From: Greg Kroah-Hartman Date: Wed, 16 Dec 2009 00:06:30 +0000 (-0800) Subject: some .31 patches X-Git-Tag: v2.6.27.42~19 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=bbe71ee89f746c86755362f916fc21d43d25570c;p=thirdparty%2Fkernel%2Fstable-queue.git some .31 patches --- diff --git a/queue-2.6.31/alsa-hda-terradici-hda-controllers-does-not-support-64-bit-mode.patch b/queue-2.6.31/alsa-hda-terradici-hda-controllers-does-not-support-64-bit-mode.patch new file mode 100644 index 00000000000..6358e01a518 --- /dev/null +++ b/queue-2.6.31/alsa-hda-terradici-hda-controllers-does-not-support-64-bit-mode.patch @@ -0,0 +1,33 @@ +From 396087eaead95fcb29eb36f1e59517aeb58c545e Mon Sep 17 00:00:00 2001 +From: Jaroslav Kysela +Date: Wed, 9 Dec 2009 10:44:47 +0100 +Subject: ALSA: hda - Terradici HDA controllers does not support 64-bit mode + +From: Jaroslav Kysela + +commit 396087eaead95fcb29eb36f1e59517aeb58c545e upstream. + +Confirmed from vendor and tests in RedHat bugzilla #536782 . + +Signed-off-by: Jaroslav Kysela +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/hda_intel.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/sound/pci/hda/hda_intel.c ++++ b/sound/pci/hda/hda_intel.c +@@ -2392,6 +2392,11 @@ static int __devinit azx_create(struct s + } + } + ++ /* disable 64bit DMA address for Teradici */ ++ /* it does not work with device 6549:1200 subsys e4a2:040b */ ++ if (chip->driver_type == AZX_DRIVER_TERA) ++ gcap &= ~ICH6_GCAP_64OK; ++ + /* allow 64bit DMA address if supported by H/W */ + if ((gcap & ICH6_GCAP_64OK) && !pci_set_dma_mask(pci, DMA_BIT_MASK(64))) + pci_set_consistent_dma_mask(pci, DMA_BIT_MASK(64)); diff --git a/queue-2.6.31/alsa-hrtimer-fix-lock-up.patch b/queue-2.6.31/alsa-hrtimer-fix-lock-up.patch new file mode 100644 index 00000000000..a0276aee161 --- /dev/null +++ b/queue-2.6.31/alsa-hrtimer-fix-lock-up.patch @@ -0,0 +1,78 @@ +From fcfdebe70759c74e2e701f69aaa7f0e5e32cf5a6 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Fri, 11 Dec 2009 12:51:05 +0100 +Subject: ALSA: hrtimer - Fix lock-up + +From: Takashi Iwai + +commit fcfdebe70759c74e2e701f69aaa7f0e5e32cf5a6 upstream. + +The timer stop callback can be called from snd_timer_interrupt(), which +is called from the hrtimer callback. Since hrtimer_cancel() waits for +the callback completion, this eventually results in a lock-up. + +This patch fixes the problem by just toggling a flag at stop callback +and call hrtimer_cancel() later. + +Reported-and-tested-by: Wojtek Zabolotny +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/core/hrtimer.c | 15 +++++++++++++-- + 1 file changed, 13 insertions(+), 2 deletions(-) + +--- a/sound/core/hrtimer.c ++++ b/sound/core/hrtimer.c +@@ -37,14 +37,22 @@ static unsigned int resolution; + struct snd_hrtimer { + struct snd_timer *timer; + struct hrtimer hrt; ++ atomic_t running; + }; + + static enum hrtimer_restart snd_hrtimer_callback(struct hrtimer *hrt) + { + struct snd_hrtimer *stime = container_of(hrt, struct snd_hrtimer, hrt); + struct snd_timer *t = stime->timer; ++ ++ if (!atomic_read(&stime->running)) ++ return HRTIMER_NORESTART; ++ + hrtimer_forward_now(hrt, ns_to_ktime(t->sticks * resolution)); + snd_timer_interrupt(stime->timer, t->sticks); ++ ++ if (!atomic_read(&stime->running)) ++ return HRTIMER_NORESTART; + return HRTIMER_RESTART; + } + +@@ -58,6 +66,7 @@ static int snd_hrtimer_open(struct snd_t + hrtimer_init(&stime->hrt, CLOCK_MONOTONIC, HRTIMER_MODE_REL); + stime->timer = t; + stime->hrt.function = snd_hrtimer_callback; ++ atomic_set(&stime->running, 0); + t->private_data = stime; + return 0; + } +@@ -78,16 +87,18 @@ static int snd_hrtimer_start(struct snd_ + { + struct snd_hrtimer *stime = t->private_data; + ++ atomic_set(&stime->running, 0); ++ hrtimer_cancel(&stime->hrt); + hrtimer_start(&stime->hrt, ns_to_ktime(t->sticks * resolution), + HRTIMER_MODE_REL); ++ atomic_set(&stime->running, 1); + return 0; + } + + static int snd_hrtimer_stop(struct snd_timer *t) + { + struct snd_hrtimer *stime = t->private_data; +- +- hrtimer_cancel(&stime->hrt); ++ atomic_set(&stime->running, 0); + return 0; + } + diff --git a/queue-2.6.31/ath5k-allow-setting-txpower-to-0.patch b/queue-2.6.31/ath5k-allow-setting-txpower-to-0.patch new file mode 100644 index 00000000000..e0fd2ac8fbf --- /dev/null +++ b/queue-2.6.31/ath5k-allow-setting-txpower-to-0.patch @@ -0,0 +1,37 @@ +From 2eb2fa67e5462a36e98172fb92c78bc405b3035f Mon Sep 17 00:00:00 2001 +From: Bob Copeland +Date: Mon, 16 Nov 2009 08:30:29 -0500 +Subject: ath5k: allow setting txpower to 0 + +From: Bob Copeland + +commit 2eb2fa67e5462a36e98172fb92c78bc405b3035f upstream. + +As a holdover from earlier code when we used to set +the power limit to '0' after a reset to configure the +default transmit power, ath5k interprets txpower=0 as +12.5 dBm. Fix that by just passing 0 through. + +This fixes http://bugzilla.kernel.org/show_bug.cgi?id=14567 + +Reported-by: Daniel Folkers +Tested-by: Daniel Folkers +Signed-off-by: Bob Copeland +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/ath/ath5k/phy.c | 2 -- + 1 file changed, 2 deletions(-) + +--- a/drivers/net/wireless/ath/ath5k/phy.c ++++ b/drivers/net/wireless/ath/ath5k/phy.c +@@ -2931,8 +2931,6 @@ ath5k_hw_txpower(struct ath5k_hw *ah, st + ATH5K_ERR(ah->ah_sc, "invalid tx power: %u\n", txpower); + return -EINVAL; + } +- if (txpower == 0) +- txpower = AR5K_TUNE_DEFAULT_TXPOWER; + + /* Reset TX power values */ + memset(&ah->ah_txpower, 0, sizeof(ah->ah_txpower)); diff --git a/queue-2.6.31/ath5k-enable-eeprom-checksum-check.patch b/queue-2.6.31/ath5k-enable-eeprom-checksum-check.patch new file mode 100644 index 00000000000..8fc477d186e --- /dev/null +++ b/queue-2.6.31/ath5k-enable-eeprom-checksum-check.patch @@ -0,0 +1,64 @@ +From 512414b0bed0d376ac4d5ec1dd6f0b1a3551febc Mon Sep 17 00:00:00 2001 +From: Luis R. Rodriguez +Date: Wed, 25 Nov 2009 17:23:26 -0500 +Subject: ath5k: enable EEPROM checksum check + +From: Luis R. Rodriguez + +commit 512414b0bed0d376ac4d5ec1dd6f0b1a3551febc upstream. + +Without this we have no gaurantee of the integrity of the +EEPROM and are likely to encounter a lot of bogus bug reports +due to actual issues on the EEPROM. With the EEPROM checksum +check in place we can easily rule those issues out. + +If you run patch during a revert *you* have a card with a busted +EEPROM and only older kernel will support that concoction. This +patch is a trade off between not accepitng bogus EEPROMs and +avoiding bogus bug reports allowing developers to focus instead +on real concrete issues. + +If stable keeps bogus bug reports because of a possibly busted EEPROM +feel free to apply this there too. + +Tested on an AR5414 + +Cc: jirislaby@gmail.com +Cc: akpm@linux-foundation.org +Cc: rjw@sisk.pl +Cc: me@bobcopeland.com +Cc: david.quan@atheros.com +Signed-off-by: Luis R. Rodriguez +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/ath/ath5k/eeprom.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/drivers/net/wireless/ath/ath5k/eeprom.c ++++ b/drivers/net/wireless/ath/ath5k/eeprom.c +@@ -97,6 +97,7 @@ ath5k_eeprom_init_header(struct ath5k_hw + struct ath5k_eeprom_info *ee = &ah->ah_capabilities.cap_eeprom; + int ret; + u16 val; ++ u32 cksum, offset; + + /* + * Read values from EEPROM and store them in the capability structure +@@ -111,7 +112,6 @@ ath5k_eeprom_init_header(struct ath5k_hw + if (ah->ah_ee_version < AR5K_EEPROM_VERSION_3_0) + return 0; + +-#ifdef notyet + /* + * Validate the checksum of the EEPROM date. There are some + * devices with invalid EEPROMs. +@@ -124,7 +124,6 @@ ath5k_eeprom_init_header(struct ath5k_hw + ATH5K_ERR(ah->ah_sc, "Invalid EEPROM checksum 0x%04x\n", cksum); + return -EIO; + } +-#endif + + AR5K_EEPROM_READ_HDR(AR5K_EEPROM_ANT_GAIN(ah->ah_ee_version), + ee_ant_gain); diff --git a/queue-2.6.31/bsdacct-fix-uid-gid-misreporting.patch b/queue-2.6.31/bsdacct-fix-uid-gid-misreporting.patch new file mode 100644 index 00000000000..98628d8ed85 --- /dev/null +++ b/queue-2.6.31/bsdacct-fix-uid-gid-misreporting.patch @@ -0,0 +1,43 @@ +From 4b731d50ff3df6b9141a6c12b088e8eb0109e83c Mon Sep 17 00:00:00 2001 +From: Alexey Dobriyan +Date: Mon, 14 Dec 2009 17:57:34 -0800 +Subject: bsdacct: fix uid/gid misreporting + +From: Alexey Dobriyan + +commit 4b731d50ff3df6b9141a6c12b088e8eb0109e83c upstream. + +commit d8e180dcd5bbbab9cd3ff2e779efcf70692ef541 "bsdacct: switch +credentials for writing to the accounting file" introduced credential +switching during final acct data collecting. However, uid/gid pair +continued to be collected from current which became credentials of who +created acct file, not who exits. + +Addresses http://bugzilla.kernel.org/show_bug.cgi?id=14676 + +Signed-off-by: Alexey Dobriyan +Reported-by: Juho K. Juopperi +Acked-by: Serge Hallyn +Acked-by: David Howells +Reviewed-by: Michal Schmidt +Cc: James Morris +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/acct.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/kernel/acct.c ++++ b/kernel/acct.c +@@ -536,7 +536,8 @@ static void do_acct_process(struct bsd_a + do_div(elapsed, AHZ); + ac.ac_btime = get_seconds() - elapsed; + /* we really need to bite the bullet and change layout */ +- current_uid_gid(&ac.ac_uid, &ac.ac_gid); ++ ac.ac_uid = orig_cred->uid; ++ ac.ac_gid = orig_cred->gid; + #if ACCT_VERSION==2 + ac.ac_ahz = AHZ; + #endif diff --git a/queue-2.6.31/debugfs-fix-create-mutex-racy-fops-and-private-data.patch b/queue-2.6.31/debugfs-fix-create-mutex-racy-fops-and-private-data.patch new file mode 100644 index 00000000000..583e8f42cdf --- /dev/null +++ b/queue-2.6.31/debugfs-fix-create-mutex-racy-fops-and-private-data.patch @@ -0,0 +1,169 @@ +From d3a3b0adad0865c12e39b712ca89efbd0a3a0dbc Mon Sep 17 00:00:00 2001 +From: Mathieu Desnoyers +Date: Tue, 17 Nov 2009 14:40:26 -0800 +Subject: debugfs: fix create mutex racy fops and private data + +From: Mathieu Desnoyers + +commit d3a3b0adad0865c12e39b712ca89efbd0a3a0dbc upstream. + +Setting fops and private data outside of the mutex at debugfs file +creation introduces a race where the files can be opened with the wrong +file operations and private data. It is easy to trigger with a process +waiting on file creation notification. + +Signed-off-by: Mathieu Desnoyers +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman + +--- + fs/debugfs/inode.c | 55 ++++++++++++++++++++++++++++++----------------------- + 1 file changed, 32 insertions(+), 23 deletions(-) + +--- a/fs/debugfs/inode.c ++++ b/fs/debugfs/inode.c +@@ -32,7 +32,9 @@ static struct vfsmount *debugfs_mount; + static int debugfs_mount_count; + static bool debugfs_registered; + +-static struct inode *debugfs_get_inode(struct super_block *sb, int mode, dev_t dev) ++static struct inode *debugfs_get_inode(struct super_block *sb, int mode, dev_t dev, ++ void *data, const struct file_operations *fops) ++ + { + struct inode *inode = new_inode(sb); + +@@ -44,14 +46,18 @@ static struct inode *debugfs_get_inode(s + init_special_inode(inode, mode, dev); + break; + case S_IFREG: +- inode->i_fop = &debugfs_file_operations; ++ inode->i_fop = fops ? fops : &debugfs_file_operations; ++ inode->i_private = data; + break; + case S_IFLNK: + inode->i_op = &debugfs_link_operations; ++ inode->i_fop = fops; ++ inode->i_private = data; + break; + case S_IFDIR: + inode->i_op = &simple_dir_inode_operations; +- inode->i_fop = &simple_dir_operations; ++ inode->i_fop = fops ? fops : &simple_dir_operations; ++ inode->i_private = data; + + /* directory inodes start off with i_nlink == 2 + * (for "." entry) */ +@@ -64,7 +70,8 @@ static struct inode *debugfs_get_inode(s + + /* SMP-safe */ + static int debugfs_mknod(struct inode *dir, struct dentry *dentry, +- int mode, dev_t dev) ++ int mode, dev_t dev, void *data, ++ const struct file_operations *fops) + { + struct inode *inode; + int error = -EPERM; +@@ -72,7 +79,7 @@ static int debugfs_mknod(struct inode *d + if (dentry->d_inode) + return -EEXIST; + +- inode = debugfs_get_inode(dir->i_sb, mode, dev); ++ inode = debugfs_get_inode(dir->i_sb, mode, dev, data, fops); + if (inode) { + d_instantiate(dentry, inode); + dget(dentry); +@@ -81,12 +88,13 @@ static int debugfs_mknod(struct inode *d + return error; + } + +-static int debugfs_mkdir(struct inode *dir, struct dentry *dentry, int mode) ++static int debugfs_mkdir(struct inode *dir, struct dentry *dentry, int mode, ++ void *data, const struct file_operations *fops) + { + int res; + + mode = (mode & (S_IRWXUGO | S_ISVTX)) | S_IFDIR; +- res = debugfs_mknod(dir, dentry, mode, 0); ++ res = debugfs_mknod(dir, dentry, mode, 0, data, fops); + if (!res) { + inc_nlink(dir); + fsnotify_mkdir(dir, dentry); +@@ -94,18 +102,20 @@ static int debugfs_mkdir(struct inode *d + return res; + } + +-static int debugfs_link(struct inode *dir, struct dentry *dentry, int mode) ++static int debugfs_link(struct inode *dir, struct dentry *dentry, int mode, ++ void *data, const struct file_operations *fops) + { + mode = (mode & S_IALLUGO) | S_IFLNK; +- return debugfs_mknod(dir, dentry, mode, 0); ++ return debugfs_mknod(dir, dentry, mode, 0, data, fops); + } + +-static int debugfs_create(struct inode *dir, struct dentry *dentry, int mode) ++static int debugfs_create(struct inode *dir, struct dentry *dentry, int mode, ++ void *data, const struct file_operations *fops) + { + int res; + + mode = (mode & S_IALLUGO) | S_IFREG; +- res = debugfs_mknod(dir, dentry, mode, 0); ++ res = debugfs_mknod(dir, dentry, mode, 0, data, fops); + if (!res) + fsnotify_create(dir, dentry); + return res; +@@ -139,7 +149,9 @@ static struct file_system_type debug_fs_ + + static int debugfs_create_by_name(const char *name, mode_t mode, + struct dentry *parent, +- struct dentry **dentry) ++ struct dentry **dentry, ++ void *data, ++ const struct file_operations *fops) + { + int error = 0; + +@@ -164,13 +176,16 @@ static int debugfs_create_by_name(const + if (!IS_ERR(*dentry)) { + switch (mode & S_IFMT) { + case S_IFDIR: +- error = debugfs_mkdir(parent->d_inode, *dentry, mode); ++ error = debugfs_mkdir(parent->d_inode, *dentry, mode, ++ data, fops); + break; + case S_IFLNK: +- error = debugfs_link(parent->d_inode, *dentry, mode); ++ error = debugfs_link(parent->d_inode, *dentry, mode, ++ data, fops); + break; + default: +- error = debugfs_create(parent->d_inode, *dentry, mode); ++ error = debugfs_create(parent->d_inode, *dentry, mode, ++ data, fops); + break; + } + dput(*dentry); +@@ -221,19 +236,13 @@ struct dentry *debugfs_create_file(const + if (error) + goto exit; + +- error = debugfs_create_by_name(name, mode, parent, &dentry); ++ error = debugfs_create_by_name(name, mode, parent, &dentry, ++ data, fops); + if (error) { + dentry = NULL; + simple_release_fs(&debugfs_mount, &debugfs_mount_count); + goto exit; + } +- +- if (dentry->d_inode) { +- if (data) +- dentry->d_inode->i_private = data; +- if (fops) +- dentry->d_inode->i_fop = fops; +- } + exit: + return dentry; + } diff --git a/queue-2.6.31/devpts_get_tty-should-validate-inode.patch b/queue-2.6.31/devpts_get_tty-should-validate-inode.patch new file mode 100644 index 00000000000..cc3de01f8c3 --- /dev/null +++ b/queue-2.6.31/devpts_get_tty-should-validate-inode.patch @@ -0,0 +1,116 @@ +From edfacdd6f81119b9005615593f2cbd94b8c7e2d8 Mon Sep 17 00:00:00 2001 +From: Sukadev Bhattiprolu +Date: Tue, 17 Nov 2009 18:35:43 -0800 +Subject: devpts_get_tty() should validate inode + +From: Sukadev Bhattiprolu + +commit edfacdd6f81119b9005615593f2cbd94b8c7e2d8 upstream. + +devpts_get_tty() assumes that the inode passed in is associated with a valid +pty. But if the only reference to the pty is via a bind-mount, the inode +passed to devpts_get_tty() while valid, would refer to a pty that no longer +exists. + +With a lot of debug effort, Grzegorz Nosek developed a small program (see +below) to reproduce a crash on recent kernels. This crash is a regression +introduced by the commit: + + commit 527b3e4773628b30d03323a2cb5fb0d84441990f + Author: Sukadev Bhattiprolu + Date: Mon Oct 13 10:43:08 2008 +0100 + +To fix, ensure that the dentry associated with the inode has not yet been +deleted/unhashed by devpts_pty_kill(). + +See also: +https://lists.linux-foundation.org/pipermail/containers/2009-July/019273.html + +tty-bug.c: + +#define _GNU_SOURCE +#include +#include +#include +#include +#include +#include +#include + +#include + +void dummy(int sig) +{ +} + +static int child(void *unused) +{ + int fd; + + signal(SIGINT, dummy); signal(SIGHUP, dummy); + pause(); /* cheesy synchronisation to wait for /dev/pts/0 to appear */ + + mount("/dev/pts/0", "/dev/console", NULL, MS_BIND, NULL); + sleep(2); + + fd = open("/dev/console", O_RDWR); + dup(0); dup(0); + write(1, "Hello world!\n", sizeof("Hello world!\n")-1); + return 0; +} + +int main(void) +{ + pid_t pid; + char *stack; + + stack = malloc(16384); + pid = clone(child, stack+16384, CLONE_NEWNS|SIGCHLD, NULL); + + open("/dev/ptmx", O_RDWR|O_NOCTTY|O_NONBLOCK); + + unlockpt(fd); grantpt(fd); + + sleep(2); + kill(pid, SIGHUP); + sleep(1); + return 0; /* exit before child opens /dev/console */ +} + +Reported-by: Grzegorz Nosek +Signed-off-by: Sukadev Bhattiprolu +Tested-by: Serge Hallyn +Signed-off-by: Greg Kroah-Hartman + +--- + fs/devpts/inode.c | 16 ++++++++++++++-- + 1 file changed, 14 insertions(+), 2 deletions(-) + +--- a/fs/devpts/inode.c ++++ b/fs/devpts/inode.c +@@ -518,11 +518,23 @@ int devpts_pty_new(struct inode *ptmx_in + + struct tty_struct *devpts_get_tty(struct inode *pts_inode, int number) + { ++ struct dentry *dentry; ++ struct tty_struct *tty; ++ + BUG_ON(pts_inode->i_rdev == MKDEV(TTYAUX_MAJOR, PTMX_MINOR)); + ++ /* Ensure dentry has not been deleted by devpts_pty_kill() */ ++ dentry = d_find_alias(pts_inode); ++ if (!dentry) ++ return NULL; ++ ++ tty = NULL; + if (pts_inode->i_sb->s_magic == DEVPTS_SUPER_MAGIC) +- return (struct tty_struct *)pts_inode->i_private; +- return NULL; ++ tty = (struct tty_struct *)pts_inode->i_private; ++ ++ dput(dentry); ++ ++ return tty; + } + + void devpts_pty_kill(struct tty_struct *tty) diff --git a/queue-2.6.31/futex-take-mmap_sem-for-get_user_pages-in-fault_in_user_writeable.patch b/queue-2.6.31/futex-take-mmap_sem-for-get_user_pages-in-fault_in_user_writeable.patch new file mode 100644 index 00000000000..f41088f1769 --- /dev/null +++ b/queue-2.6.31/futex-take-mmap_sem-for-get_user_pages-in-fault_in_user_writeable.patch @@ -0,0 +1,43 @@ +From 722d0172377a5697919b9f7e5beb95165b1dec4e Mon Sep 17 00:00:00 2001 +From: Andi Kleen +Date: Tue, 8 Dec 2009 13:19:42 +0100 +Subject: futex: Take mmap_sem for get_user_pages in fault_in_user_writeable + +From: Andi Kleen + +commit 722d0172377a5697919b9f7e5beb95165b1dec4e upstream. + +get_user_pages() must be called with mmap_sem held. + +Signed-off-by: Andi Kleen +Cc: Andrew Morton +Cc: Nick Piggin +Cc: Darren Hart +Cc: Peter Zijlstra +LKML-Reference: <20091208121942.GA21298@basil.fritz.box> +Signed-off-by: Thomas Gleixner +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/futex.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +--- a/kernel/futex.c ++++ b/kernel/futex.c +@@ -303,8 +303,14 @@ void put_futex_key(int fshared, union fu + */ + static int fault_in_user_writeable(u32 __user *uaddr) + { +- int ret = get_user_pages(current, current->mm, (unsigned long)uaddr, +- 1, 1, 0, NULL, NULL); ++ struct mm_struct *mm = current->mm; ++ int ret; ++ ++ down_read(&mm->mmap_sem); ++ ret = get_user_pages(current, mm, (unsigned long)uaddr, ++ 1, 1, 0, NULL, NULL); ++ up_read(&mm->mmap_sem); ++ + return ret < 0 ? ret : 0; + } + diff --git a/queue-2.6.31/hfs-fix-a-potential-buffer-overflow.patch b/queue-2.6.31/hfs-fix-a-potential-buffer-overflow.patch new file mode 100644 index 00000000000..ea43f3a606d --- /dev/null +++ b/queue-2.6.31/hfs-fix-a-potential-buffer-overflow.patch @@ -0,0 +1,95 @@ +From ec81aecb29668ad71f699f4e7b96ec46691895b6 Mon Sep 17 00:00:00 2001 +From: Amerigo Wang +Date: Mon, 14 Dec 2009 17:57:37 -0800 +Subject: hfs: fix a potential buffer overflow + +From: Amerigo Wang + +commit ec81aecb29668ad71f699f4e7b96ec46691895b6 upstream. + +A specially-crafted Hierarchical File System (HFS) filesystem could cause +a buffer overflow to occur in a process's kernel stack during a memcpy() +call within the hfs_bnode_read() function (at fs/hfs/bnode.c:24). The +attacker can provide the source buffer and length, and the destination +buffer is a local variable of a fixed length. This local variable (passed +as "&entry" from fs/hfs/dir.c:112 and allocated on line 60) is stored in +the stack frame of hfs_bnode_read()'s caller, which is hfs_readdir(). +Because the hfs_readdir() function executes upon any attempt to read a +directory on the filesystem, it gets called whenever a user attempts to +inspect any filesystem contents. + +[amwang@redhat.com: modify this patch and fix coding style problems] +Signed-off-by: WANG Cong +Cc: Eugene Teo +Cc: Roman Zippel +Cc: Al Viro +Cc: Christoph Hellwig +Cc: Alexey Dobriyan +Cc: Dave Anderson +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + fs/hfs/catalog.c | 4 ++++ + fs/hfs/dir.c | 11 +++++++++++ + fs/hfs/super.c | 7 ++++++- + 3 files changed, 21 insertions(+), 1 deletion(-) + +--- a/fs/hfs/catalog.c ++++ b/fs/hfs/catalog.c +@@ -289,6 +289,10 @@ int hfs_cat_move(u32 cnid, struct inode + err = hfs_brec_find(&src_fd); + if (err) + goto out; ++ if (src_fd.entrylength > sizeof(entry) || src_fd.entrylength < 0) { ++ err = -EIO; ++ goto out; ++ } + + hfs_bnode_read(src_fd.bnode, &entry, src_fd.entryoffset, + src_fd.entrylength); +--- a/fs/hfs/dir.c ++++ b/fs/hfs/dir.c +@@ -79,6 +79,11 @@ static int hfs_readdir(struct file *filp + filp->f_pos++; + /* fall through */ + case 1: ++ if (fd.entrylength > sizeof(entry) || fd.entrylength < 0) { ++ err = -EIO; ++ goto out; ++ } ++ + hfs_bnode_read(fd.bnode, &entry, fd.entryoffset, fd.entrylength); + if (entry.type != HFS_CDR_THD) { + printk(KERN_ERR "hfs: bad catalog folder thread\n"); +@@ -109,6 +114,12 @@ static int hfs_readdir(struct file *filp + err = -EIO; + goto out; + } ++ ++ if (fd.entrylength > sizeof(entry) || fd.entrylength < 0) { ++ err = -EIO; ++ goto out; ++ } ++ + hfs_bnode_read(fd.bnode, &entry, fd.entryoffset, fd.entrylength); + type = entry.type; + len = hfs_mac2asc(sb, strbuf, &fd.key->cat.CName); +--- a/fs/hfs/super.c ++++ b/fs/hfs/super.c +@@ -409,8 +409,13 @@ static int hfs_fill_super(struct super_b + /* try to get the root inode */ + hfs_find_init(HFS_SB(sb)->cat_tree, &fd); + res = hfs_cat_find_brec(sb, HFS_ROOT_CNID, &fd); +- if (!res) ++ if (!res) { ++ if (fd.entrylength > sizeof(rec) || fd.entrylength < 0) { ++ res = -EIO; ++ goto bail; ++ } + hfs_bnode_read(fd.bnode, &rec, fd.entryoffset, fd.entrylength); ++ } + if (res) { + hfs_find_exit(&fd); + goto bail_no_root; diff --git a/queue-2.6.31/hrtimer-fix-proc-timer_list-regression.patch b/queue-2.6.31/hrtimer-fix-proc-timer_list-regression.patch new file mode 100644 index 00000000000..cc62b7144d0 --- /dev/null +++ b/queue-2.6.31/hrtimer-fix-proc-timer_list-regression.patch @@ -0,0 +1,55 @@ +From 8629ea2eaba8ca0de2e38ce1b4a825e16255976e Mon Sep 17 00:00:00 2001 +From: Feng Tang +Date: Thu, 3 Sep 2009 16:32:53 +0800 +Subject: hrtimer: Fix /proc/timer_list regression + +From: Feng Tang + +commit 8629ea2eaba8ca0de2e38ce1b4a825e16255976e upstream. + +commit 507e1231 (timer stats: Optimize by adding quick check to avoid +function calls) introduced a regression in /proc/timer_list. + +/proc/timer_list shows now + #0: , tick_sched_timer, S:01, <(null)>, /-1 +instead of + #0: , tick_sched_timer, S:01, hrtimer_start, swapper/0 + +Revert the hrtimer quick check for now. The optimization needs more +thought, but this is neither 2.6.32-rc7 nor stable material. + +[ tglx: - Removed unrelated changes from the original patch + - Prevent unneccesary call to timer_stats_update_stats + - massaged the changelog ] + +Signed-off-by: Feng Tang +LKML-Reference: +Cc: Heiko Carstens +Signed-off-by: Andrew Morton +Signed-off-by: Thomas Gleixner +Signed-off-by: Greg Kroah-Hartman + +--- + include/linux/hrtimer.h | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +--- a/include/linux/hrtimer.h ++++ b/include/linux/hrtimer.h +@@ -448,7 +448,7 @@ extern void timer_stats_update_stats(voi + + static inline void timer_stats_account_hrtimer(struct hrtimer *timer) + { +- if (likely(!timer->start_site)) ++ if (likely(!timer_stats_active)) + return; + timer_stats_update_stats(timer, timer->start_pid, timer->start_site, + timer->function, timer->start_comm, 0); +@@ -459,8 +459,6 @@ extern void __timer_stats_hrtimer_set_st + + static inline void timer_stats_hrtimer_set_start_info(struct hrtimer *timer) + { +- if (likely(!timer_stats_active)) +- return; + __timer_stats_hrtimer_set_start_info(timer, __builtin_return_address(0)); + } + diff --git a/queue-2.6.31/jbd2-don-t-wipe-the-journal-on-a-failed-journal-checksum.patch b/queue-2.6.31/jbd2-don-t-wipe-the-journal-on-a-failed-journal-checksum.patch new file mode 100644 index 00000000000..413a98da394 --- /dev/null +++ b/queue-2.6.31/jbd2-don-t-wipe-the-journal-on-a-failed-journal-checksum.patch @@ -0,0 +1,42 @@ +From e6a47428de84e19fda52f21ab73fde2906c40d09 Mon Sep 17 00:00:00 2001 +From: Theodore Ts'o +Date: Sun, 15 Nov 2009 15:31:37 -0500 +Subject: jbd2: don't wipe the journal on a failed journal checksum + +From: Theodore Ts'o + +commit e6a47428de84e19fda52f21ab73fde2906c40d09 upstream. + +If there is a failed journal checksum, don't reset the journal. This +allows for userspace programs to decide how to recover from this +situation. It may be that ignoring the journal checksum failure might +be a better way of recovering the file system. Once we add per-block +checksums, we can definitely do better. Until then, a system +administrator can try backing up the file system image (or taking a +snapshot) and and trying to determine experimentally whether ignoring +the checksum failure or aborting the journal replay results in less +data loss. + +Signed-off-by: "Theodore Ts'o" +Signed-off-by: Greg Kroah-Hartman + +--- + fs/jbd2/journal.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/fs/jbd2/journal.c ++++ b/fs/jbd2/journal.c +@@ -1421,6 +1421,13 @@ int jbd2_journal_load(journal_t *journal + if (jbd2_journal_recover(journal)) + goto recovery_error; + ++ if (journal->j_failed_commit) { ++ printk(KERN_ERR "JBD2: journal transaction %u on %s " ++ "is corrupt.\n", journal->j_failed_commit, ++ journal->j_devname); ++ return -EIO; ++ } ++ + /* OK, we've finished with the dynamic journal bits: + * reinitialise the dynamic contents of the superblock in memory + * and reset them on disk. */ diff --git a/queue-2.6.31/kvm-s390-make-psw-available-on-all-exits-not-just-a-subset.patch b/queue-2.6.31/kvm-s390-make-psw-available-on-all-exits-not-just-a-subset.patch new file mode 100644 index 00000000000..ed0ec8ecd08 --- /dev/null +++ b/queue-2.6.31/kvm-s390-make-psw-available-on-all-exits-not-just-a-subset.patch @@ -0,0 +1,147 @@ +From d7b0b5eb3000c6fb902f08c619fcd673a23d8fab Mon Sep 17 00:00:00 2001 +From: Carsten Otte +Date: Thu, 19 Nov 2009 14:21:16 +0100 +Subject: KVM: s390: Make psw available on all exits, not just a subset + +From: Carsten Otte + +commit d7b0b5eb3000c6fb902f08c619fcd673a23d8fab upstream. + +This patch moves s390 processor status word into the base kvm_run +struct and keeps it up-to date on all userspace exits. + +The userspace ABI is broken by this, however there are no applications +in the wild using this. A capability check is provided so users can +verify the updated API exists. + +Signed-off-by: Carsten Otte +Signed-off-by: Avi Kivity +Signed-off-by: Greg Kroah-Hartman + +--- + arch/s390/include/asm/kvm.h | 3 ++- + arch/s390/kvm/kvm-s390.c | 25 +++++++++++++++++-------- + include/linux/kvm.h | 8 ++++++-- + 3 files changed, 25 insertions(+), 11 deletions(-) + +--- a/arch/s390/include/asm/kvm.h ++++ b/arch/s390/include/asm/kvm.h +@@ -1,6 +1,5 @@ + #ifndef __LINUX_KVM_S390_H + #define __LINUX_KVM_S390_H +- + /* + * asm-s390/kvm.h - KVM s390 specific structures and definitions + * +@@ -24,6 +23,8 @@ struct kvm_ioapic_state { + /* no IOAPIC for s390 */ + }; + ++#define __KVM_S390 ++ + /* for KVM_GET_REGS and KVM_SET_REGS */ + struct kvm_regs { + /* general purpose regs for s390 */ +--- a/arch/s390/kvm/kvm-s390.c ++++ b/arch/s390/kvm/kvm-s390.c +@@ -115,10 +115,16 @@ long kvm_arch_dev_ioctl(struct file *fil + + int kvm_dev_ioctl_check_extension(long ext) + { ++ int r; ++ + switch (ext) { ++ case KVM_CAP_S390_PSW: ++ r = 1; ++ break; + default: +- return 0; ++ r = 0; + } ++ return r; + } + + /* Section: vm related */ +@@ -422,8 +428,10 @@ static int kvm_arch_vcpu_ioctl_set_initi + vcpu_load(vcpu); + if (atomic_read(&vcpu->arch.sie_block->cpuflags) & CPUSTAT_RUNNING) + rc = -EBUSY; +- else +- vcpu->arch.sie_block->gpsw = psw; ++ else { ++ vcpu->run->psw_mask = psw.mask; ++ vcpu->run->psw_addr = psw.addr; ++ } + vcpu_put(vcpu); + return rc; + } +@@ -505,9 +513,6 @@ int kvm_arch_vcpu_ioctl_run(struct kvm_v + + switch (kvm_run->exit_reason) { + case KVM_EXIT_S390_SIEIC: +- vcpu->arch.sie_block->gpsw.mask = kvm_run->s390_sieic.mask; +- vcpu->arch.sie_block->gpsw.addr = kvm_run->s390_sieic.addr; +- break; + case KVM_EXIT_UNKNOWN: + case KVM_EXIT_S390_RESET: + break; +@@ -515,6 +520,9 @@ int kvm_arch_vcpu_ioctl_run(struct kvm_v + BUG(); + } + ++ vcpu->arch.sie_block->gpsw.mask = kvm_run->psw_mask; ++ vcpu->arch.sie_block->gpsw.addr = kvm_run->psw_addr; ++ + might_fault(); + + do { +@@ -529,8 +537,6 @@ int kvm_arch_vcpu_ioctl_run(struct kvm_v + /* intercept cannot be handled in-kernel, prepare kvm-run */ + kvm_run->exit_reason = KVM_EXIT_S390_SIEIC; + kvm_run->s390_sieic.icptcode = vcpu->arch.sie_block->icptcode; +- kvm_run->s390_sieic.mask = vcpu->arch.sie_block->gpsw.mask; +- kvm_run->s390_sieic.addr = vcpu->arch.sie_block->gpsw.addr; + kvm_run->s390_sieic.ipa = vcpu->arch.sie_block->ipa; + kvm_run->s390_sieic.ipb = vcpu->arch.sie_block->ipb; + rc = 0; +@@ -542,6 +548,9 @@ int kvm_arch_vcpu_ioctl_run(struct kvm_v + rc = 0; + } + ++ kvm_run->psw_mask = vcpu->arch.sie_block->gpsw.mask; ++ kvm_run->psw_addr = vcpu->arch.sie_block->gpsw.addr; ++ + if (vcpu->sigset_active) + sigprocmask(SIG_SETMASK, &sigsaved, NULL); + +--- a/include/linux/kvm.h ++++ b/include/linux/kvm.h +@@ -104,6 +104,11 @@ struct kvm_run { + __u64 cr8; + __u64 apic_base; + ++#ifdef __KVM_S390 ++ /* the processor status word for s390 */ ++ __u64 psw_mask; /* psw upper half */ ++ __u64 psw_addr; /* psw lower half */ ++#endif + union { + /* KVM_EXIT_UNKNOWN */ + struct { +@@ -155,8 +160,6 @@ struct kvm_run { + /* KVM_EXIT_S390_SIEIC */ + struct { + __u8 icptcode; +- __u64 mask; /* psw upper half */ +- __u64 addr; /* psw lower half */ + __u16 ipa; + __u32 ipb; + } s390_sieic; +@@ -453,6 +456,7 @@ struct kvm_irq_routing { + }; + + #endif ++#define KVM_CAP_S390_PSW 42 + + /* + * ioctls for VM fds diff --git a/queue-2.6.31/md-bitmap-protect-against-bitmap-removal-while-being-updated.patch b/queue-2.6.31/md-bitmap-protect-against-bitmap-removal-while-being-updated.patch new file mode 100644 index 00000000000..0797056bd4d --- /dev/null +++ b/queue-2.6.31/md-bitmap-protect-against-bitmap-removal-while-being-updated.patch @@ -0,0 +1,148 @@ +From aa5cbd103887011b4830355f88fb055f9ad2d556 Mon Sep 17 00:00:00 2001 +From: NeilBrown +Date: Mon, 14 Dec 2009 12:49:46 +1100 +Subject: md/bitmap: protect against bitmap removal while being updated. + +From: NeilBrown + +commit aa5cbd103887011b4830355f88fb055f9ad2d556 upstream. + +A write intent bitmap can be removed from an array while the +array is active. +When this happens, all IO is suspended and flushed before the +bitmap is removed. +However it is possible that bitmap_daemon_work is still running to +clear old bits from the bitmap. If it is, it can dereference the +bitmap after it has been freed. + +So introduce a new mutex to protect bitmap_daemon_work and get it +before destroying a bitmap. + +This is suitable for any current -stable kernel. + +Signed-off-by: NeilBrown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/bitmap.c | 24 ++++++++++++++++++------ + drivers/md/bitmap.h | 2 +- + drivers/md/md.c | 3 ++- + drivers/md/md.h | 1 + + 4 files changed, 22 insertions(+), 8 deletions(-) + +--- a/drivers/md/bitmap.c ++++ b/drivers/md/bitmap.c +@@ -1077,23 +1077,31 @@ static bitmap_counter_t *bitmap_get_coun + * out to disk + */ + +-void bitmap_daemon_work(struct bitmap *bitmap) ++void bitmap_daemon_work(mddev_t *mddev) + { ++ struct bitmap *bitmap; + unsigned long j; + unsigned long flags; + struct page *page = NULL, *lastpage = NULL; + int blocks; + void *paddr; + +- if (bitmap == NULL) ++ /* Use a mutex to guard daemon_work against ++ * bitmap_destroy. ++ */ ++ mutex_lock(&mddev->bitmap_mutex); ++ bitmap = mddev->bitmap; ++ if (bitmap == NULL) { ++ mutex_unlock(&mddev->bitmap_mutex); + return; ++ } + if (time_before(jiffies, bitmap->daemon_lastrun + bitmap->daemon_sleep*HZ)) + goto done; + + bitmap->daemon_lastrun = jiffies; + if (bitmap->allclean) { + bitmap->mddev->thread->timeout = MAX_SCHEDULE_TIMEOUT; +- return; ++ goto done; + } + bitmap->allclean = 1; + +@@ -1202,6 +1210,7 @@ void bitmap_daemon_work(struct bitmap *b + done: + if (bitmap->allclean == 0) + bitmap->mddev->thread->timeout = bitmap->daemon_sleep * HZ; ++ mutex_unlock(&mddev->bitmap_mutex); + } + + static bitmap_counter_t *bitmap_get_counter(struct bitmap *bitmap, +@@ -1538,9 +1547,9 @@ void bitmap_flush(mddev_t *mddev) + */ + sleep = bitmap->daemon_sleep; + bitmap->daemon_sleep = 0; +- bitmap_daemon_work(bitmap); +- bitmap_daemon_work(bitmap); +- bitmap_daemon_work(bitmap); ++ bitmap_daemon_work(mddev); ++ bitmap_daemon_work(mddev); ++ bitmap_daemon_work(mddev); + bitmap->daemon_sleep = sleep; + bitmap_update_sb(bitmap); + } +@@ -1571,6 +1580,7 @@ static void bitmap_free(struct bitmap *b + kfree(bp); + kfree(bitmap); + } ++ + void bitmap_destroy(mddev_t *mddev) + { + struct bitmap *bitmap = mddev->bitmap; +@@ -1578,7 +1588,9 @@ void bitmap_destroy(mddev_t *mddev) + if (!bitmap) /* there was no bitmap */ + return; + ++ mutex_lock(&mddev->bitmap_mutex); + mddev->bitmap = NULL; /* disconnect from the md device */ ++ mutex_unlock(&mddev->bitmap_mutex); + if (mddev->thread) + mddev->thread->timeout = MAX_SCHEDULE_TIMEOUT; + +--- a/drivers/md/bitmap.h ++++ b/drivers/md/bitmap.h +@@ -282,7 +282,7 @@ void bitmap_close_sync(struct bitmap *bi + void bitmap_cond_end_sync(struct bitmap *bitmap, sector_t sector); + + void bitmap_unplug(struct bitmap *bitmap); +-void bitmap_daemon_work(struct bitmap *bitmap); ++void bitmap_daemon_work(mddev_t *mddev); + #endif + + #endif +--- a/drivers/md/md.c ++++ b/drivers/md/md.c +@@ -361,6 +361,7 @@ static mddev_t * mddev_find(dev_t unit) + + mutex_init(&new->open_mutex); + mutex_init(&new->reconfig_mutex); ++ mutex_init(&new->bitmap_mutex); + INIT_LIST_HEAD(&new->disks); + INIT_LIST_HEAD(&new->all_mddevs); + init_timer(&new->safemode_timer); +@@ -6595,7 +6596,7 @@ void md_check_recovery(mddev_t *mddev) + + + if (mddev->bitmap) +- bitmap_daemon_work(mddev->bitmap); ++ bitmap_daemon_work(mddev); + + if (mddev->ro) + return; +--- a/drivers/md/md.h ++++ b/drivers/md/md.h +@@ -289,6 +289,7 @@ struct mddev_s + * hot-adding a bitmap. It should + * eventually be settable by sysfs. + */ ++ struct mutex bitmap_mutex; + + struct list_head all_mddevs; + }; diff --git a/queue-2.6.31/pata_hpt-37x-3x2n-fix-timing-register-masks-take-2.patch b/queue-2.6.31/pata_hpt-37x-3x2n-fix-timing-register-masks-take-2.patch new file mode 100644 index 00000000000..51cb8f5b78f --- /dev/null +++ b/queue-2.6.31/pata_hpt-37x-3x2n-fix-timing-register-masks-take-2.patch @@ -0,0 +1,173 @@ +From 5600c70e576199a7552e1c0fff43f3fe16f5566e Mon Sep 17 00:00:00 2001 +From: Sergei Shtylyov +Date: Fri, 27 Nov 2009 22:29:02 +0400 +Subject: pata_hpt{37x|3x2n}: fix timing register masks (take 2) + +From: Sergei Shtylyov + +commit 5600c70e576199a7552e1c0fff43f3fe16f5566e upstream. + +These drivers inherited from the older 'hpt366' IDE driver the buggy timing +register masks in their set_piomode() metods. As a result, too low command +cycle active time is programmed for slow PIO modes. Quite fortunately, it's +later "fixed up" by the set_dmamode() methods which also "helpfully" reprogram +the command timings, usually to PIO mode 4; unfortunately, setting an UltraDMA +mode #N also reprograms already set PIO data timings, usually to MWDMA mode # +max(N, 2) timings... + +However, the drivers added some breakage of their own too: the bit that they +set/clear to control the FIFO is sometimes wrong -- it's actually the MSB of +the command cycle setup time; also, setting it in DMA mode is wrong as this +bit is only for PIO actually and clearing it for PIO modes is not needed as +no mode in any timing table has it set... + +Fix all this, inverting the masks while at it, like in the 'hpt366' and +'pata_hpt366' drivers; bump the drivers' versions, accounting for recent +patches that forgot to do it... + +Signed-off-by: Sergei Shtylyov +Signed-off-by: Jeff Garzik +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ata/pata_hpt37x.c | 32 +++++++++++++++----------------- + drivers/ata/pata_hpt3x2n.c | 17 ++++++++--------- + 2 files changed, 23 insertions(+), 26 deletions(-) + +--- a/drivers/ata/pata_hpt37x.c ++++ b/drivers/ata/pata_hpt37x.c +@@ -24,7 +24,7 @@ + #include + + #define DRV_NAME "pata_hpt37x" +-#define DRV_VERSION "0.6.12" ++#define DRV_VERSION "0.6.14" + + struct hpt_clock { + u8 xfer_speed; +@@ -404,9 +404,8 @@ static void hpt370_set_piomode(struct at + + pci_read_config_dword(pdev, addr1, ®); + mode = hpt37x_find_mode(ap, adev->pio_mode); +- mode &= ~0x8000000; /* No FIFO in PIO */ +- mode &= ~0x30070000; /* Leave config bits alone */ +- reg &= 0x30070000; /* Strip timing bits */ ++ mode &= 0xCFC3FFFF; /* Leave DMA bits alone */ ++ reg &= ~0xCFC3FFFF; /* Strip timing bits */ + pci_write_config_dword(pdev, addr1, reg | mode); + } + +@@ -423,8 +422,7 @@ static void hpt370_set_dmamode(struct at + { + struct pci_dev *pdev = to_pci_dev(ap->host->dev); + u32 addr1, addr2; +- u32 reg; +- u32 mode; ++ u32 reg, mode, mask; + u8 fast; + + addr1 = 0x40 + 4 * (adev->devno + 2 * ap->port_no); +@@ -436,11 +434,12 @@ static void hpt370_set_dmamode(struct at + fast |= 0x01; + pci_write_config_byte(pdev, addr2, fast); + ++ mask = adev->dma_mode < XFER_UDMA_0 ? 0x31C001FF : 0x303C0000; ++ + pci_read_config_dword(pdev, addr1, ®); + mode = hpt37x_find_mode(ap, adev->dma_mode); +- mode |= 0x8000000; /* FIFO in MWDMA or UDMA */ +- mode &= ~0xC0000000; /* Leave config bits alone */ +- reg &= 0xC0000000; /* Strip timing bits */ ++ mode &= mask; ++ reg &= ~mask; + pci_write_config_dword(pdev, addr1, reg | mode); + } + +@@ -508,9 +507,8 @@ static void hpt372_set_piomode(struct at + mode = hpt37x_find_mode(ap, adev->pio_mode); + + printk("Find mode for %d reports %X\n", adev->pio_mode, mode); +- mode &= ~0x80000000; /* No FIFO in PIO */ +- mode &= ~0x30070000; /* Leave config bits alone */ +- reg &= 0x30070000; /* Strip timing bits */ ++ mode &= 0xCFC3FFFF; /* Leave DMA bits alone */ ++ reg &= ~0xCFC3FFFF; /* Strip timing bits */ + pci_write_config_dword(pdev, addr1, reg | mode); + } + +@@ -527,8 +525,7 @@ static void hpt372_set_dmamode(struct at + { + struct pci_dev *pdev = to_pci_dev(ap->host->dev); + u32 addr1, addr2; +- u32 reg; +- u32 mode; ++ u32 reg, mode, mask; + u8 fast; + + addr1 = 0x40 + 4 * (adev->devno + 2 * ap->port_no); +@@ -539,12 +536,13 @@ static void hpt372_set_dmamode(struct at + fast &= ~0x07; + pci_write_config_byte(pdev, addr2, fast); + ++ mask = adev->dma_mode < XFER_UDMA_0 ? 0x31C001FF : 0x303C0000; ++ + pci_read_config_dword(pdev, addr1, ®); + mode = hpt37x_find_mode(ap, adev->dma_mode); + printk("Find mode for DMA %d reports %X\n", adev->dma_mode, mode); +- mode &= ~0xC0000000; /* Leave config bits alone */ +- mode |= 0x80000000; /* FIFO in MWDMA or UDMA */ +- reg &= 0xC0000000; /* Strip timing bits */ ++ mode &= mask; ++ reg &= ~mask; + pci_write_config_dword(pdev, addr1, reg | mode); + } + +--- a/drivers/ata/pata_hpt3x2n.c ++++ b/drivers/ata/pata_hpt3x2n.c +@@ -25,7 +25,7 @@ + #include + + #define DRV_NAME "pata_hpt3x2n" +-#define DRV_VERSION "0.3.4" ++#define DRV_VERSION "0.3.7" + + enum { + HPT_PCI_FAST = (1 << 31), +@@ -185,9 +185,8 @@ static void hpt3x2n_set_piomode(struct a + + pci_read_config_dword(pdev, addr1, ®); + mode = hpt3x2n_find_mode(ap, adev->pio_mode); +- mode &= ~0x8000000; /* No FIFO in PIO */ +- mode &= ~0x30070000; /* Leave config bits alone */ +- reg &= 0x30070000; /* Strip timing bits */ ++ mode &= 0xCFC3FFFF; /* Leave DMA bits alone */ ++ reg &= ~0xCFC3FFFF; /* Strip timing bits */ + pci_write_config_dword(pdev, addr1, reg | mode); + } + +@@ -204,8 +203,7 @@ static void hpt3x2n_set_dmamode(struct a + { + struct pci_dev *pdev = to_pci_dev(ap->host->dev); + u32 addr1, addr2; +- u32 reg; +- u32 mode; ++ u32 reg, mode, mask; + u8 fast; + + addr1 = 0x40 + 4 * (adev->devno + 2 * ap->port_no); +@@ -216,11 +214,12 @@ static void hpt3x2n_set_dmamode(struct a + fast &= ~0x07; + pci_write_config_byte(pdev, addr2, fast); + ++ mask = adev->dma_mode < XFER_UDMA_0 ? 0x31C001FF : 0x303C0000; ++ + pci_read_config_dword(pdev, addr1, ®); + mode = hpt3x2n_find_mode(ap, adev->dma_mode); +- mode |= 0x8000000; /* FIFO in MWDMA or UDMA */ +- mode &= ~0xC0000000; /* Leave config bits alone */ +- reg &= 0xC0000000; /* Strip timing bits */ ++ mode &= mask; ++ reg &= ~mask; + pci_write_config_dword(pdev, addr1, reg | mode); + } + diff --git a/queue-2.6.31/pxa-em-x270-fix-usb-hub-power-up-reset-sequence.patch b/queue-2.6.31/pxa-em-x270-fix-usb-hub-power-up-reset-sequence.patch new file mode 100644 index 00000000000..306e1c3b8ec --- /dev/null +++ b/queue-2.6.31/pxa-em-x270-fix-usb-hub-power-up-reset-sequence.patch @@ -0,0 +1,42 @@ +From 1b82e4c32fba96d8805b1e2126ba5382e56fac32 Mon Sep 17 00:00:00 2001 +From: Igor Grinberg +Date: Sun, 6 Dec 2009 15:45:43 +0200 +Subject: [ARM] pxa/em-x270: fix usb hub power up/reset sequence + +From: Igor Grinberg + +commit 1b82e4c32fba96d8805b1e2126ba5382e56fac32 upstream. + +Signed-off-by: Igor Grinberg +Signed-off-by: Mike Rapoport +Signed-off-by: Eric Miao +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/mach-pxa/em-x270.c | 11 +++++------ + 1 file changed, 5 insertions(+), 6 deletions(-) + +--- a/arch/arm/mach-pxa/em-x270.c ++++ b/arch/arm/mach-pxa/em-x270.c +@@ -497,16 +497,15 @@ static int em_x270_usb_hub_init(void) + goto err_free_vbus_gpio; + + /* USB Hub power-on and reset */ +- gpio_direction_output(usb_hub_reset, 0); ++ gpio_direction_output(usb_hub_reset, 1); ++ gpio_direction_output(GPIO9_USB_VBUS_EN, 0); + regulator_enable(em_x270_usb_ldo); +- gpio_set_value(usb_hub_reset, 1); + gpio_set_value(usb_hub_reset, 0); ++ gpio_set_value(usb_hub_reset, 1); + regulator_disable(em_x270_usb_ldo); + regulator_enable(em_x270_usb_ldo); +- gpio_set_value(usb_hub_reset, 1); +- +- /* enable VBUS */ +- gpio_direction_output(GPIO9_USB_VBUS_EN, 1); ++ gpio_set_value(usb_hub_reset, 0); ++ gpio_set_value(GPIO9_USB_VBUS_EN, 1); + + return 0; + diff --git a/queue-2.6.31/series b/queue-2.6.31/series index a4c884bf77e..f5523aea37c 100644 --- a/queue-2.6.31/series +++ b/queue-2.6.31/series @@ -1,3 +1,35 @@ usb-option-add-pid-for-zte.patch usb-usb-storage-fix-bug-in-fill_inquiry.patch firewire-ohci-handle-receive-packets-with-a-data-length-of-zero.patch +alsa-hda-terradici-hda-controllers-does-not-support-64-bit-mode.patch +alsa-hrtimer-fix-lock-up.patch +ath5k-allow-setting-txpower-to-0.patch +ath5k-enable-eeprom-checksum-check.patch +bsdacct-fix-uid-gid-misreporting.patch +debugfs-fix-create-mutex-racy-fops-and-private-data.patch +devpts_get_tty-should-validate-inode.patch +futex-take-mmap_sem-for-get_user_pages-in-fault_in_user_writeable.patch +hfs-fix-a-potential-buffer-overflow.patch +hrtimer-fix-proc-timer_list-regression.patch +jbd2-don-t-wipe-the-journal-on-a-failed-journal-checksum.patch +kvm-s390-make-psw-available-on-all-exits-not-just-a-subset.patch +md-bitmap-protect-against-bitmap-removal-while-being-updated.patch +pata_hpt-37x-3x2n-fix-timing-register-masks-take-2.patch +pxa-em-x270-fix-usb-hub-power-up-reset-sequence.patch +ssb-fix-range-check-in-sprom-write.patch +sunrpc-is_err-ptr_err-confusion.patch +usb-close-usb_find_interface-race-v3.patch +usb-musb_gadget_ep0-fix-unhandled-endpoint-0-irqs-again.patch +usb-option.c-add-support-for-d-link-dwm-162-u5.patch +usb-usb-storage-add-bad_sense-flag.patch +usb-usbtmc-repeat-usb_bulk_msg-until-whole-message-is-transfered.patch +v4l-dvb-fix-test-in-copy_reg_bits.patch +x86-add-new-intel-cpu-cache-size-descriptors.patch +x86-amd-iommu-attach-devices-to-pre-allocated-domains-early.patch +x86-amd-iommu-un__init-iommu_setup_msi.patch +x86-apic-enable-lapic-nmi-watchdog-on-amd-family-11h.patch +x86-asus-p4s800-reboot-bios-quirk.patch +x86-calgary-iommu-quirk-find-nearest-matching-calgary-while-walking-up-the-pci-tree.patch +x86-fix-iommu-nodac-parameter-handling.patch +x86-fix-typo-in-intel-cpu-cache-size-descriptor.patch +x86-gart-pci-gart_64.c-use-correct-length-in-strncmp.patch diff --git a/queue-2.6.31/ssb-fix-range-check-in-sprom-write.patch b/queue-2.6.31/ssb-fix-range-check-in-sprom-write.patch new file mode 100644 index 00000000000..1a002e02f85 --- /dev/null +++ b/queue-2.6.31/ssb-fix-range-check-in-sprom-write.patch @@ -0,0 +1,66 @@ +From e33761e6f23881de9f3ee77cc2204ab2e26f3d9a Mon Sep 17 00:00:00 2001 +From: Michael Buesch +Date: Mon, 23 Nov 2009 20:58:06 +0100 +Subject: ssb: Fix range check in sprom write + +From: Michael Buesch + +commit e33761e6f23881de9f3ee77cc2204ab2e26f3d9a upstream. + +The range check in the sprom image parser hex2sprom() is broken. +One sprom word is 4 hex characters. +This fixes the check and also adds much better sanity checks to the code. +We better make sure the image is OK by doing some sanity checks to avoid +bricking the device by accident. + +Signed-off-by: Michael Buesch +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ssb/sprom.c | 20 ++++++++++++++++---- + 1 file changed, 16 insertions(+), 4 deletions(-) + +--- a/drivers/ssb/sprom.c ++++ b/drivers/ssb/sprom.c +@@ -13,6 +13,8 @@ + + #include "ssb_private.h" + ++#include ++ + + static const struct ssb_sprom *fallback_sprom; + +@@ -33,17 +35,27 @@ static int sprom2hex(const u16 *sprom, c + static int hex2sprom(u16 *sprom, const char *dump, size_t len, + size_t sprom_size_words) + { +- char tmp[5] = { 0 }; +- int cnt = 0; ++ char c, tmp[5] = { 0 }; ++ int err, cnt = 0; + unsigned long parsed; + +- if (len < sprom_size_words * 2) ++ /* Strip whitespace at the end. */ ++ while (len) { ++ c = dump[len - 1]; ++ if (!isspace(c) && c != '\0') ++ break; ++ len--; ++ } ++ /* Length must match exactly. */ ++ if (len != sprom_size_words * 4) + return -EINVAL; + + while (cnt < sprom_size_words) { + memcpy(tmp, dump, 4); + dump += 4; +- parsed = simple_strtoul(tmp, NULL, 16); ++ err = strict_strtoul(tmp, 16, &parsed); ++ if (err) ++ return err; + sprom[cnt++] = swab16((u16)parsed); + } + diff --git a/queue-2.6.31/sunrpc-is_err-ptr_err-confusion.patch b/queue-2.6.31/sunrpc-is_err-ptr_err-confusion.patch new file mode 100644 index 00000000000..5118ecfa496 --- /dev/null +++ b/queue-2.6.31/sunrpc-is_err-ptr_err-confusion.patch @@ -0,0 +1,30 @@ +From 480e3243df156e39eea6c91057e2ae612a6bbe19 Mon Sep 17 00:00:00 2001 +From: Roel Kluin +Date: Tue, 8 Dec 2009 13:13:03 -0500 +Subject: SUNRPC: IS_ERR/PTR_ERR confusion + +From: Roel Kluin + +commit 480e3243df156e39eea6c91057e2ae612a6bbe19 upstream. + +IS_ERR returns 1 or 0, PTR_ERR returns the error value. + +Signed-off-by: Roel Kluin +Signed-off-by: Trond Myklebust +Signed-off-by: Greg Kroah-Hartman + +--- + net/sunrpc/auth_gss/auth_gss.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/sunrpc/auth_gss/auth_gss.c ++++ b/net/sunrpc/auth_gss/auth_gss.c +@@ -485,7 +485,7 @@ gss_refresh_upcall(struct rpc_task *task + dprintk("RPC: %5u gss_refresh_upcall for uid %u\n", task->tk_pid, + cred->cr_uid); + gss_msg = gss_setup_upcall(task->tk_client, gss_auth, cred); +- if (IS_ERR(gss_msg) == -EAGAIN) { ++ if (PTR_ERR(gss_msg) == -EAGAIN) { + /* XXX: warning on the first, under the assumption we + * shouldn't normally hit this case on a refresh. */ + warn_gssd(); diff --git a/queue-2.6.31/usb-close-usb_find_interface-race-v3.patch b/queue-2.6.31/usb-close-usb_find_interface-race-v3.patch new file mode 100644 index 00000000000..b562a78ec46 --- /dev/null +++ b/queue-2.6.31/usb-close-usb_find_interface-race-v3.patch @@ -0,0 +1,103 @@ +From c2d284ee04ab6f6718de2ddcf1b43160e046c41d Mon Sep 17 00:00:00 2001 +From: Russ Dill +Date: Mon, 14 Dec 2009 21:45:35 -0700 +Subject: USB: Close usb_find_interface race v3 + +From: Russ Dill + +commit c2d284ee04ab6f6718de2ddcf1b43160e046c41d upstream. + +USB drivers that create character devices call usb_register_dev in their +probe function. This associates the usb_interface device with that minor +number and creates the character device and announces it to the world. +However, the driver's probe function is called before the new +usb_interface is added to the driver's klist_devices. + +This is a problem because userspace will respond to the character device +creation announcement by opening the character device. The driver's open +function will the call usb_find_interface to find the usb_interface +associated with that minor number. usb_find_interface will walk the +driver's list of devices and find the usb_interface with the matching +minor number. + +Because the announcement happens before the usb_interface is added to the +driver's klist_devices, a race condition exists. A straightforward fix +is to walk the list of devices on usb_bus_type instead since the device +is added to that list before the announcement occurs. + +bus_find_device calls get_device to bump the reference count on the found +device. It is arguable that the reference count should be dropped by the +caller of usb_find_interface instead of usb_find_interface, however, +the current users of usb_find_interface do not expect this. + +The original version of this patch only matched against minor number +instead of driver and minor number. This version matches against both. + +Signed-off-by: Russ Dill +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/usb.c | 31 ++++++++++++++++--------------- + 1 file changed, 16 insertions(+), 15 deletions(-) + +--- a/drivers/usb/core/usb.c ++++ b/drivers/usb/core/usb.c +@@ -132,7 +132,7 @@ EXPORT_SYMBOL_GPL(usb_altnum_to_altsetti + + struct find_interface_arg { + int minor; +- struct usb_interface *interface; ++ struct device_driver *drv; + }; + + static int __find_interface(struct device *dev, void *data) +@@ -143,12 +143,10 @@ static int __find_interface(struct devic + if (!is_usb_interface(dev)) + return 0; + ++ if (dev->driver != arg->drv) ++ return 0; + intf = to_usb_interface(dev); +- if (intf->minor != -1 && intf->minor == arg->minor) { +- arg->interface = intf; +- return 1; +- } +- return 0; ++ return intf->minor == arg->minor; + } + + /** +@@ -156,21 +154,24 @@ static int __find_interface(struct devic + * @drv: the driver whose current configuration is considered + * @minor: the minor number of the desired device + * +- * This walks the driver device list and returns a pointer to the interface +- * with the matching minor. Note, this only works for devices that share the +- * USB major number. ++ * This walks the bus device list and returns a pointer to the interface ++ * with the matching minor and driver. Note, this only works for devices ++ * that share the USB major number. + */ + struct usb_interface *usb_find_interface(struct usb_driver *drv, int minor) + { + struct find_interface_arg argb; +- int retval; ++ struct device *dev; + + argb.minor = minor; +- argb.interface = NULL; +- /* eat the error, it will be in argb.interface */ +- retval = driver_for_each_device(&drv->drvwrap.driver, NULL, &argb, +- __find_interface); +- return argb.interface; ++ argb.drv = &drv->drvwrap.driver; ++ ++ dev = bus_find_device(&usb_bus_type, NULL, &argb, __find_interface); ++ ++ /* Drop reference count from bus_find_device */ ++ put_device(dev); ++ ++ return dev ? to_usb_interface(dev) : NULL; + } + EXPORT_SYMBOL_GPL(usb_find_interface); + diff --git a/queue-2.6.31/usb-musb_gadget_ep0-fix-unhandled-endpoint-0-irqs-again.patch b/queue-2.6.31/usb-musb_gadget_ep0-fix-unhandled-endpoint-0-irqs-again.patch new file mode 100644 index 00000000000..c658964ef31 --- /dev/null +++ b/queue-2.6.31/usb-musb_gadget_ep0-fix-unhandled-endpoint-0-irqs-again.patch @@ -0,0 +1,36 @@ +From 196f1b7a387546f425df2f1fad26772e3d513aea Mon Sep 17 00:00:00 2001 +From: Sergei Shtylyov +Date: Mon, 16 Nov 2009 16:24:05 +0530 +Subject: USB: musb_gadget_ep0: fix unhandled endpoint 0 IRQs, again + +From: Sergei Shtylyov + +commit 196f1b7a387546f425df2f1fad26772e3d513aea upstream. + +Commit a5073b52833e4df8e16c93dc4cbb7e0c558c74a2 (musb_gadget: fix +unhandled endpoint 0 IRQs) somehow missed its key change: + +"The gadget EP0 code routinely ignores an interrupt at end of +the data phase because of musb_g_ep0_giveback() resetting the +state machine to "idle, waiting for SETUP" phase prematurely." + +So, the majority of the cases of unhandled IRQs is still unfixed... + +Signed-off-by: Sergei Shtylyov +Signed-off-by: Anand Gadiyar +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/musb/musb_gadget_ep0.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/drivers/usb/musb/musb_gadget_ep0.c ++++ b/drivers/usb/musb/musb_gadget_ep0.c +@@ -199,7 +199,6 @@ service_in_request(struct musb *musb, co + static void musb_g_ep0_giveback(struct musb *musb, struct usb_request *req) + { + musb_g_giveback(&musb->endpoints[0].ep_in, req, 0); +- musb->ep0_state = MUSB_EP0_STAGE_SETUP; + } + + /* diff --git a/queue-2.6.31/usb-option.c-add-support-for-d-link-dwm-162-u5.patch b/queue-2.6.31/usb-option.c-add-support-for-d-link-dwm-162-u5.patch new file mode 100644 index 00000000000..a1a5459b19b --- /dev/null +++ b/queue-2.6.31/usb-option.c-add-support-for-d-link-dwm-162-u5.patch @@ -0,0 +1,37 @@ +From 54a8e144acad6506920f385f4ef2779664f05b21 Mon Sep 17 00:00:00 2001 +From: Zhang Le +Date: Tue, 17 Nov 2009 14:53:42 -0800 +Subject: USB: option.c: add support for D-Link DWM-162-U5 + +From: Zhang Le + +commit 54a8e144acad6506920f385f4ef2779664f05b21 upstream. + +Add D-Link DWM-162-U5 device id 1e0e:ce16 into option driver. The device +has 4 interfaces, of which 1 is handled by storage and the other 3 by +option driver. + +The device appears first as CD-only 05c6:2100 device and must be switched +to 1e0e:ce16 mode either by using "eject CD" or usb_modeswitch. + +The MessageContent for usb_modeswitch.conf is: +"55534243e0c26a85000000000000061b000000020000000000000000000000" + +Signed-off-by: Zhang Le +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/option.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -632,6 +632,7 @@ static struct usb_device_id option_ids[] + { USB_DEVICE(TOSHIBA_VENDOR_ID, TOSHIBA_PRODUCT_G450) }, + { USB_DEVICE(TOSHIBA_VENDOR_ID, TOSHIBA_PRODUCT_HSDPA_MINICARD ) }, /* Toshiba 3G HSDPA == Novatel Expedite EU870D MiniCard */ + { USB_DEVICE(ALINK_VENDOR_ID, 0x9000) }, ++ { USB_DEVICE(ALINK_VENDOR_ID, 0xce16) }, + { USB_DEVICE_AND_INTERFACE_INFO(ALINK_VENDOR_ID, ALINK_PRODUCT_3GU, 0xff, 0xff, 0xff) }, + { USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_X060S) }, + { USB_DEVICE(AIRPLUS_VENDOR_ID, AIRPLUS_PRODUCT_MCD650) }, diff --git a/queue-2.6.31/usb-usb-storage-add-bad_sense-flag.patch b/queue-2.6.31/usb-usb-storage-add-bad_sense-flag.patch new file mode 100644 index 00000000000..2667d480dc9 --- /dev/null +++ b/queue-2.6.31/usb-usb-storage-add-bad_sense-flag.patch @@ -0,0 +1,139 @@ +From a0bb108112a872c0b0c4b3ef4974f95fb75b155d Mon Sep 17 00:00:00 2001 +From: Alan Stern +Date: Mon, 7 Dec 2009 16:39:16 -0500 +Subject: USB: usb-storage: add BAD_SENSE flag + +From: Alan Stern + +commit a0bb108112a872c0b0c4b3ef4974f95fb75b155d upstream. + +This patch (as1311) fixes a problem in usb-storage: Some devices are +pretty broken when it comes to reporting sense data. The information +they send back indicates that they have more than 18 bytes of sense +data available, but when the system asks for more than 18 they fail or +hang. The symptom is that probing fails with multiple resets. + +The patch adds a new BAD_SENSE flag to indicate that usb-storage +should never ask for more than 18 bytes of sense data. The flag can +be set in an unusual_devs entry or via the "quirks=" module parameter, +and it is set automatically whenever a REQUEST SENSE command for more +than 18 bytes fails or times out. + +An unusual_devs entry is added for the Agfa photo frame, which uses a +Prolific chip having this bug. + +Signed-off-by: Alan Stern +Tested-by: Daniel Kukula +Signed-off-by: Greg Kroah-Hartman + +--- + Documentation/kernel-parameters.txt | 2 ++ + drivers/usb/storage/transport.c | 17 +++++++++++++---- + drivers/usb/storage/unusual_devs.h | 7 +++++++ + drivers/usb/storage/usb.c | 3 +++ + include/linux/usb_usual.h | 4 +++- + 5 files changed, 28 insertions(+), 5 deletions(-) + +--- a/Documentation/kernel-parameters.txt ++++ b/Documentation/kernel-parameters.txt +@@ -2561,6 +2561,8 @@ and is between 256 and 4096 characters. + to a common usb-storage quirk flag as follows: + a = SANE_SENSE (collect more than 18 bytes + of sense data); ++ b = BAD_SENSE (don't collect more than 18 ++ bytes of sense data); + c = FIX_CAPACITY (decrease the reported + device capacity by one sector); + h = CAPACITY_HEURISTICS (decrease the +--- a/drivers/usb/storage/transport.c ++++ b/drivers/usb/storage/transport.c +@@ -666,10 +666,11 @@ void usb_stor_invoke_transport(struct sc + * to wait for at least one CHECK_CONDITION to determine + * SANE_SENSE support + */ +- if ((srb->cmnd[0] == ATA_16 || srb->cmnd[0] == ATA_12) && ++ if (unlikely((srb->cmnd[0] == ATA_16 || srb->cmnd[0] == ATA_12) && + result == USB_STOR_TRANSPORT_GOOD && + !(us->fflags & US_FL_SANE_SENSE) && +- !(srb->cmnd[2] & 0x20)) { ++ !(us->fflags & US_FL_BAD_SENSE) && ++ !(srb->cmnd[2] & 0x20))) { + US_DEBUGP("-- SAT supported, increasing auto-sense\n"); + us->fflags |= US_FL_SANE_SENSE; + } +@@ -718,6 +719,12 @@ Retry_Sense: + if (test_bit(US_FLIDX_TIMED_OUT, &us->dflags)) { + US_DEBUGP("-- auto-sense aborted\n"); + srb->result = DID_ABORT << 16; ++ ++ /* If SANE_SENSE caused this problem, disable it */ ++ if (sense_size != US_SENSE_SIZE) { ++ us->fflags &= ~US_FL_SANE_SENSE; ++ us->fflags |= US_FL_BAD_SENSE; ++ } + goto Handle_Errors; + } + +@@ -727,10 +734,11 @@ Retry_Sense: + * (small) sense request. This fixes some USB GSM modems + */ + if (temp_result == USB_STOR_TRANSPORT_FAILED && +- (us->fflags & US_FL_SANE_SENSE) && +- sense_size != US_SENSE_SIZE) { ++ sense_size != US_SENSE_SIZE) { + US_DEBUGP("-- auto-sense failure, retry small sense\n"); + sense_size = US_SENSE_SIZE; ++ us->fflags &= ~US_FL_SANE_SENSE; ++ us->fflags |= US_FL_BAD_SENSE; + goto Retry_Sense; + } + +@@ -754,6 +762,7 @@ Retry_Sense: + */ + if (srb->sense_buffer[7] > (US_SENSE_SIZE - 8) && + !(us->fflags & US_FL_SANE_SENSE) && ++ !(us->fflags & US_FL_BAD_SENSE) && + (srb->sense_buffer[0] & 0x7C) == 0x70) { + US_DEBUGP("-- SANE_SENSE support enabled\n"); + us->fflags |= US_FL_SANE_SENSE; +--- a/drivers/usb/storage/unusual_devs.h ++++ b/drivers/usb/storage/unusual_devs.h +@@ -838,6 +838,13 @@ UNUSUAL_DEV( 0x066f, 0x8000, 0x0001, 0x0 + US_SC_DEVICE, US_PR_DEVICE, NULL, + US_FL_FIX_CAPACITY ), + ++/* Reported by Daniel Kukula */ ++UNUSUAL_DEV( 0x067b, 0x1063, 0x0100, 0x0100, ++ "Prolific Technology, Inc.", ++ "Prolific Storage Gadget", ++ US_SC_DEVICE, US_PR_DEVICE, NULL, ++ US_FL_BAD_SENSE ), ++ + /* Reported by Rogerio Brito */ + UNUSUAL_DEV( 0x067b, 0x2317, 0x0001, 0x001, + "Prolific Technology, Inc.", +--- a/drivers/usb/storage/usb.c ++++ b/drivers/usb/storage/usb.c +@@ -460,6 +460,9 @@ static void adjust_quirks(struct us_data + case 'a': + f |= US_FL_SANE_SENSE; + break; ++ case 'b': ++ f |= US_FL_BAD_SENSE; ++ break; + case 'c': + f |= US_FL_FIX_CAPACITY; + break; +--- a/include/linux/usb_usual.h ++++ b/include/linux/usb_usual.h +@@ -56,7 +56,9 @@ + US_FLAG(SANE_SENSE, 0x00008000) \ + /* Sane Sense (> 18 bytes) */ \ + US_FLAG(CAPACITY_OK, 0x00010000) \ +- /* READ CAPACITY response is correct */ ++ /* READ CAPACITY response is correct */ \ ++ US_FLAG(BAD_SENSE, 0x00020000) \ ++ /* Bad Sense (never more than 18 bytes) */ + + #define US_FLAG(name, value) US_FL_##name = value , + enum { US_DO_ALL_FLAGS }; diff --git a/queue-2.6.31/usb-usbtmc-repeat-usb_bulk_msg-until-whole-message-is-transfered.patch b/queue-2.6.31/usb-usbtmc-repeat-usb_bulk_msg-until-whole-message-is-transfered.patch new file mode 100644 index 00000000000..32123976a67 --- /dev/null +++ b/queue-2.6.31/usb-usbtmc-repeat-usb_bulk_msg-until-whole-message-is-transfered.patch @@ -0,0 +1,48 @@ +From ec412b92dbe3ea839716853eea058d1bcc5e6ca4 Mon Sep 17 00:00:00 2001 +From: Andre Herms +Date: Thu, 19 Nov 2009 18:14:49 +0100 +Subject: USB: usbtmc: repeat usb_bulk_msg until whole message is transfered + +From: Andre Herms + +commit ec412b92dbe3ea839716853eea058d1bcc5e6ca4 upstream. + +usb_bulk_msg() transfers only bytes up to the maximum packet size. +It must be repeated by the usbtmc driver until all bytes of a TMC message +are transfered. + +Without this patch, ETIMEDOUT is reported when writing TMC messages +larger than the maximum USB bulk size and the transfer remains incomplete. +The user will notice that the device hangs and must be reset by either closing +the application or pulling the plug. + +Signed-off-by: Andre Herms +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/class/usbtmc.c | 14 ++++++++++---- + 1 file changed, 10 insertions(+), 4 deletions(-) + +--- a/drivers/usb/class/usbtmc.c ++++ b/drivers/usb/class/usbtmc.c +@@ -545,10 +545,16 @@ static ssize_t usbtmc_write(struct file + n_bytes = roundup(12 + this_part, 4); + memset(buffer + 12 + this_part, 0, n_bytes - (12 + this_part)); + +- retval = usb_bulk_msg(data->usb_dev, +- usb_sndbulkpipe(data->usb_dev, +- data->bulk_out), +- buffer, n_bytes, &actual, USBTMC_TIMEOUT); ++ do { ++ retval = usb_bulk_msg(data->usb_dev, ++ usb_sndbulkpipe(data->usb_dev, ++ data->bulk_out), ++ buffer, n_bytes, ++ &actual, USBTMC_TIMEOUT); ++ if (retval != 0) ++ break; ++ n_bytes -= actual; ++ } while (n_bytes); + + data->bTag_last_write = data->bTag; + data->bTag++; diff --git a/queue-2.6.31/v4l-dvb-fix-test-in-copy_reg_bits.patch b/queue-2.6.31/v4l-dvb-fix-test-in-copy_reg_bits.patch new file mode 100644 index 00000000000..586f6779801 --- /dev/null +++ b/queue-2.6.31/v4l-dvb-fix-test-in-copy_reg_bits.patch @@ -0,0 +1,32 @@ +From c95a419a5604ec8a23cd73f61e9bb151e8cbe89b Mon Sep 17 00:00:00 2001 +From: Roel Kluin +Date: Fri, 20 Nov 2009 15:34:13 -0300 +Subject: V4L/DVB: Fix test in copy_reg_bits() + +From: Roel Kluin + +commit c95a419a5604ec8a23cd73f61e9bb151e8cbe89b upstream. + +The reg_pair2[j].reg was tested twice. + +Signed-off-by: Roel Kluin +Acked-by: Michael Krufky +Signed-off-by: Andrew Morton +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/common/tuners/mxl5007t.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/media/common/tuners/mxl5007t.c ++++ b/drivers/media/common/tuners/mxl5007t.c +@@ -196,7 +196,7 @@ static void copy_reg_bits(struct reg_pai + i = j = 0; + + while (reg_pair1[i].reg || reg_pair1[i].val) { +- while (reg_pair2[j].reg || reg_pair2[j].reg) { ++ while (reg_pair2[j].reg || reg_pair2[j].val) { + if (reg_pair1[i].reg != reg_pair2[j].reg) { + j++; + continue; diff --git a/queue-2.6.31/x86-add-new-intel-cpu-cache-size-descriptors.patch b/queue-2.6.31/x86-add-new-intel-cpu-cache-size-descriptors.patch new file mode 100644 index 00000000000..c88a5f80d7e --- /dev/null +++ b/queue-2.6.31/x86-add-new-intel-cpu-cache-size-descriptors.patch @@ -0,0 +1,34 @@ +From 85160b92fbd35321104819283c91bfed2b553e3c Mon Sep 17 00:00:00 2001 +From: Dave Jones +Date: Tue, 10 Nov 2009 13:49:24 -0500 +Subject: x86: Add new Intel CPU cache size descriptors + +From: Dave Jones + +commit 85160b92fbd35321104819283c91bfed2b553e3c upstream. + +The latest rev of Intel doc AP-485 details new cache descriptors +that we don't yet support. 12MB, 18MB and 24MB 24-way assoc L3 +caches. + +Signed-off-by: Dave Jones +LKML-Reference: <20091110184924.GA20337@redhat.com> +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/cpu/intel_cacheinfo.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/arch/x86/kernel/cpu/intel_cacheinfo.c ++++ b/arch/x86/kernel/cpu/intel_cacheinfo.c +@@ -101,6 +101,9 @@ static const struct _cache_table __cpuin + { 0xe2, LVL_3, 2048 }, /* 16-way set assoc, 64 byte line size */ + { 0xe3, LVL_3, 4096 }, /* 16-way set assoc, 64 byte line size */ + { 0xe4, LVL_3, 8192 }, /* 16-way set assoc, 64 byte line size */ ++ { 0xea, LVL_3, 12288 }, /* 24-way set assoc, 64 byte line size */ ++ { 0xeb, LVL_3, 18432 }, /* 24-way set assoc, 64 byte line size */ ++ { 0xec, LVL_3, 24576 }, /* 24-way set assoc, 64 byte line size */ + { 0x00, 0, 0} + }; + diff --git a/queue-2.6.31/x86-amd-iommu-attach-devices-to-pre-allocated-domains-early.patch b/queue-2.6.31/x86-amd-iommu-attach-devices-to-pre-allocated-domains-early.patch new file mode 100644 index 00000000000..a4bb4bde753 --- /dev/null +++ b/queue-2.6.31/x86-amd-iommu-attach-devices-to-pre-allocated-domains-early.patch @@ -0,0 +1,51 @@ +From be831297716036de5b24308447ecb69f1706a846 Mon Sep 17 00:00:00 2001 +From: Joerg Roedel +Date: Mon, 23 Nov 2009 12:50:00 +0100 +Subject: x86/amd-iommu: attach devices to pre-allocated domains early + +From: Joerg Roedel + +commit be831297716036de5b24308447ecb69f1706a846 upstream. + +For some devices the ACPI table may define unity map +requirements which must me met when the IOMMU is enabled. So +we need to attach devices to their domains as early as +possible so that these mappings are in place when needed. +This patch assigns the domains right after they are +allocated. Otherwise this can result in I/O page faults +before a driver binds to a device and BIOS is still using +it. + +Signed-off-by: Joerg Roedel +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/amd_iommu.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +--- a/arch/x86/kernel/amd_iommu.c ++++ b/arch/x86/kernel/amd_iommu.c +@@ -1873,10 +1873,10 @@ static void prealloc_protection_domains( + struct pci_dev *dev = NULL; + struct dma_ops_domain *dma_dom; + struct amd_iommu *iommu; +- u16 devid; ++ u16 devid, __devid; + + while ((dev = pci_get_device(PCI_ANY_ID, PCI_ANY_ID, dev)) != NULL) { +- devid = calc_devid(dev->bus->number, dev->devfn); ++ __devid = devid = calc_devid(dev->bus->number, dev->devfn); + if (devid > amd_iommu_last_bdf) + continue; + devid = amd_iommu_alias_table[devid]; +@@ -1891,6 +1891,10 @@ static void prealloc_protection_domains( + init_unity_mappings_for_device(dma_dom, devid); + dma_dom->target_dev = devid; + ++ attach_device(iommu, &dma_dom->domain, devid); ++ if (__devid != devid) ++ attach_device(iommu, &dma_dom->domain, __devid); ++ + list_add_tail(&dma_dom->list, &iommu_pd_list); + } + } diff --git a/queue-2.6.31/x86-amd-iommu-un__init-iommu_setup_msi.patch b/queue-2.6.31/x86-amd-iommu-un__init-iommu_setup_msi.patch new file mode 100644 index 00000000000..a85ee1996a6 --- /dev/null +++ b/queue-2.6.31/x86-amd-iommu-un__init-iommu_setup_msi.patch @@ -0,0 +1,30 @@ +From 9f800de38b05d84809e89f16671d636a140eede7 Mon Sep 17 00:00:00 2001 +From: Joerg Roedel +Date: Mon, 23 Nov 2009 12:45:25 +0100 +Subject: x86/amd-iommu: un__init iommu_setup_msi + +From: Joerg Roedel + +commit 9f800de38b05d84809e89f16671d636a140eede7 upstream. + +This function may be called on the resume path and can not +be dropped after booting. + +Signed-off-by: Joerg Roedel +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/amd_iommu_init.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/x86/kernel/amd_iommu_init.c ++++ b/arch/x86/kernel/amd_iommu_init.c +@@ -915,7 +915,7 @@ static int __init init_iommu_all(struct + * + ****************************************************************************/ + +-static int __init iommu_setup_msi(struct amd_iommu *iommu) ++static int iommu_setup_msi(struct amd_iommu *iommu) + { + int r; + diff --git a/queue-2.6.31/x86-apic-enable-lapic-nmi-watchdog-on-amd-family-11h.patch b/queue-2.6.31/x86-apic-enable-lapic-nmi-watchdog-on-amd-family-11h.patch new file mode 100644 index 00000000000..250e73645a7 --- /dev/null +++ b/queue-2.6.31/x86-apic-enable-lapic-nmi-watchdog-on-amd-family-11h.patch @@ -0,0 +1,47 @@ +From 7d1849aff6687a135a8da3a75e32a00e3137a5e2 Mon Sep 17 00:00:00 2001 +From: Mikael Pettersson +Date: Thu, 3 Dec 2009 15:52:44 +0100 +Subject: x86, apic: Enable lapic nmi watchdog on AMD Family 11h + +From: Mikael Pettersson + +commit 7d1849aff6687a135a8da3a75e32a00e3137a5e2 upstream. + +The x86 lapic nmi watchdog does not recognize AMD Family 11h, +resulting in: + + NMI watchdog: CPU not supported + +As far as I can see from available documentation (the BKDM), +family 11h looks identical to family 10h as far as the PMU +is concerned. + +Extending the check to accept family 11h results in: + + Testing NMI watchdog ... OK. + +I've been running with this change on a Turion X2 Ultra ZM-82 +laptop for a couple of weeks now without problems. + +Signed-off-by: Mikael Pettersson +Cc: Andreas Herrmann +Cc: Joerg Roedel +LKML-Reference: <19223.53436.931768.278021@pilspetsen.it.uu.se> +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/cpu/perfctr-watchdog.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/x86/kernel/cpu/perfctr-watchdog.c ++++ b/arch/x86/kernel/cpu/perfctr-watchdog.c +@@ -711,7 +711,7 @@ static void probe_nmi_watchdog(void) + switch (boot_cpu_data.x86_vendor) { + case X86_VENDOR_AMD: + if (boot_cpu_data.x86 != 6 && boot_cpu_data.x86 != 15 && +- boot_cpu_data.x86 != 16) ++ boot_cpu_data.x86 != 16 && boot_cpu_data.x86 != 17) + return; + wd_ops = &k7_wd_ops; + break; diff --git a/queue-2.6.31/x86-asus-p4s800-reboot-bios-quirk.patch b/queue-2.6.31/x86-asus-p4s800-reboot-bios-quirk.patch new file mode 100644 index 00000000000..82446c32a5f --- /dev/null +++ b/queue-2.6.31/x86-asus-p4s800-reboot-bios-quirk.patch @@ -0,0 +1,63 @@ +From 4832ddda2ec4df96ea1eed334ae2dbd65fc1f541 Mon Sep 17 00:00:00 2001 +From: Leann Ogasawara +Date: Fri, 4 Dec 2009 15:42:22 -0800 +Subject: x86: ASUS P4S800 reboot=bios quirk + +From: Leann Ogasawara + +commit 4832ddda2ec4df96ea1eed334ae2dbd65fc1f541 upstream. + +Bug reporter noted their system with an ASUS P4S800 motherboard would +hang when rebooting unless reboot=b was specified. Their dmidecode +didn't contain descriptive System Information for Manufacturer or +Product Name, so I used their Base Board Information to create a +reboot quirk patch. The bug reporter confirmed this patch resolves +the reboot hang. + +Handle 0x0001, DMI type 1, 25 bytes +System Information + Manufacturer: System Manufacturer + Product Name: System Name + Version: System Version + Serial Number: SYS-1234567890 + UUID: E0BFCD8B-7948-D911-A953-E486B4EEB67F + Wake-up Type: Power Switch + +Handle 0x0002, DMI type 2, 8 bytes +Base Board Information + Manufacturer: ASUSTeK Computer INC. + Product Name: P4S800 + Version: REV 1.xx + Serial Number: xxxxxxxxxxx + +BugLink: http://bugs.launchpad.net/bugs/366682 + +ASUS P4S800 will hang when rebooting unless reboot=b is specified. +Add a quirk to reboot through the bios. + +Signed-off-by: Leann Ogasawara +LKML-Reference: <1259972107.4629.275.camel@emiko> +Signed-off-by: H. Peter Anvin +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/reboot.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/arch/x86/kernel/reboot.c ++++ b/arch/x86/kernel/reboot.c +@@ -257,6 +257,14 @@ static struct dmi_system_id __initdata r + DMI_MATCH(DMI_PRODUCT_NAME, "SBC-FITPC2"), + }, + }, ++ { /* Handle problems with rebooting on ASUS P4S800 */ ++ .callback = set_bios_reboot, ++ .ident = "ASUS P4S800", ++ .matches = { ++ DMI_MATCH(DMI_BOARD_VENDOR, "ASUSTeK Computer INC."), ++ DMI_MATCH(DMI_BOARD_NAME, "P4S800"), ++ }, ++ }, + { } + }; + diff --git a/queue-2.6.31/x86-calgary-iommu-quirk-find-nearest-matching-calgary-while-walking-up-the-pci-tree.patch b/queue-2.6.31/x86-calgary-iommu-quirk-find-nearest-matching-calgary-while-walking-up-the-pci-tree.patch new file mode 100644 index 00000000000..56628970153 --- /dev/null +++ b/queue-2.6.31/x86-calgary-iommu-quirk-find-nearest-matching-calgary-while-walking-up-the-pci-tree.patch @@ -0,0 +1,83 @@ +From 4528752f49c1f4025473d12bc5fa9181085c3f22 Mon Sep 17 00:00:00 2001 +From: Darrick J. Wong +Date: Wed, 2 Dec 2009 15:05:56 -0800 +Subject: x86, Calgary IOMMU quirk: Find nearest matching Calgary while walking up the PCI tree + +From: Darrick J. Wong + +commit 4528752f49c1f4025473d12bc5fa9181085c3f22 upstream. + +On a multi-node x3950M2 system, there's a slight oddity in the +PCI device tree for all secondary nodes: + + 30:1e.0 PCI bridge: Intel Corporation 82801 PCI Bridge (rev e1) + \-33:00.0 PCI bridge: IBM CalIOC2 PCI-E Root Port (rev 01) + \-34:00.0 RAID bus controller: LSI Logic / Symbios Logic MegaRAID SAS 1078 (rev 04) + +...as compared to the primary node: + + 00:1e.0 PCI bridge: Intel Corporation 82801 PCI Bridge (rev e1) + \-01:00.0 VGA compatible controller: ATI Technologies Inc ES1000 (rev 02) + 03:00.0 PCI bridge: IBM CalIOC2 PCI-E Root Port (rev 01) + \-04:00.0 RAID bus controller: LSI Logic / Symbios Logic MegaRAID SAS 1078 (rev 04) + +In both nodes, the LSI RAID controller hangs off a CalIOC2 +device, but on the secondary nodes, the BIOS hides the VGA +device and substitutes the device tree ending with the disk +controller. + +It would seem that Calgary devices don't necessarily appear at +the top of the PCI tree, which means that the current code to +find the Calgary IOMMU that goes with a particular device is +buggy. + +Rather than walk all the way to the top of the PCI +device tree and try to match bus number with Calgary descriptor, +the code needs to examine each parent of the particular device; +if it encounters a Calgary with a matching bus number, simply +use that. + +Otherwise, we BUG() when the bus number of the Calgary doesn't +match the bus number of whatever's at the top of the device tree. + +Extra note: This patch appears to work correctly for the x3950 +that came before the x3950 M2. + +Signed-off-by: Darrick J. Wong +Acked-by: Muli Ben-Yehuda +Cc: FUJITA Tomonori +Cc: Joerg Roedel +Cc: Yinghai Lu +Cc: Jon D. Mason +Cc: Corinna Schultz +LKML-Reference: <20091202230556.GG10295@tux1.beaverton.ibm.com> +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/pci-calgary_64.c | 12 +++++++----- + 1 file changed, 7 insertions(+), 5 deletions(-) + +--- a/arch/x86/kernel/pci-calgary_64.c ++++ b/arch/x86/kernel/pci-calgary_64.c +@@ -318,13 +318,15 @@ static inline struct iommu_table *find_i + + pdev = to_pci_dev(dev); + ++ /* search up the device tree for an iommu */ + pbus = pdev->bus; +- +- /* is the device behind a bridge? Look for the root bus */ +- while (pbus->parent) ++ do { ++ tbl = pci_iommu(pbus); ++ if (tbl && tbl->it_busno == pbus->number) ++ break; ++ tbl = NULL; + pbus = pbus->parent; +- +- tbl = pci_iommu(pbus); ++ } while (pbus); + + BUG_ON(tbl && (tbl->it_busno != pbus->number)); + diff --git a/queue-2.6.31/x86-fix-iommu-nodac-parameter-handling.patch b/queue-2.6.31/x86-fix-iommu-nodac-parameter-handling.patch new file mode 100644 index 00000000000..73984ba7c79 --- /dev/null +++ b/queue-2.6.31/x86-fix-iommu-nodac-parameter-handling.patch @@ -0,0 +1,33 @@ +From 2ae8bb75db1f3de422eb5898f2a063c46c36dba8 Mon Sep 17 00:00:00 2001 +From: Tejun Heo +Date: Mon, 26 Oct 2009 15:41:46 +0100 +Subject: x86: Fix iommu=nodac parameter handling + +From: Tejun Heo + +commit 2ae8bb75db1f3de422eb5898f2a063c46c36dba8 upstream. + +iommu=nodac should forbid dac instead of enabling it. Fix it. + +Signed-off-by: Tejun Heo +Acked-by: FUJITA Tomonori +Cc: Matteo Frigo +LKML-Reference: <4AE5B52A.4050408@kernel.org> +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/pci-dma.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/x86/kernel/pci-dma.c ++++ b/arch/x86/kernel/pci-dma.c +@@ -203,7 +203,7 @@ static __init int iommu_setup(char *p) + if (!strncmp(p, "allowdac", 8)) + forbid_dac = 0; + if (!strncmp(p, "nodac", 5)) +- forbid_dac = -1; ++ forbid_dac = 1; + if (!strncmp(p, "usedac", 6)) { + forbid_dac = -1; + return 1; diff --git a/queue-2.6.31/x86-fix-typo-in-intel-cpu-cache-size-descriptor.patch b/queue-2.6.31/x86-fix-typo-in-intel-cpu-cache-size-descriptor.patch new file mode 100644 index 00000000000..add25ad893a --- /dev/null +++ b/queue-2.6.31/x86-fix-typo-in-intel-cpu-cache-size-descriptor.patch @@ -0,0 +1,34 @@ +From e02e0e1a130b9ca37c5186d38ad4b3aaf58bb149 Mon Sep 17 00:00:00 2001 +From: Dave Jones +Date: Tue, 10 Nov 2009 15:01:20 -0500 +Subject: x86: Fix typo in Intel CPU cache size descriptor + +From: Dave Jones + +commit e02e0e1a130b9ca37c5186d38ad4b3aaf58bb149 upstream. + +I double-checked the datasheet. One of the existing +descriptors has a typo: it should be 2MB not 2038 KB. + +Signed-off-by: Dave Jones +Cc: # .3x.x: 85160b9: x86: Add new Intel CPU cache size descriptors +Cc: # .3x.x +LKML-Reference: <20091110200120.GA27090@redhat.com> +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/cpu/intel_cacheinfo.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/x86/kernel/cpu/intel_cacheinfo.c ++++ b/arch/x86/kernel/cpu/intel_cacheinfo.c +@@ -93,7 +93,7 @@ static const struct _cache_table __cpuin + { 0xd1, LVL_3, 1024 }, /* 4-way set assoc, 64 byte line size */ + { 0xd2, LVL_3, 2048 }, /* 4-way set assoc, 64 byte line size */ + { 0xd6, LVL_3, 1024 }, /* 8-way set assoc, 64 byte line size */ +- { 0xd7, LVL_3, 2038 }, /* 8-way set assoc, 64 byte line size */ ++ { 0xd7, LVL_3, 2048 }, /* 8-way set assoc, 64 byte line size */ + { 0xd8, LVL_3, 4096 }, /* 12-way set assoc, 64 byte line size */ + { 0xdc, LVL_3, 2048 }, /* 12-way set assoc, 64 byte line size */ + { 0xdd, LVL_3, 4096 }, /* 12-way set assoc, 64 byte line size */ diff --git a/queue-2.6.31/x86-gart-pci-gart_64.c-use-correct-length-in-strncmp.patch b/queue-2.6.31/x86-gart-pci-gart_64.c-use-correct-length-in-strncmp.patch new file mode 100644 index 00000000000..6dd29d3baa6 --- /dev/null +++ b/queue-2.6.31/x86-gart-pci-gart_64.c-use-correct-length-in-strncmp.patch @@ -0,0 +1,29 @@ +From 41855b77547fa18d90ed6a5d322983d3fdab1959 Mon Sep 17 00:00:00 2001 +From: Joe Perches +Date: Mon, 9 Nov 2009 17:58:50 -0800 +Subject: x86: GART: pci-gart_64.c: Use correct length in strncmp + +From: Joe Perches + +commit 41855b77547fa18d90ed6a5d322983d3fdab1959 upstream. + +Signed-off-by: Joe Perches +LKML-Reference: <1257818330.12852.72.camel@Joe-Laptop.home> +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/pci-gart_64.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/x86/kernel/pci-gart_64.c ++++ b/arch/x86/kernel/pci-gart_64.c +@@ -856,7 +856,7 @@ void __init gart_parse_options(char *p) + #endif + if (isdigit(*p) && get_option(&p, &arg)) + iommu_size = arg; +- if (!strncmp(p, "fullflush", 8)) ++ if (!strncmp(p, "fullflush", 9)) + iommu_fullflush = 1; + if (!strncmp(p, "nofullflush", 11)) + iommu_fullflush = 0;