From: Greg Kroah-Hartman Date: Tue, 6 May 2014 22:52:39 +0000 (-0700) Subject: 3.14-stable patches X-Git-Tag: v3.14.4~15 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=b696fa1d35c6ce7862cff45b4cb184cc6a24c68c;p=thirdparty%2Fkernel%2Fstable-queue.git 3.14-stable patches added patches: ahci-do-not-receive-interrupts-sent-by-dummy-ports.patch ahci-do-not-request-irq-for-dummy-port.patch ahci-ensure-msi-revert-to-single-message-mode-is-not-enforced.patch arc-preempt-ensure-return-to-kernel-mode-is-irq-safe.patch arc-remove-arc_has_coh_rtsc.patch asoc-dapm-fix-widget-double-free-with-auto-disable-dapm-kcontrol.patch b43-fix-machine-check-error-due-to-improper-access-of-b43_mmio_psm_phy_hdr.patch framebuffer-fix-cfb_copyarea.patch iwlwifi-dvm-take-mutex-when-sending-sync-bt-config-command.patch iwlwifi-mvm-disable-uapsd-due-to-bugs-in-the-firmware.patch libata-ahci-accommodate-tag-ordered-controllers.patch libata-update-queued-trim-blacklist-for-m5x0-drives.patch mach64-fix-cursor-when-character-width-is-not-a-multiple-of-8-pixels.patch mach64-use-unaligned-access.patch matroxfb-restore-the-registers-m_access-and-m_pitch.patch powerpc-fix-oops-in-rtas_stop_self.patch powerpc-tm-disable-irq-in-tm_recheckpoint.patch revert-net-mvneta-fix-usage-as-a-module-on-rgmii-configurations.patch s390-bpf-jit-initialize-a-register-if-1st-insn-is-bpf_s_ldx_b_msh.patch s390-chsc-fix-sei-usage-on-old-fw-levels.patch sunrpc-ensure-call_connect_status-deals-correctly-with-softconn-tasks.patch sunrpc-ensure-that-call_connect-times-out-correctly.patch --- diff --git a/queue-3.14/ahci-do-not-receive-interrupts-sent-by-dummy-ports.patch b/queue-3.14/ahci-do-not-receive-interrupts-sent-by-dummy-ports.patch new file mode 100644 index 00000000000..cab80d7a31e --- /dev/null +++ b/queue-3.14/ahci-do-not-receive-interrupts-sent-by-dummy-ports.patch @@ -0,0 +1,61 @@ +From 2cf532f5e67c0cfe38c8c100e49280cdadacd2be Mon Sep 17 00:00:00 2001 +From: Alexander Gordeev +Date: Thu, 17 Apr 2014 18:06:15 +0200 +Subject: ahci: Do not receive interrupts sent by dummy ports + +From: Alexander Gordeev + +commit 2cf532f5e67c0cfe38c8c100e49280cdadacd2be upstream. + +In multiple MSI mode all AHCI ports (including dummy) get assigned +separate MSI vectors and (as result of execution +pci_enable_msi_exact() function) separate IRQ numbers, (mapped to the +MSI vectors). + +Therefore, although interrupts from dummy ports are not desired they +are still enabled. We do not request IRQs for dummy ports, but that +only means we do not assign AHCI-specific ISRs to corresponding IRQ +numbers. + +As result, dummy port interrupts still could come and traverse all the +way from the PCI device to the kernel, causing unnecessary overhead. + +This update disables IRQs for dummy ports and prevents the described +issue. + +Signed-off-by: Alexander Gordeev +Signed-off-by: Tejun Heo +Tested-by: David Milburn +Cc: linux-ide@vger.kernel.org +Fixes: 5ca72c4f7c41 ("AHCI: Support multiple MSIs") +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ata/ahci.c | 16 ++++++++++------ + 1 file changed, 10 insertions(+), 6 deletions(-) + +--- a/drivers/ata/ahci.c ++++ b/drivers/ata/ahci.c +@@ -1242,12 +1242,16 @@ int ahci_host_activate(struct ata_host * + for (i = 0; i < host->n_ports; i++) { + struct ahci_port_priv *pp = host->ports[i]->private_data; + +- /* pp is NULL for dummy ports */ +- if (pp) +- rc = devm_request_threaded_irq(host->dev, +- irq + i, ahci_hw_interrupt, +- ahci_thread_fn, IRQF_SHARED, +- pp->irq_desc, host->ports[i]); ++ /* Do not receive interrupts sent by dummy ports */ ++ if (!pp) { ++ disable_irq(irq + i); ++ continue; ++ } ++ ++ rc = devm_request_threaded_irq(host->dev, irq + i, ++ ahci_hw_interrupt, ++ ahci_thread_fn, IRQF_SHARED, ++ pp->irq_desc, host->ports[i]); + if (rc) + goto out_free_irqs; + } diff --git a/queue-3.14/ahci-do-not-request-irq-for-dummy-port.patch b/queue-3.14/ahci-do-not-request-irq-for-dummy-port.patch new file mode 100644 index 00000000000..db32a9d0889 --- /dev/null +++ b/queue-3.14/ahci-do-not-request-irq-for-dummy-port.patch @@ -0,0 +1,134 @@ +From 9ae794ac5e407d3bc3fec785db481d5a2c0fa275 Mon Sep 17 00:00:00 2001 +From: David Milburn +Date: Wed, 16 Apr 2014 11:43:46 -0500 +Subject: ahci: do not request irq for dummy port + +From: David Milburn + +commit 9ae794ac5e407d3bc3fec785db481d5a2c0fa275 upstream. + +System may crash in ahci_hw_interrupt() or ahci_thread_fn() when +accessing the interrupt status in a port's private_data if the port is +actually a DUMMY port. + +00:1f.2 SATA controller: Intel Corporation 82801JI (ICH10 Family) SATA AHCI Controller + + +[ 9.352080] ahci 0000:00:1f.2: AHCI 0001.0200 32 slots 6 ports 3 Gbps 0x1 impl SATA mode +[ 9.352084] ahci 0000:00:1f.2: flags: 64bit ncq sntf pm led clo pio slum part ccc +[ 9.368155] Console: switching to colour frame buffer device 128x48 +[ 9.439759] mgag200 0000:11:00.0: fb0: mgadrmfb frame buffer device +[ 9.446765] mgag200 0000:11:00.0: registered panic notifier +[ 9.470166] scsi1 : ahci +[ 9.479166] scsi2 : ahci +[ 9.488172] scsi3 : ahci +[ 9.497174] scsi4 : ahci +[ 9.506175] scsi5 : ahci +[ 9.515174] scsi6 : ahci +[ 9.518181] ata1: SATA max UDMA/133 abar m2048@0x95c00000 port 0x95c00100 irq 91 +[ 9.526448] ata2: DUMMY +[ 9.529182] ata3: DUMMY +[ 9.531916] ata4: DUMMY +[ 9.534650] ata5: DUMMY +[ 9.537382] ata6: DUMMY +[ 9.576196] [drm] Initialized mgag200 1.0.0 20110418 for 0000:11:00.0 on minor 0 +[ 9.845257] ata1: SATA link up 1.5 Gbps (SStatus 113 SControl 300) +[ 9.865161] ata1.00: ATAPI: Optiarc DVD RW AD-7580S, FX04, max UDMA/100 +[ 9.891407] ata1.00: configured for UDMA/100 +[ 9.900525] scsi 1:0:0:0: CD-ROM Optiarc DVD RW AD-7580S FX04 PQ: 0 ANSI: 5 +[ 10.247399] iTCO_vendor_support: vendor-support=0 +[ 10.261572] iTCO_wdt: Intel TCO WatchDog Timer Driver v1.11 +[ 10.269764] iTCO_wdt: unable to reset NO_REBOOT flag, device disabled by hardware/BIOS +[ 10.301932] sd 0:2:0:0: [sda] 570310656 512-byte logical blocks: (291 GB/271 GiB) +[ 10.317085] sd 0:2:0:0: [sda] Write Protect is off +[ 10.328326] sd 0:2:0:0: [sda] Write cache: disabled, read cache: disabled, supports DPO and FUA +[ 10.375452] BUG: unable to handle kernel NULL pointer dereference at 000000000000003c +[ 10.384217] IP: [] ahci_hw_interrupt+0x100/0x130 [libahci] +[ 10.392101] PGD 0 +[ 10.394353] Oops: 0000 [#1] SMP +[ 10.397978] Modules linked in: sr_mod(+) cdrom sd_mod iTCO_wdt crc_t10dif iTCO_vendor_support crct10dif_common ahci libahci libata lpc_ich mfd_core mgag200 syscopyarea sysfillrect sysimgblt i2c_algo_bit drm_kms_helper ttm drm i2c_core megaraid_sas dm_mirror dm_region_hash +dm_log dm_mod +[ 10.426499] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 3.15.0-rc1 #1 +[ 10.433495] Hardware name: QCI QSSC-S4R/QSSC-S4R, BIOS QSSC-S4R.QCI.01.00.S013.032920111005 03/29/2011 +[ 10.443886] task: ffffffff81906460 ti: ffffffff818f0000 task.ti: ffffffff818f0000 +[ 10.452239] RIP: 0010:[] [] ahci_hw_interrupt+0x100/0x130 [libahci] +[ 10.462838] RSP: 0018:ffff880033c03d98 EFLAGS: 00010046 +[ 10.468767] RAX: 0000000000a400a4 RBX: ffff880029a6bc18 RCX: 00000000fffffffa +[ 10.476731] RDX: 00000000000000a4 RSI: ffff880029bb0000 RDI: ffff880029a6bc18 +[ 10.484696] RBP: ffff880033c03dc8 R08: 0000000000000000 R09: ffff88002f800490 +[ 10.492661] R10: 0000000000000000 R11: 0000000000000005 R12: 0000000000000000 +[ 10.500625] R13: ffff880029a6bd98 R14: 0000000000000000 R15: ffffc90000194000 +[ 10.508590] FS: 0000000000000000(0000) GS:ffff880033c00000(0000) knlGS:0000000000000000 +[ 10.517623] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b +[ 10.524035] CR2: 000000000000003c CR3: 00000000328ff000 CR4: 00000000000007b0 +[ 10.531999] Stack: +[ 10.534241] 0000000000000017 ffff880031ba7d00 000000000000005c ffff880031ba7d00 +[ 10.542535] 0000000000000000 000000000000005c ffff880033c03e10 ffffffff810c2a1e +[ 10.550827] ffff880031ae2900 000000008108fb4f ffff880031ae2900 ffff880031ae2984 +[ 10.559121] Call Trace: +[ 10.561849] +[ 10.563994] [] handle_irq_event_percpu+0x3e/0x1a0 +[ 10.571309] [] handle_irq_event+0x3d/0x60 +[ 10.577631] [] try_one_irq.isra.6+0x8d/0xf0 +[ 10.584142] [] note_interrupt+0x173/0x1f0 +[ 10.590460] [] handle_irq_event_percpu+0xae/0x1a0 +[ 10.597554] [] handle_irq_event+0x3d/0x60 +[ 10.603872] [] handle_edge_irq+0x77/0x130 +[ 10.610199] [] handle_irq+0xbf/0x150 +[ 10.616040] [] ? vtime_account_idle+0xe/0x50 +[ 10.622654] [] ? atomic_notifier_call_chain+0x1a/0x20 +[ 10.630140] [] do_IRQ+0x4f/0xf0 +[ 10.635490] [] common_interrupt+0x6d/0x6d +[ 10.641805] +[ 10.643950] [] ? cpuidle_enter_state+0x4f/0xc0 +[ 10.650972] [] ? cpuidle_enter_state+0x48/0xc0 +[ 10.657775] [] cpuidle_enter+0x17/0x20 +[ 10.663807] [] cpu_startup_entry+0x2c0/0x3d0 +[ 10.670423] [] rest_init+0x77/0x80 +[ 10.676065] [] start_kernel+0x40f/0x41a +[ 10.682190] [] ? repair_env_string+0x5c/0x5c +[ 10.688799] [] ? early_idt_handlers+0x120/0x120 +[ 10.695699] [] x86_64_start_reservations+0x2a/0x2c +[ 10.702889] [] x86_64_start_kernel+0x143/0x152 +[ 10.709689] Code: a0 fc ff 85 c0 8b 4d d4 74 c3 48 8b 7b 08 89 ca 48 c7 c6 60 66 13 a0 31 c0 e8 9d 70 28 e1 8b 4d d4 eb aa 0f 1f 84 00 00 00 00 00 <45> 8b 64 24 3c 48 89 df e8 23 47 4c e1 41 83 fc 01 19 c0 48 83 +[ 10.731470] RIP [] ahci_hw_interrupt+0x100/0x130 [libahci] +[ 10.739441] RSP +[ 10.743333] CR2: 000000000000003c +[ 10.747032] ---[ end trace b6e82636970e2690 ]--- +[ 10.760190] Kernel panic - not syncing: Fatal exception in interrupt +[ 10.767291] Kernel Offset: 0x0 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffff9fffffff) + +Cc: Alexander Gordeev +Cc: Tejun Heo +Signed-of-by: David Milburn +Fixes: 5ca72c4f7c41 ("AHCI: Support multiple MSIs") + +--- + drivers/ata/ahci.c | 12 ++++-------- + 1 file changed, 4 insertions(+), 8 deletions(-) + +--- a/drivers/ata/ahci.c ++++ b/drivers/ata/ahci.c +@@ -1233,18 +1233,14 @@ int ahci_host_activate(struct ata_host * + return rc; + + for (i = 0; i < host->n_ports; i++) { +- const char* desc; + struct ahci_port_priv *pp = host->ports[i]->private_data; + + /* pp is NULL for dummy ports */ + if (pp) +- desc = pp->irq_desc; +- else +- desc = dev_driver_string(host->dev); +- +- rc = devm_request_threaded_irq(host->dev, +- irq + i, ahci_hw_interrupt, ahci_thread_fn, IRQF_SHARED, +- desc, host->ports[i]); ++ rc = devm_request_threaded_irq(host->dev, ++ irq + i, ahci_hw_interrupt, ++ ahci_thread_fn, IRQF_SHARED, ++ pp->irq_desc, host->ports[i]); + if (rc) + goto out_free_irqs; + } diff --git a/queue-3.14/ahci-ensure-msi-revert-to-single-message-mode-is-not-enforced.patch b/queue-3.14/ahci-ensure-msi-revert-to-single-message-mode-is-not-enforced.patch new file mode 100644 index 00000000000..d96df86eb29 --- /dev/null +++ b/queue-3.14/ahci-ensure-msi-revert-to-single-message-mode-is-not-enforced.patch @@ -0,0 +1,93 @@ +From ab0f9e78b97f5193dd38b3757b42b6fbded05fb7 Mon Sep 17 00:00:00 2001 +From: Alexander Gordeev +Date: Thu, 17 Apr 2014 14:13:49 +0200 +Subject: ahci: Ensure "MSI Revert to Single Message" mode is not enforced + +From: Alexander Gordeev + +commit ab0f9e78b97f5193dd38b3757b42b6fbded05fb7 upstream. + +The AHCI specification allows hardware to choose to revert to +single MSI mode when fewer messages are allocated than requested. +Yet, at least ICH10 chipset reverts to single MSI mode even when +enough messages are allocated in some cases (see below). + +This update forces the driver to not rely on initialization of +multiple MSIs mode alone and always check if "MSI Revert to +Single Message" (MRSM) mode was enforced by the controller and +fallback to the single MSI mode in case it did. + +That prevents a situation when the driver configured multiple +per-port IRQ handlers, but the controller sends all port's +interrupts to a single IRQ, which could easily screw up the +interrupt handling and lead to delays and possibly crashes. + +The fix was tested on a 6-port controller that successfully +reverted to the single MSI mode: + +00:1f.2 SATA controller: Intel Corporation 82801JI (ICH10 Family) SATA +AHCI Controller (prog-if 01 [AHCI 1.0]) + Subsystem: Super Micro Computer Inc Device 10a7 + Flags: bus master, 66MHz, medium devsel, latency 0, IRQ 101 + I/O ports at f110 [size=8] + I/O ports at f100 [size=4] + I/O ports at f0f0 [size=8] + I/O ports at f0e0 [size=4] + I/O ports at f020 [size=32] + Memory at fbf00000 (32-bit, non-prefetchable) [size=2K] + Capabilities: [80] MSI: Enable+ Count=1/16 Maskable- 64bit- + Capabilities: [70] Power Management version 3 + Capabilities: [a8] SATA HBA v1.0 + Capabilities: [b0] PCI Advanced Features + Kernel driver in use: ahci + +With 6 ports just 8 MSI vectors should be enough, but the adapter +enforces the MRSM mode when less than 16 vectors are written to +the Multiple Messages Enable PCI register. I instigated MRSM mode +by forcing @nvec to 8 in ahci_init_interrupts(). + +Signed-off-by: Alexander Gordeev +Cc: linux-ide@vger.kernel.org +Signed-off-by: Tejun Heo +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ata/ahci.c | 9 ++++++++- + drivers/ata/ahci.h | 1 + + 2 files changed, 9 insertions(+), 1 deletion(-) + +--- a/drivers/ata/ahci.c ++++ b/drivers/ata/ahci.c +@@ -1163,7 +1163,7 @@ static inline void ahci_gtf_filter_worka + #endif + + static int ahci_init_interrupts(struct pci_dev *pdev, unsigned int n_ports, +- struct ahci_host_priv *hpriv) ++ struct ahci_host_priv *hpriv) + { + int rc, nvec; + +@@ -1189,6 +1189,13 @@ static int ahci_init_interrupts(struct p + else if (rc > 0) + goto single_msi; + ++ /* fallback to single MSI mode if the controller enforced MRSM mode */ ++ if (readl(hpriv->mmio + HOST_CTL) & HOST_MRSM) { ++ pci_disable_msi(pdev); ++ printk(KERN_INFO "ahci: MRSM is on, fallback to single MSI\n"); ++ goto single_msi; ++ } ++ + return nvec; + + single_msi: +--- a/drivers/ata/ahci.h ++++ b/drivers/ata/ahci.h +@@ -91,6 +91,7 @@ enum { + /* HOST_CTL bits */ + HOST_RESET = (1 << 0), /* reset controller; self-clear */ + HOST_IRQ_EN = (1 << 1), /* global IRQ enable */ ++ HOST_MRSM = (1 << 2), /* MSI Revert to Single Message */ + HOST_AHCI_EN = (1 << 31), /* AHCI enabled */ + + /* HOST_CAP bits */ diff --git a/queue-3.14/arc-preempt-ensure-return-to-kernel-mode-is-irq-safe.patch b/queue-3.14/arc-preempt-ensure-return-to-kernel-mode-is-irq-safe.patch new file mode 100644 index 00000000000..8694f9c64a5 --- /dev/null +++ b/queue-3.14/arc-preempt-ensure-return-to-kernel-mode-is-irq-safe.patch @@ -0,0 +1,54 @@ +From 8aa9e85adac609588eeec356e5a85059b3b819ba Mon Sep 17 00:00:00 2001 +From: Vineet Gupta +Date: Wed, 30 Apr 2014 15:26:45 +0530 +Subject: ARC: !PREEMPT: Ensure Return to kernel mode is IRQ safe + +From: Vineet Gupta + +commit 8aa9e85adac609588eeec356e5a85059b3b819ba upstream. + +There was a very small race window where resume to kernel mode from a +Exception Path (or pure kernel mode which is true for most of ARC +exceptions anyways), was not disabling interrupts in restore_regs, +clobbering the exception regs + +Anton found the culprit call flow (after many sleepless nights) + +| 1. we got a Trap from user land +| 2. started to service it. +| 3. While doing some stuff on user-land memory (I think it is padzero()), +| we got a DataTlbMiss +| 4. On return from it we are taking "resume_kernel_mode" path +| 5. NEED_RESHED is not set, so we go to "return from exception" path in +| restore regs. +| 6. there seems to be IRQ happening + +Signed-off-by: Vineet Gupta +Cc: Anton Kolesov +Cc: Francois Bedard +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arc/kernel/entry.S | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +--- a/arch/arc/kernel/entry.S ++++ b/arch/arc/kernel/entry.S +@@ -614,11 +614,13 @@ resume_user_mode_begin: + + resume_kernel_mode: + +-#ifdef CONFIG_PREEMPT +- +- ; This is a must for preempt_schedule_irq() ++ ; Disable Interrupts from this point on ++ ; CONFIG_PREEMPT: This is a must for preempt_schedule_irq() ++ ; !CONFIG_PREEMPT: To ensure restore_regs is intr safe + IRQ_DISABLE r9 + ++#ifdef CONFIG_PREEMPT ++ + ; Can't preempt if preemption disabled + GET_CURR_THR_INFO_FROM_SP r10 + ld r8, [r10, THREAD_INFO_PREEMPT_COUNT] diff --git a/queue-3.14/arc-remove-arc_has_coh_rtsc.patch b/queue-3.14/arc-remove-arc_has_coh_rtsc.patch new file mode 100644 index 00000000000..64ad03d8f6f --- /dev/null +++ b/queue-3.14/arc-remove-arc_has_coh_rtsc.patch @@ -0,0 +1,31 @@ +From d345ea2892ae7a2b70f84cf881c20731e43e4993 Mon Sep 17 00:00:00 2001 +From: Richard Weinberger +Date: Sun, 9 Feb 2014 19:48:05 +0100 +Subject: ARC: Remove ARC_HAS_COH_RTSC + +From: Richard Weinberger + +commit d345ea2892ae7a2b70f84cf881c20731e43e4993 upstream. + +The symbol is an orphan, get rid of it. + +Fixes: 7d0857a54aed ("ARC: [SMP] Disallow RTSC") +Signed-off-by: Richard Weinberger +Acked-by: Paul Bolle +Signed-off-by: Vineet Gupta +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arc/plat-arcfpga/Kconfig | 1 - + 1 file changed, 1 deletion(-) + +--- a/arch/arc/plat-arcfpga/Kconfig ++++ b/arch/arc/plat-arcfpga/Kconfig +@@ -33,7 +33,6 @@ config ISS_SMP_EXTN + bool "ARC SMP Extensions (ISS Models only)" + default n + depends on SMP +- select ARC_HAS_COH_RTSC + help + SMP Extensions to ARC700, in a "simulation only" Model, supported in + ARC ISS (Instruction Set Simulator). diff --git a/queue-3.14/asoc-dapm-fix-widget-double-free-with-auto-disable-dapm-kcontrol.patch b/queue-3.14/asoc-dapm-fix-widget-double-free-with-auto-disable-dapm-kcontrol.patch new file mode 100644 index 00000000000..0213def1de4 --- /dev/null +++ b/queue-3.14/asoc-dapm-fix-widget-double-free-with-auto-disable-dapm-kcontrol.patch @@ -0,0 +1,68 @@ +From 2697e4fb9209dfe1d1b24c92d254158f63d4bc8e Mon Sep 17 00:00:00 2001 +From: Jarkko Nikula +Date: Tue, 15 Apr 2014 16:58:09 +0300 +Subject: ASoC: dapm: Fix widget double free with auto-disable DAPM kcontrol + +From: Jarkko Nikula + +commit 2697e4fb9209dfe1d1b24c92d254158f63d4bc8e upstream. + +Commit 9e1fda4ae158 ("ASoC: dapm: Implement mixer input auto-disable") +is trying to free the widget it allocated by snd_soc_dapm_new_control() +call in dapm_kcontrol_data_alloc() by adding kfree(data->widget) to +dapm_kcontrol_free(). + +This is causing a widget double free with auto-disabled DAPM kcontrols +in sound card unregistration because widgets are already freed before +dapm_kcontrol_free() is called. + +Reason for that is all widgets are added into dapm->card->widgets list +in snd_soc_dapm_new_control() and freed in dapm_free_widgets() during +execution of snd_soc_dapm_free(). + +Now snd_soc_dapm_free() calls for different DAPM contexts happens before +snd_card_free() call from where the call chain to dapm_kcontrol_free() +begins: + +soc_cleanup_card_resources() + soc_remove_dai_links() + soc_remove_link_dais() + snd_soc_dapm_free(&cpu_dai->dapm) + soc_remove_link_components() + soc_remove_platform() + snd_soc_dapm_free(&platform->dapm) + soc_remove_codec() + snd_soc_dapm_free(&codec->dapm) + snd_soc_dapm_free(&card->dapm) + snd_card_free() + snd_card_do_free() + snd_device_free_all() + snd_device_free() + snd_ctl_dev_free() + snd_ctl_remove() + snd_ctl_free_one() + dapm_kcontrol_free() + +This wasn't making harm with ordinary DAPM kcontrols since data->widget is NULL for +them. + +Fixes: 9e1fda4ae158 (ASoC: dapm: Implement mixer input auto-disable) +Signed-off-by: Jarkko Nikula +Acked-by: Lars-Peter Clausen +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/soc-dapm.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/sound/soc/soc-dapm.c ++++ b/sound/soc/soc-dapm.c +@@ -251,7 +251,6 @@ static int dapm_kcontrol_data_alloc(stru + static void dapm_kcontrol_free(struct snd_kcontrol *kctl) + { + struct dapm_kcontrol_data *data = snd_kcontrol_chip(kctl); +- kfree(data->widget); + kfree(data->wlist); + kfree(data); + } diff --git a/queue-3.14/b43-fix-machine-check-error-due-to-improper-access-of-b43_mmio_psm_phy_hdr.patch b/queue-3.14/b43-fix-machine-check-error-due-to-improper-access-of-b43_mmio_psm_phy_hdr.patch new file mode 100644 index 00000000000..7c4b43796e1 --- /dev/null +++ b/queue-3.14/b43-fix-machine-check-error-due-to-improper-access-of-b43_mmio_psm_phy_hdr.patch @@ -0,0 +1,65 @@ +From 12cd43c6ed6da7bf7c5afbd74da6959cda6d056b Mon Sep 17 00:00:00 2001 +From: Rafał Miłecki +Date: Sat, 5 Apr 2014 18:08:25 +0200 +Subject: b43: Fix machine check error due to improper access of B43_MMIO_PSM_PHY_HDR +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rafał Miłecki + +commit 12cd43c6ed6da7bf7c5afbd74da6959cda6d056b upstream. + +Register B43_MMIO_PSM_PHY_HDR is 16 bit one, so accessing it with 32b +functions isn't safe. On my machine it causes delayed (!) CPU exception: + +Disabling lock debugging due to kernel taint +mce: [Hardware Error]: CPU 0: Machine Check Exception: 4 Bank 4: b200000000070f0f +mce: [Hardware Error]: TSC 164083803dc +mce: [Hardware Error]: PROCESSOR 2:20fc2 TIME 1396650505 SOCKET 0 APIC 0 microcode 0 +mce: [Hardware Error]: Run the above through 'mcelog --ascii' +mce: [Hardware Error]: Machine check: Processor context corrupt +Kernel panic - not syncing: Fatal machine check on current CPU +Kernel Offset: 0x0 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffff9fffffff) + +Signed-off-by: Rafał Miłecki +Acked-by: Larry Finger +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/b43/phy_n.c | 14 +++++++------- + 1 file changed, 7 insertions(+), 7 deletions(-) + +--- a/drivers/net/wireless/b43/phy_n.c ++++ b/drivers/net/wireless/b43/phy_n.c +@@ -5176,22 +5176,22 @@ static void b43_nphy_channel_setup(struc + int ch = new_channel->hw_value; + + u16 old_band_5ghz; +- u32 tmp32; ++ u16 tmp16; + + old_band_5ghz = + b43_phy_read(dev, B43_NPHY_BANDCTL) & B43_NPHY_BANDCTL_5GHZ; + if (new_channel->band == IEEE80211_BAND_5GHZ && !old_band_5ghz) { +- tmp32 = b43_read32(dev, B43_MMIO_PSM_PHY_HDR); +- b43_write32(dev, B43_MMIO_PSM_PHY_HDR, tmp32 | 4); ++ tmp16 = b43_read16(dev, B43_MMIO_PSM_PHY_HDR); ++ b43_write16(dev, B43_MMIO_PSM_PHY_HDR, tmp16 | 4); + b43_phy_set(dev, B43_PHY_B_BBCFG, 0xC000); +- b43_write32(dev, B43_MMIO_PSM_PHY_HDR, tmp32); ++ b43_write16(dev, B43_MMIO_PSM_PHY_HDR, tmp16); + b43_phy_set(dev, B43_NPHY_BANDCTL, B43_NPHY_BANDCTL_5GHZ); + } else if (new_channel->band == IEEE80211_BAND_2GHZ && old_band_5ghz) { + b43_phy_mask(dev, B43_NPHY_BANDCTL, ~B43_NPHY_BANDCTL_5GHZ); +- tmp32 = b43_read32(dev, B43_MMIO_PSM_PHY_HDR); +- b43_write32(dev, B43_MMIO_PSM_PHY_HDR, tmp32 | 4); ++ tmp16 = b43_read16(dev, B43_MMIO_PSM_PHY_HDR); ++ b43_write16(dev, B43_MMIO_PSM_PHY_HDR, tmp16 | 4); + b43_phy_mask(dev, B43_PHY_B_BBCFG, 0x3FFF); +- b43_write32(dev, B43_MMIO_PSM_PHY_HDR, tmp32); ++ b43_write16(dev, B43_MMIO_PSM_PHY_HDR, tmp16); + } + + b43_chantab_phy_upload(dev, e); diff --git a/queue-3.14/framebuffer-fix-cfb_copyarea.patch b/queue-3.14/framebuffer-fix-cfb_copyarea.patch new file mode 100644 index 00000000000..3513e07dec5 --- /dev/null +++ b/queue-3.14/framebuffer-fix-cfb_copyarea.patch @@ -0,0 +1,400 @@ +From 00a9d699bc85052d2d3ed56251cd928024ce06a3 Mon Sep 17 00:00:00 2001 +From: Mikulas Patocka +Date: Thu, 23 Jan 2014 14:39:29 -0500 +Subject: framebuffer: fix cfb_copyarea + +From: Mikulas Patocka + +commit 00a9d699bc85052d2d3ed56251cd928024ce06a3 upstream. + +The function cfb_copyarea is buggy when the copy operation is not aligned on +long boundary (4 bytes on 32-bit machines, 8 bytes on 64-bit machines). + +How to reproduce: +- use x86-64 machine +- use a framebuffer driver without acceleration (for example uvesafb) +- set the framebuffer to 8-bit depth + (for example fbset -a 1024x768-60 -depth 8) +- load a font with character width that is not a multiple of 8 pixels + note: the console-tools package cannot load a font that has + width different from 8 pixels. You need to install the packages + "kbd" and "console-terminus" and use the program "setfont" to + set font width (for example: setfont Uni2-Terminus20x10) +- move some text left and right on the bash command line and you get a + screen corruption + +To expose more bugs, put this line to the end of uvesafb_init_info: +info->flags |= FBINFO_HWACCEL_COPYAREA | FBINFO_READS_FAST; +- Now framebuffer console will use cfb_copyarea for console scrolling. +You get a screen corruption when console is scrolled. + +This patch is a rewrite of cfb_copyarea. It fixes the bugs, with this +patch, console scrolling in 8-bit depth with a font width that is not a +multiple of 8 pixels works fine. + +The cfb_copyarea code was very buggy and it looks like it was written +and never tried with non-8-pixel font. + +Signed-off-by: Mikulas Patocka +Signed-off-by: Tomi Valkeinen +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/video/cfbcopyarea.c | 153 ++++++++++++++++++++++---------------------- + 1 file changed, 78 insertions(+), 75 deletions(-) + +--- a/drivers/video/cfbcopyarea.c ++++ b/drivers/video/cfbcopyarea.c +@@ -43,13 +43,22 @@ + */ + + static void +-bitcpy(struct fb_info *p, unsigned long __iomem *dst, int dst_idx, +- const unsigned long __iomem *src, int src_idx, int bits, ++bitcpy(struct fb_info *p, unsigned long __iomem *dst, unsigned dst_idx, ++ const unsigned long __iomem *src, unsigned src_idx, int bits, + unsigned n, u32 bswapmask) + { + unsigned long first, last; + int const shift = dst_idx-src_idx; +- int left, right; ++ ++#if 0 ++ /* ++ * If you suspect bug in this function, compare it with this simple ++ * memmove implementation. ++ */ ++ fb_memmove((char *)dst + ((dst_idx & (bits - 1))) / 8, ++ (char *)src + ((src_idx & (bits - 1))) / 8, n / 8); ++ return; ++#endif + + first = fb_shifted_pixels_mask_long(p, dst_idx, bswapmask); + last = ~fb_shifted_pixels_mask_long(p, (dst_idx+n) % bits, bswapmask); +@@ -98,9 +107,8 @@ bitcpy(struct fb_info *p, unsigned long + unsigned long d0, d1; + int m; + +- right = shift & (bits - 1); +- left = -shift & (bits - 1); +- bswapmask &= shift; ++ int const left = shift & (bits - 1); ++ int const right = -shift & (bits - 1); + + if (dst_idx+n <= bits) { + // Single destination word +@@ -110,15 +118,15 @@ bitcpy(struct fb_info *p, unsigned long + d0 = fb_rev_pixels_in_long(d0, bswapmask); + if (shift > 0) { + // Single source word +- d0 >>= right; ++ d0 <<= left; + } else if (src_idx+n <= bits) { + // Single source word +- d0 <<= left; ++ d0 >>= right; + } else { + // 2 source words + d1 = FB_READL(src + 1); + d1 = fb_rev_pixels_in_long(d1, bswapmask); +- d0 = d0<>right; ++ d0 = d0 >> right | d1 << left; + } + d0 = fb_rev_pixels_in_long(d0, bswapmask); + FB_WRITEL(comp(d0, FB_READL(dst), first), dst); +@@ -135,60 +143,59 @@ bitcpy(struct fb_info *p, unsigned long + if (shift > 0) { + // Single source word + d1 = d0; +- d0 >>= right; +- dst++; ++ d0 <<= left; + n -= bits - dst_idx; + } else { + // 2 source words + d1 = FB_READL(src++); + d1 = fb_rev_pixels_in_long(d1, bswapmask); + +- d0 = d0<>right; +- dst++; ++ d0 = d0 >> right | d1 << left; + n -= bits - dst_idx; + } + d0 = fb_rev_pixels_in_long(d0, bswapmask); + FB_WRITEL(comp(d0, FB_READL(dst), first), dst); + d0 = d1; ++ dst++; + + // Main chunk + m = n % bits; + n /= bits; + while ((n >= 4) && !bswapmask) { + d1 = FB_READL(src++); +- FB_WRITEL(d0 << left | d1 >> right, dst++); ++ FB_WRITEL(d0 >> right | d1 << left, dst++); + d0 = d1; + d1 = FB_READL(src++); +- FB_WRITEL(d0 << left | d1 >> right, dst++); ++ FB_WRITEL(d0 >> right | d1 << left, dst++); + d0 = d1; + d1 = FB_READL(src++); +- FB_WRITEL(d0 << left | d1 >> right, dst++); ++ FB_WRITEL(d0 >> right | d1 << left, dst++); + d0 = d1; + d1 = FB_READL(src++); +- FB_WRITEL(d0 << left | d1 >> right, dst++); ++ FB_WRITEL(d0 >> right | d1 << left, dst++); + d0 = d1; + n -= 4; + } + while (n--) { + d1 = FB_READL(src++); + d1 = fb_rev_pixels_in_long(d1, bswapmask); +- d0 = d0 << left | d1 >> right; ++ d0 = d0 >> right | d1 << left; + d0 = fb_rev_pixels_in_long(d0, bswapmask); + FB_WRITEL(d0, dst++); + d0 = d1; + } + + // Trailing bits +- if (last) { +- if (m <= right) { ++ if (m) { ++ if (m <= bits - right) { + // Single source word +- d0 <<= left; ++ d0 >>= right; + } else { + // 2 source words + d1 = FB_READL(src); + d1 = fb_rev_pixels_in_long(d1, + bswapmask); +- d0 = d0<>right; ++ d0 = d0 >> right | d1 << left; + } + d0 = fb_rev_pixels_in_long(d0, bswapmask); + FB_WRITEL(comp(d0, FB_READL(dst), last), dst); +@@ -202,43 +209,46 @@ bitcpy(struct fb_info *p, unsigned long + */ + + static void +-bitcpy_rev(struct fb_info *p, unsigned long __iomem *dst, int dst_idx, +- const unsigned long __iomem *src, int src_idx, int bits, ++bitcpy_rev(struct fb_info *p, unsigned long __iomem *dst, unsigned dst_idx, ++ const unsigned long __iomem *src, unsigned src_idx, int bits, + unsigned n, u32 bswapmask) + { + unsigned long first, last; + int shift; + +- dst += (n-1)/bits; +- src += (n-1)/bits; +- if ((n-1) % bits) { +- dst_idx += (n-1) % bits; +- dst += dst_idx >> (ffs(bits) - 1); +- dst_idx &= bits - 1; +- src_idx += (n-1) % bits; +- src += src_idx >> (ffs(bits) - 1); +- src_idx &= bits - 1; +- } ++#if 0 ++ /* ++ * If you suspect bug in this function, compare it with this simple ++ * memmove implementation. ++ */ ++ fb_memmove((char *)dst + ((dst_idx & (bits - 1))) / 8, ++ (char *)src + ((src_idx & (bits - 1))) / 8, n / 8); ++ return; ++#endif ++ ++ dst += (dst_idx + n - 1) / bits; ++ src += (src_idx + n - 1) / bits; ++ dst_idx = (dst_idx + n - 1) % bits; ++ src_idx = (src_idx + n - 1) % bits; + + shift = dst_idx-src_idx; + +- first = fb_shifted_pixels_mask_long(p, bits - 1 - dst_idx, bswapmask); +- last = ~fb_shifted_pixels_mask_long(p, bits - 1 - ((dst_idx-n) % bits), +- bswapmask); ++ first = ~fb_shifted_pixels_mask_long(p, (dst_idx + 1) % bits, bswapmask); ++ last = fb_shifted_pixels_mask_long(p, (bits + dst_idx + 1 - n) % bits, bswapmask); + + if (!shift) { + // Same alignment for source and dest + + if ((unsigned long)dst_idx+1 >= n) { + // Single word +- if (last) +- first &= last; +- FB_WRITEL( comp( FB_READL(src), FB_READL(dst), first), dst); ++ if (first) ++ last &= first; ++ FB_WRITEL( comp( FB_READL(src), FB_READL(dst), last), dst); + } else { + // Multiple destination words + + // Leading bits +- if (first != ~0UL) { ++ if (first) { + FB_WRITEL( comp( FB_READL(src), FB_READL(dst), first), dst); + dst--; + src--; +@@ -262,7 +272,7 @@ bitcpy_rev(struct fb_info *p, unsigned l + FB_WRITEL(FB_READL(src--), dst--); + + // Trailing bits +- if (last) ++ if (last != -1UL) + FB_WRITEL( comp( FB_READL(src), FB_READL(dst), last), dst); + } + } else { +@@ -270,29 +280,28 @@ bitcpy_rev(struct fb_info *p, unsigned l + unsigned long d0, d1; + int m; + +- int const left = -shift & (bits-1); +- int const right = shift & (bits-1); +- bswapmask &= shift; ++ int const left = shift & (bits-1); ++ int const right = -shift & (bits-1); + + if ((unsigned long)dst_idx+1 >= n) { + // Single destination word +- if (last) +- first &= last; ++ if (first) ++ last &= first; + d0 = FB_READL(src); + if (shift < 0) { + // Single source word +- d0 <<= left; ++ d0 >>= right; + } else if (1+(unsigned long)src_idx >= n) { + // Single source word +- d0 >>= right; ++ d0 <<= left; + } else { + // 2 source words + d1 = FB_READL(src - 1); + d1 = fb_rev_pixels_in_long(d1, bswapmask); +- d0 = d0>>right | d1<> right; + } + d0 = fb_rev_pixels_in_long(d0, bswapmask); +- FB_WRITEL(comp(d0, FB_READL(dst), first), dst); ++ FB_WRITEL(comp(d0, FB_READL(dst), last), dst); + } else { + // Multiple destination words + /** We must always remember the last value read, because in case +@@ -307,12 +316,12 @@ bitcpy_rev(struct fb_info *p, unsigned l + if (shift < 0) { + // Single source word + d1 = d0; +- d0 <<= left; ++ d0 >>= right; + } else { + // 2 source words + d1 = FB_READL(src--); + d1 = fb_rev_pixels_in_long(d1, bswapmask); +- d0 = d0>>right | d1<> right; + } + d0 = fb_rev_pixels_in_long(d0, bswapmask); + FB_WRITEL(comp(d0, FB_READL(dst), first), dst); +@@ -325,39 +334,39 @@ bitcpy_rev(struct fb_info *p, unsigned l + n /= bits; + while ((n >= 4) && !bswapmask) { + d1 = FB_READL(src--); +- FB_WRITEL(d0 >> right | d1 << left, dst--); ++ FB_WRITEL(d0 << left | d1 >> right, dst--); + d0 = d1; + d1 = FB_READL(src--); +- FB_WRITEL(d0 >> right | d1 << left, dst--); ++ FB_WRITEL(d0 << left | d1 >> right, dst--); + d0 = d1; + d1 = FB_READL(src--); +- FB_WRITEL(d0 >> right | d1 << left, dst--); ++ FB_WRITEL(d0 << left | d1 >> right, dst--); + d0 = d1; + d1 = FB_READL(src--); +- FB_WRITEL(d0 >> right | d1 << left, dst--); ++ FB_WRITEL(d0 << left | d1 >> right, dst--); + d0 = d1; + n -= 4; + } + while (n--) { + d1 = FB_READL(src--); + d1 = fb_rev_pixels_in_long(d1, bswapmask); +- d0 = d0 >> right | d1 << left; ++ d0 = d0 << left | d1 >> right; + d0 = fb_rev_pixels_in_long(d0, bswapmask); + FB_WRITEL(d0, dst--); + d0 = d1; + } + + // Trailing bits +- if (last) { +- if (m <= left) { ++ if (m) { ++ if (m <= bits - left) { + // Single source word +- d0 >>= right; ++ d0 <<= left; + } else { + // 2 source words + d1 = FB_READL(src); + d1 = fb_rev_pixels_in_long(d1, + bswapmask); +- d0 = d0>>right | d1<> right; + } + d0 = fb_rev_pixels_in_long(d0, bswapmask); + FB_WRITEL(comp(d0, FB_READL(dst), last), dst); +@@ -371,9 +380,9 @@ void cfb_copyarea(struct fb_info *p, con + u32 dx = area->dx, dy = area->dy, sx = area->sx, sy = area->sy; + u32 height = area->height, width = area->width; + unsigned long const bits_per_line = p->fix.line_length*8u; +- unsigned long __iomem *dst = NULL, *src = NULL; ++ unsigned long __iomem *base = NULL; + int bits = BITS_PER_LONG, bytes = bits >> 3; +- int dst_idx = 0, src_idx = 0, rev_copy = 0; ++ unsigned dst_idx = 0, src_idx = 0, rev_copy = 0; + u32 bswapmask = fb_compute_bswapmask(p); + + if (p->state != FBINFO_STATE_RUNNING) +@@ -389,7 +398,7 @@ void cfb_copyarea(struct fb_info *p, con + + // split the base of the framebuffer into a long-aligned address and the + // index of the first bit +- dst = src = (unsigned long __iomem *)((unsigned long)p->screen_base & ~(bytes-1)); ++ base = (unsigned long __iomem *)((unsigned long)p->screen_base & ~(bytes-1)); + dst_idx = src_idx = 8*((unsigned long)p->screen_base & (bytes-1)); + // add offset of source and target area + dst_idx += dy*bits_per_line + dx*p->var.bits_per_pixel; +@@ -402,20 +411,14 @@ void cfb_copyarea(struct fb_info *p, con + while (height--) { + dst_idx -= bits_per_line; + src_idx -= bits_per_line; +- dst += dst_idx >> (ffs(bits) - 1); +- dst_idx &= (bytes - 1); +- src += src_idx >> (ffs(bits) - 1); +- src_idx &= (bytes - 1); +- bitcpy_rev(p, dst, dst_idx, src, src_idx, bits, ++ bitcpy_rev(p, base + (dst_idx / bits), dst_idx % bits, ++ base + (src_idx / bits), src_idx % bits, bits, + width*p->var.bits_per_pixel, bswapmask); + } + } else { + while (height--) { +- dst += dst_idx >> (ffs(bits) - 1); +- dst_idx &= (bytes - 1); +- src += src_idx >> (ffs(bits) - 1); +- src_idx &= (bytes - 1); +- bitcpy(p, dst, dst_idx, src, src_idx, bits, ++ bitcpy(p, base + (dst_idx / bits), dst_idx % bits, ++ base + (src_idx / bits), src_idx % bits, bits, + width*p->var.bits_per_pixel, bswapmask); + dst_idx += bits_per_line; + src_idx += bits_per_line; diff --git a/queue-3.14/iwlwifi-dvm-take-mutex-when-sending-sync-bt-config-command.patch b/queue-3.14/iwlwifi-dvm-take-mutex-when-sending-sync-bt-config-command.patch new file mode 100644 index 00000000000..75f817369ed --- /dev/null +++ b/queue-3.14/iwlwifi-dvm-take-mutex-when-sending-sync-bt-config-command.patch @@ -0,0 +1,44 @@ +From 82e5a649453a3cf23516277abb84273768a1592b Mon Sep 17 00:00:00 2001 +From: Emmanuel Grumbach +Date: Mon, 10 Mar 2014 15:22:03 +0200 +Subject: iwlwifi: dvm: take mutex when sending SYNC BT config command + +From: Emmanuel Grumbach + +commit 82e5a649453a3cf23516277abb84273768a1592b upstream. + +There is a flow in which we send the host command in SYNC +mode, but we don't take priv->mutex. + +Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1046495 + +Reviewed-by: Johannes Berg +Signed-off-by: Emmanuel Grumbach +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/iwlwifi/dvm/main.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +--- a/drivers/net/wireless/iwlwifi/dvm/main.c ++++ b/drivers/net/wireless/iwlwifi/dvm/main.c +@@ -252,13 +252,17 @@ static void iwl_bg_bt_runtime_config(str + struct iwl_priv *priv = + container_of(work, struct iwl_priv, bt_runtime_config); + ++ mutex_lock(&priv->mutex); + if (test_bit(STATUS_EXIT_PENDING, &priv->status)) +- return; ++ goto out; + + /* dont send host command if rf-kill is on */ + if (!iwl_is_ready_rf(priv)) +- return; ++ goto out; ++ + iwlagn_send_advance_bt_config(priv); ++out: ++ mutex_unlock(&priv->mutex); + } + + static void iwl_bg_bt_full_concurrency(struct work_struct *work) diff --git a/queue-3.14/iwlwifi-mvm-disable-uapsd-due-to-bugs-in-the-firmware.patch b/queue-3.14/iwlwifi-mvm-disable-uapsd-due-to-bugs-in-the-firmware.patch new file mode 100644 index 00000000000..46a5dfb45dd --- /dev/null +++ b/queue-3.14/iwlwifi-mvm-disable-uapsd-due-to-bugs-in-the-firmware.patch @@ -0,0 +1,32 @@ +From a82dda6cd492b8c88952be6f6527f3656f7ac585 Mon Sep 17 00:00:00 2001 +From: Emmanuel Grumbach +Date: Tue, 18 Mar 2014 16:32:45 +0200 +Subject: iwlwifi: mvm: disable uAPSD due to bugs in the firmware + +From: Emmanuel Grumbach + +commit a82dda6cd492b8c88952be6f6527f3656f7ac585 upstream. + +The current firmware advertises support for uAPSD, but +critical bugs force us to disable the feature. +When a fixed firmware will be available, we will be able to +re-enable uAPSD. + +Signed-off-by: Emmanuel Grumbach +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/iwlwifi/mvm/mac80211.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/wireless/iwlwifi/mvm/mac80211.c ++++ b/drivers/net/wireless/iwlwifi/mvm/mac80211.c +@@ -179,7 +179,7 @@ int iwl_mvm_mac_setup_register(struct iw + !iwlwifi_mod_params.sw_crypto) + hw->flags |= IEEE80211_HW_MFP_CAPABLE; + +- if (mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_UAPSD_SUPPORT) { ++ if (0 && mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_UAPSD_SUPPORT) { + hw->flags |= IEEE80211_HW_SUPPORTS_UAPSD; + hw->uapsd_queues = IWL_UAPSD_AC_INFO; + hw->uapsd_max_sp_len = IWL_UAPSD_MAX_SP; diff --git a/queue-3.14/libata-ahci-accommodate-tag-ordered-controllers.patch b/queue-3.14/libata-ahci-accommodate-tag-ordered-controllers.patch new file mode 100644 index 00000000000..47f4c7ea03c --- /dev/null +++ b/queue-3.14/libata-ahci-accommodate-tag-ordered-controllers.patch @@ -0,0 +1,96 @@ +From 8a4aeec8d2d6a3edeffbdfae451cdf05cbf0fefd Mon Sep 17 00:00:00 2001 +From: Dan Williams +Date: Thu, 17 Apr 2014 11:48:21 -0700 +Subject: libata/ahci: accommodate tag ordered controllers + +From: Dan Williams + +commit 8a4aeec8d2d6a3edeffbdfae451cdf05cbf0fefd upstream. + +The AHCI spec allows implementations to issue commands in tag order +rather than FIFO order: + + 5.3.2.12 P:SelectCmd + HBA sets pSlotLoc = (pSlotLoc + 1) mod (CAP.NCS + 1) + or HBA selects the command to issue that has had the + PxCI bit set to '1' longer than any other command + pending to be issued. + +The result is that commands posted sequentially (time-wise) may play out +of sequence when issued by hardware. + +This behavior has likely been hidden by drives that arrange for commands +to complete in issue order. However, it appears recent drives (two from +different vendors that we have found so far) inflict out-of-order +completions as a matter of course. So, we need to take care to maintain +ordered submission, otherwise we risk triggering a drive to fall out of +sequential-io automation and back to random-io processing, which incurs +large latency and degrades throughput. + +This issue was found in simple benchmarks where QD=2 seq-write +performance was 30-50% *greater* than QD=32 seq-write performance. + +Tagging for -stable and making the change globally since it has a low +risk-to-reward ratio. Also, word is that recent versions of an unnamed +OS also does it this way now. So, drives in the field are already +experienced with this tag ordering scheme. + +Cc: Dave Jiang +Cc: Ed Ciechanowski +Reviewed-by: Matthew Wilcox +Signed-off-by: Dan Williams +Signed-off-by: Tejun Heo +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ata/libata-core.c | 21 +++++++++++++-------- + include/linux/libata.h | 1 + + 2 files changed, 14 insertions(+), 8 deletions(-) + +--- a/drivers/ata/libata-core.c ++++ b/drivers/ata/libata-core.c +@@ -4792,21 +4792,26 @@ void swap_buf_le16(u16 *buf, unsigned in + static struct ata_queued_cmd *ata_qc_new(struct ata_port *ap) + { + struct ata_queued_cmd *qc = NULL; +- unsigned int i; ++ unsigned int i, tag; + + /* no command while frozen */ + if (unlikely(ap->pflags & ATA_PFLAG_FROZEN)) + return NULL; + +- /* the last tag is reserved for internal command. */ +- for (i = 0; i < ATA_MAX_QUEUE - 1; i++) +- if (!test_and_set_bit(i, &ap->qc_allocated)) { +- qc = __ata_qc_from_tag(ap, i); ++ for (i = 0; i < ATA_MAX_QUEUE; i++) { ++ tag = (i + ap->last_tag + 1) % ATA_MAX_QUEUE; ++ ++ /* the last tag is reserved for internal command. */ ++ if (tag == ATA_TAG_INTERNAL) ++ continue; ++ ++ if (!test_and_set_bit(tag, &ap->qc_allocated)) { ++ qc = __ata_qc_from_tag(ap, tag); ++ qc->tag = tag; ++ ap->last_tag = tag; + break; + } +- +- if (qc) +- qc->tag = i; ++ } + + return qc; + } +--- a/include/linux/libata.h ++++ b/include/linux/libata.h +@@ -822,6 +822,7 @@ struct ata_port { + unsigned long qc_allocated; + unsigned int qc_active; + int nr_active_links; /* #links with active qcs */ ++ unsigned int last_tag; /* track next tag hw expects */ + + struct ata_link link; /* host default link */ + struct ata_link *slave_link; /* see ata_slave_link_init() */ diff --git a/queue-3.14/libata-update-queued-trim-blacklist-for-m5x0-drives.patch b/queue-3.14/libata-update-queued-trim-blacklist-for-m5x0-drives.patch new file mode 100644 index 00000000000..eaac7f898df --- /dev/null +++ b/queue-3.14/libata-update-queued-trim-blacklist-for-m5x0-drives.patch @@ -0,0 +1,42 @@ +From d121f7d0cbb875abce249dbf7eb191f9bafe80b7 Mon Sep 17 00:00:00 2001 +From: "Martin K. Petersen" +Date: Tue, 1 Apr 2014 20:42:37 -0400 +Subject: libata: Update queued trim blacklist for M5x0 drives + +From: "Martin K. Petersen" + +commit d121f7d0cbb875abce249dbf7eb191f9bafe80b7 upstream. + +Crucial/Micron M500 drives properly support queued DSM TRIM starting +with firmware MU05. Update the blacklist so we only disable queued trim +for older firmware releases. + +Early M550 series drives suffer from the same issue as M500. A bugfix +firmware is in the pipeline but not ready yet. Until then, blacklist +queued trim for M550. + +Signed-off-by: Martin K. Petersen +Cc: Chris Samuel +Cc: Marc MERLIN +Signed-off-by: Tejun Heo +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ata/libata-core.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/ata/libata-core.c ++++ b/drivers/ata/libata-core.c +@@ -4224,8 +4224,10 @@ static const struct ata_blacklist_entry + { "PIONEER DVD-RW DVR-216D", NULL, ATA_HORKAGE_NOSETXFER }, + + /* devices that don't properly handle queued TRIM commands */ +- { "Micron_M500*", NULL, ATA_HORKAGE_NO_NCQ_TRIM, }, +- { "Crucial_CT???M500SSD*", NULL, ATA_HORKAGE_NO_NCQ_TRIM, }, ++ { "Micron_M500*", "MU0[1-4]*", ATA_HORKAGE_NO_NCQ_TRIM, }, ++ { "Crucial_CT???M500SSD*", "MU0[1-4]*", ATA_HORKAGE_NO_NCQ_TRIM, }, ++ { "Micron_M550*", NULL, ATA_HORKAGE_NO_NCQ_TRIM, }, ++ { "Crucial_CT???M550SSD*", NULL, ATA_HORKAGE_NO_NCQ_TRIM, }, + + /* + * Some WD SATA-I drives spin up and down erratically when the link diff --git a/queue-3.14/mach64-fix-cursor-when-character-width-is-not-a-multiple-of-8-pixels.patch b/queue-3.14/mach64-fix-cursor-when-character-width-is-not-a-multiple-of-8-pixels.patch new file mode 100644 index 00000000000..389943573f8 --- /dev/null +++ b/queue-3.14/mach64-fix-cursor-when-character-width-is-not-a-multiple-of-8-pixels.patch @@ -0,0 +1,88 @@ +From 43751a1b8ee2e70ce392bf31ef3133da324e68b3 Mon Sep 17 00:00:00 2001 +From: Mikulas Patocka +Date: Thu, 23 Jan 2014 14:41:59 -0500 +Subject: mach64: fix cursor when character width is not a multiple of 8 pixels + +From: Mikulas Patocka + +commit 43751a1b8ee2e70ce392bf31ef3133da324e68b3 upstream. + +This patch fixes the hardware cursor on mach64 when font width is not a +multiple of 8 pixels. + +If you load such a font, the cursor is expanded to the next 8-byte +boundary and a part of the next character after the cursor is not +visible. +For example, when you load a font with 12-pixel width, the cursor width +is 16 pixels and when the cursor is displayed, 4 pixels of the next +character are not visible. + +The reason is this: atyfb_cursor is called with proper parameters to +load an image that is 12-pixel wide. However, the number is aligned on +the next 8-pixel boundary on the line +"unsigned int width = (cursor->image.width + 7) >> 3;" and the whole +function acts as it is was loading a 16-pixel image. + +This patch fixes it so that the value written to the framebuffer is +padded with 0xaaaa (the transparent pattern) when the image size it not +a multiple of 8 pixels. The transparent pattern causes that the cursor +will not interfere with the next character. + +Signed-off-by: Mikulas Patocka +Signed-off-by: Tomi Valkeinen +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/video/aty/mach64_cursor.c | 22 ++++++++++++++++------ + 1 file changed, 16 insertions(+), 6 deletions(-) + +--- a/drivers/video/aty/mach64_cursor.c ++++ b/drivers/video/aty/mach64_cursor.c +@@ -5,6 +5,7 @@ + #include + #include + #include ++#include "../fb_draw.h" + + #include + +@@ -157,24 +158,33 @@ static int atyfb_cursor(struct fb_info * + + for (i = 0; i < height; i++) { + for (j = 0; j < width; j++) { ++ u16 l = 0xaaaa; + b = *src++; + m = *msk++; + switch (cursor->rop) { + case ROP_XOR: + // Upper 4 bits of mask data +- fb_writeb(cursor_bits_lookup[(b ^ m) >> 4], dst++); ++ l = cursor_bits_lookup[(b ^ m) >> 4] | + // Lower 4 bits of mask +- fb_writeb(cursor_bits_lookup[(b ^ m) & 0x0f], +- dst++); ++ (cursor_bits_lookup[(b ^ m) & 0x0f] << 8); + break; + case ROP_COPY: + // Upper 4 bits of mask data +- fb_writeb(cursor_bits_lookup[(b & m) >> 4], dst++); ++ l = cursor_bits_lookup[(b & m) >> 4] | + // Lower 4 bits of mask +- fb_writeb(cursor_bits_lookup[(b & m) & 0x0f], +- dst++); ++ (cursor_bits_lookup[(b & m) & 0x0f] << 8); + break; + } ++ /* ++ * If cursor size is not a multiple of 8 characters ++ * we must pad it with transparent pattern (0xaaaa). ++ */ ++ if ((j + 1) * 8 > cursor->image.width) { ++ l = comp(l, 0xaaaa, ++ (1 << ((cursor->image.width & 7) * 2)) - 1); ++ } ++ fb_writeb(l & 0xff, dst++); ++ fb_writeb(l >> 8, dst++); + } + dst += offset; + } diff --git a/queue-3.14/mach64-use-unaligned-access.patch b/queue-3.14/mach64-use-unaligned-access.patch new file mode 100644 index 00000000000..123bf725586 --- /dev/null +++ b/queue-3.14/mach64-use-unaligned-access.patch @@ -0,0 +1,46 @@ +From c29dd8696dc5dbd50b3ac441b8a26751277ba520 Mon Sep 17 00:00:00 2001 +From: Mikulas Patocka +Date: Thu, 23 Jan 2014 14:41:09 -0500 +Subject: mach64: use unaligned access + +From: Mikulas Patocka + +commit c29dd8696dc5dbd50b3ac441b8a26751277ba520 upstream. + +This patch fixes mach64 to use unaligned access to the font bitmap. + +This fixes unaligned access warning on sparc64 when 14x8 font is loaded. + +On x86(64), unaligned access is handled in hardware, so both functions +le32_to_cpup and get_unaligned_le32 perform the same operation. + +On RISC machines, unaligned access is not handled in hardware, so we +better use get_unaligned_le32 to avoid the unaligned trap and warning. + +Signed-off-by: Mikulas Patocka +Signed-off-by: Tomi Valkeinen +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/video/aty/mach64_accel.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/video/aty/mach64_accel.c ++++ b/drivers/video/aty/mach64_accel.c +@@ -4,6 +4,7 @@ + */ + + #include ++#include + #include + #include