From: Greg Kroah-Hartman Date: Sat, 7 Feb 2015 04:31:00 +0000 (+0800) Subject: 3.18-stable patches X-Git-Tag: v3.10.69~20 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=104ec743cba0a3d224cba300e176399ffeb8e956;p=thirdparty%2Fkernel%2Fstable-queue.git 3.18-stable patches added patches: arm-8299-1-mm-ensure-local-active-asid-is-marked-as-allocated-on-rollover.patch complete-oplock-break-jobs-before-closing-file-handle.patch drm-radeon-don-t-init-gpuvm-if-accel-is-disabled-v3.patch drm-radeon-fix-plls-on-rs880-and-older-v2.patch drm-radeon-fix-the-crash-in-benchmark-functions.patch drm-radeon-fix-the-crash-in-test-functions.patch drm-radeon-properly-set-vm-fragment-size-for-tn-rl.patch gpio-mcp23s08-handle-default-gpio-base.patch gpio-sysfs-fix-memory-leak-in-gpiod_export_link.patch gpio-sysfs-fix-memory-leak-in-gpiod_sysfs_set_active_low.patch kconfig-fix-warning-jump-may-be-used-uninitialized.patch lib-checksum.c-fix-carry-in-csum_tcpudp_nofold.patch md-raid5-fix-another-livelock-caused-by-non-aligned-writes.patch memcg-shmem-fix-shmem-migration-to-use-lrucare.patch mips-fix-c0_pagegrain-support.patch mips-fix-kernel-lockup-or-crash-after-cpu-offline-online.patch mips-irq-fix-disable_irq-on-cpu-irqs.patch mips-octeon-fix-kernel-crash-when-offlining-a-cpu.patch mips-traps-fix-inline-asm-ctc1-missing-.set-hardfloat.patch mm-pagewalk-call-pte_hole-for-vm_pfnmap-during-walk_page_range.patch nilfs2-fix-deadlock-of-segment-constructor-over-i_sync-flag.patch pci-add-nec-variants-to-stratus-ftserver-pcie-dmi-check.patch pci-designware-reject-msi-x-irqs.patch pci-handle-read-only-bars-on-amd-cs553x-devices.patch sd-fix-max-transfer-length-for-4k-disks.patch spi-imx-use-pio-mode-for-i.mx6dl.patch spi-spi-fsl-dspi-remove-usage-of-devm_kzalloc.patch --- diff --git a/queue-3.18/arm-8299-1-mm-ensure-local-active-asid-is-marked-as-allocated-on-rollover.patch b/queue-3.18/arm-8299-1-mm-ensure-local-active-asid-is-marked-as-allocated-on-rollover.patch new file mode 100644 index 00000000000..4753037c164 --- /dev/null +++ b/queue-3.18/arm-8299-1-mm-ensure-local-active-asid-is-marked-as-allocated-on-rollover.patch @@ -0,0 +1,79 @@ +From 8e64806672466392acf19e14427d1c29df3e58b9 Mon Sep 17 00:00:00 2001 +From: Will Deacon +Date: Thu, 29 Jan 2015 16:41:46 +0100 +Subject: ARM: 8299/1: mm: ensure local active ASID is marked as allocated on rollover + +From: Will Deacon + +commit 8e64806672466392acf19e14427d1c29df3e58b9 upstream. + +Commit e1a5848e3398 ("ARM: 7924/1: mm: don't bother with reserved ttbr0 +when running with LPAE") removed the use of the reserved TTBR0 value +for LPAE systems, since the ASID is held in the TTBR and can be updated +atomicly with the pgd of the next mm. + +Unfortunately, this patch forgot to update flush_context, which +deliberately avoids marking the local active ASID as allocated, since we +used to switch via ASID zero and didn't need to allocate the ASID of +the previous mm. The side-effect of this is that we can allocate the +same ASID to the next mm and, between flushing the local TLB and updating +TTBR0, we can perform speculative TLB fills for userspace nG mappings +using the page table of the previous mm. + +The consequence of this is that the next mm can erroneously hit some +mappings of the previous mm. Note that this was made significantly +harder to hit by a391263cd84e ("ARM: 8203/1: mm: try to re-use old ASID +assignments following a rollover") but is still theoretically possible. + +This patch fixes the problem by removing the code from flush_context +that forces the allocated ASID to zero for the local CPU. Many thanks +to the Broadcom guys for tracking this one down. + +Fixes: e1a5848e3398 ("ARM: 7924/1: mm: don't bother with reserved ttbr0 when running with LPAE") + +Reported-by: Raymond Ngun +Tested-by: Raymond Ngun +Reviewed-by: Gregory Fong +Signed-off-by: Will Deacon +Signed-off-by: Russell King +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/mm/context.c | 26 +++++++++++--------------- + 1 file changed, 11 insertions(+), 15 deletions(-) + +--- a/arch/arm/mm/context.c ++++ b/arch/arm/mm/context.c +@@ -144,21 +144,17 @@ static void flush_context(unsigned int c + /* Update the list of reserved ASIDs and the ASID bitmap. */ + bitmap_clear(asid_map, 0, NUM_USER_ASIDS); + for_each_possible_cpu(i) { +- if (i == cpu) { +- asid = 0; +- } else { +- asid = atomic64_xchg(&per_cpu(active_asids, i), 0); +- /* +- * If this CPU has already been through a +- * rollover, but hasn't run another task in +- * the meantime, we must preserve its reserved +- * ASID, as this is the only trace we have of +- * the process it is still running. +- */ +- if (asid == 0) +- asid = per_cpu(reserved_asids, i); +- __set_bit(asid & ~ASID_MASK, asid_map); +- } ++ asid = atomic64_xchg(&per_cpu(active_asids, i), 0); ++ /* ++ * If this CPU has already been through a ++ * rollover, but hasn't run another task in ++ * the meantime, we must preserve its reserved ++ * ASID, as this is the only trace we have of ++ * the process it is still running. ++ */ ++ if (asid == 0) ++ asid = per_cpu(reserved_asids, i); ++ __set_bit(asid & ~ASID_MASK, asid_map); + per_cpu(reserved_asids, i) = asid; + } + diff --git a/queue-3.18/complete-oplock-break-jobs-before-closing-file-handle.patch b/queue-3.18/complete-oplock-break-jobs-before-closing-file-handle.patch new file mode 100644 index 00000000000..e3081066aeb --- /dev/null +++ b/queue-3.18/complete-oplock-break-jobs-before-closing-file-handle.patch @@ -0,0 +1,71 @@ +From ca7df8e0bb2a5ec79691de8a1a4c0e611fe04e60 Mon Sep 17 00:00:00 2001 +From: Sachin Prabhu +Date: Thu, 15 Jan 2015 12:22:04 +0000 +Subject: Complete oplock break jobs before closing file handle + +From: Sachin Prabhu + +commit ca7df8e0bb2a5ec79691de8a1a4c0e611fe04e60 upstream. + +Commit +c11f1df5003d534fd067f0168bfad7befffb3b5c +requires writers to wait for any pending oplock break handler to +complete before proceeding to write. This is done by waiting on bit +CIFS_INODE_PENDING_OPLOCK_BREAK in cifsFileInfo->flags. This bit is +cleared by the oplock break handler job queued on the workqueue once it +has completed handling the oplock break allowing writers to proceed with +writing to the file. + +While testing, it was noticed that the filehandle could be closed while +there is a pending oplock break which results in the oplock break +handler on the cifsiod workqueue being cancelled before it has had a +chance to execute and clear the CIFS_INODE_PENDING_OPLOCK_BREAK bit. +Any subsequent attempt to write to this file hangs waiting for the +CIFS_INODE_PENDING_OPLOCK_BREAK bit to be cleared. + +We fix this by ensuring that we also clear the bit +CIFS_INODE_PENDING_OPLOCK_BREAK when we remove the oplock break handler +from the workqueue. + +The bug was found by Red Hat QA while testing using ltp's fsstress +command. + +Signed-off-by: Sachin Prabhu +Acked-by: Shirish Pargaonkar +Signed-off-by: Jeff Layton +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman + +--- + fs/cifs/file.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/fs/cifs/file.c ++++ b/fs/cifs/file.c +@@ -366,6 +366,7 @@ void cifsFileInfo_put(struct cifsFileInf + struct cifsLockInfo *li, *tmp; + struct cifs_fid fid; + struct cifs_pending_open open; ++ bool oplock_break_cancelled; + + spin_lock(&cifs_file_list_lock); + if (--cifs_file->count > 0) { +@@ -397,7 +398,7 @@ void cifsFileInfo_put(struct cifsFileInf + } + spin_unlock(&cifs_file_list_lock); + +- cancel_work_sync(&cifs_file->oplock_break); ++ oplock_break_cancelled = cancel_work_sync(&cifs_file->oplock_break); + + if (!tcon->need_reconnect && !cifs_file->invalidHandle) { + struct TCP_Server_Info *server = tcon->ses->server; +@@ -409,6 +410,9 @@ void cifsFileInfo_put(struct cifsFileInf + _free_xid(xid); + } + ++ if (oplock_break_cancelled) ++ cifs_done_oplock_break(cifsi); ++ + cifs_del_pending_open(&open); + + /* diff --git a/queue-3.18/drm-radeon-don-t-init-gpuvm-if-accel-is-disabled-v3.patch b/queue-3.18/drm-radeon-don-t-init-gpuvm-if-accel-is-disabled-v3.patch new file mode 100644 index 00000000000..0aff6d2f315 --- /dev/null +++ b/queue-3.18/drm-radeon-don-t-init-gpuvm-if-accel-is-disabled-v3.patch @@ -0,0 +1,85 @@ +From 544143f9e01a60a93eb00ab4bfcb9bf4702a2a7d Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Wed, 28 Jan 2015 14:36:26 -0500 +Subject: drm/radeon: don't init gpuvm if accel is disabled (v3) + +From: Alex Deucher + +commit 544143f9e01a60a93eb00ab4bfcb9bf4702a2a7d upstream. + +If acceleration is disabled, it does not make sense +to init gpuvm since nothing will use it. Moreover, +if radeon_vm_init() gets called it uses accel to try +and clear the pde tables, etc. which results in a bug. + +v2: handle vm_fini as well +v3: handle bo_open/close as well + +Bug: +https://bugs.freedesktop.org/show_bug.cgi?id=88786 + +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/radeon/radeon_gem.c | 6 ++++-- + drivers/gpu/drm/radeon/radeon_kms.c | 16 ++++++++-------- + 2 files changed, 12 insertions(+), 10 deletions(-) + +--- a/drivers/gpu/drm/radeon/radeon_gem.c ++++ b/drivers/gpu/drm/radeon/radeon_gem.c +@@ -146,7 +146,8 @@ int radeon_gem_object_open(struct drm_ge + struct radeon_bo_va *bo_va; + int r; + +- if (rdev->family < CHIP_CAYMAN) { ++ if ((rdev->family < CHIP_CAYMAN) || ++ (!rdev->accel_working)) { + return 0; + } + +@@ -176,7 +177,8 @@ void radeon_gem_object_close(struct drm_ + struct radeon_bo_va *bo_va; + int r; + +- if (rdev->family < CHIP_CAYMAN) { ++ if ((rdev->family < CHIP_CAYMAN) || ++ (!rdev->accel_working)) { + return; + } + +--- a/drivers/gpu/drm/radeon/radeon_kms.c ++++ b/drivers/gpu/drm/radeon/radeon_kms.c +@@ -598,14 +598,14 @@ int radeon_driver_open_kms(struct drm_de + return -ENOMEM; + } + +- vm = &fpriv->vm; +- r = radeon_vm_init(rdev, vm); +- if (r) { +- kfree(fpriv); +- return r; +- } +- + if (rdev->accel_working) { ++ vm = &fpriv->vm; ++ r = radeon_vm_init(rdev, vm); ++ if (r) { ++ kfree(fpriv); ++ return r; ++ } ++ + r = radeon_bo_reserve(rdev->ring_tmp_bo.bo, false); + if (r) { + radeon_vm_fini(rdev, vm); +@@ -663,9 +663,9 @@ void radeon_driver_postclose_kms(struct + radeon_vm_bo_rmv(rdev, vm->ib_bo_va); + radeon_bo_unreserve(rdev->ring_tmp_bo.bo); + } ++ radeon_vm_fini(rdev, vm); + } + +- radeon_vm_fini(rdev, vm); + kfree(fpriv); + file_priv->driver_priv = NULL; + } diff --git a/queue-3.18/drm-radeon-fix-plls-on-rs880-and-older-v2.patch b/queue-3.18/drm-radeon-fix-plls-on-rs880-and-older-v2.patch new file mode 100644 index 00000000000..718f6f014af --- /dev/null +++ b/queue-3.18/drm-radeon-fix-plls-on-rs880-and-older-v2.patch @@ -0,0 +1,41 @@ +From 72edd83cc9e5819ed1ee771519143d7594e059f0 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Christian=20K=C3=B6nig?= +Date: Thu, 29 Jan 2015 16:01:03 +0100 +Subject: drm/radeon: fix PLLs on RS880 and older v2 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: =?UTF-8?q?Christian=20K=C3=B6nig?= + +commit 72edd83cc9e5819ed1ee771519143d7594e059f0 upstream. + +This is a workaround for RS880 and older chips which seem to have +an additional limit on the minimum PLL input frequency. + +v2: fix signed/unsigned warning + +bugs: +https://bugzilla.kernel.org/show_bug.cgi?id=91861 +https://bugzilla.kernel.org/show_bug.cgi?id=83461 + +Signed-off-by: Christian König +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/radeon/radeon_display.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/gpu/drm/radeon/radeon_display.c ++++ b/drivers/gpu/drm/radeon/radeon_display.c +@@ -959,6 +959,9 @@ void radeon_compute_pll_avivo(struct rad + if (pll->flags & RADEON_PLL_USE_FRAC_FB_DIV && + pll->flags & RADEON_PLL_USE_REF_DIV) + ref_div_max = pll->reference_div; ++ else if (pll->flags & RADEON_PLL_PREFER_MINM_OVER_MAXP) ++ /* fix for problems on RS880 */ ++ ref_div_max = min(pll->max_ref_div, 7u); + else + ref_div_max = pll->max_ref_div; + diff --git a/queue-3.18/drm-radeon-fix-the-crash-in-benchmark-functions.patch b/queue-3.18/drm-radeon-fix-the-crash-in-benchmark-functions.patch new file mode 100644 index 00000000000..0992cbf2e2e --- /dev/null +++ b/queue-3.18/drm-radeon-fix-the-crash-in-benchmark-functions.patch @@ -0,0 +1,75 @@ +From 3f5e1b4f58b7b6480cccff4bf965436102db4346 Mon Sep 17 00:00:00 2001 +From: Ilija Hadzic +Date: Fri, 30 Jan 2015 00:38:43 -0500 +Subject: drm/radeon: fix the crash in benchmark functions +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ilija Hadzic + +commit 3f5e1b4f58b7b6480cccff4bf965436102db4346 upstream. + +radeon_copy_dma and radeon_copy_blit must be called with +a valid reservation object. Otherwise a crash will be provoked. +We borrow the object from destination BO. + +bug: +https://bugs.freedesktop.org/show_bug.cgi?id=88464 + +Reviewed-by: Christian König +Signed-off-by: Ilija Hadzic +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/radeon/radeon_benchmark.c | 13 ++++++++----- + 1 file changed, 8 insertions(+), 5 deletions(-) + +--- a/drivers/gpu/drm/radeon/radeon_benchmark.c ++++ b/drivers/gpu/drm/radeon/radeon_benchmark.c +@@ -34,7 +34,8 @@ + + static int radeon_benchmark_do_move(struct radeon_device *rdev, unsigned size, + uint64_t saddr, uint64_t daddr, +- int flag, int n) ++ int flag, int n, ++ struct reservation_object *resv) + { + unsigned long start_jiffies; + unsigned long end_jiffies; +@@ -47,12 +48,12 @@ static int radeon_benchmark_do_move(stru + case RADEON_BENCHMARK_COPY_DMA: + fence = radeon_copy_dma(rdev, saddr, daddr, + size / RADEON_GPU_PAGE_SIZE, +- NULL); ++ resv); + break; + case RADEON_BENCHMARK_COPY_BLIT: + fence = radeon_copy_blit(rdev, saddr, daddr, + size / RADEON_GPU_PAGE_SIZE, +- NULL); ++ resv); + break; + default: + DRM_ERROR("Unknown copy method\n"); +@@ -120,7 +121,8 @@ static void radeon_benchmark_move(struct + + if (rdev->asic->copy.dma) { + time = radeon_benchmark_do_move(rdev, size, saddr, daddr, +- RADEON_BENCHMARK_COPY_DMA, n); ++ RADEON_BENCHMARK_COPY_DMA, n, ++ dobj->tbo.resv); + if (time < 0) + goto out_cleanup; + if (time > 0) +@@ -130,7 +132,8 @@ static void radeon_benchmark_move(struct + + if (rdev->asic->copy.blit) { + time = radeon_benchmark_do_move(rdev, size, saddr, daddr, +- RADEON_BENCHMARK_COPY_BLIT, n); ++ RADEON_BENCHMARK_COPY_BLIT, n, ++ dobj->tbo.resv); + if (time < 0) + goto out_cleanup; + if (time > 0) diff --git a/queue-3.18/drm-radeon-fix-the-crash-in-test-functions.patch b/queue-3.18/drm-radeon-fix-the-crash-in-test-functions.patch new file mode 100644 index 00000000000..a189c8b608d --- /dev/null +++ b/queue-3.18/drm-radeon-fix-the-crash-in-test-functions.patch @@ -0,0 +1,58 @@ +From 92b712b739811e4aa7c0e1af339d0098989ea024 Mon Sep 17 00:00:00 2001 +From: Ilija Hadzic +Date: Fri, 30 Jan 2015 00:38:44 -0500 +Subject: drm/radeon: fix the crash in test functions +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ilija Hadzic + +commit 92b712b739811e4aa7c0e1af339d0098989ea024 upstream. + +radeon_copy_dma and radeon_copy_blit must be called with +a valid reservation object. Otherwise a crash will be provoked. +We borrow the object from vram BO. + +bug: +https://bugs.freedesktop.org/show_bug.cgi?id=88464 + +Reviewed-by: Christian König +Signed-off-by: Ilija Hadzic +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/radeon/radeon_test.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/gpu/drm/radeon/radeon_test.c ++++ b/drivers/gpu/drm/radeon/radeon_test.c +@@ -119,11 +119,11 @@ static void radeon_do_test_moves(struct + if (ring == R600_RING_TYPE_DMA_INDEX) + fence = radeon_copy_dma(rdev, gtt_addr, vram_addr, + size / RADEON_GPU_PAGE_SIZE, +- NULL); ++ vram_obj->tbo.resv); + else + fence = radeon_copy_blit(rdev, gtt_addr, vram_addr, + size / RADEON_GPU_PAGE_SIZE, +- NULL); ++ vram_obj->tbo.resv); + if (IS_ERR(fence)) { + DRM_ERROR("Failed GTT->VRAM copy %d\n", i); + r = PTR_ERR(fence); +@@ -170,11 +170,11 @@ static void radeon_do_test_moves(struct + if (ring == R600_RING_TYPE_DMA_INDEX) + fence = radeon_copy_dma(rdev, vram_addr, gtt_addr, + size / RADEON_GPU_PAGE_SIZE, +- NULL); ++ vram_obj->tbo.resv); + else + fence = radeon_copy_blit(rdev, vram_addr, gtt_addr, + size / RADEON_GPU_PAGE_SIZE, +- NULL); ++ vram_obj->tbo.resv); + if (IS_ERR(fence)) { + DRM_ERROR("Failed VRAM->GTT copy %d\n", i); + r = PTR_ERR(fence); diff --git a/queue-3.18/drm-radeon-properly-set-vm-fragment-size-for-tn-rl.patch b/queue-3.18/drm-radeon-properly-set-vm-fragment-size-for-tn-rl.patch new file mode 100644 index 00000000000..2b2b111bd35 --- /dev/null +++ b/queue-3.18/drm-radeon-properly-set-vm-fragment-size-for-tn-rl.patch @@ -0,0 +1,35 @@ +From a124d068bf5be6be2ff4b9fab77b1b7509107e68 Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Fri, 30 Jan 2015 09:52:24 -0500 +Subject: drm/radeon: properly set vm fragment size for TN/RL + +From: Alex Deucher + +commit a124d068bf5be6be2ff4b9fab77b1b7509107e68 upstream. + +Should be the same as cayman. We don't use VM by default +on NI parts so this isn't critical. + +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/radeon/radeon_vm.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/radeon/radeon_vm.c ++++ b/drivers/gpu/drm/radeon/radeon_vm.c +@@ -753,9 +753,11 @@ static void radeon_vm_frag_ptes(struct r + */ + + /* NI is optimized for 256KB fragments, SI and newer for 64KB */ +- uint64_t frag_flags = rdev->family == CHIP_CAYMAN ? ++ uint64_t frag_flags = ((rdev->family == CHIP_CAYMAN) || ++ (rdev->family == CHIP_ARUBA)) ? + R600_PTE_FRAG_256KB : R600_PTE_FRAG_64KB; +- uint64_t frag_align = rdev->family == CHIP_CAYMAN ? 0x200 : 0x80; ++ uint64_t frag_align = ((rdev->family == CHIP_CAYMAN) || ++ (rdev->family == CHIP_ARUBA)) ? 0x200 : 0x80; + + uint64_t frag_start = ALIGN(pe_start, frag_align); + uint64_t frag_end = pe_end & ~(frag_align - 1); diff --git a/queue-3.18/gpio-mcp23s08-handle-default-gpio-base.patch b/queue-3.18/gpio-mcp23s08-handle-default-gpio-base.patch new file mode 100644 index 00000000000..d30e7584a33 --- /dev/null +++ b/queue-3.18/gpio-mcp23s08-handle-default-gpio-base.patch @@ -0,0 +1,55 @@ +From b184c388f773f30b6c707d3d4599b2db80f4390c Mon Sep 17 00:00:00 2001 +From: Sonic Zhang +Date: Tue, 20 Jan 2015 17:00:08 +0800 +Subject: gpio: mcp23s08: handle default gpio base + +From: Sonic Zhang + +commit b184c388f773f30b6c707d3d4599b2db80f4390c upstream. + +Create default gpio base if neither device node nor +platform data is defined. + +Signed-off-by: Sonic Zhang +Reviewed-by: Alexandre Courbot +Tested-by: Antonio Fiol +Signed-off-by: Linus Walleij +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpio/gpio-mcp23s08.c | 17 ++++++++++------- + 1 file changed, 10 insertions(+), 7 deletions(-) + +--- a/drivers/gpio/gpio-mcp23s08.c ++++ b/drivers/gpio/gpio-mcp23s08.c +@@ -785,9 +785,11 @@ static int mcp230xx_probe(struct i2c_cli + client->irq = irq_of_parse_and_map(client->dev.of_node, 0); + } else { + pdata = dev_get_platdata(&client->dev); +- if (!pdata || !gpio_is_valid(pdata->base)) { +- dev_dbg(&client->dev, "invalid platform data\n"); +- return -EINVAL; ++ if (!pdata) { ++ pdata = devm_kzalloc(&client->dev, ++ sizeof(struct mcp23s08_platform_data), ++ GFP_KERNEL); ++ pdata->base = -1; + } + } + +@@ -908,10 +910,11 @@ static int mcp23s08_probe(struct spi_dev + } else { + type = spi_get_device_id(spi)->driver_data; + pdata = dev_get_platdata(&spi->dev); +- if (!pdata || !gpio_is_valid(pdata->base)) { +- dev_dbg(&spi->dev, +- "invalid or missing platform data\n"); +- return -EINVAL; ++ if (!pdata) { ++ pdata = devm_kzalloc(&spi->dev, ++ sizeof(struct mcp23s08_platform_data), ++ GFP_KERNEL); ++ pdata->base = -1; + } + + for (addr = 0; addr < ARRAY_SIZE(pdata->chip); addr++) { diff --git a/queue-3.18/gpio-sysfs-fix-memory-leak-in-gpiod_export_link.patch b/queue-3.18/gpio-sysfs-fix-memory-leak-in-gpiod_export_link.patch new file mode 100644 index 00000000000..3653936c085 --- /dev/null +++ b/queue-3.18/gpio-sysfs-fix-memory-leak-in-gpiod_export_link.patch @@ -0,0 +1,31 @@ +From 0f303db08df0df9bd0966443ad6001e63960af16 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Mon, 26 Jan 2015 12:02:45 +0100 +Subject: gpio: sysfs: fix memory leak in gpiod_export_link + +From: Johan Hovold + +commit 0f303db08df0df9bd0966443ad6001e63960af16 upstream. + +Fix memory leak in the gpio sysfs interface due to failure to drop +reference to device returned by class_find_device when creating a link. + +Fixes: a4177ee7f1a8 ("gpiolib: allow exported GPIO nodes to be named using sysfs links") +Signed-off-by: Johan Hovold +Signed-off-by: Linus Walleij +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpio/gpiolib-sysfs.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/gpio/gpiolib-sysfs.c ++++ b/drivers/gpio/gpiolib-sysfs.c +@@ -630,6 +630,7 @@ int gpiod_export_link(struct device *dev + if (tdev != NULL) { + status = sysfs_create_link(&dev->kobj, &tdev->kobj, + name); ++ put_device(tdev); + } else { + status = -ENODEV; + } diff --git a/queue-3.18/gpio-sysfs-fix-memory-leak-in-gpiod_sysfs_set_active_low.patch b/queue-3.18/gpio-sysfs-fix-memory-leak-in-gpiod_sysfs_set_active_low.patch new file mode 100644 index 00000000000..48fd0356809 --- /dev/null +++ b/queue-3.18/gpio-sysfs-fix-memory-leak-in-gpiod_sysfs_set_active_low.patch @@ -0,0 +1,33 @@ +From 49d2ca84e433dab854c7a866bc6add09cfab682d Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Mon, 26 Jan 2015 12:02:46 +0100 +Subject: gpio: sysfs: fix memory leak in gpiod_sysfs_set_active_low + +From: Johan Hovold + +commit 49d2ca84e433dab854c7a866bc6add09cfab682d upstream. + +Fix memory leak in the gpio sysfs interface due to failure to drop +reference to device returned by class_find_device when setting the +gpio-line polarity. + +Fixes: 0769746183ca ("gpiolib: add support for changing value polarity in sysfs") +Signed-off-by: Johan Hovold +Signed-off-by: Linus Walleij +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpio/gpiolib-sysfs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpio/gpiolib-sysfs.c ++++ b/drivers/gpio/gpiolib-sysfs.c +@@ -678,7 +678,7 @@ int gpiod_sysfs_set_active_low(struct gp + } + + status = sysfs_set_active_low(desc, dev, value); +- ++ put_device(dev); + unlock: + mutex_unlock(&sysfs_lock); + diff --git a/queue-3.18/kconfig-fix-warning-jump-may-be-used-uninitialized.patch b/queue-3.18/kconfig-fix-warning-jump-may-be-used-uninitialized.patch new file mode 100644 index 00000000000..85198dd173a --- /dev/null +++ b/queue-3.18/kconfig-fix-warning-jump-may-be-used-uninitialized.patch @@ -0,0 +1,50 @@ +From 2d560306096739e2251329ab5c16059311a151b0 Mon Sep 17 00:00:00 2001 +From: Peter Kümmel +Date: Tue, 4 Nov 2014 12:01:59 +0100 +Subject: kconfig: Fix warning "‘jump’ may be used uninitialized" +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Peter Kümmel + +commit 2d560306096739e2251329ab5c16059311a151b0 upstream. + +Warning: +In file included from scripts/kconfig/zconf.tab.c:2537:0: +scripts/kconfig/menu.c: In function ‘get_symbol_str’: +scripts/kconfig/menu.c:590:18: warning: ‘jump’ may be used uninitialized in this function [-Wmaybe-uninitialized] + jump->offset = strlen(r->s); + +Simplifies the test logic because (head && local) means (jump != 0) +and makes GCC happy when checking if the jump pointer was initialized. + +Signed-off-by: Peter Kümmel +Signed-off-by: Michal Marek +Cc: Sedat Dilek +Signed-off-by: Greg Kroah-Hartman + +--- + scripts/kconfig/menu.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/scripts/kconfig/menu.c ++++ b/scripts/kconfig/menu.c +@@ -548,7 +548,7 @@ static void get_prompt_str(struct gstr * + { + int i, j; + struct menu *submenu[8], *menu, *location = NULL; +- struct jump_key *jump; ++ struct jump_key *jump = NULL; + + str_printf(r, _("Prompt: %s\n"), _(prop->text)); + menu = prop->menu->parent; +@@ -586,7 +586,7 @@ static void get_prompt_str(struct gstr * + str_printf(r, _(" Location:\n")); + for (j = 4; --i >= 0; j += 2) { + menu = submenu[i]; +- if (head && location && menu == location) ++ if (jump && menu == location) + jump->offset = strlen(r->s); + str_printf(r, "%*c-> %s", j, ' ', + _(menu_get_prompt(menu))); diff --git a/queue-3.18/lib-checksum.c-fix-carry-in-csum_tcpudp_nofold.patch b/queue-3.18/lib-checksum.c-fix-carry-in-csum_tcpudp_nofold.patch new file mode 100644 index 00000000000..aa4baabaf3a --- /dev/null +++ b/queue-3.18/lib-checksum.c-fix-carry-in-csum_tcpudp_nofold.patch @@ -0,0 +1,56 @@ +From 150ae0e94634714b23919f0c333fee28a5b199d5 Mon Sep 17 00:00:00 2001 +From: karl beldan +Date: Wed, 28 Jan 2015 10:58:11 +0100 +Subject: lib/checksum.c: fix carry in csum_tcpudp_nofold + +From: karl beldan + +commit 150ae0e94634714b23919f0c333fee28a5b199d5 upstream. + +The carry from the 64->32bits folding was dropped, e.g with: +saddr=0xFFFFFFFF daddr=0xFF0000FF len=0xFFFF proto=0 sum=1, +csum_tcpudp_nofold returned 0 instead of 1. + +Signed-off-by: Karl Beldan +Cc: Al Viro +Cc: Eric Dumazet +Cc: Arnd Bergmann +Cc: Mike Frysinger +Cc: netdev@vger.kernel.org +Cc: linux-kernel@vger.kernel.org +Signed-off-by: Eric Dumazet +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + lib/checksum.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +--- a/lib/checksum.c ++++ b/lib/checksum.c +@@ -47,6 +47,15 @@ static inline unsigned short from32to16( + return x; + } + ++static inline u32 from64to32(u64 x) ++{ ++ /* add up 32-bit and 32-bit for 32+c bit */ ++ x = (x & 0xffffffff) + (x >> 32); ++ /* add up carry.. */ ++ x = (x & 0xffffffff) + (x >> 32); ++ return (u32)x; ++} ++ + static unsigned int do_csum(const unsigned char *buff, int len) + { + int odd; +@@ -195,8 +204,7 @@ __wsum csum_tcpudp_nofold(__be32 saddr, + #else + s += (proto + len) << 8; + #endif +- s += (s >> 32); +- return (__force __wsum)s; ++ return (__force __wsum)from64to32(s); + } + EXPORT_SYMBOL(csum_tcpudp_nofold); + #endif diff --git a/queue-3.18/md-raid5-fix-another-livelock-caused-by-non-aligned-writes.patch b/queue-3.18/md-raid5-fix-another-livelock-caused-by-non-aligned-writes.patch new file mode 100644 index 00000000000..9e29365b5d2 --- /dev/null +++ b/queue-3.18/md-raid5-fix-another-livelock-caused-by-non-aligned-writes.patch @@ -0,0 +1,53 @@ +From b1b02fe97f75b12ab34b2303bfd4e3526d903a58 Mon Sep 17 00:00:00 2001 +From: NeilBrown +Date: Mon, 2 Feb 2015 10:44:29 +1100 +Subject: md/raid5: fix another livelock caused by non-aligned writes. + +From: NeilBrown + +commit b1b02fe97f75b12ab34b2303bfd4e3526d903a58 upstream. + +If a non-page-aligned write is destined for a device which +is missing/faulty, we can deadlock. + +As the target device is missing, a read-modify-write cycle +is not possible. +As the write is not for a full-page, a recontruct-write cycle +is not possible. + +This should be handled by logic in fetch_block() which notices +there is a non-R5_OVERWRITE write to a missing device, and so +loads all blocks. + +However since commit 67f455486d2ea2, that code requires +STRIPE_PREREAD_ACTIVE before it will active, and those circumstances +never set STRIPE_PREREAD_ACTIVE. + +So: in handle_stripe_dirtying, if neither rmw or rcw was possible, +set STRIPE_DELAYED, which will cause STRIPE_PREREAD_ACTIVE be set +after a suitable delay. + +Fixes: 67f455486d2ea20b2d94d6adf5b9b783d079e321 +Reported-by: Mikulas Patocka +Tested-by: Heinz Mauelshagen +Signed-off-by: NeilBrown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/raid5.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/md/raid5.c ++++ b/drivers/md/raid5.c +@@ -3195,6 +3195,11 @@ static void handle_stripe_dirtying(struc + (unsigned long long)sh->sector, + rcw, qread, test_bit(STRIPE_DELAYED, &sh->state)); + } ++ ++ if (rcw > disks && rmw > disks && ++ !test_bit(STRIPE_PREREAD_ACTIVE, &sh->state)) ++ set_bit(STRIPE_DELAYED, &sh->state); ++ + /* now if nothing is locked, and if we have enough data, + * we can start a write request + */ diff --git a/queue-3.18/memcg-shmem-fix-shmem-migration-to-use-lrucare.patch b/queue-3.18/memcg-shmem-fix-shmem-migration-to-use-lrucare.patch new file mode 100644 index 00000000000..dfdc405c228 --- /dev/null +++ b/queue-3.18/memcg-shmem-fix-shmem-migration-to-use-lrucare.patch @@ -0,0 +1,66 @@ +From f5e03a4989e80a86f8b514659dca8539132e6e09 Mon Sep 17 00:00:00 2001 +From: Michal Hocko +Date: Thu, 5 Feb 2015 12:25:14 -0800 +Subject: memcg, shmem: fix shmem migration to use lrucare + +From: Michal Hocko + +commit f5e03a4989e80a86f8b514659dca8539132e6e09 upstream. + +It has been reported that 965GM might trigger + + VM_BUG_ON_PAGE(!lrucare && PageLRU(oldpage), oldpage) + +in mem_cgroup_migrate when shmem wants to replace a swap cache page +because of shmem_should_replace_page (the page is allocated from an +inappropriate zone). shmem_replace_page expects that the oldpage is not +on LRU list and calls mem_cgroup_migrate without lrucare. This is +obviously incorrect because swapcache pages might be on the LRU list +(e.g. swapin readahead page). + +Fix this by enabling lrucare for the migration in shmem_replace_page. +Also clarify that lrucare should be used even if one of the pages might +be on LRU list. + +The BUG_ON will trigger only when CONFIG_DEBUG_VM is enabled but even +without that the migration code might leave the old page on an +inappropriate memcg' LRU which is not that critical because the page +would get removed with its last reference but it is still confusing. + +Fixes: 0a31bc97c80c ("mm: memcontrol: rewrite uncharge API") +Signed-off-by: Michal Hocko +Reported-by: Chris Wilson +Reported-by: Dave Airlie +Acked-by: Hugh Dickins +Acked-by: Johannes Weiner +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/memcontrol.c | 2 +- + mm/shmem.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +--- a/mm/memcontrol.c ++++ b/mm/memcontrol.c +@@ -6589,7 +6589,7 @@ void mem_cgroup_uncharge_list(struct lis + * mem_cgroup_migrate - migrate a charge to another page + * @oldpage: currently charged page + * @newpage: page to transfer the charge to +- * @lrucare: both pages might be on the LRU already ++ * @lrucare: either or both pages might be on the LRU already + * + * Migrate the charge from @oldpage to @newpage. + * +--- a/mm/shmem.c ++++ b/mm/shmem.c +@@ -1013,7 +1013,7 @@ static int shmem_replace_page(struct pag + */ + oldpage = newpage; + } else { +- mem_cgroup_migrate(oldpage, newpage, false); ++ mem_cgroup_migrate(oldpage, newpage, true); + lru_cache_add_anon(newpage); + *pagep = newpage; + } diff --git a/queue-3.18/mips-fix-c0_pagegrain-support.patch b/queue-3.18/mips-fix-c0_pagegrain-support.patch new file mode 100644 index 00000000000..604fa2edecf --- /dev/null +++ b/queue-3.18/mips-fix-c0_pagegrain-support.patch @@ -0,0 +1,49 @@ +From 9ead8632bbf454cfc709b6205dc9cd8582fb0d64 Mon Sep 17 00:00:00 2001 +From: David Daney +Date: Tue, 6 Jan 2015 10:42:23 -0800 +Subject: MIPS: Fix C0_Pagegrain[IEC] support. + +From: David Daney + +commit 9ead8632bbf454cfc709b6205dc9cd8582fb0d64 upstream. + +The following commits: + + 5890f70f15c52d (MIPS: Use dedicated exception handler if CPU supports RI/XI exceptions) + 6575b1d4173eae (MIPS: kernel: cpu-probe: Detect unique RI/XI exceptions) + +break the kernel for *all* existing MIPS CPUs that implement the +CP0_PageGrain[IEC] bit. They cause the TLB exception handlers to be +generated without the legacy execute-inhibit handling, but never set +the CP0_PageGrain[IEC] bit to activate the use of dedicated exception +vectors for execute-inhibit exceptions. The result is that upon +detection of an execute-inhibit violation, we loop forever in the TLB +exception handlers instead of sending SIGSEGV to the task. + +If we are generating TLB exception handlers expecting separate +vectors, we must also enable the CP0_PageGrain[IEC] feature. + +The bug was introduced in kernel version 3.17. + +Signed-off-by: David Daney +Cc: Leonid Yegoshin +Cc: linux-mips@linux-mips.org +Patchwork: http://patchwork.linux-mips.org/patch/8880/ +Signed-off-by: Ralf Baechle +Signed-off-by: Greg Kroah-Hartman + +--- + arch/mips/mm/tlb-r4k.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/arch/mips/mm/tlb-r4k.c ++++ b/arch/mips/mm/tlb-r4k.c +@@ -489,6 +489,8 @@ static void r4k_tlb_configure(void) + #ifdef CONFIG_64BIT + pg |= PG_ELPA; + #endif ++ if (cpu_has_rixiex) ++ pg |= PG_IEC; + write_c0_pagegrain(pg); + } + diff --git a/queue-3.18/mips-fix-kernel-lockup-or-crash-after-cpu-offline-online.patch b/queue-3.18/mips-fix-kernel-lockup-or-crash-after-cpu-offline-online.patch new file mode 100644 index 00000000000..0237a00f1bd --- /dev/null +++ b/queue-3.18/mips-fix-kernel-lockup-or-crash-after-cpu-offline-online.patch @@ -0,0 +1,47 @@ +From c7754e75100ed5e3068ac5085747f2bfc386c8d6 Mon Sep 17 00:00:00 2001 +From: Hemmo Nieminen +Date: Thu, 15 Jan 2015 23:01:59 +0200 +Subject: MIPS: Fix kernel lockup or crash after CPU offline/online + +From: Hemmo Nieminen + +commit c7754e75100ed5e3068ac5085747f2bfc386c8d6 upstream. + +As printk() invocation can cause e.g. a TLB miss, printk() cannot be +called before the exception handlers have been properly initialized. +This can happen e.g. when netconsole has been loaded as a kernel module +and the TLB table has been cleared when a CPU was offline. + +Call cpu_report() in start_secondary() only after the exception handlers +have been initialized to fix this. + +Without the patch the kernel will randomly either lockup or crash +after a CPU is onlined and the console driver is a module. + +Signed-off-by: Hemmo Nieminen +Signed-off-by: Aaro Koskinen +Cc: David Daney +Cc: linux-mips@linux-mips.org +Cc: linux-kernel@vger.kernel.org +Patchwork: https://patchwork.linux-mips.org/patch/8953/ +Signed-off-by: Ralf Baechle +Signed-off-by: Greg Kroah-Hartman + +--- + arch/mips/kernel/smp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/mips/kernel/smp.c ++++ b/arch/mips/kernel/smp.c +@@ -123,10 +123,10 @@ asmlinkage void start_secondary(void) + unsigned int cpu; + + cpu_probe(); +- cpu_report(); + per_cpu_trap_init(false); + mips_clockevent_init(); + mp_ops->init_secondary(); ++ cpu_report(); + + /* + * XXX parity protection should be folded in here when it's converted diff --git a/queue-3.18/mips-irq-fix-disable_irq-on-cpu-irqs.patch b/queue-3.18/mips-irq-fix-disable_irq-on-cpu-irqs.patch new file mode 100644 index 00000000000..e5f16b1d78a --- /dev/null +++ b/queue-3.18/mips-irq-fix-disable_irq-on-cpu-irqs.patch @@ -0,0 +1,50 @@ +From a3e6c1eff54878506b2dddcc202df9cc8180facb Mon Sep 17 00:00:00 2001 +From: Felix Fietkau +Date: Thu, 15 Jan 2015 19:05:28 +0100 +Subject: MIPS: IRQ: Fix disable_irq on CPU IRQs + +From: Felix Fietkau + +commit a3e6c1eff54878506b2dddcc202df9cc8180facb upstream. + +If the irq_chip does not define .irq_disable, any call to disable_irq +will defer disabling the IRQ until it fires while marked as disabled. +This assumes that the handler function checks for this condition, which +handle_percpu_irq does not. In this case, calling disable_irq leads to +an IRQ storm, if the interrupt fires while disabled. + +This optimization is only useful when disabling the IRQ is slow, which +is not true for the MIPS CPU IRQ. + +Disable this optimization by implementing .irq_disable and .irq_enable + +Signed-off-by: Felix Fietkau +Cc: linux-mips@linux-mips.org +Patchwork: https://patchwork.linux-mips.org/patch/8949/ +Signed-off-by: Ralf Baechle +Signed-off-by: Greg Kroah-Hartman + +--- + arch/mips/kernel/irq_cpu.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/arch/mips/kernel/irq_cpu.c ++++ b/arch/mips/kernel/irq_cpu.c +@@ -56,6 +56,8 @@ static struct irq_chip mips_cpu_irq_cont + .irq_mask_ack = mask_mips_irq, + .irq_unmask = unmask_mips_irq, + .irq_eoi = unmask_mips_irq, ++ .irq_disable = mask_mips_irq, ++ .irq_enable = unmask_mips_irq, + }; + + /* +@@ -92,6 +94,8 @@ static struct irq_chip mips_mt_cpu_irq_c + .irq_mask_ack = mips_mt_cpu_irq_ack, + .irq_unmask = unmask_mips_irq, + .irq_eoi = unmask_mips_irq, ++ .irq_disable = mask_mips_irq, ++ .irq_enable = unmask_mips_irq, + }; + + void __init mips_cpu_irq_init(void) diff --git a/queue-3.18/mips-octeon-fix-kernel-crash-when-offlining-a-cpu.patch b/queue-3.18/mips-octeon-fix-kernel-crash-when-offlining-a-cpu.patch new file mode 100644 index 00000000000..feb85de644d --- /dev/null +++ b/queue-3.18/mips-octeon-fix-kernel-crash-when-offlining-a-cpu.patch @@ -0,0 +1,121 @@ +From 63a87fe0d0de2ce126a8cec9a299a133cfd5658e Mon Sep 17 00:00:00 2001 +From: Aaro Koskinen +Date: Thu, 15 Jan 2015 23:01:58 +0200 +Subject: MIPS: OCTEON: fix kernel crash when offlining a CPU + +From: Aaro Koskinen + +commit 63a87fe0d0de2ce126a8cec9a299a133cfd5658e upstream. + +octeon_cpu_disable() will unconditionally enable interrupts when called. +We can assume that the routine is always called with interrupts disabled, +so just delete the incorrect local_irq_disable/enable(). + +The patch fixes the following crash when offlining a CPU: + +[ 93.818785] ------------[ cut here ]------------ +[ 93.823421] WARNING: CPU: 1 PID: 10 at kernel/smp.c:231 flush_smp_call_function_queue+0x1c4/0x1d0() +[ 93.836215] Modules linked in: +[ 93.839287] CPU: 1 PID: 10 Comm: migration/1 Not tainted 3.19.0-rc4-octeon-los_b5f0 #1 +[ 93.847212] Stack : 0000000000000001 ffffffff81b2cf90 0000000000000004 ffffffff81630000 + 0000000000000000 0000000000000000 0000000000000000 000000000000004a + 0000000000000006 ffffffff8117e550 0000000000000000 0000000000000000 + ffffffff81b30000 ffffffff81b26808 8000000032c77748 ffffffff81627e07 + ffffffff81595ec8 ffffffff81b26808 000000000000000a 0000000000000001 + 0000000000000001 0000000000000003 0000000010008ce1 ffffffff815030c8 + 8000000032cbbb38 ffffffff8113d42c 0000000010008ce1 ffffffff8117f36c + 8000000032c77300 8000000032cbba50 0000000000000001 ffffffff81503984 + 0000000000000000 0000000000000000 0000000000000000 0000000000000000 + 0000000000000000 ffffffff81121668 0000000000000000 0000000000000000 + ... +[ 93.912819] Call Trace: +[ 93.915273] [] show_stack+0x68/0x80 +[ 93.920335] [] dump_stack+0x6c/0x90 +[ 93.925395] [] warn_slowpath_common+0x94/0xd8 +[ 93.931324] [] flush_smp_call_function_queue+0x1c4/0x1d0 +[ 93.938208] [] hotplug_cfd+0xf0/0x108 +[ 93.943444] [] notifier_call_chain+0x5c/0xb8 +[ 93.949286] [] cpu_notify+0x24/0x60 +[ 93.954348] [] take_cpu_down+0x38/0x58 +[ 93.959670] [] multi_cpu_stop+0x154/0x180 +[ 93.965250] [] cpu_stopper_thread+0xd8/0x160 +[ 93.971093] [] smpboot_thread_fn+0x1ec/0x1f8 +[ 93.976936] [] kthread+0xd4/0xf0 +[ 93.981735] [] ret_from_kernel_thread+0x14/0x1c +[ 93.987835] +[ 93.989326] ---[ end trace c9e3815ee655bda9 ]--- +[ 93.993951] Kernel bug detected[#1]: +[ 93.997533] CPU: 1 PID: 10 Comm: migration/1 Tainted: G W 3.19.0-rc4-octeon-los_b5f0 #1 +[ 94.006591] task: 8000000032c77300 ti: 8000000032cb8000 task.ti: 8000000032cb8000 +[ 94.014081] $ 0 : 0000000000000000 0000000010000ce1 0000000000000001 ffffffff81620000 +[ 94.022146] $ 4 : 8000000002c72ac0 0000000000000000 00000000000001a7 ffffffff813b06f0 +[ 94.030210] $ 8 : ffffffff813b20d8 0000000000000000 0000000000000000 ffffffff81630000 +[ 94.038275] $12 : 0000000000000087 0000000000000000 0000000000000086 0000000000000000 +[ 94.046339] $16 : ffffffff81623168 0000000000000001 0000000000000000 0000000000000008 +[ 94.054405] $20 : 0000000000000001 0000000000000001 0000000000000001 0000000000000003 +[ 94.062470] $24 : 0000000000000038 ffffffff813b7f10 +[ 94.070536] $28 : 8000000032cb8000 8000000032cbbc20 0000000010008ce1 ffffffff811bcaf4 +[ 94.078601] Hi : 0000000000f188e8 +[ 94.082179] Lo : d4fdf3b646c09d55 +[ 94.085760] epc : ffffffff811bc9d0 irq_work_run_list+0x8/0xf8 +[ 94.091686] Tainted: G W +[ 94.095613] ra : ffffffff811bcaf4 irq_work_run+0x34/0x60 +[ 94.101192] Status: 10000ce3 KX SX UX KERNEL EXL IE +[ 94.106235] Cause : 40808034 +[ 94.109119] PrId : 000d9301 (Cavium Octeon II) +[ 94.113653] Modules linked in: +[ 94.116721] Process migration/1 (pid: 10, threadinfo=8000000032cb8000, task=8000000032c77300, tls=0000000000000000) +[ 94.127168] Stack : 8000000002c74c80 ffffffff811a4128 0000000000000001 ffffffff81635720 + fffffffffffffff2 ffffffff8115bacc 80000000320fbce0 80000000320fbca4 + 80000000320fbc80 0000000000000002 0000000000000004 ffffffff8113d704 + 80000000320fbce0 ffffffff81501738 0000000000000003 ffffffff811b343c + 8000000002c72aa0 8000000002c72aa8 ffffffff8159cae8 ffffffff8159caa0 + ffffffff81650000 80000000320fbbf0 80000000320fbc80 ffffffff811b32e8 + 0000000000000000 ffffffff811b3768 ffffffff81622b80 ffffffff815148a8 + 8000000032c77300 8000000002c73e80 ffffffff815148a8 8000000032c77300 + ffffffff81622b80 ffffffff815148a8 8000000032c77300 ffffffff81503f48 + ffffffff8115ea0c ffffffff81620000 0000000000000000 ffffffff81174d64 + ... +[ 94.192771] Call Trace: +[ 94.195222] [] irq_work_run_list+0x8/0xf8 +[ 94.200802] [] irq_work_run+0x34/0x60 +[ 94.206036] [] hotplug_cfd+0xf0/0x108 +[ 94.211269] [] notifier_call_chain+0x5c/0xb8 +[ 94.217111] [] cpu_notify+0x24/0x60 +[ 94.222171] [] take_cpu_down+0x38/0x58 +[ 94.227491] [] multi_cpu_stop+0x154/0x180 +[ 94.233072] [] cpu_stopper_thread+0xd8/0x160 +[ 94.238914] [] smpboot_thread_fn+0x1ec/0x1f8 +[ 94.244757] [] kthread+0xd4/0xf0 +[ 94.249555] [] ret_from_kernel_thread+0x14/0x1c +[ 94.255654] +[ 94.257146] +Code: a2423c40 40026000 30420001 <00020336> dc820000 10400037 00000000 0000010f 0000010f +[ 94.267183] ---[ end trace c9e3815ee655bdaa ]--- +[ 94.271804] Fatal exception: panic in 5 seconds + +Reported-by: Hemmo Nieminen +Signed-off-by: Aaro Koskinen +Acked-by: David Daney +Cc: linux-mips@linux-mips.org +Cc: linux-kernel@vger.kernel.org +Patchwork: https://patchwork.linux-mips.org/patch/8952/ +Signed-off-by: Ralf Baechle +Signed-off-by: Greg Kroah-Hartman + +--- + arch/mips/cavium-octeon/smp.c | 2 -- + 1 file changed, 2 deletions(-) + +--- a/arch/mips/cavium-octeon/smp.c ++++ b/arch/mips/cavium-octeon/smp.c +@@ -240,9 +240,7 @@ static int octeon_cpu_disable(void) + + set_cpu_online(cpu, false); + cpu_clear(cpu, cpu_callin_map); +- local_irq_disable(); + octeon_fixup_irqs(); +- local_irq_enable(); + + flush_cache_all(); + local_flush_tlb_all(); diff --git a/queue-3.18/mips-traps-fix-inline-asm-ctc1-missing-.set-hardfloat.patch b/queue-3.18/mips-traps-fix-inline-asm-ctc1-missing-.set-hardfloat.patch new file mode 100644 index 00000000000..f4cd5f8dbca --- /dev/null +++ b/queue-3.18/mips-traps-fix-inline-asm-ctc1-missing-.set-hardfloat.patch @@ -0,0 +1,47 @@ +From d76e9b9fc5de7e8fc4fd0e72a94e8c723929ffea Mon Sep 17 00:00:00 2001 +From: James Hogan +Date: Fri, 30 Jan 2015 15:40:20 +0000 +Subject: MIPS: traps: Fix inline asm ctc1 missing .set hardfloat + +From: James Hogan + +commit d76e9b9fc5de7e8fc4fd0e72a94e8c723929ffea upstream. + +Commit 842dfc11ea9a ("MIPS: Fix build with binutils 2.24.51+") in v3.18 +enabled -msoft-float and sprinkled ".set hardfloat" where necessary to +use FP instructions. However it missed enable_restore_fp_context() which +since v3.17 does a ctc1 with inline assembly, causing the following +assembler errors on Mentor's 2014.05 toolchain: + +{standard input}: Assembler messages: +{standard input}:2913: Error: opcode not supported on this processor: mips32r2 (mips32r2) `ctc1 $2,$31' +scripts/Makefile.build:257: recipe for target 'arch/mips/kernel/traps.o' failed + +Fix that to use the new write_32bit_cp1_register() macro so that ".set +hardfloat" is automatically added when -msoft-float is in use. + +Fixes 842dfc11ea9a ("MIPS: Fix build with binutils 2.24.51+") +Signed-off-by: James Hogan +Cc: Ralf Baechle +Cc: Paul Burton +Cc: linux-mips@linux-mips.org +Patchwork: https://patchwork.linux-mips.org/patch/9173/ +Signed-off-by: Ralf Baechle +Signed-off-by: Greg Kroah-Hartman + +--- + arch/mips/kernel/traps.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/arch/mips/kernel/traps.c ++++ b/arch/mips/kernel/traps.c +@@ -1184,7 +1184,8 @@ static int enable_restore_fp_context(int + + /* Restore the scalar FP control & status register */ + if (!was_fpu_owner) +- asm volatile("ctc1 %0, $31" : : "r"(current->thread.fpu.fcr31)); ++ write_32bit_cp1_register(CP1_STATUS, ++ current->thread.fpu.fcr31); + } + + out: diff --git a/queue-3.18/mm-pagewalk-call-pte_hole-for-vm_pfnmap-during-walk_page_range.patch b/queue-3.18/mm-pagewalk-call-pte_hole-for-vm_pfnmap-during-walk_page_range.patch new file mode 100644 index 00000000000..82f73d6f058 --- /dev/null +++ b/queue-3.18/mm-pagewalk-call-pte_hole-for-vm_pfnmap-during-walk_page_range.patch @@ -0,0 +1,54 @@ +From 23aaed6659df9adfabe9c583e67a36b54e21df46 Mon Sep 17 00:00:00 2001 +From: Shiraz Hashim +Date: Thu, 5 Feb 2015 12:25:06 -0800 +Subject: mm: pagewalk: call pte_hole() for VM_PFNMAP during walk_page_range + +From: Shiraz Hashim + +commit 23aaed6659df9adfabe9c583e67a36b54e21df46 upstream. + +walk_page_range() silently skips vma having VM_PFNMAP set, which leads +to undesirable behaviour at client end (who called walk_page_range). +Userspace applications get the wrong data, so the effect is like just +confusing users (if the applications just display the data) or sometimes +killing the processes (if the applications do something with +misunderstanding virtual addresses due to the wrong data.) + +For example for pagemap_read, when no callbacks are called against +VM_PFNMAP vma, pagemap_read may prepare pagemap data for next virtual +address range at wrong index. + +Eventually userspace may get wrong pagemap data for a task. +Corresponding to a VM_PFNMAP marked vma region, kernel may report +mappings from subsequent vma regions. User space in turn may account +more pages (than really are) to the task. + +In my case I was using procmem, procrack (Android utility) which uses +pagemap interface to account RSS pages of a task. Due to this bug it +was giving a wrong picture for vmas (with VM_PFNMAP set). + +Fixes: a9ff785e4437 ("mm/pagewalk.c: walk_page_range should avoid VM_PFNMAP areas") +Signed-off-by: Shiraz Hashim +Acked-by: Naoya Horiguchi +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/pagewalk.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/mm/pagewalk.c ++++ b/mm/pagewalk.c +@@ -199,7 +199,10 @@ int walk_page_range(unsigned long addr, + */ + if ((vma->vm_start <= addr) && + (vma->vm_flags & VM_PFNMAP)) { +- next = vma->vm_end; ++ if (walk->pte_hole) ++ err = walk->pte_hole(addr, next, walk); ++ if (err) ++ break; + pgd = pgd_offset(walk->mm, next); + continue; + } diff --git a/queue-3.18/nilfs2-fix-deadlock-of-segment-constructor-over-i_sync-flag.patch b/queue-3.18/nilfs2-fix-deadlock-of-segment-constructor-over-i_sync-flag.patch new file mode 100644 index 00000000000..c1f221f8520 --- /dev/null +++ b/queue-3.18/nilfs2-fix-deadlock-of-segment-constructor-over-i_sync-flag.patch @@ -0,0 +1,220 @@ +From 7ef3ff2fea8bf5e4a21cef47ad87710a3d0fdb52 Mon Sep 17 00:00:00 2001 +From: Ryusuke Konishi +Date: Thu, 5 Feb 2015 12:25:20 -0800 +Subject: nilfs2: fix deadlock of segment constructor over I_SYNC flag + +From: Ryusuke Konishi + +commit 7ef3ff2fea8bf5e4a21cef47ad87710a3d0fdb52 upstream. + +Nilfs2 eventually hangs in a stress test with fsstress program. This +issue was caused by the following deadlock over I_SYNC flag between +nilfs_segctor_thread() and writeback_sb_inodes(): + + nilfs_segctor_thread() + nilfs_segctor_thread_construct() + nilfs_segctor_unlock() + nilfs_dispose_list() + iput() + iput_final() + evict() + inode_wait_for_writeback() * wait for I_SYNC flag + + writeback_sb_inodes() + * set I_SYNC flag on inode->i_state + __writeback_single_inode() + do_writepages() + nilfs_writepages() + nilfs_construct_dsync_segment() + nilfs_segctor_sync() + * wait for completion of segment constructor + inode_sync_complete() + * clear I_SYNC flag after __writeback_single_inode() completed + +writeback_sb_inodes() calls do_writepages() for dirty inodes after +setting I_SYNC flag on inode->i_state. do_writepages() in turn calls +nilfs_writepages(), which can run segment constructor and wait for its +completion. On the other hand, segment constructor calls iput(), which +can call evict() and wait for the I_SYNC flag on +inode_wait_for_writeback(). + +Since segment constructor doesn't know when I_SYNC will be set, it +cannot know whether iput() will block or not unless inode->i_nlink has a +non-zero count. We can prevent evict() from being called in iput() by +implementing sop->drop_inode(), but it's not preferable to leave inodes +with i_nlink == 0 for long periods because it even defers file +truncation and inode deallocation. So, this instead resolves the +deadlock by calling iput() asynchronously with a workqueue for inodes +with i_nlink == 0. + +Signed-off-by: Ryusuke Konishi +Cc: Al Viro +Tested-by: Ryusuke Konishi +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + fs/nilfs2/nilfs.h | 2 -- + fs/nilfs2/segment.c | 44 +++++++++++++++++++++++++++++++++++++++----- + fs/nilfs2/segment.h | 5 +++++ + 3 files changed, 44 insertions(+), 7 deletions(-) + +--- a/fs/nilfs2/nilfs.h ++++ b/fs/nilfs2/nilfs.h +@@ -141,7 +141,6 @@ enum { + * @ti_save: Backup of journal_info field of task_struct + * @ti_flags: Flags + * @ti_count: Nest level +- * @ti_garbage: List of inode to be put when releasing semaphore + */ + struct nilfs_transaction_info { + u32 ti_magic; +@@ -150,7 +149,6 @@ struct nilfs_transaction_info { + one of other filesystems has a bug. */ + unsigned short ti_flags; + unsigned short ti_count; +- struct list_head ti_garbage; + }; + + /* ti_magic */ +--- a/fs/nilfs2/segment.c ++++ b/fs/nilfs2/segment.c +@@ -305,7 +305,6 @@ static void nilfs_transaction_lock(struc + ti->ti_count = 0; + ti->ti_save = cur_ti; + ti->ti_magic = NILFS_TI_MAGIC; +- INIT_LIST_HEAD(&ti->ti_garbage); + current->journal_info = ti; + + for (;;) { +@@ -332,8 +331,6 @@ static void nilfs_transaction_unlock(str + + up_write(&nilfs->ns_segctor_sem); + current->journal_info = ti->ti_save; +- if (!list_empty(&ti->ti_garbage)) +- nilfs_dispose_list(nilfs, &ti->ti_garbage, 0); + } + + static void *nilfs_segctor_map_segsum_entry(struct nilfs_sc_info *sci, +@@ -746,6 +743,15 @@ static void nilfs_dispose_list(struct th + } + } + ++static void nilfs_iput_work_func(struct work_struct *work) ++{ ++ struct nilfs_sc_info *sci = container_of(work, struct nilfs_sc_info, ++ sc_iput_work); ++ struct the_nilfs *nilfs = sci->sc_super->s_fs_info; ++ ++ nilfs_dispose_list(nilfs, &sci->sc_iput_queue, 0); ++} ++ + static int nilfs_test_metadata_dirty(struct the_nilfs *nilfs, + struct nilfs_root *root) + { +@@ -1900,8 +1906,8 @@ static int nilfs_segctor_collect_dirty_f + static void nilfs_segctor_drop_written_files(struct nilfs_sc_info *sci, + struct the_nilfs *nilfs) + { +- struct nilfs_transaction_info *ti = current->journal_info; + struct nilfs_inode_info *ii, *n; ++ int defer_iput = false; + + spin_lock(&nilfs->ns_inode_lock); + list_for_each_entry_safe(ii, n, &sci->sc_dirty_files, i_dirty) { +@@ -1912,9 +1918,24 @@ static void nilfs_segctor_drop_written_f + clear_bit(NILFS_I_BUSY, &ii->i_state); + brelse(ii->i_bh); + ii->i_bh = NULL; +- list_move_tail(&ii->i_dirty, &ti->ti_garbage); ++ list_del_init(&ii->i_dirty); ++ if (!ii->vfs_inode.i_nlink) { ++ /* ++ * Defer calling iput() to avoid a deadlock ++ * over I_SYNC flag for inodes with i_nlink == 0 ++ */ ++ list_add_tail(&ii->i_dirty, &sci->sc_iput_queue); ++ defer_iput = true; ++ } else { ++ spin_unlock(&nilfs->ns_inode_lock); ++ iput(&ii->vfs_inode); ++ spin_lock(&nilfs->ns_inode_lock); ++ } + } + spin_unlock(&nilfs->ns_inode_lock); ++ ++ if (defer_iput) ++ schedule_work(&sci->sc_iput_work); + } + + /* +@@ -2583,6 +2604,8 @@ static struct nilfs_sc_info *nilfs_segct + INIT_LIST_HEAD(&sci->sc_segbufs); + INIT_LIST_HEAD(&sci->sc_write_logs); + INIT_LIST_HEAD(&sci->sc_gc_inodes); ++ INIT_LIST_HEAD(&sci->sc_iput_queue); ++ INIT_WORK(&sci->sc_iput_work, nilfs_iput_work_func); + init_timer(&sci->sc_timer); + + sci->sc_interval = HZ * NILFS_SC_DEFAULT_TIMEOUT; +@@ -2609,6 +2632,8 @@ static void nilfs_segctor_write_out(stru + ret = nilfs_segctor_construct(sci, SC_LSEG_SR); + nilfs_transaction_unlock(sci->sc_super); + ++ flush_work(&sci->sc_iput_work); ++ + } while (ret && retrycount-- > 0); + } + +@@ -2633,6 +2658,9 @@ static void nilfs_segctor_destroy(struct + || sci->sc_seq_request != sci->sc_seq_done); + spin_unlock(&sci->sc_state_lock); + ++ if (flush_work(&sci->sc_iput_work)) ++ flag = true; ++ + if (flag || !nilfs_segctor_confirm(sci)) + nilfs_segctor_write_out(sci); + +@@ -2642,6 +2670,12 @@ static void nilfs_segctor_destroy(struct + nilfs_dispose_list(nilfs, &sci->sc_dirty_files, 1); + } + ++ if (!list_empty(&sci->sc_iput_queue)) { ++ nilfs_warning(sci->sc_super, __func__, ++ "iput queue is not empty\n"); ++ nilfs_dispose_list(nilfs, &sci->sc_iput_queue, 1); ++ } ++ + WARN_ON(!list_empty(&sci->sc_segbufs)); + WARN_ON(!list_empty(&sci->sc_write_logs)); + +--- a/fs/nilfs2/segment.h ++++ b/fs/nilfs2/segment.h +@@ -26,6 +26,7 @@ + #include + #include + #include ++#include + #include + #include "nilfs.h" + +@@ -92,6 +93,8 @@ struct nilfs_segsum_pointer { + * @sc_nblk_inc: Block count of current generation + * @sc_dirty_files: List of files to be written + * @sc_gc_inodes: List of GC inodes having blocks to be written ++ * @sc_iput_queue: list of inodes for which iput should be done ++ * @sc_iput_work: work struct to defer iput call + * @sc_freesegs: array of segment numbers to be freed + * @sc_nfreesegs: number of segments on @sc_freesegs + * @sc_dsync_inode: inode whose data pages are written for a sync operation +@@ -135,6 +138,8 @@ struct nilfs_sc_info { + + struct list_head sc_dirty_files; + struct list_head sc_gc_inodes; ++ struct list_head sc_iput_queue; ++ struct work_struct sc_iput_work; + + __u64 *sc_freesegs; + size_t sc_nfreesegs; diff --git a/queue-3.18/pci-add-nec-variants-to-stratus-ftserver-pcie-dmi-check.patch b/queue-3.18/pci-add-nec-variants-to-stratus-ftserver-pcie-dmi-check.patch new file mode 100644 index 00000000000..8da5ef50fc9 --- /dev/null +++ b/queue-3.18/pci-add-nec-variants-to-stratus-ftserver-pcie-dmi-check.patch @@ -0,0 +1,48 @@ +From 51ac3d2f0c505ca36ffc9715ffd518d756589ef8 Mon Sep 17 00:00:00 2001 +From: Charlotte Richardson +Date: Mon, 2 Feb 2015 09:36:23 -0600 +Subject: PCI: Add NEC variants to Stratus ftServer PCIe DMI check + +From: Charlotte Richardson + +commit 51ac3d2f0c505ca36ffc9715ffd518d756589ef8 upstream. + +NEC OEMs the same platforms as Stratus does, which have multiple devices on +some PCIe buses under downstream ports. + +Link: https://bugzilla.kernel.org/show_bug.cgi?id=51331 +Fixes: 1278998f8ff6 ("PCI: Work around Stratus ftServer broken PCIe hierarchy (fix DMI check)") +Signed-off-by: Charlotte Richardson +Signed-off-by: Bjorn Helgaas +CC: Myron Stowe +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/pci/common.c | 16 ++++++++++++++++ + 1 file changed, 16 insertions(+) + +--- a/arch/x86/pci/common.c ++++ b/arch/x86/pci/common.c +@@ -448,6 +448,22 @@ static const struct dmi_system_id pcipro + DMI_MATCH(DMI_PRODUCT_NAME, "ftServer"), + }, + }, ++ { ++ .callback = set_scan_all, ++ .ident = "Stratus/NEC ftServer", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "NEC"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "Express5800/R32"), ++ }, ++ }, ++ { ++ .callback = set_scan_all, ++ .ident = "Stratus/NEC ftServer", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "NEC"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "Express5800/R31"), ++ }, ++ }, + {} + }; + diff --git a/queue-3.18/pci-designware-reject-msi-x-irqs.patch b/queue-3.18/pci-designware-reject-msi-x-irqs.patch new file mode 100644 index 00000000000..9c8dcf0e970 --- /dev/null +++ b/queue-3.18/pci-designware-reject-msi-x-irqs.patch @@ -0,0 +1,39 @@ +From 19c5392eb1c1e81188e898400c0e8258827eb160 Mon Sep 17 00:00:00 2001 +From: Lucas Stach +Date: Tue, 27 Jan 2015 10:24:53 -0600 +Subject: PCI: designware: Reject MSI-X IRQs + +From: Lucas Stach + +commit 19c5392eb1c1e81188e898400c0e8258827eb160 upstream. + +The DesignWare PCIe MSI hardware does not support MSI-X IRQs. Setting +those up failed as a side effect of a bug which was fixed by 91f8ae823f2b +("PCI: designware: Setup and clear exactly one MSI at a time"). + +Now that this bug is fixed, MSI-X IRQs need to be rejected explicitly; +otherwise devices trying to use them may end up with incorrectly working +interrupts. + +Fixes: 91f8ae823f2b ("PCI: designware: Setup and clear exactly one MSI at a time") +Signed-off-by: Lucas Stach +Signed-off-by: Bjorn Helgaas +Acked-by: Jingoo Han +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pci/host/pcie-designware.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/pci/host/pcie-designware.c ++++ b/drivers/pci/host/pcie-designware.c +@@ -283,6 +283,9 @@ static int dw_msi_setup_irq(struct msi_c + struct msi_msg msg; + struct pcie_port *pp = sys_to_pcie(pdev->bus->sysdata); + ++ if (desc->msi_attrib.is_msix) ++ return -EINVAL; ++ + irq = assign_irq(1, desc, &pos); + if (irq < 0) + return irq; diff --git a/queue-3.18/pci-handle-read-only-bars-on-amd-cs553x-devices.patch b/queue-3.18/pci-handle-read-only-bars-on-amd-cs553x-devices.patch new file mode 100644 index 00000000000..3fc012858f7 --- /dev/null +++ b/queue-3.18/pci-handle-read-only-bars-on-amd-cs553x-devices.patch @@ -0,0 +1,96 @@ +From 06cf35f903aa6da0cc8d9f81e9bcd1f7e1b534bb Mon Sep 17 00:00:00 2001 +From: Myron Stowe +Date: Tue, 3 Feb 2015 16:01:24 -0700 +Subject: PCI: Handle read-only BARs on AMD CS553x devices + +From: Myron Stowe + +commit 06cf35f903aa6da0cc8d9f81e9bcd1f7e1b534bb upstream. + +Some AMD CS553x devices have read-only BARs because of a firmware or +hardware defect. There's a workaround in quirk_cs5536_vsa(), but it no +longer works after 36e8164882ca ("PCI: Restore detection of read-only +BARs"). Prior to 36e8164882ca, we filled in res->start; afterwards we +leave it zeroed out. The quirk only updated the size, so the driver tried +to use a region starting at zero, which didn't work. + +Expand quirk_cs5536_vsa() to read the base addresses from the BARs and +hard-code the sizes. + +On Nix's system BAR 2's read-only value is 0x6200. Prior to 36e8164882ca, +we interpret that as a 512-byte BAR based on the lowest-order bit set. Per +datasheet sec 5.6.1, that BAR (MFGPT) requires only 64 bytes; use that to +avoid clearing any address bits if a platform uses only 64-byte alignment. + +[bhelgaas: changelog, reduce BAR 2 size to 64] +Fixes: 36e8164882ca ("PCI: Restore detection of read-only BARs") +Link: https://bugzilla.kernel.org/show_bug.cgi?id=85991#c4 +Link: http://support.amd.com/TechDocs/31506_cs5535_databook.pdf +Link: http://support.amd.com/TechDocs/33238G_cs5536_db.pdf +Reported-and-tested-by: Nix +Signed-off-by: Myron Stowe +Signed-off-by: Bjorn Helgaas +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pci/quirks.c | 40 +++++++++++++++++++++++++++++++++++++--- + 1 file changed, 37 insertions(+), 3 deletions(-) + +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -324,18 +324,52 @@ static void quirk_s3_64M(struct pci_dev + DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_S3, PCI_DEVICE_ID_S3_868, quirk_s3_64M); + DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_S3, PCI_DEVICE_ID_S3_968, quirk_s3_64M); + ++static void quirk_io(struct pci_dev *dev, int pos, unsigned size, ++ const char *name) ++{ ++ u32 region; ++ struct pci_bus_region bus_region; ++ struct resource *res = dev->resource + pos; ++ ++ pci_read_config_dword(dev, PCI_BASE_ADDRESS_0 + (pos << 2), ®ion); ++ ++ if (!region) ++ return; ++ ++ res->name = pci_name(dev); ++ res->flags = region & ~PCI_BASE_ADDRESS_IO_MASK; ++ res->flags |= ++ (IORESOURCE_IO | IORESOURCE_PCI_FIXED | IORESOURCE_SIZEALIGN); ++ region &= ~(size - 1); ++ ++ /* Convert from PCI bus to resource space */ ++ bus_region.start = region; ++ bus_region.end = region + size - 1; ++ pcibios_bus_to_resource(dev->bus, res, &bus_region); ++ ++ dev_info(&dev->dev, FW_BUG "%s quirk: reg 0x%x: %pR\n", ++ name, PCI_BASE_ADDRESS_0 + (pos << 2), res); ++} ++ + /* + * Some CS5536 BIOSes (for example, the Soekris NET5501 board w/ comBIOS + * ver. 1.33 20070103) don't set the correct ISA PCI region header info. + * BAR0 should be 8 bytes; instead, it may be set to something like 8k + * (which conflicts w/ BAR1's memory range). ++ * ++ * CS553x's ISA PCI BARs may also be read-only (ref: ++ * https://bugzilla.kernel.org/show_bug.cgi?id=85991 - Comment #4 forward). + */ + static void quirk_cs5536_vsa(struct pci_dev *dev) + { ++ static char *name = "CS5536 ISA bridge"; ++ + if (pci_resource_len(dev, 0) != 8) { +- struct resource *res = &dev->resource[0]; +- res->end = res->start + 8 - 1; +- dev_info(&dev->dev, "CS5536 ISA bridge bug detected (incorrect header); workaround applied\n"); ++ quirk_io(dev, 0, 8, name); /* SMB */ ++ quirk_io(dev, 1, 256, name); /* GPIO */ ++ quirk_io(dev, 2, 64, name); /* MFGPT */ ++ dev_info(&dev->dev, "%s bug detected (incorrect header); workaround applied\n", ++ name); + } + } + DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_CS5536_ISA, quirk_cs5536_vsa); diff --git a/queue-3.18/sd-fix-max-transfer-length-for-4k-disks.patch b/queue-3.18/sd-fix-max-transfer-length-for-4k-disks.patch new file mode 100644 index 00000000000..93a608811aa --- /dev/null +++ b/queue-3.18/sd-fix-max-transfer-length-for-4k-disks.patch @@ -0,0 +1,44 @@ +From 3a9794d32984b67a6d8992226918618f0e51e5d5 Mon Sep 17 00:00:00 2001 +From: Brian King +Date: Thu, 29 Jan 2015 15:54:40 -0600 +Subject: sd: Fix max transfer length for 4k disks + +From: Brian King + +commit 3a9794d32984b67a6d8992226918618f0e51e5d5 upstream. + +The following patch fixes an issue observed with 4k sector disks +where the max_hw_sectors attribute was getting set too large in +sd_revalidate_disk. Since sdkp->max_xfer_blocks is in units +of SCSI logical blocks and queue_max_hw_sectors is in units of +512 byte blocks, on a 4k sector disk, every time we went through +sd_revalidate_disk, we were taking the current value of +queue_max_hw_sectors and increasing it by a factor of 8. Fix +this by only shifting sdkp->max_xfer_blocks. + +Signed-off-by: Brian King +Reviewed-by: Paolo Bonzini +Reviewed-by: Martin K. Petersen +Signed-off-by: Christoph Hellwig +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/sd.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/scsi/sd.c ++++ b/drivers/scsi/sd.c +@@ -2818,9 +2818,11 @@ static int sd_revalidate_disk(struct gen + */ + sd_set_flush_flag(sdkp); + +- max_xfer = min_not_zero(queue_max_hw_sectors(sdkp->disk->queue), +- sdkp->max_xfer_blocks); ++ max_xfer = sdkp->max_xfer_blocks; + max_xfer <<= ilog2(sdp->sector_size) - 9; ++ ++ max_xfer = min_not_zero(queue_max_hw_sectors(sdkp->disk->queue), ++ max_xfer); + blk_queue_max_hw_sectors(sdkp->disk->queue, max_xfer); + set_capacity(disk, sdkp->capacity); + sd_config_write_same(sdkp); diff --git a/queue-3.18/spi-imx-use-pio-mode-for-i.mx6dl.patch b/queue-3.18/spi-imx-use-pio-mode-for-i.mx6dl.patch new file mode 100644 index 00000000000..f12f486c8b9 --- /dev/null +++ b/queue-3.18/spi-imx-use-pio-mode-for-i.mx6dl.patch @@ -0,0 +1,34 @@ +From a02bb401f8ae264be782ee57d98bdd99f14c8022 Mon Sep 17 00:00:00 2001 +From: Robin Gong +Date: Tue, 3 Feb 2015 10:25:53 +0800 +Subject: spi: imx: use pio mode for i.mx6dl + +From: Robin Gong + +commit a02bb401f8ae264be782ee57d98bdd99f14c8022 upstream. + +For TKT238285 hardware issue which may cause txfifo store data twice can only +be caught on i.mx6dl, we use pio mode instead of DMA mode on i.mx6dl. + +Fixes: f62caccd12c17e4 (spi: spi-imx: add DMA support) +Signed-off-by: Robin Gong +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/spi/spi-imx.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/spi/spi-imx.c ++++ b/drivers/spi/spi-imx.c +@@ -823,6 +823,10 @@ static int spi_imx_sdma_init(struct devi + struct dma_slave_config slave_config = {}; + int ret; + ++ /* use pio mode for i.mx6dl chip TKT238285 */ ++ if (of_machine_is_compatible("fsl,imx6dl")) ++ return 0; ++ + /* Prepare for TX DMA: */ + master->dma_tx = dma_request_slave_channel(dev, "tx"); + if (!master->dma_tx) { diff --git a/queue-3.18/spi-spi-fsl-dspi-remove-usage-of-devm_kzalloc.patch b/queue-3.18/spi-spi-fsl-dspi-remove-usage-of-devm_kzalloc.patch new file mode 100644 index 00000000000..8d02101dcf1 --- /dev/null +++ b/queue-3.18/spi-spi-fsl-dspi-remove-usage-of-devm_kzalloc.patch @@ -0,0 +1,62 @@ +From 973fbce69ed8e79b5fe3ad19cfecb581a7ef8048 Mon Sep 17 00:00:00 2001 +From: Bhuvanchandra DV +Date: Tue, 27 Jan 2015 16:27:20 +0530 +Subject: spi: spi-fsl-dspi: Remove usage of devm_kzalloc + +From: Bhuvanchandra DV + +commit 973fbce69ed8e79b5fe3ad19cfecb581a7ef8048 upstream. + +devm_* API was supposed to be used only in probe function call. +Memory is allocated at 'probe' and free automatically at 'remove'. +Usage of devm_* functions outside probe sometimes leads to memory leak. +Avoid using devm_kzalloc in dspi_setup_transfer and use kzalloc instead. +Also add the dspi_cleanup function to free the controller data upon +cleanup. + +Acked-by: Stefan Agner +Signed-off-by: Bhuvanchandra DV +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/spi/spi-fsl-dspi.c | 14 ++++++++++++-- + 1 file changed, 12 insertions(+), 2 deletions(-) + +--- a/drivers/spi/spi-fsl-dspi.c ++++ b/drivers/spi/spi-fsl-dspi.c +@@ -342,8 +342,7 @@ static int dspi_setup_transfer(struct sp + /* Only alloc on first setup */ + chip = spi_get_ctldata(spi); + if (chip == NULL) { +- chip = devm_kzalloc(&spi->dev, sizeof(struct chip_data), +- GFP_KERNEL); ++ chip = kzalloc(sizeof(struct chip_data), GFP_KERNEL); + if (!chip) + return -ENOMEM; + } +@@ -382,6 +381,16 @@ static int dspi_setup(struct spi_device + return dspi_setup_transfer(spi, NULL); + } + ++static void dspi_cleanup(struct spi_device *spi) ++{ ++ struct chip_data *chip = spi_get_ctldata((struct spi_device *)spi); ++ ++ dev_dbg(&spi->dev, "spi_device %u.%u cleanup\n", ++ spi->master->bus_num, spi->chip_select); ++ ++ kfree(chip); ++} ++ + static irqreturn_t dspi_interrupt(int irq, void *dev_id) + { + struct fsl_dspi *dspi = (struct fsl_dspi *)dev_id; +@@ -467,6 +476,7 @@ static int dspi_probe(struct platform_de + dspi->bitbang.master->setup = dspi_setup; + dspi->bitbang.master->dev.of_node = pdev->dev.of_node; + ++ master->cleanup = dspi_cleanup; + master->mode_bits = SPI_CPOL | SPI_CPHA; + master->bits_per_word_mask = SPI_BPW_MASK(4) | SPI_BPW_MASK(8) | + SPI_BPW_MASK(16);