From: Greg Kroah-Hartman Date: Wed, 26 Sep 2012 23:16:29 +0000 (-0700) Subject: 3.0-stable patches X-Git-Tag: v3.0.44~55 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=d2a63c3ee3f661ec8d7a2e5c64de92c566c24042;p=thirdparty%2Fkernel%2Fstable-queue.git 3.0-stable patches added patches: asix-support-dlink-dub-e100-h-w-ver-c1.patch can-janz-ican3-fix-support-for-older-hardware-revisions.patch can-ti_hecc-fix-oops-during-rmmod.patch cfg80211-fix-possible-circular-lock-on-reg_regdb_search.patch dmaengine-at_hdmac-check-that-each-sg-data-length-is-non-null.patch dmaengine-at_hdmac-fix-comment-in-atc_prep_slave_sg.patch drivers-misc-sgi-xp-xpc_uv.c-sgi-xpc-fails-to-load-when-cpu-0-is-out-of-irq-resources.patch drivers-rtc-rtc-rs5c348.c-fix-hour-decoding-in-12-hour-mode.patch drm-radeon-kms-extend-the-fujitsu-d3003-s2-board-connector-quirk-to-cover-later-silicon-stepping.patch ehci-update-qtd-next-pointer-in-qh-overlay-region-during-unlink.patch fbcon-fix-race-condition-between-console-lock-and-cursor-timer-v1.1.patch intel-xhci-only-switch-the-switchable-ports.patch mutex-place-lock-in-contended-state-after-fastpath_lock-failure.patch nfs-fix-a-problem-with-the-legacy-binary-mount-code.patch nfs-fix-the-initialisation-of-the-readdir-cookieverf-array.patch nfs-return-error-from-decode_getfh-in-decode-open.patch pm-runtime-clear-power.deferred_resume-on-success-in-rpm_suspend.patch pm-runtime-fix-rpm_resume-return-value-for-power.no_callbacks-set.patch rt2x00-fix-rfkill-polling-prior-to-interface-start.patch rt2x00-fix-word-size-of-rt2500usb-mac_csr19-register.patch usb-add-device-quirk-for-joss-optical-touchboard.patch usb-ftdi-sio-add-support-for-more-physik-instrumente-devices.patch usb-ftdi_sio-do-not-claim-cdc-acm-function.patch usb-ftdi_sio-pid-for-nzr-sem-16-usb.patch usb-host-xhci-fix-compilation-error-for-non-pci-based-stacks.patch xhci-fix-a-logical-vs-bitwise-and-bug.patch xhci-fix-bug-after-deq-ptr-set-to-link-trb.patch xhci-make-handover-code-more-robust.patch xhci-recognize-usb-3.0-devices-as-superspeed-at-powerup.patch --- diff --git a/queue-3.0/asix-support-dlink-dub-e100-h-w-ver-c1.patch b/queue-3.0/asix-support-dlink-dub-e100-h-w-ver-c1.patch new file mode 100644 index 00000000000..e51e7f235a4 --- /dev/null +++ b/queue-3.0/asix-support-dlink-dub-e100-h-w-ver-c1.patch @@ -0,0 +1,33 @@ +From ed3770a9cd5764a575b83810ea679bbff2b03082 Mon Sep 17 00:00:00 2001 +From: Søren Holm +Date: Mon, 17 Sep 2012 21:50:57 +0000 +Subject: asix: Support DLink DUB-E100 H/W Ver C1 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Søren Holm + +commit ed3770a9cd5764a575b83810ea679bbff2b03082 upstream. + +Signed-off-by: Søren Holm +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/usb/asix.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/net/usb/asix.c ++++ b/drivers/net/usb/asix.c +@@ -1537,6 +1537,10 @@ static const struct usb_device_id produc + USB_DEVICE (0x2001, 0x3c05), + .driver_info = (unsigned long) &ax88772_info, + }, { ++ // DLink DUB-E100 H/W Ver C1 ++ USB_DEVICE (0x2001, 0x1a02), ++ .driver_info = (unsigned long) &ax88772_info, ++}, { + // Linksys USB1000 + USB_DEVICE (0x1737, 0x0039), + .driver_info = (unsigned long) &ax88178_info, diff --git a/queue-3.0/can-janz-ican3-fix-support-for-older-hardware-revisions.patch b/queue-3.0/can-janz-ican3-fix-support-for-older-hardware-revisions.patch new file mode 100644 index 00000000000..13499b56e8e --- /dev/null +++ b/queue-3.0/can-janz-ican3-fix-support-for-older-hardware-revisions.patch @@ -0,0 +1,41 @@ +From e21093ef6fb4cbecdf926102286dbe280ae965db Mon Sep 17 00:00:00 2001 +From: "Ira W. Snyder" +Date: Tue, 11 Sep 2012 15:58:15 -0700 +Subject: can: janz-ican3: fix support for older hardware revisions + +From: "Ira W. Snyder" + +commit e21093ef6fb4cbecdf926102286dbe280ae965db upstream. + +The Revision 1.0 Janz CMOD-IO Carrier Board does not have support for +the reset registers. To support older hardware, the code is changed to +use the hardware reset register on the Janz VMOD-ICAN3 hardware itself. + +Signed-off-by: Ira W. Snyder +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/can/janz-ican3.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +--- a/drivers/net/can/janz-ican3.c ++++ b/drivers/net/can/janz-ican3.c +@@ -1249,7 +1249,6 @@ static irqreturn_t ican3_irq(int irq, vo + */ + static int ican3_reset_module(struct ican3_dev *mod) + { +- u8 val = 1 << mod->num; + unsigned long start; + u8 runold, runnew; + +@@ -1263,8 +1262,7 @@ static int ican3_reset_module(struct ica + runold = ioread8(mod->dpm + TARGET_RUNNING); + + /* reset the module */ +- iowrite8(val, &mod->ctrl->reset_assert); +- iowrite8(val, &mod->ctrl->reset_deassert); ++ iowrite8(0x00, &mod->dpmctrl->hwreset); + + /* wait until the module has finished resetting and is running */ + start = jiffies; diff --git a/queue-3.0/can-ti_hecc-fix-oops-during-rmmod.patch b/queue-3.0/can-ti_hecc-fix-oops-during-rmmod.patch new file mode 100644 index 00000000000..684c879eca9 --- /dev/null +++ b/queue-3.0/can-ti_hecc-fix-oops-during-rmmod.patch @@ -0,0 +1,77 @@ +From ab04c8bd423edb03e2148350a091836c196107fc Mon Sep 17 00:00:00 2001 +From: Marc Kleine-Budde +Date: Wed, 19 Sep 2012 14:58:45 +0200 +Subject: can: ti_hecc: fix oops during rmmod + +From: Marc Kleine-Budde + +commit ab04c8bd423edb03e2148350a091836c196107fc upstream. + +This patch fixes an oops which occurs when unloading the driver, while the +network interface is still up. The problem is that first the io mapping is +teared own, then the CAN device is unregistered, resulting in accessing the +hardware's iomem: + +[ 172.744232] Unable to handle kernel paging request at virtual address c88b0040 +[ 172.752441] pgd = c7be4000 +[ 172.755645] [c88b0040] *pgd=87821811, *pte=00000000, *ppte=00000000 +[ 172.762207] Internal error: Oops: 807 [#1] PREEMPT ARM +[ 172.767517] Modules linked in: ti_hecc(-) can_dev +[ 172.772430] CPU: 0 Not tainted (3.5.0alpha-00037-g3554cc0 #126) +[ 172.778961] PC is at ti_hecc_close+0xb0/0x100 [ti_hecc] +[ 172.784423] LR is at __dev_close_many+0x90/0xc0 +[ 172.789123] pc : [] lr : [] psr: 60000013 +[ 172.789123] sp : c5c1de68 ip : 00040081 fp : 00000000 +[ 172.801025] r10: 00000001 r9 : c5c1c000 r8 : 00100100 +[ 172.806457] r7 : c5d0a48c r6 : c5d0a400 r5 : 00000000 r4 : c5d0a000 +[ 172.813232] r3 : c88b0000 r2 : 00000001 r1 : c5d0a000 r0 : c5d0a000 +[ 172.820037] Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user +[ 172.827423] Control: 10c5387d Table: 87be4019 DAC: 00000015 +[ 172.833404] Process rmmod (pid: 600, stack limit = 0xc5c1c2f0) +[ 172.839447] Stack: (0xc5c1de68 to 0xc5c1e000) +[ 172.843994] de60: bf00c6b8 c5c1dec8 c5d0a000 c5d0a000 00200200 c033be58 +[ 172.852478] de80: c5c1de44 c5c1dec8 c5c1dec8 c033bf2c c5c1de90 c5c1de90 c5d0a084 c5c1de44 +[ 172.860992] dea0: c5c1dec8 c033c098 c061d3dc c5d0a000 00000000 c05edf28 c05edb34 c000d724 +[ 172.869476] dec0: 00000000 c033c2f8 c5d0a084 c5d0a084 00000000 c033c370 00000000 c5d0a000 +[ 172.877990] dee0: c05edb00 c033c3b8 c5d0a000 bf00d3ac c05edb00 bf00d7c8 bf00d7c8 c02842dc +[ 172.886474] df00: c02842c8 c0282f90 c5c1c000 c05edb00 bf00d7c8 c0283668 bf00d7c8 00000000 +[ 172.894989] df20: c0611f98 befe2f80 c000d724 c0282d10 bf00d804 00000000 00000013 c0068a8c +[ 172.903472] df40: c5c538e8 685f6974 00636365 c61571a8 c5cb9980 c61571a8 c6158a20 c00c9bc4 +[ 172.911987] df60: 00000000 00000000 c5cb9980 00000000 c5cb9980 00000000 c7823680 00000006 +[ 172.920471] df80: bf00d804 00000880 c5c1df8c 00000000 000d4267 befe2f80 00000001 b6d90068 +[ 172.928985] dfa0: 00000081 c000d5a0 befe2f80 00000001 befe2f80 00000880 b6d90008 00000008 +[ 172.937469] dfc0: befe2f80 00000001 b6d90068 00000081 00000001 00000000 befe2eac 00000000 +[ 172.945983] dfe0: 00000000 befe2b18 00023ba4 b6e6addc 60000010 befe2f80 a8e00190 86d2d344 +[ 172.954498] [] (ti_hecc_close+0xb0/0x100 [ti_hecc]) from [] (__dev__registered_many+0xc0/0x2a0) +[ 172.984161] [] (rollback_registered_many+0xc0/0x2a0) from [] (rollback_registered+0x20/0x30) +[ 172.994750] [] (rollback_registered+0x20/0x30) from [] (unregister_netdevice_queue+0x68/0x98) +[ 173.005401] [] (unregister_netdevice_queue+0x68/0x98) from [] (unregister_netdev+0x18/0x20) +[ 173.015899] [] (unregister_netdev+0x18/0x20) from [] (ti_hecc_remove+0x60/0x80 [ti_hecc]) +[ 173.026245] [] (ti_hecc_remove+0x60/0x80 [ti_hecc]) from [] (platform_drv_remove+0x14/0x18) +[ 173.036712] [] (platform_drv_remove+0x14/0x18) from [] (__device_release_driver+0x7c/0xbc) + +Tested-by: Jan Luebbe +Cc: Anant Gole +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/can/ti_hecc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/can/ti_hecc.c ++++ b/drivers/net/can/ti_hecc.c +@@ -969,12 +969,12 @@ static int __devexit ti_hecc_remove(stru + struct net_device *ndev = platform_get_drvdata(pdev); + struct ti_hecc_priv *priv = netdev_priv(ndev); + ++ unregister_candev(ndev); + clk_disable(priv->clk); + clk_put(priv->clk); + res = platform_get_resource(pdev, IORESOURCE_MEM, 0); + iounmap(priv->base); + release_mem_region(res->start, resource_size(res)); +- unregister_candev(ndev); + free_candev(ndev); + platform_set_drvdata(pdev, NULL); + diff --git a/queue-3.0/cfg80211-fix-possible-circular-lock-on-reg_regdb_search.patch b/queue-3.0/cfg80211-fix-possible-circular-lock-on-reg_regdb_search.patch new file mode 100644 index 00000000000..c4621b77e05 --- /dev/null +++ b/queue-3.0/cfg80211-fix-possible-circular-lock-on-reg_regdb_search.patch @@ -0,0 +1,128 @@ +From a85d0d7f3460b1a123b78e7f7e39bf72c37dfb78 Mon Sep 17 00:00:00 2001 +From: "Luis R. Rodriguez" +Date: Fri, 14 Sep 2012 15:36:57 -0700 +Subject: cfg80211: fix possible circular lock on reg_regdb_search() + +From: "Luis R. Rodriguez" + +commit a85d0d7f3460b1a123b78e7f7e39bf72c37dfb78 upstream. + +When call_crda() is called we kick off a witch hunt search +for the same regulatory domain on our internal regulatory +database and that work gets kicked off on a workqueue, this +is done while the cfg80211_mutex is held. If that workqueue +kicks off it will first lock reg_regdb_search_mutex and +later cfg80211_mutex but to ensure two CPUs will not contend +against cfg80211_mutex the right thing to do is to have the +reg_regdb_search() wait until the cfg80211_mutex is let go. + +The lockdep report is pasted below. + +cfg80211: Calling CRDA to update world regulatory domain + +====================================================== +[ INFO: possible circular locking dependency detected ] +3.3.8 #3 Tainted: G O +------------------------------------------------------- +kworker/0:1/235 is trying to acquire lock: + (cfg80211_mutex){+.+...}, at: [<816468a4>] set_regdom+0x78c/0x808 [cfg80211] + +but task is already holding lock: + (reg_regdb_search_mutex){+.+...}, at: [<81646828>] set_regdom+0x710/0x808 [cfg80211] + +which lock already depends on the new lock. + +the existing dependency chain (in reverse order) is: + +-> #2 (reg_regdb_search_mutex){+.+...}: + [<800a8384>] lock_acquire+0x60/0x88 + [<802950a8>] mutex_lock_nested+0x54/0x31c + [<81645778>] is_world_regdom+0x9f8/0xc74 [cfg80211] + +-> #1 (reg_mutex#2){+.+...}: + [<800a8384>] lock_acquire+0x60/0x88 + [<802950a8>] mutex_lock_nested+0x54/0x31c + [<8164539c>] is_world_regdom+0x61c/0xc74 [cfg80211] + +-> #0 (cfg80211_mutex){+.+...}: + [<800a77b8>] __lock_acquire+0x10d4/0x17bc + [<800a8384>] lock_acquire+0x60/0x88 + [<802950a8>] mutex_lock_nested+0x54/0x31c + [<816468a4>] set_regdom+0x78c/0x808 [cfg80211] + +other info that might help us debug this: + +Chain exists of: + cfg80211_mutex --> reg_mutex#2 --> reg_regdb_search_mutex + + Possible unsafe locking scenario: + + CPU0 CPU1 + ---- ---- + lock(reg_regdb_search_mutex); + lock(reg_mutex#2); + lock(reg_regdb_search_mutex); + lock(cfg80211_mutex); + + *** DEADLOCK *** + +3 locks held by kworker/0:1/235: + #0: (events){.+.+..}, at: [<80089a00>] process_one_work+0x230/0x460 + #1: (reg_regdb_work){+.+...}, at: [<80089a00>] process_one_work+0x230/0x460 + #2: (reg_regdb_search_mutex){+.+...}, at: [<81646828>] set_regdom+0x710/0x808 [cfg80211] + +stack backtrace: +Call Trace: +[<80290fd4>] dump_stack+0x8/0x34 +[<80291bc4>] print_circular_bug+0x2ac/0x2d8 +[<800a77b8>] __lock_acquire+0x10d4/0x17bc +[<800a8384>] lock_acquire+0x60/0x88 +[<802950a8>] mutex_lock_nested+0x54/0x31c +[<816468a4>] set_regdom+0x78c/0x808 [cfg80211] + +Reported-by: Felix Fietkau +Tested-by: Felix Fietkau +Signed-off-by: Luis R. Rodriguez +Reviewed-by: Johannes Berg +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + net/wireless/reg.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +--- a/net/wireless/reg.c ++++ b/net/wireless/reg.c +@@ -331,6 +331,9 @@ static void reg_regdb_search(struct work + struct reg_regdb_search_request *request; + const struct ieee80211_regdomain *curdom, *regdom; + int i, r; ++ bool set_reg = false; ++ ++ mutex_lock(&cfg80211_mutex); + + mutex_lock(®_regdb_search_mutex); + while (!list_empty(®_regdb_search_list)) { +@@ -346,9 +349,7 @@ static void reg_regdb_search(struct work + r = reg_copy_regd(®dom, curdom); + if (r) + break; +- mutex_lock(&cfg80211_mutex); +- set_regdom(regdom); +- mutex_unlock(&cfg80211_mutex); ++ set_reg = true; + break; + } + } +@@ -356,6 +357,11 @@ static void reg_regdb_search(struct work + kfree(request); + } + mutex_unlock(®_regdb_search_mutex); ++ ++ if (set_reg) ++ set_regdom(regdom); ++ ++ mutex_unlock(&cfg80211_mutex); + } + + static DECLARE_WORK(reg_regdb_work, reg_regdb_search); diff --git a/queue-3.0/dmaengine-at_hdmac-check-that-each-sg-data-length-is-non-null.patch b/queue-3.0/dmaengine-at_hdmac-check-that-each-sg-data-length-is-non-null.patch new file mode 100644 index 00000000000..9d43e0b9033 --- /dev/null +++ b/queue-3.0/dmaengine-at_hdmac-check-that-each-sg-data-length-is-non-null.patch @@ -0,0 +1,56 @@ +From c456797681db814f4f5b36909e8e94047bf53d9c Mon Sep 17 00:00:00 2001 +From: Nicolas Ferre +Date: Tue, 11 Sep 2012 17:21:45 +0200 +Subject: dmaengine: at_hdmac: check that each sg data length is non-null + +From: Nicolas Ferre + +commit c456797681db814f4f5b36909e8e94047bf53d9c upstream. + +Avoid the construction of a malformed DMA request sent to +the DMA controller. +Log message is for debug only because this condition is unlikely to +append and may only trigger at driver development time. + +Signed-off-by: Nicolas Ferre +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/dma/at_hdmac.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +--- a/drivers/dma/at_hdmac.c ++++ b/drivers/dma/at_hdmac.c +@@ -702,6 +702,11 @@ atc_prep_slave_sg(struct dma_chan *chan, + + mem = sg_dma_address(sg); + len = sg_dma_len(sg); ++ if (unlikely(!len)) { ++ dev_dbg(chan2dev(chan), ++ "prep_slave_sg: sg(%d) data length is zero\n", i); ++ goto err; ++ } + mem_width = 2; + if (unlikely(mem & 3 || len & 3)) + mem_width = 0; +@@ -736,6 +741,11 @@ atc_prep_slave_sg(struct dma_chan *chan, + + mem = sg_dma_address(sg); + len = sg_dma_len(sg); ++ if (unlikely(!len)) { ++ dev_dbg(chan2dev(chan), ++ "prep_slave_sg: sg(%d) data length is zero\n", i); ++ goto err; ++ } + mem_width = 2; + if (unlikely(mem & 3 || len & 3)) + mem_width = 0; +@@ -769,6 +779,7 @@ atc_prep_slave_sg(struct dma_chan *chan, + + err_desc_get: + dev_err(chan2dev(chan), "not enough descriptors available\n"); ++err: + atc_desc_put(atchan, first); + return NULL; + } diff --git a/queue-3.0/dmaengine-at_hdmac-fix-comment-in-atc_prep_slave_sg.patch b/queue-3.0/dmaengine-at_hdmac-fix-comment-in-atc_prep_slave_sg.patch new file mode 100644 index 00000000000..948aedf3d41 --- /dev/null +++ b/queue-3.0/dmaengine-at_hdmac-fix-comment-in-atc_prep_slave_sg.patch @@ -0,0 +1,31 @@ +From c618a9be0e8c0f36baee2560860a0118a428fb26 Mon Sep 17 00:00:00 2001 +From: Nicolas Ferre +Date: Tue, 11 Sep 2012 17:21:44 +0200 +Subject: dmaengine: at_hdmac: fix comment in atc_prep_slave_sg() + +From: Nicolas Ferre + +commit c618a9be0e8c0f36baee2560860a0118a428fb26 upstream. + +s/dma_memcpy/slave_sg/ and it is sg length that we are +talking about. + +Signed-off-by: Nicolas Ferre +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/dma/at_hdmac.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/dma/at_hdmac.c ++++ b/drivers/dma/at_hdmac.c +@@ -674,7 +674,7 @@ atc_prep_slave_sg(struct dma_chan *chan, + flags); + + if (unlikely(!atslave || !sg_len)) { +- dev_dbg(chan2dev(chan), "prep_dma_memcpy: length is zero!\n"); ++ dev_dbg(chan2dev(chan), "prep_slave_sg: sg length is zero!\n"); + return NULL; + } + diff --git a/queue-3.0/drivers-misc-sgi-xp-xpc_uv.c-sgi-xpc-fails-to-load-when-cpu-0-is-out-of-irq-resources.patch b/queue-3.0/drivers-misc-sgi-xp-xpc_uv.c-sgi-xpc-fails-to-load-when-cpu-0-is-out-of-irq-resources.patch new file mode 100644 index 00000000000..70948198550 --- /dev/null +++ b/queue-3.0/drivers-misc-sgi-xp-xpc_uv.c-sgi-xpc-fails-to-load-when-cpu-0-is-out-of-irq-resources.patch @@ -0,0 +1,167 @@ +From 7838f994b4fceff24c343f4e26a6cf4393869579 Mon Sep 17 00:00:00 2001 +From: Robin Holt +Date: Tue, 21 Aug 2012 16:16:02 -0700 +Subject: drivers/misc/sgi-xp/xpc_uv.c: SGI XPC fails to load when cpu 0 is out of IRQ resources + +From: Robin Holt + +commit 7838f994b4fceff24c343f4e26a6cf4393869579 upstream. + +On many of our larger systems, CPU 0 has had all of its IRQ resources +consumed before XPC loads. Worst cases on machines with multiple 10 +GigE cards and multiple IB cards have depleted the entire first socket +of IRQs. + +This patch makes selecting the node upon which IRQs are allocated (as +well as all the other GRU Message Queue structures) specifiable as a +module load param and has a default behavior of searching all nodes/cpus +for an available resources. + +[akpm@linux-foundation.org: fix build: include cpu.h and module.h] +Signed-off-by: Robin Holt +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/misc/sgi-xp/xpc_uv.c | 84 +++++++++++++++++++++++++++++++++---------- + 1 file changed, 65 insertions(+), 19 deletions(-) + +--- a/drivers/misc/sgi-xp/xpc_uv.c ++++ b/drivers/misc/sgi-xp/xpc_uv.c +@@ -18,6 +18,8 @@ + #include + #include + #include ++#include ++#include + #include + #include + #include +@@ -59,6 +61,8 @@ static struct xpc_heartbeat_uv *xpc_hear + XPC_NOTIFY_MSG_SIZE_UV) + #define XPC_NOTIFY_IRQ_NAME "xpc_notify" + ++static int xpc_mq_node = -1; ++ + static struct xpc_gru_mq_uv *xpc_activate_mq_uv; + static struct xpc_gru_mq_uv *xpc_notify_mq_uv; + +@@ -109,11 +113,8 @@ xpc_get_gru_mq_irq_uv(struct xpc_gru_mq_ + #if defined CONFIG_X86_64 + mq->irq = uv_setup_irq(irq_name, cpu, mq->mmr_blade, mq->mmr_offset, + UV_AFFINITY_CPU); +- if (mq->irq < 0) { +- dev_err(xpc_part, "uv_setup_irq() returned error=%d\n", +- -mq->irq); ++ if (mq->irq < 0) + return mq->irq; +- } + + mq->mmr_value = uv_read_global_mmr64(mmr_pnode, mq->mmr_offset); + +@@ -238,8 +239,9 @@ xpc_create_gru_mq_uv(unsigned int mq_siz + mq->mmr_blade = uv_cpu_to_blade_id(cpu); + + nid = cpu_to_node(cpu); +- page = alloc_pages_exact_node(nid, GFP_KERNEL | __GFP_ZERO | GFP_THISNODE, +- pg_order); ++ page = alloc_pages_exact_node(nid, ++ GFP_KERNEL | __GFP_ZERO | GFP_THISNODE, ++ pg_order); + if (page == NULL) { + dev_err(xpc_part, "xpc_create_gru_mq_uv() failed to alloc %d " + "bytes of memory on nid=%d for GRU mq\n", mq_size, nid); +@@ -1731,9 +1733,50 @@ static struct xpc_arch_operations xpc_ar + .notify_senders_of_disconnect = xpc_notify_senders_of_disconnect_uv, + }; + ++static int ++xpc_init_mq_node(int nid) ++{ ++ int cpu; ++ ++ get_online_cpus(); ++ ++ for_each_cpu(cpu, cpumask_of_node(nid)) { ++ xpc_activate_mq_uv = ++ xpc_create_gru_mq_uv(XPC_ACTIVATE_MQ_SIZE_UV, nid, ++ XPC_ACTIVATE_IRQ_NAME, ++ xpc_handle_activate_IRQ_uv); ++ if (!IS_ERR(xpc_activate_mq_uv)) ++ break; ++ } ++ if (IS_ERR(xpc_activate_mq_uv)) { ++ put_online_cpus(); ++ return PTR_ERR(xpc_activate_mq_uv); ++ } ++ ++ for_each_cpu(cpu, cpumask_of_node(nid)) { ++ xpc_notify_mq_uv = ++ xpc_create_gru_mq_uv(XPC_NOTIFY_MQ_SIZE_UV, nid, ++ XPC_NOTIFY_IRQ_NAME, ++ xpc_handle_notify_IRQ_uv); ++ if (!IS_ERR(xpc_notify_mq_uv)) ++ break; ++ } ++ if (IS_ERR(xpc_notify_mq_uv)) { ++ xpc_destroy_gru_mq_uv(xpc_activate_mq_uv); ++ put_online_cpus(); ++ return PTR_ERR(xpc_notify_mq_uv); ++ } ++ ++ put_online_cpus(); ++ return 0; ++} ++ + int + xpc_init_uv(void) + { ++ int nid; ++ int ret = 0; ++ + xpc_arch_ops = xpc_arch_ops_uv; + + if (sizeof(struct xpc_notify_mq_msghdr_uv) > XPC_MSG_HDR_MAX_SIZE) { +@@ -1742,21 +1785,21 @@ xpc_init_uv(void) + return -E2BIG; + } + +- xpc_activate_mq_uv = xpc_create_gru_mq_uv(XPC_ACTIVATE_MQ_SIZE_UV, 0, +- XPC_ACTIVATE_IRQ_NAME, +- xpc_handle_activate_IRQ_uv); +- if (IS_ERR(xpc_activate_mq_uv)) +- return PTR_ERR(xpc_activate_mq_uv); ++ if (xpc_mq_node < 0) ++ for_each_online_node(nid) { ++ ret = xpc_init_mq_node(nid); + +- xpc_notify_mq_uv = xpc_create_gru_mq_uv(XPC_NOTIFY_MQ_SIZE_UV, 0, +- XPC_NOTIFY_IRQ_NAME, +- xpc_handle_notify_IRQ_uv); +- if (IS_ERR(xpc_notify_mq_uv)) { +- xpc_destroy_gru_mq_uv(xpc_activate_mq_uv); +- return PTR_ERR(xpc_notify_mq_uv); +- } ++ if (!ret) ++ break; ++ } ++ else ++ ret = xpc_init_mq_node(xpc_mq_node); + +- return 0; ++ if (ret < 0) ++ dev_err(xpc_part, "xpc_init_mq_node() returned error=%d\n", ++ -ret); ++ ++ return ret; + } + + void +@@ -1765,3 +1808,6 @@ xpc_exit_uv(void) + xpc_destroy_gru_mq_uv(xpc_notify_mq_uv); + xpc_destroy_gru_mq_uv(xpc_activate_mq_uv); + } ++ ++module_param(xpc_mq_node, int, 0); ++MODULE_PARM_DESC(xpc_mq_node, "Node number on which to allocate message queues."); diff --git a/queue-3.0/drivers-rtc-rtc-rs5c348.c-fix-hour-decoding-in-12-hour-mode.patch b/queue-3.0/drivers-rtc-rtc-rs5c348.c-fix-hour-decoding-in-12-hour-mode.patch new file mode 100644 index 00000000000..06467587296 --- /dev/null +++ b/queue-3.0/drivers-rtc-rtc-rs5c348.c-fix-hour-decoding-in-12-hour-mode.patch @@ -0,0 +1,53 @@ +From 7dbfb315b2aaef0a115765946bf3026d074c33a7 Mon Sep 17 00:00:00 2001 +From: Atsushi Nemoto +Date: Tue, 21 Aug 2012 16:16:10 -0700 +Subject: drivers/rtc/rtc-rs5c348.c: fix hour decoding in 12-hour mode + +From: Atsushi Nemoto + +commit 7dbfb315b2aaef0a115765946bf3026d074c33a7 upstream. + +Correct the offset by subtracting 20 from tm_hour before taking the +modulo 12. + +[ "Why 20?" I hear you ask. Or at least I did. + + Here's the reason why: RS5C348_BIT_PM is 32, and is - stupidly - + included in the RS5C348_HOURS_MASK define. So it's really subtracting + out that bit to get "hour+12". But then because it does things modulo + 12, it needs to add the 12 in again afterwards anyway. + + This code is confused. It would be much clearer if RS5C348_HOURS_MASK + just didn't include the RS5C348_BIT_PM bit at all, then it wouldn't + need to do the silly subtract either. + + Whatever. It's all just math, the end result is the same. - Linus ] + +Reported-by: James Nute +Tested-by: James Nute +Signed-off-by: Atsushi Nemoto +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/rtc/rtc-rs5c348.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/drivers/rtc/rtc-rs5c348.c ++++ b/drivers/rtc/rtc-rs5c348.c +@@ -121,9 +121,12 @@ rs5c348_rtc_read_time(struct device *dev + tm->tm_min = bcd2bin(rxbuf[RS5C348_REG_MINS] & RS5C348_MINS_MASK); + tm->tm_hour = bcd2bin(rxbuf[RS5C348_REG_HOURS] & RS5C348_HOURS_MASK); + if (!pdata->rtc_24h) { +- tm->tm_hour %= 12; +- if (rxbuf[RS5C348_REG_HOURS] & RS5C348_BIT_PM) ++ if (rxbuf[RS5C348_REG_HOURS] & RS5C348_BIT_PM) { ++ tm->tm_hour -= 20; ++ tm->tm_hour %= 12; + tm->tm_hour += 12; ++ } else ++ tm->tm_hour %= 12; + } + tm->tm_wday = bcd2bin(rxbuf[RS5C348_REG_WDAY] & RS5C348_WDAY_MASK); + tm->tm_mday = bcd2bin(rxbuf[RS5C348_REG_DAY] & RS5C348_DAY_MASK); diff --git a/queue-3.0/drm-radeon-kms-extend-the-fujitsu-d3003-s2-board-connector-quirk-to-cover-later-silicon-stepping.patch b/queue-3.0/drm-radeon-kms-extend-the-fujitsu-d3003-s2-board-connector-quirk-to-cover-later-silicon-stepping.patch new file mode 100644 index 00000000000..75a6e5d7582 --- /dev/null +++ b/queue-3.0/drm-radeon-kms-extend-the-fujitsu-d3003-s2-board-connector-quirk-to-cover-later-silicon-stepping.patch @@ -0,0 +1,32 @@ +From 52e9b39d9a89ae33662596bd30e62dd56bddbe73 Mon Sep 17 00:00:00 2001 +From: Tvrtko Ursulin +Date: Mon, 20 Aug 2012 15:16:04 +0100 +Subject: drm/radeon/kms: extend the Fujitsu D3003-S2 board connector quirk to cover later silicon stepping + +From: Tvrtko Ursulin + +commit 52e9b39d9a89ae33662596bd30e62dd56bddbe73 upstream. + +There is a more recent APU stepping with a new PCI ID +shipping in the same board by Fujitsu which needs the +same quirk to correctly mark the back plane connectors. + +Signed-off-by: Tvrtko Ursulin +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/radeon/radeon_atombios.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/radeon/radeon_atombios.c ++++ b/drivers/gpu/drm/radeon/radeon_atombios.c +@@ -488,7 +488,7 @@ static bool radeon_atom_apply_quirks(str + } + + /* Fujitsu D3003-S2 board lists DVI-I as DVI-D and VGA */ +- if ((dev->pdev->device == 0x9802) && ++ if (((dev->pdev->device == 0x9802) || (dev->pdev->device == 0x9806)) && + (dev->pdev->subsystem_vendor == 0x1734) && + (dev->pdev->subsystem_device == 0x11bd)) { + if (*connector_type == DRM_MODE_CONNECTOR_VGA) { diff --git a/queue-3.0/ehci-update-qtd-next-pointer-in-qh-overlay-region-during-unlink.patch b/queue-3.0/ehci-update-qtd-next-pointer-in-qh-overlay-region-during-unlink.patch new file mode 100644 index 00000000000..4fd1a71cfcf --- /dev/null +++ b/queue-3.0/ehci-update-qtd-next-pointer-in-qh-overlay-region-during-unlink.patch @@ -0,0 +1,55 @@ +From 3d037774b42ed677f699b1dce7d548d55f4e4c2b Mon Sep 17 00:00:00 2001 +From: Pavankumar Kondeti +Date: Fri, 7 Sep 2012 11:23:28 +0530 +Subject: EHCI: Update qTD next pointer in QH overlay region during unlink + +From: Pavankumar Kondeti + +commit 3d037774b42ed677f699b1dce7d548d55f4e4c2b upstream. + +There is a possibility of QH overlay region having reference to a stale +qTD pointer during unlink. + +Consider an endpoint having two pending qTD before unlink process begins. +The endpoint's QH queue looks like this. + +qTD1 --> qTD2 --> Dummy + +To unlink qTD2, QH is removed from asynchronous list and Asynchronous +Advance Doorbell is programmed. The qTD1's next qTD pointer is set to +qTD2'2 next qTD pointer and qTD2 is retired upon controller's doorbell +interrupt. If QH's current qTD pointer points to qTD1, transfer overlay +region still have reference to qTD2. But qtD2 is just unlinked and freed. +This may cause EHCI system error. Fix this by updating qTD next pointer +in QH overlay region with the qTD next pointer of the current qTD. + +Signed-off-by: Pavankumar Kondeti +Acked-by: Alan Stern +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/ehci-q.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +--- a/drivers/usb/host/ehci-q.c ++++ b/drivers/usb/host/ehci-q.c +@@ -130,9 +130,17 @@ qh_refresh (struct ehci_hcd *ehci, struc + else { + qtd = list_entry (qh->qtd_list.next, + struct ehci_qtd, qtd_list); +- /* first qtd may already be partially processed */ +- if (cpu_to_hc32(ehci, qtd->qtd_dma) == qh->hw->hw_current) ++ /* ++ * first qtd may already be partially processed. ++ * If we come here during unlink, the QH overlay region ++ * might have reference to the just unlinked qtd. The ++ * qtd is updated in qh_completions(). Update the QH ++ * overlay here. ++ */ ++ if (cpu_to_hc32(ehci, qtd->qtd_dma) == qh->hw->hw_current) { ++ qh->hw->hw_qtd_next = qtd->hw_next; + qtd = NULL; ++ } + } + + if (qtd) diff --git a/queue-3.0/fbcon-fix-race-condition-between-console-lock-and-cursor-timer-v1.1.patch b/queue-3.0/fbcon-fix-race-condition-between-console-lock-and-cursor-timer-v1.1.patch new file mode 100644 index 00000000000..0822aa5c524 --- /dev/null +++ b/queue-3.0/fbcon-fix-race-condition-between-console-lock-and-cursor-timer-v1.1.patch @@ -0,0 +1,72 @@ +From d8636a2717bb3da2a7ce2154bf08de90bb8c87b0 Mon Sep 17 00:00:00 2001 +From: Dave Airlie +Date: Tue, 21 Aug 2012 16:29:47 +1000 +Subject: fbcon: fix race condition between console lock and cursor timer (v1.1) + +From: Dave Airlie + +commit d8636a2717bb3da2a7ce2154bf08de90bb8c87b0 upstream. + +So we've had a fair few reports of fbcon handover breakage between +efi/vesafb and i915 surface recently, so I dedicated a couple of +days to finding the problem. + +Essentially the last thing we saw was the conflicting framebuffer +message and that was all. + +So after much tracing with direct netconsole writes (printks +under console_lock not so useful), I think I found the race. + +Thread A (driver load) Thread B (timer thread) + unbind_con_driver -> | + bind_con_driver -> | + vc->vc_sw->con_deinit -> | + fbcon_deinit -> | + console_lock() | + | | + | fbcon_flashcursor timer fires + | console_lock() <- blocked for A + | + | +fbcon_del_cursor_timer -> + del_timer_sync + (BOOM) + +Of course because all of this is under the console lock, +we never see anything, also since we also just unbound the active +console guess what we never see anything. + +Hopefully this fixes the problem for anyone seeing vesafb->kms +driver handoff. + +v1.1: add comment suggestion from Alan. + +Signed-off-by: Dave Airlie +Acked-by: Alan Cox +Tested-by: Josh Boyer +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/video/console/fbcon.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +--- a/drivers/video/console/fbcon.c ++++ b/drivers/video/console/fbcon.c +@@ -373,8 +373,15 @@ static void fb_flashcursor(struct work_s + struct vc_data *vc = NULL; + int c; + int mode; ++ int ret; ++ ++ /* FIXME: we should sort out the unbind locking instead */ ++ /* instead we just fail to flash the cursor if we can't get ++ * the lock instead of blocking fbcon deinit */ ++ ret = console_trylock(); ++ if (ret == 0) ++ return; + +- console_lock(); + if (ops && ops->currcon != -1) + vc = vc_cons[ops->currcon].d; + diff --git a/queue-3.0/intel-xhci-only-switch-the-switchable-ports.patch b/queue-3.0/intel-xhci-only-switch-the-switchable-ports.patch new file mode 100644 index 00000000000..f11d1607dc4 --- /dev/null +++ b/queue-3.0/intel-xhci-only-switch-the-switchable-ports.patch @@ -0,0 +1,85 @@ +From a96874a2a92feaef607ddd3137277a788cb927a6 Mon Sep 17 00:00:00 2001 +From: Keng-Yu Lin +Date: Fri, 10 Aug 2012 01:39:23 +0800 +Subject: Intel xhci: Only switch the switchable ports + +From: Keng-Yu Lin + +commit a96874a2a92feaef607ddd3137277a788cb927a6 upstream. + +With a previous patch to enable the EHCI/XHCI port switching, it switches +all the available ports. + +The assumption is not correct because the BIOS may expect some ports +not switchable by the OS. + +There are two more registers that contains the information of the switchable +and non-switchable ports. + +This patch adds the checking code for the two register so that only the +switchable ports are altered. + +This patch should be backported to kernels as old as 3.0, that contain +commit ID 69e848c2090aebba5698a1620604c7dccb448684 "Intel xhci: Support +EHCI/xHCI port switching." + +Signed-off-by: Keng-Yu Lin +Signed-off-by: Sarah Sharp +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/pci-quirks.c | 27 +++++++++++++++++++++++---- + 1 file changed, 23 insertions(+), 4 deletions(-) + +--- a/drivers/usb/host/pci-quirks.c ++++ b/drivers/usb/host/pci-quirks.c +@@ -73,7 +73,9 @@ + #define NB_PIF0_PWRDOWN_1 0x01100013 + + #define USB_INTEL_XUSB2PR 0xD0 ++#define USB_INTEL_USB2PRM 0xD4 + #define USB_INTEL_USB3_PSSEN 0xD8 ++#define USB_INTEL_USB3PRM 0xDC + + static struct amd_chipset_info { + struct pci_dev *nb_dev; +@@ -758,10 +760,18 @@ void usb_enable_xhci_ports(struct pci_de + #if defined(CONFIG_USB_XHCI_HCD) || defined(CONFIG_USB_XHCI_HCD_MODULE) + u32 ports_available; + +- ports_available = 0xffffffff; ++ /* Read USB3PRM, the USB 3.0 Port Routing Mask Register ++ * Indicate the ports that can be changed from OS. ++ */ ++ pci_read_config_dword(xhci_pdev, USB_INTEL_USB3PRM, ++ &ports_available); ++ ++ dev_dbg(&xhci_pdev->dev, "Configurable ports to enable SuperSpeed: 0x%x\n", ++ ports_available); ++ + /* Write USB3_PSSEN, the USB 3.0 Port SuperSpeed Enable +- * Register, to turn on SuperSpeed terminations for all +- * available ports. ++ * Register, to turn on SuperSpeed terminations for the ++ * switchable ports. + */ + pci_write_config_dword(xhci_pdev, USB_INTEL_USB3_PSSEN, + cpu_to_le32(ports_available)); +@@ -771,7 +781,16 @@ void usb_enable_xhci_ports(struct pci_de + dev_dbg(&xhci_pdev->dev, "USB 3.0 ports that are now enabled " + "under xHCI: 0x%x\n", ports_available); + +- ports_available = 0xffffffff; ++ /* Read XUSB2PRM, xHCI USB 2.0 Port Routing Mask Register ++ * Indicate the USB 2.0 ports to be controlled by the xHCI host. ++ */ ++ ++ pci_read_config_dword(xhci_pdev, USB_INTEL_USB2PRM, ++ &ports_available); ++ ++ dev_dbg(&xhci_pdev->dev, "Configurable USB 2.0 ports to hand over to xCHI: 0x%x\n", ++ ports_available); ++ + /* Write XUSB2PR, the xHC USB 2.0 Port Routing Register, to + * switch the USB 2.0 power and data lines over to the xHCI + * host. diff --git a/queue-3.0/mutex-place-lock-in-contended-state-after-fastpath_lock-failure.patch b/queue-3.0/mutex-place-lock-in-contended-state-after-fastpath_lock-failure.patch new file mode 100644 index 00000000000..32c45c9f6a9 --- /dev/null +++ b/queue-3.0/mutex-place-lock-in-contended-state-after-fastpath_lock-failure.patch @@ -0,0 +1,82 @@ +From 0bce9c46bf3b15f485d82d7e81dabed6ebcc24b1 Mon Sep 17 00:00:00 2001 +From: Will Deacon +Date: Fri, 10 Aug 2012 15:22:09 +0100 +Subject: mutex: Place lock in contended state after fastpath_lock failure + +From: Will Deacon + +commit 0bce9c46bf3b15f485d82d7e81dabed6ebcc24b1 upstream. + +ARM recently moved to asm-generic/mutex-xchg.h for its mutex +implementation after the previous implementation was found to be missing +some crucial memory barriers. However, this has revealed some problems +running hackbench on SMP platforms due to the way in which the +MUTEX_SPIN_ON_OWNER code operates. + +The symptoms are that a bunch of hackbench tasks are left waiting on an +unlocked mutex and therefore never get woken up to claim it. This boils +down to the following sequence of events: + + Task A Task B Task C Lock value +0 1 +1 lock() 0 +2 lock() 0 +3 spin(A) 0 +4 unlock() 1 +5 lock() 0 +6 cmpxchg(1,0) 0 +7 contended() -1 +8 lock() 0 +9 spin(C) 0 +10 unlock() 1 +11 cmpxchg(1,0) 0 +12 unlock() 1 + +At this point, the lock is unlocked, but Task B is in an uninterruptible +sleep with nobody to wake it up. + +This patch fixes the problem by ensuring we put the lock into the +contended state if we fail to acquire it on the fastpath, ensuring that +any blocked waiters are woken up when the mutex is released. + +Signed-off-by: Will Deacon +Cc: Arnd Bergmann +Cc: Chris Mason +Cc: Ingo Molnar +Reviewed-by: Nicolas Pitre +Signed-off-by: Peter Zijlstra +Link: http://lkml.kernel.org/n/tip-6e9lrw2avczr0617fzl5vqb8@git.kernel.org +Signed-off-by: Thomas Gleixner +Signed-off-by: Greg Kroah-Hartman + +--- + include/asm-generic/mutex-xchg.h | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +--- a/include/asm-generic/mutex-xchg.h ++++ b/include/asm-generic/mutex-xchg.h +@@ -26,7 +26,13 @@ static inline void + __mutex_fastpath_lock(atomic_t *count, void (*fail_fn)(atomic_t *)) + { + if (unlikely(atomic_xchg(count, 0) != 1)) +- fail_fn(count); ++ /* ++ * We failed to acquire the lock, so mark it contended ++ * to ensure that any waiting tasks are woken up by the ++ * unlock slow path. ++ */ ++ if (likely(atomic_xchg(count, -1) != 1)) ++ fail_fn(count); + } + + /** +@@ -43,7 +49,8 @@ static inline int + __mutex_fastpath_lock_retval(atomic_t *count, int (*fail_fn)(atomic_t *)) + { + if (unlikely(atomic_xchg(count, 0) != 1)) +- return fail_fn(count); ++ if (likely(atomic_xchg(count, -1) != 1)) ++ return fail_fn(count); + return 0; + } + diff --git a/queue-3.0/nfs-fix-a-problem-with-the-legacy-binary-mount-code.patch b/queue-3.0/nfs-fix-a-problem-with-the-legacy-binary-mount-code.patch new file mode 100644 index 00000000000..4f68dbba8b7 --- /dev/null +++ b/queue-3.0/nfs-fix-a-problem-with-the-legacy-binary-mount-code.patch @@ -0,0 +1,41 @@ +From 872ece86ea5c367aa92f44689c2d01a1c767aeb3 Mon Sep 17 00:00:00 2001 +From: Trond Myklebust +Date: Tue, 4 Sep 2012 11:05:07 -0400 +Subject: NFS: Fix a problem with the legacy binary mount code + +From: Trond Myklebust + +commit 872ece86ea5c367aa92f44689c2d01a1c767aeb3 upstream. + +Apparently, am-utils is still using the legacy binary mountdata interface, +and is having trouble parsing /proc/mounts due to the 'port=' field being +incorrectly set. + +The following patch should fix up the regression. + +Reported-by: Marius Tolzmann +Signed-off-by: Trond Myklebust +Signed-off-by: Greg Kroah-Hartman + +--- + fs/nfs/super.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/fs/nfs/super.c ++++ b/fs/nfs/super.c +@@ -1815,6 +1815,7 @@ static int nfs_validate_mount_data(void + + memcpy(sap, &data->addr, sizeof(data->addr)); + args->nfs_server.addrlen = sizeof(data->addr); ++ args->nfs_server.port = ntohs(data->addr.sin_port); + if (!nfs_verify_server_address(sap)) + goto out_no_address; + +@@ -2528,6 +2529,7 @@ static int nfs4_validate_mount_data(void + return -EFAULT; + if (!nfs_verify_server_address(sap)) + goto out_no_address; ++ args->nfs_server.port = ntohs(((struct sockaddr_in *)sap)->sin_port); + + if (data->auth_flavourlen) { + if (data->auth_flavourlen > 1) diff --git a/queue-3.0/nfs-fix-the-initialisation-of-the-readdir-cookieverf-array.patch b/queue-3.0/nfs-fix-the-initialisation-of-the-readdir-cookieverf-array.patch new file mode 100644 index 00000000000..f5192a2b50c --- /dev/null +++ b/queue-3.0/nfs-fix-the-initialisation-of-the-readdir-cookieverf-array.patch @@ -0,0 +1,85 @@ +From c3f52af3e03013db5237e339c817beaae5ec9e3a Mon Sep 17 00:00:00 2001 +From: Trond Myklebust +Date: Mon, 3 Sep 2012 14:56:02 -0400 +Subject: NFS: Fix the initialisation of the readdir 'cookieverf' array + +From: Trond Myklebust + +commit c3f52af3e03013db5237e339c817beaae5ec9e3a upstream. + +When the NFS_COOKIEVERF helper macro was converted into a static +inline function in commit 99fadcd764 (nfs: convert NFS_*(inode) +helpers to static inline), we broke the initialisation of the +readdir cookies, since that depended on doing a memset with an +argument of 'sizeof(NFS_COOKIEVERF(inode))' which therefore +changed from sizeof(be32 cookieverf[2]) to sizeof(be32 *). + +At this point, NFS_COOKIEVERF seems to be more of an obfuscation +than a helper, so the best thing would be to just get rid of it. + +Also see: https://bugzilla.kernel.org/show_bug.cgi?id=46881 + +Reported-by: Andi Kleen +Reported-by: David Binderman +Signed-off-by: Trond Myklebust +Signed-off-by: Greg Kroah-Hartman + +--- + fs/nfs/inode.c | 2 +- + fs/nfs/nfs3proc.c | 2 +- + fs/nfs/nfs4proc.c | 4 ++-- + include/linux/nfs_fs.h | 5 ----- + 4 files changed, 4 insertions(+), 9 deletions(-) + +--- a/fs/nfs/inode.c ++++ b/fs/nfs/inode.c +@@ -150,7 +150,7 @@ static void nfs_zap_caches_locked(struct + nfsi->attrtimeo = NFS_MINATTRTIMEO(inode); + nfsi->attrtimeo_timestamp = jiffies; + +- memset(NFS_COOKIEVERF(inode), 0, sizeof(NFS_COOKIEVERF(inode))); ++ memset(NFS_I(inode)->cookieverf, 0, sizeof(NFS_I(inode)->cookieverf)); + if (S_ISREG(mode) || S_ISDIR(mode) || S_ISLNK(mode)) + nfsi->cache_validity |= NFS_INO_INVALID_ATTR|NFS_INO_INVALID_DATA|NFS_INO_INVALID_ACCESS|NFS_INO_INVALID_ACL|NFS_INO_REVAL_PAGECACHE; + else +--- a/fs/nfs/nfs3proc.c ++++ b/fs/nfs/nfs3proc.c +@@ -633,7 +633,7 @@ nfs3_proc_readdir(struct dentry *dentry, + u64 cookie, struct page **pages, unsigned int count, int plus) + { + struct inode *dir = dentry->d_inode; +- __be32 *verf = NFS_COOKIEVERF(dir); ++ __be32 *verf = NFS_I(dir)->cookieverf; + struct nfs3_readdirargs arg = { + .fh = NFS_FH(dir), + .cookie = cookie, +--- a/fs/nfs/nfs4proc.c ++++ b/fs/nfs/nfs4proc.c +@@ -3018,11 +3018,11 @@ static int _nfs4_proc_readdir(struct den + dentry->d_parent->d_name.name, + dentry->d_name.name, + (unsigned long long)cookie); +- nfs4_setup_readdir(cookie, NFS_COOKIEVERF(dir), dentry, &args); ++ nfs4_setup_readdir(cookie, NFS_I(dir)->cookieverf, dentry, &args); + res.pgbase = args.pgbase; + status = nfs4_call_sync(NFS_SERVER(dir)->client, NFS_SERVER(dir), &msg, &args.seq_args, &res.seq_res, 0); + if (status >= 0) { +- memcpy(NFS_COOKIEVERF(dir), res.verifier.data, NFS4_VERIFIER_SIZE); ++ memcpy(NFS_I(dir)->cookieverf, res.verifier.data, NFS4_VERIFIER_SIZE); + status += args.pgbase; + } + +--- a/include/linux/nfs_fs.h ++++ b/include/linux/nfs_fs.h +@@ -261,11 +261,6 @@ static inline const struct nfs_rpc_ops * + return NFS_SERVER(inode)->nfs_client->rpc_ops; + } + +-static inline __be32 *NFS_COOKIEVERF(const struct inode *inode) +-{ +- return NFS_I(inode)->cookieverf; +-} +- + static inline unsigned NFS_MINATTRTIMEO(const struct inode *inode) + { + struct nfs_server *nfss = NFS_SERVER(inode); diff --git a/queue-3.0/nfs-return-error-from-decode_getfh-in-decode-open.patch b/queue-3.0/nfs-return-error-from-decode_getfh-in-decode-open.patch new file mode 100644 index 00000000000..d88c97d906e --- /dev/null +++ b/queue-3.0/nfs-return-error-from-decode_getfh-in-decode-open.patch @@ -0,0 +1,32 @@ +From 01913b49cf1dc6409a07dd2a4cc6af2e77f3c410 Mon Sep 17 00:00:00 2001 +From: Weston Andros Adamson +Date: Thu, 6 Sep 2012 15:54:27 -0400 +Subject: NFS: return error from decode_getfh in decode open + +From: Weston Andros Adamson + +commit 01913b49cf1dc6409a07dd2a4cc6af2e77f3c410 upstream. + +If decode_getfh failed, nfs4_xdr_dec_open would return 0 since the last +decode_* call must have succeeded. + +Signed-off-by: Weston Andros Adamson +Signed-off-by: Trond Myklebust +Signed-off-by: Greg Kroah-Hartman + +--- + fs/nfs/nfs4xdr.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/fs/nfs/nfs4xdr.c ++++ b/fs/nfs/nfs4xdr.c +@@ -5745,7 +5745,8 @@ static int nfs4_xdr_dec_open(struct rpc_ + status = decode_open(xdr, res); + if (status) + goto out; +- if (decode_getfh(xdr, &res->fh) != 0) ++ status = decode_getfh(xdr, &res->fh); ++ if (status) + goto out; + if (decode_getfattr(xdr, res->f_attr, res->server, + !RPC_IS_ASYNC(rqstp->rq_task)) != 0) diff --git a/queue-3.0/pm-runtime-clear-power.deferred_resume-on-success-in-rpm_suspend.patch b/queue-3.0/pm-runtime-clear-power.deferred_resume-on-success-in-rpm_suspend.patch new file mode 100644 index 00000000000..f6c16d0e767 --- /dev/null +++ b/queue-3.0/pm-runtime-clear-power.deferred_resume-on-success-in-rpm_suspend.patch @@ -0,0 +1,49 @@ +From 58a34de7b1a920d287d17d2ca08bc9aaf7e6d35b Mon Sep 17 00:00:00 2001 +From: "Rafael J. Wysocki" +Date: Wed, 15 Aug 2012 21:31:55 +0200 +Subject: PM / Runtime: Clear power.deferred_resume on success in rpm_suspend() + +From: "Rafael J. Wysocki" + +commit 58a34de7b1a920d287d17d2ca08bc9aaf7e6d35b upstream. + +The power.deferred_resume can only be set if the runtime PM status +of device is RPM_SUSPENDING and it should be cleared after its +status has been changed, regardless of whether or not the runtime +suspend has been successful. However, it only is cleared on +suspend failure, while it may remain set on successful suspend and +is happily leaked to rpm_resume() executed in that case. + +That shouldn't happen, so if power.deferred_resume is set in +rpm_suspend() after the status has been changed to RPM_SUSPENDED, +clear it before calling rpm_resume(). Then, it doesn't need to be +cleared before changing the status to RPM_SUSPENDING any more, +because it's always cleared after the status has been changed to +either RPM_SUSPENDED (on success) or RPM_ACTIVE (on failure). + +Signed-off-by: Rafael J. Wysocki +Acked-by: Alan Stern +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/base/power/runtime.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/base/power/runtime.c ++++ b/drivers/base/power/runtime.c +@@ -360,7 +360,6 @@ static int rpm_suspend(struct device *de + goto repeat; + } + +- dev->power.deferred_resume = false; + if (dev->power.no_callbacks) + goto no_callback; /* Assume success. */ + +@@ -420,6 +419,7 @@ static int rpm_suspend(struct device *de + wake_up_all(&dev->power.wait_queue); + + if (dev->power.deferred_resume) { ++ dev->power.deferred_resume = false; + rpm_resume(dev, 0); + retval = -EAGAIN; + goto out; diff --git a/queue-3.0/pm-runtime-fix-rpm_resume-return-value-for-power.no_callbacks-set.patch b/queue-3.0/pm-runtime-fix-rpm_resume-return-value-for-power.no_callbacks-set.patch new file mode 100644 index 00000000000..4aa3ba5a009 --- /dev/null +++ b/queue-3.0/pm-runtime-fix-rpm_resume-return-value-for-power.no_callbacks-set.patch @@ -0,0 +1,46 @@ +From 7f321c26c04807834fef4c524d2b21573423fc74 Mon Sep 17 00:00:00 2001 +From: "Rafael J. Wysocki" +Date: Wed, 15 Aug 2012 21:31:45 +0200 +Subject: PM / Runtime: Fix rpm_resume() return value for power.no_callbacks set + +From: "Rafael J. Wysocki" + +commit 7f321c26c04807834fef4c524d2b21573423fc74 upstream. + +For devices whose power.no_callbacks flag is set, rpm_resume() +should return 1 if the device's parent is already active, so that +the callers of pm_runtime_get() don't think that they have to wait +for the device to resume (asynchronously) in that case (the core +won't queue up an asynchronous resume in that case, so there's +nothing to wait for anyway). + +Modify the code accordingly (and make sure that an idle notification +will be queued up on success, even if 1 is to be returned). + +Signed-off-by: Rafael J. Wysocki +Acked-by: Alan Stern +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/base/power/runtime.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/base/power/runtime.c ++++ b/drivers/base/power/runtime.c +@@ -533,6 +533,7 @@ static int rpm_resume(struct device *dev + || dev->parent->power.runtime_status == RPM_ACTIVE) { + atomic_inc(&dev->parent->power.child_count); + spin_unlock(&dev->parent->power.lock); ++ retval = 1; + goto no_callback; /* Assume success. */ + } + spin_unlock(&dev->parent->power.lock); +@@ -610,7 +611,7 @@ static int rpm_resume(struct device *dev + } + wake_up_all(&dev->power.wait_queue); + +- if (!retval) ++ if (retval >= 0) + rpm_idle(dev, RPM_ASYNC); + + out: diff --git a/queue-3.0/rt2x00-fix-rfkill-polling-prior-to-interface-start.patch b/queue-3.0/rt2x00-fix-rfkill-polling-prior-to-interface-start.patch new file mode 100644 index 00000000000..8eb7b09a691 --- /dev/null +++ b/queue-3.0/rt2x00-fix-rfkill-polling-prior-to-interface-start.patch @@ -0,0 +1,252 @@ +From a396e10019eaf3809b0219c966865aaafec12630 Mon Sep 17 00:00:00 2001 +From: Gertjan van Wingerde +Date: Fri, 31 Aug 2012 19:22:11 +0200 +Subject: rt2x00: Fix rfkill polling prior to interface start. + +From: Gertjan van Wingerde + +commit a396e10019eaf3809b0219c966865aaafec12630 upstream. + +We need to program the rfkill switch GPIO pin direction to input at +device initialization time, not only when the interface is brought up. +Doing this only when the interface is brought up could lead to rfkill +detecting the switch is turned on erroneously and inability to create +the interface and bringing it up. + +Reported-and-tested-by: Andreas Messer +Signed-off-by: Gertjan van Wingerde +Acked-by: Ivo Van Doorn +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/rt2x00/rt2400pci.c | 9 +++++++++ + drivers/net/wireless/rt2x00/rt2400pci.h | 1 + + drivers/net/wireless/rt2x00/rt2500pci.c | 9 +++++++++ + drivers/net/wireless/rt2x00/rt2500usb.c | 9 +++++++++ + drivers/net/wireless/rt2x00/rt2500usb.h | 1 + + drivers/net/wireless/rt2x00/rt2800pci.c | 9 +++++++++ + drivers/net/wireless/rt2x00/rt2800usb.c | 9 +++++++++ + drivers/net/wireless/rt2x00/rt61pci.c | 9 +++++++++ + drivers/net/wireless/rt2x00/rt61pci.h | 1 + + drivers/net/wireless/rt2x00/rt73usb.c | 9 +++++++++ + drivers/net/wireless/rt2x00/rt73usb.h | 3 +++ + 11 files changed, 69 insertions(+) + +--- a/drivers/net/wireless/rt2x00/rt2400pci.c ++++ b/drivers/net/wireless/rt2x00/rt2400pci.c +@@ -1618,6 +1618,7 @@ static int rt2400pci_probe_hw_mode(struc + static int rt2400pci_probe_hw(struct rt2x00_dev *rt2x00dev) + { + int retval; ++ u32 reg; + + /* + * Allocate eeprom data. +@@ -1631,6 +1632,14 @@ static int rt2400pci_probe_hw(struct rt2 + return retval; + + /* ++ * Enable rfkill polling by setting GPIO direction of the ++ * rfkill switch GPIO pin correctly. ++ */ ++ rt2x00pci_register_read(rt2x00dev, GPIOCSR, ®); ++ rt2x00_set_field32(®, GPIOCSR_BIT8, 1); ++ rt2x00pci_register_write(rt2x00dev, GPIOCSR, reg); ++ ++ /* + * Initialize hw specifications. + */ + retval = rt2400pci_probe_hw_mode(rt2x00dev); +--- a/drivers/net/wireless/rt2x00/rt2400pci.h ++++ b/drivers/net/wireless/rt2x00/rt2400pci.h +@@ -670,6 +670,7 @@ + #define GPIOCSR_BIT5 FIELD32(0x00000020) + #define GPIOCSR_BIT6 FIELD32(0x00000040) + #define GPIOCSR_BIT7 FIELD32(0x00000080) ++#define GPIOCSR_BIT8 FIELD32(0x00000100) + + /* + * BBPPCSR: BBP Pin control register. +--- a/drivers/net/wireless/rt2x00/rt2500pci.c ++++ b/drivers/net/wireless/rt2x00/rt2500pci.c +@@ -1936,6 +1936,7 @@ static int rt2500pci_probe_hw_mode(struc + static int rt2500pci_probe_hw(struct rt2x00_dev *rt2x00dev) + { + int retval; ++ u32 reg; + + /* + * Allocate eeprom data. +@@ -1949,6 +1950,14 @@ static int rt2500pci_probe_hw(struct rt2 + return retval; + + /* ++ * Enable rfkill polling by setting GPIO direction of the ++ * rfkill switch GPIO pin correctly. ++ */ ++ rt2x00pci_register_read(rt2x00dev, GPIOCSR, ®); ++ rt2x00_set_field32(®, GPIOCSR_DIR0, 1); ++ rt2x00pci_register_write(rt2x00dev, GPIOCSR, reg); ++ ++ /* + * Initialize hw specifications. + */ + retval = rt2500pci_probe_hw_mode(rt2x00dev); +--- a/drivers/net/wireless/rt2x00/rt2500usb.c ++++ b/drivers/net/wireless/rt2x00/rt2500usb.c +@@ -1768,6 +1768,7 @@ static int rt2500usb_probe_hw_mode(struc + static int rt2500usb_probe_hw(struct rt2x00_dev *rt2x00dev) + { + int retval; ++ u16 reg; + + /* + * Allocate eeprom data. +@@ -1781,6 +1782,14 @@ static int rt2500usb_probe_hw(struct rt2 + return retval; + + /* ++ * Enable rfkill polling by setting GPIO direction of the ++ * rfkill switch GPIO pin correctly. ++ */ ++ rt2500usb_register_read(rt2x00dev, MAC_CSR19, ®); ++ rt2x00_set_field16(®, MAC_CSR19_BIT8, 0); ++ rt2500usb_register_write(rt2x00dev, MAC_CSR19, reg); ++ ++ /* + * Initialize hw specifications. + */ + retval = rt2500usb_probe_hw_mode(rt2x00dev); +--- a/drivers/net/wireless/rt2x00/rt2500usb.h ++++ b/drivers/net/wireless/rt2x00/rt2500usb.h +@@ -197,6 +197,7 @@ + #define MAC_CSR19_BIT5 FIELD16(0x0020) + #define MAC_CSR19_BIT6 FIELD16(0x0040) + #define MAC_CSR19_BIT7 FIELD16(0x0080) ++#define MAC_CSR19_BIT8 FIELD16(0x0100) + + /* + * MAC_CSR20: LED control register. +--- a/drivers/net/wireless/rt2x00/rt2800pci.c ++++ b/drivers/net/wireless/rt2x00/rt2800pci.c +@@ -941,6 +941,7 @@ static int rt2800pci_validate_eeprom(str + static int rt2800pci_probe_hw(struct rt2x00_dev *rt2x00dev) + { + int retval; ++ u32 reg; + + /* + * Allocate eeprom data. +@@ -954,6 +955,14 @@ static int rt2800pci_probe_hw(struct rt2 + return retval; + + /* ++ * Enable rfkill polling by setting GPIO direction of the ++ * rfkill switch GPIO pin correctly. ++ */ ++ rt2x00pci_register_read(rt2x00dev, GPIO_CTRL_CFG, ®); ++ rt2x00_set_field32(®, GPIO_CTRL_CFG_GPIOD_BIT2, 1); ++ rt2x00pci_register_write(rt2x00dev, GPIO_CTRL_CFG, reg); ++ ++ /* + * Initialize hw specifications. + */ + retval = rt2800_probe_hw_mode(rt2x00dev); +--- a/drivers/net/wireless/rt2x00/rt2800usb.c ++++ b/drivers/net/wireless/rt2x00/rt2800usb.c +@@ -600,6 +600,7 @@ static int rt2800usb_validate_eeprom(str + static int rt2800usb_probe_hw(struct rt2x00_dev *rt2x00dev) + { + int retval; ++ u32 reg; + + /* + * Allocate eeprom data. +@@ -613,6 +614,14 @@ static int rt2800usb_probe_hw(struct rt2 + return retval; + + /* ++ * Enable rfkill polling by setting GPIO direction of the ++ * rfkill switch GPIO pin correctly. ++ */ ++ rt2x00usb_register_read(rt2x00dev, GPIO_CTRL_CFG, ®); ++ rt2x00_set_field32(®, GPIO_CTRL_CFG_GPIOD_BIT2, 1); ++ rt2x00usb_register_write(rt2x00dev, GPIO_CTRL_CFG, reg); ++ ++ /* + * Initialize hw specifications. + */ + retval = rt2800_probe_hw_mode(rt2x00dev); +--- a/drivers/net/wireless/rt2x00/rt61pci.c ++++ b/drivers/net/wireless/rt2x00/rt61pci.c +@@ -2840,6 +2840,7 @@ static int rt61pci_probe_hw_mode(struct + static int rt61pci_probe_hw(struct rt2x00_dev *rt2x00dev) + { + int retval; ++ u32 reg; + + /* + * Disable power saving. +@@ -2858,6 +2859,14 @@ static int rt61pci_probe_hw(struct rt2x0 + return retval; + + /* ++ * Enable rfkill polling by setting GPIO direction of the ++ * rfkill switch GPIO pin correctly. ++ */ ++ rt2x00pci_register_read(rt2x00dev, MAC_CSR13, ®); ++ rt2x00_set_field32(®, MAC_CSR13_BIT13, 1); ++ rt2x00pci_register_write(rt2x00dev, MAC_CSR13, reg); ++ ++ /* + * Initialize hw specifications. + */ + retval = rt61pci_probe_hw_mode(rt2x00dev); +--- a/drivers/net/wireless/rt2x00/rt61pci.h ++++ b/drivers/net/wireless/rt2x00/rt61pci.h +@@ -372,6 +372,7 @@ struct hw_pairwise_ta_entry { + #define MAC_CSR13_BIT10 FIELD32(0x00000400) + #define MAC_CSR13_BIT11 FIELD32(0x00000800) + #define MAC_CSR13_BIT12 FIELD32(0x00001000) ++#define MAC_CSR13_BIT13 FIELD32(0x00002000) + + /* + * MAC_CSR14: LED control register. +--- a/drivers/net/wireless/rt2x00/rt73usb.c ++++ b/drivers/net/wireless/rt2x00/rt73usb.c +@@ -2177,6 +2177,7 @@ static int rt73usb_probe_hw_mode(struct + static int rt73usb_probe_hw(struct rt2x00_dev *rt2x00dev) + { + int retval; ++ u32 reg; + + /* + * Allocate eeprom data. +@@ -2190,6 +2191,14 @@ static int rt73usb_probe_hw(struct rt2x0 + return retval; + + /* ++ * Enable rfkill polling by setting GPIO direction of the ++ * rfkill switch GPIO pin correctly. ++ */ ++ rt2x00usb_register_read(rt2x00dev, MAC_CSR13, ®); ++ rt2x00_set_field32(®, MAC_CSR13_BIT15, 0); ++ rt2x00usb_register_write(rt2x00dev, MAC_CSR13, reg); ++ ++ /* + * Initialize hw specifications. + */ + retval = rt73usb_probe_hw_mode(rt2x00dev); +--- a/drivers/net/wireless/rt2x00/rt73usb.h ++++ b/drivers/net/wireless/rt2x00/rt73usb.h +@@ -282,6 +282,9 @@ struct hw_pairwise_ta_entry { + #define MAC_CSR13_BIT10 FIELD32(0x00000400) + #define MAC_CSR13_BIT11 FIELD32(0x00000800) + #define MAC_CSR13_BIT12 FIELD32(0x00001000) ++#define MAC_CSR13_BIT13 FIELD32(0x00002000) ++#define MAC_CSR13_BIT14 FIELD32(0x00004000) ++#define MAC_CSR13_BIT15 FIELD32(0x00008000) + + /* + * MAC_CSR14: LED control register. diff --git a/queue-3.0/rt2x00-fix-word-size-of-rt2500usb-mac_csr19-register.patch b/queue-3.0/rt2x00-fix-word-size-of-rt2500usb-mac_csr19-register.patch new file mode 100644 index 00000000000..1ebcacdbf92 --- /dev/null +++ b/queue-3.0/rt2x00-fix-word-size-of-rt2500usb-mac_csr19-register.patch @@ -0,0 +1,57 @@ +From 6ced58a5dbb94dbfbea1b33ca3c56d1e929cd548 Mon Sep 17 00:00:00 2001 +From: Gertjan van Wingerde +Date: Fri, 31 Aug 2012 19:22:10 +0200 +Subject: rt2x00: Fix word size of rt2500usb MAC_CSR19 register. + +From: Gertjan van Wingerde + +commit 6ced58a5dbb94dbfbea1b33ca3c56d1e929cd548 upstream. + +The register is 16 bits wide, not 32. + +Signed-off-by: Gertjan van Wingerde +Acked-by: Ivo Van Doorn +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/rt2x00/rt2500usb.c | 2 +- + drivers/net/wireless/rt2x00/rt2500usb.h | 16 ++++++++-------- + 2 files changed, 9 insertions(+), 9 deletions(-) + +--- a/drivers/net/wireless/rt2x00/rt2500usb.c ++++ b/drivers/net/wireless/rt2x00/rt2500usb.c +@@ -283,7 +283,7 @@ static int rt2500usb_rfkill_poll(struct + u16 reg; + + rt2500usb_register_read(rt2x00dev, MAC_CSR19, ®); +- return rt2x00_get_field32(reg, MAC_CSR19_BIT7); ++ return rt2x00_get_field16(reg, MAC_CSR19_BIT7); + } + + #ifdef CONFIG_RT2X00_LIB_LEDS +--- a/drivers/net/wireless/rt2x00/rt2500usb.h ++++ b/drivers/net/wireless/rt2x00/rt2500usb.h +@@ -189,14 +189,14 @@ + * MAC_CSR19: GPIO control register. + */ + #define MAC_CSR19 0x0426 +-#define MAC_CSR19_BIT0 FIELD32(0x0001) +-#define MAC_CSR19_BIT1 FIELD32(0x0002) +-#define MAC_CSR19_BIT2 FIELD32(0x0004) +-#define MAC_CSR19_BIT3 FIELD32(0x0008) +-#define MAC_CSR19_BIT4 FIELD32(0x0010) +-#define MAC_CSR19_BIT5 FIELD32(0x0020) +-#define MAC_CSR19_BIT6 FIELD32(0x0040) +-#define MAC_CSR19_BIT7 FIELD32(0x0080) ++#define MAC_CSR19_BIT0 FIELD16(0x0001) ++#define MAC_CSR19_BIT1 FIELD16(0x0002) ++#define MAC_CSR19_BIT2 FIELD16(0x0004) ++#define MAC_CSR19_BIT3 FIELD16(0x0008) ++#define MAC_CSR19_BIT4 FIELD16(0x0010) ++#define MAC_CSR19_BIT5 FIELD16(0x0020) ++#define MAC_CSR19_BIT6 FIELD16(0x0040) ++#define MAC_CSR19_BIT7 FIELD16(0x0080) + + /* + * MAC_CSR20: LED control register. diff --git a/queue-3.0/series b/queue-3.0/series index 9e8eb395c11..bf15ab3a232 100644 --- a/queue-3.0/series +++ b/queue-3.0/series @@ -60,3 +60,32 @@ arm-fix-bad-applied-patch-for-arch-arm-kconfig-of-stable-3.0.y-tree.patch arm-7532-1-decompressor-reset-sctlr.tre-for-vmsa-armv7-cores.patch tracing-don-t-call-page_to_pfn-if-page-is-null.patch input-i8042-disable-mux-on-toshiba-c850d.patch +asix-support-dlink-dub-e100-h-w-ver-c1.patch +can-ti_hecc-fix-oops-during-rmmod.patch +can-janz-ican3-fix-support-for-older-hardware-revisions.patch +cfg80211-fix-possible-circular-lock-on-reg_regdb_search.patch +dmaengine-at_hdmac-fix-comment-in-atc_prep_slave_sg.patch +dmaengine-at_hdmac-check-that-each-sg-data-length-is-non-null.patch +rt2x00-fix-word-size-of-rt2500usb-mac_csr19-register.patch +rt2x00-fix-rfkill-polling-prior-to-interface-start.patch +nfs-fix-the-initialisation-of-the-readdir-cookieverf-array.patch +nfs-fix-a-problem-with-the-legacy-binary-mount-code.patch +nfs-return-error-from-decode_getfh-in-decode-open.patch +ehci-update-qtd-next-pointer-in-qh-overlay-region-during-unlink.patch +usb-ftdi_sio-pid-for-nzr-sem-16-usb.patch +usb-ftdi_sio-do-not-claim-cdc-acm-function.patch +usb-ftdi-sio-add-support-for-more-physik-instrumente-devices.patch +usb-add-device-quirk-for-joss-optical-touchboard.patch +intel-xhci-only-switch-the-switchable-ports.patch +xhci-fix-a-logical-vs-bitwise-and-bug.patch +xhci-make-handover-code-more-robust.patch +xhci-recognize-usb-3.0-devices-as-superspeed-at-powerup.patch +usb-host-xhci-fix-compilation-error-for-non-pci-based-stacks.patch +xhci-fix-bug-after-deq-ptr-set-to-link-trb.patch +mutex-place-lock-in-contended-state-after-fastpath_lock-failure.patch +drivers-rtc-rtc-rs5c348.c-fix-hour-decoding-in-12-hour-mode.patch +pm-runtime-fix-rpm_resume-return-value-for-power.no_callbacks-set.patch +pm-runtime-clear-power.deferred_resume-on-success-in-rpm_suspend.patch +drivers-misc-sgi-xp-xpc_uv.c-sgi-xpc-fails-to-load-when-cpu-0-is-out-of-irq-resources.patch +fbcon-fix-race-condition-between-console-lock-and-cursor-timer-v1.1.patch +drm-radeon-kms-extend-the-fujitsu-d3003-s2-board-connector-quirk-to-cover-later-silicon-stepping.patch diff --git a/queue-3.0/usb-add-device-quirk-for-joss-optical-touchboard.patch b/queue-3.0/usb-add-device-quirk-for-joss-optical-touchboard.patch new file mode 100644 index 00000000000..0e85cf41abd --- /dev/null +++ b/queue-3.0/usb-add-device-quirk-for-joss-optical-touchboard.patch @@ -0,0 +1,34 @@ +From 92fc7a8b0f20bdb243c706daf42658e8e0cd2ef0 Mon Sep 17 00:00:00 2001 +From: Alan Stern +Date: Tue, 4 Sep 2012 10:41:02 -0400 +Subject: USB: add device quirk for Joss Optical touchboard + +From: Alan Stern + +commit 92fc7a8b0f20bdb243c706daf42658e8e0cd2ef0 upstream. + +This patch (as1604) adds a CONFIG_INTF_STRINGS quirk for the Joss +infrared touchboard device. The device doesn't like to be asked for +its interface strings. + +Signed-off-by: Alan Stern +Reported-by: adam ? +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/quirks.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/usb/core/quirks.c ++++ b/drivers/usb/core/quirks.c +@@ -96,6 +96,10 @@ static const struct usb_device_id usb_qu + { USB_DEVICE(0x04b4, 0x0526), .driver_info = + USB_QUIRK_CONFIG_INTF_STRINGS }, + ++ /* Microchip Joss Optical infrared touchboard device */ ++ { USB_DEVICE(0x04d8, 0x000c), .driver_info = ++ USB_QUIRK_CONFIG_INTF_STRINGS }, ++ + /* Samsung Android phone modem - ID conflict with SPH-I500 */ + { USB_DEVICE(0x04e8, 0x6601), .driver_info = + USB_QUIRK_CONFIG_INTF_STRINGS }, diff --git a/queue-3.0/usb-ftdi-sio-add-support-for-more-physik-instrumente-devices.patch b/queue-3.0/usb-ftdi-sio-add-support-for-more-physik-instrumente-devices.patch new file mode 100644 index 00000000000..9942f48cc8a --- /dev/null +++ b/queue-3.0/usb-ftdi-sio-add-support-for-more-physik-instrumente-devices.patch @@ -0,0 +1,82 @@ +From dafc4f7be1a556ca3868d343c00127728b397068 Mon Sep 17 00:00:00 2001 +From: Éric Piel +Date: Tue, 4 Sep 2012 17:25:06 +0200 +Subject: USB: ftdi-sio: add support for more Physik Instrumente devices + +From: Éric Piel + +commit dafc4f7be1a556ca3868d343c00127728b397068 upstream. + +Commit b69cc672052540 added support for the E-861. After acquiring a C-867, I +realised that every Physik Instrumente's device has a different PID. They are +listed in the Windows device driver's .inf file. So here are all PIDs for the +current (and probably future) USB devices from Physik Instrumente. + +Compiled, but only actually tested on the E-861 and C-867. + +Signed-off-by: Éric Piel +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/ftdi_sio.c | 17 +++++++++++++++++ + drivers/usb/serial/ftdi_sio_ids.h | 21 ++++++++++++++++++++- + 2 files changed, 37 insertions(+), 1 deletion(-) + +--- a/drivers/usb/serial/ftdi_sio.c ++++ b/drivers/usb/serial/ftdi_sio.c +@@ -811,7 +811,24 @@ static struct usb_device_id id_table_com + .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, + { USB_DEVICE(LARSENBRUSGAARD_VID, LB_ALTITRACK_PID) }, + { USB_DEVICE(GN_OTOMETRICS_VID, AURICAL_USB_PID) }, ++ { USB_DEVICE(FTDI_VID, PI_C865_PID) }, ++ { USB_DEVICE(FTDI_VID, PI_C857_PID) }, ++ { USB_DEVICE(PI_VID, PI_C866_PID) }, ++ { USB_DEVICE(PI_VID, PI_C663_PID) }, ++ { USB_DEVICE(PI_VID, PI_C725_PID) }, ++ { USB_DEVICE(PI_VID, PI_E517_PID) }, ++ { USB_DEVICE(PI_VID, PI_C863_PID) }, + { USB_DEVICE(PI_VID, PI_E861_PID) }, ++ { USB_DEVICE(PI_VID, PI_C867_PID) }, ++ { USB_DEVICE(PI_VID, PI_E609_PID) }, ++ { USB_DEVICE(PI_VID, PI_E709_PID) }, ++ { USB_DEVICE(PI_VID, PI_100F_PID) }, ++ { USB_DEVICE(PI_VID, PI_1011_PID) }, ++ { USB_DEVICE(PI_VID, PI_1012_PID) }, ++ { USB_DEVICE(PI_VID, PI_1013_PID) }, ++ { USB_DEVICE(PI_VID, PI_1014_PID) }, ++ { USB_DEVICE(PI_VID, PI_1015_PID) }, ++ { USB_DEVICE(PI_VID, PI_1016_PID) }, + { USB_DEVICE(KONDO_VID, KONDO_USB_SERIAL_PID) }, + { USB_DEVICE(BAYER_VID, BAYER_CONTOUR_CABLE_PID) }, + { USB_DEVICE(FTDI_VID, MARVELL_OPENRD_PID), +--- a/drivers/usb/serial/ftdi_sio_ids.h ++++ b/drivers/usb/serial/ftdi_sio_ids.h +@@ -797,8 +797,27 @@ + * Physik Instrumente + * http://www.physikinstrumente.com/en/products/ + */ ++/* These two devices use the VID of FTDI */ ++#define PI_C865_PID 0xe0a0 /* PI C-865 Piezomotor Controller */ ++#define PI_C857_PID 0xe0a1 /* PI Encoder Trigger Box */ ++ + #define PI_VID 0x1a72 /* Vendor ID */ +-#define PI_E861_PID 0x1008 /* E-861 piezo controller USB connection */ ++#define PI_C866_PID 0x1000 /* PI C-866 Piezomotor Controller */ ++#define PI_C663_PID 0x1001 /* PI C-663 Mercury-Step */ ++#define PI_C725_PID 0x1002 /* PI C-725 Piezomotor Controller */ ++#define PI_E517_PID 0x1005 /* PI E-517 Digital Piezo Controller Operation Module */ ++#define PI_C863_PID 0x1007 /* PI C-863 */ ++#define PI_E861_PID 0x1008 /* PI E-861 Piezomotor Controller */ ++#define PI_C867_PID 0x1009 /* PI C-867 Piezomotor Controller */ ++#define PI_E609_PID 0x100D /* PI E-609 Digital Piezo Controller */ ++#define PI_E709_PID 0x100E /* PI E-709 Digital Piezo Controller */ ++#define PI_100F_PID 0x100F /* PI Digital Piezo Controller */ ++#define PI_1011_PID 0x1011 /* PI Digital Piezo Controller */ ++#define PI_1012_PID 0x1012 /* PI Motion Controller */ ++#define PI_1013_PID 0x1013 /* PI Motion Controller */ ++#define PI_1014_PID 0x1014 /* PI Device */ ++#define PI_1015_PID 0x1015 /* PI Device */ ++#define PI_1016_PID 0x1016 /* PI Digital Servo Module */ + + /* + * Kondo Kagaku Co.Ltd. diff --git a/queue-3.0/usb-ftdi_sio-do-not-claim-cdc-acm-function.patch b/queue-3.0/usb-ftdi_sio-do-not-claim-cdc-acm-function.patch new file mode 100644 index 00000000000..72a7f89d50d --- /dev/null +++ b/queue-3.0/usb-ftdi_sio-do-not-claim-cdc-acm-function.patch @@ -0,0 +1,66 @@ +From f08dea734844aa42ec57c229b0b73b3d7d21f810 Mon Sep 17 00:00:00 2001 +From: Bjørn Mork +Date: Mon, 10 Sep 2012 12:01:05 +0200 +Subject: USB: ftdi_sio: do not claim CDC ACM function + +From: Bjørn Mork + +commit f08dea734844aa42ec57c229b0b73b3d7d21f810 upstream. + +The Microchip vid:pid 04d8:000a is used for their CDC ACM +demo firmware application. This is a device with a single +function conforming to the CDC ACM specification and with +the intention of demonstrating CDC ACM class firmware and +driver interaction. The demo is used on a number of +development boards, and may also be used unmodified by +vendors using Microchip hardware. + +Some vendors have re-used this vid:pid for other types of +firmware, emulating FTDI chips. Attempting to continue to +support such devices without breaking class based +applications that by matching on interface +class/subclass/proto being ff/ff/00. I have no information +about the actual device or interface descriptors, but this +will at least make the proper CDC ACM devices work again. +Anyone having details of the offending device's descriptors +should update this entry with the details. + +Reported-by: Florian Wöhrl +Reported-by: Xiaofan Chen +Cc: Alan Cox +Cc: Bruno Thomsen +Signed-off-by: Bjørn Mork +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/ftdi_sio.c | 4 +++- + drivers/usb/serial/ftdi_sio_ids.h | 5 ++++- + 2 files changed, 7 insertions(+), 2 deletions(-) + +--- a/drivers/usb/serial/ftdi_sio.c ++++ b/drivers/usb/serial/ftdi_sio.c +@@ -803,7 +803,9 @@ static struct usb_device_id id_table_com + .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, + { USB_DEVICE(ADI_VID, ADI_GNICEPLUS_PID), + .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, +- { USB_DEVICE(MICROCHIP_VID, MICROCHIP_USB_BOARD_PID) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(MICROCHIP_VID, MICROCHIP_USB_BOARD_PID, ++ USB_CLASS_VENDOR_SPEC, ++ USB_SUBCLASS_VENDOR_SPEC, 0x00) }, + { USB_DEVICE(JETI_VID, JETI_SPC1201_PID) }, + { USB_DEVICE(MARVELL_VID, MARVELL_SHEEVAPLUG_PID), + .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, +--- a/drivers/usb/serial/ftdi_sio_ids.h ++++ b/drivers/usb/serial/ftdi_sio_ids.h +@@ -542,7 +542,10 @@ + /* + * Microchip Technology, Inc. + * +- * MICROCHIP_VID (0x04D8) and MICROCHIP_USB_BOARD_PID (0x000A) are also used by: ++ * MICROCHIP_VID (0x04D8) and MICROCHIP_USB_BOARD_PID (0x000A) are ++ * used by single function CDC ACM class based firmware demo ++ * applications. The VID/PID has also been used in firmware ++ * emulating FTDI serial chips by: + * Hornby Elite - Digital Command Control Console + * http://www.hornby.com/hornby-dcc/controllers/ + */ diff --git a/queue-3.0/usb-ftdi_sio-pid-for-nzr-sem-16-usb.patch b/queue-3.0/usb-ftdi_sio-pid-for-nzr-sem-16-usb.patch new file mode 100644 index 00000000000..08571a02dc3 --- /dev/null +++ b/queue-3.0/usb-ftdi_sio-pid-for-nzr-sem-16-usb.patch @@ -0,0 +1,43 @@ +From 26a538b9ea2a3ee10dafc0068f0560dfd7b7ba37 Mon Sep 17 00:00:00 2001 +From: Horst Schirmeier +Date: Fri, 31 Aug 2012 00:00:28 +0200 +Subject: USB: ftdi_sio: PID for NZR SEM 16+ USB + +From: Horst Schirmeier + +commit 26a538b9ea2a3ee10dafc0068f0560dfd7b7ba37 upstream. + +This adds the USB PID for the NZR SEM 16+ USB energy monitor device +. It works perfectly with the GPL software on +. + +Signed-off-by: Horst Schirmeier +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/ftdi_sio.c | 1 + + drivers/usb/serial/ftdi_sio_ids.h | 3 +++ + 2 files changed, 4 insertions(+) + +--- a/drivers/usb/serial/ftdi_sio.c ++++ b/drivers/usb/serial/ftdi_sio.c +@@ -702,6 +702,7 @@ static struct usb_device_id id_table_com + { USB_DEVICE(FTDI_VID, FTDI_PCDJ_DAC2_PID) }, + { USB_DEVICE(FTDI_VID, FTDI_RRCIRKITS_LOCOBUFFER_PID) }, + { USB_DEVICE(FTDI_VID, FTDI_ASK_RDR400_PID) }, ++ { USB_DEVICE(FTDI_VID, FTDI_NZR_SEM_USB_PID) }, + { USB_DEVICE(ICOM_VID, ICOM_ID_1_PID) }, + { USB_DEVICE(ICOM_VID, ICOM_OPC_U_UC_PID) }, + { USB_DEVICE(ICOM_VID, ICOM_ID_RP2C1_PID) }, +--- a/drivers/usb/serial/ftdi_sio_ids.h ++++ b/drivers/usb/serial/ftdi_sio_ids.h +@@ -75,6 +75,9 @@ + #define FTDI_OPENDCC_GATEWAY_PID 0xBFDB + #define FTDI_OPENDCC_GBM_PID 0xBFDC + ++/* NZR SEM 16+ USB (http://www.nzr.de) */ ++#define FTDI_NZR_SEM_USB_PID 0xC1E0 /* NZR SEM-LOG16+ */ ++ + /* + * RR-CirKits LocoBuffer USB (http://www.rr-cirkits.com) + */ diff --git a/queue-3.0/usb-host-xhci-fix-compilation-error-for-non-pci-based-stacks.patch b/queue-3.0/usb-host-xhci-fix-compilation-error-for-non-pci-based-stacks.patch new file mode 100644 index 00000000000..523a34b38d7 --- /dev/null +++ b/queue-3.0/usb-host-xhci-fix-compilation-error-for-non-pci-based-stacks.patch @@ -0,0 +1,44 @@ +From 296365781903226a3fb8758901eaeec09d2798e4 Mon Sep 17 00:00:00 2001 +From: Moiz Sonasath +Date: Wed, 5 Sep 2012 08:34:26 +0300 +Subject: usb: host: xhci: fix compilation error for non-PCI based stacks + +From: Moiz Sonasath + +commit 296365781903226a3fb8758901eaeec09d2798e4 upstream. + +For non PCI-based stacks, this function call +usb_disable_xhci_ports(to_pci_dev(hcd->self.controller)); +made from xhci_shutdown is not applicable. + +Ideally, we wouldn't have any PCI-specific code on +a generic driver such as the xHCI stack, but it looks +like we should just stub usb_disable_xhci_ports() out +for non-PCI devices. + +[ balbi@ti.com: slight improvement to commit log ] + +This patch should be backported to kernels as old as 3.0, since the +commit it fixes (e95829f474f0db3a4d940cae1423783edd966027 "xhci: Switch +PPT ports to EHCI on shutdown.") was marked for stable. + +Signed-off-by: Moiz Sonasath +Signed-off-by: Ruchika Kharwar +Signed-off-by: Felipe Balbi +Signed-off-by: Sarah Sharp +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/pci-quirks.h | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/host/pci-quirks.h ++++ b/drivers/usb/host/pci-quirks.h +@@ -15,6 +15,7 @@ void usb_disable_xhci_ports(struct pci_d + static inline void usb_amd_quirk_pll_disable(void) {} + static inline void usb_amd_quirk_pll_enable(void) {} + static inline void usb_amd_dev_put(void) {} ++static inline void usb_disable_xhci_ports(struct pci_dev *xhci_pdev) {} + #endif /* CONFIG_PCI */ + + #endif /* __LINUX_USB_PCI_QUIRKS_H */ diff --git a/queue-3.0/xhci-fix-a-logical-vs-bitwise-and-bug.patch b/queue-3.0/xhci-fix-a-logical-vs-bitwise-and-bug.patch new file mode 100644 index 00000000000..ce6571f70ff --- /dev/null +++ b/queue-3.0/xhci-fix-a-logical-vs-bitwise-and-bug.patch @@ -0,0 +1,34 @@ +From 052c7f9ffb0e95843e75448d02664459253f9ff8 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Mon, 13 Aug 2012 19:57:03 +0300 +Subject: xhci: Fix a logical vs bitwise AND bug + +From: Dan Carpenter + +commit 052c7f9ffb0e95843e75448d02664459253f9ff8 upstream. + +The intent was to test whether the flag was set. + +This patch should be backported to stable kernels as old as 3.0, since +it fixes a bug in commit e95829f474f0db3a4d940cae1423783edd966027 "xhci: +Switch PPT ports to EHCI on shutdown.", which was marked for stable. + +Signed-off-by: Dan Carpenter +Signed-off-by: Sarah Sharp +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/xhci.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/host/xhci.c ++++ b/drivers/usb/host/xhci.c +@@ -594,7 +594,7 @@ void xhci_shutdown(struct usb_hcd *hcd) + { + struct xhci_hcd *xhci = hcd_to_xhci(hcd); + +- if (xhci->quirks && XHCI_SPURIOUS_REBOOT) ++ if (xhci->quirks & XHCI_SPURIOUS_REBOOT) + usb_disable_xhci_ports(to_pci_dev(hcd->self.controller)); + + spin_lock_irq(&xhci->lock); diff --git a/queue-3.0/xhci-fix-bug-after-deq-ptr-set-to-link-trb.patch b/queue-3.0/xhci-fix-bug-after-deq-ptr-set-to-link-trb.patch new file mode 100644 index 00000000000..7fbc0c028fe --- /dev/null +++ b/queue-3.0/xhci-fix-bug-after-deq-ptr-set-to-link-trb.patch @@ -0,0 +1,119 @@ +From 50d0206fcaea3e736f912fd5b00ec6233fb4ce44 Mon Sep 17 00:00:00 2001 +From: Sarah Sharp +Date: Thu, 26 Jul 2012 12:03:59 -0700 +Subject: xhci: Fix bug after deq ptr set to link TRB. + +From: Sarah Sharp + +commit 50d0206fcaea3e736f912fd5b00ec6233fb4ce44 upstream. + +This patch fixes a particularly nasty bug that was revealed by the ring +expansion patches. The bug has been present since the very beginning of +the xHCI driver history, and could have caused general protection faults +from bad memory accesses. + +The first thing to note is that a Set TR Dequeue Pointer command can +move the dequeue pointer to a link TRB, if the canceled or stalled +transfer TD ended just before a link TRB. The function to increment the +dequeue pointer, inc_deq, was written before cancellation and stall +support was added. It assumed that the dequeue pointer could never +point to a link TRB. It would unconditionally increment the dequeue +pointer at the start of the function, check if the pointer was now on a +link TRB, and move it to the top of the next segment if so. + +This means that if a Set TR Dequeue Point command moved the dequeue +pointer to a link TRB, a subsequent call to inc_deq() would move the +pointer off the segment and into la-la-land. It would then read from +that memory to determine if it was a link TRB. Other functions would +often call inc_deq() until the dequeue pointer matched some other +pointer, which means this function would quite happily read all of +system memory before wrapping around to the right pointer value. + +Often, there would be another endpoint segment from a different ring +allocated from the same DMA pool, which would be contiguous to the +segment inc_deq just stepped off of. inc_deq would eventually find the +link TRB in that segment, and blindly move the dequeue pointer back to +the top of the correct ring segment. + +The only reason the original code worked at all is because there was +only one ring segment. With the ring expansion patches, the dequeue +pointer would eventually wrap into place, but the dequeue segment would +be out-of-sync. On the second TD after the dequeue pointer was moved to +a link TRB, trb_in_td() would fail (because the dequeue pointer and +dequeue segment were out-of-sync), and this message would appear: + +ERROR Transfer event TRB DMA ptr not part of current TD + +This fixes bugzilla entry 4333 (option-based modem unhappy on USB 3.0 +port: "Transfer event TRB DMA ptr not part of current TD", "rejecting +I/O to offline device"), + + https://bugzilla.kernel.org/show_bug.cgi?id=43333 + +and possibly other general protection fault bugs as well. + +This patch should be backported to kernels as old as 2.6.31. A separate +patch will be created for kernels older than 3.4, since inc_deq was +modified in 3.4 and this patch will not apply. + +Signed-off-by: Sarah Sharp +Tested-by: James Ettle +Tested-by: Matthew Hall +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/xhci-ring.c | 39 ++++++++++++++++++++++++--------------- + 1 file changed, 24 insertions(+), 15 deletions(-) + +--- a/drivers/usb/host/xhci-ring.c ++++ b/drivers/usb/host/xhci-ring.c +@@ -147,25 +147,34 @@ static void next_trb(struct xhci_hcd *xh + */ + static void inc_deq(struct xhci_hcd *xhci, struct xhci_ring *ring, bool consumer) + { +- union xhci_trb *next = ++(ring->dequeue); + unsigned long long addr; + + ring->deq_updates++; +- /* Update the dequeue pointer further if that was a link TRB or we're at +- * the end of an event ring segment (which doesn't have link TRBS) +- */ +- while (last_trb(xhci, ring, ring->deq_seg, next)) { +- if (consumer && last_trb_on_last_seg(xhci, ring, ring->deq_seg, next)) { +- ring->cycle_state = (ring->cycle_state ? 0 : 1); +- if (!in_interrupt()) +- xhci_dbg(xhci, "Toggle cycle state for ring %p = %i\n", +- ring, +- (unsigned int) ring->cycle_state); ++ ++ do { ++ /* ++ * Update the dequeue pointer further if that was a link TRB or ++ * we're at the end of an event ring segment (which doesn't have ++ * link TRBS) ++ */ ++ if (last_trb(xhci, ring, ring->deq_seg, ring->dequeue)) { ++ if (consumer && last_trb_on_last_seg(xhci, ring, ++ ring->deq_seg, ring->dequeue)) { ++ if (!in_interrupt()) ++ xhci_dbg(xhci, "Toggle cycle state " ++ "for ring %p = %i\n", ++ ring, ++ (unsigned int) ++ ring->cycle_state); ++ ring->cycle_state = (ring->cycle_state ? 0 : 1); ++ } ++ ring->deq_seg = ring->deq_seg->next; ++ ring->dequeue = ring->deq_seg->trbs; ++ } else { ++ ring->dequeue++; + } +- ring->deq_seg = ring->deq_seg->next; +- ring->dequeue = ring->deq_seg->trbs; +- next = ring->dequeue; +- } ++ } while (last_trb(xhci, ring, ring->deq_seg, ring->dequeue)); ++ + addr = (unsigned long long) xhci_trb_virt_to_dma(ring->deq_seg, ring->dequeue); + } + diff --git a/queue-3.0/xhci-make-handover-code-more-robust.patch b/queue-3.0/xhci-make-handover-code-more-robust.patch new file mode 100644 index 00000000000..bd4848abf3c --- /dev/null +++ b/queue-3.0/xhci-make-handover-code-more-robust.patch @@ -0,0 +1,67 @@ +From e955a1cd086de4d165ae0f4c7be7289d84b63bdc Mon Sep 17 00:00:00 2001 +From: Matthew Garrett +Date: Tue, 14 Aug 2012 16:44:49 -0400 +Subject: xhci: Make handover code more robust + +From: Matthew Garrett + +commit e955a1cd086de4d165ae0f4c7be7289d84b63bdc upstream. + +My test platform (Intel DX79SI) boots reliably under BIOS, but frequently +crashes when booting via UEFI. I finally tracked this down to the xhci +handoff code. It seems that reads from the device occasionally just return +0xff, resulting in xhci_find_next_cap_offset generating a value that's +larger than the resource region. We then oops when attempting to read the +value. Sanity checking that value lets us avoid the crash. + +I've no idea what's causing the underlying problem, and xhci still doesn't +actually *work* even with this, but the machine at least boots which will +probably make further debugging easier. + +This should be backported to kernels as old as 2.6.31, that contain the +commit 66d4eadd8d067269ea8fead1a50fe87c2979a80d "USB: xhci: BIOS handoff +and HW initialization." + +Signed-off-by: Matthew Garrett +Signed-off-by: Sarah Sharp +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/pci-quirks.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +--- a/drivers/usb/host/pci-quirks.c ++++ b/drivers/usb/host/pci-quirks.c +@@ -839,12 +839,12 @@ static void __devinit quirk_usb_handoff_ + void __iomem *op_reg_base; + u32 val; + int timeout; ++ int len = pci_resource_len(pdev, 0); + + if (!mmio_resource_enabled(pdev, 0)) + return; + +- base = ioremap_nocache(pci_resource_start(pdev, 0), +- pci_resource_len(pdev, 0)); ++ base = ioremap_nocache(pci_resource_start(pdev, 0), len); + if (base == NULL) + return; + +@@ -854,9 +854,17 @@ static void __devinit quirk_usb_handoff_ + */ + ext_cap_offset = xhci_find_next_cap_offset(base, XHCI_HCC_PARAMS_OFFSET); + do { ++ if ((ext_cap_offset + sizeof(val)) > len) { ++ /* We're reading garbage from the controller */ ++ dev_warn(&pdev->dev, ++ "xHCI controller failing to respond"); ++ return; ++ } ++ + if (!ext_cap_offset) + /* We've reached the end of the extended capabilities */ + goto hc_init; ++ + val = readl(base + ext_cap_offset); + if (XHCI_EXT_CAPS_ID(val) == XHCI_EXT_CAPS_LEGACY) + break; diff --git a/queue-3.0/xhci-recognize-usb-3.0-devices-as-superspeed-at-powerup.patch b/queue-3.0/xhci-recognize-usb-3.0-devices-as-superspeed-at-powerup.patch new file mode 100644 index 00000000000..35ec1f46da4 --- /dev/null +++ b/queue-3.0/xhci-recognize-usb-3.0-devices-as-superspeed-at-powerup.patch @@ -0,0 +1,42 @@ +From 29d214576f936db627ff62afb9ef438eea18bcd2 Mon Sep 17 00:00:00 2001 +From: Manoj Iyer +Date: Wed, 22 Aug 2012 11:53:18 -0500 +Subject: xhci: Recognize USB 3.0 devices as superspeed at powerup + +From: Manoj Iyer + +commit 29d214576f936db627ff62afb9ef438eea18bcd2 upstream. + +On Intel Panther Point chipset USB 3.0 devices show up as +high-speed devices on powerup, but after an s3 cycle they are +correctly recognized as SuperSpeed. At powerup switch the port +to xHCI so that USB 3.0 devices are correctly recognized. + +BugLink: http://bugs.launchpad.net/bugs/1000424 + +This patch should be backported to kernels as old as 3.0, that contain +commit ID 69e848c2090aebba5698a1620604c7dccb448684 "Intel xhci: Support +EHCI/xHCI port switching." + +Signed-off-by: Manoj Iyer +Signed-off-by: Sarah Sharp +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/pci-quirks.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/usb/host/pci-quirks.c ++++ b/drivers/usb/host/pci-quirks.c +@@ -895,9 +895,10 @@ static void __devinit quirk_usb_handoff_ + /* Disable any BIOS SMIs and clear all SMI events*/ + writel(val, base + ext_cap_offset + XHCI_LEGACY_CONTROL_OFFSET); + ++hc_init: + if (usb_is_intel_switchable_xhci(pdev)) + usb_enable_xhci_ports(pdev); +-hc_init: ++ + op_reg_base = base + XHCI_HC_LENGTH(readl(base)); + + /* Wait for the host controller to be ready before writing any