From: Greg Kroah-Hartman Date: Fri, 25 Jun 2010 00:24:35 +0000 (-0700) Subject: .34 patches X-Git-Tag: v2.6.31.14~20 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=208d3a1f6cb4f67cb732836d60d8df2c196a70c3;p=thirdparty%2Fkernel%2Fstable-queue.git .34 patches --- diff --git a/queue-2.6.34/ahci-add-pci-quirk-for-jmb362.patch b/queue-2.6.34/ahci-add-pci-quirk-for-jmb362.patch new file mode 100644 index 00000000000..937154d63a6 --- /dev/null +++ b/queue-2.6.34/ahci-add-pci-quirk-for-jmb362.patch @@ -0,0 +1,61 @@ +From 4daedcfe8c6851aa01cc1997220f2577f4039c13 Mon Sep 17 00:00:00 2001 +From: Tejun Heo +Date: Thu, 3 Jun 2010 11:57:04 +0200 +Subject: ahci: add pci quirk for JMB362 + +From: Tejun Heo + +commit 4daedcfe8c6851aa01cc1997220f2577f4039c13 upstream. + +JMB362 is a new variant of jmicron controller which is similar to +JMB360 but has two SATA ports instead of one. As there is no PATA +port, single function AHCI mode can be used as in JMB360. Add pci +quirk for JMB362. + +Signed-off-by: Tejun Heo +Reported-by: Aries Lee +Signed-off-by: Jeff Garzik +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pci/quirks.c | 5 ++++- + include/linux/pci_ids.h | 1 + + 2 files changed, 5 insertions(+), 1 deletion(-) + +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -1457,7 +1457,8 @@ static void quirk_jmicron_ata(struct pci + conf5 &= ~(1 << 24); /* Clear bit 24 */ + + switch (pdev->device) { +- case PCI_DEVICE_ID_JMICRON_JMB360: ++ case PCI_DEVICE_ID_JMICRON_JMB360: /* SATA single port */ ++ case PCI_DEVICE_ID_JMICRON_JMB362: /* SATA dual ports */ + /* The controller should be in single function ahci mode */ + conf1 |= 0x0002A100; /* Set 8, 13, 15, 17 */ + break; +@@ -1493,12 +1494,14 @@ static void quirk_jmicron_ata(struct pci + } + DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB360, quirk_jmicron_ata); + DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB361, quirk_jmicron_ata); ++DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB362, quirk_jmicron_ata); + DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB363, quirk_jmicron_ata); + DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB365, quirk_jmicron_ata); + DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB366, quirk_jmicron_ata); + DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB368, quirk_jmicron_ata); + DECLARE_PCI_FIXUP_RESUME_EARLY(PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB360, quirk_jmicron_ata); + DECLARE_PCI_FIXUP_RESUME_EARLY(PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB361, quirk_jmicron_ata); ++DECLARE_PCI_FIXUP_RESUME_EARLY(PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB362, quirk_jmicron_ata); + DECLARE_PCI_FIXUP_RESUME_EARLY(PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB363, quirk_jmicron_ata); + DECLARE_PCI_FIXUP_RESUME_EARLY(PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB365, quirk_jmicron_ata); + DECLARE_PCI_FIXUP_RESUME_EARLY(PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB366, quirk_jmicron_ata); +--- a/include/linux/pci_ids.h ++++ b/include/linux/pci_ids.h +@@ -2321,6 +2321,7 @@ + #define PCI_VENDOR_ID_JMICRON 0x197B + #define PCI_DEVICE_ID_JMICRON_JMB360 0x2360 + #define PCI_DEVICE_ID_JMICRON_JMB361 0x2361 ++#define PCI_DEVICE_ID_JMICRON_JMB362 0x2362 + #define PCI_DEVICE_ID_JMICRON_JMB363 0x2363 + #define PCI_DEVICE_ID_JMICRON_JMB365 0x2365 + #define PCI_DEVICE_ID_JMICRON_JMB366 0x2366 diff --git a/queue-2.6.34/ath5k-retain-promiscuous-setting.patch b/queue-2.6.34/ath5k-retain-promiscuous-setting.patch new file mode 100644 index 00000000000..8ef1352a545 --- /dev/null +++ b/queue-2.6.34/ath5k-retain-promiscuous-setting.patch @@ -0,0 +1,47 @@ +From 6b5dcccb495b66b3b0b9581cdccfed038e5d68a2 Mon Sep 17 00:00:00 2001 +From: Bob Copeland +Date: Fri, 4 Jun 2010 08:14:14 -0400 +Subject: ath5k: retain promiscuous setting + +From: Bob Copeland + +commit 6b5dcccb495b66b3b0b9581cdccfed038e5d68a2 upstream. + +Commit 56d1de0a21db28e41741cfa0a66e18bc8d920554, "ath5k: clean up +filter flags setting" introduced a regression in monitor mode such +that the promisc filter flag would get lost. + +Although we set the promisc flag when it changed, we did not +preserve it across subsequent calls to configure_filter. This patch +restores the original functionality. + +Bisected-by: weedy2887@gmail.com +Tested-by: weedy2887@gmail.com +Tested-by: Rick Farina +Signed-off-by: Bob Copeland +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/ath/ath5k/base.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/net/wireless/ath/ath5k/base.c ++++ b/drivers/net/wireless/ath/ath5k/base.c +@@ -2994,13 +2994,15 @@ static void ath5k_configure_filter(struc + + if (changed_flags & (FIF_PROMISC_IN_BSS | FIF_OTHER_BSS)) { + if (*new_flags & FIF_PROMISC_IN_BSS) { +- rfilt |= AR5K_RX_FILTER_PROM; + __set_bit(ATH_STAT_PROMISC, sc->status); + } else { + __clear_bit(ATH_STAT_PROMISC, sc->status); + } + } + ++ if (test_bit(ATH_STAT_PROMISC, sc->status)) ++ rfilt |= AR5K_RX_FILTER_PROM; ++ + /* Note, AR5K_RX_FILTER_MCAST is already enabled */ + if (*new_flags & FIF_ALLMULTI) { + mfilt[0] = ~0; diff --git a/queue-2.6.34/cfq-iosched-fix-an-oops-caused-by-slab-leak.patch b/queue-2.6.34/cfq-iosched-fix-an-oops-caused-by-slab-leak.patch new file mode 100644 index 00000000000..35d5c98bba5 --- /dev/null +++ b/queue-2.6.34/cfq-iosched-fix-an-oops-caused-by-slab-leak.patch @@ -0,0 +1,91 @@ +From d02a2c077fb81f3224c770be62a318165b23b486 Mon Sep 17 00:00:00 2001 +From: Shaohua Li +Date: Tue, 25 May 2010 10:16:53 +0200 +Subject: cfq-iosched: fix an oops caused by slab leak + +From: Shaohua Li + +commit d02a2c077fb81f3224c770be62a318165b23b486 upstream. + +I got below oops when unloading cfq-iosched. Considering scenario: +queue A merge to B, C merge to D and B will be merged to D. Before B is merged +to D, we do split B. We should put B's reference for D. + +[ 807.768536] ============================================================================= +[ 807.768539] BUG cfq_queue: Objects remaining on kmem_cache_close() +[ 807.768541] ----------------------------------------------------------------------------- +[ 807.768543] +[ 807.768546] INFO: Slab 0xffffea0003e6b4e0 objects=26 used=1 fp=0xffff88011d584fd8 flags=0x200000000004082 +[ 807.768550] Pid: 5946, comm: rmmod Tainted: G W 2.6.34-07097-gf4b87de-dirty #724 +[ 807.768552] Call Trace: +[ 807.768560] [] slab_err+0x8f/0x9d +[ 807.768564] [] ? flush_cpu_slab+0x0/0x93 +[ 807.768569] [] ? add_preempt_count+0xe/0xca +[ 807.768572] [] ? sub_preempt_count+0xe/0xb6 +[ 807.768577] [] ? _raw_spin_unlock+0x15/0x30 +[ 807.768580] [] ? sub_preempt_count+0xe/0xb6 +[ 807.768584] [] list_slab_objects+0x9b/0x19f +[ 807.768588] [] ? add_preempt_count+0xc6/0xca +[ 807.768591] [] kmem_cache_destroy+0x13f/0x21d +[ 807.768597] [] cfq_slab_kill+0x1a/0x43 [cfq_iosched] +[ 807.768601] [] cfq_exit+0x93/0x9e [cfq_iosched] +[ 807.768606] [] sys_delete_module+0x1b1/0x219 +[ 807.768612] [] system_call_fastpath+0x16/0x1b +[ 807.768618] INFO: Object 0xffff88011d584618 @offset=1560 +[ 807.768622] INFO: Allocated in cfq_get_queue+0x11e/0x274 [cfq_iosched] age=7173 cpu=1 pid=5496 +[ 807.768626] ============================================================================= + +Signed-off-by: Shaohua Li +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman + +--- + block/cfq-iosched.c | 20 ++++++++++++++------ + 1 file changed, 14 insertions(+), 6 deletions(-) + +--- a/block/cfq-iosched.c ++++ b/block/cfq-iosched.c +@@ -2503,15 +2503,10 @@ static void cfq_free_io_context(struct i + __call_for_each_cic(ioc, cic_free_func); + } + +-static void cfq_exit_cfqq(struct cfq_data *cfqd, struct cfq_queue *cfqq) ++static void cfq_put_cooperator(struct cfq_queue *cfqq) + { + struct cfq_queue *__cfqq, *next; + +- if (unlikely(cfqq == cfqd->active_queue)) { +- __cfq_slice_expired(cfqd, cfqq, 0); +- cfq_schedule_dispatch(cfqd); +- } +- + /* + * If this queue was scheduled to merge with another queue, be + * sure to drop the reference taken on that queue (and others in +@@ -2527,6 +2522,16 @@ static void cfq_exit_cfqq(struct cfq_dat + cfq_put_queue(__cfqq); + __cfqq = next; + } ++} ++ ++static void cfq_exit_cfqq(struct cfq_data *cfqd, struct cfq_queue *cfqq) ++{ ++ if (unlikely(cfqq == cfqd->active_queue)) { ++ __cfq_slice_expired(cfqd, cfqq, 0); ++ cfq_schedule_dispatch(cfqd); ++ } ++ ++ cfq_put_cooperator(cfqq); + + cfq_put_queue(cfqq); + } +@@ -3470,6 +3475,9 @@ split_cfqq(struct cfq_io_context *cic, s + } + + cic_set_cfqq(cic, NULL, 1); ++ ++ cfq_put_cooperator(cfqq); ++ + cfq_put_queue(cfqq); + return NULL; + } diff --git a/queue-2.6.34/cgroups-alloc_css_id-increments-hierarchy-depth.patch b/queue-2.6.34/cgroups-alloc_css_id-increments-hierarchy-depth.patch new file mode 100644 index 00000000000..dec8f12686c --- /dev/null +++ b/queue-2.6.34/cgroups-alloc_css_id-increments-hierarchy-depth.patch @@ -0,0 +1,89 @@ +From 94b3dd0f7bb393d93e84a173b1df9b8b64c83ac4 Mon Sep 17 00:00:00 2001 +From: Greg Thelen +Date: Fri, 4 Jun 2010 14:15:03 -0700 +Subject: cgroups: alloc_css_id() increments hierarchy depth + +From: Greg Thelen + +commit 94b3dd0f7bb393d93e84a173b1df9b8b64c83ac4 upstream. + +Child groups should have a greater depth than their parents. Prior to +this change, the parent would incorrectly report zero memory usage for +child cgroups when use_hierarchy is enabled. + +test script: + mount -t cgroup none /cgroups -o memory + cd /cgroups + mkdir cg1 + + echo 1 > cg1/memory.use_hierarchy + mkdir cg1/cg11 + + echo $$ > cg1/cg11/tasks + dd if=/dev/zero of=/tmp/foo bs=1M count=1 + + echo + echo CHILD + grep cache cg1/cg11/memory.stat + + echo + echo PARENT + grep cache cg1/memory.stat + + echo $$ > tasks + rmdir cg1/cg11 cg1 + cd / + umount /cgroups + +Using fae9c79, a recent patch that changed alloc_css_id() depth computation, +the parent incorrectly reports zero usage: + root@ubuntu:~# ./test + 1+0 records in + 1+0 records out + 1048576 bytes (1.0 MB) copied, 0.0151844 s, 69.1 MB/s + + CHILD + cache 1048576 + total_cache 1048576 + + PARENT + cache 0 + total_cache 0 + +With this patch, the parent correctly includes child usage: + root@ubuntu:~# ./test + 1+0 records in + 1+0 records out + 1048576 bytes (1.0 MB) copied, 0.0136827 s, 76.6 MB/s + + CHILD + cache 1052672 + total_cache 1052672 + + PARENT + cache 0 + total_cache 1052672 + +Signed-off-by: Greg Thelen +Acked-by: Paul Menage +Acked-by: KAMEZAWA Hiroyuki +Acked-by: Li Zefan +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/cgroup.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/kernel/cgroup.c ++++ b/kernel/cgroup.c +@@ -4599,7 +4599,7 @@ static int alloc_css_id(struct cgroup_su + parent_css = parent->subsys[subsys_id]; + child_css = child->subsys[subsys_id]; + parent_id = parent_css->id; +- depth = parent_id->depth; ++ depth = parent_id->depth + 1; + + child_id = get_new_cssid(ss, depth); + if (IS_ERR(child_id)) diff --git a/queue-2.6.34/drm-i915-kill-dangerous-pending-flip-debugging.patch b/queue-2.6.34/drm-i915-kill-dangerous-pending-flip-debugging.patch new file mode 100644 index 00000000000..fba87eb9739 --- /dev/null +++ b/queue-2.6.34/drm-i915-kill-dangerous-pending-flip-debugging.patch @@ -0,0 +1,48 @@ +From 9908ff736adf261e749b4887486a32ffa209304c Mon Sep 17 00:00:00 2001 +From: Chris Wilson +Date: Sat, 15 May 2010 09:57:03 +0100 +Subject: drm/i915: Kill dangerous pending-flip debugging + +From: Chris Wilson + +commit 9908ff736adf261e749b4887486a32ffa209304c upstream. + +We can, by virtue of a vblank interrupt firing in the middle of setting +up the unpin work (i.e. after we set the unpin_work field and before we +write to the ringbuffer) enter intel_finish_page_flip() prior to +receiving the pending flip notification. Therefore we can expect to hit +intel_finish_page_flip() under normal circumstances without a pending flip +and even without installing the pending_flip_obj. This is exacerbated by +aperture thrashing whilst binding the framebuffer + +References: + + Bug 28079 - "glresize" causes kernel panic in intel_finish_page_flip. + https://bugs.freedesktop.org/show_bug.cgi?id=28079 + +Reported-by: Nick Bowler +Signed-off-by: Chris Wilson +Cc: Jesse Barnes +Reviewed-by: Jesse Barnes +Signed-off-by: Eric Anholt +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/intel_display.c | 6 ------ + 1 file changed, 6 deletions(-) + +--- a/drivers/gpu/drm/i915/intel_display.c ++++ b/drivers/gpu/drm/i915/intel_display.c +@@ -4155,12 +4155,6 @@ void intel_finish_page_flip(struct drm_d + spin_lock_irqsave(&dev->event_lock, flags); + work = intel_crtc->unpin_work; + if (work == NULL || !work->pending) { +- if (work && !work->pending) { +- obj_priv = to_intel_bo(work->pending_flip_obj); +- DRM_DEBUG_DRIVER("flip finish: %p (%d) not pending?\n", +- obj_priv, +- atomic_read(&obj_priv->pending_flip)); +- } + spin_unlock_irqrestore(&dev->event_lock, flags); + return; + } diff --git a/queue-2.6.34/drm-i915-rebind-bo-if-currently-bound-with-incorrect-alignment.patch b/queue-2.6.34/drm-i915-rebind-bo-if-currently-bound-with-incorrect-alignment.patch new file mode 100644 index 00000000000..1fe77e296b2 --- /dev/null +++ b/queue-2.6.34/drm-i915-rebind-bo-if-currently-bound-with-incorrect-alignment.patch @@ -0,0 +1,52 @@ +From ac0c6b5ad3b3b513e1057806d4b7627fcc0ecc27 Mon Sep 17 00:00:00 2001 +From: Chris Wilson +Date: Thu, 27 May 2010 13:18:18 +0100 +Subject: drm/i915: Rebind bo if currently bound with incorrect alignment. + +From: Chris Wilson + +commit ac0c6b5ad3b3b513e1057806d4b7627fcc0ecc27 upstream. + +Whilst pinning the buffer, check that that its current alignment +matches the requested alignment. If it does not, rebind. + +This should clear up any final render errors whilst resuming, +for reference: + + Bug 27070 - [i915] Page table errors with empty ringbuffer + https://bugs.freedesktop.org/show_bug.cgi?id=27070 + + Bug 15502 - render error detected, EIR: 0x00000010 + https://bugzilla.kernel.org/show_bug.cgi?id=15502 + + Bug 13844 - i915 error: "render error detected" + https://bugzilla.kernel.org/show_bug.cgi?id=13844 + +Signed-off-by: Chris Wilson +Signed-off-by: Eric Anholt +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/i915_gem.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +--- a/drivers/gpu/drm/i915/i915_gem.c ++++ b/drivers/gpu/drm/i915/i915_gem.c +@@ -4239,6 +4239,17 @@ i915_gem_object_pin(struct drm_gem_objec + int ret; + + i915_verify_inactive(dev, __FILE__, __LINE__); ++ ++ if (obj_priv->gtt_space != NULL) { ++ if (alignment == 0) ++ alignment = i915_gem_get_gtt_alignment(obj); ++ if (obj_priv->gtt_offset & (alignment - 1)) { ++ ret = i915_gem_object_unbind(obj); ++ if (ret) ++ return ret; ++ } ++ } ++ + if (obj_priv->gtt_space == NULL) { + ret = i915_gem_object_bind_to_gtt(obj, alignment); + if (ret) diff --git a/queue-2.6.34/firewire-core-check-for-1394a-compliant-irm-fix-inaccessibility-of-sony-camcorder.patch b/queue-2.6.34/firewire-core-check-for-1394a-compliant-irm-fix-inaccessibility-of-sony-camcorder.patch new file mode 100644 index 00000000000..0b40975612d --- /dev/null +++ b/queue-2.6.34/firewire-core-check-for-1394a-compliant-irm-fix-inaccessibility-of-sony-camcorder.patch @@ -0,0 +1,111 @@ +From 10389536742cefbedecb67a5b2906f155cf3a1c3 Mon Sep 17 00:00:00 2001 +From: Stefan Richter +Date: Sun, 30 May 2010 19:43:52 +0200 +Subject: firewire: core: check for 1394a compliant IRM, fix inaccessibility of Sony camcorder + +From: Stefan Richter + +commit 10389536742cefbedecb67a5b2906f155cf3a1c3 upstream. + +Per IEEE 1394 clause 8.4.2.3, a contender for the IRM role shall check +whether the current IRM complies to 1394a-2000 or later. If not force a +compliant node (e.g. itself) to become IRM. This was implemented in the +older ieee1394 driver but not yet in firewire-core. + +An older Sony camcorder (Sony DCR-TRV25) which implements 1394-1995 IRM +but neither 1394a-2000 IRM nor BM was now found to cause an +interoperability bug: + - Camcorder becomes root node when plugged in, hence gets IRM role. + - firewire-core successfully contends for BM role, proceeds to perform + gap count optimization and resets the bus. + - Sony camcorder ignores presence of a BM (against the spec, this is + a firmware bug), performs its idea of gap count optimization and + resets the bus. + - Preceding two steps are repeated endlessly, bus never settles, + regular I/O is practically impossible. +http://thread.gmane.org/gmane.linux.kernel.firewire.user/3913 + +This is an interoperability regression from the old to the new drivers. +Fix it indirectly by adding the 1394a IRM check. The spec suggests +three and a half methods to determine 1394a compliance of a remote IRM; +we choose the method of testing the Config_ROM.Bus_Info.generation +field. This is data that firewire-core should have readily available at +this point, i.e. does not require extra I/O. + +Reported-by: Clemens Ladisch (missing 1394a check) +Reported-by: H. S. (issue with Sony DCR-TRV25) +Tested-by: H. S. +Signed-off-by: Stefan Richter +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/firewire/core-card.c | 24 +++++++++++++++++++----- + 1 file changed, 19 insertions(+), 5 deletions(-) + +--- a/drivers/firewire/core-card.c ++++ b/drivers/firewire/core-card.c +@@ -231,7 +231,7 @@ void fw_schedule_bm_work(struct fw_card + static void fw_card_bm_work(struct work_struct *work) + { + struct fw_card *card = container_of(work, struct fw_card, work.work); +- struct fw_device *root_device; ++ struct fw_device *root_device, *irm_device; + struct fw_node *root_node; + unsigned long flags; + int root_id, new_root_id, irm_id, local_id; +@@ -239,6 +239,7 @@ static void fw_card_bm_work(struct work_ + bool do_reset = false; + bool root_device_is_running; + bool root_device_is_cmc; ++ bool irm_is_1394_1995_only; + + spin_lock_irqsave(&card->lock, flags); + +@@ -248,12 +249,18 @@ static void fw_card_bm_work(struct work_ + } + + generation = card->generation; ++ + root_node = card->root_node; + fw_node_get(root_node); + root_device = root_node->data; + root_device_is_running = root_device && + atomic_read(&root_device->state) == FW_DEVICE_RUNNING; + root_device_is_cmc = root_device && root_device->cmc; ++ ++ irm_device = card->irm_node->data; ++ irm_is_1394_1995_only = irm_device && irm_device->config_rom && ++ (irm_device->config_rom[2] & 0x000000f0) == 0; ++ + root_id = root_node->node_id; + irm_id = card->irm_node->node_id; + local_id = card->local_node->node_id; +@@ -276,8 +283,15 @@ static void fw_card_bm_work(struct work_ + + if (!card->irm_node->link_on) { + new_root_id = local_id; +- fw_notify("IRM has link off, making local node (%02x) root.\n", +- new_root_id); ++ fw_notify("%s, making local node (%02x) root.\n", ++ "IRM has link off", new_root_id); ++ goto pick_me; ++ } ++ ++ if (irm_is_1394_1995_only) { ++ new_root_id = local_id; ++ fw_notify("%s, making local node (%02x) root.\n", ++ "IRM is not 1394a compliant", new_root_id); + goto pick_me; + } + +@@ -316,8 +330,8 @@ static void fw_card_bm_work(struct work_ + * root, and thus, IRM. + */ + new_root_id = local_id; +- fw_notify("BM lock failed, making local node (%02x) root.\n", +- new_root_id); ++ fw_notify("%s, making local node (%02x) root.\n", ++ "BM lock failed", new_root_id); + goto pick_me; + } + } else if (card->bm_generation != generation) { diff --git a/queue-2.6.34/iwlwifi-fix-internal-scan-race.patch b/queue-2.6.34/iwlwifi-fix-internal-scan-race.patch new file mode 100644 index 00000000000..85116c6aa7c --- /dev/null +++ b/queue-2.6.34/iwlwifi-fix-internal-scan-race.patch @@ -0,0 +1,95 @@ +From 073d5eab6fc85b6c278d507a5633b759a85dc878 Mon Sep 17 00:00:00 2001 +From: Reinette Chatre +Date: Thu, 13 May 2010 14:49:44 -0700 +Subject: iwlwifi: fix internal scan race + +From: Reinette Chatre + +commit 073d5eab6fc85b6c278d507a5633b759a85dc878 upstream. + +It is possible for internal scan to race against itself if the device is +not returning the scan results from first requests. What happens in this +case is the cleanup done during the abort of the first internal scan also +cleans up part of the new scan, causing it to access memory it shouldn't. + +Here are details: +* First internal scan is triggered and scan command sent to device. +* After seven seconds there is no scan results so the watchdog timer + triggers a scan abort. +* The scan abort succeeds and a SCAN_COMPLETE_NOTIFICATION is received for + failed scan. +* During processing of SCAN_COMPLETE_NOTIFICATION we clear STATUS_SCANNING + and queue the "scan_completed" work. +** At this time, since the problem that caused the internal scan in first + place is still present, a new internal scan is triggered. +The behavior at this point is a bit different between 2.6.34 and 2.6.35 +since 2.6.35 has a lot of this synchronized. The rest of the race +description will thus be generalized. +** As part of preparing for the scan "is_internal_short_scan" is set to +true. +* At this point the completion work for fist scan is run. As part of this + there is some locking missing around the "is_internal_short_scan" + variable and it is set to "false". +** Now the second scan runs and it considers itself a real (not internal0 + scan and thus causes problems with wrong memory being accessed. + +The fix is twofold. +* Since "is_internal_short_scan" should be protected by mutex, fix this in + scan completion work so that changes to it can be serialized. +* Do not queue a new internal scan if one is in progress. + +This fixes https://bugzilla.kernel.org/show_bug.cgi?id=15824 + +Signed-off-by: Reinette Chatre +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/iwlwifi/iwl-scan.c | 21 ++++++++++++++++++--- + 1 file changed, 18 insertions(+), 3 deletions(-) + +--- a/drivers/net/wireless/iwlwifi/iwl-scan.c ++++ b/drivers/net/wireless/iwlwifi/iwl-scan.c +@@ -561,6 +561,11 @@ static void iwl_bg_start_internal_scan(s + + mutex_lock(&priv->mutex); + ++ if (priv->is_internal_short_scan == true) { ++ IWL_DEBUG_SCAN(priv, "Internal scan already in progress\n"); ++ goto unlock; ++ } ++ + if (!iwl_is_ready_rf(priv)) { + IWL_DEBUG_SCAN(priv, "not ready or exit pending\n"); + goto unlock; +@@ -958,17 +963,27 @@ void iwl_bg_scan_completed(struct work_s + { + struct iwl_priv *priv = + container_of(work, struct iwl_priv, scan_completed); ++ bool internal = false; + + IWL_DEBUG_SCAN(priv, "SCAN complete scan\n"); + + cancel_delayed_work(&priv->scan_check); + +- if (!priv->is_internal_short_scan) +- ieee80211_scan_completed(priv->hw, false); +- else { ++ mutex_lock(&priv->mutex); ++ if (priv->is_internal_short_scan) { + priv->is_internal_short_scan = false; + IWL_DEBUG_SCAN(priv, "internal short scan completed\n"); ++ internal = true; + } ++ mutex_unlock(&priv->mutex); ++ ++ /* ++ * Do not hold mutex here since this will cause mac80211 to call ++ * into driver again into functions that will attempt to take ++ * mutex. ++ */ ++ if (!internal) ++ ieee80211_scan_completed(priv->hw, false); + + if (test_bit(STATUS_EXIT_PENDING, &priv->status)) + return; diff --git a/queue-2.6.34/iwlwifi-recalculate-average-tpt-if-not-current.patch b/queue-2.6.34/iwlwifi-recalculate-average-tpt-if-not-current.patch new file mode 100644 index 00000000000..96ae381fb0f --- /dev/null +++ b/queue-2.6.34/iwlwifi-recalculate-average-tpt-if-not-current.patch @@ -0,0 +1,50 @@ +From 3d79b2a9eeaa066b35c49fbb17e3156a3c482c3e Mon Sep 17 00:00:00 2001 +From: Reinette Chatre +Date: Mon, 3 May 2010 10:55:07 -0700 +Subject: iwlwifi: recalculate average tpt if not current + +From: Reinette Chatre + +commit 3d79b2a9eeaa066b35c49fbb17e3156a3c482c3e upstream. + +We currently have this check as a BUG_ON, which is being hit by people. +Previously it was an error with a recalculation if not current, return that +code. + +The BUG_ON was introduced by: +commit 3110bef78cb4282c58245bc8fd6d95d9ccb19749 +Author: Guy Cohen +Date: Tue Sep 9 10:54:54 2008 +0800 + + iwlwifi: Added support for 3 antennas + +... the portion adding the BUG_ON is reverted since we are encountering the error +and BUG_ON was created with assumption that error is not encountered. + +Signed-off-by: Reinette Chatre +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/iwlwifi/iwl-agn-rs.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +--- a/drivers/net/wireless/iwlwifi/iwl-agn-rs.c ++++ b/drivers/net/wireless/iwlwifi/iwl-agn-rs.c +@@ -2077,10 +2077,12 @@ static void rs_rate_scale_perform(struct + } + /* Else we have enough samples; calculate estimate of + * actual average throughput */ +- +- /* Sanity-check TPT calculations */ +- BUG_ON(window->average_tpt != ((window->success_ratio * +- tbl->expected_tpt[index] + 64) / 128)); ++ if (window->average_tpt != ((window->success_ratio * ++ tbl->expected_tpt[index] + 64) / 128)) { ++ IWL_ERR(priv, "expected_tpt should have been calculated by now\n"); ++ window->average_tpt = ((window->success_ratio * ++ tbl->expected_tpt[index] + 64) / 128); ++ } + + /* If we are searching for better modulation mode, check success. */ + if (lq_sta->search_better_tbl && diff --git a/queue-2.6.34/mac80211-fix-deauth-before-assoc.patch b/queue-2.6.34/mac80211-fix-deauth-before-assoc.patch new file mode 100644 index 00000000000..58e12efb990 --- /dev/null +++ b/queue-2.6.34/mac80211-fix-deauth-before-assoc.patch @@ -0,0 +1,81 @@ +From b054b747a694927879c94dd11af54d04346aed7d Mon Sep 17 00:00:00 2001 +From: Johannes Berg +Date: Mon, 7 Jun 2010 21:50:07 +0200 +Subject: mac80211: fix deauth before assoc + +From: Johannes Berg + +commit b054b747a694927879c94dd11af54d04346aed7d upstream. + +When we receive a deauthentication frame before +having successfully associated, we neither print +a message nor abort assocation. The former makes +it hard to debug, while the latter later causes +a warning in cfg80211 when, as will typically be +the case, association timed out. + +This warning was reported by many, e.g. in +https://bugzilla.kernel.org/show_bug.cgi?id=15981, +but I couldn't initially pinpoint it. I verified +the fix by hacking hostapd to send a deauth frame +instead of an association response. + +Signed-off-by: Johannes Berg +Tested-by: Miles Lane +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + net/mac80211/mlme.c | 40 ++++++++++++++++++++++++++++++++++++++-- + 1 file changed, 38 insertions(+), 2 deletions(-) + +--- a/net/mac80211/mlme.c ++++ b/net/mac80211/mlme.c +@@ -1530,9 +1530,45 @@ static void ieee80211_sta_rx_queued_mgmt + mutex_unlock(&ifmgd->mtx); + + if (skb->len >= 24 + 2 /* mgmt + deauth reason */ && +- (fc & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_DEAUTH) +- cfg80211_send_deauth(sdata->dev, (u8 *)mgmt, skb->len); ++ (fc & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_DEAUTH) { ++ struct ieee80211_local *local = sdata->local; ++ struct ieee80211_work *wk; ++ ++ mutex_lock(&local->work_mtx); ++ list_for_each_entry(wk, &local->work_list, list) { ++ if (wk->sdata != sdata) ++ continue; ++ ++ if (wk->type != IEEE80211_WORK_ASSOC) ++ continue; ++ ++ if (memcmp(mgmt->bssid, wk->filter_ta, ETH_ALEN)) ++ continue; ++ if (memcmp(mgmt->sa, wk->filter_ta, ETH_ALEN)) ++ continue; + ++ /* ++ * Printing the message only here means we can't ++ * spuriously print it, but it also means that it ++ * won't be printed when the frame comes in before ++ * we even tried to associate or in similar cases. ++ * ++ * Ultimately, I suspect cfg80211 should print the ++ * messages instead. ++ */ ++ printk(KERN_DEBUG ++ "%s: deauthenticated from %pM (Reason: %u)\n", ++ sdata->name, mgmt->bssid, ++ le16_to_cpu(mgmt->u.deauth.reason_code)); ++ ++ list_del_rcu(&wk->list); ++ free_work(wk); ++ break; ++ } ++ mutex_unlock(&local->work_mtx); ++ ++ cfg80211_send_deauth(sdata->dev, (u8 *)mgmt, skb->len); ++ } + out: + kfree_skb(skb); + } diff --git a/queue-2.6.34/misc-fix-allocation-borrowed-by-vhost_net.patch b/queue-2.6.34/misc-fix-allocation-borrowed-by-vhost_net.patch new file mode 100644 index 00000000000..15f008720b7 --- /dev/null +++ b/queue-2.6.34/misc-fix-allocation-borrowed-by-vhost_net.patch @@ -0,0 +1,61 @@ +From 79907d89c397b8bc2e05b347ec94e928ea919d33 Mon Sep 17 00:00:00 2001 +From: Alan Cox +Date: Wed, 9 Jun 2010 09:39:49 +0100 +Subject: misc: Fix allocation 'borrowed' by vhost_net + +From: Alan Cox + +commit 79907d89c397b8bc2e05b347ec94e928ea919d33 upstream. + +10, 233 is allocated officially to /dev/kmview which is shipping in +Ubuntu and Debian distributions. vhost_net seem to have borrowed it +without making a proper request and this causes regressions in the other +distributions. + +vhost_net can use a dynamic minor so use that instead. Also update the +file with a comment to try and avoid future misunderstandings. + +Signed-off-by: Alan Cox +[ We should have caught this before 2.6.34 got released. - Linus ] +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/vhost/net.c | 2 +- + include/linux/miscdevice.h | 7 ++++++- + 2 files changed, 7 insertions(+), 2 deletions(-) + +--- a/drivers/vhost/net.c ++++ b/drivers/vhost/net.c +@@ -637,7 +637,7 @@ const static struct file_operations vhos + }; + + static struct miscdevice vhost_net_misc = { +- VHOST_NET_MINOR, ++ MISC_DYNAMIC_MINOR, + "vhost-net", + &vhost_net_fops, + }; +--- a/include/linux/miscdevice.h ++++ b/include/linux/miscdevice.h +@@ -3,6 +3,12 @@ + #include + #include + ++/* ++ * These allocations are managed by device@lanana.org. If you use an ++ * entry that is not in assigned your entry may well be moved and ++ * reassigned, or set dynamic if a fixed value is not justified. ++ */ ++ + #define PSMOUSE_MINOR 1 + #define MS_BUSMOUSE_MINOR 2 + #define ATIXL_BUSMOUSE_MINOR 3 +@@ -30,7 +36,6 @@ + #define HPET_MINOR 228 + #define FUSE_MINOR 229 + #define KVM_MINOR 232 +-#define VHOST_NET_MINOR 233 + #define MISC_DYNAMIC_MINOR 255 + + struct device; diff --git a/queue-2.6.34/nfsd-nfsd_setattr-needs-to-call-commit_metadata.patch b/queue-2.6.34/nfsd-nfsd_setattr-needs-to-call-commit_metadata.patch new file mode 100644 index 00000000000..7924c43154d --- /dev/null +++ b/queue-2.6.34/nfsd-nfsd_setattr-needs-to-call-commit_metadata.patch @@ -0,0 +1,36 @@ +From b160fdabe93a8a53094f90f02bf4dcb500782aab Mon Sep 17 00:00:00 2001 +From: Christoph Hellwig +Date: Tue, 1 Jun 2010 21:59:18 +0200 +Subject: nfsd: nfsd_setattr needs to call commit_metadata + +From: Christoph Hellwig + +commit b160fdabe93a8a53094f90f02bf4dcb500782aab upstream. + +The conversion of write_inode_now calls to commit_metadata in commit +f501912a35c02eadc55ca9396ece55fe36f785d0 missed out the call in nfsd_setattr. + +But without this conversion we can't guarantee that a SETATTR request +has actually been commited to disk with XFS, which causes a regression +from 2.6.32 (only for NFSv2, but anyway). + +Signed-off-by: Christoph Hellwig +Signed-off-by: J. Bruce Fields +Signed-off-by: Greg Kroah-Hartman + +--- + fs/nfsd/vfs.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/fs/nfsd/vfs.c ++++ b/fs/nfsd/vfs.c +@@ -443,8 +443,7 @@ nfsd_setattr(struct svc_rqst *rqstp, str + if (size_change) + put_write_access(inode); + if (!err) +- if (EX_ISSYNC(fhp->fh_export)) +- write_inode_now(inode, 1); ++ commit_metadata(fhp); + out: + return err; + diff --git a/queue-2.6.34/p54usb-add-device-id-for-dell-wla3310-usb.patch b/queue-2.6.34/p54usb-add-device-id-for-dell-wla3310-usb.patch new file mode 100644 index 00000000000..ca4a53feb67 --- /dev/null +++ b/queue-2.6.34/p54usb-add-device-id-for-dell-wla3310-usb.patch @@ -0,0 +1,33 @@ +From 0f666a08901f8b01f294ca0ad751019375240ae3 Mon Sep 17 00:00:00 2001 +From: Jason Dravet +Date: Sat, 5 Jun 2010 15:08:29 -0500 +Subject: p54usb: Add device ID for Dell WLA3310 USB + +From: Jason Dravet + +commit 0f666a08901f8b01f294ca0ad751019375240ae3 upstream. + +Add Dell WLA3310 USB wireless card, which has a Z-Com XG-705A chipset, to the +USB Ids in p54usb. + +Signed-off-by: Jason Dravet +Tested-by: Richard Gregory Tillmore +Signed-off-by: Larry Finger +Acked-by: Christian Lamparter +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/p54/p54usb.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/wireless/p54/p54usb.c ++++ b/drivers/net/wireless/p54/p54usb.c +@@ -80,6 +80,7 @@ static struct usb_device_id p54u_table[] + {USB_DEVICE(0x1413, 0x5400)}, /* Telsey 802.11g USB2.0 Adapter */ + {USB_DEVICE(0x1435, 0x0427)}, /* Inventel UR054G */ + {USB_DEVICE(0x2001, 0x3704)}, /* DLink DWL-G122 rev A2 */ ++ {USB_DEVICE(0x413c, 0x5513)}, /* Dell WLA3310 USB Wireless Adapter */ + {USB_DEVICE(0x413c, 0x8102)}, /* Spinnaker DUT */ + {USB_DEVICE(0x413c, 0x8104)}, /* Cohiba Proto board */ + {} diff --git a/queue-2.6.34/pcmcia-avoid-validate_cis-failure-on-cis-override.patch b/queue-2.6.34/pcmcia-avoid-validate_cis-failure-on-cis-override.patch new file mode 100644 index 00000000000..ab324b51d7e --- /dev/null +++ b/queue-2.6.34/pcmcia-avoid-validate_cis-failure-on-cis-override.patch @@ -0,0 +1,36 @@ +From b83156b52dd77979cc93bafc2283929532f6f7d0 Mon Sep 17 00:00:00 2001 +From: Dominik Brodowski +Date: Mon, 7 Jun 2010 18:31:17 +0200 +Subject: pcmcia: avoid validate_cis failure on CIS override + +From: Dominik Brodowski + +commit b83156b52dd77979cc93bafc2283929532f6f7d0 upstream. + +Commit a8408c17 introduced a new check to pccard_validate_cis(), +which avoids any "late" calls to this function. This broke the +insertion of cards which require a CIS override which changes +the number of card functions. Fix this by asserting that this +is _not_ a late call, but a proper call early during the card +insertion process. + +Fixes https://bugzilla.kernel.org/show_bug.cgi?id=16138 + +Reported-by: Mikulas Patocka +Signed-off-by: Dominik Brodowski +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pcmcia/ds.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/pcmcia/ds.c ++++ b/drivers/pcmcia/ds.c +@@ -682,6 +682,7 @@ static void pcmcia_requery(struct pcmcia + if (old_funcs != new_funcs) { + /* we need to re-start */ + pcmcia_card_remove(s, NULL); ++ s->functions = 0; + pcmcia_card_add(s); + } + } diff --git a/queue-2.6.34/pcmcia-only-keep-saved-i365_cscint-flag-if-there-is-no-pci-irq.patch b/queue-2.6.34/pcmcia-only-keep-saved-i365_cscint-flag-if-there-is-no-pci-irq.patch new file mode 100644 index 00000000000..8dd9f15c3b8 --- /dev/null +++ b/queue-2.6.34/pcmcia-only-keep-saved-i365_cscint-flag-if-there-is-no-pci-irq.patch @@ -0,0 +1,43 @@ +From 02caa56e4b789b80ae7e0f0f0789f94b44ad32ef Mon Sep 17 00:00:00 2001 +From: Dominik Brodowski +Date: Fri, 21 May 2010 15:16:53 +0200 +Subject: pcmcia: only keep saved I365_CSCINT flag if there is no PCI irq + +From: Dominik Brodowski + +commit 02caa56e4b789b80ae7e0f0f0789f94b44ad32ef upstream. + +Keeping the saved I365_CSCINT flag around breaks PCMCIA on some system, +and is only needed on a few systems to get PCMCIA to work. This patch +allows PCMCIA to work on both types, and it fixes +https://bugzilla.kernel.org/show_bug.cgi?id=16015 + +Reported-by: Justin P. Mattock +Signed-off-by: Dominik Brodowski +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pcmcia/yenta_socket.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/drivers/pcmcia/yenta_socket.c ++++ b/drivers/pcmcia/yenta_socket.c +@@ -975,7 +975,7 @@ static irqreturn_t yenta_probe_handler(i + /* probes the PCI interrupt, use only on override functions */ + static int yenta_probe_cb_irq(struct yenta_socket *socket) + { +- u8 reg; ++ u8 reg = 0; + + if (!socket->cb_irq) + return -1; +@@ -989,7 +989,8 @@ static int yenta_probe_cb_irq(struct yen + } + + /* generate interrupt, wait */ +- reg = exca_readb(socket, I365_CSCINT); ++ if (!socket->dev->irq) ++ reg = exca_readb(socket, I365_CSCINT); + exca_writeb(socket, I365_CSCINT, reg | I365_CSC_STSCHG); + cb_writel(socket, CB_SOCKET_EVENT, -1); + cb_writel(socket, CB_SOCKET_MASK, CB_CSTSMASK); diff --git a/queue-2.6.34/perf-fix-signed-comparison-in-perf_adjust_period.patch b/queue-2.6.34/perf-fix-signed-comparison-in-perf_adjust_period.patch new file mode 100644 index 00000000000..2c20b66593f --- /dev/null +++ b/queue-2.6.34/perf-fix-signed-comparison-in-perf_adjust_period.patch @@ -0,0 +1,54 @@ +From f6ab91add6355e231e1c47897027b2a6ee4fa268 Mon Sep 17 00:00:00 2001 +From: Peter Zijlstra +Date: Fri, 4 Jun 2010 15:18:01 +0200 +Subject: perf: Fix signed comparison in perf_adjust_period() + +From: Peter Zijlstra + +commit f6ab91add6355e231e1c47897027b2a6ee4fa268 upstream. + +Frederic reported that frequency driven swevents didn't work properly +and even caused a division-by-zero error. + +It turns out there are two bugs, the division-by-zero comes from a +failure to deal with that in perf_calculate_period(). + +The other was more interesting and turned out to be a wrong comparison +in perf_adjust_period(). The comparison was between an s64 and u64 and +got implicitly converted to an unsigned comparison. The problem is +that period_left is typically < 0, so it ended up being always true. + +Cure this by making the local period variables s64. + +Reported-by: Frederic Weisbecker +Tested-by: Frederic Weisbecker +Signed-off-by: Peter Zijlstra +LKML-Reference: +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/perf_event.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/kernel/perf_event.c ++++ b/kernel/perf_event.c +@@ -1456,6 +1456,9 @@ do { \ + divisor = nsec * frequency; + } + ++ if (!divisor) ++ return dividend; ++ + return div64_u64(dividend, divisor); + } + +@@ -1478,7 +1481,7 @@ static int perf_event_start(struct perf_ + static void perf_adjust_period(struct perf_event *event, u64 nsec, u64 count) + { + struct hw_perf_event *hwc = &event->hw; +- u64 period, sample_period; ++ s64 period, sample_period; + s64 delta; + + period = perf_calculate_period(event, nsec, count); diff --git a/queue-2.6.34/perf_events-fix-resource-leak-in-x86-__hw_perf_event_init.patch b/queue-2.6.34/perf_events-fix-resource-leak-in-x86-__hw_perf_event_init.patch new file mode 100644 index 00000000000..51bb0dbe960 --- /dev/null +++ b/queue-2.6.34/perf_events-fix-resource-leak-in-x86-__hw_perf_event_init.patch @@ -0,0 +1,44 @@ +From 4b24a88b35e15e04bd8f2c5dda65b5dc8ebca05f Mon Sep 17 00:00:00 2001 +From: Stephane Eranian +Date: Wed, 17 Mar 2010 23:21:01 +0200 +Subject: perf_events: Fix resource leak in x86 __hw_perf_event_init() + +From: Stephane Eranian + +commit 4b24a88b35e15e04bd8f2c5dda65b5dc8ebca05f upstream. + +If reserve_pmc_hardware() succeeds but reserve_ds_buffers() +fails, then we need to release_pmc_hardware. It won't be done +by the destroy() callback because we return before setting it +in case of error. + +Signed-off-by: Stephane Eranian +Cc: peterz@infradead.org +Cc: paulus@samba.org +Cc: davem@davemloft.net +Cc: fweisbec@gmail.com +Cc: robert.richter@amd.com +Cc: perfmon2-devel@lists.sf.net +LKML-Reference: <4ba1568b.15185e0a.182a.7802@mx.google.com> +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/cpu/perf_event.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/arch/x86/kernel/cpu/perf_event.c ++++ b/arch/x86/kernel/cpu/perf_event.c +@@ -460,8 +460,11 @@ static int __hw_perf_event_init(struct p + if (atomic_read(&active_events) == 0) { + if (!reserve_pmc_hardware()) + err = -EBUSY; +- else ++ else { + err = reserve_bts_hardware(); ++ if (err) ++ release_pmc_hardware(); ++ } + } + if (!err) + atomic_inc(&active_events); diff --git a/queue-2.6.34/sata_nv-don-t-diddle-with-nien-on-mcp55.patch b/queue-2.6.34/sata_nv-don-t-diddle-with-nien-on-mcp55.patch new file mode 100644 index 00000000000..c84601187ba --- /dev/null +++ b/queue-2.6.34/sata_nv-don-t-diddle-with-nien-on-mcp55.patch @@ -0,0 +1,54 @@ +From f3faf8fc3fab45c3526efe8c9e99bb23f8723350 Mon Sep 17 00:00:00 2001 +From: Tejun Heo +Date: Tue, 1 Jun 2010 17:29:21 +0200 +Subject: sata_nv: don't diddle with nIEN on mcp55 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Tejun Heo + +commit f3faf8fc3fab45c3526efe8c9e99bb23f8723350 upstream. + +On mcp55, nIEN gets stuck once set and liteon blueray rom iHOS104-08 +violates ATA specification and fails to set I on D2H Reg FIS if nIEN +is set when the command was issued. When the other party is following +the spec, both devices can work fine but when the two flaws are put +together, they can't talk to each other. + +mcp55 has its own IRQ masking mechanism and there's no reason to mess +with nIEN in the first place. Fix it by dropping nIEN diddling from +nv_mcp55_freeze/thaw(). + +This was originally reported by Cengiz. Although Cengiz hasn't +verified the fix yet, I could reproduce this problem and verfiy the +fix. Even if Cengiz is experiencing different or additional problems, +this patch is needed. + +Signed-off-by: Tejun Heo +Reported-by: Cengiz Günay +Signed-off-by: Jeff Garzik +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ata/sata_nv.c | 2 -- + 1 file changed, 2 deletions(-) + +--- a/drivers/ata/sata_nv.c ++++ b/drivers/ata/sata_nv.c +@@ -1674,7 +1674,6 @@ static void nv_mcp55_freeze(struct ata_p + mask = readl(mmio_base + NV_INT_ENABLE_MCP55); + mask &= ~(NV_INT_ALL_MCP55 << shift); + writel(mask, mmio_base + NV_INT_ENABLE_MCP55); +- ata_sff_freeze(ap); + } + + static void nv_mcp55_thaw(struct ata_port *ap) +@@ -1688,7 +1687,6 @@ static void nv_mcp55_thaw(struct ata_por + mask = readl(mmio_base + NV_INT_ENABLE_MCP55); + mask |= (NV_INT_MASK_MCP55 << shift); + writel(mask, mmio_base + NV_INT_ENABLE_MCP55); +- ata_sff_thaw(ap); + } + + static void nv_adma_error_handler(struct ata_port *ap) diff --git a/queue-2.6.34/sata_via-magic-vt6421-fix-for-transmission-problems-w-wd-drives.patch b/queue-2.6.34/sata_via-magic-vt6421-fix-for-transmission-problems-w-wd-drives.patch new file mode 100644 index 00000000000..edeb9893938 --- /dev/null +++ b/queue-2.6.34/sata_via-magic-vt6421-fix-for-transmission-problems-w-wd-drives.patch @@ -0,0 +1,50 @@ +From 8b27ff4cf6d15964aa2987aeb58db4dfb1f87a19 Mon Sep 17 00:00:00 2001 +From: Tejun Heo +Date: Mon, 31 May 2010 16:26:48 +0200 +Subject: sata_via: magic vt6421 fix for transmission problems w/ WD drives + +From: Tejun Heo + +commit 8b27ff4cf6d15964aa2987aeb58db4dfb1f87a19 upstream. + +vt6421 has problems talking to recent WD drives. It causes a lot of +transmission errors while high bandwidth transfer as reported in the +following bugzilla entry. + + https://bugzilla.kernel.org/show_bug.cgi?id=15173 + +Joseph Chan provided the following fix. I don't have any idea what it +does but I can verify the issue is gone with the patch applied. + +Signed-off-by: Tejun Heo +Originally-from: Joseph Chan +Reported-by: Jorrit Tijben +Signed-off-by: Jeff Garzik +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ata/sata_via.c | 13 +++++++++++++ + 1 file changed, 13 insertions(+) + +--- a/drivers/ata/sata_via.c ++++ b/drivers/ata/sata_via.c +@@ -575,6 +575,19 @@ static void svia_configure(struct pci_de + tmp8 |= NATIVE_MODE_ALL; + pci_write_config_byte(pdev, SATA_NATIVE_MODE, tmp8); + } ++ ++ /* ++ * vt6421 has problems talking to some drives. The following ++ * is the magic fix from Joseph Chan . ++ * Please add proper documentation if possible. ++ * ++ * https://bugzilla.kernel.org/show_bug.cgi?id=15173 ++ */ ++ if (pdev->device == 0x3249) { ++ pci_read_config_byte(pdev, 0x52, &tmp8); ++ tmp8 |= 1 << 2; ++ pci_write_config_byte(pdev, 0x52, tmp8); ++ } + } + + static int svia_init_one(struct pci_dev *pdev, const struct pci_device_id *ent) diff --git a/queue-2.6.34/series b/queue-2.6.34/series index 463678328bd..30033172254 100644 --- a/queue-2.6.34/series +++ b/queue-2.6.34/series @@ -137,3 +137,31 @@ clocksource-sh_tmu-compute-mult-and-shift-before-registration.patch clocksource-sh_cmt-compute-mult-and-shift-before-registration.patch gconfig-fix-build-failure-on-fedora-13.patch arch-x86-kernel-add-missing-spin_unlock.patch +pcmcia-only-keep-saved-i365_cscint-flag-if-there-is-no-pci-irq.patch +pcmcia-avoid-validate_cis-failure-on-cis-override.patch +mac80211-fix-deauth-before-assoc.patch +ath5k-retain-promiscuous-setting.patch +ahci-add-pci-quirk-for-jmb362.patch +firewire-core-check-for-1394a-compliant-irm-fix-inaccessibility-of-sony-camcorder.patch +misc-fix-allocation-borrowed-by-vhost_net.patch +cgroups-alloc_css_id-increments-hierarchy-depth.patch +perf_events-fix-resource-leak-in-x86-__hw_perf_event_init.patch +sata_nv-don-t-diddle-with-nien-on-mcp55.patch +sata_via-magic-vt6421-fix-for-transmission-problems-w-wd-drives.patch +drm-i915-rebind-bo-if-currently-bound-with-incorrect-alignment.patch +drm-i915-kill-dangerous-pending-flip-debugging.patch +usb-mos7840-fix-null-pointer-dereference.patch +usb-xhci-wait-for-host-to-start-running.patch +usb-xhci-wait-for-controller-to-be-ready-after-reset.patch +usb-ftdi_sio-fix-dtr-rts-line-modes.patch +usb-cdc-acm-fix-resource-reclaim-in-error-path-of-acm_probe.patch +usb-unbind-all-interfaces-before-rebinding-them.patch +p54usb-add-device-id-for-dell-wla3310-usb.patch +wrong-type-for-magic-argument-in-simple_fill_super.patch +cfq-iosched-fix-an-oops-caused-by-slab-leak.patch +iwlwifi-fix-internal-scan-race.patch +iwlwifi-recalculate-average-tpt-if-not-current.patch +perf-fix-signed-comparison-in-perf_adjust_period.patch +tracing-fix-null-pointer-deref-with-send_sig_forced.patch +nfsd-nfsd_setattr-needs-to-call-commit_metadata.patch +wl1251-fix-a-memory-leak-in-probe.patch diff --git a/queue-2.6.34/tracing-fix-null-pointer-deref-with-send_sig_forced.patch b/queue-2.6.34/tracing-fix-null-pointer-deref-with-send_sig_forced.patch new file mode 100644 index 00000000000..2d2e73e8d86 --- /dev/null +++ b/queue-2.6.34/tracing-fix-null-pointer-deref-with-send_sig_forced.patch @@ -0,0 +1,44 @@ +From b9b76dfaac6fa2c289ee8a005be637afd2da7e2f Mon Sep 17 00:00:00 2001 +From: Oleg Nesterov +Date: Thu, 3 Jun 2010 23:34:09 +0200 +Subject: tracing: Fix null pointer deref with SEND_SIG_FORCED + +From: Oleg Nesterov + +commit b9b76dfaac6fa2c289ee8a005be637afd2da7e2f upstream. + +BUG: unable to handle kernel NULL pointer dereference at + 0000000000000006 +IP: [] ftrace_raw_event_signal_generate+0x87/0x140 + +TP_STORE_SIGINFO() forgets about SEND_SIG_FORCED, fix. + +We should probably export is_si_special() and change TP_STORE_SIGINFO() +to use it in the longer term. + +Signed-off-by: Oleg Nesterov +Acked-by: Roland McGrath +Cc: Steven Rostedt +Cc: Andrew Morton +Cc: Jason Baron +Cc: Masami Hiramatsu +LKML-Reference: <20100603213409.GA8307@redhat.com> +Signed-off-by: Frederic Weisbecker +Signed-off-by: Greg Kroah-Hartman + +--- + include/trace/events/signal.h | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/include/trace/events/signal.h ++++ b/include/trace/events/signal.h +@@ -10,7 +10,8 @@ + + #define TP_STORE_SIGINFO(__entry, info) \ + do { \ +- if (info == SEND_SIG_NOINFO) { \ ++ if (info == SEND_SIG_NOINFO || \ ++ info == SEND_SIG_FORCED) { \ + __entry->errno = 0; \ + __entry->code = SI_USER; \ + } else if (info == SEND_SIG_PRIV) { \ diff --git a/queue-2.6.34/usb-cdc-acm-fix-resource-reclaim-in-error-path-of-acm_probe.patch b/queue-2.6.34/usb-cdc-acm-fix-resource-reclaim-in-error-path-of-acm_probe.patch new file mode 100644 index 00000000000..45ea9f10ba6 --- /dev/null +++ b/queue-2.6.34/usb-cdc-acm-fix-resource-reclaim-in-error-path-of-acm_probe.patch @@ -0,0 +1,69 @@ +From c2572b78aa0447244a38e555ebb1b3b48a0088a5 Mon Sep 17 00:00:00 2001 +From: Axel Lin +Date: Mon, 31 May 2010 08:04:47 +0800 +Subject: USB: cdc-acm: fix resource reclaim in error path of acm_probe + +From: Axel Lin + +commit c2572b78aa0447244a38e555ebb1b3b48a0088a5 upstream. + +This patch fixes resource reclaim in error path of acm_probe: + +1. In the case of "out of memory (read urbs usb_alloc_urb)\n")", there + is no need to call acm_read_buffers_free(acm) here. Fix it by goto + alloc_fail6 instead of alloc_fail7. +2. In the case of "out of memory (write urbs usb_alloc_urb)", + usb_alloc_urb may fail in any iteration of the for loop. Current + implementation does not properly free allocated snd->urb. Fix it by + goto alloc_fail8 instead of alloc_fail7. +3. In the case of device_create_file(&intf->dev,&dev_attr_iCountryCodeRelDate) + fail, acm->country_codes is kfreed. As a result, device_remove_file + for dev_attr_wCountryCodes will not be executed in acm_disconnect. + Fix it by calling device_remove_file for dev_attr_wCountryCodes + before goto skip_countries. + +Signed-off-by: Axel Lin +Acked-by: Oliver Neukum +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/class/cdc-acm.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/usb/class/cdc-acm.c ++++ b/drivers/usb/class/cdc-acm.c +@@ -1201,7 +1201,7 @@ made_compressed_probe: + if (rcv->urb == NULL) { + dev_dbg(&intf->dev, + "out of memory (read urbs usb_alloc_urb)\n"); +- goto alloc_fail7; ++ goto alloc_fail6; + } + + rcv->urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP; +@@ -1225,7 +1225,7 @@ made_compressed_probe: + if (snd->urb == NULL) { + dev_dbg(&intf->dev, + "out of memory (write urbs usb_alloc_urb)"); +- goto alloc_fail7; ++ goto alloc_fail8; + } + + if (usb_endpoint_xfer_int(epwrite)) +@@ -1264,6 +1264,7 @@ made_compressed_probe: + i = device_create_file(&intf->dev, + &dev_attr_iCountryCodeRelDate); + if (i < 0) { ++ device_remove_file(&intf->dev, &dev_attr_wCountryCodes); + kfree(acm->country_codes); + goto skip_countries; + } +@@ -1300,6 +1301,7 @@ alloc_fail8: + usb_free_urb(acm->wb[i].urb); + alloc_fail7: + acm_read_buffers_free(acm); ++alloc_fail6: + for (i = 0; i < num_rx_buf; i++) + usb_free_urb(acm->ru[i].urb); + usb_free_urb(acm->ctrlurb); diff --git a/queue-2.6.34/usb-ftdi_sio-fix-dtr-rts-line-modes.patch b/queue-2.6.34/usb-ftdi_sio-fix-dtr-rts-line-modes.patch new file mode 100644 index 00000000000..77ada61d94e --- /dev/null +++ b/queue-2.6.34/usb-ftdi_sio-fix-dtr-rts-line-modes.patch @@ -0,0 +1,49 @@ +From 6a1a82df91fa0eb1cc76069a9efe5714d087eccd Mon Sep 17 00:00:00 2001 +From: Daniel Mack +Date: Thu, 3 Jun 2010 13:55:02 +0200 +Subject: USB: ftdi_sio: fix DTR/RTS line modes + +From: Daniel Mack + +commit 6a1a82df91fa0eb1cc76069a9efe5714d087eccd upstream. + +Call set_mctrl() and clear_mctrl() according to the flow control mode +selected. This makes serial communication for FT232 connected devices +work when CRTSCTS is not set. + +This fixes a regression introduced by 4175f3e31 ("tty_port: If we are +opened non blocking we still need to raise the carrier"). This patch +calls the low-level driver's dtr_rts() function which consequently sets +TIOCM_DTR | TIOCM_RTS. A later call to set_termios() without CRTSCTS in +cflags, however, does not reset these bits, and so data is not actually +sent out on the serial wire. + +Signed-off-by: Daniel Mack +Cc: Johan Hovold +Cc: Alan Cox +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/ftdi_sio.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/usb/serial/ftdi_sio.c ++++ b/drivers/usb/serial/ftdi_sio.c +@@ -2289,6 +2289,8 @@ static void ftdi_set_termios(struct tty_ + "urb failed to set to rts/cts flow control\n"); + } + ++ /* raise DTR/RTS */ ++ set_mctrl(port, TIOCM_DTR | TIOCM_RTS); + } else { + /* + * Xon/Xoff code +@@ -2336,6 +2338,8 @@ static void ftdi_set_termios(struct tty_ + } + } + ++ /* lower DTR/RTS */ ++ clear_mctrl(port, TIOCM_DTR | TIOCM_RTS); + } + return; + } diff --git a/queue-2.6.34/usb-mos7840-fix-null-pointer-dereference.patch b/queue-2.6.34/usb-mos7840-fix-null-pointer-dereference.patch new file mode 100644 index 00000000000..5a2a7934cc2 --- /dev/null +++ b/queue-2.6.34/usb-mos7840-fix-null-pointer-dereference.patch @@ -0,0 +1,28 @@ +From b41709f1263bb1ad37efc43fea0bb0b670c12e78 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Wed, 19 May 2010 22:13:17 +0200 +Subject: USB: mos7840: fix null-pointer dereference + +From: Johan Hovold + +commit b41709f1263bb1ad37efc43fea0bb0b670c12e78 upstream. + +Fix null-pointer dereference on error path. + +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/mos7840.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/drivers/usb/serial/mos7840.c ++++ b/drivers/usb/serial/mos7840.c +@@ -731,7 +731,6 @@ static void mos7840_bulk_in_callback(str + mos7840_port = urb->context; + if (!mos7840_port) { + dbg("%s", "NULL mos7840_port pointer"); +- mos7840_port->read_urb_busy = false; + return; + } + diff --git a/queue-2.6.34/usb-unbind-all-interfaces-before-rebinding-them.patch b/queue-2.6.34/usb-unbind-all-interfaces-before-rebinding-them.patch new file mode 100644 index 00000000000..e7a667155e6 --- /dev/null +++ b/queue-2.6.34/usb-unbind-all-interfaces-before-rebinding-them.patch @@ -0,0 +1,49 @@ +From c043f1245654a726925529007210e9f786426448 Mon Sep 17 00:00:00 2001 +From: Alan Stern +Date: Fri, 4 Jun 2010 14:02:42 -0400 +Subject: USB: unbind all interfaces before rebinding them +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Alan Stern + +commit c043f1245654a726925529007210e9f786426448 upstream. + +This patch (as1387) fixes a bug introduced during the changeover to +the runtime PM framework. When a driver doesn't support resume or +reset-resume, and consequently its interfaces need to be unbound and +rebound, we have to unbind all the interfaces before trying to rebind +any of them. Otherwise the driver's probe method for one interface +could try to claim a different interface and fail, because that other +interface hasn't been unbound yet. + +This fixes Bugzilla #15788. The symptom is that some USB sound cards +don't work after hibernation. + +Signed-off-by: Alan Stern +Tested-by: François Valenduc +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/driver.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/usb/core/driver.c ++++ b/drivers/usb/core/driver.c +@@ -1322,6 +1322,7 @@ int usb_resume(struct device *dev, pm_me + + /* For all other calls, take the device back to full power and + * tell the PM core in case it was autosuspended previously. ++ * Unbind the interfaces that will need rebinding later. + */ + } else { + status = usb_resume_both(udev, msg); +@@ -1330,6 +1331,7 @@ int usb_resume(struct device *dev, pm_me + pm_runtime_set_active(dev); + pm_runtime_enable(dev); + udev->last_busy = jiffies; ++ do_unbind_rebind(udev, DO_REBIND); + } + } + diff --git a/queue-2.6.34/usb-xhci-wait-for-controller-to-be-ready-after-reset.patch b/queue-2.6.34/usb-xhci-wait-for-controller-to-be-ready-after-reset.patch new file mode 100644 index 00000000000..1a1149bcda0 --- /dev/null +++ b/queue-2.6.34/usb-xhci-wait-for-controller-to-be-ready-after-reset.patch @@ -0,0 +1,50 @@ +From 2d62f3eea98354d61f90d6b115eecf9be5f4bdfe Mon Sep 17 00:00:00 2001 +From: Sarah Sharp +Date: Mon, 24 May 2010 13:25:15 -0700 +Subject: USB: xhci: Wait for controller to be ready after reset. + +From: Sarah Sharp + +commit 2d62f3eea98354d61f90d6b115eecf9be5f4bdfe upstream. + +After software resets an xHCI host controller, it must wait for the +"Controller Not Ready" (CNR) bit in the status register to be cleared. +Software is not supposed to ring any doorbells or write to any registers +except the status register until this bit is cleared. + +Signed-off-by: Sarah Sharp +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/xhci.c | 13 ++++++++++++- + 1 file changed, 12 insertions(+), 1 deletion(-) + +--- a/drivers/usb/host/xhci.c ++++ b/drivers/usb/host/xhci.c +@@ -142,6 +142,7 @@ int xhci_reset(struct xhci_hcd *xhci) + { + u32 command; + u32 state; ++ int ret; + + state = xhci_readl(xhci, &xhci->op_regs->status); + if ((state & STS_HALT) == 0) { +@@ -156,7 +157,17 @@ int xhci_reset(struct xhci_hcd *xhci) + /* XXX: Why does EHCI set this here? Shouldn't other code do this? */ + xhci_to_hcd(xhci)->state = HC_STATE_HALT; + +- return handshake(xhci, &xhci->op_regs->command, CMD_RESET, 0, 250 * 1000); ++ ret = handshake(xhci, &xhci->op_regs->command, ++ CMD_RESET, 0, 250 * 1000); ++ if (ret) ++ return ret; ++ ++ xhci_dbg(xhci, "Wait for controller to be ready for doorbell rings\n"); ++ /* ++ * xHCI cannot write to any doorbells or operational registers other ++ * than status until the "Controller Not Ready" flag is cleared. ++ */ ++ return handshake(xhci, &xhci->op_regs->status, STS_CNR, 0, 250 * 1000); + } + + diff --git a/queue-2.6.34/usb-xhci-wait-for-host-to-start-running.patch b/queue-2.6.34/usb-xhci-wait-for-host-to-start-running.patch new file mode 100644 index 00000000000..18f2d00fae2 --- /dev/null +++ b/queue-2.6.34/usb-xhci-wait-for-host-to-start-running.patch @@ -0,0 +1,77 @@ +From ed07453fd356025cc25272629e982f5e4607632c Mon Sep 17 00:00:00 2001 +From: Sarah Sharp +Date: Mon, 24 May 2010 13:25:21 -0700 +Subject: USB: xhci: Wait for host to start running. + +From: Sarah Sharp + +commit ed07453fd356025cc25272629e982f5e4607632c upstream. + +When the run bit is set in the xHCI command register, it may take a few +microseconds for the host to start running. We cannot ring any doorbells +until the host is actually running, so wait until the status register says +the host is running. + +Signed-off-by: Sarah Sharp +Reported-by: Shinya Saito +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/xhci.c | 39 ++++++++++++++++++++++++++++++++------- + 1 file changed, 32 insertions(+), 7 deletions(-) + +--- a/drivers/usb/host/xhci.c ++++ b/drivers/usb/host/xhci.c +@@ -105,6 +105,33 @@ int xhci_halt(struct xhci_hcd *xhci) + } + + /* ++ * Set the run bit and wait for the host to be running. ++ */ ++int xhci_start(struct xhci_hcd *xhci) ++{ ++ u32 temp; ++ int ret; ++ ++ temp = xhci_readl(xhci, &xhci->op_regs->command); ++ temp |= (CMD_RUN); ++ xhci_dbg(xhci, "// Turn on HC, cmd = 0x%x.\n", ++ temp); ++ xhci_writel(xhci, temp, &xhci->op_regs->command); ++ ++ /* ++ * Wait for the HCHalted Status bit to be 0 to indicate the host is ++ * running. ++ */ ++ ret = handshake(xhci, &xhci->op_regs->status, ++ STS_HALT, 0, XHCI_MAX_HALT_USEC); ++ if (ret == -ETIMEDOUT) ++ xhci_err(xhci, "Host took too long to start, " ++ "waited %u microseconds.\n", ++ XHCI_MAX_HALT_USEC); ++ return ret; ++} ++ ++/* + * Reset a halted HC, and set the internal HC state to HC_STATE_HALT. + * + * This resets pipelines, timers, counters, state machines, etc. +@@ -452,13 +479,11 @@ int xhci_run(struct usb_hcd *hcd) + if (NUM_TEST_NOOPS > 0) + doorbell = xhci_setup_one_noop(xhci); + +- temp = xhci_readl(xhci, &xhci->op_regs->command); +- temp |= (CMD_RUN); +- xhci_dbg(xhci, "// Turn on HC, cmd = 0x%x.\n", +- temp); +- xhci_writel(xhci, temp, &xhci->op_regs->command); +- /* Flush PCI posted writes */ +- temp = xhci_readl(xhci, &xhci->op_regs->command); ++ if (xhci_start(xhci)) { ++ xhci_halt(xhci); ++ return -ENODEV; ++ } ++ + xhci_dbg(xhci, "// @%p = 0x%x\n", &xhci->op_regs->command, temp); + if (doorbell) + (*doorbell)(xhci); diff --git a/queue-2.6.34/wl1251-fix-a-memory-leak-in-probe.patch b/queue-2.6.34/wl1251-fix-a-memory-leak-in-probe.patch new file mode 100644 index 00000000000..47516dafe44 --- /dev/null +++ b/queue-2.6.34/wl1251-fix-a-memory-leak-in-probe.patch @@ -0,0 +1,30 @@ +From aa679c36756003f1fabdb9fc6f00eb159559f7c3 Mon Sep 17 00:00:00 2001 +From: Grazvydas Ignotas +Date: Sat, 5 Jun 2010 02:25:47 +0300 +Subject: wl1251: fix a memory leak in probe + +From: Grazvydas Ignotas + +commit aa679c36756003f1fabdb9fc6f00eb159559f7c3 upstream. + +wl1251_sdio_probe() error path is missing wl1251_free_hw, add it. + +Signed-off-by: Grazvydas Ignotas +Acked-by: Kalle Valo +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/wl12xx/wl1251_sdio.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/wireless/wl12xx/wl1251_sdio.c ++++ b/drivers/net/wireless/wl12xx/wl1251_sdio.c +@@ -160,6 +160,7 @@ disable: + sdio_disable_func(func); + release: + sdio_release_host(func); ++ wl1251_free_hw(wl); + return ret; + } + diff --git a/queue-2.6.34/wrong-type-for-magic-argument-in-simple_fill_super.patch b/queue-2.6.34/wrong-type-for-magic-argument-in-simple_fill_super.patch new file mode 100644 index 00000000000..c6c9108c0e2 --- /dev/null +++ b/queue-2.6.34/wrong-type-for-magic-argument-in-simple_fill_super.patch @@ -0,0 +1,45 @@ +From 7d683a09990ff095a91b6e724ecee0ff8733274a Mon Sep 17 00:00:00 2001 +From: Roberto Sassu +Date: Thu, 3 Jun 2010 11:58:28 +0200 +Subject: wrong type for 'magic' argument in simple_fill_super() + +From: Roberto Sassu + +commit 7d683a09990ff095a91b6e724ecee0ff8733274a upstream. + +It's used to superblock ->s_magic, which is unsigned long. + +Signed-off-by: Roberto Sassu +Reviewed-by: Mimi Zohar +Signed-off-by: Eric Paris +Signed-off-by: Al Viro +Signed-off-by: Greg Kroah-Hartman + +--- + fs/libfs.c | 3 ++- + include/linux/fs.h | 2 +- + 2 files changed, 3 insertions(+), 2 deletions(-) + +--- a/fs/libfs.c ++++ b/fs/libfs.c +@@ -418,7 +418,8 @@ int simple_write_end(struct file *file, + * unique inode values later for this filesystem, then you must take care + * to pass it an appropriate max_reserved value to avoid collisions. + */ +-int simple_fill_super(struct super_block *s, int magic, struct tree_descr *files) ++int simple_fill_super(struct super_block *s, unsigned long magic, ++ struct tree_descr *files) + { + struct inode *inode; + struct dentry *root; +--- a/include/linux/fs.h ++++ b/include/linux/fs.h +@@ -2356,7 +2356,7 @@ extern const struct file_operations simp + extern const struct inode_operations simple_dir_inode_operations; + struct tree_descr { char *name; const struct file_operations *ops; int mode; }; + struct dentry *d_alloc_name(struct dentry *, const char *); +-extern int simple_fill_super(struct super_block *, int, struct tree_descr *); ++extern int simple_fill_super(struct super_block *, unsigned long, struct tree_descr *); + extern int simple_pin_fs(struct file_system_type *, struct vfsmount **mount, int *count); + extern void simple_release_fs(struct vfsmount **mount, int *count); +