From: Greg Kroah-Hartman Date: Mon, 6 Jan 2014 18:45:55 +0000 (-0800) Subject: 3.10-stable patches X-Git-Tag: v3.4.76~39 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=ae8ec944fe338ee67fe296b390ce6563507c1d20;p=thirdparty%2Fkernel%2Fstable-queue.git 3.10-stable patches added patches: ath9k-fix-interrupt-handling-for-the-ar9002-family.patch ath9k_htc-properly-set-mac-address-and-bssid-mask.patch auxvec.h-account-for-at_hwcap2-in-at_vector_size_base.patch ceph-avoid-data-inconsistency-due-to-d-cache-aliasing-in-readpage.patch cpupower-fix-segfault-due-to-incorrect-getopt_long-arugments.patch dm9601-fix-reception-of-full-size-ethernet-frames-on-dm9620-dm9621a.patch dm9601-work-around-tx-fifo-sync-issue-on-dm962x.patch kvm-x86-fix-apic-map-calculation-after-re-enabling.patch powerpc-align-p_end.patch powerpc-fix-bad-stack-check-in-exception-entry.patch tg3-expand-4g_overflow_test-workaround-to-skb-fragments-of-any-size.patch --- diff --git a/queue-3.10/ath9k-fix-interrupt-handling-for-the-ar9002-family.patch b/queue-3.10/ath9k-fix-interrupt-handling-for-the-ar9002-family.patch new file mode 100644 index 00000000000..fcb7d7a3c26 --- /dev/null +++ b/queue-3.10/ath9k-fix-interrupt-handling-for-the-ar9002-family.patch @@ -0,0 +1,115 @@ +From 73f0b56a1ff64e7fb6c3a62088804bab93bcedc2 Mon Sep 17 00:00:00 2001 +From: Sujith Manoharan +Date: Mon, 16 Dec 2013 07:04:59 +0530 +Subject: ath9k: Fix interrupt handling for the AR9002 family + +From: Sujith Manoharan + +commit 73f0b56a1ff64e7fb6c3a62088804bab93bcedc2 upstream. + +This patch adds a driver workaround for a HW issue. + +A race condition in the HW results in missing interrupts, +which can be avoided by a read/write with the ISR register. +All chips in the AR9002 series are affected by this bug - AR9003 +and above do not have this problem. + +Cc: Felix Fietkau +Signed-off-by: Sujith Manoharan +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/ath/ath9k/ar9002_mac.c | 52 +++++++++++++++++++++++----- + 1 file changed, 43 insertions(+), 9 deletions(-) + +--- a/drivers/net/wireless/ath/ath9k/ar9002_mac.c ++++ b/drivers/net/wireless/ath/ath9k/ar9002_mac.c +@@ -76,9 +76,16 @@ static bool ar9002_hw_get_isr(struct ath + mask2 |= ATH9K_INT_CST; + if (isr2 & AR_ISR_S2_TSFOOR) + mask2 |= ATH9K_INT_TSFOOR; ++ ++ if (!(pCap->hw_caps & ATH9K_HW_CAP_RAC_SUPPORTED)) { ++ REG_WRITE(ah, AR_ISR_S2, isr2); ++ isr &= ~AR_ISR_BCNMISC; ++ } + } + +- isr = REG_READ(ah, AR_ISR_RAC); ++ if (pCap->hw_caps & ATH9K_HW_CAP_RAC_SUPPORTED) ++ isr = REG_READ(ah, AR_ISR_RAC); ++ + if (isr == 0xffffffff) { + *masked = 0; + return false; +@@ -97,11 +104,23 @@ static bool ar9002_hw_get_isr(struct ath + + *masked |= ATH9K_INT_TX; + +- s0_s = REG_READ(ah, AR_ISR_S0_S); ++ if (pCap->hw_caps & ATH9K_HW_CAP_RAC_SUPPORTED) { ++ s0_s = REG_READ(ah, AR_ISR_S0_S); ++ s1_s = REG_READ(ah, AR_ISR_S1_S); ++ } else { ++ s0_s = REG_READ(ah, AR_ISR_S0); ++ REG_WRITE(ah, AR_ISR_S0, s0_s); ++ s1_s = REG_READ(ah, AR_ISR_S1); ++ REG_WRITE(ah, AR_ISR_S1, s1_s); ++ ++ isr &= ~(AR_ISR_TXOK | ++ AR_ISR_TXDESC | ++ AR_ISR_TXERR | ++ AR_ISR_TXEOL); ++ } ++ + ah->intr_txqs |= MS(s0_s, AR_ISR_S0_QCU_TXOK); + ah->intr_txqs |= MS(s0_s, AR_ISR_S0_QCU_TXDESC); +- +- s1_s = REG_READ(ah, AR_ISR_S1_S); + ah->intr_txqs |= MS(s1_s, AR_ISR_S1_QCU_TXERR); + ah->intr_txqs |= MS(s1_s, AR_ISR_S1_QCU_TXEOL); + } +@@ -114,13 +133,15 @@ static bool ar9002_hw_get_isr(struct ath + *masked |= mask2; + } + +- if (AR_SREV_9100(ah)) +- return true; +- +- if (isr & AR_ISR_GENTMR) { ++ if (!AR_SREV_9100(ah) && (isr & AR_ISR_GENTMR)) { + u32 s5_s; + +- s5_s = REG_READ(ah, AR_ISR_S5_S); ++ if (pCap->hw_caps & ATH9K_HW_CAP_RAC_SUPPORTED) { ++ s5_s = REG_READ(ah, AR_ISR_S5_S); ++ } else { ++ s5_s = REG_READ(ah, AR_ISR_S5); ++ } ++ + ah->intr_gen_timer_trigger = + MS(s5_s, AR_ISR_S5_GENTIMER_TRIG); + +@@ -133,8 +154,21 @@ static bool ar9002_hw_get_isr(struct ath + if ((s5_s & AR_ISR_S5_TIM_TIMER) && + !(pCap->hw_caps & ATH9K_HW_CAP_AUTOSLEEP)) + *masked |= ATH9K_INT_TIM_TIMER; ++ ++ if (!(pCap->hw_caps & ATH9K_HW_CAP_RAC_SUPPORTED)) { ++ REG_WRITE(ah, AR_ISR_S5, s5_s); ++ isr &= ~AR_ISR_GENTMR; ++ } ++ } ++ ++ if (!(pCap->hw_caps & ATH9K_HW_CAP_RAC_SUPPORTED)) { ++ REG_WRITE(ah, AR_ISR, isr); ++ REG_READ(ah, AR_ISR); + } + ++ if (AR_SREV_9100(ah)) ++ return true; ++ + if (sync_cause) { + ath9k_debug_sync_cause(common, sync_cause); + fatal_int = diff --git a/queue-3.10/ath9k_htc-properly-set-mac-address-and-bssid-mask.patch b/queue-3.10/ath9k_htc-properly-set-mac-address-and-bssid-mask.patch new file mode 100644 index 00000000000..fe1e6b31b20 --- /dev/null +++ b/queue-3.10/ath9k_htc-properly-set-mac-address-and-bssid-mask.patch @@ -0,0 +1,99 @@ +From 657eb17d87852c42b55c4b06d5425baa08b2ddb3 Mon Sep 17 00:00:00 2001 +From: Mathy Vanhoef +Date: Thu, 28 Nov 2013 12:21:45 +0100 +Subject: ath9k_htc: properly set MAC address and BSSID mask + +From: Mathy Vanhoef + +commit 657eb17d87852c42b55c4b06d5425baa08b2ddb3 upstream. + +Pick the MAC address of the first virtual interface as the new hardware MAC +address. Set BSSID mask according to this MAC address. This fixes CVE-2013-4579. + +Signed-off-by: Mathy Vanhoef +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/ath/ath9k/htc_drv_main.c | 25 +++++++++++++++++-------- + drivers/net/wireless/ath/ath9k/main.c | 5 +++-- + 2 files changed, 20 insertions(+), 10 deletions(-) + +--- a/drivers/net/wireless/ath/ath9k/htc_drv_main.c ++++ b/drivers/net/wireless/ath/ath9k/htc_drv_main.c +@@ -145,21 +145,26 @@ static void ath9k_htc_bssid_iter(void *d + struct ath9k_vif_iter_data *iter_data = data; + int i; + +- for (i = 0; i < ETH_ALEN; i++) +- iter_data->mask[i] &= ~(iter_data->hw_macaddr[i] ^ mac[i]); ++ if (iter_data->hw_macaddr != NULL) { ++ for (i = 0; i < ETH_ALEN; i++) ++ iter_data->mask[i] &= ~(iter_data->hw_macaddr[i] ^ mac[i]); ++ } else { ++ iter_data->hw_macaddr = mac; ++ } + } + +-static void ath9k_htc_set_bssid_mask(struct ath9k_htc_priv *priv, ++static void ath9k_htc_set_mac_bssid_mask(struct ath9k_htc_priv *priv, + struct ieee80211_vif *vif) + { + struct ath_common *common = ath9k_hw_common(priv->ah); + struct ath9k_vif_iter_data iter_data; + + /* +- * Use the hardware MAC address as reference, the hardware uses it +- * together with the BSSID mask when matching addresses. ++ * Pick the MAC address of the first interface as the new hardware ++ * MAC address. The hardware will use it together with the BSSID mask ++ * when matching addresses. + */ +- iter_data.hw_macaddr = common->macaddr; ++ iter_data.hw_macaddr = NULL; + memset(&iter_data.mask, 0xff, ETH_ALEN); + + if (vif) +@@ -171,6 +176,10 @@ static void ath9k_htc_set_bssid_mask(str + ath9k_htc_bssid_iter, &iter_data); + + memcpy(common->bssidmask, iter_data.mask, ETH_ALEN); ++ ++ if (iter_data.hw_macaddr) ++ memcpy(common->macaddr, iter_data.hw_macaddr, ETH_ALEN); ++ + ath_hw_setbssidmask(common); + } + +@@ -1076,7 +1085,7 @@ static int ath9k_htc_add_interface(struc + goto out; + } + +- ath9k_htc_set_bssid_mask(priv, vif); ++ ath9k_htc_set_mac_bssid_mask(priv, vif); + + priv->vif_slot |= (1 << avp->index); + priv->nvifs++; +@@ -1139,7 +1148,7 @@ static void ath9k_htc_remove_interface(s + + ath9k_htc_set_opmode(priv); + +- ath9k_htc_set_bssid_mask(priv, vif); ++ ath9k_htc_set_mac_bssid_mask(priv, vif); + + /* + * Stop ANI only if there are no associated station interfaces. +--- a/drivers/net/wireless/ath/ath9k/main.c ++++ b/drivers/net/wireless/ath/ath9k/main.c +@@ -889,8 +889,9 @@ void ath9k_calculate_iter_data(struct ie + struct ath_common *common = ath9k_hw_common(ah); + + /* +- * Use the hardware MAC address as reference, the hardware uses it +- * together with the BSSID mask when matching addresses. ++ * Pick the MAC address of the first interface as the new hardware ++ * MAC address. The hardware will use it together with the BSSID mask ++ * when matching addresses. + */ + memset(iter_data, 0, sizeof(*iter_data)); + memset(&iter_data->mask, 0xff, ETH_ALEN); diff --git a/queue-3.10/auxvec.h-account-for-at_hwcap2-in-at_vector_size_base.patch b/queue-3.10/auxvec.h-account-for-at_hwcap2-in-at_vector_size_base.patch new file mode 100644 index 00000000000..a9ff95aa16f --- /dev/null +++ b/queue-3.10/auxvec.h-account-for-at_hwcap2-in-at_vector_size_base.patch @@ -0,0 +1,35 @@ +From f60900f2609e893c7f8d0bccc7ada4947dac4cd5 Mon Sep 17 00:00:00 2001 +From: Ard Biesheuvel +Date: Mon, 23 Dec 2013 18:49:30 +0100 +Subject: auxvec.h: account for AT_HWCAP2 in AT_VECTOR_SIZE_BASE + +From: Ard Biesheuvel + +commit f60900f2609e893c7f8d0bccc7ada4947dac4cd5 upstream. + +Commit 2171364d1a92 ("powerpc: Add HWCAP2 aux entry") introduced a new +AT_ auxv entry type AT_HWCAP2 but failed to update AT_VECTOR_SIZE_BASE +accordingly. + +Signed-off-by: Ard Biesheuvel +Fixes: 2171364d1a92 (powerpc: Add HWCAP2 aux entry) +Acked-by: Michael Neuling +Cc: Nishanth Aravamudan +Cc: Benjamin Herrenschmidt +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + include/linux/auxvec.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/include/linux/auxvec.h ++++ b/include/linux/auxvec.h +@@ -3,6 +3,6 @@ + + #include + +-#define AT_VECTOR_SIZE_BASE 19 /* NEW_AUX_ENT entries in auxiliary table */ ++#define AT_VECTOR_SIZE_BASE 20 /* NEW_AUX_ENT entries in auxiliary table */ + /* number of "#define AT_.*" above, minus {AT_NULL, AT_IGNORE, AT_NOTELF} */ + #endif /* _LINUX_AUXVEC_H */ diff --git a/queue-3.10/ceph-avoid-data-inconsistency-due-to-d-cache-aliasing-in-readpage.patch b/queue-3.10/ceph-avoid-data-inconsistency-due-to-d-cache-aliasing-in-readpage.patch new file mode 100644 index 00000000000..3896602d260 --- /dev/null +++ b/queue-3.10/ceph-avoid-data-inconsistency-due-to-d-cache-aliasing-in-readpage.patch @@ -0,0 +1,40 @@ +From 56f91aad69444d650237295f68c195b74d888d95 Mon Sep 17 00:00:00 2001 +From: Li Wang +Date: Wed, 13 Nov 2013 15:22:14 +0800 +Subject: ceph: Avoid data inconsistency due to d-cache aliasing in readpage() + +From: Li Wang + +commit 56f91aad69444d650237295f68c195b74d888d95 upstream. + +If the length of data to be read in readpage() is exactly +PAGE_CACHE_SIZE, the original code does not flush d-cache +for data consistency after finishing reading. This patches fixes +this. + +Signed-off-by: Li Wang +Signed-off-by: Sage Weil +Signed-off-by: Greg Kroah-Hartman + +--- + fs/ceph/addr.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +--- a/fs/ceph/addr.c ++++ b/fs/ceph/addr.c +@@ -213,9 +213,13 @@ static int readpage_nounlock(struct file + if (err < 0) { + SetPageError(page); + goto out; +- } else if (err < PAGE_CACHE_SIZE) { ++ } else { ++ if (err < PAGE_CACHE_SIZE) { + /* zero fill remainder of page */ +- zero_user_segment(page, err, PAGE_CACHE_SIZE); ++ zero_user_segment(page, err, PAGE_CACHE_SIZE); ++ } else { ++ flush_dcache_page(page); ++ } + } + SetPageUptodate(page); + diff --git a/queue-3.10/cpupower-fix-segfault-due-to-incorrect-getopt_long-arugments.patch b/queue-3.10/cpupower-fix-segfault-due-to-incorrect-getopt_long-arugments.patch new file mode 100644 index 00000000000..b932e9943ce --- /dev/null +++ b/queue-3.10/cpupower-fix-segfault-due-to-incorrect-getopt_long-arugments.patch @@ -0,0 +1,43 @@ +From f447ef4a56dee4b68a91460bcdfe06b5011085f2 Mon Sep 17 00:00:00 2001 +From: Josh Boyer +Date: Fri, 11 Oct 2013 08:45:51 -0400 +Subject: cpupower: Fix segfault due to incorrect getopt_long arugments + +From: Josh Boyer + +commit f447ef4a56dee4b68a91460bcdfe06b5011085f2 upstream. + +If a user calls 'cpupower set --perf-bias 15', the process will end with +a SIGSEGV in libc because cpupower-set passes a NULL optarg to the atoi +call. This is because the getopt_long structure currently has all of +the options as having an optional_argument when they really have a +required argument. We change the structure to use required_argument to +match the short options and it resolves the issue. + +This fixes https://bugzilla.redhat.com/show_bug.cgi?id=1000439 + +Signed-off-by: Josh Boyer +Cc: Dominik Brodowski +Cc: Thomas Renninger +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + tools/power/cpupower/utils/cpupower-set.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/tools/power/cpupower/utils/cpupower-set.c ++++ b/tools/power/cpupower/utils/cpupower-set.c +@@ -18,9 +18,9 @@ + #include "helpers/bitmask.h" + + static struct option set_opts[] = { +- { .name = "perf-bias", .has_arg = optional_argument, .flag = NULL, .val = 'b'}, +- { .name = "sched-mc", .has_arg = optional_argument, .flag = NULL, .val = 'm'}, +- { .name = "sched-smt", .has_arg = optional_argument, .flag = NULL, .val = 's'}, ++ { .name = "perf-bias", .has_arg = required_argument, .flag = NULL, .val = 'b'}, ++ { .name = "sched-mc", .has_arg = required_argument, .flag = NULL, .val = 'm'}, ++ { .name = "sched-smt", .has_arg = required_argument, .flag = NULL, .val = 's'}, + { }, + }; + diff --git a/queue-3.10/dm9601-fix-reception-of-full-size-ethernet-frames-on-dm9620-dm9621a.patch b/queue-3.10/dm9601-fix-reception-of-full-size-ethernet-frames-on-dm9620-dm9621a.patch new file mode 100644 index 00000000000..1a7dc0496aa --- /dev/null +++ b/queue-3.10/dm9601-fix-reception-of-full-size-ethernet-frames-on-dm9620-dm9621a.patch @@ -0,0 +1,36 @@ +From 407900cfb54bdb2cfa228010b6697305f66b2948 Mon Sep 17 00:00:00 2001 +From: Peter Korsgaard +Date: Mon, 16 Dec 2013 11:35:33 +0100 +Subject: dm9601: fix reception of full size ethernet frames on dm9620/dm9621a + +From: Peter Korsgaard + +commit 407900cfb54bdb2cfa228010b6697305f66b2948 upstream. + +dm9620/dm9621a require room for 4 byte padding even in dm9601 (3 byte +header) mode. + +Signed-off-by: Peter Korsgaard +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/usb/dm9601.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/drivers/net/usb/dm9601.c ++++ b/drivers/net/usb/dm9601.c +@@ -364,7 +364,12 @@ static int dm9601_bind(struct usbnet *de + dev->net->ethtool_ops = &dm9601_ethtool_ops; + dev->net->hard_header_len += DM_TX_OVERHEAD; + dev->hard_mtu = dev->net->mtu + dev->net->hard_header_len; +- dev->rx_urb_size = dev->net->mtu + ETH_HLEN + DM_RX_OVERHEAD; ++ ++ /* dm9620/21a require room for 4 byte padding, even in dm9601 ++ * mode, so we need +1 to be able to receive full size ++ * ethernet frames. ++ */ ++ dev->rx_urb_size = dev->net->mtu + ETH_HLEN + DM_RX_OVERHEAD + 1; + + dev->mii.dev = dev->net; + dev->mii.mdio_read = dm9601_mdio_read; diff --git a/queue-3.10/dm9601-work-around-tx-fifo-sync-issue-on-dm962x.patch b/queue-3.10/dm9601-work-around-tx-fifo-sync-issue-on-dm962x.patch new file mode 100644 index 00000000000..f8ec593c689 --- /dev/null +++ b/queue-3.10/dm9601-work-around-tx-fifo-sync-issue-on-dm962x.patch @@ -0,0 +1,83 @@ +From 4263c86dca5198da6bd3ad826d0b2304fbe25776 Mon Sep 17 00:00:00 2001 +From: Peter Korsgaard +Date: Mon, 16 Dec 2013 11:35:35 +0100 +Subject: dm9601: work around tx fifo sync issue on dm962x + +From: Peter Korsgaard + +commit 4263c86dca5198da6bd3ad826d0b2304fbe25776 upstream. + +Certain dm962x revisions contain an bug, where if a USB bulk transfer retry +(E.G. if bulk crc mismatch) happens right after a transfer with odd or +maxpacket length, the internal tx hardware fifo gets out of sync causing +the interface to stop working. + +Work around it by adding up to 3 bytes of padding to ensure this situation +cannot trigger. + +This workaround also means we never pass multiple-of-maxpacket size skb's +to usbnet, so the length adjustment to handle usbnet's padding of those can +be removed. + +Reported-by: Joseph Chang +Signed-off-by: Peter Korsgaard +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/usb/dm9601.c | 27 +++++++++++++++++++-------- + 1 file changed, 19 insertions(+), 8 deletions(-) + +--- a/drivers/net/usb/dm9601.c ++++ b/drivers/net/usb/dm9601.c +@@ -473,7 +473,7 @@ static int dm9601_rx_fixup(struct usbnet + static struct sk_buff *dm9601_tx_fixup(struct usbnet *dev, struct sk_buff *skb, + gfp_t flags) + { +- int len; ++ int len, pad; + + /* format: + b1: packet length low +@@ -481,12 +481,23 @@ static struct sk_buff *dm9601_tx_fixup(s + b3..n: packet data + */ + +- len = skb->len; ++ len = skb->len + DM_TX_OVERHEAD; + +- if (skb_headroom(skb) < DM_TX_OVERHEAD) { ++ /* workaround for dm962x errata with tx fifo getting out of ++ * sync if a USB bulk transfer retry happens right after a ++ * packet with odd / maxpacket length by adding up to 3 bytes ++ * padding. ++ */ ++ while ((len & 1) || !(len % dev->maxpacket)) ++ len++; ++ ++ len -= DM_TX_OVERHEAD; /* hw header doesn't count as part of length */ ++ pad = len - skb->len; ++ ++ if (skb_headroom(skb) < DM_TX_OVERHEAD || skb_tailroom(skb) < pad) { + struct sk_buff *skb2; + +- skb2 = skb_copy_expand(skb, DM_TX_OVERHEAD, 0, flags); ++ skb2 = skb_copy_expand(skb, DM_TX_OVERHEAD, pad, flags); + dev_kfree_skb_any(skb); + skb = skb2; + if (!skb) +@@ -495,10 +506,10 @@ static struct sk_buff *dm9601_tx_fixup(s + + __skb_push(skb, DM_TX_OVERHEAD); + +- /* usbnet adds padding if length is a multiple of packet size +- if so, adjust length value in header */ +- if ((skb->len % dev->maxpacket) == 0) +- len++; ++ if (pad) { ++ memset(skb->data + skb->len, 0, pad); ++ __skb_put(skb, pad); ++ } + + skb->data[0] = len; + skb->data[1] = len >> 8; diff --git a/queue-3.10/kvm-x86-fix-apic-map-calculation-after-re-enabling.patch b/queue-3.10/kvm-x86-fix-apic-map-calculation-after-re-enabling.patch new file mode 100644 index 00000000000..240b75b71df --- /dev/null +++ b/queue-3.10/kvm-x86-fix-apic-map-calculation-after-re-enabling.patch @@ -0,0 +1,48 @@ +From e66d2ae7c67bd9ac982a3d1890564de7f7eabf4b Mon Sep 17 00:00:00 2001 +From: Jan Kiszka +Date: Sun, 29 Dec 2013 02:29:30 +0100 +Subject: KVM: x86: Fix APIC map calculation after re-enabling + +From: Jan Kiszka + +commit e66d2ae7c67bd9ac982a3d1890564de7f7eabf4b upstream. + +Update arch.apic_base before triggering recalculate_apic_map. Otherwise +the recalculation will work against the previous state of the APIC and +will fail to build the correct map when an APIC is hardware-enabled +again. + +This fixes a regression of 1e08ec4a13. + +Signed-off-by: Jan Kiszka +Signed-off-by: Marcelo Tosatti +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kvm/lapic.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/arch/x86/kvm/lapic.c ++++ b/arch/x86/kvm/lapic.c +@@ -1364,6 +1364,10 @@ void kvm_lapic_set_base(struct kvm_vcpu + return; + } + ++ if (!kvm_vcpu_is_bsp(apic->vcpu)) ++ value &= ~MSR_IA32_APICBASE_BSP; ++ vcpu->arch.apic_base = value; ++ + /* update jump label if enable bit changes */ + if ((vcpu->arch.apic_base ^ value) & MSR_IA32_APICBASE_ENABLE) { + if (value & MSR_IA32_APICBASE_ENABLE) +@@ -1373,10 +1377,6 @@ void kvm_lapic_set_base(struct kvm_vcpu + recalculate_apic_map(vcpu->kvm); + } + +- if (!kvm_vcpu_is_bsp(apic->vcpu)) +- value &= ~MSR_IA32_APICBASE_BSP; +- +- vcpu->arch.apic_base = value; + if ((old_value ^ value) & X2APIC_ENABLE) { + if (value & X2APIC_ENABLE) { + u32 id = kvm_apic_id(apic); diff --git a/queue-3.10/powerpc-align-p_end.patch b/queue-3.10/powerpc-align-p_end.patch new file mode 100644 index 00000000000..e9d40cfc7bb --- /dev/null +++ b/queue-3.10/powerpc-align-p_end.patch @@ -0,0 +1,34 @@ +From 286e4f90a72c0b0621dde0294af6ed4b0baddabb Mon Sep 17 00:00:00 2001 +From: Anton Blanchard +Date: Mon, 23 Dec 2013 12:19:51 +1100 +Subject: powerpc: Align p_end + +From: Anton Blanchard + +commit 286e4f90a72c0b0621dde0294af6ed4b0baddabb upstream. + +p_end is an 8 byte value embedded in the text section. This means it +is only 4 byte aligned when it should be 8 byte aligned. Fix this +by adding an explicit alignment. + +This fixes an issue where POWER7 little endian builds with +CONFIG_RELOCATABLE=y fail to boot. + +Signed-off-by: Anton Blanchard +Signed-off-by: Benjamin Herrenschmidt +Signed-off-by: Greg Kroah-Hartman + +--- + arch/powerpc/kernel/head_64.S | 1 + + 1 file changed, 1 insertion(+) + +--- a/arch/powerpc/kernel/head_64.S ++++ b/arch/powerpc/kernel/head_64.S +@@ -467,6 +467,7 @@ _STATIC(__after_prom_start) + mtctr r8 + bctr + ++.balign 8 + p_end: .llong _end - _stext + + 4: /* Now copy the rest of the kernel up to _end */ diff --git a/queue-3.10/powerpc-fix-bad-stack-check-in-exception-entry.patch b/queue-3.10/powerpc-fix-bad-stack-check-in-exception-entry.patch new file mode 100644 index 00000000000..8e0c8194ac9 --- /dev/null +++ b/queue-3.10/powerpc-fix-bad-stack-check-in-exception-entry.patch @@ -0,0 +1,42 @@ +From 90ff5d688e61f49f23545ffab6228bd7e87e6dc7 Mon Sep 17 00:00:00 2001 +From: Michael Neuling +Date: Mon, 16 Dec 2013 15:12:43 +1100 +Subject: powerpc: Fix bad stack check in exception entry + +From: Michael Neuling + +commit 90ff5d688e61f49f23545ffab6228bd7e87e6dc7 upstream. + +In EXCEPTION_PROLOG_COMMON() we check to see if the stack pointer (r1) +is valid when coming from the kernel. If it's not valid, we die but +with a nice oops message. + +Currently we allocate a stack frame (subtract INT_FRAME_SIZE) before we +check to see if the stack pointer is negative. Unfortunately, this +won't detect a bad stack where r1 is less than INT_FRAME_SIZE. + +This patch fixes the check to compare the modified r1 with +-INT_FRAME_SIZE. With this, bad kernel stack pointers (including NULL +pointers) are correctly detected again. + +Kudos to Paulus for finding this. + +Signed-off-by: Michael Neuling +Signed-off-by: Benjamin Herrenschmidt +Signed-off-by: Greg Kroah-Hartman + +--- + arch/powerpc/include/asm/exception-64s.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/powerpc/include/asm/exception-64s.h ++++ b/arch/powerpc/include/asm/exception-64s.h +@@ -264,7 +264,7 @@ do_kvm_##n: \ + subi r1,r1,INT_FRAME_SIZE; /* alloc frame on kernel stack */ \ + beq- 1f; \ + ld r1,PACAKSAVE(r13); /* kernel stack to use */ \ +-1: cmpdi cr1,r1,0; /* check if r1 is in userspace */ \ ++1: cmpdi cr1,r1,-INT_FRAME_SIZE; /* check if r1 is in userspace */ \ + blt+ cr1,3f; /* abort if it is */ \ + li r1,(n); /* will be reloaded later */ \ + sth r1,PACA_TRAP_SAVE(r13); \ diff --git a/queue-3.10/series b/queue-3.10/series index cf2d5ca57d7..07b3a62e5ff 100644 --- a/queue-3.10/series +++ b/queue-3.10/series @@ -47,3 +47,14 @@ drm-radeon-fix-asic-gfx-values-for-scrapper-asics.patch drm-i915-use-the-correct-gmch_ctrl-register-for-sandybridge.patch drm-radeon-fix-uvd-256mb-check.patch drm-radeon-0x9649-is-sumo2-not-sumo.patch +ceph-avoid-data-inconsistency-due-to-d-cache-aliasing-in-readpage.patch +tg3-expand-4g_overflow_test-workaround-to-skb-fragments-of-any-size.patch +auxvec.h-account-for-at_hwcap2-in-at_vector_size_base.patch +dm9601-fix-reception-of-full-size-ethernet-frames-on-dm9620-dm9621a.patch +dm9601-work-around-tx-fifo-sync-issue-on-dm962x.patch +ath9k-fix-interrupt-handling-for-the-ar9002-family.patch +ath9k_htc-properly-set-mac-address-and-bssid-mask.patch +kvm-x86-fix-apic-map-calculation-after-re-enabling.patch +powerpc-fix-bad-stack-check-in-exception-entry.patch +powerpc-align-p_end.patch +cpupower-fix-segfault-due-to-incorrect-getopt_long-arugments.patch diff --git a/queue-3.10/tg3-expand-4g_overflow_test-workaround-to-skb-fragments-of-any-size.patch b/queue-3.10/tg3-expand-4g_overflow_test-workaround-to-skb-fragments-of-any-size.patch new file mode 100644 index 00000000000..c72152640b3 --- /dev/null +++ b/queue-3.10/tg3-expand-4g_overflow_test-workaround-to-skb-fragments-of-any-size.patch @@ -0,0 +1,35 @@ +From 375679104ab3ccfd18dcbd7ba503734fb9a2c63a Mon Sep 17 00:00:00 2001 +From: Nithin Sujir +Date: Thu, 19 Dec 2013 17:44:11 -0800 +Subject: tg3: Expand 4g_overflow_test workaround to skb fragments of any size. + +From: Nithin Sujir + +commit 375679104ab3ccfd18dcbd7ba503734fb9a2c63a upstream. + +The current driver assumes that an skb fragment can only be upto jumbo +size. Presumably this was a fast-path optimization. This assumption is +no longer true as fragments can be upto 32k. + +v2: Remove unnecessary parantheses per Eric Dumazet. + +Signed-off-by: Nithin Nayak Sujir +Signed-off-by: Michael Chan +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/ethernet/broadcom/tg3.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/ethernet/broadcom/tg3.c ++++ b/drivers/net/ethernet/broadcom/tg3.c +@@ -7482,7 +7482,7 @@ static inline int tg3_4g_overflow_test(d + { + u32 base = (u32) mapping & 0xffffffff; + +- return (base > 0xffffdcc0) && (base + len + 8 < base); ++ return base + len + 8 < base; + } + + /* Test for TSO DMA buffers that cross into regions which are within MSS bytes