2.6.36.4-stable review
Subsystems (79)
cover 2.6.36.4-stable review
Note, this is the LAST 2.6.36 kernel to be released. It is "end of life" after this release.
This is the start of the stable review cycle for the 2.6.36.4 release. There are 176 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let us know. If anyone is a maintainer of the proper subsystem, and wants to add a Signed-off-by: line to the patch, please respond with it.
Responses should be made by Friday, Feb 18, 2011 00:00:00 UTC. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
kernel.org/pub/linux/kernel/v2.6/stable-review/patch-2.6.36.4-rc1.gz
and the diffstat can be found below.
thanks,
greg k-h
Documentation/kernel-parameters.txt | 1 + Makefile | 2 +- arch/arm/mm/init.c | 6 ++ arch/avr32/include/asm/syscalls.h | 9 --- arch/parisc/kernel/firmware.c | 13 +---- arch/powerpc/boot/dts/p1022ds.dts | 4 +- arch/powerpc/kernel/cpu_setup_6xx.S | 40 ++++++------ arch/powerpc/mm/numa.c | 2 +- arch/powerpc/platforms/pseries/lpar.c | 37 +++++++++++ arch/powerpc/sysdev/fsl_rio.c | 1 - arch/sh/include/asm/io.h | 10 +++- arch/sh/include/asm/pgtable_32.h | 7 ++- arch/x86/include/asm/mmu_context.h | 5 +- arch/x86/kernel/cpu/mtrr/main.c | 10 +++- arch/x86/kvm/i8259.c | 2 + arch/x86/kvm/mmu.c | 10 ++- block/cfq-iosched.c | 4 + drivers/ata/pata_mpc52xx.c | 2 +- drivers/char/agp/intel-agp.c | 27 +++++--- drivers/char/ipmi/ipmi_si_intf.c | 12 +--- drivers/char/tpm/tpm.c | 28 ++++++-- drivers/char/tpm/tpm.h | 2 + drivers/char/tpm/tpm_tis.c | 28 ++++++++- drivers/char/virtio_console.c | 15 ++++- drivers/cpuidle/cpuidle.c | 82 ++++++++++++------------ drivers/firewire/core-card.c | 11 +++- drivers/gpu/drm/Kconfig | 3 + drivers/gpu/drm/drm_crtc_helper.c | 5 +- drivers/gpu/drm/i915/i915_dma.c | 10 ++- drivers/gpu/drm/i915/i915_drv.c | 10 +++- drivers/gpu/drm/i915/i915_reg.h | 9 ++- drivers/gpu/drm/i915/intel_dp.c | 23 +++++-- drivers/gpu/drm/i915/intel_lvds.c | 8 ++ drivers/gpu/drm/radeon/atombios_dp.c | 4 +- drivers/gpu/drm/radeon/radeon_atombios.c | 37 +++++++---- drivers/gpu/drm/radeon/radeon_display.c | 4 + drivers/gpu/vga/vgaarb.c | 2 +- drivers/hwmon/applesmc.c | 48 +++++--------- drivers/hwmon/lm63.c | 59 ++++++++++++++---- drivers/hwmon/via686a.c | 14 +++- drivers/i2c/i2c-core.c | 14 ++++- drivers/infiniband/hw/cxgb4/cm.c | 2 +- drivers/input/mouse/bcm5974.c | 40 ++++++++++++ drivers/input/serio/i8042-x86ia64io.h | 21 ++++++ drivers/input/serio/i8042.c | 6 ++- drivers/md/dm-mpath.c | 12 ---- drivers/md/dm.c | 5 +- drivers/md/md.c | 27 ++++++-- drivers/md/md.h | 3 +- drivers/media/radio/radio-aimslab.c | 23 ++----- drivers/media/video/em28xx/em28xx-cards.c | 4 +- drivers/mmc/host/bfin_sdh.c | 2 +- drivers/net/atlx/atl1.c | 10 +++ drivers/net/fec.c | 4 +- drivers/net/ixgbe/ixgbe_main.c | 11 +++- drivers/net/virtio_net.c | 27 +++++--- drivers/net/wireless/ath/ath9k/ar9002_calib.c | 10 ++-- drivers/net/wireless/ath/ath9k/ar9002_hw.c | 3 +- drivers/net/wireless/ath/ath9k/ar9003_eeprom.c | 14 ++-- drivers/net/wireless/ath/ath9k/ath9k.h | 7 +- drivers/net/wireless/ath/ath9k/hif_usb.c | 40 ++++++++++- drivers/net/wireless/ath/ath9k/hif_usb.h | 1 + drivers/net/wireless/ath/ath9k/hw.c | 6 ++- drivers/net/wireless/ath/ath9k/hw.h | 1 + drivers/net/wireless/ath/ath9k/init.c | 1 - drivers/net/wireless/ath/ath9k/main.c | 64 ++++++++---------- drivers/net/wireless/ath/ath9k/pci.c | 4 + drivers/net/wireless/ath/ath9k/recv.c | 2 +- drivers/net/wireless/ath/ath9k/xmit.c | 4 +- drivers/net/wireless/iwlwifi/iwl-agn.c | 15 +++- drivers/net/wireless/iwlwifi/iwl-helpers.h | 6 ++ drivers/net/wireless/p54/txrx.c | 2 +- drivers/net/wireless/rt2x00/rt73usb.c | 1 + drivers/pci/pci-stub.c | 3 + drivers/power/ds2760_battery.c | 2 +- drivers/power/jz4740-battery.c | 7 ++ drivers/rtc/rtc-cmos.c | 16 +++-- drivers/s390/cio/qdio.h | 6 ++ drivers/s390/cio/qdio_main.c | 43 ++++++++---- drivers/scsi/libsas/sas_scsi_host.c | 1 + drivers/scsi/mpt2sas/mpt2sas_base.c | 24 ++++++-- drivers/scsi/mpt2sas/mpt2sas_scsih.c | 64 +++++++++++++++---- drivers/scsi/sd.c | 9 ++- drivers/serial/8250.c | 3 +- drivers/ssb/pcmcia.c | 2 +- drivers/staging/comedi/drivers/jr3_pci.c | 7 ++ drivers/staging/comedi/drivers/ni_labpc.c | 3 +- drivers/staging/hv/blkvsc_drv.c | 1 + drivers/staging/hv/netvsc.c | 2 +- drivers/staging/hv/netvsc_drv.c | 1 + drivers/staging/rt2860/chips/rt3090.c | 3 +- drivers/staging/rt2860/chips/rt30xx.c | 4 +- drivers/staging/rt2860/rt_main_dev.c | 2 - drivers/staging/rt2860/usb_main_dev.c | 1 + drivers/staging/usbip/vhci_hcd.c | 14 ---- drivers/staging/zram/zram_drv.c | 4 + drivers/usb/class/cdc-acm.c | 1 + drivers/usb/core/hcd.c | 2 +- drivers/usb/core/hub.c | 26 ++++++++ drivers/usb/gadget/printer.c | 19 +++--- drivers/usb/host/ehci-au1xxx.c | 2 +- drivers/usb/host/ehci-hcd.c | 27 ++++++-- drivers/usb/host/ehci-hub.c | 7 ++ drivers/usb/host/ehci-pci.c | 41 ++++++++++++- drivers/usb/host/ehci-sched.c | 79 +++++++++++++++++++++++ drivers/usb/host/ehci.h | 1 + drivers/usb/host/xhci.c | 14 +++- drivers/usb/serial/ch341.c | 10 +++ drivers/usb/serial/cp210x.c | 16 +---- drivers/usb/serial/digi_acceleport.c | 10 --- drivers/usb/serial/ftdi_sio.c | 39 +++++++++++- drivers/usb/serial/ftdi_sio_ids.h | 32 ++++++++- drivers/usb/serial/generic.c | 20 ++++++ drivers/usb/serial/io_edgeport.c | 4 +- drivers/usb/serial/io_tables.h | 1 + drivers/usb/serial/iuu_phoenix.c | 1 + drivers/usb/serial/keyspan.h | 4 + drivers/usb/serial/keyspan_pda.c | 17 ----- drivers/usb/serial/moto_modem.c | 1 + drivers/usb/serial/option.c | 23 ++++++- drivers/usb/serial/oti6858.c | 1 + drivers/usb/serial/pl2303.c | 12 ++++ drivers/usb/serial/pl2303.h | 1 + drivers/usb/serial/qcaux.c | 3 + drivers/usb/serial/siemens_mpi.c | 1 + drivers/usb/serial/spcp8x5.c | 7 ++- drivers/usb/serial/ti_usb_3410_5052.c | 2 +- drivers/usb/serial/usb-serial.c | 8 ++- drivers/usb/serial/usb_debug.c | 1 + drivers/usb/storage/unusual_cypress.h | 5 ++ drivers/usb/storage/unusual_devs.h | 32 +++++++++ drivers/video/backlight/88pm860x_bl.c | 4 +- drivers/virtio/virtio_pci.c | 20 +----- fs/direct-io.c | 10 ++- fs/ext4/inode.c | 1 + fs/nfs/delegation.c | 6 +- fs/nfs/direct.c | 34 ++++++---- fs/nilfs2/super.c | 3 +- fs/proc/kcore.c | 2 +- include/drm/drm_pciids.h | 1 - include/linux/ieee80211.h | 2 +- include/linux/klist.h | 2 +- include/linux/mmzone.h | 10 +-- include/linux/usb/serial.h | 3 + include/linux/vmstat.h | 5 ++ include/net/cfg80211.h | 15 ++-- include/scsi/scsi.h | 1 + init/calibrate.c | 6 +- kernel/ptrace.c | 2 +- kernel/smp.c | 30 +++++++++ kernel/sys.c | 3 +- kernel/watchdog.c | 23 ++++--- mm/memcontrol.c | 1 + mm/migrate.c | 48 ++++++-------- mm/mmzone.c | 21 ------ mm/page_alloc.c | 35 ++++++++-- mm/vmscan.c | 23 ++++--- mm/vmstat.c | 68 +++++++++++++++++++- net/core/rtnetlink.c | 3 + net/mac80211/agg-rx.c | 11 +--- net/mac80211/key.c | 6 ++ net/mac80211/rx.c | 4 +- net/mac80211/tx.c | 6 ++- net/wireless/reg.c | 13 +++- security/keys/request_key.c | 1 - security/selinux/hooks.c | 5 +- security/selinux/nlmsgtab.c | 2 + sound/atmel/ac97c.c | 5 +- sound/core/hrtimer.c | 5 +- sound/pci/au88x0/au88x0_pcm.c | 24 ++++++- sound/pci/hda/hda_eld.c | 2 +- sound/pci/hda/patch_conexant.c | 8 ++- sound/pci/hda/patch_realtek.c | 1 + sound/soc/blackfin/bf5xx-ac97.c | 4 +- sound/soc/blackfin/bf5xx-tdm.c | 2 +- sound/soc/codecs/wm8990.c | 10 ++-- sound/soc/codecs/wm8994.c | 17 ++++-- sound/soc/codecs/wm_hubs.c | 15 ++-- sound/usb/midi.c | 11 +++- sound/usb/usx2y/us122l.c | 41 ++++++------ 180 files changed, 1578 insertions(+), 687 deletions(-)
PATCH 1/176 staging: usbip: remove double giveback of URB
2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: =?UTF-8?q?M=C3=A1rton=20N=C3=A9meth?= <[email protected]>
commit 7571f089d7522a95c103558faf313c7af8856ceb upstream.
In the vhci_urb_dequeue() function the TCP connection is checked twice. Each time when the TCP connection is closed the URB is unlinked and given back. Remove the second attempt of unlinking and giving back of the URB completely.
This patch fixes the bug described at https://bugzilla.kernel.org/show_bug.cgi?id=24872 .
--- drivers/staging/usbip/vhci_hcd.c | 14 -------------- 1 file changed, 14 deletions(-)
drivers/staging/usbip/vhci_hcd.c +0 -14
@@ -799,20 +799,6 @@ static int vhci_urb_dequeue(struct usb_hspin_unlock_irqrestore (&vdev->priv_lock, flags2); } - -if (!vdev->ud.tcp_socket) { -/* tcp connection is closed */ -usbip_uinfo ("vhci_hcd: vhci_urb_dequeue() gives back urb %p\n" , - urb); - -usb_hcd_unlink_urb_from_ep (hcd, urb); - -spin_unlock_irqrestore (&the_controller->lock, flags); -usb_hcd_giveback_urb (vhci_to_hcd (the_controller), urb, - urb->status); -spin_lock_irqsave (&the_controller->lock, flags); - } -spin_unlock_irqrestore (&the_controller->lock, flags);usbip_dbg_vhci_hc ("leave\n" );
PATCH 2/176 USB: EHCI: ASPM quirk of ISOC on AMD SB800
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Alex He <[email protected]>
commit 05570297ecbe834b1756b522412b68eaffb9ab11 upstream.
When ASPM PM Feature is enabled on UMI link, devices that use ISOC stream of data transfer may be exposed to longer latency causing less than optimal per- formance of the device. The longer latencies are normal and are due to link wake time coming out of low power state which happens frequently to save power when the link is not active.
The following code will make exception for certain features of ASPM to be by passed and keep the logic normal state only when the ISOC device is connected and active. This change will allow the device to run at optimal performance yet minimize the impact on overall power savings.
--- drivers/usb/host/ehci-hcd.c | 8 ++++ drivers/usb/host/ehci-pci.c | 32 +++++++++++++++++ drivers/usb/host/ehci-sched.c | 79 ++++++++++++++++++++++++++++++++++++++++++ drivers/usb/host/ehci.h | 1 4 files changed, 120 insertions(+)
drivers/usb/host/ehci-hcd.c +8 -0
@@ -114,6 +114,9 @@ MODULE_PARM_DESC(hird, "host initiated r#define INTR_MASK (STS_IAA | STS_FATAL | STS_PCD | STS_ERR | STS_INT) +/* for ASPM quirk of ISOC on AMD SB800 */ +static struct pci_dev *amd_nb_dev; +/*-------------------------------------------------------------------------*/ #include "ehci.h"
@@ -514,6 +517,11 @@ static void ehci_stop (struct usb_hcd *hspin_unlock_irq (&ehci->lock);ehci_mem_cleanup (ehci); +if (amd_nb_dev) { +pci_dev_put (amd_nb_dev); + amd_nb_dev =NULL ; + } +#ifdef EHCI_STATS ehci_dbg (ehci, "irq normal %ld err %ld reclaim %ld (lost %ld)\n", ehci->stats.normal, ehci->stats.error, ehci->stats.reclaim,
drivers/usb/host/ehci-pci.c +32 -0
@@ -41,6 +41,35 @@ static int ehci_pci_reinit(struct ehci_hreturn 0 ; } +static int ehci_quirk_amd_SB800 (struct ehci_hcd *ehci) +{ +struct pci_dev *amd_smbus_dev; +u8 rev =0 ; + + amd_smbus_dev =pci_get_device (PCI_VENDOR_ID_ATI ,0x4385 ,NULL ); +if (!amd_smbus_dev) +return 0 ; + +pci_read_config_byte (amd_smbus_dev,PCI_REVISION_ID , &rev); +if (rev <0x40 ) { +pci_dev_put (amd_smbus_dev); + amd_smbus_dev =NULL ; +return 0 ; + } + +if (!amd_nb_dev) + amd_nb_dev =pci_get_device (PCI_VENDOR_ID_AMD ,0x1510 ,NULL ); +if (!amd_nb_dev) +ehci_err (ehci,"QUIRK: unable to get AMD NB device\n" ); + +ehci_info (ehci,"QUIRK: Enable AMD SB800 L1 fix\n" ); + +pci_dev_put (amd_smbus_dev); + amd_smbus_dev =NULL ; + +return 1 ; +} +/* called during probe() after chip reset completes */ static int ehci_pci_setup (struct usb_hcd *hcd) {
@@ -99,6 +128,9 @@ static int ehci_pci_setup(struct usb_hcd/* cache this readonly data; minimize chip reads */ ehci->hcs_params =ehci_readl (ehci, &ehci->caps->hcs_params); +if (ehci_quirk_amd_SB800 (ehci)) + ehci->amd_l1_fix =1 ; + retval =ehci_halt (ehci);if (retval)return retval;
drivers/usb/host/ehci-sched.c +79 -0
109 lines not on this page · raw message
drivers/usb/host/ehci.h +1 -0
@@ -130,6 +130,7 @@ struct ehci_hcd { /* one per controlle unsigned has_amcc_usb23:1; unsigned need_io_watchdog:1; unsigned broken_periodic:1; + unsigned amd_l1_fix:1; unsigned fs_i_thresh:1; /* Intel iso scheduling *//* required for usb32 quirk */
PATCH 3/176 rt2x00: add device id for windy31 usb device
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Greg Kroah-Hartman <[email protected]>
commit 9c4cf6d94fb362c27a24df5223ed6e327eb7279a upstream.
This patch adds the device id for the windy31 USB device to the rt73usb driver.
Thanks to Ralf Flaxa for reporting this and providing testing and a sample device.
--- drivers/net/wireless/rt2x00/rt73usb.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/wireless/rt2x00/rt73usb.c +1 -0
@@ -2395,6 +2395,7 @@ static struct usb_device_id rt73usb_devi { USB_DEVICE(0x04bb, 0x093d), USB_DEVICE_DATA(&rt73usb_ops) }, { USB_DEVICE(0x148f, 0x2573), USB_DEVICE_DATA(&rt73usb_ops) }, { USB_DEVICE(0x148f, 0x2671), USB_DEVICE_DATA(&rt73usb_ops) }, + { USB_DEVICE(0x0812, 0x3101), USB_DEVICE_DATA(&rt73usb_ops) },/* Qcom */ { USB_DEVICE(0x18e8, 0x6196), USB_DEVICE_DATA(&rt73usb_ops) }, { USB_DEVICE(0x18e8, 0x6229), USB_DEVICE_DATA(&rt73usb_ops) },
PATCH 4/176 staging: rt2870sta: Add ID for Linksys WUSB100v2
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Larry Finger <[email protected]>
commit 27c82819a5a42f08fc0f787ab1b0c129cbdda801 upstream.
This device was tested with rt2870sta by setting new_id.
--- drivers/staging/rt2860/usb_main_dev.c | 1 + 1 file changed, 1 insertion(+)
drivers/staging/rt2860/usb_main_dev.c +1 -0
@@ -106,6 +106,7 @@ struct usb_device_id rtusb_usb_id[] = { {USB_DEVICE(0x0411, 0x016f)}, /* MelCo.,Inc. WLI-UC-G301N */ {USB_DEVICE(0x1737, 0x0070)}, /* Linksys WUSB100 */ {USB_DEVICE(0x1737, 0x0071)}, /* Linksys WUSB600N */ + {USB_DEVICE(0x1737, 0x0078)}, /* Linksys WUSB100v2 */ {USB_DEVICE(0x0411, 0x00e8)}, /* Buffalo WLI-UC-G300N */ {USB_DEVICE(0x050d, 0x815c)}, /* Belkin F5D8053 */ {USB_DEVICE(0x100D, 0x9031)}, /* Motorola 2770 */
PATCH 5/176 ALSA: snd-usb-us122l: Fix MIDI output
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Karsten Wiese <[email protected]>
commit 921eebdc18c82268eab446592191b39e35d031d6 upstream.
The US-122L always reads 9 bytes per urb unless they are set to 0xFD.
--- sound/usb/midi.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)
sound/usb/midi.c +9 -2
@@ -843,8 +843,8 @@ static void snd_usbmidi_us122l_output(streturn ; } -memset (urb->transfer_buffer + count,0xFD ,9 - count); - urb->transfer_buffer_length = count; +memset (urb->transfer_buffer + count,0xFD , ep->max_transfer - count); + urb->transfer_buffer_length = ep->max_transfer; }static struct usb_protocol_ops snd_usbmidi_122l_ops = {
@@ -1288,6 +1288,13 @@ static int snd_usbmidi_out_endpoint_creacase USB_ID (0x1a86 ,0x752d ):/* QinHeng CH345 "USB2.0-MIDI" */ ep->max_transfer =4 ;break ; +/* +* Some devices only work with 9 bytes packet size: +*/ +case USB_ID (0x0644 ,0x800E ):/* Tascam US-122L */ +case USB_ID (0x0644 ,0x800F ):/* Tascam US-144 */ + ep->max_transfer =9 ; +break ; }for (i =0 ; i <OUTPUT_URBS ; ++i) { buffer = usb_alloc_coherent(umidi->dev,
PATCH 6/176 ALSA: snd-usb-us122l: Fix missing NULL checks
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Karsten Wiese <[email protected]>
commit cdce2db74e156fbd9a2dc3c7b246166f8b70955b upstream.
Fix missing NULL checks in usb_stream_hwdep_poll() and usb_stream_hwdep_ioctl(). Wake up poll waiters before returning from usb_stream_hwdep_ioctl().
--- sound/usb/usx2y/us122l.c | 41 ++++++++++++++++++++--------------------- 1 file changed, 20 insertions(+), 21 deletions(-)
sound/usb/usx2y/us122l.c +20 -21
@@ -273,29 +273,26 @@ static unsigned int usb_stream_hwdep_pol struct file *file, poll_table *wait) { struct us122l *us122l = hw->private_data; -struct usb_stream *s = us122l->sk.s;unsigned *polled;unsigned int mask;poll_wait (file, &us122l->sk.sleep, wait); -switch (s->state) { -case usb_stream_ready: -if (us122l->first == file) - polled = &s->periods_polled; -else - polled = &us122l->second_periods_polled; -if (*polled != s->periods_done) { - *polled = s->periods_done; - mask =POLLIN |POLLOUT |POLLWRNORM ; -break ; + mask =POLLIN |POLLOUT |POLLWRNORM |POLLERR ; +if (mutex_trylock (&us122l->mutex)) { +struct usb_stream *s = us122l->sk.s; +if (s && s->state == usb_stream_ready) { +if (us122l->first == file) + polled = &s->periods_polled; +else + polled = &us122l->second_periods_polled; +if (*polled != s->periods_done) { + *polled = s->periods_done; + mask =POLLIN |POLLOUT |POLLWRNORM ; + }else + mask =0 ; } -/* Fall through */ - mask =0 ; -break ; -default : - mask =POLLIN |POLLOUT |POLLWRNORM |POLLERR ; -break ; +mutex_unlock (&us122l->mutex); }return mask; }
@@ -381,6 +378,7 @@ static int usb_stream_hwdep_ioctl(struct {struct usb_stream_config *cfg;struct us122l *us122l = hw->private_data; +struct usb_stream *s;unsigned min_period_frames;int err =0 ;bool high_speed;
@@ -426,18 +424,18 @@ static int usb_stream_hwdep_ioctl(structsnd_power_wait (hw->card,SNDRV_CTL_POWER_D0 );mutex_lock (&us122l->mutex); + s = us122l->sk.s;if (!us122l->master) us122l->master = file;else if (us122l->master != file) { -if (memcmp (cfg, &us122l->sk.s->cfg,sizeof (*cfg))) { +if (!s ||memcmp (cfg, &s->cfg,sizeof (*cfg))) { err = -EIO ; goto unlock; } us122l->slave = file; } -if (!us122l->sk.s || -memcmp (cfg, &us122l->sk.s->cfg,sizeof (*cfg)) || - us122l->sk.s->state == usb_stream_xrun) { +if (!s ||memcmp (cfg, &s->cfg,sizeof (*cfg)) || + s->state == usb_stream_xrun) {us122l_stop (us122l);if (!us122l_start (us122l, cfg->sample_rate, cfg->period_frames)) err = -EIO ;
@@ -448,6 +446,7 @@ unlock:mutex_unlock (&us122l->mutex); free:kfree (cfg); +wake_up_all (&us122l->sk.sleep);return err; }
PATCH 7/176 atl1: fix oops when changing tx/rx ring params
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: J. K. Cliburn <[email protected]>
commit 2f32c867219734b06abc980d4812f67b6d6fe517 upstream.
Commit 3f5a2a713aad28480d86b0add00c68484b54febc zeroes out the statistics message block (SMB) and coalescing message block (CMB) when adapter ring resources are freed. This is desirable behavior, but, as a side effect, the commit leads to an oops when atl1_set_ringparam() attempts to alter the number of rx or tx elements in the ring buffer (by using ethtool -G, for example). We don't want SMB or CMB to change during this operation.
Modify atl1_set_ringparam() to preserve SMB and CMB when changing ring parameters.
--- drivers/net/atlx/atl1.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
drivers/net/atlx/atl1.c +10 -0
@@ -3503,6 +3503,8 @@ static int atl1_set_ringparam(struct netstruct atl1_rfd_ring rfd_old, rfd_new;struct atl1_rrd_ring rrd_old, rrd_new;struct atl1_ring_header rhdr_old, rhdr_new; +struct atl1_smb smb; +struct atl1_cmb cmb;int err; tpd_old = adapter->tpd_ring;
@@ -3543,11 +3545,19 @@ static int atl1_set_ringparam(struct net adapter->rrd_ring = rrd_old; adapter->tpd_ring = tpd_old; adapter->ring_header = rhdr_old; +/* +* Save SMB and CMB, since atl1_free_ring_resources +* will clear them. +*/ + smb = adapter->smb; + cmb = adapter->cmb;atl1_free_ring_resources (adapter); adapter->rfd_ring = rfd_new; adapter->rrd_ring = rrd_new; adapter->tpd_ring = tpd_new; adapter->ring_header = rhdr_new; + adapter->smb = smb; + adapter->cmb = cmb; err =atl1_up (adapter);if (err)
PATCH 8/176 hwmon: (via686a) Initialize fan_div values
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Jean Delvare <[email protected]>
commit f790674d3f87df6390828ac21a7d1530f71b59c8 upstream.
Functions set_fan_min() and set_fan_div() assume that the fan_div values have already been read from the register. The driver currently doesn't initialize them at load time, they are only set when function via686a_update_device() is called. This means that set_fan_min() and set_fan_div() misbehave if, for example, "sensors -s" is called before any monitoring application (e.g. "sensors") is has been run.
Fix the problem by always initializing the fan_div values at device bind time.
--- drivers/hwmon/via686a.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-)
drivers/hwmon/via686a.c +11 -3
@@ -687,6 +687,13 @@ static int __devexit via686a_remove(strureturn 0 ; } +static void via686a_update_fan_div (struct via686a_data *data) +{ +int reg =via686a_read_value (data,VIA686A_REG_FANDIV ); + data->fan_div[0 ] = (reg >>4 ) &0x03 ; + data->fan_div[1 ] = reg >>6 ; +} +static void __devinit via686a_init_device (struct via686a_data *data) {u8 reg;
@@ -700,6 +707,9 @@ static void __devinit via686a_init_devicvia686a_write_value (data,VIA686A_REG_TEMP_MODE , (reg & ~VIA686A_TEMP_MODE_MASK ) |VIA686A_TEMP_MODE_CONTINUOUS ); + +/* Pre-read fan clock divisor values */ +via686a_update_fan_div (data); }static struct via686a_data *via686a_update_device (struct device *dev)
@@ -751,9 +761,7 @@ static struct via686a_data *via686a_upda (via686a_read_value (data,VIA686A_REG_TEMP_LOW23 ) &0xc0 ) >>6 ; - i =via686a_read_value (data,VIA686A_REG_FANDIV ); - data->fan_div[0 ] = (i >>4 ) &0x03 ; - data->fan_div[1 ] = i >>6 ; +via686a_update_fan_div (data); data->alarms =via686a_read_value (data, VIA686A_REG_ALARM1) |
PATCH 9/176 hwmon: (applesmc) Add MacBookAir3,1(3,2) support
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Edgar Hucek <[email protected]>
commit 132af03233b493101a53010383b5abb5b9ff1e51 upstream.
This patch add support for the MacBookAir3,1 and MacBookAir3,2 to the applesmc driver.
--- drivers/hwmon/applesmc.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
drivers/hwmon/applesmc.c +10 -0
@@ -162,6 +162,10 @@ static const char *temperature_sensors_s/* Set 22: MacBook Pro 7,1 */ {"TB0T" ,"TB1T" ,"TB2T" ,"TC0D" ,"TC0P" ,"TN0D" ,"TN0P" ,"TN0S" , "TN1D", "TN1F", "TN1G", "TN1S", "Th1H", "Ts0P", "Ts0S", NULL }, +/* Set 23: MacBook Air 3,1 */ + { "TB0T", "TB1T", "TB2T", "TC0D", "TC0E", "TC0P", "TC1E", "TCZ3", +"TCZ4" ,"TCZ5" ,"TG0E" ,"TG1E" ,"TG2E" ,"TGZ3" ,"TGZ4" ,"TGZ5" , + "TH0F", "TH0O", "TM0P" }, };/* List of keys used to read/write fan speeds */
@@ -1524,11 +1528,17 @@ static __initdata struct dmi_match_data { .accelerometer = 1, .light = 1, .temperature_set = 21 }, /* MacBook Pro 7,1: accelerometer, backlight and temperature set 22 */ { .accelerometer = 1, .light = 1, .temperature_set = 22 }, +/* MacBook Air 3,1: accelerometer, backlight and temperature set 23 */ + { .accelerometer = 0, .light = 0, .temperature_set = 23 }, }; /* Note that DMI_MATCH(...,"MacBook") will match "MacBookPro1,1". * So we need to put "Apple MacBook Pro" before "Apple MacBook". */ static __initdata struct dmi_system_id applesmc_whitelist[] = { + { applesmc_dmi_match, "Apple MacBook Air 3", { + DMI_MATCH(DMI_BOARD_VENDOR, "Apple"), + DMI_MATCH(DMI_PRODUCT_NAME, "MacBookAir3") }, + &applesmc_dmi_data[23]}, { applesmc_dmi_match, "Apple MacBook Air 2", { DMI_MATCH(DMI_BOARD_VENDOR, "Apple"), DMI_MATCH(DMI_PRODUCT_NAME, "MacBookAir2") },
PATCH 10/176 hwmon: (applesmc) Relax the severity of device init failure
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Henrik Rydberg <[email protected]>
commit 2344cd0c2e9ea8f3037be11fb997ddbeda0237ca upstream.
The device init is used to reset the accelerometer. Failure to reset is not severe enough to stop loading the module or to resume from hibernation. This patch relaxes failure to a warning and drops output in case of success.
--- drivers/hwmon/applesmc.c | 38 +++++++------------------------------- 1 file changed, 7 insertions(+), 31 deletions(-)
drivers/hwmon/applesmc.c +7 -31
@@ -448,38 +448,22 @@ static int applesmc_read_motion_sensor(i }/* -* applesmc_device_init - initialize the accelerometer. Returns zero on success -* and negative error code on failure. Can sleep. +* applesmc_device_init - initialize the accelerometer. Can sleep. */ -static int applesmc_device_init (void ) +static void applesmc_device_init (void ) { -int total, ret = -ENXIO ; +int total;u8 buffer[2 ];if (!applesmc_accelerometer) -return 0 ; +return ;mutex_lock (&applesmc_lock);for (total =INIT_TIMEOUT_MSECS ; total >0 ; total -=INIT_WAIT_MSECS ) { -if (debug) -printk (KERN_DEBUG "applesmc try %d\n" , total);if (!applesmc_read_key (MOTION_SENSOR_KEY , buffer,2 ) && - (buffer[0 ] !=0x00 || buffer[1 ] !=0x00 )) { -if (total ==INIT_TIMEOUT_MSECS ) { -printk (KERN_DEBUG "applesmc: device has" -" already been initialized" -" (0x%02x, 0x%02x).\n" , - buffer[0 ], buffer[1 ]); - }else { -printk (KERN_DEBUG "applesmc: device" -" successfully initialized" -" (0x%02x, 0x%02x).\n" , - buffer[0 ], buffer[1 ]); - } - ret =0 ; + (buffer[0 ] !=0x00 || buffer[1 ] !=0x00 )) goto out; - } buffer[0 ] =0xe0 ; buffer[1 ] =0x00 ;applesmc_write_key (MOTION_SENSOR_KEY , buffer,2 );
@@ -490,7 +474,6 @@ static int applesmc_device_init(void) out:mutex_unlock (&applesmc_lock); -return ret; }/*
@@ -516,13 +499,8 @@ static int applesmc_get_fan_count(void)/* Device model stuff */ static int applesmc_probe (struct platform_device *dev) { -int ret; - - ret =applesmc_device_init (); -if (ret) -return ret; +applesmc_device_init (); -printk (KERN_INFO "applesmc: device successfully initialized.\n" );return 0 ; }
@@ -539,9 +517,7 @@ static int applesmc_pm_resume(struct dev/* Reinitialize device on resume from hibernation */ static int applesmc_pm_restore (struct device *dev) { -int ret =applesmc_device_init (); -if (ret) -return ret; +applesmc_device_init ();return applesmc_pm_resume (dev); }
PATCH 11/176 USB: serial: handle Data Carrier Detect changes
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Libor Pechacek <[email protected]>
commit d14fc1a74e846d7851f24fc9519fe87dc12a1231 upstream.
Alan's commit 335f8514f200e63d689113d29cb7253a5c282967 introduced .carrier_raised function in several drivers. That also means tty_port_block_til_ready can now suspend the process trying to open the serial port when Carrier Detect is low and put it into tty_port.open_wait queue. We need to wake up the process when Carrier Detect goes high and trigger TTY hangup when CD goes low.
Some of the devices do not report modem status line changes, or at least we don't understand the status message, so for those we remove .carrier_raised again.
--- drivers/usb/serial/ch341.c | 10 ++++++++++ drivers/usb/serial/cp210x.c | 13 +------------ drivers/usb/serial/digi_acceleport.c | 10 ---------- drivers/usb/serial/generic.c | 20 ++++++++++++++++++++ drivers/usb/serial/keyspan_pda.c | 17 ----------------- drivers/usb/serial/pl2303.c | 11 +++++++++++ drivers/usb/serial/spcp8x5.c | 6 +++++- include/linux/usb/serial.h | 3 +++ 8 files changed, 50 insertions(+), 40 deletions(-)
drivers/usb/serial/ch341.c +10 -0
@@ -486,12 +486,22 @@ static void ch341_read_int_callback(struif (actual_length >=4 ) {struct ch341_private *priv =usb_get_serial_port_data (port);unsigned long flags; +u8 prev_line_status = priv->line_status;spin_lock_irqsave (&priv->lock, flags); priv->line_status = (~(data[2 ])) &CH341_BITS_MODEM_STAT ;if ((data[1 ] &CH341_MULT_STAT )) priv->multi_status_change =1 ;spin_unlock_irqrestore (&priv->lock, flags); + +if ((priv->line_status ^ prev_line_status) &CH341_BIT_DCD ) { +struct tty_struct *tty =tty_port_tty_get (&port->port); +if (tty) +usb_serial_handle_dcd_change (port, tty, + priv->line_status &CH341_BIT_DCD ); +tty_kref_put (tty); + } +wake_up_interruptible (&priv->delta_msr_wait); }
drivers/usb/serial/cp210x.c +1 -12
@@ -49,7 +49,6 @@ static int cp210x_tiocmset_port(struct ustatic void cp210x_break_ctl (struct tty_struct *,int );static int cp210x_startup (struct usb_serial *);static void cp210x_dtr_rts (struct usb_serial_port *p,int on); -static int cp210x_carrier_raised (struct usb_serial_port *p);static int debug;
@@ -165,8 +164,7 @@ static struct usb_serial_driver cp210x_d .tiocmget = cp210x_tiocmget, .tiocmset = cp210x_tiocmset, .attach = cp210x_startup, - .dtr_rts = cp210x_dtr_rts, - .carrier_raised = cp210x_carrier_raised + .dtr_rts = cp210x_dtr_rts };/* Config request types */
@@ -765,15 +763,6 @@ static int cp210x_tiocmget (struct tty_sreturn result; } -static int cp210x_carrier_raised (struct usb_serial_port *p) -{ -unsigned int control; -cp210x_get_config (p,CP210X_GET_MDMSTS , &control,1 ); -if (control &CONTROL_DCD ) -return 1 ; -return 0 ; -} -static void cp210x_break_ctl (struct tty_struct *tty,int break_state) {struct usb_serial_port *port = tty->driver_data;
drivers/usb/serial/digi_acceleport.c +0 -10
@@ -455,7 +455,6 @@ static int digi_write_room(struct tty_ststatic int digi_chars_in_buffer (struct tty_struct *tty);static int digi_open (struct tty_struct *tty,struct usb_serial_port *port);static void digi_close (struct usb_serial_port *port); -static int digi_carrier_raised (struct usb_serial_port *port);static void digi_dtr_rts (struct usb_serial_port *port,int on);static int digi_startup_device (struct usb_serial *serial);static int digi_startup (struct usb_serial *serial);
@@ -511,7 +510,6 @@ static struct usb_serial_driver digi_acc .open = digi_open, .close = digi_close, .dtr_rts = digi_dtr_rts, - .carrier_raised = digi_carrier_raised, .write = digi_write, .write_room = digi_write_room, .write_bulk_callback = digi_write_bulk_callback,
@@ -1339,14 +1337,6 @@ static void digi_dtr_rts(struct usb_seridigi_set_modem_signals (port, on * (TIOCM_DTR |TIOCM_RTS ),1 ); } -static int digi_carrier_raised (struct usb_serial_port *port) -{ -struct digi_port *priv =usb_get_serial_port_data (port); -if (priv->dp_modem_signals &TIOCM_CD ) -return 1 ; -return 0 ; -} -static int digi_open (struct tty_struct *tty,struct usb_serial_port *port) {int ret;
drivers/usb/serial/generic.c +20 -0
@@ -479,6 +479,26 @@ int usb_serial_handle_break(struct usb_s }EXPORT_SYMBOL_GPL (usb_serial_handle_break); +/** +* usb_serial_handle_dcd_change - handle a change of carrier detect state +* @port: usb_serial_port structure for the open port +* @tty: tty_struct structure for the port +* @status: new carrier detect status, nonzero if active +*/ +void usb_serial_handle_dcd_change (struct usb_serial_port *usb_port, +struct tty_struct *tty,unsigned int status) +{ +struct tty_port *port = &usb_port->port; + +dbg ("%s - port %d, status %d" , __func__, usb_port->number, status); + +if (status) +wake_up_interruptible (&port->open_wait); +else if (tty && !C_CLOCAL (tty)) +tty_hangup (tty); +} +EXPORT_SYMBOL_GPL (usb_serial_handle_dcd_change); +int usb_serial_generic_resume (struct usb_serial *serial) {struct usb_serial_port *port;
drivers/usb/serial/keyspan_pda.c +0 -17
@@ -680,22 +680,6 @@ static void keyspan_pda_dtr_rts(struct u } } -static int keyspan_pda_carrier_raised (struct usb_serial_port *port) -{ -struct usb_serial *serial = port->serial; -unsigned char modembits; - -/* If we can read the modem status and the DCD is low then -carrier is not raised yet */ -if (keyspan_pda_get_modem_info (serial, &modembits) >=0 ) { -if (!(modembits & (1 >>6 ))) -return 0 ; - } -/* Carrier raised, or we failed (eg disconnected) so -progress accordingly */ -return 1 ; -} -static int keyspan_pda_open (struct tty_struct *tty,struct usb_serial_port *port)
@@ -882,7 +866,6 @@ static struct usb_serial_driver keyspan_ .id_table = id_table_std, .num_ports = 1, .dtr_rts = keyspan_pda_dtr_rts, - .carrier_raised = keyspan_pda_carrier_raised, .open = keyspan_pda_open, .close = keyspan_pda_close, .write = keyspan_pda_write,
drivers/usb/serial/pl2303.c +11 -0
@@ -677,9 +677,11 @@ static void pl2303_update_line_status(st {struct pl2303_private *priv =usb_get_serial_port_data (port); +struct tty_struct *tty;unsigned long flags;u8 status_idx =UART_STATE ;u8 length =UART_STATE +1 ; +u8 prev_line_status;u16 idv, idp; idv =le16_to_cpu (port->serial->dev->descriptor.idVendor);
@@ -701,11 +703,20 @@ static void pl2303_update_line_status(st/* Save off the uart status for others to look at */ spin_lock_irqsave (&priv->lock, flags); + prev_line_status = priv->line_status; priv->line_status = data[status_idx];spin_unlock_irqrestore (&priv->lock, flags);if (priv->line_status &UART_BREAK_ERROR )usb_serial_handle_break (port);wake_up_interruptible (&priv->delta_msr_wait); + + tty =tty_port_tty_get (&port->port); +if (!tty) +return ; +if ((priv->line_status ^ prev_line_status) &UART_DCD ) +usb_serial_handle_dcd_change (port, tty, + priv->line_status &UART_DCD ); +tty_kref_put (tty); }static void pl2303_read_int_callback (struct urb *urb)
drivers/usb/serial/spcp8x5.c +5 -1
@@ -133,7 +133,7 @@ struct spcp8x5_usb_ctrl_arg {/* how come ??? */ #define UART_STATE 0x08 -#define UART_STATE_TRANSIENT_MASK 0x74 +#define UART_STATE_TRANSIENT_MASK 0x75#define UART_DCD 0x01#define UART_DSR 0x02#define UART_BREAK_ERROR 0x04
@@ -526,6 +526,10 @@ static void spcp8x5_process_read_urb(str/* overrun is special, not associated with a char */ if (status &UART_OVERRUN_ERROR )tty_insert_flip_char (tty,0 ,TTY_OVERRUN ); + +if (status &UART_DCD ) +usb_serial_handle_dcd_change (port, tty, + priv->line_status &MSR_STATUS_LINE_DCD ); } tty_insert_flip_string_fixed_flag(tty, data, tty_flag,
include/linux/usb/serial.h +3 -0
@@ -345,6 +345,9 @@ extern int usb_serial_generic_prepare_wrextern int usb_serial_handle_sysrq_char (struct usb_serial_port *port,unsigned int ch);extern int usb_serial_handle_break (struct usb_serial_port *port); +extern void usb_serial_handle_dcd_change (struct usb_serial_port *usb_port, +struct tty_struct *tty, +unsigned int status);extern int usb_serial_bus_register (struct usb_serial_driver *device);
PATCH 12/176 USB: CP210x Add two device IDs
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Craig Shelley <[email protected]>
commit faea63f7ccfddfb8fc19798799fcd38c58415172 upstream.
Device Ids added for IRZ Automation Teleport SG-10 GSM/GPRS Modem and DekTec DTA Plus VHF/UHF Booster/Attenuator.
--- drivers/usb/serial/cp210x.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/usb/serial/cp210x.c +2 -0
@@ -109,7 +109,9 @@ static const struct usb_device_id id_tab { USB_DEVICE(0x10C4, 0x8341) }, /* Siemens MC35PU GPRS Modem */ { USB_DEVICE(0x10C4, 0x8382) }, /* Cygnal Integrated Products, Inc. */ { USB_DEVICE(0x10C4, 0x83A8) }, /* Amber Wireless AMB2560 */ + { USB_DEVICE(0x10C4, 0x83D8) }, /* DekTec DTA Plus VHF/UHF Booster/Attenuator */ { USB_DEVICE(0x10C4, 0x8411) }, /* Kyocera GPS Module */ + { USB_DEVICE(0x10C4, 0x8418) }, /* IRZ Automation Teleport SG-10 GSM/GPRS Modem */ { USB_DEVICE(0x10C4, 0x846E) }, /* BEI USB Sensor Interface (VCP) */ { USB_DEVICE(0x10C4, 0x8477) }, /* Balluff RFID */ { USB_DEVICE(0x10C4, 0xEA60) }, /* Silicon Labs factory default */
PATCH 13/176 USB: CP210x Removed incorrect device ID
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Craig Shelley <[email protected]>
commit 9926c0df7b31b2128eebe92e0e2b052f380ea464 upstream.
Device ID removed 0x10C4/0x8149 for West Mountain Radio Computerized Battery Analyzer. This device is actually based on a SiLabs C8051Fxxx, see http://www.etheus.net/SiUSBXp_Linux_Driver for further info.
--- drivers/usb/serial/cp210x.c | 1 - 1 file changed, 1 deletion(-)
drivers/usb/serial/cp210x.c +0 -1
@@ -86,7 +86,6 @@ static const struct usb_device_id id_tab { USB_DEVICE(0x10C4, 0x8115) }, /* Arygon NFC/Mifare Reader */ { USB_DEVICE(0x10C4, 0x813D) }, /* Burnside Telecom Deskmobile */ { USB_DEVICE(0x10C4, 0x813F) }, /* Tams Master Easy Control */ - { USB_DEVICE(0x10C4, 0x8149) }, /* West Mountain Radio Computerized Battery Analyzer */ { USB_DEVICE(0x10C4, 0x814A) }, /* West Mountain Radio RIGblaster P&P */ { USB_DEVICE(0x10C4, 0x814B) }, /* West Mountain Radio RIGtalk */ { USB_DEVICE(0x10C4, 0x8156) }, /* B&G H3000 link cable */
PATCH 14/176 USB: qcaux: add Pantech UML290 device ID
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Dan Williams <[email protected]>
commit a58861fbde2a350df4d27fc62fb42905669b37ce upstream.
Another CDC-ACM + vendor specific interface layout for the QCDM port.
--- drivers/usb/serial/qcaux.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/usb/serial/qcaux.c +2 -0
@@ -36,6 +36,7 @@#define UTSTARCOM_PRODUCT_UM175_V1 0x3712#define UTSTARCOM_PRODUCT_UM175_V2 0x3714#define UTSTARCOM_PRODUCT_UM175_ALLTEL 0x3715 +#define PANTECH_PRODUCT_UML290_VZW 0x3718/* CMOTECH devices */ #define CMOTECH_VENDOR_ID 0x16d8
@@ -66,6 +67,7 @@ static struct usb_device_id id_table[] = { USB_DEVICE_AND_INTERFACE_INFO(LG_VENDOR_ID, LG_PRODUCT_VX4400_6000, 0xff, 0xff, 0x00) }, { USB_DEVICE_AND_INTERFACE_INFO(SANYO_VENDOR_ID, SANYO_PRODUCT_KATANA_LX, 0xff, 0xff, 0x00) }, { USB_DEVICE_AND_INTERFACE_INFO(SAMSUNG_VENDOR_ID, SAMSUNG_PRODUCT_U520, 0xff, 0x00, 0x00) }, + { USB_DEVICE_AND_INTERFACE_INFO(UTSTARCOM_VENDOR_ID, PANTECH_PRODUCT_UML290_VZW, 0xff, 0xff, 0xff) }, { }, };MODULE_DEVICE_TABLE (usb, id_table);
PATCH 15/176 USB: usb-storage: unusual_devs update for Cypress ATACB
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Richard Schütz <[email protected]>
commit cae41118f50ef0c431e13159df6d7dd8bbd54004 upstream.
New device ID added for unusual Cypress ATACB device.
--- drivers/usb/storage/unusual_cypress.h | 5 +++++ 1 file changed, 5 insertions(+)
drivers/usb/storage/unusual_cypress.h +5 -0
@@ -31,4 +31,9 @@ UNUSUAL_DEV( 0x04b4, 0x6831, 0x0000, 0x "Cypress ISD-300LP", US_SC_CYP_ATACB, US_PR_DEVICE, NULL, 0), +UNUSUAL_DEV( 0x14cd, 0x6116, 0x0000, 0x9999, + "Super Top", + "USB 2.0 SATA BRIDGE", + USB_SC_CYP_ATACB, USB_PR_DEVICE, NULL, 0), +#endif /* defined(CONFIG_USB_STORAGE_CYPRESS_ATACB) || ... */
PATCH 16/176 USB: usb-storage: unusual_devs update for TrekStor DataStation maxi g.u external hard drive enclosure
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: =?UTF-8?q?Richard=20Sch=C3=BCtz?= <[email protected]>
commit 7e1e7bd9dbd469267b6e6de1bf8d71a7d65ce86a upstream.
The TrekStor DataStation maxi g.u external hard drive enclosure uses a JMicron USB to SATA chip which needs the US_FL_IGNORE_RESIDUE flag to work properly.
--- drivers/usb/storage/unusual_devs.h | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/usb/storage/unusual_devs.h +9 -0
@@ -1866,6 +1866,15 @@ UNUSUAL_DEV( 0x1908, 0x1320, 0x0000, 0x0 US_SC_DEVICE, US_PR_DEVICE, NULL, US_FL_BAD_SENSE ), +/* Patch by Richard Sch�tz <[email protected]> +* This external hard drive enclosure uses a JMicron chip which +* needs the US_FL_IGNORE_RESIDUE flag to work properly. */ +UNUSUAL_DEV (0x1e68 ,0x001b ,0x0000 ,0x0000 , +"TrekStor GmbH & Co. KG" , +"DataStation maxi g.u" , +US_SC_DEVICE ,US_PR_DEVICE ,NULL , +US_FL_IGNORE_RESIDUE |US_FL_SANE_SENSE ), + UNUSUAL_DEV( 0x2116, 0x0320, 0x0001, 0x0001, "ST", "2A",
PATCH 17/176 USB: usb-storage: unusual_devs entry for CamSport Evo
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Alan Stern <[email protected]>
commit 12f68c480c7155a66bd2a76ab2fef28dd5f93fa2 upstream.
This patch (as1438) adds an unusual_devs entry for the MagicPixel FW_Omega2 chip, used in the CamSport Evo camera. The firmware incorrectly reports a vendor-specific bDeviceClass.
--- drivers/usb/storage/unusual_devs.h | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/usb/storage/unusual_devs.h +9 -0
@@ -1043,6 +1043,15 @@ UNUSUAL_DEV( 0x084d, 0x0011, 0x0110, 0x US_SC_DEVICE, US_PR_DEVICE, NULL, US_FL_BULK32), +/* Reported by <[email protected]> +* The device reports a vendor-specific device class, requiring an +* explicit vendor/product match. +*/ +UNUSUAL_DEV (0x0851 ,0x1542 ,0x0002 ,0x0002 , +"MagicPixel" , +"FW_Omega2" , + US_SC_DEVICE, US_PR_DEVICE, NULL, 0), +/* Andrew Lunn <[email protected]> * PanDigital Digital Picture Frame. Does not like ALLOW_MEDIUM_REMOVAL * on LUN 4.
PATCH 18/176 USB: usb-storage: unusual_devs entry for Coby MP3 player
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Alan Stern <[email protected]>
commit 3ea3c9b5a8464ec8223125f95e5dddb3bfd02a39 upstream.
This patch (as1444) adds an unusual_devs entry for an MP3 player from Coby electronics. The device has two nasty bugs.
--- drivers/usb/storage/unusual_devs.h | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/usb/storage/unusual_devs.h +7 -0
@@ -1884,6 +1884,13 @@ UNUSUAL_DEV( 0x1e68, 0x001b, 0x0000, 0x US_SC_DEVICE, US_PR_DEVICE, NULL, US_FL_IGNORE_RESIDUE | US_FL_SANE_SENSE ), +/* Reported by Jasper Mackenzie <[email protected]> */ +UNUSUAL_DEV (0x1e74 ,0x4621 ,0x0000 ,0x0000 , +"Coby Electronics" , +"MP3 Player" , +US_SC_DEVICE ,US_PR_DEVICE ,NULL , +US_FL_BULK_IGNORE_TAG |US_FL_MAX_SECTORS_64 ), + UNUSUAL_DEV( 0x2116, 0x0320, 0x0001, 0x0001, "ST", "2A",
PATCH 19/176 USB: serial: Updated support for ICOM devices
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Pieter Maes <[email protected]>
commit a9d61bc49188e32d2ae9cf0f683cde3e1744feef upstream.
I found the original patch on the db0fhn repeater wiki (couldn't find the email of the origial author) I guess it was never commited.
I updated and added some Icom HAM-radio devices to the ftdi driver. Added extra comments to make clear what devices it are.
--- drivers/usb/serial/ftdi_sio.c | 12 +++++++++++- drivers/usb/serial/ftdi_sio_ids.h | 20 ++++++++++++++++---- 2 files changed, 27 insertions(+), 5 deletions(-)
drivers/usb/serial/ftdi_sio.c +11 -1
@@ -675,7 +675,17 @@ static struct usb_device_id id_table_com { USB_DEVICE(FTDI_VID, FTDI_PCDJ_DAC2_PID) }, { USB_DEVICE(FTDI_VID, FTDI_RRCIRKITS_LOCOBUFFER_PID) }, { USB_DEVICE(FTDI_VID, FTDI_ASK_RDR400_PID) }, - { USB_DEVICE(ICOM_ID1_VID, ICOM_ID1_PID) }, + { USB_DEVICE(ICOM_VID, ICOM_ID_1_PID) }, + { USB_DEVICE(ICOM_VID, ICOM_OPC_U_UC_PID) }, + { USB_DEVICE(ICOM_VID, ICOM_ID_RP2C1_PID) }, + { USB_DEVICE(ICOM_VID, ICOM_ID_RP2C2_PID) }, + { USB_DEVICE(ICOM_VID, ICOM_ID_RP2D_PID) }, + { USB_DEVICE(ICOM_VID, ICOM_ID_RP2VT_PID) }, + { USB_DEVICE(ICOM_VID, ICOM_ID_RP2VR_PID) }, + { USB_DEVICE(ICOM_VID, ICOM_ID_RP4KVT_PID) }, + { USB_DEVICE(ICOM_VID, ICOM_ID_RP4KVR_PID) }, + { USB_DEVICE(ICOM_VID, ICOM_ID_RP2KVT_PID) }, + { USB_DEVICE(ICOM_VID, ICOM_ID_RP2KVR_PID) }, { USB_DEVICE(FTDI_VID, FTDI_ACG_HFDUAL_PID) }, { USB_DEVICE(FTDI_VID, FTDI_YEI_SERVOCENTER31_PID) }, { USB_DEVICE(FTDI_VID, FTDI_THORLABS_PID) },
drivers/usb/serial/ftdi_sio_ids.h +16 -4
@@ -569,11 +569,23 @@#define OCT_US101_PID 0x0421/* OCT US101 USB to RS-232 */ /* -* Icom ID-1 digital transceiver +* Definitions for Icom Inc. devices */ - -#define ICOM_ID1_VID 0x0C26 -#define ICOM_ID1_PID 0x0004 +#define ICOM_VID 0x0C26/* Icom vendor ID */ +/* Note: ID-1 is a communications tranceiver for HAM-radio operators */ +#define ICOM_ID_1_PID 0x0004/* ID-1 USB to RS-232 */ +/* Note: OPC is an Optional cable to connect an Icom Tranceiver */ +#define ICOM_OPC_U_UC_PID 0x0018/* OPC-478UC, OPC-1122U cloning cable */ +/* Note: ID-RP* devices are Icom Repeater Devices for HAM-radio */ +#define ICOM_ID_RP2C1_PID 0x0009/* ID-RP2C Asset 1 to RS-232 */ +#define ICOM_ID_RP2C2_PID 0x000A/* ID-RP2C Asset 2 to RS-232 */ +#define ICOM_ID_RP2D_PID 0x000B/* ID-RP2D configuration port*/ +#define ICOM_ID_RP2VT_PID 0x000C/* ID-RP2V Transmit config port */ +#define ICOM_ID_RP2VR_PID 0x000D/* ID-RP2V Receive config port */ +#define ICOM_ID_RP4KVT_PID 0x0010/* ID-RP4000V Transmit config port */ +#define ICOM_ID_RP4KVR_PID 0x0011/* ID-RP4000V Receive config port */ +#define ICOM_ID_RP2KVT_PID 0x0012/* ID-RP2000V Transmit config port */ +#define ICOM_ID_RP2KVR_PID 0x0013/* ID-RP2000V Receive config port */ /* * GN Otometrics (http://www.otometrics.com)
PATCH 20/176 USB: adding USB support for Cinterions HC2x, EU3 and PH8 products
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Nicolaus Colberg <[email protected]>
commit aa52b3a92918039b273fc9d1994bd34227c40269 upstream.
/drivers/usb/serial/option.c: Adding support for Cinterion's HC25, HC28, HC28J, EU3-E, EU3-P and PH8 by correcting/adding Cinterion's and Siemens' Vendor IDs as well as Product IDs and USB_DEVICE tuples
--- drivers/usb/serial/option.c | 23 +++++++++++++++++++++-- 1 file changed, 21 insertions(+), 2 deletions(-)
drivers/usb/serial/option.c +21 -2
@@ -382,7 +382,16 @@ static void option_instat_callback(struc#define HAIER_VENDOR_ID 0x201e#define HAIER_PRODUCT_CE100 0x2009 -#define CINTERION_VENDOR_ID 0x0681 +/* Cinterion (formerly Siemens) products */ +#define SIEMENS_VENDOR_ID 0x0681 +#define CINTERION_VENDOR_ID 0x1e2d +#define CINTERION_PRODUCT_HC25_MDM 0x0047 +#define CINTERION_PRODUCT_HC25_MDMNET 0x0040 +#define CINTERION_PRODUCT_HC28_MDM 0x004C +#define CINTERION_PRODUCT_HC28_MDMNET 0x004A/* same for HC28J */ +#define CINTERION_PRODUCT_EU3_E 0x0051 +#define CINTERION_PRODUCT_EU3_P 0x0052 +#define CINTERION_PRODUCT_PH8 0x0053/* Olivetti products */ #define OLIVETTI_VENDOR_ID 0x0b3c
@@ -939,7 +948,17 @@ static const struct usb_device_id option { USB_DEVICE(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_100F) }, { USB_DEVICE(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_1011)}, { USB_DEVICE(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_1012)}, - { USB_DEVICE(CINTERION_VENDOR_ID, 0x0047) }, +/* Cinterion */ + { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_EU3_E) }, + { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_EU3_P) }, + { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_PH8) }, + { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_HC28_MDM) }, + { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_HC28_MDMNET) }, + { USB_DEVICE(SIEMENS_VENDOR_ID, CINTERION_PRODUCT_HC25_MDM) }, + { USB_DEVICE(SIEMENS_VENDOR_ID, CINTERION_PRODUCT_HC25_MDMNET) }, + { USB_DEVICE(SIEMENS_VENDOR_ID, CINTERION_PRODUCT_HC28_MDM) }, /* HC28 enumerates with Siemens or Cinterion VID depending on FW revision */ + { USB_DEVICE(SIEMENS_VENDOR_ID, CINTERION_PRODUCT_HC28_MDMNET) }, + { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD100) }, { USB_DEVICE(CELOT_VENDOR_ID, CELOT_PRODUCT_CT680M) }, /* CT-650 CDMA 450 1xEVDO modem */ { } /* Terminating entry */
PATCH 21/176 USB serial: add missing .usb_driver field in serial drivers
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Alan Stern <[email protected]>
commit 5620b5f7f19e9ee3fcf6ecf493fed7821b7b495b upstream.
This patch (as1443) fixes a bug found in many of the USB serial
drivers: They don't set the .usb_driver field in their usb_serial_driver structure. This field is needed for assigning dynamic IDs for device matching.
In addition, starting with the 2.6.37 kernel, the .usb_driver field is needed for proper autosuspend operation. Without it, attempts to open the device file will fail.
--- drivers/usb/serial/io_tables.h | 1 + drivers/usb/serial/iuu_phoenix.c | 1 + drivers/usb/serial/keyspan.h | 4 ++++ drivers/usb/serial/moto_modem.c | 1 + drivers/usb/serial/oti6858.c | 1 + drivers/usb/serial/qcaux.c | 1 + drivers/usb/serial/siemens_mpi.c | 1 + drivers/usb/serial/spcp8x5.c | 1 + drivers/usb/serial/usb-serial.c | 8 ++++++-- drivers/usb/serial/usb_debug.c | 1 + 10 files changed, 18 insertions(+), 2 deletions(-)
drivers/usb/serial/io_tables.h +1 -0
@@ -196,6 +196,7 @@ static struct usb_serial_driver epic_dev .name = "epic", }, .description = "EPiC device", + .usb_driver = &io_driver, .id_table = Epic_port_id_table, .num_ports = 1, .open = edge_open,
drivers/usb/serial/iuu_phoenix.c +1 -0
@@ -1276,6 +1276,7 @@ static struct usb_serial_driver iuu_devi .name = "iuu_phoenix", }, .id_table = id_table, + .usb_driver = &iuu_driver, .num_ports = 1, .bulk_in_size = 512, .bulk_out_size = 512,
drivers/usb/serial/keyspan.h +4 -0
@@ -546,6 +546,7 @@ static struct usb_serial_driver keyspan_ .name = "keyspan_no_firm", }, .description = "Keyspan - (without firmware)", + .usb_driver = &keyspan_driver, .id_table = keyspan_pre_ids, .num_ports = 1, .attach = keyspan_fake_startup,
@@ -557,6 +558,7 @@ static struct usb_serial_driver keyspan_ .name = "keyspan_1", }, .description = "Keyspan 1 port adapter", + .usb_driver = &keyspan_driver, .id_table = keyspan_1port_ids, .num_ports = 1, .open = keyspan_open,
@@ -579,6 +581,7 @@ static struct usb_serial_driver keyspan_ .name = "keyspan_2", }, .description = "Keyspan 2 port adapter", + .usb_driver = &keyspan_driver, .id_table = keyspan_2port_ids, .num_ports = 2, .open = keyspan_open,
@@ -601,6 +604,7 @@ static struct usb_serial_driver keyspan_ .name = "keyspan_4", }, .description = "Keyspan 4 port adapter", + .usb_driver = &keyspan_driver, .id_table = keyspan_4port_ids, .num_ports = 4, .open = keyspan_open,
drivers/usb/serial/moto_modem.c +1 -0
@@ -44,6 +44,7 @@ static struct usb_serial_driver moto_dev .name = "moto-modem", }, .id_table = id_table, + .usb_driver = &moto_driver, .num_ports = 1, };
drivers/usb/serial/oti6858.c +1 -0
@@ -157,6 +157,7 @@ static struct usb_serial_driver oti6858_ .name = "oti6858", }, .id_table = id_table, + .usb_driver = &oti6858_driver, .num_ports = 1, .open = oti6858_open, .close = oti6858_close,
drivers/usb/serial/qcaux.c +1 -0
@@ -86,6 +86,7 @@ static struct usb_serial_driver qcaux_de .name = "qcaux", }, .id_table = id_table, + .usb_driver = &qcaux_driver, .num_ports = 1, };
drivers/usb/serial/siemens_mpi.c +1 -0
@@ -42,6 +42,7 @@ static struct usb_serial_driver siemens_ .name = "siemens_mpi", }, .id_table = id_table, + .usb_driver = &siemens_usb_mpi_driver, .num_ports = 1, };
drivers/usb/serial/spcp8x5.c +1 -0
@@ -650,6 +650,7 @@ static struct usb_serial_driver spcp8x5_ .name = "SPCP8x5", }, .id_table = id_table, + .usb_driver = &spcp8x5_driver, .num_ports = 1, .open = spcp8x5_open, .dtr_rts = spcp8x5_dtr_rts,
drivers/usb/serial/usb-serial.c +6 -2
@@ -1332,11 +1332,15 @@ int usb_serial_register(struct usb_seriareturn -ENODEV ;fixup_generic (driver); -if (driver->usb_driver) - driver->usb_driver->supports_autosuspend =1 ;if (!driver->description) driver->description = driver->driver.name; +if (!driver->usb_driver) { +WARN (1 ,"Serial driver %s has no usb_driver\n" , + driver->description); +return -EINVAL ; + } + driver->usb_driver->supports_autosuspend =1 ;/* Add this device to our list of devices */ mutex_lock (&table_lock);
drivers/usb/serial/usb_debug.c +1 -0
@@ -75,6 +75,7 @@ static struct usb_serial_driver debug_de .name = "debug", }, .id_table = id_table, + .usb_driver = &debug_driver, .num_ports = 1, .bulk_out_size = USB_DEBUG_MAX_PACKET_SIZE, .break_ctl = usb_debug_break_ctl,
PATCH 22/176 USB: EHCI: ASPM quirk of ISOC on AMD Hudson
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Alex He <[email protected]>
commit baab93afc2844b68d57b0dcca5e1d34c5d7cf411 upstream.
AMD Hudson also needs the same ASPM quirk as SB800
--- drivers/usb/host/ehci-pci.c | 33 ++++++++++++++++++++------------- 1 file changed, 20 insertions(+), 13 deletions(-)
drivers/usb/host/ehci-pci.c +20 -13
@@ -41,28 +41,35 @@ static int ehci_pci_reinit(struct ehci_hreturn 0 ; } -static int ehci_quirk_amd_SB800 (struct ehci_hcd *ehci) +static int ehci_quirk_amd_hudson (struct ehci_hcd *ehci) {struct pci_dev *amd_smbus_dev;u8 rev =0 ; amd_smbus_dev =pci_get_device (PCI_VENDOR_ID_ATI ,0x4385 ,NULL ); -if (!amd_smbus_dev) -return 0 ; - -pci_read_config_byte (amd_smbus_dev,PCI_REVISION_ID , &rev); -if (rev <0x40 ) { -pci_dev_put (amd_smbus_dev); - amd_smbus_dev =NULL ; -return 0 ; +if (amd_smbus_dev) { +pci_read_config_byte (amd_smbus_dev,PCI_REVISION_ID , &rev); +if (rev <0x40 ) { +pci_dev_put (amd_smbus_dev); + amd_smbus_dev =NULL ; +return 0 ; + } + }else { + amd_smbus_dev =pci_get_device (PCI_VENDOR_ID_AMD ,0x780b ,NULL ); +if (!amd_smbus_dev) +return 0 ; +pci_read_config_byte (amd_smbus_dev,PCI_REVISION_ID , &rev); +if (rev <0x11 || rev >0x18 ) { +pci_dev_put (amd_smbus_dev); + amd_smbus_dev =NULL ; +return 0 ; + } }if (!amd_nb_dev) amd_nb_dev =pci_get_device (PCI_VENDOR_ID_AMD ,0x1510 ,NULL ); -if (!amd_nb_dev) -ehci_err (ehci,"QUIRK: unable to get AMD NB device\n" ); -ehci_info (ehci,"QUIRK: Enable AMD SB800 L1 fix\n" ); +ehci_info (ehci,"QUIRK: Enable exception for AMD Hudson ASPM\n" );pci_dev_put (amd_smbus_dev); amd_smbus_dev =NULL ;
@@ -128,7 +135,7 @@ static int ehci_pci_setup(struct usb_hcd/* cache this readonly data; minimize chip reads */ ehci->hcs_params =ehci_readl (ehci, &ehci->caps->hcs_params); -if (ehci_quirk_amd_SB800 (ehci)) +if (ehci_quirk_amd_hudson (ehci)) ehci->amd_l1_fix =1 ; retval =ehci_halt (ehci);
PATCH 23/176 USB: EHCI: fix DMA deallocation bug
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Alan Stern <[email protected]>
commit f75593ceaa08e6d27aec1a5de31cded19e850dd1 upstream.
This patch (as1440) fixes a bug in ehci-hcd. ehci->periodic_size is used to compute the size in a dma_alloc_coherent() call, but then it gets changed later on. As a result, the corresponding call to dma_free_coherent() passes a different size from the original allocation. Fix the problem by adjusting ehci->periodic_size before carrying out any of the memory allocations.
--- drivers/usb/host/ehci-hcd.c | 19 ++++++++++++------- 1 file changed, 12 insertions(+), 7 deletions(-)
drivers/usb/host/ehci-hcd.c +12 -7
@@ -557,6 +557,8 @@ static int ehci_init(struct usb_hcd *hcd ehci->iaa_watchdog.function = ehci_iaa_watchdog; ehci->iaa_watchdog.data = (unsigned long ) ehci; + hcc_params =ehci_readl (ehci, &ehci->caps->hcc_params); +/* * hw default: 1K periodic list heads, one per frame. * periodic_size can shrink by USBCMD update if hcc_params allows.
@@ -564,11 +566,20 @@ static int ehci_init(struct usb_hcd *hcd ehci->periodic_size =DEFAULT_I_TDPS ;INIT_LIST_HEAD (&ehci->cached_itd_list);INIT_LIST_HEAD (&ehci->cached_sitd_list); + +if (HCC_PGM_FRAMELISTLEN (hcc_params)) { +/* periodic schedule size can be smaller than default */ +switch (EHCI_TUNE_FLS ) { +case 0 : ehci->periodic_size =1024 ;break ; +case 1 : ehci->periodic_size =512 ;break ; +case 2 : ehci->periodic_size =256 ;break ; +default :BUG (); + } + }if ((retval =ehci_mem_init (ehci,GFP_KERNEL )) <0 )return retval;/* controllers may cache some of the periodic schedule ... */ - hcc_params =ehci_readl (ehci, &ehci->caps->hcc_params);if (HCC_ISOC_CACHE (hcc_params))// full frame cache ehci->i_thresh =2 +8 ;else // N microframes cached
@@ -622,12 +633,6 @@ static int ehci_init(struct usb_hcd *hcd/* periodic schedule size can be smaller than default */ temp &= ~(3 <<2 ); temp |= (EHCI_TUNE_FLS <<2 ); -switch (EHCI_TUNE_FLS ) { -case 0 : ehci->periodic_size =1024 ;break ; -case 1 : ehci->periodic_size =512 ;break ; -case 2 : ehci->periodic_size =256 ;break ; -default :BUG (); - } }if (HCC_LPM (hcc_params)) {/* support link power management EHCI 1.1 addendum */
PATCH 24/176 USB: g_printer: fix bug in unregistration
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Alan Stern <[email protected]>
commit d5aa475180d03d45c5dc6134aa833f1b3e89c45e upstream.
This patch (as1441) fixes a bug in g_printer. The gadget driver, char device number, and class device should be unregistered in reverse order of registration. As it is now, when the module is unloaded the class device gets unregistered first, causing a crash when the unbind method tries to access it.
This fixes Bugzilla #25882.
--- drivers/usb/gadget/printer.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/usb/gadget/printer.c +2 -3
@@ -1596,13 +1596,12 @@ cleanup(void)int status;mutex_lock (&usb_printer_gadget.lock_printer_io); -class_destroy (usb_gadget_class); -unregister_chrdev_region (g_printer_devno,2 ); - status =usb_gadget_unregister_driver (&printer_driver);if (status)ERROR (dev,"usb_gadget_unregister_driver %x\n" , status); +unregister_chrdev_region (g_printer_devno,2 ); +class_destroy (usb_gadget_class);mutex_unlock (&usb_printer_gadget.lock_printer_io); }module_exit (cleanup);
PATCH 25/176 USB: g_printer: fix bug in module parameter definitions
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Alan Stern <[email protected]>
commit ad84e4a9efb7c8ed322bafb6ebdb9c3a49a3d3a8 upstream.
This patch (as1442) fixes a bug in g_printer: Module parameters should not be marked "__initdata" if they are accessible in sysfs (i.e., if the mode value in the module_param() macro is nonzero). Otherwise attempts to access the parameters will cause addressing violations.
Character-string module parameters must not be marked "__initdata" if the module can be unloaded, because the kernel needs to access the parameter variable at unload time in order to free the dynamically-allocated string.
--- drivers/usb/gadget/printer.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)
drivers/usb/gadget/printer.c +7 -7
@@ -131,31 +131,31 @@ static struct printer_dev usb_printer_ga* parameters are in UTF-8 (superset of ASCII's 7 bit characters). */ -static ushort __initdata idVendor; +static ushort idVendor;module_param (idVendor, ushort,S_IRUGO );MODULE_PARM_DESC (idVendor,"USB Vendor ID" ); -static ushort __initdata idProduct; +static ushort idProduct;module_param (idProduct, ushort,S_IRUGO );MODULE_PARM_DESC (idProduct,"USB Product ID" ); -static ushort __initdata bcdDevice; +static ushort bcdDevice;module_param (bcdDevice, ushort,S_IRUGO );MODULE_PARM_DESC (bcdDevice,"USB Device version (BCD)" ); -static char *__initdata iManufacturer; +static char *iManufacturer;module_param (iManufacturer, charp,S_IRUGO );MODULE_PARM_DESC (iManufacturer,"USB Manufacturer string" ); -static char *__initdata iProduct; +static char *iProduct;module_param (iProduct, charp,S_IRUGO );MODULE_PARM_DESC (iProduct,"USB Product string" ); -static char *__initdata iSerialNum; +static char *iSerialNum;module_param (iSerialNum, charp,S_IRUGO );MODULE_PARM_DESC (iSerialNum,"1" ); -static char *__initdata iPNPstring; +static char *iPNPstring;module_param (iPNPstring, charp,S_IRUGO );MODULE_PARM_DESC (iPNPstring,"MFG:linux;MDL:g_printer;CLS:PRINTER;SN:1;" );
PATCH 26/176 USB: io_edgeport: fix the reported firmware major and minor
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Bjørn Mork <[email protected]>
commit 271c1150b4f8e1685e5a8cbf76e329ec894481da upstream.
The major and minor number saved in the product_info structure were copied from the address instead of the data, causing an inconsistency in the reported versions during firmware loading:
usb 4-1: firmware: requesting edgeport/down.fw /usr/src/linux/drivers/usb/serial/io_edgeport.c: downloading firmware version (930) 1.16.4 [..]
/usr/src/linux/drivers/usb/serial/io_edgeport.c: edge_startup - time 3 4328191260
/usr/src/linux/drivers/usb/serial/io_edgeport.c: FirmwareMajorVersion 0.0.4
This can cause some confusion whether firmware loaded successfully or not.
--- drivers/usb/serial/io_edgeport.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/usb/serial/io_edgeport.c +2 -2
@@ -2894,8 +2894,8 @@ static void load_application_firmware(stdbg ("%s %d.%d.%d" , fw_info, rec->data[0 ], rec->data[1 ], build); - edge_serial->product_info.FirmwareMajorVersion = fw->data[0 ]; - edge_serial->product_info.FirmwareMinorVersion = fw->data[1 ]; + edge_serial->product_info.FirmwareMajorVersion = rec->data[0 ]; + edge_serial->product_info.FirmwareMinorVersion = rec->data[1 ]; edge_serial->product_info.FirmwareBuildNumber =cpu_to_le16 (build); for (rec = ihex_next_binrec(rec); rec;
PATCH 27/176 USB: ti_usb: fix module removal
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Ionut Nicu <[email protected]>
commit b14de3857227cd978f515247853fd15cc2425d3e upstream.
If usb_deregister() is called after usb_serial_deregister() when the device is plugged in, the following Oops occurs:
[ 95.337377] BUG: unable to handle kernel NULL pointer dereference at 00000010 [ 95.338236] IP: [<c0776b2d>] klist_put+0x12/0x62 [ 95.338356] *pdpt = 000000003001a001 *pde = 0000000000000000 [ 95.338356] Oops: 0000 [#1] SMP [ 95.340499] last sysfs file: /sys/devices/pci0000:00/0000:00:1d.2/usb8/idVendor [ 95.340499] Modules linked in: ti_usb_3410_5052(-) usbserial cpufreq_ondemand acpi_cpufreq mperf iptable_nat nf_nat iptable_mangle ip6t_REJECT nf_conntrack_ipv6 nf_defrag_ipv6 ip6table_filter ip6_tables ipv6 uinput arc4 ecb iwlagn iwlcore mac80211 cfg80211 microcode pcspkr acer_wmi joydev wmi sky2 [last unloaded: scsi_wait_scan] [ 95.341908] [ 95.341908] Pid: 1532, comm: modprobe Not tainted 2.6.37-rc7+ #6 Eiger /Aspire 5930 [ 95.341908] EIP: 0060:[<c0776b2d>] EFLAGS: 00010246 CPU: 0 [ 95.341908] EIP is at klist_put+0x12/0x62 [ 95.341908] EAX: 00000000 EBX: eedc0c84 ECX: c09c21b4 EDX: 00000001 [ 95.341908] ESI: 00000000 EDI: efaa0c1c EBP: f214fe2c ESP: f214fe1c [ 95.341908] DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068 [ 95.341908] Process modprobe (pid: 1532, ti=f214e000 task=efaaf080 task.ti=f214e000) [ 95.341908] Stack: [ 95.341908] f214fe24 eedc0c84 efaaf080 efaa0c1c f214fe34 c0776ba8 f214fe5c c0776c76 [ 95.341908] c09c21b4 c09c21b4 eedc0c84 efaaf080 00000000 c0634398 eafe2d1c f7b515f0 [ 95.341908] f214fe6c c0631b5c eafe2d50 eafe2d1c f214fe7c c0631ba2 eafe2d1c eafe2c00 [ 95.341908] Call Trace: [ 95.341908] [<c0776ba8>] ? klist_del+0xd/0xf [ 95.341908] [<c0776c76>] ? klist_remove+0x48/0x74 [ 95.341908] [<c0634398>] ? devres_release_all+0x49/0x51 [ 95.341908] [<c0631b5c>] ? __device_release_driver+0x7b/0xa4 [ 95.341908] [<c0631ba2>] ? device_release_driver+0x1d/0x28 [ 95.341908] [<c06317c4>] ? bus_remove_device+0x92/0xa1 [ 95.341908] [<c062f3d8>] ? device_del+0xf9/0x13e [ 95.341908] [<f7b06146>] ? usb_serial_disconnect+0xd9/0x116 [usbserial] [ 95.341908] [<c0681e3f>] ? usb_disable_interface+0x32/0x40 [ 95.341908] [<c0683972>] ? usb_unbind_interface+0x48/0xfd [ 95.341908] [<c0631b43>] ? __device_release_driver+0x62/0xa4 [ 95.341908] [<c06320b9>] ? driver_detach+0x62/0x81 [ 95.341908] [<c0631a41>] ? bus_remove_driver+0x8f/0xae [ 95.341908] [<c063214c>] ? driver_unregister+0x50/0x57 [ 95.341908] [<c0682f95>] ? usb_deregister+0x77/0x84 [ 95.341908] [<f7b505b6>] ? ti_exit+0x26/0x28 [ti_usb_3410_5052] [ 95.341908] [<c046a307>] ? sys_delete_module+0x181/0x1de [ 95.341908] [<c04e2727>] ? path_put+0x1a/0x1d [ 95.341908] [<c047f4c5>] ? audit_syscall_entry+0x116/0x138 [ 95.341908] [<c04094df>] ? sysenter_do_call+0x12/0x28 [ 95.341908] Code: 00 83 7d f0 00 74 09 85 f6 74 05 89 f0 ff 55 f0 8b 43 04 5a 5b 5e 5f 5d c3 55 89 e5 57 56 53 89 c3 83 ec 04 8b 30 83 e6 fe 89 f0 <8b> 7e 10 88 55 f0 e8 47 26 01 00 8a 55 f0 84 d2 74 17 f6 03 01 [ 95.341908] EIP: [<c0776b2d>] klist_put+0x12/0x62 SS:ESP 0068:f214fe1c [ 95.341908] CR2: 0000000000000010 [ 95.342357] ---[ end trace 8124d00ad871ad18 ]---
--- drivers/usb/serial/ti_usb_3410_5052.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/serial/ti_usb_3410_5052.c +1 -1
@@ -365,9 +365,9 @@ failed_1port: static void __exit ti_exit(void) { +usb_deregister (&ti_usb_driver);usb_serial_deregister (&ti_1port_device);usb_serial_deregister (&ti_2port_device); -usb_deregister (&ti_usb_driver); }
PATCH 28/176 USB: Storage: Add unusual_devs entry for VTech Kidizoom
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Nick Holloway <[email protected]>
commit c25f6b1591b158f7ae3b9132367d0fa6d632e70e upstream.
This device suffers from the off-by-one error when reporting the capacity, so add entry with US_FL_FIX_CAPACITY.
--- drivers/usb/storage/unusual_devs.h | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/usb/storage/unusual_devs.h +7 -0
@@ -1396,6 +1396,13 @@ UNUSUAL_DEV( 0x0f19, 0x0105, 0x0100, 0x US_SC_DEVICE, US_PR_DEVICE, NULL, US_FL_IGNORE_RESIDUE ), +/* Submitted by Nick Holloway */ +UNUSUAL_DEV (0x0f88 ,0x042e ,0x0100 ,0x0100 , +"VTech" , +"Kidizoom" , +US_SC_DEVICE ,US_PR_DEVICE ,NULL , +US_FL_FIX_CAPACITY ), +/* Reported by Michael Stattmann <[email protected]> */ UNUSUAL_DEV( 0x0fce, 0xd008, 0x0000, 0x0000, "Sony Ericsson",
PATCH 29/176 USB: ftdi_sio: add ST Micro Connect Lite uart support
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Jean-Christophe PLAGNIOL-VILLARD <[email protected]>
commit 6ec2f46c4b4abf48c88c0ae7c476f347b97e1105 upstream.
on ST Micro Connect Lite we have 4 port
Part A and B for the JTAG
Port C Uart
Port D for PIO
--- drivers/usb/serial/ftdi_sio.c | 26 ++++++++++++++++++++++++++ drivers/usb/serial/ftdi_sio_ids.h | 6 ++++++ 2 files changed, 32 insertions(+)
drivers/usb/serial/ftdi_sio.c +26 -0
@@ -99,6 +99,7 @@ struct ftdi_sio_quirk {static int ftdi_jtag_probe (struct usb_serial *serial);static int ftdi_mtxorb_hack_setup (struct usb_serial *serial);static int ftdi_NDI_device_setup (struct usb_serial *serial); +static int ftdi_stmclite_probe (struct usb_serial *serial);static void ftdi_USB_UIRT_setup (struct ftdi_private *priv);static void ftdi_HE_TIRA1_setup (struct ftdi_private *priv);
@@ -122,6 +123,10 @@ static struct ftdi_sio_quirk ftdi_HE_TIR .port_probe = ftdi_HE_TIRA1_setup, }; +static struct ftdi_sio_quirk ftdi_stmclite_quirk = { + .probe = ftdi_stmclite_probe, +}; +/* * The 8U232AM has the same API as the sio except for: * - it can support MUCH higher baudrates; up to:
@@ -809,6 +814,8 @@ static struct usb_device_id id_table_com { USB_DEVICE(FTDI_VID, FTDI_DOTEC_PID) }, { USB_DEVICE(QIHARDWARE_VID, MILKYMISTONE_JTAGSERIAL_PID), .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, + { USB_DEVICE(ST_VID, ST_STMCLT1030_PID), + .driver_info = (kernel_ulong_t)&ftdi_stmclite_quirk }, { }, /* Optional parameter entry */ { } /* Terminating entry */ };
@@ -1690,6 +1697,25 @@ static int ftdi_jtag_probe(struct usb_se }/* +* First and second port on STMCLiteadaptors is reserved for JTAG interface +* and the forth port for pio +*/ +static int ftdi_stmclite_probe (struct usb_serial *serial) +{ +struct usb_device *udev = serial->dev; +struct usb_interface *interface = serial->interface; + +dbg ("%s" , __func__); + +if (interface == udev->actconfig->interface[2 ]) +return 0 ; + +dev_info (&udev->dev,"Ignoring serial port reserved for JTAG\n" ); + +return -ENODEV ; +} + +/* * The Matrix Orbital VK204-25-USB has an invalid IN endpoint. * We have to correct it if we want to read from it. */
drivers/usb/serial/ftdi_sio_ids.h +6 -0
@@ -1034,6 +1034,12 @@#define WHT_PID 0x0004/* Wireless Handheld Terminal */ /* +* STMicroelectonics +*/ +#define ST_VID 0x0483 +#define ST_STMCLT1030_PID 0x3747/* ST Micro Connect Lite STMCLT1030 */ + +/* * Papouch products (http://www.papouch.com/) * Submitted by Folkert van Heusden */
PATCH 30/176 USB: cdc-acm: Adding second ACM channel support for Nokia N8
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Arvid Ephraim Picciani <[email protected]>
commit 721d92fc6373dee15846216f9d178ec240ec0fd7 upstream.
This adds the N8 to the list of devices in cdc-acm, in order to get the secondary ACM device exposed.
In the spirit of:
http://kerneltrap.org/mailarchive/linux-usb/2010/9/4/6264554
--- drivers/usb/class/cdc-acm.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/class/cdc-acm.c +1 -0
@@ -1607,6 +1607,7 @@ static const struct usb_device_id acm_id { NOKIA_PCSUITE_ACM_INFO(0x0154), }, /* Nokia 5800 XpressMusic */ { NOKIA_PCSUITE_ACM_INFO(0x04ce), }, /* Nokia E90 */ { NOKIA_PCSUITE_ACM_INFO(0x01d4), }, /* Nokia E55 */ + { NOKIA_PCSUITE_ACM_INFO(0x0302), }, /* Nokia N8 */ { SAMSUNG_PCSUITE_ACM_INFO(0x6651), }, /* Samsung GTi8510 (INNOV8) *//* NOTE: non-Nokia COMM/ACM/0xff is likely MSFT RNDIS... NOT a modem! */
PATCH 31/176 USB: ftdi_sio: Add VID=0x0647, PID=0x0100 for Acton Research spectrograph
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Michael Williamson <[email protected]>
commit 28fe2eb0162a1d23370dd99ff7d0e35632b1ee91 upstream.
Add the USB Vendor ID and Product ID for a Acton Research Corp. spectrograph device with a FTDI chip for serial I/O.
--- drivers/usb/serial/ftdi_sio.c | 1 + drivers/usb/serial/ftdi_sio_ids.h | 6 ++++++ 2 files changed, 7 insertions(+)
drivers/usb/serial/ftdi_sio.c +1 -0
@@ -620,6 +620,7 @@ static struct usb_device_id id_table_com { USB_DEVICE(FTDI_VID, FTDI_OCEANIC_PID) }, { USB_DEVICE(TTI_VID, TTI_QL355P_PID) }, { USB_DEVICE(FTDI_VID, FTDI_RM_CANVIEW_PID) }, + { USB_DEVICE(ACTON_VID, ACTON_SPECTRAPRO_PID) }, { USB_DEVICE(CONTEC_VID, CONTEC_COM1USBH_PID) }, { USB_DEVICE(BANDB_VID, BANDB_USOTL4_PID) }, { USB_DEVICE(BANDB_VID, BANDB_USTL4_PID) },
drivers/usb/serial/ftdi_sio_ids.h +6 -0
@@ -518,6 +518,12 @@#define RATOC_PRODUCT_ID_USB60F 0xb020/* +* Acton Research Corp. +*/ +#define ACTON_VID 0x0647/* Vendor ID */ +#define ACTON_SPECTRAPRO_PID 0x0100 + +/* * Contec products (http://www.contec.com) * Submitted by Daniel Sangorrin */
PATCH 32/176 USB: EHCI: fix scheduling while atomic during suspend
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Yin Kangkai <[email protected]>
commit 148fc55fd0449683a1d15bf219ad8d8b6fa17545 upstream.
There is a msleep with spin lock held during ehci pci suspend, which will cause kernel BUG: scheduling while atomic. Fix that.
[ 184.139620] BUG: scheduling while atomic: kworker/u:11/416/0x00000002
[ 184.139632] 4 locks held by kworker/u:11/416:
[ 184.139640] #0: (events_unbound){+.+.+.}, at: [<c104ddd4>] process_one_work+0x1b3/0x4cb
[ 184.139669] #1: ((&entry->work)){+.+.+.}, at: [<c104ddd4>] process_one_work+0x1b3/0x4cb
[ 184.139686] #2: (&__lockdep_no_validate__){+.+.+.}, at: [<c127cde3>] __device_suspend+0x2c/0x154
[ 184.139706] #3: (&(&ehci->lock)->rlock){-.-...}, at: [<c132f3d8>] ehci_pci_suspend+0x35/0x7b
[ 184.139725] Modules linked in: serio_raw pegasus joydev mrst_gfx(C) battery
[ 184.139748] irq event stamp: 52
[ 184.139753] hardirqs last enabled at (51): [<c14fdaac>] mutex_lock_nested+0x258/0x293
[ 184.139766] hardirqs last disabled at (52): [<c14fe7b4>] _raw_spin_lock_irqsave+0xf/0x3e
[ 184.139777] softirqs last enabled at (0): [<c10371c1>] copy_process+0x3d2/0x109d
[ 184.139789] softirqs last disabled at (0): [< (null)>] (null)
[ 184.139802] Pid: 416, comm: kworker/u:11 Tainted: G C 2.6.37-6.3-adaptation-oaktrail #37
[ 184.139809] Call Trace:
[ 184.139820] [<c102eeff>] __schedule_bug+0x5e/0x65
[ 184.139829] [<c14fbca5>] schedule+0xac/0xc4c
[ 184.139840] [<c11d4845>] ? string+0x37/0x8b
[ 184.139853] [<c1044f21>] ? lock_timer_base+0x1f/0x3e
[ 184.139863] [<c14fe7da>] ? _raw_spin_lock_irqsave+0x35/0x3e
[ 184.139876] [<c1061590>] ? trace_hardirqs_off+0xb/0xd
[ 184.139885] [<c14fccdc>] schedule_timeout+0x283/0x2d9
[ 184.139896] [<c104516f>] ? process_timeout+0x0/0xa
[ 184.139906] [<c14fcd47>] schedule_timeout_uninterruptible+0x15/0x17
[ 184.139916] [<c104566a>] msleep+0x10/0x16
[ 184.139926] [<c132f316>] ehci_adjust_port_wakeup_flags+0x69/0xf6
[ 184.139937] [<c132f3eb>] ehci_pci_suspend+0x48/0x7b
[ 184.139946] [<c1326587>] suspend_common+0x52/0xbb
[ 184.139956] [<c1326625>] hcd_pci_suspend+0x26/0x28
[ 184.139967] [<c11e7182>] pci_pm_suspend+0x5f/0xd0
[ 184.139976] [<c127ca3a>] pm_op+0x5d/0xf0
[ 184.139986] [<c127ceac>] __device_suspend+0xf5/0x154
[ 184.139996] [<c127d2c8>] async_suspend+0x16/0x3a
[ 184.140006] [<c1058f54>] async_run_entry_fn+0x89/0x111
[ 184.140016] [<c104deb6>] process_one_work+0x295/0x4cb
[ 184.140026] [<c1058ecb>] ? async_run_entry_fn+0x0/0x111
[ 184.140036] [<c104e3d0>] worker_thread+0x17f/0x298
[ 184.140045] [<c104e251>] ? worker_thread+0x0/0x298
[ 184.140055] [<c105277f>] kthread+0x64/0x69
[ 184.140064] [<c105271b>] ? kthread+0x0/0x69
[ 184.140075] [<c1002efa>] kernel_thread_helper+0x6/0x1a--- drivers/usb/host/ehci-au1xxx.c | 2 +- drivers/usb/host/ehci-hub.c | 7 +++++++ drivers/usb/host/ehci-pci.c | 2 +- 3 files changed, 9 insertions(+), 2 deletions(-)
drivers/usb/host/ehci-au1xxx.c +1 -1
@@ -227,8 +227,8 @@ static int ehci_hcd_au1xxx_drv_suspend(s* mark HW unaccessible. The PM and USB cores make sure that * the root hub is either suspended or stopped. */ -spin_lock_irqsave (&ehci->lock, flags);ehci_prepare_ports_for_controller_suspend (ehci,device_may_wakeup (dev)); +spin_lock_irqsave (&ehci->lock, flags);ehci_writel (ehci,0 , &ehci->regs->intr_enable); (void )ehci_readl (ehci, &ehci->regs->intr_enable);
drivers/usb/host/ehci-hub.c +7 -0
@@ -111,6 +111,7 @@ static void ehci_adjust_port_wakeup_flag {int port;u32 temp; +unsigned long flags;/* If remote wakeup is enabled for the root hub but disabled * for the controller, we must adjust all the port wakeup flags
@@ -120,6 +121,8 @@ static void ehci_adjust_port_wakeup_flagif (!ehci_to_hcd (ehci)->self.root_hub->do_remote_wakeup || do_wakeup)return ; +spin_lock_irqsave (&ehci->lock, flags); +/* clear phy low-power mode before changing wakeup flags */ if (ehci->has_hostpc) { port =HCS_N_PORTS (ehci->hcs_params);
@@ -131,7 +134,9 @@ static void ehci_adjust_port_wakeup_flag temp =ehci_readl (ehci, hostpc_reg);ehci_writel (ehci, temp & ~HOSTPC_PHCD , hostpc_reg); } +spin_unlock_irqrestore (&ehci->lock, flags);msleep (5 ); +spin_lock_irqsave (&ehci->lock, flags); } port =HCS_N_PORTS (ehci->hcs_params);
@@ -170,6 +175,8 @@ static void ehci_adjust_port_wakeup_flag/* Does the root hub have a port wakeup pending? */ if (!suspending && (ehci_readl (ehci, &ehci->regs->status) &STS_PCD ))usb_hcd_resume_root_hub (ehci_to_hcd (ehci)); + +spin_unlock_irqrestore (&ehci->lock, flags); }static int ehci_bus_suspend (struct usb_hcd *hcd)
drivers/usb/host/ehci-pci.c +1 -1
@@ -347,8 +347,8 @@ static int ehci_pci_suspend(struct usb_h* mark HW unaccessible. The PM and USB cores make sure that * the root hub is either suspended or stopped. */ -spin_lock_irqsave (&ehci->lock, flags);ehci_prepare_ports_for_controller_suspend (ehci, do_wakeup); +spin_lock_irqsave (&ehci->lock, flags);ehci_writel (ehci,0 , &ehci->regs->intr_enable); (void )ehci_readl (ehci, &ehci->regs->intr_enable);
PATCH 33/176 USB: prevent buggy hubs from crashing the USB stack
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Alan Stern <[email protected]>
commit d199c96d41d80a567493e12b8e96ea056a1350c1 upstream.
If anyone comes across a high-speed hub that (by mistake or by design) claims to have no Transaction Translators, plugging a full- or low-speed device into it will cause the USB stack to crash. This patch (as1446) prevents the problem by ignoring such devices, since the kernel has no way to communicate with them.
--- drivers/usb/core/hub.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/usb/core/hub.c +5 -0
@@ -2722,6 +2722,11 @@ hub_port_init (struct usb_hub *hub, stru udev->ttport = hdev->ttport; }else if (udev->speed !=USB_SPEED_HIGH && hdev->speed ==USB_SPEED_HIGH ) { +if (!hub->tt.hub) { +dev_err (&udev->dev,"parent hub has no TT\n" ); + retval = -EINVAL ; + goto fail; + } udev->tt = &hub->tt; udev->ttport = port1; }
PATCH 34/176 USB: fix race between root-hub resume and wakeup requests
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Alan Stern <[email protected]>
commit bf3d7d40e42a85ca73a34e1385ff34f092a384eb upstream.
The USB core keeps track of pending resume requests for root hubs, in order to resolve races between wakeup requests and suspends. However the code that does this is subject to another race (between wakeup requests and resumes) because the WAKEUP_PENDING flag is cleared before the resume occurs, leaving a window in which another wakeup request might arrive.
This patch (as1447) fixes the problem by clearing the WAKEUP_PENDING flag after the resume instead of before it.
This fixes Bugzilla #24952.
--- drivers/usb/core/hcd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/core/hcd.c +1 -1
@@ -1945,7 +1945,6 @@ int hcd_bus_resume(struct usb_device *rhdev_dbg (&rhdev->dev,"usb %s%s\n" , (msg.event &PM_EVENT_AUTO ?"auto-" :"" ),"resume" ); -clear_bit (HCD_FLAG_WAKEUP_PENDING , &hcd->flags);if (!hcd->driver->bus_resume)return -ENOENT ;if (hcd->state ==HC_STATE_RUNNING )
@@ -1953,6 +1952,7 @@ int hcd_bus_resume(struct usb_device *rh hcd->state =HC_STATE_RESUMING ; status = hcd->driver->bus_resume (hcd); +clear_bit (HCD_FLAG_WAKEUP_PENDING , &hcd->flags);if (status ==0 ) {/* TRSMRCY = 10 msec */ msleep (10 );
PATCH 35/176 staging: zram: fix data corruption issue
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Nitin Gupta <[email protected]>
commit 5414e557fca545614ceedc3d3496f747457e2e3b upstream.
In zram_read() and zram_write() we were not incrementing the index number and thus were reading/writing values from/to incorrect sectors on zram disk, resulting in data corruption.
--- drivers/staging/zram/zram_drv.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/staging/zram/zram_drv.c +4 -0
@@ -235,6 +235,7 @@ static int zram_read(struct zram *zram,if (zram_test_flag (zram, index,ZRAM_ZERO )) {handle_zero_page (page); + index++;continue ; }
@@ -243,12 +244,14 @@ static int zram_read(struct zram *zram,pr_debug ("Read before write: sector=%lu, size=%u" , (ulong)(bio->bi_sector), bio->bi_size);/* Do nothing */ + index++;continue ; }/* Page is stored uncompressed since it's incompressible */ if (unlikely (zram_test_flag (zram, index,ZRAM_UNCOMPRESSED ))) {handle_uncompressed_page (zram, page, index); + index++;continue ; }
@@ -324,6 +327,7 @@ static int zram_write(struct zram *zram,mutex_unlock (&zram->lock);zram_stat_inc (&zram->stats.pages_zero);zram_set_flag (zram, index,ZRAM_ZERO ); + index++;continue ; }
PATCH 36/176 staging: comedi: add support for newer jr3 1-channel pci board
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Ruben Smits <[email protected]>
commit 6292817d58637f85dd623cfe563c7f5ec4f4c470 upstream.
add DEVICE_ID to table
--- drivers/staging/comedi/drivers/jr3_pci.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/staging/comedi/drivers/jr3_pci.c +7 -0
@@ -54,6 +54,7 @@ Devices: [JR3] PCI force sensor board (j#define PCI_VENDOR_ID_JR3 0x1762#define PCI_DEVICE_ID_JR3_1_CHANNEL 0x3111 +#define PCI_DEVICE_ID_JR3_1_CHANNEL_NEW 0x1111#define PCI_DEVICE_ID_JR3_2_CHANNEL 0x3112#define PCI_DEVICE_ID_JR3_3_CHANNEL 0x3113#define PCI_DEVICE_ID_JR3_4_CHANNEL 0x3114
@@ -73,6 +74,8 @@ static DEFINE_PCI_DEVICE_TABLE(jr3_pci_p {PCI_VENDOR_ID_JR3 ,PCI_DEVICE_ID_JR3_1_CHANNEL , PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, { +PCI_VENDOR_ID_JR3 ,PCI_DEVICE_ID_JR3_1_CHANNEL_NEW , + PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, {PCI_VENDOR_ID_JR3 ,PCI_DEVICE_ID_JR3_2_CHANNEL , PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, { PCI_VENDOR_ID_JR3, PCI_DEVICE_ID_JR3_3_CHANNEL,
@@ -807,6 +810,10 @@ static int jr3_pci_attach(struct comedi_ devpriv->n_channels =1 ; }break ; +case PCI_DEVICE_ID_JR3_1_CHANNEL_NEW :{ + devpriv->n_channels =1 ; + } +break ;case PCI_DEVICE_ID_JR3_2_CHANNEL :{ devpriv->n_channels =2 ; }
PATCH 37/176 staging: comedi: ni_labpc: Use shared IRQ for PCMCIA card
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Ian Abbott <[email protected]>
commit d1ce318496f5943d2cc5e20171fc383a59a1421f upstream.
The ni_labpc driver module only requests a shared IRQ for PCI devices, requesting a non-shared IRQ for non-PCI devices.
As this module is also used by the ni_labpc_cs module for certain National Instruments PCMCIA cards, it also needs to request a shared IRQ for PCMCIA devices, otherwise you get a IRQ mismatch with the CardBus controller.
--- drivers/staging/comedi/drivers/ni_labpc.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/staging/comedi/drivers/ni_labpc.c +2 -1
@@ -572,7 +572,8 @@ int labpc_common_attach(struct comedi_de/* grab our IRQ */ if (irq) { isr_flags =0 ; -if (thisboard->bustype == pci_bustype) +if (thisboard->bustype == pci_bustype + || thisboard->bustype == pcmcia_bustype) isr_flags |=IRQF_SHARED ;if (request_irq (irq, labpc_interrupt, isr_flags, driver_labpc.driver_name, dev)) {
PATCH 38/176 Staging: hv: fix sysfs symlink on hv block device
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Ky Srinivasan <[email protected]>
commit 268eff909afaca93188d2d14554cbf824f6a0e41 upstream.
The block device does not create the proper symlink in sysfs because we forgot to set up the gendisk structure properly. This patch fixes the issue.
--- drivers/staging/hv/blkvsc_drv.c | 1 + 1 file changed, 1 insertion(+)
drivers/staging/hv/blkvsc_drv.c +1 -0
@@ -369,6 +369,7 @@ static int blkvsc_probe(struct device *d blkdev->gd->first_minor =0 ; blkdev->gd->fops = &block_ops; blkdev->gd->private_data = blkdev; + blkdev->gd->driverfs_dev = &(blkdev->device_ctx->device);sprintf (blkdev->gd->disk_name,"hd%c" ,'a' + devnum);blkvsc_do_inquiry (blkdev);
PATCH 39/176 staging: hv: fix netvsc sleeping while atomic
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: =?UTF-8?q?Timo=20Ter=C3=A4s?= <[email protected]>
commit d70c673153d42e8aefd5ac296c8159ef222d076b upstream.
The channel callbacks are called directly from vmbus_event_dpc which runs in tasklet context. These callbacks need to use GFP_ATOMIC.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=16701
--- drivers/staging/hv/netvsc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/staging/hv/netvsc.c +1 -1
@@ -1250,7 +1250,7 @@ static void NetVscOnChannelCallback(void/* ASSERT(device); */ packet =kzalloc (NETVSC_PACKET_SIZE *sizeof (unsigned char ), -GFP_KERNEL ); +GFP_ATOMIC );if (!packet)return ; buffer = packet;
PATCH 40/176 staging: hv: Enable sending GARP packet after live migration
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Haiyang Zhang <[email protected]>
commit 7c161d0b900ea9bd9fc5ea5d3fa9916e9eb0dd88 upstream.
The hv_netvsc gets RNDIS_STATUS_MEDIA_CONNECT event after the VM is live migrated. Adding call to netif_notify_peers() for this event to send GARP (Gratuitous ARP) to notify network peers. Otherwise, the VM's network connection may stop after a live migration.
This patch should also be applied to stable kernel 2.6.32 and later.
--- drivers/staging/hv/netvsc_drv.c | 1 + 1 file changed, 1 insertion(+)
drivers/staging/hv/netvsc_drv.c +1 -0
@@ -233,6 +233,7 @@ static void netvsc_linkstatus_callback(sif (status ==1 ) {netif_carrier_on (net);netif_wake_queue (net); +netif_notify_peers (net); }else {netif_carrier_off (net);netif_stop_queue (net);
PATCH 41/176 Staging: rt3090: Fix RT3090 scan AP function
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Chien-Chia Chen <[email protected]>
commit 1226056d9608d241db4b558a0d88a347ad5c66ae upstream.
Fix RT3090 scan AP function.
This patch fixes the rt3090 wireless module failed to scan AP around due to Windows driver causing rt3090 module unable to scan AP in Linux.
--- drivers/staging/rt2860/chips/rt3090.c | 3 ++- drivers/staging/rt2860/chips/rt30xx.c | 2 +- 2 files changed, 3 insertions(+), 2 deletions(-)
drivers/staging/rt2860/chips/rt3090.c +2 -1
@@ -51,7 +51,8 @@ void NICInitRT3090RFRegisters(struct rt_if (IS_RT3090 (pAd)) {/* Init RF calibration */ /* Driver should toggle RF R30 bit7 before init RF registers */ -u32 RfReg =0 , data; +u8 RfReg; +u32 data;RT30xxReadRFRegister (pAd,RF_R30 , (u8 *)&RfReg); RfReg |=0x80 ;
drivers/staging/rt2860/chips/rt30xx.c +1 -1
@@ -53,7 +53,7 @@ struct rt_reg_pair RT30xx_RFRegTable[] = , {RF_R06, 0x02} , - {RF_R07, 0x70} + {RF_R07, 0x60} , {RF_R09, 0x0F} ,
PATCH 42/176 Staging: rt2860: fix previous patch error
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Chien-Chia Chen <[email protected]>
commit 1f0613158ea14b399fd7a16470630a729ba9d0c3 upstream.
Somehow Greg messed up the last patch and missed a chunk. This patch contains the missing chunk.
--- drivers/staging/rt2860/chips/rt30xx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/staging/rt2860/chips/rt30xx.c +1 -1
@@ -441,7 +441,7 @@ void RT30xxReverseRFSleepModeSetup(struc/* VCO_IC, RF R7 register Bit 4 & Bit 5 to 1 */ RT30xxReadRFRegister (pAd,RF_R07 , &RFValue); - RFValue |=0x30 ; + RFValue |=0x20 ;RT30xxWriteRFRegister (pAd,RF_R07 , RFValue);/* Idoh, RF R9 register Bit 1, Bit 2 & Bit 3 to 1 */
PATCH 43/176 staging: rt2860: Fix incorrect netif_stop_queue usage warning
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Denis Kirjanov <[email protected]>
commit 9c33008412683eba91bce2dc4575f28c728b6bd1 upstream.
The TX queues are allocated inside register_netdev. It doesn't make any sense to stop the queue before allocation.
--- drivers/staging/rt2860/rt_main_dev.c | 2 -- 1 file changed, 2 deletions(-)
drivers/staging/rt2860/rt_main_dev.c +0 -2
@@ -483,8 +483,6 @@ struct net_device *RtmpPhyNetDevInit(str net_dev->ml_priv = (void *)pAd; pAd->net_dev = net_dev; -netif_stop_queue (net_dev); -return net_dev; }
PATCH 44/176 mac80211: fix mesh forwarding when ratelimited too
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Milton Miller <[email protected]>
commit 919bbad580445801c22ef6ccbe624551fee652bd upstream.
Commit b51aff057c9d0ef6c529dc25fd9f775faf7b6c63 said:
Under memory pressure, the mac80211 mesh code may helpfully print a message that it failed to clone a mesh frame and then will proceed
to crash trying to use it anyway. Fix that.
Avoid the reference whenever the frame copy is unsuccessful regardless of the debug message being suppressed or printed.
--- net/mac80211/rx.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/mac80211/rx.c +2 -2
@@ -1712,11 +1712,11 @@ ieee80211_rx_h_mesh_fwding(struct ieee80 fwd_skb =skb_copy (skb,GFP_ATOMIC ); -if (!fwd_skb &&net_ratelimit ()) { +if (!fwd_skb &&net_ratelimit ())printk (KERN_DEBUG "%s: failed to clone mesh frame\n" , sdata->name); +if (!fwd_skb) goto out; - } fwd_hdr = (struct ieee80211_hdr *) fwd_skb->data;memcpy (fwd_hdr->addr2, sdata->vif.addr,ETH_ALEN );
PATCH 45/176 mac80211: add missing synchronize_rcu
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Johannes Berg <[email protected]>
commit d2460f4b2fa6dbdeec800414f9cf5b1fc8b71197 upstream.
commit ad0e2b5a00dbec303e4682b403bb6703d11dcdb2
Author: Johannes Berg <[email protected]> Date: Tue Jun 1 10:19:19 2010 +0200
mac80211: simplify key locking
removed the synchronization against RCU and thus opened a race window where we can use a key for TX while it is already freed. Put a synchronisation into the right place to close that window.
--- net/mac80211/key.c | 6 ++++++ 1 file changed, 6 insertions(+)
net/mac80211/key.c +6 -0
@@ -323,6 +323,12 @@ static void __ieee80211_key_destroy(struif (!key)return ; +/* +* Synchronize so the TX path can no longer be using +* this key before we free/remove it. +*/ +synchronize_rcu (); +if (key->local)ieee80211_key_disable_hw_accel (key);
PATCH 46/176 mac80211: use maximum number of AMPDU frames as default in BA RX
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Luciano Coelho <[email protected]>
commit 82694f764dad783a123394e2220b92b9be721b43 upstream.
When the buffer size is set to zero in the block ack parameter set field, we should use the maximum supported number of subframes. The existing code was bogus and was doing some unnecessary calculations that lead to wrong values.
Thanks Johannes for helping me figure this one out.
--- net/mac80211/agg-rx.c | 11 ++--------- 1 file changed, 2 insertions(+), 9 deletions(-)
net/mac80211/agg-rx.c +2 -9
@@ -172,8 +172,6 @@ void ieee80211_process_addba_request(str struct ieee80211_mgmt *mgmt, size_t len) { -struct ieee80211_hw *hw = &local->hw; -struct ieee80211_conf *conf = &hw->conf;struct tid_ampdu_rx *tid_agg_rx;u16 capab, tid, timeout, ba_policy, buf_size, start_seq_num, status;u8 dialog_token;
@@ -218,13 +216,8 @@ void ieee80211_process_addba_request(str goto end_no_lock; }/* determine default buffer size */ -if (buf_size ==0 ) { -struct ieee80211_supported_band *sband; - - sband = local->hw.wiphy->bands[conf->channel->band]; - buf_size =IEEE80211_MIN_AMPDU_BUF ; - buf_size = buf_size << sband->ht_cap.ampdu_factor; - } +if (buf_size ==0 ) + buf_size =IEEE80211_MAX_AMPDU_BUF ;/* examine state machine */
PATCH 47/176 mac80211: fix a crash in ieee80211_beacon_get_tim on change_interface
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Felix Fietkau <[email protected]>
commit eb3e554b4b3a56386ef5214dbe0e3935a350178b upstream.
Some drivers (e.g. ath9k) do not always disable beacons when they're supposed to. When an interface is changed using the change_interface op, the mode specific sdata part is in an undefined state and trying to get a beacon at this point can produce weird crashes.
To fix this, add a check for ieee80211_sdata_running before using anything from the sdata.
--- net/mac80211/tx.c | 3 +++ 1 file changed, 3 insertions(+)
net/mac80211/tx.c +3 -0
@@ -2175,6 +2175,9 @@ struct sk_buff *ieee80211_beacon_get_tim sdata =vif_to_sdata (vif); +if (!ieee80211_sdata_running (sdata)) + goto out; +if (tim_offset) *tim_offset =0 ;if (tim_length)
PATCH 48/176 mac80211: fix initialization of skb->cb in ieee80211_subif_start_xmit
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Felix Fietkau <[email protected]>
commit 489ee9195a7de9e6bc833d639ff6b553ffdad90e upstream.
The change 'mac80211: Fix BUG in pskb_expand_head when transmitting shared skbs' added a check for copying the skb if it's shared, however the tx info variable still points at the cb of the old skb
--- net/mac80211/tx.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/mac80211/tx.c +2 -1
@@ -1694,7 +1694,7 @@ netdev_tx_t ieee80211_subif_start_xmit(s {struct ieee80211_sub_if_data *sdata =IEEE80211_DEV_TO_SUB_IF (dev);struct ieee80211_local *local = sdata->local; -struct ieee80211_tx_info *info =IEEE80211_SKB_CB (skb); +struct ieee80211_tx_info *info;int ret =NETDEV_TX_BUSY , head_need;u16 ethertype, hdrlen, meshhdrlen =0 ;__le16 fc;
@@ -1984,6 +1984,7 @@ netdev_tx_t ieee80211_subif_start_xmit(sskb_set_network_header (skb, nh_pos);skb_set_transport_header (skb, h_pos); + info =IEEE80211_SKB_CB (skb);memset (info,0 ,sizeof (*info)); dev->trans_start = jiffies;
PATCH 49/176 iwlagn: enable only rfkill interrupt when device is down
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Stanislaw Gruszka <[email protected]>
commit 554d1d027b19265c4aa3f718b3126d2b86e09a08 upstream.
Since commit 6cd0b1cb872b3bf9fc5de4536404206ab74bafdd "iwlagn: fix hw-rfkill while the interface is down", we enable interrupts when device is not ready to receive them. However hardware, when it is in some inconsistent state, can generate other than rfkill interrupts and crash the system. I can reproduce crash with "kernel BUG at drivers/net/wireless/iwlwifi/iwl-agn.c:1010!" message, when forcing firmware restarts.
To fix only enable rfkill interrupt when down device and after probe. I checked patch on laptop with 5100 device, rfkill change is still passed to user space when device is down.
--- drivers/net/wireless/iwlwifi/iwl-agn.c | 9 +++++---- drivers/net/wireless/iwlwifi/iwl-helpers.h | 6 ++++++ 2 files changed, 11 insertions(+), 4 deletions(-)
drivers/net/wireless/iwlwifi/iwl-agn.c +5 -4
@@ -3260,9 +3260,10 @@ static void iwl_mac_stop(struct ieee8021flush_workqueue (priv->workqueue); -/* enable interrupts again in order to receive rfkill changes */ +/* User space software may expect getting rfkill changes +* even if interface is down */ iwl_write32 (priv,CSR_INT ,0xFFFFFFFF ); -iwl_enable_interrupts (priv); +iwl_enable_rfkill_int (priv);IWL_DEBUG_MAC80211 (priv,"leave\n" ); }
@@ -4103,14 +4104,14 @@ static int iwl_pci_probe(struct pci_dev* 8. Enable interrupts and read RFKILL state *********************************************/ -/* enable interrupts if needed: hw bug w/a */ +/* enable rfkill interrupt: hw bug w/a */ pci_read_config_word (priv->pci_dev,PCI_COMMAND , &pci_cmd);if (pci_cmd &PCI_COMMAND_INTX_DISABLE ) { pci_cmd &= ~PCI_COMMAND_INTX_DISABLE ;pci_write_config_word (priv->pci_dev,PCI_COMMAND , pci_cmd); } -iwl_enable_interrupts (priv); +iwl_enable_rfkill_int (priv);/* If platform's RF_KILL switch is NOT set to KILL */ if (iwl_read32 (priv,CSR_GP_CNTRL ) &CSR_GP_CNTRL_REG_FLAG_HW_RF_KILL_SW )
drivers/net/wireless/iwlwifi/iwl-helpers.h +6 -0
@@ -168,6 +168,12 @@ static inline void iwl_disable_interruptIWL_DEBUG_ISR (priv,"Disabled interrupts\n" ); } +static inline void iwl_enable_rfkill_int (struct iwl_priv *priv) +{ +IWL_DEBUG_ISR (priv,"Enabling rfkill interrupt\n" ); +iwl_write32 (priv,CSR_INT_MASK ,CSR_INT_BIT_RF_KILL ); +} +static inline void iwl_enable_interrupts (struct iwl_priv *priv) {IWL_DEBUG_ISR (priv,"Enabling interrupts\n" );
PATCH 50/176 iwlagn: Re-enable RF_KILL interrupt when down
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Don Fry <[email protected]>
commit 3dd823e6b86407aed1a025041d8f1df77e43a9c8 upstream.
With commit 554d1d027b19265c4aa3f718b3126d2b86e09a08 only one RF_KILL interrupt will be seen by the driver when the interface is down.
Re-enable the interrupt when it occurs to see all transitions.
--- drivers/net/wireless/iwlwifi/iwl-agn.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/net/wireless/iwlwifi/iwl-agn.c +6 -0
@@ -1234,6 +1234,9 @@ static void iwl_irq_tasklet_legacy(struc/* only Re-enable if diabled by irq */ if (test_bit (STATUS_INT_ENABLED , &priv->status))iwl_enable_interrupts (priv); +/* Re-enable RF_KILL if it occurred */ +else if (handled &CSR_INT_BIT_RF_KILL ) +iwl_enable_rfkill_int (priv);#ifdef CONFIG_IWLWIFI_DEBUG if (iwl_get_debug_level (priv) & (IWL_DL_ISR )) {
@@ -1449,6 +1452,9 @@ static void iwl_irq_tasklet(struct iwl_p/* only Re-enable if diabled by irq */ if (test_bit (STATUS_INT_ENABLED , &priv->status))iwl_enable_interrupts (priv); +/* Re-enable RF_KILL if it occurred */ +else if (handled &CSR_INT_BIT_RF_KILL ) +iwl_enable_rfkill_int (priv); }/* the threshold ratio of actual_ack_cnt to expected_ack_cnt in percent */
PATCH 51/176 ath9k_htc: Handle pending URBs properly
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Sujith Manoharan <[email protected]>
commit ff8f59b5bbdf1527235b8c88d859c7d23691324f upstream.
When doing a channel change, the pending URBs have to be killed properly on calling htc_stop().
This fixes the probe response timeout seen when sending UDP traffic at a high rate and running background scan at the same time.
--- drivers/net/wireless/ath/ath9k/hif_usb.c | 40 +++++++++++++++++++++++++++---- drivers/net/wireless/ath/ath9k/hif_usb.h | 1 2 files changed, 37 insertions(+), 4 deletions(-)
drivers/net/wireless/ath/ath9k/hif_usb.c +36 -4
@@ -144,16 +144,36 @@ static void hif_usb_tx_cb(struct urb *urcase -ENODEV :case -ESHUTDOWN :/* -* The URB has been killed, free the SKBs -* and return. +* The URB has been killed, free the SKBs. */ ath9k_skb_queue_purge (hif_dev, &tx_buf->skb_queue); -return ; + +/* +* If the URBs are being flushed, no need to add this +* URB to the free list. +*/ +spin_lock (&hif_dev->tx.tx_lock); +if (hif_dev->tx.flags &HIF_USB_TX_FLUSH ) { +spin_unlock (&hif_dev->tx.tx_lock); +return ; + } +spin_unlock (&hif_dev->tx.tx_lock); + +/* +* In the stop() case, this URB has to be added to +* the free list. +*/ + goto add_free;default :break ; } -/* Check if TX has been stopped */ +/* +* Check if TX has been stopped, this is needed because +* this CB could have been invoked just after the TX lock +* was released in hif_stop() and kill_urb() hasn't been +* called yet. +*/ spin_lock (&hif_dev->tx.tx_lock);if (hif_dev->tx.flags &HIF_USB_TX_STOP ) {spin_unlock (&hif_dev->tx.tx_lock);
@@ -305,6 +325,7 @@ static void hif_usb_start(void *hif_handstatic void hif_usb_stop (void *hif_handle,u8 pipe_id) {struct hif_device_usb *hif_dev = (struct hif_device_usb *)hif_handle; +struct tx_buf *tx_buf =NULL , *tx_buf_tmp =NULL ;unsigned long flags;spin_lock_irqsave (&hif_dev->tx.tx_lock, flags);
@@ -312,6 +333,12 @@ static void hif_usb_stop(void *hif_handl hif_dev->tx.tx_skb_cnt =0 ; hif_dev->tx.flags |=HIF_USB_TX_STOP ;spin_unlock_irqrestore (&hif_dev->tx.tx_lock, flags); + +/* The pending URBs have to be canceled. */ +list_for_each_entry_safe (tx_buf, tx_buf_tmp, + &hif_dev->tx.tx_pending, list) { +usb_kill_urb (tx_buf->urb); + } } static int hif_usb_send(void *hif_handle, u8 pipe_id, struct sk_buff *skb,
@@ -577,6 +604,7 @@ free:static void ath9k_hif_usb_dealloc_tx_urbs (struct hif_device_usb *hif_dev) {struct tx_buf *tx_buf =NULL , *tx_buf_tmp =NULL ; +unsigned long flags;list_for_each_entry_safe (tx_buf, tx_buf_tmp, &hif_dev->tx.tx_buf, list) {
@@ -587,6 +615,10 @@ static void ath9k_hif_usb_dealloc_tx_urbkfree (tx_buf); } +spin_lock_irqsave (&hif_dev->tx.tx_lock, flags); + hif_dev->tx.flags |=HIF_USB_TX_FLUSH ; +spin_unlock_irqrestore (&hif_dev->tx.tx_lock, flags); +list_for_each_entry_safe (tx_buf, tx_buf_tmp, &hif_dev->tx.tx_pending, list) {usb_kill_urb (tx_buf->urb);
drivers/net/wireless/ath/ath9k/hif_usb.h +1 -0
@@ -62,6 +62,7 @@ struct tx_buf { };#define HIF_USB_TX_STOP BIT(0) +#define HIF_USB_TX_FLUSH BIT(1)struct hif_usb_tx {u8 flags;
PATCH 52/176 ath9k_hw: Fix XPABIAS level configuration for AR9003
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Vasanthakumar Thiagarajan <[email protected]>
commit 52a0e2477dac2106bc1688cbe9615cdafc9deb7d upstream.
Improper configuration of 0x16288 and 0x16290 would affect transmission.
--- drivers/net/wireless/ath/ath9k/ar9003_eeprom.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-)
drivers/net/wireless/ath/ath9k/ar9003_eeprom.c +8 -6
@@ -22,12 +22,14 @@#define COMP_CKSUM_LEN 2#define AR_CH0_TOP (0x00016288) -#define AR_CH0_TOP_XPABIASLVL (0x3) +#define AR_CH0_TOP_XPABIASLVL (0x300)#define AR_CH0_TOP_XPABIASLVL_S (8)#define AR_CH0_THERM (0x00016290) -#define AR_CH0_THERM_SPARE (0x3f) -#define AR_CH0_THERM_SPARE_S (0) +#define AR_CH0_THERM_XPABIASLVL_MSB 0x3 +#define AR_CH0_THERM_XPABIASLVL_MSB_S 0 +#define AR_CH0_THERM_XPASHORT2GND 0x4 +#define AR_CH0_THERM_XPASHORT2GND_S 2#define AR_SWITCH_TABLE_COM_ALL (0xffff)#define AR_SWITCH_TABLE_COM_ALL_S (0)
@@ -995,9 +997,9 @@ static s32 ar9003_hw_xpa_bias_level_get(static void ar9003_hw_xpa_bias_level_apply (struct ath_hw *ah,bool is2ghz) {int bias =ar9003_hw_xpa_bias_level_get (ah, is2ghz); -REG_RMW_FIELD (ah,AR_CH0_TOP ,AR_CH0_TOP_XPABIASLVL , (bias &0x3 )); -REG_RMW_FIELD (ah,AR_CH0_THERM ,AR_CH0_THERM_SPARE , - ((bias >>2 ) &0x3 )); +REG_RMW_FIELD (ah,AR_CH0_TOP ,AR_CH0_TOP_XPABIASLVL , bias); +REG_RMW_FIELD (ah,AR_CH0_THERM ,AR_CH0_THERM_XPABIASLVL_MSB , bias >>2 ); +REG_RMW_FIELD (ah,AR_CH0_THERM ,AR_CH0_THERM_XPASHORT2GND ,1 ); }static u32 ar9003_hw_ant_ctrl_common_get (struct ath_hw *ah,bool is2ghz)
PATCH 53/176 ath9k: simplify hw reset locking
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Luis R. Rodriguez <[email protected]>
commit 9d94674ab754be0e275120a183670ead435f9c0d upstream.
The new PCU lock is better placed so we can just contend against that when trying to reset hardware.
This is part of a series of patches which fix stopping TX DMA completley when requested on the driver. For more details about this issue refer to this thread:
http://marc.info/?l=linux-wireless&m=128629803703756&w=2
--- drivers/net/wireless/ath/ath9k/ath9k.h | 1 - drivers/net/wireless/ath/ath9k/init.c | 1 - drivers/net/wireless/ath/ath9k/main.c | 22 ++++++---------------- drivers/net/wireless/ath/ath9k/xmit.c | 4 ++-- 4 files changed, 8 insertions(+), 20 deletions(-)
drivers/net/wireless/ath/ath9k/ath9k.h +0 -1
@@ -557,7 +557,6 @@ struct ath_softc {struct ath_hw *sc_ah;void __iomem *mem;int irq; -spinlock_t sc_resetlock;spinlock_t sc_serial_rw;spinlock_t sc_pm_lock;struct mutex mutex;
drivers/net/wireless/ath/ath9k/init.c +0 -1
@@ -574,7 +574,6 @@ static int ath9k_init_softc(u16 devid, s common->debug_mask = ath9k_debug;spin_lock_init (&sc->wiphy_lock); -spin_lock_init (&sc->sc_resetlock);spin_lock_init (&sc->sc_serial_rw);spin_lock_init (&sc->sc_pm_lock);mutex_init (&sc->mutex);
drivers/net/wireless/ath/ath9k/main.c +6 -16
@@ -233,19 +233,15 @@ int ath_set_channel(struct ath_softc *sc sc->sc_ah->curchan->channel, channel->center_freq, conf_is_ht40(conf)); -spin_lock_bh (&sc->sc_resetlock); - r =ath9k_hw_reset (ah, hchan, caldata, fastcc);if (r) {ath_print (common,ATH_DBG_FATAL ,"Unable to reset channel (%u MHz), " "reset status %d\n" , channel->center_freq, r); -spin_unlock_bh (&sc->sc_resetlock);spin_unlock_bh (&sc->rx.pcu_lock); goto ps_restore; } -spin_unlock_bh (&sc->sc_resetlock);if (ath_startrecv (sc) !=0 ) { ath_print(common, ATH_DBG_FATAL,
@@ -848,7 +844,6 @@ void ath_radio_enable(struct ath_softc * ah->curchan =ath_get_curchannel (sc, sc->hw);spin_lock_bh (&sc->rx.pcu_lock); -spin_lock_bh (&sc->sc_resetlock); r =ath9k_hw_reset (ah, ah->curchan, ah->caldata, false);if (r) { ath_print(common, ATH_DBG_FATAL,
@@ -856,7 +851,6 @@ void ath_radio_enable(struct ath_softc *"reset status %d\n" , channel->center_freq, r); } -spin_unlock_bh (&sc->sc_resetlock);ath_update_txpow (sc);if (ath_startrecv (sc) !=0 ) {
@@ -913,7 +907,6 @@ void ath_radio_disable(struct ath_softcif (!ah->curchan) ah->curchan =ath_get_curchannel (sc, hw); -spin_lock_bh (&sc->sc_resetlock); r =ath9k_hw_reset (ah, ah->curchan, ah->caldata, false);if (r) { ath_print(ath9k_hw_common(sc->sc_ah), ATH_DBG_FATAL,
@@ -921,7 +914,6 @@ void ath_radio_disable(struct ath_softc"reset status %d\n" , channel->center_freq, r); } -spin_unlock_bh (&sc->sc_resetlock);ath9k_hw_phy_disable (ah);
@@ -952,12 +944,10 @@ int ath_reset(struct ath_softc *sc, boolath_stoprecv (sc);ath_flushrecv (sc); -spin_lock_bh (&sc->sc_resetlock); r =ath9k_hw_reset (ah, sc->sc_ah->curchan, ah->caldata, false);if (r)ath_print (common,ATH_DBG_FATAL ,"Unable to reset hardware; reset status %d\n" , r); -spin_unlock_bh (&sc->sc_resetlock);if (ath_startrecv (sc) !=0 ) ath_print(common, ATH_DBG_FATAL,
@@ -1130,18 +1120,15 @@ static int ath9k_start(struct ieee80211_* and then setup of the interrupt mask. */ spin_lock_bh (&sc->rx.pcu_lock); -spin_lock_bh (&sc->sc_resetlock); r =ath9k_hw_reset (ah, init_channel, ah->caldata, false);if (r) {ath_print (common,ATH_DBG_FATAL ,"Unable to reset hardware; reset status %d " "(freq %u MHz)\n" , r, curchan->center_freq); -spin_unlock_bh (&sc->sc_resetlock);spin_unlock_bh (&sc->rx.pcu_lock); goto mutex_unlock; } -spin_unlock_bh (&sc->sc_resetlock);/* * This is needed only to setup initial state
@@ -1365,14 +1352,17 @@ static void ath9k_stop(struct ieee80211_* before setting the invalid flag. */ ath9k_hw_set_interrupts (ah,0 ); -spin_lock_bh (&sc->rx.pcu_lock);if (!(sc->sc_flags &SC_OP_INVALID )) {ath_drain_all_txq (sc, false); +spin_lock_bh (&sc->rx.pcu_lock);ath_stoprecv (sc);ath9k_hw_phy_disable (ah); - }else +spin_unlock_bh (&sc->rx.pcu_lock); + }else { +spin_lock_bh (&sc->rx.pcu_lock); sc->rx.rxlink =NULL ; -spin_unlock_bh (&sc->rx.pcu_lock); +spin_unlock_bh (&sc->rx.pcu_lock); + }/* disable HAL and put h/w to sleep */ ath9k_hw_disable (ah);
drivers/net/wireless/ath/ath9k/xmit.c +2 -2
@@ -1160,13 +1160,13 @@ void ath_drain_all_txq(struct ath_softcath_print (common,ATH_DBG_FATAL ,"Failed to stop TX DMA. Resetting hardware!\n" ); -spin_lock_bh (&sc->sc_resetlock); +spin_lock_bh (&sc->rx.pcu_lock); r =ath9k_hw_reset (ah, sc->sc_ah->curchan, ah->caldata, false);if (r)ath_print (common,ATH_DBG_FATAL ,"Unable to reset hardware; reset status %d\n" , r); -spin_unlock_bh (&sc->sc_resetlock); +spin_unlock_bh (&sc->rx.pcu_lock); }for (i =0 ; i <ATH9K_NUM_TX_QUEUES ; i++) {
PATCH 54/176 ath9k: move the PCU lock to the sc structure
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Luis R. Rodriguez <[email protected]>
commit 4bdd1e978ede034c1211957eb17eaf50de00d234 upstream.
The PCU lock should be used to contend TX DMA as well, this will be done next.
This is part of a series of patches which fix stopping TX DMA completley when requested on the driver. For more details about this issue refer to this thread:
http://marc.info/?l=linux-wireless&m=128629803703756&w=2
--- drivers/net/wireless/ath/ath9k/ath9k.h | 2 - drivers/net/wireless/ath/ath9k/main.c | 42 ++++++++++++++++----------------- drivers/net/wireless/ath/ath9k/recv.c | 2 - drivers/net/wireless/ath/ath9k/xmit.c | 4 +-- 4 files changed, 25 insertions(+), 25 deletions(-)
drivers/net/wireless/ath/ath9k/ath9k.h +1 -1
@@ -312,7 +312,6 @@ struct ath_rx {u8 rxotherant;u32 *rxlink;unsigned int rxfilter; -spinlock_t pcu_lock;spinlock_t rxbuflock;struct list_head rxbuf;struct ath_descdma rxdma;
@@ -559,6 +558,7 @@ struct ath_softc {int irq;spinlock_t sc_serial_rw;spinlock_t sc_pm_lock; +spinlock_t sc_pcu_lock;struct mutex mutex;struct work_struct paprd_work;struct work_struct hw_check_work;
drivers/net/wireless/ath/ath9k/main.c +21 -21
143 lines not on this page · raw message
drivers/net/wireless/ath/ath9k/recv.c +1 -1
@@ -308,7 +308,7 @@ int ath_rx_init(struct ath_softc *sc, instruct ath_buf *bf;int error =0 ; -spin_lock_init (&sc->rx.pcu_lock); +spin_lock_init (&sc->sc_pcu_lock); sc->sc_flags &= ~SC_OP_RXFLUSH ;spin_lock_init (&sc->rx.rxbuflock);
drivers/net/wireless/ath/ath9k/xmit.c +2 -2
@@ -1160,13 +1160,13 @@ void ath_drain_all_txq(struct ath_softcath_print (common,ATH_DBG_FATAL ,"Failed to stop TX DMA. Resetting hardware!\n" ); -spin_lock_bh (&sc->rx.pcu_lock); +spin_lock_bh (&sc->sc_pcu_lock); r =ath9k_hw_reset (ah, sc->sc_ah->curchan, ah->caldata, false);if (r)ath_print (common,ATH_DBG_FATAL ,"Unable to reset hardware; reset status %d\n" , r); -spin_unlock_bh (&sc->rx.pcu_lock); +spin_unlock_bh (&sc->sc_pcu_lock); }for (i =0 ; i <ATH9K_NUM_TX_QUEUES ; i++) {
PATCH 55/176 ath9k: Fix bug in delimiter padding computation
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Vasanthakumar Thiagarajan <[email protected]>
commit 39ec2997c374b528cdbf65099b6d6b8593a67f7f upstream.
There is a roundng error in delimiter padding computation which causes severe throughput drop with some of AR9003.
--- drivers/net/wireless/ath/ath9k/ath9k.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/wireless/ath/ath9k/ath9k.h +2 -2
@@ -177,8 +177,8 @@ void ath_descdma_cleanup(struct ath_soft/* returns delimiter padding required given the packet length */ #define ATH_AGGR_GET_NDELIM (_len) \ - (((((_len) + ATH_AGGR_DELIM_SZ) < ATH_AGGR_MINPLEN) ? \ - (ATH_AGGR_MINPLEN - (_len) - ATH_AGGR_DELIM_SZ) : 0) >> 2) + (((_len) >= ATH_AGGR_MINPLEN) ? 0 : \ + DIV_ROUND_UP(ATH_AGGR_MINPLEN - (_len), ATH_AGGR_DELIM_SZ))#define BAW_WITHIN (_start, _bawsz, _seqno) \ ((((_seqno) - (_start)) & 4095) < (_bawsz))
PATCH 56/176 ath9k: fix assumptions for idle calls on suspend/resume
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Luis R. Rodriguez <[email protected]>
commit a08e7ade9ddf4fe79576f953cc5c1725e944d26c upstream.
mac80211 will notify drivers when to go idle and ath9k assumed that it would get further notifications for idle states after a device stop() config call but as per agreed semantics the idle state of the radio is left up to driver after mac80211 issues the stop() callback. The driver is resposnbile for ensuring the device remains idle after that even between suspend / resume calls.
This fixes suspend/resume when you issue suspend and resume twice on ath9k when ath9k_stop() was already called. We need to put the radio to full sleep in order for resume to work correctly.
What might seem fishy is we are turning the radio off after resume. The reason why we do this is because we know we should not have anything enabled after a mac80211 tells us to stop(), if we resume and never get a start() we won't get another stop() by mac80211 so to be safe always bring the 802.11 device with the radio disabled after resume, this ensures that if we suspend we already have the radio disabled and only a start() will ever trigger it on.
--- drivers/net/wireless/ath/ath9k/main.c | 4 ++-- drivers/net/wireless/ath/ath9k/pci.c | 3 +++ 2 files changed, 5 insertions(+), 2 deletions(-)
drivers/net/wireless/ath/ath9k/main.c +2 -2
@@ -1369,8 +1369,8 @@ static void ath9k_stop(struct ieee80211_ath9k_hw_configpcipowersave (ah,1 ,1 );ath9k_ps_restore (sc); -/* Finally, put the chip in FULL SLEEP mode */ -ath9k_setpower (sc,ATH9K_PM_FULL_SLEEP ); + sc->ps_idle = true; +ath_radio_disable (sc, hw); sc->sc_flags |=SC_OP_INVALID ;
drivers/net/wireless/ath/ath9k/pci.c +3 -0
@@ -290,6 +290,9 @@ static int ath_pci_resume(struct pci_dev AR_GPIO_OUTPUT_MUX_AS_OUTPUT);ath9k_hw_set_gpio (sc->sc_ah, sc->sc_ah->led_pin,1 ); + sc->ps_idle = true; +ath_radio_disable (sc, hw); +return 0 ; }
PATCH 57/176 ath9k: fix aphy / wiphy idle mismatch
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Luis R. Rodriguez <[email protected]>
commit afe68d0a8f5961652e26cea39d74e2cc820de841 upstream.
ath9k supports its own set of virtual wiphys, and it uses the mac80211 idle notifications to know when a device needs to be idle or not. We recently changed ath9k to force idle on driver stop() and on resume but forgot to take into account ath9k's own virtual wiphy idle states. These are used internally by ath9k to check if the device's radio should be powered down on each idle call. Without this change its possible that the device could have been forced off but the virtual wiphy idle was left on.
--- drivers/net/wireless/ath/ath9k/main.c | 1 + drivers/net/wireless/ath/ath9k/pci.c | 1 + 2 files changed, 2 insertions(+)
drivers/net/wireless/ath/ath9k/main.c +1 -0
@@ -1370,6 +1370,7 @@ static void ath9k_stop(struct ieee80211_ath9k_ps_restore (sc); sc->ps_idle = true; +ath9k_set_wiphy_idle (aphy, true);ath_radio_disable (sc, hw); sc->sc_flags |=SC_OP_INVALID ;
drivers/net/wireless/ath/ath9k/pci.c +1 -0
@@ -291,6 +291,7 @@ static int ath_pci_resume(struct pci_devath9k_hw_set_gpio (sc->sc_ah, sc->sc_ah->led_pin,1 ); sc->ps_idle = true; +ath9k_set_wiphy_idle (aphy, true);ath_radio_disable (sc, hw);return 0 ;
PATCH 58/176 ath9k: fix beacon restart on channel change
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Rajkumar Manoharan <[email protected]>
commit 1186488b4a4d4871e40cb1604ba3ede3d4b7cc90 upstream.
Restart the beacon timers only if the beacon was already configured. Otherwise beacons timers are restarted unnecessarily in unassociated state too.
--- drivers/net/wireless/ath/ath9k/main.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/wireless/ath/ath9k/main.c +2 -1
@@ -258,7 +258,8 @@ int ath_set_channel(struct ath_softc *scath9k_hw_set_interrupts (ah, ah->imask);if (!(sc->sc_flags & (SC_OP_OFFCHANNEL ))) { -ath_beacon_config (sc,NULL ); +if (sc->sc_flags &SC_OP_BEACONS ) +ath_beacon_config (sc,NULL );ieee80211_queue_delayed_work (sc->hw, &sc->tx_complete_work,0 );ath_start_ani (common); }
PATCH 59/176 ath9k_hw: do PA offset calibration only on longcal interval
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Rajkumar Manoharan <[email protected]>
commit 811ea256b30b37091b5bbf41517404cf98ab56c1 upstream.
The power detector adc offset calibration has to be done on 4 minutes interval (longcal * pa_skip_count). But the commit "ath9k_hw: fix a noise floor calibration related race condition" makes the PA calibration executed more frequently beased on nfcal_pending value. Running PAOffset calibration lesser than longcal interval doesn't help anything and the worse part is that it causes NF load timeouts and RX deaf conditions.
In a very noisy environment, where the distance b/w AP & station is ~10 meter and running a downlink udp traffic with frequent background scan causes "Timeout while waiting for nf to load:
AR_PHY_AGC_CONTROL=0x40d1a" and moves the chip into deaf state. This issue was originaly reported in Android platform where the network-manager application does bgscan more frequently on AR9271 chips. (AR9285 family usb device).
--- drivers/net/wireless/ath/ath9k/ar9002_calib.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
drivers/net/wireless/ath/ath9k/ar9002_calib.c +5 -5
@@ -710,10 +710,6 @@ static bool ar9002_hw_calibrate(struct a/* Do NF cal only at longer intervals */ if (longcal || nfcal_pending) { -/* Do periodic PAOffset Cal */ -ar9002_hw_pa_cal (ah, false); -ar9002_hw_olc_temp_compensation (ah); -/* * Get the value from the previous NF cal and update * history buffer.
@@ -728,8 +724,12 @@ static bool ar9002_hw_calibrate(struct aath9k_hw_loadnf (ah, ah->curchan); } -if (longcal) +if (longcal) {ath9k_hw_start_nfcal (ah, false); +/* Do periodic PAOffset Cal */ +ar9002_hw_pa_cal (ah, false); +ar9002_hw_olc_temp_compensation (ah); + } }return iscaldone;
PATCH 60/176 ath9k_hw: disabled PAPRD for AR9003
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Luis R. Rodriguez <[email protected]>
commit 6f4810101a629b31b5427872a09ea092cfc5c4bd upstream.
AR9003's PAPRD was enabled prematurely, and is causing some large discrepancies on throughput and network connectivity. For example downlink (RX) throughput against an AR9280 AP can vary widlely from 43-73 Mbit/s while disabling this gets AR9382 (2x2) up to around 93 Mbit/s in a 2.4 GHz HT20 setup.
--- drivers/net/wireless/ath/ath9k/hw.c | 6 +++++- drivers/net/wireless/ath/ath9k/hw.h | 1 + 2 files changed, 6 insertions(+), 1 deletion(-)
drivers/net/wireless/ath/ath9k/hw.c +5 -1
@@ -387,6 +387,9 @@ static void ath9k_hw_init_config(structelse ah->config.ht_enable =0 ; +/* PAPRD needs some more work to be enabled */ + ah->config.paprd_disable =1 ; + ah->config.rx_intr_mitigation = true; ah->config.pcieSerDesWrite = true;
@@ -2264,7 +2267,8 @@ int ath9k_hw_fill_cap_info(struct ath_hw pCap->rx_status_len =sizeof (struct ar9003_rxs ); pCap->tx_desc_len =sizeof (struct ar9003_txc ); pCap->txs_len =sizeof (struct ar9003_txs ); -if (ah->eep_ops->get_eeprom (ah,EEP_PAPRD )) +if (!ah->config.paprd_disable && + ah->eep_ops->get_eeprom (ah,EEP_PAPRD )) pCap->hw_caps |=ATH9K_HW_CAP_PAPRD ; }else { pCap->tx_desc_len =sizeof (struct ath_desc );
drivers/net/wireless/ath/ath9k/hw.h +1 -0
@@ -240,6 +240,7 @@ struct ath9k_ops_config {u32 pcie_waen;u8 analog_shiftreg;u8 ht_enable; +u8 paprd_disable;u32 ofdm_trig_low;u32 ofdm_trig_high;u32 cck_trig_high;
PATCH 61/176 ath9k_hw: Fix system hang when resuming from S3/S4
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Rajkumar Manoharan <[email protected]>
commit 5b64aa72ead6f8be488d2be7af579f0d69fb7a6e upstream.
The bit 6 & 7 of AR_WA (0x4004) should be enabled only for the chips that are supporting L0s functionality while resuming back from S3/S4.
Enabling these bits for AR9280 is causing system hang within a few S3/S4-resume cycles.
--- drivers/net/wireless/ath/ath9k/ar9002_hw.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/net/wireless/ath/ath9k/ar9002_hw.c +1 -2
@@ -445,9 +445,8 @@ static void ar9002_hw_configpcipowersave }/* WAR for ASPM system hang */ -if (AR_SREV_9280 (ah) ||AR_SREV_9285 (ah) ||AR_SREV_9287 (ah)) { +if (AR_SREV_9285 (ah) ||AR_SREV_9287 (ah)) val |= (AR_WA_BIT6 |AR_WA_BIT7 ); - }if (AR_SREV_9285E_20 (ah)) val |=AR_WA_BIT23 ;
PATCH 62/176 qdio: use proper QEBSM operand for SIGA-R and SIGA-S
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Jan Glauber <[email protected]>
commit 958c0ba403cb6a693b54be2389f9ef53377fa259 upstream.
If QIOASSIST is enabled for a qdio device the SIGA instruction requires a modified function code. This function code modifier was missing for SIGA-R and SIGA-S which can lead to a kernel panic caused by an operand exception.
--- drivers/s390/cio/qdio.h | 6 ++++++ drivers/s390/cio/qdio_main.c | 43 ++++++++++++++++++++++++++++--------------- 2 files changed, 34 insertions(+), 15 deletions(-)
drivers/s390/cio/qdio.h +6 -0
@@ -91,6 +91,12 @@ enum qdio_irq_states {#define AC1_SC_QEBSM_AVAILABLE 0x02/* available for subchannel */ #define AC1_SC_QEBSM_ENABLED 0x01/* enabled for subchannel */ +/* SIGA flags */ +#define QDIO_SIGA_WRITE 0x00 +#define QDIO_SIGA_READ 0x01 +#define QDIO_SIGA_SYNC 0x02 +#define QDIO_SIGA_QEBSM_FLAG 0x80 +#ifdef CONFIG_64BIT static inline int do_sqbs (u64 token,unsigned char state,int queue,int *start,int *count)
drivers/s390/cio/qdio_main.c +28 -15
93 lines not on this page · raw message
PATCH 63/176 fix medium error problems with some arrays which can cause data corruption
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: James Bottomley <[email protected]>
commit a8733c7baf457b071528e385a0b7d4aaec79287c upstream.
Our current handling of medium error assumes that data is returned up to the bad sector. This assumption holds good for all disk devices, all DIF arrays and most ordinary arrays. However, an LSI array engine was recently discovered which reports a medium error without returning any data. This means that when we report good data up to the medium error, we've reported junk originally in the buffer as good. Worse, if the read consists of requested data plus a readahead, and the error occurs in readahead, we'll just strip off the readahead and report junk up to userspace as good data with no error.
The fix for this is to have the error position computation take into account the amount of data returned by the driver using the scsi residual data. Unfortunately, not every driver fills in this data, but for those who don't, it's set to zero, which means we'll think a full set of data was transferred and the behaviour will be identical to the prior behaviour of the code (believe the buffer up to the error sector). All modern drivers seem to set the residual, so that should fix up the LSI failure/corruption case.
--- drivers/scsi/sd.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
drivers/scsi/sd.c +8 -1
@@ -1153,6 +1153,12 @@ static unsigned int sd_completed_bytes(su64 end_lba =blk_rq_pos (scmd->request) + (scsi_bufflen (scmd) /512 );u64 bad_lba;int info_valid; +/* +* resid is optional but mostly filled in. When it's unused, +* its value is zero, so we assume the whole buffer transferred +*/ +unsigned int transferred =scsi_bufflen (scmd) -scsi_get_resid (scmd); +unsigned int good_bytes;if (scmd->request->cmd_type !=REQ_TYPE_FS )return 0 ;
@@ -1186,7 +1192,8 @@ static unsigned int sd_completed_bytes(s/* This computation should always be done in terms of * the resolution of the device's medium. */ -return (bad_lba - start_lba) * scmd->device->sector_size; + good_bytes = (bad_lba - start_lba) * scmd->device->sector_size; +return min (good_bytes, transferred); }/**
PATCH 64/176 libsas: fix runaway error handler problem
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: James Bottomley <[email protected]>
commit 9ee91f7fb550a4c82f82d9818e42493484c754af upstream.
libsas makes use of scsi_schedule_eh() but forgets to clear the host_eh_scheduled flag in its error handling routine. Because of this, the error handler thread never gets to sleep; it's constantly awake and trying to run the error routine leading to console spew and inability to run anything else (at least on a UP system). The fix is to clear the flag as we splice the work queue.
--- drivers/scsi/libsas/sas_scsi_host.c | 1 + 1 file changed, 1 insertion(+)
drivers/scsi/libsas/sas_scsi_host.c +1 -0
@@ -649,6 +649,7 @@ void sas_scsi_recover_host(struct Scsi_Hspin_lock_irqsave (shost->host_lock, flags);list_splice_init (&shost->eh_cmd_q, &eh_work_q); + shost->host_eh_scheduled =0 ;spin_unlock_irqrestore (shost->host_lock, flags);SAS_DPRINTK ("Enter %s\n" , __func__);
PATCH 65/176 mpt2sas: fix Integrated Raid unsynced on shutdown problem
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Kashyap, Desai <[email protected]>
commit 3a9c913a3e57b170887d39456e04c18f2305ec67 upstream.
Issue:
IR shutdown(sending) and IR shutdown(complete) messages not listed in /var/log/messages when driver is removed.
The driver needs to issue a MPI2_RAID_ACTION_SYSTEM_SHUTDOWN_INITIATED request when the driver is unloaded so the IR metadata journal is updated. If this request is not sent, then the volume would need a "check consistency" issued on the next bootup if the volume was roamed from one initiator to another. The current driver supports this feature only when the system is rebooted, however this also need to be supported if the driver is unloaded
Fix:
To fix this issue, the driver is going
to need to call the _scsih_ir_shutdown prior to reporting the volumes missing from the OS, hence the device handles are still present.
--- drivers/scsi/mpt2sas/mpt2sas_scsih.c | 1 + 1 file changed, 1 insertion(+)
drivers/scsi/mpt2sas/mpt2sas_scsih.c +1 -0
@@ -6685,6 +6685,7 @@ _scsih_remove(struct pci_dev *pdev)destroy_workqueue (wq);/* release all the volumes */ +_scsih_ir_shutdown (ioc);list_for_each_entry_safe (raid_device, next, &ioc->raid_device_list, list) {if (raid_device->starget) {
PATCH 66/176 fix incorrect value of SCSI_MAX_SG_CHAIN_SEGMENTS due to include file ordering
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: David Dillow <[email protected]>
commit ac61c46f4f7665ab4548e90430c37b2529e16cff upstream.
If the compiled object doesn't include linux/scatterlist.h before scsi/scsi.h, it will get an incorrect definition of SCSI_MAX_SG_CHAIN_SEGMENTS.
--- include/scsi/scsi.h | 1 + 1 file changed, 1 insertion(+)
include/scsi/scsi.h +1 -0
@@ -9,6 +9,7 @@#define _SCSI_SCSI_H#include <linux/types.h> +#include <linux/scatterlist.h> struct scsi_cmnd ;
PATCH 67/176 mpt2sas: Fix device removal handshake for zoned devices
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Kashyap, Desai <[email protected]>
commit 4dc2757a2e9a9d1f2faee4fc6119276fc0061c16 upstream.
When zoning end devices, the driver is not sending device removal handshake alogrithm to firmware. This results in controller firmware not sending sas topology add events the next time the device is added. The fix is the driver should be doing the device removal handshake even though the PHYSTATUS_VACANT bit is set in the PhyStatus of the event data. The current design is avoiding the handshake when the VACANT bit is set in the phy status.
--- drivers/scsi/mpt2sas/mpt2sas_scsih.c | 3 --- 1 file changed, 3 deletions(-)
drivers/scsi/mpt2sas/mpt2sas_scsih.c +0 -3
@@ -2957,9 +2957,6 @@ _scsih_check_topo_delete_events(struct Mu16 handle;for (i =0 ; i < event_data->NumEntries; i++) { -if (event_data->PHY[i].PhyStatus & -MPI2_EVENT_SAS_TOPO_PHYSTATUS_VACANT ) -continue ; handle =le16_to_cpu (event_data->PHY[i].AttachedDevHandle);if (!handle)continue ;
PATCH 68/176 mpt2sas: fix internal device reset for older firmware prior to MPI Rev K
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Kashyap, Desai <[email protected]>
commit efe82a16bc0f9f9e1fc8fa706eb0309fcd57770a upstream.
The "internal device reset complete" event is not supported
for older firmware prior to MPI Rev K We added
a check in the driver so the "internal device reset" event is ignored for older firmware. When ignored, the tm_busy flag doesn't get set nor cleared. Without this fix, IO queues would be froozen indefinetly after the "internal device reset" event, as the "complete" event never sent to clear the flag.
--- drivers/scsi/mpt2sas/mpt2sas_scsih.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/scsi/mpt2sas/mpt2sas_scsih.c +6 -0
@@ -4937,6 +4937,12 @@ _scsih_sas_device_status_change_event(st event_data);#endif +/* In MPI Revision K (0xC), the internal device reset complete was +* implemented, so avoid setting tm_busy flag for older firmware. +*/ +if ((ioc->facts.HeaderVersion >>8 ) <0xC ) +return ; +if (event_data->ReasonCode !=MPI2_EVENT_SAS_DEV_STAT_RC_INTERNAL_DEVICE_RESET && event_data->ReasonCode !=
PATCH 69/176 mpt2sas: Fix the race between broadcast asyn event and scsi command completion
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Kashyap, Desai <[email protected]>
commit ec07a053597bdab51cbd23619f9f9f392712508a upstream.
False timeout after hard resets, there were two issues which leads to timeout.
(1) Panic because of invalid memory access in the broadcast asyn event processing routine due to a race between accessing the scsi command pointer from broadcast asyn event processing thread and completing the same scsi command from the interrupt context.
(2) Broadcast asyn event notifcations are not handled due to events ignored while the broadcast asyn event is activity being processed from the event process kernel thread.
In addition, changed the ABRT_TASK_SET to ABORT_TASK in the
broadcast async event processing routine. This is less disruptive to other
request that generate Broadcast Asyn Primitives besides target reset. e.g clear reservations, microcode download,and mode select.
--- drivers/scsi/mpt2sas/mpt2sas_scsih.c | 54 +++++++++++++++++++++++++++++------ 1 file changed, 45 insertions(+), 9 deletions(-)
drivers/scsi/mpt2sas/mpt2sas_scsih.c +45 -9
@@ -819,7 +819,7 @@ _scsih_is_end_device(u32 device_info) }/** -* mptscsih_get_scsi_lookup - returns scmd entry +* _scsih_scsi_lookup_get - returns scmd entry * @ioc: per adapter object * @smid: system request message index *
@@ -832,6 +832,28 @@ _scsih_scsi_lookup_get(struct MPT2SAS_AD }/** +* _scsih_scsi_lookup_get_clear - returns scmd entry +* @ioc: per adapter object +* @smid: system request message index +* +* Returns the smid stored scmd pointer. +* Then will derefrence the stored scmd pointer. +*/ +static inline struct scsi_cmnd * +_scsih_scsi_lookup_get_clear (struct MPT2SAS_ADAPTER *ioc,u16 smid) +{ +unsigned long flags; +struct scsi_cmnd *scmd; + +spin_lock_irqsave (&ioc->scsi_lookup_lock, flags); + scmd = ioc->scsi_lookup[smid -1 ].scmd; + ioc->scsi_lookup[smid -1 ].scmd =NULL ; +spin_unlock_irqrestore (&ioc->scsi_lookup_lock, flags); + +return scmd; +} + +/** * _scsih_scsi_lookup_find_by_scmd - scmd lookup * @ioc: per adapter object * @smid: system request message index
@@ -3183,7 +3205,7 @@ _scsih_flush_running_cmds(struct MPT2SASu16 count =0 ;for (smid =1 ; smid <= ioc->scsiio_depth; smid++) { - scmd =_scsih_scsi_lookup_get (ioc, smid); + scmd =_scsih_scsi_lookup_get_clear (ioc, smid);if (!scmd)continue ; count++;
@@ -3775,7 +3797,7 @@ _scsih_io_done(struct MPT2SAS_ADAPTER *iu32 response_code =0 ; mpi_reply =mpt2sas_base_get_reply_virt_addr (ioc, reply); - scmd =_scsih_scsi_lookup_get (ioc, smid); + scmd =_scsih_scsi_lookup_get_clear (ioc, smid);if (scmd ==NULL )return 1 ;
@@ -5037,6 +5059,7 @@ _scsih_sas_broadcast_primative_event(str struct fw_event_work *fw_event) {struct scsi_cmnd *scmd; +struct scsi_device *sdev;u16 smid, handle;u32 lun;struct MPT2SAS_DEVICE *sas_device_priv_data;
@@ -5047,12 +5070,17 @@ _scsih_sas_broadcast_primative_event(strMpi2EventDataSasBroadcastPrimitive_t *event_data = fw_event->event_data;#endif u16 ioc_status; +unsigned long flags; +int r; +dewtprintk (ioc,printk (MPT2SAS_INFO_FMT "broadcast primative: " "phy number(%d), width(%d)\n" , ioc->name, event_data->PhyNum, event_data->PortWidth));dtmprintk (ioc,printk (MPT2SAS_INFO_FMT "%s: enter\n" , ioc->name, __func__)); +spin_lock_irqsave (&ioc->scsi_lookup_lock, flags); + ioc->broadcast_aen_busy =0 ; termination_count =0 ; query_count =0 ; mpi_reply = ioc->tm_cmds.reply;
@@ -5060,7 +5088,8 @@ _scsih_sas_broadcast_primative_event(str scmd =_scsih_scsi_lookup_get (ioc, smid);if (!scmd)continue ; - sas_device_priv_data = scmd->device->hostdata; + sdev = scmd->device; + sas_device_priv_data = sdev->hostdata;if (!sas_device_priv_data || !sas_device_priv_data->sas_target)continue ;/* skip hidden raid components */
@@ -5076,6 +5105,7 @@ _scsih_sas_broadcast_primative_event(str lun = sas_device_priv_data->lun; query_count++; +spin_unlock_irqrestore (&ioc->scsi_lookup_lock, flags);mpt2sas_scsih_issue_tm (ioc, handle,0 ,0 , lun,MPI2_SCSITASKMGMT_TASKTYPE_QUERY_TASK , smid,30 ,NULL ); ioc->tm_cmds.status =MPT2_CMD_NOT_USED ;
@@ -5085,14 +5115,20 @@ _scsih_sas_broadcast_primative_event(str (mpi_reply->ResponseCode == MPI2_SCSITASKMGMT_RSP_TM_SUCCEEDED || mpi_reply->ResponseCode == - MPI2_SCSITASKMGMT_RSP_IO_QUEUED_ON_IOC)) + MPI2_SCSITASKMGMT_RSP_IO_QUEUED_ON_IOC)) { +spin_lock_irqsave (&ioc->scsi_lookup_lock, flags);continue ; - -mpt2sas_scsih_issue_tm (ioc, handle,0 ,0 , lun, -MPI2_SCSITASKMGMT_TASKTYPE_ABRT_TASK_SET ,0 ,30 ,NULL ); + } + r =mpt2sas_scsih_issue_tm (ioc, handle, sdev->channel, sdev->id, + sdev->lun,MPI2_SCSITASKMGMT_TASKTYPE_ABORT_TASK , smid,30 , + scmd); +if (r ==FAILED ) +sdev_printk (KERN_WARNING , sdev,"task abort: FAILED " +"scmd(%p)\n" , scmd); termination_count +=le32_to_cpu (mpi_reply->TerminationCount); +spin_lock_irqsave (&ioc->scsi_lookup_lock, flags); } - ioc->broadcast_aen_busy =0 ; +spin_unlock_irqrestore (&ioc->scsi_lookup_lock, flags); dtmprintk(ioc, printk(MPT2SAS_INFO_FMT "%s - exit, query_count = %d termination_count = %d\n",
PATCH 70/176 mpt2sas: Correct resizing calculation for max_queue_depth
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Kashyap, Desai <[email protected]>
commit 11e1b961ab067ee3acaf723531da4d3f23e1d6f7 upstream.
The ioc->hba_queue_depth is not properly resized when the controller firmware reports that it supports more outstanding IO than what can be fit inside the reply descriptor pool depth. This is reproduced by setting the controller global credits larger than 30,000. The bug results in an incorrect sizing of the queues. The fix is to resize the queue_size by dividing queue_diff by two.
--- drivers/scsi/mpt2sas/mpt2sas_base.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/scsi/mpt2sas/mpt2sas_base.c +3 -3
@@ -2057,9 +2057,9 @@ _base_allocate_memory_pools(struct MPT2S/* adjust hba_queue_depth, reply_free_queue_depth, * and queue_size */ - ioc->hba_queue_depth -= queue_diff; - ioc->reply_free_queue_depth -= queue_diff; - queue_size -= queue_diff; + ioc->hba_queue_depth -= (queue_diff /2 ); + ioc->reply_free_queue_depth -= (queue_diff /2 ); + queue_size = facts->MaxReplyDescriptorPostQueueDepth; } ioc->reply_post_queue_depth = queue_size;
PATCH 71/176 mpt2sas: Kernel Panic during Large Topology discovery
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Kashyap, Desai <[email protected]>
commit 4224489f45b503f0a1f1cf310f76dc108f45689a upstream.
There was a configuration page timing out during the initial port enable at driver load time. The port enable would fail, and this would result in the driver unloading itself, meanwhile the driver was accessing freed memory in another context resulting in the panic. The fix is to prevent access to freed memory once the driver had issued the diag reset which woke up the sleeping port enable process. The routine _base_reset_handler was reorganized so the last sleeping process woken up was the port_enable.
--- drivers/scsi/mpt2sas/mpt2sas_base.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-)
drivers/scsi/mpt2sas/mpt2sas_base.c +11 -2
@@ -3786,6 +3786,8 @@ mpt2sas_base_detach(struct MPT2SAS_ADAPTstatic void _base_reset_handler (struct MPT2SAS_ADAPTER *ioc,int reset_phase) { +mpt2sas_scsih_reset_handler (ioc, reset_phase); +mpt2sas_ctl_reset_handler (ioc, reset_phase);switch (reset_phase) {case MPT2_IOC_PRE_RESET : dtmprintk(ioc, printk(MPT2SAS_INFO_FMT "%s: "
@@ -3816,8 +3818,6 @@ _base_reset_handler(struct MPT2SAS_ADAPT "MPT2_IOC_DONE_RESET\n", ioc->name, __func__));break ; } -mpt2sas_scsih_reset_handler (ioc, reset_phase); -mpt2sas_ctl_reset_handler (ioc, reset_phase); }/**
@@ -3871,6 +3871,7 @@ mpt2sas_base_hard_reset_handler(struct M {int r;unsigned long flags; +u8 pe_complete = ioc->wait_for_port_enable_to_complete;dtmprintk (ioc,printk (MPT2SAS_INFO_FMT "%s: enter\n" , ioc->name, __func__));
@@ -3913,6 +3914,14 @@ mpt2sas_base_hard_reset_handler(struct Mif (r) goto out;_base_reset_handler (ioc,MPT2_IOC_AFTER_RESET ); + +/* If this hard reset is called while port enable is active, then +* there is no reason to call make_ioc_operational +*/ +if (pe_complete) { + r = -EFAULT ; + goto out; + } r =_base_make_ioc_operational (ioc, sleep_flag);if (!r)_base_reset_handler (ioc,MPT2_IOC_DONE_RESET );
PATCH 72/176 mpt2sas: add missing initialization of scsih_cmds
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Kashyap, Desai <[email protected]>
commit d685c262083dcd5fd98b7499b22a377a3225229c upstream.
Internal command scsih_cmds init is included in mpt2sas_base_attach.
--- drivers/scsi/mpt2sas/mpt2sas_base.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/scsi/mpt2sas/mpt2sas_base.c +5 -0
@@ -3662,6 +3662,11 @@ mpt2sas_base_attach(struct MPT2SAS_ADAPT ioc->scsih_cmds.status =MPT2_CMD_NOT_USED ;mutex_init (&ioc->scsih_cmds.mutex); +/* scsih internal command bits */ + ioc->scsih_cmds.reply =kzalloc (ioc->reply_sz,GFP_KERNEL ); + ioc->scsih_cmds.status =MPT2_CMD_NOT_USED ; +mutex_init (&ioc->scsih_cmds.mutex); +/* task management internal command bits */ ioc->tm_cmds.reply =kzalloc (ioc->reply_sz,GFP_KERNEL ); ioc->tm_cmds.status =MPT2_CMD_NOT_USED ;
PATCH 73/176 cfg80211: pass the reg hint initiator to helpers
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Luis R. Rodriguez <[email protected]>
commit 7ca43d03b1291481bdf894bbaec5d580e7684e7d upstream.
This is required later.
--- net/wireless/reg.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
net/wireless/reg.c +8 -4
@@ -723,7 +723,9 @@ EXPORT_SYMBOL(freq_reg_info);* on the wiphy with the target_bw specified. Then we can simply use * that below for the desired_bw_khz below. */ -static void handle_channel (struct wiphy *wiphy,enum ieee80211_band band, +static void handle_channel (struct wiphy *wiphy, +enum nl80211_reg_initiator initiator, +enum ieee80211_band band,unsigned int chan_idx) {int r;
@@ -787,7 +789,9 @@ static void handle_channel(struct wiphy chan->max_power = (int )MBM_TO_DBM (power_rule->max_eirp); } -static void handle_band (struct wiphy *wiphy,enum ieee80211_band band) +static void handle_band (struct wiphy *wiphy, +enum ieee80211_band band, +enum nl80211_reg_initiator initiator) {unsigned int i;struct ieee80211_supported_band *sband;
@@ -796,7 +800,7 @@ static void handle_band(struct wiphy *wi sband = wiphy->bands[band];for (i =0 ; i < sband->n_channels; i++) -handle_channel (wiphy, band, i); +handle_channel (wiphy, initiator, band, i); } static bool ignore_reg_update(struct wiphy *wiphy,
@@ -1033,7 +1037,7 @@ void wiphy_update_regulatory(struct wiph goto out;for (band =0 ; band <IEEE80211_NUM_BANDS ; band++) {if (wiphy->bands[band]) -handle_band (wiphy, band); +handle_band (wiphy, band, initiator); } out:reg_process_beacons (wiphy);
PATCH 74/176 cfg80211: fix allowing country IEs for WIPHY_FLAG_STRICT_REGULATORY
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Luis R. Rodriguez <[email protected]>
commit 749b527b21465fb079796c03ffb4302584dc31c1 upstream.
We should be enabling country IE hints for WIPHY_FLAG_STRICT_REGULATORY even if we haven't yet recieved regulatory domain hint for the driver if it needed one. Without this Country IEs are not passed on to drivers that have set WIPHY_FLAG_STRICT_REGULATORY, today this is just all Atheros chipset drivers: ath5k, ath9k, ar9170, carl9170.
This was part of the original design, however it was completely overlooked...
--- include/net/cfg80211.h | 15 ++++++++------- net/wireless/reg.c | 1 + 2 files changed, 9 insertions(+), 7 deletions(-)
include/net/cfg80211.h +8 -7
@@ -1201,13 +1201,14 @@ struct cfg80211_ops {* initiator is %REGDOM_SET_BY_CORE). * @WIPHY_FLAG_STRICT_REGULATORY: tells us the driver for this device will * ignore regulatory domain settings until it gets its own regulatory -* domain via its regulatory_hint(). After its gets its own regulatory -* domain it will only allow further regulatory domain settings to -* further enhance compliance. For example if channel 13 and 14 are -* disabled by this regulatory domain no user regulatory domain can -* enable these channels at a later time. This can be used for devices -* which do not have calibration information gauranteed for frequencies -* or settings outside of its regulatory domain. +* domain via its regulatory_hint() unless the regulatory hint is +* from a country IE. After its gets its own regulatory domain it will +* only allow further regulatory domain settings to further enhance +* compliance. For example if channel 13 and 14 are disabled by this +* regulatory domain no user regulatory domain can enable these channels +* at a later time. This can be used for devices which do not have +* calibration information guaranteed for frequencies or settings +* outside of its regulatory domain. * @WIPHY_FLAG_DISABLE_BEACON_HINTS: enable this if your driver needs to ensure * that passive scan flags and beaconing flags may not be lifted by * cfg80211 due to regulatory beacon hints. For more information on beacon
net/wireless/reg.c +1 -0
@@ -816,6 +816,7 @@ static bool ignore_reg_update(struct wip* desired regulatory domain set */ if (wiphy->flags &WIPHY_FLAG_STRICT_REGULATORY && !wiphy->regd && + initiator !=NL80211_REGDOM_SET_BY_COUNTRY_IE && !is_world_regdom (last_request->alpha2))return true;return false;
PATCH 75/176 radio-aimslab.c: Fix gcc 4.5+ bug
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Mauro Carvalho Chehab <[email protected]>
commit e3c92215198cb6aa00ad38db2780faa6b72e0a3f upstream.
gcc 4.5+ doesn't properly evaluate some inlined expressions. A previous patch were proposed by Andrew Morton using noinline. However, the entire inlined function is bogus, so let's just remove it and be happy.
--- drivers/media/radio/radio-aimslab.c | 23 ++++++----------------- 1 file changed, 6 insertions(+), 17 deletions(-)
drivers/media/radio/radio-aimslab.c +6 -17
@@ -31,7 +31,6 @@#include <linux/module.h> /* Modules */ #include <linux/init.h> /* Initdata */ #include <linux/ioport.h> /* request_region */ -#include <linux/delay.h> /* udelay */ #include <linux/videodev2.h> /* kernel radio structs */ #include <linux/version.h> /* for KERNEL_VERSION MACRO */ #include <linux/io.h> /* outb, outb_p */
@@ -71,27 +70,17 @@ static struct rtrack rtrack_card;/* local things */ -static void sleep_delay (long n) -{ -/* Sleep nicely for 'n' uS */ -int d = n /msecs_to_jiffies (1000 ); -if (!d) -udelay (n); -else -msleep (jiffies_to_msecs (d)); -} -static void rt_decvol (struct rtrack *rt) {outb (0x58 , rt->io);/* volume down + sigstr + on */ -sleep_delay (100000 ); +msleep (100 );outb (0xd8 , rt->io);/* volume steady + sigstr + on */ }static void rt_incvol (struct rtrack *rt) {outb (0x98 , rt->io);/* volume up + sigstr + on */ -sleep_delay (100000 ); +msleep (100 );outb (0xd8 , rt->io);/* volume steady + sigstr + on */ }
@@ -120,7 +109,7 @@ static int rt_setvol(struct rtrack *rt,if (vol ==0 ) {/* volume = 0 means mute the card */ outb (0x48 , rt->io);/* volume down but still "on" */ -sleep_delay (2000000 );/* make sure it's totally down */ +msleep (2000 );/* make sure it's totally down */ outb (0xd0 , rt->io);/* volume steady, off */ rt->curvol =0 ;/* track the volume state! */ mutex_unlock (&rt->lock);
@@ -155,7 +144,7 @@ static void send_0_byte(struct rtrack *routb_p (128 +64 +16 +8 +1 , rt->io);/* on + wr-enable + data low */ outb_p (128 +64 +16 +8 +2 +1 , rt->io);/* clock */ } -sleep_delay (1000 ); +msleep (1 ); }static void send_1_byte (struct rtrack *rt)
@@ -169,7 +158,7 @@ static void send_1_byte(struct rtrack *routb_p (128 +64 +16 +8 +4 +2 +1 , rt->io);/* clock */ } -sleep_delay (1000 ); +msleep (1 ); }static int rt_setfreq (struct rtrack *rt,unsigned long freq)
@@ -427,7 +416,7 @@ static int __init rtrack_init(void)/* this ensures that the volume is all the way down */ outb (0x48 , rt->io);/* volume down but still "on" */ -sleep_delay (2000000 );/* make sure it's totally down */ +msleep (2000 );/* make sure it's totally down */ outb (0xc0 , rt->io);/* steady volume, mute card */ return 0 ;
PATCH 76/176 em28xx: Fix audio input for Terratec Grabby
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Mauro Carvalho Chehab <[email protected]>
commit a3fa904ec79b94f0db7faed010ff94d42f7d1d47 upstream.
The audio input line was wrong. Fix it.
--- drivers/media/video/em28xx/em28xx-cards.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/media/video/em28xx/em28xx-cards.c +2 -2
@@ -1621,11 +1621,11 @@ struct em28xx_board em28xx_boards[] = { .input = { { .type = EM28XX_VMUX_COMPOSITE1, .vmux = SAA7115_COMPOSITE0, - .amux = EM28XX_AMUX_VIDEO2, + .amux = EM28XX_AMUX_LINE_IN, }, { .type = EM28XX_VMUX_SVIDEO, .vmux = SAA7115_SVIDEO3, - .amux = EM28XX_AMUX_VIDEO2, + .amux = EM28XX_AMUX_LINE_IN, } }, }, [EM2860_BOARD_TERRATEC_AV350] = {
PATCH 77/176 ALSA : au88x0 - Limit number of channels to fix Oops via OSS emu
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Raymond Yau <[email protected]>
commit d9ab344336f74c012f6643ed3d1ad8ca0136de3b upstream.
Fix playback/capture channels patch to change supported playback channels of au8830 to 1,2,4 and capture channels to 1,2. This prevent oops when oss emulation use SNDCTL_DSP_CHANNELS to set 3 Channels
--- sound/pci/au88x0/au88x0_pcm.c | 24 ++++++++++++++++++++---- 1 file changed, 20 insertions(+), 4 deletions(-)
sound/pci/au88x0/au88x0_pcm.c +20 -4
@@ -42,11 +42,7 @@ static struct snd_pcm_hardware snd_vorte .rate_min = 5000, .rate_max = 48000, .channels_min = 1, -#ifdef CHIP_AU8830 - .channels_max = 4, -#else .channels_max = 2, -#endif .buffer_bytes_max = 0x10000, .period_bytes_min = 0x1, .period_bytes_max = 0x1000,
@@ -115,6 +111,17 @@ static struct snd_pcm_hardware snd_vorte .periods_max = 64, };#endif +#ifdef CHIP_AU8830 +static unsigned int au8830_channels[3 ] = { +1 ,2 ,4 , +}; + +static struct snd_pcm_hw_constraint_list hw_constraints_au8830_channels = { + .count =ARRAY_SIZE (au8830_channels), + .list = au8830_channels, + .mask =0 , +}; +#endif /* open callback */ static int snd_vortex_pcm_open (struct snd_pcm_substream *substream) {
@@ -156,6 +163,15 @@ static int snd_vortex_pcm_open(struct snif (VORTEX_PCM_TYPE (substream->pcm) ==VORTEX_PCM_ADB ||VORTEX_PCM_TYPE (substream->pcm) ==VORTEX_PCM_I2S ) runtime->hw = snd_vortex_playback_hw_adb; +#ifdef CHIP_AU8830 +if (substream->stream ==SNDRV_PCM_STREAM_PLAYBACK && +VORTEX_PCM_TYPE (substream->pcm) ==VORTEX_PCM_ADB ) { + runtime->hw.channels_max =4 ; +snd_pcm_hw_constraint_list (runtime,0 , +SNDRV_PCM_HW_PARAM_CHANNELS , + &hw_constraints_au8830_channels); + } +#endif substream->runtime->private_data =NULL ; }#ifndef CHIP_AU8810
PATCH 78/176 ALSA: fix invalid hardware.h include in ac97c for AVR32 architecture
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Hans-Christian Egtvedt <[email protected]>
commit fd76804f3f5484b35e6a51214c91e916ebba05aa upstream.
This patch fixes the non-compiling AC97C driver for AVR32 architecture by include mach/hardware.h only for AT91 architecture. The AVR32 architecture does not supply the hardware.h include file.
--- sound/atmel/ac97c.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
sound/atmel/ac97c.c +4 -1
@@ -33,9 +33,12 @@#include <linux/dw_dmac.h> #include <mach/cpu.h> -#include <mach/hardware.h> #include <mach/gpio.h> +#ifdef CONFIG_ARCH_AT91 +#include <mach/hardware.h> +#endif +#include "ac97c.h" enum {
PATCH 79/176 ALSA: HDA: Fix dmesg output of HDMI supported bits
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: David Henningsson <[email protected]>
commit d757534ed15387202e322854cd72dc58bbb975de upstream.
This typo caused the dmesg output of the supported bits of HDMI to be cut off early.
--- sound/pci/hda/hda_eld.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/pci/hda/hda_eld.c +1 -1
@@ -381,7 +381,7 @@ static void hdmi_show_short_audio_desc(ssnd_print_pcm_rates (a->rates, buf,sizeof (buf));if (a->format ==AUDIO_CODING_TYPE_LPCM ) -snd_print_pcm_bits (a->sample_bits, buf2 +8 ,sizeof (buf2 -8 )); +snd_print_pcm_bits (a->sample_bits, buf2 +8 ,sizeof (buf2) -8 );else if (a->max_bitrate)snprintf (buf2,sizeof (buf2),", max bitrate = %d" , a->max_bitrate);
PATCH 80/176 ALSA: hda - Fix memory leaks in conexant jack arrays
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Takashi Iwai <[email protected]>
commit 70f7db11c45a313b23922cacf248c613c3b2144c upstream.
The Conexant codec driver adds the jack arrays in init callback which may be called also in each PM resume. This results in the addition of new jack element at each time.
The fix is to check whether the requested jack is already present in the array.
Reference: Novell bug 668929
https://bugzilla.novell.com/show_bug.cgi?id=668929
--- sound/pci/hda/patch_conexant.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
sound/pci/hda/patch_conexant.c +7 -1
@@ -393,10 +393,16 @@ static int conexant_add_jack(struct hda_struct conexant_spec *spec;struct conexant_jack *jack;const char *name; -int err; +int i, err; spec = codec->spec;snd_array_init (&spec->jacks,sizeof (*jack),32 ); + + jack = spec->jacks.list; +for (i =0 ; i < spec->jacks.used; i++, jack++) +if (jack->nid == nid) +return 0 ;/* already present */ + jack =snd_array_new (&spec->jacks); name = (type ==SND_JACK_HEADPHONE ) ?"Headphone" :"Mic" ;
PATCH 81/176 Input: i8042 - introduce notimeout blacklist for Dell Vostro V13
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Jiri Kosina <[email protected]>
commit f8313ef1f448006207f12c107123522c8bc00f15 upstream.
i8042 controller present in Dell Vostro V13 errorneously signals spurious timeouts.
Introduce i8042.notimeout parameter for ignoring i8042-signalled timeouts and apply this quirk automatically for Dell Vostro V13, based on DMI match.
In addition to that, this machine also needs to be added to nomux blacklist.
--- Documentation/kernel-parameters.txt | 1 + drivers/input/serio/i8042-x86ia64io.h | 21 +++++++++++++++++++++ drivers/input/serio/i8042.c | 6 +++++- 3 files changed, 27 insertions(+), 1 deletion(-)
Documentation/kernel-parameters.txt +1 -0
@@ -879,6 +879,7 @@ and is between 256 and 4096 characters. controller i8042.nopnp [HW] Don't use ACPIPnP / PnPBIOS to discover KBD/AUX controllers + i8042.notimeout [HW] Ignore timeout condition signalled by conroller i8042.reset [HW] Reset the controller during init and cleanup i8042.unlock [HW] Unlock (ignore) the keylock
drivers/input/serio/i8042-x86ia64io.h +21 -0
@@ -420,6 +420,13 @@ static const struct dmi_system_id __init DMI_MATCH(DMI_PRODUCT_VERSION, "0100"), }, }, + { + /* Dell Vostro V13 */ + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), + DMI_MATCH(DMI_PRODUCT_NAME, "Vostro V13"), + }, + }, { } };
@@ -541,6 +548,17 @@ static const struct dmi_system_id __init };#endif +static const struct dmi_system_id __initconst i8042_dmi_notimeout_table[] = { + { +/* Dell Vostro V13 */ + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"Dell Inc." ), +DMI_MATCH (DMI_PRODUCT_NAME ,"Vostro V13" ), + }, + }, + { } +}; +/* * Some Wistron based laptops need us to explicitly enable the 'Dritek * keyboard extension' to make their extra keys start generating scancodes.
@@ -893,6 +911,9 @@ static int __init i8042_platform_init(voif (dmi_check_system (i8042_dmi_nomux_table)) i8042_nomux = true; +if (dmi_check_system (i8042_dmi_notimeout_table)) + i8042_notimeout = true; +if (dmi_check_system (i8042_dmi_dritek_table)) i8042_dritek = true;#endif /* CONFIG_X86 */
drivers/input/serio/i8042.c +5 -1
@@ -61,6 +61,10 @@ static bool i8042_noloop;module_param_named (noloop, i8042_noloop, bool,0 );MODULE_PARM_DESC (noloop,"Disable the AUX Loopback command while probing for the AUX port" ); +static bool i8042_notimeout; +module_param_named (notimeout, i8042_notimeout, bool,0 ); +MODULE_PARM_DESC (notimeout,"Ignore timeouts signalled by i8042" ); +#ifdef CONFIG_X86 static bool i8042_dritek;module_param_named (dritek, i8042_dritek, bool,0 );
@@ -503,7 +507,7 @@ static irqreturn_t i8042_interrupt(int i }else { dfl = ((str &I8042_STR_PARITY ) ?SERIO_PARITY :0 ) | - ((str &I8042_STR_TIMEOUT ) ?SERIO_TIMEOUT :0 ); + ((str &I8042_STR_TIMEOUT && !i8042_notimeout) ?SERIO_TIMEOUT :0 ); port_no = (str &I8042_STR_AUXDATA ) ?I8042_AUX_PORT_NO :I8042_KBD_PORT_NO ;
PATCH 82/176 input: bcm5974: Add support for MacBookAir3
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Edgar (gimli) Hucek <[email protected]>
commit 6021afcf19d8c6f5db6d11cadcfb6a22d0c28a48 upstream.
This patch adds support for the MacBookAir3,1 and MacBookAir3,2 models.
--- drivers/input/mouse/bcm5974.c | 40 ++++++++++++++++++++++++++++++++++++++++ 1 file changed, 40 insertions(+)
drivers/input/mouse/bcm5974.c +40 -0
@@ -55,6 +55,14 @@#define USB_DEVICE_ID_APPLE_WELLSPRING3_ANSI 0x0236#define USB_DEVICE_ID_APPLE_WELLSPRING3_ISO 0x0237#define USB_DEVICE_ID_APPLE_WELLSPRING3_JIS 0x0238 +/* MacbookAir3,2 (unibody), aka wellspring5 */ +#define USB_DEVICE_ID_APPLE_WELLSPRING4_ANSI 0x023f +#define USB_DEVICE_ID_APPLE_WELLSPRING4_ISO 0x0240 +#define USB_DEVICE_ID_APPLE_WELLSPRING4_JIS 0x0241 +/* MacbookAir3,1 (unibody), aka wellspring4 */ +#define USB_DEVICE_ID_APPLE_WELLSPRING4A_ANSI 0x0242 +#define USB_DEVICE_ID_APPLE_WELLSPRING4A_ISO 0x0243 +#define USB_DEVICE_ID_APPLE_WELLSPRING4A_JIS 0x0244#define BCM5974_DEVICE (prod) { \ .match_flags = (USB_DEVICE_ID_MATCH_DEVICE | \
@@ -80,6 +88,14 @@ static const struct usb_device_id bcm597BCM5974_DEVICE (USB_DEVICE_ID_APPLE_WELLSPRING3_ANSI ),BCM5974_DEVICE (USB_DEVICE_ID_APPLE_WELLSPRING3_ISO ),BCM5974_DEVICE (USB_DEVICE_ID_APPLE_WELLSPRING3_JIS ), +/* MacbookAir3,2 */ +BCM5974_DEVICE (USB_DEVICE_ID_APPLE_WELLSPRING4_ANSI ), +BCM5974_DEVICE (USB_DEVICE_ID_APPLE_WELLSPRING4_ISO ), +BCM5974_DEVICE (USB_DEVICE_ID_APPLE_WELLSPRING4_JIS ), +/* MacbookAir3,1 */ +BCM5974_DEVICE (USB_DEVICE_ID_APPLE_WELLSPRING4A_ANSI ), +BCM5974_DEVICE (USB_DEVICE_ID_APPLE_WELLSPRING4A_ISO ), + BCM5974_DEVICE(USB_DEVICE_ID_APPLE_WELLSPRING4A_JIS), /* Terminating entry */ {} };
@@ -234,6 +250,30 @@ static const struct bcm5974_config bcm59 { DIM_X, DIM_X / SN_COORD, -4460, 5166 }, { DIM_Y, DIM_Y / SN_COORD, -75, 6700 } }, + { +USB_DEVICE_ID_APPLE_WELLSPRING4_ANSI , +USB_DEVICE_ID_APPLE_WELLSPRING4_ISO , +USB_DEVICE_ID_APPLE_WELLSPRING4_JIS , +HAS_INTEGRATED_BUTTON , +0x84 ,sizeof (struct bt_data ), +0x81 ,TYPE2 ,FINGER_TYPE2 ,FINGER_TYPE2 +SIZEOF_ALL_FINGERS , + { DIM_PRESSURE, DIM_PRESSURE / SN_PRESSURE, 0, 300 }, + { DIM_WIDTH, DIM_WIDTH / SN_WIDTH, 0, 2048 }, + { DIM_X, DIM_X / SN_COORD, -4620, 5140 }, + { DIM_Y, DIM_Y / SN_COORD, -150, 6600 } + }, + { +USB_DEVICE_ID_APPLE_WELLSPRING4A_ANSI , +USB_DEVICE_ID_APPLE_WELLSPRING4A_ISO , +USB_DEVICE_ID_APPLE_WELLSPRING4A_JIS , +HAS_INTEGRATED_BUTTON , +0x84 ,sizeof (struct bt_data ), +0x81 ,TYPE2 ,FINGER_TYPE2 ,FINGER_TYPE2 +SIZEOF_ALL_FINGERS , + { DIM_PRESSURE, DIM_PRESSURE / SN_PRESSURE, 0, 300 }, + { DIM_WIDTH, DIM_WIDTH / SN_WIDTH, 0, 2048 }, + { DIM_X, DIM_X / SN_COORD, -4616, 5112 }, + { DIM_Y, DIM_Y / SN_COORD, -142, 5234 } + }, {} };
PATCH 83/176 hwmon: (lm63) Consider LM64 temperature offset
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Dirk Eibach <[email protected]>
commit 2778fb13ba0fed1b3e4a040e71f7881d399610a3 upstream.
LM64 has 16 degrees Celsius temperature offset on all remote sensor registers.
This was not considered When LM64 support was added to lm63.c.
--- drivers/hwmon/lm63.c | 59 ++++++++++++++++++++++++++++++++++++++++----------- 1 file changed, 47 insertions(+), 12 deletions(-)
drivers/hwmon/lm63.c +47 -12
@@ -98,6 +98,9 @@ static const unsigned short normal_i2c[]* value, it uses signed 8-bit values with LSB = 1 degree Celsius. * For remote temperature, low and high limits, it uses signed 11-bit values * with LSB = 0.125 degree Celsius, left-justified in 16-bit registers. +* For LM64 the actual remote diode temperature is 16 degree Celsius higher +* than the register reading. Remote temperature setpoints have to be +* adapted accordingly. */ #define FAN_FROM_REG (reg) ((reg) == 0xFFFC || (reg) == 0 ? 0 : \
@@ -165,6 +168,8 @@ struct lm63_data {struct mutex update_lock;char valid;/* zero until following fields are valid */ unsigned long last_updated;/* in jiffies */ +int kind; +int temp2_offset;/* registers values */ u8 config, config_fan;
@@ -247,16 +252,34 @@ static ssize_t show_pwm1_enable(struct dreturn sprintf (buf,"%d\n" , data->config_fan &0x20 ?1 :2 ); } -static ssize_t show_temp8 (struct device *dev,struct device_attribute *devattr, -char *buf) +/* +* There are 8bit registers for both local(temp1) and remote(temp2) sensor. +* For remote sensor registers temp2_offset has to be considered, +* for local sensor it must not. +* So we need separate 8bit accessors for local and remote sensor. +*/ +static ssize_t show_local_temp8 (struct device *dev, +struct device_attribute *devattr, +char *buf) {struct sensor_device_attribute *attr =to_sensor_dev_attr (devattr);struct lm63_data *data =lm63_update_device (dev);return sprintf (buf,"%d\n" ,TEMP8_FROM_REG (data->temp8[attr->index])); } -static ssize_t set_temp8 (struct device *dev,struct device_attribute *dummy, -const char *buf,size_t count) +static ssize_t show_remote_temp8 (struct device *dev, +struct device_attribute *devattr, +char *buf) +{ +struct sensor_device_attribute *attr =to_sensor_dev_attr (devattr); +struct lm63_data *data =lm63_update_device (dev); +return sprintf (buf,"%d\n" ,TEMP8_FROM_REG (data->temp8[attr->index]) + + data->temp2_offset); +} + +static ssize_t set_local_temp8 (struct device *dev, +struct device_attribute *dummy, +const char *buf,size_t count) {struct i2c_client *client =to_i2c_client (dev);struct lm63_data *data =i2c_get_clientdata (client);
@@ -274,7 +297,8 @@ static ssize_t show_temp11(struct device {struct sensor_device_attribute *attr =to_sensor_dev_attr (devattr);struct lm63_data *data =lm63_update_device (dev); -return sprintf (buf,"%d\n" ,TEMP11_FROM_REG (data->temp11[attr->index])); +return sprintf (buf,"%d\n" ,TEMP11_FROM_REG (data->temp11[attr->index]) + + data->temp2_offset); } static ssize_t set_temp11(struct device *dev, struct device_attribute *devattr,
@@ -294,7 +318,7 @@ static ssize_t set_temp11(struct deviceint nr = attr->index;mutex_lock (&data->update_lock); - data->temp11[nr] =TEMP11_TO_REG (val); + data->temp11[nr] =TEMP11_TO_REG (val - data->temp2_offset);i2c_smbus_write_byte_data (client, reg[(nr -1 ) *2 ], data->temp11[nr] >>8 ); i2c_smbus_write_byte_data(client, reg[(nr - 1) * 2 + 1],
@@ -310,6 +334,7 @@ static ssize_t show_temp2_crit_hyst(stru {struct lm63_data *data =lm63_update_device (dev);return sprintf (buf,"%d\n" ,TEMP8_FROM_REG (data->temp8[2 ]) + + data->temp2_offset -TEMP8_FROM_REG (data->temp2_crit_hyst)); }
@@ -324,7 +349,7 @@ static ssize_t set_temp2_crit_hyst(struclong hyst;mutex_lock (&data->update_lock); - hyst =TEMP8_FROM_REG (data->temp8[2 ]) - val; + hyst =TEMP8_FROM_REG (data->temp8[2 ]) + data->temp2_offset - val;i2c_smbus_write_byte_data (client,LM63_REG_REMOTE_TCRIT_HYST ,HYST_TO_REG (hyst));mutex_unlock (&data->update_lock);
@@ -355,16 +380,21 @@ static SENSOR_DEVICE_ATTR(fan1_min, S_IW static DEVICE_ATTR(pwm1, S_IWUSR | S_IRUGO, show_pwm1, set_pwm1); static DEVICE_ATTR(pwm1_enable, S_IRUGO, show_pwm1_enable, NULL); -static SENSOR_DEVICE_ATTR(temp1_input, S_IRUGO, show_temp8, NULL, 0); -static SENSOR_DEVICE_ATTR(temp1_max, S_IWUSR | S_IRUGO, show_temp8, - set_temp8, 1); +static SENSOR_DEVICE_ATTR(temp1_input, S_IRUGO, show_local_temp8, NULL, 0); +static SENSOR_DEVICE_ATTR(temp1_max, S_IWUSR | S_IRUGO, show_local_temp8, + set_local_temp8, 1); static SENSOR_DEVICE_ATTR(temp2_input, S_IRUGO, show_temp11, NULL, 0); static SENSOR_DEVICE_ATTR(temp2_min, S_IWUSR | S_IRUGO, show_temp11, set_temp11, 1); static SENSOR_DEVICE_ATTR(temp2_max, S_IWUSR | S_IRUGO, show_temp11, set_temp11, 2); -static SENSOR_DEVICE_ATTR(temp2_crit, S_IRUGO, show_temp8, NULL, 2); +/* +* On LM63, temp2_crit can be set only once, which should be job +* of the bootloader. +*/ +static SENSOR_DEVICE_ATTR(temp2_crit, S_IRUGO, show_remote_temp8, + NULL, 2); static DEVICE_ATTR(temp2_crit_hyst, S_IWUSR | S_IRUGO, show_temp2_crit_hyst, set_temp2_crit_hyst);
@@ -479,7 +509,12 @@ static int lm63_probe(struct i2c_client data->valid =0 ;mutex_init (&data->update_lock); -/* Initialize the LM63 chip */ +/* Set the device type */ + data->kind = id->driver_data; +if (data->kind == lm64) + data->temp2_offset =16000 ; + +/* Initialize chip */ lm63_init_client (new_client);/* Register sysfs hooks */
PATCH 84/176 ALSA: hrtimer: handle delayed timer interrupts
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Clemens Ladisch <[email protected]>
commit b1d4f7f4bdcf9915c41ff8cfc4425c84dabb1fde upstream.
If a timer interrupt was delayed too much, hrtimer_forward_now() will forward the timer expiry more than once. When this happens, the additional number of elapsed ALSA timer ticks must be passed to snd_timer_interrupt() to prevent the ALSA timer from falling behind.
This mostly fixes MIDI slowdown problems on highly-loaded systems with badly behaved interrupt handlers.
--- sound/core/hrtimer.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
sound/core/hrtimer.c +3 -2
@@ -45,12 +45,13 @@ static enum hrtimer_restart snd_hrtimer_ { struct snd_hrtimer *stime = container_of(hrt, struct snd_hrtimer, hrt);struct snd_timer *t = stime->timer; +unsigned long oruns;if (!atomic_read (&stime->running))return HRTIMER_NORESTART ; -hrtimer_forward_now (hrt,ns_to_ktime (t->sticks * resolution)); -snd_timer_interrupt (stime->timer, t->sticks); + oruns =hrtimer_forward_now (hrt,ns_to_ktime (t->sticks * resolution)); +snd_timer_interrupt (stime->timer, t->sticks * oruns);if (!atomic_read (&stime->running))return HRTIMER_NORESTART ;
PATCH 85/176 ALSA: HDA: Add subwoofer quirk for Acer Aspire 8942G
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: David Henningsson <[email protected]>
commit a6c47a85b8e7e4a8c47394607c5e5c43224b0892 upstream.
According to the reporter, node 0x15 needs to be muted for subwoofer to stop sounding. This pin is marked as unused by BIOS, so fix that.
--- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/patch_realtek.c +1 -0
@@ -18959,6 +18959,7 @@ static const struct alc_fixup alc662_fix };static struct snd_pci_quirk alc662_fixup_tbl[] = { +SND_PCI_QUIRK (0x1025 ,0x0308 ,"Acer Aspire 8942G" ,ALC662_FIXUP_ASPIRE ),SND_PCI_QUIRK (0x1025 ,0x038b ,"Acer Aspire 8943G" ,ALC662_FIXUP_ASPIRE ),SND_PCI_QUIRK (0x144d ,0xc051 ,"Samsung R720" ,ALC662_FIXUP_IDEAPAD ),SND_PCI_QUIRK (0x17aa ,0x38af ,"Lenovo Ideapad Y550P" ,ALC662_FIXUP_IDEAPAD ),
PATCH 86/176 ASoC: When disabling WM8994 FLL force a source selection
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Mark Brown <[email protected]>
commit 4514e8997fbefd5befd6176ac9785e287b4daed4 upstream.
When we disable the WM8994 FLL code path sharing means that we end up writing out a configuration. Currently this is the currently active input and output frequency (which causes snd_soc_update_bits() to suppress actual writes both immediately and in the common case where we reenable the same configuration later) but we allow machine drivers to pass through a source of zero. Since the register values written are one less than the source constants this causes corruption of other bitfields in the register.
Fix this by using the most recently configured FLL source when none is provided.
--- sound/soc/codecs/wm8994.c | 1 + 1 file changed, 1 insertion(+)
sound/soc/codecs/wm8994.c +1 -0
@@ -2914,6 +2914,7 @@ static int wm8994_set_fll(struct snd_soc/* Allow no source specification when stopping */ if (freq_out)return -EINVAL ; + src = wm8994->fll[id].src;break ;case WM8994_FLL_SRC_MCLK1 :case WM8994_FLL_SRC_MCLK2 :
PATCH 87/176 ASoC: WM8990: msleep() takes milliseconds not jiffies
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Dimitris Papastamos <[email protected]>
commit 7ebcf5d6021a696680ee77d9162a2edec2d671dd upstream.
--- sound/soc/codecs/wm8990.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
sound/soc/codecs/wm8990.c +5 -5
@@ -1183,7 +1183,7 @@ static int wm8990_set_bias_level(struct WM8990_VMIDTOG);/* Delay to allow output caps to discharge */ -msleep (msecs_to_jiffies (300 )); +msleep (300 );/* Disable VMIDTOG */ snd_soc_write(codec, WM8990_ANTIPOP2, WM8990_SOFTST |
@@ -1195,17 +1195,17 @@ static int wm8990_set_bias_level(struct/* Enable outputs */ snd_soc_write (codec,WM8990_POWER_MANAGEMENT_1 ,0x1b00 ); -msleep (msecs_to_jiffies (50 )); +msleep (50 );/* Enable VMID at 2x50k */ snd_soc_write (codec,WM8990_POWER_MANAGEMENT_1 ,0x1f02 ); -msleep (msecs_to_jiffies (100 )); +msleep (100 );/* Enable VREF */ snd_soc_write (codec,WM8990_POWER_MANAGEMENT_1 ,0x1f03 ); -msleep (msecs_to_jiffies (600 )); +msleep (600 );/* Enable BUFIOEN */ snd_soc_write(codec, WM8990_ANTIPOP2, WM8990_SOFTST |
@@ -1250,7 +1250,7 @@ static int wm8990_set_bias_level(struct/* Disable VMID */ snd_soc_write (codec,WM8990_POWER_MANAGEMENT_1 ,0x1f01 ); -msleep (msecs_to_jiffies (300 )); +msleep (300 );/* Enable all output discharge bits */ snd_soc_write(codec, WM8990_ANTIPOP1, WM8990_DIS_LLINE |
PATCH 88/176 ASoC: Blackfin AC97: fix build error after multi-component update
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Mike Frysinger <[email protected]>
commit e9c2048915048d605fd76539ddd96f00d593e1eb upstream.
We need to tweak how we query the active capture/playback state after the recent overhauls of common code.
--- sound/soc/blackfin/bf5xx-ac97.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
sound/soc/blackfin/bf5xx-ac97.c +2 -2
@@ -260,9 +260,9 @@ static int bf5xx_ac97_suspend(struct sndpr_debug ("%s : sport %d\n" , __func__, dai->id);if (!dai->active)return 0 ; -if (dai->capture.active) +if (dai->capture_active)sport_rx_stop (sport); -if (dai->playback.active) +if (dai->playback_active)sport_tx_stop (sport);return 0 ; }
PATCH 89/176 ASoC: Blackfin TDM: fix missed snd_soc_dai_get_drvdata update
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Mike Frysinger <[email protected]>
commit 15d2e22b820bad62854d6ad99d8af8320adf4a91 upstream.
One spot was missed in this driver when converting from snd_soc_dai.private_data to snd_soc_dai_get_drvdata.
--- sound/soc/blackfin/bf5xx-tdm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/blackfin/bf5xx-tdm.c +1 -1
@@ -210,7 +210,7 @@ static int bf5xx_tdm_set_channel_map(str#ifdef CONFIG_PM static int bf5xx_tdm_suspend (struct snd_soc_dai *dai) { -struct sport_device *sport = dai->private_data; +struct sport_device *sport =snd_soc_dai_get_drvdata (dai);if (!dai->active)return 0 ;
PATCH 90/176 NFS: Fix an NFS client lockdep issue
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Trond Myklebust <[email protected]>
commit e00b8a24041f37e56b4b8415ce4eba1cbc238065 upstream.
There is no reason to be freeing the delegation cred in the rcu callback, and doing so is resulting in a lockdep complaint that rpc_credcache_lock is being called from both softirq and non-softirq contexts.
--- fs/nfs/delegation.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
fs/nfs/delegation.c +4 -2
@@ -24,8 +24,6 @@static void nfs_do_free_delegation (struct nfs_delegation *delegation) { -if (delegation->cred) -put_rpccred (delegation->cred);kfree (delegation); }
@@ -38,6 +36,10 @@ static void nfs_free_delegation_callbackstatic void nfs_free_delegation (struct nfs_delegation *delegation) { +if (delegation->cred) { +put_rpccred (delegation->cred); + delegation->cred =NULL ; + }call_rcu (&delegation->rcu, nfs_free_delegation_callback); }
PATCH 91/176 NFS: Fix "kernel BUG at fs/aio.c:554!"
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Chuck Lever <[email protected]>
commit 839f7ad6932d95f4d5ae7267b95c574714ff3d5b upstream.
Nick Piggin reports:
Quoted 16 lines
I'm getting use after frees in aio code in NFS
[ 2703.396766] Call Trace: [ 2703.396858] [<ffffffff8100b057>] ? native_sched_clock+0x27/0x80 [ 2703.396959] [<ffffffff8108509e>] ? put_lock_stats+0xe/0x40 [ 2703.397058] [<ffffffff81088348>] ? lock_release_holdtime+0xa8/0x140 [ 2703.397159] [<ffffffff8108a2a5>] lock_acquire+0x95/0x1b0 [ 2703.397260] [<ffffffff811627db>] ? aio_put_req+0x2b/0x60 [ 2703.397361] [<ffffffff81039701>] ? get_parent_ip+0x11/0x50 [ 2703.397464] [<ffffffff81612a31>] _raw_spin_lock_irq+0x41/0x80 [ 2703.397564] [<ffffffff811627db>] ? aio_put_req+0x2b/0x60 [ 2703.397662] [<ffffffff811627db>] aio_put_req+0x2b/0x60 [ 2703.397761] [<ffffffff811647fe>] do_io_submit+0x2be/0x7c0 [ 2703.397895] [<ffffffff81164d0b>] sys_io_submit+0xb/0x10 [ 2703.397995] [<ffffffff8100307b>] system_call_fastpath+0x16/0x1b
Quoted 3 lines
Adding some tracing, it is due to nfs completing the request then returning something other than
-EIOCBQUEUED, soaio.calso completes the request.
To address this, prevent the NFS direct I/O engine from completing async iocbs when the forward path returns an error without starting any I/O.
This fix appears to survive ^C during both "xfstest no. 208" and "fsx -Z."
It's likely this bug has existed for a very long while, as we are seeing very similar symptoms in OEL 5. Copying stable.
--- fs/nfs/direct.c | 34 ++++++++++++++++++++-------------- 1 file changed, 20 insertions(+), 14 deletions(-)
fs/nfs/direct.c +20 -14
@@ -407,15 +407,18 @@ static ssize_t nfs_direct_read_schedule_ pos += vec->iov_len; } +/* +* If no bytes were started, return the error, and let the +* generic layer handle the completion. +*/ +if (requested_bytes ==0 ) { +nfs_direct_req_release (dreq); +return result <0 ? result : -EIO ; + } +if (put_dreq (dreq))nfs_direct_complete (dreq); - -if (requested_bytes !=0 ) -return 0 ; - -if (result <0 ) -return result; -return -EIO ; +return 0 ; } static ssize_t nfs_direct_read(struct kiocb *iocb, const struct iovec *iov,
@@ -841,15 +844,18 @@ static ssize_t nfs_direct_write_schedule pos += vec->iov_len; } +/* +* If no bytes were started, return the error, and let the +* generic layer handle the completion. +*/ +if (requested_bytes ==0 ) { +nfs_direct_req_release (dreq); +return result <0 ? result : -EIO ; + } +if (put_dreq (dreq))nfs_direct_write_complete (dreq, dreq->inode); - -if (requested_bytes !=0 ) -return 0 ; - -if (result <0 ) -return result; -return -EIO ; +return 0 ; } static ssize_t nfs_direct_write(struct kiocb *iocb, const struct iovec *iov,
PATCH 92/176 RDMA/cxgb4: Set the correct device physical function for iWARP connections
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Steve Wise <[email protected]>
commit 94788657c94169171971968c9d4b6222c5e704aa upstream.
The PF passed to FW was 0, causing PCI failures in an SR-IOV environment.
--- drivers/infiniband/hw/cxgb4/cm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/infiniband/hw/cxgb4/cm.c +1 -1
@@ -383,7 +383,7 @@ static void send_flowc(struct c4iw_ep *e 16)) | FW_WR_FLOWID(ep->hwtid)); flowc->mnemval[0 ].mnemonic =FW_FLOWC_MNEM_PFNVFN ; - flowc->mnemval[0 ].val =cpu_to_be32 (0 ); + flowc->mnemval[0 ].val =cpu_to_be32 (PCI_FUNC (ep->com.dev->rdev.lldi.pdev->devfn) <<8 ); flowc->mnemval[1 ].mnemonic =FW_FLOWC_MNEM_CH ; flowc->mnemval[1 ].val =cpu_to_be32 (ep->tx_chan); flowc->mnemval[2 ].mnemonic =FW_FLOWC_MNEM_PORT ;
PATCH 93/176 /proc/kcore: fix seeking
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Dave Anderson <[email protected]>
commit ceff1a770933e2ca2bf995b453dade4ec47a9878 upstream.
Commit 34aacb2920 ("procfs: Use generic_file_llseek in /proc/kcore") broke seeking on /proc/kcore. This changes it back to use default_llseek in order to restore the original behavior.
The problem with generic_file_llseek is that it only allows seeks up to inode->i_sb->s_maxbytes, which is 2GB-1 on procfs, where the memory file offset values in the /proc/kcore PT_LOAD segments may exceed or start beyond that offset value.
A similar revert was made for /proc/vmcore.
--- fs/proc/kcore.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/proc/kcore.c +1 -1
@@ -558,7 +558,7 @@ static int open_kcore(struct inode *inodstatic const struct file_operations proc_kcore_operations = { .read = read_kcore, .open = open_kcore, - .llseek = generic_file_llseek, + .llseek = default_llseek, };#ifdef CONFIG_MEMORY_HOTPLUG
PATCH 94/176 rtc-cmos: fix suspend/resume
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Paul Fox <[email protected]>
commit 2fb08e6ca9f00d1aedb3964983e9c8f84b36b807 upstream.
rtc-cmos was setting suspend/resume hooks at the device_driver level. However, the platform bus code (drivers/base/platform.c) only looks for resume hooks at the dev_pm_ops level, or within the platform_driver.
Switch rtc_cmos to use dev_pm_ops so that suspend/resume code is executed again.
Paul said:
: The user visible symptom in our (XO laptop) case was that rtcwake would : fail to wake the laptop. The RTC alarm would expire, but the wakeup : wasn't unmasked.
:
: As for severity, the impact may have been reduced because if I recall : correctly, the bug only affected platforms with CONFIG_PNP disabled.
--- drivers/rtc/rtc-cmos.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-)
drivers/rtc/rtc-cmos.c +9 -7
@@ -36,6 +36,7 @@#include <linux/platform_device.h> #include <linux/mod_devicetable.h> #include <linux/log2.h> +#include <linux/pm.h> /* this is for "generic access to PC-style RTC" using CMOS_READ/CMOS_WRITE */ #include <asm-generic/rtc.h>
@@ -850,7 +851,7 @@ static void __exit cmos_do_remove(struct#ifdef CONFIG_PM -static int cmos_suspend (struct device *dev,pm_message_t mesg) +static int cmos_suspend (struct device *dev) {struct cmos_rtc *cmos =dev_get_drvdata (dev);unsigned char tmp;
@@ -898,7 +899,7 @@ static int cmos_suspend(struct device *d*/ static inline int cmos_poweroff (struct device *dev) { -return cmos_suspend (dev,PMSG_HIBERNATE ); +return cmos_suspend (dev); }static int cmos_resume (struct device *dev)
@@ -945,9 +946,9 @@ static int cmos_resume(struct device *dereturn 0 ; } +static SIMPLE_DEV_PM_OPS(cmos_pm_ops, cmos_suspend, cmos_resume); +#else -#define cmos_suspend NULL -#define cmos_resume NULLstatic inline int cmos_poweroff (struct device *dev) {
@@ -1077,7 +1078,7 @@ static void __exit cmos_pnp_remove(strucstatic int cmos_pnp_suspend (struct pnp_dev *pnp,pm_message_t mesg) { -return cmos_suspend (&pnp->dev, mesg); +return cmos_suspend (&pnp->dev); }static int cmos_pnp_resume (struct pnp_dev *pnp)
@@ -1157,8 +1158,9 @@ static struct platform_driver cmos_platf .shutdown = cmos_platform_shutdown, .driver = { .name = (char *) driver_name, - .suspend = cmos_suspend, - .resume = cmos_resume, +#ifdef CONFIG_PM + .pm = &cmos_pm_ops, +#endif } };
PATCH 95/176 mm: fix migration hangs on anon_vma lock
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Hugh Dickins <[email protected]>
commit 1ce82b69e96c838d007f316b8347b911fdfa9842 upstream.
Increased usage of page migration in mmotm reveals that the anon_vma locking in unmap_and_move() has been deficient since 2.6.36 (or even earlier). Review at the time of f18194275c39835cb84563500995e0d503a32d9a ("mm: fix hang on anon_vma->root->lock") missed the issue here: the anon_vma to which we get a reference may already have been freed back to its slab (it is in use when we check page_mapped, but that can change), and so its anon_vma->root may be switched at any moment by reuse in anon_vma_prepare.
Perhaps we could fix that with a get_anon_vma_unless_zero(), but let's
not: just rely on page_lock_anon_vma() to do all the hard thinking for us, then we don't need any rcu read locking over here.
In removing the rcu_unlock label: since PageAnon is a bit in page->mapping, it's impossible for a !page->mapping page to be anon; but insert VM_BUG_ON in case the implementation ever changes.
--- mm/migrate.c | 48 +++++++++++++++++++----------------------------- 1 file changed, 19 insertions(+), 29 deletions(-)
mm/migrate.c +19 -29
@@ -553,7 +553,6 @@ static int unmap_and_move(new_page_t getint *result =NULL ;struct page *newpage =get_new_page (page, private, &result);int remap_swapcache =1 ; -int rcu_locked =0 ;int charge =0 ;struct mem_cgroup *mem =NULL ;struct anon_vma *anon_vma =NULL ;
@@ -605,20 +604,26 @@ static int unmap_and_move(new_page_t get/* * By try_to_unmap(), page->mapcount goes down to 0 here. In this case, * we cannot notice that anon_vma is freed while we migrates a page. -* This rcu_read_lock() delays freeing anon_vma pointer until the end +* This get_anon_vma() delays freeing anon_vma pointer until the end * of migration. File cache pages are no problem because of page_lock() * File Caches may use write_page() or lock_page() in migration, then, * just care Anon page here. */ if (PageAnon (page)) { -rcu_read_lock (); - rcu_locked =1 ; - -/* Determine how to safely use anon_vma */ -if (!page_mapped (page)) { -if (!PageSwapCache (page)) - goto rcu_unlock; - +/* +* Only page_lock_anon_vma() understands the subtleties of +* getting a hold on an anon_vma from outside one of its mms. +*/ + anon_vma =page_lock_anon_vma (page); +if (anon_vma) { +/* +* Take a reference count on the anon_vma if the +* page is mapped so that it is guaranteed to +* exist when the page is remapped later +*/ +get_anon_vma (anon_vma); +page_unlock_anon_vma (anon_vma); + }else if (PageSwapCache (page)) {/* * We cannot be sure that the anon_vma of an unmapped * swapcache page is safe to use because we don't
@@ -633,13 +638,7 @@ static int unmap_and_move(new_page_t get*/ remap_swapcache =0 ; }else { -/* -* Take a reference count on the anon_vma if the -* page is mapped so that it is guaranteed to -* exist when the page is remapped later -*/ - anon_vma =page_anon_vma (page); -get_anon_vma (anon_vma); + goto uncharge; } }
@@ -656,16 +655,10 @@ static int unmap_and_move(new_page_t get* free the metadata, so the page can be freed. */ if (!page->mapping) { -if (!PageAnon (page) &&page_has_private (page)) { -/* -* Go direct to try_to_free_buffers() here because -* a) that's what try_to_release_page() would do anyway -* b) we may be under rcu_read_lock() here, so we can't -* use GFP_KERNEL which is what try_to_release_page() -* needs to be effective. -*/ +VM_BUG_ON (PageAnon (page)); +if (page_has_private (page)) {try_to_free_buffers (page); - goto rcu_unlock; + goto uncharge; } goto skip_unmap; }
@@ -679,14 +672,11 @@ skip_unmap:if (rc && remap_swapcache)remove_migration_ptes (page, page); -rcu_unlock:/* Drop an anon_vma reference if we took one */ if (anon_vma)drop_anon_vma (anon_vma); -if (rcu_locked) -rcu_read_unlock (); uncharge:if (!charge)mem_cgroup_end_migration (mem, page, newpage);
PATCH 96/176 ext4: fix memory leak in ext4_free_branches
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Theodore Ts'o <[email protected]>
commit 1c5b9e9065567876c2d4a7a16d78f0fed154a5bf upstream.
Commit 40389687 moved a call to ext4_forget() out of ext4_free_branches and let ext4_free_blocks() handle calling bforget(). But that change unfortunately did not replace the call to ext4_forget() with brelse(), which was needed to drop the in-use count of the indirect block's buffer head, which lead to a memory leak when deleting files that used indirect blocks. Fix this.
Thanks to Hugh Dickins for pointing this out.
--- fs/ext4/inode.c | 1 + 1 file changed, 1 insertion(+)
fs/ext4/inode.c +1 -0
@@ -4530,6 +4530,7 @@ static void ext4_free_branches(handle_t (__le32 *) bh->b_data, (__le32 *) bh->b_data + addr_per_block, depth); +brelse (bh);/* * Everything below this this pointer has been
PATCH 97/176 rapidio: fix hang on RapidIO doorbell queue full condition
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Thomas Taranowski <[email protected]>
commit 12a4dc43911785f51a596f771ae0701b18d436f1 upstream.
In fsl_rio_dbell_handler() the code currently simply acknowledges the QFI queue full interrupt, but does nothing to resolve the queue full condition. Instead, it jumps to the end of the isr. When a queue full condition occurs, the isr is then re-entered immediately and continually, forever.
The fix is to just fall through and read out current doorbell entries.
--- arch/powerpc/sysdev/fsl_rio.c | 1 - 1 file changed, 1 deletion(-)
arch/powerpc/sysdev/fsl_rio.c +0 -1
@@ -954,7 +954,6 @@ fsl_rio_dbell_handler(int irq, void *devif (dsr &DOORBELL_DSR_QFI ) {pr_info ("RIO: doorbell queue full\n" );out_be32 (&priv->msg_regs->dsr,DOORBELL_DSR_QFI ); - goto out; }/* XXX Need to check/dispatch until queue empty */
PATCH 98/176 sh: Fix up legacy PTEA space attribute mapping.
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Paul Mundt <[email protected]>
commit efb3e34b6176d30c4fe8635fa8e1beb6280cc2cd upstream.
When p3_ioremap() was converted to ioremap_prot() there was some breakage introduced where the 29-bit segmentation logic would trap the area range and return an identity mapping without having allowed the area specification to force mapping through page tables. This wires up a PCC mask for pgprot verification to work out whether to short-circuit the identity mapping on legacy parts, restoring the previous behaviour.
--- arch/sh/include/asm/io.h | 10 +++++++++- arch/sh/include/asm/pgtable_32.h | 7 ++++++- 2 files changed, 15 insertions(+), 2 deletions(-)
arch/sh/include/asm/io.h +9 -1
@@ -322,7 +322,15 @@ __ioremap_29bit(phys_addr_t offset, unsi* mapping must be done by the PMB or by using page tables. */ if (likely (PXSEG (offset) <P3SEG &&PXSEG (last_addr) <P3SEG )) { -if (unlikely (pgprot_val (prot) & _PAGE_CACHABLE)) +u64 flags =pgprot_val (prot); + +/* +* Anything using the legacy PTEA space attributes needs +* to be kicked down to page table mappings. +*/ +if (unlikely (flags & _PAGE_PCC_MASK)) +return NULL ; +if (unlikely (flags & _PAGE_CACHABLE))return (void __iomem *)P1SEGADDR (offset);return (void __iomem *)P2SEGADDR (offset);
arch/sh/include/asm/pgtable_32.h +6 -1
@@ -76,6 +76,10 @@/* Wrapper for extended mode pgprot twiddling */ #define _PAGE_EXT (x) ((unsigned long long)(x) << 32) +#ifdef CONFIG_X2TLB +#define _PAGE_PCC_MASK 0x00000000/* No legacy PTEA support */ +#else +/* software: moves to PTEA.TC (Timing Control) */ #define _PAGE_PCC_AREA5 0x00000000/* use BSC registers for area5 */ #define _PAGE_PCC_AREA6 0x80000000/* use BSC registers for area6 */
@@ -89,7 +93,8 @@#define _PAGE_PCC_ATR8 0x60000000/* Attribute Memory space, 8 bit bus */ #define _PAGE_PCC_ATR16 0x60000001/* Attribute Memory space, 6 bit bus */ -#ifndef CONFIG_X2TLB +#define _PAGE_PCC_MASK 0xe0000001 +/* copy the ptea attributes */ static inline unsigned long copy_ptea_attributes (unsigned long x) {
PATCH 99/176 PCI: pci-stub: ignore zero-length id parameters
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Tejun Heo <[email protected]>
commit 99a0fadf561e1f553c08f0a29f8b2578f55dd5f0 upstream.
pci-stub uses strsep() to separate list of ids and generates a warning message when it fails to parse an id. However, not specifying the parameter results in ids set to an empty string. strsep() happily returns the empty string as the first token and thus triggers the warning message spuriously.
Make the tokner ignore zero length ids.
--- drivers/pci/pci-stub.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/pci/pci-stub.c +3 -0
@@ -54,6 +54,9 @@ static int __init pci_stub_init(void) subdevice =PCI_ANY_ID , class=0 , class_mask=0 ;int fields; +if (!strlen (id)) +continue ; + fields =sscanf (id,"%x:%x:%x:%x:%x:%x" , &vendor, &device, &subvendor, &subdevice, &class, &class_mask);
PATCH 100/176 virtio: remove virtio-pci root device
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Milton Miller <[email protected]>
commit 8b3bb3ecf1934ac4a7005ad9017de1127e2fbd2f upstream.
We sometimes need to map between the virtio device and the given pci device. One such use is OS installer that gets the boot pci device from BIOS and needs to find the relevant block device. Since it can't, installation fails.
Instead of creating a top-level devices/virtio-pci directory, create each device under the corresponding pci device node. Symlinks to all virtio-pci devices can be found under the pci driver link in bus/pci/drivers/virtio-pci/devices, and all virtio devices under drivers/bus/virtio/devices.
--- drivers/virtio/virtio_pci.c | 20 ++------------------ 1 file changed, 2 insertions(+), 18 deletions(-)
drivers/virtio/virtio_pci.c +2 -18
@@ -96,11 +96,6 @@ static struct pci_device_id virtio_pci_iMODULE_DEVICE_TABLE (pci, virtio_pci_id_table); -/* A PCI device has it's own struct device and so does a virtio device so -* we create a place for the virtio devices to show up in sysfs. I think it -* would make more sense for virtio to not insist on having it's own device. */ -static struct device *virtio_pci_root; -/* Convert a generic virtio device to our structure */ static struct virtio_pci_device *to_vp_device (struct virtio_device *vdev) {
@@ -629,7 +624,7 @@ static int __devinit virtio_pci_probe(stif (vp_dev ==NULL )return -ENOMEM ; - vp_dev->vdev.dev.parent = virtio_pci_root; + vp_dev->vdev.dev.parent = &pci_dev->dev; vp_dev->vdev.dev.release = virtio_pci_release_dev; vp_dev->vdev.config = &virtio_pci_config_ops; vp_dev->pci_dev = pci_dev;
@@ -717,17 +712,7 @@ static struct pci_driver virtio_pci_drivstatic int __init virtio_pci_init (void ) { -int err; - - virtio_pci_root =root_device_register ("virtio-pci" ); -if (IS_ERR (virtio_pci_root)) -return PTR_ERR (virtio_pci_root); - - err =pci_register_driver (&virtio_pci_driver); -if (err) -root_device_unregister (virtio_pci_root); - -return err; +return pci_register_driver (&virtio_pci_driver); }module_init (virtio_pci_init);
@@ -735,7 +720,6 @@ module_init(virtio_pci_init); static void __exit virtio_pci_exit(void) {pci_unregister_driver (&virtio_pci_driver); -root_device_unregister (virtio_pci_root); }module_exit (virtio_pci_exit);
PATCH 101/176 jz4740-battery: Protect against concurrent battery readings
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Lars-Peter Clausen <[email protected]>
commit 8ec98fe0b4ffdedce4c1caa9fb3d550f52ad1c6b upstream.
We can not handle more then one ADC request at a time to the battery. The patch adds a mutex around the ADC read code to ensure this.
--- drivers/power/jz4740-battery.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/power/jz4740-battery.c +7 -0
@@ -47,6 +47,8 @@ struct jz_battery {struct power_supply battery;struct delayed_work work; + +struct mutex lock; };static inline struct jz_battery *psy_to_jz_battery (struct power_supply *psy)
@@ -68,6 +70,8 @@ static long jz_battery_read_voltage(struunsigned long val;long voltage; +mutex_lock (&battery->lock); +INIT_COMPLETION (battery->read_completion);enable_irq (battery->irq);
@@ -91,6 +95,8 @@ static long jz_battery_read_voltage(stru battery->cell->disable (battery->pdev);disable_irq (battery->irq); +mutex_unlock (&battery->lock); +return voltage; }
@@ -291,6 +297,7 @@ static int __devinit jz_battery_probe(st jz_battery->pdev = pdev;init_completion (&jz_battery->read_completion); +mutex_init (&jz_battery->lock);INIT_DELAYED_WORK (&jz_battery->work, jz_battery_work);
PATCH 102/176 ds2760_battery: Fix calculation of time_to_empty_now
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Sven Neumann <[email protected]>
commit 86af95039b69a90db15294eb1f9c147f1df0a8ea upstream.
A check against division by zero was modified in commit b0525b48. Since this change time_to_empty_now is always reported as zero while the battery is discharging and as a negative value while the battery is charging. This is because current is negative while the battery is discharging.
Fix the check introduced by commit b0525b48 so that time_to_empty_now is reported correctly during discharge and as zero while charging.
--- drivers/power/ds2760_battery.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/power/ds2760_battery.c +1 -1
@@ -212,7 +212,7 @@ static int ds2760_battery_read_status(stif (di->rem_capacity >100 ) di->rem_capacity =100 ; -if (di->current_uA >=100L ) +if (di->current_uA <-100L ) di->life_sec = -((di->accum_current_uAh - di->empty_uAh) *36L ) / (di->current_uA /100L );else
PATCH 103/176 avr32: use syscall prototypes from asm-generic instead of arch
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Hans-Christian Egtvedt <[email protected]>
commit 664cb7142ced8b827e92e1851d1ed2cae922f225 upstream.
This patch removes the redundant syscalls prototypes in the architecture specific syscalls.h header file. These were identical with the ones in asm-generic/syscalls.h.
--- arch/avr32/include/asm/syscalls.h | 9 --------- 1 file changed, 9 deletions(-)
arch/avr32/include/asm/syscalls.h +0 -9
@@ -16,18 +16,9 @@#include <linux/signal.h> /* kernel/process.c */ -asmlinkage int sys_fork(struct pt_regs *); asmlinkage int sys_clone(unsigned long, unsigned long,unsigned long ,unsigned long ,struct pt_regs *); -asmlinkage int sys_vfork(struct pt_regs *); -asmlinkage int sys_execve(const char __user *, char __user *__user *, -char __user *__user *,struct pt_regs *); - -/* kernel/signal.c */ -asmlinkage int sys_sigaltstack(const stack_t __user *, stack_t __user *, -struct pt_regs *); -asmlinkage int sys_rt_sigreturn(struct pt_regs *);/* mm/cache.c */ asmlinkage int sys_cacheflush(int, void __user *, size_t);
PATCH 104/176 cpuidle: Make cpuidle_enable_device() call poll_idle_init()
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Rafael J. Wysocki <[email protected]>
commit d8c216cfa57e8a579f41729cbb88c97835d9ac8d upstream.
The following scenario is possible with the current cpuidle code and the ACPI cpuidle driver:
(1) acpi_processor_cst_has_changed() is called,
(2) cpuidle_disable_device() is called,
(3) cpuidle_remove_state_sysfs() is called to remove the (presumably outdated) states info from sysfs,
(3) acpi_processor_get_power_info() is called, the first entry in the
pr->power.states[] table is filled with zeros,
(4) acpi_processor_setup_cpuidle() is called and it doesn't fill the
first entry in pr->power.states[],(5) cpuidle_enable_device() is called,
(6) __cpuidle_register_device() is _not_ called, since the device has already been registered,
(7) Consequently, poll_idle_init() is _not_ called either,
(8) cpuidle_add_state_sysfs() is called to create the sysfs attributes for the new states and it uses the bogus first table entry from acpi_processor_get_power_info() for creating state0.
This problem is avoided if cpuidle_enable_device() unconditionally calls poll_idle_init().
--- drivers/cpuidle/cpuidle.c | 82 +++++++++++++++++++++++----------------------- 1 file changed, 41 insertions(+), 41 deletions(-)
drivers/cpuidle/cpuidle.c +41 -41
@@ -154,6 +154,45 @@ void cpuidle_resume_and_unlock(void)EXPORT_SYMBOL_GPL (cpuidle_resume_and_unlock); +#ifdef CONFIG_ARCH_HAS_CPU_RELAX +static int poll_idle (struct cpuidle_device *dev,struct cpuidle_state *st) +{ +ktime_t t1, t2; +s64 diff; +int ret; + + t1 =ktime_get (); +local_irq_enable (); +while (!need_resched ()) +cpu_relax (); + + t2 =ktime_get (); + diff =ktime_to_us (ktime_sub (t2, t1)); +if (diff >INT_MAX ) + diff =INT_MAX ; + + ret = (int ) diff; +return ret; +} + +static void poll_idle_init (struct cpuidle_device *dev) +{ +struct cpuidle_state *state = &dev->states[0 ]; + +cpuidle_set_statedata (state,NULL ); + +snprintf (state->name,CPUIDLE_NAME_LEN ,"C0" ); +snprintf (state->desc,CPUIDLE_DESC_LEN ,"CPUIDLE CORE POLL IDLE" ); + state->exit_latency =0 ; + state->target_residency =0 ; + state->power_usage =-1 ; + state->flags =CPUIDLE_FLAG_POLL ; + state->enter = poll_idle; +} +#else +static void poll_idle_init (struct cpuidle_device *dev) {} +#endif /* CONFIG_ARCH_HAS_CPU_RELAX */ +/** * cpuidle_enable_device - enables idle PM for a CPU * @dev: the CPU
@@ -178,6 +217,8 @@ int cpuidle_enable_device(struct cpuidlereturn ret; } +poll_idle_init (dev); +if ((ret =cpuidle_add_state_sysfs (dev)))return ret;
@@ -232,45 +273,6 @@ void cpuidle_disable_device(struct cpuidEXPORT_SYMBOL_GPL (cpuidle_disable_device); -#ifdef CONFIG_ARCH_HAS_CPU_RELAX -static int poll_idle (struct cpuidle_device *dev,struct cpuidle_state *st) -{ -ktime_t t1, t2; -s64 diff; -int ret; - - t1 =ktime_get (); -local_irq_enable (); -while (!need_resched ()) -cpu_relax (); - - t2 =ktime_get (); - diff =ktime_to_us (ktime_sub (t2, t1)); -if (diff >INT_MAX ) - diff =INT_MAX ; - - ret = (int ) diff; -return ret; -} - -static void poll_idle_init (struct cpuidle_device *dev) -{ -struct cpuidle_state *state = &dev->states[0 ]; - -cpuidle_set_statedata (state,NULL ); - -snprintf (state->name,CPUIDLE_NAME_LEN ,"C0" ); -snprintf (state->desc,CPUIDLE_DESC_LEN ,"CPUIDLE CORE POLL IDLE" ); - state->exit_latency =0 ; - state->target_residency =0 ; - state->power_usage =-1 ; - state->flags =CPUIDLE_FLAG_POLL ; - state->enter = poll_idle; -} -#else -static void poll_idle_init (struct cpuidle_device *dev) {} -#endif /* CONFIG_ARCH_HAS_CPU_RELAX */ -/** * __cpuidle_register_device - internal register function called before register * and enable routines
@@ -291,8 +293,6 @@ static int __cpuidle_register_device(strinit_completion (&dev->kobj_unregister); -poll_idle_init (dev); -/* * cpuidle driver should set the dev->power_specified bit * before registering the device if the driver provides
PATCH 105/176 p54: fix sequence no. accounting off-by-one error
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Christian Lamparter <[email protected]>
commit 3b5c5827d1f80ad8ae844a8b1183f59ddb90fe25 upstream.
P54_HDR_FLAG_DATA_OUT_SEQNR is meant to tell the
firmware that "the frame's sequence number has
already been set by the application."
Whereas IEEE80211_TX_CTL_ASSIGN_SEQ is set for
frames which lack a valid sequence number and
either the driver or firmware has to assign one.
Yup, it's the exact opposite!
--- drivers/net/wireless/p54/txrx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/p54/txrx.c +1 -1
@@ -618,7 +618,7 @@ static void p54_tx_80211_header(struct pelse *burst_possible = false; -if (info->flags &IEEE80211_TX_CTL_ASSIGN_SEQ ) +if (!(info->flags &IEEE80211_TX_CTL_ASSIGN_SEQ )) *flags |=P54_HDR_FLAG_DATA_OUT_SEQNR ;if (info->flags &IEEE80211_TX_CTL_PSPOLL_RESPONSE )
PATCH 106/176 i2c: Unregister dummy devices last on adapter removal
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Jean Delvare <[email protected]>
commit 5219bf884b6e2b54e734ca1799b6f0014bb2b4b7 upstream.
Remove real devices first and dummy devices last. This gives device driver which instantiated dummy devices themselves a chance to clean them up before we do.
--- drivers/i2c/i2c-core.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-)
drivers/i2c/i2c-core.c +13 -1
@@ -1005,6 +1005,14 @@ static int i2c_do_del_adapter(struct i2cstatic int __unregister_client (struct device *dev,void *dummy) {struct i2c_client *client =i2c_verify_client (dev); +if (client &&strcmp (client->name,"dummy" )) +i2c_unregister_device (client); +return 0 ; +} + +static int __unregister_dummy (struct device *dev,void *dummy) +{ +struct i2c_client *client =i2c_verify_client (dev);if (client)i2c_unregister_device (client);return 0 ;
@@ -1059,8 +1067,12 @@ int i2c_del_adapter(struct i2c_adapter *mutex_unlock (&adap->userspace_clients_lock);/* Detach any active clients. This can't fail, thus we do not -checking the returned value. */ +* check the returned value. This is a two-pass process, because +* we can't remove the dummy devices during the first pass: they +* could have been instantiated by real devices wishing to clean +* them up properly, so we give them a chance to do that first. */ res =device_for_each_child (&adap->dev,NULL , __unregister_client); + res =device_for_each_child (&adap->dev,NULL , __unregister_dummy);#ifdef CONFIG_I2C_COMPAT class_compat_remove_link(i2c_adapter_compat_class, &adap->dev,
PATCH 107/176 ASoC: Handle low measured DC offsets for wm_hubs devices
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Mark Brown <[email protected]>
commit 20a4e7fc7e213365ea3771d7bf1e10a6bab853be upstream.
The DC servo codes are actually signed numbers so need to be treated as such.
--- sound/soc/codecs/wm_hubs.c | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-)
sound/soc/codecs/wm_hubs.c +7 -8
@@ -92,6 +92,7 @@ static void wait_for_dc_servo(struct sndstatic void calibrate_dc_servo (struct snd_soc_codec *codec) {struct wm_hubs_data *hubs =snd_soc_codec_get_drvdata (codec); +s8 offset;u16 reg, reg_l, reg_r, dcs_cfg;/* Set for 32 series updates */
@@ -130,16 +131,14 @@ static void calibrate_dc_servo(struct sndev_dbg (codec->dev,"DCS input: %x %x\n" , reg_l, reg_r);/* HPOUT1L */ -if (reg_l + hubs->dcs_codes >0 && - reg_l + hubs->dcs_codes <0xff ) - reg_l += hubs->dcs_codes; - dcs_cfg = reg_l <<WM8993_DCS_DAC_WR_VAL_1_SHIFT ; + offset = reg_l; + offset += hubs->dcs_codes; + dcs_cfg = (u8 )offset <<WM8993_DCS_DAC_WR_VAL_1_SHIFT ;/* HPOUT1R */ -if (reg_r + hubs->dcs_codes >0 && - reg_r + hubs->dcs_codes <0xff ) - reg_r += hubs->dcs_codes; - dcs_cfg |= reg_r; + offset = reg_r; + offset += hubs->dcs_codes; + dcs_cfg |= (u8 )offset;dev_dbg (codec->dev,"DCS result: %x\n" , dcs_cfg);
PATCH 108/176 ASoC: WM8994: fix wrong value in tristate function
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Qiao Zhou <[email protected]>
commit 78b3fb46753872fc79bffecc8d50355a8622b39b upstream.
fix wrong value in wm8994_set_tristate func. when updating reg bits, it should use "value", not "reg".
--- sound/soc/codecs/wm8994.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/codecs/wm8994.c +1 -1
@@ -3486,7 +3486,7 @@ static int wm8994_set_tristate(struct snelse val =0 ; -return snd_soc_update_bits (codec, reg, mask, reg); +return snd_soc_update_bits (codec, reg, mask, val); }#define WM8994_RATES SNDRV_PCM_RATE_8000_96000
PATCH 109/176 ASoC: Create an AIF1ADCDAT signal widget to match AIF2
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Mark Brown <[email protected]>
commit 7f94de483f4e37e14d646ad6e85a3c82f66fb487 upstream.
Due to the different routing for AIF1 and AIF2 we weren't using a single widget to represent the ADCDAT signal. For consistency add one.
--- sound/soc/codecs/wm8994.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-)
sound/soc/codecs/wm8994.c +10 -4
@@ -2519,18 +2519,18 @@ SND_SOC_DAPM_SUPPLY("DSPINTCLK", WM8994_SND_SOC_DAPM_SUPPLY ("AIF1CLK" ,WM8994_AIF1_CLOCKING_1 ,0 ,0 ,NULL ,0 ),SND_SOC_DAPM_SUPPLY ("AIF2CLK" ,WM8994_AIF2_CLOCKING_1 ,0 ,0 ,NULL ,0 ), -SND_SOC_DAPM_AIF_OUT ("AIF1ADC1L" ,"AIF1 Capture" , +SND_SOC_DAPM_AIF_OUT ("AIF1ADC1L" ,NULL ,0 ,WM8994_POWER_MANAGEMENT_4 ,9 ,0 ), -SND_SOC_DAPM_AIF_OUT ("AIF1ADC1R" ,"AIF1 Capture" , +SND_SOC_DAPM_AIF_OUT ("AIF1ADC1R" ,NULL ,0 ,WM8994_POWER_MANAGEMENT_4 ,8 ,0 ),SND_SOC_DAPM_AIF_IN ("AIF1DAC1L" ,NULL ,0 ,WM8994_POWER_MANAGEMENT_5 ,9 ,0 ),SND_SOC_DAPM_AIF_IN ("AIF1DAC1R" ,NULL ,0 ,WM8994_POWER_MANAGEMENT_5 ,8 ,0 ), -SND_SOC_DAPM_AIF_OUT ("AIF1ADC2L" ,"AIF1 Capture" , +SND_SOC_DAPM_AIF_OUT ("AIF1ADC2L" ,NULL ,0 ,WM8994_POWER_MANAGEMENT_4 ,11 ,0 ), -SND_SOC_DAPM_AIF_OUT ("AIF1ADC2R" ,"AIF1 Capture" , +SND_SOC_DAPM_AIF_OUT ("AIF1ADC2R" ,NULL ,0 ,WM8994_POWER_MANAGEMENT_4 ,10 ,0 ),SND_SOC_DAPM_AIF_IN ("AIF1DAC2L" ,NULL ,0 , WM8994_POWER_MANAGEMENT_5, 11, 0),
@@ -2571,6 +2571,7 @@ SND_SOC_DAPM_AIF_IN("AIF2DACR", NULL, 0,SND_SOC_DAPM_AIF_IN ("AIF1DACDAT" ,"AIF1 Playback" ,0 ,SND_SOC_NOPM ,0 ,0 ),SND_SOC_DAPM_AIF_IN ("AIF2DACDAT" ,"AIF2 Playback" ,0 ,SND_SOC_NOPM ,0 ,0 ), +SND_SOC_DAPM_AIF_OUT ("AIF1ADCDAT" ,"AIF1 Capture" ,0 ,SND_SOC_NOPM ,0 ,0 ),SND_SOC_DAPM_AIF_OUT ("AIF2ADCDAT" ,"AIF2 Capture" ,0 ,SND_SOC_NOPM ,0 ,0 ), SND_SOC_DAPM_MUX("AIF1DAC Mux", SND_SOC_NOPM, 0, 0, &aif1dac_mux),
@@ -2766,6 +2767,11 @@ static const struct snd_soc_dapm_route i { "AIF2DAC2R Mixer", "Left Sidetone Switch", "Left Sidetone" }, { "AIF2DAC2R Mixer", "Right Sidetone Switch", "Right Sidetone" }, + { "AIF1ADCDAT", NULL, "AIF1ADC1L" }, + { "AIF1ADCDAT", NULL, "AIF1ADC1R" }, + { "AIF1ADCDAT", NULL, "AIF1ADC2L" }, + { "AIF1ADCDAT", NULL, "AIF1ADC2R" }, + { "AIF2ADCDAT", NULL, "AIF2ADC Mux" }, /* AIF3 output */
PATCH 110/176 virtio_net: Add schedule check to napi_enable call
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Bruce Rogers <[email protected]>
commit 3e9d08ec0a68f6faf718d5a7e050fe5ca0ba004f upstream.
Under harsh testing conditions, including low memory, the guest would stop receiving packets. With this patch applied we no longer see any problems in the driver while performing these tests for extended periods of time.
Make sure napi is scheduled subsequent to each napi_enable.
--- drivers/net/virtio_net.c | 27 ++++++++++++++++----------- 1 file changed, 16 insertions(+), 11 deletions(-)
drivers/net/virtio_net.c +16 -11
@@ -446,6 +446,20 @@ static void skb_recv_done(struct virtque } } +static void virtnet_napi_enable (struct virtnet_info *vi) +{ +napi_enable (&vi->napi); + +/* If all buffers were filled by other side before we napi_enabled, we +* won't get another interrupt, so process any outstanding packets +* now. virtnet_poll wants re-enable the queue, so we disable here. +* We synchronize against interrupts via NAPI_STATE_SCHED */ +if (napi_schedule_prep (&vi->napi)) { +virtqueue_disable_cb (vi->rvq); +__napi_schedule (&vi->napi); + } +} +static void refill_work (struct work_struct *work) {struct virtnet_info *vi;
@@ -454,7 +468,7 @@ static void refill_work(struct work_stru vi = container_of(work, struct virtnet_info, refill.work);napi_disable (&vi->napi); still_empty = !try_fill_recv (vi,GFP_KERNEL ); -napi_enable (&vi->napi); +virtnet_napi_enable (vi);/* In theory, this can happen: if we don't get any buffers in * we will *never* try to fill again. */
@@ -638,16 +652,7 @@ static int virtnet_open(struct net_devic {struct virtnet_info *vi =netdev_priv (dev); -napi_enable (&vi->napi); - -/* If all buffers were filled by other side before we napi_enabled, we -* won't get another interrupt, so process any outstanding packets -* now. virtnet_poll wants re-enable the queue, so we disable here. -* We synchronize against interrupts via NAPI_STATE_SCHED */ -if (napi_schedule_prep (&vi->napi)) { -virtqueue_disable_cb (vi->rvq); -__napi_schedule (&vi->napi); - } +virtnet_napi_enable (vi);return 0 ; }
PATCH 111/176 virtio: console: Wake up outvq on host notifications
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Amit Shah <[email protected]>
commit 2770c5ea501be69989a7acf54ec4cb3554c47191 upstream.
The outvq needs to be woken up on host notifications so that buffers consumed by the host can be reclaimed, outvq freed, and application writes may proceed again.
The need for this is now finally noticed when I have qemu patches ready to use nonblocking IO and flow control.
--- drivers/char/virtio_console.c | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-)
drivers/char/virtio_console.c +13 -2
@@ -1314,6 +1314,17 @@ static void control_work_handler(structspin_unlock (&portdev->cvq_lock); } +static void out_intr (struct virtqueue *vq) +{ +struct port *port; + + port =find_port_by_vq (vq->vdev->priv, vq); +if (!port) +return ; + +wake_up_interruptible (&port->waitqueue); +} +static void in_intr (struct virtqueue *vq) {struct port *port;
@@ -1430,7 +1441,7 @@ static int init_vqs(struct ports_device*/ j =0 ; io_callbacks[j] = in_intr; - io_callbacks[j +1 ] =NULL ; + io_callbacks[j +1 ] = out_intr; io_names[j] ="input" ; io_names[j +1 ] ="output" ; j +=2 ;
@@ -1444,7 +1455,7 @@ static int init_vqs(struct ports_devicefor (i =1 ; i < nr_ports; i++) { j +=2 ; io_callbacks[j] = in_intr; - io_callbacks[j +1 ] =NULL ; + io_callbacks[j +1 ] = out_intr; io_names[j] ="input" ; io_names[j +1 ] ="output" ; }
PATCH 112/176 drivers: update to pl2303 usb-serial to support Motorola cables
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Dario Lombardo <[email protected]>
commit 96a3e79edff6f41b0f115a82f1a39d66218077a7 upstream.
Added 0x0307 device id to support Motorola cables to the pl2303 usb serial driver. This cable has a modified chip that is a pl2303, but declares itself as 0307. Fixed by adding the right device id to the supported devices list, assigning it the code labeled PL2303_PRODUCT_ID_MOTOROLA.
--- drivers/usb/serial/pl2303.c | 1 + drivers/usb/serial/pl2303.h | 1 + 2 files changed, 2 insertions(+)
drivers/usb/serial/pl2303.c +1 -0
@@ -50,6 +50,7 @@ static const struct usb_device_id id_tab { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_MMX) }, { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_GPRS) }, { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_HCR331) }, + { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_MOTOROLA) }, { USB_DEVICE(IODATA_VENDOR_ID, IODATA_PRODUCT_ID) }, { USB_DEVICE(IODATA_VENDOR_ID, IODATA_PRODUCT_ID_RSAQ5) }, { USB_DEVICE(ATEN_VENDOR_ID, ATEN_PRODUCT_ID) },
drivers/usb/serial/pl2303.h +1 -0
@@ -21,6 +21,7 @@#define PL2303_PRODUCT_ID_MMX 0x0612#define PL2303_PRODUCT_ID_GPRS 0x0609#define PL2303_PRODUCT_ID_HCR331 0x331a +#define PL2303_PRODUCT_ID_MOTOROLA 0x0307#define ATEN_VENDOR_ID 0x0557#define ATEN_VENDOR_ID2 0x0547
PATCH 113/176 serial: unbreak billionton CF card
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Pavel Machek <[email protected]>
commit d0694e2aeb815042aa0f3e5036728b3db4446f1d upstream.
Unbreak Billionton CF bluetooth card. This actually fixes a regression on zaurus.
--- drivers/serial/8250.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/serial/8250.c +2 -1
@@ -241,7 +241,8 @@ static const struct serial8250_config ua .fifo_size = 128, .tx_loadsz = 128, .fcr = UART_FCR_ENABLE_FIFO | UART_FCR_R_TRIG_10, - .flags = UART_CAP_FIFO | UART_CAP_EFR | UART_CAP_SLEEP, +/* UART_CAP_EFR breaks billionon CF bluetooth card. */ + .flags = UART_CAP_FIFO | UART_CAP_SLEEP, }, [PORT_16654] = { .name = "ST16654",
PATCH 114/176 ptrace: use safer wake up on ptrace_detach()
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Tejun Heo <[email protected]>
commit 01e05e9a90b8f4c3997ae0537e87720eb475e532 upstream.
The wake_up_process() call in ptrace_detach() is spurious and not interlocked with the tracee state. IOW, the tracee could be running or sleeping in any place in the kernel by the time wake_up_process() is called. This can lead to the tracee waking up unexpectedly which can be dangerous.
The wake_up is spurious and should be removed but for now reduce its toxicity by only waking up if the tracee is in TRACED or STOPPED state.
This bug can possibly be used as an attack vector. I don't think it will take too much effort to come up with an attack which triggers oops somewhere. Most sleeps are wrapped in condition test loops and should be safe but we have quite a number of places where sleep and wakeup conditions are expected to be interlocked. Although the window of opportunity is tiny, ptrace can be used by non-privileged users and with some loading the window can definitely be extended and exploited.
--- kernel/ptrace.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/ptrace.c +1 -1
@@ -313,7 +313,7 @@ int ptrace_detach(struct task_struct *ch child->exit_code = data; dead =__ptrace_detach (current, child);if (!child->exit_state) -wake_up_process (child); +wake_up_state (child,TASK_TRACED |TASK_STOPPED ); }write_unlock_irq (&tasklist_lock);
PATCH 115/176 net: Fix ip link add netns oops
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Eric W. Biederman <[email protected]>
commit 13ad17745c2cbd437d9e24b2d97393e0be11c439 upstream.
Quoted 53 lines · Ed Swierk
On 2.6.35.7
ip link add link eth0 netns 9999 type macvlan
where 9999 is a nonexistent PID triggers an oops and causes all network functions to hang:[10663.821898] BUG: unable to handle kernel NULL pointer dereference at 000000000000006d [10663.821917] IP: [<ffffffff8149c2fa>] __dev_alloc_name+0x9a/0x170 [10663.821933] PGD 1d3927067 PUD 22f5c5067 PMD 0 [10663.821944] Oops: 0000 [#1] SMP [10663.821953] last sysfs file: /sys/devices/system/cpu/cpu0/cpufreq/scaling_cur_freq [10663.821959] CPU 3 [10663.821963] Modules linked in: macvlan ip6table_filter ip6_tables rfcomm ipt_MASQUERADE binfmt_misc iptable_nat nf_nat nf_conntrack_ipv4 nf_defrag_ipv4 xt_state nf_conntrack sco ipt_REJECT bnep l2cap xt_tcpudp iptable_filter ip_tables x_tables bridge stp vboxnetadp vboxnetflt vboxdrv kvm_intel kvm parport_pc ppdev snd_hda_codec_intelhdmi snd_hda_codec_conexant arc4 iwlagn iwlcore mac80211 snd_hda_intel snd_hda_codec snd_hwdep snd_pcm snd_seq_midi snd_rawmidi i915 snd_seq_midi_event snd_seq thinkpad_acpi drm_kms_helper btusb tpm_tis nvram uvcvideo snd_timer snd_seq_device bluetooth videodev v4l1_compat v4l2_compat_ioctl32 tpm drm tpm_bios snd cfg80211 psmouse serio_raw intel_ips soundcore snd_page_alloc intel_agp i2c_algo_bit video output netconsole configfs lp parport usbhid hid e1000e sdhci_pci ahci libahci sdhci led_class [10663.822155] [10663.822161] Pid: 6000, comm: ip Not tainted 2.6.35-23-generic #41-Ubuntu 2901CTO/2901CTO [10663.822167] RIP: 0010:[<ffffffff8149c2fa>] [<ffffffff8149c2fa>] __dev_alloc_name+0x9a/0x170 [10663.822177] RSP: 0018:ffff88014aebf7b8 EFLAGS: 00010286 [10663.822182] RAX: 00000000fffffff4 RBX: ffff8801ad900800 RCX: 0000000000000000 [10663.822187] RDX: ffff880000000000 RSI: 0000000000000000 RDI: ffff88014ad63000 [10663.822191] RBP: ffff88014aebf808 R08: 0000000000000041 R09: 0000000000000041 [10663.822196] R10: 0000000000000000 R11: dead000000200200 R12: ffff88014aebf818 [10663.822201] R13: fffffffffffffffd R14: ffff88014aebf918 R15: ffff88014ad62000 [10663.822207] FS: 00007f00c487f700(0000) GS:ffff880001f80000(0000) knlGS:0000000000000000 [10663.822212] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [10663.822216] CR2: 000000000000006d CR3: 0000000231f19000 CR4: 00000000000026e0 [10663.822221] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [10663.822226] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [10663.822231] Process ip (pid: 6000, threadinfo ffff88014aebe000, task ffff88014afb16e0) [10663.822236] Stack: [10663.822240] ffff88014aebf808 ffffffff814a2bb5 ffff88014aebf7e8 00000000a00ee8d6 [10663.822251] <0> 0000000000000000 ffffffffa00ef940 ffff8801ad900800 ffff88014aebf818 [10663.822265] <0> ffff88014aebf918 ffff8801ad900800 ffff88014aebf858 ffffffff8149c413 [10663.822281] Call Trace: [10663.822290] [<ffffffff814a2bb5>] ? dev_addr_init+0x75/0xb0 [10663.822298] [<ffffffff8149c413>] dev_alloc_name+0x43/0x90 [10663.822307] [<ffffffff814a85ee>] rtnl_create_link+0xbe/0x1b0 [10663.822314] [<ffffffff814ab2aa>] rtnl_newlink+0x48a/0x570 [10663.822321] [<ffffffff814aafcc>] ? rtnl_newlink+0x1ac/0x570 [10663.822332] [<ffffffff81030064>] ? native_x2apic_icr_read+0x4/0x20 [10663.822339] [<ffffffff814a8c17>] rtnetlink_rcv_msg+0x177/0x290 [10663.822346] [<ffffffff814a8aa0>] ? rtnetlink_rcv_msg+0x0/0x290 [10663.822354] [<ffffffff814c25d9>] netlink_rcv_skb+0xa9/0xd0 [10663.822360] [<ffffffff814a8a85>] rtnetlink_rcv+0x25/0x40 [10663.822367] [<ffffffff814c223e>] netlink_unicast+0x2de/0x2f0 [10663.822374] [<ffffffff814c303e>] netlink_sendmsg+0x1fe/0x2e0 [10663.822383] [<ffffffff81488533>] sock_sendmsg+0xf3/0x120 [10663.822391] [<ffffffff815899fe>] ? _raw_spin_lock+0xe/0x20 [10663.822400] [<ffffffff81168656>] ? __d_lookup+0x136/0x150 [10663.822406] [<ffffffff815899fe>] ? _raw_spin_lock+0xe/0x20 [10663.822414] [<ffffffff812b7a0d>] ? _atomic_dec_and_lock+0x4d/0x80 [10663.822422] [<ffffffff8116ea90>] ? mntput_no_expire+0x30/0x110 [10663.822429] [<ffffffff81486ff5>] ? move_addr_to_kernel+0x65/0x70 [10663.822435] [<ffffffff81493308>] ? verify_iovec+0x88/0xe0 [10663.822442] [<ffffffff81489020>] sys_sendmsg+0x240/0x3a0 [10663.822450] [<ffffffff8111e2a9>] ? __do_fault+0x479/0x560 [10663.822457] [<ffffffff815899fe>] ? _raw_spin_lock+0xe/0x20
Quoted 8 lines
[10663.822465] [<ffffffff8116cf4a>] ? alloc_fd+0x10a/0x150 [10663.822473] [<ffffffff8158d76e>] ? do_page_fault+0x15e/0x350 [10663.822482] [<ffffffff8100a0f2>] system_call_fastpath+0x16/0x1b [10663.822487] Code: 90 48 8d 78 02 be 25 00 00 00 e8 92 1d e2 ff 48 85 c0 75 cf bf 20 00 00 00 e8 c3 b1 c6 ff 49 89 c7 b8 f4 ff ff ff 4d 85 ff 74 bd <4d> 8b 75 70 49 8d 45 70 48 89 45 b8 49 83 ee 58 eb 28 48 8d 55 [10663.822618] RIP [<ffffffff8149c2fa>] __dev_alloc_name+0x9a/0x170 [10663.822627] RSP <ffff88014aebf7b8> [10663.822631] CR2: 000000000000006d [10663.822636] ---[ end trace 3dfd6c3ad5327ca7 ]---
This bug was introduced in:
commit 81adee47dfb608df3ad0b91d230fb3cef75f0060
Author: Eric W. Biederman <[email protected]> Date: Sun Nov 8 00:53:51 2009 -0800
net: Support specifying the network namespace upon device creation.
There is no good reason to not support userspace specifying the network namespace during device creation, and it makes it easier to create a network device and pass it to a child network namespace with a well known name.
We have to be careful to ensure that the target network namespace for the new device exists through the life of the call. To keep that logic clear I have factored out the network namespace grabbing logic into rtnl_link_get_net.
In addtion we need to continue to pass the source network namespace to the rtnl_link_ops.newlink method so that we can find the base device source network namespace.
Where apparently I forgot to add error handling to the path where we create a new network device in a new network namespace, and pass in an invalid pid.
--- net/core/rtnetlink.c | 3 +++ 1 file changed, 3 insertions(+)
net/core/rtnetlink.c +3 -0
@@ -1546,6 +1546,9 @@ replay:snprintf (ifname,IFNAMSIZ ,"%s%%d" , ops->kind); dest_net =rtnl_link_get_net (net, tb); +if (IS_ERR (dest_net)) +return PTR_ERR (dest_net); + dev =rtnl_create_link (net, dest_net, ifname, ops, tb);if (IS_ERR (dev))
PATCH 116/176 x86, mtrr: Avoid MTRR reprogramming on BP during boot on UP platforms
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Suresh Siddha <[email protected]>
commit f7448548a9f32db38f243ccd4271617758ddfe2c upstream.
Markus Kohn ran into a hard hang regression on an acer aspire 1310, when acpi is enabled. git bisect showed the following commit as the bad one that introduced the boot regression.
commit d0af9eed5aa91b6b7b5049cae69e5ea956fd85c3 Author: Suresh Siddha <[email protected]> Date: Wed Aug 19 18:05:36 2009 -0700 x86, pat/mtrr: Rendezvous all the cpus for MTRR/PAT init
Because of the UP configuration of that platform, native_smp_prepare_cpus() bailed out (in smp_sanity_check()) before doing the set_mtrr_aps_delayed_init()
Further down the boot path, native_smp_cpus_done() will call the delayed MTRR initialization for the AP's (mtrr_aps_init()) with mtrr_aps_delayed_init not set. This resulted in the boot processor reprogramming its MTRR's to the values seen during the start of the OS boot. While this is not needed ideally, this shouldn't have caused any side-effects. This is because the reprogramming of MTRR's (set_mtrr_state() that gets called via set_mtrr()) will check if the live register contents are different from what is being asked to write and will do the actual write only if they are different.
BP's mtrr state is read during the start of the OS boot and typically nothing would have changed when we ask to reprogram it on BP again because of the above scenario on an UP platform. So on a normal UP platform no reprogramming of BP MTRR MSR's happens and all is well.
However, on this platform, bios seems to be modifying the fixed mtrr range registers between the start of OS boot and when we double check the live registers for reprogramming BP MTRR registers. And as the live registers are modified, we end up reprogramming the MTRR's to the state seen during the start of the OS boot.
During ACPI initialization, something in the bios (probably smi handler?) don't like this fact and results in a hard lockup.
We didn't see this boot hang issue on this platform before the commit d0af9eed5aa91b6b7b5049cae69e5ea956fd85c3, because only the AP's (if any) will program its MTRR's to the value that BP had at the start of the OS boot.
Fix this issue by checking mtrr_aps_delayed_init before continuing further in the mtrr_aps_init(). Now, only AP's (if any) will program its MTRR's to the BP values during boot.
Addresses https://bugzilla.novell.com/show_bug.cgi?id=623393
[ By the way, this behavior of the bios modifying MTRR's after the start
of the OS boot is not common and the kernel is not prepared to handle this situation well. Irrespective of this issue, during suspend/resume, linux kernel will try to reprogram the BP's MTRR values to the values seen during the start of the OS boot. So suspend/resume might be already broken on this platform for all linux kernel versions. ]
LKML-Reference: <[email protected]>
--- arch/x86/kernel/cpu/mtrr/main.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
arch/x86/kernel/cpu/mtrr/main.c +9 -1
@@ -793,13 +793,21 @@ void set_mtrr_aps_delayed_init(void) }/* -* MTRR initialization for all AP's +* Delayed MTRR initialization for all AP's */ void mtrr_aps_init (void ) {if (!use_intel ())return ; +/* +* Check if someone has requested the delay of AP MTRR initialization, +* by doing set_mtrr_aps_delayed_init(), prior to this point. If not, +* then we are done. +*/ +if (!mtrr_aps_delayed_init) +return ; +set_mtrr (~0U ,0 ,0 ,0 ); mtrr_aps_delayed_init = false; }
PATCH 117/176 fix jiffy calculations in calibrate_delay_direct to handle overflow
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Tim Deegan <[email protected]>
commit 70a062286b9dfcbd24d2e11601aecfead5cf709a upstream.
Fixes a hang when booting as dom0 under Xen, when jiffies can be quite large by the time the kernel init gets this far.
--- init/calibrate.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
init/calibrate.c +3 -3
@@ -66,7 +66,7 @@ static unsigned long __cpuinit calibrate pre_start =0 ;read_current_timer (&start); start_jiffies = jiffies; -while (jiffies <= (start_jiffies +1 )) { +while (time_before_eq (jiffies, start_jiffies +1 )) { pre_start = start;read_current_timer (&start); }
@@ -74,8 +74,8 @@ static unsigned long __cpuinit calibrate pre_end =0 ; end = post_start; -while (jiffies <= - (start_jiffies +1 +DELAY_CALIBRATION_TICKS )) { +while (time_before_eq (jiffies, start_jiffies +1 + +DELAY_CALIBRATION_TICKS )) { pre_end = end;read_current_timer (&end); }
PATCH 118/176 ixgbe: fix for 82599 erratum on Header Splitting
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Don Skidmore <[email protected]>
commit a124339ad28389093ed15eca990d39c51c5736cc upstream.
We have found a hardware erratum on 82599 hardware that can lead to unpredictable behavior when Header Splitting mode is enabled. So we are no longer enabling this feature on affected hardware.
Please see the 82599 Specification Update for more information.
--- drivers/net/ixgbe/ixgbe_main.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)
drivers/net/ixgbe/ixgbe_main.c +9 -2
@@ -2651,9 +2651,16 @@ static void ixgbe_configure_rx(struct ixint rx_buf_len;/* Decide whether to use packet split mode or not */ +/* On by default */ + adapter->flags |=IXGBE_FLAG_RX_PS_ENABLED ; +/* Do not use packet split if we're in SR-IOV Mode */ -if (!adapter->num_vfs) - adapter->flags |=IXGBE_FLAG_RX_PS_ENABLED ; +if (adapter->num_vfs) + adapter->flags &= ~IXGBE_FLAG_RX_PS_ENABLED ; + +/* Disable packet split due to 82599 erratum #45 */ +if (hw->mac.type == ixgbe_mac_82599EB) + adapter->flags &= ~IXGBE_FLAG_RX_PS_ENABLED ;/* Set the RX buffer length according to the mode */ if (adapter->flags &IXGBE_FLAG_RX_PS_ENABLED ) {
PATCH 119/176 Fix prlimit64 for suid/sgid processes
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Kacper Kornet <[email protected]>
commit aa5bd67dcfdf9af34c7fa36ebc87d4e1f7e91873 upstream.
Since check_prlimit_permission always fails in the case of SUID/GUID processes, such processes are not able to read or set their own limits. This commit changes this by assuming that process can always read/change its own limits.
--- kernel/sys.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
kernel/sys.c +2 -1
@@ -1377,7 +1377,8 @@ static int check_prlimit_permission(struconst struct cred *cred =current_cred (), *tcred; tcred =__task_cred (task); - if ((cred->uid != tcred->euid || + if (current != task && + (cred->uid != tcred->euid || cred->uid != tcred->suid || cred->uid != tcred->uid || cred->gid != tcred->egid ||
PATCH 120/176 ARM: initrd: disable initrd if passed address overlaps reserved region
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Russell King <[email protected]>
commit b0a2679d27408d97ce31e5f800b44227d3388b84 upstream.
Disable the initrd if the passed address already overlaps the reserved region. This avoids oopses on Netwinders when NeTTrom tells the kernel that an initrd is located at mem+4MB, but this overlaps the BSS, resulting in the kernels in-use BSS being freed.
This should be applied to v2.6.37-stable.
--- arch/arm/mm/init.c | 6 ++++++ 1 file changed, 6 insertions(+)
arch/arm/mm/init.c +6 -0
@@ -282,6 +282,12 @@ void __init arm_memblock_init(struct memmemblock_reserve (__pa (_stext), _end - _stext);#endif #ifdef CONFIG_BLK_DEV_INITRD +if (phys_initrd_size && +memblock_is_region_reserved (phys_initrd_start, phys_initrd_size)) { +pr_err ("INITRD: 0x%08lx+0x%08lx overlaps in-use memory region - disabling initrd\n" , + phys_initrd_start, phys_initrd_size); + phys_initrd_start = phys_initrd_size =0 ; + }if (phys_initrd_size) {memblock_reserve (phys_initrd_start, phys_initrd_size);
PATCH 121/176 memcg: fix account leak at failure of memsw acconting
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: KAMEZAWA Hiroyuki <[email protected]>
commit 01c88e2d6b7330c0cc5867fe2297e7d826e1337d upstream.
Commit 4b53433468 ("memcg: clean up try_charge main loop") removes a cancel of charge at case: memory charge-> success. mem+swap charge-> failure.
This leaks usage of memory. Fix it.
--- mm/memcontrol.c | 1 + 1 file changed, 1 insertion(+)
mm/memcontrol.c +1 -0
@@ -1647,6 +1647,7 @@ static int __mem_cgroup_do_charge(structif (likely (!ret))return CHARGE_OK ; +res_counter_uncharge (&mem->res, csize); mem_over_limit =mem_cgroup_from_res_counter (fail_res, memsw); flags |=MEM_CGROUP_RECLAIM_NOSWAP ; }else
PATCH 122/176 mmc: bfin_sdh: fix alloc size for private data
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Sonic Zhang <[email protected]>
commit a34650f0f1ca589cda09c48cb62baf15e680a247 upstream.
The bfin_sdh driver allocates the wrong size for the private data in the mmc_host. The first parameter of mmc_alloc_host should be the size of the local driver struct rather than the common mmc_host.
--- drivers/mmc/host/bfin_sdh.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/mmc/host/bfin_sdh.c +1 -1
@@ -462,7 +462,7 @@ static int __devinit sdh_probe(struct pl goto out; } - mmc =mmc_alloc_host (sizeof (*mmc), &pdev->dev); + mmc =mmc_alloc_host (sizeof (struct sdh_host ), &pdev->dev);if (!mmc) { ret = -ENOMEM ; goto out;
PATCH 123/176 mm: page allocator: adjust the per-cpu counter threshold when memory is low
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Mel Gorman <[email protected]>
commit 88f5acf88ae6a9778f6d25d0d5d7ec2d57764a97 upstream.
Commit aa45484 ("calculate a better estimate of NR_FREE_PAGES when memory is low") noted that watermarks were based on the vmstat NR_FREE_PAGES. To avoid synchronization overhead, these counters are maintained on a per-cpu basis and drained both periodically and when a threshold is above a threshold. On large CPU systems, the difference between the estimate and real value of NR_FREE_PAGES can be very high. The system can get into a case where pages are allocated far below the min watermark potentially causing livelock issues. The commit solved the problem by taking a better reading of NR_FREE_PAGES when memory was low.
Unfortately, as reported by Shaohua Li this accurate reading can consume a large amount of CPU time on systems with many sockets due to cache line bouncing. This patch takes a different approach. For large machines where counter drift might be unsafe and while kswapd is awake, the per-cpu thresholds for the target pgdat are reduced to limit the level of drift to what should be a safe level. This incurs a performance penalty in heavy memory pressure by a factor that depends on the workload and the machine but the machine should function correctly without accidentally exhausting all memory on a node. There is an additional cost when kswapd wakes and sleeps but the event is not expected to be frequent - in Shaohua's test case, there was one recorded sleep and wake event at least.
To ensure that kswapd wakes up, a safe version of zone_watermark_ok() is introduced that takes a more accurate reading of NR_FREE_PAGES when called from wakeup_kswapd, when deciding whether it is really safe to go back to sleep in sleeping_prematurely() and when deciding if a zone is really balanced or not in balance_pgdat(). We are still using an expensive function but limiting how often it is called.
When the test case is reproduced, the time spent in the watermark functions is reduced. The following report is on the percentage of time spent cumulatively spent in the functions zone_nr_free_pages(), zone_watermark_ok(), __zone_watermark_ok(), zone_watermark_ok_safe(), zone_page_state_snapshot(), zone_page_state().
vanilla 11.6615%
disable-threshold 0.2584%
David said:
: We had to pull aa454840 "mm: page allocator: calculate a better estimate : of NR_FREE_PAGES when memory is low and kswapd is awake" from 2.6.36 : internally because tests showed that it would cause the machine to stall : as the result of heavy kswapd activity. I merged it back with this fix as : it is pending in the -mm tree and it solves the issue we were seeing, so I : definitely think this should be pushed to -stable (and I would seriously : consider it for 2.6.37 inclusion even at this late date).
--- include/linux/mmzone.h | 10 ++----- include/linux/vmstat.h | 5 +++ mm/mmzone.c | 21 --------------- mm/page_alloc.c | 35 +++++++++++++++++++------ mm/vmscan.c | 23 +++++++++------- mm/vmstat.c | 68 ++++++++++++++++++++++++++++++++++++++++++++++++- 6 files changed, 115 insertions(+), 47 deletions(-)
include/linux/mmzone.h +3 -7
@@ -448,12 +448,6 @@ static inline int zone_is_oom_locked(conreturn test_bit (ZONE_OOM_LOCKED , &zone->flags); } -#ifdef CONFIG_SMP -unsigned long zone_nr_free_pages (struct zone *zone); -#else -#define zone_nr_free_pages (zone) zone_page_state(zone, NR_FREE_PAGES) -#endif /* CONFIG_SMP */ -/* * The "priority" of VM scanning is how much of the queues we will scan in one * go. A value of 12 for DEF_PRIORITY implies that we will scan 1/4096th of the
@@ -651,7 +645,9 @@ typedef struct pglist_data {extern struct mutex zonelists_mutex;void build_all_zonelists (void *data);void wakeup_kswapd (struct zone *zone,int order); -int zone_watermark_ok (struct zone *z,int order,unsigned long mark, +bool zone_watermark_ok (struct zone *z,int order,unsigned long mark, +int classzone_idx,int alloc_flags); +bool zone_watermark_ok_safe (struct zone *z,int order,unsigned long mark,int classzone_idx,int alloc_flags);enum memmap_context {MEMMAP_EARLY ,
include/linux/vmstat.h +5 -0
@@ -254,6 +254,8 @@ extern void dec_zone_state(struct zone *extern void __dec_zone_state (struct zone *,enum zone_stat_item );void refresh_cpu_vm_stats (int ); +void reduce_pgdat_percpu_threshold (pg_data_t *pgdat); +void restore_pgdat_percpu_threshold (pg_data_t *pgdat);#else /* CONFIG_SMP */ /*
@@ -298,6 +300,9 @@ static inline void __dec_zone_page_state#define dec_zone_page_state __dec_zone_page_state#define mod_zone_page_state __mod_zone_page_state +static inline void reduce_pgdat_percpu_threshold (pg_data_t *pgdat) { } +static inline void restore_pgdat_percpu_threshold (pg_data_t *pgdat) { } +static inline void refresh_cpu_vm_stats (int cpu) { }#endif
mm/mmzone.c +0 -21
@@ -87,24 +87,3 @@ int memmap_valid_within(unsigned long pf return 1; }#endif /* CONFIG_ARCH_HAS_HOLES_MEMORYMODEL */ - -#ifdef CONFIG_SMP -/* Called when a more accurate view of NR_FREE_PAGES is needed */ -unsigned long zone_nr_free_pages (struct zone *zone) -{ -unsigned long nr_free_pages =zone_page_state (zone,NR_FREE_PAGES ); - -/* -* While kswapd is awake, it is considered the zone is under some -* memory pressure. Under pressure, there is a risk that -* per-cpu-counter-drift will allow the min watermark to be breached -* potentially causing a live-lock. While kswapd is awake and -* free pages are low, get a better estimate for free pages -*/ -if (nr_free_pages < zone->percpu_drift_mark && - !waitqueue_active (&zone->zone_pgdat->kswapd_wait)) -return zone_page_state_snapshot (zone,NR_FREE_PAGES ); - -return nr_free_pages; -} -#endif /* CONFIG_SMP */
mm/page_alloc.c +27 -8
@@ -1459,24 +1459,24 @@ static inline int should_fail_alloc_page#endif /* CONFIG_FAIL_PAGE_ALLOC */ /* -* Return 1 if free pages are above 'mark'. This takes into account the order +* Return true if free pages are above 'mark'. This takes into account the order * of the allocation. */ -int zone_watermark_ok (struct zone *z,int order,unsigned long mark, -int classzone_idx,int alloc_flags) +static bool __zone_watermark_ok (struct zone *z,int order,unsigned long mark, +int classzone_idx,int alloc_flags,long free_pages) {/* free_pages my go negative - that's OK */ long min = mark; -long free_pages =zone_nr_free_pages (z) - (1 << order) +1 ;int o; + free_pages -= (1 << order) +1 ;if (alloc_flags &ALLOC_HIGH ) min -= min /2 ;if (alloc_flags &ALLOC_HARDER ) min -= min /4 ;if (free_pages <= min + z->lowmem_reserve[classzone_idx]) -return 0 ; +return false;for (o =0 ; o < order; o++) {/* At the next order, this order's pages become unavailable */ free_pages -= z->free_area[o].nr_free << o;
@@ -1485,9 +1485,28 @@ int zone_watermark_ok(struct zone *z, in min >>=1 ;if (free_pages <= min) -return 0 ; +return false; } -return 1 ; +return true; +} + +bool zone_watermark_ok (struct zone *z,int order,unsigned long mark, +int classzone_idx,int alloc_flags) +{ +return __zone_watermark_ok (z, order, mark, classzone_idx, alloc_flags, +zone_page_state (z,NR_FREE_PAGES )); +} + +bool zone_watermark_ok_safe (struct zone *z,int order,unsigned long mark, +int classzone_idx,int alloc_flags) +{ +long free_pages =zone_page_state (z,NR_FREE_PAGES ); + +if (z->percpu_drift_mark && free_pages < z->percpu_drift_mark) + free_pages =zone_page_state_snapshot (z,NR_FREE_PAGES ); + +return __zone_watermark_ok (z, order, mark, classzone_idx, alloc_flags, + free_pages); }#ifdef CONFIG_NUMA
@@ -2441,7 +2460,7 @@ void show_free_areas(void)" all_unreclaimable? %s" "\n" , zone->name, -K (zone_nr_free_pages (zone)), +K (zone_page_state (zone,NR_FREE_PAGES )),K (min_wmark_pages (zone)),K (low_wmark_pages (zone)), K(high_wmark_pages(zone)),
mm/vmscan.c +13 -10
@@ -2082,7 +2082,7 @@ static int sleeping_prematurely(pg_data_if (zone->all_unreclaimable)continue ; -if (!zone_watermark_ok (zone, order,high_wmark_pages (zone), +if (!zone_watermark_ok_safe (zone, order,high_wmark_pages (zone),0 ,0 ))return 1 ; }
@@ -2169,7 +2169,7 @@ loop_again:shrink_active_list (SWAP_CLUSTER_MAX , zone, &sc, priority,0 ); -if (!zone_watermark_ok (zone, order, +if (!zone_watermark_ok_safe (zone, order,high_wmark_pages (zone),0 ,0 )) { end_zone = i;break ;
@@ -2215,7 +2215,7 @@ loop_again:* We put equal pressure on every zone, unless one * zone has way too many pages free already. */ -if (!zone_watermark_ok (zone, order, +if (!zone_watermark_ok_safe (zone, order,8 *high_wmark_pages (zone), end_zone,0 ))shrink_zone (priority, zone, &sc); reclaim_state->reclaimed_slab =0 ;
@@ -2236,7 +2236,7 @@ loop_again: total_scanned > sc.nr_reclaimed + sc.nr_reclaimed / 2) sc.may_writepage = 1; -if (!zone_watermark_ok (zone, order, +if (!zone_watermark_ok_safe (zone, order,high_wmark_pages (zone), end_zone,0 )) { all_zones_ok =0 ;/*
@@ -2244,7 +2244,7 @@ loop_again:* means that we have a GFP_ATOMIC allocation * failure risk. Hurry up! */ -if (!zone_watermark_ok (zone, order, +if (!zone_watermark_ok_safe (zone, order,min_wmark_pages (zone), end_zone,0 )) has_under_min_watermark_zone =1 ; }
@@ -2378,7 +2378,9 @@ static int kswapd(void *p)*/ if (!sleeping_prematurely (pgdat, order, remaining)) {trace_mm_vmscan_kswapd_sleep (pgdat->node_id); +restore_pgdat_percpu_threshold (pgdat);schedule (); +reduce_pgdat_percpu_threshold (pgdat); }else {if (remaining)count_vm_event (KSWAPD_LOW_WMARK_HIT_QUICKLY );
@@ -2417,16 +2419,17 @@ void wakeup_kswapd(struct zone *zone, inif (!populated_zone (zone))return ; - pgdat = zone->zone_pgdat; -if (zone_watermark_ok (zone, order,low_wmark_pages (zone),0 ,0 )) +if (!cpuset_zone_allowed_hardwall (zone,GFP_KERNEL ))return ; + pgdat = zone->zone_pgdat;if (pgdat->kswapd_max_order < order) pgdat->kswapd_max_order = order; -trace_mm_vmscan_wakeup_kswapd (pgdat->node_id,zone_idx (zone), order); -if (!cpuset_zone_allowed_hardwall (zone,GFP_KERNEL )) -return ;if (!waitqueue_active (&pgdat->kswapd_wait))return ; +if (zone_watermark_ok_safe (zone, order,low_wmark_pages (zone),0 ,0 )) +return ; + +trace_mm_vmscan_wakeup_kswapd (pgdat->node_id,zone_idx (zone), order);wake_up_interruptible (&pgdat->kswapd_wait); }
mm/vmstat.c +67 -1
86 lines not on this page · raw message
PATCH 124/176 klist: Fix object alignment on 64-bit.
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: David Miller <[email protected]>
commit 795abaf1e4e188c4171e3cd3dbb11a9fcacaf505 upstream.
Commit c0e69a5bbc6f ("klist.c: bit 0 in pointer can't be used as flag") intended to make sure that all klist objects were at least pointer size aligned, but used the constant "4" which only works on 32-bit.
Use "sizeof(void *)" which is correct in all cases.
--- include/linux/klist.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/linux/klist.h +1 -1
@@ -22,7 +22,7 @@ struct klist {struct list_head k_list;void (*get)(struct klist_node *);void (*put)(struct klist_node *); -} __attribute__ ((aligned (4))); +} __attribute__ ((aligned (sizeof(void *))));#define KLIST_INIT (_name, _get, _put) \ { .k_lock = __SPIN_LOCK_UNLOCKED(_name.k_lock), \
PATCH 125/176 cfq-iosched: Dont wait if queue already has requests.
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Justin TerAvest <[email protected]>
commit 02a8f01b5a9f396d0327977af4c232d0f94c45fd upstream.
Commit 7667aa0630407bc07dc38dcc79d29cc0a65553c1 added logic to wait for the last queue of the group to become busy (have at least one request), so that the group does not lose out for not being continuously backlogged. The commit did not check for the condition that the last queue already has some requests. As a result, if the queue already has requests, wait_busy is set. Later on, cfq_select_queue() checks the flag, and decides that since the queue has a request now and wait_busy is set, the queue is expired. This results in early expiration of the queue.
This patch fixes the problem by adding a check to see if queue already has requests. If it does, wait_busy is not set. As a result, time slices do not expire early.
The queues with more than one request are usually buffered writers. Testing shows improvement in isolation between buffered writers.
--- block/cfq-iosched.c | 4 ++++ 1 file changed, 4 insertions(+)
block/cfq-iosched.c +4 -0
@@ -3402,6 +3402,10 @@ static bool cfq_should_wait_busy(struct {struct cfq_io_context *cic = cfqd->active_cic; +/* If the queue already has requests, don't wait */ +if (!RB_EMPTY_ROOT (&cfqq->sort_list)) +return false; +/* If there are other queues in the group, don't wait */ if (cfqq->cfqg->nr_cfqq >1 )return false;
PATCH 126/176 powerpc/85xx: fix compatible properties of the P1022DS DMA nodes used for audio
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Timur Tabi <[email protected]>
commit b2e0861e51f2961954330dcafe6d148ee3ab5cff upstream.
In order to prevent the fsl_dma driver from claiming the DMA channels that the P1022DS audio driver needs, the compatible properties for those nodes must say "fsl,ssi-dma-channel" instead of "fsl,eloplus-dma-channel".
--- arch/powerpc/boot/dts/p1022ds.dts | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/powerpc/boot/dts/p1022ds.dts +2 -2
@@ -280,13 +280,13 @@ ranges = <0x0 0xc100 0x200>; cell-index = <1>; dma00: dma-channel@0 { - compatible = "fsl,eloplus-dma-channel"; + compatible = "fsl,ssi-dma-channel"; reg = <0x0 0x80>; cell-index = <0>; interrupts = <76 2>; }; dma01: dma-channel@80 { - compatible = "fsl,eloplus-dma-channel"; + compatible = "fsl,ssi-dma-channel"; reg = <0x80 0x80>; cell-index = <1>; interrupts = <77 2>;
PATCH 127/176 powerpc: Fix hcall tracepoint recursion
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Anton Blanchard <[email protected]>
commit 57cdfdf829a850a317425ed93c6a576c9ee6329c upstream.
Spinlocks on shared processor partitions use H_YIELD to notify the hypervisor we are waiting on another virtual CPU. Unfortunately this means the hcall tracepoints can recurse.
The patch below adds a percpu depth and checks it on both the entry and exit hcall tracepoints.
--- arch/powerpc/platforms/pseries/lpar.c | 37 ++++++++++++++++++++++++++++++++++ 1 file changed, 37 insertions(+)
arch/powerpc/platforms/pseries/lpar.c +37 -0
@@ -680,6 +680,13 @@ EXPORT_SYMBOL(arch_free_page);/* NB: reg/unreg are called while guarded with the tracepoints_mutex */ extern long hcall_tracepoint_refcount; +/* +* Since the tracing code might execute hcalls we need to guard against +* recursion. One example of this are spinlocks calling H_YIELD on +* shared processor partitions. +*/ +static DEFINE_PER_CPU(unsigned int, hcall_trace_depth); +void hcall_tracepoint_regfunc (void ) { hcall_tracepoint_refcount++;
@@ -692,12 +699,42 @@ void hcall_tracepoint_unregfunc(void)void __trace_hcall_entry (unsigned long opcode,unsigned long *args) { +unsigned long flags; +unsigned int *depth; + +local_irq_save (flags); + + depth = &__get_cpu_var (hcall_trace_depth); + +if (*depth) + goto out; + + (*depth)++;trace_hcall_entry (opcode, args); + (*depth)--; + +out: +local_irq_restore (flags); }void __trace_hcall_exit (long opcode,unsigned long retval,unsigned long *retbuf) { +unsigned long flags; +unsigned int *depth; + +local_irq_save (flags); + + depth = &__get_cpu_var (hcall_trace_depth); + +if (*depth) + goto out; + + (*depth)++;trace_hcall_exit (opcode, retval, retbuf); + (*depth)--; + +out: +local_irq_restore (flags); }#endif
PATCH 128/176 powerpc/numa: Fix bug in unmap_cpu_from_node
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Anton Blanchard <[email protected]>
commit 429f4d8d20b91e4a6c239f951c06a56a6ac22957 upstream.
When converting to the new cpumask code I screwed up:
- if (cpu_isset(cpu, numa_cpumask_lookup_table[node])) {
- cpu_clear(cpu, numa_cpumask_lookup_table[node]);
+ if (cpumask_test_cpu(cpu, node_to_cpumask_map[node])) {
+ cpumask_set_cpu(cpu, node_to_cpumask_map[node]);
This was introduced in commit 25863de07af9 (powerpc/cpumask: Convert NUMA code to new cpumask API)
Fix it.
--- arch/powerpc/mm/numa.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/powerpc/mm/numa.c +1 -1
@@ -181,7 +181,7 @@ static void unmap_cpu_from_node(unsigneddbg ("removing cpu %lu from node %d\n" , cpu, node);if (cpumask_test_cpu (cpu, node_to_cpumask_map[node])) { -cpumask_set_cpu (cpu, node_to_cpumask_map[node]); +cpumask_clear_cpu (cpu, node_to_cpumask_map[node]); }else {printk (KERN_ERR "WARNING: cpu %lu not found in node %d\n" , cpu, node);
PATCH 129/176 powerpc: Fix some 6xx/7xxx CPU setup functions
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Benjamin Herrenschmidt <[email protected]>
commit 1f1936ff3febf38d582177ea319eaa278f32c91f upstream.
Some of those functions try to adjust the CPU features, for example to remove NAP support on some revisions. However, they seem to use r5 as an index into the CPU table entry, which might have been right a long time ago but no longer is. r4 is the right register to use.
This probably caused some off behaviours on some PowerMac variants using 750cx or 7455 processor revisions.
--- arch/powerpc/kernel/cpu_setup_6xx.S | 40 ++++++++++++++++++------------------ 1 file changed, 20 insertions(+), 20 deletions(-)
arch/powerpc/kernel/cpu_setup_6xx.S +20 -20
@@ -18,7 +18,7 @@ #include <asm/mmu.h> _GLOBAL(__setup_cpu_603) - mflr r4 + mflr r5 BEGIN_MMU_FTR_SECTION li r10,0 mtspr SPRN_SPRG_603_LRU,r10 /* init SW LRU tracking */
@@ -27,60 +27,60 @@ BEGIN_FTR_SECTION bl __init_fpu_registers END_FTR_SECTION_IFCLR(CPU_FTR_FPU_UNAVAILABLE) bl setup_common_caches - mtlr r4 + mtlr r5 blr _GLOBAL(__setup_cpu_604) - mflr r4 + mflr r5 bl setup_common_caches bl setup_604_hid0 - mtlr r4 + mtlr r5 blr _GLOBAL(__setup_cpu_750) - mflr r4 + mflr r5 bl __init_fpu_registers bl setup_common_caches bl setup_750_7400_hid0 - mtlr r4 + mtlr r5 blr _GLOBAL(__setup_cpu_750cx) - mflr r4 + mflr r5 bl __init_fpu_registers bl setup_common_caches bl setup_750_7400_hid0 bl setup_750cx - mtlr r4 + mtlr r5 blr _GLOBAL(__setup_cpu_750fx) - mflr r4 + mflr r5 bl __init_fpu_registers bl setup_common_caches bl setup_750_7400_hid0 bl setup_750fx - mtlr r4 + mtlr r5 blr _GLOBAL(__setup_cpu_7400) - mflr r4 + mflr r5 bl __init_fpu_registers bl setup_7400_workarounds bl setup_common_caches bl setup_750_7400_hid0 - mtlr r4 + mtlr r5 blr _GLOBAL(__setup_cpu_7410) - mflr r4 + mflr r5 bl __init_fpu_registers bl setup_7410_workarounds bl setup_common_caches bl setup_750_7400_hid0 li r3,0 mtspr SPRN_L2CR2,r3 - mtlr r4 + mtlr r5 blr _GLOBAL(__setup_cpu_745x) - mflr r4 + mflr r5 bl setup_common_caches bl setup_745x_specifics - mtlr r4 + mtlr r5 blr /* Enable caches for 603's, 604, 750 & 7400 */
@@ -194,10 +194,10 @@ setup_750cx: cror 4*cr0+eq,4*cr0+eq,4*cr1+eq cror 4*cr0+eq,4*cr0+eq,4*cr2+eq bnelr - lwz r6,CPU_SPEC_FEATURES(r5) + lwz r6,CPU_SPEC_FEATURES(r4) li r7,CPU_FTR_CAN_NAP andc r6,r6,r7 - stw r6,CPU_SPEC_FEATURES(r5) + stw r6,CPU_SPEC_FEATURES(r4) blr /* 750fx specific
@@ -225,12 +225,12 @@ BEGIN_FTR_SECTION andis. r11,r11,L3CR_L3E@h beq 1f END_FTR_SECTION_IFSET(CPU_FTR_L3CR) - lwz r6,CPU_SPEC_FEATURES(r5) + lwz r6,CPU_SPEC_FEATURES(r4) andi. r0,r6,CPU_FTR_L3_DISABLE_NAP beq 1f li r7,CPU_FTR_CAN_NAP andc r6,r6,r7 - stw r6,CPU_SPEC_FEATURES(r5) + stw r6,CPU_SPEC_FEATURES(r4) 1: mfspr r11,SPRN_HID0
PATCH 130/176 firewire: core: fix unstable I/O with Canon camcorder
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Stefan Richter <[email protected]>
commit 6044565af458e7fa6e748bff437ecc49dea88d79 upstream.
Regression since commit 10389536742c, "firewire: core: check for 1394a compliant IRM, fix inaccessibility of Sony camcorder":
The camcorder Canon MV5i generates lots of bus resets when asynchronous requests are sent to it (e.g. Config ROM read requests or FCP Command write requests) if the camcorder is not root node. This causes drop- outs in videos or makes the camcorder entirely inaccessible.
https://bugzilla.redhat.com/show_bug.cgi?id=633260
Fix this by allowing any Canon device, even if it is a pre-1394a IRM like MV5i are, to remain root node (if it is at least Cycle Master capable). With the FireWire controller cards that I tested, MV5i always becomes root node when plugged in and left to its own devices.
--- drivers/firewire/core-card.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)
drivers/firewire/core-card.c +9 -2
@@ -75,6 +75,8 @@ static size_t config_rom_length = 1 + 4#define BIB_IRMC ((1) << 31)#define NODE_CAPABILITIES 0x0c0083c0/* per IEEE 1394 clause 8.3.2.6.5.2 */ +#define CANON_OUI 0x000085 +static void generate_config_rom (struct fw_card *card,__be32 *config_rom) {struct fw_descriptor *desc;
@@ -284,6 +286,7 @@ static void bm_work(struct work_struct *bool root_device_is_running;bool root_device_is_cmc;bool irm_is_1394_1995_only; +bool keep_this_irm;spin_lock_irq (&card->lock);
@@ -305,6 +308,10 @@ static void bm_work(struct work_struct * irm_is_1394_1995_only = irm_device && irm_device->config_rom && (irm_device->config_rom[2 ] &0x000000f0 ) ==0 ; +/* Canon MV5i works unreliably if it is not root node. */ + keep_this_irm = irm_device && irm_device->config_rom && + irm_device->config_rom[3 ] >>8 ==CANON_OUI ; + root_id = root_node->node_id; irm_id = card->irm_node->node_id; local_id = card->local_node->node_id;
@@ -333,7 +340,7 @@ static void bm_work(struct work_struct * goto pick_me; } -if (irm_is_1394_1995_only) { +if (irm_is_1394_1995_only && !keep_this_irm) { new_root_id = local_id;fw_notify ("%s, making local node (%02x) root.\n" ,"IRM is not 1394a compliant" , new_root_id);
@@ -382,7 +389,7 @@ static void bm_work(struct work_struct *spin_lock_irq (&card->lock); -if (rcode !=RCODE_COMPLETE ) { +if (rcode !=RCODE_COMPLETE && !keep_this_irm) {/* * The lock request failed, maybe the IRM * isn't really IRM capable after all. Let's
PATCH 131/176 parisc : Remove broken line wrapping handling pdc_iodc_print()
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Guy Martin <[email protected]>
commit fbea668498e93bb38ac9226c7af9120a25957375 upstream.
Remove the broken line wrapping handling in pdc_iodc_print(). It is broken in 3 ways :
- It doesn't keep track of the current screen position, it just assumes that the new buffer will be printed at the begining of the screen.
- It doesn't take in account that non printable characters won't increase the current position on the screen.
- And last but not least, it triggers a kernel panic if a backspace is the first char in the provided buffer :
Backtrace: [<0000000040128ec4>] pdc_console_write+0x44/0x78 [<0000000040128f18>] pdc_console_tty_write+0x20/0x38 [<000000004032f1ac>] n_tty_write+0x2a4/0x550 [<000000004032b158>] tty_write+0x1e0/0x2d8 [<00000000401bb420>] vfs_write+0xb8/0x188 [<00000000401bb630>] sys_write+0x68/0xb8 [<0000000040104eb8>] syscall_exit+0x0/0x14
Most terminals handle the line wrapping just fine. I've confirmed that it works correctly on a C8000 with both vga and serial output.
--- arch/parisc/kernel/firmware.c | 13 +------------ 1 file changed, 1 insertion(+), 12 deletions(-)
arch/parisc/kernel/firmware.c +1 -12
@@ -1126,15 +1126,13 @@ int pdc_iodc_print(const unsigned char *unsigned int i;unsigned long flags; -for (i =0 ; i < count && i <79 ;) { +for (i =0 ; i < count;) {switch (str[i]) {case '\n' : iodc_dbuf[i+0 ] ='\r' ; iodc_dbuf[i+1 ] ='\n' ; i +=2 ; goto print; -case '\b' :/* BS */ - i--;/* overwrite last */ default : iodc_dbuf[i] = str[i]; i++;
@@ -1142,15 +1140,6 @@ int pdc_iodc_print(const unsigned char * } } -/* if we're at the end of line, and not already inserting a newline, -* insert one anyway. iodc console doesn't claim to support >79 char -* lines. don't account for this in the return value. -*/ -if (i ==79 && iodc_dbuf[i-1 ] !='\n' ) { - iodc_dbuf[i+0 ] ='\r' ; - iodc_dbuf[i+1 ] ='\n' ; - } - print:spin_lock_irqsave (&pdc_lock, flags); real32_call(PAGE0->mem_cons.iodc_io,
PATCH 132/176 watchdog: Fix sysctl consistency
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Marcin Slusarz <[email protected]>
commit 397357666de6b5b6adb5fa99f9758ec8cf30ac34 upstream.
If it was not possible to enable watchdog for any cpu, switch watchdog_enabled back to 0, because it's visible via kernel.watchdog sysctl.
LKML-Reference: <[email protected]>
--- kernel/watchdog.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-)
kernel/watchdog.c +7 -6
@@ -441,9 +441,6 @@ static int watchdog_enable(int cpu)wake_up_process (p); } -/* if any cpu succeeds, watchdog is considered enabled for the system */ - watchdog_enabled =1 ; -return 0 ; }
@@ -471,12 +468,16 @@ static void watchdog_disable(int cpu)static void watchdog_enable_all_cpus (void ) {int cpu; -int result =0 ; + + watchdog_enabled =0 ;for_each_online_cpu (cpu) - result +=watchdog_enable (cpu); +if (!watchdog_enable (cpu)) +/* if any cpu succeeds, watchdog is considered +enabled for the system */ + watchdog_enabled =1 ; -if (result) +if (!watchdog_enabled)printk (KERN_ERR "watchdog: failed to be enabled on some cpus\n" ); }
PATCH 133/176 watchdog: Dont change watchdog state on read of sysctl
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Marcin Slusarz <[email protected]>
commit 9ffdc6c37df131f89d52001e0ef03091b158826f upstream.
LKML-Reference: <[email protected]>
--- kernel/watchdog.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
kernel/watchdog.c +6 -4
@@ -505,10 +505,12 @@ int proc_dowatchdog_enabled(struct ctl_t {proc_dointvec (table, write, buffer, length, ppos); -if (watchdog_enabled) -watchdog_enable_all_cpus (); -else -watchdog_disable_all_cpus (); +if (write) { +if (watchdog_enabled) +watchdog_enable_all_cpus (); +else +watchdog_disable_all_cpus (); + }return 0 ; }
PATCH 134/176 char/ipmi: fix OOPS caused by pnp_unregister_driver on unregistered driver
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Corey Minyard <[email protected]>
commit d2478521afc20227658a10a8c5c2bf1a2aa615b3 upstream.
This patch fixes an OOPS triggered when calling modprobe ipmi_si a second time after the first modprobe returned without finding any ipmi devices. This can happen if you reload the module after having the first module load fail. The driver was not deregistering from PNP in that case.
Peter Huewe originally reported this patch and supplied a fix, I have a different patch based on Linus' suggestion that cleans things up a bit more.
--- drivers/char/ipmi/ipmi_si_intf.c | 12 ++---------- 1 file changed, 2 insertions(+), 10 deletions(-)
drivers/char/ipmi/ipmi_si_intf.c +2 -10
@@ -320,6 +320,7 @@ static int unload_when_empty = 1;static int add_smi (struct smi_info *smi);static int try_smi_init (struct smi_info *smi);static void cleanup_one_si (struct smi_info *to_clean); +static void cleanup_ipmi_si (void );static ATOMIC_NOTIFIER_HEAD (xaction_notifier_list);static int register_xaction_notifier (struct notifier_block *nb)
@@ -3436,16 +3437,7 @@ static __devinit int init_ipmi_si(void)mutex_lock (&smi_infos_lock);if (unload_when_empty &&list_empty (&smi_infos)) {mutex_unlock (&smi_infos_lock); -#ifdef CONFIG_PCI -if (pci_registered) -pci_unregister_driver (&ipmi_pci_driver); -#endif - -#ifdef CONFIG_PPC_OF -if (of_registered) -of_unregister_platform_driver (&ipmi_of_platform_driver); -#endif -driver_unregister (&ipmi_driver.driver); +cleanup_ipmi_si (); printk(KERN_WARNING PFX "Unable to find any System Interface(s)\n");return -ENODEV ;
PATCH 135/176 ssb-pcmcia: Fix parsing of invariants tuples
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: =?UTF-8?q?Michael=20B=C3=BCsch?= <[email protected]>
commit dd3cb633078fb12e06ce6cebbdfbf55a7562e929 upstream.
This fixes parsing of the device invariants (MAC address) for PCMCIA SSB devices.
ssb_pcmcia_do_get_invariants expects an iv pointer as data argument.
--- drivers/ssb/pcmcia.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/ssb/pcmcia.c +1 -1
@@ -734,7 +734,7 @@ int ssb_pcmcia_get_invariants(struct ssb/* Fetch the vendor specific tuples. */ res =pcmcia_loop_tuple (bus->host_pcmcia,SSB_PCMCIA_CIS , - ssb_pcmcia_do_get_invariants, sprom); + ssb_pcmcia_do_get_invariants, iv);if ((res ==0 ) || (res == -ENOSPC ))return 0 ;
PATCH 136/176 backlight: fix 88pm860x_bl macro collision
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Randy Dunlap <[email protected]>
commit 2550326ac7a062fdfc204f9a3b98bdb9179638fc upstream.
Fix collision with kernel-supplied #define:
drivers/video/backlight/88pm860x_bl.c:24:1: warning: "CURRENT_MASK" redefined arch/x86/include/asm/page_64_types.h:6:1: warning: this is the location of the previous definition
--- drivers/video/backlight/88pm860x_bl.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/video/backlight/88pm860x_bl.c +2 -2
@@ -21,7 +21,7 @@#define MAX_BRIGHTNESS (0xFF)#define MIN_BRIGHTNESS (0) -#define CURRENT_MASK (0x1F << 1) +#define CURRENT_BITMASK (0x1F << 1)struct pm860x_backlight_data {struct pm860x_chip *chip;
@@ -85,7 +85,7 @@ static int pm860x_backlight_set(struct bif ((data->current_brightness ==0 ) && brightness) {if (data->iset) { ret =pm860x_set_bits (data->i2c,wled_idc (data->port), -CURRENT_MASK , data->iset); +CURRENT_BITMASK , data->iset);if (ret <0 ) goto out; }
PATCH 137/176 fs/direct-io.c: dont try to allocate more than BIO_MAX_PAGES in a bio
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: David Dillow <[email protected]>
commit 20d9600cb407b0b55fef6ee814b60345c6f58264 upstream.
When using devices that support max_segments > BIO_MAX_PAGES (256), direct IO tries to allocate a bio with more pages than allowed, which leads to an oops in dio_bio_alloc(). Clamp the request to the supported maximum, and change dio_bio_alloc() to reflect that bio_alloc() will always return a bio when called with __GFP_WAIT and a valid number of vectors.
--- fs/direct-io.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
fs/direct-io.c +7 -3
@@ -325,12 +325,16 @@ void dio_end_io(struct bio *bio, int err }EXPORT_SYMBOL_GPL (dio_end_io); -static int +static void dio_bio_alloc (struct dio *dio,struct block_device *bdev,sector_t first_sector,int nr_vecs) {struct bio *bio; +/* +* bio_alloc() is guaranteed to return a bio when called with +* __GFP_WAIT and we request a valid number of vectors. +*/ bio =bio_alloc (GFP_KERNEL , nr_vecs); bio->bi_bdev = bdev;
@@ -342,7 +346,6 @@ dio_bio_alloc(struct dio *dio, struct bl dio->bio = bio; dio->logical_offset_in_bio = dio->cur_page_fs_offset; -return 0 ; }/*
@@ -583,8 +586,9 @@ static int dio_new_bio(struct dio *dio, goto out; sector = start_sector << (dio->blkbits -9 ); nr_pages =min (dio->pages_in_io,bio_get_nr_vecs (dio->map_bh.b_bdev)); + nr_pages =min (nr_pages,BIO_MAX_PAGES );BUG_ON (nr_pages <=0 ); - ret =dio_bio_alloc (dio, dio->map_bh.b_bdev, sector, nr_pages); +dio_bio_alloc (dio, dio->map_bh.b_bdev, sector, nr_pages); dio->boundary =0 ; out:return ret;
PATCH 138/176 kernel/smp.c: fix smp_call_function_many() SMP race
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Anton Blanchard <[email protected]>
commit 6dc19899958e420a931274b94019e267e2396d3e upstream.
I noticed a failure where we hit the following WARN_ON in generic_smp_call_function_interrupt:
if (!cpumask_test_and_clear_cpu(cpu, data->cpumask))
continue;
data->csd.func(data->csd.info);
refs = atomic_dec_return(&data->refs);
WARN_ON(refs < 0); <-------------------------We atomically tested and cleared our bit in the cpumask, and yet the number of cpus left (ie refs) was 0. How can this be?
It turns out commit 54fdade1c3332391948ec43530c02c4794a38172 ("generic-ipi: make struct call_function_data lockless") is at fault. It removes locking from smp_call_function_many and in doing so creates a rather complicated race.
The problem comes about because:
- The smp_call_function_many interrupt handler walks call_function.queue without any locking.
- We reuse a percpu data structure in smp_call_function_many.
- We do not wait for any RCU grace period before starting the next smp_call_function_many.
Imagine a scenario where CPU A does two smp_call_functions back to back, and CPU B does an smp_call_function in between. We concentrate on how CPU C handles the calls:
CPU A CPU B CPU C CPU D
smp_call_function
smp_call_function_interrupt
walks
call_function.queue sees data from CPU A on list
smp_call_function
smp_call_function_interrupt
walks
call_function.queue sees
(stale) CPU A on list
smp_call_function int clears last ref on A list_del_rcu, unlocksmp_call_function reuses
percpu *data A
data->cpumask sees and clears bit in cpumask might be using old or new fn! decrements refs below 0
set data->refs (too late!)
The important thing to note is since the interrupt handler walks a potentially stale call_function.queue without any locking, then another cpu can view the percpu *data structure at any time, even when the owner is in the process of initialising it.
The following test case hits the WARN_ON 100% of the time on my PowerPC box (having 128 threads does help :)
#include <linux/module.h>
#include <linux/init.h>
#define ITERATIONS 100
static void do_nothing_ipi(void *dummy)
{
}
static void do_ipis(struct work_struct *dummy)
{
int i;
for (i = 0; i < ITERATIONS; i++)
smp_call_function(do_nothing_ipi, NULL, 1);
printk(KERN_DEBUG "cpu %d finished\n", smp_processor_id());
}static struct work_struct work[NR_CPUS];
static int __init testcase_init(void)
{
int cpu;
for_each_online_cpu(cpu) {
INIT_WORK(&work[cpu], do_ipis);
schedule_work_on(cpu, &work[cpu]);
}
return 0;
}static void __exit testcase_exit(void)
{
}
module_init(testcase_init)module_exit(testcase_exit)MODULE_LICENSE("GPL");MODULE_AUTHOR("Anton Blanchard");
I tried to fix it by ordering the read and the write of ->cpumask and ->refs. In doing so I missed a critical case but Paul McKenney was able to spot my bug thankfully :) To ensure we arent viewing previous iterations the interrupt handler needs to read ->refs then ->cpumask then ->refs _again_.
Thanks to Milton Miller and Paul McKenney for helping to debug this issue.
--- kernel/smp.c | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+)
kernel/smp.c +30 -0
@@ -194,6 +194,24 @@ void generic_smp_call_function_interruptlist_for_each_entry_rcu (data, &call_function.queue, csd.list) {int refs; +/* +* Since we walk the list without any locks, we might +* see an entry that was completed, removed from the +* list and is in the process of being reused. +* +* We must check that the cpu is in the cpumask before +* checking the refs, and both must be set before +* executing the callback on this cpu. +*/ + +if (!cpumask_test_cpu (cpu, data->cpumask)) +continue ; + +smp_rmb (); + +if (atomic_read (&data->refs) ==0 ) +continue ; +if (!cpumask_test_and_clear_cpu (cpu, data->cpumask))continue ;
@@ -202,6 +220,8 @@ void generic_smp_call_function_interrupt refs =atomic_dec_return (&data->refs);WARN_ON (refs <0 );if (!refs) { +WARN_ON (!cpumask_empty (data->cpumask)); +raw_spin_lock (&call_function.lock);list_del_rcu (&data->csd.list);raw_spin_unlock (&call_function.lock);
@@ -453,11 +473,21 @@ void smp_call_function_many(const struct data = &__get_cpu_var (cfd_data);csd_lock (&data->csd); +BUG_ON (atomic_read (&data->refs) || !cpumask_empty (data->cpumask)); data->csd.func = func; data->csd.info = info;cpumask_and (data->cpumask, mask, cpu_online_mask);cpumask_clear_cpu (this_cpu, data->cpumask); + +/* +* To ensure the interrupt handler gets an complete view +* we order the cpumask and refs writes and order the read +* of them in the interrupt handler. In addition we may +* only clear our own cpu bit from the mask. +*/ +smp_wmb (); +atomic_set (&data->refs,cpumask_weight (data->cpumask));raw_spin_lock_irqsave (&call_function.lock, flags);
PATCH 139/176 md: fix regression with re-adding devices to arrays with no metadata
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: NeilBrown <[email protected]>
commit bf572541ab44240163eaa2d486b06f306a31d45a upstream.
Commit 1a855a0606 (2.6.37-rc4) fixed a problem where devices were re-added when they shouldn't be but caused a regression in a less common case that means sometimes devices cannot be re-added when they should be.
In particular, when re-adding a device to an array without metadata we should always access the device, but after the above commit we didn't.
This patch sets the In_sync flag in that case so that the re-add succeeds.
This patch is suitable for any -stable kernel to which 1a855a0606 was applied.
--- drivers/md/md.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/md/md.c +3 -2
@@ -5150,9 +5150,10 @@ static int add_new_disk(mddev_t * mddev,/* set saved_raid_disk if appropriate */ if (!mddev->persistent) {if (info->state & (1 <<MD_DISK_SYNC ) && - info->raid_disk < mddev->raid_disks) + info->raid_disk < mddev->raid_disks) { rdev->raid_disk = info->raid_disk; -else +set_bit (In_sync, &rdev->flags); + }else rdev->raid_disk =-1 ; }else super_types[mddev->major_version].
PATCH 140/176 md: fix regression resulting in delays in clearing bits in a bitmap
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: NeilBrown <[email protected]>
commit 6c9879101442b08581e8a0e3ae6b7f643a78fd63 upstream.
commit 589a594be1fb (2.6.37-rc4) fixed a problem were md_thread would sometimes call the ->run function at a bad time.
If an error is detected during array start up after the md_thread has been started, the md_thread is killed. This resulted in the ->run function being called once. However the array may not be in a state that it is safe to call ->run.
However the fix imposed meant that ->run was not called on a timeout. This means that when an array goes idle, bitmap bits do not get cleared promptly. While the array is busy the bits will still be cleared when appropriate so this is not very serious. There is no risk to data.
Change the test so that we only avoid calling ->run when the thread is being stopped. This more explicitly addresses the problem situation.
This is suitable for 2.6.37-stable and any -stable kernel to which 589a594be1fb was applied.
--- drivers/md/md.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/md/md.c +2 -1
@@ -6038,7 +6038,8 @@ static int md_thread(void * arg) || kthread_should_stop(), thread->timeout); -if (test_and_clear_bit (THREAD_WAKEUP , &thread->flags)) +clear_bit (THREAD_WAKEUP , &thread->flags); +if (!kthread_should_stop ()) thread->run (thread->mddev); }
PATCH 141/176 md: Ensure no IO request to get md device before it is properly initialised.
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: NeilBrown <[email protected]>
commit 0ca69886a8273ac1350143d562280bfcbe4760dc upstream.
When an md device is in the process of coming on line it is possible for an IO request (typically a partition table probe) to get through before the array is fully initialised, which can cause unexpected behaviour (e.g. a crash).
So explicitly record when the array is ready for IO and don't allow IO through until then.
There is no possibility for a similar problem when the array is going off-line as there must only be one 'open' at that time, and it is busy off-lining the array and so cannot send IO requests. So no memory barrier is needed in md_stop()
This has been a bug since commit 409c57f3801 in 2.6.30 which introduced md_make_request. Before then, each personality would register its own make_request_fn when it was ready. This is suitable for any stable kernel from 2.6.30.y onwards.
--- drivers/md/md.c | 8 ++++++-- drivers/md/md.h | 3 ++- 2 files changed, 8 insertions(+), 3 deletions(-)
drivers/md/md.c +6 -2
@@ -221,10 +221,12 @@ static int md_make_request(struct requesint rv;int cpu; -if (mddev ==NULL || mddev->pers ==NULL ) { +if (mddev ==NULL || mddev->pers ==NULL + || !mddev->ready) {bio_io_error (bio);return 0 ; } +smp_rmb ();/* Ensure implications of 'active' are visible */ rcu_read_lock ();if (mddev->suspended || mddev->barrier) {DEFINE_WAIT (__wait);
@@ -4554,7 +4556,8 @@ int md_run(mddev_t *mddev) mddev->safemode_timer.data = (unsigned long ) mddev; mddev->safemode_delay = (200 *HZ )/1000 +1 ;/* 200 msec delay */ mddev->in_sync =1 ; - +smp_wmb (); + mddev->ready =1 ;list_for_each_entry (rdev, &mddev->disks, same_set)if (rdev->raid_disk >=0 ) {char nm[20 ];
@@ -4716,6 +4719,7 @@ EXPORT_SYMBOL_GPL(md_stop_writes);void md_stop (mddev_t *mddev) { + mddev->ready =0 ; mddev->pers->stop (mddev);if (mddev->pers->sync_request && mddev->to_remove ==NULL ) mddev->to_remove = &md_redundancy_group;
drivers/md/md.h +2 -1
@@ -149,7 +149,8 @@ struct mddev_s* are happening, so run/ * takeover/stop are not safe */ - +int ready;/* See when safe to pass +* IO requests down */ struct gendisk *gendisk;struct kobject kobj;
PATCH 142/176 md: Fix removal of extra drives when converting RAID6 to RAID5
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: NeilBrown <[email protected]>
commit bf2cb0dab8c97f00a71875d9b13dbac17a2f47ca upstream.
When a RAID6 is converted to a RAID5, the extra drive should be discarded. However it isn't due to a typo in a comparison.
This bug was introduced in commit e93f68a1fc6 in 2.6.35-rc4 and is suitable for any -stable since than.
As the extra drive is not removed, the 'degraded' counter is wrong and so the RAID5 will not respond correctly to a subsequent failure.
--- drivers/md/md.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/md/md.c +1 -1
@@ -3111,7 +3111,7 @@ level_store(mddev_t *mddev, const char *char nm[20 ];if (rdev->raid_disk <0 )continue ; -if (rdev->new_raid_disk > mddev->raid_disks) +if (rdev->new_raid_disk >= mddev->raid_disks) rdev->new_raid_disk =-1 ;if (rdev->new_raid_disk == rdev->raid_disk)continue ;
PATCH 143/176 pata_mpc52xx: inherit from ata_bmdma_port_ops
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Tejun Heo <[email protected]>
commit 77c5fd19075d299fe820bb59bb21b0b113676e20 upstream.
pata_mpc52xx supports BMDMA but inherits ata_sff_port_ops which triggers BUG_ON() when a DMA command is issued. Fix it.
--- drivers/ata/pata_mpc52xx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/ata/pata_mpc52xx.c +1 -1
@@ -610,7 +610,7 @@ static struct scsi_host_template mpc52xx };static struct ata_port_operations mpc52xx_ata_port_ops = { - .inherits = &ata_sff_port_ops, + .inherits = &ata_bmdma_port_ops, .sff_dev_select = mpc52xx_ata_dev_select, .set_piomode = mpc52xx_ata_set_piomode, .set_dmamode = mpc52xx_ata_set_dmamode,
PATCH 144/176 md_make_request: dont touch the bio after calling make_request
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Chris Mason <[email protected]>
commit e91ece5590b3c728624ab57043fc7a05069c604a upstream.
md_make_request was calling bio_sectors() for part_stat_add after it was calling the make_request function. This is bad because the make_request function can free the bio and because the bi_size field can change around.
The fix here was suggested by Jens Axboe. It saves the sector count before the make_request call. I hit this with CONFIG_DEBUG_PAGEALLOC turned on while trying to break his pretty fusionio card.
--- drivers/md/md.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
drivers/md/md.c +7 -2
@@ -220,6 +220,7 @@ static int md_make_request(struct requesmddev_t *mddev = q->queuedata;int rv;int cpu; +unsigned int sectors;if (mddev ==NULL || mddev->pers ==NULL || !mddev->ready) {
@@ -244,12 +245,16 @@ static int md_make_request(struct requesatomic_inc (&mddev->active_io);rcu_read_unlock (); +/* +* save the sectors now since our bio can +* go away inside make_request +*/ + sectors =bio_sectors (bio); rv = mddev->pers->make_request (mddev, bio); cpu =part_stat_lock ();part_stat_inc (cpu, &mddev->gendisk->part0, ios[rw]); -part_stat_add (cpu, &mddev->gendisk->part0, sectors[rw], -bio_sectors (bio)); +part_stat_add (cpu, &mddev->gendisk->part0, sectors[rw], sectors);part_stat_unlock ();if (atomic_dec_and_test (&mddev->active_io) && mddev->suspended)
PATCH 145/176 KVM: i8259: initialize isr_ack
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Avi Kivity <[email protected]>
commit a0272630bb594b4eac03a79e77957df7dad8eade upstream.
isr_ack is never initialized. So, until the first PIC reset, interrupts may fail to be injected. This can cause Windows XP to fail to boot, as reported in the fallout from the fix to
https://bugzilla.kernel.org/show_bug.cgi?id=21962.
--- arch/x86/kvm/i8259.c | 2 ++ 1 file changed, 2 insertions(+)
arch/x86/kvm/i8259.c +2 -0
@@ -570,6 +570,8 @@ struct kvm_pic *kvm_create_pic(struct kv s->pics[1 ].elcr_mask =0xde ; s->pics[0 ].pics_state = s; s->pics[1 ].pics_state = s; + s->pics[0 ].isr_ack =0xff ; + s->pics[1 ].isr_ack =0xff ;/* * Initialize PIO device
PATCH 146/176 KVM: MMU: Fix incorrect direct gfn for unpaged mode shadow
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Avi Kivity <[email protected]>
commit c093b8b46c5f0dd12d799f0d6a3b579863df72f6 upstream.
We use the physical address instead of the base gfn for the four PAE page directories we use in unpaged mode. When the guest accesses an address above 1GB that is backed by a large host page, a BUG_ON() in kvm_mmu_set_gfn() triggers.
Resolves: https://bugzilla.kernel.org/show_bug.cgi?id=21962
--- arch/x86/kvm/mmu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/kvm/mmu.c +1 -1
@@ -2271,7 +2271,7 @@ static int mmu_alloc_roots(struct kvm_vcreturn 1 ;if (tdp_enabled) { direct =1 ; - root_gfn = i <<30 ; + root_gfn = i << (30 -PAGE_SHIFT ); }spin_lock (&vcpu->kvm->mmu_lock);kvm_mmu_free_some_pages (vcpu);
PATCH 147/176 KVM: MMU: Fix 32 bit legacy paging with NPT
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Joerg Roedel <[email protected]>
commit f87f928882d080eaec8b0d76aecff003d664697d upstream.
This patch fixes 32 bit legacy paging with NPT enabled. The mmu_check_root call on the top-level of the loop causes root_gfn to take values (in the tdp_enabled path) which are outside of guest memory. So the mmu_check_root call fails at some point in the loop interation causing the guest to tiple-fault.
This patch changes the mmu_check_root calls to the places where they are really necessary. As a side-effect it introduces a check for the root of a pae page table too.
--- arch/x86/kvm/mmu.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
arch/x86/kvm/mmu.c +6 -2
@@ -2254,6 +2254,10 @@ static int mmu_alloc_roots(struct kvm_vcreturn 0 ; } direct = !is_paging (vcpu); + +if (mmu_check_root (vcpu, root_gfn)) +return 1 ; +for (i =0 ; i <4 ; ++i) {hpa_t root = vcpu->arch.mmu.pae_root[i];
@@ -2265,10 +2269,10 @@ static int mmu_alloc_roots(struct kvm_vccontinue ; } root_gfn = pdptr >>PAGE_SHIFT ; +if (mmu_check_root (vcpu, root_gfn)) +return 1 ; }else if (vcpu->arch.mmu.root_level ==0 ) root_gfn =0 ; -if (mmu_check_root (vcpu, root_gfn)) -return 1 ;if (tdp_enabled) { direct =1 ; root_gfn = i << (30 -PAGE_SHIFT );
PATCH 148/176 nilfs2: fix crash after one superblock became unavailable
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Ryusuke Konishi <[email protected]>
commit 0ca7a5b9ac5d301845dd6382ff25a699b6263a81 upstream.
Fixes the following kernel oops in nilfs_setup_super() which could arise if one of two super-blocks is unavailable.
Quoted 9 lines
BUG: unable to handle kernel NULL pointer dereference at (null) Pid: 3529, comm: mount.nilfs2 Not tainted 2.6.37 #1 / EIP: 0060:[<c03196bc>] EFLAGS: 00010202 CPU: 3 EIP is at memcpy+0xc/0x1b Call Trace: [<f953720e>] ? nilfs_setup_super+0x6c/0xa5 [nilfs2] [<f95369e9>] ? nilfs_get_root_dentry+0x81/0xcb [nilfs2] [<f9537a08>] ? nilfs_mount+0x4f9/0x62c [nilfs2] [<c02745cf>] ? kstrdup+0x36/0x3f
Quoted 8 lines
[<f953750f>] ? nilfs_mount+0x0/0x62c [nilfs2] [<c0293940>] ? vfs_kern_mount+0x4d/0x12c [<c02a5100>] ? get_fs_type+0x76/0x8f [<c0293a68>] ? do_kern_mount+0x33/0xbf [<c02a784a>] ? do_mount+0x2ed/0x714 [<c02a6171>] ? copy_mount_options+0x28/0xfc [<c02a7ce3>] ? sys_mount+0x72/0xaf [<c0473085>] ? syscall_call+0x7/0xb
LKML-Reference: <[email protected]>
--- fs/nilfs2/super.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/nilfs2/super.c +2 -1
@@ -733,7 +733,8 @@ static int nilfs_setup_super(struct nilfcpu_to_le16 (le16_to_cpu (sbp[0 ]->s_state) & ~NILFS_VALID_FS ); sbp[0 ]->s_mtime =cpu_to_le64 (get_seconds ());/* synchronize sbp[1] with sbp[0] */ -memcpy (sbp[1 ], sbp[0 ], nilfs->ns_sbsize); +if (sbp[1 ]) +memcpy (sbp[1 ], sbp[0 ], nilfs->ns_sbsize);return nilfs_commit_super (sbi,NILFS_SB_COMMIT_ALL ); }
PATCH 149/176 TPM: Long default timeout fix
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Rajiv Andrade <[email protected]>
commit c4ff4b829ef9e6353c0b133b7adb564a68054979 upstream.
If duration variable value is 0 at this point, it's because chip->vendor.duration wasn't filled by tpm_get_timeouts() yet. This patch sets then the lowest timeout just to give enough time for tpm_get_timeouts() to further succeed.
This fix avoids long boot times in case another entity attempts to send commands to the TPM when the TPM isn't accessible.
--- drivers/char/tpm/tpm.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
drivers/char/tpm/tpm.c +6 -4
@@ -354,12 +354,14 @@ unsigned long tpm_calc_ordinal_duration( tpm_protected_ordinal_duration[ordinal &TPM_PROTECTED_ORDINAL_MASK ]; -if (duration_idx !=TPM_UNDEFINED ) +if (duration_idx !=TPM_UNDEFINED ) { duration = chip->vendor.duration[duration_idx]; -if (duration <=0 ) +/* if duration is 0, it's because chip->vendor.duration wasn't */ +/* filled yet, so we set the lowest timeout just to give enough */ +/* time for tpm_get_timeouts() to succeed */ +return (duration <=0 ?HZ : duration); + }else return 2 *60 *HZ ; -else -return duration; }EXPORT_SYMBOL_GPL (tpm_calc_ordinal_duration);
PATCH 150/176 tpm_tis: Use timeouts returned from TPM
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Stefan Berger <[email protected]>
commit 9b29050f8f75916f974a2d231ae5d3cd59792296 upstream.
The current TPM TIS driver in git discards the timeout values returned from the TPM. The check of the response packet needs to consider that the return_code field is 0 on success and the size of the expected packet is equivalent to the header size + u32 length indicator for the TPM_GetCapability() result + 3 timeout indicators of type u32.
I am also adding a sysfs entry 'timeouts' showing the timeouts that are being used.
--- drivers/char/tpm/tpm.c | 18 ++++++++++++++++-- drivers/char/tpm/tpm.h | 2 ++ drivers/char/tpm/tpm_tis.c | 4 +++- 3 files changed, 21 insertions(+), 3 deletions(-)
drivers/char/tpm/tpm.c +16 -2
@@ -567,9 +567,11 @@ duration:if (rc)return ; -if (be32_to_cpu (tpm_cmd.header.out.return_code) - !=3 *sizeof (u32)) +if (be32_to_cpu (tpm_cmd.header.out.return_code) !=0 || +be32_to_cpu (tpm_cmd.header.out.length) + !=sizeof (tpm_cmd.header.out) +sizeof (u32) +3 *sizeof (u32))return ; + duration_cap = &tpm_cmd.params.getcap_out.cap.duration; chip->vendor.duration[TPM_SHORT ] =usecs_to_jiffies (be32_to_cpu (duration_cap->tpm_short));
@@ -913,6 +915,18 @@ ssize_t tpm_show_caps_1_2(struct device }EXPORT_SYMBOL_GPL (tpm_show_caps_1_2); +ssize_t tpm_show_timeouts (struct device *dev,struct device_attribute *attr, +char *buf) +{ +struct tpm_chip *chip =dev_get_drvdata (dev); + +return sprintf (buf,"%d %d %d\n" , +jiffies_to_usecs (chip->vendor.duration[TPM_SHORT ]), +jiffies_to_usecs (chip->vendor.duration[TPM_MEDIUM ]), +jiffies_to_usecs (chip->vendor.duration[TPM_LONG ])); +} +EXPORT_SYMBOL_GPL (tpm_show_timeouts); +ssize_t tpm_store_cancel (struct device *dev,struct device_attribute *attr,const char *buf,size_t count) {
drivers/char/tpm/tpm.h +2 -0
@@ -56,6 +56,8 @@ extern ssize_t tpm_show_owned(struct dev char *);extern ssize_t tpm_show_temp_deactivated (struct device *,struct device_attribute *attr,char *); +extern ssize_t tpm_show_timeouts (struct device *, +struct device_attribute *attr,char *);struct tpm_chip ;
drivers/char/tpm/tpm_tis.c +3 -1
@@ -355,6 +355,7 @@ static DEVICE_ATTR(temp_deactivated, S_I NULL); static DEVICE_ATTR(caps, S_IRUGO, tpm_show_caps_1_2, NULL); static DEVICE_ATTR(cancel, S_IWUSR | S_IWGRP, NULL, tpm_store_cancel); +static DEVICE_ATTR(timeouts, S_IRUGO, tpm_show_timeouts, NULL);static struct attribute *tis_attrs[] = { &dev_attr_pubek.attr,
@@ -364,7 +365,8 @@ static struct attribute *tis_attrs[] = { &dev_attr_owned.attr, &dev_attr_temp_deactivated.attr, &dev_attr_caps.attr, - &dev_attr_cancel.attr, NULL, + &dev_attr_cancel.attr, + &dev_attr_timeouts.attr, NULL, }; static struct attribute_group tis_attr_grp = {
PATCH 151/176 KEYS: Dont call up_write() if __key_link_begin() returns an error
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: David Howells <[email protected]>
commit 3fc5e98d8cf85e0d77fc597b49e9268dff67400e upstream.
In construct_alloc_key(), up_write() is called in the error path if __key_link_begin() fails, but this is incorrect as __key_link_begin() only returns with the nominated keyring locked if it returns successfully.
Without this patch, you might see the following in dmesg:
=====================================
[ BUG: bad unlock balance detected! ]
-------------------------------------
mount.cifs/5769 is trying to release lock (&key->sem) at:
[<ffffffff81201159>] request_key_and_link+0x263/0x3fc
but there are no more locks to release!
other info that might help us debug this:
3 locks held by mount.cifs/5769:
#0: (&type->s_umount_key#41/1){+.+.+.}, at: [<ffffffff81131321>] sget+0x278/0x3e7
#1: (&ret_buf->session_mutex){+.+.+.}, at: [<ffffffffa0258e59>] cifs_get_smb_ses+0x35a/0x443 [cifs]
#2: (root_key_user.cons_lock){+.+.+.}, at: [<ffffffff81201000>] request_key_and_link+0x10a/0x3fc
stack backtrace:
Pid: 5769, comm: mount.cifs Not tainted 2.6.37-rc6+ #1
Call Trace:
[<ffffffff81201159>] ? request_key_and_link+0x263/0x3fc
[<ffffffff81081601>] print_unlock_inbalance_bug+0xca/0xd5
[<ffffffff81083248>] lock_release_non_nested+0xc1/0x263
[<ffffffff81201159>] ? request_key_and_link+0x263/0x3fc
[<ffffffff81201159>] ? request_key_and_link+0x263/0x3fc
[<ffffffff81083567>] lock_release+0x17d/0x1a4
[<ffffffff81073f45>] up_write+0x23/0x3b
[<ffffffff81201159>] request_key_and_link+0x263/0x3fc
[<ffffffffa026fe9e>] ? cifs_get_spnego_key+0x61/0x21f [cifs]
[<ffffffff812013c5>] request_key+0x41/0x74
[<ffffffffa027003d>] cifs_get_spnego_key+0x200/0x21f [cifs]
[<ffffffffa026e296>] CIFS_SessSetup+0x55d/0x1273 [cifs]
[<ffffffffa02589e1>] cifs_setup_session+0x90/0x1ae [cifs]
[<ffffffffa0258e7e>] cifs_get_smb_ses+0x37f/0x443 [cifs]
[<ffffffffa025a9e3>] cifs_mount+0x1aa1/0x23f3 [cifs]
[<ffffffff8111fd94>] ? alloc_debug_processing+0xdb/0x120
[<ffffffffa027002c>] ? cifs_get_spnego_key+0x1ef/0x21f [cifs]
[<ffffffffa024cc71>] cifs_do_mount+0x165/0x2b3 [cifs]
[<ffffffff81130e72>] vfs_kern_mount+0xaf/0x1dc
[<ffffffff81131007>] do_kern_mount+0x4d/0xef
[<ffffffff811483b9>] do_mount+0x6f4/0x733
[<ffffffff8114861f>] sys_mount+0x88/0xc2
[<ffffffff8100ac42>] system_call_fastpath+0x16/0x1b--- security/keys/request_key.c | 1 - 1 file changed, 1 deletion(-)
security/keys/request_key.c +0 -1
@@ -403,7 +403,6 @@ link_check_failed:return ret; link_prealloc_failed: -up_write (&dest_keyring->sem);mutex_unlock (&user->cons_lock);kleave (" = %d [prelink]" , ret);return ret;
PATCH 152/176 SELinux: define permissions for DCB netlink messages
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Eric Paris <[email protected]>
commit 350e4f31e0eaf56dfc3b328d24a11bdf42a41fb8 upstream.
Commit 2f90b865 added two new netlink message types to the netlink route socket. SELinux has hooks to define if netlink messages are allowed to be sent or received, but it did not know about these two new message types. By default we allow such actions so noone likely noticed. This patch adds the proper definitions and thus proper permissions enforcement.
--- security/selinux/nlmsgtab.c | 2 ++ 1 file changed, 2 insertions(+)
security/selinux/nlmsgtab.c +2 -0
@@ -65,6 +65,8 @@ static struct nlmsg_perm nlmsg_route_per { RTM_NEWADDRLABEL, NETLINK_ROUTE_SOCKET__NLMSG_WRITE }, { RTM_DELADDRLABEL, NETLINK_ROUTE_SOCKET__NLMSG_WRITE }, { RTM_GETADDRLABEL, NETLINK_ROUTE_SOCKET__NLMSG_READ }, + { RTM_GETDCB, NETLINK_ROUTE_SOCKET__NLMSG_READ }, + { RTM_SETDCB, NETLINK_ROUTE_SOCKET__NLMSG_WRITE }, }; static struct nlmsg_perm nlmsg_firewall_perms[] =
PATCH 153/176 SELinux: do not compute transition labels on mountpoint labeled filesystems
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Eric Paris <[email protected]>
commit 415103f9932d45f7927f4b17e3a9a13834cdb9a1 upstream.
selinux_inode_init_security computes transitions sids even for filesystems that use mount point labeling. It shouldn't do that. It should just use the mount point label always and no matter what.
This causes 2 problems. 1) it makes file creation slower than it needs to be since we calculate the transition sid and 2) it allows files to be created with a different label than the mount point!
# id -Z staff_u:sysadm_r:sysadm_t:s0-s0:c0.c1023 # sesearch --type --class file --source sysadm_t --target tmp_t Found 1 semantic te rules: type_transition sysadm_t tmp_t : file user_tmp_t;
# mount -o loop,context="system_u:object_r:tmp_t:s0" /tmp/fs /mnt/tmp
# ls -lZ /mnt/tmp drwx------. root root system_u:object_r:tmp_t:s0 lost+found # touch /mnt/tmp/file1 # ls -lZ /mnt/tmp -rw-r--r--. root root staff_u:object_r:user_tmp_t:s0 file1 drwx------. root root system_u:object_r:tmp_t:s0 lost+found
Whoops, we have a mount point labeled filesystem tmp_t with a user_tmp_t labeled file!
--- security/selinux/hooks.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
security/selinux/hooks.c +4 -1
@@ -2529,7 +2529,10 @@ static int selinux_inode_init_security(s sid = tsec->sid; newsid = tsec->create_sid; -if (!newsid || !(sbsec->flags &SE_SBLABELSUPP )) { +if ((sbsec->flags &SE_SBINITIALIZED ) && + (sbsec->behavior ==SECURITY_FS_USE_MNTPOINT )) + newsid = sbsec->mntpoint_sid; +else if (!newsid || !(sbsec->flags &SE_SBLABELSUPP )) { rc =security_transition_sid (sid, dsec->sid,inode_mode_to_security_class (inode->i_mode), &newsid);
PATCH 154/176 tpm: Autodetect itpm devices
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Matthew Garrett <[email protected]>
commit 3f0d3d016d89a5efb8b926d4707eb21fa13f3d27 upstream.
Some Lenovos have TPMs that require a quirk to function correctly. This can be autodetected by checking whether the device has a _HID of INTC0102. This is an invalid PNPid, and as such is discarded by the pnp layer - however it's still present in the ACPI code, so we can pull it out that way. This means that the quirk won't be automatically applied on non-ACPI systems, but without ACPI we don't have any way to identify the chip anyway so I don't think that's a great concern.
--- drivers/char/tpm/tpm_tis.c | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+)
drivers/char/tpm/tpm_tis.c +24 -0
@@ -25,6 +25,7 @@#include <linux/slab.h> #include <linux/interrupt.h> #include <linux/wait.h> +#include <linux/acpi.h> #include "tpm.h" #define TPM_HEADER_SIZE 10
@@ -78,6 +79,26 @@ enum tis_defaults {static LIST_HEAD (tis_chips);static DEFINE_SPINLOCK (tis_lock); +#ifdef CONFIG_ACPI +static int is_itpm (struct pnp_dev *dev) +{ +struct acpi_device *acpi =pnp_acpi_device (dev); +struct acpi_hardware_id *id; + +list_for_each_entry (id, &acpi->pnp.ids, list) { +if (!strcmp ("INTC0102" , id->id)) +return 1 ; + } + +return 0 ; +} +#else +static int is_itpm (struct pnp_dev *dev) +{ +return 0 ; +} +#endif +static int check_locality (struct tpm_chip *chip,int l) { if ((ioread8(chip->vendor.iobase + TPM_ACCESS(l)) &
@@ -474,6 +495,9 @@ static int tpm_tis_init(struct device *d"1.2 TPM (device-id 0x%X, rev-id %d)\n" , vendor >> 16, ioread8(chip->vendor.iobase + TPM_RID(0))); +if (is_itpm (to_pnp_dev (dev))) + itpm =1 ; +if (itpm)dev_info (dev,"Intel iTPM workaround enabled\n" );
PATCH 155/176 ieee80211: correct IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK macro
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Amitkumar Karwar <[email protected]>
commit 8d661f1e462d50bd83de87ee628aaf820ce3c66c upstream.
It is defined in include/linux/ieee80211.h. As per IEEE spec. bit6 to bit15 in block ack parameter represents buffer size. So the bitmask should be 0xFFC0.
--- include/linux/ieee80211.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/linux/ieee80211.h +1 -1
@@ -959,7 +959,7 @@ struct ieee80211_ht_info {/* block-ack parameters */ #define IEEE80211_ADDBA_PARAM_POLICY_MASK 0x0002#define IEEE80211_ADDBA_PARAM_TID_MASK 0x003C -#define IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK 0xFFA0 +#define IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK 0xFFC0#define IEEE80211_DELBA_PARAM_TID_MASK 0xF000#define IEEE80211_DELBA_PARAM_INITIATOR_MASK 0x0800
PATCH 156/176 dm: dont take i_mutex to change device size
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Mike Snitzer <[email protected]>
commit c217649bf2d60ac119afd71d938278cffd55962b upstream.
No longer needlessly hold md->bdev->bd_inode->i_mutex when changing the size of a DM device. This additional locking is unnecessary because i_size_write() is already protected by the existing critical section in dm_swap_table(). DM already has a reference on md->bdev so the associated bd_inode may be changed without lifetime concerns.
A negative side-effect of having held md->bdev->bd_inode->i_mutex was that a concurrent DM device resize and flush (via fsync) would deadlock. Dropping md->bdev->bd_inode->i_mutex eliminates this potential for deadlock. The following reproducer no longer deadlocks:
https://www.redhat.com/archives/dm-devel/2009-July/msg00284.html
--- drivers/md/dm.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/md/dm.c +3 -2
@@ -2111,13 +2111,14 @@ static void event_callback(void *contextwake_up (&md->eventq); } +/* +* Protected by md->suspend_lock obtained by dm_swap_table(). +*/ static void __set_size (struct mapped_device *md,sector_t size) {set_capacity (md->disk, size); -mutex_lock (&md->bdev->bd_inode->i_mutex);i_size_write (md->bdev->bd_inode, (loff_t )size <<SECTOR_SHIFT ); -mutex_unlock (&md->bdev->bd_inode->i_mutex); }/*
PATCH 157/176 dm mpath: disable blk_abort_queue
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Mike Snitzer <[email protected]>
commit 09c9d4c9b6a2b5909ae3c6265e4cd3820b636863 upstream.
Revert commit 224cb3e981f1b2f9f93dbd49eaef505d17d894c2
dm: Call blk_abort_queue on failed paths
Multipath began to use blk_abort_queue() to allow for lower latency path deactivation. This was found to cause list corruption:
the cmd gets blk_abort_queued/timedout run on it and the scsi eh somehow is able to complete and run scsi_queue_insert while scsi_request_fn is still trying to process the request.
https://www.redhat.com/archives/dm-devel/2010-November/msg00085.html
--- drivers/md/dm-mpath.c | 12 ------------ 1 file changed, 12 deletions(-)
drivers/md/dm-mpath.c +0 -12
@@ -33,7 +33,6 @@ struct pgpath {unsigned fail_count;/* Cumulative failure count */ struct dm_path path; -struct work_struct deactivate_path;struct work_struct activate_path; };
@@ -116,7 +115,6 @@ static struct workqueue_struct *kmultipastatic void process_queued_ios (struct work_struct *work);static void trigger_event (struct work_struct *work);static void activate_path (struct work_struct *work); -static void deactivate_path (struct work_struct *work);/*-----------------------------------------------
@@ -129,7 +127,6 @@ static struct pgpath *alloc_pgpath(void)if (pgpath) { pgpath->is_active =1 ; -INIT_WORK (&pgpath->deactivate_path, deactivate_path);INIT_WORK (&pgpath->activate_path, activate_path); }
@@ -141,14 +138,6 @@ static void free_pgpath(struct pgpath *pkfree (pgpath); } -static void deactivate_path (struct work_struct *work) -{ -struct pgpath *pgpath = - container_of(work, struct pgpath, deactivate_path); - -blk_abort_queue (pgpath->path.dev->bdev->bd_disk->queue); -} -static struct priority_group *alloc_priority_group (void ) {struct priority_group *pg;
@@ -995,7 +984,6 @@ static int fail_path(struct pgpath *pgpa pgpath->path.dev->name, m->nr_valid_paths);schedule_work (&m->trigger_event); -queue_work (kmultipathd, &pgpath->deactivate_path); out:spin_unlock_irqrestore (&m->lock, flags);
PATCH 158/176 net/fec: fix MMFR_OP type in fec_enet_mdio_write
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Shawn Guo <[email protected]>
commit 862f0982eadcea0e114576c57ea426d3d51a69a6 upstream.
FEC_MMFR_OP_WRITE should be used than FEC_MMFR_OP_READ in a mdio write operation.
It's probably a typo introduced by commit:
e6b043d512fa8d9a3801bf5d72bfa3b8fc3b3cc8netdev/fec.c: add phylib supporting to enable carrier detection (v2)
--- drivers/net/fec.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/fec.c +2 -2
@@ -651,8 +651,8 @@ static int fec_enet_mdio_write(struct mi fep->mii_timeout =0 ;init_completion (&fep->mdio_done); -/* start a read op */ -writel (FEC_MMFR_ST |FEC_MMFR_OP_READ | +/* start a write op */ +writel (FEC_MMFR_ST |FEC_MMFR_OP_WRITE |FEC_MMFR_PA (mii_id) |FEC_MMFR_RA (regnum) |FEC_MMFR_TA |FEC_MMFR_DATA (value), fep->hwp +FEC_MII_DATA );
PATCH 159/176 drm/radeon/kms: add quirk for Mac Radeon HD 2600 card
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Alex Deucher <[email protected]>
commit f598aa7593427ffe3a61e7767c34bd695a5e7ed0 upstream.
--- drivers/gpu/drm/radeon/radeon_atombios.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
drivers/gpu/drm/radeon/radeon_atombios.c +11 -0
@@ -388,6 +388,17 @@ static bool radeon_atom_apply_quirks(str *line_mux =0x90 ; } +/* mac rv630 */ +if ((dev->pdev->device ==0x9588 ) && + (dev->pdev->subsystem_vendor ==0x106b ) && + (dev->pdev->subsystem_device ==0x00a6 )) { +if ((supported_device ==ATOM_DEVICE_TV1_SUPPORT ) && + (*connector_type ==DRM_MODE_CONNECTOR_DVII )) { + *connector_type = DRM_MODE_CONNECTOR_9PinDIN; + *line_mux =CONNECTOR_7PIN_DIN_ENUM_ID1 ; + } + } +/* ASUS HD 3600 XT board lists the DVI port as HDMI */ if ((dev->pdev->device == 0x9598) && (dev->pdev->subsystem_vendor == 0x1043) &&
PATCH 160/176 drm/radeon/kms: adjust quirk for acer laptop
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Alex Deucher <[email protected]>
commit 2f299d5de02da3ffb1f9e1a05c91dcd1173ebd3c upstream.
Acer laptop (TravelMate 5730G) has an HDMI connector on the laptop and a DVI connector on the docking station and both share the same encoder, hpd pin, and ddc line. The bios connector table reflects this and is technically correct, however, we drop the DVI connector here since xrandr has no concept of encoders (only crtcs and connectors) and will try and drive both connectors with different crtcs which isn't possible on the hardware side and leaves no crtcs for LVDS or VGA.
Fixes:
https://bugs.freedesktop.org/show_bug.cgi?id=32732
--- drivers/gpu/drm/radeon/radeon_atombios.c | 21 +++++++++++---------- 1 file changed, 11 insertions(+), 10 deletions(-)
drivers/gpu/drm/radeon/radeon_atombios.c +11 -10
@@ -313,7 +313,6 @@ static bool radeon_atom_apply_quirks(str uint16_t *line_mux, struct radeon_hpd *hpd) { - struct radeon_device *rdev = dev->dev_private;/* Asus M2A-VM HDMI board lists the DVI port as HDMI */ if ((dev->pdev->device == 0x791e) &&
@@ -436,21 +435,23 @@ static bool radeon_atom_apply_quirks(str } } -/* Acer laptop reports DVI-D as DVI-I and hpd pins reversed */ +/* Acer laptop (Acer TravelMate 5730G) has an HDMI port +* on the laptop and a DVI port on the docking station and +* both share the same encoder, hpd pin, and ddc line. +* So while the bios table is technically correct, +* we drop the DVI port here since xrandr has no concept of +* encoders and will try and drive both connectors +* with different crtcs which isn't possible on the hardware +* side and leaves no crtcs for LVDS or VGA. +*/ if ((dev->pdev->device ==0x95c4 ) && (dev->pdev->subsystem_vendor ==0x1025 ) && (dev->pdev->subsystem_device ==0x013c )) { -struct radeon_gpio_rec gpio; -if ((*connector_type ==DRM_MODE_CONNECTOR_DVII ) && (supported_device ==ATOM_DEVICE_DFP1_SUPPORT )) { - gpio =radeon_lookup_gpio (rdev,6 ); - *hpd =radeon_atom_get_hpd_info_from_gpio (rdev, &gpio); +/* actually it's a DVI-D port not DVI-I */ *connector_type =DRM_MODE_CONNECTOR_DVID ; - }else if ((*connector_type ==DRM_MODE_CONNECTOR_HDMIA ) && - (supported_device ==ATOM_DEVICE_DFP1_SUPPORT )) { - gpio =radeon_lookup_gpio (rdev,7 ); - *hpd =radeon_atom_get_hpd_info_from_gpio (rdev, &gpio); +return false; } }
PATCH 161/176 drm/radeon/kms: make the mac rv630 quirk generic
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Alex Deucher <[email protected]>
commit be23da8ad219650517cbbb7acbeaeb235667113a upstream.
Seems some other boards do this as well.
--- drivers/gpu/drm/radeon/radeon_atombios.c | 14 +++++--------- 1 file changed, 5 insertions(+), 9 deletions(-)
drivers/gpu/drm/radeon/radeon_atombios.c +5 -9
@@ -387,15 +387,11 @@ static bool radeon_atom_apply_quirks(str *line_mux =0x90 ; } -/* mac rv630 */ -if ((dev->pdev->device ==0x9588 ) && - (dev->pdev->subsystem_vendor ==0x106b ) && - (dev->pdev->subsystem_device ==0x00a6 )) { -if ((supported_device ==ATOM_DEVICE_TV1_SUPPORT ) && - (*connector_type ==DRM_MODE_CONNECTOR_DVII )) { - *connector_type = DRM_MODE_CONNECTOR_9PinDIN; - *line_mux =CONNECTOR_7PIN_DIN_ENUM_ID1 ; - } +/* mac rv630, rv730, others */ +if ((supported_device ==ATOM_DEVICE_TV1_SUPPORT ) && + (*connector_type ==DRM_MODE_CONNECTOR_DVII )) { + *connector_type = DRM_MODE_CONNECTOR_9PinDIN; + *line_mux =CONNECTOR_7PIN_DIN_ENUM_ID1 ; }/* ASUS HD 3600 XT board lists the DVI port as HDMI */
PATCH 162/176 radeon/kms: fix dp displayport mode validation
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Jerome Glisse <[email protected]>
commit 6bba2e116808ca12e30c8d88dfedabf8b8d67390 upstream.
Check if there is a big enough dp clock & enough dp lane to drive the video mode provided.
--- drivers/gpu/drm/radeon/atombios_dp.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/radeon/atombios_dp.c +2 -2
@@ -187,9 +187,9 @@ static int dp_link_clock_for_mode_clock(int dp_mode_valid (u8 dpcd[DP_DPCD_SIZE ],int mode_clock) {int lanes =dp_lanes_for_mode_clock (dpcd, mode_clock); -int bw =dp_lanes_for_mode_clock (dpcd, mode_clock); +int dp_clock =dp_link_clock_for_mode_clock (dpcd, mode_clock); -if ((lanes ==0 ) || (bw ==0 )) +if ((lanes ==0 ) || (dp_clock ==0 ))return MODE_CLOCK_HIGH ;return MODE_OK ;
PATCH 163/176 drm/radeon/kms: add pll debugging output
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Alex Deucher <[email protected]>
commit 51d4bf840a27fe02c883ddc6d9708af056773769 upstream.
--- drivers/gpu/drm/radeon/radeon_display.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/gpu/drm/radeon/radeon_display.c +4 -0
@@ -629,6 +629,10 @@ static void radeon_compute_pll_legacy(st *frac_fb_div_p = best_frac_feedback_div; *ref_div_p = best_ref_div; *post_div_p = best_post_div; +DRM_DEBUG_KMS ("%d %d, pll dividers - fb: %d.%d ref: %d, post %d\n" , + freq, best_freq /1000 , best_feedback_div, best_frac_feedback_div, + best_ref_div, best_post_div); + } static bool
PATCH 164/176 drm/radeon: remove 0x4243 pci id
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Alex Deucher <[email protected]>
commit 63a507800c8aca5a1891d598ae13f829346e8e39 upstream.
0x4243 is a PCI bridge, not a GPU.
Fixes:
https://bugs.freedesktop.org/show_bug.cgi?id=33815
--- include/drm/drm_pciids.h | 1 - 1 file changed, 1 deletion(-)
include/drm/drm_pciids.h +0 -1
@@ -28,7 +28,6 @@ {0x1002, 0x4156, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV350}, \ {0x1002, 0x4237, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RS200|RADEON_IS_IGP}, \ {0x1002, 0x4242, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R200}, \ - {0x1002, 0x4243, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R200}, \ {0x1002, 0x4336, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RS100|RADEON_IS_IGP|RADEON_IS_MOBILITY}, \ {0x1002, 0x4337, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RS200|RADEON_IS_IGP|RADEON_IS_MOBILITY}, \ {0x1002, 0x4437, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RS200|RADEON_IS_IGP|RADEON_IS_MOBILITY}, \
PATCH 165/176 drm/radeon/kms: fix s/r issues with bios scratch regs
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Alex Deucher <[email protected]>
commit 87364760de5d631390c478fcbac8db1b926e0adf upstream.
The accelerate mode bit gets checked by certain atom command tables to set up some register state. It needs to be clear when setting modes and set when not.
Fixes:
https://bugzilla.kernel.org/show_bug.cgi?id=26942
--- drivers/gpu/drm/radeon/radeon_atombios.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
drivers/gpu/drm/radeon/radeon_atombios.c +6 -3
@@ -2303,7 +2303,7 @@ void radeon_atom_initialize_bios_scratch bios_2_scratch &= ~ATOM_S2_VRI_BRIGHT_ENABLE ;/* tell the bios not to handle mode switching */ - bios_6_scratch |= (ATOM_S6_ACC_BLOCK_DISPLAY_SWITCH |ATOM_S6_ACC_MODE ); + bios_6_scratch |=ATOM_S6_ACC_BLOCK_DISPLAY_SWITCH ;if (rdev->family >=CHIP_R600 ) {WREG32 (R600_BIOS_2_SCRATCH , bios_2_scratch);
@@ -2354,10 +2354,13 @@ void radeon_atom_output_lock(struct drm_else bios_6_scratch =RREG32 (RADEON_BIOS_6_SCRATCH ); -if (lock) +if (lock) { bios_6_scratch |=ATOM_S6_CRITICAL_STATE ; -else + bios_6_scratch &= ~ATOM_S6_ACC_MODE ; + }else { bios_6_scratch &= ~ATOM_S6_CRITICAL_STATE ; + bios_6_scratch |=ATOM_S6_ACC_MODE ; + }if (rdev->family >=CHIP_R600 )WREG32 (R600_BIOS_6_SCRATCH , bios_6_scratch);
PATCH 166/176 drm: Restore the old_fb upon modeset failure
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Chris Wilson <[email protected]>
commit 0ba41e449fd0f45f5b29c1009020ab1b298bedda upstream.
... or else we may end up disabling the wrong framebuffer, leading to an OOPS, e.g:
[ 6033.229012] kernel BUG at drivers/gpu/drm/i915/i915_gem.c:3271! [ 6033.229012] invalid opcode: 0000 [#1] SMP [ 6033.229012] last sysfs file: /sys/devices/virtual/backlight/acpi_video0/uevent [ 6033.229012] Modules linked in: sunrpc cpufreq_ondemand acpi_cpufreq
mperf snd_hda_codec_analog snd_hda_intel snd_hda_codec snd_hwdep snd_seq snd_seq_device snd_pcm snd_timer thinkpad_acpi ppdev snd r852 sm_common iTCO_wdt uvcvideo i2c_i801 iTCO_vendor_support microcode wmi nand videodev nand_ids nand_ecc snd_page_alloc parport_pc parport mtd soundcore joydev v4l1_compat pcspkr uinput ipv6 sdhci_pci sdhci mmc_core yenta_socket i915 drm_kms_helper drm i2c_algo_bit i2c_core video output [last unloaded: scsi_wait_scan]
[ 6033.229012] [ 6033.229012] Pid: 4834, comm: Xorg Not tainted 2.6.37-rc8+ #25 7661BL5/7661BL5 [ 6033.229012] EIP: 0060:[<f86fda5e>] EFLAGS: 00013246 CPU: 0 [ 6033.229012] EIP is at i915_gem_object_unpin+0x23/0x76 [i915] [ 6033.229012] EAX: f68a4000 EBX: f6831f00 ECX: 000600fa EDX: f68a8000 [ 6033.229012] ESI: f68a4014 EDI: f68a42b8 EBP: f2169c44 ESP: f2169c3c [ 6033.229012] DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068 [ 6033.229012] Process Xorg (pid: 4834, ti=f2168000 task=f21c8000 task.ti=f2168000) [ 6033.229012] Stack: [ 6033.229012] f3a84800 f68a4014 f2169c54 f87045d8 f3a84800 f872d9a8 f2169c68 f7fd8091 [ 6033.229012] f3b952a4 00000000 f68a414c f2169cf0 f7fd9377 00000000 00000000 f7fd98b0 [ 6033.229012] f7fd9f4e 0000000f f7f328a0 00000000 00000000 00000000 f2169ca4 f68a414c [ 6033.229012] Call Trace: [ 6033.229012] [<f87045d8>] ? intel_crtc_disable+0x36/0x41 [i915] [ 6033.229012] [<f7fd8091>] ? drm_helper_disable_unused_functions+0xcd/0xf9 [drm_kms_helper] [ 6033.229012] [<f7fd9377>] ? drm_crtc_helper_set_config+0x62a/0x7f7 [drm_kms_helper] [ 6033.229012] [<c04daa10>] ? __slab_free+0x1b/0xa4 [ 6033.229012] [<f7fd7e62>] ? drm_fb_helper_initial_config+0x466/0x497 [drm_kms_helper] [ 6033.229012] [<f7fd7ea3>] ? drm_fb_helper_restore+0x10/0x2a [drm_kms_helper] [ 6033.229012] [<f86f2577>] ? i915_driver_lastclose+0x2a/0x57 [i915] [ 6033.229012] [<f7f1989f>] ? drm_lastclose+0x45/0x23e [drm] [ 6033.229012] [<f7f1a0b4>] ? drm_release+0x462/0x4d7 [drm]
--- drivers/gpu/drm/drm_crtc_helper.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/gpu/drm/drm_crtc_helper.c +4 -1
@@ -649,6 +649,7 @@ int drm_crtc_helper_set_config(struct dr old_fb)) {DRM_ERROR ("failed to set mode on [CRTC:%d]\n" , set->crtc->base.id); + set->crtc->fb = old_fb; ret = -EINVAL ; goto fail; }
@@ -663,8 +664,10 @@ int drm_crtc_helper_set_config(struct dr set->crtc->fb = set->fb; ret = crtc_funcs->mode_set_base (set->crtc, set->x, set->y, old_fb); -if (ret !=0 ) +if (ret !=0 ) { + set->crtc->fb = old_fb; goto fail; + } }kfree (save_connectors);
PATCH 167/176 drm/i915: fix calculation of eDP signal levels on Sandybridge
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Yuanhan Liu <[email protected]>
commit 3c5a62b5226ca5db993660281e9c2a7275d9fb02 upstream.
Some voltage swing/pre-emphasis level use the same value on eDP Sandybridge, like 400mv_0db and 600mv_0db are with the same value of (0x0 << 22). So, fix them, and point out the value if it isn't a supported voltage swing/pre-emphasis level.
--- drivers/gpu/drm/i915/i915_reg.h | 9 +++++---- drivers/gpu/drm/i915/intel_dp.c | 23 ++++++++++++++++------- 2 files changed, 21 insertions(+), 11 deletions(-)
drivers/gpu/drm/i915/i915_reg.h +5 -4
@@ -2967,10 +2967,11 @@#define EDP_LINK_TRAIN_600MV_3_5DB_SNB_A (0x01<<22)#define EDP_LINK_TRAIN_800MV_0DB_SNB_A (0x0<<22)/* SNB B-stepping */ -#define EDP_LINK_TRAIN_400MV_0DB_SNB_B (0x0<<22) -#define EDP_LINK_TRAIN_400MV_6DB_SNB_B (0x3a<<22) -#define EDP_LINK_TRAIN_600MV_3_5DB_SNB_B (0x39<<22) -#define EDP_LINK_TRAIN_800MV_0DB_SNB_B (0x38<<22) +#define EDP_LINK_TRAIN_400_600MV_0DB_SNB_B (0x0<<22) +#define EDP_LINK_TRAIN_400MV_3_5DB_SNB_B (0x1<<22) +#define EDP_LINK_TRAIN_400_600MV_6DB_SNB_B (0x3a<<22) +#define EDP_LINK_TRAIN_600_800MV_3_5DB_SNB_B (0x39<<22) +#define EDP_LINK_TRAIN_800_1200MV_0DB_SNB_B (0x38<<22)#define EDP_LINK_TRAIN_VOL_EMP_MASK_SNB (0x3f<<22)#endif /* _I915_REG_H_ */
drivers/gpu/drm/i915/intel_dp.c +16 -7
@@ -1093,18 +1093,27 @@ intel_dp_signal_levels(uint8_t train_setstatic uint32_t intel_gen6_edp_signal_levels (uint8_t train_set) { -switch (train_set & (DP_TRAIN_VOLTAGE_SWING_MASK |DP_TRAIN_PRE_EMPHASIS_MASK )) { +int signal_levels = train_set & (DP_TRAIN_VOLTAGE_SWING_MASK | +DP_TRAIN_PRE_EMPHASIS_MASK ); +switch (signal_levels) {case DP_TRAIN_VOLTAGE_SWING_400 |DP_TRAIN_PRE_EMPHASIS_0 : -return EDP_LINK_TRAIN_400MV_0DB_SNB_B ; +case DP_TRAIN_VOLTAGE_SWING_600 |DP_TRAIN_PRE_EMPHASIS_0 : +return EDP_LINK_TRAIN_400_600MV_0DB_SNB_B ; +case DP_TRAIN_VOLTAGE_SWING_400 |DP_TRAIN_PRE_EMPHASIS_3_5 : +return EDP_LINK_TRAIN_400MV_3_5DB_SNB_B ;case DP_TRAIN_VOLTAGE_SWING_400 |DP_TRAIN_PRE_EMPHASIS_6 : -return EDP_LINK_TRAIN_400MV_6DB_SNB_B ; +case DP_TRAIN_VOLTAGE_SWING_600 |DP_TRAIN_PRE_EMPHASIS_6 : +return EDP_LINK_TRAIN_400_600MV_6DB_SNB_B ;case DP_TRAIN_VOLTAGE_SWING_600 |DP_TRAIN_PRE_EMPHASIS_3_5 : -return EDP_LINK_TRAIN_600MV_3_5DB_SNB_B ; +case DP_TRAIN_VOLTAGE_SWING_800 |DP_TRAIN_PRE_EMPHASIS_3_5 : +return EDP_LINK_TRAIN_600_800MV_3_5DB_SNB_B ;case DP_TRAIN_VOLTAGE_SWING_800 |DP_TRAIN_PRE_EMPHASIS_0 : -return EDP_LINK_TRAIN_800MV_0DB_SNB_B ; +case DP_TRAIN_VOLTAGE_SWING_1200 |DP_TRAIN_PRE_EMPHASIS_0 : +return EDP_LINK_TRAIN_800_1200MV_0DB_SNB_B ;default : -DRM_DEBUG_KMS ("Unsupported voltage swing/pre-emphasis level\n" ); -return EDP_LINK_TRAIN_400MV_0DB_SNB_B ; +DRM_DEBUG_KMS ("Unsupported voltage swing/pre-emphasis level:" +"0x%x\n" , signal_levels); +return EDP_LINK_TRAIN_400_600MV_0DB_SNB_B ; } }
PATCH 168/176 drm/i915/lvds: Add AOpen i915GMm-HFS to the list of false-positive LVDS
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Knut Petersen <[email protected]>
commit 22ab70d3262ddb6e69b3c246a34e2967ba5eb1e8 upstream.
--- drivers/gpu/drm/i915/intel_lvds.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/gpu/drm/i915/intel_lvds.c +8 -0
@@ -701,6 +701,14 @@ static const struct dmi_system_id intel_ }, { .callback = intel_no_lvds_dmi_callback, + .ident = "AOpen i915GMm-HFS", + .matches = { +DMI_MATCH (DMI_BOARD_VENDOR ,"AOpen" ), + DMI_MATCH(DMI_BOARD_NAME, "i915GMm-HFS"), + }, + }, + { + .callback = intel_no_lvds_dmi_callback, .ident = "Aopen i945GTt-VFA", .matches = { DMI_MATCH(DMI_PRODUCT_VERSION, "AO00001JW"),
PATCH 169/176 drm/i915: Add dependency on CONFIG_TMPFS
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Chris Wilson <[email protected]>
commit f7ab9b407b3bc83161c2aa74c992ba4782e87c9c upstream.
Without tmpfs, shmem_readpage() is not compiled in causing an OOPS as soon as we try to allocate some swappable pages for GEM.
Jan 19 22:52:26 harlie kernel: Modules linked in: i915(+) drm_kms_helper cfbcopyarea video backlight cfbimgblt cfbfillrect Jan 19 22:52:26 harlie kernel: Jan 19 22:52:26 harlie kernel: Pid: 1125, comm: modprobe Not tainted 2.6.37Harlie #10 To be filled by O.E.M./To be filled by O.E.M. Jan 19 22:52:26 harlie kernel: EIP: 0060:[<00000000>] EFLAGS: 00010246 CPU: 3 Jan 19 22:52:26 harlie kernel: EIP is at 0x0 Jan 19 22:52:26 harlie kernel: EAX: 00000000 EBX: f7b7d000 ECX: f3383100 EDX: f7b7d000 Jan 19 22:52:26 harlie kernel: ESI: f1456118 EDI: 00000000 EBP: f2303c98 ESP: f2303c7c Jan 19 22:52:26 harlie kernel: DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068 Jan 19 22:52:26 harlie kernel: Process modprobe (pid: 1125, ti=f2302000 task=f259cd80 task.ti=f2302000) Jan 19 22:52:26 harlie kernel: Stack: Jan 19 22:52:26 harlie udevd-work[1072]: '/sbin/modprobe -b pci:v00008086d00000046sv00000000sd00000000bc03sc00i00' unexpected exit with status 0x0009 Jan 19 22:52:26 harlie kernel: c1074061 000000d0 f2f42b80 00000000 000a13d2 f2d5dcc0 00000001 f2303cac Jan 19 22:52:26 harlie kernel: c107416f 00000000 000a13d2 00000000 f2303cd4 f8d620ed f2cee620 00001000 Jan 19 22:52:26 harlie kernel: 00000000 000a13d2 f1456118 f2d5dcc0 f1a40000 00001000 f2303d04 f8d637ab Jan 19 22:52:26 harlie kernel: Call Trace: Jan 19 22:52:26 harlie kernel: [<c1074061>] ? do_read_cache_page+0x71/0x160 Jan 19 22:52:26 harlie kernel: [<c107416f>] ? read_cache_page_gfp+0x1f/0x30 Jan 19 22:52:26 harlie kernel: [<f8d620ed>] ? i915_gem_object_get_pages+0xad/0x1d0 [i915] Jan 19 22:52:26 harlie kernel: [<f8d637ab>] ? i915_gem_object_bind_to_gtt+0xeb/0x2d0 [i915] Jan 19 22:52:26 harlie kernel: [<f8d65961>] ? i915_gem_object_pin+0x151/0x190 [i915] Jan 19 22:52:26 harlie kernel: [<c11e16ed>] ? drm_gem_object_init+0x3d/0x60 Jan 19 22:52:26 harlie kernel: [<f8d65aa5>] ? i915_gem_init_ringbuffer+0x105/0x1e0 [i915] Jan 19 22:52:26 harlie kernel: [<f8d571b7>] ? i915_driver_load+0x667/0x1160 [i915]
--- drivers/gpu/drm/Kconfig | 3 +++ 1 file changed, 3 insertions(+)
drivers/gpu/drm/Kconfig +3 -0
@@ -97,7 +97,10 @@ config DRM_I830 config DRM_I915 tristate "i915 driver" depends on AGP_INTEL + # we need shmfs for the swappable backing store, and in particular + # the shmem_readpage() which depends upon tmpfs select SHMEM + select TMPFS select DRM_KMS_HELPER select FB_CFB_FILLRECT select FB_CFB_COPYAREA
PATCH 170/176 drm/i915: Recognise non-VGA display devices
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Chris Wilson <[email protected]>
commit 934f992c763ae1e5eefcce8af769c16444085df7 upstream.
Starting with SandyBridge (though possible with earlier hacked BIOSes), the BIOS may initialise the IGFX as secondary to a discrete GPU. Prior, it would simply disable the integrated GPU. So we adjust our PCI class mask to match any DISPLAY_CLASS device.
In such a configuration, the IGFX is not a primary VGA controller and so should not take part in VGA arbitration, and the error return from vga_client_register() is expected.
--- drivers/gpu/drm/i915/i915_dma.c | 10 ++++++++-- drivers/gpu/drm/i915/i915_drv.c | 2 +- drivers/gpu/vga/vgaarb.c | 2 +- 3 files changed, 10 insertions(+), 4 deletions(-)
drivers/gpu/drm/i915/i915_dma.c +8 -2
@@ -1419,9 +1419,15 @@ static int i915_load_modeset_init(structif (ret)DRM_INFO ("failed to find VBIOS tables\n" ); -/* if we have > 1 VGA cards, then disable the radeon VGA resources */ +/* If we have > 1 VGA cards, then we need to arbitrate access +* to the common VGA resources. +* +* If we are a secondary display controller (!PCI_DISPLAY_CLASS_VGA), +* then we do not take part in VGA arbitration and the +* vga_client_register() fails with -ENODEV. +*/ ret =vga_client_register (dev->pdev, dev,NULL , i915_vga_set_decode); -if (ret) +if (ret && ret != -ENODEV ) goto cleanup_ringbuffer; ret = vga_switcheroo_register_client(dev->pdev,
drivers/gpu/drm/i915/i915_drv.c +1 -1
@@ -53,7 +53,7 @@ extern int intel_agp_enabled;#define INTEL_VGA_DEVICE (id, info) { \ .class = PCI_CLASS_DISPLAY_VGA << 8, \ - .class_mask = 0xffff00, \ + .class_mask = 0xff0000, \ .vendor = 0x8086, \ .device = id, \ .subvendor = PCI_ANY_ID, \
drivers/gpu/vga/vgaarb.c +1 -1
@@ -636,7 +636,7 @@ int vga_client_register(struct pci_dev *void (*irq_set_state)(void *cookie,bool state), unsigned int (*set_vga_decode)(void *cookie, bool decode)) { - int ret = -1; + int ret = -ENODEV;struct vga_device *vgadev;unsigned long flags;
PATCH 171/176 x86, mm: avoid possible bogus tlb entries by clearing prev mm_cpumask after switching mm
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Suresh Siddha <[email protected]>
commit 831d52bc153971b70e64eccfbed2b232394f22f8 upstream.
Clearing the cpu in prev's mm_cpumask early will avoid the flush tlb IPI's while the cr3 is still pointing to the prev mm. And this window can lead to the possibility of bogus TLB fills resulting in strange failures. One such problematic scenario is mentioned below.
T1. CPU-1 is context switching from mm1 to mm2 context and got a NMI
etc between the point of clearing the cpu from the mm_cpumask(mm1) and before reloading the cr3 with the new mm2.
T2. CPU-2 is tearing down a specific vma for mm1 and will proceed with
flushing the TLB for mm1. It doesn't send the flush TLB to CPU-1 as it doesn't see that cpu listed in the mm_cpumask(mm1).
T3. After the TLB flush is complete, CPU-2 goes ahead and frees the
page-table pages associated with the removed vma mapping.
T4. CPU-2 now allocates those freed page-table pages for something
else.
T5. As the CR3 and TLB caches for mm1 is still active on CPU-1, CPU-1
can potentially speculate and walk through the page-table caches and can insert new TLB entries. As the page-table pages are already freed and being used on CPU-2, this page walk can potentially insert a bogus global TLB entry depending on the (random) contents of the page that is being used on CPU-2.
T6. This bogus TLB entry being global will be active across future CR3
changes and can result in weird memory corruption etc.
To avoid this issue, for the prev mm that is handing over the cpu to another mm, clear the cpu from the mm_cpumask(prev) after the cr3 is changed.
Marking it for -stable, though we haven't seen any reported failure that can be attributed to this.
--- arch/x86/include/asm/mmu_context.h | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
arch/x86/include/asm/mmu_context.h +3 -2
@@ -36,8 +36,6 @@ static inline void switch_mm(struct mm_sunsigned cpu =smp_processor_id ();if (likely (prev != next)) { -/* stop flush ipis for the previous mm */ -cpumask_clear_cpu (cpu,mm_cpumask (prev));#ifdef CONFIG_SMP percpu_write (cpu_tlbstate.state,TLBSTATE_OK );percpu_write (cpu_tlbstate.active_mm, next);
@@ -47,6 +45,9 @@ static inline void switch_mm(struct mm_s/* Re-load page tables */ load_cr3 (next->pgd); +/* stop flush ipis for the previous mm */ +cpumask_clear_cpu (cpu,mm_cpumask (prev)); +/* * load the LDT, if the LDT is different: */
PATCH 172/176 agp: ensure GART has an address before enabling it
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Stephen Kitt <[email protected]>
commit a70b95c017e8b518e1e069853355e4e497453dbb upstream.
Some BIOSs (eg. the AMI BIOS on the Asus P4P800 motherboard) don't initialise the GART address, and pcibios_assign_resources() can ignore it because it can be marked as a host bridge (see
https://bugzilla.kernel.org/show_bug.cgi?id=24392#c5 for details). This was handled correctly up to 2.6.35, but the pci_enable_device() cleanup in 2.6.36 96576a9e1a0cdb8 ("agp: intel-agp: do not use PCI resources before pci_enable_device()") means that the kernel tries to enable the GART before assigning it an address; in such cases the GART overlaps with other device assignments and ends up being disabled.
This patch fixes https://bugzilla.kernel.org/show_bug.cgi?id=24392
Note that I imagine efficeon-agp.c probably has the same problem, but I can't test that and I'd like to make sure this patch is suitable for -stable (since 2.6.36 and 2.6.37 are affected).
--- drivers/char/agp/intel-agp.c | 27 ++++++++++++++++----------- 1 file changed, 16 insertions(+), 11 deletions(-)
drivers/char/agp/intel-agp.c +16 -11
@@ -927,20 +927,14 @@ static int __devinit agp_intel_probe(strdev_info (&pdev->dev,"Intel %s Chipset\n" , intel_agp_chipsets[i].name);/* -* If the device has not been properly setup, the following will catch -* the problem and should stop the system from crashing. -* 20030610 - [email protected] -*/ -if (pci_enable_device (pdev)) { -dev_err (&pdev->dev,"can't enable PCI device\n" ); -agp_put_bridge (bridge); -return -ENODEV ; - } - -/* * The following fixes the case where the BIOS has "forgotten" to * provide an address range for the GART. * 20030610 - [email protected] +* This happens before pci_enable_device() intentionally; +* calling pci_enable_device() before assigning the resource +* will result in the GART being disabled on machines with such +* BIOSs (the GART ends up with a BAR starting at 0, which +* conflicts a lot of other devices). */ r = &pdev->resource[0 ];if (!r->start && r->end) {
@@ -951,6 +945,17 @@ static int __devinit agp_intel_probe(str } } +/* +* If the device has not been properly setup, the following will catch +* the problem and should stop the system from crashing. +* 20030610 - [email protected] +*/ +if (pci_enable_device (pdev)) { +dev_err (&pdev->dev,"can't enable PCI device\n" ); +agp_put_bridge (bridge); +return -ENODEV ; + } +/* Fill in the mode register */ if (cap_ptr) { pci_read_config_dword(pdev,
PATCH 173/176 drm/i915: Only bind to function 0 of the PCI device
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Chris Wilson <[email protected]>
commit 5fe49d86f9d01044abf687a8cd21edef636d58aa upstream.
Early chipsets (gen2/3) used function 1 as a placeholder for multi-head. We used to ignore these since they were not assigned to PCI_CLASS_DISPLAY_VGA. However with 934f992c7 we attempt to bind to all Intel PCI_CLASS_DISPLAY devices (and functions) to work in multi-gpu systems. This fails hard on gen2/3.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=28012
--- drivers/gpu/drm/i915/i915_drv.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/gpu/drm/i915/i915_drv.c +8 -0
@@ -414,6 +414,14 @@ int i965_reset(struct drm_device *dev, ustatic int __devinit i915_pci_probe (struct pci_dev *pdev,const struct pci_device_id *ent) { +/* Only bind to function 0 of the device. Early generations +* used function 1 as a placeholder for multi-head. This causes +* us confusion instead, especially on the systems where both +* functions have the same PCI-ID! +*/ +if (PCI_FUNC (pdev->devfn)) +return -ENODEV ; +return drm_get_pci_dev (pdev, ent, &driver); }
PATCH 174/176 xhci: Do not run xhci_cleanup_msix with irq disabled
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Zhang Rui <[email protected]>
commit 40a9fb17f32dbe54de3d636142a59288544deed7 upstream.
when unloading xhci_hcd, I got:
[ 134.856813] xhci_hcd 0000:02:00.0: remove, state 4 [ 134.858140] usb usb3: USB disconnect, address 1 [ 134.874956] xhci_hcd 0000:02:00.0: Host controller not halted, aborting reset. [ 134.876351] BUG: sleeping function called from invalid context at kernel/mutex.c:85 [ 134.877657] in_atomic(): 0, irqs_disabled(): 1, pid: 1451, name: modprobe [ 134.878975] Pid: 1451, comm: modprobe Not tainted 2.6.37-rc5+ #162 [ 134.880298] Call Trace: [ 134.881602] [<ffffffff8104156a>] __might_sleep+0xeb/0xf0 [ 134.882921] [<ffffffff814763dc>] mutex_lock+0x24/0x50 [ 134.884229] [<ffffffff810a745c>] free_desc+0x2e/0x5f [ 134.885538] [<ffffffff810a74c8>] irq_free_descs+0x3b/0x71 [ 134.886853] [<ffffffff8102584d>] free_irq_at+0x31/0x36 [ 134.888167] [<ffffffff8102723f>] destroy_irq+0x69/0x71 [ 134.889486] [<ffffffff8102747a>] native_teardown_msi_irq+0xe/0x10 [ 134.890820] [<ffffffff8124c382>] default_teardown_msi_irqs+0x57/0x80 [ 134.892158] [<ffffffff8124be46>] free_msi_irqs+0x8b/0xe9 [ 134.893504] [<ffffffff8124cd46>] pci_disable_msix+0x35/0x39 [ 134.894844] [<ffffffffa01b444a>] xhci_cleanup_msix+0x31/0x51 [xhci_hcd] [ 134.896186] [<ffffffffa01b4b3a>] xhci_stop+0x3a/0x80 [xhci_hcd] [ 134.897521] [<ffffffff81341dd4>] usb_remove_hcd+0xfd/0x14a [ 134.898859] [<ffffffff813500ae>] usb_hcd_pci_remove+0x5c/0xc6 [ 134.900193] [<ffffffff8123c606>] pci_device_remove+0x3f/0x91 [ 134.901535] [<ffffffff812e7ea4>] __device_release_driver+0x83/0xd9 [ 134.902899] [<ffffffff812e8571>] driver_detach+0x86/0xad [ 134.904222] [<ffffffff812e7d56>] bus_remove_driver+0xb2/0xd8 [ 134.905540] [<ffffffff812e8633>] driver_unregister+0x6c/0x74 [ 134.906839] [<ffffffff8123c8e4>] pci_unregister_driver+0x44/0x89 [ 134.908121] [<ffffffffa01b940e>] xhci_unregister_pci+0x15/0x17 [xhci_hcd] [ 134.909396] [<ffffffffa01bd7d2>] xhci_hcd_cleanup+0xe/0x10 [xhci_hcd] [ 134.910652] [<ffffffff8107fcd1>] sys_delete_module+0x1ca/0x23b [ 134.911882] [<ffffffff81123932>] ? path_put+0x22/0x26 [ 134.913104] [<ffffffff8109a800>] ? audit_syscall_entry+0x2c/0x148 [ 134.914333] [<ffffffff8100ac82>] system_call_fastpath+0x16/0x1b [ 134.915658] xhci_hcd 0000:02:00.0: USB bus 3 deregistered [ 134.916465] xhci_hcd 0000:02:00.0: PCI INT A disabled
and the same issue when xhci_suspend is invoked. (Note from Sarah: That's fixed by Andiry's patch before this, by synchronizing the irqs rather than freeing them on suspend.)
Do not run xhci_cleanup_msix with irq disabled.
This patch should be queued for the 2.6.37 stable tree.
--- drivers/usb/host/xhci.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/usb/host/xhci.c +4 -2
@@ -508,9 +508,10 @@ void xhci_stop(struct usb_hcd *hcd)spin_lock_irq (&xhci->lock);xhci_halt (xhci);xhci_reset (xhci); -xhci_cleanup_msix (xhci);spin_unlock_irq (&xhci->lock); +xhci_cleanup_msix (xhci); +#ifdef CONFIG_USB_XHCI_HCD_DEBUGGING /* Tell the event ring poll function not to reschedule */ xhci->zombie =1 ;
@@ -544,9 +545,10 @@ void xhci_shutdown(struct usb_hcd *hcd)spin_lock_irq (&xhci->lock);xhci_halt (xhci); -xhci_cleanup_msix (xhci);spin_unlock_irq (&xhci->lock); +xhci_cleanup_msix (xhci); +xhci_dbg (xhci,"xhci_shutdown completed - status = %x\n" ,xhci_readl (xhci, &xhci->op_regs->status)); }
PATCH 175/176 usb: Realloc xHCI structures after a hub is verified.
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Sarah Sharp <[email protected]>
commit 653a39d1f61bdc9f277766736d21d2e9be0391cb upstream.
When there's an xHCI host power loss after a suspend from memory, the USB core attempts to reset and verify the USB devices that are attached to the system. The xHCI driver has to reallocate those devices, since the hardware lost all knowledge of them during the power loss.
When a hub is plugged in, and the host loses power, the xHCI hardware structures are not updated to say the device is a hub. This is usually done in hub_configure() when the USB hub is detected. That function is skipped during a reset and verify by the USB core, since the core restores the old configuration and alternate settings, and the hub driver has no idea this happened. This bug makes the xHCI host controller reject the enumeration of low speed devices under the resumed hub.
Therefore, make the USB core re-setup the internal xHCI hub device information by calling update_hub_device() when hub_activate() is called for a hub reset resume. After a host power loss, all devices under the roothub get a reset-resume or a disconnect.
This patch should be queued for the 2.6.37 stable tree.
--- drivers/usb/core/hub.c | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+)
drivers/usb/core/hub.c +21 -0
@@ -677,6 +677,8 @@ static void hub_init_func3(struct work_sstatic void hub_activate (struct usb_hub *hub,enum hub_activation_type type) {struct usb_device *hdev = hub->hdev; +struct usb_hcd *hcd; +int ret;int port1;int status;bool need_debounce_delay = false;
@@ -715,6 +717,25 @@ static void hub_activate(struct usb_hubusb_autopm_get_interface_no_resume (to_usb_interface (hub->intfdev));return ;/* Continues at init2: below */ + }else if (type ==HUB_RESET_RESUME ) { +/* The internal host controller state for the hub device +* may be gone after a host power loss on system resume. +* Update the device's info so the HW knows it's a hub. +*/ + hcd =bus_to_hcd (hdev->bus); +if (hcd->driver->update_hub_device) { + ret = hcd->driver->update_hub_device (hcd, hdev, + &hub->tt,GFP_NOIO ); +if (ret <0 ) { +dev_err (hub->intfdev,"Host not " +"accepting hub info " +"update.\n" ); +dev_err (hub->intfdev,"LS/FS devices " +"and hubs may not work " +"under this hub\n." ); + } + } +hub_power_on (hub, true); }else {hub_power_on (hub, true); }
PATCH 176/176 xhci: Use GFP_NOIO during device reset.
In reply to Greg KH2.6.36-stable review patch. If anyone has any objections, please let us know.
------------------
From: Sarah Sharp <[email protected]>
commit a6d940dd759bf240d28624198660ed34582a327b upstream.
When xhci_discover_or_reset_device() is called after a host controller power loss, the virtual device may need to be reallocated. Make sure xhci_alloc_dev() uses GFP_NOIO. This avoid causing a deadlock by allowing the kernel to flush pending I/O while reallocating memory for a virtual device for a USB mass storage device that's holding the backing store for dirty memory buffers.
This patch should be queued for the 2.6.37 stable tree.
--- drivers/usb/host/xhci.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/usb/host/xhci.c +6 -2
@@ -2168,8 +2168,12 @@ int xhci_alloc_dev(struct usb_hcd *hcd,xhci_err (xhci,"Error while assigning device slot ID\n" );return 0 ; } -/* xhci_alloc_virt_device() does not touch rings; no need to lock */ -if (!xhci_alloc_virt_device (xhci, xhci->slot_id, udev,GFP_KERNEL )) { +/* xhci_alloc_virt_device() does not touch rings; no need to lock. +* Use GFP_NOIO, since this function can be called from +* xhci_discover_or_reset_device(), which may be called as part of +* mass storage driver error handling. +*/ +if (!xhci_alloc_virt_device (xhci, xhci->slot_id, udev,GFP_NOIO )) {/* Disable slot, if we can do it without mem alloc */ xhci_warn (xhci,"Could not allocate xHCI USB device data structures\n" );spin_lock_irqsave (&xhci->lock, flags);