--- /dev/null
+From 5fcb08befaf57faa1b00e514915c1660252b8c26 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <levinsasha928@gmail.com>
+Date: Mon, 11 Jun 2012 10:18:13 -0500
+Subject: 9p: BUG before corrupting memory
+
+From: Sasha Levin <levinsasha928@gmail.com>
+
+commit 5fcb08befaf57faa1b00e514915c1660252b8c26 upstream.
+
+The BUG_ON() in pack_sg_list() would get triggered only one time after we've
+corrupted some memory by sg_set_buf() into an invalid sg buffer.
+
+I'm still working on figuring out why I manage to trigger that bug...
+
+Signed-off-by: Sasha Levin <levinsasha928@gmail.com>
+Signed-off-by: Eric Van Hensbergen <ericvh@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/9p/trans_virtio.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/9p/trans_virtio.c
++++ b/net/9p/trans_virtio.c
+@@ -192,10 +192,10 @@ static int pack_sg_list(struct scatterli
+ s = rest_of_page(data);
+ if (s > count)
+ s = count;
++ BUG_ON(index > limit);
+ sg_set_buf(&sg[index++], data, s);
+ count -= s;
+ data += s;
+- BUG_ON(index > limit);
+ }
+
+ return index-start;
--- /dev/null
+From d4a4206ebbaf48b55803a7eb34e330530d83a889 Mon Sep 17 00:00:00 2001
+From: Chris Boot <bootc@bootc.net>
+Date: Tue, 24 Apr 2012 07:24:52 +0000
+Subject: e1000e: Disable ASPM L1 on 82574
+
+From: Chris Boot <bootc@bootc.net>
+
+commit d4a4206ebbaf48b55803a7eb34e330530d83a889 upstream.
+
+ASPM on the 82574 causes trouble. Currently the driver disables L0s for
+this NIC but only disables L1 if the MTU is >1500. This patch simply
+causes L1 to be disabled regardless of the MTU setting.
+
+Signed-off-by: Chris Boot <bootc@bootc.net>
+Cc: "Wyborny, Carolyn" <carolyn.wyborny@intel.com>
+Cc: Nix <nix@esperi.org.uk>
+Link: https://lkml.org/lkml/2012/3/19/362
+Tested-by: Jeff Pieper <jeffrey.e.pieper@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/ethernet/intel/e1000e/82571.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/intel/e1000e/82571.c
++++ b/drivers/net/ethernet/intel/e1000e/82571.c
+@@ -2061,8 +2061,9 @@ const struct e1000_info e1000_82574_info
+ | FLAG_HAS_SMART_POWER_DOWN
+ | FLAG_HAS_AMT
+ | FLAG_HAS_CTRLEXT_ON_LOAD,
+- .flags2 = FLAG2_CHECK_PHY_HANG
++ .flags2 = FLAG2_CHECK_PHY_HANG
+ | FLAG2_DISABLE_ASPM_L0S
++ | FLAG2_DISABLE_ASPM_L1
+ | FLAG2_NO_DISABLE_RX,
+ .pba = 32,
+ .max_hw_frame_size = DEFAULT_JUMBO,
--- /dev/null
+From 59aed95263bdd0e2b48eb9be5a94346d2d4abf90 Mon Sep 17 00:00:00 2001
+From: Chris Boot <bootc@bootc.net>
+Date: Tue, 24 Apr 2012 07:24:58 +0000
+Subject: e1000e: Remove special case for 82573/82574 ASPM L1 disablement
+
+From: Chris Boot <bootc@bootc.net>
+
+commit 59aed95263bdd0e2b48eb9be5a94346d2d4abf90 upstream.
+
+For the 82573, ASPM L1 gets disabled wholesale so this special-case code
+is not required. For the 82574 the previous patch does the same as for
+the 82573, disabling L1 on the adapter. Thus, this code is no longer
+required and can be removed.
+
+Signed-off-by: Chris Boot <bootc@bootc.net>
+Tested-by: Jeff Pieper <jeffrey.e.pieper@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/ethernet/intel/e1000e/netdev.c | 8 --------
+ 1 file changed, 8 deletions(-)
+
+--- a/drivers/net/ethernet/intel/e1000e/netdev.c
++++ b/drivers/net/ethernet/intel/e1000e/netdev.c
+@@ -5293,14 +5293,6 @@ static int e1000_change_mtu(struct net_d
+ return -EINVAL;
+ }
+
+- /* 82573 Errata 17 */
+- if (((adapter->hw.mac.type == e1000_82573) ||
+- (adapter->hw.mac.type == e1000_82574)) &&
+- (max_frame > ETH_FRAME_LEN + ETH_FCS_LEN)) {
+- adapter->flags2 |= FLAG2_DISABLE_ASPM_L1;
+- e1000e_disable_aspm(adapter->pdev, PCIE_LINK_STATE_L1);
+- }
+-
+ while (test_and_set_bit(__E1000_RESETTING, &adapter->state))
+ usleep_range(1000, 2000);
+ /* e1000e_down -> e1000e_reset dependent on max_frame_size & mtu */
--- /dev/null
+From ebed633c61c023e5d1aa4ed159cd67406e9e37c2 Mon Sep 17 00:00:00 2001
+From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Date: Wed, 16 May 2012 22:35:58 +0200
+Subject: iwlwifi: fix the Transmit Frame Descriptor rings
+
+From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+
+commit ebed633c61c023e5d1aa4ed159cd67406e9e37c2 upstream.
+
+The logic that allows to have a short TFD queue was completely wrong.
+We do maintain 256 Transmit Frame Descriptors, but they point to
+recycled buffers. We used to attach and de-attach different TFDs for
+the same buffer and it worked since they pointed to the same buffer.
+
+Also zero the number of BDs after unmapping a TFD. This seems not
+necessary since we don't reclaim the same TFD twice, but I like
+housekeeping.
+
+This patch solves this warning:
+
+[ 6427.079855] WARNING: at lib/dma-debug.c:866 check_unmap+0x727/0x7a0()
+[ 6427.079859] Hardware name: Latitude E6410
+[ 6427.079865] iwlwifi 0000:02:00.0: DMA-API: device driver tries to free DMA memory it has not allocated [device address=0x00000000296d393c] [size=8 bytes]
+[ 6427.079870] Modules linked in: ...
+[ 6427.079950] Pid: 6613, comm: ifconfig Tainted: G O 3.3.3 #5
+[ 6427.079954] Call Trace:
+[ 6427.079963] [<c10337a2>] warn_slowpath_common+0x72/0xa0
+[ 6427.079982] [<c1033873>] warn_slowpath_fmt+0x33/0x40
+[ 6427.079988] [<c12dcb77>] check_unmap+0x727/0x7a0
+[ 6427.079995] [<c12dcdaa>] debug_dma_unmap_page+0x5a/0x80
+[ 6427.080024] [<fe2312ac>] iwlagn_unmap_tfd+0x12c/0x180 [iwlwifi]
+[ 6427.080048] [<fe231349>] iwlagn_txq_free_tfd+0x49/0xb0 [iwlwifi]
+[ 6427.080071] [<fe228e37>] iwl_tx_queue_unmap+0x67/0x90 [iwlwifi]
+[ 6427.080095] [<fe22d221>] iwl_trans_pcie_stop_device+0x341/0x7b0 [iwlwifi]
+[ 6427.080113] [<fe204b0e>] iwl_down+0x17e/0x260 [iwlwifi]
+[ 6427.080132] [<fe20efec>] iwlagn_mac_stop+0x6c/0xf0 [iwlwifi]
+[ 6427.080168] [<fd8480ce>] ieee80211_stop_device+0x5e/0x190 [mac80211]
+[ 6427.080198] [<fd833208>] ieee80211_do_stop+0x288/0x620 [mac80211]
+[ 6427.080243] [<fd8335b7>] ieee80211_stop+0x17/0x20 [mac80211]
+[ 6427.080250] [<c148dac1>] __dev_close_many+0x81/0xd0
+[ 6427.080270] [<c148db3d>] __dev_close+0x2d/0x50
+[ 6427.080276] [<c148d152>] __dev_change_flags+0x82/0x150
+[ 6427.080282] [<c148e3e3>] dev_change_flags+0x23/0x60
+[ 6427.080289] [<c14f6320>] devinet_ioctl+0x6a0/0x770
+[ 6427.080296] [<c14f8705>] inet_ioctl+0x95/0xb0
+[ 6427.080304] [<c147a0f0>] sock_ioctl+0x70/0x270
+
+Reported-by: Antonio Quartulli <ordex@autistici.org>
+Tested-by: Antonio Quartulli <ordex@autistici.org>
+Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Reviewed-by: Wey-Yi W Guy <wey-yi.w.guy@intel.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/iwlwifi/iwl-trans-pcie-int.h | 2 +-
+ drivers/net/wireless/iwlwifi/iwl-trans-pcie-tx.c | 20 +++++++++++++-------
+ drivers/net/wireless/iwlwifi/iwl-trans-pcie.c | 4 +---
+ 3 files changed, 15 insertions(+), 11 deletions(-)
+
+--- a/drivers/net/wireless/iwlwifi/iwl-trans-pcie-int.h
++++ b/drivers/net/wireless/iwlwifi/iwl-trans-pcie-int.h
+@@ -342,7 +342,7 @@ void iwl_trans_pcie_tx_agg_setup(struct
+ enum iwl_rxon_context_id ctx,
+ int sta_id, int tid, int frame_limit, u16 ssn);
+ void iwlagn_txq_free_tfd(struct iwl_trans *trans, struct iwl_tx_queue *txq,
+- int index, enum dma_data_direction dma_dir);
++ enum dma_data_direction dma_dir);
+ int iwl_tx_queue_reclaim(struct iwl_trans *trans, int txq_id, int index,
+ struct sk_buff_head *skbs);
+ int iwl_queue_space(const struct iwl_queue *q);
+--- a/drivers/net/wireless/iwlwifi/iwl-trans-pcie-tx.c
++++ b/drivers/net/wireless/iwlwifi/iwl-trans-pcie-tx.c
+@@ -237,32 +237,38 @@ static void iwlagn_unmap_tfd(struct iwl_
+ for (i = 1; i < num_tbs; i++)
+ dma_unmap_single(trans->dev, iwl_tfd_tb_get_addr(tfd, i),
+ iwl_tfd_tb_get_len(tfd, i), dma_dir);
++
++ tfd->num_tbs = 0;
+ }
+
+ /**
+ * iwlagn_txq_free_tfd - Free all chunks referenced by TFD [txq->q.read_ptr]
+ * @trans - transport private data
+ * @txq - tx queue
+- * @index - the index of the TFD to be freed
+- *@dma_dir - the direction of the DMA mapping
++ * @dma_dir - the direction of the DMA mapping
+ *
+ * Does NOT advance any TFD circular buffer read/write indexes
+ * Does NOT free the TFD itself (which is within circular buffer)
+ */
+ void iwlagn_txq_free_tfd(struct iwl_trans *trans, struct iwl_tx_queue *txq,
+- int index, enum dma_data_direction dma_dir)
++ enum dma_data_direction dma_dir)
+ {
+ struct iwl_tfd *tfd_tmp = txq->tfds;
+
++ /* rd_ptr is bounded by n_bd and idx is bounded by n_window */
++ int rd_ptr = txq->q.read_ptr;
++ int idx = get_cmd_index(&txq->q, rd_ptr);
++
+ lockdep_assert_held(&txq->lock);
+
+- iwlagn_unmap_tfd(trans, &txq->meta[index], &tfd_tmp[index], dma_dir);
++ /* We have only q->n_window txq->entries, but we use q->n_bd tfds */
++ iwlagn_unmap_tfd(trans, &txq->meta[idx], &tfd_tmp[rd_ptr], dma_dir);
+
+ /* free SKB */
+ if (txq->skbs) {
+ struct sk_buff *skb;
+
+- skb = txq->skbs[index];
++ skb = txq->skbs[idx];
+
+ /* Can be called from irqs-disabled context
+ * If skb is not NULL, it means that the whole queue is being
+@@ -270,7 +276,7 @@ void iwlagn_txq_free_tfd(struct iwl_tran
+ */
+ if (skb) {
+ iwl_op_mode_free_skb(trans->op_mode, skb);
+- txq->skbs[index] = NULL;
++ txq->skbs[idx] = NULL;
+ }
+ }
+ }
+@@ -1100,7 +1106,7 @@ int iwl_tx_queue_reclaim(struct iwl_tran
+
+ iwlagn_txq_inval_byte_cnt_tbl(trans, txq);
+
+- iwlagn_txq_free_tfd(trans, txq, txq->q.read_ptr, DMA_TO_DEVICE);
++ iwlagn_txq_free_tfd(trans, txq, DMA_TO_DEVICE);
+ freed++;
+ }
+ return freed;
+--- a/drivers/net/wireless/iwlwifi/iwl-trans-pcie.c
++++ b/drivers/net/wireless/iwlwifi/iwl-trans-pcie.c
+@@ -430,9 +430,7 @@ static void iwl_tx_queue_unmap(struct iw
+
+ spin_lock_bh(&txq->lock);
+ while (q->write_ptr != q->read_ptr) {
+- /* The read_ptr needs to bound by q->n_window */
+- iwlagn_txq_free_tfd(trans, txq, get_cmd_index(q, q->read_ptr),
+- dma_dir);
++ iwlagn_txq_free_tfd(trans, txq, dma_dir);
+ q->read_ptr = iwl_queue_inc_wrap(q->read_ptr, q->n_bd);
+ }
+ spin_unlock_bh(&txq->lock);
--- /dev/null
+From dd48d708ff3e917f6d6b6c2b696c3f18c019feed Mon Sep 17 00:00:00 2001
+From: Richard Cochran <richardcochran@gmail.com>
+Date: Thu, 26 Apr 2012 14:11:32 +0200
+Subject: ntp: Correct TAI offset during leap second
+
+From: Richard Cochran <richardcochran@gmail.com>
+
+commit dd48d708ff3e917f6d6b6c2b696c3f18c019feed upstream.
+
+When repeating a UTC time value during a leap second (when the UTC
+time should be 23:59:60), the TAI timescale should not stop. The kernel
+NTP code increments the TAI offset one second too late. This patch fixes
+the issue by incrementing the offset during the leap second itself.
+
+Signed-off-by: Richard Cochran <richardcochran@gmail.com>
+Signed-off-by: John Stultz <john.stultz@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/time/ntp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/kernel/time/ntp.c
++++ b/kernel/time/ntp.c
+@@ -412,6 +412,7 @@ int second_overflow(unsigned long secs)
+ if (secs % 86400 == 0) {
+ leap = -1;
+ time_state = TIME_OOP;
++ time_tai++;
+ printk(KERN_NOTICE
+ "Clock: inserting leap second 23:59:60 UTC\n");
+ }
+@@ -426,7 +427,6 @@ int second_overflow(unsigned long secs)
+ }
+ break;
+ case TIME_OOP:
+- time_tai++;
+ time_state = TIME_WAIT;
+ break;
+
--- /dev/null
+From 30338cf09f82523d8747670f7363cc8af347c79f Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Sjur=20Br=C3=A6ndeland?= <sjur.brandeland@stericsson.com>
+Date: Sun, 10 Jun 2012 14:37:51 +0300
+Subject: remoteproc: fix missing fault indication in error-path
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Sjur Brændeland <sjur.brandeland@stericsson.com>
+
+commit 30338cf09f82523d8747670f7363cc8af347c79f upstream.
+
+If rproc_find_rsc_table() fails, rproc_fw_boot() must set
+return-value before jumping to clean_up label. Otherwise no
+error value is returned.
+
+Signed-off-by: Sjur Brændeland <sjur.brandeland@stericsson.com>
+Signed-off-by: Ohad Ben-Cohen <ohad@wizery.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/remoteproc/remoteproc_core.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/remoteproc/remoteproc_core.c
++++ b/drivers/remoteproc/remoteproc_core.c
+@@ -1041,8 +1041,10 @@ static int rproc_fw_boot(struct rproc *r
+
+ /* look for the resource table */
+ table = rproc_find_rsc_table(rproc, fw->data, fw->size, &tablesz);
+- if (!table)
++ if (!table) {
++ ret = -EINVAL;
+ goto clean_up;
++ }
+
+ /* handle fw resources which are required to boot rproc */
+ ret = rproc_handle_boot_rsc(rproc, table, tablesz);
--- /dev/null
+From e981f6d41acda2ae8c05e60feb2cb97772b4a6e6 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Sjur=20Br=C3=A6ndeland?= <sjur.brandeland@stericsson.com>
+Date: Sun, 10 Jun 2012 14:37:07 +0300
+Subject: remoteproc: fix print format warnings
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Sjur Brændeland <sjur.brandeland@stericsson.com>
+
+commit e981f6d41acda2ae8c05e60feb2cb97772b4a6e6 upstream.
+
+Fix compile warnings from GCC 4.6.1 when printing values of type size_t.
+
+drivers/remoteproc/remoteproc_core.c:251:6:
+warning: format ‘%x’ expects argument of type ‘unsigned int’,
+but argument 4 has type ‘size_t’ [-Wformat]
+drivers/remoteproc/remoteproc_core.c:938:9:
+warning: format ‘%u’ expects argument of type ‘unsigned int’,
+but argument 4 has type ‘size_t’ [-Wformat]
+drivers/remoteproc/remoteproc_core.c:1023:2:
+warning: format ‘%d’ expects argument of type ‘int’,
+but argument 4 has type ‘size_t’ [-Wformat]
+
+Signed-off-by: Sjur Brændeland <sjur.brandeland@stericsson.com>
+Signed-off-by: Ohad Ben-Cohen <ohad@wizery.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/remoteproc/remoteproc_core.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/remoteproc/remoteproc_core.c
++++ b/drivers/remoteproc/remoteproc_core.c
+@@ -247,7 +247,7 @@ rproc_load_segments(struct rproc *rproc,
+ }
+
+ if (offset + filesz > len) {
+- dev_err(dev, "truncated fw: need 0x%x avail 0x%x\n",
++ dev_err(dev, "truncated fw: need 0x%x avail 0x%zx\n",
+ offset + filesz, len);
+ ret = -EINVAL;
+ break;
+@@ -934,7 +934,7 @@ static void rproc_resource_cleanup(struc
+ unmapped = iommu_unmap(rproc->domain, entry->da, entry->len);
+ if (unmapped != entry->len) {
+ /* nothing much to do besides complaining */
+- dev_err(dev, "failed to unmap %u/%u\n", entry->len,
++ dev_err(dev, "failed to unmap %u/%zu\n", entry->len,
+ unmapped);
+ }
+
+@@ -1020,7 +1020,7 @@ static int rproc_fw_boot(struct rproc *r
+
+ ehdr = (struct elf32_hdr *)fw->data;
+
+- dev_info(dev, "Booting fw image %s, size %d\n", name, fw->size);
++ dev_info(dev, "Booting fw image %s, size %zd\n", name, fw->size);
+
+ /*
+ * if enabling an IOMMU isn't relevant for this rproc, this is
--- /dev/null
+From 6b03976288538a94e072bbfcd12d69a20daea8aa Mon Sep 17 00:00:00 2001
+From: Ohad Ben-Cohen <ohad@wizery.com>
+Date: Mon, 21 May 2012 16:31:12 +0300
+Subject: remoteproc/omap: fix dev_err typo
+
+From: Ohad Ben-Cohen <ohad@wizery.com>
+
+commit 6b03976288538a94e072bbfcd12d69a20daea8aa upstream.
+
+For some reason one of the dev_err invocations is using a wrong
+device so fix that.
+
+Signed-off-by: Ohad Ben-Cohen <ohad@wizery.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/remoteproc/omap_remoteproc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/remoteproc/omap_remoteproc.c
++++ b/drivers/remoteproc/omap_remoteproc.c
+@@ -182,7 +182,7 @@ static int __devinit omap_rproc_probe(st
+
+ ret = dma_set_coherent_mask(&pdev->dev, DMA_BIT_MASK(32));
+ if (ret) {
+- dev_err(pdev->dev.parent, "dma_set_coherent_mask: %d\n", ret);
++ dev_err(&pdev->dev, "dma_set_coherent_mask: %d\n", ret);
+ return ret;
+ }
+
hwrng-atmel-rng-fix-data-valid-check.patch
edac-avoid-mce-decoding-crash-after-edac-driver-unloaded.patch
edac-fix-the-error-about-memory-type-detection-on-sandybridge.patch
+9p-bug-before-corrupting-memory.patch
+remoteproc-omap-fix-dev_err-typo.patch
+remoteproc-fix-print-format-warnings.patch
+remoteproc-fix-missing-fault-indication-in-error-path.patch
+e1000e-disable-aspm-l1-on-82574.patch
+e1000e-remove-special-case-for-82573-82574-aspm-l1-disablement.patch
+ntp-correct-tai-offset-during-leap-second.patch
+iwlwifi-fix-the-transmit-frame-descriptor-rings.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
