From: Greg Kroah-Hartman Date: Mon, 13 Jan 2014 18:23:56 +0000 (-0800) Subject: 3.12-stable patches X-Git-Tag: v3.4.77~4 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=b312b9863a6f4a07cbe0cff0b45504e8c5417c36;p=thirdparty%2Fkernel%2Fstable-queue.git 3.12-stable patches added patches: acpi-battery-add-a-_bix-quirk-for-nec-lz750-ls.patch acpi-tpm-fix-memory-leak-when-walking-acpi-namespace.patch ahci-add-pci-id-for-marvell-88se9170-sata-controller.patch arm-dts-exynos5250-fix-mdma0-clock-number.patch arm-shmobile-armadillo-fix-coherent-dma-mask.patch arm-shmobile-kzm9g-fix-coherent-dma-mask.patch arm-shmobile-mackerel-fix-coherent-dma-mask.patch clk-clk-divider-fix-divisor-255-bug.patch clk-exynos5250-fix-sysmmu_mfc-l-r-gate-clocks.patch clk-samsung-exynos4-correct-src_mfc-register.patch clk-samsung-exynos5250-add-clk_ignore_unused-flag-for-the-sysreg-clock.patch clk-samsung-exynos5250-add-mdma0-clocks.patch clk-samsung-exynos5250-fix-acp-gate-register-offset.patch drm-nouveau-bios-make-jump-conditional.patch intel_pstate-add-x86_feature_aperfmperf-to-cpu-match-parameters.patch leds-lp5521-5523-remove-duplicate-mutex.patch mac80211-move-bufferable-mmpdu-check-to-fix-ap-mode-scan.patch mfd-rtsx_pcr-disable-interrupts-before-cancelling-delayed-works.patch netfilter-fix-wrong-byte-order-in-nf_ct_seqadj_set-internal-information.patch netfilter-nf_nat-fix-access-to-uninitialized-buffer-in-irc-nat-helper.patch parisc-ensure-full-cache-coherency-for-kmap-kunmap.patch scsi-sd-reduce-buffer-size-for-vpd-request.patch x86-fpu-amd-clear-exceptions-in-amd-fxsave-workaround.patch --- diff --git a/queue-3.12/acpi-battery-add-a-_bix-quirk-for-nec-lz750-ls.patch b/queue-3.12/acpi-battery-add-a-_bix-quirk-for-nec-lz750-ls.patch new file mode 100644 index 00000000000..181288f2e45 --- /dev/null +++ b/queue-3.12/acpi-battery-add-a-_bix-quirk-for-nec-lz750-ls.patch @@ -0,0 +1,77 @@ +From a90b40385735af0d3031f98e97b439e8944a31b3 Mon Sep 17 00:00:00 2001 +From: Lan Tianyu +Date: Mon, 6 Jan 2014 22:50:37 +0800 +Subject: ACPI / Battery: Add a _BIX quirk for NEC LZ750/LS + +From: Lan Tianyu + +commit a90b40385735af0d3031f98e97b439e8944a31b3 upstream. + +The AML method _BIX of NEC LZ750/LS returns a broken package which +skips the first member "Revision" (ACPI 5.0, Table 10-234). + +Add a quirk for this machine to skip member "Revision" during parsing +the package returned by _BIX. + +Reference: https://bugzilla.kernel.org/show_bug.cgi?id=67351 +Reported-and-tested-by: Francisco Castro +Signed-off-by: Lan Tianyu +Reviewed-by: Dmitry Torokhov +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/acpi/battery.c | 21 ++++++++++++++++++++- + 1 file changed, 20 insertions(+), 1 deletion(-) + +--- a/drivers/acpi/battery.c ++++ b/drivers/acpi/battery.c +@@ -68,6 +68,7 @@ MODULE_AUTHOR("Alexey Starikovskiy flags)) ++ ++ if (battery_bix_broken_package) ++ result = extract_package(battery, buffer.pointer, ++ extended_info_offsets + 1, ++ ARRAY_SIZE(extended_info_offsets) - 1); ++ else if (test_bit(ACPI_BATTERY_XINFO_PRESENT, &battery->flags)) + result = extract_package(battery, buffer.pointer, + extended_info_offsets, + ARRAY_SIZE(extended_info_offsets)); +@@ -1054,6 +1060,17 @@ static int battery_notify(struct notifie + return 0; + } + ++static struct dmi_system_id bat_dmi_table[] = { ++ { ++ .ident = "NEC LZ750/LS", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "NEC"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "PC-LZ750LS"), ++ }, ++ }, ++ {}, ++}; ++ + static int acpi_battery_add(struct acpi_device *device) + { + int result = 0; +@@ -1163,6 +1180,8 @@ static void __init acpi_battery_init_asy + if (!acpi_battery_dir) + return; + #endif ++ if (dmi_check_system(bat_dmi_table)) ++ battery_bix_broken_package = 1; + if (acpi_bus_register_driver(&acpi_battery_driver) < 0) { + #ifdef CONFIG_ACPI_PROCFS_POWER + acpi_unlock_battery_dir(acpi_battery_dir); diff --git a/queue-3.12/acpi-tpm-fix-memory-leak-when-walking-acpi-namespace.patch b/queue-3.12/acpi-tpm-fix-memory-leak-when-walking-acpi-namespace.patch new file mode 100644 index 00000000000..608e4d59a0d --- /dev/null +++ b/queue-3.12/acpi-tpm-fix-memory-leak-when-walking-acpi-namespace.patch @@ -0,0 +1,48 @@ +From df45c712d1f4ef37714245fb75de726f4ca2bf8d Mon Sep 17 00:00:00 2001 +From: Jiang Liu +Date: Thu, 19 Dec 2013 20:38:15 +0800 +Subject: ACPI / TPM: fix memory leak when walking ACPI namespace + +From: Jiang Liu + +commit df45c712d1f4ef37714245fb75de726f4ca2bf8d upstream. + +In function ppi_callback(), memory allocated by acpi_get_name() will get +leaked when current device isn't the desired TPM device, so fix the +memory leak. + +Signed-off-by: Jiang Liu +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/char/tpm/tpm_ppi.c | 15 +++++++++------ + 1 file changed, 9 insertions(+), 6 deletions(-) + +--- a/drivers/char/tpm/tpm_ppi.c ++++ b/drivers/char/tpm/tpm_ppi.c +@@ -27,15 +27,18 @@ static char *tpm_device_name = "TPM"; + static acpi_status ppi_callback(acpi_handle handle, u32 level, void *context, + void **return_value) + { +- acpi_status status; ++ acpi_status status = AE_OK; + struct acpi_buffer buffer = { ACPI_ALLOCATE_BUFFER, NULL }; +- status = acpi_get_name(handle, ACPI_FULL_PATHNAME, &buffer); +- if (strstr(buffer.pointer, context) != NULL) { +- *return_value = handle; ++ ++ if (ACPI_SUCCESS(acpi_get_name(handle, ACPI_FULL_PATHNAME, &buffer))) { ++ if (strstr(buffer.pointer, context) != NULL) { ++ *return_value = handle; ++ status = AE_CTRL_TERMINATE; ++ } + kfree(buffer.pointer); +- return AE_CTRL_TERMINATE; + } +- return AE_OK; ++ ++ return status; + } + + static inline void ppi_assign_params(union acpi_object params[4], diff --git a/queue-3.12/ahci-add-pci-id-for-marvell-88se9170-sata-controller.patch b/queue-3.12/ahci-add-pci-id-for-marvell-88se9170-sata-controller.patch new file mode 100644 index 00000000000..b38374cec92 --- /dev/null +++ b/queue-3.12/ahci-add-pci-id-for-marvell-88se9170-sata-controller.patch @@ -0,0 +1,32 @@ +From e098f5cbe9d410e7878b50f524dce36cc83ec40e Mon Sep 17 00:00:00 2001 +From: Simon Guinot +Date: Mon, 23 Dec 2013 13:24:35 +0100 +Subject: ahci: add PCI ID for Marvell 88SE9170 SATA controller + +From: Simon Guinot + +commit e098f5cbe9d410e7878b50f524dce36cc83ec40e upstream. + +This patch adds support for the PCI ID provided by the Marvell 88SE9170 +SATA controller. + +Signed-off-by: Simon Guinot +Signed-off-by: Tejun Heo +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ata/ahci.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/ata/ahci.c ++++ b/drivers/ata/ahci.c +@@ -427,6 +427,9 @@ static const struct pci_device_id ahci_p + .driver_data = board_ahci_yes_fbs }, /* 88se9128 */ + { PCI_DEVICE(PCI_VENDOR_ID_MARVELL_EXT, 0x9125), + .driver_data = board_ahci_yes_fbs }, /* 88se9125 */ ++ { PCI_DEVICE_SUB(PCI_VENDOR_ID_MARVELL_EXT, 0x9178, ++ PCI_VENDOR_ID_MARVELL_EXT, 0x9170), ++ .driver_data = board_ahci_yes_fbs }, /* 88se9170 */ + { PCI_DEVICE(PCI_VENDOR_ID_MARVELL_EXT, 0x917a), + .driver_data = board_ahci_yes_fbs }, /* 88se9172 */ + { PCI_DEVICE(PCI_VENDOR_ID_MARVELL_EXT, 0x9172), diff --git a/queue-3.12/arm-dts-exynos5250-fix-mdma0-clock-number.patch b/queue-3.12/arm-dts-exynos5250-fix-mdma0-clock-number.patch new file mode 100644 index 00000000000..14cf5c65320 --- /dev/null +++ b/queue-3.12/arm-dts-exynos5250-fix-mdma0-clock-number.patch @@ -0,0 +1,34 @@ +From 8777539479abd7b3efeb691685415dc2b057d0e0 Mon Sep 17 00:00:00 2001 +From: Abhilash Kesavan +Date: Thu, 12 Dec 2013 08:32:02 +0530 +Subject: ARM: dts: exynos5250: Fix MDMA0 clock number + +From: Abhilash Kesavan + +commit 8777539479abd7b3efeb691685415dc2b057d0e0 upstream. + +Due to incorrect clock specified in MDMA0 node, using MDMA0 controller +could cause system failures, due to wrong clock being controlled. This +patch fixes this by specifying correct clock. + +Signed-off-by: Abhilash Kesavan +Acked-by: Mike Turquette +[t.figa: Corrected commit message and description.] +Signed-off-by: Tomasz Figa +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/boot/dts/exynos5250.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/arm/boot/dts/exynos5250.dtsi ++++ b/arch/arm/boot/dts/exynos5250.dtsi +@@ -556,7 +556,7 @@ + compatible = "arm,pl330", "arm,primecell"; + reg = <0x10800000 0x1000>; + interrupts = <0 33 0>; +- clocks = <&clock 271>; ++ clocks = <&clock 346>; + clock-names = "apb_pclk"; + #dma-cells = <1>; + #dma-channels = <8>; diff --git a/queue-3.12/arm-shmobile-armadillo-fix-coherent-dma-mask.patch b/queue-3.12/arm-shmobile-armadillo-fix-coherent-dma-mask.patch new file mode 100644 index 00000000000..af3f0408810 --- /dev/null +++ b/queue-3.12/arm-shmobile-armadillo-fix-coherent-dma-mask.patch @@ -0,0 +1,45 @@ +From dcd740b645003b866d7eb30d13d34d0729cce9db Mon Sep 17 00:00:00 2001 +From: Laurent Pinchart +Date: Mon, 16 Dec 2013 19:16:07 +0100 +Subject: ARM: shmobile: armadillo: Fix coherent DMA mask + +From: Laurent Pinchart + +commit dcd740b645003b866d7eb30d13d34d0729cce9db upstream. + +Commit 4dcfa60071b3d23f0181f27d8519f12e37cefbb9 ("ARM: DMA-API: better +handing of DMA masks for coherent allocations") added an additional +check to the coherent DMA mask that results in an error when the mask is +larger than what dma_addr_t can address. + +Set the LCDC coherent DMA mask to DMA_BIT_MASK(32) instead of ~0 to fix +the problem. + +Signed-off-by: Laurent Pinchart +Signed-off-by: Simon Horman +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/mach-shmobile/board-armadillo800eva.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/arm/mach-shmobile/board-armadillo800eva.c ++++ b/arch/arm/mach-shmobile/board-armadillo800eva.c +@@ -482,7 +482,7 @@ static struct platform_device lcdc0_devi + .id = 0, + .dev = { + .platform_data = &lcdc0_info, +- .coherent_dma_mask = ~0, ++ .coherent_dma_mask = DMA_BIT_MASK(32), + }, + }; + +@@ -579,7 +579,7 @@ static struct platform_device hdmi_lcdc_ + .id = 1, + .dev = { + .platform_data = &hdmi_lcdc_info, +- .coherent_dma_mask = ~0, ++ .coherent_dma_mask = DMA_BIT_MASK(32), + }, + }; + diff --git a/queue-3.12/arm-shmobile-kzm9g-fix-coherent-dma-mask.patch b/queue-3.12/arm-shmobile-kzm9g-fix-coherent-dma-mask.patch new file mode 100644 index 00000000000..c42836549c3 --- /dev/null +++ b/queue-3.12/arm-shmobile-kzm9g-fix-coherent-dma-mask.patch @@ -0,0 +1,36 @@ +From 4f387323853c495ac589210832fad4503f75a0e7 Mon Sep 17 00:00:00 2001 +From: Laurent Pinchart +Date: Mon, 16 Dec 2013 19:16:08 +0100 +Subject: ARM: shmobile: kzm9g: Fix coherent DMA mask + +From: Laurent Pinchart + +commit 4f387323853c495ac589210832fad4503f75a0e7 upstream. + +Commit 4dcfa60071b3d23f0181f27d8519f12e37cefbb9 ("ARM: DMA-API: better +handing of DMA masks for coherent allocations") added an additional +check to the coherent DMA mask that results in an error when the mask is +larger than what dma_addr_t can address. + +Set the LCDC coherent DMA mask to DMA_BIT_MASK(32) instead of ~0 to fix +the problem. + +Signed-off-by: Laurent Pinchart +Signed-off-by: Simon Horman +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/mach-shmobile/board-kzm9g.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/arm/mach-shmobile/board-kzm9g.c ++++ b/arch/arm/mach-shmobile/board-kzm9g.c +@@ -334,7 +334,7 @@ static struct platform_device lcdc_devic + .resource = lcdc_resources, + .dev = { + .platform_data = &lcdc_info, +- .coherent_dma_mask = ~0, ++ .coherent_dma_mask = DMA_BIT_MASK(32), + }, + }; + diff --git a/queue-3.12/arm-shmobile-mackerel-fix-coherent-dma-mask.patch b/queue-3.12/arm-shmobile-mackerel-fix-coherent-dma-mask.patch new file mode 100644 index 00000000000..ab5e8c9d3b8 --- /dev/null +++ b/queue-3.12/arm-shmobile-mackerel-fix-coherent-dma-mask.patch @@ -0,0 +1,45 @@ +From b6328a6b7ba57fc84c38248f6f0e387e1170f1a8 Mon Sep 17 00:00:00 2001 +From: Laurent Pinchart +Date: Mon, 16 Dec 2013 19:16:09 +0100 +Subject: ARM: shmobile: mackerel: Fix coherent DMA mask + +From: Laurent Pinchart + +commit b6328a6b7ba57fc84c38248f6f0e387e1170f1a8 upstream. + +Commit 4dcfa60071b3d23f0181f27d8519f12e37cefbb9 ("ARM: DMA-API: better +handing of DMA masks for coherent allocations") added an additional +check to the coherent DMA mask that results in an error when the mask is +larger than what dma_addr_t can address. + +Set the LCDC coherent DMA mask to DMA_BIT_MASK(32) instead of ~0 to fix +the problem. + +Signed-off-by: Laurent Pinchart +Signed-off-by: Simon Horman +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/mach-shmobile/board-mackerel.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/arm/mach-shmobile/board-mackerel.c ++++ b/arch/arm/mach-shmobile/board-mackerel.c +@@ -409,7 +409,7 @@ static struct platform_device lcdc_devic + .resource = lcdc_resources, + .dev = { + .platform_data = &lcdc_info, +- .coherent_dma_mask = ~0, ++ .coherent_dma_mask = DMA_BIT_MASK(32), + }, + }; + +@@ -499,7 +499,7 @@ static struct platform_device hdmi_lcdc_ + .id = 1, + .dev = { + .platform_data = &hdmi_lcdc_info, +- .coherent_dma_mask = ~0, ++ .coherent_dma_mask = DMA_BIT_MASK(32), + }, + }; + diff --git a/queue-3.12/clk-clk-divider-fix-divisor-255-bug.patch b/queue-3.12/clk-clk-divider-fix-divisor-255-bug.patch new file mode 100644 index 00000000000..c619043e267 --- /dev/null +++ b/queue-3.12/clk-clk-divider-fix-divisor-255-bug.patch @@ -0,0 +1,40 @@ +From 778037e1ccb75609846deca9e419449c1dc137fa Mon Sep 17 00:00:00 2001 +From: James Hogan +Date: Mon, 16 Dec 2013 10:41:38 +0000 +Subject: clk: clk-divider: fix divisor > 255 bug + +From: James Hogan + +commit 778037e1ccb75609846deca9e419449c1dc137fa upstream. + +Commit 6d9252bd9a4bb (clk: Add support for power of two type dividers) +merged in v3.6 added the _get_val function to convert a divisor value to +a register field value depending on the flags. However it used the type +u8 for the div field, causing divisors larger than 255 to be masked +and the resultant clock rate to be too high. + +E.g. in my case an 11bit divider was supposed to divide 24.576 MHz down +to 32.768KHz. The divisor was correctly calculated as 750 (0x2ee). This +was masked to 238 (0xee) resulting in a frequency of 103.26KHz. + +Signed-off-by: James Hogan +Cc: Rajendra Nayak +Cc: linux-arm-kernel@lists.infradead.org +Signed-off-by: Mike Turquette +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/clk/clk-divider.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/clk/clk-divider.c ++++ b/drivers/clk/clk-divider.c +@@ -87,7 +87,7 @@ static unsigned int _get_table_val(const + return 0; + } + +-static unsigned int _get_val(struct clk_divider *divider, u8 div) ++static unsigned int _get_val(struct clk_divider *divider, unsigned int div) + { + if (divider->flags & CLK_DIVIDER_ONE_BASED) + return div; diff --git a/queue-3.12/clk-exynos5250-fix-sysmmu_mfc-l-r-gate-clocks.patch b/queue-3.12/clk-exynos5250-fix-sysmmu_mfc-l-r-gate-clocks.patch new file mode 100644 index 00000000000..ca33ef89766 --- /dev/null +++ b/queue-3.12/clk-exynos5250-fix-sysmmu_mfc-l-r-gate-clocks.patch @@ -0,0 +1,36 @@ +From 97c3557c3e0413efb1f021f582d1459760e22727 Mon Sep 17 00:00:00 2001 +From: Andrew Bresticker +Date: Fri, 8 Nov 2013 15:44:07 +0530 +Subject: clk: exynos5250: fix sysmmu_mfc{l,r} gate clocks + +From: Andrew Bresticker + +commit 97c3557c3e0413efb1f021f582d1459760e22727 upstream. + +The gate clocks for the MFC sysmmus appear to be flipped, i.e. +GATE_IP_MFC[2] gates sysmmu_mfcl and GATE_IP_MFC[1] gates sysmmu_mfcr. +Fix this so that the MFC will start up. + +Signed-off-by: Andrew Bresticker +Signed-off-by: Sachin Kamat +Acked-by: Mike Turquette +Signed-off-by: Tomasz Figa +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/clk/samsung/clk-exynos5250.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/clk/samsung/clk-exynos5250.c ++++ b/drivers/clk/samsung/clk-exynos5250.c +@@ -355,8 +355,8 @@ static struct samsung_gate_clock exynos5 + GATE(smmu_gscl2, "smmu_gscl2", "aclk266", GATE_IP_GSCL, 9, 0, 0), + GATE(smmu_gscl3, "smmu_gscl3", "aclk266", GATE_IP_GSCL, 10, 0, 0), + GATE(mfc, "mfc", "aclk333", GATE_IP_MFC, 0, 0, 0), +- GATE(smmu_mfcl, "smmu_mfcl", "aclk333", GATE_IP_MFC, 1, 0, 0), +- GATE(smmu_mfcr, "smmu_mfcr", "aclk333", GATE_IP_MFC, 2, 0, 0), ++ GATE(smmu_mfcl, "smmu_mfcl", "aclk333", GATE_IP_MFC, 2, 0, 0), ++ GATE(smmu_mfcr, "smmu_mfcr", "aclk333", GATE_IP_MFC, 1, 0, 0), + GATE(rotator, "rotator", "aclk266", GATE_IP_GEN, 1, 0, 0), + GATE(jpeg, "jpeg", "aclk166", GATE_IP_GEN, 2, 0, 0), + GATE(mdma1, "mdma1", "aclk266", GATE_IP_GEN, 4, 0, 0), diff --git a/queue-3.12/clk-samsung-exynos4-correct-src_mfc-register.patch b/queue-3.12/clk-samsung-exynos4-correct-src_mfc-register.patch new file mode 100644 index 00000000000..bfc4fa36e56 --- /dev/null +++ b/queue-3.12/clk-samsung-exynos4-correct-src_mfc-register.patch @@ -0,0 +1,34 @@ +From 5fdd1b56be51b1ec4dbde5b213d649ac717442da Mon Sep 17 00:00:00 2001 +From: Seung-Woo Kim +Date: Fri, 22 Nov 2013 14:21:08 +0900 +Subject: clk: samsung: exynos4: Correct SRC_MFC register + +From: Seung-Woo Kim + +commit 5fdd1b56be51b1ec4dbde5b213d649ac717442da upstream. + +The SRC_MFC register offset was incorrect, which could cause have caused +wrong calculation of rate of sclk_mfc clock, that could in turn lead to +incorrect operation of MFC. This patch corrects it. + +Signed-off-by: Seung-Woo Kim +Acked-by: Mike Turquette +[t.figa: Updated patch description] +Signed-off-by: Tomasz Figa +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/clk/samsung/clk-exynos4.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/clk/samsung/clk-exynos4.c ++++ b/drivers/clk/samsung/clk-exynos4.c +@@ -39,7 +39,7 @@ + #define SRC_TOP1 0xc214 + #define SRC_CAM 0xc220 + #define SRC_TV 0xc224 +-#define SRC_MFC 0xcc28 ++#define SRC_MFC 0xc228 + #define SRC_G3D 0xc22c + #define E4210_SRC_IMAGE 0xc230 + #define SRC_LCD0 0xc234 diff --git a/queue-3.12/clk-samsung-exynos5250-add-clk_ignore_unused-flag-for-the-sysreg-clock.patch b/queue-3.12/clk-samsung-exynos5250-add-clk_ignore_unused-flag-for-the-sysreg-clock.patch new file mode 100644 index 00000000000..877a96fcb13 --- /dev/null +++ b/queue-3.12/clk-samsung-exynos5250-add-clk_ignore_unused-flag-for-the-sysreg-clock.patch @@ -0,0 +1,36 @@ +From 2feed5aecf5f367b92bd6b6e92afe9e3de466907 Mon Sep 17 00:00:00 2001 +From: Abhilash Kesavan +Date: Wed, 11 Dec 2013 17:27:05 +0530 +Subject: clk: samsung: exynos5250: Add CLK_IGNORE_UNUSED flag for the sysreg clock + +From: Abhilash Kesavan + +commit 2feed5aecf5f367b92bd6b6e92afe9e3de466907 upstream. + +The sysreg (system register) generates control signals for various blocks +like disp1blk, i2c, mipi, usb etc. However, it gets disabled as an unused +clock at boot-up. This can lead to failures in operation of above blocks, +because they can not be configured properly if this clock is disabled. + +Signed-off-by: Abhilash Kesavan +Acked-by: Mike Turquette +[t.figa: Updated patch description.] +Signed-off-by: Tomasz Figa +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/clk/samsung/clk-exynos5250.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/clk/samsung/clk-exynos5250.c ++++ b/drivers/clk/samsung/clk-exynos5250.c +@@ -407,7 +407,8 @@ static struct samsung_gate_clock exynos5 + GATE(hsi2c2, "hsi2c2", "aclk66", GATE_IP_PERIC, 30, 0, 0), + GATE(hsi2c3, "hsi2c3", "aclk66", GATE_IP_PERIC, 31, 0, 0), + GATE(chipid, "chipid", "aclk66", GATE_IP_PERIS, 0, 0, 0), +- GATE(sysreg, "sysreg", "aclk66", GATE_IP_PERIS, 1, 0, 0), ++ GATE(sysreg, "sysreg", "aclk66", ++ GATE_IP_PERIS, 1, CLK_IGNORE_UNUSED, 0), + GATE(pmu, "pmu", "aclk66", GATE_IP_PERIS, 2, CLK_IGNORE_UNUSED, 0), + GATE(tzpc0, "tzpc0", "aclk66", GATE_IP_PERIS, 6, 0, 0), + GATE(tzpc1, "tzpc1", "aclk66", GATE_IP_PERIS, 7, 0, 0), diff --git a/queue-3.12/clk-samsung-exynos5250-add-mdma0-clocks.patch b/queue-3.12/clk-samsung-exynos5250-add-mdma0-clocks.patch new file mode 100644 index 00000000000..a597217d9ee --- /dev/null +++ b/queue-3.12/clk-samsung-exynos5250-add-mdma0-clocks.patch @@ -0,0 +1,56 @@ +From 8fb9aeb7a71ef4f3e0613d459a2e1366a7a90469 Mon Sep 17 00:00:00 2001 +From: Abhilash Kesavan +Date: Thu, 12 Dec 2013 08:32:01 +0530 +Subject: clk: samsung: exynos5250: Add MDMA0 clocks + +From: Abhilash Kesavan + +commit 8fb9aeb7a71ef4f3e0613d459a2e1366a7a90469 upstream. + +Adds gate clock for MDMA0 on Exynos5250 SoC. This is needed to ensure +that the clock is enabled when MDMA0 is used on systems on which +firmware gates the clockby default. + +Signed-off-by: Abhilash Kesavan +Acked-by: Mike Turquette +[t.figa: Updated patch description.] +Signed-off-by: Tomasz Figa +Signed-off-by: Greg Kroah-Hartman + +--- + Documentation/devicetree/bindings/clock/exynos5250-clock.txt | 2 ++ + drivers/clk/samsung/clk-exynos5250.c | 5 ++++- + 2 files changed, 6 insertions(+), 1 deletion(-) + +--- a/Documentation/devicetree/bindings/clock/exynos5250-clock.txt ++++ b/Documentation/devicetree/bindings/clock/exynos5250-clock.txt +@@ -159,6 +159,8 @@ clock which they consume. + mixer 343 + hdmi 344 + g2d 345 ++ mdma0 346 ++ smmu_mdma0 347 + + + [Clock Muxes] +--- a/drivers/clk/samsung/clk-exynos5250.c ++++ b/drivers/clk/samsung/clk-exynos5250.c +@@ -120,7 +120,8 @@ enum exynos5250_clks { + spi2, i2s1, i2s2, pcm1, pcm2, pwm, spdif, ac97, hsi2c0, hsi2c1, hsi2c2, + hsi2c3, chipid, sysreg, pmu, cmu_top, cmu_core, cmu_mem, tzpc0, tzpc1, + tzpc2, tzpc3, tzpc4, tzpc5, tzpc6, tzpc7, tzpc8, tzpc9, hdmi_cec, mct, +- wdt, rtc, tmu, fimd1, mie1, dsim0, dp, mixer, hdmi, g2d, ++ wdt, rtc, tmu, fimd1, mie1, dsim0, dp, mixer, hdmi, g2d, mdma0, ++ smmu_mdma0, + + /* mux clocks */ + mout_hdmi = 1024, +@@ -492,6 +493,8 @@ static struct samsung_gate_clock exynos5 + GATE(mixer, "mixer", "mout_aclk200_disp1", GATE_IP_DISP1, 5, 0, 0), + GATE(hdmi, "hdmi", "mout_aclk200_disp1", GATE_IP_DISP1, 6, 0, 0), + GATE(g2d, "g2d", "aclk200", GATE_IP_ACP, 3, 0, 0), ++ GATE(mdma0, "mdma0", "aclk266", GATE_IP_ACP, 1, 0, 0), ++ GATE(smmu_mdma0, "smmu_mdma0", "aclk266", GATE_IP_ACP, 5, 0, 0), + }; + + static struct samsung_pll_rate_table vpll_24mhz_tbl[] __initdata = { diff --git a/queue-3.12/clk-samsung-exynos5250-fix-acp-gate-register-offset.patch b/queue-3.12/clk-samsung-exynos5250-fix-acp-gate-register-offset.patch new file mode 100644 index 00000000000..ef6f13f2922 --- /dev/null +++ b/queue-3.12/clk-samsung-exynos5250-fix-acp-gate-register-offset.patch @@ -0,0 +1,42 @@ +From 3bf34666a0cce5234ac677ed2fbe5cea82c71329 Mon Sep 17 00:00:00 2001 +From: Abhilash Kesavan +Date: Thu, 12 Dec 2013 08:32:00 +0530 +Subject: clk: samsung: exynos5250: Fix ACP gate register offset + +From: Abhilash Kesavan + +commit 3bf34666a0cce5234ac677ed2fbe5cea82c71329 upstream. + +The CLK_GATE_IP_ACP register offset is incorrectly listed making +definition of g2d clock incorrect, which may lead to system failures +when trying to use G2D on systems on which firmware gates this clock +by default. Fix this and the register ordering as well. + +Signed-off-by: Abhilash Kesavan +Acked-by: Mike Turquette +[t.figa: Updated patch description.] +Signed-off-by: Tomasz Figa +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/clk/samsung/clk-exynos5250.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/clk/samsung/clk-exynos5250.c ++++ b/drivers/clk/samsung/clk-exynos5250.c +@@ -25,6 +25,7 @@ + #define MPLL_LOCK 0x4000 + #define MPLL_CON0 0x4100 + #define SRC_CORE1 0x4204 ++#define GATE_IP_ACP 0x8800 + #define CPLL_LOCK 0x10020 + #define EPLL_LOCK 0x10030 + #define VPLL_LOCK 0x10040 +@@ -75,7 +76,6 @@ + #define SRC_CDREX 0x20200 + #define PLL_DIV2_SEL 0x20a24 + #define GATE_IP_DISP1 0x10928 +-#define GATE_IP_ACP 0x10000 + + /* list of PLLs to be registered */ + enum exynos5250_plls { diff --git a/queue-3.12/drm-nouveau-bios-make-jump-conditional.patch b/queue-3.12/drm-nouveau-bios-make-jump-conditional.patch new file mode 100644 index 00000000000..969a1e1e0a6 --- /dev/null +++ b/queue-3.12/drm-nouveau-bios-make-jump-conditional.patch @@ -0,0 +1,41 @@ +From 6d60792ec059d9f2139828f9f017679abb81aa73 Mon Sep 17 00:00:00 2001 +From: Ilia Mirkin +Date: Sun, 5 Jan 2014 20:07:02 -0500 +Subject: drm/nouveau/bios: make jump conditional +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ilia Mirkin + +commit 6d60792ec059d9f2139828f9f017679abb81aa73 upstream. + +This fixes a hang in VBIOS scripts of the form "condition; jump". +The jump used to always be executed, while now it will only be +executed if the condition is true. + +See https://bugs.freedesktop.org/show_bug.cgi?id=72943 + +Reported-by: Darcy Brás da Silva +Signed-off-by: Ilia Mirkin +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/nouveau/core/subdev/bios/init.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/nouveau/core/subdev/bios/init.c ++++ b/drivers/gpu/drm/nouveau/core/subdev/bios/init.c +@@ -1294,7 +1294,11 @@ init_jump(struct nvbios_init *init) + u16 offset = nv_ro16(bios, init->offset + 1); + + trace("JUMP\t0x%04x\n", offset); +- init->offset = offset; ++ ++ if (init_exec(init)) ++ init->offset = offset; ++ else ++ init->offset += 3; + } + + /** diff --git a/queue-3.12/intel_pstate-add-x86_feature_aperfmperf-to-cpu-match-parameters.patch b/queue-3.12/intel_pstate-add-x86_feature_aperfmperf-to-cpu-match-parameters.patch new file mode 100644 index 00000000000..4d2fc85ba47 --- /dev/null +++ b/queue-3.12/intel_pstate-add-x86_feature_aperfmperf-to-cpu-match-parameters.patch @@ -0,0 +1,36 @@ +From 6cbd7ee10e2842a3d1f9b60abede1c8f3d1f1130 Mon Sep 17 00:00:00 2001 +From: Dirk Brandewie +Date: Mon, 6 Jan 2014 10:59:16 -0800 +Subject: intel_pstate: Add X86_FEATURE_APERFMPERF to cpu match parameters. + +From: Dirk Brandewie + +commit 6cbd7ee10e2842a3d1f9b60abede1c8f3d1f1130 upstream. + +KVM environments do not support APERF/MPERF MSRs. intel_pstate cannot +operate without these registers. + +The previous validity checks in intel_pstate_msrs_not_valid() are +insufficent in nested KVMs. + +References: https://bugzilla.redhat.com/show_bug.cgi?id=1046317 +Signed-off-by: Dirk Brandewie +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/cpufreq/intel_pstate.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/cpufreq/intel_pstate.c ++++ b/drivers/cpufreq/intel_pstate.c +@@ -518,7 +518,8 @@ static void intel_pstate_timer_func(unsi + } + + #define ICPU(model, policy) \ +- { X86_VENDOR_INTEL, 6, model, X86_FEATURE_ANY, (unsigned long)&policy } ++ { X86_VENDOR_INTEL, 6, model, X86_FEATURE_APERFMPERF,\ ++ (unsigned long)&policy } + + static const struct x86_cpu_id intel_pstate_cpu_ids[] = { + ICPU(0x2a, default_policy), diff --git a/queue-3.12/leds-lp5521-5523-remove-duplicate-mutex.patch b/queue-3.12/leds-lp5521-5523-remove-duplicate-mutex.patch new file mode 100644 index 00000000000..e8635b1b5ed --- /dev/null +++ b/queue-3.12/leds-lp5521-5523-remove-duplicate-mutex.patch @@ -0,0 +1,112 @@ +From e70988d1aaf73221355e06125c9937bd4b27761c Mon Sep 17 00:00:00 2001 +From: Milo Kim +Date: Mon, 2 Dec 2013 17:21:44 -0800 +Subject: leds: lp5521/5523: Remove duplicate mutex +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Milo Kim + +commit e70988d1aaf73221355e06125c9937bd4b27761c upstream. + +It can be a problem when a pattern is loaded via the firmware interface. +LP55xx common driver has already locked the mutex in 'lp55xx_firmware_loaded()'. +So it should be deleted. + +On the other hand, locks are required in store_engine_load() +on updating program memory. + +Reported-by: Pali Rohár +Reported-by: Pavel Machek +Signed-off-by: Milo Kim +Signed-off-by: Bryan Wu +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/leds/leds-lp5521.c | 12 ++++-------- + drivers/leds/leds-lp5523.c | 12 ++++-------- + 2 files changed, 8 insertions(+), 16 deletions(-) + +--- a/drivers/leds/leds-lp5521.c ++++ b/drivers/leds/leds-lp5521.c +@@ -244,18 +244,12 @@ static int lp5521_update_program_memory( + if (i % 2) + goto err; + +- mutex_lock(&chip->lock); +- + for (i = 0; i < LP5521_PROGRAM_LENGTH; i++) { + ret = lp55xx_write(chip, addr[idx] + i, pattern[i]); +- if (ret) { +- mutex_unlock(&chip->lock); ++ if (ret) + return -EINVAL; +- } + } + +- mutex_unlock(&chip->lock); +- + return size; + + err: +@@ -427,15 +421,17 @@ static ssize_t store_engine_load(struct + { + struct lp55xx_led *led = i2c_get_clientdata(to_i2c_client(dev)); + struct lp55xx_chip *chip = led->chip; ++ int ret; + + mutex_lock(&chip->lock); + + chip->engine_idx = nr; + lp5521_load_engine(chip); ++ ret = lp5521_update_program_memory(chip, buf, len); + + mutex_unlock(&chip->lock); + +- return lp5521_update_program_memory(chip, buf, len); ++ return ret; + } + store_load(1) + store_load(2) +--- a/drivers/leds/leds-lp5523.c ++++ b/drivers/leds/leds-lp5523.c +@@ -336,18 +336,12 @@ static int lp5523_update_program_memory( + if (i % 2) + goto err; + +- mutex_lock(&chip->lock); +- + for (i = 0; i < LP5523_PROGRAM_LENGTH; i++) { + ret = lp55xx_write(chip, LP5523_REG_PROG_MEM + i, pattern[i]); +- if (ret) { +- mutex_unlock(&chip->lock); ++ if (ret) + return -EINVAL; +- } + } + +- mutex_unlock(&chip->lock); +- + return size; + + err: +@@ -547,15 +541,17 @@ static ssize_t store_engine_load(struct + { + struct lp55xx_led *led = i2c_get_clientdata(to_i2c_client(dev)); + struct lp55xx_chip *chip = led->chip; ++ int ret; + + mutex_lock(&chip->lock); + + chip->engine_idx = nr; + lp5523_load_engine_and_select_page(chip); ++ ret = lp5523_update_program_memory(chip, buf, len); + + mutex_unlock(&chip->lock); + +- return lp5523_update_program_memory(chip, buf, len); ++ return ret; + } + store_load(1) + store_load(2) diff --git a/queue-3.12/mac80211-move-bufferable-mmpdu-check-to-fix-ap-mode-scan.patch b/queue-3.12/mac80211-move-bufferable-mmpdu-check-to-fix-ap-mode-scan.patch new file mode 100644 index 00000000000..b136c1576e8 --- /dev/null +++ b/queue-3.12/mac80211-move-bufferable-mmpdu-check-to-fix-ap-mode-scan.patch @@ -0,0 +1,71 @@ +From 277d916fc2e959c3f106904116bb4f7b1148d47a Mon Sep 17 00:00:00 2001 +From: Felix Fietkau +Date: Mon, 16 Dec 2013 21:39:50 +0100 +Subject: mac80211: move "bufferable MMPDU" check to fix AP mode scan + +From: Felix Fietkau + +commit 277d916fc2e959c3f106904116bb4f7b1148d47a upstream. + +The check needs to apply to both multicast and unicast packets, +otherwise probe requests on AP mode scans are sent through the multicast +buffer queue, which adds long delays (often longer than the scanning +interval). + +Signed-off-by: Felix Fietkau +Signed-off-by: Johannes Berg +Signed-off-by: Greg Kroah-Hartman + +--- + net/mac80211/tx.c | 23 +++++++++++++---------- + 1 file changed, 13 insertions(+), 10 deletions(-) + +--- a/net/mac80211/tx.c ++++ b/net/mac80211/tx.c +@@ -463,7 +463,6 @@ ieee80211_tx_h_unicast_ps_buf(struct iee + { + struct sta_info *sta = tx->sta; + struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb); +- struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data; + struct ieee80211_local *local = tx->local; + + if (unlikely(!sta)) +@@ -474,15 +473,6 @@ ieee80211_tx_h_unicast_ps_buf(struct iee + !(info->flags & IEEE80211_TX_CTL_NO_PS_BUFFER))) { + int ac = skb_get_queue_mapping(tx->skb); + +- /* only deauth, disassoc and action are bufferable MMPDUs */ +- if (ieee80211_is_mgmt(hdr->frame_control) && +- !ieee80211_is_deauth(hdr->frame_control) && +- !ieee80211_is_disassoc(hdr->frame_control) && +- !ieee80211_is_action(hdr->frame_control)) { +- info->flags |= IEEE80211_TX_CTL_NO_PS_BUFFER; +- return TX_CONTINUE; +- } +- + ps_dbg(sta->sdata, "STA %pM aid %d: PS buffer for AC %d\n", + sta->sta.addr, sta->sta.aid, ac); + if (tx->local->total_ps_buffered >= TOTAL_MAX_TX_BUFFER) +@@ -525,9 +515,22 @@ ieee80211_tx_h_unicast_ps_buf(struct iee + static ieee80211_tx_result debug_noinline + ieee80211_tx_h_ps_buf(struct ieee80211_tx_data *tx) + { ++ struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb); ++ struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data; ++ + if (unlikely(tx->flags & IEEE80211_TX_PS_BUFFERED)) + return TX_CONTINUE; + ++ /* only deauth, disassoc and action are bufferable MMPDUs */ ++ if (ieee80211_is_mgmt(hdr->frame_control) && ++ !ieee80211_is_deauth(hdr->frame_control) && ++ !ieee80211_is_disassoc(hdr->frame_control) && ++ !ieee80211_is_action(hdr->frame_control)) { ++ if (tx->flags & IEEE80211_TX_UNICAST) ++ info->flags |= IEEE80211_TX_CTL_NO_PS_BUFFER; ++ return TX_CONTINUE; ++ } ++ + if (tx->flags & IEEE80211_TX_UNICAST) + return ieee80211_tx_h_unicast_ps_buf(tx); + else diff --git a/queue-3.12/mfd-rtsx_pcr-disable-interrupts-before-cancelling-delayed-works.patch b/queue-3.12/mfd-rtsx_pcr-disable-interrupts-before-cancelling-delayed-works.patch new file mode 100644 index 00000000000..c7526434076 --- /dev/null +++ b/queue-3.12/mfd-rtsx_pcr-disable-interrupts-before-cancelling-delayed-works.patch @@ -0,0 +1,40 @@ +From 73beb63d290f961c299526852884846b0d868840 Mon Sep 17 00:00:00 2001 +From: Thomas Gleixner +Date: Mon, 2 Dec 2013 12:20:36 +0100 +Subject: mfd: rtsx_pcr: Disable interrupts before cancelling delayed works + +From: Thomas Gleixner + +commit 73beb63d290f961c299526852884846b0d868840 upstream. + +This fixes a kernel panic when resuming from suspend to RAM. +Without this fix an interrupt hits after the delayed work is canceled +and thus requeues it. So we end up freeing an armed timer. + +Signed-off-by: Thomas Gleixner +Signed-off-by: Samuel Ortiz +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mfd/rtsx_pcr.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +--- a/drivers/mfd/rtsx_pcr.c ++++ b/drivers/mfd/rtsx_pcr.c +@@ -1230,8 +1230,14 @@ static void rtsx_pci_remove(struct pci_d + + pcr->remove_pci = true; + +- cancel_delayed_work(&pcr->carddet_work); +- cancel_delayed_work(&pcr->idle_work); ++ /* Disable interrupts at the pcr level */ ++ spin_lock_irq(&pcr->lock); ++ rtsx_pci_writel(pcr, RTSX_BIER, 0); ++ pcr->bier = 0; ++ spin_unlock_irq(&pcr->lock); ++ ++ cancel_delayed_work_sync(&pcr->carddet_work); ++ cancel_delayed_work_sync(&pcr->idle_work); + + mfd_remove_devices(&pcidev->dev); + diff --git a/queue-3.12/netfilter-fix-wrong-byte-order-in-nf_ct_seqadj_set-internal-information.patch b/queue-3.12/netfilter-fix-wrong-byte-order-in-nf_ct_seqadj_set-internal-information.patch new file mode 100644 index 00000000000..65459436c50 --- /dev/null +++ b/queue-3.12/netfilter-fix-wrong-byte-order-in-nf_ct_seqadj_set-internal-information.patch @@ -0,0 +1,38 @@ +From 23dfe136e2bf8d9ea1095704c535368a9bc721da Mon Sep 17 00:00:00 2001 +From: Phil Oester +Date: Sat, 16 Nov 2013 20:37:46 -0800 +Subject: netfilter: fix wrong byte order in nf_ct_seqadj_set internal information + +From: Phil Oester + +commit 23dfe136e2bf8d9ea1095704c535368a9bc721da upstream. + +In commit 41d73ec053d2, sequence number adjustments were moved to a +separate file. Unfortunately, the sequence numbers that are stored +in the nf_ct_seqadj structure are expressed in host byte order. The +necessary ntohl call was removed when the call to adjust_tcp_sequence +was collapsed into nf_ct_seqadj_set. This broke the FTP NAT helper. +Fix it by adding back the byte order conversions. + +Reported-by: Dawid Stawiarski +Signed-off-by: Phil Oester +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Greg Kroah-Hartman + +--- + net/netfilter/nf_conntrack_seqadj.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/net/netfilter/nf_conntrack_seqadj.c ++++ b/net/netfilter/nf_conntrack_seqadj.c +@@ -41,8 +41,8 @@ int nf_ct_seqadj_set(struct nf_conn *ct, + spin_lock_bh(&ct->lock); + this_way = &seqadj->seq[dir]; + if (this_way->offset_before == this_way->offset_after || +- before(this_way->correction_pos, seq)) { +- this_way->correction_pos = seq; ++ before(this_way->correction_pos, ntohl(seq))) { ++ this_way->correction_pos = ntohl(seq); + this_way->offset_before = this_way->offset_after; + this_way->offset_after += off; + } diff --git a/queue-3.12/netfilter-nf_nat-fix-access-to-uninitialized-buffer-in-irc-nat-helper.patch b/queue-3.12/netfilter-nf_nat-fix-access-to-uninitialized-buffer-in-irc-nat-helper.patch new file mode 100644 index 00000000000..71dccbe6a67 --- /dev/null +++ b/queue-3.12/netfilter-nf_nat-fix-access-to-uninitialized-buffer-in-irc-nat-helper.patch @@ -0,0 +1,105 @@ +From 2690d97ade05c5325cbf7c72b94b90d265659886 Mon Sep 17 00:00:00 2001 +From: Daniel Borkmann +Date: Tue, 31 Dec 2013 16:28:39 +0100 +Subject: netfilter: nf_nat: fix access to uninitialized buffer in IRC NAT helper + +From: Daniel Borkmann + +commit 2690d97ade05c5325cbf7c72b94b90d265659886 upstream. + +Commit 5901b6be885e attempted to introduce IPv6 support into +IRC NAT helper. By doing so, the following code seemed to be removed +by accident: + + ip = ntohl(exp->master->tuplehash[IP_CT_DIR_REPLY].tuple.dst.u3.ip); + sprintf(buffer, "%u %u", ip, port); + pr_debug("nf_nat_irc: inserting '%s' == %pI4, port %u\n", buffer, &ip, port); + +This leads to the fact that buffer[] was left uninitialized and +contained some stack value. When we call nf_nat_mangle_tcp_packet(), +we call strlen(buffer) on excatly this uninitialized buffer. If we +are unlucky and the skb has enough tailroom, we overwrite resp. leak +contents with values that sit on our stack into the packet and send +that out to the receiver. + +Since the rather informal DCC spec [1] does not seem to specify +IPv6 support right now, we log such occurences so that admins can +act accordingly, and drop the packet. I've looked into XChat source, +and IPv6 is not supported there: addresses are in u32 and print +via %u format string. + +Therefore, restore old behaviour as in IPv4, use snprintf(). The +IRC helper does not support IPv6 by now. By this, we can safely use +strlen(buffer) in nf_nat_mangle_tcp_packet() and prevent a buffer +overflow. Also simplify some code as we now have ct variable anyway. + + [1] http://www.irchelp.org/irchelp/rfc/ctcpspec.html + +Fixes: 5901b6be885e ("netfilter: nf_nat: support IPv6 in IRC NAT helper") +Signed-off-by: Daniel Borkmann +Cc: Harald Welte +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Greg Kroah-Hartman + +--- + net/netfilter/nf_nat_irc.c | 32 +++++++++++++++++++++++++++----- + 1 file changed, 27 insertions(+), 5 deletions(-) + +--- a/net/netfilter/nf_nat_irc.c ++++ b/net/netfilter/nf_nat_irc.c +@@ -34,10 +34,14 @@ static unsigned int help(struct sk_buff + struct nf_conntrack_expect *exp) + { + char buffer[sizeof("4294967296 65635")]; ++ struct nf_conn *ct = exp->master; ++ union nf_inet_addr newaddr; + u_int16_t port; + unsigned int ret; + + /* Reply comes from server. */ ++ newaddr = ct->tuplehash[IP_CT_DIR_REPLY].tuple.dst.u3; ++ + exp->saved_proto.tcp.port = exp->tuple.dst.u.tcp.port; + exp->dir = IP_CT_DIR_REPLY; + exp->expectfn = nf_nat_follow_master; +@@ -57,17 +61,35 @@ static unsigned int help(struct sk_buff + } + + if (port == 0) { +- nf_ct_helper_log(skb, exp->master, "all ports in use"); ++ nf_ct_helper_log(skb, ct, "all ports in use"); + return NF_DROP; + } + +- ret = nf_nat_mangle_tcp_packet(skb, exp->master, ctinfo, +- protoff, matchoff, matchlen, buffer, +- strlen(buffer)); ++ /* strlen("\1DCC CHAT chat AAAAAAAA P\1\n")=27 ++ * strlen("\1DCC SCHAT chat AAAAAAAA P\1\n")=28 ++ * strlen("\1DCC SEND F AAAAAAAA P S\1\n")=26 ++ * strlen("\1DCC MOVE F AAAAAAAA P S\1\n")=26 ++ * strlen("\1DCC TSEND F AAAAAAAA P S\1\n")=27 ++ * ++ * AAAAAAAAA: bound addr (1.0.0.0==16777216, min 8 digits, ++ * 255.255.255.255==4294967296, 10 digits) ++ * P: bound port (min 1 d, max 5d (65635)) ++ * F: filename (min 1 d ) ++ * S: size (min 1 d ) ++ * 0x01, \n: terminators ++ */ ++ /* AAA = "us", ie. where server normally talks to. */ ++ snprintf(buffer, sizeof(buffer), "%u %u", ntohl(newaddr.ip), port); ++ pr_debug("nf_nat_irc: inserting '%s' == %pI4, port %u\n", ++ buffer, &newaddr.ip, port); ++ ++ ret = nf_nat_mangle_tcp_packet(skb, ct, ctinfo, protoff, matchoff, ++ matchlen, buffer, strlen(buffer)); + if (ret != NF_ACCEPT) { +- nf_ct_helper_log(skb, exp->master, "cannot mangle packet"); ++ nf_ct_helper_log(skb, ct, "cannot mangle packet"); + nf_ct_unexpect_related(exp); + } ++ + return ret; + } + diff --git a/queue-3.12/parisc-ensure-full-cache-coherency-for-kmap-kunmap.patch b/queue-3.12/parisc-ensure-full-cache-coherency-for-kmap-kunmap.patch new file mode 100644 index 00000000000..a210a5fe0e5 --- /dev/null +++ b/queue-3.12/parisc-ensure-full-cache-coherency-for-kmap-kunmap.patch @@ -0,0 +1,151 @@ +From f8dae00684d678afa13041ef170cecfd1297ed40 Mon Sep 17 00:00:00 2001 +From: John David Anglin +Date: Sun, 5 Jan 2014 21:25:00 -0500 +Subject: parisc: Ensure full cache coherency for kmap/kunmap + +From: John David Anglin + +commit f8dae00684d678afa13041ef170cecfd1297ed40 upstream. + +Helge Deller noted a few weeks ago problems with the AIO support on +parisc. This change is the result of numerous iterations on how best to +deal with this problem. + +The solution adopted here is to provide full cache coherency in a +uniform manner on all parisc systems. This involves calling +flush_dcache_page() on kmap operations and flush_kernel_dcache_page() on +kunmap operations. As a result, the copy_user_page() and +clear_user_page() functions can be removed and the overall code is +simpler. + +The change ensures that both userspace and kernel aliases to a mapped +page are invalidated and flushed. This is necessary for the correct +operation of PA8800 and PA8900 based systems which do not support +inequivalent aliases. + +With this change, I have observed no cache related issues on c8000 and +rp3440. It is now possible for example to do kernel builds with "-j64" +on four way systems. + +On systems using XFS file systems, the patch recently posted by Mikulas +Patocka to "fix crash using XFS on loopback" is needed to avoid a hang +caused by an uninitialized lock passed to flush_dcache_page() in the +page struct. + +Signed-off-by: John David Anglin +Signed-off-by: Helge Deller +Signed-off-by: Greg Kroah-Hartman + +--- + arch/parisc/include/asm/cacheflush.h | 12 ++++-------- + arch/parisc/include/asm/page.h | 5 ++--- + arch/parisc/kernel/cache.c | 35 ----------------------------------- + 3 files changed, 6 insertions(+), 46 deletions(-) + +--- a/arch/parisc/include/asm/cacheflush.h ++++ b/arch/parisc/include/asm/cacheflush.h +@@ -125,42 +125,38 @@ flush_anon_page(struct vm_area_struct *v + void mark_rodata_ro(void); + #endif + +-#ifdef CONFIG_PA8X00 +-/* Only pa8800, pa8900 needs this */ +- + #include + + #define ARCH_HAS_KMAP + +-void kunmap_parisc(void *addr); +- + static inline void *kmap(struct page *page) + { + might_sleep(); ++ flush_dcache_page(page); + return page_address(page); + } + + static inline void kunmap(struct page *page) + { +- kunmap_parisc(page_address(page)); ++ flush_kernel_dcache_page_addr(page_address(page)); + } + + static inline void *kmap_atomic(struct page *page) + { + pagefault_disable(); ++ flush_dcache_page(page); + return page_address(page); + } + + static inline void __kunmap_atomic(void *addr) + { +- kunmap_parisc(addr); ++ flush_kernel_dcache_page_addr(addr); + pagefault_enable(); + } + + #define kmap_atomic_prot(page, prot) kmap_atomic(page) + #define kmap_atomic_pfn(pfn) kmap_atomic(pfn_to_page(pfn)) + #define kmap_atomic_to_page(ptr) virt_to_page(ptr) +-#endif + + #endif /* _PARISC_CACHEFLUSH_H */ + +--- a/arch/parisc/include/asm/page.h ++++ b/arch/parisc/include/asm/page.h +@@ -28,9 +28,8 @@ struct page; + + void clear_page_asm(void *page); + void copy_page_asm(void *to, void *from); +-void clear_user_page(void *vto, unsigned long vaddr, struct page *pg); +-void copy_user_page(void *vto, void *vfrom, unsigned long vaddr, +- struct page *pg); ++#define clear_user_page(vto, vaddr, page) clear_page_asm(vto) ++#define copy_user_page(vto, vfrom, vaddr, page) copy_page_asm(vto, vfrom) + + /* #define CONFIG_PARISC_TMPALIAS */ + +--- a/arch/parisc/kernel/cache.c ++++ b/arch/parisc/kernel/cache.c +@@ -388,41 +388,6 @@ void flush_kernel_dcache_page_addr(void + } + EXPORT_SYMBOL(flush_kernel_dcache_page_addr); + +-void clear_user_page(void *vto, unsigned long vaddr, struct page *page) +-{ +- clear_page_asm(vto); +- if (!parisc_requires_coherency()) +- flush_kernel_dcache_page_asm(vto); +-} +-EXPORT_SYMBOL(clear_user_page); +- +-void copy_user_page(void *vto, void *vfrom, unsigned long vaddr, +- struct page *pg) +-{ +- /* Copy using kernel mapping. No coherency is needed +- (all in kmap/kunmap) on machines that don't support +- non-equivalent aliasing. However, the `from' page +- needs to be flushed before it can be accessed through +- the kernel mapping. */ +- preempt_disable(); +- flush_dcache_page_asm(__pa(vfrom), vaddr); +- preempt_enable(); +- copy_page_asm(vto, vfrom); +- if (!parisc_requires_coherency()) +- flush_kernel_dcache_page_asm(vto); +-} +-EXPORT_SYMBOL(copy_user_page); +- +-#ifdef CONFIG_PA8X00 +- +-void kunmap_parisc(void *addr) +-{ +- if (parisc_requires_coherency()) +- flush_kernel_dcache_page_addr(addr); +-} +-EXPORT_SYMBOL(kunmap_parisc); +-#endif +- + void purge_tlb_entries(struct mm_struct *mm, unsigned long addr) + { + unsigned long flags; diff --git a/queue-3.12/scsi-sd-reduce-buffer-size-for-vpd-request.patch b/queue-3.12/scsi-sd-reduce-buffer-size-for-vpd-request.patch new file mode 100644 index 00000000000..a79564be26b --- /dev/null +++ b/queue-3.12/scsi-sd-reduce-buffer-size-for-vpd-request.patch @@ -0,0 +1,50 @@ +From af73623f5f10eb3832c87a169b28f7df040a875b Mon Sep 17 00:00:00 2001 +From: Bernd Schubert +Date: Mon, 23 Sep 2013 14:47:32 +0200 +Subject: SCSI: sd: Reduce buffer size for vpd request + +From: Bernd Schubert + +commit af73623f5f10eb3832c87a169b28f7df040a875b upstream. + +Somehow older areca firmware versions have issues with +scsi_get_vpd_page() and a large buffer, the firmware +seems to crash and the scsi error-handler will start endless +recovery retries. +Limiting the buf-size to 64-bytes fixes this issue with older +firmware versions (<1.49 for my controller). + +Fixes a regression with areca controllers and older firmware versions +introduced by commit: 66c28f97120e8a621afd5aa7a31c4b85c547d33d + +Reported-by: Nix +Tested-by: Nix +Signed-off-by: Bernd Schubert +Acked-by: Martin K. Petersen +Signed-off-by: James Bottomley +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/sd.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/drivers/scsi/sd.c ++++ b/drivers/scsi/sd.c +@@ -2645,13 +2645,16 @@ static void sd_read_write_same(struct sc + } + + if (scsi_report_opcode(sdev, buffer, SD_BUF_SIZE, INQUIRY) < 0) { ++ /* too large values might cause issues with arcmsr */ ++ int vpd_buf_len = 64; ++ + sdev->no_report_opcodes = 1; + + /* Disable WRITE SAME if REPORT SUPPORTED OPERATION + * CODES is unsupported and the device has an ATA + * Information VPD page (SAT). + */ +- if (!scsi_get_vpd_page(sdev, 0x89, buffer, SD_BUF_SIZE)) ++ if (!scsi_get_vpd_page(sdev, 0x89, buffer, vpd_buf_len)) + sdev->no_write_same = 1; + } + diff --git a/queue-3.12/series b/queue-3.12/series index 9cd445a6067..af2d60d42eb 100644 --- a/queue-3.12/series +++ b/queue-3.12/series @@ -48,3 +48,26 @@ sfc-poll-for-mcdi-completion-once-before-timeout-occurs.patch arm-fix-footbridge-clockevent-device.patch arm-fix-bad-mode-in-...-handler-message-for-undefined-instructions.patch arm-7923-1-mm-fix-dcache-flush-logic-for-compound-high-pages.patch +arm-dts-exynos5250-fix-mdma0-clock-number.patch +arm-shmobile-kzm9g-fix-coherent-dma-mask.patch +arm-shmobile-armadillo-fix-coherent-dma-mask.patch +arm-shmobile-mackerel-fix-coherent-dma-mask.patch +drm-nouveau-bios-make-jump-conditional.patch +parisc-ensure-full-cache-coherency-for-kmap-kunmap.patch +ahci-add-pci-id-for-marvell-88se9170-sata-controller.patch +clk-clk-divider-fix-divisor-255-bug.patch +clk-samsung-exynos4-correct-src_mfc-register.patch +clk-samsung-exynos5250-fix-acp-gate-register-offset.patch +clk-samsung-exynos5250-add-mdma0-clocks.patch +clk-samsung-exynos5250-add-clk_ignore_unused-flag-for-the-sysreg-clock.patch +clk-exynos5250-fix-sysmmu_mfc-l-r-gate-clocks.patch +leds-lp5521-5523-remove-duplicate-mutex.patch +mfd-rtsx_pcr-disable-interrupts-before-cancelling-delayed-works.patch +acpi-tpm-fix-memory-leak-when-walking-acpi-namespace.patch +acpi-battery-add-a-_bix-quirk-for-nec-lz750-ls.patch +mac80211-move-bufferable-mmpdu-check-to-fix-ap-mode-scan.patch +intel_pstate-add-x86_feature_aperfmperf-to-cpu-match-parameters.patch +scsi-sd-reduce-buffer-size-for-vpd-request.patch +netfilter-fix-wrong-byte-order-in-nf_ct_seqadj_set-internal-information.patch +netfilter-nf_nat-fix-access-to-uninitialized-buffer-in-irc-nat-helper.patch +x86-fpu-amd-clear-exceptions-in-amd-fxsave-workaround.patch diff --git a/queue-3.12/x86-fpu-amd-clear-exceptions-in-amd-fxsave-workaround.patch b/queue-3.12/x86-fpu-amd-clear-exceptions-in-amd-fxsave-workaround.patch new file mode 100644 index 00000000000..6f9b6993a37 --- /dev/null +++ b/queue-3.12/x86-fpu-amd-clear-exceptions-in-amd-fxsave-workaround.patch @@ -0,0 +1,45 @@ +From 26bef1318adc1b3a530ecc807ef99346db2aa8b0 Mon Sep 17 00:00:00 2001 +From: Linus Torvalds +Date: Sat, 11 Jan 2014 19:15:52 -0800 +Subject: x86, fpu, amd: Clear exceptions in AMD FXSAVE workaround + +From: Linus Torvalds + +commit 26bef1318adc1b3a530ecc807ef99346db2aa8b0 upstream. + +Before we do an EMMS in the AMD FXSAVE information leak workaround we +need to clear any pending exceptions, otherwise we trap with a +floating-point exception inside this code. + +Reported-by: halfdog +Tested-by: Borislav Petkov +Link: http://lkml.kernel.org/r/CA%2B55aFxQnY_PCG_n4=0w-VG=YLXL-yr7oMxyy0WU2gCBAf3ydg@mail.gmail.com +Signed-off-by: H. Peter Anvin +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/include/asm/fpu-internal.h | 13 +++++++------ + 1 file changed, 7 insertions(+), 6 deletions(-) + +--- a/arch/x86/include/asm/fpu-internal.h ++++ b/arch/x86/include/asm/fpu-internal.h +@@ -293,12 +293,13 @@ static inline int restore_fpu_checking(s + /* AMD K7/K8 CPUs don't save/restore FDP/FIP/FOP unless an exception + is pending. Clear the x87 state here by setting it to fixed + values. "m" is a random variable that should be in L1 */ +- alternative_input( +- ASM_NOP8 ASM_NOP2, +- "emms\n\t" /* clear stack tags */ +- "fildl %P[addr]", /* set F?P to defined value */ +- X86_FEATURE_FXSAVE_LEAK, +- [addr] "m" (tsk->thread.fpu.has_fpu)); ++ if (unlikely(static_cpu_has(X86_FEATURE_FXSAVE_LEAK))) { ++ asm volatile( ++ "fnclex\n\t" ++ "emms\n\t" ++ "fildl %P[addr]" /* set F?P to defined value */ ++ : : [addr] "m" (tsk->thread.fpu.has_fpu)); ++ } + + return fpu_restore_checking(&tsk->thread.fpu); + }