From: Greg Kroah-Hartman Date: Tue, 27 Jan 2015 18:05:33 +0000 (-0800) Subject: 3.18-stable patches X-Git-Tag: v3.10.67~50 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=ebe532bb2f95a83c8dbfde18162c232084e2a6a0;p=thirdparty%2Fkernel%2Fstable-queue.git 3.18-stable patches added patches: alsa-usb-audio-add-mic-volume-fix-quirk-for-logitech-webcam-c210.patch can-dev-fix-crtlmode_supported-check.patch can-m_can-tag-current-can-fd-controllers-as-non-iso.patch libata-allow-sata_sil24-to-opt-out-of-tag-ordered-submission.patch libata-prevent-hsm-state-change-race-between-isr-and-pio.patch mfd-rtsx_usb-fix-runtime-pm-deadlock.patch mfd-tps65218-make-int-and-status-registers-volatile.patch mfd-tps65218-make-int1-our-status_base-register.patch pinctrl-fix-two-deadlocks.patch pinctrl-qcom-don-t-iterate-past-end-of-function-array.patch scripts-recordmcount.pl-there-is-no-m32-gcc-option-on-super-h-anymore.patch workqueue-fix-subtle-pool-management-issue-which-can-stall-whole-worker_pool.patch --- diff --git a/queue-3.18/alsa-usb-audio-add-mic-volume-fix-quirk-for-logitech-webcam-c210.patch b/queue-3.18/alsa-usb-audio-add-mic-volume-fix-quirk-for-logitech-webcam-c210.patch new file mode 100644 index 00000000000..d1059282cf7 --- /dev/null +++ b/queue-3.18/alsa-usb-audio-add-mic-volume-fix-quirk-for-logitech-webcam-c210.patch @@ -0,0 +1,27 @@ +From 6455931186bff407493135e74c5f32efd30860e2 Mon Sep 17 00:00:00 2001 +From: Jason Lee Cragg +Date: Sat, 17 Jan 2015 12:28:29 -0500 +Subject: ALSA: usb-audio: Add mic volume fix quirk for Logitech Webcam C210 + +From: Jason Lee Cragg + +commit 6455931186bff407493135e74c5f32efd30860e2 upstream. + +Signed-off-by: Jason Lee Cragg +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/usb/mixer.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/usb/mixer.c ++++ b/sound/usb/mixer.c +@@ -909,6 +909,7 @@ static void volume_control_quirks(struct + case USB_ID(0x046d, 0x0807): /* Logitech Webcam C500 */ + case USB_ID(0x046d, 0x0808): + case USB_ID(0x046d, 0x0809): ++ case USB_ID(0x046d, 0x0819): /* Logitech Webcam C210 */ + case USB_ID(0x046d, 0x081b): /* HD Webcam c310 */ + case USB_ID(0x046d, 0x081d): /* HD Webcam c510 */ + case USB_ID(0x046d, 0x0825): /* HD Webcam c270 */ diff --git a/queue-3.18/can-dev-fix-crtlmode_supported-check.patch b/queue-3.18/can-dev-fix-crtlmode_supported-check.patch new file mode 100644 index 00000000000..f43bdec3b1b --- /dev/null +++ b/queue-3.18/can-dev-fix-crtlmode_supported-check.patch @@ -0,0 +1,46 @@ +From 9b1087aa5e86448fe6ad40a58964e35f3ba423d5 Mon Sep 17 00:00:00 2001 +From: Oliver Hartkopp +Date: Mon, 5 Jan 2015 18:40:15 +0100 +Subject: can: dev: fix crtlmode_supported check + +From: Oliver Hartkopp + +commit 9b1087aa5e86448fe6ad40a58964e35f3ba423d5 upstream. + +When changing flags in the CAN drivers ctrlmode the provided new content has to +be checked whether the bits are allowed to be changed. The bits that are to be +changed are given as a bitfield in cm->mask. Therefore checking against +cm->flags is wrong as the content can hold any kind of values. + +The iproute2 tool sets the bits in cm->mask and cm->flags depending on the +detected command line options. To be robust against bogus user space +applications additionally sanitize the provided flags with the provided mask. + +Cc: Wolfgang Grandegger +Signed-off-by: Oliver Hartkopp +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/can/dev.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +--- a/drivers/net/can/dev.c ++++ b/drivers/net/can/dev.c +@@ -729,10 +729,14 @@ static int can_changelink(struct net_dev + if (dev->flags & IFF_UP) + return -EBUSY; + cm = nla_data(data[IFLA_CAN_CTRLMODE]); +- if (cm->flags & ~priv->ctrlmode_supported) ++ ++ /* check whether changed bits are allowed to be modified */ ++ if (cm->mask & ~priv->ctrlmode_supported) + return -EOPNOTSUPP; ++ ++ /* clear bits to be modified and copy the flag values */ + priv->ctrlmode &= ~cm->mask; +- priv->ctrlmode |= cm->flags; ++ priv->ctrlmode |= (cm->flags & cm->mask); + + /* CAN_CTRLMODE_FD can only be set when driver supports FD */ + if (priv->ctrlmode & CAN_CTRLMODE_FD) diff --git a/queue-3.18/can-m_can-tag-current-can-fd-controllers-as-non-iso.patch b/queue-3.18/can-m_can-tag-current-can-fd-controllers-as-non-iso.patch new file mode 100644 index 00000000000..a8d9adcb01a --- /dev/null +++ b/queue-3.18/can-m_can-tag-current-can-fd-controllers-as-non-iso.patch @@ -0,0 +1,60 @@ +From 6cfda7fbebe8a4fd33ea5722fa0212f98f643c35 Mon Sep 17 00:00:00 2001 +From: Oliver Hartkopp +Date: Mon, 5 Jan 2015 19:47:43 +0100 +Subject: can: m_can: tag current CAN FD controllers as non-ISO + +From: Oliver Hartkopp + +commit 6cfda7fbebe8a4fd33ea5722fa0212f98f643c35 upstream. + +During the CAN FD standardization process within the ISO it turned out that +the failure detection capability has to be improved. + +The CAN in Automation organization (CiA) defined the already implemented CAN +FD controllers as 'non-ISO' and the upcoming improved CAN FD controllers as +'ISO' compliant. See at http://www.can-cia.com/index.php?id=1937 + +Finally there will be three types of CAN FD controllers in the future: + +1. ISO compliant (fixed) +2. non-ISO compliant (fixed, like the M_CAN IP v3.0.1 in m_can.c) +3. ISO/non-ISO CAN FD controllers (switchable, like the PEAK USB FD) + +So the current M_CAN driver for the M_CAN IP v3.0.1 has to expose its non-ISO +implementation by setting the CAN_CTRLMODE_FD_NON_ISO ctrlmode at startup. +As this bit cannot be switched at configuration time CAN_CTRLMODE_FD_NON_ISO +must not be set in ctrlmode_supported of the current M_CAN driver. + +Signed-off-by: Oliver Hartkopp +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/can/m_can/m_can.c | 5 +++++ + include/uapi/linux/can/netlink.h | 1 + + 2 files changed, 6 insertions(+) + +--- a/drivers/net/can/m_can/m_can.c ++++ b/drivers/net/can/m_can/m_can.c +@@ -955,6 +955,11 @@ static struct net_device *alloc_m_can_de + priv->can.data_bittiming_const = &m_can_data_bittiming_const; + priv->can.do_set_mode = m_can_set_mode; + priv->can.do_get_berr_counter = m_can_get_berr_counter; ++ ++ /* CAN_CTRLMODE_FD_NON_ISO is fixed with M_CAN IP v3.0.1 */ ++ priv->can.ctrlmode = CAN_CTRLMODE_FD_NON_ISO; ++ ++ /* CAN_CTRLMODE_FD_NON_ISO can not be changed with M_CAN IP v3.0.1 */ + priv->can.ctrlmode_supported = CAN_CTRLMODE_LOOPBACK | + CAN_CTRLMODE_LISTENONLY | + CAN_CTRLMODE_BERR_REPORTING | +--- a/include/uapi/linux/can/netlink.h ++++ b/include/uapi/linux/can/netlink.h +@@ -98,6 +98,7 @@ struct can_ctrlmode { + #define CAN_CTRLMODE_BERR_REPORTING 0x10 /* Bus-error reporting */ + #define CAN_CTRLMODE_FD 0x20 /* CAN FD mode */ + #define CAN_CTRLMODE_PRESUME_ACK 0x40 /* Ignore missing CAN ACKs */ ++#define CAN_CTRLMODE_FD_NON_ISO 0x80 /* CAN FD in non-ISO mode */ + + /* + * CAN device statistics diff --git a/queue-3.18/libata-allow-sata_sil24-to-opt-out-of-tag-ordered-submission.patch b/queue-3.18/libata-allow-sata_sil24-to-opt-out-of-tag-ordered-submission.patch new file mode 100644 index 00000000000..5667bb4e2d4 --- /dev/null +++ b/queue-3.18/libata-allow-sata_sil24-to-opt-out-of-tag-ordered-submission.patch @@ -0,0 +1,68 @@ +From 72dd299d5039a336493993dcc63413cf31d0e662 Mon Sep 17 00:00:00 2001 +From: Dan Williams +Date: Fri, 16 Jan 2015 15:13:02 -0800 +Subject: libata: allow sata_sil24 to opt-out of tag ordered submission + +From: Dan Williams + +commit 72dd299d5039a336493993dcc63413cf31d0e662 upstream. + +Ronny reports: https://bugzilla.kernel.org/show_bug.cgi?id=87101 + "Since commit 8a4aeec8d "libata/ahci: accommodate tag ordered + controllers" the access to the harddisk on the first SATA-port is + failing on its first access. The access to the harddisk on the + second port is working normal. + + When reverting the above commit, access to both harddisks is working + fine again." + +Maintain tag ordered submission as the default, but allow sata_sil24 to +continue with the old behavior. + +Cc: Tejun Heo +Reported-by: Ronny Hegewald +Signed-off-by: Dan Williams +Signed-off-by: Tejun Heo +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ata/libata-core.c | 5 ++++- + drivers/ata/sata_sil24.c | 2 +- + include/linux/libata.h | 1 + + 3 files changed, 6 insertions(+), 2 deletions(-) + +--- a/drivers/ata/libata-core.c ++++ b/drivers/ata/libata-core.c +@@ -4740,7 +4740,10 @@ static struct ata_queued_cmd *ata_qc_new + return NULL; + + for (i = 0, tag = ap->last_tag + 1; i < max_queue; i++, tag++) { +- tag = tag < max_queue ? tag : 0; ++ if (ap->flags & ATA_FLAG_LOWTAG) ++ tag = i; ++ else ++ tag = tag < max_queue ? tag : 0; + + /* the last tag is reserved for internal command. */ + if (tag == ATA_TAG_INTERNAL) +--- a/drivers/ata/sata_sil24.c ++++ b/drivers/ata/sata_sil24.c +@@ -246,7 +246,7 @@ enum { + /* host flags */ + SIL24_COMMON_FLAGS = ATA_FLAG_SATA | ATA_FLAG_PIO_DMA | + ATA_FLAG_NCQ | ATA_FLAG_ACPI_SATA | +- ATA_FLAG_AN | ATA_FLAG_PMP, ++ ATA_FLAG_AN | ATA_FLAG_PMP | ATA_FLAG_LOWTAG, + SIL24_FLAG_PCIX_IRQ_WOC = (1 << 24), /* IRQ loss errata on PCI-X */ + + IRQ_STAT_4PORTS = 0xf, +--- a/include/linux/libata.h ++++ b/include/linux/libata.h +@@ -230,6 +230,7 @@ enum { + ATA_FLAG_SW_ACTIVITY = (1 << 22), /* driver supports sw activity + * led */ + ATA_FLAG_NO_DIPM = (1 << 23), /* host not happy with DIPM */ ++ ATA_FLAG_LOWTAG = (1 << 24), /* host wants lowest available tag */ + + /* bits 24:31 of ap->flags are reserved for LLD specific flags */ + diff --git a/queue-3.18/libata-prevent-hsm-state-change-race-between-isr-and-pio.patch b/queue-3.18/libata-prevent-hsm-state-change-race-between-isr-and-pio.patch new file mode 100644 index 00000000000..39ad8c7e44c --- /dev/null +++ b/queue-3.18/libata-prevent-hsm-state-change-race-between-isr-and-pio.patch @@ -0,0 +1,72 @@ +From ce7514526742c0898b837d4395f515b79dfb5a12 Mon Sep 17 00:00:00 2001 +From: David Jeffery +Date: Mon, 19 Jan 2015 13:03:25 -0600 +Subject: libata: prevent HSM state change race between ISR and PIO + +From: David Jeffery + +commit ce7514526742c0898b837d4395f515b79dfb5a12 upstream. + +It is possible for ata_sff_flush_pio_task() to set ap->hsm_task_state to +HSM_ST_IDLE in between the time __ata_sff_port_intr() checks for HSM_ST_IDLE +and before it calls ata_sff_hsm_move() causing ata_sff_hsm_move() to BUG(). + +This problem is hard to reproduce making this patch hard to verify, but this +fix will prevent the race. + +I have not been able to reproduce the problem, but here is a crash dump from +a 2.6.32 kernel. + +On examining the ata port's state, its hsm_task_state field has a value of HSM_ST_IDLE: + +crash> struct ata_port.hsm_task_state ffff881c1121c000 + hsm_task_state = 0 + +Normally, this should not be possible as ata_sff_hsm_move() was called from ata_sff_host_intr(), +which checks hsm_task_state and won't call ata_sff_hsm_move() if it has a HSM_ST_IDLE value. + +PID: 11053 TASK: ffff8816e846cae0 CPU: 0 COMMAND: "sshd" + #0 [ffff88008ba03960] machine_kexec at ffffffff81038f3b + #1 [ffff88008ba039c0] crash_kexec at ffffffff810c5d92 + #2 [ffff88008ba03a90] oops_end at ffffffff8152b510 + #3 [ffff88008ba03ac0] die at ffffffff81010e0b + #4 [ffff88008ba03af0] do_trap at ffffffff8152ad74 + #5 [ffff88008ba03b50] do_invalid_op at ffffffff8100cf95 + #6 [ffff88008ba03bf0] invalid_op at ffffffff8100bf9b + [exception RIP: ata_sff_hsm_move+317] + RIP: ffffffff813a77ad RSP: ffff88008ba03ca0 RFLAGS: 00010097 + RAX: 0000000000000000 RBX: ffff881c1121dc60 RCX: 0000000000000000 + RDX: ffff881c1121dd10 RSI: ffff881c1121dc60 RDI: ffff881c1121c000 + RBP: ffff88008ba03d00 R8: 0000000000000000 R9: 000000000000002e + R10: 000000000001003f R11: 000000000000009b R12: ffff881c1121c000 + R13: 0000000000000000 R14: 0000000000000050 R15: ffff881c1121dd78 + ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018 + #7 [ffff88008ba03d08] ata_sff_host_intr at ffffffff813a7fbd + #8 [ffff88008ba03d38] ata_sff_interrupt at ffffffff813a821e + #9 [ffff88008ba03d78] handle_IRQ_event at ffffffff810e6ec0 +--- + drivers/ata/libata-sff.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +--- a/drivers/ata/libata-sff.c ++++ b/drivers/ata/libata-sff.c +@@ -1333,7 +1333,19 @@ void ata_sff_flush_pio_task(struct ata_p + DPRINTK("ENTER\n"); + + cancel_delayed_work_sync(&ap->sff_pio_task); ++ ++ /* ++ * We wanna reset the HSM state to IDLE. If we do so without ++ * grabbing the port lock, critical sections protected by it which ++ * expect the HSM state to stay stable may get surprised. For ++ * example, we may set IDLE in between the time ++ * __ata_sff_port_intr() checks for HSM_ST_IDLE and before it calls ++ * ata_sff_hsm_move() causing ata_sff_hsm_move() to BUG(). ++ */ ++ spin_lock_irq(ap->lock); + ap->hsm_task_state = HSM_ST_IDLE; ++ spin_unlock_irq(ap->lock); ++ + ap->sff_pio_task_link = NULL; + + if (ata_msg_ctl(ap)) diff --git a/queue-3.18/mfd-rtsx_usb-fix-runtime-pm-deadlock.patch b/queue-3.18/mfd-rtsx_usb-fix-runtime-pm-deadlock.patch new file mode 100644 index 00000000000..e535753ffc1 --- /dev/null +++ b/queue-3.18/mfd-rtsx_usb-fix-runtime-pm-deadlock.patch @@ -0,0 +1,54 @@ +From b166010f6afbadb896efa37ff85eb681a8f89392 Mon Sep 17 00:00:00 2001 +From: Roger Tseng +Date: Thu, 15 Jan 2015 15:14:44 +0800 +Subject: mfd: rtsx_usb: Fix runtime PM deadlock + +From: Roger Tseng + +commit b166010f6afbadb896efa37ff85eb681a8f89392 upstream. + +sd_set_power_mode() in derived module drivers/mmc/host/rtsx_usb_sdmmc.c +acquires dev_mutex and then calls pm_runtime_get_sync() to make sure the +device is awake while initializing a newly inserted card. Once it is +called during suspending state and explicitly before rtsx_usb_suspend() +acquires the same dev_mutex, both routine deadlock and further hang the +driver because pm_runtime_get_sync() waits the pending PM operations. + +Fix this by using an empty suspend method. mmc_core always turns the +LED off after a request is done and thus it is ok to remove the only +rtsx_usb_turn_off_led() here. + +Fixes: 730876be2566 ("mfd: Add realtek USB card reader driver") +Signed-off-by: Roger Tseng +[Lee: Removed newly unused variable] +Signed-off-by: Lee Jones +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mfd/rtsx_usb.c | 12 ------------ + 1 file changed, 12 deletions(-) + +--- a/drivers/mfd/rtsx_usb.c ++++ b/drivers/mfd/rtsx_usb.c +@@ -681,21 +681,9 @@ static void rtsx_usb_disconnect(struct u + #ifdef CONFIG_PM + static int rtsx_usb_suspend(struct usb_interface *intf, pm_message_t message) + { +- struct rtsx_ucr *ucr = +- (struct rtsx_ucr *)usb_get_intfdata(intf); +- + dev_dbg(&intf->dev, "%s called with pm message 0x%04x\n", + __func__, message.event); + +- /* +- * Call to make sure LED is off during suspend to save more power. +- * It is NOT a permanent state and could be turned on anytime later. +- * Thus no need to call turn_on when resunming. +- */ +- mutex_lock(&ucr->dev_mutex); +- rtsx_usb_turn_off_led(ucr); +- mutex_unlock(&ucr->dev_mutex); +- + return 0; + } + diff --git a/queue-3.18/mfd-tps65218-make-int-and-status-registers-volatile.patch b/queue-3.18/mfd-tps65218-make-int-and-status-registers-volatile.patch new file mode 100644 index 00000000000..b4c723c7da3 --- /dev/null +++ b/queue-3.18/mfd-tps65218-make-int-and-status-registers-volatile.patch @@ -0,0 +1,51 @@ +From 773328da243978bebac82bf4c45604281edb6975 Mon Sep 17 00:00:00 2001 +From: Felipe Balbi +Date: Fri, 26 Dec 2014 13:28:20 -0600 +Subject: mfd: tps65218: Make INT[12] and STATUS registers volatile + +From: Felipe Balbi + +commit 773328da243978bebac82bf4c45604281edb6975 upstream. + +STATUS register can be modified by the HW, so we +should bypass cache because of that. + +In the case of INT[12] registers, they are the ones +that actually clear the IRQ source at the time they +are read. If we rely on the cache for them, we will +never be able to clear the interrupt, which will cause +our IRQ line to be disabled due to IRQ throttling. + +Fixes: 44b4dc6 mfd: tps65218: Add driver for the TPS65218 PMIC +Signed-off-by: Felipe Balbi +Signed-off-by: Lee Jones +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mfd/tps65218.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +--- a/drivers/mfd/tps65218.c ++++ b/drivers/mfd/tps65218.c +@@ -125,10 +125,21 @@ int tps65218_clear_bits(struct tps65218 + } + EXPORT_SYMBOL_GPL(tps65218_clear_bits); + ++static const struct regmap_range tps65218_yes_ranges[] = { ++ regmap_reg_range(TPS65218_REG_INT1, TPS65218_REG_INT2), ++ regmap_reg_range(TPS65218_REG_STATUS, TPS65218_REG_STATUS), ++}; ++ ++static const struct regmap_access_table tps65218_volatile_table = { ++ .yes_ranges = tps65218_yes_ranges, ++ .n_yes_ranges = ARRAY_SIZE(tps65218_yes_ranges), ++}; ++ + static struct regmap_config tps65218_regmap_config = { + .reg_bits = 8, + .val_bits = 8, + .cache_type = REGCACHE_RBTREE, ++ .volatile_table = &tps65218_volatile_table, + }; + + static const struct regmap_irq tps65218_irqs[] = { diff --git a/queue-3.18/mfd-tps65218-make-int1-our-status_base-register.patch b/queue-3.18/mfd-tps65218-make-int1-our-status_base-register.patch new file mode 100644 index 00000000000..3fceeda3401 --- /dev/null +++ b/queue-3.18/mfd-tps65218-make-int1-our-status_base-register.patch @@ -0,0 +1,32 @@ +From f29ae369a412942e81035984fa3d7a22ddf91fcb Mon Sep 17 00:00:00 2001 +From: Felipe Balbi +Date: Fri, 26 Dec 2014 13:28:21 -0600 +Subject: mfd: tps65218: Make INT1 our status_base register + +From: Felipe Balbi + +commit f29ae369a412942e81035984fa3d7a22ddf91fcb upstream. + +If we don't tell regmap-irq that our first status +register is at offset 1, it will try to read offset +zero, which is the chipid register. + +Fixes: 44b4dc6 mfd: tps65218: Add driver for the TPS65218 PMIC +Signed-off-by: Felipe Balbi +Signed-off-by: Lee Jones +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mfd/tps65218.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/mfd/tps65218.c ++++ b/drivers/mfd/tps65218.c +@@ -204,6 +204,7 @@ static struct regmap_irq_chip tps65218_i + + .num_regs = 2, + .mask_base = TPS65218_REG_INT_MASK1, ++ .status_base = TPS65218_REG_INT1, + }; + + static const struct of_device_id of_tps65218_match_table[] = { diff --git a/queue-3.18/pinctrl-fix-two-deadlocks.patch b/queue-3.18/pinctrl-fix-two-deadlocks.patch new file mode 100644 index 00000000000..1028166f389 --- /dev/null +++ b/queue-3.18/pinctrl-fix-two-deadlocks.patch @@ -0,0 +1,80 @@ +From db93facfb0ef542aa5d8079e47580b3e669a4d82 Mon Sep 17 00:00:00 2001 +From: Jim Lin +Date: Thu, 8 Jan 2015 20:25:05 +0800 +Subject: pinctrl: Fix two deadlocks + +From: Jim Lin + +commit db93facfb0ef542aa5d8079e47580b3e669a4d82 upstream. + +This patch is to fix two deadlock cases. +Deadlock 1: +CPU #1 + pinctrl_register-> pinctrl_get -> + create_pinctrl + (Holding lock pinctrl_maps_mutex) + -> get_pinctrl_dev_from_devname + (Trying to acquire lock pinctrldev_list_mutex) +CPU #0 + pinctrl_unregister + (Holding lock pinctrldev_list_mutex) + -> pinctrl_put ->> pinctrl_free -> + pinctrl_dt_free_maps -> pinctrl_unregister_map + (Trying to acquire lock pinctrl_maps_mutex) + +Simply to say +CPU#1 is holding lock A and trying to acquire lock B, +CPU#0 is holding lock B and trying to acquire lock A. + +Deadlock 2: +CPU #3 + pinctrl_register-> pinctrl_get -> + create_pinctrl + (Holding lock pinctrl_maps_mutex) + -> get_pinctrl_dev_from_devname + (Trying to acquire lock pinctrldev_list_mutex) +CPU #2 + pinctrl_unregister + (Holding lock pctldev->mutex) + -> pinctrl_put ->> pinctrl_free -> + pinctrl_dt_free_maps -> pinctrl_unregister_map + (Trying to acquire lock pinctrl_maps_mutex) +CPU #0 + tegra_gpio_request + (Holding lock pinctrldev_list_mutex) + -> pinctrl_get_device_gpio_range + (Trying to acquire lock pctldev->mutex) + +Simply to say +CPU#3 is holding lock A and trying to acquire lock D, +CPU#2 is holding lock B and trying to acquire lock A, +CPU#0 is holding lock D and trying to acquire lock B. + +Signed-off-by: Jim Lin +Signed-off-by: Linus Walleij +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pinctrl/core.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/drivers/pinctrl/core.c ++++ b/drivers/pinctrl/core.c +@@ -1801,14 +1801,15 @@ void pinctrl_unregister(struct pinctrl_d + if (pctldev == NULL) + return; + +- mutex_lock(&pinctrldev_list_mutex); + mutex_lock(&pctldev->mutex); +- + pinctrl_remove_device_debugfs(pctldev); ++ mutex_unlock(&pctldev->mutex); + + if (!IS_ERR(pctldev->p)) + pinctrl_put(pctldev->p); + ++ mutex_lock(&pinctrldev_list_mutex); ++ mutex_lock(&pctldev->mutex); + /* TODO: check that no pinmuxes are still active? */ + list_del(&pctldev->node); + /* Destroy descriptor tree */ diff --git a/queue-3.18/pinctrl-qcom-don-t-iterate-past-end-of-function-array.patch b/queue-3.18/pinctrl-qcom-don-t-iterate-past-end-of-function-array.patch new file mode 100644 index 00000000000..094d5119418 --- /dev/null +++ b/queue-3.18/pinctrl-qcom-don-t-iterate-past-end-of-function-array.patch @@ -0,0 +1,42 @@ +From bcd53f858d87f52843cc87764b283999126a50d6 Mon Sep 17 00:00:00 2001 +From: Stephen Boyd +Date: Mon, 19 Jan 2015 11:17:45 +0100 +Subject: pinctrl: qcom: Don't iterate past end of function array + +From: Stephen Boyd + +commit bcd53f858d87f52843cc87764b283999126a50d6 upstream. + +Timur reports that this code crashes if nfunctions is 0. Fix the +loop iteration to only consider valid elements of the functions +array. + +Reported-by: Timur Tabi +Cc: Pramod Gurav +Cc: Bjorn Andersson +Cc: Ivan T. Ivanov +Cc: Andy Gross +Fixes: 327455817a92 "pinctrl: qcom: Add support for reset for apq8064" +Signed-off-by: Stephen Boyd +Signed-off-by: Linus Walleij +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pinctrl/qcom/pinctrl-msm.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/pinctrl/qcom/pinctrl-msm.c ++++ b/drivers/pinctrl/qcom/pinctrl-msm.c +@@ -865,10 +865,10 @@ static int msm_ps_hold_restart(struct no + + static void msm_pinctrl_setup_pm_reset(struct msm_pinctrl *pctrl) + { +- int i = 0; ++ int i; + const struct msm_function *func = pctrl->soc->functions; + +- for (; i <= pctrl->soc->nfunctions; i++) ++ for (i = 0; i < pctrl->soc->nfunctions; i++) + if (!strcmp(func[i].name, "ps_hold")) { + pctrl->restart_nb.notifier_call = msm_ps_hold_restart; + pctrl->restart_nb.priority = 128; diff --git a/queue-3.18/scripts-recordmcount.pl-there-is-no-m32-gcc-option-on-super-h-anymore.patch b/queue-3.18/scripts-recordmcount.pl-there-is-no-m32-gcc-option-on-super-h-anymore.patch new file mode 100644 index 00000000000..b4a78426f23 --- /dev/null +++ b/queue-3.18/scripts-recordmcount.pl-there-is-no-m32-gcc-option-on-super-h-anymore.patch @@ -0,0 +1,44 @@ +From 1caf6aaaa47471831d77c75f094d4e00ad1ec808 Mon Sep 17 00:00:00 2001 +From: Michael Karcher +Date: Sun, 18 Jan 2015 00:36:15 +0100 +Subject: scripts/recordmcount.pl: There is no -m32 gcc option on Super-H anymore + +From: Michael Karcher + +commit 1caf6aaaa47471831d77c75f094d4e00ad1ec808 upstream. + +Compiling SH with gcc-4.8 fails due to the -m32 option not being +supported. + +From http://buildd.debian-ports.org/status/fetch.php?pkg=linux&arch=sh4&ver=3.16.7-ckt4-1&stamp=1421425783 + + CC init/main.o + gcc-4.8: error: unrecognized command line option '-m32' + ld: cannot find init/.tmp_mc_main.o: No such file or directory + objcopy: 'init/.tmp_mx_main.o': No such file + rm: cannot remove 'init/.tmp_mx_main.o': No such file or directory + rm: cannot remove 'init/.tmp_mc_main.o': No such file or directory + +Link: http://lkml.kernel.org/r/1421537778-29001-1-git-send-email-kernel@mkarcher.dialup.fu-berlin.de +Link: http://lkml.kernel.org/r/54BCBDD4.10102@physik.fu-berlin.de + +Cc: Matt Fleming +Reported-by: John Paul Adrian Glaubitz +Signed-off-by: Michael Karcher +Signed-off-by: Steven Rostedt +Signed-off-by: Greg Kroah-Hartman + +--- + scripts/recordmcount.pl | 1 - + 1 file changed, 1 deletion(-) + +--- a/scripts/recordmcount.pl ++++ b/scripts/recordmcount.pl +@@ -255,7 +255,6 @@ if ($arch eq "x86_64") { + # force flags for this arch + $ld .= " -m shlelf_linux"; + $objcopy .= " -O elf32-sh-linux"; +- $cc .= " -m32"; + + } elsif ($arch eq "powerpc") { + $local_regex = "^[0-9a-fA-F]+\\s+t\\s+(\\.?\\S+)"; diff --git a/queue-3.18/series b/queue-3.18/series index e69de29bb2d..3fa027f2a48 100644 --- a/queue-3.18/series +++ b/queue-3.18/series @@ -0,0 +1,12 @@ +can-dev-fix-crtlmode_supported-check.patch +can-m_can-tag-current-can-fd-controllers-as-non-iso.patch +pinctrl-qcom-don-t-iterate-past-end-of-function-array.patch +pinctrl-fix-two-deadlocks.patch +mfd-tps65218-make-int-and-status-registers-volatile.patch +mfd-tps65218-make-int1-our-status_base-register.patch +mfd-rtsx_usb-fix-runtime-pm-deadlock.patch +libata-allow-sata_sil24-to-opt-out-of-tag-ordered-submission.patch +libata-prevent-hsm-state-change-race-between-isr-and-pio.patch +alsa-usb-audio-add-mic-volume-fix-quirk-for-logitech-webcam-c210.patch +workqueue-fix-subtle-pool-management-issue-which-can-stall-whole-worker_pool.patch +scripts-recordmcount.pl-there-is-no-m32-gcc-option-on-super-h-anymore.patch diff --git a/queue-3.18/workqueue-fix-subtle-pool-management-issue-which-can-stall-whole-worker_pool.patch b/queue-3.18/workqueue-fix-subtle-pool-management-issue-which-can-stall-whole-worker_pool.patch new file mode 100644 index 00000000000..4c0825f8b96 --- /dev/null +++ b/queue-3.18/workqueue-fix-subtle-pool-management-issue-which-can-stall-whole-worker_pool.patch @@ -0,0 +1,133 @@ +From 29187a9eeaf362d8422e62e17a22a6e115277a49 Mon Sep 17 00:00:00 2001 +From: Tejun Heo +Date: Fri, 16 Jan 2015 14:21:16 -0500 +Subject: workqueue: fix subtle pool management issue which can stall whole worker_pool + +From: Tejun Heo + +commit 29187a9eeaf362d8422e62e17a22a6e115277a49 upstream. + +A worker_pool's forward progress is guaranteed by the fact that the +last idle worker assumes the manager role to create more workers and +summon the rescuers if creating workers doesn't succeed in timely +manner before proceeding to execute work items. + +This manager role is implemented in manage_workers(), which indicates +whether the worker may proceed to work item execution with its return +value. This is necessary because multiple workers may contend for the +manager role, and, if there already is a manager, others should +proceed to work item execution. + +Unfortunately, the function also indicates that the worker may proceed +to work item execution if need_to_create_worker() is false at the head +of the function. need_to_create_worker() tests the following +conditions. + + pending work items && !nr_running && !nr_idle + +The first and third conditions are protected by pool->lock and thus +won't change while holding pool->lock; however, nr_running can change +asynchronously as other workers block and resume and while it's likely +to be zero, as someone woke this worker up in the first place, some +other workers could have become runnable inbetween making it non-zero. + +If this happens, manage_worker() could return false even with zero +nr_idle making the worker, the last idle one, proceed to execute work +items. If then all workers of the pool end up blocking on a resource +which can only be released by a work item which is pending on that +pool, the whole pool can deadlock as there's no one to create more +workers or summon the rescuers. + +This patch fixes the problem by removing the early exit condition from +maybe_create_worker() and making manage_workers() return false iff +there's already another manager, which ensures that the last worker +doesn't start executing work items. + +We can leave the early exit condition alone and just ignore the return +value but the only reason it was put there is because the +manage_workers() used to perform both creations and destructions of +workers and thus the function may be invoked while the pool is trying +to reduce the number of workers. Now that manage_workers() is called +only when more workers are needed, the only case this early exit +condition is triggered is rare race conditions rendering it pointless. + +Tested with simulated workload and modified workqueue code which +trigger the pool deadlock reliably without this patch. + +Signed-off-by: Tejun Heo +Reported-by: Eric Sandeen +Link: http://lkml.kernel.org/g/54B019F4.8030009@sandeen.net +Cc: Dave Chinner +Cc: Lai Jiangshan +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/workqueue.c | 25 ++++++++----------------- + 1 file changed, 8 insertions(+), 17 deletions(-) + +--- a/kernel/workqueue.c ++++ b/kernel/workqueue.c +@@ -1841,17 +1841,11 @@ static void pool_mayday_timeout(unsigned + * spin_lock_irq(pool->lock) which may be released and regrabbed + * multiple times. Does GFP_KERNEL allocations. Called only from + * manager. +- * +- * Return: +- * %false if no action was taken and pool->lock stayed locked, %true +- * otherwise. + */ +-static bool maybe_create_worker(struct worker_pool *pool) ++static void maybe_create_worker(struct worker_pool *pool) + __releases(&pool->lock) + __acquires(&pool->lock) + { +- if (!need_to_create_worker(pool)) +- return false; + restart: + spin_unlock_irq(&pool->lock); + +@@ -1877,7 +1871,6 @@ restart: + */ + if (need_to_create_worker(pool)) + goto restart; +- return true; + } + + /** +@@ -1897,16 +1890,14 @@ restart: + * multiple times. Does GFP_KERNEL allocations. + * + * Return: +- * %false if the pool don't need management and the caller can safely start +- * processing works, %true indicates that the function released pool->lock +- * and reacquired it to perform some management function and that the +- * conditions that the caller verified while holding the lock before +- * calling the function might no longer be true. ++ * %false if the pool doesn't need management and the caller can safely ++ * start processing works, %true if management function was performed and ++ * the conditions that the caller verified before calling the function may ++ * no longer be true. + */ + static bool manage_workers(struct worker *worker) + { + struct worker_pool *pool = worker->pool; +- bool ret = false; + + /* + * Anyone who successfully grabs manager_arb wins the arbitration +@@ -1919,12 +1910,12 @@ static bool manage_workers(struct worker + * actual management, the pool may stall indefinitely. + */ + if (!mutex_trylock(&pool->manager_arb)) +- return ret; ++ return false; + +- ret |= maybe_create_worker(pool); ++ maybe_create_worker(pool); + + mutex_unlock(&pool->manager_arb); +- return ret; ++ return true; + } + + /**