From: Greg Kroah-Hartman Date: Fri, 6 Dec 2013 18:46:29 +0000 (-0800) Subject: 3.12-stable patches X-Git-Tag: v3.4.73~6 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=09f748fd7a9fdead56ae42e77e973b3148c7f020;p=thirdparty%2Fkernel%2Fstable-queue.git 3.12-stable patches added patches: elevator-acquire-q-sysfs_lock-in-elevator_change.patch elevator-fix-a-race-in-elevator-switching-and-md-device-initialization.patch hid-hid-elo-some-systems-cannot-stomach-work-around.patch hid-lg-fix-report-descriptor-for-logitech-momo-force-black.patch iommu-remove-stack-trace-from-broken-irq-remapping-warning.patch iommu-vt-d-fixed-interaction-of-vfio_iommu_map_dma-with-iommu-address-limits.patch ntp-make-periodic-rtc-update-more-reliable.patch rt2800-add-support-for-radio-chip-rf3070.patch usb-musb-davinci-fix-resources-passed-to-musb-driver-for-dm6467.patch usb-wusbcore-change-wa_segs_max-to-a-legal-value.patch video-kyro-fix-incorrect-sizes-when-copying-to-userspace.patch --- diff --git a/queue-3.12/elevator-acquire-q-sysfs_lock-in-elevator_change.patch b/queue-3.12/elevator-acquire-q-sysfs_lock-in-elevator_change.patch new file mode 100644 index 00000000000..875a0e374b1 --- /dev/null +++ b/queue-3.12/elevator-acquire-q-sysfs_lock-in-elevator_change.patch @@ -0,0 +1,63 @@ +From 7c8a3679e3d8e9d92d58f282161760a0e247df97 Mon Sep 17 00:00:00 2001 +From: Tomoki Sekiyama +Date: Tue, 15 Oct 2013 16:42:19 -0600 +Subject: elevator: acquire q->sysfs_lock in elevator_change() + +From: Tomoki Sekiyama + +commit 7c8a3679e3d8e9d92d58f282161760a0e247df97 upstream. + +Add locking of q->sysfs_lock into elevator_change() (an exported function) +to ensure it is held to protect q->elevator from elevator_init(), even if +elevator_change() is called from non-sysfs paths. +sysfs path (elv_iosched_store) uses __elevator_change(), non-locking +version, as the lock is already taken by elv_iosched_store(). + +Signed-off-by: Tomoki Sekiyama +Signed-off-by: Jens Axboe +Cc: Josh Boyer +Signed-off-by: Greg Kroah-Hartman + +--- + block/elevator.c | 16 ++++++++++++++-- + 1 file changed, 14 insertions(+), 2 deletions(-) + +--- a/block/elevator.c ++++ b/block/elevator.c +@@ -965,7 +965,7 @@ fail_init: + /* + * Switch this queue to the given IO scheduler. + */ +-int elevator_change(struct request_queue *q, const char *name) ++static int __elevator_change(struct request_queue *q, const char *name) + { + char elevator_name[ELV_NAME_MAX]; + struct elevator_type *e; +@@ -987,6 +987,18 @@ int elevator_change(struct request_queue + + return elevator_switch(q, e); + } ++ ++int elevator_change(struct request_queue *q, const char *name) ++{ ++ int ret; ++ ++ /* Protect q->elevator from elevator_init() */ ++ mutex_lock(&q->sysfs_lock); ++ ret = __elevator_change(q, name); ++ mutex_unlock(&q->sysfs_lock); ++ ++ return ret; ++} + EXPORT_SYMBOL(elevator_change); + + ssize_t elv_iosched_store(struct request_queue *q, const char *name, +@@ -997,7 +1009,7 @@ ssize_t elv_iosched_store(struct request + if (!q->elevator) + return count; + +- ret = elevator_change(q, name); ++ ret = __elevator_change(q, name); + if (!ret) + return count; + diff --git a/queue-3.12/elevator-fix-a-race-in-elevator-switching-and-md-device-initialization.patch b/queue-3.12/elevator-fix-a-race-in-elevator-switching-and-md-device-initialization.patch new file mode 100644 index 00000000000..72128b5653d --- /dev/null +++ b/queue-3.12/elevator-fix-a-race-in-elevator-switching-and-md-device-initialization.patch @@ -0,0 +1,103 @@ +From eb1c160b22655fd4ec44be732d6594fd1b1e44f4 Mon Sep 17 00:00:00 2001 +From: Tomoki Sekiyama +Date: Tue, 15 Oct 2013 16:42:16 -0600 +Subject: elevator: Fix a race in elevator switching and md device initialization + +From: Tomoki Sekiyama + +commit eb1c160b22655fd4ec44be732d6594fd1b1e44f4 upstream. + +The soft lockup below happens at the boot time of the system using dm +multipath and the udev rules to switch scheduler. + +[ 356.127001] BUG: soft lockup - CPU#3 stuck for 22s! [sh:483] +[ 356.127001] RIP: 0010:[] [] lock_timer_base.isra.35+0x1d/0x50 +... +[ 356.127001] Call Trace: +[ 356.127001] [] try_to_del_timer_sync+0x20/0x70 +[ 356.127001] [] ? kmem_cache_alloc_node_trace+0x20a/0x230 +[ 356.127001] [] del_timer_sync+0x52/0x60 +[ 356.127001] [] cfq_exit_queue+0x32/0xf0 +[ 356.127001] [] elevator_exit+0x2f/0x50 +[ 356.127001] [] elevator_change+0xf1/0x1c0 +[ 356.127001] [] elv_iosched_store+0x20/0x50 +[ 356.127001] [] queue_attr_store+0x59/0xb0 +[ 356.127001] [] sysfs_write_file+0xc6/0x140 +[ 356.127001] [] vfs_write+0xbd/0x1e0 +[ 356.127001] [] SyS_write+0x49/0xa0 +[ 356.127001] [] system_call_fastpath+0x16/0x1b + +This is caused by a race between md device initialization by multipathd and +shell script to switch the scheduler using sysfs. + + - multipathd: + SyS_ioctl -> do_vfs_ioctl -> dm_ctl_ioctl -> ctl_ioctl -> table_load + -> dm_setup_md_queue -> blk_init_allocated_queue -> elevator_init + q->elevator = elevator_alloc(q, e); // not yet initialized + + - sh -c 'echo deadline > /sys/$DEVPATH/queue/scheduler': + elevator_switch (in the call trace above) + struct elevator_queue *old = q->elevator; + q->elevator = elevator_alloc(q, new_e); + elevator_exit(old); // lockup! (*) + + - multipathd: (cont.) + err = e->ops.elevator_init_fn(q); // init fails; q->elevator is modified + +(*) When del_timer_sync() is called, lock_timer_base() will loop infinitely +while timer->base == NULL. In this case, as timer will never initialized, +it results in lockup. + +This patch introduces acquisition of q->sysfs_lock around elevator_init() +into blk_init_allocated_queue(), to provide mutual exclusion between +initialization of the q->scheduler and switching of the scheduler. + +This should fix this bugzilla: +https://bugzilla.redhat.com/show_bug.cgi?id=902012 + +Signed-off-by: Tomoki Sekiyama +Signed-off-by: Jens Axboe +Cc: Josh Boyer +Signed-off-by: Greg Kroah-Hartman + +--- + block/blk-core.c | 10 +++++++++- + block/elevator.c | 6 ++++++ + 2 files changed, 15 insertions(+), 1 deletion(-) + +--- a/block/blk-core.c ++++ b/block/blk-core.c +@@ -741,9 +741,17 @@ blk_init_allocated_queue(struct request_ + + q->sg_reserved_size = INT_MAX; + ++ /* Protect q->elevator from elevator_change */ ++ mutex_lock(&q->sysfs_lock); ++ + /* init elevator */ +- if (elevator_init(q, NULL)) ++ if (elevator_init(q, NULL)) { ++ mutex_unlock(&q->sysfs_lock); + return NULL; ++ } ++ ++ mutex_unlock(&q->sysfs_lock); ++ + return q; + } + EXPORT_SYMBOL(blk_init_allocated_queue); +--- a/block/elevator.c ++++ b/block/elevator.c +@@ -186,6 +186,12 @@ int elevator_init(struct request_queue * + struct elevator_type *e = NULL; + int err; + ++ /* ++ * q->sysfs_lock must be held to provide mutual exclusion between ++ * elevator_switch() and here. ++ */ ++ lockdep_assert_held(&q->sysfs_lock); ++ + if (unlikely(q->elevator)) + return 0; + diff --git a/queue-3.12/hid-hid-elo-some-systems-cannot-stomach-work-around.patch b/queue-3.12/hid-hid-elo-some-systems-cannot-stomach-work-around.patch new file mode 100644 index 00000000000..b1a3ed2032a --- /dev/null +++ b/queue-3.12/hid-hid-elo-some-systems-cannot-stomach-work-around.patch @@ -0,0 +1,67 @@ +From 403cfb53fb450d53751fdc7ee0cd6652419612cf Mon Sep 17 00:00:00 2001 +From: Oliver Neukum +Date: Wed, 25 Sep 2013 09:42:55 +0200 +Subject: HID: hid-elo: some systems cannot stomach work around + +From: Oliver Neukum + +commit 403cfb53fb450d53751fdc7ee0cd6652419612cf upstream. + +Some systems although they have firmware class 'M', which usually +needs a work around to not crash, must not be subjected to the +work around because the work around crashes them. They cannot be +told apart by their own device descriptor, but as they are part +of compound devices, can be identified by looking at their siblings. + +Signed-off-by: Oliver Neukum +Signed-off-by: Jiri Kosina +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hid/hid-elo.c | 35 ++++++++++++++++++++++++++++++++++- + 1 file changed, 34 insertions(+), 1 deletion(-) + +--- a/drivers/hid/hid-elo.c ++++ b/drivers/hid/hid-elo.c +@@ -181,7 +181,40 @@ fail: + */ + static bool elo_broken_firmware(struct usb_device *dev) + { +- return use_fw_quirk && le16_to_cpu(dev->descriptor.bcdDevice) == 0x10d; ++ struct usb_device *hub = dev->parent; ++ struct usb_device *child = NULL; ++ u16 fw_lvl = le16_to_cpu(dev->descriptor.bcdDevice); ++ u16 child_vid, child_pid; ++ int i; ++ ++ if (!use_fw_quirk) ++ return false; ++ if (fw_lvl != 0x10d) ++ return false; ++ ++ /* iterate sibling devices of the touch controller */ ++ usb_hub_for_each_child(hub, i, child) { ++ child_vid = le16_to_cpu(child->descriptor.idVendor); ++ child_pid = le16_to_cpu(child->descriptor.idProduct); ++ ++ /* ++ * If one of the devices below is present attached as a sibling of ++ * the touch controller then this is a newer IBM 4820 monitor that ++ * does not need the IBM-requested workaround if fw level is ++ * 0x010d - aka 'M'. ++ * No other HW can have this combination. ++ */ ++ if (child_vid==0x04b3) { ++ switch (child_pid) { ++ case 0x4676: /* 4820 21x Video */ ++ case 0x4677: /* 4820 51x Video */ ++ case 0x4678: /* 4820 2Lx Video */ ++ case 0x4679: /* 4820 5Lx Video */ ++ return false; ++ } ++ } ++ } ++ return true; + } + + static int elo_probe(struct hid_device *hdev, const struct hid_device_id *id) diff --git a/queue-3.12/hid-lg-fix-report-descriptor-for-logitech-momo-force-black.patch b/queue-3.12/hid-lg-fix-report-descriptor-for-logitech-momo-force-black.patch new file mode 100644 index 00000000000..042dca986ef --- /dev/null +++ b/queue-3.12/hid-lg-fix-report-descriptor-for-logitech-momo-force-black.patch @@ -0,0 +1,102 @@ +From 348cbaa800f8161168b20f85f72abb541c145132 Mon Sep 17 00:00:00 2001 +From: Simon Wood +Date: Thu, 10 Oct 2013 08:20:13 -0600 +Subject: HID: lg: fix Report Descriptor for Logitech MOMO Force (Black) + +From: Simon Wood + +commit 348cbaa800f8161168b20f85f72abb541c145132 upstream. + +By default the Logitech MOMO Force (Black) presents a combined accel/brake +axis ('Y'). This patch modifies the HID descriptor to present seperate +accel/brake axes ('Y' and 'Z'). + +Signed-off-by: Simon Wood +Signed-off-by: Jiri Kosina +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hid/hid-lg.c | 58 +++++++++++++++++++++++++++++++++++++++++++++++++++ + 1 file changed, 58 insertions(+) + +--- a/drivers/hid/hid-lg.c ++++ b/drivers/hid/hid-lg.c +@@ -47,6 +47,7 @@ + #define DFP_RDESC_ORIG_SIZE 97 + #define FV_RDESC_ORIG_SIZE 130 + #define MOMO_RDESC_ORIG_SIZE 87 ++#define MOMO2_RDESC_ORIG_SIZE 87 + + /* Fixed report descriptors for Logitech Driving Force (and Pro) + * wheel controllers +@@ -284,6 +285,54 @@ static __u8 momo_rdesc_fixed[] = { + 0xC0 /* End Collection */ + }; + ++static __u8 momo2_rdesc_fixed[] = { ++0x05, 0x01, /* Usage Page (Desktop), */ ++0x09, 0x04, /* Usage (Joystik), */ ++0xA1, 0x01, /* Collection (Application), */ ++0xA1, 0x02, /* Collection (Logical), */ ++0x95, 0x01, /* Report Count (1), */ ++0x75, 0x0A, /* Report Size (10), */ ++0x15, 0x00, /* Logical Minimum (0), */ ++0x26, 0xFF, 0x03, /* Logical Maximum (1023), */ ++0x35, 0x00, /* Physical Minimum (0), */ ++0x46, 0xFF, 0x03, /* Physical Maximum (1023), */ ++0x09, 0x30, /* Usage (X), */ ++0x81, 0x02, /* Input (Variable), */ ++0x95, 0x0A, /* Report Count (10), */ ++0x75, 0x01, /* Report Size (1), */ ++0x25, 0x01, /* Logical Maximum (1), */ ++0x45, 0x01, /* Physical Maximum (1), */ ++0x05, 0x09, /* Usage Page (Button), */ ++0x19, 0x01, /* Usage Minimum (01h), */ ++0x29, 0x0A, /* Usage Maximum (0Ah), */ ++0x81, 0x02, /* Input (Variable), */ ++0x06, 0x00, 0xFF, /* Usage Page (FF00h), */ ++0x09, 0x00, /* Usage (00h), */ ++0x95, 0x04, /* Report Count (4), */ ++0x81, 0x02, /* Input (Variable), */ ++0x95, 0x01, /* Report Count (1), */ ++0x75, 0x08, /* Report Size (8), */ ++0x26, 0xFF, 0x00, /* Logical Maximum (255), */ ++0x46, 0xFF, 0x00, /* Physical Maximum (255), */ ++0x09, 0x01, /* Usage (01h), */ ++0x81, 0x02, /* Input (Variable), */ ++0x05, 0x01, /* Usage Page (Desktop), */ ++0x09, 0x31, /* Usage (Y), */ ++0x81, 0x02, /* Input (Variable), */ ++0x09, 0x32, /* Usage (Z), */ ++0x81, 0x02, /* Input (Variable), */ ++0x06, 0x00, 0xFF, /* Usage Page (FF00h), */ ++0x09, 0x00, /* Usage (00h), */ ++0x81, 0x02, /* Input (Variable), */ ++0xC0, /* End Collection, */ ++0xA1, 0x02, /* Collection (Logical), */ ++0x09, 0x02, /* Usage (02h), */ ++0x95, 0x07, /* Report Count (7), */ ++0x91, 0x02, /* Output (Variable), */ ++0xC0, /* End Collection, */ ++0xC0 /* End Collection */ ++}; ++ + /* + * Certain Logitech keyboards send in report #3 keys which are far + * above the logical maximum described in descriptor. This extends +@@ -343,6 +392,15 @@ static __u8 *lg_report_fixup(struct hid_ + } + break; + ++ case USB_DEVICE_ID_LOGITECH_MOMO_WHEEL2: ++ if (*rsize == MOMO2_RDESC_ORIG_SIZE) { ++ hid_info(hdev, ++ "fixing up Logitech Momo Racing Force (Black) report descriptor\n"); ++ rdesc = momo2_rdesc_fixed; ++ *rsize = sizeof(momo2_rdesc_fixed); ++ } ++ break; ++ + case USB_DEVICE_ID_LOGITECH_VIBRATION_WHEEL: + if (*rsize == FV_RDESC_ORIG_SIZE) { + hid_info(hdev, diff --git a/queue-3.12/iommu-remove-stack-trace-from-broken-irq-remapping-warning.patch b/queue-3.12/iommu-remove-stack-trace-from-broken-irq-remapping-warning.patch new file mode 100644 index 00000000000..6394b6177ed --- /dev/null +++ b/queue-3.12/iommu-remove-stack-trace-from-broken-irq-remapping-warning.patch @@ -0,0 +1,52 @@ +From 05104a4e8713b27291c7bb49c1e7e68b4e243571 Mon Sep 17 00:00:00 2001 +From: Neil Horman +Date: Fri, 27 Sep 2013 12:53:35 -0400 +Subject: iommu: Remove stack trace from broken irq remapping warning + +From: Neil Horman + +commit 05104a4e8713b27291c7bb49c1e7e68b4e243571 upstream. + +The warning for the irq remapping broken check in intel_irq_remapping.c is +pretty pointless. We need the warning, but we know where its comming from, the +stack trace will always be the same, and it needlessly triggers things like +Abrt. This changes the warning to just print a text warning about BIOS being +broken, without the stack trace, then sets the appropriate taint bit. Since we +automatically disable irq remapping, theres no need to contiue making Abrt jump +at this problem + +Signed-off-by: Neil Horman +CC: Joerg Roedel +CC: Bjorn Helgaas +CC: Andy Lutomirski +CC: Konrad Rzeszutek Wilk +CC: Sebastian Andrzej Siewior +Signed-off-by: Joerg Roedel +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iommu/intel_irq_remapping.c | 13 +++++++------ + 1 file changed, 7 insertions(+), 6 deletions(-) + +--- a/drivers/iommu/intel_irq_remapping.c ++++ b/drivers/iommu/intel_irq_remapping.c +@@ -525,12 +525,13 @@ static int __init intel_irq_remapping_su + if (disable_irq_remap) + return 0; + if (irq_remap_broken) { +- WARN_TAINT(1, TAINT_FIRMWARE_WORKAROUND, +- "This system BIOS has enabled interrupt remapping\n" +- "on a chipset that contains an erratum making that\n" +- "feature unstable. To maintain system stability\n" +- "interrupt remapping is being disabled. Please\n" +- "contact your BIOS vendor for an update\n"); ++ printk(KERN_WARNING ++ "This system BIOS has enabled interrupt remapping\n" ++ "on a chipset that contains an erratum making that\n" ++ "feature unstable. To maintain system stability\n" ++ "interrupt remapping is being disabled. Please\n" ++ "contact your BIOS vendor for an update\n"); ++ add_taint(TAINT_FIRMWARE_WORKAROUND, LOCKDEP_STILL_OK); + disable_irq_remap = 1; + return 0; + } diff --git a/queue-3.12/iommu-vt-d-fixed-interaction-of-vfio_iommu_map_dma-with-iommu-address-limits.patch b/queue-3.12/iommu-vt-d-fixed-interaction-of-vfio_iommu_map_dma-with-iommu-address-limits.patch new file mode 100644 index 00000000000..d6da600b34f --- /dev/null +++ b/queue-3.12/iommu-vt-d-fixed-interaction-of-vfio_iommu_map_dma-with-iommu-address-limits.patch @@ -0,0 +1,45 @@ +From f9423606ade08653dd8a43334f0a7fb45504c5cc Mon Sep 17 00:00:00 2001 +From: Julian Stecklina +Date: Wed, 9 Oct 2013 10:03:52 +0200 +Subject: iommu/vt-d: Fixed interaction of VFIO_IOMMU_MAP_DMA with IOMMU address limits + +From: Julian Stecklina + +commit f9423606ade08653dd8a43334f0a7fb45504c5cc upstream. + +The BUG_ON in drivers/iommu/intel-iommu.c:785 can be triggered from userspace via +VFIO by calling the VFIO_IOMMU_MAP_DMA ioctl on a vfio device with any address +beyond the addressing capabilities of the IOMMU. The problem is that the ioctl code +calls iommu_iova_to_phys before it calls iommu_map. iommu_map handles the case that +it gets addresses beyond the addressing capabilities of its IOMMU. +intel_iommu_iova_to_phys does not. + +This patch fixes iommu_iova_to_phys to return NULL for addresses beyond what the +IOMMU can handle. This in turn causes the ioctl call to fail in iommu_map and +(correctly) return EFAULT to the user with a helpful warning message in the kernel +log. + +Signed-off-by: Julian Stecklina +Acked-by: Alex Williamson +Signed-off-by: Joerg Roedel +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iommu/intel-iommu.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/drivers/iommu/intel-iommu.c ++++ b/drivers/iommu/intel-iommu.c +@@ -782,7 +782,11 @@ static struct dma_pte *pfn_to_dma_pte(st + int offset; + + BUG_ON(!domain->pgd); +- BUG_ON(addr_width < BITS_PER_LONG && pfn >> addr_width); ++ ++ if (addr_width < BITS_PER_LONG && pfn >> addr_width) ++ /* Address beyond IOMMU's addressing capabilities. */ ++ return NULL; ++ + parent = domain->pgd; + + while (level > 0) { diff --git a/queue-3.12/ntp-make-periodic-rtc-update-more-reliable.patch b/queue-3.12/ntp-make-periodic-rtc-update-more-reliable.patch new file mode 100644 index 00000000000..55a35e3d25b --- /dev/null +++ b/queue-3.12/ntp-make-periodic-rtc-update-more-reliable.patch @@ -0,0 +1,46 @@ +From a97ad0c4b447a132a322cedc3a5f7fa4cab4b304 Mon Sep 17 00:00:00 2001 +From: Miroslav Lichvar +Date: Thu, 1 Aug 2013 19:31:35 +0200 +Subject: ntp: Make periodic RTC update more reliable + +From: Miroslav Lichvar + +commit a97ad0c4b447a132a322cedc3a5f7fa4cab4b304 upstream. + +The current code requires that the scheduled update of the RTC happens +in the closest tick to the half of the second. This seems to be +difficult to achieve reliably. The scheduled work may be missing the +target time by a tick or two and be constantly rescheduled every second. + +Relax the limit to 10 ticks. As a typical RTC drifts in the 11-minute +update interval by several milliseconds, this shouldn't affect the +overall accuracy of the RTC much. + +Signed-off-by: Miroslav Lichvar +Signed-off-by: John Stultz +Cc: Josh Boyer +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/time/ntp.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/kernel/time/ntp.c ++++ b/kernel/time/ntp.c +@@ -475,6 +475,7 @@ static void sync_cmos_clock(struct work_ + * called as close as possible to 500 ms before the new second starts. + * This code is run on a timer. If the clock is set, that timer + * may not expire at the correct time. Thus, we adjust... ++ * We want the clock to be within a couple of ticks from the target. + */ + if (!ntp_synced()) { + /* +@@ -485,7 +486,7 @@ static void sync_cmos_clock(struct work_ + } + + getnstimeofday(&now); +- if (abs(now.tv_nsec - (NSEC_PER_SEC / 2)) <= tick_nsec / 2) { ++ if (abs(now.tv_nsec - (NSEC_PER_SEC / 2)) <= tick_nsec * 5) { + struct timespec adjust = now; + + fail = -ENODEV; diff --git a/queue-3.12/rt2800-add-support-for-radio-chip-rf3070.patch b/queue-3.12/rt2800-add-support-for-radio-chip-rf3070.patch new file mode 100644 index 00000000000..3055fad33fb --- /dev/null +++ b/queue-3.12/rt2800-add-support-for-radio-chip-rf3070.patch @@ -0,0 +1,92 @@ +From 3b9b74baa1af2952d719735b4a4a34706a593948 Mon Sep 17 00:00:00 2001 +From: Stanislaw Gruszka +Date: Wed, 25 Sep 2013 15:34:55 +0200 +Subject: rt2800: add support for radio chip RF3070 + +From: Stanislaw Gruszka + +commit 3b9b74baa1af2952d719735b4a4a34706a593948 upstream. + +Add support for new RF chip ID: 3070. It seems to be the same as 5370, +maybe vendor just put wrong value on the eeprom, but add this id anyway +since devices with it showed on the marked. + +Signed-off-by: Stanislaw Gruszka +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/rt2x00/rt2800.h | 2 ++ + drivers/net/wireless/rt2x00/rt2800lib.c | 8 +++++++- + 2 files changed, 9 insertions(+), 1 deletion(-) + +--- a/drivers/net/wireless/rt2x00/rt2800.h ++++ b/drivers/net/wireless/rt2x00/rt2800.h +@@ -52,6 +52,7 @@ + * RF3322 2.4G 2T2R(RT3352/RT3371/RT3372/RT3391/RT3392) + * RF3053 2.4G/5G 3T3R(RT3883/RT3563/RT3573/RT3593/RT3662) + * RF5592 2.4G/5G 2T2R ++ * RF3070 2.4G 1T1R + * RF5360 2.4G 1T1R + * RF5370 2.4G 1T1R + * RF5390 2.4G 1T1R +@@ -70,6 +71,7 @@ + #define RF3322 0x000c + #define RF3053 0x000d + #define RF5592 0x000f ++#define RF3070 0x3070 + #define RF3290 0x3290 + #define RF5360 0x5360 + #define RF5370 0x5370 +--- a/drivers/net/wireless/rt2x00/rt2800lib.c ++++ b/drivers/net/wireless/rt2x00/rt2800lib.c +@@ -3152,6 +3152,7 @@ static void rt2800_config_channel(struct + case RF3322: + rt2800_config_channel_rf3322(rt2x00dev, conf, rf, info); + break; ++ case RF3070: + case RF5360: + case RF5370: + case RF5372: +@@ -3166,7 +3167,8 @@ static void rt2800_config_channel(struct + rt2800_config_channel_rf2xxx(rt2x00dev, conf, rf, info); + } + +- if (rt2x00_rf(rt2x00dev, RF3290) || ++ if (rt2x00_rf(rt2x00dev, RF3070) || ++ rt2x00_rf(rt2x00dev, RF3290) || + rt2x00_rf(rt2x00dev, RF3322) || + rt2x00_rf(rt2x00dev, RF5360) || + rt2x00_rf(rt2x00dev, RF5370) || +@@ -4264,6 +4266,7 @@ void rt2800_vco_calibration(struct rt2x0 + rt2800_rfcsr_write(rt2x00dev, 7, rfcsr); + break; + case RF3053: ++ case RF3070: + case RF3290: + case RF5360: + case RF5370: +@@ -7024,6 +7027,7 @@ static int rt2800_init_eeprom(struct rt2 + case RF3022: + case RF3052: + case RF3053: ++ case RF3070: + case RF3290: + case RF3320: + case RF3322: +@@ -7546,6 +7550,7 @@ static int rt2800_probe_hw_mode(struct r + rt2x00_rf(rt2x00dev, RF2020) || + rt2x00_rf(rt2x00dev, RF3021) || + rt2x00_rf(rt2x00dev, RF3022) || ++ rt2x00_rf(rt2x00dev, RF3070) || + rt2x00_rf(rt2x00dev, RF3290) || + rt2x00_rf(rt2x00dev, RF3320) || + rt2x00_rf(rt2x00dev, RF3322) || +@@ -7674,6 +7679,7 @@ static int rt2800_probe_hw_mode(struct r + case RF3320: + case RF3052: + case RF3053: ++ case RF3070: + case RF3290: + case RF5360: + case RF5370: diff --git a/queue-3.12/series b/queue-3.12/series index 092973a07c4..0364be6ee7b 100644 --- a/queue-3.12/series +++ b/queue-3.12/series @@ -61,3 +61,14 @@ xfrm-fix-null-pointer-dereference-when-decoding-sessions.patch xfs-add-capability-check-to-free-eofblocks-ioctl.patch mm-numa-return-the-number-of-base-pages-altered-by-protection-changes.patch md-raid5-use-conf-device_lock-protect-changing-of-multi-thread-resources.patch +usb-musb-davinci-fix-resources-passed-to-musb-driver-for-dm6467.patch +usb-wusbcore-change-wa_segs_max-to-a-legal-value.patch +video-kyro-fix-incorrect-sizes-when-copying-to-userspace.patch +hid-lg-fix-report-descriptor-for-logitech-momo-force-black.patch +hid-hid-elo-some-systems-cannot-stomach-work-around.patch +iommu-vt-d-fixed-interaction-of-vfio_iommu_map_dma-with-iommu-address-limits.patch +iommu-remove-stack-trace-from-broken-irq-remapping-warning.patch +rt2800-add-support-for-radio-chip-rf3070.patch +elevator-fix-a-race-in-elevator-switching-and-md-device-initialization.patch +elevator-acquire-q-sysfs_lock-in-elevator_change.patch +ntp-make-periodic-rtc-update-more-reliable.patch diff --git a/queue-3.12/usb-musb-davinci-fix-resources-passed-to-musb-driver-for-dm6467.patch b/queue-3.12/usb-musb-davinci-fix-resources-passed-to-musb-driver-for-dm6467.patch new file mode 100644 index 00000000000..7b46690195c --- /dev/null +++ b/queue-3.12/usb-musb-davinci-fix-resources-passed-to-musb-driver-for-dm6467.patch @@ -0,0 +1,53 @@ +From ea78201e2e08f8a91e30100c4c4a908b5cf295fc Mon Sep 17 00:00:00 2001 +From: Sergei Shtylyov +Date: Sun, 22 Sep 2013 01:43:58 +0400 +Subject: usb: musb: davinci: fix resources passed to MUSB driver for DM6467 + +From: Sergei Shtylyov + +commit ea78201e2e08f8a91e30100c4c4a908b5cf295fc upstream. + +After commit 09fc7d22b024692b2fe8a943b246de1af307132b (usb: musb: fix incorrect +usage of resource pointer), CPPI DMA driver on DaVinci DM6467 can't detect its +dedicated IRQ and so the MUSB IRQ is erroneously used instead. This is because +only 2 resources are passed to the MUSB driver from the DaVinci glue layer, so +fix this by always copying 3 resources (it's safe since a placeholder for the +3rd resource is always there) and passing 'pdev->num_resources' instead of the +size of musb_resources[] to platform_device_add_resources(). + +Signed-off-by: Sergei Shtylyov +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + + +--- + drivers/usb/musb/davinci.c | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +--- a/drivers/usb/musb/davinci.c ++++ b/drivers/usb/musb/davinci.c +@@ -509,7 +509,7 @@ static u64 davinci_dmamask = DMA_BIT_MAS + + static int davinci_probe(struct platform_device *pdev) + { +- struct resource musb_resources[2]; ++ struct resource musb_resources[3]; + struct musb_hdrc_platform_data *pdata = dev_get_platdata(&pdev->dev); + struct platform_device *musb; + struct davinci_glue *glue; +@@ -567,6 +567,15 @@ static int davinci_probe(struct platform + musb_resources[1].end = pdev->resource[1].end; + musb_resources[1].flags = pdev->resource[1].flags; + ++ /* ++ * For DM6467 3 resources are passed. A placeholder for the 3rd ++ * resource is always there, so it's safe to always copy it... ++ */ ++ musb_resources[2].name = pdev->resource[2].name; ++ musb_resources[2].start = pdev->resource[2].start; ++ musb_resources[2].end = pdev->resource[2].end; ++ musb_resources[2].flags = pdev->resource[2].flags; ++ + ret = platform_device_add_resources(musb, musb_resources, + ARRAY_SIZE(musb_resources)); + if (ret) { diff --git a/queue-3.12/usb-wusbcore-change-wa_segs_max-to-a-legal-value.patch b/queue-3.12/usb-wusbcore-change-wa_segs_max-to-a-legal-value.patch new file mode 100644 index 00000000000..a119f5f8cc3 --- /dev/null +++ b/queue-3.12/usb-wusbcore-change-wa_segs_max-to-a-legal-value.patch @@ -0,0 +1,41 @@ +From f74b75e7f920c700636cccca669c7d16d12e9202 Mon Sep 17 00:00:00 2001 +From: Thomas Pugliese +Date: Wed, 23 Oct 2013 14:44:29 -0500 +Subject: usb: wusbcore: change WA_SEGS_MAX to a legal value + +From: Thomas Pugliese + +commit f74b75e7f920c700636cccca669c7d16d12e9202 upstream. + +change WA_SEGS_MAX to a number that is legal according to the WUSB +spec. + +Signed-off-by: Thomas Pugliese +Signed-off-by: Greg Kroah-Hartman + + +--- + drivers/usb/wusbcore/wa-xfer.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/drivers/usb/wusbcore/wa-xfer.c ++++ b/drivers/usb/wusbcore/wa-xfer.c +@@ -91,7 +91,8 @@ + #include "wusbhc.h" + + enum { +- WA_SEGS_MAX = 255, ++ /* [WUSB] section 8.3.3 allocates 7 bits for the segment index. */ ++ WA_SEGS_MAX = 128, + }; + + enum wa_seg_status { +@@ -446,7 +447,7 @@ static ssize_t __wa_xfer_setup_sizes(str + } + xfer->seg_size = (xfer->seg_size / maxpktsize) * maxpktsize; + xfer->segs = DIV_ROUND_UP(urb->transfer_buffer_length, xfer->seg_size); +- if (xfer->segs >= WA_SEGS_MAX) { ++ if (xfer->segs > WA_SEGS_MAX) { + dev_err(dev, "BUG? ops, number of segments %d bigger than %d\n", + (int)(urb->transfer_buffer_length / xfer->seg_size), + WA_SEGS_MAX); diff --git a/queue-3.12/video-kyro-fix-incorrect-sizes-when-copying-to-userspace.patch b/queue-3.12/video-kyro-fix-incorrect-sizes-when-copying-to-userspace.patch new file mode 100644 index 00000000000..570a0b572e8 --- /dev/null +++ b/queue-3.12/video-kyro-fix-incorrect-sizes-when-copying-to-userspace.patch @@ -0,0 +1,43 @@ +From 2ab68ec927310dc488f3403bb48f9e4ad00a9491 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Nov 2013 14:25:36 -0500 +Subject: video: kyro: fix incorrect sizes when copying to userspace + +From: Sasha Levin + +commit 2ab68ec927310dc488f3403bb48f9e4ad00a9491 upstream. + +kyro would copy u32s and specify sizeof(unsigned long) as the size to copy. + +This would copy more data than intended and cause memory corruption and might +leak kernel memory. + +Signed-off-by: Sasha Levin +Signed-off-by: Tomi Valkeinen +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/video/kyro/fbdev.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/video/kyro/fbdev.c ++++ b/drivers/video/kyro/fbdev.c +@@ -625,15 +625,15 @@ static int kyrofb_ioctl(struct fb_info * + } + break; + case KYRO_IOCTL_UVSTRIDE: +- if (copy_to_user(argp, &deviceInfo.ulOverlayUVStride, sizeof(unsigned long))) ++ if (copy_to_user(argp, &deviceInfo.ulOverlayUVStride, sizeof(deviceInfo.ulOverlayUVStride))) + return -EFAULT; + break; + case KYRO_IOCTL_STRIDE: +- if (copy_to_user(argp, &deviceInfo.ulOverlayStride, sizeof(unsigned long))) ++ if (copy_to_user(argp, &deviceInfo.ulOverlayStride, sizeof(deviceInfo.ulOverlayStride))) + return -EFAULT; + break; + case KYRO_IOCTL_OVERLAY_OFFSET: +- if (copy_to_user(argp, &deviceInfo.ulOverlayOffset, sizeof(unsigned long))) ++ if (copy_to_user(argp, &deviceInfo.ulOverlayOffset, sizeof(deviceInfo.ulOverlayOffset))) + return -EFAULT; + break; + }