From 451eb47c3b101af35de1a7b5024d72c7f37f4820 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Tue, 24 Apr 2012 08:51:10 -0700 Subject: [PATCH] 3.3-stable patches added patches: brcm80211-smac-resume-transmit-fifo-upon-receiving-frames.patch cfg80211-fix-interface-combinations-check.patch davinci_mdio-fix-mdio-timeout-check.patch fix-modpost-failures-in-fedora-17.patch mac80211-fix-logic-error-in-ibss-channel-type-check.patch media-drxk-does-not-unlock-mutex-if-sanity-check-failed-in-scu_command.patch media-dvb_frontend-fix-a-regression-when-switching-back-to-dvb-s.patch media-rc-core-set-mode-for-winbond-cir.patch mwifiex-update-pcie8766-scratch-register-addresses.patch staging-r8712u-fix-regression-caused-by-commit-8c213fa.patch usb-yurex-fix-missing-urb_no_transfer_dma_map-flag-in-urb.patch usb-yurex-remove-allocation-of-coherent-buffer-for-setup-packet-buffer.patch uwb-fix-error-handling.patch uwb-fix-use-of-del_timer_sync-in-interrupt.patch xen-gntdev-do-not-set-vm_pfnmap.patch xen-xenbus-add-quirk-to-deal-with-misconfigured-backends.patch --- ...-transmit-fifo-upon-receiving-frames.patch | 54 +++++++ ...211-fix-interface-combinations-check.patch | 28 ++++ .../davinci_mdio-fix-mdio-timeout-check.patch | 42 +++++ .../fix-modpost-failures-in-fedora-17.patch | 51 ++++++ ...gic-error-in-ibss-channel-type-check.patch | 37 +++++ ...f-sanity-check-failed-in-scu_command.patch | 38 +++++ ...ression-when-switching-back-to-dvb-s.patch | 71 +++++++++ ...dia-rc-core-set-mode-for-winbond-cir.patch | 35 +++++ ...-pcie8766-scratch-register-addresses.patch | 48 ++++++ queue-3.3/series | 16 ++ ...-regression-caused-by-commit-8c213fa.patch | 60 +++++++ ...-urb_no_transfer_dma_map-flag-in-urb.patch | 31 ++++ ...erent-buffer-for-setup-packet-buffer.patch | 44 ++++++ queue-3.3/uwb-fix-error-handling.patch | 31 ++++ ...x-use-of-del_timer_sync-in-interrupt.patch | 61 ++++++++ .../xen-gntdev-do-not-set-vm_pfnmap.patch | 35 +++++ ...-to-deal-with-misconfigured-backends.patch | 148 ++++++++++++++++++ 17 files changed, 830 insertions(+) create mode 100644 queue-3.3/brcm80211-smac-resume-transmit-fifo-upon-receiving-frames.patch create mode 100644 queue-3.3/cfg80211-fix-interface-combinations-check.patch create mode 100644 queue-3.3/davinci_mdio-fix-mdio-timeout-check.patch create mode 100644 queue-3.3/fix-modpost-failures-in-fedora-17.patch create mode 100644 queue-3.3/mac80211-fix-logic-error-in-ibss-channel-type-check.patch create mode 100644 queue-3.3/media-drxk-does-not-unlock-mutex-if-sanity-check-failed-in-scu_command.patch create mode 100644 queue-3.3/media-dvb_frontend-fix-a-regression-when-switching-back-to-dvb-s.patch create mode 100644 queue-3.3/media-rc-core-set-mode-for-winbond-cir.patch create mode 100644 queue-3.3/mwifiex-update-pcie8766-scratch-register-addresses.patch create mode 100644 queue-3.3/staging-r8712u-fix-regression-caused-by-commit-8c213fa.patch create mode 100644 queue-3.3/usb-yurex-fix-missing-urb_no_transfer_dma_map-flag-in-urb.patch create mode 100644 queue-3.3/usb-yurex-remove-allocation-of-coherent-buffer-for-setup-packet-buffer.patch create mode 100644 queue-3.3/uwb-fix-error-handling.patch create mode 100644 queue-3.3/uwb-fix-use-of-del_timer_sync-in-interrupt.patch create mode 100644 queue-3.3/xen-gntdev-do-not-set-vm_pfnmap.patch create mode 100644 queue-3.3/xen-xenbus-add-quirk-to-deal-with-misconfigured-backends.patch diff --git a/queue-3.3/brcm80211-smac-resume-transmit-fifo-upon-receiving-frames.patch b/queue-3.3/brcm80211-smac-resume-transmit-fifo-upon-receiving-frames.patch new file mode 100644 index 00000000000..4bb5e06abac --- /dev/null +++ b/queue-3.3/brcm80211-smac-resume-transmit-fifo-upon-receiving-frames.patch @@ -0,0 +1,54 @@ +From badc4f07622f0f7093a201638f45e85765f1b5e4 Mon Sep 17 00:00:00 2001 +From: Arend van Spriel +Date: Wed, 11 Apr 2012 11:52:51 +0200 +Subject: brcm80211: smac: resume transmit fifo upon receiving frames + +From: Arend van Spriel + +commit badc4f07622f0f7093a201638f45e85765f1b5e4 upstream. + +There have been reports about not being able to use access-points +on channel 12 and 13 or having connectivity issues when these channels +were part of the selected regulatory domain. Upon switching to these +channels the brcmsmac driver suspends the transmit dma fifos. This +patch resumes them upon handing over the first received beacon to +mac80211. + +This patch is to be applied to the stable tree for kernel versions +3.2 and 3.3. + +Tested-by: Francesco Saverio Schiavarelli +Reviewed-by: Pieter-Paul Giesberts +Reviewed-by: Brett Rudley +Signed-off-by: Arend van Spriel +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/brcm80211/brcmsmac/main.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/drivers/net/wireless/brcm80211/brcmsmac/main.c ++++ b/drivers/net/wireless/brcm80211/brcmsmac/main.c +@@ -7629,6 +7629,7 @@ brcms_c_recvctl(struct brcms_c_info *wlc + { + int len_mpdu; + struct ieee80211_rx_status rx_status; ++ struct ieee80211_hdr *hdr; + + memset(&rx_status, 0, sizeof(rx_status)); + prep_mac80211_status(wlc, rxh, p, &rx_status); +@@ -7638,6 +7639,13 @@ brcms_c_recvctl(struct brcms_c_info *wlc + skb_pull(p, D11_PHY_HDR_LEN); + __skb_trim(p, len_mpdu); + ++ /* unmute transmit */ ++ if (wlc->hw->suspended_fifos) { ++ hdr = (struct ieee80211_hdr *)p->data; ++ if (ieee80211_is_beacon(hdr->frame_control)) ++ brcms_b_mute(wlc->hw, false); ++ } ++ + memcpy(IEEE80211_SKB_RXCB(p), &rx_status, sizeof(rx_status)); + ieee80211_rx_irqsafe(wlc->pub->ieee_hw, p); + } diff --git a/queue-3.3/cfg80211-fix-interface-combinations-check.patch b/queue-3.3/cfg80211-fix-interface-combinations-check.patch new file mode 100644 index 00000000000..5f2648e8698 --- /dev/null +++ b/queue-3.3/cfg80211-fix-interface-combinations-check.patch @@ -0,0 +1,28 @@ +From e55a4046dab28c440c96890bdddcf02dc8981f2d Mon Sep 17 00:00:00 2001 +From: Lukasz Kucharczyk +Date: Wed, 11 Apr 2012 14:55:10 +0200 +Subject: cfg80211: fix interface combinations check. + +From: Lukasz Kucharczyk + +commit e55a4046dab28c440c96890bdddcf02dc8981f2d upstream. + +Signed-off-by: Lukasz Kucharczyk +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + net/wireless/util.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/wireless/util.c ++++ b/net/wireless/util.c +@@ -988,7 +988,7 @@ int cfg80211_can_change_interface(struct + if (rdev->wiphy.software_iftypes & BIT(iftype)) + continue; + for (j = 0; j < c->n_limits; j++) { +- if (!(limits[j].types & iftype)) ++ if (!(limits[j].types & BIT(iftype))) + continue; + if (limits[j].max < num[iftype]) + goto cont; diff --git a/queue-3.3/davinci_mdio-fix-mdio-timeout-check.patch b/queue-3.3/davinci_mdio-fix-mdio-timeout-check.patch new file mode 100644 index 00000000000..2da1bd755b9 --- /dev/null +++ b/queue-3.3/davinci_mdio-fix-mdio-timeout-check.patch @@ -0,0 +1,42 @@ +From 5b76d0600b2b08eef77f8e9226938b7b6bde3099 Mon Sep 17 00:00:00 2001 +From: Christian Riesch +Date: Mon, 16 Apr 2012 04:35:25 +0000 +Subject: davinci_mdio: Fix MDIO timeout check + +From: Christian Riesch + +commit 5b76d0600b2b08eef77f8e9226938b7b6bde3099 upstream. + +Under heavy load (flood ping) it is possible for the MDIO timeout to +expire before the loop checks the GO bit again. This patch adds an +additional check whether the operation was done before actually +returning -ETIMEDOUT. + +To reproduce this bug, flood ping the device, e.g., ping -f -l 1000 +After some time, a "timed out waiting for user access" warning +may appear. And even worse, link may go down since the PHY reported a +timeout. + +Signed-off-by: Christian Riesch +Cc: Cyril Chemparathy +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/ethernet/ti/davinci_mdio.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/net/ethernet/ti/davinci_mdio.c ++++ b/drivers/net/ethernet/ti/davinci_mdio.c +@@ -181,6 +181,11 @@ static inline int wait_for_user_access(s + __davinci_mdio_reset(data); + return -EAGAIN; + } ++ ++ reg = __raw_readl(®s->user[0].access); ++ if ((reg & USERACCESS_GO) == 0) ++ return 0; ++ + dev_err(data->dev, "timed out waiting for user access\n"); + return -ETIMEDOUT; + } diff --git a/queue-3.3/fix-modpost-failures-in-fedora-17.patch b/queue-3.3/fix-modpost-failures-in-fedora-17.patch new file mode 100644 index 00000000000..fd073953f80 --- /dev/null +++ b/queue-3.3/fix-modpost-failures-in-fedora-17.patch @@ -0,0 +1,51 @@ +From e88aa7bbbe3046a125ea1936b16bb921cc9c6349 Mon Sep 17 00:00:00 2001 +From: David Miller +Date: Thu, 12 Apr 2012 14:37:30 -0400 +Subject: Fix modpost failures in fedora 17 + +From: David Miller + +commit e88aa7bbbe3046a125ea1936b16bb921cc9c6349 upstream. + +The symbol table on x86-64 starts to have entries that have names +like: + +_GLOBAL__sub_I_65535_0___mod_x86cpu_device_table + +They are of type STT_FUNCTION and this one had a length of 18. This +matched the device ID validation logic and it barfed because the +length did not meet the device type's criteria. + +-------------------- +FATAL: arch/x86/crypto/aesni-intel: sizeof(struct x86cpu_device_id)=16 is not a modulo of the size of section __mod_x86cpu_device_table=18. +Fix definition of struct x86cpu_device_id in mod_devicetable.h +-------------------- + +These are some kind of compiler tool internal stuff being emitted and +not something we want to inspect in modpost's device ID table +validation code. + +So skip the symbol if it is not of type STT_OBJECT. + +Signed-off-by: David S. Miller +Acked-by: Sam Ravnborg +Signed-off-by: Michal Marek +Signed-off-by: Greg Kroah-Hartman + +--- + scripts/mod/file2alias.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/scripts/mod/file2alias.c ++++ b/scripts/mod/file2alias.c +@@ -1075,6 +1075,10 @@ void handle_moddevtable(struct module *m + if (!sym->st_shndx || get_secindex(info, sym) >= info->num_sections) + return; + ++ /* We're looking for an object */ ++ if (ELF_ST_TYPE(sym->st_info) != STT_OBJECT) ++ return; ++ + /* All our symbols are of form __mod_XXX_device_table. */ + name = strstr(symname, "__mod_"); + if (!name) diff --git a/queue-3.3/mac80211-fix-logic-error-in-ibss-channel-type-check.patch b/queue-3.3/mac80211-fix-logic-error-in-ibss-channel-type-check.patch new file mode 100644 index 00000000000..bbee913510c --- /dev/null +++ b/queue-3.3/mac80211-fix-logic-error-in-ibss-channel-type-check.patch @@ -0,0 +1,37 @@ +From 6741e7f048dacc92e37c5d724ff5c64e45f6c2c9 Mon Sep 17 00:00:00 2001 +From: Felix Fietkau +Date: Mon, 16 Apr 2012 22:10:42 +0200 +Subject: mac80211: fix logic error in ibss channel type check + +From: Felix Fietkau + +commit 6741e7f048dacc92e37c5d724ff5c64e45f6c2c9 upstream. + +The broken check leads to rate control attempting to use HT40 while +the driver is configured for HT20. This leads to interesting hardware +issues. + +HT40 can only be used if the channel type is either HT40- or HT40+ +and if the channel type of the cell matches the local type. + +Signed-off-by: Felix Fietkau +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + net/mac80211/ibss.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/net/mac80211/ibss.c ++++ b/net/mac80211/ibss.c +@@ -435,8 +435,8 @@ static void ieee80211_rx_bss_info(struct + * fall back to HT20 if we don't use or use + * the other extension channel + */ +- if ((channel_type == NL80211_CHAN_HT40MINUS || +- channel_type == NL80211_CHAN_HT40PLUS) && ++ if (!(channel_type == NL80211_CHAN_HT40MINUS || ++ channel_type == NL80211_CHAN_HT40PLUS) || + channel_type != sdata->u.ibss.channel_type) + sta_ht_cap_new.cap &= + ~IEEE80211_HT_CAP_SUP_WIDTH_20_40; diff --git a/queue-3.3/media-drxk-does-not-unlock-mutex-if-sanity-check-failed-in-scu_command.patch b/queue-3.3/media-drxk-does-not-unlock-mutex-if-sanity-check-failed-in-scu_command.patch new file mode 100644 index 00000000000..e09d2bee9a2 --- /dev/null +++ b/queue-3.3/media-drxk-does-not-unlock-mutex-if-sanity-check-failed-in-scu_command.patch @@ -0,0 +1,38 @@ +From e4459e1682c107d7ee1bf102c1ba534230e9b50b Mon Sep 17 00:00:00 2001 +From: Alexey Khoroshilov +Date: Thu, 5 Apr 2012 18:53:20 -0300 +Subject: media: drxk: Does not unlock mutex if sanity check failed in scu_command() + +From: Alexey Khoroshilov + +commit e4459e1682c107d7ee1bf102c1ba534230e9b50b upstream. + +If sanity check fails in scu_command(), goto error leads to unlock of +an unheld mutex. The check should not fail in reality, but it nevertheless +worth fixing. + +Found by Linux Driver Verification project (linuxtesting.org). + +Signed-off-by: Alexey Khoroshilov +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/dvb/frontends/drxk_hard.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/media/dvb/frontends/drxk_hard.c ++++ b/drivers/media/dvb/frontends/drxk_hard.c +@@ -1525,8 +1525,10 @@ static int scu_command(struct drxk_state + dprintk(1, "\n"); + + if ((cmd == 0) || ((parameterLen > 0) && (parameter == NULL)) || +- ((resultLen > 0) && (result == NULL))) +- goto error; ++ ((resultLen > 0) && (result == NULL))) { ++ printk(KERN_ERR "drxk: Error %d on %s\n", status, __func__); ++ return status; ++ } + + mutex_lock(&state->mutex); + diff --git a/queue-3.3/media-dvb_frontend-fix-a-regression-when-switching-back-to-dvb-s.patch b/queue-3.3/media-dvb_frontend-fix-a-regression-when-switching-back-to-dvb-s.patch new file mode 100644 index 00000000000..c83d93c277a --- /dev/null +++ b/queue-3.3/media-dvb_frontend-fix-a-regression-when-switching-back-to-dvb-s.patch @@ -0,0 +1,71 @@ +From 3626479e482aa3247aac03724094ba6c13ea1e46 Mon Sep 17 00:00:00 2001 +From: Mauro Carvalho Chehab +Date: Tue, 17 Apr 2012 18:32:19 -0300 +Subject: media: dvb_frontend: Fix a regression when switching back to DVB-S + +From: Mauro Carvalho Chehab + +commit 3626479e482aa3247aac03724094ba6c13ea1e46 upstream. + +There are some softwares (Kaffeine and likely xine) that uses a +DVBv5 call to switch to DVB-S2, but expects that a DVBv3 call to +switch back to DVB-S. Well, this is not right, as a DVBv3 call +doesn't know anything about delivery systems. + +However, as, by accident, this used to work, we need to restore its +behavior, in order to avoid regressions with those softwares. + +Reported on this Fedora 16 bugzilla: + https://bugzilla.redhat.com/show_bug.cgi?id=812895 + +Reported-by: Dieter Roever +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/dvb/dvb-core/dvb_frontend.c | 25 ++++++++++++++++++++++++- + 1 file changed, 24 insertions(+), 1 deletion(-) + +--- a/drivers/media/dvb/dvb-core/dvb_frontend.c ++++ b/drivers/media/dvb/dvb-core/dvb_frontend.c +@@ -1446,6 +1446,28 @@ static int set_delivery_system(struct dv + __func__); + return -EINVAL; + } ++ /* ++ * Get a delivery system that is compatible with DVBv3 ++ * NOTE: in order for this to work with softwares like Kaffeine that ++ * uses a DVBv5 call for DVB-S2 and a DVBv3 call to go back to ++ * DVB-S, drivers that support both should put the SYS_DVBS entry ++ * before the SYS_DVBS2, otherwise it won't switch back to DVB-S. ++ * The real fix is that userspace applications should not use DVBv3 ++ * and not trust on calling FE_SET_FRONTEND to switch the delivery ++ * system. ++ */ ++ ncaps = 0; ++ while (fe->ops.delsys[ncaps] && ncaps < MAX_DELSYS) { ++ if (fe->ops.delsys[ncaps] == desired_system) { ++ delsys = desired_system; ++ break; ++ } ++ ncaps++; ++ } ++ if (delsys == SYS_UNDEFINED) { ++ dprintk("%s() Couldn't find a delivery system that matches %d\n", ++ __func__, desired_system); ++ } + } else { + /* + * This is a DVBv5 call. So, it likely knows the supported +@@ -1494,9 +1516,10 @@ static int set_delivery_system(struct dv + __func__); + return -EINVAL; + } +- c->delivery_system = delsys; + } + ++ c->delivery_system = delsys; ++ + /* + * The DVBv3 or DVBv5 call is requesting a different system. So, + * emulation is needed. diff --git a/queue-3.3/media-rc-core-set-mode-for-winbond-cir.patch b/queue-3.3/media-rc-core-set-mode-for-winbond-cir.patch new file mode 100644 index 00000000000..350f853c0c2 --- /dev/null +++ b/queue-3.3/media-rc-core-set-mode-for-winbond-cir.patch @@ -0,0 +1,35 @@ +From d9b786955f80fb306471fdb9ea24c6d03af6ca36 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?David=20H=C3=A4rdeman?= +Date: Sun, 8 Apr 2012 06:13:04 -0300 +Subject: media: rc-core: set mode for winbond-cir +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: David Härdeman + +commit d9b786955f80fb306471fdb9ea24c6d03af6ca36 upstream. + +Setting the correct mode is required by rc-core or scancodes won't be +generated (which isn't very user-friendly). + +This one-line fix should be suitable for 3.4-rc2. + +Signed-off-by: David Härdeman +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/rc/winbond-cir.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/media/rc/winbond-cir.c ++++ b/drivers/media/rc/winbond-cir.c +@@ -1046,6 +1046,7 @@ wbcir_probe(struct pnp_dev *device, cons + goto exit_unregister_led; + } + ++ data->dev->driver_type = RC_DRIVER_IR_RAW; + data->dev->driver_name = WBCIR_NAME; + data->dev->input_name = WBCIR_NAME; + data->dev->input_phys = "wbcir/cir0"; diff --git a/queue-3.3/mwifiex-update-pcie8766-scratch-register-addresses.patch b/queue-3.3/mwifiex-update-pcie8766-scratch-register-addresses.patch new file mode 100644 index 00000000000..7b4be28d568 --- /dev/null +++ b/queue-3.3/mwifiex-update-pcie8766-scratch-register-addresses.patch @@ -0,0 +1,48 @@ +From 428ca8a7065354877db63ceabfc493107686eebe Mon Sep 17 00:00:00 2001 +From: Bing Zhao +Date: Thu, 12 Apr 2012 19:00:35 -0700 +Subject: mwifiex: update pcie8766 scratch register addresses + +From: Bing Zhao + +commit 428ca8a7065354877db63ceabfc493107686eebe upstream. + +The scratch register addresses have been changed for newer chips. +Since the old chip was never shipped and it will not be supported +any more, just update register addresses to support the new chips. + +Signed-off-by: Bing Zhao +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/mwifiex/pcie.h | 18 +++++++++--------- + 1 file changed, 9 insertions(+), 9 deletions(-) + +--- a/drivers/net/wireless/mwifiex/pcie.h ++++ b/drivers/net/wireless/mwifiex/pcie.h +@@ -48,15 +48,15 @@ + #define PCIE_HOST_INT_STATUS_MASK 0xC3C + #define PCIE_SCRATCH_2_REG 0xC40 + #define PCIE_SCRATCH_3_REG 0xC44 +-#define PCIE_SCRATCH_4_REG 0xCC0 +-#define PCIE_SCRATCH_5_REG 0xCC4 +-#define PCIE_SCRATCH_6_REG 0xCC8 +-#define PCIE_SCRATCH_7_REG 0xCCC +-#define PCIE_SCRATCH_8_REG 0xCD0 +-#define PCIE_SCRATCH_9_REG 0xCD4 +-#define PCIE_SCRATCH_10_REG 0xCD8 +-#define PCIE_SCRATCH_11_REG 0xCDC +-#define PCIE_SCRATCH_12_REG 0xCE0 ++#define PCIE_SCRATCH_4_REG 0xCD0 ++#define PCIE_SCRATCH_5_REG 0xCD4 ++#define PCIE_SCRATCH_6_REG 0xCD8 ++#define PCIE_SCRATCH_7_REG 0xCDC ++#define PCIE_SCRATCH_8_REG 0xCE0 ++#define PCIE_SCRATCH_9_REG 0xCE4 ++#define PCIE_SCRATCH_10_REG 0xCE8 ++#define PCIE_SCRATCH_11_REG 0xCEC ++#define PCIE_SCRATCH_12_REG 0xCF0 + + #define CPU_INTR_DNLD_RDY BIT(0) + #define CPU_INTR_DOOR_BELL BIT(1) diff --git a/queue-3.3/series b/queue-3.3/series index 19639c9ecc0..8a52da2e5f4 100644 --- a/queue-3.3/series +++ b/queue-3.3/series @@ -12,3 +12,19 @@ mmc-fixes-for-emmc-v4.5-discard-operation.patch mmc-fixes-for-emmc-v4.5-sanitize-operation.patch mmc-sdhci-refine-non-removable-card-checking-for-card-detection.patch mmc-unbreak-sdhci-esdhc-imx-on-i.mx25.patch +xen-gntdev-do-not-set-vm_pfnmap.patch +xen-xenbus-add-quirk-to-deal-with-misconfigured-backends.patch +usb-yurex-remove-allocation-of-coherent-buffer-for-setup-packet-buffer.patch +usb-yurex-fix-missing-urb_no_transfer_dma_map-flag-in-urb.patch +uwb-fix-use-of-del_timer_sync-in-interrupt.patch +uwb-fix-error-handling.patch +davinci_mdio-fix-mdio-timeout-check.patch +mwifiex-update-pcie8766-scratch-register-addresses.patch +brcm80211-smac-resume-transmit-fifo-upon-receiving-frames.patch +mac80211-fix-logic-error-in-ibss-channel-type-check.patch +media-rc-core-set-mode-for-winbond-cir.patch +media-drxk-does-not-unlock-mutex-if-sanity-check-failed-in-scu_command.patch +media-dvb_frontend-fix-a-regression-when-switching-back-to-dvb-s.patch +cfg80211-fix-interface-combinations-check.patch +staging-r8712u-fix-regression-caused-by-commit-8c213fa.patch +fix-modpost-failures-in-fedora-17.patch diff --git a/queue-3.3/staging-r8712u-fix-regression-caused-by-commit-8c213fa.patch b/queue-3.3/staging-r8712u-fix-regression-caused-by-commit-8c213fa.patch new file mode 100644 index 00000000000..747b64a7727 --- /dev/null +++ b/queue-3.3/staging-r8712u-fix-regression-caused-by-commit-8c213fa.patch @@ -0,0 +1,60 @@ +From 2080913e017ab9f88379d93fd09546ad95faf87b Mon Sep 17 00:00:00 2001 +From: Larry Finger +Date: Sat, 25 Feb 2012 18:10:21 -0600 +Subject: staging: r8712u: Fix regression caused by commit 8c213fa + +From: Larry Finger + +commit 2080913e017ab9f88379d93fd09546ad95faf87b upstream. + +In commit 8c213fa "staging: r8712u: Use asynchronous firmware loading", +the command to release the firmware was placed in the wrong routine. + +In combination with the bug introduced in commit a5ee652 "staging: r8712u: +Interface-state not fully tracked", the driver attempts to upload firmware +that had already been released. This bug is the source of one of the +problems in https://bugs.archlinux.org/task/27996#comment89833. + +Tested-by: Alberto Lago Ballesteros +Tested-by: Adrian +Signed-off-by: Larry Finger +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/rtl8712/os_intfs.c | 3 --- + drivers/staging/rtl8712/usb_intf.c | 5 +++++ + 2 files changed, 5 insertions(+), 3 deletions(-) + +--- a/drivers/staging/rtl8712/os_intfs.c ++++ b/drivers/staging/rtl8712/os_intfs.c +@@ -476,9 +476,6 @@ static int netdev_close(struct net_devic + r8712_free_assoc_resources(padapter); + /*s2-4.*/ + r8712_free_network_queue(padapter); +- release_firmware(padapter->fw); +- /* never exit with a firmware callback pending */ +- wait_for_completion(&padapter->rtl8712_fw_ready); + return 0; + } + +--- a/drivers/staging/rtl8712/usb_intf.c ++++ b/drivers/staging/rtl8712/usb_intf.c +@@ -30,6 +30,7 @@ + + #include + #include ++#include + + #include "osdep_service.h" + #include "drv_types.h" +@@ -621,6 +622,10 @@ static void r871xu_dev_remove(struct usb + struct _adapter *padapter = netdev_priv(pnetdev); + struct usb_device *udev = interface_to_usbdev(pusb_intf); + ++ if (padapter->fw_found) ++ release_firmware(padapter->fw); ++ /* never exit with a firmware callback pending */ ++ wait_for_completion(&padapter->rtl8712_fw_ready); + usb_set_intfdata(pusb_intf, NULL); + if (padapter) { + if (drvpriv.drv_registered == true) diff --git a/queue-3.3/usb-yurex-fix-missing-urb_no_transfer_dma_map-flag-in-urb.patch b/queue-3.3/usb-yurex-fix-missing-urb_no_transfer_dma_map-flag-in-urb.patch new file mode 100644 index 00000000000..de968dc42d3 --- /dev/null +++ b/queue-3.3/usb-yurex-fix-missing-urb_no_transfer_dma_map-flag-in-urb.patch @@ -0,0 +1,31 @@ +From 532f17b5d59bf0deb6f1ff9bc1fb27d5b5011c09 Mon Sep 17 00:00:00 2001 +From: Tomoki Sekiyama +Date: Fri, 30 Mar 2012 08:51:36 +0900 +Subject: USB: yurex: Fix missing URB_NO_TRANSFER_DMA_MAP flag in urb + +From: Tomoki Sekiyama + +commit 532f17b5d59bf0deb6f1ff9bc1fb27d5b5011c09 upstream. + +Current probing code is setting URB_NO_TRANSFER_DMA_MAP flag into a wrong urb +structure, and this causes BUG_ON with some USB host implementations. +This patch fixes the issue. + +Signed-off-by: Tomoki Sekiyama +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/misc/yurex.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/misc/yurex.c ++++ b/drivers/usb/misc/yurex.c +@@ -282,7 +282,7 @@ static int yurex_probe(struct usb_interf + usb_rcvintpipe(dev->udev, dev->int_in_endpointAddr), + dev->int_buffer, YUREX_BUF_SIZE, yurex_interrupt, + dev, 1); +- dev->cntl_urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP; ++ dev->urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP; + if (usb_submit_urb(dev->urb, GFP_KERNEL)) { + retval = -EIO; + err("Could not submitting URB"); diff --git a/queue-3.3/usb-yurex-remove-allocation-of-coherent-buffer-for-setup-packet-buffer.patch b/queue-3.3/usb-yurex-remove-allocation-of-coherent-buffer-for-setup-packet-buffer.patch new file mode 100644 index 00000000000..690412ea4e5 --- /dev/null +++ b/queue-3.3/usb-yurex-remove-allocation-of-coherent-buffer-for-setup-packet-buffer.patch @@ -0,0 +1,44 @@ +From 523fc5c14f6cad283e5a266eba0e343aed6e73d5 Mon Sep 17 00:00:00 2001 +From: Tomoki Sekiyama +Date: Fri, 30 Mar 2012 08:51:28 +0900 +Subject: USB: yurex: Remove allocation of coherent buffer for setup-packet buffer + +From: Tomoki Sekiyama + +commit 523fc5c14f6cad283e5a266eba0e343aed6e73d5 upstream. + +Removes allocation of coherent buffer for the control-request setup-packet +buffer from the yurex driver. Using coherent buffers for setup-packet is +obsolete and does not work with some USB host implementations. + +Signed-off-by: Tomoki Sekiyama +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/misc/yurex.c | 8 ++------ + 1 file changed, 2 insertions(+), 6 deletions(-) + +--- a/drivers/usb/misc/yurex.c ++++ b/drivers/usb/misc/yurex.c +@@ -99,9 +99,7 @@ static void yurex_delete(struct kref *kr + usb_put_dev(dev->udev); + if (dev->cntl_urb) { + usb_kill_urb(dev->cntl_urb); +- if (dev->cntl_req) +- usb_free_coherent(dev->udev, YUREX_BUF_SIZE, +- dev->cntl_req, dev->cntl_urb->setup_dma); ++ kfree(dev->cntl_req); + if (dev->cntl_buffer) + usb_free_coherent(dev->udev, YUREX_BUF_SIZE, + dev->cntl_buffer, dev->cntl_urb->transfer_dma); +@@ -234,9 +232,7 @@ static int yurex_probe(struct usb_interf + } + + /* allocate buffer for control req */ +- dev->cntl_req = usb_alloc_coherent(dev->udev, YUREX_BUF_SIZE, +- GFP_KERNEL, +- &dev->cntl_urb->setup_dma); ++ dev->cntl_req = kmalloc(YUREX_BUF_SIZE, GFP_KERNEL); + if (!dev->cntl_req) { + err("Could not allocate cntl_req"); + goto error; diff --git a/queue-3.3/uwb-fix-error-handling.patch b/queue-3.3/uwb-fix-error-handling.patch new file mode 100644 index 00000000000..0de2e8b6340 --- /dev/null +++ b/queue-3.3/uwb-fix-error-handling.patch @@ -0,0 +1,31 @@ +From 5bd7b419ef2eb4989b207753e088c3437159618a Mon Sep 17 00:00:00 2001 +From: Oliver Neukum +Date: Wed, 18 Apr 2012 10:05:55 +0200 +Subject: uwb: fix error handling + +From: Oliver Neukum + +commit 5bd7b419ef2eb4989b207753e088c3437159618a upstream. + +Fatal errors such as a device disconnect must not trigger +error handling. The error returns must be checked. + +Signed-off-by: Oliver Neukum +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/uwb/hwa-rc.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/uwb/hwa-rc.c ++++ b/drivers/uwb/hwa-rc.c +@@ -645,7 +645,8 @@ void hwarc_neep_cb(struct urb *urb) + dev_err(dev, "NEEP: URB error %d\n", urb->status); + } + result = usb_submit_urb(urb, GFP_ATOMIC); +- if (result < 0) { ++ if (result < 0 && result != -ENODEV && result != -EPERM) { ++ /* ignoring unrecoverable errors */ + dev_err(dev, "NEEP: Can't resubmit URB (%d) resetting device\n", + result); + goto error; diff --git a/queue-3.3/uwb-fix-use-of-del_timer_sync-in-interrupt.patch b/queue-3.3/uwb-fix-use-of-del_timer_sync-in-interrupt.patch new file mode 100644 index 00000000000..6133e18ad74 --- /dev/null +++ b/queue-3.3/uwb-fix-use-of-del_timer_sync-in-interrupt.patch @@ -0,0 +1,61 @@ +From 9426cd05682745d1024dbabdec5631309bd2f480 Mon Sep 17 00:00:00 2001 +From: Oliver Neukum +Date: Mon, 16 Apr 2012 15:28:28 +0200 +Subject: uwb: fix use of del_timer_sync() in interrupt + +From: Oliver Neukum + +commit 9426cd05682745d1024dbabdec5631309bd2f480 upstream. + +del_timer_sync() cannot be used in interrupt. +Replace it with del_timer() and a flag + +Signed-off-by: Oliver Neukum +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/uwb/neh.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +--- a/drivers/uwb/neh.c ++++ b/drivers/uwb/neh.c +@@ -107,6 +107,7 @@ struct uwb_rc_neh { + u8 evt_type; + __le16 evt; + u8 context; ++ u8 completed; + uwb_rc_cmd_cb_f cb; + void *arg; + +@@ -409,6 +410,7 @@ static void uwb_rc_neh_grok_event(struct + struct device *dev = &rc->uwb_dev.dev; + struct uwb_rc_neh *neh; + struct uwb_rceb *notif; ++ unsigned long flags; + + if (rceb->bEventContext == 0) { + notif = kmalloc(size, GFP_ATOMIC); +@@ -422,7 +424,11 @@ static void uwb_rc_neh_grok_event(struct + } else { + neh = uwb_rc_neh_lookup(rc, rceb); + if (neh) { +- del_timer_sync(&neh->timer); ++ spin_lock_irqsave(&rc->neh_lock, flags); ++ /* to guard against a timeout */ ++ neh->completed = 1; ++ del_timer(&neh->timer); ++ spin_unlock_irqrestore(&rc->neh_lock, flags); + uwb_rc_neh_cb(neh, rceb, size); + } else + dev_warn(dev, "event 0x%02x/%04x/%02x (%zu bytes): nobody cared\n", +@@ -568,6 +574,10 @@ static void uwb_rc_neh_timer(unsigned lo + unsigned long flags; + + spin_lock_irqsave(&rc->neh_lock, flags); ++ if (neh->completed) { ++ spin_unlock_irqrestore(&rc->neh_lock, flags); ++ return; ++ } + if (neh->context) + __uwb_rc_neh_rm(rc, neh); + else diff --git a/queue-3.3/xen-gntdev-do-not-set-vm_pfnmap.patch b/queue-3.3/xen-gntdev-do-not-set-vm_pfnmap.patch new file mode 100644 index 00000000000..aa868089e95 --- /dev/null +++ b/queue-3.3/xen-gntdev-do-not-set-vm_pfnmap.patch @@ -0,0 +1,35 @@ +From e8e937be971d706061dc56220ff3605ab77622a7 Mon Sep 17 00:00:00 2001 +From: Stefano Stabellini +Date: Tue, 3 Apr 2012 18:05:47 +0100 +Subject: xen/gntdev: do not set VM_PFNMAP + +From: Stefano Stabellini + +commit e8e937be971d706061dc56220ff3605ab77622a7 upstream. + +Since we are using the m2p_override we do have struct pages +corresponding to the user vma mmap'ed by gntdev. + +Removing the VM_PFNMAP flag makes get_user_pages work on that vma. +An example test case would be using a Xen userspace block backend +(QDISK) on a file on NFS using O_DIRECT. + +Signed-off-by: Stefano Stabellini +Signed-off-by: Konrad Rzeszutek Wilk +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/xen/gntdev.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/xen/gntdev.c ++++ b/drivers/xen/gntdev.c +@@ -722,7 +722,7 @@ static int gntdev_mmap(struct file *flip + vma->vm_flags |= VM_RESERVED|VM_DONTEXPAND; + + if (use_ptemod) +- vma->vm_flags |= VM_DONTCOPY|VM_PFNMAP; ++ vma->vm_flags |= VM_DONTCOPY; + + vma->vm_private_data = map; + diff --git a/queue-3.3/xen-xenbus-add-quirk-to-deal-with-misconfigured-backends.patch b/queue-3.3/xen-xenbus-add-quirk-to-deal-with-misconfigured-backends.patch new file mode 100644 index 00000000000..c8b5a2d3b19 --- /dev/null +++ b/queue-3.3/xen-xenbus-add-quirk-to-deal-with-misconfigured-backends.patch @@ -0,0 +1,148 @@ +From 3066616ce23aad5719c23a0f21f32676402cb44b Mon Sep 17 00:00:00 2001 +From: Konrad Rzeszutek Wilk +Date: Tue, 17 Apr 2012 22:21:38 -0400 +Subject: xen/xenbus: Add quirk to deal with misconfigured backends. + +From: Konrad Rzeszutek Wilk + +commit 3066616ce23aad5719c23a0f21f32676402cb44b upstream. + +A rather annoying and common case is when booting a PVonHVM guest +and exposing the PV KBD and PV VFB - as broken toolstacks don't +always initialize the backends correctly. + +Normally The HVM guest is using the VGA driver and the emulated +keyboard for this (though upstream version of QEMU implements +PV KBD, but still uses a VGA driver). We provide a very basic +two-stage wait mechanism - where we wait for 30 seconds for all +devices, and then for 270 for all them except the two mentioned. + +That allows us to wait for the essential devices, like network +or disk for the full 6 minutes. + +To trigger this, put this in your guest config: + +vfb = [ 'vnc=1, vnclisten=0.0.0.0 ,vncunused=1'] + +instead of this: +vnc=1 +vnclisten="0.0.0.0" + +Acked-by: Stefano Stabellini +[v3: Split delay in non-essential (30 seconds) and essential + devices per Ian and Stefano suggestion] +[v4: Added comments per Stefano suggestion] +Signed-off-by: Konrad Rzeszutek Wilk +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/xen/xenbus/xenbus_probe_frontend.c | 69 ++++++++++++++++++++++------- + 1 file changed, 53 insertions(+), 16 deletions(-) + +--- a/drivers/xen/xenbus/xenbus_probe_frontend.c ++++ b/drivers/xen/xenbus/xenbus_probe_frontend.c +@@ -129,7 +129,7 @@ static int read_backend_details(struct x + return xenbus_read_otherend_details(xendev, "backend-id", "backend"); + } + +-static int is_device_connecting(struct device *dev, void *data) ++static int is_device_connecting(struct device *dev, void *data, bool ignore_nonessential) + { + struct xenbus_device *xendev = to_xenbus_device(dev); + struct device_driver *drv = data; +@@ -146,16 +146,41 @@ static int is_device_connecting(struct d + if (drv && (dev->driver != drv)) + return 0; + ++ if (ignore_nonessential) { ++ /* With older QEMU, for PVonHVM guests the guest config files ++ * could contain: vfb = [ 'vnc=1, vnclisten=0.0.0.0'] ++ * which is nonsensical as there is no PV FB (there can be ++ * a PVKB) running as HVM guest. */ ++ ++ if ((strncmp(xendev->nodename, "device/vkbd", 11) == 0)) ++ return 0; ++ ++ if ((strncmp(xendev->nodename, "device/vfb", 10) == 0)) ++ return 0; ++ } + xendrv = to_xenbus_driver(dev->driver); + return (xendev->state < XenbusStateConnected || + (xendev->state == XenbusStateConnected && + xendrv->is_ready && !xendrv->is_ready(xendev))); + } ++static int essential_device_connecting(struct device *dev, void *data) ++{ ++ return is_device_connecting(dev, data, true /* ignore PV[KBB+FB] */); ++} ++static int non_essential_device_connecting(struct device *dev, void *data) ++{ ++ return is_device_connecting(dev, data, false); ++} + +-static int exists_connecting_device(struct device_driver *drv) ++static int exists_essential_connecting_device(struct device_driver *drv) + { + return bus_for_each_dev(&xenbus_frontend.bus, NULL, drv, +- is_device_connecting); ++ essential_device_connecting); ++} ++static int exists_non_essential_connecting_device(struct device_driver *drv) ++{ ++ return bus_for_each_dev(&xenbus_frontend.bus, NULL, drv, ++ non_essential_device_connecting); + } + + static int print_device_status(struct device *dev, void *data) +@@ -186,6 +211,23 @@ static int print_device_status(struct de + /* We only wait for device setup after most initcalls have run. */ + static int ready_to_wait_for_devices; + ++static bool wait_loop(unsigned long start, unsigned int max_delay, ++ unsigned int *seconds_waited) ++{ ++ if (time_after(jiffies, start + (*seconds_waited+5)*HZ)) { ++ if (!*seconds_waited) ++ printk(KERN_WARNING "XENBUS: Waiting for " ++ "devices to initialise: "); ++ *seconds_waited += 5; ++ printk("%us...", max_delay - *seconds_waited); ++ if (*seconds_waited == max_delay) ++ return true; ++ } ++ ++ schedule_timeout_interruptible(HZ/10); ++ ++ return false; ++} + /* + * On a 5-minute timeout, wait for all devices currently configured. We need + * to do this to guarantee that the filesystems and / or network devices +@@ -209,19 +251,14 @@ static void wait_for_devices(struct xenb + if (!ready_to_wait_for_devices || !xen_domain()) + return; + +- while (exists_connecting_device(drv)) { +- if (time_after(jiffies, start + (seconds_waited+5)*HZ)) { +- if (!seconds_waited) +- printk(KERN_WARNING "XENBUS: Waiting for " +- "devices to initialise: "); +- seconds_waited += 5; +- printk("%us...", 300 - seconds_waited); +- if (seconds_waited == 300) +- break; +- } +- +- schedule_timeout_interruptible(HZ/10); +- } ++ while (exists_non_essential_connecting_device(drv)) ++ if (wait_loop(start, 30, &seconds_waited)) ++ break; ++ ++ /* Skips PVKB and PVFB check.*/ ++ while (exists_essential_connecting_device(drv)) ++ if (wait_loop(start, 270, &seconds_waited)) ++ break; + + if (seconds_waited) + printk("\n"); -- 2.47.3