From 4013ba1416140c9164afb55cb7efe53bda5467f3 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Mon, 14 Jan 2013 11:04:59 -0800 Subject: [PATCH] 3.4-stable patches added patches: hwmon-lm73-detect-and-report-i2c-bus-errors.patch samsung-laptop-add-quirk-for-broken-acpi_video-backlight-on-n250p.patch staging-vt6656-64-bit-fixes-correct-all-type-sizes.patch staging-vt6656-64-bit-fixes-fix-long-warning-messages.patch staging-vt6656-64bit-fixes-key.c-h-change-unsigned-long-to-u32.patch staging-vt6656-64-bit-fixes-use-u32-for-qword-definition.patch staging-vt6656-64bit-fixes-vcommandtimerwait-change-calculation-of-timer.patch staging-vt6656-out-of-bound-array-reference-in-rfbsetpower.patch video-mxsfb-fix-crash-when-unblanking-the-display.patch --- ...m73-detect-and-report-i2c-bus-errors.patch | 81 ++++++ ...broken-acpi_video-backlight-on-n250p.patch | 37 +++ queue-3.4/series | 9 + ...-64-bit-fixes-correct-all-type-sizes.patch | 44 ++++ ...-bit-fixes-fix-long-warning-messages.patch | 247 ++++++++++++++++++ ...t-fixes-use-u32-for-qword-definition.patch | 40 +++ ...-key.c-h-change-unsigned-long-to-u32.patch | 86 ++++++ ...imerwait-change-calculation-of-timer.patch | 71 +++++ ...bound-array-reference-in-rfbsetpower.patch | 35 +++ ...ix-crash-when-unblanking-the-display.patch | 39 +++ 10 files changed, 689 insertions(+) create mode 100644 queue-3.4/hwmon-lm73-detect-and-report-i2c-bus-errors.patch create mode 100644 queue-3.4/samsung-laptop-add-quirk-for-broken-acpi_video-backlight-on-n250p.patch create mode 100644 queue-3.4/staging-vt6656-64-bit-fixes-correct-all-type-sizes.patch create mode 100644 queue-3.4/staging-vt6656-64-bit-fixes-fix-long-warning-messages.patch create mode 100644 queue-3.4/staging-vt6656-64-bit-fixes-use-u32-for-qword-definition.patch create mode 100644 queue-3.4/staging-vt6656-64bit-fixes-key.c-h-change-unsigned-long-to-u32.patch create mode 100644 queue-3.4/staging-vt6656-64bit-fixes-vcommandtimerwait-change-calculation-of-timer.patch create mode 100644 queue-3.4/staging-vt6656-out-of-bound-array-reference-in-rfbsetpower.patch create mode 100644 queue-3.4/video-mxsfb-fix-crash-when-unblanking-the-display.patch diff --git a/queue-3.4/hwmon-lm73-detect-and-report-i2c-bus-errors.patch b/queue-3.4/hwmon-lm73-detect-and-report-i2c-bus-errors.patch new file mode 100644 index 00000000000..bf84ad9b9b5 --- /dev/null +++ b/queue-3.4/hwmon-lm73-detect-and-report-i2c-bus-errors.patch @@ -0,0 +1,81 @@ +From 0602934f302e016e2ea5dc6951681bfac77455ef Mon Sep 17 00:00:00 2001 +From: Chris Verges +Date: Fri, 21 Dec 2012 01:58:34 -0800 +Subject: hwmon: (lm73} Detect and report i2c bus errors + +From: Chris Verges + +commit 0602934f302e016e2ea5dc6951681bfac77455ef upstream. + +If an LM73 device does not exist on an I2C bus, attempts to communicate +with the device result in an error code returned from the i2c read/write +functions. The current lm73 driver casts that return value from a s32 +type to a s16 type, then converts it to a temperature in celsius. +Because negative temperatures are valid, it is difficult to distinguish +between an error code printed to the response buffer and a negative +temperature recorded by the sensor. + +The solution is to evaluate the return value from the i2c functions +before performing any temperature calculations. If the i2c function did +not succeed, the error code should be passed back through the virtual +file system layer instead of being printed into the response buffer. + +Before: + + $ cat /sys/class/hwmon/hwmon0/device/temp1_input + -46 + +After: + + $ cat /sys/class/hwmon/hwmon0/device/temp1_input + cat: read error: No such device or address + +Signed-off-by: Chris Verges +Signed-off-by: Guenter Roeck +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwmon/lm73.c | 16 +++++++++++----- + 1 file changed, 11 insertions(+), 5 deletions(-) + +--- a/drivers/hwmon/lm73.c ++++ b/drivers/hwmon/lm73.c +@@ -49,6 +49,7 @@ static ssize_t set_temp(struct device *d + struct i2c_client *client = to_i2c_client(dev); + long temp; + short value; ++ s32 err; + + int status = kstrtol(buf, 10, &temp); + if (status < 0) +@@ -57,8 +58,8 @@ static ssize_t set_temp(struct device *d + /* Write value */ + value = (short) SENSORS_LIMIT(temp/250, (LM73_TEMP_MIN*4), + (LM73_TEMP_MAX*4)) << 5; +- i2c_smbus_write_word_swapped(client, attr->index, value); +- return count; ++ err = i2c_smbus_write_word_swapped(client, attr->index, value); ++ return (err < 0) ? err : count; + } + + static ssize_t show_temp(struct device *dev, struct device_attribute *da, +@@ -66,11 +67,16 @@ static ssize_t show_temp(struct device * + { + struct sensor_device_attribute *attr = to_sensor_dev_attr(da); + struct i2c_client *client = to_i2c_client(dev); ++ int temp; ++ ++ s32 err = i2c_smbus_read_word_swapped(client, attr->index); ++ if (err < 0) ++ return err; ++ + /* use integer division instead of equivalent right shift to + guarantee arithmetic shift and preserve the sign */ +- int temp = ((s16) (i2c_smbus_read_word_swapped(client, +- attr->index))*250) / 32; +- return sprintf(buf, "%d\n", temp); ++ temp = (((s16) err) * 250) / 32; ++ return scnprintf(buf, PAGE_SIZE, "%d\n", temp); + } + + diff --git a/queue-3.4/samsung-laptop-add-quirk-for-broken-acpi_video-backlight-on-n250p.patch b/queue-3.4/samsung-laptop-add-quirk-for-broken-acpi_video-backlight-on-n250p.patch new file mode 100644 index 00000000000..af8f451af42 --- /dev/null +++ b/queue-3.4/samsung-laptop-add-quirk-for-broken-acpi_video-backlight-on-n250p.patch @@ -0,0 +1,37 @@ +From e04c200f1f2de8eaa2f5af6d97e7e213a1abb424 Mon Sep 17 00:00:00 2001 +From: Seth Forshee +Date: Wed, 5 Dec 2012 16:08:33 -0600 +Subject: samsung-laptop: Add quirk for broken acpi_video backlight on N250P + +From: Seth Forshee + +commit e04c200f1f2de8eaa2f5af6d97e7e213a1abb424 upstream. + +BugLink: http://bugs.launchpad.net/bugs/1086921 +Signed-off-by: Seth Forshee +Signed-off-by: Matthew Garrett +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/platform/x86/samsung-laptop.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +--- a/drivers/platform/x86/samsung-laptop.c ++++ b/drivers/platform/x86/samsung-laptop.c +@@ -1506,6 +1506,16 @@ static struct dmi_system_id __initdata s + }, + .driver_data = &samsung_broken_acpi_video, + }, ++ { ++ .callback = samsung_dmi_matched, ++ .ident = "N250P", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "SAMSUNG ELECTRONICS CO., LTD."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "N250P"), ++ DMI_MATCH(DMI_BOARD_NAME, "N250P"), ++ }, ++ .driver_data = &samsung_broken_acpi_video, ++ }, + { }, + }; + MODULE_DEVICE_TABLE(dmi, samsung_dmi_table); diff --git a/queue-3.4/series b/queue-3.4/series index b90ab8acac2..2e12f0cce1e 100644 --- a/queue-3.4/series +++ b/queue-3.4/series @@ -45,3 +45,12 @@ rdma-nes-fix-for-terminate-timer-crash.patch ring-buffer-fix-race-between-integrity-check-and-readers.patch dm-persistent-data-rename-node-to-btree_node.patch dm-ioctl-prevent-unsafe-change-to-dm_ioctl-data_size.patch +staging-vt6656-out-of-bound-array-reference-in-rfbsetpower.patch +staging-vt6656-64-bit-fixes-use-u32-for-qword-definition.patch +staging-vt6656-64-bit-fixes-correct-all-type-sizes.patch +staging-vt6656-64-bit-fixes-fix-long-warning-messages.patch +staging-vt6656-64bit-fixes-key.c-h-change-unsigned-long-to-u32.patch +staging-vt6656-64bit-fixes-vcommandtimerwait-change-calculation-of-timer.patch +hwmon-lm73-detect-and-report-i2c-bus-errors.patch +video-mxsfb-fix-crash-when-unblanking-the-display.patch +samsung-laptop-add-quirk-for-broken-acpi_video-backlight-on-n250p.patch diff --git a/queue-3.4/staging-vt6656-64-bit-fixes-correct-all-type-sizes.patch b/queue-3.4/staging-vt6656-64-bit-fixes-correct-all-type-sizes.patch new file mode 100644 index 00000000000..1ba71c7d07e --- /dev/null +++ b/queue-3.4/staging-vt6656-64-bit-fixes-correct-all-type-sizes.patch @@ -0,0 +1,44 @@ +From 7730492855a2f9c828599bcd8d62760f96d319e4 Mon Sep 17 00:00:00 2001 +From: Malcolm Priestley +Date: Sun, 11 Nov 2012 15:41:25 +0000 +Subject: staging: vt6656: 64 bit fixes : correct all type sizes + +From: Malcolm Priestley + +commit 7730492855a2f9c828599bcd8d62760f96d319e4 upstream. + +After this patch all BYTE/WORD/DWORD types can be replaced with the appropriate u sizes. + +Signed-off-by: Malcolm Priestley +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/vt6656/ttype.h | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +--- a/drivers/staging/vt6656/ttype.h ++++ b/drivers/staging/vt6656/ttype.h +@@ -44,9 +44,9 @@ typedef int BOOL; + + /****** Simple typedefs ***************************************************/ + +-typedef unsigned char BYTE; // 8-bit +-typedef unsigned short WORD; // 16-bit +-typedef unsigned long DWORD; // 32-bit ++typedef u8 BYTE; ++typedef u16 WORD; ++typedef u32 DWORD; + + // QWORD is for those situation that we want + // an 8-byte-aligned 8 byte long structure +@@ -62,8 +62,8 @@ typedef UQuadWord QWORD; + + /****** Common pointer types ***********************************************/ + +-typedef unsigned long ULONG_PTR; // 32-bit +-typedef unsigned long DWORD_PTR; // 32-bit ++typedef u32 ULONG_PTR; ++typedef u32 DWORD_PTR; + + // boolean pointer + diff --git a/queue-3.4/staging-vt6656-64-bit-fixes-fix-long-warning-messages.patch b/queue-3.4/staging-vt6656-64-bit-fixes-fix-long-warning-messages.patch new file mode 100644 index 00000000000..b6651a15816 --- /dev/null +++ b/queue-3.4/staging-vt6656-64-bit-fixes-fix-long-warning-messages.patch @@ -0,0 +1,247 @@ +From b4dc03af5513774277c9c36b12a25cd3f25f4404 Mon Sep 17 00:00:00 2001 +From: Malcolm Priestley +Date: Sun, 11 Nov 2012 15:45:52 +0000 +Subject: staging: vt6656: 64 bit fixes: fix long warning messages. + +From: Malcolm Priestley + +commit b4dc03af5513774277c9c36b12a25cd3f25f4404 upstream. + +Fixes long warning messages from patch +[PATCH 08/14] staging: vt6656: 64 bit fixes : correct all type sizes + +Signed-off-by: Malcolm Priestley +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/vt6656/dpc.c | 4 +-- + drivers/staging/vt6656/key.c | 47 +++++++++++++++++++++++++++++------------- + drivers/staging/vt6656/mac.c | 6 +++-- + drivers/staging/vt6656/rxtx.c | 18 ++++++++++------ + 4 files changed, 51 insertions(+), 24 deletions(-) + +--- a/drivers/staging/vt6656/dpc.c ++++ b/drivers/staging/vt6656/dpc.c +@@ -1238,7 +1238,7 @@ static BOOL s_bHandleRxEncryption ( + + PayloadLen -= (WLAN_HDR_ADDR3_LEN + 8 + 4); // 24 is 802.11 header, 8 is IV&ExtIV, 4 is crc + *pdwRxTSC47_16 = cpu_to_le32(*(PDWORD)(pbyIV + 4)); +- DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"ExtIV: %lx\n",*pdwRxTSC47_16); ++ DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"ExtIV: %x\n", *pdwRxTSC47_16); + if (byDecMode == KEY_CTL_TKIP) { + *pwRxTSC15_0 = cpu_to_le16(MAKEWORD(*(pbyIV+2), *pbyIV)); + } else { +@@ -1349,7 +1349,7 @@ static BOOL s_bHostWepRxEncryption ( + + PayloadLen -= (WLAN_HDR_ADDR3_LEN + 8 + 4); // 24 is 802.11 header, 8 is IV&ExtIV, 4 is crc + *pdwRxTSC47_16 = cpu_to_le32(*(PDWORD)(pbyIV + 4)); +- DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"ExtIV: %lx\n",*pdwRxTSC47_16); ++ DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"ExtIV: %x\n", *pdwRxTSC47_16); + + if (byDecMode == KEY_CTL_TKIP) { + *pwRxTSC15_0 = cpu_to_le16(MAKEWORD(*(pbyIV+2), *pbyIV)); +--- a/drivers/staging/vt6656/key.c ++++ b/drivers/staging/vt6656/key.c +@@ -235,7 +235,8 @@ BOOL KeybSetKey( + PSKeyItem pKey; + unsigned int uKeyIdx; + +- DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"Enter KeybSetKey: %lX\n", dwKeyIndex); ++ DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO ++ "Enter KeybSetKey: %X\n", dwKeyIndex); + + j = (MAX_KEY_TABLE-1); + for (i=0;i<(MAX_KEY_TABLE-1);i++) { +@@ -261,7 +262,9 @@ BOOL KeybSetKey( + if ((dwKeyIndex & TRANSMIT_KEY) != 0) { + // Group transmit key + pTable->KeyTable[i].dwGTKeyIndex = dwKeyIndex; +- DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"Group transmit key(R)[%lX]: %d\n", pTable->KeyTable[i].dwGTKeyIndex, i); ++ DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO ++ "Group transmit key(R)[%X]: %d\n", ++ pTable->KeyTable[i].dwGTKeyIndex, i); + } + pTable->KeyTable[i].wKeyCtl &= 0xFF0F; // clear group key control filed + pTable->KeyTable[i].wKeyCtl |= (byKeyDecMode << 4); +@@ -302,9 +305,12 @@ BOOL KeybSetKey( + } + DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"\n"); + +- DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"pKey->dwTSC47_16: %lx\n ", pKey->dwTSC47_16); +- DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"pKey->wTSC15_0: %x\n ", pKey->wTSC15_0); +- DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"pKey->dwKeyIndex: %lx\n ", pKey->dwKeyIndex); ++ DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"pKey->dwTSC47_16: %x\n ", ++ pKey->dwTSC47_16); ++ DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"pKey->wTSC15_0: %x\n ", ++ pKey->wTSC15_0); ++ DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"pKey->dwKeyIndex: %x\n ", ++ pKey->dwKeyIndex); + + return (TRUE); + } +@@ -326,7 +332,9 @@ BOOL KeybSetKey( + if ((dwKeyIndex & TRANSMIT_KEY) != 0) { + // Group transmit key + pTable->KeyTable[j].dwGTKeyIndex = dwKeyIndex; +- DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"Group transmit key(N)[%lX]: %d\n", pTable->KeyTable[j].dwGTKeyIndex, j); ++ DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO ++ "Group transmit key(N)[%X]: %d\n", ++ pTable->KeyTable[j].dwGTKeyIndex, j); + } + pTable->KeyTable[j].wKeyCtl &= 0xFF0F; // clear group key control filed + pTable->KeyTable[j].wKeyCtl |= (byKeyDecMode << 4); +@@ -367,9 +375,11 @@ BOOL KeybSetKey( + } + DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"\n"); + +- DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"pKey->dwTSC47_16: %lx\n ", pKey->dwTSC47_16); ++ DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"pKey->dwTSC47_16: %x\n ", ++ pKey->dwTSC47_16); + DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"pKey->wTSC15_0: %x\n ", pKey->wTSC15_0); +- DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"pKey->dwKeyIndex: %lx\n ", pKey->dwKeyIndex); ++ DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"pKey->dwKeyIndex: %x\n ", ++ pKey->dwKeyIndex); + + return (TRUE); + } +@@ -597,7 +607,8 @@ BOOL KeybGetTransmitKey(PSKeyManagement + DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"%x ", pTable->KeyTable[i].abyBSSID[ii]); + } + DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"\n"); +- DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"dwGTKeyIndex: %lX\n", pTable->KeyTable[i].dwGTKeyIndex); ++ DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"dwGTKeyIndex: %X\n", ++ pTable->KeyTable[i].dwGTKeyIndex); + + return (TRUE); + } +@@ -696,7 +707,10 @@ BOOL KeybSetDefaultKey( + if ((dwKeyIndex & TRANSMIT_KEY) != 0) { + // Group transmit key + pTable->KeyTable[MAX_KEY_TABLE-1].dwGTKeyIndex = dwKeyIndex; +- DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"Group transmit key(R)[%lX]: %d\n", pTable->KeyTable[MAX_KEY_TABLE-1].dwGTKeyIndex, MAX_KEY_TABLE-1); ++ DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO ++ "Group transmit key(R)[%X]: %d\n", ++ pTable->KeyTable[MAX_KEY_TABLE-1].dwGTKeyIndex, ++ MAX_KEY_TABLE-1); + + } + pTable->KeyTable[MAX_KEY_TABLE-1].wKeyCtl &= 0x7F00; // clear all key control filed +@@ -747,9 +761,11 @@ BOOL KeybSetDefaultKey( + } + DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"\n"); + +- DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"pKey->dwTSC47_16: %lx\n", pKey->dwTSC47_16); ++ DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"pKey->dwTSC47_16: %x\n", ++ pKey->dwTSC47_16); + DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"pKey->wTSC15_0: %x\n", pKey->wTSC15_0); +- DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"pKey->dwKeyIndex: %lx\n", pKey->dwKeyIndex); ++ DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"pKey->dwKeyIndex: %x\n", ++ pKey->dwKeyIndex); + + return (TRUE); + } +@@ -787,7 +803,8 @@ BOOL KeybSetAllGroupKey( + PSKeyItem pKey; + unsigned int uKeyIdx; + +- DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"Enter KeybSetAllGroupKey: %lX\n", dwKeyIndex); ++ DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"Enter KeybSetAllGroupKey: %X\n", ++ dwKeyIndex); + + + if ((dwKeyIndex & PAIRWISE_KEY) != 0) { // Pairwise key +@@ -804,7 +821,9 @@ BOOL KeybSetAllGroupKey( + if ((dwKeyIndex & TRANSMIT_KEY) != 0) { + // Group transmit key + pTable->KeyTable[i].dwGTKeyIndex = dwKeyIndex; +- DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"Group transmit key(R)[%lX]: %d\n", pTable->KeyTable[i].dwGTKeyIndex, i); ++ DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO ++ "Group transmit key(R)[%X]: %d\n", ++ pTable->KeyTable[i].dwGTKeyIndex, i); + + } + pTable->KeyTable[i].wKeyCtl &= 0xFF0F; // clear group key control filed +--- a/drivers/staging/vt6656/mac.c ++++ b/drivers/staging/vt6656/mac.c +@@ -260,7 +260,8 @@ BYTE pbyData[24]; + dwData1 <<= 16; + dwData1 |= MAKEWORD(*(pbyAddr+4), *(pbyAddr+5)); + +- DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"1. wOffset: %d, Data: %lX, KeyCtl:%X\n", wOffset, dwData1, wKeyCtl); ++ DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"1. wOffset: %d, Data: %X,"\ ++ " KeyCtl:%X\n", wOffset, dwData1, wKeyCtl); + + //VNSvOutPortW(dwIoBase + MAC_REG_MISCFFNDEX, wOffset); + //VNSvOutPortD(dwIoBase + MAC_REG_MISCFFDATA, dwData); +@@ -277,7 +278,8 @@ BYTE pbyData[24]; + dwData2 <<= 8; + dwData2 |= *(pbyAddr+0); + +- DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"2. wOffset: %d, Data: %lX\n", wOffset, dwData2); ++ DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"2. wOffset: %d, Data: %X\n", ++ wOffset, dwData2); + + //VNSvOutPortW(dwIoBase + MAC_REG_MISCFFNDEX, wOffset); + //VNSvOutPortD(dwIoBase + MAC_REG_MISCFFDATA, dwData); +--- a/drivers/staging/vt6656/rxtx.c ++++ b/drivers/staging/vt6656/rxtx.c +@@ -377,7 +377,8 @@ s_vFillTxKey ( + *(pbyIVHead+3) = (BYTE)(((pDevice->byKeyIndex << 6) & 0xc0) | 0x20); // 0x20 is ExtIV + // Append IV&ExtIV after Mac Header + *pdwExtIV = cpu_to_le32(pTransmitKey->dwTSC47_16); +- DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"vFillTxKey()---- pdwExtIV: %lx\n", *pdwExtIV); ++ DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"vFillTxKey()---- pdwExtIV: %x\n", ++ *pdwExtIV); + + } else if (pTransmitKey->byCipherSuite == KEY_CTL_CCMP) { + pTransmitKey->wTSC15_0++; +@@ -1753,7 +1754,8 @@ s_bPacketToWirelessUsb( + MIC_vAppend((PBYTE)&(psEthHeader->abyDstAddr[0]), 12); + dwMIC_Priority = 0; + MIC_vAppend((PBYTE)&dwMIC_Priority, 4); +- DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"MIC KEY: %lX, %lX\n", dwMICKey0, dwMICKey1); ++ DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"MIC KEY: %X, %X\n", ++ dwMICKey0, dwMICKey1); + + /////////////////////////////////////////////////////////////////// + +@@ -2635,7 +2637,8 @@ vDMA0_tx_80211(PSDevice pDevice, struct + MIC_vAppend((PBYTE)&(sEthHeader.abyDstAddr[0]), 12); + dwMIC_Priority = 0; + MIC_vAppend((PBYTE)&dwMIC_Priority, 4); +- DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"DMA0_tx_8021:MIC KEY: %lX, %lX\n", dwMICKey0, dwMICKey1); ++ DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"DMA0_tx_8021:MIC KEY:"\ ++ " %X, %X\n", dwMICKey0, dwMICKey1); + + uLength = cbHeaderSize + cbMacHdLen + uPadding + cbIVlen; + +@@ -2655,7 +2658,8 @@ vDMA0_tx_80211(PSDevice pDevice, struct + + DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"uLength: %d, %d\n", uLength, cbFrameBodySize); + DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"cbReqCount:%d, %d, %d, %d\n", cbReqCount, cbHeaderSize, uPadding, cbIVlen); +- DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"MIC:%lx, %lx\n", *pdwMIC_L, *pdwMIC_R); ++ DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"MIC:%x, %x\n", ++ *pdwMIC_L, *pdwMIC_R); + + } + +@@ -3029,7 +3033,8 @@ int nsDMA_tx_packet(PSDevice pDevice, un + DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"error: KEY is GTK!!~~\n"); + } + else { +- DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"Find PTK [%lX]\n", pTransmitKey->dwKeyIndex); ++ DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"Find PTK [%X]\n", ++ pTransmitKey->dwKeyIndex); + bNeedEncryption = TRUE; + } + } +@@ -3043,7 +3048,8 @@ int nsDMA_tx_packet(PSDevice pDevice, un + if (pDevice->bEnableHostWEP) { + if ((uNodeIndex != 0) && + (pMgmt->sNodeDBTable[uNodeIndex].dwKeyIndex & PAIRWISE_KEY)) { +- DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"Find PTK [%lX]\n", pTransmitKey->dwKeyIndex); ++ DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"Find PTK [%X]\n", ++ pTransmitKey->dwKeyIndex); + bNeedEncryption = TRUE; + } + } diff --git a/queue-3.4/staging-vt6656-64-bit-fixes-use-u32-for-qword-definition.patch b/queue-3.4/staging-vt6656-64-bit-fixes-use-u32-for-qword-definition.patch new file mode 100644 index 00000000000..61b55b6996a --- /dev/null +++ b/queue-3.4/staging-vt6656-64-bit-fixes-use-u32-for-qword-definition.patch @@ -0,0 +1,40 @@ +From a552397d5e4ef0cc0bd3e9595d6acc9a3b381171 Mon Sep 17 00:00:00 2001 +From: Malcolm Priestley +Date: Sun, 11 Nov 2012 15:32:05 +0000 +Subject: staging: vt6656: 64 bit fixes: use u32 for QWORD definition. + +From: Malcolm Priestley + +commit a552397d5e4ef0cc0bd3e9595d6acc9a3b381171 upstream. + +Size of long issues replace with u32. + +Signed-off-by: Malcolm Priestley +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/vt6656/ttype.h | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/staging/vt6656/ttype.h ++++ b/drivers/staging/vt6656/ttype.h +@@ -29,6 +29,8 @@ + #ifndef __TTYPE_H__ + #define __TTYPE_H__ + ++#include ++ + /******* Common definitions and typedefs ***********************************/ + + typedef int BOOL; +@@ -51,8 +53,8 @@ typedef unsigned long DWORD; + // which is NOT really a floating point number. + typedef union tagUQuadWord { + struct { +- DWORD dwLowDword; +- DWORD dwHighDword; ++ u32 dwLowDword; ++ u32 dwHighDword; + } u; + double DoNotUseThisField; + } UQuadWord; diff --git a/queue-3.4/staging-vt6656-64bit-fixes-key.c-h-change-unsigned-long-to-u32.patch b/queue-3.4/staging-vt6656-64bit-fixes-key.c-h-change-unsigned-long-to-u32.patch new file mode 100644 index 00000000000..367c14b2afb --- /dev/null +++ b/queue-3.4/staging-vt6656-64bit-fixes-key.c-h-change-unsigned-long-to-u32.patch @@ -0,0 +1,86 @@ +From c0d05b305b00c698b0a8c1b3d46c9380bce9db45 Mon Sep 17 00:00:00 2001 +From: Malcolm Priestley +Date: Sun, 11 Nov 2012 15:49:59 +0000 +Subject: staging: vt6656: 64bit fixes: key.c/h change unsigned long to u32 + +From: Malcolm Priestley + +commit c0d05b305b00c698b0a8c1b3d46c9380bce9db45 upstream. + +Fixes long issues. + +Signed-off-by: Malcolm Priestley +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/vt6656/key.c | 6 +++--- + drivers/staging/vt6656/key.h | 8 ++++---- + 2 files changed, 7 insertions(+), 7 deletions(-) + +--- a/drivers/staging/vt6656/key.c ++++ b/drivers/staging/vt6656/key.c +@@ -223,7 +223,7 @@ BOOL KeybSetKey( + PSKeyManagement pTable, + PBYTE pbyBSSID, + DWORD dwKeyIndex, +- unsigned long uKeyLength, ++ u32 uKeyLength, + PQWORD pKeyRSC, + PBYTE pbyKey, + BYTE byKeyDecMode +@@ -675,7 +675,7 @@ BOOL KeybSetDefaultKey( + void *pDeviceHandler, + PSKeyManagement pTable, + DWORD dwKeyIndex, +- unsigned long uKeyLength, ++ u32 uKeyLength, + PQWORD pKeyRSC, + PBYTE pbyKey, + BYTE byKeyDecMode +@@ -791,7 +791,7 @@ BOOL KeybSetAllGroupKey( + void *pDeviceHandler, + PSKeyManagement pTable, + DWORD dwKeyIndex, +- unsigned long uKeyLength, ++ u32 uKeyLength, + PQWORD pKeyRSC, + PBYTE pbyKey, + BYTE byKeyDecMode +--- a/drivers/staging/vt6656/key.h ++++ b/drivers/staging/vt6656/key.h +@@ -58,7 +58,7 @@ + typedef struct tagSKeyItem + { + BOOL bKeyValid; +- unsigned long uKeyLength; ++ u32 uKeyLength; + BYTE abyKey[MAX_KEY_LEN]; + QWORD KeyRSC; + DWORD dwTSC47_16; +@@ -107,7 +107,7 @@ BOOL KeybSetKey( + PSKeyManagement pTable, + PBYTE pbyBSSID, + DWORD dwKeyIndex, +- unsigned long uKeyLength, ++ u32 uKeyLength, + PQWORD pKeyRSC, + PBYTE pbyKey, + BYTE byKeyDecMode +@@ -146,7 +146,7 @@ BOOL KeybSetDefaultKey( + void *pDeviceHandler, + PSKeyManagement pTable, + DWORD dwKeyIndex, +- unsigned long uKeyLength, ++ u32 uKeyLength, + PQWORD pKeyRSC, + PBYTE pbyKey, + BYTE byKeyDecMode +@@ -156,7 +156,7 @@ BOOL KeybSetAllGroupKey( + void *pDeviceHandler, + PSKeyManagement pTable, + DWORD dwKeyIndex, +- unsigned long uKeyLength, ++ u32 uKeyLength, + PQWORD pKeyRSC, + PBYTE pbyKey, + BYTE byKeyDecMode diff --git a/queue-3.4/staging-vt6656-64bit-fixes-vcommandtimerwait-change-calculation-of-timer.patch b/queue-3.4/staging-vt6656-64bit-fixes-vcommandtimerwait-change-calculation-of-timer.patch new file mode 100644 index 00000000000..3378c10bce8 --- /dev/null +++ b/queue-3.4/staging-vt6656-64bit-fixes-vcommandtimerwait-change-calculation-of-timer.patch @@ -0,0 +1,71 @@ +From 70e227790d4ee4590023d8041a3485f8053593fc Mon Sep 17 00:00:00 2001 +From: Malcolm Priestley +Date: Sun, 11 Nov 2012 16:07:57 +0000 +Subject: staging: vt6656: 64bit fixes: vCommandTimerWait change calculation of timer. + +From: Malcolm Priestley + +commit 70e227790d4ee4590023d8041a3485f8053593fc upstream. + +The timer appears to run too fast/race on 64 bit systems. + +Using msecs_to_jiffies seems to cause a deadlock on 64 bit. + +A calculation of (MSecond * HZ) / 1000 appears to run satisfactory. + +Change BSSIDInfoCount to u32. + +After this patch the driver can be successfully connect on little endian 64/32 bit systems. + +Signed-off-by: Malcolm Priestley +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/vt6656/wcmd.c | 20 +++++++++++--------- + drivers/staging/vt6656/wpa2.h | 4 ++-- + 2 files changed, 13 insertions(+), 11 deletions(-) + +--- a/drivers/staging/vt6656/wcmd.c ++++ b/drivers/staging/vt6656/wcmd.c +@@ -316,17 +316,19 @@ s_MgrMakeProbeRequest( + return pTxPacket; + } + +-void vCommandTimerWait(void *hDeviceContext, unsigned int MSecond) ++void vCommandTimerWait(void *hDeviceContext, unsigned long MSecond) + { +- PSDevice pDevice = (PSDevice)hDeviceContext; ++ PSDevice pDevice = (PSDevice)hDeviceContext; + +- init_timer(&pDevice->sTimerCommand); +- pDevice->sTimerCommand.data = (unsigned long)pDevice; +- pDevice->sTimerCommand.function = (TimerFunction)vRunCommand; +- // RUN_AT :1 msec ~= (HZ/1024) +- pDevice->sTimerCommand.expires = (unsigned int)RUN_AT((MSecond * HZ) >> 10); +- add_timer(&pDevice->sTimerCommand); +- return; ++ init_timer(&pDevice->sTimerCommand); ++ ++ pDevice->sTimerCommand.data = (unsigned long)pDevice; ++ pDevice->sTimerCommand.function = (TimerFunction)vRunCommand; ++ pDevice->sTimerCommand.expires = RUN_AT((MSecond * HZ) / 1000); ++ ++ add_timer(&pDevice->sTimerCommand); ++ ++ return; + } + + void vRunCommand(void *hDeviceContext) +--- a/drivers/staging/vt6656/wpa2.h ++++ b/drivers/staging/vt6656/wpa2.h +@@ -45,8 +45,8 @@ typedef struct tagsPMKIDInfo { + } PMKIDInfo, *PPMKIDInfo; + + typedef struct tagSPMKIDCache { +- unsigned long BSSIDInfoCount; +- PMKIDInfo BSSIDInfo[MAX_PMKID_CACHE]; ++ u32 BSSIDInfoCount; ++ PMKIDInfo BSSIDInfo[MAX_PMKID_CACHE]; + } SPMKIDCache, *PSPMKIDCache; + + diff --git a/queue-3.4/staging-vt6656-out-of-bound-array-reference-in-rfbsetpower.patch b/queue-3.4/staging-vt6656-out-of-bound-array-reference-in-rfbsetpower.patch new file mode 100644 index 00000000000..ef508036034 --- /dev/null +++ b/queue-3.4/staging-vt6656-out-of-bound-array-reference-in-rfbsetpower.patch @@ -0,0 +1,35 @@ +From ab1dd9963137a1e122004d5378a581bf16ae9bc8 Mon Sep 17 00:00:00 2001 +From: Malcolm Priestley +Date: Sun, 7 Oct 2012 08:27:00 +0100 +Subject: staging: vt6656: [BUG] out of bound array reference in RFbSetPower. + +From: Malcolm Priestley + +commit ab1dd9963137a1e122004d5378a581bf16ae9bc8 upstream. + +Calling RFbSetPower with uCH zero value will cause out of bound array reference. + +This causes 64 bit kernels to oops on boot. + +Note: Driver does not function on 64 bit kernels and should be +blacklisted on them. + +Signed-off-by: Malcolm Priestley +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/vt6656/rf.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/staging/vt6656/rf.c ++++ b/drivers/staging/vt6656/rf.c +@@ -769,6 +769,9 @@ BYTE byPwr = pDevice->byCCKPwr; + return TRUE; + } + ++ if (uCH == 0) ++ return -EINVAL; ++ + switch (uRATE) { + case RATE_1M: + case RATE_2M: diff --git a/queue-3.4/video-mxsfb-fix-crash-when-unblanking-the-display.patch b/queue-3.4/video-mxsfb-fix-crash-when-unblanking-the-display.patch new file mode 100644 index 00000000000..73fee67296d --- /dev/null +++ b/queue-3.4/video-mxsfb-fix-crash-when-unblanking-the-display.patch @@ -0,0 +1,39 @@ +From 6c1ecba8d84841277d68140ef485335d5be28485 Mon Sep 17 00:00:00 2001 +From: Lothar Waßmann +Date: Thu, 22 Nov 2012 13:49:14 +0100 +Subject: video: mxsfb: fix crash when unblanking the display +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Lothar Waßmann + +commit 6c1ecba8d84841277d68140ef485335d5be28485 upstream. + +The VDCTRL4 register does not provide the MXS SET/CLR/TOGGLE feature. +The write in mxsfb_disable_controller() sets the data_cnt for the LCD +DMA to 0 which obviously means the max. count for the LCD DMA and +leads to overwriting arbitrary memory when the display is unblanked. + +Signed-off-by: Lothar Waßmann +Acked-by: Juergen Beisert +Tested-by: Lauri Hintsala +Signed-off-by: Shawn Guo +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/video/mxsfb.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/video/mxsfb.c ++++ b/drivers/video/mxsfb.c +@@ -366,7 +366,8 @@ static void mxsfb_disable_controller(str + loop--; + } + +- writel(VDCTRL4_SYNC_SIGNALS_ON, host->base + LCDC_VDCTRL4 + REG_CLR); ++ reg = readl(host->base + LCDC_VDCTRL4); ++ writel(reg & ~VDCTRL4_SYNC_SIGNALS_ON, host->base + LCDC_VDCTRL4); + + clk_disable_unprepare(host->clk); + -- 2.47.3