OSDN Git Service
Arindam Nath [Thu, 5 May 2011 06:49:02 +0000 (12:19 +0530)]
mmc: sd: set current limit for uhs cards
We decide on the current limit to be set for the card based on the
Capability of Host Controller to provide current at 1.8V signalling,
and the maximum current limit of the card as indicated by CMD6
mode 0. We then set the current limit for the card using CMD6 mode 1.
As per the Physical Layer Spec v3.01, the current limit switch is
only applicable for SDR50, SDR104, and DDR50 bus speed modes. For
other UHS-I modes, we set the default current limit of 200mA.
Tested by Zhangfei Gao with a Toshiba uhs card and general hs card,
on mmp2 in SDMA mode.
Signed-off-by: Arindam Nath <arindam.nath@amd.com>
Reviewed-by: Philip Rakity <prakity@marvell.com>
Tested-by: Philip Rakity <prakity@marvell.com>
Acked-by: Zhangfei Gao <zhangfei.gao@marvell.com>
Signed-off-by: Chris Ball <cjb@laptop.org>
Arindam Nath [Thu, 5 May 2011 06:49:01 +0000 (12:19 +0530)]
mmc: sd: add support for uhs bus speed mode selection
This patch adds support for setting UHS-I bus speed mode during UHS-I
initialization procedure. Since both the host and card can support
more than one bus speed, we select the highest speed based on both of
their capabilities. First we set the bus speed mode for the card using
CMD6 mode 1, and then we program the host controller to support the
required speed mode. We also set High Speed Enable in case one of the
UHS-I modes is selected. We take care to reset SD clock before setting
UHS mode in the Host Control2 register, and then re-enable it as per
the Host Controller spec v3.00. We then set the clock frequency for
the UHS-I mode selected.
Tested by Zhangfei Gao with a Toshiba uhs card and general hs card,
on mmp2 in SDMA mode.
Signed-off-by: Arindam Nath <arindam.nath@amd.com>
Reviewed-by: Philip Rakity <prakity@marvell.com>
Tested-by: Philip Rakity <prakity@marvell.com>
Acked-by: Zhangfei Gao <zhangfei.gao@marvell.com>
Signed-off-by: Chris Ball <cjb@laptop.org>
Arindam Nath [Thu, 5 May 2011 06:49:00 +0000 (12:19 +0530)]
mmc: sdhci: reset sdclk before setting high speed enable
As per Host Controller spec v3.00, we reset SDCLK before setting
High Speed Enable, and then set it back to avoid generating clock
gliches. Before enabling SDCLK again, we make sure the clock is
stable, so we use sdhci_set_clock().
Tested by Zhangfei Gao with a Toshiba uhs card and general hs card,
on mmp2 in SDMA mode.
Signed-off-by: Arindam Nath <arindam.nath@amd.com>
Reviewed-by: Philip Rakity <prakity@marvell.com>
Tested-by: Philip Rakity <prakity@marvell.com>
Acked-by: Zhangfei Gao <zhangfei.gao@marvell.com>
Signed-off-by: Chris Ball <cjb@laptop.org>
Arindam Nath [Thu, 5 May 2011 06:48:59 +0000 (12:18 +0530)]
mmc: sd: add support for driver type selection
This patch adds support for setting driver strength during UHS-I
initialization procedure. Since UHS-I cards set S18A (bit 24) in
response to ACMD41, we use this as a base for UHS-I initialization.
We modify the parameter list of mmc_sd_get_cid() so that we can
save the ROCR from ACMD41 to check whether bit 24 is set.
We decide whether the Host Controller supports A, C, or D driver
type depending on the Capabilities register. Driver type B is
suported by default. We then set the appropriate driver type for
the card using CMD6 mode 1. As per Host Controller spec v3.00, we
set driver type for the host only if Preset Value Enable in the
Host Control2 register is not set. SDHCI_HOST_CONTROL has been
renamed to SDHCI_HOST_CONTROL1 to conform to the spec.
Tested by Zhangfei Gao with a Toshiba uhs card and general hs card,
on mmp2 in SDMA mode.
Signed-off-by: Arindam Nath <arindam.nath@amd.com>
Reviewed-by: Philip Rakity <prakity@marvell.com>
Tested-by: Philip Rakity <prakity@marvell.com>
Acked-by: Zhangfei Gao <zhangfei.gao@marvell.com>
Signed-off-by: Chris Ball <cjb@laptop.org>
Arindam Nath [Thu, 5 May 2011 06:48:58 +0000 (12:18 +0530)]
mmc: sd: query function modes for uhs cards
SD cards which conform to Physical Layer Spec v3.01 can support
additional Bus Speed Modes, Driver Strength, and Current Limit
other than the default values. We use CMD6 mode 0 to read these
additional card functions. The values read here will be used
during UHS-I initialization steps.
Tested by Zhangfei Gao with a Toshiba uhs card and general hs card,
on mmp2 in SDMA mode.
Signed-off-by: Arindam Nath <arindam.nath@amd.com>
Reviewed-by: Philip Rakity <prakity@marvell.com>
Tested-by: Philip Rakity <prakity@marvell.com>
Acked-by: Zhangfei Gao <zhangfei.gao@marvell.com>
Signed-off-by: Chris Ball <cjb@laptop.org>
Arindam Nath [Thu, 5 May 2011 06:48:57 +0000 (12:18 +0530)]
mmc: sd: add support for signal voltage switch procedure
Host Controller v3.00 adds another Capabilities register. Apart
from other things, this new register indicates whether the Host
Controller supports SDR50, SDR104, and DDR50 UHS-I modes. The spec
doesn't mention about explicit support for SDR12 and SDR25 UHS-I
modes, so the Host Controller v3.00 should support them by default.
Also if the controller supports SDR104 mode, it will also support
SDR50 mode as well. So depending on the host support, we set the
corresponding MMC_CAP_* flags. One more new register. Host Control2
is added in v3.00, which is used during Signal Voltage Switch
procedure described below.
Since as per v3.00 spec, UHS-I supported hosts should set S18R
to 1, we set S18R (bit 24) of OCR before sending ACMD41. We also
need to set XPC (bit 28) of OCR in case the host can supply >150mA.
This support is indicated by the Maximum Current Capabilities
register of the Host Controller.
If the response of ACMD41 has both CCS and S18A set, we start the
signal voltage switch procedure, which if successfull, will switch
the card from 3.3V signalling to 1.8V signalling. Signal voltage
switch procedure adds support for a new command CMD11 in the
Physical Layer Spec v3.01. As part of this procedure, we need to
set 1.8V Signalling Enable (bit 3) of Host Control2 register, which
if remains set after 5ms, means the switch to 1.8V signalling is
successfull. Otherwise, we clear bit 24 of OCR and retry the
initialization sequence. When we remove the card, and insert the
same or another card, we need to make sure that we start with 3.3V
signalling voltage. So we call mmc_set_signal_voltage() with
MMC_SIGNAL_VOLTAGE_330 set so that we are back to 3.3V signalling
voltage before we actually start initializing the card.
Tested by Zhangfei Gao with a Toshiba uhs card and general hs card,
on mmp2 in SDMA mode.
Signed-off-by: Arindam Nath <arindam.nath@amd.com>
Reviewed-by: Philip Rakity <prakity@marvell.com>
Tested-by: Philip Rakity <prakity@marvell.com>
Acked-by: Zhangfei Gao <zhangfei.gao@marvell.com>
Signed-off-by: Chris Ball <cjb@laptop.org>
John Calixto [Tue, 26 Apr 2011 22:56:29 +0000 (18:56 -0400)]
mmc: core: Add mmc CMD+ACMD passthrough ioctl
Allows appropriately-privileged applications to send CMD (normal) and ACMD
(application-specific; preceded with CMD55) commands to cards/devices on
the mmc bus. This is primarily useful for enabling the security
functionality built in to every SD card.
It can also be used as a generic passthrough (e.g. to enable virtual
machines to control mmc bus devices directly). However, this use case has
not been tested rigorously. Generic passthrough testing was only conducted
for a few non-security opcodes to prove the feasibility of the passthrough.
Since any opcode can be sent using this passthrough, it is very possible to
render the card/device unusable. Applications that use this ioctl must
have CAP_SYS_RAWIO.
Security commands tested on TI PCIxx12 (SDHCI), Sigma Designs SMP8652 SoC,
TI OMAP3621/OMAP3630 SoC, Samsung S5PC110 SoC, Qualcomm MSM7200A SoC.
Signed-off-by: John Calixto <john.calixto@modsystems.com>
Reviewed-by: Andrei Warkentin <andreiw@motorola.com>
Reviewed-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Chris Ball <cjb@laptop.org>
Rabin Vincent [Sat, 23 Apr 2011 15:22:58 +0000 (20:52 +0530)]
mmc: block: init force_ro sysfs attribute
To avoid lockdep warnings:
BUG: key
dc90a520 not in .data!
------------[ cut here ]------------
WARNING: at /home/rabin/kernel/arm/kernel/lockdep.c:2701 sysfs_add_file_mode+0x4c/0xb0()
Modules linked in:
[<
c004b5d8>] (unwind_backtrace+0x0/0xe4) from [<
c0074f20>] (warn_slowpath_common+0x4c/0x64)
[<
c0074f20>] (warn_slowpath_common+0x4c/0x64) from [<
c0074f50>] (warn_slowpath_null+0x18/0x1c)
[<
c0074f50>] (warn_slowpath_null+0x18/0x1c) from [<
c0157fec>] (sysfs_add_file_mode+0x4c/0xb0)
[<
c0157fec>] (sysfs_add_file_mode+0x4c/0xb0) from [<
c02d61e4>] (mmc_add_disk+0x40/0x64)
[<
c02d61e4>] (mmc_add_disk+0x40/0x64) from [<
c02d64cc>] (mmc_blk_probe+0x188/0x1fc)
[<
c02d64cc>] (mmc_blk_probe+0x188/0x1fc) from [<
c02ce820>] (mmc_bus_probe+0x14/0x18)
...
Signed-off-by: Rabin Vincent <rabin@rab.in>
Signed-off-by: Chris Ball <cjb@laptop.org>
Takashi Iwai [Thu, 21 Apr 2011 18:26:38 +0000 (20:26 +0200)]
mmc: sdhci: Fix read-only detection with JMicron 388 chip
On HP laptops with JMicron 388 chip, the write-locked SD card isn't
detected correctly as read-only in many cases. This is because the
PRESENT_STATE register becomes unsable just after plugging, and it
returns the WRITE_PROTECT bit wrongly at the first read.
This patch fixes the read-only detection by adding a new sdhci quirk
indicating to check the register more intensively with a relatively
long delay.
The patch is tested with 2.6.39-rc4 kernel.
Cc: Aries Lee <arieslee@jmicron.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Chris Ball <cjb@laptop.org>
Andrei Warkentin [Fri, 22 Apr 2011 03:46:13 +0000 (22:46 -0500)]
mmc: Ensure hardware partitions don't mess with mmcblk device naming.
With the hardware partitions support (which represent additional logical
devices present on MMC), devidx does not correspond with index used to form
/dev/mmcblkX names. So use an additional allocated index for device names.
Signed-off-by: Andrei Warkentin <andreiw@motorola.com>
Signed-off-by: Chris Ball <cjb@laptop.org>
Philip Rakity [Fri, 21 Jan 2011 19:26:40 +0000 (11:26 -0800)]
mmc: sdhci: Add pre and post reset processing for chip specific reset
Marvell pxa controllers have private registers that may need to be
modified before and after a reset is done.
For example, the SD reset operation, RESET_ALL, will reset the private
registers to their default state. This will cause the clock adjustment
registers that may have been programmed to have incorrect values.
RESET_DATA sometimes needs to be delayed before the reset is done
(depending on SoC) to enable any transactions being handled by the
SDIO card to be completed. Needed in pre SD 3.0 silicon to handle
clock gating.
Implement hooks to allow this to happen.
Signed-off-by: Philip Rakity <prakity@marvell.com>
Signed-off-by: Chris Ball <cjb@laptop.org>
Mark Brown [Tue, 19 Apr 2011 17:44:17 +0000 (18:44 +0100)]
mmc: sdhci: Fix SDHCI_QUIRK_TIMEOUT_USES_SDCLK
Commit 373e6a (mmc: sdhci: R1B command handling + MMC_CAP_ERASE) moved the
handling of SDHCI_QUIRK_TIMEOUT_USES_SDCLK from sdhci_calc_timeout() to
sdhci_add_host(). This causes division by zero errors on at least the S3C
SDHCI controller as the quirk implementation needs host->clock set to work
but host->clock has not been set when sdhci_add_host() is called.
Fix this by backing out that portion of the change, the clock may vary at
runtime anyway. It does occur to me that we may want to move the quirk to
where we set the clock but this seems more invasive and I'm concerned
about undesirable side effects.
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Cc: Andrei Warkentin <andreiw@motorola.com>
Signed-off-by: Chris Ball <cjb@laptop.org>
Chris Ball [Thu, 14 Apr 2011 03:49:45 +0000 (23:49 -0400)]
mmc: initialize struct mmc_request at declaration time
Converts from:
struct mmc_request mrq;
memset(&mrq, 0, sizeof(struct mmc_request));
to:
struct mmc_request mrq = {0};
because it's shorter, as performant, and easier to work out whether
initialization has happened.
Signed-off-by: Chris Ball <cjb@laptop.org>
Chris Ball [Thu, 14 Apr 2011 03:46:05 +0000 (23:46 -0400)]
mmc: initialize struct mmc_data at declaration time
Converts from:
struct mmc_data data;
memset(&data, 0, sizeof(struct mmc_data));
to:
struct mmc_data data = {0};
because it's shorter, as performant, and easier to work out whether
initialization has happened.
Signed-off-by: Chris Ball <cjb@laptop.org>
Chris Ball [Thu, 14 Apr 2011 03:40:30 +0000 (23:40 -0400)]
mmc: initialize struct mmc_command at declaration time
Converts from:
struct mmc_command cmd;
memset(&cmd, 0, sizeof(struct mmc_command));
to:
struct mmc_command cmd = {0};
because it's shorter, as performant, and easier to work out whether
initialization has happened.
Signed-off-by: Chris Ball <cjb@laptop.org>
Chris Ball [Wed, 13 Apr 2011 20:28:34 +0000 (16:28 -0400)]
mmc: card: Fix use of uninitialized data in mmc_blk_issue_rw_rq.
mmc_blk_issue_rw_rq did not zero out mmc_command on stack.
Signed-off-by: Chris Ball <cjb@laptop.org>
Chris Ball [Wed, 13 Apr 2011 20:25:30 +0000 (16:25 -0400)]
mmc: core: Fix use of uninitialized data in mmc_send_if_cond.
mmc_send_if_cond did not zero out mmc_command on stack.
Signed-off-by: Chris Ball <cjb@laptop.org>
Andrei Warkentin [Wed, 13 Apr 2011 20:33:12 +0000 (15:33 -0500)]
mmc: core: Fix use of uninitialized data in mmc_cmd_app.
mmc_cmd_app did not zero out mmc_command on stack.
Reported-by: Chuanxiao Dong <chuanxiao.dong@intel.com>
Signed-off-by: Andrei Warkentin <andreiw@motorola.com>
Signed-off-by: Chris Ball <cjb@laptop.org>
Andrei Warkentin [Tue, 12 Apr 2011 20:06:53 +0000 (15:06 -0500)]
mmc: quirks: Fix erase/trim for certain SanDisk cards.
CMD38 argument is passed through EXT_CSD[113].
Signed-off-by: Andrei Warkentin <andreiw@motorola.com>
Signed-off-by: Chris Ball <cjb@laptop.org>
Mikko Vinni [Tue, 12 Apr 2011 13:36:18 +0000 (09:36 -0400)]
mmc: sdhci: work around broken dma boundary behavior
Some SD host controllers (noticed on an integrated JMicron SD reader on an
HP Pavilion dv5-1250eo laptop) don't update the dma address register before
signaling a dma interrupt due to a dma boundary. Update the register
manually to the next boundary (by default 512KiB), at which the transfer
stopped.
As long as each transfer is at most 512KiB in size (guaranteed by a BUG_ON
in sdhci_prepare_data()) and the boundary is kept at the default value,
this fix is needed at most once per transfer. Smaller boundaries are taken
care of by counting the transferred bytes.
Fixes: https://bugzilla.kernel.org/show_bug.cgi?id=28462
Signed-off-by: Mikko Vinni <mmvinni@yahoo.com>
Signed-off-by: Chris Ball <cjb@laptop.org>
Andrei Warkentin [Mon, 11 Apr 2011 23:11:04 +0000 (19:11 -0400)]
mmc: quirks: Support for block quirks.
Block quirks implemented using core/quirks.c support.
Signed-off-by: Andrei Warkentin <andreiw@motorola.com>
Signed-off-by: Chris Ball <cjb@laptop.org>
Andrei Warkentin [Mon, 11 Apr 2011 23:10:25 +0000 (18:10 -0500)]
mmc: MMC boot partitions support.
Allows device MMC boot partitions to be accessed. MMC partitions are
treated effectively as separate block devices on the same MMC card.
Signed-off-by: Andrei Warkentin <andreiw@motorola.com>
Acked-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Chris Ball <cjb@laptop.org>
Andrei Warkentin [Mon, 11 Apr 2011 23:10:24 +0000 (18:10 -0500)]
mmc: card: block.c cleanup for host claim/release.
Move host claim/release into mmc_blk_issue_rq.
(This is helpful so that selecting partition only has to happen
in one place for these commands.)
Signed-off-by: Andrei Warkentin <andreiw@motorola.com>
Signed-off-by: Chris Ball <cjb@laptop.org>
Andrei Warkentin [Mon, 11 Apr 2011 21:13:43 +0000 (16:13 -0500)]
mmc: core: Allow setting CMD timeout for CMD6 (SWITCH).
CMD6 is an R1B-type command, where DAT is used as busy. Depending
on register written using CMD6, timeout value can be different
as per spec.
Signed-off-by: Andrei Warkentin <andreiw@motorola.com>
Signed-off-by: Chris Ball <cjb@laptop.org>
Andrei Warkentin [Mon, 11 Apr 2011 21:13:42 +0000 (16:13 -0500)]
mmc: sdhci: R1B command handling + MMC_CAP_ERASE.
ERASE command needs R1B response, so fix R1B-type command
handling for SDHCI controller. For non-DAT commands using a busy
response, the cmd->cmd_timeout_ms (in ms) field is used for timeout
calculations.
Based on patch by Chuanxiao Dong <chuanxiao.dong@intel.com>
Signed-off-by: Andrei Warkentin <andreiw@motorola.com>
Signed-off-by: Chris Ball <cjb@laptop.org>
Andrei Warkentin [Mon, 11 Apr 2011 21:13:41 +0000 (16:13 -0500)]
mmc: core: Rename erase_timeout to cmd_timeout_ms.
Renames erase_timeout to cmd_timeout_ms inside struct mmc_command.
First step to making host honor timeouts for non-data-transfer
commands. Cleans up erase timeout code.
Signed-off-by: Andrei Warkentin <andreiw@motorola.com>
Signed-off-by: Chris Ball <cjb@laptop.org>
Randy Dunlap [Tue, 12 Apr 2011 16:59:09 +0000 (12:59 -0400)]
mmc: quirks: fix truncation warnings
Fix data truncation warnings: .manfid is not unsigned long:
drivers/mmc/core/quirks.c:36: warning: large integer implicitly truncated to unsigned type
drivers/mmc/core/quirks.c:40: warning: large integer implicitly truncated to unsigned type
drivers/mmc/core/quirks.c:43: warning: large integer implicitly truncated to unsigned type
drivers/mmc/core/quirks.c:46: warning: large integer implicitly truncated to unsigned type
Signed-off-by: Randy Dunlap <randy.dunlap@oracle.com>
Signed-off-by: Chris Ball <cjb@laptop.org>
Andrei Warkentin [Mon, 11 Apr 2011 22:02:15 +0000 (17:02 -0500)]
mmc: quirks: Extends card quirks with MMC/SD quirks matching the CID.
The current mechanism is SDIO-only. This allows us to create
function-specific quirks, without creating messy Kconfig dependencies,
or polluting core/ with function-specific code.
Signed-off-by: Andrei Warkentin <andreiw@motorola.com>
Acked-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Chris Ball <cjb@laptop.org>
Wolfram Sang [Mon, 11 Apr 2011 04:11:29 +0000 (06:11 +0200)]
mmc: core: fix memory leak in mmc_add_host
led_trigger_register_simple() allocates memory which must not be leaked
in the error-path of mmc_add_host. Move it past the only error-check in
the function.
Signed-off-by: Wolfram Sang <w.sang@pengutronix.de>
Signed-off-by: Chris Ball <cjb@laptop.org>
Ameya Palande [Tue, 5 Apr 2011 18:13:13 +0000 (21:13 +0300)]
mmc: sdhci-pci: Fix checkpatch.pl errors
This patch fixes 21 errors and 6 warnings reported by checkpatch.pl.
Signed-off-by: Ameya Palande <2ameya@gmail.com>
Reviewed-by: Wolfram Sang <w.sang@pengutronix.de>
Signed-off-by: Chris Ball <cjb@laptop.org>
Ohad Ben-Cohen [Tue, 5 Apr 2011 15:02:26 +0000 (18:02 +0300)]
mmc: quirks: wl1271 is MMC_QUIRK_DISABLE_CD
The wl12xx device supports disconnecting the pull-up resistor on
CD/DAT[3] (pin 1) of the card.
Tell SDIO core to disconnect that resistor during card init,
since we don't need it at that point (and anyway all
hosts shall provide pull-up resistors on all data lines DAT[3:0]
as described in section 6 of the SD physical specification).
As a result, this may save some power, but it's also generally healthy
since it prevents both ends from pulling up that pin, which
results in undesirable asymmetric physical bus.
Signed-off-by: Ohad Ben-Cohen <ohad@wizery.com>
Signed-off-by: Chris Ball <cjb@laptop.org>
Ohad Ben-Cohen [Tue, 5 Apr 2011 15:02:25 +0000 (18:02 +0300)]
mmc: add MMC_QUIRK_DISABLE_CD
006ebd5d introduced sdio_disable_cd(), which disconnects the pull-up
resistor on CD/DAT[3] (pin 1) of the card.
Make it possible to start using sdio_disable_cd() by introducing
MMC_QUIRK_DISABLE_CD.
Signed-off-by: Ohad Ben-Cohen <ohad@wizery.com>
Signed-off-by: Chris Ball <cjb@laptop.org>
Ohad Ben-Cohen [Tue, 5 Apr 2011 14:50:15 +0000 (17:50 +0300)]
mmc: quirks: wl1271 is MMC_QUIRK_NONSTD_FUNC_IF
Tell SDIO core to ignore the standard SDIO function interface
codes indicated by the wl1271. This is required because the
wl1271 erroneously indicates its first function as a standard
Bluetooth SDIO interface, and that drives btsdio mad.
Signed-off-by: Ohad Ben-Cohen <ohad@wizery.com>
Signed-off-by: Chris Ball <cjb@laptop.org>
Ohad Ben-Cohen [Tue, 5 Apr 2011 14:50:14 +0000 (17:50 +0300)]
mmc: add MMC_QUIRK_NONSTD_FUNC_IF
Introduce MMC_QUIRK_NONSTD_FUNC_IF to ignore the "SDIO Standard Function
interface code" as indicated by the card's FBR, and instead treat all
functions as non-standard interfaces.
This is required to prevent standard drivers from facing
errors when trying to communicate with SDIO cards that erroneously
indicate standard function interface codes.
Signed-off-by: Ohad Ben-Cohen <ohad@wizery.com>
Signed-off-by: Chris Ball <cjb@laptop.org>
Ohad Ben-Cohen [Tue, 5 Apr 2011 14:43:21 +0000 (17:43 +0300)]
mmc: do not switch to 1-bit mode if not required
6b5eda36 followed SDIO spec part E1 section 8, which states that
in case SDIO interrupts are being used to wake up a suspended host,
then it is required to switch to 1-bit mode before stopping the clock.
Before switching to 1-bit mode (or back to 4-bit mode on resume),
make sure that SDIO interrupts are really being used to wake the host.
This is helpful for devices which have an external irq line (e.g.
wl1271), and do not use SDIO interrupts to wake up the host.
In this case, switching to 1-bit mode (and back to 4-bit mode on resume)
is not necessary.
Reported-by: Eliad Peller <eliad@wizery.com>
Signed-off-by: Ohad Ben-Cohen <ohad@wizery.com>
Signed-off-by: Chris Ball <cjb@laptop.org>
Ohad Ben-Cohen [Tue, 5 Apr 2011 14:43:20 +0000 (17:43 +0300)]
mmc: mmc_card_keep_power cleanups
mmc_card_is_powered_resumed is a mouthful; instead, simply use
mmc_card_keep_power, which also better explains the purpose of
the macro.
Employ mmc_card_keep_power() where possible.
Signed-off-by: Ohad Ben-Cohen <ohad@wizery.com>
Signed-off-by: Chris Ball <cjb@laptop.org>
Andrei Warkentin [Thu, 31 Mar 2011 23:40:00 +0000 (18:40 -0500)]
mmc: Reliable write support.
Allows reliable writes to be used for MMC writes. Reliable writes are used
to service write REQ_FUA/REQ_META requests. Handles both the legacy and
the enhanced reliable write support in MMC cards.
Signed-off-by: Andrei Warkentin <andreiw@motorola.com>
Reviewed-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Chris Ball <cjb@laptop.org>
Shawn Guo [Thu, 31 Mar 2011 01:31:19 +0000 (09:31 +0800)]
mmc: sdhci: change CONFIG of MMC_SDHCI_TEGRA from 'tristate' to 'bool'
This config option is used to decide whether tegra sdhci support
should be build into the sdhci-platform module. So setting it 'm'
is nonsense, since we can't build part of an module as a module.
The effect for 'm' will probably be the same as for 'n'.
Signed-off-by: Shawn Guo <shawn.guo@linaro.org>
Signed-off-by: Chris Ball <cjb@laptop.org>
Venkat Rao [Sat, 26 Mar 2011 00:37:47 +0000 (20:37 -0400)]
mmc: tegra: add pm_flags
Enable fast bcm4329 WIFI suspend/resume on Tegra2 board.
This patch allows the mach-tegra support to tell the tegra MMC host
controller to NOT turn off power for the MMC controller the WIFI part
lives behind. Thus bcm4329 firmware doesn't need to be reloaded.
Signed-off-by: Venkat Rao <vrao@broadcom.com>
Tested-by: Grant Grundler <grundler@chromium.org>
Reviewed-by: Olof Johansson <olof@lixom.net>
Acked-by: Olof Johansson <olof@lixom.net>
Signed-off-by: Chris Ball <cjb@laptop.org>
John Ogness [Fri, 25 Mar 2011 08:47:37 +0000 (09:47 +0100)]
mmc: remove redundant irq disabling
There is no need to disable irq's when using the sg_copy_*_buffer()
functions because those functions do that already. There are also
no races for the mm_queue struct here that would require the irq's
to be disabled before calling sg_copy_*_buffer().
Signed-off-by: John Ogness <john.ogness@linutronix.de>
Signed-off-by: Chris Ball <cjb@laptop.org>
Philip Rakity [Sat, 19 Mar 2011 18:10:33 +0000 (14:10 -0400)]
mmc: Ensure linux starts in eMMC user partition
uBoot sometimes leaves eMMC pointing to the private boot partition.
Ensure we always start looking at the user partition.
Signed-off-by: Philip Rakity <prakity@marvell.com>
Signed-off-by: Bruce Clemens <bpclemens@marvell.com>
Signed-off-by: Mark F. Brown <markb@marvell.com>
Signed-off-by: Chris Ball <cjb@laptop.org>
Linus Torvalds [Mon, 16 May 2011 15:47:31 +0000 (08:47 -0700)]
Merge branch 'drm-fixes' of git://git./linux/kernel/git/airlied/drm-2.6
* 'drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6:
drm: Take lock around probes for drm_fb_helper_hotplug_event
drm/i915: Revert i915.semaphore=1 default from
47ae63e0
vga_switcheroo: don't toggle-switch devices
drm/radeon/kms: add some evergreen/ni safe regs
drm/radeon/kms: fix extended lvds info parsing
drm/radeon/kms: fix tiling reg on fusion
Chris Wilson [Fri, 22 Apr 2011 10:03:57 +0000 (11:03 +0100)]
drm: Take lock around probes for drm_fb_helper_hotplug_event
We need to hold the dev->mode_config.mutex whilst detecting the output
status. But we also need to drop it for the call into
drm_fb_helper_single_fb_probe(), which indirectly acquires the lock when
attaching the fbcon.
Failure to do so exposes a race with normal output probing. Detected by
adding some warnings that the mutex is held to the backend detect routines:
[ 17.772456] WARNING: at drivers/gpu/drm/i915/intel_crt.c:471 intel_crt_detect+0x3e/0x373 [i915]()
[ 17.772458] Hardware name: Latitude E6400
[ 17.772460] Modules linked in: ....
[ 17.772582] Pid: 11, comm: kworker/0:1 Tainted: G W 2.6.38.4-custom.2 #8
[ 17.772584] Call Trace:
[ 17.772591] [<
ffffffff81046af5>] ? warn_slowpath_common+0x78/0x8c
[ 17.772603] [<
ffffffffa03f3e5c>] ? intel_crt_detect+0x3e/0x373 [i915]
[ 17.772612] [<
ffffffffa0355d49>] ? drm_helper_probe_single_connector_modes+0xbf/0x2af [drm_kms_helper]
[ 17.772619] [<
ffffffffa03534d5>] ? drm_fb_helper_probe_connector_modes+0x39/0x4d [drm_kms_helper]
[ 17.772625] [<
ffffffffa0354760>] ? drm_fb_helper_hotplug_event+0xa5/0xc3 [drm_kms_helper]
[ 17.772633] [<
ffffffffa035577f>] ? output_poll_execute+0x146/0x17c [drm_kms_helper]
[ 17.772638] [<
ffffffff81193c01>] ? cfq_init_queue+0x247/0x345
[ 17.772644] [<
ffffffffa0355639>] ? output_poll_execute+0x0/0x17c [drm_kms_helper]
[ 17.772648] [<
ffffffff8105b540>] ? process_one_work+0x193/0x28e
[ 17.772652] [<
ffffffff8105c6bc>] ? worker_thread+0xef/0x172
[ 17.772655] [<
ffffffff8105c5cd>] ? worker_thread+0x0/0x172
[ 17.772658] [<
ffffffff8105c5cd>] ? worker_thread+0x0/0x172
[ 17.772663] [<
ffffffff8105f767>] ? kthread+0x7a/0x82
[ 17.772668] [<
ffffffff8100a724>] ? kernel_thread_helper+0x4/0x10
[ 17.772671] [<
ffffffff8105f6ed>] ? kthread+0x0/0x82
[ 17.772674] [<
ffffffff8100a720>] ? kernel_thread_helper+0x0/0x10
Reported-by: Frederik Himpe <fhimpe@telenet.be>
References: https://bugs.freedesktop.org/show_bug.cgi?id=36394
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Andy Lutomirski [Fri, 13 May 2011 16:14:54 +0000 (12:14 -0400)]
drm/i915: Revert i915.semaphore=1 default from
47ae63e0
My Q67 / i7-2600 box has rev09 Sandy Bridge graphics. It hangs
instantly when GNOME loads and it hangs so hard the reset button
doesn't work. Setting i915.semaphore=0 fixes it.
Semaphores were disabled in
a1656b9090f7008d2941c314f5a64724bea2ae37
in 2.6.38 and were re-enabled by
commit
47ae63e0c2e5fdb582d471dc906eb29be94c732f
Merge:
c59a333 467cffb
Author: Chris Wilson <chris@chris-wilson.co.uk>
Date: Mon Mar 7 12:32:44 2011 +0000
Merge branch 'drm-intel-fixes' into drm-intel-next
Apply the trivial conflicting regression fixes, but keep GPU semaphores
enabled.
Conflicts:
drivers/gpu/drm/i915/i915_drv.h
drivers/gpu/drm/i915/i915_gem_execbuffer.c
(It's worth noting that the offending change is i915_drv.c,
which is not a conflict.)
Signed-off-by: Andy Lutomirski <luto@mit.edu>
Acked-by: Keith Packard <keithp@keithp.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Florian Mickler [Sun, 15 May 2011 14:32:50 +0000 (16:32 +0200)]
vga_switcheroo: don't toggle-switch devices
If the requested device is already active, ignore the request.
This restores the original behaviour of the interface. The change was
probably an unintended side effect of
commit
66b37c6777c4 vga_switcheroo: split switching into two stages
which did not take into account to duplicate the !active check in the split-off
stage2.
Fix this by factoring that check out of stage1 into the debugfs_write routine.
References: https://bugzilla.kernel.org/show_bug.cgi?id=34252
Reported-by: Igor Murzov <e-mail@date.by>
Tested-by: Igor Murzov <e-mail@date.by>
Signed-off-by: Florian Mickler <florian@mickler.org>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Linus Torvalds [Sun, 15 May 2011 17:22:10 +0000 (10:22 -0700)]
Merge git://git./linux/kernel/git/mason/btrfs-unstable
* git://git.kernel.org/pub/scm/linux/kernel/git/mason/btrfs-unstable:
Btrfs: fix FS_IOC_SETFLAGS ioctl
Btrfs: fix FS_IOC_GETFLAGS ioctl
fs: remove FS_COW_FL
Btrfs: fix easily get into ENOSPC in mixed case
Prevent oopsing in posix_acl_valid()
Linus Torvalds [Sat, 14 May 2011 22:41:10 +0000 (15:41 -0700)]
Merge branch 'for-linus' of git://git./linux/kernel/git/sage/ceph-client
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client:
rbd: fix split bio handling
rbd: fix leak of ops struct
Li Zefan [Fri, 15 Apr 2011 03:03:17 +0000 (03:03 +0000)]
Btrfs: fix FS_IOC_SETFLAGS ioctl
Steps to reproduce the bug:
- Call FS_IOC_SETLFAGS ioctl with flags=FS_COMPR_FL
- Call FS_IOC_SETFLAGS ioctl with flags=0
- Call FS_IOC_GETFLAGS ioctl, and you'll see FS_COMPR_FL is still set!
Signed-off-by: Li Zefan <lizf@cn.fujitsu.com>
Signed-off-by: Chris Mason <chris.mason@oracle.com>
Li Zefan [Fri, 15 Apr 2011 03:03:06 +0000 (03:03 +0000)]
Btrfs: fix FS_IOC_GETFLAGS ioctl
As we've added per file compression/cow support.
Signed-off-by: Li Zefan <lizf@cn.fujitsu.com>
Signed-off-by: Chris Mason <chris.mason@oracle.com>
Li Zefan [Fri, 15 Apr 2011 03:02:49 +0000 (03:02 +0000)]
fs: remove FS_COW_FL
FS_COW_FL and FS_NOCOW_FL were newly introduced to control per file
COW in btrfs, but FS_NOCOW_FL is sufficient.
The fact is we don't have corresponding BTRFS_INODE_COW flag.
COW is default, and FS_NOCOW_FL can be used to switch off COW for
a single file.
If we mount btrfs with nodatacow, a newly created file will be set with
the FS_NOCOW_FL flag. So to turn on COW for it, we can just clear the
FS_NOCOW_FL flag.
Signed-off-by: Li Zefan <lizf@cn.fujitsu.com>
Signed-off-by: Chris Mason <chris.mason@oracle.com>
liubo [Fri, 8 Apr 2011 08:44:37 +0000 (08:44 +0000)]
Btrfs: fix easily get into ENOSPC in mixed case
When a btrfs disk is created by mixed data & metadata option, it will have no
pure data or pure metadata space info.
In btrfs's for-linus branch, commit
78b1ea13838039cd88afdd62519b40b344d6c920
(Btrfs: fix OOPS of empty filesystem after balance) initializes space infos at
the very beginning. The problem is this initialization does not take the mixed
case into account, which will cause btrfs will easily get into ENOSPC in mixed
case.
Signed-off-by: Liu Bo <liubo2009@cn.fujitsu.com>
Signed-off-by: Chris Mason <chris.mason@oracle.com>
Daniel J Blueman [Tue, 3 May 2011 16:44:13 +0000 (16:44 +0000)]
Prevent oopsing in posix_acl_valid()
If posix_acl_from_xattr() returns an error code, a negative address is
dereferenced causing an oops; fix by checking for error code first.
Signed-off-by: Daniel J Blueman <daniel.blueman@gmail.com>
Reviewed-by: Josef Bacik <josef@redhat.com>
Signed-off-by: Chris Mason <chris.mason@oracle.com>
Linus Torvalds [Sat, 14 May 2011 19:19:18 +0000 (12:19 -0700)]
Merge branch 'upstream-linus' of git://git./linux/kernel/git/jgarzik/libata-dev
* 'upstream-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jgarzik/libata-dev:
libata: fix oops when LPM is used with PMP
Hugh Dickins [Sat, 14 May 2011 19:06:42 +0000 (12:06 -0700)]
tmpfs: fix race between swapoff and writepage
Shame on me! Commit
b1dea800ac39 "tmpfs: fix race between umount and
writepage" fixed the advertized race, but introduced another: as even
its comment makes clear, we cannot safely rely on a peek at list_empty()
while holding no lock - until info->swapped is set, shmem_unuse_inode()
may delete any formerly-swapped inode from the shmem_swaplist, which
in this case would leave a swap area impossible to swapoff.
Although I don't relish taking the mutex every time, I don't care much
for the alternatives either; and at least the peek at list_empty() in
shmem_evict_inode() (a hotter path since most inodes would never have
been swapped) remains safe, because we already truncated the whole file.
Signed-off-by: Hugh Dickins <hughd@google.com>
Cc: stable@kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Tejun Heo [Mon, 9 May 2011 14:04:11 +0000 (16:04 +0200)]
libata: fix oops when LPM is used with PMP
ae01b2493c (libata: Implement ATA_FLAG_NO_DIPM and apply it to mcp65)
added ATA_FLAG_NO_DIPM and made ata_eh_set_lpm() check the flag.
However, @ap is NULL if @link points to a PMP link and thus the
unconditional @ap->flags dereference leads to the following oops.
BUG: unable to handle kernel NULL pointer dereference at
0000000000000018
IP: [<
ffffffff813f98e1>] ata_eh_recover+0x9a1/0x1510
...
Pid: 295, comm: scsi_eh_4 Tainted: P 2.6.38.5-core2 #1 System76, Inc. Serval Professional/Serval Professional
RIP: 0010:[<
ffffffff813f98e1>] [<
ffffffff813f98e1>] ata_eh_recover+0x9a1/0x1510
RSP: 0018:
ffff880132defbf0 EFLAGS:
00010246
RAX:
0000000000000000 RBX:
ffff880132f40000 RCX:
0000000000000000
RDX:
ffff88013377c000 RSI:
ffff880132f40000 RDI:
0000000000000000
RBP:
ffff880132defce0 R08:
ffff88013377dc58 R09:
ffff880132defd98
R10:
0000000000000000 R11:
00000000ffffffff R12:
0000000000000000
R13:
0000000000000000 R14:
ffff88013377c000 R15:
0000000000000000
FS:
0000000000000000(0000) GS:
ffff8800bf700000(0000) knlGS:
0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0:
000000008005003b
CR2:
0000000000000018 CR3:
0000000001a03000 CR4:
00000000000406e0
DR0:
0000000000000000 DR1:
0000000000000000 DR2:
0000000000000000
DR3:
0000000000000000 DR6:
00000000ffff0ff0 DR7:
0000000000000400
Process scsi_eh_4 (pid: 295, threadinfo
ffff880132dee000, task
ffff880133b416c0)
Stack:
0000000000000000 ffff880132defcc0 0000000000000000 ffff880132f42738
ffffffff813ee8f0 ffffffff813eefe0 ffff880132defd98 ffff88013377f190
ffffffffa00b3e30 ffffffff813ef030 0000000032defc60 ffff880100000000
Call Trace:
[<
ffffffff81400867>] sata_pmp_error_handler+0x607/0xc30
[<
ffffffffa00b273f>] ahci_error_handler+0x1f/0x70 [libahci]
[<
ffffffff813faade>] ata_scsi_error+0x5be/0x900
[<
ffffffff813cf724>] scsi_error_handler+0x124/0x650
[<
ffffffff810834b6>] kthread+0x96/0xa0
[<
ffffffff8100cd64>] kernel_thread_helper+0x4/0x10
Code: 8b 95 70 ff ff ff b8 00 00 00 00 48 3b 9a 10 2e 00 00 48 0f 44 c2 48 89 85 70 ff ff ff 48 8b 8d 70 ff ff ff f6 83 69 02 00 00 01 <48> 8b 41 18 0f 85 48 01 00 00 48 85 c9 74 12 48 8b 51 08 48 83
RIP [<
ffffffff813f98e1>] ata_eh_recover+0x9a1/0x1510
RSP <
ffff880132defbf0>
CR2:
0000000000000018
Fix it by testing @link->ap->flags instead.
stable: ATA_FLAG_NO_DIPM was added during 2.6.39 cycle but was
backported to 2.6.37 and 38. This is a fix for that and thus
also applicable to 2.6.37 and 38.
Signed-off-by: Tejun Heo <tj@kernel.org>
Reported-by: "Nathan A. Mourey II" <nmoureyii@ne.rr.com>
LKML-Reference: <
1304555277.2059.2.camel@localhost.localdomain>
Cc: Connor H <cmdkhh@gmail.com>
Cc: stable@kernel.org
Signed-off-by: Jeff Garzik <jgarzik@pobox.com>
Linus Torvalds [Sat, 14 May 2011 18:24:32 +0000 (11:24 -0700)]
Merge branch 'fbmem'
* fbmem:
Further fbcon sanity checking
fbmem: fix remove_conflicting_framebuffers races
Tejun Heo [Sat, 14 May 2011 10:28:04 +0000 (12:28 +0200)]
Revert "libata: ahci_start_engine compliant to AHCI spec"
This reverts commit
270dac35c26433d06a89150c51e75ca0181ca7e4.
The commits causes command timeouts on AC plug/unplug. It isn't yet
clear why. As the commit was for a single rather obscure controller,
revert the change for now.
The problem was reported and bisected by Gu Rui in bug#34692.
https://bugzilla.kernel.org/show_bug.cgi?id=34692
Also, reported by Rafael and Michael in the following thread.
http://thread.gmane.org/gmane.linux.kernel/
1138771
Signed-off-by: Tejun Heo <tj@kernel.org>
Reported-by: Gu Rui <chaos.proton@gmail.com>
Reported-by: Rafael J. Wysocki <rjw@sisk.pl>
Reported-by: Michael Leun <lkml20100708@newton.leun.net>
Cc: Jian Peng <jipeng2005@gmail.com>
Cc: Jeff Garzik <jgarzik@pobox.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Bruno Prémont [Sat, 14 May 2011 10:24:15 +0000 (12:24 +0200)]
Further fbcon sanity checking
This moves the
if (num_registered_fb == FB_MAX)
return -ENXIO;
check _AFTER_ the call to do_remove_conflicting_framebuffers() as this
would (now in a safe way) allow a native driver to replace the
conflicting one even if all slots in registered_fb[] are taken.
This also prevents unregistering a framebuffer that is no longer
registered (vga16f will unregister at module unload time even if the
frame buffer had been unregistered earlier due to being found
conflicting).
Signed-off-by: Bruno Prémont <bonbons@linux-vserver.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Linus Torvalds [Fri, 13 May 2011 23:16:41 +0000 (16:16 -0700)]
fbmem: fix remove_conflicting_framebuffers races
When a register_framebuffer() call results in us removing old
conflicting framebuffers, the new registration_lock doesn't protect that
situation. And we can't just add the same locking to the function,
because these functions call each other: register_framebuffer() calls
remove_conflicting_framebuffers, which in turn calls
unregister_framebuffer for any conflicting entry.
In order to fix it, this just creates wrapper functions around all three
functions and makes the versions that actually do the work be called
"do_xxx()", leaving just the wrapper that gets the lock and calls the
worker function.
So the rule becomes simply that "do_xxxx()" has to be called with the
lock held, and now do_register_framebuffer() can just call
do_remove_conflicting_framebuffers(), and that in turn can call
_do_unregister_framebuffer(), and there is no deadlock, and we can hold
the registration lock over the whole sequence, fixing the races.
It also makes error cases simpler, and fixes one situation where we
would return from unregister_framebuffer() without releasing the lock,
pointed out by Bruno Prémont.
Tested-by: Bruno Prémont <bonbons@linux-vserver.org>
Tested-by: Anca Emanuel <anca.emanuel@gmail.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Linus Torvalds [Sat, 14 May 2011 00:29:03 +0000 (17:29 -0700)]
Merge branch 'for-linus' of git://git./linux/kernel/git/mattst88/alpha-2.6
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mattst88/alpha-2.6:
alpha: Wire up syscalls new to 2.6.39
alpha: convert to clocksource_register_hz
Michael Cree [Wed, 4 May 2011 08:14:50 +0000 (08:14 +0000)]
alpha: Wire up syscalls new to 2.6.39
Wire up the syscalls:
name_to_handle_at
open_by_handle_at
clock_adjtime
syncfs
and adjust some whitespace in the neighbourhood to align commments.
Signed-off-by: Michael Cree <mcree@orcon.net.nz>
Signed-off-by: Matt Turner <mattst88@gmail.com>
John Stultz [Wed, 16 Feb 2011 06:34:49 +0000 (22:34 -0800)]
alpha: convert to clocksource_register_hz
Converts alpha to use clocksource_register_hz.
Signed-off-by: John Stultz <johnstul@us.ibm.com>
CC: Richard Henderson <rth@twiddle.net>
CC: Ivan Kokshaysky <ink@jurassic.park.msu.ru>
CC: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Matt Turner <mattst88@gmail.com>
Linus Torvalds [Fri, 13 May 2011 22:20:51 +0000 (15:20 -0700)]
Merge git://git./linux/kernel/git/davem/net-2.6
* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6:
bridge: fix forwarding of IPv6
bonding,llc: Fix structure sizeof incompatibility for some PDUs
ipv6: restore correct ECN handling on TCP xmit
ne-h8300: Fix regression caused during net_device_ops conversion
hydra: Fix regression caused during net_device_ops conversion
zorro8390: Fix regression caused during net_device_ops conversion
sfc: Always map MCDI shared memory as uncacheable
ehea: Fix memory hotplug oops
libertas: fix cmdpendingq locking
iwlegacy: fix IBSS mode crashes
ath9k: Fix a warning due to a queued work during S3 state
mac80211: don't start the dynamic ps timer if not associated
Linus Torvalds [Fri, 13 May 2011 22:19:39 +0000 (15:19 -0700)]
Merge branch 'bugfixes' of git://git.linux-nfs.org/projects/trondmy/nfs-2.6
* 'bugfixes' of git://git.linux-nfs.org/projects/trondmy/nfs-2.6:
NFSv4.1: Ensure that layoutget uses the correct gfp modes
NFSv4.1: remove pnfs_layout_hdr from pnfs_destroy_all_layouts tmp_list
NFSv41: Resend on NFS4ERR_RETRY_UNCACHED_REP
Yehuda Sadeh [Fri, 13 May 2011 20:52:56 +0000 (13:52 -0700)]
rbd: fix split bio handling
The rbd driver currently splits bios when they span an object boundary.
However, the blk_end_request expects the completions to roll up the results
in block device order, and the split rbd/ceph ops can complete in any
order. This patch adds a struct rbd_req_coll to track completion of split
requests and ensures that the results are passed back up to the block layer
in order.
This fixes errors where the file system gets completion of a read operation
that spans an object boundary before the data has actually arrived. The
bug is easily reproduced with iozone with a working set larger than
available RAM.
Reported-by: Fyodor Ustinov <ufm@ufm.su>
Signed-off-by: Yehuda Sadeh <yehuda@hq.newdream.net>
Signed-off-by: Sage Weil <sage@newdream.net>
Stephen Hemminger [Fri, 13 May 2011 20:03:24 +0000 (16:03 -0400)]
bridge: fix forwarding of IPv6
The commit
6b1e960fdbd75dcd9bcc3ba5ff8898ff1ad30b6e
bridge: Reset IPCB when entering IP stack on NF_FORWARD
broke forwarding of IPV6 packets in bridge because it would
call bp_parse_ip_options with an IPV6 packet.
Reported-by: Noah Meyerhans <noahm@debian.org>
Signed-off-by: Stephen Hemminger <shemminger@vyatta.com>
Reviewed-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Andy Lutomirski [Fri, 13 May 2011 16:14:54 +0000 (12:14 -0400)]
drm/i915: Revert i915.semaphore=1 default from i915 merge
My Q67 / i7-2600 box has rev09 Sandy Bridge graphics. It hangs
instantly when GNOME loads and it hangs so hard the reset button
doesn't work. Setting i915.semaphore=0 fixes it.
Semaphores were disabled in
a1656b9090f7 ("drm/i915: Disable GPU
semaphores by default") in 2.6.38 but were then re-enabled (by mistake?)
by the merge
47ae63e0c2e5 ("Merge branch 'drm-intel-fixes' into
drm-intel-next").
(It's worth noting that the offending change is i915_drv.c, which was
not marked as a conflict - although a 'git show --cc' on the merge does
show that neither parent had it set to 1)
Signed-off-by: Andy Lutomirski <luto@mit.edu>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Vitalii Demianets [Thu, 12 May 2011 23:04:29 +0000 (23:04 +0000)]
bonding,llc: Fix structure sizeof incompatibility for some PDUs
With some combinations of arch/compiler (e.g. arm-linux-gcc) the sizeof
operator on structure returns value greater than expected. In cases when the
structure is used for mapping PDU fields it may lead to unexpected results
(such as holes and alignment problems in skb data). __packed prevents this
undesired behavior.
Signed-off-by: Vitalii Demianets <vitas@nppfactor.kiev.ua>
Signed-off-by: David S. Miller <davem@davemloft.net>
Linus Torvalds [Fri, 13 May 2011 18:51:01 +0000 (11:51 -0700)]
vfs: micro-optimize acl_permission_check()
It's a hot function, and we're better off not mixing types in the mask
calculations. The compiler just ends up mixing 16-bit and 32-bit
operations, for no good reason.
So do everything in 'unsigned int' rather than mixing 'unsigned int'
masking with a 'umode_t' (16-bit) mode variable.
This, together with the parent commit (
47a150edc2ae: "Cache user_ns in
struct cred") makes acl_permission_check() much nicer.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Serge E. Hallyn [Fri, 13 May 2011 03:27:54 +0000 (04:27 +0100)]
Cache user_ns in struct cred
If !CONFIG_USERNS, have current_user_ns() defined to (&init_user_ns).
Get rid of _current_user_ns. This requires nsown_capable() to be
defined in capability.c rather than as static inline in capability.h,
so do that.
Request_key needs init_user_ns defined at current_user_ns if
!CONFIG_USERNS, so forward-declare that in cred.h if !CONFIG_USERNS
at current_user_ns() define.
Compile-tested with and without CONFIG_USERNS.
Signed-off-by: Serge E. Hallyn <serge.hallyn@canonical.com>
[ This makes a huge performance difference for acl_permission_check(),
up to 30%. And that is one of the hottest kernel functions for loads
that are pathname-lookup heavy. ]
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Alex Deucher [Fri, 13 May 2011 01:15:15 +0000 (21:15 -0400)]
drm/radeon/kms: add some evergreen/ni safe regs
need to programmed from the userspace drivers.
Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Alex Deucher [Wed, 11 May 2011 18:02:07 +0000 (14:02 -0400)]
drm/radeon/kms: fix extended lvds info parsing
On rev <= 1.1 tables, the offset is absolute,
on newer tables, it's relative.
Fixes:
https://bugzilla.redhat.com/show_bug.cgi?id=700326
Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
Reviewed-by: Jerome Glisse <jglisse@redhat.com>
Cc: stable@kernel.org
Signed-off-by: Dave Airlie <airlied@redhat.com>
Alex Deucher [Wed, 11 May 2011 07:15:24 +0000 (03:15 -0400)]
drm/radeon/kms: fix tiling reg on fusion
The location of MC_ARB_RAMCFG changed on fusion.
I've diffed all the other regs in evergreend.h and this
is the only other reg that changed.
Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Sage Weil [Thu, 12 May 2011 23:13:54 +0000 (16:13 -0700)]
rbd: fix leak of ops struct
The ops vector must be freed by the rbd_do_request caller.
Signed-off-by: Sage Weil <sage@newdream.net>
Linus Torvalds [Fri, 13 May 2011 01:16:13 +0000 (18:16 -0700)]
Merge branch 'for-linus' of git://git./linux/kernel/git/jmorris/security-testing-2.6
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6:
SELinux: delete debugging printks from filename_trans rule processing
Linus Torvalds [Fri, 13 May 2011 01:00:09 +0000 (18:00 -0700)]
Merge branch 'for-linus' of git://git./linux/kernel/git/ericvh/v9fs
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ericvh/v9fs:
net/9p/protocol.c: Fix a memory leak
Linus Torvalds [Thu, 12 May 2011 23:55:33 +0000 (16:55 -0700)]
Merge branch 'for-2639-rc7/i2c-fixes' of git://git.fluff.org/bjdooks/linux
* 'for-2639-rc7/i2c-fixes' of git://git.fluff.org/bjdooks/linux:
i2c: pnx: Fix crash due to wrong init of timer->data
James Morris [Thu, 12 May 2011 23:52:16 +0000 (09:52 +1000)]
Merge branch 'for-linus' of git://git.infradead.org/users/eparis/selinux into for-linus
Wolfram Sang [Fri, 29 Apr 2011 13:30:02 +0000 (15:30 +0200)]
i2c: pnx: Fix crash due to wrong init of timer->data
alg_data is already a pointer which must be passed directly.
Reported-by: Dieter Ripp <ripp@systecnet.com>
Signed-off-by: Wolfram Sang <w.sang@pengutronix.de>
Cc: Russell King <linux@arm.linux.org.uk>
Cc: Ben Dooks <ben-i2c@fluff.org>
Signed-off-by: Ben Dooks <ben-linux@fluff.org>
Steinar H. Gunderson [Fri, 6 May 2011 23:44:46 +0000 (23:44 +0000)]
ipv6: restore correct ECN handling on TCP xmit
Since commit
e9df2e8fd8fbc9 (Use appropriate sock tclass setting for
routing lookup) we lost ability to properly add ECN codemarks to ipv6
TCP frames.
It seems like TCP_ECN_send() calls INET_ECN_xmit(), which only sets the
ECN bit in the IPv4 ToS field (inet_sk(sk)->tos), but after the patch,
what's checked is inet6_sk(sk)->tclass, which is a completely different
field.
Close bug https://bugzilla.kernel.org/show_bug.cgi?id=34322
[Eric Dumazet] : added the INET_ECN_dontxmit() fix and replace macros
by inline functions for clarity.
Signed-off-by: Steinar H. Gunderson <sgunderson@bigfoot.com>
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Cc: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Cc: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Ingo Molnar [Thu, 12 May 2011 21:00:28 +0000 (23:00 +0200)]
vsprintf: Turn kptr_restrict off by default
kptr_restrict has been triggering bugs in apps such as perf, and it also makes
the system less useful by default, so turn it off by default.
This is how we generally handle security features that remove functionality,
such as firewall code or SELinux - they have to be configured and activated
from user-space.
Distributions can turn kptr_restrict on again via this line in
/etc/sysctrl.conf:
kernel.kptr_restrict = 1
( Also mark the variable __read_mostly while at it, as it's typically modified
only once per bootup, or not at all. )
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Acked-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Pedro Scarapicchia Junior [Mon, 9 May 2011 14:10:49 +0000 (14:10 +0000)]
net/9p/protocol.c: Fix a memory leak
When p9pdu_readf() is called with "s" attribute, it allocates a pointer that
will store a string. In p9dirent_read(), this pointer is not being released,
leading to out of memory errors.
This patch releases this pointer after string is copyed to dirent->d_name.
Signed-off-by: Pedro Scarapicchia Junior <pedro.scarapiccha@br.flextronics.com>
Signed-off-by: Eric Van Hensbergen <ericvh@gmail.com>
Geert Uytterhoeven [Thu, 12 May 2011 09:11:40 +0000 (09:11 +0000)]
ne-h8300: Fix regression caused during net_device_ops conversion
Changeset
dcd39c90290297f6e6ed8a04bb20da7ac2b043c5 ("ne-h8300: convert to
net_device_ops") broke ne-h8300 by adding 8390.o to the link. That
meant that lib8390.c was included twice, once in ne-h8300.c and once in
8390.c, subject to different macros. This patch reverts that by
avoiding the wrappers in 8390.c.
Fix based on commits
217cbfa856dc1cbc2890781626c4032d9e3ec59f ("mac8390:
fix regression caused during net_device_ops conversion") and
4e0168fa4842e27795a75b205a510f25b62181d9 ("mac8390: fix build with
NET_POLL_CONTROLLER").
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Cc: stable@kernel.org
Signed-off-by: David S. Miller <davem@davemloft.net>
Geert Uytterhoeven [Thu, 12 May 2011 09:11:39 +0000 (09:11 +0000)]
hydra: Fix regression caused during net_device_ops conversion
Changeset
5618f0d1193d6b051da9b59b0e32ad24397f06a4 ("hydra: convert to
net_device_ops") broke hydra by adding 8390.o to the link. That
meant that lib8390.c was included twice, once in hydra.c and once in
8390.c, subject to different macros. This patch reverts that by
avoiding the wrappers in 8390.c.
Fix based on commits
217cbfa856dc1cbc2890781626c4032d9e3ec59f ("mac8390:
fix regression caused during net_device_ops conversion") and
4e0168fa4842e27795a75b205a510f25b62181d9 ("mac8390: fix build with
NET_POLL_CONTROLLER").
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Cc: stable@kernel.org
Signed-off-by: David S. Miller <davem@davemloft.net>
Geert Uytterhoeven [Thu, 12 May 2011 09:11:38 +0000 (09:11 +0000)]
zorro8390: Fix regression caused during net_device_ops conversion
Changeset
b6114794a1c394534659f4a17420e48cf23aa922 ("zorro8390: convert to
net_device_ops") broke zorro8390 by adding 8390.o to the link. That
meant that lib8390.c was included twice, once in zorro8390.c and once in
8390.c, subject to different macros. This patch reverts that by
avoiding the wrappers in 8390.c.
Fix based on commits
217cbfa856dc1cbc2890781626c4032d9e3ec59f ("mac8390:
fix regression caused during net_device_ops conversion") and
4e0168fa4842e27795a75b205a510f25b62181d9 ("mac8390: fix build with
NET_POLL_CONTROLLER").
Reported-by: Christian T. Steigies <cts@debian.org>
Suggested-by: Finn Thain <fthain@telegraphics.com.au>
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Tested-by: Christian T. Steigies <cts@debian.org>
Cc: stable@kernel.org
Signed-off-by: David S. Miller <davem@davemloft.net>
David S. Miller [Thu, 12 May 2011 20:26:45 +0000 (16:26 -0400)]
Merge branch 'sfc-2.6.39' of git://git./linux/kernel/git/bwh/sfc-2.6
Eric Paris [Thu, 7 Apr 2011 18:46:59 +0000 (14:46 -0400)]
SELinux: delete debugging printks from filename_trans rule processing
The filename_trans rule processing has some printk(KERN_ERR ) messages
which were intended as debug aids in creating the code but weren't removed
before it was submitted. Remove them.
Reported-by: Paul Bolle <pebolle@tiscali.nl>
Signed-off-by: Eric Paris <eparis@redhat.com>
Linus Torvalds [Thu, 12 May 2011 19:41:30 +0000 (12:41 -0700)]
Merge branch 'fix/asoc' of git://git./linux/kernel/git/tiwai/sound-2.6
* 'fix/asoc' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6:
ASoC: WM8903: Fix Digital Capture Volume range
ASoC: UDA134x: Remove POWER_OFF_ON_STANDBY define.
ASoC: SSM2602: Fix reg_cache_size
ASoC: SSM2602: Fix 'Mic Boost2' control
ASoC: SSM2602: Properly annotate i2c probe and remove functions
ASoC: sst_platform: add hw_free callback to fix resource leak
ASoC: Don't crash on PM operations
ASoC: JZ4740: Fix i2s shutdown
Linus Torvalds [Thu, 12 May 2011 19:21:51 +0000 (12:21 -0700)]
Merge branch 'stable/bug-fixes-for-rc7' of git://git./linux/kernel/git/konrad/xen
* 'stable/bug-fixes-for-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/xen:
x86/mm: Fix section mismatch derived from native_pagetable_reserve()
x86,xen: introduce x86_init.mapping.pagetable_reserve
Revert "xen/mmu: Add workaround "x86-64, mm: Put early page table high""
Linus Torvalds [Thu, 12 May 2011 19:19:43 +0000 (12:19 -0700)]
Revert "drm/i915: Only enable the plane after setting the fb base (pre-ILK)"
This reverts commit
49183b2818de6899383bb82bc032f9344d6791ff.
Quoth Franz Melchior:
"This patch introduces a bug on my infamous "Acer Travelmate
5735Z-452G32Mnss": when KMS takes over, the frame buffer contents get
completely garbled up on screen, with colored stripes and unreadable
text (photo on request). Only when X11 is started, the screen gets
restored again. Closing and re-opening the lid partly cures the
mess, too: it makes the font readable, though horizontally stretched."
Acked-by: Keith Packard <keithp@keithp.com>
Cc: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
Cc: Jesse Barnes <jbarnes@virtuousgeek.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Linus Torvalds [Thu, 12 May 2011 17:42:36 +0000 (10:42 -0700)]
Merge branch 'fbmem'
* fbmem:
fbmem: make read/write/ioctl use the frame buffer at open time
fbcon: add lifetime refcount to opened frame buffers
Linus Torvalds [Thu, 12 May 2011 17:41:31 +0000 (10:41 -0700)]
Merge branch 'for-linus' of git://git./linux/kernel/git/dtor/input
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
Input: ads7846 - remove unused variable from struct ads7845_ser_req
Input: ads7846 - make transfer buffers DMA safe
Sedat Dilek [Sun, 17 Apr 2011 14:17:34 +0000 (16:17 +0200)]
x86/mm: Fix section mismatch derived from native_pagetable_reserve()
With CONFIG_DEBUG_SECTION_MISMATCH=y I see these warnings in next-
20110415:
LD vmlinux.o
MODPOST vmlinux.o
WARNING: vmlinux.o(.text+0x1ba48): Section mismatch in reference from the function native_pagetable_reserve() to the function .init.text:memblock_x86_reserve_range()
The function native_pagetable_reserve() references
the function __init memblock_x86_reserve_range().
This is often because native_pagetable_reserve lacks a __init
annotation or the annotation of memblock_x86_reserve_range is wrong.
This patch fixes the issue.
Thanks to pipacs from PaX project for help on IRC.
Acked-by: "H. Peter Anvin" <hpa@zytor.com>
Signed-off-by: Sedat Dilek <sedat.dilek@gmail.com>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Stefano Stabellini [Thu, 14 Apr 2011 14:49:41 +0000 (15:49 +0100)]
x86,xen: introduce x86_init.mapping.pagetable_reserve
Introduce a new x86_init hook called pagetable_reserve that at the end
of init_memory_mapping is used to reserve a range of memory addresses for
the kernel pagetable pages we used and free the other ones.
On native it just calls memblock_x86_reserve_range while on xen it also
takes care of setting the spare memory previously allocated
for kernel pagetable pages from RO to RW, so that it can be used for
other purposes.
A detailed explanation of the reason why this hook is needed follows.
As a consequence of the commit:
commit
4b239f458c229de044d6905c2b0f9fe16ed9e01e
Author: Yinghai Lu <yinghai@kernel.org>
Date: Fri Dec 17 16:58:28 2010 -0800
x86-64, mm: Put early page table high
at some point init_memory_mapping is going to reach the pagetable pages
area and map those pages too (mapping them as normal memory that falls
in the range of addresses passed to init_memory_mapping as argument).
Some of those pages are already pagetable pages (they are in the range
pgt_buf_start-pgt_buf_end) therefore they are going to be mapped RO and
everything is fine.
Some of these pages are not pagetable pages yet (they fall in the range
pgt_buf_end-pgt_buf_top; for example the page at pgt_buf_end) so they
are going to be mapped RW. When these pages become pagetable pages and
are hooked into the pagetable, xen will find that the guest has already
a RW mapping of them somewhere and fail the operation.
The reason Xen requires pagetables to be RO is that the hypervisor needs
to verify that the pagetables are valid before using them. The validation
operations are called "pinning" (more details in arch/x86/xen/mmu.c).
In order to fix the issue we mark all the pages in the entire range
pgt_buf_start-pgt_buf_top as RO, however when the pagetable allocation
is completed only the range pgt_buf_start-pgt_buf_end is reserved by
init_memory_mapping. Hence the kernel is going to crash as soon as one
of the pages in the range pgt_buf_end-pgt_buf_top is reused (b/c those
ranges are RO).
For this reason we need a hook to reserve the kernel pagetable pages we
used and free the other ones so that they can be reused for other
purposes.
On native it just means calling memblock_x86_reserve_range, on Xen it
also means marking RW the pagetable pages that we allocated before but
that haven't been used before.
Another way to fix this is without using the hook is by adding a 'if
(xen_pv_domain)' in the 'init_memory_mapping' code and calling the Xen
counterpart, but that is just nasty.
Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
Acked-by: Yinghai Lu <yinghai@kernel.org>
Acked-by: H. Peter Anvin <hpa@zytor.com>
Cc: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Konrad Rzeszutek Wilk [Thu, 5 May 2011 17:50:43 +0000 (13:50 -0400)]
Revert "xen/mmu: Add workaround "x86-64, mm: Put early page table high""
This reverts commit
a38647837a411f7df79623128421eef2118b5884.
It does not work with certain AMD machines.
last_pfn = 0x100000 max_arch_pfn = 0x400000000
initial memory mapped : 0 -
02c3a000
Base memory trampoline at [
ffff88000009b000] 9b000 size 20480
init_memory_mapping:
0000000000000000-
0000000100000000
0000000000 -
0100000000 page 4k
kernel direct mapping tables up to
100000000 @
ff7fb000-
100000000
init_memory_mapping:
0000000100000000-
00000001e0800000
0100000000 -
01e0800000 page 4k
kernel direct mapping tables up to
1e0800000 @
1df0f3000-
1e0000000
xen: setting RW the range
fffdc000 -
100000000
RAMDISK:
0203b000 -
02c3a000
No NUMA configuration found
Faking a node at
0000000000000000-
00000001e0800000
NUMA: Using 63 for the hash shift.
Initmem setup node 0
0000000000000000-
00000001e0800000
NODE_DATA [
00000001dfffb000 -
00000001dfffffff]
BUG: unable to handle kernel NULL pointer dereference at (null)
IP: [<
ffffffff81cf6a75>] setup_node_bootmem+0x18a/0x1ea
PGD 0
Oops: 0003 [#1] SMP
last sysfs file:
CPU 0
Modules linked in:
Pid: 0, comm: swapper Not tainted 2.6.39-0-virtual #6~smb1
RIP: e030:[<
ffffffff81cf6a75>] [<
ffffffff81cf6a75>] setup_node_bootmem+0x18a/0x1ea
RSP: e02b:
ffffffff81c01e38 EFLAGS:
00010046
RAX:
0000000000000000 RBX:
00000001e0800000 RCX:
0000000000001040
RDX:
0000000000004100 RSI:
0000000000000000 RDI:
ffff8801dfffb000
RBP:
ffffffff81c01e58 R08:
0000000000000020 R09:
0000000000000000
R10:
0000000000000000 R11:
0000000000000001 R12:
0000000000000000
R13:
0000000000000000 R14:
0000000000000000 R15:
0000000000bfe400
FS:
0000000000000000(0000) GS:
ffffffff81cca000(0000) knlGS:
0000000000000000
CS: e033 DS: 0000 ES: 0000 CR0:
0000000080050033
CR2:
0000000000000000 CR3:
0000000001c03000 CR4:
0000000000000660
DR0:
0000000000000000 DR1:
0000000000000000 DR2:
0000000000000000
DR3:
0000000000000000 DR6:
00000000ffff0ff0 DR7:
0000000000000400
Process swapper (pid: 0, threadinfo
ffffffff81c00000, task
ffffffff81c0b020)
Stack:
0000000000000040 0000000000000001 0000000000000000 ffffffffffffffff
ffffffff81c01e88 ffffffff81cf6c25 0000000000000000 0000000000000000
ffffffff81cf687f 0000000000000000 ffffffff81c01ea8 ffffffff81cf6e45
Call Trace:
[<
ffffffff81cf6c25>] numa_register_memblks.constprop.3+0x150/0x181
[<
ffffffff81cf687f>] ? numa_add_memblk+0x7c/0x7c
[<
ffffffff81cf6e45>] numa_init.part.2+0x1c/0x7c
[<
ffffffff81cf687f>] ? numa_add_memblk+0x7c/0x7c
[<
ffffffff81cf6f67>] numa_init+0x6c/0x70
[<
ffffffff81cf7057>] initmem_init+0x39/0x3b
[<
ffffffff81ce5865>] setup_arch+0x64e/0x769
[<
ffffffff815e43c1>] ? printk+0x51/0x53
[<
ffffffff81cdf92b>] start_kernel+0xd4/0x3f3
[<
ffffffff81cdf388>] x86_64_start_reservations+0x132/0x136
[<
ffffffff81ce2ed4>] xen_start_kernel+0x588/0x58f
Code: 41 00 00 48 8b 3c c5 a0 24 cc 81 31 c0 40 f6 c7 01 74 05 aa 66 ba ff 40 40 f6 c7 02 74 05 66 ab 83 ea 02 89 d1 c1 e9 02 f6 c2 02 <f3> ab 74 02 66 ab 80 e2 01 74 01 aa 49 63 c4 48 c1 eb 0c 44 89
RIP [<
ffffffff81cf6a75>] setup_node_bootmem+0x18a/0x1ea
RSP <
ffffffff81c01e38>
CR2:
0000000000000000
---[ end trace
a7919e7f17c0a725 ]---
Kernel panic - not syncing: Attempted to kill the idle task!
Pid: 0, comm: swapper Tainted: G D 2.6.39-0-virtual #6~smb1
Reported-by: Stefan Bader <stefan.bader@canonical.com>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Linus Torvalds [Thu, 12 May 2011 15:06:53 +0000 (08:06 -0700)]
Merge branch 'for-linus' of git://git./linux/kernel/git/mszeredi/fuse
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse:
fuse: fix oops in revalidate when called with NULL nameidata
Linus Torvalds [Thu, 12 May 2011 14:53:34 +0000 (07:53 -0700)]
Merge git://git./linux/kernel/git/davem/sparc-2.6
* git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc-2.6:
sparc32: Fixed unaligned memory copying in function __csum_partial_copy_sparc_generic
sparc32: fix sparcstation 5 boot
sparc32: fix section mismatch warnings in apc, pmc and time_32
Linus Torvalds [Thu, 12 May 2011 14:53:06 +0000 (07:53 -0700)]
Merge branch 'fixes' of /home/rmk/linux-2.6-arm
* 'fixes' of master.kernel.org:/home/rmk/linux-2.6-arm:
ARM: 6870/1: The mandatory barrier rmb() must be a dsb() in for device accesses
ARM: 6892/1: handle ptrace requests to change PC during interrupted system calls
ARM: 6890/1: memmap: only free allocated memmap entries when using SPARSEMEM
ARM: zImage: the page table memory must be considered before relocation
ARM: zImage: make sure not to relocate on top of the relocation code
ARM: zImage: Fix bad SP address after relocating kernel
ARM: zImage: make sure the stack is 64-bit aligned
ARM: RiscPC: acornfb: fix section mismatches
ARM: RiscPC: etherh: fix section mismatches
Linus Torvalds [Wed, 11 May 2011 21:58:34 +0000 (14:58 -0700)]
fbmem: make read/write/ioctl use the frame buffer at open time
read/write/ioctl on a fbcon file descriptor has traditionally used the
fbcon not when it was opened, but as it was at the time of the call.
That makes no sense, but the lack of sense is much more obvious now that
we properly ref-count the usage - it means that the ref-counting doesn't
actually protect operations we do on the frame buffer.
This changes it to look at the fb_info that we got at open time, but in
order to avoid using a frame buffer long after it has been unregistered,
we do verify that it is still current, and return -ENODEV if not.
Acked-by: Tim Gardner <tim.gardner@canonical.com>
Tested-by: Daniel J Blueman <daniel.blueman@gmail.com>
Tested-by: Anca Emanuel <anca.emanuel@gmail.com>
Cc: Bruno Prémont <bonbons@linux-vserver.org>
Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
Cc: Paul Mundt <lethal@linux-sh.org>
Cc: Dave Airlie <airlied@redhat.com>
Cc: Andy Whitcroft <andy.whitcroft@canonical.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Linus Torvalds [Wed, 11 May 2011 21:49:36 +0000 (14:49 -0700)]
fbcon: add lifetime refcount to opened frame buffers
This just adds the refcount and the new registration lock logic. It
does not (for example) actually change the read/write/ioctl routines to
actually use the frame buffer that was opened: those function still end
up alway susing whatever the current frame buffer is at the time of the
call.
Without this, if something holds the frame buffer open over a
framebuffer switch, the close() operation after the switch will access a
fb_info that has been free'd by the unregistering of the old frame
buffer.
(The read/write/ioctl operations will normally not cause problems,
because they will - illogically - pick up the new fbcon instead. But a
switch that happens just as one of those is going on might see problems
too, the window is just much smaller: one individual op rather than the
whole open-close sequence.)
This use-after-free is apparently fairly easily triggered by the Ubuntu
11.04 boot sequence.
Acked-by: Tim Gardner <tim.gardner@canonical.com>
Tested-by: Daniel J Blueman <daniel.blueman@gmail.com>
Tested-by: Anca Emanuel <anca.emanuel@gmail.com>
Cc: Bruno Prémont <bonbons@linux-vserver.org>
Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
Cc: Paul Mundt <lethal@linux-sh.org>
Cc: Dave Airlie <airlied@redhat.com>
Cc: Andy Whitcroft <andy.whitcroft@canonical.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>