[git pull] Please pull powerpc.git next branch

2014-06-06 Thread Benjamin Herrenschmidt
Hi Linus !

Here is the bulk of the powerpc changes for this merge window. It got a bit
delayed in part because I wasn't paying attention, and in part because I
discovered I had a core PCI change without a PCI maintainer ack in it. Bjorn
eventually agreed it was ok to merge it though we'll probably improve it
later and I didn't want to rebase to add his ack.

There is going to be a bit more next week, essentially fixes that I still
want to sort through and test.

The biggest item this time is the support to build the ppc64 LE kernel
with our new v2 ABI. We previously supported v2 userspace but the kernel
itself was a tougher nut to crack. This is now sorted mostly thanks to Anton
and Rusty.

We also have a fairly big series from Cedric that add support for 64-bit
LE zImage boot wrapper. This was made harder by the fact that traditionally
our zImage wrapper was always 32-bit, but our new LE toolchains don't really
support 32-bit anymore (it's somewhat there but not really "supported") so
we didn't want to rely on it. This meant more churn that just endian fixes.

This brings some more LE bits as well, such as the ability to run in LE mode
without a hypervisor (ie. under OPAL firmware) by doing the right OPAL call
to reinitialize the CPU to take HV interrupts in the right mode and the usual
pile of endian fixes. 

There's another series from Gavin adding EEH improvements (one day we *will*
have a release with less than 20 EEH patches, I promise !).

Another highlight is the support for the "Split core" functionality on P8
by Michael. This allows a P8 core to be split into "sub cores" of 4 threads
which allows the subcores to run different guests under KVM (the HW still
doesn't support a partition per thread).

And then the usual misc bits and fixes ...

Cheers,
Ben.

The following changes since commit 011e4b02f1da156ac7fea28a9da878f3c23af739:

  powerpc, kexec: Fix "Processor X is stuck" issue during kexec from ST mode 
(2014-05-28 13:24:26 +1000)

are available in the git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc.git next

for you to fetch changes up to 0c0a3e5a100bbc4aaedd140e82b429227a76701b:

  powerpc/powernv: Add missing include to LPC code (2014-06-07 08:57:21 +1000)


Alexander Graf (2):
  powerpc: Use 64k io pages when we never see an HEA
  PPC: ePAPR: Fix hypercall on LE guest

Alistair Popple (4):
  IBM Currituck: Clean up board specific code before adding Akebono code
  IBM Akebono: Add the Akebono platform
  powerpc: Added PCI MSI support using the HSTA module
  ppc476: Enable a linker work around for IBM errata #46

Andrew Murray (1):
  powerpc/pci: Use of_pci_range_parser helper in 
pci_process_bridge_OF_ranges

Anton Blanchard (36):
  powerpc: Don't build assembly files with ABIv2
  powerpc: No need to use dot symbols when branching to a function
  powerpc: Remove superflous function descriptors in assembly only code
  powerpc: Don't use a function descriptor for system call table
  powerpc: Remove some unnecessary uses of _GLOBAL() and _STATIC()
  powerpc: Remove _INIT_GLOBAL(), _STATIC() and _INIT_STATIC()
  powerpc: Remove dot symbol usage in exception macros
  powerpc: Create DOTSYM to wrap dot symbol usage
  powerpc: Remove function descriptors and dot symbols on new ABI
  powerpc: ABIv2 function calls must place target address in r12
  powerpc: Ignore .TOC. relocations
  powerpc: Add ABIv2 support to ppc_function_entry
  powerpc: Use ppc_function_entry instead of open coding it
  powerpc: Fix branch patching code for ABIv2
  powerpc: Fix kernel thread creation on ABIv2
  powerpc: Fix ABIv2 issues with stack offsets in assembly code
  powerpc/tm: Use STK_PARAM
  powerpc/tm: Fix GOT save offset for ABIv2
  powerpc/tracing: TRACE_WITH_FRAME_BUFFER creates invalid stack frames
  powerpc: Fix SMP issues with ppc64le ABIv2
  powerpc: Fix ABIv2 issue with dereference_function_descriptor
  powerpc: Add _GLOBAL_TOC for ABIv2 assembly functions exported to modules
  powerpc: ftrace_caller, _mcount is exported to modules so needs 
_GLOBAL_TOC()
  powerpc/kprobes: Fix ABIv2 issues with kprobe_lookup_name
  powerpc/modules: Create is_module_trampoline()
  powerpc/modules: Create module_trampoline_target()
  powerpc/ftrace: Use module loader helpers to parse trampolines
  powerpc/ftrace: Fix ABIv2 issues with __ftrace_make_call
  powerpc: Build little endian ppc64 kernel with ABIv2
  selftests/powerpc: Update for ABIv2
  powerpc: 64bit sendfile is capped at 2GB
  powerpc/powernv: Fix endian issues in memory error handling code
  powerpc: Allow ppc_md platform hook to override memory_block_size_bytes
  powerpc/powernv: Set memory_block_size_bytes to 256MB
  powerpc: Exported functions __clear_user and copy_page use r2 so need 

[PATCH 2/2] rsi_91x_sdio: add error handling into rsi_module_init()

2014-06-06 Thread Alexey Khoroshilov
Fix rsi_module_init() to propagate sdio_register_driver() errors.

Signed-off-by: Alexey Khoroshilov 
---
 drivers/net/wireless/rsi/rsi_91x_sdio.c | 6 --
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/rsi/rsi_91x_sdio.c 
b/drivers/net/wireless/rsi/rsi_91x_sdio.c
index 2e39d38d6a9e..f2991682a66a 100644
--- a/drivers/net/wireless/rsi/rsi_91x_sdio.c
+++ b/drivers/net/wireless/rsi/rsi_91x_sdio.c
@@ -822,9 +822,11 @@ static struct sdio_driver rsi_driver = {
  */
 static int rsi_module_init(void)
 {
-   sdio_register_driver(_driver);
+   int ret;
+
+   ret = sdio_register_driver(_driver);
rsi_dbg(INIT_ZONE, "%s: Registering driver\n", __func__);
-   return 0;
+   return ret;
 }
 
 /**
-- 
1.8.3.2

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 1/2] rsi: Use module_usb_driver

2014-06-06 Thread Alexey Khoroshilov
module_usb_driver eliminates the boilerplate and makes the code simpler,
in addition to the fact currently rsi_module_init() ignores usb_deregister() 
error.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Alexey Khoroshilov 
---
 drivers/net/wireless/rsi/rsi_91x_usb.c | 28 +---
 1 file changed, 1 insertion(+), 27 deletions(-)

diff --git a/drivers/net/wireless/rsi/rsi_91x_usb.c 
b/drivers/net/wireless/rsi/rsi_91x_usb.c
index 4c46e5631e2f..3226f19989e7 100644
--- a/drivers/net/wireless/rsi/rsi_91x_usb.c
+++ b/drivers/net/wireless/rsi/rsi_91x_usb.c
@@ -550,33 +550,7 @@ static struct usb_driver rsi_driver = {
 #endif
 };
 
-/**
- * rsi_module_init() - This function registers the client driver.
- * @void: Void.
- *
- * Return: 0 on success.
- */
-static int rsi_module_init(void)
-{
-   usb_register(_driver);
-   rsi_dbg(INIT_ZONE, "%s: Registering driver\n", __func__);
-   return 0;
-}
-
-/**
- * rsi_module_exit() - This function unregisters the client driver.
- * @void: Void.
- *
- * Return: None.
- */
-static void rsi_module_exit(void)
-{
-   usb_deregister(_driver);
-   rsi_dbg(INFO_ZONE, "%s: Unregistering driver\n", __func__);
-}
-
-module_init(rsi_module_init);
-module_exit(rsi_module_exit);
+module_usb_driver(rsi_driver);
 
 MODULE_AUTHOR("Redpine Signals Inc");
 MODULE_DESCRIPTION("Common USB layer for RSI drivers");
-- 
1.8.3.2

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


Re: [PATCH] x86/dumpstack: Walk frames when built with frame pointers

2014-06-06 Thread H. Peter Anvin
The USB debug port is nice once you get it to work.  Assumes they haven't done 
anything clever like hide the special port behind a hub...

Sent from my tablet, pardon any formatting problems.

> On Jun 6, 2014, at 1:24, Borislav Petkov  wrote:
> 
>> On Fri, Jun 06, 2014 at 10:17:26AM +0200, Peter Zijlstra wrote:
>> Hopefully the EFI pstore thing will work out, but I've already heard
>> that can wear out very quickly and render your machine a brick :-(
> 
> And not only that - write speed is awfully low. I hear you might be ok
> to record an oops or so. Continuous debug output, not so much.
> 
>> Me, I simply refuse to work on machines if they don't have a serial
>> line, but in general that's not a tenable position I suppose :/
> 
> Well, with all the other crap they put in modern machines, how hard it
> is to put a goddam stupid serial line out everywhere...? WTF do I need a
> goddam adaptive keyboard and other idiotic bling-bling if I can't have a
> simple serial line for debugging... Blergh.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


Re: [PATCH] x86/dumpstack: Walk frames when built with frame pointers

2014-06-06 Thread H. Peter Anvin
Yes, but now you need a custom adapter.  Some have used a phono plug for the 
absolute minimum 3 wires.  However, no standards...

Sent from my tablet, pardon any formatting problems.

> On Jun 6, 2014, at 2:35, Peter Zijlstra  wrote:
> 
>> On Fri, Jun 06, 2014 at 10:24:20AM +0200, Borislav Petkov wrote:
>> Well, with all the other crap they put in modern machines, how hard it
>> is to put a goddam stupid serial line out everywhere...? WTF do I need a
>> goddam adaptive keyboard and other idiotic bling-bling if I can't have a
>> simple serial line for debugging... Blergh.
> 
> This DE-9 is not esthetically pleasing :-) They could of course use a
> different connector, its only 5 wires or so iirc.
> 
> 
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH v3] crypto: crc32c-pclmul - Shrink K_table to 32-bit words

2014-06-06 Thread George Spelvin
There's no need for the K_table to be made of 64-bit words.  For some
reason, the original authors didn't fully reduce the values modulo the
CRC32C polynomial, and so had some 33-bit values in there.  They can
all be reduced to 32 bits.

Doing that cuts the table size in half.  Since the code depends on both
pclmulq and crc32, SSE 4.1 is obviously present, so we can use pmovzxdq
to fetch it in the correct format.

This adds (measured on Ivy Bridge) 1 cycle per main loop iteration
(CRC of up to 3K bytes), less than 0.2%.  The hope is that the reduced
D-cache footprint will make up the loss in other code.

Two other related fixes:
* K_table is read-only, so belongs in .rodata, and
* There's no need for more than 8-byte alignment

Acked-by: Tim Chen 
Signed-off-by: George Spelvin 
---
Having been tweaked, benchmarked and acked, I think this is ready to
be merged.

My initial attempts at additional speedups resulted in slowdowns;
apparently Intel coders are fairly good at optimization. :-)

 arch/x86/crypto/crc32c-pcl-intel-asm_64.S | 281 +++---
 1 file changed, 139 insertions(+), 142 deletions(-)

diff --git a/arch/x86/crypto/crc32c-pcl-intel-asm_64.S 
b/arch/x86/crypto/crc32c-pcl-intel-asm_64.S
index dbc4339b..26d49eba 100644
--- a/arch/x86/crypto/crc32c-pcl-intel-asm_64.S
+++ b/arch/x86/crypto/crc32c-pcl-intel-asm_64.S
@@ -72,6 +72,7 @@
 
 # unsigned int crc_pcl(u8 *buffer, int len, unsigned int crc_init);
 
+.text
 ENTRY(crc_pcl)
 #definebufp%rdi
 #definebufp_dw %edi
@@ -216,15 +217,11 @@ LABEL crc_ %i
## 4) Combine three results:

 
-   lea (K_table-16)(%rip), bufp# first entry is for idx 1
+   lea (K_table-8)(%rip), bufp # first entry is for idx 1
shlq$3, %rax# rax *= 8
-   subq%rax, tmp   # tmp -= rax*8
-   shlq$1, %rax
-   subq%rax, tmp   # tmp -= rax*16
-   # (total tmp -= rax*24)
-   addq%rax, bufp
-
-   movdqa  (bufp), %xmm0   # 2 consts: K1:K2
+   pmovzxdq (bufp,%rax), %xmm0 # 2 consts: K1:K2
+   leal(%eax,%eax,2), %eax # rax *= 3 (total *24)
+   subq%rax, tmp   # tmp -= rax*24
 
movqcrc_init, %xmm1 # CRC for block 1
PCLMULQDQ 0x00,%xmm0,%xmm1  # Multiply by K2
@@ -238,9 +235,9 @@ LABEL crc_ %i
mov crc2, crc_init
crc32   %rax, crc_init
 
-
-## 5) Check for end:
-
+   
+   ## 5) Check for end:
+   
 
 LABEL crc_ 0
mov tmp, len
@@ -331,136 +328,136 @@ ENDPROC(crc_pcl)
 

## PCLMULQDQ tables
-   ## Table is 128 entries x 2 quad words each
+   ## Table is 128 entries x 2 words (8 bytes) each

-.data
-.align 64
+.section   .rotata, "a", %progbits
+.align 8
 K_table:
-.quad 0x14cd00bd6,0x105ec76f0
-.quad 0x0ba4fc28e,0x14cd00bd6
-.quad 0x1d82c63da,0x0f20c0dfe
-.quad 0x09e4addf8,0x0ba4fc28e
-.quad 0x039d3b296,0x1384aa63a
-.quad 0x102f9b8a2,0x1d82c63da
-.quad 0x14237f5e6,0x01c291d04
-.quad 0x00d3b6092,0x09e4addf8
-.quad 0x0c96cfdc0,0x0740eef02
-.quad 0x18266e456,0x039d3b296
-.quad 0x0daece73e,0x0083a6eec
-.quad 0x0ab7aff2a,0x102f9b8a2
-.quad 0x1248ea574,0x1c1733996
-.quad 0x083348832,0x14237f5e6
-.quad 0x12c743124,0x02ad91c30
-.quad 0x0b9e02b86,0x00d3b6092
-.quad 0x018b33a4e,0x06992cea2
-.quad 0x1b331e26a,0x0c96cfdc0
-.quad 0x17d35ba46,0x07e908048
-.quad 0x1bf2e8b8a,0x18266e456
-.quad 0x1a3e0968a,0x11ed1f9d8
-.quad 0x0ce7f39f4,0x0daece73e
-.quad 0x061d82e56,0x0f1d0f55e
-.quad 0x0d270f1a2,0x0ab7aff2a
-.quad 0x1c3f5f66c,0x0a87ab8a8
-.quad 0x12ed0daac,0x1248ea574
-.quad 0x065863b64,0x08462d800
-.quad 0x11eef4f8e,0x083348832
-.quad 0x1ee54f54c,0x071d111a8
-.quad 0x0b3e32c28,0x12c743124
-.quad 0x0064f7f26,0x0ffd852c6
-.quad 0x0dd7e3b0c,0x0b9e02b86
-.quad 0x0f285651c,0x0dcb17aa4
-.quad 0x010746f3c,0x018b33a4e
-.quad 0x1c24afea4,0x0f37c5aee
-.quad 0x0271d9844,0x1b331e26a
-.quad 0x08e766a0c,0x06051d5a2
-.quad 0x093a5f730,0x17d35ba46
-.quad 0x06cb08e5c,0x11d5ca20e
-.quad 0x06b749fb2,0x1bf2e8b8a
-

[PATCH v2 3/5] staging: ft1000: ft1000-usb: ft1000_debug.c: Remove unnecessary whitespace.

2014-06-06 Thread Thomas Wood
Remove whitespace before a quoted newline.
Remove space between function name and it's parameter list.

Signed-off-by: Thomas Wood 
---
 drivers/staging/ft1000/ft1000-usb/ft1000_debug.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/staging/ft1000/ft1000-usb/ft1000_debug.c 
b/drivers/staging/ft1000/ft1000-usb/ft1000_debug.c
index 1395c2b..5e371b7 100644
--- a/drivers/staging/ft1000/ft1000-usb/ft1000_debug.c
+++ b/drivers/staging/ft1000/ft1000-usb/ft1000_debug.c
@@ -556,7 +556,7 @@ static long ft1000_ioctl(struct file *file, unsigned int 
command,
 
if (info->CardReady) {
 
-   /* DEBUG("FT1000:ft1000_ioctl: try to SET_DPRAM 
\n"); */
+   /* DEBUG("FT1000:ft1000_ioctl: try to 
SET_DPRAM\n"); */
 
/* Get the length field to see how many bytes 
to copy */
result = get_user(msgsz, (__u16 __user *)argp);
@@ -712,7 +712,7 @@ static long ft1000_ioctl(struct file *file, unsigned int 
command,
break;
msglen = htons(msglen);
/* DEBUG("FT1000:ft1000_ioctl:msg length = 
%x\n", msglen); */
-   if (copy_to_user (_dpram->pseudohdr, 
pdpram_blk->pbuffer, msglen)) {
+   if (copy_to_user(_dpram->pseudohdr, 
pdpram_blk->pbuffer, msglen)) {
DEBUG("FT1000:ft1000_ioctl: copy fault 
occurred\n");
result = -EFAULT;
break;
-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH v2 2/5] staging: ft1000: ft1000-usb: ft1000_debug.c: Add required spaces.

2014-06-06 Thread Thomas Wood
Add spaces around operators, after commas, and between (foo*).

Signed-off-by: Thomas Wood 
---
 drivers/staging/ft1000/ft1000-usb/ft1000_debug.c | 48 
 1 file changed, 24 insertions(+), 24 deletions(-)

diff --git a/drivers/staging/ft1000/ft1000-usb/ft1000_debug.c 
b/drivers/staging/ft1000/ft1000-usb/ft1000_debug.c
index 338f91e..1395c2b 100644
--- a/drivers/staging/ft1000/ft1000-usb/ft1000_debug.c
+++ b/drivers/staging/ft1000/ft1000-usb/ft1000_debug.c
@@ -193,7 +193,7 @@ int ft1000_create_dev(struct ft1000_usb *dev)
 
/* initialize application information */
dev->appcnt = 0;
-   for (i=0; iapp_info[i].nTxMsg = 0;
dev->app_info[i].nRxMsg = 0;
dev->app_info[i].nTxMsgReject = 0;
@@ -260,7 +260,7 @@ void ft1000_destroy_dev(struct net_device *netdev)
dev->DeviceName);
 
/* Make sure we free any memory reserve for slow Queue */
-   for (i=0; iapp_info[i].app_sqlist) == 0) {
pdpram_blk = 
list_entry(dev->app_info[i].app_sqlist.next, struct dpram_blk, list);
list_del(_blk->list);
@@ -301,7 +301,7 @@ static int ft1000_open(struct inode *inode, struct file 
*file)
 {
struct ft1000_info *info;
struct ft1000_usb *dev = (struct ft1000_usb *)inode->i_private;
-   int i,num;
+   int i, num;
 
DEBUG("%s called\n", __func__);
num = (MINOR(inode->i_rdev) & 0xf);
@@ -318,7 +318,7 @@ static int ft1000_open(struct inode *inode, struct file 
*file)
}
 
/* Search for available application info block */
-   for (i=0; iapp_info[i].fileobject == NULL)) {
break;
}
@@ -369,7 +369,7 @@ static unsigned int ft1000_poll_dev(struct file *file, 
poll_table *wait)
}
 
/* Search for matching file object */
-   for (i=0; iapp_info[i].fileobject == >f_owner) {
/* DEBUG("FT1000:ft1000_ioctl: Message is for AppId = 
%d\n", dev->app_info[i].app_id); */
break;
@@ -411,7 +411,7 @@ static long ft1000_ioctl(struct file *file, unsigned int 
command,
void __user *argp = (void __user *)argument;
struct ft1000_info *info;
struct ft1000_usb *ft1000dev;
-   int result=0;
+   int result = 0;
int cmd;
int i;
u16 tempword;
@@ -419,15 +419,15 @@ static long ft1000_ioctl(struct file *file, unsigned int 
command,
struct timeval tv;
struct IOCTL_GET_VER get_ver_data;
struct IOCTL_GET_DSP_STAT get_stat_data;
-   u8 ConnectionMsg[] = 
{0x00,0x44,0x10,0x20,0x80,0x00,0x00,0x00,0x00,0x00,0x03,0x00,0x00,0x00,0x93,0x64,
- 
0x00,0x00,0x02,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x05,0x00,0x00,0x00,0x0a,
- 
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x02,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
- 
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x12,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
- 
0x00,0x00,0x02,0x37,0x00,0x00,0x00,0x08,0x00,0x00,0x00,0x01,0x00,0x01,0x7f,0x00,
- 0x00,0x01,0x00,0x00};
+   u8 ConnectionMsg[] = {0x00, 0x44, 0x10, 0x20, 0x80, 0x00, 0x00, 0x00, 
0x00, 0x00, 0x03, 0x00, 0x00, 0x00, 0x93, 0x64,
+ 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 
0x00, 0x00, 0x00, 0x05, 0x00, 0x00, 0x00, 0x0a,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x12, 
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x02, 0x37, 0x00, 0x00, 0x00, 0x08, 
0x00, 0x00, 0x00, 0x01, 0x00, 0x01, 0x7f, 0x00,
+ 0x00, 0x01, 0x00, 0x00};
 
-   unsigned short ledStat=0;
-   unsigned short conStat=0;
+   unsigned short ledStat = 0;
+   unsigned short conStat = 0;
 
/* DEBUG("ft1000_ioctl called\n"); */
 
@@ -447,14 +447,14 @@ static long ft1000_ioctl(struct file *file, unsigned int 
command,
switch (cmd) {
case IOCTL_REGISTER_CMD:
DEBUG("FT1000:ft1000_ioctl: IOCTL_FT1000_REGISTER called\n");
-   result = get_user(tempword, (__u16 __user*)argp);
+   result = get_user(tempword, (__u16 __user *)argp);
if (result) {
DEBUG("result = %d failed to get_user\n", result);
break;
}
if (tempword == DSPBCMSGID) {
/* Search for matching file object */
-   for (i=0; iapp_info[i].fileobject == 
>f_owner) {
ft1000dev->app_info[i].DspBCMsgFlag = 1;
DEBUG("FT1000:ft1000_ioctl:Registered 
for broadcast 

[PATCH v2 4/5] staging: ft1000: ft1000-usb: ft1000_debug.c: Remove unnecessary braces.

2014-06-06 Thread Thomas Wood
Remove unnecessary braces from single statement if blocks.

Signed-off-by: Thomas Wood 
---
 drivers/staging/ft1000/ft1000-usb/ft1000_debug.c | 21 +++--
 1 file changed, 7 insertions(+), 14 deletions(-)

diff --git a/drivers/staging/ft1000/ft1000-usb/ft1000_debug.c 
b/drivers/staging/ft1000/ft1000-usb/ft1000_debug.c
index 5e371b7..94fb9f9 100644
--- a/drivers/staging/ft1000/ft1000-usb/ft1000_debug.c
+++ b/drivers/staging/ft1000/ft1000-usb/ft1000_debug.c
@@ -319,9 +319,8 @@ static int ft1000_open(struct inode *inode, struct file 
*file)
 
/* Search for available application info block */
for (i = 0; i < MAX_NUM_APP; i++) {
-   if ((dev->app_info[i].fileobject == NULL)) {
+   if ((dev->app_info[i].fileobject == NULL))
break;
-   }
}
 
/* Fail due to lack of application info block */
@@ -540,17 +539,14 @@ static long ft1000_ioctl(struct file *file, unsigned int 
command,
/* DEBUG("FT1000:ft1000_ioctl: IOCTL_FT1000_SET_DPRAM 
called\n");*/
 
 
-   if (ft1000_flarion_cnt == 0) {
+   if (ft1000_flarion_cnt == 0)
return (-EBADF);
-   }
 
-   if (ft1000dev->DrvMsgPend) {
+   if (ft1000dev->DrvMsgPend)
return (-ENOTTY);
-   }
 
-   if (ft1000dev->fProvComplete == 0) {
+   if (ft1000dev->fProvComplete == 0)
return (-EACCES);
-   }
 
ft1000dev->fAppMsgPend = 1;
 
@@ -582,9 +578,8 @@ static long ft1000_ioctl(struct file *file, unsigned int 
command,
} else {
/* Check if this message came from a 
registered application */
for (i = 0; i < MAX_NUM_APP; i++) {
-   if 
(ft1000dev->app_info[i].fileobject == >f_owner) {
+   if 
(ft1000dev->app_info[i].fileobject == >f_owner)
break;
-   }
}
if (i == MAX_NUM_APP) {
DEBUG("FT1000:No matching 
application fileobject\n");
@@ -636,9 +631,8 @@ static long ft1000_ioctl(struct file *file, unsigned int 
command,
pmsg = (u16 
*)_data->pseudohdr;
ppseudo_hdr = (struct 
pseudo_hdr *)pmsg;
total_len = msgsz+2;
-   if (total_len & 0x1) {
+   if (total_len & 0x1)
total_len++;
-   }
 
/* Insert slow queue sequence 
number */
ppseudo_hdr->seq_num = 
info->squeseqnum++;
@@ -677,9 +671,8 @@ static long ft1000_ioctl(struct file *file, unsigned int 
command,
 
/* DEBUG("FT1000:ft1000_ioctl: IOCTL_FT1000_GET_DPRAM 
called\n"); */
 
-   if (ft1000_flarion_cnt == 0) {
+   if (ft1000_flarion_cnt == 0)
return (-EBADF);
-   }
 
/* Search for matching file object */
for (i = 0; i < MAX_NUM_APP; i++) {
-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH v2 5/5] staging: ft1000: ft1000-usb: ft1000_debug.c: Misc. fixes.

2014-06-06 Thread Thomas Wood
Remove initialization of static value.
Invert the empty if statement's test to replace the else statement.
Remove parentheses from a return statement.
Fix some code indentation.

Signed-off-by: Thomas Wood 
---

I'm pretty sure that the indentation was caused by a mistake by me earlier on 
in the patch set, so I'm fixing it now.

 drivers/staging/ft1000/ft1000-usb/ft1000_debug.c | 89 
 1 file changed, 44 insertions(+), 45 deletions(-)

diff --git a/drivers/staging/ft1000/ft1000-usb/ft1000_debug.c 
b/drivers/staging/ft1000/ft1000-usb/ft1000_debug.c
index 94fb9f9..ef08db9 100644
--- a/drivers/staging/ft1000/ft1000-usb/ft1000_debug.c
+++ b/drivers/staging/ft1000/ft1000-usb/ft1000_debug.c
@@ -38,7 +38,7 @@
 #include 
 #include "ft1000_usb.h"
 
-static int ft1000_flarion_cnt = 0;
+static int ft1000_flarion_cnt;
 
 static int ft1000_open(struct inode *inode, struct file *file);
 static unsigned int ft1000_poll_dev(struct file *file, poll_table *wait);
@@ -389,7 +389,7 @@ static unsigned int ft1000_poll_dev(struct file *file, 
poll_table *wait)
poll_wait(file, >app_info[i].wait_dpram_msg, wait);
/* DEBUG("FT1000:ft1000_poll_dev:Polling for data from DSP\n"); */
 
-   return (0);
+   return 0;
 }
 
 /*
@@ -592,70 +592,69 @@ static long ft1000_ioctl(struct file *file, unsigned int 
command,
/* Check message qtype type which is 
the lower byte within qos_class */
qtype = 
ntohs(dpram_data->pseudohdr.qos_class) & 0xff;
/* DEBUG("FT1000_ft1000_ioctl: qtype = 
%d\n", qtype); */
-   if (qtype) {
-   } else {
+   if (!qtype) {
/* Put message into Slow Queue 
*/
/* Only put a message into the 
DPRAM if msg doorbell is available */
status = 
ft1000_read_register(ft1000dev, , FT1000_REG_DOORBELL);
/* DEBUG("FT1000_ft1000_ioctl: 
READ REGISTER tempword=%x\n", tempword); */
if (tempword & 
FT1000_DB_DPRAM_TX) {
-   /* Suspend for 2ms and try 
again due to DSP doorbell busy */
-   mdelay(2);
-   status = 
ft1000_read_register(ft1000dev, , FT1000_REG_DOORBELL);
-   if (tempword & 
FT1000_DB_DPRAM_TX) {
-   /* Suspend for 1ms and 
try again due to DSP doorbell busy */
-   mdelay(1);
+   /* Suspend for 2ms and 
try again due to DSP doorbell busy */
+   mdelay(2);
status = 
ft1000_read_register(ft1000dev, , FT1000_REG_DOORBELL);
if (tempword & 
FT1000_DB_DPRAM_TX) {
+   /* Suspend for 
1ms and try again due to DSP doorbell busy */
+   mdelay(1);
status = 
ft1000_read_register(ft1000dev, , FT1000_REG_DOORBELL);
if (tempword & 
FT1000_DB_DPRAM_TX) {
-   /* 
Suspend for 3ms and try again due to DSP doorbell busy */
-   
mdelay(3);
status 
= ft1000_read_register(ft1000dev, , FT1000_REG_DOORBELL);
if 
(tempword & FT1000_DB_DPRAM_TX) {
-   
DEBUG("FT1000:ft1000_ioctl:Doorbell not available\n");
-   
result = -ENOTTY;
-   
kfree(dpram_data);
-   
break;
+   
/* Suspend for 3ms and try again due to DSP doorbell busy */
+   
mdelay(3);
+   
status = ft1000_read_register(ft1000dev, , FT1000_REG_DOORBELL);
+  

[PATCH v2 0/5] staging: ft1000: ft1000-usb: ft1000_debug.c: Fix style errors and warnings.

2014-06-06 Thread Thomas Wood
Changes since v1:
 * Made single patch into a patch set.
 * Added better commit messages.

Is this better, or do I still have to split up my first patch?

>8--8<

Remove all style errors from ft1000_debug.c and some warnings.

Thomas Wood (5):
  staging: ft1000: ft1000-usb: ft1000_debug.c: Replace spaces with tabs.
  staging: ft1000: ft1000-usb: ft1000_debug.c: Add required spaces.
  staging: ft1000: ft1000-usb: ft1000_debug.c: Remove unnecessary
whitespace.
  staging: ft1000: ft1000-usb: ft1000_debug.c: Remove unnecessary
braces.
  staging: ft1000: ft1000-usb: ft1000_debug.c: Misc. fixes.

 drivers/staging/ft1000/ft1000-usb/ft1000_debug.c | 968 +++
 1 file changed, 480 insertions(+), 488 deletions(-)

-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH v2 1/5] staging: ft1000: ft1000-usb: ft1000_debug.c: Replace spaces with tabs.

2014-06-06 Thread Thomas Wood
Replace the spaces that were used as tabs with actual tabs.

Signed-off-by: Thomas Wood 
---
 drivers/staging/ft1000/ft1000-usb/ft1000_debug.c | 974 +++
 1 file changed, 487 insertions(+), 487 deletions(-)

diff --git a/drivers/staging/ft1000/ft1000-usb/ft1000_debug.c 
b/drivers/staging/ft1000/ft1000-usb/ft1000_debug.c
index a8945b7..338f91e 100644
--- a/drivers/staging/ft1000/ft1000-usb/ft1000_debug.c
+++ b/drivers/staging/ft1000/ft1000-usb/ft1000_debug.c
@@ -43,7 +43,7 @@ static int ft1000_flarion_cnt = 0;
 static int ft1000_open(struct inode *inode, struct file *file);
 static unsigned int ft1000_poll_dev(struct file *file, poll_table *wait);
 static long ft1000_ioctl(struct file *file, unsigned int command,
-   unsigned long argument);
+   unsigned long argument);
 static int ft1000_release(struct inode *inode, struct file *file);
 
 /* List to free receive command buffer pool */
@@ -81,23 +81,23 @@ static const struct file_operations ft1000fops = {
 */
 struct dpram_blk *ft1000_get_buffer(struct list_head *bufflist)
 {
-unsigned long flags;
+   unsigned long flags;
struct dpram_blk *ptr;
 
-spin_lock_irqsave(_buff_lock, flags);
-/* Check if buffer is available */
-if (list_empty(bufflist)) {
-DEBUG("ft1000_get_buffer:  No more buffer - %d\n", numofmsgbuf);
-ptr = NULL;
-} else {
-numofmsgbuf--;
-   ptr = list_entry(bufflist->next, struct dpram_blk, list);
-list_del(>list);
-/* DEBUG("ft1000_get_buffer: number of free msg buffers = %d\n", 
numofmsgbuf); */
-}
-spin_unlock_irqrestore(_buff_lock, flags);
-
-return ptr;
+   spin_lock_irqsave(_buff_lock, flags);
+   /* Check if buffer is available */
+   if (list_empty(bufflist)) {
+   DEBUG("ft1000_get_buffer:  No more buffer - %d\n", numofmsgbuf);
+   ptr = NULL;
+   } else {
+   numofmsgbuf--;
+   ptr = list_entry(bufflist->next, struct dpram_blk, list);
+   list_del(>list);
+   /* DEBUG("ft1000_get_buffer: number of free msg buffers = 
%d\n", numofmsgbuf); */
+   }
+   spin_unlock_irqrestore(_buff_lock, flags);
+
+   return ptr;
 }
 
 
@@ -119,14 +119,14 @@ struct dpram_blk *ft1000_get_buffer(struct list_head 
*bufflist)
 */
 void ft1000_free_buffer(struct dpram_blk *pdpram_blk, struct list_head *plist)
 {
-unsigned long flags;
-
-spin_lock_irqsave(_buff_lock, flags);
-/* Put memory back to list */
-list_add_tail(_blk->list, plist);
-numofmsgbuf++;
-/*DEBUG("ft1000_free_buffer: number of free msg buffers = %d\n", 
numofmsgbuf); */
-spin_unlock_irqrestore(_buff_lock, flags);
+   unsigned long flags;
+
+   spin_lock_irqsave(_buff_lock, flags);
+   /* Put memory back to list */
+   list_add_tail(_blk->list, plist);
+   numofmsgbuf++;
+   /*DEBUG("ft1000_free_buffer: number of free msg buffers = %d\n", 
numofmsgbuf); */
+   spin_unlock_irqrestore(_buff_lock, flags);
 }
 
 /*
@@ -145,25 +145,25 @@ void ft1000_free_buffer(struct dpram_blk *pdpram_blk, 
struct list_head *plist)
 */
 int ft1000_create_dev(struct ft1000_usb *dev)
 {
-int result;
-int i;
+   int result;
+   int i;
struct dentry *dir, *file;
struct ft1000_debug_dirs *tmp;
 
-/* make a new device name */
-sprintf(dev->DeviceName, "%s%d", "FT1000_", dev->CardNumber);
+   /* make a new device name */
+   sprintf(dev->DeviceName, "%s%d", "FT1000_", dev->CardNumber);
 
-DEBUG("%s: number of instance = %d\n", __func__, ft1000_flarion_cnt);
-DEBUG("DeviceCreated = %x\n", dev->DeviceCreated);
+   DEBUG("%s: number of instance = %d\n", __func__, ft1000_flarion_cnt);
+   DEBUG("DeviceCreated = %x\n", dev->DeviceCreated);
 
-if (dev->DeviceCreated) {
-   DEBUG("%s: \"%s\" already registered\n", __func__, dev->DeviceName);
-   return -EIO;
-}
+   if (dev->DeviceCreated) {
+   DEBUG("%s: \"%s\" already registered\n", __func__, 
dev->DeviceName);
+   return -EIO;
+   }
 
 
-/* register the device */
-DEBUG("%s: \"%s\" debugfs device registration\n", __func__, 
dev->DeviceName);
+   /* register the device */
+   DEBUG("%s: \"%s\" debugfs device registration\n", __func__, 
dev->DeviceName);
 
tmp = kmalloc(sizeof(struct ft1000_debug_dirs), GFP_KERNEL);
if (tmp == NULL) {
@@ -189,25 +189,25 @@ int ft1000_create_dev(struct ft1000_usb *dev)
tmp->int_number = dev->CardNumber;
list_add(&(tmp->list), &(dev->nodes.list));
 
-DEBUG("%s: registered debugfs directory \"%s\"\n", __func__, 
dev->DeviceName);
-
-/* initialize application information */
-dev->appcnt = 0;
-for (i=0; iapp_info[i].nTxMsg = 0;
-dev->app_info[i].nRxMsg = 0;
-dev->app_info[i].nTxMsgReject = 0;
-dev->app_info[i].nRxMsgMiss = 0;
-

Re: [RFC PATCH 06/16] arm: topology: Define TC2 sched energy and provide it to scheduler

2014-06-06 Thread Nicolas Pitre
On Wed, 4 Jun 2014, Peter Zijlstra wrote:

> On Wed, Jun 04, 2014 at 05:02:30PM +0100, Morten Rasmussen wrote:
> > On Tue, Jun 03, 2014 at 12:50:15PM +0100, Peter Zijlstra wrote:
> > > On Fri, May 23, 2014 at 07:16:33PM +0100, Morten Rasmussen wrote:
> > > > +static struct capacity_state cap_states_cluster_a7[] = {
> > > > +   /* Cluster only power */
> > > > +{ .cap =  358, .power = 2967, }, /*  350 MHz */
> > > > +{ .cap =  410, .power = 2792, }, /*  400 MHz */
> > > > +{ .cap =  512, .power = 2810, }, /*  500 MHz */
> > > > +{ .cap =  614, .power = 2815, }, /*  600 MHz */
> > > > +{ .cap =  717, .power = 2919, }, /*  700 MHz */
> > > > +{ .cap =  819, .power = 2847, }, /*  800 MHz */
> > > > +{ .cap =  922, .power = 3917, }, /*  900 MHz */
> > > > +{ .cap = 1024, .power = 4905, }, /* 1000 MHz */
> > > > +   };
> > > 
> > > So one thing I remember was that we spoke about restricting this to
> > > frequency levels where the voltage changed.
> > > 
> > > Because voltage jumps were the biggest factor to energy usage.
> > > 
> > > Any word on that?
> > 
> > Since we don't drive P-state changes from the scheduler, I think we
> > could leave out P-states from the table without too much trouble. Good
> > point.
> 
> Well, we eventually want to go there I think.

People within Linaro have initial code for this.  Should be posted as an 
RFC soon.

> Although we still needed
> to come up with something for Intel, because I'm not at all sure how all
> that works.

Our initial code reuse whatever existing platform specific cpufreq 
drivers.  The idea is to bypass the cpufreq governors.

If Intel hardware doesn't provide/allow much control here then the 
platform driver should already tell the cpufreq core (and by extension 
the scheduler) about the extent of what can be done.


Nicolas
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH v2 3/3] libata: Use glob_match from lib/glob.c

2014-06-06 Thread George Spelvin
The function may be useful for other drivers, so export it.
(Suggested by Tejun Heo.)

Note that I inverted the return value of glob_match; returning
true on match seemed to make more sense.

Signed-off-by: George Spelvin 
---
This is unchanged vrom v1.

 drivers/ata/Kconfig   |  1 +
 drivers/ata/libata-core.c | 72 ++-
 2 files changed, 4 insertions(+), 69 deletions(-)

diff --git a/drivers/ata/Kconfig b/drivers/ata/Kconfig
index 0033fafc..0a5e4556 100644
--- a/drivers/ata/Kconfig
+++ b/drivers/ata/Kconfig
@@ -16,6 +16,7 @@ menuconfig ATA
depends on BLOCK
depends on !(M32R || M68K || S390) || BROKEN
select SCSI
+   select GLOB
---help---
  If you want to use an ATA hard disk, ATA tape drive, ATA CD-ROM or
  any other ATA device under Linux, say Y and make sure that you know
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index ea83828b..b75695ff 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -59,6 +59,7 @@
 #include 
 #include 
 #include 
+#include 
 #include 
 #include 
 #include 
@@ -4250,73 +4251,6 @@ static const struct ata_blacklist_entry 
ata_device_blacklist [] = {
{ }
 };
 
-/**
- * glob_match - match a text string against a glob-style pattern
- * @text: the string to be examined
- * @pattern: the glob-style pattern to be matched against
- *
- * Either/both of text and pattern can be empty strings.
- *
- * Match text against a glob-style pattern, with wildcards and simple sets:
- *
- * ?   matches any single character.
- * *   matches any run of characters.
- * [xyz]   matches a single character from the set: x, y, or z.
- * [a-d]   matches a single character from the range: a, b, c, or 
d.
- * [a-d0-9] matches a single character from either range.
- *
- * The special characters ?, [, -, or *, can be matched using a set, eg. 
[*]
- * Behaviour with malformed patterns is undefined, though generally 
reasonable.
- *
- * Sample patterns:  "SD1?",  "SD1[0-5]",  "*R0",  "SD*1?[012]*xx"
- *
- * This function uses one level of recursion per '*' in pattern.
- * Since it calls _nothing_ else, and has _no_ explicit local variables,
- * this will not cause stack problems for any reasonable use here.
- *
- * RETURNS:
- * 0 on match, 1 otherwise.
- */
-static int glob_match (const char *text, const char *pattern)
-{
-   do {
-   /* Match single character or a '?' wildcard */
-   if (*text == *pattern || *pattern == '?') {
-   if (!*pattern++)
-   return 0;  /* End of both strings: match */
-   } else {
-   /* Match single char against a '[' bracketed ']' 
pattern set */
-   if (!*text || *pattern != '[')
-   break;  /* Not a pattern set */
-   while (*++pattern && *pattern != ']' && *text != 
*pattern) {
-   if (*pattern == '-' && *(pattern - 1) != '[')
-   if (*text > *(pattern - 1) && *text < 
*(pattern + 1)) {
-   ++pattern;
-   break;
-   }
-   }
-   if (!*pattern || *pattern == ']')
-   return 1;  /* No match */
-   while (*pattern && *pattern++ != ']');
-   }
-   } while (*++text && *pattern);
-
-   /* Match any run of chars against a '*' wildcard */
-   if (*pattern == '*') {
-   if (!*++pattern)
-   return 0;  /* Match: avoid recursion at end of pattern 
*/
-   /* Loop to handle additional pattern chars after the wildcard */
-   while (*text) {
-   if (glob_match(text, pattern) == 0)
-   return 0;  /* Remainder matched */
-   ++text;  /* Absorb (match) this char and try again */
-   }
-   }
-   if (!*text && !*pattern)
-   return 0;  /* End of both strings: match */
-   return 1;  /* No match */
-}
-
 static unsigned long ata_dev_blacklisted(const struct ata_device *dev)
 {
unsigned char model_num[ATA_ID_PROD_LEN + 1];
@@ -4327,10 +4261,10 @@ static unsigned long ata_dev_blacklisted(const struct 
ata_device *dev)
ata_id_c_string(dev->id, model_rev, ATA_ID_FW_REV, sizeof(model_rev));
 
while (ad->model_num) {
-   if (!glob_match(model_num, ad->model_num)) {
+   if (glob_match(model_num, ad->model_num)) {
if (ad->model_rev == NULL)
return ad->horkage;
-   if (!glob_match(model_rev, 

[PATCH v2 2/3] lib: glob.c: Add CONFIG_GLOB_SELFTEST

2014-06-06 Thread George Spelvin
This was useful during development, and is retained for future regression
testing.

GCC appears to have no way to place string literals in a particular
section; adding __initconst to a char pointer leaves the string itself
in the default string section, where it will not be thrown away after
module load.

Thus all string constants are kept in explicitly declared and named
arrays.  Sorry this makes printk a bit harder to read.  At least the
tests are more compact.

Signed-off-by: George Spelvin 
---
Persuading GCC to throw away *all* the self-test data after running
it was surprisingly annoying.

The one thing I'm not really sure about is what to do if the self-test
fails.  For now, I make the module_init function fail too.  Opinions?

 lib/Kconfig |  14 ++
 lib/glob.c  | 164 
 2 files changed, 178 insertions(+)

diff --git a/lib/Kconfig b/lib/Kconfig
index 4a607036..49592008 100644
--- a/lib/Kconfig
+++ b/lib/Kconfig
@@ -401,6 +401,20 @@ config GLOB
  are compiling an out-of tree driver which tells you that it
  depends on this.
 
+config GLOB_SELFTEST
+   bool "glob self-test on init"
+   default n
+   depends on GLOB
+   help
+ This option enables a simple self-test of the glob_match
+ function on startup.  It is primarily useful for people
+ working on the code to ensure they haven't introduced any
+ regressions.
+
+ It only adds a little bit of code and slows kernel boot (or
+ module load) by a small amount, so you're welcome to play with
+ it, but you probably don't need it.
+
 #
 # Netlink attribute parsing support is select'ed if needed
 #
diff --git a/lib/glob.c b/lib/glob.c
index 05beb470..671f80d3 100644
--- a/lib/glob.c
+++ b/lib/glob.c
@@ -121,3 +121,167 @@ backtrack:
}
 }
 EXPORT_SYMBOL(glob_match);
+
+
+#ifdef CONFIG_GLOB_SELFTEST
+
+#include 
+#include 
+
+/* Boot with "glob.verbose=1" to show successful tests, too */
+static bool verbose = false;
+module_param(verbose, bool, 0);
+
+struct glob_test {
+   char const *pat, *str;
+   bool expected;
+};
+
+static bool __pure __init test(char const *pat, char const *str, bool expected)
+{
+   bool match = glob_match(pat, str);
+   bool success = match == expected;
+
+   /* Can't get string literals into a particular section, so... */
+   static char const msg_error[] __initconst =
+   KERN_ERR "glob: \"%s\" vs. \"%s\": %s *** ERROR ***\n";
+   static char const msg_ok[] __initconst =
+   KERN_DEBUG "glob: \"%s\" vs. \"%s\": %s OK\n";
+   static char const mismatch[] __initconst = "mismatch";
+   char const *message;
+
+   if (!success)
+   message = msg_error;
+   else if (verbose)
+   message = msg_ok;
+   else
+   return success;
+
+   printk(message, pat, str, mismatch + 3*match);
+   return success;
+}
+
+/*
+ * The tests are all jammed together in one array to make it simpler
+ * to place that array in the .init.rodata section.  The obvious
+ * "array of structures containing char *" has no way to force the
+ * pointed-to strings to be in a particular section.
+ *
+ * Anyway, a test consists of:
+ * 1. Expected glob_match result: '1' or '0'.
+ * 2. Pattern to match: null-terminated string
+ * 3. String to match against: null-terminated string
+ *
+ * The list of tests is terminated with a final '\0' instead of
+ * a glob_match result character.
+ */
+static char const glob_tests[] __initconst = 
+   /* Some basic tests */
+   "1" "a\0" "a\0"
+   "0" "a\0" "b\0"
+   "0" "a\0" "aa\0"
+   "0" "a\0" "\0"
+   "1" "\0" "\0"
+   "0" "\0" "a\0"
+   /* Simple character class tests */
+   "1" "[a]\0" "a\0"
+   "0" "[a]\0" "b\0"
+   "0" "[!a]\0" "a\0"
+   "1" "[!a]\0" "b\0"
+   "1" "[ab]\0" "a\0"
+   "1" "[ab]\0" "b\0"
+   "0" "[ab]\0" "c\0"
+   "1" "[!ab]\0" "c\0"
+   "1" "[a-c]\0" "b\0"
+   "0" "[a-c]\0" "d\0"
+   /* Corner cases in character class parsing */
+   "1" "[a-c-e-g]\0" "-\0"
+   "0" "[a-c-e-g]\0" "d\0"
+   "1" "[a-c-e-g]\0" "f\0"
+   "1" "[]a-ceg-ik[]\0" "a\0"
+   "1" "[]a-ceg-ik[]\0" "]\0"
+   "1" "[]a-ceg-ik[]\0" "[\0"
+   "1" "[]a-ceg-ik[]\0" "h\0"
+   "0" "[]a-ceg-ik[]\0" "f\0"
+   "0" "[!]a-ceg-ik[]\0" "h\0"
+   "0" "[!]a-ceg-ik[]\0" "]\0"
+   "1" "[!]a-ceg-ik[]\0" "f\0"
+   /* Simple wild cards */
+   "1" "?\0" "a\0"
+   "0" "?\0" "aa\0"
+   "0" "??\0" "a\0"
+   "1" "?x?\0" "axb\0"
+   "0" "?x?\0" "abx\0"
+   "0" "?x?\0" "xab\0"
+   /* Asterisk wild cards (backtracking) */
+   "0" "*??\0" "a\0"
+   "1" "*??\0" "ab\0"
+   "1" "*??\0" "abc\0"
+   "1" "*??\0" "abcd\0"
+   "0" "??*\0" "a\0"
+   "1" "??*\0" "ab\0"
+   "1" "??*\0" "abc\0"
+   "1" "??*\0" "abcd\0"
+   "0" "?*?\0" 

[PATCH v2 1/3] Add lib/glob.c

2014-06-06 Thread George Spelvin
This is a helper function from drivers/ata/libata_core.c, where it is used
to blacklist particular device models.  It's being moved to lib/ so other
drivers may use it for the same purpose.

This implementation in non-recursive, so is safe for the kernel stack.

Signed-off-by: George Spelvin 
---
Sorry for the delay; while researching ways to organize the self-test
code I found lots of other code to fix up.

Per previous discussion, support for out-of-tree users is currently
disabled, although the machinery necessary to add it easily is
still there.

If nothing else, it provides a good place to put the self-test code.
(Which is now split out into a separate patch.)

I believe I've addressed all the comments made last time.  Any more?
(Acked-by: and Reviewed-by: particularly appreciated!)

 include/linux/glob.h |  10 +
 lib/Kconfig  |  19 
 lib/Makefile |   2 +
 lib/glob.c   | 123 +++
 4 files changed, 154 insertions(+)
 create mode 100644 include/linux/glob.h
 create mode 100644 lib/glob.c

diff --git a/include/linux/glob.h b/include/linux/glob.h
new file mode 100644
index ..c990b7fb
--- /dev/null
+++ b/include/linux/glob.h
@@ -0,0 +1,10 @@
+#ifndef _LINUX_GLOB_H
+#define _LINUX_GLOB_H
+
+#include/* For bool */
+#include /* For __pure */
+
+bool __pure glob_match(char const *pat, char const *str);
+
+#endif /* _LINUX_GLOB_H */
+
diff --git a/lib/Kconfig b/lib/Kconfig
index 4771fb3f..4a607036 100644
--- a/lib/Kconfig
+++ b/lib/Kconfig
@@ -382,6 +382,25 @@ config CPU_RMAP
 config DQL
bool
 
+config GLOB
+   bool
+#  This actually supports modular compilation, but the module overhead
+#  is ridiculous for the amount of code involved.  Until an out-of-tree
+#  driver asks for it, we'll just link it directly it into the kernel
+#  when required.  Since we're ignoring out-of-tree users, there's also
+#  no need bother prompting for a manual decision:
+#  prompt "glob_match() function"
+   help
+ This option provides a glob_match function for performing
+ simple text pattern matching.  It originated in the ATA code
+ to blacklist particular drive models, but other device drivers
+ may need similar functionality.
+
+ All drivers in the Linux kernel tree that require this function
+ should automatically select this option.  Say N unless you
+ are compiling an out-of tree driver which tells you that it
+ depends on this.
+
 #
 # Netlink attribute parsing support is select'ed if needed
 #
diff --git a/lib/Makefile b/lib/Makefile
index 0cd7b68e..a2ae6fe2 100644
--- a/lib/Makefile
+++ b/lib/Makefile
@@ -134,6 +134,8 @@ obj-$(CONFIG_CORDIC) += cordic.o
 
 obj-$(CONFIG_DQL) += dynamic_queue_limits.o
 
+obj-$(CONFIG_GLOB) += glob.o
+
 obj-$(CONFIG_MPILIB) += mpi/
 obj-$(CONFIG_SIGNATURE) += digsig.o
 
diff --git a/lib/glob.c b/lib/glob.c
new file mode 100644
index ..05beb470
--- /dev/null
+++ b/lib/glob.c
@@ -0,0 +1,123 @@
+#include 
+#include 
+
+/*
+ * The only reason this code can be compiled as a module is because the
+ * ATA code that depends on it can be as well.  In practice, they're
+ * both usually compiled in and the module overhead goes away.
+ */
+MODULE_DESCRIPTION("glob(7) matching");
+MODULE_LICENSE("Dual MIT/GPL");
+
+/**
+ * glob_match - Shell-style pattern matching, like !fnmatch(pat, str, 0)
+ * @pat: Shell-style pattern to match, e.g. "*.[ch]".
+ * @str: String to match.  The pattern must match the entire string.
+ *
+ * Perform shell-style glob matching, returning true (1) if the match
+ * succeeds, or false (0) if it fails.  Equivalent to !fnmatch(@pat, @str, 0).
+ *
+ * Pattern metacharacters are ?, *, [ and \.
+ * (And, inside character classes, !, - and ].)
+ *
+ * This is small and simple implementation intended for device blacklists
+ * where a string is matched against a number of patterns.  Thus, it
+ * does not preprocess the patterns.  It is non-recursive, and run-time
+ * is at most quadratic: strlen(@str)*strlen(@pat).
+ *
+ * An example of the worst case is glob_match("*a", "aa");
+ * it takes 6 passes over the pattern before matching the string.
+ *
+ * Like !fnmatch(@pat, @str, 0) and unlike the shell, this does NOT
+ * treat / or leading . specially; it isn't actually used for pathnames.
+ *
+ * Note that according to glob(7) (and unlike bash), character classes
+ * are complemented by a leading !; this does not support the regex-style
+ * [^a-z] syntax.
+ *
+ * An opening bracket without a matching close is matched literally.
+ */
+bool __pure glob_match(char const *pat, char const *str)
+{
+   /*
+* Backtrack to previous * on mismatch and retry starting one
+* character later in the string.  Because * matches all characters
+* (no exception for /), it can be easily proved that there's
+* never a need to backtrack multiple 

Re: [RFC PATCH 1/1] cleanup: use bool as return type for rwsem_is_locked

2014-06-06 Thread Joe Perches
On Fri, 2014-06-06 at 21:41 -0400, Pranith Kumar wrote:
> On 06/06/2014 08:59 PM, Pranith Kumar wrote:
> > On 06/06/2014 08:18 PM, Dave Chinner wrote:
> >> If you are going to change the return type to bool, then you should
> >> also remove the manual "!!" conversions to a boolean return and let
> >> the compiler do it in the most optimal way.
> > Agreed, please find patch below:
> Simplify the "!!" condition. This is much simpler. :)
[]
> diff --git a/fs/xfs/xfs_inode.c b/fs/xfs/xfs_inode.c

> @@ -285,25 +285,25 @@ xfs_ilock_demote(
>  }
>  
>  #if defined(DEBUG) || defined(XFS_WARN)
> -int
> +bool
>  xfs_isilocked(
>   xfs_inode_t *ip,
>   uintlock_flags)
>  {
>   if (lock_flags & (XFS_ILOCK_EXCL|XFS_ILOCK_SHARED)) {
>   if (!(lock_flags & XFS_ILOCK_SHARED))
> - return !!ip->i_lock.mr_writer;
> + return (ip->i_lock.mr_writer != 0);

simpler still would be just removing the !! completely.
I presume in no case would it make an actual difference
in emitted code.

ie:
return ip->i_lock.mr_writer;


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


Re: [RFC PATCH 06/16] arm: topology: Define TC2 sched energy and provide it to scheduler

2014-06-06 Thread Nicolas Pitre
On Fri, 6 Jun 2014, Ingo Molnar wrote:

> In any case, even with turbo frequencies, switching power use is 
> probably an order of magnitude higher than leakage current power use, 
> on any marketable chip, so we should concentrate on being able to 
> cover this first order effect (P/work ~ V^2), before considering any 
> second order effects (leakage current).

Just so that people are aware... We'll have to introduce thermal 
constraint management into the scheduler mix as well at some point.  
Right now what we have is an ad hoc subsystem that simply monitors 
temperature and apply crude cooling strategies when some thresholds are 
met. But a better strategy would imply thermal "provisioning".


Nicolas
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 3.2 07/92] l2tp: take PMTU from tunnel UDP socket

2014-06-06 Thread Ben Hutchings
3.2.60-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Dmitry Petukhov 

[ Upstream commit f34c4a35d87949fbb0e0f31eba3c054e9f8199ba ]

When l2tp driver tries to get PMTU for the tunnel destination, it uses
the pointer to struct sock that represents PPPoX socket, while it
should use the pointer that represents UDP socket of the tunnel.

Signed-off-by: Dmitry Petukhov 
Signed-off-by: David S. Miller 
Signed-off-by: Ben Hutchings 
---
 net/l2tp/l2tp_ppp.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c
index 969cd3e..e0f0934 100644
--- a/net/l2tp/l2tp_ppp.c
+++ b/net/l2tp/l2tp_ppp.c
@@ -772,9 +772,9 @@ static int pppol2tp_connect(struct socket *sock, struct 
sockaddr *uservaddr,
session->deref = pppol2tp_session_sock_put;
 
/* If PMTU discovery was enabled, use the MTU that was discovered */
-   dst = sk_dst_get(sk);
+   dst = sk_dst_get(tunnel->sock);
if (dst != NULL) {
-   u32 pmtu = dst_mtu(__sk_dst_get(sk));
+   u32 pmtu = dst_mtu(__sk_dst_get(tunnel->sock));
if (pmtu != 0)
session->mtu = session->mru = pmtu -
PPPOL2TP_HEADER_OVERHEAD;

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 3.2 80/92] can: peak_pci: Fix the way channels are linked together

2014-06-06 Thread Ben Hutchings
3.2.60-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Stephane Grosjean 

commit 29830406415c227a54af429d7b300aabd4754237 upstream.

Change the way channels objects are linked together by peak_pci_probe()
avoiding any kernel oops when driver is removed. Side effect is that
the list is now browsed from last to first channel.

Signed-off-by: Stephane Grosjean 
Signed-off-by: Marc Kleine-Budde 
Signed-off-by: Ben Hutchings 
---
 drivers/net/can/sja1000/peak_pci.c | 23 +--
 1 file changed, 9 insertions(+), 14 deletions(-)

diff --git a/drivers/net/can/sja1000/peak_pci.c 
b/drivers/net/can/sja1000/peak_pci.c
index 2c7f503..2147959 100644
--- a/drivers/net/can/sja1000/peak_pci.c
+++ b/drivers/net/can/sja1000/peak_pci.c
@@ -39,9 +39,9 @@ MODULE_LICENSE("GPL v2");
 #define DRV_NAME  "peak_pci"
 
 struct peak_pci_chan {
-   void __iomem *cfg_base;  /* Common for all channels */
-   struct net_device *next_dev; /* Chain of network devices */
-   u16 icr_mask;/* Interrupt mask for fast ack */
+   void __iomem *cfg_base; /* Common for all channels */
+   struct net_device *prev_dev;/* Chain of network devices */
+   u16 icr_mask;   /* Interrupt mask for fast ack */
 };
 
 #define PEAK_PCI_CAN_CLOCK (1600 / 2)
@@ -98,7 +98,7 @@ static int __devinit peak_pci_probe(struct pci_dev *pdev,
 {
struct sja1000_priv *priv;
struct peak_pci_chan *chan;
-   struct net_device *dev, *dev0 = NULL;
+   struct net_device *dev;
void __iomem *cfg_base, *reg_base;
u16 sub_sys_id, icr;
int i, err, channels;
@@ -196,18 +196,14 @@ static int __devinit peak_pci_probe(struct pci_dev *pdev,
}
 
/* Create chain of SJA1000 devices */
-   if (i == 0)
-   dev0 = dev;
-   else
-   chan->next_dev = dev;
+   chan->prev_dev = pci_get_drvdata(pdev);
+   pci_set_drvdata(pdev, dev);
 
dev_info(>dev,
 "%s at reg_base=0x%p cfg_base=0x%p irq=%d\n",
 dev->name, priv->reg_base, chan->cfg_base, dev->irq);
}
 
-   pci_set_drvdata(pdev, dev0);
-
/* Enable interrupts */
writew(icr, cfg_base + PITA_ICR + 2);
 
@@ -217,12 +213,11 @@ failure_remove_channels:
/* Disable interrupts */
writew(0x0, cfg_base + PITA_ICR + 2);
 
-   for (dev = dev0; dev; dev = chan->next_dev) {
+   for (dev = pci_get_drvdata(pdev); dev; dev = chan->prev_dev) {
unregister_sja1000dev(dev);
free_sja1000dev(dev);
priv = netdev_priv(dev);
chan = priv->priv;
-   dev = chan->next_dev;
}
 
pci_iounmap(pdev, reg_base);
@@ -241,7 +236,7 @@ failure_disable_pci:
 
 static void __devexit peak_pci_remove(struct pci_dev *pdev)
 {
-   struct net_device *dev = pci_get_drvdata(pdev); /* First device */
+   struct net_device *dev = pci_get_drvdata(pdev); /* Last device */
struct sja1000_priv *priv = netdev_priv(dev);
struct peak_pci_chan *chan = priv->priv;
void __iomem *cfg_base = chan->cfg_base;
@@ -255,7 +250,7 @@ static void __devexit peak_pci_remove(struct pci_dev *pdev)
dev_info(>dev, "removing device %s\n", dev->name);
unregister_sja1000dev(dev);
free_sja1000dev(dev);
-   dev = chan->next_dev;
+   dev = chan->prev_dev;
if (!dev)
break;
priv = netdev_priv(dev);

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 3.2 91/92] futex: Always cleanup owner tid in unlock_pi

2014-06-06 Thread Ben Hutchings
3.2.60-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Thomas Gleixner 

commit 13fbca4c6ecd96ec1a1cfa2e4f2ce191fe928a5e upstream.

If the owner died bit is set at futex_unlock_pi, we currently do not
cleanup the user space futex.  So the owner TID of the current owner
(the unlocker) persists.  That's observable inconsistant state,
especially when the ownership of the pi state got transferred.

Clean it up unconditionally.

Signed-off-by: Thomas Gleixner 
Cc: Kees Cook 
Cc: Will Drewry 
Cc: Darren Hart 
Signed-off-by: Linus Torvalds 
Signed-off-by: Ben Hutchings 
---
 kernel/futex.c | 40 ++--
 1 file changed, 18 insertions(+), 22 deletions(-)

--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -899,6 +899,7 @@ static int wake_futex_pi(u32 __user *uad
struct task_struct *new_owner;
struct futex_pi_state *pi_state = this->pi_state;
u32 uninitialized_var(curval), newval;
+   int ret = 0;
 
if (!pi_state)
return -EINVAL;
@@ -922,23 +923,19 @@ static int wake_futex_pi(u32 __user *uad
new_owner = this->task;
 
/*
-* We pass it to the next owner. (The WAITERS bit is always
-* kept enabled while there is PI state around. We must also
-* preserve the owner died bit.)
-*/
-   if (!(uval & FUTEX_OWNER_DIED)) {
-   int ret = 0;
-
-   newval = FUTEX_WAITERS | task_pid_vnr(new_owner);
-
-   if (cmpxchg_futex_value_locked(, uaddr, uval, newval))
-   ret = -EFAULT;
-   else if (curval != uval)
-   ret = -EINVAL;
-   if (ret) {
-   raw_spin_unlock(_state->pi_mutex.wait_lock);
-   return ret;
-   }
+* We pass it to the next owner. The WAITERS bit is always
+* kept enabled while there is PI state around. We cleanup the
+* owner died bit, because we are the owner.
+*/
+   newval = FUTEX_WAITERS | task_pid_vnr(new_owner);
+
+   if (cmpxchg_futex_value_locked(, uaddr, uval, newval))
+   ret = -EFAULT;
+   else if (curval != uval)
+   ret = -EINVAL;
+   if (ret) {
+   raw_spin_unlock(_state->pi_mutex.wait_lock);
+   return ret;
}
 
raw_spin_lock_irq(_state->owner->pi_lock);
@@ -2183,9 +2180,10 @@ retry:
/*
 * To avoid races, try to do the TID -> 0 atomic transition
 * again. If it succeeds then we can return without waking
-* anyone else up:
+* anyone else up. We only try this if neither the waiters nor
+* the owner died bit are set.
 */
-   if (!(uval & FUTEX_OWNER_DIED) &&
+   if (!(uval & ~FUTEX_TID_MASK) &&
cmpxchg_futex_value_locked(, uaddr, vpid, 0))
goto pi_faulted;
/*
@@ -2217,11 +2215,9 @@ retry:
/*
 * No waiters - kernel unlocks the futex:
 */
-   if (!(uval & FUTEX_OWNER_DIED)) {
-   ret = unlock_futex_pi(uaddr, uval);
-   if (ret == -EFAULT)
-   goto pi_faulted;
-   }
+   ret = unlock_futex_pi(uaddr, uval);
+   if (ret == -EFAULT)
+   goto pi_faulted;
 
 out_unlock:
spin_unlock(>lock);

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 3.2 75/92] libceph: fix corruption when using page_count 0 page in rbd

2014-06-06 Thread Ben Hutchings
3.2.60-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Chunwei Chen 

commit 178eda29ca721842f2146378e73d43e0044c4166 upstream.

It has been reported that using ZFSonLinux on rbd will result in memory
corruption. The bug report can be found here:

https://github.com/zfsonlinux/spl/issues/241
http://tracker.ceph.com/issues/7790

The reason is that ZFS will send pages with page_count 0 into rbd, which in
turns send them to tcp_sendpage. However, tcp_sendpage cannot deal with
page_count 0, as it will do get_page and put_page, and erroneously free the
page.

This type of issue has been noted before, and handled in iscsi, drbd,
etc. So, rbd should also handle this. This fix address this issue by fall back
to slower sendmsg when page_count 0 detected.

Cc: Sage Weil 
Cc: Yehuda Sadeh 
Signed-off-by: Chunwei Chen 
Reviewed-by: Ilya Dryomov 
Signed-off-by: Ben Hutchings 
---
 net/ceph/messenger.c | 20 +++-
 1 file changed, 19 insertions(+), 1 deletion(-)

--- a/net/ceph/messenger.c
+++ b/net/ceph/messenger.c
@@ -284,7 +284,7 @@ static int ceph_tcp_sendmsg(struct socke
return r;
 }
 
-static int ceph_tcp_sendpage(struct socket *sock, struct page *page,
+static int __ceph_tcp_sendpage(struct socket *sock, struct page *page,
 int offset, size_t size, bool more)
 {
int flags = MSG_DONTWAIT | MSG_NOSIGNAL | (more ? MSG_MORE : MSG_EOR);
@@ -297,6 +297,24 @@ static int ceph_tcp_sendpage(struct sock
return ret;
 }
 
+static int ceph_tcp_sendpage(struct socket *sock, struct page *page,
+int offset, size_t size, bool more)
+{
+   int ret;
+   struct kvec iov;
+
+   /* sendpage cannot properly handle pages with page_count == 0,
+* we need to fallback to sendmsg if that's the case */
+   if (page_count(page) >= 1)
+   return __ceph_tcp_sendpage(sock, page, offset, size, more);
+
+   iov.iov_base = kmap(page) + offset;
+   iov.iov_len = size;
+   ret = ceph_tcp_sendmsg(sock, , 1, size, more);
+   kunmap(page);
+
+   return ret;
+}
 
 /*
  * Shutdown/close the socket for the given connection.

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 3.2 08/92] net: core: don't account for udp header size when computing seglen

2014-06-06 Thread Ben Hutchings
3.2.60-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Florian Westphal 

[ Upstream commit 6d39d589bb76ee8a1c6cde6822006ae0053decff ]

In case of tcp, gso_size contains the tcpmss.

For UFO (udp fragmentation offloading) skbs, gso_size is the fragment
payload size, i.e. we must not account for udp header size.

Otherwise, when using virtio drivers, a to-be-forwarded UFO GSO packet
will be needlessly fragmented in the forward path, because we think its
individual segments are too large for the outgoing link.

Fixes: fe6cc55f3a9a053 ("net: ip, ipv6: handle gso skbs in forwarding path")
Cc: Eric Dumazet 
Reported-by: Tobias Brunner 
Signed-off-by: Florian Westphal 
Signed-off-by: David S. Miller 
Signed-off-by: Ben Hutchings 
---
 net/core/skbuff.c | 12 +++-
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 8ac4a0f..8ae2e43 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -3197,12 +3197,14 @@ EXPORT_SYMBOL(__skb_warn_lro_forwarding);
 unsigned int skb_gso_transport_seglen(const struct sk_buff *skb)
 {
const struct skb_shared_info *shinfo = skb_shinfo(skb);
-   unsigned int hdr_len;
 
if (likely(shinfo->gso_type & (SKB_GSO_TCPV4 | SKB_GSO_TCPV6)))
-   hdr_len = tcp_hdrlen(skb);
-   else
-   hdr_len = sizeof(struct udphdr);
-   return hdr_len + shinfo->gso_size;
+   return tcp_hdrlen(skb) + shinfo->gso_size;
+
+   /* UFO sets gso_size to the size of the fragmentation
+* payload, i.e. the size of the L4 (UDP) header is already
+* accounted for.
+*/
+   return shinfo->gso_size;
 }
 EXPORT_SYMBOL_GPL(skb_gso_transport_seglen);

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 3.2 70/92] i2c: designware: Mask all interrupts during i2c controller enable

2014-06-06 Thread Ben Hutchings
3.2.60-rc1 review patch.  If anyone has any objections, please let me know.

--

From: "Du, Wenkai" 

commit 47bb27e78867997040a228328f2a631c3c7f2c82 upstream.

There have been "i2c_designware 80860F41:00: controller timed out" errors
on a number of Baytrail platforms. The issue is caused by incorrect value in
Interrupt Mask Register (DW_IC_INTR_MASK)  when i2c core is being enabled.
This causes call to __i2c_dw_enable() to immediately start the transfer which
leads to timeout. There are 3 failure modes observed:

1. Failure in S0 to S3 resume path

The default value after reset for DW_IC_INTR_MASK is 0x8ff. When we start
the first transaction after resuming from system sleep, TX_EMPTY interrupt
is already unmasked because of the hardware default.

2. Failure in normal operational path

This failure happens rarely and is hard to reproduce. Debug trace showed that
DW_IC_INTR_MASK had value of 0x254 when failure occurred, which meant
TX_EMPTY was unmasked.

3. Failure in S3 to S0 suspend path

This failure also happens rarely and is hard to reproduce. Adding debug trace
that read DW_IC_INTR_MASK made this failure not reproducible. But from ISR
call trace we could conclude TX_EMPTY was unmasked when problem occurred.

The patch masks all interrupts before the controller is enabled to resolve the
faulty DW_IC_INTR_MASK conditions.

Signed-off-by: Wenkai Du 
Acked-by: Mika Westerberg 
[wsa: improved the comment and removed typo in commit msg]
Signed-off-by: Wolfram Sang 
Signed-off-by: Ben Hutchings 
---
 drivers/i2c/busses/i2c-designware-core.c | 3 +++
 1 file changed, 3 insertions(+)

--- a/drivers/i2c/busses/i2c-designware-core.c
+++ b/drivers/i2c/busses/i2c-designware-core.c
@@ -346,6 +346,9 @@ static void i2c_dw_xfer_init(struct dw_i
ic_con &= ~DW_IC_CON_10BITADDR_MASTER;
dw_writel(dev, ic_con, DW_IC_CON);
 
+   /* enforce disabled interrupts (due to HW issues) */
+   i2c_dw_disable_int(dev);
+
/* Enable the adapter */
dw_writel(dev, 1, DW_IC_ENABLE);
 

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 3.2 84/92] dma: mv_xor: Flush descriptors before activating a channel

2014-06-06 Thread Ben Hutchings
3.2.60-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Ezequiel Garcia 

commit 5a9a55bf9157d3490b0c8c4c81d4708602c26e07 upstream.

We need to use writel() instead of writel_relaxed() when starting
a channel, to ensure all the descriptors have been flushed before
the activation.

While at it, remove the unneeded read-modify-write and make the
code simpler.

Signed-off-by: Lior Amsalem 
Signed-off-by: Ezequiel Garcia 
Signed-off-by: Dan Williams 
[bwh: Backported to 3.2: it was using __raw_readl() and __raw_writel()
 which are just as wrong]
Signed-off-by: Ben Hutchings 
---
 drivers/dma/mv_xor.c | 8 +++-
 1 file changed, 3 insertions(+), 5 deletions(-)

--- a/drivers/dma/mv_xor.c
+++ b/drivers/dma/mv_xor.c
@@ -218,12 +218,10 @@ static void mv_set_mode(struct mv_xor_ch
 
 static void mv_chan_activate(struct mv_xor_chan *chan)
 {
-   u32 activation;
-
dev_dbg(chan->device->common.dev, " activate chan.\n");
-   activation = __raw_readl(XOR_ACTIVATION(chan));
-   activation |= 0x1;
-   __raw_writel(activation, XOR_ACTIVATION(chan));
+
+   /* writel ensures all descriptors are flushed before activation */
+   writel(BIT(0), XOR_ACTIVATION(chan));
 }
 
 static char mv_chan_is_busy(struct mv_xor_chan *chan)

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 3.2 09/92] bonding: Remove debug_fs files when module init fails

2014-06-06 Thread Ben Hutchings
3.2.60-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Thomas Richter 

[ Upstream commit db29868653394937037d71dc3545768302dda643 ]

Remove the bonding debug_fs entries when the
module initialization fails. The debug_fs
entries should be removed together with all other
already allocated resources.

Signed-off-by: Thomas Richter 
Signed-off-by: Jay Vosburgh 
Signed-off-by: David S. Miller 
Signed-off-by: Ben Hutchings 
---
 drivers/net/bonding/bond_main.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 1bf36ac..5af2a8f 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -4914,6 +4914,7 @@ static int __init bonding_init(void)
 out:
return res;
 err:
+   bond_destroy_debugfs();
rtnl_link_unregister(_link_ops);
 err_link:
unregister_pernet_subsys(_net_ops);

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 3.2 05/92] netfilter: Can't fail and free after table replacement

2014-06-06 Thread Ben Hutchings
3.2.60-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Thomas Graf 

commit c58dd2dd443c26d856a168db108a0cd11c285bf3 upstream.

All xtables variants suffer from the defect that the copy_to_user()
to copy the counters to user memory may fail after the table has
already been exchanged and thus exposed. Return an error at this
point will result in freeing the already exposed table. Any
subsequent packet processing will result in a kernel panic.

We can't copy the counters before exposing the new tables as we
want provide the counter state after the old table has been
unhooked. Therefore convert this into a silent error.

Cc: Florian Westphal 
Signed-off-by: Thomas Graf 
Signed-off-by: Pablo Neira Ayuso 
Signed-off-by: Ben Hutchings 
---
 net/bridge/netfilter/ebtables.c | 5 ++---
 net/ipv4/netfilter/arp_tables.c | 6 --
 net/ipv4/netfilter/ip_tables.c  | 6 --
 net/ipv6/netfilter/ip6_tables.c | 6 --
 4 files changed, 14 insertions(+), 9 deletions(-)

--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -1044,10 +1044,9 @@ static int do_replace_finish(struct net
if (repl->num_counters &&
   copy_to_user(repl->counters, counterstmp,
   repl->num_counters * sizeof(struct ebt_counter))) {
-   ret = -EFAULT;
+   /* Silent error, can't fail, new table is already in place */
+   net_warn_ratelimited("ebtables: counters copy to user failed 
while replacing table\n");
}
-   else
-   ret = 0;
 
/* decrease module count and free resources */
EBT_ENTRY_ITERATE(table->entries, table->entries_size,
--- a/net/ipv4/netfilter/arp_tables.c
+++ b/net/ipv4/netfilter/arp_tables.c
@@ -1039,8 +1039,10 @@ static int __do_replace(struct net *net,
 
xt_free_table_info(oldinfo);
if (copy_to_user(counters_ptr, counters,
-sizeof(struct xt_counters) * num_counters) != 0)
-   ret = -EFAULT;
+sizeof(struct xt_counters) * num_counters) != 0) {
+   /* Silent error, can't fail, new table is already in place */
+   net_warn_ratelimited("arptables: counters copy to user failed 
while replacing table\n");
+   }
vfree(counters);
xt_table_unlock(t);
return ret;
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -1227,8 +1227,10 @@ __do_replace(struct net *net, const char
 
xt_free_table_info(oldinfo);
if (copy_to_user(counters_ptr, counters,
-sizeof(struct xt_counters) * num_counters) != 0)
-   ret = -EFAULT;
+sizeof(struct xt_counters) * num_counters) != 0) {
+   /* Silent error, can't fail, new table is already in place */
+   net_warn_ratelimited("iptables: counters copy to user failed 
while replacing table\n");
+   }
vfree(counters);
xt_table_unlock(t);
return ret;
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -1249,8 +1249,10 @@ __do_replace(struct net *net, const char
 
xt_free_table_info(oldinfo);
if (copy_to_user(counters_ptr, counters,
-sizeof(struct xt_counters) * num_counters) != 0)
-   ret = -EFAULT;
+sizeof(struct xt_counters) * num_counters) != 0) {
+   /* Silent error, can't fail, new table is already in place */
+   net_warn_ratelimited("ip6tables: counters copy to user failed 
while replacing table\n");
+   }
vfree(counters);
xt_table_unlock(t);
return ret;

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 3.2 90/92] futex: Validate atomic acquisition in futex_lock_pi_atomic()

2014-06-06 Thread Ben Hutchings
3.2.60-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Thomas Gleixner 

commit b3eaa9fc5cd0a4d74b18f6b8dc617aeaf1873270 upstream.

We need to protect the atomic acquisition in the kernel against rogue
user space which sets the user space futex to 0, so the kernel side
acquisition succeeds while there is existing state in the kernel
associated to the real owner.

Verify whether the futex has waiters associated with kernel state.  If
it has, return -EINVAL.  The state is corrupted already, so no point in
cleaning it up.  Subsequent calls will fail as well.  Not our problem.

[ tglx: Use futex_top_waiter() and explain why we do not need to try
restoring the already corrupted user space state. ]

Signed-off-by: Darren Hart 
Cc: Kees Cook 
Cc: Will Drewry 
Signed-off-by: Thomas Gleixner 
Signed-off-by: Linus Torvalds 
Signed-off-by: Ben Hutchings 
---
 kernel/futex.c | 14 +++---
 1 file changed, 11 insertions(+), 3 deletions(-)

--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -758,10 +758,18 @@ retry:
return -EDEADLK;
 
/*
-* Surprise - we got the lock. Just return to userspace:
+* Surprise - we got the lock, but we do not trust user space at all.
 */
-   if (unlikely(!curval))
-   return 1;
+   if (unlikely(!curval)) {
+   /*
+* We verify whether there is kernel state for this
+* futex. If not, we can safely assume, that the 0 ->
+* TID transition is correct. If state exists, we do
+* not bother to fixup the user space state as it was
+* corrupted already.
+*/
+   return futex_top_waiter(hb, key) ? -EINVAL : 1;
+   }
 
uval = curval;
 

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 3.2 17/92] sctp: reset flowi4_oif parameter on route lookup

2014-06-06 Thread Ben Hutchings
3.2.60-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Xufeng Zhang 

[ Upstream commit 85350871317a5adb35519d9dc6fc9e80809d42ad ]

commit 813b3b5db83 (ipv4: Use caller's on-stack flowi as-is
in output route lookups.) introduces another regression which
is very similar to the problem of commit e6b45241c (ipv4: reset
flowi parameters on route connect) wants to fix:
Before we call ip_route_output_key() in sctp_v4_get_dst() to
get a dst that matches a bind address as the source address,
we have already called this function previously and the flowi
parameters have been initialized including flowi4_oif, so when
we call this function again, the process in __ip_route_output_key()
will be different because of the setting of flowi4_oif, and we'll
get a networking device which corresponds to the inputted flowi4_oif
as the output device, this is wrong because we'll never hit this
place if the previously returned source address of dst match one
of the bound addresses.

To reproduce this problem, a vlan setting is enough:
  # ifconfig eth0 up
  # route del default
  # vconfig add eth0 2
  # vconfig add eth0 3
  # ifconfig eth0.2 10.0.1.14 netmask 255.255.255.0
  # route add default gw 10.0.1.254 dev eth0.2
  # ifconfig eth0.3 10.0.0.14 netmask 255.255.255.0
  # ip rule add from 10.0.0.14 table 4
  # ip route add table 4 default via 10.0.0.254 src 10.0.0.14 dev eth0.3
  # sctp_darn -H 10.0.0.14 -P 36422 -h 10.1.4.134 -p 36422 -s -I
You'll detect that all the flow are routed to eth0.2(10.0.1.254).

Signed-off-by: Xufeng Zhang 
Signed-off-by: Julian Anastasov 
Acked-by: Vlad Yasevich 
Signed-off-by: David S. Miller 
Signed-off-by: Ben Hutchings 
---
 net/sctp/protocol.c | 7 ++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c
index 6f6ad86..de35e01 100644
--- a/net/sctp/protocol.c
+++ b/net/sctp/protocol.c
@@ -528,8 +528,13 @@ static void sctp_v4_get_dst(struct sctp_transport *t, 
union sctp_addr *saddr,
continue;
if ((laddr->state == SCTP_ADDR_SRC) &&
(AF_INET == laddr->a.sa.sa_family)) {
-   fl4->saddr = laddr->a.v4.sin_addr.s_addr;
fl4->fl4_sport = laddr->a.v4.sin_port;
+   flowi4_update_output(fl4,
+asoc->base.sk->sk_bound_dev_if,
+RT_CONN_FLAGS(asoc->base.sk),
+daddr->v4.sin_addr.s_addr,
+laddr->a.v4.sin_addr.s_addr);
+
rt = ip_route_output_key(_net, fl4);
if (!IS_ERR(rt)) {
dst = >dst;

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 3.2 72/92] x86-64, modify_ldt: Make support for 16-bit segments a runtime option

2014-06-06 Thread Ben Hutchings
3.2.60-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Linus Torvalds 

commit fa81511bb0bbb2b1aace3695ce869da9762624ff upstream.

Checkin:

b3b42ac2cbae x86-64, modify_ldt: Ban 16-bit segments on 64-bit kernels

disabled 16-bit segments on 64-bit kernels due to an information
leak.  However, it does seem that people are genuinely using Wine to
run old 16-bit Windows programs on Linux.

A proper fix for this ("espfix64") is coming in the upcoming merge
window, but as a temporary fix, create a sysctl to allow the
administrator to re-enable support for 16-bit segments.

It adds a "/proc/sys/abi/ldt16" sysctl that defaults to zero (off). If
you hit this issue and care about your old Windows program more than
you care about a kernel stack address information leak, you can do

   echo 1 > /proc/sys/abi/ldt16

as root (add it to your startup scripts), and you should be ok.

The sysctl table is only added if you have COMPAT support enabled on
x86-64, but I assume anybody who runs old windows binaries very much
does that ;)

Signed-off-by: H. Peter Anvin 
Link: 
http://lkml.kernel.org/r/ca%2b55afw9bpod10u1lfhbomphwzkvjtkmcfcs9s3urpr1yyw...@mail.gmail.com
Signed-off-by: Ben Hutchings 
---
 arch/x86/kernel/ldt.c| 4 +++-
 arch/x86/vdso/vdso32-setup.c | 8 
 2 files changed, 11 insertions(+), 1 deletion(-)

--- a/arch/x86/kernel/ldt.c
+++ b/arch/x86/kernel/ldt.c
@@ -21,6 +21,8 @@
 #include 
 #include 
 
+int sysctl_ldt16 = 0;
+
 #ifdef CONFIG_SMP
 static void flush_ldt(void *current_mm)
 {
@@ -235,7 +237,7 @@ static int write_ldt(void __user *ptr, u
 * IRET leaking the high bits of the kernel stack address.
 */
 #ifdef CONFIG_X86_64
-   if (!ldt_info.seg_32bit) {
+   if (!ldt_info.seg_32bit && !sysctl_ldt16) {
error = -EINVAL;
goto out_unlock;
}
--- a/arch/x86/vdso/vdso32-setup.c
+++ b/arch/x86/vdso/vdso32-setup.c
@@ -41,6 +41,7 @@ enum {
 #ifdef CONFIG_X86_64
 #define vdso_enabled   sysctl_vsyscall32
 #define arch_setup_additional_pagessyscall32_setup_pages
+extern int sysctl_ldt16;
 #endif
 
 /*
@@ -387,6 +388,13 @@ static ctl_table abi_table2[] = {
.maxlen = sizeof(int),
.mode   = 0644,
.proc_handler   = proc_dointvec
+   },
+   {
+   .procname   = "ldt16",
+   .data   = _ldt16,
+   .maxlen = sizeof(int),
+   .mode   = 0644,
+   .proc_handler   = proc_dointvec
},
{}
 };

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 3.2 15/92] rtnetlink: Only supply IFLA_VF_PORTS information when RTEXT_FILTER_VF is set

2014-06-06 Thread Ben Hutchings
3.2.60-rc1 review patch.  If anyone has any objections, please let me know.

--

From: David Gibson 

[ Upstream commit c53864fd60227de025cb79e05493b13f69843971 ]

Since 115c9b81928360d769a76c632bae62d15206a94a (rtnetlink: Fix problem with
buffer allocation), RTM_NEWLINK messages only contain the IFLA_VFINFO_LIST
attribute if they were solicited by a GETLINK message containing an
IFLA_EXT_MASK attribute with the RTEXT_FILTER_VF flag.

That was done because some user programs broke when they received more data
than expected - because IFLA_VFINFO_LIST contains information for each VF
it can become large if there are many VFs.

However, the IFLA_VF_PORTS attribute, supplied for devices which implement
ndo_get_vf_port (currently the 'enic' driver only), has the same problem.
It supplies per-VF information and can therefore become large, but it is
not currently conditional on the IFLA_EXT_MASK value.

Worse, it interacts badly with the existing EXT_MASK handling.  When
IFLA_EXT_MASK is not supplied, the buffer for netlink replies is fixed at
NLMSG_GOODSIZE.  If the information for IFLA_VF_PORTS exceeds this, then
rtnl_fill_ifinfo() returns -EMSGSIZE on the first message in a packet.
netlink_dump() will misinterpret this as having finished the listing and
omit data for this interface and all subsequent ones.  That can cause
getifaddrs(3) to enter an infinite loop.

This patch addresses the problem by only supplying IFLA_VF_PORTS when
IFLA_EXT_MASK is supplied with the RTEXT_FILTER_VF flag set.

Signed-off-by: David Gibson 
Reviewed-by: Jiri Pirko 
Signed-off-by: David S. Miller 
Signed-off-by: Ben Hutchings 
---
 net/core/rtnetlink.c | 16 ++--
 1 file changed, 10 insertions(+), 6 deletions(-)

diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 978a367..7beaf10 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -744,7 +744,8 @@ static inline int rtnl_vfinfo_size(const struct net_device 
*dev,
return 0;
 }
 
-static size_t rtnl_port_size(const struct net_device *dev)
+static size_t rtnl_port_size(const struct net_device *dev,
+u32 ext_filter_mask)
 {
size_t port_size = nla_total_size(4)/* PORT_VF */
+ nla_total_size(PORT_PROFILE_MAX)  /* PORT_PROFILE */
@@ -760,7 +761,8 @@ static size_t rtnl_port_size(const struct net_device *dev)
size_t port_self_size = nla_total_size(sizeof(struct nlattr))
+ port_size;
 
-   if (!dev->netdev_ops->ndo_get_vf_port || !dev->dev.parent)
+   if (!dev->netdev_ops->ndo_get_vf_port || !dev->dev.parent ||
+   !(ext_filter_mask & RTEXT_FILTER_VF))
return 0;
if (dev_num_vf(dev->dev.parent))
return port_self_size + vf_ports_size +
@@ -791,7 +793,7 @@ static noinline size_t if_nlmsg_size(const struct 
net_device *dev,
   + nla_total_size(ext_filter_mask
& RTEXT_FILTER_VF ? 4 : 0) /* IFLA_NUM_VF */
   + rtnl_vfinfo_size(dev, ext_filter_mask) /* IFLA_VFINFO_LIST */
-  + rtnl_port_size(dev) /* IFLA_VF_PORTS + IFLA_PORT_SELF */
+  + rtnl_port_size(dev, ext_filter_mask) /* IFLA_VF_PORTS + 
IFLA_PORT_SELF */
   + rtnl_link_get_size(dev) /* IFLA_LINKINFO */
   + rtnl_link_get_af_size(dev); /* IFLA_AF_SPEC */
 }
@@ -851,11 +853,13 @@ static int rtnl_port_self_fill(struct sk_buff *skb, 
struct net_device *dev)
return 0;
 }
 
-static int rtnl_port_fill(struct sk_buff *skb, struct net_device *dev)
+static int rtnl_port_fill(struct sk_buff *skb, struct net_device *dev,
+ u32 ext_filter_mask)
 {
int err;
 
-   if (!dev->netdev_ops->ndo_get_vf_port || !dev->dev.parent)
+   if (!dev->netdev_ops->ndo_get_vf_port || !dev->dev.parent ||
+   !(ext_filter_mask & RTEXT_FILTER_VF))
return 0;
 
err = rtnl_port_self_fill(skb, dev);
@@ -1002,7 +1006,7 @@ static int rtnl_fill_ifinfo(struct sk_buff *skb, struct 
net_device *dev,
nla_nest_end(skb, vfinfo);
}
 
-   if (rtnl_port_fill(skb, dev))
+   if (rtnl_port_fill(skb, dev, ext_filter_mask))
goto nla_put_failure;
 
if (dev->rtnl_link_ops) {

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 3.2 73/92] PCI: shpchp: Check bridge's secondary (not primary) bus speed

2014-06-06 Thread Ben Hutchings
3.2.60-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Marcel Apfelbaum 

commit 93fa9d32670f5592c8e56abc9928fc194e1e72fc upstream.

When a new device is added below a hotplug bridge, the bridge's secondary
bus speed and the device's bus speed must match.  The shpchp driver
previously checked the bridge's *primary* bus speed, not the secondary bus
speed.

This caused hot-add errors like:

  shpchp :00:03.0: Speed of bus ff and adapter 0 mismatch

Check the secondary bus speed instead.

[bhelgaas: changelog]
Link: https://bugzilla.kernel.org/show_bug.cgi?id=75251
Fixes: 3749c51ac6c1 ("PCI: Make current and maximum bus speeds part of the PCI 
core")
Signed-off-by: Marcel Apfelbaum 
Signed-off-by: Bjorn Helgaas 
Acked-by: Michael S. Tsirkin 
Signed-off-by: Ben Hutchings 
---
 drivers/pci/hotplug/shpchp_ctrl.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/drivers/pci/hotplug/shpchp_ctrl.c
+++ b/drivers/pci/hotplug/shpchp_ctrl.c
@@ -285,8 +285,8 @@ static int board_added(struct slot *p_sl
return WRONG_BUS_FREQUENCY;
}
 
-   bsp = ctrl->pci_dev->bus->cur_bus_speed;
-   msp = ctrl->pci_dev->bus->max_bus_speed;
+   bsp = ctrl->pci_dev->subordinate->cur_bus_speed;
+   msp = ctrl->pci_dev->subordinate->max_bus_speed;
 
/* Check if there are other slots or devices on the same bus */
if (!list_empty(>pci_dev->subordinate->devices))

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 3.2 01/92] powerpc: Add vr save/restore functions

2014-06-06 Thread Ben Hutchings
3.2.60-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Andreas Schwab 

commit 8fe9c93e7453e67b8bd09f263ec1bb0783c733fc upstream.

GCC 4.8 now generates out-of-line vr save/restore functions when
optimizing for size.  They are needed for the raid6 altivec support.

Signed-off-by: Andreas Schwab 
Signed-off-by: Benjamin Herrenschmidt 
Signed-off-by: Ben Hutchings 
---
 arch/powerpc/lib/crtsavres.S | 186 +++
 scripts/mod/modpost.c|   8 +-
 2 files changed, 192 insertions(+), 2 deletions(-)

--- a/arch/powerpc/lib/crtsavres.S
+++ b/arch/powerpc/lib/crtsavres.S
@@ -230,6 +230,87 @@ _GLOBAL(_rest32gpr_31_x)
mr  1,11
blr
 
+#ifdef CONFIG_ALTIVEC
+/* Called with r0 pointing just beyond the end of the vector save area.  */
+
+_GLOBAL(_savevr_20)
+   li  r11,-192
+   stvxvr20,r11,r0
+_GLOBAL(_savevr_21)
+   li  r11,-176
+   stvxvr21,r11,r0
+_GLOBAL(_savevr_22)
+   li  r11,-160
+   stvxvr22,r11,r0
+_GLOBAL(_savevr_23)
+   li  r11,-144
+   stvxvr23,r11,r0
+_GLOBAL(_savevr_24)
+   li  r11,-128
+   stvxvr24,r11,r0
+_GLOBAL(_savevr_25)
+   li  r11,-112
+   stvxvr25,r11,r0
+_GLOBAL(_savevr_26)
+   li  r11,-96
+   stvxvr26,r11,r0
+_GLOBAL(_savevr_27)
+   li  r11,-80
+   stvxvr27,r11,r0
+_GLOBAL(_savevr_28)
+   li  r11,-64
+   stvxvr28,r11,r0
+_GLOBAL(_savevr_29)
+   li  r11,-48
+   stvxvr29,r11,r0
+_GLOBAL(_savevr_30)
+   li  r11,-32
+   stvxvr30,r11,r0
+_GLOBAL(_savevr_31)
+   li  r11,-16
+   stvxvr31,r11,r0
+   blr
+
+_GLOBAL(_restvr_20)
+   li  r11,-192
+   lvx vr20,r11,r0
+_GLOBAL(_restvr_21)
+   li  r11,-176
+   lvx vr21,r11,r0
+_GLOBAL(_restvr_22)
+   li  r11,-160
+   lvx vr22,r11,r0
+_GLOBAL(_restvr_23)
+   li  r11,-144
+   lvx vr23,r11,r0
+_GLOBAL(_restvr_24)
+   li  r11,-128
+   lvx vr24,r11,r0
+_GLOBAL(_restvr_25)
+   li  r11,-112
+   lvx vr25,r11,r0
+_GLOBAL(_restvr_26)
+   li  r11,-96
+   lvx vr26,r11,r0
+_GLOBAL(_restvr_27)
+   li  r11,-80
+   lvx vr27,r11,r0
+_GLOBAL(_restvr_28)
+   li  r11,-64
+   lvx vr28,r11,r0
+_GLOBAL(_restvr_29)
+   li  r11,-48
+   lvx vr29,r11,r0
+_GLOBAL(_restvr_30)
+   li  r11,-32
+   lvx vr30,r11,r0
+_GLOBAL(_restvr_31)
+   li  r11,-16
+   lvx vr31,r11,r0
+   blr
+
+#endif /* CONFIG_ALTIVEC */
+
 #else /* CONFIG_PPC64 */
 
 .globl _savegpr0_14
@@ -353,6 +434,111 @@ _restgpr0_31:
mtlrr0
blr
 
+#ifdef CONFIG_ALTIVEC
+/* Called with r0 pointing just beyond the end of the vector save area.  */
+
+.globl _savevr_20
+_savevr_20:
+   li  r12,-192
+   stvxvr20,r12,r0
+.globl _savevr_21
+_savevr_21:
+   li  r12,-176
+   stvxvr21,r12,r0
+.globl _savevr_22
+_savevr_22:
+   li  r12,-160
+   stvxvr22,r12,r0
+.globl _savevr_23
+_savevr_23:
+   li  r12,-144
+   stvxvr23,r12,r0
+.globl _savevr_24
+_savevr_24:
+   li  r12,-128
+   stvxvr24,r12,r0
+.globl _savevr_25
+_savevr_25:
+   li  r12,-112
+   stvxvr25,r12,r0
+.globl _savevr_26
+_savevr_26:
+   li  r12,-96
+   stvxvr26,r12,r0
+.globl _savevr_27
+_savevr_27:
+   li  r12,-80
+   stvxvr27,r12,r0
+.globl _savevr_28
+_savevr_28:
+   li  r12,-64
+   stvxvr28,r12,r0
+.globl _savevr_29
+_savevr_29:
+   li  r12,-48
+   stvxvr29,r12,r0
+.globl _savevr_30
+_savevr_30:
+   li  r12,-32
+   stvxvr30,r12,r0
+.globl _savevr_31
+_savevr_31:
+   li  r12,-16
+   stvxvr31,r12,r0
+   blr
+
+.globl _restvr_20
+_restvr_20:
+   li  r12,-192
+   lvx vr20,r12,r0
+.globl _restvr_21
+_restvr_21:
+   li  r12,-176
+   lvx vr21,r12,r0
+.globl _restvr_22
+_restvr_22:
+   li  r12,-160
+   lvx vr22,r12,r0
+.globl _restvr_23
+_restvr_23:
+   li  r12,-144
+   lvx vr23,r12,r0
+.globl _restvr_24
+_restvr_24:
+   li  r12,-128
+   lvx vr24,r12,r0
+.globl _restvr_25
+_restvr_25:
+   li  r12,-112
+   lvx vr25,r12,r0
+.globl _restvr_26
+_restvr_26:
+   li  r12,-96
+   lvx vr26,r12,r0
+.globl _restvr_27
+_restvr_27:
+   li  r12,-80
+   lvx vr27,r12,r0
+.globl _restvr_28
+_restvr_28:
+   li  r12,-64
+   lvx vr28,r12,r0
+.globl _restvr_29
+_restvr_29:
+   li  r12,-48
+   lvx vr29,r12,r0
+.globl _restvr_30
+_restvr_30:
+   li  r12,-32
+   lvx vr30,r12,r0
+.globl _restvr_31
+_restvr_31:
+   li  r12,-16
+   lvx vr31,r12,r0
+   blr
+
+#endif /* CONFIG_ALTIVEC */
+
 #endif /* CONFIG_PPC64 

[PATCH 3.2 00/92] 3.2.60-rc1 review

2014-06-06 Thread Ben Hutchings
This is the start of the stable review cycle for the 3.2.60 release.
There are 92 patches in this series, which will be posted as responses
to this one.  If anyone has any issues with these being applied, please
let me know.

Responses should be made by Mon Jun 09 01:26:28 UTC 2014.
Anything received after that time might be too late.

A combined patch relative to 3.2.59 will be posted as an additional
response to this.  A shortlog and diffstat can be found below.

Ben.

-

AceLan Kao (3):
  HID: usbhid: quirk for Synaptics HD touchscreen
 [d8e2e7581d2521910398c4c80d7a3b78e84da7d5]
  HID: usbhid: quirk for Synaptics Large Touchccreen
 [8171a67d587a09e14a4949a81e070345fedcf410]
  HID: usbhid: quirk for Synaptics Quad HD touchscreen
 [12f508aede4bda5d20a2dd3ff3deb16ef47a97e9]

Alex Deucher (1):
  drm/radeon: handle non-VGA class pci devices with ATRM
 [d8ade3526b2aa0505132c404c05a38b73ea15490]

Alex Elder (1):
  libceph: only call kernel_sendpage() via helper
 [e36b13cceb46136d849aeee06b4907ad3570ba78]

Alex Hung (1):
  thinkpad-acpi: fix issuing duplicated key events for brightness up/down
 [ff413195e830541afeae469fc866ecd0319abd7e]

Alexander Duyck (1):
  skb: Add inline helper for getting the skb end offset  from head
 [ec47ea82477404631d49b8e568c71826c9b663ac]

Andreas Schwab (1):
  powerpc: Add vr save/restore functions
 [8fe9c93e7453e67b8bd09f263ec1bb0783c733fc]

Anthony Iliopoulos (1):
  x86, mm, hugetlb: Add missing TLB page invalidation for hugetlb_cow()
 [9844f5462392b53824e8b86726e7c33b5ecbb676]

Ben Hutchings (1):
  rtl8192cu: Fix unbalanced irq enable in error path of rtl92cu_hw_init()
 [3234f5b06fc3094176a86772cc64baf3decc98fc]

Chen Yucong (1):
  hwpoison, hugetlb: lock_page/unlock_page does not match for handling a 
free hugepage
 [b985194c8c0a130ed155b71662e39f7eaea4876f]

Christian König (1):
  drm/radeon: also try GART for CPU accessed buffers
 [544092596e8ac269f70e70961b5e9381909c9b1e]

Christoph Hellwig (1):
  posix_acl: handle NULL ACL in posix_acl_equiv_mode
 [50c6e282bdf5e8dabf8d7cf7b162545a55645fd9]

Chunwei Chen (1):
  libceph: fix corruption when using page_count 0 page in rbd
 [178eda29ca721842f2146378e73d43e0044c4166]

Daniele Forsi (2):
  USB: Nokia 5300 should be treated as unusual dev
 [6ed07d45d09bc2aa60e27b845543db9972e22a38]
  usb: storage: shuttle_usbat: fix discs being detected twice
 [df602c2d2358f02c6e49cffc5b49b9daa16db033]

David Gibson (2):
  rtnetlink: Only supply IFLA_VF_PORTS information when  RTEXT_FILTER_VF is 
set
 [c53864fd60227de025cb79e05493b13f69843971]
  rtnetlink: Warn when interface's information won't fit  in our packet
 [973462bbde79bb827824c73b59027a0aed5c9ca6]

Dmitry Petukhov (1):
  l2tp: take PMTU from tunnel UDP socket
 [f34c4a35d87949fbb0e0f31eba3c054e9f8199ba]

Eric Dumazet (2):
  ipv6: Limit mtu to 65575 bytes
 [30f78d8ebf7f514801e71b88a10c948275168518]
  net-gro: reset skb->truesize in napi_reuse_skb()
 [e33d0ba8047b049c9262fdb1fcafb93cb52ceceb]

Ezequiel Garcia (1):
  dma: mv_xor: Flush descriptors before activating a channel
 [5a9a55bf9157d3490b0c8c4c81d4708602c26e07]

Florian Westphal (2):
  net: core: don't account for udp header size when  computing seglen
 [6d39d589bb76ee8a1c6cde6822006ae0053decff]
  net: ipv4: ip_forward: fix inverted local_df test
 [ca6c5d4ad216d5942ae544bbf02503041bd802aa]

Guennadi Liakhovetski (2):
  [media] V4L2: fix VIDIOC_CREATE_BUFS in 64- / 32-bit compatibility mode
 [97d9d23dda6f37d90aefeec4ed619d52df525382]
  [media] V4L2: ov7670: fix a wrong index, potentially Oopsing the kernel 
from user-space
 [cfece5857ca51d1dcdb157017aba226f594e9dcf]

Hans de Goede (3):
  HID: add NO_INIT_REPORTS quirk for Synaptics Touch Pad V 103S
 [2f433083e854ec72c19dc9b0e1cebcc8e230fd75]
  Input: elantech - fix touchpad initialization on Gigabyte U2442
 [36189cc3cd57ab0f1cd75241f93fe01de928ac06]
  Input: synaptics - add min/max quirk for ThinkPad Edge E431
 [27a38856a948c3e8de30dc71647ff9e1778c99fc]

Horia Geanta (1):
  crypto: caam - add allocation failure handling in SPRINTFCAT macro
 [27c5fb7a84242b66bf1e0b2fe6bf40d19bcc5c04]

Ilia Mirkin (1):
  drm/nouveau/acpi: allow non-optimus setups to load vbios from acpi
 [a3d0b1218d351c6e6f3cea36abe22236a08cb246]

Ivan Vecera (1):
  tg3: update rx_jumbo_pending ring param only when jumbo  frames are 
enabled
 [ba67b510035141bd89b40bf65efa0a79834311ca]

J. Bruce Fields (2):
  nfsd4: remove lockowner when removing lock stateid
 [a1b8ff4c97b4375d21b6d6c45d75877303f61b3b]
  nfsd4: warn on finding lockowner without stateid's
 [27b11428b7de097c42f205beabb1764f4365443b]

Jason Wang 

[PATCH 3.2 79/92] drm/radeon: handle non-VGA class pci devices with ATRM

2014-06-06 Thread Ben Hutchings
3.2.60-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Alex Deucher 

commit d8ade3526b2aa0505132c404c05a38b73ea15490 upstream.

Newer PX systems have non-VGA pci class dGPUs.  Update
the ATRM fetch method to handle those cases.

bug:
https://bugzilla.kernel.org/show_bug.cgi?id=75401

Signed-off-by: Alex Deucher 
Signed-off-by: Christian König 
[bwh: Backported to 3.2: s/ACPI_HANDLE()/DEVICE_ACPI_HANDLE()/]
Signed-off-by: Ben Hutchings 
---
 drivers/gpu/drm/radeon/radeon_bios.c | 14 ++
 1 file changed, 14 insertions(+)

--- a/drivers/gpu/drm/radeon/radeon_bios.c
+++ b/drivers/gpu/drm/radeon/radeon_bios.c
@@ -173,6 +173,20 @@ static bool radeon_atrm_get_bios(struct
}
}
 
+   if (!found) {
+   while ((pdev = pci_get_class(PCI_CLASS_DISPLAY_OTHER << 8, 
pdev)) != NULL) {
+   dhandle = DEVICE_ACPI_HANDLE(>dev);
+   if (!dhandle)
+   continue;
+
+   status = acpi_get_handle(dhandle, "ATRM", _handle);
+   if (!ACPI_FAILURE(status)) {
+   found = true;
+   break;
+   }
+   }
+   }
+
if (!found)
return false;
 

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 3.2 78/92] drm/radeon: also try GART for CPU accessed buffers

2014-06-06 Thread Ben Hutchings
3.2.60-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Christian König 

commit 544092596e8ac269f70e70961b5e9381909c9b1e upstream.

Placing them exclusively into VRAM might not work all the time.

Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=78297

Signed-off-by: Christian König 
Reviewed-by: Alex Deucher 
[bwh: Backported to 3.2: ttm_bo_validate() takes an extra no_wait_reserve
 parameter; keep passing true]
Signed-off-by: Ben Hutchings 
---
 drivers/gpu/drm/radeon/radeon_object.c | 38 --
 1 file changed, 23 insertions(+), 15 deletions(-)

--- a/drivers/gpu/drm/radeon/radeon_object.c
+++ b/drivers/gpu/drm/radeon/radeon_object.c
@@ -513,22 +513,30 @@ int radeon_bo_fault_reserve_notify(struc
rbo = container_of(bo, struct radeon_bo, tbo);
radeon_bo_check_tiling(rbo, 0, 0);
rdev = rbo->rdev;
-   if (bo->mem.mem_type == TTM_PL_VRAM) {
-   size = bo->mem.num_pages << PAGE_SHIFT;
-   offset = bo->mem.start << PAGE_SHIFT;
-   if ((offset + size) > rdev->mc.visible_vram_size) {
-   /* hurrah the memory is not visible ! */
-   radeon_ttm_placement_from_domain(rbo, 
RADEON_GEM_DOMAIN_VRAM);
-   rbo->placement.lpfn = rdev->mc.visible_vram_size >> 
PAGE_SHIFT;
-   r = ttm_bo_validate(bo, >placement, false, true, 
false);
-   if (unlikely(r != 0))
-   return r;
-   offset = bo->mem.start << PAGE_SHIFT;
-   /* this should not happen */
-   if ((offset + size) > rdev->mc.visible_vram_size)
-   return -EINVAL;
-   }
+   if (bo->mem.mem_type != TTM_PL_VRAM)
+   return 0;
+
+   size = bo->mem.num_pages << PAGE_SHIFT;
+   offset = bo->mem.start << PAGE_SHIFT;
+   if ((offset + size) <= rdev->mc.visible_vram_size)
+   return 0;
+
+   /* hurrah the memory is not visible ! */
+   radeon_ttm_placement_from_domain(rbo, RADEON_GEM_DOMAIN_VRAM);
+   rbo->placement.lpfn = rdev->mc.visible_vram_size >> PAGE_SHIFT;
+   r = ttm_bo_validate(bo, >placement, false, true, false);
+   if (unlikely(r == -ENOMEM)) {
+   radeon_ttm_placement_from_domain(rbo, RADEON_GEM_DOMAIN_GTT);
+   return ttm_bo_validate(bo, >placement, false, true, false);
+   } else if (unlikely(r != 0)) {
+   return r;
}
+
+   offset = bo->mem.start << PAGE_SHIFT;
+   /* this should never happen */
+   if ((offset + size) > rdev->mc.visible_vram_size)
+   return -EINVAL;
+
return 0;
 }
 

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 3.2 14/92] rtnetlink: Warn when interface's information won't fit in our packet

2014-06-06 Thread Ben Hutchings
3.2.60-rc1 review patch.  If anyone has any objections, please let me know.

--

From: David Gibson 

[ Upstream commit 973462bbde79bb827824c73b59027a0aed5c9ca6 ]

Without IFLA_EXT_MASK specified, the information reported for a single
interface in response to RTM_GETLINK is expected to fit within a netlink
packet of NLMSG_GOODSIZE.

If it doesn't, however, things will go badly wrong,  When listing all
interfaces, netlink_dump() will incorrectly treat -EMSGSIZE on the first
message in a packet as the end of the listing and omit information for
that interface and all subsequent ones.  This can cause getifaddrs(3) to
enter an infinite loop.

This patch won't fix the problem, but it will WARN_ON() making it easier to
track down what's going wrong.

Signed-off-by: David Gibson 
Reviewed-by: Jiri Pirko 
Signed-off-by: David S. Miller 
Signed-off-by: Ben Hutchings 
---
 net/core/rtnetlink.c | 17 -
 1 file changed, 12 insertions(+), 5 deletions(-)

diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 5b7d5f2..978a367 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -1057,6 +1057,7 @@ static int rtnl_dump_ifinfo(struct sk_buff *skb, struct 
netlink_callback *cb)
struct hlist_node *node;
struct nlattr *tb[IFLA_MAX+1];
u32 ext_filter_mask = 0;
+   int err;
 
s_h = cb->args[0];
s_idx = cb->args[1];
@@ -1077,11 +1078,17 @@ static int rtnl_dump_ifinfo(struct sk_buff *skb, struct 
netlink_callback *cb)
hlist_for_each_entry_rcu(dev, node, head, index_hlist) {
if (idx < s_idx)
goto cont;
-   if (rtnl_fill_ifinfo(skb, dev, RTM_NEWLINK,
-NETLINK_CB(cb->skb).pid,
-cb->nlh->nlmsg_seq, 0,
-NLM_F_MULTI,
-ext_filter_mask) <= 0)
+   err = rtnl_fill_ifinfo(skb, dev, RTM_NEWLINK,
+  NETLINK_CB(cb->skb).pid,
+  cb->nlh->nlmsg_seq, 0,
+  NLM_F_MULTI,
+  ext_filter_mask);
+   /* If we ran out of room on the first message,
+* we're in trouble
+*/
+   WARN_ON((err == -EMSGSIZE) && (skb->len == 0));
+
+   if (err <= 0)
goto out;
 
nl_dump_check_consistent(cb, nlmsg_hdr(skb));

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 3.2 92/92] futex: Make lookup_pi_state more robust

2014-06-06 Thread Ben Hutchings
3.2.60-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Thomas Gleixner 

commit 54a217887a7b658e2650c3feff22756ab80c7339 upstream.

The current implementation of lookup_pi_state has ambigous handling of
the TID value 0 in the user space futex.  We can get into the kernel
even if the TID value is 0, because either there is a stale waiters bit
or the owner died bit is set or we are called from the requeue_pi path
or from user space just for fun.

The current code avoids an explicit sanity check for pid = 0 in case
that kernel internal state (waiters) are found for the user space
address.  This can lead to state leakage and worse under some
circumstances.

Handle the cases explicit:

   Waiter | pi_state | pi->owner | uTID  | uODIED | ?

  [1]  NULL   | ---  | ---   | 0 | 0/1| Valid
  [2]  NULL   | ---  | ---   | >0| 0/1| Valid

  [3]  Found  | NULL | --| Any   | 0/1| Invalid

  [4]  Found  | Found| NULL  | 0 | 1  | Valid
  [5]  Found  | Found| NULL  | >0| 1  | Invalid

  [6]  Found  | Found| task  | 0 | 1  | Valid

  [7]  Found  | Found| NULL  | Any   | 0  | Invalid

  [8]  Found  | Found| task  | ==taskTID | 0/1| Valid
  [9]  Found  | Found| task  | 0 | 0  | Invalid
  [10] Found  | Found| task  | !=taskTID | 0/1| Invalid

 [1] Indicates that the kernel can acquire the futex atomically. We
 came came here due to a stale FUTEX_WAITERS/FUTEX_OWNER_DIED bit.

 [2] Valid, if TID does not belong to a kernel thread. If no matching
 thread is found then it indicates that the owner TID has died.

 [3] Invalid. The waiter is queued on a non PI futex

 [4] Valid state after exit_robust_list(), which sets the user space
 value to FUTEX_WAITERS | FUTEX_OWNER_DIED.

 [5] The user space value got manipulated between exit_robust_list()
 and exit_pi_state_list()

 [6] Valid state after exit_pi_state_list() which sets the new owner in
 the pi_state but cannot access the user space value.

 [7] pi_state->owner can only be NULL when the OWNER_DIED bit is set.

 [8] Owner and user space value match

 [9] There is no transient state which sets the user space TID to 0
 except exit_robust_list(), but this is indicated by the
 FUTEX_OWNER_DIED bit. See [4]

[10] There is no transient state which leaves owner and user space
 TID out of sync.

Signed-off-by: Thomas Gleixner 
Cc: Kees Cook 
Cc: Will Drewry 
Cc: Darren Hart 
Signed-off-by: Linus Torvalds 
Signed-off-by: Ben Hutchings 
---
 kernel/futex.c | 134 +
 1 file changed, 106 insertions(+), 28 deletions(-)

--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -588,10 +588,58 @@ void exit_pi_state_list(struct task_stru
raw_spin_unlock_irq(>pi_lock);
 }
 
+/*
+ * We need to check the following states:
+ *
+ *  Waiter | pi_state | pi->owner | uTID  | uODIED | ?
+ *
+ * [1]  NULL   | ---  | ---   | 0 | 0/1| Valid
+ * [2]  NULL   | ---  | ---   | >0| 0/1| Valid
+ *
+ * [3]  Found  | NULL | --| Any   | 0/1| Invalid
+ *
+ * [4]  Found  | Found| NULL  | 0 | 1  | Valid
+ * [5]  Found  | Found| NULL  | >0| 1  | Invalid
+ *
+ * [6]  Found  | Found| task  | 0 | 1  | Valid
+ *
+ * [7]  Found  | Found| NULL  | Any   | 0  | Invalid
+ *
+ * [8]  Found  | Found| task  | ==taskTID | 0/1| Valid
+ * [9]  Found  | Found| task  | 0 | 0  | Invalid
+ * [10] Found  | Found| task  | !=taskTID | 0/1| Invalid
+ *
+ * [1] Indicates that the kernel can acquire the futex atomically. We
+ * came came here due to a stale FUTEX_WAITERS/FUTEX_OWNER_DIED bit.
+ *
+ * [2] Valid, if TID does not belong to a kernel thread. If no matching
+ *  thread is found then it indicates that the owner TID has died.
+ *
+ * [3] Invalid. The waiter is queued on a non PI futex
+ *
+ * [4] Valid state after exit_robust_list(), which sets the user space
+ * value to FUTEX_WAITERS | FUTEX_OWNER_DIED.
+ *
+ * [5] The user space value got manipulated between exit_robust_list()
+ * and exit_pi_state_list()
+ *
+ * [6] Valid state after exit_pi_state_list() which sets the new owner in
+ * the pi_state but cannot access the user space value.
+ *
+ * [7] pi_state->owner can only be NULL when the OWNER_DIED bit is set.
+ *
+ * [8] Owner and user space value match
+ *
+ * [9] There is no transient state which sets the user space TID to 0
+ * except exit_robust_list(), but this is indicated by the
+ * FUTEX_OWNER_DIED bit. See [4]
+ *
+ * [10] There is no transient state which leaves owner and user space
+ * TID out of sync.
+ */
 static int
 lookup_pi_state(u32 uval, struct futex_hash_bucket *hb,
-  

[PATCH 3.2 02/92] ACPI / EC: Clear stale EC events on Samsung systems

2014-06-06 Thread Ben Hutchings
3.2.60-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Kieran Clancy 

commit ad332c8a45330d170bb38b95209de449b31cd1b4 upstream.

A number of Samsung notebooks (530Uxx/535Uxx/540Uxx/550Pxx/900Xxx/etc)
continue to log events during sleep (lid open/close, AC plug/unplug,
battery level change), which accumulate in the EC until a buffer fills.
After the buffer is full (tests suggest it holds 8 events), GPEs stop
being triggered for new events. This state persists on wake or even on
power cycle, and prevents new events from being registered until the EC
is manually polled.

This is the root cause of a number of bugs, including AC not being
detected properly, lid close not triggering suspend, and low ambient
light not triggering the keyboard backlight. The bug also seemed to be
responsible for performance issues on at least one user's machine.

Juan Manuel Cabo found the cause of bug and the workaround of polling
the EC manually on wake.

The loop which clears the stale events is based on an earlier patch by
Lan Tianyu (see referenced attachment).

This patch:
 - Adds a function acpi_ec_clear() which polls the EC for stale _Q
   events at most ACPI_EC_CLEAR_MAX (currently 100) times. A warning is
   logged if this limit is reached.
 - Adds a flag EC_FLAGS_CLEAR_ON_RESUME which is set to 1 if the DMI
   system vendor is Samsung. This check could be replaced by several
   more specific DMI vendor/product pairs, but it's likely that the bug
   affects more Samsung products than just the five series mentioned
   above. Further, it should not be harmful to run acpi_ec_clear() on
   systems without the bug; it will return immediately after finding no
   data waiting.
 - Runs acpi_ec_clear() on initialisation (boot), from acpi_ec_add()
 - Runs acpi_ec_clear() on wake, from acpi_ec_unblock_transactions()

References: https://bugzilla.kernel.org/show_bug.cgi?id=44161
References: https://bugzilla.kernel.org/show_bug.cgi?id=45461
References: https://bugzilla.kernel.org/show_bug.cgi?id=57271
References: https://bugzilla.kernel.org/attachment.cgi?id=126801
Suggested-by: Juan Manuel Cabo 
Signed-off-by: Kieran Clancy 
Reviewed-by: Lan Tianyu 
Reviewed-by: Dennis Jansen 
Tested-by: Kieran Clancy 
Tested-by: Juan Manuel Cabo 
Tested-by: Dennis Jansen 
Tested-by: Maurizio D'Addona 
Tested-by: San Zamoyski 
Signed-off-by: Rafael J. Wysocki 
[bwh: Backported to 3.2:
 - Adjust context
 - acpi_ec::mutex was called lock]
Signed-off-by: Ben Hutchings 
---
 drivers/acpi/ec.c | 64 +++
 1 file changed, 64 insertions(+)

--- a/drivers/acpi/ec.c
+++ b/drivers/acpi/ec.c
@@ -70,6 +70,8 @@ enum ec_command {
 #define ACPI_EC_DELAY  500 /* Wait 500ms max. during EC ops */
 #define ACPI_EC_UDELAY_GLK 1000/* Wait 1ms max. to get global lock */
 #define ACPI_EC_MSI_UDELAY 550 /* Wait 550us for MSI EC */
+#define ACPI_EC_CLEAR_MAX  100 /* Maximum number of events to query
+* when trying to clear the EC */
 
 enum {
EC_FLAGS_QUERY_PENDING, /* Query is pending */
@@ -123,6 +125,7 @@ EXPORT_SYMBOL(first_ec);
 static int EC_FLAGS_MSI; /* Out-of-spec MSI controller */
 static int EC_FLAGS_VALIDATE_ECDT; /* ASUStec ECDTs need to be validated */
 static int EC_FLAGS_SKIP_DSDT_SCAN; /* Not all BIOS survive early DSDT scan */
+static int EC_FLAGS_CLEAR_ON_RESUME; /* Needs acpi_ec_clear() on boot/resume */
 
 /* --
  Transaction Management
@@ -449,6 +452,29 @@ int ec_transaction(u8 command,
 
 EXPORT_SYMBOL(ec_transaction);
 
+static int acpi_ec_query_unlocked(struct acpi_ec *ec, u8 *data);
+
+/*
+ * Clears stale _Q events that might have accumulated in the EC.
+ * Run with locked ec mutex.
+ */
+static void acpi_ec_clear(struct acpi_ec *ec)
+{
+   int i, status;
+   u8 value = 0;
+
+   for (i = 0; i < ACPI_EC_CLEAR_MAX; i++) {
+   status = acpi_ec_query_unlocked(ec, );
+   if (status || !value)
+   break;
+   }
+
+   if (unlikely(i == ACPI_EC_CLEAR_MAX))
+   pr_warn("Warning: Maximum of %d stale EC events cleared\n", i);
+   else
+   pr_info("%d stale EC events cleared\n", i);
+}
+
 void acpi_ec_block_transactions(void)
 {
struct acpi_ec *ec = first_ec;
@@ -472,6 +498,10 @@ void acpi_ec_unblock_transactions(void)
mutex_lock(>lock);
/* Allow transactions to be carried out again */
clear_bit(EC_FLAGS_BLOCKED, >flags);
+
+   if (EC_FLAGS_CLEAR_ON_RESUME)
+   acpi_ec_clear(ec);
+
mutex_unlock(>lock);
 }
 
@@ -828,6 +858,13 @@ static int acpi_ec_add(struct acpi_devic
 
/* EC is fully operational, allow queries */
clear_bit(EC_FLAGS_QUERY_PENDING, >flags);
+
+   /* Clear stale _Q events if hardware might 

[PATCH 3.2 76/92] perf: Limit perf_event_attr::sample_period to 63 bits

2014-06-06 Thread Ben Hutchings
3.2.60-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Peter Zijlstra 

commit 0819b2e30ccb93edf04876237b6205eef84ec8d2 upstream.

Vince reported that using a large sample_period (one with bit 63 set)
results in wreckage since while the sample_period is fundamentally
unsigned (negative periods don't make sense) the way we implement
things very much rely on signed logic.

So limit sample_period to 63 bits to avoid tripping over this.

Reported-by: Vince Weaver 
Signed-off-by: Peter Zijlstra 
Link: http://lkml.kernel.org/n/tip-p25fhunibl4y3qi0zuqmy...@git.kernel.org
Signed-off-by: Thomas Gleixner 
Signed-off-by: Ben Hutchings 
---
 kernel/events/core.c | 3 +++
 1 file changed, 3 insertions(+)

--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -6301,6 +6301,9 @@ SYSCALL_DEFINE5(perf_event_open,
if (attr.freq) {
if (attr.sample_freq > sysctl_perf_event_sample_rate)
return -EINVAL;
+   } else {
+   if (attr.sample_period & (1ULL << 63))
+   return -EINVAL;
}
 
/*

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 3.2 67/92] [media] V4L2: ov7670: fix a wrong index, potentially Oopsing the kernel from user-space

2014-06-06 Thread Ben Hutchings
3.2.60-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Guennadi Liakhovetski 

commit cfece5857ca51d1dcdb157017aba226f594e9dcf upstream.

Commit 75e2bdad8901a0b599e01a96229be922eef1e488 "ov7670: allow
configuration of image size, clock speed, and I/O method" uses a wrong
index to iterate an array. Apart from being wrong, it also uses an
unchecked value from user-space, which can cause access to unmapped
memory in the kernel, triggered by a normal desktop user with rights to
use V4L2 devices.

Signed-off-by: Guennadi Liakhovetski 
Acked-by: Jonathan Corbet 
Signed-off-by: Mauro Carvalho Chehab 
[bwh: Backported to 3.2:
 - Adjust filename
 - win_sizes array is static, not per-device]
Signed-off-by: Ben Hutchings 
---
 drivers/media/video/ov7670.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/media/video/ov7670.c
+++ b/drivers/media/video/ov7670.c
@@ -937,7 +937,7 @@ static int ov7670_enum_framesizes(struct
 * windows that fall outside that.
 */
for (i = 0; i < N_WIN_SIZES; i++) {
-   struct ov7670_win_size *win = _win_sizes[index];
+   struct ov7670_win_size *win = _win_sizes[i];
if (info->min_width && win->width < info->min_width)
continue;
if (info->min_height && win->height < info->min_height)

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 3.2 51/92] HID: usbhid: quirk for Synaptics HD touchscreen

2014-06-06 Thread Ben Hutchings
3.2.60-rc1 review patch.  If anyone has any objections, please let me know.

--

From: AceLan Kao 

commit d8e2e7581d2521910398c4c80d7a3b78e84da7d5 upstream.

Add Synaptics HD touchscreen(06cb:0ac3) to no init report quirk.

Signed-off-by: AceLan Kao 
Signed-off-by: Jiri Kosina 
Signed-off-by: Ben Hutchings 
---
 drivers/hid/hid-ids.h   | 1 +
 drivers/hid/usbhid/hid-quirks.c | 1 +
 2 files changed, 2 insertions(+)

--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -681,6 +681,7 @@
 #define USB_VENDOR_ID_SYNAPTICS0x06cb
 #define USB_DEVICE_ID_SYNAPTICS_LTS1   0x0af8
 #define USB_DEVICE_ID_SYNAPTICS_LTS2   0x1d10
+#define USB_DEVICE_ID_SYNAPTICS_HD 0x0ac3
 
 #define USB_VENDOR_ID_THRUSTMASTER 0x044f
 
--- a/drivers/hid/usbhid/hid-quirks.c
+++ b/drivers/hid/usbhid/hid-quirks.c
@@ -102,6 +102,7 @@ static const struct hid_blacklist {
{ USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_DUOSENSE, 
HID_QUIRK_NO_INIT_REPORTS },
{ USB_VENDOR_ID_SYNAPTICS, USB_DEVICE_ID_SYNAPTICS_LTS1, 
HID_QUIRK_NO_INIT_REPORTS },
{ USB_VENDOR_ID_SYNAPTICS, USB_DEVICE_ID_SYNAPTICS_LTS2, 
HID_QUIRK_NO_INIT_REPORTS },
+   { USB_VENDOR_ID_SYNAPTICS, USB_DEVICE_ID_SYNAPTICS_HD, 
HID_QUIRK_NO_INIT_REPORTS },
 
{ 0, 0 }
 };

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 3.2 81/92] can: peak_pci: prevent use after free at netdev removal

2014-06-06 Thread Ben Hutchings
3.2.60-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Stephane Grosjean 

commit 0b5a958cf4df3a5cd578b861471e62138f55c85e upstream.

As remarked by Christopher R. Baker in his post at

http://marc.info/?l=linux-can=139707295706465=2

there's a possibility for an use after free condition at device removal.

This simplified patch introduces an additional variable to prevent the issue.
Thanks for catching this.

Reported-by: Christopher R. Baker 
Signed-off-by: Stephane Grosjean 
Signed-off-by: Marc Kleine-Budde 
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings 
---
 drivers/net/can/sja1000/peak_pci.c | 14 +-
 1 file changed, 9 insertions(+), 5 deletions(-)

--- a/drivers/net/can/sja1000/peak_pci.c
+++ b/drivers/net/can/sja1000/peak_pci.c
@@ -98,7 +98,7 @@ static int __devinit peak_pci_probe(stru
 {
struct sja1000_priv *priv;
struct peak_pci_chan *chan;
-   struct net_device *dev;
+   struct net_device *dev, *prev_dev;
void __iomem *cfg_base, *reg_base;
u16 sub_sys_id, icr;
int i, err, channels;
@@ -213,11 +213,13 @@ failure_remove_channels:
/* Disable interrupts */
writew(0x0, cfg_base + PITA_ICR + 2);
 
-   for (dev = pci_get_drvdata(pdev); dev; dev = chan->prev_dev) {
-   unregister_sja1000dev(dev);
-   free_sja1000dev(dev);
+   for (dev = pci_get_drvdata(pdev); dev; dev = prev_dev) {
priv = netdev_priv(dev);
chan = priv->priv;
+   prev_dev = chan->prev_dev;
+
+   unregister_sja1000dev(dev);
+   free_sja1000dev(dev);
}
 
pci_iounmap(pdev, reg_base);
@@ -247,10 +249,12 @@ static void __devexit peak_pci_remove(st
 
/* Loop over all registered devices */
while (1) {
+   struct net_device *prev_dev = chan->prev_dev;
+
dev_info(>dev, "removing device %s\n", dev->name);
unregister_sja1000dev(dev);
free_sja1000dev(dev);
-   dev = chan->prev_dev;
+   dev = prev_dev;
if (!dev)
break;
priv = netdev_priv(dev);

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 3.2 68/92] [media] V4L2: fix VIDIOC_CREATE_BUFS in 64- / 32-bit compatibility mode

2014-06-06 Thread Ben Hutchings
3.2.60-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Guennadi Liakhovetski 

commit 97d9d23dda6f37d90aefeec4ed619d52df525382 upstream.

If a struct contains 64-bit fields, it is aligned on 64-bit boundaries
within containing structs in 64-bit compilations. This is the case with
struct v4l2_window, which contains pointers and is embedded into struct
v4l2_format, and that one is embedded into struct v4l2_create_buffers.
Unlike some other structs, used as a part of the kernel ABI as ioctl()
arguments, that are packed, these structs aren't packed. This isn't a
problem per se, but the ioctl-compat code for VIDIOC_CREATE_BUFS contains
a bug, that triggers in such 64-bit builds. That code wrongly assumes,
that in struct v4l2_create_buffers, struct v4l2_format immediately follows
the __u32 memory field, which in fact isn't the case. This bug wasn't
visible until now, because until recently hardly any applications used
this ioctl() and mostly embedded 32-bit only drivers implemented it. This
is changing now with addition of this ioctl() to some USB drivers, e.g.
UVC. This patch fixes the bug by copying parts of struct
v4l2_create_buffers separately.

Signed-off-by: Guennadi Liakhovetski 
Acked-by: Laurent Pinchart 
Signed-off-by: Mauro Carvalho Chehab 
[bwh: Backported to 3.2: adjust filename]
Signed-off-by: Ben Hutchings 
---
 drivers/media/video/v4l2-compat-ioctl32.c | 12 +++-
 1 file changed, 7 insertions(+), 5 deletions(-)

--- a/drivers/media/video/v4l2-compat-ioctl32.c
+++ b/drivers/media/video/v4l2-compat-ioctl32.c
@@ -178,6 +178,9 @@ struct v4l2_create_buffers32 {
 
 static int __get_v4l2_format32(struct v4l2_format *kp, struct v4l2_format32 
__user *up)
 {
+   if (get_user(kp->type, >type))
+   return -EFAULT;
+
switch (kp->type) {
case V4L2_BUF_TYPE_VIDEO_CAPTURE:
case V4L2_BUF_TYPE_VIDEO_OUTPUT:
@@ -208,17 +211,16 @@ static int __get_v4l2_format32(struct v4
 
 static int get_v4l2_format32(struct v4l2_format *kp, struct v4l2_format32 
__user *up)
 {
-   if (!access_ok(VERIFY_READ, up, sizeof(struct v4l2_format32)) ||
-   get_user(kp->type, >type))
-   return -EFAULT;
+   if (!access_ok(VERIFY_READ, up, sizeof(struct v4l2_format32)))
+   return -EFAULT;
return __get_v4l2_format32(kp, up);
 }
 
 static int get_v4l2_create32(struct v4l2_create_buffers *kp, struct 
v4l2_create_buffers32 __user *up)
 {
if (!access_ok(VERIFY_READ, up, sizeof(struct v4l2_create_buffers32)) ||
-   copy_from_user(kp, up, offsetof(struct v4l2_create_buffers32, 
format.fmt)))
-   return -EFAULT;
+   copy_from_user(kp, up, offsetof(struct v4l2_create_buffers32, 
format)))
+   return -EFAULT;
return __get_v4l2_format32(>format, >format);
 }
 

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 3.2 65/92] hwmon: (emc1403) fix inverted store_hyst()

2014-06-06 Thread Ben Hutchings
3.2.60-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Josef Gajdusek 

commit 17c048fc4bd95efea208a1920f169547d8588f1f upstream.

Attempts to set the hysteresis value to a temperature below the target
limit fails with "write error: Numerical result out of range" due to
an inverted comparison.

Signed-off-by: Josef Gajdusek 
Reviewed-by: Jean Delvare 
[Guenter Roeck: Updated headline and description]
Signed-off-by: Guenter Roeck 
Signed-off-by: Ben Hutchings 
---
 drivers/hwmon/emc1403.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/hwmon/emc1403.c
+++ b/drivers/hwmon/emc1403.c
@@ -159,7 +159,7 @@ static ssize_t store_hyst(struct device
if (retval < 0)
goto fail;
 
-   hyst = val - retval * 1000;
+   hyst = retval * 1000 - val;
hyst = DIV_ROUND_CLOSEST(hyst, 1000);
if (hyst < 0 || hyst > 255) {
retval = -ERANGE;

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 3.2 48/92] USB: Nokia 305 should be treated as unusual dev

2014-06-06 Thread Ben Hutchings
3.2.60-rc1 review patch.  If anyone has any objections, please let me know.

--

From: "Victor A. Santos" 

commit f0ef5d41792a46a1085dead9dfb0bdb2c574638e upstream.

Signed-off-by: Victor A. Santos 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Ben Hutchings 
---
 drivers/usb/storage/unusual_devs.h | 7 +++
 1 file changed, 7 insertions(+)

--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -226,6 +226,13 @@ UNUSUAL_DEV(  0x0421, 0x0495, 0x0370, 0x
USB_SC_DEVICE, USB_PR_DEVICE, NULL,
US_FL_MAX_SECTORS_64 ),
 
+/* Patch submitted by Victor A. Santos  */
+UNUSUAL_DEV(  0x0421, 0x05af, 0x0742, 0x0742,
+   "Nokia",
+   "305",
+   USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+   US_FL_MAX_SECTORS_64),
+
 /* Patch submitted by Mikhail Zolotaryov  */
 UNUSUAL_DEV(  0x0421, 0x06aa, 0x1110, 0x1110,
"Nokia",

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 3.2 57/92] NFSd: call rpc_destroy_wait_queue() from free_client()

2014-06-06 Thread Ben Hutchings
3.2.60-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Trond Myklebust 

commit 4cb57e3032d4e4bf5e97780e9907da7282b02b0c upstream.

Mainly to ensure that we don't leave any hanging timers.

Signed-off-by: Trond Myklebust 
Signed-off-by: J. Bruce Fields 
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings 
---
 fs/nfsd/nfs4state.c | 1 +
 1 file changed, 1 insertion(+)

--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -1011,6 +1011,7 @@ free_client(struct nfs4_client *clp)
list_del(>se_perclnt);
nfsd4_put_session(ses);
}
+   rpc_destroy_wait_queue(>cl_cb_waitq);
if (clp->cl_cred.cr_group_info)
put_group_info(clp->cl_cred.cr_group_info);
kfree(clp->cl_principal);

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 3.2 56/92] NFSd: Move default initialisers from create_client() to alloc_client()

2014-06-06 Thread Ben Hutchings
3.2.60-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Trond Myklebust 

commit 5694c93e6c4954fa9424c215f75eeb919bddad64 upstream.

Aside from making it clearer what is non-trivial in create_client(), it
also fixes a bug whereby we can call free_client() before idr_init()
has been called.

Signed-off-by: Trond Myklebust 
Signed-off-by: J. Bruce Fields 
[bwh: Backported to 3.2:
 - Adjust context
 - Also move initialisation of nfs4_client::cl_strhash, but
   not nfs4_client::cl_revoked]
Signed-off-by: Ben Hutchings 
---
 fs/nfsd/nfs4state.c | 24 
 1 file changed, 12 insertions(+), 12 deletions(-)

--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -986,6 +986,18 @@ static struct nfs4_client *alloc_client(
}
memcpy(clp->cl_name.data, name.data, name.len);
clp->cl_name.len = name.len;
+   INIT_LIST_HEAD(>cl_sessions);
+   idr_init(>cl_stateids);
+   atomic_set(>cl_refcount, 0);
+   clp->cl_cb_state = NFSD4_CB_UNKNOWN;
+   INIT_LIST_HEAD(>cl_idhash);
+   INIT_LIST_HEAD(>cl_strhash);
+   INIT_LIST_HEAD(>cl_openowners);
+   INIT_LIST_HEAD(>cl_delegations);
+   INIT_LIST_HEAD(>cl_lru);
+   INIT_LIST_HEAD(>cl_callbacks);
+   spin_lock_init(>cl_lock);
+   rpc_init_wait_queue(>cl_cb_waitq, "Backchannel slot table");
return clp;
 }
 
@@ -1163,7 +1175,6 @@ static struct nfs4_client *create_client
if (clp == NULL)
return NULL;
 
-   INIT_LIST_HEAD(>cl_sessions);
 
princ = svc_gss_principal(rqstp);
if (princ) {
@@ -1174,21 +1185,10 @@ static struct nfs4_client *create_client
}
}
 
-   idr_init(>cl_stateids);
memcpy(clp->cl_recdir, recdir, HEXDIR_LEN);
-   atomic_set(>cl_refcount, 0);
-   clp->cl_cb_state = NFSD4_CB_UNKNOWN;
-   INIT_LIST_HEAD(>cl_idhash);
-   INIT_LIST_HEAD(>cl_strhash);
-   INIT_LIST_HEAD(>cl_openowners);
-   INIT_LIST_HEAD(>cl_delegations);
-   INIT_LIST_HEAD(>cl_lru);
-   INIT_LIST_HEAD(>cl_callbacks);
-   spin_lock_init(>cl_lock);
INIT_WORK(>cl_cb_null.cb_work, nfsd4_do_callback_rpc);
clp->cl_time = get_seconds();
clear_bit(0, >cl_cb_slot_busy);
-   rpc_init_wait_queue(>cl_cb_waitq, "Backchannel slot table");
copy_verf(clp, verf);
rpc_copy_addr((struct sockaddr *) >cl_addr, sa);
clp->cl_flavor = rqstp->rq_flavor;

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


Re: [RFC PATCH 1/1] cleanup: use bool as return type for rwsem_is_locked

2014-06-06 Thread Pranith Kumar
On 06/06/2014 08:59 PM, Pranith Kumar wrote:
> On 06/06/2014 08:18 PM, Dave Chinner wrote:
>> On Fri, Jun 06, 2014 at 02:11:18PM -0400, Pranith Kumar wrote:
>>> On 06/06/2014 01:53 PM, Pranith Kumar wrote:
 On Fri, Jun 6, 2014 at 3:35 AM, Peter Zijlstra  
 wrote:
>
> Now in general, I don't particularly like such superfluous changes, so
> unless you can show that GCC actually generates better code, I'd prefer
> to keep things as they are.

 Fixed and checked the assembly. It saves us 2 bytes of code, not much. I 
 am not sure if that is worth it :(

 use bool as the return type for rwsem_is_locked() instead of int

> 
>>
>> If you are going to change the return type to bool, then you should
>> also remove the manual "!!" conversions to a boolean return and let
>> the compiler do it in the most optimal way.
>>
>  
> Agreed, please find patch below:
> 

Simplify the "!!" condition. This is much simpler. :)

change return type to bool to follow rwsem_is_locked()

Signed-off-by: Pranith Kumar 
---
 fs/xfs/xfs_inode.c | 8 
 fs/xfs/xfs_inode.h | 2 +-
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/fs/xfs/xfs_inode.c b/fs/xfs/xfs_inode.c
index a6115fe..c02ac49 100644
--- a/fs/xfs/xfs_inode.c
+++ b/fs/xfs/xfs_inode.c
@@ -285,25 +285,25 @@ xfs_ilock_demote(
 }
 
 #if defined(DEBUG) || defined(XFS_WARN)
-int
+bool
 xfs_isilocked(
xfs_inode_t *ip,
uintlock_flags)
 {
if (lock_flags & (XFS_ILOCK_EXCL|XFS_ILOCK_SHARED)) {
if (!(lock_flags & XFS_ILOCK_SHARED))
-   return !!ip->i_lock.mr_writer;
+   return (ip->i_lock.mr_writer != 0);
return rwsem_is_locked(>i_lock.mr_lock);
}
 
if (lock_flags & (XFS_IOLOCK_EXCL|XFS_IOLOCK_SHARED)) {
if (!(lock_flags & XFS_IOLOCK_SHARED))
-   return !!ip->i_iolock.mr_writer;
+   return (ip->i_iolock.mr_writer != 0);
return rwsem_is_locked(>i_iolock.mr_lock);
}
 
ASSERT(0);
-   return 0;
+   return false;
 }
 #endif
 
diff --git a/fs/xfs/xfs_inode.h b/fs/xfs/xfs_inode.h
index f72bffa..efebed6 100644
--- a/fs/xfs/xfs_inode.h
+++ b/fs/xfs/xfs_inode.h
@@ -346,7 +346,7 @@ voidxfs_ilock(xfs_inode_t *, uint);
 intxfs_ilock_nowait(xfs_inode_t *, uint);
 void   xfs_iunlock(xfs_inode_t *, uint);
 void   xfs_ilock_demote(xfs_inode_t *, uint);
-intxfs_isilocked(xfs_inode_t *, uint);
+bool   xfs_isilocked(xfs_inode_t *, uint);
 uint   xfs_ilock_data_map_shared(struct xfs_inode *);
 uint   xfs_ilock_attr_map_shared(struct xfs_inode *);
 intxfs_ialloc(struct xfs_trans *, xfs_inode_t *, umode_t,
-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 3.2 49/92] USB: Nokia 5300 should be treated as unusual dev

2014-06-06 Thread Ben Hutchings
3.2.60-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Daniele Forsi 

commit 6ed07d45d09bc2aa60e27b845543db9972e22a38 upstream.

Signed-off-by: Daniele Forsi 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Ben Hutchings 
---
 drivers/usb/storage/unusual_devs.h | 7 +++
 1 file changed, 7 insertions(+)

--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -226,6 +226,13 @@ UNUSUAL_DEV(  0x0421, 0x0495, 0x0370, 0x
USB_SC_DEVICE, USB_PR_DEVICE, NULL,
US_FL_MAX_SECTORS_64 ),
 
+/* Reported by Daniele Forsi  */
+UNUSUAL_DEV(  0x0421, 0x04b9, 0x0350, 0x0350,
+   "Nokia",
+   "5300",
+   USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+   US_FL_MAX_SECTORS_64 ),
+
 /* Patch submitted by Victor A. Santos  */
 UNUSUAL_DEV(  0x0421, 0x05af, 0x0742, 0x0742,
"Nokia",

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 3.2 53/92] HID: add NO_INIT_REPORTS quirk for Synaptics Touch Pad V 103S

2014-06-06 Thread Ben Hutchings
3.2.60-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Hans de Goede 

commit 2f433083e854ec72c19dc9b0e1cebcc8e230fd75 upstream.

This touchpad seriously dislikes init reports, not only timeing out, but
also refusing to work after this.

Reported-and-tested-by: Vincent Fortier 
Signed-off-by: Hans de Goede 
Reviewed-by: Benjamin Tissoires 
Signed-off-by: Jiri Kosina 
Signed-off-by: Ben Hutchings 
---
 drivers/hid/hid-ids.h   | 1 +
 drivers/hid/usbhid/hid-quirks.c | 1 +
 2 files changed, 2 insertions(+)

--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -683,6 +683,7 @@
 #define USB_DEVICE_ID_SYNAPTICS_LTS2   0x1d10
 #define USB_DEVICE_ID_SYNAPTICS_HD 0x0ac3
 #define USB_DEVICE_ID_SYNAPTICS_QUAD_HD0x1ac3
+#define USB_DEVICE_ID_SYNAPTICS_TP_V1030x5710
 
 #define USB_VENDOR_ID_THRUSTMASTER 0x044f
 
--- a/drivers/hid/usbhid/hid-quirks.c
+++ b/drivers/hid/usbhid/hid-quirks.c
@@ -104,6 +104,7 @@ static const struct hid_blacklist {
{ USB_VENDOR_ID_SYNAPTICS, USB_DEVICE_ID_SYNAPTICS_LTS2, 
HID_QUIRK_NO_INIT_REPORTS },
{ USB_VENDOR_ID_SYNAPTICS, USB_DEVICE_ID_SYNAPTICS_HD, 
HID_QUIRK_NO_INIT_REPORTS },
{ USB_VENDOR_ID_SYNAPTICS, USB_DEVICE_ID_SYNAPTICS_QUAD_HD, 
HID_QUIRK_NO_INIT_REPORTS },
+   { USB_VENDOR_ID_SYNAPTICS, USB_DEVICE_ID_SYNAPTICS_TP_V103, 
HID_QUIRK_NO_INIT_REPORTS },
 
{ 0, 0 }
 };

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 3.2 52/92] HID: usbhid: quirk for Synaptics Quad HD touchscreen

2014-06-06 Thread Ben Hutchings
3.2.60-rc1 review patch.  If anyone has any objections, please let me know.

--

From: AceLan Kao 

commit 12f508aede4bda5d20a2dd3ff3deb16ef47a97e9 upstream.

Add Synaptics HD touchscreen(06cb:1ac3) to no init report quirk

Signed-off-by: AceLan Kao 
Signed-off-by: Jiri Kosina 
Signed-off-by: Ben Hutchings 
---
 drivers/hid/hid-ids.h   | 1 +
 drivers/hid/usbhid/hid-quirks.c | 1 +
 2 files changed, 2 insertions(+)

--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -682,6 +682,7 @@
 #define USB_DEVICE_ID_SYNAPTICS_LTS1   0x0af8
 #define USB_DEVICE_ID_SYNAPTICS_LTS2   0x1d10
 #define USB_DEVICE_ID_SYNAPTICS_HD 0x0ac3
+#define USB_DEVICE_ID_SYNAPTICS_QUAD_HD0x1ac3
 
 #define USB_VENDOR_ID_THRUSTMASTER 0x044f
 
--- a/drivers/hid/usbhid/hid-quirks.c
+++ b/drivers/hid/usbhid/hid-quirks.c
@@ -103,6 +103,7 @@ static const struct hid_blacklist {
{ USB_VENDOR_ID_SYNAPTICS, USB_DEVICE_ID_SYNAPTICS_LTS1, 
HID_QUIRK_NO_INIT_REPORTS },
{ USB_VENDOR_ID_SYNAPTICS, USB_DEVICE_ID_SYNAPTICS_LTS2, 
HID_QUIRK_NO_INIT_REPORTS },
{ USB_VENDOR_ID_SYNAPTICS, USB_DEVICE_ID_SYNAPTICS_HD, 
HID_QUIRK_NO_INIT_REPORTS },
+   { USB_VENDOR_ID_SYNAPTICS, USB_DEVICE_ID_SYNAPTICS_QUAD_HD, 
HID_QUIRK_NO_INIT_REPORTS },
 
{ 0, 0 }
 };

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 3.2 74/92] libceph: only call kernel_sendpage() via helper

2014-06-06 Thread Ben Hutchings
3.2.60-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Alex Elder 

commit e36b13cceb46136d849aeee06b4907ad3570ba78 upstream.

Make ceph_tcp_sendpage() be the only place kernel_sendpage() is
used, by using this helper in write_partial_msg_pages().

Signed-off-by: Alex Elder 
Reviewed-by: Sage Weil 
[bwh: Backported to 3.2:
 - Add ceph_tcp_sendpage(), from commit 31739139f3ed ('libceph: use
   kernel_sendpage() for sending zeroes'), the rest of which is not
   applicable
 - Adjust context]
Signed-off-by: Ben Hutchings 
---
 net/ceph/messenger.c | 8 ++--
 1 file changed, 2 insertions(+), 6 deletions(-)

--- a/net/ceph/messenger.c
+++ b/net/ceph/messenger.c
@@ -284,6 +284,19 @@ static int ceph_tcp_sendmsg(struct socke
return r;
 }
 
+static int ceph_tcp_sendpage(struct socket *sock, struct page *page,
+int offset, size_t size, bool more)
+{
+   int flags = MSG_DONTWAIT | MSG_NOSIGNAL | (more ? MSG_MORE : MSG_EOR);
+   int ret;
+
+   ret = kernel_sendpage(sock, page, offset, size, flags);
+   if (ret == -EAGAIN)
+   ret = 0;
+
+   return ret;
+}
+
 
 /*
  * Shutdown/close the socket for the given connection.
@@ -851,18 +864,14 @@ static int write_partial_msg_pages(struc
cpu_to_le32(crc32c(tmpcrc, base, len));
con->out_msg_pos.did_page_crc = 1;
}
-   ret = kernel_sendpage(con->sock, page,
+   ret = ceph_tcp_sendpage(con->sock, page,
  con->out_msg_pos.page_pos + page_shift,
- len,
- MSG_DONTWAIT | MSG_NOSIGNAL |
- MSG_MORE);
+ len, 1);
 
if (crc &&
(msg->pages || msg->pagelist || msg->bio || in_trail))
kunmap(page);
 
-   if (ret == -EAGAIN)
-   ret = 0;
if (ret <= 0)
goto out;
 

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 3.2 62/92] trace: module: Maintain a valid user count

2014-06-06 Thread Ben Hutchings
3.2.60-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Romain Izard 

commit 098507ae3ec2331476fb52e85d4040c1cc6d0ef4 upstream.

The replacement of the 'count' variable by two variables 'incs' and
'decs' to resolve some race conditions during module unloading was done
in parallel with some cleanup in the trace subsystem, and was integrated
as a merge.

Unfortunately, the formula for this replacement was wrong in the tracing
code, and the refcount in the traces was not usable as a result.

Use 'count = incs - decs' to compute the user count.

Link: 
http://lkml.kernel.org/p/1393924179-9147-1-git-send-email-romain.izard@gmail.com

Acked-by: Ingo Molnar 
Cc: Rusty Russell 
Cc: Frederic Weisbecker 
Fixes: c1ab9cab7509 "merge conflict resolution"
Signed-off-by: Romain Izard 
Signed-off-by: Steven Rostedt 
Signed-off-by: Ben Hutchings 
---
 include/trace/events/module.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/include/trace/events/module.h
+++ b/include/trace/events/module.h
@@ -78,7 +78,7 @@ DECLARE_EVENT_CLASS(module_refcnt,
 
TP_fast_assign(
__entry->ip = ip;
-   __entry->refcnt = __this_cpu_read(mod->refptr->incs) + 
__this_cpu_read(mod->refptr->decs);
+   __entry->refcnt = __this_cpu_read(mod->refptr->incs) - 
__this_cpu_read(mod->refptr->decs);
__assign_str(name, mod->name);
),
 

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 3.2 19/92] tcp_cubic: fix the range of delayed_ack

2014-06-06 Thread Ben Hutchings
3.2.60-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Liu Yu 

[ Upstream commit 0cda345d1b2201dd15591b163e3c92bad5191745 ]

commit b9f47a3aaeab (tcp_cubic: limit delayed_ack ratio to prevent
divide error) try to prevent divide error, but there is still a little
chance that delayed_ack can reach zero. In case the param cnt get
negative value, then ratio+cnt would overflow and may happen to be zero.
As a result, min(ratio, ACK_RATIO_LIMIT) will calculate to be zero.

In some old kernels, such as 2.6.32, there is a bug that would
pass negative param, which then ultimately leads to this divide error.

commit 5b35e1e6e9c (tcp: fix tcp_trim_head() to adjust segment count
with skb MSS) fixed the negative param issue. However,
it's safe that we fix the range of delayed_ack as well,
to make sure we do not hit a divide by zero.

CC: Stephen Hemminger 
Signed-off-by: Liu Yu 
Signed-off-by: Eric Dumazet 
Acked-by: Neal Cardwell 
Signed-off-by: David S. Miller 
Signed-off-by: Ben Hutchings 
---
 net/ipv4/tcp_cubic.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/ipv4/tcp_cubic.c b/net/ipv4/tcp_cubic.c
index b78eac2..ed3d6d4 100644
--- a/net/ipv4/tcp_cubic.c
+++ b/net/ipv4/tcp_cubic.c
@@ -406,7 +406,7 @@ static void bictcp_acked(struct sock *sk, u32 cnt, s32 
rtt_us)
ratio -= ca->delayed_ack >> ACK_RATIO_SHIFT;
ratio += cnt;
 
-   ca->delayed_ack = min(ratio, ACK_RATIO_LIMIT);
+   ca->delayed_ack = clamp(ratio, 1U, ACK_RATIO_LIMIT);
}
 
/* Some calls are for duplicates without timetamps */

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 3.2 71/92] i2c: s3c2410: resume race fix

2014-06-06 Thread Ben Hutchings
3.2.60-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Olof Johansson 

commit ce78cc071f5f541480e381cc0241d37590041a9d upstream.

Don't unmark the device as suspended until after it's been re-setup.

The main race would be w.r.t. an i2c driver that gets resumed at the same
time (asyncronously), that is allowed to do a transfer since suspended
is set to 0 before reinit, but really should have seen the -EIO return
instead.

Signed-off-by: Olof Johansson 
Signed-off-by: Doug Anderson 
Acked-by: Kukjin Kim 
Signed-off-by: Wolfram Sang 
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings 
---
 drivers/i2c/busses/i2c-s3c2410.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/i2c/busses/i2c-s3c2410.c
+++ b/drivers/i2c/busses/i2c-s3c2410.c
@@ -1082,10 +1082,10 @@ static int s3c24xx_i2c_resume(struct dev
struct platform_device *pdev = to_platform_device(dev);
struct s3c24xx_i2c *i2c = platform_get_drvdata(pdev);
 
-   i2c->suspended = 0;
clk_enable(i2c->clk);
s3c24xx_i2c_init(i2c);
clk_disable(i2c->clk);
+   i2c->suspended = 0;
 
return 0;
 }

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 3.2 61/92] sched: Use CPUPRI_NR_PRIORITIES instead of MAX_RT_PRIO in cpupri check

2014-06-06 Thread Ben Hutchings
3.2.60-rc1 review patch.  If anyone has any objections, please let me know.

--

From: "Steven Rostedt (Red Hat)" 

commit 6227cb00cc120f9a43ce8313bb0475ddabcb7d01 upstream.

The check at the beginning of cpupri_find() makes sure that the task_pri
variable does not exceed the cp->pri_to_cpu array length. But that length
is CPUPRI_NR_PRIORITIES not MAX_RT_PRIO, where it will miss the last two
priorities in that array.

As task_pri is computed from convert_prio() which should never be bigger
than CPUPRI_NR_PRIORITIES, if the check should cause a panic if it is
hit.

Reported-by: Mike Galbraith 
Signed-off-by: Steven Rostedt 
Signed-off-by: Peter Zijlstra 
Link: http://lkml.kernel.org/r/1397015410.5212.13.ca...@marge.simpson.net
Signed-off-by: Ingo Molnar 
[bwh: Backported to 3.2: adjust filename]
Signed-off-by: Ben Hutchings 
---
 kernel/sched/cpupri.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

--- a/kernel/sched_cpupri.c
+++ b/kernel/sched_cpupri.c
@@ -68,8 +68,7 @@ int cpupri_find(struct cpupri *cp, struc
int  idx  = 0;
int  task_pri = convert_prio(p->prio);
 
-   if (task_pri >= MAX_RT_PRIO)
-   return 0;
+   BUG_ON(task_pri >= CPUPRI_NR_PRIORITIES);
 
for (idx = 0; idx < task_pri; idx++) {
struct cpupri_vec *vec  = >pri_to_cpu[idx];

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 3.2 63/92] NFSD: Call ->set_acl with a NULL ACL structure if no entries

2014-06-06 Thread Ben Hutchings
3.2.60-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Kinglong Mee 

commit aa07c713ecfc0522916f3cd57ac628ea6127c0ec upstream.

After setting ACL for directory, I got two problems that caused
by the cached zero-length default posix acl.

This patch make sure nfsd4_set_nfs4_acl calls ->set_acl
with a NULL ACL structure if there are no entries.

Thanks for Christoph Hellwig's advice.

First problem:
 hang ...

Second problem:
[ 1610.167668] [ cut here ]
[ 1610.168320] kernel BUG at /root/nfs/linux/fs/nfsd/nfs4acl.c:239!
[ 1610.168320] invalid opcode:  [#1] SMP DEBUG_PAGEALLOC
[ 1610.168320] Modules linked in: nfsv4(OE) nfs(OE) nfsd(OE)
rpcsec_gss_krb5 fscache ip6t_rpfilter ip6t_REJECT cfg80211 xt_conntrack
rfkill ebtable_nat ebtable_broute bridge stp llc ebtable_filter ebtables
ip6table_nat nf_conntrack_ipv6 nf_defrag_ipv6 nf_nat_ipv6
ip6table_mangle ip6table_security ip6table_raw ip6table_filter
ip6_tables iptable_nat nf_conntrack_ipv4 nf_defrag_ipv4 nf_nat_ipv4
nf_nat nf_conntrack iptable_mangle iptable_security iptable_raw
auth_rpcgss nfs_acl snd_intel8x0 ppdev lockd snd_ac97_codec ac97_bus
snd_pcm snd_timer e1000 pcspkr parport_pc snd parport serio_raw joydev
i2c_piix4 sunrpc(OE) microcode soundcore i2c_core ata_generic pata_acpi
[last unloaded: nfsd]
[ 1610.168320] CPU: 0 PID: 27397 Comm: nfsd Tainted: G   OE
3.15.0-rc1+ #15
[ 1610.168320] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS
VirtualBox 12/01/2006
[ 1610.168320] task: 88005ab653d0 ti: 88005a944000 task.ti:
88005a944000
[ 1610.168320] RIP: 0010:[]  []
_posix_to_nfsv4_one+0x3cd/0x3d0 [nfsd]
[ 1610.168320] RSP: 0018:88005a945b00  EFLAGS: 00010293
[ 1610.168320] RAX: 0001 RBX: 88006700bac0 RCX:

[ 1610.168320] RDX:  RSI: 880067c83f00 RDI:
880068233300
[ 1610.168320] RBP: 88005a945b48 R08: 81c64830 R09:

[ 1610.168320] R10: 88004ea85be0 R11: f475 R12:
880068233300
[ 1610.168320] R13: 0003 R14: 0002 R15:
880068233300
[ 1610.168320] FS:  () GS:88007780()
knlGS:
[ 1610.168320] CS:  0010 DS:  ES:  CR0: 8005003b
[ 1610.168320] CR2: 7f5bcbd3b0b9 CR3: 01c0f000 CR4:
06f0
[ 1610.168320] DR0:  DR1:  DR2:

[ 1610.168320] DR3:  DR6: fffe0ff0 DR7:
0400
[ 1610.168320] Stack:
[ 1610.168320]   000b67c83500 00076700bac0

[ 1610.168320]  88006700bac0 880068233300 88005a945c08
0002
[ 1610.168320]   88005a945b88 a034e2d5
00065a945b68
[ 1610.168320] Call Trace:
[ 1610.168320]  [] nfsd4_get_nfs4_acl+0x95/0x150 [nfsd]
[ 1610.168320]  [] nfsd4_encode_fattr+0x646/0x1e70 [nfsd]
[ 1610.168320]  [] ? kmemleak_alloc+0x4e/0xb0
[ 1610.168320]  [] ?
nfsd_setuser_and_check_port+0x52/0x80 [nfsd]
[ 1610.168320]  [] ? selinux_cred_prepare+0x1b/0x30
[ 1610.168320]  [] nfsd4_encode_getattr+0x5a/0x60 [nfsd]
[ 1610.168320]  [] nfsd4_encode_operation+0x67/0x110
[nfsd]
[ 1610.168320]  [] nfsd4_proc_compound+0x21d/0x810 [nfsd]
[ 1610.168320]  [] nfsd_dispatch+0xbb/0x200 [nfsd]
[ 1610.168320]  [] svc_process_common+0x46d/0x6d0 [sunrpc]
[ 1610.168320]  [] svc_process+0x103/0x170 [sunrpc]
[ 1610.168320]  [] nfsd+0xbf/0x130 [nfsd]
[ 1610.168320]  [] ? nfsd_destroy+0x80/0x80 [nfsd]
[ 1610.168320]  [] kthread+0xd2/0xf0
[ 1610.168320]  [] ? insert_kthread_work+0x40/0x40
[ 1610.168320]  [] ret_from_fork+0x7c/0xb0
[ 1610.168320]  [] ? insert_kthread_work+0x40/0x40
[ 1610.168320] Code: 78 02 e9 e7 fc ff ff 31 c0 31 d2 31 c9 66 89 45 ce
41 8b 04 24 66 89 55 d0 66 89 4d d2 48 8d 04 80 49 8d 5c 84 04 e9 37 fd
ff ff <0f> 0b 90 0f 1f 44 00 00 55 8b 56 08 c7 07 00 00 00 00 8b 46 0c
[ 1610.168320] RIP  [] _posix_to_nfsv4_one+0x3cd/0x3d0
[nfsd]
[ 1610.168320]  RSP 
[ 1610.257313] ---[ end trace 838254e3e352285b ]---

Signed-off-by: Kinglong Mee 
Signed-off-by: J. Bruce Fields 
Signed-off-by: Ben Hutchings 
---
 fs/nfsd/nfs4acl.c | 17 +
 1 file changed, 9 insertions(+), 8 deletions(-)

--- a/fs/nfsd/nfs4acl.c
+++ b/fs/nfsd/nfs4acl.c
@@ -373,8 +373,10 @@ sort_pacl(struct posix_acl *pacl)
 * by uid/gid. */
int i, j;
 
-   if (pacl->a_count <= 4)
-   return; /* no users or groups */
+   /* no users or groups */
+   if (!pacl || pacl->a_count <= 4)
+   return;
+
i = 1;
while (pacl->a_entries[i].e_tag == ACL_USER)
i++;
@@ -498,13 +500,12 @@ posix_state_to_acl(struct posix_acl_stat
 
/*
 * ACLs with no ACEs are treated differently in the inheritable
-* and effective cases: when there are no inheritable ACEs, we
-* set a zero-length default posix acl:
+* and 

[PATCH 3.2 66/92] hwmon: (emc1403) Support full range of known chip revision numbers

2014-06-06 Thread Ben Hutchings
3.2.60-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Josef Gajdusek 

commit 3a18e1398fc2dc9c32bbdc50664da3a77959a8d1 upstream.

The datasheet for EMC1413/EMC1414, which is fully compatible to
EMC1403/1404 and uses the same chip identification, references revision
numbers 0x01, 0x03, and 0x04. Accept the full range of revision numbers
from 0x01 to 0x04 to make sure none are missed.

Signed-off-by: Josef Gajdusek 
[Guenter Roeck: Updated headline and description]
Signed-off-by: Guenter Roeck 
Signed-off-by: Ben Hutchings 
---
 drivers/hwmon/emc1403.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/hwmon/emc1403.c
+++ b/drivers/hwmon/emc1403.c
@@ -290,7 +290,7 @@ static int emc1403_detect(struct i2c_cli
}
 
id = i2c_smbus_read_byte_data(client, THERMAL_REVISION_REG);
-   if (id != 0x01)
+   if (id < 0x01 || id > 0x04)
return -ENODEV;
 
return 0;

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 3.2 54/92] Input: elantech - fix touchpad initialization on Gigabyte U2442

2014-06-06 Thread Ben Hutchings
3.2.60-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Hans de Goede 

commit 36189cc3cd57ab0f1cd75241f93fe01de928ac06 upstream.

The hw_version 3 Elantech touchpad on the Gigabyte U2442 does not accept
0x0b as initialization value for r10, this stand-alone version of the
driver: http://planet76.com/drivers/elantech/psmouse-elantech-v6.tar.bz2

Uses 0x03 which does work, so this means not setting bit 3 of r10 which
sets: "Enable Real H/W Resolution In Absolute mode"

Which will result in half the x and y resolution we get with that bit set,
so simply not setting it everywhere is not a solution. We've been unable to
find a way to identify touchpads where setting the bit will fail, so this
patch uses a dmi based blacklist for this.

https://bugzilla.kernel.org/show_bug.cgi?id=61151

Reported-by: Philipp Wolfer 
Tested-by: Philipp Wolfer 
Signed-off-by: Hans de Goede 
Signed-off-by: Dmitry Torokhov 
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings 
---
 Documentation/input/elantech.txt |  5 -
 drivers/input/mouse/elantech.c   | 26 +-
 drivers/input/mouse/elantech.h   |  1 +
 3 files changed, 30 insertions(+), 2 deletions(-)

--- a/Documentation/input/elantech.txt
+++ b/Documentation/input/elantech.txt
@@ -504,9 +504,12 @@ byte 5:
 * reg_10
 
bit   7   6   5   4   3   2   1   0
- 0   0   0   0   0   0   0   A
+ 0   0   0   0   R   F   T   A
 
  A: 1 = enable absolute tracking
+ T: 1 = enable two finger mode auto correct
+ F: 1 = disable ABS Position Filter
+ R: 1 = enable real hardware resolution
 
 6.2 Native absolute mode 6 byte packet format
 ~
--- a/drivers/input/mouse/elantech.c
+++ b/drivers/input/mouse/elantech.c
@@ -11,6 +11,7 @@
  */
 
 #include 
+#include 
 #include 
 #include 
 #include 
@@ -783,7 +784,11 @@ static int elantech_set_absolute_mode(st
break;
 
case 3:
-   etd->reg_10 = 0x0b;
+   if (etd->set_hw_resolution)
+   etd->reg_10 = 0x0b;
+   else
+   etd->reg_10 = 0x03;
+
if (elantech_write_reg(psmouse, 0x10, etd->reg_10))
rc = -1;
 
@@ -1206,6 +1211,22 @@ static int elantech_reconnect(struct psm
 }
 
 /*
+ * Some hw_version 3 models go into error state when we try to set bit 3 of r10
+ */
+static const struct dmi_system_id no_hw_res_dmi_table[] = {
+#if defined(CONFIG_DMI) && defined(CONFIG_X86)
+   {
+   /* Gigabyte U2442 */
+   .matches = {
+   DMI_MATCH(DMI_SYS_VENDOR, "GIGABYTE"),
+   DMI_MATCH(DMI_PRODUCT_NAME, "U2442"),
+   },
+   },
+#endif
+   { }
+};
+
+/*
  * determine hardware version and set some properties according to it.
  */
 static int elantech_set_properties(struct elantech_data *etd)
@@ -1254,6 +1275,9 @@ static int elantech_set_properties(struc
etd->reports_pressure = true;
}
 
+   /* Enable real hardware resolution on hw_version 3 ? */
+   etd->set_hw_resolution = !dmi_check_system(no_hw_res_dmi_table);
+
return 0;
 }
 
--- a/drivers/input/mouse/elantech.h
+++ b/drivers/input/mouse/elantech.h
@@ -128,6 +128,7 @@ struct elantech_data {
bool paritycheck;
bool jumpy_cursor;
bool reports_pressure;
+   bool set_hw_resolution;
unsigned char hw_version;
unsigned int fw_version;
unsigned int single_finger_reports;

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 3.2 16/92] bridge: Handle IFLA_ADDRESS correctly when creating bridge device

2014-06-06 Thread Ben Hutchings
3.2.60-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Toshiaki Makita 

[ Upstream commit 30313a3d5794472c3548d7288e306a5492030370 ]

When bridge device is created with IFLA_ADDRESS, we are not calling
br_stp_change_bridge_id(), which leads to incorrect local fdb
management and bridge id calculation, and prevents us from receiving
frames on the bridge device.

Reported-by: Tom Gundersen 
Signed-off-by: Toshiaki Makita 
Signed-off-by: David S. Miller 
Signed-off-by: Ben Hutchings 
---
 net/bridge/br_netlink.c | 15 +++
 1 file changed, 15 insertions(+)

diff --git a/net/bridge/br_netlink.c b/net/bridge/br_netlink.c
index cbf9ccd..99a48a3 100644
--- a/net/bridge/br_netlink.c
+++ b/net/bridge/br_netlink.c
@@ -211,11 +211,26 @@ static int br_validate(struct nlattr *tb[], struct nlattr 
*data[])
return 0;
 }
 
+static int br_dev_newlink(struct net *src_net, struct net_device *dev,
+ struct nlattr *tb[], struct nlattr *data[])
+{
+   struct net_bridge *br = netdev_priv(dev);
+
+   if (tb[IFLA_ADDRESS]) {
+   spin_lock_bh(>lock);
+   br_stp_change_bridge_id(br, nla_data(tb[IFLA_ADDRESS]));
+   spin_unlock_bh(>lock);
+   }
+
+   return register_netdevice(dev);
+}
+
 struct rtnl_link_ops br_link_ops __read_mostly = {
.kind   = "bridge",
.priv_size  = sizeof(struct net_bridge),
.setup  = br_dev_setup,
.validate   = br_validate,
+   .newlink= br_dev_newlink,
.dellink= br_dev_delete,
 };
 

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 3.2 77/92] perf: Prevent false warning in perf_swevent_add

2014-06-06 Thread Ben Hutchings
3.2.60-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Jiri Olsa 

commit 39af6b1678afa5880dda7e375cf3f9d395087f6d upstream.

The perf cpu offline callback takes down all cpu context
events and releases swhash->swevent_hlist.

This could race with task context software event being just
scheduled on this cpu via perf_swevent_add while cpu hotplug
code already cleaned up event's data.

The race happens in the gap between the cpu notifier code
and the cpu being actually taken down. Note that only cpu
ctx events are terminated in the perf cpu hotplug code.

It's easily reproduced with:
  $ perf record -e faults perf bench sched pipe

while putting one of the cpus offline:
  # echo 0 > /sys/devices/system/cpu/cpu1/online

Console emits following warning:
  WARNING: CPU: 1 PID: 2845 at kernel/events/core.c:5672 
perf_swevent_add+0x18d/0x1a0()
  Modules linked in:
  CPU: 1 PID: 2845 Comm: sched-pipe Tainted: GW3.14.0+ #256
  Hardware name: Intel Corporation Montevina platform/To be filled by O.E.M., 
BIOS AMVACRB1.86C.0066.B00.0805070703 05/07/2008
   0009 880077233ab8 81665a23 0025
    880077233af8 8104732c 0046
   88007467c800 0002 88007a9cf2a0 0001
  Call Trace:
   [] dump_stack+0x4f/0x7c
   [] warn_slowpath_common+0x8c/0xc0
   [] warn_slowpath_null+0x1a/0x20
   [] perf_swevent_add+0x18d/0x1a0
   [] event_sched_in.isra.75+0x9e/0x1f0
   [] group_sched_in+0x6a/0x1f0
   [] ? sched_clock_local+0x25/0xa0
   [] ctx_sched_in+0x1f6/0x450
   [] perf_event_sched_in+0x6b/0xa0
   [] perf_event_context_sched_in+0x7b/0xc0
   [] __perf_event_task_sched_in+0x43e/0x460
   [] ? put_lock_stats.isra.18+0xe/0x30
   [] finish_task_switch+0xb8/0x100
   [] __schedule+0x30e/0xad0
   [] ? pipe_read+0x3e2/0x560
   [] ? preempt_schedule_irq+0x3e/0x70
   [] ? preempt_schedule_irq+0x3e/0x70
   [] preempt_schedule_irq+0x44/0x70
   [] retint_kernel+0x20/0x30
   [] ? lockdep_sys_exit+0x1a/0x90
   [] lockdep_sys_exit_thunk+0x35/0x67
   [] ? sysret_check+0x5/0x56

Fixing this by tracking the cpu hotplug state and displaying
the WARN only if current cpu is initialized properly.

Cc: Corey Ashford 
Cc: Frederic Weisbecker 
Cc: Ingo Molnar 
Cc: Paul Mackerras 
Cc: Arnaldo Carvalho de Melo 
Reported-by: Fengguang Wu 
Signed-off-by: Jiri Olsa 
Signed-off-by: Peter Zijlstra 
Link: 
http://lkml.kernel.org/r/1396861448-10097-1-git-send-email-jo...@redhat.com
Signed-off-by: Thomas Gleixner 
Signed-off-by: Ben Hutchings 
---
 kernel/events/core.c | 13 -
 1 file changed, 12 insertions(+), 1 deletion(-)

--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -4899,6 +4899,9 @@ struct swevent_htable {
 
/* Recursion avoidance in each contexts */
int recursion[PERF_NR_CONTEXTS];
+
+   /* Keeps track of cpu being initialized/exited */
+   boolonline;
 };
 
 static DEFINE_PER_CPU(struct swevent_htable, swevent_htable);
@@ -5141,8 +5144,14 @@ static int perf_swevent_add(struct perf_
hwc->state = !(flags & PERF_EF_START);
 
head = find_swevent_head(swhash, event);
-   if (WARN_ON_ONCE(!head))
+   if (!head) {
+   /*
+* We can race with cpu hotplug code. Do not
+* WARN if the cpu just got unplugged.
+*/
+   WARN_ON_ONCE(swhash->online);
return -EINVAL;
+   }
 
hlist_add_head_rcu(>hlist_entry, head);
 
@@ -7081,6 +7090,7 @@ static void __cpuinit perf_event_init_cp
struct swevent_htable *swhash = _cpu(swevent_htable, cpu);
 
mutex_lock(>hlist_mutex);
+   swhash->online = true;
if (swhash->hlist_refcount > 0) {
struct swevent_hlist *hlist;
 
@@ -7138,6 +7148,7 @@ static void perf_event_exit_cpu(int cpu)
perf_event_exit_cpu_context(cpu);
 
mutex_lock(>hlist_mutex);
+   swhash->online = false;
swevent_hlist_release(swhash);
mutex_unlock(>hlist_mutex);
 }

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 3.2 69/92] x86, mm, hugetlb: Add missing TLB page invalidation for hugetlb_cow()

2014-06-06 Thread Ben Hutchings
3.2.60-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Anthony Iliopoulos 

commit 9844f5462392b53824e8b86726e7c33b5ecbb676 upstream.

The invalidation is required in order to maintain proper semantics
under CoW conditions. In scenarios where a process clones several
threads, a thread operating on a core whose DTLB entry for a
particular hugepage has not been invalidated, will be reading from
the hugepage that belongs to the forked child process, even after
hugetlb_cow().

The thread will not see the updated page as long as the stale DTLB
entry remains cached, the thread attempts to write into the page,
the child process exits, or the thread gets migrated to a different
processor.

Signed-off-by: Anthony Iliopoulos 
Link: http://lkml.kernel.org/r/20140514092948.ga17...@server-36.huawei.corp
Suggested-by: Shay Goikhman 
Acked-by: Dave Hansen 
Signed-off-by: H. Peter Anvin 
Signed-off-by: Ben Hutchings 
---
 arch/x86/include/asm/hugetlb.h | 1 +
 1 file changed, 1 insertion(+)

--- a/arch/x86/include/asm/hugetlb.h
+++ b/arch/x86/include/asm/hugetlb.h
@@ -51,6 +51,7 @@ static inline pte_t huge_ptep_get_and_cl
 static inline void huge_ptep_clear_flush(struct vm_area_struct *vma,
 unsigned long addr, pte_t *ptep)
 {
+   ptep_clear_flush(vma, addr, ptep);
 }
 
 static inline int huge_pte_none(pte_t pte)

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 3.2 55/92] md: avoid possible spinning md thread at shutdown.

2014-06-06 Thread Ben Hutchings
3.2.60-rc1 review patch.  If anyone has any objections, please let me know.

--

From: NeilBrown 

commit 0f62fb220aa4ebabe8547d3a9ce4a16d3c045f21 upstream.

If an md array with externally managed metadata (e.g. DDF or IMSM)
is in use, then we should not set safemode==2 at shutdown because:

1/ this is ineffective: user-space need to be involved in any 'safemode' 
handling,
2/ The safemode management code doesn't cope with safemode==2 on external 
metadata
   and md_check_recover enters an infinite loop.

Even at shutdown, an infinite-looping process can be problematic, so this
could cause shutdown to hang.

Signed-off-by: NeilBrown 
Signed-off-by: Ben Hutchings 
---
 drivers/md/md.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -8122,7 +8122,8 @@ static int md_notify_reboot(struct notif
if (mddev_trylock(mddev)) {
if (mddev->pers)
__md_stop_writes(mddev);
-   mddev->safemode = 2;
+   if (mddev->persistent)
+   mddev->safemode = 2;
mddev_unlock(mddev);
}
need_delay = 1;

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 3.2 46/92] usb: storage: shuttle_usbat: fix discs being detected twice

2014-06-06 Thread Ben Hutchings
3.2.60-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Daniele Forsi 

commit df602c2d2358f02c6e49cffc5b49b9daa16db033 upstream.

Even if the USB-to-ATAPI converter supported multiple LUNs, this
driver would always detect the same physical device or media because
it doesn't use srb->device->lun in any way.
Tested with an Hewlett-Packard CD-Writer Plus 8200e.

Signed-off-by: Daniele Forsi 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Ben Hutchings 
---
 drivers/usb/storage/shuttle_usbat.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/usb/storage/shuttle_usbat.c
+++ b/drivers/usb/storage/shuttle_usbat.c
@@ -1846,7 +1846,7 @@ static int usbat_probe(struct usb_interf
us->transport_name = "Shuttle USBAT";
us->transport = usbat_flash_transport;
us->transport_reset = usb_stor_CB_reset;
-   us->max_lun = 1;
+   us->max_lun = 0;
 
result = usb_stor_probe2(us);
return result;

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 3.2 06/92] tracepoint: Do not waste memory on mods with no tracepoints

2014-06-06 Thread Ben Hutchings
3.2.60-rc1 review patch.  If anyone has any objections, please let me know.

--

From: "Steven Rostedt (Red Hat)" 

commit 7dec935a3aa04412cba2cebe1524ae0d34a30c24 upstream.

No reason to allocate tp_module structures for modules that have no
tracepoints. This just wastes memory.

Fixes: b75ef8b44b1c "Tracepoint: Dissociate from module mutex"
Acked-by: Mathieu Desnoyers 
Signed-off-by: Steven Rostedt 
Signed-off-by: Ben Hutchings 
---
 kernel/tracepoint.c | 6 ++
 1 file changed, 6 insertions(+)

--- a/kernel/tracepoint.c
+++ b/kernel/tracepoint.c
@@ -638,6 +638,9 @@ static int tracepoint_module_coming(stru
struct tp_module *tp_mod, *iter;
int ret = 0;
 
+   if (!mod->num_tracepoints)
+   return 0;
+
/*
 * We skip modules that taint the kernel, especially those with 
different
 * module headers (for forced load), to make sure we don't cause a 
crash.
@@ -681,6 +684,9 @@ static int tracepoint_module_going(struc
 {
struct tp_module *pos;
 
+   if (!mod->num_tracepoints)
+   return 0;
+
mutex_lock(_mutex);
tracepoint_update_probe_range(mod->tracepoints_ptrs,
mod->tracepoints_ptrs + mod->num_tracepoints);

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 3.2 27/92] thinkpad-acpi: fix issuing duplicated key events for brightness up/down

2014-06-06 Thread Ben Hutchings
3.2.60-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Alex Hung 

commit ff413195e830541afeae469fc866ecd0319abd7e upstream.

The tp_features.bright_acpimode will not be set correctly for brightness
control because ACPI_VIDEO_HID will not be located in ACPI. As a result,
a duplicated key event will always be sent. acpi_video_backlight_support()
is sufficient to detect standard ACPI brightness control.

Signed-off-by: Alex Hung 
Signed-off-by: Matthew Garrett 
Signed-off-by: Ben Hutchings 
---
 drivers/platform/x86/thinkpad_acpi.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/platform/x86/thinkpad_acpi.c
+++ b/drivers/platform/x86/thinkpad_acpi.c
@@ -3405,7 +3405,7 @@ static int __init hotkey_init(struct ibm
/* Do not issue duplicate brightness change events to
 * userspace. tpacpi_detect_brightness_capabilities() must have
 * been called before this point  */
-   if (tp_features.bright_acpimode && acpi_video_backlight_support()) {
+   if (acpi_video_backlight_support()) {
pr_info("This ThinkPad has standard ACPI backlight "
"brightness control, supported by the ACPI "
"video driver\n");

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 3.2 87/92] futex: Add another early deadlock detection check

2014-06-06 Thread Ben Hutchings
3.2.60-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Thomas Gleixner 

commit 866293ee54227584ffcb4a42f69c1f365974ba7f upstream.

Dave Jones trinity syscall fuzzer exposed an issue in the deadlock
detection code of rtmutex:
  http://lkml.kernel.org/r/20140429151655.ga14...@redhat.com

That underlying issue has been fixed with a patch to the rtmutex code,
but the futex code must not call into rtmutex in that case because
- it can detect that issue early
- it avoids a different and more complex fixup for backing out

If the user space variable got manipulated to 0x8000 which means
no lock holder, but the waiters bit set and an active pi_state in the
kernel is found we can figure out the recursive locking issue by
looking at the pi_state owner. If that is the current task, then we
can safely return -EDEADLK.

The check should have been added in commit 59fa62451 (futex: Handle
futex_pi OWNER_DIED take over correctly) already, but I did not see
the above issue caused by user space manipulation back then.

Signed-off-by: Thomas Gleixner 
Cc: Dave Jones 
Cc: Linus Torvalds 
Cc: Peter Zijlstra 
Cc: Darren Hart 
Cc: Davidlohr Bueso 
Cc: Steven Rostedt 
Cc: Clark Williams 
Cc: Paul McKenney 
Cc: Lai Jiangshan 
Cc: Roland McGrath 
Cc: Carlos ODonell 
Cc: Jakub Jelinek 
Cc: Michael Kerrisk 
Cc: Sebastian Andrzej Siewior 
Link: http://lkml.kernel.org/r/20140512201701.097349...@linutronix.de
Signed-off-by: Thomas Gleixner 
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings 
---
 kernel/futex.c | 47 ++-
 1 file changed, 34 insertions(+), 13 deletions(-)

--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -590,7 +590,8 @@ void exit_pi_state_list(struct task_stru
 
 static int
 lookup_pi_state(u32 uval, struct futex_hash_bucket *hb,
-   union futex_key *key, struct futex_pi_state **ps)
+   union futex_key *key, struct futex_pi_state **ps,
+   struct task_struct *task)
 {
struct futex_pi_state *pi_state = NULL;
struct futex_q *this, *next;
@@ -634,6 +635,16 @@ lookup_pi_state(u32 uval, struct futex_h
return -EINVAL;
}
 
+   /*
+* Protect against a corrupted uval. If uval
+* is 0x8000 then pid is 0 and the waiter
+* bit is set. So the deadlock check in the
+* calling code has failed and we did not fall
+* into the check above due to !pid.
+*/
+   if (task && pi_state->owner == task)
+   return -EDEADLK;
+
atomic_inc(_state->refcount);
*ps = pi_state;
 
@@ -783,7 +794,7 @@ retry:
 * We dont have the lock. Look up the PI state (or create it if
 * we are the first waiter):
 */
-   ret = lookup_pi_state(uval, hb, key, ps);
+   ret = lookup_pi_state(uval, hb, key, ps, task);
 
if (unlikely(ret)) {
switch (ret) {
@@ -1193,7 +1204,7 @@ void requeue_pi_wake_futex(struct futex_
  *
  * Returns:
  *  0 - failed to acquire the lock atomicly
- *  1 - acquired the lock
+ * >0 - acquired the lock, return value is vpid of the top_waiter
  * <0 - error
  */
 static int futex_proxy_trylock_atomic(u32 __user *pifutex,
@@ -1204,7 +1215,7 @@ static int futex_proxy_trylock_atomic(u3
 {
struct futex_q *top_waiter = NULL;
u32 curval;
-   int ret;
+   int ret, vpid;
 
if (get_futex_value_locked(, pifutex))
return -EFAULT;
@@ -1232,11 +1243,13 @@ static int futex_proxy_trylock_atomic(u3
 * the contended case or if set_waiters is 1.  The pi_state is returned
 * in ps in contended cases.
 */
+   vpid = task_pid_vnr(top_waiter->task);
ret = futex_lock_pi_atomic(pifutex, hb2, key2, ps, top_waiter->task,
   set_waiters);
-   if (ret == 1)
+   if (ret == 1) {
requeue_pi_wake_futex(top_waiter, key2, hb2);
-
+   return vpid;
+   }
return ret;
 }
 
@@ -1268,7 +1281,6 @@ static int futex_requeue(u32 __user *uad
struct futex_hash_bucket *hb1, *hb2;
struct plist_head *head1;
struct futex_q *this, *next;
-   u32 curval2;
 
if (requeue_pi) {
/*
@@ -1354,16 +1366,25 @@ retry_private:
 * At this point the top_waiter has either taken uaddr2 or is
 * waiting on it.  If the former, then the pi_state will not
 * exist yet, look it up one more time to ensure we have a
-* reference to it.
+* reference to it. If the lock was taken, ret contains the
+* vpid of the top waiter task.
 */
-   if 

[PATCH 3.2 45/92] drm/nouveau/acpi: allow non-optimus setups to load vbios from acpi

2014-06-06 Thread Ben Hutchings
3.2.60-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Ilia Mirkin 

commit a3d0b1218d351c6e6f3cea36abe22236a08cb246 upstream.

There appear to be a crop of new hardware where the vbios is not
available from PROM/PRAMIN, but there is a valid _ROM method in ACPI.
The data read from PCIROM almost invariably contains invalid
instructions (still has the x86 opcodes), which makes this a low-risk
way to try to obtain a valid vbios image.

Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=76475
Signed-off-by: Ilia Mirkin 
Signed-off-by: Ben Skeggs 
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings 
---
 drivers/gpu/drm/nouveau/nouveau_acpi.c | 3 ---
 1 file changed, 3 deletions(-)

--- a/drivers/gpu/drm/nouveau/nouveau_acpi.c
+++ b/drivers/gpu/drm/nouveau/nouveau_acpi.c
@@ -332,9 +332,6 @@ bool nouveau_acpi_rom_supported(struct p
acpi_status status;
acpi_handle dhandle, rom_handle;
 
-   if (!nouveau_dsm_priv.dsm_detected && 
!nouveau_dsm_priv.optimus_detected)
-   return false;
-
dhandle = DEVICE_ACPI_HANDLE(>dev);
if (!dhandle)
return false;

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 3.2 33/92] crypto: caam - add allocation failure handling in SPRINTFCAT macro

2014-06-06 Thread Ben Hutchings
3.2.60-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Horia Geanta 

commit 27c5fb7a84242b66bf1e0b2fe6bf40d19bcc5c04 upstream.

GFP_ATOMIC memory allocation could fail.
In this case, avoid NULL pointer dereference and notify user.

Cc: Kim Phillips 
Signed-off-by: Horia Geanta 
Signed-off-by: Herbert Xu 
Signed-off-by: Ben Hutchings 
---
 drivers/crypto/caam/error.c | 10 +++---
 1 file changed, 7 insertions(+), 3 deletions(-)

--- a/drivers/crypto/caam/error.c
+++ b/drivers/crypto/caam/error.c
@@ -16,9 +16,13 @@
char *tmp;  \
\
tmp = kmalloc(sizeof(format) + max_alloc, GFP_ATOMIC);  \
-   sprintf(tmp, format, param);\
-   strcat(str, tmp);   \
-   kfree(tmp); \
+   if (likely(tmp)) {  \
+   sprintf(tmp, format, param);\
+   strcat(str, tmp);   \
+   kfree(tmp); \
+   } else {\
+   strcat(str, "kmalloc failure in SPRINTFCAT");   \
+   }   \
 }
 
 static void report_jump_idx(u32 status, char *outstr)

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 3.2 40/92] hrtimer: Prevent remote enqueue of leftmost timers

2014-06-06 Thread Ben Hutchings
3.2.60-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Leon Ma 

commit 012a45e3f4af68e86d85cce060c6c2fed56498b2 upstream.

If a cpu is idle and starts an hrtimer which is not pinned on that
same cpu, the nohz code might target the timer to a different cpu.

In the case that we switch the cpu base of the timer we already have a
sanity check in place, which determines whether the timer is earlier
than the current leftmost timer on the target cpu. In that case we
enqueue the timer on the current cpu because we cannot reprogram the
clock event device on the target.

If the timers base is already the target CPU we do not have this
sanity check in place so we enqueue the timer as the leftmost timer in
the target cpus rb tree, but we cannot reprogram the clock event
device on the target cpu. So the timer expires late and subsequently
prevents the reprogramming of the target cpu clock event device until
the previously programmed event fires or a timer with an earlier
expiry time gets enqueued on the target cpu itself.

Add the same target check as we have for the switch base case and
start the timer on the current cpu if it would become the leftmost
timer on the target.

[ tglx: Rewrote subject and changelog ]

Signed-off-by: Leon Ma 
Link: 
http://lkml.kernel.org/r/1398847391-5994-1-git-send-email-xindong...@intel.com
Signed-off-by: Thomas Gleixner 
Signed-off-by: Ben Hutchings 
---
 kernel/hrtimer.c | 5 +
 1 file changed, 5 insertions(+)

--- a/kernel/hrtimer.c
+++ b/kernel/hrtimer.c
@@ -232,6 +232,11 @@ again:
goto again;
}
timer->base = new_base;
+   } else {
+   if (cpu != this_cpu && hrtimer_check_target(timer, new_base)) {
+   cpu = this_cpu;
+   goto again;
+   }
}
return new_base;
 }

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


Re: [PATCH v2] ARM: EXYNOS: mcpm: Don't rely on firmware's secondary_cpu_start

2014-06-06 Thread Nicolas Pitre
On Fri, 6 Jun 2014, Doug Anderson wrote:

> On exynos mcpm systems the firmware is hardcoded to jump to an address
> in SRAM (0x02073000) when secondary CPUs come up.  By default the
> firmware puts a bunch of code at that location.  That code expects the
> kernel to fill in a few slots with addresses that it uses to jump back
> to the kernel's entry point for secondary CPUs.
> 
> Originally (on prerelease hardware) this firmware code contained a
> bunch of workarounds to deal with boot ROM bugs.  However on all
> shipped hardware we simply use this code to redirect to a kernel
> function for bringing up the CPUs.
> 
> Let's stop relying on the code provided by the bootloader and just
> plumb in our own (simple) code jump to the kernel.  This has the nice
> benefit of fixing problems due to the fact that older bootloaders
> (like the one shipped on the Samsung Chromebook 2) might have put
> slightly different code into this location.
> 
> Once suspend/resume is implemented for systems using exynos-mcpm we'll
> need to make sure we reinstall our fixed up code after resume.  ...but
> that's not anything new since IRAM (and thus the address of the
> mcpm_entry_point) is lost across suspend/resume anyway.
> 
> Signed-off-by: Doug Anderson 

Acked-by: Nicolas Pitre 

> ---
> Changes in v2:
> - Removed #define
> 
>  arch/arm/mach-exynos/mcpm-exynos.c | 11 ++-
>  1 file changed, 6 insertions(+), 5 deletions(-)
> 
> diff --git a/arch/arm/mach-exynos/mcpm-exynos.c 
> b/arch/arm/mach-exynos/mcpm-exynos.c
> index 0498d0b..ace0ed6 100644
> --- a/arch/arm/mach-exynos/mcpm-exynos.c
> +++ b/arch/arm/mach-exynos/mcpm-exynos.c
> @@ -25,7 +25,6 @@
>  
>  #define EXYNOS5420_CPUS_PER_CLUSTER  4
>  #define EXYNOS5420_NR_CLUSTERS   2
> -#define MCPM_BOOT_ADDR_OFFSET0x1c
>  
>  /*
>   * The common v7_exit_coherency_flush API could not be used because of the
> @@ -343,11 +342,13 @@ static int __init exynos_mcpm_init(void)
>   pr_info("Exynos MCPM support installed\n");
>  
>   /*
> -  * Future entries into the kernel can now go
> -  * through the cluster entry vectors.
> +  * U-Boot SPL is hardcoded to jump to the start of ns_sram_base_addr
> +  * as part of secondary_cpu_start().  Let's redirect it to the
> +  * mcpm_entry_point().
>*/
> - __raw_writel(virt_to_phys(mcpm_entry_point),
> - ns_sram_base_addr + MCPM_BOOT_ADDR_OFFSET);
> + __raw_writel(0xe59f, ns_sram_base_addr); /* ldr r0, [pc, #0] */
> + __raw_writel(0xe12fff10, ns_sram_base_addr + 4); /* bx  r0 */
> + __raw_writel(virt_to_phys(mcpm_entry_point), ns_sram_base_addr + 8);
>  
>   iounmap(ns_sram_base_addr);
>  
> -- 
> 2.0.0.526.g5318336
> 
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 3.2 36/92] KVM: async_pf: mm->mm_users can not pin apf->mm

2014-06-06 Thread Ben Hutchings
3.2.60-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Oleg Nesterov 

commit 41c22f626254b9dc0376928cae009e73d1b6a49a upstream.

get_user_pages(mm) is simply wrong if mm->mm_users == 0 and exit_mmap/etc
was already called (or is in progress), mm->mm_count can only pin mm->pgd
and mm_struct itself.

Change kvm_setup_async_pf/async_pf_execute to inc/dec mm->mm_users.

kvm_create_vm/kvm_destroy_vm play with ->mm_count too but this case looks
fine at first glance, it seems that this ->mm is only used to verify that
current->mm == kvm->mm.

Signed-off-by: Oleg Nesterov 
Signed-off-by: Paolo Bonzini 
Signed-off-by: Ben Hutchings 
---
 virt/kvm/async_pf.c | 8 
 1 file changed, 4 insertions(+), 4 deletions(-)

--- a/virt/kvm/async_pf.c
+++ b/virt/kvm/async_pf.c
@@ -87,7 +87,7 @@ static void async_pf_execute(struct work
if (waitqueue_active(>wq))
wake_up_interruptible(>wq);
 
-   mmdrop(mm);
+   mmput(mm);
kvm_put_kvm(vcpu->kvm);
 }
 
@@ -100,7 +100,7 @@ void kvm_clear_async_pf_completion_queue
   typeof(*work), queue);
list_del(>queue);
if (cancel_work_sync(>work)) {
-   mmdrop(work->mm);
+   mmput(work->mm);
kvm_put_kvm(vcpu->kvm); /* == work->vcpu->kvm */
kmem_cache_free(async_pf_cache, work);
}
@@ -169,7 +169,7 @@ int kvm_setup_async_pf(struct kvm_vcpu *
work->addr = gfn_to_hva(vcpu->kvm, gfn);
work->arch = *arch;
work->mm = current->mm;
-   atomic_inc(>mm->mm_count);
+   atomic_inc(>mm->mm_users);
kvm_get_kvm(work->vcpu->kvm);
 
/* this can't really happen otherwise gfn_to_pfn_async
@@ -187,7 +187,7 @@ int kvm_setup_async_pf(struct kvm_vcpu *
return 1;
 retry_sync:
kvm_put_kvm(work->vcpu->kvm);
-   mmdrop(work->mm);
+   mmput(work->mm);
kmem_cache_free(async_pf_cache, work);
return 0;
 }

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 3.2 43/92] rtl8192cu: Fix unbalanced irq enable in error path of rtl92cu_hw_init()

2014-06-06 Thread Ben Hutchings
3.2.60-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Ben Hutchings 

commit 3234f5b06fc3094176a86772cc64baf3decc98fc upstream.

Fixes: a53268be0cb9 ('rtlwifi: rtl8192cu: Fix too long disable of IRQs')
Signed-off-by: Ben Hutchings 
Signed-off-by: John W. Linville 
[bwh: Backported to 3.2: adjust context]
---
 drivers/net/wireless/rtlwifi/rtl8192cu/hw.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c
@@ -1174,7 +1174,7 @@ int rtl92cu_hw_init(struct ieee80211_hw
err = _rtl92cu_init_mac(hw);
if (err) {
RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG, ("init mac failed!\n"));
-   return err;
+   goto exit;
}
err = rtl92c_download_fw(hw);
if (err) {

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 3.2 42/92] rtlwifi: rtl8192cu: Fix too long disable of IRQs

2014-06-06 Thread Ben Hutchings
3.2.60-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Larry Finger 

commit a53268be0cb9763f11da4f6fe3fb924cbe3a7d4a upstream.

In commit f78bccd79ba3cd9d9664981b501d57bdb81ab8a4 entitled "rtlwifi:
rtl8192ce: Fix too long disable of IRQs", Olivier Langlois
 fixed a problem caused by an extra long disabling
of interrupts. This patch makes the same fix for rtl8192cu.

Signed-off-by: Larry Finger 
Signed-off-by: John W. Linville 
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings 
---
 drivers/net/wireless/rtlwifi/rtl8192cu/hw.c | 15 ++-
 1 file changed, 14 insertions(+), 1 deletion(-)

--- a/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c
@@ -1158,6 +1158,17 @@ int rtl92cu_hw_init(struct ieee80211_hw
struct rtl_ps_ctl *ppsc = rtl_psc(rtl_priv(hw));
int err = 0;
static bool iqk_initialized;
+   unsigned long flags;
+
+   /* As this function can take a very long time (up to 350 ms)
+* and can be called with irqs disabled, reenable the irqs
+* to let the other devices continue being serviced.
+*
+* It is safe doing so since our own interrupts will only be enabled
+* in a subsequent step.
+*/
+   local_save_flags(flags);
+   local_irq_enable();
 
rtlhal->hw_type = HARDWARE_TYPE_RTL8192CU;
err = _rtl92cu_init_mac(hw);
@@ -1171,7 +1182,7 @@ int rtl92cu_hw_init(struct ieee80211_hw
 ("Failed to download FW. Init HW without FW now..\n"));
err = 1;
rtlhal->fw_ready = false;
-   return err;
+   goto exit;
} else {
rtlhal->fw_ready = true;
}
@@ -1212,6 +1223,8 @@ int rtl92cu_hw_init(struct ieee80211_hw
_update_mac_setting(hw);
rtl92c_dm_init(hw);
_dump_registers(hw);
+exit:
+   local_irq_restore(flags);
return err;
 }
 

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 3.2 34/92] kvm: free resources after canceling async_pf

2014-06-06 Thread Ben Hutchings
3.2.60-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Radim Krčmář 

commit 28b441e24088081c1e213139d1303b451a34a4f4 upstream.

When we cancel 'async_pf_execute()', we should behave as if the work was
never scheduled in 'kvm_setup_async_pf()'.
Fixes a bug when we can't unload module because the vm wasn't destroyed.

Signed-off-by: Radim Krčmář 
Reviewed-by: Paolo Bonzini 
Reviewed-by: Gleb Natapov 
Signed-off-by: Paolo Bonzini 
Signed-off-by: Ben Hutchings 
---
 virt/kvm/async_pf.c | 5 -
 1 file changed, 4 insertions(+), 1 deletion(-)

--- a/virt/kvm/async_pf.c
+++ b/virt/kvm/async_pf.c
@@ -101,8 +101,11 @@ void kvm_clear_async_pf_completion_queue
   typeof(*work), queue);
cancel_work_sync(>work);
list_del(>queue);
-   if (!work->done) /* work was canceled */
+   if (!work->done) { /* work was canceled */
+   mmdrop(work->mm);
+   kvm_put_kvm(vcpu->kvm); /* == work->vcpu->kvm */
kmem_cache_free(async_pf_cache, work);
+   }
}
 
spin_lock(>async_pf.lock);

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 3.2 64/92] hrtimer: Set expiry time before switch_hrtimer_base()

2014-06-06 Thread Ben Hutchings
3.2.60-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Viresh Kumar 

commit 84ea7fe37908254c3bd90910921f6e1045c1747a upstream.

switch_hrtimer_base() calls hrtimer_check_target() which ensures that
we do not migrate a timer to a remote cpu if the timer expires before
the current programmed expiry time on that remote cpu.

But __hrtimer_start_range_ns() calls switch_hrtimer_base() before the
new expiry time is set. So the sanity check in hrtimer_check_target()
is operating on stale or even uninitialized data.

Update expiry time before calling switch_hrtimer_base().

[ tglx: Rewrote changelog once again ]

Signed-off-by: Viresh Kumar 
Cc: linaro-ker...@lists.linaro.org
Cc: linaro-network...@linaro.org
Cc: fweis...@gmail.com
Cc: arvind.chau...@arm.com
Link: 
http://lkml.kernel.org/r/81999e148745fc51bbcd0615823fbab9b2e87e23.1399882253.git.viresh.ku...@linaro.org
Signed-off-by: Thomas Gleixner 
Signed-off-by: Ben Hutchings 
---
 kernel/hrtimer.c | 8 
 1 file changed, 4 insertions(+), 4 deletions(-)

--- a/kernel/hrtimer.c
+++ b/kernel/hrtimer.c
@@ -980,11 +980,8 @@ int __hrtimer_start_range_ns(struct hrti
/* Remove an active timer from the queue: */
ret = remove_hrtimer(timer, base);
 
-   /* Switch the timer base, if necessary: */
-   new_base = switch_hrtimer_base(timer, base, mode & HRTIMER_MODE_PINNED);
-
if (mode & HRTIMER_MODE_REL) {
-   tim = ktime_add_safe(tim, new_base->get_time());
+   tim = ktime_add_safe(tim, base->get_time());
/*
 * CONFIG_TIME_LOW_RES is a temporary way for architectures
 * to signal that they simply return xtime in
@@ -999,6 +996,9 @@ int __hrtimer_start_range_ns(struct hrti
 
hrtimer_set_expires_range_ns(timer, tim, delta_ns);
 
+   /* Switch the timer base, if necessary: */
+   new_base = switch_hrtimer_base(timer, base, mode & HRTIMER_MODE_PINNED);
+
timer_stats_hrtimer_set_start_info(timer);
 
leftmost = enqueue_hrtimer(timer, new_base);

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 3.2 88/92] futex: Prevent attaching to kernel threads

2014-06-06 Thread Ben Hutchings
3.2.60-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Thomas Gleixner 

commit f0d71b3dcb8332f7971b5f2363632573e6d9486a upstream.

We happily allow userspace to declare a random kernel thread to be the
owner of a user space PI futex.

Found while analysing the fallout of Dave Jones syscall fuzzer.

We also should validate the thread group for private futexes and find
some fast way to validate whether the "alleged" owner has RW access on
the file which backs the SHM, but that's a separate issue.

Signed-off-by: Thomas Gleixner 
Cc: Dave Jones 
Cc: Linus Torvalds 
Cc: Peter Zijlstra 
Cc: Darren Hart 
Cc: Davidlohr Bueso 
Cc: Steven Rostedt 
Cc: Clark Williams 
Cc: Paul McKenney 
Cc: Lai Jiangshan 
Cc: Roland McGrath 
Cc: Carlos ODonell 
Cc: Jakub Jelinek 
Cc: Michael Kerrisk 
Cc: Sebastian Andrzej Siewior 
Link: http://lkml.kernel.org/r/20140512201701.194824...@linutronix.de
Signed-off-by: Thomas Gleixner 
Signed-off-by: Ben Hutchings 
---
 kernel/futex.c | 5 +
 1 file changed, 5 insertions(+)

--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -662,6 +662,11 @@ lookup_pi_state(u32 uval, struct futex_h
if (!p)
return -ESRCH;
 
+   if (!p->mm) {
+   put_task_struct(p);
+   return -EPERM;
+   }
+
/*
 * We need to look at the task state flags to figure out,
 * whether the task is exiting. To protect against the do_exit

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 3.2 50/92] HID: usbhid: quirk for Synaptics Large Touchccreen

2014-06-06 Thread Ben Hutchings
3.2.60-rc1 review patch.  If anyone has any objections, please let me know.

--

From: AceLan Kao 

commit 8171a67d587a09e14a4949a81e070345fedcf410 upstream.

BugLink: http://bugs.launchpad.net/bugs/1180881

Synaptics large touchscreen doesn't support some of the report request
while initializing. The unspoorted request will make the device unreachable,
and will lead to the following usb_submit_urb() function call timeout.
So, add the IDs into HID_QUIRK_NO_INIT_REPORTS quirk.

Signed-off-by: AceLan Kao 
Signed-off-by: Jiri Kosina 
[bwh: Backported to 3.2:
 - Adjust context
 - Add definition of USB_VENDOR_ID_SYNAPTICS]
Signed-off-by: Ben Hutchings 
---
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -678,6 +678,10 @@
 #define USB_DEVICE_ID_SYMBOL_SCANNER_1 0x0800
 #define USB_DEVICE_ID_SYMBOL_SCANNER_2 0x1300
 
+#define USB_VENDOR_ID_SYNAPTICS0x06cb
+#define USB_DEVICE_ID_SYNAPTICS_LTS1   0x0af8
+#define USB_DEVICE_ID_SYNAPTICS_LTS2   0x1d10
+
 #define USB_VENDOR_ID_THRUSTMASTER 0x044f
 
 #define USB_VENDOR_ID_TOPSEED  0x0766
--- a/drivers/hid/usbhid/hid-quirks.c
+++ b/drivers/hid/usbhid/hid-quirks.c
@@ -100,6 +100,8 @@ static const struct hid_blacklist {
{ USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_WIRELESS, 
HID_QUIRK_MULTI_INPUT },
{ USB_VENDOR_ID_SIGMA_MICRO, USB_DEVICE_ID_SIGMA_MICRO_KEYBOARD, 
HID_QUIRK_NO_INIT_REPORTS },
{ USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_DUOSENSE, 
HID_QUIRK_NO_INIT_REPORTS },
+   { USB_VENDOR_ID_SYNAPTICS, USB_DEVICE_ID_SYNAPTICS_LTS1, 
HID_QUIRK_NO_INIT_REPORTS },
+   { USB_VENDOR_ID_SYNAPTICS, USB_DEVICE_ID_SYNAPTICS_LTS2, 
HID_QUIRK_NO_INIT_REPORTS },
 
{ 0, 0 }
 };

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 3.2 37/92] ftrace/module: Hardcode ftrace_module_init() call into load_module()

2014-06-06 Thread Ben Hutchings
3.2.60-rc1 review patch.  If anyone has any objections, please let me know.

--

From: "Steven Rostedt (Red Hat)" 

commit a949ae560a511fe4e3adf48fa44fefded93e5c2b upstream.

A race exists between module loading and enabling of function tracer.

CPU 1   CPU 2
-   -
  load_module()
   module->state = MODULE_STATE_COMING

register_ftrace_function()
 mutex_lock(_lock);
 ftrace_startup()
  update_ftrace_function();
   ftrace_arch_code_modify_prepare()
set_all_module_text_rw();
   
ftrace_arch_code_modify_post_process()
 set_all_module_text_ro();

[ here all module text is set to RO,
  including the module that is
  loading!! ]

   blocking_notifier_call_chain(MODULE_STATE_COMING);
ftrace_init_module()

 [ tries to modify code, but it's RO, and fails!
   ftrace_bug() is called]

When this race happens, ftrace_bug() will produces a nasty warning and
all of the function tracing features will be disabled until reboot.

The simple solution is to treate module load the same way the core
kernel is treated at boot. To hardcode the ftrace function modification
of converting calls to mcount into nops. This is done in init/main.c
there's no reason it could not be done in load_module(). This gives
a better control of the changes and doesn't tie the state of the
module to its notifiers as much. Ftrace is special, it needs to be
treated as such.

The reason this would work, is that the ftrace_module_init() would be
called while the module is in MODULE_STATE_UNFORMED, which is ignored
by the set_all_module_text_ro() call.

Link: 
http://lkml.kernel.org/r/1395637826-3312-1-git-send-email-indou.ta...@jp.fujitsu.com

Reported-by: Takao Indoh 
Acked-by: Rusty Russell 
Signed-off-by: Steven Rostedt 
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings 
---
 include/linux/ftrace.h |  2 ++
 kernel/module.c|  3 +++
 kernel/trace/ftrace.c  | 27 ---
 3 files changed, 9 insertions(+), 23 deletions(-)

--- a/include/linux/ftrace.h
+++ b/include/linux/ftrace.h
@@ -260,6 +260,7 @@ extern int ftrace_make_call(struct dyn_f
 extern int ftrace_arch_read_dyn_info(char *buf, int size);
 
 extern int skip_trace(unsigned long ip);
+extern void ftrace_module_init(struct module *mod);
 
 extern void ftrace_disable_daemon(void);
 extern void ftrace_enable_daemon(void);
@@ -272,6 +273,7 @@ static inline void ftrace_set_filter(uns
 static inline void ftrace_disable_daemon(void) { }
 static inline void ftrace_enable_daemon(void) { }
 static inline void ftrace_release_mod(struct module *mod) {}
+static inline void ftrace_module_init(struct module *mod) {}
 static inline int register_ftrace_command(struct ftrace_func_command *cmd)
 {
return -EINVAL;
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -2888,6 +2888,9 @@ static struct module *load_module(void _
/* This has to be done once we're sure module name is unique. */
dynamic_debug_setup(info.debug, info.num_debug);
 
+   /* Ftrace init must be called in the MODULE_STATE_UNFORMED state */
+   ftrace_module_init(mod);
+
/* Find duplicate symbols */
err = verify_export_symbols(mod);
if (err < 0)
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
@@ -3542,16 +3542,11 @@ static void ftrace_init_module(struct mo
ftrace_process_locs(mod, start, end);
 }
 
-static int ftrace_module_notify_enter(struct notifier_block *self,
- unsigned long val, void *data)
+void ftrace_module_init(struct module *mod)
 {
-   struct module *mod = data;
-
-   if (val == MODULE_STATE_COMING)
-   ftrace_init_module(mod, mod->ftrace_callsites,
-  mod->ftrace_callsites +
-  mod->num_ftrace_callsites);
-   return 0;
+   ftrace_init_module(mod, mod->ftrace_callsites,
+  mod->ftrace_callsites +
+  mod->num_ftrace_callsites);
 }
 
 static int ftrace_module_notify_exit(struct notifier_block *self,
@@ -3565,11 +3560,6 @@ static int ftrace_module_notify_exit(str
return 0;
 }
 #else
-static int ftrace_module_notify_enter(struct notifier_block *self,
- unsigned long val, void *data)
-{
-   return 0;
-}
 static int ftrace_module_notify_exit(struct notifier_block *self,
 unsigned long val, void *data)
 {
@@ -3577,11 +3567,6 @@ static int ftrace_module_notify_exit(str
 }
 #endif /* 

[PATCH 3.2 59/92] Negative (setpoint-dirty) in bdi_position_ratio()

2014-06-06 Thread Ben Hutchings
3.2.60-rc1 review patch.  If anyone has any objections, please let me know.

--

From: "paul.sz...@sydney.edu.au" 

commit ed84825b785ceb932af7dd5aa08614801721320b upstream.

In bdi_position_ratio(), get difference (setpoint-dirty) right even when
negative. Both setpoint and dirty are unsigned long, the difference was
zero-padded thus wrongly sign-extended to s64. This issue affects all
32-bit architectures, does not affect 64-bit architectures where long
and s64 are equivalent.

In this function, dirty is between freerun and limit, the pseudo-float x
is between [-1,1], expected to be negative about half the time. With
zero-padding, instead of a small negative x we obtained a large positive
one so bdi_position_ratio() returned garbage.

Casting the difference to s64 also prevents overflow with left-shift;
though normally these numbers are small and I never observed a 32-bit
overflow there.

(This patch does not solve the PAE OOM issue.)

Paul Szabo   p...@maths.usyd.edu.au   http://www.maths.usyd.edu.au/u/psz/
School of Mathematics and Statistics   University of SydneyAustralia

Reviewed-by: Jan Kara 
Reported-by: Paul Szabo 
Reference: http://bugs.debian.org/695182
Signed-off-by: Paul Szabo 
Signed-off-by: Fengguang Wu 
Signed-off-by: Ben Hutchings 
---
 mm/page-writeback.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/mm/page-writeback.c
+++ b/mm/page-writeback.c
@@ -559,7 +559,7 @@ static unsigned long bdi_position_ratio(
 * => fast response on large errors; small oscillation near setpoint
 */
setpoint = (freerun + limit) / 2;
-   x = div_s64((setpoint - dirty) << RATELIMIT_CALC_SHIFT,
+   x = div_s64(((s64)setpoint - (s64)dirty) << RATELIMIT_CALC_SHIFT,
limit - setpoint + 1);
pos_ratio = x;
pos_ratio = pos_ratio * x >> RATELIMIT_CALC_SHIFT;

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 3.2 32/92] Bluetooth: Add support for Lite-on [04ca:3007]

2014-06-06 Thread Ben Hutchings
3.2.60-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Mohammed Habibulla 

commit 1fb4e09a7e780b915dbd172592ae7e2a4c071065 upstream.

Add support for the AR9462 chip

T:  Bus=01 Lev=01 Prnt=01 Port=03 Cnt=03 Dev#=  3 Spd=12   MxCh= 0
D:  Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
P:  Vendor=04ca ProdID=3007 Rev= 0.01
C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=81(I) Atr=03(Int.) MxPS=  16 Ivl=1ms
E:  Ad=82(I) Atr=02(Bulk) MxPS=  64 Ivl=0ms
E:  Ad=02(O) Atr=02(Bulk) MxPS=  64 Ivl=0ms
I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=83(I) Atr=01(Isoc) MxPS=   0 Ivl=1ms
E:  Ad=03(O) Atr=01(Isoc) MxPS=   0 Ivl=1ms
I:  If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=83(I) Atr=01(Isoc) MxPS=   9 Ivl=1ms
E:  Ad=03(O) Atr=01(Isoc) MxPS=   9 Ivl=1ms
I:  If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=83(I) Atr=01(Isoc) MxPS=  17 Ivl=1ms
E:  Ad=03(O) Atr=01(Isoc) MxPS=  17 Ivl=1ms
I:  If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=83(I) Atr=01(Isoc) MxPS=  25 Ivl=1ms
E:  Ad=03(O) Atr=01(Isoc) MxPS=  25 Ivl=1ms
I:  If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=83(I) Atr=01(Isoc) MxPS=  33 Ivl=1ms
E:  Ad=03(O) Atr=01(Isoc) MxPS=  33 Ivl=1ms
I:  If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=83(I) Atr=01(Isoc) MxPS=  49 Ivl=1ms
E:  Ad=03(O) Atr=01(Isoc) MxPS=  49 Ivl=1ms

Signed-off-by: Mohammed Habibulla 
Signed-off-by: Gustavo Padovan 
Signed-off-by: Ben Hutchings 
---
 drivers/bluetooth/ath3k.c | 2 ++
 drivers/bluetooth/btusb.c | 1 +
 2 files changed, 3 insertions(+)

--- a/drivers/bluetooth/ath3k.c
+++ b/drivers/bluetooth/ath3k.c
@@ -81,6 +81,7 @@ static struct usb_device_id ath3k_table[
{ USB_DEVICE(0x04CA, 0x3004) },
{ USB_DEVICE(0x04CA, 0x3005) },
{ USB_DEVICE(0x04CA, 0x3006) },
+   { USB_DEVICE(0x04CA, 0x3007) },
{ USB_DEVICE(0x04CA, 0x3008) },
{ USB_DEVICE(0x13d3, 0x3362) },
{ USB_DEVICE(0x0CF3, 0xE004) },
@@ -123,6 +124,7 @@ static struct usb_device_id ath3k_blist_
{ USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 },
{ USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 },
{ USB_DEVICE(0x04ca, 0x3006), .driver_info = BTUSB_ATH3012 },
+   { USB_DEVICE(0x04ca, 0x3007), .driver_info = BTUSB_ATH3012 },
{ USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 },
{ USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 },
{ USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 },
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -152,6 +152,7 @@ static struct usb_device_id blacklist_ta
{ USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 },
{ USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 },
{ USB_DEVICE(0x04ca, 0x3006), .driver_info = BTUSB_ATH3012 },
+   { USB_DEVICE(0x04ca, 0x3007), .driver_info = BTUSB_ATH3012 },
{ USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 },
{ USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 },
{ USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 },

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 3.2 26/92] net-gro: reset skb->truesize in napi_reuse_skb()

2014-06-06 Thread Ben Hutchings
3.2.60-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Eric Dumazet 

[ Upstream commit e33d0ba8047b049c9262fdb1fcafb93cb52ceceb ]

Recycling skb always had been very tough...

This time it appears GRO layer can accumulate skb->truesize
adjustments made by drivers when they attach a fragment to skb.

skb_gro_receive() can only subtract from skb->truesize the used part
of a fragment.

I spotted this problem seeing TcpExtPruneCalled and
TcpExtTCPRcvCollapsed that were unexpected with a recent kernel, where
TCP receive window should be sized properly to accept traffic coming
from a driver not overshooting skb->truesize.

Signed-off-by: Eric Dumazet 
Signed-off-by: David S. Miller 
Signed-off-by: Ben Hutchings 
---
 net/core/dev.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/net/core/dev.c b/net/core/dev.c
index 7bcf37d..854da15 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -3648,6 +3648,7 @@ static void napi_reuse_skb(struct napi_struct *napi, 
struct sk_buff *skb)
skb->vlan_tci = 0;
skb->dev = napi->dev;
skb->skb_iif = 0;
+   skb->truesize = SKB_TRUESIZE(skb_end_offset(skb));
 
napi->skb = skb;
 }

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 3.2 60/92] mm/page-writeback.c: fix divide by zero in pos_ratio_polynom

2014-06-06 Thread Ben Hutchings
3.2.60-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Rik van Riel 

commit d5c9fde3dae750889168807038243ff36431d276 upstream.

It is possible for "limit - setpoint + 1" to equal zero, after getting
truncated to a 32 bit variable, and resulting in a divide by zero error.

Using the fully 64 bit divide functions avoids this problem.  It also
will cause pos_ratio_polynom() to return the correct value when
(setpoint - limit) exceeds 2^32.

Also uninline pos_ratio_polynom, at Andrew's request.

Signed-off-by: Rik van Riel 
Reviewed-by: Michal Hocko 
Cc: Aneesh Kumar K.V 
Cc: Mel Gorman 
Cc: Nishanth Aravamudan 
Cc: Luiz Capitulino 
Cc: Masayoshi Mizuma 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
[bwh: Backported to 3.2:
 Adjust context - pos_ratio_polynom() is not a separate function]
Signed-off-by: Ben Hutchings 
---
 mm/page-writeback.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

--- a/mm/page-writeback.c
+++ b/mm/page-writeback.c
@@ -559,7 +559,7 @@ static unsigned long bdi_position_ratio(
 * => fast response on large errors; small oscillation near setpoint
 */
setpoint = (freerun + limit) / 2;
-   x = div_s64(((s64)setpoint - (s64)dirty) << RATELIMIT_CALC_SHIFT,
+   x = div64_s64(((s64)setpoint - (s64)dirty) << RATELIMIT_CALC_SHIFT,
limit - setpoint + 1);
pos_ratio = x;
pos_ratio = pos_ratio * x >> RATELIMIT_CALC_SHIFT;
@@ -625,7 +625,7 @@ static unsigned long bdi_position_ratio(
x_intercept = bdi_setpoint + span;
 
if (bdi_dirty < x_intercept - span / 4) {
-   pos_ratio = div_u64(pos_ratio * (x_intercept - bdi_dirty),
+   pos_ratio = div64_u64(pos_ratio * (x_intercept - bdi_dirty),
x_intercept - bdi_setpoint + 1);
} else
pos_ratio /= 4;

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 3.2 35/92] kvm: remove .done from struct kvm_async_pf

2014-06-06 Thread Ben Hutchings
3.2.60-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Radim Krčmář 

commit 98fda169290b3b28c0f2db2b8f02290c13da50ef upstream.

'.done' is used to mark the completion of 'async_pf_execute()', but
'cancel_work_sync()' returns true when the work was canceled, so we
use it instead.

Signed-off-by: Radim Krčmář 
Reviewed-by: Paolo Bonzini 
Reviewed-by: Gleb Natapov 
Signed-off-by: Paolo Bonzini 
Signed-off-by: Ben Hutchings 
---
 include/linux/kvm_host.h | 1 -
 virt/kvm/async_pf.c  | 5 +
 2 files changed, 1 insertion(+), 5 deletions(-)

--- a/include/linux/kvm_host.h
+++ b/include/linux/kvm_host.h
@@ -95,7 +95,6 @@ struct kvm_async_pf {
unsigned long addr;
struct kvm_arch_async_pf arch;
struct page *page;
-   bool done;
 };
 
 void kvm_clear_async_pf_completion_queue(struct kvm_vcpu *vcpu);
--- a/virt/kvm/async_pf.c
+++ b/virt/kvm/async_pf.c
@@ -75,7 +75,6 @@ static void async_pf_execute(struct work
spin_lock(>async_pf.lock);
list_add_tail(>link, >async_pf.done);
apf->page = page;
-   apf->done = true;
spin_unlock(>async_pf.lock);
 
/*
@@ -99,9 +98,8 @@ void kvm_clear_async_pf_completion_queue
struct kvm_async_pf *work =
list_entry(vcpu->async_pf.queue.next,
   typeof(*work), queue);
-   cancel_work_sync(>work);
list_del(>queue);
-   if (!work->done) { /* work was canceled */
+   if (cancel_work_sync(>work)) {
mmdrop(work->mm);
kvm_put_kvm(vcpu->kvm); /* == work->vcpu->kvm */
kmem_cache_free(async_pf_cache, work);
@@ -166,7 +164,6 @@ int kvm_setup_async_pf(struct kvm_vcpu *
return 0;
 
work->page = NULL;
-   work->done = false;
work->vcpu = vcpu;
work->gva = gva;
work->addr = gfn_to_hva(vcpu->kvm, gfn);

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 3.2 58/92] posix_acl: handle NULL ACL in posix_acl_equiv_mode

2014-06-06 Thread Ben Hutchings
3.2.60-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Christoph Hellwig 

commit 50c6e282bdf5e8dabf8d7cf7b162545a55645fd9 upstream.

Various filesystems don't bother checking for a NULL ACL in
posix_acl_equiv_mode, and thus can dereference a NULL pointer when it
gets passed one. This usually happens from the NFS server, as the ACL tools
never pass a NULL ACL, but instead of one representing the mode bits.

Instead of adding boilerplat to all filesystems put this check into one place,
which will allow us to remove the check from other filesystems as well later
on.

Signed-off-by: Christoph Hellwig 
Reported-by: Ben Greear 
Reported-by: Marco Munderloh ,
Cc: Chuck Lever 
Signed-off-by: Al Viro 
Signed-off-by: Ben Hutchings 
---
 fs/posix_acl.c | 6 ++
 1 file changed, 6 insertions(+)

--- a/fs/posix_acl.c
+++ b/fs/posix_acl.c
@@ -155,6 +155,12 @@ posix_acl_equiv_mode(const struct posix_
umode_t mode = 0;
int not_equiv = 0;
 
+   /*
+* A null ACL can always be presented as mode bits.
+*/
+   if (!acl)
+   return 0;
+
FOREACH_ACL_ENTRY(pa, acl, pe) {
switch (pa->e_tag) {
case ACL_USER_OBJ:

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 3.2 39/92] hrtimer: Prevent all reprogramming if hang detected

2014-06-06 Thread Ben Hutchings
3.2.60-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Stuart Hayes 

commit 6c6c0d5a1c949d2e084706f9e5fb1fccc175b265 upstream.

If the last hrtimer interrupt detected a hang it sets hang_detected=1
and programs the clock event device with a delay to let the system
make progress.

If hang_detected == 1, we prevent reprogramming of the clock event
device in hrtimer_reprogram() but not in hrtimer_force_reprogram().

This can lead to the following situation:

hrtimer_interrupt()
   hang_detected = 1;
   program ce device to Xms from now (hang delay)

We have two timers pending:
   T1 expires 50ms from now
   T2 expires 5s from now

Now T1 gets canceled, which causes hrtimer_force_reprogram() to be
invoked, which in turn programs the clock event device to T2 (5
seconds from now).

Any hrtimer_start after that will not reprogram the hardware due to
hang_detected still being set. So we effectivly block all timers until
the T2 event fires and cleans up the hang situation.

Add a check for hang_detected to hrtimer_force_reprogram() which
prevents the reprogramming of the hang delay in the hardware
timer. The subsequent hrtimer_interrupt will resolve all outstanding
issues.

[ tglx: Rewrote subject and changelog and fixed up the comment in
hrtimer_force_reprogram() ]

Signed-off-by: Stuart Hayes 
Link: http://lkml.kernel.org/r/53602dc6.2060...@gmail.com
Signed-off-by: Thomas Gleixner 
Signed-off-by: Ben Hutchings 
---
 kernel/hrtimer.c | 17 +
 1 file changed, 17 insertions(+)

--- a/kernel/hrtimer.c
+++ b/kernel/hrtimer.c
@@ -567,6 +567,23 @@ hrtimer_force_reprogram(struct hrtimer_c
 
cpu_base->expires_next.tv64 = expires_next.tv64;
 
+   /*
+* If a hang was detected in the last timer interrupt then we
+* leave the hang delay active in the hardware. We want the
+* system to make progress. That also prevents the following
+* scenario:
+* T1 expires 50ms from now
+* T2 expires 5s from now
+*
+* T1 is removed, so this code is called and would reprogram
+* the hardware to 5s from now. Any hrtimer_start after that
+* will not reprogram the hardware due to hang_detected being
+* set. So we'd effectivly block all timers until the T2 event
+* fires.
+*/
+   if (cpu_base->hang_detected)
+   return;
+
if (cpu_base->expires_next.tv64 != KTIME_MAX)
tick_program_event(cpu_base->expires_next, 1);
 }

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 3.2 41/92] timer: Prevent overflow in apply_slack

2014-06-06 Thread Ben Hutchings
3.2.60-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Jiri Bohac 

commit 98a01e779f3c66b0b11cd7e64d531c0e41c95762 upstream.

On architectures with sizeof(int) < sizeof (long), the
computation of mask inside apply_slack() can be undefined if the
computed bit is > 32.

E.g. with: expires = 0xe6f5 and slack = 25, we get:

expires_limit = 0x2000e
bit = 33
mask = (1 << 33) - 1  /* undefined */

On x86, mask becomes 1 and and the slack is not applied properly.
On s390, mask is -1, expires is set to 0 and the timer fires immediately.

Use 1UL << bit to solve that issue.

Suggested-by: Deborah Townsend 
Signed-off-by: Jiri Bohac 
Link: http://lkml.kernel.org/r/20140418152310.ga13...@midget.suse.cz
Signed-off-by: Thomas Gleixner 
Signed-off-by: Ben Hutchings 
---
 kernel/timer.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/kernel/timer.c
+++ b/kernel/timer.c
@@ -769,7 +769,7 @@ unsigned long apply_slack(struct timer_l
 
bit = find_last_bit(, BITS_PER_LONG);
 
-   mask = (1 << bit) - 1;
+   mask = (1UL << bit) - 1;
 
expires_limit = expires_limit & ~(mask);
 

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 3.2 03/92] ACPI / EC: Process rather than discard events in acpi_ec_clear

2014-06-06 Thread Ben Hutchings
3.2.60-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Kieran Clancy 

commit 3eba563e280101209bad27d40bfc83ddf1489234 upstream.

Address a regression caused by commit ad332c8a4533:
(ACPI / EC: Clear stale EC events on Samsung systems)

After the earlier patch, there was found to be a race condition on some
earlier Samsung systems (N150/N210/N220). The function acpi_ec_clear was
sometimes discarding a new EC event before its GPE was triggered by the
system. In the case of these systems, this meant that the "lid open"
event was not registered on resume if that was the cause of the wake,
leading to problems when attempting to close the lid to suspend again.

After testing on a number of Samsung systems, both those affected by the
previous EC bug and those affected by the race condition, it seemed that
the best course of action was to process rather than discard the events.
On Samsung systems which accumulate stale EC events, there does not seem
to be any adverse side-effects of running the associated _Q methods.

This patch adds an argument to the static function acpi_ec_sync_query so
that it may be used within the acpi_ec_clear loop in place of
acpi_ec_query_unlocked which was used previously.

With thanks to Stefan Biereigel for reporting the issue, and for all the
people who helped test the new patch on affected systems.

Fixes: ad332c8a4533 (ACPI / EC: Clear stale EC events on Samsung systems)
References: https://lkml.kernel.org/r/532fe3b2.9060...@biereigel-wb.de
References: https://bugzilla.kernel.org/show_bug.cgi?id=44161#c173
Reported-by: Stefan Biereigel 
Signed-off-by: Kieran Clancy 
Tested-by: Stefan Biereigel 
Tested-by: Dennis Jansen 
Tested-by: Nicolas Porcel 
Tested-by: Maurizio D'Addona 
Tested-by: Juan Manuel Cabo 
Tested-by: Giannis Koutsou 
Tested-by: Kieran Clancy 
Signed-off-by: Rafael J. Wysocki 
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings 
---
 drivers/acpi/ec.c | 21 -
 1 file changed, 12 insertions(+), 9 deletions(-)

--- a/drivers/acpi/ec.c
+++ b/drivers/acpi/ec.c
@@ -206,13 +206,13 @@ unlock:
spin_unlock_irqrestore(>curr_lock, flags);
 }
 
-static int acpi_ec_sync_query(struct acpi_ec *ec);
+static int acpi_ec_sync_query(struct acpi_ec *ec, u8 *data);
 
 static int ec_check_sci_sync(struct acpi_ec *ec, u8 state)
 {
if (state & ACPI_EC_FLAG_SCI) {
if (!test_and_set_bit(EC_FLAGS_QUERY_PENDING, >flags))
-   return acpi_ec_sync_query(ec);
+   return acpi_ec_sync_query(ec, NULL);
}
return 0;
 }
@@ -452,10 +452,8 @@ int ec_transaction(u8 command,
 
 EXPORT_SYMBOL(ec_transaction);
 
-static int acpi_ec_query_unlocked(struct acpi_ec *ec, u8 *data);
-
 /*
- * Clears stale _Q events that might have accumulated in the EC.
+ * Process _Q events that might have accumulated in the EC.
  * Run with locked ec mutex.
  */
 static void acpi_ec_clear(struct acpi_ec *ec)
@@ -464,7 +462,7 @@ static void acpi_ec_clear(struct acpi_ec
u8 value = 0;
 
for (i = 0; i < ACPI_EC_CLEAR_MAX; i++) {
-   status = acpi_ec_query_unlocked(ec, );
+   status = acpi_ec_sync_query(ec, );
if (status || !value)
break;
}
@@ -591,13 +589,18 @@ static void acpi_ec_run(void *cxt)
kfree(handler);
 }
 
-static int acpi_ec_sync_query(struct acpi_ec *ec)
+static int acpi_ec_sync_query(struct acpi_ec *ec, u8 *data)
 {
u8 value = 0;
int status;
struct acpi_ec_query_handler *handler, *copy;
-   if ((status = acpi_ec_query_unlocked(ec, )))
+
+   status = acpi_ec_query_unlocked(ec, );
+   if (data)
+   *data = value;
+   if (status)
return status;
+
list_for_each_entry(handler, >list, node) {
if (value == handler->query_bit) {
/* have custom handler for this bit */
@@ -620,7 +623,7 @@ static void acpi_ec_gpe_query(void *ec_c
if (!ec)
return;
mutex_lock(>lock);
-   acpi_ec_sync_query(ec);
+   acpi_ec_sync_query(ec, NULL);
mutex_unlock(>lock);
 }
 

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 3.2 28/92] rt2x00: fix beaconing on USB

2014-06-06 Thread Ben Hutchings
3.2.60-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Stanislaw Gruszka 

commit 8834d3608cc516f13e2e510f4057c263f3d2ce42 upstream.

When disable beaconing we clear register with beacon and newer set it
back, what make we stop send beacons infinitely.

Signed-off-by: Stanislaw Gruszka 
Signed-off-by: John W. Linville 
Signed-off-by: Ben Hutchings 
---
 drivers/net/wireless/rt2x00/rt2x00mac.c | 22 --
 1 file changed, 12 insertions(+), 10 deletions(-)

--- a/drivers/net/wireless/rt2x00/rt2x00mac.c
+++ b/drivers/net/wireless/rt2x00/rt2x00mac.c
@@ -651,20 +651,18 @@ void rt2x00mac_bss_info_changed(struct i
  bss_conf->bssid);
 
/*
-* Update the beacon. This is only required on USB devices. PCI
-* devices fetch beacons periodically.
-*/
-   if (changes & BSS_CHANGED_BEACON && rt2x00_is_usb(rt2x00dev))
-   rt2x00queue_update_beacon(rt2x00dev, vif);
-
-   /*
 * Start/stop beaconing.
 */
if (changes & BSS_CHANGED_BEACON_ENABLED) {
if (!bss_conf->enable_beacon && intf->enable_beacon) {
-   rt2x00queue_clear_beacon(rt2x00dev, vif);
rt2x00dev->intf_beaconing--;
intf->enable_beacon = false;
+   /*
+* Clear beacon in the H/W for this vif. This is needed
+* to disable beaconing on this particular interface
+* and keep it running on other interfaces.
+*/
+   rt2x00queue_clear_beacon(rt2x00dev, vif);
 
if (rt2x00dev->intf_beaconing == 0) {
/*
@@ -675,11 +673,15 @@ void rt2x00mac_bss_info_changed(struct i
rt2x00queue_stop_queue(rt2x00dev->bcn);
mutex_unlock(>beacon_skb_mutex);
}
-
-
} else if (bss_conf->enable_beacon && !intf->enable_beacon) {
rt2x00dev->intf_beaconing++;
intf->enable_beacon = true;
+   /*
+* Upload beacon to the H/W. This is only required on
+* USB devices. PCI devices fetch beacons periodically.
+*/
+   if (rt2x00_is_usb(rt2x00dev))
+   rt2x00queue_update_beacon(rt2x00dev, vif);
 
if (rt2x00dev->intf_beaconing == 1) {
/*

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 3.2 21/92] ipv4: fib_semantics: increment fib_info_cnt after fib_info allocation

2014-06-06 Thread Ben Hutchings
3.2.60-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Sergey Popovich 

[ Upstream commit aeefa1ecfc799b0ea2c4979617f14cecd5cccbfd ]

Increment fib_info_cnt in fib_create_info() right after successfuly
alllocating fib_info structure, overwise fib_metrics allocation failure
leads to fib_info_cnt incorrectly decremented in free_fib_info(), called
on error path from fib_create_info().

Signed-off-by: Sergey Popovich 
Signed-off-by: David S. Miller 
Signed-off-by: Ben Hutchings 
---
 net/ipv4/fib_semantics.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
index d01f9c6..76da979 100644
--- a/net/ipv4/fib_semantics.c
+++ b/net/ipv4/fib_semantics.c
@@ -752,13 +752,13 @@ struct fib_info *fib_create_info(struct fib_config *cfg)
fi = kzalloc(sizeof(*fi)+nhs*sizeof(struct fib_nh), GFP_KERNEL);
if (fi == NULL)
goto failure;
+   fib_info_cnt++;
if (cfg->fc_mx) {
fi->fib_metrics = kzalloc(sizeof(u32) * RTAX_MAX, GFP_KERNEL);
if (!fi->fib_metrics)
goto failure;
} else
fi->fib_metrics = (u32 *) dst_default_metrics;
-   fib_info_cnt++;
 
fi->fib_net = hold_net(net);
fi->fib_protocol = cfg->fc_protocol;

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 3.2 20/92] net: ipv4: ip_forward: fix inverted local_df test

2014-06-06 Thread Ben Hutchings
3.2.60-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Florian Westphal 

[ Upstream commit ca6c5d4ad216d5942ae544bbf02503041bd802aa ]

local_df means 'ignore DF bit if set', so if its set we're
allowed to perform ip fragmentation.

This wasn't noticed earlier because the output path also drops such skbs
(and emits needed icmp error) and because netfilter ip defrag did not
set local_df until couple of days ago.

Only difference is that DF-packets-larger-than MTU now discarded
earlier (f.e. we avoid pointless netfilter postrouting trip).

While at it, drop the repeated test ip_exceeds_mtu, checking it once
is enough...

Fixes: fe6cc55f3a9 ("net: ip, ipv6: handle gso skbs in forwarding path")
Signed-off-by: Florian Westphal 
Signed-off-by: David S. Miller 
Signed-off-by: Ben Hutchings 
---
 net/ipv4/ip_forward.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/ipv4/ip_forward.c b/net/ipv4/ip_forward.c
index e0d9f02..7593f3a 100644
--- a/net/ipv4/ip_forward.c
+++ b/net/ipv4/ip_forward.c
@@ -42,12 +42,12 @@
 static bool ip_may_fragment(const struct sk_buff *skb)
 {
return unlikely((ip_hdr(skb)->frag_off & htons(IP_DF)) == 0) ||
-  !skb->local_df;
+   skb->local_df;
 }
 
 static bool ip_exceeds_mtu(const struct sk_buff *skb, unsigned int mtu)
 {
-   if (skb->len <= mtu || skb->local_df)
+   if (skb->len <= mtu)
return false;
 
if (skb_is_gso(skb) && skb_gso_network_seglen(skb) <= mtu)

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 3.2 31/92] Bluetooth: Fix redundant encryption request for reauthentication

2014-06-06 Thread Ben Hutchings
3.2.60-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Johan Hedberg 

commit 09da1f3463eb81d59685df723b1c5950b7570340 upstream.

When we're performing reauthentication (in order to elevate the
security level from an unauthenticated key to an authenticated one) we
do not need to issue any encryption command once authentication
completes. Since the trigger for the encryption HCI command is the
ENCRYPT_PEND flag this flag should not be set in this scenario.
Instead, the REAUTH_PEND flag takes care of all necessary steps for
reauthentication.

Signed-off-by: Johan Hedberg 
Signed-off-by: Marcel Holtmann 
[bwh: Backported to 3.2:
 - Adjust context
 - s/conn->flags/conn->pend/]
Signed-off-by: Ben Hutchings 
---
 net/bluetooth/hci_conn.c | 9 ++---
 1 file changed, 6 insertions(+), 3 deletions(-)

--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -610,14 +610,17 @@ static int hci_conn_auth(struct hci_conn
if (!test_and_set_bit(HCI_CONN_AUTH_PEND, >pend)) {
struct hci_cp_auth_requested cp;
 
-   /* encrypt must be pending if auth is also pending */
-   set_bit(HCI_CONN_ENCRYPT_PEND, >pend);
-
cp.handle = cpu_to_le16(conn->handle);
hci_send_cmd(conn->hdev, HCI_OP_AUTH_REQUESTED,
sizeof(cp), );
+
+   /* If we're already encrypted set the REAUTH_PEND flag,
+* otherwise set the ENCRYPT_PEND.
+*/
if (conn->key_type != 0xff)
set_bit(HCI_CONN_REAUTH_PEND, >pend);
+   else
+   set_bit(HCI_CONN_ENCRYPT_PEND, >pend);
}
 
return 0;

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 3.2 47/92] drivers/tty/hvc: don't free hvc_console_setup after init

2014-06-06 Thread Ben Hutchings
3.2.60-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Tomoki Sekiyama 

commit 501fed45b7e8836ee9373f4d31e2d85e3db6103a upstream.

When 'console=hvc0' is specified to the kernel parameter in x86 KVM guest,
hvc console is setup within a kthread. However, that will cause SEGV
and the boot will fail when the driver is builtin to the kernel,
because currently hvc_console_setup() is annotated with '__init'. This
patch removes '__init' to boot the guest successfully with 'console=hvc0'.

Signed-off-by: Tomoki Sekiyama 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Ben Hutchings 
---
 drivers/tty/hvc/hvc_console.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/tty/hvc/hvc_console.c
+++ b/drivers/tty/hvc/hvc_console.c
@@ -190,7 +190,7 @@ static struct tty_driver *hvc_console_de
return hvc_driver;
 }
 
-static int __init hvc_console_setup(struct console *co, char *options)
+static int hvc_console_setup(struct console *co, char *options)
 {  
if (co->index < 0 || co->index >= MAX_NR_HVC_CONSOLES)
return -ENODEV;

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 3.2 30/92] drm/vmwgfx: Make sure user-space can't DMA across buffer object boundaries v2

2014-06-06 Thread Ben Hutchings
3.2.60-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Thomas Hellstrom 

commit cbd75e97a525e3819c02dc18bc2d67aa544c9e45 upstream.

We already check that the buffer object we're accessing is registered with
the file. Now also make sure that we can't DMA across buffer object boundaries.

v2: Code commenting update.

Signed-off-by: Thomas Hellstrom 
Reviewed-by: Jakob Bornecrantz 
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings 
---
 drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 22 ++
 1 file changed, 22 insertions(+)

--- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
@@ -558,14 +558,36 @@ static int vmw_cmd_dma(struct vmw_privat
} *cmd;
int ret;
struct vmw_resource *res;
+   SVGA3dCmdSurfaceDMASuffix *suffix;
+   uint32_t bo_size;
 
cmd = container_of(header, struct vmw_dma_cmd, header);
+   suffix = (SVGA3dCmdSurfaceDMASuffix *)((unsigned long) >dma +
+  header->size - sizeof(*suffix));
+
+   /* Make sure device and verifier stays in sync. */
+   if (unlikely(suffix->suffixSize != sizeof(*suffix))) {
+   DRM_ERROR("Invalid DMA suffix size.\n");
+   return -EINVAL;
+   }
+
ret = vmw_translate_guest_ptr(dev_priv, sw_context,
  >dma.guest.ptr,
  _bo);
if (unlikely(ret != 0))
return ret;
 
+   /* Make sure DMA doesn't cross BO boundaries. */
+   bo_size = vmw_bo->base.num_pages * PAGE_SIZE;
+   if (unlikely(cmd->dma.guest.ptr.offset > bo_size)) {
+   DRM_ERROR("Invalid DMA offset.\n");
+   return -EINVAL;
+   }
+
+   bo_size -= cmd->dma.guest.ptr.offset;
+   if (unlikely(suffix->maximumOffset > bo_size))
+   suffix->maximumOffset = bo_size;
+
bo = _bo->base;
ret = vmw_user_surface_lookup_handle(dev_priv, sw_context->tfile,
 cmd->dma.host.sid, );

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 3.2 29/92] Input: synaptics - add min/max quirk for ThinkPad Edge E431

2014-06-06 Thread Ben Hutchings
3.2.60-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Hans de Goede 

commit 27a38856a948c3e8de30dc71647ff9e1778c99fc upstream.

Signed-off-by: Hans de Goede 
Signed-off-by: Dmitry Torokhov 
Signed-off-by: Ben Hutchings 
---
 drivers/input/mouse/synaptics.c | 8 
 1 file changed, 8 insertions(+)

--- a/drivers/input/mouse/synaptics.c
+++ b/drivers/input/mouse/synaptics.c
@@ -1394,6 +1394,14 @@ static const struct dmi_system_id min_ma
.driver_data = (int []){1232, 5710, 1156, 4696},
},
{
+   /* Lenovo ThinkPad Edge E431 */
+   .matches = {
+   DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+   DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad Edge E431"),
+   },
+   .driver_data = (int []){1024, 5022, 2508, 4832},
+   },
+   {
/* Lenovo ThinkPad T431s */
.matches = {
DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 3.2 44/92] [media] media-device: fix infoleak in ioctl media_enum_entities()

2014-06-06 Thread Ben Hutchings
3.2.60-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Salva Peiró 

commit e6a623460e5fc960ac3ee9f946d3106233fd28d8 upstream.

This fixes CVE-2014-1739.

Signed-off-by: Salva Peiró 
Acked-by: Laurent Pinchart 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Ben Hutchings 
---
 drivers/media/media-device.c | 1 +
 1 file changed, 1 insertion(+)

--- a/drivers/media/media-device.c
+++ b/drivers/media/media-device.c
@@ -90,6 +90,7 @@ static long media_device_enum_entities(s
struct media_entity *ent;
struct media_entity_desc u_ent;
 
+   memset(_ent, 0, sizeof(u_ent));
if (copy_from_user(_ent.id, >id, sizeof(u_ent.id)))
return -EFAULT;
 

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 3.2 38/92] [SCSI] mpt2sas: Don't disable device twice at suspend.

2014-06-06 Thread Ben Hutchings
3.2.60-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Tyler Stachecki 

commit af61e27c3f77c7623b5335590ae24b6a5c323e22 upstream.

On suspend, _scsih_suspend calls mpt2sas_base_free_resources, which
in turn calls pci_disable_device if the device is enabled prior to
suspending. However, _scsih_suspend also calls pci_disable_device
itself.

Thus, in the event that the device is enabled prior to suspending,
pci_disable_device will be called twice. This patch removes the
duplicate call to pci_disable_device in _scsi_suspend as it is both
unnecessary and results in a kernel oops.

Signed-off-by: Tyler Stachecki 
Signed-off-by: James Bottomley 
Signed-off-by: Ben Hutchings 
---
 drivers/scsi/mpt2sas/mpt2sas_scsih.c | 1 -
 1 file changed, 1 deletion(-)

--- a/drivers/scsi/mpt2sas/mpt2sas_scsih.c
+++ b/drivers/scsi/mpt2sas/mpt2sas_scsih.c
@@ -8166,7 +8166,6 @@ _scsih_suspend(struct pci_dev *pdev, pm_
 
mpt2sas_base_free_resources(ioc);
pci_save_state(pdev);
-   pci_disable_device(pdev);
pci_set_power_state(pdev, device_state);
return 0;
 }

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 3.2 24/92] ipv4: initialise the itag variable in __mkroute_input

2014-06-06 Thread Ben Hutchings
3.2.60-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Li RongQing 

[ Upstream commit fbdc0ad095c0a299e9abf5d8ac8f58374951149a ]

the value of itag is a random value from stack, and may not be initiated by
fib_validate_source, which called fib_combine_itag if CONFIG_IP_ROUTE_CLASSID
is not set

This will make the cached dst uncertainty

Signed-off-by: Li RongQing 
Acked-by: Alexei Starovoitov 
Signed-off-by: David S. Miller 
Signed-off-by: Ben Hutchings 
---
 net/ipv4/route.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 6768ce2..6526110 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -2142,7 +2142,7 @@ static int __mkroute_input(struct sk_buff *skb,
struct in_device *out_dev;
unsigned int flags = 0;
__be32 spec_dst;
-   u32 itag;
+   u32 itag = 0;
 
/* get a working reference to the output device */
out_dev = __in_dev_get_rcu(FIB_RES_DEV(*res));

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH 3.2 22/92] macvlan: Don't propagate IFF_ALLMULTI changes on down interfaces.

2014-06-06 Thread Ben Hutchings
3.2.60-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Peter Christensen 

[ Upstream commit bbeb0eadcf9fe74fb2b9b1a6fea82cd538b1e556 ]

Clearing the IFF_ALLMULTI flag on a down interface could cause an allmulti
overflow on the underlying interface.

Attempting the set IFF_ALLMULTI on the underlying interface would cause an
error and the log message:

"allmulti touches root, set allmulti failed."

Signed-off-by: Peter Christensen 
Signed-off-by: David S. Miller 
Signed-off-by: Ben Hutchings 
---
 drivers/net/macvlan.c | 6 --
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
index ab5786b..b74cdf6 100644
--- a/drivers/net/macvlan.c
+++ b/drivers/net/macvlan.c
@@ -391,8 +391,10 @@ static void macvlan_change_rx_flags(struct net_device 
*dev, int change)
struct macvlan_dev *vlan = netdev_priv(dev);
struct net_device *lowerdev = vlan->lowerdev;
 
-   if (change & IFF_ALLMULTI)
-   dev_set_allmulti(lowerdev, dev->flags & IFF_ALLMULTI ? 1 : -1);
+   if (dev->flags & IFF_UP) {
+   if (change & IFF_ALLMULTI)
+   dev_set_allmulti(lowerdev, dev->flags & IFF_ALLMULTI ? 
1 : -1);
+   }
 }
 
 static void macvlan_set_multicast_list(struct net_device *dev)

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


  1   2   3   4   5   6   7   8   9   10   >