diff options
Diffstat (limited to 'recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1')
49 files changed, 3345 insertions, 0 deletions
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0001-MAINTAINERS-stable-Update-address.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0001-MAINTAINERS-stable-Update-address.patch new file mode 100644 index 00000000..fe2b0d6b --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0001-MAINTAINERS-stable-Update-address.patch | |||
@@ -0,0 +1,31 @@ | |||
1 | From d1fe421bb81064477843db98b4804fec79eae30e Mon Sep 17 00:00:00 2001 | ||
2 | From: Joe Perches <joe@perches.com> | ||
3 | Date: Fri, 9 Dec 2011 13:54:34 -0800 | ||
4 | Subject: [PATCH 01/49] MAINTAINERS: stable: Update address | ||
5 | |||
6 | commit bc7a2f3abc636d7cab84258a48e77b08fb5fd3d6 upstream. | ||
7 | |||
8 | The old address hasn't worked since the great intrusion of August 2011. | ||
9 | |||
10 | Signed-off-by: Joe Perches <joe@perches.com> | ||
11 | Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> | ||
12 | --- | ||
13 | MAINTAINERS | 2 +- | ||
14 | 1 files changed, 1 insertions(+), 1 deletions(-) | ||
15 | |||
16 | diff --git a/MAINTAINERS b/MAINTAINERS | ||
17 | index 62f1cd3..f986e7d 100644 | ||
18 | --- a/MAINTAINERS | ||
19 | +++ b/MAINTAINERS | ||
20 | @@ -6258,7 +6258,7 @@ F: arch/alpha/kernel/srm_env.c | ||
21 | |||
22 | STABLE BRANCH | ||
23 | M: Greg Kroah-Hartman <greg@kroah.com> | ||
24 | -L: stable@kernel.org | ||
25 | +L: stable@vger.kernel.org | ||
26 | S: Maintained | ||
27 | |||
28 | STAGING SUBSYSTEM | ||
29 | -- | ||
30 | 1.7.7.4 | ||
31 | |||
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0002-Documentation-Update-stable-address.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0002-Documentation-Update-stable-address.patch new file mode 100644 index 00000000..10b9e325 --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0002-Documentation-Update-stable-address.patch | |||
@@ -0,0 +1,56 @@ | |||
1 | From 3dc851fe5a59ee0eb306b3a29819ee040ba69a24 Mon Sep 17 00:00:00 2001 | ||
2 | From: Joe Perches <joe@perches.com> | ||
3 | Date: Fri, 9 Dec 2011 14:12:00 -0800 | ||
4 | Subject: [PATCH 02/49] Documentation: Update stable address | ||
5 | |||
6 | commit 2eb7f204db51969ea558802a6601d79c2fb273b9 upstream. | ||
7 | |||
8 | The Japanese/Korean/Chinese versions still need updating. | ||
9 | |||
10 | Also, the stable kernel 2.6.x.y descriptions are out of date | ||
11 | and should be updated as well. | ||
12 | |||
13 | Signed-off-by: Joe Perches <joe@perches.com> | ||
14 | Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> | ||
15 | --- | ||
16 | Documentation/HOWTO | 4 ++-- | ||
17 | Documentation/development-process/5.Posting | 8 ++++---- | ||
18 | 2 files changed, 6 insertions(+), 6 deletions(-) | ||
19 | |||
20 | diff --git a/Documentation/HOWTO b/Documentation/HOWTO | ||
21 | index 81bc1a9..f7ade3b 100644 | ||
22 | --- a/Documentation/HOWTO | ||
23 | +++ b/Documentation/HOWTO | ||
24 | @@ -275,8 +275,8 @@ versions. | ||
25 | If no 2.6.x.y kernel is available, then the highest numbered 2.6.x | ||
26 | kernel is the current stable kernel. | ||
27 | |||
28 | -2.6.x.y are maintained by the "stable" team <stable@kernel.org>, and are | ||
29 | -released as needs dictate. The normal release period is approximately | ||
30 | +2.6.x.y are maintained by the "stable" team <stable@vger.kernel.org>, and | ||
31 | +are released as needs dictate. The normal release period is approximately | ||
32 | two weeks, but it can be longer if there are no pressing problems. A | ||
33 | security-related problem, instead, can cause a release to happen almost | ||
34 | instantly. | ||
35 | diff --git a/Documentation/development-process/5.Posting b/Documentation/development-process/5.Posting | ||
36 | index 903a254..8a48c9b 100644 | ||
37 | --- a/Documentation/development-process/5.Posting | ||
38 | +++ b/Documentation/development-process/5.Posting | ||
39 | @@ -271,10 +271,10 @@ copies should go to: | ||
40 | the linux-kernel list. | ||
41 | |||
42 | - If you are fixing a bug, think about whether the fix should go into the | ||
43 | - next stable update. If so, stable@kernel.org should get a copy of the | ||
44 | - patch. Also add a "Cc: stable@kernel.org" to the tags within the patch | ||
45 | - itself; that will cause the stable team to get a notification when your | ||
46 | - fix goes into the mainline. | ||
47 | + next stable update. If so, stable@vger.kernel.org should get a copy of | ||
48 | + the patch. Also add a "Cc: stable@vger.kernel.org" to the tags within | ||
49 | + the patch itself; that will cause the stable team to get a notification | ||
50 | + when your fix goes into the mainline. | ||
51 | |||
52 | When selecting recipients for a patch, it is good to have an idea of who | ||
53 | you think will eventually accept the patch and get it merged. While it | ||
54 | -- | ||
55 | 1.7.7.4 | ||
56 | |||
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0003-firmware-Fix-an-oops-on-reading-fw_priv-fw-in-sysfs-.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0003-firmware-Fix-an-oops-on-reading-fw_priv-fw-in-sysfs-.patch new file mode 100644 index 00000000..146af6d3 --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0003-firmware-Fix-an-oops-on-reading-fw_priv-fw-in-sysfs-.patch | |||
@@ -0,0 +1,81 @@ | |||
1 | From 9fa97016831ab21d14565a478dc462f35dfb7d2b Mon Sep 17 00:00:00 2001 | ||
2 | From: Neil Horman <nhorman@tuxdriver.com> | ||
3 | Date: Mon, 2 Jan 2012 15:31:23 -0500 | ||
4 | Subject: [PATCH 03/49] firmware: Fix an oops on reading fw_priv->fw in sysfs | ||
5 | loading file | ||
6 | |||
7 | commit eea915bb0d1358755f151eaefb8208a2d5f3e10c upstream. | ||
8 | |||
9 | This oops was reported recently: | ||
10 | firmware_loading_store+0xf9/0x17b | ||
11 | dev_attr_store+0x20/0x22 | ||
12 | sysfs_write_file+0x101/0x134 | ||
13 | vfs_write+0xac/0xf3 | ||
14 | sys_write+0x4a/0x6e | ||
15 | system_call_fastpath+0x16/0x1b | ||
16 | |||
17 | The complete backtrace was unfortunately not captured, but details can be found | ||
18 | here: | ||
19 | https://bugzilla.redhat.com/show_bug.cgi?id=769920 | ||
20 | |||
21 | The cause is fairly clear. | ||
22 | |||
23 | Its caused by the fact that firmware_loading_store has a case 0 in its | ||
24 | switch statement that reads and writes the fw_priv->fw poniter without the | ||
25 | protection of the fw_lock mutex. since there is a window between the time that | ||
26 | _request_firmware sets fw_priv->fw to NULL and the time the corresponding sysfs | ||
27 | file is unregistered, its possible for a user space application to race in, and | ||
28 | write a zero to the loading file, causing a NULL dereference in | ||
29 | firmware_loading_store. Fix it by extending the protection of the fw_lock mutex | ||
30 | to cover all of the firware_loading_store function. | ||
31 | |||
32 | Signed-off-by: Neil Horman <nhorman@tuxdriver.com> | ||
33 | Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> | ||
34 | --- | ||
35 | drivers/base/firmware_class.c | 14 +++++++------- | ||
36 | 1 files changed, 7 insertions(+), 7 deletions(-) | ||
37 | |||
38 | diff --git a/drivers/base/firmware_class.c b/drivers/base/firmware_class.c | ||
39 | index 06ed6b4..3719c94 100644 | ||
40 | --- a/drivers/base/firmware_class.c | ||
41 | +++ b/drivers/base/firmware_class.c | ||
42 | @@ -226,13 +226,13 @@ static ssize_t firmware_loading_store(struct device *dev, | ||
43 | int loading = simple_strtol(buf, NULL, 10); | ||
44 | int i; | ||
45 | |||
46 | + mutex_lock(&fw_lock); | ||
47 | + | ||
48 | + if (!fw_priv->fw) | ||
49 | + goto out; | ||
50 | + | ||
51 | switch (loading) { | ||
52 | case 1: | ||
53 | - mutex_lock(&fw_lock); | ||
54 | - if (!fw_priv->fw) { | ||
55 | - mutex_unlock(&fw_lock); | ||
56 | - break; | ||
57 | - } | ||
58 | firmware_free_data(fw_priv->fw); | ||
59 | memset(fw_priv->fw, 0, sizeof(struct firmware)); | ||
60 | /* If the pages are not owned by 'struct firmware' */ | ||
61 | @@ -243,7 +243,6 @@ static ssize_t firmware_loading_store(struct device *dev, | ||
62 | fw_priv->page_array_size = 0; | ||
63 | fw_priv->nr_pages = 0; | ||
64 | set_bit(FW_STATUS_LOADING, &fw_priv->status); | ||
65 | - mutex_unlock(&fw_lock); | ||
66 | break; | ||
67 | case 0: | ||
68 | if (test_bit(FW_STATUS_LOADING, &fw_priv->status)) { | ||
69 | @@ -274,7 +273,8 @@ static ssize_t firmware_loading_store(struct device *dev, | ||
70 | fw_load_abort(fw_priv); | ||
71 | break; | ||
72 | } | ||
73 | - | ||
74 | +out: | ||
75 | + mutex_unlock(&fw_lock); | ||
76 | return count; | ||
77 | } | ||
78 | |||
79 | -- | ||
80 | 1.7.7.4 | ||
81 | |||
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0004-rt2800usb-Move-ID-out-of-unknown.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0004-rt2800usb-Move-ID-out-of-unknown.patch new file mode 100644 index 00000000..6923c7ee --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0004-rt2800usb-Move-ID-out-of-unknown.patch | |||
@@ -0,0 +1,43 @@ | |||
1 | From c64f87400ad7f27c043d969e695b3b2384e8a246 Mon Sep 17 00:00:00 2001 | ||
2 | From: Larry Finger <Larry.Finger@lwfinger.net> | ||
3 | Date: Tue, 27 Dec 2011 12:22:51 -0600 | ||
4 | Subject: [PATCH 04/49] rt2800usb: Move ID out of unknown | ||
5 | |||
6 | commit 3f81f8f1524ccca24df1029b0cf825ecef5e5cdc upstream. | ||
7 | |||
8 | Testing on the openSUSE wireless forum has shown that a Linksys | ||
9 | WUSB54GC v3 with USB ID 1737:0077 works with rt2800usb when the ID is | ||
10 | written to /sys/.../new_id. This ID can therefore be moved out of UNKNOWN. | ||
11 | |||
12 | Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net> | ||
13 | Acked-by: Gertjan van Wingerde <gwingerde@gmail.com> | ||
14 | Acked-by: Ivo van Doorn <IvDoorn@gmail.com> | ||
15 | Signed-off-by: John W. Linville <linville@tuxdriver.com> | ||
16 | Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> | ||
17 | --- | ||
18 | drivers/net/wireless/rt2x00/rt2800usb.c | 2 +- | ||
19 | 1 files changed, 1 insertions(+), 1 deletions(-) | ||
20 | |||
21 | diff --git a/drivers/net/wireless/rt2x00/rt2800usb.c b/drivers/net/wireless/rt2x00/rt2800usb.c | ||
22 | index 3778763..3265b34 100644 | ||
23 | --- a/drivers/net/wireless/rt2x00/rt2800usb.c | ||
24 | +++ b/drivers/net/wireless/rt2x00/rt2800usb.c | ||
25 | @@ -976,6 +976,7 @@ static struct usb_device_id rt2800usb_device_table[] = { | ||
26 | { USB_DEVICE(0x13b1, 0x0031) }, | ||
27 | { USB_DEVICE(0x1737, 0x0070) }, | ||
28 | { USB_DEVICE(0x1737, 0x0071) }, | ||
29 | + { USB_DEVICE(0x1737, 0x0077) }, | ||
30 | /* Logitec */ | ||
31 | { USB_DEVICE(0x0789, 0x0162) }, | ||
32 | { USB_DEVICE(0x0789, 0x0163) }, | ||
33 | @@ -1171,7 +1172,6 @@ static struct usb_device_id rt2800usb_device_table[] = { | ||
34 | { USB_DEVICE(0x1740, 0x0605) }, | ||
35 | { USB_DEVICE(0x1740, 0x0615) }, | ||
36 | /* Linksys */ | ||
37 | - { USB_DEVICE(0x1737, 0x0077) }, | ||
38 | { USB_DEVICE(0x1737, 0x0078) }, | ||
39 | /* Logitec */ | ||
40 | { USB_DEVICE(0x0789, 0x0168) }, | ||
41 | -- | ||
42 | 1.7.7.4 | ||
43 | |||
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0005-offb-Fix-setting-of-the-pseudo-palette-for-8bpp.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0005-offb-Fix-setting-of-the-pseudo-palette-for-8bpp.patch new file mode 100644 index 00000000..e019802f --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0005-offb-Fix-setting-of-the-pseudo-palette-for-8bpp.patch | |||
@@ -0,0 +1,92 @@ | |||
1 | From 698d2012f8540d1cedc1f49013ba320e382cd1d9 Mon Sep 17 00:00:00 2001 | ||
2 | From: Benjamin Herrenschmidt <benh@kernel.crashing.org> | ||
3 | Date: Wed, 28 Dec 2011 00:10:16 +0000 | ||
4 | Subject: [PATCH 05/49] offb: Fix setting of the pseudo-palette for >8bpp | ||
5 | |||
6 | commit 1bb0b7d21584b3f878e2bc880db62351ddee5185 upstream. | ||
7 | |||
8 | When using a >8bpp framebuffer, offb advertises truecolor, not directcolor, | ||
9 | and doesn't touch the color map even if it has a corresponding access method | ||
10 | for the real hardware. | ||
11 | |||
12 | Thus it needs to set the pseudo-palette with all 3 components of the color, | ||
13 | like other truecolor framebuffers, not with copies of the color index like | ||
14 | a directcolor framebuffer would do. | ||
15 | |||
16 | This went unnoticed for a long time because it's pretty hard to get offb | ||
17 | to kick in with anything but 8bpp (old BootX under MacOS will do that and | ||
18 | qemu does it). | ||
19 | |||
20 | Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> | ||
21 | Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> | ||
22 | --- | ||
23 | drivers/video/offb.c | 50 +++++++++++++++++++++++--------------------------- | ||
24 | 1 files changed, 23 insertions(+), 27 deletions(-) | ||
25 | |||
26 | diff --git a/drivers/video/offb.c b/drivers/video/offb.c | ||
27 | index cb163a5..24e1fc6 100644 | ||
28 | --- a/drivers/video/offb.c | ||
29 | +++ b/drivers/video/offb.c | ||
30 | @@ -100,36 +100,32 @@ static int offb_setcolreg(u_int regno, u_int red, u_int green, u_int blue, | ||
31 | u_int transp, struct fb_info *info) | ||
32 | { | ||
33 | struct offb_par *par = (struct offb_par *) info->par; | ||
34 | - int i, depth; | ||
35 | - u32 *pal = info->pseudo_palette; | ||
36 | - | ||
37 | - depth = info->var.bits_per_pixel; | ||
38 | - if (depth == 16) | ||
39 | - depth = (info->var.green.length == 5) ? 15 : 16; | ||
40 | - | ||
41 | - if (regno > 255 || | ||
42 | - (depth == 16 && regno > 63) || | ||
43 | - (depth == 15 && regno > 31)) | ||
44 | - return 1; | ||
45 | - | ||
46 | - if (regno < 16) { | ||
47 | - switch (depth) { | ||
48 | - case 15: | ||
49 | - pal[regno] = (regno << 10) | (regno << 5) | regno; | ||
50 | - break; | ||
51 | - case 16: | ||
52 | - pal[regno] = (regno << 11) | (regno << 5) | regno; | ||
53 | - break; | ||
54 | - case 24: | ||
55 | - pal[regno] = (regno << 16) | (regno << 8) | regno; | ||
56 | - break; | ||
57 | - case 32: | ||
58 | - i = (regno << 8) | regno; | ||
59 | - pal[regno] = (i << 16) | i; | ||
60 | - break; | ||
61 | + | ||
62 | + if (info->fix.visual == FB_VISUAL_TRUECOLOR) { | ||
63 | + u32 *pal = info->pseudo_palette; | ||
64 | + u32 cr = red >> (16 - info->var.red.length); | ||
65 | + u32 cg = green >> (16 - info->var.green.length); | ||
66 | + u32 cb = blue >> (16 - info->var.blue.length); | ||
67 | + u32 value; | ||
68 | + | ||
69 | + if (regno >= 16) | ||
70 | + return -EINVAL; | ||
71 | + | ||
72 | + value = (cr << info->var.red.offset) | | ||
73 | + (cg << info->var.green.offset) | | ||
74 | + (cb << info->var.blue.offset); | ||
75 | + if (info->var.transp.length > 0) { | ||
76 | + u32 mask = (1 << info->var.transp.length) - 1; | ||
77 | + mask <<= info->var.transp.offset; | ||
78 | + value |= mask; | ||
79 | } | ||
80 | + pal[regno] = value; | ||
81 | + return 0; | ||
82 | } | ||
83 | |||
84 | + if (regno > 255) | ||
85 | + return -EINVAL; | ||
86 | + | ||
87 | red >>= 8; | ||
88 | green >>= 8; | ||
89 | blue >>= 8; | ||
90 | -- | ||
91 | 1.7.7.4 | ||
92 | |||
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0006-offb-Fix-bug-in-calculating-requested-vram-size.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0006-offb-Fix-bug-in-calculating-requested-vram-size.patch new file mode 100644 index 00000000..19c6d428 --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0006-offb-Fix-bug-in-calculating-requested-vram-size.patch | |||
@@ -0,0 +1,32 @@ | |||
1 | From 37c7c45ec59ce80eaedb2b8edc4b797e4ad0ef03 Mon Sep 17 00:00:00 2001 | ||
2 | From: Benjamin Herrenschmidt <benh@kernel.crashing.org> | ||
3 | Date: Tue, 3 Jan 2012 12:09:15 +1100 | ||
4 | Subject: [PATCH 06/49] offb: Fix bug in calculating requested vram size | ||
5 | |||
6 | commit c055fe0797b7bd8f6f21a13598a55a16d5c13ae7 upstream. | ||
7 | |||
8 | We used to try to request 8 times more vram than needed, which would | ||
9 | fail if the card has a too small BAR (observed with qemu & kvm). | ||
10 | |||
11 | Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> | ||
12 | Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> | ||
13 | --- | ||
14 | drivers/video/offb.c | 2 +- | ||
15 | 1 files changed, 1 insertions(+), 1 deletions(-) | ||
16 | |||
17 | diff --git a/drivers/video/offb.c b/drivers/video/offb.c | ||
18 | index 24e1fc6..3251a02 100644 | ||
19 | --- a/drivers/video/offb.c | ||
20 | +++ b/drivers/video/offb.c | ||
21 | @@ -377,7 +377,7 @@ static void __init offb_init_fb(const char *name, const char *full_name, | ||
22 | int pitch, unsigned long address, | ||
23 | int foreign_endian, struct device_node *dp) | ||
24 | { | ||
25 | - unsigned long res_size = pitch * height * (depth + 7) / 8; | ||
26 | + unsigned long res_size = pitch * height; | ||
27 | struct offb_par *par = &default_par; | ||
28 | unsigned long res_start = address; | ||
29 | struct fb_fix_screeninfo *fix; | ||
30 | -- | ||
31 | 1.7.7.4 | ||
32 | |||
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0007-libertas-clean-up-scan-thread-handling.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0007-libertas-clean-up-scan-thread-handling.patch new file mode 100644 index 00000000..38fbce3c --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0007-libertas-clean-up-scan-thread-handling.patch | |||
@@ -0,0 +1,86 @@ | |||
1 | From 3184baa0e69e6ad327808b91e0d915090c59b99b Mon Sep 17 00:00:00 2001 | ||
2 | From: Andres Salomon <dilinger@queued.net> | ||
3 | Date: Mon, 19 Dec 2011 12:22:58 -0800 | ||
4 | Subject: [PATCH 07/49] libertas: clean up scan thread handling | ||
5 | |||
6 | commit afbca95f95f2bf7283a72670c24c1f6de00b1cb5 upstream. | ||
7 | |||
8 | The libertas scan thread expects priv->scan_req to be non-NULL. In theory, | ||
9 | it should always be set. In practice, we've seen the following oops: | ||
10 | |||
11 | [ 8363.067444] Unable to handle kernel NULL pointer dereference at virtual address 00000004 | ||
12 | [ 8363.067490] pgd = c0004000 | ||
13 | [ 8363.078393] [00000004] *pgd=00000000 | ||
14 | [ 8363.086711] Internal error: Oops: 17 [#1] PREEMPT | ||
15 | [ 8363.091375] Modules linked in: fuse libertas_sdio libertas psmouse mousedev ov7670 mmp_camera joydev videobuf2_core videobuf2_dma_sg videobuf2_memops [last unloaded: scsi_wait_scan] | ||
16 | [ 8363.107490] CPU: 0 Not tainted (3.0.0-gf7ccc69 #671) | ||
17 | [ 8363.112799] PC is at lbs_scan_worker+0x108/0x5a4 [libertas] | ||
18 | [ 8363.118326] LR is at 0x0 | ||
19 | [ 8363.120836] pc : [<bf03a854>] lr : [<00000000>] psr: 60000113 | ||
20 | [ 8363.120845] sp : ee66bf48 ip : 00000000 fp : 00000000 | ||
21 | [ 8363.120845] r10: ee2c2088 r9 : c04e2efc r8 : eef97005 | ||
22 | [ 8363.132231] r7 : eee0716f r6 : ee2c02c0 r5 : ee2c2088 r4 : eee07160 | ||
23 | [ 8363.137419] r3 : 00000000 r2 : a0000113 r1 : 00000001 r0 : eee07160 | ||
24 | [ 8363.143896] Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment kernel | ||
25 | [ 8363.157630] Control: 10c5387d Table: 2e754019 DAC: 00000015 | ||
26 | [ 8363.163334] Process kworker/u:1 (pid: 25, stack limit = 0xee66a2f8) | ||
27 | |||
28 | While I've not found a smoking gun, there are two places that raised red flags | ||
29 | for me. The first is in _internal_start_scan, when we queue up a scan; we | ||
30 | first queue the worker, and then set priv->scan_req. There's theoretically | ||
31 | a 50mS delay which should be plenty, but doing things that way just seems | ||
32 | racy (and not in the good way). | ||
33 | |||
34 | The second is in the scan worker thread itself. Depending on the state of | ||
35 | priv->scan_channel, we cancel pending scan runs and then requeue a run in | ||
36 | 300mS. We then send the scan command down to the hardware, sleep, and if | ||
37 | we get scan results for all the desired channels, we set priv->scan_req to | ||
38 | NULL. However, it that's happened in less than 300mS, what happens with | ||
39 | the pending scan run? | ||
40 | |||
41 | This patch addresses both of those concerns. With the patch applied, we | ||
42 | have not seen the oops in the past two weeks. | ||
43 | |||
44 | Signed-off-by: Andres Salomon <dilinger@queued.net> | ||
45 | Signed-off-by: John W. Linville <linville@tuxdriver.com> | ||
46 | Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> | ||
47 | --- | ||
48 | drivers/net/wireless/libertas/cfg.c | 10 ++++++---- | ||
49 | 1 files changed, 6 insertions(+), 4 deletions(-) | ||
50 | |||
51 | diff --git a/drivers/net/wireless/libertas/cfg.c b/drivers/net/wireless/libertas/cfg.c | ||
52 | index a7f1ab2..db64ef1 100644 | ||
53 | --- a/drivers/net/wireless/libertas/cfg.c | ||
54 | +++ b/drivers/net/wireless/libertas/cfg.c | ||
55 | @@ -728,9 +728,11 @@ static void lbs_scan_worker(struct work_struct *work) | ||
56 | le16_to_cpu(scan_cmd->hdr.size), | ||
57 | lbs_ret_scan, 0); | ||
58 | |||
59 | - if (priv->scan_channel >= priv->scan_req->n_channels) | ||
60 | + if (priv->scan_channel >= priv->scan_req->n_channels) { | ||
61 | /* Mark scan done */ | ||
62 | + cancel_delayed_work(&priv->scan_work); | ||
63 | lbs_scan_done(priv); | ||
64 | + } | ||
65 | |||
66 | /* Restart network */ | ||
67 | if (carrier) | ||
68 | @@ -759,12 +761,12 @@ static void _internal_start_scan(struct lbs_private *priv, bool internal, | ||
69 | request->n_ssids, request->n_channels, request->ie_len); | ||
70 | |||
71 | priv->scan_channel = 0; | ||
72 | - queue_delayed_work(priv->work_thread, &priv->scan_work, | ||
73 | - msecs_to_jiffies(50)); | ||
74 | - | ||
75 | priv->scan_req = request; | ||
76 | priv->internal_scan = internal; | ||
77 | |||
78 | + queue_delayed_work(priv->work_thread, &priv->scan_work, | ||
79 | + msecs_to_jiffies(50)); | ||
80 | + | ||
81 | lbs_deb_leave(LBS_DEB_CFG80211); | ||
82 | } | ||
83 | |||
84 | -- | ||
85 | 1.7.7.4 | ||
86 | |||
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0008-bcma-support-for-suspend-and-resume.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0008-bcma-support-for-suspend-and-resume.patch new file mode 100644 index 00000000..fa518499 --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0008-bcma-support-for-suspend-and-resume.patch | |||
@@ -0,0 +1,120 @@ | |||
1 | From 84c0b10f18c54e0f669f9ac81872db6aff1e59b4 Mon Sep 17 00:00:00 2001 | ||
2 | From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com> | ||
3 | Date: Fri, 9 Dec 2011 22:16:07 +0100 | ||
4 | Subject: [PATCH 08/49] bcma: support for suspend and resume | ||
5 | MIME-Version: 1.0 | ||
6 | Content-Type: text/plain; charset=UTF-8 | ||
7 | Content-Transfer-Encoding: 8bit | ||
8 | |||
9 | commit 775ab52142b02237a54184238e922251c59a2b5c upstream. | ||
10 | |||
11 | bcma used to lock up machine without enabling PCI or initializing CC. | ||
12 | |||
13 | Signed-off-by: Rafał Miłecki <zajec5@gmail.com> | ||
14 | Signed-off-by: John W. Linville <linville@tuxdriver.com> | ||
15 | Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> | ||
16 | --- | ||
17 | drivers/bcma/bcma_private.h | 3 +++ | ||
18 | drivers/bcma/host_pci.c | 37 +++++++++++++++++++++++++++++++++++++ | ||
19 | drivers/bcma/main.c | 16 ++++++++++++++++ | ||
20 | 3 files changed, 56 insertions(+), 0 deletions(-) | ||
21 | |||
22 | diff --git a/drivers/bcma/bcma_private.h b/drivers/bcma/bcma_private.h | ||
23 | index 30a3085..fda56bd 100644 | ||
24 | --- a/drivers/bcma/bcma_private.h | ||
25 | +++ b/drivers/bcma/bcma_private.h | ||
26 | @@ -18,6 +18,9 @@ void bcma_bus_unregister(struct bcma_bus *bus); | ||
27 | int __init bcma_bus_early_register(struct bcma_bus *bus, | ||
28 | struct bcma_device *core_cc, | ||
29 | struct bcma_device *core_mips); | ||
30 | +#ifdef CONFIG_PM | ||
31 | +int bcma_bus_resume(struct bcma_bus *bus); | ||
32 | +#endif | ||
33 | |||
34 | /* scan.c */ | ||
35 | int bcma_bus_scan(struct bcma_bus *bus); | ||
36 | diff --git a/drivers/bcma/host_pci.c b/drivers/bcma/host_pci.c | ||
37 | index 1b51d8b..990f5a8 100644 | ||
38 | --- a/drivers/bcma/host_pci.c | ||
39 | +++ b/drivers/bcma/host_pci.c | ||
40 | @@ -224,6 +224,41 @@ static void bcma_host_pci_remove(struct pci_dev *dev) | ||
41 | pci_set_drvdata(dev, NULL); | ||
42 | } | ||
43 | |||
44 | +#ifdef CONFIG_PM | ||
45 | +static int bcma_host_pci_suspend(struct pci_dev *dev, pm_message_t state) | ||
46 | +{ | ||
47 | + /* Host specific */ | ||
48 | + pci_save_state(dev); | ||
49 | + pci_disable_device(dev); | ||
50 | + pci_set_power_state(dev, pci_choose_state(dev, state)); | ||
51 | + | ||
52 | + return 0; | ||
53 | +} | ||
54 | + | ||
55 | +static int bcma_host_pci_resume(struct pci_dev *dev) | ||
56 | +{ | ||
57 | + struct bcma_bus *bus = pci_get_drvdata(dev); | ||
58 | + int err; | ||
59 | + | ||
60 | + /* Host specific */ | ||
61 | + pci_set_power_state(dev, 0); | ||
62 | + err = pci_enable_device(dev); | ||
63 | + if (err) | ||
64 | + return err; | ||
65 | + pci_restore_state(dev); | ||
66 | + | ||
67 | + /* Bus specific */ | ||
68 | + err = bcma_bus_resume(bus); | ||
69 | + if (err) | ||
70 | + return err; | ||
71 | + | ||
72 | + return 0; | ||
73 | +} | ||
74 | +#else /* CONFIG_PM */ | ||
75 | +# define bcma_host_pci_suspend NULL | ||
76 | +# define bcma_host_pci_resume NULL | ||
77 | +#endif /* CONFIG_PM */ | ||
78 | + | ||
79 | static DEFINE_PCI_DEVICE_TABLE(bcma_pci_bridge_tbl) = { | ||
80 | { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x0576) }, | ||
81 | { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4331) }, | ||
82 | @@ -239,6 +274,8 @@ static struct pci_driver bcma_pci_bridge_driver = { | ||
83 | .id_table = bcma_pci_bridge_tbl, | ||
84 | .probe = bcma_host_pci_probe, | ||
85 | .remove = bcma_host_pci_remove, | ||
86 | + .suspend = bcma_host_pci_suspend, | ||
87 | + .resume = bcma_host_pci_resume, | ||
88 | }; | ||
89 | |||
90 | int __init bcma_host_pci_init(void) | ||
91 | diff --git a/drivers/bcma/main.c b/drivers/bcma/main.c | ||
92 | index 70c84b9..10f92b3 100644 | ||
93 | --- a/drivers/bcma/main.c | ||
94 | +++ b/drivers/bcma/main.c | ||
95 | @@ -240,6 +240,22 @@ int __init bcma_bus_early_register(struct bcma_bus *bus, | ||
96 | return 0; | ||
97 | } | ||
98 | |||
99 | +#ifdef CONFIG_PM | ||
100 | +int bcma_bus_resume(struct bcma_bus *bus) | ||
101 | +{ | ||
102 | + struct bcma_device *core; | ||
103 | + | ||
104 | + /* Init CC core */ | ||
105 | + core = bcma_find_core(bus, BCMA_CORE_CHIPCOMMON); | ||
106 | + if (core) { | ||
107 | + bus->drv_cc.setup_done = false; | ||
108 | + bcma_core_chipcommon_init(&bus->drv_cc); | ||
109 | + } | ||
110 | + | ||
111 | + return 0; | ||
112 | +} | ||
113 | +#endif | ||
114 | + | ||
115 | int __bcma_driver_register(struct bcma_driver *drv, struct module *owner) | ||
116 | { | ||
117 | drv->drv.name = drv->name; | ||
118 | -- | ||
119 | 1.7.7.4 | ||
120 | |||
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0009-wl12xx-Validate-FEM-index-from-ini-file-and-FW.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0009-wl12xx-Validate-FEM-index-from-ini-file-and-FW.patch new file mode 100644 index 00000000..3380e52b --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0009-wl12xx-Validate-FEM-index-from-ini-file-and-FW.patch | |||
@@ -0,0 +1,75 @@ | |||
1 | From aa9c7fd565d04120156ef720235e9a759638606a Mon Sep 17 00:00:00 2001 | ||
2 | From: Pontus Fuchs <pontus.fuchs@gmail.com> | ||
3 | Date: Tue, 18 Oct 2011 09:23:41 +0200 | ||
4 | Subject: [PATCH 09/49] wl12xx: Validate FEM index from ini file and FW | ||
5 | |||
6 | commit 2131d3c2f99b081806fdae7662c92fe6acda52af upstream. | ||
7 | |||
8 | Check for out of bound FEM index to prevent reading beyond ini | ||
9 | memory end. | ||
10 | |||
11 | Signed-off-by: Pontus Fuchs <pontus.fuchs@gmail.com> | ||
12 | Reviewed-by: Luciano Coelho <coelho@ti.com> | ||
13 | Signed-off-by: Luciano Coelho <coelho@ti.com> | ||
14 | Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> | ||
15 | --- | ||
16 | drivers/net/wireless/wl12xx/cmd.c | 22 ++++++++++++++++++++++ | ||
17 | 1 files changed, 22 insertions(+), 0 deletions(-) | ||
18 | |||
19 | diff --git a/drivers/net/wireless/wl12xx/cmd.c b/drivers/net/wireless/wl12xx/cmd.c | ||
20 | index a52299e..54a0d66 100644 | ||
21 | --- a/drivers/net/wireless/wl12xx/cmd.c | ||
22 | +++ b/drivers/net/wireless/wl12xx/cmd.c | ||
23 | @@ -120,6 +120,11 @@ int wl1271_cmd_general_parms(struct wl1271 *wl) | ||
24 | if (!wl->nvs) | ||
25 | return -ENODEV; | ||
26 | |||
27 | + if (gp->tx_bip_fem_manufacturer >= WL1271_INI_FEM_MODULE_COUNT) { | ||
28 | + wl1271_warning("FEM index from INI out of bounds"); | ||
29 | + return -EINVAL; | ||
30 | + } | ||
31 | + | ||
32 | gen_parms = kzalloc(sizeof(*gen_parms), GFP_KERNEL); | ||
33 | if (!gen_parms) | ||
34 | return -ENOMEM; | ||
35 | @@ -143,6 +148,12 @@ int wl1271_cmd_general_parms(struct wl1271 *wl) | ||
36 | gp->tx_bip_fem_manufacturer = | ||
37 | gen_parms->general_params.tx_bip_fem_manufacturer; | ||
38 | |||
39 | + if (gp->tx_bip_fem_manufacturer >= WL1271_INI_FEM_MODULE_COUNT) { | ||
40 | + wl1271_warning("FEM index from FW out of bounds"); | ||
41 | + ret = -EINVAL; | ||
42 | + goto out; | ||
43 | + } | ||
44 | + | ||
45 | wl1271_debug(DEBUG_CMD, "FEM autodetect: %s, manufacturer: %d\n", | ||
46 | answer ? "auto" : "manual", gp->tx_bip_fem_manufacturer); | ||
47 | |||
48 | @@ -162,6 +173,11 @@ int wl128x_cmd_general_parms(struct wl1271 *wl) | ||
49 | if (!wl->nvs) | ||
50 | return -ENODEV; | ||
51 | |||
52 | + if (gp->tx_bip_fem_manufacturer >= WL1271_INI_FEM_MODULE_COUNT) { | ||
53 | + wl1271_warning("FEM index from ini out of bounds"); | ||
54 | + return -EINVAL; | ||
55 | + } | ||
56 | + | ||
57 | gen_parms = kzalloc(sizeof(*gen_parms), GFP_KERNEL); | ||
58 | if (!gen_parms) | ||
59 | return -ENOMEM; | ||
60 | @@ -186,6 +202,12 @@ int wl128x_cmd_general_parms(struct wl1271 *wl) | ||
61 | gp->tx_bip_fem_manufacturer = | ||
62 | gen_parms->general_params.tx_bip_fem_manufacturer; | ||
63 | |||
64 | + if (gp->tx_bip_fem_manufacturer >= WL1271_INI_FEM_MODULE_COUNT) { | ||
65 | + wl1271_warning("FEM index from FW out of bounds"); | ||
66 | + ret = -EINVAL; | ||
67 | + goto out; | ||
68 | + } | ||
69 | + | ||
70 | wl1271_debug(DEBUG_CMD, "FEM autodetect: %s, manufacturer: %d\n", | ||
71 | answer ? "auto" : "manual", gp->tx_bip_fem_manufacturer); | ||
72 | |||
73 | -- | ||
74 | 1.7.7.4 | ||
75 | |||
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0010-wl12xx-Check-buffer-bound-when-processing-nvs-data.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0010-wl12xx-Check-buffer-bound-when-processing-nvs-data.patch new file mode 100644 index 00000000..d462ef66 --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0010-wl12xx-Check-buffer-bound-when-processing-nvs-data.patch | |||
@@ -0,0 +1,68 @@ | |||
1 | From bcd7880977c293b60ae6dbae4264d6c47be08fb9 Mon Sep 17 00:00:00 2001 | ||
2 | From: Pontus Fuchs <pontus.fuchs@gmail.com> | ||
3 | Date: Tue, 18 Oct 2011 09:23:42 +0200 | ||
4 | Subject: [PATCH 10/49] wl12xx: Check buffer bound when processing nvs data | ||
5 | |||
6 | commit f6efe96edd9c41c624c8f4ddbc4930c1a2d8f1e1 upstream. | ||
7 | |||
8 | An nvs with malformed contents could cause the processing of the | ||
9 | calibration data to read beyond the end of the buffer. Prevent this | ||
10 | from happening by adding bound checking. | ||
11 | |||
12 | Signed-off-by: Pontus Fuchs <pontus.fuchs@gmail.com> | ||
13 | Reviewed-by: Luciano Coelho <coelho@ti.com> | ||
14 | Signed-off-by: Luciano Coelho <coelho@ti.com> | ||
15 | Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> | ||
16 | --- | ||
17 | drivers/net/wireless/wl12xx/boot.c | 14 ++++++++++++++ | ||
18 | 1 files changed, 14 insertions(+), 0 deletions(-) | ||
19 | |||
20 | diff --git a/drivers/net/wireless/wl12xx/boot.c b/drivers/net/wireless/wl12xx/boot.c | ||
21 | index 6813379..a7b327d 100644 | ||
22 | --- a/drivers/net/wireless/wl12xx/boot.c | ||
23 | +++ b/drivers/net/wireless/wl12xx/boot.c | ||
24 | @@ -347,6 +347,9 @@ static int wl1271_boot_upload_nvs(struct wl1271 *wl) | ||
25 | nvs_ptr += 3; | ||
26 | |||
27 | for (i = 0; i < burst_len; i++) { | ||
28 | + if (nvs_ptr + 3 >= (u8 *) wl->nvs + nvs_len) | ||
29 | + goto out_badnvs; | ||
30 | + | ||
31 | val = (nvs_ptr[0] | (nvs_ptr[1] << 8) | ||
32 | | (nvs_ptr[2] << 16) | (nvs_ptr[3] << 24)); | ||
33 | |||
34 | @@ -358,6 +361,9 @@ static int wl1271_boot_upload_nvs(struct wl1271 *wl) | ||
35 | nvs_ptr += 4; | ||
36 | dest_addr += 4; | ||
37 | } | ||
38 | + | ||
39 | + if (nvs_ptr >= (u8 *) wl->nvs + nvs_len) | ||
40 | + goto out_badnvs; | ||
41 | } | ||
42 | |||
43 | /* | ||
44 | @@ -369,6 +375,10 @@ static int wl1271_boot_upload_nvs(struct wl1271 *wl) | ||
45 | */ | ||
46 | nvs_ptr = (u8 *)wl->nvs + | ||
47 | ALIGN(nvs_ptr - (u8 *)wl->nvs + 7, 4); | ||
48 | + | ||
49 | + if (nvs_ptr >= (u8 *) wl->nvs + nvs_len) | ||
50 | + goto out_badnvs; | ||
51 | + | ||
52 | nvs_len -= nvs_ptr - (u8 *)wl->nvs; | ||
53 | |||
54 | /* Now we must set the partition correctly */ | ||
55 | @@ -384,6 +394,10 @@ static int wl1271_boot_upload_nvs(struct wl1271 *wl) | ||
56 | |||
57 | kfree(nvs_aligned); | ||
58 | return 0; | ||
59 | + | ||
60 | +out_badnvs: | ||
61 | + wl1271_error("nvs data is malformed"); | ||
62 | + return -EILSEQ; | ||
63 | } | ||
64 | |||
65 | static void wl1271_boot_enable_interrupts(struct wl1271 *wl) | ||
66 | -- | ||
67 | 1.7.7.4 | ||
68 | |||
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0011-wl12xx-Restore-testmode-ABI.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0011-wl12xx-Restore-testmode-ABI.patch new file mode 100644 index 00000000..7c619d49 --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0011-wl12xx-Restore-testmode-ABI.patch | |||
@@ -0,0 +1,32 @@ | |||
1 | From 78848b4805314cdbf6c342b8315cdf7db2a1d09e Mon Sep 17 00:00:00 2001 | ||
2 | From: Pontus Fuchs <pontus.fuchs@gmail.com> | ||
3 | Date: Thu, 1 Dec 2011 12:13:44 +0100 | ||
4 | Subject: [PATCH 11/49] wl12xx: Restore testmode ABI | ||
5 | |||
6 | commit 3f1764945eaac532c20ab1f23afa352a40f797b2 upstream. | ||
7 | |||
8 | Commit 80900d0140a7648587982c8f299830e900e49165 accidently broke | ||
9 | the ABI for testmode commands. Restore the ABI again. | ||
10 | |||
11 | Signed-off-by: Pontus Fuchs <pontus.fuchs@gmail.com> | ||
12 | Signed-off-by: Luciano Coelho <coelho@ti.com> | ||
13 | Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> | ||
14 | --- | ||
15 | drivers/net/wireless/wl12xx/testmode.c | 1 + | ||
16 | 1 files changed, 1 insertions(+), 0 deletions(-) | ||
17 | |||
18 | diff --git a/drivers/net/wireless/wl12xx/testmode.c b/drivers/net/wireless/wl12xx/testmode.c | ||
19 | index 4ae8eff..abfb120 100644 | ||
20 | --- a/drivers/net/wireless/wl12xx/testmode.c | ||
21 | +++ b/drivers/net/wireless/wl12xx/testmode.c | ||
22 | @@ -36,6 +36,7 @@ enum wl1271_tm_commands { | ||
23 | WL1271_TM_CMD_TEST, | ||
24 | WL1271_TM_CMD_INTERROGATE, | ||
25 | WL1271_TM_CMD_CONFIGURE, | ||
26 | + WL1271_TM_CMD_NVS_PUSH, /* Not in use. Keep to not break ABI */ | ||
27 | WL1271_TM_CMD_SET_PLT_MODE, | ||
28 | WL1271_TM_CMD_RECOVER, | ||
29 | |||
30 | -- | ||
31 | 1.7.7.4 | ||
32 | |||
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0012-powerpc-time-Handle-wrapping-of-decrementer.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0012-powerpc-time-Handle-wrapping-of-decrementer.patch new file mode 100644 index 00000000..77fcc8b4 --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0012-powerpc-time-Handle-wrapping-of-decrementer.patch | |||
@@ -0,0 +1,93 @@ | |||
1 | From 9c146884a6b099ed8892c056e26eae85019bc2c9 Mon Sep 17 00:00:00 2001 | ||
2 | From: Anton Blanchard <anton@samba.org> | ||
3 | Date: Wed, 23 Nov 2011 20:07:17 +0000 | ||
4 | Subject: [PATCH 12/49] powerpc/time: Handle wrapping of decrementer | ||
5 | |||
6 | commit 37fb9a0231ee43d42d069863bdfd567fca2b61af upstream. | ||
7 | |||
8 | When re-enabling interrupts we have code to handle edge sensitive | ||
9 | decrementers by resetting the decrementer to 1 whenever it is negative. | ||
10 | If interrupts were disabled long enough that the decrementer wrapped to | ||
11 | positive we do nothing. This means interrupts can be delayed for a long | ||
12 | time until it finally goes negative again. | ||
13 | |||
14 | While we hope interrupts are never be disabled long enough for the | ||
15 | decrementer to go positive, we have a very good test team that can | ||
16 | drive any kernel into the ground. The softlockup data we get back | ||
17 | from these fails could be seconds in the future, completely missing | ||
18 | the cause of the lockup. | ||
19 | |||
20 | We already keep track of the timebase of the next event so use that | ||
21 | to work out if we should trigger a decrementer exception. | ||
22 | |||
23 | Signed-off-by: Anton Blanchard <anton@samba.org> | ||
24 | Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> | ||
25 | Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> | ||
26 | --- | ||
27 | arch/powerpc/include/asm/time.h | 2 ++ | ||
28 | arch/powerpc/kernel/irq.c | 15 ++++++--------- | ||
29 | arch/powerpc/kernel/time.c | 9 +++++++++ | ||
30 | 3 files changed, 17 insertions(+), 9 deletions(-) | ||
31 | |||
32 | diff --git a/arch/powerpc/include/asm/time.h b/arch/powerpc/include/asm/time.h | ||
33 | index fe6f7c2..bc3c745 100644 | ||
34 | --- a/arch/powerpc/include/asm/time.h | ||
35 | +++ b/arch/powerpc/include/asm/time.h | ||
36 | @@ -219,5 +219,7 @@ DECLARE_PER_CPU(struct cpu_usage, cpu_usage_array); | ||
37 | extern void secondary_cpu_time_init(void); | ||
38 | extern void iSeries_time_init_early(void); | ||
39 | |||
40 | +extern void decrementer_check_overflow(void); | ||
41 | + | ||
42 | #endif /* __KERNEL__ */ | ||
43 | #endif /* __POWERPC_TIME_H */ | ||
44 | diff --git a/arch/powerpc/kernel/irq.c b/arch/powerpc/kernel/irq.c | ||
45 | index 5c3c469..745c1e7 100644 | ||
46 | --- a/arch/powerpc/kernel/irq.c | ||
47 | +++ b/arch/powerpc/kernel/irq.c | ||
48 | @@ -164,16 +164,13 @@ notrace void arch_local_irq_restore(unsigned long en) | ||
49 | */ | ||
50 | local_paca->hard_enabled = en; | ||
51 | |||
52 | -#ifndef CONFIG_BOOKE | ||
53 | - /* On server, re-trigger the decrementer if it went negative since | ||
54 | - * some processors only trigger on edge transitions of the sign bit. | ||
55 | - * | ||
56 | - * BookE has a level sensitive decrementer (latches in TSR) so we | ||
57 | - * don't need that | ||
58 | + /* | ||
59 | + * Trigger the decrementer if we have a pending event. Some processors | ||
60 | + * only trigger on edge transitions of the sign bit. We might also | ||
61 | + * have disabled interrupts long enough that the decrementer wrapped | ||
62 | + * to positive. | ||
63 | */ | ||
64 | - if ((int)mfspr(SPRN_DEC) < 0) | ||
65 | - mtspr(SPRN_DEC, 1); | ||
66 | -#endif /* CONFIG_BOOKE */ | ||
67 | + decrementer_check_overflow(); | ||
68 | |||
69 | /* | ||
70 | * Force the delivery of pending soft-disabled interrupts on PS3. | ||
71 | diff --git a/arch/powerpc/kernel/time.c b/arch/powerpc/kernel/time.c | ||
72 | index 522bb1d..5db163c 100644 | ||
73 | --- a/arch/powerpc/kernel/time.c | ||
74 | +++ b/arch/powerpc/kernel/time.c | ||
75 | @@ -889,6 +889,15 @@ static void __init clocksource_init(void) | ||
76 | clock->name, clock->mult, clock->shift); | ||
77 | } | ||
78 | |||
79 | +void decrementer_check_overflow(void) | ||
80 | +{ | ||
81 | + u64 now = get_tb_or_rtc(); | ||
82 | + struct decrementer_clock *decrementer = &__get_cpu_var(decrementers); | ||
83 | + | ||
84 | + if (now >= decrementer->next_tb) | ||
85 | + set_dec(1); | ||
86 | +} | ||
87 | + | ||
88 | static int decrementer_set_next_event(unsigned long evt, | ||
89 | struct clock_event_device *dev) | ||
90 | { | ||
91 | -- | ||
92 | 1.7.7.4 | ||
93 | |||
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0013-powerpc-Fix-unpaired-probe_hcall_entry-and-probe_hca.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0013-powerpc-Fix-unpaired-probe_hcall_entry-and-probe_hca.patch new file mode 100644 index 00000000..69c746e2 --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0013-powerpc-Fix-unpaired-probe_hcall_entry-and-probe_hca.patch | |||
@@ -0,0 +1,85 @@ | |||
1 | From 78f337d172aafe8577dab8044f26326850b6c5d0 Mon Sep 17 00:00:00 2001 | ||
2 | From: Li Zhong <zhong@linux.vnet.ibm.com> | ||
3 | Date: Sun, 18 Dec 2011 16:03:04 +0000 | ||
4 | Subject: [PATCH 13/49] powerpc: Fix unpaired probe_hcall_entry and | ||
5 | probe_hcall_exit | ||
6 | |||
7 | commit e4f387d8db3ba3c2dae4d8bdfe7bb5f4fe1bcb0d upstream. | ||
8 | |||
9 | Unpaired calling of probe_hcall_entry and probe_hcall_exit might happen | ||
10 | as following, which could cause incorrect preempt count. | ||
11 | |||
12 | __trace_hcall_entry => trace_hcall_entry -> probe_hcall_entry => | ||
13 | get_cpu_var => preempt_disable | ||
14 | |||
15 | __trace_hcall_exit => trace_hcall_exit -> probe_hcall_exit => | ||
16 | put_cpu_var => preempt_enable | ||
17 | |||
18 | where: | ||
19 | A => B and A -> B means A calls B, but | ||
20 | => means A will call B through function name, and B will definitely be | ||
21 | called. | ||
22 | -> means A will call B through function pointer, so B might not be | ||
23 | called if the function pointer is not set. | ||
24 | |||
25 | So error happens when only one of probe_hcall_entry and probe_hcall_exit | ||
26 | get called during a hcall. | ||
27 | |||
28 | This patch tries to move the preempt count operations from | ||
29 | probe_hcall_entry and probe_hcall_exit to its callers. | ||
30 | |||
31 | Reported-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com> | ||
32 | Signed-off-by: Li Zhong <zhong@linux.vnet.ibm.com> | ||
33 | Tested-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com> | ||
34 | Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> | ||
35 | Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> | ||
36 | --- | ||
37 | arch/powerpc/platforms/pseries/hvCall_inst.c | 4 +--- | ||
38 | arch/powerpc/platforms/pseries/lpar.c | 2 ++ | ||
39 | 2 files changed, 3 insertions(+), 3 deletions(-) | ||
40 | |||
41 | diff --git a/arch/powerpc/platforms/pseries/hvCall_inst.c b/arch/powerpc/platforms/pseries/hvCall_inst.c | ||
42 | index f106662..c9311cf 100644 | ||
43 | --- a/arch/powerpc/platforms/pseries/hvCall_inst.c | ||
44 | +++ b/arch/powerpc/platforms/pseries/hvCall_inst.c | ||
45 | @@ -109,7 +109,7 @@ static void probe_hcall_entry(void *ignored, unsigned long opcode, unsigned long | ||
46 | if (opcode > MAX_HCALL_OPCODE) | ||
47 | return; | ||
48 | |||
49 | - h = &get_cpu_var(hcall_stats)[opcode / 4]; | ||
50 | + h = &__get_cpu_var(hcall_stats)[opcode / 4]; | ||
51 | h->tb_start = mftb(); | ||
52 | h->purr_start = mfspr(SPRN_PURR); | ||
53 | } | ||
54 | @@ -126,8 +126,6 @@ static void probe_hcall_exit(void *ignored, unsigned long opcode, unsigned long | ||
55 | h->num_calls++; | ||
56 | h->tb_total += mftb() - h->tb_start; | ||
57 | h->purr_total += mfspr(SPRN_PURR) - h->purr_start; | ||
58 | - | ||
59 | - put_cpu_var(hcall_stats); | ||
60 | } | ||
61 | |||
62 | static int __init hcall_inst_init(void) | ||
63 | diff --git a/arch/powerpc/platforms/pseries/lpar.c b/arch/powerpc/platforms/pseries/lpar.c | ||
64 | index 27a4950..dc36ea6 100644 | ||
65 | --- a/arch/powerpc/platforms/pseries/lpar.c | ||
66 | +++ b/arch/powerpc/platforms/pseries/lpar.c | ||
67 | @@ -554,6 +554,7 @@ void __trace_hcall_entry(unsigned long opcode, unsigned long *args) | ||
68 | goto out; | ||
69 | |||
70 | (*depth)++; | ||
71 | + preempt_disable(); | ||
72 | trace_hcall_entry(opcode, args); | ||
73 | (*depth)--; | ||
74 | |||
75 | @@ -576,6 +577,7 @@ void __trace_hcall_exit(long opcode, unsigned long retval, | ||
76 | |||
77 | (*depth)++; | ||
78 | trace_hcall_exit(opcode, retval, retbuf); | ||
79 | + preempt_enable(); | ||
80 | (*depth)--; | ||
81 | |||
82 | out: | ||
83 | -- | ||
84 | 1.7.7.4 | ||
85 | |||
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0014-IB-qib-Fix-a-possible-data-corruption-when-receiving.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0014-IB-qib-Fix-a-possible-data-corruption-when-receiving.patch new file mode 100644 index 00000000..8f8624a8 --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0014-IB-qib-Fix-a-possible-data-corruption-when-receiving.patch | |||
@@ -0,0 +1,78 @@ | |||
1 | From 838487db8eb68ce5fa5417e9ea1333795f172523 Mon Sep 17 00:00:00 2001 | ||
2 | From: Ram Vepa <ram.vepa@qlogic.com> | ||
3 | Date: Fri, 23 Dec 2011 08:01:43 -0500 | ||
4 | Subject: [PATCH 14/49] IB/qib: Fix a possible data corruption when receiving | ||
5 | packets | ||
6 | |||
7 | commit eddfb675256f49d14e8c5763098afe3eb2c93701 upstream. | ||
8 | |||
9 | Prevent a receive data corruption by ensuring that the write to update | ||
10 | the rcvhdrheadn register to generate an interrupt is at the very end | ||
11 | of the receive processing. | ||
12 | |||
13 | Signed-off-by: Ramkrishna Vepa <ram.vepa@qlogic.com> | ||
14 | Signed-off-by: Mike Marciniszyn <mike.marciniszyn@qlogic.com> | ||
15 | Signed-off-by: Roland Dreier <roland@purestorage.com> | ||
16 | Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> | ||
17 | --- | ||
18 | drivers/infiniband/hw/qib/qib_iba6120.c | 4 +++- | ||
19 | drivers/infiniband/hw/qib/qib_iba7220.c | 4 +++- | ||
20 | drivers/infiniband/hw/qib/qib_iba7322.c | 6 ++++-- | ||
21 | 3 files changed, 10 insertions(+), 4 deletions(-) | ||
22 | |||
23 | diff --git a/drivers/infiniband/hw/qib/qib_iba6120.c b/drivers/infiniband/hw/qib/qib_iba6120.c | ||
24 | index 781a802..4f18e2d 100644 | ||
25 | --- a/drivers/infiniband/hw/qib/qib_iba6120.c | ||
26 | +++ b/drivers/infiniband/hw/qib/qib_iba6120.c | ||
27 | @@ -2076,9 +2076,11 @@ static void qib_6120_config_ctxts(struct qib_devdata *dd) | ||
28 | static void qib_update_6120_usrhead(struct qib_ctxtdata *rcd, u64 hd, | ||
29 | u32 updegr, u32 egrhd, u32 npkts) | ||
30 | { | ||
31 | - qib_write_ureg(rcd->dd, ur_rcvhdrhead, hd, rcd->ctxt); | ||
32 | if (updegr) | ||
33 | qib_write_ureg(rcd->dd, ur_rcvegrindexhead, egrhd, rcd->ctxt); | ||
34 | + mmiowb(); | ||
35 | + qib_write_ureg(rcd->dd, ur_rcvhdrhead, hd, rcd->ctxt); | ||
36 | + mmiowb(); | ||
37 | } | ||
38 | |||
39 | static u32 qib_6120_hdrqempty(struct qib_ctxtdata *rcd) | ||
40 | diff --git a/drivers/infiniband/hw/qib/qib_iba7220.c b/drivers/infiniband/hw/qib/qib_iba7220.c | ||
41 | index 439d3c5..7ec4048 100644 | ||
42 | --- a/drivers/infiniband/hw/qib/qib_iba7220.c | ||
43 | +++ b/drivers/infiniband/hw/qib/qib_iba7220.c | ||
44 | @@ -2725,9 +2725,11 @@ static int qib_7220_set_loopback(struct qib_pportdata *ppd, const char *what) | ||
45 | static void qib_update_7220_usrhead(struct qib_ctxtdata *rcd, u64 hd, | ||
46 | u32 updegr, u32 egrhd, u32 npkts) | ||
47 | { | ||
48 | - qib_write_ureg(rcd->dd, ur_rcvhdrhead, hd, rcd->ctxt); | ||
49 | if (updegr) | ||
50 | qib_write_ureg(rcd->dd, ur_rcvegrindexhead, egrhd, rcd->ctxt); | ||
51 | + mmiowb(); | ||
52 | + qib_write_ureg(rcd->dd, ur_rcvhdrhead, hd, rcd->ctxt); | ||
53 | + mmiowb(); | ||
54 | } | ||
55 | |||
56 | static u32 qib_7220_hdrqempty(struct qib_ctxtdata *rcd) | ||
57 | diff --git a/drivers/infiniband/hw/qib/qib_iba7322.c b/drivers/infiniband/hw/qib/qib_iba7322.c | ||
58 | index 1d58959..5a070e8 100644 | ||
59 | --- a/drivers/infiniband/hw/qib/qib_iba7322.c | ||
60 | +++ b/drivers/infiniband/hw/qib/qib_iba7322.c | ||
61 | @@ -4082,10 +4082,12 @@ static void qib_update_7322_usrhead(struct qib_ctxtdata *rcd, u64 hd, | ||
62 | */ | ||
63 | if (hd >> IBA7322_HDRHEAD_PKTINT_SHIFT) | ||
64 | adjust_rcv_timeout(rcd, npkts); | ||
65 | - qib_write_ureg(rcd->dd, ur_rcvhdrhead, hd, rcd->ctxt); | ||
66 | - qib_write_ureg(rcd->dd, ur_rcvhdrhead, hd, rcd->ctxt); | ||
67 | if (updegr) | ||
68 | qib_write_ureg(rcd->dd, ur_rcvegrindexhead, egrhd, rcd->ctxt); | ||
69 | + mmiowb(); | ||
70 | + qib_write_ureg(rcd->dd, ur_rcvhdrhead, hd, rcd->ctxt); | ||
71 | + qib_write_ureg(rcd->dd, ur_rcvhdrhead, hd, rcd->ctxt); | ||
72 | + mmiowb(); | ||
73 | } | ||
74 | |||
75 | static u32 qib_7322_hdrqempty(struct qib_ctxtdata *rcd) | ||
76 | -- | ||
77 | 1.7.7.4 | ||
78 | |||
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0015-IB-uverbs-Protect-QP-multicast-list.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0015-IB-uverbs-Protect-QP-multicast-list.patch new file mode 100644 index 00000000..bff13510 --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0015-IB-uverbs-Protect-QP-multicast-list.patch | |||
@@ -0,0 +1,96 @@ | |||
1 | From a2beea13ae4c2ffcaa7f0ddf94fde1246e2e6fc1 Mon Sep 17 00:00:00 2001 | ||
2 | From: Eli Cohen <eli@dev.mellanox.co.il> | ||
3 | Date: Tue, 3 Jan 2012 20:36:48 -0800 | ||
4 | Subject: [PATCH 15/49] IB/uverbs: Protect QP multicast list | ||
5 | |||
6 | commit e214a0fe2b382fa302c036ecd6e6ffe99e3b9875 upstream. | ||
7 | |||
8 | Userspace verbs multicast attach/detach operations on a QP are done | ||
9 | while holding the rwsem of the QP for reading. That's not sufficient | ||
10 | since a reader lock allows more than one reader to acquire the | ||
11 | lock. However, multicast attach/detach does list manipulation that | ||
12 | can corrupt the list if multiple threads run in parallel. | ||
13 | |||
14 | Fix this by acquiring the rwsem as a writer to serialize attach/detach | ||
15 | operations. Add idr_write_qp() and put_qp_write() to encapsulate | ||
16 | this. | ||
17 | |||
18 | This fixes oops seen when running applications that perform multicast | ||
19 | joins/leaves. | ||
20 | |||
21 | Reported by: Mike Dubman <miked@mellanox.com> | ||
22 | Signed-off-by: Eli Cohen <eli@mellanox.com> | ||
23 | Signed-off-by: Roland Dreier <roland@purestorage.com> | ||
24 | Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> | ||
25 | --- | ||
26 | drivers/infiniband/core/uverbs_cmd.c | 21 +++++++++++++++++---- | ||
27 | 1 files changed, 17 insertions(+), 4 deletions(-) | ||
28 | |||
29 | diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c | ||
30 | index 254f164..e3db8ef 100644 | ||
31 | --- a/drivers/infiniband/core/uverbs_cmd.c | ||
32 | +++ b/drivers/infiniband/core/uverbs_cmd.c | ||
33 | @@ -241,11 +241,24 @@ static struct ib_qp *idr_read_qp(int qp_handle, struct ib_ucontext *context) | ||
34 | return idr_read_obj(&ib_uverbs_qp_idr, qp_handle, context, 0); | ||
35 | } | ||
36 | |||
37 | +static struct ib_qp *idr_write_qp(int qp_handle, struct ib_ucontext *context) | ||
38 | +{ | ||
39 | + struct ib_uobject *uobj; | ||
40 | + | ||
41 | + uobj = idr_write_uobj(&ib_uverbs_qp_idr, qp_handle, context); | ||
42 | + return uobj ? uobj->object : NULL; | ||
43 | +} | ||
44 | + | ||
45 | static void put_qp_read(struct ib_qp *qp) | ||
46 | { | ||
47 | put_uobj_read(qp->uobject); | ||
48 | } | ||
49 | |||
50 | +static void put_qp_write(struct ib_qp *qp) | ||
51 | +{ | ||
52 | + put_uobj_write(qp->uobject); | ||
53 | +} | ||
54 | + | ||
55 | static struct ib_srq *idr_read_srq(int srq_handle, struct ib_ucontext *context) | ||
56 | { | ||
57 | return idr_read_obj(&ib_uverbs_srq_idr, srq_handle, context, 0); | ||
58 | @@ -2375,7 +2388,7 @@ ssize_t ib_uverbs_attach_mcast(struct ib_uverbs_file *file, | ||
59 | if (copy_from_user(&cmd, buf, sizeof cmd)) | ||
60 | return -EFAULT; | ||
61 | |||
62 | - qp = idr_read_qp(cmd.qp_handle, file->ucontext); | ||
63 | + qp = idr_write_qp(cmd.qp_handle, file->ucontext); | ||
64 | if (!qp) | ||
65 | return -EINVAL; | ||
66 | |||
67 | @@ -2404,7 +2417,7 @@ ssize_t ib_uverbs_attach_mcast(struct ib_uverbs_file *file, | ||
68 | kfree(mcast); | ||
69 | |||
70 | out_put: | ||
71 | - put_qp_read(qp); | ||
72 | + put_qp_write(qp); | ||
73 | |||
74 | return ret ? ret : in_len; | ||
75 | } | ||
76 | @@ -2422,7 +2435,7 @@ ssize_t ib_uverbs_detach_mcast(struct ib_uverbs_file *file, | ||
77 | if (copy_from_user(&cmd, buf, sizeof cmd)) | ||
78 | return -EFAULT; | ||
79 | |||
80 | - qp = idr_read_qp(cmd.qp_handle, file->ucontext); | ||
81 | + qp = idr_write_qp(cmd.qp_handle, file->ucontext); | ||
82 | if (!qp) | ||
83 | return -EINVAL; | ||
84 | |||
85 | @@ -2441,7 +2454,7 @@ ssize_t ib_uverbs_detach_mcast(struct ib_uverbs_file *file, | ||
86 | } | ||
87 | |||
88 | out_put: | ||
89 | - put_qp_read(qp); | ||
90 | + put_qp_write(qp); | ||
91 | |||
92 | return ret ? ret : in_len; | ||
93 | } | ||
94 | -- | ||
95 | 1.7.7.4 | ||
96 | |||
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0016-iwlagn-fix-TID-use-bug.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0016-iwlagn-fix-TID-use-bug.patch new file mode 100644 index 00000000..7c020372 --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0016-iwlagn-fix-TID-use-bug.patch | |||
@@ -0,0 +1,50 @@ | |||
1 | From 274a64cd739d2b5e33e6e2112f78c896b18849a9 Mon Sep 17 00:00:00 2001 | ||
2 | From: Johannes Berg <johannes.berg@intel.com> | ||
3 | Date: Fri, 2 Dec 2011 12:22:54 -0800 | ||
4 | Subject: [PATCH 16/49] iwlagn: fix TID use bug | ||
5 | |||
6 | commit 9a215e40d70ae63762963ab3ccc7f31dd966dc6a upstream. | ||
7 | |||
8 | The driver everywhere uses max TID count as 9, | ||
9 | which is wrong, it should be 8. | ||
10 | |||
11 | I think the reason it uses 9 here is off-by-one | ||
12 | confusion by whoever wrote this. We do use the | ||
13 | value IWL_MAX_TID_COUNT for "not QoS/no TID" | ||
14 | but that is completely correct even if it is 8 | ||
15 | and not 9 since 0-7 are only valid. | ||
16 | |||
17 | As a side effect, this fixes the following bug: | ||
18 | |||
19 | Open BA session requested for 00:23:cd:16:8a:7e tid 8 | ||
20 | ------------[ cut here ]------------ | ||
21 | kernel BUG at drivers/net/wireless/iwlwifi/iwl-trans-pcie-int.h:350! | ||
22 | ... | ||
23 | |||
24 | when you do | ||
25 | echo "tx start 8" > /sys/kernel/debug/ieee80211/*/*/*/*/agg_status | ||
26 | |||
27 | Reported-by: Nikolay Martynov <mar.kolya@gmail.com> | ||
28 | Signed-off-by: Johannes Berg <johannes.berg@intel.com> | ||
29 | Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com> | ||
30 | Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> | ||
31 | --- | ||
32 | drivers/net/wireless/iwlwifi/iwl-commands.h | 2 +- | ||
33 | 1 files changed, 1 insertions(+), 1 deletions(-) | ||
34 | |||
35 | diff --git a/drivers/net/wireless/iwlwifi/iwl-commands.h b/drivers/net/wireless/iwlwifi/iwl-commands.h | ||
36 | index 69d5f85..8b9ff28 100644 | ||
37 | --- a/drivers/net/wireless/iwlwifi/iwl-commands.h | ||
38 | +++ b/drivers/net/wireless/iwlwifi/iwl-commands.h | ||
39 | @@ -809,7 +809,7 @@ struct iwl_qosparam_cmd { | ||
40 | #define IWLAGN_STATION_COUNT 16 | ||
41 | |||
42 | #define IWL_INVALID_STATION 255 | ||
43 | -#define IWL_MAX_TID_COUNT 9 | ||
44 | +#define IWL_MAX_TID_COUNT 8 | ||
45 | |||
46 | #define STA_FLG_TX_RATE_MSK cpu_to_le32(1 << 2) | ||
47 | #define STA_FLG_PWR_SAVE_MSK cpu_to_le32(1 << 8) | ||
48 | -- | ||
49 | 1.7.7.4 | ||
50 | |||
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0017-iwlagn-fix-remove-use-of-PAGE_SIZE.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0017-iwlagn-fix-remove-use-of-PAGE_SIZE.patch new file mode 100644 index 00000000..5dcc7c4f --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0017-iwlagn-fix-remove-use-of-PAGE_SIZE.patch | |||
@@ -0,0 +1,180 @@ | |||
1 | From 8de3e18bbd1ec02914f9bf1517d2c3557c666314 Mon Sep 17 00:00:00 2001 | ||
2 | From: Johannes Berg <johannes.berg@intel.com> | ||
3 | Date: Mon, 19 Dec 2011 14:00:59 -0800 | ||
4 | Subject: [PATCH 17/49] iwlagn: fix (remove) use of PAGE_SIZE | ||
5 | |||
6 | commit 106671369e6d046c0b3e1e72b18ad6dd9cb298b0 upstream. | ||
7 | |||
8 | The ICT code erroneously uses PAGE_SIZE. The bug | ||
9 | is that PAGE_SIZE isn't necessarily 4096, so on | ||
10 | such platforms this code will not work correctly | ||
11 | as we'll try to attempt to read an index in the | ||
12 | table that the device never wrote, it always has | ||
13 | 4096-byte pages. | ||
14 | |||
15 | Additionally, the manual alignment code here is | ||
16 | unnecessary -- Documentation/DMA-API-HOWTO.txt | ||
17 | states: | ||
18 | The cpu return address and the DMA bus master address are both | ||
19 | guaranteed to be aligned to the smallest PAGE_SIZE order which | ||
20 | is greater than or equal to the requested size. This invariant | ||
21 | exists (for example) to guarantee that if you allocate a chunk | ||
22 | which is smaller than or equal to 64 kilobytes, the extent of the | ||
23 | buffer you receive will not cross a 64K boundary. | ||
24 | |||
25 | Just use appropriate new constants and get rid of | ||
26 | the alignment code. | ||
27 | |||
28 | Cc: Emmanuel Grumbach <emmanuel.grumbach@intel.com> | ||
29 | Signed-off-by: Johannes Berg <johannes.berg@intel.com> | ||
30 | Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com> | ||
31 | Signed-off-by: John W. Linville <linville@tuxdriver.com> | ||
32 | Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> | ||
33 | --- | ||
34 | drivers/net/wireless/iwlwifi/iwl-trans-pcie-int.h | 2 - | ||
35 | drivers/net/wireless/iwlwifi/iwl-trans-pcie-rx.c | 73 +++++++++------------ | ||
36 | 2 files changed, 31 insertions(+), 44 deletions(-) | ||
37 | |||
38 | diff --git a/drivers/net/wireless/iwlwifi/iwl-trans-pcie-int.h b/drivers/net/wireless/iwlwifi/iwl-trans-pcie-int.h | ||
39 | index 2b6756e..5c29281 100644 | ||
40 | --- a/drivers/net/wireless/iwlwifi/iwl-trans-pcie-int.h | ||
41 | +++ b/drivers/net/wireless/iwlwifi/iwl-trans-pcie-int.h | ||
42 | @@ -219,9 +219,7 @@ struct iwl_trans_pcie { | ||
43 | |||
44 | /* INT ICT Table */ | ||
45 | __le32 *ict_tbl; | ||
46 | - void *ict_tbl_vir; | ||
47 | dma_addr_t ict_tbl_dma; | ||
48 | - dma_addr_t aligned_ict_tbl_dma; | ||
49 | int ict_index; | ||
50 | u32 inta; | ||
51 | bool use_ict; | ||
52 | diff --git a/drivers/net/wireless/iwlwifi/iwl-trans-pcie-rx.c b/drivers/net/wireless/iwlwifi/iwl-trans-pcie-rx.c | ||
53 | index 374c68c..1920237 100644 | ||
54 | --- a/drivers/net/wireless/iwlwifi/iwl-trans-pcie-rx.c | ||
55 | +++ b/drivers/net/wireless/iwlwifi/iwl-trans-pcie-rx.c | ||
56 | @@ -1136,7 +1136,11 @@ void iwl_irq_tasklet(struct iwl_trans *trans) | ||
57 | * ICT functions | ||
58 | * | ||
59 | ******************************************************************************/ | ||
60 | -#define ICT_COUNT (PAGE_SIZE/sizeof(u32)) | ||
61 | + | ||
62 | +/* a device (PCI-E) page is 4096 bytes long */ | ||
63 | +#define ICT_SHIFT 12 | ||
64 | +#define ICT_SIZE (1 << ICT_SHIFT) | ||
65 | +#define ICT_COUNT (ICT_SIZE / sizeof(u32)) | ||
66 | |||
67 | /* Free dram table */ | ||
68 | void iwl_free_isr_ict(struct iwl_trans *trans) | ||
69 | @@ -1144,21 +1148,19 @@ void iwl_free_isr_ict(struct iwl_trans *trans) | ||
70 | struct iwl_trans_pcie *trans_pcie = | ||
71 | IWL_TRANS_GET_PCIE_TRANS(trans); | ||
72 | |||
73 | - if (trans_pcie->ict_tbl_vir) { | ||
74 | - dma_free_coherent(bus(trans)->dev, | ||
75 | - (sizeof(u32) * ICT_COUNT) + PAGE_SIZE, | ||
76 | - trans_pcie->ict_tbl_vir, | ||
77 | + if (trans_pcie->ict_tbl) { | ||
78 | + dma_free_coherent(bus(trans)->dev, ICT_SIZE, | ||
79 | + trans_pcie->ict_tbl, | ||
80 | trans_pcie->ict_tbl_dma); | ||
81 | - trans_pcie->ict_tbl_vir = NULL; | ||
82 | - memset(&trans_pcie->ict_tbl_dma, 0, | ||
83 | - sizeof(trans_pcie->ict_tbl_dma)); | ||
84 | - memset(&trans_pcie->aligned_ict_tbl_dma, 0, | ||
85 | - sizeof(trans_pcie->aligned_ict_tbl_dma)); | ||
86 | + trans_pcie->ict_tbl = NULL; | ||
87 | + trans_pcie->ict_tbl_dma = 0; | ||
88 | } | ||
89 | } | ||
90 | |||
91 | |||
92 | -/* allocate dram shared table it is a PAGE_SIZE aligned | ||
93 | +/* | ||
94 | + * allocate dram shared table, it is an aligned memory | ||
95 | + * block of ICT_SIZE. | ||
96 | * also reset all data related to ICT table interrupt. | ||
97 | */ | ||
98 | int iwl_alloc_isr_ict(struct iwl_trans *trans) | ||
99 | @@ -1166,36 +1168,26 @@ int iwl_alloc_isr_ict(struct iwl_trans *trans) | ||
100 | struct iwl_trans_pcie *trans_pcie = | ||
101 | IWL_TRANS_GET_PCIE_TRANS(trans); | ||
102 | |||
103 | - /* allocate shrared data table */ | ||
104 | - trans_pcie->ict_tbl_vir = | ||
105 | - dma_alloc_coherent(bus(trans)->dev, | ||
106 | - (sizeof(u32) * ICT_COUNT) + PAGE_SIZE, | ||
107 | - &trans_pcie->ict_tbl_dma, GFP_KERNEL); | ||
108 | - if (!trans_pcie->ict_tbl_vir) | ||
109 | + trans_pcie->ict_tbl = | ||
110 | + dma_alloc_coherent(bus(trans)->dev, ICT_SIZE, | ||
111 | + &trans_pcie->ict_tbl_dma, | ||
112 | + GFP_KERNEL); | ||
113 | + if (!trans_pcie->ict_tbl) | ||
114 | return -ENOMEM; | ||
115 | |||
116 | - /* align table to PAGE_SIZE boundary */ | ||
117 | - trans_pcie->aligned_ict_tbl_dma = | ||
118 | - ALIGN(trans_pcie->ict_tbl_dma, PAGE_SIZE); | ||
119 | - | ||
120 | - IWL_DEBUG_ISR(trans, "ict dma addr %Lx dma aligned %Lx diff %d\n", | ||
121 | - (unsigned long long)trans_pcie->ict_tbl_dma, | ||
122 | - (unsigned long long)trans_pcie->aligned_ict_tbl_dma, | ||
123 | - (int)(trans_pcie->aligned_ict_tbl_dma - | ||
124 | - trans_pcie->ict_tbl_dma)); | ||
125 | + /* just an API sanity check ... it is guaranteed to be aligned */ | ||
126 | + if (WARN_ON(trans_pcie->ict_tbl_dma & (ICT_SIZE - 1))) { | ||
127 | + iwl_free_isr_ict(trans); | ||
128 | + return -EINVAL; | ||
129 | + } | ||
130 | |||
131 | - trans_pcie->ict_tbl = trans_pcie->ict_tbl_vir + | ||
132 | - (trans_pcie->aligned_ict_tbl_dma - | ||
133 | - trans_pcie->ict_tbl_dma); | ||
134 | + IWL_DEBUG_ISR(trans, "ict dma addr %Lx\n", | ||
135 | + (unsigned long long)trans_pcie->ict_tbl_dma); | ||
136 | |||
137 | - IWL_DEBUG_ISR(trans, "ict vir addr %p vir aligned %p diff %d\n", | ||
138 | - trans_pcie->ict_tbl, trans_pcie->ict_tbl_vir, | ||
139 | - (int)(trans_pcie->aligned_ict_tbl_dma - | ||
140 | - trans_pcie->ict_tbl_dma)); | ||
141 | + IWL_DEBUG_ISR(trans, "ict vir addr %p\n", trans_pcie->ict_tbl); | ||
142 | |||
143 | /* reset table and index to all 0 */ | ||
144 | - memset(trans_pcie->ict_tbl_vir, 0, | ||
145 | - (sizeof(u32) * ICT_COUNT) + PAGE_SIZE); | ||
146 | + memset(trans_pcie->ict_tbl, 0, ICT_SIZE); | ||
147 | trans_pcie->ict_index = 0; | ||
148 | |||
149 | /* add periodic RX interrupt */ | ||
150 | @@ -1213,23 +1205,20 @@ int iwl_reset_ict(struct iwl_trans *trans) | ||
151 | struct iwl_trans_pcie *trans_pcie = | ||
152 | IWL_TRANS_GET_PCIE_TRANS(trans); | ||
153 | |||
154 | - if (!trans_pcie->ict_tbl_vir) | ||
155 | + if (!trans_pcie->ict_tbl) | ||
156 | return 0; | ||
157 | |||
158 | spin_lock_irqsave(&trans->shrd->lock, flags); | ||
159 | iwl_disable_interrupts(trans); | ||
160 | |||
161 | - memset(&trans_pcie->ict_tbl[0], 0, sizeof(u32) * ICT_COUNT); | ||
162 | + memset(trans_pcie->ict_tbl, 0, ICT_SIZE); | ||
163 | |||
164 | - val = trans_pcie->aligned_ict_tbl_dma >> PAGE_SHIFT; | ||
165 | + val = trans_pcie->ict_tbl_dma >> ICT_SHIFT; | ||
166 | |||
167 | val |= CSR_DRAM_INT_TBL_ENABLE; | ||
168 | val |= CSR_DRAM_INIT_TBL_WRAP_CHECK; | ||
169 | |||
170 | - IWL_DEBUG_ISR(trans, "CSR_DRAM_INT_TBL_REG =0x%X " | ||
171 | - "aligned dma address %Lx\n", | ||
172 | - val, | ||
173 | - (unsigned long long)trans_pcie->aligned_ict_tbl_dma); | ||
174 | + IWL_DEBUG_ISR(trans, "CSR_DRAM_INT_TBL_REG =0x%x\n", val); | ||
175 | |||
176 | iwl_write32(bus(trans), CSR_DRAM_INT_TBL_REG, val); | ||
177 | trans_pcie->use_ict = true; | ||
178 | -- | ||
179 | 1.7.7.4 | ||
180 | |||
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0018-perf-Fix-parsing-of-__print_flags-in-TP_printk.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0018-perf-Fix-parsing-of-__print_flags-in-TP_printk.patch new file mode 100644 index 00000000..96e1c791 --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0018-perf-Fix-parsing-of-__print_flags-in-TP_printk.patch | |||
@@ -0,0 +1,37 @@ | |||
1 | From 3d69705bbc0503baa930a277c3570ccdc2b82ac1 Mon Sep 17 00:00:00 2001 | ||
2 | From: Steven Rostedt <srostedt@redhat.com> | ||
3 | Date: Fri, 4 Nov 2011 16:32:25 -0400 | ||
4 | Subject: [PATCH 18/49] perf: Fix parsing of __print_flags() in TP_printk() | ||
5 | |||
6 | commit 49908a1b25d448d68fd26faca260e1850201575f upstream. | ||
7 | |||
8 | A update is made to the sched:sched_switch event that adds some | ||
9 | logic to the first parameter of the __print_flags() that shows the | ||
10 | state of tasks. This change cause perf to fail parsing the flags. | ||
11 | |||
12 | A simple fix is needed to have the parser be able to process ops | ||
13 | within the argument. | ||
14 | |||
15 | Reported-by: Andrew Vagin <avagin@openvz.org> | ||
16 | Signed-off-by: Steven Rostedt <rostedt@goodmis.org> | ||
17 | Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> | ||
18 | --- | ||
19 | tools/perf/util/trace-event-parse.c | 2 ++ | ||
20 | 1 files changed, 2 insertions(+), 0 deletions(-) | ||
21 | |||
22 | diff --git a/tools/perf/util/trace-event-parse.c b/tools/perf/util/trace-event-parse.c | ||
23 | index 6c164dc..bf54c48 100644 | ||
24 | --- a/tools/perf/util/trace-event-parse.c | ||
25 | +++ b/tools/perf/util/trace-event-parse.c | ||
26 | @@ -1582,6 +1582,8 @@ process_symbols(struct event *event, struct print_arg *arg, char **tok) | ||
27 | field = malloc_or_die(sizeof(*field)); | ||
28 | |||
29 | type = process_arg(event, field, &token); | ||
30 | + while (type == EVENT_OP) | ||
31 | + type = process_op(event, field, &token); | ||
32 | if (test_type_token(type, token, EVENT_DELIM, ",")) | ||
33 | goto out_free; | ||
34 | |||
35 | -- | ||
36 | 1.7.7.4 | ||
37 | |||
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0019-ore-Fix-crash-in-case-of-an-IO-error.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0019-ore-Fix-crash-in-case-of-an-IO-error.patch new file mode 100644 index 00000000..903491af --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0019-ore-Fix-crash-in-case-of-an-IO-error.patch | |||
@@ -0,0 +1,41 @@ | |||
1 | From b892a813649b593177f4b36c200691ec7b610af7 Mon Sep 17 00:00:00 2001 | ||
2 | From: Boaz Harrosh <bharrosh@panasas.com> | ||
3 | Date: Tue, 27 Dec 2011 19:23:36 +0200 | ||
4 | Subject: [PATCH 19/49] ore: Fix crash in case of an IO error. | ||
5 | |||
6 | commit ffefb8eaa367e8a5c14f779233d9da1fbc23d164 upstream. | ||
7 | |||
8 | The users of ore_check_io() expect the reported device | ||
9 | (In case of error) to be indexed relative to the passed-in | ||
10 | ore_components table, and not the logical dev index. | ||
11 | |||
12 | This causes a crash inside objlayoutdriver in case of | ||
13 | an IO error. | ||
14 | |||
15 | Signed-off-by: Boaz Harrosh <bharrosh@panasas.com> | ||
16 | Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> | ||
17 | --- | ||
18 | fs/exofs/ore.c | 6 +++--- | ||
19 | 1 files changed, 3 insertions(+), 3 deletions(-) | ||
20 | |||
21 | diff --git a/fs/exofs/ore.c b/fs/exofs/ore.c | ||
22 | index d271ad8..894f3e1 100644 | ||
23 | --- a/fs/exofs/ore.c | ||
24 | +++ b/fs/exofs/ore.c | ||
25 | @@ -445,10 +445,10 @@ int ore_check_io(struct ore_io_state *ios, ore_on_dev_error on_dev_error) | ||
26 | u64 residual = ios->reading ? | ||
27 | or->in.residual : or->out.residual; | ||
28 | u64 offset = (ios->offset + ios->length) - residual; | ||
29 | - struct ore_dev *od = ios->oc->ods[ | ||
30 | - per_dev->dev - ios->oc->first_dev]; | ||
31 | + unsigned dev = per_dev->dev - ios->oc->first_dev; | ||
32 | + struct ore_dev *od = ios->oc->ods[dev]; | ||
33 | |||
34 | - on_dev_error(ios, od, per_dev->dev, osi.osd_err_pri, | ||
35 | + on_dev_error(ios, od, dev, osi.osd_err_pri, | ||
36 | offset, residual); | ||
37 | } | ||
38 | if (osi.osd_err_pri >= acumulated_osd_err) { | ||
39 | -- | ||
40 | 1.7.7.4 | ||
41 | |||
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0020-ore-fix-BUG_ON-too-few-sgs-when-reading.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0020-ore-fix-BUG_ON-too-few-sgs-when-reading.patch new file mode 100644 index 00000000..76fe4bf5 --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0020-ore-fix-BUG_ON-too-few-sgs-when-reading.patch | |||
@@ -0,0 +1,56 @@ | |||
1 | From 3c8f1a35fab7418f9afeda2618992c1fd5504475 Mon Sep 17 00:00:00 2001 | ||
2 | From: Boaz Harrosh <bharrosh@panasas.com> | ||
3 | Date: Wed, 28 Dec 2011 19:14:23 +0200 | ||
4 | Subject: [PATCH 20/49] ore: fix BUG_ON, too few sgs when reading | ||
5 | |||
6 | commit 361aba569f55dd159b850489a3538253afbb3973 upstream. | ||
7 | |||
8 | When reading RAID5 files, in rare cases, we calculated too | ||
9 | few sg segments. There should be two extra for the beginning | ||
10 | and end partial units. | ||
11 | |||
12 | Also "too few sg segments" should not be a BUG_ON there is | ||
13 | all the mechanics in place to handle it, as a short read. | ||
14 | So just return -ENOMEM and the rest of the code will gracefully | ||
15 | split the IO. | ||
16 | |||
17 | Signed-off-by: Boaz Harrosh <bharrosh@panasas.com> | ||
18 | Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> | ||
19 | --- | ||
20 | fs/exofs/ore.c | 2 +- | ||
21 | fs/exofs/ore_raid.c | 6 +++++- | ||
22 | 2 files changed, 6 insertions(+), 2 deletions(-) | ||
23 | |||
24 | diff --git a/fs/exofs/ore.c b/fs/exofs/ore.c | ||
25 | index 894f3e1..49cf230 100644 | ||
26 | --- a/fs/exofs/ore.c | ||
27 | +++ b/fs/exofs/ore.c | ||
28 | @@ -266,7 +266,7 @@ int ore_get_rw_state(struct ore_layout *layout, struct ore_components *oc, | ||
29 | |||
30 | /* first/last seg is split */ | ||
31 | num_raid_units += layout->group_width; | ||
32 | - sgs_per_dev = div_u64(num_raid_units, data_devs); | ||
33 | + sgs_per_dev = div_u64(num_raid_units, data_devs) + 2; | ||
34 | } else { | ||
35 | /* For Writes add parity pages array. */ | ||
36 | max_par_pages = num_raid_units * pages_in_unit * | ||
37 | diff --git a/fs/exofs/ore_raid.c b/fs/exofs/ore_raid.c | ||
38 | index 29c47e5..414a2df 100644 | ||
39 | --- a/fs/exofs/ore_raid.c | ||
40 | +++ b/fs/exofs/ore_raid.c | ||
41 | @@ -551,7 +551,11 @@ int _ore_add_parity_unit(struct ore_io_state *ios, | ||
42 | unsigned cur_len) | ||
43 | { | ||
44 | if (ios->reading) { | ||
45 | - BUG_ON(per_dev->cur_sg >= ios->sgs_per_dev); | ||
46 | + if (per_dev->cur_sg >= ios->sgs_per_dev) { | ||
47 | + ORE_DBGMSG("cur_sg(%d) >= sgs_per_dev(%d)\n" , | ||
48 | + per_dev->cur_sg, ios->sgs_per_dev); | ||
49 | + return -ENOMEM; | ||
50 | + } | ||
51 | _ore_add_sg_seg(per_dev, cur_len, true); | ||
52 | } else { | ||
53 | struct __stripe_pages_2d *sp2d = ios->sp2d; | ||
54 | -- | ||
55 | 1.7.7.4 | ||
56 | |||
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0021-ore-Must-support-none-PAGE-aligned-IO.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0021-ore-Must-support-none-PAGE-aligned-IO.patch new file mode 100644 index 00000000..94fe29ed --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0021-ore-Must-support-none-PAGE-aligned-IO.patch | |||
@@ -0,0 +1,163 @@ | |||
1 | From f3db3efc229dac1097a71b9d793d61aefb033ac2 Mon Sep 17 00:00:00 2001 | ||
2 | From: Boaz Harrosh <bharrosh@panasas.com> | ||
3 | Date: Wed, 28 Dec 2011 19:21:45 +0200 | ||
4 | Subject: [PATCH 21/49] ore: Must support none-PAGE-aligned IO | ||
5 | |||
6 | commit 724577ca355795b0a25c93ccbeee927871ca1a77 upstream. | ||
7 | |||
8 | NFS might send us offsets that are not PAGE aligned. So | ||
9 | we must read in the reminder of the first/last pages, in cases | ||
10 | we need it for Parity calculations. | ||
11 | |||
12 | We only add an sg segments to read the partial page. But | ||
13 | we don't mark it as read=true because it is a lock-for-write | ||
14 | page. | ||
15 | |||
16 | TODO: In some cases (IO spans a single unit) we can just | ||
17 | adjust the raid_unit offset/length, but this is left for | ||
18 | later Kernels. | ||
19 | |||
20 | Signed-off-by: Boaz Harrosh <bharrosh@panasas.com> | ||
21 | Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> | ||
22 | --- | ||
23 | fs/exofs/ore_raid.c | 72 ++++++++++++++++++++++++++++++++++++++++++-------- | ||
24 | 1 files changed, 60 insertions(+), 12 deletions(-) | ||
25 | |||
26 | diff --git a/fs/exofs/ore_raid.c b/fs/exofs/ore_raid.c | ||
27 | index 414a2df..d222c77 100644 | ||
28 | --- a/fs/exofs/ore_raid.c | ||
29 | +++ b/fs/exofs/ore_raid.c | ||
30 | @@ -328,8 +328,8 @@ static int _alloc_read_4_write(struct ore_io_state *ios) | ||
31 | /* @si contains info of the to-be-inserted page. Update of @si should be | ||
32 | * maintained by caller. Specificaly si->dev, si->obj_offset, ... | ||
33 | */ | ||
34 | -static int _add_to_read_4_write(struct ore_io_state *ios, | ||
35 | - struct ore_striping_info *si, struct page *page) | ||
36 | +static int _add_to_r4w(struct ore_io_state *ios, struct ore_striping_info *si, | ||
37 | + struct page *page, unsigned pg_len) | ||
38 | { | ||
39 | struct request_queue *q; | ||
40 | struct ore_per_dev_state *per_dev; | ||
41 | @@ -366,17 +366,60 @@ static int _add_to_read_4_write(struct ore_io_state *ios, | ||
42 | _ore_add_sg_seg(per_dev, gap, true); | ||
43 | } | ||
44 | q = osd_request_queue(ore_comp_dev(read_ios->oc, per_dev->dev)); | ||
45 | - added_len = bio_add_pc_page(q, per_dev->bio, page, PAGE_SIZE, 0); | ||
46 | - if (unlikely(added_len != PAGE_SIZE)) { | ||
47 | + added_len = bio_add_pc_page(q, per_dev->bio, page, pg_len, | ||
48 | + si->obj_offset % PAGE_SIZE); | ||
49 | + if (unlikely(added_len != pg_len)) { | ||
50 | ORE_DBGMSG("Failed to bio_add_pc_page bi_vcnt=%d\n", | ||
51 | per_dev->bio->bi_vcnt); | ||
52 | return -ENOMEM; | ||
53 | } | ||
54 | |||
55 | - per_dev->length += PAGE_SIZE; | ||
56 | + per_dev->length += pg_len; | ||
57 | return 0; | ||
58 | } | ||
59 | |||
60 | +/* read the beginning of an unaligned first page */ | ||
61 | +static int _add_to_r4w_first_page(struct ore_io_state *ios, struct page *page) | ||
62 | +{ | ||
63 | + struct ore_striping_info si; | ||
64 | + unsigned pg_len; | ||
65 | + | ||
66 | + ore_calc_stripe_info(ios->layout, ios->offset, 0, &si); | ||
67 | + | ||
68 | + pg_len = si.obj_offset % PAGE_SIZE; | ||
69 | + si.obj_offset -= pg_len; | ||
70 | + | ||
71 | + ORE_DBGMSG("offset=0x%llx len=0x%x index=0x%lx dev=%x\n", | ||
72 | + _LLU(si.obj_offset), pg_len, page->index, si.dev); | ||
73 | + | ||
74 | + return _add_to_r4w(ios, &si, page, pg_len); | ||
75 | +} | ||
76 | + | ||
77 | +/* read the end of an incomplete last page */ | ||
78 | +static int _add_to_r4w_last_page(struct ore_io_state *ios, u64 *offset) | ||
79 | +{ | ||
80 | + struct ore_striping_info si; | ||
81 | + struct page *page; | ||
82 | + unsigned pg_len, p, c; | ||
83 | + | ||
84 | + ore_calc_stripe_info(ios->layout, *offset, 0, &si); | ||
85 | + | ||
86 | + p = si.unit_off / PAGE_SIZE; | ||
87 | + c = _dev_order(ios->layout->group_width * ios->layout->mirrors_p1, | ||
88 | + ios->layout->mirrors_p1, si.par_dev, si.dev); | ||
89 | + page = ios->sp2d->_1p_stripes[p].pages[c]; | ||
90 | + | ||
91 | + pg_len = PAGE_SIZE - (si.unit_off % PAGE_SIZE); | ||
92 | + *offset += pg_len; | ||
93 | + | ||
94 | + ORE_DBGMSG("p=%d, c=%d next-offset=0x%llx len=0x%x dev=%x par_dev=%d\n", | ||
95 | + p, c, _LLU(*offset), pg_len, si.dev, si.par_dev); | ||
96 | + | ||
97 | + BUG_ON(!page); | ||
98 | + | ||
99 | + return _add_to_r4w(ios, &si, page, pg_len); | ||
100 | +} | ||
101 | + | ||
102 | static void _mark_read4write_pages_uptodate(struct ore_io_state *ios, int ret) | ||
103 | { | ||
104 | struct bio_vec *bv; | ||
105 | @@ -444,9 +487,13 @@ static int _read_4_write(struct ore_io_state *ios) | ||
106 | struct page **pp = &_1ps->pages[c]; | ||
107 | bool uptodate; | ||
108 | |||
109 | - if (*pp) | ||
110 | + if (*pp) { | ||
111 | + if (ios->offset % PAGE_SIZE) | ||
112 | + /* Read the remainder of the page */ | ||
113 | + _add_to_r4w_first_page(ios, *pp); | ||
114 | /* to-be-written pages start here */ | ||
115 | goto read_last_stripe; | ||
116 | + } | ||
117 | |||
118 | *pp = ios->r4w->get_page(ios->private, offset, | ||
119 | &uptodate); | ||
120 | @@ -454,7 +501,7 @@ static int _read_4_write(struct ore_io_state *ios) | ||
121 | return -ENOMEM; | ||
122 | |||
123 | if (!uptodate) | ||
124 | - _add_to_read_4_write(ios, &read_si, *pp); | ||
125 | + _add_to_r4w(ios, &read_si, *pp, PAGE_SIZE); | ||
126 | |||
127 | /* Mark read-pages to be cache_released */ | ||
128 | _1ps->page_is_read[c] = true; | ||
129 | @@ -465,8 +512,11 @@ static int _read_4_write(struct ore_io_state *ios) | ||
130 | } | ||
131 | |||
132 | read_last_stripe: | ||
133 | - offset = ios->offset + (ios->length + PAGE_SIZE - 1) / | ||
134 | - PAGE_SIZE * PAGE_SIZE; | ||
135 | + offset = ios->offset + ios->length; | ||
136 | + if (offset % PAGE_SIZE) | ||
137 | + _add_to_r4w_last_page(ios, &offset); | ||
138 | + /* offset will be aligned to next page */ | ||
139 | + | ||
140 | last_stripe_end = div_u64(offset + bytes_in_stripe - 1, bytes_in_stripe) | ||
141 | * bytes_in_stripe; | ||
142 | if (offset == last_stripe_end) /* Optimize for the aligned case */ | ||
143 | @@ -503,7 +553,7 @@ read_last_stripe: | ||
144 | /* Mark read-pages to be cache_released */ | ||
145 | _1ps->page_is_read[c] = true; | ||
146 | if (!uptodate) | ||
147 | - _add_to_read_4_write(ios, &read_si, page); | ||
148 | + _add_to_r4w(ios, &read_si, page, PAGE_SIZE); | ||
149 | } | ||
150 | |||
151 | offset += PAGE_SIZE; | ||
152 | @@ -616,8 +666,6 @@ int _ore_post_alloc_raid_stuff(struct ore_io_state *ios) | ||
153 | return -ENOMEM; | ||
154 | } | ||
155 | |||
156 | - BUG_ON(ios->offset % PAGE_SIZE); | ||
157 | - | ||
158 | /* Round io down to last full strip */ | ||
159 | first_stripe = div_u64(ios->offset, stripe_size); | ||
160 | last_stripe = div_u64(ios->offset + ios->length, stripe_size); | ||
161 | -- | ||
162 | 1.7.7.4 | ||
163 | |||
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0022-ore-FIX-breakage-when-MISC_FILESYSTEMS-is-not-set.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0022-ore-FIX-breakage-when-MISC_FILESYSTEMS-is-not-set.patch new file mode 100644 index 00000000..a55cd86b --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0022-ore-FIX-breakage-when-MISC_FILESYSTEMS-is-not-set.patch | |||
@@ -0,0 +1,89 @@ | |||
1 | From db0889eb6584510c3e1d860bfcfc7a85efc6fabe Mon Sep 17 00:00:00 2001 | ||
2 | From: Boaz Harrosh <bharrosh@panasas.com> | ||
3 | Date: Tue, 29 Nov 2011 15:35:53 -0800 | ||
4 | Subject: [PATCH 22/49] ore: FIX breakage when MISC_FILESYSTEMS is not set | ||
5 | |||
6 | commit 831c2dc5f47c1dc79c32229d75065ada1dcc66e1 upstream. | ||
7 | |||
8 | As Reported by Randy Dunlap | ||
9 | |||
10 | When MISC_FILESYSTEMS is not enabled and NFS4.1 is: | ||
11 | |||
12 | fs/built-in.o: In function `objio_alloc_io_state': | ||
13 | objio_osd.c:(.text+0xcb525): undefined reference to `ore_get_rw_state' | ||
14 | fs/built-in.o: In function `_write_done': | ||
15 | objio_osd.c:(.text+0xcb58d): undefined reference to `ore_check_io' | ||
16 | fs/built-in.o: In function `_read_done': | ||
17 | ... | ||
18 | |||
19 | When MISC_FILESYSTEMS, which is more of a GUI thing then anything else, | ||
20 | is not selected. exofs/Kconfig is never examined during Kconfig, | ||
21 | and it can not do it's magic stuff to automatically select everything | ||
22 | needed. | ||
23 | |||
24 | We must split exofs/Kconfig in two. The ore one is always included. | ||
25 | And the exofs one is left in it's old place in the menu. | ||
26 | |||
27 | Reported-by: Randy Dunlap <rdunlap@xenotime.net> | ||
28 | Signed-off-by: Boaz Harrosh <bharrosh@panasas.com> | ||
29 | Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> | ||
30 | --- | ||
31 | fs/Kconfig | 2 ++ | ||
32 | fs/exofs/Kconfig | 11 ----------- | ||
33 | fs/exofs/Kconfig.ore | 12 ++++++++++++ | ||
34 | 3 files changed, 14 insertions(+), 11 deletions(-) | ||
35 | create mode 100644 fs/exofs/Kconfig.ore | ||
36 | |||
37 | diff --git a/fs/Kconfig b/fs/Kconfig | ||
38 | index 5f4c45d..6ad58a5 100644 | ||
39 | --- a/fs/Kconfig | ||
40 | +++ b/fs/Kconfig | ||
41 | @@ -218,6 +218,8 @@ source "fs/exofs/Kconfig" | ||
42 | |||
43 | endif # MISC_FILESYSTEMS | ||
44 | |||
45 | +source "fs/exofs/Kconfig.ore" | ||
46 | + | ||
47 | menuconfig NETWORK_FILESYSTEMS | ||
48 | bool "Network File Systems" | ||
49 | default y | ||
50 | diff --git a/fs/exofs/Kconfig b/fs/exofs/Kconfig | ||
51 | index da42f32..86194b2 100644 | ||
52 | --- a/fs/exofs/Kconfig | ||
53 | +++ b/fs/exofs/Kconfig | ||
54 | @@ -1,14 +1,3 @@ | ||
55 | -# Note ORE needs to "select ASYNC_XOR". So Not to force multiple selects | ||
56 | -# for every ORE user we do it like this. Any user should add itself here | ||
57 | -# at the "depends on EXOFS_FS || ..." with an ||. The dependencies are | ||
58 | -# selected here, and we default to "ON". So in effect it is like been | ||
59 | -# selected by any of the users. | ||
60 | -config ORE | ||
61 | - tristate | ||
62 | - depends on EXOFS_FS || PNFS_OBJLAYOUT | ||
63 | - select ASYNC_XOR | ||
64 | - default SCSI_OSD_ULD | ||
65 | - | ||
66 | config EXOFS_FS | ||
67 | tristate "exofs: OSD based file system support" | ||
68 | depends on SCSI_OSD_ULD | ||
69 | diff --git a/fs/exofs/Kconfig.ore b/fs/exofs/Kconfig.ore | ||
70 | new file mode 100644 | ||
71 | index 0000000..1ca7fb7 | ||
72 | --- /dev/null | ||
73 | +++ b/fs/exofs/Kconfig.ore | ||
74 | @@ -0,0 +1,12 @@ | ||
75 | +# ORE - Objects Raid Engine (libore.ko) | ||
76 | +# | ||
77 | +# Note ORE needs to "select ASYNC_XOR". So Not to force multiple selects | ||
78 | +# for every ORE user we do it like this. Any user should add itself here | ||
79 | +# at the "depends on EXOFS_FS || ..." with an ||. The dependencies are | ||
80 | +# selected here, and we default to "ON". So in effect it is like been | ||
81 | +# selected by any of the users. | ||
82 | +config ORE | ||
83 | + tristate | ||
84 | + depends on EXOFS_FS || PNFS_OBJLAYOUT | ||
85 | + select ASYNC_XOR | ||
86 | + default SCSI_OSD_ULD | ||
87 | -- | ||
88 | 1.7.7.4 | ||
89 | |||
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0023-reiserfs-Fix-quota-mount-option-parsing.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0023-reiserfs-Fix-quota-mount-option-parsing.patch new file mode 100644 index 00000000..01215798 --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0023-reiserfs-Fix-quota-mount-option-parsing.patch | |||
@@ -0,0 +1,34 @@ | |||
1 | From 914681dc085b7bdeae0de64fba94532a6bcd093e Mon Sep 17 00:00:00 2001 | ||
2 | From: Jan Kara <jack@suse.cz> | ||
3 | Date: Wed, 21 Dec 2011 17:35:34 +0100 | ||
4 | Subject: [PATCH 23/49] reiserfs: Fix quota mount option parsing | ||
5 | |||
6 | commit a06d789b424190e9f59da391681f908486db2554 upstream. | ||
7 | |||
8 | When jqfmt mount option is not specified on remount, we mistakenly clear | ||
9 | s_jquota_fmt value stored in superblock. Fix the problem. | ||
10 | |||
11 | CC: reiserfs-devel@vger.kernel.org | ||
12 | Signed-off-by: Jan Kara <jack@suse.cz> | ||
13 | Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> | ||
14 | --- | ||
15 | fs/reiserfs/super.c | 3 ++- | ||
16 | 1 files changed, 2 insertions(+), 1 deletions(-) | ||
17 | |||
18 | diff --git a/fs/reiserfs/super.c b/fs/reiserfs/super.c | ||
19 | index 14363b9..f9eaa4a 100644 | ||
20 | --- a/fs/reiserfs/super.c | ||
21 | +++ b/fs/reiserfs/super.c | ||
22 | @@ -1164,7 +1164,8 @@ static void handle_quota_files(struct super_block *s, char **qf_names, | ||
23 | kfree(REISERFS_SB(s)->s_qf_names[i]); | ||
24 | REISERFS_SB(s)->s_qf_names[i] = qf_names[i]; | ||
25 | } | ||
26 | - REISERFS_SB(s)->s_jquota_fmt = *qfmt; | ||
27 | + if (*qfmt) | ||
28 | + REISERFS_SB(s)->s_jquota_fmt = *qfmt; | ||
29 | } | ||
30 | #endif | ||
31 | |||
32 | -- | ||
33 | 1.7.7.4 | ||
34 | |||
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0024-reiserfs-Force-inode-evictions-before-umount-to-avoi.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0024-reiserfs-Force-inode-evictions-before-umount-to-avoi.patch new file mode 100644 index 00000000..32475f91 --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0024-reiserfs-Force-inode-evictions-before-umount-to-avoi.patch | |||
@@ -0,0 +1,70 @@ | |||
1 | From 0621050323cd3eef6fe27f168151e8823a6f63dd Mon Sep 17 00:00:00 2001 | ||
2 | From: Jeff Mahoney <jeffm@suse.com> | ||
3 | Date: Wed, 21 Dec 2011 21:18:43 +0100 | ||
4 | Subject: [PATCH 24/49] reiserfs: Force inode evictions before umount to avoid | ||
5 | crash | ||
6 | |||
7 | commit a9e36da655e54545c3289b2a0700b5c443de0edd upstream. | ||
8 | |||
9 | This patch fixes a crash in reiserfs_delete_xattrs during umount. | ||
10 | |||
11 | When shrink_dcache_for_umount clears the dcache from | ||
12 | generic_shutdown_super, delayed evictions are forced to disk. If an | ||
13 | evicted inode has extended attributes associated with it, it will | ||
14 | need to walk the xattr tree to locate and remove them. | ||
15 | |||
16 | But since shrink_dcache_for_umount will BUG if it encounters active | ||
17 | dentries, the xattr tree must be released before it's called or it will | ||
18 | crash during every umount. | ||
19 | |||
20 | This patch forces the evictions to occur before generic_shutdown_super | ||
21 | by calling shrink_dcache_sb first. The additional evictions caused | ||
22 | by the removal of each associated xattr file and dir will be automatically | ||
23 | handled as they're added to the LRU list. | ||
24 | |||
25 | CC: reiserfs-devel@vger.kernel.org | ||
26 | Signed-off-by: Jeff Mahoney <jeffm@suse.com> | ||
27 | Signed-off-by: Jan Kara <jack@suse.cz> | ||
28 | Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> | ||
29 | --- | ||
30 | fs/reiserfs/super.c | 24 ++++++++++++++---------- | ||
31 | 1 files changed, 14 insertions(+), 10 deletions(-) | ||
32 | |||
33 | diff --git a/fs/reiserfs/super.c b/fs/reiserfs/super.c | ||
34 | index f9eaa4a..5e3527b 100644 | ||
35 | --- a/fs/reiserfs/super.c | ||
36 | +++ b/fs/reiserfs/super.c | ||
37 | @@ -453,16 +453,20 @@ int remove_save_link(struct inode *inode, int truncate) | ||
38 | static void reiserfs_kill_sb(struct super_block *s) | ||
39 | { | ||
40 | if (REISERFS_SB(s)) { | ||
41 | - if (REISERFS_SB(s)->xattr_root) { | ||
42 | - d_invalidate(REISERFS_SB(s)->xattr_root); | ||
43 | - dput(REISERFS_SB(s)->xattr_root); | ||
44 | - REISERFS_SB(s)->xattr_root = NULL; | ||
45 | - } | ||
46 | - if (REISERFS_SB(s)->priv_root) { | ||
47 | - d_invalidate(REISERFS_SB(s)->priv_root); | ||
48 | - dput(REISERFS_SB(s)->priv_root); | ||
49 | - REISERFS_SB(s)->priv_root = NULL; | ||
50 | - } | ||
51 | + /* | ||
52 | + * Force any pending inode evictions to occur now. Any | ||
53 | + * inodes to be removed that have extended attributes | ||
54 | + * associated with them need to clean them up before | ||
55 | + * we can release the extended attribute root dentries. | ||
56 | + * shrink_dcache_for_umount will BUG if we don't release | ||
57 | + * those before it's called so ->put_super is too late. | ||
58 | + */ | ||
59 | + shrink_dcache_sb(s); | ||
60 | + | ||
61 | + dput(REISERFS_SB(s)->xattr_root); | ||
62 | + REISERFS_SB(s)->xattr_root = NULL; | ||
63 | + dput(REISERFS_SB(s)->priv_root); | ||
64 | + REISERFS_SB(s)->priv_root = NULL; | ||
65 | } | ||
66 | |||
67 | kill_block_super(s); | ||
68 | -- | ||
69 | 1.7.7.4 | ||
70 | |||
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0025-ext3-Don-t-warn-from-writepage-when-readonly-inode-i.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0025-ext3-Don-t-warn-from-writepage-when-readonly-inode-i.patch new file mode 100644 index 00000000..5a040171 --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0025-ext3-Don-t-warn-from-writepage-when-readonly-inode-i.patch | |||
@@ -0,0 +1,73 @@ | |||
1 | From d6bc098d6daabceca79a299bfe95dfe218661423 Mon Sep 17 00:00:00 2001 | ||
2 | From: Jan Kara <jack@suse.cz> | ||
3 | Date: Thu, 22 Dec 2011 16:49:05 +0100 | ||
4 | Subject: [PATCH 25/49] ext3: Don't warn from writepage when readonly inode is | ||
5 | spotted after error | ||
6 | |||
7 | commit 33c104d415e92a51aaf638dc3d93920cfa601e5c upstream. | ||
8 | |||
9 | WARN_ON_ONCE(IS_RDONLY(inode)) tends to trip when filesystem hits error and is | ||
10 | remounted read-only. This unnecessarily scares users (well, they should be | ||
11 | scared because of filesystem error, but the stack trace distracts them from the | ||
12 | right source of their fear ;-). We could as well just remove the WARN_ON but | ||
13 | it's not hard to fix it to not trip on filesystem with errors and not use more | ||
14 | cycles in the common case so that's what we do. | ||
15 | |||
16 | Signed-off-by: Jan Kara <jack@suse.cz> | ||
17 | Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> | ||
18 | --- | ||
19 | fs/ext3/inode.c | 24 +++++++++++++++++++++--- | ||
20 | 1 files changed, 21 insertions(+), 3 deletions(-) | ||
21 | |||
22 | diff --git a/fs/ext3/inode.c b/fs/ext3/inode.c | ||
23 | index 85fe655..5b3f907 100644 | ||
24 | --- a/fs/ext3/inode.c | ||
25 | +++ b/fs/ext3/inode.c | ||
26 | @@ -1617,7 +1617,13 @@ static int ext3_ordered_writepage(struct page *page, | ||
27 | int err; | ||
28 | |||
29 | J_ASSERT(PageLocked(page)); | ||
30 | - WARN_ON_ONCE(IS_RDONLY(inode)); | ||
31 | + /* | ||
32 | + * We don't want to warn for emergency remount. The condition is | ||
33 | + * ordered to avoid dereferencing inode->i_sb in non-error case to | ||
34 | + * avoid slow-downs. | ||
35 | + */ | ||
36 | + WARN_ON_ONCE(IS_RDONLY(inode) && | ||
37 | + !(EXT3_SB(inode->i_sb)->s_mount_state & EXT3_ERROR_FS)); | ||
38 | |||
39 | /* | ||
40 | * We give up here if we're reentered, because it might be for a | ||
41 | @@ -1692,7 +1698,13 @@ static int ext3_writeback_writepage(struct page *page, | ||
42 | int err; | ||
43 | |||
44 | J_ASSERT(PageLocked(page)); | ||
45 | - WARN_ON_ONCE(IS_RDONLY(inode)); | ||
46 | + /* | ||
47 | + * We don't want to warn for emergency remount. The condition is | ||
48 | + * ordered to avoid dereferencing inode->i_sb in non-error case to | ||
49 | + * avoid slow-downs. | ||
50 | + */ | ||
51 | + WARN_ON_ONCE(IS_RDONLY(inode) && | ||
52 | + !(EXT3_SB(inode->i_sb)->s_mount_state & EXT3_ERROR_FS)); | ||
53 | |||
54 | if (ext3_journal_current_handle()) | ||
55 | goto out_fail; | ||
56 | @@ -1735,7 +1747,13 @@ static int ext3_journalled_writepage(struct page *page, | ||
57 | int err; | ||
58 | |||
59 | J_ASSERT(PageLocked(page)); | ||
60 | - WARN_ON_ONCE(IS_RDONLY(inode)); | ||
61 | + /* | ||
62 | + * We don't want to warn for emergency remount. The condition is | ||
63 | + * ordered to avoid dereferencing inode->i_sb in non-error case to | ||
64 | + * avoid slow-downs. | ||
65 | + */ | ||
66 | + WARN_ON_ONCE(IS_RDONLY(inode) && | ||
67 | + !(EXT3_SB(inode->i_sb)->s_mount_state & EXT3_ERROR_FS)); | ||
68 | |||
69 | if (ext3_journal_current_handle()) | ||
70 | goto no_write; | ||
71 | -- | ||
72 | 1.7.7.4 | ||
73 | |||
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0026-drivers-hv-Don-t-OOPS-when-you-cannot-init-vmbus.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0026-drivers-hv-Don-t-OOPS-when-you-cannot-init-vmbus.patch new file mode 100644 index 00000000..98dedab1 --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0026-drivers-hv-Don-t-OOPS-when-you-cannot-init-vmbus.patch | |||
@@ -0,0 +1,70 @@ | |||
1 | From b9e6c637b69ffe81b7f272f433f18e3cd2f58052 Mon Sep 17 00:00:00 2001 | ||
2 | From: "K. Y. Srinivasan" <kys@microsoft.com> | ||
3 | Date: Thu, 1 Dec 2011 09:59:34 -0800 | ||
4 | Subject: [PATCH 26/49] drivers: hv: Don't OOPS when you cannot init vmbus | ||
5 | |||
6 | commit cf6a2eacbcb2593b5b91d0817915c4f0464bb534 upstream. | ||
7 | |||
8 | The hv vmbus driver was causing an OOPS since it was trying to register drivers | ||
9 | on top of the bus even if initialization of the bus has failed for some | ||
10 | reason (such as the odd chance someone would run a hv enabled kernel in a | ||
11 | non-hv environment). | ||
12 | |||
13 | Signed-off-by: Sasha Levin <levinsasha928@gmail.com> | ||
14 | Signed-off-by: K. Y. Srinivasan <kys@microsoft.com> | ||
15 | Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> | ||
16 | --- | ||
17 | drivers/hv/vmbus_drv.c | 16 ++++++++++++++++ | ||
18 | 1 files changed, 16 insertions(+), 0 deletions(-) | ||
19 | |||
20 | diff --git a/drivers/hv/vmbus_drv.c b/drivers/hv/vmbus_drv.c | ||
21 | index 0c048dd..d3b0b4f 100644 | ||
22 | --- a/drivers/hv/vmbus_drv.c | ||
23 | +++ b/drivers/hv/vmbus_drv.c | ||
24 | @@ -62,6 +62,14 @@ struct hv_device_info { | ||
25 | struct hv_dev_port_info outbound; | ||
26 | }; | ||
27 | |||
28 | +static int vmbus_exists(void) | ||
29 | +{ | ||
30 | + if (hv_acpi_dev == NULL) | ||
31 | + return -ENODEV; | ||
32 | + | ||
33 | + return 0; | ||
34 | +} | ||
35 | + | ||
36 | |||
37 | static void get_channel_info(struct hv_device *device, | ||
38 | struct hv_device_info *info) | ||
39 | @@ -590,6 +598,10 @@ int __vmbus_driver_register(struct hv_driver *hv_driver, struct module *owner, c | ||
40 | |||
41 | pr_info("registering driver %s\n", hv_driver->name); | ||
42 | |||
43 | + ret = vmbus_exists(); | ||
44 | + if (ret < 0) | ||
45 | + return ret; | ||
46 | + | ||
47 | hv_driver->driver.name = hv_driver->name; | ||
48 | hv_driver->driver.owner = owner; | ||
49 | hv_driver->driver.mod_name = mod_name; | ||
50 | @@ -614,6 +626,9 @@ void vmbus_driver_unregister(struct hv_driver *hv_driver) | ||
51 | { | ||
52 | pr_info("unregistering driver %s\n", hv_driver->name); | ||
53 | |||
54 | + if (!vmbus_exists()) | ||
55 | + return; | ||
56 | + | ||
57 | driver_unregister(&hv_driver->driver); | ||
58 | |||
59 | } | ||
60 | @@ -776,6 +791,7 @@ static int __init hv_acpi_init(void) | ||
61 | |||
62 | cleanup: | ||
63 | acpi_bus_unregister_driver(&vmbus_acpi_driver); | ||
64 | + hv_acpi_dev = NULL; | ||
65 | return ret; | ||
66 | } | ||
67 | |||
68 | -- | ||
69 | 1.7.7.4 | ||
70 | |||
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0027-Drivers-hv-Fix-a-bug-in-vmbus_driver_unregister.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0027-Drivers-hv-Fix-a-bug-in-vmbus_driver_unregister.patch new file mode 100644 index 00000000..e6184ae0 --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0027-Drivers-hv-Fix-a-bug-in-vmbus_driver_unregister.patch | |||
@@ -0,0 +1,40 @@ | |||
1 | From 797931db7094985a8aa99b24695192d1773129de Mon Sep 17 00:00:00 2001 | ||
2 | From: "K. Y. Srinivasan" <kys@microsoft.com> | ||
3 | Date: Tue, 27 Dec 2011 13:49:37 -0800 | ||
4 | Subject: [PATCH 27/49] Drivers:hv: Fix a bug in vmbus_driver_unregister() | ||
5 | |||
6 | commit 8f257a142fc3868d69de3f996b95d7bdbc509560 upstream. | ||
7 | |||
8 | The function vmbus_exists() was introduced recently to deal with cases where | ||
9 | the vmbus driver failed to initialize and yet other Hyper-V drivers attempted | ||
10 | to register with the vmbus bus driver. This patch introduced a bug where | ||
11 | vmbus_driver_unregister() would fail to unregister the driver. This patch | ||
12 | fixes the problem. | ||
13 | |||
14 | Signed-off-by: K. Y. Srinivasan <kys@microsoft.com> | ||
15 | Signed-off-by: Fuzhou Chen <fuzhouch@microsoft.com> | ||
16 | Cc: Sasha Levin <levinsasha928@gmail.com> | ||
17 | Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> | ||
18 | --- | ||
19 | drivers/hv/vmbus_drv.c | 5 +---- | ||
20 | 1 files changed, 1 insertions(+), 4 deletions(-) | ||
21 | |||
22 | diff --git a/drivers/hv/vmbus_drv.c b/drivers/hv/vmbus_drv.c | ||
23 | index d3b0b4f..d2d0a2a 100644 | ||
24 | --- a/drivers/hv/vmbus_drv.c | ||
25 | +++ b/drivers/hv/vmbus_drv.c | ||
26 | @@ -627,10 +627,7 @@ void vmbus_driver_unregister(struct hv_driver *hv_driver) | ||
27 | pr_info("unregistering driver %s\n", hv_driver->name); | ||
28 | |||
29 | if (!vmbus_exists()) | ||
30 | - return; | ||
31 | - | ||
32 | - driver_unregister(&hv_driver->driver); | ||
33 | - | ||
34 | + driver_unregister(&hv_driver->driver); | ||
35 | } | ||
36 | EXPORT_SYMBOL_GPL(vmbus_driver_unregister); | ||
37 | |||
38 | -- | ||
39 | 1.7.7.4 | ||
40 | |||
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0028-USB-update-documentation-for-usbmon.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0028-USB-update-documentation-for-usbmon.patch new file mode 100644 index 00000000..8a6a5fba --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0028-USB-update-documentation-for-usbmon.patch | |||
@@ -0,0 +1,54 @@ | |||
1 | From a4d5730e9c4b209e74eab2f7650b23f95417dc71 Mon Sep 17 00:00:00 2001 | ||
2 | From: Alan Stern <stern@rowland.harvard.edu> | ||
3 | Date: Wed, 4 Jan 2012 16:36:35 -0500 | ||
4 | Subject: [PATCH 28/49] USB: update documentation for usbmon | ||
5 | |||
6 | commit d8cae98cddd286e38db1724dda1b0e7b467f9237 upstream. | ||
7 | |||
8 | The documentation for usbmon is out of date; the usbfs "devices" file | ||
9 | now exists in /sys/kernel/debug/usb rather than /proc/bus/usb. This | ||
10 | patch (as1505) updates the documentation accordingly, and also | ||
11 | mentions that the necessary information can be found by running lsusb. | ||
12 | |||
13 | Signed-off-by: Alan Stern <stern@rowland.harvard.edu> | ||
14 | CC: Pete Zaitcev <zaitcev@redhat.com> | ||
15 | Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> | ||
16 | --- | ||
17 | Documentation/usb/usbmon.txt | 14 +++++++++----- | ||
18 | 1 files changed, 9 insertions(+), 5 deletions(-) | ||
19 | |||
20 | diff --git a/Documentation/usb/usbmon.txt b/Documentation/usb/usbmon.txt | ||
21 | index a4efa04..5335fa8 100644 | ||
22 | --- a/Documentation/usb/usbmon.txt | ||
23 | +++ b/Documentation/usb/usbmon.txt | ||
24 | @@ -47,10 +47,11 @@ This allows to filter away annoying devices that talk continuously. | ||
25 | |||
26 | 2. Find which bus connects to the desired device | ||
27 | |||
28 | -Run "cat /proc/bus/usb/devices", and find the T-line which corresponds to | ||
29 | -the device. Usually you do it by looking for the vendor string. If you have | ||
30 | -many similar devices, unplug one and compare two /proc/bus/usb/devices outputs. | ||
31 | -The T-line will have a bus number. Example: | ||
32 | +Run "cat /sys/kernel/debug/usb/devices", and find the T-line which corresponds | ||
33 | +to the device. Usually you do it by looking for the vendor string. If you have | ||
34 | +many similar devices, unplug one and compare the two | ||
35 | +/sys/kernel/debug/usb/devices outputs. The T-line will have a bus number. | ||
36 | +Example: | ||
37 | |||
38 | T: Bus=03 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=12 MxCh= 0 | ||
39 | D: Ver= 1.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 8 #Cfgs= 1 | ||
40 | @@ -58,7 +59,10 @@ P: Vendor=0557 ProdID=2004 Rev= 1.00 | ||
41 | S: Manufacturer=ATEN | ||
42 | S: Product=UC100KM V2.00 | ||
43 | |||
44 | -Bus=03 means it's bus 3. | ||
45 | +"Bus=03" means it's bus 3. Alternatively, you can look at the output from | ||
46 | +"lsusb" and get the bus number from the appropriate line. Example: | ||
47 | + | ||
48 | +Bus 003 Device 002: ID 0557:2004 ATEN UC100KM V2.00 | ||
49 | |||
50 | 3. Start 'cat' | ||
51 | |||
52 | -- | ||
53 | 1.7.7.4 | ||
54 | |||
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0029-usbfs-Fix-oops-related-to-user-namespace-conversion.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0029-usbfs-Fix-oops-related-to-user-namespace-conversion.patch new file mode 100644 index 00000000..dfc6d0b8 --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0029-usbfs-Fix-oops-related-to-user-namespace-conversion.patch | |||
@@ -0,0 +1,125 @@ | |||
1 | From 6b544616a14b48a670d0c7ce10a5f8de1246cc96 Mon Sep 17 00:00:00 2001 | ||
2 | From: Sarah Sharp <sarah.a.sharp@linux.intel.com> | ||
3 | Date: Fri, 16 Dec 2011 11:26:30 -0800 | ||
4 | Subject: [PATCH 29/49] usbfs: Fix oops related to user namespace conversion. | ||
5 | |||
6 | commit 1b41c8321e495337e877ca02d0b9680bc4112eff upstream. | ||
7 | |||
8 | When running the Point Grey "flycap" program for their USB 3.0 camera | ||
9 | (which was running as a USB 2.0 device for some reason), I trigger this | ||
10 | oops whenever I try to open a video stream: | ||
11 | |||
12 | Dec 15 16:48:34 puck kernel: [ 1798.715559] BUG: unable to handle kernel NULL pointer dereference at (null) | ||
13 | Dec 15 16:48:34 puck kernel: [ 1798.719153] IP: [<ffffffff8147841e>] free_async+0x1e/0x70 | ||
14 | Dec 15 16:48:34 puck kernel: [ 1798.720991] PGD 6f833067 PUD 6fc56067 PMD 0 | ||
15 | Dec 15 16:48:34 puck kernel: [ 1798.722815] Oops: 0002 [#1] SMP | ||
16 | Dec 15 16:48:34 puck kernel: [ 1798.724627] CPU 0 | ||
17 | Dec 15 16:48:34 puck kernel: [ 1798.724636] Modules linked in: ecryptfs encrypted_keys sha1_generic trusted binfmt_misc sha256_generic aesni_intel cryptd aes_x86_64 aes_generic parport_pc dm_crypt ppdev joydev snd_hda_codec_hdmi snd_hda_codec_conexant arc4 iwlwifi snd_hda_intel snd_hda_codec snd_hwdep snd_pcm thinkpad_acpi mac80211 snd_seq_midi snd_rawmidi snd_seq_midi_event snd_seq snd_timer btusb uvcvideo snd_seq_device bluetooth videodev psmouse snd v4l2_compat_ioctl32 serio_raw tpm_tis cfg80211 tpm tpm_bios nvram soundcore snd_page_alloc lp parport i915 xhci_hcd ahci libahci drm_kms_helper drm sdhci_pci sdhci e1000e i2c_algo_bit video | ||
18 | Dec 15 16:48:34 puck kernel: [ 1798.734212] | ||
19 | Dec 15 16:48:34 puck kernel: [ 1798.736162] Pid: 2713, comm: FlyCap2 Not tainted 3.2.0-rc5+ #28 LENOVO 4286CTO/4286CTO | ||
20 | Dec 15 16:48:34 puck kernel: [ 1798.738148] RIP: 0010:[<ffffffff8147841e>] [<ffffffff8147841e>] free_async+0x1e/0x70 | ||
21 | Dec 15 16:48:34 puck kernel: [ 1798.740134] RSP: 0018:ffff88005715fd78 EFLAGS: 00010296 | ||
22 | Dec 15 16:48:34 puck kernel: [ 1798.742118] RAX: 00000000fffffff4 RBX: ffff88006fe8f900 RCX: 0000000000004118 | ||
23 | Dec 15 16:48:34 puck kernel: [ 1798.744116] RDX: 0000000001000000 RSI: 0000000000016390 RDI: 0000000000000000 | ||
24 | Dec 15 16:48:34 puck kernel: [ 1798.746087] RBP: ffff88005715fd88 R08: 0000000000000000 R09: ffffffff8146f22e | ||
25 | Dec 15 16:48:34 puck kernel: [ 1798.748018] R10: ffff88006e520ac0 R11: 0000000000000001 R12: ffff88005715fe28 | ||
26 | Dec 15 16:48:34 puck kernel: [ 1798.749916] R13: ffff88005d31df00 R14: ffff88006fe8f900 R15: 00007f688c995cb8 | ||
27 | Dec 15 16:48:34 puck kernel: [ 1798.751785] FS: 00007f68a366da40(0000) GS:ffff880100200000(0000) knlGS:0000000000000000 | ||
28 | Dec 15 16:48:34 puck kernel: [ 1798.753659] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 | ||
29 | Dec 15 16:48:34 puck kernel: [ 1798.755509] CR2: 0000000000000000 CR3: 00000000706bb000 CR4: 00000000000406f0 | ||
30 | Dec 15 16:48:34 puck kernel: [ 1798.757334] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 | ||
31 | Dec 15 16:48:34 puck kernel: [ 1798.759124] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 | ||
32 | Dec 15 16:48:34 puck kernel: [ 1798.760871] Process FlyCap2 (pid: 2713, threadinfo ffff88005715e000, task ffff88006c675b80) | ||
33 | Dec 15 16:48:34 puck kernel: [ 1798.762605] Stack: | ||
34 | Dec 15 16:48:34 puck kernel: [ 1798.764297] ffff88005715fe28 0000000000000000 ffff88005715fe08 ffffffff81479058 | ||
35 | Dec 15 16:48:34 puck kernel: [ 1798.766020] 0000000000000000 ffffea0000004000 ffff880000004118 0000000000000000 | ||
36 | Dec 15 16:48:34 puck kernel: [ 1798.767750] ffff880000000001 ffff88006e520ac0 fffffff46fd81180 0000000000000000 | ||
37 | Dec 15 16:48:34 puck kernel: [ 1798.769472] Call Trace: | ||
38 | Dec 15 16:48:34 puck kernel: [ 1798.771147] [<ffffffff81479058>] proc_do_submiturb+0x778/0xa00 | ||
39 | Dec 15 16:48:34 puck kernel: [ 1798.772798] [<ffffffff8147a5fd>] usbdev_do_ioctl+0x24d/0x1200 | ||
40 | Dec 15 16:48:34 puck kernel: [ 1798.774410] [<ffffffff8147b5de>] usbdev_ioctl+0xe/0x20 | ||
41 | Dec 15 16:48:34 puck kernel: [ 1798.775975] [<ffffffff81189259>] do_vfs_ioctl+0x99/0x600 | ||
42 | Dec 15 16:48:34 puck kernel: [ 1798.777534] [<ffffffff81189851>] sys_ioctl+0x91/0xa0 | ||
43 | Dec 15 16:48:34 puck kernel: [ 1798.779088] [<ffffffff816247c2>] system_call_fastpath+0x16/0x1b | ||
44 | ec 15 16:48:34 puck kernel: [ 1798.780634] Code: 51 ff ff ff e9 29 ff ff ff 0f 1f 40 00 55 48 89 e5 53 48 83 ec 08 66 66 66 66 90 48 89 fb 48 8b 7f 18 e8 a6 ea c0 ff 4 | ||
45 | 8 8b 7b 20 <f0> ff 0f 0f 94 c0 84 c0 74 05 e8 d3 99 c1 ff 48 8b 43 40 48 8b | ||
46 | Dec 15 16:48:34 puck kernel: [ 1798.783970] RIP [<ffffffff8147841e>] free_async+0x1e/0x70 | ||
47 | Dec 15 16:48:34 puck kernel: [ 1798.785630] RSP <ffff88005715fd78> | ||
48 | Dec 15 16:48:34 puck kernel: [ 1798.787274] CR2: 0000000000000000 | ||
49 | Dec 15 16:48:34 puck kernel: [ 1798.794728] ---[ end trace 52894d3355f88d19 ]--- | ||
50 | |||
51 | markup_oops.pl says the oops is in put_cred: | ||
52 | |||
53 | ffffffff81478401: 48 89 e5 mov %rsp,%rbp | ||
54 | ffffffff81478404: 53 push %rbx | ||
55 | ffffffff81478405: 48 83 ec 08 sub $0x8,%rsp | ||
56 | ffffffff81478409: e8 f2 c0 1a 00 callq ffffffff81624500 <mcount> | ||
57 | ffffffff8147840e: 48 89 fb mov %rdi,%rbx | %ebx => ffff88006fe8f900 | ||
58 | put_pid(as->pid); | ||
59 | ffffffff81478411: 48 8b 7f 18 mov 0x18(%rdi),%rdi | ||
60 | ffffffff81478415: e8 a6 ea c0 ff callq ffffffff81086ec0 <put_pid> | ||
61 | put_cred(as->cred); | ||
62 | ffffffff8147841a: 48 8b 7b 20 mov 0x20(%rbx),%rdi | %edi => 0 %ebx = ffff88006fe8f900 | ||
63 | */ | ||
64 | static inline int atomic_dec_and_test(atomic_t *v) | ||
65 | { | ||
66 | unsigned char c; | ||
67 | |||
68 | asm volatile(LOCK_PREFIX "decl %0; sete %1" | ||
69 | *ffffffff8147841e: f0 ff 0f lock decl (%rdi) | %edi = 0 <--- faulting instruction | ||
70 | ffffffff81478421: 0f 94 c0 sete %al | ||
71 | static inline void put_cred(const struct cred *_cred) | ||
72 | { | ||
73 | struct cred *cred = (struct cred *) _cred; | ||
74 | |||
75 | validate_creds(cred); | ||
76 | if (atomic_dec_and_test(&(cred)->usage)) | ||
77 | ffffffff81478424: 84 c0 test %al,%al | ||
78 | ffffffff81478426: 74 05 je ffffffff8147842d <free_async+0x2d> | ||
79 | __put_cred(cred); | ||
80 | ffffffff81478428: e8 d3 99 c1 ff callq ffffffff81091e00 <__put_cred> | ||
81 | kfree(as->urb->transfer_buffer); | ||
82 | ffffffff8147842d: 48 8b 43 40 mov 0x40(%rbx),%rax | ||
83 | ffffffff81478431: 48 8b 78 68 mov 0x68(%rax),%rdi | ||
84 | ffffffff81478435: e8 a6 e1 ce ff callq ffffffff811665e0 <kfree> | ||
85 | kfree(as->urb->setup_packet); | ||
86 | ffffffff8147843a: 48 8b 43 40 mov 0x40(%rbx),%rax | ||
87 | ffffffff8147843e: 48 8b b8 90 00 00 00 mov 0x90(%rax),%rdi | ||
88 | ffffffff81478445: e8 96 e1 ce ff callq ffffffff811665e0 <kfree> | ||
89 | usb_free_urb(as->urb); | ||
90 | ffffffff8147844a: 48 8b 7b 40 mov 0x40(%rbx),%rdi | ||
91 | ffffffff8147844e: e8 0d 6b ff ff callq ffffffff8146ef60 <usb_free_urb> | ||
92 | |||
93 | This bug seems to have been introduced by commit | ||
94 | d178bc3a708f39cbfefc3fab37032d3f2511b4ec "user namespace: usb: make usb | ||
95 | urbs user namespace aware (v2)" | ||
96 | |||
97 | I'm not sure if this is right fix, but it does stop the oops. | ||
98 | |||
99 | Unfortunately, the Point Grey software still refuses to work, but it's a | ||
100 | closed source app, so I can't fix it. | ||
101 | |||
102 | Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com> | ||
103 | Acked-by: Serge Hallyn <serge.hallyn@canonical.com> | ||
104 | Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> | ||
105 | --- | ||
106 | drivers/usb/core/devio.c | 3 ++- | ||
107 | 1 files changed, 2 insertions(+), 1 deletions(-) | ||
108 | |||
109 | diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c | ||
110 | index e3beaf2..7abf060 100644 | ||
111 | --- a/drivers/usb/core/devio.c | ||
112 | +++ b/drivers/usb/core/devio.c | ||
113 | @@ -249,7 +249,8 @@ static struct async *alloc_async(unsigned int numisoframes) | ||
114 | static void free_async(struct async *as) | ||
115 | { | ||
116 | put_pid(as->pid); | ||
117 | - put_cred(as->cred); | ||
118 | + if (as->cred) | ||
119 | + put_cred(as->cred); | ||
120 | kfree(as->urb->transfer_buffer); | ||
121 | kfree(as->urb->setup_packet); | ||
122 | usb_free_urb(as->urb); | ||
123 | -- | ||
124 | 1.7.7.4 | ||
125 | |||
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0030-atmel_serial-fix-spinlock-lockup-in-RS485-code.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0030-atmel_serial-fix-spinlock-lockup-in-RS485-code.patch new file mode 100644 index 00000000..75f2b51a --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0030-atmel_serial-fix-spinlock-lockup-in-RS485-code.patch | |||
@@ -0,0 +1,47 @@ | |||
1 | From 2918b666fe0636d9d90ce6defda2d3ec908231a8 Mon Sep 17 00:00:00 2001 | ||
2 | From: Claudio Scordino <claudio@evidence.eu.com> | ||
3 | Date: Fri, 16 Dec 2011 15:08:49 +0100 | ||
4 | Subject: [PATCH 30/49] atmel_serial: fix spinlock lockup in RS485 code | ||
5 | |||
6 | commit dbf1115d3f8c7052788aa4e6e46abd27f3b3eeba upstream. | ||
7 | |||
8 | Patch to fix a spinlock lockup in the driver that sometimes happens when the | ||
9 | tasklet starts. | ||
10 | |||
11 | Signed-off-by: Claudio Scordino <claudio@evidence.eu.com> | ||
12 | Signed-off-by: Dave Bender <codehero@gmail.com> | ||
13 | Tested-by: Dave Bender <codehero@gmail.com> | ||
14 | Acked-by: Nicolas Ferre <nicolas.ferre@atmel.com> | ||
15 | Acked-by: Alan Cox <alan@linux.intel.com> | ||
16 | Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> | ||
17 | --- | ||
18 | drivers/tty/serial/atmel_serial.c | 5 +++-- | ||
19 | 1 files changed, 3 insertions(+), 2 deletions(-) | ||
20 | |||
21 | diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_serial.c | ||
22 | index 4c823f3..90c8e3a 100644 | ||
23 | --- a/drivers/tty/serial/atmel_serial.c | ||
24 | +++ b/drivers/tty/serial/atmel_serial.c | ||
25 | @@ -212,8 +212,9 @@ void atmel_config_rs485(struct uart_port *port, struct serial_rs485 *rs485conf) | ||
26 | { | ||
27 | struct atmel_uart_port *atmel_port = to_atmel_uart_port(port); | ||
28 | unsigned int mode; | ||
29 | + unsigned long flags; | ||
30 | |||
31 | - spin_lock(&port->lock); | ||
32 | + spin_lock_irqsave(&port->lock, flags); | ||
33 | |||
34 | /* Disable interrupts */ | ||
35 | UART_PUT_IDR(port, atmel_port->tx_done_mask); | ||
36 | @@ -244,7 +245,7 @@ void atmel_config_rs485(struct uart_port *port, struct serial_rs485 *rs485conf) | ||
37 | /* Enable interrupts */ | ||
38 | UART_PUT_IER(port, atmel_port->tx_done_mask); | ||
39 | |||
40 | - spin_unlock(&port->lock); | ||
41 | + spin_unlock_irqrestore(&port->lock, flags); | ||
42 | |||
43 | } | ||
44 | |||
45 | -- | ||
46 | 1.7.7.4 | ||
47 | |||
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0031-cgroup-fix-to-allow-mounting-a-hierarchy-by-name.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0031-cgroup-fix-to-allow-mounting-a-hierarchy-by-name.patch new file mode 100644 index 00000000..649d103b --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0031-cgroup-fix-to-allow-mounting-a-hierarchy-by-name.patch | |||
@@ -0,0 +1,50 @@ | |||
1 | From 7e755f9707e34e7de22e2f3b77ab26d1d8de5a4b Mon Sep 17 00:00:00 2001 | ||
2 | From: Li Zefan <lizf@cn.fujitsu.com> | ||
3 | Date: Tue, 27 Dec 2011 14:25:55 +0800 | ||
4 | Subject: [PATCH 31/49] cgroup: fix to allow mounting a hierarchy by name | ||
5 | |||
6 | commit 0d19ea866562e46989412a0676412fa0983c9ce7 upstream. | ||
7 | |||
8 | If we mount a hierarchy with a specified name, the name is unique, | ||
9 | and we can use it to mount the hierarchy without specifying its | ||
10 | set of subsystem names. This feature is documented is | ||
11 | Documentation/cgroups/cgroups.txt section 2.3 | ||
12 | |||
13 | Here's an example: | ||
14 | |||
15 | # mount -t cgroup -o cpuset,name=myhier xxx /cgroup1 | ||
16 | # mount -t cgroup -o name=myhier xxx /cgroup2 | ||
17 | |||
18 | But it was broken by commit 32a8cf235e2f192eb002755076994525cdbaa35a | ||
19 | (cgroup: make the mount options parsing more accurate) | ||
20 | |||
21 | This fixes the regression. | ||
22 | |||
23 | Signed-off-by: Li Zefan <lizf@cn.fujitsu.com> | ||
24 | Signed-off-by: Tejun Heo <tj@kernel.org> | ||
25 | Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> | ||
26 | --- | ||
27 | kernel/cgroup.c | 6 +++--- | ||
28 | 1 files changed, 3 insertions(+), 3 deletions(-) | ||
29 | |||
30 | diff --git a/kernel/cgroup.c b/kernel/cgroup.c | ||
31 | index a184470..cdc0354 100644 | ||
32 | --- a/kernel/cgroup.c | ||
33 | +++ b/kernel/cgroup.c | ||
34 | @@ -1175,10 +1175,10 @@ static int parse_cgroupfs_options(char *data, struct cgroup_sb_opts *opts) | ||
35 | |||
36 | /* | ||
37 | * If the 'all' option was specified select all the subsystems, | ||
38 | - * otherwise 'all, 'none' and a subsystem name options were not | ||
39 | - * specified, let's default to 'all' | ||
40 | + * otherwise if 'none', 'name=' and a subsystem name options | ||
41 | + * were not specified, let's default to 'all' | ||
42 | */ | ||
43 | - if (all_ss || (!all_ss && !one_ss && !opts->none)) { | ||
44 | + if (all_ss || (!one_ss && !opts->none && !opts->name)) { | ||
45 | for (i = 0; i < CGROUP_SUBSYS_COUNT; i++) { | ||
46 | struct cgroup_subsys *ss = subsys[i]; | ||
47 | if (ss == NULL) | ||
48 | -- | ||
49 | 1.7.7.4 | ||
50 | |||
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0032-udf-Fix-deadlock-when-converting-file-from-in-ICB-on.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0032-udf-Fix-deadlock-when-converting-file-from-in-ICB-on.patch new file mode 100644 index 00000000..e5d99f76 --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0032-udf-Fix-deadlock-when-converting-file-from-in-ICB-on.patch | |||
@@ -0,0 +1,130 @@ | |||
1 | From b2b56aa7932508ce3a81187a68e6a558268efc35 Mon Sep 17 00:00:00 2001 | ||
2 | From: Jan Kara <jack@suse.cz> | ||
3 | Date: Sat, 10 Dec 2011 02:30:48 +0100 | ||
4 | Subject: [PATCH 32/49] udf: Fix deadlock when converting file from in-ICB one | ||
5 | to normal one | ||
6 | |||
7 | commit d2eb8c359309ec45d6bf5b147303ab8e13be86ea upstream. | ||
8 | |||
9 | During BKL removal in 2.6.38, conversion of files from in-ICB format to normal | ||
10 | format got broken. We call ->writepage with i_data_sem held but udf_get_block() | ||
11 | also acquires i_data_sem thus creating A-A deadlock. | ||
12 | |||
13 | We fix the problem by dropping i_data_sem before calling ->writepage() which is | ||
14 | safe since i_mutex still protects us against any changes in the file. Also fix | ||
15 | pagelock - i_data_sem lock inversion in udf_expand_file_adinicb() by dropping | ||
16 | i_data_sem before calling find_or_create_page(). | ||
17 | |||
18 | Reported-by: Matthias Matiak <netzpython@mail-on.us> | ||
19 | Tested-by: Matthias Matiak <netzpython@mail-on.us> | ||
20 | Reviewed-by: Namjae Jeon <linkinjeon@gmail.com> | ||
21 | Signed-off-by: Jan Kara <jack@suse.cz> | ||
22 | Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> | ||
23 | --- | ||
24 | fs/udf/file.c | 6 +++--- | ||
25 | fs/udf/inode.c | 21 ++++++++++++++++++--- | ||
26 | 2 files changed, 21 insertions(+), 6 deletions(-) | ||
27 | |||
28 | diff --git a/fs/udf/file.c b/fs/udf/file.c | ||
29 | index d8ffa7c..dca0c38 100644 | ||
30 | --- a/fs/udf/file.c | ||
31 | +++ b/fs/udf/file.c | ||
32 | @@ -125,7 +125,6 @@ static ssize_t udf_file_aio_write(struct kiocb *iocb, const struct iovec *iov, | ||
33 | err = udf_expand_file_adinicb(inode); | ||
34 | if (err) { | ||
35 | udf_debug("udf_expand_adinicb: err=%d\n", err); | ||
36 | - up_write(&iinfo->i_data_sem); | ||
37 | return err; | ||
38 | } | ||
39 | } else { | ||
40 | @@ -133,9 +132,10 @@ static ssize_t udf_file_aio_write(struct kiocb *iocb, const struct iovec *iov, | ||
41 | iinfo->i_lenAlloc = pos + count; | ||
42 | else | ||
43 | iinfo->i_lenAlloc = inode->i_size; | ||
44 | + up_write(&iinfo->i_data_sem); | ||
45 | } | ||
46 | - } | ||
47 | - up_write(&iinfo->i_data_sem); | ||
48 | + } else | ||
49 | + up_write(&iinfo->i_data_sem); | ||
50 | |||
51 | retval = generic_file_aio_write(iocb, iov, nr_segs, ppos); | ||
52 | if (retval > 0) | ||
53 | diff --git a/fs/udf/inode.c b/fs/udf/inode.c | ||
54 | index 4fd1d80..e2787d0 100644 | ||
55 | --- a/fs/udf/inode.c | ||
56 | +++ b/fs/udf/inode.c | ||
57 | @@ -151,6 +151,12 @@ const struct address_space_operations udf_aops = { | ||
58 | .bmap = udf_bmap, | ||
59 | }; | ||
60 | |||
61 | +/* | ||
62 | + * Expand file stored in ICB to a normal one-block-file | ||
63 | + * | ||
64 | + * This function requires i_data_sem for writing and releases it. | ||
65 | + * This function requires i_mutex held | ||
66 | + */ | ||
67 | int udf_expand_file_adinicb(struct inode *inode) | ||
68 | { | ||
69 | struct page *page; | ||
70 | @@ -169,9 +175,15 @@ int udf_expand_file_adinicb(struct inode *inode) | ||
71 | iinfo->i_alloc_type = ICBTAG_FLAG_AD_LONG; | ||
72 | /* from now on we have normal address_space methods */ | ||
73 | inode->i_data.a_ops = &udf_aops; | ||
74 | + up_write(&iinfo->i_data_sem); | ||
75 | mark_inode_dirty(inode); | ||
76 | return 0; | ||
77 | } | ||
78 | + /* | ||
79 | + * Release i_data_sem so that we can lock a page - page lock ranks | ||
80 | + * above i_data_sem. i_mutex still protects us against file changes. | ||
81 | + */ | ||
82 | + up_write(&iinfo->i_data_sem); | ||
83 | |||
84 | page = find_or_create_page(inode->i_mapping, 0, GFP_NOFS); | ||
85 | if (!page) | ||
86 | @@ -187,6 +199,7 @@ int udf_expand_file_adinicb(struct inode *inode) | ||
87 | SetPageUptodate(page); | ||
88 | kunmap(page); | ||
89 | } | ||
90 | + down_write(&iinfo->i_data_sem); | ||
91 | memset(iinfo->i_ext.i_data + iinfo->i_lenEAttr, 0x00, | ||
92 | iinfo->i_lenAlloc); | ||
93 | iinfo->i_lenAlloc = 0; | ||
94 | @@ -196,17 +209,20 @@ int udf_expand_file_adinicb(struct inode *inode) | ||
95 | iinfo->i_alloc_type = ICBTAG_FLAG_AD_LONG; | ||
96 | /* from now on we have normal address_space methods */ | ||
97 | inode->i_data.a_ops = &udf_aops; | ||
98 | + up_write(&iinfo->i_data_sem); | ||
99 | err = inode->i_data.a_ops->writepage(page, &udf_wbc); | ||
100 | if (err) { | ||
101 | /* Restore everything back so that we don't lose data... */ | ||
102 | lock_page(page); | ||
103 | kaddr = kmap(page); | ||
104 | + down_write(&iinfo->i_data_sem); | ||
105 | memcpy(iinfo->i_ext.i_data + iinfo->i_lenEAttr, kaddr, | ||
106 | inode->i_size); | ||
107 | kunmap(page); | ||
108 | unlock_page(page); | ||
109 | iinfo->i_alloc_type = ICBTAG_FLAG_AD_IN_ICB; | ||
110 | inode->i_data.a_ops = &udf_adinicb_aops; | ||
111 | + up_write(&iinfo->i_data_sem); | ||
112 | } | ||
113 | page_cache_release(page); | ||
114 | mark_inode_dirty(inode); | ||
115 | @@ -1111,10 +1127,9 @@ int udf_setsize(struct inode *inode, loff_t newsize) | ||
116 | if (bsize < | ||
117 | (udf_file_entry_alloc_offset(inode) + newsize)) { | ||
118 | err = udf_expand_file_adinicb(inode); | ||
119 | - if (err) { | ||
120 | - up_write(&iinfo->i_data_sem); | ||
121 | + if (err) | ||
122 | return err; | ||
123 | - } | ||
124 | + down_write(&iinfo->i_data_sem); | ||
125 | } else | ||
126 | iinfo->i_lenAlloc = newsize; | ||
127 | } | ||
128 | -- | ||
129 | 1.7.7.4 | ||
130 | |||
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0033-drivers-usb-class-cdc-acm.c-clear-dangling-pointer.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0033-drivers-usb-class-cdc-acm.c-clear-dangling-pointer.patch new file mode 100644 index 00000000..e5e7b956 --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0033-drivers-usb-class-cdc-acm.c-clear-dangling-pointer.patch | |||
@@ -0,0 +1,45 @@ | |||
1 | From 2aabf017a2a76405dd9efbca80320965d8361302 Mon Sep 17 00:00:00 2001 | ||
2 | From: Julia Lawall <julia@diku.dk> | ||
3 | Date: Fri, 23 Dec 2011 14:02:55 +0100 | ||
4 | Subject: [PATCH 33/49] drivers/usb/class/cdc-acm.c: clear dangling pointer | ||
5 | |||
6 | commit e7c8e8605d0bafc705ff27f9da98a1668427cc0f upstream. | ||
7 | |||
8 | On some failures, the country_code field of an acm structure is freed | ||
9 | without freeing the acm structure itself. Elsewhere, operations including | ||
10 | memcpy and kfree are performed on the country_code field. The patch sets | ||
11 | the country_code field to NULL when it is freed, and likewise sets the | ||
12 | country_code_size field to 0. | ||
13 | |||
14 | Signed-off-by: Julia Lawall <julia@diku.dk> | ||
15 | Acked-by: Oliver Neukum <oneukum@suse.de> | ||
16 | Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> | ||
17 | --- | ||
18 | drivers/usb/class/cdc-acm.c | 4 ++++ | ||
19 | 1 files changed, 4 insertions(+), 0 deletions(-) | ||
20 | |||
21 | diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c | ||
22 | index a8078d0..ea5e487 100644 | ||
23 | --- a/drivers/usb/class/cdc-acm.c | ||
24 | +++ b/drivers/usb/class/cdc-acm.c | ||
25 | @@ -1183,6 +1183,8 @@ made_compressed_probe: | ||
26 | i = device_create_file(&intf->dev, &dev_attr_wCountryCodes); | ||
27 | if (i < 0) { | ||
28 | kfree(acm->country_codes); | ||
29 | + acm->country_codes = NULL; | ||
30 | + acm->country_code_size = 0; | ||
31 | goto skip_countries; | ||
32 | } | ||
33 | |||
34 | @@ -1191,6 +1193,8 @@ made_compressed_probe: | ||
35 | if (i < 0) { | ||
36 | device_remove_file(&intf->dev, &dev_attr_wCountryCodes); | ||
37 | kfree(acm->country_codes); | ||
38 | + acm->country_codes = NULL; | ||
39 | + acm->country_code_size = 0; | ||
40 | goto skip_countries; | ||
41 | } | ||
42 | } | ||
43 | -- | ||
44 | 1.7.7.4 | ||
45 | |||
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0034-USB-isight-fix-kernel-bug-when-loading-firmware.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0034-USB-isight-fix-kernel-bug-when-loading-firmware.patch new file mode 100644 index 00000000..ed02f1e3 --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0034-USB-isight-fix-kernel-bug-when-loading-firmware.patch | |||
@@ -0,0 +1,47 @@ | |||
1 | From 1d24cdb0797a26e1fb1d3545f6d4b992a5a23e96 Mon Sep 17 00:00:00 2001 | ||
2 | From: Greg Kroah-Hartman <gregkh@suse.de> | ||
3 | Date: Mon, 5 Dec 2011 14:02:59 -0800 | ||
4 | Subject: [PATCH 34/49] USB: isight: fix kernel bug when loading firmware | ||
5 | |||
6 | commit 59bf5cf94f0fa3b08fb1258b52649077b7d0914d upstream. | ||
7 | |||
8 | We were sending data on the stack when uploading firmware, which causes | ||
9 | some machines fits, and is not allowed. Fix this by using the buffer we | ||
10 | already had around for this very purpose. | ||
11 | |||
12 | Reported-by: Wouter M. Koolen <wmkoolen@cwi.nl> | ||
13 | Tested-by: Wouter M. Koolen <wmkoolen@cwi.nl> | ||
14 | Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> | ||
15 | --- | ||
16 | drivers/usb/misc/isight_firmware.c | 6 ++++-- | ||
17 | 1 files changed, 4 insertions(+), 2 deletions(-) | ||
18 | |||
19 | diff --git a/drivers/usb/misc/isight_firmware.c b/drivers/usb/misc/isight_firmware.c | ||
20 | index fe1d443..8f725f6 100644 | ||
21 | --- a/drivers/usb/misc/isight_firmware.c | ||
22 | +++ b/drivers/usb/misc/isight_firmware.c | ||
23 | @@ -55,8 +55,9 @@ static int isight_firmware_load(struct usb_interface *intf, | ||
24 | |||
25 | ptr = firmware->data; | ||
26 | |||
27 | + buf[0] = 0x01; | ||
28 | if (usb_control_msg | ||
29 | - (dev, usb_sndctrlpipe(dev, 0), 0xa0, 0x40, 0xe600, 0, "\1", 1, | ||
30 | + (dev, usb_sndctrlpipe(dev, 0), 0xa0, 0x40, 0xe600, 0, buf, 1, | ||
31 | 300) != 1) { | ||
32 | printk(KERN_ERR | ||
33 | "Failed to initialise isight firmware loader\n"); | ||
34 | @@ -100,8 +101,9 @@ static int isight_firmware_load(struct usb_interface *intf, | ||
35 | } | ||
36 | } | ||
37 | |||
38 | + buf[0] = 0x00; | ||
39 | if (usb_control_msg | ||
40 | - (dev, usb_sndctrlpipe(dev, 0), 0xa0, 0x40, 0xe600, 0, "\0", 1, | ||
41 | + (dev, usb_sndctrlpipe(dev, 0), 0xa0, 0x40, 0xe600, 0, buf, 1, | ||
42 | 300) != 1) { | ||
43 | printk(KERN_ERR "isight firmware loading completion failed\n"); | ||
44 | ret = -ENODEV; | ||
45 | -- | ||
46 | 1.7.7.4 | ||
47 | |||
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0035-usb-usb-storage-doesn-t-support-dynamic-id-currently.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0035-usb-usb-storage-doesn-t-support-dynamic-id-currently.patch new file mode 100644 index 00000000..3b4450ad --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0035-usb-usb-storage-doesn-t-support-dynamic-id-currently.patch | |||
@@ -0,0 +1,121 @@ | |||
1 | From 713ad0e8402a7e377bb8b4254b9b522628c9afeb Mon Sep 17 00:00:00 2001 | ||
2 | From: Huajun Li <huajun.li.lee@gmail.com> | ||
3 | Date: Wed, 4 Jan 2012 19:25:33 +0800 | ||
4 | Subject: [PATCH 35/49] usb: usb-storage doesn't support dynamic id currently, | ||
5 | the patch disables the feature to fix an oops | ||
6 | |||
7 | commit 1a3a026ba1b6bbfe0b7f79ab38cf991d691e7c9a upstream. | ||
8 | |||
9 | Echo vendor and product number of a non usb-storage device to | ||
10 | usb-storage driver's new_id, then plug in the device to host and you | ||
11 | will find following oops msg, the root cause is usb_stor_probe1() | ||
12 | refers invalid id entry if giving a dynamic id, so just disable the | ||
13 | feature. | ||
14 | |||
15 | [ 3105.018012] general protection fault: 0000 [#1] SMP DEBUG_PAGEALLOC | ||
16 | [ 3105.018062] CPU 0 | ||
17 | [ 3105.018075] Modules linked in: usb_storage usb_libusual bluetooth | ||
18 | dm_crypt binfmt_misc snd_hda_codec_analog snd_hda_intel snd_hda_codec | ||
19 | snd_hwdep hp_wmi ppdev sparse_keymap snd_pcm snd_seq_midi snd_rawmidi | ||
20 | snd_seq_midi_event snd_seq snd_timer snd_seq_device psmouse snd | ||
21 | serio_raw tpm_infineon soundcore i915 snd_page_alloc tpm_tis | ||
22 | parport_pc tpm tpm_bios drm_kms_helper drm i2c_algo_bit video lp | ||
23 | parport usbhid hid sg sr_mod sd_mod ehci_hcd uhci_hcd usbcore e1000e | ||
24 | usb_common floppy | ||
25 | [ 3105.018408] | ||
26 | [ 3105.018419] Pid: 189, comm: khubd Tainted: G I 3.2.0-rc7+ | ||
27 | #29 Hewlett-Packard HP Compaq dc7800p Convertible Minitower/0AACh | ||
28 | [ 3105.018481] RIP: 0010:[<ffffffffa045830d>] [<ffffffffa045830d>] | ||
29 | usb_stor_probe1+0x2fd/0xc20 [usb_storage] | ||
30 | [ 3105.018536] RSP: 0018:ffff880056a3d830 EFLAGS: 00010286 | ||
31 | [ 3105.018562] RAX: ffff880065f4e648 RBX: ffff88006bb28000 RCX: 0000000000000000 | ||
32 | [ 3105.018597] RDX: ffff88006f23c7b0 RSI: 0000000000000001 RDI: 0000000000000206 | ||
33 | [ 3105.018632] RBP: ffff880056a3d900 R08: 0000000000000000 R09: ffff880067365000 | ||
34 | [ 3105.018665] R10: 00000000000002ac R11: 0000000000000010 R12: ffff6000b41a7340 | ||
35 | [ 3105.018698] R13: ffff880065f4ef60 R14: ffff88006bb28b88 R15: ffff88006f23d270 | ||
36 | [ 3105.018733] FS: 0000000000000000(0000) GS:ffff88007a200000(0000) | ||
37 | knlGS:0000000000000000 | ||
38 | [ 3105.018773] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b | ||
39 | [ 3105.018801] CR2: 00007fc99c8c4650 CR3: 0000000001e05000 CR4: 00000000000006f0 | ||
40 | [ 3105.018835] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 | ||
41 | [ 3105.018870] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 | ||
42 | [ 3105.018906] Process khubd (pid: 189, threadinfo ffff880056a3c000, | ||
43 | task ffff88005677a400) | ||
44 | [ 3105.018945] Stack: | ||
45 | [ 3105.018959] 0000000000000000 0000000000000000 ffff880056a3d8d0 | ||
46 | 0000000000000002 | ||
47 | [ 3105.019011] 0000000000000000 ffff880056a3d918 ffff880000000000 | ||
48 | 0000000000000002 | ||
49 | [ 3105.019058] ffff880056a3d8d0 0000000000000012 ffff880056a3d8d0 | ||
50 | 0000000000000006 | ||
51 | [ 3105.019105] Call Trace: | ||
52 | [ 3105.019128] [<ffffffffa0458cd4>] storage_probe+0xa4/0xe0 [usb_storage] | ||
53 | [ 3105.019173] [<ffffffffa0097822>] usb_probe_interface+0x172/0x330 [usbcore] | ||
54 | [ 3105.019211] [<ffffffff815fda67>] driver_probe_device+0x257/0x3b0 | ||
55 | [ 3105.019243] [<ffffffff815fdd43>] __device_attach+0x73/0x90 | ||
56 | [ 3105.019272] [<ffffffff815fdcd0>] ? __driver_attach+0x110/0x110 | ||
57 | [ 3105.019303] [<ffffffff815fb93c>] bus_for_each_drv+0x9c/0xf0 | ||
58 | [ 3105.019334] [<ffffffff815fd6c7>] device_attach+0xf7/0x120 | ||
59 | [ 3105.019364] [<ffffffff815fc905>] bus_probe_device+0x45/0x80 | ||
60 | [ 3105.019396] [<ffffffff815f98a6>] device_add+0x876/0x990 | ||
61 | [ 3105.019434] [<ffffffffa0094e42>] usb_set_configuration+0x822/0x9e0 [usbcore] | ||
62 | [ 3105.019479] [<ffffffffa00a3492>] generic_probe+0x62/0xf0 [usbcore] | ||
63 | [ 3105.019518] [<ffffffffa0097a46>] usb_probe_device+0x66/0xb0 [usbcore] | ||
64 | [ 3105.019555] [<ffffffff815fda67>] driver_probe_device+0x257/0x3b0 | ||
65 | [ 3105.019589] [<ffffffff815fdd43>] __device_attach+0x73/0x90 | ||
66 | [ 3105.019617] [<ffffffff815fdcd0>] ? __driver_attach+0x110/0x110 | ||
67 | [ 3105.019648] [<ffffffff815fb93c>] bus_for_each_drv+0x9c/0xf0 | ||
68 | [ 3105.019680] [<ffffffff815fd6c7>] device_attach+0xf7/0x120 | ||
69 | [ 3105.019709] [<ffffffff815fc905>] bus_probe_device+0x45/0x80 | ||
70 | [ 3105.021040] usb usb6: usb auto-resume | ||
71 | [ 3105.021045] usb usb6: wakeup_rh | ||
72 | [ 3105.024849] [<ffffffff815f98a6>] device_add+0x876/0x990 | ||
73 | [ 3105.025086] [<ffffffffa0088987>] usb_new_device+0x1e7/0x2b0 [usbcore] | ||
74 | [ 3105.025086] [<ffffffffa008a4d7>] hub_thread+0xb27/0x1ec0 [usbcore] | ||
75 | [ 3105.025086] [<ffffffff810d5200>] ? wake_up_bit+0x50/0x50 | ||
76 | [ 3105.025086] [<ffffffffa00899b0>] ? usb_remote_wakeup+0xa0/0xa0 [usbcore] | ||
77 | [ 3105.025086] [<ffffffff810d49b8>] kthread+0xd8/0xf0 | ||
78 | [ 3105.025086] [<ffffffff81939884>] kernel_thread_helper+0x4/0x10 | ||
79 | [ 3105.025086] [<ffffffff8192a8c0>] ? _raw_spin_unlock_irq+0x50/0x80 | ||
80 | [ 3105.025086] [<ffffffff8192b1b4>] ? retint_restore_args+0x13/0x13 | ||
81 | [ 3105.025086] [<ffffffff810d48e0>] ? __init_kthread_worker+0x80/0x80 | ||
82 | [ 3105.025086] [<ffffffff81939880>] ? gs_change+0x13/0x13 | ||
83 | [ 3105.025086] Code: 00 48 83 05 cd ad 00 00 01 48 83 05 cd ad 00 00 | ||
84 | 01 4c 8b ab 30 0c 00 00 48 8b 50 08 48 83 c0 30 48 89 45 a0 4c 89 a3 | ||
85 | 40 0c 00 00 <41> 0f b6 44 24 10 48 89 55 a8 3c ff 0f 84 b8 04 00 00 48 | ||
86 | 83 05 | ||
87 | [ 3105.025086] RIP [<ffffffffa045830d>] usb_stor_probe1+0x2fd/0xc20 | ||
88 | [usb_storage] | ||
89 | [ 3105.025086] RSP <ffff880056a3d830> | ||
90 | [ 3105.060037] hub 6-0:1.0: hub_resume | ||
91 | [ 3105.062616] usb usb5: usb auto-resume | ||
92 | [ 3105.064317] ehci_hcd 0000:00:1d.7: resume root hub | ||
93 | [ 3105.094809] ---[ end trace a7919e7f17c0a727 ]--- | ||
94 | [ 3105.130069] hub 5-0:1.0: hub_resume | ||
95 | [ 3105.132131] usb usb4: usb auto-resume | ||
96 | [ 3105.132136] usb usb4: wakeup_rh | ||
97 | [ 3105.180059] hub 4-0:1.0: hub_resume | ||
98 | [ 3106.290052] usb usb6: suspend_rh (auto-stop) | ||
99 | [ 3106.290077] usb usb4: suspend_rh (auto-stop) | ||
100 | |||
101 | Signed-off-by: Huajun Li <huajun.li.lee@gmail.com> | ||
102 | Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> | ||
103 | --- | ||
104 | drivers/usb/storage/usb.c | 1 + | ||
105 | 1 files changed, 1 insertions(+), 0 deletions(-) | ||
106 | |||
107 | diff --git a/drivers/usb/storage/usb.c b/drivers/usb/storage/usb.c | ||
108 | index c325e69..9e069ef 100644 | ||
109 | --- a/drivers/usb/storage/usb.c | ||
110 | +++ b/drivers/usb/storage/usb.c | ||
111 | @@ -1073,6 +1073,7 @@ static struct usb_driver usb_storage_driver = { | ||
112 | .id_table = usb_storage_usb_ids, | ||
113 | .supports_autosuspend = 1, | ||
114 | .soft_unbind = 1, | ||
115 | + .no_dynamic_id = 1, | ||
116 | }; | ||
117 | |||
118 | static int __init usb_stor_init(void) | ||
119 | -- | ||
120 | 1.7.7.4 | ||
121 | |||
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0036-USB-pxa168-Fix-compilation-error.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0036-USB-pxa168-Fix-compilation-error.patch new file mode 100644 index 00000000..87cc3a5c --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0036-USB-pxa168-Fix-compilation-error.patch | |||
@@ -0,0 +1,42 @@ | |||
1 | From 17e7ea93a7ec7bb64e3bcd6b3cbee1fea5021587 Mon Sep 17 00:00:00 2001 | ||
2 | From: Tanmay Upadhyay <tanmay.upadhyay@einfochips.com> | ||
3 | Date: Thu, 8 Dec 2011 10:03:49 +0530 | ||
4 | Subject: [PATCH 36/49] USB: pxa168: Fix compilation error | ||
5 | |||
6 | commit 35657c4d72925936c7219cc5caac118ca632acc2 upstream. | ||
7 | |||
8 | After commit c430131a02d677aa708f56342c1565edfdacb3c0 (Support | ||
9 | controllers with big endian capability regs), HC_LENGTH takes | ||
10 | two arguments. This patch fixes following compilation error: | ||
11 | |||
12 | In file included from drivers/usb/host/ehci-hcd.c:1323: | ||
13 | drivers/usb/host/ehci-pxa168.c:302:54: error: macro "HC_LENGTH" requires 2 arguments, but only 1 given | ||
14 | In file included from drivers/usb/host/ehci-hcd.c:1323: | ||
15 | drivers/usb/host/ehci-pxa168.c: In function 'ehci_pxa168_drv_probe': | ||
16 | drivers/usb/host/ehci-pxa168.c:302: error: 'HC_LENGTH' undeclared (first use in this function) | ||
17 | drivers/usb/host/ehci-pxa168.c:302: error: (Each undeclared identifier is reported only once | ||
18 | drivers/usb/host/ehci-pxa168.c:302: error: for each function it appears in.) | ||
19 | |||
20 | Signed-off-by: Tanmay Upadhyay <tanmay.upadhyay@einfochips.com> | ||
21 | Acked-by: Alan Stern <stern@rowland.harvard.edu> | ||
22 | Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> | ||
23 | --- | ||
24 | drivers/usb/host/ehci-pxa168.c | 2 +- | ||
25 | 1 files changed, 1 insertions(+), 1 deletions(-) | ||
26 | |||
27 | diff --git a/drivers/usb/host/ehci-pxa168.c b/drivers/usb/host/ehci-pxa168.c | ||
28 | index ac0c16e..8d0e7a2 100644 | ||
29 | --- a/drivers/usb/host/ehci-pxa168.c | ||
30 | +++ b/drivers/usb/host/ehci-pxa168.c | ||
31 | @@ -299,7 +299,7 @@ static int __devinit ehci_pxa168_drv_probe(struct platform_device *pdev) | ||
32 | ehci = hcd_to_ehci(hcd); | ||
33 | ehci->caps = hcd->regs + 0x100; | ||
34 | ehci->regs = hcd->regs + 0x100 + | ||
35 | - HC_LENGTH(ehci_readl(ehci, &ehci->caps->hc_capbase)); | ||
36 | + HC_LENGTH(ehci, ehci_readl(ehci, &ehci->caps->hc_capbase)); | ||
37 | ehci->hcs_params = ehci_readl(ehci, &ehci->caps->hcs_params); | ||
38 | hcd->has_tt = 1; | ||
39 | ehci->sbrn = 0x20; | ||
40 | -- | ||
41 | 1.7.7.4 | ||
42 | |||
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0037-USB-add-quirk-for-another-camera.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0037-USB-add-quirk-for-another-camera.patch new file mode 100644 index 00000000..c981711f --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0037-USB-add-quirk-for-another-camera.patch | |||
@@ -0,0 +1,37 @@ | |||
1 | From ae803972522d34f68270782827580ba0d762468c Mon Sep 17 00:00:00 2001 | ||
2 | From: Oliver Neukum <oliver@neukum.org> | ||
3 | Date: Tue, 3 Jan 2012 09:58:54 +0100 | ||
4 | Subject: [PATCH 37/49] USB: add quirk for another camera | ||
5 | |||
6 | commit 35284b3d2f68a8a3703745e629999469f78386b5 upstream. | ||
7 | |||
8 | The Guillemot Webcam Hercules Dualpix Exchange camera | ||
9 | has been reported with a second ID. | ||
10 | |||
11 | Signed-off-by: Oliver Neukum <oneukum@suse.de> | ||
12 | Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> | ||
13 | --- | ||
14 | drivers/usb/core/quirks.c | 5 ++++- | ||
15 | 1 files changed, 4 insertions(+), 1 deletions(-) | ||
16 | |||
17 | diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c | ||
18 | index ecf12e1..4c65eb6 100644 | ||
19 | --- a/drivers/usb/core/quirks.c | ||
20 | +++ b/drivers/usb/core/quirks.c | ||
21 | @@ -117,9 +117,12 @@ static const struct usb_device_id usb_quirk_list[] = { | ||
22 | { USB_DEVICE(0x06a3, 0x0006), .driver_info = | ||
23 | USB_QUIRK_CONFIG_INTF_STRINGS }, | ||
24 | |||
25 | - /* Guillemot Webcam Hercules Dualpix Exchange*/ | ||
26 | + /* Guillemot Webcam Hercules Dualpix Exchange (2nd ID) */ | ||
27 | { USB_DEVICE(0x06f8, 0x0804), .driver_info = USB_QUIRK_RESET_RESUME }, | ||
28 | |||
29 | + /* Guillemot Webcam Hercules Dualpix Exchange*/ | ||
30 | + { USB_DEVICE(0x06f8, 0x3005), .driver_info = USB_QUIRK_RESET_RESUME }, | ||
31 | + | ||
32 | /* M-Systems Flash Disk Pioneers */ | ||
33 | { USB_DEVICE(0x08ec, 0x1000), .driver_info = USB_QUIRK_RESET_RESUME }, | ||
34 | |||
35 | -- | ||
36 | 1.7.7.4 | ||
37 | |||
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0038-USB-omninet-fix-write_room.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0038-USB-omninet-fix-write_room.patch new file mode 100644 index 00000000..cbd585ac --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0038-USB-omninet-fix-write_room.patch | |||
@@ -0,0 +1,34 @@ | |||
1 | From 4a6a3895c6ffe420a07f90df0f8ad5d7ac5a47a4 Mon Sep 17 00:00:00 2001 | ||
2 | From: Johan Hovold <jhovold@gmail.com> | ||
3 | Date: Sun, 6 Nov 2011 19:06:21 +0100 | ||
4 | Subject: [PATCH 38/49] USB: omninet: fix write_room | ||
5 | |||
6 | commit 694c6301e515bad574af74b6552134c4d9dcb334 upstream. | ||
7 | |||
8 | Fix regression introduced by commit 507ca9bc047666 ([PATCH] USB: add | ||
9 | ability for usb-serial drivers to determine if their write urb is | ||
10 | currently being used.) which inverted the logic in write_room so that it | ||
11 | returns zero when the write urb is actually free. | ||
12 | |||
13 | Signed-off-by: Johan Hovold <jhovold@gmail.com> | ||
14 | Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> | ||
15 | --- | ||
16 | drivers/usb/serial/omninet.c | 2 +- | ||
17 | 1 files changed, 1 insertions(+), 1 deletions(-) | ||
18 | |||
19 | diff --git a/drivers/usb/serial/omninet.c b/drivers/usb/serial/omninet.c | ||
20 | index 60f38d5..0a8c1e6 100644 | ||
21 | --- a/drivers/usb/serial/omninet.c | ||
22 | +++ b/drivers/usb/serial/omninet.c | ||
23 | @@ -315,7 +315,7 @@ static int omninet_write_room(struct tty_struct *tty) | ||
24 | int room = 0; /* Default: no room */ | ||
25 | |||
26 | /* FIXME: no consistent locking for write_urb_busy */ | ||
27 | - if (wport->write_urb_busy) | ||
28 | + if (!wport->write_urb_busy) | ||
29 | room = wport->bulk_out_size - OMNINET_HEADERLEN; | ||
30 | |||
31 | dbg("%s - returns %d", __func__, room); | ||
32 | -- | ||
33 | 1.7.7.4 | ||
34 | |||
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0039-usb-option-add-ZD-Incorporated-HSPA-modem.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0039-usb-option-add-ZD-Incorporated-HSPA-modem.patch new file mode 100644 index 00000000..7c062f00 --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0039-usb-option-add-ZD-Incorporated-HSPA-modem.patch | |||
@@ -0,0 +1,53 @@ | |||
1 | From bd6e892c7f49027eb7d6f5739406142db70fee7e Mon Sep 17 00:00:00 2001 | ||
2 | From: Janne Snabb <snabb@epipe.com> | ||
3 | Date: Wed, 28 Dec 2011 19:36:00 +0000 | ||
4 | Subject: [PATCH 39/49] usb: option: add ZD Incorporated HSPA modem | ||
5 | |||
6 | commit 3c8c9316710b83e906e425024153bf0929887b59 upstream. | ||
7 | |||
8 | Add support for Chinese Noname HSPA USB modem which is apparently | ||
9 | manufactured by a company called ZD Incorporated (based on texts in the | ||
10 | Windows drivers). | ||
11 | |||
12 | This product is available at least from Dealextreme (SKU 80032) and | ||
13 | possibly in India with name Olive V-MW250. It is based on Qualcomm | ||
14 | MSM6280 chip. | ||
15 | |||
16 | I needed to also add "options usb-storage quirks=0685:7000:i" in modprobe | ||
17 | configuration because udevd or the kernel keeps poking the embedded | ||
18 | fake-cd-rom which fails and causes the device to reset. There might be | ||
19 | a better way to accomplish the same. usb_modeswitch is not needed with | ||
20 | this device. | ||
21 | |||
22 | Signed-off-by: Janne Snabb <snabb@epipe.com> | ||
23 | Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> | ||
24 | --- | ||
25 | drivers/usb/serial/option.c | 5 +++++ | ||
26 | 1 files changed, 5 insertions(+), 0 deletions(-) | ||
27 | |||
28 | diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c | ||
29 | index 6dd6453..c96b6b6 100644 | ||
30 | --- a/drivers/usb/serial/option.c | ||
31 | +++ b/drivers/usb/serial/option.c | ||
32 | @@ -476,6 +476,10 @@ static void option_instat_callback(struct urb *urb); | ||
33 | #define VIETTEL_VENDOR_ID 0x2262 | ||
34 | #define VIETTEL_PRODUCT_VT1000 0x0002 | ||
35 | |||
36 | +/* ZD Incorporated */ | ||
37 | +#define ZD_VENDOR_ID 0x0685 | ||
38 | +#define ZD_PRODUCT_7000 0x7000 | ||
39 | + | ||
40 | /* some devices interfaces need special handling due to a number of reasons */ | ||
41 | enum option_blacklist_reason { | ||
42 | OPTION_BLACKLIST_NONE = 0, | ||
43 | @@ -1178,6 +1182,7 @@ static const struct usb_device_id option_ids[] = { | ||
44 | { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CLU528) }, | ||
45 | { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CLU526) }, | ||
46 | { USB_DEVICE_AND_INTERFACE_INFO(VIETTEL_VENDOR_ID, VIETTEL_PRODUCT_VT1000, 0xff, 0xff, 0xff) }, | ||
47 | + { USB_DEVICE_AND_INTERFACE_INFO(ZD_VENDOR_ID, ZD_PRODUCT_7000, 0xff, 0xff, 0xff) }, | ||
48 | { } /* Terminating entry */ | ||
49 | }; | ||
50 | MODULE_DEVICE_TABLE(usb, option_ids); | ||
51 | -- | ||
52 | 1.7.7.4 | ||
53 | |||
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0040-USB-Add-USB-ID-for-Multiplex-RC-serial-adapter-to-cp.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0040-USB-Add-USB-ID-for-Multiplex-RC-serial-adapter-to-cp.patch new file mode 100644 index 00000000..164d1697 --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0040-USB-Add-USB-ID-for-Multiplex-RC-serial-adapter-to-cp.patch | |||
@@ -0,0 +1,36 @@ | |||
1 | From a558d5668e8c66327a1a84f5db8381e94c2b0cd9 Mon Sep 17 00:00:00 2001 | ||
2 | From: =?UTF-8?q?Malte=20Schr=C3=B6der?= <maltesch@gmx.de> | ||
3 | Date: Thu, 5 Jan 2012 20:34:40 +0100 | ||
4 | Subject: [PATCH 40/49] USB: Add USB-ID for Multiplex RC serial adapter to | ||
5 | cp210x.c | ||
6 | MIME-Version: 1.0 | ||
7 | Content-Type: text/plain; charset=UTF-8 | ||
8 | Content-Transfer-Encoding: 8bit | ||
9 | |||
10 | commit 08e87d0d773dc9ca5faf4c3306e238ed0ea129b0 upstream. | ||
11 | |||
12 | Hi, below patch adds the USB-ID of the serial adapters sold by | ||
13 | Multiplex RC (www.multiplex-rc.de). | ||
14 | |||
15 | Signed-off-by: Malte Schröder <maltesch@gmx.de> | ||
16 | Cc: stable <stable@vger.kernel.org> | ||
17 | Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> | ||
18 | --- | ||
19 | drivers/usb/serial/cp210x.c | 1 + | ||
20 | 1 files changed, 1 insertions(+), 0 deletions(-) | ||
21 | |||
22 | diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c | ||
23 | index fd67cc5..a1a324b 100644 | ||
24 | --- a/drivers/usb/serial/cp210x.c | ||
25 | +++ b/drivers/usb/serial/cp210x.c | ||
26 | @@ -92,6 +92,7 @@ static const struct usb_device_id id_table[] = { | ||
27 | { USB_DEVICE(0x10C4, 0x818B) }, /* AVIT Research USB to TTL */ | ||
28 | { USB_DEVICE(0x10C4, 0x819F) }, /* MJS USB Toslink Switcher */ | ||
29 | { USB_DEVICE(0x10C4, 0x81A6) }, /* ThinkOptics WavIt */ | ||
30 | + { USB_DEVICE(0x10C4, 0x81A9) }, /* Multiplex RC Interface */ | ||
31 | { USB_DEVICE(0x10C4, 0x81AC) }, /* MSD Dash Hawk */ | ||
32 | { USB_DEVICE(0x10C4, 0x81AD) }, /* INSYS USB Modem */ | ||
33 | { USB_DEVICE(0x10C4, 0x81C8) }, /* Lipowsky Industrie Elektronik GmbH, Baby-JTAG */ | ||
34 | -- | ||
35 | 1.7.7.4 | ||
36 | |||
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0041-usb-fix-number-of-mapped-SG-DMA-entries.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0041-usb-fix-number-of-mapped-SG-DMA-entries.patch new file mode 100644 index 00000000..bc2716a5 --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0041-usb-fix-number-of-mapped-SG-DMA-entries.patch | |||
@@ -0,0 +1,155 @@ | |||
1 | From 61ff4bd883cde399d333204fe9878e90b6f87329 Mon Sep 17 00:00:00 2001 | ||
2 | From: Clemens Ladisch <clemens@ladisch.de> | ||
3 | Date: Sat, 3 Dec 2011 23:41:31 +0100 | ||
4 | Subject: [PATCH 41/49] usb: fix number of mapped SG DMA entries | ||
5 | |||
6 | commit bc677d5b64644c399cd3db6a905453e611f402ab upstream. | ||
7 | |||
8 | Add a new field num_mapped_sgs to struct urb so that we have a place to | ||
9 | store the number of mapped entries and can also retain the original | ||
10 | value of entries in num_sgs. Previously, usb_hcd_map_urb_for_dma() | ||
11 | would overwrite this with the number of mapped entries, which would | ||
12 | break dma_unmap_sg() because it requires the original number of entries. | ||
13 | |||
14 | This fixes warnings like the following when using USB storage devices: | ||
15 | ------------[ cut here ]------------ | ||
16 | WARNING: at lib/dma-debug.c:902 check_unmap+0x4e4/0x695() | ||
17 | ehci_hcd 0000:00:12.2: DMA-API: device driver frees DMA sg list with different entry count [map count=4] [unmap count=1] | ||
18 | Modules linked in: ohci_hcd ehci_hcd | ||
19 | Pid: 0, comm: kworker/0:1 Not tainted 3.2.0-rc2+ #319 | ||
20 | Call Trace: | ||
21 | <IRQ> [<ffffffff81036d3b>] warn_slowpath_common+0x80/0x98 | ||
22 | [<ffffffff81036de7>] warn_slowpath_fmt+0x41/0x43 | ||
23 | [<ffffffff811fa5ae>] check_unmap+0x4e4/0x695 | ||
24 | [<ffffffff8105e92c>] ? trace_hardirqs_off+0xd/0xf | ||
25 | [<ffffffff8147208b>] ? _raw_spin_unlock_irqrestore+0x33/0x50 | ||
26 | [<ffffffff811fa84a>] debug_dma_unmap_sg+0xeb/0x117 | ||
27 | [<ffffffff8137b02f>] usb_hcd_unmap_urb_for_dma+0x71/0x188 | ||
28 | [<ffffffff8137b166>] unmap_urb_for_dma+0x20/0x22 | ||
29 | [<ffffffff8137b1c5>] usb_hcd_giveback_urb+0x5d/0xc0 | ||
30 | [<ffffffffa0000d02>] ehci_urb_done+0xf7/0x10c [ehci_hcd] | ||
31 | [<ffffffffa0001140>] qh_completions+0x429/0x4bd [ehci_hcd] | ||
32 | [<ffffffffa000340a>] ehci_work+0x95/0x9c0 [ehci_hcd] | ||
33 | ... | ||
34 | ---[ end trace f29ac88a5a48c580 ]--- | ||
35 | Mapped at: | ||
36 | [<ffffffff811faac4>] debug_dma_map_sg+0x45/0x139 | ||
37 | [<ffffffff8137bc0b>] usb_hcd_map_urb_for_dma+0x22e/0x478 | ||
38 | [<ffffffff8137c494>] usb_hcd_submit_urb+0x63f/0x6fa | ||
39 | [<ffffffff8137d01c>] usb_submit_urb+0x2c7/0x2de | ||
40 | [<ffffffff8137dcd4>] usb_sg_wait+0x55/0x161 | ||
41 | |||
42 | Signed-off-by: Clemens Ladisch <clemens@ladisch.de> | ||
43 | Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> | ||
44 | --- | ||
45 | drivers/usb/core/hcd.c | 5 ++--- | ||
46 | drivers/usb/host/ehci-q.c | 2 +- | ||
47 | drivers/usb/host/uhci-q.c | 2 +- | ||
48 | drivers/usb/host/whci/qset.c | 4 ++-- | ||
49 | drivers/usb/host/xhci-ring.c | 4 ++-- | ||
50 | include/linux/usb.h | 1 + | ||
51 | 6 files changed, 9 insertions(+), 9 deletions(-) | ||
52 | |||
53 | diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c | ||
54 | index 13222d3..179e364 100644 | ||
55 | --- a/drivers/usb/core/hcd.c | ||
56 | +++ b/drivers/usb/core/hcd.c | ||
57 | @@ -1412,11 +1412,10 @@ int usb_hcd_map_urb_for_dma(struct usb_hcd *hcd, struct urb *urb, | ||
58 | ret = -EAGAIN; | ||
59 | else | ||
60 | urb->transfer_flags |= URB_DMA_MAP_SG; | ||
61 | - if (n != urb->num_sgs) { | ||
62 | - urb->num_sgs = n; | ||
63 | + urb->num_mapped_sgs = n; | ||
64 | + if (n != urb->num_sgs) | ||
65 | urb->transfer_flags |= | ||
66 | URB_DMA_SG_COMBINED; | ||
67 | - } | ||
68 | } else if (urb->sg) { | ||
69 | struct scatterlist *sg = urb->sg; | ||
70 | urb->transfer_dma = dma_map_page( | ||
71 | diff --git a/drivers/usb/host/ehci-q.c b/drivers/usb/host/ehci-q.c | ||
72 | index 4e4066c..fef1db3 100644 | ||
73 | --- a/drivers/usb/host/ehci-q.c | ||
74 | +++ b/drivers/usb/host/ehci-q.c | ||
75 | @@ -647,7 +647,7 @@ qh_urb_transaction ( | ||
76 | /* | ||
77 | * data transfer stage: buffer setup | ||
78 | */ | ||
79 | - i = urb->num_sgs; | ||
80 | + i = urb->num_mapped_sgs; | ||
81 | if (len > 0 && i > 0) { | ||
82 | sg = urb->sg; | ||
83 | buf = sg_dma_address(sg); | ||
84 | diff --git a/drivers/usb/host/uhci-q.c b/drivers/usb/host/uhci-q.c | ||
85 | index f6ca80e..d2c6f5a 100644 | ||
86 | --- a/drivers/usb/host/uhci-q.c | ||
87 | +++ b/drivers/usb/host/uhci-q.c | ||
88 | @@ -943,7 +943,7 @@ static int uhci_submit_common(struct uhci_hcd *uhci, struct urb *urb, | ||
89 | if (usb_pipein(urb->pipe)) | ||
90 | status |= TD_CTRL_SPD; | ||
91 | |||
92 | - i = urb->num_sgs; | ||
93 | + i = urb->num_mapped_sgs; | ||
94 | if (len > 0 && i > 0) { | ||
95 | sg = urb->sg; | ||
96 | data = sg_dma_address(sg); | ||
97 | diff --git a/drivers/usb/host/whci/qset.c b/drivers/usb/host/whci/qset.c | ||
98 | index a403b53..76083ae 100644 | ||
99 | --- a/drivers/usb/host/whci/qset.c | ||
100 | +++ b/drivers/usb/host/whci/qset.c | ||
101 | @@ -443,7 +443,7 @@ static int qset_add_urb_sg(struct whc *whc, struct whc_qset *qset, struct urb *u | ||
102 | |||
103 | remaining = urb->transfer_buffer_length; | ||
104 | |||
105 | - for_each_sg(urb->sg, sg, urb->num_sgs, i) { | ||
106 | + for_each_sg(urb->sg, sg, urb->num_mapped_sgs, i) { | ||
107 | dma_addr_t dma_addr; | ||
108 | size_t dma_remaining; | ||
109 | dma_addr_t sp, ep; | ||
110 | @@ -561,7 +561,7 @@ static int qset_add_urb_sg_linearize(struct whc *whc, struct whc_qset *qset, | ||
111 | |||
112 | remaining = urb->transfer_buffer_length; | ||
113 | |||
114 | - for_each_sg(urb->sg, sg, urb->num_sgs, i) { | ||
115 | + for_each_sg(urb->sg, sg, urb->num_mapped_sgs, i) { | ||
116 | size_t len; | ||
117 | size_t sg_remaining; | ||
118 | void *orig; | ||
119 | diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c | ||
120 | index 9f1d4b1..d28c586 100644 | ||
121 | --- a/drivers/usb/host/xhci-ring.c | ||
122 | +++ b/drivers/usb/host/xhci-ring.c | ||
123 | @@ -2561,7 +2561,7 @@ static unsigned int count_sg_trbs_needed(struct xhci_hcd *xhci, struct urb *urb) | ||
124 | struct scatterlist *sg; | ||
125 | |||
126 | sg = NULL; | ||
127 | - num_sgs = urb->num_sgs; | ||
128 | + num_sgs = urb->num_mapped_sgs; | ||
129 | temp = urb->transfer_buffer_length; | ||
130 | |||
131 | xhci_dbg(xhci, "count sg list trbs: \n"); | ||
132 | @@ -2745,7 +2745,7 @@ static int queue_bulk_sg_tx(struct xhci_hcd *xhci, gfp_t mem_flags, | ||
133 | return -EINVAL; | ||
134 | |||
135 | num_trbs = count_sg_trbs_needed(xhci, urb); | ||
136 | - num_sgs = urb->num_sgs; | ||
137 | + num_sgs = urb->num_mapped_sgs; | ||
138 | total_packet_count = roundup(urb->transfer_buffer_length, | ||
139 | usb_endpoint_maxp(&urb->ep->desc)); | ||
140 | |||
141 | diff --git a/include/linux/usb.h b/include/linux/usb.h | ||
142 | index 1cea207..7626e5a 100644 | ||
143 | --- a/include/linux/usb.h | ||
144 | +++ b/include/linux/usb.h | ||
145 | @@ -1222,6 +1222,7 @@ struct urb { | ||
146 | void *transfer_buffer; /* (in) associated data buffer */ | ||
147 | dma_addr_t transfer_dma; /* (in) dma addr for transfer_buffer */ | ||
148 | struct scatterlist *sg; /* (in) scatter gather buffer list */ | ||
149 | + int num_mapped_sgs; /* (internal) mapped sg entries */ | ||
150 | int num_sgs; /* (in) number of entries in the sg list */ | ||
151 | u32 transfer_buffer_length; /* (in) data buffer length */ | ||
152 | u32 actual_length; /* (return) actual transfer length */ | ||
153 | -- | ||
154 | 1.7.7.4 | ||
155 | |||
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0042-xhci-Properly-handle-COMP_2ND_BW_ERR.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0042-xhci-Properly-handle-COMP_2ND_BW_ERR.patch new file mode 100644 index 00000000..607ae218 --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0042-xhci-Properly-handle-COMP_2ND_BW_ERR.patch | |||
@@ -0,0 +1,62 @@ | |||
1 | From df0f4624e1225d9b7fb4d8934565418c81b42c04 Mon Sep 17 00:00:00 2001 | ||
2 | From: Hans de Goede <hdegoede@redhat.com> | ||
3 | Date: Wed, 4 Jan 2012 23:29:18 +0100 | ||
4 | Subject: [PATCH 42/49] xhci: Properly handle COMP_2ND_BW_ERR | ||
5 | |||
6 | commit 71d85724bdd947a3b42a88d08af79f290a1a767b upstream. | ||
7 | |||
8 | I encountered a result of COMP_2ND_BW_ERR while improving how the pwc | ||
9 | webcam driver handles not having the full usb1 bandwidth available to | ||
10 | itself. | ||
11 | |||
12 | I created the following test setup, a NEC xhci controller with a | ||
13 | single TT USB 2 hub plugged into it, with a usb keyboard and a pwc webcam | ||
14 | plugged into the usb2 hub. This caused the following to show up in dmesg | ||
15 | when trying to stream from the pwc camera at its highest alt setting: | ||
16 | |||
17 | xhci_hcd 0000:01:00.0: ERROR: unexpected command completion code 0x23. | ||
18 | usb 6-2.1: Not enough bandwidth for altsetting 9 | ||
19 | |||
20 | And usb_set_interface returned -EINVAL, which caused my pwc code to not | ||
21 | do the right thing as it expected -ENOSPC. | ||
22 | |||
23 | This patch makes the xhci driver properly handle COMP_2ND_BW_ERR and makes | ||
24 | usb_set_interface return -ENOSPC as expected. | ||
25 | |||
26 | This should be backported to stable kernels as old as 2.6.32. | ||
27 | |||
28 | Signed-off-by: Hans de Goede <hdegoede@redhat.com> | ||
29 | Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com> | ||
30 | Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> | ||
31 | --- | ||
32 | drivers/usb/host/xhci.c | 1 + | ||
33 | drivers/usb/host/xhci.h | 1 - | ||
34 | 2 files changed, 1 insertions(+), 1 deletions(-) | ||
35 | |||
36 | diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c | ||
37 | index a1afb7c..36f9dd8 100644 | ||
38 | --- a/drivers/usb/host/xhci.c | ||
39 | +++ b/drivers/usb/host/xhci.c | ||
40 | @@ -1620,6 +1620,7 @@ static int xhci_configure_endpoint_result(struct xhci_hcd *xhci, | ||
41 | /* FIXME: can we allocate more resources for the HC? */ | ||
42 | break; | ||
43 | case COMP_BW_ERR: | ||
44 | + case COMP_2ND_BW_ERR: | ||
45 | dev_warn(&udev->dev, "Not enough bandwidth " | ||
46 | "for new device state.\n"); | ||
47 | ret = -ENOSPC; | ||
48 | diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h | ||
49 | index 3c8fbd2..09eda3a 100644 | ||
50 | --- a/drivers/usb/host/xhci.h | ||
51 | +++ b/drivers/usb/host/xhci.h | ||
52 | @@ -1033,7 +1033,6 @@ struct xhci_transfer_event { | ||
53 | /* Invalid Stream ID Error */ | ||
54 | #define COMP_STRID_ERR 34 | ||
55 | /* Secondary Bandwidth Error - may be returned by a Configure Endpoint cmd */ | ||
56 | -/* FIXME - check for this */ | ||
57 | #define COMP_2ND_BW_ERR 35 | ||
58 | /* Split Transaction Error */ | ||
59 | #define COMP_SPLIT_ERR 36 | ||
60 | -- | ||
61 | 1.7.7.4 | ||
62 | |||
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0043-usb-ch9-fix-up-MaxStreams-helper.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0043-usb-ch9-fix-up-MaxStreams-helper.patch new file mode 100644 index 00000000..a96c3724 --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0043-usb-ch9-fix-up-MaxStreams-helper.patch | |||
@@ -0,0 +1,81 @@ | |||
1 | From db46f35cb2853ffa42157c7222335cae15eda7e0 Mon Sep 17 00:00:00 2001 | ||
2 | From: Felipe Balbi <balbi@ti.com> | ||
3 | Date: Mon, 2 Jan 2012 13:35:41 +0200 | ||
4 | Subject: [PATCH 43/49] usb: ch9: fix up MaxStreams helper | ||
5 | |||
6 | commit 18b7ede5f7ee2092aedcb578d3ac30bd5d4fc23c upstream. | ||
7 | |||
8 | [ removed the dwc3 portion of the patch as it didn't apply to | ||
9 | older kernels - gregkh] | ||
10 | |||
11 | According to USB 3.0 Specification Table 9-22, if | ||
12 | bmAttributes [4:0] are set to zero, it means "no | ||
13 | streams supported", but the way this helper was | ||
14 | defined on Linux, we will *always* have one stream | ||
15 | which might cause several problems. | ||
16 | |||
17 | For example on DWC3, we would tell the controller | ||
18 | endpoint has streams enabled and yet start transfers | ||
19 | with Stream ID set to 0, which would goof up the host | ||
20 | side. | ||
21 | |||
22 | While doing that, convert the macro to an inline | ||
23 | function due to the different checks we now need. | ||
24 | |||
25 | Signed-off-by: Felipe Balbi <balbi@ti.com> | ||
26 | Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com> | ||
27 | Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> | ||
28 | --- | ||
29 | drivers/usb/host/xhci.c | 3 +-- | ||
30 | include/linux/usb/ch9.h | 20 +++++++++++++++++++- | ||
31 | 2 files changed, 20 insertions(+), 3 deletions(-) | ||
32 | |||
33 | diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c | ||
34 | index 36f9dd8..b33f059 100644 | ||
35 | --- a/drivers/usb/host/xhci.c | ||
36 | +++ b/drivers/usb/host/xhci.c | ||
37 | @@ -2797,8 +2797,7 @@ static int xhci_calculate_streams_and_bitmask(struct xhci_hcd *xhci, | ||
38 | if (ret < 0) | ||
39 | return ret; | ||
40 | |||
41 | - max_streams = USB_SS_MAX_STREAMS( | ||
42 | - eps[i]->ss_ep_comp.bmAttributes); | ||
43 | + max_streams = usb_ss_max_streams(&eps[i]->ss_ep_comp); | ||
44 | if (max_streams < (*num_streams - 1)) { | ||
45 | xhci_dbg(xhci, "Ep 0x%x only supports %u stream IDs.\n", | ||
46 | eps[i]->desc.bEndpointAddress, | ||
47 | diff --git a/include/linux/usb/ch9.h b/include/linux/usb/ch9.h | ||
48 | index d5da6c6..61b2905 100644 | ||
49 | --- a/include/linux/usb/ch9.h | ||
50 | +++ b/include/linux/usb/ch9.h | ||
51 | @@ -605,8 +605,26 @@ struct usb_ss_ep_comp_descriptor { | ||
52 | } __attribute__ ((packed)); | ||
53 | |||
54 | #define USB_DT_SS_EP_COMP_SIZE 6 | ||
55 | + | ||
56 | /* Bits 4:0 of bmAttributes if this is a bulk endpoint */ | ||
57 | -#define USB_SS_MAX_STREAMS(p) (1 << ((p) & 0x1f)) | ||
58 | +static inline int | ||
59 | +usb_ss_max_streams(const struct usb_ss_ep_comp_descriptor *comp) | ||
60 | +{ | ||
61 | + int max_streams; | ||
62 | + | ||
63 | + if (!comp) | ||
64 | + return 0; | ||
65 | + | ||
66 | + max_streams = comp->bmAttributes & 0x1f; | ||
67 | + | ||
68 | + if (!max_streams) | ||
69 | + return 0; | ||
70 | + | ||
71 | + max_streams = 1 << max_streams; | ||
72 | + | ||
73 | + return max_streams; | ||
74 | +} | ||
75 | + | ||
76 | /* Bits 1:0 of bmAttributes if this is an isoc endpoint */ | ||
77 | #define USB_SS_MULT(p) (1 + ((p) & 0x3)) | ||
78 | |||
79 | -- | ||
80 | 1.7.7.4 | ||
81 | |||
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0044-igmp-Avoid-zero-delay-when-receiving-odd-mixture-of-.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0044-igmp-Avoid-zero-delay-when-receiving-odd-mixture-of-.patch new file mode 100644 index 00000000..d7403535 --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0044-igmp-Avoid-zero-delay-when-receiving-odd-mixture-of-.patch | |||
@@ -0,0 +1,37 @@ | |||
1 | From 53876956cbd176ad0da89ca8e066202f6c143ea8 Mon Sep 17 00:00:00 2001 | ||
2 | From: Ben Hutchings <ben@decadent.org.uk> | ||
3 | Date: Mon, 9 Jan 2012 14:06:46 -0800 | ||
4 | Subject: [PATCH 44/49] igmp: Avoid zero delay when receiving odd mixture of | ||
5 | IGMP queries | ||
6 | |||
7 | commit a8c1f65c79cbbb2f7da782d4c9d15639a9b94b27 upstream. | ||
8 | |||
9 | Commit 5b7c84066733c5dfb0e4016d939757b38de189e4 ('ipv4: correct IGMP | ||
10 | behavior on v3 query during v2-compatibility mode') added yet another | ||
11 | case for query parsing, which can result in max_delay = 0. Substitute | ||
12 | a value of 1, as in the usual v3 case. | ||
13 | |||
14 | Reported-by: Simon McVittie <smcv@debian.org> | ||
15 | References: http://bugs.debian.org/654876 | ||
16 | Signed-off-by: Ben Hutchings <ben@decadent.org.uk> | ||
17 | Signed-off-by: David S. Miller <davem@davemloft.net> | ||
18 | --- | ||
19 | net/ipv4/igmp.c | 2 ++ | ||
20 | 1 files changed, 2 insertions(+), 0 deletions(-) | ||
21 | |||
22 | diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c | ||
23 | index b2ca095..c3cc64c 100644 | ||
24 | --- a/net/ipv4/igmp.c | ||
25 | +++ b/net/ipv4/igmp.c | ||
26 | @@ -875,6 +875,8 @@ static void igmp_heard_query(struct in_device *in_dev, struct sk_buff *skb, | ||
27 | * to be intended in a v3 query. | ||
28 | */ | ||
29 | max_delay = IGMPV3_MRC(ih3->code)*(HZ/IGMP_TIMER_SCALE); | ||
30 | + if (!max_delay) | ||
31 | + max_delay = 1; /* can't mod w/ 0 */ | ||
32 | } else { /* v3 */ | ||
33 | if (!pskb_may_pull(skb, sizeof(struct igmpv3_query))) | ||
34 | return; | ||
35 | -- | ||
36 | 1.7.7.4 | ||
37 | |||
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0045-asix-fix-infinite-loop-in-rx_fixup.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0045-asix-fix-infinite-loop-in-rx_fixup.patch new file mode 100644 index 00000000..93da6cde --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0045-asix-fix-infinite-loop-in-rx_fixup.patch | |||
@@ -0,0 +1,38 @@ | |||
1 | From eaa03e7a01f7dd67773c27e82d446a44440843a6 Mon Sep 17 00:00:00 2001 | ||
2 | From: Aurelien Jacobs <aurel@gnuage.org> | ||
3 | Date: Sat, 7 Jan 2012 12:15:16 -0800 | ||
4 | Subject: [PATCH 45/49] asix: fix infinite loop in rx_fixup() | ||
5 | |||
6 | commit 6c15d74defd38e7e7f8805392578b7a1d508097e upstream. | ||
7 | |||
8 | At this point if skb->len happens to be 2, the subsequant skb_pull(skb, 4) | ||
9 | call won't work and the skb->len won't be decreased and won't ever reach 0, | ||
10 | resulting in an infinite loop. | ||
11 | |||
12 | With an ASIX 88772 under heavy load, without this patch, rx_fixup() reaches | ||
13 | an infinite loop in less than a minute. With this patch applied, | ||
14 | no infinite loop even after hours of heavy load. | ||
15 | |||
16 | Signed-off-by: Aurelien Jacobs <aurel@gnuage.org> | ||
17 | Cc: Jussi Kivilinna <jussi.kivilinna@mbnet.fi> | ||
18 | Signed-off-by: David S. Miller <davem@davemloft.net> | ||
19 | --- | ||
20 | drivers/net/usb/asix.c | 2 +- | ||
21 | 1 files changed, 1 insertions(+), 1 deletions(-) | ||
22 | |||
23 | diff --git a/drivers/net/usb/asix.c b/drivers/net/usb/asix.c | ||
24 | index e95f0e6..dd2625a 100644 | ||
25 | --- a/drivers/net/usb/asix.c | ||
26 | +++ b/drivers/net/usb/asix.c | ||
27 | @@ -376,7 +376,7 @@ static int asix_rx_fixup(struct usbnet *dev, struct sk_buff *skb) | ||
28 | |||
29 | skb_pull(skb, (size + 1) & 0xfffe); | ||
30 | |||
31 | - if (skb->len == 0) | ||
32 | + if (skb->len < sizeof(header)) | ||
33 | break; | ||
34 | |||
35 | head = (u8 *) skb->data; | ||
36 | -- | ||
37 | 1.7.7.4 | ||
38 | |||
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0046-bonding-fix-error-handling-if-slave-is-busy-v2.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0046-bonding-fix-error-handling-if-slave-is-busy-v2.patch new file mode 100644 index 00000000..7b7e03a2 --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0046-bonding-fix-error-handling-if-slave-is-busy-v2.patch | |||
@@ -0,0 +1,68 @@ | |||
1 | From b40864c73fef3aefced0863fc2b3c3a7716d9f09 Mon Sep 17 00:00:00 2001 | ||
2 | From: stephen hemminger <shemminger@vyatta.com> | ||
3 | Date: Sat, 31 Dec 2011 13:26:46 +0000 | ||
4 | Subject: [PATCH 46/49] bonding: fix error handling if slave is busy (v2) | ||
5 | MIME-Version: 1.0 | ||
6 | Content-Type: text/plain; charset=UTF-8 | ||
7 | Content-Transfer-Encoding: 8bit | ||
8 | |||
9 | commit f7d9821a6a9c83450ac35e76d3709e32fd38b76f upstream. | ||
10 | |||
11 | If slave device already has a receive handler registered, then the | ||
12 | error unwind of bonding device enslave function is broken. | ||
13 | |||
14 | The following will leave a pointer to freed memory in the slave | ||
15 | device list, causing a later kernel panic. | ||
16 | # modprobe dummy | ||
17 | # ip li add dummy0-1 link dummy0 type macvlan | ||
18 | # modprobe bonding | ||
19 | # echo +dummy0 >/sys/class/net/bond0/bonding/slaves | ||
20 | |||
21 | The fix is to detach the slave (which removes it from the list) | ||
22 | in the unwind path. | ||
23 | |||
24 | Signed-off-by: Stephen Hemminger <shemminger@vyatta.com> | ||
25 | Reviewed-by: Nicolas de Pesloüan <nicolas.2p.debian@free.fr> | ||
26 | Signed-off-by: David S. Miller <davem@davemloft.net> | ||
27 | Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> | ||
28 | --- | ||
29 | drivers/net/bonding/bond_main.c | 9 +++++++-- | ||
30 | 1 files changed, 7 insertions(+), 2 deletions(-) | ||
31 | |||
32 | diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c | ||
33 | index 7f87568..e58aa2b 100644 | ||
34 | --- a/drivers/net/bonding/bond_main.c | ||
35 | +++ b/drivers/net/bonding/bond_main.c | ||
36 | @@ -1822,7 +1822,7 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev) | ||
37 | "but new slave device does not support netpoll.\n", | ||
38 | bond_dev->name); | ||
39 | res = -EBUSY; | ||
40 | - goto err_close; | ||
41 | + goto err_detach; | ||
42 | } | ||
43 | } | ||
44 | #endif | ||
45 | @@ -1831,7 +1831,7 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev) | ||
46 | |||
47 | res = bond_create_slave_symlinks(bond_dev, slave_dev); | ||
48 | if (res) | ||
49 | - goto err_close; | ||
50 | + goto err_detach; | ||
51 | |||
52 | res = netdev_rx_handler_register(slave_dev, bond_handle_frame, | ||
53 | new_slave); | ||
54 | @@ -1852,6 +1852,11 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev) | ||
55 | err_dest_symlinks: | ||
56 | bond_destroy_slave_symlinks(bond_dev, slave_dev); | ||
57 | |||
58 | +err_detach: | ||
59 | + write_lock_bh(&bond->lock); | ||
60 | + bond_detach_slave(bond, new_slave); | ||
61 | + write_unlock_bh(&bond->lock); | ||
62 | + | ||
63 | err_close: | ||
64 | dev_close(slave_dev); | ||
65 | |||
66 | -- | ||
67 | 1.7.7.4 | ||
68 | |||
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0047-usb-cdc-acm-Fix-acm_tty_hangup-vs.-acm_tty_close-rac.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0047-usb-cdc-acm-Fix-acm_tty_hangup-vs.-acm_tty_close-rac.patch new file mode 100644 index 00000000..f9363aaa --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0047-usb-cdc-acm-Fix-acm_tty_hangup-vs.-acm_tty_close-rac.patch | |||
@@ -0,0 +1,54 @@ | |||
1 | From 9d3898fe46309ee5688697d1a65975208dc49639 Mon Sep 17 00:00:00 2001 | ||
2 | From: Thilo-Alexander Ginkel <thilo@ginkel.com> | ||
3 | Date: Sat, 17 Dec 2011 10:55:10 +0100 | ||
4 | Subject: [PATCH 47/49] usb: cdc-acm: Fix acm_tty_hangup() vs. acm_tty_close() | ||
5 | race | ||
6 | |||
7 | [Not upstream as it was fixed differently for 3.3 with a much more | ||
8 | "intrusive" rework of the driver - gregkh] | ||
9 | |||
10 | There is a race condition involving acm_tty_hangup() and acm_tty_close() | ||
11 | where hangup() would attempt to access tty->driver_data without proper | ||
12 | locking and NULL checking after close() has potentially already set it | ||
13 | to NULL. One possibility to (sporadically) trigger this behavior is to | ||
14 | perform a suspend/resume cycle with a running WWAN data connection. | ||
15 | |||
16 | This patch addresses the issue by introducing a NULL check for | ||
17 | tty->driver_data in acm_tty_hangup() protected by open_mutex and exiting | ||
18 | gracefully when hangup() is invoked on a device that has already been | ||
19 | closed. | ||
20 | |||
21 | Signed-off-by: Thilo-Alexander Ginkel <thilo@ginkel.com> | ||
22 | Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> | ||
23 | --- | ||
24 | drivers/usb/class/cdc-acm.c | 12 ++++++++++-- | ||
25 | 1 files changed, 10 insertions(+), 2 deletions(-) | ||
26 | |||
27 | diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c | ||
28 | index ea5e487..e61d9c4 100644 | ||
29 | --- a/drivers/usb/class/cdc-acm.c | ||
30 | +++ b/drivers/usb/class/cdc-acm.c | ||
31 | @@ -554,10 +554,18 @@ static void acm_port_down(struct acm *acm) | ||
32 | |||
33 | static void acm_tty_hangup(struct tty_struct *tty) | ||
34 | { | ||
35 | - struct acm *acm = tty->driver_data; | ||
36 | - tty_port_hangup(&acm->port); | ||
37 | + struct acm *acm; | ||
38 | + | ||
39 | mutex_lock(&open_mutex); | ||
40 | + acm = tty->driver_data; | ||
41 | + | ||
42 | + if (!acm) | ||
43 | + goto out; | ||
44 | + | ||
45 | + tty_port_hangup(&acm->port); | ||
46 | acm_port_down(acm); | ||
47 | + | ||
48 | +out: | ||
49 | mutex_unlock(&open_mutex); | ||
50 | } | ||
51 | |||
52 | -- | ||
53 | 1.7.7.4 | ||
54 | |||
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0048-xfs-fix-acl-count-validation-in-xfs_acl_from_disk.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0048-xfs-fix-acl-count-validation-in-xfs_acl_from_disk.patch new file mode 100644 index 00000000..1ddf63dc --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0048-xfs-fix-acl-count-validation-in-xfs_acl_from_disk.patch | |||
@@ -0,0 +1,34 @@ | |||
1 | From 5af63c5af9a335ff2af8d6b84d512e92ac522995 Mon Sep 17 00:00:00 2001 | ||
2 | From: Xi Wang <xi.wang@gmail.com> | ||
3 | Date: Mon, 12 Dec 2011 21:55:52 +0000 | ||
4 | Subject: [PATCH 48/49] xfs: fix acl count validation in xfs_acl_from_disk() | ||
5 | |||
6 | commit 093019cf1b18dd31b2c3b77acce4e000e2cbc9ce upstream. | ||
7 | |||
8 | Commit fa8b18ed didn't prevent the integer overflow and possible | ||
9 | memory corruption. "count" can go negative and bypass the check. | ||
10 | |||
11 | Signed-off-by: Xi Wang <xi.wang@gmail.com> | ||
12 | Reviewed-by: Christoph Hellwig <hch@lst.de> | ||
13 | Signed-off-by: Ben Myers <bpm@sgi.com> | ||
14 | Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> | ||
15 | --- | ||
16 | fs/xfs/xfs_acl.c | 2 +- | ||
17 | 1 files changed, 1 insertions(+), 1 deletions(-) | ||
18 | |||
19 | diff --git a/fs/xfs/xfs_acl.c b/fs/xfs/xfs_acl.c | ||
20 | index 76e4266..ac702a6 100644 | ||
21 | --- a/fs/xfs/xfs_acl.c | ||
22 | +++ b/fs/xfs/xfs_acl.c | ||
23 | @@ -39,7 +39,7 @@ xfs_acl_from_disk(struct xfs_acl *aclp) | ||
24 | struct posix_acl_entry *acl_e; | ||
25 | struct posix_acl *acl; | ||
26 | struct xfs_acl_entry *ace; | ||
27 | - int count, i; | ||
28 | + unsigned int count, i; | ||
29 | |||
30 | count = be32_to_cpu(aclp->acl_cnt); | ||
31 | if (count > XFS_ACL_MAX_ENTRIES) | ||
32 | -- | ||
33 | 1.7.7.4 | ||
34 | |||
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0049-Linux-3.2.1.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0049-Linux-3.2.1.patch new file mode 100644 index 00000000..37c5764f --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0049-Linux-3.2.1.patch | |||
@@ -0,0 +1,24 @@ | |||
1 | From 78d772bb92fa633fc41d234887b050dce88542bc Mon Sep 17 00:00:00 2001 | ||
2 | From: Greg Kroah-Hartman <gregkh@suse.de> | ||
3 | Date: Thu, 12 Jan 2012 11:42:45 -0800 | ||
4 | Subject: [PATCH 49/49] Linux 3.2.1 | ||
5 | |||
6 | --- | ||
7 | Makefile | 2 +- | ||
8 | 1 files changed, 1 insertions(+), 1 deletions(-) | ||
9 | |||
10 | diff --git a/Makefile b/Makefile | ||
11 | index adddd11..c5edffa 100644 | ||
12 | --- a/Makefile | ||
13 | +++ b/Makefile | ||
14 | @@ -1,6 +1,6 @@ | ||
15 | VERSION = 3 | ||
16 | PATCHLEVEL = 2 | ||
17 | -SUBLEVEL = 0 | ||
18 | +SUBLEVEL = 1 | ||
19 | EXTRAVERSION = | ||
20 | NAME = Saber-toothed Squirrel | ||
21 | |||
22 | -- | ||
23 | 1.7.7.4 | ||
24 | |||