--- /dev/null
+From 7c8a3679e3d8e9d92d58f282161760a0e247df97 Mon Sep 17 00:00:00 2001
+From: Tomoki Sekiyama <tomoki.sekiyama@hds.com>
+Date: Tue, 15 Oct 2013 16:42:19 -0600
+Subject: elevator: acquire q->sysfs_lock in elevator_change()
+
+From: Tomoki Sekiyama <tomoki.sekiyama@hds.com>
+
+commit 7c8a3679e3d8e9d92d58f282161760a0e247df97 upstream.
+
+Add locking of q->sysfs_lock into elevator_change() (an exported function)
+to ensure it is held to protect q->elevator from elevator_init(), even if
+elevator_change() is called from non-sysfs paths.
+sysfs path (elv_iosched_store) uses __elevator_change(), non-locking
+version, as the lock is already taken by elv_iosched_store().
+
+Signed-off-by: Tomoki Sekiyama <tomoki.sekiyama@hds.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Cc: Josh Boyer <jwboyer@fedoraproject.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ block/elevator.c | 16 ++++++++++++++--
+ 1 file changed, 14 insertions(+), 2 deletions(-)
+
+--- a/block/elevator.c
++++ b/block/elevator.c
+@@ -965,7 +965,7 @@ fail_init:
+ /*
+ * Switch this queue to the given IO scheduler.
+ */
+-int elevator_change(struct request_queue *q, const char *name)
++static int __elevator_change(struct request_queue *q, const char *name)
+ {
+ char elevator_name[ELV_NAME_MAX];
+ struct elevator_type *e;
+@@ -987,6 +987,18 @@ int elevator_change(struct request_queue
+
+ return elevator_switch(q, e);
+ }
++
++int elevator_change(struct request_queue *q, const char *name)
++{
++ int ret;
++
++ /* Protect q->elevator from elevator_init() */
++ mutex_lock(&q->sysfs_lock);
++ ret = __elevator_change(q, name);
++ mutex_unlock(&q->sysfs_lock);
++
++ return ret;
++}
+ EXPORT_SYMBOL(elevator_change);
+
+ ssize_t elv_iosched_store(struct request_queue *q, const char *name,
+@@ -997,7 +1009,7 @@ ssize_t elv_iosched_store(struct request
+ if (!q->elevator)
+ return count;
+
+- ret = elevator_change(q, name);
++ ret = __elevator_change(q, name);
+ if (!ret)
+ return count;
+
--- /dev/null
+From eb1c160b22655fd4ec44be732d6594fd1b1e44f4 Mon Sep 17 00:00:00 2001
+From: Tomoki Sekiyama <tomoki.sekiyama@hds.com>
+Date: Tue, 15 Oct 2013 16:42:16 -0600
+Subject: elevator: Fix a race in elevator switching and md device initialization
+
+From: Tomoki Sekiyama <tomoki.sekiyama@hds.com>
+
+commit eb1c160b22655fd4ec44be732d6594fd1b1e44f4 upstream.
+
+The soft lockup below happens at the boot time of the system using dm
+multipath and the udev rules to switch scheduler.
+
+[ 356.127001] BUG: soft lockup - CPU#3 stuck for 22s! [sh:483]
+[ 356.127001] RIP: 0010:[<ffffffff81072a7d>] [<ffffffff81072a7d>] lock_timer_base.isra.35+0x1d/0x50
+...
+[ 356.127001] Call Trace:
+[ 356.127001] [<ffffffff81073810>] try_to_del_timer_sync+0x20/0x70
+[ 356.127001] [<ffffffff8118b08a>] ? kmem_cache_alloc_node_trace+0x20a/0x230
+[ 356.127001] [<ffffffff810738b2>] del_timer_sync+0x52/0x60
+[ 356.127001] [<ffffffff812ece22>] cfq_exit_queue+0x32/0xf0
+[ 356.127001] [<ffffffff812c98df>] elevator_exit+0x2f/0x50
+[ 356.127001] [<ffffffff812c9f21>] elevator_change+0xf1/0x1c0
+[ 356.127001] [<ffffffff812caa50>] elv_iosched_store+0x20/0x50
+[ 356.127001] [<ffffffff812d1d09>] queue_attr_store+0x59/0xb0
+[ 356.127001] [<ffffffff812143f6>] sysfs_write_file+0xc6/0x140
+[ 356.127001] [<ffffffff811a326d>] vfs_write+0xbd/0x1e0
+[ 356.127001] [<ffffffff811a3ca9>] SyS_write+0x49/0xa0
+[ 356.127001] [<ffffffff8164e899>] system_call_fastpath+0x16/0x1b
+
+This is caused by a race between md device initialization by multipathd and
+shell script to switch the scheduler using sysfs.
+
+ - multipathd:
+ SyS_ioctl -> do_vfs_ioctl -> dm_ctl_ioctl -> ctl_ioctl -> table_load
+ -> dm_setup_md_queue -> blk_init_allocated_queue -> elevator_init
+ q->elevator = elevator_alloc(q, e); // not yet initialized
+
+ - sh -c 'echo deadline > /sys/$DEVPATH/queue/scheduler':
+ elevator_switch (in the call trace above)
+ struct elevator_queue *old = q->elevator;
+ q->elevator = elevator_alloc(q, new_e);
+ elevator_exit(old); // lockup! (*)
+
+ - multipathd: (cont.)
+ err = e->ops.elevator_init_fn(q); // init fails; q->elevator is modified
+
+(*) When del_timer_sync() is called, lock_timer_base() will loop infinitely
+while timer->base == NULL. In this case, as timer will never initialized,
+it results in lockup.
+
+This patch introduces acquisition of q->sysfs_lock around elevator_init()
+into blk_init_allocated_queue(), to provide mutual exclusion between
+initialization of the q->scheduler and switching of the scheduler.
+
+This should fix this bugzilla:
+https://bugzilla.redhat.com/show_bug.cgi?id=902012
+
+Signed-off-by: Tomoki Sekiyama <tomoki.sekiyama@hds.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ block/blk-core.c | 10 +++++++++-
+ block/elevator.c | 6 ++++++
+ 2 files changed, 15 insertions(+), 1 deletion(-)
+
+--- a/block/blk-core.c
++++ b/block/blk-core.c
+@@ -741,9 +741,17 @@ blk_init_allocated_queue(struct request_
+
+ q->sg_reserved_size = INT_MAX;
+
++ /* Protect q->elevator from elevator_change */
++ mutex_lock(&q->sysfs_lock);
++
+ /* init elevator */
+- if (elevator_init(q, NULL))
++ if (elevator_init(q, NULL)) {
++ mutex_unlock(&q->sysfs_lock);
+ return NULL;
++ }
++
++ mutex_unlock(&q->sysfs_lock);
++
+ return q;
+ }
+ EXPORT_SYMBOL(blk_init_allocated_queue);
+--- a/block/elevator.c
++++ b/block/elevator.c
+@@ -186,6 +186,12 @@ int elevator_init(struct request_queue *
+ struct elevator_type *e = NULL;
+ int err;
+
++ /*
++ * q->sysfs_lock must be held to provide mutual exclusion between
++ * elevator_switch() and here.
++ */
++ lockdep_assert_held(&q->sysfs_lock);
++
+ if (unlikely(q->elevator))
+ return 0;
+
--- /dev/null
+From 348cbaa800f8161168b20f85f72abb541c145132 Mon Sep 17 00:00:00 2001
+From: Simon Wood <simon@mungewell.org>
+Date: Thu, 10 Oct 2013 08:20:13 -0600
+Subject: HID: lg: fix Report Descriptor for Logitech MOMO Force (Black)
+
+From: Simon Wood <simon@mungewell.org>
+
+commit 348cbaa800f8161168b20f85f72abb541c145132 upstream.
+
+By default the Logitech MOMO Force (Black) presents a combined accel/brake
+axis ('Y'). This patch modifies the HID descriptor to present seperate
+accel/brake axes ('Y' and 'Z').
+
+Signed-off-by: Simon Wood <simon@mungewell.org>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hid/hid-lg.c | 58 +++++++++++++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 58 insertions(+)
+
+--- a/drivers/hid/hid-lg.c
++++ b/drivers/hid/hid-lg.c
+@@ -47,6 +47,7 @@
+ #define DFP_RDESC_ORIG_SIZE 97
+ #define FV_RDESC_ORIG_SIZE 130
+ #define MOMO_RDESC_ORIG_SIZE 87
++#define MOMO2_RDESC_ORIG_SIZE 87
+
+ /* Fixed report descriptors for Logitech Driving Force (and Pro)
+ * wheel controllers
+@@ -284,6 +285,54 @@ static __u8 momo_rdesc_fixed[] = {
+ 0xC0 /* End Collection */
+ };
+
++static __u8 momo2_rdesc_fixed[] = {
++0x05, 0x01, /* Usage Page (Desktop), */
++0x09, 0x04, /* Usage (Joystik), */
++0xA1, 0x01, /* Collection (Application), */
++0xA1, 0x02, /* Collection (Logical), */
++0x95, 0x01, /* Report Count (1), */
++0x75, 0x0A, /* Report Size (10), */
++0x15, 0x00, /* Logical Minimum (0), */
++0x26, 0xFF, 0x03, /* Logical Maximum (1023), */
++0x35, 0x00, /* Physical Minimum (0), */
++0x46, 0xFF, 0x03, /* Physical Maximum (1023), */
++0x09, 0x30, /* Usage (X), */
++0x81, 0x02, /* Input (Variable), */
++0x95, 0x0A, /* Report Count (10), */
++0x75, 0x01, /* Report Size (1), */
++0x25, 0x01, /* Logical Maximum (1), */
++0x45, 0x01, /* Physical Maximum (1), */
++0x05, 0x09, /* Usage Page (Button), */
++0x19, 0x01, /* Usage Minimum (01h), */
++0x29, 0x0A, /* Usage Maximum (0Ah), */
++0x81, 0x02, /* Input (Variable), */
++0x06, 0x00, 0xFF, /* Usage Page (FF00h), */
++0x09, 0x00, /* Usage (00h), */
++0x95, 0x04, /* Report Count (4), */
++0x81, 0x02, /* Input (Variable), */
++0x95, 0x01, /* Report Count (1), */
++0x75, 0x08, /* Report Size (8), */
++0x26, 0xFF, 0x00, /* Logical Maximum (255), */
++0x46, 0xFF, 0x00, /* Physical Maximum (255), */
++0x09, 0x01, /* Usage (01h), */
++0x81, 0x02, /* Input (Variable), */
++0x05, 0x01, /* Usage Page (Desktop), */
++0x09, 0x31, /* Usage (Y), */
++0x81, 0x02, /* Input (Variable), */
++0x09, 0x32, /* Usage (Z), */
++0x81, 0x02, /* Input (Variable), */
++0x06, 0x00, 0xFF, /* Usage Page (FF00h), */
++0x09, 0x00, /* Usage (00h), */
++0x81, 0x02, /* Input (Variable), */
++0xC0, /* End Collection, */
++0xA1, 0x02, /* Collection (Logical), */
++0x09, 0x02, /* Usage (02h), */
++0x95, 0x07, /* Report Count (7), */
++0x91, 0x02, /* Output (Variable), */
++0xC0, /* End Collection, */
++0xC0 /* End Collection */
++};
++
+ /*
+ * Certain Logitech keyboards send in report #3 keys which are far
+ * above the logical maximum described in descriptor. This extends
+@@ -343,6 +392,15 @@ static __u8 *lg_report_fixup(struct hid_
+ }
+ break;
+
++ case USB_DEVICE_ID_LOGITECH_MOMO_WHEEL2:
++ if (*rsize == MOMO2_RDESC_ORIG_SIZE) {
++ hid_info(hdev,
++ "fixing up Logitech Momo Racing Force (Black) report descriptor\n");
++ rdesc = momo2_rdesc_fixed;
++ *rsize = sizeof(momo2_rdesc_fixed);
++ }
++ break;
++
+ case USB_DEVICE_ID_LOGITECH_VIBRATION_WHEEL:
+ if (*rsize == FV_RDESC_ORIG_SIZE) {
+ hid_info(hdev,
--- /dev/null
+From 05104a4e8713b27291c7bb49c1e7e68b4e243571 Mon Sep 17 00:00:00 2001
+From: Neil Horman <nhorman@tuxdriver.com>
+Date: Fri, 27 Sep 2013 12:53:35 -0400
+Subject: iommu: Remove stack trace from broken irq remapping warning
+
+From: Neil Horman <nhorman@tuxdriver.com>
+
+commit 05104a4e8713b27291c7bb49c1e7e68b4e243571 upstream.
+
+The warning for the irq remapping broken check in intel_irq_remapping.c is
+pretty pointless. We need the warning, but we know where its comming from, the
+stack trace will always be the same, and it needlessly triggers things like
+Abrt. This changes the warning to just print a text warning about BIOS being
+broken, without the stack trace, then sets the appropriate taint bit. Since we
+automatically disable irq remapping, theres no need to contiue making Abrt jump
+at this problem
+
+Signed-off-by: Neil Horman <nhorman@tuxdriver.com>
+CC: Joerg Roedel <joro@8bytes.org>
+CC: Bjorn Helgaas <bhelgaas@google.com>
+CC: Andy Lutomirski <luto@amacapital.net>
+CC: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+CC: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
+Signed-off-by: Joerg Roedel <joro@8bytes.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iommu/intel_irq_remapping.c | 13 +++++++------
+ 1 file changed, 7 insertions(+), 6 deletions(-)
+
+--- a/drivers/iommu/intel_irq_remapping.c
++++ b/drivers/iommu/intel_irq_remapping.c
+@@ -525,12 +525,13 @@ static int __init intel_irq_remapping_su
+ if (disable_irq_remap)
+ return 0;
+ if (irq_remap_broken) {
+- WARN_TAINT(1, TAINT_FIRMWARE_WORKAROUND,
+- "This system BIOS has enabled interrupt remapping\n"
+- "on a chipset that contains an erratum making that\n"
+- "feature unstable. To maintain system stability\n"
+- "interrupt remapping is being disabled. Please\n"
+- "contact your BIOS vendor for an update\n");
++ printk(KERN_WARNING
++ "This system BIOS has enabled interrupt remapping\n"
++ "on a chipset that contains an erratum making that\n"
++ "feature unstable. To maintain system stability\n"
++ "interrupt remapping is being disabled. Please\n"
++ "contact your BIOS vendor for an update\n");
++ add_taint(TAINT_FIRMWARE_WORKAROUND, LOCKDEP_STILL_OK);
+ disable_irq_remap = 1;
+ return 0;
+ }
--- /dev/null
+From f9423606ade08653dd8a43334f0a7fb45504c5cc Mon Sep 17 00:00:00 2001
+From: Julian Stecklina <jsteckli@os.inf.tu-dresden.de>
+Date: Wed, 9 Oct 2013 10:03:52 +0200
+Subject: iommu/vt-d: Fixed interaction of VFIO_IOMMU_MAP_DMA with IOMMU address limits
+
+From: Julian Stecklina <jsteckli@os.inf.tu-dresden.de>
+
+commit f9423606ade08653dd8a43334f0a7fb45504c5cc upstream.
+
+The BUG_ON in drivers/iommu/intel-iommu.c:785 can be triggered from userspace via
+VFIO by calling the VFIO_IOMMU_MAP_DMA ioctl on a vfio device with any address
+beyond the addressing capabilities of the IOMMU. The problem is that the ioctl code
+calls iommu_iova_to_phys before it calls iommu_map. iommu_map handles the case that
+it gets addresses beyond the addressing capabilities of its IOMMU.
+intel_iommu_iova_to_phys does not.
+
+This patch fixes iommu_iova_to_phys to return NULL for addresses beyond what the
+IOMMU can handle. This in turn causes the ioctl call to fail in iommu_map and
+(correctly) return EFAULT to the user with a helpful warning message in the kernel
+log.
+
+Signed-off-by: Julian Stecklina <jsteckli@os.inf.tu-dresden.de>
+Acked-by: Alex Williamson <alex.williamson@redhat.com>
+Signed-off-by: Joerg Roedel <joro@8bytes.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iommu/intel-iommu.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/drivers/iommu/intel-iommu.c
++++ b/drivers/iommu/intel-iommu.c
+@@ -782,7 +782,11 @@ static struct dma_pte *pfn_to_dma_pte(st
+ int offset;
+
+ BUG_ON(!domain->pgd);
+- BUG_ON(addr_width < BITS_PER_LONG && pfn >> addr_width);
++
++ if (addr_width < BITS_PER_LONG && pfn >> addr_width)
++ /* Address beyond IOMMU's addressing capabilities. */
++ return NULL;
++
+ parent = domain->pgd;
+
+ while (level > 0) {
--- /dev/null
+From a97ad0c4b447a132a322cedc3a5f7fa4cab4b304 Mon Sep 17 00:00:00 2001
+From: Miroslav Lichvar <mlichvar@redhat.com>
+Date: Thu, 1 Aug 2013 19:31:35 +0200
+Subject: ntp: Make periodic RTC update more reliable
+
+From: Miroslav Lichvar <mlichvar@redhat.com>
+
+commit a97ad0c4b447a132a322cedc3a5f7fa4cab4b304 upstream.
+
+The current code requires that the scheduled update of the RTC happens
+in the closest tick to the half of the second. This seems to be
+difficult to achieve reliably. The scheduled work may be missing the
+target time by a tick or two and be constantly rescheduled every second.
+
+Relax the limit to 10 ticks. As a typical RTC drifts in the 11-minute
+update interval by several milliseconds, this shouldn't affect the
+overall accuracy of the RTC much.
+
+Signed-off-by: Miroslav Lichvar <mlichvar@redhat.com>
+Signed-off-by: John Stultz <john.stultz@linaro.org>
+Cc: Josh Boyer <jwboyer@fedoraproject.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/time/ntp.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/kernel/time/ntp.c
++++ b/kernel/time/ntp.c
+@@ -475,6 +475,7 @@ static void sync_cmos_clock(struct work_
+ * called as close as possible to 500 ms before the new second starts.
+ * This code is run on a timer. If the clock is set, that timer
+ * may not expire at the correct time. Thus, we adjust...
++ * We want the clock to be within a couple of ticks from the target.
+ */
+ if (!ntp_synced()) {
+ /*
+@@ -485,7 +486,7 @@ static void sync_cmos_clock(struct work_
+ }
+
+ getnstimeofday(&now);
+- if (abs(now.tv_nsec - (NSEC_PER_SEC / 2)) <= tick_nsec / 2) {
++ if (abs(now.tv_nsec - (NSEC_PER_SEC / 2)) <= tick_nsec * 5) {
+ struct timespec adjust = now;
+
+ fail = -ENODEV;
clockevents-split-out-selection-logic.patch
clockevents-prefer-cpu-local-devices-over-global-devices.patch
mm-numa-return-the-number-of-base-pages-altered-by-protection-changes.patch
+video-kyro-fix-incorrect-sizes-when-copying-to-userspace.patch
+hid-lg-fix-report-descriptor-for-logitech-momo-force-black.patch
+iommu-vt-d-fixed-interaction-of-vfio_iommu_map_dma-with-iommu-address-limits.patch
+iommu-remove-stack-trace-from-broken-irq-remapping-warning.patch
+elevator-fix-a-race-in-elevator-switching-and-md-device-initialization.patch
+elevator-acquire-q-sysfs_lock-in-elevator_change.patch
+ntp-make-periodic-rtc-update-more-reliable.patch
--- /dev/null
+From 2ab68ec927310dc488f3403bb48f9e4ad00a9491 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sasha.levin@oracle.com>
+Date: Tue, 19 Nov 2013 14:25:36 -0500
+Subject: video: kyro: fix incorrect sizes when copying to userspace
+
+From: Sasha Levin <sasha.levin@oracle.com>
+
+commit 2ab68ec927310dc488f3403bb48f9e4ad00a9491 upstream.
+
+kyro would copy u32s and specify sizeof(unsigned long) as the size to copy.
+
+This would copy more data than intended and cause memory corruption and might
+leak kernel memory.
+
+Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/video/kyro/fbdev.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/video/kyro/fbdev.c
++++ b/drivers/video/kyro/fbdev.c
+@@ -625,15 +625,15 @@ static int kyrofb_ioctl(struct fb_info *
+ }
+ break;
+ case KYRO_IOCTL_UVSTRIDE:
+- if (copy_to_user(argp, &deviceInfo.ulOverlayUVStride, sizeof(unsigned long)))
++ if (copy_to_user(argp, &deviceInfo.ulOverlayUVStride, sizeof(deviceInfo.ulOverlayUVStride)))
+ return -EFAULT;
+ break;
+ case KYRO_IOCTL_STRIDE:
+- if (copy_to_user(argp, &deviceInfo.ulOverlayStride, sizeof(unsigned long)))
++ if (copy_to_user(argp, &deviceInfo.ulOverlayStride, sizeof(deviceInfo.ulOverlayStride)))
+ return -EFAULT;
+ break;
+ case KYRO_IOCTL_OVERLAY_OFFSET:
+- if (copy_to_user(argp, &deviceInfo.ulOverlayOffset, sizeof(unsigned long)))
++ if (copy_to_user(argp, &deviceInfo.ulOverlayOffset, sizeof(deviceInfo.ulOverlayOffset)))
+ return -EFAULT;
+ break;
+ }
projects / thirdparty / kernel / stable-queue.git / commitdiff
