From: Greg Kroah-Hartman Date: Tue, 25 Sep 2012 21:20:18 +0000 (-0700) Subject: 3.4-stable patches X-Git-Tag: v3.0.44~68 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=33759fcf98686f95edf2e4597b6d0bb0077cb3e0;p=thirdparty%2Fkernel%2Fstable-queue.git 3.4-stable patches added patches: brcmfmac-fix-big-endian-bug-in-i-scan.patch brcmfmac-fix-big-endian-host-configuration-data.patch cifs-fix-return-value-in-cifsconverttoutf16.patch hid-fix-logitech-dj-missing-unifying-device-issue.patch hwmon-ad7314-add-name-sysfs-attribute.patch hwmon-ads7871-add-name-sysfs-attribute.patch hwmon-fam15h_power-tweak-runavg_range-on-resume.patch ibmveth-fix-alignment-of-rx-queue-bug.patch mac80211-clear-bssid-on-auth-assoc-failure.patch vmwgfx-add-dumb-ioctl-support.patch --- diff --git a/queue-3.4/brcmfmac-fix-big-endian-bug-in-i-scan.patch b/queue-3.4/brcmfmac-fix-big-endian-bug-in-i-scan.patch new file mode 100644 index 00000000000..26800981689 --- /dev/null +++ b/queue-3.4/brcmfmac-fix-big-endian-bug-in-i-scan.patch @@ -0,0 +1,35 @@ +From ed205b361956c96e0d8c09a8c9135a6a79cd9541 Mon Sep 17 00:00:00 2001 +From: Hante Meuleman +Date: Tue, 11 Sep 2012 21:16:47 +0200 +Subject: brcmfmac: fix big endian bug in i-scan. + +From: Hante Meuleman + +commit ed205b361956c96e0d8c09a8c9135a6a79cd9541 upstream. + +ssid len is 32 bit and needs endian conversion for big endian systems. + +Signed-off-by: Hante Meuleman +Signed-off-by: Arend van Spriel +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c ++++ b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c +@@ -500,8 +500,10 @@ static void wl_iscan_prep(struct brcmf_s + params_le->active_time = cpu_to_le32(-1); + params_le->passive_time = cpu_to_le32(-1); + params_le->home_time = cpu_to_le32(-1); +- if (ssid && ssid->SSID_len) +- memcpy(¶ms_le->ssid_le, ssid, sizeof(struct brcmf_ssid)); ++ if (ssid && ssid->SSID_len) { ++ params_le->ssid_le.SSID_len = cpu_to_le32(ssid->SSID_len); ++ memcpy(¶ms_le->ssid_le.SSID, ssid->SSID, ssid->SSID_len); ++ } + } + + static s32 diff --git a/queue-3.4/brcmfmac-fix-big-endian-host-configuration-data.patch b/queue-3.4/brcmfmac-fix-big-endian-host-configuration-data.patch new file mode 100644 index 00000000000..19b57a1ad64 --- /dev/null +++ b/queue-3.4/brcmfmac-fix-big-endian-host-configuration-data.patch @@ -0,0 +1,93 @@ +From e020a83d0942a5aceac35986500c9834efc8707d Mon Sep 17 00:00:00 2001 +From: Hante Meuleman +Date: Tue, 11 Sep 2012 21:16:48 +0200 +Subject: brcmfmac: Fix big endian host configuration data. + +From: Hante Meuleman + +commit e020a83d0942a5aceac35986500c9834efc8707d upstream. + +Fixes big endian host configuration parameters. + +Reviewed-by: Arend Van Spriel +Signed-off-by: Hante Meuleman +Signed-off-by: Arend van Spriel +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/brcm80211/brcmfmac/dhd_common.c | 26 +++++++++++-------- + 1 file changed, 16 insertions(+), 10 deletions(-) + +--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_common.c ++++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_common.c +@@ -764,8 +764,11 @@ static void brcmf_c_arp_offload_set(stru + { + char iovbuf[32]; + int retcode; ++ __le32 arp_mode_le; + +- brcmf_c_mkiovar("arp_ol", (char *)&arp_mode, 4, iovbuf, sizeof(iovbuf)); ++ arp_mode_le = cpu_to_le32(arp_mode); ++ brcmf_c_mkiovar("arp_ol", (char *)&arp_mode_le, 4, iovbuf, ++ sizeof(iovbuf)); + retcode = brcmf_proto_cdc_set_dcmd(drvr, 0, BRCMF_C_SET_VAR, + iovbuf, sizeof(iovbuf)); + retcode = retcode >= 0 ? 0 : retcode; +@@ -781,8 +784,11 @@ static void brcmf_c_arp_offload_enable(s + { + char iovbuf[32]; + int retcode; ++ __le32 arp_enable_le; + +- brcmf_c_mkiovar("arpoe", (char *)&arp_enable, 4, ++ arp_enable_le = cpu_to_le32(arp_enable); ++ ++ brcmf_c_mkiovar("arpoe", (char *)&arp_enable_le, 4, + iovbuf, sizeof(iovbuf)); + retcode = brcmf_proto_cdc_set_dcmd(drvr, 0, BRCMF_C_SET_VAR, + iovbuf, sizeof(iovbuf)); +@@ -803,10 +809,10 @@ int brcmf_c_preinit_dcmds(struct brcmf_p + char buf[128], *ptr; + u32 dongle_align = drvr->bus_if->align; + u32 glom = 0; +- u32 roaming = 1; +- uint bcn_timeout = 3; +- int scan_assoc_time = 40; +- int scan_unassoc_time = 40; ++ __le32 roaming_le = cpu_to_le32(1); ++ __le32 bcn_timeout_le = cpu_to_le32(3); ++ __le32 scan_assoc_time_le = cpu_to_le32(40); ++ __le32 scan_unassoc_time_le = cpu_to_le32(40); + int i; + + mutex_lock(&drvr->proto_block); +@@ -841,14 +847,14 @@ int brcmf_c_preinit_dcmds(struct brcmf_p + + /* Setup timeout if Beacons are lost and roam is off to report + link down */ +- brcmf_c_mkiovar("bcn_timeout", (char *)&bcn_timeout, 4, iovbuf, ++ brcmf_c_mkiovar("bcn_timeout", (char *)&bcn_timeout_le, 4, iovbuf, + sizeof(iovbuf)); + brcmf_proto_cdc_set_dcmd(drvr, 0, BRCMF_C_SET_VAR, iovbuf, + sizeof(iovbuf)); + + /* Enable/Disable build-in roaming to allowed ext supplicant to take + of romaing */ +- brcmf_c_mkiovar("roam_off", (char *)&roaming, 4, ++ brcmf_c_mkiovar("roam_off", (char *)&roaming_le, 4, + iovbuf, sizeof(iovbuf)); + brcmf_proto_cdc_set_dcmd(drvr, 0, BRCMF_C_SET_VAR, iovbuf, + sizeof(iovbuf)); +@@ -863,9 +869,9 @@ int brcmf_c_preinit_dcmds(struct brcmf_p + sizeof(iovbuf)); + + brcmf_proto_cdc_set_dcmd(drvr, 0, BRCMF_C_SET_SCAN_CHANNEL_TIME, +- (char *)&scan_assoc_time, sizeof(scan_assoc_time)); ++ (char *)&scan_assoc_time_le, sizeof(scan_assoc_time_le)); + brcmf_proto_cdc_set_dcmd(drvr, 0, BRCMF_C_SET_SCAN_UNASSOC_TIME, +- (char *)&scan_unassoc_time, sizeof(scan_unassoc_time)); ++ (char *)&scan_unassoc_time_le, sizeof(scan_unassoc_time_le)); + + /* Set and enable ARP offload feature */ + brcmf_c_arp_offload_set(drvr, BRCMF_ARPOL_MODE); diff --git a/queue-3.4/cifs-fix-return-value-in-cifsconverttoutf16.patch b/queue-3.4/cifs-fix-return-value-in-cifsconverttoutf16.patch new file mode 100644 index 00000000000..7bfa9ece5bc --- /dev/null +++ b/queue-3.4/cifs-fix-return-value-in-cifsconverttoutf16.patch @@ -0,0 +1,35 @@ +From c73f693989d7a7d99ec66a7065295a0c93d0b127 Mon Sep 17 00:00:00 2001 +From: Jeff Layton +Date: Tue, 18 Sep 2012 14:21:01 -0400 +Subject: cifs: fix return value in cifsConvertToUTF16 + +From: Jeff Layton + +commit c73f693989d7a7d99ec66a7065295a0c93d0b127 upstream. + +This function returns the wrong value, which causes the callers to get +the length of the resulting pathname wrong when it contains non-ASCII +characters. + +This seems to fix https://bugzilla.samba.org/show_bug.cgi?id=6767 + +Reported-by: Baldvin Kovacs +Reported-and-Tested-by: Nicolas Lefebvre +Signed-off-by: Jeff Layton +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman + +--- + fs/cifs/cifs_unicode.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/cifs/cifs_unicode.c ++++ b/fs/cifs/cifs_unicode.c +@@ -328,6 +328,6 @@ cifsConvertToUTF16(__le16 *target, const + } + + ctoUTF16_out: +- return i; ++ return j; + } + diff --git a/queue-3.4/hid-fix-logitech-dj-missing-unifying-device-issue.patch b/queue-3.4/hid-fix-logitech-dj-missing-unifying-device-issue.patch new file mode 100644 index 00000000000..a7690a12ffa --- /dev/null +++ b/queue-3.4/hid-fix-logitech-dj-missing-unifying-device-issue.patch @@ -0,0 +1,143 @@ +From 596264082f10dd4a567c43d4526b2f54ac5520bc Mon Sep 17 00:00:00 2001 +From: Nestor Lopez Casado +Date: Fri, 21 Sep 2012 12:21:34 +0200 +Subject: HID: Fix logitech-dj: missing Unifying device issue + +From: Nestor Lopez Casado + +commit 596264082f10dd4a567c43d4526b2f54ac5520bc upstream. + +This patch fixes an issue introduced after commit 4ea5454203d991ec +("HID: Fix race condition between driver core and ll-driver"). + +After that commit, hid-core discards any incoming packet that arrives while +hid driver's probe function is being executed. + +This broke the enumeration process of hid-logitech-dj, that must receive +control packets in-band with the mouse and keyboard packets. Discarding mouse +or keyboard data at the very begining is usually fine, but it is not the case +for control packets. + +This patch forces a re-enumeration of the paired devices when a packet arrives +that comes from an unknown device. + +Based on a patch originally written by Benjamin Tissoires. + +Signed-off-by: Nestor Lopez Casado +Signed-off-by: Jiri Kosina +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hid/hid-logitech-dj.c | 41 +++++++++++++++++++++++++++++++++++++++++ + drivers/hid/hid-logitech-dj.h | 1 + + 2 files changed, 42 insertions(+) + +--- a/drivers/hid/hid-logitech-dj.c ++++ b/drivers/hid/hid-logitech-dj.c +@@ -185,6 +185,7 @@ static struct hid_ll_driver logi_dj_ll_d + static int logi_dj_output_hidraw_report(struct hid_device *hid, u8 * buf, + size_t count, + unsigned char report_type); ++static int logi_dj_recv_query_paired_devices(struct dj_receiver_dev *djrcv_dev); + + static void logi_dj_recv_destroy_djhid_device(struct dj_receiver_dev *djrcv_dev, + struct dj_report *dj_report) +@@ -225,6 +226,7 @@ static void logi_dj_recv_add_djhid_devic + if (dj_report->report_params[DEVICE_PAIRED_PARAM_SPFUNCTION] & + SPFUNCTION_DEVICE_LIST_EMPTY) { + dbg_hid("%s: device list is empty\n", __func__); ++ djrcv_dev->querying_devices = false; + return; + } + +@@ -235,6 +237,12 @@ static void logi_dj_recv_add_djhid_devic + return; + } + ++ if (djrcv_dev->paired_dj_devices[dj_report->device_index]) { ++ /* The device is already known. No need to reallocate it. */ ++ dbg_hid("%s: device is already known\n", __func__); ++ return; ++ } ++ + dj_hiddev = hid_allocate_device(); + if (IS_ERR(dj_hiddev)) { + dev_err(&djrcv_hdev->dev, "%s: hid_allocate_device failed\n", +@@ -298,6 +306,7 @@ static void delayedwork_callback(struct + struct dj_report dj_report; + unsigned long flags; + int count; ++ int retval; + + dbg_hid("%s\n", __func__); + +@@ -330,6 +339,25 @@ static void delayedwork_callback(struct + logi_dj_recv_destroy_djhid_device(djrcv_dev, &dj_report); + break; + default: ++ /* A normal report (i. e. not belonging to a pair/unpair notification) ++ * arriving here, means that the report arrived but we did not have a ++ * paired dj_device associated to the report's device_index, this ++ * means that the original "device paired" notification corresponding ++ * to this dj_device never arrived to this driver. The reason is that ++ * hid-core discards all packets coming from a device while probe() is ++ * executing. */ ++ if (!djrcv_dev->paired_dj_devices[dj_report.device_index]) { ++ /* ok, we don't know the device, just re-ask the ++ * receiver for the list of connected devices. */ ++ retval = logi_dj_recv_query_paired_devices(djrcv_dev); ++ if (!retval) { ++ /* everything went fine, so just leave */ ++ break; ++ } ++ dev_err(&djrcv_dev->hdev->dev, ++ "%s:logi_dj_recv_query_paired_devices " ++ "error:%d\n", __func__, retval); ++ } + dbg_hid("%s: unexpected report type\n", __func__); + } + } +@@ -360,6 +388,12 @@ static void logi_dj_recv_forward_null_re + if (!djdev) { + dbg_hid("djrcv_dev->paired_dj_devices[dj_report->device_index]" + " is NULL, index %d\n", dj_report->device_index); ++ kfifo_in(&djrcv_dev->notif_fifo, dj_report, sizeof(struct dj_report)); ++ ++ if (schedule_work(&djrcv_dev->work) == 0) { ++ dbg_hid("%s: did not schedule the work item, was already " ++ "queued\n", __func__); ++ } + return; + } + +@@ -390,6 +424,12 @@ static void logi_dj_recv_forward_report( + if (dj_device == NULL) { + dbg_hid("djrcv_dev->paired_dj_devices[dj_report->device_index]" + " is NULL, index %d\n", dj_report->device_index); ++ kfifo_in(&djrcv_dev->notif_fifo, dj_report, sizeof(struct dj_report)); ++ ++ if (schedule_work(&djrcv_dev->work) == 0) { ++ dbg_hid("%s: did not schedule the work item, was already " ++ "queued\n", __func__); ++ } + return; + } + +@@ -437,6 +477,7 @@ static int logi_dj_recv_query_paired_dev + return logi_dj_recv_send_report(djrcv_dev, &dj_report); + } + ++ + static int logi_dj_recv_switch_to_dj_mode(struct dj_receiver_dev *djrcv_dev, + unsigned timeout) + { +--- a/drivers/hid/hid-logitech-dj.h ++++ b/drivers/hid/hid-logitech-dj.h +@@ -101,6 +101,7 @@ struct dj_receiver_dev { + struct work_struct work; + struct kfifo notif_fifo; + spinlock_t lock; ++ bool querying_devices; + }; + + struct dj_device { diff --git a/queue-3.4/hwmon-ad7314-add-name-sysfs-attribute.patch b/queue-3.4/hwmon-ad7314-add-name-sysfs-attribute.patch new file mode 100644 index 00000000000..49fb3fa361e --- /dev/null +++ b/queue-3.4/hwmon-ad7314-add-name-sysfs-attribute.patch @@ -0,0 +1,43 @@ +From 3ceefe4319636d89d4bdf40dca9471970f942e4f Mon Sep 17 00:00:00 2001 +From: Guenter Roeck +Date: Tue, 11 Sep 2012 13:43:17 -0700 +Subject: hwmon: (ad7314) Add 'name' sysfs attribute + +From: Guenter Roeck + +commit 3ceefe4319636d89d4bdf40dca9471970f942e4f upstream. + +The 'name' sysfs attribute is mandatory for hwmon devices, but was missing +in this driver. + +Cc: Jonathan Cameron +Signed-off-by: Guenter Roeck +Acked-by: Jean Delvare +Acked-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwmon/ad7314.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/drivers/hwmon/ad7314.c ++++ b/drivers/hwmon/ad7314.c +@@ -94,10 +94,18 @@ static ssize_t ad7314_show_temperature(s + } + } + ++static ssize_t ad7314_show_name(struct device *dev, ++ struct device_attribute *devattr, char *buf) ++{ ++ return sprintf(buf, "%s\n", to_spi_device(dev)->modalias); ++} ++ ++static DEVICE_ATTR(name, S_IRUGO, ad7314_show_name, NULL); + static SENSOR_DEVICE_ATTR(temp1_input, S_IRUGO, + ad7314_show_temperature, NULL, 0); + + static struct attribute *ad7314_attributes[] = { ++ &dev_attr_name.attr, + &sensor_dev_attr_temp1_input.dev_attr.attr, + NULL, + }; diff --git a/queue-3.4/hwmon-ads7871-add-name-sysfs-attribute.patch b/queue-3.4/hwmon-ads7871-add-name-sysfs-attribute.patch new file mode 100644 index 00000000000..a5c65176379 --- /dev/null +++ b/queue-3.4/hwmon-ads7871-add-name-sysfs-attribute.patch @@ -0,0 +1,54 @@ +From 4e21f4eaa49f78d3e977e316514c941053871c76 Mon Sep 17 00:00:00 2001 +From: Guenter Roeck +Date: Tue, 11 Sep 2012 13:39:08 -0700 +Subject: hwmon: (ads7871) Add 'name' sysfs attribute + +From: Guenter Roeck + +commit 4e21f4eaa49f78d3e977e316514c941053871c76 upstream. + +The 'name' sysfs attribute is mandatory for hwmon devices, but was missing +in this driver. + +Cc: Paul Thomas +Signed-off-by: Guenter Roeck +Acked-by: Jean Delvare +Acked-by: Paul Thomas +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwmon/ads7871.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +--- a/drivers/hwmon/ads7871.c ++++ b/drivers/hwmon/ads7871.c +@@ -139,6 +139,12 @@ static ssize_t show_voltage(struct devic + } + } + ++static ssize_t ads7871_show_name(struct device *dev, ++ struct device_attribute *devattr, char *buf) ++{ ++ return sprintf(buf, "%s\n", to_spi_device(dev)->modalias); ++} ++ + static SENSOR_DEVICE_ATTR(in0_input, S_IRUGO, show_voltage, NULL, 0); + static SENSOR_DEVICE_ATTR(in1_input, S_IRUGO, show_voltage, NULL, 1); + static SENSOR_DEVICE_ATTR(in2_input, S_IRUGO, show_voltage, NULL, 2); +@@ -148,6 +154,8 @@ static SENSOR_DEVICE_ATTR(in5_input, S_I + static SENSOR_DEVICE_ATTR(in6_input, S_IRUGO, show_voltage, NULL, 6); + static SENSOR_DEVICE_ATTR(in7_input, S_IRUGO, show_voltage, NULL, 7); + ++static DEVICE_ATTR(name, S_IRUGO, ads7871_show_name, NULL); ++ + static struct attribute *ads7871_attributes[] = { + &sensor_dev_attr_in0_input.dev_attr.attr, + &sensor_dev_attr_in1_input.dev_attr.attr, +@@ -157,6 +165,7 @@ static struct attribute *ads7871_attribu + &sensor_dev_attr_in5_input.dev_attr.attr, + &sensor_dev_attr_in6_input.dev_attr.attr, + &sensor_dev_attr_in7_input.dev_attr.attr, ++ &dev_attr_name.attr, + NULL + }; + diff --git a/queue-3.4/hwmon-fam15h_power-tweak-runavg_range-on-resume.patch b/queue-3.4/hwmon-fam15h_power-tweak-runavg_range-on-resume.patch new file mode 100644 index 00000000000..4956a293f25 --- /dev/null +++ b/queue-3.4/hwmon-fam15h_power-tweak-runavg_range-on-resume.patch @@ -0,0 +1,67 @@ +From 5f0ecb907deb1e6f28071ee3bd568903b9da1be4 Mon Sep 17 00:00:00 2001 +From: Andreas Herrmann +Date: Sun, 23 Sep 2012 20:27:32 +0200 +Subject: hwmon: (fam15h_power) Tweak runavg_range on resume + +From: Andreas Herrmann + +commit 5f0ecb907deb1e6f28071ee3bd568903b9da1be4 upstream. + +The quirk introduced with commit +00250ec90963b7ef6678438888f3244985ecde14 (hwmon: fam15h_power: fix +bogus values with current BIOSes) is not only required during driver +load but also when system resumes from suspend. The BIOS might set the +previously recommended (but unsuitable) initilization value for the +running average range register during resume. + +Signed-off-by: Andreas Herrmann +Tested-by: Andreas Hartmann +Signed-off-by: Jean Delvare +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwmon/fam15h_power.c | 15 +++++++++++++-- + 1 file changed, 13 insertions(+), 2 deletions(-) + +--- a/drivers/hwmon/fam15h_power.c ++++ b/drivers/hwmon/fam15h_power.c +@@ -128,12 +128,12 @@ static bool __devinit fam15h_power_is_in + * counter saturations resulting in bogus power readings. + * We correct this value ourselves to cope with older BIOSes. + */ +-static DEFINE_PCI_DEVICE_TABLE(affected_device) = { ++static const struct pci_device_id affected_device[] = { + { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_15H_NB_F4) }, + { 0 } + }; + +-static void __devinit tweak_runavg_range(struct pci_dev *pdev) ++static void tweak_runavg_range(struct pci_dev *pdev) + { + u32 val; + +@@ -157,6 +157,16 @@ static void __devinit tweak_runavg_range + REG_TDP_RUNNING_AVERAGE, val); + } + ++#ifdef CONFIG_PM ++static int fam15h_power_resume(struct pci_dev *pdev) ++{ ++ tweak_runavg_range(pdev); ++ return 0; ++} ++#else ++#define fam15h_power_resume NULL ++#endif ++ + static void __devinit fam15h_power_init_data(struct pci_dev *f4, + struct fam15h_power_data *data) + { +@@ -255,6 +265,7 @@ static struct pci_driver fam15h_power_dr + .id_table = fam15h_power_id_table, + .probe = fam15h_power_probe, + .remove = __devexit_p(fam15h_power_remove), ++ .resume = fam15h_power_resume, + }; + + static int __init fam15h_power_init(void) diff --git a/queue-3.4/ibmveth-fix-alignment-of-rx-queue-bug.patch b/queue-3.4/ibmveth-fix-alignment-of-rx-queue-bug.patch new file mode 100644 index 00000000000..bd7eaf9bd74 --- /dev/null +++ b/queue-3.4/ibmveth-fix-alignment-of-rx-queue-bug.patch @@ -0,0 +1,86 @@ +From d90c92fee89ccd75ef2646f3bde0b4c0450666c3 Mon Sep 17 00:00:00 2001 +From: Santiago Leon +Date: Tue, 4 Sep 2012 14:41:37 +0000 +Subject: ibmveth: Fix alignment of rx queue bug + +From: Santiago Leon + +commit d90c92fee89ccd75ef2646f3bde0b4c0450666c3 upstream. + +This patch fixes a bug found by Nish Aravamudan +(https://lkml.org/lkml/2012/5/15/220) where the driver is not following +the spec (it is not aligning the rx buffer on a 16-byte boundary) and the +hypervisor aborts the registration, making the device unusable. + +The fix follows BenH's recommendation (https://lkml.org/lkml/2012/7/20/461) +to replace the kmalloc+map for a single call to dma_alloc_coherent() +because that function always aligns to a 16-byte boundary. + +The stable trees will run into this bug whenever the rx buffer kmalloc call +returns something not aligned on a 16-byte boundary. + +Signed-off-by: Santiago Leon +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/ethernet/ibm/ibmveth.c | 26 +++++++++----------------- + 1 file changed, 9 insertions(+), 17 deletions(-) + +--- a/drivers/net/ethernet/ibm/ibmveth.c ++++ b/drivers/net/ethernet/ibm/ibmveth.c +@@ -472,14 +472,9 @@ static void ibmveth_cleanup(struct ibmve + } + + if (adapter->rx_queue.queue_addr != NULL) { +- if (!dma_mapping_error(dev, adapter->rx_queue.queue_dma)) { +- dma_unmap_single(dev, +- adapter->rx_queue.queue_dma, +- adapter->rx_queue.queue_len, +- DMA_BIDIRECTIONAL); +- adapter->rx_queue.queue_dma = DMA_ERROR_CODE; +- } +- kfree(adapter->rx_queue.queue_addr); ++ dma_free_coherent(dev, adapter->rx_queue.queue_len, ++ adapter->rx_queue.queue_addr, ++ adapter->rx_queue.queue_dma); + adapter->rx_queue.queue_addr = NULL; + } + +@@ -556,10 +551,13 @@ static int ibmveth_open(struct net_devic + goto err_out; + } + ++ dev = &adapter->vdev->dev; ++ + adapter->rx_queue.queue_len = sizeof(struct ibmveth_rx_q_entry) * + rxq_entries; +- adapter->rx_queue.queue_addr = kmalloc(adapter->rx_queue.queue_len, +- GFP_KERNEL); ++ adapter->rx_queue.queue_addr = ++ dma_alloc_coherent(dev, adapter->rx_queue.queue_len, ++ &adapter->rx_queue.queue_dma, GFP_KERNEL); + + if (!adapter->rx_queue.queue_addr) { + netdev_err(netdev, "unable to allocate rx queue pages\n"); +@@ -567,19 +565,13 @@ static int ibmveth_open(struct net_devic + goto err_out; + } + +- dev = &adapter->vdev->dev; +- + adapter->buffer_list_dma = dma_map_single(dev, + adapter->buffer_list_addr, 4096, DMA_BIDIRECTIONAL); + adapter->filter_list_dma = dma_map_single(dev, + adapter->filter_list_addr, 4096, DMA_BIDIRECTIONAL); +- adapter->rx_queue.queue_dma = dma_map_single(dev, +- adapter->rx_queue.queue_addr, +- adapter->rx_queue.queue_len, DMA_BIDIRECTIONAL); + + if ((dma_mapping_error(dev, adapter->buffer_list_dma)) || +- (dma_mapping_error(dev, adapter->filter_list_dma)) || +- (dma_mapping_error(dev, adapter->rx_queue.queue_dma))) { ++ (dma_mapping_error(dev, adapter->filter_list_dma))) { + netdev_err(netdev, "unable to map filter or buffer list " + "pages\n"); + rc = -ENOMEM; diff --git a/queue-3.4/mac80211-clear-bssid-on-auth-assoc-failure.patch b/queue-3.4/mac80211-clear-bssid-on-auth-assoc-failure.patch new file mode 100644 index 00000000000..1b205d9db0e --- /dev/null +++ b/queue-3.4/mac80211-clear-bssid-on-auth-assoc-failure.patch @@ -0,0 +1,43 @@ +From 3d2abdfdf14f4d6decc2023708211e19b096f4ca Mon Sep 17 00:00:00 2001 +From: Eliad Peller +Date: Tue, 4 Sep 2012 17:44:45 +0300 +Subject: mac80211: clear bssid on auth/assoc failure + +From: Eliad Peller + +commit 3d2abdfdf14f4d6decc2023708211e19b096f4ca upstream. + +ifmgd->bssid wasn't cleared properly in some +auth/assoc failure cases, causing mac80211 and +the low-level driver to go out of sync. + +Clear ifmgd->bssid on failure, and notify the driver. + +Signed-off-by: Eliad Peller +Signed-off-by: Johannes Berg +Signed-off-by: Greg Kroah-Hartman + +--- + net/mac80211/mlme.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/net/mac80211/mlme.c ++++ b/net/mac80211/mlme.c +@@ -3232,6 +3232,8 @@ int ieee80211_mgd_auth(struct ieee80211_ + goto out_unlock; + + err_clear: ++ memset(ifmgd->bssid, 0, ETH_ALEN); ++ ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BSSID); + ifmgd->auth_data = NULL; + err_free: + kfree(auth_data); +@@ -3410,6 +3412,8 @@ int ieee80211_mgd_assoc(struct ieee80211 + err = 0; + goto out; + err_clear: ++ memset(ifmgd->bssid, 0, ETH_ALEN); ++ ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BSSID); + ifmgd->assoc_data = NULL; + err_free: + kfree(assoc_data); diff --git a/queue-3.4/series b/queue-3.4/series index 95857ef07c4..bd707b542a6 100644 --- a/queue-3.4/series +++ b/queue-3.4/series @@ -82,3 +82,13 @@ mm-ia64-fix-a-memory-block-size-bug.patch memory-hotplug-fix-section-info-double-registration-bug.patch xen-m2p-do-not-reuse-kmap_op-dev_bus_addr.patch xen-boot-disable-numa-for-pv-guests.patch +hwmon-fam15h_power-tweak-runavg_range-on-resume.patch +hwmon-ads7871-add-name-sysfs-attribute.patch +hwmon-ad7314-add-name-sysfs-attribute.patch +hid-fix-logitech-dj-missing-unifying-device-issue.patch +cifs-fix-return-value-in-cifsconverttoutf16.patch +vmwgfx-add-dumb-ioctl-support.patch +ibmveth-fix-alignment-of-rx-queue-bug.patch +mac80211-clear-bssid-on-auth-assoc-failure.patch +brcmfmac-fix-big-endian-bug-in-i-scan.patch +brcmfmac-fix-big-endian-host-configuration-data.patch diff --git a/queue-3.4/vmwgfx-add-dumb-ioctl-support.patch b/queue-3.4/vmwgfx-add-dumb-ioctl-support.patch new file mode 100644 index 00000000000..b857b145b45 --- /dev/null +++ b/queue-3.4/vmwgfx-add-dumb-ioctl-support.patch @@ -0,0 +1,133 @@ +From 5e1782d224c79b26ab7d5c31e3f87657000714fb Mon Sep 17 00:00:00 2001 +From: Dave Airlie +Date: Tue, 28 Aug 2012 01:53:54 +0000 +Subject: vmwgfx: add dumb ioctl support + +From: Dave Airlie + +commit 5e1782d224c79b26ab7d5c31e3f87657000714fb upstream. + +Testing and works with the -modesetting driver, + +Reviewed-by: Jakob Bornecrantz +Signed-off-by: Dave Airlie +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/vmwgfx/vmwgfx_drv.c | 5 ++ + drivers/gpu/drm/vmwgfx/vmwgfx_drv.h | 10 ++++ + drivers/gpu/drm/vmwgfx/vmwgfx_resource.c | 73 +++++++++++++++++++++++++++++++ + 3 files changed, 88 insertions(+) + +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c +@@ -1159,6 +1159,11 @@ static struct drm_driver driver = { + .open = vmw_driver_open, + .preclose = vmw_preclose, + .postclose = vmw_postclose, ++ ++ .dumb_create = vmw_dumb_create, ++ .dumb_map_offset = vmw_dumb_map_offset, ++ .dumb_destroy = vmw_dumb_destroy, ++ + .fops = &vmwgfx_driver_fops, + .name = VMWGFX_DRIVER_NAME, + .desc = VMWGFX_DRIVER_DESC, +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h +@@ -645,6 +645,16 @@ int vmw_kms_readback(struct vmw_private + int vmw_kms_update_layout_ioctl(struct drm_device *dev, void *data, + struct drm_file *file_priv); + ++int vmw_dumb_create(struct drm_file *file_priv, ++ struct drm_device *dev, ++ struct drm_mode_create_dumb *args); ++ ++int vmw_dumb_map_offset(struct drm_file *file_priv, ++ struct drm_device *dev, uint32_t handle, ++ uint64_t *offset); ++int vmw_dumb_destroy(struct drm_file *file_priv, ++ struct drm_device *dev, ++ uint32_t handle); + /** + * Overlay control - vmwgfx_overlay.c + */ +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c +@@ -1917,3 +1917,76 @@ err_ref: + vmw_resource_unreference(&res); + return ret; + } ++ ++ ++int vmw_dumb_create(struct drm_file *file_priv, ++ struct drm_device *dev, ++ struct drm_mode_create_dumb *args) ++{ ++ struct vmw_private *dev_priv = vmw_priv(dev); ++ struct vmw_master *vmaster = vmw_master(file_priv->master); ++ struct vmw_user_dma_buffer *vmw_user_bo; ++ struct ttm_buffer_object *tmp; ++ int ret; ++ ++ args->pitch = args->width * ((args->bpp + 7) / 8); ++ args->size = args->pitch * args->height; ++ ++ vmw_user_bo = kzalloc(sizeof(*vmw_user_bo), GFP_KERNEL); ++ if (vmw_user_bo == NULL) ++ return -ENOMEM; ++ ++ ret = ttm_read_lock(&vmaster->lock, true); ++ if (ret != 0) { ++ kfree(vmw_user_bo); ++ return ret; ++ } ++ ++ ret = vmw_dmabuf_init(dev_priv, &vmw_user_bo->dma, args->size, ++ &vmw_vram_sys_placement, true, ++ &vmw_user_dmabuf_destroy); ++ if (ret != 0) ++ goto out_no_dmabuf; ++ ++ tmp = ttm_bo_reference(&vmw_user_bo->dma.base); ++ ret = ttm_base_object_init(vmw_fpriv(file_priv)->tfile, ++ &vmw_user_bo->base, ++ false, ++ ttm_buffer_type, ++ &vmw_user_dmabuf_release, NULL); ++ if (unlikely(ret != 0)) ++ goto out_no_base_object; ++ ++ args->handle = vmw_user_bo->base.hash.key; ++ ++out_no_base_object: ++ ttm_bo_unref(&tmp); ++out_no_dmabuf: ++ ttm_read_unlock(&vmaster->lock); ++ return ret; ++} ++ ++int vmw_dumb_map_offset(struct drm_file *file_priv, ++ struct drm_device *dev, uint32_t handle, ++ uint64_t *offset) ++{ ++ struct ttm_object_file *tfile = vmw_fpriv(file_priv)->tfile; ++ struct vmw_dma_buffer *out_buf; ++ int ret; ++ ++ ret = vmw_user_dmabuf_lookup(tfile, handle, &out_buf); ++ if (ret != 0) ++ return -EINVAL; ++ ++ *offset = out_buf->base.addr_space_offset; ++ vmw_dmabuf_unreference(&out_buf); ++ return 0; ++} ++ ++int vmw_dumb_destroy(struct drm_file *file_priv, ++ struct drm_device *dev, ++ uint32_t handle) ++{ ++ return ttm_ref_object_base_unref(vmw_fpriv(file_priv)->tfile, ++ handle, TTM_REF_USAGE); ++}