From: Greg Kroah-Hartman Date: Thu, 6 May 2010 21:10:21 +0000 (-0700) Subject: .33 patches X-Git-Tag: v2.6.32.13~19 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=1ef74fe2eb9edd6c182a5f7627c39d195512ce7e;p=thirdparty%2Fkernel%2Fstable-queue.git .33 patches --- diff --git a/queue-2.6.33/keys-the-request_key-syscall-should-link-an-existing-key-to-the-dest-keyring.patch b/queue-2.6.33/keys-the-request_key-syscall-should-link-an-existing-key-to-the-dest-keyring.patch new file mode 100644 index 00000000000..c6aef0b9496 --- /dev/null +++ b/queue-2.6.33/keys-the-request_key-syscall-should-link-an-existing-key-to-the-dest-keyring.patch @@ -0,0 +1,81 @@ +From 03449cd9eaa4fa3a7faa4a59474bafe2e90bd143 Mon Sep 17 00:00:00 2001 +From: David Howells +Date: Tue, 27 Apr 2010 13:13:08 -0700 +Subject: keys: the request_key() syscall should link an existing key to the dest keyring + +From: David Howells + +commit 03449cd9eaa4fa3a7faa4a59474bafe2e90bd143 upstream. + +The request_key() system call and request_key_and_link() should make a +link from an existing key to the destination keyring (if supplied), not +just from a new key to the destination keyring. + +This can be tested by: + + ring=`keyctl newring fred @s` + keyctl request2 user debug:a a + keyctl request user debug:a $ring + keyctl list $ring + +If it says: + + keyring is empty + +then it didn't work. If it shows something like: + + 1 key in keyring: + 1070462727: --alswrv 0 0 user: debug:a + +then it did. + +request_key() system call is meant to recursively search all your keyrings for +the key you desire, and, optionally, if it doesn't exist, call out to userspace +to create one for you. + +If request_key() finds or creates a key, it should, optionally, create a link +to that key from the destination keyring specified. + +Therefore, if, after a successful call to request_key() with a desination +keyring specified, you see the destination keyring empty, the code didn't work +correctly. + +If you see the found key in the keyring, then it did - which is what the patch +is required for. + +Signed-off-by: David Howells +Cc: James Morris +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + security/keys/request_key.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +--- a/security/keys/request_key.c ++++ b/security/keys/request_key.c +@@ -336,8 +336,10 @@ static int construct_alloc_key(struct ke + + key_already_present: + mutex_unlock(&key_construction_mutex); +- if (dest_keyring) ++ if (dest_keyring) { ++ __key_link(dest_keyring, key_ref_to_ptr(key_ref)); + up_write(&dest_keyring->sem); ++ } + mutex_unlock(&user->cons_lock); + key_put(key); + *_key = key = key_ref_to_ptr(key_ref); +@@ -428,6 +430,11 @@ struct key *request_key_and_link(struct + + if (!IS_ERR(key_ref)) { + key = key_ref_to_ptr(key_ref); ++ if (dest_keyring) { ++ construct_get_dest_keyring(&dest_keyring); ++ key_link(dest_keyring, key); ++ key_put(dest_keyring); ++ } + } else if (PTR_ERR(key_ref) != -EAGAIN) { + key = ERR_CAST(key_ref); + } else { diff --git a/queue-2.6.33/nfsd4-bug-in-read_buf.patch b/queue-2.6.33/nfsd4-bug-in-read_buf.patch new file mode 100644 index 00000000000..d14ea3ce8b9 --- /dev/null +++ b/queue-2.6.33/nfsd4-bug-in-read_buf.patch @@ -0,0 +1,58 @@ +From 2bc3c1179c781b359d4f2f3439cb3df72afc17fc Mon Sep 17 00:00:00 2001 +From: Neil Brown +Date: Tue, 20 Apr 2010 12:16:52 +1000 +Subject: nfsd4: bug in read_buf + +From: Neil Brown + +commit 2bc3c1179c781b359d4f2f3439cb3df72afc17fc upstream. + +When read_buf is called to move over to the next page in the pagelist +of an NFSv4 request, it sets argp->end to essentially a random +number, certainly not an address within the page which argp->p now +points to. So subsequent calls to READ_BUF will think there is much +more than a page of spare space (the cast to u32 ensures an unsigned +comparison) so we can expect to fall off the end of the second +page. + +We never encountered thsi in testing because typically the only +operations which use more than two pages are write-like operations, +which have their own decoding logic. Something like a getattr after a +write may cross a page boundary, but it would be very unusual for it to +cross another boundary after that. + +Signed-off-by: J. Bruce Fields +Signed-off-by: Greg Kroah-Hartman + +--- + fs/nfsd/nfs4xdr.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/fs/nfsd/nfs4xdr.c ++++ b/fs/nfsd/nfs4xdr.c +@@ -160,10 +160,10 @@ static __be32 *read_buf(struct nfsd4_com + argp->p = page_address(argp->pagelist[0]); + argp->pagelist++; + if (argp->pagelen < PAGE_SIZE) { +- argp->end = p + (argp->pagelen>>2); ++ argp->end = argp->p + (argp->pagelen>>2); + argp->pagelen = 0; + } else { +- argp->end = p + (PAGE_SIZE>>2); ++ argp->end = argp->p + (PAGE_SIZE>>2); + argp->pagelen -= PAGE_SIZE; + } + memcpy(((char*)p)+avail, argp->p, (nbytes - avail)); +@@ -1425,10 +1425,10 @@ nfsd4_decode_compound(struct nfsd4_compo + argp->p = page_address(argp->pagelist[0]); + argp->pagelist++; + if (argp->pagelen < PAGE_SIZE) { +- argp->end = p + (argp->pagelen>>2); ++ argp->end = argp->p + (argp->pagelen>>2); + argp->pagelen = 0; + } else { +- argp->end = p + (PAGE_SIZE>>2); ++ argp->end = argp->p + (PAGE_SIZE>>2); + argp->pagelen -= PAGE_SIZE; + } + } diff --git a/queue-2.6.33/procfs-fix-tid-fdinfo.patch b/queue-2.6.33/procfs-fix-tid-fdinfo.patch new file mode 100644 index 00000000000..7f925103f5c --- /dev/null +++ b/queue-2.6.33/procfs-fix-tid-fdinfo.patch @@ -0,0 +1,37 @@ +From 3835541dd481091c4dbf5ef83c08aed12e50fd61 Mon Sep 17 00:00:00 2001 +From: Jerome Marchand +Date: Tue, 27 Apr 2010 13:13:06 -0700 +Subject: procfs: fix tid fdinfo + +From: Jerome Marchand + +commit 3835541dd481091c4dbf5ef83c08aed12e50fd61 upstream. + +Correct the file_operations struct in fdinfo entry of tid_base_stuff[]. + +Presently /proc/*/task/*/fdinfo contains symlinks to opened files like +/proc/*/fd/. + +Signed-off-by: Jerome Marchand +Cc: Alexander Viro +Cc: Miklos Szeredi +Cc: Alexey Dobriyan +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + fs/proc/base.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/proc/base.c ++++ b/fs/proc/base.c +@@ -2910,7 +2910,7 @@ out_no_task: + */ + static const struct pid_entry tid_base_stuff[] = { + DIR("fd", S_IRUSR|S_IXUSR, proc_fd_inode_operations, proc_fd_operations), +- DIR("fdinfo", S_IRUSR|S_IXUSR, proc_fdinfo_inode_operations, proc_fd_operations), ++ DIR("fdinfo", S_IRUSR|S_IXUSR, proc_fdinfo_inode_operations, proc_fdinfo_operations), + REG("environ", S_IRUSR, proc_environ_operations), + INF("auxv", S_IRUSR, proc_pid_auxv), + ONE("status", S_IRUGO, proc_pid_status), diff --git a/queue-2.6.33/series b/queue-2.6.33/series index 1fed13f1ac6..9fc978a5548 100644 --- a/queue-2.6.33/series +++ b/queue-2.6.33/series @@ -13,3 +13,18 @@ flex_array-fix-the-panic-when-calling-flex_array_alloc-without-__gfp_zero.patch hugetlb-fix-infinite-loop-in-get_futex_key-when-backed-by-huge-pages.patch reiserfs-fix-permissions-on-.reiserfs_priv.patch reiserfs-fix-corruption-during-shrinking-of-xattrs.patch +procfs-fix-tid-fdinfo.patch +nfsd4-bug-in-read_buf.patch +keys-the-request_key-syscall-should-link-an-existing-key-to-the-dest-keyring.patch +sfc-wait-at-most-10ms-for-the-mc-to-finish-reading-out-mac-statistics.patch +sfc-always-close-net-device-at-the-end-of-a-disabling-reset.patch +sfc-change-falcon_probe_board-to-fail-for-unsupported-boards.patch +staging-usbip-fix-deadlock.patch +usb-fix-remote-wakeup-settings-during-system-sleep.patch +usb-add-id-for-hp-ev2210-a.k.a-sierra-mc5725-minipci-e-cell-modem.patch +usb-don-t-read-past-config-interface-if-usb_control_msg-fails-in-usb_reset_configuration.patch +usb-fix-testing-the-wrong-variable-in-fs_create_by_name.patch +usb-don-t-choose-configs-with-no-interfaces.patch +usb-ohci-don-t-look-at-the-root-hub-to-get-the-number-of-ports.patch +usb-xhci-properly-set-the-mult-field-of-the-endpoint-context.patch +usb-xhci-properly-set-endpoint-context-fields-for-periodic-eps.patch diff --git a/queue-2.6.33/sfc-always-close-net-device-at-the-end-of-a-disabling-reset.patch b/queue-2.6.33/sfc-always-close-net-device-at-the-end-of-a-disabling-reset.patch new file mode 100644 index 00000000000..086d3d112b5 --- /dev/null +++ b/queue-2.6.33/sfc-always-close-net-device-at-the-end-of-a-disabling-reset.patch @@ -0,0 +1,41 @@ +From f49a4589e9e25ef525da449b1ce5597cb659bbb5 Mon Sep 17 00:00:00 2001 +From: Ben Hutchings +Date: Wed, 28 Apr 2010 09:01:33 +0000 +Subject: sfc: Always close net device at the end of a disabling reset + +From: Ben Hutchings + +commit f49a4589e9e25ef525da449b1ce5597cb659bbb5 upstream. + +This fixes a regression introduced by commit +eb9f6744cbfa97674c13263802259b5aa0034594 "sfc: Implement ethtool +reset operation". + +Signed-off-by: Ben Hutchings +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/sfc/efx.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/net/sfc/efx.c ++++ b/drivers/net/sfc/efx.c +@@ -1862,6 +1862,7 @@ out: + } + + if (disabled) { ++ dev_close(efx->net_dev); + EFX_ERR(efx, "has been disabled\n"); + efx->state = STATE_DISABLED; + } else { +@@ -1885,8 +1886,7 @@ static void efx_reset_work(struct work_s + } + + rtnl_lock(); +- if (efx_reset(efx, efx->reset_pending)) +- dev_close(efx->net_dev); ++ (void)efx_reset(efx, efx->reset_pending); + rtnl_unlock(); + } + diff --git a/queue-2.6.33/sfc-change-falcon_probe_board-to-fail-for-unsupported-boards.patch b/queue-2.6.33/sfc-change-falcon_probe_board-to-fail-for-unsupported-boards.patch new file mode 100644 index 00000000000..fbe71609640 --- /dev/null +++ b/queue-2.6.33/sfc-change-falcon_probe_board-to-fail-for-unsupported-boards.patch @@ -0,0 +1,77 @@ +From e41c11ee0cc602bcde68916be85fb97d1a484324 Mon Sep 17 00:00:00 2001 +From: Ben Hutchings +Date: Wed, 28 Apr 2010 09:01:50 +0000 +Subject: sfc: Change falcon_probe_board() to fail for unsupported boards + +From: Ben Hutchings + +commit e41c11ee0cc602bcde68916be85fb97d1a484324 upstream. + +The driver needs specific PHY and board support code for each SFC4000 +board; there is no point trying to continue if it is missing. +Currently unsupported boards can trigger an 'oops'. + +Signed-off-by: Ben Hutchings +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/sfc/falcon.c | 4 +++- + drivers/net/sfc/falcon_boards.c | 13 +++---------- + drivers/net/sfc/nic.h | 2 +- + 3 files changed, 7 insertions(+), 12 deletions(-) + +--- a/drivers/net/sfc/falcon.c ++++ b/drivers/net/sfc/falcon.c +@@ -1317,7 +1317,9 @@ static int falcon_probe_nvconfig(struct + + EFX_LOG(efx, "PHY is %d phy_id %d\n", efx->phy_type, efx->mdio.prtad); + +- falcon_probe_board(efx, board_rev); ++ rc = falcon_probe_board(efx, board_rev); ++ if (rc) ++ goto fail2; + + kfree(nvconfig); + return 0; +--- a/drivers/net/sfc/falcon_boards.c ++++ b/drivers/net/sfc/falcon_boards.c +@@ -728,15 +728,7 @@ static const struct falcon_board_type bo + }, + }; + +-static const struct falcon_board_type falcon_dummy_board = { +- .init = efx_port_dummy_op_int, +- .init_phy = efx_port_dummy_op_void, +- .fini = efx_port_dummy_op_void, +- .set_id_led = efx_port_dummy_op_set_id_led, +- .monitor = efx_port_dummy_op_int, +-}; +- +-void falcon_probe_board(struct efx_nic *efx, u16 revision_info) ++int falcon_probe_board(struct efx_nic *efx, u16 revision_info) + { + struct falcon_board *board = falcon_board(efx); + u8 type_id = FALCON_BOARD_TYPE(revision_info); +@@ -754,8 +746,9 @@ void falcon_probe_board(struct efx_nic * + (efx->pci_dev->subsystem_vendor == EFX_VENDID_SFC) + ? board->type->ref_model : board->type->gen_type, + 'A' + board->major, board->minor); ++ return 0; + } else { + EFX_ERR(efx, "unknown board type %d\n", type_id); +- board->type = &falcon_dummy_board; ++ return -ENODEV; + } + } +--- a/drivers/net/sfc/nic.h ++++ b/drivers/net/sfc/nic.h +@@ -156,7 +156,7 @@ extern struct efx_nic_type siena_a0_nic_ + ************************************************************************** + */ + +-extern void falcon_probe_board(struct efx_nic *efx, u16 revision_info); ++extern int falcon_probe_board(struct efx_nic *efx, u16 revision_info); + + /* TX data path */ + extern int efx_nic_probe_tx(struct efx_tx_queue *tx_queue); diff --git a/queue-2.6.33/sfc-wait-at-most-10ms-for-the-mc-to-finish-reading-out-mac-statistics.patch b/queue-2.6.33/sfc-wait-at-most-10ms-for-the-mc-to-finish-reading-out-mac-statistics.patch new file mode 100644 index 00000000000..51efe09d344 --- /dev/null +++ b/queue-2.6.33/sfc-wait-at-most-10ms-for-the-mc-to-finish-reading-out-mac-statistics.patch @@ -0,0 +1,41 @@ +From aabc5649078310094cbffb430fcbf9c25b6268f9 Mon Sep 17 00:00:00 2001 +From: Ben Hutchings +Date: Wed, 28 Apr 2010 09:00:35 +0000 +Subject: sfc: Wait at most 10ms for the MC to finish reading out MAC statistics + +From: Ben Hutchings + +commit aabc5649078310094cbffb430fcbf9c25b6268f9 upstream. + +The original code would wait indefinitely if MAC stats DMA failed. + +Signed-off-by: Ben Hutchings +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/sfc/siena.c | 13 +++++++++++-- + 1 file changed, 11 insertions(+), 2 deletions(-) + +--- a/drivers/net/sfc/siena.c ++++ b/drivers/net/sfc/siena.c +@@ -454,8 +454,17 @@ static int siena_try_update_nic_stats(st + + static void siena_update_nic_stats(struct efx_nic *efx) + { +- while (siena_try_update_nic_stats(efx) == -EAGAIN) +- cpu_relax(); ++ int retry; ++ ++ /* If we're unlucky enough to read statistics wduring the DMA, wait ++ * up to 10ms for it to finish (typically takes <500us) */ ++ for (retry = 0; retry < 100; ++retry) { ++ if (siena_try_update_nic_stats(efx) == 0) ++ return; ++ udelay(100); ++ } ++ ++ /* Use the old values instead */ + } + + static void siena_start_nic_stats(struct efx_nic *efx) diff --git a/queue-2.6.33/staging-usbip-fix-deadlock.patch b/queue-2.6.33/staging-usbip-fix-deadlock.patch new file mode 100644 index 00000000000..ad2812de140 --- /dev/null +++ b/queue-2.6.33/staging-usbip-fix-deadlock.patch @@ -0,0 +1,37 @@ +From d01f42a22ef381ba973958e977209ac9a8667d57 Mon Sep 17 00:00:00 2001 +From: Eric Lescouet +Date: Sat, 24 Apr 2010 02:55:24 +0200 +Subject: staging: usbip: Fix deadlock + +From: Eric Lescouet + +commit d01f42a22ef381ba973958e977209ac9a8667d57 upstream. + +When detaching a port from the client side (usbip --detach 0), +the event thread, on the server side, is going to deadlock. +The "eh" server thread is getting USBIP_EH_RESET event and calls: + -> stub_device_reset() -> usb_reset_device() +the USB framework is then calling back _in the same "eh" thread_ : + -> stub_disconnect() -> usbip_stop_eh() -> wait_for_completion() +the "eh" thread is being asleep forever, waiting for its own completion. +This patch checks if "eh" is the current thread, in usbip_stop_eh(). + +Signed-off-by: Eric Lescouet +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/usbip/usbip_event.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/staging/usbip/usbip_event.c ++++ b/drivers/staging/usbip/usbip_event.c +@@ -117,6 +117,9 @@ void usbip_stop_eh(struct usbip_device * + { + struct usbip_task *eh = &ud->eh; + ++ if (eh->thread == current) ++ return; /* do not wait for myself */ ++ + wait_for_completion(&eh->thread_done); + usbip_dbg_eh("usbip_eh has finished\n"); + } diff --git a/queue-2.6.33/usb-add-id-for-hp-ev2210-a.k.a-sierra-mc5725-minipci-e-cell-modem.patch b/queue-2.6.33/usb-add-id-for-hp-ev2210-a.k.a-sierra-mc5725-minipci-e-cell-modem.patch new file mode 100644 index 00000000000..1bbdb947d8c --- /dev/null +++ b/queue-2.6.33/usb-add-id-for-hp-ev2210-a.k.a-sierra-mc5725-minipci-e-cell-modem.patch @@ -0,0 +1,26 @@ +From cfbaa39347b34837f26e01fe8f4f8dbbae60b520 Mon Sep 17 00:00:00 2001 +From: William Lightning +Date: Fri, 26 Mar 2010 10:51:20 -0700 +Subject: USB: Add id for HP ev2210 a.k.a Sierra MC5725 miniPCI-e Cell Modem. + +From: William Lightning + +commit cfbaa39347b34837f26e01fe8f4f8dbbae60b520 upstream. + +Signed-off-by: William Lightning +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/sierra.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/serial/sierra.c ++++ b/drivers/usb/serial/sierra.c +@@ -229,6 +229,7 @@ static const struct sierra_iface_info di + static struct usb_device_id id_table [] = { + { USB_DEVICE(0x0F3D, 0x0112) }, /* Airprime/Sierra PC 5220 */ + { USB_DEVICE(0x03F0, 0x1B1D) }, /* HP ev2200 a.k.a MC5720 */ ++ { USB_DEVICE(0x03F0, 0x211D) }, /* HP ev2210 a.k.a MC5725 */ + { USB_DEVICE(0x03F0, 0x1E1D) }, /* HP hs2300 a.k.a MC8775 */ + + { USB_DEVICE(0x1199, 0x0017) }, /* Sierra Wireless EM5625 */ diff --git a/queue-2.6.33/usb-don-t-choose-configs-with-no-interfaces.patch b/queue-2.6.33/usb-don-t-choose-configs-with-no-interfaces.patch new file mode 100644 index 00000000000..ca2cd8b7f4d --- /dev/null +++ b/queue-2.6.33/usb-don-t-choose-configs-with-no-interfaces.patch @@ -0,0 +1,35 @@ +From 62f9cfa3ece58268b3e92ca59c23b175f86205aa Mon Sep 17 00:00:00 2001 +From: Alan Stern +Date: Tue, 20 Apr 2010 10:40:59 -0400 +Subject: USB: don't choose configs with no interfaces + +From: Alan Stern + +commit 62f9cfa3ece58268b3e92ca59c23b175f86205aa upstream. + +This patch (as1372) fixes a bug in the routine that chooses the +default configuration to install when a new USB device is detected. +The algorithm is supposed to look for a config whose first interface +is for a non-vendor-specific class. But the way it's currently +written, it will also accept a config with no interfaces at all, which +is not very useful. (Believe it or not, such things do exist.) + +Signed-off-by: Alan Stern +Tested-by: Andrew Victor +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/generic.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/core/generic.c ++++ b/drivers/usb/core/generic.c +@@ -120,7 +120,7 @@ int usb_choose_configuration(struct usb_ + * than a vendor-specific driver. */ + else if (udev->descriptor.bDeviceClass != + USB_CLASS_VENDOR_SPEC && +- (!desc || desc->bInterfaceClass != ++ (desc && desc->bInterfaceClass != + USB_CLASS_VENDOR_SPEC)) { + best = c; + break; diff --git a/queue-2.6.33/usb-don-t-read-past-config-interface-if-usb_control_msg-fails-in-usb_reset_configuration.patch b/queue-2.6.33/usb-don-t-read-past-config-interface-if-usb_control_msg-fails-in-usb_reset_configuration.patch new file mode 100644 index 00000000000..c0547eaeb53 --- /dev/null +++ b/queue-2.6.33/usb-don-t-read-past-config-interface-if-usb_control_msg-fails-in-usb_reset_configuration.patch @@ -0,0 +1,39 @@ +From e4a3d94658b5760fc947d7f7185c57db47ca362a Mon Sep 17 00:00:00 2001 +From: Roel Kluin +Date: Thu, 18 Feb 2010 02:36:23 +0100 +Subject: USB: don't read past config->interface[] if usb_control_msg() fails in usb_reset_configuration() + +From: Roel Kluin + +commit e4a3d94658b5760fc947d7f7185c57db47ca362a upstream. + +While looping over the interfaces, if usb_hcd_alloc_bandwidth() fails it calls +hcd->driver->reset_bandwidth(), so there was no need to reinstate the interface +again. + +If no break occurred, the index equals config->desc.bNumInterfaces. A +subsequent usb_control_msg() failure resulted in a read from +config->interface[config->desc.bNumInterfaces] at label reset_old_alts. + +In either case the last interface should be skipped. + +Signed-off-by: Roel Kluin +Acked-by: Alan Stern +Acked-by: Sarah Sharp +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/message.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/core/message.c ++++ b/drivers/usb/core/message.c +@@ -1471,7 +1471,7 @@ int usb_reset_configuration(struct usb_d + /* If not, reinstate the old alternate settings */ + if (retval < 0) { + reset_old_alts: +- for (; i >= 0; i--) { ++ for (i--; i >= 0; i--) { + struct usb_interface *intf = config->interface[i]; + struct usb_host_interface *alt; + diff --git a/queue-2.6.33/usb-fix-remote-wakeup-settings-during-system-sleep.patch b/queue-2.6.33/usb-fix-remote-wakeup-settings-during-system-sleep.patch new file mode 100644 index 00000000000..e83c34630de --- /dev/null +++ b/queue-2.6.33/usb-fix-remote-wakeup-settings-during-system-sleep.patch @@ -0,0 +1,87 @@ +From stern@rowland.harvard.edu Thu May 6 13:51:54 2010 +From: Alan Stern +Date: Fri, 30 Apr 2010 12:09:23 -0400 (EDT) +Subject: USB: fix remote wakeup settings during system sleep +To: Greg KH +Message-ID: + +This is a backport of commit 5f677f1d45b2bf08085bbba7394392dfa586fa8e. +Some of the functionality had to be removed, but it should still fix +the webcam problem. + +This patch (as1363b) changes the way USB remote wakeup is handled +during system sleeps. It won't be enabled unless an interface driver +specifically needs it. Also, it won't be enabled during the FREEZE or +QUIESCE phases of hibernation, when the system doesn't respond to +wakeup events anyway. + +This will fix problems people have reported with certain USB webcams +that generate wakeup requests when they shouldn't, and as a result +cause system suspends to fail. See + + https://bugs.launchpad.net/ubuntu/+source/linux/+bug/515109 + + +Signed-off-by: Alan Stern +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/driver.c | 32 ++++++++++++++++++++++++++++++-- + 1 file changed, 30 insertions(+), 2 deletions(-) + +--- a/drivers/usb/core/driver.c ++++ b/drivers/usb/core/driver.c +@@ -1255,9 +1255,8 @@ static int usb_suspend_both(struct usb_d + udev->state == USB_STATE_SUSPENDED) + goto done; + +- udev->do_remote_wakeup = device_may_wakeup(&udev->dev); +- + if (msg.event & PM_EVENT_AUTO) { ++ udev->do_remote_wakeup = device_may_wakeup(&udev->dev); + status = autosuspend_check(udev, 0); + if (status < 0) + goto done; +@@ -1789,6 +1788,34 @@ int usb_external_resume_device(struct us + return status; + } + ++static void choose_wakeup(struct usb_device *udev, pm_message_t msg) ++{ ++ int w, i; ++ struct usb_interface *intf; ++ ++ /* Remote wakeup is needed only when we actually go to sleep. ++ * For things like FREEZE and QUIESCE, if the device is already ++ * autosuspended then its current wakeup setting is okay. ++ */ ++ if (msg.event == PM_EVENT_FREEZE || msg.event == PM_EVENT_QUIESCE) { ++ udev->do_remote_wakeup = 0; ++ return; ++ } ++ ++ /* If remote wakeup is permitted, see whether any interface drivers ++ * actually want it. ++ */ ++ w = 0; ++ if (device_may_wakeup(&udev->dev) && udev->actconfig) { ++ for (i = 0; i < udev->actconfig->desc.bNumInterfaces; i++) { ++ intf = udev->actconfig->interface[i]; ++ w |= intf->needs_remote_wakeup; ++ } ++ } ++ ++ udev->do_remote_wakeup = w; ++} ++ + int usb_suspend(struct device *dev, pm_message_t msg) + { + struct usb_device *udev; +@@ -1808,6 +1835,7 @@ int usb_suspend(struct device *dev, pm_m + } + + udev->skip_sys_resume = 0; ++ choose_wakeup(udev, msg); + return usb_external_suspend_device(udev, msg); + } + diff --git a/queue-2.6.33/usb-fix-testing-the-wrong-variable-in-fs_create_by_name.patch b/queue-2.6.33/usb-fix-testing-the-wrong-variable-in-fs_create_by_name.patch new file mode 100644 index 00000000000..eab7f0a9e6e --- /dev/null +++ b/queue-2.6.33/usb-fix-testing-the-wrong-variable-in-fs_create_by_name.patch @@ -0,0 +1,38 @@ +From fa7fe7af146a7b613e36a311eefbbfb5555325d1 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Thu, 22 Apr 2010 12:00:52 +0200 +Subject: USB: fix testing the wrong variable in fs_create_by_name() + +From: Dan Carpenter + +commit fa7fe7af146a7b613e36a311eefbbfb5555325d1 upstream. + +There is a typo here. We should be testing "*dentry" which was just +assigned instead of "dentry". This could result in dereferencing an +ERR_PTR inside either usbfs_mkdir() or usbfs_create(). + +Signed-off-by: Dan Carpenter +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/inode.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/usb/core/inode.c ++++ b/drivers/usb/core/inode.c +@@ -515,13 +515,13 @@ static int fs_create_by_name (const char + *dentry = NULL; + mutex_lock(&parent->d_inode->i_mutex); + *dentry = lookup_one_len(name, parent, strlen(name)); +- if (!IS_ERR(dentry)) { ++ if (!IS_ERR(*dentry)) { + if ((mode & S_IFMT) == S_IFDIR) + error = usbfs_mkdir (parent->d_inode, *dentry, mode); + else + error = usbfs_create (parent->d_inode, *dentry, mode); + } else +- error = PTR_ERR(dentry); ++ error = PTR_ERR(*dentry); + mutex_unlock(&parent->d_inode->i_mutex); + + return error; diff --git a/queue-2.6.33/usb-ohci-don-t-look-at-the-root-hub-to-get-the-number-of-ports.patch b/queue-2.6.33/usb-ohci-don-t-look-at-the-root-hub-to-get-the-number-of-ports.patch new file mode 100644 index 00000000000..f0c548c3027 --- /dev/null +++ b/queue-2.6.33/usb-ohci-don-t-look-at-the-root-hub-to-get-the-number-of-ports.patch @@ -0,0 +1,33 @@ +From fcf7d2141f4a363a4a8454c4a0f26bb69e766c5f Mon Sep 17 00:00:00 2001 +From: Alan Stern +Date: Tue, 20 Apr 2010 10:37:57 -0400 +Subject: USB: OHCI: don't look at the root hub to get the number of ports + +From: Alan Stern + +commit fcf7d2141f4a363a4a8454c4a0f26bb69e766c5f upstream. + +This patch (as1371) fixes a small bug in ohci-hcd. The HCD already +knows how many ports the controller has; there's no need to go looking +at the root hub's usb_device structure to find out. Especially since +the root hub's maxchild value is set correctly only while the root hub +is bound to the hub driver. + +Signed-off-by: Alan Stern +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/ohci-hub.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/host/ohci-hub.c ++++ b/drivers/usb/host/ohci-hub.c +@@ -697,7 +697,7 @@ static int ohci_hub_control ( + u16 wLength + ) { + struct ohci_hcd *ohci = hcd_to_ohci (hcd); +- int ports = hcd_to_bus (hcd)->root_hub->maxchild; ++ int ports = ohci->num_ports; + u32 temp; + int retval = 0; + diff --git a/queue-2.6.33/usb-xhci-properly-set-endpoint-context-fields-for-periodic-eps.patch b/queue-2.6.33/usb-xhci-properly-set-endpoint-context-fields-for-periodic-eps.patch new file mode 100644 index 00000000000..5bdd547fd13 --- /dev/null +++ b/queue-2.6.33/usb-xhci-properly-set-endpoint-context-fields-for-periodic-eps.patch @@ -0,0 +1,142 @@ +From 9238f25d5d32a435277eb234ec82bacdd5daed41 Mon Sep 17 00:00:00 2001 +From: Sarah Sharp +Date: Fri, 16 Apr 2010 08:07:27 -0700 +Subject: USB: xhci: properly set endpoint context fields for periodic eps. + +From: Sarah Sharp + +commit 9238f25d5d32a435277eb234ec82bacdd5daed41 upstream. + +For periodic endpoints, we must let the xHCI hardware know the maximum +payload an endpoint can transfer in one service interval. The xHCI +specification refers to this as the Maximum Endpoint Service Interval Time +Payload (Max ESIT Payload). This is used by the hardware for bandwidth +management and scheduling of packets. + +For SuperSpeed endpoints, the maximum is calculated by multiplying the max +packet size by the number of bursts and the number of opportunities to +transfer within a service interval (the Mult field of the SuperSpeed +Endpoint companion descriptor). Devices advertise this in the +wBytesPerInterval field of their SuperSpeed Endpoint Companion Descriptor. + +For high speed devices, this is taken by multiplying the max packet size by the +"number of additional transaction opportunities per microframe" (the high +bits of the wMaxPacketSize field in the endpoint descriptor). + +For FS/LS devices, this is just the max packet size. + +The other thing we must set in the endpoint context is the Average TRB +Length. This is supposed to be the average of the total bytes in the +transfer descriptor (TD), divided by the number of transfer request blocks +(TRBs) it takes to describe the TD. This gives the host controller an +indication of whether the driver will be enqueuing a scatter gather list +with many entries comprised of small buffers, or one contiguous buffer. + +It also takes into account the number of extra TRBs you need for every TD. +This includes No-op TRBs and Link TRBs used to link ring segments +together. Some drivers may choose to chain an Event Data TRB on the end +of every TD, thus increasing the average number of TRBs per TD. The Linux +xHCI driver does not use Event Data TRBs. + +In theory, if there was an API to allow drivers to state what their +bandwidth requirements are, we could set this field accurately. For now, +we set it to the same number as the Max ESIT payload. + +The Average TRB Length should also be set for bulk and control endpoints, +but I have no idea how to guess what it should be. + +Signed-off-by: Sarah Sharp +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/xhci-mem.c | 51 ++++++++++++++++++++++++++++++++++++++++++++ + drivers/usb/host/xhci.h | 4 +++ + 2 files changed, 55 insertions(+) + +--- a/drivers/usb/host/xhci-mem.c ++++ b/drivers/usb/host/xhci-mem.c +@@ -592,6 +592,36 @@ static inline u32 xhci_get_endpoint_type + return type; + } + ++/* Return the maximum endpoint service interval time (ESIT) payload. ++ * Basically, this is the maxpacket size, multiplied by the burst size ++ * and mult size. ++ */ ++static inline u32 xhci_get_max_esit_payload(struct xhci_hcd *xhci, ++ struct usb_device *udev, ++ struct usb_host_endpoint *ep) ++{ ++ int max_burst; ++ int max_packet; ++ ++ /* Only applies for interrupt or isochronous endpoints */ ++ if (usb_endpoint_xfer_control(&ep->desc) || ++ usb_endpoint_xfer_bulk(&ep->desc)) ++ return 0; ++ ++ if (udev->speed == USB_SPEED_SUPER) { ++ if (ep->ss_ep_comp) ++ return ep->ss_ep_comp->desc.wBytesPerInterval; ++ xhci_warn(xhci, "WARN no SS endpoint companion descriptor.\n"); ++ /* Assume no bursts, no multiple opportunities to send. */ ++ return ep->desc.wMaxPacketSize; ++ } ++ ++ max_packet = ep->desc.wMaxPacketSize & 0x3ff; ++ max_burst = (ep->desc.wMaxPacketSize & 0x1800) >> 11; ++ /* A 0 in max burst means 1 transfer per ESIT */ ++ return max_packet * (max_burst + 1); ++} ++ + int xhci_endpoint_init(struct xhci_hcd *xhci, + struct xhci_virt_device *virt_dev, + struct usb_device *udev, +@@ -603,6 +633,7 @@ int xhci_endpoint_init(struct xhci_hcd * + struct xhci_ring *ep_ring; + unsigned int max_packet; + unsigned int max_burst; ++ u32 max_esit_payload; + + ep_index = xhci_get_endpoint_index(&ep->desc); + ep_ctx = xhci_get_ep_ctx(xhci, virt_dev->in_ctx, ep_index); +@@ -670,6 +701,26 @@ int xhci_endpoint_init(struct xhci_hcd * + default: + BUG(); + } ++ max_esit_payload = xhci_get_max_esit_payload(xhci, udev, ep); ++ ep_ctx->tx_info = MAX_ESIT_PAYLOAD_FOR_EP(max_esit_payload); ++ ++ /* ++ * XXX no idea how to calculate the average TRB buffer length for bulk ++ * endpoints, as the driver gives us no clue how big each scatter gather ++ * list entry (or buffer) is going to be. ++ * ++ * For isochronous and interrupt endpoints, we set it to the max ++ * available, until we have new API in the USB core to allow drivers to ++ * declare how much bandwidth they actually need. ++ * ++ * Normally, it would be calculated by taking the total of the buffer ++ * lengths in the TD and then dividing by the number of TRBs in a TD, ++ * including link TRBs, No-op TRBs, and Event data TRBs. Since we don't ++ * use Event Data TRBs, and we don't chain in a link TRB on short ++ * transfers, we're basically dividing by 1. ++ */ ++ ep_ctx->tx_info |= AVG_TRB_LENGTH_FOR_EP(max_esit_payload); ++ + /* FIXME Debug endpoint context */ + return 0; + } +--- a/drivers/usb/host/xhci.h ++++ b/drivers/usb/host/xhci.h +@@ -609,6 +609,10 @@ struct xhci_ep_ctx { + #define MAX_PACKET_MASK (0xffff << 16) + #define MAX_PACKET_DECODED(p) (((p) >> 16) & 0xffff) + ++/* tx_info bitmasks */ ++#define AVG_TRB_LENGTH_FOR_EP(p) ((p) & 0xffff) ++#define MAX_ESIT_PAYLOAD_FOR_EP(p) (((p) & 0xffff) << 16) ++ + + /** + * struct xhci_input_control_context diff --git a/queue-2.6.33/usb-xhci-properly-set-the-mult-field-of-the-endpoint-context.patch b/queue-2.6.33/usb-xhci-properly-set-the-mult-field-of-the-endpoint-context.patch new file mode 100644 index 00000000000..9295447e33b --- /dev/null +++ b/queue-2.6.33/usb-xhci-properly-set-the-mult-field-of-the-endpoint-context.patch @@ -0,0 +1,59 @@ +From 1cf62246c0e394021e494e0a8f1013e80db1a1a9 Mon Sep 17 00:00:00 2001 +From: Sarah Sharp +Date: Fri, 16 Apr 2010 08:07:04 -0700 +Subject: USB: xhci: properly set the "Mult" field of the endpoint context. + +From: Sarah Sharp + +commit 1cf62246c0e394021e494e0a8f1013e80db1a1a9 upstream. + +A SuperSpeed interrupt or isochronous endpoint can define the number of +"burst transactions" it can handle in a service interval. This is +indicated by the "Mult" bits in the bmAttributes of the SuperSpeed +Endpoint Companion Descriptor. For example, if it has a max packet size +of 1024, a max burst of 11, and a mult of 3, the host may send 33 +1024-byte packets in one service interval. + +We must tell the xHCI host controller the number of multiple service +opportunities (mults) the device can handle when the endpoint is +installed. We do that by setting the Mult field of the Endpoint Context +before a configure endpoint command is sent down. The Mult field is +invalid for control or bulk SuperSpeed endpoints. + +Signed-off-by: Sarah Sharp +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/xhci-mem.c | 14 ++++++++++++++ + 1 file changed, 14 insertions(+) + +--- a/drivers/usb/host/xhci-mem.c ++++ b/drivers/usb/host/xhci-mem.c +@@ -549,6 +549,19 @@ static inline unsigned int xhci_get_endp + return EP_INTERVAL(interval); + } + ++/* The "Mult" field in the endpoint context is only set for SuperSpeed devices. ++ * High speed endpoint descriptors can define "the number of additional ++ * transaction opportunities per microframe", but that goes in the Max Burst ++ * endpoint context field. ++ */ ++static inline u32 xhci_get_endpoint_mult(struct usb_device *udev, ++ struct usb_host_endpoint *ep) ++{ ++ if (udev->speed != USB_SPEED_SUPER || !ep->ss_ep_comp) ++ return 0; ++ return ep->ss_ep_comp->desc.bmAttributes; ++} ++ + static inline u32 xhci_get_endpoint_type(struct usb_device *udev, + struct usb_host_endpoint *ep) + { +@@ -611,6 +624,7 @@ int xhci_endpoint_init(struct xhci_hcd * + ep_ctx->deq = ep_ring->first_seg->dma | ep_ring->cycle_state; + + ep_ctx->ep_info = xhci_get_endpoint_interval(udev, ep); ++ ep_ctx->ep_info |= EP_MULT(xhci_get_endpoint_mult(udev, ep)); + + /* FIXME dig Mult and streams info out of ep companion desc */ +