diff options
author | Greg Kroah-Hartman <gregkh@suse.de> | 2011-06-06 10:41:18 -0700 |
---|---|---|
committer | Greg Kroah-Hartman <gregkh@suse.de> | 2011-06-06 10:41:18 -0700 |
commit | 94766e8deb6585c236f813afe492b980b2b75fdc (patch) | |
tree | b2b2e9521fd3d16a3db25e28da4c62a2e0a3a10c | |
parent | ae2b6d2a74c5fa301dd063564573ee45632b310e (diff) | |
download | stable-queue-94766e8deb6585c236f813afe492b980b2b75fdc.tar.gz |
.39 patches
22 files changed, 1137 insertions, 124 deletions
diff --git a/queue-2.6.39/asus-wmi-remove-__init-from-asus_wmi_platform_init.patch b/queue-2.6.39/asus-wmi-remove-__init-from-asus_wmi_platform_init.patch new file mode 100644 index 0000000000..ddf95bdc34 --- /dev/null +++ b/queue-2.6.39/asus-wmi-remove-__init-from-asus_wmi_platform_init.patch @@ -0,0 +1,31 @@ +From 39ddf3bf6463bc86041e806b43e014d50a144aa4 Mon Sep 17 00:00:00 2001 +From: Joe Perches <joe@perches.com> +Date: Tue, 29 Mar 2011 15:21:32 -0700 +Subject: asus-wmi: Remove __init from asus_wmi_platform_init + +From: Joe Perches <joe@perches.com> + +commit 39ddf3bf6463bc86041e806b43e014d50a144aa4 upstream. + +It's used by a non-init function. + +Signed-off-by: Joe Perches <joe@perches.com> +Signed-off-by: Matthew Garrett <mjg@redhat.com> +Cc: Jiri Slaby <jslaby@suse.cz> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/platform/x86/asus-wmi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/platform/x86/asus-wmi.c ++++ b/drivers/platform/x86/asus-wmi.c +@@ -1223,7 +1223,7 @@ static int asus_wmi_sysfs_init(struct pl + /* + * Platform device + */ +-static int __init asus_wmi_platform_init(struct asus_wmi *asus) ++static int asus_wmi_platform_init(struct asus_wmi *asus) + { + int rv; + diff --git a/queue-2.6.39/ath9k-fix-two-more-bugs-in-tx-power.patch b/queue-2.6.39/ath9k-fix-two-more-bugs-in-tx-power.patch new file mode 100644 index 0000000000..2144ce1f6c --- /dev/null +++ b/queue-2.6.39/ath9k-fix-two-more-bugs-in-tx-power.patch @@ -0,0 +1,73 @@ +From 21fdc87248d1d28492c775e05fa92b3c8c7bc8db Mon Sep 17 00:00:00 2001 +From: Daniel Halperin <dhalperi@cs.washington.edu> +Date: Tue, 31 May 2011 11:59:30 -0700 +Subject: ath9k: fix two more bugs in tx power + +From: Daniel Halperin <dhalperi@cs.washington.edu> + +commit 21fdc87248d1d28492c775e05fa92b3c8c7bc8db upstream. + +This is the same fix as + + commit 841051602e3fa18ea468fe5a177aa92b6eb44b56 + Author: Matteo Croce <technoboy85@gmail.com> + Date: Fri Dec 3 02:25:08 2010 +0100 + + The ath9k driver subtracts 3 dBm to the txpower as with two radios the + signal power is doubled. + The resulting value is assigned in an u16 which overflows and makes + the card work at full power. + +in two more places. I grepped the ath tree and didn't find any others. + +Signed-off-by: Daniel Halperin <dhalperi@cs.washington.edu> +Signed-off-by: John W. Linville <linville@tuxdriver.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/net/wireless/ath/ath9k/ar9003_eeprom.c | 10 ++++++++-- + drivers/net/wireless/ath/ath9k/eeprom_9287.c | 10 ++++++++-- + 2 files changed, 16 insertions(+), 4 deletions(-) + +--- a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c ++++ b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c +@@ -4598,10 +4598,16 @@ static void ar9003_hw_set_power_per_rate + case 1: + break; + case 2: +- scaledPower -= REDUCE_SCALED_POWER_BY_TWO_CHAIN; ++ if (scaledPower > REDUCE_SCALED_POWER_BY_TWO_CHAIN) ++ scaledPower -= REDUCE_SCALED_POWER_BY_TWO_CHAIN; ++ else ++ scaledPower = 0; + break; + case 3: +- scaledPower -= REDUCE_SCALED_POWER_BY_THREE_CHAIN; ++ if (scaledPower > REDUCE_SCALED_POWER_BY_THREE_CHAIN) ++ scaledPower -= REDUCE_SCALED_POWER_BY_THREE_CHAIN; ++ else ++ scaledPower = 0; + break; + } + +--- a/drivers/net/wireless/ath/ath9k/eeprom_9287.c ++++ b/drivers/net/wireless/ath/ath9k/eeprom_9287.c +@@ -522,10 +522,16 @@ static void ath9k_hw_set_ar9287_power_pe + case 1: + break; + case 2: +- scaledPower -= REDUCE_SCALED_POWER_BY_TWO_CHAIN; ++ if (scaledPower > REDUCE_SCALED_POWER_BY_TWO_CHAIN) ++ scaledPower -= REDUCE_SCALED_POWER_BY_TWO_CHAIN; ++ else ++ scaledPower = 0; + break; + case 3: +- scaledPower -= REDUCE_SCALED_POWER_BY_THREE_CHAIN; ++ if (scaledPower > REDUCE_SCALED_POWER_BY_THREE_CHAIN) ++ scaledPower -= REDUCE_SCALED_POWER_BY_THREE_CHAIN; ++ else ++ scaledPower = 0; + break; + } + scaledPower = max((u16)0, scaledPower); diff --git a/queue-2.6.39/ath9k-reset-chip-on-baseband-hang.patch b/queue-2.6.39/ath9k-reset-chip-on-baseband-hang.patch new file mode 100644 index 0000000000..65300b71e0 --- /dev/null +++ b/queue-2.6.39/ath9k-reset-chip-on-baseband-hang.patch @@ -0,0 +1,40 @@ +From a4d86d953b8593791cb29cf2acffd48f9ee6c4f9 Mon Sep 17 00:00:00 2001 +From: Rajkumar Manoharan <rmanoharan@atheros.com> +Date: Fri, 20 May 2011 17:52:10 +0530 +Subject: ath9k: Reset chip on baseband hang + +From: Rajkumar Manoharan <rmanoharan@atheros.com> + +commit a4d86d953b8593791cb29cf2acffd48f9ee6c4f9 upstream. + +Resetting hardware helps to recover from baseband +hang/panic for AR9003 based chips. + +Signed-off-by: Rajkumar Manoharan <rmanoharan@atheros.com> +Signed-off-by: John W. Linville <linville@tuxdriver.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/net/wireless/ath/ath9k/main.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/net/wireless/ath/ath9k/main.c ++++ b/drivers/net/wireless/ath/ath9k/main.c +@@ -633,7 +633,8 @@ void ath9k_tasklet(unsigned long data) + u32 status = sc->intrstatus; + u32 rxmask; + +- if (status & ATH9K_INT_FATAL) { ++ if ((status & ATH9K_INT_FATAL) || ++ (status & ATH9K_INT_BB_WATCHDOG)) { + ath_reset(sc, true); + return; + } +@@ -699,6 +700,7 @@ irqreturn_t ath_isr(int irq, void *dev) + { + #define SCHED_INTR ( \ + ATH9K_INT_FATAL | \ ++ ATH9K_INT_BB_WATCHDOG | \ + ATH9K_INT_RXORN | \ + ATH9K_INT_RXEOL | \ + ATH9K_INT_RX | \ diff --git a/queue-2.6.39/ath9k-set-40-mhz-rate-only-if-hw-is-configured-in-ht40.patch b/queue-2.6.39/ath9k-set-40-mhz-rate-only-if-hw-is-configured-in-ht40.patch new file mode 100644 index 0000000000..4cbfb21cc3 --- /dev/null +++ b/queue-2.6.39/ath9k-set-40-mhz-rate-only-if-hw-is-configured-in-ht40.patch @@ -0,0 +1,45 @@ +From 41e2b05b9598d6bdf91fc20280bfc538d853f769 Mon Sep 17 00:00:00 2001 +From: Rajkumar Manoharan <rmanoharan@atheros.com> +Date: Fri, 20 May 2011 17:52:14 +0530 +Subject: ath9k: set 40 Mhz rate only if hw is configured in ht40 + +From: Rajkumar Manoharan <rmanoharan@atheros.com> + +commit 41e2b05b9598d6bdf91fc20280bfc538d853f769 upstream. + +Whenever there is a channel width change from 40 Mhz to 20 Mhz, +the hardware is reconfigured to ht20. Meantime before doing +the rate control updation, the packets are being transmitted are +selected rate with IEEE80211_TX_RC_40_MHZ_WIDTH. + +While transmitting ht40 rate packets in ht20 mode is causing +baseband panic with AR9003 based chips. + +==== BB update: BB status=0x02001109 ==== +ath: ** BB state: wd=1 det=1 rdar=0 rOFDM=1 rCCK=1 tOFDM=0 tCCK=0 agc=2 +src=0 ** +ath: ** BB WD cntl: cntl1=0xffff0085 cntl2=0x00000004 ** +ath: ** BB mode: BB_gen_controls=0x000033c0 ** +ath: ** BB busy times: rx_clear=99%, rx_frame=0%, tx_frame=0% ** +ath: ==== BB update: done ==== + +Signed-off-by: Rajkumar Manoharan <rmanoharan@atheros.com> +Signed-off-by: John W. Linville <linville@tuxdriver.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/net/wireless/ath/ath9k/rc.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/net/wireless/ath/ath9k/rc.c ++++ b/drivers/net/wireless/ath/ath9k/rc.c +@@ -689,7 +689,8 @@ static void ath_rc_rate_set_series(const + + if (WLAN_RC_PHY_HT(rate_table->info[rix].phy)) { + rate->flags |= IEEE80211_TX_RC_MCS; +- if (WLAN_RC_PHY_40(rate_table->info[rix].phy)) ++ if (WLAN_RC_PHY_40(rate_table->info[rix].phy) && ++ conf_is_ht40(&txrc->hw->conf)) + rate->flags |= IEEE80211_TX_RC_40_MHZ_WIDTH; + if (WLAN_RC_PHY_SGI(rate_table->info[rix].phy)) + rate->flags |= IEEE80211_TX_RC_SHORT_GI; diff --git a/queue-2.6.39/block-blkdev_get-should-access-bd_disk-only-after.patch b/queue-2.6.39/block-blkdev_get-should-access-bd_disk-only-after.patch new file mode 100644 index 0000000000..956b04160c --- /dev/null +++ b/queue-2.6.39/block-blkdev_get-should-access-bd_disk-only-after.patch @@ -0,0 +1,40 @@ +From 4c49ff3fe128ca68dabd07537415c419ad7f82f9 Mon Sep 17 00:00:00 2001 +From: Tejun Heo <tj@kernel.org> +Date: Wed, 1 Jun 2011 08:27:41 +0200 +Subject: block: blkdev_get() should access ->bd_disk only after + success + +From: Tejun Heo <tj@kernel.org> + +commit 4c49ff3fe128ca68dabd07537415c419ad7f82f9 upstream. + +d4dc210f69 (block: don't block events on excl write for non-optical +devices) added dereferencing of bdev->bd_disk to test +GENHD_FL_BLOCK_EVENTS_ON_EXCL_WRITE; however, bdev->bd_disk can be +%NULL if open failed which can lead to an oops. + +Test the flag after testing open was successful, not before. + +Signed-off-by: Tejun Heo <tj@kernel.org> +Reported-by: David Miller <davem@davemloft.net> +Tested-by: David Miller <davem@davemloft.net> +Signed-off-by: Jens Axboe <jaxboe@fusionio.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + fs/block_dev.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/fs/block_dev.c ++++ b/fs/block_dev.c +@@ -1272,8 +1272,8 @@ int blkdev_get(struct block_device *bdev + * individual writeable reference is too fragile given the + * way @mode is used in blkdev_get/put(). + */ +- if ((disk->flags & GENHD_FL_BLOCK_EVENTS_ON_EXCL_WRITE) && +- !res && (mode & FMODE_WRITE) && !bdev->bd_write_holder) { ++ if (!res && (mode & FMODE_WRITE) && !bdev->bd_write_holder && ++ (disk->flags & GENHD_FL_BLOCK_EVENTS_ON_EXCL_WRITE)) { + bdev->bd_write_holder = true; + disk_block_events(disk); + } diff --git a/queue-2.6.39/fix-oops-caused-by-queue-refcounting-failure.patch b/queue-2.6.39/fix-oops-caused-by-queue-refcounting-failure.patch new file mode 100644 index 0000000000..29e71b3691 --- /dev/null +++ b/queue-2.6.39/fix-oops-caused-by-queue-refcounting-failure.patch @@ -0,0 +1,47 @@ +From e73e079bf128d68284efedeba1fbbc18d78610f9 Mon Sep 17 00:00:00 2001 +From: James Bottomley <James.Bottomley@HansenPartnership.com> +Date: Wed, 25 May 2011 15:52:14 -0500 +Subject: [SCSI] Fix oops caused by queue refcounting failure + +From: James Bottomley <James.Bottomley@HansenPartnership.com> + +commit e73e079bf128d68284efedeba1fbbc18d78610f9 upstream. + +In certain circumstances, we can get an oops from a torn down device. +Most notably this is from CD roms trying to call scsi_ioctl. The root +cause of the problem is the fact that after scsi_remove_device() has +been called, the queue is fully torn down. This is actually wrong +since the queue can be used until the sdev release function is called. +Therefore, we add an extra reference to the queue which is released in +sdev->release, so the queue always exists. + +Reported-by: Parag Warudkar <parag.lkml@gmail.com> +Signed-off-by: James Bottomley <jbottomley@parallels.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/scsi/scsi_scan.c | 2 +- + drivers/scsi/scsi_sysfs.c | 1 + + 2 files changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/scsi/scsi_scan.c ++++ b/drivers/scsi/scsi_scan.c +@@ -297,7 +297,7 @@ static struct scsi_device *scsi_alloc_sd + kfree(sdev); + goto out; + } +- ++ blk_get_queue(sdev->request_queue); + sdev->request_queue->queuedata = sdev; + scsi_adjust_queue_depth(sdev, 0, sdev->host->cmd_per_lun); + +--- a/drivers/scsi/scsi_sysfs.c ++++ b/drivers/scsi/scsi_sysfs.c +@@ -322,6 +322,7 @@ static void scsi_device_dev_release_user + kfree(evt); + } + ++ blk_put_queue(sdev->request_queue); + /* NULL queue means the device can't be used */ + sdev->request_queue = NULL; + diff --git a/queue-2.6.39/hwmon-coretemp-fix-tjmax-detection-for-older-cpus.patch b/queue-2.6.39/hwmon-coretemp-fix-tjmax-detection-for-older-cpus.patch new file mode 100644 index 0000000000..d08672b34e --- /dev/null +++ b/queue-2.6.39/hwmon-coretemp-fix-tjmax-detection-for-older-cpus.patch @@ -0,0 +1,66 @@ +From 4f5f71a7abe329bdad81ee6a8e4545054a7cc30a Mon Sep 17 00:00:00 2001 +From: Guenter Roeck <guenter.roeck@ericsson.com> +Date: Tue, 31 May 2011 06:54:21 -0700 +Subject: hwmon: (coretemp) Fix TjMax detection for older CPUs + +From: Guenter Roeck <guenter.roeck@ericsson.com> + +commit 4f5f71a7abe329bdad81ee6a8e4545054a7cc30a upstream. + +Commit a321cedb12904114e2ba5041a3673ca24deb09c9 excludes CPU models 0xe, 0xf, +0x16, and 0x1a from TjMax temperature adjustment, even though several of those +CPUs are known to have TiMax other than 100 degrees C, and even though the code +in adjust_tjmax() explicitly handles those CPUs and points to a Web document +listing several of the affected CPU IDs. + +Reinstate original TjMax adjustment if TjMax can not be determined using the +IA32_TEMPERATURE_TARGET register. + +https://bugzilla.kernel.org/show_bug.cgi?id=32582 + +Signed-off-by: Guenter Roeck <guenter.roeck@ericsson.com> +Cc: Huaxu Wan <huaxu.wan@linux.intel.com> +Cc: Carsten Emde <C.Emde@osadl.org> +Cc: Valdis Kletnieks <valdis.kletnieks@vt.edu> +Cc: Henrique de Moraes Holschuh <hmh@hmh.eng.br> +Cc: Yong Wang <yong.y.wang@linux.intel.com> +Cc: Rudolf Marek <r.marek@assembler.cz> +Cc: Fenghua Yu <fenghua.yu@intel.com> +Tested-by: Jean Delvare <khali@linux-fr.org> +Acked-by: Jean Delvare <khali@linux-fr.org> +Acked-by: Fenghua Yu <fenghua.yu@intel.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/hwmon/coretemp.c | 19 ++----------------- + 1 file changed, 2 insertions(+), 17 deletions(-) + +--- a/drivers/hwmon/coretemp.c ++++ b/drivers/hwmon/coretemp.c +@@ -271,24 +271,9 @@ static int __devinit get_tjmax(struct cp + + /* + * An assumption is made for early CPUs and unreadable MSR. +- * NOTE: the given value may not be correct. ++ * NOTE: the calculated value may not be correct. + */ +- +- switch (c->x86_model) { +- case 0xe: +- case 0xf: +- case 0x16: +- case 0x1a: +- dev_warn(dev, "TjMax is assumed as 100 C!\n"); +- return 100000; +- case 0x17: +- case 0x1c: /* Atom CPUs */ +- return adjust_tjmax(c, id, dev); +- default: +- dev_warn(dev, "CPU (model=0x%x) is not supported yet," +- " using default TjMax of 100C.\n", c->x86_model); +- return 100000; +- } ++ return adjust_tjmax(c, id, dev); + } + + static void __devinit get_ucode_rev_on_cpu(void *edx) diff --git a/queue-2.6.39/hwmon-coretemp-relax-target-temperature-range-check.patch b/queue-2.6.39/hwmon-coretemp-relax-target-temperature-range-check.patch new file mode 100644 index 0000000000..f98a7ae6f0 --- /dev/null +++ b/queue-2.6.39/hwmon-coretemp-relax-target-temperature-range-check.patch @@ -0,0 +1,36 @@ +From 4c6e0f8101e62d8b2d01dc94b835a98b191a1454 Mon Sep 17 00:00:00 2001 +From: Jean Delvare <khali@linux-fr.org> +Date: Tue, 31 May 2011 15:50:51 -0400 +Subject: hwmon: (coretemp) Relax target temperature range check + +From: Jean Delvare <khali@linux-fr.org> + +commit 4c6e0f8101e62d8b2d01dc94b835a98b191a1454 upstream. + +The current temperature range check of MSR_IA32_TEMPERATURE_TARGET +seems too strict to me, some TjMax values documented in +Documentation/hwmon/coretemp wouldn't pass. Relax the check so that +all the documented values pass. + +Signed-off-by: Jean Delvare <khali@linux-fr.org> +Cc: Carsten Emde <C.Emde@osadl.org> +Cc: Fenghua Yu <fenghua.yu@intel.com> +Signed-off-by: Guenter Roeck <guenter.roeck@ericsson.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + + +--- + drivers/hwmon/coretemp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/hwmon/coretemp.c ++++ b/drivers/hwmon/coretemp.c +@@ -263,7 +263,7 @@ static int __devinit get_tjmax(struct cp + * If the TjMax is not plausible, an assumption + * will be used + */ +- if ((val > 80) && (val < 120)) { ++ if (val >= 70 && val <= 125) { + dev_info(dev, "TjMax is %d C.\n", val); + return val * 1000; + } diff --git a/queue-2.6.39/iwl4965-correctly-validate-temperature-value.patch b/queue-2.6.39/iwl4965-correctly-validate-temperature-value.patch new file mode 100644 index 0000000000..85fe30d1ae --- /dev/null +++ b/queue-2.6.39/iwl4965-correctly-validate-temperature-value.patch @@ -0,0 +1,35 @@ +From dfe21582ac5ebc460dda98c67e8589dd506d02cd Mon Sep 17 00:00:00 2001 +From: Stanislaw Gruszka <sgruszka@redhat.com> +Date: Wed, 1 Jun 2011 17:17:57 +0200 +Subject: iwl4965: correctly validate temperature value + +From: Stanislaw Gruszka <sgruszka@redhat.com> + +commit dfe21582ac5ebc460dda98c67e8589dd506d02cd upstream. + +In some cases we can read wrong temperature value. If after that +temperature value will not be updated to good one, we badly configure +tx power parameters and device is unable to send a data. + +Resolves: +https://bugzilla.kernel.org/show_bug.cgi?id=35932 + +Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com> +Signed-off-by: John W. Linville <linville@tuxdriver.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/net/wireless/iwlegacy/iwl-4965.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/wireless/iwlegacy/iwl-4965.c ++++ b/drivers/net/wireless/iwlegacy/iwl-4965.c +@@ -1543,7 +1543,7 @@ static void iwl4965_temperature_calib(st + s32 temp; + + temp = iwl4965_hw_get_temperature(priv); +- if (temp < 0) ++ if (IWL_TX_POWER_TEMPERATURE_OUT_OF_RANGE(temp)) + return; + + if (priv->temperature != temp) { diff --git a/queue-2.6.39/iwl4965-fix-5ghz-operation.patch b/queue-2.6.39/iwl4965-fix-5ghz-operation.patch new file mode 100644 index 0000000000..8acc214086 --- /dev/null +++ b/queue-2.6.39/iwl4965-fix-5ghz-operation.patch @@ -0,0 +1,35 @@ +From aac11c1b351413aa3412e258e2b2dcba31777209 Mon Sep 17 00:00:00 2001 +From: Stanislaw Gruszka <sgruszka@redhat.com> +Date: Tue, 24 May 2011 16:28:55 +0200 +Subject: iwl4965: fix 5GHz operation + +From: Stanislaw Gruszka <sgruszka@redhat.com> + +commit aac11c1b351413aa3412e258e2b2dcba31777209 upstream. + +rx_status.band is used uninitialized, what disallow to work on 5GHz . + +Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com> +Signed-off-by: John W. Linville <linville@tuxdriver.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/net/wireless/iwlegacy/iwl-4965-lib.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/net/wireless/iwlegacy/iwl-4965-lib.c ++++ b/drivers/net/wireless/iwlegacy/iwl-4965-lib.c +@@ -628,11 +628,11 @@ void iwl4965_rx_reply_rx(struct iwl_priv + + /* rx_status carries information about the packet to mac80211 */ + rx_status.mactime = le64_to_cpu(phy_res->timestamp); ++ rx_status.band = (phy_res->phy_flags & RX_RES_PHY_FLAGS_BAND_24_MSK) ? ++ IEEE80211_BAND_2GHZ : IEEE80211_BAND_5GHZ; + rx_status.freq = + ieee80211_channel_to_frequency(le16_to_cpu(phy_res->channel), + rx_status.band); +- rx_status.band = (phy_res->phy_flags & RX_RES_PHY_FLAGS_BAND_24_MSK) ? +- IEEE80211_BAND_2GHZ : IEEE80211_BAND_5GHZ; + rx_status.rate_idx = + iwl4965_hwrate_to_mac80211_idx(rate_n_flags, rx_status.band); + rx_status.flag = 0; diff --git a/queue-2.6.39/mm-fix-enospc-returned-by-handle_mm_fault.patch b/queue-2.6.39/mm-fix-enospc-returned-by-handle_mm_fault.patch new file mode 100644 index 0000000000..606cae9b0b --- /dev/null +++ b/queue-2.6.39/mm-fix-enospc-returned-by-handle_mm_fault.patch @@ -0,0 +1,37 @@ +From e0dcd8a05be438b3d2e49ef61441ea3a463663f8 Mon Sep 17 00:00:00 2001 +From: Hugh Dickins <hughd@google.com> +Date: Sun, 5 Jun 2011 22:03:13 -0700 +Subject: mm: fix ENOSPC returned by handle_mm_fault() + +From: Hugh Dickins <hughd@google.com> + +commit e0dcd8a05be438b3d2e49ef61441ea3a463663f8 upstream. + +Al Viro observes that in the hugetlb case, handle_mm_fault() may return +a value of the kind ENOSPC when its caller is expecting a value of the +kind VM_FAULT_SIGBUS: fix alloc_huge_page()'s failure returns. + +Signed-off-by: Hugh Dickins <hughd@google.com> +Acked-by: Al Viro <viro@zeniv.linux.org.uk> +Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + mm/hugetlb.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/mm/hugetlb.c ++++ b/mm/hugetlb.c +@@ -1033,10 +1033,10 @@ static struct page *alloc_huge_page(stru + */ + chg = vma_needs_reservation(h, vma, addr); + if (chg < 0) +- return ERR_PTR(chg); ++ return ERR_PTR(-VM_FAULT_OOM); + if (chg) + if (hugetlb_get_quota(inode->i_mapping, chg)) +- return ERR_PTR(-ENOSPC); ++ return ERR_PTR(-VM_FAULT_SIGBUS); + + spin_lock(&hugetlb_lock); + page = dequeue_huge_page_vma(h, vma, addr, avoid_reserve); diff --git a/queue-2.6.39/nbd-limit-module-parameters-to-a-sane-value.patch b/queue-2.6.39/nbd-limit-module-parameters-to-a-sane-value.patch new file mode 100644 index 0000000000..7f63c34651 --- /dev/null +++ b/queue-2.6.39/nbd-limit-module-parameters-to-a-sane-value.patch @@ -0,0 +1,88 @@ +From 3b2710824e00d238554c13b5add347e6c701ab1a Mon Sep 17 00:00:00 2001 +From: Namhyung Kim <namhyung@gmail.com> +Date: Sat, 28 May 2011 14:44:46 +0200 +Subject: nbd: limit module parameters to a sane value + +From: Namhyung Kim <namhyung@gmail.com> + +commit 3b2710824e00d238554c13b5add347e6c701ab1a upstream. + +The 'max_part' parameter controls the number of maximum partition +a nbd device can have. However if a user specifies very large +value it would exceed the limitation of device minor number and +can cause a kernel oops (or, at least, produce invalid device +nodes in some cases). + +In addition, specifying large 'nbds_max' value causes same +problem for the same reason. + +On my desktop, following command results to the kernel bug: + +$ sudo modprobe nbd max_part=100000 + kernel BUG at /media/Linux_Data/project/linux/fs/sysfs/group.c:65! + invalid opcode: 0000 [#1] SMP + last sysfs file: /sys/devices/virtual/block/nbd4/range + CPU 1 + Modules linked in: nbd(+) bridge stp llc kvm_intel kvm asus_atk0110 sg sr_mod cdrom + + Pid: 2522, comm: modprobe Tainted: G W 2.6.39-leonard+ #159 System manufacturer System Product Name/P5G41TD-M PRO + RIP: 0010:[<ffffffff8115aa08>] [<ffffffff8115aa08>] internal_create_group+0x2f/0x166 + RSP: 0018:ffff8801009f1de8 EFLAGS: 00010246 + RAX: 00000000ffffffef RBX: ffff880103920478 RCX: 00000000000a7bd3 + RDX: ffffffff81a2dbe0 RSI: 0000000000000000 RDI: ffff880103920478 + RBP: ffff8801009f1e38 R08: ffff880103920468 R09: ffff880103920478 + R10: ffff8801009f1de8 R11: ffff88011eccbb68 R12: ffffffff81a2dbe0 + R13: ffff880103920468 R14: 0000000000000000 R15: ffff880103920400 + FS: 00007f3c49de9700(0000) GS:ffff88011f800000(0000) knlGS:0000000000000000 + CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b + CR2: 00007f3b7fe7c000 CR3: 00000000cd58d000 CR4: 00000000000406e0 + DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 + DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 + Process modprobe (pid: 2522, threadinfo ffff8801009f0000, task ffff8801009a93a0) + Stack: + ffff8801009f1e58 ffffffff812e8f6e ffff8801009f1e58 ffffffff812e7a80 + ffff880000000010 ffff880103920400 ffff8801002fd0c0 ffff880103920468 + 0000000000000011 ffff880103920400 ffff8801009f1e48 ffffffff8115ab6a + Call Trace: + [<ffffffff812e8f6e>] ? device_add+0x4f1/0x5e4 + [<ffffffff812e7a80>] ? dev_set_name+0x41/0x43 + [<ffffffff8115ab6a>] sysfs_create_group+0x13/0x15 + [<ffffffff810b857e>] blk_trace_init_sysfs+0x14/0x16 + [<ffffffff811ee58b>] blk_register_queue+0x4c/0xfd + [<ffffffff811f3bdf>] add_disk+0xe4/0x29c + [<ffffffffa007e2ab>] nbd_init+0x2ab/0x30d [nbd] + [<ffffffffa007e000>] ? 0xffffffffa007dfff + [<ffffffff8100020f>] do_one_initcall+0x7f/0x13e + [<ffffffff8107ab0a>] sys_init_module+0xa1/0x1e3 + [<ffffffff814f3542>] system_call_fastpath+0x16/0x1b + Code: 41 57 41 56 41 55 41 54 53 48 83 ec 28 0f 1f 44 00 00 48 89 fb 41 89 f6 49 89 d4 48 85 ff 74 0b 85 f6 75 0b 48 83 + 7f 30 00 75 14 <0f> 0b eb fe b9 ea ff ff ff 48 83 7f 30 00 0f 84 09 01 00 00 49 + RIP [<ffffffff8115aa08>] internal_create_group+0x2f/0x166 + RSP <ffff8801009f1de8> + ---[ end trace 753285ffbf72c57c ]--- + +Signed-off-by: Namhyung Kim <namhyung@gmail.com> +Cc: Laurent Vivier <Laurent.Vivier@bull.net> +Cc: Paul Clements <Paul.Clements@steeleye.com> +Signed-off-by: Jens Axboe <jaxboe@fusionio.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/block/nbd.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/block/nbd.c ++++ b/drivers/block/nbd.c +@@ -756,6 +756,12 @@ static int __init nbd_init(void) + if (max_part > 0) + part_shift = fls(max_part); + ++ if ((1UL << part_shift) > DISK_MAX_PARTS) ++ return -EINVAL; ++ ++ if (nbds_max > 1UL << (MINORBITS - part_shift)) ++ return -EINVAL; ++ + for (i = 0; i < nbds_max; i++) { + struct gendisk *disk = alloc_disk(1 << part_shift); + if (!disk) diff --git a/queue-2.6.39/pci-set-pcie-maxpayload-for-card-during-hotplug-insertion.patch b/queue-2.6.39/pci-set-pcie-maxpayload-for-card-during-hotplug-insertion.patch new file mode 100644 index 0000000000..9894977c27 --- /dev/null +++ b/queue-2.6.39/pci-set-pcie-maxpayload-for-card-during-hotplug-insertion.patch @@ -0,0 +1,85 @@ +From e522a7126c7c144a1dd14c6f217ac31e71082b1d Mon Sep 17 00:00:00 2001 +From: "Jordan_Hargrave@Dell.com" <Jordan_Hargrave@Dell.com> +Date: Mon, 9 May 2011 15:24:55 -0500 +Subject: PCI: Set PCIE maxpayload for card during hotplug insertion + +From: "Jordan_Hargrave@Dell.com" <Jordan_Hargrave@Dell.com> + +commit e522a7126c7c144a1dd14c6f217ac31e71082b1d upstream. + +The following patch sets the MaxPayload setting to match the parent +reading when inserting a PCIE card into a hotplug slot. On our system, +the upstream bridge is set to 256, but when inserting a card, the card +setting defaults to 128. As soon as I/O is performed to the card it +starts receiving errors since the payload size is too small. + +Reviewed-by: Kenji Kaneshige <kaneshige.kenji@jp.fujitsu.com> +Signed-off-by: Jordan Hargrave <jordan_hargrave@dell.com> +Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/pci/hotplug/pcihp_slot.c | 45 +++++++++++++++++++++++++++++++++++++++ + 1 file changed, 45 insertions(+) + +--- a/drivers/pci/hotplug/pcihp_slot.c ++++ b/drivers/pci/hotplug/pcihp_slot.c +@@ -158,6 +158,47 @@ static void program_hpp_type2(struct pci + */ + } + ++/* Program PCIE MaxPayload setting on device: ensure parent maxpayload <= device */ ++static int pci_set_payload(struct pci_dev *dev) ++{ ++ int pos, ppos; ++ u16 pctl, psz; ++ u16 dctl, dsz, dcap, dmax; ++ struct pci_dev *parent; ++ ++ parent = dev->bus->self; ++ pos = pci_find_capability(dev, PCI_CAP_ID_EXP); ++ if (!pos) ++ return 0; ++ ++ /* Read Device MaxPayload capability and setting */ ++ pci_read_config_word(dev, pos + PCI_EXP_DEVCTL, &dctl); ++ pci_read_config_word(dev, pos + PCI_EXP_DEVCAP, &dcap); ++ dsz = (dctl & PCI_EXP_DEVCTL_PAYLOAD) >> 5; ++ dmax = (dcap & PCI_EXP_DEVCAP_PAYLOAD); ++ ++ /* Read Parent MaxPayload setting */ ++ ppos = pci_find_capability(parent, PCI_CAP_ID_EXP); ++ if (!ppos) ++ return 0; ++ pci_read_config_word(parent, ppos + PCI_EXP_DEVCTL, &pctl); ++ psz = (pctl & PCI_EXP_DEVCTL_PAYLOAD) >> 5; ++ ++ /* If parent payload > device max payload -> error ++ * If parent payload > device payload -> set speed ++ * If parent payload <= device payload -> do nothing ++ */ ++ if (psz > dmax) ++ return -1; ++ else if (psz > dsz) { ++ dev_info(&dev->dev, "Setting MaxPayload to %d\n", 128 << psz); ++ pci_write_config_word(dev, pos + PCI_EXP_DEVCTL, ++ (dctl & ~PCI_EXP_DEVCTL_PAYLOAD) + ++ (psz << 5)); ++ } ++ return 0; ++} ++ + void pci_configure_slot(struct pci_dev *dev) + { + struct pci_dev *cdev; +@@ -169,6 +210,10 @@ void pci_configure_slot(struct pci_dev * + (dev->class >> 8) == PCI_CLASS_BRIDGE_PCI))) + return; + ++ ret = pci_set_payload(dev); ++ if (ret) ++ dev_warn(&dev->dev, "could not set device max payload\n"); ++ + memset(&hpp, 0, sizeof(hpp)); + ret = pci_get_hp_params(dev, &hpp); + if (ret) diff --git a/queue-2.6.39/powerpc-fix-32-bit-smp-build.patch b/queue-2.6.39/powerpc-fix-32-bit-smp-build.patch new file mode 100644 index 0000000000..9f2d15dd9e --- /dev/null +++ b/queue-2.6.39/powerpc-fix-32-bit-smp-build.patch @@ -0,0 +1,36 @@ +From 6de06f313a65d0ecabf055e708d082002b568866 Mon Sep 17 00:00:00 2001 +From: Josh Boyer <jwboyer@linux.vnet.ibm.com> +Date: Fri, 20 May 2011 16:22:25 -0400 +Subject: powerpc: Fix 32-bit SMP build + +From: Josh Boyer <jwboyer@linux.vnet.ibm.com> + +commit 6de06f313a65d0ecabf055e708d082002b568866 upstream. + +Commit 69e3cea8d5fd526 ("powerpc/smp: Make start_secondary_resume +available to all CPU variants") introduced start_secondary_resume to +misc_32.S, however it uses a 64-bit instruction which is not valid on +32-bit platforms. Use 'stw' instead. + +Reported-by: Richard Cochran <richardcochran@gmail.com> +Tested-by: Richard Cochran <richardcochran@gmail.com> +Signed-off-by: Josh Boyer <jwboyer@linux.vnet.ibm.com> +Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> +Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + arch/powerpc/kernel/head_32.S | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/powerpc/kernel/head_32.S ++++ b/arch/powerpc/kernel/head_32.S +@@ -896,7 +896,7 @@ _GLOBAL(start_secondary_resume) + rlwinm r1,r1,0,0,(31-THREAD_SHIFT) /* current_thread_info() */ + addi r1,r1,THREAD_SIZE-STACK_FRAME_OVERHEAD + li r3,0 +- std r3,0(r1) /* Zero the stack frame pointer */ ++ stw r3,0(r1) /* Zero the stack frame pointer */ + bl start_secondary + b . + #endif /* CONFIG_SMP */ diff --git a/queue-2.6.39/rtlwifi-rtl8192c-common-rtl8192ce-fix-for-ht40-regression.patch b/queue-2.6.39/rtlwifi-rtl8192c-common-rtl8192ce-fix-for-ht40-regression.patch deleted file mode 100644 index 8a5ef567bb..0000000000 --- a/queue-2.6.39/rtlwifi-rtl8192c-common-rtl8192ce-fix-for-ht40-regression.patch +++ /dev/null @@ -1,123 +0,0 @@ -From 099fb8ab1e57e5d609ac686cc0ab6d1835a79155 Mon Sep 17 00:00:00 2001 -From: Larry Finger <Larry.Finger@lwfinger.net> -Date: Sat, 14 May 2011 10:15:17 -0500 -Subject: rtlwifi: rtl8192c-common: rtl8192ce: Fix for HT40 regression - -From: Larry Finger <Larry.Finger@lwfinger.net> - -commit 099fb8ab1e57e5d609ac686cc0ab6d1835a79155 upstream. - -The changes that were made to rtl8192ce when rtl8192cu was added broke -HT40. The errors included a typo in rtlwifi, a missing routine in -rtl8192ce and a missing callback of that routine in rtl8192c-common. - -This patch fixes the regression reported in Bug #35082. - -Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net> -Signed-off-by: John W. Linville <linville@tuxdriver.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> - ---- - drivers/net/wireless/rtlwifi/ps.c | 2 - drivers/net/wireless/rtlwifi/rtl8192ce/phy.c | 69 +++++++++++++++++++++++++++ - drivers/net/wireless/rtlwifi/rtl8192ce/phy.h | 1 - 3 files changed, 71 insertions(+), 1 deletion(-) - ---- a/drivers/net/wireless/rtlwifi/ps.c -+++ b/drivers/net/wireless/rtlwifi/ps.c -@@ -205,7 +205,7 @@ static void _rtl_ps_inactive_ps(struct i - rtl_ps_set_rf_state(hw, ppsc->inactive_pwrstate, - RF_CHANGE_BY_IPS, false); - -- if (ppsc->inactive_pwrstate == ERFOFF && -+ if (ppsc->inactive_pwrstate == ERFON && - rtlhal->interface == INTF_PCI) { - if (ppsc->reg_rfps_level & RT_RF_OFF_LEVL_ASPM) { - rtlpriv->intf_ops->enable_aspm(hw); ---- a/drivers/net/wireless/rtlwifi/rtl8192ce/phy.c -+++ b/drivers/net/wireless/rtlwifi/rtl8192ce/phy.c -@@ -432,6 +432,75 @@ void rtl92ce_phy_set_bw_mode_callback(st - RT_TRACE(rtlpriv, COMP_SCAN, DBG_TRACE, ("<==\n")); - } - -+void rtl92ce_phy_set_bw_mode_callback(struct ieee80211_hw *hw) -+{ -+ struct rtl_priv *rtlpriv = rtl_priv(hw); -+ struct rtl_hal *rtlhal = rtl_hal(rtl_priv(hw)); -+ struct rtl_phy *rtlphy = &(rtlpriv->phy); -+ struct rtl_mac *mac = rtl_mac(rtl_priv(hw)); -+ u8 reg_bw_opmode; -+ u8 reg_prsr_rsc; -+ -+ RT_TRACE(rtlpriv, COMP_SCAN, DBG_TRACE, -+ ("Switch to %s bandwidth\n", -+ rtlphy->current_chan_bw == HT_CHANNEL_WIDTH_20 ? -+ "20MHz" : "40MHz")) -+ -+ if (is_hal_stop(rtlhal)) { -+ rtlphy->set_bwmode_inprogress = false; -+ return; -+ } -+ -+ reg_bw_opmode = rtl_read_byte(rtlpriv, REG_BWOPMODE); -+ reg_prsr_rsc = rtl_read_byte(rtlpriv, REG_RRSR + 2); -+ -+ switch (rtlphy->current_chan_bw) { -+ case HT_CHANNEL_WIDTH_20: -+ reg_bw_opmode |= BW_OPMODE_20MHZ; -+ rtl_write_byte(rtlpriv, REG_BWOPMODE, reg_bw_opmode); -+ break; -+ case HT_CHANNEL_WIDTH_20_40: -+ reg_bw_opmode &= ~BW_OPMODE_20MHZ; -+ rtl_write_byte(rtlpriv, REG_BWOPMODE, reg_bw_opmode); -+ reg_prsr_rsc = -+ (reg_prsr_rsc & 0x90) | (mac->cur_40_prime_sc << 5); -+ rtl_write_byte(rtlpriv, REG_RRSR + 2, reg_prsr_rsc); -+ break; -+ default: -+ RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG, -+ ("unknown bandwidth: %#X\n", rtlphy->current_chan_bw)); -+ break; -+ } -+ -+ switch (rtlphy->current_chan_bw) { -+ case HT_CHANNEL_WIDTH_20: -+ rtl_set_bbreg(hw, RFPGA0_RFMOD, BRFMOD, 0x0); -+ rtl_set_bbreg(hw, RFPGA1_RFMOD, BRFMOD, 0x0); -+ rtl_set_bbreg(hw, RFPGA0_ANALOGPARAMETER2, BIT(10), 1); -+ break; -+ case HT_CHANNEL_WIDTH_20_40: -+ rtl_set_bbreg(hw, RFPGA0_RFMOD, BRFMOD, 0x1); -+ rtl_set_bbreg(hw, RFPGA1_RFMOD, BRFMOD, 0x1); -+ -+ rtl_set_bbreg(hw, RCCK0_SYSTEM, BCCK_SIDEBAND, -+ (mac->cur_40_prime_sc >> 1)); -+ rtl_set_bbreg(hw, ROFDM1_LSTF, 0xC00, mac->cur_40_prime_sc); -+ rtl_set_bbreg(hw, RFPGA0_ANALOGPARAMETER2, BIT(10), 0); -+ -+ rtl_set_bbreg(hw, 0x818, (BIT(26) | BIT(27)), -+ (mac->cur_40_prime_sc == -+ HAL_PRIME_CHNL_OFFSET_LOWER) ? 2 : 1); -+ break; -+ default: -+ RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG, -+ ("unknown bandwidth: %#X\n", rtlphy->current_chan_bw)); -+ break; -+ } -+ rtl92ce_phy_rf6052_set_bandwidth(hw, rtlphy->current_chan_bw); -+ rtlphy->set_bwmode_inprogress = false; -+ RT_TRACE(rtlpriv, COMP_SCAN, DBG_TRACE, ("<==\n")); -+} -+ - void _rtl92ce_phy_lc_calibrate(struct ieee80211_hw *hw, bool is2t) - { - u8 tmpreg; ---- a/drivers/net/wireless/rtlwifi/rtl8192ce/phy.h -+++ b/drivers/net/wireless/rtlwifi/rtl8192ce/phy.h -@@ -250,5 +250,6 @@ bool _rtl92ce_phy_config_mac_with_header - void _rtl92c_phy_init_bb_rf_register_definition(struct ieee80211_hw *hw); - bool _rtl92c_phy_bb8192c_config_parafile(struct ieee80211_hw *hw); - void _rtl92c_phy_set_rf_sleep(struct ieee80211_hw *hw); -+void rtl92ce_phy_set_bw_mode_callback(struct ieee80211_hw *hw); - - #endif diff --git a/queue-2.6.39/serial-core-do-not-set-dtr-rts-twice-on-startup.patch b/queue-2.6.39/serial-core-do-not-set-dtr-rts-twice-on-startup.patch new file mode 100644 index 0000000000..25f31f88d4 --- /dev/null +++ b/queue-2.6.39/serial-core-do-not-set-dtr-rts-twice-on-startup.patch @@ -0,0 +1,48 @@ +From 303a7a1199c20f7c9452f024a6e17bf348b6b398 Mon Sep 17 00:00:00 2001 +From: Jiri Slaby <jslaby@suse.cz> +Date: Wed, 30 Mar 2011 00:10:56 +0200 +Subject: serial: core, do not set DTR/RTS twice on startup + +From: Jiri Slaby <jslaby@suse.cz> + +commit 303a7a1199c20f7c9452f024a6e17bf348b6b398 upstream. + +In .dtr_rts we do: + uart_set_mctrl(uport, TIOCM_DTR | TIOCM_RTS) +and call uart_update_termios. It does: + uart_set_mctrl(port, TIOCM_DTR | TIOCM_RTS) +once again. As the only callsite of uart_update_termios is .dtr_rts, +remove the uart_set_mctrl from uart_update_termios to not set it twice. + +Signed-off-by: Jiri Slaby <jslaby@suse.cz> +Cc: Alan Cox <alan@lxorguk.ukuu.org.uk> +Cc: Arnd Bergmann <arnd@arndb.de> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/tty/serial/serial_core.c | 14 -------------- + 1 file changed, 14 deletions(-) + +--- a/drivers/tty/serial/serial_core.c ++++ b/drivers/tty/serial/serial_core.c +@@ -1483,20 +1483,6 @@ static void uart_hangup(struct tty_struc + static void uart_update_termios(struct tty_struct *tty, + struct uart_state *state) + { +- struct uart_port *port = state->uart_port; +- +- /* +- * If the device failed to grab its irq resources, +- * or some other error occurred, don't try to talk +- * to the port hardware. +- */ +- if (!(tty->flags & (1 << TTY_IO_ERROR))) { +- /* +- * And finally enable the RTS and DTR signals. +- */ +- if (tty->termios->c_cflag & CBAUD) +- uart_set_mctrl(port, TIOCM_DTR | TIOCM_RTS); +- } + } + + static int uart_carrier_raised(struct tty_port *port) diff --git a/queue-2.6.39/serial-core-move-termios-handling-to-uart_startup.patch b/queue-2.6.39/serial-core-move-termios-handling-to-uart_startup.patch new file mode 100644 index 0000000000..cfa55bdb3b --- /dev/null +++ b/queue-2.6.39/serial-core-move-termios-handling-to-uart_startup.patch @@ -0,0 +1,84 @@ +From c7d7abff40c27f82fe78b1091ab3fad69b2546f9 Mon Sep 17 00:00:00 2001 +From: Jiri Slaby <jslaby@suse.cz> +Date: Wed, 30 Mar 2011 00:10:55 +0200 +Subject: serial: core, move termios handling to uart_startup + +From: Jiri Slaby <jslaby@suse.cz> + +commit c7d7abff40c27f82fe78b1091ab3fad69b2546f9 upstream. + +We should not fiddle with speed and cflags in .dtr_rts hook. Actually +we might not have tty at that moment already. + +So move the console cflag copy and speed setup into uart_startup. +Actually the speed setup is already there, but we need to call it +unconditionally (uart_startup is called from uart_open with hw_init = +0). + +This means we move uart_change_speed before dtr/rts setup in .dtr_rts. +But this should not matter as the setup should be called after +uart_change_speed anyway. +Before: After: +dtr/rts setup (dtr_rts) uart_change_speed (startup) +uart_change_speed (update_termios) dtr/rts setup (dtr_rts) +dtr/rts setup (update_termios) dtr/rts setup (update_termios) + +The second setup will dismiss with the next patch. + +Signed-off-by: Jiri Slaby <jslaby@suse.cz> +Cc: Alan Cox <alan@lxorguk.ukuu.org.uk> +Cc: Arnd Bergmann <arnd@arndb.de> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/tty/serial/serial_core.c | 24 +++++++++--------------- + 1 file changed, 9 insertions(+), 15 deletions(-) + +--- a/drivers/tty/serial/serial_core.c ++++ b/drivers/tty/serial/serial_core.c +@@ -172,12 +172,16 @@ static int uart_startup(struct tty_struc + + retval = uport->ops->startup(uport); + if (retval == 0) { +- if (init_hw) { +- /* +- * Initialise the hardware port settings. +- */ +- uart_change_speed(tty, state, NULL); ++ if (uart_console(uport) && uport->cons->cflag) { ++ tty->termios->c_cflag = uport->cons->cflag; ++ uport->cons->cflag = 0; ++ } ++ /* ++ * Initialise the hardware port settings. ++ */ ++ uart_change_speed(tty, state, NULL); + ++ if (init_hw) { + /* + * Setup the RTS and DTR signals once the + * port is open and ready to respond. +@@ -1481,11 +1485,6 @@ static void uart_update_termios(struct t + { + struct uart_port *port = state->uart_port; + +- if (uart_console(port) && port->cons->cflag) { +- tty->termios->c_cflag = port->cons->cflag; +- port->cons->cflag = 0; +- } +- + /* + * If the device failed to grab its irq resources, + * or some other error occurred, don't try to talk +@@ -1493,11 +1492,6 @@ static void uart_update_termios(struct t + */ + if (!(tty->flags & (1 << TTY_IO_ERROR))) { + /* +- * Make termios settings take effect. +- */ +- uart_change_speed(tty, state, NULL); +- +- /* + * And finally enable the RTS and DTR signals. + */ + if (tty->termios->c_cflag & CBAUD) diff --git a/queue-2.6.39/serial-core-remove-uart_update_termios.patch b/queue-2.6.39/serial-core-remove-uart_update_termios.patch new file mode 100644 index 0000000000..c2c9655608 --- /dev/null +++ b/queue-2.6.39/serial-core-remove-uart_update_termios.patch @@ -0,0 +1,67 @@ +From 6f5c24ad0f7619502199185a026a228174a27e68 Mon Sep 17 00:00:00 2001 +From: Jiri Slaby <jslaby@suse.cz> +Date: Wed, 30 Mar 2011 00:10:57 +0200 +Subject: serial: core, remove uart_update_termios + +From: Jiri Slaby <jslaby@suse.cz> + +commit 6f5c24ad0f7619502199185a026a228174a27e68 upstream. + +Now, uart_update_termios is empty, so it's time to remove it. We no +longer need a live tty in .dtr_rts. So this should prune all the bugs +where tty is zeroed in port->tty during tty_port_block_til_ready. + +There is one thing to note. We don't set ASYNC_NORMAL_ACTIVE now. It's +because this is done already in tty_port_block_til_ready. + +Signed-off-by: Jiri Slaby <jslaby@suse.cz> +Cc: Alan Cox <alan@lxorguk.ukuu.org.uk> +Cc: Arnd Bergmann <arnd@arndb.de> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/tty/serial/serial_core.c | 25 +------------------------ + 1 file changed, 1 insertion(+), 24 deletions(-) + +--- a/drivers/tty/serial/serial_core.c ++++ b/drivers/tty/serial/serial_core.c +@@ -1470,21 +1470,6 @@ static void uart_hangup(struct tty_struc + mutex_unlock(&port->mutex); + } + +-/** +- * uart_update_termios - update the terminal hw settings +- * @tty: tty associated with UART +- * @state: UART to update +- * +- * Copy across the serial console cflag setting into the termios settings +- * for the initial open of the port. This allows continuity between the +- * kernel settings, and the settings init adopts when it opens the port +- * for the first time. +- */ +-static void uart_update_termios(struct tty_struct *tty, +- struct uart_state *state) +-{ +-} +- + static int uart_carrier_raised(struct tty_port *port) + { + struct uart_state *state = container_of(port, struct uart_state, port); +@@ -1504,16 +1489,8 @@ static void uart_dtr_rts(struct tty_port + struct uart_state *state = container_of(port, struct uart_state, port); + struct uart_port *uport = state->uart_port; + +- if (onoff) { ++ if (onoff) + uart_set_mctrl(uport, TIOCM_DTR | TIOCM_RTS); +- +- /* +- * If this is the first open to succeed, +- * adjust things to suit. +- */ +- if (!test_and_set_bit(ASYNCB_NORMAL_ACTIVE, &port->flags)) +- uart_update_termios(port->tty, state); +- } + else + uart_clear_mctrl(uport, TIOCM_DTR | TIOCM_RTS); + } diff --git a/queue-2.6.39/series b/queue-2.6.39/series index ffe62ad8a4..ed15c6b3bf 100644 --- a/queue-2.6.39/series +++ b/queue-2.6.39/series @@ -8,5 +8,24 @@ intel-iommu-use-coherent-dma-mask-when-requested.patch intel-iommu-remove-host-bridge-devices-from-identity.patch intel-iommu-add-domain-check-in-domain_remove_one_dev_info.patch powerpc-4xx-fix-regression-in-smp-on-476.patch -rtlwifi-rtl8192c-common-rtl8192ce-fix-for-ht40-regression.patch arch-tile-allocate-pci-irqs-later-in-boot.patch +ubifs-fix-shrinker-object-count-reports.patch +ubifs-fix-memory-leak-on-error-path.patch +block-blkdev_get-should-access-bd_disk-only-after.patch +nbd-limit-module-parameters-to-a-sane-value.patch +fix-oops-caused-by-queue-refcounting-failure.patch +ath9k-reset-chip-on-baseband-hang.patch +ath9k-set-40-mhz-rate-only-if-hw-is-configured-in-ht40.patch +ath9k-fix-two-more-bugs-in-tx-power.patch +hwmon-coretemp-fix-tjmax-detection-for-older-cpus.patch +hwmon-coretemp-relax-target-temperature-range-check.patch +iwl4965-fix-5ghz-operation.patch +iwl4965-correctly-validate-temperature-value.patch +zd1211rw-fix-to-work-on-ohci.patch +mm-fix-enospc-returned-by-handle_mm_fault.patch +serial-core-move-termios-handling-to-uart_startup.patch +serial-core-do-not-set-dtr-rts-twice-on-startup.patch +serial-core-remove-uart_update_termios.patch +pci-set-pcie-maxpayload-for-card-during-hotplug-insertion.patch +powerpc-fix-32-bit-smp-build.patch +asus-wmi-remove-__init-from-asus_wmi_platform_init.patch diff --git a/queue-2.6.39/ubifs-fix-memory-leak-on-error-path.patch b/queue-2.6.39/ubifs-fix-memory-leak-on-error-path.patch new file mode 100644 index 0000000000..63b3aa8178 --- /dev/null +++ b/queue-2.6.39/ubifs-fix-memory-leak-on-error-path.patch @@ -0,0 +1,31 @@ +From 812eb258311f89bcd664a34a620f249d54a2cd83 Mon Sep 17 00:00:00 2001 +From: Artem Bityutskiy <Artem.Bityutskiy@nokia.com> +Date: Tue, 31 May 2011 08:40:40 +0300 +Subject: UBIFS: fix memory leak on error path + +From: Artem Bityutskiy <Artem.Bityutskiy@nokia.com> + +commit 812eb258311f89bcd664a34a620f249d54a2cd83 upstream. + +UBIFS leaks memory on error path in 'ubifs_jnl_update()' in case of write +failure because it forgets to free the 'struct ubifs_dent_node *dent' object. +Although the object is small, the alignment can make it large - e.g., 2KiB +if the min. I/O unit is 2KiB. + +Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy@nokia.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + fs/ubifs/journal.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/fs/ubifs/journal.c ++++ b/fs/ubifs/journal.c +@@ -666,6 +666,7 @@ out_free: + + out_release: + release_head(c, BASEHD); ++ kfree(dent); + out_ro: + ubifs_ro_mode(c, err); + if (last_reference) diff --git a/queue-2.6.39/ubifs-fix-shrinker-object-count-reports.patch b/queue-2.6.39/ubifs-fix-shrinker-object-count-reports.patch new file mode 100644 index 0000000000..624e08534d --- /dev/null +++ b/queue-2.6.39/ubifs-fix-shrinker-object-count-reports.patch @@ -0,0 +1,40 @@ +From cf610bf4199770420629d3bc273494bd27ad6c1d Mon Sep 17 00:00:00 2001 +From: Artem Bityutskiy <Artem.Bityutskiy@nokia.com> +Date: Tue, 31 May 2011 07:03:21 +0300 +Subject: UBIFS: fix shrinker object count reports + +From: Artem Bityutskiy <Artem.Bityutskiy@nokia.com> + +commit cf610bf4199770420629d3bc273494bd27ad6c1d upstream. + +Sometimes VM asks the shrinker to return amount of objects it can shrink, +and we return the ubifs_clean_zn_cnt in that case. However, it is possible +that this counter is negative for a short period of time, due to the way +UBIFS TNC code updates it. And I can observe the following warnings sometimes: + +shrink_slab: ubifs_shrinker+0x0/0x2b7 [ubifs] negative objects to delete nr=-8541616642706119788 + +This patch makes sure UBIFS never returns negative count of objects. + +Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy@nokia.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + fs/ubifs/shrinker.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/fs/ubifs/shrinker.c ++++ b/fs/ubifs/shrinker.c +@@ -283,7 +283,11 @@ int ubifs_shrinker(struct shrinker *shri + long clean_zn_cnt = atomic_long_read(&ubifs_clean_zn_cnt); + + if (nr == 0) +- return clean_zn_cnt; ++ /* ++ * Due to the way UBIFS updates the clean znode counter it may ++ * temporarily be negative. ++ */ ++ return clean_zn_cnt >= 0 ? clean_zn_cnt : 1; + + if (!clean_zn_cnt) { + /* diff --git a/queue-2.6.39/zd1211rw-fix-to-work-on-ohci.patch b/queue-2.6.39/zd1211rw-fix-to-work-on-ohci.patch new file mode 100644 index 0000000000..57981887ee --- /dev/null +++ b/queue-2.6.39/zd1211rw-fix-to-work-on-ohci.patch @@ -0,0 +1,153 @@ +From 59342f6a6bc35df623fb44784daa5e1077063b8f Mon Sep 17 00:00:00 2001 +From: Jussi Kivilinna <jussi.kivilinna@mbnet.fi> +Date: Mon, 30 May 2011 10:15:47 +0300 +Subject: zd1211rw: fix to work on OHCI + +From: Jussi Kivilinna <jussi.kivilinna@mbnet.fi> + +commit 59342f6a6bc35df623fb44784daa5e1077063b8f upstream. + +zd1211 devices register 'EP 4 OUT' endpoint as Interrupt type on USB 2.0: + + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x04 EP 4 OUT + bmAttributes 3 + Transfer Type Interrupt + Synch Type None + Usage Type Data + wMaxPacketSize 0x0040 1x 64 bytes + bInterval 1 + +However on USB 1.1 endpoint becomes Bulk: + + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x04 EP 4 OUT + bmAttributes 2 + Transfer Type Bulk + Synch Type None + Usage Type Data + wMaxPacketSize 0x0040 1x 64 bytes + bInterval 0 + +Commit 37939810b937aba830dd751291fcdc51cae1a6cb assumed that endpoint is +always interrupt type and changed usb_bulk_msg() calls to usb_interrupt_msg(). + +Problem here is that usb_bulk_msg() on interrupt endpoint selfcorrects the +call and changes requested pipe to interrupt type (see usb_bulk_msg). +However with usb_interrupt_msg() on bulk endpoint does not correct the +pipe type to bulk, but instead URB is submitted with interrupt type pipe. + +So pre-2.6.39 used usb_bulk_msg() and therefore worked with both endpoint +types, however in 2.6.39 usb_interrupt_msg() with bulk endpoint causes +ohci_hcd to fail submitted URB instantly with -ENOSPC and preventing zd1211rw +from working with OHCI. + +Fix this by detecting endpoint type and using correct endpoint/pipe types +for URB. Also fix asynchronous zd_usb_iowrite16v_async() to use right +URB type on 'EP 4 OUT'. + +Signed-off-by: Jussi Kivilinna <jussi.kivilinna@mbnet.fi> +Signed-off-by: John W. Linville <linville@tuxdriver.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/net/wireless/zd1211rw/zd_usb.c | 53 ++++++++++++++++++++++++++------- + 1 file changed, 42 insertions(+), 11 deletions(-) + +--- a/drivers/net/wireless/zd1211rw/zd_usb.c ++++ b/drivers/net/wireless/zd1211rw/zd_usb.c +@@ -1533,6 +1533,31 @@ static void __exit usb_exit(void) + module_init(usb_init); + module_exit(usb_exit); + ++static int zd_ep_regs_out_msg(struct usb_device *udev, void *data, int len, ++ int *actual_length, int timeout) ++{ ++ /* In USB 2.0 mode EP_REGS_OUT endpoint is interrupt type. However in ++ * USB 1.1 mode endpoint is bulk. Select correct type URB by endpoint ++ * descriptor. ++ */ ++ struct usb_host_endpoint *ep; ++ unsigned int pipe; ++ ++ pipe = usb_sndintpipe(udev, EP_REGS_OUT); ++ ep = usb_pipe_endpoint(udev, pipe); ++ if (!ep) ++ return -EINVAL; ++ ++ if (usb_endpoint_xfer_int(&ep->desc)) { ++ return usb_interrupt_msg(udev, pipe, data, len, ++ actual_length, timeout); ++ } else { ++ pipe = usb_sndbulkpipe(udev, EP_REGS_OUT); ++ return usb_bulk_msg(udev, pipe, data, len, actual_length, ++ timeout); ++ } ++} ++ + static int usb_int_regs_length(unsigned int count) + { + return sizeof(struct usb_int_regs) + count * sizeof(struct reg_data); +@@ -1648,15 +1673,14 @@ int zd_usb_ioread16v(struct zd_usb *usb, + + udev = zd_usb_to_usbdev(usb); + prepare_read_regs_int(usb); +- r = usb_interrupt_msg(udev, usb_sndintpipe(udev, EP_REGS_OUT), +- req, req_len, &actual_req_len, 50 /* ms */); ++ r = zd_ep_regs_out_msg(udev, req, req_len, &actual_req_len, 50 /*ms*/); + if (r) { + dev_dbg_f(zd_usb_dev(usb), +- "error in usb_interrupt_msg(). Error number %d\n", r); ++ "error in zd_ep_regs_out_msg(). Error number %d\n", r); + goto error; + } + if (req_len != actual_req_len) { +- dev_dbg_f(zd_usb_dev(usb), "error in usb_interrupt_msg()\n" ++ dev_dbg_f(zd_usb_dev(usb), "error in zd_ep_regs_out_msg()\n" + " req_len %d != actual_req_len %d\n", + req_len, actual_req_len); + r = -EIO; +@@ -1818,9 +1842,17 @@ int zd_usb_iowrite16v_async(struct zd_us + rw->value = cpu_to_le16(ioreqs[i].value); + } + +- usb_fill_int_urb(urb, udev, usb_sndintpipe(udev, EP_REGS_OUT), +- req, req_len, iowrite16v_urb_complete, usb, +- ep->desc.bInterval); ++ /* In USB 2.0 mode endpoint is interrupt type. However in USB 1.1 mode ++ * endpoint is bulk. Select correct type URB by endpoint descriptor. ++ */ ++ if (usb_endpoint_xfer_int(&ep->desc)) ++ usb_fill_int_urb(urb, udev, usb_sndintpipe(udev, EP_REGS_OUT), ++ req, req_len, iowrite16v_urb_complete, usb, ++ ep->desc.bInterval); ++ else ++ usb_fill_bulk_urb(urb, udev, usb_sndbulkpipe(udev, EP_REGS_OUT), ++ req, req_len, iowrite16v_urb_complete, usb); ++ + urb->transfer_flags |= URB_FREE_BUFFER; + + /* Submit previous URB */ +@@ -1924,15 +1956,14 @@ int zd_usb_rfwrite(struct zd_usb *usb, u + } + + udev = zd_usb_to_usbdev(usb); +- r = usb_interrupt_msg(udev, usb_sndintpipe(udev, EP_REGS_OUT), +- req, req_len, &actual_req_len, 50 /* ms */); ++ r = zd_ep_regs_out_msg(udev, req, req_len, &actual_req_len, 50 /*ms*/); + if (r) { + dev_dbg_f(zd_usb_dev(usb), +- "error in usb_interrupt_msg(). Error number %d\n", r); ++ "error in zd_ep_regs_out_msg(). Error number %d\n", r); + goto out; + } + if (req_len != actual_req_len) { +- dev_dbg_f(zd_usb_dev(usb), "error in usb_interrupt_msg()" ++ dev_dbg_f(zd_usb_dev(usb), "error in zd_ep_regs_out_msg()" + " req_len %d != actual_req_len %d\n", + req_len, actual_req_len); + r = -EIO; |