diff options
author | Koen Kooi <koen@dominion.thruhere.net> | 2012-03-26 08:52:27 -0500 |
---|---|---|
committer | Denys Dmytriyenko <denys@ti.com> | 2012-03-30 19:04:44 -0400 |
commit | 7df8fc578b63662ec03ad3e69ecc6f04f7d77fb8 (patch) | |
tree | 3dcbd22c5b3298ab871b5cd2a02fb148af17778e /recipes-kernel/linux/linux-ti33x-psp-3.2 | |
parent | c5bb2de92249f802c7a038401b696be9c636895a (diff) | |
download | meta-ti-7df8fc578b63662ec03ad3e69ecc6f04f7d77fb8.tar.gz |
linux-ti33x-psp 3.2: update to 3.2.13
Signed-off-by: Koen Kooi <koen@dominion.thruhere.net>
Signed-off-by: Denys Dmytriyenko <denys@ti.com>
Diffstat (limited to 'recipes-kernel/linux/linux-ti33x-psp-3.2')
53 files changed, 3817 insertions, 1 deletions
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0001-ASoC-neo1973-fix-neo1973-wm8753-initialization.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0001-ASoC-neo1973-fix-neo1973-wm8753-initialization.patch new file mode 100644 index 00000000..d25417a3 --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0001-ASoC-neo1973-fix-neo1973-wm8753-initialization.patch | |||
@@ -0,0 +1,42 @@ | |||
1 | From a1d89c5f542755e8508b072a1d2f9b295c6c028c Mon Sep 17 00:00:00 2001 | ||
2 | From: Denis 'GNUtoo' Carikli <GNUtoo@no-log.org> | ||
3 | Date: Sun, 26 Feb 2012 19:21:54 +0100 | ||
4 | Subject: [PATCH 01/42] ASoC: neo1973: fix neo1973 wm8753 initialization | ||
5 | |||
6 | commit b2ccf065f7b23147ed135a41b01d05a332ca6b7e upstream. | ||
7 | |||
8 | The neo1973 driver had wrong codec name which prevented the "sound card" | ||
9 | from appearing. | ||
10 | |||
11 | Signed-off-by: Denis 'GNUtoo' Carikli <GNUtoo@no-log.org> | ||
12 | Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com> | ||
13 | Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | ||
14 | --- | ||
15 | sound/soc/samsung/neo1973_wm8753.c | 4 ++-- | ||
16 | 1 file changed, 2 insertions(+), 2 deletions(-) | ||
17 | |||
18 | diff --git a/sound/soc/samsung/neo1973_wm8753.c b/sound/soc/samsung/neo1973_wm8753.c | ||
19 | index 7207189..2fba3f7 100644 | ||
20 | --- a/sound/soc/samsung/neo1973_wm8753.c | ||
21 | +++ b/sound/soc/samsung/neo1973_wm8753.c | ||
22 | @@ -421,7 +421,7 @@ static struct snd_soc_dai_link neo1973_dai[] = { | ||
23 | .platform_name = "samsung-audio", | ||
24 | .cpu_dai_name = "s3c24xx-iis", | ||
25 | .codec_dai_name = "wm8753-hifi", | ||
26 | - .codec_name = "wm8753-codec.0-001a", | ||
27 | + .codec_name = "wm8753.0-001a", | ||
28 | .init = neo1973_wm8753_init, | ||
29 | .ops = &neo1973_hifi_ops, | ||
30 | }, | ||
31 | @@ -430,7 +430,7 @@ static struct snd_soc_dai_link neo1973_dai[] = { | ||
32 | .stream_name = "Voice", | ||
33 | .cpu_dai_name = "dfbmcs320-pcm", | ||
34 | .codec_dai_name = "wm8753-voice", | ||
35 | - .codec_name = "wm8753-codec.0-001a", | ||
36 | + .codec_name = "wm8753.0-001a", | ||
37 | .ops = &neo1973_voice_ops, | ||
38 | }, | ||
39 | }; | ||
40 | -- | ||
41 | 1.7.9.4 | ||
42 | |||
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0002-ALSA-hda-realtek-Apply-the-coef-setup-only-to-ALC269.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0002-ALSA-hda-realtek-Apply-the-coef-setup-only-to-ALC269.patch new file mode 100644 index 00000000..b11376b7 --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0002-ALSA-hda-realtek-Apply-the-coef-setup-only-to-ALC269.patch | |||
@@ -0,0 +1,56 @@ | |||
1 | From 87e095818ba51e16500206f1507590d8cd3127ef Mon Sep 17 00:00:00 2001 | ||
2 | From: Kailang Yang <kailang@realtek.com> | ||
3 | Date: Wed, 7 Mar 2012 08:25:20 +0100 | ||
4 | Subject: [PATCH 02/42] ALSA: hda/realtek - Apply the coef-setup only to | ||
5 | ALC269VB | ||
6 | |||
7 | commit 526af6eb4dc71302f59806e2ccac7793963a7fe0 upstream. | ||
8 | |||
9 | The coef setup in alc269_fill_coef() was designed only for ALC269VB | ||
10 | model, and this has some bad effects for other ALC269 variants, such | ||
11 | as turning off the external mic input. Apply it only to ALC269VB. | ||
12 | |||
13 | Signed-off-by: Kailang Yang <kailang@realtek.com> | ||
14 | Signed-off-by: Takashi Iwai <tiwai@suse.de> | ||
15 | Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | ||
16 | --- | ||
17 | sound/pci/hda/patch_realtek.c | 8 ++++++++ | ||
18 | 1 file changed, 8 insertions(+) | ||
19 | |||
20 | diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c | ||
21 | index 3d8fbf4..dc8a6fc 100644 | ||
22 | --- a/sound/pci/hda/patch_realtek.c | ||
23 | +++ b/sound/pci/hda/patch_realtek.c | ||
24 | @@ -2063,12 +2063,16 @@ static int alc_build_controls(struct hda_codec *codec) | ||
25 | */ | ||
26 | |||
27 | static void alc_init_special_input_src(struct hda_codec *codec); | ||
28 | +static int alc269_fill_coef(struct hda_codec *codec); | ||
29 | |||
30 | static int alc_init(struct hda_codec *codec) | ||
31 | { | ||
32 | struct alc_spec *spec = codec->spec; | ||
33 | unsigned int i; | ||
34 | |||
35 | + if (codec->vendor_id == 0x10ec0269) | ||
36 | + alc269_fill_coef(codec); | ||
37 | + | ||
38 | alc_fix_pll(codec); | ||
39 | alc_auto_init_amp(codec, spec->init_amp); | ||
40 | |||
41 | @@ -5110,8 +5114,12 @@ static const struct alc_model_fixup alc269_fixup_models[] = { | ||
42 | |||
43 | static int alc269_fill_coef(struct hda_codec *codec) | ||
44 | { | ||
45 | + struct alc_spec *spec = codec->spec; | ||
46 | int val; | ||
47 | |||
48 | + if (spec->codec_variant != ALC269_TYPE_ALC269VB) | ||
49 | + return 0; | ||
50 | + | ||
51 | if ((alc_get_coef0(codec) & 0x00ff) < 0x015) { | ||
52 | alc_write_coef_idx(codec, 0xf, 0x960b); | ||
53 | alc_write_coef_idx(codec, 0xe, 0x8817); | ||
54 | -- | ||
55 | 1.7.9.4 | ||
56 | |||
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0003-aio-fix-io_setup-io_destroy-race.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0003-aio-fix-io_setup-io_destroy-race.patch new file mode 100644 index 00000000..a01113a3 --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0003-aio-fix-io_setup-io_destroy-race.patch | |||
@@ -0,0 +1,54 @@ | |||
1 | From e5459681303b77f0525bb3311ce20b05e570ae04 Mon Sep 17 00:00:00 2001 | ||
2 | From: Al Viro <viro@ZenIV.linux.org.uk> | ||
3 | Date: Wed, 7 Mar 2012 05:16:35 +0000 | ||
4 | Subject: [PATCH 03/42] aio: fix io_setup/io_destroy race | ||
5 | |||
6 | commit 86b62a2cb4fc09037bbce2959d2992962396fd7f upstream. | ||
7 | |||
8 | Have ioctx_alloc() return an extra reference, so that caller would drop it | ||
9 | on success and not bother with re-grabbing it on failure exit. The current | ||
10 | code is obviously broken - io_destroy() from another thread that managed | ||
11 | to guess the address io_setup() would've returned would free ioctx right | ||
12 | under us; gets especially interesting if aio_context_t * we pass to | ||
13 | io_setup() points to PROT_READ mapping, so put_user() fails and we end | ||
14 | up doing io_destroy() on kioctx another thread has just got freed... | ||
15 | |||
16 | Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> | ||
17 | Acked-by: Benjamin LaHaise <bcrl@kvack.org> | ||
18 | Reviewed-by: Jeff Moyer <jmoyer@redhat.com> | ||
19 | Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> | ||
20 | Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | ||
21 | --- | ||
22 | fs/aio.c | 8 ++++---- | ||
23 | 1 file changed, 4 insertions(+), 4 deletions(-) | ||
24 | |||
25 | diff --git a/fs/aio.c b/fs/aio.c | ||
26 | index 67e4b90..f6578cb 100644 | ||
27 | --- a/fs/aio.c | ||
28 | +++ b/fs/aio.c | ||
29 | @@ -273,7 +273,7 @@ static struct kioctx *ioctx_alloc(unsigned nr_events) | ||
30 | mm = ctx->mm = current->mm; | ||
31 | atomic_inc(&mm->mm_count); | ||
32 | |||
33 | - atomic_set(&ctx->users, 1); | ||
34 | + atomic_set(&ctx->users, 2); | ||
35 | spin_lock_init(&ctx->ctx_lock); | ||
36 | spin_lock_init(&ctx->ring_info.ring_lock); | ||
37 | init_waitqueue_head(&ctx->wait); | ||
38 | @@ -1338,10 +1338,10 @@ SYSCALL_DEFINE2(io_setup, unsigned, nr_events, aio_context_t __user *, ctxp) | ||
39 | ret = PTR_ERR(ioctx); | ||
40 | if (!IS_ERR(ioctx)) { | ||
41 | ret = put_user(ioctx->user_id, ctxp); | ||
42 | - if (!ret) | ||
43 | + if (!ret) { | ||
44 | + put_ioctx(ioctx); | ||
45 | return 0; | ||
46 | - | ||
47 | - get_ioctx(ioctx); /* io_destroy() expects us to hold a ref */ | ||
48 | + } | ||
49 | io_destroy(ioctx); | ||
50 | } | ||
51 | |||
52 | -- | ||
53 | 1.7.9.4 | ||
54 | |||
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0004-aio-fix-the-too-late-munmap-race.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0004-aio-fix-the-too-late-munmap-race.patch new file mode 100644 index 00000000..00ba981a --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0004-aio-fix-the-too-late-munmap-race.patch | |||
@@ -0,0 +1,81 @@ | |||
1 | From a0e1937b89ad227fad39dd1f0edb83d57dc46c12 Mon Sep 17 00:00:00 2001 | ||
2 | From: Al Viro <viro@ZenIV.linux.org.uk> | ||
3 | Date: Thu, 8 Mar 2012 17:51:19 +0000 | ||
4 | Subject: [PATCH 04/42] aio: fix the "too late munmap()" race | ||
5 | |||
6 | commit c7b285550544c22bc005ec20978472c9ac7138c6 upstream. | ||
7 | |||
8 | Current code has put_ioctx() called asynchronously from aio_fput_routine(); | ||
9 | that's done *after* we have killed the request that used to pin ioctx, | ||
10 | so there's nothing to stop io_destroy() waiting in wait_for_all_aios() | ||
11 | from progressing. As the result, we can end up with async call of | ||
12 | put_ioctx() being the last one and possibly happening during exit_mmap() | ||
13 | or elf_core_dump(), neither of which expects stray munmap() being done | ||
14 | to them... | ||
15 | |||
16 | We do need to prevent _freeing_ ioctx until aio_fput_routine() is done | ||
17 | with that, but that's all we care about - neither io_destroy() nor | ||
18 | exit_aio() will progress past wait_for_all_aios() until aio_fput_routine() | ||
19 | does really_put_req(), so the ioctx teardown won't be done until then | ||
20 | and we don't care about the contents of ioctx past that point. | ||
21 | |||
22 | Since actual freeing of these suckers is RCU-delayed, we don't need to | ||
23 | bump ioctx refcount when request goes into list for async removal. | ||
24 | All we need is rcu_read_lock held just over the ->ctx_lock-protected | ||
25 | area in aio_fput_routine(). | ||
26 | |||
27 | Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> | ||
28 | Reviewed-by: Jeff Moyer <jmoyer@redhat.com> | ||
29 | Acked-by: Benjamin LaHaise <bcrl@kvack.org> | ||
30 | Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> | ||
31 | Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | ||
32 | --- | ||
33 | fs/aio.c | 14 ++++++-------- | ||
34 | 1 file changed, 6 insertions(+), 8 deletions(-) | ||
35 | |||
36 | diff --git a/fs/aio.c b/fs/aio.c | ||
37 | index f6578cb..b9d64d8 100644 | ||
38 | --- a/fs/aio.c | ||
39 | +++ b/fs/aio.c | ||
40 | @@ -228,12 +228,6 @@ static void __put_ioctx(struct kioctx *ctx) | ||
41 | call_rcu(&ctx->rcu_head, ctx_rcu_free); | ||
42 | } | ||
43 | |||
44 | -static inline void get_ioctx(struct kioctx *kioctx) | ||
45 | -{ | ||
46 | - BUG_ON(atomic_read(&kioctx->users) <= 0); | ||
47 | - atomic_inc(&kioctx->users); | ||
48 | -} | ||
49 | - | ||
50 | static inline int try_get_ioctx(struct kioctx *kioctx) | ||
51 | { | ||
52 | return atomic_inc_not_zero(&kioctx->users); | ||
53 | @@ -609,11 +603,16 @@ static void aio_fput_routine(struct work_struct *data) | ||
54 | fput(req->ki_filp); | ||
55 | |||
56 | /* Link the iocb into the context's free list */ | ||
57 | + rcu_read_lock(); | ||
58 | spin_lock_irq(&ctx->ctx_lock); | ||
59 | really_put_req(ctx, req); | ||
60 | + /* | ||
61 | + * at that point ctx might've been killed, but actual | ||
62 | + * freeing is RCU'd | ||
63 | + */ | ||
64 | spin_unlock_irq(&ctx->ctx_lock); | ||
65 | + rcu_read_unlock(); | ||
66 | |||
67 | - put_ioctx(ctx); | ||
68 | spin_lock_irq(&fput_lock); | ||
69 | } | ||
70 | spin_unlock_irq(&fput_lock); | ||
71 | @@ -644,7 +643,6 @@ static int __aio_put_req(struct kioctx *ctx, struct kiocb *req) | ||
72 | * this function will be executed w/out any aio kthread wakeup. | ||
73 | */ | ||
74 | if (unlikely(!fput_atomic(req->ki_filp))) { | ||
75 | - get_ioctx(ctx); | ||
76 | spin_lock(&fput_lock); | ||
77 | list_add(&req->ki_list, &fput_head); | ||
78 | spin_unlock(&fput_lock); | ||
79 | -- | ||
80 | 1.7.9.4 | ||
81 | |||
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0005-x86-Derandom-delay_tsc-for-64-bit.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0005-x86-Derandom-delay_tsc-for-64-bit.patch new file mode 100644 index 00000000..29ebbbad --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0005-x86-Derandom-delay_tsc-for-64-bit.patch | |||
@@ -0,0 +1,63 @@ | |||
1 | From fc10b28e82caa4d0a793b9ec9657dedbd1c2afd8 Mon Sep 17 00:00:00 2001 | ||
2 | From: Thomas Gleixner <tglx@linutronix.de> | ||
3 | Date: Fri, 9 Mar 2012 20:55:10 +0100 | ||
4 | Subject: [PATCH 05/42] x86: Derandom delay_tsc for 64 bit | ||
5 | |||
6 | commit a7f4255f906f60f72e00aad2fb000939449ff32e upstream. | ||
7 | |||
8 | Commit f0fbf0abc093 ("x86: integrate delay functions") converted | ||
9 | delay_tsc() into a random delay generator for 64 bit. The reason is | ||
10 | that it merged the mostly identical versions of delay_32.c and | ||
11 | delay_64.c. Though the subtle difference of the result was: | ||
12 | |||
13 | static void delay_tsc(unsigned long loops) | ||
14 | { | ||
15 | - unsigned bclock, now; | ||
16 | + unsigned long bclock, now; | ||
17 | |||
18 | Now the function uses rdtscl() which returns the lower 32bit of the | ||
19 | TSC. On 32bit that's not problematic as unsigned long is 32bit. On 64 | ||
20 | bit this fails when the lower 32bit are close to wrap around when | ||
21 | bclock is read, because the following check | ||
22 | |||
23 | if ((now - bclock) >= loops) | ||
24 | break; | ||
25 | |||
26 | evaluated to true on 64bit for e.g. bclock = 0xffffffff and now = 0 | ||
27 | because the unsigned long (now - bclock) of these values results in | ||
28 | 0xffffffff00000001 which is definitely larger than the loops | ||
29 | value. That explains Tvortkos observation: | ||
30 | |||
31 | "Because I am seeing udelay(500) (_occasionally_) being short, and | ||
32 | that by delaying for some duration between 0us (yep) and 491us." | ||
33 | |||
34 | Make those variables explicitely u32 again, so this works for both 32 | ||
35 | and 64 bit. | ||
36 | |||
37 | Reported-by: Tvrtko Ursulin <tvrtko.ursulin@onelan.co.uk> | ||
38 | Signed-off-by: Thomas Gleixner <tglx@linutronix.de> | ||
39 | Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> | ||
40 | Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | ||
41 | --- | ||
42 | arch/x86/lib/delay.c | 4 ++-- | ||
43 | 1 file changed, 2 insertions(+), 2 deletions(-) | ||
44 | |||
45 | diff --git a/arch/x86/lib/delay.c b/arch/x86/lib/delay.c | ||
46 | index fc45ba8..e395693 100644 | ||
47 | --- a/arch/x86/lib/delay.c | ||
48 | +++ b/arch/x86/lib/delay.c | ||
49 | @@ -48,9 +48,9 @@ static void delay_loop(unsigned long loops) | ||
50 | } | ||
51 | |||
52 | /* TSC based delay: */ | ||
53 | -static void delay_tsc(unsigned long loops) | ||
54 | +static void delay_tsc(unsigned long __loops) | ||
55 | { | ||
56 | - unsigned long bclock, now; | ||
57 | + u32 bclock, now, loops = __loops; | ||
58 | int cpu; | ||
59 | |||
60 | preempt_disable(); | ||
61 | -- | ||
62 | 1.7.9.4 | ||
63 | |||
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0006-PCI-ignore-pre-1.1-ASPM-quirking-when-ASPM-is-disabl.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0006-PCI-ignore-pre-1.1-ASPM-quirking-when-ASPM-is-disabl.patch new file mode 100644 index 00000000..6129b69c --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0006-PCI-ignore-pre-1.1-ASPM-quirking-when-ASPM-is-disabl.patch | |||
@@ -0,0 +1,38 @@ | |||
1 | From 7d3540104ba156ddc2a80f5c9608958faad01cec Mon Sep 17 00:00:00 2001 | ||
2 | From: Matthew Garrett <mjg@redhat.com> | ||
3 | Date: Tue, 6 Mar 2012 13:41:49 -0500 | ||
4 | Subject: [PATCH 06/42] PCI: ignore pre-1.1 ASPM quirking when ASPM is | ||
5 | disabled | ||
6 | |||
7 | commit 4949be16822e92a18ea0cc1616319926628092ee upstream. | ||
8 | |||
9 | Right now we won't touch ASPM state if ASPM is disabled, except in the case | ||
10 | where we find a device that appears to be too old to reliably support ASPM. | ||
11 | Right now we'll clear it in that case, which is almost certainly the wrong | ||
12 | thing to do. The easiest way around this is just to disable the blacklisting | ||
13 | when ASPM is disabled. | ||
14 | |||
15 | Signed-off-by: Matthew Garrett <mjg@redhat.com> | ||
16 | Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org> | ||
17 | Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | ||
18 | --- | ||
19 | drivers/pci/pcie/aspm.c | 3 +++ | ||
20 | 1 file changed, 3 insertions(+) | ||
21 | |||
22 | diff --git a/drivers/pci/pcie/aspm.c b/drivers/pci/pcie/aspm.c | ||
23 | index 1cfbf22..24f049e 100644 | ||
24 | --- a/drivers/pci/pcie/aspm.c | ||
25 | +++ b/drivers/pci/pcie/aspm.c | ||
26 | @@ -500,6 +500,9 @@ static int pcie_aspm_sanity_check(struct pci_dev *pdev) | ||
27 | int pos; | ||
28 | u32 reg32; | ||
29 | |||
30 | + if (aspm_disabled) | ||
31 | + return 0; | ||
32 | + | ||
33 | /* | ||
34 | * Some functions in a slot might not all be PCIe functions, | ||
35 | * very strange. Disable ASPM for the whole slot | ||
36 | -- | ||
37 | 1.7.9.4 | ||
38 | |||
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0007-omap3isp-ccdc-Fix-crash-in-HS-VS-interrupt-handler.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0007-omap3isp-ccdc-Fix-crash-in-HS-VS-interrupt-handler.patch new file mode 100644 index 00000000..a5c82fdb --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0007-omap3isp-ccdc-Fix-crash-in-HS-VS-interrupt-handler.patch | |||
@@ -0,0 +1,40 @@ | |||
1 | From 53af81856eb79f36e3c497dd12c3875c3c340411 Mon Sep 17 00:00:00 2001 | ||
2 | From: Laurent Pinchart <laurent.pinchart@ideasonboard.com> | ||
3 | Date: Fri, 11 Nov 2011 11:22:20 -0300 | ||
4 | Subject: [PATCH 07/42] omap3isp: ccdc: Fix crash in HS/VS interrupt handler | ||
5 | |||
6 | commit bd0f2e6da7ea9e225cb2dbd3229e25584b0e9538 upstream. | ||
7 | |||
8 | The HS/VS interrupt handler needs to access the pipeline object. It | ||
9 | erronously tries to get it from the CCDC output video node, which isn't | ||
10 | necessarily included in the pipeline. This leads to a NULL pointer | ||
11 | dereference. | ||
12 | |||
13 | Fix the bug by getting the pipeline object from the CCDC subdev entity. | ||
14 | |||
15 | Reported-by: Gary Thomas <gary@mlbassoc.com> | ||
16 | Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> | ||
17 | Acked-by: Sakari Ailus <sakari.ailus@iki.fi> | ||
18 | Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com> | ||
19 | Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | ||
20 | --- | ||
21 | drivers/media/video/omap3isp/ispccdc.c | 3 +-- | ||
22 | 1 file changed, 1 insertion(+), 2 deletions(-) | ||
23 | |||
24 | diff --git a/drivers/media/video/omap3isp/ispccdc.c b/drivers/media/video/omap3isp/ispccdc.c | ||
25 | index 54a4a3f..a319281 100644 | ||
26 | --- a/drivers/media/video/omap3isp/ispccdc.c | ||
27 | +++ b/drivers/media/video/omap3isp/ispccdc.c | ||
28 | @@ -1406,8 +1406,7 @@ static int __ccdc_handle_stopping(struct isp_ccdc_device *ccdc, u32 event) | ||
29 | |||
30 | static void ccdc_hs_vs_isr(struct isp_ccdc_device *ccdc) | ||
31 | { | ||
32 | - struct isp_pipeline *pipe = | ||
33 | - to_isp_pipeline(&ccdc->video_out.video.entity); | ||
34 | + struct isp_pipeline *pipe = to_isp_pipeline(&ccdc->subdev.entity); | ||
35 | struct video_device *vdev = ccdc->subdev.devnode; | ||
36 | struct v4l2_event event; | ||
37 | |||
38 | -- | ||
39 | 1.7.9.4 | ||
40 | |||
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0008-rt2x00-fix-random-stalls.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0008-rt2x00-fix-random-stalls.patch new file mode 100644 index 00000000..17845262 --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0008-rt2x00-fix-random-stalls.patch | |||
@@ -0,0 +1,99 @@ | |||
1 | From c27583afc5c12c3731697b41e6a7c4fa2a239fae Mon Sep 17 00:00:00 2001 | ||
2 | From: Stanislaw Gruszka <sgruszka@redhat.com> | ||
3 | Date: Fri, 9 Mar 2012 12:39:54 +0100 | ||
4 | Subject: [PATCH 08/42] rt2x00: fix random stalls | ||
5 | |||
6 | commit 3780d038fdf4b5ef26ead10b0604ab1f46dd9510 upstream. | ||
7 | |||
8 | Is possible that we stop queue and then do not wake up it again, | ||
9 | especially when packets are transmitted fast. That can be easily | ||
10 | reproduced with modified tx queue entry_num to some small value e.g. 16. | ||
11 | |||
12 | If mac80211 already hold local->queue_stop_reason_lock, then we can wait | ||
13 | on that lock in both rt2x00queue_pause_queue() and | ||
14 | rt2x00queue_unpause_queue(). After drooping ->queue_stop_reason_lock | ||
15 | is possible that __ieee80211_wake_queue() will be performed before | ||
16 | __ieee80211_stop_queue(), hence we stop queue and newer wake up it | ||
17 | again. | ||
18 | |||
19 | Another race condition is possible when between rt2x00queue_threshold() | ||
20 | check and rt2x00queue_pause_queue() we will process all pending tx | ||
21 | buffers on different cpu. This might happen if for example interrupt | ||
22 | will be triggered on cpu performing rt2x00mac_tx(). | ||
23 | |||
24 | To prevent race conditions serialize pause/unpause by queue->tx_lock. | ||
25 | |||
26 | Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com> | ||
27 | Acked-by: Gertjan van Wingerde <gwingerde@gmail.com> | ||
28 | Signed-off-by: John W. Linville <linville@tuxdriver.com> | ||
29 | Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | ||
30 | --- | ||
31 | drivers/net/wireless/rt2x00/rt2x00dev.c | 6 +++++- | ||
32 | drivers/net/wireless/rt2x00/rt2x00mac.c | 9 +++++++++ | ||
33 | drivers/net/wireless/rt2x00/rt2x00queue.c | 3 +++ | ||
34 | 3 files changed, 17 insertions(+), 1 deletion(-) | ||
35 | |||
36 | diff --git a/drivers/net/wireless/rt2x00/rt2x00dev.c b/drivers/net/wireless/rt2x00/rt2x00dev.c | ||
37 | index edd317f..21b529b 100644 | ||
38 | --- a/drivers/net/wireless/rt2x00/rt2x00dev.c | ||
39 | +++ b/drivers/net/wireless/rt2x00/rt2x00dev.c | ||
40 | @@ -426,10 +426,14 @@ void rt2x00lib_txdone(struct queue_entry *entry, | ||
41 | /* | ||
42 | * If the data queue was below the threshold before the txdone | ||
43 | * handler we must make sure the packet queue in the mac80211 stack | ||
44 | - * is reenabled when the txdone handler has finished. | ||
45 | + * is reenabled when the txdone handler has finished. This has to be | ||
46 | + * serialized with rt2x00mac_tx(), otherwise we can wake up queue | ||
47 | + * before it was stopped. | ||
48 | */ | ||
49 | + spin_lock_bh(&entry->queue->tx_lock); | ||
50 | if (!rt2x00queue_threshold(entry->queue)) | ||
51 | rt2x00queue_unpause_queue(entry->queue); | ||
52 | + spin_unlock_bh(&entry->queue->tx_lock); | ||
53 | } | ||
54 | EXPORT_SYMBOL_GPL(rt2x00lib_txdone); | ||
55 | |||
56 | diff --git a/drivers/net/wireless/rt2x00/rt2x00mac.c b/drivers/net/wireless/rt2x00/rt2x00mac.c | ||
57 | index bf0acff..373dae1 100644 | ||
58 | --- a/drivers/net/wireless/rt2x00/rt2x00mac.c | ||
59 | +++ b/drivers/net/wireless/rt2x00/rt2x00mac.c | ||
60 | @@ -152,13 +152,22 @@ void rt2x00mac_tx(struct ieee80211_hw *hw, struct sk_buff *skb) | ||
61 | if (unlikely(rt2x00queue_write_tx_frame(queue, skb, false))) | ||
62 | goto exit_fail; | ||
63 | |||
64 | + /* | ||
65 | + * Pausing queue has to be serialized with rt2x00lib_txdone(). Note | ||
66 | + * we should not use spin_lock_bh variant as bottom halve was already | ||
67 | + * disabled before ieee80211_xmit() call. | ||
68 | + */ | ||
69 | + spin_lock(&queue->tx_lock); | ||
70 | if (rt2x00queue_threshold(queue)) | ||
71 | rt2x00queue_pause_queue(queue); | ||
72 | + spin_unlock(&queue->tx_lock); | ||
73 | |||
74 | return; | ||
75 | |||
76 | exit_fail: | ||
77 | + spin_lock(&queue->tx_lock); | ||
78 | rt2x00queue_pause_queue(queue); | ||
79 | + spin_unlock(&queue->tx_lock); | ||
80 | exit_free_skb: | ||
81 | dev_kfree_skb_any(skb); | ||
82 | } | ||
83 | diff --git a/drivers/net/wireless/rt2x00/rt2x00queue.c b/drivers/net/wireless/rt2x00/rt2x00queue.c | ||
84 | index 5adfb3e..9b1b2b7 100644 | ||
85 | --- a/drivers/net/wireless/rt2x00/rt2x00queue.c | ||
86 | +++ b/drivers/net/wireless/rt2x00/rt2x00queue.c | ||
87 | @@ -619,6 +619,9 @@ int rt2x00queue_write_tx_frame(struct data_queue *queue, struct sk_buff *skb, | ||
88 | else if (test_bit(REQUIRE_DMA, &queue->rt2x00dev->cap_flags)) | ||
89 | rt2x00queue_align_frame(skb); | ||
90 | |||
91 | + /* | ||
92 | + * That function must be called with bh disabled. | ||
93 | + */ | ||
94 | spin_lock(&queue->tx_lock); | ||
95 | |||
96 | if (unlikely(rt2x00queue_full(queue))) { | ||
97 | -- | ||
98 | 1.7.9.4 | ||
99 | |||
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0009-perf-x86-Fix-local-vs-remote-memory-events-for-NHM-W.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0009-perf-x86-Fix-local-vs-remote-memory-events-for-NHM-W.patch new file mode 100644 index 00000000..d57e5e31 --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0009-perf-x86-Fix-local-vs-remote-memory-events-for-NHM-W.patch | |||
@@ -0,0 +1,222 @@ | |||
1 | From 1c301a267126e6e01056eda0164a67731b738f5f Mon Sep 17 00:00:00 2001 | ||
2 | From: Peter Zijlstra <a.p.zijlstra@chello.nl> | ||
3 | Date: Mon, 5 Mar 2012 23:59:25 +0100 | ||
4 | Subject: [PATCH 09/42] perf/x86: Fix local vs remote memory events for | ||
5 | NHM/WSM | ||
6 | |||
7 | commit 87e24f4b67e68d9fd8df16e0bf9c66d1ad2a2533 upstream. | ||
8 | |||
9 | Verified using the below proglet.. before: | ||
10 | |||
11 | [root@westmere ~]# perf stat -e node-stores -e node-store-misses ./numa 0 | ||
12 | remote write | ||
13 | |||
14 | Performance counter stats for './numa 0': | ||
15 | |||
16 | 2,101,554 node-stores | ||
17 | 2,096,931 node-store-misses | ||
18 | |||
19 | 5.021546079 seconds time elapsed | ||
20 | |||
21 | [root@westmere ~]# perf stat -e node-stores -e node-store-misses ./numa 1 | ||
22 | local write | ||
23 | |||
24 | Performance counter stats for './numa 1': | ||
25 | |||
26 | 501,137 node-stores | ||
27 | 199 node-store-misses | ||
28 | |||
29 | 5.124451068 seconds time elapsed | ||
30 | |||
31 | After: | ||
32 | |||
33 | [root@westmere ~]# perf stat -e node-stores -e node-store-misses ./numa 0 | ||
34 | remote write | ||
35 | |||
36 | Performance counter stats for './numa 0': | ||
37 | |||
38 | 2,107,516 node-stores | ||
39 | 2,097,187 node-store-misses | ||
40 | |||
41 | 5.012755149 seconds time elapsed | ||
42 | |||
43 | [root@westmere ~]# perf stat -e node-stores -e node-store-misses ./numa 1 | ||
44 | local write | ||
45 | |||
46 | Performance counter stats for './numa 1': | ||
47 | |||
48 | 2,063,355 node-stores | ||
49 | 165 node-store-misses | ||
50 | |||
51 | 5.082091494 seconds time elapsed | ||
52 | |||
53 | #define _GNU_SOURCE | ||
54 | |||
55 | #include <sched.h> | ||
56 | #include <stdio.h> | ||
57 | #include <errno.h> | ||
58 | #include <sys/mman.h> | ||
59 | #include <sys/types.h> | ||
60 | #include <dirent.h> | ||
61 | #include <signal.h> | ||
62 | #include <unistd.h> | ||
63 | #include <numaif.h> | ||
64 | #include <stdlib.h> | ||
65 | |||
66 | #define SIZE (32*1024*1024) | ||
67 | |||
68 | volatile int done; | ||
69 | |||
70 | void sig_done(int sig) | ||
71 | { | ||
72 | done = 1; | ||
73 | } | ||
74 | |||
75 | int main(int argc, char **argv) | ||
76 | { | ||
77 | cpu_set_t *mask, *mask2; | ||
78 | size_t size; | ||
79 | int i, err, t; | ||
80 | int nrcpus = 1024; | ||
81 | char *mem; | ||
82 | unsigned long nodemask = 0x01; /* node 0 */ | ||
83 | DIR *node; | ||
84 | struct dirent *de; | ||
85 | int read = 0; | ||
86 | int local = 0; | ||
87 | |||
88 | if (argc < 2) { | ||
89 | printf("usage: %s [0-3]\n", argv[0]); | ||
90 | printf(" bit0 - local/remote\n"); | ||
91 | printf(" bit1 - read/write\n"); | ||
92 | exit(0); | ||
93 | } | ||
94 | |||
95 | switch (atoi(argv[1])) { | ||
96 | case 0: | ||
97 | printf("remote write\n"); | ||
98 | break; | ||
99 | case 1: | ||
100 | printf("local write\n"); | ||
101 | local = 1; | ||
102 | break; | ||
103 | case 2: | ||
104 | printf("remote read\n"); | ||
105 | read = 1; | ||
106 | break; | ||
107 | case 3: | ||
108 | printf("local read\n"); | ||
109 | local = 1; | ||
110 | read = 1; | ||
111 | break; | ||
112 | } | ||
113 | |||
114 | mask = CPU_ALLOC(nrcpus); | ||
115 | size = CPU_ALLOC_SIZE(nrcpus); | ||
116 | CPU_ZERO_S(size, mask); | ||
117 | |||
118 | node = opendir("/sys/devices/system/node/node0/"); | ||
119 | if (!node) | ||
120 | perror("opendir"); | ||
121 | while ((de = readdir(node))) { | ||
122 | int cpu; | ||
123 | |||
124 | if (sscanf(de->d_name, "cpu%d", &cpu) == 1) | ||
125 | CPU_SET_S(cpu, size, mask); | ||
126 | } | ||
127 | closedir(node); | ||
128 | |||
129 | mask2 = CPU_ALLOC(nrcpus); | ||
130 | CPU_ZERO_S(size, mask2); | ||
131 | for (i = 0; i < size; i++) | ||
132 | CPU_SET_S(i, size, mask2); | ||
133 | CPU_XOR_S(size, mask2, mask2, mask); // invert | ||
134 | |||
135 | if (!local) | ||
136 | mask = mask2; | ||
137 | |||
138 | err = sched_setaffinity(0, size, mask); | ||
139 | if (err) | ||
140 | perror("sched_setaffinity"); | ||
141 | |||
142 | mem = mmap(0, SIZE, PROT_READ|PROT_WRITE, | ||
143 | MAP_PRIVATE|MAP_ANONYMOUS, -1, 0); | ||
144 | err = mbind(mem, SIZE, MPOL_BIND, &nodemask, 8*sizeof(nodemask), MPOL_MF_MOVE); | ||
145 | if (err) | ||
146 | perror("mbind"); | ||
147 | |||
148 | signal(SIGALRM, sig_done); | ||
149 | alarm(5); | ||
150 | |||
151 | if (!read) { | ||
152 | while (!done) { | ||
153 | for (i = 0; i < SIZE; i++) | ||
154 | mem[i] = 0x01; | ||
155 | } | ||
156 | } else { | ||
157 | while (!done) { | ||
158 | for (i = 0; i < SIZE; i++) | ||
159 | t += *(volatile char *)(mem + i); | ||
160 | } | ||
161 | } | ||
162 | |||
163 | return 0; | ||
164 | } | ||
165 | |||
166 | Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl> | ||
167 | Cc: Stephane Eranian <eranian@google.com> | ||
168 | Link: http://lkml.kernel.org/n/tip-tq73sxus35xmqpojf7ootxgs@git.kernel.org | ||
169 | Signed-off-by: Ingo Molnar <mingo@elte.hu> | ||
170 | Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | ||
171 | --- | ||
172 | arch/x86/kernel/cpu/perf_event_intel.c | 17 +++++++++-------- | ||
173 | 1 file changed, 9 insertions(+), 8 deletions(-) | ||
174 | |||
175 | diff --git a/arch/x86/kernel/cpu/perf_event_intel.c b/arch/x86/kernel/cpu/perf_event_intel.c | ||
176 | index 121f1be..957c216 100644 | ||
177 | --- a/arch/x86/kernel/cpu/perf_event_intel.c | ||
178 | +++ b/arch/x86/kernel/cpu/perf_event_intel.c | ||
179 | @@ -389,14 +389,15 @@ static __initconst const u64 westmere_hw_cache_event_ids | ||
180 | #define NHM_LOCAL_DRAM (1 << 14) | ||
181 | #define NHM_NON_DRAM (1 << 15) | ||
182 | |||
183 | -#define NHM_ALL_DRAM (NHM_REMOTE_DRAM|NHM_LOCAL_DRAM) | ||
184 | +#define NHM_LOCAL (NHM_LOCAL_DRAM|NHM_REMOTE_CACHE_FWD) | ||
185 | +#define NHM_REMOTE (NHM_REMOTE_DRAM) | ||
186 | |||
187 | #define NHM_DMND_READ (NHM_DMND_DATA_RD) | ||
188 | #define NHM_DMND_WRITE (NHM_DMND_RFO|NHM_DMND_WB) | ||
189 | #define NHM_DMND_PREFETCH (NHM_PF_DATA_RD|NHM_PF_DATA_RFO) | ||
190 | |||
191 | #define NHM_L3_HIT (NHM_UNCORE_HIT|NHM_OTHER_CORE_HIT_SNP|NHM_OTHER_CORE_HITM) | ||
192 | -#define NHM_L3_MISS (NHM_NON_DRAM|NHM_ALL_DRAM|NHM_REMOTE_CACHE_FWD) | ||
193 | +#define NHM_L3_MISS (NHM_NON_DRAM|NHM_LOCAL_DRAM|NHM_REMOTE_DRAM|NHM_REMOTE_CACHE_FWD) | ||
194 | #define NHM_L3_ACCESS (NHM_L3_HIT|NHM_L3_MISS) | ||
195 | |||
196 | static __initconst const u64 nehalem_hw_cache_extra_regs | ||
197 | @@ -420,16 +421,16 @@ static __initconst const u64 nehalem_hw_cache_extra_regs | ||
198 | }, | ||
199 | [ C(NODE) ] = { | ||
200 | [ C(OP_READ) ] = { | ||
201 | - [ C(RESULT_ACCESS) ] = NHM_DMND_READ|NHM_ALL_DRAM, | ||
202 | - [ C(RESULT_MISS) ] = NHM_DMND_READ|NHM_REMOTE_DRAM, | ||
203 | + [ C(RESULT_ACCESS) ] = NHM_DMND_READ|NHM_LOCAL|NHM_REMOTE, | ||
204 | + [ C(RESULT_MISS) ] = NHM_DMND_READ|NHM_REMOTE, | ||
205 | }, | ||
206 | [ C(OP_WRITE) ] = { | ||
207 | - [ C(RESULT_ACCESS) ] = NHM_DMND_WRITE|NHM_ALL_DRAM, | ||
208 | - [ C(RESULT_MISS) ] = NHM_DMND_WRITE|NHM_REMOTE_DRAM, | ||
209 | + [ C(RESULT_ACCESS) ] = NHM_DMND_WRITE|NHM_LOCAL|NHM_REMOTE, | ||
210 | + [ C(RESULT_MISS) ] = NHM_DMND_WRITE|NHM_REMOTE, | ||
211 | }, | ||
212 | [ C(OP_PREFETCH) ] = { | ||
213 | - [ C(RESULT_ACCESS) ] = NHM_DMND_PREFETCH|NHM_ALL_DRAM, | ||
214 | - [ C(RESULT_MISS) ] = NHM_DMND_PREFETCH|NHM_REMOTE_DRAM, | ||
215 | + [ C(RESULT_ACCESS) ] = NHM_DMND_PREFETCH|NHM_LOCAL|NHM_REMOTE, | ||
216 | + [ C(RESULT_MISS) ] = NHM_DMND_PREFETCH|NHM_REMOTE, | ||
217 | }, | ||
218 | }, | ||
219 | }; | ||
220 | -- | ||
221 | 1.7.9.4 | ||
222 | |||
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0010-CIFS-Do-not-kmalloc-under-the-flocks-spinlock.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0010-CIFS-Do-not-kmalloc-under-the-flocks-spinlock.patch new file mode 100644 index 00000000..150144c3 --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0010-CIFS-Do-not-kmalloc-under-the-flocks-spinlock.patch | |||
@@ -0,0 +1,140 @@ | |||
1 | From 6fc4721b47d58ae599a4bb37869d4bfd41f70511 Mon Sep 17 00:00:00 2001 | ||
2 | From: Pavel Shilovsky <piastry@etersoft.ru> | ||
3 | Date: Mon, 5 Mar 2012 09:39:20 +0300 | ||
4 | Subject: [PATCH 10/42] CIFS: Do not kmalloc under the flocks spinlock | ||
5 | |||
6 | commit d5751469f210d2149cc2159ffff66cbeef6da3f2 upstream. | ||
7 | |||
8 | Reorganize the code to make the memory already allocated before | ||
9 | spinlock'ed loop. | ||
10 | |||
11 | Reviewed-by: Jeff Layton <jlayton@redhat.com> | ||
12 | Signed-off-by: Pavel Shilovsky <piastry@etersoft.ru> | ||
13 | Signed-off-by: Steve French <sfrench@us.ibm.com> | ||
14 | Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | ||
15 | --- | ||
16 | fs/cifs/file.c | 69 +++++++++++++++++++++++++++++++++++++++++++++----------- | ||
17 | 1 file changed, 56 insertions(+), 13 deletions(-) | ||
18 | |||
19 | diff --git a/fs/cifs/file.c b/fs/cifs/file.c | ||
20 | index 4dd9283..5e64748 100644 | ||
21 | --- a/fs/cifs/file.c | ||
22 | +++ b/fs/cifs/file.c | ||
23 | @@ -920,16 +920,26 @@ cifs_push_mandatory_locks(struct cifsFileInfo *cfile) | ||
24 | for (lockp = &inode->i_flock; *lockp != NULL; \ | ||
25 | lockp = &(*lockp)->fl_next) | ||
26 | |||
27 | +struct lock_to_push { | ||
28 | + struct list_head llist; | ||
29 | + __u64 offset; | ||
30 | + __u64 length; | ||
31 | + __u32 pid; | ||
32 | + __u16 netfid; | ||
33 | + __u8 type; | ||
34 | +}; | ||
35 | + | ||
36 | static int | ||
37 | cifs_push_posix_locks(struct cifsFileInfo *cfile) | ||
38 | { | ||
39 | struct cifsInodeInfo *cinode = CIFS_I(cfile->dentry->d_inode); | ||
40 | struct cifs_tcon *tcon = tlink_tcon(cfile->tlink); | ||
41 | struct file_lock *flock, **before; | ||
42 | - struct cifsLockInfo *lck, *tmp; | ||
43 | + unsigned int count = 0, i = 0; | ||
44 | int rc = 0, xid, type; | ||
45 | + struct list_head locks_to_send, *el; | ||
46 | + struct lock_to_push *lck, *tmp; | ||
47 | __u64 length; | ||
48 | - struct list_head locks_to_send; | ||
49 | |||
50 | xid = GetXid(); | ||
51 | |||
52 | @@ -940,29 +950,55 @@ cifs_push_posix_locks(struct cifsFileInfo *cfile) | ||
53 | return rc; | ||
54 | } | ||
55 | |||
56 | + lock_flocks(); | ||
57 | + cifs_for_each_lock(cfile->dentry->d_inode, before) { | ||
58 | + if ((*before)->fl_flags & FL_POSIX) | ||
59 | + count++; | ||
60 | + } | ||
61 | + unlock_flocks(); | ||
62 | + | ||
63 | INIT_LIST_HEAD(&locks_to_send); | ||
64 | |||
65 | + /* | ||
66 | + * Allocating count locks is enough because no locks can be added to | ||
67 | + * the list while we are holding cinode->lock_mutex that protects | ||
68 | + * locking operations of this inode. | ||
69 | + */ | ||
70 | + for (; i < count; i++) { | ||
71 | + lck = kmalloc(sizeof(struct lock_to_push), GFP_KERNEL); | ||
72 | + if (!lck) { | ||
73 | + rc = -ENOMEM; | ||
74 | + goto err_out; | ||
75 | + } | ||
76 | + list_add_tail(&lck->llist, &locks_to_send); | ||
77 | + } | ||
78 | + | ||
79 | + i = 0; | ||
80 | + el = locks_to_send.next; | ||
81 | lock_flocks(); | ||
82 | cifs_for_each_lock(cfile->dentry->d_inode, before) { | ||
83 | + if (el == &locks_to_send) { | ||
84 | + /* something is really wrong */ | ||
85 | + cERROR(1, "Can't push all brlocks!"); | ||
86 | + break; | ||
87 | + } | ||
88 | flock = *before; | ||
89 | + if ((flock->fl_flags & FL_POSIX) == 0) | ||
90 | + continue; | ||
91 | length = 1 + flock->fl_end - flock->fl_start; | ||
92 | if (flock->fl_type == F_RDLCK || flock->fl_type == F_SHLCK) | ||
93 | type = CIFS_RDLCK; | ||
94 | else | ||
95 | type = CIFS_WRLCK; | ||
96 | - | ||
97 | - lck = cifs_lock_init(flock->fl_start, length, type, | ||
98 | - cfile->netfid); | ||
99 | - if (!lck) { | ||
100 | - rc = -ENOMEM; | ||
101 | - goto send_locks; | ||
102 | - } | ||
103 | + lck = list_entry(el, struct lock_to_push, llist); | ||
104 | lck->pid = flock->fl_pid; | ||
105 | - | ||
106 | - list_add_tail(&lck->llist, &locks_to_send); | ||
107 | + lck->netfid = cfile->netfid; | ||
108 | + lck->length = length; | ||
109 | + lck->type = type; | ||
110 | + lck->offset = flock->fl_start; | ||
111 | + i++; | ||
112 | + el = el->next; | ||
113 | } | ||
114 | - | ||
115 | -send_locks: | ||
116 | unlock_flocks(); | ||
117 | |||
118 | list_for_each_entry_safe(lck, tmp, &locks_to_send, llist) { | ||
119 | @@ -979,11 +1015,18 @@ send_locks: | ||
120 | kfree(lck); | ||
121 | } | ||
122 | |||
123 | +out: | ||
124 | cinode->can_cache_brlcks = false; | ||
125 | mutex_unlock(&cinode->lock_mutex); | ||
126 | |||
127 | FreeXid(xid); | ||
128 | return rc; | ||
129 | +err_out: | ||
130 | + list_for_each_entry_safe(lck, tmp, &locks_to_send, llist) { | ||
131 | + list_del(&lck->llist); | ||
132 | + kfree(lck); | ||
133 | + } | ||
134 | + goto out; | ||
135 | } | ||
136 | |||
137 | static int | ||
138 | -- | ||
139 | 1.7.9.4 | ||
140 | |||
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0011-vfs-fix-return-value-from-do_last.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0011-vfs-fix-return-value-from-do_last.patch new file mode 100644 index 00000000..f95b2aac --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0011-vfs-fix-return-value-from-do_last.patch | |||
@@ -0,0 +1,34 @@ | |||
1 | From f52c418abc401baac70461c9b92954f9cf77b5dc Mon Sep 17 00:00:00 2001 | ||
2 | From: Miklos Szeredi <mszeredi@suse.cz> | ||
3 | Date: Tue, 6 Mar 2012 13:56:34 +0100 | ||
4 | Subject: [PATCH 11/42] vfs: fix return value from do_last() | ||
5 | |||
6 | commit 7f6c7e62fcc123e6bd9206da99a2163fe3facc31 upstream. | ||
7 | |||
8 | complete_walk() returns either ECHILD or ESTALE. do_last() turns this into | ||
9 | ECHILD unconditionally. If not in RCU mode, this error will reach userspace | ||
10 | which is complete nonsense. | ||
11 | |||
12 | Signed-off-by: Miklos Szeredi <mszeredi@suse.cz> | ||
13 | Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> | ||
14 | Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | ||
15 | --- | ||
16 | fs/namei.c | 2 +- | ||
17 | 1 file changed, 1 insertion(+), 1 deletion(-) | ||
18 | |||
19 | diff --git a/fs/namei.c b/fs/namei.c | ||
20 | index 744e942..b8344d0 100644 | ||
21 | --- a/fs/namei.c | ||
22 | +++ b/fs/namei.c | ||
23 | @@ -2139,7 +2139,7 @@ static struct file *do_last(struct nameidata *nd, struct path *path, | ||
24 | /* sayonara */ | ||
25 | error = complete_walk(nd); | ||
26 | if (error) | ||
27 | - return ERR_PTR(-ECHILD); | ||
28 | + return ERR_PTR(error); | ||
29 | |||
30 | error = -ENOTDIR; | ||
31 | if (nd->flags & LOOKUP_DIRECTORY) { | ||
32 | -- | ||
33 | 1.7.9.4 | ||
34 | |||
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0012-vfs-fix-double-put-after-complete_walk.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0012-vfs-fix-double-put-after-complete_walk.patch new file mode 100644 index 00000000..7a88ad0c --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0012-vfs-fix-double-put-after-complete_walk.patch | |||
@@ -0,0 +1,35 @@ | |||
1 | From c2f9efa695b37b1f5e70557edfdfd36f8d186d31 Mon Sep 17 00:00:00 2001 | ||
2 | From: Miklos Szeredi <mszeredi@suse.cz> | ||
3 | Date: Tue, 6 Mar 2012 13:56:33 +0100 | ||
4 | Subject: [PATCH 12/42] vfs: fix double put after complete_walk() | ||
5 | |||
6 | commit 097b180ca09b581ef0dc24fbcfc1b227de3875df upstream. | ||
7 | |||
8 | complete_walk() already puts nd->path, no need to do it again at cleanup time. | ||
9 | |||
10 | This would result in Oopses if triggered, apparently the codepath is not too | ||
11 | well exercised. | ||
12 | |||
13 | Signed-off-by: Miklos Szeredi <mszeredi@suse.cz> | ||
14 | Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> | ||
15 | Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | ||
16 | --- | ||
17 | fs/namei.c | 2 +- | ||
18 | 1 file changed, 1 insertion(+), 1 deletion(-) | ||
19 | |||
20 | diff --git a/fs/namei.c b/fs/namei.c | ||
21 | index b8344d0..9680cef 100644 | ||
22 | --- a/fs/namei.c | ||
23 | +++ b/fs/namei.c | ||
24 | @@ -2238,7 +2238,7 @@ static struct file *do_last(struct nameidata *nd, struct path *path, | ||
25 | /* Why this, you ask? _Now_ we might have grown LOOKUP_JUMPED... */ | ||
26 | error = complete_walk(nd); | ||
27 | if (error) | ||
28 | - goto exit; | ||
29 | + return ERR_PTR(error); | ||
30 | error = -EISDIR; | ||
31 | if (S_ISDIR(nd->inode->i_mode)) | ||
32 | goto exit; | ||
33 | -- | ||
34 | 1.7.9.4 | ||
35 | |||
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0013-acer-wmi-No-wifi-rfkill-on-Lenovo-machines.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0013-acer-wmi-No-wifi-rfkill-on-Lenovo-machines.patch new file mode 100644 index 00000000..6cb9d28d --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0013-acer-wmi-No-wifi-rfkill-on-Lenovo-machines.patch | |||
@@ -0,0 +1,77 @@ | |||
1 | From 9102b08273c16ddc92444c913e81572989342a8f Mon Sep 17 00:00:00 2001 | ||
2 | From: Ike Panhc <ike.pan@canonical.com> | ||
3 | Date: Fri, 3 Feb 2012 16:46:39 +0800 | ||
4 | Subject: [PATCH 13/42] acer-wmi: No wifi rfkill on Lenovo machines | ||
5 | |||
6 | commit 461e74377cfcfc2c0d6bbdfa8fc5fbc21b052c2a upstream. | ||
7 | |||
8 | We have several reports which says acer-wmi is loaded on ideapads | ||
9 | and register rfkill for wifi which can not be unblocked. | ||
10 | |||
11 | Since ideapad-laptop also register rfkill for wifi and it works | ||
12 | reliably, it will be fine acer-wmi is not going to register rfkill | ||
13 | for wifi once VPC2004 is found. | ||
14 | |||
15 | Also put IBM0068/LEN0068 in the list. Though thinkpad_acpi has no | ||
16 | wifi rfkill capability, there are reports which says acer-wmi also | ||
17 | block wireless on Thinkpad E520/E420. | ||
18 | |||
19 | Signed-off-by: Ike Panhc <ike.pan@canonical.com> | ||
20 | Signed-off-by: Matthew Garrett <mjg@redhat.com> | ||
21 | Cc: Jonathan Nieder <jrnieder@gmail.com> | ||
22 | Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | ||
23 | --- | ||
24 | drivers/platform/x86/acer-wmi.c | 30 +++++++++++++++++++++++++++++- | ||
25 | 1 file changed, 29 insertions(+), 1 deletion(-) | ||
26 | |||
27 | diff --git a/drivers/platform/x86/acer-wmi.c b/drivers/platform/x86/acer-wmi.c | ||
28 | index b848277..1e5290b 100644 | ||
29 | --- a/drivers/platform/x86/acer-wmi.c | ||
30 | +++ b/drivers/platform/x86/acer-wmi.c | ||
31 | @@ -679,6 +679,32 @@ static acpi_status AMW0_find_mailled(void) | ||
32 | return AE_OK; | ||
33 | } | ||
34 | |||
35 | +static int AMW0_set_cap_acpi_check_device_found; | ||
36 | + | ||
37 | +static acpi_status AMW0_set_cap_acpi_check_device_cb(acpi_handle handle, | ||
38 | + u32 level, void *context, void **retval) | ||
39 | +{ | ||
40 | + AMW0_set_cap_acpi_check_device_found = 1; | ||
41 | + return AE_OK; | ||
42 | +} | ||
43 | + | ||
44 | +static const struct acpi_device_id norfkill_ids[] = { | ||
45 | + { "VPC2004", 0}, | ||
46 | + { "IBM0068", 0}, | ||
47 | + { "LEN0068", 0}, | ||
48 | + { "", 0}, | ||
49 | +}; | ||
50 | + | ||
51 | +static int AMW0_set_cap_acpi_check_device(void) | ||
52 | +{ | ||
53 | + const struct acpi_device_id *id; | ||
54 | + | ||
55 | + for (id = norfkill_ids; id->id[0]; id++) | ||
56 | + acpi_get_devices(id->id, AMW0_set_cap_acpi_check_device_cb, | ||
57 | + NULL, NULL); | ||
58 | + return AMW0_set_cap_acpi_check_device_found; | ||
59 | +} | ||
60 | + | ||
61 | static acpi_status AMW0_set_capabilities(void) | ||
62 | { | ||
63 | struct wmab_args args; | ||
64 | @@ -692,7 +718,9 @@ static acpi_status AMW0_set_capabilities(void) | ||
65 | * work. | ||
66 | */ | ||
67 | if (wmi_has_guid(AMW0_GUID2)) { | ||
68 | - interface->capability |= ACER_CAP_WIRELESS; | ||
69 | + if ((quirks != &quirk_unknown) || | ||
70 | + !AMW0_set_cap_acpi_check_device()) | ||
71 | + interface->capability |= ACER_CAP_WIRELESS; | ||
72 | return AE_OK; | ||
73 | } | ||
74 | |||
75 | -- | ||
76 | 1.7.9.4 | ||
77 | |||
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0014-atl1c-dont-use-highprio-tx-queue.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0014-atl1c-dont-use-highprio-tx-queue.patch new file mode 100644 index 00000000..72577e44 --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0014-atl1c-dont-use-highprio-tx-queue.patch | |||
@@ -0,0 +1,51 @@ | |||
1 | From 8bdd32d35e2bc723a11b475eb797a9f11e8db598 Mon Sep 17 00:00:00 2001 | ||
2 | From: Eric Dumazet <eric.dumazet@gmail.com> | ||
3 | Date: Wed, 15 Feb 2012 20:43:11 +0000 | ||
4 | Subject: [PATCH 14/42] atl1c: dont use highprio tx queue | ||
5 | |||
6 | [ Upstream commit 11aad99af6ef629ff3b05d1c9f0936589b204316 ] | ||
7 | |||
8 | This driver attempts to use two TX rings but lacks proper support : | ||
9 | |||
10 | 1) IRQ handler only takes care of TX completion on first TX ring | ||
11 | 2) the stop/start logic uses the legacy functions (for non multiqueue | ||
12 | drivers) | ||
13 | |||
14 | This means all packets witk skb mark set to 1 are sent through high | ||
15 | queue but are never cleaned and queue eventualy fills and block the | ||
16 | device, triggering the infamous "NETDEV WATCHDOG" message. | ||
17 | |||
18 | Lets use a single TX ring to fix the problem, this driver is not a real | ||
19 | multiqueue one yet. | ||
20 | |||
21 | Minimal fix for stable kernels. | ||
22 | |||
23 | Reported-by: Thomas Meyer <thomas@m3y3r.de> | ||
24 | Tested-by: Thomas Meyer <thomas@m3y3r.de> | ||
25 | Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> | ||
26 | Cc: Jay Cliburn <jcliburn@gmail.com> | ||
27 | Cc: Chris Snook <chris.snook@gmail.com> | ||
28 | Signed-off-by: David S. Miller <davem@davemloft.net> | ||
29 | Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | ||
30 | --- | ||
31 | drivers/net/ethernet/atheros/atl1c/atl1c_main.c | 4 ---- | ||
32 | 1 file changed, 4 deletions(-) | ||
33 | |||
34 | diff --git a/drivers/net/ethernet/atheros/atl1c/atl1c_main.c b/drivers/net/ethernet/atheros/atl1c/atl1c_main.c | ||
35 | index 02c7ed8..eccdcff 100644 | ||
36 | --- a/drivers/net/ethernet/atheros/atl1c/atl1c_main.c | ||
37 | +++ b/drivers/net/ethernet/atheros/atl1c/atl1c_main.c | ||
38 | @@ -2241,10 +2241,6 @@ static netdev_tx_t atl1c_xmit_frame(struct sk_buff *skb, | ||
39 | dev_info(&adapter->pdev->dev, "tx locked\n"); | ||
40 | return NETDEV_TX_LOCKED; | ||
41 | } | ||
42 | - if (skb->mark == 0x01) | ||
43 | - type = atl1c_trans_high; | ||
44 | - else | ||
45 | - type = atl1c_trans_normal; | ||
46 | |||
47 | if (atl1c_tpd_avail(adapter, type) < tpd_req) { | ||
48 | /* no enough descriptor, just stop queue */ | ||
49 | -- | ||
50 | 1.7.9.4 | ||
51 | |||
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0015-neighbour-Fixed-race-condition-at-tbl-nht.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0015-neighbour-Fixed-race-condition-at-tbl-nht.patch new file mode 100644 index 00000000..35bd0721 --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0015-neighbour-Fixed-race-condition-at-tbl-nht.patch | |||
@@ -0,0 +1,48 @@ | |||
1 | From 3ba7a3f4339ce0147ffa46086eead88cb45c9b0d Mon Sep 17 00:00:00 2001 | ||
2 | From: Michel Machado <michel@digirati.com.br> | ||
3 | Date: Tue, 21 Feb 2012 11:04:13 +0000 | ||
4 | Subject: [PATCH 15/42] neighbour: Fixed race condition at tbl->nht | ||
5 | |||
6 | [ Upstream commit 84338a6c9dbb6ff3de4749864020f8f25d86fc81 ] | ||
7 | |||
8 | When the fixed race condition happens: | ||
9 | |||
10 | 1. While function neigh_periodic_work scans the neighbor hash table | ||
11 | pointed by field tbl->nht, it unlocks and locks tbl->lock between | ||
12 | buckets in order to call cond_resched. | ||
13 | |||
14 | 2. Assume that function neigh_periodic_work calls cond_resched, that is, | ||
15 | the lock tbl->lock is available, and function neigh_hash_grow runs. | ||
16 | |||
17 | 3. Once function neigh_hash_grow finishes, and RCU calls | ||
18 | neigh_hash_free_rcu, the original struct neigh_hash_table that function | ||
19 | neigh_periodic_work was using doesn't exist anymore. | ||
20 | |||
21 | 4. Once back at neigh_periodic_work, whenever the old struct | ||
22 | neigh_hash_table is accessed, things can go badly. | ||
23 | |||
24 | Signed-off-by: Michel Machado <michel@digirati.com.br> | ||
25 | CC: "David S. Miller" <davem@davemloft.net> | ||
26 | CC: Eric Dumazet <eric.dumazet@gmail.com> | ||
27 | Signed-off-by: David S. Miller <davem@davemloft.net> | ||
28 | Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | ||
29 | --- | ||
30 | net/core/neighbour.c | 2 ++ | ||
31 | 1 file changed, 2 insertions(+) | ||
32 | |||
33 | diff --git a/net/core/neighbour.c b/net/core/neighbour.c | ||
34 | index 5ac07d3..7aafaed 100644 | ||
35 | --- a/net/core/neighbour.c | ||
36 | +++ b/net/core/neighbour.c | ||
37 | @@ -802,6 +802,8 @@ next_elt: | ||
38 | write_unlock_bh(&tbl->lock); | ||
39 | cond_resched(); | ||
40 | write_lock_bh(&tbl->lock); | ||
41 | + nht = rcu_dereference_protected(tbl->nht, | ||
42 | + lockdep_is_held(&tbl->lock)); | ||
43 | } | ||
44 | /* Cycle through all hash buckets every base_reachable_time/2 ticks. | ||
45 | * ARP entry timeouts range from 1/2 base_reachable_time to 3/2 | ||
46 | -- | ||
47 | 1.7.9.4 | ||
48 | |||
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0016-ipsec-be-careful-of-non-existing-mac-headers.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0016-ipsec-be-careful-of-non-existing-mac-headers.patch new file mode 100644 index 00000000..706cdd61 --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0016-ipsec-be-careful-of-non-existing-mac-headers.patch | |||
@@ -0,0 +1,144 @@ | |||
1 | From b38838f790c928ebeb30dbd6a06d4a26e84d54dc Mon Sep 17 00:00:00 2001 | ||
2 | From: Eric Dumazet <eric.dumazet@gmail.com> | ||
3 | Date: Thu, 23 Feb 2012 10:55:02 +0000 | ||
4 | Subject: [PATCH 16/42] ipsec: be careful of non existing mac headers | ||
5 | MIME-Version: 1.0 | ||
6 | Content-Type: text/plain; charset=UTF-8 | ||
7 | Content-Transfer-Encoding: 8bit | ||
8 | |||
9 | [ Upstream commit 03606895cd98c0a628b17324fd7b5ff15db7e3cd ] | ||
10 | |||
11 | Niccolo Belli reported ipsec crashes in case we handle a frame without | ||
12 | mac header (atm in his case) | ||
13 | |||
14 | Before copying mac header, better make sure it is present. | ||
15 | |||
16 | Bugzilla reference: https://bugzilla.kernel.org/show_bug.cgi?id=42809 | ||
17 | |||
18 | Reported-by: Niccolò Belli <darkbasic@linuxsystems.it> | ||
19 | Tested-by: Niccolò Belli <darkbasic@linuxsystems.it> | ||
20 | Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> | ||
21 | Signed-off-by: David S. Miller <davem@davemloft.net> | ||
22 | Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | ||
23 | --- | ||
24 | include/linux/skbuff.h | 10 ++++++++++ | ||
25 | net/ipv4/xfrm4_mode_beet.c | 5 +---- | ||
26 | net/ipv4/xfrm4_mode_tunnel.c | 6 ++---- | ||
27 | net/ipv6/xfrm6_mode_beet.c | 6 +----- | ||
28 | net/ipv6/xfrm6_mode_tunnel.c | 6 ++---- | ||
29 | 5 files changed, 16 insertions(+), 17 deletions(-) | ||
30 | |||
31 | diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h | ||
32 | index fe86488..6cf8b53 100644 | ||
33 | --- a/include/linux/skbuff.h | ||
34 | +++ b/include/linux/skbuff.h | ||
35 | @@ -1453,6 +1453,16 @@ static inline void skb_set_mac_header(struct sk_buff *skb, const int offset) | ||
36 | } | ||
37 | #endif /* NET_SKBUFF_DATA_USES_OFFSET */ | ||
38 | |||
39 | +static inline void skb_mac_header_rebuild(struct sk_buff *skb) | ||
40 | +{ | ||
41 | + if (skb_mac_header_was_set(skb)) { | ||
42 | + const unsigned char *old_mac = skb_mac_header(skb); | ||
43 | + | ||
44 | + skb_set_mac_header(skb, -skb->mac_len); | ||
45 | + memmove(skb_mac_header(skb), old_mac, skb->mac_len); | ||
46 | + } | ||
47 | +} | ||
48 | + | ||
49 | static inline int skb_checksum_start_offset(const struct sk_buff *skb) | ||
50 | { | ||
51 | return skb->csum_start - skb_headroom(skb); | ||
52 | diff --git a/net/ipv4/xfrm4_mode_beet.c b/net/ipv4/xfrm4_mode_beet.c | ||
53 | index 6341818..e3db3f9 100644 | ||
54 | --- a/net/ipv4/xfrm4_mode_beet.c | ||
55 | +++ b/net/ipv4/xfrm4_mode_beet.c | ||
56 | @@ -110,10 +110,7 @@ static int xfrm4_beet_input(struct xfrm_state *x, struct sk_buff *skb) | ||
57 | |||
58 | skb_push(skb, sizeof(*iph)); | ||
59 | skb_reset_network_header(skb); | ||
60 | - | ||
61 | - memmove(skb->data - skb->mac_len, skb_mac_header(skb), | ||
62 | - skb->mac_len); | ||
63 | - skb_set_mac_header(skb, -skb->mac_len); | ||
64 | + skb_mac_header_rebuild(skb); | ||
65 | |||
66 | xfrm4_beet_make_header(skb); | ||
67 | |||
68 | diff --git a/net/ipv4/xfrm4_mode_tunnel.c b/net/ipv4/xfrm4_mode_tunnel.c | ||
69 | index 534972e..ed4bf11 100644 | ||
70 | --- a/net/ipv4/xfrm4_mode_tunnel.c | ||
71 | +++ b/net/ipv4/xfrm4_mode_tunnel.c | ||
72 | @@ -66,7 +66,6 @@ static int xfrm4_mode_tunnel_output(struct xfrm_state *x, struct sk_buff *skb) | ||
73 | |||
74 | static int xfrm4_mode_tunnel_input(struct xfrm_state *x, struct sk_buff *skb) | ||
75 | { | ||
76 | - const unsigned char *old_mac; | ||
77 | int err = -EINVAL; | ||
78 | |||
79 | if (XFRM_MODE_SKB_CB(skb)->protocol != IPPROTO_IPIP) | ||
80 | @@ -84,10 +83,9 @@ static int xfrm4_mode_tunnel_input(struct xfrm_state *x, struct sk_buff *skb) | ||
81 | if (!(x->props.flags & XFRM_STATE_NOECN)) | ||
82 | ipip_ecn_decapsulate(skb); | ||
83 | |||
84 | - old_mac = skb_mac_header(skb); | ||
85 | - skb_set_mac_header(skb, -skb->mac_len); | ||
86 | - memmove(skb_mac_header(skb), old_mac, skb->mac_len); | ||
87 | skb_reset_network_header(skb); | ||
88 | + skb_mac_header_rebuild(skb); | ||
89 | + | ||
90 | err = 0; | ||
91 | |||
92 | out: | ||
93 | diff --git a/net/ipv6/xfrm6_mode_beet.c b/net/ipv6/xfrm6_mode_beet.c | ||
94 | index 3437d7d..f37cba9 100644 | ||
95 | --- a/net/ipv6/xfrm6_mode_beet.c | ||
96 | +++ b/net/ipv6/xfrm6_mode_beet.c | ||
97 | @@ -80,7 +80,6 @@ static int xfrm6_beet_output(struct xfrm_state *x, struct sk_buff *skb) | ||
98 | static int xfrm6_beet_input(struct xfrm_state *x, struct sk_buff *skb) | ||
99 | { | ||
100 | struct ipv6hdr *ip6h; | ||
101 | - const unsigned char *old_mac; | ||
102 | int size = sizeof(struct ipv6hdr); | ||
103 | int err; | ||
104 | |||
105 | @@ -90,10 +89,7 @@ static int xfrm6_beet_input(struct xfrm_state *x, struct sk_buff *skb) | ||
106 | |||
107 | __skb_push(skb, size); | ||
108 | skb_reset_network_header(skb); | ||
109 | - | ||
110 | - old_mac = skb_mac_header(skb); | ||
111 | - skb_set_mac_header(skb, -skb->mac_len); | ||
112 | - memmove(skb_mac_header(skb), old_mac, skb->mac_len); | ||
113 | + skb_mac_header_rebuild(skb); | ||
114 | |||
115 | xfrm6_beet_make_header(skb); | ||
116 | |||
117 | diff --git a/net/ipv6/xfrm6_mode_tunnel.c b/net/ipv6/xfrm6_mode_tunnel.c | ||
118 | index 4d6edff..23ecd68 100644 | ||
119 | --- a/net/ipv6/xfrm6_mode_tunnel.c | ||
120 | +++ b/net/ipv6/xfrm6_mode_tunnel.c | ||
121 | @@ -63,7 +63,6 @@ static int xfrm6_mode_tunnel_output(struct xfrm_state *x, struct sk_buff *skb) | ||
122 | static int xfrm6_mode_tunnel_input(struct xfrm_state *x, struct sk_buff *skb) | ||
123 | { | ||
124 | int err = -EINVAL; | ||
125 | - const unsigned char *old_mac; | ||
126 | |||
127 | if (XFRM_MODE_SKB_CB(skb)->protocol != IPPROTO_IPV6) | ||
128 | goto out; | ||
129 | @@ -80,10 +79,9 @@ static int xfrm6_mode_tunnel_input(struct xfrm_state *x, struct sk_buff *skb) | ||
130 | if (!(x->props.flags & XFRM_STATE_NOECN)) | ||
131 | ipip6_ecn_decapsulate(skb); | ||
132 | |||
133 | - old_mac = skb_mac_header(skb); | ||
134 | - skb_set_mac_header(skb, -skb->mac_len); | ||
135 | - memmove(skb_mac_header(skb), old_mac, skb->mac_len); | ||
136 | skb_reset_network_header(skb); | ||
137 | + skb_mac_header_rebuild(skb); | ||
138 | + | ||
139 | err = 0; | ||
140 | |||
141 | out: | ||
142 | -- | ||
143 | 1.7.9.4 | ||
144 | |||
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0017-ppp-fix-ppp_mp_reconstruct-bad-seq-errors.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0017-ppp-fix-ppp_mp_reconstruct-bad-seq-errors.patch new file mode 100644 index 00000000..fe5fd328 --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0017-ppp-fix-ppp_mp_reconstruct-bad-seq-errors.patch | |||
@@ -0,0 +1,90 @@ | |||
1 | From 486667d032b8183f75da22b245635debbfa381ca Mon Sep 17 00:00:00 2001 | ||
2 | From: Ben McKeegan <ben@netservers.co.uk> | ||
3 | Date: Fri, 24 Feb 2012 06:33:56 +0000 | ||
4 | Subject: [PATCH 17/42] ppp: fix 'ppp_mp_reconstruct bad seq' errors | ||
5 | |||
6 | [ Upstream commit 8a49ad6e89feb5015e77ce6efeb2678947117e20 ] | ||
7 | |||
8 | This patch fixes a (mostly cosmetic) bug introduced by the patch | ||
9 | 'ppp: Use SKB queue abstraction interfaces in fragment processing' | ||
10 | found here: http://www.spinics.net/lists/netdev/msg153312.html | ||
11 | |||
12 | The above patch rewrote and moved the code responsible for cleaning | ||
13 | up discarded fragments but the new code does not catch every case | ||
14 | where this is necessary. This results in some discarded fragments | ||
15 | remaining in the queue, and triggering a 'bad seq' error on the | ||
16 | subsequent call to ppp_mp_reconstruct. Fragments are discarded | ||
17 | whenever other fragments of the same frame have been lost. | ||
18 | This can generate a lot of unwanted and misleading log messages. | ||
19 | |||
20 | This patch also adds additional detail to the debug logging to | ||
21 | make it clearer which fragments were lost and which other fragments | ||
22 | were discarded as a result of losses. (Run pppd with 'kdebug 1' | ||
23 | option to enable debug logging.) | ||
24 | |||
25 | Signed-off-by: Ben McKeegan <ben@netservers.co.uk> | ||
26 | Signed-off-by: David S. Miller <davem@davemloft.net> | ||
27 | Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | ||
28 | --- | ||
29 | drivers/net/ppp/ppp_generic.c | 23 +++++++++++++++++++++++ | ||
30 | 1 file changed, 23 insertions(+) | ||
31 | |||
32 | diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c | ||
33 | index edfa15d..486b404 100644 | ||
34 | --- a/drivers/net/ppp/ppp_generic.c | ||
35 | +++ b/drivers/net/ppp/ppp_generic.c | ||
36 | @@ -2024,14 +2024,22 @@ ppp_mp_reconstruct(struct ppp *ppp) | ||
37 | continue; | ||
38 | } | ||
39 | if (PPP_MP_CB(p)->sequence != seq) { | ||
40 | + u32 oldseq; | ||
41 | /* Fragment `seq' is missing. If it is after | ||
42 | minseq, it might arrive later, so stop here. */ | ||
43 | if (seq_after(seq, minseq)) | ||
44 | break; | ||
45 | /* Fragment `seq' is lost, keep going. */ | ||
46 | lost = 1; | ||
47 | + oldseq = seq; | ||
48 | seq = seq_before(minseq, PPP_MP_CB(p)->sequence)? | ||
49 | minseq + 1: PPP_MP_CB(p)->sequence; | ||
50 | + | ||
51 | + if (ppp->debug & 1) | ||
52 | + netdev_printk(KERN_DEBUG, ppp->dev, | ||
53 | + "lost frag %u..%u\n", | ||
54 | + oldseq, seq-1); | ||
55 | + | ||
56 | goto again; | ||
57 | } | ||
58 | |||
59 | @@ -2076,6 +2084,10 @@ ppp_mp_reconstruct(struct ppp *ppp) | ||
60 | struct sk_buff *tmp2; | ||
61 | |||
62 | skb_queue_reverse_walk_from_safe(list, p, tmp2) { | ||
63 | + if (ppp->debug & 1) | ||
64 | + netdev_printk(KERN_DEBUG, ppp->dev, | ||
65 | + "discarding frag %u\n", | ||
66 | + PPP_MP_CB(p)->sequence); | ||
67 | __skb_unlink(p, list); | ||
68 | kfree_skb(p); | ||
69 | } | ||
70 | @@ -2091,6 +2103,17 @@ ppp_mp_reconstruct(struct ppp *ppp) | ||
71 | /* If we have discarded any fragments, | ||
72 | signal a receive error. */ | ||
73 | if (PPP_MP_CB(head)->sequence != ppp->nextseq) { | ||
74 | + skb_queue_walk_safe(list, p, tmp) { | ||
75 | + if (p == head) | ||
76 | + break; | ||
77 | + if (ppp->debug & 1) | ||
78 | + netdev_printk(KERN_DEBUG, ppp->dev, | ||
79 | + "discarding frag %u\n", | ||
80 | + PPP_MP_CB(p)->sequence); | ||
81 | + __skb_unlink(p, list); | ||
82 | + kfree_skb(p); | ||
83 | + } | ||
84 | + | ||
85 | if (ppp->debug & 1) | ||
86 | netdev_printk(KERN_DEBUG, ppp->dev, | ||
87 | " missed pkts %u..%u\n", | ||
88 | -- | ||
89 | 1.7.9.4 | ||
90 | |||
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0018-sfc-Fix-assignment-of-ip_summed-for-pre-allocated-sk.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0018-sfc-Fix-assignment-of-ip_summed-for-pre-allocated-sk.patch new file mode 100644 index 00000000..ac641a9b --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0018-sfc-Fix-assignment-of-ip_summed-for-pre-allocated-sk.patch | |||
@@ -0,0 +1,56 @@ | |||
1 | From 724515edd415300e12da1a3d2e84cadd6a5cd90b Mon Sep 17 00:00:00 2001 | ||
2 | From: Ben Hutchings <bhutchings@solarflare.com> | ||
3 | Date: Fri, 24 Feb 2012 15:12:34 +0000 | ||
4 | Subject: [PATCH 18/42] sfc: Fix assignment of ip_summed for pre-allocated | ||
5 | skbs | ||
6 | |||
7 | [ Upstream commit ff3bc1e7527504a93710535611b2f812f3bb89bf ] | ||
8 | |||
9 | When pre-allocating skbs for received packets, we set ip_summed = | ||
10 | CHECKSUM_UNNCESSARY. We used to change it back to CHECKSUM_NONE when | ||
11 | the received packet had an incorrect checksum or unhandled protocol. | ||
12 | |||
13 | Commit bc8acf2c8c3e43fcc192762a9f964b3e9a17748b ('drivers/net: avoid | ||
14 | some skb->ip_summed initializations') mistakenly replaced the latter | ||
15 | assignment with a DEBUG-only assertion that ip_summed == | ||
16 | CHECKSUM_NONE. This assertion is always false, but it seems no-one | ||
17 | has exercised this code path in a DEBUG build. | ||
18 | |||
19 | Fix this by moving our assignment of CHECKSUM_UNNECESSARY into | ||
20 | efx_rx_packet_gro(). | ||
21 | |||
22 | Signed-off-by: Ben Hutchings <bhutchings@solarflare.com> | ||
23 | Signed-off-by: David S. Miller <davem@davemloft.net> | ||
24 | Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | ||
25 | --- | ||
26 | drivers/net/ethernet/sfc/rx.c | 4 ++-- | ||
27 | 1 file changed, 2 insertions(+), 2 deletions(-) | ||
28 | |||
29 | diff --git a/drivers/net/ethernet/sfc/rx.c b/drivers/net/ethernet/sfc/rx.c | ||
30 | index 752d521..5ef4cc0 100644 | ||
31 | --- a/drivers/net/ethernet/sfc/rx.c | ||
32 | +++ b/drivers/net/ethernet/sfc/rx.c | ||
33 | @@ -156,11 +156,10 @@ static int efx_init_rx_buffers_skb(struct efx_rx_queue *rx_queue) | ||
34 | if (unlikely(!skb)) | ||
35 | return -ENOMEM; | ||
36 | |||
37 | - /* Adjust the SKB for padding and checksum */ | ||
38 | + /* Adjust the SKB for padding */ | ||
39 | skb_reserve(skb, NET_IP_ALIGN); | ||
40 | rx_buf->len = skb_len - NET_IP_ALIGN; | ||
41 | rx_buf->is_page = false; | ||
42 | - skb->ip_summed = CHECKSUM_UNNECESSARY; | ||
43 | |||
44 | rx_buf->dma_addr = pci_map_single(efx->pci_dev, | ||
45 | skb->data, rx_buf->len, | ||
46 | @@ -499,6 +498,7 @@ static void efx_rx_packet_gro(struct efx_channel *channel, | ||
47 | |||
48 | EFX_BUG_ON_PARANOID(!checksummed); | ||
49 | rx_buf->u.skb = NULL; | ||
50 | + skb->ip_summed = CHECKSUM_UNNECESSARY; | ||
51 | |||
52 | gro_result = napi_gro_receive(napi, skb); | ||
53 | } | ||
54 | -- | ||
55 | 1.7.9.4 | ||
56 | |||
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0019-tcp-fix-false-reordering-signal-in-tcp_shifted_skb.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0019-tcp-fix-false-reordering-signal-in-tcp_shifted_skb.patch new file mode 100644 index 00000000..7796b7d3 --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0019-tcp-fix-false-reordering-signal-in-tcp_shifted_skb.patch | |||
@@ -0,0 +1,72 @@ | |||
1 | From 201eee97e7d58fbde884394768761fb24229602a Mon Sep 17 00:00:00 2001 | ||
2 | From: Neal Cardwell <ncardwell@google.com> | ||
3 | Date: Sun, 26 Feb 2012 10:06:19 +0000 | ||
4 | Subject: [PATCH 19/42] tcp: fix false reordering signal in tcp_shifted_skb | ||
5 | |||
6 | [ Upstream commit 4c90d3b30334833450ccbb02f452d4972a3c3c3f ] | ||
7 | |||
8 | When tcp_shifted_skb() shifts bytes from the skb that is currently | ||
9 | pointed to by 'highest_sack' then the increment of | ||
10 | TCP_SKB_CB(skb)->seq implicitly advances tcp_highest_sack_seq(). This | ||
11 | implicit advancement, combined with the recent fix to pass the correct | ||
12 | SACKed range into tcp_sacktag_one(), caused tcp_sacktag_one() to think | ||
13 | that the newly SACKed range was before the tcp_highest_sack_seq(), | ||
14 | leading to a call to tcp_update_reordering() with a degree of | ||
15 | reordering matching the size of the newly SACKed range (typically just | ||
16 | 1 packet, which is a NOP, but potentially larger). | ||
17 | |||
18 | This commit fixes this by simply calling tcp_sacktag_one() before the | ||
19 | TCP_SKB_CB(skb)->seq advancement that can advance our notion of the | ||
20 | highest SACKed sequence. | ||
21 | |||
22 | Correspondingly, we can simplify the code a little now that | ||
23 | tcp_shifted_skb() should update the lost_cnt_hint in all cases where | ||
24 | skb == tp->lost_skb_hint. | ||
25 | |||
26 | Signed-off-by: Neal Cardwell <ncardwell@google.com> | ||
27 | Acked-by: Yuchung Cheng <ycheng@google.com> | ||
28 | Signed-off-by: David S. Miller <davem@davemloft.net> | ||
29 | Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | ||
30 | --- | ||
31 | net/ipv4/tcp_input.c | 18 ++++++++++-------- | ||
32 | 1 file changed, 10 insertions(+), 8 deletions(-) | ||
33 | |||
34 | diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c | ||
35 | index 53113b9..9e32fca 100644 | ||
36 | --- a/net/ipv4/tcp_input.c | ||
37 | +++ b/net/ipv4/tcp_input.c | ||
38 | @@ -1406,8 +1406,16 @@ static int tcp_shifted_skb(struct sock *sk, struct sk_buff *skb, | ||
39 | |||
40 | BUG_ON(!pcount); | ||
41 | |||
42 | - /* Adjust hint for FACK. Non-FACK is handled in tcp_sacktag_one(). */ | ||
43 | - if (tcp_is_fack(tp) && (skb == tp->lost_skb_hint)) | ||
44 | + /* Adjust counters and hints for the newly sacked sequence | ||
45 | + * range but discard the return value since prev is already | ||
46 | + * marked. We must tag the range first because the seq | ||
47 | + * advancement below implicitly advances | ||
48 | + * tcp_highest_sack_seq() when skb is highest_sack. | ||
49 | + */ | ||
50 | + tcp_sacktag_one(sk, state, TCP_SKB_CB(skb)->sacked, | ||
51 | + start_seq, end_seq, dup_sack, pcount); | ||
52 | + | ||
53 | + if (skb == tp->lost_skb_hint) | ||
54 | tp->lost_cnt_hint += pcount; | ||
55 | |||
56 | TCP_SKB_CB(prev)->end_seq += shifted; | ||
57 | @@ -1433,12 +1441,6 @@ static int tcp_shifted_skb(struct sock *sk, struct sk_buff *skb, | ||
58 | skb_shinfo(skb)->gso_type = 0; | ||
59 | } | ||
60 | |||
61 | - /* Adjust counters and hints for the newly sacked sequence range but | ||
62 | - * discard the return value since prev is already marked. | ||
63 | - */ | ||
64 | - tcp_sacktag_one(sk, state, TCP_SKB_CB(skb)->sacked, | ||
65 | - start_seq, end_seq, dup_sack, pcount); | ||
66 | - | ||
67 | /* Difference in this won't matter, both ACKed by the same cumul. ACK */ | ||
68 | TCP_SKB_CB(prev)->sacked |= (TCP_SKB_CB(skb)->sacked & TCPCB_EVER_RETRANS); | ||
69 | |||
70 | -- | ||
71 | 1.7.9.4 | ||
72 | |||
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0020-vmxnet3-Fix-transport-header-size.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0020-vmxnet3-Fix-transport-header-size.patch new file mode 100644 index 00000000..8bcb9aea --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0020-vmxnet3-Fix-transport-header-size.patch | |||
@@ -0,0 +1,58 @@ | |||
1 | From 40cfa9924ed2f94482607fc884f1acb414d492b9 Mon Sep 17 00:00:00 2001 | ||
2 | From: Shreyas Bhatewara <sbhatewara@vmware.com> | ||
3 | Date: Tue, 28 Feb 2012 22:17:38 +0000 | ||
4 | Subject: [PATCH 20/42] vmxnet3: Fix transport header size | ||
5 | |||
6 | [ Upstream commit efead8710aad9e384730ecf25eae0287878840d7 ] | ||
7 | |||
8 | Fix transport header size | ||
9 | |||
10 | Fix the transpoert header size for UDP packets. | ||
11 | |||
12 | Signed-off-by: Shreyas N Bhatewara <sbhatewara@vmware.com> | ||
13 | Signed-off-by: David S. Miller <davem@davemloft.net> | ||
14 | Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | ||
15 | --- | ||
16 | drivers/net/vmxnet3/vmxnet3_drv.c | 7 +------ | ||
17 | drivers/net/vmxnet3/vmxnet3_int.h | 4 ++-- | ||
18 | 2 files changed, 3 insertions(+), 8 deletions(-) | ||
19 | |||
20 | diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet3_drv.c | ||
21 | index d96bfb1..d426261 100644 | ||
22 | --- a/drivers/net/vmxnet3/vmxnet3_drv.c | ||
23 | +++ b/drivers/net/vmxnet3/vmxnet3_drv.c | ||
24 | @@ -830,13 +830,8 @@ vmxnet3_parse_and_copy_hdr(struct sk_buff *skb, struct vmxnet3_tx_queue *tq, | ||
25 | ctx->l4_hdr_size = ((struct tcphdr *) | ||
26 | skb_transport_header(skb))->doff * 4; | ||
27 | else if (iph->protocol == IPPROTO_UDP) | ||
28 | - /* | ||
29 | - * Use tcp header size so that bytes to | ||
30 | - * be copied are more than required by | ||
31 | - * the device. | ||
32 | - */ | ||
33 | ctx->l4_hdr_size = | ||
34 | - sizeof(struct tcphdr); | ||
35 | + sizeof(struct udphdr); | ||
36 | else | ||
37 | ctx->l4_hdr_size = 0; | ||
38 | } else { | ||
39 | diff --git a/drivers/net/vmxnet3/vmxnet3_int.h b/drivers/net/vmxnet3/vmxnet3_int.h | ||
40 | index b18eac1..8df921b 100644 | ||
41 | --- a/drivers/net/vmxnet3/vmxnet3_int.h | ||
42 | +++ b/drivers/net/vmxnet3/vmxnet3_int.h | ||
43 | @@ -70,10 +70,10 @@ | ||
44 | /* | ||
45 | * Version numbers | ||
46 | */ | ||
47 | -#define VMXNET3_DRIVER_VERSION_STRING "1.1.18.0-k" | ||
48 | +#define VMXNET3_DRIVER_VERSION_STRING "1.1.29.0-k" | ||
49 | |||
50 | /* a 32-bit int, each byte encode a verion number in VMXNET3_DRIVER_VERSION */ | ||
51 | -#define VMXNET3_DRIVER_VERSION_NUM 0x01011200 | ||
52 | +#define VMXNET3_DRIVER_VERSION_NUM 0x01011D00 | ||
53 | |||
54 | #if defined(CONFIG_PCI_MSI) | ||
55 | /* RSS only makes sense if MSI-X is supported. */ | ||
56 | -- | ||
57 | 1.7.9.4 | ||
58 | |||
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0021-packetengines-fix-config-default.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0021-packetengines-fix-config-default.patch new file mode 100644 index 00000000..6cfbc55a --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0021-packetengines-fix-config-default.patch | |||
@@ -0,0 +1,33 @@ | |||
1 | From 08a5b2365331981cd769e07182fce70ed50c8b66 Mon Sep 17 00:00:00 2001 | ||
2 | From: stephen hemminger <shemminger@vyatta.com> | ||
3 | Date: Fri, 2 Mar 2012 13:38:56 +0000 | ||
4 | Subject: [PATCH 21/42] packetengines: fix config default | ||
5 | |||
6 | [ Upstream commit 3f2010b2ad3d66d5291497c9b274315e7b807ecd ] | ||
7 | |||
8 | As part of the big network driver reorg, each vendor directory defaults to | ||
9 | yes, so that older config's can migrate correctly. Looks like this one | ||
10 | got missed. | ||
11 | |||
12 | Signed-off-by: Stephen Hemminger <shemminger@vyatta.com> | ||
13 | Signed-off-by: David S. Miller <davem@davemloft.net> | ||
14 | Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | ||
15 | --- | ||
16 | drivers/net/ethernet/packetengines/Kconfig | 1 + | ||
17 | 1 file changed, 1 insertion(+) | ||
18 | |||
19 | diff --git a/drivers/net/ethernet/packetengines/Kconfig b/drivers/net/ethernet/packetengines/Kconfig | ||
20 | index b97132d..8f29feb 100644 | ||
21 | --- a/drivers/net/ethernet/packetengines/Kconfig | ||
22 | +++ b/drivers/net/ethernet/packetengines/Kconfig | ||
23 | @@ -4,6 +4,7 @@ | ||
24 | |||
25 | config NET_PACKET_ENGINE | ||
26 | bool "Packet Engine devices" | ||
27 | + default y | ||
28 | depends on PCI | ||
29 | ---help--- | ||
30 | If you have a network (Ethernet) card belonging to this class, say Y | ||
31 | -- | ||
32 | 1.7.9.4 | ||
33 | |||
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0022-r8169-corrupted-IP-fragments-fix-for-large-mtu.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0022-r8169-corrupted-IP-fragments-fix-for-large-mtu.patch new file mode 100644 index 00000000..497caa41 --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0022-r8169-corrupted-IP-fragments-fix-for-large-mtu.patch | |||
@@ -0,0 +1,49 @@ | |||
1 | From 87f64e870bbad8d4558ae32ea0152c5e986a5264 Mon Sep 17 00:00:00 2001 | ||
2 | From: =?UTF-8?q?fran=C3=A7ois=20romieu?= <romieu@fr.zoreil.com> | ||
3 | Date: Fri, 2 Mar 2012 04:43:14 +0000 | ||
4 | Subject: [PATCH 22/42] r8169: corrupted IP fragments fix for large mtu. | ||
5 | |||
6 | [ Upstream commit 9c5028e9da1255dd2b99762d8627b88b29f68cce ] | ||
7 | |||
8 | Noticed with the 8168d (-vb-gr, aka RTL_GIGA_MAC_VER_26). | ||
9 | |||
10 | ConfigX registers should only be written while the Config9346 lock | ||
11 | is held. | ||
12 | |||
13 | Signed-off-by: Francois Romieu <romieu@fr.zoreil.com> | ||
14 | Reported-by: Nick Bowler <nbowler@elliptictech.com> | ||
15 | Cc: Hayes Wang <hayeswang@realtek.com> | ||
16 | Signed-off-by: David S. Miller <davem@davemloft.net> | ||
17 | Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | ||
18 | --- | ||
19 | drivers/net/ethernet/realtek/r8169.c | 8 ++++++++ | ||
20 | 1 file changed, 8 insertions(+) | ||
21 | |||
22 | diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c | ||
23 | index c8f47f1..0cf2351 100644 | ||
24 | --- a/drivers/net/ethernet/realtek/r8169.c | ||
25 | +++ b/drivers/net/ethernet/realtek/r8169.c | ||
26 | @@ -3781,12 +3781,20 @@ static void rtl8169_init_ring_indexes(struct rtl8169_private *tp) | ||
27 | |||
28 | static void rtl_hw_jumbo_enable(struct rtl8169_private *tp) | ||
29 | { | ||
30 | + void __iomem *ioaddr = tp->mmio_addr; | ||
31 | + | ||
32 | + RTL_W8(Cfg9346, Cfg9346_Unlock); | ||
33 | rtl_generic_op(tp, tp->jumbo_ops.enable); | ||
34 | + RTL_W8(Cfg9346, Cfg9346_Lock); | ||
35 | } | ||
36 | |||
37 | static void rtl_hw_jumbo_disable(struct rtl8169_private *tp) | ||
38 | { | ||
39 | + void __iomem *ioaddr = tp->mmio_addr; | ||
40 | + | ||
41 | + RTL_W8(Cfg9346, Cfg9346_Unlock); | ||
42 | rtl_generic_op(tp, tp->jumbo_ops.disable); | ||
43 | + RTL_W8(Cfg9346, Cfg9346_Lock); | ||
44 | } | ||
45 | |||
46 | static void r8168c_hw_jumbo_enable(struct rtl8169_private *tp) | ||
47 | -- | ||
48 | 1.7.9.4 | ||
49 | |||
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0023-tcp-don-t-fragment-SACKed-skbs-in-tcp_mark_head_lost.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0023-tcp-don-t-fragment-SACKed-skbs-in-tcp_mark_head_lost.patch new file mode 100644 index 00000000..41a53871 --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0023-tcp-don-t-fragment-SACKed-skbs-in-tcp_mark_head_lost.patch | |||
@@ -0,0 +1,55 @@ | |||
1 | From c0313fea8fa8ff77714bfdab4eed42ae0785dc37 Mon Sep 17 00:00:00 2001 | ||
2 | From: Neal Cardwell <ncardwell@google.com> | ||
3 | Date: Fri, 2 Mar 2012 21:36:51 +0000 | ||
4 | Subject: [PATCH 23/42] tcp: don't fragment SACKed skbs in | ||
5 | tcp_mark_head_lost() | ||
6 | MIME-Version: 1.0 | ||
7 | Content-Type: text/plain; charset=UTF-8 | ||
8 | Content-Transfer-Encoding: 8bit | ||
9 | |||
10 | [ Upstream commit c0638c247f559e1a16ee79e54df14bca2cb679ea ] | ||
11 | |||
12 | In tcp_mark_head_lost() we should not attempt to fragment a SACKed skb | ||
13 | to mark the first portion as lost. This is for two primary reasons: | ||
14 | |||
15 | (1) tcp_shifted_skb() coalesces adjacent regions of SACKed skbs. When | ||
16 | doing this, it preserves the sum of their packet counts in order to | ||
17 | reflect the real-world dynamics on the wire. But given that skbs can | ||
18 | have remainders that do not align to MSS boundaries, this packet count | ||
19 | preservation means that for SACKed skbs there is not necessarily a | ||
20 | direct linear relationship between tcp_skb_pcount(skb) and | ||
21 | skb->len. Thus tcp_mark_head_lost()'s previous attempts to fragment | ||
22 | off and mark as lost a prefix of length (packets - oldcnt)*mss from | ||
23 | SACKed skbs were leading to occasional failures of the WARN_ON(len > | ||
24 | skb->len) in tcp_fragment() (which used to be a BUG_ON(); see the | ||
25 | recent "crash in tcp_fragment" thread on netdev). | ||
26 | |||
27 | (2) there is no real point in fragmenting off part of a SACKed skb and | ||
28 | calling tcp_skb_mark_lost() on it, since tcp_skb_mark_lost() is a NOP | ||
29 | for SACKed skbs. | ||
30 | |||
31 | Signed-off-by: Neal Cardwell <ncardwell@google.com> | ||
32 | Acked-by: Ilpo Järvinen <ilpo.jarvinen@helsinki.fi> | ||
33 | Acked-by: Yuchung Cheng <ycheng@google.com> | ||
34 | Acked-by: Nandita Dukkipati <nanditad@google.com> | ||
35 | Signed-off-by: David S. Miller <davem@davemloft.net> | ||
36 | Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | ||
37 | --- | ||
38 | net/ipv4/tcp_input.c | 1 + | ||
39 | 1 file changed, 1 insertion(+) | ||
40 | |||
41 | diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c | ||
42 | index 9e32fca..1c774af 100644 | ||
43 | --- a/net/ipv4/tcp_input.c | ||
44 | +++ b/net/ipv4/tcp_input.c | ||
45 | @@ -2571,6 +2571,7 @@ static void tcp_mark_head_lost(struct sock *sk, int packets, int mark_head) | ||
46 | |||
47 | if (cnt > packets) { | ||
48 | if ((tcp_is_sack(tp) && !tcp_is_fack(tp)) || | ||
49 | + (TCP_SKB_CB(skb)->sacked & TCPCB_SACKED_ACKED) || | ||
50 | (oldcnt >= packets)) | ||
51 | break; | ||
52 | |||
53 | -- | ||
54 | 1.7.9.4 | ||
55 | |||
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0024-bridge-check-return-value-of-ipv6_dev_get_saddr.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0024-bridge-check-return-value-of-ipv6_dev_get_saddr.patch new file mode 100644 index 00000000..7a05ae29 --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0024-bridge-check-return-value-of-ipv6_dev_get_saddr.patch | |||
@@ -0,0 +1,39 @@ | |||
1 | From 384298df213387fc31905729a5e23e79bc6b8222 Mon Sep 17 00:00:00 2001 | ||
2 | From: Ulrich Weber <ulrich.weber@sophos.com> | ||
3 | Date: Mon, 5 Mar 2012 04:52:44 +0000 | ||
4 | Subject: [PATCH 24/42] bridge: check return value of ipv6_dev_get_saddr() | ||
5 | |||
6 | [ Upstream commit d1d81d4c3dd886d5fa25a2c4fa1e39cb89613712 ] | ||
7 | |||
8 | otherwise source IPv6 address of ICMPV6_MGM_QUERY packet | ||
9 | might be random junk if IPv6 is disabled on interface or | ||
10 | link-local address is not yet ready (DAD). | ||
11 | |||
12 | Signed-off-by: Ulrich Weber <ulrich.weber@sophos.com> | ||
13 | Signed-off-by: David S. Miller <davem@davemloft.net> | ||
14 | Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | ||
15 | --- | ||
16 | net/bridge/br_multicast.c | 7 +++++-- | ||
17 | 1 file changed, 5 insertions(+), 2 deletions(-) | ||
18 | |||
19 | diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c | ||
20 | index a5f4e57..8eb6b15 100644 | ||
21 | --- a/net/bridge/br_multicast.c | ||
22 | +++ b/net/bridge/br_multicast.c | ||
23 | @@ -446,8 +446,11 @@ static struct sk_buff *br_ip6_multicast_alloc_query(struct net_bridge *br, | ||
24 | ip6h->nexthdr = IPPROTO_HOPOPTS; | ||
25 | ip6h->hop_limit = 1; | ||
26 | ipv6_addr_set(&ip6h->daddr, htonl(0xff020000), 0, 0, htonl(1)); | ||
27 | - ipv6_dev_get_saddr(dev_net(br->dev), br->dev, &ip6h->daddr, 0, | ||
28 | - &ip6h->saddr); | ||
29 | + if (ipv6_dev_get_saddr(dev_net(br->dev), br->dev, &ip6h->daddr, 0, | ||
30 | + &ip6h->saddr)) { | ||
31 | + kfree_skb(skb); | ||
32 | + return NULL; | ||
33 | + } | ||
34 | ipv6_eth_mc_map(&ip6h->daddr, eth->h_dest); | ||
35 | |||
36 | hopopt = (u8 *)(ip6h + 1); | ||
37 | -- | ||
38 | 1.7.9.4 | ||
39 | |||
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0025-tcp-fix-tcp_shift_skb_data-to-not-shift-SACKed-data-.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0025-tcp-fix-tcp_shift_skb_data-to-not-shift-SACKed-data-.patch new file mode 100644 index 00000000..07ce46b5 --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0025-tcp-fix-tcp_shift_skb_data-to-not-shift-SACKed-data-.patch | |||
@@ -0,0 +1,89 @@ | |||
1 | From c0ebd50aab8d8fa2f98ceb9da54d161f492326e0 Mon Sep 17 00:00:00 2001 | ||
2 | From: Neal Cardwell <ncardwell@google.com> | ||
3 | Date: Mon, 5 Mar 2012 19:35:04 +0000 | ||
4 | Subject: [PATCH 25/42] tcp: fix tcp_shift_skb_data() to not shift SACKed data | ||
5 | below snd_una | ||
6 | |||
7 | [ Upstream commit 4648dc97af9d496218a05353b0e442b3dfa6aaab ] | ||
8 | |||
9 | This commit fixes tcp_shift_skb_data() so that it does not shift | ||
10 | SACKed data below snd_una. | ||
11 | |||
12 | This fixes an issue whose symptoms exactly match reports showing | ||
13 | tp->sacked_out going negative since 3.3.0-rc4 (see "WARNING: at | ||
14 | net/ipv4/tcp_input.c:3418" thread on netdev). | ||
15 | |||
16 | Since 2008 (832d11c5cd076abc0aa1eaf7be96c81d1a59ce41) | ||
17 | tcp_shift_skb_data() had been shifting SACKed ranges that were below | ||
18 | snd_una. It checked that the *end* of the skb it was about to shift | ||
19 | from was above snd_una, but did not check that the end of the actual | ||
20 | shifted range was above snd_una; this commit adds that check. | ||
21 | |||
22 | Shifting SACKed ranges below snd_una is problematic because for such | ||
23 | ranges tcp_sacktag_one() short-circuits: it does not declare anything | ||
24 | as SACKed and does not increase sacked_out. | ||
25 | |||
26 | Before the fixes in commits cc9a672ee522d4805495b98680f4a3db5d0a0af9 | ||
27 | and daef52bab1fd26e24e8e9578f8fb33ba1d0cb412, shifting SACKed ranges | ||
28 | below snd_una happened to work because tcp_shifted_skb() was always | ||
29 | (incorrectly) passing in to tcp_sacktag_one() an skb whose end_seq | ||
30 | tcp_shift_skb_data() had already guaranteed was beyond snd_una. Hence | ||
31 | tcp_sacktag_one() never short-circuited and always increased | ||
32 | tp->sacked_out in this case. | ||
33 | |||
34 | After those two fixes, my testing has verified that shifting SACKed | ||
35 | ranges below snd_una could cause tp->sacked_out to go negative with | ||
36 | the following sequence of events: | ||
37 | |||
38 | (1) tcp_shift_skb_data() sees an skb whose end_seq is beyond snd_una, | ||
39 | then shifts a prefix of that skb that is below snd_una | ||
40 | |||
41 | (2) tcp_shifted_skb() increments the packet count of the | ||
42 | already-SACKed prev sk_buff | ||
43 | |||
44 | (3) tcp_sacktag_one() sees the end of the new SACKed range is below | ||
45 | snd_una, so it short-circuits and doesn't increase tp->sacked_out | ||
46 | |||
47 | (5) tcp_clean_rtx_queue() sees the SACKed skb has been ACKed, | ||
48 | decrements tp->sacked_out by this "inflated" pcount that was | ||
49 | missing a matching increase in tp->sacked_out, and hence | ||
50 | tp->sacked_out underflows to a u32 like 0xFFFFFFFF, which casted | ||
51 | to s32 is negative. | ||
52 | |||
53 | (6) this leads to the warnings seen in the recent "WARNING: at | ||
54 | net/ipv4/tcp_input.c:3418" thread on the netdev list; e.g.: | ||
55 | tcp_input.c:3418 WARN_ON((int)tp->sacked_out < 0); | ||
56 | |||
57 | More generally, I think this bug can be tickled in some cases where | ||
58 | two or more ACKs from the receiver are lost and then a DSACK arrives | ||
59 | that is immediately above an existing SACKed skb in the write queue. | ||
60 | |||
61 | This fix changes tcp_shift_skb_data() to abort this sequence at step | ||
62 | (1) in the scenario above by noticing that the bytes are below snd_una | ||
63 | and not shifting them. | ||
64 | |||
65 | Signed-off-by: Neal Cardwell <ncardwell@google.com> | ||
66 | Signed-off-by: David S. Miller <davem@davemloft.net> | ||
67 | Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | ||
68 | --- | ||
69 | net/ipv4/tcp_input.c | 4 ++++ | ||
70 | 1 file changed, 4 insertions(+) | ||
71 | |||
72 | diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c | ||
73 | index 1c774af..e4d1e4a 100644 | ||
74 | --- a/net/ipv4/tcp_input.c | ||
75 | +++ b/net/ipv4/tcp_input.c | ||
76 | @@ -1588,6 +1588,10 @@ static struct sk_buff *tcp_shift_skb_data(struct sock *sk, struct sk_buff *skb, | ||
77 | } | ||
78 | } | ||
79 | |||
80 | + /* tcp_sacktag_one() won't SACK-tag ranges below snd_una */ | ||
81 | + if (!after(TCP_SKB_CB(skb)->seq + len, tp->snd_una)) | ||
82 | + goto fallback; | ||
83 | + | ||
84 | if (!skb_shift(prev, skb, len)) | ||
85 | goto fallback; | ||
86 | if (!tcp_shifted_skb(sk, skb, state, pcount, len, mss, dup_sack)) | ||
87 | -- | ||
88 | 1.7.9.4 | ||
89 | |||
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0026-IPv6-Fix-not-join-all-router-mcast-group-when-forwar.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0026-IPv6-Fix-not-join-all-router-mcast-group-when-forwar.patch new file mode 100644 index 00000000..048a7e3f --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0026-IPv6-Fix-not-join-all-router-mcast-group-when-forwar.patch | |||
@@ -0,0 +1,36 @@ | |||
1 | From 7ddf7a941aeb1bdb57801edb82c68fae8d40ea75 Mon Sep 17 00:00:00 2001 | ||
2 | From: Li Wei <lw@cn.fujitsu.com> | ||
3 | Date: Mon, 5 Mar 2012 14:45:17 +0000 | ||
4 | Subject: [PATCH 26/42] IPv6: Fix not join all-router mcast group when | ||
5 | forwarding set. | ||
6 | |||
7 | [ Upstream commit d6ddef9e641d1229d4ec841dc75ae703171c3e92 ] | ||
8 | |||
9 | When forwarding was set and a new net device is register, | ||
10 | we need add this device to the all-router mcast group. | ||
11 | |||
12 | Signed-off-by: Li Wei <lw@cn.fujitsu.com> | ||
13 | Signed-off-by: David S. Miller <davem@davemloft.net> | ||
14 | Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | ||
15 | --- | ||
16 | net/ipv6/addrconf.c | 4 ++++ | ||
17 | 1 file changed, 4 insertions(+) | ||
18 | |||
19 | diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c | ||
20 | index 836c4ea..a5521c5 100644 | ||
21 | --- a/net/ipv6/addrconf.c | ||
22 | +++ b/net/ipv6/addrconf.c | ||
23 | @@ -434,6 +434,10 @@ static struct inet6_dev * ipv6_add_dev(struct net_device *dev) | ||
24 | /* Join all-node multicast group */ | ||
25 | ipv6_dev_mc_inc(dev, &in6addr_linklocal_allnodes); | ||
26 | |||
27 | + /* Join all-router multicast group if forwarding is set */ | ||
28 | + if (ndev->cnf.forwarding && dev && (dev->flags & IFF_MULTICAST)) | ||
29 | + ipv6_dev_mc_inc(dev, &in6addr_linklocal_allrouters); | ||
30 | + | ||
31 | return ndev; | ||
32 | } | ||
33 | |||
34 | -- | ||
35 | 1.7.9.4 | ||
36 | |||
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0027-usb-asix-Patch-for-Sitecom-LN-031.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0027-usb-asix-Patch-for-Sitecom-LN-031.patch new file mode 100644 index 00000000..be2bf826 --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0027-usb-asix-Patch-for-Sitecom-LN-031.patch | |||
@@ -0,0 +1,36 @@ | |||
1 | From 636b06096f3e95adf81e162fdb74ed388c696be1 Mon Sep 17 00:00:00 2001 | ||
2 | From: Joerg Neikes <j.neikes@midlandgate.de> | ||
3 | Date: Thu, 8 Mar 2012 22:44:03 +0000 | ||
4 | Subject: [PATCH 27/42] usb: asix: Patch for Sitecom LN-031 | ||
5 | |||
6 | commit 4e50391968849860dff1aacde358b4eb14aa5127 upstream. | ||
7 | |||
8 | This patch adds support for the Sitecom LN-031 USB adapter with a AX88178 chip. | ||
9 | |||
10 | Added USB id to find correct driver for AX88178 1000 Ethernet adapter. | ||
11 | |||
12 | Signed-off-by: Joerg Neikes <j.neikes@midlandgate.de> | ||
13 | Signed-off-by: David S. Miller <davem@davemloft.net> | ||
14 | Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | ||
15 | --- | ||
16 | drivers/net/usb/asix.c | 4 ++++ | ||
17 | 1 file changed, 4 insertions(+) | ||
18 | |||
19 | diff --git a/drivers/net/usb/asix.c b/drivers/net/usb/asix.c | ||
20 | index f5e063a..fda4be2 100644 | ||
21 | --- a/drivers/net/usb/asix.c | ||
22 | +++ b/drivers/net/usb/asix.c | ||
23 | @@ -1595,6 +1595,10 @@ static const struct usb_device_id products [] = { | ||
24 | USB_DEVICE (0x6189, 0x182d), | ||
25 | .driver_info = (unsigned long) &ax8817x_info, | ||
26 | }, { | ||
27 | + // Sitecom LN-031 "USB 2.0 10/100/1000 Ethernet adapter" | ||
28 | + USB_DEVICE (0x0df6, 0x0056), | ||
29 | + .driver_info = (unsigned long) &ax88178_info, | ||
30 | +}, { | ||
31 | // corega FEther USB2-TX | ||
32 | USB_DEVICE (0x07aa, 0x0017), | ||
33 | .driver_info = (unsigned long) &ax8817x_info, | ||
34 | -- | ||
35 | 1.7.9.4 | ||
36 | |||
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0028-regulator-Fix-setting-selector-in-tps6524x-set_volta.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0028-regulator-Fix-setting-selector-in-tps6524x-set_volta.patch new file mode 100644 index 00000000..32f16eb3 --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0028-regulator-Fix-setting-selector-in-tps6524x-set_volta.patch | |||
@@ -0,0 +1,33 @@ | |||
1 | From 62c35c47cb8ddee3510f8da30768d995d62736ba Mon Sep 17 00:00:00 2001 | ||
2 | From: Axel Lin <axel.lin@gmail.com> | ||
3 | Date: Thu, 8 Mar 2012 10:02:17 +0800 | ||
4 | Subject: [PATCH 28/42] regulator: Fix setting selector in tps6524x | ||
5 | set_voltage function | ||
6 | |||
7 | commit f03570cf1709397ebe656608266b44ec772960c2 upstream. | ||
8 | |||
9 | Don't assign the voltage to selector. | ||
10 | |||
11 | Signed-off-by: Axel Lin <axel.lin@gmail.com> | ||
12 | Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com> | ||
13 | Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | ||
14 | --- | ||
15 | drivers/regulator/tps6524x-regulator.c | 2 +- | ||
16 | 1 file changed, 1 insertion(+), 1 deletion(-) | ||
17 | |||
18 | diff --git a/drivers/regulator/tps6524x-regulator.c b/drivers/regulator/tps6524x-regulator.c | ||
19 | index 9166aa0..229b6f4 100644 | ||
20 | --- a/drivers/regulator/tps6524x-regulator.c | ||
21 | +++ b/drivers/regulator/tps6524x-regulator.c | ||
22 | @@ -481,7 +481,7 @@ static int set_voltage(struct regulator_dev *rdev, int min_uV, int max_uV, | ||
23 | if (i >= info->n_voltages) | ||
24 | i = info->n_voltages - 1; | ||
25 | |||
26 | - *selector = info->voltages[i]; | ||
27 | + *selector = i; | ||
28 | |||
29 | return write_field(hw, &info->voltage, i); | ||
30 | } | ||
31 | -- | ||
32 | 1.7.9.4 | ||
33 | |||
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0029-block-Fix-NULL-pointer-dereference-in-sd_revalidate_.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0029-block-Fix-NULL-pointer-dereference-in-sd_revalidate_.patch new file mode 100644 index 00000000..3a4af4b3 --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0029-block-Fix-NULL-pointer-dereference-in-sd_revalidate_.patch | |||
@@ -0,0 +1,170 @@ | |||
1 | From f90fbbb22b2a145c5a3d66a31a46a32bb54ed722 Mon Sep 17 00:00:00 2001 | ||
2 | From: Jun'ichi Nomura <j-nomura@ce.jp.nec.com> | ||
3 | Date: Fri, 2 Mar 2012 10:38:33 +0100 | ||
4 | Subject: [PATCH 29/42] block: Fix NULL pointer dereference in | ||
5 | sd_revalidate_disk | ||
6 | |||
7 | commit fe316bf2d5847bc5dd975668671a7b1067603bc7 upstream. | ||
8 | |||
9 | Since 2.6.39 (1196f8b), when a driver returns -ENOMEDIUM for open(), | ||
10 | __blkdev_get() calls rescan_partitions() to remove | ||
11 | in-kernel partition structures and raise KOBJ_CHANGE uevent. | ||
12 | |||
13 | However it ends up calling driver's revalidate_disk without open | ||
14 | and could cause oops. | ||
15 | |||
16 | In the case of SCSI: | ||
17 | |||
18 | process A process B | ||
19 | ---------------------------------------------- | ||
20 | sys_open | ||
21 | __blkdev_get | ||
22 | sd_open | ||
23 | returns -ENOMEDIUM | ||
24 | scsi_remove_device | ||
25 | <scsi_device torn down> | ||
26 | rescan_partitions | ||
27 | sd_revalidate_disk | ||
28 | <oops> | ||
29 | Oopses are reported here: | ||
30 | http://marc.info/?l=linux-scsi&m=132388619710052 | ||
31 | |||
32 | This patch separates the partition invalidation from rescan_partitions() | ||
33 | and use it for -ENOMEDIUM case. | ||
34 | |||
35 | Reported-by: Huajun Li <huajun.li.lee@gmail.com> | ||
36 | Signed-off-by: Jun'ichi Nomura <j-nomura@ce.jp.nec.com> | ||
37 | Acked-by: Tejun Heo <tj@kernel.org> | ||
38 | Signed-off-by: Jens Axboe <axboe@kernel.dk> | ||
39 | Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | ||
40 | --- | ||
41 | fs/block_dev.c | 16 ++++++++++++---- | ||
42 | fs/partitions/check.c | 48 ++++++++++++++++++++++++++++++++++++++++-------- | ||
43 | include/linux/genhd.h | 1 + | ||
44 | 3 files changed, 53 insertions(+), 12 deletions(-) | ||
45 | |||
46 | diff --git a/fs/block_dev.c b/fs/block_dev.c | ||
47 | index b07f1da..abe9b48 100644 | ||
48 | --- a/fs/block_dev.c | ||
49 | +++ b/fs/block_dev.c | ||
50 | @@ -1159,8 +1159,12 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, int for_part) | ||
51 | * The latter is necessary to prevent ghost | ||
52 | * partitions on a removed medium. | ||
53 | */ | ||
54 | - if (bdev->bd_invalidated && (!ret || ret == -ENOMEDIUM)) | ||
55 | - rescan_partitions(disk, bdev); | ||
56 | + if (bdev->bd_invalidated) { | ||
57 | + if (!ret) | ||
58 | + rescan_partitions(disk, bdev); | ||
59 | + else if (ret == -ENOMEDIUM) | ||
60 | + invalidate_partitions(disk, bdev); | ||
61 | + } | ||
62 | if (ret) | ||
63 | goto out_clear; | ||
64 | } else { | ||
65 | @@ -1190,8 +1194,12 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, int for_part) | ||
66 | if (bdev->bd_disk->fops->open) | ||
67 | ret = bdev->bd_disk->fops->open(bdev, mode); | ||
68 | /* the same as first opener case, read comment there */ | ||
69 | - if (bdev->bd_invalidated && (!ret || ret == -ENOMEDIUM)) | ||
70 | - rescan_partitions(bdev->bd_disk, bdev); | ||
71 | + if (bdev->bd_invalidated) { | ||
72 | + if (!ret) | ||
73 | + rescan_partitions(bdev->bd_disk, bdev); | ||
74 | + else if (ret == -ENOMEDIUM) | ||
75 | + invalidate_partitions(bdev->bd_disk, bdev); | ||
76 | + } | ||
77 | if (ret) | ||
78 | goto out_unlock_bdev; | ||
79 | } | ||
80 | diff --git a/fs/partitions/check.c b/fs/partitions/check.c | ||
81 | index e3c63d1..6b5fcc5 100644 | ||
82 | --- a/fs/partitions/check.c | ||
83 | +++ b/fs/partitions/check.c | ||
84 | @@ -539,17 +539,11 @@ static bool disk_unlock_native_capacity(struct gendisk *disk) | ||
85 | } | ||
86 | } | ||
87 | |||
88 | -int rescan_partitions(struct gendisk *disk, struct block_device *bdev) | ||
89 | +static int drop_partitions(struct gendisk *disk, struct block_device *bdev) | ||
90 | { | ||
91 | - struct parsed_partitions *state = NULL; | ||
92 | struct disk_part_iter piter; | ||
93 | struct hd_struct *part; | ||
94 | - int p, highest, res; | ||
95 | -rescan: | ||
96 | - if (state && !IS_ERR(state)) { | ||
97 | - kfree(state); | ||
98 | - state = NULL; | ||
99 | - } | ||
100 | + int res; | ||
101 | |||
102 | if (bdev->bd_part_count) | ||
103 | return -EBUSY; | ||
104 | @@ -562,6 +556,24 @@ rescan: | ||
105 | delete_partition(disk, part->partno); | ||
106 | disk_part_iter_exit(&piter); | ||
107 | |||
108 | + return 0; | ||
109 | +} | ||
110 | + | ||
111 | +int rescan_partitions(struct gendisk *disk, struct block_device *bdev) | ||
112 | +{ | ||
113 | + struct parsed_partitions *state = NULL; | ||
114 | + struct hd_struct *part; | ||
115 | + int p, highest, res; | ||
116 | +rescan: | ||
117 | + if (state && !IS_ERR(state)) { | ||
118 | + kfree(state); | ||
119 | + state = NULL; | ||
120 | + } | ||
121 | + | ||
122 | + res = drop_partitions(disk, bdev); | ||
123 | + if (res) | ||
124 | + return res; | ||
125 | + | ||
126 | if (disk->fops->revalidate_disk) | ||
127 | disk->fops->revalidate_disk(disk); | ||
128 | check_disk_size_change(disk, bdev); | ||
129 | @@ -665,6 +677,26 @@ rescan: | ||
130 | return 0; | ||
131 | } | ||
132 | |||
133 | +int invalidate_partitions(struct gendisk *disk, struct block_device *bdev) | ||
134 | +{ | ||
135 | + int res; | ||
136 | + | ||
137 | + if (!bdev->bd_invalidated) | ||
138 | + return 0; | ||
139 | + | ||
140 | + res = drop_partitions(disk, bdev); | ||
141 | + if (res) | ||
142 | + return res; | ||
143 | + | ||
144 | + set_capacity(disk, 0); | ||
145 | + check_disk_size_change(disk, bdev); | ||
146 | + bdev->bd_invalidated = 0; | ||
147 | + /* tell userspace that the media / partition table may have changed */ | ||
148 | + kobject_uevent(&disk_to_dev(disk)->kobj, KOBJ_CHANGE); | ||
149 | + | ||
150 | + return 0; | ||
151 | +} | ||
152 | + | ||
153 | unsigned char *read_dev_sector(struct block_device *bdev, sector_t n, Sector *p) | ||
154 | { | ||
155 | struct address_space *mapping = bdev->bd_inode->i_mapping; | ||
156 | diff --git a/include/linux/genhd.h b/include/linux/genhd.h | ||
157 | index 6d18f35..c6f7f6a 100644 | ||
158 | --- a/include/linux/genhd.h | ||
159 | +++ b/include/linux/genhd.h | ||
160 | @@ -596,6 +596,7 @@ extern char *disk_name (struct gendisk *hd, int partno, char *buf); | ||
161 | |||
162 | extern int disk_expand_part_tbl(struct gendisk *disk, int target); | ||
163 | extern int rescan_partitions(struct gendisk *disk, struct block_device *bdev); | ||
164 | +extern int invalidate_partitions(struct gendisk *disk, struct block_device *bdev); | ||
165 | extern struct hd_struct * __must_check add_partition(struct gendisk *disk, | ||
166 | int partno, sector_t start, | ||
167 | sector_t len, int flags, | ||
168 | -- | ||
169 | 1.7.9.4 | ||
170 | |||
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0030-block-sx8-fix-pointer-math-issue-getting-fw-version.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0030-block-sx8-fix-pointer-math-issue-getting-fw-version.patch new file mode 100644 index 00000000..0ed858c0 --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0030-block-sx8-fix-pointer-math-issue-getting-fw-version.patch | |||
@@ -0,0 +1,34 @@ | |||
1 | From 5a399c9c3325b2a72d3bf522b7e1b0fa48954d96 Mon Sep 17 00:00:00 2001 | ||
2 | From: Dan Carpenter <dan.carpenter@oracle.com> | ||
3 | Date: Sat, 3 Mar 2012 12:09:17 +0100 | ||
4 | Subject: [PATCH 30/42] block, sx8: fix pointer math issue getting fw version | ||
5 | |||
6 | commit ea5f4db8ece896c2ab9eafa0924148a2596c52e4 upstream. | ||
7 | |||
8 | "mem" is type u8. We need parenthesis here or it screws up the pointer | ||
9 | math probably leading to an oops. | ||
10 | |||
11 | Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> | ||
12 | Acked-by: Jeff Garzik <jgarzik@redhat.com> | ||
13 | Signed-off-by: Jens Axboe <axboe@kernel.dk> | ||
14 | Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | ||
15 | --- | ||
16 | drivers/block/sx8.c | 2 +- | ||
17 | 1 file changed, 1 insertion(+), 1 deletion(-) | ||
18 | |||
19 | diff --git a/drivers/block/sx8.c b/drivers/block/sx8.c | ||
20 | index b70f0fc..eec7b7a 100644 | ||
21 | --- a/drivers/block/sx8.c | ||
22 | +++ b/drivers/block/sx8.c | ||
23 | @@ -1116,7 +1116,7 @@ static inline void carm_handle_resp(struct carm_host *host, | ||
24 | break; | ||
25 | case MISC_GET_FW_VER: { | ||
26 | struct carm_fw_ver *ver = (struct carm_fw_ver *) | ||
27 | - mem + sizeof(struct carm_msg_get_fw_ver); | ||
28 | + (mem + sizeof(struct carm_msg_get_fw_ver)); | ||
29 | if (!error) { | ||
30 | host->fw_ver = le32_to_cpu(ver->version); | ||
31 | host->flags |= (ver->features & FL_FW_VER_MASK); | ||
32 | -- | ||
33 | 1.7.9.4 | ||
34 | |||
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0031-block-fix-__blkdev_get-and-add_disk-race-condition.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0031-block-fix-__blkdev_get-and-add_disk-race-condition.patch new file mode 100644 index 00000000..4a08d314 --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0031-block-fix-__blkdev_get-and-add_disk-race-condition.patch | |||
@@ -0,0 +1,163 @@ | |||
1 | From 365dff776f2730d8aa79bb2d4cec1abcca4d30fd Mon Sep 17 00:00:00 2001 | ||
2 | From: Stanislaw Gruszka <sgruszka@redhat.com> | ||
3 | Date: Fri, 2 Mar 2012 10:43:28 +0100 | ||
4 | Subject: [PATCH 31/42] block: fix __blkdev_get and add_disk race condition | ||
5 | |||
6 | commit 9f53d2fe815b4011ff930a7b6db98385d45faa68 upstream. | ||
7 | |||
8 | The following situation might occur: | ||
9 | |||
10 | __blkdev_get: add_disk: | ||
11 | |||
12 | register_disk() | ||
13 | get_gendisk() | ||
14 | |||
15 | disk_block_events() | ||
16 | disk->ev == NULL | ||
17 | |||
18 | disk_add_events() | ||
19 | |||
20 | __disk_unblock_events() | ||
21 | disk->ev != NULL | ||
22 | --ev->block | ||
23 | |||
24 | Then we unblock events, when they are suppose to be blocked. This can | ||
25 | trigger events related block/genhd.c warnings, but also can crash in | ||
26 | sd_check_events() or other places. | ||
27 | |||
28 | I'm able to reproduce crashes with the following scripts (with | ||
29 | connected usb dongle as sdb disk). | ||
30 | |||
31 | <snip> | ||
32 | DEV=/dev/sdb | ||
33 | ENABLE=/sys/bus/usb/devices/1-2/bConfigurationValue | ||
34 | |||
35 | function stop_me() | ||
36 | { | ||
37 | for i in `jobs -p` ; do kill $i 2> /dev/null ; done | ||
38 | exit | ||
39 | } | ||
40 | |||
41 | trap stop_me SIGHUP SIGINT SIGTERM | ||
42 | |||
43 | for ((i = 0; i < 10; i++)) ; do | ||
44 | while true; do fdisk -l $DEV 2>&1 > /dev/null ; done & | ||
45 | done | ||
46 | |||
47 | while true ; do | ||
48 | echo 1 > $ENABLE | ||
49 | sleep 1 | ||
50 | echo 0 > $ENABLE | ||
51 | done | ||
52 | </snip> | ||
53 | |||
54 | I use the script to verify patch fixing oops in sd_revalidate_disk | ||
55 | http://marc.info/?l=linux-scsi&m=132935572512352&w=2 | ||
56 | Without Jun'ichi Nomura patch titled "Fix NULL pointer dereference in | ||
57 | sd_revalidate_disk" or this one, script easily crash kernel within | ||
58 | a few seconds. With both patches applied I do not observe crash. | ||
59 | Unfortunately after some time (dozen of minutes), script will hung in: | ||
60 | |||
61 | [ 1563.906432] [<c08354f5>] schedule_timeout_uninterruptible+0x15/0x20 | ||
62 | [ 1563.906437] [<c04532d5>] msleep+0x15/0x20 | ||
63 | [ 1563.906443] [<c05d60b2>] blk_drain_queue+0x32/0xd0 | ||
64 | [ 1563.906447] [<c05d6e00>] blk_cleanup_queue+0xd0/0x170 | ||
65 | [ 1563.906454] [<c06d278f>] scsi_free_queue+0x3f/0x60 | ||
66 | [ 1563.906459] [<c06d7e6e>] __scsi_remove_device+0x6e/0xb0 | ||
67 | [ 1563.906463] [<c06d4aff>] scsi_forget_host+0x4f/0x60 | ||
68 | [ 1563.906468] [<c06cd84a>] scsi_remove_host+0x5a/0xf0 | ||
69 | [ 1563.906482] [<f7f030fb>] quiesce_and_remove_host+0x5b/0xa0 [usb_storage] | ||
70 | [ 1563.906490] [<f7f03203>] usb_stor_disconnect+0x13/0x20 [usb_storage] | ||
71 | |||
72 | Anyway I think this patch is some step forward. | ||
73 | |||
74 | As drawback, I do not teardown on sysfs file create error, because I do | ||
75 | not know how to nullify disk->ev (since it can be used). However add_disk | ||
76 | error handling practically does not exist too, and things will work | ||
77 | without this sysfs file, except events will not be exported to user | ||
78 | space. | ||
79 | |||
80 | Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com> | ||
81 | Acked-by: Tejun Heo <tj@kernel.org> | ||
82 | Signed-off-by: Jens Axboe <axboe@kernel.dk> | ||
83 | Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | ||
84 | --- | ||
85 | block/genhd.c | 32 +++++++++++++++++++------------- | ||
86 | 1 file changed, 19 insertions(+), 13 deletions(-) | ||
87 | |||
88 | diff --git a/block/genhd.c b/block/genhd.c | ||
89 | index 02e9fca..9db720d 100644 | ||
90 | --- a/block/genhd.c | ||
91 | +++ b/block/genhd.c | ||
92 | @@ -36,6 +36,7 @@ static DEFINE_IDR(ext_devt_idr); | ||
93 | |||
94 | static struct device_type disk_type; | ||
95 | |||
96 | +static void disk_alloc_events(struct gendisk *disk); | ||
97 | static void disk_add_events(struct gendisk *disk); | ||
98 | static void disk_del_events(struct gendisk *disk); | ||
99 | static void disk_release_events(struct gendisk *disk); | ||
100 | @@ -602,6 +603,8 @@ void add_disk(struct gendisk *disk) | ||
101 | disk->major = MAJOR(devt); | ||
102 | disk->first_minor = MINOR(devt); | ||
103 | |||
104 | + disk_alloc_events(disk); | ||
105 | + | ||
106 | /* Register BDI before referencing it from bdev */ | ||
107 | bdi = &disk->queue->backing_dev_info; | ||
108 | bdi_register_dev(bdi, disk_devt(disk)); | ||
109 | @@ -1734,9 +1737,9 @@ module_param_cb(events_dfl_poll_msecs, &disk_events_dfl_poll_msecs_param_ops, | ||
110 | &disk_events_dfl_poll_msecs, 0644); | ||
111 | |||
112 | /* | ||
113 | - * disk_{add|del|release}_events - initialize and destroy disk_events. | ||
114 | + * disk_{alloc|add|del|release}_events - initialize and destroy disk_events. | ||
115 | */ | ||
116 | -static void disk_add_events(struct gendisk *disk) | ||
117 | +static void disk_alloc_events(struct gendisk *disk) | ||
118 | { | ||
119 | struct disk_events *ev; | ||
120 | |||
121 | @@ -1749,16 +1752,6 @@ static void disk_add_events(struct gendisk *disk) | ||
122 | return; | ||
123 | } | ||
124 | |||
125 | - if (sysfs_create_files(&disk_to_dev(disk)->kobj, | ||
126 | - disk_events_attrs) < 0) { | ||
127 | - pr_warn("%s: failed to create sysfs files for events\n", | ||
128 | - disk->disk_name); | ||
129 | - kfree(ev); | ||
130 | - return; | ||
131 | - } | ||
132 | - | ||
133 | - disk->ev = ev; | ||
134 | - | ||
135 | INIT_LIST_HEAD(&ev->node); | ||
136 | ev->disk = disk; | ||
137 | spin_lock_init(&ev->lock); | ||
138 | @@ -1767,8 +1760,21 @@ static void disk_add_events(struct gendisk *disk) | ||
139 | ev->poll_msecs = -1; | ||
140 | INIT_DELAYED_WORK(&ev->dwork, disk_events_workfn); | ||
141 | |||
142 | + disk->ev = ev; | ||
143 | +} | ||
144 | + | ||
145 | +static void disk_add_events(struct gendisk *disk) | ||
146 | +{ | ||
147 | + if (!disk->ev) | ||
148 | + return; | ||
149 | + | ||
150 | + /* FIXME: error handling */ | ||
151 | + if (sysfs_create_files(&disk_to_dev(disk)->kobj, disk_events_attrs) < 0) | ||
152 | + pr_warn("%s: failed to create sysfs files for events\n", | ||
153 | + disk->disk_name); | ||
154 | + | ||
155 | mutex_lock(&disk_events_mutex); | ||
156 | - list_add_tail(&ev->node, &disk_events); | ||
157 | + list_add_tail(&disk->ev->node, &disk_events); | ||
158 | mutex_unlock(&disk_events_mutex); | ||
159 | |||
160 | /* | ||
161 | -- | ||
162 | 1.7.9.4 | ||
163 | |||
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0032-Block-use-a-freezable-workqueue-for-disk-event-polli.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0032-Block-use-a-freezable-workqueue-for-disk-event-polli.patch new file mode 100644 index 00000000..de8f4c99 --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0032-Block-use-a-freezable-workqueue-for-disk-event-polli.patch | |||
@@ -0,0 +1,129 @@ | |||
1 | From 21816a3fe95d2536991ece0a71609d8c22f8af9d Mon Sep 17 00:00:00 2001 | ||
2 | From: Alan Stern <stern@rowland.harvard.edu> | ||
3 | Date: Fri, 2 Mar 2012 10:51:00 +0100 | ||
4 | Subject: [PATCH 32/42] Block: use a freezable workqueue for disk-event | ||
5 | polling | ||
6 | |||
7 | commit 62d3c5439c534b0e6c653fc63e6d8c67be3a57b1 upstream. | ||
8 | |||
9 | This patch (as1519) fixes a bug in the block layer's disk-events | ||
10 | polling. The polling is done by a work routine queued on the | ||
11 | system_nrt_wq workqueue. Since that workqueue isn't freezable, the | ||
12 | polling continues even in the middle of a system sleep transition. | ||
13 | |||
14 | Obviously, polling a suspended drive for media changes and such isn't | ||
15 | a good thing to do; in the case of USB mass-storage devices it can | ||
16 | lead to real problems requiring device resets and even re-enumeration. | ||
17 | |||
18 | The patch fixes things by creating a new system-wide, non-reentrant, | ||
19 | freezable workqueue and using it for disk-events polling. | ||
20 | |||
21 | Signed-off-by: Alan Stern <stern@rowland.harvard.edu> | ||
22 | Acked-by: Tejun Heo <tj@kernel.org> | ||
23 | Acked-by: Rafael J. Wysocki <rjw@sisk.pl> | ||
24 | Signed-off-by: Jens Axboe <axboe@kernel.dk> | ||
25 | Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | ||
26 | --- | ||
27 | block/genhd.c | 10 +++++----- | ||
28 | include/linux/workqueue.h | 4 ++++ | ||
29 | kernel/workqueue.c | 7 ++++++- | ||
30 | 3 files changed, 15 insertions(+), 6 deletions(-) | ||
31 | |||
32 | diff --git a/block/genhd.c b/block/genhd.c | ||
33 | index 9db720d..997afd6 100644 | ||
34 | --- a/block/genhd.c | ||
35 | +++ b/block/genhd.c | ||
36 | @@ -1479,9 +1479,9 @@ static void __disk_unblock_events(struct gendisk *disk, bool check_now) | ||
37 | intv = disk_events_poll_jiffies(disk); | ||
38 | set_timer_slack(&ev->dwork.timer, intv / 4); | ||
39 | if (check_now) | ||
40 | - queue_delayed_work(system_nrt_wq, &ev->dwork, 0); | ||
41 | + queue_delayed_work(system_nrt_freezable_wq, &ev->dwork, 0); | ||
42 | else if (intv) | ||
43 | - queue_delayed_work(system_nrt_wq, &ev->dwork, intv); | ||
44 | + queue_delayed_work(system_nrt_freezable_wq, &ev->dwork, intv); | ||
45 | out_unlock: | ||
46 | spin_unlock_irqrestore(&ev->lock, flags); | ||
47 | } | ||
48 | @@ -1525,7 +1525,7 @@ void disk_flush_events(struct gendisk *disk, unsigned int mask) | ||
49 | ev->clearing |= mask; | ||
50 | if (!ev->block) { | ||
51 | cancel_delayed_work(&ev->dwork); | ||
52 | - queue_delayed_work(system_nrt_wq, &ev->dwork, 0); | ||
53 | + queue_delayed_work(system_nrt_freezable_wq, &ev->dwork, 0); | ||
54 | } | ||
55 | spin_unlock_irq(&ev->lock); | ||
56 | } | ||
57 | @@ -1562,7 +1562,7 @@ unsigned int disk_clear_events(struct gendisk *disk, unsigned int mask) | ||
58 | |||
59 | /* uncondtionally schedule event check and wait for it to finish */ | ||
60 | disk_block_events(disk); | ||
61 | - queue_delayed_work(system_nrt_wq, &ev->dwork, 0); | ||
62 | + queue_delayed_work(system_nrt_freezable_wq, &ev->dwork, 0); | ||
63 | flush_delayed_work(&ev->dwork); | ||
64 | __disk_unblock_events(disk, false); | ||
65 | |||
66 | @@ -1599,7 +1599,7 @@ static void disk_events_workfn(struct work_struct *work) | ||
67 | |||
68 | intv = disk_events_poll_jiffies(disk); | ||
69 | if (!ev->block && intv) | ||
70 | - queue_delayed_work(system_nrt_wq, &ev->dwork, intv); | ||
71 | + queue_delayed_work(system_nrt_freezable_wq, &ev->dwork, intv); | ||
72 | |||
73 | spin_unlock_irq(&ev->lock); | ||
74 | |||
75 | diff --git a/include/linux/workqueue.h b/include/linux/workqueue.h | ||
76 | index 0d556de..e228ca9 100644 | ||
77 | --- a/include/linux/workqueue.h | ||
78 | +++ b/include/linux/workqueue.h | ||
79 | @@ -289,12 +289,16 @@ enum { | ||
80 | * | ||
81 | * system_freezable_wq is equivalent to system_wq except that it's | ||
82 | * freezable. | ||
83 | + * | ||
84 | + * system_nrt_freezable_wq is equivalent to system_nrt_wq except that | ||
85 | + * it's freezable. | ||
86 | */ | ||
87 | extern struct workqueue_struct *system_wq; | ||
88 | extern struct workqueue_struct *system_long_wq; | ||
89 | extern struct workqueue_struct *system_nrt_wq; | ||
90 | extern struct workqueue_struct *system_unbound_wq; | ||
91 | extern struct workqueue_struct *system_freezable_wq; | ||
92 | +extern struct workqueue_struct *system_nrt_freezable_wq; | ||
93 | |||
94 | extern struct workqueue_struct * | ||
95 | __alloc_workqueue_key(const char *name, unsigned int flags, int max_active, | ||
96 | diff --git a/kernel/workqueue.c b/kernel/workqueue.c | ||
97 | index 42fa9ad..bb425b1 100644 | ||
98 | --- a/kernel/workqueue.c | ||
99 | +++ b/kernel/workqueue.c | ||
100 | @@ -253,11 +253,13 @@ struct workqueue_struct *system_long_wq __read_mostly; | ||
101 | struct workqueue_struct *system_nrt_wq __read_mostly; | ||
102 | struct workqueue_struct *system_unbound_wq __read_mostly; | ||
103 | struct workqueue_struct *system_freezable_wq __read_mostly; | ||
104 | +struct workqueue_struct *system_nrt_freezable_wq __read_mostly; | ||
105 | EXPORT_SYMBOL_GPL(system_wq); | ||
106 | EXPORT_SYMBOL_GPL(system_long_wq); | ||
107 | EXPORT_SYMBOL_GPL(system_nrt_wq); | ||
108 | EXPORT_SYMBOL_GPL(system_unbound_wq); | ||
109 | EXPORT_SYMBOL_GPL(system_freezable_wq); | ||
110 | +EXPORT_SYMBOL_GPL(system_nrt_freezable_wq); | ||
111 | |||
112 | #define CREATE_TRACE_POINTS | ||
113 | #include <trace/events/workqueue.h> | ||
114 | @@ -3821,8 +3823,11 @@ static int __init init_workqueues(void) | ||
115 | WQ_UNBOUND_MAX_ACTIVE); | ||
116 | system_freezable_wq = alloc_workqueue("events_freezable", | ||
117 | WQ_FREEZABLE, 0); | ||
118 | + system_nrt_freezable_wq = alloc_workqueue("events_nrt_freezable", | ||
119 | + WQ_NON_REENTRANT | WQ_FREEZABLE, 0); | ||
120 | BUG_ON(!system_wq || !system_long_wq || !system_nrt_wq || | ||
121 | - !system_unbound_wq || !system_freezable_wq); | ||
122 | + !system_unbound_wq || !system_freezable_wq || | ||
123 | + !system_nrt_freezable_wq); | ||
124 | return 0; | ||
125 | } | ||
126 | early_initcall(init_workqueues); | ||
127 | -- | ||
128 | 1.7.9.4 | ||
129 | |||
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0033-sparc32-Add-Av8-to-assembler-command-line.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0033-sparc32-Add-Av8-to-assembler-command-line.patch new file mode 100644 index 00000000..7807d732 --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0033-sparc32-Add-Av8-to-assembler-command-line.patch | |||
@@ -0,0 +1,40 @@ | |||
1 | From 80a069c15be0297948b3075c0e691832b9241187 Mon Sep 17 00:00:00 2001 | ||
2 | From: "David S. Miller" <davem@davemloft.net> | ||
3 | Date: Tue, 13 Mar 2012 18:19:51 -0700 | ||
4 | Subject: [PATCH 33/42] sparc32: Add -Av8 to assembler command line. | ||
5 | |||
6 | commit e0adb9902fb338a9fe634c3c2a3e474075c733ba upstream. | ||
7 | |||
8 | Newer version of binutils are more strict about specifying the | ||
9 | correct options to enable certain classes of instructions. | ||
10 | |||
11 | The sparc32 build is done for v7 in order to support sun4c systems | ||
12 | which lack hardware integer multiply and divide instructions. | ||
13 | |||
14 | So we have to pass -Av8 when building the assembler routines that | ||
15 | use these instructions and get patched into the kernel when we find | ||
16 | out that we have a v8 capable cpu. | ||
17 | |||
18 | Reported-by: Paul Gortmaker <paul.gortmaker@windriver.com> | ||
19 | Signed-off-by: David S. Miller <davem@davemloft.net> | ||
20 | Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | ||
21 | --- | ||
22 | arch/sparc/Makefile | 2 +- | ||
23 | 1 file changed, 1 insertion(+), 1 deletion(-) | ||
24 | |||
25 | diff --git a/arch/sparc/Makefile b/arch/sparc/Makefile | ||
26 | index ad1fb5d..eddcfb3 100644 | ||
27 | --- a/arch/sparc/Makefile | ||
28 | +++ b/arch/sparc/Makefile | ||
29 | @@ -31,7 +31,7 @@ UTS_MACHINE := sparc | ||
30 | |||
31 | #KBUILD_CFLAGS += -g -pipe -fcall-used-g5 -fcall-used-g7 | ||
32 | KBUILD_CFLAGS += -m32 -pipe -mno-fpu -fcall-used-g5 -fcall-used-g7 | ||
33 | -KBUILD_AFLAGS += -m32 | ||
34 | +KBUILD_AFLAGS += -m32 -Wa,-Av8 | ||
35 | |||
36 | #LDFLAGS_vmlinux = -N -Ttext 0xf0004000 | ||
37 | # Since 2.5.40, the first stage is left not btfix-ed. | ||
38 | -- | ||
39 | 1.7.9.4 | ||
40 | |||
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0034-hwmon-w83627ehf-Fix-writing-into-fan_stop_time-for-N.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0034-hwmon-w83627ehf-Fix-writing-into-fan_stop_time-for-N.patch new file mode 100644 index 00000000..0fb2aca1 --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0034-hwmon-w83627ehf-Fix-writing-into-fan_stop_time-for-N.patch | |||
@@ -0,0 +1,35 @@ | |||
1 | From 0cf88be2891cd60ef2f132c0eb55cb5334b6439d Mon Sep 17 00:00:00 2001 | ||
2 | From: Guenter Roeck <linux@roeck-us.net> | ||
3 | Date: Mon, 12 Mar 2012 08:21:16 -0700 | ||
4 | Subject: [PATCH 34/42] hwmon: (w83627ehf) Fix writing into fan_stop_time for | ||
5 | NCT6775F/NCT6776F | ||
6 | |||
7 | commit 33fa9b620409edfc71aa6cf01a51f990fbe46ab8 upstream. | ||
8 | |||
9 | NCT6775F and NCT6776F have their own set of registers for FAN_STOP_TIME. The | ||
10 | correct registers were used to read FAN_STOP_TIME, but writes used the wrong | ||
11 | registers. Fix it. | ||
12 | |||
13 | Signed-off-by: Guenter Roeck <linux@roeck-us.net> | ||
14 | Acked-by: Jean Delvare <khali@linux-fr.org> | ||
15 | Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | ||
16 | --- | ||
17 | drivers/hwmon/w83627ehf.c | 2 +- | ||
18 | 1 file changed, 1 insertion(+), 1 deletion(-) | ||
19 | |||
20 | diff --git a/drivers/hwmon/w83627ehf.c b/drivers/hwmon/w83627ehf.c | ||
21 | index c25387d..7a44a56 100644 | ||
22 | --- a/drivers/hwmon/w83627ehf.c | ||
23 | +++ b/drivers/hwmon/w83627ehf.c | ||
24 | @@ -1607,7 +1607,7 @@ store_##reg(struct device *dev, struct device_attribute *attr, \ | ||
25 | val = step_time_to_reg(val, data->pwm_mode[nr]); \ | ||
26 | mutex_lock(&data->update_lock); \ | ||
27 | data->reg[nr] = val; \ | ||
28 | - w83627ehf_write_value(data, W83627EHF_REG_##REG[nr], val); \ | ||
29 | + w83627ehf_write_value(data, data->REG_##REG[nr], val); \ | ||
30 | mutex_unlock(&data->update_lock); \ | ||
31 | return count; \ | ||
32 | } \ | ||
33 | -- | ||
34 | 1.7.9.4 | ||
35 | |||
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0035-hwmon-w83627ehf-Fix-memory-leak-in-probe-function.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0035-hwmon-w83627ehf-Fix-memory-leak-in-probe-function.patch new file mode 100644 index 00000000..0df8c385 --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0035-hwmon-w83627ehf-Fix-memory-leak-in-probe-function.patch | |||
@@ -0,0 +1,53 @@ | |||
1 | From 61fa0a2298850898c90ce67bb0b9b440c452820a Mon Sep 17 00:00:00 2001 | ||
2 | From: Guenter Roeck <linux@roeck-us.net> | ||
3 | Date: Mon, 12 Mar 2012 08:33:10 -0700 | ||
4 | Subject: [PATCH 35/42] hwmon: (w83627ehf) Fix memory leak in probe function | ||
5 | |||
6 | commit 32260d94408c553dca4ce54104edf79941a27536 upstream. | ||
7 | |||
8 | The driver probe function leaked memory if creating the cpu0_vid attribute file | ||
9 | failed. Fix by converting the driver to use devm_kzalloc. | ||
10 | |||
11 | Signed-off-by: Guenter Roeck <linux@roeck-us.net> | ||
12 | Acked-by: Jean Delvare <khali@linux-fr.org> | ||
13 | Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | ||
14 | --- | ||
15 | drivers/hwmon/w83627ehf.c | 7 +++---- | ||
16 | 1 file changed, 3 insertions(+), 4 deletions(-) | ||
17 | |||
18 | diff --git a/drivers/hwmon/w83627ehf.c b/drivers/hwmon/w83627ehf.c | ||
19 | index 7a44a56..3ffa1fa 100644 | ||
20 | --- a/drivers/hwmon/w83627ehf.c | ||
21 | +++ b/drivers/hwmon/w83627ehf.c | ||
22 | @@ -2004,7 +2004,8 @@ static int __devinit w83627ehf_probe(struct platform_device *pdev) | ||
23 | goto exit; | ||
24 | } | ||
25 | |||
26 | - data = kzalloc(sizeof(struct w83627ehf_data), GFP_KERNEL); | ||
27 | + data = devm_kzalloc(&pdev->dev, sizeof(struct w83627ehf_data), | ||
28 | + GFP_KERNEL); | ||
29 | if (!data) { | ||
30 | err = -ENOMEM; | ||
31 | goto exit_release; | ||
32 | @@ -2498,9 +2499,8 @@ static int __devinit w83627ehf_probe(struct platform_device *pdev) | ||
33 | |||
34 | exit_remove: | ||
35 | w83627ehf_device_remove_files(dev); | ||
36 | - kfree(data); | ||
37 | - platform_set_drvdata(pdev, NULL); | ||
38 | exit_release: | ||
39 | + platform_set_drvdata(pdev, NULL); | ||
40 | release_region(res->start, IOREGION_LENGTH); | ||
41 | exit: | ||
42 | return err; | ||
43 | @@ -2514,7 +2514,6 @@ static int __devexit w83627ehf_remove(struct platform_device *pdev) | ||
44 | w83627ehf_device_remove_files(&pdev->dev); | ||
45 | release_region(data->addr, IOREGION_LENGTH); | ||
46 | platform_set_drvdata(pdev, NULL); | ||
47 | - kfree(data); | ||
48 | |||
49 | return 0; | ||
50 | } | ||
51 | -- | ||
52 | 1.7.9.4 | ||
53 | |||
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0036-hwmon-w83627ehf-Fix-temp2-source-for-W83627UHG.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0036-hwmon-w83627ehf-Fix-temp2-source-for-W83627UHG.patch new file mode 100644 index 00000000..40044dd0 --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0036-hwmon-w83627ehf-Fix-temp2-source-for-W83627UHG.patch | |||
@@ -0,0 +1,69 @@ | |||
1 | From 9a7969b58bd5d4f2c05fefa4143f244ccb5b06ab Mon Sep 17 00:00:00 2001 | ||
2 | From: Jean Delvare <khali@linux-fr.org> | ||
3 | Date: Tue, 13 Mar 2012 04:03:27 -0400 | ||
4 | Subject: [PATCH 36/42] hwmon: (w83627ehf) Fix temp2 source for W83627UHG | ||
5 | |||
6 | commit aacb6b0052692c72fe0cb94c6b547202def6ef46 upstream. | ||
7 | |||
8 | Properly set the source of temp2 for the W83627UHG. Also fix a | ||
9 | comment right before that, and document the W83627UHG as reporting up | ||
10 | to 3 temperatures. | ||
11 | |||
12 | Signed-off-by: Jean Delvare <khali@linux-fr.org> | ||
13 | Cc: Guenter Roeck <guenter.roeck@ericsson.com> | ||
14 | Signed-off-by: Guenter Roeck <guenter.roeck@ericsson.com> | ||
15 | Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | ||
16 | --- | ||
17 | Documentation/hwmon/w83627ehf | 2 +- | ||
18 | drivers/hwmon/w83627ehf.c | 8 ++++---- | ||
19 | 2 files changed, 5 insertions(+), 5 deletions(-) | ||
20 | |||
21 | diff --git a/Documentation/hwmon/w83627ehf b/Documentation/hwmon/w83627ehf | ||
22 | index 3f44dbd..75f3155 100644 | ||
23 | --- a/Documentation/hwmon/w83627ehf | ||
24 | +++ b/Documentation/hwmon/w83627ehf | ||
25 | @@ -50,7 +50,7 @@ W83627DHG, W83627DHG-P, W83627UHG, W83667HG, W83667HG-B, W83667HG-I | ||
26 | (NCT6775F), and NCT6776F super I/O chips. We will refer to them collectively | ||
27 | as Winbond chips. | ||
28 | |||
29 | -The chips implement 2 to 4 temperature sensors (9 for NCT6775F and NCT6776F), | ||
30 | +The chips implement 3 to 4 temperature sensors (9 for NCT6775F and NCT6776F), | ||
31 | 2 to 5 fan rotation speed sensors, 8 to 10 analog voltage sensors, one VID | ||
32 | (except for 627UHG), alarms with beep warnings (control unimplemented), | ||
33 | and some automatic fan regulation strategies (plus manual fan control mode). | ||
34 | diff --git a/drivers/hwmon/w83627ehf.c b/drivers/hwmon/w83627ehf.c | ||
35 | index 3ffa1fa..ceaec92 100644 | ||
36 | --- a/drivers/hwmon/w83627ehf.c | ||
37 | +++ b/drivers/hwmon/w83627ehf.c | ||
38 | @@ -39,7 +39,7 @@ | ||
39 | 0x8860 0xa1 | ||
40 | w83627dhg 9 5 4 3 0xa020 0xc1 0x5ca3 | ||
41 | w83627dhg-p 9 5 4 3 0xb070 0xc1 0x5ca3 | ||
42 | - w83627uhg 8 2 2 2 0xa230 0xc1 0x5ca3 | ||
43 | + w83627uhg 8 2 2 3 0xa230 0xc1 0x5ca3 | ||
44 | w83667hg 9 5 3 3 0xa510 0xc1 0x5ca3 | ||
45 | w83667hg-b 9 5 3 4 0xb350 0xc1 0x5ca3 | ||
46 | nct6775f 9 4 3 9 0xb470 0xc1 0x5ca3 | ||
47 | @@ -2158,16 +2158,16 @@ static int __devinit w83627ehf_probe(struct platform_device *pdev) | ||
48 | w83627ehf_set_temp_reg_ehf(data, 3); | ||
49 | |||
50 | /* | ||
51 | - * Temperature sources for temp1 and temp2 are selected with | ||
52 | + * Temperature sources for temp2 and temp3 are selected with | ||
53 | * bank 0, registers 0x49 and 0x4a. | ||
54 | */ | ||
55 | data->temp_src[0] = 0; /* SYSTIN */ | ||
56 | reg = w83627ehf_read_value(data, 0x49) & 0x07; | ||
57 | /* Adjust to have the same mapping as other source registers */ | ||
58 | if (reg == 0) | ||
59 | - data->temp_src[1]++; | ||
60 | + data->temp_src[1] = 1; | ||
61 | else if (reg >= 2 && reg <= 5) | ||
62 | - data->temp_src[1] += 2; | ||
63 | + data->temp_src[1] = reg + 2; | ||
64 | else /* should never happen */ | ||
65 | data->have_temp &= ~(1 << 1); | ||
66 | reg = w83627ehf_read_value(data, 0x4a); | ||
67 | -- | ||
68 | 1.7.9.4 | ||
69 | |||
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0037-rapidio-tsi721-fix-bug-in-register-offset-definition.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0037-rapidio-tsi721-fix-bug-in-register-offset-definition.patch new file mode 100644 index 00000000..4f59e542 --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0037-rapidio-tsi721-fix-bug-in-register-offset-definition.patch | |||
@@ -0,0 +1,103 @@ | |||
1 | From 4998c8b933c68ede83d8c017928a6666d26b42de Mon Sep 17 00:00:00 2001 | ||
2 | From: Alexandre Bounine <alexandre.bounine@idt.com> | ||
3 | Date: Thu, 15 Mar 2012 15:17:09 -0700 | ||
4 | Subject: [PATCH 37/42] rapidio/tsi721: fix bug in register offset definitions | ||
5 | |||
6 | commit 9bbad7da76b3dd578fb55c862624366a8c9ccd22 upstream. | ||
7 | |||
8 | Fix indexed register offset definitions that use decimal (wrong) instead | ||
9 | of hexadecimal (correct) notation for indexing multipliers. | ||
10 | |||
11 | Incorrect definitions do not affect Tsi721 driver in its current default | ||
12 | configuration because it uses only IDB queue 0. Loss of inbound | ||
13 | doorbell functionality should be observed if queue other than 0 is used. | ||
14 | |||
15 | Signed-off-by: Alexandre Bounine <alexandre.bounine@idt.com> | ||
16 | Cc: Matt Porter <mporter@kernel.crashing.org> | ||
17 | Cc: Chul Kim <chul.kim@idt.com> | ||
18 | Signed-off-by: Andrew Morton <akpm@linux-foundation.org> | ||
19 | Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> | ||
20 | Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | ||
21 | --- | ||
22 | drivers/rapidio/devices/tsi721.h | 30 +++++++++++++++--------------- | ||
23 | 1 file changed, 15 insertions(+), 15 deletions(-) | ||
24 | |||
25 | diff --git a/drivers/rapidio/devices/tsi721.h b/drivers/rapidio/devices/tsi721.h | ||
26 | index 822e54c..1c226b3 100644 | ||
27 | --- a/drivers/rapidio/devices/tsi721.h | ||
28 | +++ b/drivers/rapidio/devices/tsi721.h | ||
29 | @@ -118,34 +118,34 @@ | ||
30 | |||
31 | #define TSI721_IDB_ENTRY_SIZE 64 | ||
32 | |||
33 | -#define TSI721_IDQ_CTL(x) (0x20000 + (x) * 1000) | ||
34 | +#define TSI721_IDQ_CTL(x) (0x20000 + (x) * 0x1000) | ||
35 | #define TSI721_IDQ_SUSPEND 0x00000002 | ||
36 | #define TSI721_IDQ_INIT 0x00000001 | ||
37 | |||
38 | -#define TSI721_IDQ_STS(x) (0x20004 + (x) * 1000) | ||
39 | +#define TSI721_IDQ_STS(x) (0x20004 + (x) * 0x1000) | ||
40 | #define TSI721_IDQ_RUN 0x00200000 | ||
41 | |||
42 | -#define TSI721_IDQ_MASK(x) (0x20008 + (x) * 1000) | ||
43 | +#define TSI721_IDQ_MASK(x) (0x20008 + (x) * 0x1000) | ||
44 | #define TSI721_IDQ_MASK_MASK 0xffff0000 | ||
45 | #define TSI721_IDQ_MASK_PATT 0x0000ffff | ||
46 | |||
47 | -#define TSI721_IDQ_RP(x) (0x2000c + (x) * 1000) | ||
48 | +#define TSI721_IDQ_RP(x) (0x2000c + (x) * 0x1000) | ||
49 | #define TSI721_IDQ_RP_PTR 0x0007ffff | ||
50 | |||
51 | -#define TSI721_IDQ_WP(x) (0x20010 + (x) * 1000) | ||
52 | +#define TSI721_IDQ_WP(x) (0x20010 + (x) * 0x1000) | ||
53 | #define TSI721_IDQ_WP_PTR 0x0007ffff | ||
54 | |||
55 | -#define TSI721_IDQ_BASEL(x) (0x20014 + (x) * 1000) | ||
56 | +#define TSI721_IDQ_BASEL(x) (0x20014 + (x) * 0x1000) | ||
57 | #define TSI721_IDQ_BASEL_ADDR 0xffffffc0 | ||
58 | -#define TSI721_IDQ_BASEU(x) (0x20018 + (x) * 1000) | ||
59 | -#define TSI721_IDQ_SIZE(x) (0x2001c + (x) * 1000) | ||
60 | +#define TSI721_IDQ_BASEU(x) (0x20018 + (x) * 0x1000) | ||
61 | +#define TSI721_IDQ_SIZE(x) (0x2001c + (x) * 0x1000) | ||
62 | #define TSI721_IDQ_SIZE_VAL(size) (__fls(size) - 4) | ||
63 | #define TSI721_IDQ_SIZE_MIN 512 | ||
64 | #define TSI721_IDQ_SIZE_MAX (512 * 1024) | ||
65 | |||
66 | -#define TSI721_SR_CHINT(x) (0x20040 + (x) * 1000) | ||
67 | -#define TSI721_SR_CHINTE(x) (0x20044 + (x) * 1000) | ||
68 | -#define TSI721_SR_CHINTSET(x) (0x20048 + (x) * 1000) | ||
69 | +#define TSI721_SR_CHINT(x) (0x20040 + (x) * 0x1000) | ||
70 | +#define TSI721_SR_CHINTE(x) (0x20044 + (x) * 0x1000) | ||
71 | +#define TSI721_SR_CHINTSET(x) (0x20048 + (x) * 0x1000) | ||
72 | #define TSI721_SR_CHINT_ODBOK 0x00000020 | ||
73 | #define TSI721_SR_CHINT_IDBQRCV 0x00000010 | ||
74 | #define TSI721_SR_CHINT_SUSP 0x00000008 | ||
75 | @@ -156,7 +156,7 @@ | ||
76 | |||
77 | #define TSI721_IBWIN_NUM 8 | ||
78 | |||
79 | -#define TSI721_IBWINLB(x) (0x29000 + (x) * 20) | ||
80 | +#define TSI721_IBWINLB(x) (0x29000 + (x) * 0x20) | ||
81 | #define TSI721_IBWINLB_BA 0xfffff000 | ||
82 | #define TSI721_IBWINLB_WEN 0x00000001 | ||
83 | |||
84 | @@ -187,13 +187,13 @@ | ||
85 | */ | ||
86 | #define TSI721_OBWIN_NUM TSI721_PC2SR_WINS | ||
87 | |||
88 | -#define TSI721_OBWINLB(x) (0x40000 + (x) * 20) | ||
89 | +#define TSI721_OBWINLB(x) (0x40000 + (x) * 0x20) | ||
90 | #define TSI721_OBWINLB_BA 0xffff8000 | ||
91 | #define TSI721_OBWINLB_WEN 0x00000001 | ||
92 | |||
93 | -#define TSI721_OBWINUB(x) (0x40004 + (x) * 20) | ||
94 | +#define TSI721_OBWINUB(x) (0x40004 + (x) * 0x20) | ||
95 | |||
96 | -#define TSI721_OBWINSZ(x) (0x40008 + (x) * 20) | ||
97 | +#define TSI721_OBWINSZ(x) (0x40008 + (x) * 0x20) | ||
98 | #define TSI721_OBWINSZ_SIZE 0x00001f00 | ||
99 | #define TSI721_OBWIN_SIZE(size) (__fls(size) - 15) | ||
100 | |||
101 | -- | ||
102 | 1.7.9.4 | ||
103 | |||
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0038-i2c-algo-bit-Fix-spurious-SCL-timeouts-under-heavy-l.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0038-i2c-algo-bit-Fix-spurious-SCL-timeouts-under-heavy-l.patch new file mode 100644 index 00000000..896f6abc --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0038-i2c-algo-bit-Fix-spurious-SCL-timeouts-under-heavy-l.patch | |||
@@ -0,0 +1,46 @@ | |||
1 | From 67d192ddf0b8fb26bc4f8f2cf405b984174522b8 Mon Sep 17 00:00:00 2001 | ||
2 | From: Ville Syrjala <syrjala@sci.fi> | ||
3 | Date: Thu, 15 Mar 2012 18:11:05 +0100 | ||
4 | Subject: [PATCH 38/42] i2c-algo-bit: Fix spurious SCL timeouts under heavy | ||
5 | load | ||
6 | |||
7 | commit 8ee161ce5e0cfc689eb677f227a6248191165fac upstream. | ||
8 | |||
9 | When the system is under heavy load, there can be a significant delay | ||
10 | between the getscl() and time_after() calls inside sclhi(). That delay | ||
11 | may cause the time_after() check to trigger after SCL has gone high, | ||
12 | causing sclhi() to return -ETIMEDOUT. | ||
13 | |||
14 | To fix the problem, double check that SCL is still low after the | ||
15 | timeout has been reached, before deciding to return -ETIMEDOUT. | ||
16 | |||
17 | Signed-off-by: Ville Syrjala <syrjala@sci.fi> | ||
18 | Signed-off-by: Jean Delvare <khali@linux-fr.org> | ||
19 | Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | ||
20 | --- | ||
21 | drivers/i2c/algos/i2c-algo-bit.c | 8 +++++++- | ||
22 | 1 file changed, 7 insertions(+), 1 deletion(-) | ||
23 | |||
24 | diff --git a/drivers/i2c/algos/i2c-algo-bit.c b/drivers/i2c/algos/i2c-algo-bit.c | ||
25 | index 525c734..24f94f4 100644 | ||
26 | --- a/drivers/i2c/algos/i2c-algo-bit.c | ||
27 | +++ b/drivers/i2c/algos/i2c-algo-bit.c | ||
28 | @@ -103,8 +103,14 @@ static int sclhi(struct i2c_algo_bit_data *adap) | ||
29 | * chips may hold it low ("clock stretching") while they | ||
30 | * are processing data internally. | ||
31 | */ | ||
32 | - if (time_after(jiffies, start + adap->timeout)) | ||
33 | + if (time_after(jiffies, start + adap->timeout)) { | ||
34 | + /* Test one last time, as we may have been preempted | ||
35 | + * between last check and timeout test. | ||
36 | + */ | ||
37 | + if (getscl(adap)) | ||
38 | + break; | ||
39 | return -ETIMEDOUT; | ||
40 | + } | ||
41 | cond_resched(); | ||
42 | } | ||
43 | #ifdef DEBUG | ||
44 | -- | ||
45 | 1.7.9.4 | ||
46 | |||
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0039-iscsi-target-Fix-reservation-conflict-EBUSY-response.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0039-iscsi-target-Fix-reservation-conflict-EBUSY-response.patch new file mode 100644 index 00000000..3b071da9 --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0039-iscsi-target-Fix-reservation-conflict-EBUSY-response.patch | |||
@@ -0,0 +1,51 @@ | |||
1 | From 68cefddd17e9b4f4600a64b0351acff4bb250419 Mon Sep 17 00:00:00 2001 | ||
2 | From: Nicholas Bellinger <nab@linux-iscsi.org> | ||
3 | Date: Tue, 13 Mar 2012 18:20:11 -0700 | ||
4 | Subject: [PATCH 39/42] iscsi-target: Fix reservation conflict -EBUSY response | ||
5 | handling bug | ||
6 | |||
7 | commit 00fdc6bbef77844ce397a7de7acfaf25e8e2e4eb upstream. | ||
8 | |||
9 | This patch addresses a iscsi-target specific bug related to reservation conflict | ||
10 | handling in iscsit_handle_scsi_cmd() that has been causing reservation conflicts | ||
11 | to complete and not fail as expected due to incorrect errno checking. The problem | ||
12 | occured with the change to return -EBUSY from transport_generic_cmd_sequencer() -> | ||
13 | transport_generic_allocate_tasks() failures, that broke iscsit_handle_scsi_cmd() | ||
14 | checking for -EINVAL in order to invoke a non GOOD status response. | ||
15 | |||
16 | This was manifesting itself as data corruption with legacy SPC-2 reservations, | ||
17 | but also effects iscsi-target LUNs with SPC-3 persistent reservations. | ||
18 | |||
19 | This bug was originally introduced in lio-core commit: | ||
20 | |||
21 | commit 03e98c9eb916f3f0868c1dc344dde2a60287ff72 | ||
22 | Author: Nicholas Bellinger <nab@linux-iscsi.org> | ||
23 | Date: Fri Nov 4 02:36:16 2011 -0700 | ||
24 | |||
25 | target: Address legacy PYX_TRANSPORT_* return code breakage | ||
26 | |||
27 | Reported-by: Martin Svec <martin.svec@zoner.cz> | ||
28 | Cc: Martin Svec <martin.svec@zoner.cz> | ||
29 | Cc: Christoph Hellwig <hch@lst.de> | ||
30 | Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org> | ||
31 | Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | ||
32 | --- | ||
33 | drivers/target/iscsi/iscsi_target.c | 2 +- | ||
34 | 1 file changed, 1 insertion(+), 1 deletion(-) | ||
35 | |||
36 | diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c | ||
37 | index 0c1d5c73..03d3528 100644 | ||
38 | --- a/drivers/target/iscsi/iscsi_target.c | ||
39 | +++ b/drivers/target/iscsi/iscsi_target.c | ||
40 | @@ -1029,7 +1029,7 @@ done: | ||
41 | return iscsit_add_reject_from_cmd( | ||
42 | ISCSI_REASON_BOOKMARK_NO_RESOURCES, | ||
43 | 1, 1, buf, cmd); | ||
44 | - } else if (transport_ret == -EINVAL) { | ||
45 | + } else if (transport_ret < 0) { | ||
46 | /* | ||
47 | * Unsupported SAM Opcode. CHECK_CONDITION will be sent | ||
48 | * in iscsit_execute_cmd() during the CmdSN OOO Execution | ||
49 | -- | ||
50 | 1.7.9.4 | ||
51 | |||
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0040-target-Fix-compatible-reservation-handling-CRH-1-wit.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0040-target-Fix-compatible-reservation-handling-CRH-1-wit.patch new file mode 100644 index 00000000..1673697d --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0040-target-Fix-compatible-reservation-handling-CRH-1-wit.patch | |||
@@ -0,0 +1,152 @@ | |||
1 | From 16add6db674e266a62219145284435960e47435e Mon Sep 17 00:00:00 2001 | ||
2 | From: Nicholas Bellinger <nab@linux-iscsi.org> | ||
3 | Date: Tue, 13 Mar 2012 21:29:06 -0700 | ||
4 | Subject: [PATCH 40/42] target: Fix compatible reservation handling (CRH=1) | ||
5 | with legacy RESERVE/RELEASE | ||
6 | |||
7 | commit 087a03b3ea1c8d6e2d5743a8d1c6d571058caa04 upstream. | ||
8 | |||
9 | This patch addresses a bug with target_check_scsi2_reservation_conflict() | ||
10 | return checking in target_scsi2_reservation_[reserve,release]() that was | ||
11 | preventing CRH=1 operation from silently succeeding in the two special | ||
12 | cases defined by SPC-3, and not failing with reservation conflict status | ||
13 | when dealing with legacy RESERVE/RELEASE + active SPC-3 PR logic. | ||
14 | |||
15 | Also explictly set cmd->scsi_status = SAM_STAT_RESERVATION_CONFLICT during | ||
16 | the early non reservation holder failure from pr_ops->t10_seq_non_holder() | ||
17 | check in transport_generic_cmd_sequencer() for fabrics that already expect | ||
18 | it to be set. | ||
19 | |||
20 | This bug was originally introduced in mainline commit: | ||
21 | |||
22 | commit eacac00ce5bfde8086cd0615fb53c986f7f970fe | ||
23 | Author: Christoph Hellwig <hch@infradead.org> | ||
24 | Date: Thu Nov 3 17:50:40 2011 -0400 | ||
25 | |||
26 | target: split core_scsi2_emulate_crh | ||
27 | |||
28 | Reported-by: Martin Svec <martin.svec@zoner.cz> | ||
29 | Cc: Martin Svec <martin.svec@zoner.cz> | ||
30 | Cc: Christoph Hellwig <hch@lst.de> | ||
31 | Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org> | ||
32 | Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | ||
33 | --- | ||
34 | drivers/target/target_core_pr.c | 34 +++++++++++++++++++++----------- | ||
35 | drivers/target/target_core_transport.c | 1 + | ||
36 | 2 files changed, 23 insertions(+), 12 deletions(-) | ||
37 | |||
38 | diff --git a/drivers/target/target_core_pr.c b/drivers/target/target_core_pr.c | ||
39 | index 778c1a6..6cf6ff4 100644 | ||
40 | --- a/drivers/target/target_core_pr.c | ||
41 | +++ b/drivers/target/target_core_pr.c | ||
42 | @@ -120,7 +120,7 @@ static struct t10_pr_registration *core_scsi3_locate_pr_reg(struct se_device *, | ||
43 | struct se_node_acl *, struct se_session *); | ||
44 | static void core_scsi3_put_pr_reg(struct t10_pr_registration *); | ||
45 | |||
46 | -static int target_check_scsi2_reservation_conflict(struct se_cmd *cmd, int *ret) | ||
47 | +static int target_check_scsi2_reservation_conflict(struct se_cmd *cmd) | ||
48 | { | ||
49 | struct se_session *se_sess = cmd->se_sess; | ||
50 | struct se_subsystem_dev *su_dev = cmd->se_dev->se_sub_dev; | ||
51 | @@ -130,7 +130,7 @@ static int target_check_scsi2_reservation_conflict(struct se_cmd *cmd, int *ret) | ||
52 | int conflict = 0; | ||
53 | |||
54 | if (!crh) | ||
55 | - return false; | ||
56 | + return -EINVAL; | ||
57 | |||
58 | pr_reg = core_scsi3_locate_pr_reg(cmd->se_dev, se_sess->se_node_acl, | ||
59 | se_sess); | ||
60 | @@ -158,16 +158,14 @@ static int target_check_scsi2_reservation_conflict(struct se_cmd *cmd, int *ret) | ||
61 | */ | ||
62 | if (pr_reg->pr_res_holder) { | ||
63 | core_scsi3_put_pr_reg(pr_reg); | ||
64 | - *ret = 0; | ||
65 | - return false; | ||
66 | + return 1; | ||
67 | } | ||
68 | if ((pr_reg->pr_res_type == PR_TYPE_WRITE_EXCLUSIVE_REGONLY) || | ||
69 | (pr_reg->pr_res_type == PR_TYPE_EXCLUSIVE_ACCESS_REGONLY) || | ||
70 | (pr_reg->pr_res_type == PR_TYPE_WRITE_EXCLUSIVE_ALLREG) || | ||
71 | (pr_reg->pr_res_type == PR_TYPE_EXCLUSIVE_ACCESS_ALLREG)) { | ||
72 | core_scsi3_put_pr_reg(pr_reg); | ||
73 | - *ret = 0; | ||
74 | - return true; | ||
75 | + return 1; | ||
76 | } | ||
77 | core_scsi3_put_pr_reg(pr_reg); | ||
78 | conflict = 1; | ||
79 | @@ -192,10 +190,10 @@ static int target_check_scsi2_reservation_conflict(struct se_cmd *cmd, int *ret) | ||
80 | " while active SPC-3 registrations exist," | ||
81 | " returning RESERVATION_CONFLICT\n"); | ||
82 | cmd->scsi_sense_reason = TCM_RESERVATION_CONFLICT; | ||
83 | - return true; | ||
84 | + return -EBUSY; | ||
85 | } | ||
86 | |||
87 | - return false; | ||
88 | + return 0; | ||
89 | } | ||
90 | |||
91 | int target_scsi2_reservation_release(struct se_task *task) | ||
92 | @@ -204,12 +202,18 @@ int target_scsi2_reservation_release(struct se_task *task) | ||
93 | struct se_device *dev = cmd->se_dev; | ||
94 | struct se_session *sess = cmd->se_sess; | ||
95 | struct se_portal_group *tpg = sess->se_tpg; | ||
96 | - int ret = 0; | ||
97 | + int ret = 0, rc; | ||
98 | |||
99 | if (!sess || !tpg) | ||
100 | goto out; | ||
101 | - if (target_check_scsi2_reservation_conflict(cmd, &ret)) | ||
102 | + rc = target_check_scsi2_reservation_conflict(cmd); | ||
103 | + if (rc == 1) | ||
104 | + goto out; | ||
105 | + else if (rc < 0) { | ||
106 | + cmd->scsi_sense_reason = TCM_RESERVATION_CONFLICT; | ||
107 | + ret = -EINVAL; | ||
108 | goto out; | ||
109 | + } | ||
110 | |||
111 | ret = 0; | ||
112 | spin_lock(&dev->dev_reservation_lock); | ||
113 | @@ -246,7 +250,7 @@ int target_scsi2_reservation_reserve(struct se_task *task) | ||
114 | struct se_device *dev = cmd->se_dev; | ||
115 | struct se_session *sess = cmd->se_sess; | ||
116 | struct se_portal_group *tpg = sess->se_tpg; | ||
117 | - int ret = 0; | ||
118 | + int ret = 0, rc; | ||
119 | |||
120 | if ((cmd->t_task_cdb[1] & 0x01) && | ||
121 | (cmd->t_task_cdb[1] & 0x02)) { | ||
122 | @@ -262,8 +266,14 @@ int target_scsi2_reservation_reserve(struct se_task *task) | ||
123 | */ | ||
124 | if (!sess || !tpg) | ||
125 | goto out; | ||
126 | - if (target_check_scsi2_reservation_conflict(cmd, &ret)) | ||
127 | + rc = target_check_scsi2_reservation_conflict(cmd); | ||
128 | + if (rc == 1) | ||
129 | goto out; | ||
130 | + else if (rc < 0) { | ||
131 | + cmd->scsi_sense_reason = TCM_RESERVATION_CONFLICT; | ||
132 | + ret = -EINVAL; | ||
133 | + goto out; | ||
134 | + } | ||
135 | |||
136 | ret = 0; | ||
137 | spin_lock(&dev->dev_reservation_lock); | ||
138 | diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c | ||
139 | index e4ddb93..cdb774b 100644 | ||
140 | --- a/drivers/target/target_core_transport.c | ||
141 | +++ b/drivers/target/target_core_transport.c | ||
142 | @@ -2507,6 +2507,7 @@ static int transport_generic_cmd_sequencer( | ||
143 | cmd, cdb, pr_reg_type) != 0) { | ||
144 | cmd->se_cmd_flags |= SCF_SCSI_CDB_EXCEPTION; | ||
145 | cmd->se_cmd_flags |= SCF_SCSI_RESERVATION_CONFLICT; | ||
146 | + cmd->scsi_status = SAM_STAT_RESERVATION_CONFLICT; | ||
147 | cmd->scsi_sense_reason = TCM_RESERVATION_CONFLICT; | ||
148 | return -EBUSY; | ||
149 | } | ||
150 | -- | ||
151 | 1.7.9.4 | ||
152 | |||
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0041-hwmon-zl6100-Enable-interval-between-chip-accesses-f.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0041-hwmon-zl6100-Enable-interval-between-chip-accesses-f.patch new file mode 100644 index 00000000..7d266e88 --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0041-hwmon-zl6100-Enable-interval-between-chip-accesses-f.patch | |||
@@ -0,0 +1,72 @@ | |||
1 | From e4dffc01371682d0b23d22f1fe611f96b53cc486 Mon Sep 17 00:00:00 2001 | ||
2 | From: Guenter Roeck <guenter.roeck@ericsson.com> | ||
3 | Date: Tue, 13 Mar 2012 09:05:14 -0700 | ||
4 | Subject: [PATCH 41/42] hwmon: (zl6100) Enable interval between chip accesses | ||
5 | for all chips | ||
6 | |||
7 | commit fecfb64422d91a9621a3f96ab75c3a5f13e80b58 upstream. | ||
8 | |||
9 | Intersil reports that all chips supported by the zl6100 driver require | ||
10 | an interval between chip accesses, even ZL2004 and ZL6105 which were thought | ||
11 | to be safe. | ||
12 | |||
13 | Reported-by: Vivek Gani <vgani@intersil.com> | ||
14 | Signed-off-by: Guenter Roeck <guenter.roeck@ericsson.com> | ||
15 | Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | ||
16 | --- | ||
17 | Documentation/hwmon/zl6100 | 14 ++++++-------- | ||
18 | drivers/hwmon/pmbus/zl6100.c | 11 +++-------- | ||
19 | 2 files changed, 9 insertions(+), 16 deletions(-) | ||
20 | |||
21 | diff --git a/Documentation/hwmon/zl6100 b/Documentation/hwmon/zl6100 | ||
22 | index 7617798..c5e1a5b 100644 | ||
23 | --- a/Documentation/hwmon/zl6100 | ||
24 | +++ b/Documentation/hwmon/zl6100 | ||
25 | @@ -73,14 +73,12 @@ Module parameters | ||
26 | delay | ||
27 | ----- | ||
28 | |||
29 | -Some Intersil/Zilker Labs DC-DC controllers require a minimum interval between | ||
30 | -I2C bus accesses. According to Intersil, the minimum interval is 2 ms, though | ||
31 | -1 ms appears to be sufficient and has not caused any problems in testing. | ||
32 | -The problem is known to affect ZL6100, ZL2105, and ZL2008. It is known not to | ||
33 | -affect ZL2004 and ZL6105. The driver automatically sets the interval to 1 ms | ||
34 | -except for ZL2004 and ZL6105. To enable manual override, the driver provides a | ||
35 | -writeable module parameter, 'delay', which can be used to set the interval to | ||
36 | -a value between 0 and 65,535 microseconds. | ||
37 | +Intersil/Zilker Labs DC-DC controllers require a minimum interval between I2C | ||
38 | +bus accesses. According to Intersil, the minimum interval is 2 ms, though 1 ms | ||
39 | +appears to be sufficient and has not caused any problems in testing. The problem | ||
40 | +is known to affect all currently supported chips. For manual override, the | ||
41 | +driver provides a writeable module parameter, 'delay', which can be used to set | ||
42 | +the interval to a value between 0 and 65,535 microseconds. | ||
43 | |||
44 | |||
45 | Sysfs entries | ||
46 | diff --git a/drivers/hwmon/pmbus/zl6100.c b/drivers/hwmon/pmbus/zl6100.c | ||
47 | index ba296fd..5c5cdd2 100644 | ||
48 | --- a/drivers/hwmon/pmbus/zl6100.c | ||
49 | +++ b/drivers/hwmon/pmbus/zl6100.c | ||
50 | @@ -178,16 +178,11 @@ static int zl6100_probe(struct i2c_client *client, | ||
51 | data->id = mid->driver_data; | ||
52 | |||
53 | /* | ||
54 | - * ZL2008, ZL2105, and ZL6100 are known to require a wait time | ||
55 | - * between I2C accesses. ZL2004 and ZL6105 are known to be safe. | ||
56 | - * | ||
57 | - * Only clear the wait time for chips known to be safe. The wait time | ||
58 | - * can be cleared later for additional chips if tests show that it | ||
59 | - * is not needed (in other words, better be safe than sorry). | ||
60 | + * According to information from the chip vendor, all currently | ||
61 | + * supported chips are known to require a wait time between I2C | ||
62 | + * accesses. | ||
63 | */ | ||
64 | data->delay = delay; | ||
65 | - if (data->id == zl2004 || data->id == zl6105) | ||
66 | - data->delay = 0; | ||
67 | |||
68 | /* | ||
69 | * Since there was a direct I2C device access above, wait before | ||
70 | -- | ||
71 | 1.7.9.4 | ||
72 | |||
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0042-Linux-3.2.12.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0042-Linux-3.2.12.patch new file mode 100644 index 00000000..282912d1 --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0042-Linux-3.2.12.patch | |||
@@ -0,0 +1,24 @@ | |||
1 | From 5193c69b7a34cf74e5cd0ed629eb921c3f029b3e Mon Sep 17 00:00:00 2001 | ||
2 | From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | ||
3 | Date: Mon, 19 Mar 2012 09:03:17 -0700 | ||
4 | Subject: [PATCH 42/42] Linux 3.2.12 | ||
5 | |||
6 | --- | ||
7 | Makefile | 2 +- | ||
8 | 1 file changed, 1 insertion(+), 1 deletion(-) | ||
9 | |||
10 | diff --git a/Makefile b/Makefile | ||
11 | index 4b76371..15e80f1 100644 | ||
12 | --- a/Makefile | ||
13 | +++ b/Makefile | ||
14 | @@ -1,6 +1,6 @@ | ||
15 | VERSION = 3 | ||
16 | PATCHLEVEL = 2 | ||
17 | -SUBLEVEL = 11 | ||
18 | +SUBLEVEL = 12 | ||
19 | EXTRAVERSION = | ||
20 | NAME = Saber-toothed Squirrel | ||
21 | |||
22 | -- | ||
23 | 1.7.9.4 | ||
24 | |||
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.13/0001-nilfs2-fix-NULL-pointer-dereference-in-nilfs_load_su.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.13/0001-nilfs2-fix-NULL-pointer-dereference-in-nilfs_load_su.patch new file mode 100644 index 00000000..29df2996 --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.13/0001-nilfs2-fix-NULL-pointer-dereference-in-nilfs_load_su.patch | |||
@@ -0,0 +1,62 @@ | |||
1 | From 4f3587e3e193f8ae9278442bf254d1271c4d010d Mon Sep 17 00:00:00 2001 | ||
2 | From: Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp> | ||
3 | Date: Fri, 16 Mar 2012 17:08:39 -0700 | ||
4 | Subject: [PATCH 01/10] nilfs2: fix NULL pointer dereference in | ||
5 | nilfs_load_super_block() | ||
6 | |||
7 | commit d7178c79d9b7c5518f9943188091a75fc6ce0675 upstream. | ||
8 | |||
9 | According to the report from Slicky Devil, nilfs caused kernel oops at | ||
10 | nilfs_load_super_block function during mount after he shrank the | ||
11 | partition without resizing the filesystem: | ||
12 | |||
13 | BUG: unable to handle kernel NULL pointer dereference at 00000048 | ||
14 | IP: [<d0d7a08e>] nilfs_load_super_block+0x17e/0x280 [nilfs2] | ||
15 | *pde = 00000000 | ||
16 | Oops: 0000 [#1] PREEMPT SMP | ||
17 | ... | ||
18 | Call Trace: | ||
19 | [<d0d7a87b>] init_nilfs+0x4b/0x2e0 [nilfs2] | ||
20 | [<d0d6f707>] nilfs_mount+0x447/0x5b0 [nilfs2] | ||
21 | [<c0226636>] mount_fs+0x36/0x180 | ||
22 | [<c023d961>] vfs_kern_mount+0x51/0xa0 | ||
23 | [<c023ddae>] do_kern_mount+0x3e/0xe0 | ||
24 | [<c023f189>] do_mount+0x169/0x700 | ||
25 | [<c023fa9b>] sys_mount+0x6b/0xa0 | ||
26 | [<c04abd1f>] sysenter_do_call+0x12/0x28 | ||
27 | Code: 53 18 8b 43 20 89 4b 18 8b 4b 24 89 53 1c 89 43 24 89 4b 20 8b 43 | ||
28 | 20 c7 43 2c 00 00 00 00 23 75 e8 8b 50 68 89 53 28 8b 54 b3 20 <8b> 72 | ||
29 | 48 8b 7a 4c 8b 55 08 89 b3 84 00 00 00 89 bb 88 00 00 00 | ||
30 | EIP: [<d0d7a08e>] nilfs_load_super_block+0x17e/0x280 [nilfs2] SS:ESP 0068:ca9bbdcc | ||
31 | CR2: 0000000000000048 | ||
32 | |||
33 | This turned out due to a defect in an error path which runs if the | ||
34 | calculated location of the secondary super block was invalid. | ||
35 | |||
36 | This patch fixes it and eliminates the reported oops. | ||
37 | |||
38 | Reported-by: Slicky Devil <slicky.dvl@gmail.com> | ||
39 | Signed-off-by: Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp> | ||
40 | Tested-by: Slicky Devil <slicky.dvl@gmail.com> | ||
41 | Signed-off-by: Andrew Morton <akpm@linux-foundation.org> | ||
42 | Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> | ||
43 | Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | ||
44 | --- | ||
45 | fs/nilfs2/the_nilfs.c | 1 + | ||
46 | 1 file changed, 1 insertion(+) | ||
47 | |||
48 | diff --git a/fs/nilfs2/the_nilfs.c b/fs/nilfs2/the_nilfs.c | ||
49 | index d327140..35a8970 100644 | ||
50 | --- a/fs/nilfs2/the_nilfs.c | ||
51 | +++ b/fs/nilfs2/the_nilfs.c | ||
52 | @@ -515,6 +515,7 @@ static int nilfs_load_super_block(struct the_nilfs *nilfs, | ||
53 | brelse(sbh[1]); | ||
54 | sbh[1] = NULL; | ||
55 | sbp[1] = NULL; | ||
56 | + valid[1] = 0; | ||
57 | swp = 0; | ||
58 | } | ||
59 | if (!valid[swp]) { | ||
60 | -- | ||
61 | 1.7.9.4 | ||
62 | |||
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.13/0002-afs-Read-of-file-returns-EBADMSG.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.13/0002-afs-Read-of-file-returns-EBADMSG.patch new file mode 100644 index 00000000..ff1e0d96 --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.13/0002-afs-Read-of-file-returns-EBADMSG.patch | |||
@@ -0,0 +1,56 @@ | |||
1 | From d603197ba390bdeba1aa79167697278669fdd9f3 Mon Sep 17 00:00:00 2001 | ||
2 | From: Anton Blanchard <anton@samba.org> | ||
3 | Date: Fri, 16 Mar 2012 10:28:07 +0000 | ||
4 | Subject: [PATCH 02/10] afs: Read of file returns EBADMSG | ||
5 | |||
6 | commit 2c724fb92732c0b2a5629eb8af74e82eb62ac947 upstream. | ||
7 | |||
8 | A read of a large file on an afs mount failed: | ||
9 | |||
10 | # cat junk.file > /dev/null | ||
11 | cat: junk.file: Bad message | ||
12 | |||
13 | Looking at the trace, call->offset wrapped since it is only an | ||
14 | unsigned short. In afs_extract_data: | ||
15 | |||
16 | _enter("{%u},{%zu},%d,,%zu", call->offset, len, last, count); | ||
17 | ... | ||
18 | |||
19 | if (call->offset < count) { | ||
20 | if (last) { | ||
21 | _leave(" = -EBADMSG [%d < %zu]", call->offset, count); | ||
22 | return -EBADMSG; | ||
23 | } | ||
24 | |||
25 | Which matches the trace: | ||
26 | |||
27 | [cat ] ==> afs_extract_data({65132},{524},1,,65536) | ||
28 | [cat ] <== afs_extract_data() = -EBADMSG [0 < 65536] | ||
29 | |||
30 | call->offset went from 65132 to 0. Fix this by making call->offset an | ||
31 | unsigned int. | ||
32 | |||
33 | Signed-off-by: Anton Blanchard <anton@samba.org> | ||
34 | Signed-off-by: David Howells <dhowells@redhat.com> | ||
35 | Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> | ||
36 | Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | ||
37 | --- | ||
38 | fs/afs/internal.h | 2 +- | ||
39 | 1 file changed, 1 insertion(+), 1 deletion(-) | ||
40 | |||
41 | diff --git a/fs/afs/internal.h b/fs/afs/internal.h | ||
42 | index d2b0888..a306bb6 100644 | ||
43 | --- a/fs/afs/internal.h | ||
44 | +++ b/fs/afs/internal.h | ||
45 | @@ -109,7 +109,7 @@ struct afs_call { | ||
46 | unsigned reply_size; /* current size of reply */ | ||
47 | unsigned first_offset; /* offset into mapping[first] */ | ||
48 | unsigned last_to; /* amount of mapping[last] */ | ||
49 | - unsigned short offset; /* offset into received data store */ | ||
50 | + unsigned offset; /* offset into received data store */ | ||
51 | unsigned char unmarshall; /* unmarshalling phase */ | ||
52 | bool incoming; /* T if incoming call */ | ||
53 | bool send_pages; /* T if data from mapping should be sent */ | ||
54 | -- | ||
55 | 1.7.9.4 | ||
56 | |||
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.13/0003-afs-Remote-abort-can-cause-BUG-in-rxrpc-code.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.13/0003-afs-Remote-abort-can-cause-BUG-in-rxrpc-code.patch new file mode 100644 index 00000000..22cfa613 --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.13/0003-afs-Remote-abort-can-cause-BUG-in-rxrpc-code.patch | |||
@@ -0,0 +1,68 @@ | |||
1 | From 4dd3f846325bf16e5b2d976dce42da7f722ade1f Mon Sep 17 00:00:00 2001 | ||
2 | From: Anton Blanchard <anton@samba.org> | ||
3 | Date: Fri, 16 Mar 2012 10:28:19 +0000 | ||
4 | Subject: [PATCH 03/10] afs: Remote abort can cause BUG in rxrpc code | ||
5 | |||
6 | commit c0173863528a8c9212c53e080d63a1aaae5ef4f4 upstream. | ||
7 | |||
8 | When writing files to afs I sometimes hit a BUG: | ||
9 | |||
10 | kernel BUG at fs/afs/rxrpc.c:179! | ||
11 | |||
12 | With a backtrace of: | ||
13 | |||
14 | afs_free_call | ||
15 | afs_make_call | ||
16 | afs_fs_store_data | ||
17 | afs_vnode_store_data | ||
18 | afs_write_back_from_locked_page | ||
19 | afs_writepages_region | ||
20 | afs_writepages | ||
21 | |||
22 | The cause is: | ||
23 | |||
24 | ASSERT(skb_queue_empty(&call->rx_queue)); | ||
25 | |||
26 | Looking at a tcpdump of the session the abort happens because we | ||
27 | are exceeding our disk quota: | ||
28 | |||
29 | rx abort fs reply store-data error diskquota exceeded (32) | ||
30 | |||
31 | So the abort error is valid. We hit the BUG because we haven't | ||
32 | freed all the resources for the call. | ||
33 | |||
34 | By freeing any skbs in call->rx_queue before calling afs_free_call | ||
35 | we avoid hitting leaking memory and avoid hitting the BUG. | ||
36 | |||
37 | Signed-off-by: Anton Blanchard <anton@samba.org> | ||
38 | Signed-off-by: David Howells <dhowells@redhat.com> | ||
39 | Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> | ||
40 | Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | ||
41 | --- | ||
42 | fs/afs/rxrpc.c | 3 +++ | ||
43 | 1 file changed, 3 insertions(+) | ||
44 | |||
45 | diff --git a/fs/afs/rxrpc.c b/fs/afs/rxrpc.c | ||
46 | index e45a323..8ad8c2a 100644 | ||
47 | --- a/fs/afs/rxrpc.c | ||
48 | +++ b/fs/afs/rxrpc.c | ||
49 | @@ -314,6 +314,7 @@ int afs_make_call(struct in_addr *addr, struct afs_call *call, gfp_t gfp, | ||
50 | struct msghdr msg; | ||
51 | struct kvec iov[1]; | ||
52 | int ret; | ||
53 | + struct sk_buff *skb; | ||
54 | |||
55 | _enter("%x,{%d},", addr->s_addr, ntohs(call->port)); | ||
56 | |||
57 | @@ -380,6 +381,8 @@ int afs_make_call(struct in_addr *addr, struct afs_call *call, gfp_t gfp, | ||
58 | |||
59 | error_do_abort: | ||
60 | rxrpc_kernel_abort_call(rxcall, RX_USER_ABORT); | ||
61 | + while ((skb = skb_dequeue(&call->rx_queue))) | ||
62 | + afs_free_skb(skb); | ||
63 | rxrpc_kernel_end_call(rxcall); | ||
64 | call->rxcall = NULL; | ||
65 | error_kill_call: | ||
66 | -- | ||
67 | 1.7.9.4 | ||
68 | |||
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.13/0004-perf-tools-Incorrect-use-of-snprintf-results-in-SEGV.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.13/0004-perf-tools-Incorrect-use-of-snprintf-results-in-SEGV.patch new file mode 100644 index 00000000..0cfd7651 --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.13/0004-perf-tools-Incorrect-use-of-snprintf-results-in-SEGV.patch | |||
@@ -0,0 +1,66 @@ | |||
1 | From 4458ed1dbe1180712e2c42c1816145bb793b9422 Mon Sep 17 00:00:00 2001 | ||
2 | From: Anton Blanchard <anton@samba.org> | ||
3 | Date: Wed, 7 Mar 2012 11:42:49 +1100 | ||
4 | Subject: [PATCH 04/10] perf tools: Incorrect use of snprintf results in SEGV | ||
5 | |||
6 | commit b832796caa1fda8516464a003c8c7cc547bc20c2 upstream. | ||
7 | |||
8 | I have a workload where perf top scribbles over the stack and we SEGV. | ||
9 | What makes it interesting is that an snprintf is causing this. | ||
10 | |||
11 | The workload is a c++ gem that has method names over 3000 characters | ||
12 | long, but snprintf is designed to avoid overrunning buffers. So what | ||
13 | went wrong? | ||
14 | |||
15 | The problem is we assume snprintf returns the number of characters | ||
16 | written: | ||
17 | |||
18 | ret += repsep_snprintf(bf + ret, size - ret, "[%c] ", self->level); | ||
19 | ... | ||
20 | ret += repsep_snprintf(bf + ret, size - ret, "%s", self->ms.sym->name); | ||
21 | |||
22 | Unfortunately this is not how snprintf works. snprintf returns the | ||
23 | number of characters that would have been written if there was enough | ||
24 | space. In the above case, if the first snprintf returns a value larger | ||
25 | than size, we pass a negative size into the second snprintf and happily | ||
26 | scribble over the stack. If you have 3000 character c++ methods thats a | ||
27 | lot of stack to trample. | ||
28 | |||
29 | This patch fixes repsep_snprintf by clamping the value at size - 1 which | ||
30 | is the maximum snprintf can write before adding the NULL terminator. | ||
31 | |||
32 | I get the sinking feeling that there are a lot of other uses of snprintf | ||
33 | that have this same bug, we should audit them all. | ||
34 | |||
35 | Cc: David Ahern <dsahern@gmail.com> | ||
36 | Cc: Eric B Munson <emunson@mgebm.net> | ||
37 | Cc: Frederic Weisbecker <fweisbec@gmail.com> | ||
38 | Cc: Ingo Molnar <mingo@elte.hu> | ||
39 | Cc: Paul Mackerras <paulus@samba.org> | ||
40 | Cc: Peter Zijlstra <peterz@infradead.org> | ||
41 | Cc: Yanmin Zhang <yanmin_zhang@linux.intel.com> | ||
42 | Link: http://lkml.kernel.org/r/20120307114249.44275ca3@kryten | ||
43 | Signed-off-by: Anton Blanchard <anton@samba.org> | ||
44 | Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com> | ||
45 | Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | ||
46 | --- | ||
47 | tools/perf/util/sort.c | 3 +++ | ||
48 | 1 file changed, 3 insertions(+) | ||
49 | |||
50 | diff --git a/tools/perf/util/sort.c b/tools/perf/util/sort.c | ||
51 | index 16da30d..076c9d4 100644 | ||
52 | --- a/tools/perf/util/sort.c | ||
53 | +++ b/tools/perf/util/sort.c | ||
54 | @@ -33,6 +33,9 @@ static int repsep_snprintf(char *bf, size_t size, const char *fmt, ...) | ||
55 | } | ||
56 | } | ||
57 | va_end(ap); | ||
58 | + | ||
59 | + if (n >= (int)size) | ||
60 | + return size - 1; | ||
61 | return n; | ||
62 | } | ||
63 | |||
64 | -- | ||
65 | 1.7.9.4 | ||
66 | |||
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.13/0005-perf-tools-Use-scnprintf-where-applicable.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.13/0005-perf-tools-Use-scnprintf-where-applicable.patch new file mode 100644 index 00000000..0b3e626e --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.13/0005-perf-tools-Use-scnprintf-where-applicable.patch | |||
@@ -0,0 +1,283 @@ | |||
1 | From 0761aae695aebede1d2ab4bf704419ee0ac957f1 Mon Sep 17 00:00:00 2001 | ||
2 | From: Arnaldo Carvalho de Melo <acme@redhat.com> | ||
3 | Date: Wed, 14 Mar 2012 12:29:29 -0300 | ||
4 | Subject: [PATCH 05/10] perf tools: Use scnprintf where applicable | ||
5 | |||
6 | commit e7f01d1e3d8d501deb8abeaa269d5d48a703b8b0 upstream. | ||
7 | |||
8 | Several places were expecting that the value returned was the number of | ||
9 | characters printed, not what would be printed if there was space. | ||
10 | |||
11 | Fix it by using the scnprintf and vscnprintf variants we inherited from | ||
12 | the kernel sources. | ||
13 | |||
14 | Some corner cases where the number of printed characters were not | ||
15 | accounted were fixed too. | ||
16 | |||
17 | Reported-by: Anton Blanchard <anton@samba.org> | ||
18 | Cc: Anton Blanchard <anton@samba.org> | ||
19 | Cc: Eric B Munson <emunson@mgebm.net> | ||
20 | Cc: David Ahern <dsahern@gmail.com> | ||
21 | Cc: Frederic Weisbecker <fweisbec@gmail.com> | ||
22 | Cc: Mike Galbraith <efault@gmx.de> | ||
23 | Cc: Paul Mackerras <paulus@samba.org> | ||
24 | Cc: Peter Zijlstra <peterz@infradead.org> | ||
25 | Cc: Stephane Eranian <eranian@google.com> | ||
26 | Cc: Yanmin Zhang <yanmin_zhang@linux.intel.com> | ||
27 | Link: http://lkml.kernel.org/n/tip-kwxo2eh29cxmd8ilixi2005x@git.kernel.org | ||
28 | Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com> | ||
29 | Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | ||
30 | --- | ||
31 | tools/perf/arch/powerpc/util/header.c | 2 +- | ||
32 | tools/perf/arch/x86/util/header.c | 2 +- | ||
33 | tools/perf/util/color.c | 9 +++++---- | ||
34 | tools/perf/util/header.c | 4 ++-- | ||
35 | tools/perf/util/hist.c | 30 +++++++++++++++--------------- | ||
36 | tools/perf/util/strbuf.c | 7 ++++--- | ||
37 | tools/perf/util/ui/browsers/hists.c | 12 ++++++------ | ||
38 | tools/perf/util/ui/helpline.c | 2 +- | ||
39 | 8 files changed, 35 insertions(+), 33 deletions(-) | ||
40 | |||
41 | diff --git a/tools/perf/arch/powerpc/util/header.c b/tools/perf/arch/powerpc/util/header.c | ||
42 | index eba80c2..2f7073d 100644 | ||
43 | --- a/tools/perf/arch/powerpc/util/header.c | ||
44 | +++ b/tools/perf/arch/powerpc/util/header.c | ||
45 | @@ -25,7 +25,7 @@ get_cpuid(char *buffer, size_t sz) | ||
46 | |||
47 | pvr = mfspr(SPRN_PVR); | ||
48 | |||
49 | - nb = snprintf(buffer, sz, "%lu,%lu$", PVR_VER(pvr), PVR_REV(pvr)); | ||
50 | + nb = scnprintf(buffer, sz, "%lu,%lu$", PVR_VER(pvr), PVR_REV(pvr)); | ||
51 | |||
52 | /* look for end marker to ensure the entire data fit */ | ||
53 | if (strchr(buffer, '$')) { | ||
54 | diff --git a/tools/perf/arch/x86/util/header.c b/tools/perf/arch/x86/util/header.c | ||
55 | index f940060..146d12a 100644 | ||
56 | --- a/tools/perf/arch/x86/util/header.c | ||
57 | +++ b/tools/perf/arch/x86/util/header.c | ||
58 | @@ -48,7 +48,7 @@ get_cpuid(char *buffer, size_t sz) | ||
59 | if (family >= 0x6) | ||
60 | model += ((a >> 16) & 0xf) << 4; | ||
61 | } | ||
62 | - nb = snprintf(buffer, sz, "%s,%u,%u,%u$", vendor, family, model, step); | ||
63 | + nb = scnprintf(buffer, sz, "%s,%u,%u,%u$", vendor, family, model, step); | ||
64 | |||
65 | /* look for end marker to ensure the entire data fit */ | ||
66 | if (strchr(buffer, '$')) { | ||
67 | diff --git a/tools/perf/util/color.c b/tools/perf/util/color.c | ||
68 | index 521c38a..11e46da1 100644 | ||
69 | --- a/tools/perf/util/color.c | ||
70 | +++ b/tools/perf/util/color.c | ||
71 | @@ -1,3 +1,4 @@ | ||
72 | +#include <linux/kernel.h> | ||
73 | #include "cache.h" | ||
74 | #include "color.h" | ||
75 | |||
76 | @@ -182,12 +183,12 @@ static int __color_vsnprintf(char *bf, size_t size, const char *color, | ||
77 | } | ||
78 | |||
79 | if (perf_use_color_default && *color) | ||
80 | - r += snprintf(bf, size, "%s", color); | ||
81 | - r += vsnprintf(bf + r, size - r, fmt, args); | ||
82 | + r += scnprintf(bf, size, "%s", color); | ||
83 | + r += vscnprintf(bf + r, size - r, fmt, args); | ||
84 | if (perf_use_color_default && *color) | ||
85 | - r += snprintf(bf + r, size - r, "%s", PERF_COLOR_RESET); | ||
86 | + r += scnprintf(bf + r, size - r, "%s", PERF_COLOR_RESET); | ||
87 | if (trail) | ||
88 | - r += snprintf(bf + r, size - r, "%s", trail); | ||
89 | + r += scnprintf(bf + r, size - r, "%s", trail); | ||
90 | return r; | ||
91 | } | ||
92 | |||
93 | diff --git a/tools/perf/util/header.c b/tools/perf/util/header.c | ||
94 | index 33c17a2..2cd88c1 100644 | ||
95 | --- a/tools/perf/util/header.c | ||
96 | +++ b/tools/perf/util/header.c | ||
97 | @@ -1227,7 +1227,7 @@ int build_id_cache__add_s(const char *sbuild_id, const char *debugdir, | ||
98 | if (realname == NULL || filename == NULL || linkname == NULL) | ||
99 | goto out_free; | ||
100 | |||
101 | - len = snprintf(filename, size, "%s%s%s", | ||
102 | + len = scnprintf(filename, size, "%s%s%s", | ||
103 | debugdir, is_kallsyms ? "/" : "", realname); | ||
104 | if (mkdir_p(filename, 0755)) | ||
105 | goto out_free; | ||
106 | @@ -1242,7 +1242,7 @@ int build_id_cache__add_s(const char *sbuild_id, const char *debugdir, | ||
107 | goto out_free; | ||
108 | } | ||
109 | |||
110 | - len = snprintf(linkname, size, "%s/.build-id/%.2s", | ||
111 | + len = scnprintf(linkname, size, "%s/.build-id/%.2s", | ||
112 | debugdir, sbuild_id); | ||
113 | |||
114 | if (access(linkname, X_OK) && mkdir_p(linkname, 0755)) | ||
115 | diff --git a/tools/perf/util/hist.c b/tools/perf/util/hist.c | ||
116 | index abef270..216e33a 100644 | ||
117 | --- a/tools/perf/util/hist.c | ||
118 | +++ b/tools/perf/util/hist.c | ||
119 | @@ -767,7 +767,7 @@ static int hist_entry__pcnt_snprintf(struct hist_entry *self, char *s, | ||
120 | sep ? "%.2f" : " %6.2f%%", | ||
121 | (period * 100.0) / total); | ||
122 | else | ||
123 | - ret = snprintf(s, size, sep ? "%.2f" : " %6.2f%%", | ||
124 | + ret = scnprintf(s, size, sep ? "%.2f" : " %6.2f%%", | ||
125 | (period * 100.0) / total); | ||
126 | if (symbol_conf.show_cpu_utilization) { | ||
127 | ret += percent_color_snprintf(s + ret, size - ret, | ||
128 | @@ -790,20 +790,20 @@ static int hist_entry__pcnt_snprintf(struct hist_entry *self, char *s, | ||
129 | } | ||
130 | } | ||
131 | } else | ||
132 | - ret = snprintf(s, size, sep ? "%" PRIu64 : "%12" PRIu64 " ", period); | ||
133 | + ret = scnprintf(s, size, sep ? "%" PRIu64 : "%12" PRIu64 " ", period); | ||
134 | |||
135 | if (symbol_conf.show_nr_samples) { | ||
136 | if (sep) | ||
137 | - ret += snprintf(s + ret, size - ret, "%c%" PRIu64, *sep, nr_events); | ||
138 | + ret += scnprintf(s + ret, size - ret, "%c%" PRIu64, *sep, nr_events); | ||
139 | else | ||
140 | - ret += snprintf(s + ret, size - ret, "%11" PRIu64, nr_events); | ||
141 | + ret += scnprintf(s + ret, size - ret, "%11" PRIu64, nr_events); | ||
142 | } | ||
143 | |||
144 | if (symbol_conf.show_total_period) { | ||
145 | if (sep) | ||
146 | - ret += snprintf(s + ret, size - ret, "%c%" PRIu64, *sep, period); | ||
147 | + ret += scnprintf(s + ret, size - ret, "%c%" PRIu64, *sep, period); | ||
148 | else | ||
149 | - ret += snprintf(s + ret, size - ret, " %12" PRIu64, period); | ||
150 | + ret += scnprintf(s + ret, size - ret, " %12" PRIu64, period); | ||
151 | } | ||
152 | |||
153 | if (pair_hists) { | ||
154 | @@ -818,25 +818,25 @@ static int hist_entry__pcnt_snprintf(struct hist_entry *self, char *s, | ||
155 | diff = new_percent - old_percent; | ||
156 | |||
157 | if (fabs(diff) >= 0.01) | ||
158 | - snprintf(bf, sizeof(bf), "%+4.2F%%", diff); | ||
159 | + ret += scnprintf(bf, sizeof(bf), "%+4.2F%%", diff); | ||
160 | else | ||
161 | - snprintf(bf, sizeof(bf), " "); | ||
162 | + ret += scnprintf(bf, sizeof(bf), " "); | ||
163 | |||
164 | if (sep) | ||
165 | - ret += snprintf(s + ret, size - ret, "%c%s", *sep, bf); | ||
166 | + ret += scnprintf(s + ret, size - ret, "%c%s", *sep, bf); | ||
167 | else | ||
168 | - ret += snprintf(s + ret, size - ret, "%11.11s", bf); | ||
169 | + ret += scnprintf(s + ret, size - ret, "%11.11s", bf); | ||
170 | |||
171 | if (show_displacement) { | ||
172 | if (displacement) | ||
173 | - snprintf(bf, sizeof(bf), "%+4ld", displacement); | ||
174 | + ret += scnprintf(bf, sizeof(bf), "%+4ld", displacement); | ||
175 | else | ||
176 | - snprintf(bf, sizeof(bf), " "); | ||
177 | + ret += scnprintf(bf, sizeof(bf), " "); | ||
178 | |||
179 | if (sep) | ||
180 | - ret += snprintf(s + ret, size - ret, "%c%s", *sep, bf); | ||
181 | + ret += scnprintf(s + ret, size - ret, "%c%s", *sep, bf); | ||
182 | else | ||
183 | - ret += snprintf(s + ret, size - ret, "%6.6s", bf); | ||
184 | + ret += scnprintf(s + ret, size - ret, "%6.6s", bf); | ||
185 | } | ||
186 | } | ||
187 | |||
188 | @@ -854,7 +854,7 @@ int hist_entry__snprintf(struct hist_entry *he, char *s, size_t size, | ||
189 | if (se->elide) | ||
190 | continue; | ||
191 | |||
192 | - ret += snprintf(s + ret, size - ret, "%s", sep ?: " "); | ||
193 | + ret += scnprintf(s + ret, size - ret, "%s", sep ?: " "); | ||
194 | ret += se->se_snprintf(he, s + ret, size - ret, | ||
195 | hists__col_len(hists, se->se_width_idx)); | ||
196 | } | ||
197 | diff --git a/tools/perf/util/strbuf.c b/tools/perf/util/strbuf.c | ||
198 | index 92e0685..2eeb51b 100644 | ||
199 | --- a/tools/perf/util/strbuf.c | ||
200 | +++ b/tools/perf/util/strbuf.c | ||
201 | @@ -1,4 +1,5 @@ | ||
202 | #include "cache.h" | ||
203 | +#include <linux/kernel.h> | ||
204 | |||
205 | int prefixcmp(const char *str, const char *prefix) | ||
206 | { | ||
207 | @@ -89,14 +90,14 @@ void strbuf_addf(struct strbuf *sb, const char *fmt, ...) | ||
208 | if (!strbuf_avail(sb)) | ||
209 | strbuf_grow(sb, 64); | ||
210 | va_start(ap, fmt); | ||
211 | - len = vsnprintf(sb->buf + sb->len, sb->alloc - sb->len, fmt, ap); | ||
212 | + len = vscnprintf(sb->buf + sb->len, sb->alloc - sb->len, fmt, ap); | ||
213 | va_end(ap); | ||
214 | if (len < 0) | ||
215 | - die("your vsnprintf is broken"); | ||
216 | + die("your vscnprintf is broken"); | ||
217 | if (len > strbuf_avail(sb)) { | ||
218 | strbuf_grow(sb, len); | ||
219 | va_start(ap, fmt); | ||
220 | - len = vsnprintf(sb->buf + sb->len, sb->alloc - sb->len, fmt, ap); | ||
221 | + len = vscnprintf(sb->buf + sb->len, sb->alloc - sb->len, fmt, ap); | ||
222 | va_end(ap); | ||
223 | if (len > strbuf_avail(sb)) { | ||
224 | die("this should not happen, your snprintf is broken"); | ||
225 | diff --git a/tools/perf/util/ui/browsers/hists.c b/tools/perf/util/ui/browsers/hists.c | ||
226 | index d0c94b4..81c9fa5 100644 | ||
227 | --- a/tools/perf/util/ui/browsers/hists.c | ||
228 | +++ b/tools/perf/util/ui/browsers/hists.c | ||
229 | @@ -839,15 +839,15 @@ static int hists__browser_title(struct hists *self, char *bf, size_t size, | ||
230 | unsigned long nr_events = self->stats.nr_events[PERF_RECORD_SAMPLE]; | ||
231 | |||
232 | nr_events = convert_unit(nr_events, &unit); | ||
233 | - printed = snprintf(bf, size, "Events: %lu%c %s", nr_events, unit, ev_name); | ||
234 | + printed = scnprintf(bf, size, "Events: %lu%c %s", nr_events, unit, ev_name); | ||
235 | |||
236 | if (thread) | ||
237 | - printed += snprintf(bf + printed, size - printed, | ||
238 | + printed += scnprintf(bf + printed, size - printed, | ||
239 | ", Thread: %s(%d)", | ||
240 | (thread->comm_set ? thread->comm : ""), | ||
241 | thread->pid); | ||
242 | if (dso) | ||
243 | - printed += snprintf(bf + printed, size - printed, | ||
244 | + printed += scnprintf(bf + printed, size - printed, | ||
245 | ", DSO: %s", dso->short_name); | ||
246 | return printed; | ||
247 | } | ||
248 | @@ -1097,7 +1097,7 @@ static void perf_evsel_menu__write(struct ui_browser *browser, | ||
249 | HE_COLORSET_NORMAL); | ||
250 | |||
251 | nr_events = convert_unit(nr_events, &unit); | ||
252 | - printed = snprintf(bf, sizeof(bf), "%lu%c%s%s", nr_events, | ||
253 | + printed = scnprintf(bf, sizeof(bf), "%lu%c%s%s", nr_events, | ||
254 | unit, unit == ' ' ? "" : " ", ev_name); | ||
255 | slsmg_printf("%s", bf); | ||
256 | |||
257 | @@ -1107,8 +1107,8 @@ static void perf_evsel_menu__write(struct ui_browser *browser, | ||
258 | if (!current_entry) | ||
259 | ui_browser__set_color(browser, HE_COLORSET_TOP); | ||
260 | nr_events = convert_unit(nr_events, &unit); | ||
261 | - snprintf(bf, sizeof(bf), ": %ld%c%schunks LOST!", nr_events, | ||
262 | - unit, unit == ' ' ? "" : " "); | ||
263 | + printed += scnprintf(bf, sizeof(bf), ": %ld%c%schunks LOST!", | ||
264 | + nr_events, unit, unit == ' ' ? "" : " "); | ||
265 | warn = bf; | ||
266 | } | ||
267 | |||
268 | diff --git a/tools/perf/util/ui/helpline.c b/tools/perf/util/ui/helpline.c | ||
269 | index 6ef3c56..f50f81c 100644 | ||
270 | --- a/tools/perf/util/ui/helpline.c | ||
271 | +++ b/tools/perf/util/ui/helpline.c | ||
272 | @@ -65,7 +65,7 @@ int ui_helpline__show_help(const char *format, va_list ap) | ||
273 | static int backlog; | ||
274 | |||
275 | pthread_mutex_lock(&ui__lock); | ||
276 | - ret = vsnprintf(ui_helpline__last_msg + backlog, | ||
277 | + ret = vscnprintf(ui_helpline__last_msg + backlog, | ||
278 | sizeof(ui_helpline__last_msg) - backlog, format, ap); | ||
279 | backlog += ret; | ||
280 | |||
281 | -- | ||
282 | 1.7.9.4 | ||
283 | |||
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.13/0006-tcp-fix-syncookie-regression.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.13/0006-tcp-fix-syncookie-regression.patch new file mode 100644 index 00000000..b245f584 --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.13/0006-tcp-fix-syncookie-regression.patch | |||
@@ -0,0 +1,111 @@ | |||
1 | From 1783dd4e3bf403739015f4494cb05445623826c8 Mon Sep 17 00:00:00 2001 | ||
2 | From: Eric Dumazet <eric.dumazet@gmail.com> | ||
3 | Date: Sat, 10 Mar 2012 09:20:21 +0000 | ||
4 | Subject: [PATCH 06/10] tcp: fix syncookie regression | ||
5 | |||
6 | [ Upstream commit dfd25ffffc132c00070eed64200e8950da5d7e9d ] | ||
7 | |||
8 | commit ea4fc0d619 (ipv4: Don't use rt->rt_{src,dst} in ip_queue_xmit()) | ||
9 | added a serious regression on synflood handling. | ||
10 | |||
11 | Simon Kirby discovered a successful connection was delayed by 20 seconds | ||
12 | before being responsive. | ||
13 | |||
14 | In my tests, I discovered that xmit frames were lost, and needed ~4 | ||
15 | retransmits and a socket dst rebuild before being really sent. | ||
16 | |||
17 | In case of syncookie initiated connection, we use a different path to | ||
18 | initialize the socket dst, and inet->cork.fl.u.ip4 is left cleared. | ||
19 | |||
20 | As ip_queue_xmit() now depends on inet flow being setup, fix this by | ||
21 | copying the temp flowi4 we use in cookie_v4_check(). | ||
22 | |||
23 | Reported-by: Simon Kirby <sim@netnation.com> | ||
24 | Bisected-by: Simon Kirby <sim@netnation.com> | ||
25 | Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> | ||
26 | Tested-by: Eric Dumazet <eric.dumazet@gmail.com> | ||
27 | Signed-off-by: David S. Miller <davem@davemloft.net> | ||
28 | Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | ||
29 | --- | ||
30 | net/ipv4/syncookies.c | 30 ++++++++++++++++-------------- | ||
31 | net/ipv4/tcp_ipv4.c | 10 +++++++--- | ||
32 | 2 files changed, 23 insertions(+), 17 deletions(-) | ||
33 | |||
34 | diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c | ||
35 | index 90f6544..769c0e9 100644 | ||
36 | --- a/net/ipv4/syncookies.c | ||
37 | +++ b/net/ipv4/syncookies.c | ||
38 | @@ -278,6 +278,7 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb, | ||
39 | struct rtable *rt; | ||
40 | __u8 rcv_wscale; | ||
41 | bool ecn_ok = false; | ||
42 | + struct flowi4 fl4; | ||
43 | |||
44 | if (!sysctl_tcp_syncookies || !th->ack || th->rst) | ||
45 | goto out; | ||
46 | @@ -346,20 +347,16 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb, | ||
47 | * hasn't changed since we received the original syn, but I see | ||
48 | * no easy way to do this. | ||
49 | */ | ||
50 | - { | ||
51 | - struct flowi4 fl4; | ||
52 | - | ||
53 | - flowi4_init_output(&fl4, 0, sk->sk_mark, RT_CONN_FLAGS(sk), | ||
54 | - RT_SCOPE_UNIVERSE, IPPROTO_TCP, | ||
55 | - inet_sk_flowi_flags(sk), | ||
56 | - (opt && opt->srr) ? opt->faddr : ireq->rmt_addr, | ||
57 | - ireq->loc_addr, th->source, th->dest); | ||
58 | - security_req_classify_flow(req, flowi4_to_flowi(&fl4)); | ||
59 | - rt = ip_route_output_key(sock_net(sk), &fl4); | ||
60 | - if (IS_ERR(rt)) { | ||
61 | - reqsk_free(req); | ||
62 | - goto out; | ||
63 | - } | ||
64 | + flowi4_init_output(&fl4, 0, sk->sk_mark, RT_CONN_FLAGS(sk), | ||
65 | + RT_SCOPE_UNIVERSE, IPPROTO_TCP, | ||
66 | + inet_sk_flowi_flags(sk), | ||
67 | + (opt && opt->srr) ? opt->faddr : ireq->rmt_addr, | ||
68 | + ireq->loc_addr, th->source, th->dest); | ||
69 | + security_req_classify_flow(req, flowi4_to_flowi(&fl4)); | ||
70 | + rt = ip_route_output_key(sock_net(sk), &fl4); | ||
71 | + if (IS_ERR(rt)) { | ||
72 | + reqsk_free(req); | ||
73 | + goto out; | ||
74 | } | ||
75 | |||
76 | /* Try to redo what tcp_v4_send_synack did. */ | ||
77 | @@ -373,5 +370,10 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb, | ||
78 | ireq->rcv_wscale = rcv_wscale; | ||
79 | |||
80 | ret = get_cookie_sock(sk, skb, req, &rt->dst); | ||
81 | + /* ip_queue_xmit() depends on our flow being setup | ||
82 | + * Normal sockets get it right from inet_csk_route_child_sock() | ||
83 | + */ | ||
84 | + if (ret) | ||
85 | + inet_sk(ret)->cork.fl.u.ip4 = fl4; | ||
86 | out: return ret; | ||
87 | } | ||
88 | diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c | ||
89 | index eb90aa8..de69cec 100644 | ||
90 | --- a/net/ipv4/tcp_ipv4.c | ||
91 | +++ b/net/ipv4/tcp_ipv4.c | ||
92 | @@ -1465,9 +1465,13 @@ struct sock *tcp_v4_syn_recv_sock(struct sock *sk, struct sk_buff *skb, | ||
93 | inet_csk(newsk)->icsk_ext_hdr_len = inet_opt->opt.optlen; | ||
94 | newinet->inet_id = newtp->write_seq ^ jiffies; | ||
95 | |||
96 | - if (!dst && (dst = inet_csk_route_child_sock(sk, newsk, req)) == NULL) | ||
97 | - goto put_and_exit; | ||
98 | - | ||
99 | + if (!dst) { | ||
100 | + dst = inet_csk_route_child_sock(sk, newsk, req); | ||
101 | + if (!dst) | ||
102 | + goto put_and_exit; | ||
103 | + } else { | ||
104 | + /* syncookie case : see end of cookie_v4_check() */ | ||
105 | + } | ||
106 | sk_setup_caps(newsk, dst); | ||
107 | |||
108 | tcp_mtup_init(newsk); | ||
109 | -- | ||
110 | 1.7.9.4 | ||
111 | |||
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.13/0007-ipv6-Don-t-dev_hold-dev-in-ip6_mc_find_dev_rcu.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.13/0007-ipv6-Don-t-dev_hold-dev-in-ip6_mc_find_dev_rcu.patch new file mode 100644 index 00000000..c1e22fb4 --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.13/0007-ipv6-Don-t-dev_hold-dev-in-ip6_mc_find_dev_rcu.patch | |||
@@ -0,0 +1,36 @@ | |||
1 | From 599c3a877230bfb0db2f20028170b27a9cfef914 Mon Sep 17 00:00:00 2001 | ||
2 | From: "RongQing.Li" <roy.qing.li@gmail.com> | ||
3 | Date: Thu, 15 Mar 2012 22:54:14 +0000 | ||
4 | Subject: [PATCH 07/10] ipv6: Don't dev_hold(dev) in ip6_mc_find_dev_rcu. | ||
5 | |||
6 | [ Upstream commit c577923756b7fe9071f28a76b66b83b306d1d001 ] | ||
7 | |||
8 | ip6_mc_find_dev_rcu() is called with rcu_read_lock(), so don't | ||
9 | need to dev_hold(). | ||
10 | With dev_hold(), not corresponding dev_put(), will lead to leak. | ||
11 | |||
12 | [ bug introduced in 96b52e61be1 (ipv6: mcast: RCU conversions) ] | ||
13 | |||
14 | Signed-off-by: RongQing.Li <roy.qing.li@gmail.com> | ||
15 | Acked-by: Eric Dumazet <eric.dumazet@gmail.com> | ||
16 | Signed-off-by: David S. Miller <davem@davemloft.net> | ||
17 | Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | ||
18 | --- | ||
19 | net/ipv6/mcast.c | 1 - | ||
20 | 1 file changed, 1 deletion(-) | ||
21 | |||
22 | diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c | ||
23 | index ee7839f..2257366 100644 | ||
24 | --- a/net/ipv6/mcast.c | ||
25 | +++ b/net/ipv6/mcast.c | ||
26 | @@ -257,7 +257,6 @@ static struct inet6_dev *ip6_mc_find_dev_rcu(struct net *net, | ||
27 | |||
28 | if (rt) { | ||
29 | dev = rt->rt6i_dev; | ||
30 | - dev_hold(dev); | ||
31 | dst_release(&rt->dst); | ||
32 | } | ||
33 | } else | ||
34 | -- | ||
35 | 1.7.9.4 | ||
36 | |||
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.13/0008-iwl3945-fix-possible-il-txq-NULL-pointer-dereference.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.13/0008-iwl3945-fix-possible-il-txq-NULL-pointer-dereference.patch new file mode 100644 index 00000000..07ecf541 --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.13/0008-iwl3945-fix-possible-il-txq-NULL-pointer-dereference.patch | |||
@@ -0,0 +1,63 @@ | |||
1 | From 50090beeab6611dbfccd8565bf6a6a97beddc6ee Mon Sep 17 00:00:00 2001 | ||
2 | From: Stanislaw Gruszka <sgruszka@redhat.com> | ||
3 | Date: Thu, 8 Mar 2012 13:16:01 +0100 | ||
4 | Subject: [PATCH 08/10] iwl3945: fix possible il->txq NULL pointer dereference | ||
5 | in delayed works | ||
6 | |||
7 | commit 210787e82a0ac1ffb5d7be1c796f0c51050849ad upstream. | ||
8 | |||
9 | On il3945_down procedure we free tx queue data and nullify il->txq | ||
10 | pointer. After that we drop mutex and then cancel delayed works. There | ||
11 | is possibility, that after drooping mutex and before the cancel, some | ||
12 | delayed work will start and crash while trying to send commands to | ||
13 | the device. For example, here is reported crash in | ||
14 | il3945_bg_reg_txpower_periodic(): | ||
15 | https://bugzilla.kernel.org/show_bug.cgi?id=42766#c10 | ||
16 | |||
17 | Patch fix problem by adding il->txq check on works that send commands, | ||
18 | hence utilize tx queue. | ||
19 | |||
20 | Reported-by: Clemens Eisserer <linuxhippy@gmail.com> | ||
21 | Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com> | ||
22 | Signed-off-by: John W. Linville <linville@tuxdriver.com> | ||
23 | --- | ||
24 | drivers/net/wireless/iwlegacy/iwl-3945.c | 7 ++++--- | ||
25 | drivers/net/wireless/iwlegacy/iwl3945-base.c | 2 +- | ||
26 | 2 files changed, 5 insertions(+), 4 deletions(-) | ||
27 | |||
28 | diff --git a/drivers/net/wireless/iwlegacy/iwl-3945.c b/drivers/net/wireless/iwlegacy/iwl-3945.c | ||
29 | index f7c0a74..7d1aa7c 100644 | ||
30 | --- a/drivers/net/wireless/iwlegacy/iwl-3945.c | ||
31 | +++ b/drivers/net/wireless/iwlegacy/iwl-3945.c | ||
32 | @@ -1870,11 +1870,12 @@ static void iwl3945_bg_reg_txpower_periodic(struct work_struct *work) | ||
33 | struct iwl_priv *priv = container_of(work, struct iwl_priv, | ||
34 | _3945.thermal_periodic.work); | ||
35 | |||
36 | - if (test_bit(STATUS_EXIT_PENDING, &priv->status)) | ||
37 | - return; | ||
38 | - | ||
39 | mutex_lock(&priv->mutex); | ||
40 | + if (test_bit(STATUS_EXIT_PENDING, &priv->status) || priv->txq == NULL) | ||
41 | + goto out; | ||
42 | + | ||
43 | iwl3945_reg_txpower_periodic(priv); | ||
44 | +out: | ||
45 | mutex_unlock(&priv->mutex); | ||
46 | } | ||
47 | |||
48 | diff --git a/drivers/net/wireless/iwlegacy/iwl3945-base.c b/drivers/net/wireless/iwlegacy/iwl3945-base.c | ||
49 | index 05f2ad1..b3d9f3f 100644 | ||
50 | --- a/drivers/net/wireless/iwlegacy/iwl3945-base.c | ||
51 | +++ b/drivers/net/wireless/iwlegacy/iwl3945-base.c | ||
52 | @@ -2513,7 +2513,7 @@ static void iwl3945_bg_alive_start(struct work_struct *data) | ||
53 | container_of(data, struct iwl_priv, alive_start.work); | ||
54 | |||
55 | mutex_lock(&priv->mutex); | ||
56 | - if (test_bit(STATUS_EXIT_PENDING, &priv->status)) | ||
57 | + if (test_bit(STATUS_EXIT_PENDING, &priv->status) || priv->txq == NULL) | ||
58 | goto out; | ||
59 | |||
60 | iwl3945_alive_start(priv); | ||
61 | -- | ||
62 | 1.7.9.4 | ||
63 | |||
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.13/0009-powerpc-pmac-Fix-SMP-kernels-on-pre-core99-UP-machin.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.13/0009-powerpc-pmac-Fix-SMP-kernels-on-pre-core99-UP-machin.patch new file mode 100644 index 00000000..98111cb5 --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.13/0009-powerpc-pmac-Fix-SMP-kernels-on-pre-core99-UP-machin.patch | |||
@@ -0,0 +1,36 @@ | |||
1 | From 93bbacdcea5490053dc692cad003f74eb116fd4a Mon Sep 17 00:00:00 2001 | ||
2 | From: Benjamin Herrenschmidt <benh@kernel.crashing.org> | ||
3 | Date: Fri, 9 Dec 2011 15:06:18 +1100 | ||
4 | Subject: [PATCH 09/10] powerpc/pmac: Fix SMP kernels on pre-core99 UP | ||
5 | machines | ||
6 | |||
7 | commit 78c5c68a4cf4329d17abfa469345ddf323d4fd62 upstream. | ||
8 | |||
9 | The code for "powersurge" SMP would kick in and cause a crash | ||
10 | at boot due to the lack of a NULL test. | ||
11 | |||
12 | Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> | ||
13 | Signed-off-by: Jeremy Kerr <jeremy.kerr@canonical.com> | ||
14 | Reported-by: Adam Conrad <adconrad@ubuntu.com> | ||
15 | Tested-by: Adam Conrad <adconrad@ubuntu.com> | ||
16 | Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | ||
17 | --- | ||
18 | arch/powerpc/platforms/powermac/smp.c | 2 +- | ||
19 | 1 file changed, 1 insertion(+), 1 deletion(-) | ||
20 | |||
21 | diff --git a/arch/powerpc/platforms/powermac/smp.c b/arch/powerpc/platforms/powermac/smp.c | ||
22 | index 9b6a820..3394254 100644 | ||
23 | --- a/arch/powerpc/platforms/powermac/smp.c | ||
24 | +++ b/arch/powerpc/platforms/powermac/smp.c | ||
25 | @@ -414,7 +414,7 @@ static struct irqaction psurge_irqaction = { | ||
26 | |||
27 | static void __init smp_psurge_setup_cpu(int cpu_nr) | ||
28 | { | ||
29 | - if (cpu_nr != 0) | ||
30 | + if (cpu_nr != 0 || !psurge_start) | ||
31 | return; | ||
32 | |||
33 | /* reset the entry point so if we get another intr we won't | ||
34 | -- | ||
35 | 1.7.9.4 | ||
36 | |||
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.13/0010-Linux-3.2.13.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.13/0010-Linux-3.2.13.patch new file mode 100644 index 00000000..08a58566 --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.13/0010-Linux-3.2.13.patch | |||
@@ -0,0 +1,24 @@ | |||
1 | From add3df1bc247cc4056661dd9ea3b445c1aea3e0d Mon Sep 17 00:00:00 2001 | ||
2 | From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | ||
3 | Date: Fri, 23 Mar 2012 13:54:45 -0700 | ||
4 | Subject: [PATCH 10/10] Linux 3.2.13 | ||
5 | |||
6 | --- | ||
7 | Makefile | 2 +- | ||
8 | 1 file changed, 1 insertion(+), 1 deletion(-) | ||
9 | |||
10 | diff --git a/Makefile b/Makefile | ||
11 | index 15e80f1..172e041 100644 | ||
12 | --- a/Makefile | ||
13 | +++ b/Makefile | ||
14 | @@ -1,6 +1,6 @@ | ||
15 | VERSION = 3 | ||
16 | PATCHLEVEL = 2 | ||
17 | -SUBLEVEL = 12 | ||
18 | +SUBLEVEL = 13 | ||
19 | EXTRAVERSION = | ||
20 | NAME = Saber-toothed Squirrel | ||
21 | |||
22 | -- | ||
23 | 1.7.9.4 | ||
24 | |||
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/patch.sh b/recipes-kernel/linux/linux-ti33x-psp-3.2/patch.sh index 9bc6cf3a..20d590af 100755 --- a/recipes-kernel/linux/linux-ti33x-psp-3.2/patch.sh +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/patch.sh | |||
@@ -19,7 +19,7 @@ git reset --hard ${TAG} | |||
19 | rm -Rf export | 19 | rm -Rf export |
20 | 20 | ||
21 | previous=${TAG} | 21 | previous=${TAG} |
22 | PATCHSET="3.2.1 3.2.2 3.2.3 3.2.4 3.2.5 3.2.6 3.2.7 3.2.8 3.2.9 3.2.10 3.2.11 beaglebone" | 22 | PATCHSET="3.2.1 3.2.2 3.2.3 3.2.4 3.2.5 3.2.6 3.2.7 3.2.8 3.2.9 3.2.10 3.2.11 3.2.12 3.2.13 beaglebone" |
23 | 23 | ||
24 | # apply patches | 24 | # apply patches |
25 | for patchset in ${PATCHSET} ; do | 25 | for patchset in ${PATCHSET} ; do |