From d83b0568722512e9c8b62ee61b5d35e8cc77f34f Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Mon, 6 Jan 2014 10:56:25 -0800 Subject: [PATCH] 3.4-stable patches added patches: ath9k-fix-interrupt-handling-for-the-ar9002-family.patch ath9k_htc-properly-set-mac-address-and-bssid-mask.patch ceph-avoid-data-inconsistency-due-to-d-cache-aliasing-in-readpage.patch cpupower-fix-segfault-due-to-incorrect-getopt_long-arugments.patch dm9601-fix-reception-of-full-size-ethernet-frames-on-dm9620-dm9621a.patch dm9601-work-around-tx-fifo-sync-issue-on-dm962x.patch libata-add-ata_horkage_broken_fpdma_aa-quirk-for-seagate-momentus-spinpoint-m8.patch powerpc-align-p_end.patch powerpc-fix-bad-stack-check-in-exception-entry.patch tg3-expand-4g_overflow_test-workaround-to-skb-fragments-of-any-size.patch --- ...rrupt-handling-for-the-ar9002-family.patch | 115 ++++++++++++++++++ ...perly-set-mac-address-and-bssid-mask.patch | 99 +++++++++++++++ ...-due-to-d-cache-aliasing-in-readpage.patch | 40 ++++++ ...e-to-incorrect-getopt_long-arugments.patch | 43 +++++++ ...ze-ethernet-frames-on-dm9620-dm9621a.patch | 36 ++++++ ...-around-tx-fifo-sync-issue-on-dm962x.patch | 83 +++++++++++++ ...rk-for-seagate-momentus-spinpoint-m8.patch | 39 ++++++ queue-3.4/powerpc-align-p_end.patch | 34 ++++++ ...x-bad-stack-check-in-exception-entry.patch | 42 +++++++ queue-3.4/series | 10 ++ ...karound-to-skb-fragments-of-any-size.patch | 35 ++++++ 11 files changed, 576 insertions(+) create mode 100644 queue-3.4/ath9k-fix-interrupt-handling-for-the-ar9002-family.patch create mode 100644 queue-3.4/ath9k_htc-properly-set-mac-address-and-bssid-mask.patch create mode 100644 queue-3.4/ceph-avoid-data-inconsistency-due-to-d-cache-aliasing-in-readpage.patch create mode 100644 queue-3.4/cpupower-fix-segfault-due-to-incorrect-getopt_long-arugments.patch create mode 100644 queue-3.4/dm9601-fix-reception-of-full-size-ethernet-frames-on-dm9620-dm9621a.patch create mode 100644 queue-3.4/dm9601-work-around-tx-fifo-sync-issue-on-dm962x.patch create mode 100644 queue-3.4/libata-add-ata_horkage_broken_fpdma_aa-quirk-for-seagate-momentus-spinpoint-m8.patch create mode 100644 queue-3.4/powerpc-align-p_end.patch create mode 100644 queue-3.4/powerpc-fix-bad-stack-check-in-exception-entry.patch create mode 100644 queue-3.4/tg3-expand-4g_overflow_test-workaround-to-skb-fragments-of-any-size.patch diff --git a/queue-3.4/ath9k-fix-interrupt-handling-for-the-ar9002-family.patch b/queue-3.4/ath9k-fix-interrupt-handling-for-the-ar9002-family.patch new file mode 100644 index 00000000000..0f768b084c7 --- /dev/null +++ b/queue-3.4/ath9k-fix-interrupt-handling-for-the-ar9002-family.patch @@ -0,0 +1,115 @@ +From 73f0b56a1ff64e7fb6c3a62088804bab93bcedc2 Mon Sep 17 00:00:00 2001 +From: Sujith Manoharan +Date: Mon, 16 Dec 2013 07:04:59 +0530 +Subject: ath9k: Fix interrupt handling for the AR9002 family + +From: Sujith Manoharan + +commit 73f0b56a1ff64e7fb6c3a62088804bab93bcedc2 upstream. + +This patch adds a driver workaround for a HW issue. + +A race condition in the HW results in missing interrupts, +which can be avoided by a read/write with the ISR register. +All chips in the AR9002 series are affected by this bug - AR9003 +and above do not have this problem. + +Cc: Felix Fietkau +Signed-off-by: Sujith Manoharan +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/ath/ath9k/ar9002_mac.c | 52 +++++++++++++++++++++++----- + 1 file changed, 43 insertions(+), 9 deletions(-) + +--- a/drivers/net/wireless/ath/ath9k/ar9002_mac.c ++++ b/drivers/net/wireless/ath/ath9k/ar9002_mac.c +@@ -76,9 +76,16 @@ static bool ar9002_hw_get_isr(struct ath + mask2 |= ATH9K_INT_CST; + if (isr2 & AR_ISR_S2_TSFOOR) + mask2 |= ATH9K_INT_TSFOOR; ++ ++ if (!(pCap->hw_caps & ATH9K_HW_CAP_RAC_SUPPORTED)) { ++ REG_WRITE(ah, AR_ISR_S2, isr2); ++ isr &= ~AR_ISR_BCNMISC; ++ } + } + +- isr = REG_READ(ah, AR_ISR_RAC); ++ if (pCap->hw_caps & ATH9K_HW_CAP_RAC_SUPPORTED) ++ isr = REG_READ(ah, AR_ISR_RAC); ++ + if (isr == 0xffffffff) { + *masked = 0; + return false; +@@ -97,11 +104,23 @@ static bool ar9002_hw_get_isr(struct ath + + *masked |= ATH9K_INT_TX; + +- s0_s = REG_READ(ah, AR_ISR_S0_S); ++ if (pCap->hw_caps & ATH9K_HW_CAP_RAC_SUPPORTED) { ++ s0_s = REG_READ(ah, AR_ISR_S0_S); ++ s1_s = REG_READ(ah, AR_ISR_S1_S); ++ } else { ++ s0_s = REG_READ(ah, AR_ISR_S0); ++ REG_WRITE(ah, AR_ISR_S0, s0_s); ++ s1_s = REG_READ(ah, AR_ISR_S1); ++ REG_WRITE(ah, AR_ISR_S1, s1_s); ++ ++ isr &= ~(AR_ISR_TXOK | ++ AR_ISR_TXDESC | ++ AR_ISR_TXERR | ++ AR_ISR_TXEOL); ++ } ++ + ah->intr_txqs |= MS(s0_s, AR_ISR_S0_QCU_TXOK); + ah->intr_txqs |= MS(s0_s, AR_ISR_S0_QCU_TXDESC); +- +- s1_s = REG_READ(ah, AR_ISR_S1_S); + ah->intr_txqs |= MS(s1_s, AR_ISR_S1_QCU_TXERR); + ah->intr_txqs |= MS(s1_s, AR_ISR_S1_QCU_TXEOL); + } +@@ -114,13 +133,15 @@ static bool ar9002_hw_get_isr(struct ath + *masked |= mask2; + } + +- if (AR_SREV_9100(ah)) +- return true; +- +- if (isr & AR_ISR_GENTMR) { ++ if (!AR_SREV_9100(ah) && (isr & AR_ISR_GENTMR)) { + u32 s5_s; + +- s5_s = REG_READ(ah, AR_ISR_S5_S); ++ if (pCap->hw_caps & ATH9K_HW_CAP_RAC_SUPPORTED) { ++ s5_s = REG_READ(ah, AR_ISR_S5_S); ++ } else { ++ s5_s = REG_READ(ah, AR_ISR_S5); ++ } ++ + ah->intr_gen_timer_trigger = + MS(s5_s, AR_ISR_S5_GENTIMER_TRIG); + +@@ -133,8 +154,21 @@ static bool ar9002_hw_get_isr(struct ath + if ((s5_s & AR_ISR_S5_TIM_TIMER) && + !(pCap->hw_caps & ATH9K_HW_CAP_AUTOSLEEP)) + *masked |= ATH9K_INT_TIM_TIMER; ++ ++ if (!(pCap->hw_caps & ATH9K_HW_CAP_RAC_SUPPORTED)) { ++ REG_WRITE(ah, AR_ISR_S5, s5_s); ++ isr &= ~AR_ISR_GENTMR; ++ } ++ } ++ ++ if (!(pCap->hw_caps & ATH9K_HW_CAP_RAC_SUPPORTED)) { ++ REG_WRITE(ah, AR_ISR, isr); ++ REG_READ(ah, AR_ISR); + } + ++ if (AR_SREV_9100(ah)) ++ return true; ++ + if (sync_cause) { + fatal_int = + (sync_cause & diff --git a/queue-3.4/ath9k_htc-properly-set-mac-address-and-bssid-mask.patch b/queue-3.4/ath9k_htc-properly-set-mac-address-and-bssid-mask.patch new file mode 100644 index 00000000000..76735cf284e --- /dev/null +++ b/queue-3.4/ath9k_htc-properly-set-mac-address-and-bssid-mask.patch @@ -0,0 +1,99 @@ +From 657eb17d87852c42b55c4b06d5425baa08b2ddb3 Mon Sep 17 00:00:00 2001 +From: Mathy Vanhoef +Date: Thu, 28 Nov 2013 12:21:45 +0100 +Subject: ath9k_htc: properly set MAC address and BSSID mask + +From: Mathy Vanhoef + +commit 657eb17d87852c42b55c4b06d5425baa08b2ddb3 upstream. + +Pick the MAC address of the first virtual interface as the new hardware MAC +address. Set BSSID mask according to this MAC address. This fixes CVE-2013-4579. + +Signed-off-by: Mathy Vanhoef +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/ath/ath9k/htc_drv_main.c | 25 +++++++++++++++++-------- + drivers/net/wireless/ath/ath9k/main.c | 5 +++-- + 2 files changed, 20 insertions(+), 10 deletions(-) + +--- a/drivers/net/wireless/ath/ath9k/htc_drv_main.c ++++ b/drivers/net/wireless/ath/ath9k/htc_drv_main.c +@@ -139,21 +139,26 @@ static void ath9k_htc_bssid_iter(void *d + struct ath9k_vif_iter_data *iter_data = data; + int i; + +- for (i = 0; i < ETH_ALEN; i++) +- iter_data->mask[i] &= ~(iter_data->hw_macaddr[i] ^ mac[i]); ++ if (iter_data->hw_macaddr != NULL) { ++ for (i = 0; i < ETH_ALEN; i++) ++ iter_data->mask[i] &= ~(iter_data->hw_macaddr[i] ^ mac[i]); ++ } else { ++ iter_data->hw_macaddr = mac; ++ } + } + +-static void ath9k_htc_set_bssid_mask(struct ath9k_htc_priv *priv, ++static void ath9k_htc_set_mac_bssid_mask(struct ath9k_htc_priv *priv, + struct ieee80211_vif *vif) + { + struct ath_common *common = ath9k_hw_common(priv->ah); + struct ath9k_vif_iter_data iter_data; + + /* +- * Use the hardware MAC address as reference, the hardware uses it +- * together with the BSSID mask when matching addresses. ++ * Pick the MAC address of the first interface as the new hardware ++ * MAC address. The hardware will use it together with the BSSID mask ++ * when matching addresses. + */ +- iter_data.hw_macaddr = common->macaddr; ++ iter_data.hw_macaddr = NULL; + memset(&iter_data.mask, 0xff, ETH_ALEN); + + if (vif) +@@ -164,6 +169,10 @@ static void ath9k_htc_set_bssid_mask(str + &iter_data); + + memcpy(common->bssidmask, iter_data.mask, ETH_ALEN); ++ ++ if (iter_data.hw_macaddr) ++ memcpy(common->macaddr, iter_data.hw_macaddr, ETH_ALEN); ++ + ath_hw_setbssidmask(common); + } + +@@ -1091,7 +1100,7 @@ static int ath9k_htc_add_interface(struc + goto out; + } + +- ath9k_htc_set_bssid_mask(priv, vif); ++ ath9k_htc_set_mac_bssid_mask(priv, vif); + + priv->vif_slot |= (1 << avp->index); + priv->nvifs++; +@@ -1154,7 +1163,7 @@ static void ath9k_htc_remove_interface(s + + ath9k_htc_set_opmode(priv); + +- ath9k_htc_set_bssid_mask(priv, vif); ++ ath9k_htc_set_mac_bssid_mask(priv, vif); + + /* + * Stop ANI only if there are no associated station interfaces. +--- a/drivers/net/wireless/ath/ath9k/main.c ++++ b/drivers/net/wireless/ath/ath9k/main.c +@@ -1290,8 +1290,9 @@ void ath9k_calculate_iter_data(struct ie + struct ath_common *common = ath9k_hw_common(ah); + + /* +- * Use the hardware MAC address as reference, the hardware uses it +- * together with the BSSID mask when matching addresses. ++ * Pick the MAC address of the first interface as the new hardware ++ * MAC address. The hardware will use it together with the BSSID mask ++ * when matching addresses. + */ + memset(iter_data, 0, sizeof(*iter_data)); + iter_data->hw_macaddr = common->macaddr; diff --git a/queue-3.4/ceph-avoid-data-inconsistency-due-to-d-cache-aliasing-in-readpage.patch b/queue-3.4/ceph-avoid-data-inconsistency-due-to-d-cache-aliasing-in-readpage.patch new file mode 100644 index 00000000000..3896602d260 --- /dev/null +++ b/queue-3.4/ceph-avoid-data-inconsistency-due-to-d-cache-aliasing-in-readpage.patch @@ -0,0 +1,40 @@ +From 56f91aad69444d650237295f68c195b74d888d95 Mon Sep 17 00:00:00 2001 +From: Li Wang +Date: Wed, 13 Nov 2013 15:22:14 +0800 +Subject: ceph: Avoid data inconsistency due to d-cache aliasing in readpage() + +From: Li Wang + +commit 56f91aad69444d650237295f68c195b74d888d95 upstream. + +If the length of data to be read in readpage() is exactly +PAGE_CACHE_SIZE, the original code does not flush d-cache +for data consistency after finishing reading. This patches fixes +this. + +Signed-off-by: Li Wang +Signed-off-by: Sage Weil +Signed-off-by: Greg Kroah-Hartman + +--- + fs/ceph/addr.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +--- a/fs/ceph/addr.c ++++ b/fs/ceph/addr.c +@@ -213,9 +213,13 @@ static int readpage_nounlock(struct file + if (err < 0) { + SetPageError(page); + goto out; +- } else if (err < PAGE_CACHE_SIZE) { ++ } else { ++ if (err < PAGE_CACHE_SIZE) { + /* zero fill remainder of page */ +- zero_user_segment(page, err, PAGE_CACHE_SIZE); ++ zero_user_segment(page, err, PAGE_CACHE_SIZE); ++ } else { ++ flush_dcache_page(page); ++ } + } + SetPageUptodate(page); + diff --git a/queue-3.4/cpupower-fix-segfault-due-to-incorrect-getopt_long-arugments.patch b/queue-3.4/cpupower-fix-segfault-due-to-incorrect-getopt_long-arugments.patch new file mode 100644 index 00000000000..b932e9943ce --- /dev/null +++ b/queue-3.4/cpupower-fix-segfault-due-to-incorrect-getopt_long-arugments.patch @@ -0,0 +1,43 @@ +From f447ef4a56dee4b68a91460bcdfe06b5011085f2 Mon Sep 17 00:00:00 2001 +From: Josh Boyer +Date: Fri, 11 Oct 2013 08:45:51 -0400 +Subject: cpupower: Fix segfault due to incorrect getopt_long arugments + +From: Josh Boyer + +commit f447ef4a56dee4b68a91460bcdfe06b5011085f2 upstream. + +If a user calls 'cpupower set --perf-bias 15', the process will end with +a SIGSEGV in libc because cpupower-set passes a NULL optarg to the atoi +call. This is because the getopt_long structure currently has all of +the options as having an optional_argument when they really have a +required argument. We change the structure to use required_argument to +match the short options and it resolves the issue. + +This fixes https://bugzilla.redhat.com/show_bug.cgi?id=1000439 + +Signed-off-by: Josh Boyer +Cc: Dominik Brodowski +Cc: Thomas Renninger +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + tools/power/cpupower/utils/cpupower-set.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/tools/power/cpupower/utils/cpupower-set.c ++++ b/tools/power/cpupower/utils/cpupower-set.c +@@ -18,9 +18,9 @@ + #include "helpers/bitmask.h" + + static struct option set_opts[] = { +- { .name = "perf-bias", .has_arg = optional_argument, .flag = NULL, .val = 'b'}, +- { .name = "sched-mc", .has_arg = optional_argument, .flag = NULL, .val = 'm'}, +- { .name = "sched-smt", .has_arg = optional_argument, .flag = NULL, .val = 's'}, ++ { .name = "perf-bias", .has_arg = required_argument, .flag = NULL, .val = 'b'}, ++ { .name = "sched-mc", .has_arg = required_argument, .flag = NULL, .val = 'm'}, ++ { .name = "sched-smt", .has_arg = required_argument, .flag = NULL, .val = 's'}, + { }, + }; + diff --git a/queue-3.4/dm9601-fix-reception-of-full-size-ethernet-frames-on-dm9620-dm9621a.patch b/queue-3.4/dm9601-fix-reception-of-full-size-ethernet-frames-on-dm9620-dm9621a.patch new file mode 100644 index 00000000000..a859497c276 --- /dev/null +++ b/queue-3.4/dm9601-fix-reception-of-full-size-ethernet-frames-on-dm9620-dm9621a.patch @@ -0,0 +1,36 @@ +From 407900cfb54bdb2cfa228010b6697305f66b2948 Mon Sep 17 00:00:00 2001 +From: Peter Korsgaard +Date: Mon, 16 Dec 2013 11:35:33 +0100 +Subject: dm9601: fix reception of full size ethernet frames on dm9620/dm9621a + +From: Peter Korsgaard + +commit 407900cfb54bdb2cfa228010b6697305f66b2948 upstream. + +dm9620/dm9621a require room for 4 byte padding even in dm9601 (3 byte +header) mode. + +Signed-off-by: Peter Korsgaard +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/usb/dm9601.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/drivers/net/usb/dm9601.c ++++ b/drivers/net/usb/dm9601.c +@@ -445,7 +445,12 @@ static int dm9601_bind(struct usbnet *de + dev->net->ethtool_ops = &dm9601_ethtool_ops; + dev->net->hard_header_len += DM_TX_OVERHEAD; + dev->hard_mtu = dev->net->mtu + dev->net->hard_header_len; +- dev->rx_urb_size = dev->net->mtu + ETH_HLEN + DM_RX_OVERHEAD; ++ ++ /* dm9620/21a require room for 4 byte padding, even in dm9601 ++ * mode, so we need +1 to be able to receive full size ++ * ethernet frames. ++ */ ++ dev->rx_urb_size = dev->net->mtu + ETH_HLEN + DM_RX_OVERHEAD + 1; + + dev->mii.dev = dev->net; + dev->mii.mdio_read = dm9601_mdio_read; diff --git a/queue-3.4/dm9601-work-around-tx-fifo-sync-issue-on-dm962x.patch b/queue-3.4/dm9601-work-around-tx-fifo-sync-issue-on-dm962x.patch new file mode 100644 index 00000000000..e9bb92dd39a --- /dev/null +++ b/queue-3.4/dm9601-work-around-tx-fifo-sync-issue-on-dm962x.patch @@ -0,0 +1,83 @@ +From 4263c86dca5198da6bd3ad826d0b2304fbe25776 Mon Sep 17 00:00:00 2001 +From: Peter Korsgaard +Date: Mon, 16 Dec 2013 11:35:35 +0100 +Subject: dm9601: work around tx fifo sync issue on dm962x + +From: Peter Korsgaard + +commit 4263c86dca5198da6bd3ad826d0b2304fbe25776 upstream. + +Certain dm962x revisions contain an bug, where if a USB bulk transfer retry +(E.G. if bulk crc mismatch) happens right after a transfer with odd or +maxpacket length, the internal tx hardware fifo gets out of sync causing +the interface to stop working. + +Work around it by adding up to 3 bytes of padding to ensure this situation +cannot trigger. + +This workaround also means we never pass multiple-of-maxpacket size skb's +to usbnet, so the length adjustment to handle usbnet's padding of those can +be removed. + +Reported-by: Joseph Chang +Signed-off-by: Peter Korsgaard +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/usb/dm9601.c | 27 +++++++++++++++++++-------- + 1 file changed, 19 insertions(+), 8 deletions(-) + +--- a/drivers/net/usb/dm9601.c ++++ b/drivers/net/usb/dm9601.c +@@ -536,7 +536,7 @@ static int dm9601_rx_fixup(struct usbnet + static struct sk_buff *dm9601_tx_fixup(struct usbnet *dev, struct sk_buff *skb, + gfp_t flags) + { +- int len; ++ int len, pad; + + /* format: + b1: packet length low +@@ -544,12 +544,23 @@ static struct sk_buff *dm9601_tx_fixup(s + b3..n: packet data + */ + +- len = skb->len; ++ len = skb->len + DM_TX_OVERHEAD; + +- if (skb_headroom(skb) < DM_TX_OVERHEAD) { ++ /* workaround for dm962x errata with tx fifo getting out of ++ * sync if a USB bulk transfer retry happens right after a ++ * packet with odd / maxpacket length by adding up to 3 bytes ++ * padding. ++ */ ++ while ((len & 1) || !(len % dev->maxpacket)) ++ len++; ++ ++ len -= DM_TX_OVERHEAD; /* hw header doesn't count as part of length */ ++ pad = len - skb->len; ++ ++ if (skb_headroom(skb) < DM_TX_OVERHEAD || skb_tailroom(skb) < pad) { + struct sk_buff *skb2; + +- skb2 = skb_copy_expand(skb, DM_TX_OVERHEAD, 0, flags); ++ skb2 = skb_copy_expand(skb, DM_TX_OVERHEAD, pad, flags); + dev_kfree_skb_any(skb); + skb = skb2; + if (!skb) +@@ -558,10 +569,10 @@ static struct sk_buff *dm9601_tx_fixup(s + + __skb_push(skb, DM_TX_OVERHEAD); + +- /* usbnet adds padding if length is a multiple of packet size +- if so, adjust length value in header */ +- if ((skb->len % dev->maxpacket) == 0) +- len++; ++ if (pad) { ++ memset(skb->data + skb->len, 0, pad); ++ __skb_put(skb, pad); ++ } + + skb->data[0] = len; + skb->data[1] = len >> 8; diff --git a/queue-3.4/libata-add-ata_horkage_broken_fpdma_aa-quirk-for-seagate-momentus-spinpoint-m8.patch b/queue-3.4/libata-add-ata_horkage_broken_fpdma_aa-quirk-for-seagate-momentus-spinpoint-m8.patch new file mode 100644 index 00000000000..d8c2ca40f8d --- /dev/null +++ b/queue-3.4/libata-add-ata_horkage_broken_fpdma_aa-quirk-for-seagate-momentus-spinpoint-m8.patch @@ -0,0 +1,39 @@ +From 87809942d3fa60bafb7a58d0bdb1c79e90a6821d Mon Sep 17 00:00:00 2001 +From: Michele Baldessari +Date: Mon, 25 Nov 2013 19:00:14 +0000 +Subject: libata: add ATA_HORKAGE_BROKEN_FPDMA_AA quirk for Seagate Momentus SpinPoint M8 + +From: Michele Baldessari + +commit 87809942d3fa60bafb7a58d0bdb1c79e90a6821d upstream. + +We've received multiple reports in Fedora via (BZ 907193) +that the Seagate Momentus SpinPoint M8 errors out when enabling AA: +[ 2.555905] ata2.00: failed to enable AA (error_mask=0x1) +[ 2.568482] ata2.00: failed to enable AA (error_mask=0x1) + +Add the ATA_HORKAGE_BROKEN_FPDMA_AA for this specific harddisk. + +Reported-by: Nicholas +Signed-off-by: Michele Baldessari +Tested-by: Nicholas +Acked-by: Alan Cox +Signed-off-by: Tejun Heo +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ata/libata-core.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/ata/libata-core.c ++++ b/drivers/ata/libata-core.c +@@ -4104,6 +4104,9 @@ static const struct ata_blacklist_entry + { "ST3320[68]13AS", "SD1[5-9]", ATA_HORKAGE_NONCQ | + ATA_HORKAGE_FIRMWARE_WARN }, + ++ /* Seagate Momentus SpinPoint M8 seem to have FPMDA_AA issues */ ++ { "ST1000LM024 HN-M101MBB", "2AR10001", ATA_HORKAGE_BROKEN_FPDMA_AA }, ++ + /* Blacklist entries taken from Silicon Image 3124/3132 + Windows driver .inf file - also several Linux problem reports */ + { "HTS541060G9SA00", "MB3OC60D", ATA_HORKAGE_NONCQ, }, diff --git a/queue-3.4/powerpc-align-p_end.patch b/queue-3.4/powerpc-align-p_end.patch new file mode 100644 index 00000000000..7061ccc4863 --- /dev/null +++ b/queue-3.4/powerpc-align-p_end.patch @@ -0,0 +1,34 @@ +From 286e4f90a72c0b0621dde0294af6ed4b0baddabb Mon Sep 17 00:00:00 2001 +From: Anton Blanchard +Date: Mon, 23 Dec 2013 12:19:51 +1100 +Subject: powerpc: Align p_end + +From: Anton Blanchard + +commit 286e4f90a72c0b0621dde0294af6ed4b0baddabb upstream. + +p_end is an 8 byte value embedded in the text section. This means it +is only 4 byte aligned when it should be 8 byte aligned. Fix this +by adding an explicit alignment. + +This fixes an issue where POWER7 little endian builds with +CONFIG_RELOCATABLE=y fail to boot. + +Signed-off-by: Anton Blanchard +Signed-off-by: Benjamin Herrenschmidt +Signed-off-by: Greg Kroah-Hartman + +--- + arch/powerpc/kernel/head_64.S | 1 + + 1 file changed, 1 insertion(+) + +--- a/arch/powerpc/kernel/head_64.S ++++ b/arch/powerpc/kernel/head_64.S +@@ -447,6 +447,7 @@ _STATIC(__after_prom_start) + mtctr r8 + bctr + ++.balign 8 + p_end: .llong _end - _stext + + 4: /* Now copy the rest of the kernel up to _end */ diff --git a/queue-3.4/powerpc-fix-bad-stack-check-in-exception-entry.patch b/queue-3.4/powerpc-fix-bad-stack-check-in-exception-entry.patch new file mode 100644 index 00000000000..551ee1981ef --- /dev/null +++ b/queue-3.4/powerpc-fix-bad-stack-check-in-exception-entry.patch @@ -0,0 +1,42 @@ +From 90ff5d688e61f49f23545ffab6228bd7e87e6dc7 Mon Sep 17 00:00:00 2001 +From: Michael Neuling +Date: Mon, 16 Dec 2013 15:12:43 +1100 +Subject: powerpc: Fix bad stack check in exception entry + +From: Michael Neuling + +commit 90ff5d688e61f49f23545ffab6228bd7e87e6dc7 upstream. + +In EXCEPTION_PROLOG_COMMON() we check to see if the stack pointer (r1) +is valid when coming from the kernel. If it's not valid, we die but +with a nice oops message. + +Currently we allocate a stack frame (subtract INT_FRAME_SIZE) before we +check to see if the stack pointer is negative. Unfortunately, this +won't detect a bad stack where r1 is less than INT_FRAME_SIZE. + +This patch fixes the check to compare the modified r1 with +-INT_FRAME_SIZE. With this, bad kernel stack pointers (including NULL +pointers) are correctly detected again. + +Kudos to Paulus for finding this. + +Signed-off-by: Michael Neuling +Signed-off-by: Benjamin Herrenschmidt +Signed-off-by: Greg Kroah-Hartman + +--- + arch/powerpc/include/asm/exception-64s.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/powerpc/include/asm/exception-64s.h ++++ b/arch/powerpc/include/asm/exception-64s.h +@@ -163,7 +163,7 @@ do_kvm_##n: \ + subi r1,r1,INT_FRAME_SIZE; /* alloc frame on kernel stack */ \ + beq- 1f; \ + ld r1,PACAKSAVE(r13); /* kernel stack to use */ \ +-1: cmpdi cr1,r1,0; /* check if r1 is in userspace */ \ ++1: cmpdi cr1,r1,-INT_FRAME_SIZE; /* check if r1 is in userspace */ \ + blt+ cr1,3f; /* abort if it is */ \ + li r1,(n); /* will be reloaded later */ \ + sth r1,PACA_TRAP_SAVE(r13); \ diff --git a/queue-3.4/series b/queue-3.4/series index 39e9f34b0d0..4367b758849 100644 --- a/queue-3.4/series +++ b/queue-3.4/series @@ -18,3 +18,13 @@ drm-edid-add-quirk-for-bpc-in-samsung-np700g7a-s01pl-notebook.patch net_dma-mark-broken.patch drm-radeon-fix-asic-gfx-values-for-scrapper-asics.patch drm-radeon-0x9649-is-sumo2-not-sumo.patch +ceph-avoid-data-inconsistency-due-to-d-cache-aliasing-in-readpage.patch +tg3-expand-4g_overflow_test-workaround-to-skb-fragments-of-any-size.patch +dm9601-fix-reception-of-full-size-ethernet-frames-on-dm9620-dm9621a.patch +dm9601-work-around-tx-fifo-sync-issue-on-dm962x.patch +ath9k-fix-interrupt-handling-for-the-ar9002-family.patch +ath9k_htc-properly-set-mac-address-and-bssid-mask.patch +powerpc-fix-bad-stack-check-in-exception-entry.patch +powerpc-align-p_end.patch +cpupower-fix-segfault-due-to-incorrect-getopt_long-arugments.patch +libata-add-ata_horkage_broken_fpdma_aa-quirk-for-seagate-momentus-spinpoint-m8.patch diff --git a/queue-3.4/tg3-expand-4g_overflow_test-workaround-to-skb-fragments-of-any-size.patch b/queue-3.4/tg3-expand-4g_overflow_test-workaround-to-skb-fragments-of-any-size.patch new file mode 100644 index 00000000000..9a4f0c8b922 --- /dev/null +++ b/queue-3.4/tg3-expand-4g_overflow_test-workaround-to-skb-fragments-of-any-size.patch @@ -0,0 +1,35 @@ +From 375679104ab3ccfd18dcbd7ba503734fb9a2c63a Mon Sep 17 00:00:00 2001 +From: Nithin Sujir +Date: Thu, 19 Dec 2013 17:44:11 -0800 +Subject: tg3: Expand 4g_overflow_test workaround to skb fragments of any size. + +From: Nithin Sujir + +commit 375679104ab3ccfd18dcbd7ba503734fb9a2c63a upstream. + +The current driver assumes that an skb fragment can only be upto jumbo +size. Presumably this was a fast-path optimization. This assumption is +no longer true as fragments can be upto 32k. + +v2: Remove unnecessary parantheses per Eric Dumazet. + +Signed-off-by: Nithin Nayak Sujir +Signed-off-by: Michael Chan +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/ethernet/broadcom/tg3.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/ethernet/broadcom/tg3.c ++++ b/drivers/net/ethernet/broadcom/tg3.c +@@ -6619,7 +6619,7 @@ static inline int tg3_4g_overflow_test(d + { + u32 base = (u32) mapping & 0xffffffff; + +- return (base > 0xffffdcc0) && (base + len + 8 < base); ++ return base + len + 8 < base; + } + + /* Test for DMA addresses > 40-bit */ -- 2.47.3