diff options
21 files changed, 661 insertions, 1181 deletions
diff --git a/0001-ACPI-processor-Request-native-thermal-interrupt-hand.patch b/0001-ACPI-processor-Request-native-thermal-interrupt-hand.patch new file mode 100644 index 000000000..a76603900 --- /dev/null +++ b/0001-ACPI-processor-Request-native-thermal-interrupt-hand.patch @@ -0,0 +1,169 @@ +From a21211672c9a1d730a39aa65d4a5b3414700adfb Mon Sep 17 00:00:00 2001 +From: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com> +Date: Wed, 23 Mar 2016 21:07:39 -0700 +Subject: [PATCH] ACPI / processor: Request native thermal interrupt handling + via _OSC + +There are several reports of freeze on enabling HWP (Hardware PStates) +feature on Skylake-based systems by the Intel P-states driver. The root +cause is identified as the HWP interrupts causing BIOS code to freeze. + +HWP interrupts use the thermal LVT which can be handled by Linux +natively, but on the affected Skylake-based systems SMM will respond +to it by default. This is a problem for several reasons: + - On the affected systems the SMM thermal LVT handler is broken (it + will crash when invoked) and a BIOS update is necessary to fix it. + - With thermal interrupt handled in SMM we lose all of the reporting + features of the arch/x86/kernel/cpu/mcheck/therm_throt driver. + - Some thermal drivers like x86-package-temp depend on the thermal + threshold interrupts signaled via the thermal LVT. + - The HWP interrupts are useful for debugging and tuning + performance (if the kernel can handle them). +The native handling of thermal interrupts needs to be enabled +because of that. + +This requires some way to tell SMM that the OS can handle thermal +interrupts. That can be done by using _OSC/_PDC in processor +scope very early during ACPI initialization. + +The meaning of _OSC/_PDC bit 12 in processor scope is whether or +not the OS supports native handling of interrupts for Collaborative +Processor Performance Control (CPPC) notifications. Since on +HWP-capable systems CPPC is a firmware interface to HWP, setting +this bit effectively tells the firmware that the OS will handle +thermal interrupts natively going forward. + +For details on _OSC/_PDC refer to: +http://www.intel.com/content/www/us/en/standards/processor-vendor-specific-acpi-specification.html + +To implement the _OSC/_PDC handshake as described, introduce a new +function, acpi_early_processor_osc(), that walks the ACPI +namespace looking for ACPI processor objects and invokes _OSC for +them with bit 12 in the capabilities buffer set and terminates the +namespace walk on the first success. + +Also modify intel_thermal_interrupt() to clear HWP status bits in +the HWP_STATUS MSR to acknowledge HWP interrupts (which prevents +them from firing continuously). + +Signed-off-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com> +[ rjw: Subject & changelog, function rename ] +Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> +--- + arch/x86/kernel/cpu/mcheck/therm_throt.c | 3 ++ + drivers/acpi/acpi_processor.c | 52 ++++++++++++++++++++++++++++++++ + drivers/acpi/bus.c | 3 ++ + drivers/acpi/internal.h | 6 ++++ + 4 files changed, 64 insertions(+) + +diff --git a/arch/x86/kernel/cpu/mcheck/therm_throt.c b/arch/x86/kernel/cpu/mcheck/therm_throt.c +index 2c5aaf8..0553858 100644 +--- a/arch/x86/kernel/cpu/mcheck/therm_throt.c ++++ b/arch/x86/kernel/cpu/mcheck/therm_throt.c +@@ -385,6 +385,9 @@ static void intel_thermal_interrupt(void) + { + __u64 msr_val; + ++ if (static_cpu_has(X86_FEATURE_HWP)) ++ wrmsrl_safe(MSR_HWP_STATUS, 0); ++ + rdmsrl(MSR_IA32_THERM_STATUS, msr_val); + + /* Check for violation of core thermal thresholds*/ +diff --git a/drivers/acpi/acpi_processor.c b/drivers/acpi/acpi_processor.c +index b5e54f2..0d92d0f 100644 +--- a/drivers/acpi/acpi_processor.c ++++ b/drivers/acpi/acpi_processor.c +@@ -491,6 +491,58 @@ static void acpi_processor_remove(struct acpi_device *device) + } + #endif /* CONFIG_ACPI_HOTPLUG_CPU */ + ++#ifdef CONFIG_X86 ++static bool acpi_hwp_native_thermal_lvt_set; ++static acpi_status __init acpi_hwp_native_thermal_lvt_osc(acpi_handle handle, ++ u32 lvl, ++ void *context, ++ void **rv) ++{ ++ u8 sb_uuid_str[] = "4077A616-290C-47BE-9EBD-D87058713953"; ++ u32 capbuf[2]; ++ struct acpi_osc_context osc_context = { ++ .uuid_str = sb_uuid_str, ++ .rev = 1, ++ .cap.length = 8, ++ .cap.pointer = capbuf, ++ }; ++ ++ if (acpi_hwp_native_thermal_lvt_set) ++ return AE_CTRL_TERMINATE; ++ ++ capbuf[0] = 0x0000; ++ capbuf[1] = 0x1000; /* set bit 12 */ ++ ++ if (ACPI_SUCCESS(acpi_run_osc(handle, &osc_context))) { ++ if (osc_context.ret.pointer && osc_context.ret.length > 1) { ++ u32 *capbuf_ret = osc_context.ret.pointer; ++ ++ if (capbuf_ret[1] & 0x1000) { ++ acpi_handle_info(handle, ++ "_OSC native thermal LVT Acked\n"); ++ acpi_hwp_native_thermal_lvt_set = true; ++ } ++ } ++ kfree(osc_context.ret.pointer); ++ } ++ ++ return AE_OK; ++} ++ ++void __init acpi_early_processor_osc(void) ++{ ++ if (boot_cpu_has(X86_FEATURE_HWP)) { ++ acpi_walk_namespace(ACPI_TYPE_PROCESSOR, ACPI_ROOT_OBJECT, ++ ACPI_UINT32_MAX, ++ acpi_hwp_native_thermal_lvt_osc, ++ NULL, NULL, NULL); ++ acpi_get_devices(ACPI_PROCESSOR_DEVICE_HID, ++ acpi_hwp_native_thermal_lvt_osc, ++ NULL, NULL); ++ } ++} ++#endif ++ + /* + * The following ACPI IDs are known to be suitable for representing as + * processor devices. +diff --git a/drivers/acpi/bus.c b/drivers/acpi/bus.c +index 891c42d..f9081b7 100644 +--- a/drivers/acpi/bus.c ++++ b/drivers/acpi/bus.c +@@ -1005,6 +1005,9 @@ static int __init acpi_bus_init(void) + goto error1; + } + ++ /* Set capability bits for _OSC under processor scope */ ++ acpi_early_processor_osc(); ++ + /* + * _OSC method may exist in module level code, + * so it must be run after ACPI_FULL_INITIALIZATION +diff --git a/drivers/acpi/internal.h b/drivers/acpi/internal.h +index 1e6833a..6f41c73 100644 +--- a/drivers/acpi/internal.h ++++ b/drivers/acpi/internal.h +@@ -138,6 +138,12 @@ void acpi_early_processor_set_pdc(void); + static inline void acpi_early_processor_set_pdc(void) {} + #endif + ++#ifdef CONFIG_X86 ++void acpi_early_processor_osc(void); ++#else ++static inline void acpi_early_processor_osc(void) {} ++#endif ++ + /* -------------------------------------------------------------------------- + Embedded Controller + -------------------------------------------------------------------------- */ +-- +2.5.5 + diff --git a/0001-cdc-acm-fix-NULL-pointer-reference.patch b/0001-cdc-acm-fix-NULL-pointer-reference.patch deleted file mode 100644 index 3d63411c0..000000000 --- a/0001-cdc-acm-fix-NULL-pointer-reference.patch +++ /dev/null @@ -1,46 +0,0 @@ -From 29c6dd591bbd592472247441de9fa694acdabae8 Mon Sep 17 00:00:00 2001 -From: Oliver Neukum <oneukum@suse.com> -Date: Thu, 7 Jan 2016 11:01:00 +0100 -Subject: [PATCH] cdc-acm: fix NULL pointer reference - -The union descriptor must be checked. Its usage was conditional -before the parser was introduced. This is important, because -many RNDIS device, which also use the common parser, have -bogus extra descriptors. - -Signed-off-by: Oliver Neukum <oneukum@suse.com> -Tested-by: Vasily Galkin <galkin-vv@yandex.ru> -Signed-off-by: David S. Miller <davem@davemloft.net> ---- - drivers/net/usb/cdc_ether.c | 8 +++++++- - 1 file changed, 7 insertions(+), 1 deletion(-) - -diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c -index 3da70bf..7cba2c3 100644 ---- a/drivers/net/usb/cdc_ether.c -+++ b/drivers/net/usb/cdc_ether.c -@@ -160,6 +160,12 @@ int usbnet_generic_cdc_bind(struct usbnet *dev, struct usb_interface *intf) - info->u = header.usb_cdc_union_desc; - info->header = header.usb_cdc_header_desc; - info->ether = header.usb_cdc_ether_desc; -+ if (!info->u) { -+ if (rndis) -+ goto skip; -+ else /* in that case a quirk is mandatory */ -+ goto bad_desc; -+ } - /* we need a master/control interface (what we're - * probed with) and a slave/data interface; union - * descriptors sort this all out. -@@ -256,7 +262,7 @@ skip: - goto bad_desc; - } - -- } else if (!info->header || !info->u || (!rndis && !info->ether)) { -+ } else if (!info->header || (!rndis && !info->ether)) { - dev_dbg(&intf->dev, "missing cdc %s%s%sdescriptor\n", - info->header ? "" : "header ", - info->u ? "" : "union ", --- -2.5.0 - diff --git a/0001-gpu-ipu-v3-Fix-imx-ipuv3-crtc-module-autoloading.patch b/0001-gpu-ipu-v3-Fix-imx-ipuv3-crtc-module-autoloading.patch new file mode 100644 index 000000000..d26c5d52d --- /dev/null +++ b/0001-gpu-ipu-v3-Fix-imx-ipuv3-crtc-module-autoloading.patch @@ -0,0 +1,37 @@ +From 88fd0f33c3cc5aa6a26f56902241941ac717e9f8 Mon Sep 17 00:00:00 2001 +From: Peter Robinson <pbrobinson@gmail.com> +Date: Wed, 27 Apr 2016 13:44:05 +0100 +Subject: [PATCH] gpu: ipu-v3: Fix imx-ipuv3-crtc module autoloading + +--- + drivers/gpu/ipu-v3/ipu-common.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/ipu-v3/ipu-common.c b/drivers/gpu/ipu-v3/ipu-common.c +index e00db3f..abb98c7 100644 +--- a/drivers/gpu/ipu-v3/ipu-common.c ++++ b/drivers/gpu/ipu-v3/ipu-common.c +@@ -1068,7 +1068,6 @@ static int ipu_add_client_devices(struct ipu_soc *ipu, unsigned long ipu_base) + goto err_register; + } + +- pdev->dev.of_node = of_node; + pdev->dev.parent = dev; + + ret = platform_device_add_data(pdev, ®->pdata, +@@ -1079,6 +1078,12 @@ static int ipu_add_client_devices(struct ipu_soc *ipu, unsigned long ipu_base) + platform_device_put(pdev); + goto err_register; + } ++ ++ /* ++ * Set of_node only after calling platform_device_add. Otherwise ++ * the platform:imx-ipuv3-crtc modalias won't be used. ++ */ ++ pdev->dev.of_node = of_node; + } + + return 0; +-- +2.7.4 + diff --git a/0001-uas-Limit-qdepth-at-the-scsi-host-level.patch b/0001-uas-Limit-qdepth-at-the-scsi-host-level.patch deleted file mode 100644 index b6c446829..000000000 --- a/0001-uas-Limit-qdepth-at-the-scsi-host-level.patch +++ /dev/null @@ -1,45 +0,0 @@ -From 79abe2bd501d628b165f323098d6972d69bd13d7 Mon Sep 17 00:00:00 2001 -From: Hans de Goede <hdegoede@redhat.com> -Date: Wed, 16 Mar 2016 13:20:51 +0100 -Subject: [PATCH] uas: Limit qdepth at the scsi-host level - -Commit 64d513ac31bd ("scsi: use host wide tags by default") causes -the scsi-core to queue more cmnds then we can handle on devices with -multiple LUNs, limit the qdepth at the scsi-host level instead of -per slave to fix this. - -BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1315013 -Cc: stable@vger.kernel.org # 4.4.x and 4.5.x -Signed-off-by: Hans de Goede <hdegoede@redhat.com> ---- - drivers/usb/storage/uas.c | 7 ++++++- - 1 file changed, 6 insertions(+), 1 deletion(-) - -diff --git a/drivers/usb/storage/uas.c b/drivers/usb/storage/uas.c -index c90a7e4..b5cb7ab 100644 ---- a/drivers/usb/storage/uas.c -+++ b/drivers/usb/storage/uas.c -@@ -800,7 +800,6 @@ static int uas_slave_configure(struct scsi_device *sdev) - if (devinfo->flags & US_FL_BROKEN_FUA) - sdev->broken_fua = 1; - -- scsi_change_queue_depth(sdev, devinfo->qdepth - 2); - return 0; - } - -@@ -932,6 +931,12 @@ static int uas_probe(struct usb_interface *intf, const struct usb_device_id *id) - if (result) - goto set_alt0; - -+ /* -+ * 1 tag is reserved for untagged commands + -+ * 1 tag to avoid of by one errors in some bridge firmwares -+ */ -+ shost->can_queue = devinfo->qdepth - 2; -+ - usb_set_intfdata(intf, shost); - result = scsi_add_host(shost, &intf->dev); - if (result) --- -2.7.3 - diff --git a/09-29-drm-udl-Use-unlocked-gem-unreferencing.patch b/09-29-drm-udl-Use-unlocked-gem-unreferencing.patch deleted file mode 100644 index e2dbabe83..000000000 --- a/09-29-drm-udl-Use-unlocked-gem-unreferencing.patch +++ /dev/null @@ -1,58 +0,0 @@ -From patchwork Mon Nov 23 09:32:42 2015 -Content-Type: text/plain; charset="utf-8" -MIME-Version: 1.0 -Content-Transfer-Encoding: 7bit -Subject: [09/29] drm/udl: Use unlocked gem unreferencing -From: Daniel Vetter <daniel.vetter@ffwll.ch> -X-Patchwork-Id: 65722 -Message-Id: <1448271183-20523-10-git-send-email-daniel.vetter@ffwll.ch> -To: DRI Development <dri-devel@lists.freedesktop.org> -Cc: Daniel Vetter <daniel.vetter@intel.com>, - Daniel Vetter <daniel.vetter@ffwll.ch>, - Intel Graphics Development <intel-gfx@lists.freedesktop.org>, - Dave Airlie <airlied@redhat.com> -Date: Mon, 23 Nov 2015 10:32:42 +0100 - -For drm_gem_object_unreference callers are required to hold -dev->struct_mutex, which these paths don't. Enforcing this requirement -has become a bit more strict with - -commit ef4c6270bf2867e2f8032e9614d1a8cfc6c71663 -Author: Daniel Vetter <daniel.vetter@ffwll.ch> -Date: Thu Oct 15 09:36:25 2015 +0200 - - drm/gem: Check locking in drm_gem_object_unreference - -Cc: Dave Airlie <airlied@redhat.com> -Signed-off-by: Daniel Vetter <daniel.vetter@intel.com> ---- - drivers/gpu/drm/udl/udl_fb.c | 2 +- - drivers/gpu/drm/udl/udl_gem.c | 2 +- - 2 files changed, 2 insertions(+), 2 deletions(-) - -diff --git a/drivers/gpu/drm/udl/udl_fb.c b/drivers/gpu/drm/udl/udl_fb.c -index 200419d4d43c..18a2acbccb7d 100644 ---- a/drivers/gpu/drm/udl/udl_fb.c -+++ b/drivers/gpu/drm/udl/udl_fb.c -@@ -538,7 +538,7 @@ static int udlfb_create(struct drm_fb_helper *helper, - out_destroy_fbi: - drm_fb_helper_release_fbi(helper); - out_gfree: -- drm_gem_object_unreference(&ufbdev->ufb.obj->base); -+ drm_gem_object_unreference_unlocked(&ufbdev->ufb.obj->base); - out: - return ret; - } -diff --git a/drivers/gpu/drm/udl/udl_gem.c b/drivers/gpu/drm/udl/udl_gem.c -index 2a0a784ab6ee..d7528e0d8442 100644 ---- a/drivers/gpu/drm/udl/udl_gem.c -+++ b/drivers/gpu/drm/udl/udl_gem.c -@@ -52,7 +52,7 @@ udl_gem_create(struct drm_file *file, - return ret; - } - -- drm_gem_object_unreference(&obj->base); -+ drm_gem_object_unreference_unlocked(&obj->base); - *handle_p = handle; - return 0; - } diff --git a/USB-usbfs-fix-potential-infoleak-in-devio.patch b/USB-usbfs-fix-potential-infoleak-in-devio.patch new file mode 100644 index 000000000..48360c930 --- /dev/null +++ b/USB-usbfs-fix-potential-infoleak-in-devio.patch @@ -0,0 +1,41 @@ +From 7adc5cbc25dcc47dc3856108d9823d08da75da9d Mon Sep 17 00:00:00 2001 +From: Kangjie Lu <kangjielu@gmail.com> +Date: Tue, 3 May 2016 16:32:16 -0400 +Subject: [PATCH] USB: usbfs: fix potential infoleak in devio +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +The stack object “ci” has a total size of 8 bytes. Its last 3 bytes +are padding bytes which are not initialized and leaked to userland +via “copy_to_user”. + +Signed-off-by: Kangjie Lu <kjlu@gatech.edu> +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +--- + drivers/usb/core/devio.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c +index 52c4461dfccd..9b7f1f75e887 100644 +--- a/drivers/usb/core/devio.c ++++ b/drivers/usb/core/devio.c +@@ -1316,10 +1316,11 @@ static int proc_getdriver(struct usb_dev_state *ps, void __user *arg) + + static int proc_connectinfo(struct usb_dev_state *ps, void __user *arg) + { +- struct usbdevfs_connectinfo ci = { +- .devnum = ps->dev->devnum, +- .slow = ps->dev->speed == USB_SPEED_LOW +- }; ++ struct usbdevfs_connectinfo ci; ++ ++ memset(&ci, 0, sizeof(ci)); ++ ci.devnum = ps->dev->devnum; ++ ci.slow = ps->dev->speed == USB_SPEED_LOW; + + if (copy_to_user(arg, &ci, sizeof(ci))) + return -EFAULT; +-- +2.5.5 + diff --git a/antenna_select.patch b/antenna_select.patch new file mode 100644 index 000000000..15763e9bc --- /dev/null +++ b/antenna_select.patch @@ -0,0 +1,227 @@ +From c18d8f5095715c56bb3cd9cba64242542632054b Mon Sep 17 00:00:00 2001 +From: Larry Finger <Larry.Finger@lwfinger.net> +Date: Wed, 16 Mar 2016 13:33:34 -0500 +Subject: rtlwifi: rtl8723be: Add antenna select module parameter + +A number of new laptops have been delivered with only a single antenna. +In principle, this is OK; however, a problem arises when the on-board +EEPROM is programmed to use the other antenna connection. The option +of opening the computer and moving the connector is not always possible +as it will void the warranty in some cases. In addition, this solution +breaks the Windows driver when the box dual boots Linux and Windows. + +A fix involving a new module parameter has been developed. This commit +adds the new parameter and implements the changes needed for the driver. + +Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net> +Cc: Stable <stable@vger.kernel.org> [V4.0+] +Signed-off-by: Kalle Valo <kvalo@codeaurora.org> +--- + drivers/net/wireless/realtek/rtlwifi/rtl8723be/hw.c | 5 +++++ + drivers/net/wireless/realtek/rtlwifi/rtl8723be/sw.c | 3 +++ + drivers/net/wireless/realtek/rtlwifi/wifi.h | 3 +++ + 3 files changed, 11 insertions(+) + +diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8723be/hw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8723be/hw.c +index c983d2f..5a3df91 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/rtl8723be/hw.c ++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8723be/hw.c +@@ -2684,6 +2684,7 @@ void rtl8723be_read_bt_coexist_info_from_hwpg(struct ieee80211_hw *hw, + bool auto_load_fail, u8 *hwinfo) + { + struct rtl_priv *rtlpriv = rtl_priv(hw); ++ struct rtl_mod_params *mod_params = rtlpriv->cfg->mod_params; + u8 value; + u32 tmpu_32; + +@@ -2702,6 +2703,10 @@ void rtl8723be_read_bt_coexist_info_from_hwpg(struct ieee80211_hw *hw, + rtlpriv->btcoexist.btc_info.ant_num = ANT_X2; + } + ++ /* override ant_num / ant_path */ ++ if (mod_params->ant_sel) ++ rtlpriv->btcoexist.btc_info.ant_num = ++ (mod_params->ant_sel == 1 ? ANT_X2 : ANT_X1); + } + + void rtl8723be_bt_reg_init(struct ieee80211_hw *hw) +diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8723be/sw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8723be/sw.c +index a78eaed..2101793 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/rtl8723be/sw.c ++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8723be/sw.c +@@ -273,6 +273,7 @@ static struct rtl_mod_params rtl8723be_mod_params = { + .msi_support = false, + .disable_watchdog = false, + .debug = DBG_EMERG, ++ .ant_sel = 0, + }; + + static struct rtl_hal_cfg rtl8723be_hal_cfg = { +@@ -394,6 +395,7 @@ module_param_named(fwlps, rtl8723be_mod_params.fwctrl_lps, bool, 0444); + module_param_named(msi, rtl8723be_mod_params.msi_support, bool, 0444); + module_param_named(disable_watchdog, rtl8723be_mod_params.disable_watchdog, + bool, 0444); ++module_param_named(ant_sel, rtl8723be_mod_params.ant_sel, int, 0444); + MODULE_PARM_DESC(swenc, "Set to 1 for software crypto (default 0)\n"); + MODULE_PARM_DESC(ips, "Set to 0 to not use link power save (default 1)\n"); + MODULE_PARM_DESC(swlps, "Set to 1 to use SW control power save (default 0)\n"); +@@ -402,6 +404,7 @@ MODULE_PARM_DESC(msi, "Set to 1 to use MSI interrupts mode (default 0)\n"); + MODULE_PARM_DESC(debug, "Set debug level (0-5) (default 0)"); + MODULE_PARM_DESC(disable_watchdog, + "Set to 1 to disable the watchdog (default 0)\n"); ++MODULE_PARM_DESC(ant_sel, "Set to 1 or 2 to force antenna number (default 0)\n"); + + static SIMPLE_DEV_PM_OPS(rtlwifi_pm_ops, rtl_pci_suspend, rtl_pci_resume); + +diff --git a/drivers/net/wireless/realtek/rtlwifi/wifi.h b/drivers/net/wireless/realtek/rtlwifi/wifi.h +index 554d814..93bd7fc 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/wifi.h ++++ b/drivers/net/wireless/realtek/rtlwifi/wifi.h +@@ -2246,6 +2246,9 @@ struct rtl_mod_params { + + /* default 0: 1 means do not disable interrupts */ + bool int_clear; ++ ++ /* select antenna */ ++ int ant_sel; + }; + + struct rtl_hal_usbint_cfg { +-- +cgit v0.12 + +From baa1702290953295e421f0f433e2b1ff4815827c Mon Sep 17 00:00:00 2001 +From: Larry Finger <Larry.Finger@lwfinger.net> +Date: Wed, 16 Mar 2016 13:33:35 -0500 +Subject: rtlwifi: btcoexist: Implement antenna selection + +The previous patch added an option to rtl8723be to manually select the +antenna for those cases when only a single antenna is present, and the +on-board EEPROM is incorrectly programmed. This patch implements the +necessary changes in the Bluetooth coexistence driver. + +Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net> +Cc: Stable <stable@vger.kernel.org> [V4.0+] +Signed-off-by: Kalle Valo <kvalo@codeaurora.org> +--- + .../realtek/rtlwifi/btcoexist/halbtc8723b2ant.c | 9 ++++++-- + .../realtek/rtlwifi/btcoexist/halbtcoutsrc.c | 27 +++++++++++++++++++++- + .../realtek/rtlwifi/btcoexist/halbtcoutsrc.h | 2 +- + .../wireless/realtek/rtlwifi/btcoexist/rtl_btc.c | 5 +++- + 4 files changed, 38 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtlwifi/btcoexist/halbtc8723b2ant.c b/drivers/net/wireless/realtek/rtlwifi/btcoexist/halbtc8723b2ant.c +index c43ab59..77cbd10 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/btcoexist/halbtc8723b2ant.c ++++ b/drivers/net/wireless/realtek/rtlwifi/btcoexist/halbtc8723b2ant.c +@@ -1203,7 +1203,6 @@ static void btc8723b2ant_set_ant_path(struct btc_coexist *btcoexist, + + /* Force GNT_BT to low */ + btcoexist->btc_write_1byte_bitmask(btcoexist, 0x765, 0x18, 0x0); +- btcoexist->btc_write_2byte(btcoexist, 0x948, 0x0); + + if (board_info->btdm_ant_pos == BTC_ANTENNA_AT_MAIN_PORT) { + /* tell firmware "no antenna inverse" */ +@@ -1211,19 +1210,25 @@ static void btc8723b2ant_set_ant_path(struct btc_coexist *btcoexist, + h2c_parameter[1] = 1; /* ext switch type */ + btcoexist->btc_fill_h2c(btcoexist, 0x65, 2, + h2c_parameter); ++ btcoexist->btc_write_2byte(btcoexist, 0x948, 0x0); + } else { + /* tell firmware "antenna inverse" */ + h2c_parameter[0] = 1; + h2c_parameter[1] = 1; /* ext switch type */ + btcoexist->btc_fill_h2c(btcoexist, 0x65, 2, + h2c_parameter); ++ btcoexist->btc_write_2byte(btcoexist, 0x948, 0x280); + } + } + + /* ext switch setting */ + if (use_ext_switch) { + /* fixed internal switch S1->WiFi, S0->BT */ +- btcoexist->btc_write_2byte(btcoexist, 0x948, 0x0); ++ if (board_info->btdm_ant_pos == BTC_ANTENNA_AT_MAIN_PORT) ++ btcoexist->btc_write_2byte(btcoexist, 0x948, 0x0); ++ else ++ btcoexist->btc_write_2byte(btcoexist, 0x948, 0x280); ++ + switch (antpos_type) { + case BTC_ANT_WIFI_AT_MAIN: + /* ext switch main at wifi */ +diff --git a/drivers/net/wireless/realtek/rtlwifi/btcoexist/halbtcoutsrc.c b/drivers/net/wireless/realtek/rtlwifi/btcoexist/halbtcoutsrc.c +index b2791c8..babd149 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/btcoexist/halbtcoutsrc.c ++++ b/drivers/net/wireless/realtek/rtlwifi/btcoexist/halbtcoutsrc.c +@@ -965,13 +965,38 @@ void exhalbtc_set_chip_type(u8 chip_type) + } + } + +-void exhalbtc_set_ant_num(u8 type, u8 ant_num) ++void exhalbtc_set_ant_num(struct rtl_priv *rtlpriv, u8 type, u8 ant_num) + { + if (BT_COEX_ANT_TYPE_PG == type) { + gl_bt_coexist.board_info.pg_ant_num = ant_num; + gl_bt_coexist.board_info.btdm_ant_num = ant_num; ++ /* The antenna position: ++ * Main (default) or Aux for pgAntNum=2 && btdmAntNum =1. ++ * The antenna position should be determined by ++ * auto-detect mechanism. ++ * The following is assumed to main, ++ * and those must be modified ++ * if y auto-detect mechanism is ready ++ */ ++ if ((gl_bt_coexist.board_info.pg_ant_num == 2) && ++ (gl_bt_coexist.board_info.btdm_ant_num == 1)) ++ gl_bt_coexist.board_info.btdm_ant_pos = ++ BTC_ANTENNA_AT_MAIN_PORT; ++ else ++ gl_bt_coexist.board_info.btdm_ant_pos = ++ BTC_ANTENNA_AT_MAIN_PORT; + } else if (BT_COEX_ANT_TYPE_ANTDIV == type) { + gl_bt_coexist.board_info.btdm_ant_num = ant_num; ++ gl_bt_coexist.board_info.btdm_ant_pos = ++ BTC_ANTENNA_AT_MAIN_PORT; ++ } else if (type == BT_COEX_ANT_TYPE_DETECTED) { ++ gl_bt_coexist.board_info.btdm_ant_num = ant_num; ++ if (rtlpriv->cfg->mod_params->ant_sel == 1) ++ gl_bt_coexist.board_info.btdm_ant_pos = ++ BTC_ANTENNA_AT_AUX_PORT; ++ else ++ gl_bt_coexist.board_info.btdm_ant_pos = ++ BTC_ANTENNA_AT_MAIN_PORT; + } + } + +diff --git a/drivers/net/wireless/realtek/rtlwifi/btcoexist/halbtcoutsrc.h b/drivers/net/wireless/realtek/rtlwifi/btcoexist/halbtcoutsrc.h +index 0a903ea..f41ca57 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/btcoexist/halbtcoutsrc.h ++++ b/drivers/net/wireless/realtek/rtlwifi/btcoexist/halbtcoutsrc.h +@@ -535,7 +535,7 @@ void exhalbtc_set_bt_patch_version(u16 bt_hci_version, u16 bt_patch_version); + void exhalbtc_update_min_bt_rssi(char bt_rssi); + void exhalbtc_set_bt_exist(bool bt_exist); + void exhalbtc_set_chip_type(u8 chip_type); +-void exhalbtc_set_ant_num(u8 type, u8 ant_num); ++void exhalbtc_set_ant_num(struct rtl_priv *rtlpriv, u8 type, u8 ant_num); + void exhalbtc_display_bt_coex_info(struct btc_coexist *btcoexist); + void exhalbtc_signal_compensation(struct btc_coexist *btcoexist, + u8 *rssi_wifi, u8 *rssi_bt); +diff --git a/drivers/net/wireless/realtek/rtlwifi/btcoexist/rtl_btc.c b/drivers/net/wireless/realtek/rtlwifi/btcoexist/rtl_btc.c +index b9b0cb7..d3fd921 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/btcoexist/rtl_btc.c ++++ b/drivers/net/wireless/realtek/rtlwifi/btcoexist/rtl_btc.c +@@ -72,7 +72,10 @@ void rtl_btc_init_hal_vars(struct rtl_priv *rtlpriv) + __func__, bt_type); + exhalbtc_set_chip_type(bt_type); + +- exhalbtc_set_ant_num(BT_COEX_ANT_TYPE_PG, ant_num); ++ if (rtlpriv->cfg->mod_params->ant_sel == 1) ++ exhalbtc_set_ant_num(rtlpriv, BT_COEX_ANT_TYPE_DETECTED, 1); ++ else ++ exhalbtc_set_ant_num(rtlpriv, BT_COEX_ANT_TYPE_PG, ant_num); + } + + void rtl_btc_init_hw_config(struct rtl_priv *rtlpriv) +-- +cgit v0.12 + diff --git a/config-armv7-generic b/config-armv7-generic index 23068c57a..717c23320 100644 --- a/config-armv7-generic +++ b/config-armv7-generic @@ -779,7 +779,6 @@ CONFIG_LIBERTAS_SPI=m CONFIG_P54_SPI=m CONFIG_P54_SPI_DEFAULT_EEPROM=n CONFIG_MICREL_KS8995MA=m -CONFIG_IEEE802154_AT86RF230=m CONFIG_IEEE802154_MRF24J40=m CONFIG_ARM_KPROBES_TEST=m diff --git a/config-generic b/config-generic index 508543b4f..fa5645559 100644 --- a/config-generic +++ b/config-generic @@ -1945,10 +1945,10 @@ CONFIG_IEEE802154_DRIVERS=m CONFIG_IEEE802154_FAKELB=m CONFIG_IEEE802154_ATUSB=m CONFIG_IEEE802154_CC2520=m -# CONFIG_IEEE802154_AT86RF230 is not set +CONFIG_IEEE802154_AT86RF230=m +# CONFIG_IEEE802154_AT86RF230_DEBUGFS is not set # CONFIG_IEEE802154_MRF24J40 is not set # CONFIG_IEEE802154_NL802154_EXPERIMENTAL is not set -# CONFIG_IEEE802154_AT86RF230_DEBUGFS is not set CONFIG_MAC802154=m CONFIG_NET_MPLS_GSO=m @@ -2067,7 +2067,8 @@ CONFIG_NFC_ST21NFCA=m CONFIG_NFC_ST21NFCA_I2C=m # CONFIG_NFC_ST21NFCB is not set # CONFIG_NFC_ST21NFCB_I2C is not set -# CONFIG_NFC_NXP_NCI is not set +CONFIG_NFC_NXP_NCI=m +CONFIG_NFC_NXP_NCI_I2C=m # CONFIG_NFC_NCI_SPI is not set # CONFIG_NFC_NCI_UART is not set # CONFIG_NFC_ST_NCI is not set diff --git a/ext4-fix-races-between-buffered-IO-and-collapse-inse.patch b/ext4-fix-races-between-buffered-IO-and-collapse-inse.patch deleted file mode 100644 index 0c89ea77a..000000000 --- a/ext4-fix-races-between-buffered-IO-and-collapse-inse.patch +++ /dev/null @@ -1,119 +0,0 @@ -From 32ebffd3bbb4162da5ff88f9a35dd32d0a28ea70 Mon Sep 17 00:00:00 2001 -From: Jan Kara <jack@suse.com> -Date: Mon, 7 Dec 2015 14:31:11 -0500 -Subject: [PATCH 3/4] ext4: fix races between buffered IO and collapse / insert - range - -Current code implementing FALLOC_FL_COLLAPSE_RANGE and -FALLOC_FL_INSERT_RANGE is prone to races with buffered writes and page -faults. If buffered write or write via mmap manages to squeeze between -filemap_write_and_wait_range() and truncate_pagecache() in the fallocate -implementations, the written data is simply discarded by -truncate_pagecache() although it should have been shifted. - -Fix the problem by moving filemap_write_and_wait_range() call inside -i_mutex and i_mmap_sem. That way we are protected against races with -both buffered writes and page faults. - -Signed-off-by: Jan Kara <jack@suse.com> -Signed-off-by: Theodore Ts'o <tytso@mit.edu> ---- - fs/ext4/extents.c | 59 +++++++++++++++++++++++++++++-------------------------- - 1 file changed, 31 insertions(+), 28 deletions(-) - -diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c -index 65b5ada2833f..4b105c96df08 100644 ---- a/fs/ext4/extents.c -+++ b/fs/ext4/extents.c -@@ -5487,21 +5487,7 @@ int ext4_collapse_range(struct inode *inode, loff_t offset, loff_t len) - return ret; - } - -- /* -- * Need to round down offset to be aligned with page size boundary -- * for page size > block size. -- */ -- ioffset = round_down(offset, PAGE_SIZE); -- -- /* Write out all dirty pages */ -- ret = filemap_write_and_wait_range(inode->i_mapping, ioffset, -- LLONG_MAX); -- if (ret) -- return ret; -- -- /* Take mutex lock */ - mutex_lock(&inode->i_mutex); -- - /* - * There is no need to overlap collapse range with EOF, in which case - * it is effectively a truncate operation -@@ -5526,6 +5512,27 @@ int ext4_collapse_range(struct inode *inode, loff_t offset, loff_t len) - * page cache. - */ - down_write(&EXT4_I(inode)->i_mmap_sem); -+ /* -+ * Need to round down offset to be aligned with page size boundary -+ * for page size > block size. -+ */ -+ ioffset = round_down(offset, PAGE_SIZE); -+ /* -+ * Write tail of the last page before removed range since it will get -+ * removed from the page cache below. -+ */ -+ ret = filemap_write_and_wait_range(inode->i_mapping, ioffset, offset); -+ if (ret) -+ goto out_mmap; -+ /* -+ * Write data that will be shifted to preserve them when discarding -+ * page cache below. We are also protected from pages becoming dirty -+ * by i_mmap_sem. -+ */ -+ ret = filemap_write_and_wait_range(inode->i_mapping, offset + len, -+ LLONG_MAX); -+ if (ret) -+ goto out_mmap; - truncate_pagecache(inode, ioffset); - - credits = ext4_writepage_trans_blocks(inode); -@@ -5626,21 +5633,7 @@ int ext4_insert_range(struct inode *inode, loff_t offset, loff_t len) - return ret; - } - -- /* -- * Need to round down to align start offset to page size boundary -- * for page size > block size. -- */ -- ioffset = round_down(offset, PAGE_SIZE); -- -- /* Write out all dirty pages */ -- ret = filemap_write_and_wait_range(inode->i_mapping, ioffset, -- LLONG_MAX); -- if (ret) -- return ret; -- -- /* Take mutex lock */ - mutex_lock(&inode->i_mutex); -- - /* Currently just for extent based files */ - if (!ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS)) { - ret = -EOPNOTSUPP; -@@ -5668,6 +5661,16 @@ int ext4_insert_range(struct inode *inode, loff_t offset, loff_t len) - * page cache. - */ - down_write(&EXT4_I(inode)->i_mmap_sem); -+ /* -+ * Need to round down to align start offset to page size boundary -+ * for page size > block size. -+ */ -+ ioffset = round_down(offset, PAGE_SIZE); -+ /* Write out all dirty pages */ -+ ret = filemap_write_and_wait_range(inode->i_mapping, ioffset, -+ LLONG_MAX); -+ if (ret) -+ goto out_mmap; - truncate_pagecache(inode, ioffset); - - credits = ext4_writepage_trans_blocks(inode); --- -2.5.5 - diff --git a/ext4-fix-races-between-page-faults-and-hole-punching.patch b/ext4-fix-races-between-page-faults-and-hole-punching.patch deleted file mode 100644 index 9034b958c..000000000 --- a/ext4-fix-races-between-page-faults-and-hole-punching.patch +++ /dev/null @@ -1,442 +0,0 @@ -From ea3d7209ca01da209cda6f0dea8be9cc4b7a933b Mon Sep 17 00:00:00 2001 -From: Jan Kara <jack@suse.com> -Date: Mon, 7 Dec 2015 14:28:03 -0500 -Subject: [PATCH 1/4] ext4: fix races between page faults and hole punching - -Currently, page faults and hole punching are completely unsynchronized. -This can result in page fault faulting in a page into a range that we -are punching after truncate_pagecache_range() has been called and thus -we can end up with a page mapped to disk blocks that will be shortly -freed. Filesystem corruption will shortly follow. Note that the same -race is avoided for truncate by checking page fault offset against -i_size but there isn't similar mechanism available for punching holes. - -Fix the problem by creating new rw semaphore i_mmap_sem in inode and -grab it for writing over truncate, hole punching, and other functions -removing blocks from extent tree and for read over page faults. We -cannot easily use i_data_sem for this since that ranks below transaction -start and we need something ranking above it so that it can be held over -the whole truncate / hole punching operation. Also remove various -workarounds we had in the code to reduce race window when page fault -could have created pages with stale mapping information. - -Signed-off-by: Jan Kara <jack@suse.com> -Signed-off-by: Theodore Ts'o <tytso@mit.edu> ---- - fs/ext4/ext4.h | 10 +++++++++ - fs/ext4/extents.c | 54 ++++++++++++++++++++++++-------------------- - fs/ext4/file.c | 66 ++++++++++++++++++++++++++++++++++++++++++++++-------- - fs/ext4/inode.c | 36 +++++++++++++++++++++-------- - fs/ext4/super.c | 1 + - fs/ext4/truncate.h | 2 ++ - 6 files changed, 127 insertions(+), 42 deletions(-) - -diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h -index cc7ca4e87144..348a5ff4a0e2 100644 ---- a/fs/ext4/ext4.h -+++ b/fs/ext4/ext4.h -@@ -910,6 +910,15 @@ struct ext4_inode_info { - * by other means, so we have i_data_sem. - */ - struct rw_semaphore i_data_sem; -+ /* -+ * i_mmap_sem is for serializing page faults with truncate / punch hole -+ * operations. We have to make sure that new page cannot be faulted in -+ * a section of the inode that is being punched. We cannot easily use -+ * i_data_sem for this since we need protection for the whole punch -+ * operation and i_data_sem ranks below transaction start so we have -+ * to occasionally drop it. -+ */ -+ struct rw_semaphore i_mmap_sem; - struct inode vfs_inode; - struct jbd2_inode *jinode; - -@@ -2484,6 +2493,7 @@ extern int ext4_chunk_trans_blocks(struct inode *, int nrblocks); - extern int ext4_zero_partial_blocks(handle_t *handle, struct inode *inode, - loff_t lstart, loff_t lend); - extern int ext4_page_mkwrite(struct vm_area_struct *vma, struct vm_fault *vmf); -+extern int ext4_filemap_fault(struct vm_area_struct *vma, struct vm_fault *vmf); - extern qsize_t *ext4_get_reserved_space(struct inode *inode); - extern void ext4_da_update_reserve_space(struct inode *inode, - int used, int quota_claim); -diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c -index 551353b1b17a..5be9ca5a8a7a 100644 ---- a/fs/ext4/extents.c -+++ b/fs/ext4/extents.c -@@ -4770,7 +4770,6 @@ static long ext4_zero_range(struct file *file, loff_t offset, - int partial_begin, partial_end; - loff_t start, end; - ext4_lblk_t lblk; -- struct address_space *mapping = inode->i_mapping; - unsigned int blkbits = inode->i_blkbits; - - trace_ext4_zero_range(inode, offset, len, mode); -@@ -4786,17 +4785,6 @@ static long ext4_zero_range(struct file *file, loff_t offset, - } - - /* -- * Write out all dirty pages to avoid race conditions -- * Then release them. -- */ -- if (mapping->nrpages && mapping_tagged(mapping, PAGECACHE_TAG_DIRTY)) { -- ret = filemap_write_and_wait_range(mapping, offset, -- offset + len - 1); -- if (ret) -- return ret; -- } -- -- /* - * Round up offset. This is not fallocate, we neet to zero out - * blocks, so convert interior block aligned part of the range to - * unwritten and possibly manually zero out unaligned parts of the -@@ -4856,16 +4844,22 @@ static long ext4_zero_range(struct file *file, loff_t offset, - flags |= (EXT4_GET_BLOCKS_CONVERT_UNWRITTEN | - EXT4_EX_NOCACHE); - -- /* Now release the pages and zero block aligned part of pages*/ -- truncate_pagecache_range(inode, start, end - 1); -- inode->i_mtime = inode->i_ctime = ext4_current_time(inode); -- - /* Wait all existing dio workers, newcomers will block on i_mutex */ - ext4_inode_block_unlocked_dio(inode); - inode_dio_wait(inode); - -+ /* -+ * Prevent page faults from reinstantiating pages we have -+ * released from page cache. -+ */ -+ down_write(&EXT4_I(inode)->i_mmap_sem); -+ /* Now release the pages and zero block aligned part of pages */ -+ truncate_pagecache_range(inode, start, end - 1); -+ inode->i_mtime = inode->i_ctime = ext4_current_time(inode); -+ - ret = ext4_alloc_file_blocks(file, lblk, max_blocks, new_size, - flags, mode); -+ up_write(&EXT4_I(inode)->i_mmap_sem); - if (ret) - goto out_dio; - } -@@ -5524,17 +5518,22 @@ int ext4_collapse_range(struct inode *inode, loff_t offset, loff_t len) - goto out_mutex; - } - -- truncate_pagecache(inode, ioffset); -- - /* Wait for existing dio to complete */ - ext4_inode_block_unlocked_dio(inode); - inode_dio_wait(inode); - -+ /* -+ * Prevent page faults from reinstantiating pages we have released from -+ * page cache. -+ */ -+ down_write(&EXT4_I(inode)->i_mmap_sem); -+ truncate_pagecache(inode, ioffset); -+ - credits = ext4_writepage_trans_blocks(inode); - handle = ext4_journal_start(inode, EXT4_HT_TRUNCATE, credits); - if (IS_ERR(handle)) { - ret = PTR_ERR(handle); -- goto out_dio; -+ goto out_mmap; - } - - down_write(&EXT4_I(inode)->i_data_sem); -@@ -5573,7 +5572,8 @@ int ext4_collapse_range(struct inode *inode, loff_t offset, loff_t len) - - out_stop: - ext4_journal_stop(handle); --out_dio: -+out_mmap: -+ up_write(&EXT4_I(inode)->i_mmap_sem); - ext4_inode_resume_unlocked_dio(inode); - out_mutex: - mutex_unlock(&inode->i_mutex); -@@ -5660,17 +5660,22 @@ int ext4_insert_range(struct inode *inode, loff_t offset, loff_t len) - goto out_mutex; - } - -- truncate_pagecache(inode, ioffset); -- - /* Wait for existing dio to complete */ - ext4_inode_block_unlocked_dio(inode); - inode_dio_wait(inode); - -+ /* -+ * Prevent page faults from reinstantiating pages we have released from -+ * page cache. -+ */ -+ down_write(&EXT4_I(inode)->i_mmap_sem); -+ truncate_pagecache(inode, ioffset); -+ - credits = ext4_writepage_trans_blocks(inode); - handle = ext4_journal_start(inode, EXT4_HT_TRUNCATE, credits); - if (IS_ERR(handle)) { - ret = PTR_ERR(handle); -- goto out_dio; -+ goto out_mmap; - } - - /* Expand file to avoid data loss if there is error while shifting */ -@@ -5741,7 +5746,8 @@ int ext4_insert_range(struct inode *inode, loff_t offset, loff_t len) - - out_stop: - ext4_journal_stop(handle); --out_dio: -+out_mmap: -+ up_write(&EXT4_I(inode)->i_mmap_sem); - ext4_inode_resume_unlocked_dio(inode); - out_mutex: - mutex_unlock(&inode->i_mutex); -diff --git a/fs/ext4/file.c b/fs/ext4/file.c -index 113837e7ba98..0d24ebcd7c9e 100644 ---- a/fs/ext4/file.c -+++ b/fs/ext4/file.c -@@ -209,15 +209,18 @@ static int ext4_dax_fault(struct vm_area_struct *vma, struct vm_fault *vmf) - { - int result; - handle_t *handle = NULL; -- struct super_block *sb = file_inode(vma->vm_file)->i_sb; -+ struct inode *inode = file_inode(vma->vm_file); -+ struct super_block *sb = inode->i_sb; - bool write = vmf->flags & FAULT_FLAG_WRITE; - - if (write) { - sb_start_pagefault(sb); - file_update_time(vma->vm_file); -+ down_read(&EXT4_I(inode)->i_mmap_sem); - handle = ext4_journal_start_sb(sb, EXT4_HT_WRITE_PAGE, - EXT4_DATA_TRANS_BLOCKS(sb)); -- } -+ } else -+ down_read(&EXT4_I(inode)->i_mmap_sem); - - if (IS_ERR(handle)) - result = VM_FAULT_SIGBUS; -@@ -228,8 +231,10 @@ static int ext4_dax_fault(struct vm_area_struct *vma, struct vm_fault *vmf) - if (write) { - if (!IS_ERR(handle)) - ext4_journal_stop(handle); -+ up_read(&EXT4_I(inode)->i_mmap_sem); - sb_end_pagefault(sb); -- } -+ } else -+ up_read(&EXT4_I(inode)->i_mmap_sem); - - return result; - } -@@ -246,10 +251,12 @@ static int ext4_dax_pmd_fault(struct vm_area_struct *vma, unsigned long addr, - if (write) { - sb_start_pagefault(sb); - file_update_time(vma->vm_file); -+ down_read(&EXT4_I(inode)->i_mmap_sem); - handle = ext4_journal_start_sb(sb, EXT4_HT_WRITE_PAGE, - ext4_chunk_trans_blocks(inode, - PMD_SIZE / PAGE_SIZE)); -- } -+ } else -+ down_read(&EXT4_I(inode)->i_mmap_sem); - - if (IS_ERR(handle)) - result = VM_FAULT_SIGBUS; -@@ -260,30 +267,71 @@ static int ext4_dax_pmd_fault(struct vm_area_struct *vma, unsigned long addr, - if (write) { - if (!IS_ERR(handle)) - ext4_journal_stop(handle); -+ up_read(&EXT4_I(inode)->i_mmap_sem); - sb_end_pagefault(sb); -- } -+ } else -+ up_read(&EXT4_I(inode)->i_mmap_sem); - - return result; - } - - static int ext4_dax_mkwrite(struct vm_area_struct *vma, struct vm_fault *vmf) - { -- return dax_mkwrite(vma, vmf, ext4_get_block_dax, -- ext4_end_io_unwritten); -+ int err; -+ struct inode *inode = file_inode(vma->vm_file); -+ -+ sb_start_pagefault(inode->i_sb); -+ file_update_time(vma->vm_file); -+ down_read(&EXT4_I(inode)->i_mmap_sem); -+ err = __dax_mkwrite(vma, vmf, ext4_get_block_dax, -+ ext4_end_io_unwritten); -+ up_read(&EXT4_I(inode)->i_mmap_sem); -+ sb_end_pagefault(inode->i_sb); -+ -+ return err; -+} -+ -+/* -+ * Handle write fault for VM_MIXEDMAP mappings. Similarly to ext4_dax_mkwrite() -+ * handler we check for races agaist truncate. Note that since we cycle through -+ * i_mmap_sem, we are sure that also any hole punching that began before we -+ * were called is finished by now and so if it included part of the file we -+ * are working on, our pte will get unmapped and the check for pte_same() in -+ * wp_pfn_shared() fails. Thus fault gets retried and things work out as -+ * desired. -+ */ -+static int ext4_dax_pfn_mkwrite(struct vm_area_struct *vma, -+ struct vm_fault *vmf) -+{ -+ struct inode *inode = file_inode(vma->vm_file); -+ struct super_block *sb = inode->i_sb; -+ int ret = VM_FAULT_NOPAGE; -+ loff_t size; -+ -+ sb_start_pagefault(sb); -+ file_update_time(vma->vm_file); -+ down_read(&EXT4_I(inode)->i_mmap_sem); -+ size = (i_size_read(inode) + PAGE_SIZE - 1) >> PAGE_SHIFT; -+ if (vmf->pgoff >= size) -+ ret = VM_FAULT_SIGBUS; -+ up_read(&EXT4_I(inode)->i_mmap_sem); -+ sb_end_pagefault(sb); -+ -+ return ret; - } - - static const struct vm_operations_struct ext4_dax_vm_ops = { - .fault = ext4_dax_fault, - .pmd_fault = ext4_dax_pmd_fault, - .page_mkwrite = ext4_dax_mkwrite, -- .pfn_mkwrite = dax_pfn_mkwrite, -+ .pfn_mkwrite = ext4_dax_pfn_mkwrite, - }; - #else - #define ext4_dax_vm_ops ext4_file_vm_ops - #endif - - static const struct vm_operations_struct ext4_file_vm_ops = { -- .fault = filemap_fault, -+ .fault = ext4_filemap_fault, - .map_pages = filemap_map_pages, - .page_mkwrite = ext4_page_mkwrite, - }; -diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c -index ea433a7f4bca..d1207d03c961 100644 ---- a/fs/ext4/inode.c -+++ b/fs/ext4/inode.c -@@ -3623,6 +3623,15 @@ int ext4_punch_hole(struct inode *inode, loff_t offset, loff_t length) - - } - -+ /* Wait all existing dio workers, newcomers will block on i_mutex */ -+ ext4_inode_block_unlocked_dio(inode); -+ inode_dio_wait(inode); -+ -+ /* -+ * Prevent page faults from reinstantiating pages we have released from -+ * page cache. -+ */ -+ down_write(&EXT4_I(inode)->i_mmap_sem); - first_block_offset = round_up(offset, sb->s_blocksize); - last_block_offset = round_down((offset + length), sb->s_blocksize) - 1; - -@@ -3631,10 +3640,6 @@ int ext4_punch_hole(struct inode *inode, loff_t offset, loff_t length) - truncate_pagecache_range(inode, first_block_offset, - last_block_offset); - -- /* Wait all existing dio workers, newcomers will block on i_mutex */ -- ext4_inode_block_unlocked_dio(inode); -- inode_dio_wait(inode); -- - if (ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS)) - credits = ext4_writepage_trans_blocks(inode); - else -@@ -3680,16 +3685,12 @@ int ext4_punch_hole(struct inode *inode, loff_t offset, loff_t length) - if (IS_SYNC(inode)) - ext4_handle_sync(handle); - -- /* Now release the pages again to reduce race window */ -- if (last_block_offset > first_block_offset) -- truncate_pagecache_range(inode, first_block_offset, -- last_block_offset); -- - inode->i_mtime = inode->i_ctime = ext4_current_time(inode); - ext4_mark_inode_dirty(handle, inode); - out_stop: - ext4_journal_stop(handle); - out_dio: -+ up_write(&EXT4_I(inode)->i_mmap_sem); - ext4_inode_resume_unlocked_dio(inode); - out_mutex: - mutex_unlock(&inode->i_mutex); -@@ -4823,6 +4824,7 @@ int ext4_setattr(struct dentry *dentry, struct iattr *attr) - } else - ext4_wait_for_tail_page_commit(inode); - } -+ down_write(&EXT4_I(inode)->i_mmap_sem); - /* - * Truncate pagecache after we've waited for commit - * in data=journal mode to make pages freeable. -@@ -4830,6 +4832,7 @@ int ext4_setattr(struct dentry *dentry, struct iattr *attr) - truncate_pagecache(inode, inode->i_size); - if (shrink) - ext4_truncate(inode); -+ up_write(&EXT4_I(inode)->i_mmap_sem); - } - - if (!rc) { -@@ -5278,6 +5281,8 @@ int ext4_page_mkwrite(struct vm_area_struct *vma, struct vm_fault *vmf) - - sb_start_pagefault(inode->i_sb); - file_update_time(vma->vm_file); -+ -+ down_read(&EXT4_I(inode)->i_mmap_sem); - /* Delalloc case is easy... */ - if (test_opt(inode->i_sb, DELALLOC) && - !ext4_should_journal_data(inode) && -@@ -5347,6 +5352,19 @@ retry_alloc: - out_ret: - ret = block_page_mkwrite_return(ret); - out: -+ up_read(&EXT4_I(inode)->i_mmap_sem); - sb_end_pagefault(inode->i_sb); - return ret; - } -+ -+int ext4_filemap_fault(struct vm_area_struct *vma, struct vm_fault *vmf) -+{ -+ struct inode *inode = file_inode(vma->vm_file); -+ int err; -+ -+ down_read(&EXT4_I(inode)->i_mmap_sem); -+ err = filemap_fault(vma, vmf); -+ up_read(&EXT4_I(inode)->i_mmap_sem); -+ -+ return err; -+} -diff --git a/fs/ext4/super.c b/fs/ext4/super.c -index c9ab67da6e5a..493370e6590e 100644 ---- a/fs/ext4/super.c -+++ b/fs/ext4/super.c -@@ -958,6 +958,7 @@ static void init_once(void *foo) - INIT_LIST_HEAD(&ei->i_orphan); - init_rwsem(&ei->xattr_sem); - init_rwsem(&ei->i_data_sem); -+ init_rwsem(&ei->i_mmap_sem); - inode_init_once(&ei->vfs_inode); - } - -diff --git a/fs/ext4/truncate.h b/fs/ext4/truncate.h -index 011ba6670d99..c70d06a383e2 100644 ---- a/fs/ext4/truncate.h -+++ b/fs/ext4/truncate.h -@@ -10,8 +10,10 @@ - */ - static inline void ext4_truncate_failed_write(struct inode *inode) - { -+ down_write(&EXT4_I(inode)->i_mmap_sem); - truncate_inode_pages(inode->i_mapping, inode->i_size); - ext4_truncate(inode); -+ up_write(&EXT4_I(inode)->i_mmap_sem); - } - - /* --- -2.5.5 - diff --git a/ext4-fix-races-of-writeback-with-punch-hole-and-zero.patch b/ext4-fix-races-of-writeback-with-punch-hole-and-zero.patch deleted file mode 100644 index 9ff9e2761..000000000 --- a/ext4-fix-races-of-writeback-with-punch-hole-and-zero.patch +++ /dev/null @@ -1,110 +0,0 @@ -From 011278485ecc3cd2a3954b5d4c73101d919bf1fa Mon Sep 17 00:00:00 2001 -From: Jan Kara <jack@suse.com> -Date: Mon, 7 Dec 2015 14:34:49 -0500 -Subject: [PATCH 4/4] ext4: fix races of writeback with punch hole and zero - range - -When doing delayed allocation, update of on-disk inode size is postponed -until IO submission time. However hole punch or zero range fallocate -calls can end up discarding the tail page cache page and thus on-disk -inode size would never be properly updated. - -Make sure the on-disk inode size is updated before truncating page -cache. - -Signed-off-by: Jan Kara <jack@suse.com> -Signed-off-by: Theodore Ts'o <tytso@mit.edu> ---- - fs/ext4/ext4.h | 3 +++ - fs/ext4/extents.c | 5 +++++ - fs/ext4/inode.c | 35 ++++++++++++++++++++++++++++++++++- - 3 files changed, 42 insertions(+), 1 deletion(-) - -diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h -index 348a5ff4a0e2..80f76f092079 100644 ---- a/fs/ext4/ext4.h -+++ b/fs/ext4/ext4.h -@@ -2858,6 +2858,9 @@ static inline int ext4_update_inode_size(struct inode *inode, loff_t newsize) - return changed; - } - -+int ext4_update_disksize_before_punch(struct inode *inode, loff_t offset, -+ loff_t len); -+ - struct ext4_group_info { - unsigned long bb_state; - struct rb_root bb_free_root; -diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c -index 4b105c96df08..3578b25fccfd 100644 ---- a/fs/ext4/extents.c -+++ b/fs/ext4/extents.c -@@ -4847,6 +4847,11 @@ static long ext4_zero_range(struct file *file, loff_t offset, - * released from page cache. - */ - down_write(&EXT4_I(inode)->i_mmap_sem); -+ ret = ext4_update_disksize_before_punch(inode, offset, len); -+ if (ret) { -+ up_write(&EXT4_I(inode)->i_mmap_sem); -+ goto out_dio; -+ } - /* Now release the pages and zero block aligned part of pages */ - truncate_pagecache_range(inode, start, end - 1); - inode->i_mtime = inode->i_ctime = ext4_current_time(inode); -diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c -index d1207d03c961..472e608da13d 100644 ---- a/fs/ext4/inode.c -+++ b/fs/ext4/inode.c -@@ -3559,6 +3559,35 @@ int ext4_can_truncate(struct inode *inode) - } - - /* -+ * We have to make sure i_disksize gets properly updated before we truncate -+ * page cache due to hole punching or zero range. Otherwise i_disksize update -+ * can get lost as it may have been postponed to submission of writeback but -+ * that will never happen after we truncate page cache. -+ */ -+int ext4_update_disksize_before_punch(struct inode *inode, loff_t offset, -+ loff_t len) -+{ -+ handle_t *handle; -+ loff_t size = i_size_read(inode); -+ -+ WARN_ON(!mutex_is_locked(&inode->i_mutex)); -+ if (offset > size || offset + len < size) -+ return 0; -+ -+ if (EXT4_I(inode)->i_disksize >= size) -+ return 0; -+ -+ handle = ext4_journal_start(inode, EXT4_HT_MISC, 1); -+ if (IS_ERR(handle)) -+ return PTR_ERR(handle); -+ ext4_update_i_disksize(inode, size); -+ ext4_mark_inode_dirty(handle, inode); -+ ext4_journal_stop(handle); -+ -+ return 0; -+} -+ -+/* - * ext4_punch_hole: punches a hole in a file by releaseing the blocks - * associated with the given offset and length - * -@@ -3636,9 +3665,13 @@ int ext4_punch_hole(struct inode *inode, loff_t offset, loff_t length) - last_block_offset = round_down((offset + length), sb->s_blocksize) - 1; - - /* Now release the pages and zero block aligned part of pages*/ -- if (last_block_offset > first_block_offset) -+ if (last_block_offset > first_block_offset) { -+ ret = ext4_update_disksize_before_punch(inode, offset, length); -+ if (ret) -+ goto out_dio; - truncate_pagecache_range(inode, first_block_offset, - last_block_offset); -+ } - - if (ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS)) - credits = ext4_writepage_trans_blocks(inode); --- -2.5.5 - diff --git a/ext4-move-unlocked-dio-protection-from-ext4_alloc_fi.patch b/ext4-move-unlocked-dio-protection-from-ext4_alloc_fi.patch deleted file mode 100644 index 3bf6765fa..000000000 --- a/ext4-move-unlocked-dio-protection-from-ext4_alloc_fi.patch +++ /dev/null @@ -1,93 +0,0 @@ -From 17048e8a083fec7ad841d88ef0812707fbc7e39f Mon Sep 17 00:00:00 2001 -From: Jan Kara <jack@suse.com> -Date: Mon, 7 Dec 2015 14:29:17 -0500 -Subject: [PATCH 2/4] ext4: move unlocked dio protection from - ext4_alloc_file_blocks() - -Currently ext4_alloc_file_blocks() was handling protection against -unlocked DIO. However we now need to sometimes call it under i_mmap_sem -and sometimes not and DIO protection ranks above it (although strictly -speaking this cannot currently create any deadlocks). Also -ext4_zero_range() was actually getting & releasing unlocked DIO -protection twice in some cases. Luckily it didn't introduce any real bug -but it was a land mine waiting to be stepped on. So move DIO protection -out from ext4_alloc_file_blocks() into the two callsites. - -Signed-off-by: Jan Kara <jack@suse.com> -Signed-off-by: Theodore Ts'o <tytso@mit.edu> ---- - fs/ext4/extents.c | 21 ++++++++++----------- - 1 file changed, 10 insertions(+), 11 deletions(-) - -diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c -index 5be9ca5a8a7a..65b5ada2833f 100644 ---- a/fs/ext4/extents.c -+++ b/fs/ext4/extents.c -@@ -4685,10 +4685,6 @@ static int ext4_alloc_file_blocks(struct file *file, ext4_lblk_t offset, - if (len <= EXT_UNWRITTEN_MAX_LEN) - flags |= EXT4_GET_BLOCKS_NO_NORMALIZE; - -- /* Wait all existing dio workers, newcomers will block on i_mutex */ -- ext4_inode_block_unlocked_dio(inode); -- inode_dio_wait(inode); -- - /* - * credits to insert 1 extent into extent tree - */ -@@ -4752,8 +4748,6 @@ retry: - goto retry; - } - -- ext4_inode_resume_unlocked_dio(inode); -- - return ret > 0 ? ret2 : ret; - } - -@@ -4827,6 +4821,10 @@ static long ext4_zero_range(struct file *file, loff_t offset, - if (mode & FALLOC_FL_KEEP_SIZE) - flags |= EXT4_GET_BLOCKS_KEEP_SIZE; - -+ /* Wait all existing dio workers, newcomers will block on i_mutex */ -+ ext4_inode_block_unlocked_dio(inode); -+ inode_dio_wait(inode); -+ - /* Preallocate the range including the unaligned edges */ - if (partial_begin || partial_end) { - ret = ext4_alloc_file_blocks(file, -@@ -4835,7 +4833,7 @@ static long ext4_zero_range(struct file *file, loff_t offset, - round_down(offset, 1 << blkbits)) >> blkbits, - new_size, flags, mode); - if (ret) -- goto out_mutex; -+ goto out_dio; - - } - -@@ -4844,10 +4842,6 @@ static long ext4_zero_range(struct file *file, loff_t offset, - flags |= (EXT4_GET_BLOCKS_CONVERT_UNWRITTEN | - EXT4_EX_NOCACHE); - -- /* Wait all existing dio workers, newcomers will block on i_mutex */ -- ext4_inode_block_unlocked_dio(inode); -- inode_dio_wait(inode); -- - /* - * Prevent page faults from reinstantiating pages we have - * released from page cache. -@@ -4992,8 +4986,13 @@ long ext4_fallocate(struct file *file, int mode, loff_t offset, loff_t len) - goto out; - } - -+ /* Wait all existing dio workers, newcomers will block on i_mutex */ -+ ext4_inode_block_unlocked_dio(inode); -+ inode_dio_wait(inode); -+ - ret = ext4_alloc_file_blocks(file, lblk, max_blocks, new_size, - flags, mode); -+ ext4_inode_resume_unlocked_dio(inode); - if (ret) - goto out; - --- -2.5.5 - diff --git a/input-gtco-fix-crash-on-detecting-device-without-end.patch b/input-gtco-fix-crash-on-detecting-device-without-end.patch deleted file mode 100644 index 849f607a5..000000000 --- a/input-gtco-fix-crash-on-detecting-device-without-end.patch +++ /dev/null @@ -1,49 +0,0 @@ -Subject: [PATCH] Input: gtco: fix crash on detecting device without endpoints -From: Vladis Dronov <vdronov@redhat.com> -Date: 2016-03-18 18:35:00 - -The gtco driver expects at least one valid endpoint. If given -malicious descriptors that specify 0 for the number of endpoints, -it will crash in the probe function. Ensure there is at least -one endpoint on the interface before using it. Fix minor coding -style issue. - -The full report of this issue can be found here: -http://seclists.org/bugtraq/2016/Mar/86 - -Reported-by: Ralf Spenneberg <ralf@spenneberg.net> -Signed-off-by: Vladis Dronov <vdronov@redhat.com> ---- - drivers/input/tablet/gtco.c | 10 +++++++++- - 1 file changed, 9 insertions(+), 1 deletion(-) - -diff --git a/drivers/input/tablet/gtco.c b/drivers/input/tablet/gtco.c -index 3a7f3a4..7c18249 100644 ---- a/drivers/input/tablet/gtco.c -+++ b/drivers/input/tablet/gtco.c -@@ -858,6 +858,14 @@ static int gtco_probe(struct usb_interface *usbinterface, - goto err_free_buf; - } - -+ /* Sanity check that a device has an endpoint */ -+ if (usbinterface->altsetting[0].desc.bNumEndpoints < 1) { -+ dev_err(&usbinterface->dev, -+ "Invalid number of endpoints\n"); -+ error = -EINVAL; -+ goto err_free_urb; -+ } -+ - /* - * The endpoint is always altsetting 0, we know this since we know - * this device only has one interrupt endpoint -@@ -879,7 +887,7 @@ static int gtco_probe(struct usb_interface *usbinterface, - * HID report descriptor - */ - if (usb_get_extra_descriptor(usbinterface->cur_altsetting, -- HID_DEVICE_TYPE, &hid_desc) != 0){ -+ HID_DEVICE_TYPE, &hid_desc) != 0) { - dev_err(&usbinterface->dev, - "Can't retrieve exta USB descriptor to get hid report descriptor length\n"); - error = -EIO; --- -2.5.0 diff --git a/ipv4-Dont-do-expensive-useless-work-during-inetdev-des.patch b/ipv4-Dont-do-expensive-useless-work-during-inetdev-des.patch deleted file mode 100644 index 48e4762e3..000000000 --- a/ipv4-Dont-do-expensive-useless-work-during-inetdev-des.patch +++ /dev/null @@ -1,97 +0,0 @@ -From fbd40ea0180a2d328c5adc61414dc8bab9335ce2 Mon Sep 17 00:00:00 2001 -From: "David S. Miller" <davem@davemloft.net> -Date: Sun, 13 Mar 2016 23:28:00 -0400 -Subject: ipv4: Don't do expensive useless work during inetdev destroy. - -When an inetdev is destroyed, every address assigned to the interface -is removed. And in this scenerio we do two pointless things which can -be very expensive if the number of assigned interfaces is large: - -1) Address promotion. We are deleting all addresses, so there is no - point in doing this. - -2) A full nf conntrack table purge for every address. We only need to - do this once, as is already caught by the existing - masq_dev_notifier so masq_inet_event() can skip this. - -Reported-by: Solar Designer <solar@openwall.com> -Signed-off-by: David S. Miller <davem@davemloft.net> -Tested-by: Cyrill Gorcunov <gorcunov@openvz.org> ---- - net/ipv4/devinet.c | 4 ++++ - net/ipv4/fib_frontend.c | 4 ++++ - net/ipv4/netfilter/nf_nat_masquerade_ipv4.c | 12 ++++++++++-- - 3 files changed, 18 insertions(+), 2 deletions(-) - -diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c -index 65e76a4..e333bc8 100644 ---- a/net/ipv4/devinet.c -+++ b/net/ipv4/devinet.c -@@ -334,6 +334,9 @@ static void __inet_del_ifa(struct in_device *in_dev, struct in_ifaddr **ifap, - - ASSERT_RTNL(); - -+ if (in_dev->dead) -+ goto no_promotions; -+ - /* 1. Deleting primary ifaddr forces deletion all secondaries - * unless alias promotion is set - **/ -@@ -380,6 +383,7 @@ static void __inet_del_ifa(struct in_device *in_dev, struct in_ifaddr **ifap, - fib_del_ifaddr(ifa, ifa1); - } - -+no_promotions: - /* 2. Unlink it */ - - *ifap = ifa1->ifa_next; -diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c -index 4734475..21add55 100644 ---- a/net/ipv4/fib_frontend.c -+++ b/net/ipv4/fib_frontend.c -@@ -922,6 +922,9 @@ void fib_del_ifaddr(struct in_ifaddr *ifa, struct in_ifaddr *iprim) - subnet = 1; - } - -+ if (in_dev->dead) -+ goto no_promotions; -+ - /* Deletion is more complicated than add. - * We should take care of not to delete too much :-) - * -@@ -997,6 +1000,7 @@ void fib_del_ifaddr(struct in_ifaddr *ifa, struct in_ifaddr *iprim) - } - } - -+no_promotions: - if (!(ok & BRD_OK)) - fib_magic(RTM_DELROUTE, RTN_BROADCAST, ifa->ifa_broadcast, 32, prim); - if (subnet && ifa->ifa_prefixlen < 31) { -diff --git a/net/ipv4/netfilter/nf_nat_masquerade_ipv4.c b/net/ipv4/netfilter/nf_nat_masquerade_ipv4.c -index c6eb421..ea91058 100644 ---- a/net/ipv4/netfilter/nf_nat_masquerade_ipv4.c -+++ b/net/ipv4/netfilter/nf_nat_masquerade_ipv4.c -@@ -108,10 +108,18 @@ static int masq_inet_event(struct notifier_block *this, - unsigned long event, - void *ptr) - { -- struct net_device *dev = ((struct in_ifaddr *)ptr)->ifa_dev->dev; -+ struct in_device *idev = ((struct in_ifaddr *)ptr)->ifa_dev; - struct netdev_notifier_info info; - -- netdev_notifier_info_init(&info, dev); -+ /* The masq_dev_notifier will catch the case of the device going -+ * down. So if the inetdev is dead and being destroyed we have -+ * no work to do. Otherwise this is an individual address removal -+ * and we have to perform the flush. -+ */ -+ if (idev->dead) -+ return NOTIFY_DONE; -+ -+ netdev_notifier_info_init(&info, idev->dev); - return masq_device_event(this, event, &info); - } - --- -cgit v0.12 - diff --git a/ipv4-fib-don-t-warn-when-primary-address-is-missing-.patch b/ipv4-fib-don-t-warn-when-primary-address-is-missing-.patch new file mode 100644 index 000000000..9e4cf4e0e --- /dev/null +++ b/ipv4-fib-don-t-warn-when-primary-address-is-missing-.patch @@ -0,0 +1,40 @@ +From 9f79323a0aebccb9915ab8f4b7dcf531578b9cf9 Mon Sep 17 00:00:00 2001 +From: Paolo Abeni <pabeni@redhat.com> +Date: Thu, 21 Apr 2016 20:23:31 -0400 +Subject: [PATCH] ipv4/fib: don't warn when primary address is missing if + in_dev is dead + +After commit fbd40ea0180a ("ipv4: Don't do expensive useless work +during inetdev destroy.") when deleting an interface, +fib_del_ifaddr() can be executed without any primary address +present on the dead interface. + +The above is safe, but triggers some "bug: prim == NULL" warnings. + +This commit avoids warning if the in_dev is dead + +Signed-off-by: Paolo Abeni <pabeni@redhat.com> +--- + net/ipv4/fib_frontend.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c +index 8a9246deccfe..63566ec54794 100644 +--- a/net/ipv4/fib_frontend.c ++++ b/net/ipv4/fib_frontend.c +@@ -904,7 +904,11 @@ void fib_del_ifaddr(struct in_ifaddr *ifa, struct in_ifaddr *iprim) + if (ifa->ifa_flags & IFA_F_SECONDARY) { + prim = inet_ifa_byprefix(in_dev, any, ifa->ifa_mask); + if (!prim) { +- pr_warn("%s: bug: prim == NULL\n", __func__); ++ /* if the device has been deleted, we don't perform ++ * address promotion ++ */ ++ if (!in_dev->dead) ++ pr_warn("%s: bug: prim == NULL\n", __func__); + return; + } + if (iprim && iprim != prim) { +-- +2.5.5 + diff --git a/kernel.spec b/kernel.spec index 42ab95b23..46bfccc91 100644 --- a/kernel.spec +++ b/kernel.spec @@ -58,7 +58,7 @@ Summary: The Linux kernel # Do we have a -stable update to apply? -%define stable_update 7 +%define stable_update 9 # Set rpm version accordingly %if 0%{?stable_update} %define stablerev %{stable_update} @@ -357,7 +357,7 @@ Summary: The Linux kernel # Packages that need to be installed before the kernel is, because the %%post # scripts use them. # -%define kernel_prereq fileutils, systemd >= 203-2 +%define kernel_prereq fileutils, systemd >= 203-2, /usr/bin/kernel-install %define initrd_prereq dracut >= 027 @@ -515,6 +515,8 @@ Source5005: kbuild-AFTER_LINK.patch Patch451: lib-cpumask-Make-CPUMASK_OFFSTACK-usable-without-deb.patch +Patch452: 0001-gpu-ipu-v3-Fix-imx-ipuv3-crtc-module-autoloading.patch + Patch454: arm64-avoid-needing-console-to-enable-serial-console.patch Patch456: arm64-acpi-drop-expert-patch.patch @@ -601,9 +603,6 @@ Patch503: drm-i915-turn-off-wc-mmaps.patch Patch508: kexec-uefi-copy-secure_boot-flag-in-boot-params.patch -#CVE-2015-7833 rhbz 1270158 1270160 -Patch567: usbvision-fix-crash-on-detecting-device-with-invalid.patch - #rhbz 1287819 Patch570: HID-multitouch-enable-palm-rejection-if-device-imple.patch @@ -634,42 +633,32 @@ Patch659: pipe-limit-the-per-user-amount-of-pages-allocated-in.patch #rhbz 1310252 1313318 Patch660: 0001-drm-i915-Pretend-cursor-is-always-on-for-ILK-style-W.patch -#rhbz 1316719 -Patch662: 0001-cdc-acm-fix-NULL-pointer-reference.patch - #CVE-2016-3135 rhbz 1317386 1317387 Patch664: netfilter-x_tables-check-for-size-overflow.patch #CVE-2016-3134 rhbz 1317383 1317384 Patch665: netfilter-x_tables-deal-with-bogus-nextoffset-values.patch -#CVE-2016-3135 rhbz 1318172 1318270 -Patch666: ipv4-Dont-do-expensive-useless-work-during-inetdev-des.patch - -#rhbz 1315013 -Patch679: 0001-uas-Limit-qdepth-at-the-scsi-host-level.patch - -#CVE-2016-2187 rhbz 1317017 1317010 -Patch686: input-gtco-fix-crash-on-detecting-device-without-end.patch - -#rhbz 1295646 -Patch688: 09-29-drm-udl-Use-unlocked-gem-unreferencing.patch - # CVE-2016-3672 rhbz 1324749 1324750 Patch690: x86-mm-32-Enable-full-randomization-on-i386-and-X86_.patch -#CVE-2015-8839 rhbz 1323577 1323579 -Patch691: ext4-fix-races-between-page-faults-and-hole-punching.patch -Patch692: ext4-move-unlocked-dio-protection-from-ext4_alloc_fi.patch -Patch693: ext4-fix-races-between-buffered-IO-and-collapse-inse.patch -Patch694: ext4-fix-races-of-writeback-with-punch-hole-and-zero.patch - #CVE-2016-3951 rhbz 1324782 1324815 Patch695: cdc_ncm-do-not-call-usbnet_link_change-from-cdc_ncm_.patch -Patch696: usbnet-cleanup-after-bind-in-probe.patch -#rhbz 1317116 -Patch697: HID-wacom-fix-Bamboo-ONE-oops.patch +#rhbz 1309980 +Patch698: 0001-ACPI-processor-Request-native-thermal-interrupt-hand.patch + +#rhbz 1309487 +Patch701: antenna_select.patch + +# Follow on for CVE-2016-3156 +Patch702: ipv4-fib-don-t-warn-when-primary-address-is-missing-.patch + +# Stop splashing crap about broken firmware BGRT +Patch704: x86-efi-bgrt-Switch-all-pr_err-to-pr_debug-for-inval.patch + +#CVE-2016-4482 rhbz 1332931 1332932 +Patch705: USB-usbfs-fix-potential-infoleak-in-devio.patch # END OF PATCH DEFINITIONS %endif @@ -2117,6 +2106,36 @@ fi # # %changelog +* Wed May 04 2016 Laura Abbott <labbott@fedoraproject.org> - 4.4.9-300 +- Linux v4.4.9 + +* Wed May 04 2016 Josh Boyer <jwboyer@fedoraproject.org> +- Enable NFC_NXP_NCI options (rhbz 1290556) +- CVE-2016-4482 info leak in devio.c (rhbz 1332931 1332932) + +* Fri Apr 29 2016 Peter Robinson <pbrobinson@fedoraproject.org> +- Add patch to fix i.MX6 graphics + +* Thu Apr 28 2016 Josh Boyer <jwboyer@fedoraproject.org> +- Don't splash warnings from broken BGRT firmware implementations +- Require /usr/bin/kernel-install (rhbz 1331012) + +* Tue Apr 26 2016 Josh Boyer <jwboyer@fedoraproject.org> +- Enable IEEE802154_AT86RF230 on more arches (rhbz 1330356) + +* Wed Apr 20 2016 Laura Abbott <labbott@fedoraproject.org> - 4.4.8-300 +- Linux v4.4.8 +- Allow antenna selection for rtl8723be (rhbz 1309487) + +* Tue Apr 19 2016 Josh Boyer <jwboyer@fedoraproject.org> +- CVE-2016-3955 usbip: buffer overflow by trusting length of incoming packets (rhbz 1328478 1328479) + +* Fri Apr 15 2016 Josh Boyer <jwboyer@fedoraproject.org> +- CVE-2016-3961 xen: hugetlbfs use may crash PV guests (rhbz 1327219 1323956) + +* Wed Apr 13 2016 Laura Abbott <labbott@fedoraproject.org> +- Fix for Skylake pstate issues (rhbz 1309980) + * Tue Apr 12 2016 Laura Abbott <labbott@redhat.com> - 4.4.7-300 - Linux v4.4.7 @@ -1,3 +1,3 @@ 9a78fa2eb6c68ca5a40ed5af08142599 linux-4.4.tar.xz dcbc8fe378a676d5d0dd208cf524e144 perf-man-4.4.tar.gz -2286314f215706401dd51bf07b179ae4 patch-4.4.7.xz +b0c445b438e7563f2e33dba9edc926eb patch-4.4.9.xz diff --git a/usbnet-cleanup-after-bind-in-probe.patch b/usbnet-cleanup-after-bind-in-probe.patch deleted file mode 100644 index dc231a943..000000000 --- a/usbnet-cleanup-after-bind-in-probe.patch +++ /dev/null @@ -1,39 +0,0 @@ -From 1666984c8625b3db19a9abc298931d35ab7bc64b Mon Sep 17 00:00:00 2001 -From: Oliver Neukum <oneukum@suse.com> -Date: Mon, 7 Mar 2016 11:31:10 +0100 -Subject: [PATCH] usbnet: cleanup after bind() in probe() - -In case bind() works, but a later error forces bailing -in probe() in error cases work and a timer may be scheduled. -They must be killed. This fixes an error case related to -the double free reported in -http://www.spinics.net/lists/netdev/msg367669.html -and needs to go on top of Linus' fix to cdc-ncm. - -Signed-off-by: Oliver Neukum <ONeukum@suse.com> -Signed-off-by: David S. Miller <davem@davemloft.net> ---- - drivers/net/usb/usbnet.c | 7 +++++++ - 1 file changed, 7 insertions(+) - -diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c -index 0b0ba7ef14e4..10798128c03f 100644 ---- a/drivers/net/usb/usbnet.c -+++ b/drivers/net/usb/usbnet.c -@@ -1769,6 +1769,13 @@ out3: - if (info->unbind) - info->unbind (dev, udev); - out1: -+ /* subdrivers must undo all they did in bind() if they -+ * fail it, but we may fail later and a deferred kevent -+ * may trigger an error resubmitting itself and, worse, -+ * schedule a timer. So we kill it all just in case. -+ */ -+ cancel_work_sync(&dev->kevent); -+ del_timer_sync(&dev->delay); - free_netdev(net); - out: - return status; --- -2.5.5 - diff --git a/usbvision-fix-crash-on-detecting-device-with-invalid.patch b/usbvision-fix-crash-on-detecting-device-with-invalid.patch deleted file mode 100644 index a03e37907..000000000 --- a/usbvision-fix-crash-on-detecting-device-with-invalid.patch +++ /dev/null @@ -1,49 +0,0 @@ -From 2ea39fc263c6a7589e15edb7d2d1c89fa569be53 Mon Sep 17 00:00:00 2001 -From: Vladis Dronov <vdronov@redhat.com> -Date: Mon, 16 Nov 2015 15:55:11 -0200 -Subject: [PATCH] usbvision: fix crash on detecting device with invalid - configuration - -The usbvision driver crashes when a specially crafted usb device with invalid -number of interfaces or endpoints is detected. This fix adds checks that the -device has proper configuration expected by the driver. - -Reported-by: Ralf Spenneberg <ralf@spenneberg.net> -Signed-off-by: Vladis Dronov <vdronov@redhat.com> -Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com> ---- - drivers/media/usb/usbvision/usbvision-video.c | 16 +++++++++++++++- - 1 file changed, 15 insertions(+), 1 deletion(-) - -diff --git a/drivers/media/usb/usbvision/usbvision-video.c b/drivers/media/usb/usbvision/usbvision-video.c -index b693206f66dd..d1dc1a198e3e 100644 ---- a/drivers/media/usb/usbvision/usbvision-video.c -+++ b/drivers/media/usb/usbvision/usbvision-video.c -@@ -1463,9 +1463,23 @@ static int usbvision_probe(struct usb_interface *intf, - - if (usbvision_device_data[model].interface >= 0) - interface = &dev->actconfig->interface[usbvision_device_data[model].interface]->altsetting[0]; -- else -+ else if (ifnum < dev->actconfig->desc.bNumInterfaces) - interface = &dev->actconfig->interface[ifnum]->altsetting[0]; -+ else { -+ dev_err(&intf->dev, "interface %d is invalid, max is %d\n", -+ ifnum, dev->actconfig->desc.bNumInterfaces - 1); -+ ret = -ENODEV; -+ goto err_usb; -+ } -+ -+ if (interface->desc.bNumEndpoints < 2) { -+ dev_err(&intf->dev, "interface %d has %d endpoints, but must" -+ " have minimum 2\n", ifnum, interface->desc.bNumEndpoints); -+ ret = -ENODEV; -+ goto err_usb; -+ } - endpoint = &interface->endpoint[1].desc; -+ - if (!usb_endpoint_xfer_isoc(endpoint)) { - dev_err(&intf->dev, "%s: interface %d. has non-ISO endpoint!\n", - __func__, ifnum); --- -2.5.0 - diff --git a/x86-efi-bgrt-Switch-all-pr_err-to-pr_debug-for-inval.patch b/x86-efi-bgrt-Switch-all-pr_err-to-pr_debug-for-inval.patch new file mode 100644 index 000000000..d3d0aa2c3 --- /dev/null +++ b/x86-efi-bgrt-Switch-all-pr_err-to-pr_debug-for-inval.patch @@ -0,0 +1,94 @@ +From 3e4f68f273ef86e6ed8be24a86f8ef514deaecc0 Mon Sep 17 00:00:00 2001 +From: Josh Boyer <jwboyer@fedoraproject.org> +Date: Wed, 27 Apr 2016 08:37:41 -0400 +Subject: [PATCH] x86/efi-bgrt: Switch all pr_err() to pr_debug() for invalid + BGRT + +The promise of pretty boot splashes from firmware via BGRT was at +best only that; a promise. The kernel diligently checks to make +sure the BGRT data firmware gives it is valid, and dutifully warns +the user when it isn't. However, it does so via the pr_err log +level which seems unnecessary. The user cannot do anything about +this and there really isn't an error on the part of Linux to +correct. + +This lowers the log level by using pr_debug instead. Users will +no longer have their boot process uglified by the kernel reminding +us that firmware can and often is broken. Ironic, considering +BGRT is supposed to make boot pretty to begin with. + +Signed-off-by: Josh Boyer <jwboyer@fedoraproject.org> +--- + arch/x86/platform/efi/efi-bgrt.c | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +diff --git a/arch/x86/platform/efi/efi-bgrt.c b/arch/x86/platform/efi/efi-bgrt.c +index ea48449b2e63..87da4108785b 100644 +--- a/arch/x86/platform/efi/efi-bgrt.c ++++ b/arch/x86/platform/efi/efi-bgrt.c +@@ -41,17 +41,17 @@ void __init efi_bgrt_init(void) + return; + + if (bgrt_tab->header.length < sizeof(*bgrt_tab)) { +- pr_err("Ignoring BGRT: invalid length %u (expected %zu)\n", ++ pr_debug("Ignoring BGRT: invalid length %u (expected %zu)\n", + bgrt_tab->header.length, sizeof(*bgrt_tab)); + return; + } + if (bgrt_tab->version != 1) { +- pr_err("Ignoring BGRT: invalid version %u (expected 1)\n", ++ pr_debug("Ignoring BGRT: invalid version %u (expected 1)\n", + bgrt_tab->version); + return; + } + if (bgrt_tab->status & 0xfe) { +- pr_err("Ignoring BGRT: reserved status bits are non-zero %u\n", ++ pr_debug("Ignoring BGRT: reserved status bits are non-zero %u\n", + bgrt_tab->status); + return; + } +@@ -61,12 +61,12 @@ void __init efi_bgrt_init(void) + return; + } + if (bgrt_tab->image_type != 0) { +- pr_err("Ignoring BGRT: invalid image type %u (expected 0)\n", ++ pr_debug("Ignoring BGRT: invalid image type %u (expected 0)\n", + bgrt_tab->image_type); + return; + } + if (!bgrt_tab->image_address) { +- pr_err("Ignoring BGRT: null image address\n"); ++ pr_debug("Ignoring BGRT: null image address\n"); + return; + } + +@@ -76,7 +76,7 @@ void __init efi_bgrt_init(void) + sizeof(bmp_header)); + ioremapped = true; + if (!image) { +- pr_err("Ignoring BGRT: failed to map image header memory\n"); ++ pr_debug("Ignoring BGRT: failed to map image header memory\n"); + return; + } + } +@@ -88,7 +88,7 @@ void __init efi_bgrt_init(void) + + bgrt_image = kmalloc(bgrt_image_size, GFP_KERNEL | __GFP_NOWARN); + if (!bgrt_image) { +- pr_err("Ignoring BGRT: failed to allocate memory for image (wanted %zu bytes)\n", ++ pr_debug("Ignoring BGRT: failed to allocate memory for image (wanted %zu bytes)\n", + bgrt_image_size); + return; + } +@@ -97,7 +97,7 @@ void __init efi_bgrt_init(void) + image = early_ioremap(bgrt_tab->image_address, + bmp_header.size); + if (!image) { +- pr_err("Ignoring BGRT: failed to map image memory\n"); ++ pr_debug("Ignoring BGRT: failed to map image memory\n"); + kfree(bgrt_image); + bgrt_image = NULL; + return; +-- +2.5.5 + |