From: Greg Kroah-Hartman Date: Tue, 3 Sep 2013 18:48:09 +0000 (-0700) Subject: 3.4-stable patches X-Git-Tag: v3.0.95~14 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=84bc1d98962970fb7a882808db15cceee3c9446a;p=thirdparty%2Fkernel%2Fstable-queue.git 3.4-stable patches added patches: ath9k_htc-restore-skb-headroom-when-returning-skb-to-mac80211.patch drm-i915-ivb-fix-edp-voltage-swing-reg-val.patch drm-vmwgfx-split-gmr2_remap-commands-if-they-are-to-large.patch iwl4965-fix-rfkill-set-state-regression.patch mac80211-add-missing-channel-context-release.patch sunrpc-fix-memory-corruption-issue-on-32-bit-highmem-systems.patch --- diff --git a/queue-3.4/ath9k_htc-restore-skb-headroom-when-returning-skb-to-mac80211.patch b/queue-3.4/ath9k_htc-restore-skb-headroom-when-returning-skb-to-mac80211.patch new file mode 100644 index 00000000000..1c8e34a2ae4 --- /dev/null +++ b/queue-3.4/ath9k_htc-restore-skb-headroom-when-returning-skb-to-mac80211.patch @@ -0,0 +1,57 @@ +From d2e9fc141e2aa21f4b35ee27072d84e9aa6e2ba0 Mon Sep 17 00:00:00 2001 +From: Helmut Schaa +Date: Fri, 16 Aug 2013 21:39:40 +0200 +Subject: ath9k_htc: Restore skb headroom when returning skb to mac80211 + +From: Helmut Schaa + +commit d2e9fc141e2aa21f4b35ee27072d84e9aa6e2ba0 upstream. + +ath9k_htc adds padding between the 802.11 header and the payload during +TX by moving the header. When handing the frame back to mac80211 for TX +status handling the header is not moved back into its original position. +This can result in a too small skb headroom when entering ath9k_htc +again (due to a soft retransmission for example) causing an +skb_under_panic oops. + +Fix this by moving the 802.11 header back into its original position +before returning the frame to mac80211 as other drivers like rt2x00 +or ath5k do. + +Reported-by: Marc Kleine-Budde +Signed-off-by: Helmut Schaa +Tested-by: Marc Kleine-Budde +Signed-off-by: Marc Kleine-Budde +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/ath/ath9k/htc_drv_txrx.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +--- a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c ++++ b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c +@@ -448,6 +448,7 @@ static void ath9k_htc_tx_process(struct + struct ieee80211_conf *cur_conf = &priv->hw->conf; + bool txok; + int slot; ++ int hdrlen, padsize; + + slot = strip_drv_header(priv, skb); + if (slot < 0) { +@@ -504,6 +505,15 @@ send_mac80211: + + ath9k_htc_tx_clear_slot(priv, slot); + ++ /* Remove padding before handing frame back to mac80211 */ ++ hdrlen = ieee80211_get_hdrlen_from_skb(skb); ++ ++ padsize = hdrlen & 3; ++ if (padsize && skb->len > hdrlen + padsize) { ++ memmove(skb->data + padsize, skb->data, hdrlen); ++ skb_pull(skb, padsize); ++ } ++ + /* Send status to mac80211 */ + ieee80211_tx_status(priv->hw, skb); + } diff --git a/queue-3.4/drm-i915-ivb-fix-edp-voltage-swing-reg-val.patch b/queue-3.4/drm-i915-ivb-fix-edp-voltage-swing-reg-val.patch new file mode 100644 index 00000000000..c2ede97f24c --- /dev/null +++ b/queue-3.4/drm-i915-ivb-fix-edp-voltage-swing-reg-val.patch @@ -0,0 +1,48 @@ +From 77fa4cbd5fa389e28419bbe8ac491b5fdd54840d Mon Sep 17 00:00:00 2001 +From: Imre Deak +Date: Fri, 23 Aug 2013 23:50:23 +0300 +Subject: drm/i915: ivb: fix edp voltage swing reg val + +From: Imre Deak + +commit 77fa4cbd5fa389e28419bbe8ac491b5fdd54840d upstream. + +Fix the typo introduced in + +commit 1a2eb4604b85c5efb343da8a4dcf41288fcfca85 +Author: Keith Packard +Date: Wed Nov 16 16:26:07 2011 -0800 + + drm/i915: Hook up Ivybridge eDP + +This fixes eDP link-training failures and cases where all voltage swing +/pre-emphasis levels were tried and failed during clock recovery and - +as a fallback - we go on to do channel equalization with the last voltage +swing/pre-emphasis level which will succeed. Both issues can lead to a +blank screen. + +v2: +- improve commit message + +Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=64880 +Tested-by: Jeremy Moles +Signed-off-by: Imre Deak +Reviewed-by: Paulo Zanoni +Signed-off-by: Daniel Vetter +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/i915_reg.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/i915/i915_reg.h ++++ b/drivers/gpu/drm/i915/i915_reg.h +@@ -3741,7 +3741,7 @@ + #define EDP_LINK_TRAIN_600MV_0DB_IVB (0x30 <<22) + #define EDP_LINK_TRAIN_600MV_3_5DB_IVB (0x36 <<22) + #define EDP_LINK_TRAIN_800MV_0DB_IVB (0x38 <<22) +-#define EDP_LINK_TRAIN_800MV_3_5DB_IVB (0x33 <<22) ++#define EDP_LINK_TRAIN_800MV_3_5DB_IVB (0x3e <<22) + + /* legacy values */ + #define EDP_LINK_TRAIN_500MV_0DB_IVB (0x00 <<22) diff --git a/queue-3.4/drm-vmwgfx-split-gmr2_remap-commands-if-they-are-to-large.patch b/queue-3.4/drm-vmwgfx-split-gmr2_remap-commands-if-they-are-to-large.patch new file mode 100644 index 00000000000..4eeddeeefaf --- /dev/null +++ b/queue-3.4/drm-vmwgfx-split-gmr2_remap-commands-if-they-are-to-large.patch @@ -0,0 +1,116 @@ +From 6e4dcff3adbf25acb87e74500a58e3c07bdec40f Mon Sep 17 00:00:00 2001 +From: Jakob Bornecrantz +Date: Thu, 29 Aug 2013 02:32:53 +0200 +Subject: drm/vmwgfx: Split GMR2_REMAP commands if they are to large + +From: Jakob Bornecrantz + +commit 6e4dcff3adbf25acb87e74500a58e3c07bdec40f upstream. + +This fixes the piglit test texturing/max-texture-size +causing the VM to die due to a too large SVGA command. + +Signed-off-by: Jakob Bornecrantz +Reviewed-by: Biran Paul +Reviewed-by: Zack Rusin +Signed-off-by: Dave Airlie +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/vmwgfx/vmwgfx_gmr.c | 60 ++++++++++++++++++++++++------------ + 1 file changed, 40 insertions(+), 20 deletions(-) + +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_gmr.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_gmr.c +@@ -29,7 +29,9 @@ + #include "drmP.h" + #include "ttm/ttm_bo_driver.h" + +-#define VMW_PPN_SIZE sizeof(unsigned long) ++#define VMW_PPN_SIZE (sizeof(unsigned long)) ++/* A future safe maximum remap size. */ ++#define VMW_PPN_PER_REMAP ((31 * 1024) / VMW_PPN_SIZE) + + static int vmw_gmr2_bind(struct vmw_private *dev_priv, + struct page *pages[], +@@ -38,43 +40,61 @@ static int vmw_gmr2_bind(struct vmw_priv + { + SVGAFifoCmdDefineGMR2 define_cmd; + SVGAFifoCmdRemapGMR2 remap_cmd; +- uint32_t define_size = sizeof(define_cmd) + 4; +- uint32_t remap_size = VMW_PPN_SIZE * num_pages + sizeof(remap_cmd) + 4; + uint32_t *cmd; + uint32_t *cmd_orig; ++ uint32_t define_size = sizeof(define_cmd) + sizeof(*cmd); ++ uint32_t remap_num = num_pages / VMW_PPN_PER_REMAP + ((num_pages % VMW_PPN_PER_REMAP) > 0); ++ uint32_t remap_size = VMW_PPN_SIZE * num_pages + (sizeof(remap_cmd) + sizeof(*cmd)) * remap_num; ++ uint32_t remap_pos = 0; ++ uint32_t cmd_size = define_size + remap_size; + uint32_t i; + +- cmd_orig = cmd = vmw_fifo_reserve(dev_priv, define_size + remap_size); ++ cmd_orig = cmd = vmw_fifo_reserve(dev_priv, cmd_size); + if (unlikely(cmd == NULL)) + return -ENOMEM; + + define_cmd.gmrId = gmr_id; + define_cmd.numPages = num_pages; + ++ *cmd++ = SVGA_CMD_DEFINE_GMR2; ++ memcpy(cmd, &define_cmd, sizeof(define_cmd)); ++ cmd += sizeof(define_cmd) / sizeof(*cmd); ++ ++ /* ++ * Need to split the command if there are too many ++ * pages that goes into the gmr. ++ */ ++ + remap_cmd.gmrId = gmr_id; + remap_cmd.flags = (VMW_PPN_SIZE > sizeof(*cmd)) ? + SVGA_REMAP_GMR2_PPN64 : SVGA_REMAP_GMR2_PPN32; +- remap_cmd.offsetPages = 0; +- remap_cmd.numPages = num_pages; + +- *cmd++ = SVGA_CMD_DEFINE_GMR2; +- memcpy(cmd, &define_cmd, sizeof(define_cmd)); +- cmd += sizeof(define_cmd) / sizeof(uint32); ++ while (num_pages > 0) { ++ unsigned long nr = min(num_pages, (unsigned long)VMW_PPN_PER_REMAP); ++ ++ remap_cmd.offsetPages = remap_pos; ++ remap_cmd.numPages = nr; + +- *cmd++ = SVGA_CMD_REMAP_GMR2; +- memcpy(cmd, &remap_cmd, sizeof(remap_cmd)); +- cmd += sizeof(remap_cmd) / sizeof(uint32); +- +- for (i = 0; i < num_pages; ++i) { +- if (VMW_PPN_SIZE <= 4) +- *cmd = page_to_pfn(*pages++); +- else +- *((uint64_t *)cmd) = page_to_pfn(*pages++); ++ *cmd++ = SVGA_CMD_REMAP_GMR2; ++ memcpy(cmd, &remap_cmd, sizeof(remap_cmd)); ++ cmd += sizeof(remap_cmd) / sizeof(*cmd); ++ ++ for (i = 0; i < nr; ++i) { ++ if (VMW_PPN_SIZE <= 4) ++ *cmd = page_to_pfn(*pages++); ++ else ++ *((uint64_t *)cmd) = page_to_pfn(*pages++); + +- cmd += VMW_PPN_SIZE / sizeof(*cmd); ++ cmd += VMW_PPN_SIZE / sizeof(*cmd); ++ } ++ ++ num_pages -= nr; ++ remap_pos += nr; + } + +- vmw_fifo_commit(dev_priv, define_size + remap_size); ++ BUG_ON(cmd != cmd_orig + cmd_size / sizeof(*cmd)); ++ ++ vmw_fifo_commit(dev_priv, cmd_size); + + return 0; + } diff --git a/queue-3.4/iwl4965-fix-rfkill-set-state-regression.patch b/queue-3.4/iwl4965-fix-rfkill-set-state-regression.patch new file mode 100644 index 00000000000..015fe70e6a1 --- /dev/null +++ b/queue-3.4/iwl4965-fix-rfkill-set-state-regression.patch @@ -0,0 +1,41 @@ +From b2fcc0aee58a3435566dd6d8501a0b355552f28b Mon Sep 17 00:00:00 2001 +From: Stanislaw Gruszka +Date: Wed, 21 Aug 2013 10:18:19 +0200 +Subject: iwl4965: fix rfkill set state regression + +From: Stanislaw Gruszka + +commit b2fcc0aee58a3435566dd6d8501a0b355552f28b upstream. + +My current 3.11 fix: + +commit 788f7a56fce1bcb2067b62b851a086fca48a0056 +Author: Stanislaw Gruszka +Date: Thu Aug 1 12:07:55 2013 +0200 + + iwl4965: reset firmware after rfkill off + +broke rfkill notification to user-space . I missed that bug, because +I compiled without CONFIG_RFKILL, sorry about that. + +Signed-off-by: Stanislaw Gruszka +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/iwlegacy/4965-mac.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/wireless/iwlegacy/4965-mac.c ++++ b/drivers/net/wireless/iwlegacy/4965-mac.c +@@ -4415,9 +4415,9 @@ il4965_irq_tasklet(struct il_priv *il) + set_bit(S_RFKILL, &il->status); + } else { + clear_bit(S_RFKILL, &il->status); +- wiphy_rfkill_set_hw_state(il->hw->wiphy, hw_rf_kill); + il_force_reset(il, true); + } ++ wiphy_rfkill_set_hw_state(il->hw->wiphy, hw_rf_kill); + + handled |= CSR_INT_BIT_RF_KILL; + } diff --git a/queue-3.4/mac80211-add-missing-channel-context-release.patch b/queue-3.4/mac80211-add-missing-channel-context-release.patch new file mode 100644 index 00000000000..d4a3d5ab3d4 --- /dev/null +++ b/queue-3.4/mac80211-add-missing-channel-context-release.patch @@ -0,0 +1,29 @@ +From 2a3ba63c235fdcd37f6451bdf4a0c7865a3930cf Mon Sep 17 00:00:00 2001 +From: Johannes Berg +Date: Tue, 20 Aug 2013 11:28:50 +0200 +Subject: mac80211: add missing channel context release + +From: Johannes Berg + +commit 2a3ba63c235fdcd37f6451bdf4a0c7865a3930cf upstream. + +IBSS needs to release the channel context when leaving +but I evidently missed that. Fix it. + +Signed-off-by: Johannes Berg +Signed-off-by: Greg Kroah-Hartman + +--- + net/mac80211/ibss.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/net/mac80211/ibss.c ++++ b/net/mac80211/ibss.c +@@ -1200,6 +1200,7 @@ int ieee80211_ibss_leave(struct ieee8021 + sdata->vif.bss_conf.ibss_joined = false; + ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON_ENABLED | + BSS_CHANGED_IBSS); ++ ieee80211_vif_release_channel(sdata); + synchronize_rcu(); + kfree_skb(skb); + diff --git a/queue-3.4/series b/queue-3.4/series index e69ce6036ac..b89b11b34b4 100644 --- a/queue-3.4/series +++ b/queue-3.4/series @@ -4,3 +4,9 @@ powerpc-work-around-gcc-miscompilation-of-__pa-on-64-bit.patch powerpc-hvsi-increase-handshake-timeout-from-200ms-to-400ms.patch regmap-silence-gcc-warning.patch drivers-base-memory.c-fix-show_mem_removable-to-handle-missing-sections.patch +drm-vmwgfx-split-gmr2_remap-commands-if-they-are-to-large.patch +drm-i915-ivb-fix-edp-voltage-swing-reg-val.patch +sunrpc-fix-memory-corruption-issue-on-32-bit-highmem-systems.patch +ath9k_htc-restore-skb-headroom-when-returning-skb-to-mac80211.patch +mac80211-add-missing-channel-context-release.patch +iwl4965-fix-rfkill-set-state-regression.patch diff --git a/queue-3.4/sunrpc-fix-memory-corruption-issue-on-32-bit-highmem-systems.patch b/queue-3.4/sunrpc-fix-memory-corruption-issue-on-32-bit-highmem-systems.patch new file mode 100644 index 00000000000..1e15950bc67 --- /dev/null +++ b/queue-3.4/sunrpc-fix-memory-corruption-issue-on-32-bit-highmem-systems.patch @@ -0,0 +1,50 @@ +From 347e2233b7667e336d9f671f1a52dfa3f0416e2c Mon Sep 17 00:00:00 2001 +From: Trond Myklebust +Date: Wed, 28 Aug 2013 13:35:13 -0400 +Subject: SUNRPC: Fix memory corruption issue on 32-bit highmem systems + +From: Trond Myklebust + +commit 347e2233b7667e336d9f671f1a52dfa3f0416e2c upstream. + +Some architectures, such as ARM-32 do not return the same base address +when you call kmap_atomic() twice on the same page. +This causes problems for the memmove() call in the XDR helper routine +"_shift_data_right_pages()", since it defeats the detection of +overlapping memory ranges, and has been seen to corrupt memory. + +The fix is to distinguish between the case where we're doing an +inter-page copy or not. In the former case of we know that the memory +ranges cannot possibly overlap, so we can additionally micro-optimise +by replacing memmove() with memcpy(). + +Reported-by: Mark Young +Reported-by: Matt Craighead +Cc: Bruce Fields +Signed-off-by: Trond Myklebust +Tested-by: Matt Craighead +Signed-off-by: Greg Kroah-Hartman + +--- + net/sunrpc/xdr.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +--- a/net/sunrpc/xdr.c ++++ b/net/sunrpc/xdr.c +@@ -233,10 +233,13 @@ _shift_data_right_pages(struct page **pa + pgfrom_base -= copy; + + vto = kmap_atomic(*pgto); +- vfrom = kmap_atomic(*pgfrom); +- memmove(vto + pgto_base, vfrom + pgfrom_base, copy); ++ if (*pgto != *pgfrom) { ++ vfrom = kmap_atomic(*pgfrom); ++ memcpy(vto + pgto_base, vfrom + pgfrom_base, copy); ++ kunmap_atomic(vfrom); ++ } else ++ memmove(vto + pgto_base, vto + pgfrom_base, copy); + flush_dcache_page(*pgto); +- kunmap_atomic(vfrom); + kunmap_atomic(vto); + + } while ((len -= copy) != 0);