From: Greg Kroah-Hartman Date: Wed, 28 Jul 2010 22:09:57 +0000 (-0700) Subject: .34 patches X-Git-Tag: v2.6.27.49~28 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=4c0cb5517849e71f666b0e3cea23be863a5d51f9;p=thirdparty%2Fkernel%2Fstable-queue.git .34 patches --- diff --git a/queue-2.6.34/ahci-ata_generic-let-ata_generic-handle-new-mbp-w-mcp89.patch b/queue-2.6.34/ahci-ata_generic-let-ata_generic-handle-new-mbp-w-mcp89.patch new file mode 100644 index 00000000000..9c1ad70f563 --- /dev/null +++ b/queue-2.6.34/ahci-ata_generic-let-ata_generic-handle-new-mbp-w-mcp89.patch @@ -0,0 +1,83 @@ +From c6353b4520788e34098bbf61c73fb9618ca7fdd6 Mon Sep 17 00:00:00 2001 +From: Tejun Heo +Date: Thu, 17 Jun 2010 11:42:22 +0200 +Subject: ahci,ata_generic: let ata_generic handle new MBP w/ MCP89 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Tejun Heo + +commit c6353b4520788e34098bbf61c73fb9618ca7fdd6 upstream. + +For yet unknown reason, MCP89 on MBP 7,1 doesn't work w/ ahci under +linux but the controller doesn't require explicit mode setting and +works fine with ata_generic. Make ahci ignore the controller on MBP +7,1 and let ata_generic take it for now. + +Reported in bko#15923. + + https://bugzilla.kernel.org/show_bug.cgi?id=15923 + +NVIDIA is investigating why ahci mode doesn't work. + +Signed-off-by: Tejun Heo +Cc: Peer Chen +Reported-by: Anders Østhus +Reported-by: Andreas Graf +Reported-by: Benoit Gschwind +Reported-by: Damien Cassou +Reported-by: tixetsal@juno.com +Signed-off-by: Jeff Garzik +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ata/ahci.c | 10 ++++++++++ + drivers/ata/ata_generic.c | 6 ++++++ + include/linux/pci_ids.h | 1 + + 3 files changed, 17 insertions(+) + +--- a/drivers/ata/ahci.c ++++ b/drivers/ata/ahci.c +@@ -3249,6 +3249,16 @@ static int ahci_init_one(struct pci_dev + if (pdev->vendor == PCI_VENDOR_ID_MARVELL && !marvell_enable) + return -ENODEV; + ++ /* ++ * For some reason, MCP89 on MacBook 7,1 doesn't work with ++ * ahci, use ata_generic instead. ++ */ ++ if (pdev->vendor == PCI_VENDOR_ID_NVIDIA && ++ pdev->device == PCI_DEVICE_ID_NVIDIA_NFORCE_MCP89_SATA && ++ pdev->subsystem_vendor == PCI_VENDOR_ID_APPLE && ++ pdev->subsystem_device == 0xcb89) ++ return -ENODEV; ++ + /* Promise's PDC42819 is a SAS/SATA controller that has an AHCI mode. + * At the moment, we can only use the AHCI mode. Let the users know + * that for SAS drives they're out of luck. +--- a/drivers/ata/ata_generic.c ++++ b/drivers/ata/ata_generic.c +@@ -168,6 +168,12 @@ static struct pci_device_id ata_generic[ + { PCI_DEVICE(PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_82C561), }, + { PCI_DEVICE(PCI_VENDOR_ID_OPTI, PCI_DEVICE_ID_OPTI_82C558), }, + { PCI_DEVICE(PCI_VENDOR_ID_CENATEK,PCI_DEVICE_ID_CENATEK_IDE), }, ++ /* ++ * For some reason, MCP89 on MacBook 7,1 doesn't work with ++ * ahci, use ata_generic instead. ++ */ ++ { PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_MCP89_SATA, ++ PCI_VENDOR_ID_APPLE, 0xcb89, }, + #if !defined(CONFIG_PATA_TOSHIBA) && !defined(CONFIG_PATA_TOSHIBA_MODULE) + { PCI_DEVICE(PCI_VENDOR_ID_TOSHIBA,PCI_DEVICE_ID_TOSHIBA_PICCOLO_1), }, + { PCI_DEVICE(PCI_VENDOR_ID_TOSHIBA,PCI_DEVICE_ID_TOSHIBA_PICCOLO_2), }, +--- a/include/linux/pci_ids.h ++++ b/include/linux/pci_ids.h +@@ -1261,6 +1261,7 @@ + #define PCI_DEVICE_ID_NVIDIA_NFORCE_MCP77_IDE 0x0759 + #define PCI_DEVICE_ID_NVIDIA_NFORCE_MCP73_SMBUS 0x07D8 + #define PCI_DEVICE_ID_NVIDIA_NFORCE_MCP79_SMBUS 0x0AA2 ++#define PCI_DEVICE_ID_NVIDIA_NFORCE_MCP89_SATA 0x0D85 + + #define PCI_VENDOR_ID_IMS 0x10e0 + #define PCI_DEVICE_ID_IMS_TT128 0x9128 diff --git a/queue-2.6.34/arm-6201-1-realview-do-not-use-outer_sync-on-arm11mpcore-boards-with-l220.patch b/queue-2.6.34/arm-6201-1-realview-do-not-use-outer_sync-on-arm11mpcore-boards-with-l220.patch new file mode 100644 index 00000000000..b28e821baab --- /dev/null +++ b/queue-2.6.34/arm-6201-1-realview-do-not-use-outer_sync-on-arm11mpcore-boards-with-l220.patch @@ -0,0 +1,54 @@ +From 2503a5ecd86c002506001eba432c524ea009fe7f Mon Sep 17 00:00:00 2001 +From: Catalin Marinas +Date: Thu, 1 Jul 2010 13:21:47 +0100 +Subject: ARM: 6201/1: RealView: Do not use outer_sync() on ARM11MPCore boards with L220 + +From: Catalin Marinas + +commit 2503a5ecd86c002506001eba432c524ea009fe7f upstream. + +RealView boards with certain revisions of the L220 cache controller (ARM11* +processors only) may have issues (hardware deadlock) with the recent changes to +the mb() barrier implementation (DSB followed by an L2 cache sync). The patch +redefines the RealView ARM11MPCore mandatory barriers without the outer_sync() +call. + +Tested-by: Linus Walleij +Signed-off-by: Catalin Marinas +Signed-off-by: Russell King +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/mach-realview/Kconfig | 2 ++ + arch/arm/mach-realview/include/mach/barriers.h | 8 ++++++++ + 2 files changed, 10 insertions(+) + +--- a/arch/arm/mach-realview/Kconfig ++++ b/arch/arm/mach-realview/Kconfig +@@ -18,6 +18,7 @@ config REALVIEW_EB_ARM11MP + bool "Support ARM11MPCore tile" + depends on MACH_REALVIEW_EB + select CPU_V6 ++ select ARCH_HAS_BARRIERS if SMP + help + Enable support for the ARM11MPCore tile on the Realview platform. + +@@ -35,6 +36,7 @@ config MACH_REALVIEW_PB11MP + select CPU_V6 + select ARM_GIC + select HAVE_PATA_PLATFORM ++ select ARCH_HAS_BARRIERS if SMP + help + Include support for the ARM(R) RealView MPCore Platform Baseboard. + PB11MPCore is a platform with an on-board ARM11MPCore and has +--- /dev/null ++++ b/arch/arm/mach-realview/include/mach/barriers.h +@@ -0,0 +1,8 @@ ++/* ++ * Barriers redefined for RealView ARM11MPCore platforms with L220 cache ++ * controller to work around hardware errata causing the outer_sync() ++ * operation to deadlock the system. ++ */ ++#define mb() dsb() ++#define rmb() dmb() ++#define wmb() mb() diff --git a/queue-2.6.34/arm-6211-1-atomic-ops-fix-register-constraints-for-atomic64_add_unless.patch b/queue-2.6.34/arm-6211-1-atomic-ops-fix-register-constraints-for-atomic64_add_unless.patch new file mode 100644 index 00000000000..834e5964f08 --- /dev/null +++ b/queue-2.6.34/arm-6211-1-atomic-ops-fix-register-constraints-for-atomic64_add_unless.patch @@ -0,0 +1,43 @@ +From 068de8d1be48a04b92fd97f76bb7e113b7be82a8 Mon Sep 17 00:00:00 2001 +From: Will Deacon +Date: Thu, 8 Jul 2010 10:58:06 +0100 +Subject: ARM: 6211/1: atomic ops: fix register constraints for atomic64_add_unless + +From: Will Deacon + +commit 068de8d1be48a04b92fd97f76bb7e113b7be82a8 upstream. + +The atomic64_add_unless function compares an atomic variable with +a given value and, if they are not equal, adds another given value +to the atomic variable. The function returns zero if the addition +did not occur and non-zero otherwise. + +On ARM, the return value is initialised to 1 in C code. Inline assembly +code then performs the atomic64_add_unless operation, setting the +return value to 0 iff the addition does not occur. This means that +when the addition *does* occur, the value of ret must be preserved +across the inline assembly and therefore requires a "+r" constraint +rather than the current one of "=&r". + +Thanks to Nicolas Pitre for helping to spot this. + +Reviewed-by: Nicolas Pitre +Signed-off-by: Will Deacon +Signed-off-by: Russell King +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/include/asm/atomic.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/arm/include/asm/atomic.h ++++ b/arch/arm/include/asm/atomic.h +@@ -440,7 +440,7 @@ static inline int atomic64_add_unless(at + " teq %2, #0\n" + " bne 1b\n" + "2:" +- : "=&r" (val), "=&r" (ret), "=&r" (tmp) ++ : "=&r" (val), "+r" (ret), "=&r" (tmp) + : "r" (&v->counter), "r" (u), "r" (a) + : "cc"); + diff --git a/queue-2.6.34/arm-6212-1-atomic-ops-add-memory-constraints-to-inline-asm.patch b/queue-2.6.34/arm-6212-1-atomic-ops-add-memory-constraints-to-inline-asm.patch new file mode 100644 index 00000000000..a4574535e0c --- /dev/null +++ b/queue-2.6.34/arm-6212-1-atomic-ops-add-memory-constraints-to-inline-asm.patch @@ -0,0 +1,346 @@ +From 398aa66827155ef52bab58bebd24597d90968929 Mon Sep 17 00:00:00 2001 +From: Will Deacon +Date: Thu, 8 Jul 2010 10:59:16 +0100 +Subject: ARM: 6212/1: atomic ops: add memory constraints to inline asm + +From: Will Deacon + +commit 398aa66827155ef52bab58bebd24597d90968929 upstream. + +Currently, the 32-bit and 64-bit atomic operations on ARM do not +include memory constraints in the inline assembly blocks. In the +case of barrier-less operations [for example, atomic_add], this +means that the compiler may constant fold values which have actually +been modified by a call to an atomic operation. + +This issue can be observed in the atomic64_test routine in +/lib/atomic64_test.c: + +00000000 : + 0: e1a0c00d mov ip, sp + 4: e92dd830 push {r4, r5, fp, ip, lr, pc} + 8: e24cb004 sub fp, ip, #4 + c: e24dd008 sub sp, sp, #8 + 10: e24b3014 sub r3, fp, #20 + 14: e30d000d movw r0, #53261 ; 0xd00d + 18: e3011337 movw r1, #4919 ; 0x1337 + 1c: e34c0001 movt r0, #49153 ; 0xc001 + 20: e34a1aa3 movt r1, #43683 ; 0xaaa3 + 24: e16300f8 strd r0, [r3, #-8]! + 28: e30c0afe movw r0, #51966 ; 0xcafe + 2c: e30b1eef movw r1, #48879 ; 0xbeef + 30: e34d0eaf movt r0, #57007 ; 0xdeaf + 34: e34d1ead movt r1, #57005 ; 0xdead + 38: e1b34f9f ldrexd r4, [r3] + 3c: e1a34f90 strexd r4, r0, [r3] + 40: e3340000 teq r4, #0 + 44: 1afffffb bne 38 + 48: e59f0004 ldr r0, [pc, #4] ; 54 + 4c: e3a0101e mov r1, #30 + 50: ebfffffe bl 0 <__bug> + 54: 00000000 .word 0x00000000 + +The atomic64_set (0x38-0x44) writes to the atomic64_t, but the +compiler doesn't see this, assumes the test condition is always +false and generates an unconditional branch to __bug. The rest of the +test is optimised away. + +This patch adds suitable memory constraints to the atomic operations on ARM +to ensure that the compiler is informed of the correct data hazards. We have +to use the "Qo" constraints to avoid hitting the GCC anomaly described at +http://gcc.gnu.org/bugzilla/show_bug.cgi?id=44492 , where the compiler +makes assumptions about the writeback in the addressing mode used by the +inline assembly. These constraints forbid the use of auto{inc,dec} addressing +modes, so it doesn't matter if we don't use the operand exactly once. + +Reviewed-by: Nicolas Pitre +Signed-off-by: Will Deacon +Signed-off-by: Russell King +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/include/asm/atomic.h | 132 +++++++++++++++++++++--------------------- + 1 file changed, 66 insertions(+), 66 deletions(-) + +--- a/arch/arm/include/asm/atomic.h ++++ b/arch/arm/include/asm/atomic.h +@@ -40,12 +40,12 @@ static inline void atomic_add(int i, ato + int result; + + __asm__ __volatile__("@ atomic_add\n" +-"1: ldrex %0, [%2]\n" +-" add %0, %0, %3\n" +-" strex %1, %0, [%2]\n" ++"1: ldrex %0, [%3]\n" ++" add %0, %0, %4\n" ++" strex %1, %0, [%3]\n" + " teq %1, #0\n" + " bne 1b" +- : "=&r" (result), "=&r" (tmp) ++ : "=&r" (result), "=&r" (tmp), "+Qo" (v->counter) + : "r" (&v->counter), "Ir" (i) + : "cc"); + } +@@ -58,12 +58,12 @@ static inline int atomic_add_return(int + smp_mb(); + + __asm__ __volatile__("@ atomic_add_return\n" +-"1: ldrex %0, [%2]\n" +-" add %0, %0, %3\n" +-" strex %1, %0, [%2]\n" ++"1: ldrex %0, [%3]\n" ++" add %0, %0, %4\n" ++" strex %1, %0, [%3]\n" + " teq %1, #0\n" + " bne 1b" +- : "=&r" (result), "=&r" (tmp) ++ : "=&r" (result), "=&r" (tmp), "+Qo" (v->counter) + : "r" (&v->counter), "Ir" (i) + : "cc"); + +@@ -78,12 +78,12 @@ static inline void atomic_sub(int i, ato + int result; + + __asm__ __volatile__("@ atomic_sub\n" +-"1: ldrex %0, [%2]\n" +-" sub %0, %0, %3\n" +-" strex %1, %0, [%2]\n" ++"1: ldrex %0, [%3]\n" ++" sub %0, %0, %4\n" ++" strex %1, %0, [%3]\n" + " teq %1, #0\n" + " bne 1b" +- : "=&r" (result), "=&r" (tmp) ++ : "=&r" (result), "=&r" (tmp), "+Qo" (v->counter) + : "r" (&v->counter), "Ir" (i) + : "cc"); + } +@@ -96,12 +96,12 @@ static inline int atomic_sub_return(int + smp_mb(); + + __asm__ __volatile__("@ atomic_sub_return\n" +-"1: ldrex %0, [%2]\n" +-" sub %0, %0, %3\n" +-" strex %1, %0, [%2]\n" ++"1: ldrex %0, [%3]\n" ++" sub %0, %0, %4\n" ++" strex %1, %0, [%3]\n" + " teq %1, #0\n" + " bne 1b" +- : "=&r" (result), "=&r" (tmp) ++ : "=&r" (result), "=&r" (tmp), "+Qo" (v->counter) + : "r" (&v->counter), "Ir" (i) + : "cc"); + +@@ -118,11 +118,11 @@ static inline int atomic_cmpxchg(atomic_ + + do { + __asm__ __volatile__("@ atomic_cmpxchg\n" +- "ldrex %1, [%2]\n" ++ "ldrex %1, [%3]\n" + "mov %0, #0\n" +- "teq %1, %3\n" +- "strexeq %0, %4, [%2]\n" +- : "=&r" (res), "=&r" (oldval) ++ "teq %1, %4\n" ++ "strexeq %0, %5, [%3]\n" ++ : "=&r" (res), "=&r" (oldval), "+Qo" (ptr->counter) + : "r" (&ptr->counter), "Ir" (old), "r" (new) + : "cc"); + } while (res); +@@ -137,12 +137,12 @@ static inline void atomic_clear_mask(uns + unsigned long tmp, tmp2; + + __asm__ __volatile__("@ atomic_clear_mask\n" +-"1: ldrex %0, [%2]\n" +-" bic %0, %0, %3\n" +-" strex %1, %0, [%2]\n" ++"1: ldrex %0, [%3]\n" ++" bic %0, %0, %4\n" ++" strex %1, %0, [%3]\n" + " teq %1, #0\n" + " bne 1b" +- : "=&r" (tmp), "=&r" (tmp2) ++ : "=&r" (tmp), "=&r" (tmp2), "+Qo" (*addr) + : "r" (addr), "Ir" (mask) + : "cc"); + } +@@ -249,7 +249,7 @@ static inline u64 atomic64_read(atomic64 + __asm__ __volatile__("@ atomic64_read\n" + " ldrexd %0, %H0, [%1]" + : "=&r" (result) +- : "r" (&v->counter) ++ : "r" (&v->counter), "Qo" (v->counter) + ); + + return result; +@@ -260,11 +260,11 @@ static inline void atomic64_set(atomic64 + u64 tmp; + + __asm__ __volatile__("@ atomic64_set\n" +-"1: ldrexd %0, %H0, [%1]\n" +-" strexd %0, %2, %H2, [%1]\n" ++"1: ldrexd %0, %H0, [%2]\n" ++" strexd %0, %3, %H3, [%2]\n" + " teq %0, #0\n" + " bne 1b" +- : "=&r" (tmp) ++ : "=&r" (tmp), "=Qo" (v->counter) + : "r" (&v->counter), "r" (i) + : "cc"); + } +@@ -275,13 +275,13 @@ static inline void atomic64_add(u64 i, a + unsigned long tmp; + + __asm__ __volatile__("@ atomic64_add\n" +-"1: ldrexd %0, %H0, [%2]\n" +-" adds %0, %0, %3\n" +-" adc %H0, %H0, %H3\n" +-" strexd %1, %0, %H0, [%2]\n" ++"1: ldrexd %0, %H0, [%3]\n" ++" adds %0, %0, %4\n" ++" adc %H0, %H0, %H4\n" ++" strexd %1, %0, %H0, [%3]\n" + " teq %1, #0\n" + " bne 1b" +- : "=&r" (result), "=&r" (tmp) ++ : "=&r" (result), "=&r" (tmp), "+Qo" (v->counter) + : "r" (&v->counter), "r" (i) + : "cc"); + } +@@ -294,13 +294,13 @@ static inline u64 atomic64_add_return(u6 + smp_mb(); + + __asm__ __volatile__("@ atomic64_add_return\n" +-"1: ldrexd %0, %H0, [%2]\n" +-" adds %0, %0, %3\n" +-" adc %H0, %H0, %H3\n" +-" strexd %1, %0, %H0, [%2]\n" ++"1: ldrexd %0, %H0, [%3]\n" ++" adds %0, %0, %4\n" ++" adc %H0, %H0, %H4\n" ++" strexd %1, %0, %H0, [%3]\n" + " teq %1, #0\n" + " bne 1b" +- : "=&r" (result), "=&r" (tmp) ++ : "=&r" (result), "=&r" (tmp), "+Qo" (v->counter) + : "r" (&v->counter), "r" (i) + : "cc"); + +@@ -315,13 +315,13 @@ static inline void atomic64_sub(u64 i, a + unsigned long tmp; + + __asm__ __volatile__("@ atomic64_sub\n" +-"1: ldrexd %0, %H0, [%2]\n" +-" subs %0, %0, %3\n" +-" sbc %H0, %H0, %H3\n" +-" strexd %1, %0, %H0, [%2]\n" ++"1: ldrexd %0, %H0, [%3]\n" ++" subs %0, %0, %4\n" ++" sbc %H0, %H0, %H4\n" ++" strexd %1, %0, %H0, [%3]\n" + " teq %1, #0\n" + " bne 1b" +- : "=&r" (result), "=&r" (tmp) ++ : "=&r" (result), "=&r" (tmp), "+Qo" (v->counter) + : "r" (&v->counter), "r" (i) + : "cc"); + } +@@ -334,13 +334,13 @@ static inline u64 atomic64_sub_return(u6 + smp_mb(); + + __asm__ __volatile__("@ atomic64_sub_return\n" +-"1: ldrexd %0, %H0, [%2]\n" +-" subs %0, %0, %3\n" +-" sbc %H0, %H0, %H3\n" +-" strexd %1, %0, %H0, [%2]\n" ++"1: ldrexd %0, %H0, [%3]\n" ++" subs %0, %0, %4\n" ++" sbc %H0, %H0, %H4\n" ++" strexd %1, %0, %H0, [%3]\n" + " teq %1, #0\n" + " bne 1b" +- : "=&r" (result), "=&r" (tmp) ++ : "=&r" (result), "=&r" (tmp), "+Qo" (v->counter) + : "r" (&v->counter), "r" (i) + : "cc"); + +@@ -358,12 +358,12 @@ static inline u64 atomic64_cmpxchg(atomi + + do { + __asm__ __volatile__("@ atomic64_cmpxchg\n" +- "ldrexd %1, %H1, [%2]\n" ++ "ldrexd %1, %H1, [%3]\n" + "mov %0, #0\n" +- "teq %1, %3\n" +- "teqeq %H1, %H3\n" +- "strexdeq %0, %4, %H4, [%2]" +- : "=&r" (res), "=&r" (oldval) ++ "teq %1, %4\n" ++ "teqeq %H1, %H4\n" ++ "strexdeq %0, %5, %H5, [%3]" ++ : "=&r" (res), "=&r" (oldval), "+Qo" (ptr->counter) + : "r" (&ptr->counter), "r" (old), "r" (new) + : "cc"); + } while (res); +@@ -381,11 +381,11 @@ static inline u64 atomic64_xchg(atomic64 + smp_mb(); + + __asm__ __volatile__("@ atomic64_xchg\n" +-"1: ldrexd %0, %H0, [%2]\n" +-" strexd %1, %3, %H3, [%2]\n" ++"1: ldrexd %0, %H0, [%3]\n" ++" strexd %1, %4, %H4, [%3]\n" + " teq %1, #0\n" + " bne 1b" +- : "=&r" (result), "=&r" (tmp) ++ : "=&r" (result), "=&r" (tmp), "+Qo" (ptr->counter) + : "r" (&ptr->counter), "r" (new) + : "cc"); + +@@ -402,16 +402,16 @@ static inline u64 atomic64_dec_if_positi + smp_mb(); + + __asm__ __volatile__("@ atomic64_dec_if_positive\n" +-"1: ldrexd %0, %H0, [%2]\n" ++"1: ldrexd %0, %H0, [%3]\n" + " subs %0, %0, #1\n" + " sbc %H0, %H0, #0\n" + " teq %H0, #0\n" + " bmi 2f\n" +-" strexd %1, %0, %H0, [%2]\n" ++" strexd %1, %0, %H0, [%3]\n" + " teq %1, #0\n" + " bne 1b\n" + "2:" +- : "=&r" (result), "=&r" (tmp) ++ : "=&r" (result), "=&r" (tmp), "+Qo" (v->counter) + : "r" (&v->counter) + : "cc"); + +@@ -429,18 +429,18 @@ static inline int atomic64_add_unless(at + smp_mb(); + + __asm__ __volatile__("@ atomic64_add_unless\n" +-"1: ldrexd %0, %H0, [%3]\n" +-" teq %0, %4\n" +-" teqeq %H0, %H4\n" ++"1: ldrexd %0, %H0, [%4]\n" ++" teq %0, %5\n" ++" teqeq %H0, %H5\n" + " moveq %1, #0\n" + " beq 2f\n" +-" adds %0, %0, %5\n" +-" adc %H0, %H0, %H5\n" +-" strexd %2, %0, %H0, [%3]\n" ++" adds %0, %0, %6\n" ++" adc %H0, %H0, %H6\n" ++" strexd %2, %0, %H0, [%4]\n" + " teq %2, #0\n" + " bne 1b\n" + "2:" +- : "=&r" (val), "+r" (ret), "=&r" (tmp) ++ : "=&r" (val), "+r" (ret), "=&r" (tmp), "+Qo" (v->counter) + : "r" (&v->counter), "r" (u), "r" (a) + : "cc"); + diff --git a/queue-2.6.34/arm-6226-1-fix-kprobe-bug-in-ldr-instruction-emulation.patch b/queue-2.6.34/arm-6226-1-fix-kprobe-bug-in-ldr-instruction-emulation.patch new file mode 100644 index 00000000000..7a3bf882712 --- /dev/null +++ b/queue-2.6.34/arm-6226-1-fix-kprobe-bug-in-ldr-instruction-emulation.patch @@ -0,0 +1,39 @@ +From 0ebe25f90cd99bb1bcf622ec8a841421d48380d6 Mon Sep 17 00:00:00 2001 +From: Nicolas Pitre +Date: Wed, 14 Jul 2010 05:21:22 +0100 +Subject: ARM: 6226/1: fix kprobe bug in ldr instruction emulation + +From: Nicolas Pitre + +commit 0ebe25f90cd99bb1bcf622ec8a841421d48380d6 upstream. + +From: Bin Yang + +Signed-off-by: Bin Yang +Signed-off-by: Nicolas Pitre +Signed-off-by: Russell King +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/kernel/kprobes-decode.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/arch/arm/kernel/kprobes-decode.c ++++ b/arch/arm/kernel/kprobes-decode.c +@@ -583,13 +583,14 @@ static void __kprobes emulate_ldr(struct + { + insn_llret_3arg_fn_t *i_fn = (insn_llret_3arg_fn_t *)&p->ainsn.insn[0]; + kprobe_opcode_t insn = p->opcode; ++ long ppc = (long)p->addr + 8; + union reg_pair fnr; + int rd = (insn >> 12) & 0xf; + int rn = (insn >> 16) & 0xf; + int rm = insn & 0xf; + long rdv; +- long rnv = regs->uregs[rn]; +- long rmv = regs->uregs[rm]; /* rm/rmv may be invalid, don't care. */ ++ long rnv = (rn == 15) ? ppc : regs->uregs[rn]; ++ long rmv = (rm == 15) ? ppc : regs->uregs[rm]; + long cpsr = regs->ARM_cpsr; + + fnr.dr = insnslot_llret_3arg_rflags(rnv, 0, rmv, cpsr, i_fn); diff --git a/queue-2.6.34/asoc-remove-duplicate-aux-definition-from-wm8776.patch b/queue-2.6.34/asoc-remove-duplicate-aux-definition-from-wm8776.patch new file mode 100644 index 00000000000..b36bf0278bc --- /dev/null +++ b/queue-2.6.34/asoc-remove-duplicate-aux-definition-from-wm8776.patch @@ -0,0 +1,27 @@ +From 3c0709396df0869786f83e4b2d2d687c70ee886d Mon Sep 17 00:00:00 2001 +From: Mark Brown +Date: Sat, 17 Jul 2010 14:20:17 +0100 +Subject: ASoC: Remove duplicate AUX definition from WM8776 + +From: Mark Brown + +commit 3c0709396df0869786f83e4b2d2d687c70ee886d upstream. + +Signed-off-by: Mark Brown +Acked-by: Liam Girdwood +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/codecs/wm8776.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/sound/soc/codecs/wm8776.c ++++ b/sound/soc/codecs/wm8776.c +@@ -94,7 +94,6 @@ SOC_DAPM_SINGLE("Bypass Switch", WM8776_ + + static const struct snd_soc_dapm_widget wm8776_dapm_widgets[] = { + SND_SOC_DAPM_INPUT("AUX"), +-SND_SOC_DAPM_INPUT("AUX"), + + SND_SOC_DAPM_INPUT("AIN1"), + SND_SOC_DAPM_INPUT("AIN2"), diff --git a/queue-2.6.34/ata_generic-implement-ata_gen_-flags-and-force-enable-dma-on-mbp-7-1.patch b/queue-2.6.34/ata_generic-implement-ata_gen_-flags-and-force-enable-dma-on-mbp-7-1.patch new file mode 100644 index 00000000000..2b670eb6f25 --- /dev/null +++ b/queue-2.6.34/ata_generic-implement-ata_gen_-flags-and-force-enable-dma-on-mbp-7-1.patch @@ -0,0 +1,118 @@ +From 1529c69adce1e95f7ae72f0441590c226bbac7fc Mon Sep 17 00:00:00 2001 +From: Tejun Heo +Date: Tue, 22 Jun 2010 12:27:26 +0200 +Subject: ata_generic: implement ATA_GEN_* flags and force enable DMA on MBP 7,1 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Tejun Heo + +commit 1529c69adce1e95f7ae72f0441590c226bbac7fc upstream. + +IDE mode of MCP89 on MBP 7,1 doesn't set DMA enable bits in the BMDMA +status register. Make the following changes to work around the problem. + +* Instead of using hard coded 1 in id->driver_data as class code + match, use ATA_GEN_CLASS_MATCH and carry the matched id in + host->private_data. + +* Instead of matching PCI_VENDOR_ID_CENATEK, use ATA_GEN_FORCE_DMA + flag in id instead. + +* Add ATA_GEN_FORCE_DMA to the id entry of MBP 7,1. + +Signed-off-by: Tejun Heo +Cc: Peer Chen +Reported-by: Anders Østhus +Reported-by: Andreas Graf +Reported-by: Benoit Gschwind +Reported-by: Damien Cassou +Reported-by: tixetsal@juno.com +Signed-off-by: Jeff Garzik +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ata/ata_generic.c | 26 +++++++++++++++++++------- + 1 file changed, 19 insertions(+), 7 deletions(-) + +--- a/drivers/ata/ata_generic.c ++++ b/drivers/ata/ata_generic.c +@@ -32,6 +32,11 @@ + * A generic parallel ATA driver using libata + */ + ++enum { ++ ATA_GEN_CLASS_MATCH = (1 << 0), ++ ATA_GEN_FORCE_DMA = (1 << 1), ++}; ++ + /** + * generic_set_mode - mode setting + * @link: link to set up +@@ -46,13 +51,17 @@ + static int generic_set_mode(struct ata_link *link, struct ata_device **unused) + { + struct ata_port *ap = link->ap; ++ const struct pci_device_id *id = ap->host->private_data; + int dma_enabled = 0; + struct ata_device *dev; + struct pci_dev *pdev = to_pci_dev(ap->host->dev); + +- /* Bits 5 and 6 indicate if DMA is active on master/slave */ +- if (ap->ioaddr.bmdma_addr) ++ if (id->driver_data & ATA_GEN_FORCE_DMA) { ++ dma_enabled = 0xff; ++ } else if (ap->ioaddr.bmdma_addr) { ++ /* Bits 5 and 6 indicate if DMA is active on master/slave */ + dma_enabled = ioread8(ap->ioaddr.bmdma_addr + ATA_DMA_STATUS); ++ } + + if (pdev->vendor == PCI_VENDOR_ID_CENATEK) + dma_enabled = 0xFF; +@@ -126,7 +135,7 @@ static int ata_generic_init_one(struct p + const struct ata_port_info *ppi[] = { &info, NULL }; + + /* Don't use the generic entry unless instructed to do so */ +- if (id->driver_data == 1 && all_generic_ide == 0) ++ if ((id->driver_data & ATA_GEN_CLASS_MATCH) && all_generic_ide == 0) + return -ENODEV; + + /* Devices that need care */ +@@ -155,7 +164,7 @@ static int ata_generic_init_one(struct p + return rc; + pcim_pin_device(dev); + } +- return ata_pci_sff_init_one(dev, ppi, &generic_sht, NULL, 0); ++ return ata_pci_sff_init_one(dev, ppi, &generic_sht, (void *)id, 0); + } + + static struct pci_device_id ata_generic[] = { +@@ -167,13 +176,15 @@ static struct pci_device_id ata_generic[ + { PCI_DEVICE(PCI_VENDOR_ID_HINT, PCI_DEVICE_ID_HINT_VXPROII_IDE), }, + { PCI_DEVICE(PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_82C561), }, + { PCI_DEVICE(PCI_VENDOR_ID_OPTI, PCI_DEVICE_ID_OPTI_82C558), }, +- { PCI_DEVICE(PCI_VENDOR_ID_CENATEK,PCI_DEVICE_ID_CENATEK_IDE), }, ++ { PCI_DEVICE(PCI_VENDOR_ID_CENATEK,PCI_DEVICE_ID_CENATEK_IDE), ++ .driver_data = ATA_GEN_FORCE_DMA }, + /* + * For some reason, MCP89 on MacBook 7,1 doesn't work with + * ahci, use ata_generic instead. + */ + { PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_MCP89_SATA, +- PCI_VENDOR_ID_APPLE, 0xcb89, }, ++ PCI_VENDOR_ID_APPLE, 0xcb89, ++ .driver_data = ATA_GEN_FORCE_DMA }, + #if !defined(CONFIG_PATA_TOSHIBA) && !defined(CONFIG_PATA_TOSHIBA_MODULE) + { PCI_DEVICE(PCI_VENDOR_ID_TOSHIBA,PCI_DEVICE_ID_TOSHIBA_PICCOLO_1), }, + { PCI_DEVICE(PCI_VENDOR_ID_TOSHIBA,PCI_DEVICE_ID_TOSHIBA_PICCOLO_2), }, +@@ -181,7 +192,8 @@ static struct pci_device_id ata_generic[ + { PCI_DEVICE(PCI_VENDOR_ID_TOSHIBA,PCI_DEVICE_ID_TOSHIBA_PICCOLO_5), }, + #endif + /* Must come last. If you add entries adjust this table appropriately */ +- { PCI_ANY_ID, PCI_ANY_ID, PCI_ANY_ID, PCI_ANY_ID, PCI_CLASS_STORAGE_IDE << 8, 0xFFFFFF00UL, 1}, ++ { PCI_DEVICE_CLASS(PCI_CLASS_STORAGE_IDE << 8, 0xFFFFFF00UL), ++ .driver_data = ATA_GEN_CLASS_MATCH }, + { 0, }, + }; + diff --git a/queue-2.6.34/compiler-gcc.h-gcc-4.5-needs-noclone-and-noinline-on-__naked-functions.patch b/queue-2.6.34/compiler-gcc.h-gcc-4.5-needs-noclone-and-noinline-on-__naked-functions.patch new file mode 100644 index 00000000000..f79f86b3846 --- /dev/null +++ b/queue-2.6.34/compiler-gcc.h-gcc-4.5-needs-noclone-and-noinline-on-__naked-functions.patch @@ -0,0 +1,70 @@ +From 9c695203a7ddbe49dba5f22f4c941d24f47475df Mon Sep 17 00:00:00 2001 +From: Mikael Pettersson +Date: Tue, 29 Jun 2010 15:05:25 -0700 +Subject: compiler-gcc.h: gcc-4.5 needs noclone and noinline on __naked functions + +From: Mikael Pettersson + +commit 9c695203a7ddbe49dba5f22f4c941d24f47475df upstream. + +A __naked function is defined in C but with a body completely implemented +by asm(), including any prologue and epilogue. These asm() bodies expect +standard calling conventions for parameter passing. Older GCCs implement +that correctly, but 4.[56] currently do not, see GCC PR44290. In the +Linux kernel this breaks ARM, causing most arch/arm/mm/copypage-*.c +modules to get miscompiled, resulting in kernel crashes during bootup. + +Part of the kernel fix is to augment the __naked function attribute to +also imply noinline and noclone. This patch implements that, and has been +verified to fix boot failures with gcc-4.5 compiled 2.6.34 and 2.6.35-rc1 +kernels. The patch is a no-op with older GCCs. + +Signed-off-by: Mikael Pettersson +Signed-off-by: Khem Raj +Cc: Russell King +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + include/linux/compiler-gcc.h | 10 +++++++++- + include/linux/compiler-gcc4.h | 4 ++++ + 2 files changed, 13 insertions(+), 1 deletion(-) + +--- a/include/linux/compiler-gcc.h ++++ b/include/linux/compiler-gcc.h +@@ -58,8 +58,12 @@ + * naked functions because then mcount is called without stack and frame pointer + * being set up and there is no chance to restore the lr register to the value + * before mcount was called. ++ * ++ * The asm() bodies of naked functions often depend on standard calling conventions, ++ * therefore they must be noinline and noclone. GCC 4.[56] currently fail to enforce ++ * this, so we must do so ourselves. See GCC PR44290. + */ +-#define __naked __attribute__((naked)) notrace ++#define __naked __attribute__((naked)) noinline __noclone notrace + + #define __noreturn __attribute__((noreturn)) + +@@ -85,3 +89,7 @@ + #define _gcc_header(x) __gcc_header(linux/compiler-gcc##x.h) + #define gcc_header(x) _gcc_header(x) + #include gcc_header(__GNUC__) ++ ++#if !defined(__noclone) ++#define __noclone /* not needed */ ++#endif +--- a/include/linux/compiler-gcc4.h ++++ b/include/linux/compiler-gcc4.h +@@ -48,6 +48,10 @@ + * unreleased. Really, we need to have autoconf for the kernel. + */ + #define unreachable() __builtin_unreachable() ++ ++/* Mark a function definition as prohibited from being cloned. */ ++#define __noclone __attribute__((__noclone__)) ++ + #endif + + #endif diff --git a/queue-2.6.34/edac-mpc85xx-fix-mpc85xx-dependency.patch b/queue-2.6.34/edac-mpc85xx-fix-mpc85xx-dependency.patch new file mode 100644 index 00000000000..4735cad5fb2 --- /dev/null +++ b/queue-2.6.34/edac-mpc85xx-fix-mpc85xx-dependency.patch @@ -0,0 +1,39 @@ +From 1cd8521e7d77def75fdb1cb35ecd135385e4be4f Mon Sep 17 00:00:00 2001 +From: Anton Vorontsov +Date: Tue, 20 Jul 2010 13:24:27 -0700 +Subject: edac: mpc85xx: fix MPC85xx dependency + +From: Anton Vorontsov + +commit 1cd8521e7d77def75fdb1cb35ecd135385e4be4f upstream. + +Since commit 5753c082f66eca5be81f6bda85c1718c5eea6ada ("powerpc/85xx: +Kconfig cleanup"), there is no MPC85xx Kconfig symbol anymore, so the +driver became non-selectable. + +This patch fixes the issue by switching to PPC_85xx symbol. + +Signed-off-by: Anton Vorontsov +Cc: Doug Thompson +Cc: Peter Tyser +Cc: Dave Jiang +Cc: Kumar Gala +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/edac/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/edac/Kconfig ++++ b/drivers/edac/Kconfig +@@ -196,7 +196,7 @@ config EDAC_I5100 + + config EDAC_MPC85XX + tristate "Freescale MPC83xx / MPC85xx" +- depends on EDAC_MM_EDAC && FSL_SOC && (PPC_83xx || MPC85xx) ++ depends on EDAC_MM_EDAC && FSL_SOC && (PPC_83xx || PPC_85xx) + help + Support for error detection and correction on the Freescale + MPC8349, MPC8560, MPC8540, MPC8548 diff --git a/queue-2.6.34/ethtool-fix-potential-kernel-buffer-overflow-in-ethtool_grxclsrlall.patch b/queue-2.6.34/ethtool-fix-potential-kernel-buffer-overflow-in-ethtool_grxclsrlall.patch new file mode 100644 index 00000000000..37fb5b2dc9c --- /dev/null +++ b/queue-2.6.34/ethtool-fix-potential-kernel-buffer-overflow-in-ethtool_grxclsrlall.patch @@ -0,0 +1,36 @@ +From db048b69037e7fa6a7d9e95a1271a50dc08ae233 Mon Sep 17 00:00:00 2001 +From: Ben Hutchings +Date: Mon, 28 Jun 2010 08:44:07 +0000 +Subject: ethtool: Fix potential kernel buffer overflow in ETHTOOL_GRXCLSRLALL + +From: Ben Hutchings + +commit db048b69037e7fa6a7d9e95a1271a50dc08ae233 upstream. + +On a 32-bit machine, info.rule_cnt >= 0x40000000 leads to integer +overflow and the buffer may be smaller than needed. Since +ETHTOOL_GRXCLSRLALL is unprivileged, this can presumably be used for at +least denial of service. + +Signed-off-by: Ben Hutchings +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + net/core/ethtool.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/net/core/ethtool.c ++++ b/net/core/ethtool.c +@@ -328,8 +328,9 @@ static noinline_for_stack int ethtool_ge + + if (info.cmd == ETHTOOL_GRXCLSRLALL) { + if (info.rule_cnt > 0) { +- rule_buf = kmalloc(info.rule_cnt * sizeof(u32), +- GFP_USER); ++ if (info.rule_cnt <= KMALLOC_MAX_SIZE / sizeof(u32)) ++ rule_buf = kmalloc(info.rule_cnt * sizeof(u32), ++ GFP_USER); + if (!rule_buf) + return -ENOMEM; + } diff --git a/queue-2.6.34/input-gamecon-reference-correct-input-device-in-nes-mode.patch b/queue-2.6.34/input-gamecon-reference-correct-input-device-in-nes-mode.patch new file mode 100644 index 00000000000..b3e20093272 --- /dev/null +++ b/queue-2.6.34/input-gamecon-reference-correct-input-device-in-nes-mode.patch @@ -0,0 +1,39 @@ +From 7b5d3312fbfbb21d2fc7de94e0db66cfdf8b0055 Mon Sep 17 00:00:00 2001 +From: Dmitry Torokhov +Date: Tue, 20 Jul 2010 20:25:35 -0700 +Subject: Input: gamecon - reference correct input device in NES mode + +From: Dmitry Torokhov + +commit 7b5d3312fbfbb21d2fc7de94e0db66cfdf8b0055 upstream. + +We moved input devices from 'struct gc' to individial pads (struct +gc-pad), but gc_nes_process_packet() was still trying to use old +ones and crashing. + +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/input/joystick/gamecon.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/drivers/input/joystick/gamecon.c ++++ b/drivers/input/joystick/gamecon.c +@@ -89,7 +89,6 @@ struct gc_pad { + struct gc { + struct pardevice *pd; + struct gc_pad pads[GC_MAX_DEVICES]; +- struct input_dev *dev[GC_MAX_DEVICES]; + struct timer_list timer; + int pad_count[GC_MAX]; + int used; +@@ -387,7 +386,7 @@ static void gc_nes_process_packet(struct + for (i = 0; i < GC_MAX_DEVICES; i++) { + + pad = &gc->pads[i]; +- dev = gc->dev[i]; ++ dev = pad->dev; + s = gc_status_bit[i]; + + switch (pad->type) { diff --git a/queue-2.6.34/input-gamecon-reference-correct-pad-in-gc_psx_command.patch b/queue-2.6.34/input-gamecon-reference-correct-pad-in-gc_psx_command.patch new file mode 100644 index 00000000000..59d1943d6bb --- /dev/null +++ b/queue-2.6.34/input-gamecon-reference-correct-pad-in-gc_psx_command.patch @@ -0,0 +1,31 @@ +From c25f7b763cc35a249232ce612a36a811b0e263f9 Mon Sep 17 00:00:00 2001 +From: Dmitry Torokhov +Date: Tue, 20 Jul 2010 20:25:35 -0700 +Subject: Input: gamecon - reference correct pad in gc_psx_command() + +From: Dmitry Torokhov + +commit c25f7b763cc35a249232ce612a36a811b0e263f9 upstream. + +Otherwise we won't see any events from the gamepad. +Addresses https://bugzilla.kernel.org/show_bug.cgi?id=16408 + +Reported-and-tested-by: Eugene Yudin +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/input/joystick/gamecon.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/input/joystick/gamecon.c ++++ b/drivers/input/joystick/gamecon.c +@@ -578,7 +578,7 @@ static void gc_psx_command(struct gc *gc + read = parport_read_status(port) ^ 0x80; + + for (j = 0; j < GC_MAX_DEVICES; j++) { +- struct gc_pad *pad = &gc->pads[i]; ++ struct gc_pad *pad = &gc->pads[j]; + + if (pad->type == GC_PSX || pad->type == GC_DDR) + data[j] |= (read & gc_status_bit[j]) ? (1 << i) : 0; diff --git a/queue-2.6.34/input-i8042-add-gigabyte-spring-peak-to-dmi_noloop_table.patch b/queue-2.6.34/input-i8042-add-gigabyte-spring-peak-to-dmi_noloop_table.patch new file mode 100644 index 00000000000..1082f347a2e --- /dev/null +++ b/queue-2.6.34/input-i8042-add-gigabyte-spring-peak-to-dmi_noloop_table.patch @@ -0,0 +1,39 @@ +From 3e1bbc8d5018a05c0793c8a32b777a1396eb4414 Mon Sep 17 00:00:00 2001 +From: Kamal Mostafa +Date: Mon, 19 Jul 2010 11:00:52 -0700 +Subject: Input: i8042 - add Gigabyte Spring Peak to dmi_noloop_table + +From: Kamal Mostafa + +commit 3e1bbc8d5018a05c0793c8a32b777a1396eb4414 upstream. + +Gigabyte "Spring Peak" notebook indicates wrong chassis-type, tripping up +i8042 and breaking the touchpad. Add this model to i8042_dmi_noloop_table[] +to resolve. + +BugLink: https://bugs.launchpad.net/bugs/580664 + +Signed-off-by: Kamal Mostafa +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/input/serio/i8042-x86ia64io.h | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/input/serio/i8042-x86ia64io.h ++++ b/drivers/input/serio/i8042-x86ia64io.h +@@ -166,6 +166,13 @@ static const struct dmi_system_id __init + }, + }, + { ++ /* Gigabyte Spring Peak - defines wrong chassis type */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "GIGABYTE"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "Spring Peak"), ++ }, ++ }, ++ { + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"), + DMI_MATCH(DMI_PRODUCT_NAME, "HP Pavilion dv9700"), diff --git a/queue-2.6.34/input-twl40300-keypad-fix-handling-of-all-ground-rows.patch b/queue-2.6.34/input-twl40300-keypad-fix-handling-of-all-ground-rows.patch new file mode 100644 index 00000000000..5bb32f1f684 --- /dev/null +++ b/queue-2.6.34/input-twl40300-keypad-fix-handling-of-all-ground-rows.patch @@ -0,0 +1,151 @@ +From 3fea60261e73dbf4a51130d40cafcc8465b0f2c3 Mon Sep 17 00:00:00 2001 +From: Dmitry Torokhov +Date: Tue, 20 Jul 2010 20:25:35 -0700 +Subject: Input: twl40300-keypad - fix handling of "all ground" rows + +From: Dmitry Torokhov + +commit 3fea60261e73dbf4a51130d40cafcc8465b0f2c3 upstream. + +The Nokia RX51 board code (arch/arm/mach-omap2/board-rx51-peripherals.c) +defines a key map for the matrix keypad keyboard. The hardware seems to +use all of the 8 rows and 8 columns of the keypad, although not all +possible locations are used. + +The TWL4030 supports keypads with at most 8 rows and 8 columns. Most keys +are defined with a row and column number between 0 and 7, except + + KEY(0xff, 2, KEY_F9), + KEY(0xff, 4, KEY_F10), + KEY(0xff, 5, KEY_F11), + +which represent keycodes that should be emitted when entire row is +connected to the ground. since the driver handles this case as if we +had an extra column in the key matrix. Unfortunately we do not allocate +enough space and end up owerwriting some random memory. + +Reported-and-tested-by: Laurent Pinchart +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/mach-omap2/board-rx51-peripherals.c | 17 ++++++++++++++--- + drivers/input/keyboard/twl4030_keypad.c | 17 +++++++++++------ + 2 files changed, 25 insertions(+), 9 deletions(-) + +--- a/arch/arm/mach-omap2/board-rx51-peripherals.c ++++ b/arch/arm/mach-omap2/board-rx51-peripherals.c +@@ -147,6 +147,10 @@ static void __init rx51_add_gpio_keys(vo + #endif /* CONFIG_KEYBOARD_GPIO || CONFIG_KEYBOARD_GPIO_MODULE */ + + static int board_keymap[] = { ++ /* ++ * Note that KEY(x, 8, KEY_XXX) entries represent "entrire row ++ * connected to the ground" matrix state. ++ */ + KEY(0, 0, KEY_Q), + KEY(0, 1, KEY_O), + KEY(0, 2, KEY_P), +@@ -154,6 +158,7 @@ static int board_keymap[] = { + KEY(0, 4, KEY_BACKSPACE), + KEY(0, 6, KEY_A), + KEY(0, 7, KEY_S), ++ + KEY(1, 0, KEY_W), + KEY(1, 1, KEY_D), + KEY(1, 2, KEY_F), +@@ -162,6 +167,7 @@ static int board_keymap[] = { + KEY(1, 5, KEY_J), + KEY(1, 6, KEY_K), + KEY(1, 7, KEY_L), ++ + KEY(2, 0, KEY_E), + KEY(2, 1, KEY_DOT), + KEY(2, 2, KEY_UP), +@@ -169,6 +175,8 @@ static int board_keymap[] = { + KEY(2, 5, KEY_Z), + KEY(2, 6, KEY_X), + KEY(2, 7, KEY_C), ++ KEY(2, 8, KEY_F9), ++ + KEY(3, 0, KEY_R), + KEY(3, 1, KEY_V), + KEY(3, 2, KEY_B), +@@ -177,20 +185,23 @@ static int board_keymap[] = { + KEY(3, 5, KEY_SPACE), + KEY(3, 6, KEY_SPACE), + KEY(3, 7, KEY_LEFT), ++ + KEY(4, 0, KEY_T), + KEY(4, 1, KEY_DOWN), + KEY(4, 2, KEY_RIGHT), + KEY(4, 4, KEY_LEFTCTRL), + KEY(4, 5, KEY_RIGHTALT), + KEY(4, 6, KEY_LEFTSHIFT), ++ KEY(4, 8, KEY_10), ++ + KEY(5, 0, KEY_Y), ++ KEY(5, 8, KEY_11), ++ + KEY(6, 0, KEY_U), ++ + KEY(7, 0, KEY_I), + KEY(7, 1, KEY_F7), + KEY(7, 2, KEY_F8), +- KEY(0xff, 2, KEY_F9), +- KEY(0xff, 4, KEY_F10), +- KEY(0xff, 5, KEY_F11), + }; + + static struct matrix_keymap_data board_map_data = { +--- a/drivers/input/keyboard/twl4030_keypad.c ++++ b/drivers/input/keyboard/twl4030_keypad.c +@@ -51,8 +51,12 @@ + */ + #define TWL4030_MAX_ROWS 8 /* TWL4030 hard limit */ + #define TWL4030_MAX_COLS 8 +-#define TWL4030_ROW_SHIFT 3 +-#define TWL4030_KEYMAP_SIZE (TWL4030_MAX_ROWS * TWL4030_MAX_COLS) ++/* ++ * Note that we add space for an extra column so that we can handle ++ * row lines connected to the gnd (see twl4030_col_xlate()). ++ */ ++#define TWL4030_ROW_SHIFT 4 ++#define TWL4030_KEYMAP_SIZE (TWL4030_MAX_ROWS << TWL4030_ROW_SHIFT) + + struct twl4030_keypad { + unsigned short keymap[TWL4030_KEYMAP_SIZE]; +@@ -182,7 +186,7 @@ static int twl4030_read_kp_matrix_state( + return ret; + } + +-static int twl4030_is_in_ghost_state(struct twl4030_keypad *kp, u16 *key_state) ++static bool twl4030_is_in_ghost_state(struct twl4030_keypad *kp, u16 *key_state) + { + int i; + u16 check = 0; +@@ -191,12 +195,12 @@ static int twl4030_is_in_ghost_state(str + u16 col = key_state[i]; + + if ((col & check) && hweight16(col) > 1) +- return 1; ++ return true; + + check |= col; + } + +- return 0; ++ return false; + } + + static void twl4030_kp_scan(struct twl4030_keypad *kp, bool release_all) +@@ -225,7 +229,8 @@ static void twl4030_kp_scan(struct twl40 + if (!changed) + continue; + +- for (col = 0; col < kp->n_cols; col++) { ++ /* Extra column handles "all gnd" rows */ ++ for (col = 0; col < kp->n_cols + 1; col++) { + int code; + + if (!(changed & (1 << col))) diff --git a/queue-2.6.34/ipoib-fix-world-writable-child-interface-control-sysfs-attributes.patch b/queue-2.6.34/ipoib-fix-world-writable-child-interface-control-sysfs-attributes.patch new file mode 100644 index 00000000000..210217c720b --- /dev/null +++ b/queue-2.6.34/ipoib-fix-world-writable-child-interface-control-sysfs-attributes.patch @@ -0,0 +1,42 @@ +From 7a52b34b07122ff5f45258d47f260f8a525518f0 Mon Sep 17 00:00:00 2001 +From: Or Gerlitz +Date: Sun, 6 Jun 2010 04:59:16 +0000 +Subject: IPoIB: Fix world-writable child interface control sysfs attributes + +From: Or Gerlitz + +commit 7a52b34b07122ff5f45258d47f260f8a525518f0 upstream. + +Sumeet Lahorani reported that the IPoIB +child entries are world-writable; however we don't want ordinary users +to be able to create and destroy child interfaces, so fix them to be +writable only by root. + +Signed-off-by: Or Gerlitz +Signed-off-by: Roland Dreier +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/infiniband/ulp/ipoib/ipoib_main.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c ++++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c +@@ -1163,7 +1163,7 @@ static ssize_t create_child(struct devic + + return ret ? ret : count; + } +-static DEVICE_ATTR(create_child, S_IWUGO, NULL, create_child); ++static DEVICE_ATTR(create_child, S_IWUSR, NULL, create_child); + + static ssize_t delete_child(struct device *dev, + struct device_attribute *attr, +@@ -1183,7 +1183,7 @@ static ssize_t delete_child(struct devic + return ret ? ret : count; + + } +-static DEVICE_ATTR(delete_child, S_IWUGO, NULL, delete_child); ++static DEVICE_ATTR(delete_child, S_IWUSR, NULL, delete_child); + + int ipoib_add_pkey_attr(struct net_device *dev) + { diff --git a/queue-2.6.34/kmemleak-add-support-for-no_bootmem-configurations.patch b/queue-2.6.34/kmemleak-add-support-for-no_bootmem-configurations.patch new file mode 100644 index 00000000000..342f57b18d9 --- /dev/null +++ b/queue-2.6.34/kmemleak-add-support-for-no_bootmem-configurations.patch @@ -0,0 +1,68 @@ +From 9078370c0d2cfe4a905aa34f398bbb0d65921a2b Mon Sep 17 00:00:00 2001 +From: Catalin Marinas +Date: Mon, 19 Jul 2010 11:54:15 +0100 +Subject: kmemleak: Add support for NO_BOOTMEM configurations + +From: Catalin Marinas + +commit 9078370c0d2cfe4a905aa34f398bbb0d65921a2b upstream. + +With commits 08677214 and 59be5a8e, alloc_bootmem()/free_bootmem() and +friends use the early_res functions for memory management when +NO_BOOTMEM is enabled. This patch adds the kmemleak calls in the +corresponding code paths for bootmem allocations. + +Signed-off-by: Catalin Marinas +Acked-by: Pekka Enberg +Acked-by: Yinghai Lu +Cc: H. Peter Anvin +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/early_res.c | 6 ++++++ + mm/page_alloc.c | 5 +++++ + 2 files changed, 11 insertions(+) + +--- a/kernel/early_res.c ++++ b/kernel/early_res.c +@@ -7,6 +7,8 @@ + #include + #include + #include ++#include ++#include + + /* + * Early reserved memory areas. +@@ -319,6 +321,8 @@ void __init free_early(u64 start, u64 en + struct early_res *r; + int i; + ++ kmemleak_free_part(__va(start), end - start); ++ + i = find_overlapped_early(start, end); + r = &early_res[i]; + if (i >= max_early_res || r->end != end || r->start != start) +@@ -333,6 +337,8 @@ void __init free_early_partial(u64 start + struct early_res *r; + int i; + ++ kmemleak_free_part(__va(start), end - start); ++ + if (start == end) + return; + +--- a/mm/page_alloc.c ++++ b/mm/page_alloc.c +@@ -3440,6 +3440,11 @@ void * __init __alloc_memory_core_early( + ptr = phys_to_virt(addr); + memset(ptr, 0, size); + reserve_early_without_check(addr, addr + size, "BOOTMEM"); ++ /* ++ * The min_count is set to 0 so that bootmem allocated blocks ++ * are never reported as leaks. ++ */ ++ kmemleak_alloc(ptr, size, 0, 0); + return ptr; + } + diff --git a/queue-2.6.34/powerpc-cpm-reintroduce-global-spi_pram-struct-fixes-build-issue.patch b/queue-2.6.34/powerpc-cpm-reintroduce-global-spi_pram-struct-fixes-build-issue.patch new file mode 100644 index 00000000000..8ea885f9dc2 --- /dev/null +++ b/queue-2.6.34/powerpc-cpm-reintroduce-global-spi_pram-struct-fixes-build-issue.patch @@ -0,0 +1,130 @@ +From 56825c88ff438f4dbb51a44591cc29e707fe783a Mon Sep 17 00:00:00 2001 +From: Anton Vorontsov +Date: Thu, 8 Jul 2010 21:16:10 +0400 +Subject: powerpc/cpm: Reintroduce global spi_pram struct (fixes build issue) + +From: Anton Vorontsov + +commit 56825c88ff438f4dbb51a44591cc29e707fe783a upstream. + +spi_t was removed in commit 644b2a680ccc51a9ec4d6beb12e9d47d2dee98e2 +("powerpc/cpm: Remove SPI defines and spi structs"), the commit assumed +that spi_t isn't used anywhere outside of the spi_mpc8xxx driver. But +it appears that the struct is needed for micropatch code. So, let's +reintroduce the struct. + +Fixes the following build issue: + + CC arch/powerpc/sysdev/micropatch.o + micropatch.c: In function 'cpm_load_patch': + micropatch.c:629: error: expected '=', ',', ';', 'asm' or '__attribute__' before '*' token + micropatch.c:629: error: 'spp' undeclared (first use in this function) + micropatch.c:629: error: (Each undeclared identifier is reported only once + micropatch.c:629: error: for each function it appears in.) + +Reported-by: LEROY Christophe +Reported-by: Tony Breeds +Signed-off-by: Anton Vorontsov +Signed-off-by: Kumar Gala +Signed-off-by: Greg Kroah-Hartman + +--- + arch/powerpc/include/asm/cpm.h | 24 ++++++++++++++++++++++++ + arch/powerpc/sysdev/micropatch.c | 7 ++++--- + drivers/spi/spi_mpc8xxx.c | 22 ---------------------- + 3 files changed, 28 insertions(+), 25 deletions(-) + +--- a/arch/powerpc/include/asm/cpm.h ++++ b/arch/powerpc/include/asm/cpm.h +@@ -7,6 +7,30 @@ + #include + + /* ++ * SPI Parameter RAM common to QE and CPM. ++ */ ++struct spi_pram { ++ __be16 rbase; /* Rx Buffer descriptor base address */ ++ __be16 tbase; /* Tx Buffer descriptor base address */ ++ u8 rfcr; /* Rx function code */ ++ u8 tfcr; /* Tx function code */ ++ __be16 mrblr; /* Max receive buffer length */ ++ __be32 rstate; /* Internal */ ++ __be32 rdp; /* Internal */ ++ __be16 rbptr; /* Internal */ ++ __be16 rbc; /* Internal */ ++ __be32 rxtmp; /* Internal */ ++ __be32 tstate; /* Internal */ ++ __be32 tdp; /* Internal */ ++ __be16 tbptr; /* Internal */ ++ __be16 tbc; /* Internal */ ++ __be32 txtmp; /* Internal */ ++ __be32 res; /* Tx temp. */ ++ __be16 rpbase; /* Relocation pointer (CPM1 only) */ ++ __be16 res1; /* Reserved */ ++}; ++ ++/* + * USB Controller pram common to QE and CPM. + */ + struct usb_ctlr { +--- a/arch/powerpc/sysdev/micropatch.c ++++ b/arch/powerpc/sysdev/micropatch.c +@@ -16,6 +16,7 @@ + #include + #include + #include ++#include + #include + + /* +@@ -626,7 +627,7 @@ cpm_load_patch(cpm8xx_t *cp) + volatile uint *dp; /* Dual-ported RAM. */ + volatile cpm8xx_t *commproc; + volatile iic_t *iip; +- volatile spi_t *spp; ++ volatile struct spi_pram *spp; + volatile smc_uart_t *smp; + int i; + +@@ -668,8 +669,8 @@ cpm_load_patch(cpm8xx_t *cp) + /* Put SPI above the IIC, also 32-byte aligned. + */ + i = (RPBASE + sizeof(iic_t) + 31) & ~31; +- spp = (spi_t *)&commproc->cp_dparam[PROFF_SPI]; +- spp->spi_rpbase = i; ++ spp = (struct spi_pram *)&commproc->cp_dparam[PROFF_SPI]; ++ spp->rpbase = i; + + # if defined(CONFIG_I2C_SPI_UCODE_PATCH) + commproc->cp_cpmcr1 = 0x802a; +--- a/drivers/spi/spi_mpc8xxx.c ++++ b/drivers/spi/spi_mpc8xxx.c +@@ -66,28 +66,6 @@ struct mpc8xxx_spi_reg { + __be32 receive; + }; + +-/* SPI Parameter RAM */ +-struct spi_pram { +- __be16 rbase; /* Rx Buffer descriptor base address */ +- __be16 tbase; /* Tx Buffer descriptor base address */ +- u8 rfcr; /* Rx function code */ +- u8 tfcr; /* Tx function code */ +- __be16 mrblr; /* Max receive buffer length */ +- __be32 rstate; /* Internal */ +- __be32 rdp; /* Internal */ +- __be16 rbptr; /* Internal */ +- __be16 rbc; /* Internal */ +- __be32 rxtmp; /* Internal */ +- __be32 tstate; /* Internal */ +- __be32 tdp; /* Internal */ +- __be16 tbptr; /* Internal */ +- __be16 tbc; /* Internal */ +- __be32 txtmp; /* Internal */ +- __be32 res; /* Tx temp. */ +- __be16 rpbase; /* Relocation pointer (CPM1 only) */ +- __be16 res1; /* Reserved */ +-}; +- + /* SPI Controller mode register definitions */ + #define SPMODE_LOOP (1 << 30) + #define SPMODE_CI_INACTIVEHIGH (1 << 29) diff --git a/queue-2.6.34/powerpc-cpm1-fix-build-with-various-config_-_ucode_patch-combinations.patch b/queue-2.6.34/powerpc-cpm1-fix-build-with-various-config_-_ucode_patch-combinations.patch new file mode 100644 index 00000000000..659009aa9fa --- /dev/null +++ b/queue-2.6.34/powerpc-cpm1-fix-build-with-various-config_-_ucode_patch-combinations.patch @@ -0,0 +1,54 @@ +From 2069a6ae19a34d96cc9cb284eb645b165138e03f Mon Sep 17 00:00:00 2001 +From: Anton Vorontsov +Date: Thu, 8 Jul 2010 21:16:14 +0400 +Subject: powerpc/cpm1: Fix build with various CONFIG_*_UCODE_PATCH combinations + +From: Anton Vorontsov + +commit 2069a6ae19a34d96cc9cb284eb645b165138e03f upstream. + +Warnings are treated as errors for arch/powerpc code, so build fails +with CONFIG_I2C_SPI_UCODE_PATCH=y: + + CC arch/powerpc/sysdev/micropatch.o + cc1: warnings being treated as errors + arch/powerpc/sysdev/micropatch.c: In function 'cpm_load_patch': + arch/powerpc/sysdev/micropatch.c:630: warning: unused variable 'smp' + make[1]: *** [arch/powerpc/sysdev/micropatch.o] Error 1 + +And with CONFIG_USB_SOF_UCODE_PATCH=y: + + CC arch/powerpc/sysdev/micropatch.o + cc1: warnings being treated as errors + arch/powerpc/sysdev/micropatch.c: In function 'cpm_load_patch': + arch/powerpc/sysdev/micropatch.c:629: warning: unused variable 'spp' + arch/powerpc/sysdev/micropatch.c:628: warning: unused variable 'iip' + make[1]: *** [arch/powerpc/sysdev/micropatch.o] Error 1 + +This patch fixes these issues by introducing proper #ifdefs. + +Signed-off-by: Anton Vorontsov +Signed-off-by: Kumar Gala +Signed-off-by: Greg Kroah-Hartman + +--- + arch/powerpc/sysdev/micropatch.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/arch/powerpc/sysdev/micropatch.c ++++ b/arch/powerpc/sysdev/micropatch.c +@@ -626,9 +626,14 @@ cpm_load_patch(cpm8xx_t *cp) + { + volatile uint *dp; /* Dual-ported RAM. */ + volatile cpm8xx_t *commproc; ++#if defined(CONFIG_I2C_SPI_UCODE_PATCH) || \ ++ defined(CONFIG_I2C_SPI_SMC1_UCODE_PATCH) + volatile iic_t *iip; + volatile struct spi_pram *spp; ++#ifdef CONFIG_I2C_SPI_SMC1_UCODE_PATCH + volatile smc_uart_t *smp; ++#endif ++#endif + int i; + + commproc = cp; diff --git a/queue-2.6.34/powerpc-fix-logic-error-in-fixup_irqs.patch b/queue-2.6.34/powerpc-fix-logic-error-in-fixup_irqs.patch new file mode 100644 index 00000000000..e86019698c4 --- /dev/null +++ b/queue-2.6.34/powerpc-fix-logic-error-in-fixup_irqs.patch @@ -0,0 +1,39 @@ +From 3cd8519248e9e17d982c6fab0f1a89bca6feb49a Mon Sep 17 00:00:00 2001 +From: Johannes Berg +Date: Wed, 16 Jun 2010 00:09:35 +0000 +Subject: powerpc: Fix logic error in fixup_irqs + +From: Johannes Berg + +commit 3cd8519248e9e17d982c6fab0f1a89bca6feb49a upstream. + +When SPARSE_IRQ is set, irq_to_desc() can +return NULL. While the code here has a +check for NULL, it's not really correct. +Fix it by separating the check for it. + +This fixes CPU hot unplug for me. + +Reported-by: Alastair Bridgewater +Signed-off-by: Johannes Berg +Signed-off-by: Benjamin Herrenschmidt +Signed-off-by: Greg Kroah-Hartman + +--- + arch/powerpc/kernel/irq.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/arch/powerpc/kernel/irq.c ++++ b/arch/powerpc/kernel/irq.c +@@ -294,7 +294,10 @@ void fixup_irqs(cpumask_t map) + cpumask_t mask; + + desc = irq_to_desc(irq); +- if (desc && desc->status & IRQ_PER_CPU) ++ if (!desc) ++ continue; ++ ++ if (desc->status & IRQ_PER_CPU) + continue; + + cpumask_and(&mask, desc->affinity, &map); diff --git a/queue-2.6.34/rtc-fix-ds1388-time-corruption.patch b/queue-2.6.34/rtc-fix-ds1388-time-corruption.patch new file mode 100644 index 00000000000..e60cd129146 --- /dev/null +++ b/queue-2.6.34/rtc-fix-ds1388-time-corruption.patch @@ -0,0 +1,48 @@ +From 96fc3a45ea073136566f3c2676cad52f8b39a7df Mon Sep 17 00:00:00 2001 +From: Joakim Tjernlund +Date: Tue, 29 Jun 2010 15:05:34 -0700 +Subject: rtc: fix ds1388 time corruption + +From: Joakim Tjernlund + +commit 96fc3a45ea073136566f3c2676cad52f8b39a7df upstream. + +The ds1307 driver misreads the ds1388 registers when checking for 12 or 24 +hour mode. Instead of checking the hour register it reads the minute +register. Therefore the driver thinks minutes >= 40 has the 12HR bit set +and resets the minute register by zeroing the high bits. This results in +minutes are reset to 0-9, jumping back in time 40 or 50 minutes. The time +jump is also written back to the RTC. + +Signed-off-by: Joakim Tjernlund +Cc: Wan ZongShun +Cc: Alessandro Zummo +Cc: Paul Gortmaker +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/rtc/rtc-ds1307.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/rtc/rtc-ds1307.c ++++ b/drivers/rtc/rtc-ds1307.c +@@ -775,7 +775,7 @@ static int __devinit ds1307_probe(struct + + read_rtc: + /* read RTC registers */ +- tmp = ds1307->read_block_data(ds1307->client, 0, 8, buf); ++ tmp = ds1307->read_block_data(ds1307->client, ds1307->offset, 8, buf); + if (tmp != 8) { + pr_debug("read error %d\n", tmp); + err = -EIO; +@@ -860,7 +860,7 @@ read_rtc: + if (ds1307->regs[DS1307_REG_HOUR] & DS1307_BIT_PM) + tmp += 12; + i2c_smbus_write_byte_data(client, +- DS1307_REG_HOUR, ++ ds1307->offset + DS1307_REG_HOUR, + bin2bcd(tmp)); + } + diff --git a/queue-2.6.34/sdhci-s3c-add-missing-remove-function.patch b/queue-2.6.34/sdhci-s3c-add-missing-remove-function.patch new file mode 100644 index 00000000000..0962f1c3e9c --- /dev/null +++ b/queue-2.6.34/sdhci-s3c-add-missing-remove-function.patch @@ -0,0 +1,52 @@ +From 9d51a6b2487724e8713cd2794cf09ffeee5f6932 Mon Sep 17 00:00:00 2001 +From: Marek Szyprowski +Date: Tue, 20 Jul 2010 13:24:33 -0700 +Subject: sdhci-s3c: add missing remove function + +From: Marek Szyprowski + +commit 9d51a6b2487724e8713cd2794cf09ffeee5f6932 upstream. + +System will crash sooner or later once the memory with the code of the +s3c-sdhci.ko module is reused for something else. I really have no idea +how the lack of remove function went unnoticed into the mainline code. + +Signed-off-by: Marek Szyprowski +Signed-off-by: Kyungmin Park +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mmc/host/sdhci-s3c.c | 20 ++++++++++++++++++++ + 1 file changed, 20 insertions(+) + +--- a/drivers/mmc/host/sdhci-s3c.c ++++ b/drivers/mmc/host/sdhci-s3c.c +@@ -373,6 +373,26 @@ static int __devinit sdhci_s3c_probe(str + + static int __devexit sdhci_s3c_remove(struct platform_device *pdev) + { ++ struct sdhci_host *host = platform_get_drvdata(pdev); ++ struct sdhci_s3c *sc = sdhci_priv(host); ++ int ptr; ++ ++ sdhci_remove_host(host, 1); ++ ++ for (ptr = 0; ptr < 3; ptr++) { ++ clk_disable(sc->clk_bus[ptr]); ++ clk_put(sc->clk_bus[ptr]); ++ } ++ clk_disable(sc->clk_io); ++ clk_put(sc->clk_io); ++ ++ iounmap(host->ioaddr); ++ release_resource(sc->ioarea); ++ kfree(sc->ioarea); ++ ++ sdhci_free_host(host); ++ platform_set_drvdata(pdev, NULL); ++ + return 0; + } + diff --git a/queue-2.6.34/series b/queue-2.6.34/series index 29b1154d2d1..a13605a1394 100644 --- a/queue-2.6.34/series +++ b/queue-2.6.34/series @@ -92,3 +92,32 @@ cfq-don-t-allow-queue-merges-for-queues-that-have-no-process-references.patch sysvfs-fix-null-deref.-when-allocating-new-inode.patch serial-cpm_uart-implement-the-cpm_uart_early_write-function-for-console-poll.patch um-os-linux-mem.c-needs-sys-stat.h.patch +compiler-gcc.h-gcc-4.5-needs-noclone-and-noinline-on-__naked-functions.patch +rtc-fix-ds1388-time-corruption.patch +ahci-ata_generic-let-ata_generic-handle-new-mbp-w-mcp89.patch +ata_generic-implement-ata_gen_-flags-and-force-enable-dma-on-mbp-7-1.patch +ethtool-fix-potential-kernel-buffer-overflow-in-ethtool_grxclsrlall.patch +powerpc-fix-logic-error-in-fixup_irqs.patch +powerpc-cpm-reintroduce-global-spi_pram-struct-fixes-build-issue.patch +powerpc-cpm1-fix-build-with-various-config_-_ucode_patch-combinations.patch +kmemleak-add-support-for-no_bootmem-configurations.patch +sdhci-s3c-add-missing-remove-function.patch +virtio_net-fix-oom-handling-on-tx.patch +virtio-fix-oops-on-oom.patch +edac-mpc85xx-fix-mpc85xx-dependency.patch +asoc-remove-duplicate-aux-definition-from-wm8776.patch +x86-nobootmem-make-alloc_bootmem_node-fall-back-to-other-node-when-32bit-numa-is-used.patch +input-gamecon-reference-correct-input-device-in-nes-mode.patch +input-gamecon-reference-correct-pad-in-gc_psx_command.patch +x86-fix-x2apic-preenabled-system-with-kexec.patch +ipoib-fix-world-writable-child-interface-control-sysfs-attributes.patch +input-i8042-add-gigabyte-spring-peak-to-dmi_noloop_table.patch +input-twl40300-keypad-fix-handling-of-all-ground-rows.patch +arm-6201-1-realview-do-not-use-outer_sync-on-arm11mpcore-boards-with-l220.patch +arm-6211-1-atomic-ops-fix-register-constraints-for-atomic64_add_unless.patch +arm-6212-1-atomic-ops-add-memory-constraints-to-inline-asm.patch +arm-6226-1-fix-kprobe-bug-in-ldr-instruction-emulation.patch +x86-do-not-try-to-disable-hpet-if-it-hasn-t-been-initialized-before.patch +x86-pci-mrst-add-extra-sanity-check-in-walking-the-pci-extended-cap-chain.patch +x86-kprobes-fix-swapped-segment-registers-in-kretprobe.patch +x86-i8259-only-register-sysdev-if-we-have-a-real-8259-pic.patch diff --git a/queue-2.6.34/virtio-fix-oops-on-oom.patch b/queue-2.6.34/virtio-fix-oops-on-oom.patch new file mode 100644 index 00000000000..538bb67d74f --- /dev/null +++ b/queue-2.6.34/virtio-fix-oops-on-oom.patch @@ -0,0 +1,49 @@ +From 1fe9b6fef11771461e69ecd1bc8935a1c7c90cb5 Mon Sep 17 00:00:00 2001 +From: Michael S. Tsirkin +Date: Mon, 26 Jul 2010 16:55:30 +0930 +Subject: virtio: fix oops on OOM + +From: Michael S. Tsirkin + +commit 1fe9b6fef11771461e69ecd1bc8935a1c7c90cb5 upstream. + +virtio ring was changed to return an error code on OOM, +but one caller was missed and still checks for vq->vring.num. +The fix is just to check for <0 error code. + +Long term it might make sense to change goto add_head to +just return an error on oom instead, but let's apply +a minimal fix for 2.6.35. + +Reported-by: Chris Mason +Signed-off-by: Michael S. Tsirkin +Signed-off-by: Rusty Russell +Tested-by: Chris Mason +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/virtio/virtio_ring.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/drivers/virtio/virtio_ring.c ++++ b/drivers/virtio/virtio_ring.c +@@ -162,7 +162,8 @@ static int vring_add_buf(struct virtqueu + void *data) + { + struct vring_virtqueue *vq = to_vvq(_vq); +- unsigned int i, avail, head, uninitialized_var(prev); ++ unsigned int i, avail, uninitialized_var(prev); ++ int head; + + START_USE(vq); + +@@ -172,7 +173,7 @@ static int vring_add_buf(struct virtqueu + * buffers, then go indirect. FIXME: tune this threshold */ + if (vq->indirect && (out + in) > 1 && vq->num_free) { + head = vring_add_indirect(vq, sg, out, in); +- if (head != vq->vring.num) ++ if (likely(head >= 0)) + goto add_head; + } + diff --git a/queue-2.6.34/virtio_net-fix-oom-handling-on-tx.patch b/queue-2.6.34/virtio_net-fix-oom-handling-on-tx.patch new file mode 100644 index 00000000000..9424e250fc6 --- /dev/null +++ b/queue-2.6.34/virtio_net-fix-oom-handling-on-tx.patch @@ -0,0 +1,65 @@ +From 58eba97d0774c69b1cf3e5a8ac74419409d1abbf Mon Sep 17 00:00:00 2001 +From: Rusty Russell +Date: Fri, 2 Jul 2010 16:34:01 +0000 +Subject: virtio_net: fix oom handling on tx + +From: Rusty Russell + +commit 58eba97d0774c69b1cf3e5a8ac74419409d1abbf upstream. + +virtio net will never try to overflow the TX ring, so the only reason +add_buf may fail is out of memory. Thus, we can not stop the +device until some request completes - there's no guarantee anything +at all is outstanding. + +Make the error message clearer as well: error here does not +indicate queue full. + +Signed-off-by: Michael S. Tsirkin +Signed-off-by: Rusty Russell (...and avoid TX_BUSY) +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + + +--- + drivers/net/virtio_net.c | 21 +++++++++++++-------- + 1 file changed, 13 insertions(+), 8 deletions(-) + +--- a/drivers/net/virtio_net.c ++++ b/drivers/net/virtio_net.c +@@ -566,7 +566,6 @@ static netdev_tx_t start_xmit(struct sk_ + struct virtnet_info *vi = netdev_priv(dev); + int capacity; + +-again: + /* Free up any pending old buffers before queueing new ones. */ + free_old_xmit_skbs(vi); + +@@ -575,14 +574,20 @@ again: + + /* This can happen with OOM and indirect buffers. */ + if (unlikely(capacity < 0)) { +- netif_stop_queue(dev); +- dev_warn(&dev->dev, "Unexpected full queue\n"); +- if (unlikely(!vi->svq->vq_ops->enable_cb(vi->svq))) { +- vi->svq->vq_ops->disable_cb(vi->svq); +- netif_start_queue(dev); +- goto again; ++ if (net_ratelimit()) { ++ if (likely(capacity == -ENOMEM)) { ++ dev_warn(&dev->dev, ++ "TX queue failure: out of memory\n"); ++ } else { ++ dev->stats.tx_fifo_errors++; ++ dev_warn(&dev->dev, ++ "Unexpected TX queue failure: %d\n", ++ capacity); ++ } + } +- return NETDEV_TX_BUSY; ++ dev->stats.tx_dropped++; ++ kfree_skb(skb); ++ return NETDEV_TX_OK; + } + vi->svq->vq_ops->kick(vi->svq); + diff --git a/queue-2.6.34/x86-do-not-try-to-disable-hpet-if-it-hasn-t-been-initialized-before.patch b/queue-2.6.34/x86-do-not-try-to-disable-hpet-if-it-hasn-t-been-initialized-before.patch new file mode 100644 index 00000000000..f0ce7dd3897 --- /dev/null +++ b/queue-2.6.34/x86-do-not-try-to-disable-hpet-if-it-hasn-t-been-initialized-before.patch @@ -0,0 +1,37 @@ +From ff4878089e1eaeac79d57878ad4ea32910fb4037 Mon Sep 17 00:00:00 2001 +From: Stefano Stabellini +Date: Wed, 21 Jul 2010 18:32:37 +0100 +Subject: x86: Do not try to disable hpet if it hasn't been initialized before + +From: Stefano Stabellini + +commit ff4878089e1eaeac79d57878ad4ea32910fb4037 upstream. + +hpet_disable is called unconditionally on machine reboot if hpet support +is compiled in the kernel. +hpet_disable only checks if the machine is hpet capable but doesn't make +sure that hpet has been initialized. + +[ tglx: Made it a one liner and removed the redundant hpet_address check ] + +Signed-off-by: Stefano Stabellini +Acked-by: Venkatesh Pallipadi +LKML-Reference: +Signed-off-by: Thomas Gleixner +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/hpet.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/x86/kernel/hpet.c ++++ b/arch/x86/kernel/hpet.c +@@ -959,7 +959,7 @@ fs_initcall(hpet_late_init); + + void hpet_disable(void) + { +- if (is_hpet_capable()) { ++ if (is_hpet_capable() && hpet_virt_address) { + unsigned int cfg = hpet_readl(HPET_CFG); + + if (hpet_legacy_int_enabled) { diff --git a/queue-2.6.34/x86-fix-x2apic-preenabled-system-with-kexec.patch b/queue-2.6.34/x86-fix-x2apic-preenabled-system-with-kexec.patch new file mode 100644 index 00000000000..f65f24248c5 --- /dev/null +++ b/queue-2.6.34/x86-fix-x2apic-preenabled-system-with-kexec.patch @@ -0,0 +1,53 @@ +From fd19dce7ac07973f700b0f13fb7f94b951414a4c Mon Sep 17 00:00:00 2001 +From: Yinghai Lu +Date: Thu, 15 Jul 2010 00:00:59 -0700 +Subject: x86: Fix x2apic preenabled system with kexec + +From: Yinghai Lu + +commit fd19dce7ac07973f700b0f13fb7f94b951414a4c upstream. + +Found one x2apic system kexec loop test failed +when CONFIG_NMI_WATCHDOG=y (old) or CONFIG_LOCKUP_DETECTOR=y (current tip) + +first kernel can kexec second kernel, but second kernel can not kexec third one. + +it can be duplicated on another system with BIOS preenabled x2apic. +First kernel can not kexec second kernel. + +It turns out, when kernel boot with pre-enabled x2apic, it will not execute +disable_local_APIC on shutdown path. + +when init_apic_mappings() is called in setup_arch, it will skip setting of +apic_phys when x2apic_mode is set. ( x2apic_mode is much early check_x2apic()) +Then later, disable_local_APIC() will bail out early because !apic_phys. + +So check !x2apic_mode in x2apic_mode in disable_local_APIC with !apic_phys. + +another solution could be updating init_apic_mappings() to set apic_phys even +for preenabled x2apic system. Actually even for x2apic system, that lapic +address is mapped already in early stage. + +BTW: is there any x2apic preenabled system with apicid of boot cpu > 255? + +Signed-off-by: Yinghai Lu +LKML-Reference: <4C3EB22B.3000701@kernel.org> +Acked-by: Suresh Siddha +Signed-off-by: H. Peter Anvin +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/apic/apic.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/x86/kernel/apic/apic.c ++++ b/arch/x86/kernel/apic/apic.c +@@ -920,7 +920,7 @@ void disable_local_APIC(void) + unsigned int value; + + /* APIC hasn't been mapped yet */ +- if (!apic_phys) ++ if (!x2apic_mode && !apic_phys) + return; + + clear_local_APIC(); diff --git a/queue-2.6.34/x86-i8259-only-register-sysdev-if-we-have-a-real-8259-pic.patch b/queue-2.6.34/x86-i8259-only-register-sysdev-if-we-have-a-real-8259-pic.patch new file mode 100644 index 00000000000..d787e1cc024 --- /dev/null +++ b/queue-2.6.34/x86-i8259-only-register-sysdev-if-we-have-a-real-8259-pic.patch @@ -0,0 +1,67 @@ +From 087b255a2b43f417af83cb44e0bb02507f36b7fe Mon Sep 17 00:00:00 2001 +From: Adam Lackorzynski +Date: Tue, 20 Jul 2010 15:18:19 -0700 +Subject: x86, i8259: Only register sysdev if we have a real 8259 PIC + +From: Adam Lackorzynski + +commit 087b255a2b43f417af83cb44e0bb02507f36b7fe upstream. + +My platform makes use of the null_legacy_pic choice and oopses when doing +a shutdown as the shutdown code goes through all the registered sysdevs +and calls their shutdown method which in my case poke on a non-existing +i8259. Imho the i8259 specific sysdev should only be registered if the +i8259 is actually there. + +Do not register the sysdev function when the null_legacy_pic is used so +that the i8259 resume, suspend and shutdown functions are not called. + +Signed-off-by: Adam Lackorzynski +LKML-Reference: <201007202218.o6KMIJ3m020955@imap1.linux-foundation.org> +Cc: Jacob Pan +Signed-off-by: Andrew Morton +Signed-off-by: H. Peter Anvin +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/i8259.c | 25 +++++++++++++++---------- + 1 file changed, 15 insertions(+), 10 deletions(-) + +--- a/arch/x86/kernel/i8259.c ++++ b/arch/x86/kernel/i8259.c +@@ -276,16 +276,6 @@ static struct sys_device device_i8259A = + .cls = &i8259_sysdev_class, + }; + +-static int __init i8259A_init_sysfs(void) +-{ +- int error = sysdev_class_register(&i8259_sysdev_class); +- if (!error) +- error = sysdev_register(&device_i8259A); +- return error; +-} +- +-device_initcall(i8259A_init_sysfs); +- + static void mask_8259A(void) + { + unsigned long flags; +@@ -407,3 +397,18 @@ struct legacy_pic default_legacy_pic = { + }; + + struct legacy_pic *legacy_pic = &default_legacy_pic; ++ ++static int __init i8259A_init_sysfs(void) ++{ ++ int error; ++ ++ if (legacy_pic != &default_legacy_pic) ++ return 0; ++ ++ error = sysdev_class_register(&i8259_sysdev_class); ++ if (!error) ++ error = sysdev_register(&device_i8259A); ++ return error; ++} ++ ++device_initcall(i8259A_init_sysfs); diff --git a/queue-2.6.34/x86-kprobes-fix-swapped-segment-registers-in-kretprobe.patch b/queue-2.6.34/x86-kprobes-fix-swapped-segment-registers-in-kretprobe.patch new file mode 100644 index 00000000000..7b56e2bb4e5 --- /dev/null +++ b/queue-2.6.34/x86-kprobes-fix-swapped-segment-registers-in-kretprobe.patch @@ -0,0 +1,33 @@ +From a197479848a2f1a2a5c07cffa6c31ab5e8c82797 Mon Sep 17 00:00:00 2001 +From: Roland McGrath +Date: Fri, 16 Jul 2010 18:17:12 -0700 +Subject: x86: kprobes: fix swapped segment registers in kretprobe + +From: Roland McGrath + +commit a197479848a2f1a2a5c07cffa6c31ab5e8c82797 upstream. + +In commit f007ea26, the order of the %es and %ds segment registers +got accidentally swapped, so synthesized 'struct pt_regs' frames +have the two values inverted. It's almost sure that these values +never matter, and that they also never differ. But wrong is wrong. + +Signed-off-by: Roland McGrath +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/kprobes.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/x86/kernel/kprobes.c ++++ b/arch/x86/kernel/kprobes.c +@@ -632,8 +632,8 @@ static int __kprobes kprobe_handler(stru + /* Skip cs, ip, orig_ax and gs. */ \ + " subl $16, %esp\n" \ + " pushl %fs\n" \ +- " pushl %ds\n" \ + " pushl %es\n" \ ++ " pushl %ds\n" \ + " pushl %eax\n" \ + " pushl %ebp\n" \ + " pushl %edi\n" \ diff --git a/queue-2.6.34/x86-nobootmem-make-alloc_bootmem_node-fall-back-to-other-node-when-32bit-numa-is-used.patch b/queue-2.6.34/x86-nobootmem-make-alloc_bootmem_node-fall-back-to-other-node-when-32bit-numa-is-used.patch new file mode 100644 index 00000000000..607f21ad2a2 --- /dev/null +++ b/queue-2.6.34/x86-nobootmem-make-alloc_bootmem_node-fall-back-to-other-node-when-32bit-numa-is-used.patch @@ -0,0 +1,120 @@ +From b8ab9f82025adea77864115da73e70026fa4f540 Mon Sep 17 00:00:00 2001 +From: Yinghai Lu +Date: Tue, 20 Jul 2010 13:24:31 -0700 +Subject: x86,nobootmem: make alloc_bootmem_node fall back to other node when 32bit numa is used + +From: Yinghai Lu + +commit b8ab9f82025adea77864115da73e70026fa4f540 upstream. + +Borislav Petkov reported his 32bit numa system has problem: + +[ 0.000000] Reserving total of 4c00 pages for numa KVA remap +[ 0.000000] kva_start_pfn ~ 32800 max_low_pfn ~ 375fe +[ 0.000000] max_pfn = 238000 +[ 0.000000] 8202MB HIGHMEM available. +[ 0.000000] 885MB LOWMEM available. +[ 0.000000] mapped low ram: 0 - 375fe000 +[ 0.000000] low ram: 0 - 375fe000 +[ 0.000000] alloc (nid=8 100000 - 7ee00000) (1000000 - ffffffff) 1000 1000 => 34e7000 +[ 0.000000] alloc (nid=8 100000 - 7ee00000) (1000000 - ffffffff) 200 40 => 34c9d80 +[ 0.000000] alloc (nid=0 100000 - 7ee00000) (1000000 - ffffffffffffffff) 180 40 => 34e6140 +[ 0.000000] alloc (nid=1 80000000 - c7e60000) (1000000 - ffffffffffffffff) 240 40 => 80000000 +[ 0.000000] BUG: unable to handle kernel paging request at 40000000 +[ 0.000000] IP: [] __alloc_memory_core_early+0x147/0x1d6 +[ 0.000000] *pdpt = 0000000000000000 *pde = f000ff53f000ff00 +... +[ 0.000000] Call Trace: +[ 0.000000] [] ? __alloc_bootmem_node+0x216/0x22f +[ 0.000000] [] ? sparse_early_usemaps_alloc_node+0x5a/0x10b +[ 0.000000] [] ? sparse_init+0x1dc/0x499 +[ 0.000000] [] ? paging_init+0x168/0x1df +[ 0.000000] [] ? native_pagetable_setup_start+0xef/0x1bb + +looks like it allocates too much high address for bootmem. + +Try to cut limit with get_max_mapped() + +Reported-by: Borislav Petkov +Tested-by: Conny Seidel +Signed-off-by: Yinghai Lu +Cc: Ingo Molnar +Cc: "H. Peter Anvin" +Cc: Thomas Gleixner +Cc: Johannes Weiner +Cc: Lee Schermerhorn +Cc: Mel Gorman +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/bootmem.c | 24 ++++++++++++++++++++---- + mm/page_alloc.c | 3 +++ + 2 files changed, 23 insertions(+), 4 deletions(-) + +--- a/mm/bootmem.c ++++ b/mm/bootmem.c +@@ -833,15 +833,24 @@ static void * __init ___alloc_bootmem_no + void * __init __alloc_bootmem_node(pg_data_t *pgdat, unsigned long size, + unsigned long align, unsigned long goal) + { ++ void *ptr; ++ + if (WARN_ON_ONCE(slab_is_available())) + return kzalloc_node(size, GFP_NOWAIT, pgdat->node_id); + + #ifdef CONFIG_NO_BOOTMEM +- return __alloc_memory_core_early(pgdat->node_id, size, align, ++ ptr = __alloc_memory_core_early(pgdat->node_id, size, align, ++ goal, -1ULL); ++ if (ptr) ++ return ptr; ++ ++ ptr = __alloc_memory_core_early(MAX_NUMNODES, size, align, + goal, -1ULL); + #else +- return ___alloc_bootmem_node(pgdat->bdata, size, align, goal, 0); ++ ptr = ___alloc_bootmem_node(pgdat->bdata, size, align, goal, 0); + #endif ++ ++ return ptr; + } + + void * __init __alloc_bootmem_node_high(pg_data_t *pgdat, unsigned long size, +@@ -977,14 +986,21 @@ void * __init __alloc_bootmem_low(unsign + void * __init __alloc_bootmem_low_node(pg_data_t *pgdat, unsigned long size, + unsigned long align, unsigned long goal) + { ++ void *ptr; ++ + if (WARN_ON_ONCE(slab_is_available())) + return kzalloc_node(size, GFP_NOWAIT, pgdat->node_id); + + #ifdef CONFIG_NO_BOOTMEM +- return __alloc_memory_core_early(pgdat->node_id, size, align, ++ ptr = __alloc_memory_core_early(pgdat->node_id, size, align, ++ goal, ARCH_LOW_ADDRESS_LIMIT); ++ if (ptr) ++ return ptr; ++ ptr = __alloc_memory_core_early(MAX_NUMNODES, size, align, + goal, ARCH_LOW_ADDRESS_LIMIT); + #else +- return ___alloc_bootmem_node(pgdat->bdata, size, align, ++ ptr = ___alloc_bootmem_node(pgdat->bdata, size, align, + goal, ARCH_LOW_ADDRESS_LIMIT); + #endif ++ return ptr; + } +--- a/mm/page_alloc.c ++++ b/mm/page_alloc.c +@@ -3415,6 +3415,9 @@ void * __init __alloc_memory_core_early( + int i; + void *ptr; + ++ if (limit > get_max_mapped()) ++ limit = get_max_mapped(); ++ + /* need to go over early_node_map to find out good range for node */ + for_each_active_range_index_in_nid(i, nid) { + u64 addr; diff --git a/queue-2.6.34/x86-pci-mrst-add-extra-sanity-check-in-walking-the-pci-extended-cap-chain.patch b/queue-2.6.34/x86-pci-mrst-add-extra-sanity-check-in-walking-the-pci-extended-cap-chain.patch new file mode 100644 index 00000000000..67dbfe84bae --- /dev/null +++ b/queue-2.6.34/x86-pci-mrst-add-extra-sanity-check-in-walking-the-pci-extended-cap-chain.patch @@ -0,0 +1,52 @@ +From f82c3d71d6fd2e6a3e3416f09099e29087e39abf Mon Sep 17 00:00:00 2001 +From: Jacob Pan +Date: Fri, 16 Jul 2010 11:58:26 -0700 +Subject: x86, pci, mrst: Add extra sanity check in walking the PCI extended cap chain + +From: Jacob Pan + +commit f82c3d71d6fd2e6a3e3416f09099e29087e39abf upstream. + +The fixed bar capability structure is searched in PCI extended +configuration space. We need to make sure there is a valid capability +ID to begin with otherwise, the search code may stuck in a infinite +loop which results in boot hang. This patch adds additional check for +cap ID 0, which is also invalid, and indicates end of chain. + +End of chain is supposed to have all fields zero, but that doesn't +seem to always be the case in the field. + +Suggested-by: "H. Peter Anvin" +Signed-off-by: Jacob Pan +Reviewed-by: Jesse Barnes +LKML-Reference: <1279306706-27087-1-git-send-email-jacob.jun.pan@linux.intel.com> +Signed-off-by: H. Peter Anvin +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/pci/mrst.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +--- a/arch/x86/pci/mrst.c ++++ b/arch/x86/pci/mrst.c +@@ -66,8 +66,9 @@ static int fixed_bar_cap(struct pci_bus + devfn, pos, 4, &pcie_cap)) + return 0; + +- if (pcie_cap == 0xffffffff) +- return 0; ++ if (PCI_EXT_CAP_ID(pcie_cap) == 0x0000 || ++ PCI_EXT_CAP_ID(pcie_cap) == 0xffff) ++ break; + + if (PCI_EXT_CAP_ID(pcie_cap) == PCI_EXT_CAP_ID_VNDR) { + raw_pci_ext_ops->read(pci_domain_nr(bus), bus->number, +@@ -76,7 +77,7 @@ static int fixed_bar_cap(struct pci_bus + return pos; + } + +- pos = pcie_cap >> 20; ++ pos = PCI_EXT_CAP_NEXT(pcie_cap); + } + + return 0;