From e9e789cb8a457a946280f9fcf67c7bd42133b74e Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Tue, 6 May 2014 15:52:31 -0700 Subject: [PATCH] 3.10-stable patches added patches: arc-entry-handler-tweaks-optimize-away-redundant-irq_disable_save.patch arc-entry-handler-tweaks-simplify-branch-for-in-kernel-preemption.patch b43-fix-machine-check-error-due-to-improper-access-of-b43_mmio_psm_phy_hdr.patch framebuffer-fix-cfb_copyarea.patch iwlwifi-dvm-take-mutex-when-sending-sync-bt-config-command.patch libata-ahci-accommodate-tag-ordered-controllers.patch mach64-fix-cursor-when-character-width-is-not-a-multiple-of-8-pixels.patch mach64-use-unaligned-access.patch matroxfb-restore-the-registers-m_access-and-m_pitch.patch powerpc-tm-disable-irq-in-tm_recheckpoint.patch s390-bpf-jit-initialize-a-register-if-1st-insn-is-bpf_s_ldx_b_msh.patch s390-chsc-fix-sei-usage-on-old-fw-levels.patch --- ...mize-away-redundant-irq_disable_save.patch | 84 ++++ ...lify-branch-for-in-kernel-preemption.patch | 43 ++ ...roper-access-of-b43_mmio_psm_phy_hdr.patch | 65 +++ queue-3.10/framebuffer-fix-cfb_copyarea.patch | 400 ++++++++++++++++++ ...-when-sending-sync-bt-config-command.patch | 44 ++ ...-accommodate-tag-ordered-controllers.patch | 96 +++++ ...-width-is-not-a-multiple-of-8-pixels.patch | 88 ++++ queue-3.10/mach64-use-unaligned-access.patch | 46 ++ ...e-the-registers-m_access-and-m_pitch.patch | 157 +++++++ ...pc-tm-disable-irq-in-tm_recheckpoint.patch | 145 +++++++ ...ister-if-1st-insn-is-bpf_s_ldx_b_msh.patch | 30 ++ ...-chsc-fix-sei-usage-on-old-fw-levels.patch | 70 +++ queue-3.10/series | 12 + 13 files changed, 1280 insertions(+) create mode 100644 queue-3.10/arc-entry-handler-tweaks-optimize-away-redundant-irq_disable_save.patch create mode 100644 queue-3.10/arc-entry-handler-tweaks-simplify-branch-for-in-kernel-preemption.patch create mode 100644 queue-3.10/b43-fix-machine-check-error-due-to-improper-access-of-b43_mmio_psm_phy_hdr.patch create mode 100644 queue-3.10/framebuffer-fix-cfb_copyarea.patch create mode 100644 queue-3.10/iwlwifi-dvm-take-mutex-when-sending-sync-bt-config-command.patch create mode 100644 queue-3.10/libata-ahci-accommodate-tag-ordered-controllers.patch create mode 100644 queue-3.10/mach64-fix-cursor-when-character-width-is-not-a-multiple-of-8-pixels.patch create mode 100644 queue-3.10/mach64-use-unaligned-access.patch create mode 100644 queue-3.10/matroxfb-restore-the-registers-m_access-and-m_pitch.patch create mode 100644 queue-3.10/powerpc-tm-disable-irq-in-tm_recheckpoint.patch create mode 100644 queue-3.10/s390-bpf-jit-initialize-a-register-if-1st-insn-is-bpf_s_ldx_b_msh.patch create mode 100644 queue-3.10/s390-chsc-fix-sei-usage-on-old-fw-levels.patch diff --git a/queue-3.10/arc-entry-handler-tweaks-optimize-away-redundant-irq_disable_save.patch b/queue-3.10/arc-entry-handler-tweaks-optimize-away-redundant-irq_disable_save.patch new file mode 100644 index 00000000000..f843d8710dd --- /dev/null +++ b/queue-3.10/arc-entry-handler-tweaks-optimize-away-redundant-irq_disable_save.patch @@ -0,0 +1,84 @@ +From fce16bc35ae4a45634f3dc348d8d297a25c277cf Mon Sep 17 00:00:00 2001 +From: Vineet Gupta +Date: Tue, 9 Jul 2013 17:06:40 +0530 +Subject: ARC: Entry Handler tweaks: Optimize away redundant IRQ_DISABLE_SAVE + +From: Vineet Gupta + +commit fce16bc35ae4a45634f3dc348d8d297a25c277cf upstream. + +In the exception return path, for both U/K cases, intr are already +disabled (for various existing reasons). So when we drop down to +@restore_regs, we need not redo that. + +There was subtle issue - when intr were NOT being disabled for +ret-to-kernel-but-no-preemption case - now fixed by moving the +IRQ_DISABLE further up in @resume_kernel_mode. + +So what do we gain: + +* Shaves off a few insn in return path. + +* Eliminates the need for IRQ_DISABLE_SAVE assembler macro for ARCv2 + hence allows for entry code sharing. + +Signed-off-by: Vineet Gupta +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arc/include/asm/irqflags.h | 7 ------- + arch/arc/kernel/entry.S | 10 +++++----- + 2 files changed, 5 insertions(+), 12 deletions(-) + +--- a/arch/arc/include/asm/irqflags.h ++++ b/arch/arc/include/asm/irqflags.h +@@ -137,13 +137,6 @@ static inline void arch_unmask_irq(unsig + flag \scratch + .endm + +-.macro IRQ_DISABLE_SAVE scratch, save +- lr \scratch, [status32] +- mov \save, \scratch /* Make a copy */ +- bic \scratch, \scratch, (STATUS_E1_MASK | STATUS_E2_MASK) +- flag \scratch +-.endm +- + .macro IRQ_ENABLE scratch + lr \scratch, [status32] + or \scratch, \scratch, (STATUS_E1_MASK | STATUS_E2_MASK) +--- a/arch/arc/kernel/entry.S ++++ b/arch/arc/kernel/entry.S +@@ -653,6 +653,9 @@ resume_kernel_mode: + + #ifdef CONFIG_PREEMPT + ++ ; This is a must for preempt_schedule_irq() ++ IRQ_DISABLE r9 ++ + ; Can't preempt if preemption disabled + GET_CURR_THR_INFO_FROM_SP r10 + ld r8, [r10, THREAD_INFO_PREEMPT_COUNT] +@@ -662,8 +665,6 @@ resume_kernel_mode: + ld r9, [r10, THREAD_INFO_FLAGS] + bbit0 r9, TIF_NEED_RESCHED, restore_regs + +- IRQ_DISABLE r9 +- + ; Invoke PREEMPTION + bl preempt_schedule_irq + +@@ -676,12 +677,11 @@ resume_kernel_mode: + ; + ; Restore the saved sys context (common exit-path for EXCPN/IRQ/Trap) + ; IRQ shd definitely not happen between now and rtie ++; All 2 entry points to here already disable interrupts + + restore_regs : + +- ; Disable Interrupts while restoring reg-file back +- ; XXX can this be optimised out +- IRQ_DISABLE_SAVE r9, r10 ;@r10 has prisitine (pre-disable) copy ++ lr r10, [status32] + + #ifdef CONFIG_ARC_CURR_IN_REG + ; Restore User R25 diff --git a/queue-3.10/arc-entry-handler-tweaks-simplify-branch-for-in-kernel-preemption.patch b/queue-3.10/arc-entry-handler-tweaks-simplify-branch-for-in-kernel-preemption.patch new file mode 100644 index 00000000000..19dbdc07845 --- /dev/null +++ b/queue-3.10/arc-entry-handler-tweaks-simplify-branch-for-in-kernel-preemption.patch @@ -0,0 +1,43 @@ +From 147aece29b15051173eb1e767018135361cdba89 Mon Sep 17 00:00:00 2001 +From: Vineet Gupta +Date: Tue, 14 May 2013 18:30:50 +0530 +Subject: ARC: Entry Handler tweaks: Simplify branch for in-kernel preemption + +From: Vineet Gupta + +commit 147aece29b15051173eb1e767018135361cdba89 upstream. + +Signed-off-by: Vineet Gupta +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arc/kernel/entry.S | 8 ++------ + 1 file changed, 2 insertions(+), 6 deletions(-) + +--- a/arch/arc/kernel/entry.S ++++ b/arch/arc/kernel/entry.S +@@ -589,11 +589,7 @@ ARC_ENTRY ret_from_exception + ; Pre-{IRQ,Trap,Exception} K/U mode from pt_regs->status32 + ld r8, [sp, PT_status32] ; returning to User/Kernel Mode + +-#ifdef CONFIG_PREEMPT + bbit0 r8, STATUS_U_BIT, resume_kernel_mode +-#else +- bbit0 r8, STATUS_U_BIT, restore_regs +-#endif + + ; Before returning to User mode check-for-and-complete any pending work + ; such as rescheduling/signal-delivery etc. +@@ -653,10 +649,10 @@ resume_user_mode_begin: + b resume_user_mode_begin ; unconditionally back to U mode ret chks + ; for single exit point from this block + +-#ifdef CONFIG_PREEMPT +- + resume_kernel_mode: + ++#ifdef CONFIG_PREEMPT ++ + ; Can't preempt if preemption disabled + GET_CURR_THR_INFO_FROM_SP r10 + ld r8, [r10, THREAD_INFO_PREEMPT_COUNT] diff --git a/queue-3.10/b43-fix-machine-check-error-due-to-improper-access-of-b43_mmio_psm_phy_hdr.patch b/queue-3.10/b43-fix-machine-check-error-due-to-improper-access-of-b43_mmio_psm_phy_hdr.patch new file mode 100644 index 00000000000..4c776704c0d --- /dev/null +++ b/queue-3.10/b43-fix-machine-check-error-due-to-improper-access-of-b43_mmio_psm_phy_hdr.patch @@ -0,0 +1,65 @@ +From 12cd43c6ed6da7bf7c5afbd74da6959cda6d056b Mon Sep 17 00:00:00 2001 +From: Rafał Miłecki +Date: Sat, 5 Apr 2014 18:08:25 +0200 +Subject: b43: Fix machine check error due to improper access of B43_MMIO_PSM_PHY_HDR +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rafał Miłecki + +commit 12cd43c6ed6da7bf7c5afbd74da6959cda6d056b upstream. + +Register B43_MMIO_PSM_PHY_HDR is 16 bit one, so accessing it with 32b +functions isn't safe. On my machine it causes delayed (!) CPU exception: + +Disabling lock debugging due to kernel taint +mce: [Hardware Error]: CPU 0: Machine Check Exception: 4 Bank 4: b200000000070f0f +mce: [Hardware Error]: TSC 164083803dc +mce: [Hardware Error]: PROCESSOR 2:20fc2 TIME 1396650505 SOCKET 0 APIC 0 microcode 0 +mce: [Hardware Error]: Run the above through 'mcelog --ascii' +mce: [Hardware Error]: Machine check: Processor context corrupt +Kernel panic - not syncing: Fatal machine check on current CPU +Kernel Offset: 0x0 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffff9fffffff) + +Signed-off-by: Rafał Miłecki +Acked-by: Larry Finger +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/b43/phy_n.c | 14 +++++++------- + 1 file changed, 7 insertions(+), 7 deletions(-) + +--- a/drivers/net/wireless/b43/phy_n.c ++++ b/drivers/net/wireless/b43/phy_n.c +@@ -5175,22 +5175,22 @@ static void b43_nphy_channel_setup(struc + int ch = new_channel->hw_value; + + u16 old_band_5ghz; +- u32 tmp32; ++ u16 tmp16; + + old_band_5ghz = + b43_phy_read(dev, B43_NPHY_BANDCTL) & B43_NPHY_BANDCTL_5GHZ; + if (new_channel->band == IEEE80211_BAND_5GHZ && !old_band_5ghz) { +- tmp32 = b43_read32(dev, B43_MMIO_PSM_PHY_HDR); +- b43_write32(dev, B43_MMIO_PSM_PHY_HDR, tmp32 | 4); ++ tmp16 = b43_read16(dev, B43_MMIO_PSM_PHY_HDR); ++ b43_write16(dev, B43_MMIO_PSM_PHY_HDR, tmp16 | 4); + b43_phy_set(dev, B43_PHY_B_BBCFG, 0xC000); +- b43_write32(dev, B43_MMIO_PSM_PHY_HDR, tmp32); ++ b43_write16(dev, B43_MMIO_PSM_PHY_HDR, tmp16); + b43_phy_set(dev, B43_NPHY_BANDCTL, B43_NPHY_BANDCTL_5GHZ); + } else if (new_channel->band == IEEE80211_BAND_2GHZ && old_band_5ghz) { + b43_phy_mask(dev, B43_NPHY_BANDCTL, ~B43_NPHY_BANDCTL_5GHZ); +- tmp32 = b43_read32(dev, B43_MMIO_PSM_PHY_HDR); +- b43_write32(dev, B43_MMIO_PSM_PHY_HDR, tmp32 | 4); ++ tmp16 = b43_read16(dev, B43_MMIO_PSM_PHY_HDR); ++ b43_write16(dev, B43_MMIO_PSM_PHY_HDR, tmp16 | 4); + b43_phy_mask(dev, B43_PHY_B_BBCFG, 0x3FFF); +- b43_write32(dev, B43_MMIO_PSM_PHY_HDR, tmp32); ++ b43_write16(dev, B43_MMIO_PSM_PHY_HDR, tmp16); + } + + b43_chantab_phy_upload(dev, e); diff --git a/queue-3.10/framebuffer-fix-cfb_copyarea.patch b/queue-3.10/framebuffer-fix-cfb_copyarea.patch new file mode 100644 index 00000000000..3513e07dec5 --- /dev/null +++ b/queue-3.10/framebuffer-fix-cfb_copyarea.patch @@ -0,0 +1,400 @@ +From 00a9d699bc85052d2d3ed56251cd928024ce06a3 Mon Sep 17 00:00:00 2001 +From: Mikulas Patocka +Date: Thu, 23 Jan 2014 14:39:29 -0500 +Subject: framebuffer: fix cfb_copyarea + +From: Mikulas Patocka + +commit 00a9d699bc85052d2d3ed56251cd928024ce06a3 upstream. + +The function cfb_copyarea is buggy when the copy operation is not aligned on +long boundary (4 bytes on 32-bit machines, 8 bytes on 64-bit machines). + +How to reproduce: +- use x86-64 machine +- use a framebuffer driver without acceleration (for example uvesafb) +- set the framebuffer to 8-bit depth + (for example fbset -a 1024x768-60 -depth 8) +- load a font with character width that is not a multiple of 8 pixels + note: the console-tools package cannot load a font that has + width different from 8 pixels. You need to install the packages + "kbd" and "console-terminus" and use the program "setfont" to + set font width (for example: setfont Uni2-Terminus20x10) +- move some text left and right on the bash command line and you get a + screen corruption + +To expose more bugs, put this line to the end of uvesafb_init_info: +info->flags |= FBINFO_HWACCEL_COPYAREA | FBINFO_READS_FAST; +- Now framebuffer console will use cfb_copyarea for console scrolling. +You get a screen corruption when console is scrolled. + +This patch is a rewrite of cfb_copyarea. It fixes the bugs, with this +patch, console scrolling in 8-bit depth with a font width that is not a +multiple of 8 pixels works fine. + +The cfb_copyarea code was very buggy and it looks like it was written +and never tried with non-8-pixel font. + +Signed-off-by: Mikulas Patocka +Signed-off-by: Tomi Valkeinen +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/video/cfbcopyarea.c | 153 ++++++++++++++++++++++---------------------- + 1 file changed, 78 insertions(+), 75 deletions(-) + +--- a/drivers/video/cfbcopyarea.c ++++ b/drivers/video/cfbcopyarea.c +@@ -43,13 +43,22 @@ + */ + + static void +-bitcpy(struct fb_info *p, unsigned long __iomem *dst, int dst_idx, +- const unsigned long __iomem *src, int src_idx, int bits, ++bitcpy(struct fb_info *p, unsigned long __iomem *dst, unsigned dst_idx, ++ const unsigned long __iomem *src, unsigned src_idx, int bits, + unsigned n, u32 bswapmask) + { + unsigned long first, last; + int const shift = dst_idx-src_idx; +- int left, right; ++ ++#if 0 ++ /* ++ * If you suspect bug in this function, compare it with this simple ++ * memmove implementation. ++ */ ++ fb_memmove((char *)dst + ((dst_idx & (bits - 1))) / 8, ++ (char *)src + ((src_idx & (bits - 1))) / 8, n / 8); ++ return; ++#endif + + first = fb_shifted_pixels_mask_long(p, dst_idx, bswapmask); + last = ~fb_shifted_pixels_mask_long(p, (dst_idx+n) % bits, bswapmask); +@@ -98,9 +107,8 @@ bitcpy(struct fb_info *p, unsigned long + unsigned long d0, d1; + int m; + +- right = shift & (bits - 1); +- left = -shift & (bits - 1); +- bswapmask &= shift; ++ int const left = shift & (bits - 1); ++ int const right = -shift & (bits - 1); + + if (dst_idx+n <= bits) { + // Single destination word +@@ -110,15 +118,15 @@ bitcpy(struct fb_info *p, unsigned long + d0 = fb_rev_pixels_in_long(d0, bswapmask); + if (shift > 0) { + // Single source word +- d0 >>= right; ++ d0 <<= left; + } else if (src_idx+n <= bits) { + // Single source word +- d0 <<= left; ++ d0 >>= right; + } else { + // 2 source words + d1 = FB_READL(src + 1); + d1 = fb_rev_pixels_in_long(d1, bswapmask); +- d0 = d0<>right; ++ d0 = d0 >> right | d1 << left; + } + d0 = fb_rev_pixels_in_long(d0, bswapmask); + FB_WRITEL(comp(d0, FB_READL(dst), first), dst); +@@ -135,60 +143,59 @@ bitcpy(struct fb_info *p, unsigned long + if (shift > 0) { + // Single source word + d1 = d0; +- d0 >>= right; +- dst++; ++ d0 <<= left; + n -= bits - dst_idx; + } else { + // 2 source words + d1 = FB_READL(src++); + d1 = fb_rev_pixels_in_long(d1, bswapmask); + +- d0 = d0<>right; +- dst++; ++ d0 = d0 >> right | d1 << left; + n -= bits - dst_idx; + } + d0 = fb_rev_pixels_in_long(d0, bswapmask); + FB_WRITEL(comp(d0, FB_READL(dst), first), dst); + d0 = d1; ++ dst++; + + // Main chunk + m = n % bits; + n /= bits; + while ((n >= 4) && !bswapmask) { + d1 = FB_READL(src++); +- FB_WRITEL(d0 << left | d1 >> right, dst++); ++ FB_WRITEL(d0 >> right | d1 << left, dst++); + d0 = d1; + d1 = FB_READL(src++); +- FB_WRITEL(d0 << left | d1 >> right, dst++); ++ FB_WRITEL(d0 >> right | d1 << left, dst++); + d0 = d1; + d1 = FB_READL(src++); +- FB_WRITEL(d0 << left | d1 >> right, dst++); ++ FB_WRITEL(d0 >> right | d1 << left, dst++); + d0 = d1; + d1 = FB_READL(src++); +- FB_WRITEL(d0 << left | d1 >> right, dst++); ++ FB_WRITEL(d0 >> right | d1 << left, dst++); + d0 = d1; + n -= 4; + } + while (n--) { + d1 = FB_READL(src++); + d1 = fb_rev_pixels_in_long(d1, bswapmask); +- d0 = d0 << left | d1 >> right; ++ d0 = d0 >> right | d1 << left; + d0 = fb_rev_pixels_in_long(d0, bswapmask); + FB_WRITEL(d0, dst++); + d0 = d1; + } + + // Trailing bits +- if (last) { +- if (m <= right) { ++ if (m) { ++ if (m <= bits - right) { + // Single source word +- d0 <<= left; ++ d0 >>= right; + } else { + // 2 source words + d1 = FB_READL(src); + d1 = fb_rev_pixels_in_long(d1, + bswapmask); +- d0 = d0<>right; ++ d0 = d0 >> right | d1 << left; + } + d0 = fb_rev_pixels_in_long(d0, bswapmask); + FB_WRITEL(comp(d0, FB_READL(dst), last), dst); +@@ -202,43 +209,46 @@ bitcpy(struct fb_info *p, unsigned long + */ + + static void +-bitcpy_rev(struct fb_info *p, unsigned long __iomem *dst, int dst_idx, +- const unsigned long __iomem *src, int src_idx, int bits, ++bitcpy_rev(struct fb_info *p, unsigned long __iomem *dst, unsigned dst_idx, ++ const unsigned long __iomem *src, unsigned src_idx, int bits, + unsigned n, u32 bswapmask) + { + unsigned long first, last; + int shift; + +- dst += (n-1)/bits; +- src += (n-1)/bits; +- if ((n-1) % bits) { +- dst_idx += (n-1) % bits; +- dst += dst_idx >> (ffs(bits) - 1); +- dst_idx &= bits - 1; +- src_idx += (n-1) % bits; +- src += src_idx >> (ffs(bits) - 1); +- src_idx &= bits - 1; +- } ++#if 0 ++ /* ++ * If you suspect bug in this function, compare it with this simple ++ * memmove implementation. ++ */ ++ fb_memmove((char *)dst + ((dst_idx & (bits - 1))) / 8, ++ (char *)src + ((src_idx & (bits - 1))) / 8, n / 8); ++ return; ++#endif ++ ++ dst += (dst_idx + n - 1) / bits; ++ src += (src_idx + n - 1) / bits; ++ dst_idx = (dst_idx + n - 1) % bits; ++ src_idx = (src_idx + n - 1) % bits; + + shift = dst_idx-src_idx; + +- first = fb_shifted_pixels_mask_long(p, bits - 1 - dst_idx, bswapmask); +- last = ~fb_shifted_pixels_mask_long(p, bits - 1 - ((dst_idx-n) % bits), +- bswapmask); ++ first = ~fb_shifted_pixels_mask_long(p, (dst_idx + 1) % bits, bswapmask); ++ last = fb_shifted_pixels_mask_long(p, (bits + dst_idx + 1 - n) % bits, bswapmask); + + if (!shift) { + // Same alignment for source and dest + + if ((unsigned long)dst_idx+1 >= n) { + // Single word +- if (last) +- first &= last; +- FB_WRITEL( comp( FB_READL(src), FB_READL(dst), first), dst); ++ if (first) ++ last &= first; ++ FB_WRITEL( comp( FB_READL(src), FB_READL(dst), last), dst); + } else { + // Multiple destination words + + // Leading bits +- if (first != ~0UL) { ++ if (first) { + FB_WRITEL( comp( FB_READL(src), FB_READL(dst), first), dst); + dst--; + src--; +@@ -262,7 +272,7 @@ bitcpy_rev(struct fb_info *p, unsigned l + FB_WRITEL(FB_READL(src--), dst--); + + // Trailing bits +- if (last) ++ if (last != -1UL) + FB_WRITEL( comp( FB_READL(src), FB_READL(dst), last), dst); + } + } else { +@@ -270,29 +280,28 @@ bitcpy_rev(struct fb_info *p, unsigned l + unsigned long d0, d1; + int m; + +- int const left = -shift & (bits-1); +- int const right = shift & (bits-1); +- bswapmask &= shift; ++ int const left = shift & (bits-1); ++ int const right = -shift & (bits-1); + + if ((unsigned long)dst_idx+1 >= n) { + // Single destination word +- if (last) +- first &= last; ++ if (first) ++ last &= first; + d0 = FB_READL(src); + if (shift < 0) { + // Single source word +- d0 <<= left; ++ d0 >>= right; + } else if (1+(unsigned long)src_idx >= n) { + // Single source word +- d0 >>= right; ++ d0 <<= left; + } else { + // 2 source words + d1 = FB_READL(src - 1); + d1 = fb_rev_pixels_in_long(d1, bswapmask); +- d0 = d0>>right | d1<> right; + } + d0 = fb_rev_pixels_in_long(d0, bswapmask); +- FB_WRITEL(comp(d0, FB_READL(dst), first), dst); ++ FB_WRITEL(comp(d0, FB_READL(dst), last), dst); + } else { + // Multiple destination words + /** We must always remember the last value read, because in case +@@ -307,12 +316,12 @@ bitcpy_rev(struct fb_info *p, unsigned l + if (shift < 0) { + // Single source word + d1 = d0; +- d0 <<= left; ++ d0 >>= right; + } else { + // 2 source words + d1 = FB_READL(src--); + d1 = fb_rev_pixels_in_long(d1, bswapmask); +- d0 = d0>>right | d1<> right; + } + d0 = fb_rev_pixels_in_long(d0, bswapmask); + FB_WRITEL(comp(d0, FB_READL(dst), first), dst); +@@ -325,39 +334,39 @@ bitcpy_rev(struct fb_info *p, unsigned l + n /= bits; + while ((n >= 4) && !bswapmask) { + d1 = FB_READL(src--); +- FB_WRITEL(d0 >> right | d1 << left, dst--); ++ FB_WRITEL(d0 << left | d1 >> right, dst--); + d0 = d1; + d1 = FB_READL(src--); +- FB_WRITEL(d0 >> right | d1 << left, dst--); ++ FB_WRITEL(d0 << left | d1 >> right, dst--); + d0 = d1; + d1 = FB_READL(src--); +- FB_WRITEL(d0 >> right | d1 << left, dst--); ++ FB_WRITEL(d0 << left | d1 >> right, dst--); + d0 = d1; + d1 = FB_READL(src--); +- FB_WRITEL(d0 >> right | d1 << left, dst--); ++ FB_WRITEL(d0 << left | d1 >> right, dst--); + d0 = d1; + n -= 4; + } + while (n--) { + d1 = FB_READL(src--); + d1 = fb_rev_pixels_in_long(d1, bswapmask); +- d0 = d0 >> right | d1 << left; ++ d0 = d0 << left | d1 >> right; + d0 = fb_rev_pixels_in_long(d0, bswapmask); + FB_WRITEL(d0, dst--); + d0 = d1; + } + + // Trailing bits +- if (last) { +- if (m <= left) { ++ if (m) { ++ if (m <= bits - left) { + // Single source word +- d0 >>= right; ++ d0 <<= left; + } else { + // 2 source words + d1 = FB_READL(src); + d1 = fb_rev_pixels_in_long(d1, + bswapmask); +- d0 = d0>>right | d1<> right; + } + d0 = fb_rev_pixels_in_long(d0, bswapmask); + FB_WRITEL(comp(d0, FB_READL(dst), last), dst); +@@ -371,9 +380,9 @@ void cfb_copyarea(struct fb_info *p, con + u32 dx = area->dx, dy = area->dy, sx = area->sx, sy = area->sy; + u32 height = area->height, width = area->width; + unsigned long const bits_per_line = p->fix.line_length*8u; +- unsigned long __iomem *dst = NULL, *src = NULL; ++ unsigned long __iomem *base = NULL; + int bits = BITS_PER_LONG, bytes = bits >> 3; +- int dst_idx = 0, src_idx = 0, rev_copy = 0; ++ unsigned dst_idx = 0, src_idx = 0, rev_copy = 0; + u32 bswapmask = fb_compute_bswapmask(p); + + if (p->state != FBINFO_STATE_RUNNING) +@@ -389,7 +398,7 @@ void cfb_copyarea(struct fb_info *p, con + + // split the base of the framebuffer into a long-aligned address and the + // index of the first bit +- dst = src = (unsigned long __iomem *)((unsigned long)p->screen_base & ~(bytes-1)); ++ base = (unsigned long __iomem *)((unsigned long)p->screen_base & ~(bytes-1)); + dst_idx = src_idx = 8*((unsigned long)p->screen_base & (bytes-1)); + // add offset of source and target area + dst_idx += dy*bits_per_line + dx*p->var.bits_per_pixel; +@@ -402,20 +411,14 @@ void cfb_copyarea(struct fb_info *p, con + while (height--) { + dst_idx -= bits_per_line; + src_idx -= bits_per_line; +- dst += dst_idx >> (ffs(bits) - 1); +- dst_idx &= (bytes - 1); +- src += src_idx >> (ffs(bits) - 1); +- src_idx &= (bytes - 1); +- bitcpy_rev(p, dst, dst_idx, src, src_idx, bits, ++ bitcpy_rev(p, base + (dst_idx / bits), dst_idx % bits, ++ base + (src_idx / bits), src_idx % bits, bits, + width*p->var.bits_per_pixel, bswapmask); + } + } else { + while (height--) { +- dst += dst_idx >> (ffs(bits) - 1); +- dst_idx &= (bytes - 1); +- src += src_idx >> (ffs(bits) - 1); +- src_idx &= (bytes - 1); +- bitcpy(p, dst, dst_idx, src, src_idx, bits, ++ bitcpy(p, base + (dst_idx / bits), dst_idx % bits, ++ base + (src_idx / bits), src_idx % bits, bits, + width*p->var.bits_per_pixel, bswapmask); + dst_idx += bits_per_line; + src_idx += bits_per_line; diff --git a/queue-3.10/iwlwifi-dvm-take-mutex-when-sending-sync-bt-config-command.patch b/queue-3.10/iwlwifi-dvm-take-mutex-when-sending-sync-bt-config-command.patch new file mode 100644 index 00000000000..75f817369ed --- /dev/null +++ b/queue-3.10/iwlwifi-dvm-take-mutex-when-sending-sync-bt-config-command.patch @@ -0,0 +1,44 @@ +From 82e5a649453a3cf23516277abb84273768a1592b Mon Sep 17 00:00:00 2001 +From: Emmanuel Grumbach +Date: Mon, 10 Mar 2014 15:22:03 +0200 +Subject: iwlwifi: dvm: take mutex when sending SYNC BT config command + +From: Emmanuel Grumbach + +commit 82e5a649453a3cf23516277abb84273768a1592b upstream. + +There is a flow in which we send the host command in SYNC +mode, but we don't take priv->mutex. + +Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1046495 + +Reviewed-by: Johannes Berg +Signed-off-by: Emmanuel Grumbach +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/iwlwifi/dvm/main.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +--- a/drivers/net/wireless/iwlwifi/dvm/main.c ++++ b/drivers/net/wireless/iwlwifi/dvm/main.c +@@ -252,13 +252,17 @@ static void iwl_bg_bt_runtime_config(str + struct iwl_priv *priv = + container_of(work, struct iwl_priv, bt_runtime_config); + ++ mutex_lock(&priv->mutex); + if (test_bit(STATUS_EXIT_PENDING, &priv->status)) +- return; ++ goto out; + + /* dont send host command if rf-kill is on */ + if (!iwl_is_ready_rf(priv)) +- return; ++ goto out; ++ + iwlagn_send_advance_bt_config(priv); ++out: ++ mutex_unlock(&priv->mutex); + } + + static void iwl_bg_bt_full_concurrency(struct work_struct *work) diff --git a/queue-3.10/libata-ahci-accommodate-tag-ordered-controllers.patch b/queue-3.10/libata-ahci-accommodate-tag-ordered-controllers.patch new file mode 100644 index 00000000000..101f9270c48 --- /dev/null +++ b/queue-3.10/libata-ahci-accommodate-tag-ordered-controllers.patch @@ -0,0 +1,96 @@ +From 8a4aeec8d2d6a3edeffbdfae451cdf05cbf0fefd Mon Sep 17 00:00:00 2001 +From: Dan Williams +Date: Thu, 17 Apr 2014 11:48:21 -0700 +Subject: libata/ahci: accommodate tag ordered controllers + +From: Dan Williams + +commit 8a4aeec8d2d6a3edeffbdfae451cdf05cbf0fefd upstream. + +The AHCI spec allows implementations to issue commands in tag order +rather than FIFO order: + + 5.3.2.12 P:SelectCmd + HBA sets pSlotLoc = (pSlotLoc + 1) mod (CAP.NCS + 1) + or HBA selects the command to issue that has had the + PxCI bit set to '1' longer than any other command + pending to be issued. + +The result is that commands posted sequentially (time-wise) may play out +of sequence when issued by hardware. + +This behavior has likely been hidden by drives that arrange for commands +to complete in issue order. However, it appears recent drives (two from +different vendors that we have found so far) inflict out-of-order +completions as a matter of course. So, we need to take care to maintain +ordered submission, otherwise we risk triggering a drive to fall out of +sequential-io automation and back to random-io processing, which incurs +large latency and degrades throughput. + +This issue was found in simple benchmarks where QD=2 seq-write +performance was 30-50% *greater* than QD=32 seq-write performance. + +Tagging for -stable and making the change globally since it has a low +risk-to-reward ratio. Also, word is that recent versions of an unnamed +OS also does it this way now. So, drives in the field are already +experienced with this tag ordering scheme. + +Cc: Dave Jiang +Cc: Ed Ciechanowski +Reviewed-by: Matthew Wilcox +Signed-off-by: Dan Williams +Signed-off-by: Tejun Heo +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ata/libata-core.c | 21 +++++++++++++-------- + include/linux/libata.h | 1 + + 2 files changed, 14 insertions(+), 8 deletions(-) + +--- a/drivers/ata/libata-core.c ++++ b/drivers/ata/libata-core.c +@@ -4765,21 +4765,26 @@ void swap_buf_le16(u16 *buf, unsigned in + static struct ata_queued_cmd *ata_qc_new(struct ata_port *ap) + { + struct ata_queued_cmd *qc = NULL; +- unsigned int i; ++ unsigned int i, tag; + + /* no command while frozen */ + if (unlikely(ap->pflags & ATA_PFLAG_FROZEN)) + return NULL; + +- /* the last tag is reserved for internal command. */ +- for (i = 0; i < ATA_MAX_QUEUE - 1; i++) +- if (!test_and_set_bit(i, &ap->qc_allocated)) { +- qc = __ata_qc_from_tag(ap, i); ++ for (i = 0; i < ATA_MAX_QUEUE; i++) { ++ tag = (i + ap->last_tag + 1) % ATA_MAX_QUEUE; ++ ++ /* the last tag is reserved for internal command. */ ++ if (tag == ATA_TAG_INTERNAL) ++ continue; ++ ++ if (!test_and_set_bit(tag, &ap->qc_allocated)) { ++ qc = __ata_qc_from_tag(ap, tag); ++ qc->tag = tag; ++ ap->last_tag = tag; + break; + } +- +- if (qc) +- qc->tag = i; ++ } + + return qc; + } +--- a/include/linux/libata.h ++++ b/include/linux/libata.h +@@ -772,6 +772,7 @@ struct ata_port { + unsigned long qc_allocated; + unsigned int qc_active; + int nr_active_links; /* #links with active qcs */ ++ unsigned int last_tag; /* track next tag hw expects */ + + struct ata_link link; /* host default link */ + struct ata_link *slave_link; /* see ata_slave_link_init() */ diff --git a/queue-3.10/mach64-fix-cursor-when-character-width-is-not-a-multiple-of-8-pixels.patch b/queue-3.10/mach64-fix-cursor-when-character-width-is-not-a-multiple-of-8-pixels.patch new file mode 100644 index 00000000000..389943573f8 --- /dev/null +++ b/queue-3.10/mach64-fix-cursor-when-character-width-is-not-a-multiple-of-8-pixels.patch @@ -0,0 +1,88 @@ +From 43751a1b8ee2e70ce392bf31ef3133da324e68b3 Mon Sep 17 00:00:00 2001 +From: Mikulas Patocka +Date: Thu, 23 Jan 2014 14:41:59 -0500 +Subject: mach64: fix cursor when character width is not a multiple of 8 pixels + +From: Mikulas Patocka + +commit 43751a1b8ee2e70ce392bf31ef3133da324e68b3 upstream. + +This patch fixes the hardware cursor on mach64 when font width is not a +multiple of 8 pixels. + +If you load such a font, the cursor is expanded to the next 8-byte +boundary and a part of the next character after the cursor is not +visible. +For example, when you load a font with 12-pixel width, the cursor width +is 16 pixels and when the cursor is displayed, 4 pixels of the next +character are not visible. + +The reason is this: atyfb_cursor is called with proper parameters to +load an image that is 12-pixel wide. However, the number is aligned on +the next 8-pixel boundary on the line +"unsigned int width = (cursor->image.width + 7) >> 3;" and the whole +function acts as it is was loading a 16-pixel image. + +This patch fixes it so that the value written to the framebuffer is +padded with 0xaaaa (the transparent pattern) when the image size it not +a multiple of 8 pixels. The transparent pattern causes that the cursor +will not interfere with the next character. + +Signed-off-by: Mikulas Patocka +Signed-off-by: Tomi Valkeinen +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/video/aty/mach64_cursor.c | 22 ++++++++++++++++------ + 1 file changed, 16 insertions(+), 6 deletions(-) + +--- a/drivers/video/aty/mach64_cursor.c ++++ b/drivers/video/aty/mach64_cursor.c +@@ -5,6 +5,7 @@ + #include + #include + #include ++#include "../fb_draw.h" + + #include + +@@ -157,24 +158,33 @@ static int atyfb_cursor(struct fb_info * + + for (i = 0; i < height; i++) { + for (j = 0; j < width; j++) { ++ u16 l = 0xaaaa; + b = *src++; + m = *msk++; + switch (cursor->rop) { + case ROP_XOR: + // Upper 4 bits of mask data +- fb_writeb(cursor_bits_lookup[(b ^ m) >> 4], dst++); ++ l = cursor_bits_lookup[(b ^ m) >> 4] | + // Lower 4 bits of mask +- fb_writeb(cursor_bits_lookup[(b ^ m) & 0x0f], +- dst++); ++ (cursor_bits_lookup[(b ^ m) & 0x0f] << 8); + break; + case ROP_COPY: + // Upper 4 bits of mask data +- fb_writeb(cursor_bits_lookup[(b & m) >> 4], dst++); ++ l = cursor_bits_lookup[(b & m) >> 4] | + // Lower 4 bits of mask +- fb_writeb(cursor_bits_lookup[(b & m) & 0x0f], +- dst++); ++ (cursor_bits_lookup[(b & m) & 0x0f] << 8); + break; + } ++ /* ++ * If cursor size is not a multiple of 8 characters ++ * we must pad it with transparent pattern (0xaaaa). ++ */ ++ if ((j + 1) * 8 > cursor->image.width) { ++ l = comp(l, 0xaaaa, ++ (1 << ((cursor->image.width & 7) * 2)) - 1); ++ } ++ fb_writeb(l & 0xff, dst++); ++ fb_writeb(l >> 8, dst++); + } + dst += offset; + } diff --git a/queue-3.10/mach64-use-unaligned-access.patch b/queue-3.10/mach64-use-unaligned-access.patch new file mode 100644 index 00000000000..123bf725586 --- /dev/null +++ b/queue-3.10/mach64-use-unaligned-access.patch @@ -0,0 +1,46 @@ +From c29dd8696dc5dbd50b3ac441b8a26751277ba520 Mon Sep 17 00:00:00 2001 +From: Mikulas Patocka +Date: Thu, 23 Jan 2014 14:41:09 -0500 +Subject: mach64: use unaligned access + +From: Mikulas Patocka + +commit c29dd8696dc5dbd50b3ac441b8a26751277ba520 upstream. + +This patch fixes mach64 to use unaligned access to the font bitmap. + +This fixes unaligned access warning on sparc64 when 14x8 font is loaded. + +On x86(64), unaligned access is handled in hardware, so both functions +le32_to_cpup and get_unaligned_le32 perform the same operation. + +On RISC machines, unaligned access is not handled in hardware, so we +better use get_unaligned_le32 to avoid the unaligned trap and warning. + +Signed-off-by: Mikulas Patocka +Signed-off-by: Tomi Valkeinen +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/video/aty/mach64_accel.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/video/aty/mach64_accel.c ++++ b/drivers/video/aty/mach64_accel.c +@@ -4,6 +4,7 @@ + */ + + #include ++#include + #include + #include