From: Greg Kroah-Hartman Date: Fri, 13 Mar 2009 05:35:17 +0000 (-0700) Subject: .27 patches X-Git-Tag: v2.6.28.8~16 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=67a37fefe2387aa083af5212bdfecf2ac9e7fc59;p=thirdparty%2Fkernel%2Fstable-queue.git .27 patches --- diff --git a/queue-2.6.27/0001-DVB-s5h1409-Perform-s5h1409-soft-reset-after-tunin.patch b/queue-2.6.27/0001-DVB-s5h1409-Perform-s5h1409-soft-reset-after-tunin.patch new file mode 100644 index 00000000000..431753cd143 --- /dev/null +++ b/queue-2.6.27/0001-DVB-s5h1409-Perform-s5h1409-soft-reset-after-tunin.patch @@ -0,0 +1,54 @@ +From 1b63890e13258d4058a549c4eb7e9be1eff463ef Mon Sep 17 00:00:00 2001 +From: Devin Heitmueller +Date: Mon, 26 Jan 2009 03:07:59 -0300 +Subject: DVB: s5h1409: Perform s5h1409 soft reset after tuning + +From: Devin Heitmueller + +(cherry picked from commit 67e70baf043cfdcdaf5972bc94be82632071536b) + +Just like with the s5h1411, the s5h1409 needs a soft-reset in order for it +to know that the tuner has been told to change frequencies. This change +changes the behavior from "random tuning times between 500ms to complete +tuning lock failures" to "tuning lock consistently within 700ms". + +Thanks to Robert Krakora for doing +initial testing of the patch on the KWorld 330U. + +Thanks to Andy Walls for doing testing of the patch on +the HVR-1600. + +Thanks to Michael Krufky for doing additional testing. + +Signed-off-by: Devin Heitmueller +Signed-off-by: Michael Krufky +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/dvb/frontends/s5h1409.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +--- a/drivers/media/dvb/frontends/s5h1409.c ++++ b/drivers/media/dvb/frontends/s5h1409.c +@@ -542,9 +542,6 @@ static int s5h1409_set_frontend (struct + + s5h1409_enable_modulation(fe, p->u.vsb.modulation); + +- /* Allow the demod to settle */ +- msleep(100); +- + if (fe->ops.tuner_ops.set_params) { + if (fe->ops.i2c_gate_ctrl) fe->ops.i2c_gate_ctrl(fe, 1); + fe->ops.tuner_ops.set_params(fe, p); +@@ -557,6 +554,10 @@ static int s5h1409_set_frontend (struct + s5h1409_set_qam_interleave_mode(fe); + } + ++ /* Issue a reset to the demod so it knows to resync against the ++ newly tuned frequency */ ++ s5h1409_softreset(fe); ++ + return 0; + } + diff --git a/queue-2.6.27/0002-V4L-tda8290-fix-TDA8290-TDA18271-initialization.patch b/queue-2.6.27/0002-V4L-tda8290-fix-TDA8290-TDA18271-initialization.patch new file mode 100644 index 00000000000..b157ed10436 --- /dev/null +++ b/queue-2.6.27/0002-V4L-tda8290-fix-TDA8290-TDA18271-initialization.patch @@ -0,0 +1,33 @@ +From cde07db4c3733ac3c1ae19c266a7d37029fb56ab Mon Sep 17 00:00:00 2001 +From: Michael Krufky +Date: Mon, 5 Jan 2009 18:25:04 -0300 +Subject: [PATCH] V4L: tda8290: fix TDA8290 + TDA18271 initialization + +From: Michael Krufky + +(cherry picked from commit 439b72b69e4992e9ec34b74304f0fa95623934eb) + +Don't call tda8290_init_tuner unless we have either a TDA8275 or TDA8275A +present. Calling this function will cause a TDA18271 to get sick, so we +should only call it when needed. + +Signed-off-by: Michael Krufky +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/common/tuners/tda8290.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/media/common/tuners/tda8290.c ++++ b/drivers/media/common/tuners/tda8290.c +@@ -726,7 +726,8 @@ struct dvb_frontend *tda829x_attach(stru + fe->ops.analog_ops.info.name = name; + + if (priv->ver & TDA8290) { +- tda8290_init_tuner(fe); ++ if (priv->ver & (TDA8275 | TDA8275A)) ++ tda8290_init_tuner(fe); + tda8290_init_if(fe); + } else if (priv->ver & TDA8295) + tda8295_init_if(fe); diff --git a/queue-2.6.27/0003-V4L-ivtv-fix-decoder-crash-regression.patch b/queue-2.6.27/0003-V4L-ivtv-fix-decoder-crash-regression.patch new file mode 100644 index 00000000000..3675be7de5d --- /dev/null +++ b/queue-2.6.27/0003-V4L-ivtv-fix-decoder-crash-regression.patch @@ -0,0 +1,67 @@ +From 02c9e136ea812ec8f71c5a4b75eb6b96c3be6164 Mon Sep 17 00:00:00 2001 +From: Hans Verkuil +Date: Sat, 14 Feb 2009 19:58:33 -0300 +Subject: V4L: ivtv: fix decoder crash regression + +From: Hans Verkuil + +(cherry picked from commit ac9575f75c52bcb455120f8c43376b556acba048) + +The video_ioctl2 conversion of ivtv in kernel 2.6.27 introduced a bug +causing decoder commands to crash. The decoder commands should have been +handled from the video_ioctl2 default handler, ensuring correct mapping +of the argument between user and kernel space. Unfortunately they ended +up before the video_ioctl2 call, causing random crashes. + +Thanks to hannes@linus.priv.at for testing and helping me track down the +cause! + +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Michael Krufky +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/video/ivtv/ivtv-ioctl.c | 24 ++++++++++++------------ + 1 file changed, 12 insertions(+), 12 deletions(-) + +--- a/drivers/media/video/ivtv/ivtv-ioctl.c ++++ b/drivers/media/video/ivtv/ivtv-ioctl.c +@@ -1744,6 +1744,18 @@ static int ivtv_default(struct file *fil + break; + } + ++ case IVTV_IOC_DMA_FRAME: ++ case VIDEO_GET_PTS: ++ case VIDEO_GET_FRAME_COUNT: ++ case VIDEO_GET_EVENT: ++ case VIDEO_PLAY: ++ case VIDEO_STOP: ++ case VIDEO_FREEZE: ++ case VIDEO_CONTINUE: ++ case VIDEO_COMMAND: ++ case VIDEO_TRY_COMMAND: ++ return ivtv_decoder_ioctls(file, cmd, (void *)arg); ++ + default: + return -EINVAL; + } +@@ -1786,18 +1798,6 @@ static int ivtv_serialized_ioctl(struct + ivtv_vapi(itv, CX2341X_DEC_SET_AUDIO_MODE, 2, itv->audio_bilingual_mode, itv->audio_stereo_mode); + return 0; + +- case IVTV_IOC_DMA_FRAME: +- case VIDEO_GET_PTS: +- case VIDEO_GET_FRAME_COUNT: +- case VIDEO_GET_EVENT: +- case VIDEO_PLAY: +- case VIDEO_STOP: +- case VIDEO_FREEZE: +- case VIDEO_CONTINUE: +- case VIDEO_COMMAND: +- case VIDEO_TRY_COMMAND: +- return ivtv_decoder_ioctls(filp, cmd, (void *)arg); +- + default: + break; + } diff --git a/queue-2.6.27/8250-fix-boot-hang-with-serial-console-when-using-with-serial-over-lan-port.patch b/queue-2.6.27/8250-fix-boot-hang-with-serial-console-when-using-with-serial-over-lan-port.patch new file mode 100644 index 00000000000..f6119c456ed --- /dev/null +++ b/queue-2.6.27/8250-fix-boot-hang-with-serial-console-when-using-with-serial-over-lan-port.patch @@ -0,0 +1,170 @@ +From b6adea334c6c89d5e6c94f9196bbf3a279cb53bd Mon Sep 17 00:00:00 2001 +From: Mauro Carvalho Chehab +Date: Fri, 20 Feb 2009 15:38:52 -0800 +Subject: 8250: fix boot hang with serial console when using with Serial Over Lan port + +From: Mauro Carvalho Chehab + +commit b6adea334c6c89d5e6c94f9196bbf3a279cb53bd upstream. + +Intel 8257x Ethernet boards have a feature called Serial Over Lan. + +This feature works by emulating a serial port, and it is detected by +kernel as a normal 8250 port. However, this emulation is not perfect, as +also noticed on changeset 7500b1f602aad75901774a67a687ee985d85893f. + +Before this patch, the kernel were trying to check if the serial TX is +capable of work using IRQ's. + +This were done with a code similar this: + + serial_outp(up, UART_IER, UART_IER_THRI); + lsr = serial_in(up, UART_LSR); + iir = serial_in(up, UART_IIR); + serial_outp(up, UART_IER, 0); + + if (lsr & UART_LSR_TEMT && iir & UART_IIR_NO_INT) + up->bugs |= UART_BUG_TXEN; + +This works fine for other 8250 ports, but, on 8250-emulated SoL port, the +chip is a little lazy to down UART_IIR_NO_INT at UART_IIR register. + +Due to that, UART_BUG_TXEN is sometimes enabled. However, as TX IRQ keeps +working, and the TX polling is now enabled, the driver miss-interprets the +IRQ received later, hanging up the machine until a key is pressed at the +serial console. + +This is the 6 version of this patch. Previous versions were trying to +introduce a large enough delay between serial_outp and serial_in(up, +UART_IIR), but not taking forever. However, the needed delay couldn't be +safely determined. + +At the experimental tests, a delay of 1us solves most of the cases, but +still hangs sometimes. Increasing the delay to 5us was better, but still +doesn't solve. A very high delay of 50 ms seemed to work every time. + +However, poking around with delays and pray for it to be enough doesn't +seem to be a good approach, even for a quirk. + +So, instead of playing with random large arbitrary delays, let's just +disable UART_BUG_TXEN for all SoL ports. + +[akpm@linux-foundation.org: fix warnings] +Signed-off-by: Mauro Carvalho Chehab +Cc: Alan Cox +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/serial/8250.c | 15 +++++++++++++++ + drivers/serial/8250_pci.c | 36 ++++++++++++++++++++++++++++++++++++ + include/linux/pci_ids.h | 3 +++ + include/linux/serial_core.h | 1 + + 4 files changed, 55 insertions(+) + +--- a/drivers/serial/8250.c ++++ b/drivers/serial/8250.c +@@ -1956,6 +1956,20 @@ static int serial8250_startup(struct uar + + serial8250_set_mctrl(&up->port, up->port.mctrl); + ++ /* Serial over Lan (SoL) hack: ++ Intel 8257x Gigabit ethernet chips have a ++ 16550 emulation, to be used for Serial Over Lan. ++ Those chips take a longer time than a normal ++ serial device to signalize that a transmission ++ data was queued. Due to that, the above test generally ++ fails. One solution would be to delay the reading of ++ iir. However, this is not reliable, since the timeout ++ is variable. So, let's just don't test if we receive ++ TX irq. This way, we'll never enable UART_BUG_TXEN. ++ */ ++ if (up->port.flags & UPF_NO_TXEN_TEST) ++ goto dont_test_tx_en; ++ + /* + * Do a quick test to see if we receive an + * interrupt when we enable the TX irq. +@@ -1975,6 +1989,7 @@ static int serial8250_startup(struct uar + up->bugs &= ~UART_BUG_TXEN; + } + ++dont_test_tx_en: + spin_unlock_irqrestore(&up->port.lock, flags); + + /* +--- a/drivers/serial/8250_pci.c ++++ b/drivers/serial/8250_pci.c +@@ -762,6 +762,21 @@ pci_default_setup(struct serial_private + return setup_port(priv, port, bar, offset, board->reg_shift); + } + ++static int skip_tx_en_setup(struct serial_private *priv, ++ const struct pciserial_board *board, ++ struct uart_port *port, int idx) ++{ ++ port->flags |= UPF_NO_TXEN_TEST; ++ printk(KERN_DEBUG "serial8250: skipping TxEn test for device " ++ "[%04x:%04x] subsystem [%04x:%04x]\n", ++ priv->dev->vendor, ++ priv->dev->device, ++ priv->dev->subsystem_vendor, ++ priv->dev->subsystem_device); ++ ++ return pci_default_setup(priv, board, port, idx); ++} ++ + /* This should be in linux/pci_ids.h */ + #define PCI_VENDOR_ID_SBSMODULARIO 0x124B + #define PCI_SUBVENDOR_ID_SBSMODULARIO 0x124B +@@ -828,6 +843,27 @@ static struct pci_serial_quirk pci_seria + .init = pci_inteli960ni_init, + .setup = pci_default_setup, + }, ++ { ++ .vendor = PCI_VENDOR_ID_INTEL, ++ .device = PCI_DEVICE_ID_INTEL_8257X_SOL, ++ .subvendor = PCI_ANY_ID, ++ .subdevice = PCI_ANY_ID, ++ .setup = skip_tx_en_setup, ++ }, ++ { ++ .vendor = PCI_VENDOR_ID_INTEL, ++ .device = PCI_DEVICE_ID_INTEL_82573L_SOL, ++ .subvendor = PCI_ANY_ID, ++ .subdevice = PCI_ANY_ID, ++ .setup = skip_tx_en_setup, ++ }, ++ { ++ .vendor = PCI_VENDOR_ID_INTEL, ++ .device = PCI_DEVICE_ID_INTEL_82573E_SOL, ++ .subvendor = PCI_ANY_ID, ++ .subdevice = PCI_ANY_ID, ++ .setup = skip_tx_en_setup, ++ }, + /* + * ITE + */ +--- a/include/linux/pci_ids.h ++++ b/include/linux/pci_ids.h +@@ -2283,6 +2283,9 @@ + #define PCI_DEVICE_ID_INTEL_82378 0x0484 + #define PCI_DEVICE_ID_INTEL_I960 0x0960 + #define PCI_DEVICE_ID_INTEL_I960RM 0x0962 ++#define PCI_DEVICE_ID_INTEL_8257X_SOL 0x1062 ++#define PCI_DEVICE_ID_INTEL_82573E_SOL 0x1085 ++#define PCI_DEVICE_ID_INTEL_82573L_SOL 0x108F + #define PCI_DEVICE_ID_INTEL_82815_MC 0x1130 + #define PCI_DEVICE_ID_INTEL_82815_CGC 0x1132 + #define PCI_DEVICE_ID_INTEL_82092AA_0 0x1221 +--- a/include/linux/serial_core.h ++++ b/include/linux/serial_core.h +@@ -285,6 +285,7 @@ struct uart_port { + #define UPF_HARDPPS_CD ((__force upf_t) (1 << 11)) + #define UPF_LOW_LATENCY ((__force upf_t) (1 << 13)) + #define UPF_BUGGY_UART ((__force upf_t) (1 << 14)) ++#define UPF_NO_TXEN_TEST ((__force upf_t) (1 << 15)) + #define UPF_MAGIC_MULTIPLIER ((__force upf_t) (1 << 16)) + #define UPF_CONS_FLOW ((__force upf_t) (1 << 23)) + #define UPF_SHARE_IRQ ((__force upf_t) (1 << 24)) diff --git a/queue-2.6.27/alsa-aw2-do-not-grab-every-saa7146-based-device.patch b/queue-2.6.27/alsa-aw2-do-not-grab-every-saa7146-based-device.patch new file mode 100644 index 00000000000..67cec38d779 --- /dev/null +++ b/queue-2.6.27/alsa-aw2-do-not-grab-every-saa7146-based-device.patch @@ -0,0 +1,38 @@ +From e8bf069c419c1dc0657e02636441fe1179a9db14 Mon Sep 17 00:00:00 2001 +From: Anssi Hannula +Date: Sun, 22 Feb 2009 14:42:54 +0200 +Subject: ALSA: aw2: do not grab every saa7146 based device + +From: Anssi Hannula + +commit e8bf069c419c1dc0657e02636441fe1179a9db14 upstream. + +Audiowerk2 driver snd-aw2 is bound to any saa7146 device as it does not +check subsystem ids. Many DVB devices are saa7146 based, so aw2 driver +grabs them as well. + +According to http://lkml.org/lkml/2008/10/15/311 aw2 devices have the +subsystem ids set to 0, the saa7146 default. + +Fix conflicts with DVB devices by checking for subsystem ids = 0 +specifically. + +Signed-off-by: Anssi Hannula +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/aw2/aw2-alsa.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/pci/aw2/aw2-alsa.c ++++ b/sound/pci/aw2/aw2-alsa.c +@@ -165,7 +165,7 @@ module_param_array(enable, bool, NULL, 0 + MODULE_PARM_DESC(enable, "Enable Audiowerk2 soundcard."); + + static struct pci_device_id snd_aw2_ids[] = { +- {PCI_VENDOR_ID_SAA7146, PCI_DEVICE_ID_SAA7146, PCI_ANY_ID, PCI_ANY_ID, ++ {PCI_VENDOR_ID_SAA7146, PCI_DEVICE_ID_SAA7146, 0, 0, + 0, 0, 0}, + {0} + }; diff --git a/queue-2.6.27/alsa-fix-excessive-background-noise-introduced-by-oss-emulation-rate-shrink.patch b/queue-2.6.27/alsa-fix-excessive-background-noise-introduced-by-oss-emulation-rate-shrink.patch new file mode 100644 index 00000000000..20a4a4ad621 --- /dev/null +++ b/queue-2.6.27/alsa-fix-excessive-background-noise-introduced-by-oss-emulation-rate-shrink.patch @@ -0,0 +1,31 @@ +From 5370d96f85962769ea3df3a81cc885f257c51589 Mon Sep 17 00:00:00 2001 +From: Steve Chen +Date: Sat, 21 Feb 2009 08:05:04 -0600 +Subject: ALSA: fix excessive background noise introduced by OSS emulation rate shrink + +From: Steve Chen + +commit 5370d96f85962769ea3df3a81cc885f257c51589 upstream. + +Incorrect variable was used to get the next sample which caused S2 +to be stuck with the same value resulting in loud background noise. + +Signed-off-by: Steve Chen +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/core/oss/rate.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/core/oss/rate.c ++++ b/sound/core/oss/rate.c +@@ -157,7 +157,7 @@ static void resample_shrink(struct snd_p + while (dst_frames1 > 0) { + S1 = S2; + if (src_frames1-- > 0) { +- S1 = *src; ++ S2 = *src; + src += src_step; + } + if (pos & ~R_MASK) { diff --git a/queue-2.6.27/alsa-hda-add-another-macbook-pro-3-1-ssid.patch b/queue-2.6.27/alsa-hda-add-another-macbook-pro-3-1-ssid.patch new file mode 100644 index 00000000000..29f3f4ef393 --- /dev/null +++ b/queue-2.6.27/alsa-hda-add-another-macbook-pro-3-1-ssid.patch @@ -0,0 +1,30 @@ +From 2d4663816064fabb68935f920bbd7ccdc7f9392d Mon Sep 17 00:00:00 2001 +From: Luke Yelavich +Date: Mon, 23 Feb 2009 13:00:33 +1100 +Subject: ALSA: hda - add another MacBook Pro 3,1 SSID + +From: Luke Yelavich + +commit 2d4663816064fabb68935f920bbd7ccdc7f9392d upstream. + +Reference: Ubuntu bug #33245 + https://bugs.launchpad.net/bugs/332456 + +Signed-off-by: Luke Yelavich +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_realtek.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -6630,6 +6630,7 @@ static int patch_alc882(struct hda_codec + case 0x106b2800: /* AppleTV */ + board_config = ALC885_IMAC24; + break; ++ case 0x106b00a0: /* MacBookPro3,1 - Another revision */ + case 0x106b00a1: /* Macbook (might be wrong - PCI SSID?) */ + case 0x106b2c00: /* Macbook Pro rev3 */ + case 0x106b3600: /* Macbook 3.1 */ diff --git a/queue-2.6.27/alsa-usb-audio-fix-non-continuous-rate-detection.patch b/queue-2.6.27/alsa-usb-audio-fix-non-continuous-rate-detection.patch new file mode 100644 index 00000000000..65f8d142e07 --- /dev/null +++ b/queue-2.6.27/alsa-usb-audio-fix-non-continuous-rate-detection.patch @@ -0,0 +1,66 @@ +From 0412558c873f716efe902b397af0653a550f7341 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Mon, 16 Feb 2009 22:48:12 +0100 +Subject: ALSA: usb-audio - Fix non-continuous rate detection + +From: Takashi Iwai + +commit 0412558c873f716efe902b397af0653a550f7341 upstream. + +The detection of non-continuous rates (given via rate tables) isn't +processed properly (e.g. for type II). + +This patch fixes and simplifies the detection code. + +Tested-by: Joris van Rantwijk +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/usb/usbaudio.c | 17 +++++++++-------- + 1 file changed, 9 insertions(+), 8 deletions(-) + +--- a/sound/usb/usbaudio.c ++++ b/sound/usb/usbaudio.c +@@ -2516,7 +2516,6 @@ static int parse_audio_format_rates(stru + * build the rate table and bitmap flags + */ + int r, idx; +- unsigned int nonzero_rates = 0; + + fp->rate_table = kmalloc(sizeof(int) * nr_rates, GFP_KERNEL); + if (fp->rate_table == NULL) { +@@ -2524,24 +2523,26 @@ static int parse_audio_format_rates(stru + return -1; + } + +- fp->nr_rates = nr_rates; +- fp->rate_min = fp->rate_max = combine_triple(&fmt[8]); ++ fp->nr_rates = 0; ++ fp->rate_min = fp->rate_max = 0; + for (r = 0, idx = offset + 1; r < nr_rates; r++, idx += 3) { + unsigned int rate = combine_triple(&fmt[idx]); ++ if (!rate) ++ continue; + /* C-Media CM6501 mislabels its 96 kHz altsetting */ + if (rate == 48000 && nr_rates == 1 && + chip->usb_id == USB_ID(0x0d8c, 0x0201) && + fp->altsetting == 5 && fp->maxpacksize == 392) + rate = 96000; +- fp->rate_table[r] = rate; +- nonzero_rates |= rate; +- if (rate < fp->rate_min) ++ fp->rate_table[fp->nr_rates] = rate; ++ if (!fp->rate_min || rate < fp->rate_min) + fp->rate_min = rate; +- else if (rate > fp->rate_max) ++ if (!fp->rate_max || rate > fp->rate_max) + fp->rate_max = rate; + fp->rates |= snd_pcm_rate_to_rate_bit(rate); ++ fp->nr_rates++; + } +- if (!nonzero_rates) { ++ if (!fp->nr_rates) { + hwc_debug("All rates were zero. Skipping format!\n"); + return -1; + } diff --git a/queue-2.6.27/alsa-usb-audio-workaround-for-misdetected-sample-rate-with-cm6207.patch b/queue-2.6.27/alsa-usb-audio-workaround-for-misdetected-sample-rate-with-cm6207.patch new file mode 100644 index 00000000000..2ae5684ba98 --- /dev/null +++ b/queue-2.6.27/alsa-usb-audio-workaround-for-misdetected-sample-rate-with-cm6207.patch @@ -0,0 +1,35 @@ +From 3b03cc5b86e2052295b9b484f37226ee15c87924 Mon Sep 17 00:00:00 2001 +From: Joris van Rantwijk +Date: Mon, 16 Feb 2009 22:58:23 +0100 +Subject: ALSA: usb-audio - Workaround for misdetected sample rate with CM6207 + +From: Joris van Rantwijk + +commit 3b03cc5b86e2052295b9b484f37226ee15c87924 upstream. + +The CM6207 incorrectly advertises its 96 kHz playback setting as 48 kHz +in its USB device descriptor. This patch extends an existing workaround +in usbaudio.c to also cover the CM6207. + +This resolves issue 0004249 in the ALSA bug tracker. + +Signed-off-by: Joris van Rantwijk +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/usb/usbaudio.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/sound/usb/usbaudio.c ++++ b/sound/usb/usbaudio.c +@@ -2531,7 +2531,8 @@ static int parse_audio_format_rates(stru + continue; + /* C-Media CM6501 mislabels its 96 kHz altsetting */ + if (rate == 48000 && nr_rates == 1 && +- chip->usb_id == USB_ID(0x0d8c, 0x0201) && ++ (chip->usb_id == USB_ID(0x0d8c, 0x0201) || ++ chip->usb_id == USB_ID(0x0d8c, 0x0102)) && + fp->altsetting == 5 && fp->maxpacksize == 392) + rate = 96000; + fp->rate_table[fp->nr_rates] = rate; diff --git a/queue-2.6.27/asix-new-device-ids.patch b/queue-2.6.27/asix-new-device-ids.patch new file mode 100644 index 00000000000..1e65f3ed7eb --- /dev/null +++ b/queue-2.6.27/asix-new-device-ids.patch @@ -0,0 +1,40 @@ +From fef7cc0893146550b286b13c0e6e914556142730 Mon Sep 17 00:00:00 2001 +From: Greg Kroah-Hartman +Date: Tue, 24 Feb 2009 23:52:24 -0800 +Subject: asix: new device ids + +From: Greg Kroah-Hartman + +commit fef7cc0893146550b286b13c0e6e914556142730 upstream. + +This patch adds two new device ids to the asix driver. + +One comes directly from the asix driver on their web site, the other was +reported by Armani Liao as needed for the MSI X320 to get the driver to +work properly for it. + +Reported-by: Armani Liao +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: David S. Miller + +--- + drivers/net/usb/asix.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/drivers/net/usb/asix.c ++++ b/drivers/net/usb/asix.c +@@ -1448,6 +1448,14 @@ static const struct usb_device_id produc + // Cables-to-Go USB Ethernet Adapter + USB_DEVICE(0x0b95, 0x772a), + .driver_info = (unsigned long) &ax88772_info, ++}, { ++ // ABOCOM for pci ++ USB_DEVICE(0x14ea, 0xab11), ++ .driver_info = (unsigned long) &ax88178_info, ++}, { ++ // ASIX 88772a ++ USB_DEVICE(0x0db0, 0xa877), ++ .driver_info = (unsigned long) &ax88772_info, + }, + { }, // END + }; diff --git a/queue-2.6.27/cdc_ether-add-usb-id-for-ericsson-f3507g.patch b/queue-2.6.27/cdc_ether-add-usb-id-for-ericsson-f3507g.patch new file mode 100644 index 00000000000..7d5c0c0dc4f --- /dev/null +++ b/queue-2.6.27/cdc_ether-add-usb-id-for-ericsson-f3507g.patch @@ -0,0 +1,42 @@ +From cac477e8f1038c41b6f29d3161ce351462ef3df7 Mon Sep 17 00:00:00 2001 +From: Bjørn Mork +Date: Wed, 25 Feb 2009 04:33:58 +0000 +Subject: cdc_ether: add usb id for Ericsson F3507g + +From: Bjørn Mork + +commit cac477e8f1038c41b6f29d3161ce351462ef3df7 upstream. + +The Ericsson F3507g wireless broadband module provides a CDC Ethernet +compliant interface, but identifies it as a "Mobile Direct Line" CDC +subclass, thereby preventing the CDC Ethernet class driver from picking +it up. This patch adds the device id to cdc_ether.c as a workaround. + +Ericsson has provided a "class" driver for this device: +http://kerneltrap.org/mailarchive/linux-net/2008/10/28/3832094 +But closer inspection of that driver reveals that it adds little more +than duplication of code from cdc_ether.c. See also +http://marc.info/?l=linux-usb&m=123334979706403&w=2 + +Signed-off-by: Bjørn Mork +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/usb/cdc_ether.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/net/usb/cdc_ether.c ++++ b/drivers/net/usb/cdc_ether.c +@@ -559,6 +559,11 @@ static const struct usb_device_id produc + USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_ETHERNET, + USB_CDC_PROTO_NONE), + .driver_info = (unsigned long) &cdc_info, ++}, { ++ /* Ericsson F3507g */ ++ USB_DEVICE_AND_INTERFACE_INFO(0x0bdb, 0x1900, USB_CLASS_COMM, ++ USB_CDC_SUBCLASS_MDLM, USB_CDC_PROTO_NONE), ++ .driver_info = (unsigned long) &cdc_info, + }, + { }, // END + }; diff --git a/queue-2.6.27/copy_process-fix-clone_parent-parent_exec_id-interaction.patch b/queue-2.6.27/copy_process-fix-clone_parent-parent_exec_id-interaction.patch new file mode 100644 index 00000000000..f35e042ca93 --- /dev/null +++ b/queue-2.6.27/copy_process-fix-clone_parent-parent_exec_id-interaction.patch @@ -0,0 +1,58 @@ +From 2d5516cbb9daf7d0e342a2e3b0fc6f8c39a81205 Mon Sep 17 00:00:00 2001 +From: Oleg Nesterov +Date: Mon, 2 Mar 2009 22:58:45 +0100 +Subject: copy_process: fix CLONE_PARENT && parent_exec_id interaction + +From: Oleg Nesterov + +commit 2d5516cbb9daf7d0e342a2e3b0fc6f8c39a81205 upstream. + +CLONE_PARENT can fool the ->self_exec_id/parent_exec_id logic. If we +re-use the old parent, we must also re-use ->parent_exec_id to make +sure exit_notify() sees the right ->xxx_exec_id's when the CLONE_PARENT'ed +task exits. + +Also, move down the "p->parent_exec_id = p->self_exec_id" thing, to place +two different cases together. + +Signed-off-by: Oleg Nesterov +Cc: Roland McGrath +Cc: Andrew Morton +Cc: David Howells +Cc: Serge E. Hallyn +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/fork.c | 11 +++++------ + 1 file changed, 5 insertions(+), 6 deletions(-) + +--- a/kernel/fork.c ++++ b/kernel/fork.c +@@ -1137,10 +1137,6 @@ static struct task_struct *copy_process( + #endif + clear_all_latency_tracing(p); + +- /* Our parent execution domain becomes current domain +- These must match for thread signalling to apply */ +- p->parent_exec_id = p->self_exec_id; +- + /* ok, now we should be set up.. */ + p->exit_signal = (clone_flags & CLONE_THREAD) ? -1 : (clone_flags & CSIGNAL); + p->pdeath_signal = 0; +@@ -1178,10 +1174,13 @@ static struct task_struct *copy_process( + set_task_cpu(p, smp_processor_id()); + + /* CLONE_PARENT re-uses the old parent */ +- if (clone_flags & (CLONE_PARENT|CLONE_THREAD)) ++ if (clone_flags & (CLONE_PARENT|CLONE_THREAD)) { + p->real_parent = current->real_parent; +- else ++ p->parent_exec_id = current->parent_exec_id; ++ } else { + p->real_parent = current; ++ p->parent_exec_id = current->self_exec_id; ++ } + + spin_lock(¤t->sighand->siglock); + diff --git a/queue-2.6.27/fix-fixpoint-divide-exception-in-acct_update_integrals.patch b/queue-2.6.27/fix-fixpoint-divide-exception-in-acct_update_integrals.patch new file mode 100644 index 00000000000..c5bc33c6142 --- /dev/null +++ b/queue-2.6.27/fix-fixpoint-divide-exception-in-acct_update_integrals.patch @@ -0,0 +1,100 @@ +From 6d5b5acca9e566515ef3f1ed617e7295c4f94345 Mon Sep 17 00:00:00 2001 +From: Heiko Carstens +Date: Mon, 9 Mar 2009 13:31:59 +0100 +Subject: Fix fixpoint divide exception in acct_update_integrals + +From: Heiko Carstens + +commit 6d5b5acca9e566515ef3f1ed617e7295c4f94345 upstream. + +Frans Pop reported the crash below when running an s390 kernel under Hercules: + + Kernel BUG at 000738b4 verbose debug info unavailable! + fixpoint divide exception: 0009 #1! SMP + Modules linked in: nfs lockd nfs_acl sunrpc ctcm fsm tape_34xx + cu3088 tape ccwgroup tape_class ext3 jbd mbcache dm_mirror dm_log dm_snapshot + dm_mod dasd_eckd_mod dasd_mod + CPU: 0 Not tainted 2.6.27.19 #13 + Process awk (pid: 2069, task: 0f9ed9b8, ksp: 0f4f7d18) + Krnl PSW : 070c1000 800738b4 (acct_update_integrals+0x4c/0x118) + R:0 T:1 IO:1 EX:1 Key:0 M:1 W:0 P:0 AS:0 CC:1 PM:0 + Krnl GPRS: 00000000 000007d0 7fffffff fffff830 + 00000000 ffffffff 00000002 0f9ed9b8 + 00000000 00008ca0 00000000 0f9ed9b8 + 0f9edda4 8007386e 0f4f7ec8 0f4f7e98 + Krnl Code: 800738aa: a71807d0 lhi %r1,2000 + 800738ae: 8c200001 srdl %r2,1 + 800738b2: 1d21 dr %r2,%r1 + >800738b4: 5810d10e l %r1,270(%r13) + 800738b8: 1823 lr %r2,%r3 + 800738ba: 4130f060 la %r3,96(%r15) + 800738be: 0de1 basr %r14,%r1 + 800738c0: 5800f060 l %r0,96(%r15) + Call Trace: + ( <000000000004fdea>! blocking_notifier_call_chain+0x1e/0x2c) + <0000000000038502>! do_exit+0x106/0x7c0 + <0000000000038c36>! do_group_exit+0x7a/0xb4 + <0000000000038c8e>! SyS_exit_group+0x1e/0x30 + <0000000000021c28>! sysc_do_restart+0x12/0x16 + <0000000077e7e924>! 0x77e7e924 + +Reason for this is that cpu time accounting usually only happens from +interrupt context, but acct_update_integrals gets also called from +process context with interrupts enabled. + +So in acct_update_integrals we may end up with the following scenario: + +Between reading tsk->stime/tsk->utime and tsk->acct_timexpd an interrupt +happens which updates accouting values. This causes acct_timexpd to be +greater than the former stime + utime. The subsequent calculation of + + dtime = cputime_sub(time, tsk->acct_timexpd); + +will be negative and the division performed by + + cputime_to_jiffies(dtime) + +will generate an exception since the result won't fit into a 32 bit +register. + +In order to fix this just always disable interrupts while accessing any +of the accounting values. + +Reported by: Frans Pop +Tested by: Frans Pop +Cc: Martin Schwidefsky +Signed-off-by: Heiko Carstens +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/tsacct.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/kernel/tsacct.c ++++ b/kernel/tsacct.c +@@ -120,8 +120,10 @@ void acct_update_integrals(struct task_s + if (likely(tsk->mm)) { + cputime_t time, dtime; + struct timeval value; ++ unsigned long flags; + u64 delta; + ++ local_irq_save(flags); + time = tsk->stime + tsk->utime; + dtime = cputime_sub(time, tsk->acct_timexpd); + jiffies_to_timeval(cputime_to_jiffies(dtime), &value); +@@ -129,10 +131,12 @@ void acct_update_integrals(struct task_s + delta = delta * USEC_PER_SEC + value.tv_usec; + + if (delta == 0) +- return; ++ goto out; + tsk->acct_timexpd = time; + tsk->acct_rss_mem1 += delta * get_mm_rss(tsk->mm); + tsk->acct_vm_mem1 += delta * tsk->mm->total_vm; ++ out: ++ local_irq_restore(flags); + } + } + diff --git a/queue-2.6.27/fore200-fix-oops-on-failed-firmware-load.patch b/queue-2.6.27/fore200-fix-oops-on-failed-firmware-load.patch new file mode 100644 index 00000000000..4b080aa1621 --- /dev/null +++ b/queue-2.6.27/fore200-fix-oops-on-failed-firmware-load.patch @@ -0,0 +1,34 @@ +From fcffd0d8bbddac757cd856e635ac75e8eb4518bc Mon Sep 17 00:00:00 2001 +From: Meelis Roos +Date: Tue, 10 Feb 2009 17:19:19 -0800 +Subject: fore200: fix oops on failed firmware load + +From: Meelis Roos + +commit fcffd0d8bbddac757cd856e635ac75e8eb4518bc upstream. + +Fore 200 ATM driver fails to handle request_firmware failures and oopses +when no firmware file was found. Fix it by checking for the right return +values and propaganting the return value up. + +Signed-off-by: Meelis Roos +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/atm/fore200e.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/atm/fore200e.c ++++ b/drivers/atm/fore200e.c +@@ -2578,8 +2578,8 @@ fore200e_load_and_start_fw(struct fore20 + return err; + + sprintf(buf, "%s%s", fore200e->bus->proc_name, FW_EXT); +- if (request_firmware(&firmware, buf, device) == 1) { +- printk(FORE200E "missing %s firmware image\n", fore200e->bus->model_name); ++ if ((err = request_firmware(&firmware, buf, device)) < 0) { ++ printk(FORE200E "problem loading firmware image %s\n", fore200e->bus->model_name); + return err; + } + diff --git a/queue-2.6.27/fs-new-inode-i_state-corruption-fix.patch b/queue-2.6.27/fs-new-inode-i_state-corruption-fix.patch new file mode 100644 index 00000000000..143077a19be --- /dev/null +++ b/queue-2.6.27/fs-new-inode-i_state-corruption-fix.patch @@ -0,0 +1,156 @@ +From 7ef0d7377cb287e08f3ae94cebc919448e1f5dff Mon Sep 17 00:00:00 2001 +From: Nick Piggin +Date: Thu, 12 Mar 2009 14:31:38 -0700 +Subject: fs: new inode i_state corruption fix + +From: Nick Piggin + +commit 7ef0d7377cb287e08f3ae94cebc919448e1f5dff upstream. + +There was a report of a data corruption +http://lkml.org/lkml/2008/11/14/121. There is a script included to +reproduce the problem. + +During testing, I encountered a number of strange things with ext3, so I +tried ext2 to attempt to reduce complexity of the problem. I found that +fsstress would quickly hang in wait_on_inode, waiting for I_LOCK to be +cleared, even though instrumentation showed that unlock_new_inode had +already been called for that inode. This points to memory scribble, or +synchronisation problme. + +i_state of I_NEW inodes is not protected by inode_lock because other +processes are not supposed to touch them until I_LOCK (and I_NEW) is +cleared. Adding WARN_ON(inode->i_state & I_NEW) to sites where we modify +i_state revealed that generic_sync_sb_inodes is picking up new inodes from +the inode lists and passing them to __writeback_single_inode without +waiting for I_NEW. Subsequently modifying i_state causes corruption. In +my case it would look like this: + +CPU0 CPU1 +unlock_new_inode() __sync_single_inode() + reg <- inode->i_state + reg -> reg & ~(I_LOCK|I_NEW) reg <- inode->i_state + reg -> inode->i_state reg -> reg | I_SYNC + reg -> inode->i_state + +Non-atomic RMW on CPU1 overwrites CPU0 store and sets I_LOCK|I_NEW again. + +Fix for this is rather than wait for I_NEW inodes, just skip over them: +inodes concurrently being created are not subject to data integrity +operations, and should not significantly contribute to dirty memory +either. + +After this change, I'm unable to reproduce any of the added warnings or +hangs after ~1hour of running. Previously, the new warnings would start +immediately and hang would happen in under 5 minutes. + +I'm also testing on ext3 now, and so far no problems there either. I +don't know whether this fixes the problem reported above, but it fixes a +real problem for me. + +Cc: "Jorge Boncompte [DTI2]" +Reported-by: Adrian Hunter +Cc: Jan Kara +Signed-off-by: Nick Piggin +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + fs/fs-writeback.c | 9 ++++++++- + fs/inode.c | 7 +++++++ + 2 files changed, 15 insertions(+), 1 deletion(-) + +--- a/fs/fs-writeback.c ++++ b/fs/fs-writeback.c +@@ -274,6 +274,7 @@ __sync_single_inode(struct inode *inode, + int ret; + + BUG_ON(inode->i_state & I_SYNC); ++ WARN_ON(inode->i_state & I_NEW); + + /* Set I_SYNC, reset I_DIRTY */ + dirty = inode->i_state & I_DIRTY; +@@ -298,6 +299,7 @@ __sync_single_inode(struct inode *inode, + } + + spin_lock(&inode_lock); ++ WARN_ON(inode->i_state & I_NEW); + inode->i_state &= ~I_SYNC; + if (!(inode->i_state & I_FREEING)) { + if (!(inode->i_state & I_DIRTY) && +@@ -470,6 +472,11 @@ void generic_sync_sb_inodes(struct super + break; + } + ++ if (inode->i_state & I_NEW) { ++ requeue_io(inode); ++ continue; ++ } ++ + if (wbc->nonblocking && bdi_write_congested(bdi)) { + wbc->encountered_congestion = 1; + if (!sb_is_blkdev_sb(sb)) +@@ -531,7 +538,7 @@ void generic_sync_sb_inodes(struct super + list_for_each_entry(inode, &sb->s_inodes, i_sb_list) { + struct address_space *mapping; + +- if (inode->i_state & (I_FREEING|I_WILL_FREE)) ++ if (inode->i_state & (I_FREEING|I_WILL_FREE|I_NEW)) + continue; + mapping = inode->i_mapping; + if (mapping->nrpages == 0) +--- a/fs/inode.c ++++ b/fs/inode.c +@@ -339,6 +339,7 @@ static int invalidate_list(struct list_h + invalidate_inode_buffers(inode); + if (!atomic_read(&inode->i_count)) { + list_move(&inode->i_list, dispose); ++ WARN_ON(inode->i_state & I_NEW); + inode->i_state |= I_FREEING; + count++; + continue; +@@ -440,6 +441,7 @@ static void prune_icache(int nr_to_scan) + continue; + } + list_move(&inode->i_list, &freeable); ++ WARN_ON(inode->i_state & I_NEW); + inode->i_state |= I_FREEING; + nr_pruned++; + } +@@ -595,6 +597,7 @@ void unlock_new_inode(struct inode *inod + * just created it (so there can be no old holders + * that haven't tested I_LOCK). + */ ++ WARN_ON((inode->i_state & (I_LOCK|I_NEW)) != (I_LOCK|I_NEW)); + inode->i_state &= ~(I_LOCK|I_NEW); + wake_up_inode(inode); + } +@@ -1041,6 +1044,7 @@ void generic_delete_inode(struct inode * + + list_del_init(&inode->i_list); + list_del_init(&inode->i_sb_list); ++ WARN_ON(inode->i_state & I_NEW); + inode->i_state |= I_FREEING; + inodes_stat.nr_inodes--; + spin_unlock(&inode_lock); +@@ -1082,16 +1086,19 @@ static void generic_forget_inode(struct + spin_unlock(&inode_lock); + return; + } ++ WARN_ON(inode->i_state & I_NEW); + inode->i_state |= I_WILL_FREE; + spin_unlock(&inode_lock); + write_inode_now(inode, 1); + spin_lock(&inode_lock); ++ WARN_ON(inode->i_state & I_NEW); + inode->i_state &= ~I_WILL_FREE; + inodes_stat.nr_unused--; + hlist_del_init(&inode->i_hash); + } + list_del_init(&inode->i_list); + list_del_init(&inode->i_sb_list); ++ WARN_ON(inode->i_state & I_NEW); + inode->i_state |= I_FREEING; + inodes_stat.nr_inodes--; + spin_unlock(&inode_lock); diff --git a/queue-2.6.27/hpilo-new-pci-device.patch b/queue-2.6.27/hpilo-new-pci-device.patch new file mode 100644 index 00000000000..e60e3e89c35 --- /dev/null +++ b/queue-2.6.27/hpilo-new-pci-device.patch @@ -0,0 +1,30 @@ +From 31d8b5631f095cb7100cfccc95c801a2547ffe2b Mon Sep 17 00:00:00 2001 +From: David Altobelli +Date: Fri, 27 Feb 2009 14:03:09 -0800 +Subject: hpilo: new pci device + +From: David Altobelli + +commit 31d8b5631f095cb7100cfccc95c801a2547ffe2b upstream. + +Future iLO devices will have an HP vendor id. + +Signed-off-by: David Altobelli +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/misc/hpilo.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/misc/hpilo.c ++++ b/drivers/misc/hpilo.c +@@ -710,6 +710,7 @@ out: + + static struct pci_device_id ilo_devices[] = { + { PCI_DEVICE(PCI_VENDOR_ID_COMPAQ, 0xB204) }, ++ { PCI_DEVICE(PCI_VENDOR_ID_HP, 0x3307) }, + { } + }; + MODULE_DEVICE_TABLE(pci, ilo_devices); diff --git a/queue-2.6.27/inotify-fix-gfp_kernel-related-deadlock.patch b/queue-2.6.27/inotify-fix-gfp_kernel-related-deadlock.patch new file mode 100644 index 00000000000..2c421120b6e --- /dev/null +++ b/queue-2.6.27/inotify-fix-gfp_kernel-related-deadlock.patch @@ -0,0 +1,96 @@ +From f04b30de3c82528f1ab4c58b3dd4c975f5341901 Mon Sep 17 00:00:00 2001 +From: Ingo Molnar +Date: Wed, 18 Feb 2009 14:48:43 -0800 +Subject: inotify: fix GFP_KERNEL related deadlock + +From: Ingo Molnar + +commit f04b30de3c82528f1ab4c58b3dd4c975f5341901 upstream. + +Enhanced lockdep coverage of __GFP_NOFS turned up this new lockdep +assert: + +[ 1093.677775] +[ 1093.677781] ================================= +[ 1093.680031] [ INFO: inconsistent lock state ] +[ 1093.680031] 2.6.29-rc5-tip-01504-gb49eca1-dirty #1 +[ 1093.680031] --------------------------------- +[ 1093.680031] inconsistent {RECLAIM_FS-ON-W} -> {IN-RECLAIM_FS-W} usage. +[ 1093.680031] kswapd0/308 [HC0[0]:SC0[0]:HE1:SE1] takes: +[ 1093.680031] (&inode->inotify_mutex){+.+.?.}, at: [] inotify_inode_is_dead+0x20/0x80 +[ 1093.680031] {RECLAIM_FS-ON-W} state was registered at: +[ 1093.680031] [] mark_held_locks+0x43/0x5b +[ 1093.680031] [] lockdep_trace_alloc+0x6c/0x6e +[ 1093.680031] [] kmem_cache_alloc+0x20/0x150 +[ 1093.680031] [] idr_pre_get+0x27/0x6c +[ 1093.680031] [] inotify_handle_get_wd+0x25/0xad +[ 1093.680031] [] inotify_add_watch+0x7a/0x129 +[ 1093.680031] [] sys_inotify_add_watch+0x20f/0x250 +[ 1093.680031] [] sysenter_do_call+0x12/0x35 +[ 1093.680031] [] 0xffffffff +[ 1093.680031] irq event stamp: 60417 +[ 1093.680031] hardirqs last enabled at (60417): [] call_rcu+0x53/0x59 +[ 1093.680031] hardirqs last disabled at (60416): [] call_rcu+0x17/0x59 +[ 1093.680031] softirqs last enabled at (59656): [] __do_softirq+0x157/0x16b +[ 1093.680031] softirqs last disabled at (59651): [] do_softirq+0x74/0x15d +[ 1093.680031] +[ 1093.680031] other info that might help us debug this: +[ 1093.680031] 2 locks held by kswapd0/308: +[ 1093.680031] #0: (shrinker_rwsem){++++..}, at: [] shrink_slab+0x36/0x189 +[ 1093.680031] #1: (&type->s_umount_key#4){+++++.}, at: [] shrink_dcache_memory+0x110/0x1fb +[ 1093.680031] +[ 1093.680031] stack backtrace: +[ 1093.680031] Pid: 308, comm: kswapd0 Not tainted 2.6.29-rc5-tip-01504-gb49eca1-dirty #1 +[ 1093.680031] Call Trace: +[ 1093.680031] [] valid_state+0x12a/0x13d +[ 1093.680031] [] mark_lock+0xc1/0x1e9 +[ 1093.680031] [] ? check_usage_forwards+0x0/0x3f +[ 1093.680031] [] __lock_acquire+0x2c6/0xac8 +[ 1093.680031] [] ? register_lock_class+0x17/0x228 +[ 1093.680031] [] lock_acquire+0x5d/0x7a +[ 1093.680031] [] ? inotify_inode_is_dead+0x20/0x80 +[ 1093.680031] [] __mutex_lock_common+0x3a/0x4cb +[ 1093.680031] [] ? inotify_inode_is_dead+0x20/0x80 +[ 1093.680031] [] mutex_lock_nested+0x2e/0x36 +[ 1093.680031] [] ? inotify_inode_is_dead+0x20/0x80 +[ 1093.680031] [] inotify_inode_is_dead+0x20/0x80 +[ 1093.680031] [] dentry_iput+0x90/0xc2 +[ 1093.680031] [] d_kill+0x21/0x45 +[ 1093.680031] [] __shrink_dcache_sb+0x27f/0x355 +[ 1093.680031] [] shrink_dcache_memory+0x15e/0x1fb +[ 1093.680031] [] shrink_slab+0x121/0x189 +[ 1093.680031] [] kswapd+0x39f/0x561 +[ 1093.680031] [] ? isolate_pages_global+0x0/0x233 +[ 1093.680031] [] ? autoremove_wake_function+0x0/0x43 +[ 1093.680031] [] ? kswapd+0x0/0x561 +[ 1093.680031] [] kthread+0x41/0x82 +[ 1093.680031] [] ? kthread+0x0/0x82 +[ 1093.680031] [] kernel_thread_helper+0x7/0x10 + +inotify_handle_get_wd() does idr_pre_get() which does a +kmem_cache_alloc() without __GFP_FS - and is hence deadlockable under +extreme MM pressure. + +Signed-off-by: Ingo Molnar +Acked-by: Peter Zijlstra +Cc: MinChan Kim +Cc: Nick Piggin +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + fs/inotify.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/inotify.c ++++ b/fs/inotify.c +@@ -156,7 +156,7 @@ static int inotify_handle_get_wd(struct + int ret; + + do { +- if (unlikely(!idr_pre_get(&ih->idr, GFP_KERNEL))) ++ if (unlikely(!idr_pre_get(&ih->idr, GFP_NOFS))) + return -ENOSPC; + ret = idr_get_new_above(&ih->idr, watch, ih->last_wd+1, &watch->wd); + } while (ret == -EAGAIN); diff --git a/queue-2.6.27/intel-agp-fix-a-panic-with-1m-of-shared-memory-no-gtt-entries.patch b/queue-2.6.27/intel-agp-fix-a-panic-with-1m-of-shared-memory-no-gtt-entries.patch new file mode 100644 index 00000000000..93284293d5f --- /dev/null +++ b/queue-2.6.27/intel-agp-fix-a-panic-with-1m-of-shared-memory-no-gtt-entries.patch @@ -0,0 +1,50 @@ +From 9c1e8a4ebcc04226cb6f3a1bf1d72f4cafd6b089 Mon Sep 17 00:00:00 2001 +From: Lubomir Rintel +Date: Tue, 10 Mar 2009 12:55:54 -0700 +Subject: intel-agp: fix a panic with 1M of shared memory, no GTT entries + +From: Lubomir Rintel + +commit 9c1e8a4ebcc04226cb6f3a1bf1d72f4cafd6b089 upstream. + +When GTT size is equal to amount of video memory, the amount of GTT +entries is computed lower than zero, which is invalid and leads to +off-by-one error in intel_i915_configure() + +Originally posted here: +http://bugzilla.kernel.org/show_bug.cgi?id=12539 +http://bugzilla.redhat.com/show_bug.cgi?id=445592 + +Signed-off-by: Lubomir Rintel +Cc: Lubomir Rintel +Cc: Dave Airlie +Reviewed-by: Eric Anholt +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/char/agp/intel-agp.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +--- a/drivers/char/agp/intel-agp.c ++++ b/drivers/char/agp/intel-agp.c +@@ -633,13 +633,15 @@ static void intel_i830_init_gtt_entries( + break; + } + } +- if (gtt_entries > 0) ++ if (gtt_entries > 0) { + dev_info(&agp_bridge->dev->dev, "detected %dK %s memory\n", + gtt_entries / KB(1), local ? "local" : "stolen"); +- else ++ gtt_entries /= KB(4); ++ } else { + dev_info(&agp_bridge->dev->dev, + "no pre-allocated video memory detected\n"); +- gtt_entries /= KB(4); ++ gtt_entries = 0; ++ } + + intel_private.gtt_entries = gtt_entries; + } diff --git a/queue-2.6.27/jsm-additional-device-support.patch b/queue-2.6.27/jsm-additional-device-support.patch new file mode 100644 index 00000000000..27402c3ea14 --- /dev/null +++ b/queue-2.6.27/jsm-additional-device-support.patch @@ -0,0 +1,56 @@ +From ffa7525c13eb3db0fd19a3e1cffe2ce6f561f5f3 Mon Sep 17 00:00:00 2001 +From: Adam Lackorzynski +Date: Wed, 18 Feb 2009 14:48:34 -0800 +Subject: jsm: additional device support + +From: Adam Lackorzynski + +commit ffa7525c13eb3db0fd19a3e1cffe2ce6f561f5f3 upstream. + +I have a Digi Neo 8 PCI card (114f:00b1) Serial controller: Digi +International Digi Neo 8 (rev 05) + +that works with the jsm driver after using the following patch. + +Signed-off-by: Adam Lackorzynski +Cc: Scott H Kilau +Cc: Wendy Xiong +Acked-by: Alan Cox +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/serial/jsm/jsm_driver.c | 3 +++ + include/linux/pci_ids.h | 1 + + 2 files changed, 4 insertions(+) + +--- a/drivers/serial/jsm/jsm_driver.c ++++ b/drivers/serial/jsm/jsm_driver.c +@@ -84,6 +84,8 @@ static int jsm_probe_one(struct pci_dev + brd->pci_dev = pdev; + if (pdev->device == PCIE_DEVICE_ID_NEO_4_IBM) + brd->maxports = 4; ++ else if (pdev->device == PCI_DEVICE_ID_DIGI_NEO_8) ++ brd->maxports = 8; + else + brd->maxports = 2; + +@@ -212,6 +214,7 @@ static struct pci_device_id jsm_pci_tbl[ + { PCI_DEVICE(PCI_VENDOR_ID_DIGI, PCI_DEVICE_ID_NEO_2RJ45), 0, 0, 2 }, + { PCI_DEVICE(PCI_VENDOR_ID_DIGI, PCI_DEVICE_ID_NEO_2RJ45PRI), 0, 0, 3 }, + { PCI_DEVICE(PCI_VENDOR_ID_DIGI, PCIE_DEVICE_ID_NEO_4_IBM), 0, 0, 4 }, ++ { PCI_DEVICE(PCI_VENDOR_ID_DIGI, PCI_DEVICE_ID_DIGI_NEO_8), 0, 0, 5 }, + { 0, } + }; + MODULE_DEVICE_TABLE(pci, jsm_pci_tbl); +--- a/include/linux/pci_ids.h ++++ b/include/linux/pci_ids.h +@@ -1432,6 +1432,7 @@ + #define PCI_DEVICE_ID_DIGI_DF_M_E 0x0071 + #define PCI_DEVICE_ID_DIGI_DF_M_IOM2_A 0x0072 + #define PCI_DEVICE_ID_DIGI_DF_M_A 0x0073 ++#define PCI_DEVICE_ID_DIGI_NEO_8 0x00B1 + #define PCI_DEVICE_ID_NEO_2DB9 0x00C8 + #define PCI_DEVICE_ID_NEO_2DB9PRI 0x00C9 + #define PCI_DEVICE_ID_NEO_2RJ45 0x00CA diff --git a/queue-2.6.27/libata-don-t-trust-current-capacity-values-in-identify-words-57-58.patch b/queue-2.6.27/libata-don-t-trust-current-capacity-values-in-identify-words-57-58.patch new file mode 100644 index 00000000000..3f1efd41cc6 --- /dev/null +++ b/queue-2.6.27/libata-don-t-trust-current-capacity-values-in-identify-words-57-58.patch @@ -0,0 +1,59 @@ +From 968e594afdbc40b4270f9d4032ae8350475749d6 Mon Sep 17 00:00:00 2001 +From: Robert Hancock +Date: Mon, 16 Feb 2009 20:15:08 -0600 +Subject: libata: Don't trust current capacity values in identify words 57-58 +MIME-Version: 1.0 +Content-Type: text/plain; charset=utf-8 +Content-Transfer-Encoding: 8bit + +From: Robert Hancock + +commit 968e594afdbc40b4270f9d4032ae8350475749d6 upstream. + +Hanno Böck reported a problem where an old Conner CP30254 240MB hard drive +was reported as 1.1TB in capacity by libata: + +http://lkml.org/lkml/2009/2/13/134 + +This was caused by libata trusting the drive's reported current capacity in +sectors in identify words 57 and 58 if the drive does not support LBA and the +current CHS translation values appear valid. Unfortunately it seems older +ATA specs were vague about what this field should contain and a number of drives +used values with wrong byte order or that were totally bogus. There's no +unique information that it conveys and so we can just calculate the number +of sectors from the reported current CHS values. + +While we're at it, clean up this function to use named constants for the +identify word values. + +Signed-off-by: Robert Hancock +Signed-off-by: Jeff Garzik +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ata/libata-core.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +--- a/drivers/ata/libata-core.c ++++ b/drivers/ata/libata-core.c +@@ -1190,14 +1190,16 @@ static u64 ata_id_n_sectors(const u16 *i + { + if (ata_id_has_lba(id)) { + if (ata_id_has_lba48(id)) +- return ata_id_u64(id, 100); ++ return ata_id_u64(id, ATA_ID_LBA_CAPACITY_2); + else +- return ata_id_u32(id, 60); ++ return ata_id_u32(id, ATA_ID_LBA_CAPACITY); + } else { + if (ata_id_current_chs_valid(id)) +- return ata_id_u32(id, 57); ++ return id[ATA_ID_CUR_CYLS] * id[ATA_ID_CUR_HEADS] * ++ id[ATA_ID_CUR_SECTORS]; + else +- return id[1] * id[3] * id[6]; ++ return id[ATA_ID_CYLS] * id[ATA_ID_HEADS] * ++ id[ATA_ID_SECTORS]; + } + } + diff --git a/queue-2.6.27/libata-make-sure-port-is-thawed-when-skipping-resets.patch b/queue-2.6.27/libata-make-sure-port-is-thawed-when-skipping-resets.patch new file mode 100644 index 00000000000..d7cd466ba18 --- /dev/null +++ b/queue-2.6.27/libata-make-sure-port-is-thawed-when-skipping-resets.patch @@ -0,0 +1,64 @@ +From d6515e6ff4ad3db4bd5ef2dd4e1026a7aca2482e Mon Sep 17 00:00:00 2001 +From: Tejun Heo +Date: Wed, 4 Mar 2009 15:59:30 +0900 +Subject: libata: make sure port is thawed when skipping resets + +From: Tejun Heo + +commit d6515e6ff4ad3db4bd5ef2dd4e1026a7aca2482e upstream. + +When SCR access is available and the link is offline, softreset is +skipped as it only wastes time and some controllers don't respond very +well. However, the skip path forgot to thaw the port, which not only +blocks further event notification from the port but also causes +repeated EH invocations on the same event on drivers which rely on +->thaw() to clear events if the IRQ is shared with another device or +port. + +This problem has always been there but is uncovered by recent sata_nv +nf2/3 change which dropped hardreset support while maintaining SCR +access. nf2/3 doesn't clear hotplug event mask from the interrupt +handler but relies on ->thaw() to clear them. When the hardreset was +there, the reset action was never skipped and the port was always +thawed but, with the hardreset gone, ->prereset() determines that +there's no need for softreset and both ->softreset() and ->thaw() are +skipped. This leads to stuck hotplug event in the IRQ status register +triggering hotplug event whenever IRQ is delieverd on the same IRQ. +As the controller shares the same IRQ for both ports, this happens on +every IO if one port is occpupied and the other isn't. + +This patch fixes the problem by making sure that the port is thawed on +reset-skip path. + +bko#11615 reports this problem. + +Signed-off-by: Tejun Heo +Cc: Robert Hancock +Reported-by: Dan Andresan +Reported-by: Arne Woerner +Reported-by: Stefan Lippers-Hollmann +Signed-off-by: Jeff Garzik +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ata/libata-eh.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/drivers/ata/libata-eh.c ++++ b/drivers/ata/libata-eh.c +@@ -2272,11 +2272,14 @@ int ata_eh_reset(struct ata_link *link, + } + + /* prereset() might have cleared ATA_EH_RESET. If so, +- * bang classes and return. ++ * bang classes, thaw and return. + */ + if (reset && !(ehc->i.action & ATA_EH_RESET)) { + ata_link_for_each_dev(dev, link) + classes[dev->devno] = ATA_DEV_NONE; ++ if ((ap->pflags & ATA_PFLAG_FROZEN) && ++ ata_is_host_link(link)) ++ ata_eh_thaw_port(ap); + rc = 0; + goto out; + } diff --git a/queue-2.6.27/md-avoid-races-when-stopping-resync.patch b/queue-2.6.27/md-avoid-races-when-stopping-resync.patch new file mode 100644 index 00000000000..dc7cd2811eb --- /dev/null +++ b/queue-2.6.27/md-avoid-races-when-stopping-resync.patch @@ -0,0 +1,87 @@ +From 73d5c38a9536142e062c35997b044e89166e063b Mon Sep 17 00:00:00 2001 +From: NeilBrown +Date: Wed, 25 Feb 2009 13:18:47 +1100 +Subject: md: avoid races when stopping resync. + +From: NeilBrown + +commit 73d5c38a9536142e062c35997b044e89166e063b upstream. + +There has been a race in raid10 and raid1 for a long time +which has only recently started showing up due to a scheduler changed. + +When a sync_read request finishes, as soon as reschedule_retry +is called, another thread can mark the resync request as having +completed, so md_do_sync can finish, ->stop can be called, and +->conf can be freed. So using conf after reschedule_retry is not +safe. + +Similarly, when finishing a sync_write, calling md_done_sync must be +the last thing we do, as it allows a chain of events which will free +conf and other data structures. + +The first of these requires action in raid10.c +The second requires action in raid1.c and raid10.c + +Signed-off-by: NeilBrown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/raid1.c | 3 ++- + drivers/md/raid10.c | 7 ++++--- + 2 files changed, 6 insertions(+), 4 deletions(-) + +--- a/drivers/md/raid10.c ++++ b/drivers/md/raid10.c +@@ -1231,6 +1231,7 @@ static void end_sync_read(struct bio *bi + /* for reconstruct, we always reschedule after a read. + * for resync, only after all reads + */ ++ rdev_dec_pending(conf->mirrors[d].rdev, conf->mddev); + if (test_bit(R10BIO_IsRecover, &r10_bio->state) || + atomic_dec_and_test(&r10_bio->remaining)) { + /* we have read all the blocks, +@@ -1238,7 +1239,6 @@ static void end_sync_read(struct bio *bi + */ + reschedule_retry(r10_bio); + } +- rdev_dec_pending(conf->mirrors[d].rdev, conf->mddev); + } + + static void end_sync_write(struct bio *bio, int error) +@@ -1259,11 +1259,13 @@ static void end_sync_write(struct bio *b + + update_head_pos(i, r10_bio); + ++ rdev_dec_pending(conf->mirrors[d].rdev, mddev); + while (atomic_dec_and_test(&r10_bio->remaining)) { + if (r10_bio->master_bio == NULL) { + /* the primary of several recovery bios */ +- md_done_sync(mddev, r10_bio->sectors, 1); ++ sector_t s = r10_bio->sectors; + put_buf(r10_bio); ++ md_done_sync(mddev, s, 1); + break; + } else { + r10bio_t *r10_bio2 = (r10bio_t *)r10_bio->master_bio; +@@ -1271,7 +1273,6 @@ static void end_sync_write(struct bio *b + r10_bio = r10_bio2; + } + } +- rdev_dec_pending(conf->mirrors[d].rdev, mddev); + } + + /* +--- a/drivers/md/raid1.c ++++ b/drivers/md/raid1.c +@@ -1229,8 +1229,9 @@ static void end_sync_write(struct bio *b + update_head_pos(mirror, r1_bio); + + if (atomic_dec_and_test(&r1_bio->remaining)) { +- md_done_sync(mddev, r1_bio->sectors, uptodate); ++ sector_t s = r1_bio->sectors; + put_buf(r1_bio); ++ md_done_sync(mddev, s, uptodate); + } + } + diff --git a/queue-2.6.27/md-raid10-don-t-call-bitmap_cond_end_sync-when-we-are-doing-recovery.patch b/queue-2.6.27/md-raid10-don-t-call-bitmap_cond_end_sync-when-we-are-doing-recovery.patch new file mode 100644 index 00000000000..8b22f72d373 --- /dev/null +++ b/queue-2.6.27/md-raid10-don-t-call-bitmap_cond_end_sync-when-we-are-doing-recovery.patch @@ -0,0 +1,56 @@ +From 78200d45cde2a79c0d0ae0407883bb264caa3c18 Mon Sep 17 00:00:00 2001 +From: NeilBrown +Date: Wed, 25 Feb 2009 13:18:47 +1100 +Subject: md/raid10: Don't call bitmap_cond_end_sync when we are doing recovery. + +From: NeilBrown + +commit 78200d45cde2a79c0d0ae0407883bb264caa3c18 upstream. + +For raid1/4/5/6, resync (fixing inconsistencies between devices) is +very similar to recovery (rebuilding a failed device onto a spare). +The both walk through the device addresses in order. + +For raid10 it can be quite different. resync follows the 'array' +address, and makes sure all copies are the same. Recover walks +through 'device' addresses and recreates each missing block. + +The 'bitmap_cond_end_sync' function allows the write-intent-bitmap +(When present) to be updated to reflect a partially completed resync. +It makes assumptions which mean that it does not work correctly for +raid10 recovery at all. + +In particularly, it can cause bitmap-directed recovery of a raid10 to +not recovery some of the blocks that need to be recovered. + +So move the call to bitmap_cond_end_sync into the resync path, rather +than being in the common "resync or recovery" path. + + +Signed-off-by: NeilBrown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/raid10.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/md/raid10.c ++++ b/drivers/md/raid10.c +@@ -1748,8 +1748,6 @@ static sector_t sync_request(mddev_t *md + if (!go_faster && conf->nr_waiting) + msleep_interruptible(1000); + +- bitmap_cond_end_sync(mddev->bitmap, sector_nr); +- + /* Again, very different code for resync and recovery. + * Both must result in an r10bio with a list of bios that + * have bi_end_io, bi_sector, bi_bdev set, +@@ -1885,6 +1883,8 @@ static sector_t sync_request(mddev_t *md + /* resync. Schedule a read for every block at this virt offset */ + int count = 0; + ++ bitmap_cond_end_sync(mddev->bitmap, sector_nr); ++ + if (!bitmap_start_sync(mddev->bitmap, sector_nr, + &sync_blocks, mddev->degraded) && + !conf->fullsync && !test_bit(MD_RECOVERY_REQUESTED, &mddev->recovery)) { diff --git a/queue-2.6.27/md-raid10-don-t-skip-more-than-1-bitmap-chunk-at-a-time-during-recovery.patch b/queue-2.6.27/md-raid10-don-t-skip-more-than-1-bitmap-chunk-at-a-time-during-recovery.patch new file mode 100644 index 00000000000..15925992728 --- /dev/null +++ b/queue-2.6.27/md-raid10-don-t-skip-more-than-1-bitmap-chunk-at-a-time-during-recovery.patch @@ -0,0 +1,55 @@ +From 09b4068a7fe442efc40e9dcbcf5ff37c3338ab15 Mon Sep 17 00:00:00 2001 +From: NeilBrown +Date: Wed, 25 Feb 2009 13:18:47 +1100 +Subject: md/raid10: Don't skip more than 1 bitmap-chunk at a time during recovery. + +From: NeilBrown + +commit 09b4068a7fe442efc40e9dcbcf5ff37c3338ab15 upstream. + +When doing recovery on a raid10 with a write-intent bitmap, we only +need to recovery chunks that are flagged in the bitmap. + +However if we choose to skip a chunk as it isn't flag, the code +currently skips the whole raid10-chunk, thus it might not recovery +some blocks that need recovering. + +This patch fixes it. + +In case that is confusing, it might help to understand that there +is a 'raid10 chunk size' which guides how data is distributed across +the devices, and a 'bitmap chunk size' which says how much data +corresponds to a single bit in the bitmap. + +This bug only affects cases where the bitmap chunk size is smaller +than the raid10 chunk size. + + + +Signed-off-by: NeilBrown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/raid10.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/md/raid10.c ++++ b/drivers/md/raid10.c +@@ -2010,13 +2010,13 @@ static sector_t sync_request(mddev_t *md + /* There is nowhere to write, so all non-sync + * drives must be failed, so try the next chunk... + */ +- { +- sector_t sec = max_sector - sector_nr; +- sectors_skipped += sec; ++ if (sector_nr + max_sync < max_sector) ++ max_sector = sector_nr + max_sync; ++ ++ sectors_skipped += (max_sector - sector_nr); + chunks_skipped ++; + sector_nr = max_sector; + goto skipped; +- } + } + + static int run(mddev_t *mddev) diff --git a/queue-2.6.27/mmc-s3cmci-fix-s3c2410_dma_config-arguments.patch b/queue-2.6.27/mmc-s3cmci-fix-s3c2410_dma_config-arguments.patch new file mode 100644 index 00000000000..9814ca092cc --- /dev/null +++ b/queue-2.6.27/mmc-s3cmci-fix-s3c2410_dma_config-arguments.patch @@ -0,0 +1,36 @@ +From 7c48ed3383bfb2106694807361ec187fe8a4333d Mon Sep 17 00:00:00 2001 +From: Ben Dooks +Date: Thu, 12 Mar 2009 14:31:33 -0700 +Subject: mmc: s3cmci: fix s3c2410_dma_config() arguments. + +From: Ben Dooks + +commit 7c48ed3383bfb2106694807361ec187fe8a4333d upstream. + +The s3cmci driver is calling s3c2410_dma_config with incorrect data for +the DCON register. The S3C2410_DCON_HWTRIG is implicit in the channel +configuration and the device selection of S3C2410_DCON_CH0_SDI is +incorrect as the DMA system may not select channel 0. + +Signed-off-by: Ben Dooks +Acked-by: Pierre Ossman +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mmc/host/s3cmci.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/drivers/mmc/host/s3cmci.c ++++ b/drivers/mmc/host/s3cmci.c +@@ -756,8 +756,7 @@ static void s3cmci_dma_setup(struct s3cm + host->mem->start + host->sdidata); + + if (!setup_ok) { +- s3c2410_dma_config(host->dma, 4, +- (S3C2410_DCON_HWTRIG | S3C2410_DCON_CH0_SDI)); ++ s3c2410_dma_config(host->dma, 4, 0); + s3c2410_dma_set_buffdone_fn(host->dma, + s3cmci_dma_done_callback); + s3c2410_dma_setflags(host->dma, S3C2410_DMAF_AUTOSTART); diff --git a/queue-2.6.27/mmc_test-fix-basic-read-test.patch b/queue-2.6.27/mmc_test-fix-basic-read-test.patch new file mode 100644 index 00000000000..fe4c948c7bf --- /dev/null +++ b/queue-2.6.27/mmc_test-fix-basic-read-test.patch @@ -0,0 +1,31 @@ +From 58a5dd3e0e77029d3db1f8fa75d0b54b38169d5d Mon Sep 17 00:00:00 2001 +From: Rabin Vincent +Date: Fri, 13 Feb 2009 22:55:26 +0530 +Subject: mmc_test: fix basic read test + +From: Rabin Vincent + +commit 58a5dd3e0e77029d3db1f8fa75d0b54b38169d5d upstream. + +Due to a typo in the Basic Read test, it's currently identical to the +Basic Write test. Fix this. + +Signed-off-by: Rabin Vincent +Signed-off-by: Pierre Ossman +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mmc/card/mmc_test.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/mmc/card/mmc_test.c ++++ b/drivers/mmc/card/mmc_test.c +@@ -494,7 +494,7 @@ static int mmc_test_basic_read(struct mm + + sg_init_one(&sg, test->buffer, 512); + +- ret = mmc_test_simple_transfer(test, &sg, 1, 0, 1, 512, 1); ++ ret = mmc_test_simple_transfer(test, &sg, 1, 0, 1, 512, 0); + if (ret) + return ret; + diff --git a/queue-2.6.27/mtd_dataflash-fix-probing-of-at45db321c-chips.patch b/queue-2.6.27/mtd_dataflash-fix-probing-of-at45db321c-chips.patch new file mode 100644 index 00000000000..642e9760c8a --- /dev/null +++ b/queue-2.6.27/mtd_dataflash-fix-probing-of-at45db321c-chips.patch @@ -0,0 +1,38 @@ +From 229cc58ba2b5a83b0b55764c6cb98695c106238a Mon Sep 17 00:00:00 2001 +From: Will Newton +Date: Tue, 10 Mar 2009 12:55:53 -0700 +Subject: mtd_dataflash: fix probing of AT45DB321C chips. + +From: Will Newton + +commit 229cc58ba2b5a83b0b55764c6cb98695c106238a upstream. + +Commit 771999b65f79264acde4b855e5d35696eca5e80c ("[MTD] DataFlash: bugfix, +binary page sizes now handled") broke support for probing AT45DB321C flash +chips. These chips do not support the "page size" status bit, so if we +match the JEDEC id return early. + +[akpm@linux-foundation.org: coding-style fixes] +Signed-off-by: Will Newton +Cc: David Woodhouse +Acked-by: David Brownell +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mtd/devices/mtd_dataflash.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/mtd/devices/mtd_dataflash.c ++++ b/drivers/mtd/devices/mtd_dataflash.c +@@ -628,7 +628,8 @@ static struct flash_info *__devinit jede + if (!(info->flags & IS_POW2PS)) + return info; + } +- } ++ } else ++ return info; + } + } + diff --git a/queue-2.6.27/pci-add-pci-quirk-to-disable-l0s-aspm-state-for-82575-and-82598.patch b/queue-2.6.27/pci-add-pci-quirk-to-disable-l0s-aspm-state-for-82575-and-82598.patch new file mode 100644 index 00000000000..a6874400723 --- /dev/null +++ b/queue-2.6.27/pci-add-pci-quirk-to-disable-l0s-aspm-state-for-82575-and-82598.patch @@ -0,0 +1,72 @@ +From 649426efcfbc67a8b033497151816cbac9fd0cfa Mon Sep 17 00:00:00 2001 +From: Alexander Duyck +Date: Thu, 5 Mar 2009 13:57:28 -0500 +Subject: PCI: Add PCI quirk to disable L0s ASPM state for 82575 and 82598 + +From: Alexander Duyck + +commit 649426efcfbc67a8b033497151816cbac9fd0cfa upstream. + +This patch is intended to disable L0s ASPM link state for 82598 (ixgbe) +parts due to the fact that it is possible to corrupt TX data when coming +back out of L0s on some systems. The workaround had been added for 82575 +(igb) previously, but did not use the ASPM api. This quirk uses the ASPM +api to prevent the ASPM subsystem from re-enabling the L0s state. + +Instead of adding the fix in igb to the ixgbe driver as well it was +decided to move it into a pci quirk. It is necessary to move the fix out +of the driver and into a pci quirk in order to prevent the issue from +occuring prior to driver load to handle the possibility of the device being +passed to a VM via direct assignment. + +Signed-off-by: Alexander Duyck +Signed-off-by: Jeff Kirsher +CC: Jesse Barnes +Signed-off-by: Matthew Wilcox +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pci/quirks.c | 25 +++++++++++++++++++++++++ + 1 file changed, 25 insertions(+) + +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -22,6 +22,7 @@ + #include + #include + #include ++#include + #include "pci.h" + + /* The Mellanox Tavor device gives false positive parity errors +@@ -1542,6 +1543,30 @@ static void __devinit quirk_e100_interru + } + DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, PCI_ANY_ID, quirk_e100_interrupt); + ++/* ++ * The 82575 and 82598 may experience data corruption issues when transitioning ++ * out of L0S. To prevent this we need to disable L0S on the pci-e link ++ */ ++static void __devinit quirk_disable_aspm_l0s(struct pci_dev *dev) ++{ ++ dev_info(&dev->dev, "Disabling L0s\n"); ++ pci_disable_link_state(dev, PCIE_LINK_STATE_L0S); ++} ++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x10a7, quirk_disable_aspm_l0s); ++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x10a9, quirk_disable_aspm_l0s); ++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x10b6, quirk_disable_aspm_l0s); ++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x10c6, quirk_disable_aspm_l0s); ++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x10c7, quirk_disable_aspm_l0s); ++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x10c8, quirk_disable_aspm_l0s); ++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x10d6, quirk_disable_aspm_l0s); ++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x10db, quirk_disable_aspm_l0s); ++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x10dd, quirk_disable_aspm_l0s); ++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x10e1, quirk_disable_aspm_l0s); ++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x10ec, quirk_disable_aspm_l0s); ++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x10f1, quirk_disable_aspm_l0s); ++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x10f4, quirk_disable_aspm_l0s); ++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x1508, quirk_disable_aspm_l0s); ++ + static void __devinit fixup_rev1_53c810(struct pci_dev* dev) + { + /* rev 1 ncr53c810 chips don't set the class at all which means diff --git a/queue-2.6.27/pci-don-t-enable-too-many-ht-msi-mappings.patch b/queue-2.6.27/pci-don-t-enable-too-many-ht-msi-mappings.patch new file mode 100644 index 00000000000..8817ea39331 --- /dev/null +++ b/queue-2.6.27/pci-don-t-enable-too-many-ht-msi-mappings.patch @@ -0,0 +1,164 @@ +From 1dec6b054dd1fc780e18b815068bf5677409eb2d Mon Sep 17 00:00:00 2001 +From: Yinghai Lu +Date: Mon, 23 Feb 2009 11:51:59 -0800 +Subject: PCI: don't enable too many HT MSI mappings + +From: Yinghai Lu + +commit 1dec6b054dd1fc780e18b815068bf5677409eb2d upstream. + +Prakash reported that his c51-mcp51 ondie sound card doesn't work with +MSI. But if he hacks out the HT-MSI quirk, MSI works fine. + +So this patch reworks the nv_msi_ht_cap_quirk(). It will now only +enable ht_msi on own its root device, avoiding enabling it on devices +following that root dev. + +Reported-by: Prakash Punnoor +Tested-by: Prakash Punnoor +Signed-off-by: Yinghai Lu +Signed-off-by: Jesse Barnes +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pci/quirks.c | 115 ++++++++++++++++++++++++++++++++++++++++++++------- + 1 file changed, 100 insertions(+), 15 deletions(-) + +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -1934,10 +1934,100 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_S + DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_8132_BRIDGE, + ht_enable_msi_mapping); + +-static void __devinit nv_msi_ht_cap_quirk(struct pci_dev *dev) ++static void __devinit nv_ht_enable_msi_mapping(struct pci_dev *dev) + { + struct pci_dev *host_bridge; ++ int pos; ++ int i, dev_no; ++ int found = 0; ++ ++ dev_no = dev->devfn >> 3; ++ for (i = dev_no; i >= 0; i--) { ++ host_bridge = pci_get_slot(dev->bus, PCI_DEVFN(i, 0)); ++ if (!host_bridge) ++ continue; ++ ++ pos = pci_find_ht_capability(host_bridge, HT_CAPTYPE_SLAVE); ++ if (pos != 0) { ++ found = 1; ++ break; ++ } ++ pci_dev_put(host_bridge); ++ } ++ ++ if (!found) ++ return; ++ ++ /* root did that ! */ ++ if (msi_ht_cap_enabled(host_bridge)) ++ goto out; ++ ++ ht_enable_msi_mapping(dev); ++ ++out: ++ pci_dev_put(host_bridge); ++} ++ ++static void __devinit ht_disable_msi_mapping(struct pci_dev *dev) ++{ ++ int pos, ttl = 48; ++ ++ pos = pci_find_ht_capability(dev, HT_CAPTYPE_MSI_MAPPING); ++ while (pos && ttl--) { ++ u8 flags; ++ ++ if (pci_read_config_byte(dev, pos + HT_MSI_FLAGS, ++ &flags) == 0) { ++ dev_info(&dev->dev, "Enabling HT MSI Mapping\n"); ++ ++ pci_write_config_byte(dev, pos + HT_MSI_FLAGS, ++ flags & ~HT_MSI_FLAGS_ENABLE); ++ } ++ pos = pci_find_next_ht_capability(dev, pos, ++ HT_CAPTYPE_MSI_MAPPING); ++ } ++} ++ ++static int __devinit ht_check_msi_mapping(struct pci_dev *dev) ++{ + int pos, ttl = 48; ++ int found = 0; ++ ++ /* check if there is HT MSI cap or enabled on this device */ ++ pos = pci_find_ht_capability(dev, HT_CAPTYPE_MSI_MAPPING); ++ while (pos && ttl--) { ++ u8 flags; ++ ++ if (found < 1) ++ found = 1; ++ if (pci_read_config_byte(dev, pos + HT_MSI_FLAGS, ++ &flags) == 0) { ++ if (flags & HT_MSI_FLAGS_ENABLE) { ++ if (found < 2) { ++ found = 2; ++ break; ++ } ++ } ++ } ++ pos = pci_find_next_ht_capability(dev, pos, ++ HT_CAPTYPE_MSI_MAPPING); ++ } ++ ++ return found; ++} ++ ++static void __devinit nv_msi_ht_cap_quirk(struct pci_dev *dev) ++{ ++ struct pci_dev *host_bridge; ++ int pos; ++ int found; ++ ++ /* check if there is HT MSI cap or enabled on this device */ ++ found = ht_check_msi_mapping(dev); ++ ++ /* no HT MSI CAP */ ++ if (found == 0) ++ return; + + /* + * HT MSI mapping should be disabled on devices that are below +@@ -1953,24 +2043,19 @@ static void __devinit nv_msi_ht_cap_quir + pos = pci_find_ht_capability(host_bridge, HT_CAPTYPE_SLAVE); + if (pos != 0) { + /* Host bridge is to HT */ +- ht_enable_msi_mapping(dev); ++ if (found == 1) { ++ /* it is not enabled, try to enable it */ ++ nv_ht_enable_msi_mapping(dev); ++ } + return; + } + +- /* Host bridge is not to HT, disable HT MSI mapping on this device */ +- pos = pci_find_ht_capability(dev, HT_CAPTYPE_MSI_MAPPING); +- while (pos && ttl--) { +- u8 flags; ++ /* HT MSI is not enabled */ ++ if (found == 1) ++ return; + +- if (pci_read_config_byte(dev, pos + HT_MSI_FLAGS, +- &flags) == 0) { +- dev_info(&dev->dev, "Disabling HT MSI mapping"); +- pci_write_config_byte(dev, pos + HT_MSI_FLAGS, +- flags & ~HT_MSI_FLAGS_ENABLE); +- } +- pos = pci_find_next_ht_capability(dev, pos, +- HT_CAPTYPE_MSI_MAPPING); +- } ++ /* Host bridge is not to HT, disable HT MSI mapping on this device */ ++ ht_disable_msi_mapping(dev); + } + DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_NVIDIA, PCI_ANY_ID, nv_msi_ht_cap_quirk); + DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AL, PCI_ANY_ID, nv_msi_ht_cap_quirk); diff --git a/queue-2.6.27/pci-enable-pcie-aer-only-after-checking-firmware-support.patch b/queue-2.6.27/pci-enable-pcie-aer-only-after-checking-firmware-support.patch new file mode 100644 index 00000000000..33ac960af04 --- /dev/null +++ b/queue-2.6.27/pci-enable-pcie-aer-only-after-checking-firmware-support.patch @@ -0,0 +1,109 @@ +From 1f9f13c8d59c1d8da1a602b71d1ab96d1d37d69e Mon Sep 17 00:00:00 2001 +From: Andrew Patterson +Date: Fri, 20 Feb 2009 16:04:59 -0700 +Subject: PCI: Enable PCIe AER only after checking firmware support + +From: Andrew Patterson + +commit 1f9f13c8d59c1d8da1a602b71d1ab96d1d37d69e upstream. + +The PCIe port driver currently sets the PCIe AER error reporting bits for +any root or switch port without first checking to see if firmware will grant +control. This patch moves setting these bits to the AER service driver +aer_enable_port routine. The bits are then set for the root port and any +downstream switch ports after the check for firmware support (aer_osc_setup) +is made. The patch also unsets the bits in a similar fashion when the AER +service driver is unloaded. + +Reviewed-by: Alex Chiang +Signed-off-by: Andrew Patterson +Signed-off-by: Jesse Barnes +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pci/pcie/aer/aerdrv_core.c | 48 ++++++++++++++++++++++++++++++------- + drivers/pci/pcie/portdrv_pci.c | 2 - + 2 files changed, 39 insertions(+), 11 deletions(-) + +--- a/drivers/pci/pcie/aer/aerdrv_core.c ++++ b/drivers/pci/pcie/aer/aerdrv_core.c +@@ -134,6 +134,34 @@ int pci_cleanup_aer_correct_error_status + } + #endif /* 0 */ + ++ ++static void set_device_error_reporting(struct pci_dev *dev, void *data) ++{ ++ bool enable = *((bool *)data); ++ ++ if (dev->pcie_type != PCIE_RC_PORT && ++ dev->pcie_type != PCIE_SW_UPSTREAM_PORT && ++ dev->pcie_type != PCIE_SW_DOWNSTREAM_PORT) ++ return; ++ ++ if (enable) ++ pci_enable_pcie_error_reporting(dev); ++ else ++ pci_disable_pcie_error_reporting(dev); ++} ++ ++/** ++ * set_downstream_devices_error_reporting - enable/disable the error reporting bits on the root port and its downstream ports. ++ * @dev: pointer to root port's pci_dev data structure ++ * @enable: true = enable error reporting, false = disable error reporting. ++ */ ++static void set_downstream_devices_error_reporting(struct pci_dev *dev, ++ bool enable) ++{ ++ set_device_error_reporting(dev, &enable); ++ pci_walk_bus(dev->subordinate, set_device_error_reporting, &enable); ++} ++ + static int find_device_iter(struct device *device, void *data) + { + struct pci_dev *dev; +@@ -551,15 +579,11 @@ void aer_enable_rootport(struct aer_rpc + pci_read_config_dword(pdev, aer_pos + PCI_ERR_UNCOR_STATUS, ®32); + pci_write_config_dword(pdev, aer_pos + PCI_ERR_UNCOR_STATUS, reg32); + +- /* Enable Root Port device reporting error itself */ +- pci_read_config_word(pdev, pos+PCI_EXP_DEVCTL, ®16); +- reg16 = reg16 | +- PCI_EXP_DEVCTL_CERE | +- PCI_EXP_DEVCTL_NFERE | +- PCI_EXP_DEVCTL_FERE | +- PCI_EXP_DEVCTL_URRE; +- pci_write_config_word(pdev, pos+PCI_EXP_DEVCTL, +- reg16); ++ /* ++ * Enable error reporting for the root port device and downstream port ++ * devices. ++ */ ++ set_downstream_devices_error_reporting(pdev, true); + + /* Enable Root Port's interrupt in response to error messages */ + pci_write_config_dword(pdev, +@@ -579,6 +603,12 @@ static void disable_root_aer(struct aer_ + u32 reg32; + int pos; + ++ /* ++ * Disable error reporting for the root port device and downstream port ++ * devices. ++ */ ++ set_downstream_devices_error_reporting(pdev, false); ++ + pos = pci_find_aer_capability(pdev); + /* Disable Root's interrupt in response to error messages */ + pci_write_config_dword(pdev, pos + PCI_ERR_ROOT_COMMAND, 0); +--- a/drivers/pci/pcie/portdrv_pci.c ++++ b/drivers/pci/pcie/portdrv_pci.c +@@ -109,8 +109,6 @@ static int __devinit pcie_portdrv_probe + + pcie_portdrv_save_config(dev); + +- pci_enable_pcie_error_reporting(dev); +- + return 0; + } + diff --git a/queue-2.6.27/pcie-portdrv-call-pci_disable_device-during-remove.patch b/queue-2.6.27/pcie-portdrv-call-pci_disable_device-during-remove.patch new file mode 100644 index 00000000000..d7820f68d4f --- /dev/null +++ b/queue-2.6.27/pcie-portdrv-call-pci_disable_device-during-remove.patch @@ -0,0 +1,30 @@ +From d89987193631bf23d1735c55d13a06d4b8d0e9bd Mon Sep 17 00:00:00 2001 +From: Alex Chiang +Date: Sat, 7 Mar 2009 19:35:47 -0700 +Subject: PCIe: portdrv: call pci_disable_device during remove + +From: Alex Chiang + +commit d89987193631bf23d1735c55d13a06d4b8d0e9bd upstream. + +The PCIe port driver calls pci_enable_device() during probe but +never calls pci_disable_device() during remove. + +Signed-off-by: Alex Chiang +Signed-off-by: Matthew Wilcox +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pci/pcie/portdrv_pci.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/pci/pcie/portdrv_pci.c ++++ b/drivers/pci/pcie/portdrv_pci.c +@@ -115,6 +115,7 @@ static int __devinit pcie_portdrv_probe + static void pcie_portdrv_remove (struct pci_dev *dev) + { + pcie_port_device_remove(dev); ++ pci_disable_device(dev); + kfree(pci_get_drvdata(dev)); + } + diff --git a/queue-2.6.27/powerpc-fix-load-store-float-double-alignment-handler.patch b/queue-2.6.27/powerpc-fix-load-store-float-double-alignment-handler.patch new file mode 100644 index 00000000000..0cfe69eb620 --- /dev/null +++ b/queue-2.6.27/powerpc-fix-load-store-float-double-alignment-handler.patch @@ -0,0 +1,67 @@ +From 49f297f8df9adb797334155470ea9ca68bdb041e Mon Sep 17 00:00:00 2001 +From: Michael Neuling +Date: Thu, 19 Feb 2009 18:52:20 +0000 +Subject: powerpc: Fix load/store float double alignment handler + +From: Michael Neuling + +commit 49f297f8df9adb797334155470ea9ca68bdb041e upstream. + +When we introduced VSX, we changed the way FPRs are stored in the +thread_struct. Unfortunately we missed the load/store float double +alignment handler code when updating how we access FPRs in the +thread_struct. + +Below fixes this and merges the little/big endian case. + +Signed-off-by: Michael Neuling +Signed-off-by: Benjamin Herrenschmidt +Signed-off-by: Greg Kroah-Hartman + +--- + arch/powerpc/kernel/align.c | 29 +++++++++++++---------------- + 1 file changed, 13 insertions(+), 16 deletions(-) + +--- a/arch/powerpc/kernel/align.c ++++ b/arch/powerpc/kernel/align.c +@@ -367,27 +367,24 @@ static int emulate_multiple(struct pt_re + static int emulate_fp_pair(unsigned char __user *addr, unsigned int reg, + unsigned int flags) + { +- char *ptr = (char *) ¤t->thread.TS_FPR(reg); +- int i, ret; ++ char *ptr0 = (char *) ¤t->thread.TS_FPR(reg); ++ char *ptr1 = (char *) ¤t->thread.TS_FPR(reg+1); ++ int i, ret, sw = 0; + + if (!(flags & F)) + return 0; + if (reg & 1) + return 0; /* invalid form: FRS/FRT must be even */ +- if (!(flags & SW)) { +- /* not byte-swapped - easy */ +- if (!(flags & ST)) +- ret = __copy_from_user(ptr, addr, 16); +- else +- ret = __copy_to_user(addr, ptr, 16); +- } else { +- /* each FPR value is byte-swapped separately */ +- ret = 0; +- for (i = 0; i < 16; ++i) { +- if (!(flags & ST)) +- ret |= __get_user(ptr[i^7], addr + i); +- else +- ret |= __put_user(ptr[i^7], addr + i); ++ if (flags & SW) ++ sw = 7; ++ ret = 0; ++ for (i = 0; i < 8; ++i) { ++ if (!(flags & ST)) { ++ ret |= __get_user(ptr0[i^sw], addr + i); ++ ret |= __get_user(ptr1[i^sw], addr + i + 8); ++ } else { ++ ret |= __put_user(ptr0[i^sw], addr + i); ++ ret |= __put_user(ptr1[i^sw], addr + i + 8); + } + } + if (ret) diff --git a/queue-2.6.27/proc-fix-kflags-to-uflags-copying-in-proc-kpageflags.patch b/queue-2.6.27/proc-fix-kflags-to-uflags-copying-in-proc-kpageflags.patch new file mode 100644 index 00000000000..4bec6ec54cd --- /dev/null +++ b/queue-2.6.27/proc-fix-kflags-to-uflags-copying-in-proc-kpageflags.patch @@ -0,0 +1,35 @@ +From ad3bdefe877afb47480418fdb05ecd42842de65e Mon Sep 17 00:00:00 2001 +From: Wu Fengguang +Date: Wed, 11 Mar 2009 09:00:04 +0800 +Subject: proc: fix kflags to uflags copying in /proc/kpageflags + +From: Wu Fengguang + +commit ad3bdefe877afb47480418fdb05ecd42842de65e upstream. + +Fix kpf_copy_bit(src,dst) to be kpf_copy_bit(dst,src) to match the +actual call patterns, e.g. kpf_copy_bit(kflags, KPF_LOCKED, PG_locked). + +This misplacement of src/dst only affected reporting of PG_writeback, +PG_reclaim and PG_buddy. For others kflags==uflags so not affected. + +Signed-off-by: Wu Fengguang +Reviewed-by: KOSAKI Motohiro +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + fs/proc/proc_misc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/proc/proc_misc.c ++++ b/fs/proc/proc_misc.c +@@ -797,7 +797,7 @@ static struct file_operations proc_kpage + #define KPF_RECLAIM 9 + #define KPF_BUDDY 10 + +-#define kpf_copy_bit(flags, srcpos, dstpos) (((flags >> srcpos) & 1) << dstpos) ++#define kpf_copy_bit(flags, dstpos, srcpos) (((flags >> srcpos) & 1) << dstpos) + + static ssize_t kpageflags_read(struct file *file, char __user *buf, + size_t count, loff_t *ppos) diff --git a/queue-2.6.27/proc-fix-pg_locked-reporting-in-proc-kpageflags.patch b/queue-2.6.27/proc-fix-pg_locked-reporting-in-proc-kpageflags.patch new file mode 100644 index 00000000000..27e6a926ca9 --- /dev/null +++ b/queue-2.6.27/proc-fix-pg_locked-reporting-in-proc-kpageflags.patch @@ -0,0 +1,31 @@ +From e07a4b9217d1e97d2f3a62b6b070efdc61212110 Mon Sep 17 00:00:00 2001 +From: Helge Bahmann +Date: Fri, 20 Feb 2009 16:24:12 +0300 +Subject: proc: fix PG_locked reporting in /proc/kpageflags + +From: Helge Bahmann + +commit e07a4b9217d1e97d2f3a62b6b070efdc61212110 upstream. + +Expr always evaluates to zero. + +Cc: Matt Mackall +Signed-off-by: Andrew Morton +Signed-off-by: Alexey Dobriyan +Signed-off-by: Greg Kroah-Hartman + +--- + fs/proc/proc_misc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/proc/proc_misc.c ++++ b/fs/proc/proc_misc.c +@@ -824,7 +824,7 @@ static ssize_t kpageflags_read(struct fi + else + kflags = ppage->flags; + +- uflags = kpf_copy_bit(KPF_LOCKED, PG_locked, kflags) | ++ uflags = kpf_copy_bit(kflags, KPF_LOCKED, PG_locked) | + kpf_copy_bit(kflags, KPF_ERROR, PG_error) | + kpf_copy_bit(kflags, KPF_REFERENCED, PG_referenced) | + kpf_copy_bit(kflags, KPF_UPTODATE, PG_uptodate) | diff --git a/queue-2.6.27/rdma-nes-don-t-allow-userspace-qps-to-use-stag-zero.patch b/queue-2.6.27/rdma-nes-don-t-allow-userspace-qps-to-use-stag-zero.patch new file mode 100644 index 00000000000..445492ca56d --- /dev/null +++ b/queue-2.6.27/rdma-nes-don-t-allow-userspace-qps-to-use-stag-zero.patch @@ -0,0 +1,140 @@ +From c12e56ef6951f4fce1afe9ef6aab9243ea9a9b04 Mon Sep 17 00:00:00 2001 +From: Faisal Latif +Date: Thu, 12 Mar 2009 14:34:59 -0700 +Subject: RDMA/nes: Don't allow userspace QPs to use STag zero + +From: Faisal Latif + +commit c12e56ef6951f4fce1afe9ef6aab9243ea9a9b04 upstream. + +STag zero is a special STag that allows consumers to access any bus +address without registering memory. The nes driver unfortunately +allows STag zero to be used even with QPs created by unprivileged +userspace consumers, which means that any process with direct verbs +access to the nes device can read and write any memory accessible to +the underlying PCI device (usually any memory in the system). Such +access is usually given for cluster software such as MPI to use, so +this is a local privilege escalation bug on most systems running this +driver. + +The driver was using STag zero to receive the last streaming mode +data; to allow STag zero to be disabled for unprivileged QPs, the +driver now registers a special MR for this data. + +Signed-off-by: Faisal Latif +Signed-off-by: Roland Dreier +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/infiniband/hw/nes/nes_cm.c | 37 +++++++++++++++++++++++++++++----- + drivers/infiniband/hw/nes/nes_verbs.c | 2 + + drivers/infiniband/hw/nes/nes_verbs.h | 1 + 3 files changed, 35 insertions(+), 5 deletions(-) + +--- a/drivers/infiniband/hw/nes/nes_cm.c ++++ b/drivers/infiniband/hw/nes/nes_cm.c +@@ -2474,12 +2474,14 @@ static int nes_disconnect(struct nes_qp + int ret = 0; + struct nes_vnic *nesvnic; + struct nes_device *nesdev; ++ struct nes_ib_device *nesibdev; + + nesvnic = to_nesvnic(nesqp->ibqp.device); + if (!nesvnic) + return -EINVAL; + + nesdev = nesvnic->nesdev; ++ nesibdev = nesvnic->nesibdev; + + nes_debug(NES_DBG_CM, "netdev refcnt = %u.\n", + atomic_read(&nesvnic->netdev->refcnt)); +@@ -2491,6 +2493,8 @@ static int nes_disconnect(struct nes_qp + } else { + /* Need to free the Last Streaming Mode Message */ + if (nesqp->ietf_frame) { ++ if (nesqp->lsmm_mr) ++ nesibdev->ibdev.dereg_mr(nesqp->lsmm_mr); + pci_free_consistent(nesdev->pcidev, + nesqp->private_data_len+sizeof(struct ietf_mpa_frame), + nesqp->ietf_frame, nesqp->ietf_frame_pbase); +@@ -2524,6 +2528,10 @@ int nes_accept(struct iw_cm_id *cm_id, s + struct iw_cm_event cm_event; + struct nes_hw_qp_wqe *wqe; + struct nes_v4_quad nes_quad; ++ struct nes_ib_device *nesibdev; ++ struct ib_mr *ibmr = NULL; ++ struct ib_phys_buf ibphysbuf; ++ struct nes_pd *nespd; + u32 crc_value; + int ret; + +@@ -2584,6 +2592,26 @@ int nes_accept(struct iw_cm_id *cm_id, s + if (cm_id->remote_addr.sin_addr.s_addr != + cm_id->local_addr.sin_addr.s_addr) { + u64temp = (unsigned long)nesqp; ++ nesibdev = nesvnic->nesibdev; ++ nespd = nesqp->nespd; ++ ibphysbuf.addr = nesqp->ietf_frame_pbase; ++ ibphysbuf.size = conn_param->private_data_len + ++ sizeof(struct ietf_mpa_frame); ++ ibmr = nesibdev->ibdev.reg_phys_mr((struct ib_pd *)nespd, ++ &ibphysbuf, 1, ++ IB_ACCESS_LOCAL_WRITE, ++ (u64 *)&nesqp->ietf_frame); ++ if (!ibmr) { ++ nes_debug(NES_DBG_CM, "Unable to register memory region" ++ "for lSMM for cm_node = %p \n", ++ cm_node); ++ return -ENOMEM; ++ } ++ ++ ibmr->pd = &nespd->ibpd; ++ ibmr->device = nespd->ibpd.device; ++ nesqp->lsmm_mr = ibmr; ++ + u64temp |= NES_SW_CONTEXT_ALIGN>>1; + set_wqe_64bit_value(wqe->wqe_words, + NES_IWARP_SQ_WQE_COMP_CTX_LOW_IDX, +@@ -2594,14 +2622,13 @@ int nes_accept(struct iw_cm_id *cm_id, s + wqe->wqe_words[NES_IWARP_SQ_WQE_TOTAL_PAYLOAD_IDX] = + cpu_to_le32(conn_param->private_data_len + + sizeof(struct ietf_mpa_frame)); +- wqe->wqe_words[NES_IWARP_SQ_WQE_FRAG0_LOW_IDX] = +- cpu_to_le32((u32)nesqp->ietf_frame_pbase); +- wqe->wqe_words[NES_IWARP_SQ_WQE_FRAG0_HIGH_IDX] = +- cpu_to_le32((u32)((u64)nesqp->ietf_frame_pbase >> 32)); ++ set_wqe_64bit_value(wqe->wqe_words, ++ NES_IWARP_SQ_WQE_FRAG0_LOW_IDX, ++ (u64)nesqp->ietf_frame); + wqe->wqe_words[NES_IWARP_SQ_WQE_LENGTH0_IDX] = + cpu_to_le32(conn_param->private_data_len + + sizeof(struct ietf_mpa_frame)); +- wqe->wqe_words[NES_IWARP_SQ_WQE_STAG0_IDX] = 0; ++ wqe->wqe_words[NES_IWARP_SQ_WQE_STAG0_IDX] = ibmr->lkey; + + nesqp->nesqp_context->ird_ord_sizes |= + cpu_to_le32(NES_QPCONTEXT_ORDIRD_LSMM_PRESENT | +--- a/drivers/infiniband/hw/nes/nes_verbs.c ++++ b/drivers/infiniband/hw/nes/nes_verbs.c +@@ -1338,8 +1338,10 @@ static struct ib_qp *nes_create_qp(struc + NES_QPCONTEXT_MISC_RQ_SIZE_SHIFT); + nesqp->nesqp_context->misc |= cpu_to_le32((u32)nesqp->hwqp.sq_encoded_size << + NES_QPCONTEXT_MISC_SQ_SIZE_SHIFT); ++ if (!udata) { + nesqp->nesqp_context->misc |= cpu_to_le32(NES_QPCONTEXT_MISC_PRIV_EN); + nesqp->nesqp_context->misc |= cpu_to_le32(NES_QPCONTEXT_MISC_FAST_REGISTER_EN); ++ } + nesqp->nesqp_context->cqs = cpu_to_le32(nesqp->nesscq->hw_cq.cq_number + + ((u32)nesqp->nesrcq->hw_cq.cq_number << 16)); + u64temp = (u64)nesqp->hwqp.sq_pbase; +--- a/drivers/infiniband/hw/nes/nes_verbs.h ++++ b/drivers/infiniband/hw/nes/nes_verbs.h +@@ -134,6 +134,7 @@ struct nes_qp { + struct ietf_mpa_frame *ietf_frame; + dma_addr_t ietf_frame_pbase; + wait_queue_head_t state_waitq; ++ struct ib_mr *lsmm_mr; + unsigned long socket; + struct nes_hw_qp hwqp; + struct work_struct work; diff --git a/queue-2.6.27/sdhci-fix-led-naming.patch b/queue-2.6.27/sdhci-fix-led-naming.patch new file mode 100644 index 00000000000..ddeb426ace0 --- /dev/null +++ b/queue-2.6.27/sdhci-fix-led-naming.patch @@ -0,0 +1,50 @@ +From 5dbace0c9ba110c1a3810a89fa6bf12b7574b5a3 Mon Sep 17 00:00:00 2001 +From: Helmut Schaa +Date: Sat, 14 Feb 2009 16:22:39 +0100 +Subject: sdhci: fix led naming + +From: Helmut Schaa + +commit 5dbace0c9ba110c1a3810a89fa6bf12b7574b5a3 upstream. + +Fix the led device naming for the sdhci driver. + +The led class documentation defines the led name to have the +form "devicename:colour:function" while not applicable sections +should be left blank. + +To comply with the documentation the led device name is changed +from "mmc*" to "mmc*::". + +Signed-off-by: Helmut Schaa +Signed-off-by: Pierre Ossman +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mmc/host/sdhci.c | 4 +++- + drivers/mmc/host/sdhci.h | 1 + + 2 files changed, 4 insertions(+), 1 deletion(-) + +--- a/drivers/mmc/host/sdhci.c ++++ b/drivers/mmc/host/sdhci.c +@@ -1690,7 +1690,9 @@ int sdhci_add_host(struct sdhci_host *ho + #endif + + #ifdef CONFIG_LEDS_CLASS +- host->led.name = mmc_hostname(mmc); ++ snprintf(host->led_name, sizeof(host->led_name), ++ "%s::", mmc_hostname(mmc)); ++ host->led.name = host->led_name; + host->led.brightness = LED_OFF; + host->led.default_trigger = mmc_hostname(mmc); + host->led.brightness_set = sdhci_led_control; +--- a/drivers/mmc/host/sdhci.h ++++ b/drivers/mmc/host/sdhci.h +@@ -220,6 +220,7 @@ struct sdhci_host { + + #ifdef CONFIG_LEDS_CLASS + struct led_classdev led; /* LED control */ ++ char led_name[32]; + #endif + + spinlock_t lock; /* Mutex */ diff --git a/queue-2.6.27/selinux-fix-a-panic-in-selinux_netlbl_inode_permission.patch b/queue-2.6.27/selinux-fix-a-panic-in-selinux_netlbl_inode_permission.patch new file mode 100644 index 00000000000..b065096b5af --- /dev/null +++ b/queue-2.6.27/selinux-fix-a-panic-in-selinux_netlbl_inode_permission.patch @@ -0,0 +1,41 @@ +From d7f59dc4642ce2fc7b79fcd4ec02ffce7f21eb02 Mon Sep 17 00:00:00 2001 +From: Paul Moore +Date: Fri, 27 Feb 2009 15:00:03 -0500 +Subject: selinux: Fix a panic in selinux_netlbl_inode_permission() + +From: Paul Moore + +commit d7f59dc4642ce2fc7b79fcd4ec02ffce7f21eb02 upstream. + +Rick McNeal from LSI identified a panic in selinux_netlbl_inode_permission() +caused by a certain sequence of SUNRPC operations. The problem appears to be +due to the lack of NULL pointer checking in the function; this patch adds the +pointer checks so the function will exit safely in the cases where the socket +is not completely initialized. + +Signed-off-by: Paul Moore +Signed-off-by: James Morris +Cc: Chuck Ebbert +Signed-off-by: Greg Kroah-Hartman + +--- + security/selinux/netlabel.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/security/selinux/netlabel.c ++++ b/security/selinux/netlabel.c +@@ -236,11 +236,12 @@ int selinux_netlbl_inode_permission(stru + if (!S_ISSOCK(inode->i_mode) || + ((mask & (MAY_WRITE | MAY_APPEND)) == 0)) + return 0; +- + sock = SOCKET_I(inode); + sk = sock->sk; ++ if (sk == NULL) ++ return 0; + sksec = sk->sk_security; +- if (sksec->nlbl_state != NLBL_REQUIRE) ++ if (sksec == NULL || sksec->nlbl_state != NLBL_REQUIRE) + return 0; + + local_bh_disable(); diff --git a/queue-2.6.27/selinux-fix-the-netlabel-glue-code-for-setsockopt.patch b/queue-2.6.27/selinux-fix-the-netlabel-glue-code-for-setsockopt.patch new file mode 100644 index 00000000000..b31b9a93d79 --- /dev/null +++ b/queue-2.6.27/selinux-fix-the-netlabel-glue-code-for-setsockopt.patch @@ -0,0 +1,45 @@ +From 09c50b4a52c01a1f450b8eec819089e228655bfb Mon Sep 17 00:00:00 2001 +From: Paul Moore +Date: Fri, 20 Feb 2009 16:33:02 -0500 +Subject: selinux: Fix the NetLabel glue code for setsockopt() + +From: Paul Moore + +commit 09c50b4a52c01a1f450b8eec819089e228655bfb upstream. + +At some point we (okay, I) managed to break the ability for users to use the +setsockopt() syscall to set IPv4 options when NetLabel was not active on the +socket in question. The problem was noticed by someone trying to use the +"-R" (record route) option of ping: + + # ping -R 10.0.0.1 + ping: record route: No message of desired type + +The solution is relatively simple, we catch the unlabeled socket case and +clear the error code, allowing the operation to succeed. Please note that we +still deny users the ability to override IPv4 options on socket's which have +NetLabel labeling active; this is done to ensure the labeling remains intact. + +Signed-off-by: Paul Moore +Signed-off-by: James Morris +Cc: Chuck Ebbert +Signed-off-by: Greg Kroah-Hartman + +--- + security/selinux/netlabel.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/security/selinux/netlabel.c ++++ b/security/selinux/netlabel.c +@@ -340,8 +340,10 @@ int selinux_netlbl_socket_setsockopt(str + lock_sock(sk); + rc = netlbl_sock_getattr(sk, &secattr); + release_sock(sk); +- if (rc == 0 && secattr.flags != NETLBL_SECATTR_NONE) ++ if (rc == 0) + rc = -EACCES; ++ else if (rc == -ENOMSG) ++ rc = 0; + netlbl_secattr_destroy(&secattr); + } + diff --git a/queue-2.6.27/series b/queue-2.6.27/series index 0b1baa3e79c..1e9253a89bb 100644 --- a/queue-2.6.27/series +++ b/queue-2.6.27/series @@ -24,3 +24,55 @@ usb-usb-storage-add-ignore_residue-flag-for-genesys-logic-adapters.patch watchdog-ks8695_wdt.c-clock_tick_rate-undeclared.patch watchdog-rc32434_wdt-fix-watchdog-driver.patch watchdog-rc32434_wdt-fix-sections.patch +8250-fix-boot-hang-with-serial-console-when-using-with-serial-over-lan-port.patch +alsa-aw2-do-not-grab-every-saa7146-based-device.patch +alsa-fix-excessive-background-noise-introduced-by-oss-emulation-rate-shrink.patch +alsa-hda-add-another-macbook-pro-3-1-ssid.patch +alsa-usb-audio-fix-non-continuous-rate-detection.patch +alsa-usb-audio-workaround-for-misdetected-sample-rate-with-cm6207.patch +asix-new-device-ids.patch +cdc_ether-add-usb-id-for-ericsson-f3507g.patch +copy_process-fix-clone_parent-parent_exec_id-interaction.patch +fix-fixpoint-divide-exception-in-acct_update_integrals.patch +fore200-fix-oops-on-failed-firmware-load.patch +fs-new-inode-i_state-corruption-fix.patch +hpilo-new-pci-device.patch +inotify-fix-gfp_kernel-related-deadlock.patch +intel-agp-fix-a-panic-with-1m-of-shared-memory-no-gtt-entries.patch +jsm-additional-device-support.patch +libata-don-t-trust-current-capacity-values-in-identify-words-57-58.patch +libata-make-sure-port-is-thawed-when-skipping-resets.patch +md-avoid-races-when-stopping-resync.patch +md-raid10-don-t-call-bitmap_cond_end_sync-when-we-are-doing-recovery.patch +md-raid10-don-t-skip-more-than-1-bitmap-chunk-at-a-time-during-recovery.patch +mmc-s3cmci-fix-s3c2410_dma_config-arguments.patch +mmc_test-fix-basic-read-test.patch +mtd_dataflash-fix-probing-of-at45db321c-chips.patch +pci-add-pci-quirk-to-disable-l0s-aspm-state-for-82575-and-82598.patch +pci-don-t-enable-too-many-ht-msi-mappings.patch +pci-enable-pcie-aer-only-after-checking-firmware-support.patch +pcie-portdrv-call-pci_disable_device-during-remove.patch +powerpc-fix-load-store-float-double-alignment-handler.patch +proc-fix-kflags-to-uflags-copying-in-proc-kpageflags.patch +proc-fix-pg_locked-reporting-in-proc-kpageflags.patch +rdma-nes-don-t-allow-userspace-qps-to-use-stag-zero.patch +sdhci-fix-led-naming.patch +selinux-fix-a-panic-in-selinux_netlbl_inode_permission.patch +selinux-fix-the-netlabel-glue-code-for-setsockopt.patch +sis190-add-identifier-for-atheros-ar8021-phy.patch +sound-usb-audio-fix-uninitialized-variable-with-m-audio-midi-interfaces.patch +sound-virtuoso-revert-do-not-overwrite-eeprom-on-xonar-d2-d2x.patch +usb-ehci-slow-down-itd-reuse.patch +usb-option-add-benq-3g-modem-information.patch +x86-64-fix-int-0x80-enosys-return.patch +x86-64-seccomp-fix-32-64-syscall-hole.patch +x86-64-syscall-audit-fix-32-64-syscall-hole.patch +x86-add-dell-xps710-reboot-quirk.patch +x86-tone-down-mtrr_trim_uncached_memory-warning.patch +x86-vmi-tsc-going-backwards-check-in-vmi-clocksource.patch +xen-blkfront-use-blk_rq_map_sg-to-generate-ring-entries.patch +xen-disable-interrupts-early-as-start_kernel-expects.patch +zaurus-add-usb-id-for-motomagx-phones.patch +0001-DVB-s5h1409-Perform-s5h1409-soft-reset-after-tunin.patch +0002-V4L-tda8290-fix-TDA8290-TDA18271-initialization.patch +0003-V4L-ivtv-fix-decoder-crash-regression.patch diff --git a/queue-2.6.27/sis190-add-identifier-for-atheros-ar8021-phy.patch b/queue-2.6.27/sis190-add-identifier-for-atheros-ar8021-phy.patch new file mode 100644 index 00000000000..45fd6c350e2 --- /dev/null +++ b/queue-2.6.27/sis190-add-identifier-for-atheros-ar8021-phy.patch @@ -0,0 +1,33 @@ +From 708f6e27c3f75166433b69174a8348308e55d073 Mon Sep 17 00:00:00 2001 +From: Francois Romieu +Date: Mon, 20 Oct 2008 23:37:55 +0200 +Subject: sis190: add identifier for Atheros AR8021 PHY + +From: Francois Romieu + +commit 708f6e27c3f75166433b69174a8348308e55d073 upstream. + +Fixes http://bugzilla.kernel.org/show_bug.cgi?id=10994 + +Contributed by pablomme@googlemail.com, coenraad@wish.org.za +and a few others. + +Signed-off-by: Francois Romieu +Signed-off-by: Jeff Garzik +Cc: Daniel Drake +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/sis190.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/sis190.c ++++ b/drivers/net/sis190.c +@@ -317,6 +317,7 @@ static struct mii_chip_info { + unsigned int type; + u32 feature; + } mii_chip_table[] = { ++ { "Atheros PHY AR8012", { 0x004d, 0xd020 }, LAN, 0 }, + { "Broadcom PHY BCM5461", { 0x0020, 0x60c0 }, LAN, F_PHY_BCM5461 }, + { "Broadcom PHY AC131", { 0x0143, 0xbc70 }, LAN, 0 }, + { "Agere PHY ET1101B", { 0x0282, 0xf010 }, LAN, 0 }, diff --git a/queue-2.6.27/sound-usb-audio-fix-uninitialized-variable-with-m-audio-midi-interfaces.patch b/queue-2.6.27/sound-usb-audio-fix-uninitialized-variable-with-m-audio-midi-interfaces.patch new file mode 100644 index 00000000000..58d3211c9d8 --- /dev/null +++ b/queue-2.6.27/sound-usb-audio-fix-uninitialized-variable-with-m-audio-midi-interfaces.patch @@ -0,0 +1,36 @@ +From e156ac4c571e3be741bc411e58820b74a9295c72 Mon Sep 17 00:00:00 2001 +From: Clemens Ladisch +Date: Mon, 16 Feb 2009 15:22:39 +0100 +Subject: sound: usb-audio: fix uninitialized variable with M-Audio MIDI interfaces + +From: Clemens Ladisch + +commit e156ac4c571e3be741bc411e58820b74a9295c72 upstream. + +Fix the snd_usbmidi_create_endpoints_midiman() function, which forgot to +set the out_interval member of the endpoint info structure for Midiman/ +M-Audio devices. Since kernel 2.6.24, any non-zero value makes the +driver use interrupt transfers instead of bulk transfers. With EHCI +controllers, these random interval values result in unbearably large +latencies for output MIDI transfers. + +Signed-off-by: Clemens Ladisch +Reported-by: David +Tested-by: David +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/usb/usbmidi.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/usb/usbmidi.c ++++ b/sound/usb/usbmidi.c +@@ -1583,6 +1583,7 @@ static int snd_usbmidi_create_endpoints_ + } + + ep_info.out_ep = get_endpoint(hostif, 2)->bEndpointAddress & USB_ENDPOINT_NUMBER_MASK; ++ ep_info.out_interval = 0; + ep_info.out_cables = endpoint->out_cables & 0x5555; + err = snd_usbmidi_out_endpoint_create(umidi, &ep_info, &umidi->endpoints[0]); + if (err < 0) diff --git a/queue-2.6.27/sound-virtuoso-revert-do-not-overwrite-eeprom-on-xonar-d2-d2x.patch b/queue-2.6.27/sound-virtuoso-revert-do-not-overwrite-eeprom-on-xonar-d2-d2x.patch new file mode 100644 index 00000000000..ead670e283a --- /dev/null +++ b/queue-2.6.27/sound-virtuoso-revert-do-not-overwrite-eeprom-on-xonar-d2-d2x.patch @@ -0,0 +1,105 @@ +From 6ce6c473a7fd742fdb0db95841e2c4c6b37337c5 Mon Sep 17 00:00:00 2001 +From: Clemens Ladisch +Date: Tue, 17 Feb 2009 09:50:30 +0100 +Subject: sound: virtuoso: revert "do not overwrite EEPROM on Xonar D2/D2X" + +From: Clemens Ladisch + +commit 6ce6c473a7fd742fdb0db95841e2c4c6b37337c5 upstream. + +This reverts commit 7e86c0e6850504ec9516b953f316a47277825e33 ("do not +overwrite EEPROM on Xonar D2/D2X") because it did not actually help with +the problem. + +More user reports show that the overwriting of the EEPROM is not +triggered by using this driver but by installing Linux, and that the +installation of any other operating system (even one without any CMI8788 +driver) has the same effect. In other words, the presence of this +driver does not have any effect on the occurrence of the error. (So +far, the available evidence seems to point to a BIOS bug.) + +Furthermore, it turns out that the EEPROM chip is protected against +stray write commands by the command format and by requiring a separate +write-enable command, so the error scenario in the previous commit (that +SPI writes can be misinterpreted as an EEPROM write command) is not even +theoretically possible. + +The mixer control that was removed as a consequence of the previous +commit can only be partially emulated in userspace, which also means it +cannot be seen be the in-kernel OSS API emulation, so it is better to +revert that change. + +Signed-off-by: Clemens Ladisch +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/oxygen/virtuoso.c | 22 +++++++--------------- + 1 file changed, 7 insertions(+), 15 deletions(-) + +--- a/sound/pci/oxygen/virtuoso.c ++++ b/sound/pci/oxygen/virtuoso.c +@@ -26,7 +26,7 @@ + * SPI 0 -> 1st PCM1796 (front) + * SPI 1 -> 2nd PCM1796 (surround) + * SPI 2 -> 3rd PCM1796 (center/LFE) +- * SPI 4 -> 4th PCM1796 (back) and EEPROM self-destruct (do not use!) ++ * SPI 4 -> 4th PCM1796 (back) + * + * GPIO 2 -> M0 of CS5381 + * GPIO 3 -> M1 of CS5381 +@@ -142,12 +142,6 @@ struct xonar_data { + static void pcm1796_write(struct oxygen *chip, unsigned int codec, + u8 reg, u8 value) + { +- /* +- * We don't want to do writes on SPI 4 because the EEPROM, which shares +- * the same pin, might get confused and broken. We'd better take care +- * that the driver works with the default register values ... +- */ +-#if 0 + /* maps ALSA channel pair number to SPI output */ + static const u8 codec_map[4] = { + 0, 1, 2, 4 +@@ -158,7 +152,6 @@ static void pcm1796_write(struct oxygen + (codec_map[codec] << OXYGEN_SPI_CODEC_SHIFT) | + OXYGEN_SPI_CEN_LATCH_CLOCK_HI, + (reg << 8) | value); +-#endif + } + + static void cs4398_write(struct oxygen *chip, u8 reg, u8 value) +@@ -546,9 +539,6 @@ static const DECLARE_TLV_DB_SCALE(cs4362 + + static int xonar_d2_control_filter(struct snd_kcontrol_new *template) + { +- if (!strncmp(template->name, "Master Playback ", 16)) +- /* disable volume/mute because they would require SPI writes */ +- return 1; + if (!strncmp(template->name, "CD Capture ", 11)) + /* CD in is actually connected to the video in pin */ + template->private_value ^= AC97_CD ^ AC97_VIDEO; +@@ -598,8 +588,9 @@ static const struct oxygen_model xonar_m + .dac_volume_min = 0x0f, + .dac_volume_max = 0xff, + .misc_flags = OXYGEN_MISC_MIDI, +- .function_flags = OXYGEN_FUNCTION_SPI, +- .dac_i2s_format = OXYGEN_I2S_FORMAT_I2S, ++ .function_flags = OXYGEN_FUNCTION_SPI | ++ OXYGEN_FUNCTION_ENABLE_SPI_4_5, ++ .dac_i2s_format = OXYGEN_I2S_FORMAT_LJUST, + .adc_i2s_format = OXYGEN_I2S_FORMAT_LJUST, + }, + [MODEL_D2X] = { +@@ -628,8 +619,9 @@ static const struct oxygen_model xonar_m + .dac_volume_min = 0x0f, + .dac_volume_max = 0xff, + .misc_flags = OXYGEN_MISC_MIDI, +- .function_flags = OXYGEN_FUNCTION_SPI, +- .dac_i2s_format = OXYGEN_I2S_FORMAT_I2S, ++ .function_flags = OXYGEN_FUNCTION_SPI | ++ OXYGEN_FUNCTION_ENABLE_SPI_4_5, ++ .dac_i2s_format = OXYGEN_I2S_FORMAT_LJUST, + .adc_i2s_format = OXYGEN_I2S_FORMAT_LJUST, + }, + [MODEL_D1] = { diff --git a/queue-2.6.27/usb-ehci-slow-down-itd-reuse.patch b/queue-2.6.27/usb-ehci-slow-down-itd-reuse.patch new file mode 100644 index 00000000000..36bd7bed35e --- /dev/null +++ b/queue-2.6.27/usb-ehci-slow-down-itd-reuse.patch @@ -0,0 +1,185 @@ +From 9aa09d2f8f4bc440d6db1c3414d4009642875240 Mon Sep 17 00:00:00 2001 +From: Karsten Wiese +Date: Sun, 8 Feb 2009 16:07:58 -0800 +Subject: USB: EHCI: slow down ITD reuse + +From: Karsten Wiese + +commit 9aa09d2f8f4bc440d6db1c3414d4009642875240 upstream. + +Currently ITDs are immediately recycled whenever their URB completes. +However, EHCI hardware can sometimes remember some ITD state. This +means that when the ITD is reused before end-of-frame it may sometimes +cause the hardware to reference bogus state. + +This patch defers reusing such ITDs by moving them into a new ehci member +cached_itd_list. ITDs resting in cached_itd_list are moved back into their +stream's free_list once scan_periodic() detects that the active frame has +elapsed. + +This makes the snd_usb_us122l driver (in kernel since .28) work right +when it's hooked up through EHCI. + +[ dbrownell@users.sourceforge.net: comment fixups ] + +Signed-off-by: Karsten Wiese +Tested-by: Philippe Carriere +Tested-by: Federico Briata +Signed-off-by: David Brownell +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/ehci-hcd.c | 2 + + drivers/usb/host/ehci-mem.c | 1 + drivers/usb/host/ehci-sched.c | 56 ++++++++++++++++++++++++++++++++++++------ + drivers/usb/host/ehci.h | 6 ++++ + 4 files changed, 57 insertions(+), 8 deletions(-) + +--- a/drivers/usb/host/ehci.h ++++ b/drivers/usb/host/ehci.h +@@ -87,6 +87,10 @@ struct ehci_hcd { /* one per controlle + int next_uframe; /* scan periodic, start here */ + unsigned periodic_sched; /* periodic activity count */ + ++ /* list of itds completed while clock_frame was still active */ ++ struct list_head cached_itd_list; ++ unsigned clock_frame; ++ + /* per root hub port */ + unsigned long reset_done [EHCI_MAX_ROOT_PORTS]; + +@@ -208,6 +212,8 @@ timer_action (struct ehci_hcd *ehci, enu + } + } + ++static void free_cached_itd_list(struct ehci_hcd *ehci); ++ + /*-------------------------------------------------------------------------*/ + + /* EHCI register interface, corresponds to EHCI Revision 0.95 specification */ +--- a/drivers/usb/host/ehci-hcd.c ++++ b/drivers/usb/host/ehci-hcd.c +@@ -485,6 +485,7 @@ static int ehci_init(struct usb_hcd *hcd + * periodic_size can shrink by USBCMD update if hcc_params allows. + */ + ehci->periodic_size = DEFAULT_I_TDPS; ++ INIT_LIST_HEAD(&ehci->cached_itd_list); + if ((retval = ehci_mem_init(ehci, GFP_KERNEL)) < 0) + return retval; + +@@ -497,6 +498,7 @@ static int ehci_init(struct usb_hcd *hcd + + ehci->reclaim = NULL; + ehci->next_uframe = -1; ++ ehci->clock_frame = -1; + + /* + * dedicate a qh for the async ring head, since we couldn't unlink +--- a/drivers/usb/host/ehci-mem.c ++++ b/drivers/usb/host/ehci-mem.c +@@ -128,6 +128,7 @@ static inline void qh_put (struct ehci_q + + static void ehci_mem_cleanup (struct ehci_hcd *ehci) + { ++ free_cached_itd_list(ehci); + if (ehci->async) + qh_put (ehci->async); + ehci->async = NULL; +--- a/drivers/usb/host/ehci-sched.c ++++ b/drivers/usb/host/ehci-sched.c +@@ -1004,7 +1004,8 @@ iso_stream_put(struct ehci_hcd *ehci, st + + is_in = (stream->bEndpointAddress & USB_DIR_IN) ? 0x10 : 0; + stream->bEndpointAddress &= 0x0f; +- stream->ep->hcpriv = NULL; ++ if (stream->ep) ++ stream->ep->hcpriv = NULL; + + if (stream->rescheduled) { + ehci_info (ehci, "ep%d%s-iso rescheduled " +@@ -1653,14 +1654,28 @@ itd_complete ( + (stream->bEndpointAddress & USB_DIR_IN) ? "in" : "out"); + } + iso_stream_put (ehci, stream); +- /* OK to recycle this ITD now that its completion callback ran. */ ++ + done: + usb_put_urb(urb); + itd->urb = NULL; +- itd->stream = NULL; +- list_move(&itd->itd_list, &stream->free_list); +- iso_stream_put(ehci, stream); +- ++ if (ehci->clock_frame != itd->frame || itd->index[7] != -1) { ++ /* OK to recycle this ITD now. */ ++ itd->stream = NULL; ++ list_move(&itd->itd_list, &stream->free_list); ++ iso_stream_put(ehci, stream); ++ } else { ++ /* HW might remember this ITD, so we can't recycle it yet. ++ * Move it to a safe place until a new frame starts. ++ */ ++ list_move(&itd->itd_list, &ehci->cached_itd_list); ++ if (stream->refcount == 2) { ++ /* If iso_stream_put() were called here, stream ++ * would be freed. Instead, just prevent reuse. ++ */ ++ stream->ep->hcpriv = NULL; ++ stream->ep = NULL; ++ } ++ } + return retval; + } + +@@ -2101,6 +2116,20 @@ done: + + /*-------------------------------------------------------------------------*/ + ++static void free_cached_itd_list(struct ehci_hcd *ehci) ++{ ++ struct ehci_itd *itd, *n; ++ ++ list_for_each_entry_safe(itd, n, &ehci->cached_itd_list, itd_list) { ++ struct ehci_iso_stream *stream = itd->stream; ++ itd->stream = NULL; ++ list_move(&itd->itd_list, &stream->free_list); ++ iso_stream_put(ehci, stream); ++ } ++} ++ ++/*-------------------------------------------------------------------------*/ ++ + static void + scan_periodic (struct ehci_hcd *ehci) + { +@@ -2115,10 +2144,17 @@ scan_periodic (struct ehci_hcd *ehci) + * Touches as few pages as possible: cache-friendly. + */ + now_uframe = ehci->next_uframe; +- if (HC_IS_RUNNING (ehci_to_hcd(ehci)->state)) ++ if (HC_IS_RUNNING(ehci_to_hcd(ehci)->state)) { + clock = ehci_readl(ehci, &ehci->regs->frame_index); +- else ++ clock_frame = (clock >> 3) % ehci->periodic_size; ++ } else { + clock = now_uframe + mod - 1; ++ clock_frame = -1; ++ } ++ if (ehci->clock_frame != clock_frame) { ++ free_cached_itd_list(ehci); ++ ehci->clock_frame = clock_frame; ++ } + clock %= mod; + clock_frame = clock >> 3; + +@@ -2277,6 +2313,10 @@ restart: + /* rescan the rest of this frame, then ... */ + clock = now; + clock_frame = clock >> 3; ++ if (ehci->clock_frame != clock_frame) { ++ free_cached_itd_list(ehci); ++ ehci->clock_frame = clock_frame; ++ } + } else { + now_uframe++; + now_uframe %= mod; diff --git a/queue-2.6.27/usb-option-add-benq-3g-modem-information.patch b/queue-2.6.27/usb-option-add-benq-3g-modem-information.patch new file mode 100644 index 00000000000..6570cb40480 --- /dev/null +++ b/queue-2.6.27/usb-option-add-benq-3g-modem-information.patch @@ -0,0 +1,41 @@ +From 28fb66821f884870987a0b5ab064ef651d9f7c16 Mon Sep 17 00:00:00 2001 +From: Jesse Sung +Date: Fri, 20 Feb 2009 21:13:45 -0800 +Subject: USB: option: add BenQ 3g modem information + +From: Jesse Sung + +commit 28fb66821f884870987a0b5ab064ef651d9f7c16 upstream. + +This patch addes the BenQ 3g modem support to the option driver. + + +From: Jesse Sung +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/option.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -289,6 +289,9 @@ static int option_send_setup(struct tty + #define ERICSSON_VENDOR_ID 0x0bdb + #define ERICSSON_PRODUCT_F3507G 0x1900 + ++#define BENQ_VENDOR_ID 0x04a5 ++#define BENQ_PRODUCT_H10 0x4068 ++ + static struct usb_device_id option_ids[] = { + { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_COLT) }, + { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_RICOLA) }, +@@ -498,6 +501,8 @@ static struct usb_device_id option_ids[] + { USB_DEVICE(ZTE_VENDOR_ID, ZTE_PRODUCT_MF628) }, + { USB_DEVICE(ZTE_VENDOR_ID, ZTE_PRODUCT_CDMA_TECH) }, + { USB_DEVICE(ERICSSON_VENDOR_ID, ERICSSON_PRODUCT_F3507G) }, ++ { USB_DEVICE(BENQ_VENDOR_ID, BENQ_PRODUCT_H10) }, ++ { USB_DEVICE(0x1da5, 0x4515) }, /* BenQ H20 */ + { } /* Terminating entry */ + }; + MODULE_DEVICE_TABLE(usb, option_ids); diff --git a/queue-2.6.27/x86-64-fix-int-0x80-enosys-return.patch b/queue-2.6.27/x86-64-fix-int-0x80-enosys-return.patch new file mode 100644 index 00000000000..f832fb913d1 --- /dev/null +++ b/queue-2.6.27/x86-64-fix-int-0x80-enosys-return.patch @@ -0,0 +1,67 @@ +From c09249f8d1b84344eca882547afdbffee8c09d14 Mon Sep 17 00:00:00 2001 +From: Roland McGrath +Date: Fri, 6 Feb 2009 18:15:18 -0800 +Subject: x86-64: fix int $0x80 -ENOSYS return + +From: Roland McGrath + +commit c09249f8d1b84344eca882547afdbffee8c09d14 upstream. + +One of my past fixes to this code introduced a different new bug. +When using 32-bit "int $0x80" entry for a bogus syscall number, +the return value is not correctly set to -ENOSYS. This only happens +when neither syscall-audit nor syscall tracing is enabled (i.e., never +seen if auditd ever started). Test program: + + /* gcc -o int80-badsys -m32 -g int80-badsys.c + Run on x86-64 kernel. + Note to reproduce the bug you need auditd never to have started. */ + + #include + #include + + int + main (void) + { + long res; + asm ("int $0x80" : "=a" (res) : "0" (99999)); + printf ("bad syscall returns %ld\n", res); + return res != -ENOSYS; + } + +The fix makes the int $0x80 path match the sysenter and syscall paths. + +Reported-by: Dmitry V. Levin +Signed-off-by: Roland McGrath +Cc: Chuck Ebbert +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/ia32/ia32entry.S | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +--- a/arch/x86/ia32/ia32entry.S ++++ b/arch/x86/ia32/ia32entry.S +@@ -424,9 +424,9 @@ ENTRY(ia32_syscall) + orl $TS_COMPAT,TI_status(%r10) + testl $_TIF_WORK_SYSCALL_ENTRY,TI_flags(%r10) + jnz ia32_tracesys +-ia32_do_syscall: + cmpl $(IA32_NR_syscalls-1),%eax +- ja int_ret_from_sys_call /* ia32_tracesys has set RAX(%rsp) */ ++ ja ia32_badsys ++ia32_do_call: + IA32_ARG_FIXUP + call *ia32_sys_call_table(,%rax,8) # xxx: rip relative + ia32_sysret: +@@ -441,7 +441,9 @@ ia32_tracesys: + call syscall_trace_enter + LOAD_ARGS32 ARGOFFSET /* reload args from stack in case ptrace changed it */ + RESTORE_REST +- jmp ia32_do_syscall ++ cmpl $(IA32_NR_syscalls-1),%eax ++ ja int_ret_from_sys_call /* ia32_tracesys has set RAX(%rsp) */ ++ jmp ia32_do_call + END(ia32_syscall) + + ia32_badsys: diff --git a/queue-2.6.27/x86-64-seccomp-fix-32-64-syscall-hole.patch b/queue-2.6.27/x86-64-seccomp-fix-32-64-syscall-hole.patch new file mode 100644 index 00000000000..5cebff66a65 --- /dev/null +++ b/queue-2.6.27/x86-64-seccomp-fix-32-64-syscall-hole.patch @@ -0,0 +1,221 @@ +From 5b1017404aea6d2e552e991b3fd814d839e9cd67 Mon Sep 17 00:00:00 2001 +From: Roland McGrath +Date: Fri, 27 Feb 2009 23:25:54 -0800 +Subject: x86-64: seccomp: fix 32/64 syscall hole + +From: Roland McGrath + +commit 5b1017404aea6d2e552e991b3fd814d839e9cd67 upstream. + +On x86-64, a 32-bit process (TIF_IA32) can switch to 64-bit mode with +ljmp, and then use the "syscall" instruction to make a 64-bit system +call. A 64-bit process make a 32-bit system call with int $0x80. + +In both these cases under CONFIG_SECCOMP=y, secure_computing() will use +the wrong system call number table. The fix is simple: test TS_COMPAT +instead of TIF_IA32. Here is an example exploit: + + /* test case for seccomp circumvention on x86-64 + + There are two failure modes: compile with -m64 or compile with -m32. + + The -m64 case is the worst one, because it does "chmod 777 ." (could + be any chmod call). The -m32 case demonstrates it was able to do + stat(), which can glean information but not harm anything directly. + + A buggy kernel will let the test do something, print, and exit 1; a + fixed kernel will make it exit with SIGKILL before it does anything. + */ + + #define _GNU_SOURCE + #include + #include + #include + #include + #include + #include + #include + + int + main (int argc, char **argv) + { + char buf[100]; + static const char dot[] = "."; + long ret; + unsigned st[24]; + + if (prctl (PR_SET_SECCOMP, 1, 0, 0, 0) != 0) + perror ("prctl(PR_SET_SECCOMP) -- not compiled into kernel?"); + + #ifdef __x86_64__ + assert ((uintptr_t) dot < (1UL << 32)); + asm ("int $0x80 # %0 <- %1(%2 %3)" + : "=a" (ret) : "0" (15), "b" (dot), "c" (0777)); + ret = snprintf (buf, sizeof buf, + "result %ld (check mode on .!)\n", ret); + #elif defined __i386__ + asm (".code32\n" + "pushl %%cs\n" + "pushl $2f\n" + "ljmpl $0x33, $1f\n" + ".code64\n" + "1: syscall # %0 <- %1(%2 %3)\n" + "lretl\n" + ".code32\n" + "2:" + : "=a" (ret) : "0" (4), "D" (dot), "S" (&st)); + if (ret == 0) + ret = snprintf (buf, sizeof buf, + "stat . -> st_uid=%u\n", st[7]); + else + ret = snprintf (buf, sizeof buf, "result %ld\n", ret); + #else + # error "not this one" + #endif + + write (1, buf, ret); + + syscall (__NR_exit, 1); + return 2; + } + +Signed-off-by: Roland McGrath +[ I don't know if anybody actually uses seccomp, but it's enabled in + at least both Fedora and SuSE kernels, so maybe somebody is. - Linus ] +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + arch/powerpc/include/asm/compat.h | 5 +++++ + arch/powerpc/include/asm/seccomp.h | 4 ---- + arch/sparc/include/asm/compat.h | 5 +++++ + arch/sparc/include/asm/seccomp.h | 6 ------ + include/asm-mips/seccomp.h | 1 - + include/asm-x86/seccomp_32.h | 6 ------ + include/asm-x86/seccomp_64.h | 8 -------- + kernel/seccomp.c | 7 ++++--- + 8 files changed, 14 insertions(+), 28 deletions(-) + +--- a/arch/powerpc/include/asm/compat.h ++++ b/arch/powerpc/include/asm/compat.h +@@ -210,5 +210,10 @@ struct compat_shmid64_ds { + compat_ulong_t __unused6; + }; + ++static inline int is_compat_task(void) ++{ ++ return test_thread_flag(TIF_32BIT); ++} ++ + #endif /* __KERNEL__ */ + #endif /* _ASM_POWERPC_COMPAT_H */ +--- a/arch/powerpc/include/asm/seccomp.h ++++ b/arch/powerpc/include/asm/seccomp.h +@@ -1,10 +1,6 @@ + #ifndef _ASM_POWERPC_SECCOMP_H + #define _ASM_POWERPC_SECCOMP_H + +-#ifdef __KERNEL__ +-#include +-#endif +- + #include + + #define __NR_seccomp_read __NR_read +--- a/arch/sparc/include/asm/compat.h ++++ b/arch/sparc/include/asm/compat.h +@@ -240,4 +240,9 @@ struct compat_shmid64_ds { + unsigned int __unused2; + }; + ++static inline int is_compat_task(void) ++{ ++ return test_thread_flag(TIF_32BIT); ++} ++ + #endif /* _ASM_SPARC64_COMPAT_H */ +--- a/arch/sparc/include/asm/seccomp.h ++++ b/arch/sparc/include/asm/seccomp.h +@@ -1,11 +1,5 @@ + #ifndef _ASM_SECCOMP_H + +-#include /* already defines TIF_32BIT */ +- +-#ifndef TIF_32BIT +-#error "unexpected TIF_32BIT on sparc64" +-#endif +- + #include + + #define __NR_seccomp_read __NR_read +--- a/include/asm-mips/seccomp.h ++++ b/include/asm-mips/seccomp.h +@@ -1,6 +1,5 @@ + #ifndef __ASM_SECCOMP_H + +-#include + #include + + #define __NR_seccomp_read __NR_read +--- a/include/asm-x86/seccomp_32.h ++++ b/include/asm-x86/seccomp_32.h +@@ -1,12 +1,6 @@ + #ifndef _ASM_SECCOMP_H + #define _ASM_SECCOMP_H + +-#include +- +-#ifdef TIF_32BIT +-#error "unexpected TIF_32BIT on i386" +-#endif +- + #include + + #define __NR_seccomp_read __NR_read +--- a/include/asm-x86/seccomp_64.h ++++ b/include/asm-x86/seccomp_64.h +@@ -1,14 +1,6 @@ + #ifndef _ASM_SECCOMP_H + #define _ASM_SECCOMP_H + +-#include +- +-#ifdef TIF_32BIT +-#error "unexpected TIF_32BIT on x86_64" +-#else +-#define TIF_32BIT TIF_IA32 +-#endif +- + #include + #include + +--- a/kernel/seccomp.c ++++ b/kernel/seccomp.c +@@ -8,6 +8,7 @@ + + #include + #include ++#include + + /* #define SECCOMP_DEBUG 1 */ + #define NR_SECCOMP_MODES 1 +@@ -22,7 +23,7 @@ static int mode1_syscalls[] = { + 0, /* null terminated */ + }; + +-#ifdef TIF_32BIT ++#ifdef CONFIG_COMPAT + static int mode1_syscalls_32[] = { + __NR_seccomp_read_32, __NR_seccomp_write_32, __NR_seccomp_exit_32, __NR_seccomp_sigreturn_32, + 0, /* null terminated */ +@@ -37,8 +38,8 @@ void __secure_computing(int this_syscall + switch (mode) { + case 1: + syscall = mode1_syscalls; +-#ifdef TIF_32BIT +- if (test_thread_flag(TIF_32BIT)) ++#ifdef CONFIG_COMPAT ++ if (is_compat_task()) + syscall = mode1_syscalls_32; + #endif + do { diff --git a/queue-2.6.27/x86-64-syscall-audit-fix-32-64-syscall-hole.patch b/queue-2.6.27/x86-64-syscall-audit-fix-32-64-syscall-hole.patch new file mode 100644 index 00000000000..57689496091 --- /dev/null +++ b/queue-2.6.27/x86-64-syscall-audit-fix-32-64-syscall-hole.patch @@ -0,0 +1,37 @@ +From ccbe495caa5e604b04d5a31d7459a6f6a76a756c Mon Sep 17 00:00:00 2001 +From: Roland McGrath +Date: Fri, 27 Feb 2009 19:03:24 -0800 +Subject: x86-64: syscall-audit: fix 32/64 syscall hole + +From: Roland McGrath + +commit ccbe495caa5e604b04d5a31d7459a6f6a76a756c upstream. + +On x86-64, a 32-bit process (TIF_IA32) can switch to 64-bit mode with +ljmp, and then use the "syscall" instruction to make a 64-bit system +call. A 64-bit process make a 32-bit system call with int $0x80. + +In both these cases, audit_syscall_entry() will use the wrong system +call number table and the wrong system call argument registers. This +could be used to circumvent a syscall audit configuration that filters +based on the syscall numbers or argument details. + +Signed-off-by: Roland McGrath +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/ptrace.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/x86/kernel/ptrace.c ++++ b/arch/x86/kernel/ptrace.c +@@ -1403,7 +1403,7 @@ static void syscall_trace(struct pt_regs + #ifdef CONFIG_X86_32 + # define IS_IA32 1 + #elif defined CONFIG_IA32_EMULATION +-# define IS_IA32 test_thread_flag(TIF_IA32) ++# define IS_IA32 is_compat_task() + #else + # define IS_IA32 0 + #endif diff --git a/queue-2.6.27/x86-add-dell-xps710-reboot-quirk.patch b/queue-2.6.27/x86-add-dell-xps710-reboot-quirk.patch new file mode 100644 index 00000000000..927ec6c8260 --- /dev/null +++ b/queue-2.6.27/x86-add-dell-xps710-reboot-quirk.patch @@ -0,0 +1,40 @@ +From dd4124a8a06bca89c077a16437edac010f0bb993 Mon Sep 17 00:00:00 2001 +From: Leann Ogasawara +Date: Wed, 4 Mar 2009 11:53:00 -0800 +Subject: x86: add Dell XPS710 reboot quirk + +From: Leann Ogasawara + +commit dd4124a8a06bca89c077a16437edac010f0bb993 upstream. + +Dell XPS710 will hang on reboot. This is resolved by adding a quirk to +set bios reboot. + +Signed-off-by: Leann Ogasawara +Signed-off-by: Tim Gardner +Cc: "manoj.iyer" +LKML-Reference: <1236196380.3231.89.camel@emiko> +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/reboot.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/arch/x86/kernel/reboot.c ++++ b/arch/x86/kernel/reboot.c +@@ -193,6 +193,14 @@ static struct dmi_system_id __initdata r + DMI_MATCH(DMI_PRODUCT_NAME, "HP Compaq"), + }, + }, ++ { /* Handle problems with rebooting on Dell XPS710 */ ++ .callback = set_bios_reboot, ++ .ident = "Dell XPS710", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "Dell XPS710"), ++ }, ++ }, + { } + }; + diff --git a/queue-2.6.27/x86-tone-down-mtrr_trim_uncached_memory-warning.patch b/queue-2.6.27/x86-tone-down-mtrr_trim_uncached_memory-warning.patch new file mode 100644 index 00000000000..9516477caf2 --- /dev/null +++ b/queue-2.6.27/x86-tone-down-mtrr_trim_uncached_memory-warning.patch @@ -0,0 +1,45 @@ +From bf3647c44bc76c43c4b2ebb4c37a559e899ac70e Mon Sep 17 00:00:00 2001 +From: Ingo Molnar +Date: Thu, 29 Jan 2009 11:45:35 +0100 +Subject: x86: tone down mtrr_trim_uncached_memory() warning + +From: Ingo Molnar + +commit bf3647c44bc76c43c4b2ebb4c37a559e899ac70e upstream. + +kerneloops.org is reporting a lot of these warnings that come due to +vmware not setting up any MTRRs for emulated CPUs: + +| Reported 709 times (14696 total reports) +| BIOS bug (often in VMWare) where the MTRR's are set up incorrectly +| or not at all +| +| This warning was last seen in version 2.6.29-rc2-git1, and first +| seen in 2.6.24. +| +| More info: +| http://www.kerneloops.org/searchweek.php?search=mtrr_trim_uncached_memory + +Keep a one-liner KERN_INFO about it - so that we have so notice if empty +MTRRs are caused by native hardware/BIOS weirdness. + +Signed-off-by: Ingo Molnar +Cc: Chuck Ebbert +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/cpu/mtrr/main.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/arch/x86/kernel/cpu/mtrr/main.c ++++ b/arch/x86/kernel/cpu/mtrr/main.c +@@ -1496,8 +1496,7 @@ int __init mtrr_trim_uncached_memory(uns + + /* kvm/qemu doesn't have mtrr set right, don't trim them all */ + if (!highest_pfn) { +- WARN(!kvm_para_available(), KERN_WARNING +- "WARNING: strange, CPU MTRRs all blank?\n"); ++ printk(KERN_INFO "CPU MTRRs all blank - virtualized system.\n"); + return 0; + } + diff --git a/queue-2.6.27/x86-vmi-tsc-going-backwards-check-in-vmi-clocksource.patch b/queue-2.6.27/x86-vmi-tsc-going-backwards-check-in-vmi-clocksource.patch new file mode 100644 index 00000000000..46ce9a43cd6 --- /dev/null +++ b/queue-2.6.27/x86-vmi-tsc-going-backwards-check-in-vmi-clocksource.patch @@ -0,0 +1,40 @@ +From 48ffc70b675aa7798a52a2e92e20f6cce9140b3d Mon Sep 17 00:00:00 2001 +From: Alok N Kataria +Date: Wed, 18 Feb 2009 12:33:55 -0800 +Subject: x86, vmi: TSC going backwards check in vmi clocksource + +From: Alok N Kataria + +commit 48ffc70b675aa7798a52a2e92e20f6cce9140b3d upstream. + +Impact: fix time warps under vmware + +Similar to the check for TSC going backwards in the TSC clocksource, +we also need this check for VMI clocksource. + +Signed-off-by: Alok N Kataria +Cc: Zachary Amsden +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/vmiclock_32.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/arch/x86/kernel/vmiclock_32.c ++++ b/arch/x86/kernel/vmiclock_32.c +@@ -280,10 +280,13 @@ void __devinit vmi_time_ap_init(void) + #endif + + /** vmi clocksource */ ++static struct clocksource clocksource_vmi; + + static cycle_t read_real_cycles(void) + { +- return vmi_timer_ops.get_cycle_counter(VMI_CYCLES_REAL); ++ cycle_t ret = (cycle_t)vmi_timer_ops.get_cycle_counter(VMI_CYCLES_REAL); ++ return ret >= clocksource_vmi.cycle_last ? ++ ret : clocksource_vmi.cycle_last; + } + + static struct clocksource clocksource_vmi = { diff --git a/queue-2.6.27/xen-blkfront-use-blk_rq_map_sg-to-generate-ring-entries.patch b/queue-2.6.27/xen-blkfront-use-blk_rq_map_sg-to-generate-ring-entries.patch new file mode 100644 index 00000000000..0819e301f3c --- /dev/null +++ b/queue-2.6.27/xen-blkfront-use-blk_rq_map_sg-to-generate-ring-entries.patch @@ -0,0 +1,121 @@ +From 9e973e64ac6dc504e6447d52193d4fff1a670156 Mon Sep 17 00:00:00 2001 +From: Jens Axboe +Date: Tue, 24 Feb 2009 08:10:09 +0100 +Subject: xen/blkfront: use blk_rq_map_sg to generate ring entries + +From: Jens Axboe + +commit 9e973e64ac6dc504e6447d52193d4fff1a670156 upstream. + +On occasion, the request will apparently have more segments than we +fit into the ring. Jens says: + +> The second problem is that the block layer then appears to create one +> too many segments, but from the dump it has rq->nr_phys_segments == +> BLKIF_MAX_SEGMENTS_PER_REQUEST. I suspect the latter is due to +> xen-blkfront not handling the merging on its own. It should check that +> the new page doesn't form part of the previous page. The +> rq_for_each_segment() iterates all single bits in the request, not dma +> segments. The "easiest" way to do this is to call blk_rq_map_sg() and +> then iterate the mapped sg list. That will give you what you are +> looking for. + +> Here's a test patch, compiles but otherwise untested. I spent more +> time figuring out how to enable XEN than to code it up, so YMMV! +> Probably the sg list wants to be put inside the ring and only +> initialized on allocation, then you can get rid of the sg on stack and +> sg_init_table() loop call in the function. I'll leave that, and the +> testing, to you. + +[Moved sg array into info structure, and initialize once. -J] + +Signed-off-by: Jens Axboe +Signed-off-by: Jeremy Fitzhardinge +Cc: Sven Köhler +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/block/xen-blkfront.c | 30 +++++++++++++++--------------- + 1 file changed, 15 insertions(+), 15 deletions(-) + +--- a/drivers/block/xen-blkfront.c ++++ b/drivers/block/xen-blkfront.c +@@ -40,6 +40,7 @@ + #include + #include + #include ++#include + + #include + #include +@@ -82,6 +83,7 @@ struct blkfront_info + enum blkif_state connected; + int ring_ref; + struct blkif_front_ring ring; ++ struct scatterlist sg[BLKIF_MAX_SEGMENTS_PER_REQUEST]; + unsigned int evtchn, irq; + struct request_queue *rq; + struct work_struct work; +@@ -203,12 +205,11 @@ static int blkif_queue_request(struct re + struct blkfront_info *info = req->rq_disk->private_data; + unsigned long buffer_mfn; + struct blkif_request *ring_req; +- struct req_iterator iter; +- struct bio_vec *bvec; + unsigned long id; + unsigned int fsect, lsect; +- int ref; ++ int i, ref; + grant_ref_t gref_head; ++ struct scatterlist *sg; + + if (unlikely(info->connected != BLKIF_STATE_CONNECTED)) + return 1; +@@ -237,12 +238,13 @@ static int blkif_queue_request(struct re + if (blk_barrier_rq(req)) + ring_req->operation = BLKIF_OP_WRITE_BARRIER; + +- ring_req->nr_segments = 0; +- rq_for_each_segment(bvec, req, iter) { +- BUG_ON(ring_req->nr_segments == BLKIF_MAX_SEGMENTS_PER_REQUEST); +- buffer_mfn = pfn_to_mfn(page_to_pfn(bvec->bv_page)); +- fsect = bvec->bv_offset >> 9; +- lsect = fsect + (bvec->bv_len >> 9) - 1; ++ ring_req->nr_segments = blk_rq_map_sg(req->q, req, info->sg); ++ BUG_ON(ring_req->nr_segments > BLKIF_MAX_SEGMENTS_PER_REQUEST); ++ ++ for_each_sg(info->sg, sg, ring_req->nr_segments, i) { ++ buffer_mfn = pfn_to_mfn(page_to_pfn(sg_page(sg))); ++ fsect = sg->offset >> 9; ++ lsect = fsect + (sg->length >> 9) - 1; + /* install a grant reference. */ + ref = gnttab_claim_grant_reference(&gref_head); + BUG_ON(ref == -ENOSPC); +@@ -253,16 +255,12 @@ static int blkif_queue_request(struct re + buffer_mfn, + rq_data_dir(req) ); + +- info->shadow[id].frame[ring_req->nr_segments] = +- mfn_to_pfn(buffer_mfn); +- +- ring_req->seg[ring_req->nr_segments] = ++ info->shadow[id].frame[i] = mfn_to_pfn(buffer_mfn); ++ ring_req->seg[i] = + (struct blkif_request_segment) { + .gref = ref, + .first_sect = fsect, + .last_sect = lsect }; +- +- ring_req->nr_segments++; + } + + info->ring.req_prod_pvt++; +@@ -592,6 +590,8 @@ static int setup_blkring(struct xenbus_d + SHARED_RING_INIT(sring); + FRONT_RING_INIT(&info->ring, sring, PAGE_SIZE); + ++ sg_init_table(info->sg, BLKIF_MAX_SEGMENTS_PER_REQUEST); ++ + err = xenbus_grant_ring(dev, virt_to_mfn(info->ring.sring)); + if (err < 0) { + free_page((unsigned long)sring); diff --git a/queue-2.6.27/xen-disable-interrupts-early-as-start_kernel-expects.patch b/queue-2.6.27/xen-disable-interrupts-early-as-start_kernel-expects.patch new file mode 100644 index 00000000000..7a81102b831 --- /dev/null +++ b/queue-2.6.27/xen-disable-interrupts-early-as-start_kernel-expects.patch @@ -0,0 +1,36 @@ +From 55d8085671863fe4ee6a17b7814bd38180a44e1d Mon Sep 17 00:00:00 2001 +From: Jeremy Fitzhardinge +Date: Wed, 25 Feb 2009 09:42:25 -0800 +Subject: xen: disable interrupts early, as start_kernel expects + +From: Jeremy Fitzhardinge + +commit 55d8085671863fe4ee6a17b7814bd38180a44e1d upstream. + +This avoids a lockdep warning from: + if (DEBUG_LOCKS_WARN_ON(unlikely(!early_boot_irqs_enabled))) + return; +in trace_hardirqs_on_caller(); + +Signed-off-by: Jeremy Fitzhardinge +Cc: Mark McLoughlin +Cc: Xen-devel +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/xen/enlighten.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/arch/x86/xen/enlighten.c ++++ b/arch/x86/xen/enlighten.c +@@ -1707,6 +1707,9 @@ asmlinkage void __init xen_start_kernel( + possible map and a non-dummy shared_info. */ + per_cpu(xen_vcpu, 0) = &HYPERVISOR_shared_info->vcpu_info[0]; + ++ local_irq_disable(); ++ early_boot_irqs_off(); ++ + xen_raw_console_write("mapping kernel into physical memory\n"); + pgd = xen_setup_kernel_pagetable(pgd, xen_start_info->nr_pages); + diff --git a/queue-2.6.27/zaurus-add-usb-id-for-motomagx-phones.patch b/queue-2.6.27/zaurus-add-usb-id-for-motomagx-phones.patch new file mode 100644 index 00000000000..b86fae24f10 --- /dev/null +++ b/queue-2.6.27/zaurus-add-usb-id-for-motomagx-phones.patch @@ -0,0 +1,37 @@ +From 52c0326beaa3cb0049d0f1c51c6ad5d4a04e4430 Mon Sep 17 00:00:00 2001 +From: Dmitriy Taychenachev +Date: Tue, 24 Feb 2009 18:42:48 +0000 +Subject: zaurus: add usb id for motomagx phones + +From: Dmitriy Taychenachev + +commit 52c0326beaa3cb0049d0f1c51c6ad5d4a04e4430 upstream. + +The Motorola MOTOMAGX phones (Z6, E8, Zn5 so far) are providing +combined ACM/BLAN USB configuration. Since it has Vendor Specific +class, the corresponding drivers (cdc-acm, zaurus) can't find it just +by interface info. This patch adds usb id so the zaurus driver can +properly handle this combined device. + +Signed-off-by: Dmitriy Taychenachev +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/usb/zaurus.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/net/usb/zaurus.c ++++ b/drivers/net/usb/zaurus.c +@@ -341,6 +341,11 @@ static const struct usb_device_id produc + USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_MDLM, + USB_CDC_PROTO_NONE), + .driver_info = (unsigned long) &bogus_mdlm_info, ++}, { ++ /* Motorola MOTOMAGX phones */ ++ USB_DEVICE_AND_INTERFACE_INFO(0x22b8, 0x6425, USB_CLASS_COMM, ++ USB_CDC_SUBCLASS_MDLM, USB_CDC_PROTO_NONE), ++ .driver_info = (unsigned long) &bogus_mdlm_info, + }, + + /* Olympus has some models with a Zaurus-compatible option.