From: Greg Kroah-Hartman Date: Wed, 4 Aug 2010 22:50:10 +0000 (-0700) Subject: .35 patches X-Git-Tag: v2.6.27.50~18 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=1e89d6515945d42ea129d5c3fda5d49a7c0aeee0;p=thirdparty%2Fkernel%2Fstable-queue.git .35 patches --- diff --git a/queue-2.6.35/9p-strlen-doesn-t-count-the-terminator.patch b/queue-2.6.35/9p-strlen-doesn-t-count-the-terminator.patch new file mode 100644 index 00000000000..a6c25481a57 --- /dev/null +++ b/queue-2.6.35/9p-strlen-doesn-t-count-the-terminator.patch @@ -0,0 +1,34 @@ +From 5c4bfa17f3ec46becec4b23d12323f7605ebd696 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Fri, 9 Jul 2010 23:51:54 +0000 +Subject: 9p: strlen() doesn't count the terminator + +From: Dan Carpenter + +commit 5c4bfa17f3ec46becec4b23d12323f7605ebd696 upstream. + +This is an off by one bug because strlen() doesn't count the NULL +terminator. We strcpy() addr into a fixed length array of size +UNIX_PATH_MAX later on. + +The addr variable is the name of the device being mounted. + +Signed-off-by: Dan Carpenter +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + net/9p/trans_fd.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/9p/trans_fd.c ++++ b/net/9p/trans_fd.c +@@ -948,7 +948,7 @@ p9_fd_create_unix(struct p9_client *clie + + csocket = NULL; + +- if (strlen(addr) > UNIX_PATH_MAX) { ++ if (strlen(addr) >= UNIX_PATH_MAX) { + P9_EPRINTK(KERN_ERR, "p9_trans_unix: address too long: %s\n", + addr); + return -ENAMETOOLONG; diff --git a/queue-2.6.35/amd64_edac-correct-scrub-rate-setting.patch b/queue-2.6.35/amd64_edac-correct-scrub-rate-setting.patch new file mode 100644 index 00000000000..6fefa3e49ce --- /dev/null +++ b/queue-2.6.35/amd64_edac-correct-scrub-rate-setting.patch @@ -0,0 +1,30 @@ +From bc57117856cf1e581135810b37d3b75f9d1749f5 Mon Sep 17 00:00:00 2001 +From: Borislav Petkov +Date: Fri, 21 May 2010 21:25:03 +0200 +Subject: amd64_edac: Correct scrub rate setting + +From: Borislav Petkov + +commit bc57117856cf1e581135810b37d3b75f9d1749f5 upstream. + +Exit early when setting scrub rate on unknown/unsupported families. + +Signed-off-by: Borislav Petkov +Acked-by: Doug Thompson +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/edac/amd64_edac.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/edac/amd64_edac.c ++++ b/drivers/edac/amd64_edac.c +@@ -178,7 +178,7 @@ static int amd64_set_scrub_rate(struct m + + default: + amd64_printk(KERN_ERR, "Unsupported family!\n"); +- break; ++ return -EINVAL; + } + return amd64_search_set_scrub_rate(pvt->misc_f3_ctl, *bandwidth, + min_scrubrate); diff --git a/queue-2.6.35/amd64_edac-fix-dct-base-address-selector.patch b/queue-2.6.35/amd64_edac-fix-dct-base-address-selector.patch new file mode 100644 index 00000000000..b93063c0f7e --- /dev/null +++ b/queue-2.6.35/amd64_edac-fix-dct-base-address-selector.patch @@ -0,0 +1,32 @@ +From 9975a5f22a4fcc8d08035c65439900a983f891ad Mon Sep 17 00:00:00 2001 +From: Borislav Petkov +Date: Mon, 8 Mar 2010 18:29:35 +0100 +Subject: amd64_edac: Fix DCT base address selector + +From: Borislav Petkov + +commit 9975a5f22a4fcc8d08035c65439900a983f891ad upstream. + +The correct check is to verify whether in high range we're below 4GB +and not to extract the DctSelBaseAddr again. See "2.8.5 Routing DRAM +Requests" in the F10h BKDG. + +Signed-off-by: Borislav Petkov +Acked-by: Doug Thompson +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/edac/amd64_edac.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/edac/amd64_edac.c ++++ b/drivers/edac/amd64_edac.c +@@ -1430,7 +1430,7 @@ static inline u64 f10_get_base_addr_offs + u64 chan_off; + + if (hi_range_sel) { +- if (!(dct_sel_base_addr & 0xFFFFF800) && ++ if (!(dct_sel_base_addr & 0xFFFF0000) && + hole_valid && (sys_addr >= 0x100000000ULL)) + chan_off = hole_off << 16; + else diff --git a/queue-2.6.35/amd64_edac-fix-operator-precendence-error.patch b/queue-2.6.35/amd64_edac-fix-operator-precendence-error.patch new file mode 100644 index 00000000000..3e473e6afe9 --- /dev/null +++ b/queue-2.6.35/amd64_edac-fix-operator-precendence-error.patch @@ -0,0 +1,29 @@ +From 962b70a1eb22c467b95756a290c694e73da17f41 Mon Sep 17 00:00:00 2001 +From: Borislav Petkov +Date: Tue, 3 Aug 2010 16:51:28 +0200 +Subject: amd64_edac: Fix operator precendence error + +From: Borislav Petkov + +commit 962b70a1eb22c467b95756a290c694e73da17f41 upstream. + +The bitwise AND is of higher precedence, make that explicit. + +Signed-off-by: Borislav Petkov +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/edac/amd64_edac.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/edac/amd64_edac.c ++++ b/drivers/edac/amd64_edac.c +@@ -1679,7 +1679,7 @@ static void f10_map_sysaddr_to_csrow(str + * ganged. Otherwise @chan should already contain the channel at + * this point. + */ +- if (dct_ganging_enabled(pvt) && pvt->nbcfg & K8_NBCFG_CHIPKILL) ++ if (dct_ganging_enabled(pvt) && (pvt->nbcfg & K8_NBCFG_CHIPKILL)) + chan = get_channel_from_ecc_syndrome(mci, syndrome); + + if (chan >= 0) diff --git a/queue-2.6.35/arp_notify-allow-drivers-to-explicitly-request-a-notification-event.patch b/queue-2.6.35/arp_notify-allow-drivers-to-explicitly-request-a-notification-event.patch new file mode 100644 index 00000000000..6bab778093b --- /dev/null +++ b/queue-2.6.35/arp_notify-allow-drivers-to-explicitly-request-a-notification-event.patch @@ -0,0 +1,91 @@ +From 06c4648d46d1b757d6b9591a86810be79818b60c Mon Sep 17 00:00:00 2001 +From: Ian Campbell +Date: Wed, 26 May 2010 00:09:42 +0000 +Subject: arp_notify: allow drivers to explicitly request a notification event. + +From: Ian Campbell + +commit 06c4648d46d1b757d6b9591a86810be79818b60c upstream. + +Currently such notifications are only generated when the device comes up or the +address changes. However one use case for these notifications is to enable +faster network recovery after a virtual machine migration (by causing switches +to relearn their MAC tables). A migration appears to the network stack as a +temporary loss of carrier and therefore does not trigger either of the current +conditions. Rather than adding carrier up as a trigger (which can cause issues +when interfaces a flapping) simply add an interface which the driver can use +to explicitly trigger the notification. + +Signed-off-by: Ian Campbell +Cc: Stephen Hemminger +Cc: Jeremy Fitzhardinge +Cc: David S. Miller +Cc: netdev@vger.kernel.org +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + include/linux/netdevice.h | 2 ++ + include/linux/notifier.h | 1 + + net/ipv4/devinet.c | 1 + + net/sched/sch_generic.c | 18 ++++++++++++++++++ + 4 files changed, 22 insertions(+) + +--- a/include/linux/netdevice.h ++++ b/include/linux/netdevice.h +@@ -1775,6 +1775,8 @@ extern void netif_carrier_on(struct net_ + + extern void netif_carrier_off(struct net_device *dev); + ++extern void netif_notify_peers(struct net_device *dev); ++ + /** + * netif_dormant_on - mark device as dormant. + * @dev: network device +--- a/include/linux/notifier.h ++++ b/include/linux/notifier.h +@@ -210,6 +210,7 @@ static inline int notifier_to_errno(int + #define NETDEV_POST_INIT 0x0010 + #define NETDEV_UNREGISTER_BATCH 0x0011 + #define NETDEV_BONDING_DESLAVE 0x0012 ++#define NETDEV_NOTIFY_PEERS 0x0012 + + #define SYS_DOWN 0x0001 /* Notify of system down */ + #define SYS_RESTART SYS_DOWN +--- a/net/ipv4/devinet.c ++++ b/net/ipv4/devinet.c +@@ -1081,6 +1081,7 @@ static int inetdev_event(struct notifier + } + ip_mc_up(in_dev); + /* fall through */ ++ case NETDEV_NOTIFY_PEERS: + case NETDEV_CHANGEADDR: + /* Send gratuitous ARP to notify of link change */ + if (IN_DEV_ARP_NOTIFY(in_dev)) { +--- a/net/sched/sch_generic.c ++++ b/net/sched/sch_generic.c +@@ -327,6 +327,24 @@ void netif_carrier_off(struct net_device + } + EXPORT_SYMBOL(netif_carrier_off); + ++/** ++ * netif_notify_peers - notify network peers about existence of @dev ++ * @dev: network device ++ * ++ * Generate traffic such that interested network peers are aware of ++ * @dev, such as by generating a gratuitous ARP. This may be used when ++ * a device wants to inform the rest of the network about some sort of ++ * reconfiguration such as a failover event or virtual machine ++ * migration. ++ */ ++void netif_notify_peers(struct net_device *dev) ++{ ++ rtnl_lock(); ++ call_netdevice_notifiers(NETDEV_NOTIFY_PEERS, dev); ++ rtnl_unlock(); ++} ++EXPORT_SYMBOL(netif_notify_peers); ++ + /* "NOOP" scheduler: the best scheduler, recommended for all interfaces + under all circumstances. It is difficult to invent anything faster or + cheaper. diff --git a/queue-2.6.35/ath9k-another-fix-for-the-a-mpdu-buffer-leak.patch b/queue-2.6.35/ath9k-another-fix-for-the-a-mpdu-buffer-leak.patch new file mode 100644 index 00000000000..3a557307cbf --- /dev/null +++ b/queue-2.6.35/ath9k-another-fix-for-the-a-mpdu-buffer-leak.patch @@ -0,0 +1,61 @@ +From 31e79a5954b78fbed15de2c8974d5a2b6019199a Mon Sep 17 00:00:00 2001 +From: Felix Fietkau +Date: Mon, 12 Jul 2010 23:16:34 +0200 +Subject: ath9k: another fix for the A-MPDU buffer leak + +From: Felix Fietkau + +commit 31e79a5954b78fbed15de2c8974d5a2b6019199a upstream. + +The patch 'ath9k: fix a buffer leak in A-MPDU completion' addressed the +issue of running out of buffers/descriptors in the tx path if a STA is +deleted while tx status feedback is still pending. +The remaining issue is that the skbs of the buffers are not reclaimed, +leaving a memory leak. +This patch fixes this issue by running the buffers through +ath_tx_complete_buf(), ensuring that the pending frames counter is also +updated. + +Signed-off-by: Felix Fietkau +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/ath/ath9k/xmit.c | 19 +++++++++++++++---- + 1 file changed, 15 insertions(+), 4 deletions(-) + +--- a/drivers/net/wireless/ath/ath9k/xmit.c ++++ b/drivers/net/wireless/ath/ath9k/xmit.c +@@ -329,7 +329,6 @@ static void ath_tx_complete_aggr(struct + int isaggr, txfail, txpending, sendbar = 0, needreset = 0, nbad = 0; + bool rc_update = true; + struct ieee80211_tx_rate rates[4]; +- unsigned long flags; + + skb = bf->bf_mpdu; + hdr = (struct ieee80211_hdr *)skb->data; +@@ -346,9 +345,21 @@ static void ath_tx_complete_aggr(struct + if (!sta) { + rcu_read_unlock(); + +- spin_lock_irqsave(&sc->tx.txbuflock, flags); +- list_splice_tail_init(bf_q, &sc->tx.txbuf); +- spin_unlock_irqrestore(&sc->tx.txbuflock, flags); ++ INIT_LIST_HEAD(&bf_head); ++ while (bf) { ++ bf_next = bf->bf_next; ++ ++ bf->bf_state.bf_type |= BUF_XRETRY; ++ if ((sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_EDMA) || ++ !bf->bf_stale || bf_next != NULL) ++ list_move_tail(&bf->list, &bf_head); ++ ++ ath_tx_rc_status(bf, ts, 0, 0, false); ++ ath_tx_complete_buf(sc, bf, txq, &bf_head, ts, ++ 0, 0); ++ ++ bf = bf_next; ++ } + return; + } + diff --git a/queue-2.6.35/ath9k-enable-serialize_regmode-for-non-pcie-ar9160.patch b/queue-2.6.35/ath9k-enable-serialize_regmode-for-non-pcie-ar9160.patch new file mode 100644 index 00000000000..8cd98bd1238 --- /dev/null +++ b/queue-2.6.35/ath9k-enable-serialize_regmode-for-non-pcie-ar9160.patch @@ -0,0 +1,31 @@ +From 4c85ab11ca56da1aa59b58c80cc6a356515cc645 Mon Sep 17 00:00:00 2001 +From: John W. Linville +Date: Wed, 28 Jul 2010 10:06:35 -0400 +Subject: ath9k: enable serialize_regmode for non-PCIE AR9160 + +From: John W. Linville + +commit 4c85ab11ca56da1aa59b58c80cc6a356515cc645 upstream. + +https://bugzilla.kernel.org/show_bug.cgi?id=16476 + +Signed-off-by: John W. Linville +Acked-by: Luis R. Rodriguez +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/ath/ath9k/hw.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/net/wireless/ath/ath9k/hw.c ++++ b/drivers/net/wireless/ath/ath9k/hw.c +@@ -537,7 +537,8 @@ static int __ath9k_hw_init(struct ath_hw + + if (ah->config.serialize_regmode == SER_REG_MODE_AUTO) { + if (ah->hw_version.macVersion == AR_SREV_VERSION_5416_PCI || +- (AR_SREV_9280(ah) && !ah->is_pciexpress)) { ++ ((AR_SREV_9160(ah) || AR_SREV_9280(ah)) && ++ !ah->is_pciexpress)) { + ah->config.serialize_regmode = + SER_REG_MODE_ON; + } else { diff --git a/queue-2.6.35/ath9k-fix-a-buffer-leak-in-a-mpdu-completion.patch b/queue-2.6.35/ath9k-fix-a-buffer-leak-in-a-mpdu-completion.patch new file mode 100644 index 00000000000..6223f90c1ca --- /dev/null +++ b/queue-2.6.35/ath9k-fix-a-buffer-leak-in-a-mpdu-completion.patch @@ -0,0 +1,44 @@ +From 73e194639d90594d06d0c10019c0ab4638869135 Mon Sep 17 00:00:00 2001 +From: Felix Fietkau +Date: Wed, 7 Jul 2010 19:42:09 +0200 +Subject: ath9k: fix a buffer leak in A-MPDU completion + +From: Felix Fietkau + +commit 73e194639d90594d06d0c10019c0ab4638869135 upstream. + +When ath_tx_complete_aggr() is called, it's responsible for returning +all buffers in the linked list. This was not done when the STA lookup +failed, leading to a race condition that could leak a few buffers when +a STA just disconnected. +Fix this by immediately returning all buffers to the free list in this case. + +Signed-off-by: Felix Fietkau +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/ath/ath9k/xmit.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/net/wireless/ath/ath9k/xmit.c ++++ b/drivers/net/wireless/ath/ath9k/xmit.c +@@ -329,6 +329,7 @@ static void ath_tx_complete_aggr(struct + int isaggr, txfail, txpending, sendbar = 0, needreset = 0, nbad = 0; + bool rc_update = true; + struct ieee80211_tx_rate rates[4]; ++ unsigned long flags; + + skb = bf->bf_mpdu; + hdr = (struct ieee80211_hdr *)skb->data; +@@ -344,6 +345,10 @@ static void ath_tx_complete_aggr(struct + sta = ieee80211_find_sta_by_hw(hw, hdr->addr1); + if (!sta) { + rcu_read_unlock(); ++ ++ spin_lock_irqsave(&sc->tx.txbuflock, flags); ++ list_splice_tail_init(bf_q, &sc->tx.txbuf); ++ spin_unlock_irqrestore(&sc->tx.txbuflock, flags); + return; + } + diff --git a/queue-2.6.35/ath9k-fix-a-potential-buffer-leak-in-the-sta-teardown-path.patch b/queue-2.6.35/ath9k-fix-a-potential-buffer-leak-in-the-sta-teardown-path.patch new file mode 100644 index 00000000000..1157fe8b490 --- /dev/null +++ b/queue-2.6.35/ath9k-fix-a-potential-buffer-leak-in-the-sta-teardown-path.patch @@ -0,0 +1,91 @@ +From 2b40994cabd2f545d5c11d3a65dcee6f6f9155f8 Mon Sep 17 00:00:00 2001 +From: Felix Fietkau +Date: Wed, 7 Jul 2010 19:42:08 +0200 +Subject: ath9k: fix a potential buffer leak in the STA teardown path + +From: Felix Fietkau + +commit 2b40994cabd2f545d5c11d3a65dcee6f6f9155f8 upstream. + +It looks like it might be possible for a TID to be paused, while still +holding some queued buffers, however ath_tx_node_cleanup currently only +iterates over active TIDs. +Fix this by always checking every allocated TID for the STA that is being +cleaned up. + +Signed-off-by: Felix Fietkau +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/ath/ath9k/xmit.c | 56 +++++++++++++++++----------------- + 1 file changed, 28 insertions(+), 28 deletions(-) + +--- a/drivers/net/wireless/ath/ath9k/xmit.c ++++ b/drivers/net/wireless/ath/ath9k/xmit.c +@@ -2449,37 +2449,37 @@ void ath_tx_node_init(struct ath_softc * + + void ath_tx_node_cleanup(struct ath_softc *sc, struct ath_node *an) + { +- int i; +- struct ath_atx_ac *ac, *ac_tmp; +- struct ath_atx_tid *tid, *tid_tmp; ++ struct ath_atx_ac *ac; ++ struct ath_atx_tid *tid; + struct ath_txq *txq; ++ int i, tidno; + +- for (i = 0; i < ATH9K_NUM_TX_QUEUES; i++) { +- if (ATH_TXQ_SETUP(sc, i)) { +- txq = &sc->tx.txq[i]; +- +- spin_lock_bh(&txq->axq_lock); +- +- list_for_each_entry_safe(ac, +- ac_tmp, &txq->axq_acq, list) { +- tid = list_first_entry(&ac->tid_q, +- struct ath_atx_tid, list); +- if (tid && tid->an != an) +- continue; +- list_del(&ac->list); +- ac->sched = false; +- +- list_for_each_entry_safe(tid, +- tid_tmp, &ac->tid_q, list) { +- list_del(&tid->list); +- tid->sched = false; +- ath_tid_drain(sc, txq, tid); +- tid->state &= ~AGGR_ADDBA_COMPLETE; +- tid->state &= ~AGGR_CLEANUP; +- } +- } ++ for (tidno = 0, tid = &an->tid[tidno]; ++ tidno < WME_NUM_TID; tidno++, tid++) { ++ i = tid->ac->qnum; + +- spin_unlock_bh(&txq->axq_lock); ++ if (!ATH_TXQ_SETUP(sc, i)) ++ continue; ++ ++ txq = &sc->tx.txq[i]; ++ ac = tid->ac; ++ ++ spin_lock_bh(&txq->axq_lock); ++ ++ if (tid->sched) { ++ list_del(&tid->list); ++ tid->sched = false; + } ++ ++ if (ac->sched) { ++ list_del(&ac->list); ++ tid->ac->sched = false; ++ } ++ ++ ath_tid_drain(sc, txq, tid); ++ tid->state &= ~AGGR_ADDBA_COMPLETE; ++ tid->state &= ~AGGR_CLEANUP; ++ ++ spin_unlock_bh(&txq->axq_lock); + } + } diff --git a/queue-2.6.35/ath9k-fix-retry-count-for-a-mpdu-rate-control-status-reports.patch b/queue-2.6.35/ath9k-fix-retry-count-for-a-mpdu-rate-control-status-reports.patch new file mode 100644 index 00000000000..18e0b42bc89 --- /dev/null +++ b/queue-2.6.35/ath9k-fix-retry-count-for-a-mpdu-rate-control-status-reports.patch @@ -0,0 +1,98 @@ +From 78c4653a2274479547e259e1f416d2b3d04c42a8 Mon Sep 17 00:00:00 2001 +From: Felix Fietkau +Date: Fri, 25 Jun 2010 01:26:16 +0200 +Subject: ath9k: fix retry count for A-MPDU rate control status reports +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Felix Fietkau + +commit 78c4653a2274479547e259e1f416d2b3d04c42a8 upstream. + +The 'bf_retries' field of the ath_buf structure was used for both +software retries (AMPDU subframes) and hardware retries (legacy +frames). This led to a wrong retry count being reported for the A-MPDU +rate control stats. +This patch changes the code to no longer use bf_retries for reporting +retry counts, but instead always using the real on-chip retry count +from the ath_tx_status. +Additionally, if the first subframe of an A-MPDU was not acked, the tx +status report is submitted along with the first acked subframe, which +may not contain the correct rates in the tx info. +This is easily corrected by saving the tx rate info before looping over +subframes, and then copying it back once the A-MPDU status report is +submitted. +In my tests this change improves throughput visibly. + +Signed-off-by: Felix Fietkau +Reported-by: Björn Smedman +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/ath/ath9k/xmit.c | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +--- a/drivers/net/wireless/ath/ath9k/xmit.c ++++ b/drivers/net/wireless/ath/ath9k/xmit.c +@@ -328,6 +328,7 @@ static void ath_tx_complete_aggr(struct + u32 ba[WME_BA_BMP_SIZE >> 5]; + int isaggr, txfail, txpending, sendbar = 0, needreset = 0, nbad = 0; + bool rc_update = true; ++ struct ieee80211_tx_rate rates[4]; + + skb = bf->bf_mpdu; + hdr = (struct ieee80211_hdr *)skb->data; +@@ -335,6 +336,8 @@ static void ath_tx_complete_aggr(struct + tx_info = IEEE80211_SKB_CB(skb); + hw = bf->aphy->hw; + ++ memcpy(rates, tx_info->control.rates, sizeof(rates)); ++ + rcu_read_lock(); + + /* XXX: use ieee80211_find_sta! */ +@@ -375,6 +378,9 @@ static void ath_tx_complete_aggr(struct + txfail = txpending = 0; + bf_next = bf->bf_next; + ++ skb = bf->bf_mpdu; ++ tx_info = IEEE80211_SKB_CB(skb); ++ + if (ATH_BA_ISSET(ba, ATH_BA_INDEX(seq_st, bf->bf_seqno))) { + /* transmit completion, subframe is + * acked by block ack */ +@@ -428,6 +434,7 @@ static void ath_tx_complete_aggr(struct + spin_unlock_bh(&txq->axq_lock); + + if (rc_update && (acked_cnt == 1 || txfail_cnt == 1)) { ++ memcpy(tx_info->control.rates, rates, sizeof(rates)); + ath_tx_rc_status(bf, ts, nbad, txok, true); + rc_update = false; + } else { +@@ -2050,7 +2057,7 @@ static void ath_tx_rc_status(struct ath_ + tx_info->status.rates[i].idx = -1; + } + +- tx_info->status.rates[tx_rateindex].count = bf->bf_retries + 1; ++ tx_info->status.rates[tx_rateindex].count = ts->ts_longretry + 1; + } + + static void ath_wake_mac80211_queue(struct ath_softc *sc, struct ath_txq *txq) +@@ -2161,7 +2168,6 @@ static void ath_tx_processq(struct ath_s + * This frame is sent out as a single frame. + * Use hardware retry status for this frame. + */ +- bf->bf_retries = ts.ts_longretry; + if (ts.ts_status & ATH9K_TXERR_XRETRY) + bf->bf_state.bf_type |= BUF_XRETRY; + ath_tx_rc_status(bf, &ts, 0, txok, true); +@@ -2280,7 +2286,6 @@ void ath_tx_edma_tasklet(struct ath_soft + txok = !(txs.ts_status & ATH9K_TXERR_MASK); + + if (!bf_isampdu(bf)) { +- bf->bf_retries = txs.ts_longretry; + if (txs.ts_status & ATH9K_TXERR_XRETRY) + bf->bf_state.bf_type |= BUF_XRETRY; + ath_tx_rc_status(bf, &txs, 0, txok, true); diff --git a/queue-2.6.35/ath9k-fix-tsf-after-reset-on-ar913x.patch b/queue-2.6.35/ath9k-fix-tsf-after-reset-on-ar913x.patch new file mode 100644 index 00000000000..f9c80a09f24 --- /dev/null +++ b/queue-2.6.35/ath9k-fix-tsf-after-reset-on-ar913x.patch @@ -0,0 +1,71 @@ +From f860d526eb2939a1c37128900b5af2b6f3ff7f20 Mon Sep 17 00:00:00 2001 +From: Felix Fietkau +Date: Wed, 30 Jun 2010 02:07:48 +0200 +Subject: ath9k: fix TSF after reset on AR913x +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Felix Fietkau + +commit f860d526eb2939a1c37128900b5af2b6f3ff7f20 upstream. + +When issuing a reset, the TSF value is lost in the hardware because of +the 913x specific cold reset. As with some AR9280 cards, the TSF needs +to be preserved in software here. + +Additionally, there's an issue that frequently prevents a successful +TSF write directly after the chip reset. In this case, repeating the +TSF write after the initval-writes usually works. + +This patch detects failed TSF writes and recovers from them, taking +into account the delay caused by the initval writes. + +Signed-off-by: Felix Fietkau +Reported-by: Björn Smedman +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/ath/ath9k/hw.c | 16 ++++++++++++++-- + 1 file changed, 14 insertions(+), 2 deletions(-) + +--- a/drivers/net/wireless/ath/ath9k/hw.c ++++ b/drivers/net/wireless/ath/ath9k/hw.c +@@ -1268,7 +1268,8 @@ int ath9k_hw_reset(struct ath_hw *ah, st + macStaId1 = REG_READ(ah, AR_STA_ID1) & AR_STA_ID1_BASE_RATE_11B; + + /* For chips on which RTC reset is done, save TSF before it gets cleared */ +- if (AR_SREV_9280(ah) && ah->eep_ops->get_eeprom(ah, EEP_OL_PWRCTRL)) ++ if (AR_SREV_9100(ah) || ++ (AR_SREV_9280(ah) && ah->eep_ops->get_eeprom(ah, EEP_OL_PWRCTRL))) + tsf = ath9k_hw_gettsf64(ah); + + saveLedState = REG_READ(ah, AR_CFG_LED) & +@@ -1300,7 +1301,7 @@ int ath9k_hw_reset(struct ath_hw *ah, st + } + + /* Restore TSF */ +- if (tsf && AR_SREV_9280(ah) && ah->eep_ops->get_eeprom(ah, EEP_OL_PWRCTRL)) ++ if (tsf) + ath9k_hw_settsf64(ah, tsf); + + if (AR_SREV_9280_10_OR_LATER(ah)) +@@ -1310,6 +1311,17 @@ int ath9k_hw_reset(struct ath_hw *ah, st + if (r) + return r; + ++ /* ++ * Some AR91xx SoC devices frequently fail to accept TSF writes ++ * right after the chip reset. When that happens, write a new ++ * value after the initvals have been applied, with an offset ++ * based on measured time difference ++ */ ++ if (AR_SREV_9100(ah) && (ath9k_hw_gettsf64(ah) < tsf)) { ++ tsf += 1500; ++ ath9k_hw_settsf64(ah, tsf); ++ } ++ + /* Setup MFP options for CCMP */ + if (AR_SREV_9280_20_OR_LATER(ah)) { + /* Mask Retry(b11), PwrMgt(b12), MoreData(b13) to 0 in mgmt diff --git a/queue-2.6.35/ath9k-fix-yet-another-buffer-leak-in-the-tx-aggregation-code.patch b/queue-2.6.35/ath9k-fix-yet-another-buffer-leak-in-the-tx-aggregation-code.patch new file mode 100644 index 00000000000..76009008e24 --- /dev/null +++ b/queue-2.6.35/ath9k-fix-yet-another-buffer-leak-in-the-tx-aggregation-code.patch @@ -0,0 +1,57 @@ +From 4cee78614cfa046a26c4fbf313d5bbacb3ad8efc Mon Sep 17 00:00:00 2001 +From: Felix Fietkau +Date: Fri, 23 Jul 2010 03:53:16 +0200 +Subject: ath9k: fix yet another buffer leak in the tx aggregation code + +From: Felix Fietkau + +commit 4cee78614cfa046a26c4fbf313d5bbacb3ad8efc upstream. + +When an aggregation session is being cleaned up, while the tx status +for some frames is being processed, the TID is flushed and its buffers +are sent out. + +Unfortunately that left the pending un-acked frames unprocessed, thus +leaking buffers. Fix this by reordering the code so that those frames +are processed first, before the TID is flushed. + +Signed-off-by: Felix Fietkau +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/ath/ath9k/xmit.c | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +--- a/drivers/net/wireless/ath/ath9k/xmit.c ++++ b/drivers/net/wireless/ath/ath9k/xmit.c +@@ -510,6 +510,14 @@ static void ath_tx_complete_aggr(struct + bf = bf_next; + } + ++ /* prepend un-acked frames to the beginning of the pending frame queue */ ++ if (!list_empty(&bf_pending)) { ++ spin_lock_bh(&txq->axq_lock); ++ list_splice(&bf_pending, &tid->buf_q); ++ ath_tx_queue_tid(txq, tid); ++ spin_unlock_bh(&txq->axq_lock); ++ } ++ + if (tid->state & AGGR_CLEANUP) { + if (tid->baw_head == tid->baw_tail) { + tid->state &= ~AGGR_ADDBA_COMPLETE; +@@ -522,14 +530,6 @@ static void ath_tx_complete_aggr(struct + return; + } + +- /* prepend un-acked frames to the beginning of the pending frame queue */ +- if (!list_empty(&bf_pending)) { +- spin_lock_bh(&txq->axq_lock); +- list_splice(&bf_pending, &tid->buf_q); +- ath_tx_queue_tid(txq, tid); +- spin_unlock_bh(&txq->axq_lock); +- } +- + rcu_read_unlock(); + + if (needreset) diff --git a/queue-2.6.35/ath9k_hw-fix-a-sign-error-in-the-iq-calibration-code.patch b/queue-2.6.35/ath9k_hw-fix-a-sign-error-in-the-iq-calibration-code.patch new file mode 100644 index 00000000000..3081d3b48c9 --- /dev/null +++ b/queue-2.6.35/ath9k_hw-fix-a-sign-error-in-the-iq-calibration-code.patch @@ -0,0 +1,28 @@ +From 23399016d9583d799ca98ce443a1410b13c3e96e Mon Sep 17 00:00:00 2001 +From: Felix Fietkau +Date: Sun, 11 Jul 2010 12:48:40 +0200 +Subject: ath9k_hw: fix a sign error in the IQ calibration code + +From: Felix Fietkau + +commit 23399016d9583d799ca98ce443a1410b13c3e96e upstream. + +Signed-off-by: Felix Fietkau +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/ath/ath9k/ar9002_calib.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/wireless/ath/ath9k/ar9002_calib.c ++++ b/drivers/net/wireless/ath/ath9k/ar9002_calib.c +@@ -239,7 +239,7 @@ static void ar9002_hw_iqcalibrate(struct + if (qCoff > 15) + qCoff = 15; + else if (qCoff <= -16) +- qCoff = 16; ++ qCoff = -16; + + ath_print(common, ATH_DBG_CALIBRATE, + "Chn %d : iCoff = 0x%x qCoff = 0x%x\n", diff --git a/queue-2.6.35/ath9k_hw-fix-an-off-by-one-error-in-the-pdadc-boundaries-calculation.patch b/queue-2.6.35/ath9k_hw-fix-an-off-by-one-error-in-the-pdadc-boundaries-calculation.patch new file mode 100644 index 00000000000..95ffc6c86bc --- /dev/null +++ b/queue-2.6.35/ath9k_hw-fix-an-off-by-one-error-in-the-pdadc-boundaries-calculation.patch @@ -0,0 +1,32 @@ +From 03b4776c408d2f4bf3a5d204e223724d154716d1 Mon Sep 17 00:00:00 2001 +From: Felix Fietkau +Date: Sun, 11 Jul 2010 12:48:41 +0200 +Subject: ath9k_hw: fix an off-by-one error in the PDADC boundaries calculation + +From: Felix Fietkau + +commit 03b4776c408d2f4bf3a5d204e223724d154716d1 upstream. + +PDADC values were only generated for values surrounding the target +index, however not for the target index itself, leading to a minor +error in the generated curve. + +Signed-off-by: Felix Fietkau +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/ath/ath9k/eeprom_def.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/wireless/ath/ath9k/eeprom_def.c ++++ b/drivers/net/wireless/ath/ath9k/eeprom_def.c +@@ -729,7 +729,7 @@ static void ath9k_hw_get_def_gain_bounda + vpdTableI[i][sizeCurrVpdTable - 2]); + vpdStep = (int16_t)((vpdStep < 1) ? 1 : vpdStep); + +- if (tgtIndex > maxIndex) { ++ if (tgtIndex >= maxIndex) { + while ((ss <= tgtIndex) && + (k < (AR5416_NUM_PDADC_VALUES - 1))) { + tmpVal = (int16_t)((vpdTableI[i][sizeCurrVpdTable - 1] + diff --git a/queue-2.6.35/ath9k_hw-fix-antenna-diversity-on-ar9285.patch b/queue-2.6.35/ath9k_hw-fix-antenna-diversity-on-ar9285.patch new file mode 100644 index 00000000000..47b8a122bb5 --- /dev/null +++ b/queue-2.6.35/ath9k_hw-fix-antenna-diversity-on-ar9285.patch @@ -0,0 +1,105 @@ +From 601e0cb165e65dc185b31fe7ebd2c0169ea47306 Mon Sep 17 00:00:00 2001 +From: Felix Fietkau +Date: Sun, 11 Jul 2010 12:48:39 +0200 +Subject: ath9k_hw: fix antenna diversity on AR9285 + +From: Felix Fietkau + +commit 601e0cb165e65dc185b31fe7ebd2c0169ea47306 upstream. + +On AR9285, the antenna switch configuration register uses more than just +16 bits. Because of an arbitrary mask applied to the EEPROM value that +stores this configuration, diversity was broken in some cases, leading +to a significant degradation in signal strength. +Fix this by changing the callback to return a 32 bit value and remove +the arbitrary mask. + +Signed-off-by: Felix Fietkau +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/ath/ath9k/ar9003_eeprom.c | 2 +- + drivers/net/wireless/ath/ath9k/eeprom.h | 2 +- + drivers/net/wireless/ath/ath9k/eeprom_4k.c | 4 ++-- + drivers/net/wireless/ath/ath9k/eeprom_9287.c | 4 ++-- + drivers/net/wireless/ath/ath9k/eeprom_def.c | 4 ++-- + 5 files changed, 8 insertions(+), 8 deletions(-) + +--- a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c ++++ b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c +@@ -944,7 +944,7 @@ static u8 ath9k_hw_ar9300_get_num_ant_co + return 1; + } + +-static u16 ath9k_hw_ar9300_get_eeprom_antenna_cfg(struct ath_hw *ah, ++static u32 ath9k_hw_ar9300_get_eeprom_antenna_cfg(struct ath_hw *ah, + struct ath9k_channel *chan) + { + return -EINVAL; +--- a/drivers/net/wireless/ath/ath9k/eeprom.h ++++ b/drivers/net/wireless/ath/ath9k/eeprom.h +@@ -669,7 +669,7 @@ struct eeprom_ops { + int (*get_eeprom_ver)(struct ath_hw *hw); + int (*get_eeprom_rev)(struct ath_hw *hw); + u8 (*get_num_ant_config)(struct ath_hw *hw, enum ieee80211_band band); +- u16 (*get_eeprom_antenna_cfg)(struct ath_hw *hw, ++ u32 (*get_eeprom_antenna_cfg)(struct ath_hw *hw, + struct ath9k_channel *chan); + void (*set_board_values)(struct ath_hw *hw, struct ath9k_channel *chan); + void (*set_addac)(struct ath_hw *hw, struct ath9k_channel *chan); +--- a/drivers/net/wireless/ath/ath9k/eeprom_4k.c ++++ b/drivers/net/wireless/ath/ath9k/eeprom_4k.c +@@ -1149,13 +1149,13 @@ static void ath9k_hw_4k_set_board_values + } + } + +-static u16 ath9k_hw_4k_get_eeprom_antenna_cfg(struct ath_hw *ah, ++static u32 ath9k_hw_4k_get_eeprom_antenna_cfg(struct ath_hw *ah, + struct ath9k_channel *chan) + { + struct ar5416_eeprom_4k *eep = &ah->eeprom.map4k; + struct modal_eep_4k_header *pModal = &eep->modalHeader; + +- return pModal->antCtrlCommon & 0xFFFF; ++ return pModal->antCtrlCommon; + } + + static u8 ath9k_hw_4k_get_num_ant_config(struct ath_hw *ah, +--- a/drivers/net/wireless/ath/ath9k/eeprom_9287.c ++++ b/drivers/net/wireless/ath/ath9k/eeprom_9287.c +@@ -1131,13 +1131,13 @@ static u8 ath9k_hw_AR9287_get_num_ant_co + return 1; + } + +-static u16 ath9k_hw_AR9287_get_eeprom_antenna_cfg(struct ath_hw *ah, ++static u32 ath9k_hw_AR9287_get_eeprom_antenna_cfg(struct ath_hw *ah, + struct ath9k_channel *chan) + { + struct ar9287_eeprom *eep = &ah->eeprom.map9287; + struct modal_eep_ar9287_header *pModal = &eep->modalHeader; + +- return pModal->antCtrlCommon & 0xFFFF; ++ return pModal->antCtrlCommon; + } + + static u16 ath9k_hw_AR9287_get_spur_channel(struct ath_hw *ah, +--- a/drivers/net/wireless/ath/ath9k/eeprom_def.c ++++ b/drivers/net/wireless/ath/ath9k/eeprom_def.c +@@ -1437,14 +1437,14 @@ static u8 ath9k_hw_def_get_num_ant_confi + return num_ant_config; + } + +-static u16 ath9k_hw_def_get_eeprom_antenna_cfg(struct ath_hw *ah, ++static u32 ath9k_hw_def_get_eeprom_antenna_cfg(struct ath_hw *ah, + struct ath9k_channel *chan) + { + struct ar5416_eeprom_def *eep = &ah->eeprom.def; + struct modal_eep_header *pModal = + &(eep->modalHeader[IS_CHAN_2GHZ(chan)]); + +- return pModal->antCtrlCommon & 0xFFFF; ++ return pModal->antCtrlCommon; + } + + static u16 ath9k_hw_def_get_spur_channel(struct ath_hw *ah, u16 i, bool is2GHz) diff --git a/queue-2.6.35/ath9k_hw-prevent-a-fast-channel-change-after-a-rx-dma-stuck-issue.patch b/queue-2.6.35/ath9k_hw-prevent-a-fast-channel-change-after-a-rx-dma-stuck-issue.patch new file mode 100644 index 00000000000..88a05044eab --- /dev/null +++ b/queue-2.6.35/ath9k_hw-prevent-a-fast-channel-change-after-a-rx-dma-stuck-issue.patch @@ -0,0 +1,41 @@ +From 9cc2f3e881dcda5466c55ffe8dd0a9d1433469cb Mon Sep 17 00:00:00 2001 +From: Felix Fietkau +Date: Sun, 11 Jul 2010 12:48:42 +0200 +Subject: ath9k_hw: prevent a fast channel change after a rx DMA stuck issue + +From: Felix Fietkau + +commit 9cc2f3e881dcda5466c55ffe8dd0a9d1433469cb upstream. + +If the receive path gets stuck, a full hardware reset is necessary to +recover from it. If this happens during a scan, the whole scan might fail, +as each channel change bypasses the full reset sequence. +Fix this by resetting the fast channel change flag if stopping the +receive path fails. + +This will reduce the number of error messages that look like this: +ath: DMA failed to stop in 10 ms AR_CR=0x00000024 AR_DIAG_SW=0x40000020 + +Signed-off-by: Felix Fietkau +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/ath/ath9k/hw.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/net/wireless/ath/ath9k/hw.c ++++ b/drivers/net/wireless/ath/ath9k/hw.c +@@ -1233,9 +1233,11 @@ int ath9k_hw_reset(struct ath_hw *ah, st + + if (!ah->chip_fullsleep) { + ath9k_hw_abortpcurecv(ah); +- if (!ath9k_hw_stopdmarecv(ah)) ++ if (!ath9k_hw_stopdmarecv(ah)) { + ath_print(common, ATH_DBG_XMIT, + "Failed to stop receive dma\n"); ++ bChannelChange = false; ++ } + } + + if (!ath9k_hw_setpower(ah, ATH9K_PM_AWAKE)) diff --git a/queue-2.6.35/block_dev-always-serialize-exclusive-open-attempts.patch b/queue-2.6.35/block_dev-always-serialize-exclusive-open-attempts.patch new file mode 100644 index 00000000000..dd9991db2ad --- /dev/null +++ b/queue-2.6.35/block_dev-always-serialize-exclusive-open-attempts.patch @@ -0,0 +1,47 @@ +From e75aa85892b2ee78c79edac720868cbef16e62eb Mon Sep 17 00:00:00 2001 +From: Tejun Heo +Date: Wed, 4 Aug 2010 17:59:39 +0200 +Subject: block_dev: always serialize exclusive open attempts + +From: Tejun Heo + +commit e75aa85892b2ee78c79edac720868cbef16e62eb upstream. + +bd_prepare_to_claim() incorrectly allowed multiple attempts for +exclusive open to progress in parallel if the attempting holders are +identical. This triggered BUG_ON() as reported in the following bug. + + https://bugzilla.kernel.org/show_bug.cgi?id=16393 + +__bd_abort_claiming() is used to finish claiming blocks and doesn't +work if multiple openers are inside a claiming block. Allowing +multiple parallel open attempts to continue doesn't gain anything as +those are serialized down in the call chain anyway. Fix it by always +allowing only single open attempt in a claiming block. + +This problem can easily be reproduced by adding a delay after +bd_prepare_to_claim() and attempting to mount two partitions of a +disk. + +Signed-off-by: Tejun Heo +Reported-by: Markus Trippelsdorf +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + fs/block_dev.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/fs/block_dev.c ++++ b/fs/block_dev.c +@@ -681,8 +681,8 @@ retry: + if (!bd_may_claim(bdev, whole, holder)) + return -EBUSY; + +- /* if someone else is claiming, wait for it to finish */ +- if (whole->bd_claiming && whole->bd_claiming != holder) { ++ /* if claiming is already in progress, wait for it to finish */ ++ if (whole->bd_claiming) { + wait_queue_head_t *wq = bit_waitqueue(&whole->bd_claiming, 0); + DEFINE_WAIT(wait); + diff --git a/queue-2.6.35/cfg80211-don-t-get-expired-bsses.patch b/queue-2.6.35/cfg80211-don-t-get-expired-bsses.patch new file mode 100644 index 00000000000..3d4b9a8a965 --- /dev/null +++ b/queue-2.6.35/cfg80211-don-t-get-expired-bsses.patch @@ -0,0 +1,52 @@ +From ccb6c1360f8dd43303c659db718e7e0b24175db5 Mon Sep 17 00:00:00 2001 +From: Johannes Berg +Date: Tue, 13 Jul 2010 10:55:38 +0200 +Subject: cfg80211: don't get expired BSSes + +From: Johannes Berg + +commit ccb6c1360f8dd43303c659db718e7e0b24175db5 upstream. + +When kernel-internal users use cfg80211_get_bss() +to get a reference to a BSS struct, they may end +up getting one that would have been removed from +the list if there had been any userspace access +to the list. This leads to inconsistencies and +problems. + +Fix it by making cfg80211_get_bss() ignore BSSes +that cfg80211_bss_expire() would remove. + +Fixes http://bugzilla.intellinuxwireless.org/show_bug.cgi?id=2180 + +Reported-by: Jiajia Zheng +Tested-by: Jiajia Zheng +Signed-off-by: Johannes Berg +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + net/wireless/scan.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/net/wireless/scan.c ++++ b/net/wireless/scan.c +@@ -275,6 +275,7 @@ struct cfg80211_bss *cfg80211_get_bss(st + { + struct cfg80211_registered_device *dev = wiphy_to_dev(wiphy); + struct cfg80211_internal_bss *bss, *res = NULL; ++ unsigned long now = jiffies; + + spin_lock_bh(&dev->bss_lock); + +@@ -283,6 +284,10 @@ struct cfg80211_bss *cfg80211_get_bss(st + continue; + if (channel && bss->pub.channel != channel) + continue; ++ /* Don't get expired BSS structs */ ++ if (time_after(now, bss->ts + IEEE80211_SCAN_RESULT_EXPIRE) && ++ !atomic_read(&bss->hold)) ++ continue; + if (is_bss(&bss->pub, bssid, ssid, ssid_len)) { + res = bss; + kref_get(&res->ref); diff --git a/queue-2.6.35/cfg80211-ignore-spurious-deauth.patch b/queue-2.6.35/cfg80211-ignore-spurious-deauth.patch new file mode 100644 index 00000000000..2046482eace --- /dev/null +++ b/queue-2.6.35/cfg80211-ignore-spurious-deauth.patch @@ -0,0 +1,45 @@ +From 643f82e32f14faf0d0944c804203a6681b6b0a1e Mon Sep 17 00:00:00 2001 +From: Johannes Berg +Date: Mon, 12 Jul 2010 14:46:43 +0200 +Subject: cfg80211: ignore spurious deauth + +From: Johannes Berg + +commit 643f82e32f14faf0d0944c804203a6681b6b0a1e upstream. + +Ever since mac80211/drivers are no longer +fully in charge of keeping track of the +auth status, trying to make them do so will +fail. Instead of warning and reporting the +deauthentication to userspace, cfg80211 must +simply ignore it so that spurious +deauthentications, e.g. before starting +authentication, aren't seen by userspace as +actual deauthentications. + +Reported-by: Paul Stewart +Signed-off-by: Johannes Berg +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + net/wireless/mlme.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/net/wireless/mlme.c ++++ b/net/wireless/mlme.c +@@ -44,10 +44,10 @@ void cfg80211_send_rx_auth(struct net_de + } + } + +- WARN_ON(!done); +- +- nl80211_send_rx_auth(rdev, dev, buf, len, GFP_KERNEL); +- cfg80211_sme_rx_auth(dev, buf, len); ++ if (done) { ++ nl80211_send_rx_auth(rdev, dev, buf, len, GFP_KERNEL); ++ cfg80211_sme_rx_auth(dev, buf, len); ++ } + + wdev_unlock(wdev); + } diff --git a/queue-2.6.35/cred-fix-rcu-warning-due-to-previous-patch-fixing-__task_cred-s-checks.patch b/queue-2.6.35/cred-fix-rcu-warning-due-to-previous-patch-fixing-__task_cred-s-checks.patch new file mode 100644 index 00000000000..130278f5337 --- /dev/null +++ b/queue-2.6.35/cred-fix-rcu-warning-due-to-previous-patch-fixing-__task_cred-s-checks.patch @@ -0,0 +1,63 @@ +From 694f690d27dadccc8cb9d90532e76593b61fe098 Mon Sep 17 00:00:00 2001 +From: David Howells +Date: Wed, 4 Aug 2010 16:59:14 +0100 +Subject: CRED: Fix RCU warning due to previous patch fixing __task_cred()'s checks + +From: David Howells + +commit 694f690d27dadccc8cb9d90532e76593b61fe098 upstream. + +Commit 8f92054e7ca1 ("CRED: Fix __task_cred()'s lockdep check and banner +comment") fixed the lockdep checks on __task_cred(). This has shown up +a place in the signalling code where a lock should be held - namely that +check_kill_permission() requires its callers to hold the RCU lock. + +Fix group_send_sig_info() to get the RCU read lock around its call to +check_kill_permission(). + +Without this patch, the following warning can occur: + + =================================================== + [ INFO: suspicious rcu_dereference_check() usage. ] + --------------------------------------------------- + kernel/signal.c:660 invoked rcu_dereference_check() without protection! + ... + +Reported-by: Tetsuo Handa +Signed-off-by: David Howells +Acked-by: Oleg Nesterov +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/signal.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +--- a/kernel/signal.c ++++ b/kernel/signal.c +@@ -637,7 +637,7 @@ static inline bool si_fromuser(const str + + /* + * Bad permissions for sending the signal +- * - the caller must hold at least the RCU read lock ++ * - the caller must hold the RCU read lock + */ + static int check_kill_permission(int sig, struct siginfo *info, + struct task_struct *t) +@@ -1127,11 +1127,14 @@ struct sighand_struct *lock_task_sighand + + /* + * send signal info to all the members of a group +- * - the caller must hold the RCU read lock at least + */ + int group_send_sig_info(int sig, struct siginfo *info, struct task_struct *p) + { +- int ret = check_kill_permission(sig, info, p); ++ int ret; ++ ++ rcu_read_lock(); ++ ret = check_kill_permission(sig, info, p); ++ rcu_read_unlock(); + + if (!ret && sig) + ret = do_send_sig_info(sig, info, p, true); diff --git a/queue-2.6.35/e1000e-82577-82578-phy-register-access-issues.patch b/queue-2.6.35/e1000e-82577-82578-phy-register-access-issues.patch new file mode 100644 index 00000000000..082bd25495c --- /dev/null +++ b/queue-2.6.35/e1000e-82577-82578-phy-register-access-issues.patch @@ -0,0 +1,38 @@ +From ff847ac2d3e90edd94674c28bade25ae1e6a2e49 Mon Sep 17 00:00:00 2001 +From: Bruce Allan +Date: Tue, 27 Jul 2010 12:28:46 +0000 +Subject: e1000e: 82577/82578 PHY register access issues + +From: Bruce Allan + +commit ff847ac2d3e90edd94674c28bade25ae1e6a2e49 upstream. + +The MAC-PHY interconnect on 82577/82578 uses a power management feature +(called K1) which must be disabled when in 1Gbps due to a hardware issue on +these parts. The #define bit setting used to enable/disable K1 is +incorrect and can cause PHY register accesses to stop working altogether +until the next device reset. This patch sets the register correctly. + +This issue is present in kernels since 2.6.32. + +Signed-off-by: Bruce Allan +Tested-by: Jeff Pieper +Signed-off-by: Jeff Kirsher +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/e1000e/hw.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/e1000e/hw.h ++++ b/drivers/net/e1000e/hw.h +@@ -308,7 +308,7 @@ enum e1e_registers { + #define E1000_KMRNCTRLSTA_INBAND_PARAM 0x9 /* Kumeran InBand Parameters */ + #define E1000_KMRNCTRLSTA_DIAG_NELPBK 0x1000 /* Nearend Loopback mode */ + #define E1000_KMRNCTRLSTA_K1_CONFIG 0x7 +-#define E1000_KMRNCTRLSTA_K1_ENABLE 0x140E ++#define E1000_KMRNCTRLSTA_K1_ENABLE 0x0002 + #define E1000_KMRNCTRLSTA_K1_DISABLE 0x1400 + + #define IFE_PHY_EXTENDED_STATUS_CONTROL 0x10 diff --git a/queue-2.6.35/e1000e-don-t-inadvertently-re-set-intx_disable.patch b/queue-2.6.35/e1000e-don-t-inadvertently-re-set-intx_disable.patch new file mode 100644 index 00000000000..e6490f7a20e --- /dev/null +++ b/queue-2.6.35/e1000e-don-t-inadvertently-re-set-intx_disable.patch @@ -0,0 +1,71 @@ +From 36f2407fe52c55566221f8c68c8fb808abffd2f5 Mon Sep 17 00:00:00 2001 +From: Dean Nelson +Date: Tue, 29 Jun 2010 18:12:05 +0000 +Subject: e1000e: don't inadvertently re-set INTX_DISABLE + +From: Dean Nelson + +commit 36f2407fe52c55566221f8c68c8fb808abffd2f5 upstream. + +Should e1000_test_msi() fail to see an msi interrupt, it attempts to +fallback to legacy INTx interrupts. But an error in the code may prevent +this from happening correctly. + +Before calling e1000_test_msi_interrupt(), e1000_test_msi() disables SERR +by clearing the SERR bit from the just read PCI_COMMAND bits as it writes +them back out. + +Upon return from calling e1000_test_msi_interrupt(), it re-enables SERR +by writing out the version of PCI_COMMAND it had previously read. + +The problem with this is that e1000_test_msi_interrupt() calls +pci_disable_msi(), which eventually ends up in pci_intx(). And because +pci_intx() was called with enable set to 1, the INTX_DISABLE bit gets +cleared from PCI_COMMAND, which is what we want. But when we get back to +e1000_test_msi(), the INTX_DISABLE bit gets inadvertently re-set because +of the attempt by e1000_test_msi() to re-enable SERR. + +The solution is to have e1000_test_msi() re-read the PCI_COMMAND bits as +part of its attempt to re-enable SERR. + +During debugging/testing of this issue I found that not all the systems +I ran on had the SERR bit set to begin with. And on some of the systems +the same could be said for the INTX_DISABLE bit. Needless to say these +latter systems didn't have a problem falling back to legacy INTx +interrupts with the code as is. + +Signed-off-by: Dean Nelson +Tested-by: Emil Tantilov +Signed-off-by: Jeff Kirsher +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/e1000e/netdev.c | 13 +++++++++---- + 1 file changed, 9 insertions(+), 4 deletions(-) + +--- a/drivers/net/e1000e/netdev.c ++++ b/drivers/net/e1000e/netdev.c +@@ -3419,13 +3419,18 @@ static int e1000_test_msi(struct e1000_a + + /* disable SERR in case the MSI write causes a master abort */ + pci_read_config_word(adapter->pdev, PCI_COMMAND, &pci_cmd); +- pci_write_config_word(adapter->pdev, PCI_COMMAND, +- pci_cmd & ~PCI_COMMAND_SERR); ++ if (pci_cmd & PCI_COMMAND_SERR) ++ pci_write_config_word(adapter->pdev, PCI_COMMAND, ++ pci_cmd & ~PCI_COMMAND_SERR); + + err = e1000_test_msi_interrupt(adapter); + +- /* restore previous setting of command word */ +- pci_write_config_word(adapter->pdev, PCI_COMMAND, pci_cmd); ++ /* re-enable SERR */ ++ if (pci_cmd & PCI_COMMAND_SERR) { ++ pci_read_config_word(adapter->pdev, PCI_COMMAND, &pci_cmd); ++ pci_cmd |= PCI_COMMAND_SERR; ++ pci_write_config_word(adapter->pdev, PCI_COMMAND, pci_cmd); ++ } + + /* success ! */ + if (!err) diff --git a/queue-2.6.35/igb-use-only-a-single-tx-queue-in-sr-iov-mode.patch b/queue-2.6.35/igb-use-only-a-single-tx-queue-in-sr-iov-mode.patch new file mode 100644 index 00000000000..bac3b11d0bb --- /dev/null +++ b/queue-2.6.35/igb-use-only-a-single-tx-queue-in-sr-iov-mode.patch @@ -0,0 +1,52 @@ +From 5fa8517f038d51d571981fb495206cc30ed91b06 Mon Sep 17 00:00:00 2001 +From: Greg Rose +Date: Thu, 1 Jul 2010 13:38:16 +0000 +Subject: igb: Use only a single Tx queue in SR-IOV mode + +From: Greg Rose + +commit 5fa8517f038d51d571981fb495206cc30ed91b06 upstream. + +The 82576 expects the second rx queue in any pool to receive L2 switch +loop back packets sent from the second tx queue in another pool. The +82576 VF driver does not enable the second rx queue so if the PF driver +sends packets destined to a VF from its second tx queue then the VF +driver will never see them. In SR-IOV mode limit the number of tx queues +used by the PF driver to one. This patch fixes a bug reported in which +the PF cannot communciate with the VF and should be considered for 2.6.34 +stable. + +Signed-off-by: Greg Rose +Tested-by: Jeff Pieper +Signed-off-by: Jeff Kirsher +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/igb/igb_main.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/net/igb/igb_main.c ++++ b/drivers/net/igb/igb_main.c +@@ -630,9 +630,6 @@ static void igb_cache_ring_register(stru + for (; i < adapter->rss_queues; i++) + adapter->rx_ring[i]->reg_idx = rbase_offset + + Q_IDX_82576(i); +- for (; j < adapter->rss_queues; j++) +- adapter->tx_ring[j]->reg_idx = rbase_offset + +- Q_IDX_82576(j); + } + case e1000_82575: + case e1000_82580: +@@ -996,7 +993,10 @@ static void igb_set_interrupt_capability + + /* Number of supported queues. */ + adapter->num_rx_queues = adapter->rss_queues; +- adapter->num_tx_queues = adapter->rss_queues; ++ if (adapter->vfs_allocated_count) ++ adapter->num_tx_queues = 1; ++ else ++ adapter->num_tx_queues = adapter->rss_queues; + + /* start with one vector for every rx queue */ + numvecs = adapter->num_rx_queues; diff --git a/queue-2.6.35/iwlwifi-fix-scan-abort.patch b/queue-2.6.35/iwlwifi-fix-scan-abort.patch new file mode 100644 index 00000000000..d87eebd7cd6 --- /dev/null +++ b/queue-2.6.35/iwlwifi-fix-scan-abort.patch @@ -0,0 +1,65 @@ +From d28232b461b8d54b09e59325dbac8b0913ce2049 Mon Sep 17 00:00:00 2001 +From: Stanislaw Gruszka +Date: Thu, 29 Jul 2010 11:37:41 +0200 +Subject: iwlwifi: fix scan abort + +From: Stanislaw Gruszka + +commit d28232b461b8d54b09e59325dbac8b0913ce2049 upstream. + +Fix possible double priv->mutex lock introduced by commit +a69b03e941abae00380fc6bc1877fb797a1b31e6 +"iwlwifi: cancel scan watchdog in iwl_bg_abort_scan" . +We can not call cancel_delayed_work_sync(&priv->scan_check) with +priv->mutex locked because workqueue function iwl_bg_scan_check() +take that lock internally. + +We do not need to synchronize when canceling priv->scan_check work. +We can avoid races (sending double abort command or send no +command at all) using STATUS_SCAN_ABORT bit. Moreover +current iwl_bg_scan_check() code seems to be broken, as +we should not send abort commands when currently aborting. + +Signed-off-by: Stanislaw Gruszka +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/iwlwifi/iwl-scan.c | 18 ++++++++---------- + 1 file changed, 8 insertions(+), 10 deletions(-) + +--- a/drivers/net/wireless/iwlwifi/iwl-scan.c ++++ b/drivers/net/wireless/iwlwifi/iwl-scan.c +@@ -420,11 +420,10 @@ void iwl_bg_scan_check(struct work_struc + return; + + mutex_lock(&priv->mutex); +- if (test_bit(STATUS_SCANNING, &priv->status) || +- test_bit(STATUS_SCAN_ABORTING, &priv->status)) { +- IWL_DEBUG_SCAN(priv, "Scan completion watchdog resetting " +- "adapter (%dms)\n", +- jiffies_to_msecs(IWL_SCAN_CHECK_WATCHDOG)); ++ if (test_bit(STATUS_SCANNING, &priv->status) && ++ !test_bit(STATUS_SCAN_ABORTING, &priv->status)) { ++ IWL_DEBUG_SCAN(priv, "Scan completion watchdog (%dms)\n", ++ jiffies_to_msecs(IWL_SCAN_CHECK_WATCHDOG)); + + if (!test_bit(STATUS_EXIT_PENDING, &priv->status)) + iwl_send_scan_abort(priv); +@@ -489,12 +488,11 @@ void iwl_bg_abort_scan(struct work_struc + !test_bit(STATUS_GEO_CONFIGURED, &priv->status)) + return; + +- mutex_lock(&priv->mutex); +- +- cancel_delayed_work_sync(&priv->scan_check); +- set_bit(STATUS_SCAN_ABORTING, &priv->status); +- iwl_send_scan_abort(priv); ++ cancel_delayed_work(&priv->scan_check); + ++ mutex_lock(&priv->mutex); ++ if (test_bit(STATUS_SCAN_ABORTING, &priv->status)) ++ iwl_send_scan_abort(priv); + mutex_unlock(&priv->mutex); + } + EXPORT_SYMBOL(iwl_bg_abort_scan); diff --git a/queue-2.6.35/mac80211-avoid-scheduling-while-atomic-in-mesh_rx_plink_frame.patch b/queue-2.6.35/mac80211-avoid-scheduling-while-atomic-in-mesh_rx_plink_frame.patch new file mode 100644 index 00000000000..ef377d14c10 --- /dev/null +++ b/queue-2.6.35/mac80211-avoid-scheduling-while-atomic-in-mesh_rx_plink_frame.patch @@ -0,0 +1,165 @@ +From c937019761a758f2749b1f3a032b7a91fb044753 Mon Sep 17 00:00:00 2001 +From: John W. Linville +Date: Mon, 21 Jun 2010 17:14:07 -0400 +Subject: mac80211: avoid scheduling while atomic in mesh_rx_plink_frame + +From: John W. Linville + +commit c937019761a758f2749b1f3a032b7a91fb044753 upstream. + +While mesh_rx_plink_frame holds sta->lock... + +mesh_rx_plink_frame -> + mesh_plink_inc_estab_count -> + ieee80211_bss_info_change_notify + +...but ieee80211_bss_info_change_notify is allowed to sleep. A driver +taking advantage of that allowance can cause a scheduling while +atomic bug. Similar paths exist for mesh_plink_dec_estab_count, +so work around those as well. + +http://bugzilla.kernel.org/show_bug.cgi?id=16099 + +Also, correct a minor kerneldoc comment error (mismatched function names). + +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + net/mac80211/mesh_plink.c | 42 +++++++++++++++++++++++++++++++----------- + 1 file changed, 31 insertions(+), 11 deletions(-) + +--- a/net/mac80211/mesh_plink.c ++++ b/net/mac80211/mesh_plink.c +@@ -65,7 +65,6 @@ void mesh_plink_inc_estab_count(struct i + { + atomic_inc(&sdata->u.mesh.mshstats.estab_plinks); + mesh_accept_plinks_update(sdata); +- ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON); + } + + static inline +@@ -73,7 +72,6 @@ void mesh_plink_dec_estab_count(struct i + { + atomic_dec(&sdata->u.mesh.mshstats.estab_plinks); + mesh_accept_plinks_update(sdata); +- ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON); + } + + /** +@@ -115,7 +113,7 @@ static struct sta_info *mesh_plink_alloc + } + + /** +- * mesh_plink_deactivate - deactivate mesh peer link ++ * __mesh_plink_deactivate - deactivate mesh peer link + * + * @sta: mesh peer link to deactivate + * +@@ -123,18 +121,23 @@ static struct sta_info *mesh_plink_alloc + * + * Locking: the caller must hold sta->lock + */ +-static void __mesh_plink_deactivate(struct sta_info *sta) ++static bool __mesh_plink_deactivate(struct sta_info *sta) + { + struct ieee80211_sub_if_data *sdata = sta->sdata; ++ bool deactivated = false; + +- if (sta->plink_state == PLINK_ESTAB) ++ if (sta->plink_state == PLINK_ESTAB) { + mesh_plink_dec_estab_count(sdata); ++ deactivated = true; ++ } + sta->plink_state = PLINK_BLOCKED; + mesh_path_flush_by_nexthop(sta); ++ ++ return deactivated; + } + + /** +- * __mesh_plink_deactivate - deactivate mesh peer link ++ * mesh_plink_deactivate - deactivate mesh peer link + * + * @sta: mesh peer link to deactivate + * +@@ -142,9 +145,15 @@ static void __mesh_plink_deactivate(stru + */ + void mesh_plink_deactivate(struct sta_info *sta) + { ++ struct ieee80211_sub_if_data *sdata = sta->sdata; ++ bool deactivated; ++ + spin_lock_bh(&sta->lock); +- __mesh_plink_deactivate(sta); ++ deactivated = __mesh_plink_deactivate(sta); + spin_unlock_bh(&sta->lock); ++ ++ if (deactivated) ++ ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON); + } + + static int mesh_plink_frame_tx(struct ieee80211_sub_if_data *sdata, +@@ -381,10 +390,16 @@ int mesh_plink_open(struct sta_info *sta + + void mesh_plink_block(struct sta_info *sta) + { ++ struct ieee80211_sub_if_data *sdata = sta->sdata; ++ bool deactivated; ++ + spin_lock_bh(&sta->lock); +- __mesh_plink_deactivate(sta); ++ deactivated = __mesh_plink_deactivate(sta); + sta->plink_state = PLINK_BLOCKED; + spin_unlock_bh(&sta->lock); ++ ++ if (deactivated) ++ ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON); + } + + +@@ -397,6 +412,7 @@ void mesh_rx_plink_frame(struct ieee8021 + enum plink_event event; + enum plink_frame_type ftype; + size_t baselen; ++ bool deactivated; + u8 ie_len; + u8 *baseaddr; + __le16 plid, llid, reason; +@@ -651,8 +667,9 @@ void mesh_rx_plink_frame(struct ieee8021 + case CNF_ACPT: + del_timer(&sta->plink_timer); + sta->plink_state = PLINK_ESTAB; +- mesh_plink_inc_estab_count(sdata); + spin_unlock_bh(&sta->lock); ++ mesh_plink_inc_estab_count(sdata); ++ ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON); + mpl_dbg("Mesh plink with %pM ESTABLISHED\n", + sta->sta.addr); + break; +@@ -684,8 +701,9 @@ void mesh_rx_plink_frame(struct ieee8021 + case OPN_ACPT: + del_timer(&sta->plink_timer); + sta->plink_state = PLINK_ESTAB; +- mesh_plink_inc_estab_count(sdata); + spin_unlock_bh(&sta->lock); ++ mesh_plink_inc_estab_count(sdata); ++ ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON); + mpl_dbg("Mesh plink with %pM ESTABLISHED\n", + sta->sta.addr); + mesh_plink_frame_tx(sdata, PLINK_CONFIRM, sta->sta.addr, llid, +@@ -702,11 +720,13 @@ void mesh_rx_plink_frame(struct ieee8021 + case CLS_ACPT: + reason = cpu_to_le16(MESH_CLOSE_RCVD); + sta->reason = reason; +- __mesh_plink_deactivate(sta); ++ deactivated = __mesh_plink_deactivate(sta); + sta->plink_state = PLINK_HOLDING; + llid = sta->llid; + mod_plink_timer(sta, dot11MeshHoldingTimeout(sdata)); + spin_unlock_bh(&sta->lock); ++ if (deactivated) ++ ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON); + mesh_plink_frame_tx(sdata, PLINK_CLOSE, sta->sta.addr, llid, + plid, reason); + break; diff --git a/queue-2.6.35/parisc-pass-through-t-to-early-iodc-console.patch b/queue-2.6.35/parisc-pass-through-t-to-early-iodc-console.patch new file mode 100644 index 00000000000..4d7f9a9512a --- /dev/null +++ b/queue-2.6.35/parisc-pass-through-t-to-early-iodc-console.patch @@ -0,0 +1,56 @@ +From d9b68e5e88248bb24fd4e455588bea1d56108fd6 Mon Sep 17 00:00:00 2001 +From: Kyle McMartin +Date: Tue, 3 Aug 2010 20:38:08 -0400 +Subject: parisc: pass through '\t' to early (iodc) console + +From: Kyle McMartin + +commit d9b68e5e88248bb24fd4e455588bea1d56108fd6 upstream. + +The firmware handles '\t' internally, so stop trying to emulate it +(which, incidentally, had a bug in it.) + +Fixes a really weird hang at bootup in rcu_bootup_announce, which, +as far as I can tell, is the first printk in the core kernel to use +a tab as the first character. + +Signed-off-by: Kyle McMartin +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + arch/parisc/kernel/firmware.c | 12 ++---------- + 1 file changed, 2 insertions(+), 10 deletions(-) + +--- a/arch/parisc/kernel/firmware.c ++++ b/arch/parisc/kernel/firmware.c +@@ -1123,7 +1123,6 @@ static char __attribute__((aligned(64))) + */ + int pdc_iodc_print(const unsigned char *str, unsigned count) + { +- static int posx; /* for simple TAB-Simulation... */ + unsigned int i; + unsigned long flags; + +@@ -1133,19 +1132,12 @@ int pdc_iodc_print(const unsigned char * + iodc_dbuf[i+0] = '\r'; + iodc_dbuf[i+1] = '\n'; + i += 2; +- posx = 0; + goto print; +- case '\t': +- while (posx & 7) { +- iodc_dbuf[i] = ' '; +- i++, posx++; +- } +- break; + case '\b': /* BS */ +- posx -= 2; ++ i--; /* overwrite last */ + default: + iodc_dbuf[i] = str[i]; +- i++, posx++; ++ i++; + break; + } + } diff --git a/queue-2.6.35/series b/queue-2.6.35/series index 4a2024fbdc4..7fc9357da59 100644 --- a/queue-2.6.35/series +++ b/queue-2.6.35/series @@ -1,2 +1,30 @@ parisc-led.c-fix-potential-stack-overflow-in-led_proc_write.patch arm-imx-gpio-add-spinlock-protection.patch +block_dev-always-serialize-exclusive-open-attempts.patch +parisc-pass-through-t-to-early-iodc-console.patch +amd64_edac-fix-dct-base-address-selector.patch +amd64_edac-correct-scrub-rate-setting.patch +amd64_edac-fix-operator-precendence-error.patch +arp_notify-allow-drivers-to-explicitly-request-a-notification-event.patch +xen-netfront-explicitly-generate-arp_notify-event-after-migration.patch +e1000e-don-t-inadvertently-re-set-intx_disable.patch +e1000e-82577-82578-phy-register-access-issues.patch +9p-strlen-doesn-t-count-the-terminator.patch +igb-use-only-a-single-tx-queue-in-sr-iov-mode.patch +ath9k-enable-serialize_regmode-for-non-pcie-ar9160.patch +ath9k-fix-a-potential-buffer-leak-in-the-sta-teardown-path.patch +ath9k_hw-prevent-a-fast-channel-change-after-a-rx-dma-stuck-issue.patch +ath9k_hw-fix-a-sign-error-in-the-iq-calibration-code.patch +ath9k_hw-fix-an-off-by-one-error-in-the-pdadc-boundaries-calculation.patch +ath9k-fix-retry-count-for-a-mpdu-rate-control-status-reports.patch +ath9k-fix-a-buffer-leak-in-a-mpdu-completion.patch +ath9k-another-fix-for-the-a-mpdu-buffer-leak.patch +ath9k-fix-tsf-after-reset-on-ar913x.patch +ath9k-fix-yet-another-buffer-leak-in-the-tx-aggregation-code.patch +ath9k_hw-fix-antenna-diversity-on-ar9285.patch +iwlwifi-fix-scan-abort.patch +ssb-handle-alternate-ssprom-location.patch +cfg80211-ignore-spurious-deauth.patch +cfg80211-don-t-get-expired-bsses.patch +mac80211-avoid-scheduling-while-atomic-in-mesh_rx_plink_frame.patch +cred-fix-rcu-warning-due-to-previous-patch-fixing-__task_cred-s-checks.patch diff --git a/queue-2.6.35/ssb-handle-alternate-ssprom-location.patch b/queue-2.6.35/ssb-handle-alternate-ssprom-location.patch new file mode 100644 index 00000000000..8444dbce709 --- /dev/null +++ b/queue-2.6.35/ssb-handle-alternate-ssprom-location.patch @@ -0,0 +1,65 @@ +From 9d1ac34ec3a67713308ae0883c3359c557f14d17 Mon Sep 17 00:00:00 2001 +From: Larry Finger +Date: Fri, 14 May 2010 22:08:58 -0500 +Subject: ssb: Handle alternate SSPROM location + +From: Larry Finger + +commit 9d1ac34ec3a67713308ae0883c3359c557f14d17 upstream. + +In kernel Bugzilla #15825 (2 users), in a wireless mailing list thread +(http://lists.infradead.org/pipermail/b43-dev/2010-May/000124.html), and on a +netbook owned by John Linville +(http://marc.info/?l=linux-wireless&m=127230751408818&w=4), there are reports +of ssb failing to detect an SPROM at the normal location. After studying the +MMIO trace dump for the Broadcom wl driver, it was determined that the affected +boxes had a relocated SPROM. + +This patch fixes all systems that have reported this problem. + +Signed-off-by: Larry Finger +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ssb/driver_chipcommon.c | 1 + + drivers/ssb/pci.c | 15 +++++++++++++-- + 2 files changed, 14 insertions(+), 2 deletions(-) + +--- a/drivers/ssb/driver_chipcommon.c ++++ b/drivers/ssb/driver_chipcommon.c +@@ -235,6 +235,7 @@ void ssb_chipcommon_init(struct ssb_chip + return; /* We don't have a ChipCommon */ + if (cc->dev->id.revision >= 11) + cc->status = chipco_read32(cc, SSB_CHIPCO_CHIPSTAT); ++ ssb_dprintk(KERN_INFO PFX "chipcommon status is 0x%x\n", cc->status); + ssb_pmu_init(cc); + chipco_powercontrol_init(cc); + ssb_chipco_set_clockmode(cc, SSB_CLKMODE_FAST); +--- a/drivers/ssb/pci.c ++++ b/drivers/ssb/pci.c +@@ -626,11 +626,22 @@ static int ssb_pci_sprom_get(struct ssb_ + return -ENODEV; + } + if (bus->chipco.dev) { /* can be unavailible! */ +- bus->sprom_offset = (bus->chipco.dev->id.revision < 31) ? +- SSB_SPROM_BASE1 : SSB_SPROM_BASE31; ++ /* ++ * get SPROM offset: SSB_SPROM_BASE1 except for ++ * chipcommon rev >= 31 or chip ID is 0x4312 and ++ * chipcommon status & 3 == 2 ++ */ ++ if (bus->chipco.dev->id.revision >= 31) ++ bus->sprom_offset = SSB_SPROM_BASE31; ++ else if (bus->chip_id == 0x4312 && ++ (bus->chipco.status & 0x03) == 2) ++ bus->sprom_offset = SSB_SPROM_BASE31; ++ else ++ bus->sprom_offset = SSB_SPROM_BASE1; + } else { + bus->sprom_offset = SSB_SPROM_BASE1; + } ++ ssb_dprintk(KERN_INFO PFX "SPROM offset is 0x%x\n", bus->sprom_offset); + + buf = kcalloc(SSB_SPROMSIZE_WORDS_R123, sizeof(u16), GFP_KERNEL); + if (!buf) diff --git a/queue-2.6.35/xen-netfront-explicitly-generate-arp_notify-event-after-migration.patch b/queue-2.6.35/xen-netfront-explicitly-generate-arp_notify-event-after-migration.patch new file mode 100644 index 00000000000..e2d6e877a93 --- /dev/null +++ b/queue-2.6.35/xen-netfront-explicitly-generate-arp_notify-event-after-migration.patch @@ -0,0 +1,35 @@ +From 592970675c9522bde588b945388c7995c8b51328 Mon Sep 17 00:00:00 2001 +From: Ian Campbell +Date: Wed, 26 May 2010 00:09:43 +0000 +Subject: xen: netfront: explicitly generate arp_notify event after migration. + +From: Ian Campbell + +commit 592970675c9522bde588b945388c7995c8b51328 upstream. + +Use newly introduced netif_notify_peers() method to ensure a gratuitous ARP is +generated after a migration. + +Signed-off-by: Ian Campbell +Cc: Stephen Hemminger +Cc: Jeremy Fitzhardinge +Cc: David S. Miller +Cc: netdev@vger.kernel.org +Cc: xen-devel@lists.xensource.com +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/xen-netfront.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/xen-netfront.c ++++ b/drivers/net/xen-netfront.c +@@ -1621,6 +1621,7 @@ static void backend_changed(struct xenbu + if (xennet_connect(netdev) != 0) + break; + xenbus_switch_state(dev, XenbusStateConnected); ++ netif_notify_peers(netdev); + break; + + case XenbusStateClosing: