3.7-stable patches

added patches:
	clk-ux500-fix-bit-error.patch
	mm-dmapool-use-provided-gfp-flags-for-all-dma_alloc_coherent-calls.patch
	telephony-ijx-buffer-overflow-in-ixj_write_cid.patch
	x86-amd-power-driver-support-for-amd-s-family-16h-processors.patch

diff --git a/queue-3.7/clk-ux500-fix-bit-error.patch b/queue-3.7/clk-ux500-fix-bit-error.patch
new file mode 100644 (file)
index 0000000..54757c7
--- /dev/null
+++ b/queue-3.7/clk-ux500-fix-bit-error.patch
@@ -0,0 +1,40 @@
+From 2630b17b6ee47ac79b4f5120ac49105027f644ea Mon Sep 17 00:00:00 2001
+From: Linus Walleij <linus.walleij@linaro.org>
+Date: Tue, 27 Nov 2012 20:15:20 +0100
+Subject: clk: ux500: fix bit error
+
+From: Linus Walleij <linus.walleij@linaro.org>
+
+commit 2630b17b6ee47ac79b4f5120ac49105027f644ea upstream.
+
+This fixes a bit error in the U8500 clock implementation: the
+unused p2_pclk12 registered at bit 12 in periphereral group 6
+was defined as using bit 11 rather than bit 12.
+
+When walking over and disabling the unused clocks in the tree
+at late init time, p2_pclk12 was disabled, by effectively
+clearing the but for p2_pclk11 instead of bit 12 as it should
+have, thus disabling gpio block 6 and 7.
+
+Reported-by: Lee Jones <lee.jones@linaro.org>
+Acked-by: Ulf Hansson <ulf.hansson@linaro.org>
+Cc: Philippe Begnic <philippe.begnic@st.com>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Mike Turquette <mturquette@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/clk/ux500/u8500_clk.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/clk/ux500/u8500_clk.c
++++ b/drivers/clk/ux500/u8500_clk.c
+@@ -323,7 +323,7 @@ void u8500_clk_init(void)
+       clk_register_clkdev(clk, NULL, "gpioblock1");
+ 
+       clk = clk_reg_prcc_pclk("p2_pclk12", "per2clk", U8500_CLKRST2_BASE,
+-                              BIT(11), 0);
++                              BIT(12), 0);
+ 
+       clk = clk_reg_prcc_pclk("p3_pclk0", "per3clk", U8500_CLKRST3_BASE,
+                               BIT(0), 0);

diff --git a/queue-3.7/mm-dmapool-use-provided-gfp-flags-for-all-dma_alloc_coherent-calls.patch b/queue-3.7/mm-dmapool-use-provided-gfp-flags-for-all-dma_alloc_coherent-calls.patch
new file mode 100644 (file)
index 0000000..5867b9a
--- /dev/null
+++ b/queue-3.7/mm-dmapool-use-provided-gfp-flags-for-all-dma_alloc_coherent-calls.patch
@@ -0,0 +1,124 @@
+From 387870f2d6d679746020fa8e25ef786ff338dc98 Mon Sep 17 00:00:00 2001
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+Date: Wed, 7 Nov 2012 15:37:07 +0100
+Subject: mm: dmapool: use provided gfp flags for all dma_alloc_coherent() calls
+
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+
+commit 387870f2d6d679746020fa8e25ef786ff338dc98 upstream.
+
+dmapool always calls dma_alloc_coherent() with GFP_ATOMIC flag,
+regardless the flags provided by the caller. This causes excessive
+pruning of emergency memory pools without any good reason. Additionaly,
+on ARM architecture any driver which is using dmapools will sooner or
+later  trigger the following error:
+"ERROR: 256 KiB atomic DMA coherent pool is too small!
+Please increase it with coherent_pool= kernel parameter!".
+Increasing the coherent pool size usually doesn't help much and only
+delays such error, because all GFP_ATOMIC DMA allocations are always
+served from the special, very limited memory pool.
+
+This patch changes the dmapool code to correctly use gfp flags provided
+by the dmapool caller.
+
+Reported-by: Soeren Moch <smoch@web.de>
+Reported-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
+Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Tested-by: Andrew Lunn <andrew@lunn.ch>
+Tested-by: Soeren Moch <smoch@web.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ mm/dmapool.c |   31 +++++++------------------------
+ 1 file changed, 7 insertions(+), 24 deletions(-)
+
+--- a/mm/dmapool.c
++++ b/mm/dmapool.c
+@@ -50,7 +50,6 @@ struct dma_pool {            /* the pool */
+       size_t allocation;
+       size_t boundary;
+       char name[32];
+-      wait_queue_head_t waitq;
+       struct list_head pools;
+ };
+ 
+@@ -62,8 +61,6 @@ struct dma_page {            /* cacheable header f
+       unsigned int offset;
+ };
+ 
+-#define       POOL_TIMEOUT_JIFFIES    ((100 /* msec */ * HZ) / 1000)
+-
+ static DEFINE_MUTEX(pools_lock);
+ 
+ static ssize_t
+@@ -172,7 +169,6 @@ struct dma_pool *dma_pool_create(const c
+       retval->size = size;
+       retval->boundary = boundary;
+       retval->allocation = allocation;
+-      init_waitqueue_head(&retval->waitq);
+ 
+       if (dev) {
+               int ret;
+@@ -227,7 +223,6 @@ static struct dma_page *pool_alloc_page(
+               memset(page->vaddr, POOL_POISON_FREED, pool->allocation);
+ #endif
+               pool_initialise_page(pool, page);
+-              list_add(&page->page_list, &pool->page_list);
+               page->in_use = 0;
+               page->offset = 0;
+       } else {
+@@ -315,30 +310,21 @@ void *dma_pool_alloc(struct dma_pool *po
+       might_sleep_if(mem_flags & __GFP_WAIT);
+ 
+       spin_lock_irqsave(&pool->lock, flags);
+- restart:
+       list_for_each_entry(page, &pool->page_list, page_list) {
+               if (page->offset < pool->allocation)
+                       goto ready;
+       }
+-      page = pool_alloc_page(pool, GFP_ATOMIC);
+-      if (!page) {
+-              if (mem_flags & __GFP_WAIT) {
+-                      DECLARE_WAITQUEUE(wait, current);
+ 
+-                      __set_current_state(TASK_UNINTERRUPTIBLE);
+-                      __add_wait_queue(&pool->waitq, &wait);
+-                      spin_unlock_irqrestore(&pool->lock, flags);
++      /* pool_alloc_page() might sleep, so temporarily drop &pool->lock */
++      spin_unlock_irqrestore(&pool->lock, flags);
+ 
+-                      schedule_timeout(POOL_TIMEOUT_JIFFIES);
++      page = pool_alloc_page(pool, mem_flags);
++      if (!page)
++              return NULL;
+ 
+-                      spin_lock_irqsave(&pool->lock, flags);
+-                      __remove_wait_queue(&pool->waitq, &wait);
+-                      goto restart;
+-              }
+-              retval = NULL;
+-              goto done;
+-      }
++      spin_lock_irqsave(&pool->lock, flags);
+ 
++      list_add(&page->page_list, &pool->page_list);
+  ready:
+       page->in_use++;
+       offset = page->offset;
+@@ -348,7 +334,6 @@ void *dma_pool_alloc(struct dma_pool *po
+ #ifdef        DMAPOOL_DEBUG
+       memset(retval, POOL_POISON_ALLOCATED, pool->size);
+ #endif
+- done:
+       spin_unlock_irqrestore(&pool->lock, flags);
+       return retval;
+ }
+@@ -435,8 +420,6 @@ void dma_pool_free(struct dma_pool *pool
+       page->in_use--;
+       *(int *)vaddr = page->offset;
+       page->offset = offset;
+-      if (waitqueue_active(&pool->waitq))
+-              wake_up_locked(&pool->waitq);
+       /*
+        * Resist a temptation to do
+        *    if (!is_page_busy(page)) pool_free_page(pool, page);

diff --git a/queue-3.7/series b/queue-3.7/series
new file mode 100644 (file)
index 0000000..2bc5a58
--- /dev/null
+++ b/queue-3.7/series
@@ -0,0 +1,4 @@
+mm-dmapool-use-provided-gfp-flags-for-all-dma_alloc_coherent-calls.patch
+clk-ux500-fix-bit-error.patch
+x86-amd-power-driver-support-for-amd-s-family-16h-processors.patch
+telephony-ijx-buffer-overflow-in-ixj_write_cid.patch

diff --git a/queue-3.7/telephony-ijx-buffer-overflow-in-ixj_write_cid.patch b/queue-3.7/telephony-ijx-buffer-overflow-in-ixj_write_cid.patch
new file mode 100644 (file)
index 0000000..13ad3f5
--- /dev/null
+++ b/queue-3.7/telephony-ijx-buffer-overflow-in-ixj_write_cid.patch
@@ -0,0 +1,60 @@
+From dan.carpenter@oracle.com  Tue Dec 11 13:26:39 2012
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Mon, 3 Dec 2012 22:05:12 +0300
+Subject: telephony: ijx: buffer overflow in ixj_write_cid()
+To: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Message-ID: <20121203190512.GA9273@elgon.mountain>
+
+[Not needed in 3.8 or newer as this driver is removed there. - gregkh]
+
+We get this from user space and nothing has been done to ensure that
+these strings are NUL terminated.
+
+Reported-by: Chen Gang <gang.chen@asianux.com>
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/telephony/ixj.c |   24 ++++++++++++------------
+ 1 file changed, 12 insertions(+), 12 deletions(-)
+
+--- a/drivers/staging/telephony/ixj.c
++++ b/drivers/staging/telephony/ixj.c
+@@ -3190,12 +3190,12 @@ static void ixj_write_cid(IXJ *j)
+ 
+       ixj_fsk_alloc(j);
+ 
+-      strcpy(sdmf1, j->cid_send.month);
+-      strcat(sdmf1, j->cid_send.day);
+-      strcat(sdmf1, j->cid_send.hour);
+-      strcat(sdmf1, j->cid_send.min);
+-      strcpy(sdmf2, j->cid_send.number);
+-      strcpy(sdmf3, j->cid_send.name);
++      strlcpy(sdmf1, j->cid_send.month, sizeof(sdmf1));
++      strlcat(sdmf1, j->cid_send.day, sizeof(sdmf1));
++      strlcat(sdmf1, j->cid_send.hour, sizeof(sdmf1));
++      strlcat(sdmf1, j->cid_send.min, sizeof(sdmf1));
++      strlcpy(sdmf2, j->cid_send.number, sizeof(sdmf2));
++      strlcpy(sdmf3, j->cid_send.name, sizeof(sdmf3));
+ 
+       len1 = strlen(sdmf1);
+       len2 = strlen(sdmf2);
+@@ -3340,12 +3340,12 @@ static void ixj_write_cidcw(IXJ *j)
+               ixj_pre_cid(j);
+       }
+       j->flags.cidcw_ack = 0;
+-      strcpy(sdmf1, j->cid_send.month);
+-      strcat(sdmf1, j->cid_send.day);
+-      strcat(sdmf1, j->cid_send.hour);
+-      strcat(sdmf1, j->cid_send.min);
+-      strcpy(sdmf2, j->cid_send.number);
+-      strcpy(sdmf3, j->cid_send.name);
++      strlcpy(sdmf1, j->cid_send.month, sizeof(sdmf1));
++      strlcat(sdmf1, j->cid_send.day, sizeof(sdmf1));
++      strlcat(sdmf1, j->cid_send.hour, sizeof(sdmf1));
++      strlcat(sdmf1, j->cid_send.min, sizeof(sdmf1));
++      strlcpy(sdmf2, j->cid_send.number, sizeof(sdmf2));
++      strlcpy(sdmf3, j->cid_send.name, sizeof(sdmf3));
+ 
+       len1 = strlen(sdmf1);
+       len2 = strlen(sdmf2);

diff --git a/queue-3.7/x86-amd-power-driver-support-for-amd-s-family-16h-processors.patch b/queue-3.7/x86-amd-power-driver-support-for-amd-s-family-16h-processors.patch
new file mode 100644 (file)
index 0000000..d1c7649
--- /dev/null
+++ b/queue-3.7/x86-amd-power-driver-support-for-amd-s-family-16h-processors.patch
@@ -0,0 +1,40 @@
+From 22e32f4f57778ebc6e17812fa3008361c05d64f9 Mon Sep 17 00:00:00 2001
+From: Boris Ostrovsky <boris.ostrovsky@amd.com>
+Date: Wed, 5 Dec 2012 06:12:42 -0500
+Subject: x86,AMD: Power driver support for AMD's family 16h processors
+
+From: Boris Ostrovsky <boris.ostrovsky@amd.com>
+
+commit 22e32f4f57778ebc6e17812fa3008361c05d64f9 upstream.
+
+Add family 16h PCI ID to AMD's power driver to allow it report
+power consumption on these processors.
+
+Signed-off-by: Boris Ostrovsky <boris.ostrovsky@amd.com>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hwmon/fam15h_power.c |    4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/hwmon/fam15h_power.c
++++ b/drivers/hwmon/fam15h_power.c
+@@ -31,6 +31,9 @@ MODULE_DESCRIPTION("AMD Family 15h CPU p
+ MODULE_AUTHOR("Andreas Herrmann <herrmann.der.user@googlemail.com>");
+ MODULE_LICENSE("GPL");
+ 
++/* Family 16h Northbridge's function 4 PCI ID */
++#define PCI_DEVICE_ID_AMD_16H_NB_F4   0x1534
++
+ /* D18F3 */
+ #define REG_NORTHBRIDGE_CAP           0xe8
+ 
+@@ -248,6 +251,7 @@ static void __devexit fam15h_power_remov
+ 
+ static DEFINE_PCI_DEVICE_TABLE(fam15h_power_id_table) = {
+       { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_15H_NB_F4) },
++      { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_16H_NB_F4) },
+       {}
+ };
+ MODULE_DEVICE_TABLE(pci, fam15h_power_id_table);