From: Greg Kroah-Hartman Date: Sun, 20 Apr 2014 20:02:26 +0000 (-0700) Subject: 3.14-stable patches X-Git-Tag: v3.13.11~11 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=9a6ddd173e1541680957272e8f6513bdbdab5d8b;p=thirdparty%2Fkernel%2Fstable-queue.git 3.14-stable patches added patches: acpi-button-add-acpi-button-event-via-netlink-routine.patch backing_dev-fix-hung-task-on-sync.patch bdi-avoid-oops-on-device-removal.patch bluetooth-fix-removing-long-term-key.patch btrfs-skip-submitting-barrier-for-missing-device.patch char-ipmi_bt_sm-fix-infinite-loop.patch ima-restore-the-original-behavior-for-sending-data-with-ima-template.patch kernfs-fix-off-by-one-error.patch kernfs-protect-lazy-kernfs_iattrs-allocation-with-mutex.patch pci-designware-fix-iatu-programming-for-cfg1-io-and-mem-viewport.patch pci-designware-fix-rc-bar-to-be-single-64-bit-non-prefetchable-memory-bar.patch pci-enable-intx-in-pci_reenable_device-only-when-msi-msi-x-not-enabled.patch pid_namespace-pidns_get-should-check-task_active_pid_ns-null.patch scsi-sd-don-t-fail-if-the-device-doesn-t-recognize-synchronize-cache.patch staging-comedi-8255_pci-initialize-mite-data-window.patch staging-comedi-fix-circular-locking-dependency-in-comedi_mmap.patch tty-fix-low_latency-bug.patch tty-set-correct-tty-name-in-active-sysfs-attribute.patch x86-adjust-irq-remapping-quirk-for-older-revisions-of-5500-5520-chipsets.patch x86-hyperv-bypass-the-timer_irq_works-check.patch xfs-fix-directory-hash-ordering-bug.patch --- diff --git a/queue-3.14/acpi-button-add-acpi-button-event-via-netlink-routine.patch b/queue-3.14/acpi-button-add-acpi-button-event-via-netlink-routine.patch new file mode 100644 index 00000000000..b8b0d784f4a --- /dev/null +++ b/queue-3.14/acpi-button-add-acpi-button-event-via-netlink-routine.patch @@ -0,0 +1,38 @@ +From 0bf6368ee8f25826d0645c0f7a4f17c8845356a4 Mon Sep 17 00:00:00 2001 +From: Lan Tianyu +Date: Sat, 15 Mar 2014 13:37:13 -0400 +Subject: ACPI / button: Add ACPI Button event via netlink routine + +From: Lan Tianyu + +commit 0bf6368ee8f25826d0645c0f7a4f17c8845356a4 upstream. + +Commit 1696d9d (ACPI: Remove the old /proc/acpi/event interface) +removed ACPI Button event which originally was sent to userspace via +/proc/acpi/event. This caused ACPI shutdown regression on gentoo +in VirtualBox. Now ACPI events are sent to userspace via netlink, +so add ACPI Button event back via netlink routine. + +References: https://bugzilla.kernel.org/show_bug.cgi?id=71721 +Reported-and-tested-by: Richard Musil +Signed-off-by: Lan Tianyu +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/acpi/button.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/acpi/button.c ++++ b/drivers/acpi/button.c +@@ -302,6 +302,10 @@ static void acpi_button_notify(struct ac + input_sync(input); + + pm_wakeup_event(&device->dev, 0); ++ acpi_bus_generate_netlink_event( ++ device->pnp.device_class, ++ dev_name(&device->dev), ++ event, ++button->pushed); + } + break; + default: diff --git a/queue-3.14/backing_dev-fix-hung-task-on-sync.patch b/queue-3.14/backing_dev-fix-hung-task-on-sync.patch new file mode 100644 index 00000000000..da35b3a4f94 --- /dev/null +++ b/queue-3.14/backing_dev-fix-hung-task-on-sync.patch @@ -0,0 +1,94 @@ +From 6ca738d60c563d5c6cf6253ee4b8e76fa77b2b9e Mon Sep 17 00:00:00 2001 +From: Derek Basehore +Date: Thu, 3 Apr 2014 14:46:22 -0700 +Subject: backing_dev: fix hung task on sync + +From: Derek Basehore + +commit 6ca738d60c563d5c6cf6253ee4b8e76fa77b2b9e upstream. + +bdi_wakeup_thread_delayed() used the mod_delayed_work() function to +schedule work to writeback dirty inodes. The problem with this is that +it can delay work that is scheduled for immediate execution, such as the +work from sync_inodes_sb(). This can happen since mod_delayed_work() +can now steal work from a work_queue. This fixes the problem by using +queue_delayed_work() instead. This is a regression caused by commit +839a8e8660b6 ("writeback: replace custom worker pool implementation with +unbound workqueue"). + +The reason that this causes a problem is that laptop-mode will change +the delay, dirty_writeback_centisecs, to 60000 (10 minutes) by default. +In the case that bdi_wakeup_thread_delayed() races with +sync_inodes_sb(), sync will be stopped for 10 minutes and trigger a hung +task. Even if dirty_writeback_centisecs is not long enough to cause a +hung task, we still don't want to delay sync for that long. + +We fix the problem by using queue_delayed_work() when we want to +schedule writeback sometime in future. This function doesn't change the +timer if it is already armed. + +For the same reason, we also change bdi_writeback_workfn() to +immediately queue the work again in the case that the work_list is not +empty. The same problem can happen if the sync work is run on the +rescue worker. + +[jack@suse.cz: update changelog, add comment, use bdi_wakeup_thread_delayed()] +Signed-off-by: Derek Basehore +Reviewed-by: Jan Kara +Cc: Alexander Viro +Reviewed-by: Tejun Heo +Cc: Greg Kroah-Hartman +Cc: "Darrick J. Wong" +Cc: Derek Basehore +Cc: Kees Cook +Cc: Benson Leung +Cc: Sonny Rao +Cc: Luigi Semenzato +Cc: Jens Axboe +Cc: Dave Chinner +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + fs/fs-writeback.c | 8 ++++---- + mm/backing-dev.c | 5 ++++- + 2 files changed, 8 insertions(+), 5 deletions(-) + +--- a/fs/fs-writeback.c ++++ b/fs/fs-writeback.c +@@ -1039,10 +1039,10 @@ void bdi_writeback_workfn(struct work_st + trace_writeback_pages_written(pages_written); + } + +- if (!list_empty(&bdi->work_list) || +- (wb_has_dirty_io(wb) && dirty_writeback_interval)) +- queue_delayed_work(bdi_wq, &wb->dwork, +- msecs_to_jiffies(dirty_writeback_interval * 10)); ++ if (!list_empty(&bdi->work_list)) ++ mod_delayed_work(bdi_wq, &wb->dwork, 0); ++ else if (wb_has_dirty_io(wb) && dirty_writeback_interval) ++ bdi_wakeup_thread_delayed(bdi); + + current->flags &= ~PF_SWAPWRITE; + } +--- a/mm/backing-dev.c ++++ b/mm/backing-dev.c +@@ -288,13 +288,16 @@ int bdi_has_dirty_io(struct backing_dev_ + * Note, we wouldn't bother setting up the timer, but this function is on the + * fast-path (used by '__mark_inode_dirty()'), so we save few context switches + * by delaying the wake-up. ++ * ++ * We have to be careful not to postpone flush work if it is scheduled for ++ * earlier. Thus we use queue_delayed_work(). + */ + void bdi_wakeup_thread_delayed(struct backing_dev_info *bdi) + { + unsigned long timeout; + + timeout = msecs_to_jiffies(dirty_writeback_interval * 10); +- mod_delayed_work(bdi_wq, &bdi->wb.dwork, timeout); ++ queue_delayed_work(bdi_wq, &bdi->wb.dwork, timeout); + } + + /* diff --git a/queue-3.14/bdi-avoid-oops-on-device-removal.patch b/queue-3.14/bdi-avoid-oops-on-device-removal.patch new file mode 100644 index 00000000000..d2078004283 --- /dev/null +++ b/queue-3.14/bdi-avoid-oops-on-device-removal.patch @@ -0,0 +1,145 @@ +From 5acda9d12dcf1ad0d9a5a2a7c646de3472fa7555 Mon Sep 17 00:00:00 2001 +From: Jan Kara +Date: Thu, 3 Apr 2014 14:46:23 -0700 +Subject: bdi: avoid oops on device removal + +From: Jan Kara + +commit 5acda9d12dcf1ad0d9a5a2a7c646de3472fa7555 upstream. + +After commit 839a8e8660b6 ("writeback: replace custom worker pool +implementation with unbound workqueue") when device is removed while we +are writing to it we crash in bdi_writeback_workfn() -> +set_worker_desc() because bdi->dev is NULL. + +This can happen because even though bdi_unregister() cancels all pending +flushing work, nothing really prevents new ones from being queued from +balance_dirty_pages() or other places. + +Fix the problem by clearing BDI_registered bit in bdi_unregister() and +checking it before scheduling of any flushing work. + +Fixes: 839a8e8660b6777e7fe4e80af1a048aebe2b5977 + +Reviewed-by: Tejun Heo +Signed-off-by: Jan Kara +Cc: Derek Basehore +Cc: Jens Axboe +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + fs/fs-writeback.c | 23 ++++++++++++++++++----- + include/linux/backing-dev.h | 2 +- + mm/backing-dev.c | 13 +++++++++---- + 3 files changed, 28 insertions(+), 10 deletions(-) + +--- a/fs/fs-writeback.c ++++ b/fs/fs-writeback.c +@@ -89,16 +89,29 @@ static inline struct inode *wb_inode(str + #define CREATE_TRACE_POINTS + #include + ++static void bdi_wakeup_thread(struct backing_dev_info *bdi) ++{ ++ spin_lock_bh(&bdi->wb_lock); ++ if (test_bit(BDI_registered, &bdi->state)) ++ mod_delayed_work(bdi_wq, &bdi->wb.dwork, 0); ++ spin_unlock_bh(&bdi->wb_lock); ++} ++ + static void bdi_queue_work(struct backing_dev_info *bdi, + struct wb_writeback_work *work) + { + trace_writeback_queue(bdi, work); + + spin_lock_bh(&bdi->wb_lock); ++ if (!test_bit(BDI_registered, &bdi->state)) { ++ if (work->done) ++ complete(work->done); ++ goto out_unlock; ++ } + list_add_tail(&work->list, &bdi->work_list); +- spin_unlock_bh(&bdi->wb_lock); +- + mod_delayed_work(bdi_wq, &bdi->wb.dwork, 0); ++out_unlock: ++ spin_unlock_bh(&bdi->wb_lock); + } + + static void +@@ -114,7 +127,7 @@ __bdi_start_writeback(struct backing_dev + work = kzalloc(sizeof(*work), GFP_ATOMIC); + if (!work) { + trace_writeback_nowork(bdi); +- mod_delayed_work(bdi_wq, &bdi->wb.dwork, 0); ++ bdi_wakeup_thread(bdi); + return; + } + +@@ -161,7 +174,7 @@ void bdi_start_background_writeback(stru + * writeback as soon as there is no other work to do. + */ + trace_writeback_wake_background(bdi); +- mod_delayed_work(bdi_wq, &bdi->wb.dwork, 0); ++ bdi_wakeup_thread(bdi); + } + + /* +@@ -1017,7 +1030,7 @@ void bdi_writeback_workfn(struct work_st + current->flags |= PF_SWAPWRITE; + + if (likely(!current_is_workqueue_rescuer() || +- list_empty(&bdi->bdi_list))) { ++ !test_bit(BDI_registered, &bdi->state))) { + /* + * The normal path. Keep writing back @bdi until its + * work_list is empty. Note that this path is also taken +--- a/include/linux/backing-dev.h ++++ b/include/linux/backing-dev.h +@@ -95,7 +95,7 @@ struct backing_dev_info { + unsigned int max_ratio, max_prop_frac; + + struct bdi_writeback wb; /* default writeback info for this bdi */ +- spinlock_t wb_lock; /* protects work_list */ ++ spinlock_t wb_lock; /* protects work_list & wb.dwork scheduling */ + + struct list_head work_list; + +--- a/mm/backing-dev.c ++++ b/mm/backing-dev.c +@@ -297,7 +297,10 @@ void bdi_wakeup_thread_delayed(struct ba + unsigned long timeout; + + timeout = msecs_to_jiffies(dirty_writeback_interval * 10); +- queue_delayed_work(bdi_wq, &bdi->wb.dwork, timeout); ++ spin_lock_bh(&bdi->wb_lock); ++ if (test_bit(BDI_registered, &bdi->state)) ++ queue_delayed_work(bdi_wq, &bdi->wb.dwork, timeout); ++ spin_unlock_bh(&bdi->wb_lock); + } + + /* +@@ -310,9 +313,6 @@ static void bdi_remove_from_list(struct + spin_unlock_bh(&bdi_lock); + + synchronize_rcu_expedited(); +- +- /* bdi_list is now unused, clear it to mark @bdi dying */ +- INIT_LIST_HEAD(&bdi->bdi_list); + } + + int bdi_register(struct backing_dev_info *bdi, struct device *parent, +@@ -363,6 +363,11 @@ static void bdi_wb_shutdown(struct backi + */ + bdi_remove_from_list(bdi); + ++ /* Make sure nobody queues further work */ ++ spin_lock_bh(&bdi->wb_lock); ++ clear_bit(BDI_registered, &bdi->state); ++ spin_unlock_bh(&bdi->wb_lock); ++ + /* + * Drain work list and shutdown the delayed_work. At this point, + * @bdi->bdi_list is empty telling bdi_Writeback_workfn() that @bdi diff --git a/queue-3.14/bluetooth-fix-removing-long-term-key.patch b/queue-3.14/bluetooth-fix-removing-long-term-key.patch new file mode 100644 index 00000000000..08484e7ebb3 --- /dev/null +++ b/queue-3.14/bluetooth-fix-removing-long-term-key.patch @@ -0,0 +1,101 @@ +From 5981a8821b774ada0be512fd9bad7c241e17657e Mon Sep 17 00:00:00 2001 +From: Claudio Takahasi +Date: Thu, 25 Jul 2013 16:34:24 -0300 +Subject: Bluetooth: Fix removing Long Term Key + +From: Claudio Takahasi + +commit 5981a8821b774ada0be512fd9bad7c241e17657e upstream. + +This patch fixes authentication failure on LE link re-connection when +BlueZ acts as slave (peripheral). LTK is removed from the internal list +after its first use causing PIN or Key missing reply when re-connecting +the link. The LE Long Term Key Request event indicates that the master +is attempting to encrypt or re-encrypt the link. + +Pre-condition: BlueZ host paired and running as slave. +How to reproduce(master): + + 1) Establish an ACL LE encrypted link + 2) Disconnect the link + 3) Try to re-establish the ACL LE encrypted link (fails) + +> HCI Event: LE Meta Event (0x3e) plen 19 + LE Connection Complete (0x01) + Status: Success (0x00) + Handle: 64 + Role: Slave (0x01) +... +@ Device Connected: 00:02:72:DC:29:C9 (1) flags 0x0000 +> HCI Event: LE Meta Event (0x3e) plen 13 + LE Long Term Key Request (0x05) + Handle: 64 + Random number: 875be18439d9aa37 + Encryption diversifier: 0x76ed +< HCI Command: LE Long Term Key Request Reply (0x08|0x001a) plen 18 + Handle: 64 + Long term key: 2aa531db2fce9f00a0569c7d23d17409 +> HCI Event: Command Complete (0x0e) plen 6 + LE Long Term Key Request Reply (0x08|0x001a) ncmd 1 + Status: Success (0x00) + Handle: 64 +> HCI Event: Encryption Change (0x08) plen 4 + Status: Success (0x00) + Handle: 64 + Encryption: Enabled with AES-CCM (0x01) +... +@ Device Disconnected: 00:02:72:DC:29:C9 (1) reason 3 +< HCI Command: LE Set Advertise Enable (0x08|0x000a) plen 1 + Advertising: Enabled (0x01) +> HCI Event: Command Complete (0x0e) plen 4 + LE Set Advertise Enable (0x08|0x000a) ncmd 1 + Status: Success (0x00) +> HCI Event: LE Meta Event (0x3e) plen 19 + LE Connection Complete (0x01) + Status: Success (0x00) + Handle: 64 + Role: Slave (0x01) +... +@ Device Connected: 00:02:72:DC:29:C9 (1) flags 0x0000 +> HCI Event: LE Meta Event (0x3e) plen 13 + LE Long Term Key Request (0x05) + Handle: 64 + Random number: 875be18439d9aa37 + Encryption diversifier: 0x76ed +< HCI Command: LE Long Term Key Request Neg Reply (0x08|0x001b) plen 2 + Handle: 64 +> HCI Event: Command Complete (0x0e) plen 6 + LE Long Term Key Request Neg Reply (0x08|0x001b) ncmd 1 + Status: Success (0x00) + Handle: 64 +> HCI Event: Disconnect Complete (0x05) plen 4 + Status: Success (0x00) + Handle: 64 + Reason: Authentication Failure (0x05) +@ Device Disconnected: 00:02:72:DC:29:C9 (1) reason 0 + +Signed-off-by: Claudio Takahasi +Signed-off-by: Johan Hedberg +Signed-off-by: Greg Kroah-Hartman + +--- + net/bluetooth/hci_event.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +--- a/net/bluetooth/hci_event.c ++++ b/net/bluetooth/hci_event.c +@@ -3593,7 +3593,13 @@ static void hci_le_ltk_request_evt(struc + + hci_send_cmd(hdev, HCI_OP_LE_LTK_REPLY, sizeof(cp), &cp); + +- if (ltk->type & HCI_SMP_STK) { ++ /* Ref. Bluetooth Core SPEC pages 1975 and 2004. STK is a ++ * temporary key used to encrypt a connection following ++ * pairing. It is used during the Encrypted Session Setup to ++ * distribute the keys. Later, security can be re-established ++ * using a distributed LTK. ++ */ ++ if (ltk->type == HCI_SMP_STK_SLAVE) { + list_del(<k->list); + kfree(ltk); + } diff --git a/queue-3.14/btrfs-skip-submitting-barrier-for-missing-device.patch b/queue-3.14/btrfs-skip-submitting-barrier-for-missing-device.patch new file mode 100644 index 00000000000..b85d9fce597 --- /dev/null +++ b/queue-3.14/btrfs-skip-submitting-barrier-for-missing-device.patch @@ -0,0 +1,53 @@ +From f88ba6a2a44ee98e8d59654463dc157bb6d13c43 Mon Sep 17 00:00:00 2001 +From: Hidetoshi Seto +Date: Wed, 5 Feb 2014 16:34:38 +0900 +Subject: Btrfs: skip submitting barrier for missing device + +From: Hidetoshi Seto + +commit f88ba6a2a44ee98e8d59654463dc157bb6d13c43 upstream. + +I got an error on v3.13: + BTRFS error (device sdf1) in write_all_supers:3378: errno=-5 IO failure (errors while submitting device barriers.) + +how to reproduce: + > mkfs.btrfs -f -d raid1 /dev/sdf1 /dev/sdf2 + > wipefs -a /dev/sdf2 + > mount -o degraded /dev/sdf1 /mnt + > btrfs balance start -f -sconvert=single -mconvert=single -dconvert=single /mnt + +The reason of the error is that barrier_all_devices() failed to submit +barrier to the missing device. However it is clear that we cannot do +anything on missing device, and also it is not necessary to care chunks +on the missing device. + +This patch stops sending/waiting barrier if device is missing. + +Signed-off-by: Hidetoshi Seto +Signed-off-by: Josef Bacik +Signed-off-by: Greg Kroah-Hartman + +--- + fs/btrfs/disk-io.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/fs/btrfs/disk-io.c ++++ b/fs/btrfs/disk-io.c +@@ -3244,6 +3244,8 @@ static int barrier_all_devices(struct bt + /* send down all the barriers */ + head = &info->fs_devices->devices; + list_for_each_entry_rcu(dev, head, dev_list) { ++ if (dev->missing) ++ continue; + if (!dev->bdev) { + errors_send++; + continue; +@@ -3258,6 +3260,8 @@ static int barrier_all_devices(struct bt + + /* wait for all the barriers */ + list_for_each_entry_rcu(dev, head, dev_list) { ++ if (dev->missing) ++ continue; + if (!dev->bdev) { + errors_wait++; + continue; diff --git a/queue-3.14/char-ipmi_bt_sm-fix-infinite-loop.patch b/queue-3.14/char-ipmi_bt_sm-fix-infinite-loop.patch new file mode 100644 index 00000000000..d8aea543745 --- /dev/null +++ b/queue-3.14/char-ipmi_bt_sm-fix-infinite-loop.patch @@ -0,0 +1,47 @@ +From a94cdd1f4d30f12904ab528152731fb13a812a16 Mon Sep 17 00:00:00 2001 +From: Jiri Slaby +Date: Mon, 14 Apr 2014 09:46:50 -0500 +Subject: Char: ipmi_bt_sm, fix infinite loop + +From: Jiri Slaby + +commit a94cdd1f4d30f12904ab528152731fb13a812a16 upstream. + +In read_all_bytes, we do + + unsigned char i; + ... + bt->read_data[0] = BMC2HOST; + bt->read_count = bt->read_data[0]; + ... + for (i = 1; i <= bt->read_count; i++) + bt->read_data[i] = BMC2HOST; + +If bt->read_data[0] == bt->read_count == 255, we loop infinitely in the +'for' loop. Make 'i' an 'int' instead of 'char' to get rid of the +overflow and finish the loop after 255 iterations every time. + +Signed-off-by: Jiri Slaby +Reported-and-debugged-by: Rui Hui Dian +Cc: Tomas Cech +Cc: Corey Minyard +Cc: +Signed-off-by: Corey Minyard +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/char/ipmi/ipmi_bt_sm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/char/ipmi/ipmi_bt_sm.c ++++ b/drivers/char/ipmi/ipmi_bt_sm.c +@@ -352,7 +352,7 @@ static inline void write_all_bytes(struc + + static inline int read_all_bytes(struct si_sm_data *bt) + { +- unsigned char i; ++ unsigned int i; + + /* + * length is "framing info", minimum = 4: NetFn, Seq, Cmd, cCode. diff --git a/queue-3.14/ima-restore-the-original-behavior-for-sending-data-with-ima-template.patch b/queue-3.14/ima-restore-the-original-behavior-for-sending-data-with-ima-template.patch new file mode 100644 index 00000000000..fa7677b1f59 --- /dev/null +++ b/queue-3.14/ima-restore-the-original-behavior-for-sending-data-with-ima-template.patch @@ -0,0 +1,96 @@ +From c019e307ad82a8ee652b8ccbacf69ae94263b07b Mon Sep 17 00:00:00 2001 +From: Roberto Sassu +Date: Mon, 3 Feb 2014 13:56:04 +0100 +Subject: ima: restore the original behavior for sending data with ima template + +From: Roberto Sassu + +commit c019e307ad82a8ee652b8ccbacf69ae94263b07b upstream. + +With the new template mechanism introduced in IMA since kernel 3.13, +the format of data sent through the binary_runtime_measurements interface +is slightly changed. Now, for a generic measurement, the format of +template data (after the template name) is: + +template_len | field1_len | field1 | ... | fieldN_len | fieldN + +In addition, fields containing a string now include the '\0' termination +character. + +Instead, the format for the 'ima' template should be: + +SHA1 digest | event name length | event name + +It must be noted that while in the IMA 3.13 code 'event name length' is +'IMA_EVENT_NAME_LEN_MAX + 1' (256 bytes), so that the template digest +is calculated correctly, and 'event name' contains '\0', in the pre 3.13 +code 'event name length' is exactly the string length and 'event name' +does not contain the termination character. + +The patch restores the behavior of the IMA code pre 3.13 for the 'ima' +template so that legacy userspace tools obtain a consistent behavior +when receiving data from the binary_runtime_measurements interface +regardless of which kernel version is used. + +Signed-off-by: Roberto Sassu +Signed-off-by: Mimi Zohar +Signed-off-by: Greg Kroah-Hartman + +--- + security/integrity/ima/ima.h | 2 +- + security/integrity/ima/ima_fs.c | 2 ++ + security/integrity/ima/ima_template_lib.c | 10 +++++++--- + 3 files changed, 10 insertions(+), 4 deletions(-) + +--- a/security/integrity/ima/ima.h ++++ b/security/integrity/ima/ima.h +@@ -27,7 +27,7 @@ + #include "../integrity.h" + + enum ima_show_type { IMA_SHOW_BINARY, IMA_SHOW_BINARY_NO_FIELD_LEN, +- IMA_SHOW_ASCII }; ++ IMA_SHOW_BINARY_OLD_STRING_FMT, IMA_SHOW_ASCII }; + enum tpm_pcrs { TPM_PCR0 = 0, TPM_PCR8 = 8 }; + + /* digest size for IMA, fits SHA1 or MD5 */ +--- a/security/integrity/ima/ima_fs.c ++++ b/security/integrity/ima/ima_fs.c +@@ -160,6 +160,8 @@ static int ima_measurements_show(struct + + if (is_ima_template && strcmp(field->field_id, "d") == 0) + show = IMA_SHOW_BINARY_NO_FIELD_LEN; ++ if (is_ima_template && strcmp(field->field_id, "n") == 0) ++ show = IMA_SHOW_BINARY_OLD_STRING_FMT; + field->field_show(m, show, &e->template_data[i]); + } + return 0; +--- a/security/integrity/ima/ima_template_lib.c ++++ b/security/integrity/ima/ima_template_lib.c +@@ -109,13 +109,16 @@ static void ima_show_template_data_binar + enum data_formats datafmt, + struct ima_field_data *field_data) + { ++ u32 len = (show == IMA_SHOW_BINARY_OLD_STRING_FMT) ? ++ strlen(field_data->data) : field_data->len; ++ + if (show != IMA_SHOW_BINARY_NO_FIELD_LEN) +- ima_putc(m, &field_data->len, sizeof(u32)); ++ ima_putc(m, &len, sizeof(len)); + +- if (!field_data->len) ++ if (!len) + return; + +- ima_putc(m, field_data->data, field_data->len); ++ ima_putc(m, field_data->data, len); + } + + static void ima_show_template_field_data(struct seq_file *m, +@@ -129,6 +132,7 @@ static void ima_show_template_field_data + break; + case IMA_SHOW_BINARY: + case IMA_SHOW_BINARY_NO_FIELD_LEN: ++ case IMA_SHOW_BINARY_OLD_STRING_FMT: + ima_show_template_data_binary(m, show, datafmt, field_data); + break; + default: diff --git a/queue-3.14/kernfs-fix-off-by-one-error.patch b/queue-3.14/kernfs-fix-off-by-one-error.patch new file mode 100644 index 00000000000..056ca04a94d --- /dev/null +++ b/queue-3.14/kernfs-fix-off-by-one-error.patch @@ -0,0 +1,32 @@ +From 88391d49abb7d8dee91d405f96bd9e003cb6798d Mon Sep 17 00:00:00 2001 +From: Richard Cochran +Date: Wed, 5 Mar 2014 17:10:52 +0100 +Subject: kernfs: fix off by one error. + +From: Richard Cochran + +commit 88391d49abb7d8dee91d405f96bd9e003cb6798d upstream. + +The hash values 0 and 1 are reserved for magic directory entries, but +the code only prevents names hashing to 0. This patch fixes the test +to also prevent hash value 1. + +Signed-off-by: Richard Cochran +Reviewed-by: "Eric W. Biederman" +Signed-off-by: Greg Kroah-Hartman + +--- + fs/kernfs/dir.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/kernfs/dir.c ++++ b/fs/kernfs/dir.c +@@ -37,7 +37,7 @@ static unsigned int kernfs_name_hash(con + hash = (end_name_hash(hash) ^ hash_ptr((void *)ns, 31)); + hash &= 0x7fffffffU; + /* Reserve hash numbers 0, 1 and INT_MAX for magic directory entries */ +- if (hash < 1) ++ if (hash < 2) + hash += 2; + if (hash >= INT_MAX) + hash = INT_MAX - 1; diff --git a/queue-3.14/kernfs-protect-lazy-kernfs_iattrs-allocation-with-mutex.patch b/queue-3.14/kernfs-protect-lazy-kernfs_iattrs-allocation-with-mutex.patch new file mode 100644 index 00000000000..bef7e55c7b4 --- /dev/null +++ b/queue-3.14/kernfs-protect-lazy-kernfs_iattrs-allocation-with-mutex.patch @@ -0,0 +1,63 @@ +From 4afddd60a770560d370d6f85c5aef57c16bf7502 Mon Sep 17 00:00:00 2001 +From: Tejun Heo +Date: Wed, 2 Apr 2014 16:40:52 -0400 +Subject: kernfs: protect lazy kernfs_iattrs allocation with mutex + +From: Tejun Heo + +commit 4afddd60a770560d370d6f85c5aef57c16bf7502 upstream. + +kernfs_iattrs is allocated lazily when operations which require it +take place; unfortunately, the lazy allocation and returning weren't +properly synchronized and when there are multiple concurrent +operations, it might end up returning kernfs_iattrs which hasn't +finished initialization yet or different copies to different callers. + +Fix it by synchronizing with a mutex. This can be smarter with memory +barriers but let's go there if it actually turns out to be necessary. + +Signed-off-by: Tejun Heo +Link: http://lkml.kernel.org/g/533ABA32.9080602@oracle.com +Reported-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman + +--- + fs/kernfs/inode.c | 14 ++++++++++---- + 1 file changed, 10 insertions(+), 4 deletions(-) + +--- a/fs/kernfs/inode.c ++++ b/fs/kernfs/inode.c +@@ -48,14 +48,18 @@ void __init kernfs_inode_init(void) + + static struct kernfs_iattrs *kernfs_iattrs(struct kernfs_node *kn) + { ++ static DEFINE_MUTEX(iattr_mutex); ++ struct kernfs_iattrs *ret; + struct iattr *iattrs; + ++ mutex_lock(&iattr_mutex); ++ + if (kn->iattr) +- return kn->iattr; ++ goto out_unlock; + + kn->iattr = kzalloc(sizeof(struct kernfs_iattrs), GFP_KERNEL); + if (!kn->iattr) +- return NULL; ++ goto out_unlock; + iattrs = &kn->iattr->ia_iattr; + + /* assign default attributes */ +@@ -65,8 +69,10 @@ static struct kernfs_iattrs *kernfs_iatt + iattrs->ia_atime = iattrs->ia_mtime = iattrs->ia_ctime = CURRENT_TIME; + + simple_xattrs_init(&kn->iattr->xattrs); +- +- return kn->iattr; ++out_unlock: ++ ret = kn->iattr; ++ mutex_unlock(&iattr_mutex); ++ return ret; + } + + static int __kernfs_setattr(struct kernfs_node *kn, const struct iattr *iattr) diff --git a/queue-3.14/pci-designware-fix-iatu-programming-for-cfg1-io-and-mem-viewport.patch b/queue-3.14/pci-designware-fix-iatu-programming-for-cfg1-io-and-mem-viewport.patch new file mode 100644 index 00000000000..162babeda15 --- /dev/null +++ b/queue-3.14/pci-designware-fix-iatu-programming-for-cfg1-io-and-mem-viewport.patch @@ -0,0 +1,71 @@ +From 017fcdc30cdae18c0946eef1ece1f14b4c7897ba Mon Sep 17 00:00:00 2001 +From: Mohit Kumar +Date: Wed, 16 Apr 2014 10:23:34 -0600 +Subject: PCI: designware: Fix iATU programming for cfg1, io and mem viewport + +From: Mohit Kumar + +commit 017fcdc30cdae18c0946eef1ece1f14b4c7897ba upstream. + +This patch corrects iATU programming for cfg1, io and mem viewport. Enable +ATU only after configuring it. + +Signed-off-by: Mohit Kumar +Signed-off-by: Ajay Khandelwal +Signed-off-by: Bjorn Helgaas +Acked-by: Jingoo Han +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pci/host/pcie-designware.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/pci/host/pcie-designware.c ++++ b/drivers/pci/host/pcie-designware.c +@@ -522,13 +522,13 @@ static void dw_pcie_prog_viewport_cfg1(s + dw_pcie_writel_rc(pp, PCIE_ATU_REGION_OUTBOUND | PCIE_ATU_REGION_INDEX1, + PCIE_ATU_VIEWPORT); + dw_pcie_writel_rc(pp, PCIE_ATU_TYPE_CFG1, PCIE_ATU_CR1); +- dw_pcie_writel_rc(pp, PCIE_ATU_ENABLE, PCIE_ATU_CR2); + dw_pcie_writel_rc(pp, pp->cfg1_base, PCIE_ATU_LOWER_BASE); + dw_pcie_writel_rc(pp, (pp->cfg1_base >> 32), PCIE_ATU_UPPER_BASE); + dw_pcie_writel_rc(pp, pp->cfg1_base + pp->config.cfg1_size - 1, + PCIE_ATU_LIMIT); + dw_pcie_writel_rc(pp, busdev, PCIE_ATU_LOWER_TARGET); + dw_pcie_writel_rc(pp, 0, PCIE_ATU_UPPER_TARGET); ++ dw_pcie_writel_rc(pp, PCIE_ATU_ENABLE, PCIE_ATU_CR2); + } + + static void dw_pcie_prog_viewport_mem_outbound(struct pcie_port *pp) +@@ -537,7 +537,6 @@ static void dw_pcie_prog_viewport_mem_ou + dw_pcie_writel_rc(pp, PCIE_ATU_REGION_OUTBOUND | PCIE_ATU_REGION_INDEX0, + PCIE_ATU_VIEWPORT); + dw_pcie_writel_rc(pp, PCIE_ATU_TYPE_MEM, PCIE_ATU_CR1); +- dw_pcie_writel_rc(pp, PCIE_ATU_ENABLE, PCIE_ATU_CR2); + dw_pcie_writel_rc(pp, pp->mem_base, PCIE_ATU_LOWER_BASE); + dw_pcie_writel_rc(pp, (pp->mem_base >> 32), PCIE_ATU_UPPER_BASE); + dw_pcie_writel_rc(pp, pp->mem_base + pp->config.mem_size - 1, +@@ -545,6 +544,7 @@ static void dw_pcie_prog_viewport_mem_ou + dw_pcie_writel_rc(pp, pp->config.mem_bus_addr, PCIE_ATU_LOWER_TARGET); + dw_pcie_writel_rc(pp, upper_32_bits(pp->config.mem_bus_addr), + PCIE_ATU_UPPER_TARGET); ++ dw_pcie_writel_rc(pp, PCIE_ATU_ENABLE, PCIE_ATU_CR2); + } + + static void dw_pcie_prog_viewport_io_outbound(struct pcie_port *pp) +@@ -553,7 +553,6 @@ static void dw_pcie_prog_viewport_io_out + dw_pcie_writel_rc(pp, PCIE_ATU_REGION_OUTBOUND | PCIE_ATU_REGION_INDEX1, + PCIE_ATU_VIEWPORT); + dw_pcie_writel_rc(pp, PCIE_ATU_TYPE_IO, PCIE_ATU_CR1); +- dw_pcie_writel_rc(pp, PCIE_ATU_ENABLE, PCIE_ATU_CR2); + dw_pcie_writel_rc(pp, pp->io_base, PCIE_ATU_LOWER_BASE); + dw_pcie_writel_rc(pp, (pp->io_base >> 32), PCIE_ATU_UPPER_BASE); + dw_pcie_writel_rc(pp, pp->io_base + pp->config.io_size - 1, +@@ -561,6 +560,7 @@ static void dw_pcie_prog_viewport_io_out + dw_pcie_writel_rc(pp, pp->config.io_bus_addr, PCIE_ATU_LOWER_TARGET); + dw_pcie_writel_rc(pp, upper_32_bits(pp->config.io_bus_addr), + PCIE_ATU_UPPER_TARGET); ++ dw_pcie_writel_rc(pp, PCIE_ATU_ENABLE, PCIE_ATU_CR2); + } + + static int dw_pcie_rd_other_conf(struct pcie_port *pp, struct pci_bus *bus, diff --git a/queue-3.14/pci-designware-fix-rc-bar-to-be-single-64-bit-non-prefetchable-memory-bar.patch b/queue-3.14/pci-designware-fix-rc-bar-to-be-single-64-bit-non-prefetchable-memory-bar.patch new file mode 100644 index 00000000000..7c98000b540 --- /dev/null +++ b/queue-3.14/pci-designware-fix-rc-bar-to-be-single-64-bit-non-prefetchable-memory-bar.patch @@ -0,0 +1,40 @@ +From dbffdd6862e67d60703f2df66c558bf448f81d6e Mon Sep 17 00:00:00 2001 +From: Mohit Kumar +Date: Wed, 19 Feb 2014 17:34:35 +0530 +Subject: PCI: designware: Fix RC BAR to be single 64-bit non-prefetchable memory BAR + +From: Mohit Kumar + +commit dbffdd6862e67d60703f2df66c558bf448f81d6e upstream. + +The Synopsys PCIe core provides one pair of 32-bit BARs (BAR 0 and BAR 1). +The BARs can be configured as follows: + + - One 64-bit BAR: BARs 0 and 1 are combined to form a single 64-bit BAR + - Two 32-bit BARs: BARs 0 and 1 are two independent 32-bit BARs + +This patch corrects 64-bit, non-prefetchable memory BAR configuration +implemented in dw driver. + +Signed-off-by: Mohit Kumar +Signed-off-by: Bjorn Helgaas +Cc: Pratyush Anand +Cc: Jingoo Han +Cc: Arnd Bergmann +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pci/host/pcie-designware.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/pci/host/pcie-designware.c ++++ b/drivers/pci/host/pcie-designware.c +@@ -800,7 +800,7 @@ void dw_pcie_setup_rc(struct pcie_port * + + /* setup RC BARs */ + dw_pcie_writel_rc(pp, 0x00000004, PCI_BASE_ADDRESS_0); +- dw_pcie_writel_rc(pp, 0x00000004, PCI_BASE_ADDRESS_1); ++ dw_pcie_writel_rc(pp, 0x00000000, PCI_BASE_ADDRESS_1); + + /* setup interrupt pins */ + dw_pcie_readl_rc(pp, PCI_INTERRUPT_LINE, &val); diff --git a/queue-3.14/pci-enable-intx-in-pci_reenable_device-only-when-msi-msi-x-not-enabled.patch b/queue-3.14/pci-enable-intx-in-pci_reenable_device-only-when-msi-msi-x-not-enabled.patch new file mode 100644 index 00000000000..f8227096623 --- /dev/null +++ b/queue-3.14/pci-enable-intx-in-pci_reenable_device-only-when-msi-msi-x-not-enabled.patch @@ -0,0 +1,47 @@ +From 866d54177b4e671cd52bed1fb487d140d7b691f5 Mon Sep 17 00:00:00 2001 +From: Bjorn Helgaas +Date: Fri, 7 Mar 2014 16:06:05 -0700 +Subject: PCI: Enable INTx in pci_reenable_device() only when MSI/MSI-X not enabled + +From: Bjorn Helgaas + +commit 866d54177b4e671cd52bed1fb487d140d7b691f5 upstream. + +Andreas reported that after 1f42db786b14 ("PCI: Enable INTx if BIOS left +them disabled"), pciehp surprise removal stopped working. + +This happens because pci_reenable_device() on the hotplug bridge (used in +the pciehp_configure_device() path) clears the Interrupt Disable bit, which +apparently breaks the bridge's MSI hotplug event reporting. + +Previously we cleared the Interrupt Disable bit in do_pci_enable_device(), +which is used by both pci_enable_device() and pci_reenable_device(). But +we use pci_reenable_device() after the driver may have enabled MSI or +MSI-X, and we *set* Interrupt Disable as part of enabling MSI/MSI-X. + +This patch clears Interrupt Disable only when MSI/MSI-X has not been +enabled. + +Fixes: 1f42db786b14 PCI: Enable INTx if BIOS left them disabled +Link: https://bugzilla.kernel.org/show_bug.cgi?id=71691 +Reported-and-tested-by: Andreas Noever +Signed-off-by: Bjorn Helgaas +CC: Sarah Sharp +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pci/pci.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/pci/pci.c ++++ b/drivers/pci/pci.c +@@ -1195,6 +1195,9 @@ static int do_pci_enable_device(struct p + if (dev->msi_enabled || dev->msix_enabled) + return 0; + ++ if (dev->msi_enabled || dev->msix_enabled) ++ return 0; ++ + pci_read_config_byte(dev, PCI_INTERRUPT_PIN, &pin); + if (pin) { + pci_read_config_word(dev, PCI_COMMAND, &cmd); diff --git a/queue-3.14/pid_namespace-pidns_get-should-check-task_active_pid_ns-null.patch b/queue-3.14/pid_namespace-pidns_get-should-check-task_active_pid_ns-null.patch new file mode 100644 index 00000000000..f00992dea10 --- /dev/null +++ b/queue-3.14/pid_namespace-pidns_get-should-check-task_active_pid_ns-null.patch @@ -0,0 +1,36 @@ +From d23082257d83e4bc89727d5aedee197e907999d2 Mon Sep 17 00:00:00 2001 +From: Oleg Nesterov +Date: Wed, 2 Apr 2014 17:45:05 +0200 +Subject: pid_namespace: pidns_get() should check task_active_pid_ns() != NULL + +From: Oleg Nesterov + +commit d23082257d83e4bc89727d5aedee197e907999d2 upstream. + +pidns_get()->get_pid_ns() can hit ns == NULL. This task_struct can't +go away, but task_active_pid_ns(task) is NULL if release_task(task) +was already called. Alternatively we could change get_pid_ns(ns) to +check ns != NULL, but it seems that other callers are fine. + +Signed-off-by: Oleg Nesterov +Cc: Eric W. Biederman ebiederm@xmission.com> +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/pid_namespace.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/kernel/pid_namespace.c ++++ b/kernel/pid_namespace.c +@@ -318,7 +318,9 @@ static void *pidns_get(struct task_struc + struct pid_namespace *ns; + + rcu_read_lock(); +- ns = get_pid_ns(task_active_pid_ns(task)); ++ ns = task_active_pid_ns(task); ++ if (ns) ++ get_pid_ns(ns); + rcu_read_unlock(); + + return ns; diff --git a/queue-3.14/scsi-sd-don-t-fail-if-the-device-doesn-t-recognize-synchronize-cache.patch b/queue-3.14/scsi-sd-don-t-fail-if-the-device-doesn-t-recognize-synchronize-cache.patch new file mode 100644 index 00000000000..c3ecc376d58 --- /dev/null +++ b/queue-3.14/scsi-sd-don-t-fail-if-the-device-doesn-t-recognize-synchronize-cache.patch @@ -0,0 +1,42 @@ +From 7aae51347b21eb738dc1981df1365b57a6c5ee4e Mon Sep 17 00:00:00 2001 +From: Alan Stern +Date: Wed, 15 Jan 2014 15:37:04 -0500 +Subject: SCSI: sd: don't fail if the device doesn't recognize SYNCHRONIZE CACHE + +From: Alan Stern + +commit 7aae51347b21eb738dc1981df1365b57a6c5ee4e upstream. + +Evidently some wacky USB-ATA bridges don't recognize the SYNCHRONIZE +CACHE command, as shown in this email thread: + + http://marc.info/?t=138978356200002&r=1&w=2 + +The fact that we can't tell them to drain their caches shouldn't +prevent the system from going into suspend. Therefore sd_sync_cache() +shouldn't return an error if the device replies with an Invalid +Command ASC. + +Signed-off-by: Alan Stern +Reported-by: Sven Neumann +Tested-by: Daniel Mack +Signed-off-by: James Bottomley +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/sd.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/scsi/sd.c ++++ b/drivers/scsi/sd.c +@@ -1463,8 +1463,8 @@ static int sd_sync_cache(struct scsi_dis + sd_print_sense_hdr(sdkp, &sshdr); + /* we need to evaluate the error return */ + if (scsi_sense_valid(&sshdr) && +- /* 0x3a is medium not present */ +- sshdr.asc == 0x3a) ++ (sshdr.asc == 0x3a || /* medium not present */ ++ sshdr.asc == 0x20)) /* invalid command */ + /* this is no error here */ + return 0; + diff --git a/queue-3.14/series b/queue-3.14/series index 33e150294e1..487b8a451a1 100644 --- a/queue-3.14/series +++ b/queue-3.14/series @@ -1 +1,22 @@ user-namespace-fix-incorrect-memory-barriers.patch +char-ipmi_bt_sm-fix-infinite-loop.patch +x86-hyperv-bypass-the-timer_irq_works-check.patch +x86-adjust-irq-remapping-quirk-for-older-revisions-of-5500-5520-chipsets.patch +pci-designware-fix-rc-bar-to-be-single-64-bit-non-prefetchable-memory-bar.patch +pci-designware-fix-iatu-programming-for-cfg1-io-and-mem-viewport.patch +acpi-button-add-acpi-button-event-via-netlink-routine.patch +pci-enable-intx-in-pci_reenable_device-only-when-msi-msi-x-not-enabled.patch +staging-comedi-8255_pci-initialize-mite-data-window.patch +staging-comedi-fix-circular-locking-dependency-in-comedi_mmap.patch +kernfs-fix-off-by-one-error.patch +kernfs-protect-lazy-kernfs_iattrs-allocation-with-mutex.patch +tty-set-correct-tty-name-in-active-sysfs-attribute.patch +tty-fix-low_latency-bug.patch +scsi-sd-don-t-fail-if-the-device-doesn-t-recognize-synchronize-cache.patch +pid_namespace-pidns_get-should-check-task_active_pid_ns-null.patch +bluetooth-fix-removing-long-term-key.patch +ima-restore-the-original-behavior-for-sending-data-with-ima-template.patch +backing_dev-fix-hung-task-on-sync.patch +bdi-avoid-oops-on-device-removal.patch +xfs-fix-directory-hash-ordering-bug.patch +btrfs-skip-submitting-barrier-for-missing-device.patch diff --git a/queue-3.14/staging-comedi-8255_pci-initialize-mite-data-window.patch b/queue-3.14/staging-comedi-8255_pci-initialize-mite-data-window.patch new file mode 100644 index 00000000000..fd86240dbc3 --- /dev/null +++ b/queue-3.14/staging-comedi-8255_pci-initialize-mite-data-window.patch @@ -0,0 +1,127 @@ +From 268d1e799663b795cba15c64f5d29407786a9dd4 Mon Sep 17 00:00:00 2001 +From: Ian Abbott +Date: Thu, 13 Mar 2014 15:30:39 +0000 +Subject: staging: comedi: 8255_pci: initialize MITE data window + +From: Ian Abbott + +commit 268d1e799663b795cba15c64f5d29407786a9dd4 upstream. + +According to National Instruments' PCI-DIO-96/PXI-6508/PCI-6503 User +Manual, the physical address in PCI BAR1 needs to be OR'ed with 0x80 and +written to register offset 0xC0 in the "MITE" registers (BAR0). Do so +during initialization of the National Instruments boards handled by the +"8255_pci" driver. The boards were previously handled by the +"ni_pcidio" driver, where the initialization was done by `mite_setup()` +in the "mite" module. The "mite" module comes with too much extra +baggage for the "8255_pci" driver to deal with so use a local, simpler +initialization function. + +Signed-off-by: Ian Abbott +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/comedi/drivers/8255_pci.c | 34 ++++++++++++++++++++++++++++++ + 1 file changed, 34 insertions(+) + +--- a/drivers/staging/comedi/drivers/8255_pci.c ++++ b/drivers/staging/comedi/drivers/8255_pci.c +@@ -56,6 +56,7 @@ Configuration Options: not applicable, u + #include "../comedidev.h" + + #include "8255.h" ++#include "mite.h" + + enum pci_8255_boardid { + BOARD_ADLINK_PCI7224, +@@ -79,6 +80,7 @@ struct pci_8255_boardinfo { + const char *name; + int dio_badr; + int n_8255; ++ unsigned int has_mite:1; + }; + + static const struct pci_8255_boardinfo pci_8255_boards[] = { +@@ -126,36 +128,43 @@ static const struct pci_8255_boardinfo p + .name = "ni_pci-dio-96", + .dio_badr = 1, + .n_8255 = 4, ++ .has_mite = 1, + }, + [BOARD_NI_PCIDIO96B] = { + .name = "ni_pci-dio-96b", + .dio_badr = 1, + .n_8255 = 4, ++ .has_mite = 1, + }, + [BOARD_NI_PXI6508] = { + .name = "ni_pxi-6508", + .dio_badr = 1, + .n_8255 = 4, ++ .has_mite = 1, + }, + [BOARD_NI_PCI6503] = { + .name = "ni_pci-6503", + .dio_badr = 1, + .n_8255 = 1, ++ .has_mite = 1, + }, + [BOARD_NI_PCI6503B] = { + .name = "ni_pci-6503b", + .dio_badr = 1, + .n_8255 = 1, ++ .has_mite = 1, + }, + [BOARD_NI_PCI6503X] = { + .name = "ni_pci-6503x", + .dio_badr = 1, + .n_8255 = 1, ++ .has_mite = 1, + }, + [BOARD_NI_PXI_6503] = { + .name = "ni_pxi-6503", + .dio_badr = 1, + .n_8255 = 1, ++ .has_mite = 1, + }, + }; + +@@ -163,6 +172,25 @@ struct pci_8255_private { + void __iomem *mmio_base; + }; + ++static int pci_8255_mite_init(struct pci_dev *pcidev) ++{ ++ void __iomem *mite_base; ++ u32 main_phys_addr; ++ ++ /* ioremap the MITE registers (BAR 0) temporarily */ ++ mite_base = pci_ioremap_bar(pcidev, 0); ++ if (!mite_base) ++ return -ENOMEM; ++ ++ /* set data window to main registers (BAR 1) */ ++ main_phys_addr = pci_resource_start(pcidev, 1); ++ writel(main_phys_addr | WENAB, mite_base + MITE_IODWBSR); ++ ++ /* finished with MITE registers */ ++ iounmap(mite_base); ++ return 0; ++} ++ + static int pci_8255_mmio(int dir, int port, int data, unsigned long iobase) + { + void __iomem *mmio_base = (void __iomem *)iobase; +@@ -201,6 +229,12 @@ static int pci_8255_auto_attach(struct c + if (ret) + return ret; + ++ if (board->has_mite) { ++ ret = pci_8255_mite_init(pcidev); ++ if (ret) ++ return ret; ++ } ++ + is_mmio = (pci_resource_flags(pcidev, board->dio_badr) & + IORESOURCE_MEM) != 0; + if (is_mmio) { diff --git a/queue-3.14/staging-comedi-fix-circular-locking-dependency-in-comedi_mmap.patch b/queue-3.14/staging-comedi-fix-circular-locking-dependency-in-comedi_mmap.patch new file mode 100644 index 00000000000..0b926304dc2 --- /dev/null +++ b/queue-3.14/staging-comedi-fix-circular-locking-dependency-in-comedi_mmap.patch @@ -0,0 +1,245 @@ +From b34aa86f12e8848ba453215602c8c50fa63c4cb3 Mon Sep 17 00:00:00 2001 +From: Ian Abbott +Date: Thu, 10 Apr 2014 19:41:57 +0100 +Subject: staging: comedi: fix circular locking dependency in comedi_mmap() + +From: Ian Abbott + +commit b34aa86f12e8848ba453215602c8c50fa63c4cb3 upstream. + +Mmapping a comedi data buffer with lockdep checking enabled produced the +following kernel debug messages: + +====================================================== +[ INFO: possible circular locking dependency detected ] +3.5.0-rc3-ija1+ #9 Tainted: G C +------------------------------------------------------- +comedi_test/4160 is trying to acquire lock: + (&dev->mutex#2){+.+.+.}, at: [] comedi_mmap+0x57/0x1d9 [comedi] + +but task is already holding lock: + (&mm->mmap_sem){++++++}, at: [] vm_mmap_pgoff+0x41/0x76 + +which lock already depends on the new lock. + +the existing dependency chain (in reverse order) is: + +-> #1 (&mm->mmap_sem){++++++}: + [] lock_acquire+0x97/0x105 + [] might_fault+0x6d/0x90 + [] do_devinfo_ioctl.isra.7+0x11e/0x14c [comedi] + [] comedi_unlocked_ioctl+0x256/0xe48 [comedi] + [] vfs_ioctl+0x18/0x34 + [] do_vfs_ioctl+0x382/0x43c + [] sys_ioctl+0x42/0x65 + [] system_call_fastpath+0x16/0x1b + +-> #0 (&dev->mutex#2){+.+.+.}: + [] __lock_acquire+0x101d/0x1591 + [] lock_acquire+0x97/0x105 + [] mutex_lock_nested+0x46/0x2a4 + [] comedi_mmap+0x57/0x1d9 [comedi] + [] mmap_region+0x281/0x492 + [] do_mmap_pgoff+0x26b/0x2a7 + [] vm_mmap_pgoff+0x5d/0x76 + [] sys_mmap_pgoff+0xc7/0x10d + [] sys_mmap+0x16/0x20 + [] system_call_fastpath+0x16/0x1b + +other info that might help us debug this: + + Possible unsafe locking scenario: + + CPU0 CPU1 + ---- ---- + lock(&mm->mmap_sem); + lock(&dev->mutex#2); + lock(&mm->mmap_sem); + lock(&dev->mutex#2); + + *** DEADLOCK *** + +To avoid the circular dependency, just try to get the lock in +`comedi_mmap()` instead of blocking. Since the comedi device's main mutex +is heavily used, do a down-read of its `attach_lock` rwsemaphore +instead. Trying to down-read `attach_lock` should only fail if +some task has down-write locked it, and that is only done while the +comedi device is being attached to or detached from a low-level hardware +device. + +Unfortunately, acquiring the `attach_lock` doesn't prevent another +task replacing the comedi data buffer we are trying to mmap. The +details of the buffer are held in a `struct comedi_buf_map` and pointed +to by `s->async->buf_map` where `s` is the comedi subdevice whose buffer +we are trying to map. The `struct comedi_buf_map` is already reference +counted with a `struct kref`, so we can stop it being freed prematurely. + +Modify `comedi_mmap()` to call new function +`comedi_buf_map_from_subdev_get()` to read the subdevice's current +buffer map pointer and increment its reference instead of accessing +`async->buf_map` directly. Call `comedi_buf_map_put()` to decrement the +reference once the buffer map structure has been dealt with. (Note that +`comedi_buf_map_put()` does nothing if passed a NULL pointer.) + +`comedi_buf_map_from_subdev_get()` checks the subdevice's buffer map +pointer has been set and the buffer map has been initialized enough for +`comedi_mmap()` to deal with it (specifically, check the `n_pages` +member has been set to a non-zero value). If all is well, the buffer +map's reference is incremented and a pointer to it is returned. The +comedi subdevice's spin-lock is used to protect the checks. Also use +the spin-lock in `__comedi_buf_alloc()` and `__comedi_buf_free()` to +protect changes to the subdevice's buffer map structure pointer and the +buffer map structure's `n_pages` member. (This checking of `n_pages` is +a bit clunky and I [Ian Abbott] plan to deal with it in the future.) + +Signed-off-by: Ian Abbott +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/comedi/comedi_buf.c | 37 +++++++++++++++++++++++++++++-- + drivers/staging/comedi/comedi_fops.c | 18 +++++++++++---- + drivers/staging/comedi/comedi_internal.h | 2 + + 3 files changed, 51 insertions(+), 6 deletions(-) + +--- a/drivers/staging/comedi/comedi_buf.c ++++ b/drivers/staging/comedi/comedi_buf.c +@@ -61,6 +61,8 @@ static void __comedi_buf_free(struct com + struct comedi_subdevice *s) + { + struct comedi_async *async = s->async; ++ struct comedi_buf_map *bm; ++ unsigned long flags; + + if (async->prealloc_buf) { + vunmap(async->prealloc_buf); +@@ -68,8 +70,11 @@ static void __comedi_buf_free(struct com + async->prealloc_bufsz = 0; + } + +- comedi_buf_map_put(async->buf_map); ++ spin_lock_irqsave(&s->spin_lock, flags); ++ bm = async->buf_map; + async->buf_map = NULL; ++ spin_unlock_irqrestore(&s->spin_lock, flags); ++ comedi_buf_map_put(bm); + } + + static void __comedi_buf_alloc(struct comedi_device *dev, +@@ -80,6 +85,7 @@ static void __comedi_buf_alloc(struct co + struct page **pages = NULL; + struct comedi_buf_map *bm; + struct comedi_buf_page *buf; ++ unsigned long flags; + unsigned i; + + if (!IS_ENABLED(CONFIG_HAS_DMA) && s->async_dma_dir != DMA_NONE) { +@@ -92,8 +98,10 @@ static void __comedi_buf_alloc(struct co + if (!bm) + return; + +- async->buf_map = bm; + kref_init(&bm->refcount); ++ spin_lock_irqsave(&s->spin_lock, flags); ++ async->buf_map = bm; ++ spin_unlock_irqrestore(&s->spin_lock, flags); + bm->dma_dir = s->async_dma_dir; + if (bm->dma_dir != DMA_NONE) + /* Need ref to hardware device to free buffer later. */ +@@ -127,7 +135,9 @@ static void __comedi_buf_alloc(struct co + + pages[i] = virt_to_page(buf->virt_addr); + } ++ spin_lock_irqsave(&s->spin_lock, flags); + bm->n_pages = i; ++ spin_unlock_irqrestore(&s->spin_lock, flags); + + /* vmap the prealloc_buf if all the pages were allocated */ + if (i == n_pages) +@@ -150,6 +160,29 @@ int comedi_buf_map_put(struct comedi_buf + return 1; + } + ++/* returns s->async->buf_map and increments its kref refcount */ ++struct comedi_buf_map * ++comedi_buf_map_from_subdev_get(struct comedi_subdevice *s) ++{ ++ struct comedi_async *async = s->async; ++ struct comedi_buf_map *bm = NULL; ++ unsigned long flags; ++ ++ if (!async) ++ return NULL; ++ ++ spin_lock_irqsave(&s->spin_lock, flags); ++ bm = async->buf_map; ++ /* only want it if buffer pages allocated */ ++ if (bm && bm->n_pages) ++ comedi_buf_map_get(bm); ++ else ++ bm = NULL; ++ spin_unlock_irqrestore(&s->spin_lock, flags); ++ ++ return bm; ++} ++ + bool comedi_buf_is_mmapped(struct comedi_async *async) + { + struct comedi_buf_map *bm = async->buf_map; +--- a/drivers/staging/comedi/comedi_fops.c ++++ b/drivers/staging/comedi/comedi_fops.c +@@ -1923,14 +1923,21 @@ static int comedi_mmap(struct file *file + struct comedi_device *dev = file->private_data; + struct comedi_subdevice *s; + struct comedi_async *async; +- struct comedi_buf_map *bm; ++ struct comedi_buf_map *bm = NULL; + unsigned long start = vma->vm_start; + unsigned long size; + int n_pages; + int i; + int retval; + +- mutex_lock(&dev->mutex); ++ /* ++ * 'trylock' avoids circular dependency with current->mm->mmap_sem ++ * and down-reading &dev->attach_lock should normally succeed without ++ * contention unless the device is in the process of being attached ++ * or detached. ++ */ ++ if (!down_read_trylock(&dev->attach_lock)) ++ return -EAGAIN; + + if (!dev->attached) { + dev_dbg(dev->class_dev, "no driver attached\n"); +@@ -1970,7 +1977,9 @@ static int comedi_mmap(struct file *file + } + + n_pages = size >> PAGE_SHIFT; +- bm = async->buf_map; ++ ++ /* get reference to current buf map (if any) */ ++ bm = comedi_buf_map_from_subdev_get(s); + if (!bm || n_pages > bm->n_pages) { + retval = -EINVAL; + goto done; +@@ -1994,7 +2003,8 @@ static int comedi_mmap(struct file *file + + retval = 0; + done: +- mutex_unlock(&dev->mutex); ++ up_read(&dev->attach_lock); ++ comedi_buf_map_put(bm); /* put reference to buf map - okay if NULL */ + return retval; + } + +--- a/drivers/staging/comedi/comedi_internal.h ++++ b/drivers/staging/comedi/comedi_internal.h +@@ -19,6 +19,8 @@ void comedi_buf_reset(struct comedi_asyn + bool comedi_buf_is_mmapped(struct comedi_async *async); + void comedi_buf_map_get(struct comedi_buf_map *bm); + int comedi_buf_map_put(struct comedi_buf_map *bm); ++struct comedi_buf_map *comedi_buf_map_from_subdev_get( ++ struct comedi_subdevice *s); + unsigned int comedi_buf_write_n_allocated(struct comedi_async *async); + void comedi_device_cancel_all(struct comedi_device *dev); + diff --git a/queue-3.14/tty-fix-low_latency-bug.patch b/queue-3.14/tty-fix-low_latency-bug.patch new file mode 100644 index 00000000000..74d0f0f1468 --- /dev/null +++ b/queue-3.14/tty-fix-low_latency-bug.patch @@ -0,0 +1,155 @@ +From a9c3f68f3cd8d55f809fbdb0c138ed061ea1bd25 Mon Sep 17 00:00:00 2001 +From: Peter Hurley +Date: Sat, 22 Feb 2014 07:31:21 -0500 +Subject: tty: Fix low_latency BUG + +From: Peter Hurley + +commit a9c3f68f3cd8d55f809fbdb0c138ed061ea1bd25 upstream. + +The user-settable knob, low_latency, has been the source of +several BUG reports which stem from flush_to_ldisc() running +in interrupt context. Since 3.12, which added several sleeping +locks (termios_rwsem and buf->lock) to the input processing path, +the frequency of these BUG reports has increased. + +Note that changes in 3.12 did not introduce this regression; +sleeping locks were first added to the input processing path +with the removal of the BKL from N_TTY in commit +a88a69c91256418c5907c2f1f8a0ec0a36f9e6cc, +'n_tty: Fix loss of echoed characters and remove bkl from n_tty' +and later in commit 38db89799bdf11625a831c5af33938dcb11908b6, +'tty: throttling race fix'. Since those changes, executing +flush_to_ldisc() in interrupt_context (ie, low_latency set), is unsafe. + +However, since most devices do not validate if the low_latency +setting is appropriate for the context (process or interrupt) in +which they receive data, some reports are due to misconfiguration. +Further, serial dma devices for which dma fails, resort to +interrupt receiving as a backup without resetting low_latency. + +Historically, low_latency was used to force wake-up the reading +process rather than wait for the next scheduler tick. The +effect was to trim multiple milliseconds of latency from +when the process would receive new data. + +Recent tests [1] have shown that the reading process now receives +data with only 10's of microseconds latency without low_latency set. + +Remove the low_latency rx steering from tty_flip_buffer_push(); +however, leave the knob as an optional hint to drivers that can +tune their rx fifos and such like. Cleanup stale code comments +regarding low_latency. + +[1] https://lkml.org/lkml/2014/2/20/434 + +"Yay.. thats an annoying historical pain in the butt gone." + -- Alan Cox + +Reported-by: Beat Bolli +Reported-by: Pavel Roskin +Acked-by: David Sterba +Cc: Grant Edwards +Cc: Stanislaw Gruszka +Cc: Hal Murray +Signed-off-by: Peter Hurley +Signed-off-by: Alan Cox +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/ipwireless/tty.c | 3 --- + drivers/tty/tty_buffer.c | 20 ++++---------------- + drivers/usb/gadget/u_serial.c | 4 ++-- + include/linux/tty.h | 2 +- + 4 files changed, 7 insertions(+), 22 deletions(-) + +--- a/drivers/tty/ipwireless/tty.c ++++ b/drivers/tty/ipwireless/tty.c +@@ -176,9 +176,6 @@ void ipwireless_tty_received(struct ipw_ + ": %d chars not inserted to flip buffer!\n", + length - work); + +- /* +- * This may sleep if ->low_latency is set +- */ + if (work) + tty_flip_buffer_push(&tty->port); + } +--- a/drivers/tty/tty_buffer.c ++++ b/drivers/tty/tty_buffer.c +@@ -351,14 +351,11 @@ EXPORT_SYMBOL(tty_insert_flip_string_fla + * Takes any pending buffers and transfers their ownership to the + * ldisc side of the queue. It then schedules those characters for + * processing by the line discipline. +- * Note that this function can only be used when the low_latency flag +- * is unset. Otherwise the workqueue won't be flushed. + */ + + void tty_schedule_flip(struct tty_port *port) + { + struct tty_bufhead *buf = &port->buf; +- WARN_ON(port->low_latency); + + buf->tail->commit = buf->tail->used; + schedule_work(&buf->work); +@@ -482,17 +479,15 @@ static void flush_to_ldisc(struct work_s + */ + void tty_flush_to_ldisc(struct tty_struct *tty) + { +- if (!tty->port->low_latency) +- flush_work(&tty->port->buf.work); ++ flush_work(&tty->port->buf.work); + } + + /** + * tty_flip_buffer_push - terminal + * @port: tty port to push + * +- * Queue a push of the terminal flip buffers to the line discipline. This +- * function must not be called from IRQ context if port->low_latency is +- * set. ++ * Queue a push of the terminal flip buffers to the line discipline. ++ * Can be called from IRQ/atomic context. + * + * In the event of the queue being busy for flipping the work will be + * held off and retried later. +@@ -500,14 +495,7 @@ void tty_flush_to_ldisc(struct tty_struc + + void tty_flip_buffer_push(struct tty_port *port) + { +- struct tty_bufhead *buf = &port->buf; +- +- buf->tail->commit = buf->tail->used; +- +- if (port->low_latency) +- flush_to_ldisc(&buf->work); +- else +- schedule_work(&buf->work); ++ tty_schedule_flip(port); + } + EXPORT_SYMBOL(tty_flip_buffer_push); + +--- a/drivers/usb/gadget/u_serial.c ++++ b/drivers/usb/gadget/u_serial.c +@@ -549,8 +549,8 @@ static void gs_rx_push(unsigned long _po + port->read_started--; + } + +- /* Push from tty to ldisc; without low_latency set this is handled by +- * a workqueue, so we won't get callbacks and can hold port_lock ++ /* Push from tty to ldisc; this is handled by a workqueue, ++ * so we won't get callbacks and can hold port_lock + */ + if (do_push) + tty_flip_buffer_push(&port->port); +--- a/include/linux/tty.h ++++ b/include/linux/tty.h +@@ -208,7 +208,7 @@ struct tty_port { + wait_queue_head_t delta_msr_wait; /* Modem status change */ + unsigned long flags; /* TTY flags ASY_*/ + unsigned char console:1, /* port is a console */ +- low_latency:1; /* direct buffer flush */ ++ low_latency:1; /* optional: tune for latency */ + struct mutex mutex; /* Locking */ + struct mutex buf_mutex; /* Buffer alloc lock */ + unsigned char *xmit_buf; /* Optional buffer */ diff --git a/queue-3.14/tty-set-correct-tty-name-in-active-sysfs-attribute.patch b/queue-3.14/tty-set-correct-tty-name-in-active-sysfs-attribute.patch new file mode 100644 index 00000000000..bd8f0982ba7 --- /dev/null +++ b/queue-3.14/tty-set-correct-tty-name-in-active-sysfs-attribute.patch @@ -0,0 +1,75 @@ +From 723abd87f6e536f1353c8f64f621520bc29523a3 Mon Sep 17 00:00:00 2001 +From: Hannes Reinecke +Date: Thu, 27 Feb 2014 12:30:51 +0100 +Subject: tty: Set correct tty name in 'active' sysfs attribute + +From: Hannes Reinecke + +commit 723abd87f6e536f1353c8f64f621520bc29523a3 upstream. + +The 'active' sysfs attribute should refer to the currently active tty +devices the console is running on, not the currently active console. The +console structure doesn't refer to any device in sysfs, only the tty the +console is running on has. So we need to print out the tty names in +'active', not the console names. + +There is one special-case, which is tty0. If the console is directed to +it, we want 'tty0' to show up in the file, so user-space knows that the +messages get forwarded to the active VT. The ->device() callback would +resolve tty0, though. Hence, treat it special and don't call into the VT +layer to resolve it (plymouth is known to depend on it). + +Cc: Lennart Poettering +Cc: Kay Sievers +Cc: Jiri Slaby +Signed-off-by: Werner Fink +Signed-off-by: Hannes Reinecke +Signed-off-by: David Herrmann +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/tty_io.c | 23 +++++++++++++++++------ + 1 file changed, 17 insertions(+), 6 deletions(-) + +--- a/drivers/tty/tty_io.c ++++ b/drivers/tty/tty_io.c +@@ -1271,12 +1271,13 @@ static void pty_line_name(struct tty_dri + * + * Locking: None + */ +-static void tty_line_name(struct tty_driver *driver, int index, char *p) ++static ssize_t tty_line_name(struct tty_driver *driver, int index, char *p) + { + if (driver->flags & TTY_DRIVER_UNNUMBERED_NODE) +- strcpy(p, driver->name); ++ return sprintf(p, "%s", driver->name); + else +- sprintf(p, "%s%d", driver->name, index + driver->name_base); ++ return sprintf(p, "%s%d", driver->name, ++ index + driver->name_base); + } + + /** +@@ -3545,9 +3546,19 @@ static ssize_t show_cons_active(struct d + if (i >= ARRAY_SIZE(cs)) + break; + } +- while (i--) +- count += sprintf(buf + count, "%s%d%c", +- cs[i]->name, cs[i]->index, i ? ' ':'\n'); ++ while (i--) { ++ int index = cs[i]->index; ++ struct tty_driver *drv = cs[i]->device(cs[i], &index); ++ ++ /* don't resolve tty0 as some programs depend on it */ ++ if (drv && (cs[i]->index > 0 || drv->major != TTY_MAJOR)) ++ count += tty_line_name(drv, index, buf + count); ++ else ++ count += sprintf(buf + count, "%s%d", ++ cs[i]->name, cs[i]->index); ++ ++ count += sprintf(buf + count, "%c", i ? ' ':'\n'); ++ } + console_unlock(); + + return count; diff --git a/queue-3.14/x86-adjust-irq-remapping-quirk-for-older-revisions-of-5500-5520-chipsets.patch b/queue-3.14/x86-adjust-irq-remapping-quirk-for-older-revisions-of-5500-5520-chipsets.patch new file mode 100644 index 00000000000..40ce083e740 --- /dev/null +++ b/queue-3.14/x86-adjust-irq-remapping-quirk-for-older-revisions-of-5500-5520-chipsets.patch @@ -0,0 +1,64 @@ +From 6f8a1b335fde143b7407036e2368d3cd6eb55674 Mon Sep 17 00:00:00 2001 +From: Neil Horman +Date: Wed, 12 Mar 2014 14:44:33 -0400 +Subject: x86: Adjust irq remapping quirk for older revisions of 5500/5520 chipsets + +From: Neil Horman + +commit 6f8a1b335fde143b7407036e2368d3cd6eb55674 upstream. + +Commit 03bbcb2e7e2 (iommu/vt-d: add quirk for broken interrupt +remapping on 55XX chipsets) properly disables irq remapping on the +5500/5520 chipsets that don't correctly perform that feature. + +However, when I wrote it, I followed the errata sheet linked in that +commit too closely, and explicitly tied the activation of the quirk to +revision 0x13 of the chip, under the assumption that earlier revisions +were not in the field. Recently a system was reported to be suffering +from this remap bug and the quirk hadn't triggered, because the +revision id register read at a lower value that 0x13, so the quirk +test failed improperly. Given this, it seems only prudent to adjust +this quirk so that any revision less than 0x13 has the quirk asserted. + +[ tglx: Removed the 0x12 comparison of pci id 3405 as this is covered + by the <= 0x13 check already ] + +Signed-off-by: Neil Horman +Cc: Ingo Molnar +Cc: "H. Peter Anvin" +Cc: x86@kernel.org +Link: http://lkml.kernel.org/r/1394649873-14913-1-git-send-email-nhorman@tuxdriver.com +Signed-off-by: Thomas Gleixner +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/early-quirks.c | 15 ++++++--------- + 1 file changed, 6 insertions(+), 9 deletions(-) + +--- a/arch/x86/kernel/early-quirks.c ++++ b/arch/x86/kernel/early-quirks.c +@@ -203,18 +203,15 @@ static void __init intel_remapping_check + revision = read_pci_config_byte(num, slot, func, PCI_REVISION_ID); + + /* +- * Revision 13 of all triggering devices id in this quirk have +- * a problem draining interrupts when irq remapping is enabled, +- * and should be flagged as broken. Additionally revisions 0x12 +- * and 0x22 of device id 0x3405 has this problem. ++ * Revision <= 13 of all triggering devices id in this quirk ++ * have a problem draining interrupts when irq remapping is ++ * enabled, and should be flagged as broken. Additionally ++ * revision 0x22 of device id 0x3405 has this problem. + */ +- if (revision == 0x13) ++ if (revision <= 0x13) + set_irq_remapping_broken(); +- else if ((device == 0x3405) && +- ((revision == 0x12) || +- (revision == 0x22))) ++ else if (device == 0x3405 && revision == 0x22) + set_irq_remapping_broken(); +- + } + + /* diff --git a/queue-3.14/x86-hyperv-bypass-the-timer_irq_works-check.patch b/queue-3.14/x86-hyperv-bypass-the-timer_irq_works-check.patch new file mode 100644 index 00000000000..0cdeb1fd16e --- /dev/null +++ b/queue-3.14/x86-hyperv-bypass-the-timer_irq_works-check.patch @@ -0,0 +1,54 @@ +From ca3ba2a2f4a49a308e7d78c784d51b2332064f15 Mon Sep 17 00:00:00 2001 +From: Jason Wang +Date: Fri, 28 Feb 2014 11:30:29 +0800 +Subject: x86, hyperv: Bypass the timer_irq_works() check + +From: Jason Wang + +commit ca3ba2a2f4a49a308e7d78c784d51b2332064f15 upstream. + +This patch bypass the timer_irq_works() check for hyperv guest since: + +- It was guaranteed to work. +- timer_irq_works() may fail sometime due to the lpj calibration were inaccurate + in a hyperv guest or a buggy host. + +In the future, we should get the tsc frequency from hypervisor and use preset +lpj instead. + +[ hpa: I would prefer to not defer things to "the future" in the future... ] + +Cc: K. Y. Srinivasan +Cc: Haiyang Zhang +Acked-by: K. Y. Srinivasan +Signed-off-by: Jason Wang +Link: http://lkml.kernel.org/r/1393558229-14755-1-git-send-email-jasowang@redhat.com +Signed-off-by: H. Peter Anvin +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/cpu/mshyperv.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/arch/x86/kernel/cpu/mshyperv.c ++++ b/arch/x86/kernel/cpu/mshyperv.c +@@ -26,6 +26,7 @@ + #include + #include + #include ++#include + + struct ms_hyperv_info ms_hyperv; + EXPORT_SYMBOL_GPL(ms_hyperv); +@@ -105,6 +106,11 @@ static void __init ms_hyperv_init_platfo + + if (ms_hyperv.features & HV_X64_MSR_TIME_REF_COUNT_AVAILABLE) + clocksource_register_hz(&hyperv_cs, NSEC_PER_SEC/100); ++ ++#ifdef CONFIG_X86_IO_APIC ++ no_timer_check = 1; ++#endif ++ + } + + const __refconst struct hypervisor_x86 x86_hyper_ms_hyperv = { diff --git a/queue-3.14/xfs-fix-directory-hash-ordering-bug.patch b/queue-3.14/xfs-fix-directory-hash-ordering-bug.patch new file mode 100644 index 00000000000..a26a89ccf94 --- /dev/null +++ b/queue-3.14/xfs-fix-directory-hash-ordering-bug.patch @@ -0,0 +1,55 @@ +From c88547a8119e3b581318ab65e9b72f27f23e641d Mon Sep 17 00:00:00 2001 +From: Mark Tinguely +Date: Fri, 4 Apr 2014 07:10:49 +1100 +Subject: xfs: fix directory hash ordering bug + +From: Mark Tinguely + +commit c88547a8119e3b581318ab65e9b72f27f23e641d upstream. + +Commit f5ea1100 ("xfs: add CRCs to dir2/da node blocks") introduced +in 3.10 incorrectly converted the btree hash index array pointer in +xfs_da3_fixhashpath(). It resulted in the the current hash always +being compared against the first entry in the btree rather than the +current block index into the btree block's hash entry array. As a +result, it was comparing the wrong hashes, and so could misorder the +entries in the btree. + +For most cases, this doesn't cause any problems as it requires hash +collisions to expose the ordering problem. However, when there are +hash collisions within a directory there is a very good probability +that the entries will be ordered incorrectly and that actually +matters when duplicate hashes are placed into or removed from the +btree block hash entry array. + +This bug results in an on-disk directory corruption and that results +in directory verifier functions throwing corruption warnings into +the logs. While no data or directory entries are lost, access to +them may be compromised, and attempts to remove entries from a +directory that has suffered from this corruption may result in a +filesystem shutdown. xfs_repair will fix the directory hash +ordering without data loss occuring. + +[dchinner: wrote useful a commit message] + +Reported-by: Hannes Frederic Sowa +Signed-off-by: Mark Tinguely +Reviewed-by: Ben Myers +Signed-off-by: Dave Chinner +Signed-off-by: Greg Kroah-Hartman + +--- + fs/xfs/xfs_da_btree.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/xfs/xfs_da_btree.c ++++ b/fs/xfs/xfs_da_btree.c +@@ -1295,7 +1295,7 @@ xfs_da3_fixhashpath( + node = blk->bp->b_addr; + dp->d_ops->node_hdr_from_disk(&nodehdr, node); + btree = dp->d_ops->node_tree_p(node); +- if (be32_to_cpu(btree->hashval) == lasthash) ++ if (be32_to_cpu(btree[blk->index].hashval) == lasthash) + break; + blk->hashval = lasthash; + btree[blk->index].hashval = cpu_to_be32(lasthash);