From: Greg Kroah-Hartman Date: Tue, 24 Sep 2013 14:43:36 +0000 (-0700) Subject: 3.11-stable patches X-Git-Tag: v3.0.97~17 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=3226d9c59dfe4476a59096dcd5ae7b6618e1d473;p=thirdparty%2Fkernel%2Fstable-queue.git 3.11-stable patches added patches: alsa-hda-add-toshiba-satellite-c870-to-msi-blacklist.patch alsa-hda-hdmi-fallback-to-alsa-allocation-when-selecting-ca.patch alsa-hda-re-setup-hdmi-pin-and-audio-infoframe-on-stream-switches.patch ath9k-always-clear-ps-filter-bit-on-new-assoc.patch ath9k-avoid-accessing-mrc-registers-on-single-chain-devices.patch ath9k-fix-rx-descriptor-related-race-condition.patch brcmsmac-fix-warning-caused-by-lack-of-calls-to-dma_mapping_error.patch ext4-fix-ext4_writepages-in-presence-of-truncate.patch ext4-move-test-whether-extent-to-map-can-be-extended-to-one-place.patch ext4-simplify-truncation-code-in-ext4_setattr.patch hid-correct-the-usb-ids-for-the-new-macbook-air-6.patch hid-fix-speedlink-vad-cezanne-support-for-some-devices.patch hid-kye-add-report-fixup-for-genius-gx-imperator-keyboard.patch hid-pantherlord-validate-output-report-details.patch hid-wiimote-work-around-broken-drm_kai-on-gen10.patch mac80211-ignore-e-csa-in-probe-response-frames.patch net-mvneta-properly-disable-hw-phy-polling-and-ensure-adjust_link-works.patch pinctrl-at91-fix-get_pullup-down-function-return.patch --- diff --git a/queue-3.11/alsa-hda-add-toshiba-satellite-c870-to-msi-blacklist.patch b/queue-3.11/alsa-hda-add-toshiba-satellite-c870-to-msi-blacklist.patch new file mode 100644 index 00000000000..c6d91fe63bb --- /dev/null +++ b/queue-3.11/alsa-hda-add-toshiba-satellite-c870-to-msi-blacklist.patch @@ -0,0 +1,31 @@ +From 83f72151352791836a1b9c1542614cc9bf71ac61 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Mon, 9 Sep 2013 10:20:48 +0200 +Subject: ALSA: hda - Add Toshiba Satellite C870 to MSI blacklist + +From: Takashi Iwai + +commit 83f72151352791836a1b9c1542614cc9bf71ac61 upstream. + +Toshiba Satellite C870 shows interrupt problems occasionally when +certain mixer controls like "Mic Switch" is toggled. This seems +worked around by not using MSI. + +Bugzilla: https://bugzilla.novell.com/show_bug.cgi?id=833585 +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/hda_intel.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/pci/hda/hda_intel.c ++++ b/sound/pci/hda/hda_intel.c +@@ -3376,6 +3376,7 @@ static struct snd_pci_quirk msi_black_li + SND_PCI_QUIRK(0x1043, 0x81f2, "ASUS", 0), /* Athlon64 X2 + nvidia */ + SND_PCI_QUIRK(0x1043, 0x81f6, "ASUS", 0), /* nvidia */ + SND_PCI_QUIRK(0x1043, 0x822d, "ASUS", 0), /* Athlon64 X2 + nvidia MCP55 */ ++ SND_PCI_QUIRK(0x1179, 0xfb44, "Toshiba Satellite C870", 0), /* AMD Hudson */ + SND_PCI_QUIRK(0x1849, 0x0888, "ASRock", 0), /* Athlon64 X2 + nvidia */ + SND_PCI_QUIRK(0xa0a0, 0x0575, "Aopen MZ915-M", 0), /* ICH6 */ + {} diff --git a/queue-3.11/alsa-hda-hdmi-fallback-to-alsa-allocation-when-selecting-ca.patch b/queue-3.11/alsa-hda-hdmi-fallback-to-alsa-allocation-when-selecting-ca.patch new file mode 100644 index 00000000000..6b4a9214539 --- /dev/null +++ b/queue-3.11/alsa-hda-hdmi-fallback-to-alsa-allocation-when-selecting-ca.patch @@ -0,0 +1,67 @@ +From 18e391862cceaf43ddb8eb5cca05e1a83abdebaa Mon Sep 17 00:00:00 2001 +From: Anssi Hannula +Date: Sun, 1 Sep 2013 14:36:47 +0300 +Subject: ALSA: hda - hdmi: Fallback to ALSA allocation when selecting CA + +From: Anssi Hannula + +commit 18e391862cceaf43ddb8eb5cca05e1a83abdebaa upstream. + +hdmi_channel_allocation() tries to find a HDMI channel allocation that +matches the number channels in the playback stream and contains only +speakers that the HDMI sink has reported as available via EDID. If no +such allocation is found, 0 (stereo audio) is used. + +Using CA 0 causes the audio causes the sink to discard everything except +the first two channels (front left and front right). + +However, the sink may be capable of receiving more channels than it has +speakers (and then perform downmix or discard the extra channels), in +which case it is preferable to use a CA that contains extra channels +than to use CA 0 which discards all the non-stereo channels. + +Additionally, it seems that HBR (HD) passthrough output does not work on +Intel HDMI codecs when CA is set to 0 (possibly the codec zeroes +channels not present in CA). This happens with all receivers that report +a 5.1 speaker mask since a HBR stream is carried on 8 channels to the +codec. + +Add a fallback in the CA selection so that the CA channel count at least +matches the stream channel count, even if the stream contains channels +not present in the sink speaker descriptor. + +Thanks to GrimGriefer at OpenELEC forums for discovering that changing +the sink speaker mask allowed HBR output. + +Reported-by: GrimGriefer +Reported-by: Ashecrow +Reported-by: Frank Zafka +Reported-by: Peter Frühberger +Signed-off-by: Anssi Hannula +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_hdmi.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +--- a/sound/pci/hda/patch_hdmi.c ++++ b/sound/pci/hda/patch_hdmi.c +@@ -553,6 +553,17 @@ static int hdmi_channel_allocation(struc + } + } + ++ if (!ca) { ++ /* if there was no match, select the regular ALSA channel ++ * allocation with the matching number of channels */ ++ for (i = 0; i < ARRAY_SIZE(channel_allocations); i++) { ++ if (channels == channel_allocations[i].channels) { ++ ca = channel_allocations[i].ca_index; ++ break; ++ } ++ } ++ } ++ + snd_print_channel_allocation(eld->info.spk_alloc, buf, sizeof(buf)); + snd_printdd("HDMI: select CA 0x%x for %d-channel allocation: %s\n", + ca, channels, buf); diff --git a/queue-3.11/alsa-hda-re-setup-hdmi-pin-and-audio-infoframe-on-stream-switches.patch b/queue-3.11/alsa-hda-re-setup-hdmi-pin-and-audio-infoframe-on-stream-switches.patch new file mode 100644 index 00000000000..fa1f4ca44dc --- /dev/null +++ b/queue-3.11/alsa-hda-re-setup-hdmi-pin-and-audio-infoframe-on-stream-switches.patch @@ -0,0 +1,144 @@ +From b054087dbacee30a9dddaef2c9a96312146be04e Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Mon, 2 Sep 2013 12:33:02 +0200 +Subject: ALSA: hda - Re-setup HDMI pin and audio infoframe on stream switches + +From: Takashi Iwai + +commit b054087dbacee30a9dddaef2c9a96312146be04e upstream. + +When the transcoder:port mapping on Haswell HDMI/DP audio is changed +during the stream playback, the sound gets lost. Typically this +problem is seen when the user switches the graphics mode from eDP+DP +to DP-only configuration, where CRTC 1 is used for DP in the former +while CRTC 0 is used for the latter. + +The graphics controller notifies the change via the normal ELD update +procedure, so we get the intrinsic event. For enabling the sound +again, the HDMI audio driver needs to reset the pin and set up the +audio infoframe again. + +This patch achieves it by: +- keep the current status of channels and info frame setup in per_pin + struct, +- check the reconnection in the intrinsic event handler, +- reset the pin and the re-invoke hdmi_setup_audio_infoframe() + accordingly. + +The hdmi_setup_audio_infoframe() function has been changed, too, so +that it can be invoked without passing the substream instance. + +The patch is mostly based on the work by Mengdong Lin. + +Cc: Mengdong Lin +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_hdmi.c | 41 +++++++++++++++++++++++++++++++---------- + 1 file changed, 31 insertions(+), 10 deletions(-) + +--- a/sound/pci/hda/patch_hdmi.c ++++ b/sound/pci/hda/patch_hdmi.c +@@ -67,6 +67,8 @@ struct hdmi_spec_per_pin { + struct delayed_work work; + struct snd_kcontrol *eld_ctl; + int repoll_count; ++ bool setup; /* the stream has been set up by prepare callback */ ++ int channels; /* current number of channels */ + bool non_pcm; + bool chmap_set; /* channel-map override by ALSA API? */ + unsigned char chmap[8]; /* ALSA API channel-map */ +@@ -868,18 +870,19 @@ static bool hdmi_infoframe_uptodate(stru + return true; + } + +-static void hdmi_setup_audio_infoframe(struct hda_codec *codec, int pin_idx, +- bool non_pcm, +- struct snd_pcm_substream *substream) ++static void hdmi_setup_audio_infoframe(struct hda_codec *codec, ++ struct hdmi_spec_per_pin *per_pin, ++ bool non_pcm) + { +- struct hdmi_spec *spec = codec->spec; +- struct hdmi_spec_per_pin *per_pin = get_pin(spec, pin_idx); + hda_nid_t pin_nid = per_pin->pin_nid; +- int channels = substream->runtime->channels; ++ int channels = per_pin->channels; + struct hdmi_eld *eld; + int ca; + union audio_infoframe ai; + ++ if (!channels) ++ return; ++ + eld = &per_pin->sink_eld; + if (!eld->monitor_present) + return; +@@ -1329,6 +1332,7 @@ static void hdmi_present_sense(struct hd + eld_changed = true; + } + if (update_eld) { ++ bool old_eld_valid = pin_eld->eld_valid; + pin_eld->eld_valid = eld->eld_valid; + eld_changed = pin_eld->eld_size != eld->eld_size || + memcmp(pin_eld->eld_buffer, eld->eld_buffer, +@@ -1338,6 +1342,18 @@ static void hdmi_present_sense(struct hd + eld->eld_size); + pin_eld->eld_size = eld->eld_size; + pin_eld->info = eld->info; ++ ++ /* Haswell-specific workaround: re-setup when the transcoder is ++ * changed during the stream playback ++ */ ++ if (codec->vendor_id == 0x80862807 && ++ eld->eld_valid && !old_eld_valid && per_pin->setup) { ++ snd_hda_codec_write(codec, pin_nid, 0, ++ AC_VERB_SET_AMP_GAIN_MUTE, ++ AMP_OUT_UNMUTE); ++ hdmi_setup_audio_infoframe(codec, per_pin, ++ per_pin->non_pcm); ++ } + } + mutex_unlock(&pin_eld->lock); + +@@ -1510,14 +1526,17 @@ static int generic_hdmi_playback_pcm_pre + hda_nid_t cvt_nid = hinfo->nid; + struct hdmi_spec *spec = codec->spec; + int pin_idx = hinfo_to_pin_index(spec, hinfo); +- hda_nid_t pin_nid = get_pin(spec, pin_idx)->pin_nid; ++ struct hdmi_spec_per_pin *per_pin = get_pin(spec, pin_idx); ++ hda_nid_t pin_nid = per_pin->pin_nid; + bool non_pcm; + + non_pcm = check_non_pcm_per_cvt(codec, cvt_nid); ++ per_pin->channels = substream->runtime->channels; ++ per_pin->setup = true; + + hdmi_set_channel_count(codec, cvt_nid, substream->runtime->channels); + +- hdmi_setup_audio_infoframe(codec, pin_idx, non_pcm, substream); ++ hdmi_setup_audio_infoframe(codec, per_pin, non_pcm); + + return hdmi_setup_stream(codec, cvt_nid, pin_nid, stream_tag, format); + } +@@ -1557,6 +1576,9 @@ static int hdmi_pcm_close(struct hda_pcm + snd_hda_spdif_ctls_unassign(codec, pin_idx); + per_pin->chmap_set = false; + memset(per_pin->chmap, 0, sizeof(per_pin->chmap)); ++ ++ per_pin->setup = false; ++ per_pin->channels = 0; + } + + return 0; +@@ -1692,8 +1714,7 @@ static int hdmi_chmap_ctl_put(struct snd + per_pin->chmap_set = true; + memcpy(per_pin->chmap, chmap, sizeof(chmap)); + if (prepared) +- hdmi_setup_audio_infoframe(codec, pin_idx, per_pin->non_pcm, +- substream); ++ hdmi_setup_audio_infoframe(codec, per_pin, per_pin->non_pcm); + + return 0; + } diff --git a/queue-3.11/ath9k-always-clear-ps-filter-bit-on-new-assoc.patch b/queue-3.11/ath9k-always-clear-ps-filter-bit-on-new-assoc.patch new file mode 100644 index 00000000000..da6046079a4 --- /dev/null +++ b/queue-3.11/ath9k-always-clear-ps-filter-bit-on-new-assoc.patch @@ -0,0 +1,30 @@ +From 026d5b07c03458f9c0ccd19c3850564a5409c325 Mon Sep 17 00:00:00 2001 +From: Felix Fietkau +Date: Tue, 6 Aug 2013 14:18:10 +0200 +Subject: ath9k: always clear ps filter bit on new assoc + +From: Felix Fietkau + +commit 026d5b07c03458f9c0ccd19c3850564a5409c325 upstream. + +Otherwise in some cases, EAPOL frames might be filtered during the +initial handshake, causing delays and assoc failures. + +Signed-off-by: Felix Fietkau +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/ath/ath9k/xmit.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/wireless/ath/ath9k/xmit.c ++++ b/drivers/net/wireless/ath/ath9k/xmit.c +@@ -2602,6 +2602,7 @@ void ath_tx_node_init(struct ath_softc * + for (acno = 0, ac = &an->ac[acno]; + acno < IEEE80211_NUM_ACS; acno++, ac++) { + ac->sched = false; ++ ac->clear_ps_filter = true; + ac->txq = sc->tx.txq_map[acno]; + INIT_LIST_HEAD(&ac->tid_q); + } diff --git a/queue-3.11/ath9k-avoid-accessing-mrc-registers-on-single-chain-devices.patch b/queue-3.11/ath9k-avoid-accessing-mrc-registers-on-single-chain-devices.patch new file mode 100644 index 00000000000..c90a5938cf9 --- /dev/null +++ b/queue-3.11/ath9k-avoid-accessing-mrc-registers-on-single-chain-devices.patch @@ -0,0 +1,32 @@ +From a1c781bb20ac1e03280e420abd47a99eb8bbdd3b Mon Sep 17 00:00:00 2001 +From: Felix Fietkau +Date: Tue, 13 Aug 2013 12:33:28 +0200 +Subject: ath9k: avoid accessing MRC registers on single-chain devices + +From: Felix Fietkau + +commit a1c781bb20ac1e03280e420abd47a99eb8bbdd3b upstream. + +They are not implemented, and accessing them might trigger errors + +Signed-off-by: Felix Fietkau +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/ath/ath9k/ar9003_phy.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/net/wireless/ath/ath9k/ar9003_phy.c ++++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.c +@@ -1173,6 +1173,10 @@ skip_ws_det: + * is_on == 0 means MRC CCK is OFF (more noise imm) + */ + bool is_on = param ? 1 : 0; ++ ++ if (ah->caps.rx_chainmask == 1) ++ break; ++ + REG_RMW_FIELD(ah, AR_PHY_MRC_CCK_CTRL, + AR_PHY_MRC_CCK_ENABLE, is_on); + REG_RMW_FIELD(ah, AR_PHY_MRC_CCK_CTRL, diff --git a/queue-3.11/ath9k-fix-rx-descriptor-related-race-condition.patch b/queue-3.11/ath9k-fix-rx-descriptor-related-race-condition.patch new file mode 100644 index 00000000000..857a80e7e46 --- /dev/null +++ b/queue-3.11/ath9k-fix-rx-descriptor-related-race-condition.patch @@ -0,0 +1,107 @@ +From e96542e55a2aacf4bdeccfe2f17b77c4895b4df2 Mon Sep 17 00:00:00 2001 +From: Felix Fietkau +Date: Sat, 10 Aug 2013 15:59:15 +0200 +Subject: ath9k: fix rx descriptor related race condition + +From: Felix Fietkau + +commit e96542e55a2aacf4bdeccfe2f17b77c4895b4df2 upstream. + +Similar to a race condition that exists in the tx path, the hardware +might re-read the 'next' pointer of a descriptor of the last completed +frame. This only affects non-EDMA (pre-AR93xx) devices. + +To deal with this race, defer clearing and re-linking a completed rx +descriptor until the next one has been processed. + +Signed-off-by: Felix Fietkau +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/ath/ath9k/ath9k.h | 5 +---- + drivers/net/wireless/ath/ath9k/recv.c | 17 +++++++++++++---- + 2 files changed, 14 insertions(+), 8 deletions(-) + +--- a/drivers/net/wireless/ath/ath9k/ath9k.h ++++ b/drivers/net/wireless/ath/ath9k/ath9k.h +@@ -79,10 +79,6 @@ struct ath_config { + sizeof(struct ath_buf_state)); \ + } while (0) + +-#define ATH_RXBUF_RESET(_bf) do { \ +- (_bf)->bf_stale = false; \ +- } while (0) +- + /** + * enum buffer_type - Buffer type flags + * +@@ -317,6 +313,7 @@ struct ath_rx { + struct ath_descdma rxdma; + struct ath_rx_edma rx_edma[ATH9K_RX_QUEUE_MAX]; + ++ struct ath_buf *buf_hold; + struct sk_buff *frag; + + u32 ampdu_ref; +--- a/drivers/net/wireless/ath/ath9k/recv.c ++++ b/drivers/net/wireless/ath/ath9k/recv.c +@@ -42,8 +42,6 @@ static void ath_rx_buf_link(struct ath_s + struct ath_desc *ds; + struct sk_buff *skb; + +- ATH_RXBUF_RESET(bf); +- + ds = bf->bf_desc; + ds->ds_link = 0; /* link to null */ + ds->ds_data = bf->bf_buf_addr; +@@ -70,6 +68,14 @@ static void ath_rx_buf_link(struct ath_s + sc->rx.rxlink = &ds->ds_link; + } + ++static void ath_rx_buf_relink(struct ath_softc *sc, struct ath_buf *bf) ++{ ++ if (sc->rx.buf_hold) ++ ath_rx_buf_link(sc, sc->rx.buf_hold); ++ ++ sc->rx.buf_hold = bf; ++} ++ + static void ath_setdefantenna(struct ath_softc *sc, u32 antenna) + { + /* XXX block beacon interrupts */ +@@ -117,7 +123,6 @@ static bool ath_rx_edma_buf_link(struct + + skb = bf->bf_mpdu; + +- ATH_RXBUF_RESET(bf); + memset(skb->data, 0, ah->caps.rx_status_len); + dma_sync_single_for_device(sc->dev, bf->bf_buf_addr, + ah->caps.rx_status_len, DMA_TO_DEVICE); +@@ -432,6 +437,7 @@ int ath_startrecv(struct ath_softc *sc) + if (list_empty(&sc->rx.rxbuf)) + goto start_recv; + ++ sc->rx.buf_hold = NULL; + sc->rx.rxlink = NULL; + list_for_each_entry_safe(bf, tbf, &sc->rx.rxbuf, list) { + ath_rx_buf_link(sc, bf); +@@ -677,6 +683,9 @@ static struct ath_buf *ath_get_next_rx_b + } + + bf = list_first_entry(&sc->rx.rxbuf, struct ath_buf, list); ++ if (bf == sc->rx.buf_hold) ++ return NULL; ++ + ds = bf->bf_desc; + + /* +@@ -1375,7 +1384,7 @@ requeue: + if (edma) { + ath_rx_edma_buf_link(sc, qtype); + } else { +- ath_rx_buf_link(sc, bf); ++ ath_rx_buf_relink(sc, bf); + ath9k_hw_rxena(ah); + } + } while (1); diff --git a/queue-3.11/brcmsmac-fix-warning-caused-by-lack-of-calls-to-dma_mapping_error.patch b/queue-3.11/brcmsmac-fix-warning-caused-by-lack-of-calls-to-dma_mapping_error.patch new file mode 100644 index 00000000000..74f99b515b9 --- /dev/null +++ b/queue-3.11/brcmsmac-fix-warning-caused-by-lack-of-calls-to-dma_mapping_error.patch @@ -0,0 +1,103 @@ +From 67d0cf50bd32b66eab709871714e55725ee30ce4 Mon Sep 17 00:00:00 2001 +From: "John W. Linville" +Date: Fri, 9 Aug 2013 13:36:21 -0400 +Subject: brcmsmac: Fix WARNING caused by lack of calls to dma_mapping_error() + +From: "John W. Linville" + +commit 67d0cf50bd32b66eab709871714e55725ee30ce4 upstream. + +The driver fails to check the results of DMA mapping in twp places, +which results in the following warning: + +[ 28.078515] ------------[ cut here ]------------ +[ 28.078529] WARNING: at lib/dma-debug.c:937 check_unmap+0x47e/0x930() +[ 28.078533] bcma-pci-bridge 0000:0e:00.0: DMA-API: device driver failed to check map error[device address=0x00000000b5d60d6c] [size=1876 bytes] [mapped as + single] +[ 28.078536] Modules linked in: bnep bluetooth vboxpci(O) vboxnetadp(O) vboxnetflt(O) vboxdrv(O) ipv6 b43 brcmsmac rtl8192cu rtl8192c_common rtlwifi mac802 +11 brcmutil cfg80211 snd_hda_codec_conexant rng_core snd_hda_intel kvm_amd snd_hda_codec ssb kvm mmc_core snd_pcm snd_seq snd_timer snd_seq_device snd k8temp + cordic joydev serio_raw hwmon sr_mod sg pcmcia pcmcia_core soundcore cdrom i2c_nforce2 i2c_core forcedeth bcma snd_page_alloc autofs4 ext4 jbd2 mbcache crc1 +6 scsi_dh_alua scsi_dh_hp_sw scsi_dh_rdac scsi_dh_emc scsi_dh ata_generic pata_amd +[ 28.078602] CPU: 1 PID: 2570 Comm: NetworkManager Tainted: G O 3.10.0-rc7-wl+ #42 +[ 28.078605] Hardware name: Hewlett-Packard HP Pavilion dv2700 Notebook PC/30D6, BIOS F.27 11/27/2008 +[ 28.078607] 0000000000000009 ffff8800bbb03ad8 ffffffff8144f898 ffff8800bbb03b18 +[ 28.078612] ffffffff8103e1eb 0000000000000002 ffff8800b719f480 ffff8800b7b9c010 +[ 28.078617] ffffffff824204c0 ffffffff81754d57 0000000000000754 ffff8800bbb03b78 +[ 28.078622] Call Trace: +[ 28.078624] [] dump_stack+0x19/0x1b +[ 28.078634] [] warn_slowpath_common+0x6b/0xa0 +[ 28.078638] [] warn_slowpath_fmt+0x41/0x50 +[ 28.078650] [] check_unmap+0x47e/0x930 +[ 28.078655] [] debug_dma_unmap_page+0x5c/0x70 +[ 28.078679] [] dma64_getnextrxp+0x10c/0x190 [brcmsmac] +[ 28.078691] [] dma_rx+0x62/0x240 [brcmsmac] +[ 28.078707] [] brcms_c_dpc+0x211/0x9d0 [brcmsmac] +[ 28.078717] [] ? brcms_dpc+0x27/0xf0 [brcmsmac] +[ 28.078731] [] brcms_dpc+0x47/0xf0 [brcmsmac] +[ 28.078736] [] tasklet_action+0x6c/0xf0 +--snip-- +[ 28.078974] [] SyS_sendmsg+0xd/0x20 +[ 28.078979] [] tracesys+0xdd/0xe2 +[ 28.078982] ---[ end trace 6164d1a08148e9c8 ]--- +[ 28.078984] Mapped at: +[ 28.078985] [] debug_dma_map_page+0x9d/0x150 +[ 28.078989] [] dma_rxfill+0x102/0x3d0 [brcmsmac] +[ 28.079001] [] brcms_c_init+0x87d/0x1100 [brcmsmac] +[ 28.079010] [] brcms_init+0x21/0x30 [brcmsmac] +[ 28.079018] [] brcms_c_up+0x150/0x430 [brcmsmac] + +As the patch adds a new failure mechanism to dma_rxfill(). When I changed the +comment at the start of the routine to add that information, I also polished +the wording. + +Signed-off-by: Larry Finger +Cc: Brett Rudley +Cc: Franky (Zhenhui) Lin +Cc: Hante Meuleman +Cc: brcm80211-dev-list@broadcom.com +Acked-by: Arend van Spriel +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/brcm80211/brcmsmac/dma.c | 15 +++++++++++---- + 1 file changed, 11 insertions(+), 4 deletions(-) + +--- a/drivers/net/wireless/brcm80211/brcmsmac/dma.c ++++ b/drivers/net/wireless/brcm80211/brcmsmac/dma.c +@@ -1015,9 +1015,10 @@ static bool dma64_txidle(struct dma_info + + /* + * post receive buffers +- * return false is refill failed completely and ring is empty this will stall +- * the rx dma and user might want to call rxfill again asap. This unlikely +- * happens on memory-rich NIC, but often on memory-constrained dongle ++ * Return false if refill failed completely or dma mapping failed. The ring ++ * is empty, which will stall the rx dma and user might want to call rxfill ++ * again asap. This is unlikely to happen on a memory-rich NIC, but often on ++ * memory-constrained dongle. + */ + bool dma_rxfill(struct dma_pub *pub) + { +@@ -1078,6 +1079,8 @@ bool dma_rxfill(struct dma_pub *pub) + + pa = dma_map_single(di->dmadev, p->data, di->rxbufsize, + DMA_FROM_DEVICE); ++ if (dma_mapping_error(di->dmadev, pa)) ++ return false; + + /* save the free packet pointer */ + di->rxp[rxout] = p; +@@ -1284,7 +1287,11 @@ static void dma_txenq(struct dma_info *d + + /* get physical address of buffer start */ + pa = dma_map_single(di->dmadev, data, len, DMA_TO_DEVICE); +- ++ /* if mapping failed, free skb */ ++ if (dma_mapping_error(di->dmadev, pa)) { ++ brcmu_pkt_buf_free_skb(p); ++ return; ++ } + /* With a DMA segment list, Descriptor table is filled + * using the segment list instead of looping over + * buffers in multi-chain DMA. Therefore, EOF for SGLIST diff --git a/queue-3.11/ext4-fix-ext4_writepages-in-presence-of-truncate.patch b/queue-3.11/ext4-fix-ext4_writepages-in-presence-of-truncate.patch new file mode 100644 index 00000000000..8793dd6357a --- /dev/null +++ b/queue-3.11/ext4-fix-ext4_writepages-in-presence-of-truncate.patch @@ -0,0 +1,202 @@ +From 5f1132b2ba8c873f25982cf45917e8455fb6c962 Mon Sep 17 00:00:00 2001 +From: Jan Kara +Date: Sat, 17 Aug 2013 10:02:33 -0400 +Subject: ext4: fix ext4_writepages() in presence of truncate + +From: Jan Kara + +commit 5f1132b2ba8c873f25982cf45917e8455fb6c962 upstream. + +Inode size can arbitrarily change while writeback is in progress. When +ext4_writepages() has prepared a long extent for mapping and truncate +then reduces i_size, mpage_map_and_submit_buffers() will always map just +one buffer in a page instead of all of them due to lblk < blocks check. +So we end up not using all blocks we've allocated (thus leaking them) +and also delalloc accounting goes wrong manifesting as a warning like: + +ext4_da_release_space:1333: ext4_da_release_space: ino 12, to_free 1 +with only 0 reserved data blocks + +Note that the problem can happen only when blocksize < pagesize because +otherwise we have only a single buffer in the page. + +Fix the problem by removing the size check from the mapping loop. We +have an extent allocated so we have to use it all before checking for +i_size. We also rename add_page_bufs_to_extent() to +mpage_process_page_bufs() and make that function submit the page for IO +if all buffers (upto EOF) in it are mapped. + +Reported-by: Dave Jones +Reported-by: Zheng Liu +Signed-off-by: Jan Kara +Signed-off-by: "Theodore Ts'o" +Signed-off-by: Greg Kroah-Hartman + +--- + fs/ext4/inode.c | 107 ++++++++++++++++++++++++++++++++++---------------------- + 1 file changed, 66 insertions(+), 41 deletions(-) + +--- a/fs/ext4/inode.c ++++ b/fs/ext4/inode.c +@@ -1890,6 +1890,26 @@ static int ext4_writepage(struct page *p + return ret; + } + ++static int mpage_submit_page(struct mpage_da_data *mpd, struct page *page) ++{ ++ int len; ++ loff_t size = i_size_read(mpd->inode); ++ int err; ++ ++ BUG_ON(page->index != mpd->first_page); ++ if (page->index == size >> PAGE_CACHE_SHIFT) ++ len = size & ~PAGE_CACHE_MASK; ++ else ++ len = PAGE_CACHE_SIZE; ++ clear_page_dirty_for_io(page); ++ err = ext4_bio_write_page(&mpd->io_submit, page, len, mpd->wbc); ++ if (!err) ++ mpd->wbc->nr_to_write--; ++ mpd->first_page++; ++ ++ return err; ++} ++ + #define BH_FLAGS ((1 << BH_Unwritten) | (1 << BH_Delay)) + + /* +@@ -1948,12 +1968,29 @@ static bool mpage_add_bh_to_extent(struc + return false; + } + +-static bool add_page_bufs_to_extent(struct mpage_da_data *mpd, +- struct buffer_head *head, +- struct buffer_head *bh, +- ext4_lblk_t lblk) ++/* ++ * mpage_process_page_bufs - submit page buffers for IO or add them to extent ++ * ++ * @mpd - extent of blocks for mapping ++ * @head - the first buffer in the page ++ * @bh - buffer we should start processing from ++ * @lblk - logical number of the block in the file corresponding to @bh ++ * ++ * Walk through page buffers from @bh upto @head (exclusive) and either submit ++ * the page for IO if all buffers in this page were mapped and there's no ++ * accumulated extent of buffers to map or add buffers in the page to the ++ * extent of buffers to map. The function returns 1 if the caller can continue ++ * by processing the next page, 0 if it should stop adding buffers to the ++ * extent to map because we cannot extend it anymore. It can also return value ++ * < 0 in case of error during IO submission. ++ */ ++static int mpage_process_page_bufs(struct mpage_da_data *mpd, ++ struct buffer_head *head, ++ struct buffer_head *bh, ++ ext4_lblk_t lblk) + { + struct inode *inode = mpd->inode; ++ int err; + ext4_lblk_t blocks = (i_size_read(inode) + (1 << inode->i_blkbits) - 1) + >> inode->i_blkbits; + +@@ -1963,32 +2000,18 @@ static bool add_page_bufs_to_extent(stru + if (lblk >= blocks || !mpage_add_bh_to_extent(mpd, lblk, bh)) { + /* Found extent to map? */ + if (mpd->map.m_len) +- return false; ++ return 0; + /* Everything mapped so far and we hit EOF */ +- return true; ++ break; + } + } while (lblk++, (bh = bh->b_this_page) != head); +- return true; +-} +- +-static int mpage_submit_page(struct mpage_da_data *mpd, struct page *page) +-{ +- int len; +- loff_t size = i_size_read(mpd->inode); +- int err; +- +- BUG_ON(page->index != mpd->first_page); +- if (page->index == size >> PAGE_CACHE_SHIFT) +- len = size & ~PAGE_CACHE_MASK; +- else +- len = PAGE_CACHE_SIZE; +- clear_page_dirty_for_io(page); +- err = ext4_bio_write_page(&mpd->io_submit, page, len, mpd->wbc); +- if (!err) +- mpd->wbc->nr_to_write--; +- mpd->first_page++; +- +- return err; ++ /* So far everything mapped? Submit the page for IO. */ ++ if (mpd->map.m_len == 0) { ++ err = mpage_submit_page(mpd, head->b_page); ++ if (err < 0) ++ return err; ++ } ++ return lblk < blocks; + } + + /* +@@ -2012,8 +2035,6 @@ static int mpage_map_and_submit_buffers( + struct inode *inode = mpd->inode; + struct buffer_head *head, *bh; + int bpp_bits = PAGE_CACHE_SHIFT - inode->i_blkbits; +- ext4_lblk_t blocks = (i_size_read(inode) + (1 << inode->i_blkbits) - 1) +- >> inode->i_blkbits; + pgoff_t start, end; + ext4_lblk_t lblk; + sector_t pblock; +@@ -2048,18 +2069,26 @@ static int mpage_map_and_submit_buffers( + */ + mpd->map.m_len = 0; + mpd->map.m_flags = 0; +- add_page_bufs_to_extent(mpd, head, bh, +- lblk); ++ /* ++ * FIXME: If dioread_nolock supports ++ * blocksize < pagesize, we need to make ++ * sure we add size mapped so far to ++ * io_end->size as the following call ++ * can submit the page for IO. ++ */ ++ err = mpage_process_page_bufs(mpd, head, ++ bh, lblk); + pagevec_release(&pvec); +- return 0; ++ if (err > 0) ++ err = 0; ++ return err; + } + if (buffer_delay(bh)) { + clear_buffer_delay(bh); + bh->b_blocknr = pblock++; + } + clear_buffer_unwritten(bh); +- } while (++lblk < blocks && +- (bh = bh->b_this_page) != head); ++ } while (lblk++, (bh = bh->b_this_page) != head); + + /* + * FIXME: This is going to break if dioread_nolock +@@ -2328,14 +2357,10 @@ static int mpage_prepare_extent_to_map(s + lblk = ((ext4_lblk_t)page->index) << + (PAGE_CACHE_SHIFT - blkbits); + head = page_buffers(page); +- if (!add_page_bufs_to_extent(mpd, head, head, lblk)) ++ err = mpage_process_page_bufs(mpd, head, head, lblk); ++ if (err <= 0) + goto out; +- /* So far everything mapped? Submit the page for IO. */ +- if (mpd->map.m_len == 0) { +- err = mpage_submit_page(mpd, page); +- if (err < 0) +- goto out; +- } ++ err = 0; + + /* + * Accumulated enough dirty pages? This doesn't apply diff --git a/queue-3.11/ext4-move-test-whether-extent-to-map-can-be-extended-to-one-place.patch b/queue-3.11/ext4-move-test-whether-extent-to-map-can-be-extended-to-one-place.patch new file mode 100644 index 00000000000..2a2d3c1290d --- /dev/null +++ b/queue-3.11/ext4-move-test-whether-extent-to-map-can-be-extended-to-one-place.patch @@ -0,0 +1,108 @@ +From 09930042a2e94cf8ee79d22943915612c1e4ba51 Mon Sep 17 00:00:00 2001 +From: Jan Kara +Date: Sat, 17 Aug 2013 09:57:56 -0400 +Subject: ext4: move test whether extent to map can be extended to one place + +From: Jan Kara + +commit 09930042a2e94cf8ee79d22943915612c1e4ba51 upstream. + +Currently the logic whether the current buffer can be added to an extent +of buffers to map is split between mpage_add_bh_to_extent() and +add_page_bufs_to_extent(). Move the whole logic to +mpage_add_bh_to_extent() which makes things a bit more straightforward +and make following i_size fixes easier. + +Signed-off-by: Jan Kara +Signed-off-by: "Theodore Ts'o" +Signed-off-by: Greg Kroah-Hartman + +--- + fs/ext4/inode.c | 49 +++++++++++++++++++++++++++++-------------------- + 1 file changed, 29 insertions(+), 20 deletions(-) + +--- a/fs/ext4/inode.c ++++ b/fs/ext4/inode.c +@@ -1904,34 +1904,48 @@ static int ext4_writepage(struct page *p + * + * @mpd - extent of blocks + * @lblk - logical number of the block in the file +- * @b_state - b_state of the buffer head added ++ * @bh - buffer head we want to add to the extent + * +- * the function is used to collect contig. blocks in same state ++ * The function is used to collect contig. blocks in the same state. If the ++ * buffer doesn't require mapping for writeback and we haven't started the ++ * extent of buffers to map yet, the function returns 'true' immediately - the ++ * caller can write the buffer right away. Otherwise the function returns true ++ * if the block has been added to the extent, false if the block couldn't be ++ * added. + */ +-static int mpage_add_bh_to_extent(struct mpage_da_data *mpd, ext4_lblk_t lblk, +- unsigned long b_state) ++static bool mpage_add_bh_to_extent(struct mpage_da_data *mpd, ext4_lblk_t lblk, ++ struct buffer_head *bh) + { + struct ext4_map_blocks *map = &mpd->map; + +- /* Don't go larger than mballoc is willing to allocate */ +- if (map->m_len >= MAX_WRITEPAGES_EXTENT_LEN) +- return 0; ++ /* Buffer that doesn't need mapping for writeback? */ ++ if (!buffer_dirty(bh) || !buffer_mapped(bh) || ++ (!buffer_delay(bh) && !buffer_unwritten(bh))) { ++ /* So far no extent to map => we write the buffer right away */ ++ if (map->m_len == 0) ++ return true; ++ return false; ++ } + + /* First block in the extent? */ + if (map->m_len == 0) { + map->m_lblk = lblk; + map->m_len = 1; +- map->m_flags = b_state & BH_FLAGS; +- return 1; ++ map->m_flags = bh->b_state & BH_FLAGS; ++ return true; + } + ++ /* Don't go larger than mballoc is willing to allocate */ ++ if (map->m_len >= MAX_WRITEPAGES_EXTENT_LEN) ++ return false; ++ + /* Can we merge the block to our big extent? */ + if (lblk == map->m_lblk + map->m_len && +- (b_state & BH_FLAGS) == map->m_flags) { ++ (bh->b_state & BH_FLAGS) == map->m_flags) { + map->m_len++; +- return 1; ++ return true; + } +- return 0; ++ return false; + } + + static bool add_page_bufs_to_extent(struct mpage_da_data *mpd, +@@ -1946,18 +1960,13 @@ static bool add_page_bufs_to_extent(stru + do { + BUG_ON(buffer_locked(bh)); + +- if (!buffer_dirty(bh) || !buffer_mapped(bh) || +- (!buffer_delay(bh) && !buffer_unwritten(bh)) || +- lblk >= blocks) { ++ if (lblk >= blocks || !mpage_add_bh_to_extent(mpd, lblk, bh)) { + /* Found extent to map? */ + if (mpd->map.m_len) + return false; +- if (lblk >= blocks) +- return true; +- continue; ++ /* Everything mapped so far and we hit EOF */ ++ return true; + } +- if (!mpage_add_bh_to_extent(mpd, lblk, bh->b_state)) +- return false; + } while (lblk++, (bh = bh->b_this_page) != head); + return true; + } diff --git a/queue-3.11/ext4-simplify-truncation-code-in-ext4_setattr.patch b/queue-3.11/ext4-simplify-truncation-code-in-ext4_setattr.patch new file mode 100644 index 00000000000..5d469016a9a --- /dev/null +++ b/queue-3.11/ext4-simplify-truncation-code-in-ext4_setattr.patch @@ -0,0 +1,155 @@ +From 5208386c501276df18fee464e21d3c58d2d79517 Mon Sep 17 00:00:00 2001 +From: Jan Kara +Date: Sat, 17 Aug 2013 10:07:17 -0400 +Subject: ext4: simplify truncation code in ext4_setattr() + +From: Jan Kara + +commit 5208386c501276df18fee464e21d3c58d2d79517 upstream. + +Merge conditions in ext4_setattr() handling inode size changes, also +move ext4_begin_ordered_truncate() call somewhat earlier because it +simplifies error recovery in case of failure. Also add error handling in +case i_disksize update fails. + +Signed-off-by: Jan Kara +Signed-off-by: "Theodore Ts'o" +Signed-off-by: Greg Kroah-Hartman + +--- + fs/ext4/inode.c | 109 +++++++++++++++++++++++++------------------------------- + 1 file changed, 49 insertions(+), 60 deletions(-) + +--- a/fs/ext4/inode.c ++++ b/fs/ext4/inode.c +@@ -4600,7 +4600,9 @@ int ext4_setattr(struct dentry *dentry, + ext4_journal_stop(handle); + } + +- if (attr->ia_valid & ATTR_SIZE) { ++ if (attr->ia_valid & ATTR_SIZE && attr->ia_size != inode->i_size) { ++ handle_t *handle; ++ loff_t oldsize = inode->i_size; + + if (!(ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS))) { + struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb); +@@ -4608,73 +4610,60 @@ int ext4_setattr(struct dentry *dentry, + if (attr->ia_size > sbi->s_bitmap_maxbytes) + return -EFBIG; + } +- } +- +- if (S_ISREG(inode->i_mode) && +- attr->ia_valid & ATTR_SIZE && +- (attr->ia_size < inode->i_size)) { +- handle_t *handle; +- +- handle = ext4_journal_start(inode, EXT4_HT_INODE, 3); +- if (IS_ERR(handle)) { +- error = PTR_ERR(handle); +- goto err_out; +- } +- if (ext4_handle_valid(handle)) { +- error = ext4_orphan_add(handle, inode); +- orphan = 1; +- } +- EXT4_I(inode)->i_disksize = attr->ia_size; +- rc = ext4_mark_inode_dirty(handle, inode); +- if (!error) +- error = rc; +- ext4_journal_stop(handle); +- +- if (ext4_should_order_data(inode)) { +- error = ext4_begin_ordered_truncate(inode, ++ if (S_ISREG(inode->i_mode) && ++ (attr->ia_size < inode->i_size)) { ++ if (ext4_should_order_data(inode)) { ++ error = ext4_begin_ordered_truncate(inode, + attr->ia_size); +- if (error) { +- /* Do as much error cleanup as possible */ +- handle = ext4_journal_start(inode, +- EXT4_HT_INODE, 3); +- if (IS_ERR(handle)) { +- ext4_orphan_del(NULL, inode); ++ if (error) + goto err_out; +- } +- ext4_orphan_del(handle, inode); +- orphan = 0; +- ext4_journal_stop(handle); ++ } ++ handle = ext4_journal_start(inode, EXT4_HT_INODE, 3); ++ if (IS_ERR(handle)) { ++ error = PTR_ERR(handle); ++ goto err_out; ++ } ++ if (ext4_handle_valid(handle)) { ++ error = ext4_orphan_add(handle, inode); ++ orphan = 1; ++ } ++ EXT4_I(inode)->i_disksize = attr->ia_size; ++ rc = ext4_mark_inode_dirty(handle, inode); ++ if (!error) ++ error = rc; ++ ext4_journal_stop(handle); ++ if (error) { ++ ext4_orphan_del(NULL, inode); + goto err_out; + } + } +- } +- +- if (attr->ia_valid & ATTR_SIZE) { +- if (attr->ia_size != inode->i_size) { +- loff_t oldsize = inode->i_size; + +- i_size_write(inode, attr->ia_size); +- /* +- * Blocks are going to be removed from the inode. Wait +- * for dio in flight. Temporarily disable +- * dioread_nolock to prevent livelock. +- */ +- if (orphan) { +- if (!ext4_should_journal_data(inode)) { +- ext4_inode_block_unlocked_dio(inode); +- inode_dio_wait(inode); +- ext4_inode_resume_unlocked_dio(inode); +- } else +- ext4_wait_for_tail_page_commit(inode); +- } +- /* +- * Truncate pagecache after we've waited for commit +- * in data=journal mode to make pages freeable. +- */ +- truncate_pagecache(inode, oldsize, inode->i_size); ++ i_size_write(inode, attr->ia_size); ++ /* ++ * Blocks are going to be removed from the inode. Wait ++ * for dio in flight. Temporarily disable ++ * dioread_nolock to prevent livelock. ++ */ ++ if (orphan) { ++ if (!ext4_should_journal_data(inode)) { ++ ext4_inode_block_unlocked_dio(inode); ++ inode_dio_wait(inode); ++ ext4_inode_resume_unlocked_dio(inode); ++ } else ++ ext4_wait_for_tail_page_commit(inode); + } +- ext4_truncate(inode); ++ /* ++ * Truncate pagecache after we've waited for commit ++ * in data=journal mode to make pages freeable. ++ */ ++ truncate_pagecache(inode, oldsize, inode->i_size); + } ++ /* ++ * We want to call ext4_truncate() even if attr->ia_size == ++ * inode->i_size for cases like truncation of fallocated space ++ */ ++ if (attr->ia_valid & ATTR_SIZE) ++ ext4_truncate(inode); + + if (!rc) { + setattr_copy(inode, attr); diff --git a/queue-3.11/hid-correct-the-usb-ids-for-the-new-macbook-air-6.patch b/queue-3.11/hid-correct-the-usb-ids-for-the-new-macbook-air-6.patch new file mode 100644 index 00000000000..59f75432b37 --- /dev/null +++ b/queue-3.11/hid-correct-the-usb-ids-for-the-new-macbook-air-6.patch @@ -0,0 +1,57 @@ +From 8c89cc17b91992845bd635813cd162fe8dfcec6e Mon Sep 17 00:00:00 2001 +From: Henrik Rydberg +Date: Sun, 1 Sep 2013 15:31:44 +0200 +Subject: HID: Correct the USB IDs for the new Macbook Air 6 + +From: Henrik Rydberg + +commit 8c89cc17b91992845bd635813cd162fe8dfcec6e upstream. + +A recent patch (9d9a04ee) added support for the new machine, but got +the sequence of USB ids wrong. Reports from both Ian and Linus T show +that the 0x0291 id is for ISO, not ANSI, which should have the missing +number 0x0290. This patchs moves the three numbers accordingly, fixing +the problem. + +Reported-and-tested-by: Ian Munsie +Tested-by: Linus G Thiel +Signed-off-by: Henrik Rydberg +Acked-by: Dmitry Torokhov +Signed-off-by: Jiri Kosina +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hid/hid-ids.h | 6 +++--- + drivers/input/mouse/bcm5974.c | 6 +++--- + 2 files changed, 6 insertions(+), 6 deletions(-) + +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -135,9 +135,9 @@ + #define USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_JIS 0x023b + #define USB_DEVICE_ID_APPLE_ALU_WIRELESS_2011_ANSI 0x0255 + #define USB_DEVICE_ID_APPLE_ALU_WIRELESS_2011_ISO 0x0256 +-#define USB_DEVICE_ID_APPLE_WELLSPRING8_ANSI 0x0291 +-#define USB_DEVICE_ID_APPLE_WELLSPRING8_ISO 0x0292 +-#define USB_DEVICE_ID_APPLE_WELLSPRING8_JIS 0x0293 ++#define USB_DEVICE_ID_APPLE_WELLSPRING8_ANSI 0x0290 ++#define USB_DEVICE_ID_APPLE_WELLSPRING8_ISO 0x0291 ++#define USB_DEVICE_ID_APPLE_WELLSPRING8_JIS 0x0292 + #define USB_DEVICE_ID_APPLE_FOUNTAIN_TP_ONLY 0x030a + #define USB_DEVICE_ID_APPLE_GEYSER1_TP_ONLY 0x030b + #define USB_DEVICE_ID_APPLE_IRCONTROL 0x8240 +--- a/drivers/input/mouse/bcm5974.c ++++ b/drivers/input/mouse/bcm5974.c +@@ -89,9 +89,9 @@ + #define USB_DEVICE_ID_APPLE_WELLSPRING7A_ISO 0x025a + #define USB_DEVICE_ID_APPLE_WELLSPRING7A_JIS 0x025b + /* MacbookAir6,2 (unibody, June 2013) */ +-#define USB_DEVICE_ID_APPLE_WELLSPRING8_ANSI 0x0291 +-#define USB_DEVICE_ID_APPLE_WELLSPRING8_ISO 0x0292 +-#define USB_DEVICE_ID_APPLE_WELLSPRING8_JIS 0x0293 ++#define USB_DEVICE_ID_APPLE_WELLSPRING8_ANSI 0x0290 ++#define USB_DEVICE_ID_APPLE_WELLSPRING8_ISO 0x0291 ++#define USB_DEVICE_ID_APPLE_WELLSPRING8_JIS 0x0292 + + #define BCM5974_DEVICE(prod) { \ + .match_flags = (USB_DEVICE_ID_MATCH_DEVICE | \ diff --git a/queue-3.11/hid-fix-speedlink-vad-cezanne-support-for-some-devices.patch b/queue-3.11/hid-fix-speedlink-vad-cezanne-support-for-some-devices.patch new file mode 100644 index 00000000000..0fd99a76bed --- /dev/null +++ b/queue-3.11/hid-fix-speedlink-vad-cezanne-support-for-some-devices.patch @@ -0,0 +1,52 @@ +From 06bb5219118fb098f4b0c7dcb484b28a52bf1c14 Mon Sep 17 00:00:00 2001 +From: Stefan Kriwanek +Date: Sun, 25 Aug 2013 10:46:13 +0200 +Subject: HID: Fix Speedlink VAD Cezanne support for some devices + +From: Stefan Kriwanek + +commit 06bb5219118fb098f4b0c7dcb484b28a52bf1c14 upstream. + +Some devices of the "Speedlink VAD Cezanne" model need more aggressive fixing +than already done. + +I made sure through testing that this patch would not interfere with the proper +working of a device that is bug-free. (The driver drops EV_REL events with +abs(val) >= 256, which are not achievable even on the highest laser resolution +hardware setting.) + +Signed-off-by: Stefan Kriwanek +Signed-off-by: Jiri Kosina +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hid/hid-speedlink.c | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +--- a/drivers/hid/hid-speedlink.c ++++ b/drivers/hid/hid-speedlink.c +@@ -3,7 +3,7 @@ + * Fixes "jumpy" cursor and removes nonexistent keyboard LEDS from + * the HID descriptor. + * +- * Copyright (c) 2011 Stefan Kriwanek ++ * Copyright (c) 2011, 2013 Stefan Kriwanek + */ + + /* +@@ -46,8 +46,13 @@ static int speedlink_event(struct hid_de + struct hid_usage *usage, __s32 value) + { + /* No other conditions due to usage_table. */ +- /* Fix "jumpy" cursor (invalid events sent by device). */ +- if (value == 256) ++ ++ /* This fixes the "jumpy" cursor occuring due to invalid events sent ++ * by the device. Some devices only send them with value==+256, others ++ * don't. However, catching abs(value)>=256 is restrictive enough not ++ * to interfere with devices that were bug-free (has been tested). ++ */ ++ if (abs(value) >= 256) + return 1; + /* Drop useless distance 0 events (on button clicks etc.) as well */ + if (value == 0) diff --git a/queue-3.11/hid-kye-add-report-fixup-for-genius-gx-imperator-keyboard.patch b/queue-3.11/hid-kye-add-report-fixup-for-genius-gx-imperator-keyboard.patch new file mode 100644 index 00000000000..e4a4457a2d8 --- /dev/null +++ b/queue-3.11/hid-kye-add-report-fixup-for-genius-gx-imperator-keyboard.patch @@ -0,0 +1,115 @@ +From 0adb9c2c5ed42f199cb2a630c37d18dee385fae2 Mon Sep 17 00:00:00 2001 +From: Benjamin Tissoires +Date: Mon, 15 Jul 2013 10:12:18 +0200 +Subject: HID: kye: Add report fixup for Genius Gx Imperator Keyboard + +From: Benjamin Tissoires + +commit 0adb9c2c5ed42f199cb2a630c37d18dee385fae2 upstream. + +Genius Gx Imperator Keyboard presents the same problem in its report +descriptors than Genius Gila Gaming Mouse. +Use the same fixup for both. + +Fixes: +https://bugzilla.redhat.com/show_bug.cgi?id=928561 + +Reported-and-tested-by: Honza Brazdil +Signed-off-by: Benjamin Tissoires +Signed-off-by: Jiri Kosina +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hid/hid-core.c | 1 + + drivers/hid/hid-ids.h | 1 + + drivers/hid/hid-kye.c | 45 ++++++++++++++++++++++++++++----------------- + 3 files changed, 30 insertions(+), 17 deletions(-) + +--- a/drivers/hid/hid-core.c ++++ b/drivers/hid/hid-core.c +@@ -1597,6 +1597,7 @@ static const struct hid_device_id hid_ha + { HID_USB_DEVICE(USB_VENDOR_ID_KENSINGTON, USB_DEVICE_ID_KS_SLIMBLADE) }, + { HID_USB_DEVICE(USB_VENDOR_ID_KEYTOUCH, USB_DEVICE_ID_KEYTOUCH_IEC) }, + { HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_GENIUS_GILA_GAMING_MOUSE) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_GENIUS_GX_IMPERATOR) }, + { HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_ERGO_525V) }, + { HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_EASYPEN_I405X) }, + { HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_MOUSEPEN_I608X) }, +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -482,6 +482,7 @@ + #define USB_VENDOR_ID_KYE 0x0458 + #define USB_DEVICE_ID_KYE_ERGO_525V 0x0087 + #define USB_DEVICE_ID_GENIUS_GILA_GAMING_MOUSE 0x0138 ++#define USB_DEVICE_ID_GENIUS_GX_IMPERATOR 0x4018 + #define USB_DEVICE_ID_KYE_GPEN_560 0x5003 + #define USB_DEVICE_ID_KYE_EASYPEN_I405X 0x5010 + #define USB_DEVICE_ID_KYE_MOUSEPEN_I608X 0x5011 +--- a/drivers/hid/hid-kye.c ++++ b/drivers/hid/hid-kye.c +@@ -268,6 +268,26 @@ static __u8 easypen_m610x_rdesc_fixed[] + 0xC0 /* End Collection */ + }; + ++static __u8 *kye_consumer_control_fixup(struct hid_device *hdev, __u8 *rdesc, ++ unsigned int *rsize, int offset, const char *device_name) { ++ /* ++ * the fixup that need to be done: ++ * - change Usage Maximum in the Comsumer Control ++ * (report ID 3) to a reasonable value ++ */ ++ if (*rsize >= offset + 31 && ++ /* Usage Page (Consumer Devices) */ ++ rdesc[offset] == 0x05 && rdesc[offset + 1] == 0x0c && ++ /* Usage (Consumer Control) */ ++ rdesc[offset + 2] == 0x09 && rdesc[offset + 3] == 0x01 && ++ /* Usage Maximum > 12287 */ ++ rdesc[offset + 10] == 0x2a && rdesc[offset + 12] > 0x2f) { ++ hid_info(hdev, "fixing up %s report descriptor\n", device_name); ++ rdesc[offset + 12] = 0x2f; ++ } ++ return rdesc; ++} ++ + static __u8 *kye_report_fixup(struct hid_device *hdev, __u8 *rdesc, + unsigned int *rsize) + { +@@ -315,23 +335,12 @@ static __u8 *kye_report_fixup(struct hid + } + break; + case USB_DEVICE_ID_GENIUS_GILA_GAMING_MOUSE: +- /* +- * the fixup that need to be done: +- * - change Usage Maximum in the Comsumer Control +- * (report ID 3) to a reasonable value +- */ +- if (*rsize >= 135 && +- /* Usage Page (Consumer Devices) */ +- rdesc[104] == 0x05 && rdesc[105] == 0x0c && +- /* Usage (Consumer Control) */ +- rdesc[106] == 0x09 && rdesc[107] == 0x01 && +- /* Usage Maximum > 12287 */ +- rdesc[114] == 0x2a && rdesc[116] > 0x2f) { +- hid_info(hdev, +- "fixing up Genius Gila Gaming Mouse " +- "report descriptor\n"); +- rdesc[116] = 0x2f; +- } ++ rdesc = kye_consumer_control_fixup(hdev, rdesc, rsize, 104, ++ "Genius Gila Gaming Mouse"); ++ break; ++ case USB_DEVICE_ID_GENIUS_GX_IMPERATOR: ++ rdesc = kye_consumer_control_fixup(hdev, rdesc, rsize, 83, ++ "Genius Gx Imperator Keyboard"); + break; + } + return rdesc; +@@ -428,6 +437,8 @@ static const struct hid_device_id kye_de + USB_DEVICE_ID_KYE_EASYPEN_M610X) }, + { HID_USB_DEVICE(USB_VENDOR_ID_KYE, + USB_DEVICE_ID_GENIUS_GILA_GAMING_MOUSE) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_KYE, ++ USB_DEVICE_ID_GENIUS_GX_IMPERATOR) }, + { } + }; + MODULE_DEVICE_TABLE(hid, kye_devices); diff --git a/queue-3.11/hid-pantherlord-validate-output-report-details.patch b/queue-3.11/hid-pantherlord-validate-output-report-details.patch new file mode 100644 index 00000000000..ecd984ff014 --- /dev/null +++ b/queue-3.11/hid-pantherlord-validate-output-report-details.patch @@ -0,0 +1,46 @@ +From 412f30105ec6735224535791eed5cdc02888ecb4 Mon Sep 17 00:00:00 2001 +From: Kees Cook +Date: Wed, 28 Aug 2013 22:30:49 +0200 +Subject: HID: pantherlord: validate output report details + +From: Kees Cook + +commit 412f30105ec6735224535791eed5cdc02888ecb4 upstream. + +A HID device could send a malicious output report that would cause the +pantherlord HID driver to write beyond the output report allocation +during initialization, causing a heap overflow: + +[ 310.939483] usb 1-1: New USB device found, idVendor=0e8f, idProduct=0003 +... +[ 315.980774] BUG kmalloc-192 (Tainted: G W ): Redzone overwritten + +CVE-2013-2892 + +Signed-off-by: Kees Cook +Signed-off-by: Jiri Kosina +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hid/hid-pl.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +--- a/drivers/hid/hid-pl.c ++++ b/drivers/hid/hid-pl.c +@@ -132,8 +132,14 @@ static int plff_init(struct hid_device * + strong = &report->field[0]->value[2]; + weak = &report->field[0]->value[3]; + debug("detected single-field device"); +- } else if (report->maxfield >= 4 && report->field[0]->maxusage == 1 && +- report->field[0]->usage[0].hid == (HID_UP_LED | 0x43)) { ++ } else if (report->field[0]->maxusage == 1 && ++ report->field[0]->usage[0].hid == ++ (HID_UP_LED | 0x43) && ++ report->maxfield >= 4 && ++ report->field[0]->report_count >= 1 && ++ report->field[1]->report_count >= 1 && ++ report->field[2]->report_count >= 1 && ++ report->field[3]->report_count >= 1) { + report->field[0]->value[0] = 0x00; + report->field[1]->value[0] = 0x00; + strong = &report->field[2]->value[0]; diff --git a/queue-3.11/hid-wiimote-work-around-broken-drm_kai-on-gen10.patch b/queue-3.11/hid-wiimote-work-around-broken-drm_kai-on-gen10.patch new file mode 100644 index 00000000000..316da753ee4 --- /dev/null +++ b/queue-3.11/hid-wiimote-work-around-broken-drm_kai-on-gen10.patch @@ -0,0 +1,51 @@ +From a6be8569b6705cbc26e7ae1a8be476067cc5a78b Mon Sep 17 00:00:00 2001 +From: David Herrmann +Date: Sun, 4 Aug 2013 18:50:10 +0200 +Subject: HID: wiimote: work around broken DRM_KAI on GEN10 + +From: David Herrmann + +commit a6be8569b6705cbc26e7ae1a8be476067cc5a78b upstream. + +GEN10 and earlier devices seem to not support DRM_KAI if we run in basic +IR mode. Use DRM_KAIE instead. This might increases overhead slightly as +the extension port is read and streamed but we stream accelerometer data +constantly, too, so this is negligible. + +Note that our parsers are hardcoded on IR-formats, so we cannot actually +use 96-bit IR DRMs for basic IR data. We would have to adjust the parsers. +But as only GEN20 and newer support this, we simply avoid mixed DRMs. + +This fixes a bug where GEN10 devices didn't provide IR data if +accelerometer and IR are enabled simultaneously. As a workaround, you can +enable DRM_KAIE without this patch via (disables device power-management): + echo "37" >/sys/kernel/debug/hid//drm + +Signed-off-by: David Herrmann +Reported-by: Nicolas Adenis-Lamarre +Signed-off-by: Jiri Kosina +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hid/hid-wiimote-core.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +--- a/drivers/hid/hid-wiimote-core.c ++++ b/drivers/hid/hid-wiimote-core.c +@@ -212,10 +212,12 @@ static __u8 select_drm(struct wiimote_da + + if (ir == WIIPROTO_FLAG_IR_BASIC) { + if (wdata->state.flags & WIIPROTO_FLAG_ACCEL) { +- if (ext) +- return WIIPROTO_REQ_DRM_KAIE; +- else +- return WIIPROTO_REQ_DRM_KAI; ++ /* GEN10 and ealier devices bind IR formats to DRMs. ++ * Hence, we cannot use DRM_KAI here as it might be ++ * bound to IR_EXT. Use DRM_KAIE unconditionally so we ++ * work with all devices and our parsers can use the ++ * fixed formats, too. */ ++ return WIIPROTO_REQ_DRM_KAIE; + } else { + return WIIPROTO_REQ_DRM_KIE; + } diff --git a/queue-3.11/mac80211-ignore-e-csa-in-probe-response-frames.patch b/queue-3.11/mac80211-ignore-e-csa-in-probe-response-frames.patch new file mode 100644 index 00000000000..de0cbccc02e --- /dev/null +++ b/queue-3.11/mac80211-ignore-e-csa-in-probe-response-frames.patch @@ -0,0 +1,56 @@ +From d70b7616d9080ec9f868fbd31db5fd4341435d61 Mon Sep 17 00:00:00 2001 +From: Johannes Berg +Date: Fri, 23 Aug 2013 15:48:48 +0200 +Subject: mac80211: ignore (E)CSA in probe response frames + +From: Johannes Berg + +commit d70b7616d9080ec9f868fbd31db5fd4341435d61 upstream. + +Seth reports that some APs, notably the Netgear WNDAP360, send +invalid ECSA IEs in probe response frames with the operating +class and channel number both set to zero, even when no channel +switch is being done. As a result, any scan while connected to +such an AP results in the connection being dropped. + +Fix this by ignoring any channel switch announcment in probe +response frames entirely, since we're connected to the AP we +will be receiving a beacon (and maybe even an action frame) if +a channel switch is done, which is sufficient. + +Reported-by: Seth Forshee +Tested-by: Seth Forshee +Signed-off-by: Johannes Berg +Signed-off-by: Greg Kroah-Hartman + +--- + net/mac80211/mlme.c | 11 +++-------- + 1 file changed, 3 insertions(+), 8 deletions(-) + +--- a/net/mac80211/mlme.c ++++ b/net/mac80211/mlme.c +@@ -2851,14 +2851,6 @@ static void ieee80211_rx_bss_info(struct + ieee80211_rx_bss_put(local, bss); + sdata->vif.bss_conf.beacon_rate = bss->beacon_rate; + } +- +- if (!sdata->u.mgd.associated || +- !ether_addr_equal(mgmt->bssid, sdata->u.mgd.associated->bssid)) +- return; +- +- ieee80211_sta_process_chanswitch(sdata, rx_status->mactime, +- elems, true); +- + } + + +@@ -3147,6 +3139,9 @@ static void ieee80211_rx_mgmt_beacon(str + + ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems); + ++ ieee80211_sta_process_chanswitch(sdata, rx_status->mactime, ++ &elems, true); ++ + if (ieee80211_sta_wmm_params(local, sdata, elems.wmm_param, + elems.wmm_param_len)) + changed |= BSS_CHANGED_QOS; diff --git a/queue-3.11/net-mvneta-properly-disable-hw-phy-polling-and-ensure-adjust_link-works.patch b/queue-3.11/net-mvneta-properly-disable-hw-phy-polling-and-ensure-adjust_link-works.patch new file mode 100644 index 00000000000..29ad072e265 --- /dev/null +++ b/queue-3.11/net-mvneta-properly-disable-hw-phy-polling-and-ensure-adjust_link-works.patch @@ -0,0 +1,117 @@ +From 714086029116b6b0a34e67ba1dd2f0d1cf26770c Mon Sep 17 00:00:00 2001 +From: Thomas Petazzoni +Date: Wed, 4 Sep 2013 16:21:18 +0200 +Subject: net: mvneta: properly disable HW PHY polling and ensure adjust_link() works + +From: Thomas Petazzoni + +commit 714086029116b6b0a34e67ba1dd2f0d1cf26770c upstream. + +This commit fixes a long-standing bug that has been reported by many +users: on some Armada 370 platforms, only the network interface that +has been used in U-Boot to tftp the kernel works properly in +Linux. The other network interfaces can see a 'link up', but are +unable to transmit data. The reports were generally made on the Armada +370-based Mirabox, but have also been given on the Armada 370-RD +board. + +The network MAC in the Armada 370/XP (supported by the mvneta driver +in Linux) has a functionality that allows it to continuously poll the +PHY and directly update the MAC configuration accordingly (speed, +duplex, etc.). The very first versions of the driver submitted for +review were using this hardware mechanism, but due to this, the driver +was not integrated with the kernel phylib. Following reviews, the +driver was changed to use the phylib, and therefore a software based +polling. In software based polling, Linux regularly talks to the PHY +over the MDIO bus, and sees if the link status has changed. If it's +the case then the adjust_link() callback of the driver is called to +update the MAC configuration accordingly. + +However, it turns out that the adjust_link() callback was not +configuring the hardware in a completely correct way: while it was +setting the speed and duplex bits correctly, it wasn't telling the +hardware to actually take into account those bits rather than what the +hardware-based PHY polling mechanism has concluded. So, in fact the +adjust_link() callback was basically a no-op. + +However, the network happened to be working because on the network +interfaces used by U-Boot for tftp on Armada 370 platforms because the +hardware PHY polling was enabled by the bootloader, and left enabled +by Linux. However, the second network interface not used for tftp (or +both network interfaces if the kernel is loaded from USB, NAND or SD +card) didn't had the hardware PHY polling enabled. + +This patch fixes this situation by: + + (1) Making sure that the hardware PHY polling is disabled by clearing + the MVNETA_PHY_POLLING_ENABLE bit in the MVNETA_UNIT_CONTROL + register in the driver ->probe() function. + + (2) Making sure that the duplex and speed selections made by the + adjust_link() callback are taken into account by clearing the + MVNETA_GMAC_AN_SPEED_EN and MVNETA_GMAC_AN_DUPLEX_EN bits in the + MVNETA_GMAC_AUTONEG_CONFIG register. + +This patch has been tested on Armada 370 Mirabox, and now both network +interfaces are usable after boot. + +[ Problem introduced by commit c5aff18 ("net: mvneta: driver for + Marvell Armada 370/XP network unit") ] + +Signed-off-by: Thomas Petazzoni +Cc: Willy Tarreau +Cc: Jochen De Smet +Cc: Peter Sanford +Cc: Ethan Tuttle +Cc: Chény Yves-Gael +Cc: Ryan Press +Cc: Simon Guinot +Cc: vdonnefort@lacie.com +Acked-by: Jason Cooper +Tested-by: Vincent Donnefort +Tested-by: Yves-Gael Cheny +Tested-by: Gregory CLEMENT +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/ethernet/marvell/mvneta.c | 13 ++++++++++++- + 1 file changed, 12 insertions(+), 1 deletion(-) + +--- a/drivers/net/ethernet/marvell/mvneta.c ++++ b/drivers/net/ethernet/marvell/mvneta.c +@@ -138,7 +138,9 @@ + #define MVNETA_GMAC_FORCE_LINK_PASS BIT(1) + #define MVNETA_GMAC_CONFIG_MII_SPEED BIT(5) + #define MVNETA_GMAC_CONFIG_GMII_SPEED BIT(6) ++#define MVNETA_GMAC_AN_SPEED_EN BIT(7) + #define MVNETA_GMAC_CONFIG_FULL_DUPLEX BIT(12) ++#define MVNETA_GMAC_AN_DUPLEX_EN BIT(13) + #define MVNETA_MIB_COUNTERS_BASE 0x3080 + #define MVNETA_MIB_LATE_COLLISION 0x7c + #define MVNETA_DA_FILT_SPEC_MCAST 0x3400 +@@ -915,6 +917,13 @@ static void mvneta_defaults_set(struct m + /* Assign port SDMA configuration */ + mvreg_write(pp, MVNETA_SDMA_CONFIG, val); + ++ /* Disable PHY polling in hardware, since we're using the ++ * kernel phylib to do this. ++ */ ++ val = mvreg_read(pp, MVNETA_UNIT_CONTROL); ++ val &= ~MVNETA_PHY_POLLING_ENABLE; ++ mvreg_write(pp, MVNETA_UNIT_CONTROL, val); ++ + mvneta_set_ucast_table(pp, -1); + mvneta_set_special_mcast_table(pp, -1); + mvneta_set_other_mcast_table(pp, -1); +@@ -2307,7 +2316,9 @@ static void mvneta_adjust_link(struct ne + val = mvreg_read(pp, MVNETA_GMAC_AUTONEG_CONFIG); + val &= ~(MVNETA_GMAC_CONFIG_MII_SPEED | + MVNETA_GMAC_CONFIG_GMII_SPEED | +- MVNETA_GMAC_CONFIG_FULL_DUPLEX); ++ MVNETA_GMAC_CONFIG_FULL_DUPLEX | ++ MVNETA_GMAC_AN_SPEED_EN | ++ MVNETA_GMAC_AN_DUPLEX_EN); + + if (phydev->duplex) + val |= MVNETA_GMAC_CONFIG_FULL_DUPLEX; diff --git a/queue-3.11/pinctrl-at91-fix-get_pullup-down-function-return.patch b/queue-3.11/pinctrl-at91-fix-get_pullup-down-function-return.patch new file mode 100644 index 00000000000..5304ec5c6f5 --- /dev/null +++ b/queue-3.11/pinctrl-at91-fix-get_pullup-down-function-return.patch @@ -0,0 +1,42 @@ +From 05d3534a321d7fe4524b3b83bb20318282f3ec2c Mon Sep 17 00:00:00 2001 +From: Boris BREZILLON +Date: Tue, 27 Aug 2013 15:19:21 +0200 +Subject: pinctrl: at91: fix get_pullup/down function return + +From: Boris BREZILLON + +commit 05d3534a321d7fe4524b3b83bb20318282f3ec2c upstream. + +In PIO_PUSR and PIO_PPDSR register if a given bit is set 1 this means the +pullup/down for this pin (pin is represented as a bit position) is +disabled. + +Signed-off-by: Boris BREZILLON +Acked-by: Nicolas Ferre +Signed-off-by: Linus Walleij +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pinctrl/pinctrl-at91.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/pinctrl/pinctrl-at91.c ++++ b/drivers/pinctrl/pinctrl-at91.c +@@ -325,7 +325,7 @@ static void at91_mux_disable_interrupt(v + + static unsigned at91_mux_get_pullup(void __iomem *pio, unsigned pin) + { +- return (readl_relaxed(pio + PIO_PUSR) >> pin) & 0x1; ++ return !((readl_relaxed(pio + PIO_PUSR) >> pin) & 0x1); + } + + static void at91_mux_set_pullup(void __iomem *pio, unsigned mask, bool on) +@@ -445,7 +445,7 @@ static void at91_mux_pio3_set_debounce(v + + static bool at91_mux_pio3_get_pulldown(void __iomem *pio, unsigned pin) + { +- return (__raw_readl(pio + PIO_PPDSR) >> pin) & 0x1; ++ return !((__raw_readl(pio + PIO_PPDSR) >> pin) & 0x1); + } + + static void at91_mux_pio3_set_pulldown(void __iomem *pio, unsigned mask, bool is_on) diff --git a/queue-3.11/series b/queue-3.11/series index bf698aa82aa..0e49a283cb2 100644 --- a/queue-3.11/series +++ b/queue-3.11/series @@ -54,3 +54,21 @@ pci_ids-add-pci-device-id-functions-3-and-4-for-newer-f15h-models.patch x86-amd_nb-clarify-f15h-model-30h-gart-and-l3-support.patch x86-mce-pay-no-attention-to-f-bit-in-mcacod-when-parsing-uc-errors.patch sched-x86-optimize-switch_mm-for-multi-threaded-workloads.patch +alsa-hda-re-setup-hdmi-pin-and-audio-infoframe-on-stream-switches.patch +alsa-hda-hdmi-fallback-to-alsa-allocation-when-selecting-ca.patch +alsa-hda-add-toshiba-satellite-c870-to-msi-blacklist.patch +pinctrl-at91-fix-get_pullup-down-function-return.patch +ext4-move-test-whether-extent-to-map-can-be-extended-to-one-place.patch +ext4-fix-ext4_writepages-in-presence-of-truncate.patch +ext4-simplify-truncation-code-in-ext4_setattr.patch +mac80211-ignore-e-csa-in-probe-response-frames.patch +brcmsmac-fix-warning-caused-by-lack-of-calls-to-dma_mapping_error.patch +ath9k-always-clear-ps-filter-bit-on-new-assoc.patch +ath9k-fix-rx-descriptor-related-race-condition.patch +ath9k-avoid-accessing-mrc-registers-on-single-chain-devices.patch +net-mvneta-properly-disable-hw-phy-polling-and-ensure-adjust_link-works.patch +hid-correct-the-usb-ids-for-the-new-macbook-air-6.patch +hid-pantherlord-validate-output-report-details.patch +hid-kye-add-report-fixup-for-genius-gx-imperator-keyboard.patch +hid-wiimote-work-around-broken-drm_kai-on-gen10.patch +hid-fix-speedlink-vad-cezanne-support-for-some-devices.patch