From: Greg Kroah-Hartman Date: Thu, 11 Mar 2010 19:31:42 +0000 (-0800) Subject: .33 patches X-Git-Tag: v2.6.32.10~14 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=06f6fce38bbe1d57c500b268fe81a232391996ae;p=thirdparty%2Fkernel%2Fstable-queue.git .33 patches --- diff --git a/queue-2.6.33/eeepc-laptop-disable-wireless-hotplug-for-1005pe.patch b/queue-2.6.33/eeepc-laptop-disable-wireless-hotplug-for-1005pe.patch new file mode 100644 index 00000000000..248d13fb327 --- /dev/null +++ b/queue-2.6.33/eeepc-laptop-disable-wireless-hotplug-for-1005pe.patch @@ -0,0 +1,34 @@ +From ced69c59811f05b2f8378467cbb82ac6ed3c6a5a Mon Sep 17 00:00:00 2001 +From: Alan Jenkins +Date: Sat, 20 Feb 2010 11:02:24 +0000 +Subject: eeepc-laptop: disable wireless hotplug for 1005PE + +From: Alan Jenkins + +commit ced69c59811f05b2f8378467cbb82ac6ed3c6a5a upstream. + +The wireless hotplug code is not needed on this model, and it disables +the wired ethernet card. (Like on the 1005HA and 1201N). + +References: + +Signed-off-by: Alan Jenkins +Reported-by: Ansgar Burchardt +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/platform/x86/eeepc-laptop.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/platform/x86/eeepc-laptop.c ++++ b/drivers/platform/x86/eeepc-laptop.c +@@ -1277,7 +1277,8 @@ static void eeepc_dmi_check(struct eeepc + * hotplug code. In fact, current hotplug code seems to unplug another + * device... + */ +- if (strcmp(model, "1005HA") == 0 || strcmp(model, "1201N") == 0) { ++ if (strcmp(model, "1005HA") == 0 || strcmp(model, "1201N") == 0 || ++ strcmp(model, "1005PE") == 0) { + eeepc->hotplug_disabled = true; + pr_info("wlan hotplug disabled\n"); + } diff --git a/queue-2.6.33/ocfs2-only-bug-out-in-direct-io-write-for-reflinked-extent.patch b/queue-2.6.33/ocfs2-only-bug-out-in-direct-io-write-for-reflinked-extent.patch new file mode 100644 index 00000000000..91417c3a86b --- /dev/null +++ b/queue-2.6.33/ocfs2-only-bug-out-in-direct-io-write-for-reflinked-extent.patch @@ -0,0 +1,36 @@ +From cbaee472f274ea9a98aabe47025f6e5551acadcb Mon Sep 17 00:00:00 2001 +From: Tao Ma +Date: Fri, 26 Feb 2010 10:54:52 +0800 +Subject: ocfs2: Only bug out in direct io write for reflinked extent. + +From: Tao Ma + +commit cbaee472f274ea9a98aabe47025f6e5551acadcb upstream. + +In ocfs2_direct_IO_get_blocks, we only need to bug out +in case of we are going to write a recounted extent rec. + +What a silly bug introduced by me! + +Signed-off-by: Tao Ma +Signed-off-by: Joel Becker +Signed-off-by: Greg Kroah-Hartman + +--- + fs/ocfs2/aops.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/fs/ocfs2/aops.c ++++ b/fs/ocfs2/aops.c +@@ -577,8 +577,9 @@ static int ocfs2_direct_IO_get_blocks(st + goto bail; + } + +- /* We should already CoW the refcounted extent. */ +- BUG_ON(ext_flags & OCFS2_EXT_REFCOUNTED); ++ /* We should already CoW the refcounted extent in case of create. */ ++ BUG_ON(create && (ext_flags & OCFS2_EXT_REFCOUNTED)); ++ + /* + * get_more_blocks() expects us to describe a hole by clearing + * the mapped bit on bh_result(). diff --git a/queue-2.6.33/series b/queue-2.6.33/series index 4acdd57c955..54c2ce87acd 100644 --- a/queue-2.6.33/series +++ b/queue-2.6.33/series @@ -77,6 +77,26 @@ netfilter-xt_recent-fix-buffer-overflow.patch netfilter-xt_recent-fix-false-match.patch sunxvr500-additional-pci-id-for-sunxvr500-driver.patch mac80211-do-not-transmit-frames-on-unconfigured-4-addr-vlan-interfaces.patch +eeepc-laptop-disable-wireless-hotplug-for-1005pe.patch +thinkpad-acpi-fix-poll-thread-auto-start.patch +thinkpad-acpi-r52-brightness_mode-has-been-confirmed.patch +thinkpad-acpi-document-hkey-event-3006.patch +thinkpad-acpi-make-driver-events-work-in-nvram-poll-mode.patch +thinkpad-acpi-fix-bluetooth-wwan-resume.patch +thinkpad-acpi-lock-down-video-output-state-access.patch +ocfs2-only-bug-out-in-direct-io-write-for-reflinked-extent.patch +x86-ia32_aout-do-not-kill-argument-mapping.patch +x86-add-imac9-1-to-pci_reboot_dmi_table.patch +x86-xen-disable-highmem-pte-allocation-even-when-config_highpte-y.patch +x86-avoid-race-condition-in-pci_enable_msix.patch +x86-fix-sci-on-ioapic-0.patch +usb-xhci-fix-finding-extended-capabilities-registers.patch +usb-fix-the-idproduct-value-for-usb-3.0-root-hubs.patch +usb-fix-crash-in-uhci_scan_schedule.patch +usb-remove-debugging-message-for-uevent-constructions.patch +usb-move-hcd-free_dev-call-into-usb_disconnect-to-fix-oops.patch +usb-f_mass_storage-fix-crash-on-bind-error.patch +usb-add-new-ftdi_sio-device-ids.patch sched-fix-sched_mv_power_savings-for-smt.patch sched-fix-smt-scheduler-regression-in-find_busiest_queue.patch sched-don-t-use-possibly-stale-sched_class.patch diff --git a/queue-2.6.33/thinkpad-acpi-document-hkey-event-3006.patch b/queue-2.6.33/thinkpad-acpi-document-hkey-event-3006.patch new file mode 100644 index 00000000000..c0ce40cbdeb --- /dev/null +++ b/queue-2.6.33/thinkpad-acpi-document-hkey-event-3006.patch @@ -0,0 +1,56 @@ +From bf8b29c8f7f8269e99eca8b19048ed5b34b51810 Mon Sep 17 00:00:00 2001 +From: Henrique de Moraes Holschuh +Date: Thu, 25 Feb 2010 21:28:56 -0300 +Subject: thinkpad-acpi: document HKEY event 3006 + +From: Henrique de Moraes Holschuh + +commit bf8b29c8f7f8269e99eca8b19048ed5b34b51810 upstream. + +Event 0x3006 is used to help power management of the ODD in the +UltraBay. The EC generates this event when the ODD eject button is +pressed (even if the bay is powered down). + +Normally, Linux doesn't need this as we keep the SATA link powered +up (which wastes power). The EC powers up the bay by itself when the +ODD eject button is pressed, and the SATA PHY reports the hotplug. + +However, we could also power that SATA link down (and for that matter, +also power down the Ultrabay) if the ODD is left idle for a while with +no disk inside, and use event 0x3006 to know when we need that SATA link +powered back up. + +For now, just stop asking for more information when event 0x3006 is +seen, there is no point in pestering users about it anymore. + +Signed-off-by: Henrique de Moraes Holschuh +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/platform/x86/thinkpad_acpi.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +--- a/drivers/platform/x86/thinkpad_acpi.c ++++ b/drivers/platform/x86/thinkpad_acpi.c +@@ -3650,13 +3650,19 @@ static void hotkey_notify(struct ibm_str + break; + case 3: + /* 0x3000-0x3FFF: bay-related wakeups */ +- if (hkey == TP_HKEY_EV_BAYEJ_ACK) { ++ switch (hkey) { ++ case TP_HKEY_EV_BAYEJ_ACK: + hotkey_autosleep_ack = 1; + printk(TPACPI_INFO + "bay ejected\n"); + hotkey_wakeup_hotunplug_complete_notify_change(); + known_ev = true; +- } else { ++ break; ++ case TP_HKEY_EV_OPTDRV_EJ: ++ /* FIXME: kick libata if SATA link offline */ ++ known_ev = true; ++ break; ++ default: + known_ev = false; + } + break; diff --git a/queue-2.6.33/thinkpad-acpi-fix-bluetooth-wwan-resume.patch b/queue-2.6.33/thinkpad-acpi-fix-bluetooth-wwan-resume.patch new file mode 100644 index 00000000000..4bd18236f45 --- /dev/null +++ b/queue-2.6.33/thinkpad-acpi-fix-bluetooth-wwan-resume.patch @@ -0,0 +1,83 @@ +From 08fedfc903c78e380b0baa7b57c52d367794d0a5 Mon Sep 17 00:00:00 2001 +From: Henrique de Moraes Holschuh +Date: Thu, 25 Feb 2010 22:22:07 -0300 +Subject: thinkpad-acpi: fix bluetooth/wwan resume + +From: Henrique de Moraes Holschuh + +commit 08fedfc903c78e380b0baa7b57c52d367794d0a5 upstream. + +Studying the DSDTs of various thinkpads, it looks like bit 3 of the +argument to SBDC and SWAN is not "set radio to last state on resume". +Rather, it seems to be "if this bit is set, enable radio on resume, +otherwise disable it on resume". + +So, the proper way to prepare the radios for S3 suspend is: disable +radio and clear bit 3 on the SBDC/SWAN call to to resume with radio +disabled, and enable radio and set bit 3 on the SBDC/SWAN call to +resume with the radio enabled. + +Also, for persistent devices, the rfkill core does not restore state, +so we really need to get the firmware to do the right thing. + +We don't sync the radio state on suspend, instead we trust the BIOS to +not do anything weird if we never touched the radio state since boot. +Time will tell if that's a wise way of doing things... + +Signed-off-by: Henrique de Moraes Holschuh +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/platform/x86/thinkpad_acpi.c | 18 ++++++++++-------- + 1 file changed, 10 insertions(+), 8 deletions(-) + +--- a/drivers/platform/x86/thinkpad_acpi.c ++++ b/drivers/platform/x86/thinkpad_acpi.c +@@ -3878,7 +3878,7 @@ enum { + TP_ACPI_BLUETOOTH_HWPRESENT = 0x01, /* Bluetooth hw available */ + TP_ACPI_BLUETOOTH_RADIOSSW = 0x02, /* Bluetooth radio enabled */ + TP_ACPI_BLUETOOTH_RESUMECTRL = 0x04, /* Bluetooth state at resume: +- off / last state */ ++ 0 = disable, 1 = enable */ + }; + + enum { +@@ -3924,10 +3924,11 @@ static int bluetooth_set_status(enum tpa + } + #endif + +- /* We make sure to keep TP_ACPI_BLUETOOTH_RESUMECTRL off */ +- status = TP_ACPI_BLUETOOTH_RESUMECTRL; + if (state == TPACPI_RFK_RADIO_ON) +- status |= TP_ACPI_BLUETOOTH_RADIOSSW; ++ status = TP_ACPI_BLUETOOTH_RADIOSSW ++ | TP_ACPI_BLUETOOTH_RESUMECTRL; ++ else ++ status = 0; + + if (!acpi_evalf(hkey_handle, NULL, "SBDC", "vd", status)) + return -EIO; +@@ -4078,7 +4079,7 @@ enum { + TP_ACPI_WANCARD_HWPRESENT = 0x01, /* Wan hw available */ + TP_ACPI_WANCARD_RADIOSSW = 0x02, /* Wan radio enabled */ + TP_ACPI_WANCARD_RESUMECTRL = 0x04, /* Wan state at resume: +- off / last state */ ++ 0 = disable, 1 = enable */ + }; + + #define TPACPI_RFK_WWAN_SW_NAME "tpacpi_wwan_sw" +@@ -4115,10 +4116,11 @@ static int wan_set_status(enum tpacpi_rf + } + #endif + +- /* We make sure to set TP_ACPI_WANCARD_RESUMECTRL */ +- status = TP_ACPI_WANCARD_RESUMECTRL; + if (state == TPACPI_RFK_RADIO_ON) +- status |= TP_ACPI_WANCARD_RADIOSSW; ++ status = TP_ACPI_WANCARD_RADIOSSW ++ | TP_ACPI_WANCARD_RESUMECTRL; ++ else ++ status = 0; + + if (!acpi_evalf(hkey_handle, NULL, "SWAN", "vd", status)) + return -EIO; diff --git a/queue-2.6.33/thinkpad-acpi-fix-poll-thread-auto-start.patch b/queue-2.6.33/thinkpad-acpi-fix-poll-thread-auto-start.patch new file mode 100644 index 00000000000..5c5ad71cbad --- /dev/null +++ b/queue-2.6.33/thinkpad-acpi-fix-poll-thread-auto-start.patch @@ -0,0 +1,71 @@ +From b589ea4c44170d3f7a845684e2d1b3b9571663af Mon Sep 17 00:00:00 2001 +From: Henrique de Moraes Holschuh +Date: Thu, 25 Feb 2010 21:28:58 -0300 +Subject: thinkpad-acpi: fix poll thread auto-start + +From: Henrique de Moraes Holschuh + +commit b589ea4c44170d3f7a845684e2d1b3b9571663af upstream. + +The driver was not starting the NVRAM polling thread if the input +device was bound immediately after registration. + +This fixes: +http://bugzilla.kernel.org/show_bug.cgi?id=15118 + +Reported-by: Florian Zumbiehl +Signed-off-by: Henrique de Moraes Holschuh +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/platform/x86/thinkpad_acpi.c | 15 ++++++--------- + 1 file changed, 6 insertions(+), 9 deletions(-) + +--- a/drivers/platform/x86/thinkpad_acpi.c ++++ b/drivers/platform/x86/thinkpad_acpi.c +@@ -2607,16 +2607,11 @@ static int hotkey_inputdev_open(struct i + { + switch (tpacpi_lifecycle) { + case TPACPI_LIFE_INIT: +- /* +- * hotkey_init will call hotkey_poll_setup_safe +- * at the appropriate moment +- */ +- return 0; +- case TPACPI_LIFE_EXITING: +- return -EBUSY; + case TPACPI_LIFE_RUNNING: + hotkey_poll_setup_safe(false); + return 0; ++ case TPACPI_LIFE_EXITING: ++ return -EBUSY; + } + + /* Should only happen if tpacpi_lifecycle is corrupt */ +@@ -2627,7 +2622,7 @@ static int hotkey_inputdev_open(struct i + static void hotkey_inputdev_close(struct input_dev *dev) + { + /* disable hotkey polling when possible */ +- if (tpacpi_lifecycle == TPACPI_LIFE_RUNNING && ++ if (tpacpi_lifecycle != TPACPI_LIFE_EXITING && + !(hotkey_source_mask & hotkey_driver_mask)) + hotkey_poll_setup_safe(false); + } +@@ -9051,6 +9046,9 @@ static int __init thinkpad_acpi_module_i + return ret; + } + } ++ ++ tpacpi_lifecycle = TPACPI_LIFE_RUNNING; ++ + ret = input_register_device(tpacpi_inputdev); + if (ret < 0) { + printk(TPACPI_ERR "unable to register input device\n"); +@@ -9060,7 +9058,6 @@ static int __init thinkpad_acpi_module_i + tp_features.input_device_registered = 1; + } + +- tpacpi_lifecycle = TPACPI_LIFE_RUNNING; + return 0; + } + diff --git a/queue-2.6.33/thinkpad-acpi-lock-down-video-output-state-access.patch b/queue-2.6.33/thinkpad-acpi-lock-down-video-output-state-access.patch new file mode 100644 index 00000000000..bb571ed0d44 --- /dev/null +++ b/queue-2.6.33/thinkpad-acpi-lock-down-video-output-state-access.patch @@ -0,0 +1,117 @@ +From b525c06cdbd8a3963f0173ccd23f9147d4c384b5 Mon Sep 17 00:00:00 2001 +From: Henrique de Moraes Holschuh +Date: Thu, 25 Feb 2010 22:22:22 -0300 +Subject: thinkpad-acpi: lock down video output state access + +From: Henrique de Moraes Holschuh + +commit b525c06cdbd8a3963f0173ccd23f9147d4c384b5 upstream. + +Given the right combination of ThinkPad and X.org, just reading the +video output control state is enough to hard-crash X.org. + +Until the day I somehow find out a model or BIOS cut date to not +provide this feature to ThinkPads that can do video switching through +X RandR, change permissions so that only processes with CAP_SYS_ADMIN +can access any sort of video output control state. + +This bug could be considered a local DoS I suppose, as it allows any +non-privledged local user to cause some versions of X.org to +hard-crash some ThinkPads. + +Reported-by: Jidanni +Signed-off-by: Henrique de Moraes Holschuh +Signed-off-by: Greg Kroah-Hartman + +--- + Documentation/laptops/thinkpad-acpi.txt | 4 ++++ + drivers/platform/x86/Kconfig | 10 ++++++++-- + drivers/platform/x86/thinkpad_acpi.c | 15 +++++++++++++-- + 3 files changed, 25 insertions(+), 4 deletions(-) + +--- a/Documentation/laptops/thinkpad-acpi.txt ++++ b/Documentation/laptops/thinkpad-acpi.txt +@@ -650,6 +650,10 @@ LCD, CRT or DVI (if available). The foll + echo expand_toggle > /proc/acpi/ibm/video + echo video_switch > /proc/acpi/ibm/video + ++NOTE: Access to this feature is restricted to processes owning the ++CAP_SYS_ADMIN capability for safety reasons, as it can interact badly ++enough with some versions of X.org to crash it. ++ + Each video output device can be enabled or disabled individually. + Reading /proc/acpi/ibm/video shows the status of each device. + +--- a/drivers/platform/x86/Kconfig ++++ b/drivers/platform/x86/Kconfig +@@ -319,9 +319,15 @@ config THINKPAD_ACPI_VIDEO + server running, phase of the moon, and the current mood of + Schroedinger's cat. If you can use X.org's RandR to control + your ThinkPad's video output ports instead of this feature, +- don't think twice: do it and say N here to save some memory. ++ don't think twice: do it and say N here to save memory and avoid ++ bad interactions with X.org. + +- If you are not sure, say Y here. ++ NOTE: access to this feature is limited to processes with the ++ CAP_SYS_ADMIN capability, to avoid local DoS issues in platforms ++ where it interacts badly with X.org. ++ ++ If you are not sure, say Y here but do try to check if you could ++ be using X.org RandR instead. + + config THINKPAD_ACPI_HOTKEY_POLL + bool "Support NVRAM polling for hot keys" +--- a/drivers/platform/x86/thinkpad_acpi.c ++++ b/drivers/platform/x86/thinkpad_acpi.c +@@ -286,6 +286,7 @@ struct ibm_init_struct { + char param[32]; + + int (*init) (struct ibm_init_struct *); ++ mode_t base_procfs_mode; + struct ibm_struct *data; + }; + +@@ -4629,6 +4630,10 @@ static int video_read(struct seq_file *m + return 0; + } + ++ /* Even reads can crash X.org, so... */ ++ if (!capable(CAP_SYS_ADMIN)) ++ return -EPERM; ++ + status = video_outputsw_get(); + if (status < 0) + return status; +@@ -4662,6 +4667,10 @@ static int video_write(char *buf) + if (video_supported == TPACPI_VIDEO_NONE) + return -ENODEV; + ++ /* Even reads can crash X.org, let alone writes... */ ++ if (!capable(CAP_SYS_ADMIN)) ++ return -EPERM; ++ + enable = 0; + disable = 0; + +@@ -8506,9 +8515,10 @@ static int __init ibm_init(struct ibm_in + "%s installed\n", ibm->name); + + if (ibm->read) { +- mode_t mode; ++ mode_t mode = iibm->base_procfs_mode; + +- mode = S_IRUGO; ++ if (!mode) ++ mode = S_IRUGO; + if (ibm->write) + mode |= S_IWUSR; + entry = proc_create_data(ibm->name, mode, proc_dir, +@@ -8699,6 +8709,7 @@ static struct ibm_init_struct ibms_init[ + #ifdef CONFIG_THINKPAD_ACPI_VIDEO + { + .init = video_init, ++ .base_procfs_mode = S_IRUSR, + .data = &video_driver_data, + }, + #endif diff --git a/queue-2.6.33/thinkpad-acpi-make-driver-events-work-in-nvram-poll-mode.patch b/queue-2.6.33/thinkpad-acpi-make-driver-events-work-in-nvram-poll-mode.patch new file mode 100644 index 00000000000..245e1a5f670 --- /dev/null +++ b/queue-2.6.33/thinkpad-acpi-make-driver-events-work-in-nvram-poll-mode.patch @@ -0,0 +1,81 @@ +From 7f0cf712a74fcc3ad21f0bde95bd32c2f2cc3888 Mon Sep 17 00:00:00 2001 +From: Henrique de Moraes Holschuh +Date: Thu, 25 Feb 2010 21:29:00 -0300 +Subject: thinkpad-acpi: make driver events work in NVRAM poll mode + +From: Henrique de Moraes Holschuh + +commit 7f0cf712a74fcc3ad21f0bde95bd32c2f2cc3888 upstream. + +Thadeu Lima de Souza Cascardo reports this: + +Brightness notification does not work until the user writes to +hotkey_mask attribute. That's because the polling thread will only run +if hotkey_user_mask is set and someone is reading the input device or +if hotkey_driver_mask is set. In this second case, this condition is +not tested after the mask is changed, because the brightness and +volume drivers are started after the hotkey drivers. + +Fix tpacpi_hotkey_driver_mask_set() to call hotkey_poll_setup(), so +that the poller kthread will be started when needed. + +Reported-by: Thadeu Lima de Souza Cascardo +Tested-by: Thadeu Lima de Souza Cascardo +Signed-off-by: Henrique de Moraes Holschuh +Cc: Andrew Morton +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/platform/x86/thinkpad_acpi.c | 13 ++++++++++--- + 1 file changed, 10 insertions(+), 3 deletions(-) + +--- a/drivers/platform/x86/thinkpad_acpi.c ++++ b/drivers/platform/x86/thinkpad_acpi.c +@@ -2082,6 +2082,7 @@ static struct attribute_set *hotkey_dev_ + + static void tpacpi_driver_event(const unsigned int hkey_event); + static void hotkey_driver_event(const unsigned int scancode); ++static void hotkey_poll_setup(const bool may_warn); + + /* HKEY.MHKG() return bits */ + #define TP_HOTKEY_TABLET_MASK (1 << 3) +@@ -2264,6 +2265,8 @@ static int tpacpi_hotkey_driver_mask_set + + rc = hotkey_mask_set((hotkey_acpi_mask | hotkey_driver_mask) & + ~hotkey_source_mask); ++ hotkey_poll_setup(true); ++ + mutex_unlock(&hotkey_mutex); + + return rc; +@@ -2548,7 +2551,7 @@ static void hotkey_poll_stop_sync(void) + } + + /* call with hotkey_mutex held */ +-static void hotkey_poll_setup(bool may_warn) ++static void hotkey_poll_setup(const bool may_warn) + { + const u32 poll_driver_mask = hotkey_driver_mask & hotkey_source_mask; + const u32 poll_user_mask = hotkey_user_mask & hotkey_source_mask; +@@ -2579,7 +2582,7 @@ static void hotkey_poll_setup(bool may_w + } + } + +-static void hotkey_poll_setup_safe(bool may_warn) ++static void hotkey_poll_setup_safe(const bool may_warn) + { + mutex_lock(&hotkey_mutex); + hotkey_poll_setup(may_warn); +@@ -2597,7 +2600,11 @@ static void hotkey_poll_set_freq(unsigne + + #else /* CONFIG_THINKPAD_ACPI_HOTKEY_POLL */ + +-static void hotkey_poll_setup_safe(bool __unused) ++static void hotkey_poll_setup(const bool __unused) ++{ ++} ++ ++static void hotkey_poll_setup_safe(const bool __unused) + { + } + diff --git a/queue-2.6.33/thinkpad-acpi-r52-brightness_mode-has-been-confirmed.patch b/queue-2.6.33/thinkpad-acpi-r52-brightness_mode-has-been-confirmed.patch new file mode 100644 index 00000000000..94559a516bb --- /dev/null +++ b/queue-2.6.33/thinkpad-acpi-r52-brightness_mode-has-been-confirmed.patch @@ -0,0 +1,41 @@ +From 7d1894d8d1c411d2dad95abfe0f65bacf68c4afa Mon Sep 17 00:00:00 2001 +From: Henrique de Moraes Holschuh +Date: Thu, 25 Feb 2010 21:28:56 -0300 +Subject: thinkpad-acpi: R52 brightness_mode has been confirmed + +From: Henrique de Moraes Holschuh + +commit 7d1894d8d1c411d2dad95abfe0f65bacf68c4afa upstream. + +We can stop pestering users for confirmation of the brightness_mode +default for firmware TP-76. + +While at it, add a few missing comments in that quirk table. + +Reported-by: Whoopie +Signed-off-by: Henrique de Moraes Holschuh +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/platform/x86/thinkpad_acpi.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/platform/x86/thinkpad_acpi.c ++++ b/drivers/platform/x86/thinkpad_acpi.c +@@ -6128,13 +6128,13 @@ static const struct tpacpi_quirk brightn + TPACPI_Q_IBM('1', 'Y', TPACPI_BRGHT_Q_EC), /* T43/p ATI */ + + /* Models with ATI GPUs that can use ECNVRAM */ +- TPACPI_Q_IBM('1', 'R', TPACPI_BRGHT_Q_EC), ++ TPACPI_Q_IBM('1', 'R', TPACPI_BRGHT_Q_EC), /* R50,51 T40-42 */ + TPACPI_Q_IBM('1', 'Q', TPACPI_BRGHT_Q_ASK|TPACPI_BRGHT_Q_EC), +- TPACPI_Q_IBM('7', '6', TPACPI_BRGHT_Q_ASK|TPACPI_BRGHT_Q_EC), ++ TPACPI_Q_IBM('7', '6', TPACPI_BRGHT_Q_EC), /* R52 */ + TPACPI_Q_IBM('7', '8', TPACPI_BRGHT_Q_ASK|TPACPI_BRGHT_Q_EC), + + /* Models with Intel Extreme Graphics 2 */ +- TPACPI_Q_IBM('1', 'U', TPACPI_BRGHT_Q_NOEC), ++ TPACPI_Q_IBM('1', 'U', TPACPI_BRGHT_Q_NOEC), /* X40 */ + TPACPI_Q_IBM('1', 'V', TPACPI_BRGHT_Q_ASK|TPACPI_BRGHT_Q_EC), + TPACPI_Q_IBM('1', 'W', TPACPI_BRGHT_Q_ASK|TPACPI_BRGHT_Q_EC), + diff --git a/queue-2.6.33/usb-add-new-ftdi_sio-device-ids.patch b/queue-2.6.33/usb-add-new-ftdi_sio-device-ids.patch new file mode 100644 index 00000000000..34358fca8f6 --- /dev/null +++ b/queue-2.6.33/usb-add-new-ftdi_sio-device-ids.patch @@ -0,0 +1,46 @@ +From 9714080d20f2ec4b671a06ce69367d91fa9e227e Mon Sep 17 00:00:00 2001 +From: Mitchell Solomon +Date: Fri, 12 Feb 2010 13:23:18 -0500 +Subject: USB: add new ftdi_sio device ids + +From: Mitchell Solomon + +commit 9714080d20f2ec4b671a06ce69367d91fa9e227e upstream. + +PID patch for my products + +Signed-off-by: Mitchell Solomon +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/ftdi_sio.c | 4 ++++ + drivers/usb/serial/ftdi_sio_ids.h | 8 ++++++++ + 2 files changed, 12 insertions(+) + +--- a/drivers/usb/serial/ftdi_sio.c ++++ b/drivers/usb/serial/ftdi_sio.c +@@ -737,6 +737,10 @@ static struct usb_device_id id_table_com + .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, + { USB_DEVICE(FTDI_VID, HAMEG_HO820_PID) }, + { USB_DEVICE(FTDI_VID, HAMEG_HO870_PID) }, ++ { USB_DEVICE(FTDI_VID, MJSG_GENERIC_PID) }, ++ { USB_DEVICE(FTDI_VID, MJSG_SR_RADIO_PID) }, ++ { USB_DEVICE(FTDI_VID, MJSG_HD_RADIO_PID) }, ++ { USB_DEVICE(FTDI_VID, MJSG_XM_RADIO_PID) }, + { }, /* Optional parameter entry */ + { } /* Terminating entry */ + }; +--- a/drivers/usb/serial/ftdi_sio_ids.h ++++ b/drivers/usb/serial/ftdi_sio_ids.h +@@ -1002,3 +1002,11 @@ + #define EVO_8U232AM_PID 0x02FF /* Evolution robotics RCM2 (FT232AM)*/ + #define EVO_HYBRID_PID 0x0302 /* Evolution robotics RCM4 PID (FT232BM)*/ + #define EVO_RCM4_PID 0x0303 /* Evolution robotics RCM4 PID */ ++ ++/* ++ * MJS Gadgets HD Radio / XM Radio / Sirius Radio interfaces (using VID 0x0403) ++ */ ++#define MJSG_GENERIC_PID 0x9378 ++#define MJSG_SR_RADIO_PID 0x9379 ++#define MJSG_XM_RADIO_PID 0x937A ++#define MJSG_HD_RADIO_PID 0x937C diff --git a/queue-2.6.33/usb-f_mass_storage-fix-crash-on-bind-error.patch b/queue-2.6.33/usb-f_mass_storage-fix-crash-on-bind-error.patch new file mode 100644 index 00000000000..9b4b8124f2f --- /dev/null +++ b/queue-2.6.33/usb-f_mass_storage-fix-crash-on-bind-error.patch @@ -0,0 +1,30 @@ +From 8e7e61dfbf1ec6418bf89505980b158a8d00d877 Mon Sep 17 00:00:00 2001 +From: Peter Korsgaard +Date: Thu, 4 Feb 2010 17:15:25 +0100 +Subject: USB: f_mass_storage: fix crash on bind() error + +From: Peter Korsgaard + +commit 8e7e61dfbf1ec6418bf89505980b158a8d00d877 upstream. + +init_completion() hasn't been called yet and the thread isn't created +if we end up here, so don't call complete() on thread_notifier. + +Signed-off-by: Peter Korsgaard +Acked-by: Michal Nazarewicz +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/gadget/f_mass_storage.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/drivers/usb/gadget/f_mass_storage.c ++++ b/drivers/usb/gadget/f_mass_storage.c +@@ -2852,7 +2852,6 @@ error_release: + /* Call fsg_common_release() directly, ref might be not + * initialised */ + fsg_common_release(&common->ref); +- complete(&common->thread_notifier); + return ERR_PTR(rc); + } + diff --git a/queue-2.6.33/usb-fix-crash-in-uhci_scan_schedule.patch b/queue-2.6.33/usb-fix-crash-in-uhci_scan_schedule.patch new file mode 100644 index 00000000000..d3155431a8a --- /dev/null +++ b/queue-2.6.33/usb-fix-crash-in-uhci_scan_schedule.patch @@ -0,0 +1,59 @@ +From d23356da714595b888686d22cd19061323c09190 Mon Sep 17 00:00:00 2001 +From: Pete Zaitcev +Date: Fri, 8 Jan 2010 15:39:22 -0700 +Subject: USB: fix crash in uhci_scan_schedule + +From: Pete Zaitcev + +commit d23356da714595b888686d22cd19061323c09190 upstream. + +When hardware is removed on a Stratus, the system may crash like this: + +ACPI: PCI interrupt for device 0000:7c:00.1 disabled +Trying to free nonexistent resource <00000000a8000000-00000000afffffff> +Trying to free nonexistent resource <00000000a4800000-00000000a480ffff> +uhci_hcd 0000:7e:1d.0: remove, state 1 +usb usb2: USB disconnect, address 1 +usb 2-1: USB disconnect, address 2 +Unable to handle kernel paging request at 0000000000100100 RIP: + [] :uhci_hcd:uhci_scan_schedule+0xa2/0x89c + + #4 [ffff81011de17e50] uhci_scan_schedule at ffffffff88021918 + #5 [ffff81011de17ed0] uhci_irq at ffffffff88023cb8 + #6 [ffff81011de17f10] usb_hcd_irq at ffffffff801f1c1f + #7 [ffff81011de17f20] handle_IRQ_event at ffffffff8001123b + #8 [ffff81011de17f50] __do_IRQ at ffffffff800ba749 + +This occurs because an interrupt scans uhci->skelqh, which is +being freed. We do the right thing: disable the interrupts in the +device, and do not do any processing if the interrupt is shared +with other source, but it's possible that another CPU gets +delayed somewhere (e.g. loops) until we started freeing. + +The agreed-upon solution is to wait for interrupts to play out +before proceeding. No other bareers are neceesary. + +A backport of this patch was tested on a 2.6.18 based kernel. +Testing of 2.6.32-based kernels is under way, but it takes us +forever (months) to turn this around. So I think it's a good +patch and we should keep it. + +Tracked in RH bz#516851 + +Signed-Off-By: Pete Zaitcev +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/uhci-hcd.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/host/uhci-hcd.c ++++ b/drivers/usb/host/uhci-hcd.c +@@ -735,6 +735,7 @@ static void uhci_stop(struct usb_hcd *hc + uhci_hc_died(uhci); + uhci_scan_schedule(uhci); + spin_unlock_irq(&uhci->lock); ++ synchronize_irq(hcd->irq); + + del_timer_sync(&uhci->fsbr_timer); + release_uhci(uhci); diff --git a/queue-2.6.33/usb-fix-the-idproduct-value-for-usb-3.0-root-hubs.patch b/queue-2.6.33/usb-fix-the-idproduct-value-for-usb-3.0-root-hubs.patch new file mode 100644 index 00000000000..09dde5ea6ce --- /dev/null +++ b/queue-2.6.33/usb-fix-the-idproduct-value-for-usb-3.0-root-hubs.patch @@ -0,0 +1,31 @@ +From cd780694920fbf869b23c8afb0bd083e7b0448c7 Mon Sep 17 00:00:00 2001 +From: Alan Stern +Date: Thu, 25 Feb 2010 13:19:37 -0500 +Subject: USB: fix the idProduct value for USB-3.0 root hubs + +From: Alan Stern + +commit cd780694920fbf869b23c8afb0bd083e7b0448c7 upstream. + +This patch (as1346) changes the idProduct value for USB-3.0 root hubs +from 0x0002 (which we already use for USB-2.0 root hubs) to 0x0003. + +Signed-off-by: Alan Stern +Acked-by: Sarah Sharp +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/hcd.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/core/hcd.c ++++ b/drivers/usb/core/hcd.c +@@ -141,7 +141,7 @@ static const u8 usb3_rh_dev_descriptor[1 + 0x09, /* __u8 bMaxPacketSize0; 2^9 = 512 Bytes */ + + 0x6b, 0x1d, /* __le16 idVendor; Linux Foundation */ +- 0x02, 0x00, /* __le16 idProduct; device 0x0002 */ ++ 0x03, 0x00, /* __le16 idProduct; device 0x0003 */ + KERNEL_VER, KERNEL_REL, /* __le16 bcdDevice */ + + 0x03, /* __u8 iManufacturer; */ diff --git a/queue-2.6.33/usb-move-hcd-free_dev-call-into-usb_disconnect-to-fix-oops.patch b/queue-2.6.33/usb-move-hcd-free_dev-call-into-usb_disconnect-to-fix-oops.patch new file mode 100644 index 00000000000..ad08c58ed57 --- /dev/null +++ b/queue-2.6.33/usb-move-hcd-free_dev-call-into-usb_disconnect-to-fix-oops.patch @@ -0,0 +1,94 @@ +From f7410ced7f931bb1ad79d1336412cf7b7a33cb14 Mon Sep 17 00:00:00 2001 +From: Herbert Xu +Date: Sun, 10 Jan 2010 20:15:03 +1100 +Subject: USB: Move hcd free_dev call into usb_disconnect to fix oops + +From: Herbert Xu + +commit f7410ced7f931bb1ad79d1336412cf7b7a33cb14 upstream. + +USB: Move hcd free_dev call into usb_disconnect + +I found a way to oops the kernel: + +1. Open a USB device through devio. +2. Remove the hcd module in the host kernel. +3. Close the devio file descriptor. + +The problem is that closing the file descriptor does usb_release_dev +as it is the last reference. usb_release_dev then tries to invoke +the hcd free_dev function (or rather dereferencing the hcd driver +struct). This causes an oops as the hcd driver has already been +unloaded so the struct is gone. + +This patch tries to fix this by bringing the free_dev call earlier +and into usb_disconnect. I have verified that repeating the +above steps no longer crashes with this patch applied. + +Signed-off-by: Herbert Xu +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/hcd.h | 2 +- + drivers/usb/core/hub.c | 12 ++++++++++++ + drivers/usb/core/usb.c | 3 --- + 3 files changed, 13 insertions(+), 4 deletions(-) + +--- a/drivers/usb/core/hcd.h ++++ b/drivers/usb/core/hcd.h +@@ -248,7 +248,7 @@ struct hc_driver { + /* xHCI specific functions */ + /* Called by usb_alloc_dev to alloc HC device structures */ + int (*alloc_dev)(struct usb_hcd *, struct usb_device *); +- /* Called by usb_release_dev to free HC device structures */ ++ /* Called by usb_disconnect to free HC device structures */ + void (*free_dev)(struct usb_hcd *, struct usb_device *); + + /* Bandwidth computation functions */ +--- a/drivers/usb/core/hub.c ++++ b/drivers/usb/core/hub.c +@@ -1554,6 +1554,15 @@ static inline void usb_stop_pm(struct us + + #endif + ++static void hub_free_dev(struct usb_device *udev) ++{ ++ struct usb_hcd *hcd = bus_to_hcd(udev->bus); ++ ++ /* Root hubs aren't real devices, so don't free HCD resources */ ++ if (hcd->driver->free_dev && udev->parent) ++ hcd->driver->free_dev(hcd, udev); ++} ++ + /** + * usb_disconnect - disconnect a device (usbcore-internal) + * @pdev: pointer to device being disconnected +@@ -1624,6 +1633,8 @@ void usb_disconnect(struct usb_device ** + + usb_stop_pm(udev); + ++ hub_free_dev(udev); ++ + put_device(&udev->dev); + } + +@@ -3191,6 +3202,7 @@ loop_disable: + loop: + usb_ep0_reinit(udev); + release_address(udev); ++ hub_free_dev(udev); + usb_put_dev(udev); + if ((status == -ENOTCONN) || (status == -ENOTSUPP)) + break; +--- a/drivers/usb/core/usb.c ++++ b/drivers/usb/core/usb.c +@@ -228,9 +228,6 @@ static void usb_release_dev(struct devic + hcd = bus_to_hcd(udev->bus); + + usb_destroy_configuration(udev); +- /* Root hubs aren't real devices, so don't free HCD resources */ +- if (hcd->driver->free_dev && udev->parent) +- hcd->driver->free_dev(hcd, udev); + usb_put_hcd(hcd); + kfree(udev->product); + kfree(udev->manufacturer); diff --git a/queue-2.6.33/usb-remove-debugging-message-for-uevent-constructions.patch b/queue-2.6.33/usb-remove-debugging-message-for-uevent-constructions.patch new file mode 100644 index 00000000000..7270c9d7f38 --- /dev/null +++ b/queue-2.6.33/usb-remove-debugging-message-for-uevent-constructions.patch @@ -0,0 +1,39 @@ +From cceffe9348f93188d7811bda95924d4bd3040d0f Mon Sep 17 00:00:00 2001 +From: Alan Stern +Date: Mon, 8 Feb 2010 09:45:12 -0500 +Subject: USB: remove debugging message for uevent constructions + +From: Alan Stern + +commit cceffe9348f93188d7811bda95924d4bd3040d0f upstream. + +This patch (as1332) removes an unneeded and annoying debugging message +announcing all USB uevent constructions. + +Signed-off-by: Alan Stern +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/driver.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +--- a/drivers/usb/core/driver.c ++++ b/drivers/usb/core/driver.c +@@ -691,9 +691,6 @@ static int usb_uevent(struct device *dev + { + struct usb_device *usb_dev; + +- /* driver is often null here; dev_dbg() would oops */ +- pr_debug("usb %s: uevent\n", dev_name(dev)); +- + if (is_usb_device(dev)) { + usb_dev = to_usb_device(dev); + } else if (is_usb_interface(dev)) { +@@ -705,6 +702,7 @@ static int usb_uevent(struct device *dev + } + + if (usb_dev->devnum < 0) { ++ /* driver is often null here; dev_dbg() would oops */ + pr_debug("usb %s: already deleted?\n", dev_name(dev)); + return -ENODEV; + } diff --git a/queue-2.6.33/usb-xhci-fix-finding-extended-capabilities-registers.patch b/queue-2.6.33/usb-xhci-fix-finding-extended-capabilities-registers.patch new file mode 100644 index 00000000000..eb6d3519020 --- /dev/null +++ b/queue-2.6.33/usb-xhci-fix-finding-extended-capabilities-registers.patch @@ -0,0 +1,43 @@ +From 05197921ff3dad52d99fd1647974c57d9c28d40e Mon Sep 17 00:00:00 2001 +From: Edward Shao +Date: Thu, 11 Feb 2010 03:37:30 +0800 +Subject: USB: xhci: Fix finding extended capabilities registers + +From: Edward Shao + +commit 05197921ff3dad52d99fd1647974c57d9c28d40e upstream. + +According "5.3.6 Capability Parameters (HCCPARAMS)" of xHCI rev0.96 spec, +value of xECP register indicates a relative offset, in 32-bit words, +from Base to the beginning of the first extended capability. +The wrong calculation will cause BIOS handoff fail (not handoff from BIOS) +in some platform with BIOS USB legacy sup support. + +Signed-off-by: Edward Shao +Cc: Sarah Sharp +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/xhci-ext-caps.h | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/drivers/usb/host/xhci-ext-caps.h ++++ b/drivers/usb/host/xhci-ext-caps.h +@@ -101,12 +101,15 @@ static inline int xhci_find_next_cap_off + + next = readl(base + ext_offset); + +- if (ext_offset == XHCI_HCC_PARAMS_OFFSET) ++ if (ext_offset == XHCI_HCC_PARAMS_OFFSET) { + /* Find the first extended capability */ + next = XHCI_HCC_EXT_CAPS(next); +- else ++ ext_offset = 0; ++ } else { + /* Find the next extended capability */ + next = XHCI_EXT_CAPS_NEXT(next); ++ } ++ + if (!next) + return 0; + /* diff --git a/queue-2.6.33/x86-add-imac9-1-to-pci_reboot_dmi_table.patch b/queue-2.6.33/x86-add-imac9-1-to-pci_reboot_dmi_table.patch new file mode 100644 index 00000000000..5449cafbea4 --- /dev/null +++ b/queue-2.6.33/x86-add-imac9-1-to-pci_reboot_dmi_table.patch @@ -0,0 +1,39 @@ +From 0a832320f1bae6a4169bf683e201378f2437cfc1 Mon Sep 17 00:00:00 2001 +From: Justin P. Mattock +Date: Tue, 16 Feb 2010 15:17:29 -0800 +Subject: x86: Add iMac9,1 to pci_reboot_dmi_table + +From: Justin P. Mattock + +commit 0a832320f1bae6a4169bf683e201378f2437cfc1 upstream. + +On the iMac9,1 /sbin/reboot results in a black mangled screen. Adding +this DMI entry gets the machine to reboot cleanly as it should. + +Signed-off-by: Justin P. Mattock +LKML-Reference: <1266362249-3337-1-git-send-email-justinmattock@gmail.com> +Signed-off-by: H. Peter Anvin +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/reboot.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/arch/x86/kernel/reboot.c ++++ b/arch/x86/kernel/reboot.c +@@ -461,6 +461,14 @@ static struct dmi_system_id __initdata p + DMI_MATCH(DMI_PRODUCT_NAME, "Macmini3,1"), + }, + }, ++ { /* Handle problems with rebooting on the iMac9,1. */ ++ .callback = set_pci_reboot, ++ .ident = "Apple iMac9,1", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "iMac9,1"), ++ }, ++ }, + { } + }; + diff --git a/queue-2.6.33/x86-avoid-race-condition-in-pci_enable_msix.patch b/queue-2.6.33/x86-avoid-race-condition-in-pci_enable_msix.patch new file mode 100644 index 00000000000..77a9458f180 --- /dev/null +++ b/queue-2.6.33/x86-avoid-race-condition-in-pci_enable_msix.patch @@ -0,0 +1,215 @@ +From ced5b697a76d325e7a7ac7d382dbbb632c765093 Mon Sep 17 00:00:00 2001 +From: Brandon Phiilps +Date: Wed, 10 Feb 2010 01:20:06 -0800 +Subject: x86: Avoid race condition in pci_enable_msix() + +From: Brandon Phiilps + +commit ced5b697a76d325e7a7ac7d382dbbb632c765093 upstream. + +Keep chip_data in create_irq_nr and destroy_irq. + +When two drivers are setting up MSI-X at the same time via +pci_enable_msix() there is a race. See this dmesg excerpt: + +[ 85.170610] ixgbe 0000:02:00.1: irq 97 for MSI/MSI-X +[ 85.170611] alloc irq_desc for 99 on node -1 +[ 85.170613] igb 0000:08:00.1: irq 98 for MSI/MSI-X +[ 85.170614] alloc kstat_irqs on node -1 +[ 85.170616] alloc irq_2_iommu on node -1 +[ 85.170617] alloc irq_desc for 100 on node -1 +[ 85.170619] alloc kstat_irqs on node -1 +[ 85.170621] alloc irq_2_iommu on node -1 +[ 85.170625] ixgbe 0000:02:00.1: irq 99 for MSI/MSI-X +[ 85.170626] alloc irq_desc for 101 on node -1 +[ 85.170628] igb 0000:08:00.1: irq 100 for MSI/MSI-X +[ 85.170630] alloc kstat_irqs on node -1 +[ 85.170631] alloc irq_2_iommu on node -1 +[ 85.170635] alloc irq_desc for 102 on node -1 +[ 85.170636] alloc kstat_irqs on node -1 +[ 85.170639] alloc irq_2_iommu on node -1 +[ 85.170646] BUG: unable to handle kernel NULL pointer dereference +at 0000000000000088 + +As you can see igb and ixgbe are both alternating on create_irq_nr() +via pci_enable_msix() in their probe function. + +ixgbe: While looping through irq_desc_ptrs[] via create_irq_nr() ixgbe +choses irq_desc_ptrs[102] and exits the loop, drops vector_lock and +calls dynamic_irq_init. Then it sets irq_desc_ptrs[102]->chip_data = +NULL via dynamic_irq_init(). + +igb: Grabs the vector_lock now and starts looping over irq_desc_ptrs[] +via create_irq_nr(). It gets to irq_desc_ptrs[102] and does this: + + cfg_new = irq_desc_ptrs[102]->chip_data; + if (cfg_new->vector != 0) + continue; + +This hits the NULL deref. + +Another possible race exists via pci_disable_msix() in a driver or in +the number of error paths that call free_msi_irqs(): + +destroy_irq() +dynamic_irq_cleanup() which sets desc->chip_data = NULL +...race window... +desc->chip_data = cfg; + +Remove the save and restore code for cfg in create_irq_nr() and +destroy_irq() and take the desc->lock when checking the irq_cfg. + +Reported-and-analyzed-by: Brandon Philips +Signed-off-by: Yinghai Lu +LKML-Reference: <1265793639-15071-3-git-send-email-yinghai@kernel.org> +Signed-off-by: Brandon Phililps +Signed-off-by: H. Peter Anvin +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/apic/io_apic.c | 18 +++----------- + include/linux/irq.h | 2 + + kernel/irq/chip.c | 52 +++++++++++++++++++++++++++++++++-------- + 3 files changed, 50 insertions(+), 22 deletions(-) + +--- a/arch/x86/kernel/apic/io_apic.c ++++ b/arch/x86/kernel/apic/io_apic.c +@@ -3228,12 +3228,9 @@ unsigned int create_irq_nr(unsigned int + } + spin_unlock_irqrestore(&vector_lock, flags); + +- if (irq > 0) { +- dynamic_irq_init(irq); +- /* restore it, in case dynamic_irq_init clear it */ +- if (desc_new) +- desc_new->chip_data = cfg_new; +- } ++ if (irq > 0) ++ dynamic_irq_init_keep_chip_data(irq); ++ + return irq; + } + +@@ -3256,17 +3253,12 @@ void destroy_irq(unsigned int irq) + { + unsigned long flags; + struct irq_cfg *cfg; +- struct irq_desc *desc; + +- /* store it, in case dynamic_irq_cleanup clear it */ +- desc = irq_to_desc(irq); +- cfg = desc->chip_data; +- dynamic_irq_cleanup(irq); +- /* connect back irq_cfg */ +- desc->chip_data = cfg; ++ dynamic_irq_cleanup_keep_chip_data(irq); + + free_irte(irq); + spin_lock_irqsave(&vector_lock, flags); ++ cfg = irq_to_desc(irq)->chip_data; + __clear_irq_vector(irq, cfg); + spin_unlock_irqrestore(&vector_lock, flags); + } +--- a/include/linux/irq.h ++++ b/include/linux/irq.h +@@ -400,7 +400,9 @@ static inline int irq_has_action(unsigne + + /* Dynamic irq helper functions */ + extern void dynamic_irq_init(unsigned int irq); ++void dynamic_irq_init_keep_chip_data(unsigned int irq); + extern void dynamic_irq_cleanup(unsigned int irq); ++void dynamic_irq_cleanup_keep_chip_data(unsigned int irq); + + /* Set/get chip/data for an IRQ: */ + extern int set_irq_chip(unsigned int irq, struct irq_chip *chip); +--- a/kernel/irq/chip.c ++++ b/kernel/irq/chip.c +@@ -18,11 +18,7 @@ + + #include "internals.h" + +-/** +- * dynamic_irq_init - initialize a dynamically allocated irq +- * @irq: irq number to initialize +- */ +-void dynamic_irq_init(unsigned int irq) ++static void dynamic_irq_init_x(unsigned int irq, bool keep_chip_data) + { + struct irq_desc *desc; + unsigned long flags; +@@ -41,7 +37,8 @@ void dynamic_irq_init(unsigned int irq) + desc->depth = 1; + desc->msi_desc = NULL; + desc->handler_data = NULL; +- desc->chip_data = NULL; ++ if (!keep_chip_data) ++ desc->chip_data = NULL; + desc->action = NULL; + desc->irq_count = 0; + desc->irqs_unhandled = 0; +@@ -55,10 +52,26 @@ void dynamic_irq_init(unsigned int irq) + } + + /** +- * dynamic_irq_cleanup - cleanup a dynamically allocated irq ++ * dynamic_irq_init - initialize a dynamically allocated irq + * @irq: irq number to initialize + */ +-void dynamic_irq_cleanup(unsigned int irq) ++void dynamic_irq_init(unsigned int irq) ++{ ++ dynamic_irq_init_x(irq, false); ++} ++ ++/** ++ * dynamic_irq_init_keep_chip_data - initialize a dynamically allocated irq ++ * @irq: irq number to initialize ++ * ++ * does not set irq_to_desc(irq)->chip_data to NULL ++ */ ++void dynamic_irq_init_keep_chip_data(unsigned int irq) ++{ ++ dynamic_irq_init_x(irq, true); ++} ++ ++static void dynamic_irq_cleanup_x(unsigned int irq, bool keep_chip_data) + { + struct irq_desc *desc = irq_to_desc(irq); + unsigned long flags; +@@ -77,7 +90,8 @@ void dynamic_irq_cleanup(unsigned int ir + } + desc->msi_desc = NULL; + desc->handler_data = NULL; +- desc->chip_data = NULL; ++ if (!keep_chip_data) ++ desc->chip_data = NULL; + desc->handle_irq = handle_bad_irq; + desc->chip = &no_irq_chip; + desc->name = NULL; +@@ -85,6 +99,26 @@ void dynamic_irq_cleanup(unsigned int ir + raw_spin_unlock_irqrestore(&desc->lock, flags); + } + ++/** ++ * dynamic_irq_cleanup - cleanup a dynamically allocated irq ++ * @irq: irq number to initialize ++ */ ++void dynamic_irq_cleanup(unsigned int irq) ++{ ++ dynamic_irq_cleanup_x(irq, false); ++} ++ ++/** ++ * dynamic_irq_cleanup_keep_chip_data - cleanup a dynamically allocated irq ++ * @irq: irq number to initialize ++ * ++ * does not set irq_to_desc(irq)->chip_data to NULL ++ */ ++void dynamic_irq_cleanup_keep_chip_data(unsigned int irq) ++{ ++ dynamic_irq_cleanup_x(irq, true); ++} ++ + + /** + * set_irq_chip - set the irq chip for an irq diff --git a/queue-2.6.33/x86-fix-sci-on-ioapic-0.patch b/queue-2.6.33/x86-fix-sci-on-ioapic-0.patch new file mode 100644 index 00000000000..5f541335f85 --- /dev/null +++ b/queue-2.6.33/x86-fix-sci-on-ioapic-0.patch @@ -0,0 +1,139 @@ +From 18dce6ba5c8c6bd0f3ab4efa4cbdd698dab5c40a Mon Sep 17 00:00:00 2001 +From: Yinghai Lu +Date: Wed, 10 Feb 2010 01:20:05 -0800 +Subject: x86: Fix SCI on IOAPIC != 0 + +From: Yinghai Lu + +commit 18dce6ba5c8c6bd0f3ab4efa4cbdd698dab5c40a upstream. + +Thomas Renninger reported on IBM x3330 + +booting a latest kernel on this machine results in: + +PCI: PCI BIOS revision 2.10 entry at 0xfd61c, last bus=1 +PCI: Using configuration type 1 for base access bio: create slab at 0 +ACPI: SCI (IRQ30) allocation failed +ACPI Exception: AE_NOT_ACQUIRED, Unable to install System Control Interrupt handler (20090903/evevent-161) +ACPI: Unable to start the ACPI Interpreter + +Later all kind of devices fail... + +and bisect it down to this commit: +commit b9c61b70075c87a8612624736faf4a2de5b1ed30 + + x86/pci: update pirq_enable_irq() to setup io apic routing + +it turns out we need to set irq routing for the sci on ioapic1 early. + +-v2: make it work without sparseirq too. +-v3: fix checkpatch.pl warning, and cc to stable + +Reported-by: Thomas Renninger +Bisected-by: Thomas Renninger +Tested-by: Thomas Renninger +Signed-off-by: Yinghai Lu +LKML-Reference: <1265793639-15071-2-git-send-email-yinghai@kernel.org> +Signed-off-by: H. Peter Anvin +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/include/asm/io_apic.h | 1 + arch/x86/kernel/acpi/boot.c | 9 ++++++- + arch/x86/kernel/apic/io_apic.c | 50 +++++++++++++++++++++++++++++++++++++++++ + 3 files changed, 59 insertions(+), 1 deletion(-) + +--- a/arch/x86/include/asm/io_apic.h ++++ b/arch/x86/include/asm/io_apic.h +@@ -160,6 +160,7 @@ extern int io_apic_get_redir_entries(int + struct io_apic_irq_attr; + extern int io_apic_set_pci_routing(struct device *dev, int irq, + struct io_apic_irq_attr *irq_attr); ++void setup_IO_APIC_irq_extra(u32 gsi); + extern int (*ioapic_renumber_irq)(int ioapic, int irq); + extern void ioapic_init_mappings(void); + extern void ioapic_insert_resources(void); +--- a/arch/x86/kernel/acpi/boot.c ++++ b/arch/x86/kernel/acpi/boot.c +@@ -446,6 +446,12 @@ void __init acpi_pic_sci_set_trigger(uns + int acpi_gsi_to_irq(u32 gsi, unsigned int *irq) + { + *irq = gsi; ++ ++#ifdef CONFIG_X86_IO_APIC ++ if (acpi_irq_model == ACPI_IRQ_MODEL_IOAPIC) ++ setup_IO_APIC_irq_extra(gsi); ++#endif ++ + return 0; + } + +@@ -473,7 +479,8 @@ int acpi_register_gsi(struct device *dev + plat_gsi = mp_register_gsi(dev, gsi, trigger, polarity); + } + #endif +- acpi_gsi_to_irq(plat_gsi, &irq); ++ irq = plat_gsi; ++ + return irq; + } + +--- a/arch/x86/kernel/apic/io_apic.c ++++ b/arch/x86/kernel/apic/io_apic.c +@@ -1539,6 +1539,56 @@ static void __init setup_IO_APIC_irqs(vo + } + + /* ++ * for the gsit that is not in first ioapic ++ * but could not use acpi_register_gsi() ++ * like some special sci in IBM x3330 ++ */ ++void setup_IO_APIC_irq_extra(u32 gsi) ++{ ++ int apic_id = 0, pin, idx, irq; ++ int node = cpu_to_node(boot_cpu_id); ++ struct irq_desc *desc; ++ struct irq_cfg *cfg; ++ ++ /* ++ * Convert 'gsi' to 'ioapic.pin'. ++ */ ++ apic_id = mp_find_ioapic(gsi); ++ if (apic_id < 0) ++ return; ++ ++ pin = mp_find_ioapic_pin(apic_id, gsi); ++ idx = find_irq_entry(apic_id, pin, mp_INT); ++ if (idx == -1) ++ return; ++ ++ irq = pin_2_irq(idx, apic_id, pin); ++#ifdef CONFIG_SPARSE_IRQ ++ desc = irq_to_desc(irq); ++ if (desc) ++ return; ++#endif ++ desc = irq_to_desc_alloc_node(irq, node); ++ if (!desc) { ++ printk(KERN_INFO "can not get irq_desc for %d\n", irq); ++ return; ++ } ++ ++ cfg = desc->chip_data; ++ add_pin_to_irq_node(cfg, node, apic_id, pin); ++ ++ if (test_bit(pin, mp_ioapic_routing[apic_id].pin_programmed)) { ++ pr_debug("Pin %d-%d already programmed\n", ++ mp_ioapics[apic_id].apicid, pin); ++ return; ++ } ++ set_bit(pin, mp_ioapic_routing[apic_id].pin_programmed); ++ ++ setup_IO_APIC_irq(apic_id, pin, irq, desc, ++ irq_trigger(idx), irq_polarity(idx)); ++} ++ ++/* + * Set up the timer pin, possibly with the 8259A-master behind. + */ + static void __init setup_timer_IRQ0_pin(unsigned int apic_id, unsigned int pin, diff --git a/queue-2.6.33/x86-ia32_aout-do-not-kill-argument-mapping.patch b/queue-2.6.33/x86-ia32_aout-do-not-kill-argument-mapping.patch new file mode 100644 index 00000000000..7c2ee1f3b92 --- /dev/null +++ b/queue-2.6.33/x86-ia32_aout-do-not-kill-argument-mapping.patch @@ -0,0 +1,42 @@ +From 318f6b228ba88a394ef560efc1bfe028ad5ae6b6 Mon Sep 17 00:00:00 2001 +From: Jiri Slaby +Date: Wed, 10 Feb 2010 20:55:16 +0100 +Subject: x86, ia32_aout: do not kill argument mapping + +From: Jiri Slaby + +commit 318f6b228ba88a394ef560efc1bfe028ad5ae6b6 upstream. + +Do not set current->mm->mmap to NULL in 32-bit emulation on 64-bit +load_aout_binary after flush_old_exec as it would destroy already +set brpm mapping with arguments. + +Introduced by b6a2fea39318e43fee84fa7b0b90d68bed92d2ba +mm: variable length argument support +where the argument mapping in bprm was added. + +[ hpa: this is a regression from 2.6.22... time to kill a.out? ] + +Signed-off-by: Jiri Slaby +LKML-Reference: <1265831716-7668-1-git-send-email-jslaby@suse.cz> +Cc: Ingo Molnar +Cc: Thomas Gleixner +Cc: Ollie Wild +Cc: x86@kernel.org +Signed-off-by: H. Peter Anvin +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/ia32/ia32_aout.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/arch/x86/ia32/ia32_aout.c ++++ b/arch/x86/ia32/ia32_aout.c +@@ -327,7 +327,6 @@ static int load_aout_binary(struct linux + current->mm->free_area_cache = TASK_UNMAPPED_BASE; + current->mm->cached_hole_size = 0; + +- current->mm->mmap = NULL; + install_exec_creds(bprm); + current->flags &= ~PF_FORKNOEXEC; + diff --git a/queue-2.6.33/x86-xen-disable-highmem-pte-allocation-even-when-config_highpte-y.patch b/queue-2.6.33/x86-xen-disable-highmem-pte-allocation-even-when-config_highpte-y.patch new file mode 100644 index 00000000000..b8d1d468341 --- /dev/null +++ b/queue-2.6.33/x86-xen-disable-highmem-pte-allocation-even-when-config_highpte-y.patch @@ -0,0 +1,79 @@ +From 817a824b75b1475f1b067c8cee318c7b4d66fcde Mon Sep 17 00:00:00 2001 +From: Ian Campbell +Date: Fri, 26 Feb 2010 17:16:00 +0000 +Subject: x86, xen: Disable highmem PTE allocation even when CONFIG_HIGHPTE=y +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ian Campbell + +commit 817a824b75b1475f1b067c8cee318c7b4d66fcde upstream. + +There's a path in the pagefault code where the kernel deliberately +breaks its own locking rules by kmapping a high pte page without +holding the pagetable lock (in at least page_check_address). This +breaks Xen's ability to track the pinned/unpinned state of the +page. There does not appear to be a viable workaround for this +behaviour so simply disable HIGHPTE for all Xen guests. + +Signed-off-by: Ian Campbell +LKML-Reference: <1267204562-11844-1-git-send-email-ian.campbell@citrix.com> +Cc: Jeremy Fitzhardinge +Cc: Ingo Molnar +Cc: Pasi Kärkkäinen +Cc: +Signed-off-by: H. Peter Anvin +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/xen/enlighten.c | 7 +++++++ + arch/x86/xen/mmu.c | 11 ++++++----- + 2 files changed, 13 insertions(+), 5 deletions(-) + +--- a/arch/x86/xen/enlighten.c ++++ b/arch/x86/xen/enlighten.c +@@ -50,6 +50,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -1094,6 +1095,12 @@ asmlinkage void __init xen_start_kernel( + + __supported_pte_mask |= _PAGE_IOMAP; + ++ /* ++ * Prevent page tables from being allocated in highmem, even ++ * if CONFIG_HIGHPTE is enabled. ++ */ ++ __userpte_alloc_gfp &= ~__GFP_HIGHMEM; ++ + /* Work out if we support NX */ + x86_configure_nx(); + +--- a/arch/x86/xen/mmu.c ++++ b/arch/x86/xen/mmu.c +@@ -1432,14 +1432,15 @@ static void *xen_kmap_atomic_pte(struct + { + pgprot_t prot = PAGE_KERNEL; + ++ /* ++ * We disable highmem allocations for page tables so we should never ++ * see any calls to kmap_atomic_pte on a highmem page. ++ */ ++ BUG_ON(PageHighMem(page)); ++ + if (PagePinned(page)) + prot = PAGE_KERNEL_RO; + +- if (0 && PageHighMem(page)) +- printk("mapping highpte %lx type %d prot %s\n", +- page_to_pfn(page), type, +- (unsigned long)pgprot_val(prot) & _PAGE_RW ? "WRITE" : "READ"); +- + return kmap_atomic_prot(page, type, prot); + } + #endif