From: Greg Kroah-Hartman Date: Fri, 23 Mar 2012 17:10:31 +0000 (-0700) Subject: 3.3-stable patches X-Git-Tag: v3.0.26~11 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=dae4576c8ba4c2f800edca2a13c3e76727e33765;p=thirdparty%2Fkernel%2Fstable-queue.git 3.3-stable patches added patches: ahci-add-ahci_hflag_delay_engine-host-flag.patch ahci-move-ahci_hflags-macro-to-ahci.h.patch ahci_platform-add-strict_ahci-platform-type.patch firewire-ohci-fix-too-early-completion-of-ir-multichannel-buffers.patch pata_legacy-correctly-mask-recovery-field-for-ht6560b.patch video-uvesafb-fix-oops-that-uvesafb-try-to-execute-nx-protected-page.patch --- diff --git a/queue-3.3/ahci-add-ahci_hflag_delay_engine-host-flag.patch b/queue-3.3/ahci-add-ahci_hflag_delay_engine-host-flag.patch new file mode 100644 index 00000000000..e67b87f35e9 --- /dev/null +++ b/queue-3.3/ahci-add-ahci_hflag_delay_engine-host-flag.patch @@ -0,0 +1,69 @@ +From 66583c9fa63d05d5580e409f9a58d3cad6d76d17 Mon Sep 17 00:00:00 2001 +From: Brian Norris +Date: Tue, 21 Feb 2012 10:38:42 -0800 +Subject: ahci: add AHCI_HFLAG_DELAY_ENGINE host flag + +From: Brian Norris + +commit 66583c9fa63d05d5580e409f9a58d3cad6d76d17 upstream. + +The following commit was intended to fix problems with specific AHCI +controller(s) that would become bricks if the AHCI specification was not +followed strictly (that is, if ahci_start_engine() was called while the +controller was in the wrong state): + + commit 7faa33da9b7add01db9f1ad92c6a5d9145e940a7 + ahci: start engine only during soft/hard resets + +However, some devices currently have issues with that fix, so we must +implement a flag that delays the ahci_start_engine() call only for specific +controllers. + +This commit simply introduces the flag, without enabling it in any driver. + +Note that even when AHCI_HFLAG_DELAY_ENGINE is not enabled, this patch does +not constitue a full revert to commit 7faa33da; there is still a change in +behavior to the ahci_port_suspend() failure path. + +Signed-off-by: Brian Norris +Signed-off-by: Jeff Garzik +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ata/ahci.h | 3 +++ + drivers/ata/libahci.c | 5 +++++ + 2 files changed, 8 insertions(+) + +--- a/drivers/ata/ahci.h ++++ b/drivers/ata/ahci.h +@@ -210,6 +210,9 @@ enum { + AHCI_HFLAG_NO_SNTF = (1 << 12), /* no sntf */ + AHCI_HFLAG_NO_FPDMA_AA = (1 << 13), /* no FPDMA AA */ + AHCI_HFLAG_YES_FBS = (1 << 14), /* force FBS cap on */ ++ AHCI_HFLAG_DELAY_ENGINE = (1 << 15), /* do not start engine on ++ port start (wait until ++ error-handling stage) */ + + /* ap->flags bits */ + +--- a/drivers/ata/libahci.c ++++ b/drivers/ata/libahci.c +@@ -737,6 +737,7 @@ static void ahci_power_down(struct ata_p + + static void ahci_start_port(struct ata_port *ap) + { ++ struct ahci_host_priv *hpriv = ap->host->private_data; + struct ahci_port_priv *pp = ap->private_data; + struct ata_link *link; + struct ahci_em_priv *emp; +@@ -746,6 +747,10 @@ static void ahci_start_port(struct ata_p + /* enable FIS reception */ + ahci_start_fis_rx(ap); + ++ /* enable DMA */ ++ if (!(hpriv->flags & AHCI_HFLAG_DELAY_ENGINE)) ++ ahci_start_engine(ap); ++ + /* turn on LEDs */ + if (ap->flags & ATA_FLAG_EM) { + ata_for_each_link(link, ap, EDGE) { diff --git a/queue-3.3/ahci-move-ahci_hflags-macro-to-ahci.h.patch b/queue-3.3/ahci-move-ahci_hflags-macro-to-ahci.h.patch new file mode 100644 index 00000000000..0d80a1c28bc --- /dev/null +++ b/queue-3.3/ahci-move-ahci_hflags-macro-to-ahci.h.patch @@ -0,0 +1,44 @@ +From 55d5ec316627b64c3764e4c1b4b8e1988e272c1f Mon Sep 17 00:00:00 2001 +From: Brian Norris +Date: Tue, 21 Feb 2012 10:38:43 -0800 +Subject: ahci: move AHCI_HFLAGS() macro to ahci.h + +From: Brian Norris + +commit 55d5ec316627b64c3764e4c1b4b8e1988e272c1f upstream. + +We will need this macro in both ahci.c and ahci_platform.c, so just move it +to the header. + +Signed-off-by: Brian Norris +Signed-off-by: Jeff Garzik +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ata/ahci.c | 2 -- + drivers/ata/ahci.h | 3 +++ + 2 files changed, 3 insertions(+), 2 deletions(-) + +--- a/drivers/ata/ahci.c ++++ b/drivers/ata/ahci.c +@@ -103,8 +103,6 @@ static struct ata_port_operations ahci_p + .hardreset = ahci_p5wdh_hardreset, + }; + +-#define AHCI_HFLAGS(flags) .private_data = (void *)(flags) +- + static const struct ata_port_info ahci_port_info[] = { + /* by features */ + [board_ahci] = +--- a/drivers/ata/ahci.h ++++ b/drivers/ata/ahci.h +@@ -195,6 +195,9 @@ enum { + PORT_FBS_EN = (1 << 0), /* Enable FBS */ + + /* hpriv->flags bits */ ++ ++#define AHCI_HFLAGS(flags) .private_data = (void *)(flags) ++ + AHCI_HFLAG_NO_NCQ = (1 << 0), + AHCI_HFLAG_IGN_IRQ_IF_ERR = (1 << 1), /* ignore IRQ_IF_ERR */ + AHCI_HFLAG_IGN_SERR_INTERNAL = (1 << 2), /* ignore SERR_INTERNAL */ diff --git a/queue-3.3/ahci_platform-add-strict_ahci-platform-type.patch b/queue-3.3/ahci_platform-add-strict_ahci-platform-type.patch new file mode 100644 index 00000000000..970454ef674 --- /dev/null +++ b/queue-3.3/ahci_platform-add-strict_ahci-platform-type.patch @@ -0,0 +1,53 @@ +From d408e2b14fba4fa214fa5bc24b7baae8a55e563c Mon Sep 17 00:00:00 2001 +From: Brian Norris +Date: Tue, 21 Feb 2012 10:38:44 -0800 +Subject: ahci_platform: add STRICT_AHCI platform type + +From: Brian Norris + +commit d408e2b14fba4fa214fa5bc24b7baae8a55e563c upstream. + +Some platforms need to make use of the AHCI_HFLAG_DELAY_ENGINE flag. + +Signed-off-by: Brian Norris +Signed-off-by: Jeff Garzik +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ata/ahci_platform.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +--- a/drivers/ata/ahci_platform.c ++++ b/drivers/ata/ahci_platform.c +@@ -26,6 +26,7 @@ + enum ahci_type { + AHCI, /* standard platform ahci */ + IMX53_AHCI, /* ahci on i.mx53 */ ++ STRICT_AHCI, /* delayed DMA engine start */ + }; + + static struct platform_device_id ahci_devtype[] = { +@@ -36,6 +37,9 @@ static struct platform_device_id ahci_de + .name = "imx53-ahci", + .driver_data = IMX53_AHCI, + }, { ++ .name = "strict-ahci", ++ .driver_data = STRICT_AHCI, ++ }, { + /* sentinel */ + } + }; +@@ -56,6 +60,13 @@ static const struct ata_port_info ahci_p + .udma_mask = ATA_UDMA6, + .port_ops = &ahci_pmp_retry_srst_ops, + }, ++ [STRICT_AHCI] = { ++ AHCI_HFLAGS (AHCI_HFLAG_DELAY_ENGINE), ++ .flags = AHCI_FLAG_COMMON, ++ .pio_mask = ATA_PIO4, ++ .udma_mask = ATA_UDMA6, ++ .port_ops = &ahci_ops, ++ }, + }; + + static struct scsi_host_template ahci_platform_sht = { diff --git a/queue-3.3/firewire-ohci-fix-too-early-completion-of-ir-multichannel-buffers.patch b/queue-3.3/firewire-ohci-fix-too-early-completion-of-ir-multichannel-buffers.patch new file mode 100644 index 00000000000..d7e07db0333 --- /dev/null +++ b/queue-3.3/firewire-ohci-fix-too-early-completion-of-ir-multichannel-buffers.patch @@ -0,0 +1,52 @@ +From 0c0efbacab8d70700d13301e0ae7975783c0cb0a Mon Sep 17 00:00:00 2001 +From: Clemens Ladisch +Date: Mon, 12 Mar 2012 21:45:47 +0100 +Subject: firewire: ohci: fix too-early completion of IR multichannel buffers + +From: Clemens Ladisch + +commit 0c0efbacab8d70700d13301e0ae7975783c0cb0a upstream. + +handle_ir_buffer_fill() assumed that a completed descriptor would be +indicated by a non-zero transfer_status (as in most other descriptors). +However, this field is written by the controller as soon as (the end of) +the first packet has been written into the buffer. As a consequence, if +we happen to run into such a descriptor when the interrupt handler is +executed after such a packet has completed, the descriptor would be +taken out of the list of active descriptors as soon as the buffer had +been partially filled, so the event for the buffer being completely +filled would never be sent. + +To fix this, handle descriptors only when they have been completely +filled, i.e., when res_count == 0. (This also matches the condition +that is reported by the controller with an interrupt.) + +Signed-off-by: Clemens Ladisch +Signed-off-by: Stefan Richter +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/firewire/ohci.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +--- a/drivers/firewire/ohci.c ++++ b/drivers/firewire/ohci.c +@@ -2748,7 +2748,7 @@ static int handle_ir_buffer_fill(struct + container_of(context, struct iso_context, context); + u32 buffer_dma; + +- if (!last->transfer_status) ++ if (last->res_count != 0) + /* Descriptor(s) not done yet, stop iteration */ + return 0; + +@@ -2762,8 +2762,7 @@ static int handle_ir_buffer_fill(struct + if (le16_to_cpu(last->control) & DESCRIPTOR_IRQ_ALWAYS) + ctx->base.callback.mc(&ctx->base, + le32_to_cpu(last->data_address) + +- le16_to_cpu(last->req_count) - +- le16_to_cpu(last->res_count), ++ le16_to_cpu(last->req_count), + ctx->base.callback_data); + + return 1; diff --git a/queue-3.3/pata_legacy-correctly-mask-recovery-field-for-ht6560b.patch b/queue-3.3/pata_legacy-correctly-mask-recovery-field-for-ht6560b.patch new file mode 100644 index 00000000000..a7441626107 --- /dev/null +++ b/queue-3.3/pata_legacy-correctly-mask-recovery-field-for-ht6560b.patch @@ -0,0 +1,33 @@ +From 9716387311c790de381214c03e7f1b72b91a8189 Mon Sep 17 00:00:00 2001 +From: Sergei Shtylyov +Date: Thu, 19 Jan 2012 19:09:56 +0300 +Subject: pata_legacy: correctly mask recovery field for HT6560B + +From: Sergei Shtylyov + +commit 9716387311c790de381214c03e7f1b72b91a8189 upstream. + +According to the HT6560H datasheet, the recovery timing field is 4-bit wide, +with a value of 0 meaning 16 cycles. Correct obvious thinko in the recovery +field mask. + +Signed-off-by: Sergei Shtylyov +Signed-off-by: Jeff Garzik +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ata/pata_legacy.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/drivers/ata/pata_legacy.c ++++ b/drivers/ata/pata_legacy.c +@@ -401,8 +401,7 @@ static void ht6560b_set_piomode(struct a + ata_timing_compute(adev, adev->pio_mode, &t, 20000, 1000); + + active = clamp_val(t.active, 2, 15); +- recover = clamp_val(t.recover, 2, 16); +- recover &= 0x15; ++ recover = clamp_val(t.recover, 2, 16) & 0x0F; + + inb(0x3E6); + inb(0x3E6); diff --git a/queue-3.3/series b/queue-3.3/series index 867f0e39fea..57942249f6c 100644 --- a/queue-3.3/series +++ b/queue-3.3/series @@ -93,3 +93,9 @@ target-fix-16-bit-target-ports-for-set-target-port-groups-emulation.patch bluetooth-add-ar30xx-device-id-on-asus-laptops.patch hid-add-extra-hotkeys-in-asus-aio-keyboards.patch hid-add-more-hotkeys-in-asus-aio-keyboards.patch +ahci-add-ahci_hflag_delay_engine-host-flag.patch +ahci-move-ahci_hflags-macro-to-ahci.h.patch +ahci_platform-add-strict_ahci-platform-type.patch +pata_legacy-correctly-mask-recovery-field-for-ht6560b.patch +firewire-ohci-fix-too-early-completion-of-ir-multichannel-buffers.patch +video-uvesafb-fix-oops-that-uvesafb-try-to-execute-nx-protected-page.patch diff --git a/queue-3.3/video-uvesafb-fix-oops-that-uvesafb-try-to-execute-nx-protected-page.patch b/queue-3.3/video-uvesafb-fix-oops-that-uvesafb-try-to-execute-nx-protected-page.patch new file mode 100644 index 00000000000..ab05b688b0c --- /dev/null +++ b/queue-3.3/video-uvesafb-fix-oops-that-uvesafb-try-to-execute-nx-protected-page.patch @@ -0,0 +1,121 @@ +From ec0d22e4d563e7cce9f6678e2000900755c2989d Mon Sep 17 00:00:00 2001 +From: Wang YanQing +Date: Fri, 2 Mar 2012 08:48:50 +0800 +Subject: video:uvesafb: Fix oops that uvesafb try to execute NX-protected page + +From: Wang YanQing + +commit ec0d22e4d563e7cce9f6678e2000900755c2989d upstream. + +This patch fixes the oops below + +[ 81.560602] uvesafb: NVIDIA Corporation, GT216 Board - 0696a290, Chip Rev , OEM: NVIDIA, VBE v3.0 +[ 81.609384] uvesafb: protected mode interface info at c000:d350 +[ 81.609388] uvesafb: pmi: set display start = c00cd3b3, set palette = c00cd40e +[ 81.609390] uvesafb: pmi: ports = 3b4 3b5 3ba 3c0 3c1 3c4 3c5 3c6 3c7 3c8 3c9 3cc 3ce 3cf 3d0 3d1 3d2 3d3 3d4 3d5 3da +[ 81.614558] uvesafb: VBIOS/hardware doesn't support DDC transfers +[ 81.614562] uvesafb: no monitor limits have been set, default refresh rate will be used +[ 81.614994] uvesafb: scrolling: ypan using protected mode interface, yres_virtual=4915 +[ 81.744147] kernel tried to execute NX-protected page - exploit attempt? (uid: 0) +[ 81.744153] BUG: unable to handle kernel paging request at c00cd3b3 +[ 81.744159] IP: [] 0xc00cd3b2 +[ 81.744167] *pdpt = 00000000016d6001 *pde = 0000000001c7b067 *pte = 80000000000cd163 +[ 81.744171] Oops: 0011 [#1] SMP +[ 81.744174] Modules linked in: uvesafb(+) cfbcopyarea cfbimgblt cfbfillrect +[ 81.744178] +[ 81.744181] Pid: 3497, comm: modprobe Not tainted 3.3.0-rc4NX+ #71 Acer Aspire 4741 /Aspire 4741 +[ 81.744185] EIP: 0060:[] EFLAGS: 00010246 CPU: 0 +[ 81.744187] EIP is at 0xc00cd3b3 +[ 81.744189] EAX: 00004f07 EBX: 00000000 ECX: 00000000 EDX: 00000000 +[ 81.744191] ESI: f763f000 EDI: f763f6e8 EBP: f57f3a0c ESP: f57f3a00 +[ 81.744192] DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068 +[ 81.744195] Process modprobe (pid: 3497, ti=f57f2000 task=f748c600 task.ti=f57f2000) +[ 81.744196] Stack: +[ 81.744197] f82512c5 f759341c 00000000 f57f3a30 c124a9bc 00000001 00000001 000001e0 +[ 81.744202] f8251280 f763f000 f7593400 00000000 f57f3a40 c12598dd f5c0c000 00000000 +[ 81.744206] f57f3b10 c1255efe c125a21a 00000006 f763f09c 00000000 c1c6cb60 f7593400 +[ 81.744210] Call Trace: +[ 81.744215] [] ? uvesafb_pan_display+0x45/0x60 [uvesafb] +[ 81.744222] [] fb_pan_display+0x10c/0x160 +[ 81.744226] [] ? uvesafb_vbe_find_mode+0x180/0x180 [uvesafb] +[ 81.744230] [] bit_update_start+0x1d/0x50 +[ 81.744232] [] fbcon_switch+0x39e/0x550 +[ 81.744235] [] ? bit_cursor+0x4ea/0x560 +[ 81.744240] [] redraw_screen+0x12b/0x220 +[ 81.744245] [] ? tty_do_resize+0x3b/0xc0 +[ 81.744247] [] vc_do_resize+0x3d2/0x3e0 +[ 81.744250] [] vc_resize+0x14/0x20 +[ 81.744253] [] fbcon_init+0x29d/0x500 +[ 81.744255] [] ? set_inverse_trans_unicode+0xe4/0x110 +[ 81.744258] [] visual_init+0xb8/0x150 +[ 81.744261] [] bind_con_driver+0x16c/0x360 +[ 81.744264] [] ? register_con_driver+0x6e/0x190 +[ 81.744267] [] take_over_console+0x41/0x50 +[ 81.744269] [] fbcon_takeover+0x6a/0xd0 +[ 81.744272] [] fbcon_event_notify+0x758/0x790 +[ 81.744277] [] notifier_call_chain+0x42/0xb0 +[ 81.744280] [] __blocking_notifier_call_chain+0x60/0x90 +[ 81.744283] [] blocking_notifier_call_chain+0x1a/0x20 +[ 81.744285] [] fb_notifier_call_chain+0x11/0x20 +[ 81.744288] [] register_framebuffer+0x1d9/0x2b0 +[ 81.744293] [] ? ioremap_wc+0x33/0x40 +[ 81.744298] [] uvesafb_probe+0xaba/0xc40 [uvesafb] +[ 81.744302] [] platform_drv_probe+0xf/0x20 +[ 81.744306] [] driver_probe_device+0x68/0x170 +[ 81.744309] [] __device_attach+0x41/0x50 +[ 81.744313] [] bus_for_each_drv+0x48/0x70 +[ 81.744316] [] device_attach+0x83/0xa0 +[ 81.744319] [] ? __driver_attach+0x90/0x90 +[ 81.744321] [] bus_probe_device+0x6f/0x90 +[ 81.744324] [] device_add+0x5e5/0x680 +[ 81.744329] [] ? kvasprintf+0x43/0x60 +[ 81.744332] [] ? kobject_set_name_vargs+0x64/0x70 +[ 81.744335] [] ? kobject_set_name_vargs+0x64/0x70 +[ 81.744339] [] platform_device_add+0xff/0x1b0 +[ 81.744343] [] uvesafb_init+0x50/0x9b [uvesafb] +[ 81.744346] [] do_one_initcall+0x2f/0x170 +[ 81.744350] [] ? uvesafb_is_valid_mode+0x66/0x66 [uvesafb] +[ 81.744355] [] sys_init_module+0xf4/0x1410 +[ 81.744359] [] ? vfsmount_lock_local_unlock_cpu+0x30/0x30 +[ 81.744363] [] sysenter_do_call+0x12/0x36 +[ 81.744365] Code: f5 00 00 00 32 f6 66 8b da 66 d1 e3 66 ba d4 03 8a e3 b0 1c 66 ef b0 1e 66 ef 8a e7 b0 1d 66 ef b0 1f 66 ef e8 fa 00 00 00 61 c3 <60> e8 c8 00 00 00 66 8b f3 66 8b da 66 ba d4 03 b0 0c 8a e5 66 +[ 81.744388] EIP: [] 0xc00cd3b3 SS:ESP 0068:f57f3a00 +[ 81.744391] CR2: 00000000c00cd3b3 +[ 81.744393] ---[ end trace 18b2c87c925b54d6 ]--- + +Signed-off-by: Wang YanQing +Signed-off-by: Florian Tobias Schandinat +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/video/uvesafb.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +--- a/drivers/video/uvesafb.c ++++ b/drivers/video/uvesafb.c +@@ -23,6 +23,7 @@ + #include