From: Greg Kroah-Hartman Date: Tue, 4 Feb 2014 01:07:01 +0000 (+0100) Subject: 3.4-stable patches X-Git-Tag: v3.4.79~10 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=49dae356806ba7d7bafce4791fe48a6c253d6495;p=thirdparty%2Fkernel%2Fstable-queue.git 3.4-stable patches added patches: arm-at91-smc-bug-fix-in-sam9_smc_cs_read.patch b43-fix-lockdep-splat.patch b43-fix-the-wrong-assignment-of-status.freq-in-b43_rx.patch b43-fix-unload-oops-if-firmware-is-not-available.patch b43legacy-fix-unload-oops-if-firmware-is-not-available.patch kvm-s390-fix-diagnose-code-extraction.patch rtlwifi-rtl8192c-add-new-definitions-in-the-dm_common-header.patch rtlwifi-rtl8192c-add-routines-to-save-restore-power-index-registers.patch rtlwifi-rtl8192cu-add-new-device-id.patch rtlwifi-rtl8192cu-fix-some-code-in-rf-handling.patch rtlwifi-rtl8192cu-update-the-power-index-registers.patch rtlwifi-set-the-link-state.patch rtlwifi-update-beacon-statistics-for-usb-driver.patch serial-add-support-for-200-v3-series-titan-card.patch staging-r8712u-set-device-type-to-wlan.patch staging-vt6656-bbvupdatepreedthreshold-always-set-sensitivity-on-bscanning.patch tty-serial-at91-handle-shutdown-more-safely.patch usb-cypress_m8-fix-ring-indicator-detection-and-reporting.patch usb-nokia-502-is-an-unusual-device.patch usb-option-add-new-zte-3g-modem-pids-to-option-driver.patch usb-serial-add-support-for-iball-3.5g-connect-usb-modem.patch usb-xhci-check-for-xhci_plat-in-xhci_cleanup_msix.patch x86-x32-correct-invalid-use-of-user-timespec-in-the-kernel.patch --- diff --git a/queue-3.4/arm-at91-smc-bug-fix-in-sam9_smc_cs_read.patch b/queue-3.4/arm-at91-smc-bug-fix-in-sam9_smc_cs_read.patch new file mode 100644 index 00000000000..aec05426fbe --- /dev/null +++ b/queue-3.4/arm-at91-smc-bug-fix-in-sam9_smc_cs_read.patch @@ -0,0 +1,32 @@ +From 1588c51cf6d782e63a8719681d905ef0ac22ee62 Mon Sep 17 00:00:00 2001 +From: Jean-Jacques Hiblot +Date: Thu, 9 Jan 2014 16:01:54 +0100 +Subject: ARM: at91: smc: bug fix in sam9_smc_cs_read() + +From: Jean-Jacques Hiblot + +commit 1588c51cf6d782e63a8719681d905ef0ac22ee62 upstream. + +There was a copy/paste error when reading the nwe_pulse value. + +Signed-off-by: Jean-Jacques Hiblot +Acked-by: Boris BREZILLON +Signed-off-by: Nicolas Ferre +Signed-off-by: Kevin Hilman +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/mach-at91/sam9_smc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/arm/mach-at91/sam9_smc.c ++++ b/arch/arm/mach-at91/sam9_smc.c +@@ -101,7 +101,7 @@ static void sam9_smc_cs_read(void __iome + /* Pulse register */ + val = __raw_readl(base + AT91_SMC_PULSE); + +- config->nwe_setup = val & AT91_SMC_NWEPULSE; ++ config->nwe_pulse = val & AT91_SMC_NWEPULSE; + config->ncs_write_pulse = (val & AT91_SMC_NCS_WRPULSE) >> 8; + config->nrd_pulse = (val & AT91_SMC_NRDPULSE) >> 16; + config->ncs_read_pulse = (val & AT91_SMC_NCS_RDPULSE) >> 24; diff --git a/queue-3.4/b43-fix-lockdep-splat.patch b/queue-3.4/b43-fix-lockdep-splat.patch new file mode 100644 index 00000000000..58b9dcb7371 --- /dev/null +++ b/queue-3.4/b43-fix-lockdep-splat.patch @@ -0,0 +1,103 @@ +From 09164043f63c947a49797750a09ca1cd7c31108e Mon Sep 17 00:00:00 2001 +From: Larry Finger +Date: Sun, 12 Jan 2014 15:11:37 -0600 +Subject: b43: Fix lockdep splat + +From: Larry Finger + +commit 09164043f63c947a49797750a09ca1cd7c31108e upstream. + +In https://bugzilla.kernel.org/show_bug.cgi?id=67561, a locking dependency is reported +when b43 is used with hostapd, and rfkill is used to kill the radio output. + +The lockdep splat (in part) is as follows: + +====================================================== +[ INFO: possible circular locking dependency detected ] +3.12.0 #1 Not tainted +------------------------------------------------------- +rfkill/10040 is trying to acquire lock: + (rtnl_mutex){+.+.+.}, at: [] rtnl_lock+0x12/0x20 + +but task is already holding lock: + (rfkill_global_mutex){+.+.+.}, at: [] rfkill_fop_write+0x6a/0x170 [rfkill] + +--snip-- + +Chain exists of: + rtnl_mutex --> misc_mtx --> rfkill_global_mutex + +The fix is to move the initialization of the hardware random number generator +outside the code range covered by the rtnl_mutex. + +Reported-by: yury +Tested-by: yury +Signed-off-by: Larry Finger +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/b43/main.c | 17 +++++++++++------ + 1 file changed, 11 insertions(+), 6 deletions(-) + +--- a/drivers/net/wireless/b43/main.c ++++ b/drivers/net/wireless/b43/main.c +@@ -2413,6 +2413,7 @@ error: + + static int b43_one_core_attach(struct b43_bus_dev *dev, struct b43_wl *wl); + static void b43_one_core_detach(struct b43_bus_dev *dev); ++static int b43_rng_init(struct b43_wl *wl); + + static void b43_request_firmware(struct work_struct *work) + { +@@ -2459,6 +2460,10 @@ start_ieee80211: + if (err) + goto err_one_core_detach; + b43_leds_register(wl->current_dev); ++ ++ /* Register HW RNG driver */ ++ b43_rng_init(wl); ++ + goto out; + + err_one_core_detach: +@@ -4583,9 +4588,6 @@ static void b43_wireless_core_exit(struc + if (!dev || b43_status(dev) != B43_STAT_INITIALIZED) + return; + +- /* Unregister HW RNG driver */ +- b43_rng_exit(dev->wl); +- + b43_set_status(dev, B43_STAT_UNINIT); + + /* Stop the microcode PSM. */ +@@ -4728,9 +4730,6 @@ static int b43_wireless_core_init(struct + + b43_set_status(dev, B43_STAT_INITIALIZED); + +- /* Register HW RNG driver */ +- b43_rng_init(dev->wl); +- + out: + return err; + +@@ -5388,6 +5387,9 @@ static void b43_bcma_remove(struct bcma_ + + b43_one_core_detach(wldev->dev); + ++ /* Unregister HW RNG driver */ ++ b43_rng_exit(wl); ++ + b43_leds_unregister(wl); + + ieee80211_free_hw(wl->hw); +@@ -5468,6 +5470,9 @@ static void b43_ssb_remove(struct ssb_de + + b43_one_core_detach(dev); + ++ /* Unregister HW RNG driver */ ++ b43_rng_exit(wl); ++ + if (list_empty(&wl->devlist)) { + b43_leds_unregister(wl); + /* Last core on the chip unregistered. diff --git a/queue-3.4/b43-fix-the-wrong-assignment-of-status.freq-in-b43_rx.patch b/queue-3.4/b43-fix-the-wrong-assignment-of-status.freq-in-b43_rx.patch new file mode 100644 index 00000000000..682071bf3df --- /dev/null +++ b/queue-3.4/b43-fix-the-wrong-assignment-of-status.freq-in-b43_rx.patch @@ -0,0 +1,39 @@ +From 64e5acb09ca6b50c97299cff9ef51299470b29f2 Mon Sep 17 00:00:00 2001 +From: ZHAO Gang +Date: Sat, 18 Jan 2014 00:17:38 +0800 +Subject: b43: fix the wrong assignment of status.freq in b43_rx() + +From: ZHAO Gang + +commit 64e5acb09ca6b50c97299cff9ef51299470b29f2 upstream. + +Use the right function to update frequency value. + +If rx skb is probe response or beacon, the wrong frequency value can +cause problem that bss info can't be updated when it should be. + +Fixes: 8318d78a44d4 ("cfg80211 API for channels/bitrates, mac80211 and driver conversion") +Signed-off-by: ZHAO Gang +Acked-by: Larry Finger +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/b43/xmit.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/net/wireless/b43/xmit.c ++++ b/drivers/net/wireless/b43/xmit.c +@@ -819,10 +819,10 @@ void b43_rx(struct b43_wldev *dev, struc + * channel number in b43. */ + if (chanstat & B43_RX_CHAN_5GHZ) { + status.band = IEEE80211_BAND_5GHZ; +- status.freq = b43_freq_to_channel_5ghz(chanid); ++ status.freq = b43_channel_to_freq_5ghz(chanid); + } else { + status.band = IEEE80211_BAND_2GHZ; +- status.freq = b43_freq_to_channel_2ghz(chanid); ++ status.freq = b43_channel_to_freq_2ghz(chanid); + } + break; + default: diff --git a/queue-3.4/b43-fix-unload-oops-if-firmware-is-not-available.patch b/queue-3.4/b43-fix-unload-oops-if-firmware-is-not-available.patch new file mode 100644 index 00000000000..621873c2f42 --- /dev/null +++ b/queue-3.4/b43-fix-unload-oops-if-firmware-is-not-available.patch @@ -0,0 +1,91 @@ +From 0673effd41dba323d6a280ef37b5ef29f3f5a653 Mon Sep 17 00:00:00 2001 +From: Larry Finger +Date: Sun, 12 Jan 2014 15:11:38 -0600 +Subject: b43: Fix unload oops if firmware is not available + +From: Larry Finger + +commit 0673effd41dba323d6a280ef37b5ef29f3f5a653 upstream. + +The asyncronous firmware load uses a completion struct to hold firmware +processing until the user-space routines are up and running. There is. +however, a problem in that the waiter is nevered canceled during teardown. +As a result, unloading the driver when firmware is not available causes an oops. + +To be able to access the completion structure at teardown, it had to be moved +into the b43_wldev structure. + +This patch also fixes a typo in a comment. + +Signed-off-by: Larry Finger +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/b43/b43.h | 4 ++-- + drivers/net/wireless/b43/main.c | 10 +++++----- + 2 files changed, 7 insertions(+), 7 deletions(-) + +--- a/drivers/net/wireless/b43/b43.h ++++ b/drivers/net/wireless/b43/b43.h +@@ -719,8 +719,6 @@ enum b43_firmware_file_type { + struct b43_request_fw_context { + /* The device we are requesting the fw for. */ + struct b43_wldev *dev; +- /* a completion event structure needed if this call is asynchronous */ +- struct completion fw_load_complete; + /* a pointer to the firmware object */ + const struct firmware *blob; + /* The type of firmware to request. */ +@@ -797,6 +795,8 @@ enum { + struct b43_wldev { + struct b43_bus_dev *dev; + struct b43_wl *wl; ++ /* a completion event structure needed if this call is asynchronous */ ++ struct completion fw_load_complete; + + /* The device initialization status. + * Use b43_status() to query. */ +--- a/drivers/net/wireless/b43/main.c ++++ b/drivers/net/wireless/b43/main.c +@@ -2061,6 +2061,7 @@ void b43_do_release_fw(struct b43_firmwa + + static void b43_release_firmware(struct b43_wldev *dev) + { ++ complete(&dev->fw_load_complete); + b43_do_release_fw(&dev->fw.ucode); + b43_do_release_fw(&dev->fw.pcm); + b43_do_release_fw(&dev->fw.initvals); +@@ -2086,7 +2087,7 @@ static void b43_fw_cb(const struct firmw + struct b43_request_fw_context *ctx = context; + + ctx->blob = firmware; +- complete(&ctx->fw_load_complete); ++ complete(&ctx->dev->fw_load_complete); + } + + int b43_do_request_fw(struct b43_request_fw_context *ctx, +@@ -2133,7 +2134,7 @@ int b43_do_request_fw(struct b43_request + } + if (async) { + /* do this part asynchronously */ +- init_completion(&ctx->fw_load_complete); ++ init_completion(&ctx->dev->fw_load_complete); + err = request_firmware_nowait(THIS_MODULE, 1, ctx->fwname, + ctx->dev->dev->dev, GFP_KERNEL, + ctx, b43_fw_cb); +@@ -2141,12 +2142,11 @@ int b43_do_request_fw(struct b43_request + pr_err("Unable to load firmware\n"); + return err; + } +- /* stall here until fw ready */ +- wait_for_completion(&ctx->fw_load_complete); ++ wait_for_completion(&ctx->dev->fw_load_complete); + if (ctx->blob) + goto fw_ready; + /* On some ARM systems, the async request will fail, but the next sync +- * request works. For this reason, we dall through here ++ * request works. For this reason, we fall through here + */ + } + err = request_firmware(&ctx->blob, ctx->fwname, diff --git a/queue-3.4/b43legacy-fix-unload-oops-if-firmware-is-not-available.patch b/queue-3.4/b43legacy-fix-unload-oops-if-firmware-is-not-available.patch new file mode 100644 index 00000000000..66ee81018f5 --- /dev/null +++ b/queue-3.4/b43legacy-fix-unload-oops-if-firmware-is-not-available.patch @@ -0,0 +1,32 @@ +From 452028665312672c6ba9e16a19248ee00ead9400 Mon Sep 17 00:00:00 2001 +From: Larry Finger +Date: Sun, 12 Jan 2014 15:11:39 -0600 +Subject: b43legacy: Fix unload oops if firmware is not available + +From: Larry Finger + +commit 452028665312672c6ba9e16a19248ee00ead9400 upstream. + +The asyncronous firmware load uses a completion struct to hold firmware +processing until the user-space routines are up and running. There is. +however, a problem in that the waiter is nevered canceled during teardown. +As a result, unloading the driver when firmware is not available causes an oops. + +Signed-off-by: Larry Finger +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/b43legacy/main.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/wireless/b43legacy/main.c ++++ b/drivers/net/wireless/b43legacy/main.c +@@ -3915,6 +3915,7 @@ static void b43legacy_remove(struct ssb_ + * as the ieee80211 unreg will destroy the workqueue. */ + cancel_work_sync(&wldev->restart_work); + cancel_work_sync(&wl->firmware_load); ++ complete(&wldev->fw_load_complete); + + B43legacy_WARN_ON(!wl); + if (!wldev->fw.ucode) diff --git a/queue-3.4/kvm-s390-fix-diagnose-code-extraction.patch b/queue-3.4/kvm-s390-fix-diagnose-code-extraction.patch new file mode 100644 index 00000000000..35289ae6b9f --- /dev/null +++ b/queue-3.4/kvm-s390-fix-diagnose-code-extraction.patch @@ -0,0 +1,34 @@ +From 743db27c526e0f31cc507959d662e97e2048a86f Mon Sep 17 00:00:00 2001 +From: Heiko Carstens +Date: Mon, 11 Nov 2013 13:56:47 +0100 +Subject: KVM: s390: fix diagnose code extraction + +From: Heiko Carstens + +commit 743db27c526e0f31cc507959d662e97e2048a86f upstream. + +The diagnose code to be used is the contents of the base register (if not +zero), plus the displacement. The current code ignores the base register +contents. So let's fix that... + +Reviewed-by: Cornelia Huck +Cc: stable@vger.kernel.org +Signed-off-by: Heiko Carstens +Signed-off-by: Cornelia Huck +Signed-off-by: Greg Kroah-Hartman + +--- + arch/s390/kvm/diag.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/s390/kvm/diag.c ++++ b/arch/s390/kvm/diag.c +@@ -82,7 +82,7 @@ static int __diag_ipl_functions(struct k + + int kvm_s390_handle_diag(struct kvm_vcpu *vcpu) + { +- int code = (vcpu->arch.sie_block->ipb & 0xfff0000) >> 16; ++ int code = kvm_s390_get_base_disp_rs(vcpu) & 0xffff; + + switch (code) { + case 0x10: diff --git a/queue-3.4/rtlwifi-rtl8192c-add-new-definitions-in-the-dm_common-header.patch b/queue-3.4/rtlwifi-rtl8192c-add-new-definitions-in-the-dm_common-header.patch new file mode 100644 index 00000000000..29ae8d8df35 --- /dev/null +++ b/queue-3.4/rtlwifi-rtl8192c-add-new-definitions-in-the-dm_common-header.patch @@ -0,0 +1,48 @@ +From c908c74e005de780fddbe8cb6fcd44803f5d4b74 Mon Sep 17 00:00:00 2001 +From: Larry Finger +Date: Mon, 18 Nov 2013 11:11:29 -0600 +Subject: rtlwifi: rtl8192c: Add new definitions in the dm_common header + +From: Larry Finger + +commit c908c74e005de780fddbe8cb6fcd44803f5d4b74 upstream. + +Changes in the gain-control mechanism will require some changes in the header. + +Signed-off-by: Larry Finger +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/rtlwifi/rtl8192c/dm_common.h | 14 ++++++++++++++ + 1 file changed, 14 insertions(+) + +--- a/drivers/net/wireless/rtlwifi/rtl8192c/dm_common.h ++++ b/drivers/net/wireless/rtlwifi/rtl8192c/dm_common.h +@@ -125,6 +125,17 @@ struct dig_t { + u8 cur_ccasate; + }; + ++#define DYNAMIC_FUNC_DISABLE 0x0 ++#define DYNAMIC_FUNC_DIG BIT(0) ++#define DYNAMIC_FUNC_HP BIT(1) ++#define DYNAMIC_FUNC_SS BIT(2) /*Tx Power Tracking*/ ++#define DYNAMIC_FUNC_BT BIT(3) ++#define DYNAMIC_FUNC_ANT_DIV BIT(4) ++ ++#define RSSI_CCK 0 ++#define RSSI_OFDM 1 ++#define RSSI_DEFAULT 2 ++ + struct swat_t { + u8 failure_cnt; + u8 try_flag; +@@ -202,5 +213,8 @@ void rtl92c_phy_lc_calibrate(struct ieee + void rtl92c_phy_iq_calibrate(struct ieee80211_hw *hw, bool recovery); + void rtl92c_dm_dynamic_txpower(struct ieee80211_hw *hw); + void rtl92c_dm_bt_coexist(struct ieee80211_hw *hw); ++void dm_savepowerindex(struct ieee80211_hw *hw); ++void dm_writepowerindex(struct ieee80211_hw *hw, u8 value); ++void dm_restorepowerindex(struct ieee80211_hw *hw); + + #endif diff --git a/queue-3.4/rtlwifi-rtl8192c-add-routines-to-save-restore-power-index-registers.patch b/queue-3.4/rtlwifi-rtl8192c-add-routines-to-save-restore-power-index-registers.patch new file mode 100644 index 00000000000..b0bea1ce276 --- /dev/null +++ b/queue-3.4/rtlwifi-rtl8192c-add-routines-to-save-restore-power-index-registers.patch @@ -0,0 +1,62 @@ +From 97204e93f01868eeba6ae5c4f3270f32905bb418 Mon Sep 17 00:00:00 2001 +From: Larry Finger +Date: Mon, 18 Nov 2013 11:11:32 -0600 +Subject: rtlwifi: rtl8192c: Add routines to save/restore power index registers + +From: Larry Finger + +commit 97204e93f01868eeba6ae5c4f3270f32905bb418 upstream. + +Signed-off-by: Larry Finger +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/rtlwifi/rtl8192c/dm_common.c | 36 ++++++++++++++++++++++ + 1 file changed, 36 insertions(+) + +--- a/drivers/net/wireless/rtlwifi/rtl8192c/dm_common.c ++++ b/drivers/net/wireless/rtlwifi/rtl8192c/dm_common.c +@@ -161,6 +161,42 @@ static const u8 cckswing_table_ch14[CCK_ + {0x09, 0x08, 0x07, 0x04, 0x00, 0x00, 0x00, 0x00} + }; + ++static u32 power_index_reg[6] = {0xc90, 0xc91, 0xc92, 0xc98, 0xc99, 0xc9a}; ++ ++void dm_restorepowerindex(struct ieee80211_hw *hw) ++{ ++ struct rtl_priv *rtlpriv = rtl_priv(hw); ++ u8 index; ++ ++ for (index = 0; index < 6; index++) ++ rtl_write_byte(rtlpriv, power_index_reg[index], ++ rtlpriv->dm.powerindex_backup[index]); ++} ++EXPORT_SYMBOL_GPL(dm_restorepowerindex); ++ ++void dm_writepowerindex(struct ieee80211_hw *hw, u8 value) ++{ ++ struct rtl_priv *rtlpriv = rtl_priv(hw); ++ u8 index; ++ ++ for (index = 0; index < 6; index++) ++ rtl_write_byte(rtlpriv, power_index_reg[index], value); ++} ++EXPORT_SYMBOL_GPL(dm_writepowerindex); ++ ++void dm_savepowerindex(struct ieee80211_hw *hw) ++{ ++ struct rtl_priv *rtlpriv = rtl_priv(hw); ++ u8 index; ++ u8 tmp; ++ ++ for (index = 0; index < 6; index++) { ++ tmp = rtl_read_byte(rtlpriv, power_index_reg[index]); ++ rtlpriv->dm.powerindex_backup[index] = tmp; ++ } ++} ++EXPORT_SYMBOL_GPL(dm_savepowerindex); ++ + static void rtl92c_dm_diginit(struct ieee80211_hw *hw) + { + dm_digtable.dig_enable_flag = true; diff --git a/queue-3.4/rtlwifi-rtl8192cu-add-new-device-id.patch b/queue-3.4/rtlwifi-rtl8192cu-add-new-device-id.patch new file mode 100644 index 00000000000..9381a2ffe3d --- /dev/null +++ b/queue-3.4/rtlwifi-rtl8192cu-add-new-device-id.patch @@ -0,0 +1,29 @@ +From f87f960b2fb802f26ee3b00c19320e57a9c583ff Mon Sep 17 00:00:00 2001 +From: Larry Finger +Date: Thu, 9 Jan 2014 10:27:27 -0600 +Subject: rtlwifi: rtl8192cu: Add new device ID + +From: Larry Finger + +commit f87f960b2fb802f26ee3b00c19320e57a9c583ff upstream. + +Reported-by: Jan Prinsloo +Tested-by: Jan Prinsloo +Signed-off-by: Larry Finger +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/rtlwifi/rtl8192cu/sw.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c ++++ b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c +@@ -306,6 +306,7 @@ static struct usb_device_id rtl8192c_usb + {RTL_USB_DEVICE(0x0bda, 0x5088, rtl92cu_hal_cfg)}, /*Thinkware-CC&C*/ + {RTL_USB_DEVICE(0x0df6, 0x0052, rtl92cu_hal_cfg)}, /*Sitecom - Edimax*/ + {RTL_USB_DEVICE(0x0df6, 0x005c, rtl92cu_hal_cfg)}, /*Sitecom - Edimax*/ ++ {RTL_USB_DEVICE(0x0df6, 0x0077, rtl92cu_hal_cfg)}, /*Sitecom-WLA2100V2*/ + {RTL_USB_DEVICE(0x0eb0, 0x9071, rtl92cu_hal_cfg)}, /*NO Brand - Etop*/ + {RTL_USB_DEVICE(0x4856, 0x0091, rtl92cu_hal_cfg)}, /*NetweeN - Feixun*/ + /* HP - Lite-On ,8188CUS Slim Combo */ diff --git a/queue-3.4/rtlwifi-rtl8192cu-fix-some-code-in-rf-handling.patch b/queue-3.4/rtlwifi-rtl8192cu-fix-some-code-in-rf-handling.patch new file mode 100644 index 00000000000..ae064408bc5 --- /dev/null +++ b/queue-3.4/rtlwifi-rtl8192cu-fix-some-code-in-rf-handling.patch @@ -0,0 +1,69 @@ +From e9b0784bb9de3152e787ee779868c626b137fb3b Mon Sep 17 00:00:00 2001 +From: Larry Finger +Date: Mon, 18 Nov 2013 11:11:34 -0600 +Subject: rtlwifi: rtl8192cu: Fix some code in RF handling + +From: Larry Finger + +commit e9b0784bb9de3152e787ee779868c626b137fb3b upstream. + +Signed-off-by: Larry Finger +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/rtlwifi/rtl8192cu/rf.c | 29 +++++++++++++++------------- + 1 file changed, 16 insertions(+), 13 deletions(-) + +--- a/drivers/net/wireless/rtlwifi/rtl8192cu/rf.c ++++ b/drivers/net/wireless/rtlwifi/rtl8192cu/rf.c +@@ -85,17 +85,15 @@ void rtl92cu_phy_rf6052_set_cck_txpower( + if (mac->act_scanning) { + tx_agc[RF90_PATH_A] = 0x3f3f3f3f; + tx_agc[RF90_PATH_B] = 0x3f3f3f3f; +- if (turbo_scanoff) { +- for (idx1 = RF90_PATH_A; idx1 <= RF90_PATH_B; idx1++) { +- tx_agc[idx1] = ppowerlevel[idx1] | +- (ppowerlevel[idx1] << 8) | +- (ppowerlevel[idx1] << 16) | +- (ppowerlevel[idx1] << 24); +- if (rtlhal->interface == INTF_USB) { +- if (tx_agc[idx1] > 0x20 && +- rtlefuse->external_pa) +- tx_agc[idx1] = 0x20; +- } ++ for (idx1 = RF90_PATH_A; idx1 <= RF90_PATH_B; idx1++) { ++ tx_agc[idx1] = ppowerlevel[idx1] | ++ (ppowerlevel[idx1] << 8) | ++ (ppowerlevel[idx1] << 16) | ++ (ppowerlevel[idx1] << 24); ++ if (rtlhal->interface == INTF_USB) { ++ if (tx_agc[idx1] > 0x20 && ++ rtlefuse->external_pa) ++ tx_agc[idx1] = 0x20; + } + } + } else { +@@ -107,7 +105,7 @@ void rtl92cu_phy_rf6052_set_cck_txpower( + TXHIGHPWRLEVEL_LEVEL2) { + tx_agc[RF90_PATH_A] = 0x00000000; + tx_agc[RF90_PATH_B] = 0x00000000; +- } else{ ++ } else { + for (idx1 = RF90_PATH_A; idx1 <= RF90_PATH_B; idx1++) { + tx_agc[idx1] = ppowerlevel[idx1] | + (ppowerlevel[idx1] << 8) | +@@ -379,7 +377,12 @@ static void _rtl92c_write_ofdm_power_reg + regoffset == RTXAGC_B_MCS07_MCS04) + regoffset = 0xc98; + for (i = 0; i < 3; i++) { +- writeVal = (writeVal > 6) ? (writeVal - 6) : 0; ++ if (i != 2) ++ writeVal = (writeVal > 8) ? ++ (writeVal - 8) : 0; ++ else ++ writeVal = (writeVal > 6) ? ++ (writeVal - 6) : 0; + rtl_write_byte(rtlpriv, (u32)(regoffset + i), + (u8)writeVal); + } diff --git a/queue-3.4/rtlwifi-rtl8192cu-update-the-power-index-registers.patch b/queue-3.4/rtlwifi-rtl8192cu-update-the-power-index-registers.patch new file mode 100644 index 00000000000..bc7c79e17de --- /dev/null +++ b/queue-3.4/rtlwifi-rtl8192cu-update-the-power-index-registers.patch @@ -0,0 +1,47 @@ +From 9806eacf5de27ab01d680c5d75c92a3a89734e4f Mon Sep 17 00:00:00 2001 +From: Larry Finger +Date: Mon, 18 Nov 2013 11:11:33 -0600 +Subject: rtlwifi: rtl8192cu: Update the power index registers + +From: Larry Finger + +commit 9806eacf5de27ab01d680c5d75c92a3a89734e4f upstream. + +This patch uses the newly introduced power index register routines. + +Signed-off-by: Larry Finger +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/rtlwifi/rtl8192cu/dm.c | 9 +++++++++ + drivers/net/wireless/rtlwifi/rtl8192cu/dm.h | 3 +++ + 2 files changed, 12 insertions(+) + +--- a/drivers/net/wireless/rtlwifi/rtl8192cu/dm.c ++++ b/drivers/net/wireless/rtlwifi/rtl8192cu/dm.c +@@ -107,6 +107,15 @@ void rtl92cu_dm_dynamic_txpower(struct i + "PHY_SetTxPowerLevel8192S() Channel = %d\n", + rtlphy->current_channel); + rtl92c_phy_set_txpower_level(hw, rtlphy->current_channel); ++ if (rtlpriv->dm.dynamic_txhighpower_lvl == ++ TXHIGHPWRLEVEL_NORMAL) ++ dm_restorepowerindex(hw); ++ else if (rtlpriv->dm.dynamic_txhighpower_lvl == ++ TXHIGHPWRLEVEL_LEVEL1) ++ dm_writepowerindex(hw, 0x14); ++ else if (rtlpriv->dm.dynamic_txhighpower_lvl == ++ TXHIGHPWRLEVEL_LEVEL2) ++ dm_writepowerindex(hw, 0x10); + } + + rtlpriv->dm.last_dtp_lvl = rtlpriv->dm.dynamic_txhighpower_lvl; +--- a/drivers/net/wireless/rtlwifi/rtl8192cu/dm.h ++++ b/drivers/net/wireless/rtlwifi/rtl8192cu/dm.h +@@ -30,3 +30,6 @@ + #include "../rtl8192ce/dm.h" + + void rtl92cu_dm_dynamic_txpower(struct ieee80211_hw *hw); ++void dm_savepowerindex(struct ieee80211_hw *hw); ++void dm_writepowerindex(struct ieee80211_hw *hw, u8 value); ++void dm_restorepowerindex(struct ieee80211_hw *hw); diff --git a/queue-3.4/rtlwifi-set-the-link-state.patch b/queue-3.4/rtlwifi-set-the-link-state.patch new file mode 100644 index 00000000000..a7cf492b26e --- /dev/null +++ b/queue-3.4/rtlwifi-set-the-link-state.patch @@ -0,0 +1,30 @@ +From 619ce76f8bb850b57032501a39f26aa6c6731c70 Mon Sep 17 00:00:00 2001 +From: Larry Finger +Date: Mon, 18 Nov 2013 11:11:28 -0600 +Subject: rtlwifi: Set the link state + +From: Larry Finger + +commit 619ce76f8bb850b57032501a39f26aa6c6731c70 upstream. + +The present code fails to set the linked state when an interface is +added. + +Signed-off-by: Larry Finger +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/rtlwifi/core.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/wireless/rtlwifi/core.c ++++ b/drivers/net/wireless/rtlwifi/core.c +@@ -175,6 +175,7 @@ static int rtl_op_add_interface(struct i + rtlpriv->cfg->maps + [RTL_IBSS_INT_MASKS]); + } ++ mac->link_state = MAC80211_LINKED; + break; + case NL80211_IFTYPE_ADHOC: + RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD, diff --git a/queue-3.4/rtlwifi-update-beacon-statistics-for-usb-driver.patch b/queue-3.4/rtlwifi-update-beacon-statistics-for-usb-driver.patch new file mode 100644 index 00000000000..7bfd58e62ad --- /dev/null +++ b/queue-3.4/rtlwifi-update-beacon-statistics-for-usb-driver.patch @@ -0,0 +1,31 @@ +From 65b9cc97c6852fae19dc5c7745e9abc8dd380aad Mon Sep 17 00:00:00 2001 +From: Larry Finger +Date: Mon, 18 Nov 2013 11:11:31 -0600 +Subject: rtlwifi: Update beacon statistics for USB driver + +From: Larry Finger + +commit 65b9cc97c6852fae19dc5c7745e9abc8dd380aad upstream. + +The USB drivers were not updating the beacon statistics, which led to +false beacon loss indications. + +Signed-off-by: Larry Finger +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/rtlwifi/usb.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/net/wireless/rtlwifi/usb.c ++++ b/drivers/net/wireless/rtlwifi/usb.c +@@ -480,6 +480,8 @@ static void _rtl_usb_rx_process_agg(stru + if (unicast) + rtlpriv->link_info.num_rx_inperiod++; + } ++ /* static bcn for roaming */ ++ rtl_beacon_statistic(hw, skb); + } + } + diff --git a/queue-3.4/serial-add-support-for-200-v3-series-titan-card.patch b/queue-3.4/serial-add-support-for-200-v3-series-titan-card.patch new file mode 100644 index 00000000000..c058953d09b --- /dev/null +++ b/queue-3.4/serial-add-support-for-200-v3-series-titan-card.patch @@ -0,0 +1,36 @@ +From 48c0247d7b7bf58abb85a39021099529df365c4d Mon Sep 17 00:00:00 2001 +From: Yegor Yefremov +Date: Mon, 9 Dec 2013 12:11:15 +0100 +Subject: serial: add support for 200 v3 series Titan card + +From: Yegor Yefremov + +commit 48c0247d7b7bf58abb85a39021099529df365c4d upstream. + +Signed-off-by: Yegor Yefremov +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/serial/8250/8250_pci.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/tty/serial/8250/8250_pci.c ++++ b/drivers/tty/serial/8250/8250_pci.c +@@ -1142,6 +1142,7 @@ pci_xr17c154_setup(struct serial_private + #define PCI_DEVICE_ID_TITAN_800E 0xA014 + #define PCI_DEVICE_ID_TITAN_200EI 0xA016 + #define PCI_DEVICE_ID_TITAN_200EISI 0xA017 ++#define PCI_DEVICE_ID_TITAN_200V3 0xA306 + #define PCI_DEVICE_ID_TITAN_400V3 0xA310 + #define PCI_DEVICE_ID_TITAN_410V3 0xA312 + #define PCI_DEVICE_ID_TITAN_800V3 0xA314 +@@ -3456,6 +3457,9 @@ static struct pci_device_id serial_pci_t + { PCI_VENDOR_ID_TITAN, PCI_DEVICE_ID_TITAN_200EISI, + PCI_ANY_ID, PCI_ANY_ID, 0, 0, + pbn_oxsemi_2_4000000 }, ++ { PCI_VENDOR_ID_TITAN, PCI_DEVICE_ID_TITAN_200V3, ++ PCI_ANY_ID, PCI_ANY_ID, 0, 0, ++ pbn_b0_bt_2_921600 }, + { PCI_VENDOR_ID_TITAN, PCI_DEVICE_ID_TITAN_400V3, + PCI_ANY_ID, PCI_ANY_ID, 0, 0, + pbn_b0_4_921600 }, diff --git a/queue-3.4/series b/queue-3.4/series index e4aece9508a..ed47ffdc091 100644 --- a/queue-3.4/series +++ b/queue-3.4/series @@ -1,3 +1,26 @@ md-raid5-fix-long-standing-problem-with-bitmap-handling-on-write-failure.patch mm-hugetlbfs-fix-hugetlbfs-optimization.patch e752x_edac-fix-pci_dev-usage-count.patch +x86-x32-correct-invalid-use-of-user-timespec-in-the-kernel.patch +usb-option-add-new-zte-3g-modem-pids-to-option-driver.patch +usb-serial-add-support-for-iball-3.5g-connect-usb-modem.patch +usb-cypress_m8-fix-ring-indicator-detection-and-reporting.patch +usb-nokia-502-is-an-unusual-device.patch +usb-xhci-check-for-xhci_plat-in-xhci_cleanup_msix.patch +rtlwifi-rtl8192cu-add-new-device-id.patch +rtlwifi-update-beacon-statistics-for-usb-driver.patch +rtlwifi-set-the-link-state.patch +rtlwifi-rtl8192c-add-new-definitions-in-the-dm_common-header.patch +rtlwifi-rtl8192c-add-routines-to-save-restore-power-index-registers.patch +rtlwifi-rtl8192cu-update-the-power-index-registers.patch +rtlwifi-rtl8192cu-fix-some-code-in-rf-handling.patch +b43-fix-lockdep-splat.patch +b43-fix-unload-oops-if-firmware-is-not-available.patch +b43legacy-fix-unload-oops-if-firmware-is-not-available.patch +b43-fix-the-wrong-assignment-of-status.freq-in-b43_rx.patch +staging-r8712u-set-device-type-to-wlan.patch +staging-vt6656-bbvupdatepreedthreshold-always-set-sensitivity-on-bscanning.patch +tty-serial-at91-handle-shutdown-more-safely.patch +arm-at91-smc-bug-fix-in-sam9_smc_cs_read.patch +serial-add-support-for-200-v3-series-titan-card.patch +kvm-s390-fix-diagnose-code-extraction.patch diff --git a/queue-3.4/staging-r8712u-set-device-type-to-wlan.patch b/queue-3.4/staging-r8712u-set-device-type-to-wlan.patch new file mode 100644 index 00000000000..67f8749d8cc --- /dev/null +++ b/queue-3.4/staging-r8712u-set-device-type-to-wlan.patch @@ -0,0 +1,40 @@ +From 3a21f00a5002b14e4aab52aef59d33ed28468a13 Mon Sep 17 00:00:00 2001 +From: Larry Finger +Date: Tue, 24 Dec 2013 11:22:54 -0600 +Subject: staging: r8712u: Set device type to wlan + +From: Larry Finger + +commit 3a21f00a5002b14e4aab52aef59d33ed28468a13 upstream. + +The latest version of NetworkManager does not recognize the device as wireless +without this change. + +Signed-off-by: Larry Finger +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/rtl8712/usb_intf.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/staging/rtl8712/usb_intf.c ++++ b/drivers/staging/rtl8712/usb_intf.c +@@ -361,6 +361,10 @@ static u8 key_2char2num(u8 hch, u8 lch) + return (hex_to_bin(hch) << 4) | hex_to_bin(lch); + } + ++static const struct device_type wlan_type = { ++ .name = "wlan", ++}; ++ + /* + * drv_init() - a device potentially for us + * +@@ -396,6 +400,7 @@ static int r871xu_drv_init(struct usb_in + padapter->pusb_intf = pusb_intf; + usb_set_intfdata(pusb_intf, pnetdev); + SET_NETDEV_DEV(pnetdev, &pusb_intf->dev); ++ pnetdev->dev.type = &wlan_type; + /* step 2. */ + padapter->dvobj_init = &r8712_usb_dvobj_init; + padapter->dvobj_deinit = &r8712_usb_dvobj_deinit; diff --git a/queue-3.4/staging-vt6656-bbvupdatepreedthreshold-always-set-sensitivity-on-bscanning.patch b/queue-3.4/staging-vt6656-bbvupdatepreedthreshold-always-set-sensitivity-on-bscanning.patch new file mode 100644 index 00000000000..e48d9f2d1fb --- /dev/null +++ b/queue-3.4/staging-vt6656-bbvupdatepreedthreshold-always-set-sensitivity-on-bscanning.patch @@ -0,0 +1,48 @@ +From 8f248dae133668bfb8e9379b4b3f0571c858b24a Mon Sep 17 00:00:00 2001 +From: Malcolm Priestley +Date: Sun, 8 Dec 2013 09:11:30 +0000 +Subject: staging: vt6656: [BUG] BBvUpdatePreEDThreshold Always set sensitivity on bScanning + +From: Malcolm Priestley + +commit 8f248dae133668bfb8e9379b4b3f0571c858b24a upstream. + +byBBPreEDIndex value is initially 0, this means that from +cold BBvUpdatePreEDThreshold is never set. + +This means that sensitivity may be in an ambiguous state, +failing to scan any wireless points or at least distant ones. + +Signed-off-by: Malcolm Priestley +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/vt6656/baseband.c | 3 --- + 1 file changed, 3 deletions(-) + +--- a/drivers/staging/vt6656/baseband.c ++++ b/drivers/staging/vt6656/baseband.c +@@ -1634,7 +1634,6 @@ BBvUpdatePreEDThreshold( + + if( bScanning ) + { // need Max sensitivity //RSSI -69, -70,.... +- if(pDevice->byBBPreEDIndex == 0) break; + pDevice->byBBPreEDIndex = 0; + ControlvWriteByte(pDevice, MESSAGE_REQUEST_BBREG, 0xC9, 0x00); //CR201(0xC9) + ControlvWriteByte(pDevice, MESSAGE_REQUEST_BBREG, 0xCE, 0x30); //CR206(0xCE) +@@ -1777,7 +1776,6 @@ BBvUpdatePreEDThreshold( + + if( bScanning ) + { // need Max sensitivity //RSSI -69, -70, ... +- if(pDevice->byBBPreEDIndex == 0) break; + pDevice->byBBPreEDIndex = 0; + ControlvWriteByte(pDevice, MESSAGE_REQUEST_BBREG, 0xC9, 0x00); //CR201(0xC9) + ControlvWriteByte(pDevice, MESSAGE_REQUEST_BBREG, 0xCE, 0x24); //CR206(0xCE) +@@ -1929,7 +1927,6 @@ BBvUpdatePreEDThreshold( + case RF_VT3342A0: //RobertYu:20060627, testing table + if( bScanning ) + { // need Max sensitivity //RSSI -67, -68, ... +- if(pDevice->byBBPreEDIndex == 0) break; + pDevice->byBBPreEDIndex = 0; + ControlvWriteByte(pDevice, MESSAGE_REQUEST_BBREG, 0xC9, 0x00); //CR201(0xC9) + ControlvWriteByte(pDevice, MESSAGE_REQUEST_BBREG, 0xCE, 0x38); //CR206(0xCE) diff --git a/queue-3.4/tty-serial-at91-handle-shutdown-more-safely.patch b/queue-3.4/tty-serial-at91-handle-shutdown-more-safely.patch new file mode 100644 index 00000000000..65eb5c6d698 --- /dev/null +++ b/queue-3.4/tty-serial-at91-handle-shutdown-more-safely.patch @@ -0,0 +1,73 @@ +From 0cc7c6c7916b1b6f34350ff1473b80b9f7e459c0 Mon Sep 17 00:00:00 2001 +From: Marek Roszko +Date: Tue, 7 Jan 2014 11:45:06 +0100 +Subject: tty/serial: at91: Handle shutdown more safely + +From: Marek Roszko + +commit 0cc7c6c7916b1b6f34350ff1473b80b9f7e459c0 upstream. + +Interrupts were being cleaned up late in the shutdown handler, it is possible +that an interrupt can occur and schedule a tasklet that runs after the port is +cleaned up. There is a null dereference due to this race condition with the +following stacktrace: + +[] (atmel_tasklet_func+0x514/0x814) from [] (tasklet_action+0x70/0xa8) +[] (tasklet_action+0x70/0xa8) from [] (__do_softirq+0x90/0x144) +[] (__do_softirq+0x90/0x144) from [] (irq_exit+0x40/0x4c) +[] (irq_exit+0x40/0x4c) from [] (handle_IRQ+0x64/0x84) +[] (handle_IRQ+0x64/0x84) from [] (__irq_svc+0x40/0x50) +[] (__irq_svc+0x40/0x50) from [] (atmel_rx_dma_release+0x88/0xb8) +[] (atmel_rx_dma_release+0x88/0xb8) from [] (atmel_shutdown+0x104/0x160) +[] (atmel_shutdown+0x104/0x160) from [] (uart_port_shutdown+0x2c/0x38) + +Signed-off-by: Marek Roszko +Acked-by: Leilei Zhao +Signed-off-by: Nicolas Ferre +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/serial/atmel_serial.c | 20 +++++++++++++------- + 1 file changed, 13 insertions(+), 7 deletions(-) + +--- a/drivers/tty/serial/atmel_serial.c ++++ b/drivers/tty/serial/atmel_serial.c +@@ -1022,12 +1022,24 @@ static int atmel_startup(struct uart_por + static void atmel_shutdown(struct uart_port *port) + { + struct atmel_uart_port *atmel_port = to_atmel_uart_port(port); ++ ++ /* ++ * Clear out any scheduled tasklets before ++ * we destroy the buffers ++ */ ++ tasklet_kill(&atmel_port->tasklet); ++ + /* +- * Ensure everything is stopped. ++ * Ensure everything is stopped and ++ * disable all interrupts, port and break condition. + */ + atmel_stop_rx(port); + atmel_stop_tx(port); + ++ UART_PUT_CR(port, ATMEL_US_RSTSTA); ++ UART_PUT_IDR(port, -1); ++ ++ + /* + * Shut-down the DMA. + */ +@@ -1054,12 +1066,6 @@ static void atmel_shutdown(struct uart_p + } + + /* +- * Disable all interrupts, port and break condition. +- */ +- UART_PUT_CR(port, ATMEL_US_RSTSTA); +- UART_PUT_IDR(port, -1); +- +- /* + * Free the interrupt + */ + free_irq(port->irq, port); diff --git a/queue-3.4/usb-cypress_m8-fix-ring-indicator-detection-and-reporting.patch b/queue-3.4/usb-cypress_m8-fix-ring-indicator-detection-and-reporting.patch new file mode 100644 index 00000000000..80401a757b1 --- /dev/null +++ b/queue-3.4/usb-cypress_m8-fix-ring-indicator-detection-and-reporting.patch @@ -0,0 +1,33 @@ +From 440ebadeae9298d7de3d4d105342691841ec88d0 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Thu, 2 Jan 2014 22:49:24 +0100 +Subject: USB: cypress_m8: fix ring-indicator detection and reporting + +From: Johan Hovold + +commit 440ebadeae9298d7de3d4d105342691841ec88d0 upstream. + +Fix ring-indicator (RI) status-bit definition, which was defined as CTS, +effectively preventing RI-changes from being detected while reporting +false RI status. + +This bug predates git. + +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/cypress_m8.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/serial/cypress_m8.h ++++ b/drivers/usb/serial/cypress_m8.h +@@ -63,7 +63,7 @@ + #define UART_DSR 0x20 /* data set ready - flow control - device to host */ + #define CONTROL_RTS 0x10 /* request to send - flow control - host to device */ + #define UART_CTS 0x10 /* clear to send - flow control - device to host */ +-#define UART_RI 0x10 /* ring indicator - modem - device to host */ ++#define UART_RI 0x80 /* ring indicator - modem - device to host */ + #define UART_CD 0x40 /* carrier detect - modem - device to host */ + #define CYP_ERROR 0x08 /* received from input report - device to host */ + /* Note - the below has nothing to do with the "feature report" reset */ diff --git a/queue-3.4/usb-nokia-502-is-an-unusual-device.patch b/queue-3.4/usb-nokia-502-is-an-unusual-device.patch new file mode 100644 index 00000000000..eb2f022ecbe --- /dev/null +++ b/queue-3.4/usb-nokia-502-is-an-unusual-device.patch @@ -0,0 +1,42 @@ +From 0e16114f2db4838251fb64f3b550996ad3585890 Mon Sep 17 00:00:00 2001 +From: Mikhail Zolotaryov +Date: Sat, 28 Dec 2013 01:56:35 +0200 +Subject: USB: Nokia 502 is an unusual device + +From: Mikhail Zolotaryov + +commit 0e16114f2db4838251fb64f3b550996ad3585890 upstream. + +The USB storage operation of Nokia Asha 502 Dual SIM smartphone running Asha +Platform 1.1.1 is unreliable in respect of data consistency (i.e. transfered +files are corrupted). A similar issue is described here: +http://discussions.nokia.com/t5/Asha-and-other-Nokia-Series-30/Nokia-301-USB-transfers-and-corrupted-files/td-p/1974170 + +The workaround is (MAX_SECTORS_64): + rmmod usb_storage && modprobe usb_storage quirks=0421:06aa:m + +The patch adds the tested device to the unusual list permanently. + +Signed-off-by: Mikhail Zolotaryov +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/storage/unusual_devs.h | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/usb/storage/unusual_devs.h ++++ b/drivers/usb/storage/unusual_devs.h +@@ -226,6 +226,13 @@ UNUSUAL_DEV( 0x0421, 0x0495, 0x0370, 0x + USB_SC_DEVICE, USB_PR_DEVICE, NULL, + US_FL_MAX_SECTORS_64 ), + ++/* Patch submitted by Mikhail Zolotaryov */ ++UNUSUAL_DEV( 0x0421, 0x06aa, 0x1110, 0x1110, ++ "Nokia", ++ "502", ++ USB_SC_DEVICE, USB_PR_DEVICE, NULL, ++ US_FL_MAX_SECTORS_64 ), ++ + #ifdef NO_SDDR09 + UNUSUAL_DEV( 0x0436, 0x0005, 0x0100, 0x0100, + "Microtech", diff --git a/queue-3.4/usb-option-add-new-zte-3g-modem-pids-to-option-driver.patch b/queue-3.4/usb-option-add-new-zte-3g-modem-pids-to-option-driver.patch new file mode 100644 index 00000000000..a0b736357c7 --- /dev/null +++ b/queue-3.4/usb-option-add-new-zte-3g-modem-pids-to-option-driver.patch @@ -0,0 +1,36 @@ +From 4d90b819ae4c7ea8fd5e2bb7edc68c0f334be2e4 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?=E5=BC=A0=E5=90=9B?= +Date: Wed, 18 Dec 2013 15:37:17 +0800 +Subject: usb: option: add new zte 3g modem pids to option driver + +From: =?UTF-8?q?=E5=BC=A0=E5=90=9B?= + +commit 4d90b819ae4c7ea8fd5e2bb7edc68c0f334be2e4 upstream. + +Signed-off-by: Jun zhang +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/option.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -1461,6 +1461,17 @@ static const struct usb_device_id option + .driver_info = (kernel_ulong_t)&net_intf3_blacklist }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0178, 0xff, 0xff, 0xff), + .driver_info = (kernel_ulong_t)&net_intf3_blacklist }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffe9, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff8b, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff8c, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff8d, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff8e, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff8f, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff90, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff91, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff92, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff93, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff94, 0xff, 0xff, 0xff) }, + + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_CDMA_TECH, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_AC8710, 0xff, 0xff, 0xff) }, diff --git a/queue-3.4/usb-serial-add-support-for-iball-3.5g-connect-usb-modem.patch b/queue-3.4/usb-serial-add-support-for-iball-3.5g-connect-usb-modem.patch new file mode 100644 index 00000000000..c522afed2cf --- /dev/null +++ b/queue-3.4/usb-serial-add-support-for-iball-3.5g-connect-usb-modem.patch @@ -0,0 +1,59 @@ +From 7d5c1b9c7cb5ec8e52b1adc65c484a923a8ea6c3 Mon Sep 17 00:00:00 2001 +From: Rahul Bedarkar +Date: Thu, 2 Jan 2014 20:57:56 +0530 +Subject: USB: serial: add support for iBall 3.5G connect usb modem +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rahul Bedarkar + +commit 7d5c1b9c7cb5ec8e52b1adc65c484a923a8ea6c3 upstream. + +Add support for iBall 3.5G connect usb modem. + +$lsusb +Bus 002 Device 006: ID 1c9e:9605 OMEGA TECHNOLOGY + +$usb-devices +T: Bus=02 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 6 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=1c9e ProdID=9605 Rev=00.00 +S: Manufacturer=USB Modem +S: Product=USB Modem +S: SerialNumber=1234567890ABCDEF +C: #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA +I: If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option +I: If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option +I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option +I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=option +I: If#= 4 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=06 Prot=50 Driver=usb-storage + +Signed-off-by: Rahul Bedarkar +Suggested-by: Bjørn Mork +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/option.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -325,6 +325,9 @@ static void option_instat_callback(struc + * It seems to contain a Qualcomm QSC6240/6290 chipset */ + #define FOUR_G_SYSTEMS_PRODUCT_W14 0x9603 + ++/* iBall 3.5G connect wireless modem */ ++#define IBALL_3_5G_CONNECT 0x9605 ++ + /* Zoom */ + #define ZOOM_PRODUCT_4597 0x9607 + +@@ -1520,6 +1523,7 @@ static const struct usb_device_id option + .driver_info = (kernel_ulong_t)&four_g_w14_blacklist + }, + { USB_DEVICE(LONGCHEER_VENDOR_ID, ZOOM_PRODUCT_4597) }, ++ { USB_DEVICE(LONGCHEER_VENDOR_ID, IBALL_3_5G_CONNECT) }, + { USB_DEVICE(HAIER_VENDOR_ID, HAIER_PRODUCT_CE100) }, + /* Pirelli */ + { USB_DEVICE(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_C100_1)}, diff --git a/queue-3.4/usb-xhci-check-for-xhci_plat-in-xhci_cleanup_msix.patch b/queue-3.4/usb-xhci-check-for-xhci_plat-in-xhci_cleanup_msix.patch new file mode 100644 index 00000000000..19f5f4a0c2c --- /dev/null +++ b/queue-3.4/usb-xhci-check-for-xhci_plat-in-xhci_cleanup_msix.patch @@ -0,0 +1,37 @@ +From 9005355af23856c55a5538c9024355785424821b Mon Sep 17 00:00:00 2001 +From: Jack Pham +Date: Fri, 15 Nov 2013 14:53:14 -0800 +Subject: usb: xhci: Check for XHCI_PLAT in xhci_cleanup_msix() + +From: Jack Pham + +commit 9005355af23856c55a5538c9024355785424821b upstream. + +If CONFIG_PCI is enabled, make sure xhci_cleanup_msix() +doesn't try to free a bogus PCI IRQ or dereference an invalid +pci_dev when the xHCI device is actually a platform_device. + +This patch should be backported to kernels as old as 3.9, that +contain the commit 52fb61250a7a132b0cfb9f4a1060a1f3c49e5a25 +"xhci-plat: Don't enable legacy PCI interrupts." + +Signed-off-by: Jack Pham +Signed-off-by: Sarah Sharp +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/xhci.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/usb/host/xhci.c ++++ b/drivers/usb/host/xhci.c +@@ -315,6 +315,9 @@ static void xhci_cleanup_msix(struct xhc + struct usb_hcd *hcd = xhci_to_hcd(xhci); + struct pci_dev *pdev = to_pci_dev(hcd->self.controller); + ++ if (xhci->quirks & XHCI_PLAT) ++ return; ++ + xhci_free_irq(xhci); + + if (xhci->msix_entries) { diff --git a/queue-3.4/x86-x32-correct-invalid-use-of-user-timespec-in-the-kernel.patch b/queue-3.4/x86-x32-correct-invalid-use-of-user-timespec-in-the-kernel.patch new file mode 100644 index 00000000000..3f817849b13 --- /dev/null +++ b/queue-3.4/x86-x32-correct-invalid-use-of-user-timespec-in-the-kernel.patch @@ -0,0 +1,80 @@ +From 2def2ef2ae5f3990aabdbe8a755911902707d268 Mon Sep 17 00:00:00 2001 +From: PaX Team +Date: Thu, 30 Jan 2014 16:59:25 -0800 +Subject: x86, x32: Correct invalid use of user timespec in the kernel + +From: PaX Team + +commit 2def2ef2ae5f3990aabdbe8a755911902707d268 upstream. + +The x32 case for the recvmsg() timout handling is broken: + + asmlinkage long compat_sys_recvmmsg(int fd, struct compat_mmsghdr __user *mmsg, + unsigned int vlen, unsigned int flags, + struct compat_timespec __user *timeout) + { + int datagrams; + struct timespec ktspec; + + if (flags & MSG_CMSG_COMPAT) + return -EINVAL; + + if (COMPAT_USE_64BIT_TIME) + return __sys_recvmmsg(fd, (struct mmsghdr __user *)mmsg, vlen, + flags | MSG_CMSG_COMPAT, + (struct timespec *) timeout); + ... + +The timeout pointer parameter is provided by userland (hence the __user +annotation) but for x32 syscalls it's simply cast to a kernel pointer +and is passed to __sys_recvmmsg which will eventually directly +dereference it for both reading and writing. Other callers to +__sys_recvmmsg properly copy from userland to the kernel first. + +The bug was introduced by commit ee4fa23c4bfc ("compat: Use +COMPAT_USE_64BIT_TIME in net/compat.c") and should affect all kernels +since 3.4 (and perhaps vendor kernels if they backported x32 support +along with this code). + +Note that CONFIG_X86_X32_ABI gets enabled at build time and only if +CONFIG_X86_X32 is enabled and ld can build x32 executables. + +Other uses of COMPAT_USE_64BIT_TIME seem fine. + +This addresses CVE-2014-0038. + +Signed-off-by: PaX Team +Signed-off-by: H. Peter Anvin +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + net/compat.c | 9 ++------- + 1 file changed, 2 insertions(+), 7 deletions(-) + +--- a/net/compat.c ++++ b/net/compat.c +@@ -789,21 +789,16 @@ asmlinkage long compat_sys_recvmmsg(int + if (flags & MSG_CMSG_COMPAT) + return -EINVAL; + +- if (COMPAT_USE_64BIT_TIME) +- return __sys_recvmmsg(fd, (struct mmsghdr __user *)mmsg, vlen, +- flags | MSG_CMSG_COMPAT, +- (struct timespec *) timeout); +- + if (timeout == NULL) + return __sys_recvmmsg(fd, (struct mmsghdr __user *)mmsg, vlen, + flags | MSG_CMSG_COMPAT, NULL); + +- if (get_compat_timespec(&ktspec, timeout)) ++ if (compat_get_timespec(&ktspec, timeout)) + return -EFAULT; + + datagrams = __sys_recvmmsg(fd, (struct mmsghdr __user *)mmsg, vlen, + flags | MSG_CMSG_COMPAT, &ktspec); +- if (datagrams > 0 && put_compat_timespec(&ktspec, timeout)) ++ if (datagrams > 0 && compat_put_timespec(&ktspec, timeout)) + datagrams = -EFAULT; + + return datagrams;