From: Greg Kroah-Hartman Date: Tue, 5 Nov 2013 15:51:20 +0000 (-0800) Subject: 3.4-stable patches X-Git-Tag: v3.4.69~15 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=a5edbed4f9d9b1547b4244906ba62a299a86a410;p=thirdparty%2Fkernel%2Fstable-queue.git 3.4-stable patches added patches: can-flexcan-flexcan_chip_start-fix-regression-mark-one-mb-for-tx-and-abort-pending-tx.patch jfs-fix-error-path-in-ialloc.patch mwifiex-fix-sdio-interrupt-lost-issue.patch rtlwifi-rtl8192cu-fix-error-in-pointer-arithmetic.patch --- diff --git a/queue-3.4/can-flexcan-flexcan_chip_start-fix-regression-mark-one-mb-for-tx-and-abort-pending-tx.patch b/queue-3.4/can-flexcan-flexcan_chip_start-fix-regression-mark-one-mb-for-tx-and-abort-pending-tx.patch new file mode 100644 index 00000000000..a2a021baf03 --- /dev/null +++ b/queue-3.4/can-flexcan-flexcan_chip_start-fix-regression-mark-one-mb-for-tx-and-abort-pending-tx.patch @@ -0,0 +1,73 @@ +From d5a7b406c529e4595ce03dc8f6dcf7fa36f106fa Mon Sep 17 00:00:00 2001 +From: Marc Kleine-Budde +Date: Fri, 4 Oct 2013 10:52:36 +0200 +Subject: can: flexcan: flexcan_chip_start: fix regression, mark one MB for TX and abort pending TX + +From: Marc Kleine-Budde + +commit d5a7b406c529e4595ce03dc8f6dcf7fa36f106fa upstream. + +In patch + + 0d1862e can: flexcan: fix flexcan_chip_start() on imx6 + +the loop in flexcan_chip_start() that iterates over all mailboxes after the +soft reset of the CAN core was removed. This loop put all mailboxes (even the +ones marked as reserved 1...7) into EMPTY/INACTIVE mode. On mailboxes 8...63, +this aborts any pending TX messages. + +After a cold boot there is random garbage in the mailboxes, which leads to +spontaneous transmit of CAN frames during first activation. Further if the +interface was disabled with a pending message (usually due to an error +condition on the CAN bus), this message is retransmitted after enabling the +interface again. + +This patch fixes the regression by: +1) Limiting the maximum number of used mailboxes to 8, 0...7 are used by the RX +FIFO, 8 is used by TX. +2) Marking the TX mailbox as EMPTY/INACTIVE, so that any pending TX of that +mailbox is aborted. + +Cc: Lothar Waßmann +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/can/flexcan.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +--- a/drivers/net/can/flexcan.c ++++ b/drivers/net/can/flexcan.c +@@ -60,7 +60,7 @@ + #define FLEXCAN_MCR_BCC BIT(16) + #define FLEXCAN_MCR_LPRIO_EN BIT(13) + #define FLEXCAN_MCR_AEN BIT(12) +-#define FLEXCAN_MCR_MAXMB(x) ((x) & 0xf) ++#define FLEXCAN_MCR_MAXMB(x) ((x) & 0x1f) + #define FLEXCAN_MCR_IDAM_A (0 << 8) + #define FLEXCAN_MCR_IDAM_B (1 << 8) + #define FLEXCAN_MCR_IDAM_C (2 << 8) +@@ -701,9 +701,11 @@ static int flexcan_chip_start(struct net + * + */ + reg_mcr = flexcan_read(®s->mcr); ++ reg_mcr &= ~FLEXCAN_MCR_MAXMB(0xff); + reg_mcr |= FLEXCAN_MCR_FRZ | FLEXCAN_MCR_FEN | FLEXCAN_MCR_HALT | + FLEXCAN_MCR_SUPV | FLEXCAN_MCR_WRN_EN | +- FLEXCAN_MCR_IDAM_C | FLEXCAN_MCR_SRX_DIS; ++ FLEXCAN_MCR_IDAM_C | FLEXCAN_MCR_SRX_DIS | ++ FLEXCAN_MCR_MAXMB(FLEXCAN_TX_BUF_ID); + netdev_dbg(dev, "%s: writing mcr=0x%08x", __func__, reg_mcr); + flexcan_write(reg_mcr, ®s->mcr); + +@@ -744,6 +746,10 @@ static int flexcan_chip_start(struct net + ®s->cantxfg[i].can_ctrl); + } + ++ /* Abort any pending TX, mark Mailbox as INACTIVE */ ++ flexcan_write(FLEXCAN_MB_CNT_CODE(0x4), ++ ®s->cantxfg[FLEXCAN_TX_BUF_ID].can_ctrl); ++ + /* acceptance mask/acceptance code (accept everything) */ + flexcan_write(0x0, ®s->rxgmask); + flexcan_write(0x0, ®s->rx14mask); diff --git a/queue-3.4/jfs-fix-error-path-in-ialloc.patch b/queue-3.4/jfs-fix-error-path-in-ialloc.patch new file mode 100644 index 00000000000..7a586b8da0f --- /dev/null +++ b/queue-3.4/jfs-fix-error-path-in-ialloc.patch @@ -0,0 +1,39 @@ +From 8660998608cfa1077e560034db81885af8e1e885 Mon Sep 17 00:00:00 2001 +From: Dave Kleikamp +Date: Fri, 6 Sep 2013 21:49:56 -0500 +Subject: jfs: fix error path in ialloc + +From: Dave Kleikamp + +commit 8660998608cfa1077e560034db81885af8e1e885 upstream. + +If insert_inode_locked() fails, we shouldn't be calling +unlock_new_inode(). + +Signed-off-by: Dave Kleikamp +Tested-by: Michael L. Semon +Signed-off-by: Greg Kroah-Hartman + +--- + fs/jfs/jfs_inode.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/fs/jfs/jfs_inode.c ++++ b/fs/jfs/jfs_inode.c +@@ -95,7 +95,7 @@ struct inode *ialloc(struct inode *paren + + if (insert_inode_locked(inode) < 0) { + rc = -EINVAL; +- goto fail_unlock; ++ goto fail_put; + } + + inode_init_owner(inode, parent, mode); +@@ -156,7 +156,6 @@ struct inode *ialloc(struct inode *paren + fail_drop: + dquot_drop(inode); + inode->i_flags |= S_NOQUOTA; +-fail_unlock: + clear_nlink(inode); + unlock_new_inode(inode); + fail_put: diff --git a/queue-3.4/mwifiex-fix-sdio-interrupt-lost-issue.patch b/queue-3.4/mwifiex-fix-sdio-interrupt-lost-issue.patch new file mode 100644 index 00000000000..91731363d88 --- /dev/null +++ b/queue-3.4/mwifiex-fix-sdio-interrupt-lost-issue.patch @@ -0,0 +1,55 @@ +From 453b0c3f6910672f79da354077af728d92f95c5b Mon Sep 17 00:00:00 2001 +From: Amitkumar Karwar +Date: Fri, 27 Sep 2013 10:55:38 -0700 +Subject: mwifiex: fix SDIO interrupt lost issue + +From: Amitkumar Karwar + +commit 453b0c3f6910672f79da354077af728d92f95c5b upstream. + +601216e "mwifiex: process RX packets in SDIO IRQ thread directly" +introduced a command timeout issue which can be reproduced easily on +an AM33xx platform using a test application written by Daniel Mack: + +https://gist.github.com/zonque/6579314 + +mwifiex_main_process() is called from both the SDIO handler and +the workqueue. In case an interrupt occurs right after the +int_status check, but before updating the mwifiex_processing flag, +this interrupt gets lost, resulting in a command timeout and +consequently a card reset. + +Let main_proc_lock protect both int_status and mwifiex_processing +flag. This fixes the interrupt lost issue. + +Reported-by: Sven Neumann +Reported-by: Andreas Fenkart +Tested-by: Daniel Mack +Reviewed-by: Dylan Reid +Signed-off-by: Amitkumar Karwar +Signed-off-by: Bing Zhao +Signed-off-by: Paul Stewart +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/mwifiex/main.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/net/wireless/mwifiex/main.c ++++ b/drivers/net/wireless/mwifiex/main.c +@@ -261,10 +261,12 @@ process_start: + } + } while (true); + +- if ((adapter->int_status) || IS_CARD_RX_RCVD(adapter)) ++ spin_lock_irqsave(&adapter->main_proc_lock, flags); ++ if ((adapter->int_status) || IS_CARD_RX_RCVD(adapter)) { ++ spin_unlock_irqrestore(&adapter->main_proc_lock, flags); + goto process_start; ++ } + +- spin_lock_irqsave(&adapter->main_proc_lock, flags); + adapter->mwifiex_processing = false; + spin_unlock_irqrestore(&adapter->main_proc_lock, flags); + diff --git a/queue-3.4/rtlwifi-rtl8192cu-fix-error-in-pointer-arithmetic.patch b/queue-3.4/rtlwifi-rtl8192cu-fix-error-in-pointer-arithmetic.patch new file mode 100644 index 00000000000..46a0b3e415a --- /dev/null +++ b/queue-3.4/rtlwifi-rtl8192cu-fix-error-in-pointer-arithmetic.patch @@ -0,0 +1,34 @@ +From 9473ca6e920a3b9ca902753ce52833657f9221cc Mon Sep 17 00:00:00 2001 +From: Mark Cave-Ayland +Date: Tue, 8 Oct 2013 10:18:20 -0500 +Subject: rtlwifi: rtl8192cu: Fix error in pointer arithmetic + +From: Mark Cave-Ayland + +commit 9473ca6e920a3b9ca902753ce52833657f9221cc upstream. + +An error in calculating the offset in an skb causes the driver to read +essential device info from the wrong locations. The main effect is that +automatic gain calculations are nonsense. + +Signed-off-by: Mark Cave-Ayland +Signed-off-by: Larry Finger +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/rtlwifi/rtl8192cu/trx.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/net/wireless/rtlwifi/rtl8192cu/trx.c ++++ b/drivers/net/wireless/rtlwifi/rtl8192cu/trx.c +@@ -343,7 +343,8 @@ bool rtl92cu_rx_query_desc(struct ieee80 + (bool)GET_RX_DESC_PAGGR(pdesc)); + rx_status->mactime = GET_RX_DESC_TSFL(pdesc); + if (phystatus) { +- p_drvinfo = (struct rx_fwinfo_92c *)(pdesc + RTL_RX_DESC_SIZE); ++ p_drvinfo = (struct rx_fwinfo_92c *)(skb->data + ++ stats->rx_bufshift); + rtl92c_translate_rx_signal_stuff(hw, skb, stats, pdesc, + p_drvinfo); + } diff --git a/queue-3.4/series b/queue-3.4/series index 043e78f1e00..e32a1cb3f2a 100644 --- a/queue-3.4/series +++ b/queue-3.4/series @@ -4,3 +4,7 @@ usb-quirks-add-touchscreen-that-is-dazzeled-by-remote-wakeup.patch usb-serial-ftdi_sio-add-id-for-z3x-box-device.patch mac80211-correctly-close-cancelled-scans.patch mac80211-update-sta-last_rx-on-acked-tx-frames.patch +mwifiex-fix-sdio-interrupt-lost-issue.patch +rtlwifi-rtl8192cu-fix-error-in-pointer-arithmetic.patch +jfs-fix-error-path-in-ialloc.patch +can-flexcan-flexcan_chip_start-fix-regression-mark-one-mb-for-tx-and-abort-pending-tx.patch