From ab509ee3512ec39c8bc8588f5df6e953abae4469 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Thu, 26 Jan 2012 10:39:19 -0800 Subject: [PATCH] 3.2-stable patches added patches: asoc-disable-register-synchronisation-for-low-frequency-wm8996-sysclk.patch asoc-don-t-go-through-cache-when-applying-wm5100-rev-a-updates.patch asoc-mark-wm5100-register-map-cache-only-when-going-into-bias_off.patch asoc-wm8996-call-_post_pmu-callback-for-cpvdd.patch brcmsmac-fix-tx-queue-flush-infinite-loop.patch crypto-sha512-make-it-work-undo-percpu-message-schedule.patch crypto-sha512-reduce-stack-usage-to-safe-number.patch jbd-issue-cache-flush-after-checkpointing.patch mac80211-fix-work-removal-on-deauth-request.patch tpm_tis-add-delay-after-aborting-command.patch --- ...tion-for-low-frequency-wm8996-sysclk.patch | 61 +++++++++ ...e-when-applying-wm5100-rev-a-updates.patch | 38 ++++++ ...-cache-only-when-going-into-bias_off.patch | 29 ++++ ...96-call-_post_pmu-callback-for-cpvdd.patch | 31 +++++ ...mac-fix-tx-queue-flush-infinite-loop.patch | 51 +++++++ ...it-work-undo-percpu-message-schedule.patch | 75 +++++++++++ ...12-reduce-stack-usage-to-safe-number.patch | 127 ++++++++++++++++++ ...ssue-cache-flush-after-checkpointing.patch | 114 ++++++++++++++++ ...1-fix-work-removal-on-deauth-request.patch | 109 +++++++++++++++ queue-3.2/series | 10 ++ ...tis-add-delay-after-aborting-command.patch | 35 +++++ 11 files changed, 680 insertions(+) create mode 100644 queue-3.2/asoc-disable-register-synchronisation-for-low-frequency-wm8996-sysclk.patch create mode 100644 queue-3.2/asoc-don-t-go-through-cache-when-applying-wm5100-rev-a-updates.patch create mode 100644 queue-3.2/asoc-mark-wm5100-register-map-cache-only-when-going-into-bias_off.patch create mode 100644 queue-3.2/asoc-wm8996-call-_post_pmu-callback-for-cpvdd.patch create mode 100644 queue-3.2/brcmsmac-fix-tx-queue-flush-infinite-loop.patch create mode 100644 queue-3.2/crypto-sha512-make-it-work-undo-percpu-message-schedule.patch create mode 100644 queue-3.2/crypto-sha512-reduce-stack-usage-to-safe-number.patch create mode 100644 queue-3.2/jbd-issue-cache-flush-after-checkpointing.patch create mode 100644 queue-3.2/mac80211-fix-work-removal-on-deauth-request.patch create mode 100644 queue-3.2/tpm_tis-add-delay-after-aborting-command.patch diff --git a/queue-3.2/asoc-disable-register-synchronisation-for-low-frequency-wm8996-sysclk.patch b/queue-3.2/asoc-disable-register-synchronisation-for-low-frequency-wm8996-sysclk.patch new file mode 100644 index 00000000000..97e463ccb0a --- /dev/null +++ b/queue-3.2/asoc-disable-register-synchronisation-for-low-frequency-wm8996-sysclk.patch @@ -0,0 +1,61 @@ +From fed22007113cb857e917913ce016d9b539dc3a80 Mon Sep 17 00:00:00 2001 +From: Mark Brown +Date: Wed, 18 Jan 2012 19:17:06 +0000 +Subject: ASoC: Disable register synchronisation for low frequency WM8996 SYSCLK + +From: Mark Brown + +commit fed22007113cb857e917913ce016d9b539dc3a80 upstream. + +With a low frequency SYSCLK and a fast I2C clock register synchronisation +may occasionally take too long to take effect, causing I/O issues. Disable +synchronisation in order to avoid any issues. + +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/codecs/wm8996.c | 4 ++++ + sound/soc/codecs/wm8996.h | 4 ++++ + 2 files changed, 8 insertions(+) + +--- a/sound/soc/codecs/wm8996.c ++++ b/sound/soc/codecs/wm8996.c +@@ -1932,6 +1932,7 @@ static int wm8996_set_sysclk(struct snd_ + struct wm8996_priv *wm8996 = snd_soc_codec_get_drvdata(codec); + int lfclk = 0; + int ratediv = 0; ++ int sync = WM8996_REG_SYNC; + int src; + int old; + +@@ -1976,6 +1977,7 @@ static int wm8996_set_sysclk(struct snd_ + case 32000: + case 32768: + lfclk = WM8996_LFCLK_ENA; ++ sync = 0; + break; + default: + dev_warn(codec->dev, "Unsupported clock rate %dHz\n", +@@ -1989,6 +1991,8 @@ static int wm8996_set_sysclk(struct snd_ + WM8996_SYSCLK_SRC_MASK | WM8996_SYSCLK_DIV_MASK, + src << WM8996_SYSCLK_SRC_SHIFT | ratediv); + snd_soc_update_bits(codec, WM8996_CLOCKING_1, WM8996_LFCLK_ENA, lfclk); ++ snd_soc_update_bits(codec, WM8996_CONTROL_INTERFACE_1, ++ WM8996_REG_SYNC, sync); + snd_soc_update_bits(codec, WM8996_AIF_CLOCKING_1, + WM8996_SYSCLK_ENA, old); + +--- a/sound/soc/codecs/wm8996.h ++++ b/sound/soc/codecs/wm8996.h +@@ -1567,6 +1567,10 @@ int wm8996_detect(struct snd_soc_codec * + /* + * R257 (0x101) - Control Interface (1) + */ ++#define WM8996_REG_SYNC 0x8000 /* REG_SYNC */ ++#define WM8996_REG_SYNC_MASK 0x8000 /* REG_SYNC */ ++#define WM8996_REG_SYNC_SHIFT 15 /* REG_SYNC */ ++#define WM8996_REG_SYNC_WIDTH 1 /* REG_SYNC */ + #define WM8996_AUTO_INC 0x0004 /* AUTO_INC */ + #define WM8996_AUTO_INC_MASK 0x0004 /* AUTO_INC */ + #define WM8996_AUTO_INC_SHIFT 2 /* AUTO_INC */ diff --git a/queue-3.2/asoc-don-t-go-through-cache-when-applying-wm5100-rev-a-updates.patch b/queue-3.2/asoc-don-t-go-through-cache-when-applying-wm5100-rev-a-updates.patch new file mode 100644 index 00000000000..899f332cc4d --- /dev/null +++ b/queue-3.2/asoc-don-t-go-through-cache-when-applying-wm5100-rev-a-updates.patch @@ -0,0 +1,38 @@ +From 495174a8ffbaa0d15153d855cf206cdc46d51cf4 Mon Sep 17 00:00:00 2001 +From: Mark Brown +Date: Thu, 19 Jan 2012 11:16:37 +0000 +Subject: ASoC: Don't go through cache when applying WM5100 rev A updates + +From: Mark Brown + +commit 495174a8ffbaa0d15153d855cf206cdc46d51cf4 upstream. + +These are all to either uncached registers or fixes to register defaults, +in the former case the cache won't do anything and in the latter case +we're fixing things so the cache sync will do the right thing. + +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/codecs/wm5100.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/sound/soc/codecs/wm5100.c ++++ b/sound/soc/codecs/wm5100.c +@@ -1379,6 +1379,7 @@ static int wm5100_set_bias_level(struct + + switch (wm5100->rev) { + case 0: ++ regcache_cache_bypass(wm5100->regmap, true); + snd_soc_write(codec, 0x11, 0x3); + snd_soc_write(codec, 0x203, 0xc); + snd_soc_write(codec, 0x206, 0); +@@ -1394,6 +1395,7 @@ static int wm5100_set_bias_level(struct + snd_soc_write(codec, + wm5100_reva_patches[i].reg, + wm5100_reva_patches[i].val); ++ regcache_cache_bypass(wm5100->regmap, false); + break; + default: + break; diff --git a/queue-3.2/asoc-mark-wm5100-register-map-cache-only-when-going-into-bias_off.patch b/queue-3.2/asoc-mark-wm5100-register-map-cache-only-when-going-into-bias_off.patch new file mode 100644 index 00000000000..36d3710d1fa --- /dev/null +++ b/queue-3.2/asoc-mark-wm5100-register-map-cache-only-when-going-into-bias_off.patch @@ -0,0 +1,29 @@ +From e53e417331c57b9b97e3f8be870214a02c99265c Mon Sep 17 00:00:00 2001 +From: Mark Brown +Date: Wed, 18 Jan 2012 20:02:38 +0000 +Subject: ASoC: Mark WM5100 register map cache only when going into BIAS_OFF + +From: Mark Brown + +commit e53e417331c57b9b97e3f8be870214a02c99265c upstream. + +Writing to the registers won't work if we do actually manage to hit a fully +powered off state. + +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/codecs/wm5100.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/soc/codecs/wm5100.c ++++ b/sound/soc/codecs/wm5100.c +@@ -1404,6 +1404,7 @@ static int wm5100_set_bias_level(struct + break; + + case SND_SOC_BIAS_OFF: ++ regcache_cache_only(wm5100->regmap, true); + if (wm5100->pdata.ldo_ena) + gpio_set_value_cansleep(wm5100->pdata.ldo_ena, 0); + regulator_bulk_disable(ARRAY_SIZE(wm5100->core_supplies), diff --git a/queue-3.2/asoc-wm8996-call-_post_pmu-callback-for-cpvdd.patch b/queue-3.2/asoc-wm8996-call-_post_pmu-callback-for-cpvdd.patch new file mode 100644 index 00000000000..1000e88d3e4 --- /dev/null +++ b/queue-3.2/asoc-wm8996-call-_post_pmu-callback-for-cpvdd.patch @@ -0,0 +1,31 @@ +From a14304edcd5e8323205db34b08f709feb5357e64 Mon Sep 17 00:00:00 2001 +From: Mark Brown +Date: Sat, 21 Jan 2012 21:48:53 +0000 +Subject: ASoC: wm8996: Call _POST_PMU callback for CPVDD + +From: Mark Brown + +commit a14304edcd5e8323205db34b08f709feb5357e64 upstream. + +We should be allowing a 5ms delay after the charge pump is started in +order to ensure it has finished ramping. + +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/codecs/wm8996.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/sound/soc/codecs/wm8996.c ++++ b/sound/soc/codecs/wm8996.c +@@ -1049,7 +1049,8 @@ SND_SOC_DAPM_SUPPLY_S("SYSCLK", 1, WM899 + SND_SOC_DAPM_SUPPLY_S("SYSDSPCLK", 2, WM8996_CLOCKING_1, 1, 0, NULL, 0), + SND_SOC_DAPM_SUPPLY_S("AIFCLK", 2, WM8996_CLOCKING_1, 2, 0, NULL, 0), + SND_SOC_DAPM_SUPPLY_S("Charge Pump", 2, WM8996_CHARGE_PUMP_1, 15, 0, cp_event, +- SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_POST_PMD), ++ SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_POST_PMU | ++ SND_SOC_DAPM_POST_PMD), + SND_SOC_DAPM_SUPPLY("Bandgap", SND_SOC_NOPM, 0, 0, bg_event, + SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_POST_PMD), + SND_SOC_DAPM_SUPPLY("LDO2", WM8996_POWER_MANAGEMENT_2, 1, 0, NULL, 0), diff --git a/queue-3.2/brcmsmac-fix-tx-queue-flush-infinite-loop.patch b/queue-3.2/brcmsmac-fix-tx-queue-flush-infinite-loop.patch new file mode 100644 index 00000000000..4c824e7cd8c --- /dev/null +++ b/queue-3.2/brcmsmac-fix-tx-queue-flush-infinite-loop.patch @@ -0,0 +1,51 @@ +From f96b08a7e6f69c0f0a576554df3df5b1b519c479 Mon Sep 17 00:00:00 2001 +From: Stanislaw Gruszka +Date: Tue, 17 Jan 2012 12:38:50 +0100 +Subject: brcmsmac: fix tx queue flush infinite loop + +From: Stanislaw Gruszka + +commit f96b08a7e6f69c0f0a576554df3df5b1b519c479 upstream. + +This patch workaround live deadlock problem caused by infinite loop +in brcms_c_wait_for_tx_completion(). I do not consider the patch as +the proper fix, which should fix the real reason of tx queue flush +failure, but patch helps with system lockup. + +Reference: +https://bugzilla.kernel.org/show_bug.cgi?id=42576 + +Reported-and-tested-by: Patrick +Signed-off-by: Stanislaw Gruszka +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/brcm80211/brcmsmac/main.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +--- a/drivers/net/wireless/brcm80211/brcmsmac/main.c ++++ b/drivers/net/wireless/brcm80211/brcmsmac/main.c +@@ -8217,13 +8217,21 @@ int brcms_c_get_curband(struct brcms_c_i + + void brcms_c_wait_for_tx_completion(struct brcms_c_info *wlc, bool drop) + { ++ int timeout = 20; ++ + /* flush packet queue when requested */ + if (drop) + brcmu_pktq_flush(&wlc->pkt_queue->q, false, NULL, NULL); + + /* wait for queue and DMA fifos to run dry */ +- while (!pktq_empty(&wlc->pkt_queue->q) || brcms_txpktpendtot(wlc) > 0) ++ while (!pktq_empty(&wlc->pkt_queue->q) || brcms_txpktpendtot(wlc) > 0) { + brcms_msleep(wlc->wl, 1); ++ ++ if (--timeout == 0) ++ break; ++ } ++ ++ WARN_ON_ONCE(timeout == 0); + } + + void brcms_c_set_beacon_listen_interval(struct brcms_c_info *wlc, u8 interval) diff --git a/queue-3.2/crypto-sha512-make-it-work-undo-percpu-message-schedule.patch b/queue-3.2/crypto-sha512-make-it-work-undo-percpu-message-schedule.patch new file mode 100644 index 00000000000..62b7aee5ef9 --- /dev/null +++ b/queue-3.2/crypto-sha512-make-it-work-undo-percpu-message-schedule.patch @@ -0,0 +1,75 @@ +From 84e31fdb7c797a7303e0cc295cb9bc8b73fb872d Mon Sep 17 00:00:00 2001 +From: Alexey Dobriyan +Date: Sat, 14 Jan 2012 21:27:37 +0300 +Subject: crypto: sha512 - make it work, undo percpu message schedule + +From: Alexey Dobriyan + +commit 84e31fdb7c797a7303e0cc295cb9bc8b73fb872d upstream. + +commit f9e2bca6c22d75a289a349f869701214d63b5060 +aka "crypto: sha512 - Move message schedule W[80] to static percpu area" +created global message schedule area. + +If sha512_update will ever be entered twice, hash will be silently +calculated incorrectly. + +Probably the easiest way to notice incorrect hashes being calculated is +to run 2 ping floods over AH with hmac(sha512): + + #!/usr/sbin/setkey -f + flush; + spdflush; + add IP1 IP2 ah 25 -A hmac-sha512 0x00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000025; + add IP2 IP1 ah 52 -A hmac-sha512 0x00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000052; + spdadd IP1 IP2 any -P out ipsec ah/transport//require; + spdadd IP2 IP1 any -P in ipsec ah/transport//require; + +XfrmInStateProtoError will start ticking with -EBADMSG being returned +from ah_input(). This never happens with, say, hmac(sha1). + +With patch applied (on BOTH sides), XfrmInStateProtoError does not tick +with multiple bidirectional ping flood streams like it doesn't tick +with SHA-1. + +After this patch sha512_transform() will start using ~750 bytes of stack on x86_64. +This is OK for simple loads, for something more heavy, stack reduction will be done +separatedly. + +Signed-off-by: Alexey Dobriyan +Signed-off-by: Herbert Xu +Signed-off-by: Greg Kroah-Hartman + +--- + crypto/sha512_generic.c | 6 +----- + 1 file changed, 1 insertion(+), 5 deletions(-) + +--- a/crypto/sha512_generic.c ++++ b/crypto/sha512_generic.c +@@ -21,8 +21,6 @@ + #include + #include + +-static DEFINE_PER_CPU(u64[80], msg_schedule); +- + static inline u64 Ch(u64 x, u64 y, u64 z) + { + return z ^ (x & (y ^ z)); +@@ -89,7 +87,7 @@ sha512_transform(u64 *state, const u8 *i + u64 a, b, c, d, e, f, g, h, t1, t2; + + int i; +- u64 *W = get_cpu_var(msg_schedule); ++ u64 W[80]; + + /* load the input */ + for (i = 0; i < 16; i++) +@@ -128,8 +126,6 @@ sha512_transform(u64 *state, const u8 *i + + /* erase our data */ + a = b = c = d = e = f = g = h = t1 = t2 = 0; +- memset(W, 0, sizeof(__get_cpu_var(msg_schedule))); +- put_cpu_var(msg_schedule); + } + + static int diff --git a/queue-3.2/crypto-sha512-reduce-stack-usage-to-safe-number.patch b/queue-3.2/crypto-sha512-reduce-stack-usage-to-safe-number.patch new file mode 100644 index 00000000000..29b9c36950a --- /dev/null +++ b/queue-3.2/crypto-sha512-reduce-stack-usage-to-safe-number.patch @@ -0,0 +1,127 @@ +From 51fc6dc8f948047364f7d42a4ed89b416c6cc0a3 Mon Sep 17 00:00:00 2001 +From: Alexey Dobriyan +Date: Sat, 14 Jan 2012 21:40:57 +0300 +Subject: crypto: sha512 - reduce stack usage to safe number + +From: Alexey Dobriyan + +commit 51fc6dc8f948047364f7d42a4ed89b416c6cc0a3 upstream. + +For rounds 16--79, W[i] only depends on W[i - 2], W[i - 7], W[i - 15] and W[i - 16]. +Consequently, keeping all W[80] array on stack is unnecessary, +only 16 values are really needed. + +Using W[16] instead of W[80] greatly reduces stack usage +(~750 bytes to ~340 bytes on x86_64). + +Line by line explanation: +* BLEND_OP + array is "circular" now, all indexes have to be modulo 16. + Round number is positive, so remainder operation should be + without surprises. + +* initial full message scheduling is trimmed to first 16 values which + come from data block, the rest is calculated before it's needed. + +* original loop body is unrolled version of new SHA512_0_15 and + SHA512_16_79 macros, unrolling was done to not do explicit variable + renaming. Otherwise it's the very same code after preprocessing. + See sha1_transform() code which does the same trick. + +Patch survives in-tree crypto test and original bugreport test +(ping flood with hmac(sha512). + +See FIPS 180-2 for SHA-512 definition +http://csrc.nist.gov/publications/fips/fips180-2/fips180-2withchangenotice.pdf + +Signed-off-by: Alexey Dobriyan +Signed-off-by: Herbert Xu +Signed-off-by: Greg Kroah-Hartman + +--- + crypto/sha512_generic.c | 58 ++++++++++++++++++++++++++++-------------------- + 1 file changed, 34 insertions(+), 24 deletions(-) + +--- a/crypto/sha512_generic.c ++++ b/crypto/sha512_generic.c +@@ -78,7 +78,7 @@ static inline void LOAD_OP(int I, u64 *W + + static inline void BLEND_OP(int I, u64 *W) + { +- W[I] = s1(W[I-2]) + W[I-7] + s0(W[I-15]) + W[I-16]; ++ W[I % 16] += s1(W[(I-2) % 16]) + W[(I-7) % 16] + s0(W[(I-15) % 16]); + } + + static void +@@ -87,38 +87,48 @@ sha512_transform(u64 *state, const u8 *i + u64 a, b, c, d, e, f, g, h, t1, t2; + + int i; +- u64 W[80]; ++ u64 W[16]; + + /* load the input */ + for (i = 0; i < 16; i++) + LOAD_OP(i, W, input); + +- for (i = 16; i < 80; i++) { +- BLEND_OP(i, W); +- } +- + /* load the state into our registers */ + a=state[0]; b=state[1]; c=state[2]; d=state[3]; + e=state[4]; f=state[5]; g=state[6]; h=state[7]; + +- /* now iterate */ +- for (i=0; i<80; i+=8) { +- t1 = h + e1(e) + Ch(e,f,g) + sha512_K[i ] + W[i ]; +- t2 = e0(a) + Maj(a,b,c); d+=t1; h=t1+t2; +- t1 = g + e1(d) + Ch(d,e,f) + sha512_K[i+1] + W[i+1]; +- t2 = e0(h) + Maj(h,a,b); c+=t1; g=t1+t2; +- t1 = f + e1(c) + Ch(c,d,e) + sha512_K[i+2] + W[i+2]; +- t2 = e0(g) + Maj(g,h,a); b+=t1; f=t1+t2; +- t1 = e + e1(b) + Ch(b,c,d) + sha512_K[i+3] + W[i+3]; +- t2 = e0(f) + Maj(f,g,h); a+=t1; e=t1+t2; +- t1 = d + e1(a) + Ch(a,b,c) + sha512_K[i+4] + W[i+4]; +- t2 = e0(e) + Maj(e,f,g); h+=t1; d=t1+t2; +- t1 = c + e1(h) + Ch(h,a,b) + sha512_K[i+5] + W[i+5]; +- t2 = e0(d) + Maj(d,e,f); g+=t1; c=t1+t2; +- t1 = b + e1(g) + Ch(g,h,a) + sha512_K[i+6] + W[i+6]; +- t2 = e0(c) + Maj(c,d,e); f+=t1; b=t1+t2; +- t1 = a + e1(f) + Ch(f,g,h) + sha512_K[i+7] + W[i+7]; +- t2 = e0(b) + Maj(b,c,d); e+=t1; a=t1+t2; ++#define SHA512_0_15(i, a, b, c, d, e, f, g, h) \ ++ t1 = h + e1(e) + Ch(e, f, g) + sha512_K[i] + W[i]; \ ++ t2 = e0(a) + Maj(a, b, c); \ ++ d += t1; \ ++ h = t1 + t2 ++ ++#define SHA512_16_79(i, a, b, c, d, e, f, g, h) \ ++ BLEND_OP(i, W); \ ++ t1 = h + e1(e) + Ch(e, f, g) + sha512_K[i] + W[(i)%16]; \ ++ t2 = e0(a) + Maj(a, b, c); \ ++ d += t1; \ ++ h = t1 + t2 ++ ++ for (i = 0; i < 16; i += 8) { ++ SHA512_0_15(i, a, b, c, d, e, f, g, h); ++ SHA512_0_15(i + 1, h, a, b, c, d, e, f, g); ++ SHA512_0_15(i + 2, g, h, a, b, c, d, e, f); ++ SHA512_0_15(i + 3, f, g, h, a, b, c, d, e); ++ SHA512_0_15(i + 4, e, f, g, h, a, b, c, d); ++ SHA512_0_15(i + 5, d, e, f, g, h, a, b, c); ++ SHA512_0_15(i + 6, c, d, e, f, g, h, a, b); ++ SHA512_0_15(i + 7, b, c, d, e, f, g, h, a); ++ } ++ for (i = 16; i < 80; i += 8) { ++ SHA512_16_79(i, a, b, c, d, e, f, g, h); ++ SHA512_16_79(i + 1, h, a, b, c, d, e, f, g); ++ SHA512_16_79(i + 2, g, h, a, b, c, d, e, f); ++ SHA512_16_79(i + 3, f, g, h, a, b, c, d, e); ++ SHA512_16_79(i + 4, e, f, g, h, a, b, c, d); ++ SHA512_16_79(i + 5, d, e, f, g, h, a, b, c); ++ SHA512_16_79(i + 6, c, d, e, f, g, h, a, b); ++ SHA512_16_79(i + 7, b, c, d, e, f, g, h, a); + } + + state[0] += a; state[1] += b; state[2] += c; state[3] += d; diff --git a/queue-3.2/jbd-issue-cache-flush-after-checkpointing.patch b/queue-3.2/jbd-issue-cache-flush-after-checkpointing.patch new file mode 100644 index 00000000000..a510e645b5a --- /dev/null +++ b/queue-3.2/jbd-issue-cache-flush-after-checkpointing.patch @@ -0,0 +1,114 @@ +From 353b67d8ced4dc53281c88150ad295e24bc4b4c5 Mon Sep 17 00:00:00 2001 +From: Jan Kara +Date: Sat, 26 Nov 2011 00:35:39 +0100 +Subject: jbd: Issue cache flush after checkpointing + +From: Jan Kara + +commit 353b67d8ced4dc53281c88150ad295e24bc4b4c5 upstream. + +When we reach cleanup_journal_tail(), there is no guarantee that +checkpointed buffers are on a stable storage - especially if buffers were +written out by log_do_checkpoint(), they are likely to be only in disk's +caches. Thus when we update journal superblock, effectively removing old +transaction from journal, this write of superblock can get to stable storage +before those checkpointed buffers which can result in filesystem corruption +after a crash. + +A similar problem can happen if we replay the journal and wipe it before +flushing disk's caches. + +Thus we must unconditionally issue a cache flush before we update journal +superblock in these cases. The fix is slightly complicated by the fact that we +have to get log tail before we issue cache flush but we can store it in the +journal superblock only after the cache flush. Otherwise we risk races where +new tail is written before appropriate cache flush is finished. + +I managed to reproduce the corruption using somewhat tweaked Chris Mason's +barrier-test scheduler. Also this should fix occasional reports of 'Bit already +freed' filesystem errors which are totally unreproducible but inspection of +several fs images I've gathered over time points to a problem like this. + +Signed-off-by: Jan Kara +Signed-off-by: Greg Kroah-Hartman + +--- + fs/jbd/checkpoint.c | 27 ++++++++++++++++++++++----- + fs/jbd/recovery.c | 4 ++++ + 2 files changed, 26 insertions(+), 5 deletions(-) + +--- a/fs/jbd/checkpoint.c ++++ b/fs/jbd/checkpoint.c +@@ -453,8 +453,6 @@ out: + * + * Return <0 on error, 0 on success, 1 if there was nothing to clean up. + * +- * Called with the journal lock held. +- * + * This is the only part of the journaling code which really needs to be + * aware of transaction aborts. Checkpointing involves writing to the + * main filesystem area rather than to the journal, so it can proceed +@@ -472,13 +470,14 @@ int cleanup_journal_tail(journal_t *jour + if (is_journal_aborted(journal)) + return 1; + +- /* OK, work out the oldest transaction remaining in the log, and ++ /* ++ * OK, work out the oldest transaction remaining in the log, and + * the log block it starts at. + * + * If the log is now empty, we need to work out which is the + * next transaction ID we will write, and where it will +- * start. */ +- ++ * start. ++ */ + spin_lock(&journal->j_state_lock); + spin_lock(&journal->j_list_lock); + transaction = journal->j_checkpoint_transactions; +@@ -504,7 +503,25 @@ int cleanup_journal_tail(journal_t *jour + spin_unlock(&journal->j_state_lock); + return 1; + } ++ spin_unlock(&journal->j_state_lock); ++ ++ /* ++ * We need to make sure that any blocks that were recently written out ++ * --- perhaps by log_do_checkpoint() --- are flushed out before we ++ * drop the transactions from the journal. It's unlikely this will be ++ * necessary, especially with an appropriately sized journal, but we ++ * need this to guarantee correctness. Fortunately ++ * cleanup_journal_tail() doesn't get called all that often. ++ */ ++ if (journal->j_flags & JFS_BARRIER) ++ blkdev_issue_flush(journal->j_fs_dev, GFP_KERNEL, NULL); + ++ spin_lock(&journal->j_state_lock); ++ if (!tid_gt(first_tid, journal->j_tail_sequence)) { ++ spin_unlock(&journal->j_state_lock); ++ /* Someone else cleaned up journal so return 0 */ ++ return 0; ++ } + /* OK, update the superblock to recover the freed space. + * Physical blocks come first: have we wrapped beyond the end of + * the log? */ +--- a/fs/jbd/recovery.c ++++ b/fs/jbd/recovery.c +@@ -20,6 +20,7 @@ + #include + #include + #include ++#include + #endif + + /* +@@ -263,6 +264,9 @@ int journal_recover(journal_t *journal) + err2 = sync_blockdev(journal->j_fs_dev); + if (!err) + err = err2; ++ /* Flush disk caches to get replayed data on the permanent storage */ ++ if (journal->j_flags & JFS_BARRIER) ++ blkdev_issue_flush(journal->j_fs_dev, GFP_KERNEL, NULL); + + return err; + } diff --git a/queue-3.2/mac80211-fix-work-removal-on-deauth-request.patch b/queue-3.2/mac80211-fix-work-removal-on-deauth-request.patch new file mode 100644 index 00000000000..59e2d672e89 --- /dev/null +++ b/queue-3.2/mac80211-fix-work-removal-on-deauth-request.patch @@ -0,0 +1,109 @@ +From bc4934bc61d0a11fd62c5187ff83645628f8be8b Mon Sep 17 00:00:00 2001 +From: Johannes Berg +Date: Wed, 18 Jan 2012 14:10:25 +0100 +Subject: mac80211: fix work removal on deauth request + +From: Johannes Berg + +commit bc4934bc61d0a11fd62c5187ff83645628f8be8b upstream. + +When deauth is requested while an auth or assoc +work item is in progress, we currently delete it +without regard for any state it might need to +clean up. Fix it by cleaning up for those items. + +In the case Pontus found, the problem manifested +itself as such: + +authenticate with 00:23:69:aa:dd:7b (try 1) +authenticated +failed to insert Dummy STA entry for the AP (error -17) +deauthenticating from 00:23:69:aa:dd:7b by local choice (reason=2) + +It could also happen differently if the driver +uses the tx_sync callback. + +We can't just call the ->done() method of the work +items because that will lock up due to the locking +in cfg80211. This fix isn't very clean, but that +seems acceptable since I have patches pending to +remove this code completely. + +Reported-by: Pontus Fuchs +Tested-by: Pontus Fuchs +Signed-off-by: Johannes Berg +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + net/mac80211/mlme.c | 38 +++++++++++++++++++++++++++----------- + 1 file changed, 27 insertions(+), 11 deletions(-) + +--- a/net/mac80211/mlme.c ++++ b/net/mac80211/mlme.c +@@ -2719,7 +2719,6 @@ int ieee80211_mgd_deauth(struct ieee8021 + { + struct ieee80211_local *local = sdata->local; + struct ieee80211_if_managed *ifmgd = &sdata->u.mgd; +- struct ieee80211_work *wk; + u8 bssid[ETH_ALEN]; + bool assoc_bss = false; + +@@ -2732,30 +2731,47 @@ int ieee80211_mgd_deauth(struct ieee8021 + assoc_bss = true; + } else { + bool not_auth_yet = false; ++ struct ieee80211_work *tmp, *wk = NULL; + + mutex_unlock(&ifmgd->mtx); + + mutex_lock(&local->mtx); +- list_for_each_entry(wk, &local->work_list, list) { +- if (wk->sdata != sdata) ++ list_for_each_entry(tmp, &local->work_list, list) { ++ if (tmp->sdata != sdata) + continue; + +- if (wk->type != IEEE80211_WORK_DIRECT_PROBE && +- wk->type != IEEE80211_WORK_AUTH && +- wk->type != IEEE80211_WORK_ASSOC && +- wk->type != IEEE80211_WORK_ASSOC_BEACON_WAIT) ++ if (tmp->type != IEEE80211_WORK_DIRECT_PROBE && ++ tmp->type != IEEE80211_WORK_AUTH && ++ tmp->type != IEEE80211_WORK_ASSOC && ++ tmp->type != IEEE80211_WORK_ASSOC_BEACON_WAIT) + continue; + +- if (memcmp(req->bss->bssid, wk->filter_ta, ETH_ALEN)) ++ if (memcmp(req->bss->bssid, tmp->filter_ta, ETH_ALEN)) + continue; + +- not_auth_yet = wk->type == IEEE80211_WORK_DIRECT_PROBE; +- list_del_rcu(&wk->list); +- free_work(wk); ++ not_auth_yet = tmp->type == IEEE80211_WORK_DIRECT_PROBE; ++ list_del_rcu(&tmp->list); ++ synchronize_rcu(); ++ wk = tmp; + break; + } + mutex_unlock(&local->mtx); + ++ if (wk && wk->type == IEEE80211_WORK_ASSOC) { ++ /* clean up dummy sta & TX sync */ ++ sta_info_destroy_addr(wk->sdata, wk->filter_ta); ++ if (wk->assoc.synced) ++ drv_finish_tx_sync(local, wk->sdata, ++ wk->filter_ta, ++ IEEE80211_TX_SYNC_ASSOC); ++ } else if (wk && wk->type == IEEE80211_WORK_AUTH) { ++ if (wk->probe_auth.synced) ++ drv_finish_tx_sync(local, wk->sdata, ++ wk->filter_ta, ++ IEEE80211_TX_SYNC_AUTH); ++ } ++ kfree(wk); ++ + /* + * If somebody requests authentication and we haven't + * sent out an auth frame yet there's no need to send diff --git a/queue-3.2/series b/queue-3.2/series index 06a70214821..e2317d666df 100644 --- a/queue-3.2/series +++ b/queue-3.2/series @@ -10,3 +10,13 @@ drm-radeon-kms-move-panel-mode-setup-into-encoder-mode-set.patch drm-radeon-kms-rework-modeset-sequence-for-dce41-and-dce5.patch drm-fix-authentication-kernel-crash.patch xfs-fix-missing-xfs_iunlock-on-error-recovery-path-in-xfs_readlink.patch +asoc-mark-wm5100-register-map-cache-only-when-going-into-bias_off.patch +asoc-disable-register-synchronisation-for-low-frequency-wm8996-sysclk.patch +asoc-don-t-go-through-cache-when-applying-wm5100-rev-a-updates.patch +asoc-wm8996-call-_post_pmu-callback-for-cpvdd.patch +brcmsmac-fix-tx-queue-flush-infinite-loop.patch +mac80211-fix-work-removal-on-deauth-request.patch +jbd-issue-cache-flush-after-checkpointing.patch +crypto-sha512-make-it-work-undo-percpu-message-schedule.patch +crypto-sha512-reduce-stack-usage-to-safe-number.patch +tpm_tis-add-delay-after-aborting-command.patch diff --git a/queue-3.2/tpm_tis-add-delay-after-aborting-command.patch b/queue-3.2/tpm_tis-add-delay-after-aborting-command.patch new file mode 100644 index 00000000000..07315df12d5 --- /dev/null +++ b/queue-3.2/tpm_tis-add-delay-after-aborting-command.patch @@ -0,0 +1,35 @@ +From a927b8131794ee449b7f6666e7ab61301949b20f Mon Sep 17 00:00:00 2001 +From: Stefan Berger +Date: Fri, 11 Nov 2011 12:57:06 -0500 +Subject: tpm_tis: add delay after aborting command + +From: Stefan Berger + +commit a927b8131794ee449b7f6666e7ab61301949b20f upstream. + +This patch adds a delay after aborting a command. Some TPMs need +this and will not process the subsequent command correctly otherwise. + +It's worth noting that a TPM randomly failing to process a command, +maps to randomly failing suspend/resume operations. + +Signed-off-by: Stefan Berger +Signed-off-by: Rajiv Andrade +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/char/tpm/tpm_tis.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/char/tpm/tpm_tis.c ++++ b/drivers/char/tpm/tpm_tis.c +@@ -432,6 +432,9 @@ static int probe_itpm(struct tpm_chip *c + out: + itpm = rem_itpm; + tpm_tis_ready(chip); ++ /* some TPMs need a break here otherwise they will not work ++ * correctly on the immediately subsequent command */ ++ msleep(chip->vendor.timeout_b); + release_locality(chip, chip->vendor.locality, 0); + + return rc; -- 2.47.3