From 5526d79d6e7559ec5d5548e9143f65ed4e6f8617 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Tue, 13 Apr 2010 14:03:17 -0700 Subject: [PATCH] .33 patches --- .../arm-6031-1-fix-thumb-2-decompressor.patch | 33 +++++++ ...fix-double-calls-to-ath_radio_enable.patch | 32 +++++++ ...el-bug-with-remote-os-2-server-try-3.patch | 67 ++++++++++++++ ...tes-at-the-beginning-of-cifssmbwrite.patch | 42 +++++++++ .../drm-edid-quirks-envision-en2028.patch | 32 +++++++ ...bios-verify-dac_adj-values-are-valid.patch | 79 ++++++++++++++++ ...ix-washed-out-image-on-legacy-tv-dac.patch | 31 +++++++ ...adeon-r300-ad-only-has-one-quad-pipe.patch | 79 ++++++++++++++++ ...eck-for-valid-qos-packet-before-free.patch | 54 +++++++++++ ...tion-frames-in-ieee80211_rx_h_action.patch | 52 +++++++++++ .../s390-disable-change-bit-override.patch | 55 ++++++++++++ queue-2.6.33/series | 15 ++++ ...e-do-a-global-tlb-flush-in-s4-resume.patch | 71 +++++++++++++++ ...pic-call-on-smp-kernel-on-smp-boards.patch | 52 +++++++++++ .../x86-handle-overlapping-mptables.patch | 51 +++++++++++ ...-read-after-write-of-hpet-comparator.patch | 89 +++++++++++++++++++ 16 files changed, 834 insertions(+) create mode 100644 queue-2.6.33/arm-6031-1-fix-thumb-2-decompressor.patch create mode 100644 queue-2.6.33/ath9k-fix-double-calls-to-ath_radio_enable.patch create mode 100644 queue-2.6.33/cifs-fix-a-kernel-bug-with-remote-os-2-server-try-3.patch create mode 100644 queue-2.6.33/cifs-initialize-nbytes-at-the-beginning-of-cifssmbwrite.patch create mode 100644 queue-2.6.33/drm-edid-quirks-envision-en2028.patch create mode 100644 queue-2.6.33/drm-radeon-kms-combios-verify-dac_adj-values-are-valid.patch create mode 100644 queue-2.6.33/drm-radeon-kms-fix-washed-out-image-on-legacy-tv-dac.patch create mode 100644 queue-2.6.33/drm-radeon-r300-ad-only-has-one-quad-pipe.patch create mode 100644 queue-2.6.33/iwlwifi-need-check-for-valid-qos-packet-before-free.patch create mode 100644 queue-2.6.33/mac80211-handle-mesh-action-frames-in-ieee80211_rx_h_action.patch create mode 100644 queue-2.6.33/s390-disable-change-bit-override.patch create mode 100644 queue-2.6.33/x86-32-resume-do-a-global-tlb-flush-in-s4-resume.patch create mode 100644 queue-2.6.33/x86-fix-double-enable_ir_x2apic-call-on-smp-kernel-on-smp-boards.patch create mode 100644 queue-2.6.33/x86-handle-overlapping-mptables.patch create mode 100644 queue-2.6.33/x86-hpet-erratum-workaround-for-read-after-write-of-hpet-comparator.patch diff --git a/queue-2.6.33/arm-6031-1-fix-thumb-2-decompressor.patch b/queue-2.6.33/arm-6031-1-fix-thumb-2-decompressor.patch new file mode 100644 index 00000000000..11dbca16427 --- /dev/null +++ b/queue-2.6.33/arm-6031-1-fix-thumb-2-decompressor.patch @@ -0,0 +1,33 @@ +From d4d9959c099751158c5cf14813fe378e206339c6 Mon Sep 17 00:00:00 2001 +From: Rabin Vincent +Date: Wed, 7 Apr 2010 18:10:20 +0100 +Subject: ARM: 6031/1: fix Thumb-2 decompressor + +From: Rabin Vincent + +commit d4d9959c099751158c5cf14813fe378e206339c6 upstream. + +98e12b5a6e05413 ("ARM: Fix decompressor's kernel size estimation for +ROM=y") broke the Thumb-2 decompressor because it added an entry in the +LC0 table but didn't adjust the offset the Thumb-2 code uses to load the +SP from that table. Fix it. + +Signed-off-by: Rabin Vincent +Signed-off-by: Russell King +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/boot/compressed/head.S | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/arm/boot/compressed/head.S ++++ b/arch/arm/boot/compressed/head.S +@@ -172,7 +172,7 @@ not_angel: + adr r0, LC0 + ARM( ldmia r0, {r1, r2, r3, r4, r5, r6, r11, ip, sp}) + THUMB( ldmia r0, {r1, r2, r3, r4, r5, r6, r11, ip} ) +- THUMB( ldr sp, [r0, #28] ) ++ THUMB( ldr sp, [r0, #32] ) + subs r0, r0, r1 @ calculate the delta offset + + @ if delta is zero, we are diff --git a/queue-2.6.33/ath9k-fix-double-calls-to-ath_radio_enable.patch b/queue-2.6.33/ath9k-fix-double-calls-to-ath_radio_enable.patch new file mode 100644 index 00000000000..91144a65244 --- /dev/null +++ b/queue-2.6.33/ath9k-fix-double-calls-to-ath_radio_enable.patch @@ -0,0 +1,32 @@ +From 1144601118507f8b3b676a9a392584d216d3f2cc Mon Sep 17 00:00:00 2001 +From: Felix Fietkau +Date: Tue, 6 Apr 2010 12:05:01 -0700 +Subject: ath9k: fix double calls to ath_radio_enable + +From: Felix Fietkau + +commit 1144601118507f8b3b676a9a392584d216d3f2cc upstream. + +With the enable_radio being uninitialized, ath_radio_enable() might be +called twice, which can leave some hardware in an undefined state. + +Signed-off-by: Felix Fietkau +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/ath/ath9k/main.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/drivers/net/wireless/ath/ath9k/main.c ++++ b/drivers/net/wireless/ath/ath9k/main.c +@@ -2721,8 +2721,7 @@ static int ath9k_config(struct ieee80211 + all_wiphys_idle = ath9k_all_wiphys_idle(sc); + ath9k_set_wiphy_idle(aphy, idle); + +- if (!idle && all_wiphys_idle) +- enable_radio = true; ++ enable_radio = (!idle && all_wiphys_idle); + + /* + * After we unlock here its possible another wiphy diff --git a/queue-2.6.33/cifs-fix-a-kernel-bug-with-remote-os-2-server-try-3.patch b/queue-2.6.33/cifs-fix-a-kernel-bug-with-remote-os-2-server-try-3.patch new file mode 100644 index 00000000000..0c27d1ea6fc --- /dev/null +++ b/queue-2.6.33/cifs-fix-a-kernel-bug-with-remote-os-2-server-try-3.patch @@ -0,0 +1,67 @@ +From 6513a81e9325d712f1bfb9a1d7b750134e49ff18 Mon Sep 17 00:00:00 2001 +From: Suresh Jayaraman +Date: Wed, 31 Mar 2010 12:00:03 +0530 +Subject: cifs: Fix a kernel BUG with remote OS/2 server (try #3) + +From: Suresh Jayaraman + +commit 6513a81e9325d712f1bfb9a1d7b750134e49ff18 upstream. + +While chasing a bug report involving a OS/2 server, I noticed the server sets +pSMBr->CountHigh to a incorrect value even in case of normal writes. This +results in 'nbytes' being computed wrongly and triggers a kernel BUG at +mm/filemap.c. + +void iov_iter_advance(struct iov_iter *i, size_t bytes) +{ + BUG_ON(i->count < bytes); <--- BUG here + +Why the server is setting 'CountHigh' is not clear but only does so after +writing 64k bytes. Though this looks like the server bug, the client side +crash may not be acceptable. + +The workaround is to mask off high 16 bits if the number of bytes written as +returned by the server is greater than the bytes requested by the client as +suggested by Jeff Layton. + +Reviewed-by: Jeff Layton +Signed-off-by: Suresh Jayaraman +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman + +--- + fs/cifs/cifssmb.c | 16 ++++++++++++++++ + 1 file changed, 16 insertions(+) + +--- a/fs/cifs/cifssmb.c ++++ b/fs/cifs/cifssmb.c +@@ -1517,6 +1517,14 @@ CIFSSMBWrite(const int xid, struct cifsT + *nbytes = le16_to_cpu(pSMBr->CountHigh); + *nbytes = (*nbytes) << 16; + *nbytes += le16_to_cpu(pSMBr->Count); ++ ++ /* ++ * Mask off high 16 bits when bytes written as returned by the ++ * server is greater than bytes requested by the client. Some ++ * OS/2 servers are known to set incorrect CountHigh values. ++ */ ++ if (*nbytes > count) ++ *nbytes &= 0xFFFF; + } + + cifs_buf_release(pSMB); +@@ -1605,6 +1613,14 @@ CIFSSMBWrite2(const int xid, struct cifs + *nbytes = le16_to_cpu(pSMBr->CountHigh); + *nbytes = (*nbytes) << 16; + *nbytes += le16_to_cpu(pSMBr->Count); ++ ++ /* ++ * Mask off high 16 bits when bytes written as returned by the ++ * server is greater than bytes requested by the client. OS/2 ++ * servers are known to set incorrect CountHigh values. ++ */ ++ if (*nbytes > count) ++ *nbytes &= 0xFFFF; + } + + /* cifs_small_buf_release(pSMB); */ /* Freed earlier now in SendReceive2 */ diff --git a/queue-2.6.33/cifs-initialize-nbytes-at-the-beginning-of-cifssmbwrite.patch b/queue-2.6.33/cifs-initialize-nbytes-at-the-beginning-of-cifssmbwrite.patch new file mode 100644 index 00000000000..d506fe3e39a --- /dev/null +++ b/queue-2.6.33/cifs-initialize-nbytes-at-the-beginning-of-cifssmbwrite.patch @@ -0,0 +1,42 @@ +From a24e2d7d8f512340991ef0a59cb5d08d491b8e98 Mon Sep 17 00:00:00 2001 +From: Steve French +Date: Sat, 3 Apr 2010 17:20:21 +0000 +Subject: CIFS: initialize nbytes at the beginning of CIFSSMBWrite() + +From: Steve French + +commit a24e2d7d8f512340991ef0a59cb5d08d491b8e98 upstream. + +By doing this we always overwrite nbytes value that is being passed on to +CIFSSMBWrite() and need not rely on the callers to initialize. CIFSSMBWrite2 is +doing this already. + +Reviewed-by: Shirish Pargaonkar +Reviewed-by: Jeff Layton +Signed-off-by: Suresh Jayaraman +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman + +--- + fs/cifs/cifssmb.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/fs/cifs/cifssmb.c ++++ b/fs/cifs/cifssmb.c +@@ -1430,6 +1430,8 @@ CIFSSMBWrite(const int xid, struct cifsT + __u32 bytes_sent; + __u16 byte_count; + ++ *nbytes = 0; ++ + /* cFYI(1, ("write at %lld %d bytes", offset, count));*/ + if (tcon->ses == NULL) + return -ECONNABORTED; +@@ -1512,7 +1514,6 @@ CIFSSMBWrite(const int xid, struct cifsT + cifs_stats_inc(&tcon->num_writes); + if (rc) { + cFYI(1, ("Send error in write = %d", rc)); +- *nbytes = 0; + } else { + *nbytes = le16_to_cpu(pSMBr->CountHigh); + *nbytes = (*nbytes) << 16; diff --git a/queue-2.6.33/drm-edid-quirks-envision-en2028.patch b/queue-2.6.33/drm-edid-quirks-envision-en2028.patch new file mode 100644 index 00000000000..dfb2383c734 --- /dev/null +++ b/queue-2.6.33/drm-edid-quirks-envision-en2028.patch @@ -0,0 +1,32 @@ +From ba1163de2f74d624e7b0e530c4104c98ede0045a Mon Sep 17 00:00:00 2001 +From: Adam Jackson +Date: Tue, 6 Apr 2010 16:11:00 +0000 +Subject: drm/edid/quirks: Envision EN2028 + +From: Adam Jackson + +commit ba1163de2f74d624e7b0e530c4104c98ede0045a upstream. + +Claims 1280x1024 preferred, physically 1600x1200 + +cf. http://bugzilla.redhat.com/530399 + +Signed-off-by: Adam Jackson +Signed-off-by: Dave Airlie +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/drm_edid.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/gpu/drm/drm_edid.c ++++ b/drivers/gpu/drm/drm_edid.c +@@ -85,6 +85,8 @@ static struct edid_quirk { + + /* Envision Peripherals, Inc. EN-7100e */ + { "EPI", 59264, EDID_QUIRK_135_CLOCK_TOO_HIGH }, ++ /* Envision EN2028 */ ++ { "EPI", 8232, EDID_QUIRK_PREFER_LARGE_60 }, + + /* Funai Electronics PM36B */ + { "FCM", 13600, EDID_QUIRK_PREFER_LARGE_75 | diff --git a/queue-2.6.33/drm-radeon-kms-combios-verify-dac_adj-values-are-valid.patch b/queue-2.6.33/drm-radeon-kms-combios-verify-dac_adj-values-are-valid.patch new file mode 100644 index 00000000000..4caa9812ad8 --- /dev/null +++ b/queue-2.6.33/drm-radeon-kms-combios-verify-dac_adj-values-are-valid.patch @@ -0,0 +1,79 @@ +From 3a89b4a9ca7ce11e3b7d5119aea917b9fc29a302 Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Tue, 6 Apr 2010 12:35:26 -0400 +Subject: drm/radeon/kms/combios: verify dac_adj values are valid + +From: Alex Deucher + +commit 3a89b4a9ca7ce11e3b7d5119aea917b9fc29a302 upstream. + +Some vbios dac_adj tables are all zeros. Check for that +case and use the default table if so. + +Should fix fdo bug 27478. + +Signed-off-by: Alex Deucher +Signed-off-by: Dave Airlie +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/radeon/radeon_combios.c | 20 +++++++++++++++----- + 1 file changed, 15 insertions(+), 5 deletions(-) + +--- a/drivers/gpu/drm/radeon/radeon_combios.c ++++ b/drivers/gpu/drm/radeon/radeon_combios.c +@@ -670,7 +670,9 @@ struct radeon_encoder_primary_dac *radeo + dac = RBIOS8(dac_info + 0x3) & 0xf; + p_dac->ps2_pdac_adj = (bg << 8) | (dac); + } +- found = 1; ++ /* if the values are all zeros, use the table */ ++ if (p_dac->ps2_pdac_adj) ++ found = 1; + } + + out: +@@ -812,7 +814,9 @@ struct radeon_encoder_tv_dac *radeon_com + bg = RBIOS8(dac_info + 0x10) & 0xf; + dac = RBIOS8(dac_info + 0x11) & 0xf; + tv_dac->ntsc_tvdac_adj = (bg << 16) | (dac << 20); +- found = 1; ++ /* if the values are all zeros, use the table */ ++ if (tv_dac->ps2_tvdac_adj) ++ found = 1; + } else if (rev > 1) { + bg = RBIOS8(dac_info + 0xc) & 0xf; + dac = (RBIOS8(dac_info + 0xc) >> 4) & 0xf; +@@ -825,7 +829,9 @@ struct radeon_encoder_tv_dac *radeon_com + bg = RBIOS8(dac_info + 0xe) & 0xf; + dac = (RBIOS8(dac_info + 0xe) >> 4) & 0xf; + tv_dac->ntsc_tvdac_adj = (bg << 16) | (dac << 20); +- found = 1; ++ /* if the values are all zeros, use the table */ ++ if (tv_dac->ps2_tvdac_adj) ++ found = 1; + } + tv_dac->tv_std = radeon_combios_get_tv_info(rdev); + } +@@ -842,7 +848,9 @@ struct radeon_encoder_tv_dac *radeon_com + (bg << 16) | (dac << 20); + tv_dac->pal_tvdac_adj = tv_dac->ps2_tvdac_adj; + tv_dac->ntsc_tvdac_adj = tv_dac->ps2_tvdac_adj; +- found = 1; ++ /* if the values are all zeros, use the table */ ++ if (tv_dac->ps2_tvdac_adj) ++ found = 1; + } else { + bg = RBIOS8(dac_info + 0x4) & 0xf; + dac = RBIOS8(dac_info + 0x5) & 0xf; +@@ -850,7 +858,9 @@ struct radeon_encoder_tv_dac *radeon_com + (bg << 16) | (dac << 20); + tv_dac->pal_tvdac_adj = tv_dac->ps2_tvdac_adj; + tv_dac->ntsc_tvdac_adj = tv_dac->ps2_tvdac_adj; +- found = 1; ++ /* if the values are all zeros, use the table */ ++ if (tv_dac->ps2_tvdac_adj) ++ found = 1; + } + } else { + DRM_INFO("No TV DAC info found in BIOS\n"); diff --git a/queue-2.6.33/drm-radeon-kms-fix-washed-out-image-on-legacy-tv-dac.patch b/queue-2.6.33/drm-radeon-kms-fix-washed-out-image-on-legacy-tv-dac.patch new file mode 100644 index 00000000000..de1c2f7d1f2 --- /dev/null +++ b/queue-2.6.33/drm-radeon-kms-fix-washed-out-image-on-legacy-tv-dac.patch @@ -0,0 +1,31 @@ +From 643acacf02679befd0f98ac3c5fecb805f1c9548 Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Mon, 5 Apr 2010 23:57:52 -0400 +Subject: drm/radeon/kms: fix washed out image on legacy tv dac + +From: Alex Deucher + +commit 643acacf02679befd0f98ac3c5fecb805f1c9548 upstream. + +bad cast was overwriting the tvdac adj values +Fixes fdo bug 27478 + +Signed-off-by: Alex Deucher +Signed-off-by: Dave Airlie +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/radeon/radeon_connectors.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/radeon/radeon_connectors.c ++++ b/drivers/gpu/drm/radeon/radeon_connectors.c +@@ -315,7 +315,7 @@ int radeon_connector_set_property(struct + radeon_encoder = to_radeon_encoder(encoder); + if (!radeon_encoder->enc_priv) + return 0; +- if (rdev->is_atom_bios) { ++ if (ASIC_IS_AVIVO(rdev) || radeon_r4xx_atom) { + struct radeon_encoder_atom_dac *dac_int; + dac_int = radeon_encoder->enc_priv; + dac_int->tv_std = val; diff --git a/queue-2.6.33/drm-radeon-r300-ad-only-has-one-quad-pipe.patch b/queue-2.6.33/drm-radeon-r300-ad-only-has-one-quad-pipe.patch new file mode 100644 index 00000000000..6069086d97d --- /dev/null +++ b/queue-2.6.33/drm-radeon-r300-ad-only-has-one-quad-pipe.patch @@ -0,0 +1,79 @@ +From 57b54ea6b7863ccfeb41851b5f58f9fd1b83c79e Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Michel=20D=C3=A4nzer?= +Date: Fri, 2 Apr 2010 16:59:06 +0000 +Subject: drm/radeon: R300 AD only has one quad pipe. +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: =?UTF-8?q?Michel=20D=C3=A4nzer?= + +commit 57b54ea6b7863ccfeb41851b5f58f9fd1b83c79e upstream. + +Gleaned from the Mesa code. + +Fixes https://bugs.freedesktop.org/show_bug.cgi?id=27355 . + +Signed-off-by: Michel Dänzer +Signed-off-by: Dave Airlie +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/radeon/r300.c | 5 +++-- + drivers/gpu/drm/radeon/radeon_cp.c | 10 ++++++---- + 2 files changed, 9 insertions(+), 6 deletions(-) + +--- a/drivers/gpu/drm/radeon/r300.c ++++ b/drivers/gpu/drm/radeon/r300.c +@@ -364,11 +364,12 @@ void r300_gpu_init(struct radeon_device + + r100_hdp_reset(rdev); + /* FIXME: rv380 one pipes ? */ +- if ((rdev->family == CHIP_R300) || (rdev->family == CHIP_R350)) { ++ if ((rdev->family == CHIP_R300 && rdev->pdev->device != 0x4144) || ++ (rdev->family == CHIP_R350)) { + /* r300,r350 */ + rdev->num_gb_pipes = 2; + } else { +- /* rv350,rv370,rv380 */ ++ /* rv350,rv370,rv380,r300 AD */ + rdev->num_gb_pipes = 1; + } + rdev->num_z_pipes = 1; +--- a/drivers/gpu/drm/radeon/radeon_cp.c ++++ b/drivers/gpu/drm/radeon/radeon_cp.c +@@ -417,8 +417,9 @@ static int radeon_do_wait_for_idle(drm_r + return -EBUSY; + } + +-static void radeon_init_pipes(drm_radeon_private_t *dev_priv) ++static void radeon_init_pipes(struct drm_device *dev) + { ++ drm_radeon_private_t *dev_priv = dev->dev_private; + uint32_t gb_tile_config, gb_pipe_sel = 0; + + if ((dev_priv->flags & RADEON_FAMILY_MASK) == CHIP_RV530) { +@@ -436,11 +437,12 @@ static void radeon_init_pipes(drm_radeon + dev_priv->num_gb_pipes = ((gb_pipe_sel >> 12) & 0x3) + 1; + } else { + /* R3xx */ +- if (((dev_priv->flags & RADEON_FAMILY_MASK) == CHIP_R300) || ++ if (((dev_priv->flags & RADEON_FAMILY_MASK) == CHIP_R300 && ++ dev->pdev->device != 0x4144) || + ((dev_priv->flags & RADEON_FAMILY_MASK) == CHIP_R350)) { + dev_priv->num_gb_pipes = 2; + } else { +- /* R3Vxx */ ++ /* RV3xx/R300 AD */ + dev_priv->num_gb_pipes = 1; + } + } +@@ -736,7 +738,7 @@ static int radeon_do_engine_reset(struct + + /* setup the raster pipes */ + if ((dev_priv->flags & RADEON_FAMILY_MASK) >= CHIP_R300) +- radeon_init_pipes(dev_priv); ++ radeon_init_pipes(dev); + + /* Reset the CP ring */ + radeon_do_cp_reset(dev_priv); diff --git a/queue-2.6.33/iwlwifi-need-check-for-valid-qos-packet-before-free.patch b/queue-2.6.33/iwlwifi-need-check-for-valid-qos-packet-before-free.patch new file mode 100644 index 00000000000..e8ab5e97c51 --- /dev/null +++ b/queue-2.6.33/iwlwifi-need-check-for-valid-qos-packet-before-free.patch @@ -0,0 +1,54 @@ +From ece6444c2fe80dab679beb5f0d58b091f1933b00 Mon Sep 17 00:00:00 2001 +From: Wey-Yi Guy +Date: Thu, 8 Apr 2010 13:17:37 -0700 +Subject: iwlwifi: need check for valid qos packet before free + +From: Wey-Yi Guy + +commit ece6444c2fe80dab679beb5f0d58b091f1933b00 upstream. + +For 4965, need to check it is valid qos frame before free, only valid +QoS frame has the tid used to free the packets. + +Signed-off-by: Wey-Yi Guy +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/iwlwifi/iwl-4965.c | 13 +++++++++---- + 1 file changed, 9 insertions(+), 4 deletions(-) + +--- a/drivers/net/wireless/iwlwifi/iwl-4965.c ++++ b/drivers/net/wireless/iwlwifi/iwl-4965.c +@@ -2008,7 +2008,9 @@ static void iwl4965_rx_reply_tx(struct i + IWL_DEBUG_TX_REPLY(priv, "Retry scheduler reclaim scd_ssn " + "%d index %d\n", scd_ssn , index); + freed = iwl_tx_queue_reclaim(priv, txq_id, index); +- iwl_free_tfds_in_queue(priv, sta_id, tid, freed); ++ if (qc) ++ iwl_free_tfds_in_queue(priv, sta_id, ++ tid, freed); + + if (priv->mac80211_registered && + (iwl_queue_space(&txq->q) > txq->q.low_mark) && +@@ -2034,14 +2036,17 @@ static void iwl4965_rx_reply_tx(struct i + tx_resp->failure_frame); + + freed = iwl_tx_queue_reclaim(priv, txq_id, index); +- iwl_free_tfds_in_queue(priv, sta_id, tid, freed); ++ if (qc && likely(sta_id != IWL_INVALID_STATION)) ++ iwl_free_tfds_in_queue(priv, sta_id, tid, freed); ++ else if (sta_id == IWL_INVALID_STATION) ++ IWL_DEBUG_TX_REPLY(priv, "Station not known\n"); + + if (priv->mac80211_registered && + (iwl_queue_space(&txq->q) > txq->q.low_mark)) + iwl_wake_queue(priv, txq_id); + } +- +- iwl_txq_check_empty(priv, sta_id, tid, txq_id); ++ if (qc && likely(sta_id != IWL_INVALID_STATION)) ++ iwl_txq_check_empty(priv, sta_id, tid, txq_id); + + if (iwl_check_bits(status, TX_ABORT_REQUIRED_MSK)) + IWL_ERR(priv, "TODO: Implement Tx ABORT REQUIRED!!!\n"); diff --git a/queue-2.6.33/mac80211-handle-mesh-action-frames-in-ieee80211_rx_h_action.patch b/queue-2.6.33/mac80211-handle-mesh-action-frames-in-ieee80211_rx_h_action.patch new file mode 100644 index 00000000000..7997d5ae378 --- /dev/null +++ b/queue-2.6.33/mac80211-handle-mesh-action-frames-in-ieee80211_rx_h_action.patch @@ -0,0 +1,52 @@ +From 1cb561f83793191cf86a2db3948d28f5f42df9ff Mon Sep 17 00:00:00 2001 +From: Javier Cardona +Date: Mon, 29 Mar 2010 11:00:20 -0700 +Subject: mac80211: Handle mesh action frames in ieee80211_rx_h_action + +From: Javier Cardona + +commit 1cb561f83793191cf86a2db3948d28f5f42df9ff upstream. + +This fixes the problem introduced in commit +8404080568613d93ad7cf0a16dfb68 which broke mesh peer link establishment. + +changes: +v2 Added missing break (Johannes) +v3 Broke original patch into two (Johannes) + +Signed-off-by: Javier Cardona +Reviewed-by: Johannes Berg +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + net/mac80211/mesh.c | 3 --- + net/mac80211/rx.c | 5 +++++ + 2 files changed, 5 insertions(+), 3 deletions(-) + +--- a/net/mac80211/mesh.c ++++ b/net/mac80211/mesh.c +@@ -749,9 +749,6 @@ ieee80211_mesh_rx_mgmt(struct ieee80211_ + + switch (fc & IEEE80211_FCTL_STYPE) { + case IEEE80211_STYPE_ACTION: +- if (skb->len < IEEE80211_MIN_ACTION_SIZE) +- return RX_DROP_MONITOR; +- /* fall through */ + case IEEE80211_STYPE_PROBE_RESP: + case IEEE80211_STYPE_BEACON: + skb_queue_tail(&ifmsh->skb_queue, skb); +--- a/net/mac80211/rx.c ++++ b/net/mac80211/rx.c +@@ -2355,6 +2355,11 @@ static int prepare_for_handlers(struct i + /* should never get here */ + WARN_ON(1); + break; ++ case MESH_PLINK_CATEGORY: ++ case MESH_PATH_SEL_CATEGORY: ++ if (ieee80211_vif_is_mesh(&sdata->vif)) ++ return ieee80211_mesh_rx_mgmt(sdata, rx->skb); ++ break; + } + + return 1; diff --git a/queue-2.6.33/s390-disable-change-bit-override.patch b/queue-2.6.33/s390-disable-change-bit-override.patch new file mode 100644 index 00000000000..a723eb495e5 --- /dev/null +++ b/queue-2.6.33/s390-disable-change-bit-override.patch @@ -0,0 +1,55 @@ +From 6af7eea2aee57b869f34eba0a94ef122fe90fbfd Mon Sep 17 00:00:00 2001 +From: Christian Borntraeger +Date: Fri, 9 Apr 2010 13:43:01 +0200 +Subject: [S390] s390: disable change bit override + +From: Christian Borntraeger + +commit 6af7eea2aee57b869f34eba0a94ef122fe90fbfd upstream. + +commit 6a985c6194017de2c062916ad1cd00dee0302c40 +([S390] s390: use change recording override for kernel mapping) +deactivated the change bit recording for the kernel mapping to +improve the performance. This works most of the time, but there +are cases (e.g. kernel runs in home space, futex atomic compare xcmg) +where we modify user memory with the kernel mapping instead of the +user mapping. +Instead of fixing these cases, this patch just deactivates change bit +override to avoid future problems with other kernel code that might +use the kernel mapping for user memory. + +Signed-off-by: Christian Borntraeger +Signed-off-by: Martin Schwidefsky +Signed-off-by: Greg Kroah-Hartman + +--- + arch/s390/mm/vmem.c | 11 +++-------- + 1 file changed, 3 insertions(+), 8 deletions(-) + +--- a/arch/s390/mm/vmem.c ++++ b/arch/s390/mm/vmem.c +@@ -70,12 +70,8 @@ static pte_t __ref *vmem_pte_alloc(void) + pte = alloc_bootmem(PTRS_PER_PTE * sizeof(pte_t)); + if (!pte) + return NULL; +- if (MACHINE_HAS_HPAGE) +- clear_table((unsigned long *) pte, _PAGE_TYPE_EMPTY | _PAGE_CO, +- PTRS_PER_PTE * sizeof(pte_t)); +- else +- clear_table((unsigned long *) pte, _PAGE_TYPE_EMPTY, +- PTRS_PER_PTE * sizeof(pte_t)); ++ clear_table((unsigned long *) pte, _PAGE_TYPE_EMPTY, ++ PTRS_PER_PTE * sizeof(pte_t)); + return pte; + } + +@@ -116,8 +112,7 @@ static int vmem_add_mem(unsigned long st + if (MACHINE_HAS_HPAGE && !(address & ~HPAGE_MASK) && + (address + HPAGE_SIZE <= start + size) && + (address >= HPAGE_SIZE)) { +- pte_val(pte) |= _SEGMENT_ENTRY_LARGE | +- _SEGMENT_ENTRY_CO; ++ pte_val(pte) |= _SEGMENT_ENTRY_LARGE; + pmd_val(*pm_dir) = pte_val(pte); + address += HPAGE_SIZE - PAGE_SIZE; + continue; diff --git a/queue-2.6.33/series b/queue-2.6.33/series index b301cd178cd..2855d6b002b 100644 --- a/queue-2.6.33/series +++ b/queue-2.6.33/series @@ -38,3 +38,18 @@ alsa-hda-add-msi-blacklist-for-aopen-mz915-m.patch backlight-mbp_nvidia_bl-add-five-more-macbook-variants.patch pata_via-add-via-vx900-support.patch libata-disable-ncq-on-crucial-c300-ssd.patch +s390-disable-change-bit-override.patch +cifs-fix-a-kernel-bug-with-remote-os-2-server-try-3.patch +cifs-initialize-nbytes-at-the-beginning-of-cifssmbwrite.patch +ath9k-fix-double-calls-to-ath_radio_enable.patch +iwlwifi-need-check-for-valid-qos-packet-before-free.patch +mac80211-handle-mesh-action-frames-in-ieee80211_rx_h_action.patch +arm-6031-1-fix-thumb-2-decompressor.patch +drm-edid-quirks-envision-en2028.patch +drm-radeon-r300-ad-only-has-one-quad-pipe.patch +drm-radeon-kms-fix-washed-out-image-on-legacy-tv-dac.patch +drm-radeon-kms-combios-verify-dac_adj-values-are-valid.patch +x86-32-resume-do-a-global-tlb-flush-in-s4-resume.patch +x86-handle-overlapping-mptables.patch +x86-hpet-erratum-workaround-for-read-after-write-of-hpet-comparator.patch +x86-fix-double-enable_ir_x2apic-call-on-smp-kernel-on-smp-boards.patch diff --git a/queue-2.6.33/x86-32-resume-do-a-global-tlb-flush-in-s4-resume.patch b/queue-2.6.33/x86-32-resume-do-a-global-tlb-flush-in-s4-resume.patch new file mode 100644 index 00000000000..d7dcd66ab23 --- /dev/null +++ b/queue-2.6.33/x86-32-resume-do-a-global-tlb-flush-in-s4-resume.patch @@ -0,0 +1,71 @@ +From 8ae06d223f8203c72104e5c0c4ee49a000aedb42 Mon Sep 17 00:00:00 2001 +From: Shaohua Li +Date: Fri, 5 Mar 2010 08:59:32 +0800 +Subject: x86-32, resume: do a global tlb flush in S4 resume + +From: Shaohua Li + +commit 8ae06d223f8203c72104e5c0c4ee49a000aedb42 upstream. + +Colin King reported a strange oops in S4 resume code path (see below). The test +system has i5/i7 CPU. The kernel doesn't open PAE, so 4M page table is used. +The oops always happen a virtual address 0xc03ff000, which is mapped to the +last 4k of first 4M memory. Doing a global tlb flush fixes the issue. + +EIP: 0060:[] EFLAGS: 00010086 CPU: 0 +EIP is at copy_loop+0xe/0x15 +EAX: 36aeb000 EBX: 00000000 ECX: 00000400 EDX: f55ad46c +ESI: 0f800000 EDI: c03ff000 EBP: f67fbec4 ESP: f67fbea8 +DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068 +... +... +CR2: 00000000c03ff000 + +Tested-by: Colin Ian King +Signed-off-by: Shaohua Li +LKML-Reference: <20100305005932.GA22675@sli10-desk.sh.intel.com> +Acked-by: Rafael J. Wysocki +Signed-off-by: H. Peter Anvin +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/power/hibernate_asm_32.S | 15 +++++++-------- + 1 file changed, 7 insertions(+), 8 deletions(-) + +--- a/arch/x86/power/hibernate_asm_32.S ++++ b/arch/x86/power/hibernate_asm_32.S +@@ -27,10 +27,17 @@ ENTRY(swsusp_arch_suspend) + ret + + ENTRY(restore_image) ++ movl mmu_cr4_features, %ecx + movl resume_pg_dir, %eax + subl $__PAGE_OFFSET, %eax + movl %eax, %cr3 + ++ jecxz 1f # cr4 Pentium and higher, skip if zero ++ andl $~(X86_CR4_PGE), %ecx ++ movl %ecx, %cr4; # turn off PGE ++ movl %cr3, %eax; # flush TLB ++ movl %eax, %cr3 ++1: + movl restore_pblist, %edx + .p2align 4,,7 + +@@ -54,16 +61,8 @@ done: + movl $swapper_pg_dir, %eax + subl $__PAGE_OFFSET, %eax + movl %eax, %cr3 +- /* Flush TLB, including "global" things (vmalloc) */ + movl mmu_cr4_features, %ecx + jecxz 1f # cr4 Pentium and higher, skip if zero +- movl %ecx, %edx +- andl $~(X86_CR4_PGE), %edx +- movl %edx, %cr4; # turn off PGE +-1: +- movl %cr3, %eax; # flush TLB +- movl %eax, %cr3 +- jecxz 1f # cr4 Pentium and higher, skip if zero + movl %ecx, %cr4; # turn PGE back on + 1: + diff --git a/queue-2.6.33/x86-fix-double-enable_ir_x2apic-call-on-smp-kernel-on-smp-boards.patch b/queue-2.6.33/x86-fix-double-enable_ir_x2apic-call-on-smp-kernel-on-smp-boards.patch new file mode 100644 index 00000000000..effd92a1547 --- /dev/null +++ b/queue-2.6.33/x86-fix-double-enable_ir_x2apic-call-on-smp-kernel-on-smp-boards.patch @@ -0,0 +1,52 @@ +From 472a474c6630efd195d3738339fd1bdc8aa3b1aa Mon Sep 17 00:00:00 2001 +From: Suresh Siddha +Date: Wed, 31 Mar 2010 18:04:47 -0700 +Subject: x86: Fix double enable_IR_x2apic() call on SMP kernel on !SMP boards + +From: Suresh Siddha + +commit 472a474c6630efd195d3738339fd1bdc8aa3b1aa upstream. + +Jan Grossmann reported kernel boot panic while booting SMP +kernel on his system with a single core cpu. SMP kernels call +enable_IR_x2apic() from native_smp_prepare_cpus() and on +platforms where the kernel doesn't find SMP configuration we +ended up again calling enable_IR_x2apic() from the +APIC_init_uniprocessor() call in the smp_sanity_check(). Thus +leading to kernel panic. + +Don't call enable_IR_x2apic() and default_setup_apic_routing() +from APIC_init_uniprocessor() in CONFIG_SMP case. + +NOTE: this kind of non-idempotent and assymetric initialization +sequence is rather fragile and unclean, we'll clean that up +in v2.6.35. This is the minimal fix for v2.6.34. + +Reported-by: Jan.Grossmann@kielnet.net +Signed-off-by: Suresh Siddha +Cc: +Cc: +Cc: +Cc: +Cc: +LKML-Reference: <1270083887.7835.78.camel@sbs-t61.sc.intel.com> +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/apic/apic.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/arch/x86/kernel/apic/apic.c ++++ b/arch/x86/kernel/apic/apic.c +@@ -1640,8 +1640,10 @@ int __init APIC_init_uniprocessor(void) + } + #endif + ++#ifndef CONFIG_SMP + enable_IR_x2apic(); + default_setup_apic_routing(); ++#endif + + verify_local_APIC(); + connect_bsp_APIC(); diff --git a/queue-2.6.33/x86-handle-overlapping-mptables.patch b/queue-2.6.33/x86-handle-overlapping-mptables.patch new file mode 100644 index 00000000000..98f48633c04 --- /dev/null +++ b/queue-2.6.33/x86-handle-overlapping-mptables.patch @@ -0,0 +1,51 @@ +From 909fc87b32b3b9e3f0b87dcc5d98319c41900c58 Mon Sep 17 00:00:00 2001 +From: Andi Kleen +Date: Mon, 29 Mar 2010 09:41:11 +0200 +Subject: x86: Handle overlapping mptables + +From: Andi Kleen + +commit 909fc87b32b3b9e3f0b87dcc5d98319c41900c58 upstream. + +We found a system where the MP table MPC and MPF structures overlap. + +That doesn't really matter because the mptable is not used anyways with ACPI, +but it leads to a panic in the early allocator due to the overlapping +reservations in 2.6.33. + +Earlier kernels handled this without problems. + +Simply change these reservations to reserve_early_overlap_ok to avoid +the panic. + +Reported-by: Thomas Renninger +Tested-by: Thomas Renninger +Signed-off-by: Andi Kleen +LKML-Reference: <20100329074111.GA22821@basil.fritz.box> +Signed-off-by: H. Peter Anvin +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/mpparse.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/x86/kernel/mpparse.c ++++ b/arch/x86/kernel/mpparse.c +@@ -664,7 +664,7 @@ static void __init smp_reserve_memory(st + { + unsigned long size = get_mpc_size(mpf->physptr); + +- reserve_early(mpf->physptr, mpf->physptr+size, "MP-table mpc"); ++ reserve_early_overlap_ok(mpf->physptr, mpf->physptr+size, "MP-table mpc"); + } + + static int __init smp_scan_config(unsigned long base, unsigned long length) +@@ -693,7 +693,7 @@ static int __init smp_scan_config(unsign + mpf, (u64)virt_to_phys(mpf)); + + mem = virt_to_phys(mpf); +- reserve_early(mem, mem + sizeof(*mpf), "MP-table mpf"); ++ reserve_early_overlap_ok(mem, mem + sizeof(*mpf), "MP-table mpf"); + if (mpf->physptr) + smp_reserve_memory(mpf); + diff --git a/queue-2.6.33/x86-hpet-erratum-workaround-for-read-after-write-of-hpet-comparator.patch b/queue-2.6.33/x86-hpet-erratum-workaround-for-read-after-write-of-hpet-comparator.patch new file mode 100644 index 00000000000..23de57948e4 --- /dev/null +++ b/queue-2.6.33/x86-hpet-erratum-workaround-for-read-after-write-of-hpet-comparator.patch @@ -0,0 +1,89 @@ +From 8da854cb02156c90028233ae1e85ce46a1d3f82c Mon Sep 17 00:00:00 2001 +From: Pallipadi, Venkatesh +Date: Thu, 25 Feb 2010 10:53:48 -0800 +Subject: x86, hpet: Erratum workaround for read after write of HPET comparator + +From: Pallipadi, Venkatesh + +commit 8da854cb02156c90028233ae1e85ce46a1d3f82c upstream. + +On Wed, Feb 24, 2010 at 03:37:04PM -0800, Justin Piszcz wrote: +> Hello, +> +> Again, on the Intel DP55KG board: +> +> # uname -a +> Linux host 2.6.33 #1 SMP Wed Feb 24 18:31:00 EST 2010 x86_64 GNU/Linux +> +> [ 1.237600] ------------[ cut here ]------------ +> [ 1.237890] WARNING: at arch/x86/kernel/hpet.c:404 hpet_next_event+0x70/0x80() +> [ 1.238221] Hardware name: +> [ 1.238504] hpet: compare register read back failed. +> [ 1.238793] Modules linked in: +> [ 1.239315] Pid: 0, comm: swapper Not tainted 2.6.33 #1 +> [ 1.239605] Call Trace: +> [ 1.239886] [] ? warn_slowpath_common+0x73/0xb0 +> [ 1.240409] [] ? tick_dev_program_event+0x38/0xc0 +> [ 1.240699] [] ? warn_slowpath_fmt+0x40/0x50 +> [ 1.240992] [] ? tick_dev_program_event+0x38/0xc0 +> [ 1.241281] [] ? hpet_next_event+0x70/0x80 +> [ 1.241573] [] ? tick_dev_program_event+0x38/0xc0 +> [ 1.241859] [] ? tick_handle_oneshot_broadcast+0xe2/0x100 +> [ 1.246533] [] ? timer_interrupt+0x1a/0x30 +> [ 1.246826] [] ? handle_IRQ_event+0x39/0xd0 +> [ 1.247118] [] ? handle_edge_irq+0xb8/0x160 +> [ 1.247407] [] ? handle_irq+0x15/0x20 +> [ 1.247689] [] ? do_IRQ+0x62/0xe0 +> [ 1.247976] [] ? ret_from_intr+0x0/0xa +> [ 1.248262] [] ? mwait_idle+0x57/0x80 +> [ 1.248796] [] ? cpu_idle+0x5c/0xb0 +> [ 1.249080] ---[ end trace db7f668fb6fef4e1 ]--- +> +> Is this something Intel has to fix or is it a bug in the kernel? + +This is a chipset erratum. + +Thomas: You mentioned we can retain this check only for known-buggy and +hpet debug kind of options. But here is the simple workaround patch for +this particular erratum. + +Some chipsets have a erratum due to which read immediately following a +write of HPET comparator returns old comparator value instead of most +recently written value. + +Erratum 15 in +"Intel I/O Controller Hub 9 (ICH9) Family Specification Update" +(http://www.intel.com/assets/pdf/specupdate/316973.pdf) + +Workaround for the errata is to read the comparator twice if the first +one fails. + +Signed-off-by: Venkatesh Pallipadi +LKML-Reference: <20100225185348.GA9674@linux-os.sc.intel.com> +Signed-off-by: H. Peter Anvin +Cc: Venkatesh Pallipadi +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/hpet.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +--- a/arch/x86/kernel/hpet.c ++++ b/arch/x86/kernel/hpet.c +@@ -399,9 +399,15 @@ static int hpet_next_event(unsigned long + * then we might have a real hardware problem. We can not do + * much about it here, but at least alert the user/admin with + * a prominent warning. ++ * An erratum on some chipsets (ICH9,..), results in comparator read ++ * immediately following a write returning old value. Workaround ++ * for this is to read this value second time, when first ++ * read returns old value. + */ +- WARN_ONCE(hpet_readl(HPET_Tn_CMP(timer)) != cnt, ++ if (unlikely((u32)hpet_readl(HPET_Tn_CMP(timer)) != cnt)) { ++ WARN_ONCE(hpet_readl(HPET_Tn_CMP(timer)) != cnt, + KERN_WARNING "hpet: compare register read back failed.\n"); ++ } + + return (s32)(hpet_readl(HPET_COUNTER) - cnt) >= 0 ? -ETIME : 0; + } -- 2.47.3