From: Greg Kroah-Hartman Date: Sun, 26 May 2013 00:05:23 +0000 (+0900) Subject: 3.9-stable patches X-Git-Tag: v3.0.81~34 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=3367d2840a152583832666c9f958c95be455ea9b;p=thirdparty%2Fkernel%2Fstable-queue.git 3.9-stable patches added patches: arc-copy_-to-from-_user-to-honor-usermode-access-permissions.patch arm-7723-1-crypto-sha1-armv4-large.s-fix-sp-handling.patch arm-am33xx-add-missing-.clkdm_name-to-clkdiv32k_ick-clock.patch arm-at91-dt-fix-macb-pinctrl_macb_rmii_mii_alt-definition.patch arm-at91-rm9200-fix-time-support.patch arm-at91-trivial-fix-model-name-for-sam9x25-ek.patch arm-omap-fix-__init-section-mismatch-for-_enable_preprogram.patch arm-plat-orion-fix-num_resources-and-id-for-ge10-and-ge11.patch cfg80211-fix-sending-wowlan-tcp-wakeup-settings.patch cfg80211-fix-wiphy_register-error-path.patch cfg80211-fix-wowlan-wakeup-tracing.patch cifs-only-set-ops-for-inodes-in-i_new-state.patch drivers-char-random.c-fix-priming-of-last_data.patch drivers-hv-fix-a-bug-in-get_vp_index.patch fat-fix-possible-overflow-for-fat_clusters.patch input-egalax_ts-abs_mt_position_y-not-reported-well.patch iwlwifi-mvm-always-use-scan_type_forced.patch iwlwifi-mvm-prevent-setting-assoc-flag-in-mac_context_cmd.patch mac80211-fix-ap-mode-frame-matching.patch mac80211-use-just-spin_lock-in-ieee80211_get_tkip_p2k.patch random-fix-accounting-race-condition-with-lockless-irq-entropy_count-update.patch staging-vt6656-fix-missing-spin-lock-in-iwctl_siwpower.patch staging-vt6656-use-free_netdev-instead-of-kfree.patch tty-fix-tty-miss-restart-after-we-turn-off-flow-control.patch usb-blacklisted-cinterion-s-plxx-wwan-interface.patch usb-chipidea-fix-link-error-when-usb_ehci_hcd-is-a-module.patch usb-cxacru-potential-underflow-in-cxacru_cm_get_array.patch usb-ftdi_sio-add-support-for-newport-conex-motor-drivers.patch usb-option-add-device-ids-for-dell-5804-novatel-e371-wwan-card.patch usb-option-add-telewell-tw-lte-4g.patch usb-reset-resume-quirk-needed-by-a-hub.patch usb-uhci-fix-for-suspend-of-virtual-hp-controller.patch usb-xhci-override-bogus-bulk-wmaxpacketsize-values.patch --- diff --git a/queue-3.9/arc-copy_-to-from-_user-to-honor-usermode-access-permissions.patch b/queue-3.9/arc-copy_-to-from-_user-to-honor-usermode-access-permissions.patch new file mode 100644 index 00000000000..31f167e2e57 --- /dev/null +++ b/queue-3.9/arc-copy_-to-from-_user-to-honor-usermode-access-permissions.patch @@ -0,0 +1,178 @@ +From a950549c675f2c8c504469dec7d780da8a6433dc Mon Sep 17 00:00:00 2001 +From: Vineet Gupta +Date: Tue, 21 May 2013 15:25:11 +0530 +Subject: ARC: copy_(to|from)_user() to honor usermode-access permissions + +From: Vineet Gupta + +commit a950549c675f2c8c504469dec7d780da8a6433dc upstream. + +This manifested as grep failing psuedo-randomly: + +-------------->8--------------------- +[ARCLinux]$ ip address show lo | grep inet +[ARCLinux]$ ip address show lo | grep inet +[ARCLinux]$ ip address show lo | grep inet +[ARCLinux]$ +[ARCLinux]$ ip address show lo | grep inet + inet 127.0.0.1/8 scope host lo +-------------->8--------------------- + +ARC700 MMU provides fully orthogonal permission bits per page: +Ur, Uw, Ux, Kr, Kw, Kx + +The user mode page permission templates used to have all Kernel mode +access bits enabled. +This caused a tricky race condition observed with uClibc buffered file +read and UNIX pipes. + +1. Read access to an anon mapped page in libc .bss: write-protected + zero_page mapped: TLB Entry installed with Ur + K[rwx] + +2. grep calls libc:getc() -> buffered read layer calls read(2) with the + internal read buffer in same .bss page. + The read() call is on STDIN which has been redirected to a pipe. + read(2) => sys_read() => pipe_read() => copy_to_user() + +3. Since page has Kernel-write permission (despite being user-mode + write-protected), copy_to_user() suceeds w/o taking a MMU TLB-Miss + Exception (page-fault for ARC). core-MM is unaware that kernel + erroneously wrote to the reserved read-only zero-page (BUG #1) + +4. Control returns to userspace which now does a write to same .bss page + Since Linux MM is not aware that page has been modified by kernel, it + simply reassigns a new writable zero-init page to mapping, loosing the + prior write by kernel - effectively zero'ing out the libc read buffer + under the hood - hence grep doesn't see right data (BUG #2) + +The fix is to make all kernel-mode access permissions mirror the +user-mode ones. Note that the kernel still has full access to pages, +when accessed directly (w/o MMU) - this fix ensures that kernel-mode +access in copy_to_from() path uses the same faulting access model as for +pure user accesses to keep MM fully aware of page state. + +The issue is peudo-random because it only shows up if the TLB entry +installed in #1 is present at the time of #3. If it is evicted out, due +to TLB pressure or some-such, then copy_to_user() does take a TLB Miss +Exception, with a routine write-to-anon COW processing installing a +fresh page for kernel writes and also usable as it is in userspace. + +Further the issue was dormant for so long as it depends on where the +libc internal read buffer (in .bss) is mapped at runtime. +If it happens to reside in file-backed data mapping of libc (in the +page-aligned slack space trailing the file backed data), loader zero +padding the slack space, does the early cow page replacement, setting +things up at the very beginning itself. + +With gcc 4.8 based builds, the libc buffer got pushed out to a real +anon mapping which triggers the issue. + +Reported-by: Anton Kolesov +Signed-off-by: Vineet Gupta +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arc/include/asm/pgtable.h | 26 +++++++++++++++----------- + arch/arc/include/asm/tlb.h | 2 +- + arch/arc/mm/tlbex.S | 6 +++--- + 3 files changed, 19 insertions(+), 15 deletions(-) + +--- a/arch/arc/include/asm/pgtable.h ++++ b/arch/arc/include/asm/pgtable.h +@@ -57,9 +57,9 @@ + + #define _PAGE_ACCESSED (1<<1) /* Page is accessed (S) */ + #define _PAGE_CACHEABLE (1<<2) /* Page is cached (H) */ +-#define _PAGE_EXECUTE (1<<3) /* Page has user execute perm (H) */ +-#define _PAGE_WRITE (1<<4) /* Page has user write perm (H) */ +-#define _PAGE_READ (1<<5) /* Page has user read perm (H) */ ++#define _PAGE_U_EXECUTE (1<<3) /* Page has user execute perm (H) */ ++#define _PAGE_U_WRITE (1<<4) /* Page has user write perm (H) */ ++#define _PAGE_U_READ (1<<5) /* Page has user read perm (H) */ + #define _PAGE_K_EXECUTE (1<<6) /* Page has kernel execute perm (H) */ + #define _PAGE_K_WRITE (1<<7) /* Page has kernel write perm (H) */ + #define _PAGE_K_READ (1<<8) /* Page has kernel perm (H) */ +@@ -72,9 +72,9 @@ + + /* PD1 */ + #define _PAGE_CACHEABLE (1<<0) /* Page is cached (H) */ +-#define _PAGE_EXECUTE (1<<1) /* Page has user execute perm (H) */ +-#define _PAGE_WRITE (1<<2) /* Page has user write perm (H) */ +-#define _PAGE_READ (1<<3) /* Page has user read perm (H) */ ++#define _PAGE_U_EXECUTE (1<<1) /* Page has user execute perm (H) */ ++#define _PAGE_U_WRITE (1<<2) /* Page has user write perm (H) */ ++#define _PAGE_U_READ (1<<3) /* Page has user read perm (H) */ + #define _PAGE_K_EXECUTE (1<<4) /* Page has kernel execute perm (H) */ + #define _PAGE_K_WRITE (1<<5) /* Page has kernel write perm (H) */ + #define _PAGE_K_READ (1<<6) /* Page has kernel perm (H) */ +@@ -93,7 +93,8 @@ + #endif + + /* Kernel allowed all permissions for all pages */ +-#define _K_PAGE_PERMS (_PAGE_K_EXECUTE | _PAGE_K_WRITE | _PAGE_K_READ) ++#define _K_PAGE_PERMS (_PAGE_K_EXECUTE | _PAGE_K_WRITE | _PAGE_K_READ | \ ++ _PAGE_GLOBAL | _PAGE_PRESENT) + + #ifdef CONFIG_ARC_CACHE_PAGES + #define _PAGE_DEF_CACHEABLE _PAGE_CACHEABLE +@@ -106,7 +107,11 @@ + * -by default cached, unless config otherwise + * -present in memory + */ +-#define ___DEF (_PAGE_PRESENT | _K_PAGE_PERMS | _PAGE_DEF_CACHEABLE) ++#define ___DEF (_PAGE_PRESENT | _PAGE_DEF_CACHEABLE) ++ ++#define _PAGE_READ (_PAGE_U_READ | _PAGE_K_READ) ++#define _PAGE_WRITE (_PAGE_U_WRITE | _PAGE_K_WRITE) ++#define _PAGE_EXECUTE (_PAGE_U_EXECUTE | _PAGE_K_EXECUTE) + + /* Set of bits not changed in pte_modify */ + #define _PAGE_CHG_MASK (PAGE_MASK | _PAGE_ACCESSED | _PAGE_MODIFIED) +@@ -125,11 +130,10 @@ + * kernel vaddr space - visible in all addr spaces, but kernel mode only + * Thus Global, all-kernel-access, no-user-access, cached + */ +-#define PAGE_KERNEL __pgprot(___DEF | _PAGE_GLOBAL) ++#define PAGE_KERNEL __pgprot(_K_PAGE_PERMS | _PAGE_DEF_CACHEABLE) + + /* ioremap */ +-#define PAGE_KERNEL_NO_CACHE __pgprot(_PAGE_PRESENT | _K_PAGE_PERMS | \ +- _PAGE_GLOBAL) ++#define PAGE_KERNEL_NO_CACHE __pgprot(_K_PAGE_PERMS) + + /************************************************************************** + * Mapping of vm_flags (Generic VM) to PTE flags (arch specific) +--- a/arch/arc/include/asm/tlb.h ++++ b/arch/arc/include/asm/tlb.h +@@ -16,7 +16,7 @@ + /* Masks for actual TLB "PD"s */ + #define PTE_BITS_IN_PD0 (_PAGE_GLOBAL | _PAGE_PRESENT) + #define PTE_BITS_IN_PD1 (PAGE_MASK | _PAGE_CACHEABLE | \ +- _PAGE_EXECUTE | _PAGE_WRITE | _PAGE_READ | \ ++ _PAGE_U_EXECUTE | _PAGE_U_WRITE | _PAGE_U_READ | \ + _PAGE_K_EXECUTE | _PAGE_K_WRITE | _PAGE_K_READ) + + #ifndef __ASSEMBLY__ +--- a/arch/arc/mm/tlbex.S ++++ b/arch/arc/mm/tlbex.S +@@ -277,7 +277,7 @@ ARC_ENTRY EV_TLBMissI + ;---------------------------------------------------------------- + ; VERIFY_PTE: Check if PTE permissions approp for executing code + cmp_s r2, VMALLOC_START +- mov.lo r2, (_PAGE_PRESENT | _PAGE_READ | _PAGE_EXECUTE) ++ mov.lo r2, (_PAGE_PRESENT | _PAGE_U_READ | _PAGE_U_EXECUTE) + mov.hs r2, (_PAGE_PRESENT | _PAGE_K_READ | _PAGE_K_EXECUTE) + + and r3, r0, r2 ; Mask out NON Flag bits from PTE +@@ -320,9 +320,9 @@ ARC_ENTRY EV_TLBMissD + mov_s r2, 0 + lr r3, [ecr] + btst_s r3, ECR_C_BIT_DTLB_LD_MISS ; Read Access +- or.nz r2, r2, _PAGE_READ ; chk for Read flag in PTE ++ or.nz r2, r2, _PAGE_U_READ ; chk for Read flag in PTE + btst_s r3, ECR_C_BIT_DTLB_ST_MISS ; Write Access +- or.nz r2, r2, _PAGE_WRITE ; chk for Write flag in PTE ++ or.nz r2, r2, _PAGE_U_WRITE ; chk for Write flag in PTE + ; Above laddering takes care of XCHG access + ; which is both Read and Write + diff --git a/queue-3.9/arm-7723-1-crypto-sha1-armv4-large.s-fix-sp-handling.patch b/queue-3.9/arm-7723-1-crypto-sha1-armv4-large.s-fix-sp-handling.patch new file mode 100644 index 00000000000..3df6367188e --- /dev/null +++ b/queue-3.9/arm-7723-1-crypto-sha1-armv4-large.s-fix-sp-handling.patch @@ -0,0 +1,42 @@ +From 934fc24df10abfd5aff533d0d044a17669d77d79 Mon Sep 17 00:00:00 2001 +From: Ard Biesheuvel +Date: Wed, 15 May 2013 10:46:30 +0100 +Subject: ARM: 7723/1: crypto: sha1-armv4-large.S: fix SP handling + +From: Ard Biesheuvel + +commit 934fc24df10abfd5aff533d0d044a17669d77d79 upstream. + +Make the SHA1 asm code ABI conformant by making sure all stack +accesses occur above the stack pointer. + +Origin: +http://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=1a9d60d2 + +Signed-off-by: Ard Biesheuvel +Acked-by: Nicolas Pitre +Signed-off-by: Russell King +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/crypto/sha1-armv4-large.S | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/arm/crypto/sha1-armv4-large.S ++++ b/arch/arm/crypto/sha1-armv4-large.S +@@ -195,6 +195,7 @@ ENTRY(sha1_block_data_order) + add r3,r3,r10 @ E+=F_00_19(B,C,D) + cmp r14,sp + bne .L_00_15 @ [((11+4)*5+2)*3] ++ sub sp,sp,#25*4 + #if __ARM_ARCH__<7 + ldrb r10,[r1,#2] + ldrb r9,[r1,#3] +@@ -290,7 +291,6 @@ ENTRY(sha1_block_data_order) + add r3,r3,r10 @ E+=F_00_19(B,C,D) + + ldr r8,.LK_20_39 @ [+15+16*4] +- sub sp,sp,#25*4 + cmn sp,#0 @ [+3], clear carry to denote 20_39 + .L_20_39_or_60_79: + ldr r9,[r14,#15*4] diff --git a/queue-3.9/arm-am33xx-add-missing-.clkdm_name-to-clkdiv32k_ick-clock.patch b/queue-3.9/arm-am33xx-add-missing-.clkdm_name-to-clkdiv32k_ick-clock.patch new file mode 100644 index 00000000000..01903c45677 --- /dev/null +++ b/queue-3.9/arm-am33xx-add-missing-.clkdm_name-to-clkdiv32k_ick-clock.patch @@ -0,0 +1,76 @@ +From a6d25f4c951b8b28f2eaec6f891ff834622532f2 Mon Sep 17 00:00:00 2001 +From: Vaibhav Hiremath +Date: Wed, 27 Mar 2013 15:34:26 +0530 +Subject: ARM: AM33XX: Add missing .clkdm_name to clkdiv32k_ick clock + +From: Vaibhav Hiremath + +commit a6d25f4c951b8b28f2eaec6f891ff834622532f2 upstream. + +It is required to enable respective clock-domain before +enabling any clock/module inside that clock-domain. + +During common-clock migration, .clkdm_name field got missed +for "clkdiv32k_ick" clock, which leaves "clk_24mhz_clkdm" +unused; so it will be disabled even if childs of this clock-domain +is enabled, which keeps child modules in idle mode. + +This fixes the kernel crash observed on AM335xEVM-SK platform, +where clkdiv32_ick clock is being used as a gpio debounce clock +and since clkdiv32k_ick is in idle mode it leads to below crash - + +Crash Log: +========== +[ 2.598347] Unhandled fault: external abort on non-linefetch (0x1028) at +0xfa1ac150 +[ 2.606434] Internal error: : 1028 [#1] SMP ARM +[ 2.611207] Modules linked in: +[ 2.614449] CPU: 0 Not tainted (3.8.4-01382-g1f449cd-dirty #4) +[ 2.620973] PC is at _set_gpio_debounce+0x60/0x104 +[ 2.626025] LR is at clk_enable+0x30/0x3c + +Signed-off-by: Vaibhav Hiremath +Cc: Rajendra Nayak +Acked-by: Paul Walmsley +Signed-off-by: Tony Lindgren +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/mach-omap2/cclock33xx_data.c | 26 +++++++++++++++++++++++--- + 1 file changed, 23 insertions(+), 3 deletions(-) + +--- a/arch/arm/mach-omap2/cclock33xx_data.c ++++ b/arch/arm/mach-omap2/cclock33xx_data.c +@@ -446,9 +446,29 @@ DEFINE_CLK_GATE(cefuse_fck, "sys_clkin_c + */ + DEFINE_CLK_FIXED_FACTOR(clkdiv32k_ck, "clk_24mhz", &clk_24mhz, 0x0, 1, 732); + +-DEFINE_CLK_GATE(clkdiv32k_ick, "clkdiv32k_ck", &clkdiv32k_ck, 0x0, +- AM33XX_CM_PER_CLKDIV32K_CLKCTRL, AM33XX_MODULEMODE_SWCTRL_SHIFT, +- 0x0, NULL); ++static struct clk clkdiv32k_ick; ++ ++static const char *clkdiv32k_ick_parent_names[] = { ++ "clkdiv32k_ck", ++}; ++ ++static const struct clk_ops clkdiv32k_ick_ops = { ++ .enable = &omap2_dflt_clk_enable, ++ .disable = &omap2_dflt_clk_disable, ++ .is_enabled = &omap2_dflt_clk_is_enabled, ++ .init = &omap2_init_clk_clkdm, ++}; ++ ++static struct clk_hw_omap clkdiv32k_ick_hw = { ++ .hw = { ++ .clk = &clkdiv32k_ick, ++ }, ++ .enable_reg = AM33XX_CM_PER_CLKDIV32K_CLKCTRL, ++ .enable_bit = AM33XX_MODULEMODE_SWCTRL_SHIFT, ++ .clkdm_name = "clk_24mhz_clkdm", ++}; ++ ++DEFINE_STRUCT_CLK(clkdiv32k_ick, clkdiv32k_ick_parent_names, clkdiv32k_ick_ops); + + /* "usbotg_fck" is an additional clock and not really a modulemode */ + DEFINE_CLK_GATE(usbotg_fck, "dpll_per_ck", &dpll_per_ck, 0x0, diff --git a/queue-3.9/arm-at91-dt-fix-macb-pinctrl_macb_rmii_mii_alt-definition.patch b/queue-3.9/arm-at91-dt-fix-macb-pinctrl_macb_rmii_mii_alt-definition.patch new file mode 100644 index 00000000000..2ee0a076d5c --- /dev/null +++ b/queue-3.9/arm-at91-dt-fix-macb-pinctrl_macb_rmii_mii_alt-definition.patch @@ -0,0 +1,32 @@ +From f6d35d67d0a5c159f767a20f4fcc1d295a7314b1 Mon Sep 17 00:00:00 2001 +From: Boris BREZILLON +Date: Thu, 23 May 2013 18:01:21 +0200 +Subject: ARM: at91/dt: fix macb pinctrl_macb_rmii_mii_alt definition + +From: Boris BREZILLON + +commit f6d35d67d0a5c159f767a20f4fcc1d295a7314b1 upstream. + +The PA24 pin is wrongly assigned to peripheral B. +In the current config there is 2 ETX3 pins (PA11 and PA24) and +no ETXER pin (PA22). + +Signed-off-by: Boris BREZILLON +Signed-off-by: Nicolas Ferre +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/boot/dts/at91sam9260.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/arm/boot/dts/at91sam9260.dtsi ++++ b/arch/arm/boot/dts/at91sam9260.dtsi +@@ -264,7 +264,7 @@ + atmel,pins = + <0 10 0x2 0x0 /* PA10 periph B */ + 0 11 0x2 0x0 /* PA11 periph B */ +- 0 24 0x2 0x0 /* PA24 periph B */ ++ 0 22 0x2 0x0 /* PA22 periph B */ + 0 25 0x2 0x0 /* PA25 periph B */ + 0 26 0x2 0x0 /* PA26 periph B */ + 0 27 0x2 0x0 /* PA27 periph B */ diff --git a/queue-3.9/arm-at91-rm9200-fix-time-support.patch b/queue-3.9/arm-at91-rm9200-fix-time-support.patch new file mode 100644 index 00000000000..a58b2f3e6b1 --- /dev/null +++ b/queue-3.9/arm-at91-rm9200-fix-time-support.patch @@ -0,0 +1,51 @@ +From b7a8ca5173ef9aa55fa039d7c216426ff0b25a12 Mon Sep 17 00:00:00 2001 +From: Jean-Christophe PLAGNIOL-VILLARD +Date: Wed, 15 May 2013 12:12:33 +0200 +Subject: ARM: at91: rm9200 fix time support + +From: Jean-Christophe PLAGNIOL-VILLARD + +commit b7a8ca5173ef9aa55fa039d7c216426ff0b25a12 upstream. + +since commit 838a2ae80a6ab52139fb1bf0a93ea8c5eff94488 +Author: Shawn Guo +Date: Sat Jan 12 11:50:05 2013 +0000 + +ARM: use clockevents_config_and_register() where possible + +The timer is wrongly configured and result in a nice crash +so revert it on rm9200 timer. + +Signed-off-by: Jean-Christophe PLAGNIOL-VILLARD +Cc: Shawn Guo +Signed-off-by: Nicolas Ferre +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/mach-at91/at91rm9200_time.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/arch/arm/mach-at91/at91rm9200_time.c ++++ b/arch/arm/mach-at91/at91rm9200_time.c +@@ -174,6 +174,7 @@ clkevt32k_next_event(unsigned long delta + static struct clock_event_device clkevt = { + .name = "at91_tick", + .features = CLOCK_EVT_FEAT_PERIODIC | CLOCK_EVT_FEAT_ONESHOT, ++ .shift = 32, + .rating = 150, + .set_next_event = clkevt32k_next_event, + .set_mode = clkevt32k_mode, +@@ -264,9 +265,11 @@ void __init at91rm9200_timer_init(void) + at91_st_write(AT91_ST_RTMR, 1); + + /* Setup timer clockevent, with minimum of two ticks (important!!) */ ++ clkevt.mult = div_sc(AT91_SLOW_CLOCK, NSEC_PER_SEC, clkevt.shift); ++ clkevt.max_delta_ns = clockevent_delta2ns(AT91_ST_ALMV, &clkevt); ++ clkevt.min_delta_ns = clockevent_delta2ns(2, &clkevt) + 1; + clkevt.cpumask = cpumask_of(0); +- clockevents_config_and_register(&clkevt, AT91_SLOW_CLOCK, +- 2, AT91_ST_ALMV); ++ clockevents_register_device(&clkevt); + + /* register clocksource */ + clocksource_register_hz(&clk32k, AT91_SLOW_CLOCK); diff --git a/queue-3.9/arm-at91-trivial-fix-model-name-for-sam9x25-ek.patch b/queue-3.9/arm-at91-trivial-fix-model-name-for-sam9x25-ek.patch new file mode 100644 index 00000000000..1951db5d4b1 --- /dev/null +++ b/queue-3.9/arm-at91-trivial-fix-model-name-for-sam9x25-ek.patch @@ -0,0 +1,27 @@ +From 9349d00fc3ff2b110dc07d9f5d06abfeac300c19 Mon Sep 17 00:00:00 2001 +From: Jean-Christophe PLAGNIOL-VILLARD +Date: Tue, 7 May 2013 22:06:57 +0200 +Subject: ARM: at91/trivial: fix model name for SAM9X25-EK + +From: Jean-Christophe PLAGNIOL-VILLARD + +commit 9349d00fc3ff2b110dc07d9f5d06abfeac300c19 upstream. + +Signed-off-by: Jean-Christophe PLAGNIOL-VILLARD +Signed-off-by: Nicolas Ferre +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/boot/dts/at91sam9x25ek.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/arm/boot/dts/at91sam9x25ek.dts ++++ b/arch/arm/boot/dts/at91sam9x25ek.dts +@@ -11,6 +11,6 @@ + /include/ "at91sam9x5ek.dtsi" + + / { +- model = "Atmel AT91SAM9G25-EK"; ++ model = "Atmel AT91SAM9X25-EK"; + compatible = "atmel,at91sam9x25ek", "atmel,at91sam9x5ek", "atmel,at91sam9x5", "atmel,at91sam9"; + }; diff --git a/queue-3.9/arm-omap-fix-__init-section-mismatch-for-_enable_preprogram.patch b/queue-3.9/arm-omap-fix-__init-section-mismatch-for-_enable_preprogram.patch new file mode 100644 index 00000000000..bced2059bf1 --- /dev/null +++ b/queue-3.9/arm-omap-fix-__init-section-mismatch-for-_enable_preprogram.patch @@ -0,0 +1,88 @@ +From 0f497039276fa2ca2ca324236848bb15c8c775dc Mon Sep 17 00:00:00 2001 +From: jean-philippe francois +Date: Thu, 16 May 2013 11:25:07 -0700 +Subject: ARM: OMAP: fix __init section mismatch for _enable_preprogram + +From: jean-philippe francois + +commit 0f497039276fa2ca2ca324236848bb15c8c775dc upstream. + +_enable_preprogram is marked as __init, but is called from _enable +which is not. Without this patch, the board oopses after init. Tested +on custom hardware and on beagle board xM. Otherwise we can get: + +Unable to handle kernel paging request at virtual address 000b0012 +pgd = cf968000 +*pgd=8fb06831, *pte=00000000, *ppte=00000000 +PREEMPT ARM +Modules linked in: +CPU: 0 Not tainted (3.9.0 #2) +PC is at _enable_preprogram+0x1c/0x24 +LR is at omap_hwmod_enable+0x34/0x60 + psr: 80000093 +sp : cf95de08 ip : 00002de5 fp : bec33d4c +r10: 00000000 r9 : 00000002 r8 : b6dd2c78 +r7 : 00000004 r6 : 00000000 r5 : a0000013 r4 : cf95c000 +r3 : 00000000 r2 : b6dd2c7c r1 : 00000000 r0 : 000b0012 +Flags: Nzcv IRQs off FIQs on Mode SVC_32 ISA ARM Segment user +Control: 10c5387d Table: 8f968019 DAC: 00000015 +Process otpcmd (pid: 607, stack limit = 0xcf95c230) +Stack: (0xcf95de08 to 0xcf95e000) +de00: 00000001 cf91f840 00000000 c001d6fc 00000002 cf91f840 +de20: cf8f7e10 c001de54 cf8f7e10 c001de78 c001de68 c01d5e80 00000000 cf8f7e10 +de40: cf8f7e10 c01d5f28 cf8f7e10 c0530d30 00000000 c01d6f28 00000000 c0088664 +de60: b6ea1000 cfb05284 cf95c000 00000001 cf95c000 60000013 00000001 cf95dee4 +de80: cf870050 c01d7308 cf870010 cf870050 00000001 c0278b14 c0526f28 00000000 +dea0: cf870050 ffff8e18 00000001 cf95dee4 00000000 c0274f7c cf870050 00000001 +dec0: cf95dee4 cf1d8484 000000e0 c0276464 00000008 cf9c0000 00000007 c0276980 +dee0: cf9c0000 00000064 00000008 cf1d8404 cf1d8400 c01cc05c 0000270a cf1d8504 +df00: 00000023 cf1d8484 00000007 c01cc670 00000bdd 00000001 00000000 cf449e60 +df20: cf1dde70 cf1d8400 bec33d18 cf1d8504 c0246f00 00000003 cf95c000 00000000 +df40: bec33d4c c01cd078 00000003 cf1d8504 00000081 c01cbcb8 bec33d18 00000003 +df60: bec33d18 c00a9034 00002000 c00a9c68 cf92fe00 00000003 c0246f00 cf92fe00 +df80: 00000000 c00a9cb0 00000003 00000000 00008e70 00000000 b6f17000 00000036 +dfa0: c000e484 c000e300 00008e70 00000000 00000003 c0246f00 bec33d18 bec33d18 +dfc0: 00008e70 00000000 b6f17000 00000036 00000000 00000000 b6f6d000 bec33d4c +dfe0: b6ea1bd0 bec33d0c 00008c9c b6ea1bdc 60000010 00000003 00000000 00000000 +(_omap_device_enable_hwmods+0x20/0x34) +(omap_device_enable+0x3c/0x50) +(_od_runtime_resume+0x10/0x1c) +(__rpm_callback+0x54/0x98) +(rpm_callback+0x64/0x7c) +(rpm_resume+0x434/0x554) +(__pm_runtime_resume+0x48/0x74) +(omap_i2c_xfer+0x28/0xe8) +(__i2c_transfer+0x3c/0x78) +(i2c_transfer+0x6c/0xc0) +(i2c_master_send+0x38/0x48) +(sha204p_send_command+0x60/0x9c) +(sha204c_send_and_receive+0x5c/0x1e0) +(sha204m_read+0x94/0xa0) +(otp_do_read+0x50/0xa4) +(vfs_ioctl+0x24/0x40) +(do_vfs_ioctl+0x1b0/0x1c0) +(sys_ioctl+0x38/0x54) +(ret_fast_syscall+0x0/0x30) +Code: e1a08002 ea000009 e598003c e592c05c (e7904003) + +Signed-off-by: Jean-Philippe Fran=C3=A7ois +Acked-by: Kevin Hilman +[tony@atomide.com: updated description with oops] +Signed-off-by: Tony Lindgren +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/mach-omap2/omap_hwmod.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/arm/mach-omap2/omap_hwmod.c ++++ b/arch/arm/mach-omap2/omap_hwmod.c +@@ -2066,7 +2066,7 @@ static int _omap4_get_context_lost(struc + * do so is present in the hwmod data, then call it and pass along the + * return value; otherwise, return 0. + */ +-static int __init _enable_preprogram(struct omap_hwmod *oh) ++static int _enable_preprogram(struct omap_hwmod *oh) + { + if (!oh->class->enable_preprogram) + return 0; diff --git a/queue-3.9/arm-plat-orion-fix-num_resources-and-id-for-ge10-and-ge11.patch b/queue-3.9/arm-plat-orion-fix-num_resources-and-id-for-ge10-and-ge11.patch new file mode 100644 index 00000000000..fd367ed80a7 --- /dev/null +++ b/queue-3.9/arm-plat-orion-fix-num_resources-and-id-for-ge10-and-ge11.patch @@ -0,0 +1,66 @@ +From 2b8b2797142c7951e635c6eec5d1705ee9bc45c5 Mon Sep 17 00:00:00 2001 +From: Gregory CLEMENT +Date: Sun, 19 May 2013 22:12:43 +0200 +Subject: ARM: plat-orion: Fix num_resources and id for ge10 and ge11 + +From: Gregory CLEMENT + +commit 2b8b2797142c7951e635c6eec5d1705ee9bc45c5 upstream. + +When platform data were moved from arch/arm/mach-mv78xx0/common.c to +arch/arm/plat-orion/common.c with the commit "7e3819d ARM: orion: +Consolidate ethernet platform data", there were few typo made on +gigabit Ethernet interface ge10 and ge11. This commit writes back +their initial value, which allows to use this interfaces again. + +Signed-off-by: Gregory CLEMENT +Acked-by: Andrew Lunn +Signed-off-by: Jason Cooper +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/plat-orion/common.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +--- a/arch/arm/plat-orion/common.c ++++ b/arch/arm/plat-orion/common.c +@@ -373,7 +373,7 @@ static struct resource orion_ge10_shared + + static struct platform_device orion_ge10_shared = { + .name = MV643XX_ETH_SHARED_NAME, +- .id = 1, ++ .id = 2, + .dev = { + .platform_data = &orion_ge10_shared_data, + }, +@@ -388,8 +388,8 @@ static struct resource orion_ge10_resour + + static struct platform_device orion_ge10 = { + .name = MV643XX_ETH_NAME, +- .id = 1, +- .num_resources = 2, ++ .id = 2, ++ .num_resources = 1, + .resource = orion_ge10_resources, + .dev = { + .coherent_dma_mask = DMA_BIT_MASK(32), +@@ -425,7 +425,7 @@ static struct resource orion_ge11_shared + + static struct platform_device orion_ge11_shared = { + .name = MV643XX_ETH_SHARED_NAME, +- .id = 1, ++ .id = 3, + .dev = { + .platform_data = &orion_ge11_shared_data, + }, +@@ -440,8 +440,8 @@ static struct resource orion_ge11_resour + + static struct platform_device orion_ge11 = { + .name = MV643XX_ETH_NAME, +- .id = 1, +- .num_resources = 2, ++ .id = 3, ++ .num_resources = 1, + .resource = orion_ge11_resources, + .dev = { + .coherent_dma_mask = DMA_BIT_MASK(32), diff --git a/queue-3.9/cfg80211-fix-sending-wowlan-tcp-wakeup-settings.patch b/queue-3.9/cfg80211-fix-sending-wowlan-tcp-wakeup-settings.patch new file mode 100644 index 00000000000..554c46ba5dd --- /dev/null +++ b/queue-3.9/cfg80211-fix-sending-wowlan-tcp-wakeup-settings.patch @@ -0,0 +1,33 @@ +From e248ad30204eff6559b4d2d94d49d9d46c08185a Mon Sep 17 00:00:00 2001 +From: Johannes Berg +Date: Thu, 16 May 2013 10:24:28 +0200 +Subject: cfg80211: fix sending WoWLAN TCP wakeup settings + +From: Johannes Berg + +commit e248ad30204eff6559b4d2d94d49d9d46c08185a upstream. + +The code sending the current WoWLAN TCP wakeup settings in +nl80211_send_wowlan_tcp() is not closing the nested attribute, +thus causing the parser to get confused on the receiver side +in userspace (iw). Fix this. + +Reported-by: Deepak Arora +Signed-off-by: Johannes Berg +Signed-off-by: Greg Kroah-Hartman + +--- + net/wireless/nl80211.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/net/wireless/nl80211.c ++++ b/net/wireless/nl80211.c +@@ -7177,6 +7177,8 @@ static int nl80211_send_wowlan_tcp(struc + &tcp->payload_tok)) + return -ENOBUFS; + ++ nla_nest_end(msg, nl_tcp); ++ + return 0; + } + diff --git a/queue-3.9/cfg80211-fix-wiphy_register-error-path.patch b/queue-3.9/cfg80211-fix-wiphy_register-error-path.patch new file mode 100644 index 00000000000..a00fd815744 --- /dev/null +++ b/queue-3.9/cfg80211-fix-wiphy_register-error-path.patch @@ -0,0 +1,52 @@ +From 03cd7e4e1ea16cd151c799a33b5ca1fd41a464df Mon Sep 17 00:00:00 2001 +From: Johannes Berg +Date: Fri, 10 May 2013 19:23:40 +0200 +Subject: cfg80211: fix wiphy_register error path + +From: Johannes Berg + +commit 03cd7e4e1ea16cd151c799a33b5ca1fd41a464df upstream. + +If rfkill_register() fails in wiphy_register() the struct device +is unregistered but everything else isn't (regulatory, debugfs) +and we even leave the wiphy instance on all internal lists even +though it will likely be freed soon, which is clearly a problem. +Fix this by cleaning up properly. + +Signed-off-by: Johannes Berg +Signed-off-by: Greg Kroah-Hartman + +--- + net/wireless/core.c | 16 ++++++++++------ + 1 file changed, 10 insertions(+), 6 deletions(-) + +--- a/net/wireless/core.c ++++ b/net/wireless/core.c +@@ -638,17 +638,21 @@ int wiphy_register(struct wiphy *wiphy) + * cfg80211_mutex lock + */ + res = rfkill_register(rdev->rfkill); +- if (res) +- goto out_rm_dev; ++ if (res) { ++ device_del(&rdev->wiphy.dev); ++ ++ mutex_lock(&cfg80211_mutex); ++ debugfs_remove_recursive(rdev->wiphy.debugfsdir); ++ list_del_rcu(&rdev->list); ++ wiphy_regulatory_deregister(wiphy); ++ mutex_unlock(&cfg80211_mutex); ++ return res; ++ } + + rtnl_lock(); + rdev->wiphy.registered = true; + rtnl_unlock(); + return 0; +- +-out_rm_dev: +- device_del(&rdev->wiphy.dev); +- return res; + } + EXPORT_SYMBOL(wiphy_register); + diff --git a/queue-3.9/cfg80211-fix-wowlan-wakeup-tracing.patch b/queue-3.9/cfg80211-fix-wowlan-wakeup-tracing.patch new file mode 100644 index 00000000000..abae7e4fa8b --- /dev/null +++ b/queue-3.9/cfg80211-fix-wowlan-wakeup-tracing.patch @@ -0,0 +1,64 @@ +From a92eecbbeaf01ea2267751569dd3301248513915 Mon Sep 17 00:00:00 2001 +From: Johannes Berg +Date: Mon, 29 Apr 2013 12:09:14 +0200 +Subject: cfg80211: fix WoWLAN wakeup tracing + +From: Johannes Berg + +commit a92eecbbeaf01ea2267751569dd3301248513915 upstream. + +If the device reports a non-wireless wakeup reason, the +tracing code crashes trying to dereference a NULL pointer. +Fix this by checking the pointer on all accesses and also +add a non_wireless tag to the event. + +Signed-off-by: Johannes Berg +Signed-off-by: Greg Kroah-Hartman + +--- + net/wireless/trace.h | 23 +++++++++++++---------- + 1 file changed, 13 insertions(+), 10 deletions(-) + +--- a/net/wireless/trace.h ++++ b/net/wireless/trace.h +@@ -2386,6 +2386,7 @@ TRACE_EVENT(cfg80211_report_wowlan_wakeu + TP_STRUCT__entry( + WIPHY_ENTRY + WDEV_ENTRY ++ __field(bool, non_wireless) + __field(bool, disconnect) + __field(bool, magic_pkt) + __field(bool, gtk_rekey_failure) +@@ -2394,20 +2395,22 @@ TRACE_EVENT(cfg80211_report_wowlan_wakeu + __field(bool, rfkill_release) + __field(s32, pattern_idx) + __field(u32, packet_len) +- __dynamic_array(u8, packet, wakeup->packet_present_len) ++ __dynamic_array(u8, packet, ++ wakeup ? wakeup->packet_present_len : 0) + ), + TP_fast_assign( + WIPHY_ASSIGN; + WDEV_ASSIGN; +- __entry->disconnect = wakeup->disconnect; +- __entry->magic_pkt = wakeup->magic_pkt; +- __entry->gtk_rekey_failure = wakeup->gtk_rekey_failure; +- __entry->eap_identity_req = wakeup->eap_identity_req; +- __entry->four_way_handshake = wakeup->four_way_handshake; +- __entry->rfkill_release = wakeup->rfkill_release; +- __entry->pattern_idx = wakeup->pattern_idx; +- __entry->packet_len = wakeup->packet_len; +- if (wakeup->packet && wakeup->packet_present_len) ++ __entry->non_wireless = !wakeup; ++ __entry->disconnect = wakeup ? wakeup->disconnect : false; ++ __entry->magic_pkt = wakeup ? wakeup->magic_pkt : false; ++ __entry->gtk_rekey_failure = wakeup ? wakeup->gtk_rekey_failure : false; ++ __entry->eap_identity_req = wakeup ? wakeup->eap_identity_req : false; ++ __entry->four_way_handshake = wakeup ? wakeup->four_way_handshake : false; ++ __entry->rfkill_release = wakeup ? wakeup->rfkill_release : false; ++ __entry->pattern_idx = wakeup ? wakeup->pattern_idx : false; ++ __entry->packet_len = wakeup ? wakeup->packet_len : false; ++ if (wakeup && wakeup->packet && wakeup->packet_present_len) + memcpy(__get_dynamic_array(packet), wakeup->packet, + wakeup->packet_present_len); + ), diff --git a/queue-3.9/cifs-only-set-ops-for-inodes-in-i_new-state.patch b/queue-3.9/cifs-only-set-ops-for-inodes-in-i_new-state.patch new file mode 100644 index 00000000000..a6a24fce69d --- /dev/null +++ b/queue-3.9/cifs-only-set-ops-for-inodes-in-i_new-state.patch @@ -0,0 +1,36 @@ +From c2b93e0699723700f886ce17bb65ffd771195a6d Mon Sep 17 00:00:00 2001 +From: Jeff Layton +Date: Tue, 7 May 2013 11:28:31 -0400 +Subject: cifs: only set ops for inodes in I_NEW state + +From: Jeff Layton + +commit c2b93e0699723700f886ce17bb65ffd771195a6d upstream. + +It's generally not safe to reset the inode ops once they've been set. In +the case where the inode was originally thought to be a directory and +then later found to be a DFS referral, this can lead to an oops when we +try to trigger an inode op on it after changing the ops to the blank +referral operations. + +Reported-and-Tested-by: Sachin Prabhu +Signed-off-by: Jeff Layton +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman + +--- + fs/cifs/inode.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/fs/cifs/inode.c ++++ b/fs/cifs/inode.c +@@ -169,7 +169,8 @@ cifs_fattr_to_inode(struct inode *inode, + + if (fattr->cf_flags & CIFS_FATTR_DFS_REFERRAL) + inode->i_flags |= S_AUTOMOUNT; +- cifs_set_ops(inode); ++ if (inode->i_state & I_NEW) ++ cifs_set_ops(inode); + } + + void diff --git a/queue-3.9/drivers-char-random.c-fix-priming-of-last_data.patch b/queue-3.9/drivers-char-random.c-fix-priming-of-last_data.patch new file mode 100644 index 00000000000..77c2cb06ad3 --- /dev/null +++ b/queue-3.9/drivers-char-random.c-fix-priming-of-last_data.patch @@ -0,0 +1,94 @@ +From 1e7e2e05c179a68aaf8830fe91547a87f4589e53 Mon Sep 17 00:00:00 2001 +From: Jarod Wilson +Date: Fri, 24 May 2013 15:55:31 -0700 +Subject: drivers/char/random.c: fix priming of last_data + +From: Jarod Wilson + +commit 1e7e2e05c179a68aaf8830fe91547a87f4589e53 upstream. + +Commit ec8f02da9ea5 ("random: prime last_data value per fips +requirements") added priming of last_data per fips requirements. + +Unfortuantely, it did so in a way that can lead to multiple threads all +incrementing nbytes, but only one actually doing anything with the extra +data, which leads to some fun random corruption and panics. + +The fix is to simply do everything needed to prime last_data in a single +shot, so there's no window for multiple cpus to increment nbytes -- in +fact, we won't even increment or decrement nbytes anymore, we'll just +extract the needed EXTRACT_SIZE one time per pool and then carry on with +the normal routine. + +All these changes have been tested across multiple hosts and +architectures where panics were previously encoutered. The code changes +are are strictly limited to areas only touched when when booted in fips +mode. + +This change should also go into 3.8-stable, to make the myriads of fips +users on 3.8.x happy. + +Signed-off-by: Jarod Wilson +Tested-by: Jan Stancek +Tested-by: Jan Stodola +Cc: Herbert Xu +Acked-by: Neil Horman +Cc: "David S. Miller" +Cc: Matt Mackall +Cc: "Theodore Ts'o" +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/char/random.c | 30 +++++++++++++++--------------- + 1 file changed, 15 insertions(+), 15 deletions(-) + +--- a/drivers/char/random.c ++++ b/drivers/char/random.c +@@ -957,10 +957,23 @@ static ssize_t extract_entropy(struct en + { + ssize_t ret = 0, i; + __u8 tmp[EXTRACT_SIZE]; ++ unsigned long flags; + + /* if last_data isn't primed, we need EXTRACT_SIZE extra bytes */ +- if (fips_enabled && !r->last_data_init) +- nbytes += EXTRACT_SIZE; ++ if (fips_enabled) { ++ spin_lock_irqsave(&r->lock, flags); ++ if (!r->last_data_init) { ++ r->last_data_init = true; ++ spin_unlock_irqrestore(&r->lock, flags); ++ trace_extract_entropy(r->name, EXTRACT_SIZE, ++ r->entropy_count, _RET_IP_); ++ xfer_secondary_pool(r, EXTRACT_SIZE); ++ extract_buf(r, tmp); ++ spin_lock_irqsave(&r->lock, flags); ++ memcpy(r->last_data, tmp, EXTRACT_SIZE); ++ } ++ spin_unlock_irqrestore(&r->lock, flags); ++ } + + trace_extract_entropy(r->name, nbytes, r->entropy_count, _RET_IP_); + xfer_secondary_pool(r, nbytes); +@@ -970,19 +983,6 @@ static ssize_t extract_entropy(struct en + extract_buf(r, tmp); + + if (fips_enabled) { +- unsigned long flags; +- +- +- /* prime last_data value if need be, per fips 140-2 */ +- if (!r->last_data_init) { +- spin_lock_irqsave(&r->lock, flags); +- memcpy(r->last_data, tmp, EXTRACT_SIZE); +- r->last_data_init = true; +- nbytes -= EXTRACT_SIZE; +- spin_unlock_irqrestore(&r->lock, flags); +- extract_buf(r, tmp); +- } +- + spin_lock_irqsave(&r->lock, flags); + if (!memcmp(tmp, r->last_data, EXTRACT_SIZE)) + panic("Hardware RNG duplicated output!\n"); diff --git a/queue-3.9/drivers-hv-fix-a-bug-in-get_vp_index.patch b/queue-3.9/drivers-hv-fix-a-bug-in-get_vp_index.patch new file mode 100644 index 00000000000..4a904d496ff --- /dev/null +++ b/queue-3.9/drivers-hv-fix-a-bug-in-get_vp_index.patch @@ -0,0 +1,31 @@ +From d2242a384355773c711a936522bcfae0f35f8c2a Mon Sep 17 00:00:00 2001 +From: "K. Y. Srinivasan" +Date: Fri, 17 May 2013 09:30:35 -0700 +Subject: Drivers: hv: Fix a bug in get_vp_index() + +From: "K. Y. Srinivasan" + +commit d2242a384355773c711a936522bcfae0f35f8c2a upstream. + +Linux' notion of cpuid is different from the Host's notion of CPUID. In the +call to bind the channel interrupts, we should use the host's notion of +CPU Ids. Fix this bug. + +Signed-off-by: K. Y. Srinivasan +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hv/channel_mgmt.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/hv/channel_mgmt.c ++++ b/drivers/hv/channel_mgmt.c +@@ -318,7 +318,7 @@ static u32 get_vp_index(uuid_le *type_gu + return 0; + } + cur_cpu = (++next_vp % max_cpus); +- return cur_cpu; ++ return hv_context.vp_index[cur_cpu]; + } + + /* diff --git a/queue-3.9/fat-fix-possible-overflow-for-fat_clusters.patch b/queue-3.9/fat-fix-possible-overflow-for-fat_clusters.patch new file mode 100644 index 00000000000..a66077e9309 --- /dev/null +++ b/queue-3.9/fat-fix-possible-overflow-for-fat_clusters.patch @@ -0,0 +1,52 @@ +From 7b92d03c3239f43e5b86c9cc9630f026d36ee995 Mon Sep 17 00:00:00 2001 +From: OGAWA Hirofumi +Date: Fri, 24 May 2013 15:55:08 -0700 +Subject: fat: fix possible overflow for fat_clusters + +From: OGAWA Hirofumi + +commit 7b92d03c3239f43e5b86c9cc9630f026d36ee995 upstream. + +Intermediate value of fat_clusters can be overflowed on 32bits arch. + +Reported-by: Krzysztof Strasburger +Signed-off-by: OGAWA Hirofumi +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + fs/fat/inode.c | 15 ++++++++++++++- + 1 file changed, 14 insertions(+), 1 deletion(-) + +--- a/fs/fat/inode.c ++++ b/fs/fat/inode.c +@@ -1223,6 +1223,19 @@ static int fat_read_root(struct inode *i + return 0; + } + ++static unsigned long calc_fat_clusters(struct super_block *sb) ++{ ++ struct msdos_sb_info *sbi = MSDOS_SB(sb); ++ ++ /* Divide first to avoid overflow */ ++ if (sbi->fat_bits != 12) { ++ unsigned long ent_per_sec = sb->s_blocksize * 8 / sbi->fat_bits; ++ return ent_per_sec * sbi->fat_length; ++ } ++ ++ return sbi->fat_length * sb->s_blocksize * 8 / sbi->fat_bits; ++} ++ + /* + * Read the super block of an MS-DOS FS. + */ +@@ -1427,7 +1440,7 @@ int fat_fill_super(struct super_block *s + sbi->dirty = b->fat16.state & FAT_STATE_DIRTY; + + /* check that FAT table does not overflow */ +- fat_clusters = sbi->fat_length * sb->s_blocksize * 8 / sbi->fat_bits; ++ fat_clusters = calc_fat_clusters(sb); + total_clusters = min(total_clusters, fat_clusters - FAT_START_ENT); + if (total_clusters > MAX_FAT(sb)) { + if (!silent) diff --git a/queue-3.9/input-egalax_ts-abs_mt_position_y-not-reported-well.patch b/queue-3.9/input-egalax_ts-abs_mt_position_y-not-reported-well.patch new file mode 100644 index 00000000000..706bcd1b5c1 --- /dev/null +++ b/queue-3.9/input-egalax_ts-abs_mt_position_y-not-reported-well.patch @@ -0,0 +1,31 @@ +From 3c9cfa782e075cc2348b949ba139911aac02c7cb Mon Sep 17 00:00:00 2001 +From: Heiko Abraham +Date: Sun, 5 May 2013 19:49:49 -0700 +Subject: Input: egalax_ts - ABS_MT_POSITION_Y not reported well + +From: Heiko Abraham + +commit 3c9cfa782e075cc2348b949ba139911aac02c7cb upstream. + +The egalax_ts touchscreen modul not report ABS_MT_POSITION_Y proper. +As result it may be, that upper software levels only receive x coordinates well. + +Signed-off-by: Heiko Abraham +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/input/touchscreen/egalax_ts.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/input/touchscreen/egalax_ts.c ++++ b/drivers/input/touchscreen/egalax_ts.c +@@ -216,7 +216,7 @@ static int egalax_ts_probe(struct i2c_cl + input_set_abs_params(input_dev, + ABS_MT_POSITION_X, 0, EGALAX_MAX_X, 0, 0); + input_set_abs_params(input_dev, +- ABS_MT_POSITION_X, 0, EGALAX_MAX_Y, 0, 0); ++ ABS_MT_POSITION_Y, 0, EGALAX_MAX_Y, 0, 0); + input_mt_init_slots(input_dev, MAX_SUPPORT_POINTS, 0); + + input_set_drvdata(input_dev, ts); diff --git a/queue-3.9/iwlwifi-mvm-always-use-scan_type_forced.patch b/queue-3.9/iwlwifi-mvm-always-use-scan_type_forced.patch new file mode 100644 index 00000000000..47b7f7ec305 --- /dev/null +++ b/queue-3.9/iwlwifi-mvm-always-use-scan_type_forced.patch @@ -0,0 +1,38 @@ +From f70ed7b330ce769828d402f920fb13da6c13ea63 Mon Sep 17 00:00:00 2001 +From: Ilan Peer +Date: Sun, 28 Apr 2013 08:18:28 +0300 +Subject: iwlwifi: mvm: Always use SCAN_TYPE_FORCED + +From: Ilan Peer + +commit f70ed7b330ce769828d402f920fb13da6c13ea63 upstream. + +The FW AUX framework does not handle well cases where time events +fail to be scheduled (and as a result issues assert 0x3330). Until +a proper fix is in place, WA this by always setting the scan type to +SCAN_TYPE_FORCED. + +Signed-off-by: Ilan Peer +Reviewed-by: Emmanuel Grumbach +Signed-off-by: Johannes Berg +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/iwlwifi/mvm/scan.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/net/wireless/iwlwifi/mvm/scan.c ++++ b/drivers/net/wireless/iwlwifi/mvm/scan.c +@@ -298,6 +298,12 @@ int iwl_mvm_scan_request(struct iwl_mvm + else + cmd->type = cpu_to_le32(SCAN_TYPE_FORCED); + ++ /* ++ * TODO: This is a WA due to a bug in the FW AUX framework that does not ++ * properly handle time events that fail to be scheduled ++ */ ++ cmd->type = cpu_to_le32(SCAN_TYPE_FORCED); ++ + cmd->repeats = cpu_to_le32(1); + + /* diff --git a/queue-3.9/iwlwifi-mvm-prevent-setting-assoc-flag-in-mac_context_cmd.patch b/queue-3.9/iwlwifi-mvm-prevent-setting-assoc-flag-in-mac_context_cmd.patch new file mode 100644 index 00000000000..5a1dcd76e8e --- /dev/null +++ b/queue-3.9/iwlwifi-mvm-prevent-setting-assoc-flag-in-mac_context_cmd.patch @@ -0,0 +1,62 @@ +From ba283927268d45184c17c37ff78d427e59026229 Mon Sep 17 00:00:00 2001 +From: Alexander Bondar +Date: Thu, 2 May 2013 16:34:48 +0300 +Subject: iwlwifi: mvm: Prevent setting assoc flag in MAC_CONTEXT_CMD + +From: Alexander Bondar + +commit ba283927268d45184c17c37ff78d427e59026229 upstream. + +In the normal flow first MAC_CONTEXT_CMD for particular interface is +never sent while associated. The exception is fw restart flow when +resuming from suspend when WoWLAN is enabled. In this case successive +"add" and "modify" MAC_CONTEXT_CMD commands may be sent with assoc flag +set what cause FW mal functioning. To prevent this never set assoc flag +in MAC_CONTEXT_CMD with action "add". + +Signed-off-by: Alexander Bondar +Reviewed-by: Emmanuel Grumbach +Signed-off-by: Johannes Berg +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/iwlwifi/mvm/mac-ctxt.c | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +--- a/drivers/net/wireless/iwlwifi/mvm/mac-ctxt.c ++++ b/drivers/net/wireless/iwlwifi/mvm/mac-ctxt.c +@@ -586,10 +586,12 @@ static int iwl_mvm_mac_ctxt_send_cmd(str + */ + static void iwl_mvm_mac_ctxt_cmd_fill_sta(struct iwl_mvm *mvm, + struct ieee80211_vif *vif, +- struct iwl_mac_data_sta *ctxt_sta) ++ struct iwl_mac_data_sta *ctxt_sta, ++ bool force_assoc_off) + { + /* We need the dtim_period to set the MAC as associated */ +- if (vif->bss_conf.assoc && vif->bss_conf.dtim_period) { ++ if (vif->bss_conf.assoc && vif->bss_conf.dtim_period && ++ !force_assoc_off) { + u32 dtim_offs; + + /* +@@ -652,7 +654,8 @@ static int iwl_mvm_mac_ctxt_cmd_station( + iwl_mvm_mac_ctxt_cmd_common(mvm, vif, &cmd, action); + + /* Fill the data specific for station mode */ +- iwl_mvm_mac_ctxt_cmd_fill_sta(mvm, vif, &cmd.sta); ++ iwl_mvm_mac_ctxt_cmd_fill_sta(mvm, vif, &cmd.sta, ++ action == FW_CTXT_ACTION_ADD); + + return iwl_mvm_mac_ctxt_send_cmd(mvm, &cmd); + } +@@ -669,7 +672,8 @@ static int iwl_mvm_mac_ctxt_cmd_p2p_clie + iwl_mvm_mac_ctxt_cmd_common(mvm, vif, &cmd, action); + + /* Fill the data specific for station mode */ +- iwl_mvm_mac_ctxt_cmd_fill_sta(mvm, vif, &cmd.p2p_sta.sta); ++ iwl_mvm_mac_ctxt_cmd_fill_sta(mvm, vif, &cmd.p2p_sta.sta, ++ action == FW_CTXT_ACTION_ADD); + + cmd.p2p_sta.ctwin = cpu_to_le32(vif->bss_conf.p2p_ctwindow); + diff --git a/queue-3.9/mac80211-fix-ap-mode-frame-matching.patch b/queue-3.9/mac80211-fix-ap-mode-frame-matching.patch new file mode 100644 index 00000000000..949a8cf8fca --- /dev/null +++ b/queue-3.9/mac80211-fix-ap-mode-frame-matching.patch @@ -0,0 +1,34 @@ +From 2b9ccd4e4308272e5aec614b77c5385e7ec2ec90 Mon Sep 17 00:00:00 2001 +From: Johannes Berg +Date: Mon, 13 May 2013 16:42:40 +0200 +Subject: mac80211: fix AP-mode frame matching + +From: Johannes Berg + +commit 2b9ccd4e4308272e5aec614b77c5385e7ec2ec90 upstream. + +In AP mode, ignore frames with mis-matched BSSID that aren't +multicast or sent to the correct destination. This fixes +reporting public action frames to userspace multiple times +on multiple virtual AP interfaces. + +Reported-by: Jouni Malinen +Signed-off-by: Johannes Berg +Signed-off-by: Greg Kroah-Hartman + +--- + net/mac80211/rx.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/net/mac80211/rx.c ++++ b/net/mac80211/rx.c +@@ -3032,6 +3032,9 @@ static int prepare_for_handlers(struct i + * and location updates. Note that mac80211 + * itself never looks at these frames. + */ ++ if (!multicast && ++ !ether_addr_equal(sdata->vif.addr, hdr->addr1)) ++ return 0; + if (ieee80211_is_public_action(hdr, skb->len)) + return 1; + if (!ieee80211_is_beacon(hdr->frame_control)) diff --git a/queue-3.9/mac80211-use-just-spin_lock-in-ieee80211_get_tkip_p2k.patch b/queue-3.9/mac80211-use-just-spin_lock-in-ieee80211_get_tkip_p2k.patch new file mode 100644 index 00000000000..e1a6b89afdd --- /dev/null +++ b/queue-3.9/mac80211-use-just-spin_lock-in-ieee80211_get_tkip_p2k.patch @@ -0,0 +1,38 @@ +From 655914ab863bcc06c84270e4159fd59002d6b529 Mon Sep 17 00:00:00 2001 +From: Johannes Berg +Date: Mon, 6 May 2013 15:54:58 +0200 +Subject: mac80211: use just spin_lock() in ieee80211_get_tkip_p2k() + +From: Johannes Berg + +commit 655914ab863bcc06c84270e4159fd59002d6b529 upstream. + +ieee80211_get_tkip_p2k() may be called with interrupts +disabled, so spin_unlock_bh() isn't safe and leads to +warnings. Since it's always called with BHs disabled +already, just use spin_lock(). + +Reported-by: Milan Kocian +Acked-by: Stanislaw Gruszka +Signed-off-by: Johannes Berg +Signed-off-by: Greg Kroah-Hartman + +--- + net/mac80211/tkip.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/net/mac80211/tkip.c ++++ b/net/mac80211/tkip.c +@@ -208,10 +208,10 @@ void ieee80211_get_tkip_p2k(struct ieee8 + u32 iv32 = get_unaligned_le32(&data[4]); + u16 iv16 = data[2] | (data[0] << 8); + +- spin_lock_bh(&key->u.tkip.txlock); ++ spin_lock(&key->u.tkip.txlock); + ieee80211_compute_tkip_p1k(key, iv32); + tkip_mixing_phase2(tk, ctx, iv16, p2k); +- spin_unlock_bh(&key->u.tkip.txlock); ++ spin_unlock(&key->u.tkip.txlock); + } + EXPORT_SYMBOL(ieee80211_get_tkip_p2k); + diff --git a/queue-3.9/random-fix-accounting-race-condition-with-lockless-irq-entropy_count-update.patch b/queue-3.9/random-fix-accounting-race-condition-with-lockless-irq-entropy_count-update.patch new file mode 100644 index 00000000000..8afaf609fcd --- /dev/null +++ b/queue-3.9/random-fix-accounting-race-condition-with-lockless-irq-entropy_count-update.patch @@ -0,0 +1,70 @@ +From 10b3a32d292c21ea5b3ad5ca5975e88bb20b8d68 Mon Sep 17 00:00:00 2001 +From: Jiri Kosina +Date: Fri, 24 May 2013 15:55:33 -0700 +Subject: random: fix accounting race condition with lockless irq entropy_count update + +From: Jiri Kosina + +commit 10b3a32d292c21ea5b3ad5ca5975e88bb20b8d68 upstream. + +Commit 902c098a3663 ("random: use lockless techniques in the interrupt +path") turned IRQ path from being spinlock protected into lockless +cmpxchg-retry update. + +That commit removed r->lock serialization between crediting entropy bits +from IRQ context and accounting when extracting entropy on userspace +read path, but didn't turn the r->entropy_count reads/updates in +account() to use cmpxchg as well. + +It has been observed, that under certain circumstances this leads to +read() on /dev/urandom to return 0 (EOF), as r->entropy_count gets +corrupted and becomes negative, which in turn results in propagating 0 +all the way from account() to the actual read() call. + +Convert the accounting code to be the proper lockless counterpart of +what has been partially done by 902c098a3663. + +Signed-off-by: Jiri Kosina +Cc: Theodore Ts'o +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/char/random.c | 22 +++++++++++++++------- + 1 file changed, 15 insertions(+), 7 deletions(-) + +--- a/drivers/char/random.c ++++ b/drivers/char/random.c +@@ -865,16 +865,24 @@ static size_t account(struct entropy_sto + if (r->entropy_count / 8 < min + reserved) { + nbytes = 0; + } else { ++ int entropy_count, orig; ++retry: ++ entropy_count = orig = ACCESS_ONCE(r->entropy_count); + /* If limited, never pull more than available */ +- if (r->limit && nbytes + reserved >= r->entropy_count / 8) +- nbytes = r->entropy_count/8 - reserved; ++ if (r->limit && nbytes + reserved >= entropy_count / 8) ++ nbytes = entropy_count/8 - reserved; + +- if (r->entropy_count / 8 >= nbytes + reserved) +- r->entropy_count -= nbytes*8; +- else +- r->entropy_count = reserved; ++ if (entropy_count / 8 >= nbytes + reserved) { ++ entropy_count -= nbytes*8; ++ if (cmpxchg(&r->entropy_count, orig, entropy_count) != orig) ++ goto retry; ++ } else { ++ entropy_count = reserved; ++ if (cmpxchg(&r->entropy_count, orig, entropy_count) != orig) ++ goto retry; ++ } + +- if (r->entropy_count < random_write_wakeup_thresh) ++ if (entropy_count < random_write_wakeup_thresh) + wakeup_write = 1; + } + diff --git a/queue-3.9/series b/queue-3.9/series index 9260728078f..afb17d60acb 100644 --- a/queue-3.9/series +++ b/queue-3.9/series @@ -1,3 +1,36 @@ avr32-fix-relocation-check-for-signed-18-bit-offset.patch usb-ohci-fix-logic-for-scheduling-isochronous-urbs.patch usb-fix-latency-in-uhci-hcd-and-ohci-hcd.patch +arm-plat-orion-fix-num_resources-and-id-for-ge10-and-ge11.patch +arm-omap-fix-__init-section-mismatch-for-_enable_preprogram.patch +arm-am33xx-add-missing-.clkdm_name-to-clkdiv32k_ick-clock.patch +arm-7723-1-crypto-sha1-armv4-large.s-fix-sp-handling.patch +arm-at91-trivial-fix-model-name-for-sam9x25-ek.patch +arm-at91-rm9200-fix-time-support.patch +arm-at91-dt-fix-macb-pinctrl_macb_rmii_mii_alt-definition.patch +cfg80211-fix-wowlan-wakeup-tracing.patch +cfg80211-fix-wiphy_register-error-path.patch +cfg80211-fix-sending-wowlan-tcp-wakeup-settings.patch +mac80211-use-just-spin_lock-in-ieee80211_get_tkip_p2k.patch +mac80211-fix-ap-mode-frame-matching.patch +iwlwifi-mvm-always-use-scan_type_forced.patch +iwlwifi-mvm-prevent-setting-assoc-flag-in-mac_context_cmd.patch +staging-vt6656-fix-missing-spin-lock-in-iwctl_siwpower.patch +staging-vt6656-use-free_netdev-instead-of-kfree.patch +usb-chipidea-fix-link-error-when-usb_ehci_hcd-is-a-module.patch +usb-option-add-telewell-tw-lte-4g.patch +usb-option-add-device-ids-for-dell-5804-novatel-e371-wwan-card.patch +usb-ftdi_sio-add-support-for-newport-conex-motor-drivers.patch +usb-cxacru-potential-underflow-in-cxacru_cm_get_array.patch +tty-fix-tty-miss-restart-after-we-turn-off-flow-control.patch +usb-blacklisted-cinterion-s-plxx-wwan-interface.patch +usb-reset-resume-quirk-needed-by-a-hub.patch +usb-xhci-override-bogus-bulk-wmaxpacketsize-values.patch +usb-uhci-fix-for-suspend-of-virtual-hp-controller.patch +input-egalax_ts-abs_mt_position_y-not-reported-well.patch +drivers-hv-fix-a-bug-in-get_vp_index.patch +cifs-only-set-ops-for-inodes-in-i_new-state.patch +arc-copy_-to-from-_user-to-honor-usermode-access-permissions.patch +drivers-char-random.c-fix-priming-of-last_data.patch +random-fix-accounting-race-condition-with-lockless-irq-entropy_count-update.patch +fat-fix-possible-overflow-for-fat_clusters.patch diff --git a/queue-3.9/staging-vt6656-fix-missing-spin-lock-in-iwctl_siwpower.patch b/queue-3.9/staging-vt6656-fix-missing-spin-lock-in-iwctl_siwpower.patch new file mode 100644 index 00000000000..33d5de365ed --- /dev/null +++ b/queue-3.9/staging-vt6656-fix-missing-spin-lock-in-iwctl_siwpower.patch @@ -0,0 +1,49 @@ +From 91ec61f8f01cf32868e2ed2fa96a299e77964055 Mon Sep 17 00:00:00 2001 +From: Malcolm Priestley +Date: Wed, 15 May 2013 01:44:25 +0100 +Subject: staging: vt6656: [bug] Fix missing spin lock in iwctl_siwpower. + +From: Malcolm Priestley + +commit 91ec61f8f01cf32868e2ed2fa96a299e77964055 upstream. + +Fixes occasional dead lock on power up / down. + +spin_lock_irq is used because of unlocking with spin_unlock_irq +elsewhere in the driver. + +Only relevant to kernels 3.8 and later when command was +transferred to the iw_handler. + +Signed-off-by: Malcolm Priestley +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/vt6656/iwctl.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/staging/vt6656/iwctl.c ++++ b/drivers/staging/vt6656/iwctl.c +@@ -1348,9 +1348,12 @@ int iwctl_siwpower(struct net_device *de + return rc; + } + ++ spin_lock_irq(&pDevice->lock); ++ + if (wrq->disabled) { + pDevice->ePSMode = WMAC_POWER_CAM; + PSvDisablePowerSaving(pDevice); ++ spin_unlock_irq(&pDevice->lock); + return rc; + } + if ((wrq->flags & IW_POWER_TYPE) == IW_POWER_TIMEOUT) { +@@ -1361,6 +1364,9 @@ int iwctl_siwpower(struct net_device *de + pDevice->ePSMode = WMAC_POWER_FAST; + PSvEnablePowerSaving((void *)pDevice, pMgmt->wListenInterval); + } ++ ++ spin_unlock_irq(&pDevice->lock); ++ + switch (wrq->flags & IW_POWER_MODE) { + case IW_POWER_UNICAST_R: + DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO " SIOCSIWPOWER: IW_POWER_UNICAST_R \n"); diff --git a/queue-3.9/staging-vt6656-use-free_netdev-instead-of-kfree.patch b/queue-3.9/staging-vt6656-use-free_netdev-instead-of-kfree.patch new file mode 100644 index 00000000000..923f1dc0245 --- /dev/null +++ b/queue-3.9/staging-vt6656-use-free_netdev-instead-of-kfree.patch @@ -0,0 +1,29 @@ +From 0a438d5b381e2bdfd5e02d653bf46fcc878356e3 Mon Sep 17 00:00:00 2001 +From: Hema Prathaban +Date: Sat, 11 May 2013 22:39:47 +0530 +Subject: staging: vt6656: use free_netdev instead of kfree + +From: Hema Prathaban + +commit 0a438d5b381e2bdfd5e02d653bf46fcc878356e3 upstream. + +use free_netdev() instead of kfree(pDevice->apdev) + +Signed-off-by: Hema Prathaban +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/vt6656/hostap.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/staging/vt6656/hostap.c ++++ b/drivers/staging/vt6656/hostap.c +@@ -133,7 +133,7 @@ static int hostap_disable_hostapd(struct + DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "%s: Netdevice %s unregistered\n", + pDevice->dev->name, pDevice->apdev->name); + } +- kfree(pDevice->apdev); ++ free_netdev(pDevice->apdev); + pDevice->apdev = NULL; + pDevice->bEnable8021x = false; + pDevice->bEnableHostWEP = false; diff --git a/queue-3.9/tty-fix-tty-miss-restart-after-we-turn-off-flow-control.patch b/queue-3.9/tty-fix-tty-miss-restart-after-we-turn-off-flow-control.patch new file mode 100644 index 00000000000..1bcc105bc71 --- /dev/null +++ b/queue-3.9/tty-fix-tty-miss-restart-after-we-turn-off-flow-control.patch @@ -0,0 +1,51 @@ +From dab73b4eb9ef924a2b90dab84e539076d82b256f Mon Sep 17 00:00:00 2001 +From: Wang YanQing +Date: Thu, 9 May 2013 14:16:47 +0800 +Subject: TTY: Fix tty miss restart after we turn off flow-control + +From: Wang YanQing + +commit dab73b4eb9ef924a2b90dab84e539076d82b256f upstream. + +I meet emacs hang in start if I do the operation below: + 1: echo 3 > /proc/sys/vm/drop_caches + 2: emacs BigFile + 3: Press CTRL-S follow 2 immediately + +Then emacs hang on, CTRL-Q can't resume, the terminal +hang on, you can do nothing with this terminal except +close it. + +The reason is before emacs takeover control the tty, +we use CTRL-S to XOFF it. Then when emacs takeover the +control, it may don't use the flow-control, so emacs hang. +This patch fix it. + +This patch will fix a kind of strange tty relation hang problem, +I believe I meet it with vim in ssh, and also see below bug report: +http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=465823 + +Signed-off-by: Wang YanQing +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/n_tty.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/drivers/tty/n_tty.c ++++ b/drivers/tty/n_tty.c +@@ -1588,6 +1588,14 @@ static void n_tty_set_termios(struct tty + ldata->real_raw = 0; + } + n_tty_set_room(tty); ++ /* ++ * Fix tty hang when I_IXON(tty) is cleared, but the tty ++ * been stopped by STOP_CHAR(tty) before it. ++ */ ++ if (!I_IXON(tty) && old && (old->c_iflag & IXON) && !tty->flow_stopped) { ++ start_tty(tty); ++ } ++ + /* The termios change make the tty ready for I/O */ + wake_up_interruptible(&tty->write_wait); + wake_up_interruptible(&tty->read_wait); diff --git a/queue-3.9/usb-blacklisted-cinterion-s-plxx-wwan-interface.patch b/queue-3.9/usb-blacklisted-cinterion-s-plxx-wwan-interface.patch new file mode 100644 index 00000000000..1bda243f603 --- /dev/null +++ b/queue-3.9/usb-blacklisted-cinterion-s-plxx-wwan-interface.patch @@ -0,0 +1,45 @@ +From 8ff10bdb14a52e3f25d4ce09e0582a8684c1a6db Mon Sep 17 00:00:00 2001 +From: Schemmel Hans-Christoph +Date: Mon, 6 May 2013 11:05:12 +0200 +Subject: USB: Blacklisted Cinterion's PLxx WWAN Interface + +From: Schemmel Hans-Christoph + +commit 8ff10bdb14a52e3f25d4ce09e0582a8684c1a6db upstream. + +/drivers/usb/serial/option.c: Blacklisted Cinterion's PLxx WWAN +Interface (USB Interface 4), because it will be handled by QMI WWAN +driver. Product IDs renamed. + +Signed-off-by: Hans-Christoph Schemmel +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/option.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -342,8 +342,8 @@ static void option_instat_callback(struc + #define CINTERION_PRODUCT_EU3_E 0x0051 + #define CINTERION_PRODUCT_EU3_P 0x0052 + #define CINTERION_PRODUCT_PH8 0x0053 +-#define CINTERION_PRODUCT_AH6 0x0055 +-#define CINTERION_PRODUCT_PLS8 0x0060 ++#define CINTERION_PRODUCT_AHXX 0x0055 ++#define CINTERION_PRODUCT_PLXX 0x0060 + + /* Olivetti products */ + #define OLIVETTI_VENDOR_ID 0x0b3c +@@ -1268,8 +1268,9 @@ static const struct usb_device_id option + { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_EU3_E) }, + { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_EU3_P) }, + { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_PH8) }, +- { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_AH6) }, +- { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_PLS8) }, ++ { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_AHXX) }, ++ { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_PLXX), ++ .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_HC28_MDM) }, + { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_HC28_MDMNET) }, + { USB_DEVICE(SIEMENS_VENDOR_ID, CINTERION_PRODUCT_HC25_MDM) }, diff --git a/queue-3.9/usb-chipidea-fix-link-error-when-usb_ehci_hcd-is-a-module.patch b/queue-3.9/usb-chipidea-fix-link-error-when-usb_ehci_hcd-is-a-module.patch new file mode 100644 index 00000000000..ef575f4f80b --- /dev/null +++ b/queue-3.9/usb-chipidea-fix-link-error-when-usb_ehci_hcd-is-a-module.patch @@ -0,0 +1,35 @@ +From 7c8bfed7aaeba690de30835fe89882e1047a55fd Mon Sep 17 00:00:00 2001 +From: David Rientjes +Date: Fri, 26 Apr 2013 13:25:01 -0700 +Subject: usb, chipidea: fix link error when USB_EHCI_HCD is a module + +From: David Rientjes + +commit 7c8bfed7aaeba690de30835fe89882e1047a55fd upstream. + +Fixes link error when USB_EHCI_HCD=m and USB_CHIPIDEA_HOST=y: + + drivers/built-in.o: In function `ci_hdrc_host_init': + drivers/usb/chipidea/host.c:104: undefined reference to `ehci_init_driver' + +as a result of commit 09f6ffde2ece ("USB: EHCI: fix build error by making +ChipIdea host a normal EHCI driver"). + +Signed-off-by: David Rientjes +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/chipidea/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/chipidea/Kconfig ++++ b/drivers/usb/chipidea/Kconfig +@@ -20,7 +20,7 @@ config USB_CHIPIDEA_UDC + config USB_CHIPIDEA_HOST + bool "ChipIdea host controller" + depends on USB=y || USB=USB_CHIPIDEA +- depends on USB_EHCI_HCD ++ depends on USB_EHCI_HCD=y + select USB_EHCI_ROOT_HUB_TT + help + Say Y here to enable host controller functionality of the diff --git a/queue-3.9/usb-cxacru-potential-underflow-in-cxacru_cm_get_array.patch b/queue-3.9/usb-cxacru-potential-underflow-in-cxacru_cm_get_array.patch new file mode 100644 index 00000000000..990ce8a22e6 --- /dev/null +++ b/queue-3.9/usb-cxacru-potential-underflow-in-cxacru_cm_get_array.patch @@ -0,0 +1,32 @@ +From 2a0ebf80aa95cc758d4725f74a7016e992606a39 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Sun, 19 May 2013 21:52:20 +0300 +Subject: USB: cxacru: potential underflow in cxacru_cm_get_array() + +From: Dan Carpenter + +commit 2a0ebf80aa95cc758d4725f74a7016e992606a39 upstream. + +The value of "offd" comes off the instance->rcv_buf[] and we used it as +the offset into an array. The problem is that we check the upper bound +but not for negative values. + +Signed-off-by: Dan Carpenter +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/atm/cxacru.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/usb/atm/cxacru.c ++++ b/drivers/usb/atm/cxacru.c +@@ -686,7 +686,8 @@ static int cxacru_cm_get_array(struct cx + { + int ret, len; + __le32 *buf; +- int offb, offd; ++ int offb; ++ unsigned int offd; + const int stride = CMD_PACKET_SIZE / (4 * 2) - 1; + int buflen = ((size - 1) / stride + 1 + size * 2) * 4; + diff --git a/queue-3.9/usb-ftdi_sio-add-support-for-newport-conex-motor-drivers.patch b/queue-3.9/usb-ftdi_sio-add-support-for-newport-conex-motor-drivers.patch new file mode 100644 index 00000000000..5555f82fd8a --- /dev/null +++ b/queue-3.9/usb-ftdi_sio-add-support-for-newport-conex-motor-drivers.patch @@ -0,0 +1,57 @@ +From 7138143972b7c293267c783fc99a194f0ceff7f2 Mon Sep 17 00:00:00 2001 +From: "Gomella, Andrew (NIH/NHLBI) [F]" +Date: Fri, 17 May 2013 17:39:46 +0000 +Subject: USB: ftdi_sio: Add support for Newport CONEX motor drivers + +From: "Gomella, Andrew (NIH/NHLBI) [F]" + +commit 7138143972b7c293267c783fc99a194f0ceff7f2 upstream. + +Here are two more devices that use FTDI USB-to-serial chips with new product ID's. + +The devices are the Newport Conex-AGP and Conex-CC motor controllers. +(http://www.newport.com/CONEX-AGP-Integrated-Piezo-Motor-Rotation-Stages-/987623/1033/info.aspx) +(http://www.newport.com/CONEX-CC-DC-Servo-Controller-Actuators/934114/1033/info.aspx) + +usb-devices command yields: + +P: Vendor=104d ProdID=3002 Rev=06.00 +S: Manufacturer=Newport +S: Product=CONEX-CC + +as well as + +P: Vendor=104d ProdID=3006 Rev=06.00 +S: Manufacturer=Newport +S: Product=CONEX-AGP + +Signed-off-by: Andrew Gomella +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/ftdi_sio.c | 2 ++ + drivers/usb/serial/ftdi_sio_ids.h | 2 ++ + 2 files changed, 4 insertions(+) + +--- a/drivers/usb/serial/ftdi_sio.c ++++ b/drivers/usb/serial/ftdi_sio.c +@@ -191,6 +191,8 @@ static struct usb_device_id id_table_com + { USB_DEVICE(FTDI_VID, FTDI_OPENDCC_GBM_PID) }, + { USB_DEVICE(FTDI_VID, FTDI_OPENDCC_GBM_BOOST_PID) }, + { USB_DEVICE(NEWPORT_VID, NEWPORT_AGILIS_PID) }, ++ { USB_DEVICE(NEWPORT_VID, NEWPORT_CONEX_CC_PID) }, ++ { USB_DEVICE(NEWPORT_VID, NEWPORT_CONEX_AGP_PID) }, + { USB_DEVICE(INTERBIOMETRICS_VID, INTERBIOMETRICS_IOBOARD_PID) }, + { USB_DEVICE(INTERBIOMETRICS_VID, INTERBIOMETRICS_MINI_IOBOARD_PID) }, + { USB_DEVICE(FTDI_VID, FTDI_SPROG_II) }, +--- a/drivers/usb/serial/ftdi_sio_ids.h ++++ b/drivers/usb/serial/ftdi_sio_ids.h +@@ -772,6 +772,8 @@ + */ + #define NEWPORT_VID 0x104D + #define NEWPORT_AGILIS_PID 0x3000 ++#define NEWPORT_CONEX_CC_PID 0x3002 ++#define NEWPORT_CONEX_AGP_PID 0x3006 + + /* Interbiometrics USB I/O Board */ + /* Developed for Interbiometrics by Rudolf Gugler */ diff --git a/queue-3.9/usb-option-add-device-ids-for-dell-5804-novatel-e371-wwan-card.patch b/queue-3.9/usb-option-add-device-ids-for-dell-5804-novatel-e371-wwan-card.patch new file mode 100644 index 00000000000..74e03aae684 --- /dev/null +++ b/queue-3.9/usb-option-add-device-ids-for-dell-5804-novatel-e371-wwan-card.patch @@ -0,0 +1,36 @@ +From 49c6e370dd6400b84897c4100095089b5c13a061 Mon Sep 17 00:00:00 2001 +From: Dan Williams +Date: Mon, 6 May 2013 16:16:44 -0500 +Subject: USB: option: add device IDs for Dell 5804 (Novatel E371) WWAN card + +From: Dan Williams + +commit 49c6e370dd6400b84897c4100095089b5c13a061 upstream. + +A rebranded Novatel E371 for AT&T's LTE bands. + +Signed-off-by: Dan Williams +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/option.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -196,6 +196,7 @@ static void option_instat_callback(struc + + #define DELL_PRODUCT_5800_MINICARD_VZW 0x8195 /* Novatel E362 */ + #define DELL_PRODUCT_5800_V2_MINICARD_VZW 0x8196 /* Novatel E362 */ ++#define DELL_PRODUCT_5804_MINICARD_ATT 0x819b /* Novatel E371 */ + + #define KYOCERA_VENDOR_ID 0x0c88 + #define KYOCERA_PRODUCT_KPC650 0x17da +@@ -771,6 +772,7 @@ static const struct usb_device_id option + { USB_DEVICE(DELL_VENDOR_ID, DELL_PRODUCT_5730_MINICARD_VZW) }, /* Dell Wireless 5730 Mobile Broadband EVDO/HSPA Mini-Card */ + { USB_DEVICE_AND_INTERFACE_INFO(DELL_VENDOR_ID, DELL_PRODUCT_5800_MINICARD_VZW, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(DELL_VENDOR_ID, DELL_PRODUCT_5800_V2_MINICARD_VZW, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(DELL_VENDOR_ID, DELL_PRODUCT_5804_MINICARD_ATT, 0xff, 0xff, 0xff) }, + { USB_DEVICE(ANYDATA_VENDOR_ID, ANYDATA_PRODUCT_ADU_E100A) }, /* ADU-E100, ADU-310 */ + { USB_DEVICE(ANYDATA_VENDOR_ID, ANYDATA_PRODUCT_ADU_500A) }, + { USB_DEVICE(ANYDATA_VENDOR_ID, ANYDATA_PRODUCT_ADU_620UW) }, diff --git a/queue-3.9/usb-option-add-telewell-tw-lte-4g.patch b/queue-3.9/usb-option-add-telewell-tw-lte-4g.patch new file mode 100644 index 00000000000..f8259aa1d29 --- /dev/null +++ b/queue-3.9/usb-option-add-telewell-tw-lte-4g.patch @@ -0,0 +1,35 @@ +From 73c042df6e1bc50544842a04b777b36bbe3630e6 Mon Sep 17 00:00:00 2001 +From: Teppo Kotilainen +Date: Fri, 3 May 2013 10:28:12 +0300 +Subject: usb: option: Add Telewell TW-LTE 4G + +From: Teppo Kotilainen + +commit 73c042df6e1bc50544842a04b777b36bbe3630e6 upstream. + +Information from driver description files: + + diag: VID_19D2&PID_0412&MI_00 + nmea: VID_19D2&PID_0412&MI_01 + at: VID_19D2&PID_0412&MI_02 + modem: VID_19D2&PID_0412&MI_03 + net: VID_19D2&PID_0412&MI_04 + +Signed-off-by: Teppo Kotilainen +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/option.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -966,6 +966,8 @@ static const struct usb_device_id option + .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0330, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0395, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0412, 0xff, 0xff, 0xff), /* Telewell TW-LTE 4G */ ++ .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0414, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0417, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1008, 0xff, 0xff, 0xff), diff --git a/queue-3.9/usb-reset-resume-quirk-needed-by-a-hub.patch b/queue-3.9/usb-reset-resume-quirk-needed-by-a-hub.patch new file mode 100644 index 00000000000..c94386c70ae --- /dev/null +++ b/queue-3.9/usb-reset-resume-quirk-needed-by-a-hub.patch @@ -0,0 +1,30 @@ +From bac6b03275184c912ad0818c9a0a736847804dca Mon Sep 17 00:00:00 2001 +From: Oliver Neukum +Date: Tue, 30 Apr 2013 10:18:04 +0200 +Subject: USB: reset resume quirk needed by a hub + +From: Oliver Neukum + +commit bac6b03275184c912ad0818c9a0a736847804dca upstream. + +Werner Fink has reported problems with this hub. + +Signed-off-by: Oliver Neukum +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/quirks.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/usb/core/quirks.c ++++ b/drivers/usb/core/quirks.c +@@ -88,6 +88,9 @@ static const struct usb_device_id usb_qu + /* Edirol SD-20 */ + { USB_DEVICE(0x0582, 0x0027), .driver_info = USB_QUIRK_RESET_RESUME }, + ++ /* Alcor Micro Corp. Hub */ ++ { USB_DEVICE(0x058f, 0x9254), .driver_info = USB_QUIRK_RESET_RESUME }, ++ + /* appletouch */ + { USB_DEVICE(0x05ac, 0x021a), .driver_info = USB_QUIRK_RESET_RESUME }, + diff --git a/queue-3.9/usb-uhci-fix-for-suspend-of-virtual-hp-controller.patch b/queue-3.9/usb-uhci-fix-for-suspend-of-virtual-hp-controller.patch new file mode 100644 index 00000000000..3e7698afc8b --- /dev/null +++ b/queue-3.9/usb-uhci-fix-for-suspend-of-virtual-hp-controller.patch @@ -0,0 +1,39 @@ +From 997ff893603c6455da4c5e26ba1d0f81adfecdfc Mon Sep 17 00:00:00 2001 +From: Alan Stern +Date: Tue, 14 May 2013 13:55:29 -0400 +Subject: USB: UHCI: fix for suspend of virtual HP controller + +From: Alan Stern + +commit 997ff893603c6455da4c5e26ba1d0f81adfecdfc upstream. + +HP's virtual UHCI host controller takes a long time to suspend +(several hundred microseconds), even when no devices are attached. +This provokes a warning message from uhci-hcd in the auto-stop case. + +To prevent this from happening, this patch adds a test to avoid +performing an auto-stop when the wait_for_hp quirk flag is set. The +controller will still suspend through the normal runtime PM mechanism. +And since that pathway includes a 1-ms delay, the slowness of the +virtual hardware won't matter. + +Signed-off-by: Alan Stern +Reported-and-tested-by: ZhenHua +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/uhci-hub.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/usb/host/uhci-hub.c ++++ b/drivers/usb/host/uhci-hub.c +@@ -225,7 +225,8 @@ static int uhci_hub_status_data(struct u + /* auto-stop if nothing connected for 1 second */ + if (any_ports_active(uhci)) + uhci->rh_state = UHCI_RH_RUNNING; +- else if (time_after_eq(jiffies, uhci->auto_stop_time)) ++ else if (time_after_eq(jiffies, uhci->auto_stop_time) && ++ !uhci->wait_for_hp) + suspend_rh(uhci, UHCI_RH_AUTO_STOPPED); + break; + diff --git a/queue-3.9/usb-xhci-override-bogus-bulk-wmaxpacketsize-values.patch b/queue-3.9/usb-xhci-override-bogus-bulk-wmaxpacketsize-values.patch new file mode 100644 index 00000000000..1b9e79811c0 --- /dev/null +++ b/queue-3.9/usb-xhci-override-bogus-bulk-wmaxpacketsize-values.patch @@ -0,0 +1,79 @@ +From e4f47e3675e6f1f40906b785b934ce963e9f2eb3 Mon Sep 17 00:00:00 2001 +From: Alan Stern +Date: Wed, 8 May 2013 11:18:05 -0400 +Subject: USB: xHCI: override bogus bulk wMaxPacketSize values + +From: Alan Stern + +commit e4f47e3675e6f1f40906b785b934ce963e9f2eb3 upstream. + +This patch shortens the logic in xhci_endpoint_init() by moving common +calculations involving max_packet and max_burst outside the switch +statement, rather than repeating the same code in multiple +case-specific statements. It also replaces two usages of max_packet +which were clearly intended to be max_burst all along. + +More importantly, it compensates for a common bug in high-speed bulk +endpoint descriptors. In many devices there is a bulk endpoint having +a wMaxPacketSize value smaller than 512, which is forbidden by the USB +spec. Some xHCI controllers can't handle this and refuse to accept +the endpoint. This patch changes the max_packet value to 512, which +allows the controller to use the endpoint properly. + +In practice the bogus maxpacket size doesn't matter, because none of +the transfers sent via these endpoints are longer than the maxpacket +value anyway. + +Signed-off-by: Alan Stern +Reported-and-tested-by: "Aurélien Leblond" +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/xhci-mem.c | 17 +++++++++-------- + 1 file changed, 9 insertions(+), 8 deletions(-) + +--- a/drivers/usb/host/xhci-mem.c ++++ b/drivers/usb/host/xhci-mem.c +@@ -1423,15 +1423,17 @@ int xhci_endpoint_init(struct xhci_hcd * + ep_ctx->ep_info2 |= cpu_to_le32(xhci_get_endpoint_type(udev, ep)); + + /* Set the max packet size and max burst */ ++ max_packet = GET_MAX_PACKET(usb_endpoint_maxp(&ep->desc)); ++ max_burst = 0; + switch (udev->speed) { + case USB_SPEED_SUPER: +- max_packet = usb_endpoint_maxp(&ep->desc); +- ep_ctx->ep_info2 |= cpu_to_le32(MAX_PACKET(max_packet)); + /* dig out max burst from ep companion desc */ +- max_packet = ep->ss_ep_comp.bMaxBurst; +- ep_ctx->ep_info2 |= cpu_to_le32(MAX_BURST(max_packet)); ++ max_burst = ep->ss_ep_comp.bMaxBurst; + break; + case USB_SPEED_HIGH: ++ /* Some devices get this wrong */ ++ if (usb_endpoint_xfer_bulk(&ep->desc)) ++ max_packet = 512; + /* bits 11:12 specify the number of additional transaction + * opportunities per microframe (USB 2.0, section 9.6.6) + */ +@@ -1439,17 +1441,16 @@ int xhci_endpoint_init(struct xhci_hcd * + usb_endpoint_xfer_int(&ep->desc)) { + max_burst = (usb_endpoint_maxp(&ep->desc) + & 0x1800) >> 11; +- ep_ctx->ep_info2 |= cpu_to_le32(MAX_BURST(max_burst)); + } +- /* Fall through */ ++ break; + case USB_SPEED_FULL: + case USB_SPEED_LOW: +- max_packet = GET_MAX_PACKET(usb_endpoint_maxp(&ep->desc)); +- ep_ctx->ep_info2 |= cpu_to_le32(MAX_PACKET(max_packet)); + break; + default: + BUG(); + } ++ ep_ctx->ep_info2 |= cpu_to_le32(MAX_PACKET(max_packet) | ++ MAX_BURST(max_burst)); + max_esit_payload = xhci_get_max_esit_payload(xhci, udev, ep); + ep_ctx->tx_info = cpu_to_le32(MAX_ESIT_PAYLOAD_FOR_EP(max_esit_payload)); +