From db084639bfa9f8ede91d5ddab42ecad85bb125b0 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Fri, 7 Nov 2014 12:27:16 -0800 Subject: [PATCH] 3.17-stable patches added patches: asoc-adau1761-fix-input-pga-volume.patch asoc-core-fix-use-after-free-in-snd_soc_remove_platform.patch asoc-intel-hsw-bdw-only-support-s16-and-s24-formats.patch asoc-soc-dapm-fix-use-after-free.patch asoc-soc-pcm-fix-sig_bits-determination-in-soc_pcm_apply_msb.patch asoc-tlv320aic3x-fix-pll-d-configuration.patch fs-allow-open-dir-o_tmpfile-...-0-with-mode-0.patch fs-fix-theoretical-division-by-0-in-super_cache_scan.patch fs-make-cont_expand_zero-interruptible.patch libata-sff-fix-controllers-with-no-ctl-port.patch lockd-try-to-reconnect-if-statd-has-moved.patch mmc-core-sdio-fix-unconditional-wake_up_process-on-sdio-thread.patch mmc-don-t-request-cd-irq-until-mmc_start_host.patch mmc-rtsx_pci_sdmmc-fix-incorrect-last-byte-in-r2-response.patch mmc-rtsx_usb_sdmmc-fix-incorrect-last-byte-in-r2-response.patch mmc-sdhci-pxav3-set_uhs_signaling-is-initialized-twice-differently.patch mmc-sdhci-s3c-fix-runtime-pm-handling-on-sdhci_add_host-failure.patch pata_serverworks-disable-64-kb-dma-transfers-on-broadcom-osb4-ide-controller.patch revert-percpu-free-percpu-allocation-info-for-uniprocessor-system.patch sunrpc-add-missing-support-for-rpc_clnt_create_no_retrans_timeout.patch sunrpc-don-t-wake-tasks-during-connection-abort.patch ubifs-fix-a-race-condition.patch ubifs-fix-free-log-space-calculation.patch --- .../asoc-adau1761-fix-input-pga-volume.patch | 41 +++++ ...fter-free-in-snd_soc_remove_platform.patch | 36 ++++ ...bdw-only-support-s16-and-s24-formats.patch | 32 ++++ .../asoc-soc-dapm-fix-use-after-free.patch | 88 ++++++++++ ...s-determination-in-soc_pcm_apply_msb.patch | 33 ++++ ...-tlv320aic3x-fix-pll-d-configuration.patch | 63 +++++++ ...open-dir-o_tmpfile-...-0-with-mode-0.patch | 87 ++++++++++ ...al-division-by-0-in-super_cache_scan.patch | 37 ++++ ...-make-cont_expand_zero-interruptible.patch | 42 +++++ ...sff-fix-controllers-with-no-ctl-port.patch | 110 ++++++++++++ ...-try-to-reconnect-if-statd-has-moved.patch | 36 ++++ ...ional-wake_up_process-on-sdio-thread.patch | 70 ++++++++ ...-request-cd-irq-until-mmc_start_host.patch | 130 ++++++++++++++ ...x-incorrect-last-byte-in-r2-response.patch | 42 +++++ ...x-incorrect-last-byte-in-r2-response.patch | 42 +++++ ...ing-is-initialized-twice-differently.patch | 47 +++++ ...m-handling-on-sdhci_add_host-failure.patch | 88 ++++++++++ ...fers-on-broadcom-osb4-ide-controller.patch | 162 ++++++++++++++++++ ...ocation-info-for-uniprocessor-system.patch | 38 ++++ queue-3.17/series | 23 +++ ...r-rpc_clnt_create_no_retrans_timeout.patch | 45 +++++ ...t-wake-tasks-during-connection-abort.patch | 56 ++++++ queue-3.17/ubifs-fix-a-race-condition.patch | 124 ++++++++++++++ ...ubifs-fix-free-log-space-calculation.patch | 51 ++++++ 24 files changed, 1523 insertions(+) create mode 100644 queue-3.17/asoc-adau1761-fix-input-pga-volume.patch create mode 100644 queue-3.17/asoc-core-fix-use-after-free-in-snd_soc_remove_platform.patch create mode 100644 queue-3.17/asoc-intel-hsw-bdw-only-support-s16-and-s24-formats.patch create mode 100644 queue-3.17/asoc-soc-dapm-fix-use-after-free.patch create mode 100644 queue-3.17/asoc-soc-pcm-fix-sig_bits-determination-in-soc_pcm_apply_msb.patch create mode 100644 queue-3.17/asoc-tlv320aic3x-fix-pll-d-configuration.patch create mode 100644 queue-3.17/fs-allow-open-dir-o_tmpfile-...-0-with-mode-0.patch create mode 100644 queue-3.17/fs-fix-theoretical-division-by-0-in-super_cache_scan.patch create mode 100644 queue-3.17/fs-make-cont_expand_zero-interruptible.patch create mode 100644 queue-3.17/libata-sff-fix-controllers-with-no-ctl-port.patch create mode 100644 queue-3.17/lockd-try-to-reconnect-if-statd-has-moved.patch create mode 100644 queue-3.17/mmc-core-sdio-fix-unconditional-wake_up_process-on-sdio-thread.patch create mode 100644 queue-3.17/mmc-don-t-request-cd-irq-until-mmc_start_host.patch create mode 100644 queue-3.17/mmc-rtsx_pci_sdmmc-fix-incorrect-last-byte-in-r2-response.patch create mode 100644 queue-3.17/mmc-rtsx_usb_sdmmc-fix-incorrect-last-byte-in-r2-response.patch create mode 100644 queue-3.17/mmc-sdhci-pxav3-set_uhs_signaling-is-initialized-twice-differently.patch create mode 100644 queue-3.17/mmc-sdhci-s3c-fix-runtime-pm-handling-on-sdhci_add_host-failure.patch create mode 100644 queue-3.17/pata_serverworks-disable-64-kb-dma-transfers-on-broadcom-osb4-ide-controller.patch create mode 100644 queue-3.17/revert-percpu-free-percpu-allocation-info-for-uniprocessor-system.patch create mode 100644 queue-3.17/sunrpc-add-missing-support-for-rpc_clnt_create_no_retrans_timeout.patch create mode 100644 queue-3.17/sunrpc-don-t-wake-tasks-during-connection-abort.patch create mode 100644 queue-3.17/ubifs-fix-a-race-condition.patch create mode 100644 queue-3.17/ubifs-fix-free-log-space-calculation.patch diff --git a/queue-3.17/asoc-adau1761-fix-input-pga-volume.patch b/queue-3.17/asoc-adau1761-fix-input-pga-volume.patch new file mode 100644 index 00000000000..3652e6b1da2 --- /dev/null +++ b/queue-3.17/asoc-adau1761-fix-input-pga-volume.patch @@ -0,0 +1,41 @@ +From 3b283f0893f55cb79e4507e5ec34e49c17d0a787 Mon Sep 17 00:00:00 2001 +From: Lars-Peter Clausen +Date: Wed, 22 Oct 2014 10:51:18 +0200 +Subject: ASoC: adau1761: Fix input PGA volume + +From: Lars-Peter Clausen + +commit 3b283f0893f55cb79e4507e5ec34e49c17d0a787 upstream. + +For the input PGA to work correctly the ALC clock needs to be active. +Otherwise volume changes are not applied. + +Fixes: dab464b60b2 ("ASoC: Add ADAU1361/ADAU1761 audio CODEC support") +Signed-off-by: Lars-Peter Clausen +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/codecs/adau1761.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/sound/soc/codecs/adau1761.c ++++ b/sound/soc/codecs/adau1761.c +@@ -405,6 +405,7 @@ static const struct snd_soc_dapm_widget + 2, 0, NULL, 0), + + SND_SOC_DAPM_SUPPLY("Slew Clock", ADAU1761_CLK_ENABLE0, 6, 0, NULL, 0), ++ SND_SOC_DAPM_SUPPLY("ALC Clock", ADAU1761_CLK_ENABLE0, 5, 0, NULL, 0), + + SND_SOC_DAPM_SUPPLY_S("Digital Clock 0", 1, ADAU1761_CLK_ENABLE1, + 0, 0, NULL, 0), +@@ -436,6 +437,9 @@ static const struct snd_soc_dapm_route a + { "Right Playback Mixer", NULL, "Slew Clock" }, + { "Left Playback Mixer", NULL, "Slew Clock" }, + ++ { "Left Input Mixer", NULL, "ALC Clock" }, ++ { "Right Input Mixer", NULL, "ALC Clock" }, ++ + { "Digital Clock 0", NULL, "SYSCLK" }, + { "Digital Clock 1", NULL, "SYSCLK" }, + }; diff --git a/queue-3.17/asoc-core-fix-use-after-free-in-snd_soc_remove_platform.patch b/queue-3.17/asoc-core-fix-use-after-free-in-snd_soc_remove_platform.patch new file mode 100644 index 00000000000..fb6a7ce4759 --- /dev/null +++ b/queue-3.17/asoc-core-fix-use-after-free-in-snd_soc_remove_platform.patch @@ -0,0 +1,36 @@ +From decc27b01d584c985c231e73d3b493de6ec07af8 Mon Sep 17 00:00:00 2001 +From: Daniel Mack +Date: Tue, 7 Oct 2014 13:41:23 +0200 +Subject: ASoC: core: fix use after free in snd_soc_remove_platform() + +From: Daniel Mack + +commit decc27b01d584c985c231e73d3b493de6ec07af8 upstream. + +Coverity spotted an use-after-free condition in snd_soc_remove_platform(). +Fix this by moving snd_soc_component_cleanup() after the debug print +statement which uses the component's string. + +Signed-off-by: Daniel Mack +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/soc-core.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/sound/soc/soc-core.c ++++ b/sound/soc/soc-core.c +@@ -4315,10 +4315,10 @@ void snd_soc_remove_platform(struct snd_ + snd_soc_component_del_unlocked(&platform->component); + mutex_unlock(&client_mutex); + +- snd_soc_component_cleanup(&platform->component); +- + dev_dbg(platform->dev, "ASoC: Unregistered platform '%s'\n", + platform->component.name); ++ ++ snd_soc_component_cleanup(&platform->component); + } + EXPORT_SYMBOL_GPL(snd_soc_remove_platform); + diff --git a/queue-3.17/asoc-intel-hsw-bdw-only-support-s16-and-s24-formats.patch b/queue-3.17/asoc-intel-hsw-bdw-only-support-s16-and-s24-formats.patch new file mode 100644 index 00000000000..1cb5a2910a2 --- /dev/null +++ b/queue-3.17/asoc-intel-hsw-bdw-only-support-s16-and-s24-formats.patch @@ -0,0 +1,32 @@ +From 2ccf3bd4f8b120936cdfc796baf40c5d3dfab68d Mon Sep 17 00:00:00 2001 +From: Liam Girdwood +Date: Thu, 16 Oct 2014 15:29:14 +0100 +Subject: ASoC: Intel: HSW/BDW only support S16 and S24 formats. + +From: Liam Girdwood + +commit 2ccf3bd4f8b120936cdfc796baf40c5d3dfab68d upstream. + +Fix driver with correct formats. + +Signed-off-by: Liam Girdwood +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/intel/sst-haswell-pcm.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +--- a/sound/soc/intel/sst-haswell-pcm.c ++++ b/sound/soc/intel/sst-haswell-pcm.c +@@ -693,9 +693,7 @@ static int hsw_pcm_new(struct snd_soc_pc + } + + #define HSW_FORMATS \ +- (SNDRV_PCM_FMTBIT_S32_LE | SNDRV_PCM_FMTBIT_S24_LE | \ +- SNDRV_PCM_FMTBIT_S20_3LE | SNDRV_PCM_FMTBIT_S16_LE |\ +- SNDRV_PCM_FMTBIT_S8) ++ (SNDRV_PCM_FMTBIT_S24_LE | SNDRV_PCM_FMTBIT_S16_LE) + + static struct snd_soc_dai_driver hsw_dais[] = { + { diff --git a/queue-3.17/asoc-soc-dapm-fix-use-after-free.patch b/queue-3.17/asoc-soc-dapm-fix-use-after-free.patch new file mode 100644 index 00000000000..3a25fdc204b --- /dev/null +++ b/queue-3.17/asoc-soc-dapm-fix-use-after-free.patch @@ -0,0 +1,88 @@ +From e5092c96c9c28f4d12811edcd02ca8eec16e748e Mon Sep 17 00:00:00 2001 +From: Daniel Mack +Date: Tue, 7 Oct 2014 13:41:24 +0200 +Subject: ASoC: soc-dapm: fix use after free + +From: Daniel Mack + +commit e5092c96c9c28f4d12811edcd02ca8eec16e748e upstream. + +Coverity spotted the following possible use-after-free condition in +dapm_create_or_share_mixmux_kcontrol(): + +If kcontrol is NULL, and (wname_in_long_name && kcname_in_long_name) +validates to true, 'name' will be set to an allocated string, and be +freed a few lines later via the 'long_name' alias. 'name', however, +is used by dev_err() in case snd_ctl_add() fails. + +Fix this by adding a jump label that frees 'long_name' at the end of +the function. + +Signed-off-by: Daniel Mack +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/soc-dapm.c | 25 ++++++++++++++----------- + 1 file changed, 14 insertions(+), 11 deletions(-) + +--- a/sound/soc/soc-dapm.c ++++ b/sound/soc/soc-dapm.c +@@ -591,9 +591,9 @@ static int dapm_create_or_share_mixmux_k + int shared; + struct snd_kcontrol *kcontrol; + bool wname_in_long_name, kcname_in_long_name; +- char *long_name; ++ char *long_name = NULL; + const char *name; +- int ret; ++ int ret = 0; + + prefix = soc_dapm_prefix(dapm); + if (prefix) +@@ -652,15 +652,17 @@ static int dapm_create_or_share_mixmux_k + + kcontrol = snd_soc_cnew(&w->kcontrol_news[kci], NULL, name, + prefix); +- kfree(long_name); +- if (!kcontrol) +- return -ENOMEM; ++ if (!kcontrol) { ++ ret = -ENOMEM; ++ goto exit_free; ++ } ++ + kcontrol->private_free = dapm_kcontrol_free; + + ret = dapm_kcontrol_data_alloc(w, kcontrol); + if (ret) { + snd_ctl_free_one(kcontrol); +- return ret; ++ goto exit_free; + } + + ret = snd_ctl_add(card, kcontrol); +@@ -668,17 +670,18 @@ static int dapm_create_or_share_mixmux_k + dev_err(dapm->dev, + "ASoC: failed to add widget %s dapm kcontrol %s: %d\n", + w->name, name, ret); +- return ret; ++ goto exit_free; + } + } + + ret = dapm_kcontrol_add_widget(kcontrol, w); +- if (ret) +- return ret; ++ if (ret == 0) ++ w->kcontrols[kci] = kcontrol; + +- w->kcontrols[kci] = kcontrol; ++exit_free: ++ kfree(long_name); + +- return 0; ++ return ret; + } + + /* create new dapm mixer control */ diff --git a/queue-3.17/asoc-soc-pcm-fix-sig_bits-determination-in-soc_pcm_apply_msb.patch b/queue-3.17/asoc-soc-pcm-fix-sig_bits-determination-in-soc_pcm_apply_msb.patch new file mode 100644 index 00000000000..42f40211601 --- /dev/null +++ b/queue-3.17/asoc-soc-pcm-fix-sig_bits-determination-in-soc_pcm_apply_msb.patch @@ -0,0 +1,33 @@ +From 5e63dfccf34d4dbf21429c4919f33c028ff49991 Mon Sep 17 00:00:00 2001 +From: Daniel Mack +Date: Tue, 7 Oct 2014 14:33:46 +0200 +Subject: ASoC: soc-pcm: fix sig_bits determination in soc_pcm_apply_msb() + +From: Daniel Mack + +commit 5e63dfccf34d4dbf21429c4919f33c028ff49991 upstream. + +In the SNDRV_PCM_STREAM_CAPTURE branch in soc_pcm_apply_msb(), look at +sig_bits of the capture stream, not the playback one. + +Spotted by coverity. + +Signed-off-by: Daniel Mack +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/soc-pcm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/soc/soc-pcm.c ++++ b/sound/soc/soc-pcm.c +@@ -352,7 +352,7 @@ static void soc_pcm_apply_msb(struct snd + } else { + for (i = 0; i < rtd->num_codecs; i++) { + codec_dai = rtd->codec_dais[i]; +- if (codec_dai->driver->playback.sig_bits == 0) { ++ if (codec_dai->driver->capture.sig_bits == 0) { + bits = 0; + break; + } diff --git a/queue-3.17/asoc-tlv320aic3x-fix-pll-d-configuration.patch b/queue-3.17/asoc-tlv320aic3x-fix-pll-d-configuration.patch new file mode 100644 index 00000000000..4728c430855 --- /dev/null +++ b/queue-3.17/asoc-tlv320aic3x-fix-pll-d-configuration.patch @@ -0,0 +1,63 @@ +From 31d9f8faf9a54c851e835af489c82f45105a442f Mon Sep 17 00:00:00 2001 +From: Dmitry Lavnikevich +Date: Fri, 3 Oct 2014 16:18:56 +0300 +Subject: ASoC: tlv320aic3x: fix PLL D configuration + +From: Dmitry Lavnikevich + +commit 31d9f8faf9a54c851e835af489c82f45105a442f upstream. + +Current caching implementation during regcache_sync() call bypasses +all register writes of values that are already known as default +(regmap reg_defaults). Same time in TLV320AIC3x codecs register 5 +(AIC3X_PLL_PROGC_REG) write should be immediately followed by register +6 write (AIC3X_PLL_PROGD_REG) even if it was not changed. Otherwise +both registers will not be written. + +This brings to issue that appears particulary in case of 44.1kHz +playback with 19.2MHz master clock. In this case AIC3X_PLL_PROGC_REG +is 0x6e while AIC3X_PLL_PROGD_REG is 0x0 (same as register +default). Thus AIC3X_PLL_PROGC_REG also remains not written and we get +wrong playback speed. + +In this patch snd_soc_read() is used to get cached pll values and +snd_soc_write() (unlike regcache_sync() this function doesn't bypasses +hardware default values) to write them to registers. + +Signed-off-by: Dmitry Lavnikevich +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/codecs/tlv320aic3x.c | 13 +++++++++++++ + 1 file changed, 13 insertions(+) + +--- a/sound/soc/codecs/tlv320aic3x.c ++++ b/sound/soc/codecs/tlv320aic3x.c +@@ -1121,6 +1121,7 @@ static int aic3x_regulator_event(struct + static int aic3x_set_power(struct snd_soc_codec *codec, int power) + { + struct aic3x_priv *aic3x = snd_soc_codec_get_drvdata(codec); ++ unsigned int pll_c, pll_d; + int ret; + + if (power) { +@@ -1138,6 +1139,18 @@ static int aic3x_set_power(struct snd_so + /* Sync reg_cache with the hardware */ + regcache_cache_only(aic3x->regmap, false); + regcache_sync(aic3x->regmap); ++ ++ /* Rewrite paired PLL D registers in case cached sync skipped ++ * writing one of them and thus caused other one also not ++ * being written ++ */ ++ pll_c = snd_soc_read(codec, AIC3X_PLL_PROGC_REG); ++ pll_d = snd_soc_read(codec, AIC3X_PLL_PROGD_REG); ++ if (pll_c == aic3x_reg[AIC3X_PLL_PROGC_REG].def || ++ pll_d == aic3x_reg[AIC3X_PLL_PROGD_REG].def) { ++ snd_soc_write(codec, AIC3X_PLL_PROGC_REG, pll_c); ++ snd_soc_write(codec, AIC3X_PLL_PROGD_REG, pll_d); ++ } + } else { + /* + * Do soft reset to this codec instance in order to clear diff --git a/queue-3.17/fs-allow-open-dir-o_tmpfile-...-0-with-mode-0.patch b/queue-3.17/fs-allow-open-dir-o_tmpfile-...-0-with-mode-0.patch new file mode 100644 index 00000000000..657596707c8 --- /dev/null +++ b/queue-3.17/fs-allow-open-dir-o_tmpfile-...-0-with-mode-0.patch @@ -0,0 +1,87 @@ +From 69a91c237ab0ebe4e9fdeaf6d0090c85275594ec Mon Sep 17 00:00:00 2001 +From: Eric Rannaud +Date: Thu, 30 Oct 2014 01:51:01 -0700 +Subject: fs: allow open(dir, O_TMPFILE|..., 0) with mode 0 + +From: Eric Rannaud + +commit 69a91c237ab0ebe4e9fdeaf6d0090c85275594ec upstream. + +The man page for open(2) indicates that when O_CREAT is specified, the +'mode' argument applies only to future accesses to the file: + + Note that this mode applies only to future accesses of the newly + created file; the open() call that creates a read-only file + may well return a read/write file descriptor. + +The man page for open(2) implies that 'mode' is treated identically by +O_CREAT and O_TMPFILE. + +O_TMPFILE, however, behaves differently: + + int fd = open("/tmp", O_TMPFILE | O_RDWR, 0); + assert(fd == -1); + assert(errno == EACCES); + + int fd = open("/tmp", O_TMPFILE | O_RDWR, 0600); + assert(fd > 0); + +For O_CREAT, do_last() sets acc_mode to MAY_OPEN only: + + if (*opened & FILE_CREATED) { + /* Don't check for write permission, don't truncate */ + open_flag &= ~O_TRUNC; + will_truncate = false; + acc_mode = MAY_OPEN; + path_to_nameidata(path, nd); + goto finish_open_created; + } + +But for O_TMPFILE, do_tmpfile() passes the full op->acc_mode to +may_open(). + +This patch lines up the behavior of O_TMPFILE with O_CREAT. After the +inode is created, may_open() is called with acc_mode = MAY_OPEN, in +do_tmpfile(). + +A different, but related glibc bug revealed the discrepancy: +https://sourceware.org/bugzilla/show_bug.cgi?id=17523 + +The glibc lazily loads the 'mode' argument of open() and openat() using +va_arg() only if O_CREAT is present in 'flags' (to support both the 2 +argument and the 3 argument forms of open; same idea for openat()). +However, the glibc ignores the 'mode' argument if O_TMPFILE is in +'flags'. + +On x86_64, for open(), it magically works anyway, as 'mode' is in +RDX when entering open(), and is still in RDX on SYSCALL, which is where +the kernel looks for the 3rd argument of a syscall. + +But openat() is not quite so lucky: 'mode' is in RCX when entering the +glibc wrapper for openat(), while the kernel looks for the 4th argument +of a syscall in R10. Indeed, the syscall calling convention differs from +the regular calling convention in this respect on x86_64. So the kernel +sees mode = 0 when trying to use glibc openat() with O_TMPFILE, and +fails with EACCES. + +Signed-off-by: Eric Rannaud +Acked-by: Andy Lutomirski +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + fs/namei.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/fs/namei.c ++++ b/fs/namei.c +@@ -3154,7 +3154,8 @@ static int do_tmpfile(int dfd, struct fi + if (error) + goto out2; + audit_inode(pathname, nd->path.dentry, 0); +- error = may_open(&nd->path, op->acc_mode, op->open_flag); ++ /* Don't check for other permissions, the inode was just created */ ++ error = may_open(&nd->path, MAY_OPEN, op->open_flag); + if (error) + goto out2; + file->f_path.mnt = nd->path.mnt; diff --git a/queue-3.17/fs-fix-theoretical-division-by-0-in-super_cache_scan.patch b/queue-3.17/fs-fix-theoretical-division-by-0-in-super_cache_scan.patch new file mode 100644 index 00000000000..d728148dc5d --- /dev/null +++ b/queue-3.17/fs-fix-theoretical-division-by-0-in-super_cache_scan.patch @@ -0,0 +1,37 @@ +From 475d0db742e3755c6b267f48577ff7cbb7dfda0d Mon Sep 17 00:00:00 2001 +From: Tetsuo Handa +Date: Sat, 17 May 2014 20:56:38 +0900 +Subject: fs: Fix theoretical division by 0 in super_cache_scan(). + +From: Tetsuo Handa + +commit 475d0db742e3755c6b267f48577ff7cbb7dfda0d upstream. + +total_objects could be 0 and is used as a denom. + +While total_objects is a "long", total_objects == 0 unlikely happens for +3.12 and later kernels because 32-bit architectures would not be able to +hold (1 << 32) objects. However, total_objects == 0 may happen for kernels +between 3.1 and 3.11 because total_objects in prune_super() was an "int" +and (e.g.) x86_64 architecture might be able to hold (1 << 32) objects. + +Signed-off-by: Tetsuo Handa +Reviewed-by: Christoph Hellwig +Signed-off-by: Al Viro +Signed-off-by: Greg Kroah-Hartman + +--- + fs/super.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/fs/super.c ++++ b/fs/super.c +@@ -80,6 +80,8 @@ static unsigned long super_cache_scan(st + inodes = list_lru_count_node(&sb->s_inode_lru, sc->nid); + dentries = list_lru_count_node(&sb->s_dentry_lru, sc->nid); + total_objects = dentries + inodes + fs_objects + 1; ++ if (!total_objects) ++ total_objects = 1; + + /* proportion the scan between the caches */ + dentries = mult_frac(sc->nr_to_scan, dentries, total_objects); diff --git a/queue-3.17/fs-make-cont_expand_zero-interruptible.patch b/queue-3.17/fs-make-cont_expand_zero-interruptible.patch new file mode 100644 index 00000000000..b86ba1954b8 --- /dev/null +++ b/queue-3.17/fs-make-cont_expand_zero-interruptible.patch @@ -0,0 +1,42 @@ +From c2ca0fcd202863b14bd041a7fece2e789926c225 Mon Sep 17 00:00:00 2001 +From: Mikulas Patocka +Date: Sun, 27 Jul 2014 13:00:41 -0400 +Subject: fs: make cont_expand_zero interruptible + +From: Mikulas Patocka + +commit c2ca0fcd202863b14bd041a7fece2e789926c225 upstream. + +This patch makes it possible to kill a process looping in +cont_expand_zero. A process may spend a lot of time in this function, so +it is desirable to be able to kill it. + +It happened to me that I wanted to copy a piece data from the disk to a +file. By mistake, I used the "seek" parameter to dd instead of "skip". Due +to the "seek" parameter, dd attempted to extend the file and became stuck +doing so - the only possibility was to reset the machine or wait many +hours until the filesystem runs out of space and cont_expand_zero fails. +We need this patch to be able to terminate the process. + +Signed-off-by: Mikulas Patocka +Signed-off-by: Al Viro +Signed-off-by: Greg Kroah-Hartman + +--- + fs/buffer.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/fs/buffer.c ++++ b/fs/buffer.c +@@ -2318,6 +2318,11 @@ static int cont_expand_zero(struct file + err = 0; + + balance_dirty_pages_ratelimited(mapping); ++ ++ if (unlikely(fatal_signal_pending(current))) { ++ err = -EINTR; ++ goto out; ++ } + } + + /* page covers the boundary, find the boundary offset */ diff --git a/queue-3.17/libata-sff-fix-controllers-with-no-ctl-port.patch b/queue-3.17/libata-sff-fix-controllers-with-no-ctl-port.patch new file mode 100644 index 00000000000..38869228756 --- /dev/null +++ b/queue-3.17/libata-sff-fix-controllers-with-no-ctl-port.patch @@ -0,0 +1,110 @@ +From 6d8ca28fa688a9354bc9fbc935bdaeb3651b6677 Mon Sep 17 00:00:00 2001 +From: Ondrej Zary +Date: Sat, 27 Sep 2014 00:04:46 +0200 +Subject: libata-sff: Fix controllers with no ctl port + +From: Ondrej Zary + +commit 6d8ca28fa688a9354bc9fbc935bdaeb3651b6677 upstream. + +Currently, ata_sff_softreset is skipped for controllers with no ctl port. +But that also skips ata_sff_dev_classify required for device detection. +This means that libata is currently broken on controllers with no ctl port. + +No device connected: +[ 1.872480] pata_isapnp 01:01.02: activated +[ 1.889823] scsi2 : pata_isapnp +[ 1.890109] ata3: PATA max PIO0 cmd 0x1e8 ctl 0x0 irq 11 +[ 6.888110] ata3.01: qc timeout (cmd 0xec) +[ 6.888179] ata3.01: failed to IDENTIFY (I/O error, err_mask=0x5) +[ 16.888085] ata3.01: qc timeout (cmd 0xec) +[ 16.888147] ata3.01: failed to IDENTIFY (I/O error, err_mask=0x5) +[ 46.888086] ata3.01: qc timeout (cmd 0xec) +[ 46.888148] ata3.01: failed to IDENTIFY (I/O error, err_mask=0x5) +[ 51.888100] ata3.00: qc timeout (cmd 0xec) +[ 51.888160] ata3.00: failed to IDENTIFY (I/O error, err_mask=0x5) +[ 61.888079] ata3.00: qc timeout (cmd 0xec) +[ 61.888141] ata3.00: failed to IDENTIFY (I/O error, err_mask=0x5) +[ 91.888089] ata3.00: qc timeout (cmd 0xec) +[ 91.888152] ata3.00: failed to IDENTIFY (I/O error, err_mask=0x5) + +ATAPI device connected: +[ 1.882061] pata_isapnp 01:01.02: activated +[ 1.893430] scsi2 : pata_isapnp +[ 1.893719] ata3: PATA max PIO0 cmd 0x1e8 ctl 0x0 irq 11 +[ 6.892107] ata3.01: qc timeout (cmd 0xec) +[ 6.892171] ata3.01: failed to IDENTIFY (I/O error, err_mask=0x5) +[ 16.892079] ata3.01: qc timeout (cmd 0xec) +[ 16.892138] ata3.01: failed to IDENTIFY (I/O error, err_mask=0x5) +[ 46.892079] ata3.01: qc timeout (cmd 0xec) +[ 46.892138] ata3.01: failed to IDENTIFY (I/O error, err_mask=0x5) +[ 46.908586] ata3.00: ATAPI: ACER CD-767E/O, V1.5X, max PIO2, CDB intr +[ 46.924570] ata3.00: configured for PIO0 (device error ignored) +[ 46.926295] scsi 2:0:0:0: CD-ROM ACER CD-767E/O 1.5X PQ: 0 ANSI: 5 +[ 46.984519] sr0: scsi3-mmc drive: 6x/6x xa/form2 tray +[ 46.984592] cdrom: Uniform CD-ROM driver Revision: 3.20 + +So don't skip ata_sff_softreset, just skip the reset part of ata_bus_softreset +if the ctl port is not available. + +This makes IDE port on ES968 behave correctly: + +No device connected: +[ 4.670888] pata_isapnp 01:01.02: activated +[ 4.673207] scsi host2: pata_isapnp +[ 4.673675] ata3: PATA max PIO0 cmd 0x1e8 ctl 0x0 irq 11 +[ 7.081840] Adding 2541652k swap on /dev/sda2. Priority:-1 extents:1 across:2541652k + +ATAPI device connected: +[ 4.704362] pata_isapnp 01:01.02: activated +[ 4.706620] scsi host2: pata_isapnp +[ 4.706877] ata3: PATA max PIO0 cmd 0x1e8 ctl 0x0 irq 11 +[ 4.872782] ata3.00: ATAPI: ACER CD-767E/O, V1.5X, max PIO2, CDB intr +[ 4.888673] ata3.00: configured for PIO0 (device error ignored) +[ 4.893984] scsi 2:0:0:0: CD-ROM ACER CD-767E/O 1.5X PQ: 0 ANSI: 5 +[ 7.015578] Adding 2541652k swap on /dev/sda2. Priority:-1 extents:1 across:2541652k + +Signed-off-by: Ondrej Zary +Signed-off-by: Tejun Heo +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ata/libata-sff.c | 20 +++++++++----------- + 1 file changed, 9 insertions(+), 11 deletions(-) + +--- a/drivers/ata/libata-sff.c ++++ b/drivers/ata/libata-sff.c +@@ -2008,13 +2008,15 @@ static int ata_bus_softreset(struct ata_ + + DPRINTK("ata%u: bus reset via SRST\n", ap->print_id); + +- /* software reset. causes dev0 to be selected */ +- iowrite8(ap->ctl, ioaddr->ctl_addr); +- udelay(20); /* FIXME: flush */ +- iowrite8(ap->ctl | ATA_SRST, ioaddr->ctl_addr); +- udelay(20); /* FIXME: flush */ +- iowrite8(ap->ctl, ioaddr->ctl_addr); +- ap->last_ctl = ap->ctl; ++ if (ap->ioaddr.ctl_addr) { ++ /* software reset. causes dev0 to be selected */ ++ iowrite8(ap->ctl, ioaddr->ctl_addr); ++ udelay(20); /* FIXME: flush */ ++ iowrite8(ap->ctl | ATA_SRST, ioaddr->ctl_addr); ++ udelay(20); /* FIXME: flush */ ++ iowrite8(ap->ctl, ioaddr->ctl_addr); ++ ap->last_ctl = ap->ctl; ++ } + + /* wait the port to become ready */ + return ata_sff_wait_after_reset(&ap->link, devmask, deadline); +@@ -2215,10 +2217,6 @@ void ata_sff_error_handler(struct ata_po + + spin_unlock_irqrestore(ap->lock, flags); + +- /* ignore ata_sff_softreset if ctl isn't accessible */ +- if (softreset == ata_sff_softreset && !ap->ioaddr.ctl_addr) +- softreset = NULL; +- + /* ignore built-in hardresets if SCR access is not available */ + if ((hardreset == sata_std_hardreset || + hardreset == sata_sff_hardreset) && !sata_scr_valid(&ap->link)) diff --git a/queue-3.17/lockd-try-to-reconnect-if-statd-has-moved.patch b/queue-3.17/lockd-try-to-reconnect-if-statd-has-moved.patch new file mode 100644 index 00000000000..352c4fdd4c5 --- /dev/null +++ b/queue-3.17/lockd-try-to-reconnect-if-statd-has-moved.patch @@ -0,0 +1,36 @@ +From 173b3afceebe76fa2205b2c8808682d5b541fe3c Mon Sep 17 00:00:00 2001 +From: Benjamin Coddington +Date: Tue, 23 Sep 2014 12:26:20 -0400 +Subject: lockd: Try to reconnect if statd has moved + +From: Benjamin Coddington + +commit 173b3afceebe76fa2205b2c8808682d5b541fe3c upstream. + +If rpc.statd is restarted, upcalls to monitor hosts can fail with +ECONNREFUSED. In that case force a lookup of statd's new port and retry the +upcall. + +Signed-off-by: Benjamin Coddington +Signed-off-by: Trond Myklebust +Signed-off-by: Greg Kroah-Hartman + +--- + fs/lockd/mon.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/fs/lockd/mon.c ++++ b/fs/lockd/mon.c +@@ -159,6 +159,12 @@ static int nsm_mon_unmon(struct nsm_hand + + msg.rpc_proc = &clnt->cl_procinfo[proc]; + status = rpc_call_sync(clnt, &msg, RPC_TASK_SOFTCONN); ++ if (status == -ECONNREFUSED) { ++ dprintk("lockd: NSM upcall RPC failed, status=%d, forcing rebind\n", ++ status); ++ rpc_force_rebind(clnt); ++ status = rpc_call_sync(clnt, &msg, RPC_TASK_SOFTCONN); ++ } + if (status < 0) + dprintk("lockd: NSM upcall RPC failed, status=%d\n", + status); diff --git a/queue-3.17/mmc-core-sdio-fix-unconditional-wake_up_process-on-sdio-thread.patch b/queue-3.17/mmc-core-sdio-fix-unconditional-wake_up_process-on-sdio-thread.patch new file mode 100644 index 00000000000..be6d3d9cb01 --- /dev/null +++ b/queue-3.17/mmc-core-sdio-fix-unconditional-wake_up_process-on-sdio-thread.patch @@ -0,0 +1,70 @@ +From dea67c4ec8218b301d7cac7ee6e63dac0bc566cb Mon Sep 17 00:00:00 2001 +From: Fu Zhonghui +Date: Mon, 18 Aug 2014 10:48:14 +0800 +Subject: mmc: core: sdio: Fix unconditional wake_up_process() on sdio thread + +From: Fu Zhonghui + +commit dea67c4ec8218b301d7cac7ee6e63dac0bc566cb upstream. + +781e989cf59 ("mmc: sdhci: convert to new SDIO IRQ handling") and +bf3b5ec66bd ("mmc: sdio_irq: rework sdio irq handling") disabled +the use of our own custom threaded IRQ handler, but left in an +unconditional wake_up_process() on that handler at resume-time. +Link: https://bugzilla.kernel.org/show_bug.cgi?id=80151 + +In addition, the check for MMC_CAP_SDIO_IRQ capability is added +before enable sdio IRQ. + +Signed-off-by: Jaehoon Chung +Signed-off-by: Chris Ball +Signed-off-by: Fu Zhonghui +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mmc/core/sdio.c | 12 ++++++++++-- + drivers/mmc/core/sdio_irq.c | 4 ++-- + 2 files changed, 12 insertions(+), 4 deletions(-) + +--- a/drivers/mmc/core/sdio.c ++++ b/drivers/mmc/core/sdio.c +@@ -992,8 +992,16 @@ static int mmc_sdio_resume(struct mmc_ho + } + } + +- if (!err && host->sdio_irqs) +- wake_up_process(host->sdio_irq_thread); ++ if (!err && host->sdio_irqs) { ++ if (!(host->caps2 & MMC_CAP2_SDIO_IRQ_NOTHREAD)) { ++ wake_up_process(host->sdio_irq_thread); ++ } else if (host->caps & MMC_CAP_SDIO_IRQ) { ++ mmc_host_clk_hold(host); ++ host->ops->enable_sdio_irq(host, 1); ++ mmc_host_clk_release(host); ++ } ++ } ++ + mmc_release_host(host); + + host->pm_flags &= ~MMC_PM_KEEP_POWER; +--- a/drivers/mmc/core/sdio_irq.c ++++ b/drivers/mmc/core/sdio_irq.c +@@ -208,7 +208,7 @@ static int sdio_card_irq_get(struct mmc_ + host->sdio_irqs--; + return err; + } +- } else { ++ } else if (host->caps & MMC_CAP_SDIO_IRQ) { + mmc_host_clk_hold(host); + host->ops->enable_sdio_irq(host, 1); + mmc_host_clk_release(host); +@@ -229,7 +229,7 @@ static int sdio_card_irq_put(struct mmc_ + if (!(host->caps2 & MMC_CAP2_SDIO_IRQ_NOTHREAD)) { + atomic_set(&host->sdio_irq_thread_abort, 1); + kthread_stop(host->sdio_irq_thread); +- } else { ++ } else if (host->caps & MMC_CAP_SDIO_IRQ) { + mmc_host_clk_hold(host); + host->ops->enable_sdio_irq(host, 0); + mmc_host_clk_release(host); diff --git a/queue-3.17/mmc-don-t-request-cd-irq-until-mmc_start_host.patch b/queue-3.17/mmc-don-t-request-cd-irq-until-mmc_start_host.patch new file mode 100644 index 00000000000..b4c3cbffaa7 --- /dev/null +++ b/queue-3.17/mmc-don-t-request-cd-irq-until-mmc_start_host.patch @@ -0,0 +1,130 @@ +From d4d11449088ee9aca16fd1884b852b8b73a4bda1 Mon Sep 17 00:00:00 2001 +From: Stephen Warren +Date: Mon, 22 Sep 2014 09:57:42 -0600 +Subject: mmc: don't request CD IRQ until mmc_start_host() + +From: Stephen Warren + +commit d4d11449088ee9aca16fd1884b852b8b73a4bda1 upstream. + +As soon as the CD IRQ is requested, it can trigger, since it's an +externally controlled event. If it does, delayed_work host->detect will +be scheduled. + +Many host controller probe()s are roughly structured as: + +*_probe() { + host = sdhci_pltfm_init(); + mmc_of_parse(host->mmc); + rc = sdhci_add_host(host); + if (rc) { + sdhci_pltfm_free(); + return rc; + } + +In 3.17, CD IRQs can are enabled quite early via *_probe() -> +mmc_of_parse() -> mmc_gpio_request_cd() -> mmc_gpiod_request_cd_irq(). + +Note that in linux-next, mmc_of_parse() calls mmc_gpio*d*_request_cd() +rather than mmc_gpio_request_cd(), and mmc_gpio*d*_request_cd() doesn't +call mmc_gpiod_request_cd_irq(). However, this issue still exists if +mmc_gpio_request_cd() is called directly before mmc_start_host(). + +sdhci_add_host() may fail part way through (e.g. due to deferred +probe for a vmmc regulator), and sdhci_pltfm_free() does nothing to +unrequest the CD IRQ nor cancel the delayed_work. sdhci_pltfm_free() is +coded to assume that if sdhci_add_host() failed, then the delayed_work +cannot (or should not) have been triggered. + +This can lead to the following with CONFIG_DEBUG_OBJECTS_* enabled, when +kfree(host) is eventually called inside sdhci_pltfm_free(): + +WARNING: CPU: 2 PID: 6 at lib/debugobjects.c:263 debug_print_object+0x8c/0xb4() +ODEBUG: free active (active state 0) object type: timer_list hint: delayed_work_timer_fn+0x0/0x18 + +The object being complained about is host->detect. + +There's no need to request the CD IRQ so early; mmc_start_host() already +requests it. For most SDHCI hosts at least, the typical call path that +does this is: *_probe() -> sdhci_add_host() -> mmc_add_host() -> +mmc_start_host(). Therefore, remove the call to mmc_gpiod_request_cd_irq() +from mmc_gpio_request_cd(). This also matches mmc_gpio*d*_request_cd(), +which already doesn't call mmc_gpiod_request_cd_irq(). + +However, some host controller drivers call mmc_gpio_request_cd() after +mmc_start_host() has already been called, and assume that this will also +call mmc_gpiod_request_cd_irq(). Update those drivers to explicitly call +mmc_gpiod_request_cd_irq() themselves. Ideally, these drivers should be +modified to move their call to mmc_gpio_request_cd() before their call +to mmc_add_host(). However that's too large a change for stable. + +This solves the problem (eliminates the kernel error message above), +since it guarantees that the IRQ can't trigger before mmc_start_host() +is called. + +The critical point here is that once sdhci_add_host() calls +mmc_add_host() -> mmc_start_host(), sdhci_add_host() is coded not to +fail. In other words, if there's a chance that mmc_start_host() may have +been called, and CD IRQs triggered, and the delayed_work scheduled, +sdhci_add_host() won't fail, and so cleanup is no longer via +sdhci_pltfm_free() (which doesn't free the IRQ or cancel the work queue) +but instead must be via sdhci_remove_host(), which calls mmc_remove_host() +-> mmc_stop_host(), which does free the IRQ and cancel the work queue. + +CC: Russell King +Cc: Adrian Hunter +Cc: Alexandre Courbot +Cc: Linus Walleij +Signed-off-by: Stephen Warren +Acked-by: Adrian Hunter +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mmc/core/slot-gpio.c | 2 -- + drivers/mmc/host/mmc_spi.c | 1 + + drivers/mmc/host/sdhci-sirf.c | 1 + + drivers/mmc/host/tmio_mmc_pio.c | 1 + + 4 files changed, 3 insertions(+), 2 deletions(-) + +--- a/drivers/mmc/core/slot-gpio.c ++++ b/drivers/mmc/core/slot-gpio.c +@@ -221,8 +221,6 @@ int mmc_gpio_request_cd(struct mmc_host + ctx->override_cd_active_level = true; + ctx->cd_gpio = gpio_to_desc(gpio); + +- mmc_gpiod_request_cd_irq(host); +- + return 0; + } + EXPORT_SYMBOL(mmc_gpio_request_cd); +--- a/drivers/mmc/host/mmc_spi.c ++++ b/drivers/mmc/host/mmc_spi.c +@@ -1436,6 +1436,7 @@ static int mmc_spi_probe(struct spi_devi + host->pdata->cd_debounce); + if (status != 0) + goto fail_add_host; ++ mmc_gpiod_request_cd_irq(mmc); + } + + if (host->pdata && host->pdata->flags & MMC_SPI_USE_RO_GPIO) { +--- a/drivers/mmc/host/sdhci-sirf.c ++++ b/drivers/mmc/host/sdhci-sirf.c +@@ -94,6 +94,7 @@ static int sdhci_sirf_probe(struct platf + ret); + goto err_request_cd; + } ++ mmc_gpiod_request_cd_irq(host->mmc); + } + + return 0; +--- a/drivers/mmc/host/tmio_mmc_pio.c ++++ b/drivers/mmc/host/tmio_mmc_pio.c +@@ -1103,6 +1103,7 @@ int tmio_mmc_host_probe(struct tmio_mmc_ + tmio_mmc_host_remove(_host); + return ret; + } ++ mmc_gpiod_request_cd_irq(mmc); + } + + *host = _host; diff --git a/queue-3.17/mmc-rtsx_pci_sdmmc-fix-incorrect-last-byte-in-r2-response.patch b/queue-3.17/mmc-rtsx_pci_sdmmc-fix-incorrect-last-byte-in-r2-response.patch new file mode 100644 index 00000000000..5ae027ca633 --- /dev/null +++ b/queue-3.17/mmc-rtsx_pci_sdmmc-fix-incorrect-last-byte-in-r2-response.patch @@ -0,0 +1,42 @@ +From d1419d50c1bf711e9fd27b516a739c86b23f7cf9 Mon Sep 17 00:00:00 2001 +From: Roger Tseng +Date: Fri, 15 Aug 2014 14:06:00 +0800 +Subject: mmc: rtsx_pci_sdmmc: fix incorrect last byte in R2 response + +From: Roger Tseng + +commit d1419d50c1bf711e9fd27b516a739c86b23f7cf9 upstream. + +Current code erroneously fill the last byte of R2 response with an undefined +value. In addition, the controller actually 'offloads' the last byte +(CRC7, end bit) while receiving R2 response and thus it's impossible to get the +actual value. This could cause mmc stack to obtain inconsistent CID from the +same card after resume and misidentify it as a different card. + +Fix by assigning dummy CRC and end bit: {7'b0, 1} = 0x1 to the last byte of R2. + +Fixes: ff984e57d36e ("mmc: Add realtek pcie sdmmc host driver") +Signed-off-by: Roger Tseng +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mmc/host/rtsx_pci_sdmmc.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/mmc/host/rtsx_pci_sdmmc.c ++++ b/drivers/mmc/host/rtsx_pci_sdmmc.c +@@ -412,6 +412,13 @@ static void sd_send_cmd_get_rsp(struct r + } + + if (rsp_type == SD_RSP_TYPE_R2) { ++ /* ++ * The controller offloads the last byte {CRC-7, end bit 1'b1} ++ * of response type R2. Assign dummy CRC, 0, and end bit to the ++ * byte(ptr[16], goes into the LSB of resp[3] later). ++ */ ++ ptr[16] = 1; ++ + for (i = 0; i < 4; i++) { + cmd->resp[i] = get_unaligned_be32(ptr + 1 + i * 4); + dev_dbg(sdmmc_dev(host), "cmd->resp[%d] = 0x%08x\n", diff --git a/queue-3.17/mmc-rtsx_usb_sdmmc-fix-incorrect-last-byte-in-r2-response.patch b/queue-3.17/mmc-rtsx_usb_sdmmc-fix-incorrect-last-byte-in-r2-response.patch new file mode 100644 index 00000000000..ef62b104374 --- /dev/null +++ b/queue-3.17/mmc-rtsx_usb_sdmmc-fix-incorrect-last-byte-in-r2-response.patch @@ -0,0 +1,42 @@ +From 6f67cc6fd1cf339a0f19b9d4a998ec3c0123b1b6 Mon Sep 17 00:00:00 2001 +From: Roger Tseng +Date: Fri, 15 Aug 2014 14:06:01 +0800 +Subject: mmc: rtsx_usb_sdmmc: fix incorrect last byte in R2 response + +From: Roger Tseng + +commit 6f67cc6fd1cf339a0f19b9d4a998ec3c0123b1b6 upstream. + +Current code erroneously fill the last byte of R2 response with an undefined +value. In addition, the controller actually 'offloads' the last byte +(CRC7, end bit) while receiving R2 response and thus it's impossible to get the +actual value. This could cause mmc stack to obtain inconsistent CID from the +same card after resume and misidentify it as a different card. + +Fix by assigning dummy CRC and end bit: {7'b0, 1} = 0x1 to the last byte of R2. + +Fixes: c7f6558d84af ("mmc: Add realtek USB sdmmc host driver") +Signed-off-by: Roger Tseng +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mmc/host/rtsx_usb_sdmmc.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/mmc/host/rtsx_usb_sdmmc.c ++++ b/drivers/mmc/host/rtsx_usb_sdmmc.c +@@ -435,6 +435,13 @@ static void sd_send_cmd_get_rsp(struct r + } + + if (rsp_type == SD_RSP_TYPE_R2) { ++ /* ++ * The controller offloads the last byte {CRC-7, end bit 1'b1} ++ * of response type R2. Assign dummy CRC, 0, and end bit to the ++ * byte(ptr[16], goes into the LSB of resp[3] later). ++ */ ++ ptr[16] = 1; ++ + for (i = 0; i < 4; i++) { + cmd->resp[i] = get_unaligned_be32(ptr + 1 + i * 4); + dev_dbg(sdmmc_dev(host), "cmd->resp[%d] = 0x%08x\n", diff --git a/queue-3.17/mmc-sdhci-pxav3-set_uhs_signaling-is-initialized-twice-differently.patch b/queue-3.17/mmc-sdhci-pxav3-set_uhs_signaling-is-initialized-twice-differently.patch new file mode 100644 index 00000000000..4d3e406cf74 --- /dev/null +++ b/queue-3.17/mmc-sdhci-pxav3-set_uhs_signaling-is-initialized-twice-differently.patch @@ -0,0 +1,47 @@ +From b315376573778b195e640a163675fb9f5937ddca Mon Sep 17 00:00:00 2001 +From: Peter Griffin +Date: Fri, 15 Aug 2014 14:02:15 +0100 +Subject: mmc: sdhci-pxav3: set_uhs_signaling is initialized twice differently + +From: Peter Griffin + +commit b315376573778b195e640a163675fb9f5937ddca upstream. + +.set_uhs_signaling field is currently initialised twice once to the +arch specific callback pxav3_set_uhs_signaling, and also to the generic +sdhci_set_uhs_signaling callback. + +This means that uhs is currently broken for this platform currently, as pxav3 +has some special constriants which means it can't use the generic callback. + +This happened in +commit 96d7b78cfc2f ("mmc: sdhci: convert sdhci_set_uhs_signaling() into a library function") +commit a702c8abb2a9 ("mmc: host: split up sdhci-pxa, create sdhci-pxav3.c")' + +Fix this and hopefully prevent it happening in the future by ensuring named +initialisers always follow the declaration order in the structure definition. + +Signed-off-by: Peter Griffin +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mmc/host/sdhci-pxav3.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/drivers/mmc/host/sdhci-pxav3.c ++++ b/drivers/mmc/host/sdhci-pxav3.c +@@ -224,12 +224,11 @@ static void pxav3_set_uhs_signaling(stru + + static const struct sdhci_ops pxav3_sdhci_ops = { + .set_clock = sdhci_set_clock, +- .set_uhs_signaling = pxav3_set_uhs_signaling, + .platform_send_init_74_clocks = pxav3_gen_init_74_clocks, + .get_max_clock = sdhci_pltfm_clk_get_max_clock, + .set_bus_width = sdhci_set_bus_width, + .reset = pxav3_reset, +- .set_uhs_signaling = sdhci_set_uhs_signaling, ++ .set_uhs_signaling = pxav3_set_uhs_signaling, + }; + + static struct sdhci_pltfm_data sdhci_pxav3_pdata = { diff --git a/queue-3.17/mmc-sdhci-s3c-fix-runtime-pm-handling-on-sdhci_add_host-failure.patch b/queue-3.17/mmc-sdhci-s3c-fix-runtime-pm-handling-on-sdhci_add_host-failure.patch new file mode 100644 index 00000000000..01a269fe649 --- /dev/null +++ b/queue-3.17/mmc-sdhci-s3c-fix-runtime-pm-handling-on-sdhci_add_host-failure.patch @@ -0,0 +1,88 @@ +From 221414db1934c1c883501998f510bb75acfbaa51 Mon Sep 17 00:00:00 2001 +From: Bartlomiej Zolnierkiewicz +Date: Thu, 7 Aug 2014 18:07:07 +0200 +Subject: mmc: sdhci-s3c: fix runtime PM handling on sdhci_add_host() failure + +From: Bartlomiej Zolnierkiewicz + +commit 221414db1934c1c883501998f510bb75acfbaa51 upstream. + +Runtime Power Management handling for the sdhci_add_host() failure +case in sdhci_s3c_probe() should match the code in sdhci_s3c_remove() +(which uses pm_runtime_disable() call which matches the earlier +pm_runtime_enable() one). Fix it. + +This patch fixes "BUG: spinlock bad magic on CPU#0, swapper/0/1" and +"Unbalanced pm_runtime_enable!" warnings. + +>From the kernel log: +... +[ 1.659631] s3c-sdhci 12530000.sdhci: sdhci_add_host() failed +[ 1.665096] BUG: spinlock bad magic on CPU#0, swapper/0/1 +[ 1.670433] lock: 0xea01e484, .magic: 00000000, .owner: /-1, .owner_cpu: 0 +[ 1.677895] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 3.16.0-next-20140804-00008-ga59480f-dirty #707 +[ 1.687037] [] (unwind_backtrace) from [] (show_stack+0x10/0x14) +[ 1.694740] [] (show_stack) from [] (dump_stack+0x68/0xb8) +[ 1.701948] [] (dump_stack) from [] (do_raw_spin_lock+0x15c/0x1a4) +[ 1.709848] [] (do_raw_spin_lock) from [] (_raw_spin_lock_irqsave+0x20/0x28) +[ 1.718619] [] (_raw_spin_lock_irqsave) from [] (sdhci_do_set_ios+0x1c/0x5cc) +[ 1.727464] [] (sdhci_do_set_ios) from [] (sdhci_runtime_resume_host+0x50/0x104) +[ 1.736574] [] (sdhci_runtime_resume_host) from [] (pm_generic_runtime_resume+0x2c/0x40) +[ 1.746383] [] (pm_generic_runtime_resume) from [] (__rpm_callback+0x34/0x70) +[ 1.755233] [] (__rpm_callback) from [] (rpm_callback+0x28/0x88) +[ 1.762958] [] (rpm_callback) from [] (rpm_resume+0x384/0x4ec) +[ 1.770511] [] (rpm_resume) from [] (pm_runtime_forbid+0x58/0x64) +[ 1.778325] [] (pm_runtime_forbid) from [] (sdhci_s3c_probe+0x4a4/0x540) +[ 1.786749] [] (sdhci_s3c_probe) from [] (platform_drv_probe+0x2c/0x5c) +[ 1.795076] [] (platform_drv_probe) from [] (driver_probe_device+0x114/0x234) +[ 1.803929] [] (driver_probe_device) from [] (__driver_attach+0x8c/0x90) +[ 1.812347] [] (__driver_attach) from [] (bus_for_each_dev+0x54/0x88) +[ 1.820506] [] (bus_for_each_dev) from [] (bus_add_driver+0xd8/0x1cc) +[ 1.828665] [] (bus_add_driver) from [] (driver_register+0x78/0xf4) +[ 1.836652] [] (driver_register) from [] (do_one_initcall+0x80/0x1d0) +[ 1.844816] [] (do_one_initcall) from [] (kernel_init_freeable+0x108/0x1d4) +[ 1.853503] [] (kernel_init_freeable) from [] (kernel_init+0x8/0xe4) +[ 1.861568] [] (kernel_init) from [] (ret_from_fork+0x14/0x3c) +[ 1.869582] platform 12530000.sdhci: Driver s3c-sdhci requests probe deferral +... +[ 1.997047] s3c-sdhci 12530000.sdhci: Unbalanced pm_runtime_enable! +... +[ 2.027235] s3c-sdhci 12530000.sdhci: sdhci_add_host() failed +[ 2.032884] platform 12530000.sdhci: Driver s3c-sdhci requests probe deferral +... + +Tested on Hardkernel's Exynos4412 based ODROID-U3 board. + +Fixes: 9f4e8151dbbc ("mmc: sdhci-s3c: Enable runtime power management") +Cc: Mark Brown +Cc: Jaehoon Chung +Cc: Ben Dooks +Signed-off-by: Bartlomiej Zolnierkiewicz +Acked-by: Kyungmin Park +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mmc/host/sdhci-s3c.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/mmc/host/sdhci-s3c.c ++++ b/drivers/mmc/host/sdhci-s3c.c +@@ -606,8 +606,6 @@ static int sdhci_s3c_probe(struct platfo + ret = sdhci_add_host(host); + if (ret) { + dev_err(dev, "sdhci_add_host() failed\n"); +- pm_runtime_forbid(&pdev->dev); +- pm_runtime_get_noresume(&pdev->dev); + goto err_req_regs; + } + +@@ -618,6 +616,8 @@ static int sdhci_s3c_probe(struct platfo + return 0; + + err_req_regs: ++ pm_runtime_disable(&pdev->dev); ++ + err_no_busclks: + clk_disable_unprepare(sc->clk_io); + diff --git a/queue-3.17/pata_serverworks-disable-64-kb-dma-transfers-on-broadcom-osb4-ide-controller.patch b/queue-3.17/pata_serverworks-disable-64-kb-dma-transfers-on-broadcom-osb4-ide-controller.patch new file mode 100644 index 00000000000..1f328ba80d9 --- /dev/null +++ b/queue-3.17/pata_serverworks-disable-64-kb-dma-transfers-on-broadcom-osb4-ide-controller.patch @@ -0,0 +1,162 @@ +From 37017ac6849e772e67dd187ba2fbd056c4afa533 Mon Sep 17 00:00:00 2001 +From: Scott Carter +Date: Wed, 24 Sep 2014 18:13:09 -0700 +Subject: pata_serverworks: disable 64-KB DMA transfers on Broadcom OSB4 IDE Controller + +From: Scott Carter + +commit 37017ac6849e772e67dd187ba2fbd056c4afa533 upstream. + +The Broadcom OSB4 IDE Controller (vendor and device IDs: 1166:0211) +does not support 64-KB DMA transfers. +Whenever a 64-KB DMA transfer is attempted, +the transfer fails and messages similar to the following +are written to the console log: + + [ 2431.851125] sr 0:0:0:0: [sr0] Unhandled sense code + [ 2431.851139] sr 0:0:0:0: [sr0] Result: hostbyte=DID_OK driverbyte=DRIVER_SENSE + [ 2431.851152] sr 0:0:0:0: [sr0] Sense Key : Hardware Error [current] + [ 2431.851166] sr 0:0:0:0: [sr0] Add. Sense: Logical unit communication time-out + [ 2431.851182] sr 0:0:0:0: [sr0] CDB: Read(10): 28 00 00 00 76 f4 00 00 40 00 + [ 2431.851210] end_request: I/O error, dev sr0, sector 121808 + +When the libata and pata_serverworks modules +are recompiled with ATA_DEBUG and ATA_VERBOSE_DEBUG defined in libata.h, +the 64-KB transfer size in the scatter-gather list can be seen +in the console log: + + [ 2664.897267] sr 9:0:0:0: [sr0] Send: + [ 2664.897274] 0xf63d85e0 + [ 2664.897283] sr 9:0:0:0: [sr0] CDB: + [ 2664.897288] Read(10): 28 00 00 00 7f b4 00 00 40 00 + [ 2664.897319] buffer = 0xf6d6fbc0, bufflen = 131072, queuecommand 0xf81b7700 + [ 2664.897331] ata_scsi_dump_cdb: CDB (1:0,0,0) 28 00 00 00 7f b4 00 00 40 + [ 2664.897338] ata_scsi_translate: ENTER + [ 2664.897345] ata_sg_setup: ENTER, ata1 + [ 2664.897356] ata_sg_setup: 3 sg elements mapped + [ 2664.897364] ata_bmdma_fill_sg: PRD[0] = (0x66FD2000, 0xE000) + [ 2664.897371] ata_bmdma_fill_sg: PRD[1] = (0x65000000, 0x10000) + ------------------------------------------------------> ======= + [ 2664.897378] ata_bmdma_fill_sg: PRD[2] = (0x66A10000, 0x2000) + [ 2664.897386] ata1: ata_dev_select: ENTER, device 0, wait 1 + [ 2664.897422] ata_sff_tf_load: feat 0x1 nsect 0x0 lba 0x0 0x0 0xFC + [ 2664.897428] ata_sff_tf_load: device 0xA0 + [ 2664.897448] ata_sff_exec_command: ata1: cmd 0xA0 + [ 2664.897457] ata_scsi_translate: EXIT + [ 2664.897462] leaving scsi_dispatch_cmnd() + [ 2664.897497] Doing sr request, dev = sr0, block = 0 + [ 2664.897507] sr0 : reading 64/256 512 byte blocks. + [ 2664.897553] ata_sff_hsm_move: ata1: protocol 7 task_state 1 (dev_stat 0x58) + [ 2664.897560] atapi_send_cdb: send cdb + [ 2666.910058] ata_bmdma_port_intr: ata1: host_stat 0x64 + [ 2666.910079] __ata_sff_port_intr: ata1: protocol 7 task_state 3 + [ 2666.910093] ata_sff_hsm_move: ata1: protocol 7 task_state 3 (dev_stat 0x51) + [ 2666.910101] ata_sff_hsm_move: ata1: protocol 7 task_state 4 (dev_stat 0x51) + [ 2666.910129] sr 9:0:0:0: [sr0] Done: + [ 2666.910136] 0xf63d85e0 TIMEOUT + +lspci shows that the driver used for the Broadcom OSB4 IDE Controller is +pata_serverworks: + + 00:0f.1 IDE interface: Broadcom OSB4 IDE Controller (prog-if 8e [Master SecP SecO PriP]) + Flags: bus master, medium devsel, latency 64 + [virtual] Memory at 000001f0 (32-bit, non-prefetchable) [size=8] + [virtual] Memory at 000003f0 (type 3, non-prefetchable) [size=1] + I/O ports at 0170 [size=8] + I/O ports at 0374 [size=4] + I/O ports at 1440 [size=16] + Kernel driver in use: pata_serverworks + +The pata_serverworks driver supports five distinct device IDs, +one being the OSB4 and the other four belonging to the CSB series. +The CSB series appears to support 64-KB DMA transfers, +as tests on a machine with an SAI2 motherboard +containing a Broadcom CSB5 IDE Controller (vendor and device IDs: 1166:0212) +showed no problems with 64-KB DMA transfers. + +This problem was first discovered when attempting to install openSUSE +from a DVD on a machine with an STL2 motherboard. +Using the pata_serverworks module, +older releases of openSUSE will not install at all due to the timeouts. +Releases of openSUSE prior to 11.3 can be installed by disabling +the pata_serverworks module using the brokenmodules boot parameter, +which causes the serverworks module to be used instead. +Recent releases of openSUSE (12.2 and later) include better error recovery and +will install, though very slowly. +On all openSUSE releases, the problem can be recreated +on a machine containing a Broadcom OSB4 IDE Controller +by mounting an install DVD and running a command similar to the following: + + find /mnt -type f -print | xargs cat > /dev/null + +The patch below corrects the problem. +Similar to the other ATA drivers that do not support 64-KB DMA transfers, +the patch changes the ata_port_operations qc_prep vector to point to a routine +that breaks any 64-KB segment into two 32-KB segments and +changes the scsi_host_template sg_tablesize element to reduce by half +the number of scatter/gather elements allowed. +These two changes affect only the OSB4. + +Signed-off-by: Scott Carter +Signed-off-by: Tejun Heo +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ata/pata_serverworks.c | 13 +++++++++++-- + 1 file changed, 11 insertions(+), 2 deletions(-) + +--- a/drivers/ata/pata_serverworks.c ++++ b/drivers/ata/pata_serverworks.c +@@ -251,12 +251,18 @@ static void serverworks_set_dmamode(stru + pci_write_config_byte(pdev, 0x54, ultra_cfg); + } + +-static struct scsi_host_template serverworks_sht = { ++static struct scsi_host_template serverworks_osb4_sht = { ++ ATA_BMDMA_SHT(DRV_NAME), ++ .sg_tablesize = LIBATA_DUMB_MAX_PRD, ++}; ++ ++static struct scsi_host_template serverworks_csb_sht = { + ATA_BMDMA_SHT(DRV_NAME), + }; + + static struct ata_port_operations serverworks_osb4_port_ops = { + .inherits = &ata_bmdma_port_ops, ++ .qc_prep = ata_bmdma_dumb_qc_prep, + .cable_detect = serverworks_cable_detect, + .mode_filter = serverworks_osb4_filter, + .set_piomode = serverworks_set_piomode, +@@ -265,6 +271,7 @@ static struct ata_port_operations server + + static struct ata_port_operations serverworks_csb_port_ops = { + .inherits = &serverworks_osb4_port_ops, ++ .qc_prep = ata_bmdma_qc_prep, + .mode_filter = serverworks_csb_filter, + }; + +@@ -404,6 +411,7 @@ static int serverworks_init_one(struct p + } + }; + const struct ata_port_info *ppi[] = { &info[id->driver_data], NULL }; ++ struct scsi_host_template *sht = &serverworks_csb_sht; + int rc; + + rc = pcim_enable_device(pdev); +@@ -417,6 +425,7 @@ static int serverworks_init_one(struct p + /* Select non UDMA capable OSB4 if we can't do fixups */ + if (rc < 0) + ppi[0] = &info[1]; ++ sht = &serverworks_osb4_sht; + } + /* setup CSB5/CSB6 : South Bridge and IDE option RAID */ + else if ((pdev->device == PCI_DEVICE_ID_SERVERWORKS_CSB5IDE) || +@@ -433,7 +442,7 @@ static int serverworks_init_one(struct p + ppi[1] = &ata_dummy_port_info; + } + +- return ata_pci_bmdma_init_one(pdev, ppi, &serverworks_sht, NULL, 0); ++ return ata_pci_bmdma_init_one(pdev, ppi, sht, NULL, 0); + } + + #ifdef CONFIG_PM_SLEEP diff --git a/queue-3.17/revert-percpu-free-percpu-allocation-info-for-uniprocessor-system.patch b/queue-3.17/revert-percpu-free-percpu-allocation-info-for-uniprocessor-system.patch new file mode 100644 index 00000000000..c0423866293 --- /dev/null +++ b/queue-3.17/revert-percpu-free-percpu-allocation-info-for-uniprocessor-system.patch @@ -0,0 +1,38 @@ +From bb2e226b3bef596dd56be97df655d857b4603923 Mon Sep 17 00:00:00 2001 +From: Guenter Roeck +Date: Sun, 21 Sep 2014 15:04:53 -0700 +Subject: Revert "percpu: free percpu allocation info for uniprocessor system" + +From: Guenter Roeck + +commit bb2e226b3bef596dd56be97df655d857b4603923 upstream. + +This reverts commit 3189eddbcafc ("percpu: free percpu allocation info for +uniprocessor system"). + +The commit causes a hang with a crisv32 image. This may be an architecture +problem, but at least for now the revert is necessary to be able to boot a +crisv32 image. + +Cc: Tejun Heo +Cc: Honggang Li +Signed-off-by: Guenter Roeck +Signed-off-by: Tejun Heo +Fixes: 3189eddbcafc ("percpu: free percpu allocation info for uniprocessor system") +Signed-off-by: Greg Kroah-Hartman + +--- + mm/percpu.c | 2 -- + 1 file changed, 2 deletions(-) + +--- a/mm/percpu.c ++++ b/mm/percpu.c +@@ -1932,8 +1932,6 @@ void __init setup_per_cpu_areas(void) + + if (pcpu_setup_first_chunk(ai, fc) < 0) + panic("Failed to initialize percpu areas."); +- +- pcpu_free_alloc_info(ai); + } + + #endif /* CONFIG_SMP */ diff --git a/queue-3.17/series b/queue-3.17/series index cf4daff2596..1b600c68a51 100644 --- a/queue-3.17/series +++ b/queue-3.17/series @@ -24,3 +24,26 @@ drivers-net-disable-ufo-through-virtio.patch drivers-net-ipv6-select-ipv6-fragment-idents-for-virtio-ufo-packets.patch drivers-net-macvtap-and-tun-depend-on-inet.patch stmmac-pci-set-default-of-the-filter-bins.patch +lockd-try-to-reconnect-if-statd-has-moved.patch +sunrpc-don-t-wake-tasks-during-connection-abort.patch +sunrpc-add-missing-support-for-rpc_clnt_create_no_retrans_timeout.patch +revert-percpu-free-percpu-allocation-info-for-uniprocessor-system.patch +pata_serverworks-disable-64-kb-dma-transfers-on-broadcom-osb4-ide-controller.patch +libata-sff-fix-controllers-with-no-ctl-port.patch +asoc-core-fix-use-after-free-in-snd_soc_remove_platform.patch +asoc-soc-dapm-fix-use-after-free.patch +asoc-soc-pcm-fix-sig_bits-determination-in-soc_pcm_apply_msb.patch +asoc-tlv320aic3x-fix-pll-d-configuration.patch +asoc-intel-hsw-bdw-only-support-s16-and-s24-formats.patch +asoc-adau1761-fix-input-pga-volume.patch +mmc-core-sdio-fix-unconditional-wake_up_process-on-sdio-thread.patch +mmc-sdhci-pxav3-set_uhs_signaling-is-initialized-twice-differently.patch +mmc-rtsx_usb_sdmmc-fix-incorrect-last-byte-in-r2-response.patch +mmc-don-t-request-cd-irq-until-mmc_start_host.patch +mmc-rtsx_pci_sdmmc-fix-incorrect-last-byte-in-r2-response.patch +mmc-sdhci-s3c-fix-runtime-pm-handling-on-sdhci_add_host-failure.patch +fs-make-cont_expand_zero-interruptible.patch +fs-fix-theoretical-division-by-0-in-super_cache_scan.patch +fs-allow-open-dir-o_tmpfile-...-0-with-mode-0.patch +ubifs-fix-a-race-condition.patch +ubifs-fix-free-log-space-calculation.patch diff --git a/queue-3.17/sunrpc-add-missing-support-for-rpc_clnt_create_no_retrans_timeout.patch b/queue-3.17/sunrpc-add-missing-support-for-rpc_clnt_create_no_retrans_timeout.patch new file mode 100644 index 00000000000..5862bd56eec --- /dev/null +++ b/queue-3.17/sunrpc-add-missing-support-for-rpc_clnt_create_no_retrans_timeout.patch @@ -0,0 +1,45 @@ +From 2aca5b869ace67a63aab895659e5dc14c33a4d6e Mon Sep 17 00:00:00 2001 +From: Trond Myklebust +Date: Wed, 24 Sep 2014 22:35:58 -0400 +Subject: SUNRPC: Add missing support for RPC_CLNT_CREATE_NO_RETRANS_TIMEOUT + +From: Trond Myklebust + +commit 2aca5b869ace67a63aab895659e5dc14c33a4d6e upstream. + +The flag RPC_CLNT_CREATE_NO_RETRANS_TIMEOUT was intended introduced in +order to allow NFSv4 clients to disable resend timeouts. Since those +cause the RPC layer to break the connection, they mess up the duplicate +reply caches that remain indexed on the port number in NFSv4.. + +This patch includes the code that was missing in the original to +set the appropriate flag in struct rpc_clnt, when the caller of +rpc_create() sets RPC_CLNT_CREATE_NO_RETRANS_TIMEOUT. + +Fixes: 8a19a0b6cb2e (SUNRPC: Add RPC task and client level options to...) +Signed-off-by: Trond Myklebust +Signed-off-by: Greg Kroah-Hartman + +--- + net/sunrpc/clnt.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/net/sunrpc/clnt.c ++++ b/net/sunrpc/clnt.c +@@ -461,6 +461,8 @@ struct rpc_clnt *rpc_create_xprt(struct + + if (args->flags & RPC_CLNT_CREATE_AUTOBIND) + clnt->cl_autobind = 1; ++ if (args->flags & RPC_CLNT_CREATE_NO_RETRANS_TIMEOUT) ++ clnt->cl_noretranstimeo = 1; + if (args->flags & RPC_CLNT_CREATE_DISCRTRY) + clnt->cl_discrtry = 1; + if (!(args->flags & RPC_CLNT_CREATE_QUIET)) +@@ -579,6 +581,7 @@ static struct rpc_clnt *__rpc_clone_clie + /* Turn off autobind on clones */ + new->cl_autobind = 0; + new->cl_softrtry = clnt->cl_softrtry; ++ new->cl_noretranstimeo = clnt->cl_noretranstimeo; + new->cl_discrtry = clnt->cl_discrtry; + new->cl_chatty = clnt->cl_chatty; + return new; diff --git a/queue-3.17/sunrpc-don-t-wake-tasks-during-connection-abort.patch b/queue-3.17/sunrpc-don-t-wake-tasks-during-connection-abort.patch new file mode 100644 index 00000000000..3e6a7f1295a --- /dev/null +++ b/queue-3.17/sunrpc-don-t-wake-tasks-during-connection-abort.patch @@ -0,0 +1,56 @@ +From a743419f420a64d442280845c0377a915b76644f Mon Sep 17 00:00:00 2001 +From: Benjamin Coddington +Date: Tue, 23 Sep 2014 12:26:19 -0400 +Subject: SUNRPC: Don't wake tasks during connection abort + +From: Benjamin Coddington + +commit a743419f420a64d442280845c0377a915b76644f upstream. + +When aborting a connection to preserve source ports, don't wake the task in +xs_error_report. This allows tasks with RPC_TASK_SOFTCONN to succeed if the +connection needs to be re-established since it preserves the task's status +instead of setting it to the status of the aborting kernel_connect(). + +This may also avoid a potential conflict on the socket's lock. + +Signed-off-by: Benjamin Coddington +Signed-off-by: Trond Myklebust +Signed-off-by: Greg Kroah-Hartman + +--- + include/linux/sunrpc/xprt.h | 1 + + net/sunrpc/xprtsock.c | 4 ++++ + 2 files changed, 5 insertions(+) + +--- a/include/linux/sunrpc/xprt.h ++++ b/include/linux/sunrpc/xprt.h +@@ -357,6 +357,7 @@ int xs_swapper(struct rpc_xprt *xprt, + #define XPRT_CONNECTION_ABORT (7) + #define XPRT_CONNECTION_CLOSE (8) + #define XPRT_CONGESTED (9) ++#define XPRT_CONNECTION_REUSE (10) + + static inline void xprt_set_connected(struct rpc_xprt *xprt) + { +--- a/net/sunrpc/xprtsock.c ++++ b/net/sunrpc/xprtsock.c +@@ -845,6 +845,8 @@ static void xs_error_report(struct sock + dprintk("RPC: xs_error_report client %p, error=%d...\n", + xprt, -err); + trace_rpc_socket_error(xprt, sk->sk_socket, err); ++ if (test_bit(XPRT_CONNECTION_REUSE, &xprt->state)) ++ goto out; + xprt_wake_pending_tasks(xprt, err); + out: + read_unlock_bh(&sk->sk_callback_lock); +@@ -2245,7 +2247,9 @@ static void xs_tcp_setup_socket(struct w + abort_and_exit = test_and_clear_bit(XPRT_CONNECTION_ABORT, + &xprt->state); + /* "close" the socket, preserving the local port */ ++ set_bit(XPRT_CONNECTION_REUSE, &xprt->state); + xs_tcp_reuse_connection(transport); ++ clear_bit(XPRT_CONNECTION_REUSE, &xprt->state); + + if (abort_and_exit) + goto out_eagain; diff --git a/queue-3.17/ubifs-fix-a-race-condition.patch b/queue-3.17/ubifs-fix-a-race-condition.patch new file mode 100644 index 00000000000..d7977cf9828 --- /dev/null +++ b/queue-3.17/ubifs-fix-a-race-condition.patch @@ -0,0 +1,124 @@ +From 052c28073ff26f771d44ef33952a41d18dadd255 Mon Sep 17 00:00:00 2001 +From: Artem Bityutskiy +Date: Sun, 29 Jun 2014 17:00:45 +0300 +Subject: UBIFS: fix a race condition + +From: Artem Bityutskiy + +commit 052c28073ff26f771d44ef33952a41d18dadd255 upstream. + +Hu (hujianyang@huawei.com) discovered a race condition which may lead to a +situation when UBIFS is unable to mount the file-system after an unclean +reboot. The problem is theoretical, though. + +In UBIFS, we have the log, which basically a set of LEBs in a certain area. The +log has the tail and the head. + +Every time user writes data to the file-system, the UBIFS journal grows, and +the log grows as well, because we append new reference nodes to the head of the +log. So the head moves forward all the time, while the log tail stays at the +same position. + +At any time, the UBIFS master node points to the tail of the log. When we mount +the file-system, we scan the log, and we always start from its tail, because +this is where the master node points to. The only occasion when the tail of the +log changes is the commit operation. + +The commit operation has 2 phases - "commit start" and "commit end". The former +is relatively short, and does not involve much I/O. During this phase we mostly +just build various in-memory lists of the things which have to be written to +the flash media during "commit end" phase. + +During the commit start phase, what we do is we "clean" the log. Indeed, the +commit operation will index all the data in the journal, so the entire journal +"disappears", and therefore the data in the log become unneeded. So we just +move the head of the log to the next LEB, and write the CS node there. This LEB +will be the tail of the new log when the commit operation finishes. + +When the "commit start" phase finishes, users may write more data to the +file-system, in parallel with the ongoing "commit end" operation. At this point +the log tail was not changed yet, it is the same as it had been before we +started the commit. The log head keeps moving forward, though. + +The commit operation now needs to write the new master node, and the new master +node should point to the new log tail. After this the LEBs between the old log +tail and the new log tail can be unmapped and re-used again. + +And here is the possible problem. We do 2 operations: (a) We first update the +log tail position in memory (see 'ubifs_log_end_commit()'). (b) And then we +write the master node (see the big lock of code in 'do_commit()'). + +But nothing prevents the log head from moving forward between (a) and (b), and +the log head may "wrap" now to the old log tail. And when the "wrap" happens, +the contends of the log tail gets erased. Now a power cut happens and we are in +trouble. We end up with the old master node pointing to the old tail, which was +erased. And replay fails because it expects the master node to point to the +correct log tail at all times. + +This patch merges the abovementioned (a) and (b) operations by moving the master +node change code to the 'ubifs_log_end_commit()' function, so that it runs with +the log mutex locked, which will prevent the log from being changed benween +operations (a) and (b). + +Reported-by: hujianyang +Tested-by: hujianyang +Signed-off-by: Artem Bityutskiy +Signed-off-by: Greg Kroah-Hartman + +--- + fs/ubifs/commit.c | 8 +++----- + fs/ubifs/log.c | 11 ++++++++--- + 2 files changed, 11 insertions(+), 8 deletions(-) + +--- a/fs/ubifs/commit.c ++++ b/fs/ubifs/commit.c +@@ -166,10 +166,6 @@ static int do_commit(struct ubifs_info * + err = ubifs_orphan_end_commit(c); + if (err) + goto out; +- old_ltail_lnum = c->ltail_lnum; +- err = ubifs_log_end_commit(c, new_ltail_lnum); +- if (err) +- goto out; + err = dbg_check_old_index(c, &zroot); + if (err) + goto out; +@@ -202,7 +198,9 @@ static int do_commit(struct ubifs_info * + c->mst_node->flags |= cpu_to_le32(UBIFS_MST_NO_ORPHS); + else + c->mst_node->flags &= ~cpu_to_le32(UBIFS_MST_NO_ORPHS); +- err = ubifs_write_master(c); ++ ++ old_ltail_lnum = c->ltail_lnum; ++ err = ubifs_log_end_commit(c, new_ltail_lnum); + if (err) + goto out; + +--- a/fs/ubifs/log.c ++++ b/fs/ubifs/log.c +@@ -447,9 +447,9 @@ out: + * @ltail_lnum: new log tail LEB number + * + * This function is called on when the commit operation was finished. It +- * moves log tail to new position and unmaps LEBs which contain obsolete data. +- * Returns zero in case of success and a negative error code in case of +- * failure. ++ * moves log tail to new position and updates the master node so that it stores ++ * the new log tail LEB number. Returns zero in case of success and a negative ++ * error code in case of failure. + */ + int ubifs_log_end_commit(struct ubifs_info *c, int ltail_lnum) + { +@@ -477,7 +477,12 @@ int ubifs_log_end_commit(struct ubifs_in + spin_unlock(&c->buds_lock); + + err = dbg_check_bud_bytes(c); ++ if (err) ++ goto out; + ++ err = ubifs_write_master(c); ++ ++out: + mutex_unlock(&c->log_mutex); + return err; + } diff --git a/queue-3.17/ubifs-fix-free-log-space-calculation.patch b/queue-3.17/ubifs-fix-free-log-space-calculation.patch new file mode 100644 index 00000000000..88cc912da11 --- /dev/null +++ b/queue-3.17/ubifs-fix-free-log-space-calculation.patch @@ -0,0 +1,51 @@ +From ba29e721eb2df6df8f33c1f248388bb037a47914 Mon Sep 17 00:00:00 2001 +From: Artem Bityutskiy +Date: Wed, 16 Jul 2014 15:22:29 +0300 +Subject: UBIFS: fix free log space calculation + +From: Artem Bityutskiy + +commit ba29e721eb2df6df8f33c1f248388bb037a47914 upstream. + +Hu (hujianyang ) discovered an issue in the +'empty_log_bytes()' function, which calculates how many bytes are left in the +log: + +" +If 'c->lhead_lnum + 1 == c->ltail_lnum' and 'c->lhead_offs == c->leb_size', 'h' +would equalent to 't' and 'empty_log_bytes()' would return 'c->log_bytes' +instead of 0. +" + +At this point it is not clear what would be the consequences of this, and +whether this may lead to any problems, but this patch addresses the issue just +in case. + +Tested-by: hujianyang +Reported-by: hujianyang +Signed-off-by: Artem Bityutskiy +Signed-off-by: Greg Kroah-Hartman + +--- + fs/ubifs/log.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +--- a/fs/ubifs/log.c ++++ b/fs/ubifs/log.c +@@ -106,10 +106,14 @@ static inline long long empty_log_bytes( + h = (long long)c->lhead_lnum * c->leb_size + c->lhead_offs; + t = (long long)c->ltail_lnum * c->leb_size; + +- if (h >= t) ++ if (h > t) + return c->log_bytes - h + t; +- else ++ else if (h != t) + return t - h; ++ else if (c->lhead_lnum != c->ltail_lnum) ++ return 0; ++ else ++ return c->log_bytes; + } + + /** -- 2.47.3