From: Greg Kroah-Hartman Date: Fri, 21 Sep 2012 17:33:31 +0000 (-0700) Subject: 3.5-stable patches X-Git-Tag: v3.0.44~84 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=05273bbbe1ee2c0d2ff1248e3904d403997e69ed;p=thirdparty%2Fkernel%2Fstable-queue.git 3.5-stable patches added patches: alsa-hda-fix-missing-master-volume-for-stac9200-925x.patch alsa-hda-fix-oops-at-codec-reset-reconfig.patch alsa-hda-workaround-for-silent-output-on-vaio-z-with-alc889.patch alsa-ice1724-use-linear-scale-for-ak4396-volume-control.patch alsa-usb-audio-fix-bogus-error-messages-for-delay-accounting.patch arm-7496-1-hw_breakpoint-don-t-rely-on-dfsr-to-show-watchpoint-access-type.patch arm-7501-1-decompressor-reset-ttbcr-for-vmsa-armv7-cores.patch arm-7513-1-make-sure-dtc-is-built-before-running-it.patch arm-7526-1-traps-send-sigill-if-get_user-fails-on-undef-handling-path.patch arm-7527-1-uaccess-explicitly-check-__user-pointer-when-cpu_use_domains.patch arm-clk-imx25-fix-ssi-clock-registration.patch arm-clk-imx35-fix-ssi-clock-registration.patch arm-fix-ioremap-of-address-zero.patch arm-omap-timer-obey-the-config_omap_32k_timer.patch cciss-fix-handling-of-protocol-error.patch cpufreq-powernow-k8-workqueue-user-shouldn-t-migrate-the-kworker-to-another-cpu.patch ecryptfs-copy-up-attributes-of-the-lower-target-inode-after-rename.patch netconsole-remove-a-redundant-netconsole_target_put.patch staging-android-alarm-ioctl-command-encoding-fix.patch staging-comedi-amplc_pci224-fix-pci-ref-count.patch staging-comedi-das08-correct-ai-encoding-for-das08jr-16-ao.patch staging-comedi-das08-correct-ao-output-for-das08jr-16-ao.patch staging-r8712u-fix-bug-in-r8712_recv_indicatepkt.patch staging-speakup-fix-an-improperly-declared-variable.patch staging-vt6656-failed-connection-incorrect-endian.patch staging-zcache-fix-cleancache-race-condition-with-shrinker.patch target-fix-data_length-re-assignment-bug-with-scsi-overflow.patch target-simplify-code-around-transport_get_sense_data.patch usb-option-replace-zte-k5006-z-entry-with-vendor-class-rule.patch vfs-dcache-use-dcache_dentry_killed-instead-of-dcache_disconnected-in-d_kill.patch vfs-make-o_path-file-descriptors-usable-for-fstat.patch workqueue-reimplement-work_on_cpu-using-system_wq.patch --- diff --git a/queue-3.5/alsa-hda-fix-missing-master-volume-for-stac9200-925x.patch b/queue-3.5/alsa-hda-fix-missing-master-volume-for-stac9200-925x.patch new file mode 100644 index 00000000000..b1d274c8794 --- /dev/null +++ b/queue-3.5/alsa-hda-fix-missing-master-volume-for-stac9200-925x.patch @@ -0,0 +1,34 @@ +From ab548d2dba63ba947287965e525cc02a15d9853d Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Thu, 6 Sep 2012 10:10:11 +0200 +Subject: ALSA: hda - Fix missing Master volume for STAC9200/925x + +From: Takashi Iwai + +commit ab548d2dba63ba947287965e525cc02a15d9853d upstream. + +With the commit [2faa3bf: ALSA: hda - Rewrite the mute-LED hook with +vmaster hook in patch_sigmatel.c], the former Master volume control +was converted to PCM. This was supposed to be covered by the vmaster +control. But due to the lack of "PCM" slave definition, this didn't +happen properly. The patch fixes the missing entry. + +Reported-by: Andrew Shadura +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_sigmatel.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/pci/hda/patch_sigmatel.c ++++ b/sound/pci/hda/patch_sigmatel.c +@@ -1075,7 +1075,7 @@ static struct snd_kcontrol_new stac_smux + + static const char * const slave_pfxs[] = { + "Front", "Surround", "Center", "LFE", "Side", +- "Headphone", "Speaker", "IEC958", ++ "Headphone", "Speaker", "IEC958", "PCM", + NULL + }; + diff --git a/queue-3.5/alsa-hda-fix-oops-at-codec-reset-reconfig.patch b/queue-3.5/alsa-hda-fix-oops-at-codec-reset-reconfig.patch new file mode 100644 index 00000000000..58b8a9a8b6e --- /dev/null +++ b/queue-3.5/alsa-hda-fix-oops-at-codec-reset-reconfig.patch @@ -0,0 +1,45 @@ +From 07dc59f0988cb54fd87bd373b3b27eb2401dd811 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Mon, 10 Sep 2012 09:39:31 +0200 +Subject: ALSA: hda - Fix Oops at codec reset/reconfig + +From: Takashi Iwai + +commit 07dc59f0988cb54fd87bd373b3b27eb2401dd811 upstream. + +snd_hda_codec_reset() calls restore_pincfgs() where the codec is +powered up again, which eventually tries to resume and initialize via +the callbacks of the codec. However, it's the place just after codec +free callback, thus no codec callbacks should be called after that. +On a codec like CS4206, it results in Oops due to the access in init +callback. + +This patch fixes the issue by clearing the codec callbacks properly +after freeing codec. + +Reported-by: Daniel J Blueman +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/hda_codec.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/pci/hda/hda_codec.c ++++ b/sound/pci/hda/hda_codec.c +@@ -2325,6 +2325,7 @@ int snd_hda_codec_reset(struct hda_codec + } + if (codec->patch_ops.free) + codec->patch_ops.free(codec); ++ memset(&codec->patch_ops, 0, sizeof(codec->patch_ops)); + snd_hda_jack_tbl_clear(codec); + codec->proc_widget_hook = NULL; + codec->spec = NULL; +@@ -2340,7 +2341,6 @@ int snd_hda_codec_reset(struct hda_codec + codec->num_pcms = 0; + codec->pcm_info = NULL; + codec->preset = NULL; +- memset(&codec->patch_ops, 0, sizeof(codec->patch_ops)); + codec->slave_dig_outs = NULL; + codec->spdif_status_reset = 0; + module_put(codec->owner); diff --git a/queue-3.5/alsa-hda-workaround-for-silent-output-on-vaio-z-with-alc889.patch b/queue-3.5/alsa-hda-workaround-for-silent-output-on-vaio-z-with-alc889.patch new file mode 100644 index 00000000000..8c606cc8249 --- /dev/null +++ b/queue-3.5/alsa-hda-workaround-for-silent-output-on-vaio-z-with-alc889.patch @@ -0,0 +1,117 @@ +From tiwai@suse.de Fri Sep 21 10:24:28 2012 +From: Takashi Iwai +Date: Thu, 20 Sep 2012 07:44:11 +0200 +Subject: ALSA: hda - Workaround for silent output on VAIO Z with ALC889 +To: stable@vger.kernel.org +Cc: Adam Williamson +Message-ID: + +From: Takashi Iwai + +commit e427c2375646789ecd0ccaef1a1e41458559ab2d upstream. + +On recent kernels, Realtek codec parser tries to optimize the routing +aggressively and take the headphone output as primary at first. This +caused a regression on VAIO Z with ALC889, the silent output from the +speaker. + +The problem seems that the speaker pin must be connected to the first +DAC (0x02) on this machine by some reason although the codec itself +advertises the flexible routing with any DACs. + +This patch adds a fix-up for choosing the speaker pin as the primary +so that the right DAC is assigned on this device. + +Reported-and-tested-by: Adam Williamson +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + +--- + Documentation/sound/alsa/HD-Audio-Models.txt | 1 + + sound/pci/hda/patch_realtek.c | 22 +++++++++++++++++++++- + 2 files changed, 22 insertions(+), 1 deletion(-) + +--- a/Documentation/sound/alsa/HD-Audio-Models.txt ++++ b/Documentation/sound/alsa/HD-Audio-Models.txt +@@ -47,6 +47,7 @@ ALC882/883/885/888/889 + acer-aspire-4930g Acer Aspire 4930G/5930G/6530G/6930G/7730G + acer-aspire-8930g Acer Aspire 8330G/6935G + acer-aspire Acer Aspire others ++ no-primary-hp VAIO Z workaround (for fixed speaker DAC) + + ALC861/660 + ========== +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -201,6 +201,7 @@ struct alc_spec { + unsigned int vol_in_capsrc:1; /* use capsrc volume (ADC has no vol) */ + unsigned int parse_flags; /* passed to snd_hda_parse_pin_defcfg() */ + unsigned int shared_mic_hp:1; /* HP/Mic-in sharing */ ++ unsigned int no_primary_hp:1; /* Don't prefer HP pins to speaker pins */ + + /* auto-mute control */ + int automute_mode; +@@ -4182,7 +4183,8 @@ static int alc_parse_auto_config(struct + return 0; /* can't find valid BIOS pin config */ + } + +- if (cfg->line_out_type == AUTO_PIN_SPEAKER_OUT && ++ if (!spec->no_primary_hp && ++ cfg->line_out_type == AUTO_PIN_SPEAKER_OUT && + cfg->line_outs <= cfg->hp_outs) { + /* use HP as primary out */ + cfg->speaker_outs = cfg->line_outs; +@@ -4909,6 +4911,7 @@ enum { + ALC889_FIXUP_DAC_ROUTE, + ALC889_FIXUP_MBP_VREF, + ALC889_FIXUP_IMAC91_VREF, ++ ALC882_FIXUP_NO_PRIMARY_HP, + }; + + static void alc889_fixup_coef(struct hda_codec *codec, +@@ -5030,6 +5033,17 @@ static void alc889_fixup_imac91_vref(str + spec->keep_vref_in_automute = 1; + } + ++/* Don't take HP output as primary ++ * strangely, the speaker output doesn't work on VAIO Z through DAC 0x05 ++ */ ++static void alc882_fixup_no_primary_hp(struct hda_codec *codec, ++ const struct alc_fixup *fix, int action) ++{ ++ struct alc_spec *spec = codec->spec; ++ if (action == ALC_FIXUP_ACT_PRE_PROBE) ++ spec->no_primary_hp = 1; ++} ++ + static const struct alc_fixup alc882_fixups[] = { + [ALC882_FIXUP_ABIT_AW9D_MAX] = { + .type = ALC_FIXUP_PINS, +@@ -5212,6 +5226,10 @@ static const struct alc_fixup alc882_fix + .chained = true, + .chain_id = ALC882_FIXUP_GPIO1, + }, ++ [ALC882_FIXUP_NO_PRIMARY_HP] = { ++ .type = ALC_FIXUP_FUNC, ++ .v.func = alc882_fixup_no_primary_hp, ++ }, + }; + + static const struct snd_pci_quirk alc882_fixup_tbl[] = { +@@ -5246,6 +5264,7 @@ static const struct snd_pci_quirk alc882 + SND_PCI_QUIRK(0x1043, 0x1971, "Asus W2JC", ALC882_FIXUP_ASUS_W2JC), + SND_PCI_QUIRK(0x1043, 0x835f, "Asus Eee 1601", ALC888_FIXUP_EEE1601), + SND_PCI_QUIRK(0x104d, 0x9047, "Sony Vaio TT", ALC889_FIXUP_VAIO_TT), ++ SND_PCI_QUIRK(0x104d, 0x905a, "Sony Vaio Z", ALC882_FIXUP_NO_PRIMARY_HP), + + /* All Apple entries are in codec SSIDs */ + SND_PCI_QUIRK(0x106b, 0x00a0, "MacBookPro 3,1", ALC889_FIXUP_MBP_VREF), +@@ -5286,6 +5305,7 @@ static const struct alc_model_fixup alc8 + {.id = ALC882_FIXUP_ACER_ASPIRE_4930G, .name = "acer-aspire-4930g"}, + {.id = ALC882_FIXUP_ACER_ASPIRE_8930G, .name = "acer-aspire-8930g"}, + {.id = ALC883_FIXUP_ACER_EAPD, .name = "acer-aspire"}, ++ {.id = ALC882_FIXUP_NO_PRIMARY_HP, .name = "no-primary-hp"}, + {} + }; + diff --git a/queue-3.5/alsa-ice1724-use-linear-scale-for-ak4396-volume-control.patch b/queue-3.5/alsa-ice1724-use-linear-scale-for-ak4396-volume-control.patch new file mode 100644 index 00000000000..70a6c4d179a --- /dev/null +++ b/queue-3.5/alsa-ice1724-use-linear-scale-for-ak4396-volume-control.patch @@ -0,0 +1,41 @@ +From 3737e2be505d872bf2b3c1cd4151b2d2b413d7b5 Mon Sep 17 00:00:00 2001 +From: Matteo Frigo +Date: Wed, 12 Sep 2012 10:12:06 -0400 +Subject: ALSA: ice1724: Use linear scale for AK4396 volume control. + +From: Matteo Frigo + +commit 3737e2be505d872bf2b3c1cd4151b2d2b413d7b5 upstream. + +The AK4396 DAC has a linear-scale attentuator, but +sound/pci/ice1712/prodigy_hifi.c used a log scale instead, which is +not quite right. This patch restores the correct scale, borrowing +from the ak4396 code in sound/pci/oxygen/oxygen.c. + +Signed-off-by: Matteo Frigo +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/ice1712/prodigy_hifi.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/sound/pci/ice1712/prodigy_hifi.c ++++ b/sound/pci/ice1712/prodigy_hifi.c +@@ -297,6 +297,7 @@ static int ak4396_dac_vol_put(struct snd + } + + static const DECLARE_TLV_DB_SCALE(db_scale_wm_dac, -12700, 100, 1); ++static const DECLARE_TLV_DB_LINEAR(ak4396_db_scale, TLV_DB_GAIN_MUTE, 0); + + static struct snd_kcontrol_new prodigy_hd2_controls[] __devinitdata = { + { +@@ -307,7 +308,7 @@ static struct snd_kcontrol_new prodigy_h + .info = ak4396_dac_vol_info, + .get = ak4396_dac_vol_get, + .put = ak4396_dac_vol_put, +- .tlv = { .p = db_scale_wm_dac }, ++ .tlv = { .p = ak4396_db_scale }, + }, + }; + diff --git a/queue-3.5/alsa-usb-audio-fix-bogus-error-messages-for-delay-accounting.patch b/queue-3.5/alsa-usb-audio-fix-bogus-error-messages-for-delay-accounting.patch new file mode 100644 index 00000000000..ee6d797af1f --- /dev/null +++ b/queue-3.5/alsa-usb-audio-fix-bogus-error-messages-for-delay-accounting.patch @@ -0,0 +1,46 @@ +From 1213a205f9ed27d97de3d5bed28fb085ef4853e2 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Thu, 6 Sep 2012 14:58:00 +0200 +Subject: ALSA: usb-audio: Fix bogus error messages for delay accounting + +From: Takashi Iwai + +commit 1213a205f9ed27d97de3d5bed28fb085ef4853e2 upstream. + +The recent fix for the missing fine delayed time adjustment gives +strange error messages at each start of the playback stream, such as + delay: estimated 0, actual 352 + delay: estimated 353, actual 705 + +These come from the sanity check in retire_playback_urb(). Before the +stream is activated via start_endpoints(), a few silent packets have +been already sent. And at this point the delay account is still in +the state as if the new packets are just queued, so the driver gets +confused and spews the bogus error messages. + +For fixing the issue, we just need to check whether the received +packet is valid, whether it's zero sized or not. + +Reported-by: Markus Trippelsdorf +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/usb/pcm.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/sound/usb/pcm.c ++++ b/sound/usb/pcm.c +@@ -1140,6 +1140,12 @@ static void retire_playback_urb(struct s + int processed = urb->transfer_buffer_length / stride; + int est_delay; + ++ /* ignore the delay accounting when procssed=0 is given, i.e. ++ * silent payloads are procssed before handling the actual data ++ */ ++ if (!processed) ++ return; ++ + spin_lock_irqsave(&subs->lock, flags); + est_delay = snd_usb_pcm_delay(subs, runtime->rate); + /* update delay with exact number of samples played */ diff --git a/queue-3.5/arm-7496-1-hw_breakpoint-don-t-rely-on-dfsr-to-show-watchpoint-access-type.patch b/queue-3.5/arm-7496-1-hw_breakpoint-don-t-rely-on-dfsr-to-show-watchpoint-access-type.patch new file mode 100644 index 00000000000..9b665b0668f --- /dev/null +++ b/queue-3.5/arm-7496-1-hw_breakpoint-don-t-rely-on-dfsr-to-show-watchpoint-access-type.patch @@ -0,0 +1,107 @@ +From bf8801145c01ab600f8df66e8c879ac642fa5846 Mon Sep 17 00:00:00 2001 +From: Will Deacon +Date: Thu, 16 Aug 2012 18:55:44 +0100 +Subject: ARM: 7496/1: hw_breakpoint: don't rely on dfsr to show watchpoint access type + +From: Will Deacon + +commit bf8801145c01ab600f8df66e8c879ac642fa5846 upstream. + +From ARM debug architecture v7.1 onwards, a watchpoint exception causes +the DFAR to be updated with the faulting data address. However, DFSR.WnR +takes an UNKNOWN value and therefore cannot be used in general to +determine the access type that triggered the watchpoint. + +This patch forbids watchpoints without an overflow handler from +specifying a specific access type (load/store). Those with overflow +handlers must be able to handle false positives potentially triggered by +a watchpoint of a different access type on the same address. For +SIGTRAP-based handlers (i.e. ptrace), this should have no impact. + +Signed-off-by: Will Deacon +Signed-off-by: Russell King +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/kernel/hw_breakpoint.c | 55 +++++++++++++++++++++++++++++----------- + 1 file changed, 40 insertions(+), 15 deletions(-) + +--- a/arch/arm/kernel/hw_breakpoint.c ++++ b/arch/arm/kernel/hw_breakpoint.c +@@ -159,6 +159,12 @@ static int debug_arch_supported(void) + arch >= ARM_DEBUG_ARCH_V7_1; + } + ++/* Can we determine the watchpoint access type from the fsr? */ ++static int debug_exception_updates_fsr(void) ++{ ++ return 0; ++} ++ + /* Determine number of WRP registers available. */ + static int get_num_wrp_resources(void) + { +@@ -619,18 +625,35 @@ int arch_validate_hwbkpt_settings(struct + info->address &= ~alignment_mask; + info->ctrl.len <<= offset; + +- /* +- * Currently we rely on an overflow handler to take +- * care of single-stepping the breakpoint when it fires. +- * In the case of userspace breakpoints on a core with V7 debug, +- * we can use the mismatch feature as a poor-man's hardware +- * single-step, but this only works for per-task breakpoints. +- */ +- if (!bp->overflow_handler && (arch_check_bp_in_kernelspace(bp) || +- !core_has_mismatch_brps() || !bp->hw.bp_target)) { +- pr_warning("overflow handler required but none found\n"); +- ret = -EINVAL; ++ if (!bp->overflow_handler) { ++ /* ++ * Mismatch breakpoints are required for single-stepping ++ * breakpoints. ++ */ ++ if (!core_has_mismatch_brps()) ++ return -EINVAL; ++ ++ /* We don't allow mismatch breakpoints in kernel space. */ ++ if (arch_check_bp_in_kernelspace(bp)) ++ return -EPERM; ++ ++ /* ++ * Per-cpu breakpoints are not supported by our stepping ++ * mechanism. ++ */ ++ if (!bp->hw.bp_target) ++ return -EINVAL; ++ ++ /* ++ * We only support specific access types if the fsr ++ * reports them. ++ */ ++ if (!debug_exception_updates_fsr() && ++ (info->ctrl.type == ARM_BREAKPOINT_LOAD || ++ info->ctrl.type == ARM_BREAKPOINT_STORE)) ++ return -EINVAL; + } ++ + out: + return ret; + } +@@ -706,10 +729,12 @@ static void watchpoint_handler(unsigned + goto unlock; + + /* Check that the access type matches. */ +- access = (fsr & ARM_FSR_ACCESS_MASK) ? HW_BREAKPOINT_W : +- HW_BREAKPOINT_R; +- if (!(access & hw_breakpoint_type(wp))) +- goto unlock; ++ if (debug_exception_updates_fsr()) { ++ access = (fsr & ARM_FSR_ACCESS_MASK) ? ++ HW_BREAKPOINT_W : HW_BREAKPOINT_R; ++ if (!(access & hw_breakpoint_type(wp))) ++ goto unlock; ++ } + + /* We have a winner. */ + info->trigger = addr; diff --git a/queue-3.5/arm-7501-1-decompressor-reset-ttbcr-for-vmsa-armv7-cores.patch b/queue-3.5/arm-7501-1-decompressor-reset-ttbcr-for-vmsa-armv7-cores.patch new file mode 100644 index 00000000000..0a22d03fe68 --- /dev/null +++ b/queue-3.5/arm-7501-1-decompressor-reset-ttbcr-for-vmsa-armv7-cores.patch @@ -0,0 +1,47 @@ +From dbece45894d3ab1baac15a96dc4e1e8e23f64a93 Mon Sep 17 00:00:00 2001 +From: Will Deacon +Date: Fri, 24 Aug 2012 15:20:59 +0100 +Subject: ARM: 7501/1: decompressor: reset ttbcr for VMSA ARMv7 cores + +From: Will Deacon + +commit dbece45894d3ab1baac15a96dc4e1e8e23f64a93 upstream. + +When enabling the MMU for ARMv7 CPUs, the decompressor does not touch +the ttbcr register, assuming that it will be zeroed (N == 0, EAE == 0). +Given that only EAE is defined as 0 for non-secure copies of the +register (and a bootloader such as kexec may leave it set to 1 anyway), +we should ensure that we reset the register ourselves before turning on +the MMU. + +This patch zeroes TTBCR.EAE and TTBCR.N prior to enabling the MMU for +ARMv7 cores in the decompressor, configuring us exclusively for 32-bit +translation tables via TTBR0. + +Acked-by: Nicolas Pitre +Signed-off-by: Matthew Leach +Signed-off-by: Will Deacon +Signed-off-by: Russell King +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/boot/compressed/head.S | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/arch/arm/boot/compressed/head.S ++++ b/arch/arm/boot/compressed/head.S +@@ -659,10 +659,14 @@ __armv7_mmu_cache_on: + #ifdef CONFIG_CPU_ENDIAN_BE8 + orr r0, r0, #1 << 25 @ big-endian page tables + #endif ++ mrcne p15, 0, r6, c2, c0, 2 @ read ttb control reg + orrne r0, r0, #1 @ MMU enabled + movne r1, #0xfffffffd @ domain 0 = client ++ bic r6, r6, #1 << 31 @ 32-bit translation system ++ bic r6, r6, #3 << 0 @ use only ttbr0 + mcrne p15, 0, r3, c2, c0, 0 @ load page table pointer + mcrne p15, 0, r1, c3, c0, 0 @ load domain access control ++ mcrne p15, 0, r6, c2, c0, 2 @ load ttb control + #endif + mcr p15, 0, r0, c7, c5, 4 @ ISB + mcr p15, 0, r0, c1, c0, 0 @ load control register diff --git a/queue-3.5/arm-7513-1-make-sure-dtc-is-built-before-running-it.patch b/queue-3.5/arm-7513-1-make-sure-dtc-is-built-before-running-it.patch new file mode 100644 index 00000000000..4b1d8f14dcf --- /dev/null +++ b/queue-3.5/arm-7513-1-make-sure-dtc-is-built-before-running-it.patch @@ -0,0 +1,35 @@ +From 70b0476a2394de4f4e32e0b67288d80ff71ca963 Mon Sep 17 00:00:00 2001 +From: David Brown +Date: Tue, 4 Sep 2012 21:36:37 +0100 +Subject: ARM: 7513/1: Make sure dtc is built before running it + +From: David Brown + +commit 70b0476a2394de4f4e32e0b67288d80ff71ca963 upstream. + +'make dtbs' in a clean tree will try running the dtc before actually +building it. Make these rules depend upon the scripts to build it. + +Signed-off-by: David Brown +Signed-off-by: Russell King +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/Makefile | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/arm/Makefile ++++ b/arch/arm/Makefile +@@ -279,10 +279,10 @@ zImage Image xipImage bootpImage uImage: + zinstall uinstall install: vmlinux + $(Q)$(MAKE) $(build)=$(boot) MACHINE=$(MACHINE) $@ + +-%.dtb: ++%.dtb: scripts + $(Q)$(MAKE) $(build)=$(boot) MACHINE=$(MACHINE) $(boot)/$@ + +-dtbs: ++dtbs: scripts + $(Q)$(MAKE) $(build)=$(boot) MACHINE=$(MACHINE) $(boot)/$@ + + # We use MRPROPER_FILES and CLEAN_FILES now diff --git a/queue-3.5/arm-7526-1-traps-send-sigill-if-get_user-fails-on-undef-handling-path.patch b/queue-3.5/arm-7526-1-traps-send-sigill-if-get_user-fails-on-undef-handling-path.patch new file mode 100644 index 00000000000..40527957c71 --- /dev/null +++ b/queue-3.5/arm-7526-1-traps-send-sigill-if-get_user-fails-on-undef-handling-path.patch @@ -0,0 +1,54 @@ +From 2b2040af0b64cd93e5d4df2494c4486cf604090d Mon Sep 17 00:00:00 2001 +From: Will Deacon +Date: Fri, 7 Sep 2012 18:21:44 +0100 +Subject: ARM: 7526/1: traps: send SIGILL if get_user fails on undef handling path + +From: Will Deacon + +commit 2b2040af0b64cd93e5d4df2494c4486cf604090d upstream. + +get_user may fail to load from the provided __user address due to an +unhandled fault generated by the access. + +In the case of the undefined instruction trap, this results in failure +to load the faulting instruction, in which case we should send SIGILL to +the task rather than continue with potentially uninitialised data. + +Signed-off-by: Will Deacon +Signed-off-by: Russell King +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/kernel/traps.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +--- a/arch/arm/kernel/traps.c ++++ b/arch/arm/kernel/traps.c +@@ -388,20 +388,23 @@ asmlinkage void __exception do_undefinst + #endif + instr = *(u32 *) pc; + } else if (thumb_mode(regs)) { +- get_user(instr, (u16 __user *)pc); ++ if (get_user(instr, (u16 __user *)pc)) ++ goto die_sig; + if (is_wide_instruction(instr)) { + unsigned int instr2; +- get_user(instr2, (u16 __user *)pc+1); ++ if (get_user(instr2, (u16 __user *)pc+1)) ++ goto die_sig; + instr <<= 16; + instr |= instr2; + } +- } else { +- get_user(instr, (u32 __user *)pc); ++ } else if (get_user(instr, (u32 __user *)pc)) { ++ goto die_sig; + } + + if (call_undef_hook(regs, instr) == 0) + return; + ++die_sig: + #ifdef CONFIG_DEBUG_USER + if (user_debug & UDBG_UNDEFINED) { + printk(KERN_INFO "%s (%d): undefined instruction: pc=%p\n", diff --git a/queue-3.5/arm-7527-1-uaccess-explicitly-check-__user-pointer-when-cpu_use_domains.patch b/queue-3.5/arm-7527-1-uaccess-explicitly-check-__user-pointer-when-cpu_use_domains.patch new file mode 100644 index 00000000000..0b6bb2d9d78 --- /dev/null +++ b/queue-3.5/arm-7527-1-uaccess-explicitly-check-__user-pointer-when-cpu_use_domains.patch @@ -0,0 +1,241 @@ +From 8404663f81d212918ff85f493649a7991209fa04 Mon Sep 17 00:00:00 2001 +From: Russell King +Date: Fri, 7 Sep 2012 18:22:28 +0100 +Subject: ARM: 7527/1: uaccess: explicitly check __user pointer when !CPU_USE_DOMAINS + +From: Russell King + +commit 8404663f81d212918ff85f493649a7991209fa04 upstream. + +The {get,put}_user macros don't perform range checking on the provided +__user address when !CPU_HAS_DOMAINS. + +This patch reworks the out-of-line assembly accessors to check the user +address against a specified limit, returning -EFAULT if is is out of +range. + +[will: changed get_user register allocation to match put_user] +[rmk: fixed building on older ARM architectures] + +Reported-by: Catalin Marinas +Signed-off-by: Will Deacon +Signed-off-by: Russell King +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/include/asm/assembler.h | 8 +++++++ + arch/arm/include/asm/uaccess.h | 40 ++++++++++++++++++++++++++------------- + arch/arm/lib/getuser.S | 23 ++++++++++++++-------- + arch/arm/lib/putuser.S | 6 +++++ + 4 files changed, 56 insertions(+), 21 deletions(-) + +--- a/arch/arm/include/asm/assembler.h ++++ b/arch/arm/include/asm/assembler.h +@@ -320,4 +320,12 @@ + .size \name , . - \name + .endm + ++ .macro check_uaccess, addr:req, size:req, limit:req, tmp:req, bad:req ++#ifndef CONFIG_CPU_USE_DOMAINS ++ adds \tmp, \addr, #\size - 1 ++ sbcccs \tmp, \tmp, \limit ++ bcs \bad ++#endif ++ .endm ++ + #endif /* __ASM_ASSEMBLER_H__ */ +--- a/arch/arm/include/asm/uaccess.h ++++ b/arch/arm/include/asm/uaccess.h +@@ -101,28 +101,39 @@ extern int __get_user_1(void *); + extern int __get_user_2(void *); + extern int __get_user_4(void *); + +-#define __get_user_x(__r2,__p,__e,__s,__i...) \ ++#define __GUP_CLOBBER_1 "lr", "cc" ++#ifdef CONFIG_CPU_USE_DOMAINS ++#define __GUP_CLOBBER_2 "ip", "lr", "cc" ++#else ++#define __GUP_CLOBBER_2 "lr", "cc" ++#endif ++#define __GUP_CLOBBER_4 "lr", "cc" ++ ++#define __get_user_x(__r2,__p,__e,__l,__s) \ + __asm__ __volatile__ ( \ + __asmeq("%0", "r0") __asmeq("%1", "r2") \ ++ __asmeq("%3", "r1") \ + "bl __get_user_" #__s \ + : "=&r" (__e), "=r" (__r2) \ +- : "0" (__p) \ +- : __i, "cc") ++ : "0" (__p), "r" (__l) \ ++ : __GUP_CLOBBER_##__s) + + #define get_user(x,p) \ + ({ \ ++ unsigned long __limit = current_thread_info()->addr_limit - 1; \ + register const typeof(*(p)) __user *__p asm("r0") = (p);\ + register unsigned long __r2 asm("r2"); \ ++ register unsigned long __l asm("r1") = __limit; \ + register int __e asm("r0"); \ + switch (sizeof(*(__p))) { \ + case 1: \ +- __get_user_x(__r2, __p, __e, 1, "lr"); \ +- break; \ ++ __get_user_x(__r2, __p, __e, __l, 1); \ ++ break; \ + case 2: \ +- __get_user_x(__r2, __p, __e, 2, "r3", "lr"); \ ++ __get_user_x(__r2, __p, __e, __l, 2); \ + break; \ + case 4: \ +- __get_user_x(__r2, __p, __e, 4, "lr"); \ ++ __get_user_x(__r2, __p, __e, __l, 4); \ + break; \ + default: __e = __get_user_bad(); break; \ + } \ +@@ -135,31 +146,34 @@ extern int __put_user_2(void *, unsigned + extern int __put_user_4(void *, unsigned int); + extern int __put_user_8(void *, unsigned long long); + +-#define __put_user_x(__r2,__p,__e,__s) \ ++#define __put_user_x(__r2,__p,__e,__l,__s) \ + __asm__ __volatile__ ( \ + __asmeq("%0", "r0") __asmeq("%2", "r2") \ ++ __asmeq("%3", "r1") \ + "bl __put_user_" #__s \ + : "=&r" (__e) \ +- : "0" (__p), "r" (__r2) \ ++ : "0" (__p), "r" (__r2), "r" (__l) \ + : "ip", "lr", "cc") + + #define put_user(x,p) \ + ({ \ ++ unsigned long __limit = current_thread_info()->addr_limit - 1; \ + register const typeof(*(p)) __r2 asm("r2") = (x); \ + register const typeof(*(p)) __user *__p asm("r0") = (p);\ ++ register unsigned long __l asm("r1") = __limit; \ + register int __e asm("r0"); \ + switch (sizeof(*(__p))) { \ + case 1: \ +- __put_user_x(__r2, __p, __e, 1); \ ++ __put_user_x(__r2, __p, __e, __l, 1); \ + break; \ + case 2: \ +- __put_user_x(__r2, __p, __e, 2); \ ++ __put_user_x(__r2, __p, __e, __l, 2); \ + break; \ + case 4: \ +- __put_user_x(__r2, __p, __e, 4); \ ++ __put_user_x(__r2, __p, __e, __l, 4); \ + break; \ + case 8: \ +- __put_user_x(__r2, __p, __e, 8); \ ++ __put_user_x(__r2, __p, __e, __l, 8); \ + break; \ + default: __e = __put_user_bad(); break; \ + } \ +--- a/arch/arm/lib/getuser.S ++++ b/arch/arm/lib/getuser.S +@@ -16,8 +16,9 @@ + * __get_user_X + * + * Inputs: r0 contains the address ++ * r1 contains the address limit, which must be preserved + * Outputs: r0 is the error code +- * r2, r3 contains the zero-extended value ++ * r2 contains the zero-extended value + * lr corrupted + * + * No other registers must be altered. (see +@@ -27,33 +28,39 @@ + * Note also that it is intended that __get_user_bad is not global. + */ + #include ++#include + #include + #include + + ENTRY(__get_user_1) ++ check_uaccess r0, 1, r1, r2, __get_user_bad + 1: TUSER(ldrb) r2, [r0] + mov r0, #0 + mov pc, lr + ENDPROC(__get_user_1) + + ENTRY(__get_user_2) +-#ifdef CONFIG_THUMB2_KERNEL +-2: TUSER(ldrb) r2, [r0] +-3: TUSER(ldrb) r3, [r0, #1] ++ check_uaccess r0, 2, r1, r2, __get_user_bad ++#ifdef CONFIG_CPU_USE_DOMAINS ++rb .req ip ++2: ldrbt r2, [r0], #1 ++3: ldrbt rb, [r0], #0 + #else +-2: TUSER(ldrb) r2, [r0], #1 +-3: TUSER(ldrb) r3, [r0] ++rb .req r0 ++2: ldrb r2, [r0] ++3: ldrb rb, [r0, #1] + #endif + #ifndef __ARMEB__ +- orr r2, r2, r3, lsl #8 ++ orr r2, r2, rb, lsl #8 + #else +- orr r2, r3, r2, lsl #8 ++ orr r2, rb, r2, lsl #8 + #endif + mov r0, #0 + mov pc, lr + ENDPROC(__get_user_2) + + ENTRY(__get_user_4) ++ check_uaccess r0, 4, r1, r2, __get_user_bad + 4: TUSER(ldr) r2, [r0] + mov r0, #0 + mov pc, lr +--- a/arch/arm/lib/putuser.S ++++ b/arch/arm/lib/putuser.S +@@ -16,6 +16,7 @@ + * __put_user_X + * + * Inputs: r0 contains the address ++ * r1 contains the address limit, which must be preserved + * r2, r3 contains the value + * Outputs: r0 is the error code + * lr corrupted +@@ -27,16 +28,19 @@ + * Note also that it is intended that __put_user_bad is not global. + */ + #include ++#include + #include + #include + + ENTRY(__put_user_1) ++ check_uaccess r0, 1, r1, ip, __put_user_bad + 1: TUSER(strb) r2, [r0] + mov r0, #0 + mov pc, lr + ENDPROC(__put_user_1) + + ENTRY(__put_user_2) ++ check_uaccess r0, 2, r1, ip, __put_user_bad + mov ip, r2, lsr #8 + #ifdef CONFIG_THUMB2_KERNEL + #ifndef __ARMEB__ +@@ -60,12 +64,14 @@ ENTRY(__put_user_2) + ENDPROC(__put_user_2) + + ENTRY(__put_user_4) ++ check_uaccess r0, 4, r1, ip, __put_user_bad + 4: TUSER(str) r2, [r0] + mov r0, #0 + mov pc, lr + ENDPROC(__put_user_4) + + ENTRY(__put_user_8) ++ check_uaccess r0, 8, r1, ip, __put_user_bad + #ifdef CONFIG_THUMB2_KERNEL + 5: TUSER(str) r2, [r0] + 6: TUSER(str) r3, [r0, #4] diff --git a/queue-3.5/arm-clk-imx25-fix-ssi-clock-registration.patch b/queue-3.5/arm-clk-imx25-fix-ssi-clock-registration.patch new file mode 100644 index 00000000000..0b223cc4356 --- /dev/null +++ b/queue-3.5/arm-clk-imx25-fix-ssi-clock-registration.patch @@ -0,0 +1,42 @@ +From 912bfe76528c287bc4812521b8d53366954b39a5 Mon Sep 17 00:00:00 2001 +From: Fabio Estevam +Date: Sun, 19 Aug 2012 14:05:59 -0300 +Subject: ARM: clk-imx25: Fix SSI clock registration + +From: Fabio Estevam + +commit 912bfe76528c287bc4812521b8d53366954b39a5 upstream. + +SSI block has two types of clock: + +ipg: bus clock, the clock needed for accessing registers. +per: peripheral clock, the clock needed for generating the bit rate. + +Currently SSI driver only supports slave mode and only need to handle +the ipg clock, because the peripheral clock comes from the master codec. + +Only register the ipg clock and do not register the peripheral clock for ssi. + +Signed-off-by: Fabio Estevam +Signed-off-by: Sascha Hauer +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/mach-imx/clk-imx25.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +--- a/arch/arm/mach-imx/clk-imx25.c ++++ b/arch/arm/mach-imx/clk-imx25.c +@@ -222,10 +222,8 @@ int __init mx25_clocks_init(void) + clk_register_clkdev(clk[lcdc_ipg], "ipg", "imx-fb.0"); + clk_register_clkdev(clk[lcdc_ahb], "ahb", "imx-fb.0"); + clk_register_clkdev(clk[wdt_ipg], NULL, "imx2-wdt.0"); +- clk_register_clkdev(clk[ssi1_ipg_per], "per", "imx-ssi.0"); +- clk_register_clkdev(clk[ssi1_ipg], "ipg", "imx-ssi.0"); +- clk_register_clkdev(clk[ssi2_ipg_per], "per", "imx-ssi.1"); +- clk_register_clkdev(clk[ssi2_ipg], "ipg", "imx-ssi.1"); ++ clk_register_clkdev(clk[ssi1_ipg], NULL, "imx-ssi.0"); ++ clk_register_clkdev(clk[ssi2_ipg], NULL, "imx-ssi.1"); + clk_register_clkdev(clk[esdhc1_ipg_per], "per", "sdhci-esdhc-imx25.0"); + clk_register_clkdev(clk[esdhc1_ipg], "ipg", "sdhci-esdhc-imx25.0"); + clk_register_clkdev(clk[esdhc1_ahb], "ahb", "sdhci-esdhc-imx25.0"); diff --git a/queue-3.5/arm-clk-imx35-fix-ssi-clock-registration.patch b/queue-3.5/arm-clk-imx35-fix-ssi-clock-registration.patch new file mode 100644 index 00000000000..2bf865b232b --- /dev/null +++ b/queue-3.5/arm-clk-imx35-fix-ssi-clock-registration.patch @@ -0,0 +1,43 @@ +From 48540058612786d365602f3324ed97f9071092de Mon Sep 17 00:00:00 2001 +From: Fabio Estevam +Date: Mon, 20 Aug 2012 09:39:22 -0300 +Subject: ARM: clk-imx35: Fix SSI clock registration + +From: Fabio Estevam + +commit 48540058612786d365602f3324ed97f9071092de upstream. + +SSI block has two types of clock: + +ipg: bus clock, the clock needed for accessing registers. +per: peripheral clock, the clock needed for generating the bit rate. + +Currently SSI driver only supports slave mode and only need to handle +the ipg clock, because the peripheral clock comes from the master codec. + +Only register the ipg clock and do not register the peripheral clock for ssi. + +Signed-off-by: Fabio Estevam +Tested-by: Mark Brown +Signed-off-by: Sascha Hauer +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/mach-imx/clk-imx35.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +--- a/arch/arm/mach-imx/clk-imx35.c ++++ b/arch/arm/mach-imx/clk-imx35.c +@@ -230,10 +230,8 @@ int __init mx35_clocks_init() + clk_register_clkdev(clk[ipu_gate], NULL, "mx3_sdc_fb"); + clk_register_clkdev(clk[owire_gate], NULL, "mxc_w1"); + clk_register_clkdev(clk[sdma_gate], NULL, "imx35-sdma"); +- clk_register_clkdev(clk[ipg], "ipg", "imx-ssi.0"); +- clk_register_clkdev(clk[ssi1_div_post], "per", "imx-ssi.0"); +- clk_register_clkdev(clk[ipg], "ipg", "imx-ssi.1"); +- clk_register_clkdev(clk[ssi2_div_post], "per", "imx-ssi.1"); ++ clk_register_clkdev(clk[ssi1_gate], NULL, "imx-ssi.0"); ++ clk_register_clkdev(clk[ssi2_gate], NULL, "imx-ssi.1"); + /* i.mx35 has the i.mx21 type uart */ + clk_register_clkdev(clk[uart1_gate], "per", "imx21-uart.0"); + clk_register_clkdev(clk[ipg], "ipg", "imx21-uart.0"); diff --git a/queue-3.5/arm-fix-ioremap-of-address-zero.patch b/queue-3.5/arm-fix-ioremap-of-address-zero.patch new file mode 100644 index 00000000000..b058ae961bd --- /dev/null +++ b/queue-3.5/arm-fix-ioremap-of-address-zero.patch @@ -0,0 +1,84 @@ +From a849088aa1552b1a28eea3daff599ee22a734ae3 Mon Sep 17 00:00:00 2001 +From: Russell King +Date: Sat, 25 Aug 2012 09:03:15 +0100 +Subject: ARM: Fix ioremap() of address zero + +From: Russell King + +commit a849088aa1552b1a28eea3daff599ee22a734ae3 upstream. + +Murali Nalajala reports a regression that ioremapping address zero +results in an oops dump: + +Unable to handle kernel paging request at virtual address fa200000 +pgd = d4f80000 +[fa200000] *pgd=00000000 +Internal error: Oops: 5 [#1] PREEMPT SMP ARM +Modules linked in: +CPU: 0 Tainted: G W (3.4.0-g3b5f728-00009-g638207a #13) +PC is at msm_pm_config_rst_vector_before_pc+0x8/0x30 +LR is at msm_pm_boot_config_before_pc+0x18/0x20 +pc : [] lr : [] psr: a0000093 +sp : c0837ef0 ip : cfe00000 fp : 0000000d +r10: da7efc17 r9 : 225c4278 r8 : 00000006 +r7 : 0003c000 r6 : c085c824 r5 : 00000001 r4 : fa101000 +r3 : fa200000 r2 : c095080c r1 : 002250fc r0 : 00000000 +Flags: NzCv IRQs off FIQs on Mode SVC_32 ISA ARM Segment kernel +Control: 10c5387d Table: 25180059 DAC: 00000015 +[] (msm_pm_config_rst_vector_before_pc+0x8/0x30) from [] (msm_pm_boot_config_before_pc+0x18/0x20) +[] (msm_pm_boot_config_before_pc+0x18/0x20) from [] (msm_pm_power_collapse+0x410/0xb04) +[] (msm_pm_power_collapse+0x410/0xb04) from [] (arch_idle+0x294/0x3e0) +[] (arch_idle+0x294/0x3e0) from [] (default_idle+0x18/0x2c) +[] (default_idle+0x18/0x2c) from [] (cpu_idle+0x90/0xe4) +[] (cpu_idle+0x90/0xe4) from [] (rest_init+0x88/0xa0) +[] (rest_init+0x88/0xa0) from [] (start_kernel+0x3a8/0x40c) +Code: c0704256 e12fff1e e59f2020 e5923000 (e5930000) + +This is caused by the 'reserved' entries which we insert (see +19b52abe3c5d7 - ARM: 7438/1: fill possible PMD empty section gaps) +which get matched for physical address zero. + +Resolve this by marking these reserved entries with a different flag. + +Tested-by: Murali Nalajala +Acked-by: Nicolas Pitre +Signed-off-by: Russell King +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/mm/mm.h | 3 +++ + arch/arm/mm/mmu.c | 4 ++-- + 2 files changed, 5 insertions(+), 2 deletions(-) + +--- a/arch/arm/mm/mm.h ++++ b/arch/arm/mm/mm.h +@@ -55,6 +55,9 @@ extern void __flush_dcache_page(struct a + /* permanent static mappings from iotable_init() */ + #define VM_ARM_STATIC_MAPPING 0x40000000 + ++/* empty mapping */ ++#define VM_ARM_EMPTY_MAPPING 0x20000000 ++ + /* mapping type (attributes) for permanent static mappings */ + #define VM_ARM_MTYPE(mt) ((mt) << 20) + #define VM_ARM_MTYPE_MASK (0x1f << 20) +--- a/arch/arm/mm/mmu.c ++++ b/arch/arm/mm/mmu.c +@@ -813,7 +813,7 @@ static void __init pmd_empty_section_gap + vm = early_alloc_aligned(sizeof(*vm), __alignof__(*vm)); + vm->addr = (void *)addr; + vm->size = SECTION_SIZE; +- vm->flags = VM_IOREMAP | VM_ARM_STATIC_MAPPING; ++ vm->flags = VM_IOREMAP | VM_ARM_EMPTY_MAPPING; + vm->caller = pmd_empty_section_gap; + vm_area_add_early(vm); + } +@@ -826,7 +826,7 @@ static void __init fill_pmd_gaps(void) + + /* we're still single threaded hence no lock needed here */ + for (vm = vmlist; vm; vm = vm->next) { +- if (!(vm->flags & VM_ARM_STATIC_MAPPING)) ++ if (!(vm->flags & (VM_ARM_STATIC_MAPPING | VM_ARM_EMPTY_MAPPING))) + continue; + addr = (unsigned long)vm->addr; + if (addr < next) diff --git a/queue-3.5/arm-omap-timer-obey-the-config_omap_32k_timer.patch b/queue-3.5/arm-omap-timer-obey-the-config_omap_32k_timer.patch new file mode 100644 index 00000000000..20471a6334f --- /dev/null +++ b/queue-3.5/arm-omap-timer-obey-the-config_omap_32k_timer.patch @@ -0,0 +1,48 @@ +From 45caae74d238ef6583e9402cb8c550cc0b0f7dbd Mon Sep 17 00:00:00 2001 +From: Igor Grinberg +Date: Tue, 28 Aug 2012 01:26:14 +0300 +Subject: ARM: OMAP: timer: obey the !CONFIG_OMAP_32K_TIMER + +From: Igor Grinberg + +commit 45caae74d238ef6583e9402cb8c550cc0b0f7dbd upstream. + +Currently, omap2_sync32k_clocksource_init() function initializes the 32K +timer as the system clock source regardless of the CONFIG_OMAP_32K_TIMER +setting. +Fix this by providing a default implementation for +!CONFIG_OMAP_32K_TIMER case. + +Signed-off-by: Igor Grinberg +Reviewed-by: Paul Walmsley +Acked-by: Santosh Shilimkar +Signed-off-by: Tony Lindgren +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/mach-omap2/timer.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/arch/arm/mach-omap2/timer.c ++++ b/arch/arm/mach-omap2/timer.c +@@ -263,6 +263,7 @@ static u32 notrace dmtimer_read_sched_cl + return 0; + } + ++#ifdef CONFIG_OMAP_32K_TIMER + /* Setup free-running counter for clocksource */ + static int __init omap2_sync32k_clocksource_init(void) + { +@@ -302,6 +303,12 @@ static int __init omap2_sync32k_clocksou + + return ret; + } ++#else ++static inline int omap2_sync32k_clocksource_init(void) ++{ ++ return -ENODEV; ++} ++#endif + + static void __init omap2_gptimer_clocksource_init(int gptimer_id, + const char *fck_source) diff --git a/queue-3.5/cciss-fix-handling-of-protocol-error.patch b/queue-3.5/cciss-fix-handling-of-protocol-error.patch new file mode 100644 index 00000000000..23f9f5f2fc7 --- /dev/null +++ b/queue-3.5/cciss-fix-handling-of-protocol-error.patch @@ -0,0 +1,35 @@ +From 2453f5f992717251cfadab6184fbb3ec2f2e8b40 Mon Sep 17 00:00:00 2001 +From: "Stephen M. Cameron" +Date: Fri, 14 Sep 2012 16:35:10 -0500 +Subject: cciss: fix handling of protocol error + +From: "Stephen M. Cameron" + +commit 2453f5f992717251cfadab6184fbb3ec2f2e8b40 upstream. + +If a command completes with a status of CMD_PROTOCOL_ERR, this +information should be conveyed to the SCSI mid layer, not dropped +on the floor. Unlike a similar bug in the hpsa driver, this bug +only affects tape drives and CD and DVD ROM drives in the cciss +driver, and to induce it, you have to disconnect (or damage) a +cable, so it is not a very likely scenario (which would explain +why the bug has gone undetected for the last 10 years.) + +Signed-off-by: Stephen M. Cameron +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/block/cciss_scsi.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/block/cciss_scsi.c ++++ b/drivers/block/cciss_scsi.c +@@ -795,6 +795,7 @@ static void complete_scsi_command(Comman + } + break; + case CMD_PROTOCOL_ERR: ++ cmd->result = DID_ERROR << 16; + dev_warn(&h->pdev->dev, + "%p has protocol error\n", c); + break; diff --git a/queue-3.5/cpufreq-powernow-k8-workqueue-user-shouldn-t-migrate-the-kworker-to-another-cpu.patch b/queue-3.5/cpufreq-powernow-k8-workqueue-user-shouldn-t-migrate-the-kworker-to-another-cpu.patch new file mode 100644 index 00000000000..940e6425007 --- /dev/null +++ b/queue-3.5/cpufreq-powernow-k8-workqueue-user-shouldn-t-migrate-the-kworker-to-another-cpu.patch @@ -0,0 +1,169 @@ +From 6889125b8b4e09c5e53e6ecab3433bed1ce198c9 Mon Sep 17 00:00:00 2001 +From: Tejun Heo +Date: Tue, 18 Sep 2012 14:24:59 -0700 +Subject: cpufreq/powernow-k8: workqueue user shouldn't migrate the kworker to another CPU + +From: Tejun Heo + +commit 6889125b8b4e09c5e53e6ecab3433bed1ce198c9 upstream. + +powernowk8_target() runs off a per-cpu work item and if the +cpufreq_policy->cpu is different from the current one, it migrates the +kworker to the target CPU by manipulating current->cpus_allowed. The +function migrates the kworker back to the original CPU but this is +still broken. Workqueue concurrency management requires the kworkers +to stay on the same CPU and powernowk8_target() ends up triggerring +BUG_ON(rq != this_rq()) in try_to_wake_up_local() if it contends on +fidvid_mutex and sleeps. + +It is unclear why this bug is being reported now. Duncan says it +appeared to be a regression of 3.6-rc1 and couldn't reproduce it on +3.5. Bisection seemed to point to 63d95a91 "workqueue: use @pool +instead of @gcwq or @cpu where applicable" which is an non-functional +change. Given that the reproduce case sometimes took upto days to +trigger, it's easy to be misled while bisecting. Maybe something made +contention on fidvid_mutex more likely? I don't know. + +This patch fixes the bug by using work_on_cpu() instead if @pol->cpu +isn't the same as the current one. The code assumes that +cpufreq_policy->cpu is kept online by the caller, which Rafael tells +me is the case. + +stable: ed48ece27c ("workqueue: reimplement work_on_cpu() using + system_wq") should be applied before this; otherwise, the + behavior could be horrible. + +Signed-off-by: Tejun Heo +Reported-by: Duncan <1i5t5.duncan@cox.net> +Tested-by: Duncan <1i5t5.duncan@cox.net> +Cc: Rafael J. Wysocki +Cc: Andreas Herrmann +Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=47301 +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/cpufreq/powernow-k8.c | 63 ++++++++++++++++++++++-------------------- + 1 file changed, 34 insertions(+), 29 deletions(-) + +--- a/drivers/cpufreq/powernow-k8.c ++++ b/drivers/cpufreq/powernow-k8.c +@@ -35,7 +35,6 @@ + #include + #include + #include +-#include /* for current / set_cpus_allowed() */ + #include + #include + +@@ -1139,16 +1138,23 @@ static int transition_frequency_pstate(s + return res; + } + +-/* Driver entry point to switch to the target frequency */ +-static int powernowk8_target(struct cpufreq_policy *pol, +- unsigned targfreq, unsigned relation) ++struct powernowk8_target_arg { ++ struct cpufreq_policy *pol; ++ unsigned targfreq; ++ unsigned relation; ++}; ++ ++static long powernowk8_target_fn(void *arg) + { +- cpumask_var_t oldmask; ++ struct powernowk8_target_arg *pta = arg; ++ struct cpufreq_policy *pol = pta->pol; ++ unsigned targfreq = pta->targfreq; ++ unsigned relation = pta->relation; + struct powernow_k8_data *data = per_cpu(powernow_data, pol->cpu); + u32 checkfid; + u32 checkvid; + unsigned int newstate; +- int ret = -EIO; ++ int ret; + + if (!data) + return -EINVAL; +@@ -1156,29 +1162,16 @@ static int powernowk8_target(struct cpuf + checkfid = data->currfid; + checkvid = data->currvid; + +- /* only run on specific CPU from here on. */ +- /* This is poor form: use a workqueue or smp_call_function_single */ +- if (!alloc_cpumask_var(&oldmask, GFP_KERNEL)) +- return -ENOMEM; +- +- cpumask_copy(oldmask, tsk_cpus_allowed(current)); +- set_cpus_allowed_ptr(current, cpumask_of(pol->cpu)); +- +- if (smp_processor_id() != pol->cpu) { +- printk(KERN_ERR PFX "limiting to cpu %u failed\n", pol->cpu); +- goto err_out; +- } +- + if (pending_bit_stuck()) { + printk(KERN_ERR PFX "failing targ, change pending bit set\n"); +- goto err_out; ++ return -EIO; + } + + pr_debug("targ: cpu %d, %d kHz, min %d, max %d, relation %d\n", + pol->cpu, targfreq, pol->min, pol->max, relation); + + if (query_current_values_with_pending_wait(data)) +- goto err_out; ++ return -EIO; + + if (cpu_family != CPU_HW_PSTATE) { + pr_debug("targ: curr fid 0x%x, vid 0x%x\n", +@@ -1196,7 +1189,7 @@ static int powernowk8_target(struct cpuf + + if (cpufreq_frequency_table_target(pol, data->powernow_table, + targfreq, relation, &newstate)) +- goto err_out; ++ return -EIO; + + mutex_lock(&fidvid_mutex); + +@@ -1209,9 +1202,8 @@ static int powernowk8_target(struct cpuf + ret = transition_frequency_fidvid(data, newstate); + if (ret) { + printk(KERN_ERR PFX "transition frequency failed\n"); +- ret = 1; + mutex_unlock(&fidvid_mutex); +- goto err_out; ++ return 1; + } + mutex_unlock(&fidvid_mutex); + +@@ -1220,12 +1212,25 @@ static int powernowk8_target(struct cpuf + data->powernow_table[newstate].index); + else + pol->cur = find_khz_freq_from_fid(data->currfid); +- ret = 0; + +-err_out: +- set_cpus_allowed_ptr(current, oldmask); +- free_cpumask_var(oldmask); +- return ret; ++ return 0; ++} ++ ++/* Driver entry point to switch to the target frequency */ ++static int powernowk8_target(struct cpufreq_policy *pol, ++ unsigned targfreq, unsigned relation) ++{ ++ struct powernowk8_target_arg pta = { .pol = pol, .targfreq = targfreq, ++ .relation = relation }; ++ ++ /* ++ * Must run on @pol->cpu. cpufreq core is responsible for ensuring ++ * that we're bound to the current CPU and pol->cpu stays online. ++ */ ++ if (smp_processor_id() == pol->cpu) ++ return powernowk8_target_fn(&pta); ++ else ++ return work_on_cpu(pol->cpu, powernowk8_target_fn, &pta); + } + + /* Driver entry point to verify the policy and range of frequencies */ diff --git a/queue-3.5/ecryptfs-copy-up-attributes-of-the-lower-target-inode-after-rename.patch b/queue-3.5/ecryptfs-copy-up-attributes-of-the-lower-target-inode-after-rename.patch new file mode 100644 index 00000000000..d1ff50360dc --- /dev/null +++ b/queue-3.5/ecryptfs-copy-up-attributes-of-the-lower-target-inode-after-rename.patch @@ -0,0 +1,62 @@ +From 8335eafc2859e1a26282bef7c3d19f3d68868b8a Mon Sep 17 00:00:00 2001 +From: Tyler Hicks +Date: Thu, 13 Sep 2012 12:00:56 -0700 +Subject: eCryptfs: Copy up attributes of the lower target inode after rename + +From: Tyler Hicks + +commit 8335eafc2859e1a26282bef7c3d19f3d68868b8a upstream. + +After calling into the lower filesystem to do a rename, the lower target +inode's attributes were not copied up to the eCryptfs target inode. This +resulted in the eCryptfs target inode staying around, rather than being +evicted, because i_nlink was not updated for the eCryptfs inode. This +also meant that eCryptfs didn't do the final iput() on the lower target +inode so it stayed around, as well. This would result in a failure to +free up space occupied by the target file in the rename() operation. +Both target inodes would eventually be evicted when the eCryptfs +filesystem was unmounted. + +This patch calls fsstack_copy_attr_all() after the lower filesystem +does its ->rename() so that important inode attributes, such as i_nlink, +are updated at the eCryptfs layer. ecryptfs_evict_inode() is now called +and eCryptfs can drop its final reference on the lower inode. + +http://launchpad.net/bugs/561129 + +Signed-off-by: Tyler Hicks +Tested-by: Colin Ian King +Signed-off-by: Greg Kroah-Hartman + +--- + fs/ecryptfs/inode.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/fs/ecryptfs/inode.c ++++ b/fs/ecryptfs/inode.c +@@ -621,6 +621,7 @@ ecryptfs_rename(struct inode *old_dir, s + struct dentry *lower_old_dir_dentry; + struct dentry *lower_new_dir_dentry; + struct dentry *trap = NULL; ++ struct inode *target_inode; + + lower_old_dentry = ecryptfs_dentry_to_lower(old_dentry); + lower_new_dentry = ecryptfs_dentry_to_lower(new_dentry); +@@ -628,6 +629,7 @@ ecryptfs_rename(struct inode *old_dir, s + dget(lower_new_dentry); + lower_old_dir_dentry = dget_parent(lower_old_dentry); + lower_new_dir_dentry = dget_parent(lower_new_dentry); ++ target_inode = new_dentry->d_inode; + trap = lock_rename(lower_old_dir_dentry, lower_new_dir_dentry); + /* source should not be ancestor of target */ + if (trap == lower_old_dentry) { +@@ -643,6 +645,9 @@ ecryptfs_rename(struct inode *old_dir, s + lower_new_dir_dentry->d_inode, lower_new_dentry); + if (rc) + goto out_lock; ++ if (target_inode) ++ fsstack_copy_attr_all(target_inode, ++ ecryptfs_inode_to_lower(target_inode)); + fsstack_copy_attr_all(new_dir, lower_new_dir_dentry->d_inode); + if (new_dir != old_dir) + fsstack_copy_attr_all(old_dir, lower_old_dir_dentry->d_inode); diff --git a/queue-3.5/netconsole-remove-a-redundant-netconsole_target_put.patch b/queue-3.5/netconsole-remove-a-redundant-netconsole_target_put.patch new file mode 100644 index 00000000000..d2ba0eb8aac --- /dev/null +++ b/queue-3.5/netconsole-remove-a-redundant-netconsole_target_put.patch @@ -0,0 +1,39 @@ +From 72d3eb13b5c0abe7d63efac41f39c5b644c7bbaa Mon Sep 17 00:00:00 2001 +From: Amerigo Wang +Date: Sat, 18 Aug 2012 07:02:20 +0000 +Subject: netconsole: remove a redundant netconsole_target_put() + +From: Amerigo Wang + +commit 72d3eb13b5c0abe7d63efac41f39c5b644c7bbaa upstream. + +This netconsole_target_put() is obviously redundant, and it +causes a kernel segfault when removing a bridge device which has +netconsole running on it. + +This is caused by: + + commit 8d8fc29d02a33e4bd5f4fa47823c1fd386346093 + Author: Amerigo Wang + Date: Thu May 19 21:39:10 2011 +0000 + + netpoll: disable netpoll when enslave a device + +Signed-off-by: Cong Wang +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/netconsole.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/drivers/net/netconsole.c ++++ b/drivers/net/netconsole.c +@@ -648,7 +648,6 @@ static int netconsole_netdev_event(struc + flags); + dev_put(nt->np.dev); + nt->np.dev = NULL; +- netconsole_target_put(nt); + } + nt->enabled = 0; + stopped = true; diff --git a/queue-3.5/series b/queue-3.5/series index 2afc54c3cb8..7d824f53fe8 100644 --- a/queue-3.5/series +++ b/queue-3.5/series @@ -32,3 +32,35 @@ net-ipv4-ipmr_expire_timer-causes-crash-when-removing-net-namespace.patch bnx2x-fix-57840_mf-pci-id.patch cs89x0-packet-reception-not-working.patch openvswitch-reset-upper-layer-protocol-info-on-internal-devices.patch +workqueue-reimplement-work_on_cpu-using-system_wq.patch +cpufreq-powernow-k8-workqueue-user-shouldn-t-migrate-the-kworker-to-another-cpu.patch +cciss-fix-handling-of-protocol-error.patch +vfs-make-o_path-file-descriptors-usable-for-fstat.patch +vfs-dcache-use-dcache_dentry_killed-instead-of-dcache_disconnected-in-d_kill.patch +netconsole-remove-a-redundant-netconsole_target_put.patch +ecryptfs-copy-up-attributes-of-the-lower-target-inode-after-rename.patch +target-fix-data_length-re-assignment-bug-with-scsi-overflow.patch +target-simplify-code-around-transport_get_sense_data.patch +arm-7496-1-hw_breakpoint-don-t-rely-on-dfsr-to-show-watchpoint-access-type.patch +arm-7501-1-decompressor-reset-ttbcr-for-vmsa-armv7-cores.patch +arm-7513-1-make-sure-dtc-is-built-before-running-it.patch +arm-7526-1-traps-send-sigill-if-get_user-fails-on-undef-handling-path.patch +arm-7527-1-uaccess-explicitly-check-__user-pointer-when-cpu_use_domains.patch +staging-android-alarm-ioctl-command-encoding-fix.patch +arm-omap-timer-obey-the-config_omap_32k_timer.patch +arm-clk-imx25-fix-ssi-clock-registration.patch +arm-clk-imx35-fix-ssi-clock-registration.patch +arm-fix-ioremap-of-address-zero.patch +alsa-hda-fix-missing-master-volume-for-stac9200-925x.patch +alsa-usb-audio-fix-bogus-error-messages-for-delay-accounting.patch +alsa-hda-fix-oops-at-codec-reset-reconfig.patch +alsa-ice1724-use-linear-scale-for-ak4396-volume-control.patch +alsa-hda-workaround-for-silent-output-on-vaio-z-with-alc889.patch +staging-speakup-fix-an-improperly-declared-variable.patch +staging-zcache-fix-cleancache-race-condition-with-shrinker.patch +staging-vt6656-failed-connection-incorrect-endian.patch +staging-r8712u-fix-bug-in-r8712_recv_indicatepkt.patch +staging-comedi-amplc_pci224-fix-pci-ref-count.patch +staging-comedi-das08-correct-ao-output-for-das08jr-16-ao.patch +staging-comedi-das08-correct-ai-encoding-for-das08jr-16-ao.patch +usb-option-replace-zte-k5006-z-entry-with-vendor-class-rule.patch diff --git a/queue-3.5/staging-android-alarm-ioctl-command-encoding-fix.patch b/queue-3.5/staging-android-alarm-ioctl-command-encoding-fix.patch new file mode 100644 index 00000000000..35ddc4b494a --- /dev/null +++ b/queue-3.5/staging-android-alarm-ioctl-command-encoding-fix.patch @@ -0,0 +1,35 @@ +From 6bd4a5d96c08dc2380f8053b1bd4f879f55cd3c9 Mon Sep 17 00:00:00 2001 +From: "Dae S. Kim" +Date: Fri, 31 Aug 2012 02:00:51 +0200 +Subject: Staging: Android alarm: IOCTL command encoding fix + +From: "Dae S. Kim" + +commit 6bd4a5d96c08dc2380f8053b1bd4f879f55cd3c9 upstream. + +Fixed a bug. Data was being written to user space using an IOCTL +command encoded with _IOC_WRITE access mode. + +Signed-off-by: Dae S. Kim +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/android/android_alarm.h | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/staging/android/android_alarm.h ++++ b/drivers/staging/android/android_alarm.h +@@ -51,10 +51,12 @@ enum android_alarm_return_flags { + #define ANDROID_ALARM_WAIT _IO('a', 1) + + #define ALARM_IOW(c, type, size) _IOW('a', (c) | ((type) << 4), size) ++#define ALARM_IOR(c, type, size) _IOR('a', (c) | ((type) << 4), size) ++ + /* Set alarm */ + #define ANDROID_ALARM_SET(type) ALARM_IOW(2, type, struct timespec) + #define ANDROID_ALARM_SET_AND_WAIT(type) ALARM_IOW(3, type, struct timespec) +-#define ANDROID_ALARM_GET_TIME(type) ALARM_IOW(4, type, struct timespec) ++#define ANDROID_ALARM_GET_TIME(type) ALARM_IOR(4, type, struct timespec) + #define ANDROID_ALARM_SET_RTC _IOW('a', 5, struct timespec) + #define ANDROID_ALARM_BASE_CMD(cmd) (cmd & ~(_IOC(0, 0, 0xf0, 0))) + #define ANDROID_ALARM_IOCTL_TO_TYPE(cmd) (_IOC_NR(cmd) >> 4) diff --git a/queue-3.5/staging-comedi-amplc_pci224-fix-pci-ref-count.patch b/queue-3.5/staging-comedi-amplc_pci224-fix-pci-ref-count.patch new file mode 100644 index 00000000000..eb7f50f7209 --- /dev/null +++ b/queue-3.5/staging-comedi-amplc_pci224-fix-pci-ref-count.patch @@ -0,0 +1,48 @@ +From cadf84bfeb80e216fde328d357fe856160157d2c Mon Sep 17 00:00:00 2001 +From: Ian Abbott +Date: Mon, 3 Sep 2012 16:39:38 +0100 +Subject: staging: comedi: amplc_pci224: Fix PCI ref count + +From: Ian Abbott + +commit cadf84bfeb80e216fde328d357fe856160157d2c upstream. + +When attaching a PCI device manually via the comedi driver `attach` hook +(`pci224_attach()`) (called by the comedi core for the +`COMEDI_DEVCONFIG` ioctl), its reference count is incremented in the +`for_each_pci_dev` loop (in `pci224_find_pci_dev()`). It is decremented +when the `detach` hook (`pci224_detach()`) is called to detach the +device. However, when the PCI device is attached automatically via the +`attach_pci` hook (`pci224_attach_pci()`, called at probe time via +`comedi_pci_auto_config()`) it's reference count is not incremented so +there will be an unmatched decrement when detaching the device. + +Increment the PCI device reference count in `pci224_attach_pci()` to +correct the mismatch. + +Once support for manual configuration has been removed from this driver, +the calls to `pci_dev_get()` and `pci_dev_put()` can be removed. + +Signed-off-by: Ian Abbott +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/comedi/drivers/amplc_pci224.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/staging/comedi/drivers/amplc_pci224.c ++++ b/drivers/staging/comedi/drivers/amplc_pci224.c +@@ -1519,6 +1519,13 @@ pci224_attach_pci(struct comedi_device * + dev->minor, DRIVER_NAME); + return -EINVAL; + } ++ /* ++ * Need to 'get' the PCI device to match the 'put' in pci224_detach(). ++ * TODO: Remove the pci_dev_get() and matching pci_dev_put() once ++ * support for manual attachment of PCI devices via pci224_attach() ++ * has been removed. ++ */ ++ pci_dev_get(pci_dev); + return pci224_attach_common(dev, pci_dev, NULL); + } + diff --git a/queue-3.5/staging-comedi-das08-correct-ai-encoding-for-das08jr-16-ao.patch b/queue-3.5/staging-comedi-das08-correct-ai-encoding-for-das08jr-16-ao.patch new file mode 100644 index 00000000000..0225c55046b --- /dev/null +++ b/queue-3.5/staging-comedi-das08-correct-ai-encoding-for-das08jr-16-ao.patch @@ -0,0 +1,38 @@ +From e6391a182865efc896cb2a8d79e07b7ac2f45b48 Mon Sep 17 00:00:00 2001 +From: Ian Abbott +Date: Fri, 31 Aug 2012 20:41:29 +0100 +Subject: staging: comedi: das08: Correct AI encoding for das08jr-16-ao + +From: Ian Abbott + +commit e6391a182865efc896cb2a8d79e07b7ac2f45b48 upstream. + +The element of `das08_boards[]` for the 'das08jr-16-ao' board has the +`ai_encoding` member set to `das08_encode12`. It should be set to +`das08_encode16` same as the 'das08jr/16' board. After all, this board +has 16-bit AI resolution. + +The description of the A/D LSB register at offset 0 seems incorrect in +the user manual "cio-das08jr-16-ao.pdf" as it implies that the AI +resolution is only 12 bits. The diagrams of the A/D LSB and MSB +registers show 15 data bits and a sign bit, which matches what the +software expects for the `das08_encode16` AI encoding method. + +Signed-off-by: Ian Abbott +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/comedi/drivers/das08.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/staging/comedi/drivers/das08.c ++++ b/drivers/staging/comedi/drivers/das08.c +@@ -403,7 +403,7 @@ static const struct das08_board_struct d + .ai = das08_ai_rinsn, + .ai_nbits = 16, + .ai_pg = das08_pg_none, +- .ai_encoding = das08_encode12, ++ .ai_encoding = das08_encode16, + .ao = das08jr_ao_winsn, + .ao_nbits = 16, + .di = das08jr_di_rbits, diff --git a/queue-3.5/staging-comedi-das08-correct-ao-output-for-das08jr-16-ao.patch b/queue-3.5/staging-comedi-das08-correct-ao-output-for-das08jr-16-ao.patch new file mode 100644 index 00000000000..9686807e5f3 --- /dev/null +++ b/queue-3.5/staging-comedi-das08-correct-ao-output-for-das08jr-16-ao.patch @@ -0,0 +1,31 @@ +From 61ed59ed09e6ad2b8395178ea5ad5f653bba08e3 Mon Sep 17 00:00:00 2001 +From: Ian Abbott +Date: Fri, 31 Aug 2012 20:41:30 +0100 +Subject: staging: comedi: das08: Correct AO output for das08jr-16-ao + +From: Ian Abbott + +commit 61ed59ed09e6ad2b8395178ea5ad5f653bba08e3 upstream. + +Don't zero out bits 15..12 of the data value in `das08jr_ao_winsn()` as +that knobbles the upper three-quarters of the output range for the +'das08jr-16-ao' board. + +Signed-off-by: Ian Abbott +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/comedi/drivers/das08.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/staging/comedi/drivers/das08.c ++++ b/drivers/staging/comedi/drivers/das08.c +@@ -678,7 +678,7 @@ static int das08jr_ao_winsn(struct comed + int chan; + + lsb = data[0] & 0xff; +- msb = (data[0] >> 8) & 0xf; ++ msb = (data[0] >> 8) & 0xff; + + chan = CR_CHAN(insn->chanspec); + diff --git a/queue-3.5/staging-r8712u-fix-bug-in-r8712_recv_indicatepkt.patch b/queue-3.5/staging-r8712u-fix-bug-in-r8712_recv_indicatepkt.patch new file mode 100644 index 00000000000..c15732215b7 --- /dev/null +++ b/queue-3.5/staging-r8712u-fix-bug-in-r8712_recv_indicatepkt.patch @@ -0,0 +1,42 @@ +From abf02cfc179bb4bd30d05f582d61b3b8f429b813 Mon Sep 17 00:00:00 2001 +From: Eric Dumazet +Date: Mon, 10 Sep 2012 21:22:11 +0200 +Subject: staging: r8712u: fix bug in r8712_recv_indicatepkt() + +From: Eric Dumazet + +commit abf02cfc179bb4bd30d05f582d61b3b8f429b813 upstream. + +64bit arches have a buggy r8712u driver, let's fix it. + +skb->tail must be set properly or network stack behavior is undefined. + +Addresses https://bugzilla.redhat.com/show_bug.cgi?id=847525 +Addresses https://bugzilla.kernel.org/show_bug.cgi?id=45071 + +Signed-off-by: Eric Dumazet +Cc: Dave Jones +Acked-by: Larry Finger +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/rtl8712/recv_linux.c | 7 +------ + 1 file changed, 1 insertion(+), 6 deletions(-) + +--- a/drivers/staging/rtl8712/recv_linux.c ++++ b/drivers/staging/rtl8712/recv_linux.c +@@ -117,13 +117,8 @@ void r8712_recv_indicatepkt(struct _adap + if (skb == NULL) + goto _recv_indicatepkt_drop; + skb->data = precv_frame->u.hdr.rx_data; +-#ifdef NET_SKBUFF_DATA_USES_OFFSET +- skb->tail = (sk_buff_data_t)(precv_frame->u.hdr.rx_tail - +- precv_frame->u.hdr.rx_head); +-#else +- skb->tail = (sk_buff_data_t)precv_frame->u.hdr.rx_tail; +-#endif + skb->len = precv_frame->u.hdr.len; ++ skb_set_tail_pointer(skb, skb->len); + if ((pattrib->tcpchk_valid == 1) && (pattrib->tcp_chkrpt == 1)) + skb->ip_summed = CHECKSUM_UNNECESSARY; + else diff --git a/queue-3.5/staging-speakup-fix-an-improperly-declared-variable.patch b/queue-3.5/staging-speakup-fix-an-improperly-declared-variable.patch new file mode 100644 index 00000000000..2c68ef5501a --- /dev/null +++ b/queue-3.5/staging-speakup-fix-an-improperly-declared-variable.patch @@ -0,0 +1,31 @@ +From 4ea418b8b2fa8a70d0fcc8231b65e67b3a72984b Mon Sep 17 00:00:00 2001 +From: Christopher Brannon +Date: Sat, 16 Jun 2012 16:55:20 -0500 +Subject: Staging: speakup: fix an improperly-declared variable. + +From: Christopher Brannon + +commit 4ea418b8b2fa8a70d0fcc8231b65e67b3a72984b upstream. + +A local static variable was declared as a pointer to a string +constant. We're assigning to the underlying memory, so it +needs to be an array instead. + +Signed-off-by: Christopher Brannon +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/speakup/main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/staging/speakup/main.c ++++ b/drivers/staging/speakup/main.c +@@ -1854,7 +1854,7 @@ static void speakup_bits(struct vc_data + + static int handle_goto(struct vc_data *vc, u_char type, u_char ch, u_short key) + { +- static u_char *goto_buf = "\0\0\0\0\0\0"; ++ static u_char goto_buf[8]; + static int num; + int maxlen, go_pos; + char *cp; diff --git a/queue-3.5/staging-vt6656-failed-connection-incorrect-endian.patch b/queue-3.5/staging-vt6656-failed-connection-incorrect-endian.patch new file mode 100644 index 00000000000..8d79214c12f --- /dev/null +++ b/queue-3.5/staging-vt6656-failed-connection-incorrect-endian.patch @@ -0,0 +1,110 @@ +From aa209eef3ce8419ff2926c2fa944dfbfb5afbacb Mon Sep 17 00:00:00 2001 +From: Malcolm Priestley +Date: Wed, 29 Aug 2012 23:08:21 +0100 +Subject: staging: vt6656: [BUG] - Failed connection, incorrect endian. + +From: Malcolm Priestley + +commit aa209eef3ce8419ff2926c2fa944dfbfb5afbacb upstream. + +Hi, + +This patch fixes a bug with driver failing to negotiate a connection. + +The bug was traced to commit +203e4615ee9d9fa8d3506b9d0ef30095e4d5bc90 +staging: vt6656: removed custom definitions of Ethernet packet types + +In that patch, definitions in include/linux/if_ether.h replaced ones +in tether.h which had both big and little endian definitions. + +include/linux/if_ether.h only refers to big endian values, cpu_to_be16 +should be used for the correct endian architectures. + +Signed-off-by: Malcolm Priestley +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/vt6656/dpc.c | 2 +- + drivers/staging/vt6656/rxtx.c | 38 +++++++++++++++++++------------------- + 2 files changed, 20 insertions(+), 20 deletions(-) + +--- a/drivers/staging/vt6656/dpc.c ++++ b/drivers/staging/vt6656/dpc.c +@@ -200,7 +200,7 @@ s_vProcessRxMACHeader ( + } else if (!compare_ether_addr(pbyRxBuffer, &pDevice->abySNAP_RFC1042[0])) { + cbHeaderSize += 6; + pwType = (PWORD) (pbyRxBufferAddr + cbHeaderSize); +- if ((*pwType == cpu_to_le16(ETH_P_IPX)) || ++ if ((*pwType == cpu_to_be16(ETH_P_IPX)) || + (*pwType == cpu_to_le16(0xF380))) { + cbHeaderSize -= 8; + pwType = (PWORD) (pbyRxBufferAddr + cbHeaderSize); +--- a/drivers/staging/vt6656/rxtx.c ++++ b/drivers/staging/vt6656/rxtx.c +@@ -1701,7 +1701,7 @@ s_bPacketToWirelessUsb( + // 802.1H + if (ntohs(psEthHeader->wType) > ETH_DATA_LEN) { + if (pDevice->dwDiagRefCount == 0) { +- if ((psEthHeader->wType == cpu_to_le16(ETH_P_IPX)) || ++ if ((psEthHeader->wType == cpu_to_be16(ETH_P_IPX)) || + (psEthHeader->wType == cpu_to_le16(0xF380))) { + memcpy((PBYTE) (pbyPayloadHead), + abySNAP_Bridgetunnel, 6); +@@ -2840,10 +2840,10 @@ int nsDMA_tx_packet(PSDevice pDevice, un + Packet_Type = skb->data[ETH_HLEN+1]; + Descriptor_type = skb->data[ETH_HLEN+1+1+2]; + Key_info = (skb->data[ETH_HLEN+1+1+2+1] << 8)|(skb->data[ETH_HLEN+1+1+2+2]); +- if (pDevice->sTxEthHeader.wType == cpu_to_le16(ETH_P_PAE)) { +- /* 802.1x OR eapol-key challenge frame transfer */ +- if (((Protocol_Version == 1) || (Protocol_Version == 2)) && +- (Packet_Type == 3)) { ++ if (pDevice->sTxEthHeader.wType == cpu_to_be16(ETH_P_PAE)) { ++ /* 802.1x OR eapol-key challenge frame transfer */ ++ if (((Protocol_Version == 1) || (Protocol_Version == 2)) && ++ (Packet_Type == 3)) { + bTxeapol_key = TRUE; + if(!(Key_info & BIT3) && //WPA or RSN group-key challenge + (Key_info & BIT8) && (Key_info & BIT9)) { //send 2/2 key +@@ -2989,19 +2989,19 @@ int nsDMA_tx_packet(PSDevice pDevice, un + } + } + +- if (pDevice->sTxEthHeader.wType == cpu_to_le16(ETH_P_PAE)) { +- if (pDevice->byBBType != BB_TYPE_11A) { +- pDevice->wCurrentRate = RATE_1M; +- pDevice->byACKRate = RATE_1M; +- pDevice->byTopCCKBasicRate = RATE_1M; +- pDevice->byTopOFDMBasicRate = RATE_6M; +- } else { +- pDevice->wCurrentRate = RATE_6M; +- pDevice->byACKRate = RATE_6M; +- pDevice->byTopCCKBasicRate = RATE_1M; +- pDevice->byTopOFDMBasicRate = RATE_6M; +- } +- } ++ if (pDevice->sTxEthHeader.wType == cpu_to_be16(ETH_P_PAE)) { ++ if (pDevice->byBBType != BB_TYPE_11A) { ++ pDevice->wCurrentRate = RATE_1M; ++ pDevice->byACKRate = RATE_1M; ++ pDevice->byTopCCKBasicRate = RATE_1M; ++ pDevice->byTopOFDMBasicRate = RATE_6M; ++ } else { ++ pDevice->wCurrentRate = RATE_6M; ++ pDevice->byACKRate = RATE_6M; ++ pDevice->byTopCCKBasicRate = RATE_1M; ++ pDevice->byTopOFDMBasicRate = RATE_6M; ++ } ++ } + + DBG_PRT(MSG_LEVEL_DEBUG, + KERN_INFO "dma_tx: pDevice->wCurrentRate = %d\n", +@@ -3017,7 +3017,7 @@ int nsDMA_tx_packet(PSDevice pDevice, un + + if (bNeedEncryption == TRUE) { + DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"ntohs Pkt Type=%04x\n", ntohs(pDevice->sTxEthHeader.wType)); +- if ((pDevice->sTxEthHeader.wType) == cpu_to_le16(ETH_P_PAE)) { ++ if ((pDevice->sTxEthHeader.wType) == cpu_to_be16(ETH_P_PAE)) { + bNeedEncryption = FALSE; + DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"Pkt Type=%04x\n", (pDevice->sTxEthHeader.wType)); + if ((pMgmt->eCurrMode == WMAC_MODE_ESS_STA) && (pMgmt->eCurrState == WMAC_STATE_ASSOC)) { diff --git a/queue-3.5/staging-zcache-fix-cleancache-race-condition-with-shrinker.patch b/queue-3.5/staging-zcache-fix-cleancache-race-condition-with-shrinker.patch new file mode 100644 index 00000000000..e1d4cec7f95 --- /dev/null +++ b/queue-3.5/staging-zcache-fix-cleancache-race-condition-with-shrinker.patch @@ -0,0 +1,70 @@ +From 6d7d9798ad5c97ee4e911dd070dc12dc5ae55bd0 Mon Sep 17 00:00:00 2001 +From: Seth Jennings +Date: Wed, 29 Aug 2012 16:58:45 -0500 +Subject: staging: zcache: fix cleancache race condition with shrinker + +From: Seth Jennings + +commit 6d7d9798ad5c97ee4e911dd070dc12dc5ae55bd0 upstream. + +This patch fixes a race condition that results in memory +corruption when using cleancache. + +The race exists between the zcache shrinker handler, +shrink_zcache_memory() and cleancache_get_page(). + +In most cases, the shrinker will both evict a zbpg +from its buddy list and flush it from tmem before a +cleancache_get_page() occurs on that page. A subsequent +cleancache_get_page() will fail in the tmem layer. + +In the rare case that two occur together and the +cleancache_get_page() path gets through the tmem +layer before the shrinker path can flush tmem, +zbud_decompress() does a check to see if the zbpg is a +"zombie", i.e. not on a buddy list, which means the shrinker +is in the process of reclaiming it. If the zbpg is a zombie, +zbud_decompress() returns -EINVAL. + +However, this return code is being ignored by the caller, +zcache_pampd_get_data_and_free(), which results in the +caller of cleancache_get_page() thinking that the page has +been properly retrieved when it has not. + +This patch modifies zcache_pampd_get_data_and_free() to +convey the failure up the stack so that the caller of +cleancache_get_page() knows the page retrieval failed. + +This needs to be applied to stable trees as well. +zcache-main.c was named zcache.c before v3.1, so +I'm not sure how you want to handle trees earlier +than that. + +Signed-off-by: Seth Jennings +Reviewed-by: Konrad Rzeszutek Wilk +Reviewed-by: Minchan Kim +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/zcache/zcache-main.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +--- a/drivers/staging/zcache/zcache-main.c ++++ b/drivers/staging/zcache/zcache-main.c +@@ -1259,13 +1259,12 @@ static int zcache_pampd_get_data_and_fre + void *pampd, struct tmem_pool *pool, + struct tmem_oid *oid, uint32_t index) + { +- int ret = 0; +- + BUG_ON(!is_ephemeral(pool)); +- zbud_decompress((struct page *)(data), pampd); ++ if (zbud_decompress((struct page *)(data), pampd) < 0) ++ return -EINVAL; + zbud_free_and_delist((struct zbud_hdr *)pampd); + atomic_dec(&zcache_curr_eph_pampd_count); +- return ret; ++ return 0; + } + + /* diff --git a/queue-3.5/target-fix-data_length-re-assignment-bug-with-scsi-overflow.patch b/queue-3.5/target-fix-data_length-re-assignment-bug-with-scsi-overflow.patch new file mode 100644 index 00000000000..7c26436075b --- /dev/null +++ b/queue-3.5/target-fix-data_length-re-assignment-bug-with-scsi-overflow.patch @@ -0,0 +1,71 @@ +From 4c054ba63ad47ef244cfcfa1cea38134620a5bae Mon Sep 17 00:00:00 2001 +From: Nicholas Bellinger +Date: Thu, 16 Aug 2012 15:33:10 -0700 +Subject: target: Fix ->data_length re-assignment bug with SCSI overflow + +From: Nicholas Bellinger + +commit 4c054ba63ad47ef244cfcfa1cea38134620a5bae upstream. + +This patch fixes a long-standing bug with SCSI overflow handling +where se_cmd->data_length was incorrectly being re-assigned to +the larger CDB extracted allocation length, resulting in a number +of fabric level errors that would end up causing a session reset +in most cases. So instead now: + + - Only re-assign se_cmd->data_length durining UNDERFLOW (to use the + smaller value) + - Use existing se_cmd->data_length for OVERFLOW (to use the smaller + value) + +This fix has been tested with the following CDB to generate an +SCSI overflow: + + sg_raw -r512 /dev/sdc 28 0 0 0 0 0 0 0 9 0 + +Tested using iscsi-target, tcm_qla2xxx, loopback and tcm_vhost fabric +ports. Here is a bit more detail on each case: + + - iscsi-target: Bug with open-iscsi with overflow, sg_raw returns + -3584 bytes of data. + - tcm_qla2xxx: Working as expected, returnins 512 bytes of data + - loopback: sg_raw returns CHECK_CONDITION, from overflow rejection + in transport_generic_map_mem_to_cmd() + - tcm_vhost: Same as loopback + +Reported-by: Roland Dreier +Cc: Roland Dreier +Cc: Christoph Hellwig +Cc: Boaz Harrosh +Signed-off-by: Nicholas Bellinger +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/target/target_core_transport.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +--- a/drivers/target/target_core_transport.c ++++ b/drivers/target/target_core_transport.c +@@ -3000,15 +3000,20 @@ static int transport_generic_cmd_sequenc + /* Returns CHECK_CONDITION + INVALID_CDB_FIELD */ + goto out_invalid_cdb_field; + } +- ++ /* ++ * For the overflow case keep the existing fabric provided ++ * ->data_length. Otherwise for the underflow case, reset ++ * ->data_length to the smaller SCSI expected data transfer ++ * length. ++ */ + if (size > cmd->data_length) { + cmd->se_cmd_flags |= SCF_OVERFLOW_BIT; + cmd->residual_count = (size - cmd->data_length); + } else { + cmd->se_cmd_flags |= SCF_UNDERFLOW_BIT; + cmd->residual_count = (cmd->data_length - size); ++ cmd->data_length = size; + } +- cmd->data_length = size; + } + + if (cmd->se_cmd_flags & SCF_SCSI_DATA_SG_IO_CDB) { diff --git a/queue-3.5/target-simplify-code-around-transport_get_sense_data.patch b/queue-3.5/target-simplify-code-around-transport_get_sense_data.patch new file mode 100644 index 00000000000..553983f8ac5 --- /dev/null +++ b/queue-3.5/target-simplify-code-around-transport_get_sense_data.patch @@ -0,0 +1,124 @@ +From 27a2709912ac19c755d34c79fe11994b0bf8082b Mon Sep 17 00:00:00 2001 +From: Paolo Bonzini +Date: Wed, 5 Sep 2012 17:09:14 +0200 +Subject: target: simplify code around transport_get_sense_data + +From: Paolo Bonzini + +commit 27a2709912ac19c755d34c79fe11994b0bf8082b upstream. + +The error conditions in transport_get_sense_data are superfluous +and complicate the code unnecessarily: + +* SCF_TRANSPORT_TASK_SENSE is checked in the caller; + +* it's simply part of the invariants of dev->transport->get_sense_buffer + that it must be there if transport_complete ever returns 1, and that + it must not return NULL. Besides, the entire callback will disappear + with the next patch. + +* similarly in the caller we can expect that sense data is only sent + for non-zero cmd->scsi_status. + +Signed-off-by: Paolo Bonzini +Signed-off-by: Nicholas Bellinger +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/target/target_core_transport.c | 49 ++++++++------------------------- + 1 file changed, 13 insertions(+), 36 deletions(-) + +--- a/drivers/target/target_core_transport.c ++++ b/drivers/target/target_core_transport.c +@@ -2261,7 +2261,7 @@ out: + /* + * Used to obtain Sense Data from underlying Linux/SCSI struct scsi_cmnd + */ +-static int transport_get_sense_data(struct se_cmd *cmd) ++static void transport_get_sense_data(struct se_cmd *cmd) + { + unsigned char *buffer = cmd->sense_buffer, *sense_buffer = NULL; + struct se_device *dev = cmd->se_dev; +@@ -2271,30 +2271,15 @@ static int transport_get_sense_data(stru + WARN_ON(!cmd->se_lun); + + if (!dev) +- return 0; ++ return; + + spin_lock_irqsave(&cmd->t_state_lock, flags); + if (cmd->se_cmd_flags & SCF_SENT_CHECK_CONDITION) { + spin_unlock_irqrestore(&cmd->t_state_lock, flags); +- return 0; +- } +- +- if (!(cmd->se_cmd_flags & SCF_TRANSPORT_TASK_SENSE)) +- goto out; +- +- if (!dev->transport->get_sense_buffer) { +- pr_err("dev->transport->get_sense_buffer is NULL\n"); +- goto out; ++ return; + } + + sense_buffer = dev->transport->get_sense_buffer(cmd); +- if (!sense_buffer) { +- pr_err("ITT 0x%08x cmd %p: Unable to locate" +- " sense buffer for task with sense\n", +- cmd->se_tfo->get_task_tag(cmd), cmd); +- goto out; +- } +- + spin_unlock_irqrestore(&cmd->t_state_lock, flags); + + offset = cmd->se_tfo->set_fabric_sense_len(cmd, TRANSPORT_SENSE_BUFFER); +@@ -2306,11 +2291,6 @@ static int transport_get_sense_data(stru + + pr_debug("HBA_[%u]_PLUG[%s]: Set SAM STATUS: 0x%02x and sense\n", + dev->se_hba->hba_id, dev->transport->name, cmd->scsi_status); +- return 0; +- +-out: +- spin_unlock_irqrestore(&cmd->t_state_lock, flags); +- return -1; + } + + static inline long long transport_dev_end_lba(struct se_device *dev) +@@ -3171,7 +3151,7 @@ static void transport_handle_queue_full( + static void target_complete_ok_work(struct work_struct *work) + { + struct se_cmd *cmd = container_of(work, struct se_cmd, work); +- int reason = 0, ret; ++ int ret; + + /* + * Check if we need to move delayed/dormant tasks from cmds on the +@@ -3192,19 +3172,16 @@ static void target_complete_ok_work(stru + * the struct se_cmd in question. + */ + if (cmd->se_cmd_flags & SCF_TRANSPORT_TASK_SENSE) { +- if (transport_get_sense_data(cmd) < 0) +- reason = TCM_NON_EXISTENT_LUN; ++ WARN_ON(!cmd->scsi_status); ++ transport_get_sense_data(cmd); ++ ret = transport_send_check_condition_and_sense( ++ cmd, 0, 1); ++ if (ret == -EAGAIN || ret == -ENOMEM) ++ goto queue_full; + +- if (cmd->scsi_status) { +- ret = transport_send_check_condition_and_sense( +- cmd, reason, 1); +- if (ret == -EAGAIN || ret == -ENOMEM) +- goto queue_full; +- +- transport_lun_remove_cmd(cmd); +- transport_cmd_check_stop_to_fabric(cmd); +- return; +- } ++ transport_lun_remove_cmd(cmd); ++ transport_cmd_check_stop_to_fabric(cmd); ++ return; + } + /* + * Check for a callback, used by amongst other things diff --git a/queue-3.5/usb-option-replace-zte-k5006-z-entry-with-vendor-class-rule.patch b/queue-3.5/usb-option-replace-zte-k5006-z-entry-with-vendor-class-rule.patch new file mode 100644 index 00000000000..1056eaaf38e --- /dev/null +++ b/queue-3.5/usb-option-replace-zte-k5006-z-entry-with-vendor-class-rule.patch @@ -0,0 +1,81 @@ +From ba9edaa468869a8cea242a411066b0f490751798 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Bj=C3=B8rn=20Mork?= +Date: Tue, 11 Sep 2012 09:40:31 +0200 +Subject: USB: option: replace ZTE K5006-Z entry with vendor class rule +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: =?UTF-8?q?Bj=C3=B8rn=20Mork?= + +commit ba9edaa468869a8cea242a411066b0f490751798 upstream. + +Fix the ZTE K5006-Z entry so that it actually matches anything + + commit f1b5c997 USB: option: add ZTE K5006-Z + +added a device specific entry assuming that the device would use +class/subclass/proto == ff/ff/ff like other ZTE devices. It +turns out that ZTE has started using vendor specific subclass +and protocol codes: + +T: Bus=01 Lev=01 Prnt=01 Port=03 Cnt=01 Dev#= 4 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=19d2 ProdID=1018 Rev= 0.00 +S: Manufacturer=ZTE,Incorporated +S: Product=ZTE LTE Technologies MSM +S: SerialNumber=MF821Vxxxxxxx +C:* #Ifs= 5 Cfg#= 1 Atr=c0 MxPwr=500mA +I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=86 Prot=10 Driver=(none) +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=4ms +I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=02 Prot=05 Driver=(none) +E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=4ms +I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=02 Prot=01 Driver=(none) +E: Ad=83(I) Atr=03(Int.) MxPS= 64 Ivl=2ms +E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=4ms +I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=06 Prot=00 Driver=qmi_wwan +E: Ad=85(I) Atr=03(Int.) MxPS= 64 Ivl=2ms +E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=4ms +I:* If#= 4 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=06 Prot=50 Driver=usb-storage +E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms + +We do not have any information on how ZTE intend to use these +codes, but let us assume for now that the 3 sets matching +serial functions in the K5006-Z always will identify a serial +function in a ZTE device. + +Cc: Thomas Schäfer +Signed-off-by: Bjørn Mork +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/option.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -886,8 +886,6 @@ static const struct usb_device_id option + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1010, 0xff, 0xff, 0xff), + .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1012, 0xff, 0xff, 0xff) }, +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1018, 0xff, 0xff, 0xff), +- .driver_info = (kernel_ulong_t)&net_intf3_blacklist }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1057, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1058, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1059, 0xff, 0xff, 0xff) }, +@@ -1092,6 +1090,10 @@ static const struct usb_device_id option + .driver_info = (kernel_ulong_t)&zte_ad3812_z_blacklist }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MC2716, 0xff, 0xff, 0xff), + .driver_info = (kernel_ulong_t)&zte_mc2716_z_blacklist }, ++ { USB_VENDOR_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff, 0x02, 0x01) }, ++ { USB_VENDOR_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff, 0x02, 0x05) }, ++ { USB_VENDOR_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff, 0x86, 0x10) }, ++ + { USB_DEVICE(BENQ_VENDOR_ID, BENQ_PRODUCT_H10) }, + { USB_DEVICE(DLINK_VENDOR_ID, DLINK_PRODUCT_DWM_652) }, + { USB_DEVICE(ALINK_VENDOR_ID, DLINK_PRODUCT_DWM_652_U5) }, /* Yes, ALINK_VENDOR_ID */ diff --git a/queue-3.5/vfs-dcache-use-dcache_dentry_killed-instead-of-dcache_disconnected-in-d_kill.patch b/queue-3.5/vfs-dcache-use-dcache_dentry_killed-instead-of-dcache_disconnected-in-d_kill.patch new file mode 100644 index 00000000000..993f1caf703 --- /dev/null +++ b/queue-3.5/vfs-dcache-use-dcache_dentry_killed-instead-of-dcache_disconnected-in-d_kill.patch @@ -0,0 +1,64 @@ +From b161dfa6937ae46d50adce8a7c6b12233e96e7bd Mon Sep 17 00:00:00 2001 +From: Miklos Szeredi +Date: Mon, 17 Sep 2012 22:31:38 +0200 +Subject: vfs: dcache: use DCACHE_DENTRY_KILLED instead of DCACHE_DISCONNECTED in d_kill() + +From: Miklos Szeredi + +commit b161dfa6937ae46d50adce8a7c6b12233e96e7bd upstream. + +IBM reported a soft lockup after applying the fix for the rename_lock +deadlock. Commit c83ce989cb5f ("VFS: Fix the nfs sillyrename regression +in kernel 2.6.38") was found to be the culprit. + +The nfs sillyrename fix used DCACHE_DISCONNECTED to indicate that the +dentry was killed. This flag can be set on non-killed dentries too, +which results in infinite retries when trying to traverse the dentry +tree. + +This patch introduces a separate flag: DCACHE_DENTRY_KILLED, which is +only set in d_kill() and makes try_to_ascend() test only this flag. + +IBM reported successful test results with this patch. + +Signed-off-by: Miklos Szeredi +Cc: Trond Myklebust +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + fs/dcache.c | 4 ++-- + include/linux/dcache.h | 2 ++ + 2 files changed, 4 insertions(+), 2 deletions(-) + +--- a/fs/dcache.c ++++ b/fs/dcache.c +@@ -389,7 +389,7 @@ static struct dentry *d_kill(struct dent + * Inform try_to_ascend() that we are no longer attached to the + * dentry tree + */ +- dentry->d_flags |= DCACHE_DISCONNECTED; ++ dentry->d_flags |= DCACHE_DENTRY_KILLED; + if (parent) + spin_unlock(&parent->d_lock); + dentry_iput(dentry); +@@ -1046,7 +1046,7 @@ static struct dentry *try_to_ascend(stru + * or deletion + */ + if (new != old->d_parent || +- (old->d_flags & DCACHE_DISCONNECTED) || ++ (old->d_flags & DCACHE_DENTRY_KILLED) || + (!locked && read_seqretry(&rename_lock, seq))) { + spin_unlock(&new->d_lock); + new = NULL; +--- a/include/linux/dcache.h ++++ b/include/linux/dcache.h +@@ -206,6 +206,8 @@ struct dentry_operations { + #define DCACHE_MANAGED_DENTRY \ + (DCACHE_MOUNTED|DCACHE_NEED_AUTOMOUNT|DCACHE_MANAGE_TRANSIT) + ++#define DCACHE_DENTRY_KILLED 0x100000 ++ + extern seqlock_t rename_lock; + + static inline int dname_external(struct dentry *dentry) diff --git a/queue-3.5/vfs-make-o_path-file-descriptors-usable-for-fstat.patch b/queue-3.5/vfs-make-o_path-file-descriptors-usable-for-fstat.patch new file mode 100644 index 00000000000..b33386a1c17 --- /dev/null +++ b/queue-3.5/vfs-make-o_path-file-descriptors-usable-for-fstat.patch @@ -0,0 +1,43 @@ +From 55815f70147dcfa3ead5738fd56d3574e2e3c1c2 Mon Sep 17 00:00:00 2001 +From: Linus Torvalds +Date: Fri, 14 Sep 2012 14:48:21 -0700 +Subject: vfs: make O_PATH file descriptors usable for 'fstat()' +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Linus Torvalds + +commit 55815f70147dcfa3ead5738fd56d3574e2e3c1c2 upstream. + +We already use them for openat() and friends, but fstat() also wants to +be able to use O_PATH file descriptors. This should make it more +directly comparable to the O_SEARCH of Solaris. + +Note that you could already do the same thing with "fstatat()" and an +empty path, but just doing "fstat()" directly is simpler and faster, so +there is no reason not to just allow it directly. + +See also commit 332a2e1244bd, which did the same thing for fchdir, for +the same reasons. + +Reported-by: ольга крыжановская +Cc: Al Viro +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + fs/stat.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/stat.c ++++ b/fs/stat.c +@@ -58,7 +58,7 @@ EXPORT_SYMBOL(vfs_getattr); + int vfs_fstat(unsigned int fd, struct kstat *stat) + { + int fput_needed; +- struct file *f = fget_light(fd, &fput_needed); ++ struct file *f = fget_raw_light(fd, &fput_needed); + int error = -EBADF; + + if (f) { diff --git a/queue-3.5/workqueue-reimplement-work_on_cpu-using-system_wq.patch b/queue-3.5/workqueue-reimplement-work_on_cpu-using-system_wq.patch new file mode 100644 index 00000000000..f27a9e08e3c --- /dev/null +++ b/queue-3.5/workqueue-reimplement-work_on_cpu-using-system_wq.patch @@ -0,0 +1,82 @@ +From ed48ece27cd3d5ee0354c32bbaec0f3e1d4715c3 Mon Sep 17 00:00:00 2001 +From: Tejun Heo +Date: Tue, 18 Sep 2012 12:48:43 -0700 +Subject: workqueue: reimplement work_on_cpu() using system_wq + +From: Tejun Heo + +commit ed48ece27cd3d5ee0354c32bbaec0f3e1d4715c3 upstream. + +The existing work_on_cpu() implementation is hugely inefficient. It +creates a new kthread, execute that single function and then let the +kthread die on each invocation. + +Now that system_wq can handle concurrent executions, there's no +advantage of doing this. Reimplement work_on_cpu() using system_wq +which makes it simpler and way more efficient. + +stable: While this isn't a fix in itself, it's needed to fix a + workqueue related bug in cpufreq/powernow-k8. AFAICS, this + shouldn't break other existing users. + +Signed-off-by: Tejun Heo +Acked-by: Jiri Kosina +Cc: Linus Torvalds +Cc: Bjorn Helgaas +Cc: Len Brown +Cc: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/workqueue.c | 25 ++++++++----------------- + 1 file changed, 8 insertions(+), 17 deletions(-) + +--- a/kernel/workqueue.c ++++ b/kernel/workqueue.c +@@ -3628,18 +3628,17 @@ static int __devinit workqueue_cpu_down_ + #ifdef CONFIG_SMP + + struct work_for_cpu { +- struct completion completion; ++ struct work_struct work; + long (*fn)(void *); + void *arg; + long ret; + }; + +-static int do_work_for_cpu(void *_wfc) ++static void work_for_cpu_fn(struct work_struct *work) + { +- struct work_for_cpu *wfc = _wfc; ++ struct work_for_cpu *wfc = container_of(work, struct work_for_cpu, work); ++ + wfc->ret = wfc->fn(wfc->arg); +- complete(&wfc->completion); +- return 0; + } + + /** +@@ -3654,19 +3653,11 @@ static int do_work_for_cpu(void *_wfc) + */ + long work_on_cpu(unsigned int cpu, long (*fn)(void *), void *arg) + { +- struct task_struct *sub_thread; +- struct work_for_cpu wfc = { +- .completion = COMPLETION_INITIALIZER_ONSTACK(wfc.completion), +- .fn = fn, +- .arg = arg, +- }; ++ struct work_for_cpu wfc = { .fn = fn, .arg = arg }; + +- sub_thread = kthread_create(do_work_for_cpu, &wfc, "work_for_cpu"); +- if (IS_ERR(sub_thread)) +- return PTR_ERR(sub_thread); +- kthread_bind(sub_thread, cpu); +- wake_up_process(sub_thread); +- wait_for_completion(&wfc.completion); ++ INIT_WORK_ONSTACK(&wfc.work, work_for_cpu_fn); ++ schedule_work_on(cpu, &wfc.work); ++ flush_work(&wfc.work); + return wfc.ret; + } + EXPORT_SYMBOL_GPL(work_on_cpu);