From b224b8053c298081bb8bf6685247adfa3671345f Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Thu, 2 May 2013 20:25:08 -0700 Subject: [PATCH] 3.8-stable patches added patches: arm-set-the-page-table-freeing-ceiling-to-task_size.patch gianfar-do-not-advertise-any-alarm-capability.patch s390-memory-hotplug-prevent-offline-of-active-memory-increments.patch serial_core.c-add-put_device-after-device_find_child.patch tty-fix-up-atime-mtime-mess-take-three.patch usb-add-ftdi_sio-usb-id-for-gdm-boost-v1.x.patch usb-chipidea-udc-fix-memory-access-of-shared-memory-on-armv5-machines.patch usb-chipidea-udc-fix-memory-leak-in-_ep_nuke.patch usbfs-always-allow-ctrl-requests-with-usb_recip_endpoint-on-the-ctrl-ep.patch usb-ftdi_sio-correct-st-micro-connect-lite-pids.patch usb-ftdi_sio-enable-two-uart-ports-on-st-microconnect-lite.patch usb-misc-appledisplay-add-24-led-cinema-display.patch usb-remove-redundant-tdi_reset.patch usb-storage-cy7c68300a-chips-do-not-support-cypress-atacb.patch xen-smp-fix-leakage-of-timer-interrupt-line-for-every-cpu-online-offline.patch xen-smp-spinlock-fix-leakage-of-the-spinlock-interrupt-line-for-every-cpu-online-offline.patch xen-time-fix-kasprintf-splat-when-allocating-timer-d-irq-line.patch --- ...e-table-freeing-ceiling-to-task_size.patch | 55 +++++++++++ ...o-not-advertise-any-alarm-capability.patch | 44 +++++++++ ...-offline-of-active-memory-increments.patch | 58 +++++++++++ ...d-put_device-after-device_find_child.patch | 98 +++++++++++++++++++ queue-3.8/series | 17 ++++ ...y-fix-up-atime-mtime-mess-take-three.patch | 63 ++++++++++++ ...d-ftdi_sio-usb-id-for-gdm-boost-v1.x.patch | 41 ++++++++ ...s-of-shared-memory-on-armv5-machines.patch | 81 +++++++++++++++ ...idea-udc-fix-memory-leak-in-_ep_nuke.patch | 37 +++++++ ...o-correct-st-micro-connect-lite-pids.patch | 51 ++++++++++ ...o-uart-ports-on-st-microconnect-lite.patch | 56 +++++++++++ ...pledisplay-add-24-led-cinema-display.patch | 28 ++++++ .../usb-remove-redundant-tdi_reset.patch | 35 +++++++ ...a-chips-do-not-support-cypress-atacb.patch | 75 ++++++++++++++ ...th-usb_recip_endpoint-on-the-ctrl-ep.patch | 46 +++++++++ ...pt-line-for-every-cpu-online-offline.patch | 59 +++++++++++ ...pt-line-for-every-cpu-online-offline.patch | 72 ++++++++++++++ ...lat-when-allocating-timer-d-irq-line.patch | 73 ++++++++++++++ 18 files changed, 989 insertions(+) create mode 100644 queue-3.8/arm-set-the-page-table-freeing-ceiling-to-task_size.patch create mode 100644 queue-3.8/gianfar-do-not-advertise-any-alarm-capability.patch create mode 100644 queue-3.8/s390-memory-hotplug-prevent-offline-of-active-memory-increments.patch create mode 100644 queue-3.8/serial_core.c-add-put_device-after-device_find_child.patch create mode 100644 queue-3.8/tty-fix-up-atime-mtime-mess-take-three.patch create mode 100644 queue-3.8/usb-add-ftdi_sio-usb-id-for-gdm-boost-v1.x.patch create mode 100644 queue-3.8/usb-chipidea-udc-fix-memory-access-of-shared-memory-on-armv5-machines.patch create mode 100644 queue-3.8/usb-chipidea-udc-fix-memory-leak-in-_ep_nuke.patch create mode 100644 queue-3.8/usb-ftdi_sio-correct-st-micro-connect-lite-pids.patch create mode 100644 queue-3.8/usb-ftdi_sio-enable-two-uart-ports-on-st-microconnect-lite.patch create mode 100644 queue-3.8/usb-misc-appledisplay-add-24-led-cinema-display.patch create mode 100644 queue-3.8/usb-remove-redundant-tdi_reset.patch create mode 100644 queue-3.8/usb-storage-cy7c68300a-chips-do-not-support-cypress-atacb.patch create mode 100644 queue-3.8/usbfs-always-allow-ctrl-requests-with-usb_recip_endpoint-on-the-ctrl-ep.patch create mode 100644 queue-3.8/xen-smp-fix-leakage-of-timer-interrupt-line-for-every-cpu-online-offline.patch create mode 100644 queue-3.8/xen-smp-spinlock-fix-leakage-of-the-spinlock-interrupt-line-for-every-cpu-online-offline.patch create mode 100644 queue-3.8/xen-time-fix-kasprintf-splat-when-allocating-timer-d-irq-line.patch diff --git a/queue-3.8/arm-set-the-page-table-freeing-ceiling-to-task_size.patch b/queue-3.8/arm-set-the-page-table-freeing-ceiling-to-task_size.patch new file mode 100644 index 00000000000..e3d0670d7fd --- /dev/null +++ b/queue-3.8/arm-set-the-page-table-freeing-ceiling-to-task_size.patch @@ -0,0 +1,55 @@ +From 104ad3b32d7a71941c8ab2dee78eea38e8a23309 Mon Sep 17 00:00:00 2001 +From: Catalin Marinas +Date: Mon, 29 Apr 2013 15:07:45 -0700 +Subject: arm: set the page table freeing ceiling to TASK_SIZE + +From: Catalin Marinas + +commit 104ad3b32d7a71941c8ab2dee78eea38e8a23309 upstream. + +ARM processors with LPAE enabled use 3 levels of page tables, with an +entry in the top level (pgd) covering 1GB of virtual space. Because of +the branch relocation limitations on ARM, the loadable modules are +mapped 16MB below PAGE_OFFSET, making the corresponding 1GB pgd shared +between kernel modules and user space. + +If free_pgtables() is called with the default ceiling 0, +free_pgd_range() (and subsequently called functions) also frees the page +table shared between user space and kernel modules (which is normally +handled by the ARM-specific pgd_free() function). This patch changes +defines the ARM USER_PGTABLES_CEILING to TASK_SIZE when CONFIG_ARM_LPAE +is enabled. + +Note that the pgd_free() function already checks the presence of the +shared pmd page allocated by pgd_alloc() and frees it, though with +ceiling 0 this wasn't necessary. + +Signed-off-by: Catalin Marinas +Cc: Russell King +Cc: Hugh Dickins +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/include/asm/pgtable.h | 9 +++++++++ + 1 file changed, 9 insertions(+) + +--- a/arch/arm/include/asm/pgtable.h ++++ b/arch/arm/include/asm/pgtable.h +@@ -61,6 +61,15 @@ extern void __pgd_error(const char *file + #define FIRST_USER_ADDRESS PAGE_SIZE + + /* ++ * Use TASK_SIZE as the ceiling argument for free_pgtables() and ++ * free_pgd_range() to avoid freeing the modules pmd when LPAE is enabled (pmd ++ * page shared between user and kernel). ++ */ ++#ifdef CONFIG_ARM_LPAE ++#define USER_PGTABLES_CEILING TASK_SIZE ++#endif ++ ++/* + * The pgprot_* and protection_map entries will be fixed up in runtime + * to include the cachable and bufferable bits based on memory policy, + * as well as any architecture dependent bits like global/ASID and SMP diff --git a/queue-3.8/gianfar-do-not-advertise-any-alarm-capability.patch b/queue-3.8/gianfar-do-not-advertise-any-alarm-capability.patch new file mode 100644 index 00000000000..d2ba07648b2 --- /dev/null +++ b/queue-3.8/gianfar-do-not-advertise-any-alarm-capability.patch @@ -0,0 +1,44 @@ +From cd4baaaa04b4aaa3b0ec4d13a6f3d203b92eadbd Mon Sep 17 00:00:00 2001 +From: Richard Cochran +Date: Mon, 22 Apr 2013 19:42:16 +0000 +Subject: gianfar: do not advertise any alarm capability. + +From: Richard Cochran + +commit cd4baaaa04b4aaa3b0ec4d13a6f3d203b92eadbd upstream. + +An early draft of the PHC patch series included an alarm in the +gianfar driver. During the review process, the alarm code was dropped, +but the capability removal was overlooked. This patch fixes the issue +by advertising zero alarms. + +This patch should be applied to every 3.x stable kernel. + +Signed-off-by: Richard Cochran +Reported-by: Chris LaRocque +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/ethernet/freescale/gianfar_ptp.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/drivers/net/ethernet/freescale/gianfar_ptp.c ++++ b/drivers/net/ethernet/freescale/gianfar_ptp.c +@@ -127,7 +127,6 @@ struct gianfar_ptp_registers { + + #define DRIVER "gianfar_ptp" + #define DEFAULT_CKSEL 1 +-#define N_ALARM 1 /* first alarm is used internally to reset fipers */ + #define N_EXT_TS 2 + #define REG_SIZE sizeof(struct gianfar_ptp_registers) + +@@ -410,7 +409,7 @@ static struct ptp_clock_info ptp_gianfar + .owner = THIS_MODULE, + .name = "gianfar clock", + .max_adj = 512000, +- .n_alarm = N_ALARM, ++ .n_alarm = 0, + .n_ext_ts = N_EXT_TS, + .n_per_out = 0, + .pps = 1, diff --git a/queue-3.8/s390-memory-hotplug-prevent-offline-of-active-memory-increments.patch b/queue-3.8/s390-memory-hotplug-prevent-offline-of-active-memory-increments.patch new file mode 100644 index 00000000000..c7d24478e93 --- /dev/null +++ b/queue-3.8/s390-memory-hotplug-prevent-offline-of-active-memory-increments.patch @@ -0,0 +1,58 @@ +From 94c163663fc1dcfc067a5fb3cc1446b9469975ce Mon Sep 17 00:00:00 2001 +From: Heiko Carstens +Date: Thu, 25 Apr 2013 10:03:15 +0200 +Subject: s390/memory hotplug: prevent offline of active memory increments + +From: Heiko Carstens + +commit 94c163663fc1dcfc067a5fb3cc1446b9469975ce upstream. + +In case a machine supports memory hotplug all active memory increments +present at IPL time have been initialized with a "usecount" of 1. +This is wrong if the memory increment size is larger than the memory +section size of the memory hotplug code. If that is the case the +usecount must be initialized with the number of memory sections that +fit into one memory increment. +Otherwise it is possible to put a memory increment into standby state +even if there are still active sections. +Afterwards addressing exceptions might happen which cause the kernel +to panic. +However even worse, if a memory increment was put into standby state +and afterwards into active state again, it's contents would have been +zeroed, leading to memory corruption. + +This was only an issue for machines that support standby memory and +have at least 256GB memory. + +This is broken since commit fdb1bb15 "[S390] sclp/memory hotplug: fix +initial usecount of increments". + +Signed-off-by: Heiko Carstens +Reviewed-by: Gerald Schaefer +Signed-off-by: Martin Schwidefsky +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/s390/char/sclp_cmd.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/s390/char/sclp_cmd.c ++++ b/drivers/s390/char/sclp_cmd.c +@@ -567,6 +567,8 @@ static void __init sclp_add_standby_memo + add_memory_merged(0); + } + ++#define MEM_SCT_SIZE (1UL << SECTION_SIZE_BITS) ++ + static void __init insert_increment(u16 rn, int standby, int assigned) + { + struct memory_increment *incr, *new_incr; +@@ -579,7 +581,7 @@ static void __init insert_increment(u16 + new_incr->rn = rn; + new_incr->standby = standby; + if (!standby) +- new_incr->usecount = 1; ++ new_incr->usecount = rzm > MEM_SCT_SIZE ? rzm/MEM_SCT_SIZE : 1; + last_rn = 0; + prev = &sclp_mem_list; + list_for_each_entry(incr, &sclp_mem_list, list) { diff --git a/queue-3.8/serial_core.c-add-put_device-after-device_find_child.patch b/queue-3.8/serial_core.c-add-put_device-after-device_find_child.patch new file mode 100644 index 00000000000..97a97be14ec --- /dev/null +++ b/queue-3.8/serial_core.c-add-put_device-after-device_find_child.patch @@ -0,0 +1,98 @@ +From 5a65dcc04cda41f4122aacc37a5a348454645399 Mon Sep 17 00:00:00 2001 +From: Federico Vaga +Date: Mon, 15 Apr 2013 16:01:07 +0200 +Subject: serial_core.c: add put_device() after device_find_child() + +From: Federico Vaga + +commit 5a65dcc04cda41f4122aacc37a5a348454645399 upstream. + +The serial core uses device_find_child() but does not drop the reference to +the retrieved child after using it. This patch add the missing put_device(). + +What I have done to test this issue. + +I used a machine with an AMBA PL011 serial driver. I tested the patch on +next-20120408 because the last branch [next-20120415] does not boot on this +board. + +For test purpose, I added some pr_info() messages to print the refcount +after device_find_child() (lines: 1937,2009), and after put_device() +(lines: 1947, 2021). + +Boot the machine *without* put_device(). Then: + +echo reboot > /sys/power/disk +echo disk > /sys/power/state +[ 87.058575] uart_suspend_port:1937 refcount 4 +[ 87.058582] uart_suspend_port:1947 refcount 4 +[ 87.098083] uart_resume_port:2009refcount 5 +[ 87.098088] uart_resume_port:2021 refcount 5 + +echo disk > /sys/power/state +[ 103.055574] uart_suspend_port:1937 refcount 6 +[ 103.055580] uart_suspend_port:1947 refcount 6 +[ 103.095322] uart_resume_port:2009 refcount 7 +[ 103.095327] uart_resume_port:2021 refcount 7 + +echo disk > /sys/power/state +[ 252.459580] uart_suspend_port:1937 refcount 8 +[ 252.459586] uart_suspend_port:1947 refcount 8 +[ 252.499611] uart_resume_port:2009 refcount 9 +[ 252.499616] uart_resume_port:2021 refcount 9 + +The refcount continuously increased. + +Boot the machine *with* this patch. Then: + +echo reboot > /sys/power/disk +echo disk > /sys/power/state +[ 159.333559] uart_suspend_port:1937 refcount 4 +[ 159.333566] uart_suspend_port:1947 refcount 3 +[ 159.372751] uart_resume_port:2009 refcount 4 +[ 159.372755] uart_resume_port:2021 refcount 3 + +echo disk > /sys/power/state +[ 185.713614] uart_suspend_port:1937 refcount 4 +[ 185.713621] uart_suspend_port:1947 refcount 3 +[ 185.752935] uart_resume_port:2009 refcount 4 +[ 185.752940] uart_resume_port:2021 refcount 3 + +echo disk > /sys/power/state +[ 207.458584] uart_suspend_port:1937 refcount 4 +[ 207.458591] uart_suspend_port:1947 refcount 3 +[ 207.498598] uart_resume_port:2009 refcount 4 +[ 207.498605] uart_resume_port:2021 refcount 3 + +The refcount correctly handled. + +Signed-off-by: Federico Vaga +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/serial/serial_core.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/tty/serial/serial_core.c ++++ b/drivers/tty/serial/serial_core.c +@@ -1940,6 +1940,8 @@ int uart_suspend_port(struct uart_driver + mutex_unlock(&port->mutex); + return 0; + } ++ put_device(tty_dev); ++ + if (console_suspend_enabled || !uart_console(uport)) + uport->suspended = 1; + +@@ -2005,9 +2007,11 @@ int uart_resume_port(struct uart_driver + disable_irq_wake(uport->irq); + uport->irq_wake = 0; + } ++ put_device(tty_dev); + mutex_unlock(&port->mutex); + return 0; + } ++ put_device(tty_dev); + uport->suspended = 0; + + /* diff --git a/queue-3.8/series b/queue-3.8/series index 1b97c1801f0..edf959a41bf 100644 --- a/queue-3.8/series +++ b/queue-3.8/series @@ -17,3 +17,20 @@ iwlwifi-dvm-don-t-send-zeroed-lq-cmd.patch mwifiex-use-pci_release_region-instead-of-a-pci_release_regions.patch mwifiex-call-pci_release_region-after-calling-pci_disable_device.patch mac80211-fix-station-entry-leak-warning-while-suspending.patch +usb-misc-appledisplay-add-24-led-cinema-display.patch +usb-add-ftdi_sio-usb-id-for-gdm-boost-v1.x.patch +usb-ftdi_sio-correct-st-micro-connect-lite-pids.patch +usb-ftdi_sio-enable-two-uart-ports-on-st-microconnect-lite.patch +usbfs-always-allow-ctrl-requests-with-usb_recip_endpoint-on-the-ctrl-ep.patch +usb-chipidea-udc-fix-memory-access-of-shared-memory-on-armv5-machines.patch +usb-chipidea-udc-fix-memory-leak-in-_ep_nuke.patch +usb-remove-redundant-tdi_reset.patch +usb-storage-cy7c68300a-chips-do-not-support-cypress-atacb.patch +s390-memory-hotplug-prevent-offline-of-active-memory-increments.patch +xen-time-fix-kasprintf-splat-when-allocating-timer-d-irq-line.patch +xen-smp-fix-leakage-of-timer-interrupt-line-for-every-cpu-online-offline.patch +xen-smp-spinlock-fix-leakage-of-the-spinlock-interrupt-line-for-every-cpu-online-offline.patch +serial_core.c-add-put_device-after-device_find_child.patch +arm-set-the-page-table-freeing-ceiling-to-task_size.patch +gianfar-do-not-advertise-any-alarm-capability.patch +tty-fix-up-atime-mtime-mess-take-three.patch diff --git a/queue-3.8/tty-fix-up-atime-mtime-mess-take-three.patch b/queue-3.8/tty-fix-up-atime-mtime-mess-take-three.patch new file mode 100644 index 00000000000..9a243e91d93 --- /dev/null +++ b/queue-3.8/tty-fix-up-atime-mtime-mess-take-three.patch @@ -0,0 +1,63 @@ +From b0b885657b6c8ef63a46bc9299b2a7715d19acde Mon Sep 17 00:00:00 2001 +From: Linus Torvalds +Date: Wed, 1 May 2013 07:32:21 -0700 +Subject: tty: fix up atime/mtime mess, take three + +From: Linus Torvalds + +commit b0b885657b6c8ef63a46bc9299b2a7715d19acde upstream. + +We first tried to avoid updating atime/mtime entirely (commit +b0de59b5733d: "TTY: do not update atime/mtime on read/write"), and then +limited it to only update it occasionally (commit 37b7f3c76595: "TTY: +fix atime/mtime regression"), but it turns out that this was both +insufficient and overkill. + +It was insufficient because we let people attach to the shared ptmx node +to see activity without even reading atime/mtime, and it was overkill +because the "only once a minute" means that you can't really tell an +idle person from an active one with 'w'. + +So this tries to fix the problem properly. It marks the shared ptmx +node as un-notifiable, and it lowers the "only once a minute" to a few +seconds instead - still long enough that you can't time individual +keystrokes, but short enough that you can tell whether somebody is +active or not. + +Reported-by: Simon Kirby +Acked-by: Jiri Slaby +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/pty.c | 3 +++ + drivers/tty/tty_io.c | 4 ++-- + 2 files changed, 5 insertions(+), 2 deletions(-) + +--- a/drivers/tty/pty.c ++++ b/drivers/tty/pty.c +@@ -675,6 +675,9 @@ static int ptmx_open(struct inode *inode + + nonseekable_open(inode, filp); + ++ /* We refuse fsnotify events on ptmx, since it's a shared resource */ ++ filp->f_mode |= FMODE_NONOTIFY; ++ + retval = tty_alloc_file(filp); + if (retval) + return retval; +--- a/drivers/tty/tty_io.c ++++ b/drivers/tty/tty_io.c +@@ -941,10 +941,10 @@ void start_tty(struct tty_struct *tty) + + EXPORT_SYMBOL(start_tty); + ++/* We limit tty time update visibility to every 8 seconds or so. */ + static void tty_update_time(struct timespec *time) + { +- unsigned long sec = get_seconds(); +- sec -= sec % 60; ++ unsigned long sec = get_seconds() & ~7; + if ((long)(sec - time->tv_sec) > 0) + time->tv_sec = sec; + } diff --git a/queue-3.8/usb-add-ftdi_sio-usb-id-for-gdm-boost-v1.x.patch b/queue-3.8/usb-add-ftdi_sio-usb-id-for-gdm-boost-v1.x.patch new file mode 100644 index 00000000000..cafbf464ee9 --- /dev/null +++ b/queue-3.8/usb-add-ftdi_sio-usb-id-for-gdm-boost-v1.x.patch @@ -0,0 +1,41 @@ +From 58f8b6c4fa5a13cb2ddb400e26e9e65766d71e38 Mon Sep 17 00:00:00 2001 +From: Stefani Seibold +Date: Sun, 7 Apr 2013 12:08:55 +0200 +Subject: USB: add ftdi_sio USB ID for GDM Boost V1.x + +From: Stefani Seibold + +commit 58f8b6c4fa5a13cb2ddb400e26e9e65766d71e38 upstream. + +This patch add a missing usb device id for the GDMBoost V1.x device + +The patch is against 3.9-rc5 + +Signed-off-by: Stefani Seibold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/ftdi_sio.c | 1 + + drivers/usb/serial/ftdi_sio_ids.h | 1 + + 2 files changed, 2 insertions(+) + +--- a/drivers/usb/serial/ftdi_sio.c ++++ b/drivers/usb/serial/ftdi_sio.c +@@ -189,6 +189,7 @@ static struct usb_device_id id_table_com + { USB_DEVICE(FTDI_VID, FTDI_OPENDCC_THROTTLE_PID) }, + { USB_DEVICE(FTDI_VID, FTDI_OPENDCC_GATEWAY_PID) }, + { USB_DEVICE(FTDI_VID, FTDI_OPENDCC_GBM_PID) }, ++ { USB_DEVICE(FTDI_VID, FTDI_OPENDCC_GBM_BOOST_PID) }, + { USB_DEVICE(NEWPORT_VID, NEWPORT_AGILIS_PID) }, + { USB_DEVICE(INTERBIOMETRICS_VID, INTERBIOMETRICS_IOBOARD_PID) }, + { USB_DEVICE(INTERBIOMETRICS_VID, INTERBIOMETRICS_MINI_IOBOARD_PID) }, +--- a/drivers/usb/serial/ftdi_sio_ids.h ++++ b/drivers/usb/serial/ftdi_sio_ids.h +@@ -74,6 +74,7 @@ + #define FTDI_OPENDCC_THROTTLE_PID 0xBFDA + #define FTDI_OPENDCC_GATEWAY_PID 0xBFDB + #define FTDI_OPENDCC_GBM_PID 0xBFDC ++#define FTDI_OPENDCC_GBM_BOOST_PID 0xBFDD + + /* NZR SEM 16+ USB (http://www.nzr.de) */ + #define FTDI_NZR_SEM_USB_PID 0xC1E0 /* NZR SEM-LOG16+ */ diff --git a/queue-3.8/usb-chipidea-udc-fix-memory-access-of-shared-memory-on-armv5-machines.patch b/queue-3.8/usb-chipidea-udc-fix-memory-access-of-shared-memory-on-armv5-machines.patch new file mode 100644 index 00000000000..305359cc360 --- /dev/null +++ b/queue-3.8/usb-chipidea-udc-fix-memory-access-of-shared-memory-on-armv5-machines.patch @@ -0,0 +1,81 @@ +From a9c174302b1590ef3ead485d804a303c5f89174b Mon Sep 17 00:00:00 2001 +From: Michael Grzeschik +Date: Thu, 4 Apr 2013 13:13:46 +0300 +Subject: usb: chipidea: udc: fix memory access of shared memory on armv5 machines + +From: Michael Grzeschik + +commit a9c174302b1590ef3ead485d804a303c5f89174b upstream. + +The udc uses an shared dma memory space between hard and software. This +memory layout is described in ci13xxx_qh and ci13xxx_td which are marked +with the attribute ((packed)). + +The compiler currently does not know about the alignment of the memory +layout, and will create strb and ldrb operations. + +The Datasheet of the synopsys core describes, that some operations on +the mapped memory need to be atomic double word operations. I.e. the +next pointer addressing in the qhead, as otherwise the hardware will +read wrong data and totally stuck. + +This is also possible while working with the current active td queue, +and preparing the td->ptr.next in software while the hardware is still +working with the current active td which is supposed to be changed: + +writeb(0xde, &td->ptr.next + 0x0); /* strb */ +writeb(0xad, &td->ptr.next + 0x1); /* strb */ + +<----- hardware reads value of td->ptr.next and get stuck! + +writeb(0xbe, &td->ptr.next + 0x2); /* strb */ +writeb(0xef, &td->ptr.next + 0x3); /* strb */ + +This appeares on armv5 machines where the hardware does not support +unaligned 32bit operations. + +This patch adds the attribute ((aligned(4))) to the structures to tell +the compiler to use 32bit operations. It also adds an wmb() for the +prepared TD data before it gets enqueued into the qhead. + +Signed-off-by: Michael Grzeschik +Reviewed-by: Felipe Balbi +Signed-off-by: Alexander Shishkin +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/chipidea/udc.c | 2 ++ + drivers/usb/chipidea/udc.h | 4 ++-- + 2 files changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/usb/chipidea/udc.c ++++ b/drivers/usb/chipidea/udc.c +@@ -461,6 +461,8 @@ static int _hardware_enqueue(struct ci13 + mReq->ptr->page[i] = + (mReq->req.dma + i * CI13XXX_PAGE_SIZE) & ~TD_RESERVED_MASK; + ++ wmb(); ++ + if (!list_empty(&mEp->qh.queue)) { + struct ci13xxx_req *mReqPrev; + int n = hw_ep_bit(mEp->num, mEp->dir); +--- a/drivers/usb/chipidea/udc.h ++++ b/drivers/usb/chipidea/udc.h +@@ -40,7 +40,7 @@ struct ci13xxx_td { + #define TD_CURR_OFFSET (0x0FFFUL << 0) + #define TD_FRAME_NUM (0x07FFUL << 0) + #define TD_RESERVED_MASK (0x0FFFUL << 0) +-} __attribute__ ((packed)); ++} __attribute__ ((packed, aligned(4))); + + /* DMA layout of queue heads */ + struct ci13xxx_qh { +@@ -57,7 +57,7 @@ struct ci13xxx_qh { + /* 9 */ + u32 RESERVED; + struct usb_ctrlrequest setup; +-} __attribute__ ((packed)); ++} __attribute__ ((packed, aligned(4))); + + /** + * struct ci13xxx_req - usb request representation diff --git a/queue-3.8/usb-chipidea-udc-fix-memory-leak-in-_ep_nuke.patch b/queue-3.8/usb-chipidea-udc-fix-memory-leak-in-_ep_nuke.patch new file mode 100644 index 00000000000..84ab94abd90 --- /dev/null +++ b/queue-3.8/usb-chipidea-udc-fix-memory-leak-in-_ep_nuke.patch @@ -0,0 +1,37 @@ +From 7ca2cd291fd84ae499390f227a255ccba2780a81 Mon Sep 17 00:00:00 2001 +From: Michael Grzeschik +Date: Thu, 4 Apr 2013 13:13:47 +0300 +Subject: usb: chipidea: udc: fix memory leak in _ep_nuke + +From: Michael Grzeschik + +commit 7ca2cd291fd84ae499390f227a255ccba2780a81 upstream. + +In hardware_enqueue code adds one extra td with dma_pool_alloc if +mReq->req.zero is true. When _ep_nuke will be called for that endpoint, +dma_pool_free will not be called to free that memory again. That patch +fixes this. + +Signed-off-by: Michael Grzeschik +Signed-off-by: Alexander Shishkin +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/chipidea/udc.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/usb/chipidea/udc.c ++++ b/drivers/usb/chipidea/udc.c +@@ -563,6 +563,12 @@ __acquires(mEp->lock) + struct ci13xxx_req *mReq = \ + list_entry(mEp->qh.queue.next, + struct ci13xxx_req, queue); ++ ++ if (mReq->zptr) { ++ dma_pool_free(mEp->td_pool, mReq->zptr, mReq->zdma); ++ mReq->zptr = NULL; ++ } ++ + list_del_init(&mReq->queue); + mReq->req.status = -ESHUTDOWN; + diff --git a/queue-3.8/usb-ftdi_sio-correct-st-micro-connect-lite-pids.patch b/queue-3.8/usb-ftdi_sio-correct-st-micro-connect-lite-pids.patch new file mode 100644 index 00000000000..6a567af33d3 --- /dev/null +++ b/queue-3.8/usb-ftdi_sio-correct-st-micro-connect-lite-pids.patch @@ -0,0 +1,51 @@ +From 9f06d15f8db6946e41f73196a122b84a37938878 Mon Sep 17 00:00:00 2001 +From: Adrian Thomasset +Date: Tue, 23 Apr 2013 12:46:29 +0100 +Subject: USB: ftdi_sio: correct ST Micro Connect Lite PIDs + +From: Adrian Thomasset + +commit 9f06d15f8db6946e41f73196a122b84a37938878 upstream. + +The current ST Micro Connect Lite uses the FT4232H hi-speed quad USB +UART FTDI chip. It is also possible to drive STM reference targets +populated with an on-board JTAG debugger based on the FT2232H chip with +the same STMicroelectronics tools. + +For this reason, the ST Micro Connect Lite PIDs should be +ST_STMCLT_2232_PID: 0x3746 +ST_STMCLT_4232_PID: 0x3747 + +Signed-off-by: Adrian Thomasset +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/ftdi_sio.c | 4 +++- + drivers/usb/serial/ftdi_sio_ids.h | 3 ++- + 2 files changed, 5 insertions(+), 2 deletions(-) + +--- a/drivers/usb/serial/ftdi_sio.c ++++ b/drivers/usb/serial/ftdi_sio.c +@@ -871,7 +871,9 @@ static struct usb_device_id id_table_com + { USB_DEVICE(FTDI_VID, FTDI_DOTEC_PID) }, + { USB_DEVICE(QIHARDWARE_VID, MILKYMISTONE_JTAGSERIAL_PID), + .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, +- { USB_DEVICE(ST_VID, ST_STMCLT1030_PID), ++ { USB_DEVICE(ST_VID, ST_STMCLT_2232_PID), ++ .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, ++ { USB_DEVICE(ST_VID, ST_STMCLT_4232_PID), + .driver_info = (kernel_ulong_t)&ftdi_stmclite_quirk }, + { USB_DEVICE(FTDI_VID, FTDI_RF_R106) }, + { USB_DEVICE(FTDI_VID, FTDI_DISTORTEC_JTAG_LOCK_PICK_PID), +--- a/drivers/usb/serial/ftdi_sio_ids.h ++++ b/drivers/usb/serial/ftdi_sio_ids.h +@@ -1151,7 +1151,8 @@ + * STMicroelectonics + */ + #define ST_VID 0x0483 +-#define ST_STMCLT1030_PID 0x3747 /* ST Micro Connect Lite STMCLT1030 */ ++#define ST_STMCLT_2232_PID 0x3746 ++#define ST_STMCLT_4232_PID 0x3747 + + /* + * Papouch products (http://www.papouch.com/) diff --git a/queue-3.8/usb-ftdi_sio-enable-two-uart-ports-on-st-microconnect-lite.patch b/queue-3.8/usb-ftdi_sio-enable-two-uart-ports-on-st-microconnect-lite.patch new file mode 100644 index 00000000000..49ce3098899 --- /dev/null +++ b/queue-3.8/usb-ftdi_sio-enable-two-uart-ports-on-st-microconnect-lite.patch @@ -0,0 +1,56 @@ +From 71d9a2b95fc9c9474d46d764336efd7a5a805555 Mon Sep 17 00:00:00 2001 +From: Adrian Thomasset +Date: Wed, 24 Apr 2013 11:37:35 +0100 +Subject: USB: ftdi_sio: enable two UART ports on ST Microconnect Lite + +From: Adrian Thomasset + +commit 71d9a2b95fc9c9474d46d764336efd7a5a805555 upstream. + +The FT4232H used in the ST Micro Connect Lite has four hi-speed UART ports. +The first two ports are reserved for the JTAG interface. + +We enable by default ports 2 and 3 as UARTs (where port 2 is a +conventional RS-232 UART) + +Signed-off-by: Adrian Thomasset +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/ftdi_sio.c | 18 +++++++++++------- + 1 file changed, 11 insertions(+), 7 deletions(-) + +--- a/drivers/usb/serial/ftdi_sio.c ++++ b/drivers/usb/serial/ftdi_sio.c +@@ -1795,20 +1795,24 @@ static int ftdi_8u2232c_probe(struct usb + } + + /* +- * First and second port on STMCLiteadaptors is reserved for JTAG interface +- * and the forth port for pio ++ * First two ports on JTAG adaptors using an FT4232 such as STMicroelectronics's ++ * ST Micro Connect Lite are reserved for JTAG or other non-UART interfaces and ++ * can be accessed from userspace. ++ * The next two ports are enabled as UARTs by default, where port 2 is ++ * a conventional RS-232 UART. + */ + static int ftdi_stmclite_probe(struct usb_serial *serial) + { + struct usb_device *udev = serial->dev; + struct usb_interface *interface = serial->interface; + +- if (interface == udev->actconfig->interface[2]) +- return 0; ++ if (interface == udev->actconfig->interface[0] || ++ interface == udev->actconfig->interface[1]) { ++ dev_info(&udev->dev, "Ignoring serial port reserved for JTAG\n"); ++ return -ENODEV; ++ } + +- dev_info(&udev->dev, "Ignoring serial port reserved for JTAG\n"); +- +- return -ENODEV; ++ return 0; + } + + /* diff --git a/queue-3.8/usb-misc-appledisplay-add-24-led-cinema-display.patch b/queue-3.8/usb-misc-appledisplay-add-24-led-cinema-display.patch new file mode 100644 index 00000000000..d61f67991d3 --- /dev/null +++ b/queue-3.8/usb-misc-appledisplay-add-24-led-cinema-display.patch @@ -0,0 +1,28 @@ +From e7d3b6e22c871ba36d052ca99bc8ceca4d546a60 Mon Sep 17 00:00:00 2001 +From: Ben Jencks +Date: Tue, 2 Apr 2013 00:35:08 -0400 +Subject: usb/misc/appledisplay: Add 24" LED Cinema display + +From: Ben Jencks + +commit e7d3b6e22c871ba36d052ca99bc8ceca4d546a60 upstream. + +Add the Apple 24" LED Cinema display to the supported devices. + +Signed-off-by: Ben Jencks +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/misc/appledisplay.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/misc/appledisplay.c ++++ b/drivers/usb/misc/appledisplay.c +@@ -63,6 +63,7 @@ static const struct usb_device_id appled + { APPLEDISPLAY_DEVICE(0x9219) }, + { APPLEDISPLAY_DEVICE(0x921c) }, + { APPLEDISPLAY_DEVICE(0x921d) }, ++ { APPLEDISPLAY_DEVICE(0x9236) }, + + /* Terminating entry */ + { } diff --git a/queue-3.8/usb-remove-redundant-tdi_reset.patch b/queue-3.8/usb-remove-redundant-tdi_reset.patch new file mode 100644 index 00000000000..a46fecc6f56 --- /dev/null +++ b/queue-3.8/usb-remove-redundant-tdi_reset.patch @@ -0,0 +1,35 @@ +From 61ac6ac8d662ac7ac67c864954d39d1b19948354 Mon Sep 17 00:00:00 2001 +From: Shengzhou Liu +Date: Wed, 17 Apr 2013 18:03:46 +0800 +Subject: usb: remove redundant tdi_reset + +From: Shengzhou Liu + +commit 61ac6ac8d662ac7ac67c864954d39d1b19948354 upstream. + +We remove the redundant tdi_reset in ehci_setup since there +is already it in ehci_reset. +It was observed that the duplicated tdi_reset was causing +the PHY_CLK_VALID bit unstable. + +Reported-by: Michael Braun +Signed-off-by: Shengzhou Liu +Acked-by: Alan Stern +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/ehci-hcd.c | 3 --- + 1 file changed, 3 deletions(-) + +--- a/drivers/usb/host/ehci-hcd.c ++++ b/drivers/usb/host/ehci-hcd.c +@@ -670,9 +670,6 @@ int ehci_setup(struct usb_hcd *hcd) + if (retval) + return retval; + +- if (ehci_is_TDI(ehci)) +- tdi_reset(ehci); +- + ehci_reset(ehci); + + return 0; diff --git a/queue-3.8/usb-storage-cy7c68300a-chips-do-not-support-cypress-atacb.patch b/queue-3.8/usb-storage-cy7c68300a-chips-do-not-support-cypress-atacb.patch new file mode 100644 index 00000000000..492401fc954 --- /dev/null +++ b/queue-3.8/usb-storage-cy7c68300a-chips-do-not-support-cypress-atacb.patch @@ -0,0 +1,75 @@ +From 671b4b2ba9266cbcfe7210a704e9ea487dcaa988 Mon Sep 17 00:00:00 2001 +From: Tormod Volden +Date: Sat, 20 Apr 2013 14:24:04 +0200 +Subject: usb-storage: CY7C68300A chips do not support Cypress ATACB + +From: Tormod Volden + +commit 671b4b2ba9266cbcfe7210a704e9ea487dcaa988 upstream. + +Many cards based on CY7C68300A/B/C use the USB ID 04b4:6830 but only the +B and C variants (EZ-USB AT2LP) support the ATA Command Block +functionality, according to the data sheets. The A variant (EZ-USB AT2) +locks up if ATACB is attempted, until a typical 30 seconds timeout runs +out and a USB reset is performed. + +https://bugs.launchpad.net/bugs/428469 + +It seems that one way to spot a CY7C68300A (at least where the card +manufacturer left Cypress' EEPROM default vaules, against Cypress' +recommendations) is to look at the USB string descriptor indices. + +A http://media.digikey.com/pdf/Data%20Sheets/Cypress%20PDFs/CY7C68300A.pdf +B http://www.farnell.com/datasheets/43456.pdf +C http://www.cypress.com/?rID=14189 + +Note that a CY7C68300B/C chip appears as CY7C68300A if it is running +in Backward Compatibility Mode, and if ATACB would be supported in this +case there is anyway no way to tell which chip it really is. + +For 5 years my external USB drive has been locking up for half a minute +when plugged in and ata_id is run by udev, or anytime hdparm or similar +is run on it. + +Finally looking at the /correct/ datasheet I think I found the reason. I +am aware the quirk in this patch is a bit hacky, but the hardware +manufacturers haven't made it easy for us. + +Signed-off-by: Tormod Volden +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/storage/cypress_atacb.c | 16 ++++++++++++++-- + 1 file changed, 14 insertions(+), 2 deletions(-) + +--- a/drivers/usb/storage/cypress_atacb.c ++++ b/drivers/usb/storage/cypress_atacb.c +@@ -248,14 +248,26 @@ static int cypress_probe(struct usb_inte + { + struct us_data *us; + int result; ++ struct usb_device *device; + + result = usb_stor_probe1(&us, intf, id, + (id - cypress_usb_ids) + cypress_unusual_dev_list); + if (result) + return result; + +- us->protocol_name = "Transparent SCSI with Cypress ATACB"; +- us->proto_handler = cypress_atacb_passthrough; ++ /* Among CY7C68300 chips, the A revision does not support Cypress ATACB ++ * Filter out this revision from EEPROM default descriptor values ++ */ ++ device = interface_to_usbdev(intf); ++ if (device->descriptor.iManufacturer != 0x38 || ++ device->descriptor.iProduct != 0x4e || ++ device->descriptor.iSerialNumber != 0x64) { ++ us->protocol_name = "Transparent SCSI with Cypress ATACB"; ++ us->proto_handler = cypress_atacb_passthrough; ++ } else { ++ us->protocol_name = "Transparent SCSI"; ++ us->proto_handler = usb_stor_transparent_scsi_command; ++ } + + result = usb_stor_probe2(us); + return result; diff --git a/queue-3.8/usbfs-always-allow-ctrl-requests-with-usb_recip_endpoint-on-the-ctrl-ep.patch b/queue-3.8/usbfs-always-allow-ctrl-requests-with-usb_recip_endpoint-on-the-ctrl-ep.patch new file mode 100644 index 00000000000..2d4f2241142 --- /dev/null +++ b/queue-3.8/usbfs-always-allow-ctrl-requests-with-usb_recip_endpoint-on-the-ctrl-ep.patch @@ -0,0 +1,46 @@ +From 1361bf4b9f9ef45e628a5b89e0fd9bedfdcb7104 Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Tue, 16 Apr 2013 11:08:33 +0200 +Subject: usbfs: Always allow ctrl requests with USB_RECIP_ENDPOINT on the ctrl ep + +From: Hans de Goede + +commit 1361bf4b9f9ef45e628a5b89e0fd9bedfdcb7104 upstream. + +When usbfs receives a ctrl-request from userspace it calls check_ctrlrecip, +which for a request with USB_RECIP_ENDPOINT tries to map this to an interface +to see if this interface is claimed, except for ctrl-requests with a type of +USB_TYPE_VENDOR. + +When trying to use this device: http://www.akaipro.com/eiepro +redirected to a Windows vm running on qemu on top of Linux. + +The windows driver makes a ctrl-req with USB_TYPE_CLASS and +USB_RECIP_ENDPOINT with index 0, and the mapping of the endpoint (0) to +the interface fails since ep 0 is the ctrl endpoint and thus never is +part of an interface. + +This patch fixes this ctrl-req failing by skipping the checkintf call for +USB_RECIP_ENDPOINT ctrl-reqs on the ctrl endpoint. + +Reported-by: Dave Stikkolorum +Tested-by: Dave Stikkolorum +Signed-off-by: Hans de Goede +Acked-by: Alan Stern +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/devio.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/usb/core/devio.c ++++ b/drivers/usb/core/devio.c +@@ -738,6 +738,8 @@ static int check_ctrlrecip(struct dev_st + index &= 0xff; + switch (requesttype & USB_RECIP_MASK) { + case USB_RECIP_ENDPOINT: ++ if ((index & ~USB_DIR_IN) == 0) ++ return 0; + ret = findintfep(ps->dev, index); + if (ret >= 0) + ret = checkintf(ps, ret); diff --git a/queue-3.8/xen-smp-fix-leakage-of-timer-interrupt-line-for-every-cpu-online-offline.patch b/queue-3.8/xen-smp-fix-leakage-of-timer-interrupt-line-for-every-cpu-online-offline.patch new file mode 100644 index 00000000000..7ba7279e8eb --- /dev/null +++ b/queue-3.8/xen-smp-fix-leakage-of-timer-interrupt-line-for-every-cpu-online-offline.patch @@ -0,0 +1,59 @@ +From 888b65b4bc5e7fcbbb967023300cd5d44dba1950 Mon Sep 17 00:00:00 2001 +From: Konrad Rzeszutek Wilk +Date: Tue, 16 Apr 2013 13:49:26 -0400 +Subject: xen/smp: Fix leakage of timer interrupt line for every CPU online/offline. + +From: Konrad Rzeszutek Wilk + +commit 888b65b4bc5e7fcbbb967023300cd5d44dba1950 upstream. + +In the PVHVM path when we do CPU online/offline path we would +leak the timer%d IRQ line everytime we do a offline event. The +online path (xen_hvm_setup_cpu_clockevents via +x86_cpuinit.setup_percpu_clockev) would allocate a new interrupt +line for the timer%d. + +But we would still use the old interrupt line leading to: + +kernel BUG at /home/konrad/ssd/konrad/linux/kernel/hrtimer.c:1261! +invalid opcode: 0000 [#1] SMP +RIP: 0010:[] [] hrtimer_interrupt+0x261/0x270 +.. snip.. + + [] xen_timer_interrupt+0x2f/0x1b0 + [] ? stop_machine_cpu_stop+0xb5/0xf0 + [] handle_irq_event_percpu+0x7c/0x240 + [] handle_percpu_irq+0x49/0x70 + [] __xen_evtchn_do_upcall+0x1c3/0x2f0 + [] xen_evtchn_do_upcall+0x2a/0x40 + [] xen_hvm_callback_vector+0x6d/0x80 + + [] ? start_secondary+0x193/0x1a8 + [] ? start_secondary+0x18f/0x1a8 + +There is also the oddity (timer1) in the /proc/interrupts after +offlining CPU1: + + 64: 1121 0 xen-percpu-virq timer0 + 78: 0 0 xen-percpu-virq timer1 + 84: 0 2483 xen-percpu-virq timer2 + +This patch fixes it. + +Signed-off-by: Konrad Rzeszutek Wilk +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/xen/smp.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/arch/x86/xen/smp.c ++++ b/arch/x86/xen/smp.c +@@ -658,6 +658,7 @@ static void xen_hvm_cpu_die(unsigned int + unbind_from_irqhandler(per_cpu(xen_debug_irq, cpu), NULL); + unbind_from_irqhandler(per_cpu(xen_callfuncsingle_irq, cpu), NULL); + unbind_from_irqhandler(per_cpu(xen_irq_work, cpu), NULL); ++ xen_teardown_timer(cpu); + native_cpu_die(cpu); + } + diff --git a/queue-3.8/xen-smp-spinlock-fix-leakage-of-the-spinlock-interrupt-line-for-every-cpu-online-offline.patch b/queue-3.8/xen-smp-spinlock-fix-leakage-of-the-spinlock-interrupt-line-for-every-cpu-online-offline.patch new file mode 100644 index 00000000000..58cd549142b --- /dev/null +++ b/queue-3.8/xen-smp-spinlock-fix-leakage-of-the-spinlock-interrupt-line-for-every-cpu-online-offline.patch @@ -0,0 +1,72 @@ +From 66ff0fe9e7bda8aec99985b24daad03652f7304e Mon Sep 17 00:00:00 2001 +From: Konrad Rzeszutek Wilk +Date: Tue, 16 Apr 2013 14:08:50 -0400 +Subject: xen/smp/spinlock: Fix leakage of the spinlock interrupt line for every CPU online/offline + +From: Konrad Rzeszutek Wilk + +commit 66ff0fe9e7bda8aec99985b24daad03652f7304e upstream. + +While we don't use the spinlock interrupt line (see for details +commit f10cd522c5fbfec9ae3cc01967868c9c2401ed23 - +xen: disable PV spinlocks on HVM) - we should still do the proper +init / deinit sequence. We did not do that correctly and for the +CPU init for PVHVM guest we would allocate an interrupt line - but +failed to deallocate the old interrupt line. + +This resulted in leakage of an irq_desc but more importantly this splat +as we online an offlined CPU: + +genirq: Flags mismatch irq 71. 0002cc20 (spinlock1) vs. 0002cc20 (spinlock1) +Pid: 2542, comm: init.late Not tainted 3.9.0-rc6upstream #1 +Call Trace: + [] __setup_irq+0x23e/0x4a0 + [] ? kmem_cache_alloc_trace+0x221/0x250 + [] request_threaded_irq+0xfb/0x160 + [] ? xen_spin_trylock+0x20/0x20 + [] bind_ipi_to_irqhandler+0xa3/0x160 + [] ? kasprintf+0x38/0x40 + [] ? xen_spin_trylock+0x20/0x20 + [] ? update_max_interval+0x15/0x40 + [] xen_init_lock_cpu+0x3c/0x78 + [] xen_hvm_cpu_notify+0x29/0x33 + [] notifier_call_chain+0x4d/0x70 + [] __raw_notifier_call_chain+0x9/0x10 + [] __cpu_notify+0x1b/0x30 + [] _cpu_up+0xa0/0x14b + [] cpu_up+0xd9/0xec + [] store_online+0x94/0xd0 + [] dev_attr_store+0x1b/0x20 + [] sysfs_write_file+0xf4/0x170 + [] vfs_write+0xb4/0x130 + [] sys_write+0x5a/0xa0 + [] system_call_fastpath+0x16/0x1b +cpu 1 spinlock event irq -16 +smpboot: Booting Node 0 Processor 1 APIC 0x2 + +And if one looks at the /proc/interrupts right after +offlining (CPU1): + + 70: 0 0 xen-percpu-ipi spinlock0 + 71: 0 0 xen-percpu-ipi spinlock1 + 77: 0 0 xen-percpu-ipi spinlock2 + +There is the oddity of the 'spinlock1' still being present. + +Signed-off-by: Konrad Rzeszutek Wilk +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/xen/smp.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/arch/x86/xen/smp.c ++++ b/arch/x86/xen/smp.c +@@ -658,6 +658,7 @@ static void xen_hvm_cpu_die(unsigned int + unbind_from_irqhandler(per_cpu(xen_debug_irq, cpu), NULL); + unbind_from_irqhandler(per_cpu(xen_callfuncsingle_irq, cpu), NULL); + unbind_from_irqhandler(per_cpu(xen_irq_work, cpu), NULL); ++ xen_uninit_lock_cpu(cpu); + xen_teardown_timer(cpu); + native_cpu_die(cpu); + } diff --git a/queue-3.8/xen-time-fix-kasprintf-splat-when-allocating-timer-d-irq-line.patch b/queue-3.8/xen-time-fix-kasprintf-splat-when-allocating-timer-d-irq-line.patch new file mode 100644 index 00000000000..dbbe48fa5fa --- /dev/null +++ b/queue-3.8/xen-time-fix-kasprintf-splat-when-allocating-timer-d-irq-line.patch @@ -0,0 +1,73 @@ +From 7918c92ae9638eb8a6ec18e2b4a0de84557cccc8 Mon Sep 17 00:00:00 2001 +From: Konrad Rzeszutek Wilk +Date: Tue, 16 Apr 2013 15:18:00 -0400 +Subject: xen/time: Fix kasprintf splat when allocating timer%d IRQ line. + +From: Konrad Rzeszutek Wilk + +commit 7918c92ae9638eb8a6ec18e2b4a0de84557cccc8 upstream. + +When we online the CPU, we get this splat: + +smpboot: Booting Node 0 Processor 1 APIC 0x2 +installing Xen timer for CPU 1 +BUG: sleeping function called from invalid context at /home/konrad/ssd/konrad/linux/mm/slab.c:3179 +in_atomic(): 1, irqs_disabled(): 0, pid: 0, name: swapper/1 +Pid: 0, comm: swapper/1 Not tainted 3.9.0-rc6upstream-00001-g3884fad #1 +Call Trace: + [] __might_sleep+0xda/0x100 + [] __kmalloc_track_caller+0x1e7/0x2c0 + [] ? kasprintf+0x38/0x40 + [] kvasprintf+0x5b/0x90 + [] kasprintf+0x38/0x40 + [] xen_setup_timer+0x30/0xb0 + [] xen_hvm_setup_cpu_clockevents+0x1f/0x30 + [] start_secondary+0x19c/0x1a8 + +The solution to that is use kasprintf in the CPU hotplug path +that 'online's the CPU. That is, do it in in xen_hvm_cpu_notify, +and remove the call to in xen_hvm_setup_cpu_clockevents. + +Unfortunatly the later is not a good idea as the bootup path +does not use xen_hvm_cpu_notify so we would end up never allocating +timer%d interrupt lines when booting. As such add the check for +atomic() to continue. + +Signed-off-by: Konrad Rzeszutek Wilk +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/xen/enlighten.c | 5 ++++- + arch/x86/xen/time.c | 6 +++++- + 2 files changed, 9 insertions(+), 2 deletions(-) + +--- a/arch/x86/xen/enlighten.c ++++ b/arch/x86/xen/enlighten.c +@@ -1589,8 +1589,11 @@ static int __cpuinit xen_hvm_cpu_notify( + switch (action) { + case CPU_UP_PREPARE: + xen_vcpu_setup(cpu); +- if (xen_have_vector_callback) ++ if (xen_have_vector_callback) { + xen_init_lock_cpu(cpu); ++ if (xen_feature(XENFEAT_hvm_safe_pvclock)) ++ xen_setup_timer(cpu); ++ } + break; + default: + break; +--- a/arch/x86/xen/time.c ++++ b/arch/x86/xen/time.c +@@ -497,7 +497,11 @@ static void xen_hvm_setup_cpu_clockevent + { + int cpu = smp_processor_id(); + xen_setup_runstate_info(cpu); +- xen_setup_timer(cpu); ++ /* ++ * xen_setup_timer(cpu) - snprintf is bad in atomic context. Hence ++ * doing it xen_hvm_cpu_notify (which gets called by smp_init during ++ * early bootup and also during CPU hotplug events). ++ */ + xen_setup_cpu_clockevents(); + } + -- 2.47.3