From: Greg Kroah-Hartman Date: Mon, 4 Jan 2010 19:36:59 +0000 (-0800) Subject: start .32 queue X-Git-Tag: v2.6.31.10~20 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=91642809b7b8c0a7e46d01dcf2dd3d5567489d33;p=thirdparty%2Fkernel%2Fstable-queue.git start .32 queue --- diff --git a/queue-2.6.32/acerhdf-limit-modalias-matching-to-supported.patch b/queue-2.6.32/acerhdf-limit-modalias-matching-to-supported.patch new file mode 100644 index 00000000000..586c5453d5a --- /dev/null +++ b/queue-2.6.32/acerhdf-limit-modalias-matching-to-supported.patch @@ -0,0 +1,44 @@ +From bdc731bc5fcd1794e9ac8ac80c389d302381c123 Mon Sep 17 00:00:00 2001 +From: Stefan Bader +Date: Mon, 21 Dec 2009 16:20:04 -0800 +Subject: acerhdf: limit modalias matching to supported + +From: Stefan Bader + +commit bdc731bc5fcd1794e9ac8ac80c389d302381c123 upstream. + +BugLink: https://bugs.launchpad.net/ubuntu/+bug/435958 + +The module alias currently matches any Acer computer but when loaded the +BIOS checks will only succeed on Aspire One models. This causes a invalid +BIOS warning for all other models (seen on Aspire 4810T). This is not +fatal but worries users that see this message. Limiting the moule alias +to models starting with AOA or DOA for Packard Bell. + +Signed-off-by: Stefan Bader +Acked-by: Borislav Petkov +Acked-by: Peter Feuerer +Signed-off-by: Andrew Morton +Signed-off-by: Len Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/platform/x86/acerhdf.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +--- a/drivers/platform/x86/acerhdf.c ++++ b/drivers/platform/x86/acerhdf.c +@@ -640,9 +640,10 @@ static void __exit acerhdf_exit(void) + MODULE_LICENSE("GPL"); + MODULE_AUTHOR("Peter Feuerer"); + MODULE_DESCRIPTION("Aspire One temperature and fan driver"); +-MODULE_ALIAS("dmi:*:*Acer*:*:"); +-MODULE_ALIAS("dmi:*:*Gateway*:*:"); +-MODULE_ALIAS("dmi:*:*Packard Bell*:*:"); ++MODULE_ALIAS("dmi:*:*Acer*:pnAOA*:"); ++MODULE_ALIAS("dmi:*:*Gateway*:pnAOA*:"); ++MODULE_ALIAS("dmi:*:*Packard Bell*:pnAOA*:"); ++MODULE_ALIAS("dmi:*:*Packard Bell*:pnDOA*:"); + + module_init(acerhdf_init); + module_exit(acerhdf_exit); diff --git a/queue-2.6.32/acpi-ec-fix-msi-dmi-detection.patch b/queue-2.6.32/acpi-ec-fix-msi-dmi-detection.patch new file mode 100644 index 00000000000..2f85d1026c2 --- /dev/null +++ b/queue-2.6.32/acpi-ec-fix-msi-dmi-detection.patch @@ -0,0 +1,47 @@ +From 55b313f249e11b815fd0be51869f166aaf368f44 Mon Sep 17 00:00:00 2001 +From: Alexey Starikovskiy +Date: Tue, 22 Dec 2009 02:42:52 -0500 +Subject: ACPI: EC: Fix MSI DMI detection + +From: Alexey Starikovskiy + +commit 55b313f249e11b815fd0be51869f166aaf368f44 upstream. + +MSI strings should be ORed, not ANDed. + +Reference: http://bugzilla.kernel.org/show_bug.cgi?id=14446 + +Signed-off-by: Alexey Starikovskiy +Signed-off-by: Len Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/acpi/ec.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +--- a/drivers/acpi/ec.c ++++ b/drivers/acpi/ec.c +@@ -916,6 +916,7 @@ static int ec_validate_ecdt(const struct + /* MSI EC needs special treatment, enable it */ + static int ec_flag_msi(const struct dmi_system_id *id) + { ++ printk(KERN_DEBUG PREFIX "Detected MSI hardware, enabling workarounds.\n"); + EC_FLAGS_MSI = 1; + EC_FLAGS_VALIDATE_ECDT = 1; + return 0; +@@ -928,8 +929,13 @@ static struct dmi_system_id __initdata e + DMI_MATCH(DMI_BOARD_NAME, "JFL92") }, NULL}, + { + ec_flag_msi, "MSI hardware", { +- DMI_MATCH(DMI_BIOS_VENDOR, "Micro-Star"), +- DMI_MATCH(DMI_CHASSIS_VENDOR, "MICRO-Star") }, NULL}, ++ DMI_MATCH(DMI_BIOS_VENDOR, "Micro-Star")}, NULL}, ++ { ++ ec_flag_msi, "MSI hardware", { ++ DMI_MATCH(DMI_SYS_VENDOR, "Micro-Star")}, NULL}, ++ { ++ ec_flag_msi, "MSI hardware", { ++ DMI_MATCH(DMI_CHASSIS_VENDOR, "MICRO-Star")}, NULL}, + { + ec_validate_ecdt, "ASUS hardware", { + DMI_MATCH(DMI_BIOS_VENDOR, "ASUS") }, NULL}, diff --git a/queue-2.6.32/acpi-use-the-return-result-of-acpi-lid-notifier-chain-correctly.patch b/queue-2.6.32/acpi-use-the-return-result-of-acpi-lid-notifier-chain-correctly.patch new file mode 100644 index 00000000000..548d784472e --- /dev/null +++ b/queue-2.6.32/acpi-use-the-return-result-of-acpi-lid-notifier-chain-correctly.patch @@ -0,0 +1,43 @@ +From 13c199c0d0cf78b27592991129fb8cbcfc5164de Mon Sep 17 00:00:00 2001 +From: Zhao Yakui +Date: Tue, 15 Dec 2009 22:01:57 +0800 +Subject: ACPI: Use the return result of ACPI lid notifier chain correctly + +From: Zhao Yakui + +commit 13c199c0d0cf78b27592991129fb8cbcfc5164de upstream. + +On some laptops it will return NOTIFY_OK(non-zero) when calling the ACPI LID +notifier. Then it is used as the result of ACPI LID resume function, which +will complain the following warning message in course of suspend/resume: + + >PM: Device PNP0C0D:00 failed to resume: error 1 + +This patch is to eliminate the above warning message. + +http://bugzilla.kernel.org/show_bug.cgi?id=14782 + +Signed-off-by: Zhao Yakui +Signed-off-by: Len Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/acpi/button.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/acpi/button.c ++++ b/drivers/acpi/button.c +@@ -282,6 +282,13 @@ static int acpi_lid_send_state(struct ac + if (ret == NOTIFY_DONE) + ret = blocking_notifier_call_chain(&acpi_lid_notifier, state, + device); ++ if (ret == NOTIFY_DONE || ret == NOTIFY_OK) { ++ /* ++ * It is also regarded as success if the notifier_chain ++ * returns NOTIFY_OK or NOTIFY_DONE. ++ */ ++ ret = 0; ++ } + return ret; + } + diff --git a/queue-2.6.32/alsa-hda-fix-missing-capsrc_nids-for-alc88x.patch b/queue-2.6.32/alsa-hda-fix-missing-capsrc_nids-for-alc88x.patch new file mode 100644 index 00000000000..886a12ef361 --- /dev/null +++ b/queue-2.6.32/alsa-hda-fix-missing-capsrc_nids-for-alc88x.patch @@ -0,0 +1,62 @@ +From 035eb0cff0671ada49ba9f3e5c9e7b0cb950efea Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Thu, 17 Dec 2009 15:00:26 +0100 +Subject: ALSA: hda - Fix missing capsrc_nids for ALC88x + +From: Takashi Iwai + +commit 035eb0cff0671ada49ba9f3e5c9e7b0cb950efea upstream. + +Some model quirks missed the corresponding capsrc_nids. This resulted in +non-working capture source selection. + +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_realtek.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -9141,6 +9141,8 @@ static struct alc_config_preset alc882_p + .dac_nids = alc883_dac_nids, + .num_adc_nids = ARRAY_SIZE(alc889_adc_nids), + .adc_nids = alc889_adc_nids, ++ .capsrc_nids = alc889_capsrc_nids, ++ .capsrc_nids = alc889_capsrc_nids, + .dig_out_nid = ALC883_DIGOUT_NID, + .dig_in_nid = ALC883_DIGIN_NID, + .slave_dig_outs = alc883_slave_dig_outs, +@@ -9187,6 +9189,7 @@ static struct alc_config_preset alc882_p + .dac_nids = alc883_dac_nids, + .adc_nids = alc883_adc_nids_alt, + .num_adc_nids = ARRAY_SIZE(alc883_adc_nids_alt), ++ .capsrc_nids = alc883_capsrc_nids, + .dig_out_nid = ALC883_DIGOUT_NID, + .num_channel_mode = ARRAY_SIZE(alc883_3ST_2ch_modes), + .channel_mode = alc883_3ST_2ch_modes, +@@ -9333,6 +9336,7 @@ static struct alc_config_preset alc882_p + .dac_nids = alc883_dac_nids, + .adc_nids = alc883_adc_nids_alt, + .num_adc_nids = ARRAY_SIZE(alc883_adc_nids_alt), ++ .capsrc_nids = alc883_capsrc_nids, + .num_channel_mode = ARRAY_SIZE(alc883_sixstack_modes), + .channel_mode = alc883_sixstack_modes, + .input_mux = &alc883_capture_source, +@@ -9394,6 +9398,7 @@ static struct alc_config_preset alc882_p + .dac_nids = alc883_dac_nids, + .adc_nids = alc883_adc_nids_alt, + .num_adc_nids = ARRAY_SIZE(alc883_adc_nids_alt), ++ .capsrc_nids = alc883_capsrc_nids, + .num_channel_mode = ARRAY_SIZE(alc883_3ST_2ch_modes), + .channel_mode = alc883_3ST_2ch_modes, + .input_mux = &alc883_lenovo_101e_capture_source, +@@ -9573,6 +9578,7 @@ static struct alc_config_preset alc882_p + alc880_gpio1_init_verbs }, + .adc_nids = alc883_adc_nids, + .num_adc_nids = ARRAY_SIZE(alc883_adc_nids), ++ .capsrc_nids = alc883_capsrc_nids, + .dac_nids = alc883_dac_nids, + .num_dacs = ARRAY_SIZE(alc883_dac_nids), + .channel_mode = alc889A_mb31_6ch_modes, diff --git a/queue-2.6.32/asoc-do-not-write-to-invalid-registers-on-the-wm9712.patch b/queue-2.6.32/asoc-do-not-write-to-invalid-registers-on-the-wm9712.patch new file mode 100644 index 00000000000..a99ad5a7c75 --- /dev/null +++ b/queue-2.6.32/asoc-do-not-write-to-invalid-registers-on-the-wm9712.patch @@ -0,0 +1,36 @@ +From 48e3cbb3f67a27d9c2db075f3d0f700246c40caa Mon Sep 17 00:00:00 2001 +From: Eric Millbrandt +Date: Tue, 22 Dec 2009 10:13:24 -0500 +Subject: ASoC: Do not write to invalid registers on the wm9712. + +From: Eric Millbrandt + +commit 48e3cbb3f67a27d9c2db075f3d0f700246c40caa upstream. + +This patch fixes a bug where "virtual" registers were being written to the ac97 +bus. This was causing unrelated registers to become corrupted (headphone 0x04, +touchscreen 0x78, etc). + +This patch duplicates protection that was included in the wm9713 driver. + +Signed-off-by: Eric Millbrandt +Acked-by: Liam Girdwood +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/codecs/wm9712.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/sound/soc/codecs/wm9712.c ++++ b/sound/soc/codecs/wm9712.c +@@ -464,7 +464,8 @@ static int ac97_write(struct snd_soc_cod + { + u16 *cache = codec->reg_cache; + +- soc_ac97_ops.write(codec->ac97, reg, val); ++ if (reg < 0x7c) ++ soc_ac97_ops.write(codec->ac97, reg, val); + reg = reg >> 1; + if (reg < (ARRAY_SIZE(wm9712_reg))) + cache[reg] = val; diff --git a/queue-2.6.32/asoc-wm8974-fix-a-wrong-bit-definition.patch b/queue-2.6.32/asoc-wm8974-fix-a-wrong-bit-definition.patch new file mode 100644 index 00000000000..3bd9f558bb8 --- /dev/null +++ b/queue-2.6.32/asoc-wm8974-fix-a-wrong-bit-definition.patch @@ -0,0 +1,31 @@ +From 48c03ce72f2665f79a3fe54fc6d71b8cc3d30803 Mon Sep 17 00:00:00 2001 +From: Guennadi Liakhovetski +Date: Thu, 17 Dec 2009 14:51:35 +0100 +Subject: ASoC: wm8974: fix a wrong bit definition + +From: Guennadi Liakhovetski + +commit 48c03ce72f2665f79a3fe54fc6d71b8cc3d30803 upstream. + +The wm8974 datasheet defines BUFIOEN as bit 2. + +Signed-off-by: Guennadi Liakhovetski +Acked-by: Liam Girdwood +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/codecs/wm8974.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/soc/codecs/wm8974.c ++++ b/sound/soc/codecs/wm8974.c +@@ -47,7 +47,7 @@ static const u16 wm8974_reg[WM8974_CACHE + }; + + #define WM8974_POWER1_BIASEN 0x08 +-#define WM8974_POWER1_BUFIOEN 0x10 ++#define WM8974_POWER1_BUFIOEN 0x04 + + struct wm8974_priv { + struct snd_soc_codec codec; diff --git a/queue-2.6.32/ath5k-fix-swi-calibration-interrupt-storm.patch b/queue-2.6.32/ath5k-fix-swi-calibration-interrupt-storm.patch new file mode 100644 index 00000000000..fe51b4561ea --- /dev/null +++ b/queue-2.6.32/ath5k-fix-swi-calibration-interrupt-storm.patch @@ -0,0 +1,57 @@ +From 242ab7ad689accafd5e87ffd22b85cf1bf7fbbef Mon Sep 17 00:00:00 2001 +From: Bob Copeland +Date: Mon, 21 Dec 2009 22:26:48 -0500 +Subject: ath5k: fix SWI calibration interrupt storm + +From: Bob Copeland + +commit 242ab7ad689accafd5e87ffd22b85cf1bf7fbbef upstream. + +The calibration period is now invoked by triggering a software +interrupt from within the ISR by ath5k_hw_calibration_poll() +instead of via a timer. + +However, the calibration interval isn't initialized before +interrupts are enabled, so we can have a situation where an +interrupt occurs before the interval is assigned, so the +interval is actually negative. As a result, the ISR will +arm a software interrupt to schedule the tasklet, and then +rearm it when the SWI is processed, and so on, leading to a +softlockup at modprobe time. + +Move the initialization order around so the calibration interval +is set before interrupts are active. Another possible fix +is to schedule the tasklet directly from the poll routine, +but I think there are additional plans for the SWI. + +Signed-off-by: Bob Copeland +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/ath/ath5k/base.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +--- a/drivers/net/wireless/ath/ath5k/base.c ++++ b/drivers/net/wireless/ath/ath5k/base.c +@@ -2349,6 +2349,9 @@ ath5k_init(struct ath5k_softc *sc) + */ + ath5k_stop_locked(sc); + ++ /* Set PHY calibration interval */ ++ ah->ah_cal_intval = ath5k_calinterval; ++ + /* + * The basic interface to setting the hardware in a good + * state is ``reset''. On return the hardware is known to +@@ -2376,10 +2379,6 @@ ath5k_init(struct ath5k_softc *sc) + + /* Set ack to be sent at low bit-rates */ + ath5k_hw_set_ack_bitrate_high(ah, false); +- +- /* Set PHY calibration inteval */ +- ah->ah_cal_intval = ath5k_calinterval; +- + ret = 0; + done: + mmiowb(); diff --git a/queue-2.6.32/ath9k-fix-missed-error-codes-in-the-tx-status-check.patch b/queue-2.6.32/ath9k-fix-missed-error-codes-in-the-tx-status-check.patch new file mode 100644 index 00000000000..7263a351569 --- /dev/null +++ b/queue-2.6.32/ath9k-fix-missed-error-codes-in-the-tx-status-check.patch @@ -0,0 +1,57 @@ +From 5b479a076de091590423a9e6dfc2584126b28761 Mon Sep 17 00:00:00 2001 +From: Felix Fietkau +Date: Thu, 24 Dec 2009 14:04:32 +0100 +Subject: ath9k: fix missed error codes in the tx status check +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Felix Fietkau + +commit 5b479a076de091590423a9e6dfc2584126b28761 upstream. + +My previous change added in: + + commit 815833e7ecf0b9a017315cae6aef4d7cd9517681 + ath9k: fix tx status reporting + +was not checking all possible tx error conditions. This could possibly +lead to throughput issues due to slow rate control adaption or missed +retransmissions of failed A-MPDU frames. + +This patch adds a mask for all possible error conditions and uses it +in the xmit ok check. + +Reported-by: Björn Smedman +Signed-off-by: Felix Fietkau +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/ath/ath9k/mac.h | 3 +++ + drivers/net/wireless/ath/ath9k/xmit.c | 2 +- + 2 files changed, 4 insertions(+), 1 deletion(-) + +--- a/drivers/net/wireless/ath/ath9k/mac.h ++++ b/drivers/net/wireless/ath/ath9k/mac.h +@@ -77,6 +77,9 @@ + #define ATH9K_TXERR_XTXOP 0x08 + #define ATH9K_TXERR_TIMER_EXPIRED 0x10 + #define ATH9K_TX_ACKED 0x20 ++#define ATH9K_TXERR_MASK \ ++ (ATH9K_TXERR_XRETRY | ATH9K_TXERR_FILT | ATH9K_TXERR_FIFO | \ ++ ATH9K_TXERR_XTXOP | ATH9K_TXERR_TIMER_EXPIRED) + + #define ATH9K_TX_BA 0x01 + #define ATH9K_TX_PWRMGMT 0x02 +--- a/drivers/net/wireless/ath/ath9k/xmit.c ++++ b/drivers/net/wireless/ath/ath9k/xmit.c +@@ -2020,7 +2020,7 @@ static void ath_tx_processq(struct ath_s + if (bf_isaggr(bf)) + txq->axq_aggr_depth--; + +- txok = !(ds->ds_txstat.ts_status & ATH9K_TXERR_FILT); ++ txok = !(ds->ds_txstat.ts_status & ATH9K_TXERR_MASK); + txq->axq_tx_inprogress = false; + spin_unlock_bh(&txq->axq_lock); + diff --git a/queue-2.6.32/ath9k-fix-suspend-by-waking-device-prior-to-stop.patch b/queue-2.6.32/ath9k-fix-suspend-by-waking-device-prior-to-stop.patch new file mode 100644 index 00000000000..0b9c936b399 --- /dev/null +++ b/queue-2.6.32/ath9k-fix-suspend-by-waking-device-prior-to-stop.patch @@ -0,0 +1,45 @@ +From 3867cf6a8c699846e928e8f5a9f31013708df192 Mon Sep 17 00:00:00 2001 +From: Sujith +Date: Wed, 23 Dec 2009 20:03:27 -0500 +Subject: ath9k: fix suspend by waking device prior to stop + +From: Sujith + +commit 3867cf6a8c699846e928e8f5a9f31013708df192 upstream. + +Ensure the device is awake prior to trying to tell hardware +to stop it. Impact of not doing this is we can likely leave +the device in an undefined state likely causing issues with +suspend and resume. This patch ensures harware is where it +should be prior to suspend. + +Signed-off-by: Sujith +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/ath/ath9k/main.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/net/wireless/ath/ath9k/main.c ++++ b/drivers/net/wireless/ath/ath9k/main.c +@@ -2147,6 +2147,9 @@ static void ath9k_stop(struct ieee80211_ + return; /* another wiphy still in use */ + } + ++ /* Ensure HW is awake when we try to shut it down. */ ++ ath9k_ps_wakeup(sc); ++ + if (sc->sc_flags & SC_OP_BTCOEX_ENABLED) { + ath9k_hw_btcoex_disable(sc->sc_ah); + if (sc->btcoex_info.btcoex_scheme == ATH_BTCOEX_CFG_3WIRE) +@@ -2167,6 +2170,9 @@ static void ath9k_stop(struct ieee80211_ + /* disable HAL and put h/w to sleep */ + ath9k_hw_disable(sc->sc_ah); + ath9k_hw_configpcipowersave(sc->sc_ah, 1, 1); ++ ath9k_ps_restore(sc); ++ ++ /* Finally, put the chip in FULL SLEEP mode */ + ath9k_hw_setpower(sc->sc_ah, ATH9K_PM_FULL_SLEEP); + + sc->sc_flags |= SC_OP_INVALID; diff --git a/queue-2.6.32/ath9k-fix-tx-queue-draining.patch b/queue-2.6.32/ath9k-fix-tx-queue-draining.patch new file mode 100644 index 00000000000..058bea56447 --- /dev/null +++ b/queue-2.6.32/ath9k-fix-tx-queue-draining.patch @@ -0,0 +1,48 @@ +From e8009e9850d59000d518296af372888911a129bd Mon Sep 17 00:00:00 2001 +From: Sujith +Date: Mon, 14 Dec 2009 14:57:08 +0530 +Subject: ath9k: Fix TX queue draining + +From: Sujith + +commit e8009e9850d59000d518296af372888911a129bd upstream. + +When TX DMA termination has failed, the HW has to be reset +completely. Doing a fast channel change in this case is insufficient. +Also, change the debug level of a couple of messages to FATAL. + +Signed-off-by: Sujith +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/ath/ath9k/mac.c | 2 +- + drivers/net/wireless/ath/ath9k/xmit.c | 4 ++-- + 2 files changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/net/wireless/ath/ath9k/mac.c ++++ b/drivers/net/wireless/ath/ath9k/mac.c +@@ -155,7 +155,7 @@ bool ath9k_hw_stoptxdma(struct ath_hw *a + wait = wait_time; + while (ath9k_hw_numtxpending(ah, q)) { + if ((--wait) == 0) { +- DPRINTF(ah->ah_sc, ATH_DBG_QUEUE, ++ DPRINTF(ah->ah_sc, ATH_DBG_FATAL, + "Failed to stop TX DMA in 100 " + "msec after killing last frame\n"); + break; +--- a/drivers/net/wireless/ath/ath9k/xmit.c ++++ b/drivers/net/wireless/ath/ath9k/xmit.c +@@ -1076,10 +1076,10 @@ void ath_drain_all_txq(struct ath_softc + if (npend) { + int r; + +- DPRINTF(sc, ATH_DBG_XMIT, "Unable to stop TxDMA. Reset HAL!\n"); ++ DPRINTF(sc, ATH_DBG_FATAL, "Unable to stop TxDMA. Reset HAL!\n"); + + spin_lock_bh(&sc->sc_resetlock); +- r = ath9k_hw_reset(ah, sc->sc_ah->curchan, true); ++ r = ath9k_hw_reset(ah, sc->sc_ah->curchan, false); + if (r) + DPRINTF(sc, ATH_DBG_FATAL, + "Unable to reset hardware; reset status %d\n", diff --git a/queue-2.6.32/ath9k-wake-hardware-during-ampdu-tx-actions.patch b/queue-2.6.32/ath9k-wake-hardware-during-ampdu-tx-actions.patch new file mode 100644 index 00000000000..1f9e1e97a42 --- /dev/null +++ b/queue-2.6.32/ath9k-wake-hardware-during-ampdu-tx-actions.patch @@ -0,0 +1,47 @@ +From 8b685ba9de803f210936400612a32a2003f47cd3 Mon Sep 17 00:00:00 2001 +From: Luis R. Rodriguez +Date: Wed, 23 Dec 2009 20:03:29 -0500 +Subject: ath9k: wake hardware during AMPDU TX actions + +From: Luis R. Rodriguez + +commit 8b685ba9de803f210936400612a32a2003f47cd3 upstream. + +AMDPDU actions poke hardware for TX operation, as such +we want to turn hardware on for these actions. AMDPU RX operations +do not require hardware on as nothing is done in hardware for +those actions. Without this we cannot guarantee hardware has +been programmed correctly for each AMPDU TX action. + +Signed-off-by: Luis R. Rodriguez +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/ath/ath9k/main.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/net/wireless/ath/ath9k/main.c ++++ b/drivers/net/wireless/ath/ath9k/main.c +@@ -2726,15 +2726,21 @@ static int ath9k_ampdu_action(struct iee + case IEEE80211_AMPDU_RX_STOP: + break; + case IEEE80211_AMPDU_TX_START: ++ ath9k_ps_wakeup(sc); + ath_tx_aggr_start(sc, sta, tid, ssn); + ieee80211_start_tx_ba_cb_irqsafe(hw, sta->addr, tid); ++ ath9k_ps_restore(sc); + break; + case IEEE80211_AMPDU_TX_STOP: ++ ath9k_ps_wakeup(sc); + ath_tx_aggr_stop(sc, sta, tid); + ieee80211_stop_tx_ba_cb_irqsafe(hw, sta->addr, tid); ++ ath9k_ps_restore(sc); + break; + case IEEE80211_AMPDU_TX_OPERATIONAL: ++ ath9k_ps_wakeup(sc); + ath_tx_aggr_resume(sc, sta, tid); ++ ath9k_ps_restore(sc); + break; + default: + DPRINTF(sc, ATH_DBG_FATAL, "Unknown AMPDU action\n"); diff --git a/queue-2.6.32/ath9k-wake-hardware-for-interface-ibss-ap-mesh-removal.patch b/queue-2.6.32/ath9k-wake-hardware-for-interface-ibss-ap-mesh-removal.patch new file mode 100644 index 00000000000..8cf50eb7e04 --- /dev/null +++ b/queue-2.6.32/ath9k-wake-hardware-for-interface-ibss-ap-mesh-removal.patch @@ -0,0 +1,35 @@ +From 5f70a88f631c3480107853cae12925185eb4c598 Mon Sep 17 00:00:00 2001 +From: Luis R. Rodriguez +Date: Wed, 23 Dec 2009 20:03:28 -0500 +Subject: ath9k: wake hardware for interface IBSS/AP/Mesh removal + +From: Luis R. Rodriguez + +commit 5f70a88f631c3480107853cae12925185eb4c598 upstream. + +When we remove a IBSS/AP/Mesh interface we stop DMA +but to do this we should ensure hardware is on. Awaken +the device prior to these calls. This should ensure +DMA is stopped upon suspend and plain device removal. + +Signed-off-by: Luis R. Rodriguez +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/ath/ath9k/main.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/net/wireless/ath/ath9k/main.c ++++ b/drivers/net/wireless/ath/ath9k/main.c +@@ -2277,8 +2277,10 @@ static void ath9k_remove_interface(struc + if ((sc->sc_ah->opmode == NL80211_IFTYPE_AP) || + (sc->sc_ah->opmode == NL80211_IFTYPE_ADHOC) || + (sc->sc_ah->opmode == NL80211_IFTYPE_MESH_POINT)) { ++ ath9k_ps_wakeup(sc); + ath9k_hw_stoptxdma(sc->sc_ah, sc->beacon.beaconq); + ath_beacon_return(sc, avp); ++ ath9k_ps_restore(sc); + } + + sc->sc_flags &= ~SC_OP_BEACONS; diff --git a/queue-2.6.32/ath9k_hw-fix-ar_gpio_input_en_val_bt_priority_bb-and-its-shift-value-in-0x4054.patch b/queue-2.6.32/ath9k_hw-fix-ar_gpio_input_en_val_bt_priority_bb-and-its-shift-value-in-0x4054.patch new file mode 100644 index 00000000000..51e78782614 --- /dev/null +++ b/queue-2.6.32/ath9k_hw-fix-ar_gpio_input_en_val_bt_priority_bb-and-its-shift-value-in-0x4054.patch @@ -0,0 +1,36 @@ +From c37919bfe0a5c1bee9a31701a31e05a2f8840936 Mon Sep 17 00:00:00 2001 +From: Vasanthakumar Thiagarajan +Date: Fri, 13 Nov 2009 14:32:40 +0530 +Subject: ath9k_hw: Fix AR_GPIO_INPUT_EN_VAL_BT_PRIORITY_BB and its shift value in 0x4054 + +From: Vasanthakumar Thiagarajan + +commit c37919bfe0a5c1bee9a31701a31e05a2f8840936 upstream. + +The bit value of AR_GPIO_INPUT_EN_VAL_BT_PRIORITY_BB is wrong, it should +be 0x400 and the number of bits to be right shifted is 10. Having this +wrong value in 0x4054 sometimes affects bt quality on btcoex environment. + +Signed-off-by: Vasanthakumar Thiagarajan +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/ath/ath9k/reg.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/net/wireless/ath/ath9k/reg.h ++++ b/drivers/net/wireless/ath/ath9k/reg.h +@@ -969,10 +969,10 @@ enum { + #define AR_GPIO_INPUT_EN_VAL_BT_ACTIVE_S 4 + #define AR_GPIO_INPUT_EN_VAL_RFSILENT_DEF 0x00000080 + #define AR_GPIO_INPUT_EN_VAL_RFSILENT_DEF_S 7 ++#define AR_GPIO_INPUT_EN_VAL_BT_PRIORITY_BB 0x00000400 ++#define AR_GPIO_INPUT_EN_VAL_BT_PRIORITY_BB_S 10 + #define AR_GPIO_INPUT_EN_VAL_BT_ACTIVE_BB 0x00001000 + #define AR_GPIO_INPUT_EN_VAL_BT_ACTIVE_BB_S 12 +-#define AR_GPIO_INPUT_EN_VAL_BT_PRIORITY_BB 0x00001000 +-#define AR_GPIO_INPUT_EN_VAL_BT_PRIORITY_BB_S 1 + #define AR_GPIO_INPUT_EN_VAL_RFSILENT_BB 0x00008000 + #define AR_GPIO_INPUT_EN_VAL_RFSILENT_BB_S 15 + #define AR_GPIO_RTC_RESET_OVERRIDE_ENABLE 0x00010000 diff --git a/queue-2.6.32/ath9k_hw-fix-possible-oob-array-indexing-in-gen_timer_index-on-64-bit.patch b/queue-2.6.32/ath9k_hw-fix-possible-oob-array-indexing-in-gen_timer_index-on-64-bit.patch new file mode 100644 index 00000000000..b95fae2eca8 --- /dev/null +++ b/queue-2.6.32/ath9k_hw-fix-possible-oob-array-indexing-in-gen_timer_index-on-64-bit.patch @@ -0,0 +1,34 @@ +From c90017dd43f0cdb42134b9229761e8be02bcd524 Mon Sep 17 00:00:00 2001 +From: Vasanthakumar Thiagarajan +Date: Fri, 13 Nov 2009 14:32:39 +0530 +Subject: ath9k_hw: Fix possible OOB array indexing in gen_timer_index[] on 64-bit + +From: Vasanthakumar Thiagarajan + +commit c90017dd43f0cdb42134b9229761e8be02bcd524 upstream. + +debruijn32 (0x077CB531) is used to index gen_timer_index[] +which is an array of 32 u32. Having debruijn32 as unsigned +long on a 64-bit platform will result in indexing more than 32 +in gen_timer_index[] and there by causing a crash. Make it +unsigned to fix this issue. + +Signed-off-by: Vasanthakumar Thiagarajan +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/ath/ath9k/hw.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/wireless/ath/ath9k/hw.h ++++ b/drivers/net/wireless/ath/ath9k/hw.h +@@ -408,7 +408,7 @@ struct ath9k_hw_version { + * Using de Bruijin sequence to to look up 1's index in a 32 bit number + * debruijn32 = 0000 0111 0111 1100 1011 0101 0011 0001 + */ +-#define debruijn32 0x077CB531UL ++#define debruijn32 0x077CB531U + + struct ath_gen_timer_configuration { + u32 next_addr; diff --git a/queue-2.6.32/bluetooth-prevent-ill-timed-autosuspend-in-usb-driver.patch b/queue-2.6.32/bluetooth-prevent-ill-timed-autosuspend-in-usb-driver.patch new file mode 100644 index 00000000000..6c7e5aa1b0c --- /dev/null +++ b/queue-2.6.32/bluetooth-prevent-ill-timed-autosuspend-in-usb-driver.patch @@ -0,0 +1,30 @@ +From 652fd781a52ad6e24b908cd8b83d12699754f253 Mon Sep 17 00:00:00 2001 +From: Oliver Neukum +Date: Wed, 16 Dec 2009 19:23:43 +0100 +Subject: Bluetooth: Prevent ill-timed autosuspend in USB driver + +From: Oliver Neukum + +commit 652fd781a52ad6e24b908cd8b83d12699754f253 upstream. + +The device must be marked busy as it receives data. + +Signed-off-by: Oliver Neukum +Tested-by: Matthew Garrett +Signed-off-by: Marcel Holtmann +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/bluetooth/btusb.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -307,6 +307,7 @@ static void btusb_bulk_complete(struct u + return; + + usb_anchor_urb(urb, &data->bulk_anchor); ++ usb_mark_last_busy(data->udev); + + err = usb_submit_urb(urb, GFP_ATOMIC); + if (err < 0) { diff --git a/queue-2.6.32/cfg80211-fix-race-between-deauth-and-assoc-response.patch b/queue-2.6.32/cfg80211-fix-race-between-deauth-and-assoc-response.patch new file mode 100644 index 00000000000..4c3a346ceaa --- /dev/null +++ b/queue-2.6.32/cfg80211-fix-race-between-deauth-and-assoc-response.patch @@ -0,0 +1,92 @@ +From 3bdb2d48c5f58c781a4099c99044384a23620884 Mon Sep 17 00:00:00 2001 +From: Johannes Berg +Date: Wed, 23 Dec 2009 13:12:05 +0100 +Subject: cfg80211: fix race between deauth and assoc response + +From: Johannes Berg + +commit 3bdb2d48c5f58c781a4099c99044384a23620884 upstream. + +Joseph Nahmias reported, in http://bugs.debian.org/562016, +that he was getting the following warning (with some log +around the issue): + + ath0: direct probe to AP 00:11:95:77:e0:b0 (try 1) + ath0: direct probe responded + ath0: authenticate with AP 00:11:95:77:e0:b0 (try 1) + ath0: authenticated + ath0: associate with AP 00:11:95:77:e0:b0 (try 1) + ath0: deauthenticating from 00:11:95:77:e0:b0 by local choice (reason=3) + ath0: direct probe to AP 00:11:95:77:e0:b0 (try 1) + ath0: RX AssocResp from 00:11:95:77:e0:b0 (capab=0x421 status=0 aid=2) + ath0: associated + ------------[ cut here ]------------ + WARNING: at net/wireless/mlme.c:97 cfg80211_send_rx_assoc+0x14d/0x152 [cfg80211]() + Hardware name: 7658CTO + ... + Pid: 761, comm: phy0 Not tainted 2.6.32-trunk-686 #1 + Call Trace: + [] ? warn_slowpath_common+0x5e/0x8a + [] ? warn_slowpath_null+0xa/0xc + [] ? cfg80211_send_rx_assoc+0x14d/0x152 + ... + ath0: link becomes ready + ath0: deauthenticating from 00:11:95:77:e0:b0 by local choice (reason=3) + ath0: no IPv6 routers present + ath0: link is not ready + ath0: direct probe to AP 00:11:95:77:e0:b0 (try 1) + ath0: direct probe responded + ath0: authenticate with AP 00:11:95:77:e0:b0 (try 1) + ath0: authenticated + ath0: associate with AP 00:11:95:77:e0:b0 (try 1) + ath0: RX ReassocResp from 00:11:95:77:e0:b0 (capab=0x421 status=0 aid=2) + ath0: associated + +It is not clear to me how the first "direct probe" here +happens, but this seems to be a race condition, if the +user requests to deauth after requesting assoc, but before +the assoc response is received. In that case, it may +happen that mac80211 tries to report the assoc success to +cfg80211, but gets blocked on the wdev lock that is held +because the user is requesting the deauth. + +The result is that we run into a warning. This is mostly +harmless, but maybe cause an unexpected event to be sent +to userspace; we'd send an assoc success event although +userspace was no longer expecting that. + +To fix this, remove the warning and check whether the +race happened and in that case abort processing. + +Reported-by: Joseph Nahmias +Cc: 562016-quiet@bugs.debian.org +Signed-off-by: Johannes Berg +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + net/wireless/mlme.c | 13 ++++++++++++- + 1 file changed, 12 insertions(+), 1 deletion(-) + +--- a/net/wireless/mlme.c ++++ b/net/wireless/mlme.c +@@ -94,7 +94,18 @@ void cfg80211_send_rx_assoc(struct net_d + } + } + +- WARN_ON(!bss); ++ /* ++ * We might be coming here because the driver reported ++ * a successful association at the same time as the ++ * user requested a deauth. In that case, we will have ++ * removed the BSS from the auth_bsses list due to the ++ * deauth request when the assoc response makes it. If ++ * the two code paths acquire the lock the other way ++ * around, that's just the standard situation of a ++ * deauth being requested while connected. ++ */ ++ if (!bss) ++ goto out; + } else if (wdev->conn) { + cfg80211_sme_failed_assoc(wdev); + need_connect_result = false; diff --git a/queue-2.6.32/cifs-null-out-tcon-psesinfo-and-srvtcp-pointers-when-chasing-dfs-referrals.patch b/queue-2.6.32/cifs-null-out-tcon-psesinfo-and-srvtcp-pointers-when-chasing-dfs-referrals.patch new file mode 100644 index 00000000000..1bf7bc01f00 --- /dev/null +++ b/queue-2.6.32/cifs-null-out-tcon-psesinfo-and-srvtcp-pointers-when-chasing-dfs-referrals.patch @@ -0,0 +1,71 @@ +From a2934c7b363ddcc001964f2444649f909e583bef Mon Sep 17 00:00:00 2001 +From: Jeff Layton +Date: Thu, 3 Dec 2009 08:09:41 -0500 +Subject: cifs: NULL out tcon, pSesInfo, and srvTcp pointers when chasing DFS referrals + +From: Jeff Layton + +commit a2934c7b363ddcc001964f2444649f909e583bef upstream. + +The scenario is this: + +The kernel gets EREMOTE and starts chasing a DFS referral at mount time. +The tcon reference is put, which puts the session reference too, but +neither pointer is zeroed out. + +The mount gets retried (goto try_mount_again) with new mount info. +Session setup fails fails and rc ends up being non-zero. The code then +falls through to the end and tries to put the previously freed tcon +pointer again. Oops at: cifs_put_smb_ses+0x14/0xd0 + +Fix this by moving the initialization of the rc variable and the tcon, +pSesInfo and srvTcp pointers below the try_mount_again label. Also, add +a FreeXid() before the goto to prevent xid "leaks". + +Signed-off-by: Jeff Layton +Reported-by: Gustavo Carvalho Homem +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman + +--- + fs/cifs/connect.c | 13 +++++++++---- + 1 file changed, 9 insertions(+), 4 deletions(-) + +--- a/fs/cifs/connect.c ++++ b/fs/cifs/connect.c +@@ -2287,12 +2287,12 @@ int + cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb, + char *mount_data_global, const char *devname) + { +- int rc = 0; ++ int rc; + int xid; + struct smb_vol *volume_info; +- struct cifsSesInfo *pSesInfo = NULL; +- struct cifsTconInfo *tcon = NULL; +- struct TCP_Server_Info *srvTcp = NULL; ++ struct cifsSesInfo *pSesInfo; ++ struct cifsTconInfo *tcon; ++ struct TCP_Server_Info *srvTcp; + char *full_path; + char *mount_data = mount_data_global; + #ifdef CONFIG_CIFS_DFS_UPCALL +@@ -2301,6 +2301,10 @@ cifs_mount(struct super_block *sb, struc + int referral_walks_count = 0; + try_mount_again: + #endif ++ rc = 0; ++ tcon = NULL; ++ pSesInfo = NULL; ++ srvTcp = NULL; + full_path = NULL; + + xid = GetXid(); +@@ -2597,6 +2601,7 @@ remote_path_check: + + cleanup_volume_info(&volume_info); + referral_walks_count++; ++ FreeXid(xid); + goto try_mount_again; + } + #else /* No DFS support, return error on mount */ diff --git a/queue-2.6.32/clockevents-prevent-clockevent_devices-list-corruption-on-cpu-hotplug.patch b/queue-2.6.32/clockevents-prevent-clockevent_devices-list-corruption-on-cpu-hotplug.patch new file mode 100644 index 00000000000..a470e4f2f2d --- /dev/null +++ b/queue-2.6.32/clockevents-prevent-clockevent_devices-list-corruption-on-cpu-hotplug.patch @@ -0,0 +1,67 @@ +From bb6eddf7676e1c1f3e637aa93c5224488d99036f Mon Sep 17 00:00:00 2001 +From: Thomas Gleixner +Date: Thu, 10 Dec 2009 15:35:10 +0100 +Subject: clockevents: Prevent clockevent_devices list corruption on cpu hotplug + +From: Thomas Gleixner + +commit bb6eddf7676e1c1f3e637aa93c5224488d99036f upstream. + +Xiaotian Feng triggered a list corruption in the clock events list on +CPU hotplug and debugged the root cause. + +If a CPU registers more than one per cpu clock event device, then only +the active clock event device is removed on CPU_DEAD. The unused +devices are kept in the clock events device list. + +On CPU up the clock event devices are registered again, which means +that we list_add an already enqueued list_head. That results in list +corruption. + +Resolve this by removing all devices which are associated to the dead +CPU on CPU_DEAD. + +Reported-by: Xiaotian Feng +Signed-off-by: Thomas Gleixner +Tested-by: Xiaotian Feng +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/time/clockevents.c | 18 +++++++++++++++--- + 1 file changed, 15 insertions(+), 3 deletions(-) + +--- a/kernel/time/clockevents.c ++++ b/kernel/time/clockevents.c +@@ -237,8 +237,9 @@ void clockevents_exchange_device(struct + */ + void clockevents_notify(unsigned long reason, void *arg) + { +- struct list_head *node, *tmp; ++ struct clock_event_device *dev, *tmp; + unsigned long flags; ++ int cpu; + + spin_lock_irqsave(&clockevents_lock, flags); + clockevents_do_notify(reason, arg); +@@ -249,8 +250,19 @@ void clockevents_notify(unsigned long re + * Unregister the clock event devices which were + * released from the users in the notify chain. + */ +- list_for_each_safe(node, tmp, &clockevents_released) +- list_del(node); ++ list_for_each_entry_safe(dev, tmp, &clockevents_released, list) ++ list_del(&dev->list); ++ /* ++ * Now check whether the CPU has left unused per cpu devices ++ */ ++ cpu = *((int *)arg); ++ list_for_each_entry_safe(dev, tmp, &clockevent_devices, list) { ++ if (cpumask_test_cpu(cpu, dev->cpumask) && ++ cpumask_weight(dev->cpumask) == 1) { ++ BUG_ON(dev->mode != CLOCK_EVT_MODE_UNUSED); ++ list_del(&dev->list); ++ } ++ } + break; + default: + break; diff --git a/queue-2.6.32/dma-at_hdmac-correct-incompatible-type-for-argument-1-of-spin_lock_bh.patch b/queue-2.6.32/dma-at_hdmac-correct-incompatible-type-for-argument-1-of-spin_lock_bh.patch new file mode 100644 index 00000000000..dc0250e407a --- /dev/null +++ b/queue-2.6.32/dma-at_hdmac-correct-incompatible-type-for-argument-1-of-spin_lock_bh.patch @@ -0,0 +1,39 @@ +From 4297a462f455e38f08976df7b16c849614a287da Mon Sep 17 00:00:00 2001 +From: Nicolas Ferre +Date: Wed, 16 Dec 2009 16:28:03 +0100 +Subject: dma: at_hdmac: correct incompatible type for argument 1 of 'spin_lock_bh' + +From: Nicolas Ferre + +commit 4297a462f455e38f08976df7b16c849614a287da upstream. + +Correct a typo error in locking calls. + +Signed-off-by: Nicolas Ferre +Signed-off-by: Dan Williams +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/dma/at_hdmac.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/dma/at_hdmac.c ++++ b/drivers/dma/at_hdmac.c +@@ -815,7 +815,7 @@ atc_is_tx_complete(struct dma_chan *chan + dev_vdbg(chan2dev(chan), "is_tx_complete: %d (d%d, u%d)\n", + cookie, done ? *done : 0, used ? *used : 0); + +- spin_lock_bh(atchan->lock); ++ spin_lock_bh(&atchan->lock); + + last_complete = atchan->completed_cookie; + last_used = chan->cookie; +@@ -830,7 +830,7 @@ atc_is_tx_complete(struct dma_chan *chan + ret = dma_async_is_complete(cookie, last_complete, last_used); + } + +- spin_unlock_bh(atchan->lock); ++ spin_unlock_bh(&atchan->lock); + + if (done) + *done = last_complete; diff --git a/queue-2.6.32/dma-debug-do-not-add-notifier-when-dma-debugging-is-disabled.patch b/queue-2.6.32/dma-debug-do-not-add-notifier-when-dma-debugging-is-disabled.patch new file mode 100644 index 00000000000..b9f0e19fe65 --- /dev/null +++ b/queue-2.6.32/dma-debug-do-not-add-notifier-when-dma-debugging-is-disabled.patch @@ -0,0 +1,52 @@ +From f797d9881b62c2ddb1d2e7bd80d87141949c84aa Mon Sep 17 00:00:00 2001 +From: Shaun Ruffell +Date: Thu, 17 Dec 2009 18:00:36 -0600 +Subject: dma-debug: Do not add notifier when dma debugging is disabled. + +From: Shaun Ruffell + +commit f797d9881b62c2ddb1d2e7bd80d87141949c84aa upstream. + +If CONFIG_HAVE_DMA_API_DEBUG is defined and "dma_debug=off" is +specified on the kernel command line, when you detach a driver from a +device you can cause the following NULL pointer dereference: + +BUG: unable to handle kernel NULL pointer dereference at (null) +IP: [] dma_debug_device_change+0x5d/0x117 + +The problem is that the dma_debug_device_change notifier function is +added to the bus notifier chain even though the dma_entry_hash array +was never initialized. If dma debugging is disabled, this patch both +prevents dma_debug_device_change notifiers from being added to the +chain, and additionally ensures that the dma_debug_device_change +notifier function is a no-op. + +Signed-off-by: Shaun Ruffell +Signed-off-by: Joerg Roedel +Signed-off-by: Greg Kroah-Hartman + +--- + lib/dma-debug.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/lib/dma-debug.c ++++ b/lib/dma-debug.c +@@ -676,6 +676,8 @@ static int dma_debug_device_change(struc + struct device *dev = data; + int count; + ++ if (global_disable) ++ return; + + switch (action) { + case BUS_NOTIFY_UNBOUND_DRIVER: +@@ -697,6 +699,9 @@ void dma_debug_add_bus(struct bus_type * + { + struct notifier_block *nb; + ++ if (global_disable) ++ return; ++ + nb = kzalloc(sizeof(struct notifier_block), GFP_KERNEL); + if (nb == NULL) { + pr_err("dma_debug_add_bus: out of memory\n"); diff --git a/queue-2.6.32/dma-debug-fix-bug-causing-build-warning.patch b/queue-2.6.32/dma-debug-fix-bug-causing-build-warning.patch new file mode 100644 index 00000000000..3ccff926877 --- /dev/null +++ b/queue-2.6.32/dma-debug-fix-bug-causing-build-warning.patch @@ -0,0 +1,49 @@ +From a8fe9ea200ea21421ea750423d1d4d4f7ce037cf Mon Sep 17 00:00:00 2001 +From: Ingo Molnar +Date: Thu, 31 Dec 2009 15:16:23 +0100 +Subject: dma-debug: Fix bug causing build warning + +From: Ingo Molnar + +commit a8fe9ea200ea21421ea750423d1d4d4f7ce037cf upstream. + +Stephen Rothwell reported the following build warning: + + lib/dma-debug.c: In function 'dma_debug_device_change': + lib/dma-debug.c:680: warning: 'return' with no value, in function returning non-void + +Introduced by commit f797d9881b62c2ddb1d2e7bd80d87141949c84aa +("dma-debug: Do not add notifier when dma debugging is disabled"). + +Return 0 [notify-done] when disabled. (this is standard bus notifier behavior.) + +Signed-off-by: Shaun Ruffell +Signed-off-by: Joerg Roedel +Cc: Linus Torvalds +LKML-Reference: <20091231125624.GA14666@liondog.tnic> +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + lib/dma-debug.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +--- a/lib/dma-debug.c ++++ b/lib/dma-debug.c +@@ -670,14 +670,13 @@ static int device_dma_allocations(struct + return count; + } + +-static int dma_debug_device_change(struct notifier_block *nb, +- unsigned long action, void *data) ++static int dma_debug_device_change(struct notifier_block *nb, unsigned long action, void *data) + { + struct device *dev = data; + int count; + + if (global_disable) +- return; ++ return 0; + + switch (action) { + case BUS_NOTIFY_UNBOUND_DRIVER: diff --git a/queue-2.6.32/drivers-net-usb-correct-code-taking-the-size-of-a-pointer.patch b/queue-2.6.32/drivers-net-usb-correct-code-taking-the-size-of-a-pointer.patch new file mode 100644 index 00000000000..a030d3017e6 --- /dev/null +++ b/queue-2.6.32/drivers-net-usb-correct-code-taking-the-size-of-a-pointer.patch @@ -0,0 +1,41 @@ +From 6057912d7baad31be9819518674ffad349a065b1 Mon Sep 17 00:00:00 2001 +From: Julia Lawall +Date: Sun, 13 Dec 2009 05:47:04 +0000 +Subject: drivers/net/usb: Correct code taking the size of a pointer + +From: Julia Lawall + +commit 6057912d7baad31be9819518674ffad349a065b1 upstream. + +sizeof(dev->dev_addr) is the size of a pointer. A few lines above, the +size of this field is obtained using netdev->addr_len for a call to memcpy, +so do the same here. + +A simplified version of the semantic patch that finds this problem is as +follows: (http://coccinelle.lip6.fr/) + +// +@@ +expression *x; +expression f; +type T; +@@ + +*f(...,(T)x,...) +// + +Signed-off-by: Julia Lawall +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- a/drivers/net/usb/rtl8150.c ++++ b/drivers/net/usb/rtl8150.c +@@ -324,7 +324,7 @@ static int rtl8150_set_mac_address(struct net_device *netdev, void *p) + dbg("%02X:", netdev->dev_addr[i]); + dbg("%02X\n", netdev->dev_addr[i]); + /* Set the IDR registers. */ +- set_registers(dev, IDR, sizeof(netdev->dev_addr), netdev->dev_addr); ++ set_registers(dev, IDR, netdev->addr_len, netdev->dev_addr); + #ifdef EEPROM_WRITE + { + u8 cr; diff --git a/queue-2.6.32/drm-radeon-fix-build-on-64-bit-with-some-compilers.patch b/queue-2.6.32/drm-radeon-fix-build-on-64-bit-with-some-compilers.patch new file mode 100644 index 00000000000..b641e82588a --- /dev/null +++ b/queue-2.6.32/drm-radeon-fix-build-on-64-bit-with-some-compilers.patch @@ -0,0 +1,32 @@ +From 794f3141a194a4f4c28c1d417b071a901f78d9bb Mon Sep 17 00:00:00 2001 +From: Dave Airlie +Date: Sun, 20 Dec 2009 16:08:40 +1000 +Subject: drm/radeon: fix build on 64-bit with some compilers. + +From: Dave Airlie + +commit 794f3141a194a4f4c28c1d417b071a901f78d9bb upstream. + +drivers/gpu/drm/radeon/radeon_test.c:45: undefined reference to `__udivdi3' + +Reported-by: Mr. James W. Laferriere +Signed-off-by: Dave Airlie +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/radeon/radeon_test.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/radeon/radeon_test.c ++++ b/drivers/gpu/drm/radeon/radeon_test.c +@@ -42,8 +42,8 @@ void radeon_test_moves(struct radeon_dev + /* Number of tests = + * (Total GTT - IB pool - writeback page - ring buffer) / test size + */ +- n = (rdev->mc.gtt_size - RADEON_IB_POOL_SIZE*64*1024 - RADEON_GPU_PAGE_SIZE - +- rdev->cp.ring_size) / size; ++ n = ((u32)(rdev->mc.gtt_size - RADEON_IB_POOL_SIZE*64*1024 - RADEON_GPU_PAGE_SIZE - ++ rdev->cp.ring_size)) / size; + + gtt_obj = kzalloc(n * sizeof(*gtt_obj), GFP_KERNEL); + if (!gtt_obj) { diff --git a/queue-2.6.32/ioat2-3-put-channel-hardware-in-known-state-at-init.patch b/queue-2.6.32/ioat2-3-put-channel-hardware-in-known-state-at-init.patch new file mode 100644 index 00000000000..dd8819a2756 --- /dev/null +++ b/queue-2.6.32/ioat2-3-put-channel-hardware-in-known-state-at-init.patch @@ -0,0 +1,314 @@ +From a6d52d70677e99bdb89b6921c265d0a58c22e597 Mon Sep 17 00:00:00 2001 +From: Dan Williams +Date: Sat, 19 Dec 2009 15:36:02 -0700 +Subject: ioat2,3: put channel hardware in known state at init + +From: Dan Williams + +commit a6d52d70677e99bdb89b6921c265d0a58c22e597 upstream. + +Put the ioat2 and ioat3 state machines in the halted state with all +errors cleared. + +The ioat1 init path is not disturbed for stability, there are no +reported ioat1 initiaization issues. + +Reported-by: Roland Dreier +Tested-by: Roland Dreier +Acked-by: Simon Horman +Signed-off-by: Dan Williams +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/dma/ioat/dma.c | 2 - + drivers/dma/ioat/dma.h | 18 +++++++++++ + drivers/dma/ioat/dma_v2.c | 69 ++++++++++++++++++++++++++++++++----------- + drivers/dma/ioat/dma_v2.h | 2 + + drivers/dma/ioat/dma_v3.c | 54 ++++++++++++++++++++++++--------- + drivers/dma/ioat/registers.h | 1 + 6 files changed, 114 insertions(+), 32 deletions(-) + +--- a/drivers/dma/ioat/dma.c ++++ b/drivers/dma/ioat/dma.c +@@ -1032,7 +1032,7 @@ int __devinit ioat_probe(struct ioatdma_ + dma->dev = &pdev->dev; + + if (!dma->chancnt) { +- dev_err(dev, "zero channels detected\n"); ++ dev_err(dev, "channel enumeration error\n"); + goto err_setup_interrupts; + } + +--- a/drivers/dma/ioat/dma.h ++++ b/drivers/dma/ioat/dma.h +@@ -60,6 +60,7 @@ + * @dca: direct cache access context + * @intr_quirk: interrupt setup quirk (for ioat_v1 devices) + * @enumerate_channels: hw version specific channel enumeration ++ * @reset_hw: hw version specific channel (re)initialization + * @cleanup_tasklet: select between the v2 and v3 cleanup routines + * @timer_fn: select between the v2 and v3 timer watchdog routines + * @self_test: hardware version specific self test for each supported op type +@@ -78,6 +79,7 @@ struct ioatdma_device { + struct dca_provider *dca; + void (*intr_quirk)(struct ioatdma_device *device); + int (*enumerate_channels)(struct ioatdma_device *device); ++ int (*reset_hw)(struct ioat_chan_common *chan); + void (*cleanup_tasklet)(unsigned long data); + void (*timer_fn)(unsigned long data); + int (*self_test)(struct ioatdma_device *device); +@@ -264,6 +266,22 @@ static inline void ioat_suspend(struct i + writeb(IOAT_CHANCMD_SUSPEND, chan->reg_base + IOAT_CHANCMD_OFFSET(ver)); + } + ++static inline void ioat_reset(struct ioat_chan_common *chan) ++{ ++ u8 ver = chan->device->version; ++ ++ writeb(IOAT_CHANCMD_RESET, chan->reg_base + IOAT_CHANCMD_OFFSET(ver)); ++} ++ ++static inline bool ioat_reset_pending(struct ioat_chan_common *chan) ++{ ++ u8 ver = chan->device->version; ++ u8 cmd; ++ ++ cmd = readb(chan->reg_base + IOAT_CHANCMD_OFFSET(ver)); ++ return (cmd & IOAT_CHANCMD_RESET) == IOAT_CHANCMD_RESET; ++} ++ + static inline void ioat_set_chainaddr(struct ioat_dma_chan *ioat, u64 addr) + { + struct ioat_chan_common *chan = &ioat->base; +--- a/drivers/dma/ioat/dma_v2.c ++++ b/drivers/dma/ioat/dma_v2.c +@@ -239,20 +239,50 @@ void __ioat2_restart_chan(struct ioat2_d + __ioat2_start_null_desc(ioat); + } + +-static void ioat2_restart_channel(struct ioat2_dma_chan *ioat) ++int ioat2_quiesce(struct ioat_chan_common *chan, unsigned long tmo) + { +- struct ioat_chan_common *chan = &ioat->base; +- unsigned long phys_complete; ++ unsigned long end = jiffies + tmo; ++ int err = 0; + u32 status; + + status = ioat_chansts(chan); + if (is_ioat_active(status) || is_ioat_idle(status)) + ioat_suspend(chan); + while (is_ioat_active(status) || is_ioat_idle(status)) { ++ if (end && time_after(jiffies, end)) { ++ err = -ETIMEDOUT; ++ break; ++ } + status = ioat_chansts(chan); + cpu_relax(); + } + ++ return err; ++} ++ ++int ioat2_reset_sync(struct ioat_chan_common *chan, unsigned long tmo) ++{ ++ unsigned long end = jiffies + tmo; ++ int err = 0; ++ ++ ioat_reset(chan); ++ while (ioat_reset_pending(chan)) { ++ if (end && time_after(jiffies, end)) { ++ err = -ETIMEDOUT; ++ break; ++ } ++ cpu_relax(); ++ } ++ ++ return err; ++} ++ ++static void ioat2_restart_channel(struct ioat2_dma_chan *ioat) ++{ ++ struct ioat_chan_common *chan = &ioat->base; ++ unsigned long phys_complete; ++ ++ ioat2_quiesce(chan, 0); + if (ioat_cleanup_preamble(chan, &phys_complete)) + __cleanup(ioat, phys_complete); + +@@ -318,6 +348,19 @@ void ioat2_timer_event(unsigned long dat + spin_unlock_bh(&chan->cleanup_lock); + } + ++static int ioat2_reset_hw(struct ioat_chan_common *chan) ++{ ++ /* throw away whatever the channel was doing and get it initialized */ ++ u32 chanerr; ++ ++ ioat2_quiesce(chan, msecs_to_jiffies(100)); ++ ++ chanerr = readl(chan->reg_base + IOAT_CHANERR_OFFSET); ++ writel(chanerr, chan->reg_base + IOAT_CHANERR_OFFSET); ++ ++ return ioat2_reset_sync(chan, msecs_to_jiffies(200)); ++} ++ + /** + * ioat2_enumerate_channels - find and initialize the device's channels + * @device: the device to be enumerated +@@ -360,6 +403,10 @@ int ioat2_enumerate_channels(struct ioat + (unsigned long) ioat); + ioat->xfercap_log = xfercap_log; + spin_lock_init(&ioat->ring_lock); ++ if (device->reset_hw(&ioat->base)) { ++ i = 0; ++ break; ++ } + } + dma->chancnt = i; + return i; +@@ -467,7 +514,6 @@ int ioat2_alloc_chan_resources(struct dm + struct ioat2_dma_chan *ioat = to_ioat2_chan(c); + struct ioat_chan_common *chan = &ioat->base; + struct ioat_ring_ent **ring; +- u32 chanerr; + int order; + + /* have we already been set up? */ +@@ -477,12 +523,6 @@ int ioat2_alloc_chan_resources(struct dm + /* Setup register to interrupt and write completion status on error */ + writew(IOAT_CHANCTRL_RUN, chan->reg_base + IOAT_CHANCTRL_OFFSET); + +- chanerr = readl(chan->reg_base + IOAT_CHANERR_OFFSET); +- if (chanerr) { +- dev_err(to_dev(chan), "CHANERR = %x, clearing\n", chanerr); +- writel(chanerr, chan->reg_base + IOAT_CHANERR_OFFSET); +- } +- + /* allocate a completion writeback area */ + /* doing 2 32bit writes to mmio since 1 64b write doesn't work */ + chan->completion = pci_pool_alloc(chan->device->completion_pool, +@@ -746,13 +786,7 @@ void ioat2_free_chan_resources(struct dm + tasklet_disable(&chan->cleanup_task); + del_timer_sync(&chan->timer); + device->cleanup_tasklet((unsigned long) ioat); +- +- /* Delay 100ms after reset to allow internal DMA logic to quiesce +- * before removing DMA descriptor resources. +- */ +- writeb(IOAT_CHANCMD_RESET, +- chan->reg_base + IOAT_CHANCMD_OFFSET(chan->device->version)); +- mdelay(100); ++ device->reset_hw(chan); + + spin_lock_bh(&ioat->ring_lock); + descs = ioat2_ring_space(ioat); +@@ -839,6 +873,7 @@ int __devinit ioat2_dma_probe(struct ioa + int err; + + device->enumerate_channels = ioat2_enumerate_channels; ++ device->reset_hw = ioat2_reset_hw; + device->cleanup_tasklet = ioat2_cleanup_tasklet; + device->timer_fn = ioat2_timer_event; + device->self_test = ioat_dma_self_test; +--- a/drivers/dma/ioat/dma_v2.h ++++ b/drivers/dma/ioat/dma_v2.h +@@ -185,6 +185,8 @@ bool reshape_ring(struct ioat2_dma_chan + void __ioat2_issue_pending(struct ioat2_dma_chan *ioat); + void ioat2_cleanup_tasklet(unsigned long data); + void ioat2_timer_event(unsigned long data); ++int ioat2_quiesce(struct ioat_chan_common *chan, unsigned long tmo); ++int ioat2_reset_sync(struct ioat_chan_common *chan, unsigned long tmo); + extern struct kobj_type ioat2_ktype; + extern struct kmem_cache *ioat2_cache; + #endif /* IOATDMA_V2_H */ +--- a/drivers/dma/ioat/dma_v3.c ++++ b/drivers/dma/ioat/dma_v3.c +@@ -1130,6 +1130,45 @@ static int __devinit ioat3_dma_self_test + return 0; + } + ++static int ioat3_reset_hw(struct ioat_chan_common *chan) ++{ ++ /* throw away whatever the channel was doing and get it ++ * initialized, with ioat3 specific workarounds ++ */ ++ struct ioatdma_device *device = chan->device; ++ struct pci_dev *pdev = device->pdev; ++ u32 chanerr; ++ u16 dev_id; ++ int err; ++ ++ ioat2_quiesce(chan, msecs_to_jiffies(100)); ++ ++ chanerr = readl(chan->reg_base + IOAT_CHANERR_OFFSET); ++ writel(chanerr, chan->reg_base + IOAT_CHANERR_OFFSET); ++ ++ /* -= IOAT ver.3 workarounds =- */ ++ /* Write CHANERRMSK_INT with 3E07h to mask out the errors ++ * that can cause stability issues for IOAT ver.3, and clear any ++ * pending errors ++ */ ++ pci_write_config_dword(pdev, IOAT_PCI_CHANERRMASK_INT_OFFSET, 0x3e07); ++ err = pci_read_config_dword(pdev, IOAT_PCI_CHANERR_INT_OFFSET, &chanerr); ++ if (err) { ++ dev_err(&pdev->dev, "channel error register unreachable\n"); ++ return err; ++ } ++ pci_write_config_dword(pdev, IOAT_PCI_CHANERR_INT_OFFSET, chanerr); ++ ++ /* Clear DMAUNCERRSTS Cfg-Reg Parity Error status bit ++ * (workaround for spurious config parity error after restart) ++ */ ++ pci_read_config_word(pdev, IOAT_PCI_DEVICE_ID_OFFSET, &dev_id); ++ if (dev_id == PCI_DEVICE_ID_INTEL_IOAT_TBG0) ++ pci_write_config_dword(pdev, IOAT_PCI_DMAUNCERRSTS_OFFSET, 0x10); ++ ++ return ioat2_reset_sync(chan, msecs_to_jiffies(200)); ++} ++ + int __devinit ioat3_dma_probe(struct ioatdma_device *device, int dca) + { + struct pci_dev *pdev = device->pdev; +@@ -1139,10 +1178,10 @@ int __devinit ioat3_dma_probe(struct ioa + struct ioat_chan_common *chan; + bool is_raid_device = false; + int err; +- u16 dev_id; + u32 cap; + + device->enumerate_channels = ioat2_enumerate_channels; ++ device->reset_hw = ioat3_reset_hw; + device->self_test = ioat3_dma_self_test; + dma = &device->common; + dma->device_prep_dma_memcpy = ioat2_dma_prep_memcpy_lock; +@@ -1218,19 +1257,6 @@ int __devinit ioat3_dma_probe(struct ioa + dma->device_prep_dma_xor_val = NULL; + #endif + +- /* -= IOAT ver.3 workarounds =- */ +- /* Write CHANERRMSK_INT with 3E07h to mask out the errors +- * that can cause stability issues for IOAT ver.3 +- */ +- pci_write_config_dword(pdev, IOAT_PCI_CHANERRMASK_INT_OFFSET, 0x3e07); +- +- /* Clear DMAUNCERRSTS Cfg-Reg Parity Error status bit +- * (workaround for spurious config parity error after restart) +- */ +- pci_read_config_word(pdev, IOAT_PCI_DEVICE_ID_OFFSET, &dev_id); +- if (dev_id == PCI_DEVICE_ID_INTEL_IOAT_TBG0) +- pci_write_config_dword(pdev, IOAT_PCI_DMAUNCERRSTS_OFFSET, 0x10); +- + err = ioat_probe(device); + if (err) + return err; +--- a/drivers/dma/ioat/registers.h ++++ b/drivers/dma/ioat/registers.h +@@ -27,6 +27,7 @@ + + #define IOAT_PCI_DEVICE_ID_OFFSET 0x02 + #define IOAT_PCI_DMAUNCERRSTS_OFFSET 0x148 ++#define IOAT_PCI_CHANERR_INT_OFFSET 0x180 + #define IOAT_PCI_CHANERRMASK_INT_OFFSET 0x184 + + /* MMIO Device Registers */ diff --git a/queue-2.6.32/ioat3-fix-p-disabled-q-continuation.patch b/queue-2.6.32/ioat3-fix-p-disabled-q-continuation.patch new file mode 100644 index 00000000000..42837c7a028 --- /dev/null +++ b/queue-2.6.32/ioat3-fix-p-disabled-q-continuation.patch @@ -0,0 +1,42 @@ +From cd78809f6191485a90ea6c92c2b58900ab5c156f Mon Sep 17 00:00:00 2001 +From: Dan Williams +Date: Thu, 17 Dec 2009 13:52:39 -0700 +Subject: ioat3: fix p-disabled q-continuation + +From: Dan Williams + +commit cd78809f6191485a90ea6c92c2b58900ab5c156f upstream. + +When continuing a pq calculation the driver needs 3 extra sources. The +driver can perform a 3 source calculation with a single descriptor, but +needs an extended descriptor to process up to 8 sources in one +operation. However, in the p-disabled case only one extra source is +needed. When continuing a p-disabled operation there are occasions +(i.e. 0 < src_cnt % 8 < 3) where the tail operation does not need an +extended descriptor. Properly account for this fact otherwise invalid +'dmacount' values will be written to hardware usually causing the +channel to halt with 'invalid descriptor' errors. + +Signed-off-by: Dan Williams +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/dma/ioat/dma_v3.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/dma/ioat/dma_v3.c ++++ b/drivers/dma/ioat/dma_v3.c +@@ -650,9 +650,11 @@ __ioat3_prep_pq_lock(struct dma_chan *c, + + num_descs = ioat2_xferlen_to_descs(ioat, len); + /* we need 2x the number of descriptors to cover greater than 3 +- * sources ++ * sources (we need 1 extra source in the q-only continuation ++ * case and 3 extra sources in the p+q continuation case. + */ +- if (src_cnt > 3 || flags & DMA_PREP_CONTINUE) { ++ if (src_cnt + dmaf_p_disabled_continue(flags) > 3 || ++ (dmaf_continue(flags) && !dmaf_p_disabled_continue(flags))) { + with_ext = 1; + num_descs *= 2; + } else diff --git a/queue-2.6.32/iwl3945-disable-power-save.patch b/queue-2.6.32/iwl3945-disable-power-save.patch new file mode 100644 index 00000000000..7a4773bbc93 --- /dev/null +++ b/queue-2.6.32/iwl3945-disable-power-save.patch @@ -0,0 +1,61 @@ +From bc45a67079c916a9bd0a95b0b879cc0f259bac6e Mon Sep 17 00:00:00 2001 +From: Reinette Chatre +Date: Mon, 14 Dec 2009 14:12:10 -0800 +Subject: iwl3945: disable power save + +From: Reinette Chatre + +commit bc45a67079c916a9bd0a95b0b879cc0f259bac6e upstream. + +we see from http://bugzilla.intellinuxwireless.org/show_bug.cgi?id=2125 +that power saving does not work well on 3945. Since then power saving has +also been connected with association problems where an AP deathenticates a +3945 after it is unable to transmit data to it - this happens when 3945 +enters power savings mode. + +Disable power save support until issues are resolved. + +Signed-off-by: Reinette Chatre +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/iwlwifi/iwl-3945.c | 2 ++ + drivers/net/wireless/iwlwifi/iwl3945-base.c | 8 +++++--- + 2 files changed, 7 insertions(+), 3 deletions(-) + +--- a/drivers/net/wireless/iwlwifi/iwl3945-base.c ++++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c +@@ -3854,9 +3854,11 @@ static int iwl3945_setup_mac(struct iwl_ + /* Tell mac80211 our characteristics */ + hw->flags = IEEE80211_HW_SIGNAL_DBM | + IEEE80211_HW_NOISE_DBM | +- IEEE80211_HW_SPECTRUM_MGMT | +- IEEE80211_HW_SUPPORTS_PS | +- IEEE80211_HW_SUPPORTS_DYNAMIC_PS; ++ IEEE80211_HW_SPECTRUM_MGMT; ++ ++ if (!priv->cfg->broken_powersave) ++ hw->flags |= IEEE80211_HW_SUPPORTS_PS | ++ IEEE80211_HW_SUPPORTS_DYNAMIC_PS; + + hw->wiphy->interface_modes = + BIT(NL80211_IFTYPE_STATION) | +--- a/drivers/net/wireless/iwlwifi/iwl-3945.c ++++ b/drivers/net/wireless/iwlwifi/iwl-3945.c +@@ -2895,6 +2895,7 @@ static struct iwl_cfg iwl3945_bg_cfg = { + .mod_params = &iwl3945_mod_params, + .use_isr_legacy = true, + .ht_greenfield_support = false, ++ .broken_powersave = true, + }; + + static struct iwl_cfg iwl3945_abg_cfg = { +@@ -2909,6 +2910,7 @@ static struct iwl_cfg iwl3945_abg_cfg = + .mod_params = &iwl3945_mod_params, + .use_isr_legacy = true, + .ht_greenfield_support = false, ++ .broken_powersave = true, + }; + + struct pci_device_id iwl3945_hw_card_ids[] = { diff --git a/queue-2.6.32/iwl3945-fix-panic-in-iwl3945-driver.patch b/queue-2.6.32/iwl3945-fix-panic-in-iwl3945-driver.patch new file mode 100644 index 00000000000..e52b0f5db8b --- /dev/null +++ b/queue-2.6.32/iwl3945-fix-panic-in-iwl3945-driver.patch @@ -0,0 +1,119 @@ +From dc57a303faab8562b92e85df0d79c4a05d7e2a61 Mon Sep 17 00:00:00 2001 +From: Zhu Yi +Date: Mon, 14 Dec 2009 14:12:12 -0800 +Subject: iwl3945: fix panic in iwl3945 driver + +From: Zhu Yi + +commit dc57a303faab8562b92e85df0d79c4a05d7e2a61 upstream. + +3945 updated write_ptr without regard to read_ptr on the Tx path. +This messes up our TFD on high load and result in the following: + +<1>[ 7290.414172] IP: [] iwl3945_rx_reply_tx+0xc1/0x450 [iwl3945] +<4>[ 7290.414205] PGD 0 +<1>[ 7290.414214] Thread overran stack, or stack corrupted +<0>[ 7290.414229] Oops: 0002 [#1] PREEMPT SMP +<0>[ 7290.414246] last sysfs file: /sys/devices/platform/coretemp.1/temp1_input +<4>[ 7290.414265] CPU 0 +<4>[ 7290.414274] Modules linked in: af_packet nfsd usb_storage usb_libusual cpufreq_powersave exportfs cpufreq_conservative iwl3945 nfs cpufreq_userspace snd_hda_codec_realtek acpi_cpufreq uvcvideo lockd iwlcore snd_hda_intel joydev coretemp nfs_acl videodev snd_hda_codec mac80211 v4l1_compat snd_hwdep sbp2 v4l2_compat_ioctl32 uhci_hcd psmouse auth_rpcgss ohci1394 cfg80211 ehci_hcd video ieee1394 snd_pcm serio_raw battery ac nvidia(P) usbcore output sunrpc evdev lirc_ene0100 snd_page_alloc rfkill tg3 libphy fuse lzo lzo_decompress lzo_compress +<6>[ 7290.414486] Pid: 0, comm: swapper Tainted: P 2.6.32-rc8-wl #213 Aspire 5720 +<6>[ 7290.414507] RIP: 0010:[] [] iwl3945_rx_reply_tx+0xc1/0x450 [iwl3945] +<6>[ 7290.414541] RSP: 0018:ffff880002203d60 EFLAGS: 00010246 +<6>[ 7290.414557] RAX: 000000000000004f RBX: ffff880064c11600 RCX: 0000000000000013 +<6>[ 7290.414576] RDX: ffffffffa0ddcf20 RSI: ffff8800512b7008 RDI: 0000000000000038 +<6>[ 7290.414596] RBP: ffff880002203dd0 R08: 0000000000000000 R09: 0000000000000100 +<6>[ 7290.414616] R10: 0000000000000001 R11: 0000000000000000 R12: 00000000000000a0 +<6>[ 7290.414635] R13: 0000000000000002 R14: 0000000000000013 R15: 0000000000020201 +<6>[ 7290.414655] FS: 0000000000000000(0000) GS:ffff880002200000(0000) knlGS:0000000000000000 +<6>[ 7290.414677] CS: 0010 DS: 0018 ES: 0018 CR0: 000000008005003b +<6>[ 7290.414693] CR2: 0000000000000041 CR3: 0000000001001000 CR4: 00000000000006f0 +<6>[ 7290.414712] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +<6>[ 7290.414732] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 +<4>[ 7290.414752] Process swapper (pid: 0, threadinfo ffffffff81524000, task ffffffff81528b60) +<0>[ 7290.414772] Stack: +<4>[ 7290.414780] ffff880002203da0 0000000000000046 0000000000000000 0000000000000046 +<4>[ 7290.414804] <0> 0000000000000282 0000000000000282 0000000000000282 ffff880064c12010 +<4>[ 7290.414830] <0> ffff880002203db0 ffff880064c11600 ffff880064c12e50 ffff8800512b7000 +<0>[ 7290.414858] Call Trace: +<0>[ 7290.414867] +<4>[ 7290.414884] [] iwl3945_irq_tasklet+0x657/0x1740 [iwl3945] +<4>[ 7290.414910] [] ? _spin_unlock+0x30/0x60 +<4>[ 7290.414931] [] tasklet_action+0x101/0x110 +<4>[ 7290.414950] [] __do_softirq+0xc0/0x160 +<4>[ 7290.414968] [] call_softirq+0x1c/0x30 +<4>[ 7290.414986] [] do_softirq+0x75/0xb0 +<4>[ 7290.415003] [] irq_exit+0x95/0xa0 +<4>[ 7290.415020] [] do_IRQ+0x77/0xf0 +<4>[ 7290.415038] [] ret_from_intr+0x0/0xf +<0>[ 7290.415052] +<4>[ 7290.415067] [] ? acpi_idle_enter_bm+0x270/0x2a5 +<4>[ 7290.415087] [] ? acpi_idle_enter_bm+0x27a/0x2a5 +<4>[ 7290.415107] [] ? acpi_idle_enter_bm+0x270/0x2a5 +<4>[ 7290.415130] [] ? cpuidle_idle_call+0x93/0xf0 +<4>[ 7290.415149] [] ? cpu_idle+0xa7/0x110 +<4>[ 7290.415168] [] ? rest_init+0x75/0x80 +<4>[ 7290.415187] [] ? start_kernel+0x3a7/0x3b3 +<4>[ 7290.415206] [] ? x86_64_start_reservations+0x125/0x129 +<4>[ 7290.415227] [] ? x86_64_start_kernel+0xe4/0xeb +<0>[ 7290.415243] Code: 00 41 39 ce 0f 8d e8 01 00 00 48 8b 47 40 48 63 d2 48 69 d2 98 00 00 00 4c 8b 04 02 48 c7 c2 20 cf dd a0 49 8d 78 38 49 8d 40 4f 47 09 00 c6 47 0c 00 c6 47 0f 00 c6 47 12 00 c6 47 15 00 49 +<1>[ 7290.415382] RIP [] iwl3945_rx_reply_tx+0xc1/0x450 [iwl3945] +<4>[ 7290.415410] RSP +<0>[ 7290.415421] CR2: 0000000000000041 +<4>[ 7290.415436] ---[ end trace ec46807277caa515 ]--- +<0>[ 7290.415450] Kernel panic - not syncing: Fatal exception in interrupt +<4>[ 7290.415468] Pid: 0, comm: swapper Tainted: P D 2.6.32-rc8-wl #213 +<4>[ 7290.415486] Call Trace: +<4>[ 7290.415495] [] panic+0x7d/0x13a +<4>[ 7290.415519] [] oops_end+0xda/0xe0 +<4>[ 7290.415538] [] no_context+0xea/0x250 +<4>[ 7290.415557] [] ? select_task_rq_fair+0x511/0x780 +<4>[ 7290.415578] [] __bad_area_nosemaphore+0x125/0x1e0 +<4>[ 7290.415597] [] ? __enqueue_entity+0x7c/0x80 +<4>[ 7290.415616] [] ? enqueue_task_fair+0x111/0x150 +<4>[ 7290.415636] [] bad_area_nosemaphore+0xe/0x10 +<4>[ 7290.415656] [] do_page_fault+0x26a/0x320 +<4>[ 7290.415674] [] page_fault+0x1f/0x30 +<4>[ 7290.415697] [] ? iwl3945_rx_reply_tx+0xc1/0x450 [iwl3945] +<4>[ 7290.415723] [] iwl3945_irq_tasklet+0x657/0x1740 [iwl3945] +<4>[ 7290.415746] [] ? _spin_unlock+0x30/0x60 +<4>[ 7290.415764] [] tasklet_action+0x101/0x110 +<4>[ 7290.415783] [] __do_softirq+0xc0/0x160 +<4>[ 7290.415801] [] call_softirq+0x1c/0x30 +<4>[ 7290.415818] [] do_softirq+0x75/0xb0 +<4>[ 7290.415835] [] irq_exit+0x95/0xa0 +<4>[ 7290.415852] [] do_IRQ+0x77/0xf0 +<4>[ 7290.415869] [] ret_from_intr+0x0/0xf +<4>[ 7290.415883] [] ? acpi_idle_enter_bm+0x270/0x2a5 +<4>[ 7290.415911] [] ? acpi_idle_enter_bm+0x27a/0x2a5 +<4>[ 7290.415931] [] ? acpi_idle_enter_bm+0x270/0x2a5 +<4>[ 7290.415952] [] ? cpuidle_idle_call+0x93/0xf0 +<4>[ 7290.415971] [] ? cpu_idle+0xa7/0x110 +<4>[ 7290.415989] [] ? rest_init+0x75/0x80 +<4>[ 7290.416007] [] ? start_kernel+0x3a7/0x3b3 +<4>[ 7290.416026] [] ? x86_64_start_reservations+0x125/0x129 +<4>[ 7290.416047] [] ? x86_64_start_kernel+0xe4/0xeb + +Reported-by: Maxim Levitsky +Tested-by: Maxim Levitsky +Signed-off-by: Zhu Yi +Signed-off-by: Reinette Chatre +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/iwlwifi/iwl3945-base.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/net/wireless/iwlwifi/iwl3945-base.c ++++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c +@@ -562,6 +562,9 @@ static int iwl3945_tx_skb(struct iwl_pri + txq = &priv->txq[txq_id]; + q = &txq->q; + ++ if ((iwl_queue_space(q) < q->high_mark)) ++ goto drop; ++ + spin_lock_irqsave(&priv->lock, flags); + + idx = get_cmd_index(q, q->write_ptr, 0); diff --git a/queue-2.6.32/iwlwifi-fix-40mhz-operation-setting-on-cards-that-do-not-allow-it.patch b/queue-2.6.32/iwlwifi-fix-40mhz-operation-setting-on-cards-that-do-not-allow-it.patch new file mode 100644 index 00000000000..70083a3e4e5 --- /dev/null +++ b/queue-2.6.32/iwlwifi-fix-40mhz-operation-setting-on-cards-that-do-not-allow-it.patch @@ -0,0 +1,34 @@ +From 6c3069b1e7e983e176a5f826e2edffefdd404a08 Mon Sep 17 00:00:00 2001 +From: Reinette Chatre +Date: Mon, 14 Dec 2009 14:12:13 -0800 +Subject: iwlwifi: fix 40MHz operation setting on cards that do not allow it + +From: Reinette Chatre + +commit 6c3069b1e7e983e176a5f826e2edffefdd404a08 upstream. + +Some devices have 40MHz operation disabled entirely. Ensure that driver do +not enable 40MHz operation if a channel does not allow this. + +This fixes http://bugzilla.intellinuxwireless.org/show_bug.cgi?id=2135 + +Signed-off-by: Reinette Chatre +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/iwlwifi/iwl-eeprom.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/net/wireless/iwlwifi/iwl-eeprom.c ++++ b/drivers/net/wireless/iwlwifi/iwl-eeprom.c +@@ -711,7 +711,8 @@ static int iwl_mod_ht40_chan_info(struct + ch_info->ht40_min_power = 0; + ch_info->ht40_scan_power = eeprom_ch->max_power_avg; + ch_info->ht40_flags = eeprom_ch->flags; +- ch_info->ht40_extension_channel &= ~clear_ht40_extension_channel; ++ if (eeprom_ch->flags & EEPROM_CHANNEL_VALID) ++ ch_info->ht40_extension_channel &= ~clear_ht40_extension_channel; + + return 0; + } diff --git a/queue-2.6.32/iwlwifi-fix-eeprom-otp-reading-endian-annotations-and-a-bug.patch b/queue-2.6.32/iwlwifi-fix-eeprom-otp-reading-endian-annotations-and-a-bug.patch new file mode 100644 index 00000000000..f1f010776b7 --- /dev/null +++ b/queue-2.6.32/iwlwifi-fix-eeprom-otp-reading-endian-annotations-and-a-bug.patch @@ -0,0 +1,164 @@ +From af6b8ee38833b39f70946f767740565ceb126961 Mon Sep 17 00:00:00 2001 +From: Johannes Berg +Date: Mon, 14 Dec 2009 14:12:08 -0800 +Subject: iwlwifi: fix EEPROM/OTP reading endian annotations and a bug + +From: Johannes Berg + +commit af6b8ee38833b39f70946f767740565ceb126961 upstream. + +The construct "le16_to_cpu((__force __le16)(r >> 16))" has +always bothered me when looking through the iwlwifi code, +it shouldn't be necessary to __force anything, and before +this code, "r" was obtained with an ioread32, which swaps +each of the two u16 values in it properly when swapping the +entire u32 value. I've had arguments about this code with +people before, but always conceded they were right because +removing it only made things not work at all on big endian +platforms. + +However, analysing a failure of the OTP reading code, I now +finally figured out what is going on, and why my intuition +about that code being wrong was right all along. + +It turns out that the 'priv->eeprom' u8 array really wants +to have the data in it in little endian. So the force code +above and all really converts *to* little endian, not from +it. Cf., for instance, the function iwl_eeprom_query16() -- +it reads two u8 values and combines them into a u16, in a +little-endian way. And considering it more, it makes sense +to have the eeprom array as on the device, after all not +all values really are 16-bit values, the MAC address for +instance is not. + +Now, what this really means is that all the annotations are +completely wrong. The eeprom reading code should fill the +priv->eeprom array as a __le16 array, with __le16 values. + +This also means that iwl_read_otp_word() should really have +a __le16 pointer as the data argument, since it should be +filling that in a format suitable for priv->eeprom. + +Propagating these changes throughout, iwl_find_otp_image() +is found to be, now obviously visible, defective -- it uses +the data returned by iwl_read_otp_word() directly as if it +was CPU endianness. Fixing that, which is this hunk of the +patch: + +- next_link_addr = link_value * sizeof(u16); ++ next_link_addr = le16_to_cpu(link_value) * sizeof(u16); + +is the only real change of this patch. Everything else is +just fixing the sparse annotations. + +Also, the bug only shows up on big endian platforms with a +1000 series card. 5000 and previous series do not use OTP, +and 6000 series has shadow RAM support which means we don't +ever use the defective code on any cards but 1000. + +Signed-off-by: Johannes Berg +Signed-off-by: Reinette Chatre +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/iwlwifi/iwl-dev.h | 2 +- + drivers/net/wireless/iwlwifi/iwl-eeprom.c | 20 +++++++++++--------- + 2 files changed, 12 insertions(+), 10 deletions(-) + +--- a/drivers/net/wireless/iwlwifi/iwl-dev.h ++++ b/drivers/net/wireless/iwlwifi/iwl-dev.h +@@ -1149,7 +1149,7 @@ struct iwl_priv { + u32 last_beacon_time; + u64 last_tsf; + +- /* eeprom */ ++ /* eeprom -- this is in the card's little endian byte order */ + u8 *eeprom; + int nvm_device_type; + struct iwl_eeprom_calib_info *calib_info; +--- a/drivers/net/wireless/iwlwifi/iwl-eeprom.c ++++ b/drivers/net/wireless/iwlwifi/iwl-eeprom.c +@@ -337,7 +337,7 @@ static int iwl_init_otp_access(struct iw + return ret; + } + +-static int iwl_read_otp_word(struct iwl_priv *priv, u16 addr, u16 *eeprom_data) ++static int iwl_read_otp_word(struct iwl_priv *priv, u16 addr, __le16 *eeprom_data) + { + int ret = 0; + u32 r; +@@ -370,7 +370,7 @@ static int iwl_read_otp_word(struct iwl_ + CSR_OTP_GP_REG_ECC_CORR_STATUS_MSK); + IWL_ERR(priv, "Correctable OTP ECC error, continue read\n"); + } +- *eeprom_data = le16_to_cpu((__force __le16)(r >> 16)); ++ *eeprom_data = cpu_to_le16(r >> 16); + return 0; + } + +@@ -379,7 +379,8 @@ static int iwl_read_otp_word(struct iwl_ + */ + static bool iwl_is_otp_empty(struct iwl_priv *priv) + { +- u16 next_link_addr = 0, link_value; ++ u16 next_link_addr = 0; ++ __le16 link_value; + bool is_empty = false; + + /* locate the beginning of OTP link list */ +@@ -409,7 +410,8 @@ static bool iwl_is_otp_empty(struct iwl_ + static int iwl_find_otp_image(struct iwl_priv *priv, + u16 *validblockaddr) + { +- u16 next_link_addr = 0, link_value = 0, valid_addr; ++ u16 next_link_addr = 0, valid_addr; ++ __le16 link_value = 0; + int usedblocks = 0; + + /* set addressing mode to absolute to traverse the link list */ +@@ -429,7 +431,7 @@ static int iwl_find_otp_image(struct iwl + * check for more block on the link list + */ + valid_addr = next_link_addr; +- next_link_addr = link_value * sizeof(u16); ++ next_link_addr = le16_to_cpu(link_value) * sizeof(u16); + IWL_DEBUG_INFO(priv, "OTP blocks %d addr 0x%x\n", + usedblocks, next_link_addr); + if (iwl_read_otp_word(priv, next_link_addr, &link_value)) +@@ -463,7 +465,7 @@ static int iwl_find_otp_image(struct iwl + */ + int iwl_eeprom_init(struct iwl_priv *priv) + { +- u16 *e; ++ __le16 *e; + u32 gp = iwl_read32(priv, CSR_EEPROM_GP); + int sz; + int ret; +@@ -482,7 +484,7 @@ int iwl_eeprom_init(struct iwl_priv *pri + ret = -ENOMEM; + goto alloc_err; + } +- e = (u16 *)priv->eeprom; ++ e = (__le16 *)priv->eeprom; + + ret = priv->cfg->ops->lib->eeprom_ops.verify_signature(priv); + if (ret < 0) { +@@ -521,7 +523,7 @@ int iwl_eeprom_init(struct iwl_priv *pri + } + for (addr = validblockaddr; addr < validblockaddr + sz; + addr += sizeof(u16)) { +- u16 eeprom_data; ++ __le16 eeprom_data; + + ret = iwl_read_otp_word(priv, addr, &eeprom_data); + if (ret) +@@ -545,7 +547,7 @@ int iwl_eeprom_init(struct iwl_priv *pri + goto done; + } + r = _iwl_read_direct32(priv, CSR_EEPROM_REG); +- e[addr / 2] = le16_to_cpu((__force __le16)(r >> 16)); ++ e[addr / 2] = cpu_to_le16(r >> 16); + } + } + ret = 0; diff --git a/queue-2.6.32/iwlwifi-fix-more-eeprom-endian-bugs.patch b/queue-2.6.32/iwlwifi-fix-more-eeprom-endian-bugs.patch new file mode 100644 index 00000000000..fdbf807eafc --- /dev/null +++ b/queue-2.6.32/iwlwifi-fix-more-eeprom-endian-bugs.patch @@ -0,0 +1,108 @@ +From b7bb1756cb6a610cdbac8cfdad9e79bb5670b63b Mon Sep 17 00:00:00 2001 +From: Johannes Berg +Date: Mon, 14 Dec 2009 14:12:09 -0800 +Subject: iwlwifi: fix more eeprom endian bugs + +From: Johannes Berg + +commit b7bb1756cb6a610cdbac8cfdad9e79bb5670b63b upstream. + +I've also for a long time had a problem with the +temperature calculation code, which I had fixed +by byte-swapping the values, and now it turns out +that was the correct fix after all. + +Also, any use of iwl_eeprom_query_addr() that is +for more than a u8 must be cast to little endian, +and some structs as well. + +Fix all this. Again, no real impact on platforms +that already are little endian. + +Signed-off-by: Johannes Berg +Signed-off-by: Reinette Chatre +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/iwlwifi/iwl-4965.c | 2 +- + drivers/net/wireless/iwlwifi/iwl-5000-hw.h | 14 +++++++++----- + drivers/net/wireless/iwlwifi/iwl-5000.c | 7 ++++--- + drivers/net/wireless/iwlwifi/iwl-eeprom.h | 4 ++-- + 4 files changed, 16 insertions(+), 11 deletions(-) + +--- a/drivers/net/wireless/iwlwifi/iwl-4965.c ++++ b/drivers/net/wireless/iwlwifi/iwl-4965.c +@@ -1337,7 +1337,7 @@ static int iwl4965_fill_txpower_tbl(stru + iwl4965_interpolate_chan(priv, channel, &ch_eeprom_info); + + /* calculate tx gain adjustment based on power supply voltage */ +- voltage = priv->calib_info->voltage; ++ voltage = le16_to_cpu(priv->calib_info->voltage); + init_voltage = (s32)le32_to_cpu(priv->card_alive_init.voltage); + voltage_compensation = + iwl4965_get_voltage_compensation(voltage, init_voltage); +--- a/drivers/net/wireless/iwlwifi/iwl-5000.c ++++ b/drivers/net/wireless/iwlwifi/iwl-5000.c +@@ -460,14 +460,15 @@ static void iwl5000_set_ct_threshold(str + static int iwl5000_set_Xtal_calib(struct iwl_priv *priv) + { + struct iwl_calib_xtal_freq_cmd cmd; +- u16 *xtal_calib = (u16 *)iwl_eeprom_query_addr(priv, EEPROM_5000_XTAL); ++ __le16 *xtal_calib = ++ (__le16 *)iwl_eeprom_query_addr(priv, EEPROM_5000_XTAL); + + cmd.hdr.op_code = IWL_PHY_CALIBRATE_CRYSTAL_FRQ_CMD; + cmd.hdr.first_group = 0; + cmd.hdr.groups_num = 1; + cmd.hdr.data_valid = 1; +- cmd.cap_pin1 = (u8)xtal_calib[0]; +- cmd.cap_pin2 = (u8)xtal_calib[1]; ++ cmd.cap_pin1 = le16_to_cpu(xtal_calib[0]); ++ cmd.cap_pin2 = le16_to_cpu(xtal_calib[1]); + return iwl_calib_set(&priv->calib_results[IWL_CALIB_XTAL], + (u8 *)&cmd, sizeof(cmd)); + } +--- a/drivers/net/wireless/iwlwifi/iwl-5000-hw.h ++++ b/drivers/net/wireless/iwlwifi/iwl-5000-hw.h +@@ -92,11 +92,15 @@ + + static inline s32 iwl_temp_calib_to_offset(struct iwl_priv *priv) + { +- u16 *temp_calib = (u16 *)iwl_eeprom_query_addr(priv, +- EEPROM_5000_TEMPERATURE); +- /* offset = temperature - voltage / coef */ +- s32 offset = (s32)(temp_calib[0] - temp_calib[1] / IWL_5150_VOLTAGE_TO_TEMPERATURE_COEFF); +- return offset; ++ u16 temperature, voltage; ++ __le16 *temp_calib = ++ (__le16 *)iwl_eeprom_query_addr(priv, EEPROM_5000_TEMPERATURE); ++ ++ temperature = le16_to_cpu(temp_calib[0]); ++ voltage = le16_to_cpu(temp_calib[1]); ++ ++ /* offset = temp - volt / coeff */ ++ return (s32)(temperature - voltage / IWL_5150_VOLTAGE_TO_TEMPERATURE_COEFF); + } + + /* Fixed (non-configurable) rx data from phy */ +--- a/drivers/net/wireless/iwlwifi/iwl-eeprom.h ++++ b/drivers/net/wireless/iwlwifi/iwl-eeprom.h +@@ -133,7 +133,7 @@ struct iwl_eeprom_channel { + * + */ + struct iwl_eeprom_enhanced_txpwr { +- u16 reserved; ++ __le16 common; + s8 chain_a_max; + s8 chain_b_max; + s8 chain_c_max; +@@ -347,7 +347,7 @@ struct iwl_eeprom_calib_subband_info { + struct iwl_eeprom_calib_info { + u8 saturation_power24; /* half-dBm (e.g. "34" = 17 dBm) */ + u8 saturation_power52; /* half-dBm */ +- s16 voltage; /* signed */ ++ __le16 voltage; /* signed */ + struct iwl_eeprom_calib_subband_info + band_info[EEPROM_TX_POWER_BANDS]; + } __attribute__ ((packed)); diff --git a/queue-2.6.32/iwmc3200wifi-fix-array-out-of-boundary-access.patch b/queue-2.6.32/iwmc3200wifi-fix-array-out-of-boundary-access.patch new file mode 100644 index 00000000000..e8d1c7540b7 --- /dev/null +++ b/queue-2.6.32/iwmc3200wifi-fix-array-out-of-boundary-access.patch @@ -0,0 +1,31 @@ +From 6c853da3f30c93eae847ecbcd9fdf10ba0da04c2 Mon Sep 17 00:00:00 2001 +From: Zhu Yi +Date: Mon, 28 Dec 2009 14:23:11 +0800 +Subject: iwmc3200wifi: fix array out-of-boundary access + +From: Zhu Yi + +commit 6c853da3f30c93eae847ecbcd9fdf10ba0da04c2 upstream. + +Allocate priv->rx_packets[IWM_RX_ID_HASH + 1] because the max array +index is IWM_RX_ID_HASH according to IWM_RX_ID_GET_HASH(). + +Signed-off-by: Zhu Yi +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/iwmc3200wifi/iwm.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/wireless/iwmc3200wifi/iwm.h ++++ b/drivers/net/wireless/iwmc3200wifi/iwm.h +@@ -258,7 +258,7 @@ struct iwm_priv { + + struct sk_buff_head rx_list; + struct list_head rx_tickets; +- struct list_head rx_packets[IWM_RX_ID_HASH]; ++ struct list_head rx_packets[IWM_RX_ID_HASH + 1]; + struct workqueue_struct *rx_wq; + struct work_struct rx_worker; + diff --git a/queue-2.6.32/kvm-lapic-make-sure-irr-bitmap-is-scanned-after-vm-load.patch b/queue-2.6.32/kvm-lapic-make-sure-irr-bitmap-is-scanned-after-vm-load.patch new file mode 100644 index 00000000000..0d43e3d48b2 --- /dev/null +++ b/queue-2.6.32/kvm-lapic-make-sure-irr-bitmap-is-scanned-after-vm-load.patch @@ -0,0 +1,31 @@ +From 6e24a6eff4571002cd48b99a2b92dc829ce39cb9 Mon Sep 17 00:00:00 2001 +From: Marcelo Tosatti +Date: Mon, 14 Dec 2009 17:37:35 -0200 +Subject: KVM: LAPIC: make sure IRR bitmap is scanned after vm load + +From: Marcelo Tosatti + +commit 6e24a6eff4571002cd48b99a2b92dc829ce39cb9 upstream. + +The vcpus are initialized with irr_pending set to false, but +loading the LAPIC registers with pending IRR fails to reset +the irr_pending variable. + +Signed-off-by: Marcelo Tosatti +Signed-off-by: Avi Kivity +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kvm/lapic.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/arch/x86/kvm/lapic.c ++++ b/arch/x86/kvm/lapic.c +@@ -1156,6 +1156,7 @@ void kvm_apic_post_state_restore(struct + hrtimer_cancel(&apic->lapic_timer.timer); + update_divide_count(apic); + start_apic_timer(apic); ++ apic->irr_pending = true; + } + + void __kvm_migrate_apic_timer(struct kvm_vcpu *vcpu) diff --git a/queue-2.6.32/kvm-mmu-remove-prefault-from-invlpg-handler.patch b/queue-2.6.32/kvm-mmu-remove-prefault-from-invlpg-handler.patch new file mode 100644 index 00000000000..5400d6b0976 --- /dev/null +++ b/queue-2.6.32/kvm-mmu-remove-prefault-from-invlpg-handler.patch @@ -0,0 +1,70 @@ +From fb341f572d26e0786167cd96b90cc4febed830cf Mon Sep 17 00:00:00 2001 +From: Marcelo Tosatti +Date: Sat, 5 Dec 2009 12:34:11 -0200 +Subject: KVM: MMU: remove prefault from invlpg handler + +From: Marcelo Tosatti + +commit fb341f572d26e0786167cd96b90cc4febed830cf upstream. + +The invlpg prefault optimization breaks Windows 2008 R2 occasionally. + +The visible effect is that the invlpg handler instantiates a pte which +is, microseconds later, written with a different gfn by another vcpu. + +The OS could have other mechanisms to prevent a present translation from +being used, which the hypervisor is unaware of. + +While the documentation states that the cpu is at liberty to prefetch tlb +entries, it looks like this is not heeded, so remove tlb prefetch from +invlpg. + +Signed-off-by: Marcelo Tosatti +Signed-off-by: Avi Kivity +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kvm/paging_tmpl.h | 18 ------------------ + 1 file changed, 18 deletions(-) + +--- a/arch/x86/kvm/paging_tmpl.h ++++ b/arch/x86/kvm/paging_tmpl.h +@@ -455,8 +455,6 @@ out_unlock: + static void FNAME(invlpg)(struct kvm_vcpu *vcpu, gva_t gva) + { + struct kvm_shadow_walk_iterator iterator; +- pt_element_t gpte; +- gpa_t pte_gpa = -1; + int level; + u64 *sptep; + int need_flush = 0; +@@ -471,10 +469,6 @@ static void FNAME(invlpg)(struct kvm_vcp + if (level == PT_PAGE_TABLE_LEVEL || + ((level == PT_DIRECTORY_LEVEL && is_large_pte(*sptep))) || + ((level == PT_PDPE_LEVEL && is_large_pte(*sptep)))) { +- struct kvm_mmu_page *sp = page_header(__pa(sptep)); +- +- pte_gpa = (sp->gfn << PAGE_SHIFT); +- pte_gpa += (sptep - sp->spt) * sizeof(pt_element_t); + + if (is_shadow_present_pte(*sptep)) { + rmap_remove(vcpu->kvm, sptep); +@@ -493,18 +487,6 @@ static void FNAME(invlpg)(struct kvm_vcp + if (need_flush) + kvm_flush_remote_tlbs(vcpu->kvm); + spin_unlock(&vcpu->kvm->mmu_lock); +- +- if (pte_gpa == -1) +- return; +- if (kvm_read_guest_atomic(vcpu->kvm, pte_gpa, &gpte, +- sizeof(pt_element_t))) +- return; +- if (is_present_gpte(gpte) && (gpte & PT_ACCESSED_MASK)) { +- if (mmu_topup_memory_caches(vcpu)) +- return; +- kvm_mmu_pte_write(vcpu, pte_gpa, (const u8 *)&gpte, +- sizeof(pt_element_t), 0); +- } + } + + static gpa_t FNAME(gva_to_gpa)(struct kvm_vcpu *vcpu, gva_t vaddr) diff --git a/queue-2.6.32/libertas-fix-buffer-overflow-in-lbs_get_essid.patch b/queue-2.6.32/libertas-fix-buffer-overflow-in-lbs_get_essid.patch new file mode 100644 index 00000000000..45962a2ad6e --- /dev/null +++ b/queue-2.6.32/libertas-fix-buffer-overflow-in-lbs_get_essid.patch @@ -0,0 +1,50 @@ +From 45b241689179a6065384260242637cf21dabfb2d Mon Sep 17 00:00:00 2001 +From: Daniel Mack +Date: Wed, 16 Dec 2009 05:12:58 +0100 +Subject: Libertas: fix buffer overflow in lbs_get_essid() + +From: Daniel Mack + +commit 45b241689179a6065384260242637cf21dabfb2d upstream. + +The libertas driver copies the SSID buffer back to the wireless core and +appends a trailing NULL character for termination. This is + +a) unnecessary because the buffer is allocated with kzalloc and is hence + already NULLed when this function is called, and + +b) for priv->curbssparams.ssid_len == 32, it writes back one byte too + much which causes memory corruptions. + +Fix this by removing the extra write. + +Signed-off-by: Daniel Mack +Cc: Stephen Hemminger +Cc: Maithili Hinge +Cc: Kiran Divekar +Cc: Michael Hirsch +Cc: netdev@vger.kernel.org +Cc: libertas-dev@lists.infradead.org +Cc: linux-wireless@lists.infradead.org +Acked-by: Holger Schurig +Acked-by: Dan Williams +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/libertas/wext.c | 2 -- + 1 file changed, 2 deletions(-) + +--- a/drivers/net/wireless/libertas/wext.c ++++ b/drivers/net/wireless/libertas/wext.c +@@ -1953,10 +1953,8 @@ static int lbs_get_essid(struct net_devi + if (priv->connect_status == LBS_CONNECTED) { + memcpy(extra, priv->curbssparams.ssid, + priv->curbssparams.ssid_len); +- extra[priv->curbssparams.ssid_len] = '\0'; + } else { + memset(extra, 0, 32); +- extra[priv->curbssparams.ssid_len] = '\0'; + } + /* + * If none, we may want to get the one that was set diff --git a/queue-2.6.32/mac80211-fix-ibss-merge.patch b/queue-2.6.32/mac80211-fix-ibss-merge.patch new file mode 100644 index 00000000000..85468dc9b0a --- /dev/null +++ b/queue-2.6.32/mac80211-fix-ibss-merge.patch @@ -0,0 +1,39 @@ +From 450aae3d7b60a970f266349a837dfb30a539198b Mon Sep 17 00:00:00 2001 +From: Sujith +Date: Mon, 2 Nov 2009 12:33:23 +0530 +Subject: mac80211: Fix IBSS merge + +From: Sujith + +commit 450aae3d7b60a970f266349a837dfb30a539198b upstream. + +Currently, in IBSS mode, a single creator would go into +a loop trying to merge/scan. This happens because the IBSS timer is +rearmed on finishing a scan and the subsequent +timer invocation requests another scan immediately. + +This patch fixes this issue by checking if we have just completed +a scan run trying to merge with other IBSS networks. + +Signed-off-by: Sujith +Signed-off-by: John W. Linville +Cc: Luis Rodriguez +Signed-off-by: Greg Kroah-Hartman + +--- + net/mac80211/ibss.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/net/mac80211/ibss.c ++++ b/net/mac80211/ibss.c +@@ -455,6 +455,10 @@ static void ieee80211_sta_merge_ibss(str + + ieee80211_sta_expire(sdata, IEEE80211_IBSS_INACTIVITY_LIMIT); + ++ if (time_before(jiffies, ifibss->last_scan_completed + ++ IEEE80211_IBSS_MERGE_INTERVAL)) ++ return; ++ + if (ieee80211_sta_active_ibss(sdata)) + return; + diff --git a/queue-2.6.32/mac80211-fix-propagation-of-failed-hardware-reconfigurations.patch b/queue-2.6.32/mac80211-fix-propagation-of-failed-hardware-reconfigurations.patch new file mode 100644 index 00000000000..95d82c7c370 --- /dev/null +++ b/queue-2.6.32/mac80211-fix-propagation-of-failed-hardware-reconfigurations.patch @@ -0,0 +1,59 @@ +From 24feda0084722189468a65e20019cdd8ef99702b Mon Sep 17 00:00:00 2001 +From: Luis R. Rodriguez +Date: Thu, 24 Dec 2009 15:38:22 -0500 +Subject: mac80211: fix propagation of failed hardware reconfigurations + +From: Luis R. Rodriguez + +commit 24feda0084722189468a65e20019cdd8ef99702b upstream. + +mac80211 does not propagate failed hardware reconfiguration +requests. For suspend and resume this is important due to all +the possible issues that can come out of the suspend <-> resume +cycle. Not propagating the error means cfg80211 will assume +the resume for the device went through fine and mac80211 will +continue on trying to poke at the hardware, enable timers, +queue work, and so on for a device which is completley +unfunctional. + +The least we can do is to propagate device start issues and +warn when this occurs upon resume. A side effect of this patch +is we also now propagate the start errors upon harware +reconfigurations (non-suspend), but this should also be desirable +anyway, there is not point in continuing to reconfigure a +device if mac80211 was unable to start the device. + +For further details refer to the thread: + +http://marc.info/?t=126151038700001&r=1&w=2 + +Signed-off-by: Luis R. Rodriguez +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + net/mac80211/util.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +--- a/net/mac80211/util.c ++++ b/net/mac80211/util.c +@@ -1031,7 +1031,19 @@ int ieee80211_reconfig(struct ieee80211_ + + /* restart hardware */ + if (local->open_count) { ++ /* ++ * Upon resume hardware can sometimes be goofy due to ++ * various platform / driver / bus issues, so restarting ++ * the device may at times not work immediately. Propagate ++ * the error. ++ */ + res = drv_start(local); ++ if (res) { ++ WARN(local->suspended, "Harware became unavailable " ++ "upon resume. This is could be a software issue" ++ "prior to suspend or a harware issue\n"); ++ return res; ++ } + + ieee80211_led_radio(local, true); + } diff --git a/queue-2.6.32/mac80211-fix-wmm-ap-settings-application.patch b/queue-2.6.32/mac80211-fix-wmm-ap-settings-application.patch new file mode 100644 index 00000000000..93f873b6711 --- /dev/null +++ b/queue-2.6.32/mac80211-fix-wmm-ap-settings-application.patch @@ -0,0 +1,52 @@ +From 0183826b58a2712ffe608bc3302447be3e6a3ab8 Mon Sep 17 00:00:00 2001 +From: Johannes Berg +Date: Thu, 17 Dec 2009 16:16:53 +0100 +Subject: mac80211: fix WMM AP settings application + +From: Johannes Berg + +commit 0183826b58a2712ffe608bc3302447be3e6a3ab8 upstream. + +My + commit 77fdaa12cea26c204cc12c312fe40bc0f3dcdfd8 + Author: Johannes Berg + Date: Tue Jul 7 03:45:17 2009 +0200 + + mac80211: rework MLME for multiple authentications + +inadvertedly broke WMM because it removed, along with +a bunch of other now useless initialisations, the line +initialising sdata->u.mgd.wmm_last_param_set to -1 +which would make it adopt any WMM parameter set. If, +as is usually the case, the AP uses WMM parameter set +sequence number zero, we'd never update it until the +AP changes the sequence number. + +Add the missing initialisation back to get the WMM +settings from the AP applied locally. + +Signed-off-by: Johannes Berg +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + net/mac80211/mlme.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/net/mac80211/mlme.c ++++ b/net/mac80211/mlme.c +@@ -904,6 +904,14 @@ static void ieee80211_set_associated(str + sdata->u.mgd.flags &= ~(IEEE80211_STA_CONNECTION_POLL | + IEEE80211_STA_BEACON_POLL); + ++ /* ++ * Always handle WMM once after association regardless ++ * of the first value the AP uses. Setting -1 here has ++ * that effect because the AP values is an unsigned ++ * 4-bit value. ++ */ ++ sdata->u.mgd.wmm_last_param_set = -1; ++ + ieee80211_led_assoc(local, 1); + + sdata->vif.bss_conf.assoc = 1; diff --git a/queue-2.6.32/md-fix-unfortunate-interaction-with-evms.patch b/queue-2.6.32/md-fix-unfortunate-interaction-with-evms.patch new file mode 100644 index 00000000000..fbf2d5e7f88 --- /dev/null +++ b/queue-2.6.32/md-fix-unfortunate-interaction-with-evms.patch @@ -0,0 +1,57 @@ +From cbd1998377504df005302ac90d49db72a48552a6 Mon Sep 17 00:00:00 2001 +From: NeilBrown +Date: Wed, 30 Dec 2009 12:08:49 +1100 +Subject: md: Fix unfortunate interaction with evms + +From: NeilBrown + +commit cbd1998377504df005302ac90d49db72a48552a6 upstream. + +evms configures md arrays by: + open device + send ioctl + close device + +for each different ioctl needed. +Since 2.6.29, the device can disappear after the 'close' +unless a significant configuration has happened to the device. +The change made by "SET_ARRAY_INFO" can too minor to stop the device +from disappearing, but important enough that losing the change is bad. + +So: make sure SET_ARRAY_INFO sets mddev->ctime, and keep the device +active as long as ctime is non-zero (it gets zeroed with lots of other +things when the array is stopped). + +This is suitable for -stable kernels since 2.6.29. + +Signed-off-by: NeilBrown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/md.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +--- a/drivers/md/md.c ++++ b/drivers/md/md.c +@@ -282,7 +282,9 @@ static void mddev_put(mddev_t *mddev) + if (!atomic_dec_and_lock(&mddev->active, &all_mddevs_lock)) + return; + if (!mddev->raid_disks && list_empty(&mddev->disks) && +- !mddev->hold_active) { ++ mddev->ctime == 0 && !mddev->hold_active) { ++ /* Array is not configured at all, and not held active, ++ * so destroy it */ + list_del(&mddev->all_mddevs); + if (mddev->gendisk) { + /* we did a probe so need to clean up. +@@ -5071,6 +5073,10 @@ static int set_array_info(mddev_t * mdde + mddev->minor_version = info->minor_version; + mddev->patch_version = info->patch_version; + mddev->persistent = !info->not_persistent; ++ /* ensure mddev_put doesn't delete this now that there ++ * is some minimal configuration. ++ */ ++ mddev->ctime = get_seconds(); + return 0; + } + mddev->major_version = MD_MAJOR_VERSION; diff --git a/queue-2.6.32/pata_cmd64x-fix-overclocking-of-udma0-2-modes.patch b/queue-2.6.32/pata_cmd64x-fix-overclocking-of-udma0-2-modes.patch new file mode 100644 index 00000000000..07fad5069cf --- /dev/null +++ b/queue-2.6.32/pata_cmd64x-fix-overclocking-of-udma0-2-modes.patch @@ -0,0 +1,38 @@ +From 509426bd46ad0903dca409803e0ee3d30f99f1e8 Mon Sep 17 00:00:00 2001 +From: Bartlomiej Zolnierkiewicz +Date: Sun, 20 Dec 2009 19:22:33 +0100 +Subject: pata_cmd64x: fix overclocking of UDMA0-2 modes + +From: Bartlomiej Zolnierkiewicz + +commit 509426bd46ad0903dca409803e0ee3d30f99f1e8 upstream. + +adev->dma_mode stores the transfer mode value not UDMA mode number +so the condition in cmd64x_set_dmamode() is always true and the higher +UDMA clock is always selected. This can potentially result in data +corruption when UDMA33 device is used, when 40-wire cable is used or +when the error recovery code decides to lower the device speed down. + +The issue was introduced in the commit 6a40da0 ("libata cmd64x: whack +into a shape that looks like the documentation") which goes back to +kernel 2.6.20. + +Signed-off-by: Bartlomiej Zolnierkiewicz +Signed-off-by: Jeff Garzik +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ata/pata_cmd64x.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/ata/pata_cmd64x.c ++++ b/drivers/ata/pata_cmd64x.c +@@ -219,7 +219,7 @@ static void cmd64x_set_dmamode(struct at + regU |= udma_data[adev->dma_mode - XFER_UDMA_0] << shift; + /* Merge the control bits */ + regU |= 1 << adev->devno; /* UDMA on */ +- if (adev->dma_mode > 2) /* 15nS timing */ ++ if (adev->dma_mode > XFER_UDMA_2) /* 15nS timing */ + regU |= 4 << adev->devno; + } else { + regU &= ~ (1 << adev->devno); /* UDMA off */ diff --git a/queue-2.6.32/pata_hpt3x2n-fix-clock-turnaround.patch b/queue-2.6.32/pata_hpt3x2n-fix-clock-turnaround.patch new file mode 100644 index 00000000000..7305835eed9 --- /dev/null +++ b/queue-2.6.32/pata_hpt3x2n-fix-clock-turnaround.patch @@ -0,0 +1,170 @@ +From 256ace9bbd4cdb6d48d5f55d55d42fa20527fad1 Mon Sep 17 00:00:00 2001 +From: Sergei Shtylyov +Date: Thu, 17 Dec 2009 01:11:27 -0500 +Subject: pata_hpt3x2n: fix clock turnaround + +From: Sergei Shtylyov + +commit 256ace9bbd4cdb6d48d5f55d55d42fa20527fad1 upstream. + +The clock turnaround code still doesn't work for several reasons: + +- 'USE_DPLL' flag in 'ap->host->private_data' is never initialized + or updated, so the driver can only set the chip to the DPLL clock + mode, not the PCI mode; + +- the driver doesn't serialize access to the channels depending on + the current clock mode like the vendor drivers, so the clock + turnaround is only executed "optionally", not always as it should be; + +- the wrong ports are written to when hpt3x2n_set_clock() is called + for the secondary channel; + +- hpt3x2n_set_clock() can inadvertently enable the disabled channels + when resetting the channel state machines. + +Signed-off-by: Sergei Shtylyov +Signed-off-by: Jeff Garzik +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ata/pata_hpt3x2n.c | 64 ++++++++++++++++++++++++--------------------- + 1 file changed, 35 insertions(+), 29 deletions(-) + +--- a/drivers/ata/pata_hpt3x2n.c ++++ b/drivers/ata/pata_hpt3x2n.c +@@ -8,7 +8,7 @@ + * Copyright (C) 1999-2003 Andre Hedrick + * Portions Copyright (C) 2001 Sun Microsystems, Inc. + * Portions Copyright (C) 2003 Red Hat Inc +- * Portions Copyright (C) 2005-2007 MontaVista Software, Inc. ++ * Portions Copyright (C) 2005-2009 MontaVista Software, Inc. + * + * + * TODO +@@ -25,7 +25,7 @@ + #include + + #define DRV_NAME "pata_hpt3x2n" +-#define DRV_VERSION "0.3.7" ++#define DRV_VERSION "0.3.8" + + enum { + HPT_PCI_FAST = (1 << 31), +@@ -262,7 +262,7 @@ static void hpt3x2n_bmdma_stop(struct at + + static void hpt3x2n_set_clock(struct ata_port *ap, int source) + { +- void __iomem *bmdma = ap->ioaddr.bmdma_addr; ++ void __iomem *bmdma = ap->ioaddr.bmdma_addr - ap->port_no * 8; + + /* Tristate the bus */ + iowrite8(0x80, bmdma+0x73); +@@ -272,9 +272,9 @@ static void hpt3x2n_set_clock(struct ata + iowrite8(source, bmdma+0x7B); + iowrite8(0xC0, bmdma+0x79); + +- /* Reset state machines */ +- iowrite8(0x37, bmdma+0x70); +- iowrite8(0x37, bmdma+0x74); ++ /* Reset state machines, avoid enabling the disabled channels */ ++ iowrite8(ioread8(bmdma+0x70) | 0x32, bmdma+0x70); ++ iowrite8(ioread8(bmdma+0x74) | 0x32, bmdma+0x74); + + /* Complete reset */ + iowrite8(0x00, bmdma+0x79); +@@ -284,21 +284,10 @@ static void hpt3x2n_set_clock(struct ata + iowrite8(0x00, bmdma+0x77); + } + +-/* Check if our partner interface is busy */ +- +-static int hpt3x2n_pair_idle(struct ata_port *ap) +-{ +- struct ata_host *host = ap->host; +- struct ata_port *pair = host->ports[ap->port_no ^ 1]; +- +- if (pair->hsm_task_state == HSM_ST_IDLE) +- return 1; +- return 0; +-} +- + static int hpt3x2n_use_dpll(struct ata_port *ap, int writing) + { + long flags = (long)ap->host->private_data; ++ + /* See if we should use the DPLL */ + if (writing) + return USE_DPLL; /* Needed for write */ +@@ -307,20 +296,35 @@ static int hpt3x2n_use_dpll(struct ata_p + return 0; + } + ++static int hpt3x2n_qc_defer(struct ata_queued_cmd *qc) ++{ ++ struct ata_port *ap = qc->ap; ++ struct ata_port *alt = ap->host->ports[ap->port_no ^ 1]; ++ int rc, flags = (long)ap->host->private_data; ++ int dpll = hpt3x2n_use_dpll(ap, qc->tf.flags & ATA_TFLAG_WRITE); ++ ++ /* First apply the usual rules */ ++ rc = ata_std_qc_defer(qc); ++ if (rc != 0) ++ return rc; ++ ++ if ((flags & USE_DPLL) != dpll && alt->qc_active) ++ return ATA_DEFER_PORT; ++ return 0; ++} ++ + static unsigned int hpt3x2n_qc_issue(struct ata_queued_cmd *qc) + { +- struct ata_taskfile *tf = &qc->tf; + struct ata_port *ap = qc->ap; + int flags = (long)ap->host->private_data; ++ int dpll = hpt3x2n_use_dpll(ap, qc->tf.flags & ATA_TFLAG_WRITE); + +- if (hpt3x2n_pair_idle(ap)) { +- int dpll = hpt3x2n_use_dpll(ap, (tf->flags & ATA_TFLAG_WRITE)); +- if ((flags & USE_DPLL) != dpll) { +- if (dpll == 1) +- hpt3x2n_set_clock(ap, 0x21); +- else +- hpt3x2n_set_clock(ap, 0x23); +- } ++ if ((flags & USE_DPLL) != dpll) { ++ flags &= ~USE_DPLL; ++ flags |= dpll; ++ ap->host->private_data = (void *)(long)flags; ++ ++ hpt3x2n_set_clock(ap, dpll ? 0x21 : 0x23); + } + return ata_sff_qc_issue(qc); + } +@@ -337,6 +341,8 @@ static struct ata_port_operations hpt3x2 + .inherits = &ata_bmdma_port_ops, + + .bmdma_stop = hpt3x2n_bmdma_stop, ++ ++ .qc_defer = hpt3x2n_qc_defer, + .qc_issue = hpt3x2n_qc_issue, + + .cable_detect = hpt3x2n_cable_detect, +@@ -454,7 +460,7 @@ static int hpt3x2n_init_one(struct pci_d + unsigned int f_low, f_high; + int adjust; + unsigned long iobase = pci_resource_start(dev, 4); +- void *hpriv = NULL; ++ void *hpriv = (void *)USE_DPLL; + int rc; + + rc = pcim_enable_device(dev); +@@ -542,7 +548,7 @@ static int hpt3x2n_init_one(struct pci_d + /* Set our private data up. We only need a few flags so we use + it directly */ + if (pci_mhz > 60) { +- hpriv = (void *)PCI66; ++ hpriv = (void *)(PCI66 | USE_DPLL); + /* + * On HPT371N, if ATA clock is 66 MHz we must set bit 2 in + * the MISC. register to stretch the UltraDMA Tss timing. diff --git a/queue-2.6.32/powerpc-handle-vsx-alignment-faults-correctly-in-little-endian-mode.patch b/queue-2.6.32/powerpc-handle-vsx-alignment-faults-correctly-in-little-endian-mode.patch new file mode 100644 index 00000000000..a54f175c912 --- /dev/null +++ b/queue-2.6.32/powerpc-handle-vsx-alignment-faults-correctly-in-little-endian-mode.patch @@ -0,0 +1,130 @@ +From bb7f20b1c639606def3b91f4e4aca6daeee5d80a Mon Sep 17 00:00:00 2001 +From: Neil Campbell +Date: Mon, 14 Dec 2009 04:08:57 +0000 +Subject: powerpc: Handle VSX alignment faults correctly in little-endian mode + +From: Neil Campbell + +commit bb7f20b1c639606def3b91f4e4aca6daeee5d80a upstream. + +This patch fixes the handling of VSX alignment faults in little-endian +mode (the current code assumes the processor is in big-endian mode). + +The patch also makes the handlers clear the top 8 bytes of the register +when handling an 8 byte VSX load. + +This is based on 2.6.32. + +Signed-off-by: Neil Campbell +Acked-by: Michael Neuling +Signed-off-by: Benjamin Herrenschmidt +Signed-off-by: Greg Kroah-Hartman + +--- + arch/powerpc/kernel/align.c | 63 ++++++++++++++++++++++++++++++++------------ + 1 file changed, 46 insertions(+), 17 deletions(-) + +--- a/arch/powerpc/kernel/align.c ++++ b/arch/powerpc/kernel/align.c +@@ -642,10 +642,14 @@ static int emulate_spe(struct pt_regs *r + */ + static int emulate_vsx(unsigned char __user *addr, unsigned int reg, + unsigned int areg, struct pt_regs *regs, +- unsigned int flags, unsigned int length) ++ unsigned int flags, unsigned int length, ++ unsigned int elsize) + { + char *ptr; ++ unsigned long *lptr; + int ret = 0; ++ int sw = 0; ++ int i, j; + + flush_vsx_to_thread(current); + +@@ -654,19 +658,35 @@ static int emulate_vsx(unsigned char __u + else + ptr = (char *) ¤t->thread.vr[reg - 32]; + +- if (flags & ST) +- ret = __copy_to_user(addr, ptr, length); +- else { +- if (flags & SPLT){ +- ret = __copy_from_user(ptr, addr, length); +- ptr += length; ++ lptr = (unsigned long *) ptr; ++ ++ if (flags & SW) ++ sw = elsize-1; ++ ++ for (j = 0; j < length; j += elsize) { ++ for (i = 0; i < elsize; ++i) { ++ if (flags & ST) ++ ret |= __put_user(ptr[i^sw], addr + i); ++ else ++ ret |= __get_user(ptr[i^sw], addr + i); + } +- ret |= __copy_from_user(ptr, addr, length); ++ ptr += elsize; ++ addr += elsize; + } +- if (flags & U) +- regs->gpr[areg] = regs->dar; +- if (ret) ++ ++ if (!ret) { ++ if (flags & U) ++ regs->gpr[areg] = regs->dar; ++ ++ /* Splat load copies the same data to top and bottom 8 bytes */ ++ if (flags & SPLT) ++ lptr[1] = lptr[0]; ++ /* For 8 byte loads, zero the top 8 bytes */ ++ else if (!(flags & ST) && (8 == length)) ++ lptr[1] = 0; ++ } else + return -EFAULT; ++ + return 1; + } + #endif +@@ -767,16 +787,25 @@ int fix_alignment(struct pt_regs *regs) + + #ifdef CONFIG_VSX + if ((instruction & 0xfc00003e) == 0x7c000018) { +- /* Additional register addressing bit (64 VSX vs 32 FPR/GPR */ ++ unsigned int elsize; ++ ++ /* Additional register addressing bit (64 VSX vs 32 FPR/GPR) */ + reg |= (instruction & 0x1) << 5; + /* Simple inline decoder instead of a table */ ++ /* VSX has only 8 and 16 byte memory accesses */ ++ nb = 8; + if (instruction & 0x200) + nb = 16; +- else if (instruction & 0x080) +- nb = 8; +- else +- nb = 4; ++ ++ /* Vector stores in little-endian mode swap individual ++ elements, so process them separately */ ++ elsize = 4; ++ if (instruction & 0x80) ++ elsize = 8; ++ + flags = 0; ++ if (regs->msr & MSR_LE) ++ flags |= SW; + if (instruction & 0x100) + flags |= ST; + if (instruction & 0x040) +@@ -787,7 +816,7 @@ int fix_alignment(struct pt_regs *regs) + nb = 8; + } + PPC_WARN_EMULATED(vsx); +- return emulate_vsx(addr, reg, areg, regs, flags, nb); ++ return emulate_vsx(addr, reg, areg, regs, flags, nb, elsize); + } + #endif + /* A size of 0 indicates an instruction we don't support, with diff --git a/queue-2.6.32/sched-fix-task_hot-test-order.patch b/queue-2.6.32/sched-fix-task_hot-test-order.patch new file mode 100644 index 00000000000..75fd17c52cc --- /dev/null +++ b/queue-2.6.32/sched-fix-task_hot-test-order.patch @@ -0,0 +1,44 @@ +From e6c8fba7771563b2f3dfb96a78f36ec17e15bdf0 Mon Sep 17 00:00:00 2001 +From: Peter Zijlstra +Date: Wed, 16 Dec 2009 18:04:33 +0100 +Subject: sched: Fix task_hot() test order + +From: Peter Zijlstra + +commit e6c8fba7771563b2f3dfb96a78f36ec17e15bdf0 upstream. + +Make sure not to access sched_fair fields before verifying it is +indeed a sched_fair task. + +Signed-off-by: Peter Zijlstra +Cc: Mike Galbraith +LKML-Reference: <20091216170517.577998058@chello.nl> +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/sched.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/kernel/sched.c ++++ b/kernel/sched.c +@@ -2036,6 +2036,9 @@ task_hot(struct task_struct *p, u64 now, + { + s64 delta; + ++ if (p->sched_class != &fair_sched_class) ++ return 0; ++ + /* + * Buddy candidates are cache hot: + */ +@@ -2044,9 +2047,6 @@ task_hot(struct task_struct *p, u64 now, + &p->se == cfs_rq_of(&p->se)->last)) + return 1; + +- if (p->sched_class != &fair_sched_class) +- return 0; +- + if (sysctl_sched_migration_cost == -1) + return 1; + if (sysctl_sched_migration_cost == 0) diff --git a/queue-2.6.32/sched-select_task_rq_fair-must-honour-sd_load_balance.patch b/queue-2.6.32/sched-select_task_rq_fair-must-honour-sd_load_balance.patch new file mode 100644 index 00000000000..ac69432819a --- /dev/null +++ b/queue-2.6.32/sched-select_task_rq_fair-must-honour-sd_load_balance.patch @@ -0,0 +1,33 @@ +From e4f4288842ee12747e10c354d72be7d424c0b627 Mon Sep 17 00:00:00 2001 +From: Peter Zijlstra +Date: Wed, 16 Dec 2009 18:04:34 +0100 +Subject: sched: Select_task_rq_fair() must honour SD_LOAD_BALANCE + +From: Peter Zijlstra + +commit e4f4288842ee12747e10c354d72be7d424c0b627 upstream. + +We should skip !SD_LOAD_BALANCE domains. + +Signed-off-by: Peter Zijlstra +Cc: Mike Galbraith +LKML-Reference: <20091216170517.653578430@chello.nl> +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/sched_fair.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/kernel/sched_fair.c ++++ b/kernel/sched_fair.c +@@ -1374,6 +1374,9 @@ static int select_task_rq_fair(struct ta + + rcu_read_lock(); + for_each_domain(cpu, tmp) { ++ if (!(tmp->flags & SD_LOAD_BALANCE)) ++ continue; ++ + /* + * If power savings logic is enabled for a domain, see if we + * are not overloaded, if so, don't balance wider. diff --git a/queue-2.6.32/scsi-fc-class-fix-fc_transport_init-error-handling.patch b/queue-2.6.32/scsi-fc-class-fix-fc_transport_init-error-handling.patch new file mode 100644 index 00000000000..250b40f62b6 --- /dev/null +++ b/queue-2.6.32/scsi-fc-class-fix-fc_transport_init-error-handling.patch @@ -0,0 +1,52 @@ +From 48de68a40aef032a2e198437f4781a83bfb938db Mon Sep 17 00:00:00 2001 +From: Mike Christie +Date: Tue, 17 Nov 2009 21:25:16 -0600 +Subject: SCSI: fc class: fix fc_transport_init error handling + +From: Mike Christie + +commit 48de68a40aef032a2e198437f4781a83bfb938db upstream. + +If transport_class_register fails we should unregister any +registered classes, or we will leak memory or other +resources. + +I did a quick modprobe of scsi_transport_fc to test the +patch. + +Signed-off-by: Mike Christie +Signed-off-by: James Bottomley +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/scsi_transport_fc.c | 17 ++++++++++++++--- + 1 file changed, 14 insertions(+), 3 deletions(-) + +--- a/drivers/scsi/scsi_transport_fc.c ++++ b/drivers/scsi/scsi_transport_fc.c +@@ -648,11 +648,22 @@ static __init int fc_transport_init(void + return error; + error = transport_class_register(&fc_vport_class); + if (error) +- return error; ++ goto unreg_host_class; + error = transport_class_register(&fc_rport_class); + if (error) +- return error; +- return transport_class_register(&fc_transport_class); ++ goto unreg_vport_class; ++ error = transport_class_register(&fc_transport_class); ++ if (error) ++ goto unreg_rport_class; ++ return 0; ++ ++unreg_rport_class: ++ transport_class_unregister(&fc_rport_class); ++unreg_vport_class: ++ transport_class_unregister(&fc_vport_class); ++unreg_host_class: ++ transport_class_unregister(&fc_host_class); ++ return error; + } + + static void __exit fc_transport_exit(void) diff --git a/queue-2.6.32/scsi-ipr-fix-eeh-recovery.patch b/queue-2.6.32/scsi-ipr-fix-eeh-recovery.patch new file mode 100644 index 00000000000..0d4c998ed49 --- /dev/null +++ b/queue-2.6.32/scsi-ipr-fix-eeh-recovery.patch @@ -0,0 +1,55 @@ +From 99c965dd9ee1a004efc083c3d760ba982bb76adf Mon Sep 17 00:00:00 2001 +From: Kleber Sacilotto de Souza +Date: Wed, 25 Nov 2009 20:13:43 -0200 +Subject: SCSI: ipr: fix EEH recovery + +From: Kleber Sacilotto de Souza + +commit 99c965dd9ee1a004efc083c3d760ba982bb76adf upstream. + +After commits c82f63e411f1b58427c103bd95af2863b1c96dd1 (PCI: check saved +state before restore) and 4b77b0a2ba27d64f58f16d8d4d48d8319dda36ff (PCI: +Clear saved_state after the state has been restored) PCI drivers are +prevented from restoring the device standard configuration registers +twice in a row. These changes introduced a regression on ipr EEH +recovery. + +The ipr device driver saves the PCI state only during the device probe +and restores it on ipr_reset_restore_cfg_space() during IOA resets. This +behavior is causing the EEH recovery to fail after the second error +detected, since the registers are not being restored. + +One possible solution would be saving the registers after restoring +them. The problem with this approach is that while recovering from an +EEH error if pci_save_state() results in an EEH error, the adapter/slot +will be reset, and end up back in ipr_reset_restore_cfg_space(), but it +won't have a valid saved state to restore, so pci_restore_state() will +fail. + +The following patch introduces a workaround for this problem, hacking +around the PCI API by setting pdev->state_saved = true before we do the +restore. It fixes the EEH regression and prevents that we hit another +EEH error during EEH recovery. + + +[jejb: fix is a hack ... Jesse and Rafael will fix properly] +Signed-off-by: Kleber Sacilotto de Souza +Acked-by: Brian King +Cc: Jesse Barnes +Signed-off-by: James Bottomley +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/ipr.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/scsi/ipr.c ++++ b/drivers/scsi/ipr.c +@@ -6516,6 +6516,7 @@ static int ipr_reset_restore_cfg_space(s + int rc; + + ENTER; ++ ioa_cfg->pdev->state_saved = true; + rc = pci_restore_state(ioa_cfg->pdev); + + if (rc != PCIBIOS_SUCCESSFUL) { diff --git a/queue-2.6.32/scsi-mpt2sas-add-missing-initialization-of-scsih_cmds.patch b/queue-2.6.32/scsi-mpt2sas-add-missing-initialization-of-scsih_cmds.patch new file mode 100644 index 00000000000..9f9b8940af7 --- /dev/null +++ b/queue-2.6.32/scsi-mpt2sas-add-missing-initialization-of-scsih_cmds.patch @@ -0,0 +1,29 @@ +From d685c262083dcd5fd98b7499b22a377a3225229c Mon Sep 17 00:00:00 2001 +From: Kashyap, Desai +Date: Tue, 17 Nov 2009 13:16:37 +0530 +Subject: SCSI: mpt2sas: add missing initialization of scsih_cmds + +From: Kashyap, Desai + +commit d685c262083dcd5fd98b7499b22a377a3225229c upstream. + +Internal command scsih_cmds init is included in mpt2sas_base_attach. + +Signed-off-by: Kashyap Desai +Signed-off-by: James Bottomley +Signed-off-by: Greg Kroah-Hartman + +--- a/drivers/scsi/mpt2sas/mpt2sas_base.c ++++ b/drivers/scsi/mpt2sas/mpt2sas_base.c +@@ -3583,6 +3583,11 @@ mpt2sas_base_attach(struct MPT2SAS_ADAPTER *ioc) + ioc->transport_cmds.status = MPT2_CMD_NOT_USED; + mutex_init(&ioc->transport_cmds.mutex); + ++ /* scsih internal command bits */ ++ ioc->scsih_cmds.reply = kzalloc(ioc->reply_sz, GFP_KERNEL); ++ ioc->scsih_cmds.status = MPT2_CMD_NOT_USED; ++ mutex_init(&ioc->scsih_cmds.mutex); ++ + /* task management internal command bits */ + ioc->tm_cmds.reply = kzalloc(ioc->reply_sz, GFP_KERNEL); + ioc->tm_cmds.status = MPT2_CMD_NOT_USED; diff --git a/queue-2.6.32/scsi-qla2xxx-dpc-thread-can-execute-before-scsi-host-has-been-added.patch b/queue-2.6.32/scsi-qla2xxx-dpc-thread-can-execute-before-scsi-host-has-been-added.patch new file mode 100644 index 00000000000..43ccbe7fb8f --- /dev/null +++ b/queue-2.6.32/scsi-qla2xxx-dpc-thread-can-execute-before-scsi-host-has-been-added.patch @@ -0,0 +1,122 @@ +From 1486400f7edd009d49550da968d5744e246dc7f8 Mon Sep 17 00:00:00 2001 +From: Michael Reed +Date: Wed, 2 Dec 2009 09:11:16 -0600 +Subject: SCSI: qla2xxx: dpc thread can execute before scsi host has been added + +From: Michael Reed + +commit 1486400f7edd009d49550da968d5744e246dc7f8 upstream. + +Fix crash in qla2x00_fdmi_register() due to the dpc +thread executing before the scsi host has been fully +added. + +Unable to handle kernel NULL pointer dereference (address 00000000000001d0) +qla2xxx_7_dpc[4140]: Oops 8813272891392 [1] + +Call Trace: + [] show_stack+0x50/0xa0 + sp=e00000b07c59f930 bsp=e00000b07c591400 + [] show_regs+0x820/0x860 + sp=e00000b07c59fb00 bsp=e00000b07c5913a0 + [] die+0x1a0/0x2e0 + sp=e00000b07c59fb00 bsp=e00000b07c591360 + [] ia64_do_page_fault+0x8c0/0x9e0 + sp=e00000b07c59fb00 bsp=e00000b07c591310 + [] ia64_native_leave_kernel+0x0/0x270 + sp=e00000b07c59fb90 bsp=e00000b07c591310 + [] qla2x00_fdmi_register+0x850/0xbe0 [qla2xxx] + sp=e00000b07c59fd60 bsp=e00000b07c591290 + [] qla2x00_configure_loop+0x1930/0x34c0 [qla2xxx] + sp=e00000b07c59fd60 bsp=e00000b07c591128 + [] qla2x00_loop_resync+0x1b0/0x2e0 [qla2xxx] + sp=e00000b07c59fdf0 bsp=e00000b07c5910c0 + [] qla2x00_do_dpc+0x9a0/0xce0 [qla2xxx] + sp=e00000b07c59fdf0 bsp=e00000b07c590fa0 + [] kthread+0x110/0x140 + sp=e00000b07c59fe00 bsp=e00000b07c590f68 + [] kernel_thread_helper+0xd0/0x100 + sp=e00000b07c59fe30 bsp=e00000b07c590f40 + [] start_kernel_thread+0x20/0x40 + sp=e00000b07c59fe30 bsp=e00000b07c590f40 + +crash> dis a000000207197350 +0xa000000207197350 : [MMI] ld1 r45=[r14];; +crash> scsi_qla_host.host 0xe00000b058c73ff8 + host = 0xe00000b058c73be0, +crash> Scsi_Host.shost_data 0xe00000b058c73be0 + shost_data = 0x0, <<<<<<<<<<< + +The fc_transport fc_* workqueue threads have yet to be created. + +crash> ps | grep _7 + 3891 2 2 e00000b075c80000 IN 0.0 0 0 [scsi_eh_7] + 4140 2 3 e00000b07c590000 RU 0.0 0 0 [qla2xxx_7_dpc] + +The thread creating adding the Scsi_Host is blocked due to other +activity in sysfs. + +crash> bt 3762 +PID: 3762 TASK: e00000b071e70000 CPU: 3 COMMAND: "modprobe" + #0 [BSP:e00000b071e71548] schedule at a000000100727e00 + #1 [BSP:e00000b071e714c8] __mutex_lock_slowpath at a0000001007295a0 + #2 [BSP:e00000b071e714a8] mutex_lock at a000000100729830 + #3 [BSP:e00000b071e71478] sysfs_addrm_start at a0000001002584f0 + #4 [BSP:e00000b071e71440] create_dir at a000000100259350 + #5 [BSP:e00000b071e71410] sysfs_create_subdir at a000000100259510 + #6 [BSP:e00000b071e713b0] internal_create_group at a00000010025c880 + #7 [BSP:e00000b071e71388] sysfs_create_group at a00000010025cc50 + #8 [BSP:e00000b071e71368] dpm_sysfs_add at a000000100425050 + #9 [BSP:e00000b071e71310] device_add at a000000100417d90 +#10 [BSP:e00000b071e712d8] scsi_add_host at a00000010045a380 +#11 [BSP:e00000b071e71268] qla2x00_probe_one at a0000002071be950 +#12 [BSP:e00000b071e71248] local_pci_probe at a00000010032e490 +#13 [BSP:e00000b071e71218] pci_device_probe at a00000010032ecd0 +#14 [BSP:e00000b071e711d8] driver_probe_device at a00000010041d480 +#15 [BSP:e00000b071e711a8] __driver_attach at a00000010041d6e0 +#16 [BSP:e00000b071e71170] bus_for_each_dev at a00000010041c240 +#17 [BSP:e00000b071e71150] driver_attach at a00000010041d0a0 +#18 [BSP:e00000b071e71108] bus_add_driver at a00000010041b080 +#19 [BSP:e00000b071e710c0] driver_register at a00000010041dea0 +#20 [BSP:e00000b071e71088] __pci_register_driver at a00000010032f610 +#21 [BSP:e00000b071e71058] (unknown) at a000000207200270 +#22 [BSP:e00000b071e71018] do_one_initcall at a00000010000a9c0 +#23 [BSP:e00000b071e70f98] sys_init_module at a0000001000fef00 +#24 [BSP:e00000b071e70f98] ia64_ret_from_syscall at a00000010000c740 + +So, it appears that qla2xxx dpc thread is moving forward before the +scsi host has been completely added. + +This patch moves the setting of the init_done (and online) flag to +after the call to scsi_add_host() to hold off the dpc thread. + +Found via large lun count testing using 2.6.31. + +Signed-off-by: Michael Reed +Acked-by: Giridhar Malavali +Signed-off-by: James Bottomley +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/qla2xxx/qla_os.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/scsi/qla2xxx/qla_os.c ++++ b/drivers/scsi/qla2xxx/qla_os.c +@@ -2016,13 +2016,13 @@ skip_dpc: + DEBUG2(printk("DEBUG: detect hba %ld at address = %p\n", + base_vha->host_no, ha)); + +- base_vha->flags.init_done = 1; +- base_vha->flags.online = 1; +- + ret = scsi_add_host(host, &pdev->dev); + if (ret) + goto probe_failed; + ++ base_vha->flags.init_done = 1; ++ base_vha->flags.online = 1; ++ + ha->isp_ops->enable_intrs(ha); + + scsi_scan_host(host); diff --git a/queue-2.6.32/scsi-st-fix-mdata-page_order-handling.patch b/queue-2.6.32/scsi-st-fix-mdata-page_order-handling.patch new file mode 100644 index 00000000000..42a9241f215 --- /dev/null +++ b/queue-2.6.32/scsi-st-fix-mdata-page_order-handling.patch @@ -0,0 +1,148 @@ +From c982c368bb90adbd312faa05d0cfd842e9ab45a7 Mon Sep 17 00:00:00 2001 +From: FUJITA Tomonori +Date: Thu, 26 Nov 2009 09:24:13 +0900 +Subject: SCSI: st: fix mdata->page_order handling + +From: FUJITA Tomonori + +commit c982c368bb90adbd312faa05d0cfd842e9ab45a7 upstream. + +dio transfer always resets mdata->page_order to zero. It breaks +high-order pages previously allocated for non-dio transfer. + +This patches adds reserved_page_order to st_buffer structure to save +page order for non-dio transfer. + +http://bugzilla.kernel.org/show_bug.cgi?id=14563 + +When enlarge_buffer() allocates 524288 from 0, st uses six-order page +allocation. So mdata->page_order is 6 and frp_seg is 2. + +After that, if st uses dio, sgl_map_user_pages() sets +mdata->page_order to 0 for st_do_scsi(). After that, when we call +normalize_buffer(), it frees only free frp_seg * PAGE_SIZE (2 * 4096) +though we should free frp_seg * PAGE_SIZE << 6 (2 * 4096 << 6). So we +see buffer_size is set to 516096 (524288 - 8192). + +Reported-by: Joachim Breuer +Tested-by: Joachim Breuer +Acked-by: Kai Makisara +Signed-off-by: FUJITA Tomonori +Signed-off-by: James Bottomley +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/st.c | 23 ++++++++++++----------- + drivers/scsi/st.h | 1 + + 2 files changed, 13 insertions(+), 11 deletions(-) + +--- a/drivers/scsi/st.c ++++ b/drivers/scsi/st.c +@@ -552,13 +552,15 @@ st_do_scsi(struct st_request * SRpnt, st + SRpnt->waiting = waiting; + + if (STp->buffer->do_dio) { ++ mdata->page_order = 0; + mdata->nr_entries = STp->buffer->sg_segs; + mdata->pages = STp->buffer->mapped_pages; + } else { ++ mdata->page_order = STp->buffer->reserved_page_order; + mdata->nr_entries = + DIV_ROUND_UP(bytes, PAGE_SIZE << mdata->page_order); +- STp->buffer->map_data.pages = STp->buffer->reserved_pages; +- STp->buffer->map_data.offset = 0; ++ mdata->pages = STp->buffer->reserved_pages; ++ mdata->offset = 0; + } + + memcpy(SRpnt->cmd, cmd, sizeof(SRpnt->cmd)); +@@ -3718,7 +3720,7 @@ static int enlarge_buffer(struct st_buff + priority |= __GFP_ZERO; + + if (STbuffer->frp_segs) { +- order = STbuffer->map_data.page_order; ++ order = STbuffer->reserved_page_order; + b_size = PAGE_SIZE << order; + } else { + for (b_size = PAGE_SIZE, order = 0; +@@ -3751,7 +3753,7 @@ static int enlarge_buffer(struct st_buff + segs++; + } + STbuffer->b_data = page_address(STbuffer->reserved_pages[0]); +- STbuffer->map_data.page_order = order; ++ STbuffer->reserved_page_order = order; + + return 1; + } +@@ -3764,7 +3766,7 @@ static void clear_buffer(struct st_buffe + + for (i=0; i < st_bp->frp_segs; i++) + memset(page_address(st_bp->reserved_pages[i]), 0, +- PAGE_SIZE << st_bp->map_data.page_order); ++ PAGE_SIZE << st_bp->reserved_page_order); + st_bp->cleared = 1; + } + +@@ -3772,7 +3774,7 @@ static void clear_buffer(struct st_buffe + /* Release the extra buffer */ + static void normalize_buffer(struct st_buffer * STbuffer) + { +- int i, order = STbuffer->map_data.page_order; ++ int i, order = STbuffer->reserved_page_order; + + for (i = 0; i < STbuffer->frp_segs; i++) { + __free_pages(STbuffer->reserved_pages[i], order); +@@ -3780,7 +3782,7 @@ static void normalize_buffer(struct st_b + } + STbuffer->frp_segs = 0; + STbuffer->sg_segs = 0; +- STbuffer->map_data.page_order = 0; ++ STbuffer->reserved_page_order = 0; + STbuffer->map_data.offset = 0; + } + +@@ -3790,7 +3792,7 @@ static void normalize_buffer(struct st_b + static int append_to_buffer(const char __user *ubp, struct st_buffer * st_bp, int do_count) + { + int i, cnt, res, offset; +- int length = PAGE_SIZE << st_bp->map_data.page_order; ++ int length = PAGE_SIZE << st_bp->reserved_page_order; + + for (i = 0, offset = st_bp->buffer_bytes; + i < st_bp->frp_segs && offset >= length; i++) +@@ -3822,7 +3824,7 @@ static int append_to_buffer(const char _ + static int from_buffer(struct st_buffer * st_bp, char __user *ubp, int do_count) + { + int i, cnt, res, offset; +- int length = PAGE_SIZE << st_bp->map_data.page_order; ++ int length = PAGE_SIZE << st_bp->reserved_page_order; + + for (i = 0, offset = st_bp->read_pointer; + i < st_bp->frp_segs && offset >= length; i++) +@@ -3855,7 +3857,7 @@ static void move_buffer_data(struct st_b + { + int src_seg, dst_seg, src_offset = 0, dst_offset; + int count, total; +- int length = PAGE_SIZE << st_bp->map_data.page_order; ++ int length = PAGE_SIZE << st_bp->reserved_page_order; + + if (offset == 0) + return; +@@ -4577,7 +4579,6 @@ static int sgl_map_user_pages(struct st_ + } + + mdata->offset = uaddr & ~PAGE_MASK; +- mdata->page_order = 0; + STbp->mapped_pages = pages; + + return nr_pages; +--- a/drivers/scsi/st.h ++++ b/drivers/scsi/st.h +@@ -46,6 +46,7 @@ struct st_buffer { + struct st_request *last_SRpnt; + struct st_cmdstatus cmdstat; + struct page **reserved_pages; ++ int reserved_page_order; + struct page **mapped_pages; + struct rq_map_data map_data; + unsigned char *b_data; diff --git a/queue-2.6.32/series b/queue-2.6.32/series new file mode 100644 index 00000000000..a97f1cc42cc --- /dev/null +++ b/queue-2.6.32/series @@ -0,0 +1,58 @@ +scsi-ipr-fix-eeh-recovery.patch +scsi-qla2xxx-dpc-thread-can-execute-before-scsi-host-has-been-added.patch +scsi-st-fix-mdata-page_order-handling.patch +scsi-fc-class-fix-fc_transport_init-error-handling.patch +scsi-mpt2sas-add-missing-initialization-of-scsih_cmds.patch +sched-fix-task_hot-test-order.patch +x86-cpuid-add-volatile-to-asm-in-native_cpuid.patch +sched-select_task_rq_fair-must-honour-sd_load_balance.patch +clockevents-prevent-clockevent_devices-list-corruption-on-cpu-hotplug.patch +pata_hpt3x2n-fix-clock-turnaround.patch +pata_cmd64x-fix-overclocking-of-udma0-2-modes.patch +asoc-wm8974-fix-a-wrong-bit-definition.patch +sound-sgio2audio-pdaudiocf-usb-audio-initialize-pcm-buffer.patch +alsa-hda-fix-missing-capsrc_nids-for-alc88x.patch +acerhdf-limit-modalias-matching-to-supported.patch +acpi-ec-fix-msi-dmi-detection.patch +acpi-use-the-return-result-of-acpi-lid-notifier-chain-correctly.patch +powerpc-handle-vsx-alignment-faults-correctly-in-little-endian-mode.patch +asoc-do-not-write-to-invalid-registers-on-the-wm9712.patch +drm-radeon-fix-build-on-64-bit-with-some-compilers.patch +usb-emi62-fix-crash-when-trying-to-load-emi-6-2-firmware.patch +usb-option-support-hi-speed-for-modem-haier-ce100.patch +usb-fix-a-bug-on-appledisplay.c-regarding-signedness.patch +usb-musb-gadget_ep0-avoid-setupend-interrupt.patch +bluetooth-prevent-ill-timed-autosuspend-in-usb-driver.patch +usb-rename-usb_configure_device.patch +usb-fix-bugs-in-usb_-de-authorize_device.patch +drivers-net-usb-correct-code-taking-the-size-of-a-pointer.patch +x86-sgi-uv-fix-writes-to-led-registers-on-remote-uv-hubs.patch +md-fix-unfortunate-interaction-with-evms.patch +dma-at_hdmac-correct-incompatible-type-for-argument-1-of-spin_lock_bh.patch +dma-debug-do-not-add-notifier-when-dma-debugging-is-disabled.patch +dma-debug-fix-bug-causing-build-warning.patch +cifs-null-out-tcon-psesinfo-and-srvtcp-pointers-when-chasing-dfs-referrals.patch +x86-amd-iommu-fix-initialization-failure-panic.patch +ioat3-fix-p-disabled-q-continuation.patch +ioat2-3-put-channel-hardware-in-known-state-at-init.patch +kvm-mmu-remove-prefault-from-invlpg-handler.patch +kvm-lapic-make-sure-irr-bitmap-is-scanned-after-vm-load.patch +libertas-fix-buffer-overflow-in-lbs_get_essid.patch +iwmc3200wifi-fix-array-out-of-boundary-access.patch +mac80211-fix-propagation-of-failed-hardware-reconfigurations.patch +mac80211-fix-wmm-ap-settings-application.patch +mac80211-fix-ibss-merge.patch +cfg80211-fix-race-between-deauth-and-assoc-response.patch +ath5k-fix-swi-calibration-interrupt-storm.patch +ath9k-wake-hardware-for-interface-ibss-ap-mesh-removal.patch +ath9k-fix-tx-queue-draining.patch +ath9k-fix-missed-error-codes-in-the-tx-status-check.patch +ath9k-wake-hardware-during-ampdu-tx-actions.patch +ath9k-fix-suspend-by-waking-device-prior-to-stop.patch +ath9k_hw-fix-possible-oob-array-indexing-in-gen_timer_index-on-64-bit.patch +ath9k_hw-fix-ar_gpio_input_en_val_bt_priority_bb-and-its-shift-value-in-0x4054.patch +iwl3945-disable-power-save.patch +iwl3945-fix-panic-in-iwl3945-driver.patch +iwlwifi-fix-eeprom-otp-reading-endian-annotations-and-a-bug.patch +iwlwifi-fix-more-eeprom-endian-bugs.patch +iwlwifi-fix-40mhz-operation-setting-on-cards-that-do-not-allow-it.patch diff --git a/queue-2.6.32/sound-sgio2audio-pdaudiocf-usb-audio-initialize-pcm-buffer.patch b/queue-2.6.32/sound-sgio2audio-pdaudiocf-usb-audio-initialize-pcm-buffer.patch new file mode 100644 index 00000000000..050720fb14b --- /dev/null +++ b/queue-2.6.32/sound-sgio2audio-pdaudiocf-usb-audio-initialize-pcm-buffer.patch @@ -0,0 +1,57 @@ +From 3e85fd614c7b6bb7f33bb04a0dcb5a3bfca4c0fe Mon Sep 17 00:00:00 2001 +From: Clemens Ladisch +Date: Fri, 18 Dec 2009 09:27:24 +0100 +Subject: sound: sgio2audio/pdaudiocf/usb-audio: initialize PCM buffer + +From: Clemens Ladisch + +commit 3e85fd614c7b6bb7f33bb04a0dcb5a3bfca4c0fe upstream. + +When allocating the PCM buffer, use vmalloc_user() instead of vmalloc(). +Otherwise, it would be possible for applications to play the previous +contents of the kernel memory to the speakers, or to read it directly if +the buffer is exported to userspace. + +Signed-off-by: Clemens Ladisch +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/mips/sgio2audio.c | 2 +- + sound/pcmcia/pdaudiocf/pdaudiocf_pcm.c | 2 +- + sound/usb/usbaudio.c | 2 +- + 3 files changed, 3 insertions(+), 3 deletions(-) + +--- a/sound/mips/sgio2audio.c ++++ b/sound/mips/sgio2audio.c +@@ -609,7 +609,7 @@ static int snd_sgio2audio_pcm_hw_params( + /* alloc virtual 'dma' area */ + if (runtime->dma_area) + vfree(runtime->dma_area); +- runtime->dma_area = vmalloc(size); ++ runtime->dma_area = vmalloc_user(size); + if (runtime->dma_area == NULL) + return -ENOMEM; + runtime->dma_bytes = size; +--- a/sound/pcmcia/pdaudiocf/pdaudiocf_pcm.c ++++ b/sound/pcmcia/pdaudiocf/pdaudiocf_pcm.c +@@ -51,7 +51,7 @@ static int snd_pcm_alloc_vmalloc_buffer( + return 0; /* already enough large */ + vfree(runtime->dma_area); + } +- runtime->dma_area = vmalloc_32(size); ++ runtime->dma_area = vmalloc_32_user(size); + if (! runtime->dma_area) + return -ENOMEM; + runtime->dma_bytes = size; +--- a/sound/usb/usbaudio.c ++++ b/sound/usb/usbaudio.c +@@ -752,7 +752,7 @@ static int snd_pcm_alloc_vmalloc_buffer( + return 0; /* already large enough */ + vfree(runtime->dma_area); + } +- runtime->dma_area = vmalloc(size); ++ runtime->dma_area = vmalloc_user(size); + if (!runtime->dma_area) + return -ENOMEM; + runtime->dma_bytes = size; diff --git a/queue-2.6.32/usb-emi62-fix-crash-when-trying-to-load-emi-6-2-firmware.patch b/queue-2.6.32/usb-emi62-fix-crash-when-trying-to-load-emi-6-2-firmware.patch new file mode 100644 index 00000000000..c73e2241250 --- /dev/null +++ b/queue-2.6.32/usb-emi62-fix-crash-when-trying-to-load-emi-6-2-firmware.patch @@ -0,0 +1,43 @@ +From ac06c06770bb8761b1f1f9bdf2f5420fa6d3e9fa Mon Sep 17 00:00:00 2001 +From: Clemens Ladisch +Date: Mon, 21 Dec 2009 15:36:44 -0800 +Subject: USB: emi62: fix crash when trying to load EMI 6|2 firmware + +From: Clemens Ladisch + +commit ac06c06770bb8761b1f1f9bdf2f5420fa6d3e9fa upstream. + +While converting emi62 to use request_firmware(), the driver was also +changed to use the ihex helper functions. However, this broke the loading +of the FPGA firmware because the code tries to access the addr field of +the EOF record which works with a plain array that has an empty last +record but not with the ihex helper functions where the end of the data is +signaled with a NULL record pointer, resulting in: + +BUG: unable to handle kernel NULL pointer dereference at (null) +IP: [] emi62_load_firmware+0x33c/0x740 [emi62] + +This can be fixed by changing the loop condition to test the return value +of ihex_next_binrec() directly (like in emi26.c). + +Signed-off-by: Clemens Ladisch +Reported-and-tested-by: Der Mickster +Acked-by: David Woodhouse +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/misc/emi62.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/misc/emi62.c ++++ b/drivers/usb/misc/emi62.c +@@ -167,7 +167,7 @@ static int emi62_load_firmware (struct u + err("%s - error loading firmware: error = %d", __func__, err); + goto wraperr; + } +- } while (i > 0); ++ } while (rec); + + /* Assert reset (stop the CPU in the EMI) */ + err = emi62_set_reset(dev,1); diff --git a/queue-2.6.32/usb-fix-a-bug-on-appledisplay.c-regarding-signedness.patch b/queue-2.6.32/usb-fix-a-bug-on-appledisplay.c-regarding-signedness.patch new file mode 100644 index 00000000000..993573da917 --- /dev/null +++ b/queue-2.6.32/usb-fix-a-bug-on-appledisplay.c-regarding-signedness.patch @@ -0,0 +1,38 @@ +From 37e9066b2f85480d99d3795373f5ef0b00ac1189 Mon Sep 17 00:00:00 2001 +From: pancho horrillo +Date: Wed, 23 Dec 2009 11:09:13 +0100 +Subject: USB: Fix a bug on appledisplay.c regarding signedness + +From: pancho horrillo + +commit 37e9066b2f85480d99d3795373f5ef0b00ac1189 upstream. + +brightness status is reported by the Apple Cinema Displays as an +'unsigned char' (u8) value, but the code used 'char' instead. + +Note that he driver was developed on the PowerPC architecture, +where the two types are synonymous, which is not always the case. + +Fixed that. Otherwise the driver will interpret brightness +levels > 127 as negative, and fail to load. + +Signed-off-by: pancho horrillo +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/misc/appledisplay.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/usb/misc/appledisplay.c ++++ b/drivers/usb/misc/appledisplay.c +@@ -72,8 +72,8 @@ struct appledisplay { + struct usb_device *udev; /* usb device */ + struct urb *urb; /* usb request block */ + struct backlight_device *bd; /* backlight device */ +- char *urbdata; /* interrupt URB data buffer */ +- char *msgdata; /* control message data buffer */ ++ u8 *urbdata; /* interrupt URB data buffer */ ++ u8 *msgdata; /* control message data buffer */ + + struct delayed_work work; + int button_pressed; diff --git a/queue-2.6.32/usb-fix-bugs-in-usb_-de-authorize_device.patch b/queue-2.6.32/usb-fix-bugs-in-usb_-de-authorize_device.patch new file mode 100644 index 00000000000..92b544522d2 --- /dev/null +++ b/queue-2.6.32/usb-fix-bugs-in-usb_-de-authorize_device.patch @@ -0,0 +1,129 @@ +From da307123c621b01cce147a4be313d8a754674f63 Mon Sep 17 00:00:00 2001 +From: Alan Stern +Date: Tue, 8 Dec 2009 15:54:44 -0500 +Subject: USB: fix bugs in usb_(de)authorize_device + +From: Alan Stern + +commit da307123c621b01cce147a4be313d8a754674f63 upstream. + +This patch (as1315) fixes some bugs in the USB core authorization +code: + + usb_deauthorize_device() should deallocate the device strings + instead of leaking them, and it should invoke + usb_destroy_configuration() (which does proper reference + counting) instead of freeing the config information directly. + + usb_authorize_device() shouldn't change the device strings + until it knows that the authorization will succeed, and it should + autosuspend the device at the end (having autoresumed the + device at the start). + + Because the device strings can be changed, the sysfs routines + to display the strings must protect the string pointers by + locking the device. + +Signed-off-by: Alan Stern +CC: Inaky Perez-Gonzalez +Acked-by: David Vrabel +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/hub.c | 32 ++++++++++++++++++++------------ + drivers/usb/core/sysfs.c | 6 +++++- + 2 files changed, 25 insertions(+), 13 deletions(-) + +--- a/drivers/usb/core/hub.c ++++ b/drivers/usb/core/hub.c +@@ -1803,21 +1803,23 @@ fail: + */ + int usb_deauthorize_device(struct usb_device *usb_dev) + { +- unsigned cnt; + usb_lock_device(usb_dev); + if (usb_dev->authorized == 0) + goto out_unauthorized; ++ + usb_dev->authorized = 0; + usb_set_configuration(usb_dev, -1); ++ ++ kfree(usb_dev->product); + usb_dev->product = kstrdup("n/a (unauthorized)", GFP_KERNEL); ++ kfree(usb_dev->manufacturer); + usb_dev->manufacturer = kstrdup("n/a (unauthorized)", GFP_KERNEL); ++ kfree(usb_dev->serial); + usb_dev->serial = kstrdup("n/a (unauthorized)", GFP_KERNEL); +- kfree(usb_dev->config); +- usb_dev->config = NULL; +- for (cnt = 0; cnt < usb_dev->descriptor.bNumConfigurations; cnt++) +- kfree(usb_dev->rawdescriptors[cnt]); ++ ++ usb_destroy_configuration(usb_dev); + usb_dev->descriptor.bNumConfigurations = 0; +- kfree(usb_dev->rawdescriptors); ++ + out_unauthorized: + usb_unlock_device(usb_dev); + return 0; +@@ -1827,15 +1829,11 @@ out_unauthorized: + int usb_authorize_device(struct usb_device *usb_dev) + { + int result = 0, c; ++ + usb_lock_device(usb_dev); + if (usb_dev->authorized == 1) + goto out_authorized; +- kfree(usb_dev->product); +- usb_dev->product = NULL; +- kfree(usb_dev->manufacturer); +- usb_dev->manufacturer = NULL; +- kfree(usb_dev->serial); +- usb_dev->serial = NULL; ++ + result = usb_autoresume_device(usb_dev); + if (result < 0) { + dev_err(&usb_dev->dev, +@@ -1848,6 +1846,14 @@ int usb_authorize_device(struct usb_devi + "authorization: %d\n", result); + goto error_device_descriptor; + } ++ ++ kfree(usb_dev->product); ++ usb_dev->product = NULL; ++ kfree(usb_dev->manufacturer); ++ usb_dev->manufacturer = NULL; ++ kfree(usb_dev->serial); ++ usb_dev->serial = NULL; ++ + usb_dev->authorized = 1; + result = usb_enumerate_device(usb_dev); + if (result < 0) +@@ -1866,8 +1872,10 @@ int usb_authorize_device(struct usb_devi + } + } + dev_info(&usb_dev->dev, "authorized to connect\n"); ++ + error_enumerate: + error_device_descriptor: ++ usb_autosuspend_device(usb_dev); + error_autoresume: + out_authorized: + usb_unlock_device(usb_dev); // complements locktree +--- a/drivers/usb/core/sysfs.c ++++ b/drivers/usb/core/sysfs.c +@@ -82,9 +82,13 @@ static ssize_t show_##name(struct devic + struct device_attribute *attr, char *buf) \ + { \ + struct usb_device *udev; \ ++ int retval; \ + \ + udev = to_usb_device(dev); \ +- return sprintf(buf, "%s\n", udev->name); \ ++ usb_lock_device(udev); \ ++ retval = sprintf(buf, "%s\n", udev->name); \ ++ usb_unlock_device(udev); \ ++ return retval; \ + } \ + static DEVICE_ATTR(name, S_IRUGO, show_##name, NULL); + diff --git a/queue-2.6.32/usb-musb-gadget_ep0-avoid-setupend-interrupt.patch b/queue-2.6.32/usb-musb-gadget_ep0-avoid-setupend-interrupt.patch new file mode 100644 index 00000000000..25b13ce0b1d --- /dev/null +++ b/queue-2.6.32/usb-musb-gadget_ep0-avoid-setupend-interrupt.patch @@ -0,0 +1,58 @@ +From 17be5c5f5ef99c94374e07f71effa78e93a20eda Mon Sep 17 00:00:00 2001 +From: Sergei Shtylyov +Date: Tue, 15 Dec 2009 13:30:01 +0200 +Subject: USB: musb: gadget_ep0: avoid SetupEnd interrupt + +From: Sergei Shtylyov + +commit 17be5c5f5ef99c94374e07f71effa78e93a20eda upstream. + +Gadget stalling a zero-length SETUP request results in this error message: + +SetupEnd came in a wrong ep0stage idle + +In order to avoid it, always set the CSR0.DataEnd bit after detecting a zero- +length request. Add the missing '\n' to the error message itself as well... + +Signed-off-by: Sergei Shtylyov +Acked-by: Anand Gadiyar +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/musb/musb_gadget_ep0.c | 14 ++++++++++---- + 1 file changed, 10 insertions(+), 4 deletions(-) + +--- a/drivers/usb/musb/musb_gadget_ep0.c ++++ b/drivers/usb/musb/musb_gadget_ep0.c +@@ -647,7 +647,7 @@ irqreturn_t musb_g_ep0_irq(struct musb * + musb->ep0_state = MUSB_EP0_STAGE_STATUSIN; + break; + default: +- ERR("SetupEnd came in a wrong ep0stage %s", ++ ERR("SetupEnd came in a wrong ep0stage %s\n", + decode_ep0stage(musb->ep0_state)); + } + csr = musb_readw(regs, MUSB_CSR0); +@@ -770,12 +770,18 @@ setup: + handled = service_zero_data_request( + musb, &setup); + ++ /* ++ * We're expecting no data in any case, so ++ * always set the DATAEND bit -- doing this ++ * here helps avoid SetupEnd interrupt coming ++ * in the idle stage when we're stalling... ++ */ ++ musb->ackpend |= MUSB_CSR0_P_DATAEND; ++ + /* status stage might be immediate */ +- if (handled > 0) { +- musb->ackpend |= MUSB_CSR0_P_DATAEND; ++ if (handled > 0) + musb->ep0_state = + MUSB_EP0_STAGE_STATUSIN; +- } + break; + + /* sequence #1 (IN to host), includes GET_STATUS diff --git a/queue-2.6.32/usb-option-support-hi-speed-for-modem-haier-ce100.patch b/queue-2.6.32/usb-option-support-hi-speed-for-modem-haier-ce100.patch new file mode 100644 index 00000000000..cc5bf8642d4 --- /dev/null +++ b/queue-2.6.32/usb-option-support-hi-speed-for-modem-haier-ce100.patch @@ -0,0 +1,47 @@ +From c983202bd03eb82394ef1dce5906702fcbc7bb80 Mon Sep 17 00:00:00 2001 +From: Donny Kurnia +Date: Wed, 23 Dec 2009 19:03:12 +0700 +Subject: USB: option: support hi speed for modem Haier CE100 + +From: Donny Kurnia + +commit c983202bd03eb82394ef1dce5906702fcbc7bb80 upstream. + +I made this patch for usbserial driver to add the support for EVDO modem +Haier CE100. The bugs report for this is here: +https://bugs.launchpad.net/ubuntu/+source/linux/+bug/490068 + +This patch based on these post: +http://blankblondtank.wordpress.com/2009/09/04/mengoptimalkan-koneksi-modem-haier-ce-100-cdma-di-linux/ +http://tantos.web.id/blogs/how-to-internet-connection-using-cdma-evdo-modem-and-karmic-koala-ubuntu-9-10 + +I hope this patch can help other that have the Haier C100 modem, mostly in my country, Indonesia. + +Signed-off-by: Donny Kurnia +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/option.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -340,6 +340,10 @@ static int option_resume(struct usb_ser + #define FOUR_G_SYSTEMS_VENDOR_ID 0x1c9e + #define FOUR_G_SYSTEMS_PRODUCT_W14 0x9603 + ++/* Haier products */ ++#define HAIER_VENDOR_ID 0x201e ++#define HAIER_PRODUCT_CE100 0x2009 ++ + static struct usb_device_id option_ids[] = { + { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_COLT) }, + { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_RICOLA) }, +@@ -641,6 +645,7 @@ static struct usb_device_id option_ids[] + { USB_DEVICE(AIRPLUS_VENDOR_ID, AIRPLUS_PRODUCT_MCD650) }, + { USB_DEVICE(TLAYTECH_VENDOR_ID, TLAYTECH_PRODUCT_TEU800) }, + { USB_DEVICE(FOUR_G_SYSTEMS_VENDOR_ID, FOUR_G_SYSTEMS_PRODUCT_W14) }, ++ { USB_DEVICE(HAIER_VENDOR_ID, HAIER_PRODUCT_CE100) }, + { } /* Terminating entry */ + }; + MODULE_DEVICE_TABLE(usb, option_ids); diff --git a/queue-2.6.32/usb-rename-usb_configure_device.patch b/queue-2.6.32/usb-rename-usb_configure_device.patch new file mode 100644 index 00000000000..42fb0971988 --- /dev/null +++ b/queue-2.6.32/usb-rename-usb_configure_device.patch @@ -0,0 +1,110 @@ +From 8d8558d10806b7e805cb80df867ebb0a453d4765 Mon Sep 17 00:00:00 2001 +From: Alan Stern +Date: Tue, 8 Dec 2009 15:50:41 -0500 +Subject: USB: rename usb_configure_device + +From: Alan Stern + +commit 8d8558d10806b7e805cb80df867ebb0a453d4765 upstream. + +This patch (as1314) renames usb_configure_device() and +usb_configure_device_otg() in the hub driver. Neither name is +appropriate because these routines enumerate devices, they don't +configure them. That's handled by usb_choose_configuration() and +usb_set_configuration(). + +Signed-off-by: Alan Stern +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/hub.c | 26 +++++++++++++------------- + 1 file changed, 13 insertions(+), 13 deletions(-) + +--- a/drivers/usb/core/hub.c ++++ b/drivers/usb/core/hub.c +@@ -1612,12 +1612,12 @@ static inline void announce_device(struc + #endif + + /** +- * usb_configure_device_otg - FIXME (usbcore-internal) ++ * usb_enumerate_device_otg - FIXME (usbcore-internal) + * @udev: newly addressed device (in ADDRESS state) + * +- * Do configuration for On-The-Go devices ++ * Finish enumeration for On-The-Go devices + */ +-static int usb_configure_device_otg(struct usb_device *udev) ++static int usb_enumerate_device_otg(struct usb_device *udev) + { + int err = 0; + +@@ -1688,7 +1688,7 @@ fail: + + + /** +- * usb_configure_device - Detect and probe device intfs/otg (usbcore-internal) ++ * usb_enumerate_device - Read device configs/intfs/otg (usbcore-internal) + * @udev: newly addressed device (in ADDRESS state) + * + * This is only called by usb_new_device() and usb_authorize_device() +@@ -1699,7 +1699,7 @@ fail: + * the string descriptors, as they will be errored out by the device + * until it has been authorized. + */ +-static int usb_configure_device(struct usb_device *udev) ++static int usb_enumerate_device(struct usb_device *udev) + { + int err; + +@@ -1723,7 +1723,7 @@ static int usb_configure_device(struct u + udev->descriptor.iManufacturer); + udev->serial = usb_cache_string(udev, udev->descriptor.iSerialNumber); + } +- err = usb_configure_device_otg(udev); ++ err = usb_enumerate_device_otg(udev); + fail: + return err; + } +@@ -1733,8 +1733,8 @@ fail: + * usb_new_device - perform initial device setup (usbcore-internal) + * @udev: newly addressed device (in ADDRESS state) + * +- * This is called with devices which have been enumerated, but not yet +- * configured. The device descriptor is available, but not descriptors ++ * This is called with devices which have been detected but not fully ++ * enumerated. The device descriptor is available, but not descriptors + * for any device configuration. The caller must have locked either + * the parent hub (if udev is a normal device) or else the + * usb_bus_list_lock (if udev is a root hub). The parent's pointer to +@@ -1757,8 +1757,8 @@ int usb_new_device(struct usb_device *ud + if (udev->parent) + usb_autoresume_device(udev->parent); + +- usb_detect_quirks(udev); /* Determine quirks */ +- err = usb_configure_device(udev); /* detect & probe dev/intfs */ ++ usb_detect_quirks(udev); ++ err = usb_enumerate_device(udev); /* Read descriptors */ + if (err < 0) + goto fail; + dev_dbg(&udev->dev, "udev %d, busnum %d, minor = %d\n", +@@ -1849,9 +1849,9 @@ int usb_authorize_device(struct usb_devi + goto error_device_descriptor; + } + usb_dev->authorized = 1; +- result = usb_configure_device(usb_dev); ++ result = usb_enumerate_device(usb_dev); + if (result < 0) +- goto error_configure; ++ goto error_enumerate; + /* Choose and set the configuration. This registers the interfaces + * with the driver core and lets interface drivers bind to them. + */ +@@ -1866,7 +1866,7 @@ int usb_authorize_device(struct usb_devi + } + } + dev_info(&usb_dev->dev, "authorized to connect\n"); +-error_configure: ++error_enumerate: + error_device_descriptor: + error_autoresume: + out_authorized: diff --git a/queue-2.6.32/x86-amd-iommu-fix-initialization-failure-panic.patch b/queue-2.6.32/x86-amd-iommu-fix-initialization-failure-panic.patch new file mode 100644 index 00000000000..1dba189948b --- /dev/null +++ b/queue-2.6.32/x86-amd-iommu-fix-initialization-failure-panic.patch @@ -0,0 +1,57 @@ +From 0f764806438d5576ac58898332e5dcf30bb8a679 Mon Sep 17 00:00:00 2001 +From: Joerg Roedel +Date: Mon, 21 Dec 2009 15:51:23 +0100 +Subject: x86/amd-iommu: Fix initialization failure panic + +From: Joerg Roedel + +commit 0f764806438d5576ac58898332e5dcf30bb8a679 upstream. + +The assumption that acpi_table_parse passes the return value +of the hanlder function to the caller proved wrong +recently. The return value of the handler function is +totally ignored. This makes the initialization code for AMD +IOMMU buggy in a way that could cause a kernel panic on +initialization. This patch fixes the issue in the AMD IOMMU +driver. + +Signed-off-by: Joerg Roedel +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/amd_iommu_init.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +--- a/arch/x86/kernel/amd_iommu_init.c ++++ b/arch/x86/kernel/amd_iommu_init.c +@@ -136,6 +136,11 @@ LIST_HEAD(amd_iommu_list); /* list of a + system */ + + /* ++ * Set to true if ACPI table parsing and hardware intialization went properly ++ */ ++static bool amd_iommu_initialized; ++ ++/* + * Pointer to the device table which is shared by all AMD IOMMUs + * it is indexed by the PCI device id or the HT unit id and contains + * information about the domain the device belongs to as well as the +@@ -913,6 +918,8 @@ static int __init init_iommu_all(struct + } + WARN_ON(p != end); + ++ amd_iommu_initialized = true; ++ + return 0; + } + +@@ -1263,6 +1270,9 @@ int __init amd_iommu_init(void) + if (acpi_table_parse("IVRS", init_iommu_all) != 0) + goto free; + ++ if (!amd_iommu_initialized) ++ goto free; ++ + if (acpi_table_parse("IVRS", init_memory_definitions) != 0) + goto free; + diff --git a/queue-2.6.32/x86-cpuid-add-volatile-to-asm-in-native_cpuid.patch b/queue-2.6.32/x86-cpuid-add-volatile-to-asm-in-native_cpuid.patch new file mode 100644 index 00000000000..7f3686cbd5f --- /dev/null +++ b/queue-2.6.32/x86-cpuid-add-volatile-to-asm-in-native_cpuid.patch @@ -0,0 +1,48 @@ +From 45a94d7cd45ed991914011919e7d40eb6d2546d1 Mon Sep 17 00:00:00 2001 +From: Suresh Siddha +Date: Wed, 16 Dec 2009 16:25:42 -0800 +Subject: x86, cpuid: Add "volatile" to asm in native_cpuid() + +From: Suresh Siddha + +commit 45a94d7cd45ed991914011919e7d40eb6d2546d1 upstream. + +xsave_cntxt_init() does something like: + + cpuid(0xd, ..); // find out what features FP/SSE/.. etc are supported + + xsetbv(); // enable the features known to OS + + cpuid(0xd, ..); // find out the size of the context for features enabled + +Depending on what features get enabled in xsetbv(), value of the +cpuid.eax=0xd.ecx=0.ebx changes correspondingly (representing the +size of the context that is enabled). + +As we don't have volatile keyword for native_cpuid(), gcc 4.1.2 +optimizes away the second cpuid and the kernel continues to use +the cpuid information obtained before xsetbv(), ultimately leading to kernel +crash on processors supporting more state than the legacy FP/SSE. + +Add "volatile" for native_cpuid(). + +Signed-off-by: Suresh Siddha +LKML-Reference: <1261009542.2745.55.camel@sbs-t61.sc.intel.com> +Signed-off-by: H. Peter Anvin +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/include/asm/processor.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/x86/include/asm/processor.h ++++ b/arch/x86/include/asm/processor.h +@@ -180,7 +180,7 @@ static inline void native_cpuid(unsigned + unsigned int *ecx, unsigned int *edx) + { + /* ecx is often an input as well as an output. */ +- asm("cpuid" ++ asm volatile("cpuid" + : "=a" (*eax), + "=b" (*ebx), + "=c" (*ecx), diff --git a/queue-2.6.32/x86-sgi-uv-fix-writes-to-led-registers-on-remote-uv-hubs.patch b/queue-2.6.32/x86-sgi-uv-fix-writes-to-led-registers-on-remote-uv-hubs.patch new file mode 100644 index 00000000000..9632f8d268e --- /dev/null +++ b/queue-2.6.32/x86-sgi-uv-fix-writes-to-led-registers-on-remote-uv-hubs.patch @@ -0,0 +1,244 @@ +From 39d30770992895d55789de64bad2349510af68d0 Mon Sep 17 00:00:00 2001 +From: Mike Travis +Date: Mon, 28 Dec 2009 13:28:25 -0800 +Subject: x86: SGI UV: Fix writes to led registers on remote uv hubs + +From: Mike Travis + +commit 39d30770992895d55789de64bad2349510af68d0 upstream. + +The wrong address was being used to write the SCIR led regs on +remote hubs. Also, there was an inconsistency between how BIOS +and the kernel indexed these regs. Standardize on using the +lower 6 bits of the APIC ID as the index. + +This patch fixes the problem of writing to an errant address to +a cpu # >= 64. + +Signed-off-by: Mike Travis +Reviewed-by: Jack Steiner +Cc: Robin Holt +Cc: Linus Torvalds +LKML-Reference: <4B3922F9.3060905@sgi.com> +[ v2: fix a number of annoying checkpatch artifacts and whitespace noise ] +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/include/asm/uv/uv_hub.h | 86 ++++++++++++++++++++----------------- + arch/x86/kernel/apic/x2apic_uv_x.c | 12 ++--- + 2 files changed, 54 insertions(+), 44 deletions(-) + +--- a/arch/x86/include/asm/uv/uv_hub.h ++++ b/arch/x86/include/asm/uv/uv_hub.h +@@ -31,20 +31,20 @@ + * contiguous (although various IO spaces may punch holes in + * it).. + * +- * N - Number of bits in the node portion of a socket physical +- * address. ++ * N - Number of bits in the node portion of a socket physical ++ * address. + * +- * NASID - network ID of a router, Mbrick or Cbrick. Nasid values of +- * routers always have low bit of 1, C/MBricks have low bit +- * equal to 0. Most addressing macros that target UV hub chips +- * right shift the NASID by 1 to exclude the always-zero bit. +- * NASIDs contain up to 15 bits. ++ * NASID - network ID of a router, Mbrick or Cbrick. Nasid values of ++ * routers always have low bit of 1, C/MBricks have low bit ++ * equal to 0. Most addressing macros that target UV hub chips ++ * right shift the NASID by 1 to exclude the always-zero bit. ++ * NASIDs contain up to 15 bits. + * + * GNODE - NASID right shifted by 1 bit. Most mmrs contain gnodes instead + * of nasids. + * +- * PNODE - the low N bits of the GNODE. The PNODE is the most useful variant +- * of the nasid for socket usage. ++ * PNODE - the low N bits of the GNODE. The PNODE is the most useful variant ++ * of the nasid for socket usage. + * + * + * NumaLink Global Physical Address Format: +@@ -71,12 +71,12 @@ + * + * + * APICID format +- * NOTE!!!!!! This is the current format of the APICID. However, code +- * should assume that this will change in the future. Use functions +- * in this file for all APICID bit manipulations and conversion. ++ * NOTE!!!!!! This is the current format of the APICID. However, code ++ * should assume that this will change in the future. Use functions ++ * in this file for all APICID bit manipulations and conversion. + * +- * 1111110000000000 +- * 5432109876543210 ++ * 1111110000000000 ++ * 5432109876543210 + * pppppppppplc0cch + * sssssssssss + * +@@ -89,9 +89,9 @@ + * Note: Processor only supports 12 bits in the APICID register. The ACPI + * tables hold all 16 bits. Software needs to be aware of this. + * +- * Unless otherwise specified, all references to APICID refer to +- * the FULL value contained in ACPI tables, not the subset in the +- * processor APICID register. ++ * Unless otherwise specified, all references to APICID refer to ++ * the FULL value contained in ACPI tables, not the subset in the ++ * processor APICID register. + */ + + +@@ -151,16 +151,16 @@ struct uv_hub_info_s { + }; + + DECLARE_PER_CPU(struct uv_hub_info_s, __uv_hub_info); +-#define uv_hub_info (&__get_cpu_var(__uv_hub_info)) ++#define uv_hub_info (&__get_cpu_var(__uv_hub_info)) + #define uv_cpu_hub_info(cpu) (&per_cpu(__uv_hub_info, cpu)) + + /* + * Local & Global MMR space macros. +- * Note: macros are intended to be used ONLY by inline functions +- * in this file - not by other kernel code. +- * n - NASID (full 15-bit global nasid) +- * g - GNODE (full 15-bit global nasid, right shifted 1) +- * p - PNODE (local part of nsids, right shifted 1) ++ * Note: macros are intended to be used ONLY by inline functions ++ * in this file - not by other kernel code. ++ * n - NASID (full 15-bit global nasid) ++ * g - GNODE (full 15-bit global nasid, right shifted 1) ++ * p - PNODE (local part of nsids, right shifted 1) + */ + #define UV_NASID_TO_PNODE(n) (((n) >> 1) & uv_hub_info->pnode_mask) + #define UV_PNODE_TO_GNODE(p) ((p) |uv_hub_info->gnode_extra) +@@ -213,8 +213,8 @@ DECLARE_PER_CPU(struct uv_hub_info_s, __ + /* + * Macros for converting between kernel virtual addresses, socket local physical + * addresses, and UV global physical addresses. +- * Note: use the standard __pa() & __va() macros for converting +- * between socket virtual and socket physical addresses. ++ * Note: use the standard __pa() & __va() macros for converting ++ * between socket virtual and socket physical addresses. + */ + + /* socket phys RAM --> UV global physical address */ +@@ -265,21 +265,18 @@ static inline int uv_apicid_to_pnode(int + * Access global MMRs using the low memory MMR32 space. This region supports + * faster MMR access but not all MMRs are accessible in this space. + */ +-static inline unsigned long *uv_global_mmr32_address(int pnode, +- unsigned long offset) ++static inline unsigned long *uv_global_mmr32_address(int pnode, unsigned long offset) + { + return __va(UV_GLOBAL_MMR32_BASE | + UV_GLOBAL_MMR32_PNODE_BITS(pnode) | offset); + } + +-static inline void uv_write_global_mmr32(int pnode, unsigned long offset, +- unsigned long val) ++static inline void uv_write_global_mmr32(int pnode, unsigned long offset, unsigned long val) + { + writeq(val, uv_global_mmr32_address(pnode, offset)); + } + +-static inline unsigned long uv_read_global_mmr32(int pnode, +- unsigned long offset) ++static inline unsigned long uv_read_global_mmr32(int pnode, unsigned long offset) + { + return readq(uv_global_mmr32_address(pnode, offset)); + } +@@ -288,25 +285,32 @@ static inline unsigned long uv_read_glob + * Access Global MMR space using the MMR space located at the top of physical + * memory. + */ +-static inline unsigned long *uv_global_mmr64_address(int pnode, +- unsigned long offset) ++static inline unsigned long *uv_global_mmr64_address(int pnode, unsigned long offset) + { + return __va(UV_GLOBAL_MMR64_BASE | + UV_GLOBAL_MMR64_PNODE_BITS(pnode) | offset); + } + +-static inline void uv_write_global_mmr64(int pnode, unsigned long offset, +- unsigned long val) ++static inline void uv_write_global_mmr64(int pnode, unsigned long offset, unsigned long val) + { + writeq(val, uv_global_mmr64_address(pnode, offset)); + } + +-static inline unsigned long uv_read_global_mmr64(int pnode, +- unsigned long offset) ++static inline unsigned long uv_read_global_mmr64(int pnode, unsigned long offset) + { + return readq(uv_global_mmr64_address(pnode, offset)); + } + ++static inline void uv_write_global_mmr8(int pnode, unsigned long offset, unsigned char val) ++{ ++ writeb(val, uv_global_mmr64_address(pnode, offset)); ++} ++ ++static inline unsigned char uv_read_global_mmr8(int pnode, unsigned long offset) ++{ ++ return readb(uv_global_mmr64_address(pnode, offset)); ++} ++ + /* + * Access hub local MMRs. Faster than using global space but only local MMRs + * are accessible. +@@ -426,11 +430,17 @@ static inline void uv_set_scir_bits(unsi + } + } + ++static inline unsigned long uv_scir_offset(int apicid) ++{ ++ return SCIR_LOCAL_MMR_BASE | (apicid & 0x3f); ++} ++ + static inline void uv_set_cpu_scir_bits(int cpu, unsigned char value) + { + if (uv_cpu_hub_info(cpu)->scir.state != value) { ++ uv_write_global_mmr8(uv_cpu_to_pnode(cpu), ++ uv_cpu_hub_info(cpu)->scir.offset, value); + uv_cpu_hub_info(cpu)->scir.state = value; +- uv_write_local_mmr8(uv_cpu_hub_info(cpu)->scir.offset, value); + } + } + +--- a/arch/x86/kernel/apic/x2apic_uv_x.c ++++ b/arch/x86/kernel/apic/x2apic_uv_x.c +@@ -607,8 +607,10 @@ void __init uv_system_init(void) + uv_rtc_init(); + + for_each_present_cpu(cpu) { ++ int apicid = per_cpu(x86_cpu_to_apicid, cpu); ++ + nid = cpu_to_node(cpu); +- pnode = uv_apicid_to_pnode(per_cpu(x86_cpu_to_apicid, cpu)); ++ pnode = uv_apicid_to_pnode(apicid); + blade = boot_pnode_to_blade(pnode); + lcpu = uv_blade_info[blade].nr_possible_cpus; + uv_blade_info[blade].nr_possible_cpus++; +@@ -629,15 +631,13 @@ void __init uv_system_init(void) + uv_cpu_hub_info(cpu)->gnode_extra = gnode_extra; + uv_cpu_hub_info(cpu)->global_mmr_base = mmr_base; + uv_cpu_hub_info(cpu)->coherency_domain_number = sn_coherency_id; +- uv_cpu_hub_info(cpu)->scir.offset = SCIR_LOCAL_MMR_BASE + lcpu; ++ uv_cpu_hub_info(cpu)->scir.offset = uv_scir_offset(apicid); + uv_node_to_blade[nid] = blade; + uv_cpu_to_blade[cpu] = blade; + max_pnode = max(pnode, max_pnode); + +- printk(KERN_DEBUG "UV: cpu %d, apicid 0x%x, pnode %d, nid %d, " +- "lcpu %d, blade %d\n", +- cpu, per_cpu(x86_cpu_to_apicid, cpu), pnode, nid, +- lcpu, blade); ++ printk(KERN_DEBUG "UV: cpu %d, apicid 0x%x, pnode %d, nid %d, lcpu %d, blade %d\n", ++ cpu, apicid, pnode, nid, lcpu, blade); + } + + /* Add blade/pnode info for nodes without cpus */