diff options
| author | Paul Gortmaker <paul.gortmaker@windriver.com> | 2011-10-08 23:59:00 -0400 |
|---|---|---|
| committer | Paul Gortmaker <paul.gortmaker@windriver.com> | 2011-10-08 23:59:00 -0400 |
| commit | 26b30f36264abca9fbf837af02d7b08754340537 (patch) | |
| tree | d6d0e9646d3708ef2af18d685f2cb09ddcafc40e | |
| parent | ff0e8d862b0d0314de63bebd99f45c4e51964f55 (diff) | |
| download | longterm-queue-2.6.34-26b30f36264abca9fbf837af02d7b08754340537.tar.gz | |
Raw import of commits based on v2.6.32.40 selections
There was a delete ancient/unused DMA API commit in the 32 selections
that didn't apply cleanly, and since I didn't see the point of it, I
didn't labour over it for the time being and instead skipped it.
Note that some of the .40 selections were added previously.
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
86 files changed, 5467 insertions, 0 deletions
diff --git a/queue/ALSA-emux-Add-trivial-compat-ioctl-handler.patch b/queue/ALSA-emux-Add-trivial-compat-ioctl-handler.patch new file mode 100644 index 0000000..03b26e1 --- /dev/null +++ b/queue/ALSA-emux-Add-trivial-compat-ioctl-handler.patch @@ -0,0 +1,29 @@ +From 9ad8c96319851b73ddfca8a69ddd319442b7a8d0 Mon Sep 17 00:00:00 2001 +From: Ben Hutchings <ben@decadent.org.uk> +Date: Sun, 12 Sep 2010 02:41:47 +0100 +Subject: [PATCH] ALSA: emux: Add trivial compat ioctl handler + +commit a254dba37c5a372fc8b44ba29509ba052d4e859d upstream. + +Reported-by: Carmen Cru <carmen.cru@belgacom.net> +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +Signed-off-by: Takashi Iwai <tiwai@suse.de> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> + +diff --git a/sound/synth/emux/emux_hwdep.c b/sound/synth/emux/emux_hwdep.c +index ff0b2a8..5ae1eae 100644 +--- a/sound/synth/emux/emux_hwdep.c ++++ b/sound/synth/emux/emux_hwdep.c +@@ -128,6 +128,9 @@ snd_emux_init_hwdep(struct snd_emux *emu) + strcpy(hw->name, SNDRV_EMUX_HWDEP_NAME); + hw->iface = SNDRV_HWDEP_IFACE_EMUX_WAVETABLE; + hw->ops.ioctl = snd_emux_hwdep_ioctl; ++ /* The ioctl parameter types are compatible between 32- and ++ * 64-bit architectures, so use the same function. */ ++ hw->ops.ioctl_compat = snd_emux_hwdep_ioctl; + hw->exclusive = 1; + hw->private_data = emu; + if ((err = snd_card_register(emu->card)) < 0) +-- +1.7.7 + diff --git a/queue/ALSA-hda-Add-model-mbp55-entry-for-MacBookPro-7-1.patch b/queue/ALSA-hda-Add-model-mbp55-entry-for-MacBookPro-7-1.patch new file mode 100644 index 0000000..e370b7c --- /dev/null +++ b/queue/ALSA-hda-Add-model-mbp55-entry-for-MacBookPro-7-1.patch @@ -0,0 +1,28 @@ +From fa5270b8a90f5e299e4b8536982fbb746b054c87 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai <tiwai@suse.de> +Date: Mon, 11 Oct 2010 14:46:35 +0200 +Subject: [PATCH] ALSA: hda - Add model=mbp55 entry for MacBookPro 7,1 + +commit f46119b73425df9d1e05c5d5e909a993d95b0218 upstream. + +Reference: Novell bnc#645066 + https://bugzilla.novell.com/show_bug.cgi?id=645066 + +Signed-off-by: Takashi Iwai <tiwai@suse.de> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> + +diff --git a/sound/pci/hda/patch_cirrus.c b/sound/pci/hda/patch_cirrus.c +index 1c6d1c3..6ba2557 100644 +--- a/sound/pci/hda/patch_cirrus.c ++++ b/sound/pci/hda/patch_cirrus.c +@@ -1092,6 +1092,7 @@ static const char *cs420x_models[CS420X_MODELS] = { + static struct snd_pci_quirk cs420x_cfg_tbl[] = { + SND_PCI_QUIRK(0x10de, 0x0ac0, "MacBookPro 5,3", CS420X_MBP53), + SND_PCI_QUIRK(0x10de, 0xcb79, "MacBookPro 5,5", CS420X_MBP55), ++ SND_PCI_QUIRK(0x10de, 0xcb89, "MacBookPro 7,1", CS420X_MBP55), + SND_PCI_QUIRK(0x8086, 0x7270, "IMac 27 Inch", CS420X_IMAC27), + {} /* terminator */ + }; +-- +1.7.7 + diff --git a/queue/ALSA-hda-MacBookAir3-1-3-2-alsa-support.patch b/queue/ALSA-hda-MacBookAir3-1-3-2-alsa-support.patch new file mode 100644 index 0000000..b05e2c5 --- /dev/null +++ b/queue/ALSA-hda-MacBookAir3-1-3-2-alsa-support.patch @@ -0,0 +1,29 @@ +From 23bed9edacb265461ef5d47105ec508f95e5fa36 Mon Sep 17 00:00:00 2001 +From: "Edgar (gimli) Hucek" <gimli@dark-green.com> +Date: Wed, 3 Nov 2010 08:14:10 +0100 +Subject: [PATCH] ALSA: hda - MacBookAir3,1(3,2) alsa support + +commit 87232dd49aeb6b7d1af291edca8bd129a82ef4b5 upstream. + +This patch add support for the MacBookAir3,1 and MacBookAir3,2 to the alsa +sound system. + +Signed-off-by: Edgar (gimli) Hucek <gimli@dark-green.com> +Signed-off-by: Takashi Iwai <tiwai@suse.de> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> + +diff --git a/sound/pci/hda/patch_cirrus.c b/sound/pci/hda/patch_cirrus.c +index 6ba2557..5f08464 100644 +--- a/sound/pci/hda/patch_cirrus.c ++++ b/sound/pci/hda/patch_cirrus.c +@@ -1091,6 +1091,7 @@ static const char *cs420x_models[CS420X_MODELS] = { + + static struct snd_pci_quirk cs420x_cfg_tbl[] = { + SND_PCI_QUIRK(0x10de, 0x0ac0, "MacBookPro 5,3", CS420X_MBP53), ++ SND_PCI_QUIRK(0x10de, 0x0d94, "MacBookAir 3,1(2)", CS420X_MBP55), + SND_PCI_QUIRK(0x10de, 0xcb79, "MacBookPro 5,5", CS420X_MBP55), + SND_PCI_QUIRK(0x10de, 0xcb89, "MacBookPro 7,1", CS420X_MBP55), + SND_PCI_QUIRK(0x8086, 0x7270, "IMac 27 Inch", CS420X_IMAC27), +-- +1.7.7 + diff --git a/queue/ALSA-hda-MacBookPro-5-3-line-in-support.patch b/queue/ALSA-hda-MacBookPro-5-3-line-in-support.patch new file mode 100644 index 0000000..049ae12 --- /dev/null +++ b/queue/ALSA-hda-MacBookPro-5-3-line-in-support.patch @@ -0,0 +1,94 @@ +From 237ffc8311d6d1022961c882324e737571d08798 Mon Sep 17 00:00:00 2001 +From: Vince Weaver <vweaver1@eecs.utk.edu> +Date: Wed, 22 Sep 2010 17:31:37 -0400 +Subject: [PATCH] ALSA: hda - MacBookPro 5,3 line-in support + +commit 4e7d7c6018567fa03f387d06602d4145c75ebbe0 upstream. + +I've found the following patch is necessary to enable line-in on +my MacBookPro 5,3 machine. With the patch applied I've successfully +recorded audio from the line-in jack. This is based on the existing +5,5 support. + +Signed-off-by: Vince Weaver <vweaver1@eecs.utk.edu> +Signed-off-by: Takashi Iwai <tiwai@suse.de> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> + +diff --git a/sound/pci/hda/patch_cirrus.c b/sound/pci/hda/patch_cirrus.c +index 350ee8a..1c6d1c3 100644 +--- a/sound/pci/hda/patch_cirrus.c ++++ b/sound/pci/hda/patch_cirrus.c +@@ -65,6 +65,7 @@ struct cs_spec { + + /* available models */ + enum { ++ CS420X_MBP53, + CS420X_MBP55, + CS420X_IMAC27, + CS420X_AUTO, +@@ -838,7 +839,8 @@ static void cs_automute(struct hda_codec *codec) + AC_VERB_SET_PIN_WIDGET_CONTROL, + hp_present ? 0 : PIN_OUT); + } +- if (spec->board_config == CS420X_MBP55 || ++ if (spec->board_config == CS420X_MBP53 || ++ spec->board_config == CS420X_MBP55 || + spec->board_config == CS420X_IMAC27) { + unsigned int gpio = hp_present ? 0x02 : 0x08; + snd_hda_codec_write(codec, 0x01, 0, +@@ -1080,6 +1082,7 @@ static int cs_parse_auto_config(struct hda_codec *codec) + } + + static const char *cs420x_models[CS420X_MODELS] = { ++ [CS420X_MBP53] = "mbp53", + [CS420X_MBP55] = "mbp55", + [CS420X_IMAC27] = "imac27", + [CS420X_AUTO] = "auto", +@@ -1087,6 +1090,7 @@ static const char *cs420x_models[CS420X_MODELS] = { + + + static struct snd_pci_quirk cs420x_cfg_tbl[] = { ++ SND_PCI_QUIRK(0x10de, 0x0ac0, "MacBookPro 5,3", CS420X_MBP53), + SND_PCI_QUIRK(0x10de, 0xcb79, "MacBookPro 5,5", CS420X_MBP55), + SND_PCI_QUIRK(0x8086, 0x7270, "IMac 27 Inch", CS420X_IMAC27), + {} /* terminator */ +@@ -1097,6 +1101,20 @@ struct cs_pincfg { + u32 val; + }; + ++static struct cs_pincfg mbp53_pincfgs[] = { ++ { 0x09, 0x012b4050 }, ++ { 0x0a, 0x90100141 }, ++ { 0x0b, 0x90100140 }, ++ { 0x0c, 0x018b3020 }, ++ { 0x0d, 0x90a00110 }, ++ { 0x0e, 0x400000f0 }, ++ { 0x0f, 0x01cbe030 }, ++ { 0x10, 0x014be060 }, ++ { 0x12, 0x400000f0 }, ++ { 0x15, 0x400000f0 }, ++ {} /* terminator */ ++}; ++ + static struct cs_pincfg mbp55_pincfgs[] = { + { 0x09, 0x012b4030 }, + { 0x0a, 0x90100121 }, +@@ -1126,6 +1144,7 @@ static struct cs_pincfg imac27_pincfgs[] = { + }; + + static struct cs_pincfg *cs_pincfgs[CS420X_MODELS] = { ++ [CS420X_MBP53] = mbp53_pincfgs, + [CS420X_MBP55] = mbp55_pincfgs, + [CS420X_IMAC27] = imac27_pincfgs, + }; +@@ -1158,6 +1177,7 @@ static int patch_cs420x(struct hda_codec *codec) + + switch (spec->board_config) { + case CS420X_IMAC27: ++ case CS420X_MBP53: + case CS420X_MBP55: + /* GPIO1 = headphones */ + /* GPIO3 = speakers */ +-- +1.7.7 + diff --git a/queue/ALSA-powermac-Lineout-detection-on-G4-DA.patch b/queue/ALSA-powermac-Lineout-detection-on-G4-DA.patch new file mode 100644 index 0000000..8c73ad1 --- /dev/null +++ b/queue/ALSA-powermac-Lineout-detection-on-G4-DA.patch @@ -0,0 +1,40 @@ +From 88011c65172718b731c7fe44b960dbd17320a496 Mon Sep 17 00:00:00 2001 +From: Risto Suominen <Risto.Suominen@gmail.com> +Date: Sun, 4 Apr 2010 08:00:00 +0300 +Subject: [PATCH] ALSA: powermac - Lineout detection on G4 DA + +commit b6d7335001f331f2d295ff15d67e385615ceff81 upstream. + +Lineout (Pro Speaker) detection on PowerMac G4 Digital Audio (Tumbler). + +Signed-off-by: Risto Suominen <Risto.Suominen@gmail.com> +Signed-off-by: Takashi Iwai <tiwai@suse.de> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> + +diff --git a/sound/ppc/tumbler.c b/sound/ppc/tumbler.c +index 3b7471c..696280c 100644 +--- a/sound/ppc/tumbler.c ++++ b/sound/ppc/tumbler.c +@@ -1137,7 +1137,8 @@ static long tumbler_find_device(const char *device, const char *platform, + gp->inactive_val = (*base) ? 0x4 : 0x5; + } else { + const u32 *prop = NULL; +- gp->active_state = IS_G4DA && !strcmp(device, "keywest-gpio15"); ++ gp->active_state = IS_G4DA ++ && !strncmp(device, "keywest-gpio1", 13); + gp->active_val = 0x4; + gp->inactive_val = 0x5; + /* Here are some crude hacks to extract the GPIO polarity and +@@ -1315,6 +1316,9 @@ static int __devinit tumbler_init(struct snd_pmac *chip) + if (irq <= NO_IRQ) + irq = tumbler_find_device("line-output-detect", + NULL, &mix->line_detect, 1); ++ if (IS_G4DA && irq <= NO_IRQ) ++ irq = tumbler_find_device("keywest-gpio16", ++ NULL, &mix->line_detect, 1); + mix->lineout_irq = irq; + + tumbler_reset_audio(chip); +-- +1.7.7 + diff --git a/queue/ALSA-powermac-Reverse-HP-detection-on-G4-DA.patch b/queue/ALSA-powermac-Reverse-HP-detection-on-G4-DA.patch new file mode 100644 index 0000000..b8b6bb6 --- /dev/null +++ b/queue/ALSA-powermac-Reverse-HP-detection-on-G4-DA.patch @@ -0,0 +1,46 @@ +From c0c3cf14eb5ef8dcee1475ce222f50ed5a542516 Mon Sep 17 00:00:00 2001 +From: Risto Suominen <Risto.Suominen@gmail.com> +Date: Sun, 4 Apr 2010 07:59:30 +0300 +Subject: [PATCH] ALSA: powermac - Reverse HP detection on G4 DA + +commit 819ef70b135ba66cd1659c913255686bf931e3d4 upstream. + +Reverse headphone detection bit on PowerMac G4 Digital Audio (Tumbler). + +Signed-off-by: Risto Suominen <Risto.Suominen@gmail.com> +Signed-off-by: Takashi Iwai <tiwai@suse.de> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> + +diff --git a/sound/ppc/tumbler.c b/sound/ppc/tumbler.c +index 789f44f..3b7471c 100644 +--- a/sound/ppc/tumbler.c ++++ b/sound/ppc/tumbler.c +@@ -30,6 +30,7 @@ + #include <linux/kmod.h> + #include <linux/slab.h> + #include <linux/interrupt.h> ++#include <linux/string.h> + #include <sound/core.h> + #include <asm/io.h> + #include <asm/irq.h> +@@ -46,6 +47,8 @@ + #define DBG(fmt...) + #endif + ++#define IS_G4DA (machine_is_compatible("PowerMac3,4")) ++ + /* i2c address for tumbler */ + #define TAS_I2C_ADDR 0x34 + +@@ -1134,7 +1137,7 @@ static long tumbler_find_device(const char *device, const char *platform, + gp->inactive_val = (*base) ? 0x4 : 0x5; + } else { + const u32 *prop = NULL; +- gp->active_state = 0; ++ gp->active_state = IS_G4DA && !strcmp(device, "keywest-gpio15"); + gp->active_val = 0x4; + gp->inactive_val = 0x5; + /* Here are some crude hacks to extract the GPIO polarity and +-- +1.7.7 + diff --git a/queue/ARM-6891-1-prevent-heap-corruption-in-OABI-semtimedo.patch b/queue/ARM-6891-1-prevent-heap-corruption-in-OABI-semtimedo.patch new file mode 100644 index 0000000..16b0743 --- /dev/null +++ b/queue/ARM-6891-1-prevent-heap-corruption-in-OABI-semtimedo.patch @@ -0,0 +1,33 @@ +From f9a600423a922237ac48be4f6774e21ccc0b923a Mon Sep 17 00:00:00 2001 +From: Dan Rosenberg <drosenberg@vsecurity.com> +Date: Fri, 29 Apr 2011 15:48:07 +0100 +Subject: [PATCH] ARM: 6891/1: prevent heap corruption in OABI semtimedop + +commit 0f22072ab50cac7983f9660d33974b45184da4f9 upstream. + +When CONFIG_OABI_COMPAT is set, the wrapper for semtimedop does not +bound the nsops argument. A sufficiently large value will cause an +integer overflow in allocation size, followed by copying too much data +into the allocated buffer. Fix this by restricting nsops to SEMOPM. +Untested. + +Signed-off-by: Dan Rosenberg <drosenberg@vsecurity.com> +Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> + +diff --git a/arch/arm/kernel/sys_oabi-compat.c b/arch/arm/kernel/sys_oabi-compat.c +index 33ff678..73bb15c 100644 +--- a/arch/arm/kernel/sys_oabi-compat.c ++++ b/arch/arm/kernel/sys_oabi-compat.c +@@ -311,7 +311,7 @@ asmlinkage long sys_oabi_semtimedop(int semid, + long err; + int i; + +- if (nsops < 1) ++ if (nsops < 1 || nsops > SEMOPM) + return -EINVAL; + sops = kmalloc(sizeof(*sops) * nsops, GFP_KERNEL); + if (!sops) +-- +1.7.7 + diff --git a/queue/ASoC-Fix-output-PGA-enabling-in-wm_hubs-CODECs.patch b/queue/ASoC-Fix-output-PGA-enabling-in-wm_hubs-CODECs.patch new file mode 100644 index 0000000..675b58e --- /dev/null +++ b/queue/ASoC-Fix-output-PGA-enabling-in-wm_hubs-CODECs.patch @@ -0,0 +1,48 @@ +From ca19ab211c0992be58b5c56a985de3c6d2c76f28 Mon Sep 17 00:00:00 2001 +From: Mark Brown <broonie@opensource.wolfsonmicro.com> +Date: Fri, 8 Apr 2011 16:32:16 +0900 +Subject: [PATCH] ASoC: Fix output PGA enabling in wm_hubs CODECs + +commit 39cca168bdfaef9d0c496ec27f292445d6184946 upstream. + +The output PGA was not being powered up in headphone and speaker paths, +removing the ability to offer volume control and mute with the output +PGA. + +Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com> +Acked-by: Liam Girdwood <lrg@slimlogic.co.uk> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> + +diff --git a/sound/soc/codecs/wm_hubs.c b/sound/soc/codecs/wm_hubs.c +index e1f225a..db6122f 100644 +--- a/sound/soc/codecs/wm_hubs.c ++++ b/sound/soc/codecs/wm_hubs.c +@@ -701,12 +701,12 @@ static const struct snd_soc_dapm_route analogue_routes[] = { + + { "SPKL", "Input Switch", "MIXINL" }, + { "SPKL", "IN1LP Switch", "IN1LP" }, +- { "SPKL", "Output Switch", "Left Output Mixer" }, ++ { "SPKL", "Output Switch", "Left Output PGA" }, + { "SPKL", NULL, "TOCLK" }, + + { "SPKR", "Input Switch", "MIXINR" }, + { "SPKR", "IN1RP Switch", "IN1RP" }, +- { "SPKR", "Output Switch", "Right Output Mixer" }, ++ { "SPKR", "Output Switch", "Right Output PGA" }, + { "SPKR", NULL, "TOCLK" }, + + { "SPKL Boost", "Direct Voice Switch", "Direct Voice" }, +@@ -728,8 +728,8 @@ static const struct snd_soc_dapm_route analogue_routes[] = { + { "SPKOUTRP", NULL, "SPKR Driver" }, + { "SPKOUTRN", NULL, "SPKR Driver" }, + +- { "Left Headphone Mux", "Mixer", "Left Output Mixer" }, +- { "Right Headphone Mux", "Mixer", "Right Output Mixer" }, ++ { "Left Headphone Mux", "Mixer", "Left Output PGA" }, ++ { "Right Headphone Mux", "Mixer", "Right Output PGA" }, + + { "Headphone PGA", NULL, "Left Headphone Mux" }, + { "Headphone PGA", NULL, "Right Headphone Mux" }, +-- +1.7.7 + diff --git a/queue/Bluetooth-Add-MacBookAir3-1-2-support.patch b/queue/Bluetooth-Add-MacBookAir3-1-2-support.patch new file mode 100644 index 0000000..5cf6f26 --- /dev/null +++ b/queue/Bluetooth-Add-MacBookAir3-1-2-support.patch @@ -0,0 +1,101 @@ +From 445746b3faf61adde0bd11e489725bf9a2d81bfc Mon Sep 17 00:00:00 2001 +From: "Edgar (gimli) Hucek" <gimli@dark-green.com> +Date: Thu, 4 Nov 2010 08:04:33 +0100 +Subject: [PATCH] Bluetooth: Add MacBookAir3,1(2) support + +commit 3e3ede7dda2d77d2cbec608e663b6a6ace501bfc upstream. + +Adding the new MacBookAir3,1(2) to btusb. + +Output without the patch and btusb loaded : + +T: Bus=03 Lev=02 Prnt=03 Port=02 Cnt=01 Dev#= 6 Spd=12 MxCh= 0 +D: Ver= 2.00 Cls=ff(vend.) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 +P: Vendor=05ac ProdID=821b Rev= 0.34 +S: Manufacturer=Apple Inc. +S: Product=Bluetooth USB Host Controller +C:* #Ifs= 4 Cfg#= 1 Atr=e0 MxPwr= 0mA +I:* If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=01 Prot=01 Driver=(none) +E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms +E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms +E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms +I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none) +E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms +E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms +I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none) +E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms +E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms +I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none) +E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms +E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms +I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none) +E: Ad=83(I) Atr=01(Isoc) MxPS= 32 Ivl=1ms +E: Ad=03(O) Atr=01(Isoc) MxPS= 32 Ivl=1ms +I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none) +E: Ad=83(I) Atr=01(Isoc) MxPS= 64 Ivl=1ms +E: Ad=03(O) Atr=01(Isoc) MxPS= 64 Ivl=1ms +I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none) +E: Ad=83(I) Atr=01(Isoc) MxPS= 64 Ivl=1ms +E: Ad=03(O) Atr=01(Isoc) MxPS= 64 Ivl=1ms +I:* If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) +E: Ad=84(I) Atr=02(Bulk) MxPS= 32 Ivl=0ms +E: Ad=04(O) Atr=02(Bulk) MxPS= 32 Ivl=0ms +I:* If#= 3 Alt= 0 #EPs= 0 Cls=fe(app. ) Sub=01 Prot=01 Driver=(none) + +Output with the patch and btusb loaded : + +T: Bus=03 Lev=02 Prnt=03 Port=02 Cnt=01 Dev#= 6 Spd=12 MxCh= 0 +D: Ver= 2.00 Cls=ff(vend.) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 +P: Vendor=05ac ProdID=821b Rev= 0.34 +S: Manufacturer=Apple Inc. +S: Product=Bluetooth USB Host Controller +C:* #Ifs= 4 Cfg#= 1 Atr=e0 MxPwr= 0mA +I:* If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb +E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms +E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms +E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms +I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms +E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms +I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms +E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms +I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms +E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms +I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=83(I) Atr=01(Isoc) MxPS= 32 Ivl=1ms +E: Ad=03(O) Atr=01(Isoc) MxPS= 32 Ivl=1ms +I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=83(I) Atr=01(Isoc) MxPS= 64 Ivl=1ms +E: Ad=03(O) Atr=01(Isoc) MxPS= 64 Ivl=1ms +I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=83(I) Atr=01(Isoc) MxPS= 64 Ivl=1ms +E: Ad=03(O) Atr=01(Isoc) MxPS= 64 Ivl=1ms +I:* If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) +E: Ad=84(I) Atr=02(Bulk) MxPS= 32 Ivl=0ms +E: Ad=04(O) Atr=02(Bulk) MxPS= 32 Ivl=0ms +I:* If#= 3 Alt= 0 #EPs= 0 Cls=fe(app. ) Sub=01 Prot=01 Driver=(none) + +Signed-off-by: Edgar (gimli) Hucek <gimli@dark-green.com> +Acked-by: Marcel Holtmann <marcel@holtmann.org> +Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> + +diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c +index 7225e11..0eb6d1b 100644 +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -71,6 +71,9 @@ static struct usb_device_id btusb_table[] = { + /* Apple MacBookPro6,2 */ + { USB_DEVICE(0x05ac, 0x8218) }, + ++ /* Apple MacBookAir3,1, MacBookAir3,2 */ ++ { USB_DEVICE(0x05ac, 0x821b) }, ++ + /* AVM BlueFRITZ! USB v2.0 */ + { USB_DEVICE(0x057c, 0x3800) }, + +-- +1.7.7 + diff --git a/queue/Bluetooth-Add-support-Bluetooth-controller-of-Macboo-2.patch b/queue/Bluetooth-Add-support-Bluetooth-controller-of-Macboo-2.patch new file mode 100644 index 0000000..e1250d9 --- /dev/null +++ b/queue/Bluetooth-Add-support-Bluetooth-controller-of-Macboo-2.patch @@ -0,0 +1,45 @@ +From 6f7086f3be57b33bacd45731b9e9bf7105b4b078 Mon Sep 17 00:00:00 2001 +From: Nobuhiro Iwamatsu <iwamatsu@nigauri.org> +Date: Fri, 20 Aug 2010 16:24:07 +0900 +Subject: [PATCH] Bluetooth: Add support Bluetooth controller of MacbookPro + 7,1 + +commit 3cd01976e702ccaffb907727caff4f8789353599 upstream. + +Bluetooth controller of MacbookPro 7,1 does not work. +Because Device Class of these controllers was set 255 (Vendor Sepecific Class). + +T: Bus=04 Lev=02 Prnt=04 Port=00 Cnt=01 Dev#= 5 Spd=12 MxCh= 0 +D: Ver= 2.00 Cls=ff(vend.) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 +P: Vendor=05ac ProdID=8213 Rev=01.86 +S: Manufacturer=Apple Inc. +S: Product=Bluetooth USB Host Controller +S: SerialNumber=5C5948C81B99 +C: #Ifs= 4 Cfg#= 1 Atr=e0 MxPwr=0mA +I: If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb +I: If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) +I: If#= 3 Alt= 0 #EPs= 0 Cls=fe(app. ) Sub=01 Prot=00 Driver=(none) + +Signed-off-by: Nobuhiro Iwamatsu <iwamatsu@nigauri.org> +Acked-by: Marcel Holtmann <marcel@holtmann.org> +Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> + +diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c +index f55332d..7225e11 100644 +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -59,6 +59,9 @@ static struct usb_device_id btusb_table[] = { + /* Generic Bluetooth USB device */ + { USB_DEVICE_INFO(0xe0, 0x01, 0x01) }, + ++ /* Apple MacBookPro 7,1 */ ++ { USB_DEVICE(0x05ac, 0x8213) }, ++ + /* Apple iMac11,1 */ + { USB_DEVICE(0x05ac, 0x8215) }, + +-- +1.7.7 + diff --git a/queue/Bluetooth-Add-support-Bluetooth-controller-of-Macboo.patch b/queue/Bluetooth-Add-support-Bluetooth-controller-of-Macboo.patch new file mode 100644 index 0000000..16d8857 --- /dev/null +++ b/queue/Bluetooth-Add-support-Bluetooth-controller-of-Macboo.patch @@ -0,0 +1,44 @@ +From 09cbe4fcb7c4fedca90ecf91eef1373fa80cb036 Mon Sep 17 00:00:00 2001 +From: Nobuhiro Iwamatsu <iwamatsu@nigauri.org> +Date: Fri, 20 Aug 2010 16:24:06 +0900 +Subject: [PATCH] Bluetooth: Add support Bluetooth controller of MacbookPro + 6,2 + +commit 9c047157a20521cd525527947b13b950d168d2e6 upstream. + +Bluetooth controller of MacbookPro 6,2 does not work. +Because Device Class of these controllers was set 255 (Vendor Sepecific Class). + +T: Bus=01 Lev=03 Prnt=03 Port=02 Cnt=03 Dev#= 8 Spd=12 MxCh= 0 +D: Ver= 2.00 Cls=ff(vend.) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 +P: Vendor=05ac ProdID=8218 Rev=00.22 +S: Manufacturer=Apple Inc. +S: Product=Bluetooth USB Host Controller +C: #Ifs= 4 Cfg#= 1 Atr=e0 MxPwr=0mA +I: If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=01 Prot=01 Driver=(none) +I: If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none) +I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) +I: If#= 3 Alt= 0 #EPs= 0 Cls=fe(app. ) Sub=01 Prot=01 Driver=(none) + +Signed-off-by: Nobuhiro Iwamatsu <iwamatsu@nigauri.org> +Acked-by: Marcel Holtmann <marcel@holtmann.org> +Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> + +diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c +index c9e2dc8..f55332d 100644 +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -65,6 +65,9 @@ static struct usb_device_id btusb_table[] = { + /* Apple MacBookPro8,2 */ + { USB_DEVICE(0x05ac, 0x821a) }, + ++ /* Apple MacBookPro6,2 */ ++ { USB_DEVICE(0x05ac, 0x8218) }, ++ + /* AVM BlueFRITZ! USB v2.0 */ + { USB_DEVICE(0x057c, 0x3800) }, + +-- +1.7.7 + diff --git a/queue/FLEXCOP-PCI-fix-__xlate_proc_name-warning-for-flexco.patch b/queue/FLEXCOP-PCI-fix-__xlate_proc_name-warning-for-flexco.patch new file mode 100644 index 0000000..35b34c2 --- /dev/null +++ b/queue/FLEXCOP-PCI-fix-__xlate_proc_name-warning-for-flexco.patch @@ -0,0 +1,32 @@ +From c779da07bf49de72304e5074ee3b0ce4dfbd2c83 Mon Sep 17 00:00:00 2001 +From: Patrick Boettcher <pboettcher@kernellabs.com> +Date: Sun, 3 Apr 2011 12:40:24 -0300 +Subject: [PATCH] FLEXCOP-PCI: fix __xlate_proc_name-warning for flexcop-pci + +commit b934c20de1398d4a82d2ecfeb588a214a910f13f upstream. + +This patch fixes the warning about bad names for sys-fs and other kernel-things. The flexcop-pci driver was using '/'-characters in it, which is not good. +This has been fixed in several attempts by several people, but obviously never made it into the kernel. + +Signed-off-by: Patrick Boettcher <pboettcher@kernellabs.com> +Cc: Steffen Barszus <steffenbpunkt@googlemail.com> +Cc: Boris Cuber <me@boris64.net> +Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> + +diff --git a/drivers/media/dvb/b2c2/flexcop-pci.c b/drivers/media/dvb/b2c2/flexcop-pci.c +index 227c020..4f3e3ce 100644 +--- a/drivers/media/dvb/b2c2/flexcop-pci.c ++++ b/drivers/media/dvb/b2c2/flexcop-pci.c +@@ -38,7 +38,7 @@ MODULE_PARM_DESC(debug, + DEBSTATUS); + + #define DRIVER_VERSION "0.1" +-#define DRIVER_NAME "Technisat/B2C2 FlexCop II/IIb/III Digital TV PCI Driver" ++#define DRIVER_NAME "flexcop-pci" + #define DRIVER_AUTHOR "Patrick Boettcher <patrick.boettcher@desy.de>" + + struct flexcop_pci { +-- +1.7.7 + diff --git a/queue/Fix-corrupted-OSF-partition-table-parsing.patch b/queue/Fix-corrupted-OSF-partition-table-parsing.patch new file mode 100644 index 0000000..7e5953f --- /dev/null +++ b/queue/Fix-corrupted-OSF-partition-table-parsing.patch @@ -0,0 +1,73 @@ +From 336a0809e583bf31353800b9c9221627302025b2 Mon Sep 17 00:00:00 2001 +From: Timo Warns <Warns@pre-sense.de> +Date: Mon, 14 Mar 2011 14:59:33 +0100 +Subject: [PATCH] Fix corrupted OSF partition table parsing + +commit 1eafbfeb7bdf59cfe173304c76188f3fd5f1fd05 upstream. + +The kernel automatically evaluates partition tables of storage devices. +The code for evaluating OSF partitions contains a bug that leaks data +from kernel heap memory to userspace for certain corrupted OSF +partitions. + +In more detail: + + for (i = 0 ; i < le16_to_cpu(label->d_npartitions); i++, partition++) { + +iterates from 0 to d_npartitions - 1, where d_npartitions is read from +the partition table without validation and partition is a pointer to an +array of at most 8 d_partitions. + +Add the proper and obvious validation. + +Signed-off-by: Timo Warns <warns@pre-sense.de> +[ Changed the patch trivially to not repeat the whole le16_to_cpu() + thing, and to use an explicit constant for the magic value '8' ] +Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> + +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> + +diff --git a/fs/partitions/osf.c b/fs/partitions/osf.c +index c05c17bc..6e0825e 100644 +--- a/fs/partitions/osf.c ++++ b/fs/partitions/osf.c +@@ -10,10 +10,13 @@ + #include "check.h" + #include "osf.h" + ++#define MAX_OSF_PARTITIONS 8 ++ + int osf_partition(struct parsed_partitions *state, struct block_device *bdev) + { + int i; + int slot = 1; ++ unsigned int npartitions; + Sector sect; + unsigned char *data; + struct disklabel { +@@ -45,7 +48,7 @@ int osf_partition(struct parsed_partitions *state, struct block_device *bdev) + u8 p_fstype; + u8 p_frag; + __le16 p_cpg; +- } d_partitions[8]; ++ } d_partitions[MAX_OSF_PARTITIONS]; + } * label; + struct d_partition * partition; + +@@ -63,7 +66,12 @@ int osf_partition(struct parsed_partitions *state, struct block_device *bdev) + put_dev_sector(sect); + return 0; + } +- for (i = 0 ; i < le16_to_cpu(label->d_npartitions); i++, partition++) { ++ npartitions = le16_to_cpu(label->d_npartitions); ++ if (npartitions > MAX_OSF_PARTITIONS) { ++ put_dev_sector(sect); ++ return 0; ++ } ++ for (i = 0 ; i < npartitions; i++, partition++) { + if (slot == state->limit) + break; + if (le32_to_cpu(partition->p_size)) +-- +1.7.7 + diff --git a/queue/Fix-gcc-4.5.1-miscompiling-drivers-char-i8k.c-again.patch b/queue/Fix-gcc-4.5.1-miscompiling-drivers-char-i8k.c-again.patch new file mode 100644 index 0000000..a0b5b55 --- /dev/null +++ b/queue/Fix-gcc-4.5.1-miscompiling-drivers-char-i8k.c-again.patch @@ -0,0 +1,71 @@ +From d919b8b86ef0bde9fa4f3dc8fd53766f06dc0010 Mon Sep 17 00:00:00 2001 +From: Jim Bos <jim876@xs4all.nl> +Date: Mon, 15 Nov 2010 21:22:37 +0100 +Subject: [PATCH] Fix gcc 4.5.1 miscompiling drivers/char/i8k.c (again) + +commit 22d3243de86bc92d874abb7c5b185d5c47aba323 upstream. + +The fix in commit 6b4e81db2552 ("i8k: Tell gcc that *regs gets +clobbered") to work around the gcc miscompiling i8k.c to add "+m +(*regs)" caused register pressure problems and a build failure. + +Changing the 'asm' statement to 'asm volatile' instead should prevent +that and works around the gcc bug as well, so we can remove the "+m". + +[ Background on the gcc bug: a memory clobber fails to mark the function + the asm resides in as non-pure (aka "__attribute__((const))"), so if + the function does nothing else that triggers the non-pure logic, gcc + will think that that function has no side effects at all. As a result, + callers will be mis-compiled. + + Adding the "+m" made gcc see that it's not a pure function, and so + does "asm volatile". The problem was never really the need to mark + "*regs" as changed, since the memory clobber did that part - the + problem was just a bug in the gcc "pure" function analysis - Linus ] + +Signed-off-by: Jim Bos <jim876@xs4all.nl> +Acked-by: Jakub Jelinek <jakub@redhat.com> +Cc: Andi Kleen <andi@firstfloor.org> +Cc: Andreas Schwab <schwab@linux-m68k.org> +Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> + +diff --git a/drivers/char/i8k.c b/drivers/char/i8k.c +index 828fd24..4365717 100644 +--- a/drivers/char/i8k.c ++++ b/drivers/char/i8k.c +@@ -119,7 +119,7 @@ static int i8k_smm(struct smm_regs *regs) + int eax = regs->eax; + + #if defined(CONFIG_X86_64) +- asm("pushq %%rax\n\t" ++ asm volatile("pushq %%rax\n\t" + "movl 0(%%rax),%%edx\n\t" + "pushq %%rdx\n\t" + "movl 4(%%rax),%%ebx\n\t" +@@ -141,11 +141,11 @@ static int i8k_smm(struct smm_regs *regs) + "lahf\n\t" + "shrl $8,%%eax\n\t" + "andl $1,%%eax\n" +- :"=a"(rc), "+m" (*regs) ++ :"=a"(rc) + : "a"(regs) + : "%ebx", "%ecx", "%edx", "%esi", "%edi", "memory"); + #else +- asm("pushl %%eax\n\t" ++ asm volatile("pushl %%eax\n\t" + "movl 0(%%eax),%%edx\n\t" + "push %%edx\n\t" + "movl 4(%%eax),%%ebx\n\t" +@@ -167,7 +167,7 @@ static int i8k_smm(struct smm_regs *regs) + "lahf\n\t" + "shrl $8,%%eax\n\t" + "andl $1,%%eax\n" +- :"=a"(rc), "+m" (*regs) ++ :"=a"(rc) + : "a"(regs) + : "%ebx", "%ecx", "%edx", "%esi", "%edi", "memory"); + #endif +-- +1.7.7 + diff --git a/queue/GFS2-BUG-in-gfs2_adjust_quota.patch b/queue/GFS2-BUG-in-gfs2_adjust_quota.patch new file mode 100644 index 0000000..a6bc625 --- /dev/null +++ b/queue/GFS2-BUG-in-gfs2_adjust_quota.patch @@ -0,0 +1,46 @@ +From bd61524d4c5eefcc5243298748a3376365360a54 Mon Sep 17 00:00:00 2001 +From: Abhijith Das <adas@redhat.com> +Date: Sun, 4 Jul 2010 01:33:24 -0400 +Subject: [PATCH] GFS2: BUG in gfs2_adjust_quota + +commit 8b4216018bdbfbb1b76150d202b15ee68c38e991 upstream. + +HighMem pages on i686 do not get mapped to the buffer_heads and this was +causing a NULL pointer dereference when we were trying to memset page buffers +to zero. +We now use zero_user() that kmaps the page and directly manipulates page data. +This patch also fixes a boundary condition that was incorrect. + +Signed-off-by: Abhi Das <adas@redhat.com> +Signed-off-by: Steven Whitehouse <swhiteho@redhat.com> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> + +diff --git a/fs/gfs2/quota.c b/fs/gfs2/quota.c +index fcd76f9..083e85c 100644 +--- a/fs/gfs2/quota.c ++++ b/fs/gfs2/quota.c +@@ -694,10 +694,8 @@ get_a_page: + if (!buffer_mapped(bh)) + goto unlock_out; + /* If it's a newly allocated disk block for quota, zero it */ +- if (buffer_new(bh)) { +- memset(bh->b_data, 0, bh->b_size); +- set_buffer_uptodate(bh); +- } ++ if (buffer_new(bh)) ++ zero_user(page, pos - blocksize, bh->b_size); + } + + if (PageUptodate(page)) +@@ -723,7 +721,7 @@ get_a_page: + + /* If quota straddles page boundary, we need to update the rest of the + * quota at the beginning of the next page */ +- if (offset != 0) { /* first page, offset is closer to PAGE_CACHE_SIZE */ ++ if ((offset + sizeof(struct gfs2_quota)) > PAGE_CACHE_SIZE) { + ptr = ptr + nbytes; + nbytes = sizeof(struct gfs2_quota) - nbytes; + offset = 0; +-- +1.7.7 + diff --git a/queue/GFS2-Fix-writing-to-non-page-aligned-gfs2_quota-stru.patch b/queue/GFS2-Fix-writing-to-non-page-aligned-gfs2_quota-stru.patch new file mode 100644 index 0000000..6558eef --- /dev/null +++ b/queue/GFS2-Fix-writing-to-non-page-aligned-gfs2_quota-stru.patch @@ -0,0 +1,164 @@ +From 556f0dbe6791d2bae34ea9bb99fcde554565a2b6 Mon Sep 17 00:00:00 2001 +From: Abhijith Das <adas@redhat.com> +Date: Fri, 7 May 2010 17:50:18 -0400 +Subject: [PATCH] GFS2: Fix writing to non-page aligned gfs2_quota structures + +commit 7e619bc3e6252dc746f64ac3b486e784822e9533 upstream. + +This is the upstream fix for this bug. This patch differs +from the RHEL5 fix (Red Hat bz #555754) which simply writes to the 8-byte +value field of the quota. In upstream quota code, we're +required to write the entire quota (88 bytes) which can be split +across a page boundary. We check for such quotas, and read/write +the two parts from/to the corresponding pages holding these parts. + +With this patch, I don't see the bug anymore using the reproducer +in Red Hat bz 555754. I successfully ran a couple of simple tests/mounts/ +umounts and it doesn't seem like this patch breaks anything else. + +Signed-off-by: Abhi Das <adas@redhat.com> +Signed-off-by: Steven Whitehouse <swhiteho@redhat.com> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> + +diff --git a/fs/gfs2/quota.c b/fs/gfs2/quota.c +index 6dbcbad..fcd76f9 100644 +--- a/fs/gfs2/quota.c ++++ b/fs/gfs2/quota.c +@@ -637,15 +637,40 @@ static int gfs2_adjust_quota(struct gfs2_inode *ip, loff_t loc, + unsigned blocksize, iblock, pos; + struct buffer_head *bh, *dibh; + struct page *page; +- void *kaddr; +- struct gfs2_quota *qp; +- s64 value; +- int err = -EIO; ++ void *kaddr, *ptr; ++ struct gfs2_quota q, *qp; ++ int err, nbytes; + u64 size; + + if (gfs2_is_stuffed(ip)) + gfs2_unstuff_dinode(ip, NULL); +- ++ ++ memset(&q, 0, sizeof(struct gfs2_quota)); ++ err = gfs2_internal_read(ip, NULL, (char *)&q, &loc, sizeof(q)); ++ if (err < 0) ++ return err; ++ ++ err = -EIO; ++ qp = &q; ++ qp->qu_value = be64_to_cpu(qp->qu_value); ++ qp->qu_value += change; ++ qp->qu_value = cpu_to_be64(qp->qu_value); ++ qd->qd_qb.qb_value = qp->qu_value; ++ if (fdq) { ++ if (fdq->d_fieldmask & FS_DQ_BSOFT) { ++ qp->qu_warn = cpu_to_be64(fdq->d_blk_softlimit); ++ qd->qd_qb.qb_warn = qp->qu_warn; ++ } ++ if (fdq->d_fieldmask & FS_DQ_BHARD) { ++ qp->qu_limit = cpu_to_be64(fdq->d_blk_hardlimit); ++ qd->qd_qb.qb_limit = qp->qu_limit; ++ } ++ } ++ ++ /* Write the quota into the quota file on disk */ ++ ptr = qp; ++ nbytes = sizeof(struct gfs2_quota); ++get_a_page: + page = grab_cache_page(mapping, index); + if (!page) + return -ENOMEM; +@@ -667,7 +692,12 @@ static int gfs2_adjust_quota(struct gfs2_inode *ip, loff_t loc, + if (!buffer_mapped(bh)) { + gfs2_block_map(inode, iblock, bh, 1); + if (!buffer_mapped(bh)) +- goto unlock; ++ goto unlock_out; ++ /* If it's a newly allocated disk block for quota, zero it */ ++ if (buffer_new(bh)) { ++ memset(bh->b_data, 0, bh->b_size); ++ set_buffer_uptodate(bh); ++ } + } + + if (PageUptodate(page)) +@@ -677,32 +707,34 @@ static int gfs2_adjust_quota(struct gfs2_inode *ip, loff_t loc, + ll_rw_block(READ_META, 1, &bh); + wait_on_buffer(bh); + if (!buffer_uptodate(bh)) +- goto unlock; ++ goto unlock_out; + } + + gfs2_trans_add_bh(ip->i_gl, bh, 0); + + kaddr = kmap_atomic(page, KM_USER0); +- qp = kaddr + offset; +- value = (s64)be64_to_cpu(qp->qu_value) + change; +- qp->qu_value = cpu_to_be64(value); +- qd->qd_qb.qb_value = qp->qu_value; +- if (fdq) { +- if (fdq->d_fieldmask & FS_DQ_BSOFT) { +- qp->qu_warn = cpu_to_be64(fdq->d_blk_softlimit); +- qd->qd_qb.qb_warn = qp->qu_warn; +- } +- if (fdq->d_fieldmask & FS_DQ_BHARD) { +- qp->qu_limit = cpu_to_be64(fdq->d_blk_hardlimit); +- qd->qd_qb.qb_limit = qp->qu_limit; +- } +- } ++ if (offset + sizeof(struct gfs2_quota) > PAGE_CACHE_SIZE) ++ nbytes = PAGE_CACHE_SIZE - offset; ++ memcpy(kaddr + offset, ptr, nbytes); + flush_dcache_page(page); + kunmap_atomic(kaddr, KM_USER0); ++ unlock_page(page); ++ page_cache_release(page); ++ ++ /* If quota straddles page boundary, we need to update the rest of the ++ * quota at the beginning of the next page */ ++ if (offset != 0) { /* first page, offset is closer to PAGE_CACHE_SIZE */ ++ ptr = ptr + nbytes; ++ nbytes = sizeof(struct gfs2_quota) - nbytes; ++ offset = 0; ++ index++; ++ goto get_a_page; ++ } + ++ /* Update the disk inode timestamp and size (if extended) */ + err = gfs2_meta_inode_buffer(ip, &dibh); + if (err) +- goto unlock; ++ goto out; + + size = loc + sizeof(struct gfs2_quota); + if (size > inode->i_size) { +@@ -715,7 +747,9 @@ static int gfs2_adjust_quota(struct gfs2_inode *ip, loff_t loc, + brelse(dibh); + mark_inode_dirty(inode); + +-unlock: ++out: ++ return err; ++unlock_out: + unlock_page(page); + page_cache_release(page); + return err; +@@ -779,8 +813,10 @@ static int do_sync(unsigned int num_qd, struct gfs2_quota_data **qda) + * rgrp since it won't be allocated during the transaction + */ + al->al_requested = 1; +- /* +1 in the end for block requested above for unstuffing */ +- blocks = num_qd * data_blocks + RES_DINODE + num_qd + 1; ++ /* +3 in the end for unstuffing block, inode size update block ++ * and another block in case quota straddles page boundary and ++ * two blocks need to be updated instead of 1 */ ++ blocks = num_qd * data_blocks + RES_DINODE + num_qd + 3; + + if (nalloc) + al->al_requested += nalloc * (data_blocks + ind_blocks); +-- +1.7.7 + diff --git a/queue/HID-add-MacBookAir-3-1-and-3-2-support.patch b/queue/HID-add-MacBookAir-3-1-and-3-2-support.patch new file mode 100644 index 0000000..824c1c5 --- /dev/null +++ b/queue/HID-add-MacBookAir-3-1-and-3-2-support.patch @@ -0,0 +1,135 @@ +From 9c6732da9ece920e288bd41ca62edcaa5c01b538 Mon Sep 17 00:00:00 2001 +From: "Edgar (gimli) Hucek" <gimli@dark-green.com> +Date: Wed, 3 Nov 2010 10:36:18 -0400 +Subject: [PATCH] HID: add MacBookAir 3,1 and 3,2 support + +commit 99b9f758bbc904f22faffcf4d83205f4a5e7bc0c upstream. + +This patch add support for the MacBookAir3,1 and MacBookAir3,2 to the hid +driver. + +Signed-off-by: Edgar (gimli) Hucek <gimli@dark-green.com> +Signed-off-by: Jiri Kosina <jkosina@suse.cz> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> + +diff --git a/drivers/hid/hid-apple.c b/drivers/hid/hid-apple.c +index bba05d0..1a2bb2a 100644 +--- a/drivers/hid/hid-apple.c ++++ b/drivers/hid/hid-apple.c +@@ -59,6 +59,27 @@ struct apple_key_translation { + u8 flags; + }; + ++static const struct apple_key_translation macbookair_fn_keys[] = { ++ { KEY_BACKSPACE, KEY_DELETE }, ++ { KEY_ENTER, KEY_INSERT }, ++ { KEY_F1, KEY_BRIGHTNESSDOWN, APPLE_FLAG_FKEY }, ++ { KEY_F2, KEY_BRIGHTNESSUP, APPLE_FLAG_FKEY }, ++ { KEY_F3, KEY_SCALE, APPLE_FLAG_FKEY }, ++ { KEY_F4, KEY_DASHBOARD, APPLE_FLAG_FKEY }, ++ { KEY_F6, KEY_PREVIOUSSONG, APPLE_FLAG_FKEY }, ++ { KEY_F7, KEY_PLAYPAUSE, APPLE_FLAG_FKEY }, ++ { KEY_F8, KEY_NEXTSONG, APPLE_FLAG_FKEY }, ++ { KEY_F9, KEY_MUTE, APPLE_FLAG_FKEY }, ++ { KEY_F10, KEY_VOLUMEDOWN, APPLE_FLAG_FKEY }, ++ { KEY_F11, KEY_VOLUMEUP, APPLE_FLAG_FKEY }, ++ { KEY_F12, KEY_EJECTCD, APPLE_FLAG_FKEY }, ++ { KEY_UP, KEY_PAGEUP }, ++ { KEY_DOWN, KEY_PAGEDOWN }, ++ { KEY_LEFT, KEY_HOME }, ++ { KEY_RIGHT, KEY_END }, ++ { } ++}; ++ + static const struct apple_key_translation apple_fn_keys[] = { + { KEY_BACKSPACE, KEY_DELETE }, + { KEY_ENTER, KEY_INSERT }, +@@ -157,10 +178,15 @@ static int hidinput_apple_event(struct hid_device *hid, struct input_dev *input, + if (fnmode) { + int do_translate; + +- trans = apple_find_translation((hid->product < 0x21d || +- hid->product >= 0x300) ? +- powerbook_fn_keys : apple_fn_keys, +- usage->code); ++ if(hid->product >= USB_DEVICE_ID_APPLE_WELLSPRING4_ANSI && ++ hid->product <= USB_DEVICE_ID_APPLE_WELLSPRING4A_JIS) { ++ trans = apple_find_translation(macbookair_fn_keys, usage->code); ++ } else if (hid->product < 0x21d || hid->product >= 0x300) { ++ trans = apple_find_translation(powerbook_fn_keys, usage->code); ++ } else { ++ trans = apple_find_translation(apple_fn_keys, usage->code); ++ } ++ + if (trans) { + if (test_bit(usage->code, asc->pressed_fn)) + do_translate = 1; +@@ -439,6 +465,18 @@ static const struct hid_device_id apple_devices[] = { + .driver_data = APPLE_HAS_FN | APPLE_ISO_KEYBOARD }, + { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING3_JIS), + .driver_data = APPLE_HAS_FN | APPLE_RDESC_JIS }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4_ANSI), ++ .driver_data = APPLE_HAS_FN }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4_ISO), ++ .driver_data = APPLE_HAS_FN | APPLE_ISO_KEYBOARD }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4_JIS), ++ .driver_data = APPLE_HAS_FN | APPLE_RDESC_JIS }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4A_ANSI), ++ .driver_data = APPLE_HAS_FN }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4A_ISO), ++ .driver_data = APPLE_HAS_FN | APPLE_ISO_KEYBOARD }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4A_JIS), ++ .driver_data = APPLE_HAS_FN | APPLE_RDESC_JIS }, + { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_ANSI), + .driver_data = APPLE_NUMLOCK_EMULATION | APPLE_HAS_FN }, + { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_ISO), +diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c +index 0010efa..07ddda5 100644 +--- a/drivers/hid/hid-core.c ++++ b/drivers/hid/hid-core.c +@@ -1284,6 +1284,12 @@ static const struct hid_device_id hid_blacklist[] = { + { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING3_ANSI) }, + { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING3_ISO) }, + { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING3_JIS) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4_ANSI) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4_ISO) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4_JIS) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4A_ANSI) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4A_ISO) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4A_JIS) }, + { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_ANSI) }, + { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_ISO) }, + { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_JIS) }, +@@ -1715,6 +1721,12 @@ static const struct hid_device_id hid_mouse_ignore_list[] = { + { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING3_ANSI) }, + { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING3_ISO) }, + { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING3_JIS) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4_ANSI) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4_ISO) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4_JIS) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4A_ANSI) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4A_ISO) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4A_JIS) }, + { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_FOUNTAIN_TP_ONLY) }, + { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_GEYSER1_TP_ONLY) }, + { } +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h +index b681cbf..fe054d6 100644 +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -92,6 +92,12 @@ + #define USB_DEVICE_ID_APPLE_WELLSPRING3_ANSI 0x0236 + #define USB_DEVICE_ID_APPLE_WELLSPRING3_ISO 0x0237 + #define USB_DEVICE_ID_APPLE_WELLSPRING3_JIS 0x0238 ++#define USB_DEVICE_ID_APPLE_WELLSPRING4_ANSI 0x023f ++#define USB_DEVICE_ID_APPLE_WELLSPRING4_ISO 0x0240 ++#define USB_DEVICE_ID_APPLE_WELLSPRING4_JIS 0x0241 ++#define USB_DEVICE_ID_APPLE_WELLSPRING4A_ANSI 0x0242 ++#define USB_DEVICE_ID_APPLE_WELLSPRING4A_ISO 0x0243 ++#define USB_DEVICE_ID_APPLE_WELLSPRING4A_JIS 0x0244 + #define USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_ANSI 0x0239 + #define USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_ISO 0x023a + #define USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_JIS 0x023b +-- +1.7.7 + diff --git a/queue/Increase-OSF-partition-limit-from-8-to-18.patch b/queue/Increase-OSF-partition-limit-from-8-to-18.patch new file mode 100644 index 0000000..0fbbfc6 --- /dev/null +++ b/queue/Increase-OSF-partition-limit-from-8-to-18.patch @@ -0,0 +1,37 @@ +From 96d07dd2989cedbebef5db7b454b1bde40a5d58c Mon Sep 17 00:00:00 2001 +From: Linus Torvalds <torvalds@linux-foundation.org> +Date: Wed, 16 Mar 2011 08:04:07 -0700 +Subject: [PATCH] Increase OSF partition limit from 8 to 18 + +commit 34d211a2d5df4984a35b18d8ccacbe1d10abb067 upstream. + +It turns out that while a maximum of 8 partitions may be what people +"should" have had, you can actually fit up to 18 entries(*) in a sector. + +And some people clearly were taking advantage of that, like Michael +Cree, who had ten partitions on one of his OSF disks. + +(*) The OSF partition data starts at byte offset 64 in the first sector, + and the array of 16-byte partition entries start at offset 148 in + the on-disk partition structure. + +Reported-by: Michael Cree <mcree@orcon.net.nz> +Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> + +diff --git a/fs/partitions/osf.c b/fs/partitions/osf.c +index 6e0825e..9ddca58 100644 +--- a/fs/partitions/osf.c ++++ b/fs/partitions/osf.c +@@ -10,7 +10,7 @@ + #include "check.h" + #include "osf.h" + +-#define MAX_OSF_PARTITIONS 8 ++#define MAX_OSF_PARTITIONS 18 + + int osf_partition(struct parsed_partitions *state, struct block_device *bdev) + { +-- +1.7.7 + diff --git a/queue/Input-elantech-discard-the-first-2-positions-on-some.patch b/queue/Input-elantech-discard-the-first-2-positions-on-some.patch new file mode 100644 index 0000000..d07dee0 --- /dev/null +++ b/queue/Input-elantech-discard-the-first-2-positions-on-some.patch @@ -0,0 +1,101 @@ +From 8775e47da2b6270c97dd0b951a608b1375391005 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?=C3=89ric=20Piel?= <E.A.B.Piel@tudelft.nl> +Date: Thu, 5 Aug 2010 23:51:49 -0700 +Subject: [PATCH] Input: elantech - discard the first 2 positions on some + firmwares +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +commit 7f29f17b57255b6395046805a98bc663ded63fb8 upstream. + +According to the Dell/Ubuntu driver, what was previously observed as +"jumpy cursor" corresponds to the hardware sending incorrect data for +the first two reports of a one touch finger. So let's use the same +workaround as in the other driver. Also, detect another firmware +version with the same behaviour, as in the other driver. + +Signed-off-by: Éric Piel <eric.piel@tremplin-utc.net> +Signed-off-by: Dmitry Torokhov <dtor@mail.ru> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> + +diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c +index 4400369..a0c19c2 100644 +--- a/drivers/input/mouse/elantech.c ++++ b/drivers/input/mouse/elantech.c +@@ -183,7 +183,6 @@ static void elantech_report_absolute_v1(struct psmouse *psmouse) + struct elantech_data *etd = psmouse->private; + unsigned char *packet = psmouse->packet; + int fingers; +- static int old_fingers; + + if (etd->fw_version < 0x020000) { + /* +@@ -201,10 +200,13 @@ static void elantech_report_absolute_v1(struct psmouse *psmouse) + } + + if (etd->jumpy_cursor) { +- /* Discard packets that are likely to have bogus coordinates */ +- if (fingers > old_fingers) { ++ if (fingers != 1) { ++ etd->single_finger_reports = 0; ++ } else if (etd->single_finger_reports < 2) { ++ /* Discard first 2 reports of one finger, bogus */ ++ etd->single_finger_reports++; + elantech_debug("elantech.c: discarding packet\n"); +- goto discard_packet_v1; ++ return; + } + } + +@@ -236,9 +238,6 @@ static void elantech_report_absolute_v1(struct psmouse *psmouse) + } + + input_sync(dev); +- +- discard_packet_v1: +- old_fingers = fingers; + } + + /* +@@ -734,14 +733,14 @@ int elantech_init(struct psmouse *psmouse) + etd->capabilities = param[0]; + + /* +- * This firmware seems to suffer from misreporting coordinates when ++ * This firmware suffers from misreporting coordinates when + * a touch action starts causing the mouse cursor or scrolled page + * to jump. Enable a workaround. + */ +- if (etd->fw_version == 0x020022) { +- pr_info("elantech.c: firmware version 2.0.34 detected, " ++ if (etd->fw_version == 0x020022 || etd->fw_version == 0x020600) { ++ pr_info("elantech.c: firmware version 2.0.34/2.6.0 detected, " + "enabling jumpy cursor workaround\n"); +- etd->jumpy_cursor = 1; ++ etd->jumpy_cursor = true; + } + + if (elantech_set_absolute_mode(psmouse)) { +diff --git a/drivers/input/mouse/elantech.h b/drivers/input/mouse/elantech.h +index ac57bde..aa4aac5 100644 +--- a/drivers/input/mouse/elantech.h ++++ b/drivers/input/mouse/elantech.h +@@ -100,10 +100,11 @@ struct elantech_data { + unsigned char reg_26; + unsigned char debug; + unsigned char capabilities; +- unsigned char paritycheck; +- unsigned char jumpy_cursor; ++ bool paritycheck; ++ bool jumpy_cursor; + unsigned char hw_version; +- unsigned int fw_version; ++ unsigned int fw_version; ++ unsigned int single_finger_reports; + unsigned char parity[256]; + }; + +-- +1.7.7 + diff --git a/queue/Input-elantech-relax-signature-checks.patch b/queue/Input-elantech-relax-signature-checks.patch new file mode 100644 index 0000000..8223e87 --- /dev/null +++ b/queue/Input-elantech-relax-signature-checks.patch @@ -0,0 +1,57 @@ +From 6def2d4ffd0118f59a4ed06986df71cef9ba7f72 Mon Sep 17 00:00:00 2001 +From: Dmitry Torokhov <dmitry.torokhov@gmail.com> +Date: Wed, 19 May 2010 10:11:13 -0700 +Subject: [PATCH] Input: elantech - relax signature checks + +commit a083632eaf6231162b33e40561cfec6a9c156945 upstream. + +Apparently there are Elantech touchpads that report non-zero in the 2nd byte +of their signature. Adjust the detection routine so that if 2nd byte is +zero and 3rd byte contains value that is not a valid report rate, we still +assume that signature is valid. + +Tested-by: Eric Piel <eric.piel@tremplin-utc.net> +Signed-off-by: Dmitry Torokhov <dtor@mail.ru> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> + +diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c +index 112b4ee..4400369 100644 +--- a/drivers/input/mouse/elantech.c ++++ b/drivers/input/mouse/elantech.c +@@ -575,6 +575,24 @@ static struct attribute_group elantech_attr_group = { + .attrs = elantech_attrs, + }; + ++static bool elantech_is_signature_valid(const unsigned char *param) ++{ ++ static const unsigned char rates[] = { 200, 100, 80, 60, 40, 20, 10 }; ++ int i; ++ ++ if (param[0] == 0) ++ return false; ++ ++ if (param[1] == 0) ++ return true; ++ ++ for (i = 0; i < ARRAY_SIZE(rates); i++) ++ if (param[2] == rates[i]) ++ return false; ++ ++ return true; ++} ++ + /* + * Use magic knock to detect Elantech touchpad + */ +@@ -618,7 +636,7 @@ int elantech_detect(struct psmouse *psmouse, bool set_properties) + pr_debug("elantech.c: Elantech version query result 0x%02x, 0x%02x, 0x%02x.\n", + param[0], param[1], param[2]); + +- if (param[0] == 0 || param[1] != 0) { ++ if (!elantech_is_signature_valid(param)) { + if (!force_elantech) { + pr_debug("elantech.c: Probably not a real Elantech touchpad. Aborting.\n"); + return -1; +-- +1.7.7 + diff --git a/queue/NFS-nfs_wcc_update_inode-should-set-nfsi-attr_gencou.patch b/queue/NFS-nfs_wcc_update_inode-should-set-nfsi-attr_gencou.patch new file mode 100644 index 0000000..9bfe0cf --- /dev/null +++ b/queue/NFS-nfs_wcc_update_inode-should-set-nfsi-attr_gencou.patch @@ -0,0 +1,82 @@ +From 3aed5e2c21667fcb2d647390e2fc43f169fc98d8 Mon Sep 17 00:00:00 2001 +From: Trond Myklebust <Trond.Myklebust@netapp.com> +Date: Tue, 25 Jan 2011 15:28:21 -0500 +Subject: [PATCH] NFS: nfs_wcc_update_inode() should set nfsi->attr_gencount + +commit 27dc1cd3ad9300f81e1219e5fc305d91d85353f8 upstream. + +If the call to nfs_wcc_update_inode() results in an attribute update, we +need to ensure that the inode's attr_gencount gets bumped too, otherwise +we are not protected against races with other GETATTR calls. + +Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> + +diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c +index 50a56ed..b0299c0 100644 +--- a/fs/nfs/inode.c ++++ b/fs/nfs/inode.c +@@ -793,9 +793,10 @@ out: + return ret; + } + +-static void nfs_wcc_update_inode(struct inode *inode, struct nfs_fattr *fattr) ++static unsigned long nfs_wcc_update_inode(struct inode *inode, struct nfs_fattr *fattr) + { + struct nfs_inode *nfsi = NFS_I(inode); ++ unsigned long ret = 0; + + if ((fattr->valid & NFS_ATTR_FATTR_PRECHANGE) + && (fattr->valid & NFS_ATTR_FATTR_CHANGE) +@@ -803,25 +804,32 @@ static void nfs_wcc_update_inode(struct inode *inode, struct nfs_fattr *fattr) + nfsi->change_attr = fattr->change_attr; + if (S_ISDIR(inode->i_mode)) + nfsi->cache_validity |= NFS_INO_INVALID_DATA; ++ ret |= NFS_INO_INVALID_ATTR; + } + /* If we have atomic WCC data, we may update some attributes */ + if ((fattr->valid & NFS_ATTR_FATTR_PRECTIME) + && (fattr->valid & NFS_ATTR_FATTR_CTIME) +- && timespec_equal(&inode->i_ctime, &fattr->pre_ctime)) +- memcpy(&inode->i_ctime, &fattr->ctime, sizeof(inode->i_ctime)); ++ && timespec_equal(&inode->i_ctime, &fattr->pre_ctime)) { ++ memcpy(&inode->i_ctime, &fattr->ctime, sizeof(inode->i_ctime)); ++ ret |= NFS_INO_INVALID_ATTR; ++ } + + if ((fattr->valid & NFS_ATTR_FATTR_PREMTIME) + && (fattr->valid & NFS_ATTR_FATTR_MTIME) + && timespec_equal(&inode->i_mtime, &fattr->pre_mtime)) { +- memcpy(&inode->i_mtime, &fattr->mtime, sizeof(inode->i_mtime)); +- if (S_ISDIR(inode->i_mode)) +- nfsi->cache_validity |= NFS_INO_INVALID_DATA; ++ memcpy(&inode->i_mtime, &fattr->mtime, sizeof(inode->i_mtime)); ++ if (S_ISDIR(inode->i_mode)) ++ nfsi->cache_validity |= NFS_INO_INVALID_DATA; ++ ret |= NFS_INO_INVALID_ATTR; + } + if ((fattr->valid & NFS_ATTR_FATTR_PRESIZE) + && (fattr->valid & NFS_ATTR_FATTR_SIZE) + && i_size_read(inode) == nfs_size_to_loff_t(fattr->pre_size) +- && nfsi->npages == 0) +- i_size_write(inode, nfs_size_to_loff_t(fattr->size)); ++ && nfsi->npages == 0) { ++ i_size_write(inode, nfs_size_to_loff_t(fattr->size)); ++ ret |= NFS_INO_INVALID_ATTR; ++ } ++ return ret; + } + + /** +@@ -1115,7 +1123,7 @@ static int nfs_update_inode(struct inode *inode, struct nfs_fattr *fattr) + | NFS_INO_REVAL_PAGECACHE); + + /* Do atomic weak cache consistency updates */ +- nfs_wcc_update_inode(inode, fattr); ++ invalid |= nfs_wcc_update_inode(inode, fattr); + + /* More cache consistency checks */ + if (fattr->valid & NFS_ATTR_FATTR_CHANGE) { +-- +1.7.7 + diff --git a/queue/NFSv4.1-Ensure-state-manager-thread-dies-on-last-umo.patch b/queue/NFSv4.1-Ensure-state-manager-thread-dies-on-last-umo.patch new file mode 100644 index 0000000..63242ae --- /dev/null +++ b/queue/NFSv4.1-Ensure-state-manager-thread-dies-on-last-umo.patch @@ -0,0 +1,38 @@ +From 704acf920b270d2649fdf822d9cf5836a852f597 Mon Sep 17 00:00:00 2001 +From: Trond Myklebust <Trond.Myklebust@netapp.com> +Date: Fri, 15 Apr 2011 17:34:18 -0400 +Subject: [PATCH] NFSv4.1: Ensure state manager thread dies on last umount + +commit 47c2199b6eb5fbe38ddb844db7cdbd914d304f9c upstream. + +Currently, the state manager may continue to try recovering state forever +even after the last filesystem to reference that nfs_client has umounted. + +Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> + +diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c +index 6c5ed51..c03bdcc 100644 +--- a/fs/nfs/nfs4state.c ++++ b/fs/nfs/nfs4state.c +@@ -1399,7 +1399,7 @@ static void nfs4_state_manager(struct nfs_client *clp) + int status = 0; + + /* Ensure exclusive access to NFSv4 state */ +- for(;;) { ++ do { + if (test_and_clear_bit(NFS4CLNT_LEASE_EXPIRED, &clp->cl_state)) { + /* We're going to have to re-establish a clientid */ + status = nfs4_reclaim_lease(clp); +@@ -1482,7 +1482,7 @@ static void nfs4_state_manager(struct nfs_client *clp) + break; + if (test_and_set_bit(NFS4CLNT_MANAGER_RUNNING, &clp->cl_state) != 0) + break; +- } ++ } while (atomic_read(&clp->cl_count) > 1); + return; + out_error: + printk(KERN_WARNING "Error: state manager failed on NFSv4 server %s" +-- +1.7.7 + diff --git a/queue/Open-with-O_CREAT-flag-set-fails-to-open-existing-fi.patch b/queue/Open-with-O_CREAT-flag-set-fails-to-open-existing-fi.patch new file mode 100644 index 0000000..8bde0c8 --- /dev/null +++ b/queue/Open-with-O_CREAT-flag-set-fails-to-open-existing-fi.patch @@ -0,0 +1,55 @@ +From 44f91c3ff3bd1b2234eb382a5348e3f6d1fdd57e Mon Sep 17 00:00:00 2001 +From: Sachin Prabhu <sprabhu@redhat.com> +Date: Wed, 20 Apr 2011 13:09:35 +0100 +Subject: [PATCH] Open with O_CREAT flag set fails to open existing files on + non writable directories + +commit 1574dff8996ab1ed92c09012f8038b5566fce313 upstream. + +An open on a NFS4 share using the O_CREAT flag on an existing file for +which we have permissions to open but contained in a directory with no +write permissions will fail with EACCES. + +A tcpdump shows that the client had set the open mode to UNCHECKED which +indicates that the file should be created if it doesn't exist and +encountering an existing flag is not an error. Since in this case the +file exists and can be opened by the user, the NFS server is wrong in +attempting to check create permissions on the parent directory. + +The patch adds a conditional statement to check for create permissions +only if the file doesn't exist. + +Signed-off-by: Sachin S. Prabhu <sprabhu@redhat.com> +Signed-off-by: J. Bruce Fields <bfields@redhat.com> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> + +diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c +index 054b50b..7de2873 100644 +--- a/fs/nfsd/vfs.c ++++ b/fs/nfsd/vfs.c +@@ -1387,7 +1387,7 @@ nfsd_create_v3(struct svc_rqst *rqstp, struct svc_fh *fhp, + goto out; + if (!(iap->ia_valid & ATTR_MODE)) + iap->ia_mode = 0; +- err = fh_verify(rqstp, fhp, S_IFDIR, NFSD_MAY_CREATE); ++ err = fh_verify(rqstp, fhp, S_IFDIR, NFSD_MAY_EXEC); + if (err) + goto out; + +@@ -1409,6 +1409,13 @@ nfsd_create_v3(struct svc_rqst *rqstp, struct svc_fh *fhp, + if (IS_ERR(dchild)) + goto out_nfserr; + ++ /* If file doesn't exist, check for permissions to create one */ ++ if (!dchild->d_inode) { ++ err = fh_verify(rqstp, fhp, S_IFDIR, NFSD_MAY_CREATE); ++ if (err) ++ goto out; ++ } ++ + err = fh_compose(resfhp, fhp->fh_export, dchild, fhp); + if (err) + goto out; +-- +1.7.7 + diff --git a/queue/Remove-extra-struct-page-member-from-the-buffer-info.patch b/queue/Remove-extra-struct-page-member-from-the-buffer-info.patch new file mode 100644 index 0000000..e9ab8ad --- /dev/null +++ b/queue/Remove-extra-struct-page-member-from-the-buffer-info.patch @@ -0,0 +1,31 @@ +From a214f9ddf5213a79078c93280aacee33d6675956 Mon Sep 17 00:00:00 2001 +From: Greg Rose <gregory.v.rose@intel.com> +Date: Tue, 16 Nov 2010 19:41:36 -0800 +Subject: [PATCH] Remove extra struct page member from the buffer info + structure + +commit b1d670f10e8078485884f0cf7e384d890909aeaa upstream. + +declaration. + +Reported-by: Andi Kleen <andi@firstfloor.org> +Signed-off-by: Greg Rose <gregory.v.rose@intel.com> +Tested-by: Emil Tantilov <emil.s.tantilov@intel.com> +Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> + +diff --git a/drivers/net/igbvf/igbvf.h b/drivers/net/igbvf/igbvf.h +index debeee2..f7ae284 100644 +--- a/drivers/net/igbvf/igbvf.h ++++ b/drivers/net/igbvf/igbvf.h +@@ -126,7 +126,6 @@ struct igbvf_buffer { + unsigned int page_offset; + }; + }; +- struct page *page; + }; + + union igbvf_desc { +-- +1.7.7 + diff --git a/queue/SUNRPC-fix-NFS-client-over-TCP-hangs-due-to-packet-l.patch b/queue/SUNRPC-fix-NFS-client-over-TCP-hangs-due-to-packet-l.patch new file mode 100644 index 0000000..deabb2d --- /dev/null +++ b/queue/SUNRPC-fix-NFS-client-over-TCP-hangs-due-to-packet-l.patch @@ -0,0 +1,67 @@ +From 78e4ee0eb3280bbd319b86c41ad90e0d63ec3aa6 Mon Sep 17 00:00:00 2001 +From: Andy Chittenden <andyc.bluearc@gmail.com> +Date: Tue, 10 Aug 2010 10:19:53 -0400 +Subject: [PATCH] SUNRPC: fix NFS client over TCP hangs due to packet loss + (Bug 16494) + +commit 669502ff31d7dba1849aec7ee2450a3c61f57d39 upstream. + +When reusing a TCP connection, ensure that it's aborted if a previous +shutdown attempt has been made on that connection so that the RPC over +TCP recovery mechanism succeeds. + +Signed-off-by: Andy Chittenden <andyc.bluearc@gmail.com> +Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> + +diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c +index b613cb7..9bfb685 100644 +--- a/net/sunrpc/xprtsock.c ++++ b/net/sunrpc/xprtsock.c +@@ -1324,10 +1324,11 @@ static void xs_tcp_state_change(struct sock *sk) + if (!(xprt = xprt_from_sock(sk))) + goto out; + dprintk("RPC: xs_tcp_state_change client %p...\n", xprt); +- dprintk("RPC: state %x conn %d dead %d zapped %d\n", ++ dprintk("RPC: state %x conn %d dead %d zapped %d sk_shutdown %d\n", + sk->sk_state, xprt_connected(xprt), + sock_flag(sk, SOCK_DEAD), +- sock_flag(sk, SOCK_ZAPPED)); ++ sock_flag(sk, SOCK_ZAPPED), ++ sk->sk_shutdown); + + switch (sk->sk_state) { + case TCP_ESTABLISHED: +@@ -1798,10 +1799,25 @@ static void xs_tcp_reuse_connection(struct rpc_xprt *xprt, struct sock_xprt *tra + { + unsigned int state = transport->inet->sk_state; + +- if (state == TCP_CLOSE && transport->sock->state == SS_UNCONNECTED) +- return; +- if ((1 << state) & (TCPF_ESTABLISHED|TCPF_SYN_SENT)) +- return; ++ if (state == TCP_CLOSE && transport->sock->state == SS_UNCONNECTED) { ++ /* we don't need to abort the connection if the socket ++ * hasn't undergone a shutdown ++ */ ++ if (transport->inet->sk_shutdown == 0) ++ return; ++ dprintk("RPC: %s: TCP_CLOSEd and sk_shutdown set to %d\n", ++ __func__, transport->inet->sk_shutdown); ++ } ++ if ((1 << state) & (TCPF_ESTABLISHED|TCPF_SYN_SENT)) { ++ /* we don't need to abort the connection if the socket ++ * hasn't undergone a shutdown ++ */ ++ if (transport->inet->sk_shutdown == 0) ++ return; ++ dprintk("RPC: %s: ESTABLISHED/SYN_SENT " ++ "sk_shutdown set to %d\n", ++ __func__, transport->inet->sk_shutdown); ++ } + xs_abort_connection(xprt, transport); + } + +-- +1.7.7 + diff --git a/queue/Staging-rtl8192su-Clean-up-in-case-of-an-error-in-mo.patch b/queue/Staging-rtl8192su-Clean-up-in-case-of-an-error-in-mo.patch new file mode 100644 index 0000000..e319688 --- /dev/null +++ b/queue/Staging-rtl8192su-Clean-up-in-case-of-an-error-in-mo.patch @@ -0,0 +1,104 @@ +From df75c69688944dc69bd04e3fba596ca469f38fc7 Mon Sep 17 00:00:00 2001 +From: Ben Hutchings <ben@decadent.org.uk> +Date: Tue, 25 May 2010 04:20:30 +0100 +Subject: [PATCH] Staging: rtl8192su: Clean up in case of an error in module + initialisation + +commit 9a3dfa0555130952517b9a9c3918729495aa709a upstream. + +Currently various resources may be leaked in case of an error. + +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> + +diff --git a/drivers/staging/rtl8192su/r8192U_core.c b/drivers/staging/rtl8192su/r8192U_core.c +index 04f8516..9848d08 100644 +--- a/drivers/staging/rtl8192su/r8192U_core.c ++++ b/drivers/staging/rtl8192su/r8192U_core.c +@@ -960,10 +960,11 @@ static int proc_get_stats_rx(char *page, char **start, + return len; + } + +-void rtl8192_proc_module_init(void) ++int rtl8192_proc_module_init(void) + { + RT_TRACE(COMP_INIT, "Initializing proc filesystem"); + rtl8192_proc=create_proc_entry(RTL819xU_MODULE_NAME, S_IFDIR, init_net.proc_net); ++ return rtl8192_proc ? 0 : -ENOMEM; + } + + +@@ -7526,35 +7527,63 @@ static int __init rtl8192_usb_module_init(void) + ret = ieee80211_crypto_init(); + if (ret) { + printk(KERN_ERR "ieee80211_crypto_init() failed %d\n", ret); +- return ret; ++ goto fail_crypto; + } + + ret = ieee80211_crypto_tkip_init(); + if (ret) { + printk(KERN_ERR "ieee80211_crypto_tkip_init() failed %d\n", + ret); +- return ret; ++ goto fail_crypto_tkip; + } + + ret = ieee80211_crypto_ccmp_init(); + if (ret) { + printk(KERN_ERR "ieee80211_crypto_ccmp_init() failed %d\n", + ret); +- return ret; ++ goto fail_crypto_ccmp; + } + + ret = ieee80211_crypto_wep_init(); + if (ret) { + printk(KERN_ERR "ieee80211_crypto_wep_init() failed %d\n", ret); +- return ret; ++ goto fail_crypto_wep; + } + + printk(KERN_INFO "\nLinux kernel driver for RTL8192 based WLAN cards\n"); + printk(KERN_INFO "Copyright (c) 2007-2008, Realsil Wlan\n"); + RT_TRACE(COMP_INIT, "Initializing module"); + RT_TRACE(COMP_INIT, "Wireless extensions version %d", WIRELESS_EXT); +- rtl8192_proc_module_init(); +- return usb_register(&rtl8192_usb_driver); ++ ++ ret = rtl8192_proc_module_init(); ++ if (ret) { ++ pr_err("rtl8192_proc_module_init() failed %d\n", ret); ++ goto fail_proc; ++ } ++ ++ ret = usb_register(&rtl8192_usb_driver); ++ if (ret) { ++ pr_err("usb_register() failed %d\n", ret); ++ goto fail_usb; ++ } ++ ++ return 0; ++ ++fail_usb: ++ rtl8192_proc_module_remove(); ++fail_proc: ++ ieee80211_crypto_wep_exit(); ++fail_crypto_wep: ++ ieee80211_crypto_ccmp_exit(); ++fail_crypto_ccmp: ++ ieee80211_crypto_tkip_exit(); ++fail_crypto_tkip: ++ ieee80211_crypto_deinit(); ++fail_crypto: ++#ifdef CONFIG_IEEE80211_DEBUG ++ ieee80211_debug_exit(); ++#endif ++ return ret; + } + + +-- +1.7.7 + diff --git a/queue/Staging-rtl8192su-Fix-procfs-code-for-interfaces-not.patch b/queue/Staging-rtl8192su-Fix-procfs-code-for-interfaces-not.patch new file mode 100644 index 0000000..51e4826 --- /dev/null +++ b/queue/Staging-rtl8192su-Fix-procfs-code-for-interfaces-not.patch @@ -0,0 +1,107 @@ +From ac9cdb2fe70723f22f27bf0f61dc1f3688d1c564 Mon Sep 17 00:00:00 2001 +From: Ben Hutchings <ben@decadent.org.uk> +Date: Tue, 25 May 2010 04:25:57 +0100 +Subject: [PATCH] Staging: rtl8192su: Fix procfs code for interfaces not named + wlan0 + +commit 41a38d9e632f7c9ec5ad8fc627567d97f4302c4a upstream. + +The current code creates directories in procfs named after interfaces, +but doesn't handle renaming. This can result in name collisions and +consequent WARNINGs. It also means that the interface name cannot +reliably be used to remove the directory - in fact the current code +doesn't even try, and always uses "wlan0"! + +Since the name of a proc_dir_entry is embedded in it, use that when +removing it. + +Add a netdev notifier to catch interface renaming, and remove and +re-add the directory at this point. + +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> + +diff --git a/drivers/staging/rtl8192su/r8192U_core.c b/drivers/staging/rtl8192su/r8192U_core.c +index 9848d08..7946cf6 100644 +--- a/drivers/staging/rtl8192su/r8192U_core.c ++++ b/drivers/staging/rtl8192su/r8192U_core.c +@@ -26,6 +26,7 @@ + + #include <linux/vmalloc.h> + #include <linux/slab.h> ++#include <linux/notifier.h> + + #undef LOOP_TEST + #undef DUMP_RX +@@ -161,6 +162,8 @@ MODULE_PARM_DESC(channels," Channel bitmask for specific locales. NYI"); + static int __devinit rtl8192_usb_probe(struct usb_interface *intf, + const struct usb_device_id *id); + static void __devexit rtl8192_usb_disconnect(struct usb_interface *intf); ++static const struct net_device_ops rtl8192_netdev_ops; ++static struct notifier_block proc_netdev_notifier; + + static struct usb_driver rtl8192_usb_driver = { + .name = RTL819xU_MODULE_NAME, /* Driver name */ +@@ -962,14 +965,22 @@ static int proc_get_stats_rx(char *page, char **start, + + int rtl8192_proc_module_init(void) + { ++ int ret; ++ + RT_TRACE(COMP_INIT, "Initializing proc filesystem"); + rtl8192_proc=create_proc_entry(RTL819xU_MODULE_NAME, S_IFDIR, init_net.proc_net); +- return rtl8192_proc ? 0 : -ENOMEM; ++ if (!rtl8192_proc) ++ return -ENOMEM; ++ ret = register_netdevice_notifier(&proc_netdev_notifier); ++ if (ret) ++ remove_proc_entry(RTL819xU_MODULE_NAME, init_net.proc_net); ++ return ret; + } + + + void rtl8192_proc_module_remove(void) + { ++ unregister_netdevice_notifier(&proc_netdev_notifier); + remove_proc_entry(RTL819xU_MODULE_NAME, init_net.proc_net); + } + +@@ -997,8 +1008,7 @@ void rtl8192_proc_remove_one(struct net_device *dev) + remove_proc_entry("registers-e", priv->dir_dev); + // remove_proc_entry("cck-registers",priv->dir_dev); + // remove_proc_entry("ofdm-registers",priv->dir_dev); +- //remove_proc_entry(dev->name, rtl8192_proc); +- remove_proc_entry("wlan0", rtl8192_proc); ++ remove_proc_entry(priv->dir_dev->name, rtl8192_proc); + priv->dir_dev = NULL; + } + } +@@ -1115,6 +1125,25 @@ void rtl8192_proc_init_one(struct net_device *dev) + dev->name); + } + } ++ ++static int proc_netdev_event(struct notifier_block *this, ++ unsigned long event, void *ptr) ++{ ++ struct net_device *net_dev = ptr; ++ ++ if (net_dev->netdev_ops == &rtl8192_netdev_ops && ++ event == NETDEV_CHANGENAME) { ++ rtl8192_proc_remove_one(net_dev); ++ rtl8192_proc_init_one(net_dev); ++ } ++ ++ return NOTIFY_DONE; ++} ++ ++static struct notifier_block proc_netdev_notifier = { ++ .notifier_call = proc_netdev_event, ++}; ++ + /**************************************************************************** + -----------------------------MISC STUFF------------------------- + *****************************************************************************/ +-- +1.7.7 + diff --git a/queue/Staging-rtl8192su-add-device-ids.patch b/queue/Staging-rtl8192su-add-device-ids.patch new file mode 100644 index 0000000..8ad3154 --- /dev/null +++ b/queue/Staging-rtl8192su-add-device-ids.patch @@ -0,0 +1,62 @@ +From b7d7dcd072f3404e8e3d44b0247a1ad703d934fa Mon Sep 17 00:00:00 2001 +From: Florian Schilhabel <florian.c.schilhabel@googlemail.com> +Date: Tue, 8 Jun 2010 03:47:13 +0200 +Subject: [PATCH] Staging: rtl8192su: add device ids + +commit 15d93ed070125d51693f102a0f94045dcaf30d9b upstream. + +This patch adds some device ids. +The list of supported devices was extracted from realteks driver package. +(0x050d, 0x815F) and (0x0df6, 0x004b) are not in the official list of +supported devices and may not work correctly. +In case of problems with these, they should probably be removed from the list. + +Signed-off-by: Florian Schilhabel <florian.c.schilhabel@googlemail.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> + +diff --git a/drivers/staging/rtl8192su/r8192U_core.c b/drivers/staging/rtl8192su/r8192U_core.c +index f4cc5f0..a813a7b 100644 +--- a/drivers/staging/rtl8192su/r8192U_core.c ++++ b/drivers/staging/rtl8192su/r8192U_core.c +@@ -113,14 +113,30 @@ u32 rt_global_debug_component = \ + #define CAM_CONTENT_COUNT 8 + + static const struct usb_device_id rtl8192_usb_id_tbl[] = { +- /* Realtek */ +- {USB_DEVICE(0x0bda, 0x8171)}, +- {USB_DEVICE(0x050d, 0x815F)}, /* Belkin F5D8053 v6 */ +- {USB_DEVICE(0x0df6, 0x004b)}, /* WL-349 */ +- /* Guillemot */ +- {USB_DEVICE(0x06f8, 0xe031)}, +- //92SU ++ {USB_DEVICE(0x0bda, 0x8171)}, /* Realtek */ + {USB_DEVICE(0x0bda, 0x8172)}, ++ {USB_DEVICE(0x0bda, 0x8173)}, ++ {USB_DEVICE(0x0bda, 0x8174)}, ++ {USB_DEVICE(0x0bda, 0x8712)}, ++ {USB_DEVICE(0x0bda, 0x8713)}, ++ {USB_DEVICE(0x07aa, 0x0047)}, ++ {USB_DEVICE(0x07d1, 0x3303)}, ++ {USB_DEVICE(0x07d1, 0x3302)}, ++ {USB_DEVICE(0x07d1, 0x3300)}, ++ {USB_DEVICE(0x1740, 0x9603)}, ++ {USB_DEVICE(0x1740, 0x9605)}, ++ {USB_DEVICE(0x050d, 0x815F)}, ++ {USB_DEVICE(0x06f8, 0xe031)}, ++ {USB_DEVICE(0x7392, 0x7611)}, ++ {USB_DEVICE(0x7392, 0x7612)}, ++ {USB_DEVICE(0x7392, 0x7622)}, ++ {USB_DEVICE(0x0DF6, 0x0045)}, ++ {USB_DEVICE(0x0E66, 0x0015)}, ++ {USB_DEVICE(0x0E66, 0x0016)}, ++ {USB_DEVICE(0x0b05, 0x1786)}, ++ /* these are not in the official list */ ++ {USB_DEVICE(0x050d, 0x815F)}, /* Belkin F5D8053 v6 */ ++ {USB_DEVICE(0x0df6, 0x004b)}, /* WL-349 */ + {} + }; + +-- +1.7.7 + diff --git a/queue/Staging-rtl8192su-check-for-skb-NULL.patch b/queue/Staging-rtl8192su-check-for-skb-NULL.patch new file mode 100644 index 0000000..b03e3b2 --- /dev/null +++ b/queue/Staging-rtl8192su-check-for-skb-NULL.patch @@ -0,0 +1,238 @@ +From b57e88de77b82d3667719c31c07447bfe278c0d9 Mon Sep 17 00:00:00 2001 +From: Florian Schilhabel <florian.c.schilhabel@googlemail.com> +Date: Tue, 4 May 2010 14:23:43 +0200 +Subject: [PATCH] Staging: rtl8192su: check for skb == NULL + +commit 199ef62a287b429a8fa3b7dc5ae6b69f607bf324 upstream. + +added 2 checks for skb == NULL. +plus cosmetics + +Signed-off-by: Florian Schilhabel <florian.c.schilhabel@googlemail.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> + +diff --git a/drivers/staging/rtl8192su/r8192S_firmware.c b/drivers/staging/rtl8192su/r8192S_firmware.c +index 752a3f1..f7dd7e7 100644 +--- a/drivers/staging/rtl8192su/r8192S_firmware.c ++++ b/drivers/staging/rtl8192su/r8192S_firmware.c +@@ -31,44 +31,46 @@ + // Code size + // Created by Roger, 2008.04.10. + // +-bool FirmwareDownloadCode(struct net_device *dev, u8 * code_virtual_address,u32 buffer_len) ++bool FirmwareDownloadCode(struct net_device *dev, ++ u8 *code_virtual_address, ++ u32 buffer_len) + { +- struct r8192_priv *priv = ieee80211_priv(dev); +- bool rt_status = true; +- u16 frag_threshold = MAX_FIRMWARE_CODE_SIZE; //Fragmentation might be required in 90/92 but not in 92S +- u16 frag_length, frag_offset = 0; +- struct sk_buff *skb; +- unsigned char *seg_ptr; +- cb_desc *tcb_desc; +- u8 bLastIniPkt = 0; +- u16 ExtraDescOffset = 0; ++ struct r8192_priv *priv = ieee80211_priv(dev); ++ bool rt_status = true; ++ /* Fragmentation might be required in 90/92 but not in 92S */ ++ u16 frag_threshold = MAX_FIRMWARE_CODE_SIZE; ++ u16 frag_length, frag_offset = 0; ++ struct sk_buff *skb; ++ unsigned char *seg_ptr; ++ cb_desc *tcb_desc; ++ u8 bLastIniPkt = 0; ++ u16 ExtraDescOffset = 0; + +- +- RT_TRACE(COMP_FIRMWARE, "--->FirmwareDownloadCode()\n" ); +- +- //MAX_TRANSMIT_BUFFER_SIZE +- if(buffer_len >= MAX_FIRMWARE_CODE_SIZE-USB_HWDESC_HEADER_LEN) +- { +- RT_TRACE(COMP_ERR, "Size over MAX_FIRMWARE_CODE_SIZE! \n"); ++ if (buffer_len >= MAX_FIRMWARE_CODE_SIZE - USB_HWDESC_HEADER_LEN) { ++ RT_TRACE(COMP_ERR, "(%s): Firmware exceeds" ++ " MAX_FIRMWARE_CODE_SIZE\n", __func__); + goto cmdsend_downloadcode_fail; + } +- + ExtraDescOffset = USB_HWDESC_HEADER_LEN; +- + do { + if((buffer_len-frag_offset) > frag_threshold) +- { + frag_length = frag_threshold + ExtraDescOffset; ++ else { ++ frag_length = (u16)(buffer_len - ++ frag_offset + ExtraDescOffset); ++ bLastIniPkt = 1; + } +- else +- { +- frag_length = (u16)(buffer_len - frag_offset + ExtraDescOffset); +- bLastIniPkt = 1; +- } +- +- /* Allocate skb buffer to contain firmware info and tx descriptor info. */ ++ /* ++ * Allocate skb buffer to contain firmware info ++ * and tx descriptor info. ++ */ + skb = dev_alloc_skb(frag_length); +- memcpy((unsigned char *)(skb->cb),&dev,sizeof(dev)); ++ if (skb == NULL) { ++ RT_TRACE(COMP_ERR, "(%s): unable to alloc skb buffer\n", ++ __func__); ++ goto cmdsend_downloadcode_fail; ++ } ++ memcpy((unsigned char *)(skb->cb), &dev, sizeof(dev)); + + tcb_desc = (cb_desc*)(skb->cb + MAX_DEV_ADDR_SIZE); + tcb_desc->queue_index = TXCMD_QUEUE; +@@ -76,73 +78,60 @@ bool FirmwareDownloadCode(struct net_device *dev, u8 * code_virtual_address,u32 + tcb_desc->bLastIniPkt = bLastIniPkt; + + skb_reserve(skb, ExtraDescOffset); +- seg_ptr = (u8 *)skb_put(skb, (u32)(frag_length-ExtraDescOffset)); +- memcpy(seg_ptr, code_virtual_address+frag_offset, (u32)(frag_length-ExtraDescOffset)); + +- tcb_desc->txbuf_size= frag_length; ++ seg_ptr = (u8 *)skb_put(skb, ++ (u32)(frag_length - ExtraDescOffset)); + +- if(!priv->ieee80211->check_nic_enough_desc(dev,tcb_desc->queue_index)|| +- (!skb_queue_empty(&priv->ieee80211->skb_waitQ[tcb_desc->queue_index]))||\ +- (priv->ieee80211->queue_stop) ) +- { ++ memcpy(seg_ptr, code_virtual_address + frag_offset, ++ (u32)(frag_length-ExtraDescOffset)); ++ ++ tcb_desc->txbuf_size = frag_length; ++ ++ if (!priv->ieee80211->check_nic_enough_desc(dev, tcb_desc->queue_index) || ++ (!skb_queue_empty(&priv->ieee80211->skb_waitQ[tcb_desc->queue_index])) || ++ (priv->ieee80211->queue_stop)) { + RT_TRACE(COMP_FIRMWARE,"=====================================================> tx full!\n"); + skb_queue_tail(&priv->ieee80211->skb_waitQ[tcb_desc->queue_index], skb); +- } +- else +- { +- priv->ieee80211->softmac_hard_start_xmit(skb,dev); +- } ++ } else ++ priv->ieee80211->softmac_hard_start_xmit(skb, dev); + + frag_offset += (frag_length - ExtraDescOffset); + +- }while(frag_offset < buffer_len); +- ++ } while (frag_offset < buffer_len); + return rt_status ; + +- + cmdsend_downloadcode_fail: + rt_status = false; +- RT_TRACE(COMP_ERR, "CmdSendDownloadCode fail !!\n"); ++ RT_TRACE(COMP_ERR, "(%s): failed\n", __func__); + return rt_status; +- + } + + +-RT_STATUS +-FirmwareEnableCPU(struct net_device *dev) ++RT_STATUS FirmwareEnableCPU(struct net_device *dev) + { ++ RT_STATUS rtStatus = RT_STATUS_SUCCESS; ++ u8 tmpU1b, CPUStatus = 0; ++ u16 tmpU2b; ++ u32 iCheckTime = 200; + +- RT_STATUS rtStatus = RT_STATUS_SUCCESS; +- u8 tmpU1b, CPUStatus = 0; +- u16 tmpU2b; +- u32 iCheckTime = 200; +- +- RT_TRACE(COMP_FIRMWARE, "-->FirmwareEnableCPU()\n" ); +- // Enable CPU. ++ /* Enable CPU. */ + tmpU1b = read_nic_byte(dev, SYS_CLKR); +- write_nic_byte(dev, SYS_CLKR, (tmpU1b|SYS_CPU_CLKSEL)); //AFE source +- ++ /* AFE source */ ++ write_nic_byte(dev, SYS_CLKR, (tmpU1b|SYS_CPU_CLKSEL)); + tmpU2b = read_nic_word(dev, SYS_FUNC_EN); + write_nic_word(dev, SYS_FUNC_EN, (tmpU2b|FEN_CPUEN)); +- +- //Polling IMEM Ready after CPU has refilled. +- do +- { ++ /* Poll IMEM Ready after CPU has refilled. */ ++ do { + CPUStatus = read_nic_byte(dev, TCR); +- if(CPUStatus& IMEM_RDY) +- { +- RT_TRACE(COMP_FIRMWARE, "IMEM Ready after CPU has refilled.\n"); ++ if (CPUStatus & IMEM_RDY) ++ /* success */ + break; +- } +- +- //usleep(100); + udelay(100); +- }while(iCheckTime--); +- +- if(!(CPUStatus & IMEM_RDY)) +- return RT_STATUS_FAILURE; +- +- RT_TRACE(COMP_FIRMWARE, "<--FirmwareEnableCPU(): rtStatus(%#x)\n", rtStatus); ++ } while (iCheckTime--); ++ if (!(CPUStatus & IMEM_RDY)) { ++ RT_TRACE(COMP_ERR, "(%s): failed to enable CPU\n", __func__); ++ rtStatus = RT_STATUS_FAILURE; ++ } + return rtStatus; + } + +diff --git a/drivers/staging/rtl8192su/r8192U_core.c b/drivers/staging/rtl8192su/r8192U_core.c +index 04d9b85..04f8516 100644 +--- a/drivers/staging/rtl8192su/r8192U_core.c ++++ b/drivers/staging/rtl8192su/r8192U_core.c +@@ -1278,7 +1278,6 @@ static int rtl8192_rx_initiate(struct net_device*dev) + kfree_skb(skb); + break; + } +-// printk("nomal packet IN request!\n"); + usb_fill_bulk_urb(entry, priv->udev, + usb_rcvbulkpipe(priv->udev, 3), skb_tail_pointer(skb), + RX_URB_SIZE, rtl8192_rx_isr, skb); +@@ -1292,7 +1291,6 @@ static int rtl8192_rx_initiate(struct net_device*dev) + + /* command packet rx procedure */ + while (skb_queue_len(&priv->rx_queue) < MAX_RX_URB + 3) { +-// printk("command packet IN request!\n"); + skb = __dev_alloc_skb(RX_URB_SIZE ,GFP_KERNEL); + if (!skb) + break; +diff --git a/drivers/staging/rtl8192su/r819xU_cmdpkt.c b/drivers/staging/rtl8192su/r819xU_cmdpkt.c +index 3ebfe79..e69c3b4 100644 +--- a/drivers/staging/rtl8192su/r819xU_cmdpkt.c ++++ b/drivers/staging/rtl8192su/r819xU_cmdpkt.c +@@ -56,6 +56,12 @@ SendTxCommandPacket( + + //Get TCB and local buffer from common pool. (It is shared by CmdQ, MgntQ, and USB coalesce DataQ) + skb = dev_alloc_skb(USB_HWDESC_HEADER_LEN + DataLen + 4); ++ if (skb == NULL) { ++ RT_TRACE(COMP_ERR, "(%s): unable to alloc skb buffer\n", ++ __func__); ++ rtStatus = false; ++ return rtStatus; ++ } + memcpy((unsigned char *)(skb->cb),&dev,sizeof(dev)); + tcb_desc = (cb_desc*)(skb->cb + MAX_DEV_ADDR_SIZE); + tcb_desc->queue_index = TXCMD_QUEUE; +-- +1.7.7 + diff --git a/queue/Staging-rtl8192su-remove-device-ids.patch b/queue/Staging-rtl8192su-remove-device-ids.patch new file mode 100644 index 0000000..3feadbf --- /dev/null +++ b/queue/Staging-rtl8192su-remove-device-ids.patch @@ -0,0 +1,54 @@ +From 77a4e5f31bc741354bf43db2be7cdb219d48fa46 Mon Sep 17 00:00:00 2001 +From: Florian Schilhabel <florian.c.schilhabel@googlemail.com> +Date: Tue, 8 Jun 2010 03:46:26 +0200 +Subject: [PATCH] Staging: rtl8192su: remove device ids + +commit 60b42de30ad6fb131dc8e9dbd11a8a9ea0ab394c upstream. + +This patch removes some device-ids. +The list of unsupported devices was extracted from realteks driver package. +removed IDs are: +(0x0bda, 0x8192) +(0x0bda, 0x8709) +(0x07aa, 0x0043) +(0x050d, 0x805E) +(0x0df6, 0x0031) +(0x1740, 0x9201) +(0x2001, 0x3301) +(0x5a57, 0x0290) +These devices are _not_ rtl819su based. + +Signed-off-by: Florian Schilhabel <florian.c.schilhabel@googlemail.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> + +diff --git a/drivers/staging/rtl8192su/r8192U_core.c b/drivers/staging/rtl8192su/r8192U_core.c +index 7946cf6..f4cc5f0 100644 +--- a/drivers/staging/rtl8192su/r8192U_core.c ++++ b/drivers/staging/rtl8192su/r8192U_core.c +@@ -115,22 +115,8 @@ u32 rt_global_debug_component = \ + static const struct usb_device_id rtl8192_usb_id_tbl[] = { + /* Realtek */ + {USB_DEVICE(0x0bda, 0x8171)}, +- {USB_DEVICE(0x0bda, 0x8192)}, +- {USB_DEVICE(0x0bda, 0x8709)}, +- /* Corega */ +- {USB_DEVICE(0x07aa, 0x0043)}, +- /* Belkin */ +- {USB_DEVICE(0x050d, 0x805E)}, + {USB_DEVICE(0x050d, 0x815F)}, /* Belkin F5D8053 v6 */ +- /* Sitecom */ +- {USB_DEVICE(0x0df6, 0x0031)}, + {USB_DEVICE(0x0df6, 0x004b)}, /* WL-349 */ +- /* EnGenius */ +- {USB_DEVICE(0x1740, 0x9201)}, +- /* Dlink */ +- {USB_DEVICE(0x2001, 0x3301)}, +- /* Zinwell */ +- {USB_DEVICE(0x5a57, 0x0290)}, + /* Guillemot */ + {USB_DEVICE(0x06f8, 0xe031)}, + //92SU +-- +1.7.7 + diff --git a/queue/UBIFS-fix-master-node-recovery.patch b/queue/UBIFS-fix-master-node-recovery.patch new file mode 100644 index 0000000..5b8ab2a --- /dev/null +++ b/queue/UBIFS-fix-master-node-recovery.patch @@ -0,0 +1,77 @@ +From 1fe8534ffe14df426be8f1c0a8a4f52e97d929de Mon Sep 17 00:00:00 2001 +From: Artem Bityutskiy <Artem.Bityutskiy@nokia.com> +Date: Thu, 21 Apr 2011 14:49:55 +0300 +Subject: [PATCH] UBIFS: fix master node recovery + +commit 6e0d9fd38b750d678bf9fd07db23582f52fafa55 upstream. + +This patch fixes the following symptoms: +1. Unmount UBIFS cleanly. +2. Start mounting UBIFS R/W and have a power cut immediately +3. Start mounting UBIFS R/O, this succeeds +4. Try to re-mount UBIFS R/W - this fails immediately or later on, + because UBIFS will write the master node to the flash area + which has been written before. + +The analysis of the problem: + +1. UBIFS is unmounted cleanly, both copies of the master node are clean. +2. UBIFS is being mounter R/W, starts changing master node copy 1, and + a power cut happens. The copy N1 becomes corrupted. +3. UBIFS is being mounted R/O. It notices the copy N1 is corrupted and + reads copy N2. Copy N2 is clean. +4. Because of R/O mode, UBIFS cannot recover copy 1. +5. The mount code (ubifs_mount()) sees that the master node is clean, + so it decides that no recovery is needed. +6. We are re-mounting R/W. UBIFS believes no recovery is needed and + starts updating the master node, but copy N1 is still corrupted + and was not recovered! + +Fix this problem by marking the master node as dirty every time we +recover it and we are in R/O mode. This forces further recovery and +the UBIFS cleans-up the corruptions and recovers the copy N1 when +re-mounting R/W later. + +Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy@nokia.com> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> + +diff --git a/fs/ubifs/recovery.c b/fs/ubifs/recovery.c +index 109c6ea..b712ed6 100644 +--- a/fs/ubifs/recovery.c ++++ b/fs/ubifs/recovery.c +@@ -300,6 +300,32 @@ int ubifs_recover_master_node(struct ubifs_info *c) + goto out_free; + } + memcpy(c->rcvrd_mst_node, c->mst_node, UBIFS_MST_NODE_SZ); ++ ++ /* ++ * We had to recover the master node, which means there was an ++ * unclean reboot. However, it is possible that the master node ++ * is clean at this point, i.e., %UBIFS_MST_DIRTY is not set. ++ * E.g., consider the following chain of events: ++ * ++ * 1. UBIFS was cleanly unmounted, so the master node is clean ++ * 2. UBIFS is being mounted R/W and starts changing the master ++ * node in the first (%UBIFS_MST_LNUM). A power cut happens, ++ * so this LEB ends up with some amount of garbage at the ++ * end. ++ * 3. UBIFS is being mounted R/O. We reach this place and ++ * recover the master node from the second LEB ++ * (%UBIFS_MST_LNUM + 1). But we cannot update the media ++ * because we are being mounted R/O. We have to defer the ++ * operation. ++ * 4. However, this master node (@c->mst_node) is marked as ++ * clean (since the step 1). And if we just return, the ++ * mount code will be confused and won't recover the master ++ * node when it is re-mounter R/W later. ++ * ++ * Thus, to force the recovery by marking the master node as ++ * dirty. ++ */ ++ c->mst_node->flags |= cpu_to_le32(UBIFS_MST_DIRTY); + } else { + /* Write the recovered master node */ + c->max_sqnum = le64_to_cpu(mst->ch.sqnum) - 1; +-- +1.7.7 + diff --git a/queue/USB-teach-devices-file-about-Wireless-and-SuperSpeed.patch b/queue/USB-teach-devices-file-about-Wireless-and-SuperSpeed.patch new file mode 100644 index 0000000..71b9ff7 --- /dev/null +++ b/queue/USB-teach-devices-file-about-Wireless-and-SuperSpeed.patch @@ -0,0 +1,152 @@ +From 322aa64e1c07bb83171e2a2dd173943a8b1e116d Mon Sep 17 00:00:00 2001 +From: Alan Stern <stern@rowland.harvard.edu> +Date: Mon, 13 Sep 2010 10:43:25 -0400 +Subject: [PATCH] USB: teach "devices" file about Wireless and SuperSpeed USB + +commit 834e2312e7a384877a876b0d34dffc3046c96bcb upstream. + +The /sys/kernel/debug/usb/devices file doesn't know about Wireless or +SuperSpeed USB. This patch (as1416b) teaches it, and updates the +Documentation/usb/proc_sub_info.txt file accordingly. + +Signed-off-by: Alan Stern <stern@rowland.harvard.edu> +CC: David Vrabel <david.vrabel@csr.com> +CC: Sarah Sharp <sarah.a.sharp@linux.intel.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> + +diff --git a/Documentation/usb/proc_usb_info.txt b/Documentation/usb/proc_usb_info.txt +index fafcd47..afe596d 100644 +--- a/Documentation/usb/proc_usb_info.txt ++++ b/Documentation/usb/proc_usb_info.txt +@@ -1,12 +1,17 @@ + /proc/bus/usb filesystem output + =============================== +-(version 2003.05.30) ++(version 2010.09.13) + + + The usbfs filesystem for USB devices is traditionally mounted at + /proc/bus/usb. It provides the /proc/bus/usb/devices file, as well as + the /proc/bus/usb/BBB/DDD files. + ++In many modern systems the usbfs filsystem isn't used at all. Instead ++USB device nodes are created under /dev/usb/ or someplace similar. The ++"devices" file is available in debugfs, typically as ++/sys/kernel/debug/usb/devices. ++ + + **NOTE**: If /proc/bus/usb appears empty, and a host controller + driver has been linked, then you need to mount the +@@ -106,8 +111,8 @@ Legend: + + Topology info: + +-T: Bus=dd Lev=dd Prnt=dd Port=dd Cnt=dd Dev#=ddd Spd=ddd MxCh=dd +-| | | | | | | | |__MaxChildren ++T: Bus=dd Lev=dd Prnt=dd Port=dd Cnt=dd Dev#=ddd Spd=dddd MxCh=dd ++| | | | | | | | |__MaxChildren + | | | | | | | |__Device Speed in Mbps + | | | | | | |__DeviceNumber + | | | | | |__Count of devices at this level +@@ -120,8 +125,13 @@ T: Bus=dd Lev=dd Prnt=dd Port=dd Cnt=dd Dev#=ddd Spd=ddd MxCh=dd + Speed may be: + 1.5 Mbit/s for low speed USB + 12 Mbit/s for full speed USB +- 480 Mbit/s for high speed USB (added for USB 2.0) ++ 480 Mbit/s for high speed USB (added for USB 2.0); ++ also used for Wireless USB, which has no fixed speed ++ 5000 Mbit/s for SuperSpeed USB (added for USB 3.0) + ++ For reasons lost in the mists of time, the Port number is always ++ too low by 1. For example, a device plugged into port 4 will ++ show up with "Port=03". + + Bandwidth info: + B: Alloc=ddd/ddd us (xx%), #Int=ddd, #Iso=ddd +@@ -291,7 +301,7 @@ Here's an example, from a system which has a UHCI root hub, + an external hub connected to the root hub, and a mouse and + a serial converter connected to the external hub. + +-T: Bus=00 Lev=00 Prnt=00 Port=00 Cnt=00 Dev#= 1 Spd=12 MxCh= 2 ++T: Bus=00 Lev=00 Prnt=00 Port=00 Cnt=00 Dev#= 1 Spd=12 MxCh= 2 + B: Alloc= 28/900 us ( 3%), #Int= 2, #Iso= 0 + D: Ver= 1.00 Cls=09(hub ) Sub=00 Prot=00 MxPS= 8 #Cfgs= 1 + P: Vendor=0000 ProdID=0000 Rev= 0.00 +@@ -301,21 +311,21 @@ C:* #Ifs= 1 Cfg#= 1 Atr=40 MxPwr= 0mA + I: If#= 0 Alt= 0 #EPs= 1 Cls=09(hub ) Sub=00 Prot=00 Driver=hub + E: Ad=81(I) Atr=03(Int.) MxPS= 8 Ivl=255ms + +-T: Bus=00 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=12 MxCh= 4 ++T: Bus=00 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=12 MxCh= 4 + D: Ver= 1.00 Cls=09(hub ) Sub=00 Prot=00 MxPS= 8 #Cfgs= 1 + P: Vendor=0451 ProdID=1446 Rev= 1.00 + C:* #Ifs= 1 Cfg#= 1 Atr=e0 MxPwr=100mA + I: If#= 0 Alt= 0 #EPs= 1 Cls=09(hub ) Sub=00 Prot=00 Driver=hub + E: Ad=81(I) Atr=03(Int.) MxPS= 1 Ivl=255ms + +-T: Bus=00 Lev=02 Prnt=02 Port=00 Cnt=01 Dev#= 3 Spd=1.5 MxCh= 0 ++T: Bus=00 Lev=02 Prnt=02 Port=00 Cnt=01 Dev#= 3 Spd=1.5 MxCh= 0 + D: Ver= 1.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 8 #Cfgs= 1 + P: Vendor=04b4 ProdID=0001 Rev= 0.00 + C:* #Ifs= 1 Cfg#= 1 Atr=80 MxPwr=100mA + I: If#= 0 Alt= 0 #EPs= 1 Cls=03(HID ) Sub=01 Prot=02 Driver=mouse + E: Ad=81(I) Atr=03(Int.) MxPS= 3 Ivl= 10ms + +-T: Bus=00 Lev=02 Prnt=02 Port=02 Cnt=02 Dev#= 4 Spd=12 MxCh= 0 ++T: Bus=00 Lev=02 Prnt=02 Port=02 Cnt=02 Dev#= 4 Spd=12 MxCh= 0 + D: Ver= 1.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 8 #Cfgs= 1 + P: Vendor=0565 ProdID=0001 Rev= 1.08 + S: Manufacturer=Peracom Networks, Inc. +@@ -330,12 +340,12 @@ E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl= 8ms + Selecting only the "T:" and "I:" lines from this (for example, by using + "procusb ti"), we have: + +-T: Bus=00 Lev=00 Prnt=00 Port=00 Cnt=00 Dev#= 1 Spd=12 MxCh= 2 +-T: Bus=00 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=12 MxCh= 4 ++T: Bus=00 Lev=00 Prnt=00 Port=00 Cnt=00 Dev#= 1 Spd=12 MxCh= 2 ++T: Bus=00 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=12 MxCh= 4 + I: If#= 0 Alt= 0 #EPs= 1 Cls=09(hub ) Sub=00 Prot=00 Driver=hub +-T: Bus=00 Lev=02 Prnt=02 Port=00 Cnt=01 Dev#= 3 Spd=1.5 MxCh= 0 ++T: Bus=00 Lev=02 Prnt=02 Port=00 Cnt=01 Dev#= 3 Spd=1.5 MxCh= 0 + I: If#= 0 Alt= 0 #EPs= 1 Cls=03(HID ) Sub=01 Prot=02 Driver=mouse +-T: Bus=00 Lev=02 Prnt=02 Port=02 Cnt=02 Dev#= 4 Spd=12 MxCh= 0 ++T: Bus=00 Lev=02 Prnt=02 Port=02 Cnt=02 Dev#= 4 Spd=12 MxCh= 0 + I: If#= 0 Alt= 0 #EPs= 3 Cls=00(>ifc ) Sub=00 Prot=00 Driver=serial + + +diff --git a/drivers/usb/core/devices.c b/drivers/usb/core/devices.c +index 7013296..0ce4230 100644 +--- a/drivers/usb/core/devices.c ++++ b/drivers/usb/core/devices.c +@@ -65,8 +65,8 @@ + #define ALLOW_SERIAL_NUMBER + + static const char *format_topo = +-/* T: Bus=dd Lev=dd Prnt=dd Port=dd Cnt=dd Dev#=ddd Spd=ddd MxCh=dd */ +-"\nT: Bus=%2.2d Lev=%2.2d Prnt=%2.2d Port=%2.2d Cnt=%2.2d Dev#=%3d Spd=%3s MxCh=%2d\n"; ++/* T: Bus=dd Lev=dd Prnt=dd Port=dd Cnt=dd Dev#=ddd Spd=dddd MxCh=dd */ ++"\nT: Bus=%2.2d Lev=%2.2d Prnt=%2.2d Port=%2.2d Cnt=%2.2d Dev#=%3d Spd=%-4s MxCh=%2d\n"; + + static const char *format_string_manufacturer = + /* S: Manufacturer=xxxx */ +@@ -518,11 +518,14 @@ static ssize_t usb_device_dump(char __user **buffer, size_t *nbytes, + speed = "1.5"; break; + case USB_SPEED_UNKNOWN: /* usb 1.1 root hub code */ + case USB_SPEED_FULL: +- speed = "12 "; break; ++ speed = "12"; break; ++ case USB_SPEED_WIRELESS: /* Wireless has no real fixed speed */ + case USB_SPEED_HIGH: + speed = "480"; break; ++ case USB_SPEED_SUPER: ++ speed = "5000"; break; + default: +- speed = "?? "; ++ speed = "??"; + } + data_end = pages_start + sprintf(pages_start, format_topo, + bus->busnum, level, parent_devnum, +-- +1.7.7 + diff --git a/queue/V4L-DVB-Add-Elgato-EyeTV-Diversity-to-dibcom-driver.patch b/queue/V4L-DVB-Add-Elgato-EyeTV-Diversity-to-dibcom-driver.patch new file mode 100644 index 0000000..a5a22f2 --- /dev/null +++ b/queue/V4L-DVB-Add-Elgato-EyeTV-Diversity-to-dibcom-driver.patch @@ -0,0 +1,117 @@ +From 3910ff4c5fcbe78929736ae286f76f975f35fe06 Mon Sep 17 00:00:00 2001 +From: "michael@alice-dsl.net" <michael@alice-dsl.net> +Date: Mon, 26 Apr 2010 22:18:57 -0300 +Subject: [PATCH] V4L/DVB: Add Elgato EyeTV Diversity to dibcom driver +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +commit 84e2f037ce9672d0fb118e3e82cecfe6122ace3f upstream. + +This patch introduces support for DVB-T for the following dibcom +based card: Elgato EyeTV Diversity (USB-ID: 0fd9:0011) + +Support for the Elgato silver IR remote is added too (set parameter +dvb_usb_dib0700_ir_proto=0) + +[w.sang@pengutronix.de: rebased to current linuxtv-master] +Signed-off-by: Michael Müller <mueller_michael@alice-dsl.net> +Signed-off-by: Wolfram Sang <w.sang@pengutronix.de> +Signed-off-by: Patrick Boettcher <pboettcher@kernellabs.com> +Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com> + +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> + +diff --git a/drivers/media/dvb/dvb-usb/dib0700_devices.c b/drivers/media/dvb/dvb-usb/dib0700_devices.c +index 34eab05..f9052be 100644 +--- a/drivers/media/dvb/dvb-usb/dib0700_devices.c ++++ b/drivers/media/dvb/dvb-usb/dib0700_devices.c +@@ -794,6 +794,43 @@ static struct dvb_usb_rc_key dib0700_rc_keys[] = { + { 0x7a13, KEY_VOLUMEDOWN }, + { 0x7a40, KEY_POWER }, + { 0x7a41, KEY_MUTE }, ++ ++ /* Key codes for the Elgato EyeTV Diversity silver remote, ++ set dvb_usb_dib0700_ir_proto=0 */ ++ { 0x4501, KEY_POWER }, ++ { 0x4502, KEY_MUTE }, ++ { 0x4503, KEY_1 }, ++ { 0x4504, KEY_2 }, ++ { 0x4505, KEY_3 }, ++ { 0x4506, KEY_4 }, ++ { 0x4507, KEY_5 }, ++ { 0x4508, KEY_6 }, ++ { 0x4509, KEY_7 }, ++ { 0x450a, KEY_8 }, ++ { 0x450b, KEY_9 }, ++ { 0x450c, KEY_LAST }, ++ { 0x450d, KEY_0 }, ++ { 0x450e, KEY_ENTER }, ++ { 0x450f, KEY_RED }, ++ { 0x4510, KEY_CHANNELUP }, ++ { 0x4511, KEY_GREEN }, ++ { 0x4512, KEY_VOLUMEDOWN }, ++ { 0x4513, KEY_OK }, ++ { 0x4514, KEY_VOLUMEUP }, ++ { 0x4515, KEY_YELLOW }, ++ { 0x4516, KEY_CHANNELDOWN }, ++ { 0x4517, KEY_BLUE }, ++ { 0x4518, KEY_LEFT }, /* Skip backwards */ ++ { 0x4519, KEY_PLAYPAUSE }, ++ { 0x451a, KEY_RIGHT }, /* Skip forward */ ++ { 0x451b, KEY_REWIND }, ++ { 0x451c, KEY_L }, /* Live */ ++ { 0x451d, KEY_FASTFORWARD }, ++ { 0x451e, KEY_STOP }, /* 'Reveal' for Teletext */ ++ { 0x451f, KEY_MENU }, /* KEY_TEXT for Teletext */ ++ { 0x4540, KEY_RECORD }, /* Font 'Size' for Teletext */ ++ { 0x4541, KEY_SCREEN }, /* Full screen toggle, 'Hold' for Teletext */ ++ { 0x4542, KEY_SELECT }, /* Select video input, 'Select' for Teletext */ + }; + + /* STK7700P: Hauppauge Nova-T Stick, AVerMedia Volar */ +@@ -2049,6 +2086,7 @@ struct usb_device_id dib0700_usb_id_table[] = { + /* 65 */{ USB_DEVICE(USB_VID_PINNACLE, USB_PID_PINNACLE_PCTV73ESE) }, + { USB_DEVICE(USB_VID_PINNACLE, USB_PID_PINNACLE_PCTV282E) }, + { USB_DEVICE(USB_VID_DIBCOM, USB_PID_DIBCOM_STK8096GP) }, ++ { USB_DEVICE(USB_VID_ELGATO, USB_PID_ELGATO_EYETV_DIVERSITY) }, + { 0 } /* Terminating entry */ + }; + MODULE_DEVICE_TABLE(usb, dib0700_usb_id_table); +@@ -2393,7 +2431,7 @@ struct dvb_usb_device_properties dib0700_devices[] = { + } + }, + +- .num_device_descs = 6, ++ .num_device_descs = 7, + .devices = { + { "DiBcom STK7070PD reference design", + { &dib0700_usb_id_table[17], NULL }, +@@ -2419,7 +2457,11 @@ struct dvb_usb_device_properties dib0700_devices[] = { + { "Sony PlayTV", + { &dib0700_usb_id_table[44], NULL }, + { NULL }, +- } ++ }, ++ { "Elgato EyeTV Diversity", ++ { &dib0700_usb_id_table[68], NULL }, ++ { NULL }, ++ }, + }, + .rc_interval = DEFAULT_RC_INTERVAL, + .rc_key_map = dib0700_rc_keys, +diff --git a/drivers/media/dvb/dvb-usb/dvb-usb-ids.h b/drivers/media/dvb/dvb-usb/dvb-usb-ids.h +index ae8b57a..71dfc7c 100644 +--- a/drivers/media/dvb/dvb-usb/dvb-usb-ids.h ++++ b/drivers/media/dvb/dvb-usb/dvb-usb-ids.h +@@ -288,6 +288,7 @@ + #define USB_PID_MSI_DIGI_VOX_MINI_III 0x8807 + #define USB_PID_SONY_PLAYTV 0x0003 + #define USB_PID_MYGICA_D689 0xd811 ++#define USB_PID_ELGATO_EYETV_DIVERSITY 0x0011 + #define USB_PID_ELGATO_EYETV_DTT 0x0021 + #define USB_PID_ELGATO_EYETV_DTT_Dlx 0x0020 + #define USB_PID_DVB_T_USB_STICK_HIGH_SPEED_COLD 0x5000 +-- +1.7.7 + diff --git a/queue/af_unix-Only-allow-recv-on-connected-seqpacket-socke.patch b/queue/af_unix-Only-allow-recv-on-connected-seqpacket-socke.patch new file mode 100644 index 0000000..d9b2903 --- /dev/null +++ b/queue/af_unix-Only-allow-recv-on-connected-seqpacket-socke.patch @@ -0,0 +1,85 @@ +From bd9382d3d471ce28343159e55b1c9b2c208a22f4 Mon Sep 17 00:00:00 2001 +From: "Eric W. Biederman" <ebiederm@xmission.com> +Date: Sun, 24 Apr 2011 01:54:57 +0000 +Subject: [PATCH] af_unix: Only allow recv on connected seqpacket sockets. +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +commit a05d2ad1c1f391c7f514a1d1e09b5417968a7d07 upstream. + +This fixes the following oops discovered by Dan Aloni: + +> Anyway, the following is the output of the Oops that I got on the +> Ubuntu kernel on which I first detected the problem +> (2.6.37-12-generic). The Oops that followed will be more useful, I +> guess. + +>[ 5594.669852] BUG: unable to handle kernel NULL pointer dereference +> at (null) +> [ 5594.681606] IP: [<ffffffff81550b7b>] unix_dgram_recvmsg+0x1fb/0x420 +> [ 5594.687576] PGD 2a05d067 PUD 2b951067 PMD 0 +> [ 5594.693720] Oops: 0002 [#1] SMP +> [ 5594.699888] last sysfs file: + +The bug was that unix domain sockets use a pseduo packet for +connecting and accept uses that psudo packet to get the socket. +In the buggy seqpacket case we were allowing unconnected +sockets to call recvmsg and try to receive the pseudo packet. + +That is always wrong and as of commit 7361c36c5 the pseudo +packet had become enough different from a normal packet +that the kernel started oopsing. + +Do for seqpacket_recv what was done for seqpacket_send in 2.5 +and only allow it on connected seqpacket sockets. + +Tested-by: Dan Aloni <dan@aloni.org> +Signed-off-by: Eric W. Biederman <ebiederm@xmission.com> +Signed-off-by: David S. Miller <davem@davemloft.net> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> + +diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c +index 207a119..0b7148b 100644 +--- a/net/unix/af_unix.c ++++ b/net/unix/af_unix.c +@@ -503,6 +503,8 @@ static int unix_dgram_connect(struct socket *, struct sockaddr *, + int, int); + static int unix_seqpacket_sendmsg(struct kiocb *, struct socket *, + struct msghdr *, size_t); ++static int unix_seqpacket_recvmsg(struct kiocb *, struct socket *, ++ struct msghdr *, size_t, int); + + static const struct proto_ops unix_stream_ops = { + .family = PF_UNIX, +@@ -562,7 +564,7 @@ static const struct proto_ops unix_seqpacket_ops = { + .setsockopt = sock_no_setsockopt, + .getsockopt = sock_no_getsockopt, + .sendmsg = unix_seqpacket_sendmsg, +- .recvmsg = unix_dgram_recvmsg, ++ .recvmsg = unix_seqpacket_recvmsg, + .mmap = sock_no_mmap, + .sendpage = sock_no_sendpage, + }; +@@ -1666,6 +1668,18 @@ static int unix_seqpacket_sendmsg(struct kiocb *kiocb, struct socket *sock, + return unix_dgram_sendmsg(kiocb, sock, msg, len); + } + ++static int unix_seqpacket_recvmsg(struct kiocb *iocb, struct socket *sock, ++ struct msghdr *msg, size_t size, ++ int flags) ++{ ++ struct sock *sk = sock->sk; ++ ++ if (sk->sk_state != TCP_ESTABLISHED) ++ return -ENOTCONN; ++ ++ return unix_dgram_recvmsg(iocb, sock, msg, size, flags); ++} ++ + static void unix_copy_addr(struct msghdr *msg, struct sock *sk) + { + struct unix_sock *u = unix_sk(sk); +-- +1.7.7 + diff --git a/queue/ath-add-missing-regdomain-pair-0x5c-mapping.patch b/queue/ath-add-missing-regdomain-pair-0x5c-mapping.patch new file mode 100644 index 0000000..fb258ca --- /dev/null +++ b/queue/ath-add-missing-regdomain-pair-0x5c-mapping.patch @@ -0,0 +1,40 @@ +From c5a50ad18f9b2cdf80a5bd582918edf671c69f91 Mon Sep 17 00:00:00 2001 +From: Christian Lamparter <chunkeey@googlemail.com> +Date: Wed, 6 Apr 2011 20:40:31 +0200 +Subject: [PATCH] ath: add missing regdomain pair 0x5c mapping + +commit bd39a274fb7b43374c797bafdb7f506598f36f77 upstream. + +Joe Culler reported a problem with his AR9170 device: + +> ath: EEPROM regdomain: 0x5c +> ath: EEPROM indicates we should expect a direct regpair map +> ath: invalid regulatory domain/country code 0x5c +> ath: Invalid EEPROM contents + +It turned out that the regdomain 'APL7_FCCA' was not mapped yet. +According to Luis R. Rodriguez [Atheros' engineer] APL7 maps to +FCC_CTL and FCCA maps to FCC_CTL as well, so the attached patch +should be correct. + +Reported-by: Joe Culler <joe.culler@gmail.com> +Acked-by: Luis R. Rodriguez <lrodriguez@atheros.com> +Signed-off-by: Christian Lamparter <chunkeey@googlemail.com> +Signed-off-by: John W. Linville <linville@tuxdriver.com> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> + +diff --git a/drivers/net/wireless/ath/regd_common.h b/drivers/net/wireless/ath/regd_common.h +index 248c670..5c2cfe6 100644 +--- a/drivers/net/wireless/ath/regd_common.h ++++ b/drivers/net/wireless/ath/regd_common.h +@@ -195,6 +195,7 @@ static struct reg_dmn_pair_mapping regDomainPairs[] = { + {APL9_WORLD, CTL_ETSI, CTL_ETSI}, + + {APL3_FCCA, CTL_FCC, CTL_FCC}, ++ {APL7_FCCA, CTL_FCC, CTL_FCC}, + {APL1_ETSIC, CTL_FCC, CTL_ETSI}, + {APL2_ETSIC, CTL_FCC, CTL_ETSI}, + {APL2_APLD, CTL_FCC, NO_CTL}, +-- +1.7.7 + diff --git a/queue/b43-Fix-warning-at-drivers-mmc-core-core.c-237-in-mm.patch b/queue/b43-Fix-warning-at-drivers-mmc-core-core.c-237-in-mm.patch new file mode 100644 index 0000000..d1dbfca --- /dev/null +++ b/queue/b43-Fix-warning-at-drivers-mmc-core-core.c-237-in-mm.patch @@ -0,0 +1,68 @@ +From 13fe1014a0462fafc0a5fb8d3bc2f5b3105db60a Mon Sep 17 00:00:00 2001 +From: Larry Finger <Larry.Finger@lwfinger.net> +Date: Thu, 28 Oct 2010 10:43:26 -0500 +Subject: [PATCH] b43: Fix warning at drivers/mmc/core/core.c:237 in + mmc_wait_for_cmd + +commit 9f2a0fac625bcef9c579bcf0b0c904ab1a56e7c4 upstream. + +On module removal, the sdio version of b43 generates the following warning: + +[ 851.560519] ------------[ cut here ]------------ +[ 851.560531] WARNING: at drivers/mmc/core/core.c:237 mmc_wait_for_cmd+0x88/0x90() +[ 851.560534] Hardware name: 20552PG +[ 851.560536] Modules linked in: b43(-) ssb mmc_block binfmt_misc rfcomm sco bnep ppdev l2cap ipt_MASQUERADE iptable_nat nf_nat nf_conntrack_ipv4 nf_defrag_ipv4 xt_state nf_conntrack ipt_REJECT xt_tcpudp iptable_filter ip_tables x_tables bridge stp kvm_intel kvm arc4 iwlagn snd_hda_codec_conexant snd_hda_intel snd_hda_codec iwlcore snd_hwdep snd_pcm thinkpad_acpi mac80211 snd_seq_midi snd_rawmidi snd_seq_midi_event snd_seq r852 joydev snd_timer sm_common pcmcia nand snd_seq_device cfg80211 sdhci_pci btusb psmouse tpm_tis yenta_socket nand_ids lp snd pcmcia_rsrc nand_ecc bluetooth sdhci tpm pcmcia_core parport mtd snd_page_alloc serio_raw tpm_bios soundcore nvram led_class sha256_generic aes_i586 aes_generic dm_crypt i915 drm_kms_helper drm ahci intel_agp i2c_algo_bit intel_gtt e1000e libahci video agpgart output +[ 851.560620] Pid: 2504, comm: rmmod Not tainted 2.6.36-titan0+ #1 +[ 851.560622] Call Trace: +[ 851.560631] [<c014a102>] warn_slowpath_common+0x72/0xa0 +[ 851.560636] [<c04d94c8>] ? mmc_wait_for_cmd+0x88/0x90 +[ 851.560641] [<c04d94c8>] ? mmc_wait_for_cmd+0x88/0x90 +[ 851.560645] [<c014a152>] warn_slowpath_null+0x22/0x30 +[ 851.560649] [<c04d94c8>] mmc_wait_for_cmd+0x88/0x90 +[ 851.560655] [<c0401585>] ? device_release+0x25/0x80 +[ 851.560660] [<c04df210>] mmc_io_rw_direct_host+0xa0/0x150 +[ 851.560665] [<c04df370>] mmc_io_rw_direct+0x30/0x40 +[ 851.560669] [<c04e06e7>] sdio_disable_func+0x37/0xa0 +[ 851.560683] [<f8dfcb80>] b43_sdio_remove+0x30/0x50 [b43] +[ 851.560687] [<c04df8cc>] sdio_bus_remove+0x1c/0x60 +[ 851.560692] [<c016d39f>] ? blocking_notifier_call_chain+0x1f/0x30 +[ 851.560697] [<c0404991>] __device_release_driver+0x51/0xb0 +[ 851.560701] [<c0404a7f>] driver_detach+0x8f/0xa0 +[ 851.560705] [<c0403c83>] bus_remove_driver+0x63/0xa0 +[ 851.560709] [<c0405039>] driver_unregister+0x49/0x80 +[ 851.560713] [<c0405039>] ? driver_unregister+0x49/0x80 +[ 851.560718] [<c04dfad7>] sdio_unregister_driver+0x17/0x20 +[ 851.560727] [<f8dfcb42>] b43_sdio_exit+0x12/0x20 [b43] +[ 851.560734] [<f8dfe76f>] b43_exit+0x17/0x3c [b43] +[ 851.560740] [<c017fb8d>] sys_delete_module+0x13d/0x200 +[ 851.560747] [<c01fd7d2>] ? do_munmap+0x212/0x300 +[ 851.560752] [<c010311f>] sysenter_do_call+0x12/0x28 +[ 851.560757] ---[ end trace 31e14488072d2f7d ]--- +[ 851.560759] ------------[ cut here ]------------ + +The warning is caused by b43 not claiming the device before calling +sdio_disable_func(). + +Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net> +Reported-by: Arnd Hannemann <arnd@arndnet.de> +Tested-by: Arnd Hannemann <arnd@arndnet.de> +Signed-off-by: John W. Linville <linville@tuxdriver.com> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> + +diff --git a/drivers/net/wireless/b43/sdio.c b/drivers/net/wireless/b43/sdio.c +index 4e56b7b..8b18314 100644 +--- a/drivers/net/wireless/b43/sdio.c ++++ b/drivers/net/wireless/b43/sdio.c +@@ -175,7 +175,9 @@ static void b43_sdio_remove(struct sdio_func *func) + struct b43_sdio *sdio = sdio_get_drvdata(func); + + ssb_bus_unregister(&sdio->ssb); ++ sdio_claim_host(func); + sdio_disable_func(func); ++ sdio_release_host(func); + kfree(sdio); + sdio_set_drvdata(func, NULL); + } +-- +1.7.7 + diff --git a/queue/backlight-MacBookAir3-1-3-2-mbp-nvidia-bl-support.patch b/queue/backlight-MacBookAir3-1-3-2-mbp-nvidia-bl-support.patch new file mode 100644 index 0000000..9f470ef --- /dev/null +++ b/queue/backlight-MacBookAir3-1-3-2-mbp-nvidia-bl-support.patch @@ -0,0 +1,48 @@ +From 0206ce037d8d5f739859dbc4b3deb0ac9a80bbbe Mon Sep 17 00:00:00 2001 +From: "Edgar (gimli) Hucek" <gimli@dark-green.com> +Date: Thu, 11 Nov 2010 14:05:30 -0800 +Subject: [PATCH] backlight: MacBookAir3,1(3,2) mbp-nvidia-bl support + +commit bd760e1e5b34351e0705705e5163cb89c1316d71 upstream. + +Add support for the MacBookAir3,1 and MacBookAir3,2 to the mbp-nvidia-bl +driver. + +Signed-off-by: Edgar (gimli) Hucek <gimli@dark-green.com> +Acked-by: Richard Purdie <rpurdie@linux.intel.com> +Signed-off-by: Andrew Morton <akpm@linux-foundation.org> +Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> + +diff --git a/drivers/video/backlight/mbp_nvidia_bl.c b/drivers/video/backlight/mbp_nvidia_bl.c +index 1b5d3fe..0f5268e 100644 +--- a/drivers/video/backlight/mbp_nvidia_bl.c ++++ b/drivers/video/backlight/mbp_nvidia_bl.c +@@ -290,6 +290,24 @@ static const struct dmi_system_id __initdata mbp_device_table[] = { + }, + .driver_data = (void *)&nvidia_chipset_data, + }, ++ { ++ .callback = mbp_dmi_match, ++ .ident = "MacBookAir 3,1", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "MacBookAir3,1"), ++ }, ++ .driver_data = (void *)&nvidia_chipset_data, ++ }, ++ { ++ .callback = mbp_dmi_match, ++ .ident = "MacBookAir 3,2", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "MacBookAir3,2"), ++ }, ++ .driver_data = (void *)&nvidia_chipset_data, ++ }, + { } + }; + +-- +1.7.7 + diff --git a/queue/block-blk-sysfs-Fix-an-err-return-path-in-blk_regist.patch b/queue/block-blk-sysfs-Fix-an-err-return-path-in-blk_regist.patch new file mode 100644 index 0000000..1629a32 --- /dev/null +++ b/queue/block-blk-sysfs-Fix-an-err-return-path-in-blk_regist.patch @@ -0,0 +1,34 @@ +From 8055656ff11fa3a03b6c53b6a0b50b0ab057d54c Mon Sep 17 00:00:00 2001 +From: Liu Yuan <tailai.ly@taobao.com> +Date: Tue, 19 Apr 2011 13:47:58 +0200 +Subject: [PATCH] block, blk-sysfs: Fix an err return path in + blk_register_queue() + +commit ed5302d3c25006a9edc7a7fbea97a30483f89ef7 upstream. + +We do not call blk_trace_remove_sysfs() in err return path +if kobject_add() fails. This path fixes it. + +Signed-off-by: Liu Yuan <tailai.ly@taobao.com> +Signed-off-by: Jens Axboe <jaxboe@fusionio.com> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> + +diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c +index d246654..3eede79 100644 +--- a/block/blk-sysfs.c ++++ b/block/blk-sysfs.c +@@ -502,8 +502,10 @@ int blk_register_queue(struct gendisk *disk) + return ret; + + ret = kobject_add(&q->kobj, kobject_get(&dev->kobj), "%s", "queue"); +- if (ret < 0) ++ if (ret < 0) { ++ blk_trace_remove_sysfs(dev); + return ret; ++ } + + kobject_uevent(&q->kobj, KOBJ_ADD); + +-- +1.7.7 + diff --git a/queue/bonding-Ensure-that-we-unshare-skbs-prior-to-calling.patch b/queue/bonding-Ensure-that-we-unshare-skbs-prior-to-calling.patch new file mode 100644 index 0000000..7f1f3d1 --- /dev/null +++ b/queue/bonding-Ensure-that-we-unshare-skbs-prior-to-calling.patch @@ -0,0 +1,134 @@ +From f90f50c9cc9d92456ace2b0533971ac4c09592a8 Mon Sep 17 00:00:00 2001 +From: Neil Horman <nhorman@tuxdriver.com> +Date: Thu, 20 Jan 2011 09:02:31 +0000 +Subject: [PATCH] bonding: Ensure that we unshare skbs prior to calling + pskb_may_pull + +commit b30532515f0a62bfe17207ab00883dd262497006 upstream. + +Recently reported oops: + +kernel BUG at net/core/skbuff.c:813! +invalid opcode: 0000 [#1] SMP +last sysfs file: /sys/devices/virtual/net/bond0/broadcast +CPU 8 +Modules linked in: sit tunnel4 cpufreq_ondemand acpi_cpufreq freq_table bonding +ipv6 dm_mirror dm_region_hash dm_log cdc_ether usbnet mii serio_raw i2c_i801 +i2c_core iTCO_wdt iTCO_vendor_support shpchp ioatdma i7core_edac edac_core bnx2 +ixgbe dca mdio sg ext4 mbcache jbd2 sd_mod crc_t10dif mptsas mptscsih mptbase +scsi_transport_sas dm_mod [last unloaded: microcode] + +Modules linked in: sit tunnel4 cpufreq_ondemand acpi_cpufreq freq_table bonding +ipv6 dm_mirror dm_region_hash dm_log cdc_ether usbnet mii serio_raw i2c_i801 +i2c_core iTCO_wdt iTCO_vendor_support shpchp ioatdma i7core_edac edac_core bnx2 +ixgbe dca mdio sg ext4 mbcache jbd2 sd_mod crc_t10dif mptsas mptscsih mptbase +scsi_transport_sas dm_mod [last unloaded: microcode] +Pid: 0, comm: swapper Not tainted 2.6.32-71.el6.x86_64 #1 BladeCenter HS22 +-[7870AC1]- +RIP: 0010:[<ffffffff81405b16>] [<ffffffff81405b16>] +pskb_expand_head+0x36/0x1e0 +RSP: 0018:ffff880028303b70 EFLAGS: 00010202 +RAX: 0000000000000002 RBX: ffff880c6458ec80 RCX: 0000000000000020 +RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff880c6458ec80 +RBP: ffff880028303bc0 R08: ffffffff818a6180 R09: ffff880c6458ed64 +R10: ffff880c622b36c0 R11: 0000000000000400 R12: 0000000000000000 +R13: 0000000000000180 R14: ffff880c622b3000 R15: 0000000000000000 +FS: 0000000000000000(0000) GS:ffff880028300000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0018 ES: 0018 CR0: 000000008005003b +CR2: 00000038653452a4 CR3: 0000000001001000 CR4: 00000000000006e0 +DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 +Process swapper (pid: 0, threadinfo ffff8806649c2000, task ffff880c64f16ab0) +Stack: + ffff880028303bc0 ffffffff8104fff9 000000000000001c 0000000100000000 +<0> ffff880000047d80 ffff880c6458ec80 000000000000001c ffff880c6223da00 +<0> ffff880c622b3000 0000000000000000 ffff880028303c10 ffffffff81407f7a +Call Trace: +<IRQ> + [<ffffffff8104fff9>] ? __wake_up_common+0x59/0x90 + [<ffffffff81407f7a>] __pskb_pull_tail+0x2aa/0x360 + [<ffffffffa0244530>] bond_arp_rcv+0x2c0/0x2e0 [bonding] + [<ffffffff814a0857>] ? packet_rcv+0x377/0x440 + [<ffffffff8140f21b>] netif_receive_skb+0x2db/0x670 + [<ffffffff8140f788>] napi_skb_finish+0x58/0x70 + [<ffffffff8140fc89>] napi_gro_receive+0x39/0x50 + [<ffffffffa01286eb>] ixgbe_clean_rx_irq+0x35b/0x900 [ixgbe] + [<ffffffffa01290f6>] ixgbe_clean_rxtx_many+0x136/0x240 [ixgbe] + [<ffffffff8140fe53>] net_rx_action+0x103/0x210 + [<ffffffff81073bd7>] __do_softirq+0xb7/0x1e0 + [<ffffffff810d8740>] ? handle_IRQ_event+0x60/0x170 + [<ffffffff810142cc>] call_softirq+0x1c/0x30 + [<ffffffff81015f35>] do_softirq+0x65/0xa0 + [<ffffffff810739d5>] irq_exit+0x85/0x90 + [<ffffffff814cf915>] do_IRQ+0x75/0xf0 + [<ffffffff81013ad3>] ret_from_intr+0x0/0x11 + <EOI> + [<ffffffff8101bc01>] ? mwait_idle+0x71/0xd0 + [<ffffffff814cd80a>] ? atomic_notifier_call_chain+0x1a/0x20 + [<ffffffff81011e96>] cpu_idle+0xb6/0x110 + [<ffffffff814c17c8>] start_secondary+0x1fc/0x23f + +Resulted from bonding driver registering packet handlers via dev_add_pack and +then trying to call pskb_may_pull. If another packet handler (like for AF_PACKET +sockets) gets called first, the delivered skb will have a user count > 1, which +causes pskb_may_pull to BUG halt when it does its skb_shared check. Fix this by +calling skb_share_check prior to the may_pull call sites in the bonding driver +to clone the skb when needed. Tested by myself and the reported successfully. + +Signed-off-by: Neil Horman +CC: Andy Gospodarek <andy@greyhouse.net> +CC: Jay Vosburgh <fubar@us.ibm.com> +CC: "David S. Miller" <davem@davemloft.net> +Signed-off-by: Jay Vosburgh <fubar@us.ibm.com> +Signed-off-by: Andy Gospodarek <andy@greyhouse.net> +Signed-off-by: David S. Miller <davem@davemloft.net> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> + +diff --git a/drivers/net/bonding/bond_3ad.c b/drivers/net/bonding/bond_3ad.c +index 0ddf4c6..9a002f1 100644 +--- a/drivers/net/bonding/bond_3ad.c ++++ b/drivers/net/bonding/bond_3ad.c +@@ -2466,6 +2466,10 @@ int bond_3ad_lacpdu_recv(struct sk_buff *skb, struct net_device *dev, struct pac + if (!(dev->flags & IFF_MASTER)) + goto out; + ++ skb = skb_share_check(skb, GFP_ATOMIC); ++ if (!skb) ++ goto out; ++ + if (!pskb_may_pull(skb, sizeof(struct lacpdu))) + goto out; + +diff --git a/drivers/net/bonding/bond_alb.c b/drivers/net/bonding/bond_alb.c +index 0d42b38..e9154ab 100644 +--- a/drivers/net/bonding/bond_alb.c ++++ b/drivers/net/bonding/bond_alb.c +@@ -368,6 +368,10 @@ static int rlb_arp_recv(struct sk_buff *skb, struct net_device *bond_dev, struct + goto out; + } + ++ skb = skb_share_check(skb, GFP_ATOMIC); ++ if (!skb) ++ goto out; ++ + if (!pskb_may_pull(skb, arp_hdr_len(bond_dev))) + goto out; + +diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c +index 0075514..af8eec1 100644 +--- a/drivers/net/bonding/bond_main.c ++++ b/drivers/net/bonding/bond_main.c +@@ -2645,6 +2645,10 @@ static int bond_arp_rcv(struct sk_buff *skb, struct net_device *dev, struct pack + if (!slave || !slave_do_arp_validate(bond, slave)) + goto out_unlock; + ++ skb = skb_share_check(skb, GFP_ATOMIC); ++ if (!skb) ++ goto out_unlock; ++ + if (!pskb_may_pull(skb, arp_hdr_len(dev))) + goto out_unlock; + +-- +1.7.7 + diff --git a/queue/btrfs-Require-CAP_SYS_ADMIN-for-filesystem-rebalance.patch b/queue/btrfs-Require-CAP_SYS_ADMIN-for-filesystem-rebalance.patch new file mode 100644 index 0000000..b67477f --- /dev/null +++ b/queue/btrfs-Require-CAP_SYS_ADMIN-for-filesystem-rebalance.patch @@ -0,0 +1,41 @@ +From c7114c219833c13277eeb18e3926bae49ec85602 Mon Sep 17 00:00:00 2001 +From: Ben Hutchings <ben@decadent.org.uk> +Date: Wed, 29 Dec 2010 14:55:03 +0000 +Subject: [PATCH] btrfs: Require CAP_SYS_ADMIN for filesystem rebalance + +commit 6f88a4403def422bd8e276ddf6863d6ac71435d2 upstream. + +Filesystem rebalancing (BTRFS_IOC_BALANCE) affects the entire +filesystem and may run uninterruptibly for a long time. This does not +seem to be something that an unprivileged user should be able to do. + +Reported-by: Aron Xu <happyaron.xu@gmail.com> +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +Signed-off-by: Chris Mason <chris.mason@oracle.com> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> + +diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c +index 8db7b14..c04ebb1 100644 +--- a/fs/btrfs/volumes.c ++++ b/fs/btrfs/volumes.c +@@ -22,6 +22,7 @@ + #include <linux/blkdev.h> + #include <linux/random.h> + #include <linux/iocontext.h> ++#include <linux/capability.h> + #include <asm/div64.h> + #include "compat.h" + #include "ctree.h" +@@ -1908,6 +1909,9 @@ int btrfs_balance(struct btrfs_root *dev_root) + if (dev_root->fs_info->sb->s_flags & MS_RDONLY) + return -EROFS; + ++ if (!capable(CAP_SYS_ADMIN)) ++ return -EPERM; ++ + mutex_lock(&dev_root->fs_info->volume_mutex); + dev_root = dev_root->fs_info->dev_root; + +-- +1.7.7 + diff --git a/queue/cifs-fix-another-memleak-in-cifs_root_iget.patch b/queue/cifs-fix-another-memleak-in-cifs_root_iget.patch new file mode 100644 index 0000000..02eb272 --- /dev/null +++ b/queue/cifs-fix-another-memleak-in-cifs_root_iget.patch @@ -0,0 +1,55 @@ +From 8b198c72bdec68d657d39cd0c8d71ee64bbf775e Mon Sep 17 00:00:00 2001 +From: Oskar Schirmer <oskar@scara.com> +Date: Wed, 10 Nov 2010 21:06:13 +0000 +Subject: [PATCH] cifs: fix another memleak, in cifs_root_iget + +commit a7851ce73b9fdef53f251420e6883cf4f3766534 upstream. + +cifs_root_iget allocates full_path through +cifs_build_path_to_root, but fails to kfree it upon +cifs_get_inode_info* failure. + +Make all failure exit paths traverse clean up +handling at the end of the function. + +Signed-off-by: Oskar Schirmer <oskar@scara.com> +Reviewed-by: Jesper Juhl <jj@chaosbits.net> +Signed-off-by: Steve French <sfrench@us.ibm.com> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> + +diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c +index 49b47c3..da3e83f 100644 +--- a/fs/cifs/inode.c ++++ b/fs/cifs/inode.c +@@ -793,8 +793,10 @@ struct inode *cifs_root_iget(struct super_block *sb, unsigned long ino) + rc = cifs_get_inode_info(&inode, full_path, NULL, sb, + xid, NULL); + +- if (!inode) +- return ERR_PTR(-ENOMEM); ++ if (!inode) { ++ inode = ERR_PTR(-ENOMEM); ++ goto out; ++ } + + if (rc && cifs_sb->tcon->ipc) { + cFYI(1, ("ipc connection - fake read inode")); +@@ -805,13 +807,11 @@ struct inode *cifs_root_iget(struct super_block *sb, unsigned long ino) + inode->i_uid = cifs_sb->mnt_uid; + inode->i_gid = cifs_sb->mnt_gid; + } else if (rc) { +- kfree(full_path); +- _FreeXid(xid); + iget_failed(inode); +- return ERR_PTR(rc); ++ inode = ERR_PTR(rc); + } + +- ++out: + kfree(full_path); + /* can not call macro FreeXid here since in a void func + * TODO: This is no longer true +-- +1.7.7 + diff --git a/queue/dasd-correct-device-table.patch b/queue/dasd-correct-device-table.patch new file mode 100644 index 0000000..2ee3f38 --- /dev/null +++ b/queue/dasd-correct-device-table.patch @@ -0,0 +1,31 @@ +From ddc44ac3195678adb90d3faf78b152cd99015061 Mon Sep 17 00:00:00 2001 +From: Stefan Haberland <stefan.haberland@de.ibm.com> +Date: Thu, 17 Feb 2011 13:13:55 +0100 +Subject: [PATCH] dasd: correct device table + +commit 5da24b7627ff821e154a3aaecd5d60e1d8e228a5 upstream. + +The 3880 storage control unit supports a 3380 device +type, but not a 3390 device type. + +Reported-by: Stephen Powell <zlinuxman@wowway.com> +Signed-off-by: Stefan Haberland <stefan.haberland@de.ibm.com> +Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> + +diff --git a/drivers/s390/block/dasd_eckd.c b/drivers/s390/block/dasd_eckd.c +index 0cb2331..7d05fe5 100644 +--- a/drivers/s390/block/dasd_eckd.c ++++ b/drivers/s390/block/dasd_eckd.c +@@ -63,7 +63,7 @@ static struct dasd_discipline dasd_eckd_discipline; + static struct ccw_device_id dasd_eckd_ids[] = { + { CCW_DEVICE_DEVTYPE (0x3990, 0, 0x3390, 0), .driver_info = 0x1}, + { CCW_DEVICE_DEVTYPE (0x2105, 0, 0x3390, 0), .driver_info = 0x2}, +- { CCW_DEVICE_DEVTYPE (0x3880, 0, 0x3390, 0), .driver_info = 0x3}, ++ { CCW_DEVICE_DEVTYPE (0x3880, 0, 0x3380, 0), .driver_info = 0x3}, + { CCW_DEVICE_DEVTYPE (0x3990, 0, 0x3380, 0), .driver_info = 0x4}, + { CCW_DEVICE_DEVTYPE (0x2105, 0, 0x3380, 0), .driver_info = 0x5}, + { CCW_DEVICE_DEVTYPE (0x9343, 0, 0x9345, 0), .driver_info = 0x6}, +-- +1.7.7 + diff --git a/queue/dell-laptop-Add-another-Dell-laptop-family-to-the-DM.patch b/queue/dell-laptop-Add-another-Dell-laptop-family-to-the-DM.patch new file mode 100644 index 0000000..e5e112e --- /dev/null +++ b/queue/dell-laptop-Add-another-Dell-laptop-family-to-the-DM.patch @@ -0,0 +1,40 @@ +From e24b8b1756d6033c7e8f9a9ccff2be73513adf9c Mon Sep 17 00:00:00 2001 +From: Rezwanul Kabir <Rezwanul_Kabir@dell.com> +Date: Wed, 23 Jun 2010 12:02:43 -0500 +Subject: [PATCH] dell-laptop: Add another Dell laptop family to the DMI + whitelist + +commit 410d44c74cf9942e3055d5b7d73953fac8efbacb upstream. + +This is to support Precision M4500 and others. + +Signed-off-by: Rezwanul Kabir <Rezwanul_Kabir@dell.com> +Signed-off-by: Matthew Garrett <mjg@redhat.com> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> + +diff --git a/drivers/platform/x86/dell-laptop.c b/drivers/platform/x86/dell-laptop.c +index 6110601..0fb56e0 100644 +--- a/drivers/platform/x86/dell-laptop.c ++++ b/drivers/platform/x86/dell-laptop.c +@@ -83,6 +83,12 @@ static const struct dmi_system_id __initdata dell_device_table[] = { + }, + }, + { ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), ++ DMI_MATCH(DMI_CHASSIS_TYPE, "9"), /*Laptop*/ ++ }, ++ }, ++ { + .ident = "Dell Computer Corporation", + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "Dell Computer Corporation"), +@@ -628,4 +634,5 @@ MODULE_AUTHOR("Matthew Garrett <mjg@redhat.com>"); + MODULE_DESCRIPTION("Dell laptop driver"); + MODULE_LICENSE("GPL"); + MODULE_ALIAS("dmi:*svnDellInc.:*:ct8:*"); ++MODULE_ALIAS("dmi:*svnDellInc.:*:ct9:*"); + MODULE_ALIAS("dmi:*svnDellComputerCorporation.:*:ct8:*"); +-- +1.7.7 + diff --git a/queue/drm-radeon-kms-fix-bad-shift-in-atom-iio-table-parse.patch b/queue/drm-radeon-kms-fix-bad-shift-in-atom-iio-table-parse.patch new file mode 100644 index 0000000..ed0bf88 --- /dev/null +++ b/queue/drm-radeon-kms-fix-bad-shift-in-atom-iio-table-parse.patch @@ -0,0 +1,47 @@ +From d814830772badf6ebb4aa8ffe5fc3354023de59e Mon Sep 17 00:00:00 2001 +From: Alex Deucher <alexdeucher@gmail.com> +Date: Thu, 14 Apr 2011 11:19:50 -0400 +Subject: [PATCH] drm/radeon/kms: fix bad shift in atom iio table parser + +commit 8e461123f28e6b17456225e70eb834b3b30d28bb upstream. + +Noticed by Patrick Lowry. + +Signed-off-by: Alex Deucher <alexdeucher@gmail.com> +Signed-off-by: Dave Airlie <airlied@redhat.com> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> + +diff --git a/drivers/gpu/drm/radeon/atom.c b/drivers/gpu/drm/radeon/atom.c +index 1d56983..b913bf1 100644 +--- a/drivers/gpu/drm/radeon/atom.c ++++ b/drivers/gpu/drm/radeon/atom.c +@@ -131,7 +131,7 @@ static uint32_t atom_iio_execute(struct atom_context *ctx, int base, + case ATOM_IIO_MOVE_INDEX: + temp &= + ~((0xFFFFFFFF >> (32 - CU8(base + 1))) << +- CU8(base + 2)); ++ CU8(base + 3)); + temp |= + ((index >> CU8(base + 2)) & + (0xFFFFFFFF >> (32 - CU8(base + 1)))) << CU8(base + +@@ -141,7 +141,7 @@ static uint32_t atom_iio_execute(struct atom_context *ctx, int base, + case ATOM_IIO_MOVE_DATA: + temp &= + ~((0xFFFFFFFF >> (32 - CU8(base + 1))) << +- CU8(base + 2)); ++ CU8(base + 3)); + temp |= + ((data >> CU8(base + 2)) & + (0xFFFFFFFF >> (32 - CU8(base + 1)))) << CU8(base + +@@ -151,7 +151,7 @@ static uint32_t atom_iio_execute(struct atom_context *ctx, int base, + case ATOM_IIO_MOVE_ATTR: + temp &= + ~((0xFFFFFFFF >> (32 - CU8(base + 1))) << +- CU8(base + 2)); ++ CU8(base + 3)); + temp |= + ((ctx-> + io_attr >> CU8(base + 2)) & (0xFFFFFFFF >> (32 - +-- +1.7.7 + diff --git a/queue/e1000-fix-Tx-hangs-by-disabling-64-bit-DMA.patch b/queue/e1000-fix-Tx-hangs-by-disabling-64-bit-DMA.patch new file mode 100644 index 0000000..bf083ec --- /dev/null +++ b/queue/e1000-fix-Tx-hangs-by-disabling-64-bit-DMA.patch @@ -0,0 +1,255 @@ +From 4dd66afa256095e392afc914c2103237b5523cef Mon Sep 17 00:00:00 2001 +From: Jesse Brandeburg <jesse.brandeburg@intel.com> +Date: Tue, 7 Sep 2010 21:01:12 +0000 +Subject: [PATCH] e1000: fix Tx hangs by disabling 64-bit DMA + +commit e508be174ad36b0cf9b324cd04978c2b13c21502 upstream. + +Several users report issues with 32-bit adapters when plugged +into PCI slots in machines with >= 4GB ram. In particular AMD +systems with HyperTransport to PCI bridges seem to trigger the +issue, but it isn't limited to only them. + +This issue is not easily reproducible here, yet still continues +to occur in the field. For e1000 on PCI devices, just disable DMA +addresses over the 4GB boundary when in PCI (not PCI-X) mode, to +prevent the issue from continuing to pop up. The performance +impact for this is negligible. + +The code was refactored to move the init of the hw struct to its +own function. This allows the init to be called very early in +probe, which then allows using hw-> members for this fix. + +A slight refactor to the DMA mask code was done for minor +correctness based on the instructions in DMA-API-HOWTO. + +[PG: 34 has pci prefix, e.g pci_set_dma_mask vs. dma_set_mask] + +Signed-off-by: Jesse Brandeburg <jesse.brandeburg@intel.com> +Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com> +Signed-off-by: David S. Miller <davem@davemloft.net> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> + +diff --git a/drivers/net/e1000/e1000_main.c b/drivers/net/e1000/e1000_main.c +index 13e34d2..6039d7f 100644 +--- a/drivers/net/e1000/e1000_main.c ++++ b/drivers/net/e1000/e1000_main.c +@@ -787,6 +787,70 @@ static const struct net_device_ops e1000_netdev_ops = { + }; + + /** ++ * e1000_init_hw_struct - initialize members of hw struct ++ * @adapter: board private struct ++ * @hw: structure used by e1000_hw.c ++ * ++ * Factors out initialization of the e1000_hw struct to its own function ++ * that can be called very early at init (just after struct allocation). ++ * Fields are initialized based on PCI device information and ++ * OS network device settings (MTU size). ++ * Returns negative error codes if MAC type setup fails. ++ */ ++static int e1000_init_hw_struct(struct e1000_adapter *adapter, ++ struct e1000_hw *hw) ++{ ++ struct pci_dev *pdev = adapter->pdev; ++ ++ /* PCI config space info */ ++ hw->vendor_id = pdev->vendor; ++ hw->device_id = pdev->device; ++ hw->subsystem_vendor_id = pdev->subsystem_vendor; ++ hw->subsystem_id = pdev->subsystem_device; ++ hw->revision_id = pdev->revision; ++ ++ pci_read_config_word(pdev, PCI_COMMAND, &hw->pci_cmd_word); ++ ++ hw->max_frame_size = adapter->netdev->mtu + ++ ENET_HEADER_SIZE + ETHERNET_FCS_SIZE; ++ hw->min_frame_size = MINIMUM_ETHERNET_FRAME_SIZE; ++ ++ /* identify the MAC */ ++ if (e1000_set_mac_type(hw)) { ++ e_err(probe, "Unknown MAC Type\n"); ++ return -EIO; ++ } ++ ++ switch (hw->mac_type) { ++ default: ++ break; ++ case e1000_82541: ++ case e1000_82547: ++ case e1000_82541_rev_2: ++ case e1000_82547_rev_2: ++ hw->phy_init_script = 1; ++ break; ++ } ++ ++ e1000_set_media_type(hw); ++ e1000_get_bus_info(hw); ++ ++ hw->wait_autoneg_complete = false; ++ hw->tbi_compatibility_en = true; ++ hw->adaptive_ifs = true; ++ ++ /* Copper options */ ++ ++ if (hw->media_type == e1000_media_type_copper) { ++ hw->mdix = AUTO_ALL_MODES; ++ hw->disable_polarity_correction = false; ++ hw->master_slave = E1000_MASTER_SLAVE; ++ } ++ ++ return 0; ++} ++ ++/** + * e1000_probe - Device Initialization Routine + * @pdev: PCI device information struct + * @ent: entry in e1000_pci_tbl +@@ -823,22 +887,6 @@ static int __devinit e1000_probe(struct pci_dev *pdev, + if (err) + return err; + +- if (!pci_set_dma_mask(pdev, DMA_BIT_MASK(64)) && +- !pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(64))) { +- pci_using_dac = 1; +- } else { +- err = pci_set_dma_mask(pdev, DMA_BIT_MASK(32)); +- if (err) { +- err = pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(32)); +- if (err) { +- E1000_ERR("No usable DMA configuration, " +- "aborting\n"); +- goto err_dma; +- } +- } +- pci_using_dac = 0; +- } +- + err = pci_request_selected_regions(pdev, bars, e1000_driver_name); + if (err) + goto err_pci_reg; +@@ -882,6 +930,32 @@ static int __devinit e1000_probe(struct pci_dev *pdev, + } + } + ++ /* make ready for any if (hw->...) below */ ++ err = e1000_init_hw_struct(adapter, hw); ++ if (err) ++ goto err_sw_init; ++ ++ /* ++ * there is a workaround being applied below that limits ++ * 64-bit DMA addresses to 64-bit hardware. There are some ++ * 32-bit adapters that Tx hang when given 64-bit DMA addresses ++ */ ++ pci_using_dac = 0; ++ if ((hw->bus_type == e1000_bus_type_pcix) && ++ !dma_set_mask(&pdev->dev, DMA_BIT_MASK(64))) { ++ /* ++ * according to DMA-API-HOWTO, coherent calls will always ++ * succeed if the set call did ++ */ ++ dma_set_coherent_mask(&pdev->dev, DMA_BIT_MASK(64)); ++ pci_using_dac = 1; ++ } else if (!dma_set_mask(&pdev->dev, DMA_BIT_MASK(32))) { ++ dma_set_coherent_mask(&pdev->dev, DMA_BIT_MASK(32)); ++ } else { ++ pr_err("No usable DMA config, aborting\n"); ++ goto err_dma; ++ } ++ + netdev->netdev_ops = &e1000_netdev_ops; + e1000_set_ethtool_ops(netdev); + netdev->watchdog_timeo = 5 * HZ; +@@ -956,8 +1030,6 @@ static int __devinit e1000_probe(struct pci_dev *pdev, + if (!is_valid_ether_addr(netdev->perm_addr)) + DPRINTK(PROBE, ERR, "Invalid MAC Address\n"); + +- e1000_get_bus_info(hw); +- + init_timer(&adapter->tx_fifo_stall_timer); + adapter->tx_fifo_stall_timer.function = &e1000_82547_tx_fifo_stall; + adapter->tx_fifo_stall_timer.data = (unsigned long)adapter; +@@ -1070,6 +1142,7 @@ err_eeprom: + iounmap(hw->flash_address); + kfree(adapter->tx_ring); + kfree(adapter->rx_ring); ++err_dma: + err_sw_init: + iounmap(hw->hw_addr); + err_ioremap: +@@ -1077,7 +1150,6 @@ err_ioremap: + err_alloc_etherdev: + pci_release_selected_regions(pdev, bars); + err_pci_reg: +-err_dma: + pci_disable_device(pdev); + return err; + } +@@ -1129,62 +1201,12 @@ static void __devexit e1000_remove(struct pci_dev *pdev) + * @adapter: board private structure to initialize + * + * e1000_sw_init initializes the Adapter private data structure. +- * Fields are initialized based on PCI device information and +- * OS network device settings (MTU size). ++ * e1000_init_hw_struct MUST be called before this function + **/ + + static int __devinit e1000_sw_init(struct e1000_adapter *adapter) + { +- struct e1000_hw *hw = &adapter->hw; +- struct net_device *netdev = adapter->netdev; +- struct pci_dev *pdev = adapter->pdev; +- +- /* PCI config space info */ +- +- hw->vendor_id = pdev->vendor; +- hw->device_id = pdev->device; +- hw->subsystem_vendor_id = pdev->subsystem_vendor; +- hw->subsystem_id = pdev->subsystem_device; +- hw->revision_id = pdev->revision; +- +- pci_read_config_word(pdev, PCI_COMMAND, &hw->pci_cmd_word); +- + adapter->rx_buffer_len = MAXIMUM_ETHERNET_VLAN_SIZE; +- hw->max_frame_size = netdev->mtu + +- ENET_HEADER_SIZE + ETHERNET_FCS_SIZE; +- hw->min_frame_size = MINIMUM_ETHERNET_FRAME_SIZE; +- +- /* identify the MAC */ +- +- if (e1000_set_mac_type(hw)) { +- DPRINTK(PROBE, ERR, "Unknown MAC Type\n"); +- return -EIO; +- } +- +- switch (hw->mac_type) { +- default: +- break; +- case e1000_82541: +- case e1000_82547: +- case e1000_82541_rev_2: +- case e1000_82547_rev_2: +- hw->phy_init_script = 1; +- break; +- } +- +- e1000_set_media_type(hw); +- +- hw->wait_autoneg_complete = false; +- hw->tbi_compatibility_en = true; +- hw->adaptive_ifs = true; +- +- /* Copper options */ +- +- if (hw->media_type == e1000_media_type_copper) { +- hw->mdix = AUTO_ALL_MODES; +- hw->disable_polarity_correction = false; +- hw->master_slave = E1000_MASTER_SLAVE; +- } + + adapter->num_tx_queues = 1; + adapter->num_rx_queues = 1; +-- +1.7.7 + diff --git a/queue/e1000e-Reset-82577-82578-PHY-before-first-PHY-regist.patch b/queue/e1000e-Reset-82577-82578-PHY-before-first-PHY-regist.patch new file mode 100644 index 0000000..dfac7af --- /dev/null +++ b/queue/e1000e-Reset-82577-82578-PHY-before-first-PHY-regist.patch @@ -0,0 +1,40 @@ +From 51b7c3f472acf7f15b58c44bb912ec658d54721a Mon Sep 17 00:00:00 2001 +From: Bruce Allan <bruce.w.allan@intel.com> +Date: Wed, 5 May 2010 22:00:27 +0000 +Subject: [PATCH] e1000e: Reset 82577/82578 PHY before first PHY register read + +commit 627c8a041f7aaaea93c766f69bd61d952a277586 upstream. + +Reset the PHY before first accessing it. Doing so, ensure that the PHY is +in a known good state before we read/write PHY registers. This fixes a +driver probe failure. + +Signed-off-by: Bruce Allan <bruce.w.allan@intel.com> +Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com> +Signed-off-by: David S. Miller <davem@davemloft.net> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> + +diff --git a/drivers/net/e1000e/ich8lan.c b/drivers/net/e1000e/ich8lan.c +index 8b5e157..a626012 100644 +--- a/drivers/net/e1000e/ich8lan.c ++++ b/drivers/net/e1000e/ich8lan.c +@@ -274,6 +274,16 @@ static s32 e1000_init_phy_params_pchlan(struct e1000_hw *hw) + phy->ops.power_down = e1000_power_down_phy_copper_ich8lan; + phy->autoneg_mask = AUTONEG_ADVERTISE_SPEED_DEFAULT; + ++ /* ++ * Reset the PHY before any acccess to it. Doing so, ensures that ++ * the PHY is in a known good state before we read/write PHY registers. ++ * The generic reset is sufficient here, because we haven't determined ++ * the PHY type yet. ++ */ ++ ret_val = e1000e_phy_hw_reset_generic(hw); ++ if (ret_val) ++ goto out; ++ + phy->id = e1000_phy_unknown; + ret_val = e1000e_get_phy_id(hw); + if (ret_val) +-- +1.7.7 + diff --git a/queue/fix-oops-in-scsi_run_queue.patch b/queue/fix-oops-in-scsi_run_queue.patch new file mode 100644 index 0000000..73f2811 --- /dev/null +++ b/queue/fix-oops-in-scsi_run_queue.patch @@ -0,0 +1,48 @@ +From 5f73c337d88fc4a7071464a87b23cbb01f16c5d4 Mon Sep 17 00:00:00 2001 +From: James Bottomley <James.Bottomley@suse.de> +Date: Sun, 1 May 2011 09:42:07 -0500 +Subject: [PATCH] fix oops in scsi_run_queue() + +commit c055f5b2614b4f758ae6cc86733f31fa4c2c5844 upstream. + +The recent commit closing the race window in device teardown: + +commit 86cbfb5607d4b81b1a993ff689bbd2addd5d3a9b +Author: James Bottomley <James.Bottomley@suse.de> +Date: Fri Apr 22 10:39:59 2011 -0500 + + [SCSI] put stricter guards on queue dead checks + +is causing a potential NULL deref in scsi_run_queue() because the +q->queuedata may already be NULL by the time this function is called. +Since we shouldn't be running a queue that is being torn down, simply +add a NULL check in scsi_run_queue() to forestall this. + +Tested-by: Jim Schutt <jaschut@sandia.gov> +Signed-off-by: James Bottomley <James.Bottomley@suse.de> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> + +diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c +index c2a9e12..725f3cd 100644 +--- a/drivers/scsi/scsi_lib.c ++++ b/drivers/scsi/scsi_lib.c +@@ -400,10 +400,15 @@ static inline int scsi_host_is_busy(struct Scsi_Host *shost) + static void scsi_run_queue(struct request_queue *q) + { + struct scsi_device *sdev = q->queuedata; +- struct Scsi_Host *shost = sdev->host; ++ struct Scsi_Host *shost; + LIST_HEAD(starved_list); + unsigned long flags; + ++ /* if the device is dead, sdev will be NULL, so no queue to run */ ++ if (!sdev) ++ return; ++ ++ shost = sdev->host; + if (scsi_target(sdev)->single_lun) + scsi_single_lun_run(sdev); + +-- +1.7.7 + diff --git a/queue/hwmon-applesmc-Add-MacBookAir3-1-3-2-support.patch b/queue/hwmon-applesmc-Add-MacBookAir3-1-3-2-support.patch new file mode 100644 index 0000000..4ce171b --- /dev/null +++ b/queue/hwmon-applesmc-Add-MacBookAir3-1-3-2-support.patch @@ -0,0 +1,53 @@ +From 89031374986e654546e61bac7567a308154432f2 Mon Sep 17 00:00:00 2001 +From: Edgar Hucek <gimli@dark-green.com> +Date: Tue, 9 Nov 2010 15:15:01 +0000 +Subject: [PATCH] hwmon: (applesmc) Add MacBookAir3,1(3,2) support + +commit 132af03233b493101a53010383b5abb5b9ff1e51 upstream. + +This patch add support for the MacBookAir3,1 and MacBookAir3,2 to the +applesmc driver. + +[rydberg@euromail.se: minor cleanup] +Signed-off-by: Edgar Hucek <gimli@dark-green.com> +Signed-off-by: Henrik Rydberg <rydberg@euromail.se> +Signed-off-by: Guenter Roeck <guenter.roeck@ericsson.com> + +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> + +diff --git a/drivers/hwmon/applesmc.c b/drivers/hwmon/applesmc.c +index 57c0331..7765a6b 100644 +--- a/drivers/hwmon/applesmc.c ++++ b/drivers/hwmon/applesmc.c +@@ -162,6 +162,10 @@ static const char *temperature_sensors_sets[][41] = { + /* Set 22: MacBook Pro 7,1 */ + { "TB0T", "TB1T", "TB2T", "TC0D", "TC0P", "TN0D", "TN0P", "TN0S", + "TN1D", "TN1F", "TN1G", "TN1S", "Th1H", "Ts0P", "Ts0S", NULL }, ++/* Set 23: MacBook Air 3,1 */ ++ { "TB0T", "TB1T", "TB2T", "TC0D", "TC0E", "TC0P", "TC1E", "TCZ3", ++ "TCZ4", "TCZ5", "TG0E", "TG1E", "TG2E", "TGZ3", "TGZ4", "TGZ5", ++ "TH0F", "TH0O", "TM0P" }, + }; + + /* List of keys used to read/write fan speeds */ +@@ -1385,11 +1389,17 @@ static __initdata struct dmi_match_data applesmc_dmi_data[] = { + { .accelerometer = 1, .light = 1, .temperature_set = 21 }, + /* MacBook Pro 7,1: accelerometer, backlight and temperature set 22 */ + { .accelerometer = 1, .light = 1, .temperature_set = 22 }, ++/* MacBook Air 3,1: accelerometer, backlight and temperature set 23 */ ++ { .accelerometer = 0, .light = 0, .temperature_set = 23 }, + }; + + /* Note that DMI_MATCH(...,"MacBook") will match "MacBookPro1,1". + * So we need to put "Apple MacBook Pro" before "Apple MacBook". */ + static __initdata struct dmi_system_id applesmc_whitelist[] = { ++ { applesmc_dmi_match, "Apple MacBook Air 3", { ++ DMI_MATCH(DMI_BOARD_VENDOR, "Apple"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "MacBookAir3") }, ++ &applesmc_dmi_data[23]}, + { applesmc_dmi_match, "Apple MacBook Air 2", { + DMI_MATCH(DMI_BOARD_VENDOR, "Apple"), + DMI_MATCH(DMI_PRODUCT_NAME, "MacBookAir2") }, +-- +1.7.7 + diff --git a/queue/hwmon-applesmc-Add-generic-support-for-MacBook-Pro-6.patch b/queue/hwmon-applesmc-Add-generic-support-for-MacBook-Pro-6.patch new file mode 100644 index 0000000..2e42733 --- /dev/null +++ b/queue/hwmon-applesmc-Add-generic-support-for-MacBook-Pro-6.patch @@ -0,0 +1,55 @@ +From 062bd7f05662efc3c65cf13abbf6650bfe07b4e9 Mon Sep 17 00:00:00 2001 +From: Bernhard Froemel <froemel@vmars.tuwien.ac.at> +Date: Thu, 27 May 2010 19:58:52 +0200 +Subject: [PATCH] hwmon: (applesmc) Add generic support for MacBook Pro 6 + +commit 872bad55e2d3fcc13e1e8770a3b200f0c6ca5126 upstream. + +This patch adds generic support for the MacBook Pro 6 family +based on the 6,2 model. + +[rydberg@euromail.se: patch cleanup] +Signed-off-by: Bernhard Froemel <froemel@vmars.tuwien.ac.at> +Signed-off-by: Henrik Rydberg <rydberg@euromail.se> +Signed-off-by: Jean Delvare <khali@linux-fr.org> + +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> + +diff --git a/drivers/hwmon/applesmc.c b/drivers/hwmon/applesmc.c +index be33094..ce41a43 100644 +--- a/drivers/hwmon/applesmc.c ++++ b/drivers/hwmon/applesmc.c +@@ -155,6 +155,10 @@ static const char *temperature_sensors_sets[][41] = { + /* Set 20: MacBook Pro 5,4 */ + { "TB0T", "TB1T", "TB2T", "TB3T", "TC0D", "TC0F", "TC0P", "TN0D", + "TN0P", "TTF0", "Th2H", "Ts0P", "Ts0S", NULL }, ++/* Set 21: MacBook Pro 6,2 */ ++ { "TB0T", "TB1T", "TB2T", "TC0C", "TC0D", "TC0P", "TC1C", "TG0D", ++ "TG0P", "TG0T", "TMCD", "TP0P", "TPCD", "Th1H", "Th2H", "Tm0P", ++ "Ts0P", "Ts0S", NULL }, + }; + + /* List of keys used to read/write fan speeds */ +@@ -1374,6 +1378,8 @@ static __initdata struct dmi_match_data applesmc_dmi_data[] = { + { .accelerometer = 1, .light = 1, .temperature_set = 19 }, + /* MacBook Pro 5,4: accelerometer, backlight and temperature set 20 */ + { .accelerometer = 1, .light = 1, .temperature_set = 20 }, ++/* MacBook Pro 6,2: accelerometer, backlight and temperature set 21 */ ++ { .accelerometer = 1, .light = 1, .temperature_set = 21 }, + }; + + /* Note that DMI_MATCH(...,"MacBook") will match "MacBookPro1,1". +@@ -1395,6 +1401,10 @@ static __initdata struct dmi_system_id applesmc_whitelist[] = { + DMI_MATCH(DMI_BOARD_VENDOR, "Apple"), + DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro5,3") }, + &applesmc_dmi_data[19]}, ++ { applesmc_dmi_match, "Apple MacBook Pro 6", { ++ DMI_MATCH(DMI_BOARD_VENDOR, "Apple"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro6") }, ++ &applesmc_dmi_data[21]}, + { applesmc_dmi_match, "Apple MacBook Pro 5", { + DMI_MATCH(DMI_BOARD_VENDOR, "Apple"), + DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro5") }, +-- +1.7.7 + diff --git a/queue/hwmon-applesmc-Add-generic-support-for-MacBook-Pro-7.patch b/queue/hwmon-applesmc-Add-generic-support-for-MacBook-Pro-7.patch new file mode 100644 index 0000000..49c72af --- /dev/null +++ b/queue/hwmon-applesmc-Add-generic-support-for-MacBook-Pro-7.patch @@ -0,0 +1,51 @@ +From ded8d8d8b603eeadc831e29c3ed16b24c49dc66e Mon Sep 17 00:00:00 2001 +From: Henrik Rydberg <rydberg@euromail.se> +Date: Thu, 27 May 2010 19:58:53 +0200 +Subject: [PATCH] hwmon: (applesmc) Add generic support for MacBook Pro 7 + +commit 405eaa1c1d045cdd872802fc515f638573984880 upstream. + +This patch adds generic support for the MacBook Pro 7 family +based on the 7,1 model. + +Signed-off-by: Henrik Rydberg <rydberg@euromail.se> +Signed-off-by: Jean Delvare <khali@linux-fr.org> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> + +diff --git a/drivers/hwmon/applesmc.c b/drivers/hwmon/applesmc.c +index ce41a43..57c0331 100644 +--- a/drivers/hwmon/applesmc.c ++++ b/drivers/hwmon/applesmc.c +@@ -159,6 +159,9 @@ static const char *temperature_sensors_sets[][41] = { + { "TB0T", "TB1T", "TB2T", "TC0C", "TC0D", "TC0P", "TC1C", "TG0D", + "TG0P", "TG0T", "TMCD", "TP0P", "TPCD", "Th1H", "Th2H", "Tm0P", + "Ts0P", "Ts0S", NULL }, ++/* Set 22: MacBook Pro 7,1 */ ++ { "TB0T", "TB1T", "TB2T", "TC0D", "TC0P", "TN0D", "TN0P", "TN0S", ++ "TN1D", "TN1F", "TN1G", "TN1S", "Th1H", "Ts0P", "Ts0S", NULL }, + }; + + /* List of keys used to read/write fan speeds */ +@@ -1380,6 +1383,8 @@ static __initdata struct dmi_match_data applesmc_dmi_data[] = { + { .accelerometer = 1, .light = 1, .temperature_set = 20 }, + /* MacBook Pro 6,2: accelerometer, backlight and temperature set 21 */ + { .accelerometer = 1, .light = 1, .temperature_set = 21 }, ++/* MacBook Pro 7,1: accelerometer, backlight and temperature set 22 */ ++ { .accelerometer = 1, .light = 1, .temperature_set = 22 }, + }; + + /* Note that DMI_MATCH(...,"MacBook") will match "MacBookPro1,1". +@@ -1393,6 +1398,10 @@ static __initdata struct dmi_system_id applesmc_whitelist[] = { + DMI_MATCH(DMI_BOARD_VENDOR, "Apple"), + DMI_MATCH(DMI_PRODUCT_NAME, "MacBookAir") }, + &applesmc_dmi_data[7]}, ++ { applesmc_dmi_match, "Apple MacBook Pro 7", { ++ DMI_MATCH(DMI_BOARD_VENDOR, "Apple"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro7") }, ++ &applesmc_dmi_data[22]}, + { applesmc_dmi_match, "Apple MacBook Pro 5,4", { + DMI_MATCH(DMI_BOARD_VENDOR, "Apple"), + DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro5,4") }, +-- +1.7.7 + diff --git a/queue/hwmon-applesmc-Add-support-for-MacBook-Pro-5-3-and-5.patch b/queue/hwmon-applesmc-Add-support-for-MacBook-Pro-5-3-and-5.patch new file mode 100644 index 0000000..20cb1eb --- /dev/null +++ b/queue/hwmon-applesmc-Add-support-for-MacBook-Pro-5-3-and-5.patch @@ -0,0 +1,61 @@ +From c0993d79661b3e6a409b47bd621951b5ba306c77 Mon Sep 17 00:00:00 2001 +From: Henrik Rydberg <rydberg@euromail.se> +Date: Thu, 27 May 2010 19:58:50 +0200 +Subject: [PATCH] hwmon: (applesmc) Add support for MacBook Pro 5,3 and 5,4 + +commit 4e4a99d32721800c061191027f18f780dcbd9e0b upstream. + +The MacBookPro 5,3 model has two fans, whereas the 5,4 model has +only one. This patch adds explicit support for the 5,3 and 5,4 models. + +Signed-off-by: Henrik Rydberg <rydberg@euromail.se> +Signed-off-by: Jean Delvare <khali@linux-fr.org> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> + +diff --git a/drivers/hwmon/applesmc.c b/drivers/hwmon/applesmc.c +index f085c18..be33094 100644 +--- a/drivers/hwmon/applesmc.c ++++ b/drivers/hwmon/applesmc.c +@@ -148,6 +148,13 @@ static const char *temperature_sensors_sets[][41] = { + /* Set 18: MacBook Pro 2,2 */ + { "TB0T", "TC0D", "TC0P", "TG0H", "TG0P", "TG0T", "TM0P", "TTF0", + "Th0H", "Th1H", "Tm0P", "Ts0P", NULL }, ++/* Set 19: Macbook Pro 5,3 */ ++ { "TB0T", "TB1T", "TB2T", "TB3T", "TC0D", "TC0F", "TC0P", "TG0D", ++ "TG0F", "TG0H", "TG0P", "TG0T", "TN0D", "TN0P", "TTF0", "Th2H", ++ "Tm0P", "Ts0P", "Ts0S", NULL }, ++/* Set 20: MacBook Pro 5,4 */ ++ { "TB0T", "TB1T", "TB2T", "TB3T", "TC0D", "TC0F", "TC0P", "TN0D", ++ "TN0P", "TTF0", "Th2H", "Ts0P", "Ts0S", NULL }, + }; + + /* List of keys used to read/write fan speeds */ +@@ -1363,6 +1370,10 @@ static __initdata struct dmi_match_data applesmc_dmi_data[] = { + { .accelerometer = 0, .light = 0, .temperature_set = 17 }, + /* MacBook Pro 2,2: accelerometer, backlight and temperature set 18 */ + { .accelerometer = 1, .light = 1, .temperature_set = 18 }, ++/* MacBook Pro 5,3: accelerometer, backlight and temperature set 19 */ ++ { .accelerometer = 1, .light = 1, .temperature_set = 19 }, ++/* MacBook Pro 5,4: accelerometer, backlight and temperature set 20 */ ++ { .accelerometer = 1, .light = 1, .temperature_set = 20 }, + }; + + /* Note that DMI_MATCH(...,"MacBook") will match "MacBookPro1,1". +@@ -1376,6 +1387,14 @@ static __initdata struct dmi_system_id applesmc_whitelist[] = { + DMI_MATCH(DMI_BOARD_VENDOR, "Apple"), + DMI_MATCH(DMI_PRODUCT_NAME, "MacBookAir") }, + &applesmc_dmi_data[7]}, ++ { applesmc_dmi_match, "Apple MacBook Pro 5,4", { ++ DMI_MATCH(DMI_BOARD_VENDOR, "Apple"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro5,4") }, ++ &applesmc_dmi_data[20]}, ++ { applesmc_dmi_match, "Apple MacBook Pro 5,3", { ++ DMI_MATCH(DMI_BOARD_VENDOR, "Apple"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro5,3") }, ++ &applesmc_dmi_data[19]}, + { applesmc_dmi_match, "Apple MacBook Pro 5", { + DMI_MATCH(DMI_BOARD_VENDOR, "Apple"), + DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro5") }, +-- +1.7.7 + diff --git a/queue/i8k-Tell-gcc-that-regs-gets-clobbered.patch b/queue/i8k-Tell-gcc-that-regs-gets-clobbered.patch new file mode 100644 index 0000000..46da277 --- /dev/null +++ b/queue/i8k-Tell-gcc-that-regs-gets-clobbered.patch @@ -0,0 +1,49 @@ +From 7337772995aa0014c918ba7721f4b7509c0d9c47 Mon Sep 17 00:00:00 2001 +From: Jim Bos <jim876@xs4all.nl> +Date: Sat, 13 Nov 2010 12:13:53 +0100 +Subject: [PATCH] i8k: Tell gcc that *regs gets clobbered + +commit 6b4e81db2552bad04100e7d5ddeed7e848f53b48 upstream. + +More recent GCC caused the i8k driver to stop working, on Slackware +compiler was upgraded from gcc-4.4.4 to gcc-4.5.1 after which it didn't +work anymore, meaning the driver didn't load or gave total nonsensical +output. + +As it turned out the asm(..) statement forgot to mention it modifies the +*regs variable. + +Credits to Andi Kleen and Andreas Schwab for providing the fix. + +Signed-off-by: Jim Bos <jim876@xs4all.nl> +Cc: Andi Kleen <andi@firstfloor.org> +Cc: Andreas Schwab <schwab@linux-m68k.org> +Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> + +diff --git a/drivers/char/i8k.c b/drivers/char/i8k.c +index fc8cf7a..828fd24 100644 +--- a/drivers/char/i8k.c ++++ b/drivers/char/i8k.c +@@ -141,7 +141,7 @@ static int i8k_smm(struct smm_regs *regs) + "lahf\n\t" + "shrl $8,%%eax\n\t" + "andl $1,%%eax\n" +- :"=a"(rc) ++ :"=a"(rc), "+m" (*regs) + : "a"(regs) + : "%ebx", "%ecx", "%edx", "%esi", "%edi", "memory"); + #else +@@ -166,7 +166,8 @@ static int i8k_smm(struct smm_regs *regs) + "movl %%edx,0(%%eax)\n\t" + "lahf\n\t" + "shrl $8,%%eax\n\t" +- "andl $1,%%eax\n":"=a"(rc) ++ "andl $1,%%eax\n" ++ :"=a"(rc), "+m" (*regs) + : "a"(regs) + : "%ebx", "%ecx", "%edx", "%esi", "%edi", "memory"); + #endif +-- +1.7.7 + diff --git a/queue/init-sched-Fix-race-between-init-and-kthreadd.patch b/queue/init-sched-Fix-race-between-init-and-kthreadd.patch new file mode 100644 index 0000000..53adfd7 --- /dev/null +++ b/queue/init-sched-Fix-race-between-init-and-kthreadd.patch @@ -0,0 +1,68 @@ +From 8b72ec6671d9b4a1a878e4d22ed4c2050d2480cd Mon Sep 17 00:00:00 2001 +From: Peter Zijlstra <peterz@infradead.org> +Date: Mon, 28 Jun 2010 16:51:01 +0200 +Subject: [PATCH] init, sched: Fix race between init and kthreadd + +commit b433c3d4549ae74935b585115f076c6fb7bc48fe upstream. + +Ilya reported that on a very slow machine he could reliably +reproduce a race between forking init and kthreadd. We first +fork init so that it obtains pid-1, however since the scheduler +is already fully running at this point it can preempt and run +the init thread before we spawn and set kthreadd_task. + +The init thread can then attempt spawning kthreads without +kthreadd being present which results in an OOPS. + +Reported-by: Ilya Loginov <isloginov@gmail.com> +Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl> +Acked-by: Linus Torvalds <torvalds@linux-foundation.org> +LKML-Reference: <1277736661.3561.110.camel@laptop> +Signed-off-by: Ingo Molnar <mingo@elte.hu> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> + +diff --git a/init/main.c b/init/main.c +index 5c85402..df0e20b 100644 +--- a/init/main.c ++++ b/init/main.c +@@ -421,18 +421,26 @@ static void __init setup_command_line(char *command_line) + * gcc-3.4 accidentally inlines this function, so use noinline. + */ + ++static __initdata DECLARE_COMPLETION(kthreadd_done); ++ + static noinline void __init_refok rest_init(void) + __releases(kernel_lock) + { + int pid; + + rcu_scheduler_starting(); ++ /* ++ * We need to spawn init first so that it obtains pid-1, however ++ * the init task will end up wanting to create kthreads, which, if ++ * we schedule it before we create kthreadd, will OOPS. ++ */ + kernel_thread(kernel_init, NULL, CLONE_FS | CLONE_SIGHAND); + numa_default_policy(); + pid = kernel_thread(kthreadd, NULL, CLONE_FS | CLONE_FILES); + rcu_read_lock(); + kthreadd_task = find_task_by_pid_ns(pid, &init_pid_ns); + rcu_read_unlock(); ++ complete(&kthreadd_done); + unlock_kernel(); + + /* +@@ -853,6 +861,10 @@ static noinline int init_post(void) + + static int __init kernel_init(void * unused) + { ++ /* ++ * Wait until kthreadd is all set-up. ++ */ ++ wait_for_completion(&kthreadd_done); + lock_kernel(); + + /* +-- +1.7.7 + diff --git a/queue/intel-iommu-Fix-get_domain_for_dev-error-path.patch b/queue/intel-iommu-Fix-get_domain_for_dev-error-path.patch new file mode 100644 index 0000000..8d3d5da --- /dev/null +++ b/queue/intel-iommu-Fix-get_domain_for_dev-error-path.patch @@ -0,0 +1,34 @@ +From 8bffb6316d83dd3bd028dcf51bae0bcd9e60dcf9 Mon Sep 17 00:00:00 2001 +From: Alex Williamson <alex.williamson@redhat.com> +Date: Fri, 4 Mar 2011 14:52:30 -0700 +Subject: [PATCH] intel-iommu: Fix get_domain_for_dev() error path + +commit 2fe9723df8e45fd247782adea244a5e653c30bf4 upstream. + +If we run out of domain_ids and fail iommu_attach_domain(), we +fall into domain_exit() without having setup enough of the +domain structure for this to do anything useful. In fact, it +typically runs off into the weeds walking the bogus domain->devices +list. Just free the domain. + +Signed-off-by: Alex Williamson <alex.williamson@redhat.com> +Acked-by: Donald Dutile <ddutile@redhat.com> +Signed-off-by: David Woodhouse <David.Woodhouse@intel.com> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> + +diff --git a/drivers/pci/intel-iommu.c b/drivers/pci/intel-iommu.c +index 62e92e5..2b985b9 100644 +--- a/drivers/pci/intel-iommu.c ++++ b/drivers/pci/intel-iommu.c +@@ -1848,7 +1848,7 @@ static struct dmar_domain *get_domain_for_dev(struct pci_dev *pdev, int gaw) + + ret = iommu_attach_domain(domain, iommu); + if (ret) { +- domain_exit(domain); ++ free_domain_mem(domain); + goto error; + } + +-- +1.7.7 + diff --git a/queue/intel-iommu-Force-disable-IOMMU-for-iGFX-on-broken-C.patch b/queue/intel-iommu-Force-disable-IOMMU-for-iGFX-on-broken-C.patch new file mode 100644 index 0000000..230254c --- /dev/null +++ b/queue/intel-iommu-Force-disable-IOMMU-for-iGFX-on-broken-C.patch @@ -0,0 +1,50 @@ +From d5071df118b5f491f45ddd834db94a9261afa6bd Mon Sep 17 00:00:00 2001 +From: David Woodhouse <David.Woodhouse@intel.com> +Date: Tue, 15 Jun 2010 10:57:57 +0100 +Subject: [PATCH] intel-iommu: Force-disable IOMMU for iGFX on broken Cantiga + revisions. + +commit 2d9e667efdfb4e986074d98e7d9a424003c7c43b upstream. + +Certain revisions of this chipset appear to be broken. There is a shadow +GTT which mirrors the real GTT but contains pre-translated physical +addresses, for performance reasons. When a GTT update happens, the +translations are done once and the resulting physical addresses written +back to the shadow GTT. + +Except sometimes, the physical address is actually written back to the +_real_ GTT, not the shadow GTT. Thus we start to see faults when that +physical address is fed through translation again. + +Signed-off-by: David Woodhouse <David.Woodhouse@intel.com> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> + +diff --git a/drivers/pci/intel-iommu.c b/drivers/pci/intel-iommu.c +index 2b985b9..67e2f60 100644 +--- a/drivers/pci/intel-iommu.c ++++ b/drivers/pci/intel-iommu.c +@@ -383,7 +383,7 @@ int dmar_disabled = 0; + int dmar_disabled = 1; + #endif /*CONFIG_DMAR_DEFAULT_ON*/ + +-static int __initdata dmar_map_gfx = 1; ++static int dmar_map_gfx = 1; + static int dmar_forcedac; + static int intel_iommu_strict; + +@@ -3762,6 +3762,12 @@ static void __devinit quirk_iommu_rwbf(struct pci_dev *dev) + */ + printk(KERN_INFO "DMAR: Forcing write-buffer flush capability\n"); + rwbf_quirk = 1; ++ ++ /* https://bugzilla.redhat.com/show_bug.cgi?id=538163 */ ++ if (dev->revision == 0x07) { ++ printk(KERN_INFO "DMAR: Disabling IOMMU for graphics on this chipset\n"); ++ dmar_map_gfx = 0; ++ } + } + + DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x2a40, quirk_iommu_rwbf); +-- +1.7.7 + diff --git a/queue/intel-iommu-Unlink-domain-from-iommu.patch b/queue/intel-iommu-Unlink-domain-from-iommu.patch new file mode 100644 index 0000000..5f9f456 --- /dev/null +++ b/queue/intel-iommu-Unlink-domain-from-iommu.patch @@ -0,0 +1,54 @@ +From 3800138beb61d288323eeae291cf2133a25aeb83 Mon Sep 17 00:00:00 2001 +From: Alex Williamson <alex.williamson@redhat.com> +Date: Fri, 4 Mar 2011 14:52:16 -0700 +Subject: [PATCH] intel-iommu: Unlink domain from iommu + +commit a97590e56d0d58e1dd262353f7cbd84e81d8e600 upstream. + +When we remove a device, we unlink the iommu from the domain, but +we never do the reverse unlinking of the domain from the iommu. +This means that we never clear iommu->domain_ids, eventually leading +to resource exhaustion if we repeatedly bind and unbind a device +to a driver. Also free empty domains to avoid a resource leak. + +Signed-off-by: Alex Williamson <alex.williamson@redhat.com> +Acked-by: Donald Dutile <ddutile@redhat.com> +Signed-off-by: David Woodhouse <David.Woodhouse@intel.com> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> + +diff --git a/drivers/pci/intel-iommu.c b/drivers/pci/intel-iommu.c +index 3507692..62e92e5 100644 +--- a/drivers/pci/intel-iommu.c ++++ b/drivers/pci/intel-iommu.c +@@ -3261,9 +3261,15 @@ static int device_notifier(struct notifier_block *nb, + if (!domain) + return 0; + +- if (action == BUS_NOTIFY_UNBOUND_DRIVER && !iommu_pass_through) ++ if (action == BUS_NOTIFY_UNBOUND_DRIVER && !iommu_pass_through) { + domain_remove_one_dev_info(domain, pdev); + ++ if (!(domain->flags & DOMAIN_FLAG_VIRTUAL_MACHINE) && ++ !(domain->flags & DOMAIN_FLAG_STATIC_IDENTITY) && ++ list_empty(&domain->devices)) ++ domain_exit(domain); ++ } ++ + return 0; + } + +@@ -3412,6 +3418,11 @@ static void domain_remove_one_dev_info(struct dmar_domain *domain, + domain->iommu_count--; + domain_update_iommu_cap(domain); + spin_unlock_irqrestore(&domain->iommu_lock, tmp_flags); ++ ++ spin_lock_irqsave(&iommu->lock, tmp_flags); ++ clear_bit(domain->id, iommu->domain_ids); ++ iommu->domains[domain->id] = NULL; ++ spin_unlock_irqrestore(&iommu->lock, tmp_flags); + } + + spin_unlock_irqrestore(&device_domain_lock, flags); +-- +1.7.7 + diff --git a/queue/ipv6-Silence-privacy-extensions-initialization.patch b/queue/ipv6-Silence-privacy-extensions-initialization.patch new file mode 100644 index 0000000..3cca68e --- /dev/null +++ b/queue/ipv6-Silence-privacy-extensions-initialization.patch @@ -0,0 +1,41 @@ +From bc0b40b266731be60d95214c11e8cb25ff72fa5d Mon Sep 17 00:00:00 2001 +From: Romain Francoise <romain@orebokech.com> +Date: Mon, 17 Jan 2011 07:59:18 +0000 +Subject: [PATCH] ipv6: Silence privacy extensions initialization + +commit 2fdc1c8093255f9da877d7b9ce3f46c2098377dc upstream. + +When a network namespace is created (via CLONE_NEWNET), the loopback +interface is automatically added to the new namespace, triggering a +printk in ipv6_add_dev() if CONFIG_IPV6_PRIVACY is set. + +This is problematic for applications which use CLONE_NEWNET as +part of a sandbox, like Chromium's suid sandbox or recent versions of +vsftpd. On a busy machine, it can lead to thousands of useless +"lo: Disabled Privacy Extensions" messages appearing in dmesg. + +It's easy enough to check the status of privacy extensions via the +use_tempaddr sysctl, so just removing the printk seems like the most +sensible solution. + +Signed-off-by: Romain Francoise <romain@orebokech.com> +Signed-off-by: David S. Miller <davem@davemloft.net> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> + +diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c +index 844ffc5..34ad669 100644 +--- a/net/ipv6/addrconf.c ++++ b/net/ipv6/addrconf.c +@@ -408,9 +408,6 @@ static struct inet6_dev * ipv6_add_dev(struct net_device *dev) + dev->type == ARPHRD_TUNNEL6 || + dev->type == ARPHRD_SIT || + dev->type == ARPHRD_NONE) { +- printk(KERN_INFO +- "%s: Disabled Privacy Extensions\n", +- dev->name); + ndev->cnf.use_tempaddr = -1; + } else { + in6_dev_hold(ndev); +-- +1.7.7 + diff --git a/queue/iwlagn-Support-new-5000-microcode.patch b/queue/iwlagn-Support-new-5000-microcode.patch new file mode 100644 index 0000000..9b8ad35 --- /dev/null +++ b/queue/iwlagn-Support-new-5000-microcode.patch @@ -0,0 +1,29 @@ +From a6e79c3b118a82d489b16487feedb58d6251db1c Mon Sep 17 00:00:00 2001 +From: "Fry, Donald H" <donald.h.fry@intel.com> +Date: Wed, 16 Feb 2011 11:49:34 -0800 +Subject: [PATCH] iwlagn: Support new 5000 microcode. + +commit 41504cce240f791f1e16561db95728c5537fbad9 upstream. + +New iwlwifi-5000 microcode requires driver support for API version 5. + +Signed-off-by: Don Fry <donald.h.fry@intel.com> +Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> + +diff --git a/drivers/net/wireless/iwlwifi/iwl-5000.c b/drivers/net/wireless/iwlwifi/iwl-5000.c +index d05fad4..dc191b8 100644 +--- a/drivers/net/wireless/iwlwifi/iwl-5000.c ++++ b/drivers/net/wireless/iwlwifi/iwl-5000.c +@@ -48,7 +48,7 @@ + #include "iwl-6000-hw.h" + + /* Highest firmware API version supported */ +-#define IWL5000_UCODE_API_MAX 2 ++#define IWL5000_UCODE_API_MAX 5 + #define IWL5150_UCODE_API_MAX 2 + + /* Lowest firmware API version supported */ +-- +1.7.7 + diff --git a/queue/iwlwifi-fix-skb-usage-after-free.patch b/queue/iwlwifi-fix-skb-usage-after-free.patch new file mode 100644 index 0000000..077f0f8 --- /dev/null +++ b/queue/iwlwifi-fix-skb-usage-after-free.patch @@ -0,0 +1,54 @@ +From 07d9d992b9b3016dfa08fc55de2255fcd5d74d64 Mon Sep 17 00:00:00 2001 +From: Stanislaw Gruszka <sgruszka@redhat.com> +Date: Wed, 20 Apr 2011 15:57:14 +0200 +Subject: [PATCH] iwlwifi: fix skb usage after free + +commit b25026981aecde3685dd0e45ad980fff9f528daa upstream. + +Since + +commit a120e912eb51e347f36c71b60a1d13af74d30e83 +Author: Stanislaw Gruszka <sgruszka@redhat.com> +Date: Fri Feb 19 15:47:33 2010 -0800 + + iwlwifi: sanity check before counting number of tfds can be free + +we use skb->data after calling ieee80211_tx_status_irqsafe(), which +could free skb instantly. + +On current kernels I do not observe practical problems related with +bug, but on 2.6.35.y it cause random system hangs when stressing +wireless link. + +[PG: since 34, file renamed, + iwlagn_tx_status --> iwl_tx_status] + +Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com> +Acked-by: Wey-Yi Guy <wey-yi.w.guy@intel.com> +Signed-off-by: John W. Linville <linville@tuxdriver.com> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> + +diff --git a/drivers/net/wireless/iwlwifi/iwl-tx.c b/drivers/net/wireless/iwlwifi/iwl-tx.c +index e950153..92a5f9e 100644 +--- a/drivers/net/wireless/iwlwifi/iwl-tx.c ++++ b/drivers/net/wireless/iwlwifi/iwl-tx.c +@@ -1234,11 +1234,15 @@ int iwl_tx_queue_reclaim(struct iwl_priv *priv, int txq_id, int index) + q->read_ptr = iwl_queue_inc_wrap(q->read_ptr, q->n_bd)) { + + tx_info = &txq->txb[txq->q.read_ptr]; +- iwl_tx_status(priv, tx_info->skb[0]); ++ ++ if (WARN_ON_ONCE(tx_info->skb == NULL)) ++ continue; + + hdr = (struct ieee80211_hdr *)tx_info->skb[0]->data; +- if (hdr && ieee80211_is_data_qos(hdr->frame_control)) ++ if (ieee80211_is_data_qos(hdr->frame_control)) + nfreed++; ++ ++ iwl_tx_status(priv, tx_info->skb[0]); + tx_info->skb[0] = NULL; + + if (priv->cfg->ops->lib->txq_inval_byte_cnt_tbl) +-- +1.7.7 + diff --git a/queue/kconfig-Avoid-buffer-underrun-in-choice-input.patch b/queue/kconfig-Avoid-buffer-underrun-in-choice-input.patch new file mode 100644 index 0000000..eadfa93 --- /dev/null +++ b/queue/kconfig-Avoid-buffer-underrun-in-choice-input.patch @@ -0,0 +1,37 @@ +From 2164b24b2b0ab606f1518fc89c4731b0bf5819bc Mon Sep 17 00:00:00 2001 +From: Ben Hutchings <ben@decadent.org.uk> +Date: Sat, 23 Apr 2011 18:42:56 +0100 +Subject: [PATCH] kconfig: Avoid buffer underrun in choice input + +commit 3ba41621156681afcdbcd624e3191cbc65eb94f4 upstream. + +Commit 40aee729b350 ('kconfig: fix default value for choice input') +fixed some cases where kconfig would select the wrong option from a +choice with a single valid option and thus enter an infinite loop. + +However, this broke the test for user input of the form 'N?', because +when kconfig selects the single valid option the input is zero-length +and the test will read the byte before the input buffer. If this +happens to contain '?' (as it will in a mips build on Debian unstable +today) then kconfig again enters an infinite loop. + +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> + +diff --git a/scripts/kconfig/conf.c b/scripts/kconfig/conf.c +index 9960d1c..7f97e3f 100644 +--- a/scripts/kconfig/conf.c ++++ b/scripts/kconfig/conf.c +@@ -330,7 +330,7 @@ static int conf_choice(struct menu *menu) + } + if (!child) + continue; +- if (line[strlen(line) - 1] == '?') { ++ if (line[0] && line[strlen(line) - 1] == '?') { + print_help(child); + continue; + } +-- +1.7.7 + diff --git a/queue/libata-set-queue-DMA-alignment-to-sector-size-for-AT.patch b/queue/libata-set-queue-DMA-alignment-to-sector-size-for-AT.patch new file mode 100644 index 0000000..6e4b2d4 --- /dev/null +++ b/queue/libata-set-queue-DMA-alignment-to-sector-size-for-AT.patch @@ -0,0 +1,78 @@ +From 93972f790de561d0d9a021a2b57f8da0d7f8e887 Mon Sep 17 00:00:00 2001 +From: Tejun Heo <htejun@gmail.com> +Date: Thu, 20 Jan 2011 13:59:06 +0100 +Subject: [PATCH] libata: set queue DMA alignment to sector size for ATAPI too + +commit 729a6a300e628a48cf12bac93a964a535e83cd1d upstream. + +ata_pio_sectors() expects buffer for each sector to be contained in a +single page; otherwise, it ends up overrunning the first page. This +is achieved by setting queue DMA alignment. If sector_size is smaller +than PAGE_SIZE and all buffers are sector_size aligned, buffer for +each sector is always contained in a single page. + +This wasn't applied to ATAPI devices but IDENTIFY_PACKET is executed +as ATA_PROT_PIO and thus uses ata_pio_sectors(). Newer versions of +udev issue IDENTIFY_PACKET with unaligned buffer triggering the +problem and causing oops. + +This patch fixes the problem by setting sdev->sector_size to +ATA_SECT_SIZE on ATATPI devices and always setting DMA alignment to +sector_size. While at it, add a warning for the unlikely but still +possible scenario where sector_size is larger than PAGE_SIZE, in which +case the alignment wouldn't be enough. + +Signed-off-by: Tejun Heo <tj@kernel.org> +Reported-by: John Stanley <jpsinthemix@verizon.net> +Tested-by: John Stanley <jpsinthemix@verizon.net> +Signed-off-by: Jeff Garzik <jgarzik@redhat.com> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> + +diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c +index 1d266e2..0dfa468 100644 +--- a/drivers/ata/libata-scsi.c ++++ b/drivers/ata/libata-scsi.c +@@ -1104,9 +1104,9 @@ static int ata_scsi_dev_config(struct scsi_device *sdev, + struct request_queue *q = sdev->request_queue; + void *buf; + +- /* set the min alignment and padding */ +- blk_queue_update_dma_alignment(sdev->request_queue, +- ATA_DMA_PAD_SZ - 1); ++ sdev->sector_size = ATA_SECT_SIZE; ++ ++ /* set DMA padding */ + blk_queue_update_dma_pad(sdev->request_queue, + ATA_DMA_PAD_SZ - 1); + +@@ -1120,12 +1120,24 @@ static int ata_scsi_dev_config(struct scsi_device *sdev, + + blk_queue_dma_drain(q, atapi_drain_needed, buf, ATAPI_MAX_DRAIN); + } else { +- /* ATA devices must be sector aligned */ +- blk_queue_update_dma_alignment(sdev->request_queue, +- ATA_SECT_SIZE - 1); + sdev->manage_start_stop = 1; + } + ++ /* ++ * ata_pio_sectors() expects buffer for each sector to not cross ++ * page boundary. Enforce it by requiring buffers to be sector ++ * aligned, which works iff sector_size is not larger than ++ * PAGE_SIZE. ATAPI devices also need the alignment as ++ * IDENTIFY_PACKET is executed as ATA_PROT_PIO. ++ */ ++ if (sdev->sector_size > PAGE_SIZE) ++ ata_dev_printk(dev, KERN_WARNING, ++ "sector_size=%u > PAGE_SIZE, PIO may malfunction\n", ++ sdev->sector_size); ++ ++ blk_queue_update_dma_alignment(sdev->request_queue, ++ ATA_SECT_SIZE - 1); ++ + if (dev->flags & ATA_DFLAG_AN) + set_bit(SDEV_EVT_MEDIA_CHANGE, sdev->supported_events); + +-- +1.7.7 + diff --git a/queue/m68k-mm-Set-all-online-nodes-in-N_NORMAL_MEMORY.patch b/queue/m68k-mm-Set-all-online-nodes-in-N_NORMAL_MEMORY.patch new file mode 100644 index 0000000..49c3f85 --- /dev/null +++ b/queue/m68k-mm-Set-all-online-nodes-in-N_NORMAL_MEMORY.patch @@ -0,0 +1,42 @@ +From 5de8068af49d717d994fd5995c63ca4b47b6e19a Mon Sep 17 00:00:00 2001 +From: Michael Schmitz <schmitzmic@googlemail.com> +Date: Tue, 26 Apr 2011 14:51:53 +1200 +Subject: [PATCH] m68k/mm: Set all online nodes in N_NORMAL_MEMORY + +commit 4aac0b4815ba592052758f4b468f253d383dc9d6 upstream. + +For m68k, N_NORMAL_MEMORY represents all nodes that have present memory +since it does not support HIGHMEM. This patch sets the bit at the time +node_present_pages has been set by free_area_init_node. +At the time the node is brought online, the node state would have to be +done unconditionally since information about present memory has not yet +been recorded. + +If N_NORMAL_MEMORY is not accurate, slub may encounter errors since it +uses this nodemask to setup per-cache kmem_cache_node data structures. + +This pach is an alternative to the one proposed by David Rientjes +<rientjes@google.com> attempting to set node state immediately when +bringing the node online. + +Signed-off-by: Michael Schmitz <schmitz@debian.org> +Tested-by: Thorsten Glaser <tg@debian.org> +Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> + +diff --git a/arch/m68k/mm/motorola.c b/arch/m68k/mm/motorola.c +index 02b7a03..8b3db1c 100644 +--- a/arch/m68k/mm/motorola.c ++++ b/arch/m68k/mm/motorola.c +@@ -300,6 +300,8 @@ void __init paging_init(void) + zones_size[ZONE_DMA] = m68k_memory[i].size >> PAGE_SHIFT; + free_area_init_node(i, zones_size, + m68k_memory[i].addr >> PAGE_SHIFT, NULL); ++ if (node_present_pages(i)) ++ node_set_state(i, N_NORMAL_MEMORY); + } + } + +-- +1.7.7 + diff --git a/queue/mmc-build-fix-mmc_pm_notify-is-only-available-with-C.patch b/queue/mmc-build-fix-mmc_pm_notify-is-only-available-with-C.patch new file mode 100644 index 0000000..08a130f --- /dev/null +++ b/queue/mmc-build-fix-mmc_pm_notify-is-only-available-with-C.patch @@ -0,0 +1,42 @@ +From babc8bedb7e498d72210b0a71a88e5babc5ebdba Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Uwe=20Kleine-K=C3=B6nig?= <u.kleine-koenig@pengutronix.de> +Date: Wed, 18 Aug 2010 09:25:38 -0700 +Subject: [PATCH] mmc: build fix: mmc_pm_notify is only available with + CONFIG_PM=y +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +commit 81ca03a0e2ea0207b2df80e0edcf4c775c07a505 upstream. + +This fixes a build breakage introduced by commit 4c2ef25fe0b8 ("mmc: fix +all hangs related to mmc/sd card insert/removal during suspend/resume") + +Cc: David Brownell <david-b@pacbell.net> +Cc: Alan Stern <stern@rowland.harvard.edu> +Cc: linux-mmc@vger.kernel.org +Cc: Andrew Morton <akpm@linux-foundation.org> +Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de> +Acked-by: Kukjin Kim <kgene.kim@samsung.com> +Acked-by: Maxim Levitsky <maximlevitsky@gmail.com> +Acked-by: Randy Dunlap <randy.dunlap@oracle.com> +Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> + +diff --git a/drivers/mmc/core/host.c b/drivers/mmc/core/host.c +index 0efe631..d80cfdc 100644 +--- a/drivers/mmc/core/host.c ++++ b/drivers/mmc/core/host.c +@@ -86,7 +86,9 @@ struct mmc_host *mmc_alloc_host(int extra, struct device *dev) + init_waitqueue_head(&host->wq); + INIT_DELAYED_WORK(&host->detect, mmc_rescan); + INIT_DELAYED_WORK_DEFERRABLE(&host->disable, mmc_host_deeper_disable); ++#ifdef CONFIG_PM + host->pm_notify.notifier_call = mmc_pm_notify; ++#endif + + /* + * By default, hosts do not support SGIO or large requests. +-- +1.7.7 + diff --git a/queue/mmc-fix-all-hangs-related-to-mmc-sd-card-insert-remo.patch b/queue/mmc-fix-all-hangs-related-to-mmc-sd-card-insert-remo.patch new file mode 100644 index 0000000..265fb37 --- /dev/null +++ b/queue/mmc-fix-all-hangs-related-to-mmc-sd-card-insert-remo.patch @@ -0,0 +1,219 @@ +From 45aea6d934c78d6ff0515e4a8972f65b805ca660 Mon Sep 17 00:00:00 2001 +From: Maxim Levitsky <maximlevitsky@gmail.com> +Date: Tue, 10 Aug 2010 18:01:41 -0700 +Subject: [PATCH] mmc: fix all hangs related to mmc/sd card insert/removal + during suspend/resume + +commit 4c2ef25fe0b847d2ae818f74758ddb0be1c27d8e upstream. + +If you don't use CONFIG_MMC_UNSAFE_RESUME, as soon as you attempt to +suspend, the card will be removed, therefore this patch doesn't change the +behavior of this option. + +However the removal will be done by pm notifier, which runs while +userspace is still not frozen and thus can freely use del_gendisk, without +the risk of deadlock which would happen otherwise. + +Card detect workqueue is now disabled while userspace is frozen, Therefore +if you do use CONFIG_MMC_UNSAFE_RESUME, and remove the card during +suspend, the removal will be detected as soon as userspace is unfrozen, +again at the moment it is safe to call del_gendisk. + +Tested with and without CONFIG_MMC_UNSAFE_RESUME with suspend and hibernate. + +[akpm@linux-foundation.org: clean up function prototype] +[akpm@linux-foundation.org: fix CONFIG_PM-n linkage, small cleanups] +[akpm@linux-foundation.org: coding-style fixes] +Signed-off-by: Maxim Levitsky <maximlevitsky@gmail.com> +Cc: David Brownell <david-b@pacbell.net> +Cc: Alan Stern <stern@rowland.harvard.edu> +Cc: <linux-mmc@vger.kernel.org> +Signed-off-by: Andrew Morton <akpm@linux-foundation.org> +Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> + +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> + +diff --git a/drivers/mmc/core/core.c b/drivers/mmc/core/core.c +index 3168ebd..3e22f98 100644 +--- a/drivers/mmc/core/core.c ++++ b/drivers/mmc/core/core.c +@@ -1057,6 +1057,17 @@ void mmc_rescan(struct work_struct *work) + container_of(work, struct mmc_host, detect.work); + u32 ocr; + int err; ++ unsigned long flags; ++ ++ spin_lock_irqsave(&host->lock, flags); ++ ++ if (host->rescan_disable) { ++ spin_unlock_irqrestore(&host->lock, flags); ++ return; ++ } ++ ++ spin_unlock_irqrestore(&host->lock, flags); ++ + + mmc_bus_get(host); + +@@ -1267,19 +1278,6 @@ int mmc_suspend_host(struct mmc_host *host, pm_message_t state) + if (host->bus_ops && !host->bus_dead) { + if (host->bus_ops->suspend) + err = host->bus_ops->suspend(host); +- if (err == -ENOSYS || !host->bus_ops->resume) { +- /* +- * We simply "remove" the card in this case. +- * It will be redetected on resume. +- */ +- if (host->bus_ops->remove) +- host->bus_ops->remove(host); +- mmc_claim_host(host); +- mmc_detach_bus(host); +- mmc_release_host(host); +- host->pm_flags = 0; +- err = 0; +- } + } + mmc_bus_put(host); + +@@ -1311,28 +1309,61 @@ int mmc_resume_host(struct mmc_host *host) + printk(KERN_WARNING "%s: error %d during resume " + "(card was removed?)\n", + mmc_hostname(host), err); +- if (host->bus_ops->remove) +- host->bus_ops->remove(host); +- mmc_claim_host(host); +- mmc_detach_bus(host); +- mmc_release_host(host); +- /* no need to bother upper layers */ + err = 0; + } + } + mmc_bus_put(host); + +- /* +- * We add a slight delay here so that resume can progress +- * in parallel. +- */ +- mmc_detect_change(host, 1); +- + return err; + } +- + EXPORT_SYMBOL(mmc_resume_host); + ++/* Do the card removal on suspend if card is assumed removeable ++ * Do that in pm notifier while userspace isn't yet frozen, so we will be able ++ to sync the card. ++*/ ++int mmc_pm_notify(struct notifier_block *notify_block, ++ unsigned long mode, void *unused) ++{ ++ struct mmc_host *host = container_of( ++ notify_block, struct mmc_host, pm_notify); ++ unsigned long flags; ++ ++ ++ switch (mode) { ++ case PM_HIBERNATION_PREPARE: ++ case PM_SUSPEND_PREPARE: ++ ++ spin_lock_irqsave(&host->lock, flags); ++ host->rescan_disable = 1; ++ spin_unlock_irqrestore(&host->lock, flags); ++ cancel_delayed_work_sync(&host->detect); ++ ++ if (!host->bus_ops || host->bus_ops->suspend) ++ break; ++ ++ mmc_claim_host(host); ++ ++ if (host->bus_ops->remove) ++ host->bus_ops->remove(host); ++ ++ mmc_detach_bus(host); ++ mmc_release_host(host); ++ host->pm_flags = 0; ++ break; ++ ++ case PM_POST_SUSPEND: ++ case PM_POST_HIBERNATION: ++ ++ spin_lock_irqsave(&host->lock, flags); ++ host->rescan_disable = 0; ++ spin_unlock_irqrestore(&host->lock, flags); ++ mmc_detect_change(host, 0); ++ ++ } ++ ++ return 0; ++} + #endif + + static int __init mmc_init(void) +diff --git a/drivers/mmc/core/host.c b/drivers/mmc/core/host.c +index 4735390..0efe631 100644 +--- a/drivers/mmc/core/host.c ++++ b/drivers/mmc/core/host.c +@@ -17,6 +17,7 @@ + #include <linux/pagemap.h> + #include <linux/leds.h> + #include <linux/slab.h> ++#include <linux/suspend.h> + + #include <linux/mmc/host.h> + +@@ -85,6 +86,7 @@ struct mmc_host *mmc_alloc_host(int extra, struct device *dev) + init_waitqueue_head(&host->wq); + INIT_DELAYED_WORK(&host->detect, mmc_rescan); + INIT_DELAYED_WORK_DEFERRABLE(&host->disable, mmc_host_deeper_disable); ++ host->pm_notify.notifier_call = mmc_pm_notify; + + /* + * By default, hosts do not support SGIO or large requests. +@@ -133,6 +135,7 @@ int mmc_add_host(struct mmc_host *host) + #endif + + mmc_start_host(host); ++ register_pm_notifier(&host->pm_notify); + + return 0; + } +@@ -149,6 +152,7 @@ EXPORT_SYMBOL(mmc_add_host); + */ + void mmc_remove_host(struct mmc_host *host) + { ++ unregister_pm_notifier(&host->pm_notify); + mmc_stop_host(host); + + #ifdef CONFIG_DEBUG_FS +diff --git a/include/linux/mmc/host.h b/include/linux/mmc/host.h +index 43eaf5c..18d9eb3 100644 +--- a/include/linux/mmc/host.h ++++ b/include/linux/mmc/host.h +@@ -121,6 +121,7 @@ struct mmc_host { + unsigned int f_min; + unsigned int f_max; + u32 ocr_avail; ++ struct notifier_block pm_notify; + + #define MMC_VDD_165_195 0x00000080 /* VDD voltage 1.65 - 1.95 */ + #define MMC_VDD_20_21 0x00000100 /* VDD voltage 2.0 ~ 2.1 */ +@@ -180,6 +181,7 @@ struct mmc_host { + + /* Only used with MMC_CAP_DISABLE */ + int enabled; /* host is enabled */ ++ int rescan_disable; /* disable card detection */ + int nesting_cnt; /* "enable" nesting count */ + int en_dis_recurs; /* detect recursion */ + unsigned int disable_delay; /* disable delay in msecs */ +@@ -254,6 +256,7 @@ int mmc_card_can_sleep(struct mmc_host *host); + int mmc_host_enable(struct mmc_host *host); + int mmc_host_disable(struct mmc_host *host); + int mmc_host_lazy_disable(struct mmc_host *host); ++int mmc_pm_notify(struct notifier_block *notify_block, unsigned long, void *); + + static inline void mmc_set_disable_delay(struct mmc_host *host, + unsigned int disable_delay) +-- +1.7.7 + diff --git a/queue/mmc-sdhci-Check-mrq-NULL-in-sdhci_tasklet_finish.patch b/queue/mmc-sdhci-Check-mrq-NULL-in-sdhci_tasklet_finish.patch new file mode 100644 index 0000000..0d14933 --- /dev/null +++ b/queue/mmc-sdhci-Check-mrq-NULL-in-sdhci_tasklet_finish.patch @@ -0,0 +1,38 @@ +From 1d48585baaf6bce48194d0a6176c4e57770067d1 Mon Sep 17 00:00:00 2001 +From: Chris Ball <cjb@laptop.org> +Date: Wed, 27 Apr 2011 17:35:31 -0400 +Subject: [PATCH] mmc: sdhci: Check mrq != NULL in sdhci_tasklet_finish + +commit 0c9c99a765321104cc5f9c97f949382a9ba4927e upstream. + +It seems that under certain circumstances the sdhci_tasklet_finish() +call can be entered with mrq set to NULL, causing the system to crash +with a NULL pointer de-reference. + +Seen on S3C6410 system. Based on a patch by Dimitris Papastamos. + +Reported-by: Dimitris Papastamos <dp@opensource.wolfsonmicro.com> +Signed-off-by: Chris Ball <cjb@laptop.org> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> + +diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c +index 6441e22..be410d7 100644 +--- a/drivers/mmc/host/sdhci.c ++++ b/drivers/mmc/host/sdhci.c +@@ -1268,6 +1268,13 @@ static void sdhci_tasklet_finish(unsigned long param) + + host = (struct sdhci_host*)param; + ++ /* ++ * If this tasklet gets rescheduled while running, it will ++ * be run again afterwards but without any active request. ++ */ ++ if (!host->mrq) ++ return; ++ + spin_lock_irqsave(&host->lock, flags); + + del_timer(&host->timer); +-- +1.7.7 + diff --git a/queue/mmc-sdhci-Check-mrq-cmd-in-sdhci_tasklet_finish.patch b/queue/mmc-sdhci-Check-mrq-cmd-in-sdhci_tasklet_finish.patch new file mode 100644 index 0000000..52cb1ae --- /dev/null +++ b/queue/mmc-sdhci-Check-mrq-cmd-in-sdhci_tasklet_finish.patch @@ -0,0 +1,38 @@ +From ae609603f6e27d48050baff078d07a5254317ac1 Mon Sep 17 00:00:00 2001 +From: Ben Dooks <ben-linux@fluff.org> +Date: Wed, 27 Apr 2011 14:24:19 +0100 +Subject: [PATCH] mmc: sdhci: Check mrq->cmd in sdhci_tasklet_finish + +commit b7b4d3426d2b5ecab21578eb20d8e456a1aace8f upstream. + +It seems that under certain circumstances that the sdhci_tasklet_finish() +call can be entered with mrq->cmd set to NULL, causing the system to crash +with a NULL pointer de-reference. + +Unable to handle kernel NULL pointer dereference at virtual address 00000000 +PC is at sdhci_tasklet_finish+0x34/0xe8 +LR is at sdhci_tasklet_finish+0x24/0xe8 + +Seen on S3C6410 system. + +Signed-off-by: Ben Dooks <ben-linux@fluff.org> +Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com> +Signed-off-by: Chris Ball <cjb@laptop.org> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> + +diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c +index 9d4fdfa..6441e22 100644 +--- a/drivers/mmc/host/sdhci.c ++++ b/drivers/mmc/host/sdhci.c +@@ -1279,7 +1279,7 @@ static void sdhci_tasklet_finish(unsigned long param) + * upon error conditions. + */ + if (!(host->flags & SDHCI_DEVICE_DEAD) && +- (mrq->cmd->error || ++ ((mrq->cmd && mrq->cmd->error) || + (mrq->data && (mrq->data->error || + (mrq->data->stop && mrq->data->stop->error))) || + (host->quirks & SDHCI_QUIRK_RESET_AFTER_REQUEST))) { +-- +1.7.7 + diff --git a/queue/mmc-sdhci-pci-Fix-error-case-in-sdhci_pci_probe_slot.patch b/queue/mmc-sdhci-pci-Fix-error-case-in-sdhci_pci_probe_slot.patch new file mode 100644 index 0000000..5b4a9cd --- /dev/null +++ b/queue/mmc-sdhci-pci-Fix-error-case-in-sdhci_pci_probe_slot.patch @@ -0,0 +1,34 @@ +From f4b7c21edbc0b350425c8d1a99c7d6c372e3b29c Mon Sep 17 00:00:00 2001 +From: Chris Ball <cjb@laptop.org> +Date: Tue, 29 Mar 2011 00:46:12 -0400 +Subject: [PATCH] mmc: sdhci-pci: Fix error case in sdhci_pci_probe_slot() + +commit 9fdcdbb0d84922e7ccda2f717a04ea62629f7e18 upstream. + +If pci_ioremap_bar() fails during probe, we "goto release;" and free the +host, but then we return 0 -- which tells sdhci_pci_probe() that the probe +succeeded. Since we think the probe succeeded, when we unload sdhci we'll +go to sdhci_pci_remove_slot() and it will try to dereference slot->host, +which is now NULL because we freed it in the error path earlier. + +The patch simply sets ret appropriately, so that sdhci_pci_probe() will +detect the failure immediately and bail out. + +Signed-off-by: Chris Ball <cjb@laptop.org> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> + +diff --git a/drivers/mmc/host/sdhci-pci.c b/drivers/mmc/host/sdhci-pci.c +index 6701af6..e907447 100644 +--- a/drivers/mmc/host/sdhci-pci.c ++++ b/drivers/mmc/host/sdhci-pci.c +@@ -653,6 +653,7 @@ static struct sdhci_pci_slot * __devinit sdhci_pci_probe_slot( + host->ioaddr = pci_ioremap_bar(pdev, bar); + if (!host->ioaddr) { + dev_err(&pdev->dev, "failed to remap registers\n"); ++ ret = -ENOMEM; + goto release; + } + +-- +1.7.7 + diff --git a/queue/mpt2sas-fix-the-incorrect-scsi_dma_map-error-checkin.patch b/queue/mpt2sas-fix-the-incorrect-scsi_dma_map-error-checkin.patch new file mode 100644 index 0000000..c130943 --- /dev/null +++ b/queue/mpt2sas-fix-the-incorrect-scsi_dma_map-error-checkin.patch @@ -0,0 +1,48 @@ +From 60d35f72578854c321cca1250e89d37710ff401f Mon Sep 17 00:00:00 2001 +From: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp> +Date: Tue, 9 Mar 2010 11:09:50 +0900 +Subject: [PATCH] mpt2sas: fix the incorrect scsi_dma_map error checking + +commit bb789d01620e5d36081b22edb6fb71cf55ff043c upstream. + +scsi_dma_map() returns -1 if an error occurred (zero means that the +command has no data). So the following current code can't catch an +error: + +sges_left = scsi_dma_map(scmd); +if (!sges_left) { + sdev_printk(KERN_ERR, scmd->device, "pci_map_sg" + " failed: request for %d bytes!\n", scsi_bufflen(scmd)); + return -ENOMEM; +} + +Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp> +Acked-by: "Desai, Kashyap" <Kashyap.Desai@lsi.com> +Signed-off-by: James Bottomley <James.Bottomley@suse.de> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> + +diff --git a/drivers/scsi/mpt2sas/mpt2sas_scsih.c b/drivers/scsi/mpt2sas/mpt2sas_scsih.c +index 87cf0d2..8d98f09 100644 +--- a/drivers/scsi/mpt2sas/mpt2sas_scsih.c ++++ b/drivers/scsi/mpt2sas/mpt2sas_scsih.c +@@ -988,7 +988,7 @@ _scsih_build_scatter_gather(struct MPT2SAS_ADAPTER *ioc, + u32 chain_offset; + u32 chain_length; + u32 chain_flags; +- u32 sges_left; ++ int sges_left; + u32 sges_in_segment; + u32 sgl_flags; + u32 sgl_flags_last_element; +@@ -1009,7 +1009,7 @@ _scsih_build_scatter_gather(struct MPT2SAS_ADAPTER *ioc, + + sg_scmd = scsi_sglist(scmd); + sges_left = scsi_dma_map(scmd); +- if (!sges_left) { ++ if (sges_left < 0) { + sdev_printk(KERN_ERR, scmd->device, "pci_map_sg" + " failed: request for %d bytes!\n", scsi_bufflen(scmd)); + return -ENOMEM; +-- +1.7.7 + diff --git a/queue/nfs-don-t-lose-MS_SYNCHRONOUS-on-remount-of-noac-mou.patch b/queue/nfs-don-t-lose-MS_SYNCHRONOUS-on-remount-of-noac-mou.patch new file mode 100644 index 0000000..053f03f --- /dev/null +++ b/queue/nfs-don-t-lose-MS_SYNCHRONOUS-on-remount-of-noac-mou.patch @@ -0,0 +1,43 @@ +From 5f6dbc1c4a33622faebdda9e9f320046c476b8e2 Mon Sep 17 00:00:00 2001 +From: Jeff Layton <jlayton@redhat.com> +Date: Wed, 27 Apr 2011 11:49:09 -0400 +Subject: [PATCH] nfs: don't lose MS_SYNCHRONOUS on remount of noac mount + +commit 26c4c170731f00008f4317a2888a0a07ac99d90d upstream. + +On a remount, the VFS layer will clear the MS_SYNCHRONOUS bit on the +assumption that the flags on the mount syscall will have it set if the +remounted fs is supposed to keep it. + +In the case of "noac" though, MS_SYNCHRONOUS is implied. A remount of +such a mount will lose the MS_SYNCHRONOUS flag since "sync" isn't part +of the mount options. + +Reported-by: Max Matveev <makc@redhat.com> +Signed-off-by: Jeff Layton <jlayton@redhat.com> +Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> + +diff --git a/fs/nfs/super.c b/fs/nfs/super.c +index ae570b0..85958a1 100644 +--- a/fs/nfs/super.c ++++ b/fs/nfs/super.c +@@ -1989,6 +1989,15 @@ nfs_remount(struct super_block *sb, int *flags, char *raw_data) + if (error < 0) + goto out; + ++ /* ++ * noac is a special case. It implies -o sync, but that's not ++ * necessarily reflected in the mtab options. do_remount_sb ++ * will clear MS_SYNCHRONOUS if -o sync wasn't specified in the ++ * remount options, so we have to explicitly reset it. ++ */ ++ if (data->flags & NFS_MOUNT_NOAC) ++ *flags |= MS_SYNCHRONOUS; ++ + /* compare new mount options with old ones */ + error = nfs_compare_remount_data(nfss, data); + out: +-- +1.7.7 + diff --git a/queue/nfs-fix-compilation-warning.patch b/queue/nfs-fix-compilation-warning.patch new file mode 100644 index 0000000..629d9cc --- /dev/null +++ b/queue/nfs-fix-compilation-warning.patch @@ -0,0 +1,30 @@ +From 32b491c0102feeebcf55fc4022d78060d4aa7041 Mon Sep 17 00:00:00 2001 +From: Jovi Zhang <bookjovi@gmail.com> +Date: Wed, 2 Mar 2011 23:19:37 +0000 +Subject: [PATCH] nfs: fix compilation warning + +commit 43b7c3f051dea504afccc39bcb56d8e26c2e0b77 upstream. + +this commit fix compilation warning as following: +linux-2.6/fs/nfs/nfs4proc.c:3265: warning: comparison of distinct pointer types lacks a cast + +Signed-off-by: Jovi Zhang <bookjovi@gmail.com> +Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> + +diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c +index 5b33856..8dd3309 100644 +--- a/fs/nfs/nfs4proc.c ++++ b/fs/nfs/nfs4proc.c +@@ -3251,7 +3251,7 @@ static int buf_to_pages_noslab(const void *buf, size_t buflen, + spages = pages; + + do { +- len = min(PAGE_CACHE_SIZE, buflen); ++ len = min_t(size_t, PAGE_CACHE_SIZE, buflen); + newpage = alloc_page(GFP_KERNEL); + + if (newpage == NULL) +-- +1.7.7 + diff --git a/queue/p54-Initialize-extra_len-in-p54_tx_80211.patch b/queue/p54-Initialize-extra_len-in-p54_tx_80211.patch new file mode 100644 index 0000000..41b7113 --- /dev/null +++ b/queue/p54-Initialize-extra_len-in-p54_tx_80211.patch @@ -0,0 +1,42 @@ +From 2c2ce60117990b1fcb7d77f35d9c3d822d972994 Mon Sep 17 00:00:00 2001 +From: Jason Conti <jason.conti@gmail.com> +Date: Thu, 7 Apr 2011 21:09:57 +0200 +Subject: [PATCH] p54: Initialize extra_len in p54_tx_80211 + +commit a6756da9eace8b4af73e9dea43f1fc2889224c94 upstream. + +This patch fixes a very serious off-by-one bug in +the driver, which could leave the device in an +unresponsive state. + +The problem was that the extra_len variable [used to +reserve extra scratch buffer space for the firmware] +was left uninitialized. Because p54_assign_address +later needs the value to reserve additional space, +the resulting frame could be to big for the small +device's memory window and everything would +immediately come to a grinding halt. + +Reference: https://bugs.launchpad.net/bugs/722185 + +Acked-by: Christian Lamparter <chunkeey@googlemail.com> +Signed-off-by: Jason Conti <jason.conti@gmail.com> +Signed-off-by: John W. Linville <linville@tuxdriver.com> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> + +diff --git a/drivers/net/wireless/p54/txrx.c b/drivers/net/wireless/p54/txrx.c +index db89d65..8db2132 100644 +--- a/drivers/net/wireless/p54/txrx.c ++++ b/drivers/net/wireless/p54/txrx.c +@@ -703,7 +703,7 @@ int p54_tx_80211(struct ieee80211_hw *dev, struct sk_buff *skb) + struct p54_tx_info *p54info; + struct p54_hdr *hdr; + struct p54_tx_data *txhdr; +- unsigned int padding, len, extra_len; ++ unsigned int padding, len, extra_len = 0; + int i, j, ridx; + u16 hdr_flags = 0, aid = 0; + u8 rate, queue = 0, crypt_offset = 0; +-- +1.7.7 + diff --git a/queue/perf-symbols-allow-forcing-use-of-cplus_demangle.patch b/queue/perf-symbols-allow-forcing-use-of-cplus_demangle.patch new file mode 100644 index 0000000..e6aabe7 --- /dev/null +++ b/queue/perf-symbols-allow-forcing-use-of-cplus_demangle.patch @@ -0,0 +1,37 @@ +From e0a06eb2629cd91d9b6b28d40dede5394cce497b Mon Sep 17 00:00:00 2001 +From: Kyle McMartin <kyle@mcmartin.ca> +Date: Mon, 10 May 2010 16:43:35 -0400 +Subject: [PATCH] perf symbols: allow forcing use of cplus_demangle + +commit d11c7addfe0fa501cb54c824c0fac3481d527433 upstream. + +For Fedora, I want to force perf to link against libiberty.a for +cplus_demangle, rather than libbfd.a for bfd_demangle due to licensing insanity +on binutils. (libiberty is LGPL2, libbfd is GPL3.) + +If we just rely on autodetection, we'll end up with libbfd linked against us, +since they're both in binutils-static in the buildroot. + +Cc: Ingo Molnar <mingo@elte.hu> +LKML-Reference: <20100510204335.GA7565@bombadil.infradead.org> +Signed-off-by: Kyle McMartin <kyle@redhat.com> +Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> + +diff --git a/tools/perf/Makefile b/tools/perf/Makefile +index bc0f670..429bace 100644 +--- a/tools/perf/Makefile ++++ b/tools/perf/Makefile +@@ -541,6 +541,9 @@ endif + + ifdef NO_DEMANGLE + BASIC_CFLAGS += -DNO_DEMANGLE ++else ifdef HAVE_CPLUS_DEMANGLE ++ EXTLIBS += -liberty ++ BASIC_CFLAGS += -DHAVE_CPLUS_DEMANGLE + else + has_bfd := $(shell sh -c "(echo '\#include <bfd.h>'; echo 'int main(void) { bfd_demangle(0, 0, 0); return 0; }') | $(CC) -x c - $(ALL_CFLAGS) -o $(BITBUCKET) $(ALL_LDFLAGS) $(EXTLIBS) -lbfd "$(QUIET_STDERR)" && echo y") + +-- +1.7.7 + diff --git a/queue/pmcraid-reject-negative-request-size.patch b/queue/pmcraid-reject-negative-request-size.patch new file mode 100644 index 0000000..91c9830 --- /dev/null +++ b/queue/pmcraid-reject-negative-request-size.patch @@ -0,0 +1,52 @@ +From 850a2cc6eda2e966234e39a250485dd452ccd294 Mon Sep 17 00:00:00 2001 +From: Dan Rosenberg <drosenberg@vsecurity.com> +Date: Tue, 5 Apr 2011 13:27:31 -0400 +Subject: [PATCH] pmcraid: reject negative request size + +commit 5f6279da3760ce48f478f2856aacebe0c59a39f3 upstream. + +There's a code path in pmcraid that can be reached via device ioctl that +causes all sorts of ugliness, including heap corruption or triggering +the OOM killer due to consecutive allocation of large numbers of pages. +Not especially relevant from a security perspective, since users must +have CAP_SYS_ADMIN to open the character device. + +First, the user can call pmcraid_chr_ioctl() with a type +PMCRAID_PASSTHROUGH_IOCTL. A pmcraid_passthrough_ioctl_buffer +is copied in, and the request_size variable is set to +buffer->ioarcb.data_transfer_length, which is an arbitrary 32-bit signed +value provided by the user. + +If a negative value is provided here, bad things can happen. For +example, pmcraid_build_passthrough_ioadls() is called with this +request_size, which immediately calls pmcraid_alloc_sglist() with a +negative size. The resulting math on allocating a scatter list can +result in an overflow in the kzalloc() call (if num_elem is 0, the +sglist will be smaller than expected), or if num_elem is unexpectedly +large the subsequent loop will call alloc_pages() repeatedly, a high +number of pages will be allocated and the OOM killer might be invoked. + +Prevent this value from being negative in pmcraid_ioctl_passthrough(). + +Signed-off-by: Dan Rosenberg <drosenberg@vsecurity.com> +Cc: Anil Ravindranath <anil_ravindranath@pmc-sierra.com> +Signed-off-by: James Bottomley <James.Bottomley@suse.de> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> + +diff --git a/drivers/scsi/pmcraid.c b/drivers/scsi/pmcraid.c +index 53aefff..bdb7259 100644 +--- a/drivers/scsi/pmcraid.c ++++ b/drivers/scsi/pmcraid.c +@@ -3528,6 +3528,9 @@ static long pmcraid_ioctl_passthrough( + rc = -EFAULT; + goto out_free_buffer; + } ++ } else if (request_size < 0) { ++ rc = -EINVAL; ++ goto out_free_buffer; + } + + /* check if we have any additional command parameters */ +-- +1.7.7 + diff --git a/queue/powerpc-boot-dts-Install-dts-from-the-right-director.patch b/queue/powerpc-boot-dts-Install-dts-from-the-right-director.patch new file mode 100644 index 0000000..bf40b36 --- /dev/null +++ b/queue/powerpc-boot-dts-Install-dts-from-the-right-director.patch @@ -0,0 +1,34 @@ +From b32a8ea9de7b59709d73ca4720eb38855814c5cc Mon Sep 17 00:00:00 2001 +From: Ben Hutchings <ben@decadent.org.uk> +Date: Sat, 8 Jan 2011 14:24:01 +0000 +Subject: [PATCH] powerpc/boot/dts: Install dts from the right directory + +commit 4d9ef89dee13e964ea8b064d82ff55cf36209237 upstream. + +The dts-installed variable is initialised using a wildcard path that +will be expanded relative to the build directory. Use the existing +variable dtstree to generate an absolute wildcard path that will work +when building in a separate directory. + +Reported-by: Gerhard Pircher <gerhard_pircher@gmx.net> +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +Tested-by: Gerhard Pircher <gerhard_pircher@gmx.net> [against 2.6.32] +Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> + +diff --git a/arch/powerpc/boot/Makefile b/arch/powerpc/boot/Makefile +index bb2465b..22b527b 100644 +--- a/arch/powerpc/boot/Makefile ++++ b/arch/powerpc/boot/Makefile +@@ -367,7 +367,7 @@ INSTALL := install + extra-installed := $(patsubst $(obj)/%, $(DESTDIR)$(WRAPPER_OBJDIR)/%, $(extra-y)) + hostprogs-installed := $(patsubst %, $(DESTDIR)$(WRAPPER_BINDIR)/%, $(hostprogs-y)) + wrapper-installed := $(DESTDIR)$(WRAPPER_BINDIR)/wrapper +-dts-installed := $(patsubst $(obj)/dts/%, $(DESTDIR)$(WRAPPER_DTSDIR)/%, $(wildcard $(obj)/dts/*.dts)) ++dts-installed := $(patsubst $(dtstree)/%, $(DESTDIR)$(WRAPPER_DTSDIR)/%, $(wildcard $(dtstree)/*.dts)) + + all-installed := $(extra-installed) $(hostprogs-installed) $(wrapper-installed) $(dts-installed) + +-- +1.7.7 + diff --git a/queue/put-stricter-guards-on-queue-dead-checks.patch b/queue/put-stricter-guards-on-queue-dead-checks.patch new file mode 100644 index 0000000..1a73d2c --- /dev/null +++ b/queue/put-stricter-guards-on-queue-dead-checks.patch @@ -0,0 +1,60 @@ +From 3cd23d4e0fd15142697c69074060df76734d861d Mon Sep 17 00:00:00 2001 +From: James Bottomley <James.Bottomley@suse.de> +Date: Fri, 22 Apr 2011 10:39:59 -0500 +Subject: [PATCH] put stricter guards on queue dead checks + +commit 86cbfb5607d4b81b1a993ff689bbd2addd5d3a9b upstream. + +SCSI uses request_queue->queuedata == NULL as a signal that the queue +is dying. We set this state in the sdev release function. However, +this allows a small window where we release the last reference but +haven't quite got to this stage yet and so something will try to take +a reference in scsi_request_fn and oops. It's very rare, but we had a +report here, so we're pushing this as a bug fix + +The actual fix is to set request_queue->queuedata to NULL in +scsi_remove_device() before we drop the reference. This causes +correct automatic rejects from scsi_request_fn as people who hold +additional references try to submit work and prevents anything from +getting a new reference to the sdev that way. + +Signed-off-by: James Bottomley <James.Bottomley@suse.de> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> + +diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c +index 02be251..ed3b52f 100644 +--- a/drivers/scsi/scsi_sysfs.c ++++ b/drivers/scsi/scsi_sysfs.c +@@ -319,14 +319,8 @@ static void scsi_device_dev_release_usercontext(struct work_struct *work) + kfree(evt); + } + +- if (sdev->request_queue) { +- sdev->request_queue->queuedata = NULL; +- /* user context needed to free queue */ +- scsi_free_queue(sdev->request_queue); +- /* temporary expedient, try to catch use of queue lock +- * after free of sdev */ +- sdev->request_queue = NULL; +- } ++ /* NULL queue means the device can't be used */ ++ sdev->request_queue = NULL; + + scsi_target_reap(scsi_target(sdev)); + +@@ -964,6 +958,12 @@ void __scsi_remove_device(struct scsi_device *sdev) + if (sdev->host->hostt->slave_destroy) + sdev->host->hostt->slave_destroy(sdev); + transport_destroy_device(dev); ++ ++ /* cause the request function to reject all I/O requests */ ++ sdev->request_queue->queuedata = NULL; ++ ++ /* Freeing the queue signals to block that we're done */ ++ scsi_free_queue(sdev->request_queue); + put_device(dev); + } + +-- +1.7.7 + diff --git a/queue/rt2500usb-fallback-to-SW-encryption-for-TKIP-AES.patch b/queue/rt2500usb-fallback-to-SW-encryption-for-TKIP-AES.patch new file mode 100644 index 0000000..28061ec --- /dev/null +++ b/queue/rt2500usb-fallback-to-SW-encryption-for-TKIP-AES.patch @@ -0,0 +1,59 @@ +From c9b6ff02aa1d641ff607363a222b656787695d6c Mon Sep 17 00:00:00 2001 +From: Ondrej Zary <linux@rainbow-software.org> +Date: Wed, 23 Jun 2010 12:57:15 +0200 +Subject: [PATCH] rt2500usb: fallback to SW encryption for TKIP+AES + +commit 75f64dd54a185150ebfc45e99351c890d4a2252f upstream. + +HW crypto in rt2500usb does not seem to support keys with different ciphers, +which breaks TKIP+AES mode. Fall back to software encryption to fix it. + +This should fix long-standing problems with rt2500usb and WPA, such as: +http://rt2x00.serialmonkey.com/phpBB/viewtopic.php?f=4&t=4834 +https://bugzilla.redhat.com/show_bug.cgi?id=484888 + +Also tested that it does not break WEP, TKIP-only and AES-only modes. + +Signed-off-by: Ondrej Zary <linux@rainbow-software.org> +Acked-by: Gertjan van Wingerde <gwingerde@gmail.com> +Signed-off-by: John W. Linville <linville@tuxdriver.com> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> + +diff --git a/drivers/net/wireless/rt2x00/rt2500usb.c b/drivers/net/wireless/rt2x00/rt2500usb.c +index 8ebb705..2961228 100644 +--- a/drivers/net/wireless/rt2x00/rt2500usb.c ++++ b/drivers/net/wireless/rt2x00/rt2500usb.c +@@ -348,6 +348,7 @@ static int rt2500usb_config_key(struct rt2x00_dev *rt2x00dev, + int timeout; + u32 mask; + u16 reg; ++ enum cipher curr_cipher; + + if (crypto->cmd == SET_KEY) { + /* +@@ -358,6 +359,7 @@ static int rt2500usb_config_key(struct rt2x00_dev *rt2x00dev, + mask = TXRX_CSR0_KEY_ID.bit_mask; + + rt2500usb_register_read(rt2x00dev, TXRX_CSR0, ®); ++ curr_cipher = rt2x00_get_field16(reg, TXRX_CSR0_ALGORITHM); + reg &= mask; + + if (reg && reg == mask) +@@ -366,6 +368,14 @@ static int rt2500usb_config_key(struct rt2x00_dev *rt2x00dev, + reg = rt2x00_get_field16(reg, TXRX_CSR0_KEY_ID); + + key->hw_key_idx += reg ? ffz(reg) : 0; ++ /* ++ * Hardware requires that all keys use the same cipher ++ * (e.g. TKIP-only, AES-only, but not TKIP+AES). ++ * If this is not the first key, compare the cipher with the ++ * first one and fall back to SW crypto if not the same. ++ */ ++ if (key->hw_key_idx > 0 && crypto->cipher != curr_cipher) ++ return -EOPNOTSUPP; + + /* + * The encryption key doesn't fit within the CSR cache, +-- +1.7.7 + diff --git a/queue/scsi_dh_emc-request-flag-cleanup.patch b/queue/scsi_dh_emc-request-flag-cleanup.patch new file mode 100644 index 0000000..4491a38 --- /dev/null +++ b/queue/scsi_dh_emc-request-flag-cleanup.patch @@ -0,0 +1,36 @@ +From fd3d47386e9dc6e5207c1cfe9a4d8b9a7381958a Mon Sep 17 00:00:00 2001 +From: Mike Christie <michaelc@cs.wisc.edu> +Date: Fri, 9 Apr 2010 22:07:37 -0500 +Subject: [PATCH] scsi_dh_emc: request flag cleanup + +commit 5738d4449c1baf05e8345684d12371f76296473d upstream. + +blk_get_request sets the cmd_flags, so we should not and do not +need to set them. If we did set them to a different value then +it can cause a oops in the elevator code. + +Signed-off-by: Mike Christie <michaelc@cs.wisc.edu> +Signed-off-by: James Bottomley <James.Bottomley@suse.de> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> + +diff --git a/drivers/scsi/device_handler/scsi_dh_emc.c b/drivers/scsi/device_handler/scsi_dh_emc.c +index e8a0bc3..6faf472 100644 +--- a/drivers/scsi/device_handler/scsi_dh_emc.c ++++ b/drivers/scsi/device_handler/scsi_dh_emc.c +@@ -285,13 +285,11 @@ static struct request *get_req(struct scsi_device *sdev, int cmd, + switch (cmd) { + case MODE_SELECT: + len = sizeof(short_trespass); +- rq->cmd_flags |= REQ_RW; + rq->cmd[1] = 0x10; + rq->cmd[4] = len; + break; + case MODE_SELECT_10: + len = sizeof(long_trespass); +- rq->cmd_flags |= REQ_RW; + rq->cmd[1] = 0x10; + rq->cmd[8] = len; + break; +-- +1.7.7 + diff --git a/queue/serial-imx-read-cts-state-only-after-acking-cts-chan.patch b/queue/serial-imx-read-cts-state-only-after-acking-cts-chan.patch new file mode 100644 index 0000000..62564c8 --- /dev/null +++ b/queue/serial-imx-read-cts-state-only-after-acking-cts-chan.patch @@ -0,0 +1,48 @@ +From df7dc8aaa5188f63b1c3e3a0368226c5330a7772 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Uwe=20Kleine-K=C3=B6nig?= <u.kleine-koenig@pengutronix.de> +Date: Mon, 11 Apr 2011 10:59:09 +0200 +Subject: [PATCH] serial/imx: read cts state only after acking cts change irq +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +commit 5680e94148a86e8c31fdc5cb0ea0d5c6810c05b0 upstream. + +If cts changes between reading the level at the cts input (USR1_RTSS) +and acking the irq (USR1_RTSD) the last edge doesn't generate an irq and +uart_handle_cts_change is called with a outdated value for cts. + +The race was introduced by commit + + ceca629 ([ARM] 2971/1: i.MX uart handle rts irq) + +[PG: file in drivers/serial not drivers/tty/serial in .34] + +Reported-by: Arwed Springer <Arwed.Springer@de.trumpf.com> +Tested-by: Arwed Springer <Arwed.Springer@de.trumpf.com> +Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> + +diff --git a/drivers/serial/imx.c b/drivers/serial/imx.c +index eacb588..6d2028e 100644 +--- a/drivers/serial/imx.c ++++ b/drivers/serial/imx.c +@@ -383,12 +383,13 @@ static void imx_start_tx(struct uart_port *port) + static irqreturn_t imx_rtsint(int irq, void *dev_id) + { + struct imx_port *sport = dev_id; +- unsigned int val = readl(sport->port.membase + USR1) & USR1_RTSS; ++ unsigned int val; + unsigned long flags; + + spin_lock_irqsave(&sport->port.lock, flags); + + writel(USR1_RTSD, sport->port.membase + USR1); ++ val = readl(sport->port.membase + USR1) & USR1_RTSS; + uart_handle_cts_change(&sport->port, !!val); + wake_up_interruptible(&sport->port.state->port.delta_msr_wait); + +-- +1.7.7 + diff --git a/queue/series b/queue/series index 4c3069b..ef1caab 100644 --- a/queue/series +++ b/queue/series @@ -91,6 +91,91 @@ proc-do-proper-range-check-on-readdir-offset.patch can-Add-missing-socket-check-in-can-bcm-release.patch can-add-missing-socket-check-in-can-raw-release.patch nfs4-Ensure-that-ACL-pages-sent-over-NFS-were-not-al.patch +ath-add-missing-regdomain-pair-0x5c-mapping.patch +block-blk-sysfs-Fix-an-err-return-path-in-blk_regist.patch +p54-Initialize-extra_len-in-p54_tx_80211.patch +intel-iommu-Unlink-domain-from-iommu.patch +intel-iommu-Fix-get_domain_for_dev-error-path.patch +drm-radeon-kms-fix-bad-shift-in-atom-iio-table-parse.patch +NFS-nfs_wcc_update_inode-should-set-nfsi-attr_gencou.patch +serial-imx-read-cts-state-only-after-acking-cts-chan.patch +ASoC-Fix-output-PGA-enabling-in-wm_hubs-CODECs.patch +kconfig-Avoid-buffer-underrun-in-choice-input.patch +UBIFS-fix-master-node-recovery.patch +Remove-extra-struct-page-member-from-the-buffer-info.patch +dasd-correct-device-table.patch +iwlagn-Support-new-5000-microcode.patch +slub-fix-panic-with-DISCONTIGMEM.patch +set-memory-ranges-in-N_NORMAL_MEMORY-when-onlined.patch +FLEXCOP-PCI-fix-__xlate_proc_name-warning-for-flexco.patch +m68k-mm-Set-all-online-nodes-in-N_NORMAL_MEMORY.patch +nfs-don-t-lose-MS_SYNCHRONOUS-on-remount-of-noac-mou.patch +NFSv4.1-Ensure-state-manager-thread-dies-on-last-umo.patch +pmcraid-reject-negative-request-size.patch +put-stricter-guards-on-queue-dead-checks.patch +mmc-sdhci-pci-Fix-error-case-in-sdhci_pci_probe_slot.patch +mmc-sdhci-Check-mrq-cmd-in-sdhci_tasklet_finish.patch +mmc-sdhci-Check-mrq-NULL-in-sdhci_tasklet_finish.patch +x86-AMD-Fix-APIC-timer-erratum-400-affecting-K8-Rev..patch +af_unix-Only-allow-recv-on-connected-seqpacket-socke.patch +ARM-6891-1-prevent-heap-corruption-in-OABI-semtimedo.patch +i8k-Tell-gcc-that-regs-gets-clobbered.patch +Fix-gcc-4.5.1-miscompiling-drivers-char-i8k.c-again.patch +Open-with-O_CREAT-flag-set-fails-to-open-existing-fi.patch +Input-elantech-relax-signature-checks.patch +Input-elantech-discard-the-first-2-positions-on-some.patch +Staging-rtl8192su-check-for-skb-NULL.patch +Staging-rtl8192su-Clean-up-in-case-of-an-error-in-mo.patch +Staging-rtl8192su-Fix-procfs-code-for-interfaces-not.patch +Staging-rtl8192su-remove-device-ids.patch +Staging-rtl8192su-add-device-ids.patch +USB-teach-devices-file-about-Wireless-and-SuperSpeed.patch +GFS2-Fix-writing-to-non-page-aligned-gfs2_quota-stru.patch +GFS2-BUG-in-gfs2_adjust_quota.patch +SUNRPC-fix-NFS-client-over-TCP-hangs-due-to-packet-l.patch +nfs-fix-compilation-warning.patch +Fix-corrupted-OSF-partition-table-parsing.patch +Increase-OSF-partition-limit-from-8-to-18.patch +hwmon-applesmc-Add-support-for-MacBook-Pro-5-3-and-5.patch +hwmon-applesmc-Add-generic-support-for-MacBook-Pro-6.patch +hwmon-applesmc-Add-generic-support-for-MacBook-Pro-7.patch +hwmon-applesmc-Add-MacBookAir3-1-3-2-support.patch +ALSA-emux-Add-trivial-compat-ioctl-handler.patch +ALSA-powermac-Reverse-HP-detection-on-G4-DA.patch +ALSA-powermac-Lineout-detection-on-G4-DA.patch +ALSA-hda-MacBookPro-5-3-line-in-support.patch +ALSA-hda-Add-model-mbp55-entry-for-MacBookPro-7-1.patch +ALSA-hda-MacBookAir3-1-3-2-alsa-support.patch +virtio_net-Add-schedule-check-to-napi_enable-call.patch +Bluetooth-Add-support-Bluetooth-controller-of-Macboo.patch +Bluetooth-Add-support-Bluetooth-controller-of-Macboo-2.patch +Bluetooth-Add-MacBookAir3-1-2-support.patch +perf-symbols-allow-forcing-use-of-cplus_demangle.patch +V4L-DVB-Add-Elgato-EyeTV-Diversity-to-dibcom-driver.patch +mmc-fix-all-hangs-related-to-mmc-sd-card-insert-remo.patch +mmc-build-fix-mmc_pm_notify-is-only-available-with-C.patch +b43-Fix-warning-at-drivers-mmc-core-core.c-237-in-mm.patch +dell-laptop-Add-another-Dell-laptop-family-to-the-DM.patch +scsi_dh_emc-request-flag-cleanup.patch +cifs-fix-another-memleak-in-cifs_root_iget.patch +e1000e-Reset-82577-82578-PHY-before-first-PHY-regist.patch +e1000-fix-Tx-hangs-by-disabling-64-bit-DMA.patch +btrfs-Require-CAP_SYS_ADMIN-for-filesystem-rebalance.patch +init-sched-Fix-race-between-init-and-kthreadd.patch +backlight-MacBookAir3-1-3-2-mbp-nvidia-bl-support.patch +bonding-Ensure-that-we-unshare-skbs-prior-to-calling.patch +HID-add-MacBookAir-3-1-and-3-2-support.patch +intel-iommu-Force-disable-IOMMU-for-iGFX-on-broken-C.patch +ipv6-Silence-privacy-extensions-initialization.patch +mpt2sas-fix-the-incorrect-scsi_dma_map-error-checkin.patch +powerpc-boot-dts-Install-dts-from-the-right-director.patch +rt2500usb-fallback-to-SW-encryption-for-TKIP-AES.patch +tehuti-Firmware-filename-is-tehuti-bdx.bin.patch +wireless-b43-fix-error-path-in-SDIO.patch +libata-set-queue-DMA-alignment-to-sector-size-for-AT.patch +iwlwifi-fix-skb-usage-after-free.patch +x86-pvclock-Move-scale_delta-into-common-header.patch +fix-oops-in-scsi_run_queue.patch # Content taken from v2.6.32.41 dccp-handle-invalid-feature-options-length.patch diff --git a/queue/set-memory-ranges-in-N_NORMAL_MEMORY-when-onlined.patch b/queue/set-memory-ranges-in-N_NORMAL_MEMORY-when-onlined.patch new file mode 100644 index 0000000..3d41690 --- /dev/null +++ b/queue/set-memory-ranges-in-N_NORMAL_MEMORY-when-onlined.patch @@ -0,0 +1,59 @@ +From abff89847954ef1217dc91b0f8e4f8d5cdb81352 Mon Sep 17 00:00:00 2001 +From: David Rientjes <rientjes@google.com> +Date: Wed, 20 Apr 2011 19:27:13 -0700 +Subject: [PATCH] set memory ranges in N_NORMAL_MEMORY when onlined + +commit d9b41e0b54fd7e164daf1e9c539c1070398aa02e upstream. + +When a DISCONTIGMEM memory range is brought online as a NUMA node, it +also needs to have its bet set in N_NORMAL_MEMORY. This is necessary for +generic kernel code that utilizes N_NORMAL_MEMORY as a subset of N_ONLINE +for memory savings. + +These types of hacks can hopefully be removed once DISCONTIGMEM is either +removed or abstracted away from CONFIG_NUMA. + +Fixes a panic in the slub code which only initializes structures for +N_NORMAL_MEMORY to save memory: + + Backtrace: + [<000000004021c938>] add_partial+0x28/0x98 + [<000000004021faa0>] __slab_free+0x1d0/0x1d8 + [<000000004021fd04>] kmem_cache_free+0xc4/0x128 + [<000000004033bf9c>] ida_get_new_above+0x21c/0x2c0 + [<00000000402a8980>] sysfs_new_dirent+0xd0/0x238 + [<00000000402a974c>] create_dir+0x5c/0x168 + [<00000000402a9ab0>] sysfs_create_dir+0x98/0x128 + [<000000004033d6c4>] kobject_add_internal+0x114/0x258 + [<000000004033d9ac>] kobject_add_varg+0x7c/0xa0 + [<000000004033df20>] kobject_add+0x50/0x90 + [<000000004033dfb4>] kobject_create_and_add+0x54/0xc8 + [<00000000407862a0>] cgroup_init+0x138/0x1f0 + [<000000004077ce50>] start_kernel+0x5a0/0x840 + [<000000004011fa3c>] start_parisc+0xa4/0xb8 + [<00000000404bb034>] packet_ioctl+0x16c/0x208 + [<000000004049ac30>] ip_mroute_setsockopt+0x260/0xf20 + +Signed-off-by: David Rientjes <rientjes@google.com> +Signed-off-by: James Bottomley <James.Bottomley@suse.de> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> + +diff --git a/arch/parisc/mm/init.c b/arch/parisc/mm/init.c +index f4f4d70..7fd8aad 100644 +--- a/arch/parisc/mm/init.c ++++ b/arch/parisc/mm/init.c +@@ -266,8 +266,10 @@ static void __init setup_bootmem(void) + } + memset(pfnnid_map, 0xff, sizeof(pfnnid_map)); + +- for (i = 0; i < npmem_ranges; i++) ++ for (i = 0; i < npmem_ranges; i++) { ++ node_set_state(i, N_NORMAL_MEMORY); + node_set_online(i); ++ } + #endif + + /* +-- +1.7.7 + diff --git a/queue/slub-fix-panic-with-DISCONTIGMEM.patch b/queue/slub-fix-panic-with-DISCONTIGMEM.patch new file mode 100644 index 0000000..c27668c --- /dev/null +++ b/queue/slub-fix-panic-with-DISCONTIGMEM.patch @@ -0,0 +1,37 @@ +From bd2b373130b34445f797f4cd39cd302a9f00c2a3 Mon Sep 17 00:00:00 2001 +From: James Bottomley <James.Bottomley@HansenPartnership.com> +Date: Tue, 19 Apr 2011 16:29:36 -0500 +Subject: [PATCH] slub: fix panic with DISCONTIGMEM + +commit 4a5fa3590f09999f6db41bc386bce40848fa9f63 upstream. + +Slub makes assumptions about page_to_nid() which are violated by +DISCONTIGMEM and !NUMA. This violation results in a panic because +page_to_nid() can be non-zero for pages in the discontiguous ranges and +this leads to a null return by get_node(). The assertion by the +maintainer is that DISCONTIGMEM should only be allowed when NUMA is also +defined. However, at least six architectures: alpha, ia64, m32r, m68k, +mips, parisc violate this. The panic is a regression against slab, so +just mark slub broken in the problem configuration to prevent users +reporting these panics. + +Acked-by: David Rientjes <rientjes@google.com> +Acked-by: Pekka Enberg <penberg@kernel.org> +Signed-off-by: James Bottomley <James.Bottomley@suse.de> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> + +diff --git a/init/Kconfig b/init/Kconfig +index 5fe94b8..04e486cf 100644 +--- a/init/Kconfig ++++ b/init/Kconfig +@@ -1052,6 +1052,7 @@ config SLAB + per cpu and per node queues. + + config SLUB ++ depends on BROKEN || NUMA || !DISCONTIGMEM + bool "SLUB (Unqueued Allocator)" + help + SLUB is a slab allocator that minimizes cache line usage +-- +1.7.7 + diff --git a/queue/tehuti-Firmware-filename-is-tehuti-bdx.bin.patch b/queue/tehuti-Firmware-filename-is-tehuti-bdx.bin.patch new file mode 100644 index 0000000..1af7c5a --- /dev/null +++ b/queue/tehuti-Firmware-filename-is-tehuti-bdx.bin.patch @@ -0,0 +1,38 @@ +From f83d4d2d8cfd6b43fd0488b76a0fff13c599eb31 Mon Sep 17 00:00:00 2001 +From: Ben Hutchings <ben@decadent.org.uk> +Date: Fri, 17 Dec 2010 10:16:23 -0800 +Subject: [PATCH] tehuti: Firmware filename is tehuti/bdx.bin + +commit 46814e08d80f87449b5adb3d549a3cae6f9f8148 upstream. + +My conversion of tehuti to use request_firmware() was confused about +the filename of the firmware blob. Change the driver to match the +blob. + +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +Signed-off-by: Andy Gospodarek <andy@greyhouse.net> +Signed-off-by: David S. Miller <davem@davemloft.net> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> + +diff --git a/drivers/net/tehuti.c b/drivers/net/tehuti.c +index f549309..cf4529c 100644 +--- a/drivers/net/tehuti.c ++++ b/drivers/net/tehuti.c +@@ -324,7 +324,7 @@ static int bdx_fw_load(struct bdx_priv *priv) + ENTER; + master = READ_REG(priv, regINIT_SEMAPHORE); + if (!READ_REG(priv, regINIT_STATUS) && master) { +- rc = request_firmware(&fw, "tehuti/firmware.bin", &priv->pdev->dev); ++ rc = request_firmware(&fw, "tehuti/bdx.bin", &priv->pdev->dev); + if (rc) + goto out; + bdx_tx_push_desc_safe(priv, (char *)fw->data, fw->size); +@@ -2518,4 +2518,4 @@ module_exit(bdx_module_exit); + MODULE_LICENSE("GPL"); + MODULE_AUTHOR(DRIVER_AUTHOR); + MODULE_DESCRIPTION(BDX_DRV_DESC); +-MODULE_FIRMWARE("tehuti/firmware.bin"); ++MODULE_FIRMWARE("tehuti/bdx.bin"); +-- +1.7.7 + diff --git a/queue/virtio_net-Add-schedule-check-to-napi_enable-call.patch b/queue/virtio_net-Add-schedule-check-to-napi_enable-call.patch new file mode 100644 index 0000000..f4fed25 --- /dev/null +++ b/queue/virtio_net-Add-schedule-check-to-napi_enable-call.patch @@ -0,0 +1,77 @@ +From e9ced70620a211573fabfb35df15c75dfb7b5951 Mon Sep 17 00:00:00 2001 +From: Bruce Rogers <brogers@novell.com> +Date: Thu, 10 Feb 2011 11:03:31 -0800 +Subject: [PATCH] virtio_net: Add schedule check to napi_enable call + +commit 3e9d08ec0a68f6faf718d5a7e050fe5ca0ba004f upstream. + +Under harsh testing conditions, including low memory, the guest would +stop receiving packets. With this patch applied we no longer see any +problems in the driver while performing these tests for extended periods +of time. + +Make sure napi is scheduled subsequent to each napi_enable. + +[PG: in 34, virtqueue_disable_cb is vi->rvq->vq_ops->disable_cb] + +Signed-off-by: Bruce Rogers <brogers@novell.com> +Signed-off-by: Olaf Kirch <okir@suse.de> +Signed-off-by: Rusty Russell <rusty@rustcorp.com.au> +Signed-off-by: David S. Miller <davem@davemloft.net> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> + +diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c +index f5b5d74..195104d 100644 +--- a/drivers/net/virtio_net.c ++++ b/drivers/net/virtio_net.c +@@ -448,6 +448,20 @@ static void skb_recv_done(struct virtqueue *rvq) + } + } + ++static void virtnet_napi_enable(struct virtnet_info *vi) ++{ ++ napi_enable(&vi->napi); ++ ++ /* If all buffers were filled by other side before we napi_enabled, we ++ * won't get another interrupt, so process any outstanding packets ++ * now. virtnet_poll wants re-enable the queue, so we disable here. ++ * We synchronize against interrupts via NAPI_STATE_SCHED */ ++ if (napi_schedule_prep(&vi->napi)) { ++ virtqueue_disable_cb(vi->rvq); ++ __napi_schedule(&vi->napi); ++ } ++} ++ + static void refill_work(struct work_struct *work) + { + struct virtnet_info *vi; +@@ -456,7 +470,7 @@ static void refill_work(struct work_struct *work) + vi = container_of(work, struct virtnet_info, refill.work); + napi_disable(&vi->napi); + still_empty = !try_fill_recv(vi, GFP_KERNEL); +- napi_enable(&vi->napi); ++ virtnet_napi_enable(vi); + + /* In theory, this can happen: if we don't get any buffers in + * we will *never* try to fill again. */ +@@ -642,16 +656,7 @@ static int virtnet_open(struct net_device *dev) + { + struct virtnet_info *vi = netdev_priv(dev); + +- napi_enable(&vi->napi); +- +- /* If all buffers were filled by other side before we napi_enabled, we +- * won't get another interrupt, so process any outstanding packets +- * now. virtnet_poll wants re-enable the queue, so we disable here. +- * We synchronize against interrupts via NAPI_STATE_SCHED */ +- if (napi_schedule_prep(&vi->napi)) { +- vi->rvq->vq_ops->disable_cb(vi->rvq); +- __napi_schedule(&vi->napi); +- } ++ virtnet_napi_enable(vi); + return 0; + } + +-- +1.7.7 + diff --git a/queue/wireless-b43-fix-error-path-in-SDIO.patch b/queue/wireless-b43-fix-error-path-in-SDIO.patch new file mode 100644 index 0000000..693e1e6 --- /dev/null +++ b/queue/wireless-b43-fix-error-path-in-SDIO.patch @@ -0,0 +1,29 @@ +From a154c3726fb036b7791e43db05649ac54088a30a Mon Sep 17 00:00:00 2001 +From: Guennadi Liakhovetski <g.liakhovetski@gmx.de> +Date: Tue, 23 Nov 2010 17:10:24 +0100 +Subject: [PATCH] wireless: b43: fix error path in SDIO + +commit e476a5a41ad67d0e2b4a652820c49a3923eb936b upstream. + +Fix unbalanced call to sdio_release_host() on the error path. + +Signed-off-by: Guennadi Liakhovetski <g.liakhovetski@gmx.de> +Acked-by: Larry Finger <Larry.Finger@lwfinger.net> +Signed-off-by: John W. Linville <linville@tuxdriver.com> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> + +diff --git a/drivers/net/wireless/b43/sdio.c b/drivers/net/wireless/b43/sdio.c +index 8b18314..4808dc7 100644 +--- a/drivers/net/wireless/b43/sdio.c ++++ b/drivers/net/wireless/b43/sdio.c +@@ -163,6 +163,7 @@ static int b43_sdio_probe(struct sdio_func *func, + err_free_ssb: + kfree(sdio); + err_disable_func: ++ sdio_claim_host(func); + sdio_disable_func(func); + err_release_host: + sdio_release_host(func); +-- +1.7.7 + diff --git a/queue/x86-AMD-Fix-APIC-timer-erratum-400-affecting-K8-Rev..patch b/queue/x86-AMD-Fix-APIC-timer-erratum-400-affecting-K8-Rev..patch new file mode 100644 index 0000000..372d85e --- /dev/null +++ b/queue/x86-AMD-Fix-APIC-timer-erratum-400-affecting-K8-Rev..patch @@ -0,0 +1,44 @@ +From a12d98a363169cfd35675946afa4a9a428215e77 Mon Sep 17 00:00:00 2001 +From: Boris Ostrovsky <ostr@amd64.org> +Date: Fri, 29 Apr 2011 17:47:43 -0400 +Subject: [PATCH] x86, AMD: Fix APIC timer erratum 400 affecting K8 Rev.A-E + processors + +commit e20a2d205c05cef6b5783df339a7d54adeb50962 upstream. + +Older AMD K8 processors (Revisions A-E) are affected by erratum +400 (APIC timer interrupts don't occur in C states greater than +C1). This, for example, means that X86_FEATURE_ARAT flag should +not be set for these parts. + +This addresses regression introduced by commit +b87cf80af3ba4b4c008b4face3c68d604e1715c6 ("x86, AMD: Set ARAT +feature on AMD processors") where the system may become +unresponsive until external interrupt (such as keyboard input) +occurs. This results, for example, in time not being reported +correctly, lack of progress on the system and other lockups. + +Reported-by: Joerg-Volker Peetz <jvpeetz@web.de> +Tested-by: Joerg-Volker Peetz <jvpeetz@web.de> +Acked-by: Borislav Petkov <borislav.petkov@amd.com> +Signed-off-by: Boris Ostrovsky <Boris.Ostrovsky@amd.com> +Link: http://lkml.kernel.org/r/1304113663-6586-1-git-send-email-ostr@amd64.org +Signed-off-by: Ingo Molnar <mingo@elte.hu> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> + +diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c +index d618dc1..89e2071 100644 +--- a/arch/x86/kernel/cpu/amd.c ++++ b/arch/x86/kernel/cpu/amd.c +@@ -652,7 +652,7 @@ cpu_dev_register(amd_cpu_dev); + */ + + const int amd_erratum_400[] = +- AMD_OSVW_ERRATUM(1, AMD_MODEL_RANGE(0xf, 0x41, 0x2, 0xff, 0xf), ++ AMD_OSVW_ERRATUM(1, AMD_MODEL_RANGE(0x0f, 0x4, 0x2, 0xff, 0xf), + AMD_MODEL_RANGE(0x10, 0x2, 0x1, 0xff, 0xf)); + + +-- +1.7.7 + diff --git a/queue/x86-pvclock-Move-scale_delta-into-common-header.patch b/queue/x86-pvclock-Move-scale_delta-into-common-header.patch new file mode 100644 index 0000000..e3608c9 --- /dev/null +++ b/queue/x86-pvclock-Move-scale_delta-into-common-header.patch @@ -0,0 +1,79 @@ +From e9deb7c6c912d5c58532bc4a57d4223963eab9ec Mon Sep 17 00:00:00 2001 +From: Zachary Amsden <zamsden@redhat.com> +Date: Thu, 19 Aug 2010 22:07:29 -1000 +Subject: [PATCH] x86: pvclock: Move scale_delta into common header + +commit 347bb4448c2155eb2310923ccaa4be5677649003 upstream. + +The scale_delta function for shift / multiply with 31-bit +precision moves to a common header so it can be used by both +kernel and kvm module. + +Signed-off-by: Zachary Amsden <zamsden@redhat.com> +Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> + +diff --git a/arch/x86/include/asm/pvclock.h b/arch/x86/include/asm/pvclock.h +index daaacab..982aa32 100644 +--- a/arch/x86/include/asm/pvclock.h ++++ b/arch/x86/include/asm/pvclock.h +@@ -12,4 +12,42 @@ void pvclock_read_wallclock(struct pvclock_wall_clock *wall, + struct timespec *ts); + void pvclock_resume(void); + ++/* ++ * Scale a 64-bit delta by scaling and multiplying by a 32-bit fraction, ++ * yielding a 64-bit result. ++ */ ++static inline u64 pvclock_scale_delta(u64 delta, u32 mul_frac, int shift) ++{ ++ u64 product; ++#ifdef __i386__ ++ u32 tmp1, tmp2; ++#endif ++ ++ if (shift < 0) ++ delta >>= -shift; ++ else ++ delta <<= shift; ++ ++#ifdef __i386__ ++ __asm__ ( ++ "mul %5 ; " ++ "mov %4,%%eax ; " ++ "mov %%edx,%4 ; " ++ "mul %5 ; " ++ "xor %5,%5 ; " ++ "add %4,%%eax ; " ++ "adc %5,%%edx ; " ++ : "=A" (product), "=r" (tmp1), "=r" (tmp2) ++ : "a" ((u32)delta), "1" ((u32)(delta >> 32)), "2" (mul_frac) ); ++#elif defined(__x86_64__) ++ __asm__ ( ++ "mul %%rdx ; shrd $32,%%rdx,%%rax" ++ : "=a" (product) : "0" (delta), "d" ((u64)mul_frac) ); ++#else ++#error implement me! ++#endif ++ ++ return product; ++} ++ + #endif /* _ASM_X86_PVCLOCK_H */ +diff --git a/arch/x86/kernel/pvclock.c b/arch/x86/kernel/pvclock.c +index b12fe8d..929047c 100644 +--- a/arch/x86/kernel/pvclock.c ++++ b/arch/x86/kernel/pvclock.c +@@ -74,7 +74,8 @@ static inline u64 scale_delta(u64 delta, u32 mul_frac, int shift) + static u64 pvclock_get_nsec_offset(struct pvclock_shadow_time *shadow) + { + u64 delta = native_read_tsc() - shadow->tsc_timestamp; +- return scale_delta(delta, shadow->tsc_to_nsec_mul, shadow->tsc_shift); ++ return pvclock_scale_delta(delta, shadow->tsc_to_nsec_mul, ++ shadow->tsc_shift); + } + + /* +-- +1.7.7 + |