From: Greg Kroah-Hartman Date: Fri, 22 Apr 2011 20:22:11 +0000 (-0700) Subject: .38 patches X-Git-Tag: v2.6.38.5~7 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=936a137a1be296626a2b71d1ccdb6eeb7668f068;p=thirdparty%2Fkernel%2Fstable-queue.git .38 patches --- diff --git a/queue-2.6.38/ath-add-missing-regdomain-pair-0x5c-mapping.patch b/queue-2.6.38/ath-add-missing-regdomain-pair-0x5c-mapping.patch new file mode 100644 index 00000000000..c817b3bcb24 --- /dev/null +++ b/queue-2.6.38/ath-add-missing-regdomain-pair-0x5c-mapping.patch @@ -0,0 +1,41 @@ +From bd39a274fb7b43374c797bafdb7f506598f36f77 Mon Sep 17 00:00:00 2001 +From: Christian Lamparter +Date: Wed, 6 Apr 2011 20:40:31 +0200 +Subject: ath: add missing regdomain pair 0x5c mapping + +From: Christian Lamparter + +commit bd39a274fb7b43374c797bafdb7f506598f36f77 upstream. + +Joe Culler reported a problem with his AR9170 device: + +> ath: EEPROM regdomain: 0x5c +> ath: EEPROM indicates we should expect a direct regpair map +> ath: invalid regulatory domain/country code 0x5c +> ath: Invalid EEPROM contents + +It turned out that the regdomain 'APL7_FCCA' was not mapped yet. +According to Luis R. Rodriguez [Atheros' engineer] APL7 maps to +FCC_CTL and FCCA maps to FCC_CTL as well, so the attached patch +should be correct. + +Reported-by: Joe Culler +Acked-by: Luis R. Rodriguez +Signed-off-by: Christian Lamparter +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/ath/regd_common.h | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/wireless/ath/regd_common.h ++++ b/drivers/net/wireless/ath/regd_common.h +@@ -195,6 +195,7 @@ static struct reg_dmn_pair_mapping regDo + {APL9_WORLD, CTL_ETSI, CTL_ETSI}, + + {APL3_FCCA, CTL_FCC, CTL_FCC}, ++ {APL7_FCCA, CTL_FCC, CTL_FCC}, + {APL1_ETSIC, CTL_FCC, CTL_ETSI}, + {APL2_ETSIC, CTL_FCC, CTL_ETSI}, + {APL2_APLD, CTL_FCC, NO_CTL}, diff --git a/queue-2.6.38/ath9k_hw-fix-stopping-rx-dma-during-resets.patch b/queue-2.6.38/ath9k_hw-fix-stopping-rx-dma-during-resets.patch new file mode 100644 index 00000000000..bfb02890c13 --- /dev/null +++ b/queue-2.6.38/ath9k_hw-fix-stopping-rx-dma-during-resets.patch @@ -0,0 +1,152 @@ +From 5882da02e9d9089b7e8c739f3e774aaeeff8b7ba Mon Sep 17 00:00:00 2001 +From: Felix Fietkau +Date: Fri, 8 Apr 2011 20:13:18 +0200 +Subject: ath9k_hw: fix stopping rx DMA during resets + +From: Felix Fietkau + +commit 5882da02e9d9089b7e8c739f3e774aaeeff8b7ba upstream. + +During PHY errors, the MAC can sometimes fail to enter an idle state on older +hardware (before AR9380) after an rx stop has been requested. + +This typically shows up in the kernel log with messages like these: + +ath: Could not stop RX, we could be confusing the DMA engine when we start RX up +------------[ cut here ]------------ +WARNING: at drivers/net/wireless/ath/ath9k/recv.c:504 ath_stoprecv+0xcc/0xf0 [ath9k]() +Call Trace: +[<8023f0e8>] dump_stack+0x8/0x34 +[<80075050>] warn_slowpath_common+0x78/0xa4 +[<80075094>] warn_slowpath_null+0x18/0x24 +[<80d66d60>] ath_stoprecv+0xcc/0xf0 [ath9k] +[<80d642cc>] ath_set_channel+0xbc/0x270 [ath9k] +[<80d65254>] ath_radio_disable+0x4a4/0x7fc [ath9k] + +When this happens, the state that the MAC enters is easy to identify and +does not result in bogus DMA traffic, however to ensure a working state +after a channel change, the hardware should still be reset. + +This patch adds detection for this specific MAC state, after which the above +warnings completely disappear in my tests. + +Signed-off-by: Felix Fietkau +Cc: Kyungwan Nam +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/ath/ath9k/hw.c | 9 --------- + drivers/net/wireless/ath/ath9k/mac.c | 25 ++++++++++++++++++++++--- + drivers/net/wireless/ath/ath9k/mac.h | 2 +- + drivers/net/wireless/ath/ath9k/recv.c | 6 +++--- + 4 files changed, 26 insertions(+), 16 deletions(-) + +--- a/drivers/net/wireless/ath/ath9k/hw.c ++++ b/drivers/net/wireless/ath/ath9k/hw.c +@@ -1218,15 +1218,6 @@ int ath9k_hw_reset(struct ath_hw *ah, st + ah->txchainmask = common->tx_chainmask; + ah->rxchainmask = common->rx_chainmask; + +- if ((common->bus_ops->ath_bus_type != ATH_USB) && !ah->chip_fullsleep) { +- ath9k_hw_abortpcurecv(ah); +- if (!ath9k_hw_stopdmarecv(ah)) { +- ath_dbg(common, ATH_DBG_XMIT, +- "Failed to stop receive dma\n"); +- bChannelChange = false; +- } +- } +- + if (!ath9k_hw_setpower(ah, ATH9K_PM_AWAKE)) + return -EIO; + +--- a/drivers/net/wireless/ath/ath9k/mac.c ++++ b/drivers/net/wireless/ath/ath9k/mac.c +@@ -770,28 +770,47 @@ void ath9k_hw_abortpcurecv(struct ath_hw + } + EXPORT_SYMBOL(ath9k_hw_abortpcurecv); + +-bool ath9k_hw_stopdmarecv(struct ath_hw *ah) ++bool ath9k_hw_stopdmarecv(struct ath_hw *ah, bool *reset) + { + #define AH_RX_STOP_DMA_TIMEOUT 10000 /* usec */ + #define AH_RX_TIME_QUANTUM 100 /* usec */ + struct ath_common *common = ath9k_hw_common(ah); ++ u32 mac_status, last_mac_status = 0; + int i; + ++ /* Enable access to the DMA observation bus */ ++ REG_WRITE(ah, AR_MACMISC, ++ ((AR_MACMISC_DMA_OBS_LINE_8 << AR_MACMISC_DMA_OBS_S) | ++ (AR_MACMISC_MISC_OBS_BUS_1 << ++ AR_MACMISC_MISC_OBS_BUS_MSB_S))); ++ + REG_WRITE(ah, AR_CR, AR_CR_RXD); + + /* Wait for rx enable bit to go low */ + for (i = AH_RX_STOP_DMA_TIMEOUT / AH_TIME_QUANTUM; i != 0; i--) { + if ((REG_READ(ah, AR_CR) & AR_CR_RXE) == 0) + break; ++ ++ if (!AR_SREV_9300_20_OR_LATER(ah)) { ++ mac_status = REG_READ(ah, AR_DMADBG_7) & 0x7f0; ++ if (mac_status == 0x1c0 && mac_status == last_mac_status) { ++ *reset = true; ++ break; ++ } ++ ++ last_mac_status = mac_status; ++ } ++ + udelay(AH_TIME_QUANTUM); + } + + if (i == 0) { + ath_err(common, +- "DMA failed to stop in %d ms AR_CR=0x%08x AR_DIAG_SW=0x%08x\n", ++ "DMA failed to stop in %d ms AR_CR=0x%08x AR_DIAG_SW=0x%08x DMADBG_7=0x%08x\n", + AH_RX_STOP_DMA_TIMEOUT / 1000, + REG_READ(ah, AR_CR), +- REG_READ(ah, AR_DIAG_SW)); ++ REG_READ(ah, AR_DIAG_SW), ++ REG_READ(ah, AR_DMADBG_7)); + return false; + } else { + return true; +--- a/drivers/net/wireless/ath/ath9k/mac.h ++++ b/drivers/net/wireless/ath/ath9k/mac.h +@@ -692,7 +692,7 @@ bool ath9k_hw_setrxabort(struct ath_hw * + void ath9k_hw_putrxbuf(struct ath_hw *ah, u32 rxdp); + void ath9k_hw_startpcureceive(struct ath_hw *ah, bool is_scanning); + void ath9k_hw_abortpcurecv(struct ath_hw *ah); +-bool ath9k_hw_stopdmarecv(struct ath_hw *ah); ++bool ath9k_hw_stopdmarecv(struct ath_hw *ah, bool *reset); + int ath9k_hw_beaconq_setup(struct ath_hw *ah); + + /* Interrupt Handling */ +--- a/drivers/net/wireless/ath/ath9k/recv.c ++++ b/drivers/net/wireless/ath/ath9k/recv.c +@@ -513,12 +513,12 @@ start_recv: + bool ath_stoprecv(struct ath_softc *sc) + { + struct ath_hw *ah = sc->sc_ah; +- bool stopped; ++ bool stopped, reset = false; + + spin_lock_bh(&sc->rx.rxbuflock); + ath9k_hw_abortpcurecv(ah); + ath9k_hw_setrxfilter(ah, 0); +- stopped = ath9k_hw_stopdmarecv(ah); ++ stopped = ath9k_hw_stopdmarecv(ah, &reset); + + if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_EDMA) + ath_edma_stop_recv(sc); +@@ -533,7 +533,7 @@ bool ath_stoprecv(struct ath_softc *sc) + "confusing the DMA engine when we start RX up\n"); + ATH_DBG_WARN_ON_ONCE(!stopped); + } +- return stopped; ++ return stopped || reset; + } + + void ath_flushrecv(struct ath_softc *sc) diff --git a/queue-2.6.38/block-blk-sysfs-fix-an-err-return-path-in-blk_register_queue.patch b/queue-2.6.38/block-blk-sysfs-fix-an-err-return-path-in-blk_register_queue.patch new file mode 100644 index 00000000000..437fa1e2570 --- /dev/null +++ b/queue-2.6.38/block-blk-sysfs-fix-an-err-return-path-in-blk_register_queue.patch @@ -0,0 +1,34 @@ +From ed5302d3c25006a9edc7a7fbea97a30483f89ef7 Mon Sep 17 00:00:00 2001 +From: Liu Yuan +Date: Tue, 19 Apr 2011 13:47:58 +0200 +Subject: block, blk-sysfs: Fix an err return path in blk_register_queue() + +From: Liu Yuan + +commit ed5302d3c25006a9edc7a7fbea97a30483f89ef7 upstream. + +We do not call blk_trace_remove_sysfs() in err return path +if kobject_add() fails. This path fixes it. + +Signed-off-by: Liu Yuan +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman + +--- + block/blk-sysfs.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/block/blk-sysfs.c ++++ b/block/blk-sysfs.c +@@ -511,8 +511,10 @@ int blk_register_queue(struct gendisk *d + return ret; + + ret = kobject_add(&q->kobj, kobject_get(&dev->kobj), "%s", "queue"); +- if (ret < 0) ++ if (ret < 0) { ++ blk_trace_remove_sysfs(dev); + return ret; ++ } + + kobject_uevent(&q->kobj, KOBJ_ADD); + diff --git a/queue-2.6.38/drm-i915-sanitize-the-output-registers-after-resume.patch b/queue-2.6.38/drm-i915-sanitize-the-output-registers-after-resume.patch new file mode 100644 index 00000000000..a92df18c7ba --- /dev/null +++ b/queue-2.6.38/drm-i915-sanitize-the-output-registers-after-resume.patch @@ -0,0 +1,124 @@ +From f6e5b1603b8bb7131b6778d0d4e2e5dda120a379 Mon Sep 17 00:00:00 2001 +From: Chris Wilson +Date: Tue, 12 Apr 2011 18:06:51 +0100 +Subject: drm/i915: Sanitize the output registers after resume + +From: Chris Wilson + +commit f6e5b1603b8bb7131b6778d0d4e2e5dda120a379 upstream. + +Similar to booting, we need to inspect the state left by the BIOS and +remove any conflicting bits before we take over. The example reported by +Seth Forshee is very similar to the bug we encountered with the state left +by grub2, that the crtc pipe<->planning mapping was reversed from our +expectations and so we failed to turn off the outputs when booting or, +in this case, resuming. This may be in fact the same bug, but triggered +at resume time. + +This patch rearranges the code we already have to clear up the +conflicting state upon init and calls it from reset (which is called +after we have lost control of the hardware, i.e. along both the boot and +resume paths) instead. + +Reported-and-tested-by: Seth Forshee +Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=35796 +Signed-off-by: Chris Wilson +Reviewed-by: Keith Packard +Signed-off-by: Keith Packard +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/intel_display.c | 68 ++++++++++++++++++----------------- + 1 file changed, 36 insertions(+), 32 deletions(-) + +--- a/drivers/gpu/drm/i915/intel_display.c ++++ b/drivers/gpu/drm/i915/intel_display.c +@@ -5630,36 +5630,6 @@ cleanup_work: + return ret; + } + +-static void intel_crtc_reset(struct drm_crtc *crtc) +-{ +- struct intel_crtc *intel_crtc = to_intel_crtc(crtc); +- +- /* Reset flags back to the 'unknown' status so that they +- * will be correctly set on the initial modeset. +- */ +- intel_crtc->dpms_mode = -1; +-} +- +-static struct drm_crtc_helper_funcs intel_helper_funcs = { +- .dpms = intel_crtc_dpms, +- .mode_fixup = intel_crtc_mode_fixup, +- .mode_set = intel_crtc_mode_set, +- .mode_set_base = intel_pipe_set_base, +- .mode_set_base_atomic = intel_pipe_set_base_atomic, +- .load_lut = intel_crtc_load_lut, +- .disable = intel_crtc_disable, +-}; +- +-static const struct drm_crtc_funcs intel_crtc_funcs = { +- .reset = intel_crtc_reset, +- .cursor_set = intel_crtc_cursor_set, +- .cursor_move = intel_crtc_cursor_move, +- .gamma_set = intel_crtc_gamma_set, +- .set_config = drm_crtc_helper_set_config, +- .destroy = intel_crtc_destroy, +- .page_flip = intel_crtc_page_flip, +-}; +- + static void intel_sanitize_modesetting(struct drm_device *dev, + int pipe, int plane) + { +@@ -5710,6 +5680,42 @@ static void intel_sanitize_modesetting(s + } + } + ++static void intel_crtc_reset(struct drm_crtc *crtc) ++{ ++ struct drm_device *dev = crtc->dev; ++ struct intel_crtc *intel_crtc = to_intel_crtc(crtc); ++ ++ /* Reset flags back to the 'unknown' status so that they ++ * will be correctly set on the initial modeset. ++ */ ++ intel_crtc->dpms_mode = -1; ++ ++ /* We need to fix up any BIOS configuration that conflicts with ++ * our expectations. ++ */ ++ intel_sanitize_modesetting(dev, intel_crtc->pipe, intel_crtc->plane); ++} ++ ++static struct drm_crtc_helper_funcs intel_helper_funcs = { ++ .dpms = intel_crtc_dpms, ++ .mode_fixup = intel_crtc_mode_fixup, ++ .mode_set = intel_crtc_mode_set, ++ .mode_set_base = intel_pipe_set_base, ++ .mode_set_base_atomic = intel_pipe_set_base_atomic, ++ .load_lut = intel_crtc_load_lut, ++ .disable = intel_crtc_disable, ++}; ++ ++static const struct drm_crtc_funcs intel_crtc_funcs = { ++ .reset = intel_crtc_reset, ++ .cursor_set = intel_crtc_cursor_set, ++ .cursor_move = intel_crtc_cursor_move, ++ .gamma_set = intel_crtc_gamma_set, ++ .set_config = drm_crtc_helper_set_config, ++ .destroy = intel_crtc_destroy, ++ .page_flip = intel_crtc_page_flip, ++}; ++ + static void intel_crtc_init(struct drm_device *dev, int pipe) + { + drm_i915_private_t *dev_priv = dev->dev_private; +@@ -5759,8 +5765,6 @@ static void intel_crtc_init(struct drm_d + + setup_timer(&intel_crtc->idle_timer, intel_crtc_idle_timer, + (unsigned long)intel_crtc); +- +- intel_sanitize_modesetting(dev, intel_crtc->pipe, intel_crtc->plane); + } + + int intel_get_pipe_from_crtc_id(struct drm_device *dev, void *data, diff --git a/queue-2.6.38/drm-i915-tv-remember-the-detected-tv-type.patch b/queue-2.6.38/drm-i915-tv-remember-the-detected-tv-type.patch new file mode 100644 index 00000000000..0497c3e7664 --- /dev/null +++ b/queue-2.6.38/drm-i915-tv-remember-the-detected-tv-type.patch @@ -0,0 +1,41 @@ +From d5627663f2088fa4be447fdcfd52bcb233448d85 Mon Sep 17 00:00:00 2001 +From: Mathew McKernan +Date: Tue, 12 Apr 2011 06:51:37 +0100 +Subject: drm/i915/tv: Remember the detected TV type + +From: Mathew McKernan + +commit d5627663f2088fa4be447fdcfd52bcb233448d85 upstream. + +During detect() we would probe the connection bits to determine if +there was a TV attached, and what video input type (Component, S-Video, +Composite, etc) to use. However, we promptly discarded this vital bit of +information and never propagated it to where it was used to determine +the correct modes and setup the control registers. Fix it! + +This fixes a regression from 7b334fcb45b757ffb093696ca3de1b0c8b4a33f1. + +Reported-and-tested-by: Mathew McKernan +Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=35977 +Signed-off-by: Mathew McKernan +Signed-off-by: Chris Wilson +Acked-by: Paul Menzel +Signed-off-by: Keith Packard +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/intel_tv.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/gpu/drm/i915/intel_tv.c ++++ b/drivers/gpu/drm/i915/intel_tv.c +@@ -1380,7 +1380,9 @@ intel_tv_detect(struct drm_connector *co + if (type < 0) + return connector_status_disconnected; + ++ intel_tv->type = type; + intel_tv_find_better_format(connector); ++ + return connector_status_connected; + } + diff --git a/queue-2.6.38/drm-nouveau-fix-notifier-memory-corruption-bug.patch b/queue-2.6.38/drm-nouveau-fix-notifier-memory-corruption-bug.patch new file mode 100644 index 00000000000..4a59e09bb68 --- /dev/null +++ b/queue-2.6.38/drm-nouveau-fix-notifier-memory-corruption-bug.patch @@ -0,0 +1,45 @@ +From a18d89ca026140eb8ac4459bf70a01c571dd9a32 Mon Sep 17 00:00:00 2001 +From: Marcin Slusarz +Date: Tue, 19 Apr 2011 23:50:48 +0200 +Subject: drm/nouveau: fix notifier memory corruption bug + +From: Marcin Slusarz + +commit a18d89ca026140eb8ac4459bf70a01c571dd9a32 upstream. + +nouveau_bo_wr32 expects offset to be in words, but we pass value in bytes, +so after commit 73412c3854c877e5f37ad944ee8977addde4d35a ("drm/nouveau: allocate +kernel's notifier object at end of block") we started to overwrite some memory +after notifier buffer object (previously m2mf_ntfy was always 0, so it didn't +matter it was a value in bytes). + +Reported-by: Dominik Brodowski +Reported-by: Nigel Cunningham +Signed-off-by: Marcin Slusarz +Cc: Ben Skeggs +Cc: Pekka Paalanen +Signed-off-by: Ben Skeggs +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/nouveau/nouveau_fbcon.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/nouveau/nouveau_fbcon.c ++++ b/drivers/gpu/drm/nouveau/nouveau_fbcon.c +@@ -181,13 +181,13 @@ nouveau_fbcon_sync(struct fb_info *info) + OUT_RING (chan, 0); + } + +- nouveau_bo_wr32(chan->notifier_bo, chan->m2mf_ntfy + 3, 0xffffffff); ++ nouveau_bo_wr32(chan->notifier_bo, chan->m2mf_ntfy/4 + 3, 0xffffffff); + FIRE_RING(chan); + mutex_unlock(&chan->mutex); + + ret = -EBUSY; + for (i = 0; i < 100000; i++) { +- if (!nouveau_bo_rd32(chan->notifier_bo, chan->m2mf_ntfy + 3)) { ++ if (!nouveau_bo_rd32(chan->notifier_bo, chan->m2mf_ntfy/4 + 3)) { + ret = 0; + break; + } diff --git a/queue-2.6.38/drm-radeon-kms-fix-bad-shift-in-atom-iio-table-parser.patch b/queue-2.6.38/drm-radeon-kms-fix-bad-shift-in-atom-iio-table-parser.patch new file mode 100644 index 00000000000..aa40047c383 --- /dev/null +++ b/queue-2.6.38/drm-radeon-kms-fix-bad-shift-in-atom-iio-table-parser.patch @@ -0,0 +1,48 @@ +From 8e461123f28e6b17456225e70eb834b3b30d28bb Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Thu, 14 Apr 2011 11:19:50 -0400 +Subject: drm/radeon/kms: fix bad shift in atom iio table parser + +From: Alex Deucher + +commit 8e461123f28e6b17456225e70eb834b3b30d28bb upstream. + +Noticed by Patrick Lowry. + +Signed-off-by: Alex Deucher +Signed-off-by: Dave Airlie +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/radeon/atom.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/gpu/drm/radeon/atom.c ++++ b/drivers/gpu/drm/radeon/atom.c +@@ -135,7 +135,7 @@ static uint32_t atom_iio_execute(struct + case ATOM_IIO_MOVE_INDEX: + temp &= + ~((0xFFFFFFFF >> (32 - CU8(base + 1))) << +- CU8(base + 2)); ++ CU8(base + 3)); + temp |= + ((index >> CU8(base + 2)) & + (0xFFFFFFFF >> (32 - CU8(base + 1)))) << CU8(base + +@@ -145,7 +145,7 @@ static uint32_t atom_iio_execute(struct + case ATOM_IIO_MOVE_DATA: + temp &= + ~((0xFFFFFFFF >> (32 - CU8(base + 1))) << +- CU8(base + 2)); ++ CU8(base + 3)); + temp |= + ((data >> CU8(base + 2)) & + (0xFFFFFFFF >> (32 - CU8(base + 1)))) << CU8(base + +@@ -155,7 +155,7 @@ static uint32_t atom_iio_execute(struct + case ATOM_IIO_MOVE_ATTR: + temp &= + ~((0xFFFFFFFF >> (32 - CU8(base + 1))) << +- CU8(base + 2)); ++ CU8(base + 3)); + temp |= + ((ctx-> + io_attr >> CU8(base + 2)) & (0xFFFFFFFF >> (32 - diff --git a/queue-2.6.38/drm-radeon-kms-pll-tweaks-for-r7xx.patch b/queue-2.6.38/drm-radeon-kms-pll-tweaks-for-r7xx.patch new file mode 100644 index 00000000000..7e403b2fd48 --- /dev/null +++ b/queue-2.6.38/drm-radeon-kms-pll-tweaks-for-r7xx.patch @@ -0,0 +1,44 @@ +From 5785e53ffa73f77fb19e378c899027afc07272bc Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Tue, 19 Apr 2011 15:24:59 -0400 +Subject: drm/radeon/kms: pll tweaks for r7xx + +From: Alex Deucher + +commit 5785e53ffa73f77fb19e378c899027afc07272bc upstream. + +Prefer min m to max p only on pre-r7xx asics. + +Fixes: +https://bugs.freedesktop.org/show_bug.cgi?id=36197 + +Signed-off-by: Alex Deucher +Signed-off-by: Dave Airlie +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/radeon/atombios_crtc.c | 6 +----- + 1 file changed, 1 insertion(+), 5 deletions(-) + +--- a/drivers/gpu/drm/radeon/atombios_crtc.c ++++ b/drivers/gpu/drm/radeon/atombios_crtc.c +@@ -532,10 +532,7 @@ static u32 atombios_adjust_pll(struct dr + else + pll->flags |= RADEON_PLL_PREFER_LOW_REF_DIV; + +- if ((rdev->family == CHIP_R600) || +- (rdev->family == CHIP_RV610) || +- (rdev->family == CHIP_RV630) || +- (rdev->family == CHIP_RV670)) ++ if (rdev->family < CHIP_RV770) + pll->flags |= RADEON_PLL_PREFER_MINM_OVER_MAXP; + } else { + pll->flags |= RADEON_PLL_LEGACY; +@@ -565,7 +562,6 @@ static u32 atombios_adjust_pll(struct dr + if (radeon_encoder->devices & (ATOM_DEVICE_LCD_SUPPORT)) { + if (ss_enabled) { + if (ss->refdiv) { +- pll->flags |= RADEON_PLL_PREFER_MINM_OVER_MAXP; + pll->flags |= RADEON_PLL_USE_REF_DIV; + pll->reference_div = ss->refdiv; + if (ASIC_IS_AVIVO(rdev)) diff --git a/queue-2.6.38/intel-iommu-fix-get_domain_for_dev-error-path.patch b/queue-2.6.38/intel-iommu-fix-get_domain_for_dev-error-path.patch new file mode 100644 index 00000000000..f66d4d2acc2 --- /dev/null +++ b/queue-2.6.38/intel-iommu-fix-get_domain_for_dev-error-path.patch @@ -0,0 +1,35 @@ +From 2fe9723df8e45fd247782adea244a5e653c30bf4 Mon Sep 17 00:00:00 2001 +From: Alex Williamson +Date: Fri, 4 Mar 2011 14:52:30 -0700 +Subject: intel-iommu: Fix get_domain_for_dev() error path + +From: Alex Williamson + +commit 2fe9723df8e45fd247782adea244a5e653c30bf4 upstream. + +If we run out of domain_ids and fail iommu_attach_domain(), we +fall into domain_exit() without having setup enough of the +domain structure for this to do anything useful. In fact, it +typically runs off into the weeds walking the bogus domain->devices +list. Just free the domain. + +Signed-off-by: Alex Williamson +Acked-by: Donald Dutile +Signed-off-by: David Woodhouse +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pci/intel-iommu.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/pci/intel-iommu.c ++++ b/drivers/pci/intel-iommu.c +@@ -1835,7 +1835,7 @@ static struct dmar_domain *get_domain_fo + + ret = iommu_attach_domain(domain, iommu); + if (ret) { +- domain_exit(domain); ++ free_domain_mem(domain); + goto error; + } + diff --git a/queue-2.6.38/intel-iommu-fix-use-after-release-during-device-attach.patch b/queue-2.6.38/intel-iommu-fix-use-after-release-during-device-attach.patch new file mode 100644 index 00000000000..3c1962b222b --- /dev/null +++ b/queue-2.6.38/intel-iommu-fix-use-after-release-during-device-attach.patch @@ -0,0 +1,34 @@ +From 7a6610139a1e1d9297dd1c5d178022eac36839cb Mon Sep 17 00:00:00 2001 +From: Jan Kiszka +Date: Tue, 2 Nov 2010 08:05:51 +0100 +Subject: intel-iommu: Fix use after release during device attach + +From: Jan Kiszka + +commit 7a6610139a1e1d9297dd1c5d178022eac36839cb upstream. + +Obtain the new pgd pointer before releasing the page containing this +value. + +Signed-off-by: Jan Kiszka +Reviewed-by: Sheng Yang +Signed-off-by: David Woodhouse +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pci/intel-iommu.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/pci/intel-iommu.c ++++ b/drivers/pci/intel-iommu.c +@@ -3627,9 +3627,9 @@ static int intel_iommu_attach_device(str + + pte = dmar_domain->pgd; + if (dma_pte_present(pte)) { +- free_pgtable_page(dmar_domain->pgd); + dmar_domain->pgd = (struct dma_pte *) + phys_to_virt(dma_pte_addr(pte)); ++ free_pgtable_page(pte); + } + dmar_domain->agaw--; + } diff --git a/queue-2.6.38/intel-iommu-unlink-domain-from-iommu.patch b/queue-2.6.38/intel-iommu-unlink-domain-from-iommu.patch new file mode 100644 index 00000000000..8bbbcac232d --- /dev/null +++ b/queue-2.6.38/intel-iommu-unlink-domain-from-iommu.patch @@ -0,0 +1,55 @@ +From a97590e56d0d58e1dd262353f7cbd84e81d8e600 Mon Sep 17 00:00:00 2001 +From: Alex Williamson +Date: Fri, 4 Mar 2011 14:52:16 -0700 +Subject: intel-iommu: Unlink domain from iommu + +From: Alex Williamson + +commit a97590e56d0d58e1dd262353f7cbd84e81d8e600 upstream. + +When we remove a device, we unlink the iommu from the domain, but +we never do the reverse unlinking of the domain from the iommu. +This means that we never clear iommu->domain_ids, eventually leading +to resource exhaustion if we repeatedly bind and unbind a device +to a driver. Also free empty domains to avoid a resource leak. + +Signed-off-by: Alex Williamson +Acked-by: Donald Dutile +Signed-off-by: David Woodhouse +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pci/intel-iommu.c | 13 ++++++++++++- + 1 file changed, 12 insertions(+), 1 deletion(-) + +--- a/drivers/pci/intel-iommu.c ++++ b/drivers/pci/intel-iommu.c +@@ -3260,9 +3260,15 @@ static int device_notifier(struct notifi + if (!domain) + return 0; + +- if (action == BUS_NOTIFY_UNBOUND_DRIVER && !iommu_pass_through) ++ if (action == BUS_NOTIFY_UNBOUND_DRIVER && !iommu_pass_through) { + domain_remove_one_dev_info(domain, pdev); + ++ if (!(domain->flags & DOMAIN_FLAG_VIRTUAL_MACHINE) && ++ !(domain->flags & DOMAIN_FLAG_STATIC_IDENTITY) && ++ list_empty(&domain->devices)) ++ domain_exit(domain); ++ } ++ + return 0; + } + +@@ -3411,6 +3417,11 @@ static void domain_remove_one_dev_info(s + domain->iommu_count--; + domain_update_iommu_cap(domain); + spin_unlock_irqrestore(&domain->iommu_lock, tmp_flags); ++ ++ spin_lock_irqsave(&iommu->lock, tmp_flags); ++ clear_bit(domain->id, iommu->domain_ids); ++ iommu->domains[domain->id] = NULL; ++ spin_unlock_irqrestore(&iommu->lock, tmp_flags); + } + + spin_unlock_irqrestore(&device_domain_lock, flags); diff --git a/queue-2.6.38/netxen-limit-skb-frags-for-non-tso-packet.patch b/queue-2.6.38/netxen-limit-skb-frags-for-non-tso-packet.patch new file mode 100644 index 00000000000..8f45ad7d42b --- /dev/null +++ b/queue-2.6.38/netxen-limit-skb-frags-for-non-tso-packet.patch @@ -0,0 +1,80 @@ +From c968bdf6912cad6d0fc63d7037cc1c870604a808 Mon Sep 17 00:00:00 2001 +From: amit salecha +Date: Mon, 11 Apr 2011 02:10:22 +0000 +Subject: netxen: limit skb frags for non tso packet + +From: amit salecha + +commit c968bdf6912cad6d0fc63d7037cc1c870604a808 upstream. + +Machines are getting deadlock in four node cluster environment. +All nodes are accessing (find /gfs2 -depth -print|cpio -ocv > /dev/null) +200 GB storage on a GFS2 filesystem. +This result in memory fragmentation and driver receives 18 frags for +1448 byte packets. +For non tso packet, fw drops the tx request, if it has >14 frags. + +Fixing it by pulling extra frags. + +Signed-off-by: Amit Kumar Salecha +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/netxen/netxen_nic.h | 4 ++-- + drivers/net/netxen/netxen_nic_main.c | 17 +++++++++++++++++ + 2 files changed, 19 insertions(+), 2 deletions(-) + +--- a/drivers/net/netxen/netxen_nic.h ++++ b/drivers/net/netxen/netxen_nic.h +@@ -174,7 +174,7 @@ + + #define MAX_NUM_CARDS 4 + +-#define MAX_BUFFERS_PER_CMD 32 ++#define NETXEN_MAX_FRAGS_PER_TX 14 + #define MAX_TSO_HEADER_DESC 2 + #define MGMT_CMD_DESC_RESV 4 + #define TX_STOP_THRESH ((MAX_SKB_FRAGS >> 2) + MAX_TSO_HEADER_DESC \ +@@ -558,7 +558,7 @@ struct netxen_recv_crb { + */ + struct netxen_cmd_buffer { + struct sk_buff *skb; +- struct netxen_skb_frag frag_array[MAX_BUFFERS_PER_CMD + 1]; ++ struct netxen_skb_frag frag_array[MAX_SKB_FRAGS + 1]; + u32 frag_count; + }; + +--- a/drivers/net/netxen/netxen_nic_main.c ++++ b/drivers/net/netxen/netxen_nic_main.c +@@ -1841,6 +1841,8 @@ netxen_nic_xmit_frame(struct sk_buff *sk + struct cmd_desc_type0 *hwdesc, *first_desc; + struct pci_dev *pdev; + int i, k; ++ int delta = 0; ++ struct skb_frag_struct *frag; + + u32 producer; + int frag_count, no_of_desc; +@@ -1848,6 +1850,21 @@ netxen_nic_xmit_frame(struct sk_buff *sk + + frag_count = skb_shinfo(skb)->nr_frags + 1; + ++ /* 14 frags supported for normal packet and ++ * 32 frags supported for TSO packet ++ */ ++ if (!skb_is_gso(skb) && frag_count > NETXEN_MAX_FRAGS_PER_TX) { ++ ++ for (i = 0; i < (frag_count - NETXEN_MAX_FRAGS_PER_TX); i++) { ++ frag = &skb_shinfo(skb)->frags[i]; ++ delta += frag->size; ++ } ++ ++ if (!__pskb_pull_tail(skb, delta)) ++ goto drop_packet; ++ ++ frag_count = 1 + skb_shinfo(skb)->nr_frags; ++ } + /* 4 fragments per cmd des */ + no_of_desc = (frag_count + 3) >> 2; + diff --git a/queue-2.6.38/nfsd4-fix-filp-leak.patch b/queue-2.6.38/nfsd4-fix-filp-leak.patch new file mode 100644 index 00000000000..bc7f980e006 --- /dev/null +++ b/queue-2.6.38/nfsd4-fix-filp-leak.patch @@ -0,0 +1,36 @@ +From a96e5b90804be8b540d30f4a1453fc87f95b3149 Mon Sep 17 00:00:00 2001 +From: OGAWA Hirofumi +Date: Mon, 18 Apr 2011 11:48:55 -0400 +Subject: nfsd4: Fix filp leak + +From: OGAWA Hirofumi + +commit a96e5b90804be8b540d30f4a1453fc87f95b3149 upstream. + +23fcf2ec93fb8573a653408316af599939ff9a8e (nfsd4: fix oops on lock failure) + +The above patch breaks free path for stp->st_file. If stp was inserted +into sop->so_stateids, we have to free stp->st_file refcount. Because +stp->st_file refcount itself is taken whether or not any refcounts are +taken on the stp->st_file->fi_fds[]. + +Signed-off-by: OGAWA Hirofumi +Signed-off-by: J. Bruce Fields +Signed-off-by: Greg Kroah-Hartman + +--- + fs/nfsd/nfs4state.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/nfsd/nfs4state.c ++++ b/fs/nfsd/nfs4state.c +@@ -403,8 +403,8 @@ static void free_generic_stateid(struct + if (stp->st_access_bmap) { + oflag = nfs4_access_bmap_to_omode(stp); + nfs4_file_put_access(stp->st_file, oflag); +- put_nfs4_file(stp->st_file); + } ++ put_nfs4_file(stp->st_file); + kmem_cache_free(stateid_slab, stp); + } + diff --git a/queue-2.6.38/nfsd4-fix-struct-file-leak-on-delegation.patch b/queue-2.6.38/nfsd4-fix-struct-file-leak-on-delegation.patch new file mode 100644 index 00000000000..cdf2f5b2033 --- /dev/null +++ b/queue-2.6.38/nfsd4-fix-struct-file-leak-on-delegation.patch @@ -0,0 +1,29 @@ +From 4ee63624fd927376b97ead3a8d00728d437bc8e8 Mon Sep 17 00:00:00 2001 +From: J. Bruce Fields +Date: Fri, 15 Apr 2011 18:08:26 -0400 +Subject: nfsd4: fix struct file leak on delegation + +From: J. Bruce Fields + +commit 4ee63624fd927376b97ead3a8d00728d437bc8e8 upstream. + +Introduced by acfdf5c383b38f7f4dddae41b97c97f1ae058f49. + +Reported-by: Gerhard Heift +Signed-off-by: J. Bruce Fields +Signed-off-by: Greg Kroah-Hartman + +--- + fs/nfsd/nfs4state.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/fs/nfsd/nfs4state.c ++++ b/fs/nfsd/nfs4state.c +@@ -258,6 +258,7 @@ static void nfs4_put_deleg_lease(struct + if (atomic_dec_and_test(&fp->fi_delegees)) { + vfs_setlease(fp->fi_deleg_file, F_UNLCK, &fp->fi_lease); + fp->fi_lease = NULL; ++ fput(fp->fi_deleg_file); + fp->fi_deleg_file = NULL; + } + } diff --git a/queue-2.6.38/p54-initialize-extra_len-in-p54_tx_80211.patch b/queue-2.6.38/p54-initialize-extra_len-in-p54_tx_80211.patch new file mode 100644 index 00000000000..3bfcff1408c --- /dev/null +++ b/queue-2.6.38/p54-initialize-extra_len-in-p54_tx_80211.patch @@ -0,0 +1,43 @@ +From a6756da9eace8b4af73e9dea43f1fc2889224c94 Mon Sep 17 00:00:00 2001 +From: Jason Conti +Date: Thu, 7 Apr 2011 21:09:57 +0200 +Subject: p54: Initialize extra_len in p54_tx_80211 + +From: Jason Conti + +commit a6756da9eace8b4af73e9dea43f1fc2889224c94 upstream. + +This patch fixes a very serious off-by-one bug in +the driver, which could leave the device in an +unresponsive state. + +The problem was that the extra_len variable [used to +reserve extra scratch buffer space for the firmware] +was left uninitialized. Because p54_assign_address +later needs the value to reserve additional space, +the resulting frame could be to big for the small +device's memory window and everything would +immediately come to a grinding halt. + +Reference: https://bugs.launchpad.net/bugs/722185 + +Acked-by: Christian Lamparter +Signed-off-by: Jason Conti +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/p54/txrx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/wireless/p54/txrx.c ++++ b/drivers/net/wireless/p54/txrx.c +@@ -705,7 +705,7 @@ int p54_tx_80211(struct ieee80211_hw *de + struct p54_tx_info *p54info; + struct p54_hdr *hdr; + struct p54_tx_data *txhdr; +- unsigned int padding, len, extra_len; ++ unsigned int padding, len, extra_len = 0; + int i, j, ridx; + u16 hdr_flags = 0, aid = 0; + u8 rate, queue = 0, crypt_offset = 0; diff --git a/queue-2.6.38/qlcnic-limit-skb-frags-for-non-tso-packet.patch b/queue-2.6.38/qlcnic-limit-skb-frags-for-non-tso-packet.patch new file mode 100644 index 00000000000..8262a0a380e --- /dev/null +++ b/queue-2.6.38/qlcnic-limit-skb-frags-for-non-tso-packet.patch @@ -0,0 +1,67 @@ +From 91a403caf0f26c71ce4407fd235b2d6fb225fba9 Mon Sep 17 00:00:00 2001 +From: Amit Kumar Salecha +Date: Tue, 12 Apr 2011 17:05:55 +0000 +Subject: qlcnic: limit skb frags for non tso packet + +From: Amit Kumar Salecha + +commit 91a403caf0f26c71ce4407fd235b2d6fb225fba9 upstream. + +Machines are getting deadlock in four node cluster environment. +All nodes are accessing (find /gfs2 -depth -print|cpio -ocv > /dev/null) +200 GB storage on a GFS2 filesystem. +This result in memory fragmentation and driver receives 18 frags for +1448 byte packets. +For non tso packet, fw drops the tx request, if it has >14 frags. + +Fixing it by pulling extra frags. + +Signed-off-by: Amit Kumar Salecha +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/qlcnic/qlcnic.h | 1 + + drivers/net/qlcnic/qlcnic_main.c | 14 ++++++++++++++ + 2 files changed, 15 insertions(+) + +--- a/drivers/net/qlcnic/qlcnic.h ++++ b/drivers/net/qlcnic/qlcnic.h +@@ -99,6 +99,7 @@ + #define TX_UDPV6_PKT 0x0c + + /* Tx defines */ ++#define QLCNIC_MAX_FRAGS_PER_TX 14 + #define MAX_TSO_HEADER_DESC 2 + #define MGMT_CMD_DESC_RESV 4 + #define TX_STOP_THRESH ((MAX_SKB_FRAGS >> 2) + MAX_TSO_HEADER_DESC \ +--- a/drivers/net/qlcnic/qlcnic_main.c ++++ b/drivers/net/qlcnic/qlcnic_main.c +@@ -2099,6 +2099,7 @@ qlcnic_xmit_frame(struct sk_buff *skb, s + struct cmd_desc_type0 *hwdesc, *first_desc; + struct pci_dev *pdev; + struct ethhdr *phdr; ++ int delta = 0; + int i, k; + + u32 producer; +@@ -2118,6 +2119,19 @@ qlcnic_xmit_frame(struct sk_buff *skb, s + } + + frag_count = skb_shinfo(skb)->nr_frags + 1; ++ /* 14 frags supported for normal packet and ++ * 32 frags supported for TSO packet ++ */ ++ if (!skb_is_gso(skb) && frag_count > QLCNIC_MAX_FRAGS_PER_TX) { ++ ++ for (i = 0; i < (frag_count - QLCNIC_MAX_FRAGS_PER_TX); i++) ++ delta += skb_shinfo(skb)->frags[i].size; ++ ++ if (!__pskb_pull_tail(skb, delta)) ++ goto drop_packet; ++ ++ frag_count = 1 + skb_shinfo(skb)->nr_frags; ++ } + + /* 4 fragments per cmd des */ + no_of_desc = (frag_count + 3) >> 2; diff --git a/queue-2.6.38/series b/queue-2.6.38/series new file mode 100644 index 00000000000..e995676b61c --- /dev/null +++ b/queue-2.6.38/series @@ -0,0 +1,19 @@ +ath9k_hw-fix-stopping-rx-dma-during-resets.patch +netxen-limit-skb-frags-for-non-tso-packet.patch +ath-add-missing-regdomain-pair-0x5c-mapping.patch +block-blk-sysfs-fix-an-err-return-path-in-blk_register_queue.patch +p54-initialize-extra_len-in-p54_tx_80211.patch +qlcnic-limit-skb-frags-for-non-tso-packet.patch +nfsd4-fix-struct-file-leak-on-delegation.patch +nfsd4-fix-filp-leak.patch +virtio-decrement-avail-idx-on-buffer-detach.patch +x86-gart-set-distlbwalkprb-bit-always.patch +x86-gart-make-sure-gart-does-not-map-physmem-above-1tb.patch +intel-iommu-fix-use-after-release-during-device-attach.patch +intel-iommu-unlink-domain-from-iommu.patch +intel-iommu-fix-get_domain_for_dev-error-path.patch +drm-radeon-kms-pll-tweaks-for-r7xx.patch +drm-nouveau-fix-notifier-memory-corruption-bug.patch +drm-radeon-kms-fix-bad-shift-in-atom-iio-table-parser.patch +drm-i915-sanitize-the-output-registers-after-resume.patch +drm-i915-tv-remember-the-detected-tv-type.patch diff --git a/queue-2.6.38/virtio-decrement-avail-idx-on-buffer-detach.patch b/queue-2.6.38/virtio-decrement-avail-idx-on-buffer-detach.patch new file mode 100644 index 00000000000..0bd67ea2508 --- /dev/null +++ b/queue-2.6.38/virtio-decrement-avail-idx-on-buffer-detach.patch @@ -0,0 +1,39 @@ +From b3258ff1d6086bd2b9eeb556844a868ad7d49bc8 Mon Sep 17 00:00:00 2001 +From: Amit Shah +Date: Wed, 16 Mar 2011 19:12:10 +0530 +Subject: virtio: Decrement avail idx on buffer detach + +From: Amit Shah + +commit b3258ff1d6086bd2b9eeb556844a868ad7d49bc8 upstream. + +When detaching a buffer from a vq, the avail.idx value should be +decremented as well. + +This was noticed by hot-unplugging a virtio console port and then +plugging in a new one on the same number (re-using the vqs which were +just 'disowned'). qemu reported + + 'Guest moved used index from 0 to 256' + +when any IO was attempted on the new port. + +Reported-by: juzhang +Signed-off-by: Amit Shah +Signed-off-by: Rusty Russell +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/virtio/virtio_ring.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/virtio/virtio_ring.c ++++ b/drivers/virtio/virtio_ring.c +@@ -371,6 +371,7 @@ void *virtqueue_detach_unused_buf(struct + /* detach_buf clears data, so grab it now. */ + buf = vq->data[i]; + detach_buf(vq, i); ++ vq->vring.avail->idx--; + END_USE(vq); + return buf; + } diff --git a/queue-2.6.38/x86-gart-make-sure-gart-does-not-map-physmem-above-1tb.patch b/queue-2.6.38/x86-gart-make-sure-gart-does-not-map-physmem-above-1tb.patch new file mode 100644 index 00000000000..07dca4731d9 --- /dev/null +++ b/queue-2.6.38/x86-gart-make-sure-gart-does-not-map-physmem-above-1tb.patch @@ -0,0 +1,49 @@ +From 665d3e2af83c8fbd149534db8f57d82fa6fa6753 Mon Sep 17 00:00:00 2001 +From: Joerg Roedel +Date: Mon, 18 Apr 2011 15:45:46 +0200 +Subject: x86, gart: Make sure GART does not map physmem above 1TB + +From: Joerg Roedel + +commit 665d3e2af83c8fbd149534db8f57d82fa6fa6753 upstream. + +The GART can only map physical memory below 1TB. Make sure +the gart driver in the kernel does not try to map memory +above 1TB. + +Signed-off-by: Joerg Roedel +Link: http://lkml.kernel.org/r/1303134346-5805-5-git-send-email-joerg.roedel@amd.com +Signed-off-by: H. Peter Anvin +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/pci-gart_64.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +--- a/arch/x86/kernel/pci-gart_64.c ++++ b/arch/x86/kernel/pci-gart_64.c +@@ -81,6 +81,9 @@ static u32 gart_unmapped_entry; + #define AGPEXTERN + #endif + ++/* GART can only remap to physical addresses < 1TB */ ++#define GART_MAX_PHYS_ADDR (1ULL << 40) ++ + /* backdoor interface to AGP driver */ + AGPEXTERN int agp_memory_reserved; + AGPEXTERN __u32 *agp_gatt_table; +@@ -212,9 +215,13 @@ static dma_addr_t dma_map_area(struct de + size_t size, int dir, unsigned long align_mask) + { + unsigned long npages = iommu_num_pages(phys_mem, size, PAGE_SIZE); +- unsigned long iommu_page = alloc_iommu(dev, npages, align_mask); ++ unsigned long iommu_page; + int i; + ++ if (unlikely(phys_mem + size > GART_MAX_PHYS_ADDR)) ++ return bad_dma_addr; ++ ++ iommu_page = alloc_iommu(dev, npages, align_mask); + if (iommu_page == -1) { + if (!nonforced_iommu(dev, phys_mem, size)) + return phys_mem; diff --git a/queue-2.6.38/x86-gart-set-distlbwalkprb-bit-always.patch b/queue-2.6.38/x86-gart-set-distlbwalkprb-bit-always.patch new file mode 100644 index 00000000000..1539d1850da --- /dev/null +++ b/queue-2.6.38/x86-gart-set-distlbwalkprb-bit-always.patch @@ -0,0 +1,57 @@ +From c34151a742d84ae65db2088ea30495063f697fbe Mon Sep 17 00:00:00 2001 +From: Joerg Roedel +Date: Mon, 18 Apr 2011 15:45:45 +0200 +Subject: x86, gart: Set DISTLBWALKPRB bit always + +From: Joerg Roedel + +commit c34151a742d84ae65db2088ea30495063f697fbe upstream. + +The DISTLBWALKPRB bit must be set for the GART because the +gatt table is mapped UC. But the current code does not set +the bit at boot when the BIOS setup the aperture correctly. +Fix that by setting this bit when enabling the GART instead +of the other places. + +Cc: Borislav Petkov +Signed-off-by: Joerg Roedel +Link: http://lkml.kernel.org/r/1303134346-5805-4-git-send-email-joerg.roedel@amd.com +Signed-off-by: H. Peter Anvin +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/include/asm/gart.h | 4 ++-- + arch/x86/kernel/aperture_64.c | 2 +- + 2 files changed, 3 insertions(+), 3 deletions(-) + +--- a/arch/x86/include/asm/gart.h ++++ b/arch/x86/include/asm/gart.h +@@ -66,7 +66,7 @@ static inline void gart_set_size_and_ena + * Don't enable translation but enable GART IO and CPU accesses. + * Also, set DISTLBWALKPRB since GART tables memory is UC. + */ +- ctl = DISTLBWALKPRB | order << 1; ++ ctl = order << 1; + + pci_write_config_dword(dev, AMD64_GARTAPERTURECTL, ctl); + } +@@ -83,7 +83,7 @@ static inline void enable_gart_translati + + /* Enable GART translation for this hammer. */ + pci_read_config_dword(dev, AMD64_GARTAPERTURECTL, &ctl); +- ctl |= GARTEN; ++ ctl |= GARTEN | DISTLBWALKPRB; + ctl &= ~(DISGARTCPU | DISGARTIO); + pci_write_config_dword(dev, AMD64_GARTAPERTURECTL, ctl); + } +--- a/arch/x86/kernel/aperture_64.c ++++ b/arch/x86/kernel/aperture_64.c +@@ -500,7 +500,7 @@ out: + * Don't enable translation yet but enable GART IO and CPU + * accesses and set DISTLBWALKPRB since GART table memory is UC. + */ +- u32 ctl = DISTLBWALKPRB | aper_order << 1; ++ u32 ctl = aper_order << 1; + + bus = amd_nb_bus_dev_ranges[i].bus; + dev_base = amd_nb_bus_dev_ranges[i].dev_base;