From: Greg Kroah-Hartman Date: Tue, 27 Jul 2010 22:51:57 +0000 (-0700) Subject: .32 patches X-Git-Tag: v2.6.27.49~38 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=a0402406ee9461f75187486957ba82bfdf79069c;p=thirdparty%2Fkernel%2Fstable-queue.git .32 patches --- diff --git a/queue-2.6.32/alsa-hda-add-macbook-5-2-quirk.patch b/queue-2.6.32/alsa-hda-add-macbook-5-2-quirk.patch new file mode 100644 index 00000000000..4f6864fa6c1 --- /dev/null +++ b/queue-2.6.32/alsa-hda-add-macbook-5-2-quirk.patch @@ -0,0 +1,31 @@ +From 3bfea98ff73d377ffce0d4c7f938b7ef958cdb35 Mon Sep 17 00:00:00 2001 +From: Luke Yelavich +Date: Tue, 22 Jun 2010 11:04:19 +1000 +Subject: ALSA: hda - Add Macbook 5,2 quirk + +From: Luke Yelavich + +commit 3bfea98ff73d377ffce0d4c7f938b7ef958cdb35 upstream. + +BugLink: https://bugs.launchpad.net/bugs/463178 + +Set Macbook 5,2 (106b:4a00) hardware to use ALC885_MB5 + +Signed-off-by: Luke Yelavich +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_realtek.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -8942,6 +8942,7 @@ static struct snd_pci_quirk alc882_ssid_ + SND_PCI_QUIRK(0x106b, 0x3800, "MacbookPro 4,1", ALC885_MBP3), + SND_PCI_QUIRK(0x106b, 0x3e00, "iMac 24 Aluminum", ALC885_IMAC24), + SND_PCI_QUIRK(0x106b, 0x3f00, "Macbook 5,1", ALC885_MB5), ++ SND_PCI_QUIRK(0x106b, 0x4a00, "Macbook 5,2", ALC885_MB5), + /* FIXME: HP jack sense seems not working for MBP 5,1 or 5,2, + * so apparently no perfect solution yet + */ diff --git a/queue-2.6.32/ath5k-drop-warning-on-jumbo-frames.patch b/queue-2.6.32/ath5k-drop-warning-on-jumbo-frames.patch new file mode 100644 index 00000000000..847a1601cf5 --- /dev/null +++ b/queue-2.6.32/ath5k-drop-warning-on-jumbo-frames.patch @@ -0,0 +1,58 @@ +From 9637e516d16a58b13f6098cfe899e22963132be3 Mon Sep 17 00:00:00 2001 +From: Luis R. Rodriguez +Date: Mon, 10 May 2010 15:26:27 -0400 +Subject: ath5k: drop warning on jumbo frames + +From: Luis R. Rodriguez + +commit 9637e516d16a58b13f6098cfe899e22963132be3 upstream. + +Jumbo frames are not supported, and if they are seen it is likely +a bogus frame so just silently discard them instead of warning on +them all time. Also, instead of dropping them immediately though +move the check *after* we check for all sort of frame errors. This +should enable us to discard these frames if the hardware picks +other bogus items first. Lets see if we still get those jumbo +counters increasing still with this. + +Jumbo frames would happen if we tell hardware we can support +a small 802.11 chunks of DMA'd frame, hardware would split RX'd +frames into parts and we'd have to reconstruct them in software. +This is done with USB due to the bulk size but with ath5k we +already provide a good limit to hardware and this should not be +happening. + +This is reported quite often and if it fills the logs then this +needs to be addressed and to avoid spurious reports. + +Signed-off-by: Luis R. Rodriguez +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/ath/ath5k/base.c | 7 ++----- + 1 file changed, 2 insertions(+), 5 deletions(-) + +--- a/drivers/net/wireless/ath/ath5k/base.c ++++ b/drivers/net/wireless/ath/ath5k/base.c +@@ -1818,11 +1818,6 @@ ath5k_tasklet_rx(unsigned long data) + return; + } + +- if (unlikely(rs.rs_more)) { +- ATH5K_WARN(sc, "unsupported jumbo\n"); +- goto next; +- } +- + if (unlikely(rs.rs_status)) { + if (rs.rs_status & AR5K_RXERR_PHY) + goto next; +@@ -1852,6 +1847,8 @@ ath5k_tasklet_rx(unsigned long data) + sc->opmode != NL80211_IFTYPE_MONITOR) + goto next; + } ++ if (unlikely(rs.rs_more)) ++ goto next; + accept: + next_skb = ath5k_rx_skb_alloc(sc, &next_skb_addr); + diff --git a/queue-2.6.32/ath9k-avoid-corrupt-frames-being-forwarded-to-mac80211.patch b/queue-2.6.32/ath9k-avoid-corrupt-frames-being-forwarded-to-mac80211.patch new file mode 100644 index 00000000000..1fcaccc4724 --- /dev/null +++ b/queue-2.6.32/ath9k-avoid-corrupt-frames-being-forwarded-to-mac80211.patch @@ -0,0 +1,65 @@ +From 3a37495268ab45507b4cab9d4cb18c5496ab7a10 Mon Sep 17 00:00:00 2001 +From: Vivek Natarajan +Date: Tue, 27 Apr 2010 13:05:38 +0530 +Subject: ath9k: Avoid corrupt frames being forwarded to mac80211. + +From: Vivek Natarajan + +commit 3a37495268ab45507b4cab9d4cb18c5496ab7a10 upstream. + +If bit 29 is set, MAC H/W can attempt to decrypt the received aggregate +with WEP or TKIP, eventhough the received frame may be a CRC failed +corrupted frame. If this bit is set, H/W obeys key type in keycache. +If it is not set and if the key type in keycache is neither open nor +AES, H/W forces key type to be open. But bit 29 should be set to 1 +for AsyncFIFO feature to encrypt/decrypt the aggregate with WEP or TKIP. + +Reported-by: Johan Hovold +Signed-off-by: Vivek Natarajan +Signed-off-by: Ranga Rao Ravuri +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + + +--- + drivers/net/wireless/ath/ath9k/initvals.h | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/net/wireless/ath/ath9k/initvals.h ++++ b/drivers/net/wireless/ath/ath9k/initvals.h +@@ -2762,7 +2762,7 @@ static const u32 ar9280Common_9280_2[][2 + { 0x00008258, 0x00000000 }, + { 0x0000825c, 0x400000ff }, + { 0x00008260, 0x00080922 }, +- { 0x00008264, 0xa8a00010 }, ++ { 0x00008264, 0x88a00010 }, + { 0x00008270, 0x00000000 }, + { 0x00008274, 0x40000000 }, + { 0x00008278, 0x003e4180 }, +@@ -3935,7 +3935,7 @@ static const u_int32_t ar9285Common_9285 + { 0x00008258, 0x00000000 }, + { 0x0000825c, 0x400000ff }, + { 0x00008260, 0x00080922 }, +- { 0x00008264, 0xa8a00010 }, ++ { 0x00008264, 0x88a00010 }, + { 0x00008270, 0x00000000 }, + { 0x00008274, 0x40000000 }, + { 0x00008278, 0x003e4180 }, +@@ -5072,7 +5072,7 @@ static const u_int32_t ar9287Common_9287 + { 0x00008258, 0x00000000 }, + { 0x0000825c, 0x400000ff }, + { 0x00008260, 0x00080922 }, +- { 0x00008264, 0xa8a00010 }, ++ { 0x00008264, 0x88a00010 }, + { 0x00008270, 0x00000000 }, + { 0x00008274, 0x40000000 }, + { 0x00008278, 0x003e4180 }, +@@ -6864,7 +6864,7 @@ static const u_int32_t ar9271Common_9271 + { 0x00008258, 0x00000000 }, + { 0x0000825c, 0x400000ff }, + { 0x00008260, 0x00080922 }, +- { 0x00008264, 0xa8a00010 }, ++ { 0x00008264, 0x88a00010 }, + { 0x00008270, 0x00000000 }, + { 0x00008274, 0x40000000 }, + { 0x00008278, 0x003e4180 }, diff --git a/queue-2.6.32/ath9k-re-enable-ps-by-default-for-new-single-chip-families.patch b/queue-2.6.32/ath9k-re-enable-ps-by-default-for-new-single-chip-families.patch new file mode 100644 index 00000000000..13ff46adb18 --- /dev/null +++ b/queue-2.6.32/ath9k-re-enable-ps-by-default-for-new-single-chip-families.patch @@ -0,0 +1,58 @@ +From 14acdde6e527950f66c084dbf19bad6fbfcaeedc Mon Sep 17 00:00:00 2001 +From: Luis R. Rodriguez +Date: Fri, 18 Dec 2009 11:26:04 -0500 +Subject: ath9k: re-enable ps by default for new single chip families + +From: Luis R. Rodriguez + +commit 14acdde6e527950f66c084dbf19bad6fbfcaeedc upstream. + +The newer single chip hardware family of chipsets have not been +experiencing issues with power saving set by default with recent +fixes merged (even into stable). The remaining issues are only +reported with AR5416 and since enabling PS by default can increase +power savings considerably best to take advantage of that feature +as this has been tested properly. + +For more details on this issue see the bug report: + +http://bugzilla.kernel.org/show_bug.cgi?id=14267 + +We leave AR5416 with PS disabled by default, that seems to require +some more work. + +Cc: Peter Stuge +Cc: Justin P. Mattock +Cc: Kristoffer Ericson +Signed-off-by: Luis R. Rodriguez +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + + +--- + drivers/net/wireless/ath/ath9k/main.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/drivers/net/wireless/ath/ath9k/main.c ++++ b/drivers/net/wireless/ath/ath9k/main.c +@@ -1538,6 +1538,8 @@ bad_no_ah: + + void ath_set_hw_capab(struct ath_softc *sc, struct ieee80211_hw *hw) + { ++ struct ath_hw *ah = sc->sc_ah; ++ + hw->flags = IEEE80211_HW_RX_INCLUDES_FCS | + IEEE80211_HW_HOST_BROADCAST_PS_BUFFERING | + IEEE80211_HW_SIGNAL_DBM | +@@ -1558,7 +1560,10 @@ void ath_set_hw_capab(struct ath_softc * + BIT(NL80211_IFTYPE_ADHOC) | + BIT(NL80211_IFTYPE_MESH_POINT); + +- hw->wiphy->ps_default = false; ++ if (AR_SREV_5416(ah)) ++ hw->wiphy->ps_default = false; ++ else ++ hw->wiphy->ps_default = true; + + hw->queues = 4; + hw->max_rates = 4; diff --git a/queue-2.6.32/btrfs-fix-checks-in-btrfs_ioc_clone_range.patch b/queue-2.6.32/btrfs-fix-checks-in-btrfs_ioc_clone_range.patch new file mode 100644 index 00000000000..48c56861f14 --- /dev/null +++ b/queue-2.6.32/btrfs-fix-checks-in-btrfs_ioc_clone_range.patch @@ -0,0 +1,47 @@ +From 2ebc3464781ad24474abcbd2274e6254689853b5 Mon Sep 17 00:00:00 2001 +From: Dan Rosenberg +Date: Mon, 19 Jul 2010 16:58:20 -0400 +Subject: Btrfs: fix checks in BTRFS_IOC_CLONE_RANGE + +From: Dan Rosenberg + +commit 2ebc3464781ad24474abcbd2274e6254689853b5 upstream. + +1. The BTRFS_IOC_CLONE and BTRFS_IOC_CLONE_RANGE ioctls should check +whether the donor file is append-only before writing to it. + +2. The BTRFS_IOC_CLONE_RANGE ioctl appears to have an integer +overflow that allows a user to specify an out-of-bounds range to copy +from the source file (if off + len wraps around). I haven't been able +to successfully exploit this, but I'd imagine that a clever attacker +could use this to read things he shouldn't. Even if it's not +exploitable, it couldn't hurt to be safe. + +Signed-off-by: Dan Rosenberg +Signed-off-by: Chris Mason +Signed-off-by: Greg Kroah-Hartman + +--- + fs/btrfs/ioctl.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/fs/btrfs/ioctl.c ++++ b/fs/btrfs/ioctl.c +@@ -947,7 +947,7 @@ static noinline long btrfs_ioctl_clone(s + */ + + /* the destination must be opened for writing */ +- if (!(file->f_mode & FMODE_WRITE)) ++ if (!(file->f_mode & FMODE_WRITE) || (file->f_flags & O_APPEND)) + return -EINVAL; + + ret = mnt_want_write(file->f_path.mnt); +@@ -1000,7 +1000,7 @@ static noinline long btrfs_ioctl_clone(s + + /* determine range to clone */ + ret = -EINVAL; +- if (off >= src->i_size || off + len > src->i_size) ++ if (off + len > src->i_size || off + len < off) + goto out_unlock; + if (len == 0) + olen = len = src->i_size - off; diff --git a/queue-2.6.32/cifs-don-t-attempt-busy-file-rename-unless-it-s-in-same-directory.patch b/queue-2.6.32/cifs-don-t-attempt-busy-file-rename-unless-it-s-in-same-directory.patch new file mode 100644 index 00000000000..c53d26a79e4 --- /dev/null +++ b/queue-2.6.32/cifs-don-t-attempt-busy-file-rename-unless-it-s-in-same-directory.patch @@ -0,0 +1,37 @@ +From ed0e3ace576d297a5c7015401db1060bbf677b94 Mon Sep 17 00:00:00 2001 +From: Jeff Layton +Date: Tue, 1 Jun 2010 16:21:01 -0400 +Subject: cifs: don't attempt busy-file rename unless it's in same directory + +From: Jeff Layton + +commit ed0e3ace576d297a5c7015401db1060bbf677b94 upstream. + +Busy-file renames don't actually work across directories, so we need +to limit this code to renames within the same dir. + +This fixes the bug detailed here: + + https://bugzilla.redhat.com/show_bug.cgi?id=591938 + +Signed-off-by: Jeff Layton +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman + +--- + fs/cifs/inode.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/fs/cifs/inode.c ++++ b/fs/cifs/inode.c +@@ -1284,6 +1284,10 @@ cifs_do_rename(int xid, struct dentry *f + if (rc == 0 || rc != -ETXTBSY) + return rc; + ++ /* open-file renames don't work across directories */ ++ if (to_dentry->d_parent != from_dentry->d_parent) ++ return rc; ++ + /* open the file to be renamed -- we need DELETE perms */ + rc = CIFSSMBOpen(xid, pTcon, fromPath, FILE_OPEN, DELETE, + CREATE_NOT_DIR, &srcfid, &oplock, NULL, diff --git a/queue-2.6.32/cifs-fix-a-malicious-redirect-problem-in-the-dns-lookup-code.patch b/queue-2.6.32/cifs-fix-a-malicious-redirect-problem-in-the-dns-lookup-code.patch new file mode 100644 index 00000000000..2fb5f623275 --- /dev/null +++ b/queue-2.6.32/cifs-fix-a-malicious-redirect-problem-in-the-dns-lookup-code.patch @@ -0,0 +1,201 @@ +From 4c0c03ca54f72fdd5912516ad0a23ec5cf01bda7 Mon Sep 17 00:00:00 2001 +From: David Howells +Date: Thu, 22 Jul 2010 12:53:18 +0100 +Subject: CIFS: Fix a malicious redirect problem in the DNS lookup code + +From: David Howells + +commit 4c0c03ca54f72fdd5912516ad0a23ec5cf01bda7 upstream. + +Fix the security problem in the CIFS filesystem DNS lookup code in which a +malicious redirect could be installed by a random user by simply adding a +result record into one of their keyrings with add_key() and then invoking a +CIFS CFS lookup [CVE-2010-2524]. + +This is done by creating an internal keyring specifically for the caching of +DNS lookups. To enforce the use of this keyring, the module init routine +creates a set of override credentials with the keyring installed as the thread +keyring and instructs request_key() to only install lookup result keys in that +keyring. + +The override is then applied around the call to request_key(). + +This has some additional benefits when a kernel service uses this module to +request a key: + + (1) The result keys are owned by root, not the user that caused the lookup. + + (2) The result keys don't pop up in the user's keyrings. + + (3) The result keys don't come out of the quota of the user that caused the + lookup. + +The keyring can be viewed as root by doing cat /proc/keys: + +2a0ca6c3 I----- 1 perm 1f030000 0 0 keyring .dns_resolver: 1/4 + +It can then be listed with 'keyctl list' by root. + + # keyctl list 0x2a0ca6c3 + 1 key in keyring: + 726766307: --alswrv 0 0 dns_resolver: foo.bar.com + +Signed-off-by: David Howells +Reviewed-and-Tested-by: Jeff Layton +Acked-by: Steve French +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + fs/cifs/cifsfs.c | 6 ++-- + fs/cifs/dns_resolve.c | 69 ++++++++++++++++++++++++++++++++++++++++++++++++++ + fs/cifs/dns_resolve.h | 4 +- + 3 files changed, 74 insertions(+), 5 deletions(-) + +--- a/fs/cifs/cifsfs.c ++++ b/fs/cifs/cifsfs.c +@@ -1033,7 +1033,7 @@ init_cifs(void) + goto out_unregister_filesystem; + #endif + #ifdef CONFIG_CIFS_DFS_UPCALL +- rc = register_key_type(&key_type_dns_resolver); ++ rc = cifs_init_dns_resolver(); + if (rc) + goto out_unregister_key_type; + #endif +@@ -1045,7 +1045,7 @@ init_cifs(void) + + out_unregister_resolver_key: + #ifdef CONFIG_CIFS_DFS_UPCALL +- unregister_key_type(&key_type_dns_resolver); ++ cifs_exit_dns_resolver(); + out_unregister_key_type: + #endif + #ifdef CONFIG_CIFS_UPCALL +@@ -1071,7 +1071,7 @@ exit_cifs(void) + cifs_proc_clean(); + #ifdef CONFIG_CIFS_DFS_UPCALL + cifs_dfs_release_automount_timer(); +- unregister_key_type(&key_type_dns_resolver); ++ cifs_exit_dns_resolver(); + #endif + #ifdef CONFIG_CIFS_UPCALL + unregister_key_type(&cifs_spnego_key_type); +--- a/fs/cifs/dns_resolve.c ++++ b/fs/cifs/dns_resolve.c +@@ -23,12 +23,16 @@ + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + */ + ++#include ++#include + #include + #include "dns_resolve.h" + #include "cifsglob.h" + #include "cifsproto.h" + #include "cifs_debug.h" + ++static const struct cred *dns_resolver_cache; ++ + /* Checks if supplied name is IP address + * returns: + * 1 - name is IP +@@ -93,6 +97,7 @@ struct key_type key_type_dns_resolver = + int + dns_resolve_server_name_to_ip(const char *unc, char **ip_addr) + { ++ const struct cred *saved_cred; + int rc = -EAGAIN; + struct key *rkey = ERR_PTR(-EAGAIN); + char *name; +@@ -132,8 +137,15 @@ dns_resolve_server_name_to_ip(const char + goto skip_upcall; + } + ++ saved_cred = override_creds(dns_resolver_cache); + rkey = request_key(&key_type_dns_resolver, name, ""); ++ revert_creds(saved_cred); + if (!IS_ERR(rkey)) { ++ if (!(rkey->perm & KEY_USR_VIEW)) { ++ down_read(&rkey->sem); ++ rkey->perm |= KEY_USR_VIEW; ++ up_read(&rkey->sem); ++ } + len = rkey->type_data.x[0]; + data = rkey->payload.data; + } else { +@@ -164,4 +176,61 @@ out: + return rc; + } + ++int __init cifs_init_dns_resolver(void) ++{ ++ struct cred *cred; ++ struct key *keyring; ++ int ret; ++ ++ printk(KERN_NOTICE "Registering the %s key type\n", ++ key_type_dns_resolver.name); ++ ++ /* create an override credential set with a special thread keyring in ++ * which DNS requests are cached ++ * ++ * this is used to prevent malicious redirections from being installed ++ * with add_key(). ++ */ ++ cred = prepare_kernel_cred(NULL); ++ if (!cred) ++ return -ENOMEM; ++ ++ keyring = key_alloc(&key_type_keyring, ".dns_resolver", 0, 0, cred, ++ (KEY_POS_ALL & ~KEY_POS_SETATTR) | ++ KEY_USR_VIEW | KEY_USR_READ, ++ KEY_ALLOC_NOT_IN_QUOTA); ++ if (IS_ERR(keyring)) { ++ ret = PTR_ERR(keyring); ++ goto failed_put_cred; ++ } ++ ++ ret = key_instantiate_and_link(keyring, NULL, 0, NULL, NULL); ++ if (ret < 0) ++ goto failed_put_key; ++ ++ ret = register_key_type(&key_type_dns_resolver); ++ if (ret < 0) ++ goto failed_put_key; ++ ++ /* instruct request_key() to use this special keyring as a cache for ++ * the results it looks up */ ++ cred->thread_keyring = keyring; ++ cred->jit_keyring = KEY_REQKEY_DEFL_THREAD_KEYRING; ++ dns_resolver_cache = cred; ++ return 0; ++ ++failed_put_key: ++ key_put(keyring); ++failed_put_cred: ++ put_cred(cred); ++ return ret; ++} + ++void __exit cifs_exit_dns_resolver(void) ++{ ++ key_revoke(dns_resolver_cache->thread_keyring); ++ unregister_key_type(&key_type_dns_resolver); ++ put_cred(dns_resolver_cache); ++ printk(KERN_NOTICE "Unregistered %s key type\n", ++ key_type_dns_resolver.name); ++} +--- a/fs/cifs/dns_resolve.h ++++ b/fs/cifs/dns_resolve.h +@@ -24,8 +24,8 @@ + #define _DNS_RESOLVE_H + + #ifdef __KERNEL__ +-#include +-extern struct key_type key_type_dns_resolver; ++extern int __init cifs_init_dns_resolver(void); ++extern void __exit cifs_exit_dns_resolver(void); + extern int dns_resolve_server_name_to_ip(const char *unc, char **ip_addr); + #endif /* KERNEL */ + diff --git a/queue-2.6.32/cifs-remove-bogus-first_time-check-in-ntlmv2-session-setup-code.patch b/queue-2.6.32/cifs-remove-bogus-first_time-check-in-ntlmv2-session-setup-code.patch new file mode 100644 index 00000000000..14d0e8c2a2e --- /dev/null +++ b/queue-2.6.32/cifs-remove-bogus-first_time-check-in-ntlmv2-session-setup-code.patch @@ -0,0 +1,46 @@ +From 8a224d489454b7457105848610cfebebdec5638d Mon Sep 17 00:00:00 2001 +From: Jeff Layton +Date: Wed, 16 Jun 2010 13:40:18 -0400 +Subject: cifs: remove bogus first_time check in NTLMv2 session setup code + +From: Jeff Layton + +commit 8a224d489454b7457105848610cfebebdec5638d upstream. + +This bug appears to be the result of a cut-and-paste mistake from the +NTLMv1 code. The function to generate the MAC key was commented out, but +not the conditional above it. The conditional then ended up causing the +session setup key not to be copied to the buffer unless this was the +first session on the socket, and that made all but the first NTLMv2 +session setup fail. + +Fix this by removing the conditional and all of the commented clutter +that made it difficult to see. + +Reported-by: Gunther Deschner +Signed-off-by: Jeff Layton +Signed-off-by: Greg Kroah-Hartman + +--- + fs/cifs/sess.c | 10 +--------- + 1 file changed, 1 insertion(+), 9 deletions(-) + +--- a/fs/cifs/sess.c ++++ b/fs/cifs/sess.c +@@ -723,15 +723,7 @@ ssetup_ntlmssp_authenticate: + + /* calculate session key */ + setup_ntlmv2_rsp(ses, v2_sess_key, nls_cp); +- if (first_time) /* should this be moved into common code +- with similar ntlmv2 path? */ +- /* cifs_calculate_ntlmv2_mac_key(ses->server->mac_signing_key, +- response BB FIXME, v2_sess_key); */ +- +- /* copy session key */ +- +- /* memcpy(bcc_ptr, (char *)ntlm_session_key,LM2_SESS_KEY_SIZE); +- bcc_ptr += LM2_SESS_KEY_SIZE; */ ++ /* FIXME: calculate MAC key */ + memcpy(bcc_ptr, (char *)v2_sess_key, + sizeof(struct ntlmv2_resp)); + bcc_ptr += sizeof(struct ntlmv2_resp); diff --git a/queue-2.6.32/cpmac-do-not-leak-struct-net_device-on-phy_connect-errors.patch b/queue-2.6.32/cpmac-do-not-leak-struct-net_device-on-phy_connect-errors.patch new file mode 100644 index 00000000000..d5d1e2c7df2 --- /dev/null +++ b/queue-2.6.32/cpmac-do-not-leak-struct-net_device-on-phy_connect-errors.patch @@ -0,0 +1,32 @@ +From ed770f01360b392564650bf1553ce723fa46afec Mon Sep 17 00:00:00 2001 +From: Florian Fainelli +Date: Sun, 20 Jun 2010 22:07:48 +0000 +Subject: cpmac: do not leak struct net_device on phy_connect errors + +From: Florian Fainelli + +commit ed770f01360b392564650bf1553ce723fa46afec upstream. + +If the call to phy_connect fails, we will return directly instead of freeing +the previously allocated struct net_device. + +Signed-off-by: Florian Fainelli +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/cpmac.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/net/cpmac.c ++++ b/drivers/net/cpmac.c +@@ -1176,7 +1176,8 @@ static int __devinit cpmac_probe(struct + if (netif_msg_drv(priv)) + printk(KERN_ERR "%s: Could not attach to PHY\n", + dev->name); +- return PTR_ERR(priv->phy); ++ rc = PTR_ERR(priv->phy); ++ goto fail; + } + + if ((rc = register_netdev(dev))) { diff --git a/queue-2.6.32/fb-fix-colliding-defines-for-fb-flags.patch b/queue-2.6.32/fb-fix-colliding-defines-for-fb-flags.patch new file mode 100644 index 00000000000..63412dc7dc5 --- /dev/null +++ b/queue-2.6.32/fb-fix-colliding-defines-for-fb-flags.patch @@ -0,0 +1,42 @@ +From b26c949755c06ec79e55a75817210083bd78fc9a Mon Sep 17 00:00:00 2001 +From: Dave Airlie +Date: Wed, 23 Jun 2010 11:35:41 +1000 +Subject: fb: fix colliding defines for fb flags. + +From: Dave Airlie + +commit b26c949755c06ec79e55a75817210083bd78fc9a upstream. + +When I added the flags I must have been using a 25 line terminal and missed the following flags. + +The collided with flag has one user in staging despite being in-tree for 5 years. + +I'm happy to push this via my drm tree unless someone really wants to do it. + +Signed-off-by: Dave Airlie +Signed-off-by: Greg Kroah-Hartman + +--- + include/linux/fb.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/include/linux/fb.h ++++ b/include/linux/fb.h +@@ -784,8 +784,6 @@ struct fb_tile_ops { + #define FBINFO_MISC_USEREVENT 0x10000 /* event request + from userspace */ + #define FBINFO_MISC_TILEBLITTING 0x20000 /* use tile blitting */ +-#define FBINFO_MISC_FIRMWARE 0x40000 /* a replaceable firmware +- inited framebuffer */ + + /* A driver may set this flag to indicate that it does want a set_par to be + * called every time when fbcon_switch is executed. The advantage is that with +@@ -799,6 +797,8 @@ struct fb_tile_ops { + */ + #define FBINFO_MISC_ALWAYS_SETPAR 0x40000 + ++/* where the fb is a firmware driver, and can be replaced with a proper one */ ++#define FBINFO_MISC_FIRMWARE 0x80000 + /* + * Host and GPU endianness differ. + */ diff --git a/queue-2.6.32/hostap-protect-against-initialization-interrupt.patch b/queue-2.6.32/hostap-protect-against-initialization-interrupt.patch new file mode 100644 index 00000000000..2b0450346af --- /dev/null +++ b/queue-2.6.32/hostap-protect-against-initialization-interrupt.patch @@ -0,0 +1,103 @@ +From d6a574ff6bfb842bdb98065da053881ff527be46 Mon Sep 17 00:00:00 2001 +From: Tim Gardner +Date: Tue, 8 Jun 2010 11:33:02 -0600 +Subject: hostap: Protect against initialization interrupt + +From: Tim Gardner + +commit d6a574ff6bfb842bdb98065da053881ff527be46 upstream. + +Use an irq spinlock to hold off the IRQ handler until +enough early card init is complete such that the handler +can run without faulting. + +Signed-off-by: Tim Gardner +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/hostap/hostap_cs.c | 10 ++++++++++ + drivers/net/wireless/hostap/hostap_hw.c | 13 +++++++++++++ + drivers/net/wireless/hostap/hostap_wlan.h | 2 +- + 3 files changed, 24 insertions(+), 1 deletion(-) + +--- a/drivers/net/wireless/hostap/hostap_cs.c ++++ b/drivers/net/wireless/hostap/hostap_cs.c +@@ -626,6 +626,7 @@ static int prism2_config(struct pcmcia_d + int ret = 1; + int last_fn, last_ret; + struct hostap_cs_priv *hw_priv; ++ unsigned long flags; + + PDEBUG(DEBUG_FLOW, "prism2_config()\n"); + +@@ -661,6 +662,12 @@ static int prism2_config(struct pcmcia_d + link->dev_node = &hw_priv->node; + + /* ++ * Make sure the IRQ handler cannot proceed until at least ++ * dev->base_addr is initialized. ++ */ ++ spin_lock_irqsave(&local->irq_init_lock, flags); ++ ++ /* + * Allocate an interrupt line. Note that this does not assign a + * handler to the interrupt, unless the 'Handler' member of the + * irq structure is initialized. +@@ -686,6 +693,8 @@ static int prism2_config(struct pcmcia_d + dev->irq = link->irq.AssignedIRQ; + dev->base_addr = link->io.BasePort1; + ++ spin_unlock_irqrestore(&local->irq_init_lock, flags); ++ + /* Finally, report what we've done */ + printk(KERN_INFO "%s: index 0x%02x: ", + dev_info, link->conf.ConfigIndex); +@@ -715,6 +724,7 @@ static int prism2_config(struct pcmcia_d + return ret; + + cs_failed: ++ spin_unlock_irqrestore(&local->irq_init_lock, flags); + cs_error(link, last_fn, last_ret); + + failed: +--- a/drivers/net/wireless/hostap/hostap_hw.c ++++ b/drivers/net/wireless/hostap/hostap_hw.c +@@ -2621,6 +2621,18 @@ static irqreturn_t prism2_interrupt(int + iface = netdev_priv(dev); + local = iface->local; + ++ /* Detect early interrupt before driver is fully configued */ ++ spin_lock(&local->irq_init_lock); ++ if (!dev->base_addr) { ++ if (net_ratelimit()) { ++ printk(KERN_DEBUG "%s: Interrupt, but dev not configured\n", ++ dev->name); ++ } ++ spin_unlock(&local->irq_init_lock); ++ return IRQ_HANDLED; ++ } ++ spin_unlock(&local->irq_init_lock); ++ + prism2_io_debug_add(dev, PRISM2_IO_DEBUG_CMD_INTERRUPT, 0, 0); + + if (local->func->card_present && !local->func->card_present(local)) { +@@ -3138,6 +3150,7 @@ prism2_init_local_data(struct prism2_hel + spin_lock_init(&local->cmdlock); + spin_lock_init(&local->baplock); + spin_lock_init(&local->lock); ++ spin_lock_init(&local->irq_init_lock); + mutex_init(&local->rid_bap_mtx); + + if (card_idx < 0 || card_idx >= MAX_PARM_DEVICES) +--- a/drivers/net/wireless/hostap/hostap_wlan.h ++++ b/drivers/net/wireless/hostap/hostap_wlan.h +@@ -654,7 +654,7 @@ struct local_info { + rwlock_t iface_lock; /* hostap_interfaces read lock; use write lock + * when removing entries from the list. + * TX and RX paths can use read lock. */ +- spinlock_t cmdlock, baplock, lock; ++ spinlock_t cmdlock, baplock, lock, irq_init_lock; + struct mutex rid_bap_mtx; + u16 infofid; /* MAC buffer id for info frame */ + /* txfid, intransmitfid, next_txtid, and next_alloc are protected by diff --git a/queue-2.6.32/hwmon-coretemp-properly-label-the-sensors.patch b/queue-2.6.32/hwmon-coretemp-properly-label-the-sensors.patch new file mode 100644 index 00000000000..da9ff380dc7 --- /dev/null +++ b/queue-2.6.32/hwmon-coretemp-properly-label-the-sensors.patch @@ -0,0 +1,50 @@ +From 3f4f09b4be35d38d6e2bf22c989443e65e70fc4c Mon Sep 17 00:00:00 2001 +From: Jean Delvare +Date: Fri, 9 Jul 2010 16:22:51 +0200 +Subject: hwmon: (coretemp) Properly label the sensors + +From: Jean Delvare + +commit 3f4f09b4be35d38d6e2bf22c989443e65e70fc4c upstream. + +Don't assume that CPU entry number and core ID always match. It +worked in the simple cases (single CPU, no HT) but fails on +multi-CPU systems. + +Signed-off-by: Jean Delvare +Acked-by: Huaxu Wan +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwmon/coretemp.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/drivers/hwmon/coretemp.c ++++ b/drivers/hwmon/coretemp.c +@@ -53,6 +53,7 @@ struct coretemp_data { + struct mutex update_lock; + const char *name; + u32 id; ++ u16 core_id; + char valid; /* zero until following fields are valid */ + unsigned long last_updated; /* in jiffies */ + int temp; +@@ -75,7 +76,7 @@ static ssize_t show_name(struct device * + if (attr->index == SHOW_NAME) + ret = sprintf(buf, "%s\n", data->name); + else /* show label */ +- ret = sprintf(buf, "Core %d\n", data->id); ++ ret = sprintf(buf, "Core %d\n", data->core_id); + return ret; + } + +@@ -255,6 +256,9 @@ static int __devinit coretemp_probe(stru + } + + data->id = pdev->id; ++#ifdef CONFIG_SMP ++ data->core_id = c->cpu_core_id; ++#endif + data->name = "coretemp"; + mutex_init(&data->update_lock); + diff --git a/queue-2.6.32/hwmon-coretemp-skip-duplicate-cpu-entries.patch b/queue-2.6.32/hwmon-coretemp-skip-duplicate-cpu-entries.patch new file mode 100644 index 00000000000..b5cf3078ba6 --- /dev/null +++ b/queue-2.6.32/hwmon-coretemp-skip-duplicate-cpu-entries.patch @@ -0,0 +1,76 @@ +From d883b9f0977269d519469da72faec6a7f72cb489 Mon Sep 17 00:00:00 2001 +From: Jean Delvare +Date: Fri, 9 Jul 2010 16:22:49 +0200 +Subject: hwmon: (coretemp) Skip duplicate CPU entries + +From: Jean Delvare + +commit d883b9f0977269d519469da72faec6a7f72cb489 upstream. + +On hyper-threaded CPUs, each core appears twice in the CPU list. Skip +the second entry to avoid duplicate sensors. + +Signed-off-by: Jean Delvare +Acked-by: Huaxu Wan +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwmon/coretemp.c | 26 +++++++++++++++++++++++++- + 1 file changed, 25 insertions(+), 1 deletion(-) + +--- a/drivers/hwmon/coretemp.c ++++ b/drivers/hwmon/coretemp.c +@@ -356,6 +356,10 @@ struct pdev_entry { + struct list_head list; + struct platform_device *pdev; + unsigned int cpu; ++#ifdef CONFIG_SMP ++ u16 phys_proc_id; ++ u16 cpu_core_id; ++#endif + }; + + static LIST_HEAD(pdev_list); +@@ -366,6 +370,22 @@ static int __cpuinit coretemp_device_add + int err; + struct platform_device *pdev; + struct pdev_entry *pdev_entry; ++#ifdef CONFIG_SMP ++ struct cpuinfo_x86 *c = &cpu_data(cpu); ++#endif ++ ++ mutex_lock(&pdev_list_mutex); ++ ++#ifdef CONFIG_SMP ++ /* Skip second HT entry of each core */ ++ list_for_each_entry(pdev_entry, &pdev_list, list) { ++ if (c->phys_proc_id == pdev_entry->phys_proc_id && ++ c->cpu_core_id == pdev_entry->cpu_core_id) { ++ err = 0; /* Not an error */ ++ goto exit; ++ } ++ } ++#endif + + pdev = platform_device_alloc(DRVNAME, cpu); + if (!pdev) { +@@ -389,7 +409,10 @@ static int __cpuinit coretemp_device_add + + pdev_entry->pdev = pdev; + pdev_entry->cpu = cpu; +- mutex_lock(&pdev_list_mutex); ++#ifdef CONFIG_SMP ++ pdev_entry->phys_proc_id = c->phys_proc_id; ++ pdev_entry->cpu_core_id = c->cpu_core_id; ++#endif + list_add_tail(&pdev_entry->list, &pdev_list); + mutex_unlock(&pdev_list_mutex); + +@@ -400,6 +423,7 @@ exit_device_free: + exit_device_put: + platform_device_put(pdev); + exit: ++ mutex_unlock(&pdev_list_mutex); + return err; + } + diff --git a/queue-2.6.32/hwmon-it87-fix-in7-on-it8720f.patch b/queue-2.6.32/hwmon-it87-fix-in7-on-it8720f.patch new file mode 100644 index 00000000000..f2b8ceaa97b --- /dev/null +++ b/queue-2.6.32/hwmon-it87-fix-in7-on-it8720f.patch @@ -0,0 +1,67 @@ +From 436cad2a41a40c6c32bd9152b63d17eeb1f7c99b Mon Sep 17 00:00:00 2001 +From: Jean Delvare +Date: Fri, 9 Jul 2010 16:22:48 +0200 +Subject: hwmon: (it87) Fix in7 on IT8720F + +From: Jean Delvare + +commit 436cad2a41a40c6c32bd9152b63d17eeb1f7c99b upstream. + +The IT8720F has no VIN7 pin, so VCCH should always be routed +internally to VIN7 with an internal divider. Curiously, there still +is a configuration bit to control this, which means it can be set +incorrectly. And even more curiously, many boards out there are +improperly configured, even though the IT8720F datasheet claims that +the internal routing of VCCH to VIN7 is the default setting. So we +force the internal routing in this case. + +It turns out that all boards with the wrong setting are from Gigabyte, +so I suspect a BIOS bug. But it's easy enough to workaround in the +driver, so let's do it. + +Signed-off-by: Jean Delvare +Cc: Jean-Marc Spaggiari +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwmon/it87.c | 22 ++++++++++++++++++++++ + 1 file changed, 22 insertions(+) + +--- a/drivers/hwmon/it87.c ++++ b/drivers/hwmon/it87.c +@@ -80,6 +80,13 @@ superio_inb(int reg) + return inb(VAL); + } + ++static inline void ++superio_outb(int reg, int val) ++{ ++ outb(reg, REG); ++ outb(val, VAL); ++} ++ + static int superio_inw(int reg) + { + int val; +@@ -1036,6 +1043,21 @@ static int __init it87_find(unsigned sho + sio_data->vid_value = superio_inb(IT87_SIO_VID_REG); + + reg = superio_inb(IT87_SIO_PINX2_REG); ++ /* ++ * The IT8720F has no VIN7 pin, so VCCH should always be ++ * routed internally to VIN7 with an internal divider. ++ * Curiously, there still is a configuration bit to control ++ * this, which means it can be set incorrectly. And even ++ * more curiously, many boards out there are improperly ++ * configured, even though the IT8720F datasheet claims ++ * that the internal routing of VCCH to VIN7 is the default ++ * setting. So we force the internal routing in this case. ++ */ ++ if (sio_data->type == it8720 && !(reg & (1 << 1))) { ++ reg |= (1 << 1); ++ superio_outb(IT87_SIO_PINX2_REG, reg); ++ pr_notice("it87: Routing internal VCCH to in7\n"); ++ } + if (reg & (1 << 0)) + pr_info("it87: in3 is VCC (+5V)\n"); + if (reg & (1 << 1)) diff --git a/queue-2.6.32/hwmon-k8temp-bypass-core-swapping-on-single-core-processors.patch b/queue-2.6.32/hwmon-k8temp-bypass-core-swapping-on-single-core-processors.patch new file mode 100644 index 00000000000..b7f4e268a0f --- /dev/null +++ b/queue-2.6.32/hwmon-k8temp-bypass-core-swapping-on-single-core-processors.patch @@ -0,0 +1,52 @@ +From cd4de21f7e65a8cd04860f5661b3c18648ee52a1 Mon Sep 17 00:00:00 2001 +From: Jean Delvare +Date: Sun, 20 Jun 2010 09:22:32 +0200 +Subject: hwmon: (k8temp) Bypass core swapping on single-core processors + +From: Jean Delvare + +commit cd4de21f7e65a8cd04860f5661b3c18648ee52a1 upstream. + +Commit a2e066bba2aad6583e3ff648bf28339d6c9f0898 introduced core +swapping for CPU models 64 and later. I recently had a report about +a Sempron 3200+, model 95, for which this patch broke temperature +reading. It happens that this is a single-core processor, so the +effect of the swapping was to read a temperature value for a core +that didn't exist, leading to an incorrect value (-49 degrees C.) + +Disabling core swapping on singe-core processors should fix this. + +Additional comment from Andreas: + +The BKDG says + + Thermal Sensor Core Select (ThermSenseCoreSel)-Bit 2. This bit + selects the CPU whose temperature is reported in the CurTemp + field. This bit only applies to dual core processors. For + single core processors CPU0 Thermal Sensor is always selected. + +k8temp_probe() correctly detected that SEL_CORE can't be used on single +core CPU. Thus k8temp did never update the temperature values stored +in temp[1][x] and -49 degrees was reported. For single core CPUs we +must use the values read into temp[0][x]. + +Signed-off-by: Jean Delvare +Tested-by: Rick Moritz +Acked-by: Andreas Herrmann +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwmon/k8temp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/hwmon/k8temp.c ++++ b/drivers/hwmon/k8temp.c +@@ -120,7 +120,7 @@ static ssize_t show_temp(struct device * + int temp; + struct k8temp_data *data = k8temp_update_device(dev); + +- if (data->swap_core_select) ++ if (data->swap_core_select && (data->sensorsp & SEL_CORE)) + core = core ? 0 : 1; + + temp = TEMP_FROM_REG(data->temp[core][place]) + data->temp_offset; diff --git a/queue-2.6.32/hwmon-k8temp-fix-temperature-reporting-for-asb1-processor-revisions.patch b/queue-2.6.32/hwmon-k8temp-fix-temperature-reporting-for-asb1-processor-revisions.patch new file mode 100644 index 00000000000..6d620b49a4c --- /dev/null +++ b/queue-2.6.32/hwmon-k8temp-fix-temperature-reporting-for-asb1-processor-revisions.patch @@ -0,0 +1,64 @@ +From d535bad90dad4eb42ec6528043fcfb53627d4f89 Mon Sep 17 00:00:00 2001 +From: Andreas Herrmann +Date: Fri, 9 Jul 2010 16:22:47 +0200 +Subject: hwmon: (k8temp) Fix temperature reporting for ASB1 processor revisions + +From: Andreas Herrmann + +commit d535bad90dad4eb42ec6528043fcfb53627d4f89 upstream. + +Reported temperature for ASB1 CPUs is too high. +Add ASB1 CPU revisions (these are also non-desktop variants) to the +list of CPUs for which the temperature fixup is not required. + +Example: (from LENOVO ThinkPad Edge 13, 01972NG, system was idle) + + Current kernel reports + + $ sensors + k8temp-pci-00c3 + Adapter: PCI adapter + Core0 Temp: +74.0 C + Core0 Temp: +70.0 C + Core1 Temp: +69.0 C + Core1 Temp: +70.0 C + + With this patch I have + + $ sensors + k8temp-pci-00c3 + Adapter: PCI adapter + Core0 Temp: +54.0 C + Core0 Temp: +51.0 C + Core1 Temp: +48.0 C + Core1 Temp: +49.0 C + +Cc: Rudolf Marek +Signed-off-by: Andreas Herrmann +Signed-off-by: Jean Delvare +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwmon/k8temp.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +--- a/drivers/hwmon/k8temp.c ++++ b/drivers/hwmon/k8temp.c +@@ -180,11 +180,13 @@ static int __devinit k8temp_probe(struct + } + + if ((model >= 0x69) && +- !(model == 0xc1 || model == 0x6c || model == 0x7c)) { ++ !(model == 0xc1 || model == 0x6c || model == 0x7c || ++ model == 0x6b || model == 0x6f || model == 0x7f)) { + /* +- * RevG desktop CPUs (i.e. no socket S1G1 parts) +- * need additional offset, otherwise reported +- * temperature is below ambient temperature ++ * RevG desktop CPUs (i.e. no socket S1G1 or ++ * ASB1 parts) need additional offset, ++ * otherwise reported temperature is below ++ * ambient temperature + */ + data->temp_offset = 21000; + } diff --git a/queue-2.6.32/igb-change-how-we-handle-alternate-mac-addresses.patch b/queue-2.6.32/igb-change-how-we-handle-alternate-mac-addresses.patch new file mode 100644 index 00000000000..e782e398d0e --- /dev/null +++ b/queue-2.6.32/igb-change-how-we-handle-alternate-mac-addresses.patch @@ -0,0 +1,101 @@ +From 22896639af98ebc721a94ed71fc3acf2fb4a24dc Mon Sep 17 00:00:00 2001 +From: Alexander Duyck +Date: Mon, 5 Oct 2009 06:34:25 +0000 +Subject: igb: change how we handle alternate mac addresses + +From: Alexander Duyck + +commit 22896639af98ebc721a94ed71fc3acf2fb4a24dc upstream. + +This patch allows us to treat the alternate mac address as though it is the +physical address on the adapter. This is accomplished by letting the +alt_mac_address function to only fail on an NVM error. If no errors occur +and the alternate mac address is not present then RAR0 is read as the +default mac address. + +Signed-off-by: Alexander Duyck +Signed-off-by: Jeff Kirsher +Signed-off-by: David S. Miller +Cc: Brandon Philips +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/igb/e1000_82575.c | 13 +++++++++++-- + drivers/net/igb/e1000_hw.h | 2 ++ + drivers/net/igb/e1000_mac.c | 17 +++++++++-------- + 3 files changed, 22 insertions(+), 10 deletions(-) + +--- a/drivers/net/igb/e1000_82575.c ++++ b/drivers/net/igb/e1000_82575.c +@@ -1168,9 +1168,18 @@ static s32 igb_read_mac_addr_82575(struc + { + s32 ret_val = 0; + +- if (igb_check_alt_mac_addr(hw)) +- ret_val = igb_read_mac_addr(hw); ++ /* ++ * If there's an alternate MAC address place it in RAR0 ++ * so that it will override the Si installed default perm ++ * address. ++ */ ++ ret_val = igb_check_alt_mac_addr(hw); ++ if (ret_val) ++ goto out; + ++ ret_val = igb_read_mac_addr(hw); ++ ++out: + return ret_val; + } + +--- a/drivers/net/igb/e1000_hw.h ++++ b/drivers/net/igb/e1000_hw.h +@@ -53,6 +53,8 @@ struct e1000_hw; + + #define E1000_FUNC_1 1 + ++#define E1000_ALT_MAC_ADDRESS_OFFSET_LAN1 3 ++ + enum e1000_mac_type { + e1000_undefined = 0, + e1000_82575, +--- a/drivers/net/igb/e1000_mac.c ++++ b/drivers/net/igb/e1000_mac.c +@@ -185,13 +185,12 @@ s32 igb_check_alt_mac_addr(struct e1000_ + } + + if (nvm_alt_mac_addr_offset == 0xFFFF) { +- ret_val = -(E1000_NOT_IMPLEMENTED); ++ /* There is no Alternate MAC Address */ + goto out; + } + + if (hw->bus.func == E1000_FUNC_1) +- nvm_alt_mac_addr_offset += ETH_ALEN/sizeof(u16); +- ++ nvm_alt_mac_addr_offset += E1000_ALT_MAC_ADDRESS_OFFSET_LAN1; + for (i = 0; i < ETH_ALEN; i += 2) { + offset = nvm_alt_mac_addr_offset + (i >> 1); + ret_val = hw->nvm.ops.read(hw, offset, 1, &nvm_data); +@@ -206,14 +205,16 @@ s32 igb_check_alt_mac_addr(struct e1000_ + + /* if multicast bit is set, the alternate address will not be used */ + if (alt_mac_addr[0] & 0x01) { +- ret_val = -(E1000_NOT_IMPLEMENTED); ++ hw_dbg("Ignoring Alternate Mac Address with MC bit set\n"); + goto out; + } + +- for (i = 0; i < ETH_ALEN; i++) +- hw->mac.addr[i] = hw->mac.perm_addr[i] = alt_mac_addr[i]; +- +- hw->mac.ops.rar_set(hw, hw->mac.perm_addr, 0); ++ /* ++ * We have a valid alternate MAC address, and we want to treat it the ++ * same as the normal permanent MAC address stored by the HW into the ++ * RAR. Do this by mapping this address into RAR0. ++ */ ++ hw->mac.ops.rar_set(hw, alt_mac_addr, 0); + + out: + return ret_val; diff --git a/queue-2.6.32/iwlwifi-cancel-scan-watchdog-in-iwl_bg_abort_scan.patch b/queue-2.6.32/iwlwifi-cancel-scan-watchdog-in-iwl_bg_abort_scan.patch new file mode 100644 index 00000000000..e887cbad715 --- /dev/null +++ b/queue-2.6.32/iwlwifi-cancel-scan-watchdog-in-iwl_bg_abort_scan.patch @@ -0,0 +1,63 @@ +From a69b03e941abae00380fc6bc1877fb797a1b31e6 Mon Sep 17 00:00:00 2001 +From: John W. Linville +Date: Mon, 14 Jun 2010 14:30:25 -0400 +Subject: iwlwifi: cancel scan watchdog in iwl_bg_abort_scan + +From: John W. Linville + +commit a69b03e941abae00380fc6bc1877fb797a1b31e6 upstream. + +Avoids this: + +WARNING: at net/mac80211/scan.c:312 ieee80211_scan_completed+0x5f/0x1f1 +[mac80211]() +Hardware name: Latitude E5400 +Modules linked in: aes_x86_64 aes_generic fuse ipt_MASQUERADE iptable_nat +nf_nat rfcomm sco bridge stp llc bnep l2cap sunrpc cpufreq_ondemand +acpi_cpufreq freq_table xt_physdev ip6t_REJECT nf_conntrack_ipv6 +ip6table_filter ip6_tables ipv6 kvm_intel kvm uinput arc4 ecb +snd_hda_codec_intelhdmi snd_hda_codec_idt snd_hda_intel iwlagn snd_hda_codec +snd_hwdep snd_seq snd_seq_device iwlcore snd_pcm dell_wmi sdhci_pci sdhci +iTCO_wdt tg3 dell_laptop mmc_core i2c_i801 wmi mac80211 snd_timer +iTCO_vendor_support btusb joydev dcdbas cfg80211 bluetooth snd soundcore +microcode rfkill snd_page_alloc firewire_ohci firewire_core crc_itu_t +yenta_socket rsrc_nonstatic i915 drm_kms_helper drm i2c_algo_bit i2c_core video +output [last unloaded: scsi_wait_scan] +Pid: 979, comm: iwlagn Tainted: G W 2.6.33.3-85.fc13.x86_64 #1 +Call Trace: +[] warn_slowpath_common+0x77/0x8f +[] warn_slowpath_null+0xf/0x11 +[] ieee80211_scan_completed+0x5f/0x1f1 [mac80211] +[] iwl_bg_scan_completed+0xbb/0x17a [iwlcore] +[] worker_thread+0x1a4/0x232 +[] ? iwl_bg_scan_completed+0x0/0x17a [iwlcore] +[] ? autoremove_wake_function+0x0/0x34 +[] ? worker_thread+0x0/0x232 +[] kthread+0x7a/0x82 +[] kernel_thread_helper+0x4/0x10 +[] ? kthread+0x0/0x82 +[] ? kernel_thread_helper+0x0/0x10 + +Reported here: + + https://bugzilla.redhat.com/show_bug.cgi?id=590436 + +Signed-off-by: John W. Linville +Reported-by: Mihai Harpau +Acked-by: Reinette Chatre +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/iwlwifi/iwl-scan.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/wireless/iwlwifi/iwl-scan.c ++++ b/drivers/net/wireless/iwlwifi/iwl-scan.c +@@ -799,6 +799,7 @@ void iwl_bg_abort_scan(struct work_struc + + mutex_lock(&priv->mutex); + ++ cancel_delayed_work_sync(&priv->scan_check); + set_bit(STATUS_SCAN_ABORTING, &priv->status); + iwl_send_scan_abort(priv); + diff --git a/queue-2.6.32/mac80211-do-not-wip-out-old-supported-rates.patch b/queue-2.6.32/mac80211-do-not-wip-out-old-supported-rates.patch new file mode 100644 index 00000000000..80cb1da4789 --- /dev/null +++ b/queue-2.6.32/mac80211-do-not-wip-out-old-supported-rates.patch @@ -0,0 +1,65 @@ +From f0b058b61711ebf5be94d6865ca7b2c259b71d37 Mon Sep 17 00:00:00 2001 +From: Stanislaw Gruszka +Date: Wed, 28 Apr 2010 15:17:03 +0200 +Subject: mac80211: do not wip out old supported rates + +From: Stanislaw Gruszka + +commit f0b058b61711ebf5be94d6865ca7b2c259b71d37 upstream. + +Use old supported rates, if AP do not provide supported rates +information element in a new managment frame. + +Signed-off-by: Stanislaw Gruszka +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + net/mac80211/scan.c | 21 +++++++++++---------- + 1 file changed, 11 insertions(+), 10 deletions(-) + +--- a/net/mac80211/scan.c ++++ b/net/mac80211/scan.c +@@ -62,7 +62,7 @@ ieee80211_bss_info_update(struct ieee802 + bool beacon) + { + struct ieee80211_bss *bss; +- int clen; ++ int clen, srlen; + s32 signal = 0; + + if (local->hw.flags & IEEE80211_HW_SIGNAL_DBM) +@@ -94,23 +94,24 @@ ieee80211_bss_info_update(struct ieee802 + if (bss->dtim_period == 0) + bss->dtim_period = 1; + +- bss->supp_rates_len = 0; ++ /* replace old supported rates if we get new values */ ++ srlen = 0; + if (elems->supp_rates) { +- clen = IEEE80211_MAX_SUPP_RATES - bss->supp_rates_len; ++ clen = IEEE80211_MAX_SUPP_RATES; + if (clen > elems->supp_rates_len) + clen = elems->supp_rates_len; +- memcpy(&bss->supp_rates[bss->supp_rates_len], elems->supp_rates, +- clen); +- bss->supp_rates_len += clen; ++ memcpy(bss->supp_rates, elems->supp_rates, clen); ++ srlen += clen; + } + if (elems->ext_supp_rates) { +- clen = IEEE80211_MAX_SUPP_RATES - bss->supp_rates_len; ++ clen = IEEE80211_MAX_SUPP_RATES - srlen; + if (clen > elems->ext_supp_rates_len) + clen = elems->ext_supp_rates_len; +- memcpy(&bss->supp_rates[bss->supp_rates_len], +- elems->ext_supp_rates, clen); +- bss->supp_rates_len += clen; ++ memcpy(bss->supp_rates + srlen, elems->ext_supp_rates, clen); ++ srlen += clen; + } ++ if (srlen) ++ bss->supp_rates_len = srlen; + + bss->wmm_used = elems->wmm_param || elems->wmm_info; + diff --git a/queue-2.6.32/mac80211-handle-mesh-action-frames-in-ieee80211_rx_h_action.patch b/queue-2.6.32/mac80211-handle-mesh-action-frames-in-ieee80211_rx_h_action.patch new file mode 100644 index 00000000000..ba23495c767 --- /dev/null +++ b/queue-2.6.32/mac80211-handle-mesh-action-frames-in-ieee80211_rx_h_action.patch @@ -0,0 +1,52 @@ +From 1cb561f83793191cf86a2db3948d28f5f42df9ff Mon Sep 17 00:00:00 2001 +From: Javier Cardona +Date: Mon, 29 Mar 2010 11:00:20 -0700 +Subject: mac80211: Handle mesh action frames in ieee80211_rx_h_action + +From: Javier Cardona + +commit 1cb561f83793191cf86a2db3948d28f5f42df9ff upstream. + +This fixes the problem introduced in commit +8404080568613d93ad7cf0a16dfb68 which broke mesh peer link establishment. + +changes: +v2 Added missing break (Johannes) +v3 Broke original patch into two (Johannes) + +Signed-off-by: Javier Cardona +Reviewed-by: Johannes Berg +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + + +--- + include/linux/ieee80211.h | 2 ++ + net/mac80211/rx.c | 5 +++++ + 2 files changed, 7 insertions(+) + +--- a/include/linux/ieee80211.h ++++ b/include/linux/ieee80211.h +@@ -1098,6 +1098,8 @@ enum ieee80211_category { + WLAN_CATEGORY_SA_QUERY = 8, + WLAN_CATEGORY_PROTECTED_DUAL_OF_ACTION = 9, + WLAN_CATEGORY_WMM = 17, ++ WLAN_CATEGORY_MESH_PLINK = 30, /* Pending ANA approval */ ++ WLAN_CATEGORY_MESH_PATH_SEL = 32, /* Pending ANA approval */ + WLAN_CATEGORY_VENDOR_SPECIFIC_PROTECTED = 126, + WLAN_CATEGORY_VENDOR_SPECIFIC = 127, + }; +--- a/net/mac80211/rx.c ++++ b/net/mac80211/rx.c +@@ -1818,6 +1818,11 @@ ieee80211_rx_h_action(struct ieee80211_r + return RX_CONTINUE; + } + break; ++ case WLAN_CATEGORY_MESH_PLINK: ++ case WLAN_CATEGORY_MESH_PATH_SEL: ++ if (ieee80211_vif_is_mesh(&sdata->vif)) ++ return ieee80211_mesh_rx_mgmt(sdata, rx->skb); ++ break; + default: + /* do not process rejected action frames */ + if (mgmt->u.action.category & 0x80) diff --git a/queue-2.6.32/math-emu-correct-test-for-downshifting-fraction-in-_fp_from_int.patch b/queue-2.6.32/math-emu-correct-test-for-downshifting-fraction-in-_fp_from_int.patch new file mode 100644 index 00000000000..14bb4b9b121 --- /dev/null +++ b/queue-2.6.32/math-emu-correct-test-for-downshifting-fraction-in-_fp_from_int.patch @@ -0,0 +1,56 @@ +From f8324e20f8289dffc646d64366332e05eaacab25 Mon Sep 17 00:00:00 2001 +From: Mikael Pettersson +Date: Tue, 20 Jul 2010 18:45:14 -0700 +Subject: math-emu: correct test for downshifting fraction in _FP_FROM_INT() + +From: Mikael Pettersson + +commit f8324e20f8289dffc646d64366332e05eaacab25 upstream. + +The kernel's math-emu code contains a macro _FP_FROM_INT() which is +used to convert an integer to a raw normalized floating-point value. +It does this basically in three steps: + +1. Compute the exponent from the number of leading zero bits. +2. Downshift large fractions to put the MSB in the right position + for normalized fractions. +3. Upshift small fractions to put the MSB in the right position. + +There is an boundary error in step 2, causing a fraction with its +MSB exactly one bit above the normalized MSB position to not be +downshifted. This results in a non-normalized raw float, which when +packed becomes a massively inaccurate representation for that input. + +The impact of this depends on a number of arch-specific factors, +but it is known to have broken emulation of FXTOD instructions +on UltraSPARC III, which was originally reported as GCC bug 44631 +. + +Any arch which uses math-emu to emulate conversions from integers to +same-size floats may be affected. + +The fix is simple: the exponent comparison used to determine if the +fraction should be downshifted must be "<=" not "<". + +I'm sending a kernel module to test this as a reply to this message. +There are also SPARC user-space test cases in the GCC bug entry. + +Signed-off-by: Mikael Pettersson +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + include/math-emu/op-common.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/include/math-emu/op-common.h ++++ b/include/math-emu/op-common.h +@@ -799,7 +799,7 @@ do { \ + X##_e -= (_FP_W_TYPE_SIZE - rsize); \ + X##_e = rsize - X##_e - 1; \ + \ +- if (_FP_FRACBITS_##fs < rsize && _FP_WFRACBITS_##fs < X##_e) \ ++ if (_FP_FRACBITS_##fs < rsize && _FP_WFRACBITS_##fs <= X##_e) \ + __FP_FRAC_SRS_1(ur_, (X##_e - _FP_WFRACBITS_##fs + 1), rsize);\ + _FP_FRAC_DISASSEMBLE_##wc(X, ur_, rsize); \ + if ((_FP_WFRACBITS_##fs - X##_e - 1) > 0) \ diff --git a/queue-2.6.32/nfsv4-ensure-that-proc-self-mountinfo-displays-the-minor-version-number.patch b/queue-2.6.32/nfsv4-ensure-that-proc-self-mountinfo-displays-the-minor-version-number.patch new file mode 100644 index 00000000000..9c7f0539fd0 --- /dev/null +++ b/queue-2.6.32/nfsv4-ensure-that-proc-self-mountinfo-displays-the-minor-version-number.patch @@ -0,0 +1,58 @@ +From 0be8189f2c87fcc747d6a4a657a0b6e2161b2318 Mon Sep 17 00:00:00 2001 +From: Trond Myklebust +Date: Fri, 18 Jun 2010 12:23:58 -0400 +Subject: NFSv4: Ensure that /proc/self/mountinfo displays the minor version number + +From: Trond Myklebust + +commit 0be8189f2c87fcc747d6a4a657a0b6e2161b2318 upstream. + +Currently, we do not display the minor version mount parameter in the +/proc mount info. + +Signed-off-by: Trond Myklebust +Signed-off-by: Greg Kroah-Hartman + +--- + fs/nfs/super.c | 22 ++++++++++++++++++---- + 1 file changed, 18 insertions(+), 4 deletions(-) + +--- a/fs/nfs/super.c ++++ b/fs/nfs/super.c +@@ -534,6 +534,22 @@ static void nfs_show_mountd_options(stru + } + } + ++#ifdef CONFIG_NFS_V4 ++static void nfs_show_nfsv4_options(struct seq_file *m, struct nfs_server *nfss, ++ int showdefaults) ++{ ++ struct nfs_client *clp = nfss->nfs_client; ++ ++ seq_printf(m, ",clientaddr=%s", clp->cl_ipaddr); ++ seq_printf(m, ",minorversion=%u", clp->cl_minorversion); ++} ++#else ++static void nfs_show_nfsv4_options(struct seq_file *m, struct nfs_server *nfss, ++ int showdefaults) ++{ ++} ++#endif ++ + /* + * Describe the mount options in force on this server representation + */ +@@ -595,11 +611,9 @@ static void nfs_show_mount_options(struc + + if (version != 4) + nfs_show_mountd_options(m, nfss, showdefaults); ++ else ++ nfs_show_nfsv4_options(m, nfss, showdefaults); + +-#ifdef CONFIG_NFS_V4 +- if (clp->rpc_ops->version == 4) +- seq_printf(m, ",clientaddr=%s", clp->cl_ipaddr); +-#endif + if (nfss->options & NFS_OPTION_FSCACHE) + seq_printf(m, ",fsc"); + } diff --git a/queue-2.6.32/nfsv4-fix-an-embarassing-typo-in-encode_attrs.patch b/queue-2.6.32/nfsv4-fix-an-embarassing-typo-in-encode_attrs.patch new file mode 100644 index 00000000000..426fd240c93 --- /dev/null +++ b/queue-2.6.32/nfsv4-fix-an-embarassing-typo-in-encode_attrs.patch @@ -0,0 +1,36 @@ +From d3f6baaa34c54040b3ef30950e59b54ac0624b21 Mon Sep 17 00:00:00 2001 +From: Trond Myklebust +Date: Tue, 22 Jun 2010 08:52:39 -0400 +Subject: NFSv4: Fix an embarassing typo in encode_attrs() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Trond Myklebust + +commit d3f6baaa34c54040b3ef30950e59b54ac0624b21 upstream. + +Apparently, we have never been able to set the atime correctly from the +NFSv4 client. + +Reported-by: 小倉一夫 +Signed-off-by: Trond Myklebust +Signed-off-by: Greg Kroah-Hartman + +--- + fs/nfs/nfs4xdr.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/fs/nfs/nfs4xdr.c ++++ b/fs/nfs/nfs4xdr.c +@@ -840,8 +840,8 @@ static void encode_attrs(struct xdr_stre + bmval1 |= FATTR4_WORD1_TIME_ACCESS_SET; + *p++ = cpu_to_be32(NFS4_SET_TO_CLIENT_TIME); + *p++ = cpu_to_be32(0); +- *p++ = cpu_to_be32(iap->ia_mtime.tv_sec); +- *p++ = cpu_to_be32(iap->ia_mtime.tv_nsec); ++ *p++ = cpu_to_be32(iap->ia_atime.tv_sec); ++ *p++ = cpu_to_be32(iap->ia_atime.tv_nsec); + } + else if (iap->ia_valid & ATTR_ATIME) { + bmval1 |= FATTR4_WORD1_TIME_ACCESS_SET; diff --git a/queue-2.6.32/p54pci-add-symbol-ap-300-minipci-adapters-pciid.patch b/queue-2.6.32/p54pci-add-symbol-ap-300-minipci-adapters-pciid.patch new file mode 100644 index 00000000000..0339a47cd10 --- /dev/null +++ b/queue-2.6.32/p54pci-add-symbol-ap-300-minipci-adapters-pciid.patch @@ -0,0 +1,28 @@ +From 50900f1698f68127e54c67fdfe829e4a97b1be2b Mon Sep 17 00:00:00 2001 +From: Joerg Albert +Date: Sun, 13 Jun 2010 14:22:23 +0200 +Subject: p54pci: add Symbol AP-300 minipci adapters pciid + +From: Joerg Albert + +commit 50900f1698f68127e54c67fdfe829e4a97b1be2b upstream. + +Signed-off-by: Christian Lamparter +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/p54/p54pci.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/net/wireless/p54/p54pci.c ++++ b/drivers/net/wireless/p54/p54pci.c +@@ -40,6 +40,8 @@ static struct pci_device_id p54p_table[] + { PCI_DEVICE(0x1260, 0x3877) }, + /* Intersil PRISM Javelin/Xbow Wireless LAN adapter */ + { PCI_DEVICE(0x1260, 0x3886) }, ++ /* Intersil PRISM Xbow Wireless LAN adapter (Symbol AP-300) */ ++ { PCI_DEVICE(0x1260, 0xffff) }, + { }, + }; + diff --git a/queue-2.6.32/series b/queue-2.6.32/series index 27fa7a034fd..9e5cd3c34d5 100644 --- a/queue-2.6.32/series +++ b/queue-2.6.32/series @@ -1 +1,30 @@ virtio-pci-disable-msi-at-startup.patch +ssb-handle-netbook-devices-where-the-sprom-address-is-changed.patch +hwmon-k8temp-bypass-core-swapping-on-single-core-processors.patch +hwmon-k8temp-fix-temperature-reporting-for-asb1-processor-revisions.patch +hwmon-coretemp-properly-label-the-sensors.patch +hwmon-coretemp-skip-duplicate-cpu-entries.patch +hwmon-it87-fix-in7-on-it8720f.patch +cifs-remove-bogus-first_time-check-in-ntlmv2-session-setup-code.patch +cifs-don-t-attempt-busy-file-rename-unless-it-s-in-same-directory.patch +cifs-fix-a-malicious-redirect-problem-in-the-dns-lookup-code.patch +alsa-hda-add-macbook-5-2-quirk.patch +cpmac-do-not-leak-struct-net_device-on-phy_connect-errors.patch +sky2-enable-rx-tx-in-sky2_phy_reinit.patch +igb-change-how-we-handle-alternate-mac-addresses.patch +sparc-fix-use-of-uid16_t-and-gid16_t-in-asm-stat.h.patch +math-emu-correct-test-for-downshifting-fraction-in-_fp_from_int.patch +nfsv4-fix-an-embarassing-typo-in-encode_attrs.patch +nfsv4-ensure-that-proc-self-mountinfo-displays-the-minor-version-number.patch +sunrpc-fix-a-re-entrancy-bug-in-xs_tcp_read_calldir.patch +ath5k-drop-warning-on-jumbo-frames.patch +ath9k-re-enable-ps-by-default-for-new-single-chip-families.patch +ath9k-avoid-corrupt-frames-being-forwarded-to-mac80211.patch +hostap-protect-against-initialization-interrupt.patch +tpm-readpubek-output-struct-fix.patch +fb-fix-colliding-defines-for-fb-flags.patch +iwlwifi-cancel-scan-watchdog-in-iwl_bg_abort_scan.patch +mac80211-do-not-wip-out-old-supported-rates.patch +mac80211-handle-mesh-action-frames-in-ieee80211_rx_h_action.patch +btrfs-fix-checks-in-btrfs_ioc_clone_range.patch +p54pci-add-symbol-ap-300-minipci-adapters-pciid.patch diff --git a/queue-2.6.32/sky2-enable-rx-tx-in-sky2_phy_reinit.patch b/queue-2.6.32/sky2-enable-rx-tx-in-sky2_phy_reinit.patch new file mode 100644 index 00000000000..3ce0a6567fb --- /dev/null +++ b/queue-2.6.32/sky2-enable-rx-tx-in-sky2_phy_reinit.patch @@ -0,0 +1,80 @@ +From 38000a94a902e94ca8b5498f7871c6316de8957a Mon Sep 17 00:00:00 2001 +From: Brandon Philips +Date: Wed, 16 Jun 2010 16:21:58 +0000 +Subject: sky2: enable rx/tx in sky2_phy_reinit() + +From: Brandon Philips + +commit 38000a94a902e94ca8b5498f7871c6316de8957a upstream. + +sky2_phy_reinit is called by the ethtool helpers sky2_set_settings, +sky2_nway_reset and sky2_set_pauseparam when netif_running. + +However, at the end of sky2_phy_init GM_GP_CTRL has GM_GPCR_RX_ENA and +GM_GPCR_TX_ENA cleared. So, doing these commands causes the device to +stop working: + +$ ethtool -r eth0 +$ ethtool -A eth0 autoneg off + +Fix this issue by enabling Rx/Tx after running sky2_phy_init in +sky2_phy_reinit. + +Signed-off-by: Brandon Philips +Tested-by: Brandon Philips +Cc: stable@kernel.org +Tested-by: Mike McCormack +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/sky2.c | 19 ++++++++++++++----- + 1 file changed, 14 insertions(+), 5 deletions(-) + +--- a/drivers/net/sky2.c ++++ b/drivers/net/sky2.c +@@ -704,11 +704,24 @@ static void sky2_phy_power_down(struct s + sky2_write8(hw, B2_TST_CTRL1, TST_CFG_WRITE_OFF); + } + ++/* Enable Rx/Tx */ ++static void sky2_enable_rx_tx(struct sky2_port *sky2) ++{ ++ struct sky2_hw *hw = sky2->hw; ++ unsigned port = sky2->port; ++ u16 reg; ++ ++ reg = gma_read16(hw, port, GM_GP_CTRL); ++ reg |= GM_GPCR_RX_ENA | GM_GPCR_TX_ENA; ++ gma_write16(hw, port, GM_GP_CTRL, reg); ++} ++ + /* Force a renegotiation */ + static void sky2_phy_reinit(struct sky2_port *sky2) + { + spin_lock_bh(&sky2->phy_lock); + sky2_phy_init(sky2->hw, sky2->port); ++ sky2_enable_rx_tx(sky2); + spin_unlock_bh(&sky2->phy_lock); + } + +@@ -1929,7 +1942,6 @@ static void sky2_link_up(struct sky2_por + { + struct sky2_hw *hw = sky2->hw; + unsigned port = sky2->port; +- u16 reg; + static const char *fc_name[] = { + [FC_NONE] = "none", + [FC_TX] = "tx", +@@ -1937,10 +1949,7 @@ static void sky2_link_up(struct sky2_por + [FC_BOTH] = "both", + }; + +- /* enable Rx/Tx */ +- reg = gma_read16(hw, port, GM_GP_CTRL); +- reg |= GM_GPCR_RX_ENA | GM_GPCR_TX_ENA; +- gma_write16(hw, port, GM_GP_CTRL, reg); ++ sky2_enable_rx_tx(sky2); + + gm_phy_write(hw, port, PHY_MARV_INT_MASK, PHY_M_DEF_MSK); + diff --git a/queue-2.6.32/sparc-fix-use-of-uid16_t-and-gid16_t-in-asm-stat.h.patch b/queue-2.6.32/sparc-fix-use-of-uid16_t-and-gid16_t-in-asm-stat.h.patch new file mode 100644 index 00000000000..77cbbe73d8b --- /dev/null +++ b/queue-2.6.32/sparc-fix-use-of-uid16_t-and-gid16_t-in-asm-stat.h.patch @@ -0,0 +1,30 @@ +From 7469a9acf919d36836f6c635099d8edc9be4528a Mon Sep 17 00:00:00 2001 +From: Rob Landley +Date: Sat, 27 Mar 2010 08:36:18 -0700 +Subject: sparc: Fix use of uid16_t and gid16_t in asm/stat.h + +From: Rob Landley + +commit 7469a9acf919d36836f6c635099d8edc9be4528a upstream. + +Signed-off-by: Rob Landley +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + arch/sparc/include/asm/stat.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/sparc/include/asm/stat.h ++++ b/arch/sparc/include/asm/stat.h +@@ -53,8 +53,8 @@ struct stat { + ino_t st_ino; + mode_t st_mode; + short st_nlink; +- uid16_t st_uid; +- gid16_t st_gid; ++ unsigned short st_uid; ++ unsigned short st_gid; + unsigned short st_rdev; + off_t st_size; + time_t st_atime; diff --git a/queue-2.6.32/ssb-handle-netbook-devices-where-the-sprom-address-is-changed.patch b/queue-2.6.32/ssb-handle-netbook-devices-where-the-sprom-address-is-changed.patch new file mode 100644 index 00000000000..8b58bf8ec7d --- /dev/null +++ b/queue-2.6.32/ssb-handle-netbook-devices-where-the-sprom-address-is-changed.patch @@ -0,0 +1,237 @@ +From stable-bounces@linux.kernel.org Sun Jul 11 16:26:25 2010 +From: Larry Finger +Date: Sun, 11 Jul 2010 18:26:15 -0500 +Subject: ssb: Handle Netbook devices where the SPROM address is changed +To: Greg KH +Cc: linux-stable +Message-ID: <4C3A5317.3090603@lwfinger.net> + +From: Christoph Fritz + +For some Netbook computers with Broadcom BCM4312 wireless interfaces, +the SPROM has been moved to a new location. When the ssb driver tries to +read the old location, the systems hangs when trying to read a +non-existent location. Such freezes are particularly bad as they do not +log the failure. + +This patch is modified from commit +da1fdb02d9200ff28b6f3a380d21930335fe5429 with some pieces from other +mainline changes so that it can be applied to stable 2.6.34.Y. + +Signed-off-by: Larry Finger +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ssb/driver_chipcommon.c | 3 + + drivers/ssb/driver_chipcommon_pmu.c | 17 ++++------- + drivers/ssb/pci.c | 46 ++++++++++++++++++++++++++---- + drivers/ssb/sprom.c | 15 +++++++++ + include/linux/ssb/ssb.h | 1 + include/linux/ssb/ssb_driver_chipcommon.h | 2 + + include/linux/ssb/ssb_regs.h | 3 + + 7 files changed, 70 insertions(+), 17 deletions(-) + +--- a/drivers/ssb/driver_chipcommon.c ++++ b/drivers/ssb/driver_chipcommon.c +@@ -233,6 +233,9 @@ void ssb_chipcommon_init(struct ssb_chip + { + if (!cc->dev) + return; /* We don't have a ChipCommon */ ++ if (cc->dev->id.revision >= 11) ++ cc->status = chipco_read32(cc, SSB_CHIPCO_CHIPSTAT); ++ ssb_dprintk(KERN_INFO PFX "chipcommon status is 0x%x\n", cc->status); + ssb_pmu_init(cc); + chipco_powercontrol_init(cc); + ssb_chipco_set_clockmode(cc, SSB_CLKMODE_FAST); +--- a/drivers/ssb/driver_chipcommon_pmu.c ++++ b/drivers/ssb/driver_chipcommon_pmu.c +@@ -495,9 +495,9 @@ static void ssb_pmu_resources_init(struc + chipco_write32(cc, SSB_CHIPCO_PMU_MAXRES_MSK, max_msk); + } + ++/* http://bcm-v4.sipsolutions.net/802.11/SSB/PmuInit */ + void ssb_pmu_init(struct ssb_chipcommon *cc) + { +- struct ssb_bus *bus = cc->dev->bus; + u32 pmucap; + + if (!(cc->capabilities & SSB_CHIPCO_CAP_PMU)) +@@ -509,15 +509,12 @@ void ssb_pmu_init(struct ssb_chipcommon + ssb_dprintk(KERN_DEBUG PFX "Found rev %u PMU (capabilities 0x%08X)\n", + cc->pmu.rev, pmucap); + +- if (cc->pmu.rev >= 1) { +- if ((bus->chip_id == 0x4325) && (bus->chip_rev < 2)) { +- chipco_mask32(cc, SSB_CHIPCO_PMU_CTL, +- ~SSB_CHIPCO_PMU_CTL_NOILPONW); +- } else { +- chipco_set32(cc, SSB_CHIPCO_PMU_CTL, +- SSB_CHIPCO_PMU_CTL_NOILPONW); +- } +- } ++ if (cc->pmu.rev == 1) ++ chipco_mask32(cc, SSB_CHIPCO_PMU_CTL, ++ ~SSB_CHIPCO_PMU_CTL_NOILPONW); ++ else ++ chipco_set32(cc, SSB_CHIPCO_PMU_CTL, ++ SSB_CHIPCO_PMU_CTL_NOILPONW); + ssb_pmu_pll_init(cc); + ssb_pmu_resources_init(cc); + } +--- a/drivers/ssb/pci.c ++++ b/drivers/ssb/pci.c +@@ -22,6 +22,7 @@ + + #include "ssb_private.h" + ++bool ssb_is_sprom_available(struct ssb_bus *bus); + + /* Define the following to 1 to enable a printk on each coreswitch. */ + #define SSB_VERBOSE_PCICORESWITCH_DEBUG 0 +@@ -167,7 +168,7 @@ err_pci: + } + + /* Get the word-offset for a SSB_SPROM_XXX define. */ +-#define SPOFF(offset) (((offset) - SSB_SPROM_BASE) / sizeof(u16)) ++#define SPOFF(offset) ((offset) / sizeof(u16)) + /* Helper to extract some _offset, which is one of the SSB_SPROM_XXX defines. */ + #define SPEX16(_outvar, _offset, _mask, _shift) \ + out->_outvar = ((in[SPOFF(_offset)] & (_mask)) >> (_shift)) +@@ -252,8 +253,13 @@ static int sprom_do_read(struct ssb_bus + { + int i; + ++ /* Check if SPROM can be read */ ++ if (ioread16(bus->mmio + bus->sprom_offset) == 0xFFFF) { ++ ssb_printk(KERN_ERR PFX "Unable to read SPROM\n"); ++ return -ENODEV; ++ } + for (i = 0; i < bus->sprom_size; i++) +- sprom[i] = ioread16(bus->mmio + SSB_SPROM_BASE + (i * 2)); ++ sprom[i] = ioread16(bus->mmio + bus->sprom_offset + (i * 2)); + + return 0; + } +@@ -284,7 +290,7 @@ static int sprom_do_write(struct ssb_bus + ssb_printk("75%%"); + else if (i % 2) + ssb_printk("."); +- writew(sprom[i], bus->mmio + SSB_SPROM_BASE + (i * 2)); ++ writew(sprom[i], bus->mmio + bus->sprom_offset + (i * 2)); + mmiowb(); + msleep(20); + } +@@ -620,21 +626,49 @@ static int ssb_pci_sprom_get(struct ssb_ + int err = -ENOMEM; + u16 *buf; + ++ if (!ssb_is_sprom_available(bus)) { ++ ssb_printk(KERN_ERR PFX "No SPROM available!\n"); ++ return -ENODEV; ++ } ++ if (bus->chipco.dev) { /* can be unavailible! */ ++ /* ++ * get SPROM offset: SSB_SPROM_BASE1 except for ++ * chipcommon rev >= 31 or chip ID is 0x4312 and ++ * chipcommon status & 3 == 2 ++ */ ++ if (bus->chipco.dev->id.revision >= 31) ++ bus->sprom_offset = SSB_SPROM_BASE31; ++ else if (bus->chip_id == 0x4312 && ++ (bus->chipco.status & 0x03) == 2) ++ bus->sprom_offset = SSB_SPROM_BASE31; ++ else ++ bus->sprom_offset = SSB_SPROM_BASE1; ++ } else { ++ bus->sprom_offset = SSB_SPROM_BASE1; ++ } ++ ssb_dprintk(KERN_INFO PFX "SPROM offset is 0x%x\n", bus->sprom_offset); ++ + buf = kcalloc(SSB_SPROMSIZE_WORDS_R123, sizeof(u16), GFP_KERNEL); + if (!buf) + goto out; + bus->sprom_size = SSB_SPROMSIZE_WORDS_R123; +- sprom_do_read(bus, buf); ++ err = sprom_do_read(bus, buf); ++ if (err) ++ goto out_free; + err = sprom_check_crc(buf, bus->sprom_size); + if (err) { + /* try for a 440 byte SPROM - revision 4 and higher */ + kfree(buf); + buf = kcalloc(SSB_SPROMSIZE_WORDS_R4, sizeof(u16), + GFP_KERNEL); +- if (!buf) ++ if (!buf) { ++ err = -ENOMEM; + goto out; ++ } + bus->sprom_size = SSB_SPROMSIZE_WORDS_R4; +- sprom_do_read(bus, buf); ++ err = sprom_do_read(bus, buf); ++ if (err) ++ goto out_free; + err = sprom_check_crc(buf, bus->sprom_size); + if (err) { + /* All CRC attempts failed. +--- a/drivers/ssb/sprom.c ++++ b/drivers/ssb/sprom.c +@@ -179,3 +179,18 @@ const struct ssb_sprom *ssb_get_fallback + { + return fallback_sprom; + } ++ ++/* http://bcm-v4.sipsolutions.net/802.11/IsSpromAvailable */ ++bool ssb_is_sprom_available(struct ssb_bus *bus) ++{ ++ /* status register only exists on chipcomon rev >= 11 and we need check ++ for >= 31 only */ ++ /* this routine differs from specs as we do not access SPROM directly ++ on PCMCIA */ ++ if (bus->bustype == SSB_BUSTYPE_PCI && ++ bus->chipco.dev && /* can be unavailible! */ ++ bus->chipco.dev->id.revision >= 31) ++ return bus->chipco.capabilities & SSB_CHIPCO_CAP_SPROM; ++ ++ return true; ++} +--- a/include/linux/ssb/ssb.h ++++ b/include/linux/ssb/ssb.h +@@ -302,6 +302,7 @@ struct ssb_bus { + u16 chip_id; + u16 chip_rev; + u16 sprom_size; /* number of words in sprom */ ++ u16 sprom_offset; + u8 chip_package; + + /* List of devices (cores) on the backplane. */ +--- a/include/linux/ssb/ssb_driver_chipcommon.h ++++ b/include/linux/ssb/ssb_driver_chipcommon.h +@@ -46,6 +46,7 @@ + #define SSB_PLLTYPE_7 0x00038000 /* 25Mhz, 4 dividers */ + #define SSB_CHIPCO_CAP_PCTL 0x00040000 /* Power Control */ + #define SSB_CHIPCO_CAP_OTPS 0x00380000 /* OTP size */ ++#define SSB_CHIPCO_CAP_SPROM 0x40000000 /* SPROM present */ + #define SSB_CHIPCO_CAP_OTPS_SHIFT 19 + #define SSB_CHIPCO_CAP_OTPS_BASE 5 + #define SSB_CHIPCO_CAP_JTAGM 0x00400000 /* JTAG master present */ +@@ -564,6 +565,7 @@ struct ssb_chipcommon_pmu { + struct ssb_chipcommon { + struct ssb_device *dev; + u32 capabilities; ++ u32 status; + /* Fast Powerup Delay constant */ + u16 fast_pwrup_delay; + struct ssb_chipcommon_pmu pmu; +--- a/include/linux/ssb/ssb_regs.h ++++ b/include/linux/ssb/ssb_regs.h +@@ -170,7 +170,8 @@ + #define SSB_SPROMSIZE_WORDS_R4 220 + #define SSB_SPROMSIZE_BYTES_R123 (SSB_SPROMSIZE_WORDS_R123 * sizeof(u16)) + #define SSB_SPROMSIZE_BYTES_R4 (SSB_SPROMSIZE_WORDS_R4 * sizeof(u16)) +-#define SSB_SPROM_BASE 0x1000 ++#define SSB_SPROM_BASE1 0x1000 ++#define SSB_SPROM_BASE31 0x0800 + #define SSB_SPROM_REVISION 0x107E + #define SSB_SPROM_REVISION_REV 0x00FF /* SPROM Revision number */ + #define SSB_SPROM_REVISION_CRC 0xFF00 /* SPROM CRC8 value */ diff --git a/queue-2.6.32/sunrpc-fix-a-re-entrancy-bug-in-xs_tcp_read_calldir.patch b/queue-2.6.32/sunrpc-fix-a-re-entrancy-bug-in-xs_tcp_read_calldir.patch new file mode 100644 index 00000000000..cecc14014d9 --- /dev/null +++ b/queue-2.6.32/sunrpc-fix-a-re-entrancy-bug-in-xs_tcp_read_calldir.patch @@ -0,0 +1,103 @@ +From b76ce56192bcf618013fb9aecd83488cffd645cc Mon Sep 17 00:00:00 2001 +From: Trond Myklebust +Date: Wed, 16 Jun 2010 13:57:32 -0400 +Subject: SUNRPC: Fix a re-entrancy bug in xs_tcp_read_calldir() + +From: Trond Myklebust + +commit b76ce56192bcf618013fb9aecd83488cffd645cc upstream. + +If the attempt to read the calldir fails, then instead of storing the read +bytes, we currently discard them. This leads to a garbage final result when +upon re-entry to the same routine, we read the remaining bytes. + +Fixes the regression in bugzilla number 16213. Please see + https://bugzilla.kernel.org/show_bug.cgi?id=16213 + +Signed-off-by: Trond Myklebust +Signed-off-by: Greg Kroah-Hartman + +--- + net/sunrpc/xprtsock.c | 38 ++++++++++++++++++++++---------------- + 1 file changed, 22 insertions(+), 16 deletions(-) + +--- a/net/sunrpc/xprtsock.c ++++ b/net/sunrpc/xprtsock.c +@@ -238,7 +238,8 @@ struct sock_xprt { + * State of TCP reply receive + */ + __be32 tcp_fraghdr, +- tcp_xid; ++ tcp_xid, ++ tcp_calldir; + + u32 tcp_offset, + tcp_reclen; +@@ -961,7 +962,7 @@ static inline void xs_tcp_read_calldir(s + { + size_t len, used; + u32 offset; +- __be32 calldir; ++ char *p; + + /* + * We want transport->tcp_offset to be 8 at the end of this routine +@@ -970,26 +971,33 @@ static inline void xs_tcp_read_calldir(s + * transport->tcp_offset is 4 (after having already read the xid). + */ + offset = transport->tcp_offset - sizeof(transport->tcp_xid); +- len = sizeof(calldir) - offset; ++ len = sizeof(transport->tcp_calldir) - offset; + dprintk("RPC: reading CALL/REPLY flag (%Zu bytes)\n", len); +- used = xdr_skb_read_bits(desc, &calldir, len); ++ p = ((char *) &transport->tcp_calldir) + offset; ++ used = xdr_skb_read_bits(desc, p, len); + transport->tcp_offset += used; + if (used != len) + return; + transport->tcp_flags &= ~TCP_RCV_READ_CALLDIR; +- transport->tcp_flags |= TCP_RCV_COPY_CALLDIR; +- transport->tcp_flags |= TCP_RCV_COPY_DATA; + /* + * We don't yet have the XDR buffer, so we will write the calldir + * out after we get the buffer from the 'struct rpc_rqst' + */ +- if (ntohl(calldir) == RPC_REPLY) ++ switch (ntohl(transport->tcp_calldir)) { ++ case RPC_REPLY: ++ transport->tcp_flags |= TCP_RCV_COPY_CALLDIR; ++ transport->tcp_flags |= TCP_RCV_COPY_DATA; + transport->tcp_flags |= TCP_RPC_REPLY; +- else ++ break; ++ case RPC_CALL: ++ transport->tcp_flags |= TCP_RCV_COPY_CALLDIR; ++ transport->tcp_flags |= TCP_RCV_COPY_DATA; + transport->tcp_flags &= ~TCP_RPC_REPLY; +- dprintk("RPC: reading %s CALL/REPLY flag %08x\n", +- (transport->tcp_flags & TCP_RPC_REPLY) ? +- "reply for" : "request with", calldir); ++ break; ++ default: ++ dprintk("RPC: invalid request message type\n"); ++ xprt_force_disconnect(&transport->xprt); ++ } + xs_tcp_check_fraghdr(transport); + } + +@@ -1009,12 +1017,10 @@ static inline void xs_tcp_read_common(st + /* + * Save the RPC direction in the XDR buffer + */ +- __be32 calldir = transport->tcp_flags & TCP_RPC_REPLY ? +- htonl(RPC_REPLY) : 0; +- + memcpy(rcvbuf->head[0].iov_base + transport->tcp_copied, +- &calldir, sizeof(calldir)); +- transport->tcp_copied += sizeof(calldir); ++ &transport->tcp_calldir, ++ sizeof(transport->tcp_calldir)); ++ transport->tcp_copied += sizeof(transport->tcp_calldir); + transport->tcp_flags &= ~TCP_RCV_COPY_CALLDIR; + } + diff --git a/queue-2.6.32/tpm-readpubek-output-struct-fix.patch b/queue-2.6.32/tpm-readpubek-output-struct-fix.patch new file mode 100644 index 00000000000..883927d0d69 --- /dev/null +++ b/queue-2.6.32/tpm-readpubek-output-struct-fix.patch @@ -0,0 +1,34 @@ +From 02a077c52ef7631275a79862ffd9f3dbe9d38bc2 Mon Sep 17 00:00:00 2001 +From: Rajiv Andrade +Date: Mon, 14 Jun 2010 13:58:22 -0300 +Subject: TPM: ReadPubEK output struct fix + +From: Rajiv Andrade + +commit 02a077c52ef7631275a79862ffd9f3dbe9d38bc2 upstream. + +This patch adds a missing element of the ReadPubEK command output, +that prevents future overflow of this buffer when copying the +TPM output result into it. + +Prevents a kernel panic in case the user tries to read the +pubek from sysfs. + +Signed-off-by: Rajiv Andrade +Signed-off-by: James Morris +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/char/tpm/tpm.h | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/char/tpm/tpm.h ++++ b/drivers/char/tpm/tpm.h +@@ -224,6 +224,7 @@ struct tpm_readpubek_params_out { + u8 algorithm[4]; + u8 encscheme[2]; + u8 sigscheme[2]; ++ __be32 paramsize; + u8 parameters[12]; /*assuming RSA*/ + __be32 keysize; + u8 modulus[256];