From: Greg Kroah-Hartman Date: Tue, 4 Feb 2014 01:06:22 +0000 (+0100) Subject: 3.10-stable patches X-Git-Tag: v3.4.79~13 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=6187a03b28a60c386070ed088480ba8ce5be846c;p=thirdparty%2Fkernel%2Fstable-queue.git 3.10-stable patches added patches: arm-at91-smc-bug-fix-in-sam9_smc_cs_read.patch b43-fix-lockdep-splat.patch b43-fix-the-wrong-assignment-of-status.freq-in-b43_rx.patch b43-fix-unload-oops-if-firmware-is-not-available.patch b43legacy-fix-unload-oops-if-firmware-is-not-available.patch hwmon-k10temp-add-support-for-kaveri-cpus.patch iwlwifi-mvm-fix-missing-cleanup-in-.start-error-path.patch iwlwifi-pcie-enable-oscillator-for-l1-exit.patch kvm-s390-fix-diagnose-code-extraction.patch kvm-x86-limit-pit-timer-frequency.patch mwifiex-add-missing-endian-conversion-for-fw_tsf.patch mwifiex-fix-wrong-11ac-bits-setting-in-fw_cap_info.patch rtlwifi-add-missing-code-to-pwdb-statics-routine.patch rtlwifi-increase-the-rx-queue-length-for-usb-drivers.patch rtlwifi-redo-register-save-locations.patch rtlwifi-rtl8188ee-fix-typo-in-code.patch rtlwifi-rtl8192c-add-new-definitions-in-the-dm_common-header.patch rtlwifi-rtl8192c-add-routines-to-save-restore-power-index-registers.patch rtlwifi-rtl8192c-prevent-reconnect-attempts-if-not-connected.patch rtlwifi-rtl8192cu-add-new-device-id.patch rtlwifi-rtl8192cu-add-new-firmware.patch rtlwifi-rtl8192cu-fix-some-code-in-rf-handling.patch rtlwifi-rtl8192cu-update-the-power-index-registers.patch rtlwifi-set-the-link-state.patch rtlwifi-update-beacon-statistics-for-usb-driver.patch s390-uapi-fix-struct-statfs64-definition.patch serial-8250-enable-uart_bug_nomsr-for-tegra.patch serial-8250-fix-initialisation-of-quatech-cards-with-the-amcc-pci-chip.patch serial-add-support-for-200-v3-series-titan-card.patch staging-r8712u-set-device-type-to-wlan.patch staging-vt6656-bbvupdatepreedthreshold-always-set-sensitivity-on-bscanning.patch staging-vt6656-cardqgetnexttbtt-correct-ulownexttbtt.patch tty-serial-at91-handle-shutdown-more-safely.patch usb-cypress_m8-fix-ring-indicator-detection-and-reporting.patch usb-dwc3-fix-the-glue-drivers-using-the-nop-phy.patch usb-ehci-add-freescale-imx28-special-write-register-method.patch usb-fix-race-between-hub_disconnect-and-recursively_mark_notattached.patch usb-ftdi_sio-added-cs5-quirk-for-broken-smartcard-readers.patch usb-nokia-502-is-an-unusual-device.patch usb-option-add-new-zte-3g-modem-pids-to-option-driver.patch usb-pl2303-fix-data-corruption-on-termios-updates.patch usb-serial-add-support-for-iball-3.5g-connect-usb-modem.patch usb-xhci-check-for-xhci_plat-in-xhci_cleanup_msix.patch x86-add-check-for-number-of-available-vectors-before-cpu-down.patch x86-efi-fix-off-by-one-bug-in-efi-boot-services-reservation.patch x86-x32-correct-invalid-use-of-user-timespec-in-the-kernel.patch --- diff --git a/queue-3.10/arm-at91-smc-bug-fix-in-sam9_smc_cs_read.patch b/queue-3.10/arm-at91-smc-bug-fix-in-sam9_smc_cs_read.patch new file mode 100644 index 00000000000..aec05426fbe --- /dev/null +++ b/queue-3.10/arm-at91-smc-bug-fix-in-sam9_smc_cs_read.patch @@ -0,0 +1,32 @@ +From 1588c51cf6d782e63a8719681d905ef0ac22ee62 Mon Sep 17 00:00:00 2001 +From: Jean-Jacques Hiblot +Date: Thu, 9 Jan 2014 16:01:54 +0100 +Subject: ARM: at91: smc: bug fix in sam9_smc_cs_read() + +From: Jean-Jacques Hiblot + +commit 1588c51cf6d782e63a8719681d905ef0ac22ee62 upstream. + +There was a copy/paste error when reading the nwe_pulse value. + +Signed-off-by: Jean-Jacques Hiblot +Acked-by: Boris BREZILLON +Signed-off-by: Nicolas Ferre +Signed-off-by: Kevin Hilman +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/mach-at91/sam9_smc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/arm/mach-at91/sam9_smc.c ++++ b/arch/arm/mach-at91/sam9_smc.c +@@ -101,7 +101,7 @@ static void sam9_smc_cs_read(void __iome + /* Pulse register */ + val = __raw_readl(base + AT91_SMC_PULSE); + +- config->nwe_setup = val & AT91_SMC_NWEPULSE; ++ config->nwe_pulse = val & AT91_SMC_NWEPULSE; + config->ncs_write_pulse = (val & AT91_SMC_NCS_WRPULSE) >> 8; + config->nrd_pulse = (val & AT91_SMC_NRDPULSE) >> 16; + config->ncs_read_pulse = (val & AT91_SMC_NCS_RDPULSE) >> 24; diff --git a/queue-3.10/b43-fix-lockdep-splat.patch b/queue-3.10/b43-fix-lockdep-splat.patch new file mode 100644 index 00000000000..ddb9ebdac60 --- /dev/null +++ b/queue-3.10/b43-fix-lockdep-splat.patch @@ -0,0 +1,103 @@ +From 09164043f63c947a49797750a09ca1cd7c31108e Mon Sep 17 00:00:00 2001 +From: Larry Finger +Date: Sun, 12 Jan 2014 15:11:37 -0600 +Subject: b43: Fix lockdep splat + +From: Larry Finger + +commit 09164043f63c947a49797750a09ca1cd7c31108e upstream. + +In https://bugzilla.kernel.org/show_bug.cgi?id=67561, a locking dependency is reported +when b43 is used with hostapd, and rfkill is used to kill the radio output. + +The lockdep splat (in part) is as follows: + +====================================================== +[ INFO: possible circular locking dependency detected ] +3.12.0 #1 Not tainted +------------------------------------------------------- +rfkill/10040 is trying to acquire lock: + (rtnl_mutex){+.+.+.}, at: [] rtnl_lock+0x12/0x20 + +but task is already holding lock: + (rfkill_global_mutex){+.+.+.}, at: [] rfkill_fop_write+0x6a/0x170 [rfkill] + +--snip-- + +Chain exists of: + rtnl_mutex --> misc_mtx --> rfkill_global_mutex + +The fix is to move the initialization of the hardware random number generator +outside the code range covered by the rtnl_mutex. + +Reported-by: yury +Tested-by: yury +Signed-off-by: Larry Finger +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/b43/main.c | 17 +++++++++++------ + 1 file changed, 11 insertions(+), 6 deletions(-) + +--- a/drivers/net/wireless/b43/main.c ++++ b/drivers/net/wireless/b43/main.c +@@ -2422,6 +2422,7 @@ error: + + static int b43_one_core_attach(struct b43_bus_dev *dev, struct b43_wl *wl); + static void b43_one_core_detach(struct b43_bus_dev *dev); ++static int b43_rng_init(struct b43_wl *wl); + + static void b43_request_firmware(struct work_struct *work) + { +@@ -2473,6 +2474,10 @@ start_ieee80211: + goto err_one_core_detach; + wl->hw_registred = true; + b43_leds_register(wl->current_dev); ++ ++ /* Register HW RNG driver */ ++ b43_rng_init(wl); ++ + goto out; + + err_one_core_detach: +@@ -4634,9 +4639,6 @@ static void b43_wireless_core_exit(struc + if (!dev || b43_status(dev) != B43_STAT_INITIALIZED) + return; + +- /* Unregister HW RNG driver */ +- b43_rng_exit(dev->wl); +- + b43_set_status(dev, B43_STAT_UNINIT); + + /* Stop the microcode PSM. */ +@@ -4779,9 +4781,6 @@ static int b43_wireless_core_init(struct + + b43_set_status(dev, B43_STAT_INITIALIZED); + +- /* Register HW RNG driver */ +- b43_rng_init(dev->wl); +- + out: + return err; + +@@ -5442,6 +5441,9 @@ static void b43_bcma_remove(struct bcma_ + + b43_one_core_detach(wldev->dev); + ++ /* Unregister HW RNG driver */ ++ b43_rng_exit(wl); ++ + b43_leds_unregister(wl); + + ieee80211_free_hw(wl->hw); +@@ -5519,6 +5521,9 @@ static void b43_ssb_remove(struct ssb_de + + b43_one_core_detach(dev); + ++ /* Unregister HW RNG driver */ ++ b43_rng_exit(wl); ++ + if (list_empty(&wl->devlist)) { + b43_leds_unregister(wl); + /* Last core on the chip unregistered. diff --git a/queue-3.10/b43-fix-the-wrong-assignment-of-status.freq-in-b43_rx.patch b/queue-3.10/b43-fix-the-wrong-assignment-of-status.freq-in-b43_rx.patch new file mode 100644 index 00000000000..93b50b53c41 --- /dev/null +++ b/queue-3.10/b43-fix-the-wrong-assignment-of-status.freq-in-b43_rx.patch @@ -0,0 +1,39 @@ +From 64e5acb09ca6b50c97299cff9ef51299470b29f2 Mon Sep 17 00:00:00 2001 +From: ZHAO Gang +Date: Sat, 18 Jan 2014 00:17:38 +0800 +Subject: b43: fix the wrong assignment of status.freq in b43_rx() + +From: ZHAO Gang + +commit 64e5acb09ca6b50c97299cff9ef51299470b29f2 upstream. + +Use the right function to update frequency value. + +If rx skb is probe response or beacon, the wrong frequency value can +cause problem that bss info can't be updated when it should be. + +Fixes: 8318d78a44d4 ("cfg80211 API for channels/bitrates, mac80211 and driver conversion") +Signed-off-by: ZHAO Gang +Acked-by: Larry Finger +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/b43/xmit.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/net/wireless/b43/xmit.c ++++ b/drivers/net/wireless/b43/xmit.c +@@ -821,10 +821,10 @@ void b43_rx(struct b43_wldev *dev, struc + * channel number in b43. */ + if (chanstat & B43_RX_CHAN_5GHZ) { + status.band = IEEE80211_BAND_5GHZ; +- status.freq = b43_freq_to_channel_5ghz(chanid); ++ status.freq = b43_channel_to_freq_5ghz(chanid); + } else { + status.band = IEEE80211_BAND_2GHZ; +- status.freq = b43_freq_to_channel_2ghz(chanid); ++ status.freq = b43_channel_to_freq_2ghz(chanid); + } + break; + default: diff --git a/queue-3.10/b43-fix-unload-oops-if-firmware-is-not-available.patch b/queue-3.10/b43-fix-unload-oops-if-firmware-is-not-available.patch new file mode 100644 index 00000000000..8871be9ff60 --- /dev/null +++ b/queue-3.10/b43-fix-unload-oops-if-firmware-is-not-available.patch @@ -0,0 +1,91 @@ +From 0673effd41dba323d6a280ef37b5ef29f3f5a653 Mon Sep 17 00:00:00 2001 +From: Larry Finger +Date: Sun, 12 Jan 2014 15:11:38 -0600 +Subject: b43: Fix unload oops if firmware is not available + +From: Larry Finger + +commit 0673effd41dba323d6a280ef37b5ef29f3f5a653 upstream. + +The asyncronous firmware load uses a completion struct to hold firmware +processing until the user-space routines are up and running. There is. +however, a problem in that the waiter is nevered canceled during teardown. +As a result, unloading the driver when firmware is not available causes an oops. + +To be able to access the completion structure at teardown, it had to be moved +into the b43_wldev structure. + +This patch also fixes a typo in a comment. + +Signed-off-by: Larry Finger +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/b43/b43.h | 4 ++-- + drivers/net/wireless/b43/main.c | 10 +++++----- + 2 files changed, 7 insertions(+), 7 deletions(-) + +--- a/drivers/net/wireless/b43/b43.h ++++ b/drivers/net/wireless/b43/b43.h +@@ -731,8 +731,6 @@ enum b43_firmware_file_type { + struct b43_request_fw_context { + /* The device we are requesting the fw for. */ + struct b43_wldev *dev; +- /* a completion event structure needed if this call is asynchronous */ +- struct completion fw_load_complete; + /* a pointer to the firmware object */ + const struct firmware *blob; + /* The type of firmware to request. */ +@@ -809,6 +807,8 @@ enum { + struct b43_wldev { + struct b43_bus_dev *dev; + struct b43_wl *wl; ++ /* a completion event structure needed if this call is asynchronous */ ++ struct completion fw_load_complete; + + /* The device initialization status. + * Use b43_status() to query. */ +--- a/drivers/net/wireless/b43/main.c ++++ b/drivers/net/wireless/b43/main.c +@@ -2068,6 +2068,7 @@ void b43_do_release_fw(struct b43_firmwa + + static void b43_release_firmware(struct b43_wldev *dev) + { ++ complete(&dev->fw_load_complete); + b43_do_release_fw(&dev->fw.ucode); + b43_do_release_fw(&dev->fw.pcm); + b43_do_release_fw(&dev->fw.initvals); +@@ -2093,7 +2094,7 @@ static void b43_fw_cb(const struct firmw + struct b43_request_fw_context *ctx = context; + + ctx->blob = firmware; +- complete(&ctx->fw_load_complete); ++ complete(&ctx->dev->fw_load_complete); + } + + int b43_do_request_fw(struct b43_request_fw_context *ctx, +@@ -2140,7 +2141,7 @@ int b43_do_request_fw(struct b43_request + } + if (async) { + /* do this part asynchronously */ +- init_completion(&ctx->fw_load_complete); ++ init_completion(&ctx->dev->fw_load_complete); + err = request_firmware_nowait(THIS_MODULE, 1, ctx->fwname, + ctx->dev->dev->dev, GFP_KERNEL, + ctx, b43_fw_cb); +@@ -2148,12 +2149,11 @@ int b43_do_request_fw(struct b43_request + pr_err("Unable to load firmware\n"); + return err; + } +- /* stall here until fw ready */ +- wait_for_completion(&ctx->fw_load_complete); ++ wait_for_completion(&ctx->dev->fw_load_complete); + if (ctx->blob) + goto fw_ready; + /* On some ARM systems, the async request will fail, but the next sync +- * request works. For this reason, we dall through here ++ * request works. For this reason, we fall through here + */ + } + err = request_firmware(&ctx->blob, ctx->fwname, diff --git a/queue-3.10/b43legacy-fix-unload-oops-if-firmware-is-not-available.patch b/queue-3.10/b43legacy-fix-unload-oops-if-firmware-is-not-available.patch new file mode 100644 index 00000000000..7d3d2056604 --- /dev/null +++ b/queue-3.10/b43legacy-fix-unload-oops-if-firmware-is-not-available.patch @@ -0,0 +1,32 @@ +From 452028665312672c6ba9e16a19248ee00ead9400 Mon Sep 17 00:00:00 2001 +From: Larry Finger +Date: Sun, 12 Jan 2014 15:11:39 -0600 +Subject: b43legacy: Fix unload oops if firmware is not available + +From: Larry Finger + +commit 452028665312672c6ba9e16a19248ee00ead9400 upstream. + +The asyncronous firmware load uses a completion struct to hold firmware +processing until the user-space routines are up and running. There is. +however, a problem in that the waiter is nevered canceled during teardown. +As a result, unloading the driver when firmware is not available causes an oops. + +Signed-off-by: Larry Finger +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/b43legacy/main.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/wireless/b43legacy/main.c ++++ b/drivers/net/wireless/b43legacy/main.c +@@ -3919,6 +3919,7 @@ static void b43legacy_remove(struct ssb_ + * as the ieee80211 unreg will destroy the workqueue. */ + cancel_work_sync(&wldev->restart_work); + cancel_work_sync(&wl->firmware_load); ++ complete(&wldev->fw_load_complete); + + B43legacy_WARN_ON(!wl); + if (!wldev->fw.ucode) diff --git a/queue-3.10/hwmon-k10temp-add-support-for-kaveri-cpus.patch b/queue-3.10/hwmon-k10temp-add-support-for-kaveri-cpus.patch new file mode 100644 index 00000000000..c19429c1864 --- /dev/null +++ b/queue-3.10/hwmon-k10temp-add-support-for-kaveri-cpus.patch @@ -0,0 +1,29 @@ +From d303b1b5fbb688282bbf72a534b9dfed7af9fe4f Mon Sep 17 00:00:00 2001 +From: Phil Pokorny +Date: Tue, 14 Jan 2014 10:46:46 -0800 +Subject: hwmon: (k10temp) Add support for Kaveri CPUs + +From: Phil Pokorny + +commit d303b1b5fbb688282bbf72a534b9dfed7af9fe4f upstream. + +Add new PCI ID to support new model "Kaveri" family. + +Signed-off-by: Philip Pokorny +Signed-off-by: Guenter Roeck +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwmon/k10temp.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/hwmon/k10temp.c ++++ b/drivers/hwmon/k10temp.c +@@ -211,6 +211,7 @@ static DEFINE_PCI_DEVICE_TABLE(k10temp_i + { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_CNB17H_F3) }, + { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_15H_NB_F3) }, + { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_15H_M10H_F3) }, ++ { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_15H_M30H_NB_F3) }, + { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_16H_NB_F3) }, + {} + }; diff --git a/queue-3.10/iwlwifi-mvm-fix-missing-cleanup-in-.start-error-path.patch b/queue-3.10/iwlwifi-mvm-fix-missing-cleanup-in-.start-error-path.patch new file mode 100644 index 00000000000..e170b54316f --- /dev/null +++ b/queue-3.10/iwlwifi-mvm-fix-missing-cleanup-in-.start-error-path.patch @@ -0,0 +1,35 @@ +From 91b0d1198417cf4fd9a7bd4138b6909f0b359099 Mon Sep 17 00:00:00 2001 +From: Eliad Peller +Date: Sun, 5 Jan 2014 12:41:12 +0200 +Subject: iwlwifi: mvm: fix missing cleanup in .start() error path + +From: Eliad Peller + +commit 91b0d1198417cf4fd9a7bd4138b6909f0b359099 upstream. + +Cleanup of iwl_mvm_leds was missing in case of error, +resulting in the following warning: + +WARNING: at lib/kobject.c:196 kobject_add_internal+0x1f4/0x210() +kobject_add_internal failed for phy0-led with -EEXIST, don't try to register things with the same name in the same directory. + +which prevents further reloads of the driver. + +Signed-off-by: Eliad Peller +Signed-off-by: Emmanuel Grumbach +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/iwlwifi/mvm/ops.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/wireless/iwlwifi/mvm/ops.c ++++ b/drivers/net/wireless/iwlwifi/mvm/ops.c +@@ -424,6 +424,7 @@ iwl_op_mode_mvm_start(struct iwl_trans * + + out_unregister: + ieee80211_unregister_hw(mvm->hw); ++ iwl_mvm_leds_exit(mvm); + out_free: + iwl_phy_db_free(mvm->phy_db); + kfree(mvm->scan_cmd); diff --git a/queue-3.10/iwlwifi-pcie-enable-oscillator-for-l1-exit.patch b/queue-3.10/iwlwifi-pcie-enable-oscillator-for-l1-exit.patch new file mode 100644 index 00000000000..76a3e5f7b1d --- /dev/null +++ b/queue-3.10/iwlwifi-pcie-enable-oscillator-for-l1-exit.patch @@ -0,0 +1,81 @@ +From 2d93aee152b1758a94a18fe15d72153ba73b5679 Mon Sep 17 00:00:00 2001 +From: Emmanuel Grumbach +Date: Tue, 24 Dec 2013 14:15:41 +0200 +Subject: iwlwifi: pcie: enable oscillator for L1 exit + +From: Emmanuel Grumbach + +commit 2d93aee152b1758a94a18fe15d72153ba73b5679 upstream. + +Enabling the oscillator consumes slightly more power (100uA) +but allows to make sure that we exit from L1 on time. + +Not doing so might lead to a PCIe specification violation +since we might wake up from L1 at the wrong time. +This issue has been identified on 3160 and 7260 only. +On older NICs L1 off is not enabled, on newer NICs (7265), +the issue is fixed. + +When the bug occurs the user sees that the NIC has +disappeared from the PCI bridge, any access to the device +returns 0xff. + +This fixes: + https://bugzilla.kernel.org/show_bug.cgi?id=64541 + +and has been extensively discussed here: + http://markmail.org/thread/mfmpzqt3r333n4bo + +Fixes: 99cd47142399 ("iwlwifi: add 7000 series device configuration") +Reported-and-tested-by: wzyboy +Reviewed-by: Johannes Berg +Signed-off-by: Emmanuel Grumbach +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/iwlwifi/iwl-prph.h | 4 ++++ + drivers/net/wireless/iwlwifi/pcie/trans.c | 22 ++++++++++++++++++++++ + 2 files changed, 26 insertions(+) + +--- a/drivers/net/wireless/iwlwifi/iwl-prph.h ++++ b/drivers/net/wireless/iwlwifi/iwl-prph.h +@@ -260,4 +260,8 @@ static inline unsigned int SCD_QUEUE_STA + + /*********************** END TX SCHEDULER *************************************/ + ++/* Oscillator clock */ ++#define OSC_CLK (0xa04068) ++#define OSC_CLK_FORCE_CONTROL (0x8) ++ + #endif /* __iwl_prph_h__ */ +--- a/drivers/net/wireless/iwlwifi/pcie/trans.c ++++ b/drivers/net/wireless/iwlwifi/pcie/trans.c +@@ -206,6 +206,28 @@ static int iwl_pcie_apm_init(struct iwl_ + goto out; + } + ++ if (trans->cfg->host_interrupt_operation_mode) { ++ /* ++ * This is a bit of an abuse - This is needed for 7260 / 3160 ++ * only check host_interrupt_operation_mode even if this is ++ * not related to host_interrupt_operation_mode. ++ * ++ * Enable the oscillator to count wake up time for L1 exit. This ++ * consumes slightly more power (100uA) - but allows to be sure ++ * that we wake up from L1 on time. ++ * ++ * This looks weird: read twice the same register, discard the ++ * value, set a bit, and yet again, read that same register ++ * just to discard the value. But that's the way the hardware ++ * seems to like it. ++ */ ++ iwl_read_prph(trans, OSC_CLK); ++ iwl_read_prph(trans, OSC_CLK); ++ iwl_set_bits_prph(trans, OSC_CLK, OSC_CLK_FORCE_CONTROL); ++ iwl_read_prph(trans, OSC_CLK); ++ iwl_read_prph(trans, OSC_CLK); ++ } ++ + /* + * Enable DMA clock and wait for it to stabilize. + * diff --git a/queue-3.10/kvm-s390-fix-diagnose-code-extraction.patch b/queue-3.10/kvm-s390-fix-diagnose-code-extraction.patch new file mode 100644 index 00000000000..0aada71f78f --- /dev/null +++ b/queue-3.10/kvm-s390-fix-diagnose-code-extraction.patch @@ -0,0 +1,34 @@ +From 743db27c526e0f31cc507959d662e97e2048a86f Mon Sep 17 00:00:00 2001 +From: Heiko Carstens +Date: Mon, 11 Nov 2013 13:56:47 +0100 +Subject: KVM: s390: fix diagnose code extraction + +From: Heiko Carstens + +commit 743db27c526e0f31cc507959d662e97e2048a86f upstream. + +The diagnose code to be used is the contents of the base register (if not +zero), plus the displacement. The current code ignores the base register +contents. So let's fix that... + +Reviewed-by: Cornelia Huck +Cc: stable@vger.kernel.org +Signed-off-by: Heiko Carstens +Signed-off-by: Cornelia Huck +Signed-off-by: Greg Kroah-Hartman + +--- + arch/s390/kvm/diag.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/s390/kvm/diag.c ++++ b/arch/s390/kvm/diag.c +@@ -130,7 +130,7 @@ static int __diag_virtio_hypercall(struc + + int kvm_s390_handle_diag(struct kvm_vcpu *vcpu) + { +- int code = (vcpu->arch.sie_block->ipb & 0xfff0000) >> 16; ++ int code = kvm_s390_get_base_disp_rs(vcpu) & 0xffff; + + trace_kvm_s390_handle_diag(vcpu, code); + switch (code) { diff --git a/queue-3.10/kvm-x86-limit-pit-timer-frequency.patch b/queue-3.10/kvm-x86-limit-pit-timer-frequency.patch new file mode 100644 index 00000000000..cf5d643c876 --- /dev/null +++ b/queue-3.10/kvm-x86-limit-pit-timer-frequency.patch @@ -0,0 +1,92 @@ +From 9ed96e87c5748de4c2807ef17e81287c7304186c Mon Sep 17 00:00:00 2001 +From: Marcelo Tosatti +Date: Mon, 6 Jan 2014 12:00:02 -0200 +Subject: KVM: x86: limit PIT timer frequency + +From: Marcelo Tosatti + +commit 9ed96e87c5748de4c2807ef17e81287c7304186c upstream. + +Limit PIT timer frequency similarly to the limit applied by +LAPIC timer. + +Reviewed-by: Jan Kiszka +Signed-off-by: Marcelo Tosatti +Signed-off-by: Paolo Bonzini +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kvm/i8254.c | 18 ++++++++++++++++++ + arch/x86/kvm/lapic.c | 3 --- + arch/x86/kvm/x86.c | 3 +++ + arch/x86/kvm/x86.h | 2 ++ + 4 files changed, 23 insertions(+), 3 deletions(-) + +--- a/arch/x86/kvm/i8254.c ++++ b/arch/x86/kvm/i8254.c +@@ -37,6 +37,7 @@ + + #include "irq.h" + #include "i8254.h" ++#include "x86.h" + + #ifndef CONFIG_X86_64 + #define mod_64(x, y) ((x) - (y) * div64_u64(x, y)) +@@ -349,6 +350,23 @@ static void create_pit_timer(struct kvm + atomic_set(&ps->pending, 0); + ps->irq_ack = 1; + ++ /* ++ * Do not allow the guest to program periodic timers with small ++ * interval, since the hrtimers are not throttled by the host ++ * scheduler. ++ */ ++ if (ps->is_periodic) { ++ s64 min_period = min_timer_period_us * 1000LL; ++ ++ if (ps->period < min_period) { ++ pr_info_ratelimited( ++ "kvm: requested %lld ns " ++ "i8254 timer period limited to %lld ns\n", ++ ps->period, min_period); ++ ps->period = min_period; ++ } ++ } ++ + hrtimer_start(&ps->timer, ktime_add_ns(ktime_get(), interval), + HRTIMER_MODE_ABS); + } +--- a/arch/x86/kvm/lapic.c ++++ b/arch/x86/kvm/lapic.c +@@ -71,9 +71,6 @@ + #define VEC_POS(v) ((v) & (32 - 1)) + #define REG_POS(v) (((v) >> 5) << 4) + +-static unsigned int min_timer_period_us = 500; +-module_param(min_timer_period_us, uint, S_IRUGO | S_IWUSR); +- + static inline void apic_set_reg(struct kvm_lapic *apic, int reg_off, u32 val) + { + *((u32 *) (apic->regs + reg_off)) = val; +--- a/arch/x86/kvm/x86.c ++++ b/arch/x86/kvm/x86.c +@@ -94,6 +94,9 @@ EXPORT_SYMBOL_GPL(kvm_x86_ops); + static bool ignore_msrs = 0; + module_param(ignore_msrs, bool, S_IRUGO | S_IWUSR); + ++unsigned int min_timer_period_us = 500; ++module_param(min_timer_period_us, uint, S_IRUGO | S_IWUSR); ++ + bool kvm_has_tsc_control; + EXPORT_SYMBOL_GPL(kvm_has_tsc_control); + u32 kvm_max_guest_tsc_khz; +--- a/arch/x86/kvm/x86.h ++++ b/arch/x86/kvm/x86.h +@@ -124,5 +124,7 @@ int kvm_write_guest_virt_system(struct x + + extern u64 host_xcr0; + ++extern unsigned int min_timer_period_us; ++ + extern struct static_key kvm_no_apic_vcpu; + #endif diff --git a/queue-3.10/mwifiex-add-missing-endian-conversion-for-fw_tsf.patch b/queue-3.10/mwifiex-add-missing-endian-conversion-for-fw_tsf.patch new file mode 100644 index 00000000000..f8fdc1eac0c --- /dev/null +++ b/queue-3.10/mwifiex-add-missing-endian-conversion-for-fw_tsf.patch @@ -0,0 +1,41 @@ +From 9795229752c31da0c5f8a7dc4c827665327b52f9 Mon Sep 17 00:00:00 2001 +From: Amitkumar Karwar +Date: Fri, 10 Jan 2014 14:30:41 -0800 +Subject: mwifiex: add missing endian conversion for fw_tsf + +From: Amitkumar Karwar + +commit 9795229752c31da0c5f8a7dc4c827665327b52f9 upstream. + +It is u64 data received from firmware. Little endian to cpu +conversion is required here. + +Signed-off-by: Amitkumar Karwar +Signed-off-by: Bing Zhao +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/mwifiex/scan.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/net/wireless/mwifiex/scan.c ++++ b/drivers/net/wireless/mwifiex/scan.c +@@ -1622,7 +1622,7 @@ int mwifiex_ret_802_11_scan(struct mwifi + const u8 *ie_buf; + size_t ie_len; + u16 channel = 0; +- u64 fw_tsf = 0; ++ __le64 fw_tsf = 0; + u16 beacon_size = 0; + u32 curr_bcn_bytes; + u32 freq; +@@ -1749,7 +1749,7 @@ int mwifiex_ret_802_11_scan(struct mwifi + ie_buf, ie_len, rssi, GFP_KERNEL); + bss_priv = (struct mwifiex_bss_priv *)bss->priv; + bss_priv->band = band; +- bss_priv->fw_tsf = fw_tsf; ++ bss_priv->fw_tsf = le64_to_cpu(fw_tsf); + if (priv->media_connected && + !memcmp(bssid, + priv->curr_bss_params.bss_descriptor diff --git a/queue-3.10/mwifiex-fix-wrong-11ac-bits-setting-in-fw_cap_info.patch b/queue-3.10/mwifiex-fix-wrong-11ac-bits-setting-in-fw_cap_info.patch new file mode 100644 index 00000000000..5ab73af475e --- /dev/null +++ b/queue-3.10/mwifiex-fix-wrong-11ac-bits-setting-in-fw_cap_info.patch @@ -0,0 +1,31 @@ +From 1e202242ee1432d68a8bea4919b2ae0ef19d9e06 Mon Sep 17 00:00:00 2001 +From: Bing Zhao +Date: Tue, 14 Jan 2014 19:16:34 -0800 +Subject: mwifiex: fix wrong 11ac bits setting in fw_cap_info + +From: Bing Zhao + +commit 1e202242ee1432d68a8bea4919b2ae0ef19d9e06 upstream. + +bit 14 is actually reserved and bit 12 & 13 should be used for +11ac capability in fw_cap_info. + +Signed-off-by: Bing Zhao +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/mwifiex/fw.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/wireless/mwifiex/fw.h ++++ b/drivers/net/wireless/mwifiex/fw.h +@@ -228,7 +228,7 @@ enum MWIFIEX_802_11_PRIVACY_FILTER { + + /* HW_SPEC fw_cap_info */ + +-#define ISSUPP_11ACENABLED(fw_cap_info) (fw_cap_info & (BIT(13)|BIT(14))) ++#define ISSUPP_11ACENABLED(fw_cap_info) (fw_cap_info & (BIT(12)|BIT(13))) + + #define GET_VHTCAP_CHWDSET(vht_cap_info) ((vht_cap_info >> 2) & 0x3) + #define GET_VHTNSSMCS(mcs_mapset, nss) ((mcs_mapset >> (2 * (nss - 1))) & 0x3) diff --git a/queue-3.10/rtlwifi-add-missing-code-to-pwdb-statics-routine.patch b/queue-3.10/rtlwifi-add-missing-code-to-pwdb-statics-routine.patch new file mode 100644 index 00000000000..e927a11b6de --- /dev/null +++ b/queue-3.10/rtlwifi-add-missing-code-to-pwdb-statics-routine.patch @@ -0,0 +1,60 @@ +From d82403a9f407217b6aed5260aa92a120e8e98310 Mon Sep 17 00:00:00 2001 +From: Larry Finger +Date: Mon, 18 Nov 2013 11:11:35 -0600 +Subject: rtlwifi: Add missing code to PWDB statics routine + +From: Larry Finger + +commit d82403a9f407217b6aed5260aa92a120e8e98310 upstream. + +Signed-off-by: Larry Finger +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/rtlwifi/stats.c | 14 ++++++++++++++ + 1 file changed, 14 insertions(+) + +--- a/drivers/net/wireless/rtlwifi/stats.c ++++ b/drivers/net/wireless/rtlwifi/stats.c +@@ -176,6 +176,7 @@ static void rtl_process_pwdb(struct ieee + struct rtl_sta_info *drv_priv = NULL; + struct ieee80211_sta *sta = NULL; + long undec_sm_pwdb; ++ long undec_sm_cck; + + rcu_read_lock(); + if (rtlpriv->mac80211.opmode != NL80211_IFTYPE_STATION) +@@ -185,12 +186,16 @@ static void rtl_process_pwdb(struct ieee + if (sta) { + drv_priv = (struct rtl_sta_info *) sta->drv_priv; + undec_sm_pwdb = drv_priv->rssi_stat.undec_sm_pwdb; ++ undec_sm_cck = drv_priv->rssi_stat.undec_sm_cck; + } else { + undec_sm_pwdb = rtlpriv->dm.undec_sm_pwdb; ++ undec_sm_cck = rtlpriv->dm.undec_sm_cck; + } + + if (undec_sm_pwdb < 0) + undec_sm_pwdb = pstatus->rx_pwdb_all; ++ if (undec_sm_cck < 0) ++ undec_sm_cck = pstatus->rx_pwdb_all; + if (pstatus->rx_pwdb_all > (u32) undec_sm_pwdb) { + undec_sm_pwdb = (((undec_sm_pwdb) * + (RX_SMOOTH_FACTOR - 1)) + +@@ -200,6 +205,15 @@ static void rtl_process_pwdb(struct ieee + undec_sm_pwdb = (((undec_sm_pwdb) * (RX_SMOOTH_FACTOR - 1)) + + (pstatus->rx_pwdb_all)) / (RX_SMOOTH_FACTOR); + } ++ if (pstatus->rx_pwdb_all > (u32) undec_sm_cck) { ++ undec_sm_cck = (((undec_sm_pwdb) * ++ (RX_SMOOTH_FACTOR - 1)) + ++ (pstatus->rx_pwdb_all)) / (RX_SMOOTH_FACTOR); ++ undec_sm_cck = undec_sm_cck + 1; ++ } else { ++ undec_sm_pwdb = (((undec_sm_cck) * (RX_SMOOTH_FACTOR - 1)) + ++ (pstatus->rx_pwdb_all)) / (RX_SMOOTH_FACTOR); ++ } + + if (sta) { + drv_priv->rssi_stat.undec_sm_pwdb = undec_sm_pwdb; diff --git a/queue-3.10/rtlwifi-increase-the-rx-queue-length-for-usb-drivers.patch b/queue-3.10/rtlwifi-increase-the-rx-queue-length-for-usb-drivers.patch new file mode 100644 index 00000000000..4dc939ce65e --- /dev/null +++ b/queue-3.10/rtlwifi-increase-the-rx-queue-length-for-usb-drivers.patch @@ -0,0 +1,31 @@ +From dc6405712268fe514d3dd89aa936c4397b0871b9 Mon Sep 17 00:00:00 2001 +From: Larry Finger +Date: Mon, 18 Nov 2013 11:11:30 -0600 +Subject: rtlwifi: Increase the RX queue length for USB drivers + +From: Larry Finger + +commit dc6405712268fe514d3dd89aa936c4397b0871b9 upstream. + +The current number of RX buffers queued is 32, which is too small under +heavy load. That number is doubled. + +Signed-off-by: Larry Finger +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/rtlwifi/usb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/wireless/rtlwifi/usb.c ++++ b/drivers/net/wireless/rtlwifi/usb.c +@@ -550,7 +550,7 @@ static void _rtl_rx_pre_process(struct i + } + } + +-#define __RX_SKB_MAX_QUEUED 32 ++#define __RX_SKB_MAX_QUEUED 64 + + static void _rtl_rx_work(unsigned long param) + { diff --git a/queue-3.10/rtlwifi-redo-register-save-locations.patch b/queue-3.10/rtlwifi-redo-register-save-locations.patch new file mode 100644 index 00000000000..a6f72401bfc --- /dev/null +++ b/queue-3.10/rtlwifi-redo-register-save-locations.patch @@ -0,0 +1,101 @@ +From b9a758a8c905fc59e783ae91ad645452d877ea88 Mon Sep 17 00:00:00 2001 +From: Larry Finger +Date: Mon, 18 Nov 2013 11:11:27 -0600 +Subject: rtlwifi: Redo register save locations + +From: Larry Finger + +commit b9a758a8c905fc59e783ae91ad645452d877ea88 upstream. + +The initial USB driver did not use some register save locations in the +private data storage. To save some memory, a union was used to overlay these +variables with USB I/O components. In an update of the gain-control code, +these register save locations are now needed for USB drivers. + +Signed-off-by: Larry Finger +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/rtlwifi/wifi.h | 32 ++++++++++++++++---------------- + 1 file changed, 16 insertions(+), 16 deletions(-) + +--- a/drivers/net/wireless/rtlwifi/wifi.h ++++ b/drivers/net/wireless/rtlwifi/wifi.h +@@ -1035,6 +1035,7 @@ struct rtl_ht_agg { + + struct rssi_sta { + long undec_sm_pwdb; ++ long undec_sm_cck; + }; + + struct rtl_tid_data { +@@ -1325,8 +1326,10 @@ struct fast_ant_training { + struct rtl_dm { + /*PHY status for Dynamic Management */ + long entry_min_undec_sm_pwdb; ++ long undec_sm_cck; + long undec_sm_pwdb; /*out dm */ + long entry_max_undec_sm_pwdb; ++ s32 ofdm_pkt_cnt; + bool dm_initialgain_enable; + bool dynamic_txpower_enable; + bool current_turbo_edca; +@@ -1341,6 +1344,7 @@ struct rtl_dm { + bool inform_fw_driverctrldm; + bool current_mrc_switch; + u8 txpowercount; ++ u8 powerindex_backup[6]; + + u8 thermalvalue_rxgain; + u8 thermalvalue_iqk; +@@ -1352,7 +1356,9 @@ struct rtl_dm { + bool done_txpower; + u8 dynamic_txhighpower_lvl; /*Tx high power level */ + u8 dm_flag; /*Indicate each dynamic mechanism's status. */ ++ u8 dm_flag_tmp; + u8 dm_type; ++ u8 dm_rssi_sel; + u8 txpower_track_control; + bool interrupt_migration; + bool disable_tx_int; +@@ -1951,6 +1957,7 @@ struct dig_t { + u8 pre_ccastate; + u8 cur_ccasate; + u8 large_fa_hit; ++ u8 dig_dynamic_min; + u8 forbidden_igi; + u8 dig_state; + u8 dig_highpwrstate; +@@ -2031,22 +2038,15 @@ struct rtl_priv { + struct dig_t dm_digtable; + struct ps_t dm_pstable; + +- /* section shared by individual drivers */ +- union { +- struct { /* data buffer pointer for USB reads */ +- __le32 *usb_data; +- int usb_data_index; +- bool initialized; +- }; +- struct { /* section for 8723ae */ +- bool reg_init; /* true if regs saved */ +- u32 reg_874; +- u32 reg_c70; +- u32 reg_85c; +- u32 reg_a74; +- bool bt_operation_on; +- }; +- }; ++ u32 reg_874; ++ u32 reg_c70; ++ u32 reg_85c; ++ u32 reg_a74; ++ bool reg_init; /* true if regs saved */ ++ bool bt_operation_on; ++ __le32 *usb_data; ++ int usb_data_index; ++ bool initialized; + bool enter_ps; /* true when entering PS */ + u8 rate_mask[5]; + diff --git a/queue-3.10/rtlwifi-rtl8188ee-fix-typo-in-code.patch b/queue-3.10/rtlwifi-rtl8188ee-fix-typo-in-code.patch new file mode 100644 index 00000000000..a984dd06383 --- /dev/null +++ b/queue-3.10/rtlwifi-rtl8188ee-fix-typo-in-code.patch @@ -0,0 +1,33 @@ +From f699273d6a624266ebc9198774f06ee64a3847a1 Mon Sep 17 00:00:00 2001 +From: Larry Finger +Date: Mon, 25 Nov 2013 10:45:28 -0600 +Subject: rtlwifi: rtl8188ee: Fix typo in code + +From: Larry Finger + +commit f699273d6a624266ebc9198774f06ee64a3847a1 upstream. + +The static analyser "cppcheck" shows the following typo: +drivers/net/wireless/rtlwifi/rtl8188ee/dm.c:1081]: (style) Same expression on both sides of '!='. + +Signed-off-by: Larry Finger +Reported-by: David Binderman +Cc: David Binderman +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/rtlwifi/rtl8188ee/dm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/wireless/rtlwifi/rtl8188ee/dm.c ++++ b/drivers/net/wireless/rtlwifi/rtl8188ee/dm.c +@@ -1078,7 +1078,7 @@ static void rtl88e_dm_txpower_tracking_c + rtldm->swing_flag_ofdm = true; + } + +- if (rtldm->swing_idx_cck != rtldm->swing_idx_cck) { ++ if (rtldm->swing_idx_cck_cur != rtldm->swing_idx_cck) { + rtldm->swing_idx_cck_cur = rtldm->swing_idx_cck; + rtldm->swing_flag_cck = true; + } diff --git a/queue-3.10/rtlwifi-rtl8192c-add-new-definitions-in-the-dm_common-header.patch b/queue-3.10/rtlwifi-rtl8192c-add-new-definitions-in-the-dm_common-header.patch new file mode 100644 index 00000000000..afe14567b02 --- /dev/null +++ b/queue-3.10/rtlwifi-rtl8192c-add-new-definitions-in-the-dm_common-header.patch @@ -0,0 +1,48 @@ +From c908c74e005de780fddbe8cb6fcd44803f5d4b74 Mon Sep 17 00:00:00 2001 +From: Larry Finger +Date: Mon, 18 Nov 2013 11:11:29 -0600 +Subject: rtlwifi: rtl8192c: Add new definitions in the dm_common header + +From: Larry Finger + +commit c908c74e005de780fddbe8cb6fcd44803f5d4b74 upstream. + +Changes in the gain-control mechanism will require some changes in the header. + +Signed-off-by: Larry Finger +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/rtlwifi/rtl8192c/dm_common.h | 14 ++++++++++++++ + 1 file changed, 14 insertions(+) + +--- a/drivers/net/wireless/rtlwifi/rtl8192c/dm_common.h ++++ b/drivers/net/wireless/rtlwifi/rtl8192c/dm_common.h +@@ -91,6 +91,17 @@ + #define TX_POWER_NEAR_FIELD_THRESH_LVL2 74 + #define TX_POWER_NEAR_FIELD_THRESH_LVL1 67 + ++#define DYNAMIC_FUNC_DISABLE 0x0 ++#define DYNAMIC_FUNC_DIG BIT(0) ++#define DYNAMIC_FUNC_HP BIT(1) ++#define DYNAMIC_FUNC_SS BIT(2) /*Tx Power Tracking*/ ++#define DYNAMIC_FUNC_BT BIT(3) ++#define DYNAMIC_FUNC_ANT_DIV BIT(4) ++ ++#define RSSI_CCK 0 ++#define RSSI_OFDM 1 ++#define RSSI_DEFAULT 2 ++ + struct swat_t { + u8 failure_cnt; + u8 try_flag; +@@ -167,5 +178,8 @@ void rtl92c_phy_lc_calibrate(struct ieee + void rtl92c_phy_iq_calibrate(struct ieee80211_hw *hw, bool recovery); + void rtl92c_dm_dynamic_txpower(struct ieee80211_hw *hw); + void rtl92c_dm_bt_coexist(struct ieee80211_hw *hw); ++void dm_savepowerindex(struct ieee80211_hw *hw); ++void dm_writepowerindex(struct ieee80211_hw *hw, u8 value); ++void dm_restorepowerindex(struct ieee80211_hw *hw); + + #endif diff --git a/queue-3.10/rtlwifi-rtl8192c-add-routines-to-save-restore-power-index-registers.patch b/queue-3.10/rtlwifi-rtl8192c-add-routines-to-save-restore-power-index-registers.patch new file mode 100644 index 00000000000..2705bc72df2 --- /dev/null +++ b/queue-3.10/rtlwifi-rtl8192c-add-routines-to-save-restore-power-index-registers.patch @@ -0,0 +1,62 @@ +From 97204e93f01868eeba6ae5c4f3270f32905bb418 Mon Sep 17 00:00:00 2001 +From: Larry Finger +Date: Mon, 18 Nov 2013 11:11:32 -0600 +Subject: rtlwifi: rtl8192c: Add routines to save/restore power index registers + +From: Larry Finger + +commit 97204e93f01868eeba6ae5c4f3270f32905bb418 upstream. + +Signed-off-by: Larry Finger +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/rtlwifi/rtl8192c/dm_common.c | 36 ++++++++++++++++++++++ + 1 file changed, 36 insertions(+) + +--- a/drivers/net/wireless/rtlwifi/rtl8192c/dm_common.c ++++ b/drivers/net/wireless/rtlwifi/rtl8192c/dm_common.c +@@ -158,6 +158,42 @@ static const u8 cckswing_table_ch14[CCK_ + {0x09, 0x08, 0x07, 0x04, 0x00, 0x00, 0x00, 0x00} + }; + ++static u32 power_index_reg[6] = {0xc90, 0xc91, 0xc92, 0xc98, 0xc99, 0xc9a}; ++ ++void dm_restorepowerindex(struct ieee80211_hw *hw) ++{ ++ struct rtl_priv *rtlpriv = rtl_priv(hw); ++ u8 index; ++ ++ for (index = 0; index < 6; index++) ++ rtl_write_byte(rtlpriv, power_index_reg[index], ++ rtlpriv->dm.powerindex_backup[index]); ++} ++EXPORT_SYMBOL_GPL(dm_restorepowerindex); ++ ++void dm_writepowerindex(struct ieee80211_hw *hw, u8 value) ++{ ++ struct rtl_priv *rtlpriv = rtl_priv(hw); ++ u8 index; ++ ++ for (index = 0; index < 6; index++) ++ rtl_write_byte(rtlpriv, power_index_reg[index], value); ++} ++EXPORT_SYMBOL_GPL(dm_writepowerindex); ++ ++void dm_savepowerindex(struct ieee80211_hw *hw) ++{ ++ struct rtl_priv *rtlpriv = rtl_priv(hw); ++ u8 index; ++ u8 tmp; ++ ++ for (index = 0; index < 6; index++) { ++ tmp = rtl_read_byte(rtlpriv, power_index_reg[index]); ++ rtlpriv->dm.powerindex_backup[index] = tmp; ++ } ++} ++EXPORT_SYMBOL_GPL(dm_savepowerindex); ++ + static void rtl92c_dm_diginit(struct ieee80211_hw *hw) + { + struct rtl_priv *rtlpriv = rtl_priv(hw); diff --git a/queue-3.10/rtlwifi-rtl8192c-prevent-reconnect-attempts-if-not-connected.patch b/queue-3.10/rtlwifi-rtl8192c-prevent-reconnect-attempts-if-not-connected.patch new file mode 100644 index 00000000000..ddf7aeee094 --- /dev/null +++ b/queue-3.10/rtlwifi-rtl8192c-prevent-reconnect-attempts-if-not-connected.patch @@ -0,0 +1,33 @@ +From 8fd77aec1a9d6f4328fc0244f21932114e066df3 Mon Sep 17 00:00:00 2001 +From: Larry Finger +Date: Mon, 18 Nov 2013 11:11:25 -0600 +Subject: rtlwifi: rtl8192c: Prevent reconnect attempts if not connected + +From: Larry Finger + +commit 8fd77aec1a9d6f4328fc0244f21932114e066df3 upstream. + +This driver has a watchdog timer that attempts to reconnect when beacon frames +are not seen for 6 seconds. This patch disables that reconnect whenever the +device has never been connected. + +Signed-off-by: Larry Finger +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/rtlwifi/base.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/net/wireless/rtlwifi/base.c ++++ b/drivers/net/wireless/rtlwifi/base.c +@@ -1427,7 +1427,8 @@ void rtl_watchdog_wq_callback(void *data + /* if we can't recv beacon for 6s, we should + * reconnect this AP + */ +- if (rtlpriv->link_info.roam_times >= 3) { ++ if ((rtlpriv->link_info.roam_times >= 3) && ++ !is_zero_ether_addr(rtlpriv->mac80211.bssid)) { + RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG, + "AP off, try to reconnect now\n"); + rtlpriv->link_info.roam_times = 0; diff --git a/queue-3.10/rtlwifi-rtl8192cu-add-new-device-id.patch b/queue-3.10/rtlwifi-rtl8192cu-add-new-device-id.patch new file mode 100644 index 00000000000..9381a2ffe3d --- /dev/null +++ b/queue-3.10/rtlwifi-rtl8192cu-add-new-device-id.patch @@ -0,0 +1,29 @@ +From f87f960b2fb802f26ee3b00c19320e57a9c583ff Mon Sep 17 00:00:00 2001 +From: Larry Finger +Date: Thu, 9 Jan 2014 10:27:27 -0600 +Subject: rtlwifi: rtl8192cu: Add new device ID + +From: Larry Finger + +commit f87f960b2fb802f26ee3b00c19320e57a9c583ff upstream. + +Reported-by: Jan Prinsloo +Tested-by: Jan Prinsloo +Signed-off-by: Larry Finger +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/rtlwifi/rtl8192cu/sw.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c ++++ b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c +@@ -306,6 +306,7 @@ static struct usb_device_id rtl8192c_usb + {RTL_USB_DEVICE(0x0bda, 0x5088, rtl92cu_hal_cfg)}, /*Thinkware-CC&C*/ + {RTL_USB_DEVICE(0x0df6, 0x0052, rtl92cu_hal_cfg)}, /*Sitecom - Edimax*/ + {RTL_USB_DEVICE(0x0df6, 0x005c, rtl92cu_hal_cfg)}, /*Sitecom - Edimax*/ ++ {RTL_USB_DEVICE(0x0df6, 0x0077, rtl92cu_hal_cfg)}, /*Sitecom-WLA2100V2*/ + {RTL_USB_DEVICE(0x0eb0, 0x9071, rtl92cu_hal_cfg)}, /*NO Brand - Etop*/ + {RTL_USB_DEVICE(0x4856, 0x0091, rtl92cu_hal_cfg)}, /*NetweeN - Feixun*/ + /* HP - Lite-On ,8188CUS Slim Combo */ diff --git a/queue-3.10/rtlwifi-rtl8192cu-add-new-firmware.patch b/queue-3.10/rtlwifi-rtl8192cu-add-new-firmware.patch new file mode 100644 index 00000000000..94396f75199 --- /dev/null +++ b/queue-3.10/rtlwifi-rtl8192cu-add-new-firmware.patch @@ -0,0 +1,93 @@ +From 62009b7f12793c932aaba0df946b04cb4a77d022 Mon Sep 17 00:00:00 2001 +From: Larry Finger +Date: Mon, 18 Nov 2013 11:11:26 -0600 +Subject: rtlwifi: rtl8192cu: Add new firmware + +From: Larry Finger + +commit 62009b7f12793c932aaba0df946b04cb4a77d022 upstream. + +Vendor driver rtl8188C_8192C_8192D_usb_linux_v3.4.2_3727.20120404 introduced +new firmware for these chips. The code try for the new file, and fall back to +the original firmware if the new file is not available. + +Signed-off-by: Larry Finger +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/rtlwifi/core.c | 10 ++++++++++ + drivers/net/wireless/rtlwifi/rtl8192cu/sw.c | 16 +++++++++++++--- + drivers/net/wireless/rtlwifi/wifi.h | 1 + + 3 files changed, 24 insertions(+), 3 deletions(-) + +--- a/drivers/net/wireless/rtlwifi/core.c ++++ b/drivers/net/wireless/rtlwifi/core.c +@@ -46,10 +46,20 @@ void rtl_fw_cb(const struct firmware *fi + "Firmware callback routine entered!\n"); + complete(&rtlpriv->firmware_loading_complete); + if (!firmware) { ++ if (rtlpriv->cfg->alt_fw_name) { ++ err = request_firmware(&firmware, ++ rtlpriv->cfg->alt_fw_name, ++ rtlpriv->io.dev); ++ pr_info("Loading alternative firmware %s\n", ++ rtlpriv->cfg->alt_fw_name); ++ if (!err) ++ goto found_alt; ++ } + pr_err("Firmware %s not available\n", rtlpriv->cfg->fw_name); + rtlpriv->max_fw_size = 0; + return; + } ++found_alt: + if (firmware->size > rtlpriv->max_fw_size) { + RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG, + "Firmware is too big!\n"); +--- a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c ++++ b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c +@@ -49,6 +49,9 @@ MODULE_AUTHOR("Larry Finger rtlhal.version) && ++ !IS_92C_SERIAL(rtlpriv->rtlhal.version)) { ++ rtlpriv->cfg->fw_name = "rtlwifi/rtl8192cufw_A.bin"; ++ } else if (IS_81xxC_VENDOR_UMC_B_CUT(rtlpriv->rtlhal.version)) { ++ rtlpriv->cfg->fw_name = "rtlwifi/rtl8192cufw_B.bin"; ++ } else { ++ rtlpriv->cfg->fw_name = "rtlwifi/rtl8192cufw_TMSC.bin"; ++ } ++ /* provide name of alternative file */ ++ rtlpriv->cfg->alt_fw_name = "rtlwifi/rtl8192cufw.bin"; + pr_info("Loading firmware %s\n", rtlpriv->cfg->fw_name); + rtlpriv->max_fw_size = 0x4000; + err = request_firmware_nowait(THIS_MODULE, 1, + rtlpriv->cfg->fw_name, rtlpriv->io.dev, + GFP_KERNEL, hw, rtl_fw_cb); +- +- + return err; + } + +--- a/drivers/net/wireless/rtlwifi/wifi.h ++++ b/drivers/net/wireless/rtlwifi/wifi.h +@@ -1806,6 +1806,7 @@ struct rtl_hal_cfg { + bool write_readback; + char *name; + char *fw_name; ++ char *alt_fw_name; + struct rtl_hal_ops *ops; + struct rtl_mod_params *mod_params; + struct rtl_hal_usbint_cfg *usb_interface_cfg; diff --git a/queue-3.10/rtlwifi-rtl8192cu-fix-some-code-in-rf-handling.patch b/queue-3.10/rtlwifi-rtl8192cu-fix-some-code-in-rf-handling.patch new file mode 100644 index 00000000000..76053d80899 --- /dev/null +++ b/queue-3.10/rtlwifi-rtl8192cu-fix-some-code-in-rf-handling.patch @@ -0,0 +1,69 @@ +From e9b0784bb9de3152e787ee779868c626b137fb3b Mon Sep 17 00:00:00 2001 +From: Larry Finger +Date: Mon, 18 Nov 2013 11:11:34 -0600 +Subject: rtlwifi: rtl8192cu: Fix some code in RF handling + +From: Larry Finger + +commit e9b0784bb9de3152e787ee779868c626b137fb3b upstream. + +Signed-off-by: Larry Finger +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/rtlwifi/rtl8192cu/rf.c | 29 +++++++++++++++------------- + 1 file changed, 16 insertions(+), 13 deletions(-) + +--- a/drivers/net/wireless/rtlwifi/rtl8192cu/rf.c ++++ b/drivers/net/wireless/rtlwifi/rtl8192cu/rf.c +@@ -85,17 +85,15 @@ void rtl92cu_phy_rf6052_set_cck_txpower( + if (mac->act_scanning) { + tx_agc[RF90_PATH_A] = 0x3f3f3f3f; + tx_agc[RF90_PATH_B] = 0x3f3f3f3f; +- if (turbo_scanoff) { +- for (idx1 = RF90_PATH_A; idx1 <= RF90_PATH_B; idx1++) { +- tx_agc[idx1] = ppowerlevel[idx1] | +- (ppowerlevel[idx1] << 8) | +- (ppowerlevel[idx1] << 16) | +- (ppowerlevel[idx1] << 24); +- if (rtlhal->interface == INTF_USB) { +- if (tx_agc[idx1] > 0x20 && +- rtlefuse->external_pa) +- tx_agc[idx1] = 0x20; +- } ++ for (idx1 = RF90_PATH_A; idx1 <= RF90_PATH_B; idx1++) { ++ tx_agc[idx1] = ppowerlevel[idx1] | ++ (ppowerlevel[idx1] << 8) | ++ (ppowerlevel[idx1] << 16) | ++ (ppowerlevel[idx1] << 24); ++ if (rtlhal->interface == INTF_USB) { ++ if (tx_agc[idx1] > 0x20 && ++ rtlefuse->external_pa) ++ tx_agc[idx1] = 0x20; + } + } + } else { +@@ -107,7 +105,7 @@ void rtl92cu_phy_rf6052_set_cck_txpower( + TXHIGHPWRLEVEL_LEVEL2) { + tx_agc[RF90_PATH_A] = 0x00000000; + tx_agc[RF90_PATH_B] = 0x00000000; +- } else{ ++ } else { + for (idx1 = RF90_PATH_A; idx1 <= RF90_PATH_B; idx1++) { + tx_agc[idx1] = ppowerlevel[idx1] | + (ppowerlevel[idx1] << 8) | +@@ -373,7 +371,12 @@ static void _rtl92c_write_ofdm_power_reg + regoffset == RTXAGC_B_MCS07_MCS04) + regoffset = 0xc98; + for (i = 0; i < 3; i++) { +- writeVal = (writeVal > 6) ? (writeVal - 6) : 0; ++ if (i != 2) ++ writeVal = (writeVal > 8) ? ++ (writeVal - 8) : 0; ++ else ++ writeVal = (writeVal > 6) ? ++ (writeVal - 6) : 0; + rtl_write_byte(rtlpriv, (u32)(regoffset + i), + (u8)writeVal); + } diff --git a/queue-3.10/rtlwifi-rtl8192cu-update-the-power-index-registers.patch b/queue-3.10/rtlwifi-rtl8192cu-update-the-power-index-registers.patch new file mode 100644 index 00000000000..b8f9cab4e33 --- /dev/null +++ b/queue-3.10/rtlwifi-rtl8192cu-update-the-power-index-registers.patch @@ -0,0 +1,47 @@ +From 9806eacf5de27ab01d680c5d75c92a3a89734e4f Mon Sep 17 00:00:00 2001 +From: Larry Finger +Date: Mon, 18 Nov 2013 11:11:33 -0600 +Subject: rtlwifi: rtl8192cu: Update the power index registers + +From: Larry Finger + +commit 9806eacf5de27ab01d680c5d75c92a3a89734e4f upstream. + +This patch uses the newly introduced power index register routines. + +Signed-off-by: Larry Finger +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/rtlwifi/rtl8192cu/dm.c | 9 +++++++++ + drivers/net/wireless/rtlwifi/rtl8192cu/dm.h | 3 +++ + 2 files changed, 12 insertions(+) + +--- a/drivers/net/wireless/rtlwifi/rtl8192cu/dm.c ++++ b/drivers/net/wireless/rtlwifi/rtl8192cu/dm.c +@@ -101,6 +101,15 @@ void rtl92cu_dm_dynamic_txpower(struct i + "PHY_SetTxPowerLevel8192S() Channel = %d\n", + rtlphy->current_channel); + rtl92c_phy_set_txpower_level(hw, rtlphy->current_channel); ++ if (rtlpriv->dm.dynamic_txhighpower_lvl == ++ TXHIGHPWRLEVEL_NORMAL) ++ dm_restorepowerindex(hw); ++ else if (rtlpriv->dm.dynamic_txhighpower_lvl == ++ TXHIGHPWRLEVEL_LEVEL1) ++ dm_writepowerindex(hw, 0x14); ++ else if (rtlpriv->dm.dynamic_txhighpower_lvl == ++ TXHIGHPWRLEVEL_LEVEL2) ++ dm_writepowerindex(hw, 0x10); + } + + rtlpriv->dm.last_dtp_lvl = rtlpriv->dm.dynamic_txhighpower_lvl; +--- a/drivers/net/wireless/rtlwifi/rtl8192cu/dm.h ++++ b/drivers/net/wireless/rtlwifi/rtl8192cu/dm.h +@@ -30,3 +30,6 @@ + #include "../rtl8192ce/dm.h" + + void rtl92cu_dm_dynamic_txpower(struct ieee80211_hw *hw); ++void dm_savepowerindex(struct ieee80211_hw *hw); ++void dm_writepowerindex(struct ieee80211_hw *hw, u8 value); ++void dm_restorepowerindex(struct ieee80211_hw *hw); diff --git a/queue-3.10/rtlwifi-set-the-link-state.patch b/queue-3.10/rtlwifi-set-the-link-state.patch new file mode 100644 index 00000000000..45aa2cb53aa --- /dev/null +++ b/queue-3.10/rtlwifi-set-the-link-state.patch @@ -0,0 +1,30 @@ +From 619ce76f8bb850b57032501a39f26aa6c6731c70 Mon Sep 17 00:00:00 2001 +From: Larry Finger +Date: Mon, 18 Nov 2013 11:11:28 -0600 +Subject: rtlwifi: Set the link state + +From: Larry Finger + +commit 619ce76f8bb850b57032501a39f26aa6c6731c70 upstream. + +The present code fails to set the linked state when an interface is +added. + +Signed-off-by: Larry Finger +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/rtlwifi/core.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/wireless/rtlwifi/core.c ++++ b/drivers/net/wireless/rtlwifi/core.c +@@ -194,6 +194,7 @@ static int rtl_op_add_interface(struct i + rtlpriv->cfg->maps + [RTL_IBSS_INT_MASKS]); + } ++ mac->link_state = MAC80211_LINKED; + break; + case NL80211_IFTYPE_ADHOC: + RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD, diff --git a/queue-3.10/rtlwifi-update-beacon-statistics-for-usb-driver.patch b/queue-3.10/rtlwifi-update-beacon-statistics-for-usb-driver.patch new file mode 100644 index 00000000000..25b9c1c48d2 --- /dev/null +++ b/queue-3.10/rtlwifi-update-beacon-statistics-for-usb-driver.patch @@ -0,0 +1,31 @@ +From 65b9cc97c6852fae19dc5c7745e9abc8dd380aad Mon Sep 17 00:00:00 2001 +From: Larry Finger +Date: Mon, 18 Nov 2013 11:11:31 -0600 +Subject: rtlwifi: Update beacon statistics for USB driver + +From: Larry Finger + +commit 65b9cc97c6852fae19dc5c7745e9abc8dd380aad upstream. + +The USB drivers were not updating the beacon statistics, which led to +false beacon loss indications. + +Signed-off-by: Larry Finger +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/rtlwifi/usb.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/net/wireless/rtlwifi/usb.c ++++ b/drivers/net/wireless/rtlwifi/usb.c +@@ -477,6 +477,8 @@ static void _rtl_usb_rx_process_agg(stru + if (unicast) + rtlpriv->link_info.num_rx_inperiod++; + } ++ /* static bcn for roaming */ ++ rtl_beacon_statistic(hw, skb); + } + } + diff --git a/queue-3.10/s390-uapi-fix-struct-statfs64-definition.patch b/queue-3.10/s390-uapi-fix-struct-statfs64-definition.patch new file mode 100644 index 00000000000..ffec82e91fb --- /dev/null +++ b/queue-3.10/s390-uapi-fix-struct-statfs64-definition.patch @@ -0,0 +1,44 @@ +From 4e078146dff728f4865270a47710d57797e81eb6 Mon Sep 17 00:00:00 2001 +From: Heiko Carstens +Date: Tue, 21 Jan 2014 17:31:10 +0100 +Subject: s390/uapi: fix struct statfs64 definition + +From: Heiko Carstens + +commit 4e078146dff728f4865270a47710d57797e81eb6 upstream. + +With b8668fd0a7e1b59f "s390/uapi: change struct statfs[64] member types +to unsigned values" the size of a couple of struct statfs64 member got +incorrectly changed from 64 to 32 bit for 32 bit builds. + +Fix this by changing the type of couple of struct statfs64 members from +unsigned long to unsigned long long. +The definition of struct compat_statfs64 was correct however. + +Signed-off-by: Heiko Carstens +Signed-off-by: Martin Schwidefsky +Signed-off-by: Greg Kroah-Hartman + +--- + arch/s390/include/uapi/asm/statfs.h | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +--- a/arch/s390/include/uapi/asm/statfs.h ++++ b/arch/s390/include/uapi/asm/statfs.h +@@ -35,11 +35,11 @@ struct statfs { + struct statfs64 { + unsigned int f_type; + unsigned int f_bsize; +- unsigned long f_blocks; +- unsigned long f_bfree; +- unsigned long f_bavail; +- unsigned long f_files; +- unsigned long f_ffree; ++ unsigned long long f_blocks; ++ unsigned long long f_bfree; ++ unsigned long long f_bavail; ++ unsigned long long f_files; ++ unsigned long long f_ffree; + __kernel_fsid_t f_fsid; + unsigned int f_namelen; + unsigned int f_frsize; diff --git a/queue-3.10/serial-8250-enable-uart_bug_nomsr-for-tegra.patch b/queue-3.10/serial-8250-enable-uart_bug_nomsr-for-tegra.patch new file mode 100644 index 00000000000..30710e63ca2 --- /dev/null +++ b/queue-3.10/serial-8250-enable-uart_bug_nomsr-for-tegra.patch @@ -0,0 +1,65 @@ +From 3685f19e07802ec4207b52465c408f185b66490e Mon Sep 17 00:00:00 2001 +From: Stephen Warren +Date: Tue, 7 Jan 2014 15:00:12 -0700 +Subject: serial: 8250: enable UART_BUG_NOMSR for Tegra + +From: Stephen Warren + +commit 3685f19e07802ec4207b52465c408f185b66490e upstream. + +Tegra chips have 4 or 5 identical UART modules embedded. UARTs C..E have +their MODEM-control signals tied off to a static state. However UARTs A +and B can optionally route those signals to/from package pins, depending +on the exact pinmux configuration. + +When these signals are not routed to package pins, false interrupts may +trigger either temporarily, or permanently, all while not showing up in +the IIR; it will read as NO_INT. This will eventually lead to the UART +IRQ being disabled due to unhandled interrupts. When this happens, the +kernel may print e.g.: + + irq 68: nobody cared (try booting with the "irqpoll" option) + +In order to prevent this, enable UART_BUG_NOMSR. This prevents +UART_IER_MSI from being enabled, which prevents the false interrupts +from triggering. + +In practice, this is not needed under any of the following conditions: + +* On Tegra chips after Tegra30, since the HW bug has apparently been + fixed. + +* On UARTs C..E since their MODEM control signals are tied to the correct + static state which doesn't trigger the issue. + +* On UARTs A..B if the MODEM control signals are routed out to package + pins, since they will then carry valid signals. + +However, we ignore these exceptions for now, since they are only relevant +if a board actually hooks up more than a 4-wire UART, and no currently +supported board does this. If we ever support a board that does, we can +refine the algorithm that enables UART_BUG_NOMSR to take those exceptions +into account, and/or read a flag from DT/... that indicates that the +board has hooked up and pinmux'd more than a 4-wire UART. + +Reported-by: Olof Johansson # autotester +Signed-off-by: Stephen Warren +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/serial/8250/8250_core.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/tty/serial/8250/8250_core.c ++++ b/drivers/tty/serial/8250/8250_core.c +@@ -2670,6 +2670,10 @@ static void serial8250_config_port(struc + if (port->type == PORT_16550A && port->iotype == UPIO_AU) + up->bugs |= UART_BUG_NOMSR; + ++ /* HW bugs may trigger IRQ while IIR == NO_INT */ ++ if (port->type == PORT_TEGRA) ++ up->bugs |= UART_BUG_NOMSR; ++ + if (port->type != PORT_UNKNOWN && flags & UART_CONFIG_IRQ) + autoconfig_irq(up); + diff --git a/queue-3.10/serial-8250-fix-initialisation-of-quatech-cards-with-the-amcc-pci-chip.patch b/queue-3.10/serial-8250-fix-initialisation-of-quatech-cards-with-the-amcc-pci-chip.patch new file mode 100644 index 00000000000..ffadef9f21a --- /dev/null +++ b/queue-3.10/serial-8250-fix-initialisation-of-quatech-cards-with-the-amcc-pci-chip.patch @@ -0,0 +1,34 @@ +From 9c5320f8d7d9a2cf623e65d50e1113f34d9b9eb1 Mon Sep 17 00:00:00 2001 +From: Jonathan Woithe +Date: Mon, 9 Dec 2013 16:33:08 +1030 +Subject: serial: 8250: Fix initialisation of Quatech cards with the AMCC PCI chip + +From: Jonathan Woithe + +commit 9c5320f8d7d9a2cf623e65d50e1113f34d9b9eb1 upstream. + +Fix the initialisation of older Quatech serial cards which are fitted with +the AMCC PCI Matchmaker interface chip. + +Signed-off-by: Jonathan Woithe (jwoithe@just42.net) +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/serial/8250/8250_pci.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/tty/serial/8250/8250_pci.c ++++ b/drivers/tty/serial/8250/8250_pci.c +@@ -1260,10 +1260,10 @@ static int pci_quatech_init(struct pci_d + unsigned long base = pci_resource_start(dev, 0); + if (base) { + u32 tmp; +- outl(inl(base + 0x38), base + 0x38); ++ outl(inl(base + 0x38) | 0x00002000, base + 0x38); + tmp = inl(base + 0x3c); + outl(tmp | 0x01000000, base + 0x3c); +- outl(tmp, base + 0x3c); ++ outl(tmp &= ~0x01000000, base + 0x3c); + } + } + return 0; diff --git a/queue-3.10/serial-add-support-for-200-v3-series-titan-card.patch b/queue-3.10/serial-add-support-for-200-v3-series-titan-card.patch new file mode 100644 index 00000000000..ac93419d1b9 --- /dev/null +++ b/queue-3.10/serial-add-support-for-200-v3-series-titan-card.patch @@ -0,0 +1,36 @@ +From 48c0247d7b7bf58abb85a39021099529df365c4d Mon Sep 17 00:00:00 2001 +From: Yegor Yefremov +Date: Mon, 9 Dec 2013 12:11:15 +0100 +Subject: serial: add support for 200 v3 series Titan card + +From: Yegor Yefremov + +commit 48c0247d7b7bf58abb85a39021099529df365c4d upstream. + +Signed-off-by: Yegor Yefremov +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/serial/8250/8250_pci.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/tty/serial/8250/8250_pci.c ++++ b/drivers/tty/serial/8250/8250_pci.c +@@ -1545,6 +1545,7 @@ pci_wch_ch353_setup(struct serial_privat + #define PCI_DEVICE_ID_TITAN_800E 0xA014 + #define PCI_DEVICE_ID_TITAN_200EI 0xA016 + #define PCI_DEVICE_ID_TITAN_200EISI 0xA017 ++#define PCI_DEVICE_ID_TITAN_200V3 0xA306 + #define PCI_DEVICE_ID_TITAN_400V3 0xA310 + #define PCI_DEVICE_ID_TITAN_410V3 0xA312 + #define PCI_DEVICE_ID_TITAN_800V3 0xA314 +@@ -4139,6 +4140,9 @@ static struct pci_device_id serial_pci_t + { PCI_VENDOR_ID_TITAN, PCI_DEVICE_ID_TITAN_200EISI, + PCI_ANY_ID, PCI_ANY_ID, 0, 0, + pbn_oxsemi_2_4000000 }, ++ { PCI_VENDOR_ID_TITAN, PCI_DEVICE_ID_TITAN_200V3, ++ PCI_ANY_ID, PCI_ANY_ID, 0, 0, ++ pbn_b0_bt_2_921600 }, + { PCI_VENDOR_ID_TITAN, PCI_DEVICE_ID_TITAN_400V3, + PCI_ANY_ID, PCI_ANY_ID, 0, 0, + pbn_b0_4_921600 }, diff --git a/queue-3.10/series b/queue-3.10/series index 012982da9f0..1ff962b20ba 100644 --- a/queue-3.10/series +++ b/queue-3.10/series @@ -6,3 +6,49 @@ mm-hugetlbfs-fix-hugetlbfs-optimization.patch e752x_edac-fix-pci_dev-usage-count.patch e1000e-fix-compiler-warnings.patch mm-mempolicy.c-fix-mempolicy-printing-in-numa_maps.patch +x86-x32-correct-invalid-use-of-user-timespec-in-the-kernel.patch +x86-efi-fix-off-by-one-bug-in-efi-boot-services-reservation.patch +x86-add-check-for-number-of-available-vectors-before-cpu-down.patch +kvm-x86-limit-pit-timer-frequency.patch +usb-dwc3-fix-the-glue-drivers-using-the-nop-phy.patch +usb-pl2303-fix-data-corruption-on-termios-updates.patch +usb-option-add-new-zte-3g-modem-pids-to-option-driver.patch +usb-serial-add-support-for-iball-3.5g-connect-usb-modem.patch +usb-cypress_m8-fix-ring-indicator-detection-and-reporting.patch +usb-ftdi_sio-added-cs5-quirk-for-broken-smartcard-readers.patch +usb-nokia-502-is-an-unusual-device.patch +usb-xhci-check-for-xhci_plat-in-xhci_cleanup_msix.patch +usb-fix-race-between-hub_disconnect-and-recursively_mark_notattached.patch +usb-ehci-add-freescale-imx28-special-write-register-method.patch +rtlwifi-rtl8192cu-add-new-device-id.patch +rtlwifi-update-beacon-statistics-for-usb-driver.patch +rtlwifi-rtl8192c-prevent-reconnect-attempts-if-not-connected.patch +rtlwifi-rtl8192cu-add-new-firmware.patch +rtlwifi-redo-register-save-locations.patch +rtlwifi-set-the-link-state.patch +rtlwifi-rtl8192c-add-new-definitions-in-the-dm_common-header.patch +rtlwifi-increase-the-rx-queue-length-for-usb-drivers.patch +rtlwifi-rtl8192c-add-routines-to-save-restore-power-index-registers.patch +rtlwifi-rtl8192cu-update-the-power-index-registers.patch +rtlwifi-rtl8192cu-fix-some-code-in-rf-handling.patch +rtlwifi-add-missing-code-to-pwdb-statics-routine.patch +rtlwifi-rtl8188ee-fix-typo-in-code.patch +mwifiex-add-missing-endian-conversion-for-fw_tsf.patch +mwifiex-fix-wrong-11ac-bits-setting-in-fw_cap_info.patch +iwlwifi-pcie-enable-oscillator-for-l1-exit.patch +iwlwifi-mvm-fix-missing-cleanup-in-.start-error-path.patch +b43-fix-lockdep-splat.patch +b43-fix-unload-oops-if-firmware-is-not-available.patch +b43legacy-fix-unload-oops-if-firmware-is-not-available.patch +b43-fix-the-wrong-assignment-of-status.freq-in-b43_rx.patch +staging-r8712u-set-device-type-to-wlan.patch +staging-vt6656-bbvupdatepreedthreshold-always-set-sensitivity-on-bscanning.patch +staging-vt6656-cardqgetnexttbtt-correct-ulownexttbtt.patch +tty-serial-at91-handle-shutdown-more-safely.patch +arm-at91-smc-bug-fix-in-sam9_smc_cs_read.patch +hwmon-k10temp-add-support-for-kaveri-cpus.patch +serial-add-support-for-200-v3-series-titan-card.patch +serial-8250-fix-initialisation-of-quatech-cards-with-the-amcc-pci-chip.patch +serial-8250-enable-uart_bug_nomsr-for-tegra.patch +kvm-s390-fix-diagnose-code-extraction.patch +s390-uapi-fix-struct-statfs64-definition.patch diff --git a/queue-3.10/staging-r8712u-set-device-type-to-wlan.patch b/queue-3.10/staging-r8712u-set-device-type-to-wlan.patch new file mode 100644 index 00000000000..01ccdb59eaf --- /dev/null +++ b/queue-3.10/staging-r8712u-set-device-type-to-wlan.patch @@ -0,0 +1,40 @@ +From 3a21f00a5002b14e4aab52aef59d33ed28468a13 Mon Sep 17 00:00:00 2001 +From: Larry Finger +Date: Tue, 24 Dec 2013 11:22:54 -0600 +Subject: staging: r8712u: Set device type to wlan + +From: Larry Finger + +commit 3a21f00a5002b14e4aab52aef59d33ed28468a13 upstream. + +The latest version of NetworkManager does not recognize the device as wireless +without this change. + +Signed-off-by: Larry Finger +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/rtl8712/usb_intf.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/staging/rtl8712/usb_intf.c ++++ b/drivers/staging/rtl8712/usb_intf.c +@@ -358,6 +358,10 @@ static u8 key_2char2num(u8 hch, u8 lch) + return (hex_to_bin(hch) << 4) | hex_to_bin(lch); + } + ++static const struct device_type wlan_type = { ++ .name = "wlan", ++}; ++ + /* + * drv_init() - a device potentially for us + * +@@ -393,6 +397,7 @@ static int r871xu_drv_init(struct usb_in + padapter->pusb_intf = pusb_intf; + usb_set_intfdata(pusb_intf, pnetdev); + SET_NETDEV_DEV(pnetdev, &pusb_intf->dev); ++ pnetdev->dev.type = &wlan_type; + /* step 2. */ + padapter->dvobj_init = &r8712_usb_dvobj_init; + padapter->dvobj_deinit = &r8712_usb_dvobj_deinit; diff --git a/queue-3.10/staging-vt6656-bbvupdatepreedthreshold-always-set-sensitivity-on-bscanning.patch b/queue-3.10/staging-vt6656-bbvupdatepreedthreshold-always-set-sensitivity-on-bscanning.patch new file mode 100644 index 00000000000..83b191e19c2 --- /dev/null +++ b/queue-3.10/staging-vt6656-bbvupdatepreedthreshold-always-set-sensitivity-on-bscanning.patch @@ -0,0 +1,48 @@ +From 8f248dae133668bfb8e9379b4b3f0571c858b24a Mon Sep 17 00:00:00 2001 +From: Malcolm Priestley +Date: Sun, 8 Dec 2013 09:11:30 +0000 +Subject: staging: vt6656: [BUG] BBvUpdatePreEDThreshold Always set sensitivity on bScanning + +From: Malcolm Priestley + +commit 8f248dae133668bfb8e9379b4b3f0571c858b24a upstream. + +byBBPreEDIndex value is initially 0, this means that from +cold BBvUpdatePreEDThreshold is never set. + +This means that sensitivity may be in an ambiguous state, +failing to scan any wireless points or at least distant ones. + +Signed-off-by: Malcolm Priestley +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/vt6656/baseband.c | 3 --- + 1 file changed, 3 deletions(-) + +--- a/drivers/staging/vt6656/baseband.c ++++ b/drivers/staging/vt6656/baseband.c +@@ -1466,7 +1466,6 @@ void BBvUpdatePreEDThreshold(struct vnt_ + + if( bScanning ) + { // need Max sensitivity //RSSI -69, -70,.... +- if(pDevice->byBBPreEDIndex == 0) break; + pDevice->byBBPreEDIndex = 0; + ControlvWriteByte(pDevice, MESSAGE_REQUEST_BBREG, 0xC9, 0x00); //CR201(0xC9) + ControlvWriteByte(pDevice, MESSAGE_REQUEST_BBREG, 0xCE, 0x30); //CR206(0xCE) +@@ -1609,7 +1608,6 @@ void BBvUpdatePreEDThreshold(struct vnt_ + + if( bScanning ) + { // need Max sensitivity //RSSI -69, -70, ... +- if(pDevice->byBBPreEDIndex == 0) break; + pDevice->byBBPreEDIndex = 0; + ControlvWriteByte(pDevice, MESSAGE_REQUEST_BBREG, 0xC9, 0x00); //CR201(0xC9) + ControlvWriteByte(pDevice, MESSAGE_REQUEST_BBREG, 0xCE, 0x24); //CR206(0xCE) +@@ -1761,7 +1759,6 @@ void BBvUpdatePreEDThreshold(struct vnt_ + case RF_VT3342A0: //RobertYu:20060627, testing table + if( bScanning ) + { // need Max sensitivity //RSSI -67, -68, ... +- if(pDevice->byBBPreEDIndex == 0) break; + pDevice->byBBPreEDIndex = 0; + ControlvWriteByte(pDevice, MESSAGE_REQUEST_BBREG, 0xC9, 0x00); //CR201(0xC9) + ControlvWriteByte(pDevice, MESSAGE_REQUEST_BBREG, 0xCE, 0x38); //CR206(0xCE) diff --git a/queue-3.10/staging-vt6656-cardqgetnexttbtt-correct-ulownexttbtt.patch b/queue-3.10/staging-vt6656-cardqgetnexttbtt-correct-ulownexttbtt.patch new file mode 100644 index 00000000000..b1e8d1756b1 --- /dev/null +++ b/queue-3.10/staging-vt6656-cardqgetnexttbtt-correct-ulownexttbtt.patch @@ -0,0 +1,31 @@ +From 9acec059c0cef0bf086c738f4c0b1f4447782a48 Mon Sep 17 00:00:00 2001 +From: Malcolm Priestley +Date: Wed, 1 Jan 2014 19:19:28 +0000 +Subject: staging: vt6656: CARDqGetNextTBTT correct uLowNextTBTT + +From: Malcolm Priestley + +commit 9acec059c0cef0bf086c738f4c0b1f4447782a48 upstream. + +value uLowNextTBTT yields wrong value. + +ULL is needed with qwTSF + +Signed-off-by: Malcolm Priestley +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/vt6656/card.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/staging/vt6656/card.c ++++ b/drivers/staging/vt6656/card.c +@@ -761,7 +761,7 @@ u64 CARDqGetNextTBTT(u64 qwTSF, u16 wBea + + uBeaconInterval = wBeaconInterval * 1024; + // Next TBTT = ((local_current_TSF / beacon_interval) + 1 ) * beacon_interval +- uLowNextTBTT = ((qwTSF & 0xffffffffU) >> 10) << 10; ++ uLowNextTBTT = ((qwTSF & 0xffffffffULL) >> 10) << 10; + uLowRemain = (uLowNextTBTT) % uBeaconInterval; + uHighRemain = ((0x80000000 % uBeaconInterval) * 2 * (u32)(qwTSF >> 32)) + % uBeaconInterval; diff --git a/queue-3.10/tty-serial-at91-handle-shutdown-more-safely.patch b/queue-3.10/tty-serial-at91-handle-shutdown-more-safely.patch new file mode 100644 index 00000000000..65eb5c6d698 --- /dev/null +++ b/queue-3.10/tty-serial-at91-handle-shutdown-more-safely.patch @@ -0,0 +1,73 @@ +From 0cc7c6c7916b1b6f34350ff1473b80b9f7e459c0 Mon Sep 17 00:00:00 2001 +From: Marek Roszko +Date: Tue, 7 Jan 2014 11:45:06 +0100 +Subject: tty/serial: at91: Handle shutdown more safely + +From: Marek Roszko + +commit 0cc7c6c7916b1b6f34350ff1473b80b9f7e459c0 upstream. + +Interrupts were being cleaned up late in the shutdown handler, it is possible +that an interrupt can occur and schedule a tasklet that runs after the port is +cleaned up. There is a null dereference due to this race condition with the +following stacktrace: + +[] (atmel_tasklet_func+0x514/0x814) from [] (tasklet_action+0x70/0xa8) +[] (tasklet_action+0x70/0xa8) from [] (__do_softirq+0x90/0x144) +[] (__do_softirq+0x90/0x144) from [] (irq_exit+0x40/0x4c) +[] (irq_exit+0x40/0x4c) from [] (handle_IRQ+0x64/0x84) +[] (handle_IRQ+0x64/0x84) from [] (__irq_svc+0x40/0x50) +[] (__irq_svc+0x40/0x50) from [] (atmel_rx_dma_release+0x88/0xb8) +[] (atmel_rx_dma_release+0x88/0xb8) from [] (atmel_shutdown+0x104/0x160) +[] (atmel_shutdown+0x104/0x160) from [] (uart_port_shutdown+0x2c/0x38) + +Signed-off-by: Marek Roszko +Acked-by: Leilei Zhao +Signed-off-by: Nicolas Ferre +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/serial/atmel_serial.c | 20 +++++++++++++------- + 1 file changed, 13 insertions(+), 7 deletions(-) + +--- a/drivers/tty/serial/atmel_serial.c ++++ b/drivers/tty/serial/atmel_serial.c +@@ -1022,12 +1022,24 @@ static int atmel_startup(struct uart_por + static void atmel_shutdown(struct uart_port *port) + { + struct atmel_uart_port *atmel_port = to_atmel_uart_port(port); ++ ++ /* ++ * Clear out any scheduled tasklets before ++ * we destroy the buffers ++ */ ++ tasklet_kill(&atmel_port->tasklet); ++ + /* +- * Ensure everything is stopped. ++ * Ensure everything is stopped and ++ * disable all interrupts, port and break condition. + */ + atmel_stop_rx(port); + atmel_stop_tx(port); + ++ UART_PUT_CR(port, ATMEL_US_RSTSTA); ++ UART_PUT_IDR(port, -1); ++ ++ + /* + * Shut-down the DMA. + */ +@@ -1054,12 +1066,6 @@ static void atmel_shutdown(struct uart_p + } + + /* +- * Disable all interrupts, port and break condition. +- */ +- UART_PUT_CR(port, ATMEL_US_RSTSTA); +- UART_PUT_IDR(port, -1); +- +- /* + * Free the interrupt + */ + free_irq(port->irq, port); diff --git a/queue-3.10/usb-cypress_m8-fix-ring-indicator-detection-and-reporting.patch b/queue-3.10/usb-cypress_m8-fix-ring-indicator-detection-and-reporting.patch new file mode 100644 index 00000000000..80401a757b1 --- /dev/null +++ b/queue-3.10/usb-cypress_m8-fix-ring-indicator-detection-and-reporting.patch @@ -0,0 +1,33 @@ +From 440ebadeae9298d7de3d4d105342691841ec88d0 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Thu, 2 Jan 2014 22:49:24 +0100 +Subject: USB: cypress_m8: fix ring-indicator detection and reporting + +From: Johan Hovold + +commit 440ebadeae9298d7de3d4d105342691841ec88d0 upstream. + +Fix ring-indicator (RI) status-bit definition, which was defined as CTS, +effectively preventing RI-changes from being detected while reporting +false RI status. + +This bug predates git. + +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/cypress_m8.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/serial/cypress_m8.h ++++ b/drivers/usb/serial/cypress_m8.h +@@ -63,7 +63,7 @@ + #define UART_DSR 0x20 /* data set ready - flow control - device to host */ + #define CONTROL_RTS 0x10 /* request to send - flow control - host to device */ + #define UART_CTS 0x10 /* clear to send - flow control - device to host */ +-#define UART_RI 0x10 /* ring indicator - modem - device to host */ ++#define UART_RI 0x80 /* ring indicator - modem - device to host */ + #define UART_CD 0x40 /* carrier detect - modem - device to host */ + #define CYP_ERROR 0x08 /* received from input report - device to host */ + /* Note - the below has nothing to do with the "feature report" reset */ diff --git a/queue-3.10/usb-dwc3-fix-the-glue-drivers-using-the-nop-phy.patch b/queue-3.10/usb-dwc3-fix-the-glue-drivers-using-the-nop-phy.patch new file mode 100644 index 00000000000..f24f18bc9bc --- /dev/null +++ b/queue-3.10/usb-dwc3-fix-the-glue-drivers-using-the-nop-phy.patch @@ -0,0 +1,45 @@ +From 13518673f1419f2667985a6fca4543e44143408b Mon Sep 17 00:00:00 2001 +From: Heikki Krogerus +Date: Wed, 18 Dec 2013 16:41:25 +0200 +Subject: usb: dwc3: fix the glue drivers using the nop phy + +From: Heikki Krogerus + +commit 13518673f1419f2667985a6fca4543e44143408b upstream. + +The reset_gpio member of the usb_phy_gen_xceiv_platform_data +structure needs the have negative value or phy-generic's +probe will fail unless DT is used. 0 is a valid gpio number. + +This fixes an issue where phy-generic fails to probe with +message: "usb_phy_gen_xceiv.0: Error requesting RESET GPIO 0". + +Signed-off-by: Heikki Krogerus +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/dwc3/dwc3-exynos.c | 1 + + drivers/usb/dwc3/dwc3-pci.c | 1 + + 2 files changed, 2 insertions(+) + +--- a/drivers/usb/dwc3/dwc3-exynos.c ++++ b/drivers/usb/dwc3/dwc3-exynos.c +@@ -46,6 +46,7 @@ static int dwc3_exynos_register_phys(str + + exynos->usb2_phy = pdev; + pdata.type = USB_PHY_TYPE_USB2; ++ pdata.gpio_reset = -1; + + ret = platform_device_add_data(exynos->usb2_phy, &pdata, sizeof(pdata)); + if (ret) +--- a/drivers/usb/dwc3/dwc3-pci.c ++++ b/drivers/usb/dwc3/dwc3-pci.c +@@ -72,6 +72,7 @@ static int dwc3_pci_register_phys(struct + + glue->usb2_phy = pdev; + pdata.type = USB_PHY_TYPE_USB2; ++ pdata.gpio_reset = -1; + + ret = platform_device_add_data(glue->usb2_phy, &pdata, sizeof(pdata)); + if (ret) diff --git a/queue-3.10/usb-ehci-add-freescale-imx28-special-write-register-method.patch b/queue-3.10/usb-ehci-add-freescale-imx28-special-write-register-method.patch new file mode 100644 index 00000000000..53a1c23acf7 --- /dev/null +++ b/queue-3.10/usb-ehci-add-freescale-imx28-special-write-register-method.patch @@ -0,0 +1,75 @@ +From feffe09f510c475df082546815f9e4a573f6a233 Mon Sep 17 00:00:00 2001 +From: Peter Chen +Date: Fri, 10 Jan 2014 13:51:26 +0800 +Subject: usb: ehci: add freescale imx28 special write register method + +From: Peter Chen + +commit feffe09f510c475df082546815f9e4a573f6a233 upstream. + +According to Freescale imx28 Errata, "ENGR119653 USB: ARM to USB +register error issue", All USB register write operations must +use the ARM SWP instruction. So, we implement a special ehci_write +for imx28. + +Discussion for it at below: +http://marc.info/?l=linux-usb&m=137996395529294&w=2 + +Without this patcheset, imx28 works unstable at high AHB bus loading. +If the bus loading is not high, the imx28 usb can work well at the most +of time. There is a IC errata for this problem, usually, we consider +IC errata is a problem not a new feature, and this workaround is needed +for that, so we need to add them to stable tree 3.11+. + +Cc: robert.hodaszi@digi.com +Signed-off-by: Peter Chen +Acked-by: Alan Stern +Signed-off-by: Marc Kleine-Budde +Tested-by: Marc Kleine-Budde +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/ehci.h | 18 +++++++++++++++++- + 1 file changed, 17 insertions(+), 1 deletion(-) + +--- a/drivers/usb/host/ehci.h ++++ b/drivers/usb/host/ehci.h +@@ -200,6 +200,7 @@ struct ehci_hcd { /* one per controlle + unsigned has_synopsys_hc_bug:1; /* Synopsys HC */ + unsigned frame_index_bug:1; /* MosChip (AKA NetMos) */ + unsigned need_oc_pp_cycle:1; /* MPC834X port power */ ++ unsigned imx28_write_fix:1; /* For Freescale i.MX28 */ + + /* required for usb32 quirk */ + #define OHCI_CTRL_HCFS (3 << 6) +@@ -675,6 +676,18 @@ static inline unsigned int ehci_readl(co + #endif + } + ++#ifdef CONFIG_SOC_IMX28 ++static inline void imx28_ehci_writel(const unsigned int val, ++ volatile __u32 __iomem *addr) ++{ ++ __asm__ ("swp %0, %0, [%1]" : : "r"(val), "r"(addr)); ++} ++#else ++static inline void imx28_ehci_writel(const unsigned int val, ++ volatile __u32 __iomem *addr) ++{ ++} ++#endif + static inline void ehci_writel(const struct ehci_hcd *ehci, + const unsigned int val, __u32 __iomem *regs) + { +@@ -683,7 +696,10 @@ static inline void ehci_writel(const str + writel_be(val, regs) : + writel(val, regs); + #else +- writel(val, regs); ++ if (ehci->imx28_write_fix) ++ imx28_ehci_writel(val, regs); ++ else ++ writel(val, regs); + #endif + } + diff --git a/queue-3.10/usb-fix-race-between-hub_disconnect-and-recursively_mark_notattached.patch b/queue-3.10/usb-fix-race-between-hub_disconnect-and-recursively_mark_notattached.patch new file mode 100644 index 00000000000..4f80e5e90c3 --- /dev/null +++ b/queue-3.10/usb-fix-race-between-hub_disconnect-and-recursively_mark_notattached.patch @@ -0,0 +1,92 @@ +From 543d7784b07ffd16cc82a9cb4e1e0323fd0040f1 Mon Sep 17 00:00:00 2001 +From: Alan Stern +Date: Tue, 7 Jan 2014 10:43:02 -0500 +Subject: USB: fix race between hub_disconnect and recursively_mark_NOTATTACHED + +From: Alan Stern + +commit 543d7784b07ffd16cc82a9cb4e1e0323fd0040f1 upstream. + +There is a race in the hub driver between hub_disconnect() and +recursively_mark_NOTATTACHED(). This race can be triggered if the +driver is unbound from a device at the same time as the bus's root hub +is removed. When the race occurs, it can cause an oops: + +BUG: unable to handle kernel NULL pointer dereference at 0000015c +IP: [] recursively_mark_NOTATTACHED+0x20/0x60 +Call Trace: + [] recursively_mark_NOTATTACHED+0x34/0x60 + [] recursively_mark_NOTATTACHED+0x34/0x60 + [] recursively_mark_NOTATTACHED+0x34/0x60 + [] recursively_mark_NOTATTACHED+0x34/0x60 + [] usb_set_device_state+0x92/0x120 + [] usb_disconnect+0x2b/0x1a0 + [] usb_remove_hcd+0xb0/0x160 + [] ? _raw_spin_unlock_irqrestore+0x26/0x50 + [] ehci_mid_remove+0x1c/0x30 + [] ehci_mid_stop_host+0x16/0x30 + [] penwell_otg_work+0xd28/0x3520 + [] ? __schedule+0x39b/0x7f0 + [] ? sub_preempt_count+0x3d/0x50 + [] process_one_work+0x11d/0x3d0 + [] ? mutex_unlock+0xd/0x10 + [] ? manage_workers.isra.24+0x1b5/0x270 + [] worker_thread+0xf9/0x320 + [] ? _raw_spin_unlock_irqrestore+0x26/0x50 + [] ? rescuer_thread+0x2b0/0x2b0 + [] kthread+0x94/0xa0 + [] ret_from_kernel_thread+0x1b/0x28 + [] ? kthread_create_on_node+0xc0/0xc0 + +One problem is that recursively_mark_NOTATTACHED() uses the intfdata +value and hub->hdev->maxchild while hub_disconnect() is clearing them. +Another problem is that it uses hub->ports[i] while the port device is +being released. + +To fix this race, we need to hold the device_state_lock while +hub_disconnect() changes the values. (Note that usb_disconnect() +and hub_port_connect_change() already acquire this lock at similar +critical times during a USB device's life cycle.) We also need to +remove the port devices after maxchild has been set to 0, instead of +before. + +Signed-off-by: Alan Stern +Reported-by: "Du, Changbin" +Tested-by: "Du, Changbin" +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/hub.c | 14 +++++++++----- + 1 file changed, 9 insertions(+), 5 deletions(-) + +--- a/drivers/usb/core/hub.c ++++ b/drivers/usb/core/hub.c +@@ -1605,7 +1605,7 @@ static void hub_disconnect(struct usb_in + { + struct usb_hub *hub = usb_get_intfdata(intf); + struct usb_device *hdev = interface_to_usbdev(intf); +- int i; ++ int port1; + + /* Take the hub off the event list and don't let it be added again */ + spin_lock_irq(&hub_event_lock); +@@ -1620,11 +1620,15 @@ static void hub_disconnect(struct usb_in + hub->error = 0; + hub_quiesce(hub, HUB_DISCONNECT); + +- usb_set_intfdata (intf, NULL); ++ /* Avoid races with recursively_mark_NOTATTACHED() */ ++ spin_lock_irq(&device_state_lock); ++ port1 = hdev->maxchild; ++ hdev->maxchild = 0; ++ usb_set_intfdata(intf, NULL); ++ spin_unlock_irq(&device_state_lock); + +- for (i = 0; i < hdev->maxchild; i++) +- usb_hub_remove_port_device(hub, i + 1); +- hub->hdev->maxchild = 0; ++ for (; port1 > 0; --port1) ++ usb_hub_remove_port_device(hub, port1); + + if (hub->hdev->speed == USB_SPEED_HIGH) + highspeed_hubs--; diff --git a/queue-3.10/usb-ftdi_sio-added-cs5-quirk-for-broken-smartcard-readers.patch b/queue-3.10/usb-ftdi_sio-added-cs5-quirk-for-broken-smartcard-readers.patch new file mode 100644 index 00000000000..19252e76c74 --- /dev/null +++ b/queue-3.10/usb-ftdi_sio-added-cs5-quirk-for-broken-smartcard-readers.patch @@ -0,0 +1,67 @@ +From c1f15196ac3b541d084dc80a8fbd8a74c6a0bd44 Mon Sep 17 00:00:00 2001 +From: Colin Leitner +Date: Mon, 6 Jan 2014 21:33:54 +0100 +Subject: USB: ftdi_sio: added CS5 quirk for broken smartcard readers + +From: Colin Leitner + +commit c1f15196ac3b541d084dc80a8fbd8a74c6a0bd44 upstream. + +Genuine FTDI chips support only CS7/8. A previous fix in commit +8704211f65a2 ("USB: ftdi_sio: fixed handling of unsupported CSIZE +setting") enforced this limitation and reported it back to userspace. + +However, certain types of smartcard readers depend on specific +driver behaviour that requests 0 data bits (not 5) to change into a +different operating mode if CS5 has been set. + +This patch reenables this behaviour for all FTDI devices. + +Tagged to be added to stable, because it affects a lot of users of +embedded systems which rely on these readers to work properly. + +Reported-by: Heinrich Siebmanns +Tested-by: Heinrich Siebmanns +Signed-off-by: Colin Leitner +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/ftdi_sio.c | 17 +++++++++++++++-- + 1 file changed, 15 insertions(+), 2 deletions(-) + +--- a/drivers/usb/serial/ftdi_sio.c ++++ b/drivers/usb/serial/ftdi_sio.c +@@ -2132,10 +2132,20 @@ static void ftdi_set_termios(struct tty_ + } + + /* +- * All FTDI UART chips are limited to CS7/8. We won't pretend to ++ * All FTDI UART chips are limited to CS7/8. We shouldn't pretend to + * support CS5/6 and revert the CSIZE setting instead. ++ * ++ * CS5 however is used to control some smartcard readers which abuse ++ * this limitation to switch modes. Original FTDI chips fall back to ++ * eight data bits. ++ * ++ * TODO: Implement a quirk to only allow this with mentioned ++ * readers. One I know of (Argolis Smartreader V1) ++ * returns "USB smartcard server" as iInterface string. ++ * The vendor didn't bother with a custom VID/PID of ++ * course. + */ +- if ((C_CSIZE(tty) != CS8) && (C_CSIZE(tty) != CS7)) { ++ if (C_CSIZE(tty) == CS6) { + dev_warn(ddev, "requested CSIZE setting not supported\n"); + + termios->c_cflag &= ~CSIZE; +@@ -2182,6 +2192,9 @@ no_skip: + urb_value |= FTDI_SIO_SET_DATA_PARITY_NONE; + } + switch (cflag & CSIZE) { ++ case CS5: ++ dev_dbg(ddev, "Setting CS5 quirk\n"); ++ break; + case CS7: + urb_value |= 7; + dev_dbg(ddev, "Setting CS7\n"); diff --git a/queue-3.10/usb-nokia-502-is-an-unusual-device.patch b/queue-3.10/usb-nokia-502-is-an-unusual-device.patch new file mode 100644 index 00000000000..89228ea5bd5 --- /dev/null +++ b/queue-3.10/usb-nokia-502-is-an-unusual-device.patch @@ -0,0 +1,42 @@ +From 0e16114f2db4838251fb64f3b550996ad3585890 Mon Sep 17 00:00:00 2001 +From: Mikhail Zolotaryov +Date: Sat, 28 Dec 2013 01:56:35 +0200 +Subject: USB: Nokia 502 is an unusual device + +From: Mikhail Zolotaryov + +commit 0e16114f2db4838251fb64f3b550996ad3585890 upstream. + +The USB storage operation of Nokia Asha 502 Dual SIM smartphone running Asha +Platform 1.1.1 is unreliable in respect of data consistency (i.e. transfered +files are corrupted). A similar issue is described here: +http://discussions.nokia.com/t5/Asha-and-other-Nokia-Series-30/Nokia-301-USB-transfers-and-corrupted-files/td-p/1974170 + +The workaround is (MAX_SECTORS_64): + rmmod usb_storage && modprobe usb_storage quirks=0421:06aa:m + +The patch adds the tested device to the unusual list permanently. + +Signed-off-by: Mikhail Zolotaryov +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/storage/unusual_devs.h | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/usb/storage/unusual_devs.h ++++ b/drivers/usb/storage/unusual_devs.h +@@ -234,6 +234,13 @@ UNUSUAL_DEV( 0x0421, 0x0495, 0x0370, 0x + USB_SC_DEVICE, USB_PR_DEVICE, NULL, + US_FL_MAX_SECTORS_64 ), + ++/* Patch submitted by Mikhail Zolotaryov */ ++UNUSUAL_DEV( 0x0421, 0x06aa, 0x1110, 0x1110, ++ "Nokia", ++ "502", ++ USB_SC_DEVICE, USB_PR_DEVICE, NULL, ++ US_FL_MAX_SECTORS_64 ), ++ + #ifdef NO_SDDR09 + UNUSUAL_DEV( 0x0436, 0x0005, 0x0100, 0x0100, + "Microtech", diff --git a/queue-3.10/usb-option-add-new-zte-3g-modem-pids-to-option-driver.patch b/queue-3.10/usb-option-add-new-zte-3g-modem-pids-to-option-driver.patch new file mode 100644 index 00000000000..07a1f274dfe --- /dev/null +++ b/queue-3.10/usb-option-add-new-zte-3g-modem-pids-to-option-driver.patch @@ -0,0 +1,36 @@ +From 4d90b819ae4c7ea8fd5e2bb7edc68c0f334be2e4 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?=E5=BC=A0=E5=90=9B?= +Date: Wed, 18 Dec 2013 15:37:17 +0800 +Subject: usb: option: add new zte 3g modem pids to option driver + +From: =?UTF-8?q?=E5=BC=A0=E5=90=9B?= + +commit 4d90b819ae4c7ea8fd5e2bb7edc68c0f334be2e4 upstream. + +Signed-off-by: Jun zhang +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/option.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -1447,6 +1447,17 @@ static const struct usb_device_id option + .driver_info = (kernel_ulong_t)&net_intf3_blacklist }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0178, 0xff, 0xff, 0xff), + .driver_info = (kernel_ulong_t)&net_intf3_blacklist }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffe9, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff8b, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff8c, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff8d, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff8e, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff8f, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff90, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff91, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff92, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff93, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff94, 0xff, 0xff, 0xff) }, + + /* NOTE: most ZTE CDMA devices should be driven by zte_ev, not option */ + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MC2718, 0xff, 0xff, 0xff), diff --git a/queue-3.10/usb-pl2303-fix-data-corruption-on-termios-updates.patch b/queue-3.10/usb-pl2303-fix-data-corruption-on-termios-updates.patch new file mode 100644 index 00000000000..96f49b012bc --- /dev/null +++ b/queue-3.10/usb-pl2303-fix-data-corruption-on-termios-updates.patch @@ -0,0 +1,87 @@ +From 623c8263376c0b8a4b0c220232e7313d762cd0cc Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Sun, 29 Dec 2013 19:22:53 +0100 +Subject: USB: pl2303: fix data corruption on termios updates +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Johan Hovold + +commit 623c8263376c0b8a4b0c220232e7313d762cd0cc upstream. + +Some PL2303 devices are known to lose bytes if you change serial +settings even to the same values as before. Avoid this by comparing the +encoded settings with the previsouly used ones before configuring the +device. + +The common case was fixed by commit bf5e5834bffc6 ("pl2303: Fix mode +switching regression"), but this problem was still possible to trigger, +for instance, by using the TCSETS2-interface to repeatedly request +115201 baud, which gets mapped to 115200 and thus always triggers a +settings update. + +Cc: Frank Schäfer +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/pl2303.c | 33 +++++++++++++++++++++++++-------- + 1 file changed, 25 insertions(+), 8 deletions(-) + +--- a/drivers/usb/serial/pl2303.c ++++ b/drivers/usb/serial/pl2303.c +@@ -141,6 +141,8 @@ struct pl2303_private { + spinlock_t lock; + u8 line_control; + u8 line_status; ++ ++ u8 line_settings[7]; + }; + + static int pl2303_vendor_read(__u16 value, __u16 index, +@@ -280,10 +282,6 @@ static void pl2303_set_termios(struct tt + int baud_floor, baud_ceil; + int k; + +- /* The PL2303 is reported to lose bytes if you change +- serial settings even to the same values as before. Thus +- we actually need to filter in this specific case */ +- + if (old_termios && !tty_termios_hw_change(&tty->termios, old_termios)) + return; + +@@ -422,10 +420,29 @@ static void pl2303_set_termios(struct tt + dev_dbg(&port->dev, "parity = none\n"); + } + +- i = usb_control_msg(serial->dev, usb_sndctrlpipe(serial->dev, 0), +- SET_LINE_REQUEST, SET_LINE_REQUEST_TYPE, +- 0, 0, buf, 7, 100); +- dev_dbg(&port->dev, "0x21:0x20:0:0 %d\n", i); ++ /* ++ * Some PL2303 are known to lose bytes if you change serial settings ++ * even to the same values as before. Thus we actually need to filter ++ * in this specific case. ++ * ++ * Note that the tty_termios_hw_change check above is not sufficient ++ * as a previously requested baud rate may differ from the one ++ * actually used (and stored in old_termios). ++ * ++ * NOTE: No additional locking needed for line_settings as it is ++ * only used in set_termios, which is serialised against itself. ++ */ ++ if (!old_termios || memcmp(buf, priv->line_settings, 7)) { ++ i = usb_control_msg(serial->dev, ++ usb_sndctrlpipe(serial->dev, 0), ++ SET_LINE_REQUEST, SET_LINE_REQUEST_TYPE, ++ 0, 0, buf, 7, 100); ++ ++ dev_dbg(&port->dev, "0x21:0x20:0:0 %d\n", i); ++ ++ if (i == 7) ++ memcpy(priv->line_settings, buf, 7); ++ } + + /* change control lines if we are switching to or from B0 */ + spin_lock_irqsave(&priv->lock, flags); diff --git a/queue-3.10/usb-serial-add-support-for-iball-3.5g-connect-usb-modem.patch b/queue-3.10/usb-serial-add-support-for-iball-3.5g-connect-usb-modem.patch new file mode 100644 index 00000000000..faf73a53066 --- /dev/null +++ b/queue-3.10/usb-serial-add-support-for-iball-3.5g-connect-usb-modem.patch @@ -0,0 +1,59 @@ +From 7d5c1b9c7cb5ec8e52b1adc65c484a923a8ea6c3 Mon Sep 17 00:00:00 2001 +From: Rahul Bedarkar +Date: Thu, 2 Jan 2014 20:57:56 +0530 +Subject: USB: serial: add support for iBall 3.5G connect usb modem +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rahul Bedarkar + +commit 7d5c1b9c7cb5ec8e52b1adc65c484a923a8ea6c3 upstream. + +Add support for iBall 3.5G connect usb modem. + +$lsusb +Bus 002 Device 006: ID 1c9e:9605 OMEGA TECHNOLOGY + +$usb-devices +T: Bus=02 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 6 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=1c9e ProdID=9605 Rev=00.00 +S: Manufacturer=USB Modem +S: Product=USB Modem +S: SerialNumber=1234567890ABCDEF +C: #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA +I: If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option +I: If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option +I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option +I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=option +I: If#= 4 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=06 Prot=50 Driver=usb-storage + +Signed-off-by: Rahul Bedarkar +Suggested-by: Bjørn Mork +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/option.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -320,6 +320,9 @@ static void option_instat_callback(struc + * It seems to contain a Qualcomm QSC6240/6290 chipset */ + #define FOUR_G_SYSTEMS_PRODUCT_W14 0x9603 + ++/* iBall 3.5G connect wireless modem */ ++#define IBALL_3_5G_CONNECT 0x9605 ++ + /* Zoom */ + #define ZOOM_PRODUCT_4597 0x9607 + +@@ -1500,6 +1503,7 @@ static const struct usb_device_id option + .driver_info = (kernel_ulong_t)&four_g_w14_blacklist + }, + { USB_DEVICE(LONGCHEER_VENDOR_ID, ZOOM_PRODUCT_4597) }, ++ { USB_DEVICE(LONGCHEER_VENDOR_ID, IBALL_3_5G_CONNECT) }, + { USB_DEVICE(HAIER_VENDOR_ID, HAIER_PRODUCT_CE100) }, + /* Pirelli */ + { USB_DEVICE_INTERFACE_CLASS(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_C100_1, 0xff) }, diff --git a/queue-3.10/usb-xhci-check-for-xhci_plat-in-xhci_cleanup_msix.patch b/queue-3.10/usb-xhci-check-for-xhci_plat-in-xhci_cleanup_msix.patch new file mode 100644 index 00000000000..19f5f4a0c2c --- /dev/null +++ b/queue-3.10/usb-xhci-check-for-xhci_plat-in-xhci_cleanup_msix.patch @@ -0,0 +1,37 @@ +From 9005355af23856c55a5538c9024355785424821b Mon Sep 17 00:00:00 2001 +From: Jack Pham +Date: Fri, 15 Nov 2013 14:53:14 -0800 +Subject: usb: xhci: Check for XHCI_PLAT in xhci_cleanup_msix() + +From: Jack Pham + +commit 9005355af23856c55a5538c9024355785424821b upstream. + +If CONFIG_PCI is enabled, make sure xhci_cleanup_msix() +doesn't try to free a bogus PCI IRQ or dereference an invalid +pci_dev when the xHCI device is actually a platform_device. + +This patch should be backported to kernels as old as 3.9, that +contain the commit 52fb61250a7a132b0cfb9f4a1060a1f3c49e5a25 +"xhci-plat: Don't enable legacy PCI interrupts." + +Signed-off-by: Jack Pham +Signed-off-by: Sarah Sharp +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/xhci.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/usb/host/xhci.c ++++ b/drivers/usb/host/xhci.c +@@ -315,6 +315,9 @@ static void xhci_cleanup_msix(struct xhc + struct usb_hcd *hcd = xhci_to_hcd(xhci); + struct pci_dev *pdev = to_pci_dev(hcd->self.controller); + ++ if (xhci->quirks & XHCI_PLAT) ++ return; ++ + xhci_free_irq(xhci); + + if (xhci->msix_entries) { diff --git a/queue-3.10/x86-add-check-for-number-of-available-vectors-before-cpu-down.patch b/queue-3.10/x86-add-check-for-number-of-available-vectors-before-cpu-down.patch new file mode 100644 index 00000000000..25902edf4f2 --- /dev/null +++ b/queue-3.10/x86-add-check-for-number-of-available-vectors-before-cpu-down.patch @@ -0,0 +1,211 @@ +From da6139e49c7cb0f4251265cb5243b8d220adb48d Mon Sep 17 00:00:00 2001 +From: Prarit Bhargava +Date: Mon, 13 Jan 2014 06:51:01 -0500 +Subject: x86: Add check for number of available vectors before CPU down + +From: Prarit Bhargava + +commit da6139e49c7cb0f4251265cb5243b8d220adb48d upstream. + +Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=64791 + +When a cpu is downed on a system, the irqs on the cpu are assigned to +other cpus. It is possible, however, that when a cpu is downed there +aren't enough free vectors on the remaining cpus to account for the +vectors from the cpu that is being downed. + +This results in an interesting "overflow" condition where irqs are +"assigned" to a CPU but are not handled. + +For example, when downing cpus on a 1-64 logical processor system: + + +[ 232.021745] smpboot: CPU 61 is now offline +[ 238.480275] smpboot: CPU 62 is now offline +[ 245.991080] ------------[ cut here ]------------ +[ 245.996270] WARNING: CPU: 0 PID: 0 at net/sched/sch_generic.c:264 dev_watchdog+0x246/0x250() +[ 246.005688] NETDEV WATCHDOG: p786p1 (ixgbe): transmit queue 0 timed out +[ 246.013070] Modules linked in: lockd sunrpc iTCO_wdt iTCO_vendor_support sb_edac ixgbe microcode e1000e pcspkr joydev edac_core lpc_ich ioatdma ptp mdio mfd_core i2c_i801 dca pps_core i2c_core wmi acpi_cpufreq isci libsas scsi_transport_sas +[ 246.037633] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 3.12.0+ #14 +[ 246.044451] Hardware name: Intel Corporation S4600LH ........../SVRBD-ROW_T, BIOS SE5C600.86B.01.08.0003.022620131521 02/26/2013 +[ 246.057371] 0000000000000009 ffff88081fa03d40 ffffffff8164fbf6 ffff88081fa0ee48 +[ 246.065728] ffff88081fa03d90 ffff88081fa03d80 ffffffff81054ecc ffff88081fa13040 +[ 246.074073] 0000000000000000 ffff88200cce0000 0000000000000040 0000000000000000 +[ 246.082430] Call Trace: +[ 246.085174] [] dump_stack+0x46/0x58 +[ 246.091633] [] warn_slowpath_common+0x8c/0xc0 +[ 246.098352] [] warn_slowpath_fmt+0x46/0x50 +[ 246.104786] [] dev_watchdog+0x246/0x250 +[ 246.110923] [] ? dev_deactivate_queue.constprop.31+0x80/0x80 +[ 246.119097] [] call_timer_fn+0x3a/0x110 +[ 246.125224] [] ? update_process_times+0x6f/0x80 +[ 246.132137] [] ? dev_deactivate_queue.constprop.31+0x80/0x80 +[ 246.140308] [] run_timer_softirq+0x1f0/0x2a0 +[ 246.146933] [] __do_softirq+0xe0/0x220 +[ 246.152976] [] call_softirq+0x1c/0x30 +[ 246.158920] [] do_softirq+0x55/0x90 +[ 246.164670] [] irq_exit+0xa5/0xb0 +[ 246.170227] [] smp_apic_timer_interrupt+0x4a/0x60 +[ 246.177324] [] apic_timer_interrupt+0x6a/0x70 +[ 246.184041] [] ? cpuidle_enter_state+0x5b/0xe0 +[ 246.191559] [] ? cpuidle_enter_state+0x57/0xe0 +[ 246.198374] [] cpuidle_idle_call+0xbd/0x200 +[ 246.204900] [] arch_cpu_idle+0xe/0x30 +[ 246.210846] [] cpu_startup_entry+0xd0/0x250 +[ 246.217371] [] rest_init+0x77/0x80 +[ 246.223028] [] start_kernel+0x3ee/0x3fb +[ 246.229165] [] ? repair_env_string+0x5e/0x5e +[ 246.235787] [] x86_64_start_reservations+0x2a/0x2c +[ 246.242990] [] x86_64_start_kernel+0xf8/0xfc +[ 246.249610] ---[ end trace fb74fdef54d79039 ]--- +[ 246.254807] ixgbe 0000:c2:00.0 p786p1: initiating reset due to tx timeout +[ 246.262489] ixgbe 0000:c2:00.0 p786p1: Reset adapter +Last login: Mon Nov 11 08:35:14 from 10.18.17.119 +[root@(none) ~]# [ 246.792676] ixgbe 0000:c2:00.0 p786p1: detected SFP+: 5 +[ 249.231598] ixgbe 0000:c2:00.0 p786p1: NIC Link is Up 10 Gbps, Flow Control: RX/TX +[ 246.792676] ixgbe 0000:c2:00.0 p786p1: detected SFP+: 5 +[ 249.231598] ixgbe 0000:c2:00.0 p786p1: NIC Link is Up 10 Gbps, Flow Control: RX/TX + +(last lines keep repeating. ixgbe driver is dead until module reload.) + +If the downed cpu has more vectors than are free on the remaining cpus on the +system, it is possible that some vectors are "orphaned" even though they are +assigned to a cpu. In this case, since the ixgbe driver had a watchdog, the +watchdog fired and notified that something was wrong. + +This patch adds a function, check_vectors(), to compare the number of vectors +on the CPU going down and compares it to the number of vectors available on +the system. If there aren't enough vectors for the CPU to go down, an +error is returned and propogated back to userspace. + +v2: Do not need to look at percpu irqs +v3: Need to check affinity to prevent counting of MSIs in IOAPIC Lowest + Priority Mode +v4: Additional changes suggested by Gong Chen. +v5/v6/v7/v8: Updated comment text + +Signed-off-by: Prarit Bhargava +Link: http://lkml.kernel.org/r/1389613861-3853-1-git-send-email-prarit@redhat.com +Reviewed-by: Gong Chen +Cc: Andi Kleen +Cc: Michel Lespinasse +Cc: Seiji Aguchi +Cc: Yang Zhang +Cc: Paul Gortmaker +Cc: Janet Morgan +Cc: Tony Luck +Cc: Ruiv Wang +Cc: Gong Chen +Signed-off-by: H. Peter Anvin +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/include/asm/irq.h | 1 + arch/x86/kernel/irq.c | 70 +++++++++++++++++++++++++++++++++++++++++++++ + arch/x86/kernel/smpboot.c | 6 +++ + 3 files changed, 77 insertions(+) + +--- a/arch/x86/include/asm/irq.h ++++ b/arch/x86/include/asm/irq.h +@@ -25,6 +25,7 @@ extern void irq_ctx_init(int cpu); + + #ifdef CONFIG_HOTPLUG_CPU + #include ++extern int check_irq_vectors_for_cpu_disable(void); + extern void fixup_irqs(void); + extern void irq_force_complete_move(int); + #endif +--- a/arch/x86/kernel/irq.c ++++ b/arch/x86/kernel/irq.c +@@ -249,6 +249,76 @@ void smp_kvm_posted_intr_ipi(struct pt_r + EXPORT_SYMBOL_GPL(vector_used_by_percpu_irq); + + #ifdef CONFIG_HOTPLUG_CPU ++/* ++ * This cpu is going to be removed and its vectors migrated to the remaining ++ * online cpus. Check to see if there are enough vectors in the remaining cpus. ++ * This function is protected by stop_machine(). ++ */ ++int check_irq_vectors_for_cpu_disable(void) ++{ ++ int irq, cpu; ++ unsigned int this_cpu, vector, this_count, count; ++ struct irq_desc *desc; ++ struct irq_data *data; ++ struct cpumask affinity_new, online_new; ++ ++ this_cpu = smp_processor_id(); ++ cpumask_copy(&online_new, cpu_online_mask); ++ cpu_clear(this_cpu, online_new); ++ ++ this_count = 0; ++ for (vector = FIRST_EXTERNAL_VECTOR; vector < NR_VECTORS; vector++) { ++ irq = __this_cpu_read(vector_irq[vector]); ++ if (irq >= 0) { ++ desc = irq_to_desc(irq); ++ data = irq_desc_get_irq_data(desc); ++ cpumask_copy(&affinity_new, data->affinity); ++ cpu_clear(this_cpu, affinity_new); ++ ++ /* Do not count inactive or per-cpu irqs. */ ++ if (!irq_has_action(irq) || irqd_is_per_cpu(data)) ++ continue; ++ ++ /* ++ * A single irq may be mapped to multiple ++ * cpu's vector_irq[] (for example IOAPIC cluster ++ * mode). In this case we have two ++ * possibilities: ++ * ++ * 1) the resulting affinity mask is empty; that is ++ * this the down'd cpu is the last cpu in the irq's ++ * affinity mask, or ++ * ++ * 2) the resulting affinity mask is no longer ++ * a subset of the online cpus but the affinity ++ * mask is not zero; that is the down'd cpu is the ++ * last online cpu in a user set affinity mask. ++ */ ++ if (cpumask_empty(&affinity_new) || ++ !cpumask_subset(&affinity_new, &online_new)) ++ this_count++; ++ } ++ } ++ ++ count = 0; ++ for_each_online_cpu(cpu) { ++ if (cpu == this_cpu) ++ continue; ++ for (vector = FIRST_EXTERNAL_VECTOR; vector < NR_VECTORS; ++ vector++) { ++ if (per_cpu(vector_irq, cpu)[vector] < 0) ++ count++; ++ } ++ } ++ ++ if (count < this_count) { ++ pr_warn("CPU %d disable failed: CPU has %u vectors assigned and there are only %u available.\n", ++ this_cpu, this_count, count); ++ return -ERANGE; ++ } ++ return 0; ++} ++ + /* A cpu has been removed from cpu_online_mask. Reset irq affinities. */ + void fixup_irqs(void) + { +--- a/arch/x86/kernel/smpboot.c ++++ b/arch/x86/kernel/smpboot.c +@@ -1309,6 +1309,12 @@ void cpu_disable_common(void) + + int native_cpu_disable(void) + { ++ int ret; ++ ++ ret = check_irq_vectors_for_cpu_disable(); ++ if (ret) ++ return ret; ++ + clear_local_APIC(); + + cpu_disable_common(); diff --git a/queue-3.10/x86-efi-fix-off-by-one-bug-in-efi-boot-services-reservation.patch b/queue-3.10/x86-efi-fix-off-by-one-bug-in-efi-boot-services-reservation.patch new file mode 100644 index 00000000000..c02fec226af --- /dev/null +++ b/queue-3.10/x86-efi-fix-off-by-one-bug-in-efi-boot-services-reservation.patch @@ -0,0 +1,38 @@ +From a7f84f03f660d93574ac88835d056c0d6468aebe Mon Sep 17 00:00:00 2001 +From: Dave Young +Date: Fri, 20 Dec 2013 18:02:15 +0800 +Subject: x86/efi: Fix off-by-one bug in EFI Boot Services reservation + +From: Dave Young + +commit a7f84f03f660d93574ac88835d056c0d6468aebe upstream. + +Current code check boot service region with kernel text region by: +start+size >= __pa_symbol(_text) +The end of the above region should be start + size - 1 instead. + +I see this problem in ovmf + Fedora 19 grub boot: +text start: 1000000 md start: 800000 md size: 800000 + +Signed-off-by: Dave Young +Acked-by: Borislav Petkov +Acked-by: Toshi Kani +Tested-by: Toshi Kani +Signed-off-by: Matt Fleming +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/platform/efi/efi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/x86/platform/efi/efi.c ++++ b/arch/x86/platform/efi/efi.c +@@ -438,7 +438,7 @@ void __init efi_reserve_boot_services(vo + * - Not within any part of the kernel + * - Not the bios reserved area + */ +- if ((start+size >= __pa_symbol(_text) ++ if ((start + size > __pa_symbol(_text) + && start <= __pa_symbol(_end)) || + !e820_all_mapped(start, start+size, E820_RAM) || + memblock_is_region_reserved(start, size)) { diff --git a/queue-3.10/x86-x32-correct-invalid-use-of-user-timespec-in-the-kernel.patch b/queue-3.10/x86-x32-correct-invalid-use-of-user-timespec-in-the-kernel.patch new file mode 100644 index 00000000000..0ec89719fb7 --- /dev/null +++ b/queue-3.10/x86-x32-correct-invalid-use-of-user-timespec-in-the-kernel.patch @@ -0,0 +1,80 @@ +From 2def2ef2ae5f3990aabdbe8a755911902707d268 Mon Sep 17 00:00:00 2001 +From: PaX Team +Date: Thu, 30 Jan 2014 16:59:25 -0800 +Subject: x86, x32: Correct invalid use of user timespec in the kernel + +From: PaX Team + +commit 2def2ef2ae5f3990aabdbe8a755911902707d268 upstream. + +The x32 case for the recvmsg() timout handling is broken: + + asmlinkage long compat_sys_recvmmsg(int fd, struct compat_mmsghdr __user *mmsg, + unsigned int vlen, unsigned int flags, + struct compat_timespec __user *timeout) + { + int datagrams; + struct timespec ktspec; + + if (flags & MSG_CMSG_COMPAT) + return -EINVAL; + + if (COMPAT_USE_64BIT_TIME) + return __sys_recvmmsg(fd, (struct mmsghdr __user *)mmsg, vlen, + flags | MSG_CMSG_COMPAT, + (struct timespec *) timeout); + ... + +The timeout pointer parameter is provided by userland (hence the __user +annotation) but for x32 syscalls it's simply cast to a kernel pointer +and is passed to __sys_recvmmsg which will eventually directly +dereference it for both reading and writing. Other callers to +__sys_recvmmsg properly copy from userland to the kernel first. + +The bug was introduced by commit ee4fa23c4bfc ("compat: Use +COMPAT_USE_64BIT_TIME in net/compat.c") and should affect all kernels +since 3.4 (and perhaps vendor kernels if they backported x32 support +along with this code). + +Note that CONFIG_X86_X32_ABI gets enabled at build time and only if +CONFIG_X86_X32 is enabled and ld can build x32 executables. + +Other uses of COMPAT_USE_64BIT_TIME seem fine. + +This addresses CVE-2014-0038. + +Signed-off-by: PaX Team +Signed-off-by: H. Peter Anvin +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + net/compat.c | 9 ++------- + 1 file changed, 2 insertions(+), 7 deletions(-) + +--- a/net/compat.c ++++ b/net/compat.c +@@ -780,21 +780,16 @@ asmlinkage long compat_sys_recvmmsg(int + if (flags & MSG_CMSG_COMPAT) + return -EINVAL; + +- if (COMPAT_USE_64BIT_TIME) +- return __sys_recvmmsg(fd, (struct mmsghdr __user *)mmsg, vlen, +- flags | MSG_CMSG_COMPAT, +- (struct timespec *) timeout); +- + if (timeout == NULL) + return __sys_recvmmsg(fd, (struct mmsghdr __user *)mmsg, vlen, + flags | MSG_CMSG_COMPAT, NULL); + +- if (get_compat_timespec(&ktspec, timeout)) ++ if (compat_get_timespec(&ktspec, timeout)) + return -EFAULT; + + datagrams = __sys_recvmmsg(fd, (struct mmsghdr __user *)mmsg, vlen, + flags | MSG_CMSG_COMPAT, &ktspec); +- if (datagrams > 0 && put_compat_timespec(&ktspec, timeout)) ++ if (datagrams > 0 && compat_put_timespec(&ktspec, timeout)) + datagrams = -EFAULT; + + return datagrams;