From: Greg Kroah-Hartman Date: Wed, 14 Jan 2015 05:44:16 +0000 (-0800) Subject: 3.18-stable patches X-Git-Tag: v3.10.65~8 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=5bdb2afd553a796e3830adc94437faeaf06f1abb;p=thirdparty%2Fkernel%2Fstable-queue.git 3.18-stable patches added patches: acpi-pm-fix-pm-initialization-for-devices-that-are-not-present.patch acpi-video-add-some-samsung-models-to-disable_native_backlight-list.patch arm64-efi-add-missing-call-to-early_ioremap_reset.patch arm64-kernel-fix-__cpu_suspend-mm-switch-on-warm-boot.patch arm64-move-cpu_resume-into-the-text-section.patch btrfs-don-t-delay-inode-ref-updates-during-log-replay.patch crypto-aesni-fix-by8-variant-for-128-bit-keys.patch crypto-sha-mb-add-avx2_supported-check.patch input-alps-v7-fix-finger-counting-for-2-fingers-on-clickpads.patch input-alps-v7-ignore-new-packets.patch input-alps-v7-sometimes-a-single-touch-is-reported-in-mt.patch perf-fix-events-installation-during-moving-group.patch perf-session-do-not-fail-on-processing-out-of-order-event.patch perf-x86-intel-uncore-make-sure-only-uncore-events-are-collected.patch perf-x86-uncore-hsw-ep-handle-systems-with-only-two-sboxes.patch revert-input-atmel_mxt_ts-use-deep-sleep-mode-when-stopped.patch revert-mac80211-fix-accounting-of-the-tailroom-needed-counter.patch rpc-fix-xdr_truncate_encode-to-handle-buffer-ending-on-page-boundary.patch --- diff --git a/queue-3.18/acpi-pm-fix-pm-initialization-for-devices-that-are-not-present.patch b/queue-3.18/acpi-pm-fix-pm-initialization-for-devices-that-are-not-present.patch new file mode 100644 index 00000000000..a82de36baff --- /dev/null +++ b/queue-3.18/acpi-pm-fix-pm-initialization-for-devices-that-are-not-present.patch @@ -0,0 +1,99 @@ +From 1b1f3e1699a9886f1070f94171097ab4ccdbfc95 Mon Sep 17 00:00:00 2001 +From: "Rafael J. Wysocki" +Date: Thu, 1 Jan 2015 23:38:28 +0100 +Subject: ACPI / PM: Fix PM initialization for devices that are not present + +From: "Rafael J. Wysocki" + +commit 1b1f3e1699a9886f1070f94171097ab4ccdbfc95 upstream. + +If an ACPI device object whose _STA returns 0 (not present and not +functional) has _PR0 or _PS0, its power_manageable flag will be set +and acpi_bus_init_power() will return 0 for it. Consequently, if +such a device object is passed to the ACPI device PM functions, they +will attempt to carry out the requested operation on the device, +although they should not do that for devices that are not present. + +To fix that problem make acpi_bus_init_power() return an error code +for devices that are not present which will cause power_manageable to +be cleared for them as appropriate in acpi_bus_get_power_flags(). +However, the lists of power resources should not be freed for the +device in that case, so modify acpi_bus_get_power_flags() to keep +those lists even if acpi_bus_init_power() returns an error. +Accordingly, when deciding whether or not the lists of power +resources need to be freed, acpi_free_power_resources_lists() +should check the power.flags.power_resources flag instead of +flags.power_manageable, so make that change too. + +Furthermore, if acpi_bus_attach() sees that flags.initialized is +unset for the given device, it should reset the power management +settings of the device and re-initialize them from scratch instead +of relying on the previous settings (the device may have appeared +after being not present previously, for example), so make it use +the 'valid' flag of the D0 power state as the initial value of +flags.power_manageable for it and call acpi_bus_init_power() to +discover its current power state. + +Signed-off-by: Rafael J. Wysocki +Reviewed-by: Mika Westerberg +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/acpi/device_pm.c | 2 +- + drivers/acpi/scan.c | 13 ++++++++----- + 2 files changed, 9 insertions(+), 6 deletions(-) + +--- a/drivers/acpi/device_pm.c ++++ b/drivers/acpi/device_pm.c +@@ -257,7 +257,7 @@ int acpi_bus_init_power(struct acpi_devi + + device->power.state = ACPI_STATE_UNKNOWN; + if (!acpi_device_is_present(device)) +- return 0; ++ return -ENXIO; + + result = acpi_device_get_power(device, &state); + if (result) +--- a/drivers/acpi/scan.c ++++ b/drivers/acpi/scan.c +@@ -909,7 +909,7 @@ static void acpi_free_power_resources_li + if (device->wakeup.flags.valid) + acpi_power_resources_list_free(&device->wakeup.resources); + +- if (!device->flags.power_manageable) ++ if (!device->power.flags.power_resources) + return; + + for (i = ACPI_STATE_D0; i <= ACPI_STATE_D3_HOT; i++) { +@@ -1631,10 +1631,8 @@ static void acpi_bus_get_power_flags(str + device->power.flags.power_resources) + device->power.states[ACPI_STATE_D3_COLD].flags.os_accessible = 1; + +- if (acpi_bus_init_power(device)) { +- acpi_free_power_resources_lists(device); ++ if (acpi_bus_init_power(device)) + device->flags.power_manageable = 0; +- } + } + + static void acpi_bus_get_flags(struct acpi_device *device) +@@ -2202,13 +2200,18 @@ static void acpi_bus_attach(struct acpi_ + /* Skip devices that are not present. */ + if (!acpi_device_is_present(device)) { + device->flags.visited = false; ++ device->flags.power_manageable = 0; + return; + } + if (device->handler) + goto ok; + + if (!device->flags.initialized) { +- acpi_bus_update_power(device, NULL); ++ device->flags.power_manageable = ++ device->power.states[ACPI_STATE_D0].flags.valid; ++ if (acpi_bus_init_power(device)) ++ device->flags.power_manageable = 0; ++ + device->flags.initialized = true; + } + device->flags.visited = false; diff --git a/queue-3.18/acpi-video-add-some-samsung-models-to-disable_native_backlight-list.patch b/queue-3.18/acpi-video-add-some-samsung-models-to-disable_native_backlight-list.patch new file mode 100644 index 00000000000..2ac6fd791a7 --- /dev/null +++ b/queue-3.18/acpi-video-add-some-samsung-models-to-disable_native_backlight-list.patch @@ -0,0 +1,56 @@ +From 7d0b93499f4879ddbc75d594f4ea216ba964f78e Mon Sep 17 00:00:00 2001 +From: Aaron Lu +Date: Mon, 22 Dec 2014 15:18:05 +0800 +Subject: ACPI / video: Add some Samsung models to disable_native_backlight list + +From: Aaron Lu + +commit 7d0b93499f4879ddbc75d594f4ea216ba964f78e upstream. + +Several Samsung laptop models (SAMSUNG 870Z5E/880Z5E/680Z5E and +SAMSUNG 370R4E/370R4V/370R5E/3570RE/370R5V) do not have a working +native backlight control interface so restore their acpi_videoX +interface. + +Link: https://bugzilla.kernel.org/show_bug.cgi?id=84221 +Link: https://bugzilla.kernel.org/show_bug.cgi?id=84651 +For SAMSUNG 870Z5E/880Z5E/680Z5E: +Reported-and-tested-by: Brent Saner +Reported-by: Vitaliy Filippov +Reported-by: Laszlo KREKACS +For SAMSUNG 370R4E/370R4V/370R5E/3570RE/370R5V: +Reported-by: Vladimir Perepechin +Signed-off-by: Aaron Lu +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/acpi/video.c | 17 +++++++++++++++++ + 1 file changed, 17 insertions(+) + +--- a/drivers/acpi/video.c ++++ b/drivers/acpi/video.c +@@ -505,6 +505,23 @@ static struct dmi_system_id video_dmi_ta + DMI_MATCH(DMI_PRODUCT_NAME, "HP ENVY 15 Notebook PC"), + }, + }, ++ ++ { ++ .callback = video_disable_native_backlight, ++ .ident = "SAMSUNG 870Z5E/880Z5E/680Z5E", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "SAMSUNG ELECTRONICS CO., LTD."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "870Z5E/880Z5E/680Z5E"), ++ }, ++ }, ++ { ++ .callback = video_disable_native_backlight, ++ .ident = "SAMSUNG 370R4E/370R4V/370R5E/3570RE/370R5V", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "SAMSUNG ELECTRONICS CO., LTD."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "370R4E/370R4V/370R5E/3570RE/370R5V"), ++ }, ++ }, + {} + }; + diff --git a/queue-3.18/arm64-efi-add-missing-call-to-early_ioremap_reset.patch b/queue-3.18/arm64-efi-add-missing-call-to-early_ioremap_reset.patch new file mode 100644 index 00000000000..adcf04bcaf0 --- /dev/null +++ b/queue-3.18/arm64-efi-add-missing-call-to-early_ioremap_reset.patch @@ -0,0 +1,63 @@ +From 0e63ea48b4d8035dd0e91a3fa6fb79458b47adfb Mon Sep 17 00:00:00 2001 +From: Ard Biesheuvel +Date: Thu, 8 Jan 2015 09:54:58 +0000 +Subject: arm64/efi: add missing call to early_ioremap_reset() + +From: Ard Biesheuvel + +commit 0e63ea48b4d8035dd0e91a3fa6fb79458b47adfb upstream. + +The early ioremap support introduced by patch bf4b558eba92 +("arm64: add early_ioremap support") failed to add a call to +early_ioremap_reset() at an appropriate time. Without this call, +invocations of early_ioremap etc. that are done too late will go +unnoticed and may cause corruption. + +This is exactly what happened when the first user of this feature +was added in patch f84d02755f5a ("arm64: add EFI runtime services"). +The early mapping of the EFI memory map is unmapped during an early +initcall, at which time the early ioremap support is long gone. + +Fix by adding the missing call to early_ioremap_reset() to +setup_arch(), and move the offending early_memunmap() to right after +the point where the early mapping of the EFI memory map is last used. + +Fixes: f84d02755f5a ("arm64: add EFI runtime services") +Signed-off-by: Leif Lindholm +Signed-off-by: Ard Biesheuvel +Signed-off-by: Will Deacon +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm64/kernel/efi.c | 2 +- + arch/arm64/kernel/setup.c | 1 + + 2 files changed, 2 insertions(+), 1 deletion(-) + +--- a/arch/arm64/kernel/efi.c ++++ b/arch/arm64/kernel/efi.c +@@ -327,6 +327,7 @@ void __init efi_idmap_init(void) + + /* boot time idmap_pg_dir is incomplete, so fill in missing parts */ + efi_setup_idmap(); ++ early_memunmap(memmap.map, memmap.map_end - memmap.map); + } + + static int __init remap_region(efi_memory_desc_t *md, void **new) +@@ -381,7 +382,6 @@ static int __init arm64_enter_virtual_mo + } + + mapsize = memmap.map_end - memmap.map; +- early_memunmap(memmap.map, mapsize); + + if (efi_runtime_disabled()) { + pr_info("EFI runtime services will be disabled.\n"); +--- a/arch/arm64/kernel/setup.c ++++ b/arch/arm64/kernel/setup.c +@@ -394,6 +394,7 @@ void __init setup_arch(char **cmdline_p) + request_standard_resources(); + + efi_idmap_init(); ++ early_ioremap_reset(); + + unflatten_device_tree(); + diff --git a/queue-3.18/arm64-kernel-fix-__cpu_suspend-mm-switch-on-warm-boot.patch b/queue-3.18/arm64-kernel-fix-__cpu_suspend-mm-switch-on-warm-boot.patch new file mode 100644 index 00000000000..3ad27eb1b1f --- /dev/null +++ b/queue-3.18/arm64-kernel-fix-__cpu_suspend-mm-switch-on-warm-boot.patch @@ -0,0 +1,71 @@ +From f43c27188a49111b58e9611afa2f0365b0b55625 Mon Sep 17 00:00:00 2001 +From: Lorenzo Pieralisi +Date: Fri, 19 Dec 2014 17:03:47 +0000 +Subject: arm64: kernel: fix __cpu_suspend mm switch on warm-boot + +From: Lorenzo Pieralisi + +commit f43c27188a49111b58e9611afa2f0365b0b55625 upstream. + +On arm64 the TTBR0_EL1 register is set to either the reserved TTBR0 +page tables on boot or to the active_mm mappings belonging to user space +processes, it must never be set to swapper_pg_dir page tables mappings. + +When a CPU is booted its active_mm is set to init_mm even though its +TTBR0_EL1 points at the reserved TTBR0 page mappings. This implies +that when __cpu_suspend is triggered the active_mm can point at +init_mm even if the current TTBR0_EL1 register contains the reserved +TTBR0_EL1 mappings. + +Therefore, the mm save and restore executed in __cpu_suspend might +turn out to be erroneous in that, if the current->active_mm corresponds +to init_mm, on resume from low power it ends up restoring in the +TTBR0_EL1 the init_mm mappings that are global and can cause speculation +of TLB entries which end up being propagated to user space. + +This patch fixes the issue by checking the active_mm pointer before +restoring the TTBR0 mappings. If the current active_mm == &init_mm, +the code sets the TTBR0_EL1 to the reserved TTBR0 mapping instead of +switching back to the active_mm, which is the expected behaviour +corresponding to the TTBR0_EL1 settings when __cpu_suspend was entered. + +Fixes: 95322526ef62 ("arm64: kernel: cpu_{suspend/resume} implementation") +Cc: Will Deacon +Signed-off-by: Lorenzo Pieralisi +Signed-off-by: Catalin Marinas +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm64/kernel/suspend.c | 14 +++++++++++++- + 1 file changed, 13 insertions(+), 1 deletion(-) + +--- a/arch/arm64/kernel/suspend.c ++++ b/arch/arm64/kernel/suspend.c +@@ -5,6 +5,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -98,7 +99,18 @@ int __cpu_suspend(unsigned long arg, int + */ + ret = __cpu_suspend_enter(arg, fn); + if (ret == 0) { +- cpu_switch_mm(mm->pgd, mm); ++ /* ++ * We are resuming from reset with TTBR0_EL1 set to the ++ * idmap to enable the MMU; restore the active_mm mappings in ++ * TTBR0_EL1 unless the active_mm == &init_mm, in which case ++ * the thread entered __cpu_suspend with TTBR0_EL1 set to ++ * reserved TTBR0 page tables and should be restored as such. ++ */ ++ if (mm == &init_mm) ++ cpu_set_reserved_ttbr0(); ++ else ++ cpu_switch_mm(mm->pgd, mm); ++ + flush_tlb_all(); + + /* diff --git a/queue-3.18/arm64-move-cpu_resume-into-the-text-section.patch b/queue-3.18/arm64-move-cpu_resume-into-the-text-section.patch new file mode 100644 index 00000000000..b40584851d0 --- /dev/null +++ b/queue-3.18/arm64-move-cpu_resume-into-the-text-section.patch @@ -0,0 +1,110 @@ +From c3684fbb446501b48dec6677a6a9f61c215053de Mon Sep 17 00:00:00 2001 +From: Laura Abbott +Date: Fri, 21 Nov 2014 21:50:40 +0000 +Subject: arm64: Move cpu_resume into the text section + +From: Laura Abbott + +commit c3684fbb446501b48dec6677a6a9f61c215053de upstream. + +The function cpu_resume currently lives in the .data section. +There's no reason for it to be there since we can use relative +instructions without a problem. Move a few cpu_resume data +structures out of the assembly file so the .data annotation +can be dropped completely and cpu_resume ends up in the read +only text section. + +Reviewed-by: Kees Cook +Reviewed-by: Mark Rutland +Reviewed-by: Lorenzo Pieralisi +Tested-by: Mark Rutland +Tested-by: Lorenzo Pieralisi +Tested-by: Kees Cook +Acked-by: Ard Biesheuvel +Signed-off-by: Laura Abbott +Signed-off-by: Will Deacon +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm64/kernel/sleep.S | 36 ++++++------------------------------ + arch/arm64/kernel/suspend.c | 4 ++-- + 2 files changed, 8 insertions(+), 32 deletions(-) + +--- a/arch/arm64/kernel/sleep.S ++++ b/arch/arm64/kernel/sleep.S +@@ -147,14 +147,12 @@ cpu_resume_after_mmu: + ret + ENDPROC(cpu_resume_after_mmu) + +- .data + ENTRY(cpu_resume) + bl el2_setup // if in EL2 drop to EL1 cleanly + #ifdef CONFIG_SMP + mrs x1, mpidr_el1 +- adr x4, mpidr_hash_ptr +- ldr x5, [x4] +- add x8, x4, x5 // x8 = struct mpidr_hash phys address ++ adrp x8, mpidr_hash ++ add x8, x8, #:lo12:mpidr_hash // x8 = struct mpidr_hash phys address + /* retrieve mpidr_hash members to compute the hash */ + ldr x2, [x8, #MPIDR_HASH_MASK] + ldp w3, w4, [x8, #MPIDR_HASH_SHIFTS] +@@ -164,14 +162,15 @@ ENTRY(cpu_resume) + #else + mov x7, xzr + #endif +- adr x0, sleep_save_sp ++ adrp x0, sleep_save_sp ++ add x0, x0, #:lo12:sleep_save_sp + ldr x0, [x0, #SLEEP_SAVE_SP_PHYS] + ldr x0, [x0, x7, lsl #3] + /* load sp from context */ + ldr x2, [x0, #CPU_CTX_SP] +- adr x1, sleep_idmap_phys ++ adrp x1, sleep_idmap_phys + /* load physical address of identity map page table in x1 */ +- ldr x1, [x1] ++ ldr x1, [x1, #:lo12:sleep_idmap_phys] + mov sp, x2 + /* + * cpu_do_resume expects x0 to contain context physical address +@@ -180,26 +179,3 @@ ENTRY(cpu_resume) + bl cpu_do_resume // PC relative jump, MMU off + b cpu_resume_mmu // Resume MMU, never returns + ENDPROC(cpu_resume) +- +- .align 3 +-mpidr_hash_ptr: +- /* +- * offset of mpidr_hash symbol from current location +- * used to obtain run-time mpidr_hash address with MMU off +- */ +- .quad mpidr_hash - . +-/* +- * physical address of identity mapped page tables +- */ +- .type sleep_idmap_phys, #object +-ENTRY(sleep_idmap_phys) +- .quad 0 +-/* +- * struct sleep_save_sp { +- * phys_addr_t *save_ptr_stash; +- * phys_addr_t save_ptr_stash_phys; +- * }; +- */ +- .type sleep_save_sp, #object +-ENTRY(sleep_save_sp) +- .space SLEEP_SAVE_SP_SZ // struct sleep_save_sp +--- a/arch/arm64/kernel/suspend.c ++++ b/arch/arm64/kernel/suspend.c +@@ -126,8 +126,8 @@ int __cpu_suspend(unsigned long arg, int + return ret; + } + +-extern struct sleep_save_sp sleep_save_sp; +-extern phys_addr_t sleep_idmap_phys; ++struct sleep_save_sp sleep_save_sp; ++phys_addr_t sleep_idmap_phys; + + static int __init cpu_suspend_init(void) + { diff --git a/queue-3.18/btrfs-don-t-delay-inode-ref-updates-during-log-replay.patch b/queue-3.18/btrfs-don-t-delay-inode-ref-updates-during-log-replay.patch new file mode 100644 index 00000000000..2b256aeae78 --- /dev/null +++ b/queue-3.18/btrfs-don-t-delay-inode-ref-updates-during-log-replay.patch @@ -0,0 +1,50 @@ +From 6f8960541b1eb6054a642da48daae2320fddba93 Mon Sep 17 00:00:00 2001 +From: Chris Mason +Date: Wed, 31 Dec 2014 12:18:29 -0500 +Subject: Btrfs: don't delay inode ref updates during log replay + +From: Chris Mason + +commit 6f8960541b1eb6054a642da48daae2320fddba93 upstream. + +Commit 1d52c78afbb (Btrfs: try not to ENOSPC on log replay) added a +check to skip delayed inode updates during log replay because it +confuses the enospc code. But the delayed processing will end up +ignoring delayed refs from log replay because the inode itself wasn't +put through the delayed code. + +This can end up triggering a warning at commit time: + +WARNING: CPU: 2 PID: 778 at fs/btrfs/delayed-inode.c:1410 btrfs_assert_delayed_root_empty+0x32/0x34() + +Which is repeated for each commit because we never process the delayed +inode ref update. + +The fix used here is to change btrfs_delayed_delete_inode_ref to return +an error if we're currently in log replay. The caller will do the ref +deletion immediately and everything will work properly. + +Signed-off-by: Chris Mason +Signed-off-by: Greg Kroah-Hartman + +--- + fs/btrfs/delayed-inode.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/fs/btrfs/delayed-inode.c ++++ b/fs/btrfs/delayed-inode.c +@@ -1857,6 +1857,14 @@ int btrfs_delayed_delete_inode_ref(struc + { + struct btrfs_delayed_node *delayed_node; + ++ /* ++ * we don't do delayed inode updates during log recovery because it ++ * leads to enospc problems. This means we also can't do ++ * delayed inode refs ++ */ ++ if (BTRFS_I(inode)->root->fs_info->log_root_recovering) ++ return -EAGAIN; ++ + delayed_node = btrfs_get_or_create_delayed_node(inode); + if (IS_ERR(delayed_node)) + return PTR_ERR(delayed_node); diff --git a/queue-3.18/crypto-aesni-fix-by8-variant-for-128-bit-keys.patch b/queue-3.18/crypto-aesni-fix-by8-variant-for-128-bit-keys.patch new file mode 100644 index 00000000000..acde3838413 --- /dev/null +++ b/queue-3.18/crypto-aesni-fix-by8-variant-for-128-bit-keys.patch @@ -0,0 +1,156 @@ +From 0b1e95b2fa0934c3a08db483979c70d3b287f50e Mon Sep 17 00:00:00 2001 +From: Mathias Krause +Date: Tue, 30 Dec 2014 22:50:54 +0100 +Subject: crypto: aesni - fix "by8" variant for 128 bit keys + +From: Mathias Krause + +commit 0b1e95b2fa0934c3a08db483979c70d3b287f50e upstream. + +The "by8" counter mode optimization is broken for 128 bit keys with +input data longer than 128 bytes. It uses the wrong key material for +en- and decryption. + +The key registers xkey0, xkey4, xkey8 and xkey12 need to be preserved +in case we're handling more than 128 bytes of input data -- they won't +get reloaded after the initial load. They must therefore be (a) loaded +on the first iteration and (b) be preserved for the latter ones. The +implementation for 128 bit keys does not comply with (a) nor (b). + +Fix this by bringing the implementation back to its original source +and correctly load the key registers and preserve their values by +*not* re-using the registers for other purposes. + +Kudos to James for reporting the issue and providing a test case +showing the discrepancies. + +Reported-by: James Yonan +Cc: Chandramouli Narayanan +Signed-off-by: Mathias Krause +Signed-off-by: Herbert Xu +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/crypto/aes_ctrby8_avx-x86_64.S | 46 ++++++++++++++++++++++++-------- + 1 file changed, 35 insertions(+), 11 deletions(-) + +--- a/arch/x86/crypto/aes_ctrby8_avx-x86_64.S ++++ b/arch/x86/crypto/aes_ctrby8_avx-x86_64.S +@@ -208,7 +208,7 @@ ddq_add_8: + + .if (klen == KEY_128) + .if (load_keys) +- vmovdqa 3*16(p_keys), xkeyA ++ vmovdqa 3*16(p_keys), xkey4 + .endif + .else + vmovdqa 3*16(p_keys), xkeyA +@@ -224,7 +224,7 @@ ddq_add_8: + add $(16*by), p_in + + .if (klen == KEY_128) +- vmovdqa 4*16(p_keys), xkey4 ++ vmovdqa 4*16(p_keys), xkeyB + .else + .if (load_keys) + vmovdqa 4*16(p_keys), xkey4 +@@ -234,7 +234,12 @@ ddq_add_8: + .set i, 0 + .rept by + club XDATA, i +- vaesenc xkeyA, var_xdata, var_xdata /* key 3 */ ++ /* key 3 */ ++ .if (klen == KEY_128) ++ vaesenc xkey4, var_xdata, var_xdata ++ .else ++ vaesenc xkeyA, var_xdata, var_xdata ++ .endif + .set i, (i +1) + .endr + +@@ -243,13 +248,18 @@ ddq_add_8: + .set i, 0 + .rept by + club XDATA, i +- vaesenc xkey4, var_xdata, var_xdata /* key 4 */ ++ /* key 4 */ ++ .if (klen == KEY_128) ++ vaesenc xkeyB, var_xdata, var_xdata ++ .else ++ vaesenc xkey4, var_xdata, var_xdata ++ .endif + .set i, (i +1) + .endr + + .if (klen == KEY_128) + .if (load_keys) +- vmovdqa 6*16(p_keys), xkeyB ++ vmovdqa 6*16(p_keys), xkey8 + .endif + .else + vmovdqa 6*16(p_keys), xkeyB +@@ -267,12 +277,17 @@ ddq_add_8: + .set i, 0 + .rept by + club XDATA, i +- vaesenc xkeyB, var_xdata, var_xdata /* key 6 */ ++ /* key 6 */ ++ .if (klen == KEY_128) ++ vaesenc xkey8, var_xdata, var_xdata ++ .else ++ vaesenc xkeyB, var_xdata, var_xdata ++ .endif + .set i, (i +1) + .endr + + .if (klen == KEY_128) +- vmovdqa 8*16(p_keys), xkey8 ++ vmovdqa 8*16(p_keys), xkeyB + .else + .if (load_keys) + vmovdqa 8*16(p_keys), xkey8 +@@ -288,7 +303,7 @@ ddq_add_8: + + .if (klen == KEY_128) + .if (load_keys) +- vmovdqa 9*16(p_keys), xkeyA ++ vmovdqa 9*16(p_keys), xkey12 + .endif + .else + vmovdqa 9*16(p_keys), xkeyA +@@ -297,7 +312,12 @@ ddq_add_8: + .set i, 0 + .rept by + club XDATA, i +- vaesenc xkey8, var_xdata, var_xdata /* key 8 */ ++ /* key 8 */ ++ .if (klen == KEY_128) ++ vaesenc xkeyB, var_xdata, var_xdata ++ .else ++ vaesenc xkey8, var_xdata, var_xdata ++ .endif + .set i, (i +1) + .endr + +@@ -306,7 +326,12 @@ ddq_add_8: + .set i, 0 + .rept by + club XDATA, i +- vaesenc xkeyA, var_xdata, var_xdata /* key 9 */ ++ /* key 9 */ ++ .if (klen == KEY_128) ++ vaesenc xkey12, var_xdata, var_xdata ++ .else ++ vaesenc xkeyA, var_xdata, var_xdata ++ .endif + .set i, (i +1) + .endr + +@@ -412,7 +437,6 @@ ddq_add_8: + /* main body of aes ctr load */ + + .macro do_aes_ctrmain key_len +- + cmp $16, num_bytes + jb .Ldo_return2\key_len + diff --git a/queue-3.18/crypto-sha-mb-add-avx2_supported-check.patch b/queue-3.18/crypto-sha-mb-add-avx2_supported-check.patch new file mode 100644 index 00000000000..7d372c00633 --- /dev/null +++ b/queue-3.18/crypto-sha-mb-add-avx2_supported-check.patch @@ -0,0 +1,41 @@ +From 0b8c960cf6defc56b3aa1a71b5af95872b6dff2b Mon Sep 17 00:00:00 2001 +From: Vinson Lee +Date: Mon, 29 Dec 2014 16:20:39 -0800 +Subject: crypto: sha-mb - Add avx2_supported check. + +From: Vinson Lee + +commit 0b8c960cf6defc56b3aa1a71b5af95872b6dff2b upstream. + +This patch fixes this allyesconfig target build error with older +binutils. + + LD arch/x86/crypto/built-in.o +ld: arch/x86/crypto/sha-mb/built-in.o: No such file: No such file or directory + +Signed-off-by: Vinson Lee +Signed-off-by: Herbert Xu +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/crypto/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/x86/crypto/Makefile ++++ b/arch/x86/crypto/Makefile +@@ -26,7 +26,6 @@ obj-$(CONFIG_CRYPTO_GHASH_CLMUL_NI_INTEL + + obj-$(CONFIG_CRYPTO_CRC32C_INTEL) += crc32c-intel.o + obj-$(CONFIG_CRYPTO_SHA1_SSSE3) += sha1-ssse3.o +-obj-$(CONFIG_CRYPTO_SHA1_MB) += sha-mb/ + obj-$(CONFIG_CRYPTO_CRC32_PCLMUL) += crc32-pclmul.o + obj-$(CONFIG_CRYPTO_SHA256_SSSE3) += sha256-ssse3.o + obj-$(CONFIG_CRYPTO_SHA512_SSSE3) += sha512-ssse3.o +@@ -46,6 +45,7 @@ endif + ifeq ($(avx2_supported),yes) + obj-$(CONFIG_CRYPTO_CAMELLIA_AESNI_AVX2_X86_64) += camellia-aesni-avx2.o + obj-$(CONFIG_CRYPTO_SERPENT_AVX2_X86_64) += serpent-avx2.o ++ obj-$(CONFIG_CRYPTO_SHA1_MB) += sha-mb/ + endif + + aes-i586-y := aes-i586-asm_32.o aes_glue.o diff --git a/queue-3.18/input-alps-v7-fix-finger-counting-for-2-fingers-on-clickpads.patch b/queue-3.18/input-alps-v7-fix-finger-counting-for-2-fingers-on-clickpads.patch new file mode 100644 index 00000000000..c446809c783 --- /dev/null +++ b/queue-3.18/input-alps-v7-fix-finger-counting-for-2-fingers-on-clickpads.patch @@ -0,0 +1,69 @@ +From d27eb7931c98a1ebfc9b2fcc48939846bcbfc804 Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Thu, 18 Dec 2014 09:55:14 -0800 +Subject: Input: alps - v7: fix finger counting for > 2 fingers on clickpads + +From: Hans de Goede + +commit d27eb7931c98a1ebfc9b2fcc48939846bcbfc804 upstream. + +Protocol v7 uses the middle / right button bits on clickpads to communicate +"location" information of a 3th touch (and possible 4th) touch on +clickpads. + +Specifically when 3 touches are down, if one of the 3 touches is in the +left / right button area, this will get reported in the middle / right +button bits and the touchpad will still send a TWO type packet rather then +a MULTI type packet, so when this happens we must add the finger reported +in the button area to the finger count. + +Likewise we must also add fingers reported this way to the finger count +when we get MULTI packets. + +BugLink: https://bugs.freedesktop.org/show_bug.cgi?id=86338 +Signed-off-by: Hans de Goede +Tested-by: Benjamin Tissoires +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/input/mouse/alps.c | 16 ++++++++++++---- + 1 file changed, 12 insertions(+), 4 deletions(-) + +--- a/drivers/input/mouse/alps.c ++++ b/drivers/input/mouse/alps.c +@@ -933,6 +933,7 @@ static int alps_decode_packet_v7(struct + unsigned char *p, + struct psmouse *psmouse) + { ++ struct alps_data *priv = psmouse->private; + unsigned char pkt_id; + + pkt_id = alps_get_packet_id_v7(p); +@@ -963,15 +964,22 @@ static int alps_decode_packet_v7(struct + + alps_get_finger_coordinate_v7(f->mt, p, pkt_id); + +- f->left = (p[0] & 0x80) >> 7; +- f->right = (p[0] & 0x20) >> 5; +- f->middle = (p[0] & 0x10) >> 4; +- + if (pkt_id == V7_PACKET_ID_TWO) + f->fingers = alps_get_mt_count(f->mt); + else /* pkt_id == V7_PACKET_ID_MULTI */ + f->fingers = 3 + (p[5] & 0x03); + ++ f->left = (p[0] & 0x80) >> 7; ++ if (priv->flags & ALPS_BUTTONPAD) { ++ if (p[0] & 0x20) ++ f->fingers++; ++ if (p[0] & 0x10) ++ f->fingers++; ++ } else { ++ f->right = (p[0] & 0x20) >> 5; ++ f->middle = (p[0] & 0x10) >> 4; ++ } ++ + /* Sometimes a single touch is reported in mt[1] rather then mt[0] */ + if (f->fingers == 1 && f->mt[0].x == 0 && f->mt[0].y == 0) { + f->mt[0].x = f->mt[1].x; diff --git a/queue-3.18/input-alps-v7-ignore-new-packets.patch b/queue-3.18/input-alps-v7-ignore-new-packets.patch new file mode 100644 index 00000000000..87bef974c91 --- /dev/null +++ b/queue-3.18/input-alps-v7-ignore-new-packets.patch @@ -0,0 +1,81 @@ +From 8b23811535d2e1dd6abbe4ce6ea1edfd50ce72de Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Thu, 18 Dec 2014 09:52:59 -0800 +Subject: Input: alps - v7: ignore new packets + +From: Hans de Goede + +commit 8b23811535d2e1dd6abbe4ce6ea1edfd50ce72de upstream. + +NEW packets are send to indicate a discontinuity in the finger coordinate +reporting. Specifically a finger may have moved from slot 0 to 1 or vice +versa. INPUT_MT_TRACK takes care of this for us. + +NEW packets have 3 problems: +1) They do not contain middle / right button info (on non clickpads) + this can be worked around by preserving the old button state +2) They do not contain an accurate fingercount, and they are + typically send when the number of fingers changes. We cannot use + the old finger count as that may mismatch with the amount of + touch coordinates we've available in the NEW packet +3) Their x data for the second touch is inaccurate leading to + a possible jump of the x coordinate by 16 units when the first + non NEW packet comes in + +Since problems 2 & 3 cannot be worked around, just ignore them. + +BugLink: https://bugs.freedesktop.org/show_bug.cgi?id=86338 +Signed-off-by: Hans de Goede +Tested-by: Benjamin Tissoires +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/input/mouse/alps.c | 30 ++++++++++++++++++++++++------ + 1 file changed, 24 insertions(+), 6 deletions(-) + +--- a/drivers/input/mouse/alps.c ++++ b/drivers/input/mouse/alps.c +@@ -938,18 +938,36 @@ static int alps_decode_packet_v7(struct + return 0; + if (pkt_id == V7_PACKET_ID_UNKNOWN) + return -1; ++ /* ++ * NEW packets are send to indicate a discontinuity in the finger ++ * coordinate reporting. Specifically a finger may have moved from ++ * slot 0 to 1 or vice versa. INPUT_MT_TRACK takes care of this for ++ * us. ++ * ++ * NEW packets have 3 problems: ++ * 1) They do not contain middle / right button info (on non clickpads) ++ * this can be worked around by preserving the old button state ++ * 2) They do not contain an accurate fingercount, and they are ++ * typically send when the number of fingers changes. We cannot use ++ * the old finger count as that may mismatch with the amount of ++ * touch coordinates we've available in the NEW packet ++ * 3) Their x data for the second touch is inaccurate leading to ++ * a possible jump of the x coordinate by 16 units when the first ++ * non NEW packet comes in ++ * Since problems 2 & 3 cannot be worked around, just ignore them. ++ */ ++ if (pkt_id == V7_PACKET_ID_NEW) ++ return 1; + + alps_get_finger_coordinate_v7(f->mt, p, pkt_id); + +- if (pkt_id == V7_PACKET_ID_TWO || pkt_id == V7_PACKET_ID_MULTI) { +- f->left = (p[0] & 0x80) >> 7; +- f->right = (p[0] & 0x20) >> 5; +- f->middle = (p[0] & 0x10) >> 4; +- } ++ f->left = (p[0] & 0x80) >> 7; ++ f->right = (p[0] & 0x20) >> 5; ++ f->middle = (p[0] & 0x10) >> 4; + + if (pkt_id == V7_PACKET_ID_TWO) + f->fingers = alps_get_mt_count(f->mt); +- else if (pkt_id == V7_PACKET_ID_MULTI) ++ else /* pkt_id == V7_PACKET_ID_MULTI */ + f->fingers = 3 + (p[5] & 0x03); + + return 0; diff --git a/queue-3.18/input-alps-v7-sometimes-a-single-touch-is-reported-in-mt.patch b/queue-3.18/input-alps-v7-sometimes-a-single-touch-is-reported-in-mt.patch new file mode 100644 index 00000000000..192a1b7515c --- /dev/null +++ b/queue-3.18/input-alps-v7-sometimes-a-single-touch-is-reported-in-mt.patch @@ -0,0 +1,64 @@ +From 7091c443dda8c6c6d8e70e33452252f9ad3e7814 Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Thu, 18 Dec 2014 09:53:34 -0800 +Subject: Input: alps - v7: sometimes a single touch is reported in mt[1] + +From: Hans de Goede + +commit 7091c443dda8c6c6d8e70e33452252f9ad3e7814 upstream. + +The v7 proto differentiates between a primary touch (with high precision) +and a secondary touch (with lower precision). Normally when 2 fingers are +down and one is lifted the still present touch becomes the primary touch, +but some traces have shown that this does not happen always. + +This commit deals with this by making alps_get_mt_count() not stop at the +first empty mt slot, and if a touch is present in mt[1] and not mt[0] +moving the data to mt[0] (for input_mt_assign_slots). + +BugLink: https://bugs.freedesktop.org/show_bug.cgi?id=86338 +Signed-off-by: Hans de Goede +Tested-by: Benjamin Tissoires +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/input/mouse/alps.c | 18 ++++++++++++++---- + 1 file changed, 14 insertions(+), 4 deletions(-) + +--- a/drivers/input/mouse/alps.c ++++ b/drivers/input/mouse/alps.c +@@ -919,12 +919,14 @@ static void alps_get_finger_coordinate_v + + static int alps_get_mt_count(struct input_mt_pos *mt) + { +- int i; ++ int i, fingers = 0; + +- for (i = 0; i < MAX_TOUCHES && mt[i].x != 0 && mt[i].y != 0; i++) +- /* empty */; ++ for (i = 0; i < MAX_TOUCHES; i++) { ++ if (mt[i].x != 0 || mt[i].y != 0) ++ fingers++; ++ } + +- return i; ++ return fingers; + } + + static int alps_decode_packet_v7(struct alps_fields *f, +@@ -970,6 +972,14 @@ static int alps_decode_packet_v7(struct + else /* pkt_id == V7_PACKET_ID_MULTI */ + f->fingers = 3 + (p[5] & 0x03); + ++ /* Sometimes a single touch is reported in mt[1] rather then mt[0] */ ++ if (f->fingers == 1 && f->mt[0].x == 0 && f->mt[0].y == 0) { ++ f->mt[0].x = f->mt[1].x; ++ f->mt[0].y = f->mt[1].y; ++ f->mt[1].x = 0; ++ f->mt[1].y = 0; ++ } ++ + return 0; + } + diff --git a/queue-3.18/perf-fix-events-installation-during-moving-group.patch b/queue-3.18/perf-fix-events-installation-during-moving-group.patch new file mode 100644 index 00000000000..b81039dff58 --- /dev/null +++ b/queue-3.18/perf-fix-events-installation-during-moving-group.patch @@ -0,0 +1,76 @@ +From 9fc81d87420d0d3fd62d5e5529972c0ad9eab9cc Mon Sep 17 00:00:00 2001 +From: Jiri Olsa +Date: Wed, 10 Dec 2014 21:23:51 +0100 +Subject: perf: Fix events installation during moving group + +From: Jiri Olsa + +commit 9fc81d87420d0d3fd62d5e5529972c0ad9eab9cc upstream. + +We allow PMU driver to change the cpu on which the event +should be installed to. This happened in patch: + + e2d37cd213dc ("perf: Allow the PMU driver to choose the CPU on which to install events") + +This patch also forces all the group members to follow +the currently opened events cpu if the group happened +to be moved. + +This and the change of event->cpu in perf_install_in_context() +function introduced in: + + 0cda4c023132 ("perf: Introduce perf_pmu_migrate_context()") + +forces group members to change their event->cpu, +if the currently-opened-event's PMU changed the cpu +and there is a group move. + +Above behaviour causes problem for breakpoint events, +which uses event->cpu to touch cpu specific data for +breakpoints accounting. By changing event->cpu, some +breakpoints slots were wrongly accounted for given +cpu. + +Vinces's perf fuzzer hit this issue and caused following +WARN on my setup: + + WARNING: CPU: 0 PID: 20214 at arch/x86/kernel/hw_breakpoint.c:119 arch_install_hw_breakpoint+0x142/0x150() + Can't find any breakpoint slot + [...] + +This patch changes the group moving code to keep the event's +original cpu. + +Reported-by: Vince Weaver +Signed-off-by: Jiri Olsa +Cc: Arnaldo Carvalho de Melo +Cc: Frederic Weisbecker +Cc: Linus Torvalds +Cc: Peter Zijlstra +Cc: Stephane Eranian +Cc: Vince Weaver +Cc: Yan, Zheng +Link: http://lkml.kernel.org/r/1418243031-20367-3-git-send-email-jolsa@kernel.org +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/events/core.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/kernel/events/core.c ++++ b/kernel/events/core.c +@@ -7435,11 +7435,11 @@ SYSCALL_DEFINE5(perf_event_open, + + if (move_group) { + synchronize_rcu(); +- perf_install_in_context(ctx, group_leader, event->cpu); ++ perf_install_in_context(ctx, group_leader, group_leader->cpu); + get_ctx(ctx); + list_for_each_entry(sibling, &group_leader->sibling_list, + group_entry) { +- perf_install_in_context(ctx, sibling, event->cpu); ++ perf_install_in_context(ctx, sibling, sibling->cpu); + get_ctx(ctx); + } + } diff --git a/queue-3.18/perf-session-do-not-fail-on-processing-out-of-order-event.patch b/queue-3.18/perf-session-do-not-fail-on-processing-out-of-order-event.patch new file mode 100644 index 00000000000..b227b96b471 --- /dev/null +++ b/queue-3.18/perf-session-do-not-fail-on-processing-out-of-order-event.patch @@ -0,0 +1,88 @@ +From f61ff6c06dc8f32c7036013ad802c899ec590607 Mon Sep 17 00:00:00 2001 +From: Jiri Olsa +Date: Wed, 26 Nov 2014 16:39:31 +0100 +Subject: perf session: Do not fail on processing out of order event + +From: Jiri Olsa + +commit f61ff6c06dc8f32c7036013ad802c899ec590607 upstream. + +Linus reported perf report command being interrupted due to processing +of 'out of order' event, with following error: + + Timestamp below last timeslice flush + 0x5733a8 [0x28]: failed to process type: 3 + +I could reproduce the issue and in my case it was caused by one CPU +(mmap) being behind during record and userspace mmap reader seeing the +data after other CPUs data were already stored. + +This is expected under some circumstances because we need to limit the +number of events that we queue for reordering when we receive a +PERF_RECORD_FINISHED_ROUND or when we force flush due to memory +pressure. + +Reported-by: Linus Torvalds +Signed-off-by: Jiri Olsa +Acked-by: Ingo Molnar +Cc: Andi Kleen +Cc: Corey Ashford +Cc: David Ahern +Cc: Frederic Weisbecker +Cc: Ingo Molnar +Cc: Linus Torvalds +Cc: Matt Fleming +Cc: Namhyung Kim +Cc: Paul Mackerras +Cc: Peter Zijlstra +Cc: Stephane Eranian +Link: http://lkml.kernel.org/r/1417016371-30249-1-git-send-email-jolsa@kernel.org +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Zhiqiang Zhang +Signed-off-by: Greg Kroah-Hartman + +--- + tools/perf/util/event.h | 1 + + tools/perf/util/session.c | 11 +++++------ + 2 files changed, 6 insertions(+), 6 deletions(-) + +--- a/tools/perf/util/event.h ++++ b/tools/perf/util/event.h +@@ -214,6 +214,7 @@ struct events_stats { + u32 nr_invalid_chains; + u32 nr_unknown_id; + u32 nr_unprocessable_samples; ++ u32 nr_unordered_events; + }; + + struct attr_event { +--- a/tools/perf/util/session.c ++++ b/tools/perf/util/session.c +@@ -521,15 +521,11 @@ int perf_session_queue_event(struct perf + return -ETIME; + + if (timestamp < oe->last_flush) { +- WARN_ONCE(1, "Timestamp below last timeslice flush\n"); +- +- pr_oe_time(timestamp, "out of order event"); ++ pr_oe_time(timestamp, "out of order event\n"); + pr_oe_time(oe->last_flush, "last flush, last_flush_type %d\n", + oe->last_flush_type); + +- /* We could get out of order messages after forced flush. */ +- if (oe->last_flush_type != OE_FLUSH__HALF) +- return -EINVAL; ++ s->stats.nr_unordered_events++; + } + + new = ordered_events__new(oe, timestamp, event); +@@ -1057,6 +1053,9 @@ static void perf_session__warn_about_err + "Do you have a KVM guest running and not using 'perf kvm'?\n", + session->stats.nr_unprocessable_samples); + } ++ ++ if (session->stats.nr_unordered_events != 0) ++ ui__warning("%u out of order events recorded.\n", session->stats.nr_unordered_events); + } + + volatile int session_done; diff --git a/queue-3.18/perf-x86-intel-uncore-make-sure-only-uncore-events-are-collected.patch b/queue-3.18/perf-x86-intel-uncore-make-sure-only-uncore-events-are-collected.patch new file mode 100644 index 00000000000..4c2741fb285 --- /dev/null +++ b/queue-3.18/perf-x86-intel-uncore-make-sure-only-uncore-events-are-collected.patch @@ -0,0 +1,89 @@ +From af91568e762d04931dcbdd6bef4655433d8b9418 Mon Sep 17 00:00:00 2001 +From: Jiri Olsa +Date: Wed, 10 Dec 2014 21:23:50 +0100 +Subject: perf/x86/intel/uncore: Make sure only uncore events are collected + +From: Jiri Olsa + +commit af91568e762d04931dcbdd6bef4655433d8b9418 upstream. + +The uncore_collect_events functions assumes that event group +might contain only uncore events which is wrong, because it +might contain any type of events. + +This bug leads to uncore framework touching 'not' uncore events, +which could end up all sorts of bugs. + +One was triggered by Vince's perf fuzzer, when the uncore code +touched breakpoint event private event space as if it was uncore +event and caused BUG: + + BUG: unable to handle kernel paging request at ffffffff82822068 + IP: [] uncore_assign_events+0x188/0x250 + ... + +The code in uncore_assign_events() function was looking for +event->hw.idx data while the event was initialized as a +breakpoint with different members in event->hw union. + +This patch forces uncore_collect_events() to collect only uncore +events. + +Reported-by: Vince Weaver +Signed-off-by: Jiri Olsa +Cc: Arnaldo Carvalho de Melo +Cc: Frederic Weisbecker +Cc: Linus Torvalds +Cc: Peter Zijlstra +Cc: Stephane Eranian +Cc: Yan, Zheng +Link: http://lkml.kernel.org/r/1418243031-20367-2-git-send-email-jolsa@kernel.org +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/cpu/perf_event_intel_uncore.c | 22 +++++++++++++++++++--- + 1 file changed, 19 insertions(+), 3 deletions(-) + +--- a/arch/x86/kernel/cpu/perf_event_intel_uncore.c ++++ b/arch/x86/kernel/cpu/perf_event_intel_uncore.c +@@ -276,6 +276,17 @@ static struct intel_uncore_box *uncore_a + return box; + } + ++/* ++ * Using uncore_pmu_event_init pmu event_init callback ++ * as a detection point for uncore events. ++ */ ++static int uncore_pmu_event_init(struct perf_event *event); ++ ++static bool is_uncore_event(struct perf_event *event) ++{ ++ return event->pmu->event_init == uncore_pmu_event_init; ++} ++ + static int + uncore_collect_events(struct intel_uncore_box *box, struct perf_event *leader, bool dogrp) + { +@@ -290,13 +301,18 @@ uncore_collect_events(struct intel_uncor + return -EINVAL; + + n = box->n_events; +- box->event_list[n] = leader; +- n++; ++ ++ if (is_uncore_event(leader)) { ++ box->event_list[n] = leader; ++ n++; ++ } ++ + if (!dogrp) + return n; + + list_for_each_entry(event, &leader->sibling_list, group_entry) { +- if (event->state <= PERF_EVENT_STATE_OFF) ++ if (!is_uncore_event(event) || ++ event->state <= PERF_EVENT_STATE_OFF) + continue; + + if (n >= max_count) diff --git a/queue-3.18/perf-x86-uncore-hsw-ep-handle-systems-with-only-two-sboxes.patch b/queue-3.18/perf-x86-uncore-hsw-ep-handle-systems-with-only-two-sboxes.patch new file mode 100644 index 00000000000..a02b07102e2 --- /dev/null +++ b/queue-3.18/perf-x86-uncore-hsw-ep-handle-systems-with-only-two-sboxes.patch @@ -0,0 +1,86 @@ +From 5306c31c5733cb4a79cc002e0c3ad256fd439614 Mon Sep 17 00:00:00 2001 +From: Andi Kleen +Date: Tue, 6 Jan 2015 14:34:35 -0800 +Subject: perf/x86/uncore/hsw-ep: Handle systems with only two SBOXes + +From: Andi Kleen + +commit 5306c31c5733cb4a79cc002e0c3ad256fd439614 upstream. + +There was another report of a boot failure with a #GP fault in the +uncore SBOX initialization. The earlier work around was not enough +for this system. + +The boot was failing while trying to initialize the third SBOX. + +This patch detects parts with only two SBOXes and limits the number +of SBOX units to two there. + +Stable material, as it affects boot problems on 3.18. + +Tested-by: Andreas Oehler +Signed-off-by: Andi Kleen +Signed-off-by: Peter Zijlstra (Intel) +Cc: Arnaldo Carvalho de Melo +Cc: Stephane Eranian +Cc: Yan, Zheng +Link: http://lkml.kernel.org/r/1420583675-9163-1-git-send-email-andi@firstfloor.org +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/cpu/perf_event_intel_uncore.h | 2 +- + arch/x86/kernel/cpu/perf_event_intel_uncore_snbep.c | 17 +++++++++++++++++ + 2 files changed, 18 insertions(+), 1 deletion(-) + +--- a/arch/x86/kernel/cpu/perf_event_intel_uncore.h ++++ b/arch/x86/kernel/cpu/perf_event_intel_uncore.h +@@ -17,7 +17,7 @@ + #define UNCORE_PCI_DEV_TYPE(data) ((data >> 8) & 0xff) + #define UNCORE_PCI_DEV_IDX(data) (data & 0xff) + #define UNCORE_EXTRA_PCI_DEV 0xff +-#define UNCORE_EXTRA_PCI_DEV_MAX 2 ++#define UNCORE_EXTRA_PCI_DEV_MAX 3 + + /* support up to 8 sockets */ + #define UNCORE_SOCKET_MAX 8 +--- a/arch/x86/kernel/cpu/perf_event_intel_uncore_snbep.c ++++ b/arch/x86/kernel/cpu/perf_event_intel_uncore_snbep.c +@@ -887,6 +887,7 @@ void snbep_uncore_cpu_init(void) + enum { + SNBEP_PCI_QPI_PORT0_FILTER, + SNBEP_PCI_QPI_PORT1_FILTER, ++ HSWEP_PCI_PCU_3, + }; + + static int snbep_qpi_hw_config(struct intel_uncore_box *box, struct perf_event *event) +@@ -2022,6 +2023,17 @@ void hswep_uncore_cpu_init(void) + { + if (hswep_uncore_cbox.num_boxes > boot_cpu_data.x86_max_cores) + hswep_uncore_cbox.num_boxes = boot_cpu_data.x86_max_cores; ++ ++ /* Detect 6-8 core systems with only two SBOXes */ ++ if (uncore_extra_pci_dev[0][HSWEP_PCI_PCU_3]) { ++ u32 capid4; ++ ++ pci_read_config_dword(uncore_extra_pci_dev[0][HSWEP_PCI_PCU_3], ++ 0x94, &capid4); ++ if (((capid4 >> 6) & 0x3) == 0) ++ hswep_uncore_sbox.num_boxes = 2; ++ } ++ + uncore_msr_uncores = hswep_msr_uncores; + } + +@@ -2279,6 +2291,11 @@ static DEFINE_PCI_DEVICE_TABLE(hswep_unc + .driver_data = UNCORE_PCI_DEV_DATA(UNCORE_EXTRA_PCI_DEV, + SNBEP_PCI_QPI_PORT1_FILTER), + }, ++ { /* PCU.3 (for Capability registers) */ ++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x2fc0), ++ .driver_data = UNCORE_PCI_DEV_DATA(UNCORE_EXTRA_PCI_DEV, ++ HSWEP_PCI_PCU_3), ++ }, + { /* end: all zeroes */ } + }; + diff --git a/queue-3.18/revert-input-atmel_mxt_ts-use-deep-sleep-mode-when-stopped.patch b/queue-3.18/revert-input-atmel_mxt_ts-use-deep-sleep-mode-when-stopped.patch new file mode 100644 index 00000000000..69c161ef0dd --- /dev/null +++ b/queue-3.18/revert-input-atmel_mxt_ts-use-deep-sleep-mode-when-stopped.patch @@ -0,0 +1,187 @@ +From 7f4054836d811c650c51f9c93088f8ebd61b0020 Mon Sep 17 00:00:00 2001 +From: Linus Torvalds +Date: Wed, 31 Dec 2014 12:59:34 -0800 +Subject: Revert "Input: atmel_mxt_ts - use deep sleep mode when stopped" + +From: Linus Torvalds + +commit 7f4054836d811c650c51f9c93088f8ebd61b0020 upstream. + +This reverts commit 9d469d033d135d80742a4e39e6bbb4519dd5eee1. + +It breaks the Chromebook Pixel touchpad (and touchscreen). + +Reported-by: Dirk Hohndel +Bisected-by: Linus Torvalds +Cc: Nick Dyer +Cc: Benson Leung +Cc: Yufeng Shen +Cc: Dmitry Torokhov +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/input/touchscreen/atmel_mxt_ts.c | 99 ++++++++----------------------- + 1 file changed, 26 insertions(+), 73 deletions(-) + +--- a/drivers/input/touchscreen/atmel_mxt_ts.c ++++ b/drivers/input/touchscreen/atmel_mxt_ts.c +@@ -99,13 +99,9 @@ + #define MXT_T6_STATUS_COMSERR (1 << 2) + + /* MXT_GEN_POWER_T7 field */ +-struct t7_config { +- u8 idle; +- u8 active; +-} __packed; +- +-#define MXT_POWER_CFG_RUN 0 +-#define MXT_POWER_CFG_DEEPSLEEP 1 ++#define MXT_POWER_IDLEACQINT 0 ++#define MXT_POWER_ACTVACQINT 1 ++#define MXT_POWER_ACTV2IDLETO 2 + + /* MXT_GEN_ACQUIRE_T8 field */ + #define MXT_ACQUIRE_CHRGTIME 0 +@@ -117,6 +113,7 @@ struct t7_config { + #define MXT_ACQUIRE_ATCHCALSTHR 7 + + /* MXT_TOUCH_MULTI_T9 field */ ++#define MXT_TOUCH_CTRL 0 + #define MXT_T9_ORIENT 9 + #define MXT_T9_RANGE 18 + +@@ -256,7 +253,6 @@ struct mxt_data { + bool update_input; + u8 last_message_count; + u8 num_touchids; +- struct t7_config t7_cfg; + + /* Cached parameters from object table */ + u16 T5_address; +@@ -672,6 +668,20 @@ static void mxt_proc_t6_messages(struct + data->t6_status = status; + } + ++static int mxt_write_object(struct mxt_data *data, ++ u8 type, u8 offset, u8 val) ++{ ++ struct mxt_object *object; ++ u16 reg; ++ ++ object = mxt_get_object(data, type); ++ if (!object || offset >= mxt_obj_size(object)) ++ return -EINVAL; ++ ++ reg = object->start_address; ++ return mxt_write_reg(data->client, reg + offset, val); ++} ++ + static void mxt_input_button(struct mxt_data *data, u8 *message) + { + struct input_dev *input = data->input_dev; +@@ -1742,60 +1752,6 @@ err_free_object_table: + return error; + } + +-static int mxt_set_t7_power_cfg(struct mxt_data *data, u8 sleep) +-{ +- struct device *dev = &data->client->dev; +- int error; +- struct t7_config *new_config; +- struct t7_config deepsleep = { .active = 0, .idle = 0 }; +- +- if (sleep == MXT_POWER_CFG_DEEPSLEEP) +- new_config = &deepsleep; +- else +- new_config = &data->t7_cfg; +- +- error = __mxt_write_reg(data->client, data->T7_address, +- sizeof(data->t7_cfg), new_config); +- if (error) +- return error; +- +- dev_dbg(dev, "Set T7 ACTV:%d IDLE:%d\n", +- new_config->active, new_config->idle); +- +- return 0; +-} +- +-static int mxt_init_t7_power_cfg(struct mxt_data *data) +-{ +- struct device *dev = &data->client->dev; +- int error; +- bool retry = false; +- +-recheck: +- error = __mxt_read_reg(data->client, data->T7_address, +- sizeof(data->t7_cfg), &data->t7_cfg); +- if (error) +- return error; +- +- if (data->t7_cfg.active == 0 || data->t7_cfg.idle == 0) { +- if (!retry) { +- dev_dbg(dev, "T7 cfg zero, resetting\n"); +- mxt_soft_reset(data); +- retry = true; +- goto recheck; +- } else { +- dev_dbg(dev, "T7 cfg zero after reset, overriding\n"); +- data->t7_cfg.active = 20; +- data->t7_cfg.idle = 100; +- return mxt_set_t7_power_cfg(data, MXT_POWER_CFG_RUN); +- } +- } +- +- dev_dbg(dev, "Initialized power cfg: ACTV %d, IDLE %d\n", +- data->t7_cfg.active, data->t7_cfg.idle); +- return 0; +-} +- + static int mxt_configure_objects(struct mxt_data *data, + const struct firmware *cfg) + { +@@ -1809,12 +1765,6 @@ static int mxt_configure_objects(struct + dev_warn(dev, "Error %d updating config\n", error); + } + +- error = mxt_init_t7_power_cfg(data); +- if (error) { +- dev_err(dev, "Failed to initialize power cfg\n"); +- return error; +- } +- + error = mxt_initialize_t9_input_device(data); + if (error) + return error; +@@ -2093,15 +2043,16 @@ static const struct attribute_group mxt_ + + static void mxt_start(struct mxt_data *data) + { +- mxt_set_t7_power_cfg(data, MXT_POWER_CFG_RUN); +- +- /* Recalibrate since chip has been in deep sleep */ +- mxt_t6_command(data, MXT_COMMAND_CALIBRATE, 1, false); ++ /* Touch enable */ ++ mxt_write_object(data, ++ MXT_TOUCH_MULTI_T9, MXT_TOUCH_CTRL, 0x83); + } + + static void mxt_stop(struct mxt_data *data) + { +- mxt_set_t7_power_cfg(data, MXT_POWER_CFG_DEEPSLEEP); ++ /* Touch disable */ ++ mxt_write_object(data, ++ MXT_TOUCH_MULTI_T9, MXT_TOUCH_CTRL, 0); + } + + static int mxt_input_open(struct input_dev *dev) +@@ -2267,6 +2218,8 @@ static int mxt_resume(struct device *dev + struct mxt_data *data = i2c_get_clientdata(client); + struct input_dev *input_dev = data->input_dev; + ++ mxt_soft_reset(data); ++ + mutex_lock(&input_dev->mutex); + + if (input_dev->users) diff --git a/queue-3.18/revert-mac80211-fix-accounting-of-the-tailroom-needed-counter.patch b/queue-3.18/revert-mac80211-fix-accounting-of-the-tailroom-needed-counter.patch new file mode 100644 index 00000000000..75bfd71c6af --- /dev/null +++ b/queue-3.18/revert-mac80211-fix-accounting-of-the-tailroom-needed-counter.patch @@ -0,0 +1,88 @@ +From 1e359a5de861a57aa04d92bb620f52a5c1d7f8b1 Mon Sep 17 00:00:00 2001 +From: Johannes Berg +Date: Mon, 5 Jan 2015 10:28:49 +0100 +Subject: Revert "mac80211: Fix accounting of the tailroom-needed counter" + +From: Johannes Berg + +commit 1e359a5de861a57aa04d92bb620f52a5c1d7f8b1 upstream. + +This reverts commit ca34e3b5c808385b175650605faa29e71e91991b. + +It turns out that the p54 and cw2100 drivers assume that there's +tailroom even when they don't say they really need it. However, +there's currently no way for them to explicitly say they do need +it, so for now revert this. + +This fixes https://bugzilla.kernel.org/show_bug.cgi?id=90331. + +Fixes: ca34e3b5c808 ("mac80211: Fix accounting of the tailroom-needed counter") +Reported-by: Christopher Chavez +Bisected-by: Larry Finger +Debugged-by: Christian Lamparter +Signed-off-by: Johannes Berg +Signed-off-by: Greg Kroah-Hartman + +--- + include/net/mac80211.h | 7 ++----- + net/mac80211/key.c | 12 +++++++++--- + 2 files changed, 11 insertions(+), 8 deletions(-) + +--- a/include/net/mac80211.h ++++ b/include/net/mac80211.h +@@ -1227,8 +1227,7 @@ struct ieee80211_vif *wdev_to_ieee80211_ + * + * @IEEE80211_KEY_FLAG_GENERATE_IV: This flag should be set by the + * driver to indicate that it requires IV generation for this +- * particular key. Setting this flag does not necessarily mean that SKBs +- * will have sufficient tailroom for ICV or MIC. ++ * particular key. + * @IEEE80211_KEY_FLAG_GENERATE_MMIC: This flag should be set by + * the driver for a TKIP key if it requires Michael MIC + * generation in software. +@@ -1240,9 +1239,7 @@ struct ieee80211_vif *wdev_to_ieee80211_ + * @IEEE80211_KEY_FLAG_PUT_IV_SPACE: This flag should be set by the driver + * if space should be prepared for the IV, but the IV + * itself should not be generated. Do not set together with +- * @IEEE80211_KEY_FLAG_GENERATE_IV on the same key. Setting this flag does +- * not necessarily mean that SKBs will have sufficient tailroom for ICV or +- * MIC. ++ * @IEEE80211_KEY_FLAG_GENERATE_IV on the same key. + * @IEEE80211_KEY_FLAG_RX_MGMT: This key will be used to decrypt received + * management frames. The flag can help drivers that have a hardware + * crypto implementation that doesn't deal with management frames +--- a/net/mac80211/key.c ++++ b/net/mac80211/key.c +@@ -131,7 +131,9 @@ static int ieee80211_key_enable_hw_accel + if (!ret) { + key->flags |= KEY_FLAG_UPLOADED_TO_HARDWARE; + +- if (!(key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_MMIC)) ++ if (!((key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_MMIC) || ++ (key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_IV) || ++ (key->conf.flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE))) + sdata->crypto_tx_tailroom_needed_cnt--; + + WARN_ON((key->conf.flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE) && +@@ -179,7 +181,9 @@ static void ieee80211_key_disable_hw_acc + sta = key->sta; + sdata = key->sdata; + +- if (!(key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_MMIC)) ++ if (!((key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_MMIC) || ++ (key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_IV) || ++ (key->conf.flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE))) + increment_tailroom_need_count(sdata); + + ret = drv_set_key(key->local, DISABLE_KEY, sdata, +@@ -875,7 +879,9 @@ void ieee80211_remove_key(struct ieee802 + if (key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE) { + key->flags &= ~KEY_FLAG_UPLOADED_TO_HARDWARE; + +- if (!(key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_MMIC)) ++ if (!((key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_MMIC) || ++ (key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_IV) || ++ (key->conf.flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE))) + increment_tailroom_need_count(key->sdata); + } + diff --git a/queue-3.18/rpc-fix-xdr_truncate_encode-to-handle-buffer-ending-on-page-boundary.patch b/queue-3.18/rpc-fix-xdr_truncate_encode-to-handle-buffer-ending-on-page-boundary.patch new file mode 100644 index 00000000000..882ac44f8c3 --- /dev/null +++ b/queue-3.18/rpc-fix-xdr_truncate_encode-to-handle-buffer-ending-on-page-boundary.patch @@ -0,0 +1,55 @@ +From 49a068f82a1d30eb585d7804b05948376be6cf9a Mon Sep 17 00:00:00 2001 +From: "J. Bruce Fields" +Date: Mon, 22 Dec 2014 16:14:51 -0500 +Subject: rpc: fix xdr_truncate_encode to handle buffer ending on page boundary +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: "J. Bruce Fields" + +commit 49a068f82a1d30eb585d7804b05948376be6cf9a upstream. + +A struct xdr_stream at a page boundary might point to the end of one +page or the beginning of the next, but xdr_truncate_encode isn't +prepared to handle the former. + +This can cause corruption of NFSv4 READDIR replies in the case that a +readdir entry that would have exceeded the client's dircount/maxcount +limit would have ended exactly on a 4k page boundary. You're more +likely to hit this case on large directories. + +Other xdr_truncate_encode callers are probably also affected. + +Reported-by: Holger Hoffstätte +Tested-by: Holger Hoffstätte +Fixes: 3e19ce762b53 "rpc: xdr_truncate_encode" +Signed-off-by: J. Bruce Fields +Signed-off-by: Greg Kroah-Hartman + +--- + net/sunrpc/xdr.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/net/sunrpc/xdr.c ++++ b/net/sunrpc/xdr.c +@@ -606,7 +606,7 @@ void xdr_truncate_encode(struct xdr_stre + struct kvec *head = buf->head; + struct kvec *tail = buf->tail; + int fraglen; +- int new, old; ++ int new; + + if (len > buf->len) { + WARN_ON_ONCE(1); +@@ -628,8 +628,8 @@ void xdr_truncate_encode(struct xdr_stre + buf->len -= fraglen; + + new = buf->page_base + buf->page_len; +- old = new + fraglen; +- xdr->page_ptr -= (old >> PAGE_SHIFT) - (new >> PAGE_SHIFT); ++ ++ xdr->page_ptr = buf->pages + (new >> PAGE_SHIFT); + + if (buf->page_len && buf->len == len) { + xdr->p = page_address(*xdr->page_ptr); diff --git a/queue-3.18/series b/queue-3.18/series index 0af56d2e8c6..8151e69ae55 100644 --- a/queue-3.18/series +++ b/queue-3.18/series @@ -120,3 +120,21 @@ arm-dts-dra7-wdt-fix-compatible-property-for-watchdog.patch arm-dts-enable-pwm-node-by-default-for-s3c64xx.patch arm-omap4-pm-only-do-static-dependency-configuration-in-omap4_init_static_deps.patch revert-arm-7830-1-delay-don-t-bother-reporting-bogomips-in-proc-cpuinfo.patch +rpc-fix-xdr_truncate_encode-to-handle-buffer-ending-on-page-boundary.patch +acpi-video-add-some-samsung-models-to-disable_native_backlight-list.patch +acpi-pm-fix-pm-initialization-for-devices-that-are-not-present.patch +revert-input-atmel_mxt_ts-use-deep-sleep-mode-when-stopped.patch +input-alps-v7-ignore-new-packets.patch +input-alps-v7-sometimes-a-single-touch-is-reported-in-mt.patch +input-alps-v7-fix-finger-counting-for-2-fingers-on-clickpads.patch +arm64-move-cpu_resume-into-the-text-section.patch +arm64-kernel-fix-__cpu_suspend-mm-switch-on-warm-boot.patch +arm64-efi-add-missing-call-to-early_ioremap_reset.patch +crypto-sha-mb-add-avx2_supported-check.patch +crypto-aesni-fix-by8-variant-for-128-bit-keys.patch +btrfs-don-t-delay-inode-ref-updates-during-log-replay.patch +revert-mac80211-fix-accounting-of-the-tailroom-needed-counter.patch +perf-x86-intel-uncore-make-sure-only-uncore-events-are-collected.patch +perf-fix-events-installation-during-moving-group.patch +perf-x86-uncore-hsw-ep-handle-systems-with-only-two-sboxes.patch +perf-session-do-not-fail-on-processing-out-of-order-event.patch