From: Greg Kroah-Hartman Date: Sat, 9 Nov 2013 06:33:44 +0000 (-0800) Subject: 3.10-stable patches X-Git-Tag: v3.4.69~2 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=efb6e0060dd696ac426bf83714e2c8152fde465c;p=thirdparty%2Fkernel%2Fstable-queue.git 3.10-stable patches added patches: drm-pad-drm_mode_get_connector-to-64-bit-boundary.patch drm-prevent-overwriting-from-userspace-underallocating-core-ioctl-structs.patch drm-radeon-atom-workaround-vbios-bug-in-transmitter-table-on-rs780.patch drm-vmwgfx-don-t-kill-clients-on-vt-switch.patch drm-vmwgfx-don-t-put-resources-with-invalid-id-s-on-lru-list.patch mm-pagewalk.c-fix-walk_page_range-access-of-wrong-ptes.patch mm-vmalloc.c-fix-an-overflow-bug-in-alloc_vmap_area.patch ntb-add-error-handling-in-ntb_device_setup.patch ntb-correct-debugfs-to-work-with-more-than-1-ntb-device.patch ntb-correct-number-of-scratch-pad-registers.patch ntb-correct-usd-dsd-identification.patch seq_file-always-update-file-f_pos-in-seq_lseek.patch --- diff --git a/queue-3.10/drm-pad-drm_mode_get_connector-to-64-bit-boundary.patch b/queue-3.10/drm-pad-drm_mode_get_connector-to-64-bit-boundary.patch new file mode 100644 index 00000000000..2d80b0f7285 --- /dev/null +++ b/queue-3.10/drm-pad-drm_mode_get_connector-to-64-bit-boundary.patch @@ -0,0 +1,52 @@ +From bc5bd37ce48c66e9192ad2e7231e9678880f6f8e Mon Sep 17 00:00:00 2001 +From: Chris Wilson +Date: Wed, 16 Oct 2013 09:49:02 +0100 +Subject: drm: Pad drm_mode_get_connector to 64-bit boundary + +From: Chris Wilson + +commit bc5bd37ce48c66e9192ad2e7231e9678880f6f8e upstream. + +Pavel Roskin reported that DRM_IOCTL_MODE_GETCONNECTOR was overwritting +the 4 bytes beyond the end of its structure with a 32-bit userspace +running on a 64-bit kernel. This is due to the padding gcc inserts as +the drm_mode_get_connector struct includes a u64 and its size is not a +natural multiple of u64s. + +64-bit kernel: + +sizeof(drm_mode_get_connector)=80, alignof=8 +sizeof(drm_mode_get_encoder)=20, alignof=4 +sizeof(drm_mode_modeinfo)=68, alignof=4 + +32-bit userspace: + +sizeof(drm_mode_get_connector)=76, alignof=4 +sizeof(drm_mode_get_encoder)=20, alignof=4 +sizeof(drm_mode_modeinfo)=68, alignof=4 + +Fortuituously we can insert explicit padding to the tail of our +structures without breaking ABI. + +Reported-by: Pavel Roskin +Signed-off-by: Chris Wilson +Cc: Dave Airlie +Cc: dri-devel@lists.freedesktop.org +Signed-off-by: Dave Airlie +Signed-off-by: Greg Kroah-Hartman + +--- + include/uapi/drm/drm_mode.h | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/include/uapi/drm/drm_mode.h ++++ b/include/uapi/drm/drm_mode.h +@@ -223,6 +223,8 @@ struct drm_mode_get_connector { + __u32 connection; + __u32 mm_width, mm_height; /**< HxW in millimeters */ + __u32 subpixel; ++ ++ __u32 pad; + }; + + #define DRM_MODE_PROP_PENDING (1<<0) diff --git a/queue-3.10/drm-prevent-overwriting-from-userspace-underallocating-core-ioctl-structs.patch b/queue-3.10/drm-prevent-overwriting-from-userspace-underallocating-core-ioctl-structs.patch new file mode 100644 index 00000000000..d137c43bacf --- /dev/null +++ b/queue-3.10/drm-prevent-overwriting-from-userspace-underallocating-core-ioctl-structs.patch @@ -0,0 +1,52 @@ +From b062672e305ce071f21eb9e18b102c2a430e0999 Mon Sep 17 00:00:00 2001 +From: Chris Wilson +Date: Wed, 16 Oct 2013 11:22:44 +0100 +Subject: drm: Prevent overwriting from userspace underallocating core ioctl structs + +From: Chris Wilson + +commit b062672e305ce071f21eb9e18b102c2a430e0999 upstream. + +Apply the protections from + +commit 1b2f1489633888d4a06028315dc19d65768a1c05 +Author: Dave Airlie +Date: Sat Aug 14 20:20:34 2010 +1000 + + drm: block userspace under allocating buffer and having drivers overwrite it (v2) + +to the core ioctl structs as well, for we found one instance where there +is a 32-/64-bit size mismatch and were guilty of writing beyond the end +of the user's buffer. + +Signed-off-by: Chris Wilson +Cc: Dave Airlie +Reviewed-by: Ville Syrjälä +Cc: dri-devel@lists.freedesktop.org +Signed-off-by: Dave Airlie +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/drm_drv.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/drm_drv.c ++++ b/drivers/gpu/drm/drm_drv.c +@@ -406,9 +406,16 @@ long drm_ioctl(struct file *filp, + cmd = ioctl->cmd_drv; + } + else if ((nr >= DRM_COMMAND_END) || (nr < DRM_COMMAND_BASE)) { ++ u32 drv_size; ++ + ioctl = &drm_ioctls[nr]; +- cmd = ioctl->cmd; ++ ++ drv_size = _IOC_SIZE(ioctl->cmd); + usize = asize = _IOC_SIZE(cmd); ++ if (drv_size > asize) ++ asize = drv_size; ++ ++ cmd = ioctl->cmd; + } else + goto err_i1; + diff --git a/queue-3.10/drm-radeon-atom-workaround-vbios-bug-in-transmitter-table-on-rs780.patch b/queue-3.10/drm-radeon-atom-workaround-vbios-bug-in-transmitter-table-on-rs780.patch new file mode 100644 index 00000000000..8faa8432d86 --- /dev/null +++ b/queue-3.10/drm-radeon-atom-workaround-vbios-bug-in-transmitter-table-on-rs780.patch @@ -0,0 +1,35 @@ +From c23632d4e57c0dd20bf50eca08fa0eb8ad3ff680 Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Thu, 10 Oct 2013 16:45:27 -0400 +Subject: drm/radeon/atom: workaround vbios bug in transmitter table on rs780 + +From: Alex Deucher + +commit c23632d4e57c0dd20bf50eca08fa0eb8ad3ff680 upstream. + +Some rs780 asics seem to be affected as well. + +See: +http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=91f3a6aaf280294b07c05dfe606e6c27b7ba3c72 + +Fixes: +https://bugzilla.kernel.org/show_bug.cgi?id=60791 + +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/radeon/atombios_encoders.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/radeon/atombios_encoders.c ++++ b/drivers/gpu/drm/radeon/atombios_encoders.c +@@ -1641,7 +1641,7 @@ radeon_atom_encoder_dpms_dig(struct drm_ + * does the same thing and more. + */ + if ((rdev->family != CHIP_RV710) && (rdev->family != CHIP_RV730) && +- (rdev->family != CHIP_RS880)) ++ (rdev->family != CHIP_RS780) && (rdev->family != CHIP_RS880)) + atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_ENABLE_OUTPUT, 0, 0); + } + if (ENCODER_MODE_IS_DP(atombios_get_encoder_mode(encoder)) && connector) { diff --git a/queue-3.10/drm-vmwgfx-don-t-kill-clients-on-vt-switch.patch b/queue-3.10/drm-vmwgfx-don-t-kill-clients-on-vt-switch.patch new file mode 100644 index 00000000000..a01d003be21 --- /dev/null +++ b/queue-3.10/drm-vmwgfx-don-t-kill-clients-on-vt-switch.patch @@ -0,0 +1,62 @@ +From c4249855ac5b2a383704d31e040d3831d6a25c6f Mon Sep 17 00:00:00 2001 +From: Thomas Hellstrom +Date: Wed, 9 Oct 2013 01:42:51 -0700 +Subject: drm/vmwgfx: Don't kill clients on VT switch + +From: Thomas Hellstrom + +commit c4249855ac5b2a383704d31e040d3831d6a25c6f upstream. + +DRI clients that tried to grab the TTM lock when the master (X server) was +switched away during a VT switch were sent the SIGTERM signal by the +kernel. Fix this so that they are only sent that signal when the master has +exited. + +Signed-off-by: Thomas Hellstrom +Reviewed-by: Jakob Bornecrantz +Signed-off-by: Dave Airlie +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/vmwgfx/vmwgfx_drv.c | 17 ++++++++++++----- + 1 file changed, 12 insertions(+), 5 deletions(-) + +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c +@@ -740,9 +740,17 @@ static void vmw_postclose(struct drm_dev + struct vmw_fpriv *vmw_fp; + + vmw_fp = vmw_fpriv(file_priv); +- ttm_object_file_release(&vmw_fp->tfile); +- if (vmw_fp->locked_master) ++ ++ if (vmw_fp->locked_master) { ++ struct vmw_master *vmaster = ++ vmw_master(vmw_fp->locked_master); ++ ++ ttm_lock_set_kill(&vmaster->lock, true, SIGTERM); ++ ttm_vt_unlock(&vmaster->lock); + drm_master_put(&vmw_fp->locked_master); ++ } ++ ++ ttm_object_file_release(&vmw_fp->tfile); + kfree(vmw_fp); + } + +@@ -942,14 +950,13 @@ static void vmw_master_drop(struct drm_d + + vmw_fp->locked_master = drm_master_get(file_priv->master); + ret = ttm_vt_lock(&vmaster->lock, false, vmw_fp->tfile); +- vmw_execbuf_release_pinned_bo(dev_priv); +- + if (unlikely((ret != 0))) { + DRM_ERROR("Unable to lock TTM at VT switch.\n"); + drm_master_put(&vmw_fp->locked_master); + } + +- ttm_lock_set_kill(&vmaster->lock, true, SIGTERM); ++ ttm_lock_set_kill(&vmaster->lock, false, SIGTERM); ++ vmw_execbuf_release_pinned_bo(dev_priv); + + if (!dev_priv->enable_fb) { + ret = ttm_bo_evict_mm(&dev_priv->bdev, TTM_PL_VRAM); diff --git a/queue-3.10/drm-vmwgfx-don-t-put-resources-with-invalid-id-s-on-lru-list.patch b/queue-3.10/drm-vmwgfx-don-t-put-resources-with-invalid-id-s-on-lru-list.patch new file mode 100644 index 00000000000..24342f20807 --- /dev/null +++ b/queue-3.10/drm-vmwgfx-don-t-put-resources-with-invalid-id-s-on-lru-list.patch @@ -0,0 +1,32 @@ +From 26682480c202e7360cbcdc3bc9e962bf749c6b8d Mon Sep 17 00:00:00 2001 +From: Thomas Hellstrom +Date: Wed, 9 Oct 2013 01:42:50 -0700 +Subject: drm/vmwgfx: Don't put resources with invalid id's on lru list + +From: Thomas Hellstrom + +commit 26682480c202e7360cbcdc3bc9e962bf749c6b8d upstream. + +The evict code may try to swap them out causing a BUG in the destroy +function. + +Signed-off-by: Thomas Hellstrom +Reviewed-by: Jakob Bornecrantz +Signed-off-by: Dave Airlie +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/vmwgfx/vmwgfx_resource.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c +@@ -970,7 +970,7 @@ void vmw_resource_unreserve(struct vmw_r + if (new_backup) + res->backup_offset = new_backup_offset; + +- if (!res->func->may_evict) ++ if (!res->func->may_evict || res->id == -1) + return; + + write_lock(&dev_priv->resource_lock); diff --git a/queue-3.10/mm-pagewalk.c-fix-walk_page_range-access-of-wrong-ptes.patch b/queue-3.10/mm-pagewalk.c-fix-walk_page_range-access-of-wrong-ptes.patch new file mode 100644 index 00000000000..44e79faaaf8 --- /dev/null +++ b/queue-3.10/mm-pagewalk.c-fix-walk_page_range-access-of-wrong-ptes.patch @@ -0,0 +1,53 @@ +From 3017f079efd6af199b0852b5c425364513db460e Mon Sep 17 00:00:00 2001 +From: Chen LinX +Date: Wed, 30 Oct 2013 13:56:18 -0700 +Subject: mm/pagewalk.c: fix walk_page_range() access of wrong PTEs + +From: Chen LinX + +commit 3017f079efd6af199b0852b5c425364513db460e upstream. + +When walk_page_range walk a memory map's page tables, it'll skip +VM_PFNMAP area, then variable 'next' will to assign to vma->vm_end, it +maybe larger than 'end'. In next loop, 'addr' will be larger than +'next'. Then in /proc/XXXX/pagemap file reading procedure, the 'addr' +will growing forever in pagemap_pte_range, pte_to_pagemap_entry will +access the wrong pte. + + BUG: Bad page map in process procrank pte:8437526f pmd:785de067 + addr:9108d000 vm_flags:00200073 anon_vma:f0d99020 mapping: (null) index:9108d + CPU: 1 PID: 4974 Comm: procrank Tainted: G B W O 3.10.1+ #1 + Call Trace: + dump_stack+0x16/0x18 + print_bad_pte+0x114/0x1b0 + vm_normal_page+0x56/0x60 + pagemap_pte_range+0x17a/0x1d0 + walk_page_range+0x19e/0x2c0 + pagemap_read+0x16e/0x200 + vfs_read+0x84/0x150 + SyS_read+0x4a/0x80 + syscall_call+0x7/0xb + +Signed-off-by: Liu ShuoX +Signed-off-by: Chen LinX +Acked-by: Kirill A. Shutemov +Reviewed-by: Naoya Horiguchi +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/pagewalk.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/mm/pagewalk.c ++++ b/mm/pagewalk.c +@@ -242,7 +242,7 @@ int walk_page_range(unsigned long addr, + if (err) + break; + pgd++; +- } while (addr = next, addr != end); ++ } while (addr = next, addr < end); + + return err; + } diff --git a/queue-3.10/mm-vmalloc.c-fix-an-overflow-bug-in-alloc_vmap_area.patch b/queue-3.10/mm-vmalloc.c-fix-an-overflow-bug-in-alloc_vmap_area.patch new file mode 100644 index 00000000000..3c2e2581da4 --- /dev/null +++ b/queue-3.10/mm-vmalloc.c-fix-an-overflow-bug-in-alloc_vmap_area.patch @@ -0,0 +1,65 @@ +From bcb615a81b1765864c71c50afb56631e7a1e5283 Mon Sep 17 00:00:00 2001 +From: Zhang Yanfei +Date: Mon, 8 Jul 2013 16:00:19 -0700 +Subject: mm/vmalloc.c: fix an overflow bug in alloc_vmap_area() + +From: Zhang Yanfei + +commit bcb615a81b1765864c71c50afb56631e7a1e5283 upstream. + +When searching a vmap area in the vmalloc space, we use (addr + size - +1) to check if the value is less than addr, which is an overflow. But +we assign (addr + size) to vmap_area->va_end. + +So if we come across the below case: + + (addr + size - 1) : not overflow + (addr + size) : overflow + +we will assign an overflow value (e.g 0) to vmap_area->va_end, And this +will trigger BUG in __insert_vmap_area, causing system panic. + +So using (addr + size) to check the overflow should be the correct +behaviour, not (addr + size - 1). + +Signed-off-by: Zhang Yanfei +Reported-by: Ghennadi Procopciuc +Tested-by: Daniel Baluta +Cc: David Rientjes +Cc: Minchan Kim +Cc: KOSAKI Motohiro +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Cc: Anatoly Muliarski +Signed-off-by: Greg Kroah-Hartman + +--- + mm/vmalloc.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/mm/vmalloc.c ++++ b/mm/vmalloc.c +@@ -388,12 +388,12 @@ nocache: + addr = ALIGN(first->va_end, align); + if (addr < vstart) + goto nocache; +- if (addr + size - 1 < addr) ++ if (addr + size < addr) + goto overflow; + + } else { + addr = ALIGN(vstart, align); +- if (addr + size - 1 < addr) ++ if (addr + size < addr) + goto overflow; + + n = vmap_area_root.rb_node; +@@ -420,7 +420,7 @@ nocache: + if (addr + cached_hole_size < first->va_start) + cached_hole_size = first->va_start - addr; + addr = ALIGN(first->va_end, align); +- if (addr + size - 1 < addr) ++ if (addr + size < addr) + goto overflow; + + if (list_is_last(&first->list, &vmap_area_list)) diff --git a/queue-3.10/ntb-add-error-handling-in-ntb_device_setup.patch b/queue-3.10/ntb-add-error-handling-in-ntb_device_setup.patch new file mode 100644 index 00000000000..25424b14405 --- /dev/null +++ b/queue-3.10/ntb-add-error-handling-in-ntb_device_setup.patch @@ -0,0 +1,40 @@ +From 3b12a0d15bd1559e72ad21d9d807fd2a6706f0ab Mon Sep 17 00:00:00 2001 +From: Jon Mason +Date: Mon, 15 Jul 2013 13:23:47 -0700 +Subject: NTB: Add Error Handling in ntb_device_setup + +From: Jon Mason + +commit 3b12a0d15bd1559e72ad21d9d807fd2a6706f0ab upstream. + +If an error is encountered in ntb_device_setup, it is possible that the +spci_cmd isn't populated. Writes to the offset can result in a NULL +pointer dereference. This issue is easily encountered by running in +NTB-RP mode, as it currently is not supported and will generate an +error. To get around this issue, return if an error is encountered +prior to attempting to write to the spci_cmd offset. + +Signed-off-by: Jon Mason +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ntb/ntb_hw.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/drivers/ntb/ntb_hw.c ++++ b/drivers/ntb/ntb_hw.c +@@ -644,10 +644,13 @@ static int ntb_device_setup(struct ntb_d + rc = -ENODEV; + } + ++ if (rc) ++ return rc; ++ + /* Enable Bus Master and Memory Space on the secondary side */ + writew(PCI_COMMAND_MEMORY | PCI_COMMAND_MASTER, ndev->reg_ofs.spci_cmd); + +- return rc; ++ return 0; + } + + static void ntb_device_free(struct ntb_device *ndev) diff --git a/queue-3.10/ntb-correct-debugfs-to-work-with-more-than-1-ntb-device.patch b/queue-3.10/ntb-correct-debugfs-to-work-with-more-than-1-ntb-device.patch new file mode 100644 index 00000000000..185372dee2f --- /dev/null +++ b/queue-3.10/ntb-correct-debugfs-to-work-with-more-than-1-ntb-device.patch @@ -0,0 +1,187 @@ +From 1517a3f21a1dd321f16bcf44204bddff9d21abd0 Mon Sep 17 00:00:00 2001 +From: Jon Mason +Date: Tue, 30 Jul 2013 15:58:49 -0700 +Subject: NTB: Correct debugfs to work with more than 1 NTB Device + +From: Jon Mason + +commit 1517a3f21a1dd321f16bcf44204bddff9d21abd0 upstream. + +Debugfs was setup in NTB to only have a single debugfs directory. This +resulted in the leaking of debugfs directories and files when multiple +NTB devices were present, due to each device stomping on the variables +containing the previous device's values (thus preventing them from being +freed on cleanup). Correct this by creating a secondary directory of +the PCI BDF for each device present, and nesting the previously existing +information in those directories. + +Signed-off-by: Jon Mason +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ntb/ntb_hw.c | 27 +++++++++++++++++++++++++++ + drivers/ntb/ntb_hw.h | 16 ++++++++++++++++ + drivers/ntb/ntb_transport.c | 17 +++++------------ + 3 files changed, 48 insertions(+), 12 deletions(-) + +--- a/drivers/ntb/ntb_hw.c ++++ b/drivers/ntb/ntb_hw.c +@@ -78,6 +78,8 @@ enum { + BWD_HW, + }; + ++static struct dentry *debugfs_dir; ++ + /* Translate memory window 0,1 to BAR 2,4 */ + #define MW_TO_BAR(mw) (mw * 2 + 2) + +@@ -998,6 +1000,28 @@ static void ntb_free_callbacks(struct nt + kfree(ndev->db_cb); + } + ++static void ntb_setup_debugfs(struct ntb_device *ndev) ++{ ++ if (!debugfs_initialized()) ++ return; ++ ++ if (!debugfs_dir) ++ debugfs_dir = debugfs_create_dir(KBUILD_MODNAME, NULL); ++ ++ ndev->debugfs_dir = debugfs_create_dir(pci_name(ndev->pdev), ++ debugfs_dir); ++} ++ ++static void ntb_free_debugfs(struct ntb_device *ndev) ++{ ++ debugfs_remove_recursive(ndev->debugfs_dir); ++ ++ if (debugfs_dir && simple_empty(debugfs_dir)) { ++ debugfs_remove_recursive(debugfs_dir); ++ debugfs_dir = NULL; ++ } ++} ++ + static int ntb_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id) + { + struct ntb_device *ndev; +@@ -1010,6 +1034,7 @@ static int ntb_pci_probe(struct pci_dev + ndev->pdev = pdev; + ndev->link_status = NTB_LINK_DOWN; + pci_set_drvdata(pdev, ndev); ++ ntb_setup_debugfs(ndev); + + rc = pci_enable_device(pdev); + if (rc) +@@ -1106,6 +1131,7 @@ err2: + err1: + pci_disable_device(pdev); + err: ++ ntb_free_debugfs(ndev); + kfree(ndev); + + dev_err(&pdev->dev, "Error loading %s module\n", KBUILD_MODNAME); +@@ -1135,6 +1161,7 @@ static void ntb_pci_remove(struct pci_de + iounmap(ndev->reg_base); + pci_release_selected_regions(pdev, NTB_BAR_MASK); + pci_disable_device(pdev); ++ ntb_free_debugfs(ndev); + kfree(ndev); + } + +--- a/drivers/ntb/ntb_hw.h ++++ b/drivers/ntb/ntb_hw.h +@@ -127,6 +127,8 @@ struct ntb_device { + unsigned char link_status; + struct delayed_work hb_timer; + unsigned long last_ts; ++ ++ struct dentry *debugfs_dir; + }; + + /** +@@ -155,6 +157,20 @@ static inline struct pci_dev *ntb_query_ + return ndev->pdev; + } + ++/** ++ * ntb_query_debugfs() - return the debugfs pointer ++ * @ndev: pointer to ntb_device instance ++ * ++ * Given the ntb pointer, return the debugfs directory pointer for the NTB ++ * hardware device ++ * ++ * RETURNS: a pointer to the debugfs directory ++ */ ++static inline struct dentry *ntb_query_debugfs(struct ntb_device *ndev) ++{ ++ return ndev->debugfs_dir; ++} ++ + struct ntb_device *ntb_register_transport(struct pci_dev *pdev, + void *transport); + void ntb_unregister_transport(struct ntb_device *ndev); +--- a/drivers/ntb/ntb_transport.c ++++ b/drivers/ntb/ntb_transport.c +@@ -157,7 +157,6 @@ struct ntb_transport { + bool transport_link; + struct delayed_work link_work; + struct work_struct link_cleanup; +- struct dentry *debugfs_dir; + }; + + enum { +@@ -824,12 +823,12 @@ static void ntb_transport_init_queue(str + qp->tx_max_frame = min(transport_mtu, tx_size / 2); + qp->tx_max_entry = tx_size / qp->tx_max_frame; + +- if (nt->debugfs_dir) { ++ if (ntb_query_debugfs(nt->ndev)) { + char debugfs_name[4]; + + snprintf(debugfs_name, 4, "qp%d", qp_num); + qp->debugfs_dir = debugfs_create_dir(debugfs_name, +- nt->debugfs_dir); ++ ntb_query_debugfs(nt->ndev)); + + qp->debugfs_stats = debugfs_create_file("stats", S_IRUSR, + qp->debugfs_dir, qp, +@@ -857,11 +856,6 @@ int ntb_transport_init(struct pci_dev *p + if (!nt) + return -ENOMEM; + +- if (debugfs_initialized()) +- nt->debugfs_dir = debugfs_create_dir(KBUILD_MODNAME, NULL); +- else +- nt->debugfs_dir = NULL; +- + nt->ndev = ntb_register_transport(pdev, nt); + if (!nt->ndev) { + rc = -EIO; +@@ -907,7 +901,6 @@ err2: + err1: + ntb_unregister_transport(nt->ndev); + err: +- debugfs_remove_recursive(nt->debugfs_dir); + kfree(nt); + return rc; + } +@@ -921,16 +914,16 @@ void ntb_transport_free(void *transport) + nt->transport_link = NTB_LINK_DOWN; + + /* verify that all the qp's are freed */ +- for (i = 0; i < nt->max_qps; i++) ++ for (i = 0; i < nt->max_qps; i++) { + if (!test_bit(i, &nt->qp_bitmap)) + ntb_transport_free_queue(&nt->qps[i]); ++ debugfs_remove_recursive(nt->qps[i].debugfs_dir); ++ } + + ntb_bus_remove(nt); + + cancel_delayed_work_sync(&nt->link_work); + +- debugfs_remove_recursive(nt->debugfs_dir); +- + ntb_unregister_event_callback(nt->ndev); + + pdev = ntb_query_pdev(nt->ndev); diff --git a/queue-3.10/ntb-correct-number-of-scratch-pad-registers.patch b/queue-3.10/ntb-correct-number-of-scratch-pad-registers.patch new file mode 100644 index 00000000000..cb6abc0f8c6 --- /dev/null +++ b/queue-3.10/ntb-correct-number-of-scratch-pad-registers.patch @@ -0,0 +1,45 @@ +From 87034511519815259e37336f52edf06d114d43b6 Mon Sep 17 00:00:00 2001 +From: Jon Mason +Date: Mon, 15 Jul 2013 15:26:14 -0700 +Subject: NTB: Correct Number of Scratch Pad Registers + +From: Jon Mason + +commit 87034511519815259e37336f52edf06d114d43b6 upstream. + +The NTB Xeon hardware has 16 scratch pad registers and 16 back-to-back +scratch pad registers. Correct the #define to represent this and update +the variable names to reflect their usage. + +Signed-off-by: Jon Mason +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ntb/ntb_hw.c | 2 +- + drivers/ntb/ntb_regs.h | 4 ++-- + 2 files changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/ntb/ntb_hw.c ++++ b/drivers/ntb/ntb_hw.c +@@ -547,7 +547,7 @@ static int ntb_xeon_setup(struct ntb_dev + if (ndev->conn_type == NTB_CONN_B2B) { + ndev->reg_ofs.sdb = ndev->reg_base + SNB_B2B_DOORBELL_OFFSET; + ndev->reg_ofs.spad_write = ndev->reg_base + SNB_B2B_SPAD_OFFSET; +- ndev->limits.max_spads = SNB_MAX_SPADS; ++ ndev->limits.max_spads = SNB_MAX_B2B_SPADS; + } else { + ndev->reg_ofs.sdb = ndev->reg_base + SNB_SDOORBELL_OFFSET; + ndev->reg_ofs.spad_write = ndev->reg_base + SNB_SPAD_OFFSET; +--- a/drivers/ntb/ntb_regs.h ++++ b/drivers/ntb/ntb_regs.h +@@ -53,8 +53,8 @@ + #define NTB_LINK_WIDTH_MASK 0x03f0 + + #define SNB_MSIX_CNT 4 +-#define SNB_MAX_SPADS 16 +-#define SNB_MAX_COMPAT_SPADS 8 ++#define SNB_MAX_B2B_SPADS 16 ++#define SNB_MAX_COMPAT_SPADS 16 + /* Reserve the uppermost bit for link interrupt */ + #define SNB_MAX_DB_BITS 15 + #define SNB_DB_BITS_PER_VEC 5 diff --git a/queue-3.10/ntb-correct-usd-dsd-identification.patch b/queue-3.10/ntb-correct-usd-dsd-identification.patch new file mode 100644 index 00000000000..dbe6db6dd3f --- /dev/null +++ b/queue-3.10/ntb-correct-usd-dsd-identification.patch @@ -0,0 +1,44 @@ +From b6750cfe0710a14fd147ba27fddbecae8ba88c77 Mon Sep 17 00:00:00 2001 +From: Jon Mason +Date: Fri, 31 May 2013 14:05:53 -0700 +Subject: NTB: Correct USD/DSD Identification + +From: Jon Mason + +commit b6750cfe0710a14fd147ba27fddbecae8ba88c77 upstream. + +Due to ambiguous documentation, the USD/DSD identification is backward +when compared to the setting in BIOS. Correct the bits to match the +BIOS setting. + +Signed-off-by: Jon Mason +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ntb/ntb_hw.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/drivers/ntb/ntb_hw.c ++++ b/drivers/ntb/ntb_hw.c +@@ -531,9 +531,9 @@ static int ntb_xeon_setup(struct ntb_dev + } + + if (val & SNB_PPD_DEV_TYPE) +- ndev->dev_type = NTB_DEV_DSD; +- else + ndev->dev_type = NTB_DEV_USD; ++ else ++ ndev->dev_type = NTB_DEV_DSD; + + ndev->reg_ofs.pdb = ndev->reg_base + SNB_PDOORBELL_OFFSET; + ndev->reg_ofs.pdb_mask = ndev->reg_base + SNB_PDBMSK_OFFSET; +@@ -647,6 +647,9 @@ static int ntb_device_setup(struct ntb_d + if (rc) + return rc; + ++ dev_info(&ndev->pdev->dev, "Device Type = %s\n", ++ ndev->dev_type == NTB_DEV_USD ? "USD/DSP" : "DSD/USP"); ++ + /* Enable Bus Master and Memory Space on the secondary side */ + writew(PCI_COMMAND_MEMORY | PCI_COMMAND_MASTER, ndev->reg_ofs.spci_cmd); + diff --git a/queue-3.10/seq_file-always-update-file-f_pos-in-seq_lseek.patch b/queue-3.10/seq_file-always-update-file-f_pos-in-seq_lseek.patch new file mode 100644 index 00000000000..ace1fc4b752 --- /dev/null +++ b/queue-3.10/seq_file-always-update-file-f_pos-in-seq_lseek.patch @@ -0,0 +1,70 @@ +From 05e16745c0c471bba313961b605b6da3b21a853d Mon Sep 17 00:00:00 2001 +From: Gu Zheng +Date: Fri, 25 Oct 2013 18:15:06 +0800 +Subject: seq_file: always update file->f_pos in seq_lseek() + +From: Gu Zheng + +commit 05e16745c0c471bba313961b605b6da3b21a853d upstream. + +This issue was first pointed out by Jiaxing Wang several months ago, but no +further comments: +https://lkml.org/lkml/2013/6/29/41 + +As we know pread() does not change f_pos, so after pread(), file->f_pos +and m->read_pos become different. And seq_lseek() does not update file->f_pos +if offset equals to m->read_pos, so after pread() and seq_lseek()(lseek to +m->read_pos), then a subsequent read may read from a wrong position, the +following program produces the problem: + + char str1[32] = { 0 }; + char str2[32] = { 0 }; + int poffset = 10; + int count = 20; + + /*open any seq file*/ + int fd = open("/proc/modules", O_RDONLY); + + pread(fd, str1, count, poffset); + printf("pread:%s\n", str1); + + /*seek to where m->read_pos is*/ + lseek(fd, poffset+count, SEEK_SET); + + /*supposed to read from poffset+count, but this read from position 0*/ + read(fd, str2, count); + printf("read:%s\n", str2); + +out put: +pread: + ck_netbios_ns 12665 +read: + nf_conntrack_netbios + +/proc/modules: +nf_conntrack_netbios_ns 12665 0 - Live 0xffffffffa038b000 +nf_conntrack_broadcast 12589 1 nf_conntrack_netbios_ns, Live 0xffffffffa0386000 + +So we always update file->f_pos to offset in seq_lseek() to fix this issue. + +Signed-off-by: Jiaxing Wang +Signed-off-by: Gu Zheng +Signed-off-by: Al Viro +Cc: Jonghwan Choi +Signed-off-by: Greg Kroah-Hartman + +--- + fs/seq_file.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/fs/seq_file.c ++++ b/fs/seq_file.c +@@ -328,6 +328,8 @@ loff_t seq_lseek(struct file *file, loff + m->read_pos = offset; + retval = file->f_pos = offset; + } ++ } else { ++ file->f_pos = offset; + } + } + file->f_version = m->version; diff --git a/queue-3.10/series b/queue-3.10/series index b9767842747..48e1f321f40 100644 --- a/queue-3.10/series +++ b/queue-3.10/series @@ -60,3 +60,15 @@ mm-prevent-parallel-splits-during-thp-migration.patch mm-numa-sanitize-task_numa_fault-callsites.patch mm-close-races-between-thp-migration-and-pmd-numa-clearing.patch mm-account-for-a-thp-numa-hinting-update-as-one-pte-update.patch +mm-pagewalk.c-fix-walk_page_range-access-of-wrong-ptes.patch +mm-vmalloc.c-fix-an-overflow-bug-in-alloc_vmap_area.patch +drm-vmwgfx-don-t-put-resources-with-invalid-id-s-on-lru-list.patch +drm-vmwgfx-don-t-kill-clients-on-vt-switch.patch +drm-prevent-overwriting-from-userspace-underallocating-core-ioctl-structs.patch +drm-pad-drm_mode_get_connector-to-64-bit-boundary.patch +drm-radeon-atom-workaround-vbios-bug-in-transmitter-table-on-rs780.patch +seq_file-always-update-file-f_pos-in-seq_lseek.patch +ntb-add-error-handling-in-ntb_device_setup.patch +ntb-correct-number-of-scratch-pad-registers.patch +ntb-correct-usd-dsd-identification.patch +ntb-correct-debugfs-to-work-with-more-than-1-ntb-device.patch