From: Greg Kroah-Hartman Date: Thu, 27 Jun 2013 19:19:27 +0000 (-0700) Subject: 3.9-stable patches X-Git-Tag: v3.9.9~14 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=252548b5ac03c55aa584628ebd07d039a822d7ee;p=thirdparty%2Fkernel%2Fstable-queue.git 3.9-stable patches added patches: ath9k_htc-handle-idle-state-transition-properly.patch bluetooth-fix-crash-in-l2cap_build_cmd-with-small-mtu.patch bluetooth-fix-invalid-length-check-in-l2cap_information_rsp.patch dlci-acquire-rtnl_lock-before-calling-__dev_get_by_name.patch dlci-validate-the-net-device-in-dlci_del.patch hw_breakpoint-fix-cpu-check-in-task_bp_pinned-cpu.patch hw_breakpoint-use-cpu_possible_mask-in-reserve-release-_bp_slot.patch iwlwifi-dvm-fix-chain-noise-calibration.patch net-tg3-avoid-delay-during-mmio-access.patch rt2800-fix-rt5390-rt3290-tx-power-settings-regression.patch s390-irq-only-define-synchronize_irq-on-smp.patch s390-pci-implement-irq-functions-if-pci.patch --- diff --git a/queue-3.9/ath9k_htc-handle-idle-state-transition-properly.patch b/queue-3.9/ath9k_htc-handle-idle-state-transition-properly.patch new file mode 100644 index 00000000000..ade6d2a1956 --- /dev/null +++ b/queue-3.9/ath9k_htc-handle-idle-state-transition-properly.patch @@ -0,0 +1,32 @@ +From 075163bbb0f51174359947e1bce84f5edb23f21e Mon Sep 17 00:00:00 2001 +From: Sujith Manoharan +Date: Thu, 20 Jun 2013 13:57:07 +0530 +Subject: ath9k_htc: Handle IDLE state transition properly + +From: Sujith Manoharan + +commit 075163bbb0f51174359947e1bce84f5edb23f21e upstream. + +Make sure that a chip reset is done when IDLE is turned +off - this fixes authentication timeouts. + +Reported-by: Ignacy Gawedzki +Signed-off-by: Sujith Manoharan +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/ath/ath9k/htc_drv_main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/wireless/ath/ath9k/htc_drv_main.c ++++ b/drivers/net/wireless/ath/ath9k/htc_drv_main.c +@@ -1174,7 +1174,7 @@ static int ath9k_htc_config(struct ieee8 + mutex_lock(&priv->htc_pm_lock); + + priv->ps_idle = !!(conf->flags & IEEE80211_CONF_IDLE); +- if (priv->ps_idle) ++ if (!priv->ps_idle) + chip_reset = true; + + mutex_unlock(&priv->htc_pm_lock); diff --git a/queue-3.9/bluetooth-fix-crash-in-l2cap_build_cmd-with-small-mtu.patch b/queue-3.9/bluetooth-fix-crash-in-l2cap_build_cmd-with-small-mtu.patch new file mode 100644 index 00000000000..9e8b39ca995 --- /dev/null +++ b/queue-3.9/bluetooth-fix-crash-in-l2cap_build_cmd-with-small-mtu.patch @@ -0,0 +1,90 @@ +From 300b962e5244a1ea010df7e88595faa0085b461d Mon Sep 17 00:00:00 2001 +From: Anderson Lizardo +Date: Sun, 2 Jun 2013 16:30:40 -0400 +Subject: Bluetooth: Fix crash in l2cap_build_cmd() with small MTU + +From: Anderson Lizardo + +commit 300b962e5244a1ea010df7e88595faa0085b461d upstream. + +If a too small MTU value is set with ioctl(HCISETACLMTU) or by a bogus +controller, memory corruption happens due to a memcpy() call with +negative length. + +Fix this crash on either incoming or outgoing connections with a MTU +smaller than L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE: + +[ 46.885433] BUG: unable to handle kernel paging request at f56ad000 +[ 46.888037] IP: [] memcpy+0x1d/0x40 +[ 46.888037] *pdpt = 0000000000ac3001 *pde = 00000000373f8067 *pte = 80000000356ad060 +[ 46.888037] Oops: 0002 [#1] SMP DEBUG_PAGEALLOC +[ 46.888037] Modules linked in: hci_vhci bluetooth virtio_balloon i2c_piix4 uhci_hcd usbcore usb_common +[ 46.888037] CPU: 0 PID: 1044 Comm: kworker/u3:0 Not tainted 3.10.0-rc1+ #12 +[ 46.888037] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2007 +[ 46.888037] Workqueue: hci0 hci_rx_work [bluetooth] +[ 46.888037] task: f59b15b0 ti: f55c4000 task.ti: f55c4000 +[ 46.888037] EIP: 0060:[] EFLAGS: 00010212 CPU: 0 +[ 46.888037] EIP is at memcpy+0x1d/0x40 +[ 46.888037] EAX: f56ac1c0 EBX: fffffff8 ECX: 3ffffc6e EDX: f55c5cf2 +[ 46.888037] ESI: f55c6b32 EDI: f56ad000 EBP: f55c5c68 ESP: f55c5c5c +[ 46.888037] DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068 +[ 46.888037] CR0: 8005003b CR2: f56ad000 CR3: 3557d000 CR4: 000006f0 +[ 46.888037] DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000 +[ 46.888037] DR6: ffff0ff0 DR7: 00000400 +[ 46.888037] Stack: +[ 46.888037] fffffff8 00000010 00000003 f55c5cac f8c6a54c ffffffff f8c69eb2 00000000 +[ 46.888037] f4783cdc f57f0070 f759c590 1001c580 00000003 0200000a 00000000 f5a88560 +[ 46.888037] f5ba2600 f5a88560 00000041 00000000 f55c5d90 f8c6f4c7 00000008 f55c5cf2 +[ 46.888037] Call Trace: +[ 46.888037] [] l2cap_send_cmd+0x1cc/0x230 [bluetooth] +[ 46.888037] [] ? l2cap_global_chan_by_psm+0x152/0x1a0 [bluetooth] +[ 46.888037] [] l2cap_connect+0x3f7/0x540 [bluetooth] +[ 46.888037] [] ? trace_hardirqs_off+0xb/0x10 +[ 46.888037] [] ? mark_held_locks+0x68/0x110 +[ 46.888037] [] ? mutex_lock_nested+0x280/0x360 +[ 46.888037] [] ? __mutex_unlock_slowpath+0xa9/0x150 +[ 46.888037] [] ? trace_hardirqs_on_caller+0xec/0x1b0 +[ 46.888037] [] ? mutex_lock_nested+0x268/0x360 +[ 46.888037] [] ? trace_hardirqs_on+0xb/0x10 +[ 46.888037] [] l2cap_recv_frame+0xb2d/0x1d30 [bluetooth] +[ 46.888037] [] ? mark_held_locks+0x68/0x110 +[ 46.888037] [] ? __mutex_unlock_slowpath+0xa9/0x150 +[ 46.888037] [] ? trace_hardirqs_on_caller+0xec/0x1b0 +[ 46.888037] [] l2cap_recv_acldata+0x2a1/0x320 [bluetooth] +[ 46.888037] [] hci_rx_work+0x518/0x810 [bluetooth] +[ 46.888037] [] ? hci_rx_work+0x132/0x810 [bluetooth] +[ 46.888037] [] process_one_work+0x1a9/0x600 +[ 46.888037] [] ? process_one_work+0x12b/0x600 +[ 46.888037] [] ? worker_thread+0x19e/0x320 +[ 46.888037] [] ? worker_thread+0x19e/0x320 +[ 46.888037] [] worker_thread+0xf7/0x320 +[ 46.888037] [] ? rescuer_thread+0x290/0x290 +[ 46.888037] [] kthread+0xa8/0xb0 +[ 46.888037] [] ret_from_kernel_thread+0x1b/0x28 +[ 46.888037] [] ? flush_kthread_worker+0x120/0x120 +[ 46.888037] Code: c3 90 8d 74 26 00 e8 63 fc ff ff eb e8 90 55 89 e5 83 ec 0c 89 5d f4 89 75 f8 89 7d fc 3e 8d 74 26 00 89 cb 89 c7 c1 e9 02 89 d6 a5 89 d9 83 e1 03 74 02 f3 a4 8b 5d f4 8b 75 f8 8b 7d fc 89 +[ 46.888037] EIP: [] memcpy+0x1d/0x40 SS:ESP 0068:f55c5c5c +[ 46.888037] CR2: 00000000f56ad000 +[ 46.888037] ---[ end trace 0217c1f4d78714a9 ]--- + +Signed-off-by: Anderson Lizardo +Signed-off-by: Gustavo Padovan +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + net/bluetooth/l2cap_core.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/net/bluetooth/l2cap_core.c ++++ b/net/bluetooth/l2cap_core.c +@@ -2743,6 +2743,9 @@ static struct sk_buff *l2cap_build_cmd(s + BT_DBG("conn %p, code 0x%2.2x, ident 0x%2.2x, len %u", + conn, code, ident, dlen); + ++ if (conn->mtu < L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE) ++ return NULL; ++ + len = L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE + dlen; + count = min_t(unsigned int, conn->mtu, len); + diff --git a/queue-3.9/bluetooth-fix-invalid-length-check-in-l2cap_information_rsp.patch b/queue-3.9/bluetooth-fix-invalid-length-check-in-l2cap_information_rsp.patch new file mode 100644 index 00000000000..124b46fed94 --- /dev/null +++ b/queue-3.9/bluetooth-fix-invalid-length-check-in-l2cap_information_rsp.patch @@ -0,0 +1,48 @@ +From 3f6fa3d489e127ca5a5b298eabac3ff5dbe0e112 Mon Sep 17 00:00:00 2001 +From: Jaganath Kanakkassery +Date: Fri, 21 Jun 2013 19:55:11 +0530 +Subject: Bluetooth: Fix invalid length check in l2cap_information_rsp() + +From: Jaganath Kanakkassery + +commit 3f6fa3d489e127ca5a5b298eabac3ff5dbe0e112 upstream. + +The length check is invalid since the length varies with type of +info response. + +This was introduced by the commit cb3b3152b2f5939d67005cff841a1ca748b19888 + +Because of this, l2cap info rsp is not handled and command reject is sent. + +> ACL data: handle 11 flags 0x02 dlen 16 + L2CAP(s): Info rsp: type 2 result 0 + Extended feature mask 0x00b8 + Enhanced Retransmission mode + Streaming mode + FCS Option + Fixed Channels +< ACL data: handle 11 flags 0x00 dlen 10 + L2CAP(s): Command rej: reason 0 + Command not understood + +Signed-off-by: Jaganath Kanakkassery +Signed-off-by: Chan-Yeol Park +Acked-by: Johan Hedberg +Signed-off-by: Gustavo Padovan +Signed-off-by: Greg Kroah-Hartman + +--- + net/bluetooth/l2cap_core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/bluetooth/l2cap_core.c ++++ b/net/bluetooth/l2cap_core.c +@@ -4224,7 +4224,7 @@ static inline int l2cap_information_rsp( + struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) data; + u16 type, result; + +- if (cmd_len != sizeof(*rsp)) ++ if (cmd_len < sizeof(*rsp)) + return -EPROTO; + + type = __le16_to_cpu(rsp->type); diff --git a/queue-3.9/dlci-acquire-rtnl_lock-before-calling-__dev_get_by_name.patch b/queue-3.9/dlci-acquire-rtnl_lock-before-calling-__dev_get_by_name.patch new file mode 100644 index 00000000000..c26f6439ed8 --- /dev/null +++ b/queue-3.9/dlci-acquire-rtnl_lock-before-calling-__dev_get_by_name.patch @@ -0,0 +1,60 @@ +From 11eb2645cbf38a08ae491bf6c602eea900ec0bb5 Mon Sep 17 00:00:00 2001 +From: Zefan Li +Date: Wed, 26 Jun 2013 15:29:54 +0800 +Subject: dlci: acquire rtnl_lock before calling __dev_get_by_name() + +From: Zefan Li + +commit 11eb2645cbf38a08ae491bf6c602eea900ec0bb5 upstream. + +Otherwise the net device returned can be freed at anytime. + +Signed-off-by: Li Zefan +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wan/dlci.c | 14 +++++++++----- + 1 file changed, 9 insertions(+), 5 deletions(-) + +--- a/drivers/net/wan/dlci.c ++++ b/drivers/net/wan/dlci.c +@@ -385,20 +385,24 @@ static int dlci_del(struct dlci_add *dlc + struct net_device *master, *slave; + int err; + ++ rtnl_lock(); ++ + /* validate slave device */ + master = __dev_get_by_name(&init_net, dlci->devname); +- if (!master) +- return -ENODEV; ++ if (!master) { ++ err = -ENODEV; ++ goto out; ++ } + + if (netif_running(master)) { +- return -EBUSY; ++ err = -EBUSY; ++ goto out; + } + + dlp = netdev_priv(master); + slave = dlp->slave; + flp = netdev_priv(slave); + +- rtnl_lock(); + err = (*flp->deassoc)(slave, master); + if (!err) { + list_del(&dlp->list); +@@ -407,8 +411,8 @@ static int dlci_del(struct dlci_add *dlc + + dev_put(slave); + } ++out: + rtnl_unlock(); +- + return err; + } + diff --git a/queue-3.9/dlci-validate-the-net-device-in-dlci_del.patch b/queue-3.9/dlci-validate-the-net-device-in-dlci_del.patch new file mode 100644 index 00000000000..e6aa1c11e01 --- /dev/null +++ b/queue-3.9/dlci-validate-the-net-device-in-dlci_del.patch @@ -0,0 +1,67 @@ +From 578a1310f2592ba90c5674bca21c1dbd1adf3f0a Mon Sep 17 00:00:00 2001 +From: Zefan Li +Date: Wed, 26 Jun 2013 15:31:58 +0800 +Subject: dlci: validate the net device in dlci_del() + +From: Zefan Li + +commit 578a1310f2592ba90c5674bca21c1dbd1adf3f0a upstream. + +We triggered an oops while running trinity with 3.4 kernel: + +BUG: unable to handle kernel paging request at 0000000100000d07 +IP: [] dlci_ioctl+0xd8/0x2d4 [dlci] +PGD 640c0d067 PUD 0 +Oops: 0000 [#1] PREEMPT SMP +CPU 3 +... +Pid: 7302, comm: trinity-child3 Not tainted 3.4.24.09+ 40 Huawei Technologies Co., Ltd. Tecal RH2285 /BC11BTSA +RIP: 0010:[] [] dlci_ioctl+0xd8/0x2d4 [dlci] +... +Call Trace: + [] sock_ioctl+0x153/0x280 + [] do_vfs_ioctl+0xa4/0x5e0 + [] ? fget_light+0x3ea/0x490 + [] sys_ioctl+0x4f/0x80 + [] system_call_fastpath+0x16/0x1b +... + +It's because the net device is not a dlci device. + +Reported-by: Li Jinyue +Signed-off-by: Li Zefan +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wan/dlci.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +--- a/drivers/net/wan/dlci.c ++++ b/drivers/net/wan/dlci.c +@@ -384,6 +384,7 @@ static int dlci_del(struct dlci_add *dlc + struct frad_local *flp; + struct net_device *master, *slave; + int err; ++ bool found = false; + + rtnl_lock(); + +@@ -393,6 +394,17 @@ static int dlci_del(struct dlci_add *dlc + err = -ENODEV; + goto out; + } ++ ++ list_for_each_entry(dlp, &dlci_devs, list) { ++ if (dlp->master == master) { ++ found = true; ++ break; ++ } ++ } ++ if (!found) { ++ err = -ENODEV; ++ goto out; ++ } + + if (netif_running(master)) { + err = -EBUSY; diff --git a/queue-3.9/hw_breakpoint-fix-cpu-check-in-task_bp_pinned-cpu.patch b/queue-3.9/hw_breakpoint-fix-cpu-check-in-task_bp_pinned-cpu.patch new file mode 100644 index 00000000000..ddbd978f708 --- /dev/null +++ b/queue-3.9/hw_breakpoint-fix-cpu-check-in-task_bp_pinned-cpu.patch @@ -0,0 +1,53 @@ +From 8b4d801b2b123b6c09742f861fe44a8527b84d47 Mon Sep 17 00:00:00 2001 +From: Oleg Nesterov +Date: Thu, 20 Jun 2013 17:50:06 +0200 +Subject: hw_breakpoint: Fix cpu check in task_bp_pinned(cpu) + +From: Oleg Nesterov + +commit 8b4d801b2b123b6c09742f861fe44a8527b84d47 upstream. + +trinity fuzzer triggered WARN_ONCE("Can't find any breakpoint +slot") in arch_install_hw_breakpoint() but the problem is not +arch-specific. + +The problem is, task_bp_pinned(cpu) checks "cpu == iter->cpu" +but this doesn't account the "all cpus" events with iter->cpu < +0. + +This means that, say, register_user_hw_breakpoint(tsk) can +happily create the arbitrary number > HBP_NUM of breakpoints +which can not be activated. toggle_bp_task_slot() is equally +wrong by the same reason and nr_task_bp_pinned[] can have +negative entries. + +Simple test: + + # perl -e 'sleep 1 while 1' & + # perf record -e mem:0x10,mem:0x10,mem:0x10,mem:0x10,mem:0x10 -p `pidof perl` + +Before this patch this triggers the same problem/WARN_ON(), +after the patch it correctly fails with -ENOSPC. + +Reported-by: Vince Weaver +Signed-off-by: Oleg Nesterov +Acked-by: Frederic Weisbecker +Link: http://lkml.kernel.org/r/20130620155006.GA6324@redhat.com +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/events/hw_breakpoint.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/kernel/events/hw_breakpoint.c ++++ b/kernel/events/hw_breakpoint.c +@@ -120,7 +120,7 @@ static int task_bp_pinned(int cpu, struc + list_for_each_entry(iter, &bp_task_head, hw.bp_list) { + if (iter->hw.bp_target == tsk && + find_slot_idx(iter) == type && +- cpu == iter->cpu) ++ (iter->cpu < 0 || cpu == iter->cpu)) + count += hw_breakpoint_weight(iter); + } + diff --git a/queue-3.9/hw_breakpoint-use-cpu_possible_mask-in-reserve-release-_bp_slot.patch b/queue-3.9/hw_breakpoint-use-cpu_possible_mask-in-reserve-release-_bp_slot.patch new file mode 100644 index 00000000000..f0982a02cd9 --- /dev/null +++ b/queue-3.9/hw_breakpoint-use-cpu_possible_mask-in-reserve-release-_bp_slot.patch @@ -0,0 +1,55 @@ +From c790b0ad23f427c7522ffed264706238c57c007e Mon Sep 17 00:00:00 2001 +From: Oleg Nesterov +Date: Thu, 20 Jun 2013 17:50:09 +0200 +Subject: hw_breakpoint: Use cpu_possible_mask in {reserve,release}_bp_slot() + +From: Oleg Nesterov + +commit c790b0ad23f427c7522ffed264706238c57c007e upstream. + +fetch_bp_busy_slots() and toggle_bp_slot() use +for_each_online_cpu(), this is obviously wrong wrt cpu_up() or +cpu_down(), we can over/under account the per-cpu numbers. + +For example: + + # echo 0 >> /sys/devices/system/cpu/cpu1/online + # perf record -e mem:0x10 -p 1 & + # echo 1 >> /sys/devices/system/cpu/cpu1/online + # perf record -e mem:0x10,mem:0x10,mem:0x10,mem:0x10 -C1 -a & + # taskset -p 0x2 1 + +triggers the same WARN_ONCE("Can't find any breakpoint slot") in +arch_install_hw_breakpoint(). + +Reported-by: Vince Weaver +Signed-off-by: Oleg Nesterov +Acked-by: Frederic Weisbecker +Link: http://lkml.kernel.org/r/20130620155009.GA6327@redhat.com +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/events/hw_breakpoint.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/kernel/events/hw_breakpoint.c ++++ b/kernel/events/hw_breakpoint.c +@@ -149,7 +149,7 @@ fetch_bp_busy_slots(struct bp_busy_slots + return; + } + +- for_each_online_cpu(cpu) { ++ for_each_possible_cpu(cpu) { + unsigned int nr; + + nr = per_cpu(nr_cpu_bp_pinned[type], cpu); +@@ -235,7 +235,7 @@ toggle_bp_slot(struct perf_event *bp, bo + if (cpu >= 0) { + toggle_bp_task_slot(bp, cpu, enable, type, weight); + } else { +- for_each_online_cpu(cpu) ++ for_each_possible_cpu(cpu) + toggle_bp_task_slot(bp, cpu, enable, type, weight); + } + diff --git a/queue-3.9/iwlwifi-dvm-fix-chain-noise-calibration.patch b/queue-3.9/iwlwifi-dvm-fix-chain-noise-calibration.patch new file mode 100644 index 00000000000..043870e4b53 --- /dev/null +++ b/queue-3.9/iwlwifi-dvm-fix-chain-noise-calibration.patch @@ -0,0 +1,36 @@ +From b28b6dfe580ab1ab8bf08b908fd69e299b877103 Mon Sep 17 00:00:00 2001 +From: Nikolay Martynov +Date: Fri, 31 May 2013 01:29:12 -0400 +Subject: iwlwifi: dvm: fix chain noise calibration + +From: Nikolay Martynov + +commit b28b6dfe580ab1ab8bf08b908fd69e299b877103 upstream. + +First step of chain noise calibration process had disable flag +check inverted. Chain noise calibration never started because +of this. + +Tested on intel 5300 with two antennas attached. The driver +correctly disabled one chain. + +Signed-off-by: Nikolay Martynov +Reviewed-by: Emmanuel Grumbach +Signed-off-by: Johannes Berg +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/iwlwifi/dvm/rxon.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/wireless/iwlwifi/dvm/rxon.c ++++ b/drivers/net/wireless/iwlwifi/dvm/rxon.c +@@ -1377,7 +1377,7 @@ static void iwlagn_chain_noise_reset(str + struct iwl_chain_noise_data *data = &priv->chain_noise_data; + int ret; + +- if (!(priv->calib_disabled & IWL_CHAIN_NOISE_CALIB_DISABLED)) ++ if (priv->calib_disabled & IWL_CHAIN_NOISE_CALIB_DISABLED) + return; + + if ((data->state == IWL_CHAIN_NOISE_ALIVE) && diff --git a/queue-3.9/net-tg3-avoid-delay-during-mmio-access.patch b/queue-3.9/net-tg3-avoid-delay-during-mmio-access.patch new file mode 100644 index 00000000000..b1bcbc124ce --- /dev/null +++ b/queue-3.9/net-tg3-avoid-delay-during-mmio-access.patch @@ -0,0 +1,121 @@ +From 6d446ec32f169c6a5d9bc90684a8082a6cbe90f6 Mon Sep 17 00:00:00 2001 +From: Gavin Shan +Date: Tue, 25 Jun 2013 15:24:32 +0800 +Subject: net/tg3: Avoid delay during MMIO access + +From: Gavin Shan + +commit 6d446ec32f169c6a5d9bc90684a8082a6cbe90f6 upstream. + +When the EEH error is the result of a fenced host bridge, MMIO accesses +can be very slow (milliseconds) to timeout and return all 1's, +thus causing the driver various timeout loops to take way too long and +trigger soft-lockup warnings (in addition to taking minutes to recover). + +It might be worthwhile to check if for any of these cases, ffffffff is +a valid possible value, and if not, bail early since that means the HW +is either gone or isolated. In the meantime, checking that the PCI channel +is offline would be workaround of the problem. + +Signed-off-by: Gavin Shan +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/ethernet/broadcom/tg3.c | 36 ++++++++++++++++++++++++++++++++++++ + 1 file changed, 36 insertions(+) + +--- a/drivers/net/ethernet/broadcom/tg3.c ++++ b/drivers/net/ethernet/broadcom/tg3.c +@@ -743,6 +743,9 @@ static int tg3_ape_lock(struct tg3 *tp, + status = tg3_ape_read32(tp, gnt + off); + if (status == bit) + break; ++ if (pci_channel_offline(tp->pdev)) ++ break; ++ + udelay(10); + } + +@@ -1634,6 +1637,9 @@ static void tg3_wait_for_event_ack(struc + for (i = 0; i < delay_cnt; i++) { + if (!(tr32(GRC_RX_CPU_EVENT) & GRC_RX_CPU_DRIVER_EVENT)) + break; ++ if (pci_channel_offline(tp->pdev)) ++ break; ++ + udelay(8); + } + } +@@ -1812,6 +1818,9 @@ static int tg3_poll_fw(struct tg3 *tp) + for (i = 0; i < 200; i++) { + if (tr32(VCPU_STATUS) & VCPU_STATUS_INIT_DONE) + return 0; ++ if (pci_channel_offline(tp->pdev)) ++ return -ENODEV; ++ + udelay(100); + } + return -ENODEV; +@@ -1822,6 +1831,15 @@ static int tg3_poll_fw(struct tg3 *tp) + tg3_read_mem(tp, NIC_SRAM_FIRMWARE_MBOX, &val); + if (val == ~NIC_SRAM_FIRMWARE_MBOX_MAGIC1) + break; ++ if (pci_channel_offline(tp->pdev)) { ++ if (!tg3_flag(tp, NO_FWARE_REPORTED)) { ++ tg3_flag_set(tp, NO_FWARE_REPORTED); ++ netdev_info(tp->dev, "No firmware running\n"); ++ } ++ ++ break; ++ } ++ + udelay(10); + } + +@@ -3411,6 +3429,8 @@ static int tg3_nvram_write_block_buffere + ret = tg3_nvram_exec_cmd(tp, nvram_cmd); + if (ret) + break; ++ if (pci_channel_offline(tp->pdev)) ++ return -EBUSY; + } + return ret; + } +@@ -8224,6 +8244,14 @@ static int tg3_stop_block(struct tg3 *tp + tw32_f(ofs, val); + + for (i = 0; i < MAX_WAIT_CNT; i++) { ++ if (pci_channel_offline(tp->pdev)) { ++ dev_err(&tp->pdev->dev, ++ "tg3_stop_block device offline, " ++ "ofs=%lx enable_bit=%x\n", ++ ofs, enable_bit); ++ return -ENODEV; ++ } ++ + udelay(100); + val = tr32(ofs); + if ((val & enable_bit) == 0) +@@ -8247,6 +8275,13 @@ static int tg3_abort_hw(struct tg3 *tp, + + tg3_disable_ints(tp); + ++ if (pci_channel_offline(tp->pdev)) { ++ tp->rx_mode &= ~(RX_MODE_ENABLE | TX_MODE_ENABLE); ++ tp->mac_mode &= ~MAC_MODE_TDE_ENABLE; ++ err = -ENODEV; ++ goto err_no_dev; ++ } ++ + tp->rx_mode &= ~RX_MODE_ENABLE; + tw32_f(MAC_RX_MODE, tp->rx_mode); + udelay(10); +@@ -8295,6 +8330,7 @@ static int tg3_abort_hw(struct tg3 *tp, + err |= tg3_stop_block(tp, BUFMGR_MODE, BUFMGR_MODE_ENABLE, silent); + err |= tg3_stop_block(tp, MEMARB_MODE, MEMARB_MODE_ENABLE, silent); + ++err_no_dev: + for (i = 0; i < tp->irq_cnt; i++) { + struct tg3_napi *tnapi = &tp->napi[i]; + if (tnapi->hw_status) diff --git a/queue-3.9/rt2800-fix-rt5390-rt3290-tx-power-settings-regression.patch b/queue-3.9/rt2800-fix-rt5390-rt3290-tx-power-settings-regression.patch new file mode 100644 index 00000000000..55af7fc4fe7 --- /dev/null +++ b/queue-3.9/rt2800-fix-rt5390-rt3290-tx-power-settings-regression.patch @@ -0,0 +1,74 @@ +From 8c8d2017ba25c510ddf093419048460db1109bc4 Mon Sep 17 00:00:00 2001 +From: Stanislaw Gruszka +Date: Tue, 11 Jun 2013 18:48:53 +0200 +Subject: rt2800: fix RT5390 & RT3290 TX power settings regression + +From: Stanislaw Gruszka + +commit 8c8d2017ba25c510ddf093419048460db1109bc4 upstream. + +My change: + +commit cee2c7315f60beeff6137ee59e99acc77d636eeb +Author: Stanislaw Gruszka +Date: Fri Oct 5 13:44:09 2012 +0200 + + rt2800: use BBP_R1 for setting tx power + +unfortunately does not work well with RT5390 and RT3290 chips as they +require different temperature compensation TX power settings (TSSI +tuning). Since that commit make wireless connection very unstable on +those chips, restore previous behavior to fix regression. Once we +implement proper TSSI tuning on 5390/3290 we can restore back setting +TX power by BBP_R1 register for those chips. + +Reported-and-tested-by: Mike Romberg +Signed-off-by: Stanislaw Gruszka +Acked-by: Gertjan van Wingerde +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/rt2x00/rt2800lib.c | 29 ++++++++++++++++++----------- + 1 file changed, 18 insertions(+), 11 deletions(-) + +--- a/drivers/net/wireless/rt2x00/rt2800lib.c ++++ b/drivers/net/wireless/rt2x00/rt2800lib.c +@@ -2634,19 +2634,26 @@ static void rt2800_config_txpower(struct + * TODO: we do not use +6 dBm option to do not increase power beyond + * regulatory limit, however this could be utilized for devices with + * CAPABILITY_POWER_LIMIT. ++ * ++ * TODO: add different temperature compensation code for RT3290 & RT5390 ++ * to allow to use BBP_R1 for those chips. + */ +- rt2800_bbp_read(rt2x00dev, 1, &r1); +- if (delta <= -12) { +- power_ctrl = 2; +- delta += 12; +- } else if (delta <= -6) { +- power_ctrl = 1; +- delta += 6; +- } else { +- power_ctrl = 0; ++ if (!rt2x00_rt(rt2x00dev, RT3290) && ++ !rt2x00_rt(rt2x00dev, RT5390)) { ++ rt2800_bbp_read(rt2x00dev, 1, &r1); ++ if (delta <= -12) { ++ power_ctrl = 2; ++ delta += 12; ++ } else if (delta <= -6) { ++ power_ctrl = 1; ++ delta += 6; ++ } else { ++ power_ctrl = 0; ++ } ++ rt2x00_set_field8(&r1, BBP1_TX_POWER_CTRL, power_ctrl); ++ rt2800_bbp_write(rt2x00dev, 1, r1); + } +- rt2x00_set_field8(&r1, BBP1_TX_POWER_CTRL, power_ctrl); +- rt2800_bbp_write(rt2x00dev, 1, r1); ++ + offset = TX_PWR_CFG_0; + + for (i = 0; i < EEPROM_TXPOWER_BYRATE_SIZE; i += 2) { diff --git a/queue-3.9/s390-irq-only-define-synchronize_irq-on-smp.patch b/queue-3.9/s390-irq-only-define-synchronize_irq-on-smp.patch new file mode 100644 index 00000000000..491477f0924 --- /dev/null +++ b/queue-3.9/s390-irq-only-define-synchronize_irq-on-smp.patch @@ -0,0 +1,41 @@ +From 690cec8e70c211d1f5f6e520b21a68d0306173b6 Mon Sep 17 00:00:00 2001 +From: Ben Hutchings +Date: Fri, 14 Jun 2013 01:18:44 +0100 +Subject: s390/irq: Only define synchronize_irq() on SMP + +From: Ben Hutchings + +commit 690cec8e70c211d1f5f6e520b21a68d0306173b6 upstream. + +In uniprocessor configurations, synchronize_irq() is defined in + as a macro, and this function definition fails to +compile. + +Reported-by: kbuild test robot +Signed-off-by: Ben Hutchings +Signed-off-by: Heiko Carstens +Signed-off-by: Martin Schwidefsky +Signed-off-by: Greg Kroah-Hartman + +--- + arch/s390/kernel/irq.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/arch/s390/kernel/irq.c ++++ b/arch/s390/kernel/irq.c +@@ -314,6 +314,7 @@ void measurement_alert_subclass_unregist + } + EXPORT_SYMBOL(measurement_alert_subclass_unregister); + ++#ifdef CONFIG_SMP + void synchronize_irq(unsigned int irq) + { + /* +@@ -322,6 +323,7 @@ void synchronize_irq(unsigned int irq) + */ + } + EXPORT_SYMBOL_GPL(synchronize_irq); ++#endif + + #ifndef CONFIG_PCI + diff --git a/queue-3.9/s390-pci-implement-irq-functions-if-pci.patch b/queue-3.9/s390-pci-implement-irq-functions-if-pci.patch new file mode 100644 index 00000000000..06946320cc7 --- /dev/null +++ b/queue-3.9/s390-pci-implement-irq-functions-if-pci.patch @@ -0,0 +1,143 @@ +From c46b54f7406780ec4cf9c9124d1cfb777674dc70 Mon Sep 17 00:00:00 2001 +From: Ben Hutchings +Date: Mon, 10 Jun 2013 15:34:04 +0200 +Subject: s390/pci: Implement IRQ functions if !PCI + +From: Ben Hutchings + +commit c46b54f7406780ec4cf9c9124d1cfb777674dc70 upstream. + +All architectures must implement IRQ functions. Since various +dependencies on !S390 were removed, there are various drivers that can +be selected but will fail to link. Provide a dummy implementation of +these functions for the !PCI case. + +Signed-off-by: Ben Hutchings +Acked-by: David S. Miller +Signed-off-by: Martin Schwidefsky +Signed-off-by: Greg Kroah-Hartman + +--- + arch/s390/kernel/irq.c | 64 +++++++++++++++++++++++++++++++++++++++++++++++++ + arch/s390/pci/pci.c | 33 ------------------------- + 2 files changed, 64 insertions(+), 33 deletions(-) + +--- a/arch/s390/kernel/irq.c ++++ b/arch/s390/kernel/irq.c +@@ -313,3 +313,67 @@ void measurement_alert_subclass_unregist + spin_unlock(&ma_subclass_lock); + } + EXPORT_SYMBOL(measurement_alert_subclass_unregister); ++ ++void synchronize_irq(unsigned int irq) ++{ ++ /* ++ * Not needed, the handler is protected by a lock and IRQs that occur ++ * after the handler is deleted are just NOPs. ++ */ ++} ++EXPORT_SYMBOL_GPL(synchronize_irq); ++ ++#ifndef CONFIG_PCI ++ ++/* Only PCI devices have dynamically-defined IRQ handlers */ ++ ++int request_irq(unsigned int irq, irq_handler_t handler, ++ unsigned long irqflags, const char *devname, void *dev_id) ++{ ++ return -EINVAL; ++} ++EXPORT_SYMBOL_GPL(request_irq); ++ ++void free_irq(unsigned int irq, void *dev_id) ++{ ++ WARN_ON(1); ++} ++EXPORT_SYMBOL_GPL(free_irq); ++ ++void enable_irq(unsigned int irq) ++{ ++ WARN_ON(1); ++} ++EXPORT_SYMBOL_GPL(enable_irq); ++ ++void disable_irq(unsigned int irq) ++{ ++ WARN_ON(1); ++} ++EXPORT_SYMBOL_GPL(disable_irq); ++ ++#endif /* !CONFIG_PCI */ ++ ++void disable_irq_nosync(unsigned int irq) ++{ ++ disable_irq(irq); ++} ++EXPORT_SYMBOL_GPL(disable_irq_nosync); ++ ++unsigned long probe_irq_on(void) ++{ ++ return 0; ++} ++EXPORT_SYMBOL_GPL(probe_irq_on); ++ ++int probe_irq_off(unsigned long val) ++{ ++ return 0; ++} ++EXPORT_SYMBOL_GPL(probe_irq_off); ++ ++unsigned int probe_irq_mask(unsigned long val) ++{ ++ return val; ++} ++EXPORT_SYMBOL_GPL(probe_irq_mask); +--- a/arch/s390/pci/pci.c ++++ b/arch/s390/pci/pci.c +@@ -306,15 +306,6 @@ static int zpci_cfg_store(struct zpci_de + return rc; + } + +-void synchronize_irq(unsigned int irq) +-{ +- /* +- * Not needed, the handler is protected by a lock and IRQs that occur +- * after the handler is deleted are just NOPs. +- */ +-} +-EXPORT_SYMBOL_GPL(synchronize_irq); +- + void enable_irq(unsigned int irq) + { + struct msi_desc *msi = irq_get_msi_desc(irq); +@@ -331,30 +322,6 @@ void disable_irq(unsigned int irq) + } + EXPORT_SYMBOL_GPL(disable_irq); + +-void disable_irq_nosync(unsigned int irq) +-{ +- disable_irq(irq); +-} +-EXPORT_SYMBOL_GPL(disable_irq_nosync); +- +-unsigned long probe_irq_on(void) +-{ +- return 0; +-} +-EXPORT_SYMBOL_GPL(probe_irq_on); +- +-int probe_irq_off(unsigned long val) +-{ +- return 0; +-} +-EXPORT_SYMBOL_GPL(probe_irq_off); +- +-unsigned int probe_irq_mask(unsigned long val) +-{ +- return val; +-} +-EXPORT_SYMBOL_GPL(probe_irq_mask); +- + void pcibios_fixup_bus(struct pci_bus *bus) + { + } diff --git a/queue-3.9/series b/queue-3.9/series index f7cbec1fa17..a343e436003 100644 --- a/queue-3.9/series +++ b/queue-3.9/series @@ -2,3 +2,15 @@ s390-ipl-fix-fcp-wwpn-and-lun-format-strings-for-read.patch arm-7762-1-kernel-fix-arm_dt_init_cpu_maps-to-skip-non-cpu-nodes.patch arm-7755-1-handle-user-space-mapped-pages-in-flush_kernel_dcache_page.patch arm-7772-1-fix-missing-flush_kernel_dcache_page-for-nommu.patch +bluetooth-fix-crash-in-l2cap_build_cmd-with-small-mtu.patch +bluetooth-fix-invalid-length-check-in-l2cap_information_rsp.patch +hw_breakpoint-fix-cpu-check-in-task_bp_pinned-cpu.patch +hw_breakpoint-use-cpu_possible_mask-in-reserve-release-_bp_slot.patch +ath9k_htc-handle-idle-state-transition-properly.patch +iwlwifi-dvm-fix-chain-noise-calibration.patch +s390-pci-implement-irq-functions-if-pci.patch +s390-irq-only-define-synchronize_irq-on-smp.patch +dlci-acquire-rtnl_lock-before-calling-__dev_get_by_name.patch +dlci-validate-the-net-device-in-dlci_del.patch +net-tg3-avoid-delay-during-mmio-access.patch +rt2800-fix-rt5390-rt3290-tx-power-settings-regression.patch