From: Greg Kroah-Hartman Date: Tue, 27 Jul 2010 22:49:09 +0000 (-0700) Subject: .34 patches X-Git-Tag: v2.6.27.49~40 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=c32dab2d74343e52078fd09f8bf32755304b2861;p=thirdparty%2Fkernel%2Fstable-queue.git .34 patches --- diff --git a/queue-2.6.34/alsa-hda-add-macbook-5-2-quirk.patch b/queue-2.6.34/alsa-hda-add-macbook-5-2-quirk.patch new file mode 100644 index 00000000000..8aa83a5e8c0 --- /dev/null +++ b/queue-2.6.34/alsa-hda-add-macbook-5-2-quirk.patch @@ -0,0 +1,31 @@ +From 3bfea98ff73d377ffce0d4c7f938b7ef958cdb35 Mon Sep 17 00:00:00 2001 +From: Luke Yelavich +Date: Tue, 22 Jun 2010 11:04:19 +1000 +Subject: ALSA: hda - Add Macbook 5,2 quirk + +From: Luke Yelavich + +commit 3bfea98ff73d377ffce0d4c7f938b7ef958cdb35 upstream. + +BugLink: https://bugs.launchpad.net/bugs/463178 + +Set Macbook 5,2 (106b:4a00) hardware to use ALC885_MB5 + +Signed-off-by: Luke Yelavich +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_realtek.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -9400,6 +9400,7 @@ static struct snd_pci_quirk alc882_ssid_ + SND_PCI_QUIRK(0x106b, 0x3e00, "iMac 24 Aluminum", ALC885_IMAC24), + SND_PCI_QUIRK(0x106b, 0x4900, "iMac 9,1 Aluminum", ALC885_IMAC91), + SND_PCI_QUIRK(0x106b, 0x3f00, "Macbook 5,1", ALC885_MB5), ++ SND_PCI_QUIRK(0x106b, 0x4a00, "Macbook 5,2", ALC885_MB5), + /* FIXME: HP jack sense seems not working for MBP 5,1 or 5,2, + * so apparently no perfect solution yet + */ diff --git a/queue-2.6.34/alsa-hda-don-t-check-capture-source-mixer-if-no-adc-is-available.patch b/queue-2.6.34/alsa-hda-don-t-check-capture-source-mixer-if-no-adc-is-available.patch new file mode 100644 index 00000000000..fa2ee864bff --- /dev/null +++ b/queue-2.6.34/alsa-hda-don-t-check-capture-source-mixer-if-no-adc-is-available.patch @@ -0,0 +1,53 @@ +From fbe618f216830f47b183858c3380d4767b1ad02f Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Fri, 11 Jun 2010 11:24:58 +0200 +Subject: ALSA: hda - Don't check capture source mixer if no ADC is available + +From: Takashi Iwai + +commit fbe618f216830f47b183858c3380d4767b1ad02f upstream. + +With multiple codec configurations, some codec might have no ADC, thus +it keeps spec->adc_nids = NULL. This causes an Oops in alc_build_controls(). + +Reference: kernel bug #16156 + https://bugzilla.kernel.org/show_bug.cgi?id=16156 + +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_realtek.c | 22 ++++++++++++---------- + 1 file changed, 12 insertions(+), 10 deletions(-) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -2550,16 +2550,18 @@ static int alc_build_controls(struct hda + } + + /* assign Capture Source enums to NID */ +- kctl = snd_hda_find_mixer_ctl(codec, "Capture Source"); +- if (!kctl) +- kctl = snd_hda_find_mixer_ctl(codec, "Input Source"); +- for (i = 0; kctl && i < kctl->count; i++) { +- hda_nid_t *nids = spec->capsrc_nids; +- if (!nids) +- nids = spec->adc_nids; +- err = snd_hda_add_nid(codec, kctl, i, nids[i]); +- if (err < 0) +- return err; ++ if (spec->capsrc_nids || spec->adc_nids) { ++ kctl = snd_hda_find_mixer_ctl(codec, "Capture Source"); ++ if (!kctl) ++ kctl = snd_hda_find_mixer_ctl(codec, "Input Source"); ++ for (i = 0; kctl && i < kctl->count; i++) { ++ hda_nid_t *nids = spec->capsrc_nids; ++ if (!nids) ++ nids = spec->adc_nids; ++ err = snd_hda_add_nid(codec, kctl, i, nids[i]); ++ if (err < 0) ++ return err; ++ } + } + if (spec->cap_mixer) { + const char *kname = kctl ? kctl->id.name : NULL; diff --git a/queue-2.6.34/alsa-hda-restore-cleared-pin-controls-on-resume.patch b/queue-2.6.34/alsa-hda-restore-cleared-pin-controls-on-resume.patch new file mode 100644 index 00000000000..6ff67dc1a73 --- /dev/null +++ b/queue-2.6.34/alsa-hda-restore-cleared-pin-controls-on-resume.patch @@ -0,0 +1,108 @@ +From ac0547dc62e67a3e0b0c1628b6e49efba8f517db Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Mon, 5 Jul 2010 16:50:13 +0200 +Subject: ALSA: hda - Restore cleared pin controls on resume + +From: Takashi Iwai + +commit ac0547dc62e67a3e0b0c1628b6e49efba8f517db upstream. + +Many codecs now clear the pin controls at suspend via snd_hda_shutup_pins() +for reducing the click noise at power-off. But this leaves some pins +uninitialized, and they'll be never recovered after resume. + +This patch adds the proper recovery of cleared pin controls on resume. +Also it adds a check of bus->shutdown so that pins won't be cleared at +module unloading. + +Reference: Kernel bug 16339 + http://bugzilla.kernel.org/show_bug.cgi?id=16339 + +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/hda_codec.c | 27 +++++++++++++++++++++++++++ + sound/pci/hda/hda_codec.h | 5 ++++- + 2 files changed, 31 insertions(+), 1 deletion(-) + +--- a/sound/pci/hda/hda_codec.c ++++ b/sound/pci/hda/hda_codec.c +@@ -784,6 +784,9 @@ static int read_pin_defaults(struct hda_ + pin->nid = nid; + pin->cfg = snd_hda_codec_read(codec, nid, 0, + AC_VERB_GET_CONFIG_DEFAULT, 0); ++ pin->ctrl = snd_hda_codec_read(codec, nid, 0, ++ AC_VERB_GET_PIN_WIDGET_CONTROL, ++ 0); + } + return 0; + } +@@ -912,15 +915,38 @@ static void restore_pincfgs(struct hda_c + void snd_hda_shutup_pins(struct hda_codec *codec) + { + int i; ++ /* don't shut up pins when unloading the driver; otherwise it breaks ++ * the default pin setup at the next load of the driver ++ */ ++ if (codec->bus->shutdown) ++ return; + for (i = 0; i < codec->init_pins.used; i++) { + struct hda_pincfg *pin = snd_array_elem(&codec->init_pins, i); + /* use read here for syncing after issuing each verb */ + snd_hda_codec_read(codec, pin->nid, 0, + AC_VERB_SET_PIN_WIDGET_CONTROL, 0); + } ++ codec->pins_shutup = 1; + } + EXPORT_SYMBOL_HDA(snd_hda_shutup_pins); + ++/* Restore the pin controls cleared previously via snd_hda_shutup_pins() */ ++static void restore_shutup_pins(struct hda_codec *codec) ++{ ++ int i; ++ if (!codec->pins_shutup) ++ return; ++ if (codec->bus->shutdown) ++ return; ++ for (i = 0; i < codec->init_pins.used; i++) { ++ struct hda_pincfg *pin = snd_array_elem(&codec->init_pins, i); ++ snd_hda_codec_write(codec, pin->nid, 0, ++ AC_VERB_SET_PIN_WIDGET_CONTROL, ++ pin->ctrl); ++ } ++ codec->pins_shutup = 0; ++} ++ + static void init_hda_cache(struct hda_cache_rec *cache, + unsigned int record_size); + static void free_hda_cache(struct hda_cache_rec *cache); +@@ -2858,6 +2884,7 @@ static void hda_call_codec_resume(struct + codec->afg ? codec->afg : codec->mfg, + AC_PWRST_D0); + restore_pincfgs(codec); /* restore all current pin configs */ ++ restore_shutup_pins(codec); + hda_exec_init_verbs(codec); + if (codec->patch_ops.resume) + codec->patch_ops.resume(codec); +--- a/sound/pci/hda/hda_codec.h ++++ b/sound/pci/hda/hda_codec.h +@@ -821,6 +821,7 @@ struct hda_codec { + unsigned int pin_amp_workaround:1; /* pin out-amp takes index + * (e.g. Conexant codecs) + */ ++ unsigned int pins_shutup:1; /* pins are shut up */ + unsigned int no_trigger_sense:1; /* don't trigger at pin-sensing */ + #ifdef CONFIG_SND_HDA_POWER_SAVE + unsigned int power_on :1; /* current (global) power-state */ +@@ -894,7 +895,9 @@ void snd_hda_codec_resume_cache(struct h + /* the struct for codec->pin_configs */ + struct hda_pincfg { + hda_nid_t nid; +- unsigned int cfg; ++ unsigned char ctrl; /* current pin control value */ ++ unsigned char pad; /* reserved */ ++ unsigned int cfg; /* default configuration */ + }; + + unsigned int snd_hda_codec_get_pincfg(struct hda_codec *codec, hda_nid_t nid); diff --git a/queue-2.6.34/ath9k-avoid-corrupt-frames-being-forwarded-to-mac80211.patch b/queue-2.6.34/ath9k-avoid-corrupt-frames-being-forwarded-to-mac80211.patch new file mode 100644 index 00000000000..436dad034b7 --- /dev/null +++ b/queue-2.6.34/ath9k-avoid-corrupt-frames-being-forwarded-to-mac80211.patch @@ -0,0 +1,64 @@ +From 3a37495268ab45507b4cab9d4cb18c5496ab7a10 Mon Sep 17 00:00:00 2001 +From: Vivek Natarajan +Date: Tue, 27 Apr 2010 13:05:38 +0530 +Subject: ath9k: Avoid corrupt frames being forwarded to mac80211. + +From: Vivek Natarajan + +commit 3a37495268ab45507b4cab9d4cb18c5496ab7a10 upstream. + +If bit 29 is set, MAC H/W can attempt to decrypt the received aggregate +with WEP or TKIP, eventhough the received frame may be a CRC failed +corrupted frame. If this bit is set, H/W obeys key type in keycache. +If it is not set and if the key type in keycache is neither open nor +AES, H/W forces key type to be open. But bit 29 should be set to 1 +for AsyncFIFO feature to encrypt/decrypt the aggregate with WEP or TKIP. + +Reported-by: Johan Hovold +Signed-off-by: Vivek Natarajan +Signed-off-by: Ranga Rao Ravuri +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/ath/ath9k/initvals.h | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/net/wireless/ath/ath9k/initvals.h ++++ b/drivers/net/wireless/ath/ath9k/initvals.h +@@ -246,7 +246,7 @@ static const u32 ar5416Common[][2] = { + { 0x00008258, 0x00000000 }, + { 0x0000825c, 0x400000ff }, + { 0x00008260, 0x00080922 }, +- { 0x00008264, 0xa8000010 }, ++ { 0x00008264, 0x88000010 }, + { 0x00008270, 0x00000000 }, + { 0x00008274, 0x40000000 }, + { 0x00008278, 0x003e4180 }, +@@ -2766,7 +2766,7 @@ static const u32 ar9280Common_9280_2[][2 + { 0x00008258, 0x00000000 }, + { 0x0000825c, 0x400000ff }, + { 0x00008260, 0x00080922 }, +- { 0x00008264, 0xa8a00010 }, ++ { 0x00008264, 0x88a00010 }, + { 0x00008270, 0x00000000 }, + { 0x00008274, 0x40000000 }, + { 0x00008278, 0x003e4180 }, +@@ -3936,7 +3936,7 @@ static const u_int32_t ar9285Common_9285 + { 0x00008258, 0x00000000 }, + { 0x0000825c, 0x400000ff }, + { 0x00008260, 0x00080922 }, +- { 0x00008264, 0xa8a00010 }, ++ { 0x00008264, 0x88a00010 }, + { 0x00008270, 0x00000000 }, + { 0x00008274, 0x40000000 }, + { 0x00008278, 0x003e4180 }, +@@ -5073,7 +5073,7 @@ static const u_int32_t ar9287Common_9287 + { 0x00008258, 0x00000000 }, + { 0x0000825c, 0x400000ff }, + { 0x00008260, 0x00080922 }, +- { 0x00008264, 0xa8a00010 }, ++ { 0x00008264, 0x88a00010 }, + { 0x00008270, 0x00000000 }, + { 0x00008274, 0x40000000 }, + { 0x00008278, 0x003e4180 }, diff --git a/queue-2.6.34/btrfs-fix-checks-in-btrfs_ioc_clone_range.patch b/queue-2.6.34/btrfs-fix-checks-in-btrfs_ioc_clone_range.patch new file mode 100644 index 00000000000..2a81b5cd3ac --- /dev/null +++ b/queue-2.6.34/btrfs-fix-checks-in-btrfs_ioc_clone_range.patch @@ -0,0 +1,47 @@ +From 2ebc3464781ad24474abcbd2274e6254689853b5 Mon Sep 17 00:00:00 2001 +From: Dan Rosenberg +Date: Mon, 19 Jul 2010 16:58:20 -0400 +Subject: Btrfs: fix checks in BTRFS_IOC_CLONE_RANGE + +From: Dan Rosenberg + +commit 2ebc3464781ad24474abcbd2274e6254689853b5 upstream. + +1. The BTRFS_IOC_CLONE and BTRFS_IOC_CLONE_RANGE ioctls should check +whether the donor file is append-only before writing to it. + +2. The BTRFS_IOC_CLONE_RANGE ioctl appears to have an integer +overflow that allows a user to specify an out-of-bounds range to copy +from the source file (if off + len wraps around). I haven't been able +to successfully exploit this, but I'd imagine that a clever attacker +could use this to read things he shouldn't. Even if it's not +exploitable, it couldn't hurt to be safe. + +Signed-off-by: Dan Rosenberg +Signed-off-by: Chris Mason +Signed-off-by: Greg Kroah-Hartman + +--- + fs/btrfs/ioctl.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/fs/btrfs/ioctl.c ++++ b/fs/btrfs/ioctl.c +@@ -1469,7 +1469,7 @@ static noinline long btrfs_ioctl_clone(s + */ + + /* the destination must be opened for writing */ +- if (!(file->f_mode & FMODE_WRITE)) ++ if (!(file->f_mode & FMODE_WRITE) || (file->f_flags & O_APPEND)) + return -EINVAL; + + ret = mnt_want_write(file->f_path.mnt); +@@ -1522,7 +1522,7 @@ static noinline long btrfs_ioctl_clone(s + + /* determine range to clone */ + ret = -EINVAL; +- if (off >= src->i_size || off + len > src->i_size) ++ if (off + len > src->i_size || off + len < off) + goto out_unlock; + if (len == 0) + olen = len = src->i_size - off; diff --git a/queue-2.6.34/cifs-don-t-attempt-busy-file-rename-unless-it-s-in-same-directory.patch b/queue-2.6.34/cifs-don-t-attempt-busy-file-rename-unless-it-s-in-same-directory.patch new file mode 100644 index 00000000000..cd86a1263ed --- /dev/null +++ b/queue-2.6.34/cifs-don-t-attempt-busy-file-rename-unless-it-s-in-same-directory.patch @@ -0,0 +1,37 @@ +From ed0e3ace576d297a5c7015401db1060bbf677b94 Mon Sep 17 00:00:00 2001 +From: Jeff Layton +Date: Tue, 1 Jun 2010 16:21:01 -0400 +Subject: cifs: don't attempt busy-file rename unless it's in same directory + +From: Jeff Layton + +commit ed0e3ace576d297a5c7015401db1060bbf677b94 upstream. + +Busy-file renames don't actually work across directories, so we need +to limit this code to renames within the same dir. + +This fixes the bug detailed here: + + https://bugzilla.redhat.com/show_bug.cgi?id=591938 + +Signed-off-by: Jeff Layton +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman + +--- + fs/cifs/inode.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/fs/cifs/inode.c ++++ b/fs/cifs/inode.c +@@ -1389,6 +1389,10 @@ cifs_do_rename(int xid, struct dentry *f + if (rc == 0 || rc != -ETXTBSY) + return rc; + ++ /* open-file renames don't work across directories */ ++ if (to_dentry->d_parent != from_dentry->d_parent) ++ return rc; ++ + /* open the file to be renamed -- we need DELETE perms */ + rc = CIFSSMBOpen(xid, pTcon, fromPath, FILE_OPEN, DELETE, + CREATE_NOT_DIR, &srcfid, &oplock, NULL, diff --git a/queue-2.6.34/cifs-fix-a-malicious-redirect-problem-in-the-dns-lookup-code.patch b/queue-2.6.34/cifs-fix-a-malicious-redirect-problem-in-the-dns-lookup-code.patch new file mode 100644 index 00000000000..83035174e3d --- /dev/null +++ b/queue-2.6.34/cifs-fix-a-malicious-redirect-problem-in-the-dns-lookup-code.patch @@ -0,0 +1,201 @@ +From 4c0c03ca54f72fdd5912516ad0a23ec5cf01bda7 Mon Sep 17 00:00:00 2001 +From: David Howells +Date: Thu, 22 Jul 2010 12:53:18 +0100 +Subject: CIFS: Fix a malicious redirect problem in the DNS lookup code + +From: David Howells + +commit 4c0c03ca54f72fdd5912516ad0a23ec5cf01bda7 upstream. + +Fix the security problem in the CIFS filesystem DNS lookup code in which a +malicious redirect could be installed by a random user by simply adding a +result record into one of their keyrings with add_key() and then invoking a +CIFS CFS lookup [CVE-2010-2524]. + +This is done by creating an internal keyring specifically for the caching of +DNS lookups. To enforce the use of this keyring, the module init routine +creates a set of override credentials with the keyring installed as the thread +keyring and instructs request_key() to only install lookup result keys in that +keyring. + +The override is then applied around the call to request_key(). + +This has some additional benefits when a kernel service uses this module to +request a key: + + (1) The result keys are owned by root, not the user that caused the lookup. + + (2) The result keys don't pop up in the user's keyrings. + + (3) The result keys don't come out of the quota of the user that caused the + lookup. + +The keyring can be viewed as root by doing cat /proc/keys: + +2a0ca6c3 I----- 1 perm 1f030000 0 0 keyring .dns_resolver: 1/4 + +It can then be listed with 'keyctl list' by root. + + # keyctl list 0x2a0ca6c3 + 1 key in keyring: + 726766307: --alswrv 0 0 dns_resolver: foo.bar.com + +Signed-off-by: David Howells +Reviewed-and-Tested-by: Jeff Layton +Acked-by: Steve French +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + fs/cifs/cifsfs.c | 6 ++-- + fs/cifs/dns_resolve.c | 69 ++++++++++++++++++++++++++++++++++++++++++++++++++ + fs/cifs/dns_resolve.h | 4 +- + 3 files changed, 74 insertions(+), 5 deletions(-) + +--- a/fs/cifs/cifsfs.c ++++ b/fs/cifs/cifsfs.c +@@ -1046,7 +1046,7 @@ init_cifs(void) + goto out_unregister_filesystem; + #endif + #ifdef CONFIG_CIFS_DFS_UPCALL +- rc = register_key_type(&key_type_dns_resolver); ++ rc = cifs_init_dns_resolver(); + if (rc) + goto out_unregister_key_type; + #endif +@@ -1058,7 +1058,7 @@ init_cifs(void) + + out_unregister_resolver_key: + #ifdef CONFIG_CIFS_DFS_UPCALL +- unregister_key_type(&key_type_dns_resolver); ++ cifs_exit_dns_resolver(); + out_unregister_key_type: + #endif + #ifdef CONFIG_CIFS_UPCALL +@@ -1084,7 +1084,7 @@ exit_cifs(void) + cifs_proc_clean(); + #ifdef CONFIG_CIFS_DFS_UPCALL + cifs_dfs_release_automount_timer(); +- unregister_key_type(&key_type_dns_resolver); ++ cifs_exit_dns_resolver(); + #endif + #ifdef CONFIG_CIFS_UPCALL + unregister_key_type(&cifs_spnego_key_type); +--- a/fs/cifs/dns_resolve.c ++++ b/fs/cifs/dns_resolve.c +@@ -24,12 +24,16 @@ + */ + + #include ++#include ++#include + #include + #include "dns_resolve.h" + #include "cifsglob.h" + #include "cifsproto.h" + #include "cifs_debug.h" + ++static const struct cred *dns_resolver_cache; ++ + /* Checks if supplied name is IP address + * returns: + * 1 - name is IP +@@ -94,6 +98,7 @@ struct key_type key_type_dns_resolver = + int + dns_resolve_server_name_to_ip(const char *unc, char **ip_addr) + { ++ const struct cred *saved_cred; + int rc = -EAGAIN; + struct key *rkey = ERR_PTR(-EAGAIN); + char *name; +@@ -133,8 +138,15 @@ dns_resolve_server_name_to_ip(const char + goto skip_upcall; + } + ++ saved_cred = override_creds(dns_resolver_cache); + rkey = request_key(&key_type_dns_resolver, name, ""); ++ revert_creds(saved_cred); + if (!IS_ERR(rkey)) { ++ if (!(rkey->perm & KEY_USR_VIEW)) { ++ down_read(&rkey->sem); ++ rkey->perm |= KEY_USR_VIEW; ++ up_read(&rkey->sem); ++ } + len = rkey->type_data.x[0]; + data = rkey->payload.data; + } else { +@@ -165,4 +177,61 @@ out: + return rc; + } + ++int __init cifs_init_dns_resolver(void) ++{ ++ struct cred *cred; ++ struct key *keyring; ++ int ret; ++ ++ printk(KERN_NOTICE "Registering the %s key type\n", ++ key_type_dns_resolver.name); ++ ++ /* create an override credential set with a special thread keyring in ++ * which DNS requests are cached ++ * ++ * this is used to prevent malicious redirections from being installed ++ * with add_key(). ++ */ ++ cred = prepare_kernel_cred(NULL); ++ if (!cred) ++ return -ENOMEM; ++ ++ keyring = key_alloc(&key_type_keyring, ".dns_resolver", 0, 0, cred, ++ (KEY_POS_ALL & ~KEY_POS_SETATTR) | ++ KEY_USR_VIEW | KEY_USR_READ, ++ KEY_ALLOC_NOT_IN_QUOTA); ++ if (IS_ERR(keyring)) { ++ ret = PTR_ERR(keyring); ++ goto failed_put_cred; ++ } ++ ++ ret = key_instantiate_and_link(keyring, NULL, 0, NULL, NULL); ++ if (ret < 0) ++ goto failed_put_key; ++ ++ ret = register_key_type(&key_type_dns_resolver); ++ if (ret < 0) ++ goto failed_put_key; ++ ++ /* instruct request_key() to use this special keyring as a cache for ++ * the results it looks up */ ++ cred->thread_keyring = keyring; ++ cred->jit_keyring = KEY_REQKEY_DEFL_THREAD_KEYRING; ++ dns_resolver_cache = cred; ++ return 0; ++ ++failed_put_key: ++ key_put(keyring); ++failed_put_cred: ++ put_cred(cred); ++ return ret; ++} + ++void __exit cifs_exit_dns_resolver(void) ++{ ++ key_revoke(dns_resolver_cache->thread_keyring); ++ unregister_key_type(&key_type_dns_resolver); ++ put_cred(dns_resolver_cache); ++ printk(KERN_NOTICE "Unregistered %s key type\n", ++ key_type_dns_resolver.name); ++} +--- a/fs/cifs/dns_resolve.h ++++ b/fs/cifs/dns_resolve.h +@@ -24,8 +24,8 @@ + #define _DNS_RESOLVE_H + + #ifdef __KERNEL__ +-#include +-extern struct key_type key_type_dns_resolver; ++extern int __init cifs_init_dns_resolver(void); ++extern void __exit cifs_exit_dns_resolver(void); + extern int dns_resolve_server_name_to_ip(const char *unc, char **ip_addr); + #endif /* KERNEL */ + diff --git a/queue-2.6.34/cifs-remove-bogus-first_time-check-in-ntlmv2-session-setup-code.patch b/queue-2.6.34/cifs-remove-bogus-first_time-check-in-ntlmv2-session-setup-code.patch new file mode 100644 index 00000000000..14d0e8c2a2e --- /dev/null +++ b/queue-2.6.34/cifs-remove-bogus-first_time-check-in-ntlmv2-session-setup-code.patch @@ -0,0 +1,46 @@ +From 8a224d489454b7457105848610cfebebdec5638d Mon Sep 17 00:00:00 2001 +From: Jeff Layton +Date: Wed, 16 Jun 2010 13:40:18 -0400 +Subject: cifs: remove bogus first_time check in NTLMv2 session setup code + +From: Jeff Layton + +commit 8a224d489454b7457105848610cfebebdec5638d upstream. + +This bug appears to be the result of a cut-and-paste mistake from the +NTLMv1 code. The function to generate the MAC key was commented out, but +not the conditional above it. The conditional then ended up causing the +session setup key not to be copied to the buffer unless this was the +first session on the socket, and that made all but the first NTLMv2 +session setup fail. + +Fix this by removing the conditional and all of the commented clutter +that made it difficult to see. + +Reported-by: Gunther Deschner +Signed-off-by: Jeff Layton +Signed-off-by: Greg Kroah-Hartman + +--- + fs/cifs/sess.c | 10 +--------- + 1 file changed, 1 insertion(+), 9 deletions(-) + +--- a/fs/cifs/sess.c ++++ b/fs/cifs/sess.c +@@ -723,15 +723,7 @@ ssetup_ntlmssp_authenticate: + + /* calculate session key */ + setup_ntlmv2_rsp(ses, v2_sess_key, nls_cp); +- if (first_time) /* should this be moved into common code +- with similar ntlmv2 path? */ +- /* cifs_calculate_ntlmv2_mac_key(ses->server->mac_signing_key, +- response BB FIXME, v2_sess_key); */ +- +- /* copy session key */ +- +- /* memcpy(bcc_ptr, (char *)ntlm_session_key,LM2_SESS_KEY_SIZE); +- bcc_ptr += LM2_SESS_KEY_SIZE; */ ++ /* FIXME: calculate MAC key */ + memcpy(bcc_ptr, (char *)v2_sess_key, + sizeof(struct ntlmv2_resp)); + bcc_ptr += sizeof(struct ntlmv2_resp); diff --git a/queue-2.6.34/cmd640-fix-kernel-oops-in-test_irq-method.patch b/queue-2.6.34/cmd640-fix-kernel-oops-in-test_irq-method.patch new file mode 100644 index 00000000000..6c508459801 --- /dev/null +++ b/queue-2.6.34/cmd640-fix-kernel-oops-in-test_irq-method.patch @@ -0,0 +1,38 @@ +From a9ddabc52ce3757a4331d6c1e8bf4065333cc51b Mon Sep 17 00:00:00 2001 +From: Sergei Shtylyov +Date: Tue, 11 May 2010 00:08:03 -0700 +Subject: cmd640: fix kernel oops in test_irq() method + +From: Sergei Shtylyov + +commit a9ddabc52ce3757a4331d6c1e8bf4065333cc51b upstream. + +When implementing the test_iqr() method, I forgot that this driver is not an +ordinary PCI driver and also needs to support VLB variant of the chip. Moreover, +'hwif->dev' should be NULL, potentially causing oops in pci_read_config_byte(). + +Signed-off-by: Sergei Shtylyov +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ide/cmd640.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +--- a/drivers/ide/cmd640.c ++++ b/drivers/ide/cmd640.c +@@ -633,12 +633,10 @@ static void __init cmd640_init_dev(ide_d + + static int cmd640_test_irq(ide_hwif_t *hwif) + { +- struct pci_dev *dev = to_pci_dev(hwif->dev); + int irq_reg = hwif->channel ? ARTTIM23 : CFR; +- u8 irq_stat, irq_mask = hwif->channel ? ARTTIM23_IDE23INTR : ++ u8 irq_mask = hwif->channel ? ARTTIM23_IDE23INTR : + CFR_IDE01INTR; +- +- pci_read_config_byte(dev, irq_reg, &irq_stat); ++ u8 irq_stat = get_cmd640_reg(irq_reg); + + return (irq_stat & irq_mask) ? 1 : 0; + } diff --git a/queue-2.6.34/cpmac-do-not-leak-struct-net_device-on-phy_connect-errors.patch b/queue-2.6.34/cpmac-do-not-leak-struct-net_device-on-phy_connect-errors.patch new file mode 100644 index 00000000000..a2d7dd7f556 --- /dev/null +++ b/queue-2.6.34/cpmac-do-not-leak-struct-net_device-on-phy_connect-errors.patch @@ -0,0 +1,32 @@ +From ed770f01360b392564650bf1553ce723fa46afec Mon Sep 17 00:00:00 2001 +From: Florian Fainelli +Date: Sun, 20 Jun 2010 22:07:48 +0000 +Subject: cpmac: do not leak struct net_device on phy_connect errors + +From: Florian Fainelli + +commit ed770f01360b392564650bf1553ce723fa46afec upstream. + +If the call to phy_connect fails, we will return directly instead of freeing +the previously allocated struct net_device. + +Signed-off-by: Florian Fainelli +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/cpmac.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/net/cpmac.c ++++ b/drivers/net/cpmac.c +@@ -1182,7 +1182,8 @@ static int __devinit cpmac_probe(struct + if (netif_msg_drv(priv)) + printk(KERN_ERR "%s: Could not attach to PHY\n", + dev->name); +- return PTR_ERR(priv->phy); ++ rc = PTR_ERR(priv->phy); ++ goto fail; + } + + if ((rc = register_netdev(dev))) { diff --git a/queue-2.6.34/fb-fix-colliding-defines-for-fb-flags.patch b/queue-2.6.34/fb-fix-colliding-defines-for-fb-flags.patch new file mode 100644 index 00000000000..0119a20d58b --- /dev/null +++ b/queue-2.6.34/fb-fix-colliding-defines-for-fb-flags.patch @@ -0,0 +1,42 @@ +From b26c949755c06ec79e55a75817210083bd78fc9a Mon Sep 17 00:00:00 2001 +From: Dave Airlie +Date: Wed, 23 Jun 2010 11:35:41 +1000 +Subject: fb: fix colliding defines for fb flags. + +From: Dave Airlie + +commit b26c949755c06ec79e55a75817210083bd78fc9a upstream. + +When I added the flags I must have been using a 25 line terminal and missed the following flags. + +The collided with flag has one user in staging despite being in-tree for 5 years. + +I'm happy to push this via my drm tree unless someone really wants to do it. + +Signed-off-by: Dave Airlie +Signed-off-by: Greg Kroah-Hartman + +--- + include/linux/fb.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/include/linux/fb.h ++++ b/include/linux/fb.h +@@ -787,8 +787,6 @@ struct fb_tile_ops { + #define FBINFO_MISC_USEREVENT 0x10000 /* event request + from userspace */ + #define FBINFO_MISC_TILEBLITTING 0x20000 /* use tile blitting */ +-#define FBINFO_MISC_FIRMWARE 0x40000 /* a replaceable firmware +- inited framebuffer */ + + /* A driver may set this flag to indicate that it does want a set_par to be + * called every time when fbcon_switch is executed. The advantage is that with +@@ -802,6 +800,8 @@ struct fb_tile_ops { + */ + #define FBINFO_MISC_ALWAYS_SETPAR 0x40000 + ++/* where the fb is a firmware driver, and can be replaced with a proper one */ ++#define FBINFO_MISC_FIRMWARE 0x80000 + /* + * Host and GPU endianness differ. + */ diff --git a/queue-2.6.34/hostap-protect-against-initialization-interrupt.patch b/queue-2.6.34/hostap-protect-against-initialization-interrupt.patch new file mode 100644 index 00000000000..2887ad4af6d --- /dev/null +++ b/queue-2.6.34/hostap-protect-against-initialization-interrupt.patch @@ -0,0 +1,119 @@ +From d6a574ff6bfb842bdb98065da053881ff527be46 Mon Sep 17 00:00:00 2001 +From: Tim Gardner +Date: Tue, 8 Jun 2010 11:33:02 -0600 +Subject: hostap: Protect against initialization interrupt + +From: Tim Gardner + +commit d6a574ff6bfb842bdb98065da053881ff527be46 upstream. + +Use an irq spinlock to hold off the IRQ handler until +enough early card init is complete such that the handler +can run without faulting. + +Signed-off-by: Tim Gardner +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/hostap/hostap_cs.c | 15 +++++++++++++-- + drivers/net/wireless/hostap/hostap_hw.c | 13 +++++++++++++ + drivers/net/wireless/hostap/hostap_wlan.h | 2 +- + 3 files changed, 27 insertions(+), 3 deletions(-) + +--- a/drivers/net/wireless/hostap/hostap_cs.c ++++ b/drivers/net/wireless/hostap/hostap_cs.c +@@ -603,6 +603,7 @@ static int prism2_config(struct pcmcia_d + local_info_t *local; + int ret = 1; + struct hostap_cs_priv *hw_priv; ++ unsigned long flags; + + PDEBUG(DEBUG_FLOW, "prism2_config()\n"); + +@@ -637,6 +638,12 @@ static int prism2_config(struct pcmcia_d + link->dev_node = &hw_priv->node; + + /* ++ * Make sure the IRQ handler cannot proceed until at least ++ * dev->base_addr is initialized. ++ */ ++ spin_lock_irqsave(&local->irq_init_lock, flags); ++ ++ /* + * Allocate an interrupt line. Note that this does not assign a + * handler to the interrupt, unless the 'Handler' member of the + * irq structure is initialized. +@@ -646,7 +653,7 @@ static int prism2_config(struct pcmcia_d + link->irq.Handler = prism2_interrupt; + ret = pcmcia_request_irq(link, &link->irq); + if (ret) +- goto failed; ++ goto failed_unlock; + } + + /* +@@ -656,11 +663,13 @@ static int prism2_config(struct pcmcia_d + */ + ret = pcmcia_request_configuration(link, &link->conf); + if (ret) +- goto failed; ++ goto failed_unlock; + + dev->irq = link->irq.AssignedIRQ; + dev->base_addr = link->io.BasePort1; + ++ spin_unlock_irqrestore(&local->irq_init_lock, flags); ++ + /* Finally, report what we've done */ + printk(KERN_INFO "%s: index 0x%02x: ", + dev_info, link->conf.ConfigIndex); +@@ -689,6 +698,8 @@ static int prism2_config(struct pcmcia_d + } + return ret; + ++ failed_unlock: ++ spin_unlock_irqrestore(&local->irq_init_lock, flags); + failed: + kfree(hw_priv); + prism2_release((u_long)link); +--- a/drivers/net/wireless/hostap/hostap_hw.c ++++ b/drivers/net/wireless/hostap/hostap_hw.c +@@ -2630,6 +2630,18 @@ static irqreturn_t prism2_interrupt(int + iface = netdev_priv(dev); + local = iface->local; + ++ /* Detect early interrupt before driver is fully configued */ ++ spin_lock(&local->irq_init_lock); ++ if (!dev->base_addr) { ++ if (net_ratelimit()) { ++ printk(KERN_DEBUG "%s: Interrupt, but dev not configured\n", ++ dev->name); ++ } ++ spin_unlock(&local->irq_init_lock); ++ return IRQ_HANDLED; ++ } ++ spin_unlock(&local->irq_init_lock); ++ + prism2_io_debug_add(dev, PRISM2_IO_DEBUG_CMD_INTERRUPT, 0, 0); + + if (local->func->card_present && !local->func->card_present(local)) { +@@ -3147,6 +3159,7 @@ prism2_init_local_data(struct prism2_hel + spin_lock_init(&local->cmdlock); + spin_lock_init(&local->baplock); + spin_lock_init(&local->lock); ++ spin_lock_init(&local->irq_init_lock); + mutex_init(&local->rid_bap_mtx); + + if (card_idx < 0 || card_idx >= MAX_PARM_DEVICES) +--- a/drivers/net/wireless/hostap/hostap_wlan.h ++++ b/drivers/net/wireless/hostap/hostap_wlan.h +@@ -654,7 +654,7 @@ struct local_info { + rwlock_t iface_lock; /* hostap_interfaces read lock; use write lock + * when removing entries from the list. + * TX and RX paths can use read lock. */ +- spinlock_t cmdlock, baplock, lock; ++ spinlock_t cmdlock, baplock, lock, irq_init_lock; + struct mutex rid_bap_mtx; + u16 infofid; /* MAC buffer id for info frame */ + /* txfid, intransmitfid, next_txtid, and next_alloc are protected by diff --git a/queue-2.6.34/hwmon-coretemp-properly-label-the-sensors.patch b/queue-2.6.34/hwmon-coretemp-properly-label-the-sensors.patch new file mode 100644 index 00000000000..da9ff380dc7 --- /dev/null +++ b/queue-2.6.34/hwmon-coretemp-properly-label-the-sensors.patch @@ -0,0 +1,50 @@ +From 3f4f09b4be35d38d6e2bf22c989443e65e70fc4c Mon Sep 17 00:00:00 2001 +From: Jean Delvare +Date: Fri, 9 Jul 2010 16:22:51 +0200 +Subject: hwmon: (coretemp) Properly label the sensors + +From: Jean Delvare + +commit 3f4f09b4be35d38d6e2bf22c989443e65e70fc4c upstream. + +Don't assume that CPU entry number and core ID always match. It +worked in the simple cases (single CPU, no HT) but fails on +multi-CPU systems. + +Signed-off-by: Jean Delvare +Acked-by: Huaxu Wan +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwmon/coretemp.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/drivers/hwmon/coretemp.c ++++ b/drivers/hwmon/coretemp.c +@@ -53,6 +53,7 @@ struct coretemp_data { + struct mutex update_lock; + const char *name; + u32 id; ++ u16 core_id; + char valid; /* zero until following fields are valid */ + unsigned long last_updated; /* in jiffies */ + int temp; +@@ -75,7 +76,7 @@ static ssize_t show_name(struct device * + if (attr->index == SHOW_NAME) + ret = sprintf(buf, "%s\n", data->name); + else /* show label */ +- ret = sprintf(buf, "Core %d\n", data->id); ++ ret = sprintf(buf, "Core %d\n", data->core_id); + return ret; + } + +@@ -255,6 +256,9 @@ static int __devinit coretemp_probe(stru + } + + data->id = pdev->id; ++#ifdef CONFIG_SMP ++ data->core_id = c->cpu_core_id; ++#endif + data->name = "coretemp"; + mutex_init(&data->update_lock); + diff --git a/queue-2.6.34/hwmon-coretemp-skip-duplicate-cpu-entries.patch b/queue-2.6.34/hwmon-coretemp-skip-duplicate-cpu-entries.patch new file mode 100644 index 00000000000..b5cf3078ba6 --- /dev/null +++ b/queue-2.6.34/hwmon-coretemp-skip-duplicate-cpu-entries.patch @@ -0,0 +1,76 @@ +From d883b9f0977269d519469da72faec6a7f72cb489 Mon Sep 17 00:00:00 2001 +From: Jean Delvare +Date: Fri, 9 Jul 2010 16:22:49 +0200 +Subject: hwmon: (coretemp) Skip duplicate CPU entries + +From: Jean Delvare + +commit d883b9f0977269d519469da72faec6a7f72cb489 upstream. + +On hyper-threaded CPUs, each core appears twice in the CPU list. Skip +the second entry to avoid duplicate sensors. + +Signed-off-by: Jean Delvare +Acked-by: Huaxu Wan +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwmon/coretemp.c | 26 +++++++++++++++++++++++++- + 1 file changed, 25 insertions(+), 1 deletion(-) + +--- a/drivers/hwmon/coretemp.c ++++ b/drivers/hwmon/coretemp.c +@@ -356,6 +356,10 @@ struct pdev_entry { + struct list_head list; + struct platform_device *pdev; + unsigned int cpu; ++#ifdef CONFIG_SMP ++ u16 phys_proc_id; ++ u16 cpu_core_id; ++#endif + }; + + static LIST_HEAD(pdev_list); +@@ -366,6 +370,22 @@ static int __cpuinit coretemp_device_add + int err; + struct platform_device *pdev; + struct pdev_entry *pdev_entry; ++#ifdef CONFIG_SMP ++ struct cpuinfo_x86 *c = &cpu_data(cpu); ++#endif ++ ++ mutex_lock(&pdev_list_mutex); ++ ++#ifdef CONFIG_SMP ++ /* Skip second HT entry of each core */ ++ list_for_each_entry(pdev_entry, &pdev_list, list) { ++ if (c->phys_proc_id == pdev_entry->phys_proc_id && ++ c->cpu_core_id == pdev_entry->cpu_core_id) { ++ err = 0; /* Not an error */ ++ goto exit; ++ } ++ } ++#endif + + pdev = platform_device_alloc(DRVNAME, cpu); + if (!pdev) { +@@ -389,7 +409,10 @@ static int __cpuinit coretemp_device_add + + pdev_entry->pdev = pdev; + pdev_entry->cpu = cpu; +- mutex_lock(&pdev_list_mutex); ++#ifdef CONFIG_SMP ++ pdev_entry->phys_proc_id = c->phys_proc_id; ++ pdev_entry->cpu_core_id = c->cpu_core_id; ++#endif + list_add_tail(&pdev_entry->list, &pdev_list); + mutex_unlock(&pdev_list_mutex); + +@@ -400,6 +423,7 @@ exit_device_free: + exit_device_put: + platform_device_put(pdev); + exit: ++ mutex_unlock(&pdev_list_mutex); + return err; + } + diff --git a/queue-2.6.34/hwmon-i5k_amb-fix-sysfs-attribute-for-lockdep.patch b/queue-2.6.34/hwmon-i5k_amb-fix-sysfs-attribute-for-lockdep.patch new file mode 100644 index 00000000000..fb674924167 --- /dev/null +++ b/queue-2.6.34/hwmon-i5k_amb-fix-sysfs-attribute-for-lockdep.patch @@ -0,0 +1,71 @@ +From 0e6c7870856c7fb4ee054d28ac253b2d3d0c7e36 Mon Sep 17 00:00:00 2001 +From: KAMEZAWA Hiroyuki +Date: Sun, 20 Jun 2010 09:22:31 +0200 +Subject: hwmon: (i5k_amb) Fix sysfs attribute for lockdep + +From: KAMEZAWA Hiroyuki + +commit 0e6c7870856c7fb4ee054d28ac253b2d3d0c7e36 upstream. + +i5k_amb.ko uses dynamically allocated memory (by kmalloc) for +attributes passed to sysfs. So, sysfs_attr_init() should be called +for working happy with lockdep. + +Signed-off-by: KAMEZAWA Hiroyuki +Signed-off-by: Jean Delvare +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwmon/i5k_amb.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/hwmon/i5k_amb.c ++++ b/drivers/hwmon/i5k_amb.c +@@ -289,6 +289,7 @@ static int __devinit i5k_amb_hwmon_init( + iattr->s_attr.dev_attr.attr.mode = S_IRUGO; + iattr->s_attr.dev_attr.show = show_label; + iattr->s_attr.index = k; ++ sysfs_attr_init(&iattr->s_attr.dev_attr.attr); + res = device_create_file(&pdev->dev, + &iattr->s_attr.dev_attr); + if (res) +@@ -303,6 +304,7 @@ static int __devinit i5k_amb_hwmon_init( + iattr->s_attr.dev_attr.attr.mode = S_IRUGO; + iattr->s_attr.dev_attr.show = show_amb_temp; + iattr->s_attr.index = k; ++ sysfs_attr_init(&iattr->s_attr.dev_attr.attr); + res = device_create_file(&pdev->dev, + &iattr->s_attr.dev_attr); + if (res) +@@ -318,6 +320,7 @@ static int __devinit i5k_amb_hwmon_init( + iattr->s_attr.dev_attr.show = show_amb_min; + iattr->s_attr.dev_attr.store = store_amb_min; + iattr->s_attr.index = k; ++ sysfs_attr_init(&iattr->s_attr.dev_attr.attr); + res = device_create_file(&pdev->dev, + &iattr->s_attr.dev_attr); + if (res) +@@ -333,6 +336,7 @@ static int __devinit i5k_amb_hwmon_init( + iattr->s_attr.dev_attr.show = show_amb_mid; + iattr->s_attr.dev_attr.store = store_amb_mid; + iattr->s_attr.index = k; ++ sysfs_attr_init(&iattr->s_attr.dev_attr.attr); + res = device_create_file(&pdev->dev, + &iattr->s_attr.dev_attr); + if (res) +@@ -348,6 +352,7 @@ static int __devinit i5k_amb_hwmon_init( + iattr->s_attr.dev_attr.show = show_amb_max; + iattr->s_attr.dev_attr.store = store_amb_max; + iattr->s_attr.index = k; ++ sysfs_attr_init(&iattr->s_attr.dev_attr.attr); + res = device_create_file(&pdev->dev, + &iattr->s_attr.dev_attr); + if (res) +@@ -362,6 +367,7 @@ static int __devinit i5k_amb_hwmon_init( + iattr->s_attr.dev_attr.attr.mode = S_IRUGO; + iattr->s_attr.dev_attr.show = show_amb_alarm; + iattr->s_attr.index = k; ++ sysfs_attr_init(&iattr->s_attr.dev_attr.attr); + res = device_create_file(&pdev->dev, + &iattr->s_attr.dev_attr); + if (res) diff --git a/queue-2.6.34/hwmon-it87-fix-in7-on-it8720f.patch b/queue-2.6.34/hwmon-it87-fix-in7-on-it8720f.patch new file mode 100644 index 00000000000..bb79f450c8d --- /dev/null +++ b/queue-2.6.34/hwmon-it87-fix-in7-on-it8720f.patch @@ -0,0 +1,67 @@ +From 436cad2a41a40c6c32bd9152b63d17eeb1f7c99b Mon Sep 17 00:00:00 2001 +From: Jean Delvare +Date: Fri, 9 Jul 2010 16:22:48 +0200 +Subject: hwmon: (it87) Fix in7 on IT8720F + +From: Jean Delvare + +commit 436cad2a41a40c6c32bd9152b63d17eeb1f7c99b upstream. + +The IT8720F has no VIN7 pin, so VCCH should always be routed +internally to VIN7 with an internal divider. Curiously, there still +is a configuration bit to control this, which means it can be set +incorrectly. And even more curiously, many boards out there are +improperly configured, even though the IT8720F datasheet claims that +the internal routing of VCCH to VIN7 is the default setting. So we +force the internal routing in this case. + +It turns out that all boards with the wrong setting are from Gigabyte, +so I suspect a BIOS bug. But it's easy enough to workaround in the +driver, so let's do it. + +Signed-off-by: Jean Delvare +Cc: Jean-Marc Spaggiari +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwmon/it87.c | 22 ++++++++++++++++++++++ + 1 file changed, 22 insertions(+) + +--- a/drivers/hwmon/it87.c ++++ b/drivers/hwmon/it87.c +@@ -80,6 +80,13 @@ superio_inb(int reg) + return inb(VAL); + } + ++static inline void ++superio_outb(int reg, int val) ++{ ++ outb(reg, REG); ++ outb(val, VAL); ++} ++ + static int superio_inw(int reg) + { + int val; +@@ -1517,6 +1524,21 @@ static int __init it87_find(unsigned sho + sio_data->vid_value = superio_inb(IT87_SIO_VID_REG); + + reg = superio_inb(IT87_SIO_PINX2_REG); ++ /* ++ * The IT8720F has no VIN7 pin, so VCCH should always be ++ * routed internally to VIN7 with an internal divider. ++ * Curiously, there still is a configuration bit to control ++ * this, which means it can be set incorrectly. And even ++ * more curiously, many boards out there are improperly ++ * configured, even though the IT8720F datasheet claims ++ * that the internal routing of VCCH to VIN7 is the default ++ * setting. So we force the internal routing in this case. ++ */ ++ if (sio_data->type == it8720 && !(reg & (1 << 1))) { ++ reg |= (1 << 1); ++ superio_outb(IT87_SIO_PINX2_REG, reg); ++ pr_notice("it87: Routing internal VCCH to in7\n"); ++ } + if (reg & (1 << 0)) + pr_info("it87: in3 is VCC (+5V)\n"); + if (reg & (1 << 1)) diff --git a/queue-2.6.34/hwmon-k10temp-do-not-blacklist-known-working-cpu-models.patch b/queue-2.6.34/hwmon-k10temp-do-not-blacklist-known-working-cpu-models.patch new file mode 100644 index 00000000000..8864eb589af --- /dev/null +++ b/queue-2.6.34/hwmon-k10temp-do-not-blacklist-known-working-cpu-models.patch @@ -0,0 +1,47 @@ +From eefc2d9e3d4f8820f2c128a0e44a23de28b1ed64 Mon Sep 17 00:00:00 2001 +From: Jean Delvare +Date: Sun, 20 Jun 2010 09:22:31 +0200 +Subject: hwmon: (k10temp) Do not blacklist known working CPU models + +From: Jean Delvare + +commit eefc2d9e3d4f8820f2c128a0e44a23de28b1ed64 upstream. + +When detecting AM2+ or AM3 socket with DDR2, only blacklist cores +which are known to exist in AM2+ format. + +Signed-off-by: Jean Delvare +Acked-by: Clemens Ladisch +Cc: Andreas Herrmann +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwmon/k10temp.c | 14 ++++++++++++-- + 1 file changed, 12 insertions(+), 2 deletions(-) + +--- a/drivers/hwmon/k10temp.c ++++ b/drivers/hwmon/k10temp.c +@@ -112,11 +112,21 @@ static bool __devinit has_erratum_319(st + if (pkg_type != CPUID_PKGTYPE_AM2R2_AM3) + return false; + +- /* Differentiate between AM2+ (bad) and AM3 (good) */ ++ /* DDR3 memory implies socket AM3, which is good */ + pci_bus_read_config_dword(pdev->bus, + PCI_DEVFN(PCI_SLOT(pdev->devfn), 2), + REG_DCT0_CONFIG_HIGH, ®_dram_cfg); +- return !(reg_dram_cfg & DDR3_MODE); ++ if (reg_dram_cfg & DDR3_MODE) ++ return false; ++ ++ /* ++ * Unfortunately it is possible to run a socket AM3 CPU with DDR2 ++ * memory. We blacklist all the cores which do exist in socket AM2+ ++ * format. It still isn't perfect, as RB-C2 cores exist in both AM2+ ++ * and AM3 formats, but that's the best we can do. ++ */ ++ return boot_cpu_data.x86_model < 4 || ++ (boot_cpu_data.x86_model == 4 && boot_cpu_data.x86_mask <= 2); + } + + static int __devinit k10temp_probe(struct pci_dev *pdev, diff --git a/queue-2.6.34/hwmon-k8temp-bypass-core-swapping-on-single-core-processors.patch b/queue-2.6.34/hwmon-k8temp-bypass-core-swapping-on-single-core-processors.patch new file mode 100644 index 00000000000..b7f4e268a0f --- /dev/null +++ b/queue-2.6.34/hwmon-k8temp-bypass-core-swapping-on-single-core-processors.patch @@ -0,0 +1,52 @@ +From cd4de21f7e65a8cd04860f5661b3c18648ee52a1 Mon Sep 17 00:00:00 2001 +From: Jean Delvare +Date: Sun, 20 Jun 2010 09:22:32 +0200 +Subject: hwmon: (k8temp) Bypass core swapping on single-core processors + +From: Jean Delvare + +commit cd4de21f7e65a8cd04860f5661b3c18648ee52a1 upstream. + +Commit a2e066bba2aad6583e3ff648bf28339d6c9f0898 introduced core +swapping for CPU models 64 and later. I recently had a report about +a Sempron 3200+, model 95, for which this patch broke temperature +reading. It happens that this is a single-core processor, so the +effect of the swapping was to read a temperature value for a core +that didn't exist, leading to an incorrect value (-49 degrees C.) + +Disabling core swapping on singe-core processors should fix this. + +Additional comment from Andreas: + +The BKDG says + + Thermal Sensor Core Select (ThermSenseCoreSel)-Bit 2. This bit + selects the CPU whose temperature is reported in the CurTemp + field. This bit only applies to dual core processors. For + single core processors CPU0 Thermal Sensor is always selected. + +k8temp_probe() correctly detected that SEL_CORE can't be used on single +core CPU. Thus k8temp did never update the temperature values stored +in temp[1][x] and -49 degrees was reported. For single core CPUs we +must use the values read into temp[0][x]. + +Signed-off-by: Jean Delvare +Tested-by: Rick Moritz +Acked-by: Andreas Herrmann +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwmon/k8temp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/hwmon/k8temp.c ++++ b/drivers/hwmon/k8temp.c +@@ -120,7 +120,7 @@ static ssize_t show_temp(struct device * + int temp; + struct k8temp_data *data = k8temp_update_device(dev); + +- if (data->swap_core_select) ++ if (data->swap_core_select && (data->sensorsp & SEL_CORE)) + core = core ? 0 : 1; + + temp = TEMP_FROM_REG(data->temp[core][place]) + data->temp_offset; diff --git a/queue-2.6.34/hwmon-k8temp-fix-temperature-reporting-for-asb1-processor-revisions.patch b/queue-2.6.34/hwmon-k8temp-fix-temperature-reporting-for-asb1-processor-revisions.patch new file mode 100644 index 00000000000..6d620b49a4c --- /dev/null +++ b/queue-2.6.34/hwmon-k8temp-fix-temperature-reporting-for-asb1-processor-revisions.patch @@ -0,0 +1,64 @@ +From d535bad90dad4eb42ec6528043fcfb53627d4f89 Mon Sep 17 00:00:00 2001 +From: Andreas Herrmann +Date: Fri, 9 Jul 2010 16:22:47 +0200 +Subject: hwmon: (k8temp) Fix temperature reporting for ASB1 processor revisions + +From: Andreas Herrmann + +commit d535bad90dad4eb42ec6528043fcfb53627d4f89 upstream. + +Reported temperature for ASB1 CPUs is too high. +Add ASB1 CPU revisions (these are also non-desktop variants) to the +list of CPUs for which the temperature fixup is not required. + +Example: (from LENOVO ThinkPad Edge 13, 01972NG, system was idle) + + Current kernel reports + + $ sensors + k8temp-pci-00c3 + Adapter: PCI adapter + Core0 Temp: +74.0 C + Core0 Temp: +70.0 C + Core1 Temp: +69.0 C + Core1 Temp: +70.0 C + + With this patch I have + + $ sensors + k8temp-pci-00c3 + Adapter: PCI adapter + Core0 Temp: +54.0 C + Core0 Temp: +51.0 C + Core1 Temp: +48.0 C + Core1 Temp: +49.0 C + +Cc: Rudolf Marek +Signed-off-by: Andreas Herrmann +Signed-off-by: Jean Delvare +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwmon/k8temp.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +--- a/drivers/hwmon/k8temp.c ++++ b/drivers/hwmon/k8temp.c +@@ -180,11 +180,13 @@ static int __devinit k8temp_probe(struct + } + + if ((model >= 0x69) && +- !(model == 0xc1 || model == 0x6c || model == 0x7c)) { ++ !(model == 0xc1 || model == 0x6c || model == 0x7c || ++ model == 0x6b || model == 0x6f || model == 0x7f)) { + /* +- * RevG desktop CPUs (i.e. no socket S1G1 parts) +- * need additional offset, otherwise reported +- * temperature is below ambient temperature ++ * RevG desktop CPUs (i.e. no socket S1G1 or ++ * ASB1 parts) need additional offset, ++ * otherwise reported temperature is below ++ * ambient temperature + */ + data->temp_offset = 21000; + } diff --git a/queue-2.6.34/iwlwifi-cancel-scan-watchdog-in-iwl_bg_abort_scan.patch b/queue-2.6.34/iwlwifi-cancel-scan-watchdog-in-iwl_bg_abort_scan.patch new file mode 100644 index 00000000000..a3ccfb61dc6 --- /dev/null +++ b/queue-2.6.34/iwlwifi-cancel-scan-watchdog-in-iwl_bg_abort_scan.patch @@ -0,0 +1,63 @@ +From a69b03e941abae00380fc6bc1877fb797a1b31e6 Mon Sep 17 00:00:00 2001 +From: John W. Linville +Date: Mon, 14 Jun 2010 14:30:25 -0400 +Subject: iwlwifi: cancel scan watchdog in iwl_bg_abort_scan + +From: John W. Linville + +commit a69b03e941abae00380fc6bc1877fb797a1b31e6 upstream. + +Avoids this: + +WARNING: at net/mac80211/scan.c:312 ieee80211_scan_completed+0x5f/0x1f1 +[mac80211]() +Hardware name: Latitude E5400 +Modules linked in: aes_x86_64 aes_generic fuse ipt_MASQUERADE iptable_nat +nf_nat rfcomm sco bridge stp llc bnep l2cap sunrpc cpufreq_ondemand +acpi_cpufreq freq_table xt_physdev ip6t_REJECT nf_conntrack_ipv6 +ip6table_filter ip6_tables ipv6 kvm_intel kvm uinput arc4 ecb +snd_hda_codec_intelhdmi snd_hda_codec_idt snd_hda_intel iwlagn snd_hda_codec +snd_hwdep snd_seq snd_seq_device iwlcore snd_pcm dell_wmi sdhci_pci sdhci +iTCO_wdt tg3 dell_laptop mmc_core i2c_i801 wmi mac80211 snd_timer +iTCO_vendor_support btusb joydev dcdbas cfg80211 bluetooth snd soundcore +microcode rfkill snd_page_alloc firewire_ohci firewire_core crc_itu_t +yenta_socket rsrc_nonstatic i915 drm_kms_helper drm i2c_algo_bit i2c_core video +output [last unloaded: scsi_wait_scan] +Pid: 979, comm: iwlagn Tainted: G W 2.6.33.3-85.fc13.x86_64 #1 +Call Trace: +[] warn_slowpath_common+0x77/0x8f +[] warn_slowpath_null+0xf/0x11 +[] ieee80211_scan_completed+0x5f/0x1f1 [mac80211] +[] iwl_bg_scan_completed+0xbb/0x17a [iwlcore] +[] worker_thread+0x1a4/0x232 +[] ? iwl_bg_scan_completed+0x0/0x17a [iwlcore] +[] ? autoremove_wake_function+0x0/0x34 +[] ? worker_thread+0x0/0x232 +[] kthread+0x7a/0x82 +[] kernel_thread_helper+0x4/0x10 +[] ? kthread+0x0/0x82 +[] ? kernel_thread_helper+0x0/0x10 + +Reported here: + + https://bugzilla.redhat.com/show_bug.cgi?id=590436 + +Signed-off-by: John W. Linville +Reported-by: Mihai Harpau +Acked-by: Reinette Chatre +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/iwlwifi/iwl-scan.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/wireless/iwlwifi/iwl-scan.c ++++ b/drivers/net/wireless/iwlwifi/iwl-scan.c +@@ -952,6 +952,7 @@ void iwl_bg_abort_scan(struct work_struc + + mutex_lock(&priv->mutex); + ++ cancel_delayed_work_sync(&priv->scan_check); + set_bit(STATUS_SCAN_ABORTING, &priv->status); + iwl_send_scan_abort(priv); + diff --git a/queue-2.6.34/mac80211-do-not-wip-out-old-supported-rates.patch b/queue-2.6.34/mac80211-do-not-wip-out-old-supported-rates.patch new file mode 100644 index 00000000000..a0ba8d16a25 --- /dev/null +++ b/queue-2.6.34/mac80211-do-not-wip-out-old-supported-rates.patch @@ -0,0 +1,65 @@ +From f0b058b61711ebf5be94d6865ca7b2c259b71d37 Mon Sep 17 00:00:00 2001 +From: Stanislaw Gruszka +Date: Wed, 28 Apr 2010 15:17:03 +0200 +Subject: mac80211: do not wip out old supported rates + +From: Stanislaw Gruszka + +commit f0b058b61711ebf5be94d6865ca7b2c259b71d37 upstream. + +Use old supported rates, if AP do not provide supported rates +information element in a new managment frame. + +Signed-off-by: Stanislaw Gruszka +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + net/mac80211/scan.c | 21 +++++++++++---------- + 1 file changed, 11 insertions(+), 10 deletions(-) + +--- a/net/mac80211/scan.c ++++ b/net/mac80211/scan.c +@@ -83,7 +83,7 @@ ieee80211_bss_info_update(struct ieee802 + { + struct cfg80211_bss *cbss; + struct ieee80211_bss *bss; +- int clen; ++ int clen, srlen; + s32 signal = 0; + + if (local->hw.flags & IEEE80211_HW_SIGNAL_DBM) +@@ -112,23 +112,24 @@ ieee80211_bss_info_update(struct ieee802 + bss->dtim_period = tim_ie->dtim_period; + } + +- bss->supp_rates_len = 0; ++ /* replace old supported rates if we get new values */ ++ srlen = 0; + if (elems->supp_rates) { +- clen = IEEE80211_MAX_SUPP_RATES - bss->supp_rates_len; ++ clen = IEEE80211_MAX_SUPP_RATES; + if (clen > elems->supp_rates_len) + clen = elems->supp_rates_len; +- memcpy(&bss->supp_rates[bss->supp_rates_len], elems->supp_rates, +- clen); +- bss->supp_rates_len += clen; ++ memcpy(bss->supp_rates, elems->supp_rates, clen); ++ srlen += clen; + } + if (elems->ext_supp_rates) { +- clen = IEEE80211_MAX_SUPP_RATES - bss->supp_rates_len; ++ clen = IEEE80211_MAX_SUPP_RATES - srlen; + if (clen > elems->ext_supp_rates_len) + clen = elems->ext_supp_rates_len; +- memcpy(&bss->supp_rates[bss->supp_rates_len], +- elems->ext_supp_rates, clen); +- bss->supp_rates_len += clen; ++ memcpy(bss->supp_rates + srlen, elems->ext_supp_rates, clen); ++ srlen += clen; + } ++ if (srlen) ++ bss->supp_rates_len = srlen; + + bss->wmm_used = elems->wmm_param || elems->wmm_info; + bss->uapsd_supported = is_uapsd_supported(elems); diff --git a/queue-2.6.34/math-emu-correct-test-for-downshifting-fraction-in-_fp_from_int.patch b/queue-2.6.34/math-emu-correct-test-for-downshifting-fraction-in-_fp_from_int.patch new file mode 100644 index 00000000000..14bb4b9b121 --- /dev/null +++ b/queue-2.6.34/math-emu-correct-test-for-downshifting-fraction-in-_fp_from_int.patch @@ -0,0 +1,56 @@ +From f8324e20f8289dffc646d64366332e05eaacab25 Mon Sep 17 00:00:00 2001 +From: Mikael Pettersson +Date: Tue, 20 Jul 2010 18:45:14 -0700 +Subject: math-emu: correct test for downshifting fraction in _FP_FROM_INT() + +From: Mikael Pettersson + +commit f8324e20f8289dffc646d64366332e05eaacab25 upstream. + +The kernel's math-emu code contains a macro _FP_FROM_INT() which is +used to convert an integer to a raw normalized floating-point value. +It does this basically in three steps: + +1. Compute the exponent from the number of leading zero bits. +2. Downshift large fractions to put the MSB in the right position + for normalized fractions. +3. Upshift small fractions to put the MSB in the right position. + +There is an boundary error in step 2, causing a fraction with its +MSB exactly one bit above the normalized MSB position to not be +downshifted. This results in a non-normalized raw float, which when +packed becomes a massively inaccurate representation for that input. + +The impact of this depends on a number of arch-specific factors, +but it is known to have broken emulation of FXTOD instructions +on UltraSPARC III, which was originally reported as GCC bug 44631 +. + +Any arch which uses math-emu to emulate conversions from integers to +same-size floats may be affected. + +The fix is simple: the exponent comparison used to determine if the +fraction should be downshifted must be "<=" not "<". + +I'm sending a kernel module to test this as a reply to this message. +There are also SPARC user-space test cases in the GCC bug entry. + +Signed-off-by: Mikael Pettersson +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + include/math-emu/op-common.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/include/math-emu/op-common.h ++++ b/include/math-emu/op-common.h +@@ -799,7 +799,7 @@ do { \ + X##_e -= (_FP_W_TYPE_SIZE - rsize); \ + X##_e = rsize - X##_e - 1; \ + \ +- if (_FP_FRACBITS_##fs < rsize && _FP_WFRACBITS_##fs < X##_e) \ ++ if (_FP_FRACBITS_##fs < rsize && _FP_WFRACBITS_##fs <= X##_e) \ + __FP_FRAC_SRS_1(ur_, (X##_e - _FP_WFRACBITS_##fs + 1), rsize);\ + _FP_FRAC_DISASSEMBLE_##wc(X, ur_, rsize); \ + if ((_FP_WFRACBITS_##fs - X##_e - 1) > 0) \ diff --git a/queue-2.6.34/net-core-neighbour-update-oops.patch b/queue-2.6.34/net-core-neighbour-update-oops.patch new file mode 100644 index 00000000000..0804a1fa9fe --- /dev/null +++ b/queue-2.6.34/net-core-neighbour-update-oops.patch @@ -0,0 +1,46 @@ +From 91a72a70594e5212c97705ca6a694bd307f7a26b Mon Sep 17 00:00:00 2001 +From: Doug Kehn +Date: Wed, 14 Jul 2010 18:02:16 -0700 +Subject: net/core: neighbour update Oops + +From: Doug Kehn + +commit 91a72a70594e5212c97705ca6a694bd307f7a26b upstream. + +When configuring DMVPN (GRE + openNHRP) and a GRE remote +address is configured a kernel Oops is observed. The +obserseved Oops is caused by a NULL header_ops pointer +(neigh->dev->header_ops) in neigh_update_hhs() when + +void (*update)(struct hh_cache*, const struct net_device*, const unsigned char *) += neigh->dev->header_ops->cache_update; + +is executed. The dev associated with the NULL header_ops is +the GRE interface. This patch guards against the +possibility that header_ops is NULL. + +This Oops was first observed in kernel version 2.6.26.8. + +Signed-off-by: Doug Kehn +Acked-by: Eric Dumazet +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + net/core/neighbour.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/net/core/neighbour.c ++++ b/net/core/neighbour.c +@@ -948,7 +948,10 @@ static void neigh_update_hhs(struct neig + { + struct hh_cache *hh; + void (*update)(struct hh_cache*, const struct net_device*, const unsigned char *) +- = neigh->dev->header_ops->cache_update; ++ = NULL; ++ ++ if (neigh->dev->header_ops) ++ update = neigh->dev->header_ops->cache_update; + + if (update) { + for (hh = neigh->hh; hh; hh = hh->hh_next) { diff --git a/queue-2.6.34/net-fix-problem-in-reading-sock-tx-queue.patch b/queue-2.6.34/net-fix-problem-in-reading-sock-tx-queue.patch new file mode 100644 index 00000000000..1a44000dd97 --- /dev/null +++ b/queue-2.6.34/net-fix-problem-in-reading-sock-tx-queue.patch @@ -0,0 +1,68 @@ +From b0f77d0eae0c58a5a9691a067ada112ceeae2d00 Mon Sep 17 00:00:00 2001 +From: Tom Herbert +Date: Wed, 14 Jul 2010 20:50:29 -0700 +Subject: net: fix problem in reading sock TX queue + +From: Tom Herbert + +commit b0f77d0eae0c58a5a9691a067ada112ceeae2d00 upstream. + +Fix problem in reading the tx_queue recorded in a socket. In +dev_pick_tx, the TX queue is read by doing a check with +sk_tx_queue_recorded on the socket, followed by a sk_tx_queue_get. +The problem is that there is not mutual exclusion across these +calls in the socket so it it is possible that the queue in the +sock can be invalidated after sk_tx_queue_recorded is called so +that sk_tx_queue get returns -1, which sets 65535 in queue_index +and thus dev_pick_tx returns 65536 which is a bogus queue and +can cause crash in dev_queue_xmit. + +We fix this by only calling sk_tx_queue_get which does the proper +checks. The interface is that sk_tx_queue_get returns the TX queue +if the sock argument is non-NULL and TX queue is recorded, else it +returns -1. sk_tx_queue_recorded is no longer used so it can be +completely removed. + +Signed-off-by: Tom Herbert +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + include/net/sock.h | 7 +------ + net/core/dev.c | 7 +++---- + 2 files changed, 4 insertions(+), 10 deletions(-) + +--- a/include/net/sock.h ++++ b/include/net/sock.h +@@ -1146,12 +1146,7 @@ static inline void sk_tx_queue_clear(str + + static inline int sk_tx_queue_get(const struct sock *sk) + { +- return sk->sk_tx_queue_mapping; +-} +- +-static inline bool sk_tx_queue_recorded(const struct sock *sk) +-{ +- return (sk && sk->sk_tx_queue_mapping >= 0); ++ return sk ? sk->sk_tx_queue_mapping : -1; + } + + static inline void sk_set_socket(struct sock *sk, struct socket *sock) +--- a/net/core/dev.c ++++ b/net/core/dev.c +@@ -1972,12 +1972,11 @@ static inline u16 dev_cap_txqueue(struct + static struct netdev_queue *dev_pick_tx(struct net_device *dev, + struct sk_buff *skb) + { +- u16 queue_index; ++ int queue_index; + struct sock *sk = skb->sk; + +- if (sk_tx_queue_recorded(sk)) { +- queue_index = sk_tx_queue_get(sk); +- } else { ++ queue_index = sk_tx_queue_get(sk); ++ if (queue_index < 0) { + const struct net_device_ops *ops = dev->netdev_ops; + + if (ops->ndo_select_queue) { diff --git a/queue-2.6.34/nfsv4-ensure-that-proc-self-mountinfo-displays-the-minor-version-number.patch b/queue-2.6.34/nfsv4-ensure-that-proc-self-mountinfo-displays-the-minor-version-number.patch new file mode 100644 index 00000000000..bf3f05ab54d --- /dev/null +++ b/queue-2.6.34/nfsv4-ensure-that-proc-self-mountinfo-displays-the-minor-version-number.patch @@ -0,0 +1,58 @@ +From 0be8189f2c87fcc747d6a4a657a0b6e2161b2318 Mon Sep 17 00:00:00 2001 +From: Trond Myklebust +Date: Fri, 18 Jun 2010 12:23:58 -0400 +Subject: NFSv4: Ensure that /proc/self/mountinfo displays the minor version number + +From: Trond Myklebust + +commit 0be8189f2c87fcc747d6a4a657a0b6e2161b2318 upstream. + +Currently, we do not display the minor version mount parameter in the +/proc mount info. + +Signed-off-by: Trond Myklebust +Signed-off-by: Greg Kroah-Hartman + +--- + fs/nfs/super.c | 22 ++++++++++++++++++---- + 1 file changed, 18 insertions(+), 4 deletions(-) + +--- a/fs/nfs/super.c ++++ b/fs/nfs/super.c +@@ -566,6 +566,22 @@ static void nfs_show_mountd_options(stru + nfs_show_mountd_netid(m, nfss, showdefaults); + } + ++#ifdef CONFIG_NFS_V4 ++static void nfs_show_nfsv4_options(struct seq_file *m, struct nfs_server *nfss, ++ int showdefaults) ++{ ++ struct nfs_client *clp = nfss->nfs_client; ++ ++ seq_printf(m, ",clientaddr=%s", clp->cl_ipaddr); ++ seq_printf(m, ",minorversion=%u", clp->cl_minorversion); ++} ++#else ++static void nfs_show_nfsv4_options(struct seq_file *m, struct nfs_server *nfss, ++ int showdefaults) ++{ ++} ++#endif ++ + /* + * Describe the mount options in force on this server representation + */ +@@ -627,11 +643,9 @@ static void nfs_show_mount_options(struc + + if (version != 4) + nfs_show_mountd_options(m, nfss, showdefaults); ++ else ++ nfs_show_nfsv4_options(m, nfss, showdefaults); + +-#ifdef CONFIG_NFS_V4 +- if (clp->rpc_ops->version == 4) +- seq_printf(m, ",clientaddr=%s", clp->cl_ipaddr); +-#endif + if (nfss->options & NFS_OPTION_FSCACHE) + seq_printf(m, ",fsc"); + } diff --git a/queue-2.6.34/nfsv4-fix-an-embarassing-typo-in-encode_attrs.patch b/queue-2.6.34/nfsv4-fix-an-embarassing-typo-in-encode_attrs.patch new file mode 100644 index 00000000000..9ebf74a317f --- /dev/null +++ b/queue-2.6.34/nfsv4-fix-an-embarassing-typo-in-encode_attrs.patch @@ -0,0 +1,36 @@ +From d3f6baaa34c54040b3ef30950e59b54ac0624b21 Mon Sep 17 00:00:00 2001 +From: Trond Myklebust +Date: Tue, 22 Jun 2010 08:52:39 -0400 +Subject: NFSv4: Fix an embarassing typo in encode_attrs() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Trond Myklebust + +commit d3f6baaa34c54040b3ef30950e59b54ac0624b21 upstream. + +Apparently, we have never been able to set the atime correctly from the +NFSv4 client. + +Reported-by: 小倉一夫 +Signed-off-by: Trond Myklebust +Signed-off-by: Greg Kroah-Hartman + +--- + fs/nfs/nfs4xdr.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/fs/nfs/nfs4xdr.c ++++ b/fs/nfs/nfs4xdr.c +@@ -862,8 +862,8 @@ static void encode_attrs(struct xdr_stre + bmval1 |= FATTR4_WORD1_TIME_ACCESS_SET; + *p++ = cpu_to_be32(NFS4_SET_TO_CLIENT_TIME); + *p++ = cpu_to_be32(0); +- *p++ = cpu_to_be32(iap->ia_mtime.tv_sec); +- *p++ = cpu_to_be32(iap->ia_mtime.tv_nsec); ++ *p++ = cpu_to_be32(iap->ia_atime.tv_sec); ++ *p++ = cpu_to_be32(iap->ia_atime.tv_nsec); + } + else if (iap->ia_valid & ATTR_ATIME) { + bmval1 |= FATTR4_WORD1_TIME_ACCESS_SET; diff --git a/queue-2.6.34/ocfs2-no-need-to-zero-pages-past-i_size.patch b/queue-2.6.34/ocfs2-no-need-to-zero-pages-past-i_size.patch new file mode 100644 index 00000000000..69cf1b58892 --- /dev/null +++ b/queue-2.6.34/ocfs2-no-need-to-zero-pages-past-i_size.patch @@ -0,0 +1,87 @@ +From 693c241a5f6aa01417f5f4caf9f82e60e316398d Mon Sep 17 00:00:00 2001 +From: Joel Becker +Date: Fri, 2 Jul 2010 17:20:27 -0700 +Subject: ocfs2: No need to zero pages past i_size. + +From: Joel Becker + +commit 693c241a5f6aa01417f5f4caf9f82e60e316398d upstream. + +When ocfs2 fills a hole, it does so by allocating clusters. When a +cluster is larger than the write, ocfs2 must zero the portions of the +cluster outside of the write. If the clustersize is smaller than a +pagecache page, this is handled by the normal pagecache mechanisms, but +when the clustersize is larger than a page, ocfs2's write code will zero +the pages adjacent to the write. This makes sure the entire cluster is +zeroed correctly. + +Currently ocfs2 behaves exactly the same when writing past i_size. +However, this means ocfs2 is writing zeroed pages for portions of a new +cluster that are beyond i_size. The page writeback code isn't expecting +this. It treats all pages past the one containing i_size as left behind +due to a previous truncate operation. + +Thankfully, ocfs2 calculates the number of pages it will be working on +up front. The rest of the write code merely honors the original +calculation. We can simply trim the number of pages to only cover the +actual file data. + +Signed-off-by: Joel Becker +Signed-off-by: Greg Kroah-Hartman + +--- + fs/ocfs2/aops.c | 22 ++++++++++++++++++---- + 1 file changed, 18 insertions(+), 4 deletions(-) + +--- a/fs/ocfs2/aops.c ++++ b/fs/ocfs2/aops.c +@@ -1131,23 +1131,37 @@ out: + */ + static int ocfs2_grab_pages_for_write(struct address_space *mapping, + struct ocfs2_write_ctxt *wc, +- u32 cpos, loff_t user_pos, int new, ++ u32 cpos, loff_t user_pos, ++ unsigned user_len, int new, + struct page *mmap_page) + { + int ret = 0, i; +- unsigned long start, target_index, index; ++ unsigned long start, target_index, end_index, index; + struct inode *inode = mapping->host; ++ loff_t last_byte; + + target_index = user_pos >> PAGE_CACHE_SHIFT; + + /* + * Figure out how many pages we'll be manipulating here. For + * non allocating write, we just change the one +- * page. Otherwise, we'll need a whole clusters worth. ++ * page. Otherwise, we'll need a whole clusters worth. If we're ++ * writing past i_size, we only need enough pages to cover the ++ * last page of the write. + */ + if (new) { + wc->w_num_pages = ocfs2_pages_per_cluster(inode->i_sb); + start = ocfs2_align_clusters_to_page_index(inode->i_sb, cpos); ++ /* ++ * We need the index *past* the last page we could possibly ++ * touch. This is the page past the end of the write or ++ * i_size, whichever is greater. ++ */ ++ last_byte = max(user_pos + user_len, i_size_read(inode)); ++ BUG_ON(last_byte < 1); ++ end_index = ((last_byte - 1) >> PAGE_CACHE_SHIFT) + 1; ++ if ((start + wc->w_num_pages) > end_index) ++ wc->w_num_pages = end_index - start; + } else { + wc->w_num_pages = 1; + start = target_index; +@@ -1786,7 +1800,7 @@ int ocfs2_write_begin_nolock(struct addr + * that we can zero and flush if we error after adding the + * extent. + */ +- ret = ocfs2_grab_pages_for_write(mapping, wc, wc->w_cpos, pos, ++ ret = ocfs2_grab_pages_for_write(mapping, wc, wc->w_cpos, pos, len, + cluster_of_pages, mmap_page); + if (ret) { + mlog_errno(ret); diff --git a/queue-2.6.34/ocfs2-when-zero-extending-do-it-by-page.patch b/queue-2.6.34/ocfs2-when-zero-extending-do-it-by-page.patch new file mode 100644 index 00000000000..3090c91610a --- /dev/null +++ b/queue-2.6.34/ocfs2-when-zero-extending-do-it-by-page.patch @@ -0,0 +1,227 @@ +From a4bfb4cf11fd2211b788af59dc8a8b4394bca227 Mon Sep 17 00:00:00 2001 +From: Joel Becker +Date: Tue, 6 Jul 2010 14:36:06 -0700 +Subject: ocfs2: When zero extending, do it by page. + +From: Joel Becker + +commit a4bfb4cf11fd2211b788af59dc8a8b4394bca227 upstream. + +ocfs2_zero_extend() does its zeroing block by block, but it calls a +function named ocfs2_write_zero_page(). Let's have +ocfs2_write_zero_page() handle the page level. From +ocfs2_zero_extend()'s perspective, it is now page-at-a-time. + +Signed-off-by: Joel Becker +Signed-off-by: Greg Kroah-Hartman + +--- + fs/ocfs2/aops.c | 30 -------------- + fs/ocfs2/file.c | 118 +++++++++++++++++++++++++++++++++++++++----------------- + 2 files changed, 84 insertions(+), 64 deletions(-) + +--- a/fs/ocfs2/aops.c ++++ b/fs/ocfs2/aops.c +@@ -459,36 +459,6 @@ int walk_page_buffers( handle_t *handle, + return ret; + } + +-handle_t *ocfs2_start_walk_page_trans(struct inode *inode, +- struct page *page, +- unsigned from, +- unsigned to) +-{ +- struct ocfs2_super *osb = OCFS2_SB(inode->i_sb); +- handle_t *handle; +- int ret = 0; +- +- handle = ocfs2_start_trans(osb, OCFS2_INODE_UPDATE_CREDITS); +- if (IS_ERR(handle)) { +- ret = -ENOMEM; +- mlog_errno(ret); +- goto out; +- } +- +- if (ocfs2_should_order_data(inode)) { +- ret = ocfs2_jbd2_file_inode(handle, inode); +- if (ret < 0) +- mlog_errno(ret); +- } +-out: +- if (ret) { +- if (!IS_ERR(handle)) +- ocfs2_commit_trans(osb, handle); +- handle = ERR_PTR(ret); +- } +- return handle; +-} +- + static sector_t ocfs2_bmap(struct address_space *mapping, sector_t block) + { + sector_t status; +--- a/fs/ocfs2/file.c ++++ b/fs/ocfs2/file.c +@@ -738,28 +738,55 @@ leave: + return status; + } + ++/* ++ * While a write will already be ordering the data, a truncate will not. ++ * Thus, we need to explicitly order the zeroed pages. ++ */ ++static handle_t *ocfs2_zero_start_ordered_transaction(struct inode *inode) ++{ ++ struct ocfs2_super *osb = OCFS2_SB(inode->i_sb); ++ handle_t *handle = NULL; ++ int ret = 0; ++ ++ if (!ocfs2_should_order_data(inode)) ++ goto out; ++ ++ handle = ocfs2_start_trans(osb, OCFS2_INODE_UPDATE_CREDITS); ++ if (IS_ERR(handle)) { ++ ret = -ENOMEM; ++ mlog_errno(ret); ++ goto out; ++ } ++ ++ ret = ocfs2_jbd2_file_inode(handle, inode); ++ if (ret < 0) ++ mlog_errno(ret); ++ ++out: ++ if (ret) { ++ if (!IS_ERR(handle)) ++ ocfs2_commit_trans(osb, handle); ++ handle = ERR_PTR(ret); ++ } ++ return handle; ++} ++ + /* Some parts of this taken from generic_cont_expand, which turned out + * to be too fragile to do exactly what we need without us having to + * worry about recursive locking in ->write_begin() and ->write_end(). */ +-static int ocfs2_write_zero_page(struct inode *inode, +- u64 size) ++static int ocfs2_write_zero_page(struct inode *inode, u64 abs_from, ++ u64 abs_to) + { + struct address_space *mapping = inode->i_mapping; + struct page *page; +- unsigned long index; +- unsigned int offset; ++ unsigned long index = abs_from >> PAGE_CACHE_SHIFT; + handle_t *handle = NULL; + int ret; ++ unsigned zero_from, zero_to, block_start, block_end; + +- offset = (size & (PAGE_CACHE_SIZE-1)); /* Within page */ +- /* ugh. in prepare/commit_write, if from==to==start of block, we +- ** skip the prepare. make sure we never send an offset for the start +- ** of a block +- */ +- if ((offset & (inode->i_sb->s_blocksize - 1)) == 0) { +- offset++; +- } +- index = size >> PAGE_CACHE_SHIFT; ++ BUG_ON(abs_from >= abs_to); ++ BUG_ON(abs_to > (((u64)index + 1) << PAGE_CACHE_SHIFT)); ++ BUG_ON(abs_from & (inode->i_blkbits - 1)); + + page = grab_cache_page(mapping, index); + if (!page) { +@@ -768,31 +795,51 @@ static int ocfs2_write_zero_page(struct + goto out; + } + +- ret = ocfs2_prepare_write_nolock(inode, page, offset, offset); +- if (ret < 0) { +- mlog_errno(ret); +- goto out_unlock; +- } ++ /* Get the offsets within the page that we want to zero */ ++ zero_from = abs_from & (PAGE_CACHE_SIZE - 1); ++ zero_to = abs_to & (PAGE_CACHE_SIZE - 1); ++ if (!zero_to) ++ zero_to = PAGE_CACHE_SIZE; ++ ++ /* We know that zero_from is block aligned */ ++ for (block_start = zero_from; block_start < zero_to; ++ block_start = block_end) { ++ block_end = block_start + (1 << inode->i_blkbits); + +- if (ocfs2_should_order_data(inode)) { +- handle = ocfs2_start_walk_page_trans(inode, page, offset, +- offset); +- if (IS_ERR(handle)) { +- ret = PTR_ERR(handle); +- handle = NULL; ++ /* ++ * block_start is block-aligned. Bump it by one to ++ * force ocfs2_{prepare,commit}_write() to zero the ++ * whole block. ++ */ ++ ret = ocfs2_prepare_write_nolock(inode, page, ++ block_start + 1, ++ block_start + 1); ++ if (ret < 0) { ++ mlog_errno(ret); + goto out_unlock; + } +- } + +- /* must not update i_size! */ +- ret = block_commit_write(page, offset, offset); +- if (ret < 0) +- mlog_errno(ret); +- else +- ret = 0; ++ if (!handle) { ++ handle = ocfs2_zero_start_ordered_transaction(inode); ++ if (IS_ERR(handle)) { ++ ret = PTR_ERR(handle); ++ handle = NULL; ++ break; ++ } ++ } ++ ++ /* must not update i_size! */ ++ ret = block_commit_write(page, block_start + 1, ++ block_start + 1); ++ if (ret < 0) ++ mlog_errno(ret); ++ else ++ ret = 0; ++ } + + if (handle) + ocfs2_commit_trans(OCFS2_SB(inode->i_sb), handle); ++ + out_unlock: + unlock_page(page); + page_cache_release(page); +@@ -804,18 +851,21 @@ static int ocfs2_zero_extend(struct inod + u64 zero_to_size) + { + int ret = 0; +- u64 start_off; ++ u64 start_off, next_off; + struct super_block *sb = inode->i_sb; + + start_off = ocfs2_align_bytes_to_blocks(sb, i_size_read(inode)); + while (start_off < zero_to_size) { +- ret = ocfs2_write_zero_page(inode, start_off); ++ next_off = (start_off & PAGE_CACHE_MASK) + PAGE_CACHE_SIZE; ++ if (next_off > zero_to_size) ++ next_off = zero_to_size; ++ ret = ocfs2_write_zero_page(inode, start_off, next_off); + if (ret < 0) { + mlog_errno(ret); + goto out; + } + +- start_off += sb->s_blocksize; ++ start_off = next_off; + + /* + * Very large extends have the potential to lock up diff --git a/queue-2.6.34/p54pci-add-symbol-ap-300-minipci-adapters-pciid.patch b/queue-2.6.34/p54pci-add-symbol-ap-300-minipci-adapters-pciid.patch new file mode 100644 index 00000000000..d5cbd3de243 --- /dev/null +++ b/queue-2.6.34/p54pci-add-symbol-ap-300-minipci-adapters-pciid.patch @@ -0,0 +1,28 @@ +From 50900f1698f68127e54c67fdfe829e4a97b1be2b Mon Sep 17 00:00:00 2001 +From: Joerg Albert +Date: Sun, 13 Jun 2010 14:22:23 +0200 +Subject: p54pci: add Symbol AP-300 minipci adapters pciid + +From: Joerg Albert + +commit 50900f1698f68127e54c67fdfe829e4a97b1be2b upstream. + +Signed-off-by: Christian Lamparter +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/p54/p54pci.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/net/wireless/p54/p54pci.c ++++ b/drivers/net/wireless/p54/p54pci.c +@@ -41,6 +41,8 @@ static DEFINE_PCI_DEVICE_TABLE(p54p_tabl + { PCI_DEVICE(0x1260, 0x3877) }, + /* Intersil PRISM Javelin/Xbow Wireless LAN adapter */ + { PCI_DEVICE(0x1260, 0x3886) }, ++ /* Intersil PRISM Xbow Wireless LAN adapter (Symbol AP-300) */ ++ { PCI_DEVICE(0x1260, 0xffff) }, + { }, + }; + diff --git a/queue-2.6.34/perf_events-fix-intel-westmere-event-constraints.patch b/queue-2.6.34/perf_events-fix-intel-westmere-event-constraints.patch new file mode 100644 index 00000000000..dc9dbad0ad0 --- /dev/null +++ b/queue-2.6.34/perf_events-fix-intel-westmere-event-constraints.patch @@ -0,0 +1,38 @@ +From d11007703c31db534674ebeeb9eb047bbbe758bd Mon Sep 17 00:00:00 2001 +From: Stephane Eranian +Date: Thu, 10 Jun 2010 13:25:01 +0200 +Subject: perf_events: Fix Intel Westmere event constraints + +From: Stephane Eranian + +commit d11007703c31db534674ebeeb9eb047bbbe758bd upstream. + +Based on Intel Vol3b (March 2010), the event +SNOOPQ_REQUEST_OUTSTANDING is restricted to counters 0,1 so +update the event table for Intel Westmere accordingly. + +Signed-off-by: Stephane Eranian +Cc: peterz@infradead.org +Cc: paulus@samba.org +Cc: davem@davemloft.net +Cc: fweisbec@gmail.com +Cc: perfmon2-devel@lists.sf.net +Cc: eranian@gmail.com +LKML-Reference: <4c10cb56.5120e30a.2eb4.ffffc3de@mx.google.com> +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/cpu/perf_event_intel.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/arch/x86/kernel/cpu/perf_event_intel.c ++++ b/arch/x86/kernel/cpu/perf_event_intel.c +@@ -72,6 +72,7 @@ static struct event_constraint intel_wes + INTEL_EVENT_CONSTRAINT(0x51, 0x3), /* L1D */ + INTEL_EVENT_CONSTRAINT(0x60, 0x1), /* OFFCORE_REQUESTS_OUTSTANDING */ + INTEL_EVENT_CONSTRAINT(0x63, 0x3), /* CACHE_LOCK_CYCLES */ ++ INTEL_EVENT_CONSTRAINT(0xb3, 0x1), /* SNOOPQ_REQUEST_OUTSTANDING */ + EVENT_CONSTRAINT_END + }; + diff --git a/queue-2.6.34/powerpc-5200-fix-build-error-in-sound-code.patch b/queue-2.6.34/powerpc-5200-fix-build-error-in-sound-code.patch new file mode 100644 index 00000000000..8a1a84fe16a --- /dev/null +++ b/queue-2.6.34/powerpc-5200-fix-build-error-in-sound-code.patch @@ -0,0 +1,47 @@ +From f487537c2b6b23332bbea7ecb1fe793b6c74d5b2 Mon Sep 17 00:00:00 2001 +From: Grant Likely +Date: Mon, 14 Jun 2010 00:03:34 -0600 +Subject: powerpc/5200: Fix build error in sound code. + +From: Grant Likely + +commit f487537c2b6b23332bbea7ecb1fe793b6c74d5b2 upstream. + +Compiling in the MPC5200 sound drivers results in the following build error: + +sound/soc/fsl/mpc5200_psc_ac97.o: In function `to_psc_dma_stream': +mpc5200_psc_ac97.c:(.text+0x0): multiple definition of `to_psc_dma_stream' +sound/soc/fsl/mpc5200_dma.o:mpc5200_dma.c:(.text+0x0): first defined here +sound/soc/fsl/efika-audio-fabric.o: In function `to_psc_dma_stream': +efika-audio-fabric.c:(.text+0x0): multiple definition of `to_psc_dma_stream' +sound/soc/fsl/mpc5200_dma.o:mpc5200_dma.c:(.text+0x0): first defined here +make[3]: *** [sound/soc/fsl/built-in.o] Error 1 +make[2]: *** [sound/soc/fsl] Error 2 +make[1]: *** [sound/soc] Error 2 +make: *** [sound] Error 2 + +This patch fixes it by declaring the inline function in the header file to +also be a static. + +Signed-off-by: Grant Likely +Cc: Jon Smirl +Tested-by: John Hilmar Linkhorst +Acked-by: Mark Brown +Cc: Peter Korsgaard +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/fsl/mpc5200_dma.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/soc/fsl/mpc5200_dma.h ++++ b/sound/soc/fsl/mpc5200_dma.h +@@ -73,7 +73,7 @@ struct psc_dma { + }; + + /* Utility for retrieving psc_dma_stream structure from a substream */ +-inline struct psc_dma_stream * ++static inline struct psc_dma_stream * + to_psc_dma_stream(struct snd_pcm_substream *substream, struct psc_dma *psc_dma) + { + if (substream->pstr->stream == SNDRV_PCM_STREAM_CAPTURE) diff --git a/queue-2.6.34/series b/queue-2.6.34/series index cd29a6dfd2c..82ea36c3d1c 100644 --- a/queue-2.6.34/series +++ b/queue-2.6.34/series @@ -12,3 +12,40 @@ tcp-tcp_synack_options-fix.patch tcp-use-correct-net-ns-in-cookie_v4_check.patch usbnet-set-parent-device-early-for-netdev_printk.patch fix-mis-applied-upstream-commit-ac9721f3f54b27a16c7e1afb2481e7ee95a70318.patch +ssb-handle-netbook-devices-where-the-sprom-address-is-changed.patch +hwmon-k8temp-bypass-core-swapping-on-single-core-processors.patch +hwmon-k8temp-fix-temperature-reporting-for-asb1-processor-revisions.patch +hwmon-i5k_amb-fix-sysfs-attribute-for-lockdep.patch +hwmon-k10temp-do-not-blacklist-known-working-cpu-models.patch +hwmon-coretemp-properly-label-the-sensors.patch +hwmon-coretemp-skip-duplicate-cpu-entries.patch +hwmon-it87-fix-in7-on-it8720f.patch +cifs-remove-bogus-first_time-check-in-ntlmv2-session-setup-code.patch +cifs-don-t-attempt-busy-file-rename-unless-it-s-in-same-directory.patch +cifs-fix-a-malicious-redirect-problem-in-the-dns-lookup-code.patch +alsa-hda-don-t-check-capture-source-mixer-if-no-adc-is-available.patch +alsa-hda-add-macbook-5-2-quirk.patch +alsa-hda-restore-cleared-pin-controls-on-resume.patch +cpmac-do-not-leak-struct-net_device-on-phy_connect-errors.patch +sky2-restore-multicast-after-restart.patch +sky2-enable-rx-tx-in-sky2_phy_reinit.patch +net-fix-problem-in-reading-sock-tx-queue.patch +tcp-fix-crash-in-tcp_xmit_retransmit_queue.patch +net-core-neighbour-update-oops.patch +math-emu-correct-test-for-downshifting-fraction-in-_fp_from_int.patch +cmd640-fix-kernel-oops-in-test_irq-method.patch +nfsv4-fix-an-embarassing-typo-in-encode_attrs.patch +nfsv4-ensure-that-proc-self-mountinfo-displays-the-minor-version-number.patch +sunrpc-fix-a-re-entrancy-bug-in-xs_tcp_read_calldir.patch +powerpc-5200-fix-build-error-in-sound-code.patch +ath9k-avoid-corrupt-frames-being-forwarded-to-mac80211.patch +hostap-protect-against-initialization-interrupt.patch +tpm-readpubek-output-struct-fix.patch +fb-fix-colliding-defines-for-fb-flags.patch +iwlwifi-cancel-scan-watchdog-in-iwl_bg_abort_scan.patch +mac80211-do-not-wip-out-old-supported-rates.patch +btrfs-fix-checks-in-btrfs_ioc_clone_range.patch +ocfs2-no-need-to-zero-pages-past-i_size.patch +ocfs2-when-zero-extending-do-it-by-page.patch +p54pci-add-symbol-ap-300-minipci-adapters-pciid.patch +perf_events-fix-intel-westmere-event-constraints.patch diff --git a/queue-2.6.34/sky2-enable-rx-tx-in-sky2_phy_reinit.patch b/queue-2.6.34/sky2-enable-rx-tx-in-sky2_phy_reinit.patch new file mode 100644 index 00000000000..4f6f6a01b2e --- /dev/null +++ b/queue-2.6.34/sky2-enable-rx-tx-in-sky2_phy_reinit.patch @@ -0,0 +1,80 @@ +From 38000a94a902e94ca8b5498f7871c6316de8957a Mon Sep 17 00:00:00 2001 +From: Brandon Philips +Date: Wed, 16 Jun 2010 16:21:58 +0000 +Subject: sky2: enable rx/tx in sky2_phy_reinit() + +From: Brandon Philips + +commit 38000a94a902e94ca8b5498f7871c6316de8957a upstream. + +sky2_phy_reinit is called by the ethtool helpers sky2_set_settings, +sky2_nway_reset and sky2_set_pauseparam when netif_running. + +However, at the end of sky2_phy_init GM_GP_CTRL has GM_GPCR_RX_ENA and +GM_GPCR_TX_ENA cleared. So, doing these commands causes the device to +stop working: + +$ ethtool -r eth0 +$ ethtool -A eth0 autoneg off + +Fix this issue by enabling Rx/Tx after running sky2_phy_init in +sky2_phy_reinit. + +Signed-off-by: Brandon Philips +Tested-by: Brandon Philips +Cc: stable@kernel.org +Tested-by: Mike McCormack +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/sky2.c | 19 ++++++++++++++----- + 1 file changed, 14 insertions(+), 5 deletions(-) + +--- a/drivers/net/sky2.c ++++ b/drivers/net/sky2.c +@@ -720,11 +720,24 @@ static void sky2_phy_power_down(struct s + sky2_write8(hw, B2_TST_CTRL1, TST_CFG_WRITE_OFF); + } + ++/* Enable Rx/Tx */ ++static void sky2_enable_rx_tx(struct sky2_port *sky2) ++{ ++ struct sky2_hw *hw = sky2->hw; ++ unsigned port = sky2->port; ++ u16 reg; ++ ++ reg = gma_read16(hw, port, GM_GP_CTRL); ++ reg |= GM_GPCR_RX_ENA | GM_GPCR_TX_ENA; ++ gma_write16(hw, port, GM_GP_CTRL, reg); ++} ++ + /* Force a renegotiation */ + static void sky2_phy_reinit(struct sky2_port *sky2) + { + spin_lock_bh(&sky2->phy_lock); + sky2_phy_init(sky2->hw, sky2->port); ++ sky2_enable_rx_tx(sky2); + spin_unlock_bh(&sky2->phy_lock); + } + +@@ -2002,7 +2015,6 @@ static void sky2_link_up(struct sky2_por + { + struct sky2_hw *hw = sky2->hw; + unsigned port = sky2->port; +- u16 reg; + static const char *fc_name[] = { + [FC_NONE] = "none", + [FC_TX] = "tx", +@@ -2010,10 +2022,7 @@ static void sky2_link_up(struct sky2_por + [FC_BOTH] = "both", + }; + +- /* enable Rx/Tx */ +- reg = gma_read16(hw, port, GM_GP_CTRL); +- reg |= GM_GPCR_RX_ENA | GM_GPCR_TX_ENA; +- gma_write16(hw, port, GM_GP_CTRL, reg); ++ sky2_enable_rx_tx(sky2); + + gm_phy_write(hw, port, PHY_MARV_INT_MASK, PHY_M_DEF_MSK); + diff --git a/queue-2.6.34/sky2-restore-multicast-after-restart.patch b/queue-2.6.34/sky2-restore-multicast-after-restart.patch new file mode 100644 index 00000000000..b74dc64b0d7 --- /dev/null +++ b/queue-2.6.34/sky2-restore-multicast-after-restart.patch @@ -0,0 +1,30 @@ +From 37652522faa0877dc6d0dbb6b999bdccc07f0e89 Mon Sep 17 00:00:00 2001 +From: Mike McCormack +Date: Thu, 13 May 2010 06:12:48 +0000 +Subject: sky2: Restore multicast after restart + +From: Mike McCormack + +commit 37652522faa0877dc6d0dbb6b999bdccc07f0e89 upstream. + +Multicast settings will be lost on reset, so restore them. + +Signed-off-by: Mike McCormack +Acked-by: Stephen Hemminger +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/sky2.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/sky2.c ++++ b/drivers/net/sky2.c +@@ -3293,6 +3293,7 @@ static void sky2_restart(struct work_str + continue; + + sky2_hw_up(sky2); ++ sky2_set_multicast(dev); + netif_wake_queue(dev); + } + diff --git a/queue-2.6.34/ssb-handle-netbook-devices-where-the-sprom-address-is-changed.patch b/queue-2.6.34/ssb-handle-netbook-devices-where-the-sprom-address-is-changed.patch new file mode 100644 index 00000000000..943aa933313 --- /dev/null +++ b/queue-2.6.34/ssb-handle-netbook-devices-where-the-sprom-address-is-changed.patch @@ -0,0 +1,237 @@ +From stable-bounces@linux.kernel.org Sun Jul 11 16:26:25 2010 +From: Larry Finger +Date: Sun, 11 Jul 2010 18:26:15 -0500 +Subject: ssb: Handle Netbook devices where the SPROM address is changed +To: Greg KH +Cc: linux-stable +Message-ID: <4C3A5317.3090603@lwfinger.net> + +From: Christoph Fritz + +For some Netbook computers with Broadcom BCM4312 wireless interfaces, +the SPROM has been moved to a new location. When the ssb driver tries to +read the old location, the systems hangs when trying to read a +non-existent location. Such freezes are particularly bad as they do not +log the failure. + +This patch is modified from commit +da1fdb02d9200ff28b6f3a380d21930335fe5429 with some pieces from other +mainline changes so that it can be applied to stable 2.6.34.Y. + +Signed-off-by: Larry Finger +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ssb/driver_chipcommon.c | 3 + + drivers/ssb/driver_chipcommon_pmu.c | 17 ++++------- + drivers/ssb/pci.c | 46 ++++++++++++++++++++++++++---- + drivers/ssb/sprom.c | 15 +++++++++ + include/linux/ssb/ssb.h | 1 + include/linux/ssb/ssb_driver_chipcommon.h | 2 + + include/linux/ssb/ssb_regs.h | 3 + + 7 files changed, 70 insertions(+), 17 deletions(-) + +--- a/drivers/ssb/driver_chipcommon.c ++++ b/drivers/ssb/driver_chipcommon.c +@@ -233,6 +233,9 @@ void ssb_chipcommon_init(struct ssb_chip + { + if (!cc->dev) + return; /* We don't have a ChipCommon */ ++ if (cc->dev->id.revision >= 11) ++ cc->status = chipco_read32(cc, SSB_CHIPCO_CHIPSTAT); ++ ssb_dprintk(KERN_INFO PFX "chipcommon status is 0x%x\n", cc->status); + ssb_pmu_init(cc); + chipco_powercontrol_init(cc); + ssb_chipco_set_clockmode(cc, SSB_CLKMODE_FAST); +--- a/drivers/ssb/driver_chipcommon_pmu.c ++++ b/drivers/ssb/driver_chipcommon_pmu.c +@@ -502,9 +502,9 @@ static void ssb_pmu_resources_init(struc + chipco_write32(cc, SSB_CHIPCO_PMU_MAXRES_MSK, max_msk); + } + ++/* http://bcm-v4.sipsolutions.net/802.11/SSB/PmuInit */ + void ssb_pmu_init(struct ssb_chipcommon *cc) + { +- struct ssb_bus *bus = cc->dev->bus; + u32 pmucap; + + if (!(cc->capabilities & SSB_CHIPCO_CAP_PMU)) +@@ -516,15 +516,12 @@ void ssb_pmu_init(struct ssb_chipcommon + ssb_dprintk(KERN_DEBUG PFX "Found rev %u PMU (capabilities 0x%08X)\n", + cc->pmu.rev, pmucap); + +- if (cc->pmu.rev >= 1) { +- if ((bus->chip_id == 0x4325) && (bus->chip_rev < 2)) { +- chipco_mask32(cc, SSB_CHIPCO_PMU_CTL, +- ~SSB_CHIPCO_PMU_CTL_NOILPONW); +- } else { +- chipco_set32(cc, SSB_CHIPCO_PMU_CTL, +- SSB_CHIPCO_PMU_CTL_NOILPONW); +- } +- } ++ if (cc->pmu.rev == 1) ++ chipco_mask32(cc, SSB_CHIPCO_PMU_CTL, ++ ~SSB_CHIPCO_PMU_CTL_NOILPONW); ++ else ++ chipco_set32(cc, SSB_CHIPCO_PMU_CTL, ++ SSB_CHIPCO_PMU_CTL_NOILPONW); + ssb_pmu_pll_init(cc); + ssb_pmu_resources_init(cc); + } +--- a/drivers/ssb/pci.c ++++ b/drivers/ssb/pci.c +@@ -23,6 +23,7 @@ + + #include "ssb_private.h" + ++bool ssb_is_sprom_available(struct ssb_bus *bus); + + /* Define the following to 1 to enable a printk on each coreswitch. */ + #define SSB_VERBOSE_PCICORESWITCH_DEBUG 0 +@@ -168,7 +169,7 @@ err_pci: + } + + /* Get the word-offset for a SSB_SPROM_XXX define. */ +-#define SPOFF(offset) (((offset) - SSB_SPROM_BASE) / sizeof(u16)) ++#define SPOFF(offset) ((offset) / sizeof(u16)) + /* Helper to extract some _offset, which is one of the SSB_SPROM_XXX defines. */ + #define SPEX16(_outvar, _offset, _mask, _shift) \ + out->_outvar = ((in[SPOFF(_offset)] & (_mask)) >> (_shift)) +@@ -253,8 +254,13 @@ static int sprom_do_read(struct ssb_bus + { + int i; + ++ /* Check if SPROM can be read */ ++ if (ioread16(bus->mmio + bus->sprom_offset) == 0xFFFF) { ++ ssb_printk(KERN_ERR PFX "Unable to read SPROM\n"); ++ return -ENODEV; ++ } + for (i = 0; i < bus->sprom_size; i++) +- sprom[i] = ioread16(bus->mmio + SSB_SPROM_BASE + (i * 2)); ++ sprom[i] = ioread16(bus->mmio + bus->sprom_offset + (i * 2)); + + return 0; + } +@@ -285,7 +291,7 @@ static int sprom_do_write(struct ssb_bus + ssb_printk("75%%"); + else if (i % 2) + ssb_printk("."); +- writew(sprom[i], bus->mmio + SSB_SPROM_BASE + (i * 2)); ++ writew(sprom[i], bus->mmio + bus->sprom_offset + (i * 2)); + mmiowb(); + msleep(20); + } +@@ -621,21 +627,49 @@ static int ssb_pci_sprom_get(struct ssb_ + int err = -ENOMEM; + u16 *buf; + ++ if (!ssb_is_sprom_available(bus)) { ++ ssb_printk(KERN_ERR PFX "No SPROM available!\n"); ++ return -ENODEV; ++ } ++ if (bus->chipco.dev) { /* can be unavailible! */ ++ /* ++ * get SPROM offset: SSB_SPROM_BASE1 except for ++ * chipcommon rev >= 31 or chip ID is 0x4312 and ++ * chipcommon status & 3 == 2 ++ */ ++ if (bus->chipco.dev->id.revision >= 31) ++ bus->sprom_offset = SSB_SPROM_BASE31; ++ else if (bus->chip_id == 0x4312 && ++ (bus->chipco.status & 0x03) == 2) ++ bus->sprom_offset = SSB_SPROM_BASE31; ++ else ++ bus->sprom_offset = SSB_SPROM_BASE1; ++ } else { ++ bus->sprom_offset = SSB_SPROM_BASE1; ++ } ++ ssb_dprintk(KERN_INFO PFX "SPROM offset is 0x%x\n", bus->sprom_offset); ++ + buf = kcalloc(SSB_SPROMSIZE_WORDS_R123, sizeof(u16), GFP_KERNEL); + if (!buf) + goto out; + bus->sprom_size = SSB_SPROMSIZE_WORDS_R123; +- sprom_do_read(bus, buf); ++ err = sprom_do_read(bus, buf); ++ if (err) ++ goto out_free; + err = sprom_check_crc(buf, bus->sprom_size); + if (err) { + /* try for a 440 byte SPROM - revision 4 and higher */ + kfree(buf); + buf = kcalloc(SSB_SPROMSIZE_WORDS_R4, sizeof(u16), + GFP_KERNEL); +- if (!buf) ++ if (!buf) { ++ err = -ENOMEM; + goto out; ++ } + bus->sprom_size = SSB_SPROMSIZE_WORDS_R4; +- sprom_do_read(bus, buf); ++ err = sprom_do_read(bus, buf); ++ if (err) ++ goto out_free; + err = sprom_check_crc(buf, bus->sprom_size); + if (err) { + /* All CRC attempts failed. +--- a/drivers/ssb/sprom.c ++++ b/drivers/ssb/sprom.c +@@ -176,3 +176,18 @@ const struct ssb_sprom *ssb_get_fallback + { + return fallback_sprom; + } ++ ++/* http://bcm-v4.sipsolutions.net/802.11/IsSpromAvailable */ ++bool ssb_is_sprom_available(struct ssb_bus *bus) ++{ ++ /* status register only exists on chipcomon rev >= 11 and we need check ++ for >= 31 only */ ++ /* this routine differs from specs as we do not access SPROM directly ++ on PCMCIA */ ++ if (bus->bustype == SSB_BUSTYPE_PCI && ++ bus->chipco.dev && /* can be unavailible! */ ++ bus->chipco.dev->id.revision >= 31) ++ return bus->chipco.capabilities & SSB_CHIPCO_CAP_SPROM; ++ ++ return true; ++} +--- a/include/linux/ssb/ssb.h ++++ b/include/linux/ssb/ssb.h +@@ -306,6 +306,7 @@ struct ssb_bus { + u16 chip_id; + u16 chip_rev; + u16 sprom_size; /* number of words in sprom */ ++ u16 sprom_offset; + u8 chip_package; + + /* List of devices (cores) on the backplane. */ +--- a/include/linux/ssb/ssb_driver_chipcommon.h ++++ b/include/linux/ssb/ssb_driver_chipcommon.h +@@ -46,6 +46,7 @@ + #define SSB_PLLTYPE_7 0x00038000 /* 25Mhz, 4 dividers */ + #define SSB_CHIPCO_CAP_PCTL 0x00040000 /* Power Control */ + #define SSB_CHIPCO_CAP_OTPS 0x00380000 /* OTP size */ ++#define SSB_CHIPCO_CAP_SPROM 0x40000000 /* SPROM present */ + #define SSB_CHIPCO_CAP_OTPS_SHIFT 19 + #define SSB_CHIPCO_CAP_OTPS_BASE 5 + #define SSB_CHIPCO_CAP_JTAGM 0x00400000 /* JTAG master present */ +@@ -564,6 +565,7 @@ struct ssb_chipcommon_pmu { + struct ssb_chipcommon { + struct ssb_device *dev; + u32 capabilities; ++ u32 status; + /* Fast Powerup Delay constant */ + u16 fast_pwrup_delay; + struct ssb_chipcommon_pmu pmu; +--- a/include/linux/ssb/ssb_regs.h ++++ b/include/linux/ssb/ssb_regs.h +@@ -170,7 +170,8 @@ + #define SSB_SPROMSIZE_WORDS_R4 220 + #define SSB_SPROMSIZE_BYTES_R123 (SSB_SPROMSIZE_WORDS_R123 * sizeof(u16)) + #define SSB_SPROMSIZE_BYTES_R4 (SSB_SPROMSIZE_WORDS_R4 * sizeof(u16)) +-#define SSB_SPROM_BASE 0x1000 ++#define SSB_SPROM_BASE1 0x1000 ++#define SSB_SPROM_BASE31 0x0800 + #define SSB_SPROM_REVISION 0x107E + #define SSB_SPROM_REVISION_REV 0x00FF /* SPROM Revision number */ + #define SSB_SPROM_REVISION_CRC 0xFF00 /* SPROM CRC8 value */ diff --git a/queue-2.6.34/sunrpc-fix-a-re-entrancy-bug-in-xs_tcp_read_calldir.patch b/queue-2.6.34/sunrpc-fix-a-re-entrancy-bug-in-xs_tcp_read_calldir.patch new file mode 100644 index 00000000000..3b284f9d72d --- /dev/null +++ b/queue-2.6.34/sunrpc-fix-a-re-entrancy-bug-in-xs_tcp_read_calldir.patch @@ -0,0 +1,103 @@ +From b76ce56192bcf618013fb9aecd83488cffd645cc Mon Sep 17 00:00:00 2001 +From: Trond Myklebust +Date: Wed, 16 Jun 2010 13:57:32 -0400 +Subject: SUNRPC: Fix a re-entrancy bug in xs_tcp_read_calldir() + +From: Trond Myklebust + +commit b76ce56192bcf618013fb9aecd83488cffd645cc upstream. + +If the attempt to read the calldir fails, then instead of storing the read +bytes, we currently discard them. This leads to a garbage final result when +upon re-entry to the same routine, we read the remaining bytes. + +Fixes the regression in bugzilla number 16213. Please see + https://bugzilla.kernel.org/show_bug.cgi?id=16213 + +Signed-off-by: Trond Myklebust +Signed-off-by: Greg Kroah-Hartman + +--- + net/sunrpc/xprtsock.c | 38 ++++++++++++++++++++++---------------- + 1 file changed, 22 insertions(+), 16 deletions(-) + +--- a/net/sunrpc/xprtsock.c ++++ b/net/sunrpc/xprtsock.c +@@ -224,7 +224,8 @@ struct sock_xprt { + * State of TCP reply receive + */ + __be32 tcp_fraghdr, +- tcp_xid; ++ tcp_xid, ++ tcp_calldir; + + u32 tcp_offset, + tcp_reclen; +@@ -942,7 +943,7 @@ static inline void xs_tcp_read_calldir(s + { + size_t len, used; + u32 offset; +- __be32 calldir; ++ char *p; + + /* + * We want transport->tcp_offset to be 8 at the end of this routine +@@ -951,26 +952,33 @@ static inline void xs_tcp_read_calldir(s + * transport->tcp_offset is 4 (after having already read the xid). + */ + offset = transport->tcp_offset - sizeof(transport->tcp_xid); +- len = sizeof(calldir) - offset; ++ len = sizeof(transport->tcp_calldir) - offset; + dprintk("RPC: reading CALL/REPLY flag (%Zu bytes)\n", len); +- used = xdr_skb_read_bits(desc, &calldir, len); ++ p = ((char *) &transport->tcp_calldir) + offset; ++ used = xdr_skb_read_bits(desc, p, len); + transport->tcp_offset += used; + if (used != len) + return; + transport->tcp_flags &= ~TCP_RCV_READ_CALLDIR; +- transport->tcp_flags |= TCP_RCV_COPY_CALLDIR; +- transport->tcp_flags |= TCP_RCV_COPY_DATA; + /* + * We don't yet have the XDR buffer, so we will write the calldir + * out after we get the buffer from the 'struct rpc_rqst' + */ +- if (ntohl(calldir) == RPC_REPLY) ++ switch (ntohl(transport->tcp_calldir)) { ++ case RPC_REPLY: ++ transport->tcp_flags |= TCP_RCV_COPY_CALLDIR; ++ transport->tcp_flags |= TCP_RCV_COPY_DATA; + transport->tcp_flags |= TCP_RPC_REPLY; +- else ++ break; ++ case RPC_CALL: ++ transport->tcp_flags |= TCP_RCV_COPY_CALLDIR; ++ transport->tcp_flags |= TCP_RCV_COPY_DATA; + transport->tcp_flags &= ~TCP_RPC_REPLY; +- dprintk("RPC: reading %s CALL/REPLY flag %08x\n", +- (transport->tcp_flags & TCP_RPC_REPLY) ? +- "reply for" : "request with", calldir); ++ break; ++ default: ++ dprintk("RPC: invalid request message type\n"); ++ xprt_force_disconnect(&transport->xprt); ++ } + xs_tcp_check_fraghdr(transport); + } + +@@ -990,12 +998,10 @@ static inline void xs_tcp_read_common(st + /* + * Save the RPC direction in the XDR buffer + */ +- __be32 calldir = transport->tcp_flags & TCP_RPC_REPLY ? +- htonl(RPC_REPLY) : 0; +- + memcpy(rcvbuf->head[0].iov_base + transport->tcp_copied, +- &calldir, sizeof(calldir)); +- transport->tcp_copied += sizeof(calldir); ++ &transport->tcp_calldir, ++ sizeof(transport->tcp_calldir)); ++ transport->tcp_copied += sizeof(transport->tcp_calldir); + transport->tcp_flags &= ~TCP_RCV_COPY_CALLDIR; + } + diff --git a/queue-2.6.34/tcp-fix-crash-in-tcp_xmit_retransmit_queue.patch b/queue-2.6.34/tcp-fix-crash-in-tcp_xmit_retransmit_queue.patch new file mode 100644 index 00000000000..d0fb1541ece --- /dev/null +++ b/queue-2.6.34/tcp-fix-crash-in-tcp_xmit_retransmit_queue.patch @@ -0,0 +1,44 @@ +From 45e77d314585869dfe43c82679f7e08c9b35b898 Mon Sep 17 00:00:00 2001 +From: Ilpo Järvinen +Date: Mon, 19 Jul 2010 01:16:18 +0000 +Subject: tcp: fix crash in tcp_xmit_retransmit_queue +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ilpo Järvinen + +commit 45e77d314585869dfe43c82679f7e08c9b35b898 upstream. + +It can happen that there are no packets in queue while calling +tcp_xmit_retransmit_queue(). tcp_write_queue_head() then returns +NULL and that gets deref'ed to get sacked into a local var. + +There is no work to do if no packets are outstanding so we just +exit early. + +This oops was introduced by 08ebd1721ab8fd (tcp: remove tp->lost_out +guard to make joining diff nicer). + +Signed-off-by: Ilpo Järvinen +Reported-by: Lennart Schulte +Tested-by: Lennart Schulte +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + net/ipv4/tcp_output.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/net/ipv4/tcp_output.c ++++ b/net/ipv4/tcp_output.c +@@ -2206,6 +2206,9 @@ void tcp_xmit_retransmit_queue(struct so + int mib_idx; + int fwd_rexmitting = 0; + ++ if (!tp->packets_out) ++ return; ++ + if (!tp->lost_out) + tp->retransmit_high = tp->snd_una; + diff --git a/queue-2.6.34/tpm-readpubek-output-struct-fix.patch b/queue-2.6.34/tpm-readpubek-output-struct-fix.patch new file mode 100644 index 00000000000..883927d0d69 --- /dev/null +++ b/queue-2.6.34/tpm-readpubek-output-struct-fix.patch @@ -0,0 +1,34 @@ +From 02a077c52ef7631275a79862ffd9f3dbe9d38bc2 Mon Sep 17 00:00:00 2001 +From: Rajiv Andrade +Date: Mon, 14 Jun 2010 13:58:22 -0300 +Subject: TPM: ReadPubEK output struct fix + +From: Rajiv Andrade + +commit 02a077c52ef7631275a79862ffd9f3dbe9d38bc2 upstream. + +This patch adds a missing element of the ReadPubEK command output, +that prevents future overflow of this buffer when copying the +TPM output result into it. + +Prevents a kernel panic in case the user tries to read the +pubek from sysfs. + +Signed-off-by: Rajiv Andrade +Signed-off-by: James Morris +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/char/tpm/tpm.h | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/char/tpm/tpm.h ++++ b/drivers/char/tpm/tpm.h +@@ -224,6 +224,7 @@ struct tpm_readpubek_params_out { + u8 algorithm[4]; + u8 encscheme[2]; + u8 sigscheme[2]; ++ __be32 paramsize; + u8 parameters[12]; /*assuming RSA*/ + __be32 keysize; + u8 modulus[256];