From: Greg Kroah-Hartman Date: Mon, 23 Sep 2013 22:46:28 +0000 (-0700) Subject: 3.10-stable patches X-Git-Tag: v3.0.97~22 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=7f4388bf195e90efe409c785684e91f8ec1d5764;p=thirdparty%2Fkernel%2Fstable-queue.git 3.10-stable patches added patches: acpi-lpss-don-t-crash-if-a-device-has-no-mmio-resources.patch asoc-mc13783-add-spi-errata-fix.patch asoc-wm8960-fix-pll-register-writes.patch introduce-save_altstack_ex-to-unbreak-x86-smap.patch rculist-list_first_or_null_rcu-should-use-list_entry_rcu.patch sched-x86-optimize-switch_mm-for-multi-threaded-workloads.patch usb-cdc-wdm-fix-race-between-interrupt-handler-and-tasklet.patch usb-config-desc.blength-may-not-exceed-amount-of-data-returned-by-the-device.patch usb-don-t-check-pm-qos-no_power_off-flag-in-usb_port_suspend.patch usb-don-t-fail-port-power-resume-on-device-disconnect.patch usb-ehci-mxc-check-for-pdata-before-dereferencing.patch usb-fix-build-error-when-config_pm_sleep-isn-t-enabled.patch usb-gadget-uvc-fix-error-handling-in-uvc_queue_buffer.patch usb-handle-lpm-errors-during-device-suspend-correctly.patch usb-mos7720-fix-big-endian-control-requests.patch usb-mos7720-use-gfp_atomic-under-spinlock.patch x86-amd_nb-clarify-f15h-model-30h-gart-and-l3-support.patch x86-mce-pay-no-attention-to-f-bit-in-mcacod-when-parsing-uc-errors.patch x86-smap-handle-csum_partial_copy_-_user.patch --- diff --git a/queue-3.10/acpi-lpss-don-t-crash-if-a-device-has-no-mmio-resources.patch b/queue-3.10/acpi-lpss-don-t-crash-if-a-device-has-no-mmio-resources.patch new file mode 100644 index 00000000000..a1435d1e88d --- /dev/null +++ b/queue-3.10/acpi-lpss-don-t-crash-if-a-device-has-no-mmio-resources.patch @@ -0,0 +1,47 @@ +From af65cfe9aeae03e0682bebdf4db94582d75562dd Mon Sep 17 00:00:00 2001 +From: Mika Westerberg +Date: Mon, 2 Sep 2013 13:30:25 +0300 +Subject: ACPI / LPSS: don't crash if a device has no MMIO resources + +From: Mika Westerberg + +commit af65cfe9aeae03e0682bebdf4db94582d75562dd upstream. + +Intel LPSS devices that are enumerated from ACPI have both MMIO and IRQ +resources returned in their _CRS method. However, Apple Macbook Air with +Haswell has LPSS devices enumerated from PCI bus instead and _CRS method +returns only an interrupt number (but the device has _HID set that causes +the scan handler to match it). + +The current ACPI / LPSS code sets pdata->dev_desc only when MMIO resource +is found for the device and in case of Macbook Air it is never found. That +leads to a NULL pointer dereference in register_device_clock(). + +Correct this by always setting the pdata->dev_desc. + +Reported-and-tested-by: Imre Kaloz +Signed-off-by: Mika Westerberg +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/acpi/acpi_lpss.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/acpi/acpi_lpss.c ++++ b/drivers/acpi/acpi_lpss.c +@@ -155,12 +155,13 @@ static int acpi_lpss_create_device(struc + pdata->mmio_size = resource_size(&rentry->res); + pdata->mmio_base = ioremap(rentry->res.start, + pdata->mmio_size); +- pdata->dev_desc = dev_desc; + break; + } + + acpi_dev_free_resource_list(&resource_list); + ++ pdata->dev_desc = dev_desc; ++ + if (dev_desc->clk_required) { + ret = register_device_clock(adev, pdata); + if (ret) { diff --git a/queue-3.10/asoc-mc13783-add-spi-errata-fix.patch b/queue-3.10/asoc-mc13783-add-spi-errata-fix.patch new file mode 100644 index 00000000000..8cd26d0c148 --- /dev/null +++ b/queue-3.10/asoc-mc13783-add-spi-errata-fix.patch @@ -0,0 +1,41 @@ +From 9f6f0afbb9fdabf6dcac642dfec457f28981e3f8 Mon Sep 17 00:00:00 2001 +From: Steffen Trumtrar +Date: Mon, 9 Sep 2013 18:09:12 +0200 +Subject: ASoC: mc13783: add spi errata fix + +From: Steffen Trumtrar + +commit 9f6f0afbb9fdabf6dcac642dfec457f28981e3f8 upstream. + +The MC13783 Chip Errata, Rev. 4 says, that depending on SPI clock +and main audio clock speed, the Audio Codec or Stereo DAC do sometimes +not start when programmed to do so. This is due to an internal clock +timing issue related to the loading of the SPI bits into the audio block. + +On an i.MX27 based system, this issue lead to switched audio channels under +certain circumstances: RTC + Touch + Audio are used and loaded at startup. + +The mentioned workaround of writing registers 40 and 41 two times is implemented +here. + +Signed-off-by: Steffen Trumtrar +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/codecs/mc13783.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/sound/soc/codecs/mc13783.c ++++ b/sound/soc/codecs/mc13783.c +@@ -126,6 +126,10 @@ static int mc13783_write(struct snd_soc_ + + ret = mc13xxx_reg_write(priv->mc13xxx, reg, value); + ++ /* include errata fix for spi audio problems */ ++ if (reg == MC13783_AUDIO_CODEC || reg == MC13783_AUDIO_DAC) ++ ret = mc13xxx_reg_write(priv->mc13xxx, reg, value); ++ + mc13xxx_unlock(priv->mc13xxx); + + return ret; diff --git a/queue-3.10/asoc-wm8960-fix-pll-register-writes.patch b/queue-3.10/asoc-wm8960-fix-pll-register-writes.patch new file mode 100644 index 00000000000..85dbdf2c8cb --- /dev/null +++ b/queue-3.10/asoc-wm8960-fix-pll-register-writes.patch @@ -0,0 +1,35 @@ +From 85fa532b6ef920b32598df86b194571a7059a77c Mon Sep 17 00:00:00 2001 +From: Mike Dyer +Date: Fri, 16 Aug 2013 18:36:28 +0100 +Subject: ASoC: wm8960: Fix PLL register writes + +From: Mike Dyer + +commit 85fa532b6ef920b32598df86b194571a7059a77c upstream. + +Bit 9 of PLL2,3 and 4 is reserved as '0'. The 24bit fractional part +should be split across each register in 8bit chunks. + +Signed-off-by: Mike Dyer +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/codecs/wm8960.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/sound/soc/codecs/wm8960.c ++++ b/sound/soc/codecs/wm8960.c +@@ -857,9 +857,9 @@ static int wm8960_set_dai_pll(struct snd + if (pll_div.k) { + reg |= 0x20; + +- snd_soc_write(codec, WM8960_PLL2, (pll_div.k >> 18) & 0x3f); +- snd_soc_write(codec, WM8960_PLL3, (pll_div.k >> 9) & 0x1ff); +- snd_soc_write(codec, WM8960_PLL4, pll_div.k & 0x1ff); ++ snd_soc_write(codec, WM8960_PLL2, (pll_div.k >> 16) & 0xff); ++ snd_soc_write(codec, WM8960_PLL3, (pll_div.k >> 8) & 0xff); ++ snd_soc_write(codec, WM8960_PLL4, pll_div.k & 0xff); + } + snd_soc_write(codec, WM8960_PLL1, reg); + diff --git a/queue-3.10/introduce-save_altstack_ex-to-unbreak-x86-smap.patch b/queue-3.10/introduce-save_altstack_ex-to-unbreak-x86-smap.patch new file mode 100644 index 00000000000..7a1c2b2f080 --- /dev/null +++ b/queue-3.10/introduce-save_altstack_ex-to-unbreak-x86-smap.patch @@ -0,0 +1,107 @@ +From bd1c149aa9915b9abb6d83d0f01dfd2ace0680b5 Mon Sep 17 00:00:00 2001 +From: Al Viro +Date: Sun, 1 Sep 2013 20:35:01 +0100 +Subject: Introduce [compat_]save_altstack_ex() to unbreak x86 SMAP + +From: Al Viro + +commit bd1c149aa9915b9abb6d83d0f01dfd2ace0680b5 upstream. + +For performance reasons, when SMAP is in use, SMAP is left open for an +entire put_user_try { ... } put_user_catch(); block, however, calling +__put_user() in the middle of that block will close SMAP as the +STAC..CLAC constructs intentionally do not nest. + +Furthermore, using __put_user() rather than put_user_ex() here is bad +for performance. + +Thus, introduce new [compat_]save_altstack_ex() helpers that replace +__[compat_]save_altstack() for x86, being currently the only +architecture which supports put_user_try { ... } put_user_catch(). + +Reported-by: H. Peter Anvin +Signed-off-by: Al Viro +Signed-off-by: H. Peter Anvin +Link: http://lkml.kernel.org/n/tip-es5p6y64if71k8p5u08agv9n@git.kernel.org +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/ia32/ia32_signal.c | 2 +- + arch/x86/kernel/signal.c | 6 +++--- + include/linux/compat.h | 7 +++++++ + include/linux/signal.h | 8 ++++++++ + 4 files changed, 19 insertions(+), 4 deletions(-) + +--- a/arch/x86/ia32/ia32_signal.c ++++ b/arch/x86/ia32/ia32_signal.c +@@ -459,7 +459,7 @@ int ia32_setup_rt_frame(int sig, struct + else + put_user_ex(0, &frame->uc.uc_flags); + put_user_ex(0, &frame->uc.uc_link); +- err |= __compat_save_altstack(&frame->uc.uc_stack, regs->sp); ++ compat_save_altstack_ex(&frame->uc.uc_stack, regs->sp); + + if (ksig->ka.sa.sa_flags & SA_RESTORER) + restorer = ksig->ka.sa.sa_restorer; +--- a/arch/x86/kernel/signal.c ++++ b/arch/x86/kernel/signal.c +@@ -364,7 +364,7 @@ static int __setup_rt_frame(int sig, str + else + put_user_ex(0, &frame->uc.uc_flags); + put_user_ex(0, &frame->uc.uc_link); +- err |= __save_altstack(&frame->uc.uc_stack, regs->sp); ++ save_altstack_ex(&frame->uc.uc_stack, regs->sp); + + /* Set up to return from userspace. */ + restorer = VDSO32_SYMBOL(current->mm->context.vdso, rt_sigreturn); +@@ -429,7 +429,7 @@ static int __setup_rt_frame(int sig, str + else + put_user_ex(0, &frame->uc.uc_flags); + put_user_ex(0, &frame->uc.uc_link); +- err |= __save_altstack(&frame->uc.uc_stack, regs->sp); ++ save_altstack_ex(&frame->uc.uc_stack, regs->sp); + + /* Set up to return from userspace. If provided, use a stub + already in userspace. */ +@@ -496,7 +496,7 @@ static int x32_setup_rt_frame(struct ksi + else + put_user_ex(0, &frame->uc.uc_flags); + put_user_ex(0, &frame->uc.uc_link); +- err |= __compat_save_altstack(&frame->uc.uc_stack, regs->sp); ++ compat_save_altstack_ex(&frame->uc.uc_stack, regs->sp); + put_user_ex(0, &frame->uc.uc__pad0); + + if (ksig->ka.sa.sa_flags & SA_RESTORER) { +--- a/include/linux/compat.h ++++ b/include/linux/compat.h +@@ -669,6 +669,13 @@ asmlinkage long compat_sys_sigaltstack(c + + int compat_restore_altstack(const compat_stack_t __user *uss); + int __compat_save_altstack(compat_stack_t __user *, unsigned long); ++#define compat_save_altstack_ex(uss, sp) do { \ ++ compat_stack_t __user *__uss = uss; \ ++ struct task_struct *t = current; \ ++ put_user_ex(ptr_to_compat((void __user *)t->sas_ss_sp), &__uss->ss_sp); \ ++ put_user_ex(sas_ss_flags(sp), &__uss->ss_flags); \ ++ put_user_ex(t->sas_ss_size, &__uss->ss_size); \ ++} while (0); + + asmlinkage long compat_sys_sched_rr_get_interval(compat_pid_t pid, + struct compat_timespec __user *interval); +--- a/include/linux/signal.h ++++ b/include/linux/signal.h +@@ -434,6 +434,14 @@ void signals_init(void); + int restore_altstack(const stack_t __user *); + int __save_altstack(stack_t __user *, unsigned long); + ++#define save_altstack_ex(uss, sp) do { \ ++ stack_t __user *__uss = uss; \ ++ struct task_struct *t = current; \ ++ put_user_ex((void __user *)t->sas_ss_sp, &__uss->ss_sp); \ ++ put_user_ex(sas_ss_flags(sp), &__uss->ss_flags); \ ++ put_user_ex(t->sas_ss_size, &__uss->ss_size); \ ++} while (0); ++ + #ifdef CONFIG_PROC_FS + struct seq_file; + extern void render_sigset_t(struct seq_file *, const char *, sigset_t *); diff --git a/queue-3.10/rculist-list_first_or_null_rcu-should-use-list_entry_rcu.patch b/queue-3.10/rculist-list_first_or_null_rcu-should-use-list_entry_rcu.patch new file mode 100644 index 00000000000..fc85e3fd14c --- /dev/null +++ b/queue-3.10/rculist-list_first_or_null_rcu-should-use-list_entry_rcu.patch @@ -0,0 +1,68 @@ +From c34ac00caefbe49d40058ae7200bd58725cebb45 Mon Sep 17 00:00:00 2001 +From: Tejun Heo +Date: Fri, 28 Jun 2013 10:34:48 -0700 +Subject: rculist: list_first_or_null_rcu() should use list_entry_rcu() + +From: Tejun Heo + +commit c34ac00caefbe49d40058ae7200bd58725cebb45 upstream. + +list_first_or_null() should test whether the list is empty and return +pointer to the first entry if not in a RCU safe manner. It's broken +in several ways. + +* It compares __kernel @__ptr with __rcu @__next triggering the + following sparse warning. + + net/core/dev.c:4331:17: error: incompatible types in comparison expression (different address spaces) + +* It doesn't perform rcu_dereference*() and computes the entry address + using container_of() directly from the __rcu pointer which is + inconsitent with other rculist interface. As a result, all three + in-kernel users - net/core/dev.c, macvlan, cgroup - are buggy. They + dereference the pointer w/o going through read barrier. + +* While ->next dereference passes through list_next_rcu(), the + compiler is still free to fetch ->next more than once and thus + nullify the "__ptr != __next" condition check. + +Fix it by making list_first_or_null_rcu() dereference ->next directly +using ACCESS_ONCE() and then use list_entry_rcu() on it like other +rculist accessors. + +v2: Paul pointed out that the compiler may fetch the pointer more than + once nullifying the condition check. ACCESS_ONCE() added on + ->next dereference. + +v3: Restored () around macro param which was accidentally removed. + Spotted by Paul. + +Signed-off-by: Tejun Heo +Reported-by: Fengguang Wu +Cc: Dipankar Sarma +Cc: "Paul E. McKenney" +Cc: "David S. Miller" +Cc: Li Zefan +Cc: Patrick McHardy +Signed-off-by: Paul E. McKenney +Reviewed-by: Josh Triplett +Signed-off-by: Greg Kroah-Hartman + +--- + include/linux/rculist.h | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/include/linux/rculist.h ++++ b/include/linux/rculist.h +@@ -267,8 +267,9 @@ static inline void list_splice_init_rcu( + */ + #define list_first_or_null_rcu(ptr, type, member) \ + ({struct list_head *__ptr = (ptr); \ +- struct list_head __rcu *__next = list_next_rcu(__ptr); \ +- likely(__ptr != __next) ? container_of(__next, type, member) : NULL; \ ++ struct list_head *__next = ACCESS_ONCE(__ptr->next); \ ++ likely(__ptr != __next) ? \ ++ list_entry_rcu(__next, type, member) : NULL; \ + }) + + /** diff --git a/queue-3.10/sched-x86-optimize-switch_mm-for-multi-threaded-workloads.patch b/queue-3.10/sched-x86-optimize-switch_mm-for-multi-threaded-workloads.patch new file mode 100644 index 00000000000..2c3d55db02c --- /dev/null +++ b/queue-3.10/sched-x86-optimize-switch_mm-for-multi-threaded-workloads.patch @@ -0,0 +1,90 @@ +From 8f898fbbe5ee5e20a77c4074472a1fd088dc47d1 Mon Sep 17 00:00:00 2001 +From: Rik van Riel +Date: Wed, 31 Jul 2013 22:14:21 -0400 +Subject: sched/x86: Optimize switch_mm() for multi-threaded workloads + +From: Rik van Riel + +commit 8f898fbbe5ee5e20a77c4074472a1fd088dc47d1 upstream. + +Dick Fowles, Don Zickus and Joe Mario have been working on +improvements to perf, and noticed heavy cache line contention +on the mm_cpumask, running linpack on a 60 core / 120 thread +system. + +The cause turned out to be unnecessary atomic accesses to the +mm_cpumask. When in lazy TLB mode, the CPU is only removed from +the mm_cpumask if there is a TLB flush event. + +Most of the time, no such TLB flush happens, and the kernel +skips the TLB reload. It can also skip the atomic memory +set & test. + +Here is a summary of Joe's test results: + + * The __schedule function dropped from 24% of all program cycles down + to 5.5%. + + * The cacheline contention/hotness for accesses to that bitmask went + from being the 1st/2nd hottest - down to the 84th hottest (0.3% of + all shared misses which is now quite cold) + + * The average load latency for the bit-test-n-set instruction in + __schedule dropped from 10k-15k cycles down to an average of 600 cycles. + + * The linpack program results improved from 133 GFlops to 144 GFlops. + Peak GFlops rose from 133 to 153. + +Reported-by: Don Zickus +Reported-by: Joe Mario +Tested-by: Joe Mario +Signed-off-by: Rik van Riel +Reviewed-by: Paul Turner +Acked-by: Linus Torvalds +Link: http://lkml.kernel.org/r/20130731221421.616d3d20@annuminas.surriel.com +[ Made the comments consistent around the modified code. ] +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/include/asm/mmu_context.h | 20 +++++++++++++------- + 1 file changed, 13 insertions(+), 7 deletions(-) + +--- a/arch/x86/include/asm/mmu_context.h ++++ b/arch/x86/include/asm/mmu_context.h +@@ -45,22 +45,28 @@ static inline void switch_mm(struct mm_s + /* Re-load page tables */ + load_cr3(next->pgd); + +- /* stop flush ipis for the previous mm */ ++ /* Stop flush ipis for the previous mm */ + cpumask_clear_cpu(cpu, mm_cpumask(prev)); + +- /* +- * load the LDT, if the LDT is different: +- */ ++ /* Load the LDT, if the LDT is different: */ + if (unlikely(prev->context.ldt != next->context.ldt)) + load_LDT_nolock(&next->context); + } + #ifdef CONFIG_SMP +- else { ++ else { + this_cpu_write(cpu_tlbstate.state, TLBSTATE_OK); + BUG_ON(this_cpu_read(cpu_tlbstate.active_mm) != next); + +- if (!cpumask_test_and_set_cpu(cpu, mm_cpumask(next))) { +- /* We were in lazy tlb mode and leave_mm disabled ++ if (!cpumask_test_cpu(cpu, mm_cpumask(next))) { ++ /* ++ * On established mms, the mm_cpumask is only changed ++ * from irq context, from ptep_clear_flush() while in ++ * lazy tlb mode, and here. Irqs are blocked during ++ * schedule, protecting us from simultaneous changes. ++ */ ++ cpumask_set_cpu(cpu, mm_cpumask(next)); ++ /* ++ * We were in lazy tlb mode and leave_mm disabled + * tlb flush IPI delivery. We must reload CR3 + * to make sure to use no freed page tables. + */ diff --git a/queue-3.10/series b/queue-3.10/series index f1e046fc246..2d36ab67657 100644 --- a/queue-3.10/series +++ b/queue-3.10/series @@ -30,3 +30,22 @@ net-check-the-correct-namespace-when-spoofing-pid-over-scm_rights.patch staging-comedi-dt282x-dt282x_ai_insn_read-always-fails.patch iio-mxs-lradc-fix-misuse-of-iio-trig.patch iio-mxs-lradc-remove-useless-check-in-read_raw.patch +acpi-lpss-don-t-crash-if-a-device-has-no-mmio-resources.patch +usb-mos7720-use-gfp_atomic-under-spinlock.patch +usb-mos7720-fix-big-endian-control-requests.patch +usb-ehci-mxc-check-for-pdata-before-dereferencing.patch +usb-cdc-wdm-fix-race-between-interrupt-handler-and-tasklet.patch +usb-gadget-uvc-fix-error-handling-in-uvc_queue_buffer.patch +usb-don-t-fail-port-power-resume-on-device-disconnect.patch +usb-fix-build-error-when-config_pm_sleep-isn-t-enabled.patch +usb-config-desc.blength-may-not-exceed-amount-of-data-returned-by-the-device.patch +usb-handle-lpm-errors-during-device-suspend-correctly.patch +usb-don-t-check-pm-qos-no_power_off-flag-in-usb_port_suspend.patch +rculist-list_first_or_null_rcu-should-use-list_entry_rcu.patch +asoc-wm8960-fix-pll-register-writes.patch +asoc-mc13783-add-spi-errata-fix.patch +x86-smap-handle-csum_partial_copy_-_user.patch +introduce-save_altstack_ex-to-unbreak-x86-smap.patch +x86-amd_nb-clarify-f15h-model-30h-gart-and-l3-support.patch +x86-mce-pay-no-attention-to-f-bit-in-mcacod-when-parsing-uc-errors.patch +sched-x86-optimize-switch_mm-for-multi-threaded-workloads.patch diff --git a/queue-3.10/usb-cdc-wdm-fix-race-between-interrupt-handler-and-tasklet.patch b/queue-3.10/usb-cdc-wdm-fix-race-between-interrupt-handler-and-tasklet.patch new file mode 100644 index 00000000000..6f6ee21f630 --- /dev/null +++ b/queue-3.10/usb-cdc-wdm-fix-race-between-interrupt-handler-and-tasklet.patch @@ -0,0 +1,63 @@ +From 6dd433e6cf2475ce8abec1b467720858c24450eb Mon Sep 17 00:00:00 2001 +From: Oliver Neukum +Date: Tue, 6 Aug 2013 14:22:59 +0200 +Subject: USB: cdc-wdm: fix race between interrupt handler and tasklet + +From: Oliver Neukum + +commit 6dd433e6cf2475ce8abec1b467720858c24450eb upstream. + +Both could want to submit the same URB. Some checks of the flag +intended to prevent that were missing. + +Signed-off-by: Oliver Neukum +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/class/cdc-wdm.c | 13 +++++++++---- + 1 file changed, 9 insertions(+), 4 deletions(-) + +--- a/drivers/usb/class/cdc-wdm.c ++++ b/drivers/usb/class/cdc-wdm.c +@@ -209,6 +209,7 @@ skip_error: + static void wdm_int_callback(struct urb *urb) + { + int rv = 0; ++ int responding; + int status = urb->status; + struct wdm_device *desc; + struct usb_cdc_notification *dr; +@@ -262,8 +263,8 @@ static void wdm_int_callback(struct urb + + spin_lock(&desc->iuspin); + clear_bit(WDM_READ, &desc->flags); +- set_bit(WDM_RESPONDING, &desc->flags); +- if (!test_bit(WDM_DISCONNECTING, &desc->flags) ++ responding = test_and_set_bit(WDM_RESPONDING, &desc->flags); ++ if (!responding && !test_bit(WDM_DISCONNECTING, &desc->flags) + && !test_bit(WDM_SUSPENDING, &desc->flags)) { + rv = usb_submit_urb(desc->response, GFP_ATOMIC); + dev_dbg(&desc->intf->dev, "%s: usb_submit_urb %d", +@@ -685,16 +686,20 @@ static void wdm_rxwork(struct work_struc + { + struct wdm_device *desc = container_of(work, struct wdm_device, rxwork); + unsigned long flags; +- int rv; ++ int rv = 0; ++ int responding; + + spin_lock_irqsave(&desc->iuspin, flags); + if (test_bit(WDM_DISCONNECTING, &desc->flags)) { + spin_unlock_irqrestore(&desc->iuspin, flags); + } else { ++ responding = test_and_set_bit(WDM_RESPONDING, &desc->flags); + spin_unlock_irqrestore(&desc->iuspin, flags); +- rv = usb_submit_urb(desc->response, GFP_KERNEL); ++ if (!responding) ++ rv = usb_submit_urb(desc->response, GFP_KERNEL); + if (rv < 0 && rv != -EPERM) { + spin_lock_irqsave(&desc->iuspin, flags); ++ clear_bit(WDM_RESPONDING, &desc->flags); + if (!test_bit(WDM_DISCONNECTING, &desc->flags)) + schedule_work(&desc->rxwork); + spin_unlock_irqrestore(&desc->iuspin, flags); diff --git a/queue-3.10/usb-config-desc.blength-may-not-exceed-amount-of-data-returned-by-the-device.patch b/queue-3.10/usb-config-desc.blength-may-not-exceed-amount-of-data-returned-by-the-device.patch new file mode 100644 index 00000000000..9156194eb0c --- /dev/null +++ b/queue-3.10/usb-config-desc.blength-may-not-exceed-amount-of-data-returned-by-the-device.patch @@ -0,0 +1,33 @@ +From b4f17a488ae2e09bfcf95c0e0b4219c246f1116a Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Sat, 3 Aug 2013 16:37:48 +0200 +Subject: usb: config->desc.bLength may not exceed amount of data returned by the device + +From: Hans de Goede + +commit b4f17a488ae2e09bfcf95c0e0b4219c246f1116a upstream. + +While reading the config parsing code I noticed this check is missing, without +this check config->desc.wTotalLength can end up with a value larger then the +dev->rawdescriptors length for the config, and when userspace then tries to +get the rawdescriptors bad things may happen. + +Signed-off-by: Hans de Goede +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/config.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/usb/core/config.c ++++ b/drivers/usb/core/config.c +@@ -424,7 +424,8 @@ static int usb_parse_configuration(struc + + memcpy(&config->desc, buffer, USB_DT_CONFIG_SIZE); + if (config->desc.bDescriptorType != USB_DT_CONFIG || +- config->desc.bLength < USB_DT_CONFIG_SIZE) { ++ config->desc.bLength < USB_DT_CONFIG_SIZE || ++ config->desc.bLength > size) { + dev_err(ddev, "invalid descriptor for config index %d: " + "type = 0x%X, length = %d\n", cfgidx, + config->desc.bDescriptorType, config->desc.bLength); diff --git a/queue-3.10/usb-don-t-check-pm-qos-no_power_off-flag-in-usb_port_suspend.patch b/queue-3.10/usb-don-t-check-pm-qos-no_power_off-flag-in-usb_port_suspend.patch new file mode 100644 index 00000000000..a27f034c904 --- /dev/null +++ b/queue-3.10/usb-don-t-check-pm-qos-no_power_off-flag-in-usb_port_suspend.patch @@ -0,0 +1,53 @@ +From 98a4f1ff7bea8002ab79d6776e30d27932e88244 Mon Sep 17 00:00:00 2001 +From: Lan Tianyu +Date: Wed, 3 Jul 2013 22:17:54 +0800 +Subject: usb: don't check pm qos NO_POWER_OFF flag in usb_port_suspend() + +From: Lan Tianyu + +commit 98a4f1ff7bea8002ab79d6776e30d27932e88244 upstream. + +The pm qos NO_POWER_OFF flag is checked twice during usb device suspend +to see if the usb port power off condition is met. This is redundant and +also will prevent the port from being powered off if the NO_POWER_OFF +flag is changed to 1 from 0 after the device was already suspended. + +More detail in the following link. + http://marc.info/?l=linux-usb&m=136543949130865&w=2 + +This patch should be backported to kernels as old as 3.7, that +contain the commit f7ac7787ad361e31a7972e2854ed8dc2eedfac3b "usb/acpi: +Use ACPI methods to power off ports." + +Signed-off-by: Lan Tianyu +Signed-off-by: Sarah Sharp +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/hub.c | 14 ++------------ + 1 file changed, 2 insertions(+), 12 deletions(-) + +--- a/drivers/usb/core/hub.c ++++ b/drivers/usb/core/hub.c +@@ -3041,19 +3041,9 @@ int usb_port_suspend(struct usb_device * + usb_set_device_state(udev, USB_STATE_SUSPENDED); + } + +- /* +- * Check whether current status meets the requirement of +- * usb port power off mechanism +- */ + if (status == 0 && !udev->do_remote_wakeup && udev->persist_enabled) { +- enum pm_qos_flags_status pm_qos_stat; +- +- pm_qos_stat = dev_pm_qos_flags(&port_dev->dev, +- PM_QOS_FLAG_NO_POWER_OFF); +- if (pm_qos_stat != PM_QOS_FLAGS_ALL) { +- pm_runtime_put_sync(&port_dev->dev); +- port_dev->did_runtime_put = true; +- } ++ pm_runtime_put_sync(&port_dev->dev); ++ port_dev->did_runtime_put = true; + } + + usb_mark_last_busy(hub->hdev); diff --git a/queue-3.10/usb-don-t-fail-port-power-resume-on-device-disconnect.patch b/queue-3.10/usb-don-t-fail-port-power-resume-on-device-disconnect.patch new file mode 100644 index 00000000000..20b7c1345f3 --- /dev/null +++ b/queue-3.10/usb-don-t-fail-port-power-resume-on-device-disconnect.patch @@ -0,0 +1,74 @@ +From d49dad3e11638f66be4e16573ffaa8c46a09e3b3 Mon Sep 17 00:00:00 2001 +From: Sarah Sharp +Date: Mon, 5 Aug 2013 18:58:15 -0700 +Subject: usb: Don't fail port power resume on device disconnect. + +From: Sarah Sharp + +commit d49dad3e11638f66be4e16573ffaa8c46a09e3b3 upstream. + +Userspace can tell the kernel to power off any USB port, including ones +that are visible and connectible to users. When an attached USB device +goes into suspend, the port will be powered off if the +pm_qos_no_port_poweroff file for its port is set to 0, the device does +not have remote wakeup enabled, and the device is marked as persistent. + +If the user disconnects the USB device while the port is powered off, +the current code does not handle that properly. If you disconnect a +device, and then run `lsusb -v -s` for the device, the device disconnect +does not get handled by the USB core. The runtime resume of the port +fails, because hub_port_debounce_be_connected() returns -ETIMEDOUT. + +This means the port resume fails and khubd doesn't handle the USB device +disconnect. This leaves the device listed in lsusb, and the port's +runtime_status will be permanently marked as "error". + +Fix this by ignoring the return value of hub_port_debounce_be_connected. +Users can disconnect USB devices while the ports are powered off, and we +must be able to handle that. + +This patch should be backported to kernels as old as 3.9, that +contain the commit ad493e5e580546e6c3024b76a41535476da1546a "usb: add +usb port auto power off mechanism" + +Signed-off-by: Sarah Sharp +Cc: Lan Tianyu +Cc: Alan Stern +Cc: Rafael J. Wysocki +Signed-off-by: Sarah Sharp +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/port.c | 13 +++++-------- + 1 file changed, 5 insertions(+), 8 deletions(-) + +--- a/drivers/usb/core/port.c ++++ b/drivers/usb/core/port.c +@@ -89,22 +89,19 @@ static int usb_port_runtime_resume(struc + retval = usb_hub_set_port_power(hdev, port1, true); + if (port_dev->child && !retval) { + /* +- * Wait for usb hub port to be reconnected in order to make +- * the resume procedure successful. ++ * Attempt to wait for usb hub port to be reconnected in order ++ * to make the resume procedure successful. The device may have ++ * disconnected while the port was powered off, so ignore the ++ * return status. + */ + retval = hub_port_debounce_be_connected(hub, port1); +- if (retval < 0) { ++ if (retval < 0) + dev_dbg(&port_dev->dev, "can't get reconnection after setting port power on, status %d\n", + retval); +- goto out; +- } + usb_clear_port_feature(hdev, port1, USB_PORT_FEAT_C_ENABLE); +- +- /* Set return value to 0 if debounce successful */ + retval = 0; + } + +-out: + clear_bit(port1, hub->busy_bits); + usb_autopm_put_interface(intf); + return retval; diff --git a/queue-3.10/usb-ehci-mxc-check-for-pdata-before-dereferencing.patch b/queue-3.10/usb-ehci-mxc-check-for-pdata-before-dereferencing.patch new file mode 100644 index 00000000000..6f6ede443f2 --- /dev/null +++ b/queue-3.10/usb-ehci-mxc-check-for-pdata-before-dereferencing.patch @@ -0,0 +1,34 @@ +From f375fc520d4df0cd9fcb570f33c103c6c0311f9e Mon Sep 17 00:00:00 2001 +From: Daniel Mack +Date: Wed, 21 Aug 2013 11:17:21 +0200 +Subject: usb: ehci-mxc: check for pdata before dereferencing + +From: Daniel Mack + +commit f375fc520d4df0cd9fcb570f33c103c6c0311f9e upstream. + +Commit 7e8d5cd93fac ("USB: Add EHCI support for MX27 and MX31 based +boards") introduced code that could potentially lead to a NULL pointer +dereference on driver removal. + +Fix this by checking for the value of pdata before dereferencing it. + +Signed-off-by: Daniel Mack +Reported-by: Dan Carpenter +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/ehci-mxc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/host/ehci-mxc.c ++++ b/drivers/usb/host/ehci-mxc.c +@@ -184,7 +184,7 @@ static int ehci_mxc_drv_remove(struct pl + if (pdata && pdata->exit) + pdata->exit(pdev); + +- if (pdata->otg) ++ if (pdata && pdata->otg) + usb_phy_shutdown(pdata->otg); + + clk_disable_unprepare(priv->usbclk); diff --git a/queue-3.10/usb-fix-build-error-when-config_pm_sleep-isn-t-enabled.patch b/queue-3.10/usb-fix-build-error-when-config_pm_sleep-isn-t-enabled.patch new file mode 100644 index 00000000000..c2cb14b06ad --- /dev/null +++ b/queue-3.10/usb-fix-build-error-when-config_pm_sleep-isn-t-enabled.patch @@ -0,0 +1,38 @@ +From 9d8924297cd9c256c23c02abae40202563452453 Mon Sep 17 00:00:00 2001 +From: Alan Stern +Date: Fri, 30 Aug 2013 10:46:00 -0400 +Subject: USB: fix build error when CONFIG_PM_SLEEP isn't enabled + +From: Alan Stern + +commit 9d8924297cd9c256c23c02abae40202563452453 upstream. + +This patch fixes a build error that occurs when CONFIG_PM is enabled +and CONFIG_PM_SLEEP isn't: + +>> drivers/usb/host/ohci-pci.c:294:10: error: 'usb_hcd_pci_pm_ops' undeclared here (not in a function) + .pm = &usb_hcd_pci_pm_ops + +Since the usb_hcd_pci_pm_ops structure is defined and used when +CONFIG_PM is enabled, its declaration should not be protected by +CONFIG_PM_SLEEP. + +Signed-off-by: Alan Stern +Reported-by: kbuild test robot +Signed-off-by: Greg Kroah-Hartman + +--- + include/linux/usb/hcd.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/include/linux/usb/hcd.h ++++ b/include/linux/usb/hcd.h +@@ -410,7 +410,7 @@ extern int usb_hcd_pci_probe(struct pci_ + extern void usb_hcd_pci_remove(struct pci_dev *dev); + extern void usb_hcd_pci_shutdown(struct pci_dev *dev); + +-#ifdef CONFIG_PM_SLEEP ++#ifdef CONFIG_PM + extern const struct dev_pm_ops usb_hcd_pci_pm_ops; + #endif + #endif /* CONFIG_PCI */ diff --git a/queue-3.10/usb-gadget-uvc-fix-error-handling-in-uvc_queue_buffer.patch b/queue-3.10/usb-gadget-uvc-fix-error-handling-in-uvc_queue_buffer.patch new file mode 100644 index 00000000000..6f6adf0d18d --- /dev/null +++ b/queue-3.10/usb-gadget-uvc-fix-error-handling-in-uvc_queue_buffer.patch @@ -0,0 +1,42 @@ +From ebe864a6cb8e087ede047fa1fa6b6d06fcb9a9e4 Mon Sep 17 00:00:00 2001 +From: Laurent Pinchart +Date: Mon, 29 Apr 2013 22:18:01 +0200 +Subject: usb: gadget: uvc: Fix error handling in uvc_queue_buffer() + +From: Laurent Pinchart + +commit ebe864a6cb8e087ede047fa1fa6b6d06fcb9a9e4 upstream. + +The conversion to videobuf2 failed to check the return value of +vb2_qbuf(). Fix it. + +Reported-by: Michael Grzeschik +Signed-off-by: Laurent Pinchart +Tested-By: Michael Grzeschik +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/gadget/uvc_queue.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/drivers/usb/gadget/uvc_queue.c ++++ b/drivers/usb/gadget/uvc_queue.c +@@ -177,12 +177,16 @@ static int uvc_queue_buffer(struct uvc_v + + mutex_lock(&queue->mutex); + ret = vb2_qbuf(&queue->queue, buf); ++ if (ret < 0) ++ goto done; ++ + spin_lock_irqsave(&queue->irqlock, flags); + ret = (queue->flags & UVC_QUEUE_PAUSED) != 0; + queue->flags &= ~UVC_QUEUE_PAUSED; + spin_unlock_irqrestore(&queue->irqlock, flags); +- mutex_unlock(&queue->mutex); + ++done: ++ mutex_unlock(&queue->mutex); + return ret; + } + diff --git a/queue-3.10/usb-handle-lpm-errors-during-device-suspend-correctly.patch b/queue-3.10/usb-handle-lpm-errors-during-device-suspend-correctly.patch new file mode 100644 index 00000000000..eb5ef042830 --- /dev/null +++ b/queue-3.10/usb-handle-lpm-errors-during-device-suspend-correctly.patch @@ -0,0 +1,150 @@ +From aa5ceae24bf8dff1d6fe87c6c4b08e69c6d33550 Mon Sep 17 00:00:00 2001 +From: Alan Stern +Date: Tue, 30 Jul 2013 15:39:02 -0400 +Subject: USB: handle LPM errors during device suspend correctly + +From: Alan Stern + +commit aa5ceae24bf8dff1d6fe87c6c4b08e69c6d33550 upstream. + +The hub driver's usb_port_suspend() routine doesn't handle errors +related to Link Power Management properly. It always returns failure, +it doesn't try to clean up the wakeup setting, (in the case of system +sleep) it doesn't try to go ahead with the port suspend regardless, +and it doesn't try to apply the new power-off mechanism. + +This patch fixes these problems. + +Note: Sarah fixed this patch to apply against 3.11, since the original +commit (4fae6f0fa86f92e6bc7429371b1e177ad0aaac66 "USB: handle LPM errors +during device suspend correctly") called usb_disable_remote_wakeup, +which won't be added until 3.12. + +This patch should be backported to kernels as old as 3.5, that +contain the commit 8306095fd2c1100e8244c09bf560f97aca5a311d "USB: +Disable USB 3.0 LPM in critical sections.". There will be merge +conflicts, since LTM wasn't added until 3.6. + +Signed-off-by: Alan Stern +Signed-off-by: Sarah Sharp +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/hub.c | 71 ++++++++++++++++++++++++++----------------------- + 1 file changed, 38 insertions(+), 33 deletions(-) + +--- a/drivers/usb/core/hub.c ++++ b/drivers/usb/core/hub.c +@@ -2916,7 +2916,6 @@ int usb_port_suspend(struct usb_device * + { + struct usb_hub *hub = usb_hub_to_struct_hub(udev->parent); + struct usb_port *port_dev = hub->ports[udev->portnum - 1]; +- enum pm_qos_flags_status pm_qos_stat; + int port1 = udev->portnum; + int status; + bool really_suspend = true; +@@ -2954,7 +2953,7 @@ int usb_port_suspend(struct usb_device * + status); + /* bail if autosuspend is requested */ + if (PMSG_IS_AUTO(msg)) +- return status; ++ goto err_wakeup; + } + } + +@@ -2963,14 +2962,16 @@ int usb_port_suspend(struct usb_device * + usb_set_usb2_hardware_lpm(udev, 0); + + if (usb_disable_ltm(udev)) { +- dev_err(&udev->dev, "%s Failed to disable LTM before suspend\n.", +- __func__); +- return -ENOMEM; ++ dev_err(&udev->dev, "Failed to disable LTM before suspend\n."); ++ status = -ENOMEM; ++ if (PMSG_IS_AUTO(msg)) ++ goto err_ltm; + } + if (usb_unlocked_disable_lpm(udev)) { +- dev_err(&udev->dev, "%s Failed to disable LPM before suspend\n.", +- __func__); +- return -ENOMEM; ++ dev_err(&udev->dev, "Failed to disable LPM before suspend\n."); ++ status = -ENOMEM; ++ if (PMSG_IS_AUTO(msg)) ++ goto err_lpm3; + } + + /* see 7.1.7.6 */ +@@ -2998,28 +2999,31 @@ int usb_port_suspend(struct usb_device * + if (status) { + dev_dbg(hub->intfdev, "can't suspend port %d, status %d\n", + port1, status); +- /* paranoia: "should not happen" */ +- if (udev->do_remote_wakeup) { +- if (!hub_is_superspeed(hub->hdev)) { +- (void) usb_control_msg(udev, +- usb_sndctrlpipe(udev, 0), +- USB_REQ_CLEAR_FEATURE, +- USB_RECIP_DEVICE, +- USB_DEVICE_REMOTE_WAKEUP, 0, +- NULL, 0, +- USB_CTRL_SET_TIMEOUT); +- } else +- (void) usb_disable_function_remotewakeup(udev); +- +- } + ++ /* Try to enable USB3 LPM and LTM again */ ++ usb_unlocked_enable_lpm(udev); ++ err_lpm3: ++ usb_enable_ltm(udev); ++ err_ltm: + /* Try to enable USB2 hardware LPM again */ + if (udev->usb2_hw_lpm_capable == 1) + usb_set_usb2_hardware_lpm(udev, 1); + +- /* Try to enable USB3 LTM and LPM again */ +- usb_enable_ltm(udev); +- usb_unlocked_enable_lpm(udev); ++ if (udev->do_remote_wakeup) { ++ if (udev->speed < USB_SPEED_SUPER) ++ usb_control_msg(udev, usb_sndctrlpipe(udev, 0), ++ USB_REQ_CLEAR_FEATURE, ++ USB_RECIP_DEVICE, ++ USB_DEVICE_REMOTE_WAKEUP, 0, ++ NULL, 0, USB_CTRL_SET_TIMEOUT); ++ else ++ usb_control_msg(udev, usb_sndctrlpipe(udev, 0), ++ USB_REQ_CLEAR_FEATURE, ++ USB_RECIP_INTERFACE, ++ USB_INTRF_FUNC_SUSPEND, 0, ++ NULL, 0, USB_CTRL_SET_TIMEOUT); ++ } ++ err_wakeup: + + /* System sleep transitions should never fail */ + if (!PMSG_IS_AUTO(msg)) +@@ -3041,14 +3045,15 @@ int usb_port_suspend(struct usb_device * + * Check whether current status meets the requirement of + * usb port power off mechanism + */ +- pm_qos_stat = dev_pm_qos_flags(&port_dev->dev, +- PM_QOS_FLAG_NO_POWER_OFF); +- if (!udev->do_remote_wakeup +- && pm_qos_stat != PM_QOS_FLAGS_ALL +- && udev->persist_enabled +- && !status) { +- pm_runtime_put_sync(&port_dev->dev); +- port_dev->did_runtime_put = true; ++ if (status == 0 && !udev->do_remote_wakeup && udev->persist_enabled) { ++ enum pm_qos_flags_status pm_qos_stat; ++ ++ pm_qos_stat = dev_pm_qos_flags(&port_dev->dev, ++ PM_QOS_FLAG_NO_POWER_OFF); ++ if (pm_qos_stat != PM_QOS_FLAGS_ALL) { ++ pm_runtime_put_sync(&port_dev->dev); ++ port_dev->did_runtime_put = true; ++ } + } + + usb_mark_last_busy(hub->hdev); diff --git a/queue-3.10/usb-mos7720-fix-big-endian-control-requests.patch b/queue-3.10/usb-mos7720-fix-big-endian-control-requests.patch new file mode 100644 index 00000000000..b998b93864b --- /dev/null +++ b/queue-3.10/usb-mos7720-fix-big-endian-control-requests.patch @@ -0,0 +1,33 @@ +From 3b716caf190ccc6f2a09387210e0e6a26c1d81a4 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Mon, 19 Aug 2013 13:05:45 +0200 +Subject: USB: mos7720: fix big-endian control requests + +From: Johan Hovold + +commit 3b716caf190ccc6f2a09387210e0e6a26c1d81a4 upstream. + +Fix endianess bugs in parallel-port code which caused corrupt +control-requests to be issued on big-endian machines. + +Reported-by: kbuild test robot +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/mos7720.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/usb/serial/mos7720.c ++++ b/drivers/usb/serial/mos7720.c +@@ -382,8 +382,8 @@ static int write_parport_reg_nonblock(st + } + urbtrack->setup->bRequestType = (__u8)0x40; + urbtrack->setup->bRequest = (__u8)0x0e; +- urbtrack->setup->wValue = get_reg_value(reg, dummy); +- urbtrack->setup->wIndex = get_reg_index(reg); ++ urbtrack->setup->wValue = cpu_to_le16(get_reg_value(reg, dummy)); ++ urbtrack->setup->wIndex = cpu_to_le16(get_reg_index(reg)); + urbtrack->setup->wLength = 0; + usb_fill_control_urb(urbtrack->urb, usbdev, + usb_sndctrlpipe(usbdev, 0), diff --git a/queue-3.10/usb-mos7720-use-gfp_atomic-under-spinlock.patch b/queue-3.10/usb-mos7720-use-gfp_atomic-under-spinlock.patch new file mode 100644 index 00000000000..bbd12357b4e --- /dev/null +++ b/queue-3.10/usb-mos7720-use-gfp_atomic-under-spinlock.patch @@ -0,0 +1,31 @@ +From d0bd9a41186e076ea543c397ad8a67a6cf604b55 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Fri, 16 Aug 2013 10:16:59 +0300 +Subject: USB: mos7720: use GFP_ATOMIC under spinlock + +From: Dan Carpenter + +commit d0bd9a41186e076ea543c397ad8a67a6cf604b55 upstream. + +The write_parport_reg_nonblock() function shouldn't sleep because it's +called with spinlocks held. + +Signed-off-by: Dan Carpenter +Acked-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/mos7720.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/serial/mos7720.c ++++ b/drivers/usb/serial/mos7720.c +@@ -374,7 +374,7 @@ static int write_parport_reg_nonblock(st + kfree(urbtrack); + return -ENOMEM; + } +- urbtrack->setup = kmalloc(sizeof(*urbtrack->setup), GFP_KERNEL); ++ urbtrack->setup = kmalloc(sizeof(*urbtrack->setup), GFP_ATOMIC); + if (!urbtrack->setup) { + usb_free_urb(urbtrack->urb); + kfree(urbtrack); diff --git a/queue-3.10/x86-amd_nb-clarify-f15h-model-30h-gart-and-l3-support.patch b/queue-3.10/x86-amd_nb-clarify-f15h-model-30h-gart-and-l3-support.patch new file mode 100644 index 00000000000..d65eeb835af --- /dev/null +++ b/queue-3.10/x86-amd_nb-clarify-f15h-model-30h-gart-and-l3-support.patch @@ -0,0 +1,63 @@ +From 7d64ac6422092adbbdaa279ab32f9d4c90a84558 Mon Sep 17 00:00:00 2001 +From: Aravind Gopalakrishnan +Date: Fri, 2 Aug 2013 17:43:03 -0500 +Subject: x86, amd_nb: Clarify F15h, model 30h GART and L3 support + +From: Aravind Gopalakrishnan + +commit 7d64ac6422092adbbdaa279ab32f9d4c90a84558 upstream. + +F15h, models 0x30 and later don't have a GART. Note that. Also check +CPUID leaf 0x80000006 for L3 prescence because there are models which +don't sport an L3 cache. + +Signed-off-by: Aravind Gopalakrishnan +[ Boris: rewrite commit message, cleanup comments. ] +Signed-off-by: Borislav Petkov +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/amd_nb.c | 13 +++++++++++-- + 1 file changed, 11 insertions(+), 2 deletions(-) + +--- a/arch/x86/kernel/amd_nb.c ++++ b/arch/x86/kernel/amd_nb.c +@@ -20,6 +20,7 @@ const struct pci_device_id amd_nb_misc_i + { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_10H_NB_MISC) }, + { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_15H_NB_F3) }, + { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_15H_M10H_F3) }, ++ { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_15H_M30H_NB_F3) }, + { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_16H_NB_F3) }, + {} + }; +@@ -27,6 +28,7 @@ EXPORT_SYMBOL(amd_nb_misc_ids); + + static const struct pci_device_id amd_nb_link_ids[] = { + { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_15H_NB_F4) }, ++ { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_15H_M30H_NB_F4) }, + { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_16H_NB_F4) }, + {} + }; +@@ -81,13 +83,20 @@ int amd_cache_northbridges(void) + next_northbridge(misc, amd_nb_misc_ids); + node_to_amd_nb(i)->link = link = + next_northbridge(link, amd_nb_link_ids); +- } ++ } + ++ /* GART present only on Fam15h upto model 0fh */ + if (boot_cpu_data.x86 == 0xf || boot_cpu_data.x86 == 0x10 || +- boot_cpu_data.x86 == 0x15) ++ (boot_cpu_data.x86 == 0x15 && boot_cpu_data.x86_model < 0x10)) + amd_northbridges.flags |= AMD_NB_GART; + + /* ++ * Check for L3 cache presence. ++ */ ++ if (!cpuid_edx(0x80000006)) ++ return 0; ++ ++ /* + * Some CPU families support L3 Cache Index Disable. There are some + * limitations because of E382 and E388 on family 0x10. + */ diff --git a/queue-3.10/x86-mce-pay-no-attention-to-f-bit-in-mcacod-when-parsing-uc-errors.patch b/queue-3.10/x86-mce-pay-no-attention-to-f-bit-in-mcacod-when-parsing-uc-errors.patch new file mode 100644 index 00000000000..d14ddcd4bdd --- /dev/null +++ b/queue-3.10/x86-mce-pay-no-attention-to-f-bit-in-mcacod-when-parsing-uc-errors.patch @@ -0,0 +1,50 @@ +From 0ca06c0857aee11911f91621db14498496f2c2cd Mon Sep 17 00:00:00 2001 +From: Tony Luck +Date: Wed, 24 Jul 2013 13:54:20 -0700 +Subject: x86/mce: Pay no attention to 'F' bit in MCACOD when parsing 'UC' errors + +From: Tony Luck + +commit 0ca06c0857aee11911f91621db14498496f2c2cd upstream. + +The 0x1000 bit of the MCACOD field of machine check MCi_STATUS +registers is only defined for corrected errors (where it means +that hardware may be filtering errors see SDM section 15.9.2.1). + +For uncorrected errors it may, or may not be set - so we should mask +it out when checking for the architecturaly defined recoverable +error signatures (see SDM 15.9.3.1 and 15.9.3.2) + +Acked-by: Naveen N. Rao +Signed-off-by: Tony Luck +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/include/asm/mce.h | 13 +++++++++++-- + 1 file changed, 11 insertions(+), 2 deletions(-) + +--- a/arch/x86/include/asm/mce.h ++++ b/arch/x86/include/asm/mce.h +@@ -32,11 +32,20 @@ + #define MCI_STATUS_PCC (1ULL<<57) /* processor context corrupt */ + #define MCI_STATUS_S (1ULL<<56) /* Signaled machine check */ + #define MCI_STATUS_AR (1ULL<<55) /* Action required */ +-#define MCACOD 0xffff /* MCA Error Code */ ++ ++/* ++ * Note that the full MCACOD field of IA32_MCi_STATUS MSR is ++ * bits 15:0. But bit 12 is the 'F' bit, defined for corrected ++ * errors to indicate that errors are being filtered by hardware. ++ * We should mask out bit 12 when looking for specific signatures ++ * of uncorrected errors - so the F bit is deliberately skipped ++ * in this #define. ++ */ ++#define MCACOD 0xefff /* MCA Error Code */ + + /* Architecturally defined codes from SDM Vol. 3B Chapter 15 */ + #define MCACOD_SCRUB 0x00C0 /* 0xC0-0xCF Memory Scrubbing */ +-#define MCACOD_SCRUBMSK 0xfff0 ++#define MCACOD_SCRUBMSK 0xeff0 /* Skip bit 12 ('F' bit) */ + #define MCACOD_L3WB 0x017A /* L3 Explicit Writeback */ + #define MCACOD_DATA 0x0134 /* Data Load */ + #define MCACOD_INSTR 0x0150 /* Instruction Fetch */ diff --git a/queue-3.10/x86-smap-handle-csum_partial_copy_-_user.patch b/queue-3.10/x86-smap-handle-csum_partial_copy_-_user.patch new file mode 100644 index 00000000000..742b3e7c855 --- /dev/null +++ b/queue-3.10/x86-smap-handle-csum_partial_copy_-_user.patch @@ -0,0 +1,109 @@ +From 7263dda41b5a28ae6566fd126d9b06ada73dd721 Mon Sep 17 00:00:00 2001 +From: "H. Peter Anvin" +Date: Fri, 30 Aug 2013 15:43:03 -0700 +Subject: x86, smap: Handle csum_partial_copy_*_user() + +From: "H. Peter Anvin" + +commit 7263dda41b5a28ae6566fd126d9b06ada73dd721 upstream. + +Add SMAP annotations to csum_partial_copy_to/from_user(). These +functions legitimately access user space and thus need to set the AC +flag. + +TODO: add explicit checks that the side with the kernel space pointer +really points into kernel space. + +Signed-off-by: H. Peter Anvin +Link: http://lkml.kernel.org/n/tip-2aps0u00eer658fd5xyanan7@git.kernel.org +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/include/asm/checksum_32.h | 22 +++++++++++++++++----- + arch/x86/lib/csum-wrappers_64.c | 12 ++++++++++-- + 2 files changed, 27 insertions(+), 7 deletions(-) + +--- a/arch/x86/include/asm/checksum_32.h ++++ b/arch/x86/include/asm/checksum_32.h +@@ -49,9 +49,15 @@ static inline __wsum csum_partial_copy_f + int len, __wsum sum, + int *err_ptr) + { ++ __wsum ret; ++ + might_sleep(); +- return csum_partial_copy_generic((__force void *)src, dst, +- len, sum, err_ptr, NULL); ++ stac(); ++ ret = csum_partial_copy_generic((__force void *)src, dst, ++ len, sum, err_ptr, NULL); ++ clac(); ++ ++ return ret; + } + + /* +@@ -176,10 +182,16 @@ static inline __wsum csum_and_copy_to_us + int len, __wsum sum, + int *err_ptr) + { ++ __wsum ret; ++ + might_sleep(); +- if (access_ok(VERIFY_WRITE, dst, len)) +- return csum_partial_copy_generic(src, (__force void *)dst, +- len, sum, NULL, err_ptr); ++ if (access_ok(VERIFY_WRITE, dst, len)) { ++ stac(); ++ ret = csum_partial_copy_generic(src, (__force void *)dst, ++ len, sum, NULL, err_ptr); ++ clac(); ++ return ret; ++ } + + if (len) + *err_ptr = -EFAULT; +--- a/arch/x86/lib/csum-wrappers_64.c ++++ b/arch/x86/lib/csum-wrappers_64.c +@@ -6,6 +6,7 @@ + */ + #include + #include ++#include + + /** + * csum_partial_copy_from_user - Copy and checksum from user space. +@@ -52,8 +53,10 @@ csum_partial_copy_from_user(const void _ + len -= 2; + } + } ++ stac(); + isum = csum_partial_copy_generic((__force const void *)src, + dst, len, isum, errp, NULL); ++ clac(); + if (unlikely(*errp)) + goto out_err; + +@@ -82,6 +85,8 @@ __wsum + csum_partial_copy_to_user(const void *src, void __user *dst, + int len, __wsum isum, int *errp) + { ++ __wsum ret; ++ + might_sleep(); + + if (unlikely(!access_ok(VERIFY_WRITE, dst, len))) { +@@ -105,8 +110,11 @@ csum_partial_copy_to_user(const void *sr + } + + *errp = 0; +- return csum_partial_copy_generic(src, (void __force *)dst, +- len, isum, NULL, errp); ++ stac(); ++ ret = csum_partial_copy_generic(src, (void __force *)dst, ++ len, isum, NULL, errp); ++ clac(); ++ return ret; + } + EXPORT_SYMBOL(csum_partial_copy_to_user); +