--- /dev/null
+From e2b31644e999e8bfe3efce880fb32840299abf41 Mon Sep 17 00:00:00 2001
+From: Tomas Winkler <tomas.winkler@intel.com>
+Date: Mon, 2 Sep 2013 13:29:46 +0300
+Subject: mei: bus: stop wait for read during cl state transition
+
+From: Tomas Winkler <tomas.winkler@intel.com>
+
+commit e2b31644e999e8bfe3efce880fb32840299abf41 upstream.
+
+Bus layer omitted check for client state transition while waiting
+for read completion
+The client state transition may occur for example as result
+of firmware initiated reset
+
+Add mei_cl_is_transitioning wrapper to reduce the code
+repetition.:
+
+Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/misc/mei/bus.c | 5 ++++-
+ drivers/misc/mei/client.h | 6 ++++++
+ drivers/misc/mei/main.c | 11 ++++-------
+ 3 files changed, 14 insertions(+), 8 deletions(-)
+
+--- a/drivers/misc/mei/bus.c
++++ b/drivers/misc/mei/bus.c
+@@ -295,10 +295,13 @@ int __mei_cl_recv(struct mei_cl *cl, u8
+
+ if (cl->reading_state != MEI_READ_COMPLETE &&
+ !waitqueue_active(&cl->rx_wait)) {
++
+ mutex_unlock(&dev->device_lock);
+
+ if (wait_event_interruptible(cl->rx_wait,
+- (MEI_READ_COMPLETE == cl->reading_state))) {
++ cl->reading_state == MEI_READ_COMPLETE ||
++ mei_cl_is_transitioning(cl))) {
++
+ if (signal_pending(current))
+ return -EINTR;
+ return -ERESTARTSYS;
+--- a/drivers/misc/mei/client.h
++++ b/drivers/misc/mei/client.h
+@@ -76,6 +76,12 @@ static inline bool mei_cl_cmp_id(const s
+ (cl1->host_client_id == cl2->host_client_id) &&
+ (cl1->me_client_id == cl2->me_client_id);
+ }
++static inline bool mei_cl_is_transitioning(struct mei_cl *cl)
++{
++ return (MEI_FILE_INITIALIZING == cl->state ||
++ MEI_FILE_DISCONNECTED == cl->state ||
++ MEI_FILE_DISCONNECTING == cl->state);
++}
+
+
+ int mei_cl_flow_ctrl_creds(struct mei_cl *cl);
+--- a/drivers/misc/mei/main.c
++++ b/drivers/misc/mei/main.c
+@@ -262,19 +262,16 @@ static ssize_t mei_read(struct file *fil
+ mutex_unlock(&dev->device_lock);
+
+ if (wait_event_interruptible(cl->rx_wait,
+- (MEI_READ_COMPLETE == cl->reading_state ||
+- MEI_FILE_INITIALIZING == cl->state ||
+- MEI_FILE_DISCONNECTED == cl->state ||
+- MEI_FILE_DISCONNECTING == cl->state))) {
++ MEI_READ_COMPLETE == cl->reading_state ||
++ mei_cl_is_transitioning(cl))) {
++
+ if (signal_pending(current))
+ return -EINTR;
+ return -ERESTARTSYS;
+ }
+
+ mutex_lock(&dev->device_lock);
+- if (MEI_FILE_INITIALIZING == cl->state ||
+- MEI_FILE_DISCONNECTED == cl->state ||
+- MEI_FILE_DISCONNECTING == cl->state) {
++ if (mei_cl_is_transitioning(cl)) {
+ rets = -EBUSY;
+ goto out;
+ }
--- /dev/null
+From 4a704575cc1afb3b848f096778fa9b8d7b3d5813 Mon Sep 17 00:00:00 2001
+From: Alexander Usyskin <alexander.usyskin@intel.com>
+Date: Mon, 2 Sep 2013 13:29:47 +0300
+Subject: mei: cancel stall timers in mei_reset
+
+From: Alexander Usyskin <alexander.usyskin@intel.com>
+
+commit 4a704575cc1afb3b848f096778fa9b8d7b3d5813 upstream.
+
+Unset init_clients_timer and amthif_stall_timers
+in mei_reset in order to cancel timer ticking and hence
+avoid recursive reset calls.
+
+Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
+Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/misc/mei/amthif.c | 1 +
+ drivers/misc/mei/init.c | 3 +++
+ 2 files changed, 4 insertions(+)
+
+--- a/drivers/misc/mei/amthif.c
++++ b/drivers/misc/mei/amthif.c
+@@ -57,6 +57,7 @@ void mei_amthif_reset_params(struct mei_
+ dev->iamthif_ioctl = false;
+ dev->iamthif_state = MEI_IAMTHIF_IDLE;
+ dev->iamthif_timer = 0;
++ dev->iamthif_stall_timer = 0;
+ }
+
+ /**
+--- a/drivers/misc/mei/init.c
++++ b/drivers/misc/mei/init.c
+@@ -164,6 +164,9 @@ void mei_reset(struct mei_device *dev, i
+ memset(&dev->wr_ext_msg, 0, sizeof(dev->wr_ext_msg));
+ }
+
++ /* we're already in reset, cancel the init timer */
++ dev->init_clients_timer = 0;
++
+ dev->me_clients_num = 0;
+ dev->rd_msg_hdr = 0;
+ dev->wd_pending = false;
--- /dev/null
+From 1aee351a739153529fbb98ee461777b2abd5e1c9 Mon Sep 17 00:00:00 2001
+From: Tomas Winkler <tomas.winkler@intel.com>
+Date: Mon, 2 Sep 2013 13:29:45 +0300
+Subject: mei: make me client counters less error prone
+
+From: Tomas Winkler <tomas.winkler@intel.com>
+
+commit 1aee351a739153529fbb98ee461777b2abd5e1c9 upstream.
+
+1. u8 counters are prone to hard to detect overflow:
+ make them unsigned long to match bit_ functions argument type
+
+2. don't check me_clients_num for negativity, it is unsigned.
+
+3. init all the me client counters from one place
+
+Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/misc/mei/hbm.c | 10 ++++++----
+ drivers/misc/mei/mei_dev.h | 6 +++---
+ 2 files changed, 9 insertions(+), 7 deletions(-)
+
+--- a/drivers/misc/mei/hbm.c
++++ b/drivers/misc/mei/hbm.c
+@@ -35,11 +35,15 @@ static void mei_hbm_me_cl_allocate(struc
+ struct mei_me_client *clients;
+ int b;
+
++ dev->me_clients_num = 0;
++ dev->me_client_presentation_num = 0;
++ dev->me_client_index = 0;
++
+ /* count how many ME clients we have */
+ for_each_set_bit(b, dev->me_clients_map, MEI_CLIENTS_MAX)
+ dev->me_clients_num++;
+
+- if (dev->me_clients_num <= 0)
++ if (dev->me_clients_num == 0)
+ return;
+
+ kfree(dev->me_clients);
+@@ -221,7 +225,7 @@ static int mei_hbm_prop_req(struct mei_d
+ struct hbm_props_request *prop_req;
+ const size_t len = sizeof(struct hbm_props_request);
+ unsigned long next_client_index;
+- u8 client_num;
++ unsigned long client_num;
+
+
+ client_num = dev->me_client_presentation_num;
+@@ -650,8 +654,6 @@ void mei_hbm_dispatch(struct mei_device
+ if (dev->dev_state == MEI_DEV_INIT_CLIENTS &&
+ dev->hbm_state == MEI_HBM_ENUM_CLIENTS) {
+ dev->init_clients_timer = 0;
+- dev->me_client_presentation_num = 0;
+- dev->me_client_index = 0;
+ mei_hbm_me_cl_allocate(dev);
+ dev->hbm_state = MEI_HBM_CLIENT_PROPERTIES;
+
+--- a/drivers/misc/mei/mei_dev.h
++++ b/drivers/misc/mei/mei_dev.h
+@@ -402,9 +402,9 @@ struct mei_device {
+ struct mei_me_client *me_clients; /* Note: memory has to be allocated */
+ DECLARE_BITMAP(me_clients_map, MEI_CLIENTS_MAX);
+ DECLARE_BITMAP(host_clients_map, MEI_CLIENTS_MAX);
+- u8 me_clients_num;
+- u8 me_client_presentation_num;
+- u8 me_client_index;
++ unsigned long me_clients_num;
++ unsigned long me_client_presentation_num;
++ unsigned long me_client_index;
+
+ struct mei_cl wd_cl;
+ enum mei_wd_states wd_state;
--- /dev/null
+From 19b85cfb190eb9980eaf416bff96aef4159a430e Mon Sep 17 00:00:00 2001
+From: Johan Hovold <jhovold@gmail.com>
+Date: Tue, 10 Sep 2013 12:50:50 +0200
+Subject: serial: pch_uart: fix tty-kref leak in dma-rx path
+
+From: Johan Hovold <jhovold@gmail.com>
+
+commit 19b85cfb190eb9980eaf416bff96aef4159a430e upstream.
+
+Fix tty_kref leak when tty_buffer_request room fails in dma-rx path.
+
+Note that the tty ref isn't really needed anymore, but as the leak has
+always been there, fixing it before removing should makes it easier to
+backport the fix.
+
+Signed-off-by: Johan Hovold <jhovold@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/serial/pch_uart.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/tty/serial/pch_uart.c
++++ b/drivers/tty/serial/pch_uart.c
+@@ -658,11 +658,12 @@ static int dma_push_rx(struct eg20t_port
+ dev_warn(port->dev, "Rx overrun: dropping %u bytes\n",
+ size - room);
+ if (!room)
+- return room;
++ goto out;
+
+ tty_insert_flip_string(tport, sg_virt(&priv->sg_rx), size);
+
+ port->icount.rx += room;
++out:
+ tty_kref_put(tty);
+
+ return room;
--- /dev/null
+From fc0919c68cb2f75bb1af759315f9d7e2a9443c28 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <jhovold@gmail.com>
+Date: Tue, 10 Sep 2013 12:50:49 +0200
+Subject: serial: pch_uart: fix tty-kref leak in rx-error path
+
+From: Johan Hovold <jhovold@gmail.com>
+
+commit fc0919c68cb2f75bb1af759315f9d7e2a9443c28 upstream.
+
+Fix tty-kref leak introduced by commit 384e301e ("pch_uart: fix a
+deadlock when pch_uart as console") which never put its tty reference.
+
+Signed-off-by: Johan Hovold <jhovold@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/serial/pch_uart.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/tty/serial/pch_uart.c
++++ b/drivers/tty/serial/pch_uart.c
+@@ -1071,6 +1071,8 @@ static void pch_uart_err_ir(struct eg20t
+ if (tty == NULL) {
+ for (i = 0; error_msg[i] != NULL; i++)
+ dev_err(&priv->pdev->dev, error_msg[i]);
++ } else {
++ tty_kref_put(tty);
+ }
+ }
+
--- /dev/null
+From cfd29aa0e81b791985e8428e6507e80e074e6730 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <jhovold@gmail.com>
+Date: Tue, 10 Sep 2013 12:50:48 +0200
+Subject: serial: tegra: fix tty-kref leak
+
+From: Johan Hovold <jhovold@gmail.com>
+
+commit cfd29aa0e81b791985e8428e6507e80e074e6730 upstream.
+
+Fix potential tty-kref leak in stop_rx path.
+
+Signed-off-by: Johan Hovold <jhovold@gmail.com>
+Tested-by: Stephen Warren <swarren@nvidia.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/serial/serial-tegra.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/tty/serial/serial-tegra.c
++++ b/drivers/tty/serial/serial-tegra.c
+@@ -726,7 +726,7 @@ static irqreturn_t tegra_uart_isr(int ir
+ static void tegra_uart_stop_rx(struct uart_port *u)
+ {
+ struct tegra_uart_port *tup = to_tegra_uport(u);
+- struct tty_struct *tty = tty_port_tty_get(&tup->uport.state->port);
++ struct tty_struct *tty;
+ struct tty_port *port = &u->state->port;
+ struct dma_tx_state state;
+ unsigned long ier;
+@@ -738,6 +738,8 @@ static void tegra_uart_stop_rx(struct ua
+ if (!tup->rx_in_progress)
+ return;
+
++ tty = tty_port_tty_get(&tup->uport.state->port);
++
+ tegra_uart_wait_sym_time(tup, 1); /* wait a character interval */
+
+ ier = tup->ier_shadow;
x86-reboot-add-quirk-to-make-dell-c6100-use-reboot-pci-automatically.patch
tools-lib-lk-uninclude-linux-magic.h-in-debugfs.c.patch
x86-efi-don-t-map-boot-services-on-i386.patch
+mei-make-me-client-counters-less-error-prone.patch
+mei-bus-stop-wait-for-read-during-cl-state-transition.patch
+mei-cancel-stall-timers-in-mei_reset.patch
+tty-fix-sigttou-not-sent-with-tcflush.patch
+serial-tegra-fix-tty-kref-leak.patch
+serial-pch_uart-fix-tty-kref-leak-in-rx-error-path.patch
+serial-pch_uart-fix-tty-kref-leak-in-dma-rx-path.patch
--- /dev/null
+From 5cec7bf699c61d14f0538345076480bb8c8ebfbb Mon Sep 17 00:00:00 2001
+From: Peter Hurley <peter@hurleysoftware.com>
+Date: Wed, 25 Sep 2013 20:13:04 -0400
+Subject: tty: Fix SIGTTOU not sent with tcflush()
+
+From: Peter Hurley <peter@hurleysoftware.com>
+
+commit 5cec7bf699c61d14f0538345076480bb8c8ebfbb upstream.
+
+Commit 'e7f3880cd9b98c5bf9391ae7acdec82b75403776'
+ tty: Fix recursive deadlock in tty_perform_flush()
+introduced a regression where tcflush() does not generate
+SIGTTOU for background process groups.
+
+Make sure ioctl(TCFLSH) calls tty_check_change() when
+invoked from the line discipline.
+
+Reported-by: Oleg Nesterov <oleg@redhat.com>
+Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/tty_ioctl.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/tty/tty_ioctl.c
++++ b/drivers/tty/tty_ioctl.c
+@@ -1201,6 +1201,9 @@ int n_tty_ioctl_helper(struct tty_struct
+ }
+ return 0;
+ case TCFLSH:
++ retval = tty_check_change(tty);
++ if (retval)
++ return retval;
+ return __tty_perform_flush(tty, arg);
+ default:
+ /* Try the mode commands */
projects / thirdparty / kernel / stable-queue.git / commitdiff
