From: Greg Kroah-Hartman Date: Mon, 26 Aug 2013 12:45:55 +0000 (-0700) Subject: 3.10-stable patches X-Git-Tag: v3.0.94~5 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=bae9925b122cd5ee1e3501a800400a3d1910b17c;p=thirdparty%2Fkernel%2Fstable-queue.git 3.10-stable patches added patches: arm64-perf-fix-array-out-of-bounds-access-in-armpmu_map_hw_event.patch arm64-perf-fix-event-validation-for-software-group-leaders.patch arm-7816-1-config_kuser_helpers-fix-help-text.patch arm-at91-dt-fix-at91sam9n12ek-memory-node.patch arm-davinci-nand-specify-ecc-strength.patch drivers-platform-olpc-olpc-ec.c-initialise-earlier.patch drm-i915-invalidate-tlbs-for-the-rings-after-a-reset.patch drm-radeon-fix-uvd-message-buffer-validation.patch drm-radeon-fix-wreg32_or-macro-setting-bits-in-a-register.patch drm-radeon-r7xx-fix-copy-paste-typo-in-golden-register-setup.patch nilfs2-fix-issue-with-counting-number-of-bio-requests-for-bio_eopnotsupp-error-detection.patch nilfs2-remove-double-bio_put-in-nilfs_end_bio_write-for-bio_eopnotsupp-error.patch of-fdt-fix-memory-initialization-for-expanded-dt.patch staging-comedi-bug-fix-null-pointer-dereference-on-failed-attach.patch usb-phy-fix-build-breakage.patch vfs-collect_mounts-should-return-an-err_ptr.patch x86-don-t-clear-olpc_ofw_header-when-sentinel-is-detected.patch xen-events-initialize-local-per-cpu-mask-for-all-possible-events.patch xen-events-mask-events-when-changing-their-vcpu-binding.patch zd1201-do-not-use-stack-as-urb-transfer_buffer.patch --- diff --git a/queue-3.10/arm-7816-1-config_kuser_helpers-fix-help-text.patch b/queue-3.10/arm-7816-1-config_kuser_helpers-fix-help-text.patch new file mode 100644 index 00000000000..a88a59685c2 --- /dev/null +++ b/queue-3.10/arm-7816-1-config_kuser_helpers-fix-help-text.patch @@ -0,0 +1,47 @@ +From ac124504ecf6b20a2457d873d0728a8b991a5b0c Mon Sep 17 00:00:00 2001 +From: Nicolas Pitre +Date: Wed, 14 Aug 2013 22:36:32 +0100 +Subject: ARM: 7816/1: CONFIG_KUSER_HELPERS: fix help text + +From: Nicolas Pitre + +commit ac124504ecf6b20a2457d873d0728a8b991a5b0c upstream. + +Commit f6f91b0d9fd9 ("ARM: allow kuser helpers to be removed from the +vector page") introduced some help text for the CONFIG_KUSER_HELPERS +option which is rather contradictory. + +Let's fix that, and improve it a little. + +Signed-off-by: Nicolas Pitre +Signed-off-by: Russell King +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/mm/Kconfig | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +--- a/arch/arm/mm/Kconfig ++++ b/arch/arm/mm/Kconfig +@@ -789,15 +789,18 @@ config KUSER_HELPERS + the CPU type fitted to the system. This permits binaries to be + run on ARMv4 through to ARMv7 without modification. + ++ See Documentation/arm/kernel_user_helpers.txt for details. ++ + However, the fixed address nature of these helpers can be used + by ROP (return orientated programming) authors when creating + exploits. + + If all of the binaries and libraries which run on your platform + are built specifically for your platform, and make no use of +- these helpers, then you can turn this option off. However, +- when such an binary or library is run, it will receive a SIGILL +- signal, which will terminate the program. ++ these helpers, then you can turn this option off to hinder ++ such exploits. However, in that case, if a binary or library ++ relying on those helpers is run, it will receive a SIGILL signal, ++ which will terminate the program. + + Say N here only if you are absolutely certain that you do not + need these helpers; otherwise, the safe option is to say Y. diff --git a/queue-3.10/arm-at91-dt-fix-at91sam9n12ek-memory-node.patch b/queue-3.10/arm-at91-dt-fix-at91sam9n12ek-memory-node.patch new file mode 100644 index 00000000000..65dd8f7bd1e --- /dev/null +++ b/queue-3.10/arm-at91-dt-fix-at91sam9n12ek-memory-node.patch @@ -0,0 +1,32 @@ +From a57603ca2871ee0773b00839c1ea35c4a2d3eeb0 Mon Sep 17 00:00:00 2001 +From: Nicolas Ferre +Date: Fri, 28 Jun 2013 10:39:15 +0200 +Subject: ARM: at91/DT: fix at91sam9n12ek memory node + +From: Nicolas Ferre + +commit a57603ca2871ee0773b00839c1ea35c4a2d3eeb0 upstream. + +Signed-off-by: Nicolas Ferre +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/boot/dts/at91sam9n12ek.dts | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/arm/boot/dts/at91sam9n12ek.dts ++++ b/arch/arm/boot/dts/at91sam9n12ek.dts +@@ -14,11 +14,11 @@ + compatible = "atmel,at91sam9n12ek", "atmel,at91sam9n12", "atmel,at91sam9"; + + chosen { +- bootargs = "mem=128M console=ttyS0,115200 root=/dev/mtdblock1 rw rootfstype=jffs2"; ++ bootargs = "console=ttyS0,115200 root=/dev/mtdblock1 rw rootfstype=jffs2"; + }; + + memory { +- reg = <0x20000000 0x10000000>; ++ reg = <0x20000000 0x8000000>; + }; + + clocks { diff --git a/queue-3.10/arm-davinci-nand-specify-ecc-strength.patch b/queue-3.10/arm-davinci-nand-specify-ecc-strength.patch new file mode 100644 index 00000000000..723e4e29622 --- /dev/null +++ b/queue-3.10/arm-davinci-nand-specify-ecc-strength.patch @@ -0,0 +1,73 @@ +From acd36357edc08649e85ff15dc4ed62353c912eff Mon Sep 17 00:00:00 2001 +From: Sekhar Nori +Date: Fri, 16 Aug 2013 14:43:48 +0530 +Subject: ARM: davinci: nand: specify ecc strength + +From: Sekhar Nori + +commit acd36357edc08649e85ff15dc4ed62353c912eff upstream. + +Starting with kernel v3.5, it is mandatory +to specify ECC strength when using hardware +ECC. Without this, kernel panics with a warning +of the sort: + +Driver must set ecc.strength when using hardware ECC +------------[ cut here ]------------ +kernel BUG at drivers/mtd/nand/nand_base.c:3519! + +Fix this by specifying ECC strength for the boards +which were missing this. + +Reported-by: Holger Freyther +Signed-off-by: Sekhar Nori +Signed-off-by: Kevin Hilman +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/mach-davinci/board-dm355-leopard.c | 1 + + arch/arm/mach-davinci/board-dm644x-evm.c | 1 + + arch/arm/mach-davinci/board-dm646x-evm.c | 1 + + arch/arm/mach-davinci/board-neuros-osd2.c | 1 + + 4 files changed, 4 insertions(+) + +--- a/arch/arm/mach-davinci/board-dm355-leopard.c ++++ b/arch/arm/mach-davinci/board-dm355-leopard.c +@@ -75,6 +75,7 @@ static struct davinci_nand_pdata davinci + .parts = davinci_nand_partitions, + .nr_parts = ARRAY_SIZE(davinci_nand_partitions), + .ecc_mode = NAND_ECC_HW_SYNDROME, ++ .ecc_bits = 4, + .bbt_options = NAND_BBT_USE_FLASH, + }; + +--- a/arch/arm/mach-davinci/board-dm644x-evm.c ++++ b/arch/arm/mach-davinci/board-dm644x-evm.c +@@ -153,6 +153,7 @@ static struct davinci_nand_pdata davinci + .parts = davinci_evm_nandflash_partition, + .nr_parts = ARRAY_SIZE(davinci_evm_nandflash_partition), + .ecc_mode = NAND_ECC_HW, ++ .ecc_bits = 1, + .bbt_options = NAND_BBT_USE_FLASH, + .timing = &davinci_evm_nandflash_timing, + }; +--- a/arch/arm/mach-davinci/board-dm646x-evm.c ++++ b/arch/arm/mach-davinci/board-dm646x-evm.c +@@ -90,6 +90,7 @@ static struct davinci_nand_pdata davinci + .parts = davinci_nand_partitions, + .nr_parts = ARRAY_SIZE(davinci_nand_partitions), + .ecc_mode = NAND_ECC_HW, ++ .ecc_bits = 1, + .options = 0, + }; + +--- a/arch/arm/mach-davinci/board-neuros-osd2.c ++++ b/arch/arm/mach-davinci/board-neuros-osd2.c +@@ -88,6 +88,7 @@ static struct davinci_nand_pdata davinci + .parts = davinci_ntosd2_nandflash_partition, + .nr_parts = ARRAY_SIZE(davinci_ntosd2_nandflash_partition), + .ecc_mode = NAND_ECC_HW, ++ .ecc_bits = 1, + .bbt_options = NAND_BBT_USE_FLASH, + }; + diff --git a/queue-3.10/arm64-perf-fix-array-out-of-bounds-access-in-armpmu_map_hw_event.patch b/queue-3.10/arm64-perf-fix-array-out-of-bounds-access-in-armpmu_map_hw_event.patch new file mode 100644 index 00000000000..2b46cc38da5 --- /dev/null +++ b/queue-3.10/arm64-perf-fix-array-out-of-bounds-access-in-armpmu_map_hw_event.patch @@ -0,0 +1,37 @@ +From 868f6fea8fa63f09acbfa93256d0d2abdcabff79 Mon Sep 17 00:00:00 2001 +From: Will Deacon +Date: Tue, 20 Aug 2013 11:47:39 +0100 +Subject: arm64: perf: fix array out of bounds access in armpmu_map_hw_event() + +From: Will Deacon + +commit 868f6fea8fa63f09acbfa93256d0d2abdcabff79 upstream. + +This is a port of d9f966357b14 ("ARM: 7810/1: perf: Fix array out of +bounds access in armpmu_map_hw_event()") to arm64, which fixes an oops +in the arm64 perf backend found as a result of Vince's fuzzing tool. + +Signed-off-by: Will Deacon +Signed-off-by: Catalin Marinas +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm64/kernel/perf_event.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/arch/arm64/kernel/perf_event.c ++++ b/arch/arm64/kernel/perf_event.c +@@ -107,7 +107,12 @@ armpmu_map_cache_event(const unsigned (* + static int + armpmu_map_event(const unsigned (*event_map)[PERF_COUNT_HW_MAX], u64 config) + { +- int mapping = (*event_map)[config]; ++ int mapping; ++ ++ if (config >= PERF_COUNT_HW_MAX) ++ return -EINVAL; ++ ++ mapping = (*event_map)[config]; + return mapping == HW_OP_UNSUPPORTED ? -ENOENT : mapping; + } + diff --git a/queue-3.10/arm64-perf-fix-event-validation-for-software-group-leaders.patch b/queue-3.10/arm64-perf-fix-event-validation-for-software-group-leaders.patch new file mode 100644 index 00000000000..407bd91b011 --- /dev/null +++ b/queue-3.10/arm64-perf-fix-event-validation-for-software-group-leaders.patch @@ -0,0 +1,33 @@ +From ee7538a008a45050c8f706d38b600f55953169f9 Mon Sep 17 00:00:00 2001 +From: Will Deacon +Date: Tue, 20 Aug 2013 11:47:40 +0100 +Subject: arm64: perf: fix event validation for software group leaders + +From: Will Deacon + +commit ee7538a008a45050c8f706d38b600f55953169f9 upstream. + +This is a port of c95eb3184ea1 ("ARM: 7809/1: perf: fix event validation +for software group leaders") to arm64, which fixes a panic in the arm64 +perf backend found as a result of Vince's fuzzing tool. + +Signed-off-by: Will Deacon +Signed-off-by: Catalin Marinas +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm64/kernel/perf_event.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/arch/arm64/kernel/perf_event.c ++++ b/arch/arm64/kernel/perf_event.c +@@ -322,6 +322,9 @@ validate_event(struct pmu_hw_events *hw_ + struct hw_perf_event fake_event = event->hw; + struct pmu *leader_pmu = event->group_leader->pmu; + ++ if (is_software_event(event)) ++ return 1; ++ + if (event->pmu != leader_pmu || event->state <= PERF_EVENT_STATE_OFF) + return 1; + diff --git a/queue-3.10/drivers-platform-olpc-olpc-ec.c-initialise-earlier.patch b/queue-3.10/drivers-platform-olpc-olpc-ec.c-initialise-earlier.patch new file mode 100644 index 00000000000..741a321e3b2 --- /dev/null +++ b/queue-3.10/drivers-platform-olpc-olpc-ec.c-initialise-earlier.patch @@ -0,0 +1,48 @@ +From 93dbc1b3b506e16c1f6d5b5dcfe756a85cb1dc58 Mon Sep 17 00:00:00 2001 +From: Daniel Drake +Date: Thu, 22 Aug 2013 16:35:43 -0700 +Subject: drivers/platform/olpc/olpc-ec.c: initialise earlier + +From: Daniel Drake + +commit 93dbc1b3b506e16c1f6d5b5dcfe756a85cb1dc58 upstream. + +Being a low-level component, various drivers (e.g. olpc-battery) assume +that it is ok to communicate with the OLPC Embedded Controller during +probe. Therefore the OLPC EC driver must be initialised before other +drivers try to use it. This was the case until it was recently moved +out of arch/x86 and restructured around commits ac2504151f5a ("Platform: +OLPC: turn EC driver into a platform_driver") and 85f90cf6ca56 ("x86: +OLPC: switch over to using new EC driver on x86"). + +Use arch_initcall so that olpc-ec is readied earlier, matching the +previous behaviour. + +Fixes a regression introduced in Linux-3.6 where various drivers such as +olpc-battery and olpc-xo1-sci failed to load due to an inability to +communicate with the EC. The user-visible effect was a lack of battery +monitoring, missing ebook/lid switch input devices, etc. + +Signed-off-by: Daniel Drake +Cc: Andres Salomon +Cc: Paul Fox +Cc: Thomas Gleixner +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/platform/olpc/olpc-ec.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/platform/olpc/olpc-ec.c ++++ b/drivers/platform/olpc/olpc-ec.c +@@ -330,7 +330,7 @@ static int __init olpc_ec_init_module(vo + return platform_driver_register(&olpc_ec_plat_driver); + } + +-module_init(olpc_ec_init_module); ++arch_initcall(olpc_ec_init_module); + + MODULE_AUTHOR("Andres Salomon "); + MODULE_LICENSE("GPL"); diff --git a/queue-3.10/drm-i915-invalidate-tlbs-for-the-rings-after-a-reset.patch b/queue-3.10/drm-i915-invalidate-tlbs-for-the-rings-after-a-reset.patch new file mode 100644 index 00000000000..5ccfc4af984 --- /dev/null +++ b/queue-3.10/drm-i915-invalidate-tlbs-for-the-rings-after-a-reset.patch @@ -0,0 +1,65 @@ +From 884020bf3d2a3787a1cc6df902e98e0eec60330b Mon Sep 17 00:00:00 2001 +From: Chris Wilson +Date: Tue, 6 Aug 2013 19:01:14 +0100 +Subject: drm/i915: Invalidate TLBs for the rings after a reset + +From: Chris Wilson + +commit 884020bf3d2a3787a1cc6df902e98e0eec60330b upstream. + +After any "soft gfx reset" we must manually invalidate the TLBs +associated with each ring. Empirically, it seems that a +suspend/resume or D3-D0 cycle count as a "soft reset". The symptom is +that the hardware would fail to note the new address for its status +page, and so it would continue to write the shadow registers and +breadcrumbs into the old physical address (now used by something +completely different, scary). Whereas the driver would read the new +status page and never see any progress, it would appear that the GPU +hung immediately upon resume. + +Based on a patch by naresh kumar kachhi + +Reported-by: Thiago Macieira +Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=64725 +Signed-off-by: Chris Wilson +Tested-by: Thiago Macieira +Signed-off-by: Daniel Vetter +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/i915_reg.h | 2 ++ + drivers/gpu/drm/i915/intel_ringbuffer.c | 12 ++++++++++++ + 2 files changed, 14 insertions(+) + +--- a/drivers/gpu/drm/i915/i915_reg.h ++++ b/drivers/gpu/drm/i915/i915_reg.h +@@ -617,6 +617,8 @@ + will not assert AGPBUSY# and will only + be delivered when out of C3. */ + #define INSTPM_FORCE_ORDERING (1<<7) /* GEN6+ */ ++#define INSTPM_TLB_INVALIDATE (1<<9) ++#define INSTPM_SYNC_FLUSH (1<<5) + #define ACTHD 0x020c8 + #define FW_BLC 0x020d8 + #define FW_BLC2 0x020dc +--- a/drivers/gpu/drm/i915/intel_ringbuffer.c ++++ b/drivers/gpu/drm/i915/intel_ringbuffer.c +@@ -907,6 +907,18 @@ void intel_ring_setup_status_page(struct + + I915_WRITE(mmio, (u32)ring->status_page.gfx_addr); + POSTING_READ(mmio); ++ ++ /* Flush the TLB for this page */ ++ if (INTEL_INFO(dev)->gen >= 6) { ++ u32 reg = RING_INSTPM(ring->mmio_base); ++ I915_WRITE(reg, ++ _MASKED_BIT_ENABLE(INSTPM_TLB_INVALIDATE | ++ INSTPM_SYNC_FLUSH)); ++ if (wait_for((I915_READ(reg) & INSTPM_SYNC_FLUSH) == 0, ++ 1000)) ++ DRM_ERROR("%s: wait for SyncFlush to complete for TLB invalidation timed out\n", ++ ring->name); ++ } + } + + static int diff --git a/queue-3.10/drm-radeon-fix-uvd-message-buffer-validation.patch b/queue-3.10/drm-radeon-fix-uvd-message-buffer-validation.patch new file mode 100644 index 00000000000..c47bb4a58b5 --- /dev/null +++ b/queue-3.10/drm-radeon-fix-uvd-message-buffer-validation.patch @@ -0,0 +1,36 @@ +From 112a6d0c071808f6d48354fc8834a574e5dcefc0 Mon Sep 17 00:00:00 2001 +From: Christian König +Date: Sun, 11 Aug 2013 21:27:56 +0200 +Subject: drm/radeon: fix UVD message buffer validation + +From: Christian König + +commit 112a6d0c071808f6d48354fc8834a574e5dcefc0 upstream. + +When the message buffer is currently moving block until it is idle again. + +Signed-off-by: Christian König +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/radeon/radeon_uvd.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/drivers/gpu/drm/radeon/radeon_uvd.c ++++ b/drivers/gpu/drm/radeon/radeon_uvd.c +@@ -359,6 +359,14 @@ static int radeon_uvd_cs_msg(struct rade + return -EINVAL; + } + ++ if (bo->tbo.sync_obj) { ++ r = radeon_fence_wait(bo->tbo.sync_obj, false); ++ if (r) { ++ DRM_ERROR("Failed waiting for UVD message (%d)!\n", r); ++ return r; ++ } ++ } ++ + r = radeon_bo_kmap(bo, &ptr); + if (r) + return r; diff --git a/queue-3.10/drm-radeon-fix-wreg32_or-macro-setting-bits-in-a-register.patch b/queue-3.10/drm-radeon-fix-wreg32_or-macro-setting-bits-in-a-register.patch new file mode 100644 index 00000000000..8370a8e8c14 --- /dev/null +++ b/queue-3.10/drm-radeon-fix-wreg32_or-macro-setting-bits-in-a-register.patch @@ -0,0 +1,39 @@ +From d43a93c8d9bc4e0dc0293b6458c077c3c797594f Mon Sep 17 00:00:00 2001 +From: Rafał Miłecki +Date: Thu, 15 Aug 2013 18:55:22 +0200 +Subject: drm/radeon: fix WREG32_OR macro setting bits in a register + +From: Rafał Miłecki + +commit d43a93c8d9bc4e0dc0293b6458c077c3c797594f upstream. + +This bug (introduced in 3.10) in WREG32_OR made +commit d3418eacad403033e95e49dc14afa37c2112c134 +"drm/radeon/evergreen: setup HDMI before enabling it" +cause a regression. Sometimes audio over HDMI wasn't working, sometimes +display was corrupted. + +This fixes: +https://bugzilla.kernel.org/show_bug.cgi?id=60687 +https://bugzilla.kernel.org/show_bug.cgi?id=60709 +https://bugs.freedesktop.org/show_bug.cgi?id=67767 + +Signed-off-by: Rafał Miłecki +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/radeon/radeon.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/radeon/radeon.h ++++ b/drivers/gpu/drm/radeon/radeon.h +@@ -1764,7 +1764,7 @@ void r100_io_wreg(struct radeon_device * + WREG32(reg, tmp_); \ + } while (0) + #define WREG32_AND(reg, and) WREG32_P(reg, 0, and) +-#define WREG32_OR(reg, or) WREG32_P(reg, or, ~or) ++#define WREG32_OR(reg, or) WREG32_P(reg, or, ~(or)) + #define WREG32_PLL_P(reg, val, mask) \ + do { \ + uint32_t tmp_ = RREG32_PLL(reg); \ diff --git a/queue-3.10/drm-radeon-r7xx-fix-copy-paste-typo-in-golden-register-setup.patch b/queue-3.10/drm-radeon-r7xx-fix-copy-paste-typo-in-golden-register-setup.patch new file mode 100644 index 00000000000..af1468392fa --- /dev/null +++ b/queue-3.10/drm-radeon-r7xx-fix-copy-paste-typo-in-golden-register-setup.patch @@ -0,0 +1,60 @@ +From 022374c02e357ac82e98dd2689fb2efe05723d69 Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Tue, 13 Aug 2013 15:57:32 -0400 +Subject: drm/radeon/r7xx: fix copy paste typo in golden register setup + +From: Alex Deucher + +commit 022374c02e357ac82e98dd2689fb2efe05723d69 upstream. + +Uses the wrong array size for some asics which can lead +to garbage getting written to registers. + +Fixes: +https://bugzilla.kernel.org/show_bug.cgi?id=60674 + +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/radeon/rv770.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +--- a/drivers/gpu/drm/radeon/rv770.c ++++ b/drivers/gpu/drm/radeon/rv770.c +@@ -744,10 +744,10 @@ static void rv770_init_golden_registers( + (const u32)ARRAY_SIZE(r7xx_golden_dyn_gpr_registers)); + radeon_program_register_sequence(rdev, + rv730_golden_registers, +- (const u32)ARRAY_SIZE(rv770_golden_registers)); ++ (const u32)ARRAY_SIZE(rv730_golden_registers)); + radeon_program_register_sequence(rdev, + rv730_mgcg_init, +- (const u32)ARRAY_SIZE(rv770_mgcg_init)); ++ (const u32)ARRAY_SIZE(rv730_mgcg_init)); + break; + case CHIP_RV710: + radeon_program_register_sequence(rdev, +@@ -758,18 +758,18 @@ static void rv770_init_golden_registers( + (const u32)ARRAY_SIZE(r7xx_golden_dyn_gpr_registers)); + radeon_program_register_sequence(rdev, + rv710_golden_registers, +- (const u32)ARRAY_SIZE(rv770_golden_registers)); ++ (const u32)ARRAY_SIZE(rv710_golden_registers)); + radeon_program_register_sequence(rdev, + rv710_mgcg_init, +- (const u32)ARRAY_SIZE(rv770_mgcg_init)); ++ (const u32)ARRAY_SIZE(rv710_mgcg_init)); + break; + case CHIP_RV740: + radeon_program_register_sequence(rdev, + rv740_golden_registers, +- (const u32)ARRAY_SIZE(rv770_golden_registers)); ++ (const u32)ARRAY_SIZE(rv740_golden_registers)); + radeon_program_register_sequence(rdev, + rv740_mgcg_init, +- (const u32)ARRAY_SIZE(rv770_mgcg_init)); ++ (const u32)ARRAY_SIZE(rv740_mgcg_init)); + break; + default: + break; diff --git a/queue-3.10/nilfs2-fix-issue-with-counting-number-of-bio-requests-for-bio_eopnotsupp-error-detection.patch b/queue-3.10/nilfs2-fix-issue-with-counting-number-of-bio-requests-for-bio_eopnotsupp-error-detection.patch new file mode 100644 index 00000000000..c199e876b72 --- /dev/null +++ b/queue-3.10/nilfs2-fix-issue-with-counting-number-of-bio-requests-for-bio_eopnotsupp-error-detection.patch @@ -0,0 +1,53 @@ +From 4bf93b50fd04118ac7f33a3c2b8a0a1f9fa80bc9 Mon Sep 17 00:00:00 2001 +From: Vyacheslav Dubeyko +Date: Thu, 22 Aug 2013 16:35:45 -0700 +Subject: nilfs2: fix issue with counting number of bio requests for BIO_EOPNOTSUPP error detection + +From: Vyacheslav Dubeyko + +commit 4bf93b50fd04118ac7f33a3c2b8a0a1f9fa80bc9 upstream. + +Fix the issue with improper counting number of flying bio requests for +BIO_EOPNOTSUPP error detection case. + +The sb_nbio must be incremented exactly the same number of times as +complete() function was called (or will be called) because +nilfs_segbuf_wait() will call wail_for_completion() for the number of +times set to sb_nbio: + + do { + wait_for_completion(&segbuf->sb_bio_event); + } while (--segbuf->sb_nbio > 0); + +Two functions complete() and wait_for_completion() must be called the +same number of times for the same sb_bio_event. Otherwise, +wait_for_completion() will hang or leak. + +Signed-off-by: Vyacheslav Dubeyko +Cc: Dan Carpenter +Acked-by: Ryusuke Konishi +Tested-by: Ryusuke Konishi +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + fs/nilfs2/segbuf.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/nilfs2/segbuf.c ++++ b/fs/nilfs2/segbuf.c +@@ -376,12 +376,12 @@ static int nilfs_segbuf_submit_bio(struc + bio->bi_private = segbuf; + bio_get(bio); + submit_bio(mode, bio); ++ segbuf->sb_nbio++; + if (bio_flagged(bio, BIO_EOPNOTSUPP)) { + bio_put(bio); + err = -EOPNOTSUPP; + goto failed; + } +- segbuf->sb_nbio++; + bio_put(bio); + + wi->bio = NULL; diff --git a/queue-3.10/nilfs2-remove-double-bio_put-in-nilfs_end_bio_write-for-bio_eopnotsupp-error.patch b/queue-3.10/nilfs2-remove-double-bio_put-in-nilfs_end_bio_write-for-bio_eopnotsupp-error.patch new file mode 100644 index 00000000000..059afa47ac5 --- /dev/null +++ b/queue-3.10/nilfs2-remove-double-bio_put-in-nilfs_end_bio_write-for-bio_eopnotsupp-error.patch @@ -0,0 +1,37 @@ +From 2df37a19c686c2d7c4e9b4ce1505b5141e3e5552 Mon Sep 17 00:00:00 2001 +From: Vyacheslav Dubeyko +Date: Thu, 22 Aug 2013 16:35:44 -0700 +Subject: nilfs2: remove double bio_put() in nilfs_end_bio_write() for BIO_EOPNOTSUPP error + +From: Vyacheslav Dubeyko + +commit 2df37a19c686c2d7c4e9b4ce1505b5141e3e5552 upstream. + +Remove double call of bio_put() in nilfs_end_bio_write() for the case of +BIO_EOPNOTSUPP error detection. The issue was found by Dan Carpenter +and he suggests first version of the fix too. + +Signed-off-by: Vyacheslav Dubeyko +Reported-by: Dan Carpenter +Acked-by: Ryusuke Konishi +Tested-by: Ryusuke Konishi +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + fs/nilfs2/segbuf.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/fs/nilfs2/segbuf.c ++++ b/fs/nilfs2/segbuf.c +@@ -345,8 +345,7 @@ static void nilfs_end_bio_write(struct b + + if (err == -EOPNOTSUPP) { + set_bit(BIO_EOPNOTSUPP, &bio->bi_flags); +- bio_put(bio); +- /* to be detected by submit_seg_bio() */ ++ /* to be detected by nilfs_segbuf_submit_bio() */ + } + + if (!uptodate) diff --git a/queue-3.10/of-fdt-fix-memory-initialization-for-expanded-dt.patch b/queue-3.10/of-fdt-fix-memory-initialization-for-expanded-dt.patch new file mode 100644 index 00000000000..79ee982d552 --- /dev/null +++ b/queue-3.10/of-fdt-fix-memory-initialization-for-expanded-dt.patch @@ -0,0 +1,52 @@ +From 9e40127526e857fa3f29d51e83277204fbdfc6ba Mon Sep 17 00:00:00 2001 +From: Wladislav Wiebe +Date: Mon, 12 Aug 2013 13:06:53 +0200 +Subject: of: fdt: fix memory initialization for expanded DT + +From: Wladislav Wiebe + +commit 9e40127526e857fa3f29d51e83277204fbdfc6ba upstream. + +Already existing property flags are filled wrong for properties created from +initial FDT. This could cause problems if this DYNAMIC device-tree functions +are used later, i.e. properties are attached/detached/replaced. Simply dumping +flags from the running system show, that some initial static (not allocated via +kzmalloc()) nodes are marked as dynamic. + +I putted some debug extensions to property_proc_show(..) : +.. ++ if (OF_IS_DYNAMIC(pp)) ++ pr_err("DEBUG: xxx : OF_IS_DYNAMIC\n"); ++ if (OF_IS_DETACHED(pp)) ++ pr_err("DEBUG: xxx : OF_IS_DETACHED\n"); + +when you operate on the nodes (e.g.: ~$ cat /proc/device-tree/*some_node*) you +will see that those flags are filled wrong, basically in most cases it will dump +a DYNAMIC or DETACHED status, which is in not true. +(BTW. this OF_IS_DETACHED is a own define for debug purposes which which just +make a test_bit(OF_DETACHED, &x->_flags) + +If nodes are dynamic kernel is allowed to kfree() them. But it will crash +attempting to do so on the nodes from FDT -- they are not allocated via +kzmalloc(). + +Signed-off-by: Wladislav Wiebe +Acked-by: Alexander Sverdlin +Signed-off-by: Rob Herring +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/of/fdt.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/of/fdt.c ++++ b/drivers/of/fdt.c +@@ -392,6 +392,8 @@ static void __unflatten_device_tree(stru + mem = (unsigned long) + dt_alloc(size + 4, __alignof__(struct device_node)); + ++ memset((void *)mem, 0, size); ++ + ((__be32 *)mem)[size / 4] = cpu_to_be32(0xdeadbeef); + + pr_debug(" unflattening %lx...\n", mem); diff --git a/queue-3.10/series b/queue-3.10/series index 26e55e93917..bf5b3420ace 100644 --- a/queue-3.10/series +++ b/queue-3.10/series @@ -35,3 +35,23 @@ tracing-uprobes-fail-to-unregister-if-probe-event-files-are-in-use.patch ftrace-check-module-functions-being-traced-on-reload.patch xen-smp-initialize-ipi-vectors-before-marking-cpu-online.patch arc-strchr-breakage-in-big-endian-configuration.patch +zd1201-do-not-use-stack-as-urb-transfer_buffer.patch +vfs-collect_mounts-should-return-an-err_ptr.patch +x86-don-t-clear-olpc_ofw_header-when-sentinel-is-detected.patch +xen-events-initialize-local-per-cpu-mask-for-all-possible-events.patch +xen-events-mask-events-when-changing-their-vcpu-binding.patch +arm-davinci-nand-specify-ecc-strength.patch +arm-at91-dt-fix-at91sam9n12ek-memory-node.patch +arm64-perf-fix-array-out-of-bounds-access-in-armpmu_map_hw_event.patch +arm64-perf-fix-event-validation-for-software-group-leaders.patch +arm-7816-1-config_kuser_helpers-fix-help-text.patch +staging-comedi-bug-fix-null-pointer-dereference-on-failed-attach.patch +drm-radeon-r7xx-fix-copy-paste-typo-in-golden-register-setup.patch +drm-radeon-fix-uvd-message-buffer-validation.patch +drm-radeon-fix-wreg32_or-macro-setting-bits-in-a-register.patch +drm-i915-invalidate-tlbs-for-the-rings-after-a-reset.patch +of-fdt-fix-memory-initialization-for-expanded-dt.patch +nilfs2-remove-double-bio_put-in-nilfs_end_bio_write-for-bio_eopnotsupp-error.patch +nilfs2-fix-issue-with-counting-number-of-bio-requests-for-bio_eopnotsupp-error-detection.patch +drivers-platform-olpc-olpc-ec.c-initialise-earlier.patch +usb-phy-fix-build-breakage.patch diff --git a/queue-3.10/staging-comedi-bug-fix-null-pointer-dereference-on-failed-attach.patch b/queue-3.10/staging-comedi-bug-fix-null-pointer-dereference-on-failed-attach.patch new file mode 100644 index 00000000000..1f45b3aca83 --- /dev/null +++ b/queue-3.10/staging-comedi-bug-fix-null-pointer-dereference-on-failed-attach.patch @@ -0,0 +1,35 @@ +From 3955dfa8216f712bc204a5ad2f4e51efff252fde Mon Sep 17 00:00:00 2001 +From: Ian Abbott +Date: Fri, 23 Aug 2013 12:37:17 +0100 +Subject: staging: comedi: bug-fix NULL pointer dereference on failed attach + +From: Ian Abbott + +commit 3955dfa8216f712bc204a5ad2f4e51efff252fde upstream. + +Commit dcd7b8bd63cb81c5b973bf86510ca3c80bbbd162 ("staging: comedi: put +module _after_ detach" by myself) reversed a couple of calls in +`comedi_device_attach()` when recovering from an error returned by the +low-level driver's 'attach' handler. Unfortunately, that introduced a +NULL pointer dereference bug as `dev->driver` is NULL after the call to +`comedi_device_detach()`. We still have a pointer to the low-level +comedi driver structure in the `driv` variable, so use that instead. + +Signed-off-by: Ian Abbott +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/comedi/drivers.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/staging/comedi/drivers.c ++++ b/drivers/staging/comedi/drivers.c +@@ -464,7 +464,7 @@ int comedi_device_attach(struct comedi_d + ret = comedi_device_postconfig(dev); + if (ret < 0) { + comedi_device_detach(dev); +- module_put(dev->driver->module); ++ module_put(driv->module); + } + /* On success, the driver module count has been incremented. */ + return ret; diff --git a/queue-3.10/usb-phy-fix-build-breakage.patch b/queue-3.10/usb-phy-fix-build-breakage.patch new file mode 100644 index 00000000000..d772054de51 --- /dev/null +++ b/queue-3.10/usb-phy-fix-build-breakage.patch @@ -0,0 +1,59 @@ +From 52d5b9aba1f5790ca3231c262979c2c3e26dd99b Mon Sep 17 00:00:00 2001 +From: Anatolij Gustschin +Date: Wed, 21 Aug 2013 17:43:31 +0200 +Subject: usb: phy: fix build breakage + +From: Anatolij Gustschin + +commit 52d5b9aba1f5790ca3231c262979c2c3e26dd99b upstream. + +Commit 94ae9843 (usb: phy: rename all phy drivers to phy-$name-usb.c) +renamed drivers/usb/phy/otg_fsm.h to drivers/usb/phy/phy-fsm-usb.h +but changed drivers/usb/phy/phy-fsm-usb.c to include not existing +"phy-otg-fsm.h" instead of new "phy-fsm-usb.h". This breaks building: + ... + drivers/usb/phy/phy-fsm-usb.c:32:25: fatal error: phy-otg-fsm.h: No such file or directory + compilation terminated. + make[3]: *** [drivers/usb/phy/phy-fsm-usb.o] Error 1 + +This commit also missed to modify drivers/usb/phy/phy-fsl-usb.h +to include new "phy-fsm-usb.h" instead of "otg_fsm.h" resulting +in another build breakage: + ... + In file included from drivers/usb/phy/phy-fsl-usb.c:46:0: + drivers/usb/phy/phy-fsl-usb.h:18:21: fatal error: otg_fsm.h: No such file or directory + compilation terminated. + make[3]: *** [drivers/usb/phy/phy-fsl-usb.o] Error 1 + +Fix both issues. + +Signed-off-by: Anatolij Gustschin +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/phy/phy-fsl-usb.h | 2 +- + drivers/usb/phy/phy-fsm-usb.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/usb/phy/phy-fsl-usb.h ++++ b/drivers/usb/phy/phy-fsl-usb.h +@@ -15,7 +15,7 @@ + * 675 Mass Ave, Cambridge, MA 02139, USA. + */ + +-#include "otg_fsm.h" ++#include "phy-fsm-usb.h" + #include + #include + +--- a/drivers/usb/phy/phy-fsm-usb.c ++++ b/drivers/usb/phy/phy-fsm-usb.c +@@ -29,7 +29,7 @@ + #include + #include + +-#include "phy-otg-fsm.h" ++#include "phy-fsm-usb.h" + + /* Change USB protocol when there is a protocol change */ + static int otg_set_protocol(struct otg_fsm *fsm, int protocol) diff --git a/queue-3.10/vfs-collect_mounts-should-return-an-err_ptr.patch b/queue-3.10/vfs-collect_mounts-should-return-an-err_ptr.patch new file mode 100644 index 00000000000..c427ab93a3b --- /dev/null +++ b/queue-3.10/vfs-collect_mounts-should-return-an-err_ptr.patch @@ -0,0 +1,35 @@ +From 52e220d357a38cb29fa2e29f34ed94c1d66357f4 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Wed, 14 Aug 2013 12:44:39 +0300 +Subject: VFS: collect_mounts() should return an ERR_PTR + +From: Dan Carpenter + +commit 52e220d357a38cb29fa2e29f34ed94c1d66357f4 upstream. + +This should actually be returning an ERR_PTR on error instead of NULL. +That was how it was designed and all the callers expect it. + +[AV: actually, that's what "VFS: Make clone_mnt()/copy_tree()/collect_mounts() +return errors" missed - originally collect_mounts() was expected to return +NULL on failure] + +Signed-off-by: Dan Carpenter +Signed-off-by: Al Viro +Signed-off-by: Greg Kroah-Hartman + +--- + fs/namespace.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/namespace.c ++++ b/fs/namespace.c +@@ -1429,7 +1429,7 @@ struct vfsmount *collect_mounts(struct p + CL_COPY_ALL | CL_PRIVATE); + namespace_unlock(); + if (IS_ERR(tree)) +- return NULL; ++ return ERR_CAST(tree); + return &tree->mnt; + } + diff --git a/queue-3.10/x86-don-t-clear-olpc_ofw_header-when-sentinel-is-detected.patch b/queue-3.10/x86-don-t-clear-olpc_ofw_header-when-sentinel-is-detected.patch new file mode 100644 index 00000000000..7d4c8bae5f0 --- /dev/null +++ b/queue-3.10/x86-don-t-clear-olpc_ofw_header-when-sentinel-is-detected.patch @@ -0,0 +1,50 @@ +From d55e37bb0f51316e552376ddc0a3fff34ca7108b Mon Sep 17 00:00:00 2001 +From: Daniel Drake +Date: Fri, 9 Aug 2013 18:14:20 -0400 +Subject: x86: Don't clear olpc_ofw_header when sentinel is detected + +From: Daniel Drake + +commit d55e37bb0f51316e552376ddc0a3fff34ca7108b upstream. + +OpenFirmware wasn't quite following the protocol described in boot.txt +and the kernel has detected this through use of the sentinel value +in boot_params. OFW does zero out almost all of the stuff that it should +do, but not the sentinel. + +This causes the kernel to clear olpc_ofw_header, which breaks x86 OLPC +support. + +OpenFirmware has now been fixed. However, it would be nice if we could +maintain Linux compatibility with old firmware versions. To do that, we just +have to avoid zeroing out olpc_ofw_header. + +OFW does not write to any other parts of the header that are being zapped +by the sentinel-detection code, and all users of olpc_ofw_header are +somewhat protected through checking for the OLPC_OFW_SIG magic value +before using it. So this should not cause any problems for anyone. + +Signed-off-by: Daniel Drake +Link: http://lkml.kernel.org/r/20130809221420.618E6FAB03@dev.laptop.org +Acked-by: Yinghai Lu +Signed-off-by: H. Peter Anvin +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/include/asm/bootparam_utils.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/x86/include/asm/bootparam_utils.h ++++ b/arch/x86/include/asm/bootparam_utils.h +@@ -35,9 +35,9 @@ static void sanitize_boot_params(struct + */ + if (boot_params->sentinel) { + /* fields in boot_params are left uninitialized, clear them */ +- memset(&boot_params->olpc_ofw_header, 0, ++ memset(&boot_params->ext_ramdisk_image, 0, + (char *)&boot_params->efi_info - +- (char *)&boot_params->olpc_ofw_header); ++ (char *)&boot_params->ext_ramdisk_image); + memset(&boot_params->kbd_status, 0, + (char *)&boot_params->hdr - + (char *)&boot_params->kbd_status); diff --git a/queue-3.10/xen-events-initialize-local-per-cpu-mask-for-all-possible-events.patch b/queue-3.10/xen-events-initialize-local-per-cpu-mask-for-all-possible-events.patch new file mode 100644 index 00000000000..de49524cd57 --- /dev/null +++ b/queue-3.10/xen-events-initialize-local-per-cpu-mask-for-all-possible-events.patch @@ -0,0 +1,43 @@ +From 84ca7a8e45dafb49cd5ca90a343ba033e2885c17 Mon Sep 17 00:00:00 2001 +From: David Vrabel +Date: Thu, 15 Aug 2013 13:21:06 +0100 +Subject: xen/events: initialize local per-cpu mask for all possible events + +From: David Vrabel + +commit 84ca7a8e45dafb49cd5ca90a343ba033e2885c17 upstream. + +The sizeof() argument in init_evtchn_cpu_bindings() is incorrect +resulting in only the first 64 (or 32 in 32-bit guests) ports having +their bindings being initialized to VCPU 0. + +In most cases this does not cause a problem as request_irq() will set +the irq affinity which will set the correct local per-cpu mask. +However, if the request_irq() is called on a VCPU other than 0, there +is a window between the unmasking of the event and the affinity being +set were an event may be lost because it is not locally unmasked on +any VCPU. If request_irq() is called on VCPU 0 then local irqs are +disabled during the window and the race does not occur. + +Fix this by initializing all NR_EVENT_CHANNEL bits in the local +per-cpu masks. + +Signed-off-by: David Vrabel +Signed-off-by: Konrad Rzeszutek Wilk +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/xen/events.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/xen/events.c ++++ b/drivers/xen/events.c +@@ -346,7 +346,7 @@ static void init_evtchn_cpu_bindings(voi + + for_each_possible_cpu(i) + memset(per_cpu(cpu_evtchn_mask, i), +- (i == 0) ? ~0 : 0, sizeof(*per_cpu(cpu_evtchn_mask, i))); ++ (i == 0) ? ~0 : 0, NR_EVENT_CHANNELS/8); + } + + static inline void clear_evtchn(int port) diff --git a/queue-3.10/xen-events-mask-events-when-changing-their-vcpu-binding.patch b/queue-3.10/xen-events-mask-events-when-changing-their-vcpu-binding.patch new file mode 100644 index 00000000000..2542265ec15 --- /dev/null +++ b/queue-3.10/xen-events-mask-events-when-changing-their-vcpu-binding.patch @@ -0,0 +1,67 @@ +From 4704fe4f03a5ab27e3c36184af85d5000e0f8a48 Mon Sep 17 00:00:00 2001 +From: David Vrabel +Date: Thu, 15 Aug 2013 13:21:07 +0100 +Subject: xen/events: mask events when changing their VCPU binding + +From: David Vrabel + +commit 4704fe4f03a5ab27e3c36184af85d5000e0f8a48 upstream. + +When a event is being bound to a VCPU there is a window between the +EVTCHNOP_bind_vpcu call and the adjustment of the local per-cpu masks +where an event may be lost. The hypervisor upcalls the new VCPU but +the kernel thinks that event is still bound to the old VCPU and +ignores it. + +There is even a problem when the event is being bound to the same VCPU +as there is a small window beween the clear_bit() and set_bit() calls +in bind_evtchn_to_cpu(). When scanning for pending events, the kernel +may read the bit when it is momentarily clear and ignore the event. + +Avoid this by masking the event during the whole bind operation. + +Signed-off-by: David Vrabel +Signed-off-by: Konrad Rzeszutek Wilk +Reviewed-by: Jan Beulich +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/xen/events.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +--- a/drivers/xen/events.c ++++ b/drivers/xen/events.c +@@ -1492,8 +1492,10 @@ void rebind_evtchn_irq(int evtchn, int i + /* Rebind an evtchn so that it gets delivered to a specific cpu */ + static int rebind_irq_to_cpu(unsigned irq, unsigned tcpu) + { ++ struct shared_info *s = HYPERVISOR_shared_info; + struct evtchn_bind_vcpu bind_vcpu; + int evtchn = evtchn_from_irq(irq); ++ int masked; + + if (!VALID_EVTCHN(evtchn)) + return -1; +@@ -1510,6 +1512,12 @@ static int rebind_irq_to_cpu(unsigned ir + bind_vcpu.vcpu = tcpu; + + /* ++ * Mask the event while changing the VCPU binding to prevent ++ * it being delivered on an unexpected VCPU. ++ */ ++ masked = sync_test_and_set_bit(evtchn, BM(s->evtchn_mask)); ++ ++ /* + * If this fails, it usually just indicates that we're dealing with a + * virq or IPI channel, which don't actually need to be rebound. Ignore + * it, but don't do the xenlinux-level rebind in that case. +@@ -1517,6 +1525,9 @@ static int rebind_irq_to_cpu(unsigned ir + if (HYPERVISOR_event_channel_op(EVTCHNOP_bind_vcpu, &bind_vcpu) >= 0) + bind_evtchn_to_cpu(evtchn, tcpu); + ++ if (!masked) ++ unmask_evtchn(evtchn); ++ + return 0; + } + diff --git a/queue-3.10/zd1201-do-not-use-stack-as-urb-transfer_buffer.patch b/queue-3.10/zd1201-do-not-use-stack-as-urb-transfer_buffer.patch new file mode 100644 index 00000000000..9e9351796e1 --- /dev/null +++ b/queue-3.10/zd1201-do-not-use-stack-as-urb-transfer_buffer.patch @@ -0,0 +1,38 @@ +From 1206ff4ff9d2ef7468a355328bc58ac6ebf5be44 Mon Sep 17 00:00:00 2001 +From: Jussi Kivilinna +Date: Tue, 6 Aug 2013 14:28:42 +0300 +Subject: zd1201: do not use stack as URB transfer_buffer + +From: Jussi Kivilinna + +commit 1206ff4ff9d2ef7468a355328bc58ac6ebf5be44 upstream. + +Patch fixes zd1201 not to use stack as URB transfer_buffer. URB buffers need +to be DMA-able, which stack is not. + +Patch is only compile tested. + +Signed-off-by: Jussi Kivilinna +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/zd1201.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/net/wireless/zd1201.c ++++ b/drivers/net/wireless/zd1201.c +@@ -98,10 +98,12 @@ static int zd1201_fw_upload(struct usb_d + goto exit; + + err = usb_control_msg(dev, usb_rcvctrlpipe(dev, 0), 0x4, +- USB_DIR_IN | 0x40, 0,0, &ret, sizeof(ret), ZD1201_FW_TIMEOUT); ++ USB_DIR_IN | 0x40, 0, 0, buf, sizeof(ret), ZD1201_FW_TIMEOUT); + if (err < 0) + goto exit; + ++ memcpy(&ret, buf, sizeof(ret)); ++ + if (ret & 0x80) { + err = -EIO; + goto exit;