From: Greg Kroah-Hartman Date: Fri, 25 Feb 2011 01:25:34 +0000 (-0800) Subject: .37 patches X-Git-Tag: v2.6.37.3~9 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=adb46d1be4182f2f9a0a8329dc7ce1a0d435f40f;p=thirdparty%2Fkernel%2Fstable-queue.git .37 patches --- diff --git a/queue-2.6.37/mm-prevent-concurrent-unmap_mapping_range-on-the-same-inode.patch b/queue-2.6.37/mm-prevent-concurrent-unmap_mapping_range-on-the-same-inode.patch new file mode 100644 index 00000000000..78f09786ae8 --- /dev/null +++ b/queue-2.6.37/mm-prevent-concurrent-unmap_mapping_range-on-the-same-inode.patch @@ -0,0 +1,214 @@ +From 2aa15890f3c191326678f1bd68af61ec6b8753ec Mon Sep 17 00:00:00 2001 +From: Miklos Szeredi +Date: Wed, 23 Feb 2011 13:49:47 +0100 +Subject: mm: prevent concurrent unmap_mapping_range() on the same inode + +From: Miklos Szeredi + +commit 2aa15890f3c191326678f1bd68af61ec6b8753ec upstream. + +Michael Leun reported that running parallel opens on a fuse filesystem +can trigger a "kernel BUG at mm/truncate.c:475" + +Gurudas Pai reported the same bug on NFS. + +The reason is, unmap_mapping_range() is not prepared for more than +one concurrent invocation per inode. For example: + + thread1: going through a big range, stops in the middle of a vma and + stores the restart address in vm_truncate_count. + + thread2: comes in with a small (e.g. single page) unmap request on + the same vma, somewhere before restart_address, finds that the + vma was already unmapped up to the restart address and happily + returns without doing anything. + +Another scenario would be two big unmap requests, both having to +restart the unmapping and each one setting vm_truncate_count to its +own value. This could go on forever without any of them being able to +finish. + +Truncate and hole punching already serialize with i_mutex. Other +callers of unmap_mapping_range() do not, and it's difficult to get +i_mutex protection for all callers. In particular ->d_revalidate(), +which calls invalidate_inode_pages2_range() in fuse, may be called +with or without i_mutex. + +This patch adds a new mutex to 'struct address_space' to prevent +running multiple concurrent unmap_mapping_range() on the same mapping. + +[ We'll hopefully get rid of all this with the upcoming mm + preemptibility series by Peter Zijlstra, the "mm: Remove i_mmap_mutex + lockbreak" patch in particular. But that is for 2.6.39 ] + +Signed-off-by: Miklos Szeredi +Reported-by: Michael Leun +Reported-by: Gurudas Pai +Tested-by: Gurudas Pai +Acked-by: Hugh Dickins +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + fs/gfs2/main.c | 9 +-------- + fs/inode.c | 22 +++++++++++++++------- + fs/nilfs2/btnode.c | 5 ----- + fs/nilfs2/btnode.h | 1 - + fs/nilfs2/mdt.c | 4 ++-- + fs/nilfs2/page.h | 1 - + fs/nilfs2/super.c | 2 +- + include/linux/fs.h | 2 ++ + mm/memory.c | 2 ++ + 9 files changed, 23 insertions(+), 25 deletions(-) + +--- a/fs/gfs2/main.c ++++ b/fs/gfs2/main.c +@@ -59,14 +59,7 @@ static void gfs2_init_gl_aspace_once(voi + struct address_space *mapping = (struct address_space *)(gl + 1); + + gfs2_init_glock_once(gl); +- memset(mapping, 0, sizeof(*mapping)); +- INIT_RADIX_TREE(&mapping->page_tree, GFP_ATOMIC); +- spin_lock_init(&mapping->tree_lock); +- spin_lock_init(&mapping->i_mmap_lock); +- INIT_LIST_HEAD(&mapping->private_list); +- spin_lock_init(&mapping->private_lock); +- INIT_RAW_PRIO_TREE_ROOT(&mapping->i_mmap); +- INIT_LIST_HEAD(&mapping->i_mmap_nonlinear); ++ address_space_init_once(mapping); + } + + /** +--- a/fs/inode.c ++++ b/fs/inode.c +@@ -280,6 +280,20 @@ static void destroy_inode(struct inode * + kmem_cache_free(inode_cachep, (inode)); + } + ++void address_space_init_once(struct address_space *mapping) ++{ ++ memset(mapping, 0, sizeof(*mapping)); ++ INIT_RADIX_TREE(&mapping->page_tree, GFP_ATOMIC); ++ spin_lock_init(&mapping->tree_lock); ++ spin_lock_init(&mapping->i_mmap_lock); ++ INIT_LIST_HEAD(&mapping->private_list); ++ spin_lock_init(&mapping->private_lock); ++ INIT_RAW_PRIO_TREE_ROOT(&mapping->i_mmap); ++ INIT_LIST_HEAD(&mapping->i_mmap_nonlinear); ++ mutex_init(&mapping->unmap_mutex); ++} ++EXPORT_SYMBOL(address_space_init_once); ++ + /* + * These are initializations that only need to be done + * once, because the fields are idempotent across use +@@ -293,13 +307,7 @@ void inode_init_once(struct inode *inode + INIT_LIST_HEAD(&inode->i_devices); + INIT_LIST_HEAD(&inode->i_wb_list); + INIT_LIST_HEAD(&inode->i_lru); +- INIT_RADIX_TREE(&inode->i_data.page_tree, GFP_ATOMIC); +- spin_lock_init(&inode->i_data.tree_lock); +- spin_lock_init(&inode->i_data.i_mmap_lock); +- INIT_LIST_HEAD(&inode->i_data.private_list); +- spin_lock_init(&inode->i_data.private_lock); +- INIT_RAW_PRIO_TREE_ROOT(&inode->i_data.i_mmap); +- INIT_LIST_HEAD(&inode->i_data.i_mmap_nonlinear); ++ address_space_init_once(&inode->i_data); + i_size_ordered_init(inode); + #ifdef CONFIG_FSNOTIFY + INIT_HLIST_HEAD(&inode->i_fsnotify_marks); +--- a/fs/nilfs2/btnode.c ++++ b/fs/nilfs2/btnode.c +@@ -35,11 +35,6 @@ + #include "btnode.h" + + +-void nilfs_btnode_cache_init_once(struct address_space *btnc) +-{ +- nilfs_mapping_init_once(btnc); +-} +- + static const struct address_space_operations def_btnode_aops = { + .sync_page = block_sync_page, + }; +--- a/fs/nilfs2/btnode.h ++++ b/fs/nilfs2/btnode.h +@@ -37,7 +37,6 @@ struct nilfs_btnode_chkey_ctxt { + struct buffer_head *newbh; + }; + +-void nilfs_btnode_cache_init_once(struct address_space *); + void nilfs_btnode_cache_init(struct address_space *, struct backing_dev_info *); + void nilfs_btnode_cache_clear(struct address_space *); + struct buffer_head *nilfs_btnode_create_block(struct address_space *btnc, +--- a/fs/nilfs2/mdt.c ++++ b/fs/nilfs2/mdt.c +@@ -460,9 +460,9 @@ int nilfs_mdt_setup_shadow_map(struct in + struct backing_dev_info *bdi = inode->i_sb->s_bdi; + + INIT_LIST_HEAD(&shadow->frozen_buffers); +- nilfs_mapping_init_once(&shadow->frozen_data); ++ address_space_init_once(&shadow->frozen_data); + nilfs_mapping_init(&shadow->frozen_data, bdi, &shadow_map_aops); +- nilfs_mapping_init_once(&shadow->frozen_btnodes); ++ address_space_init_once(&shadow->frozen_btnodes); + nilfs_mapping_init(&shadow->frozen_btnodes, bdi, &shadow_map_aops); + mi->mi_shadow = shadow; + return 0; +--- a/fs/nilfs2/page.h ++++ b/fs/nilfs2/page.h +@@ -61,7 +61,6 @@ void nilfs_free_private_page(struct page + int nilfs_copy_dirty_pages(struct address_space *, struct address_space *); + void nilfs_copy_back_pages(struct address_space *, struct address_space *); + void nilfs_clear_dirty_pages(struct address_space *); +-void nilfs_mapping_init_once(struct address_space *mapping); + void nilfs_mapping_init(struct address_space *mapping, + struct backing_dev_info *bdi, + const struct address_space_operations *aops); +--- a/fs/nilfs2/super.c ++++ b/fs/nilfs2/super.c +@@ -1263,7 +1263,7 @@ static void nilfs_inode_init_once(void * + #ifdef CONFIG_NILFS_XATTR + init_rwsem(&ii->xattr_sem); + #endif +- nilfs_btnode_cache_init_once(&ii->i_btnode_cache); ++ address_space_init_once(&ii->i_btnode_cache); + ii->i_bmap = &ii->i_bmap_data; + inode_init_once(&ii->vfs_inode); + } +--- a/include/linux/fs.h ++++ b/include/linux/fs.h +@@ -646,6 +646,7 @@ struct address_space { + spinlock_t private_lock; /* for use by the address_space */ + struct list_head private_list; /* ditto */ + struct address_space *assoc_mapping; /* ditto */ ++ struct mutex unmap_mutex; /* to protect unmapping */ + } __attribute__((aligned(sizeof(long)))); + /* + * On most architectures that alignment is already the case; but +@@ -2203,6 +2204,7 @@ extern loff_t vfs_llseek(struct file *fi + + extern int inode_init_always(struct super_block *, struct inode *); + extern void inode_init_once(struct inode *); ++extern void address_space_init_once(struct address_space *mapping); + extern void ihold(struct inode * inode); + extern void iput(struct inode *); + extern struct inode * igrab(struct inode *); +--- a/mm/memory.c ++++ b/mm/memory.c +@@ -2572,6 +2572,7 @@ void unmap_mapping_range(struct address_ + details.last_index = ULONG_MAX; + details.i_mmap_lock = &mapping->i_mmap_lock; + ++ mutex_lock(&mapping->unmap_mutex); + spin_lock(&mapping->i_mmap_lock); + + /* Protect against endless unmapping loops */ +@@ -2588,6 +2589,7 @@ void unmap_mapping_range(struct address_ + if (unlikely(!list_empty(&mapping->i_mmap_nonlinear))) + unmap_mapping_range_list(&mapping->i_mmap_nonlinear, &details); + spin_unlock(&mapping->i_mmap_lock); ++ mutex_unlock(&mapping->unmap_mutex); + } + EXPORT_SYMBOL(unmap_mapping_range); + diff --git a/queue-2.6.37/p54pci-update-receive-dma-buffers-before-and-after-processing.patch b/queue-2.6.37/p54pci-update-receive-dma-buffers-before-and-after-processing.patch new file mode 100644 index 00000000000..d76a5adabc4 --- /dev/null +++ b/queue-2.6.37/p54pci-update-receive-dma-buffers-before-and-after-processing.patch @@ -0,0 +1,59 @@ +From 0bf719dfdecc5552155cbec78e49fa06e531e35c Mon Sep 17 00:00:00 2001 +From: Christian Lamparter +Date: Fri, 11 Feb 2011 01:48:42 +0100 +Subject: p54pci: update receive dma buffers before and after processing + +From: Christian Lamparter + +commit 0bf719dfdecc5552155cbec78e49fa06e531e35c upstream. + +Documentation/DMA-API-HOWTO.txt states: + +"DMA transfers need to be synced properly in order for +the cpu and device to see the most uptodate and correct +copy of the DMA buffer." + +Signed-off-by: Christian Lamparter +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/p54/p54pci.c | 14 +++++++++----- + 1 file changed, 9 insertions(+), 5 deletions(-) + +--- a/drivers/net/wireless/p54/p54pci.c ++++ b/drivers/net/wireless/p54/p54pci.c +@@ -199,6 +199,7 @@ static void p54p_check_rx_ring(struct ie + while (i != idx) { + u16 len; + struct sk_buff *skb; ++ dma_addr_t dma_addr; + desc = &ring[i]; + len = le16_to_cpu(desc->len); + skb = rx_buf[i]; +@@ -216,17 +217,20 @@ static void p54p_check_rx_ring(struct ie + + len = priv->common.rx_mtu; + } ++ dma_addr = le32_to_cpu(desc->host_addr); ++ pci_dma_sync_single_for_cpu(priv->pdev, dma_addr, ++ priv->common.rx_mtu + 32, PCI_DMA_FROMDEVICE); + skb_put(skb, len); + + if (p54_rx(dev, skb)) { +- pci_unmap_single(priv->pdev, +- le32_to_cpu(desc->host_addr), +- priv->common.rx_mtu + 32, +- PCI_DMA_FROMDEVICE); ++ pci_unmap_single(priv->pdev, dma_addr, ++ priv->common.rx_mtu + 32, PCI_DMA_FROMDEVICE); + rx_buf[i] = NULL; +- desc->host_addr = 0; ++ desc->host_addr = cpu_to_le32(0); + } else { + skb_trim(skb, 0); ++ pci_dma_sync_single_for_device(priv->pdev, dma_addr, ++ priv->common.rx_mtu + 32, PCI_DMA_FROMDEVICE); + desc->len = cpu_to_le16(priv->common.rx_mtu + 32); + } + diff --git a/queue-2.6.37/revert-bluetooth-enable-usb-autosuspend-by-default-on-btusb.patch b/queue-2.6.37/revert-bluetooth-enable-usb-autosuspend-by-default-on-btusb.patch new file mode 100644 index 00000000000..7795ee1f1a2 --- /dev/null +++ b/queue-2.6.37/revert-bluetooth-enable-usb-autosuspend-by-default-on-btusb.patch @@ -0,0 +1,48 @@ +From 78794b2cdeac37ac1fd950fc9c4454b56d88ac03 Mon Sep 17 00:00:00 2001 +From: Linus Torvalds +Date: Wed, 23 Feb 2011 19:42:03 -0800 +Subject: Revert "Bluetooth: Enable USB autosuspend by default on btusb" + +From: Linus Torvalds + +commit 78794b2cdeac37ac1fd950fc9c4454b56d88ac03 upstream. + +This reverts commit 556ea928f78a390fe16ae584e6433dff304d3014. + +Jeff Chua reports that it can cause some bluetooth devices (he mentions +an Bluetooth Intermec scanner) to just stop responding after a while +with messages like + + [ 4533.361959] btusb 8-1:1.0: no reset_resume for driver btusb? + [ 4533.361964] btusb 8-1:1.1: no reset_resume for driver btusb? + +from the kernel. See also + + https://bugzilla.kernel.org/show_bug.cgi?id=26182 + +for other reports. + +Reported-by: Jeff Chua +Reported-by: Andrew Meakovski +Reported-by: Jim Faulkner +Acked-by: Greg KH +Acked-by: Matthew Garrett +Acked-by: Gustavo F. Padovan +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/bluetooth/btusb.c | 2 -- + 1 file changed, 2 deletions(-) + +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -1038,8 +1038,6 @@ static int btusb_probe(struct usb_interf + + usb_set_intfdata(intf, data); + +- usb_enable_autosuspend(interface_to_usbdev(intf)); +- + return 0; + } + diff --git a/queue-2.6.37/revert-drm-radeon-kms-switch-back-to-min-max-pll-post-divider-iteration.patch b/queue-2.6.37/revert-drm-radeon-kms-switch-back-to-min-max-pll-post-divider-iteration.patch new file mode 100644 index 00000000000..75239863c6b --- /dev/null +++ b/queue-2.6.37/revert-drm-radeon-kms-switch-back-to-min-max-pll-post-divider-iteration.patch @@ -0,0 +1,41 @@ +From bd6a60afeb4c9ada3ff27f1d13db1a2b5c11d8c0 Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Mon, 21 Feb 2011 01:11:59 -0500 +Subject: Revert "drm/radeon/kms: switch back to min->max pll post divider iteration" + +From: Alex Deucher + +commit bd6a60afeb4c9ada3ff27f1d13db1a2b5c11d8c0 upstream. + +This reverts commit a6f9761743bf35b052180f4a8bdae4d2cc0465f6. + +Remove this commit as it is no longer necessary. The relevant bugs +were fixed properly in: +drm/radeon/kms: hopefully fix pll issues for real (v3) +5b40ddf888398ce4cccbf3b9d0a18d90149ed7ff +drm/radeon/kms: add missing frac fb div flag for dce4+ +9f4283f49f0a96a64c5a45fe56f0f8c942885eef + +This commit also broke certain ~5 Mhz modes on old arcade monitors, +so reverting this commit fixes: +https://bugzilla.kernel.org/show_bug.cgi?id=29502 + +Signed-off-by: Alex Deucher +Signed-off-by: Dave Airlie +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/radeon/radeon_display.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/radeon/radeon_display.c ++++ b/drivers/gpu/drm/radeon/radeon_display.c +@@ -639,7 +639,7 @@ void radeon_compute_pll_legacy(struct ra + max_fractional_feed_div = pll->max_frac_feedback_div; + } + +- for (post_div = min_post_div; post_div <= max_post_div; ++post_div) { ++ for (post_div = max_post_div; post_div >= min_post_div; --post_div) { + uint32_t ref_div; + + if ((pll->flags & RADEON_PLL_NO_ODD_POST_DIV) && (post_div & 1)) diff --git a/queue-2.6.37/sierra-add-new-id-for-airprime-sierra-usb-ip-modem.patch b/queue-2.6.37/sierra-add-new-id-for-airprime-sierra-usb-ip-modem.patch new file mode 100644 index 00000000000..5c6b65d3ad0 --- /dev/null +++ b/queue-2.6.37/sierra-add-new-id-for-airprime-sierra-usb-ip-modem.patch @@ -0,0 +1,39 @@ +From e1dc5157c574e7249dc1cd072fde2e48b3011533 Mon Sep 17 00:00:00 2001 +From: Jon Thomas +Date: Wed, 16 Feb 2011 11:02:34 -0500 +Subject: sierra: add new ID for Airprime/Sierra USB IP modem + +From: Jon Thomas + +commit e1dc5157c574e7249dc1cd072fde2e48b3011533 upstream. + +I picked up a new Sierra usb 308 (At&t Shockwave) on 2/2011 and the vendor code +is 0x0f3d + +Looking up vendor and product id's I see: + +0f3d Airprime, Incorporated + 0112 CDMA 1xEVDO PC Card, PC 5220 + +Sierra and Airprime are somehow related and I'm guessing the At&t usb 308 might +be have some common hardware with the AirPrime SL809x. + +Signed-off-by: Jon Thomas +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/sierra.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/usb/serial/sierra.c ++++ b/drivers/usb/serial/sierra.c +@@ -301,6 +301,9 @@ static const struct usb_device_id id_tab + { USB_DEVICE(0x1199, 0x68A3), /* Sierra Wireless Direct IP modems */ + .driver_info = (kernel_ulong_t)&direct_ip_interface_blacklist + }, ++ { USB_DEVICE(0x0f3d, 0x68A3), /* Airprime/Sierra Wireless Direct IP modems */ ++ .driver_info = (kernel_ulong_t)&direct_ip_interface_blacklist ++ }, + { USB_DEVICE(0x413C, 0x08133) }, /* Dell Computer Corp. Wireless 5720 VZW Mobile Broadband (EVDO Rev-A) Minicard GPS Port */ + + { } diff --git a/queue-2.6.37/staging-brcm80211-bugfix-for-softmac-crash-on-multi-cpu-configurations.patch b/queue-2.6.37/staging-brcm80211-bugfix-for-softmac-crash-on-multi-cpu-configurations.patch new file mode 100644 index 00000000000..909d9844b67 --- /dev/null +++ b/queue-2.6.37/staging-brcm80211-bugfix-for-softmac-crash-on-multi-cpu-configurations.patch @@ -0,0 +1,112 @@ +From arend@broadcom.com Thu Feb 24 17:23:22 2011 +From: "Arend van Spriel" +Date: Thu, 24 Feb 2011 21:42:19 +0100 +Subject: staging: brcm80211: bugfix for softmac crash on multi cpu configurations +To: gregkh@suse.de +Cc: rvossen@broadcom.com, stable@kernel.org +Message-ID: <1298580139-3695-2-git-send-email-arend@broadcom.com> + + +From: Roland Vossen + +commit 6a3be6e6e7feb4cb35275475d6a863b748d59cc3 upstream + +Solved a locking issue that resulted in driver crashes with the 43224 and 43225 +chips. The problem has been reported on several fora. Root cause was two fold: +hardware was being manipulated by two unsynchronized threads, and a scan +operation could interfere with an ongoing dynamic calibration process. Fix was +to invoke a lock on wl_ops_config() operation and to set internal flags when a +scan operation is started and stopped. + +Please add this to the staging-linus branch. + +Reviewed-by: Arend van Spriel +Signed-off-by: Roland Vossen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/staging/brcm80211/sys/wl_mac80211.c | 14 ++++++++++---- + drivers/staging/brcm80211/sys/wlc_mac80211.c | 13 +++++++++++++ + drivers/staging/brcm80211/sys/wlc_pub.h | 2 ++ + 3 files changed, 25 insertions(+), 4 deletions(-) + +--- a/drivers/staging/brcm80211/sys/wl_mac80211.c ++++ b/drivers/staging/brcm80211/sys/wl_mac80211.c +@@ -353,9 +353,7 @@ ieee_set_channel(struct ieee80211_hw *hw + switch (type) { + case NL80211_CHAN_HT20: + case NL80211_CHAN_NO_HT: +- WL_LOCK(wl); + err = wlc_set(wl->wlc, WLC_SET_CHANNEL, chan->hw_value); +- WL_UNLOCK(wl); + break; + case NL80211_CHAN_HT40MINUS: + case NL80211_CHAN_HT40PLUS: +@@ -376,6 +374,7 @@ static int wl_ops_config(struct ieee8021 + int err = 0; + int new_int; + ++ WL_LOCK(wl); + if (changed & IEEE80211_CONF_CHANGE_LISTEN_INTERVAL) { + WL_NONE(("%s: Setting listen interval to %d\n", + __func__, conf->listen_interval)); +@@ -431,6 +430,7 @@ static int wl_ops_config(struct ieee8021 + } + + config_out: ++ WL_UNLOCK(wl); + return err; + } + +@@ -559,14 +559,20 @@ wl_ops_set_tim(struct ieee80211_hw *hw, + + static void wl_ops_sw_scan_start(struct ieee80211_hw *hw) + { ++ struct wl_info *wl = hw->priv; + WL_NONE(("Scan Start\n")); +- return; ++ WL_LOCK(wl); ++ wlc_scan_start(wl->wlc); ++ WL_UNLOCK(wl); + } + + static void wl_ops_sw_scan_complete(struct ieee80211_hw *hw) + { ++ struct wl_info *wl = hw->priv; + WL_NONE(("Scan Complete\n")); +- return; ++ WL_LOCK(wl); ++ wlc_scan_stop(wl->wlc); ++ WL_UNLOCK(wl); + } + + static void wl_ops_set_tsf(struct ieee80211_hw *hw, u64 tsf) +--- a/drivers/staging/brcm80211/sys/wlc_mac80211.c ++++ b/drivers/staging/brcm80211/sys/wlc_mac80211.c +@@ -8672,3 +8672,16 @@ static void wlc_txq_free(wlc_info_t *wlc + + kfree(qi); + } ++ ++/* ++ * Flag 'scan in progress' to withold dynamic phy calibration ++ */ ++void wlc_scan_start(struct wlc_info *wlc) ++{ ++ wlc_phy_hold_upd(wlc->band->pi, PHY_HOLD_FOR_SCAN, true); ++} ++ ++void wlc_scan_stop(struct wlc_info *wlc) ++{ ++ wlc_phy_hold_upd(wlc->band->pi, PHY_HOLD_FOR_SCAN, false); ++} +--- a/drivers/staging/brcm80211/sys/wlc_pub.h ++++ b/drivers/staging/brcm80211/sys/wlc_pub.h +@@ -568,6 +568,8 @@ extern void wlc_enable_mac(struct wlc_in + extern u16 wlc_rate_shm_offset(struct wlc_info *wlc, u8 rate); + extern u32 wlc_get_rspec_history(struct wlc_bsscfg *cfg); + extern u32 wlc_get_current_highest_rate(struct wlc_bsscfg *cfg); ++extern void wlc_scan_start(struct wlc_info *wlc); ++extern void wlc_scan_stop(struct wlc_info *wlc); + + static inline int wlc_iovar_getuint(struct wlc_info *wlc, const char *name, + uint *arg) diff --git a/queue-2.6.37/staging-brcm80211-remove-assert-to-avoid-panic-since-2.6.37-kernel.patch b/queue-2.6.37/staging-brcm80211-remove-assert-to-avoid-panic-since-2.6.37-kernel.patch new file mode 100644 index 00000000000..81590db63dc --- /dev/null +++ b/queue-2.6.37/staging-brcm80211-remove-assert-to-avoid-panic-since-2.6.37-kernel.patch @@ -0,0 +1,53 @@ +From arend@broadcom.com Thu Feb 24 17:22:54 2011 +From: "Arend van Spriel" +Date: Thu, 24 Feb 2011 21:42:18 +0100 +Subject: staging: brcm80211: remove assert to avoid panic since 2.6.37 kernel +To: gregkh@suse.de +Cc: rvossen@broadcom.com, stable@kernel.org +Message-ID: <1298580139-3695-1-git-send-email-arend@broadcom.com> + +From: Arend van Spriel + +commit d062d44a8386c82c06e483f0c0d1124ba3cab2c8 upstream + +The driver assumed it would receive skb packets from MAC80211 which +are not cloned. To guard this assumption an assert was placed in +the transmit routine. As of kernel 2.6.37 it turns out MAC80211 does +pass skb packets that are cloned. The assert is also not needed as +it does not lead to a failure state in our driver when the packet is +cloned. Therefore the assert can safely be removed. + +> commit f8a0a781488ec7288d1049e5d2022850aa98f7b6 +> Author: Felix Fietkau +> Date: Sat Dec 18 19:30:50 2010 +0100 +> +> mac80211: fix potentially redundant skb data copying +> +> When an skb is shared, it needs to be duplicated, along with its data +> If the skb does not have enough headroom, using skb_copy might cause t +> buffer to be copied twice (once by skb_copy and once by pskb_expand_he +> Fix this by using skb_clone initially and letting ieee80211_skb_resize +> out the rest. +> +> Signed-off-by: Felix Fietkau +> Signed-off-by: John W. Linville +> + +Acked-by: Brett Rudley +Signed-off-by: Arend van Spriel +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/brcm80211/sys/wlc_mac80211.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/drivers/staging/brcm80211/sys/wlc_mac80211.c ++++ b/drivers/staging/brcm80211/sys/wlc_mac80211.c +@@ -5336,7 +5336,6 @@ wlc_sendpkt_mac80211(wlc_info_t *wlc, vo + fifo = prio2fifo[prio]; + + ASSERT((uint) PKTHEADROOM(sdu) >= TXOFF); +- ASSERT(!PKTSHARED(sdu)); + ASSERT(!PKTNEXT(sdu)); + ASSERT(!PKTLINK(sdu)); + ASSERT(fifo < NFIFO); diff --git a/queue-2.6.37/tcp-fix-inet_twsk_deschedule.patch b/queue-2.6.37/tcp-fix-inet_twsk_deschedule.patch new file mode 100644 index 00000000000..09ba39cdfe1 --- /dev/null +++ b/queue-2.6.37/tcp-fix-inet_twsk_deschedule.patch @@ -0,0 +1,44 @@ +From 91035f0b7d89291af728b6f3e370c3be58fcbe1b Mon Sep 17 00:00:00 2001 +From: Eric Dumazet +Date: Fri, 18 Feb 2011 22:35:56 +0000 +Subject: tcp: fix inet_twsk_deschedule() + +From: Eric Dumazet + +commit 91035f0b7d89291af728b6f3e370c3be58fcbe1b upstream. + +Eric W. Biederman reported a lockdep splat in inet_twsk_deschedule() + +This is caused by inet_twsk_purge(), run from process context, +and commit 575f4cd5a5b6394577 (net: Use rcu lookups in inet_twsk_purge.) +removed the BH disabling that was necessary. + +Add the BH disabling but fine grained, right before calling +inet_twsk_deschedule(), instead of whole function. + +With help from Linus Torvalds and Eric W. Biederman + +Reported-by: Eric W. Biederman +Signed-off-by: Eric Dumazet +CC: Daniel Lezcano +CC: Pavel Emelyanov +CC: Arnaldo Carvalho de Melo +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + net/ipv4/inet_timewait_sock.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/net/ipv4/inet_timewait_sock.c ++++ b/net/ipv4/inet_timewait_sock.c +@@ -505,7 +505,9 @@ restart: + } + + rcu_read_unlock(); ++ local_bh_disable(); + inet_twsk_deschedule(tw, twdr); ++ local_bh_enable(); + inet_twsk_put(tw); + goto restart_rcu; + } diff --git a/queue-2.6.37/usb-add-quirk-for-samsung-android-phone-modem.patch b/queue-2.6.37/usb-add-quirk-for-samsung-android-phone-modem.patch new file mode 100644 index 00000000000..ecff70f1046 --- /dev/null +++ b/queue-2.6.37/usb-add-quirk-for-samsung-android-phone-modem.patch @@ -0,0 +1,37 @@ +From 72a012ce0a02c6c616676a24b40ff81d1aaeafda Mon Sep 17 00:00:00 2001 +From: Maciej Szmigiero +Date: Sat, 5 Feb 2011 21:52:00 +0100 +Subject: USB: Add quirk for Samsung Android phone modem + +From: Maciej Szmigiero + +commit 72a012ce0a02c6c616676a24b40ff81d1aaeafda upstream. + +My Galaxy Spica needs this quirk when in modem mode, otherwise +it causes endless USB bus resets and is unusable in this mode. + +Unfortunately Samsung decided to reuse ID of its old CDMA phone SGH-I500 +for the modem part. +That's why in addition to this patch the visor driver must be prevented +from binding to SPH-I500 ID, so ACM driver can do that. + +Signed-off-by: Maciej Szmigiero +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/quirks.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/usb/core/quirks.c ++++ b/drivers/usb/core/quirks.c +@@ -48,6 +48,10 @@ static const struct usb_device_id usb_qu + { USB_DEVICE(0x04b4, 0x0526), .driver_info = + USB_QUIRK_CONFIG_INTF_STRINGS }, + ++ /* Samsung Android phone modem - ID conflict with SPH-I500 */ ++ { USB_DEVICE(0x04e8, 0x6601), .driver_info = ++ USB_QUIRK_CONFIG_INTF_STRINGS }, ++ + /* Roland SC-8820 */ + { USB_DEVICE(0x0582, 0x0007), .driver_info = USB_QUIRK_RESET_RESUME }, + diff --git a/queue-2.6.37/usb-add-quirks-entry-for-keytouch-qwerty-panel.patch b/queue-2.6.37/usb-add-quirks-entry-for-keytouch-qwerty-panel.patch new file mode 100644 index 00000000000..381495c210f --- /dev/null +++ b/queue-2.6.37/usb-add-quirks-entry-for-keytouch-qwerty-panel.patch @@ -0,0 +1,35 @@ +From 3c18e30f87ac5466bddbb05cf955605efd7db025 Mon Sep 17 00:00:00 2001 +From: Alan Stern +Date: Thu, 17 Feb 2011 10:26:38 -0500 +Subject: USB: add quirks entry for Keytouch QWERTY Panel + +From: Alan Stern + +commit 3c18e30f87ac5466bddbb05cf955605efd7db025 upstream. + +This patch (as1448) adds a quirks entry for the Keytouch QWERTY Panel +firmware, used in the IEC 60945 keyboard. This device crashes during +enumeration when the computer asks for its configuration string +descriptor. + +Signed-off-by: Alan Stern +Tested-by: kholis +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/quirks.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/usb/core/quirks.c ++++ b/drivers/usb/core/quirks.c +@@ -68,6 +68,10 @@ static const struct usb_device_id usb_qu + /* M-Systems Flash Disk Pioneers */ + { USB_DEVICE(0x08ec, 0x1000), .driver_info = USB_QUIRK_RESET_RESUME }, + ++ /* Keytouch QWERTY Panel keyboard */ ++ { USB_DEVICE(0x0926, 0x3333), .driver_info = ++ USB_QUIRK_CONFIG_INTF_STRINGS }, ++ + /* X-Rite/Gretag-Macbeth Eye-One Pro display colorimeter */ + { USB_DEVICE(0x0971, 0x2000), .driver_info = USB_QUIRK_NO_SET_INTF }, + diff --git a/queue-2.6.37/usb-add-samsung-sgh-i500-android-modem-id-switch-to-visor-driver.patch b/queue-2.6.37/usb-add-samsung-sgh-i500-android-modem-id-switch-to-visor-driver.patch new file mode 100644 index 00000000000..f1492549a37 --- /dev/null +++ b/queue-2.6.37/usb-add-samsung-sgh-i500-android-modem-id-switch-to-visor-driver.patch @@ -0,0 +1,59 @@ +From acb52cb1613e1d3c8a8c650717cc51965c60d7d4 Mon Sep 17 00:00:00 2001 +From: Maciej Szmigiero +Date: Mon, 7 Feb 2011 12:42:36 +0100 +Subject: USB: Add Samsung SGH-I500/Android modem ID switch to visor driver + +From: Maciej Szmigiero + +commit acb52cb1613e1d3c8a8c650717cc51965c60d7d4 upstream. + +[USB]Add Samsung SGH-I500/Android modem ID switch to visor driver + +Samsung decided to reuse USB ID of its old CDMA phone SGH-I500 for the +modem part of some of their Android phones. At least Galaxy Spica +is affected. + +This modem needs ACM driver and does not work with visor driver which +binds the conflicting ID for SGH-I500. +Because SGH-I500 is pretty an old hardware its best to add switch to +visor +driver in cause somebody still wants to use that phone with Linux. + +Note that this is needed only when using the Android phone as modem, +not in USB storage or ADB mode. + +Signed-off-by: Maciej Szmigiero +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/visor.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +--- a/drivers/usb/serial/visor.c ++++ b/drivers/usb/serial/visor.c +@@ -27,6 +27,7 @@ + #include + #include + #include ++#include + #include "visor.h" + + /* +@@ -479,6 +480,17 @@ static int visor_probe(struct usb_serial + + dbg("%s", __func__); + ++ /* ++ * some Samsung Android phones in modem mode have the same ID ++ * as SPH-I500, but they are ACM devices, so dont bind to them ++ */ ++ if (id->idVendor == SAMSUNG_VENDOR_ID && ++ id->idProduct == SAMSUNG_SPH_I500_ID && ++ serial->dev->descriptor.bDeviceClass == USB_CLASS_COMM && ++ serial->dev->descriptor.bDeviceSubClass == ++ USB_CDC_SUBCLASS_ACM) ++ return -ENODEV; ++ + if (serial->dev->actconfig->desc.bConfigurationValue != 1) { + dev_err(&serial->dev->dev, "active config #%d != 1 ??\n", + serial->dev->actconfig->desc.bConfigurationValue); diff --git a/queue-2.6.37/usb-musb-omap2430-fix-kernel-panic-on-reboot.patch b/queue-2.6.37/usb-musb-omap2430-fix-kernel-panic-on-reboot.patch new file mode 100644 index 00000000000..1396359a260 --- /dev/null +++ b/queue-2.6.37/usb-musb-omap2430-fix-kernel-panic-on-reboot.patch @@ -0,0 +1,89 @@ +From b193b412e62b134adf69af286c7e7f8e99259350 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Fri, 11 Feb 2011 16:57:08 +0100 +Subject: usb: musb: omap2430: fix kernel panic on reboot + +From: Johan Hovold + +commit b193b412e62b134adf69af286c7e7f8e99259350 upstream. + +Cancel idle timer in musb_platform_exit. + +The idle timer could trigger after clock had been disabled leading to +kernel panic when MUSB_DEVCTL is accessed in musb_do_idle on 2.6.37. + +The fault below is no longer triggered on 2.6.38-rc4 (clock is disabled +later, and only if compiled as a module, and the offending memory access +has moved) but the timer should be cancelled nonetheless. + +Rebooting... musb_hdrc musb_hdrc: remove, state 4 +usb usb1: USB disconnect, address 1 +musb_hdrc musb_hdrc: USB bus 1 deregistered +Unhandled fault: external abort on non-linefetch (0x1028) at 0xfa0ab060 +Internal error: : 1028 [#1] PREEMPT +last sysfs file: /sys/kernel/uevent_seqnum +Modules linked in: +CPU: 0 Not tainted (2.6.37+ #6) +PC is at musb_do_idle+0x24/0x138 +LR is at musb_do_idle+0x18/0x138 +pc : [] lr : [] psr: 80000193 +sp : cf2bdd80 ip : cf2bdd80 fp : c048a20c +r10: c048a60c r9 : c048a40c r8 : cf85e110 +r7 : cf2bc000 r6 : 40000113 r5 : c0489800 r4 : cf85e110 +r3 : 00000004 r2 : 00000006 r1 : fa0ab000 r0 : cf8a7000 +Flags: Nzcv IRQs off FIQs on Mode SVC_32 ISA ARM Segment user +Control: 10c5387d Table: 8faac019 DAC: 00000015 +Process reboot (pid: 769, stack limit = 0xcf2bc2f0) +Stack: (0xcf2bdd80 to 0xcf2be000) +dd80: 00000103 c0489800 c02377b4 c005fa34 00000555 c0071a8c c04a3858 cf2bdda8 +dda0: 00000555 c048a00c cf2bdda8 cf2bdda8 1838beb0 00000103 00000004 cf2bc000 +ddc0: 00000001 00000001 c04896c8 0000000a 00000000 c005ac14 00000001 c003f32c +dde0: 00000000 00000025 00000000 cf2bc000 00000002 00000001 cf2bc000 00000000 +de00: 00000001 c005ad08 cf2bc000 c002e07c c03ec039 ffffffff fa200000 c0033608 +de20: 00000001 00000000 cf852c14 cf81f200 c045b714 c045b708 cf2bc000 c04a37e8 +de40: c0033c04 cf2bc000 00000000 00000001 cf2bde68 cf2bde68 c01c3abc c004f7d8 +de60: 60000013 ffffffff c0033c04 00000000 01234567 fee1dead 00000000 c006627c +de80: 00000001 c00662c8 28121969 c00663ec cfa38c40 cf9f6a00 cf2bded0 cf9f6a0c +dea0: 00000000 cf92f000 00008914 c02cd284 c04a55c8 c028b398 c00715c0 becf24a8 +dec0: 30687465 00000000 00000000 00000000 00000002 1301a8c0 00000000 00000000 +dee0: 00000002 1301a8c0 00000000 00000000 c0450494 cf527920 00011f10 cf2bdf08 +df00: 00011f10 cf2bdf10 00011f10 cf2bdf18 c00f0b44 c004f7e8 cf2bdf18 cf2bdf18 +df20: 00011f10 cf2bdf30 00011f10 cf2bdf38 cf401300 cf486100 00000008 c00d2b28 +df40: 00011f10 cf401300 00200200 c00d3388 00011f10 cfb63a88 cfb63a80 c00c2f08 +df60: 00000000 00000000 cfb63a80 00000000 cf0a3480 00000006 c0033c04 cfb63a80 +df80: 00000000 c00c0104 00000003 cf0a3480 cfb63a80 00000000 00000001 00000004 +dfa0: 00000058 c0033a80 00000000 00000001 fee1dead 28121969 01234567 00000000 +dfc0: 00000000 00000001 00000004 00000058 00000001 00000001 00000000 00000001 +dfe0: 4024d200 becf2cb0 00009210 4024d218 60000010 fee1dead 00000000 00000000 +[] (musb_do_idle+0x24/0x138) from [] (run_timer_softirq+0x1a8/0x26) +[] (run_timer_softirq+0x1a8/0x26c) from [] (__do_softirq+0x88/0x13) +[] (__do_softirq+0x88/0x138) from [] (irq_exit+0x44/0x98) +[] (irq_exit+0x44/0x98) from [] (asm_do_IRQ+0x7c/0xa0) +[] (asm_do_IRQ+0x7c/0xa0) from [] (__irq_svc+0x48/0xa8) +Exception stack(0xcf2bde20 to 0xcf2bde68) +de20: 00000001 00000000 cf852c14 cf81f200 c045b714 c045b708 cf2bc000 c04a37e8 +de40: c0033c04 cf2bc000 00000000 00000001 cf2bde68 cf2bde68 c01c3abc c004f7d8 +de60: 60000013 ffffffff +[] (__irq_svc+0x48/0xa8) from [] (sub_preempt_count+0x0/0xb8) +Code: ebf86030 e5940098 e594108c e5902010 (e5d13060) +---[ end trace 3689c0d808f9bf7c ]--- +Kernel panic - not syncing: Fatal exception in interrupt + +Signed-off-by: Johan Hovold +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/musb/omap2430.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/musb/omap2430.c ++++ b/drivers/usb/musb/omap2430.c +@@ -317,6 +317,7 @@ static int musb_platform_resume(struct m + + int musb_platform_exit(struct musb *musb) + { ++ del_timer_sync(&musb_idle_timer); + + musb_platform_suspend(musb); + diff --git a/queue-2.6.37/usb-serial-usb_wwan-fix-tty-null-dereference.patch b/queue-2.6.37/usb-serial-usb_wwan-fix-tty-null-dereference.patch new file mode 100644 index 00000000000..5c08ed9dc4c --- /dev/null +++ b/queue-2.6.37/usb-serial-usb_wwan-fix-tty-null-dereference.patch @@ -0,0 +1,71 @@ +From 38237fd2be9421c104f84cc35665097bdce89013 Mon Sep 17 00:00:00 2001 +From: Jiri Slaby +Date: Tue, 15 Feb 2011 15:55:07 +0100 +Subject: USB: serial/usb_wwan, fix tty NULL dereference + +From: Jiri Slaby + +commit 38237fd2be9421c104f84cc35665097bdce89013 upstream. + +tty_port_tty_get may return without any problems NULL. Handle this +case and do not oops in usb_wwan_indat_callback by dereferencing it. + +The oops: +Unable to handle kernel paging request for data at address 0x000000d8 +Faulting instruction address: 0xc0175b3c +Oops: Kernel access of bad area, sig: 11 [#1] +PowerPC 40x Platform +last sysfs file: +/sys/devices/pci0000:00/0000:00:00.0/0000:01:00.0/0000:02:09.2/usb1/idVendor +Modules linked in: +NIP: c0175b3c LR: c0175e7c CTR: c0215c90 +REGS: c77f7d50 TRAP: 0300 Not tainted (2.6.37-rc5) +MSR: 00021030 CR: 88482028 XER: 2000005f +DEAR: 000000d8, ESR: 00000000 +TASK = c7141b90[1149] 'wvdial' THREAD: c2750000 +GPR00: 00021030 c77f7e00 c7141b90 00000000 0000000e 00000000 0000000e c0410680 +GPR08: c683db00 00000000 00000001 c03c81f8 88482028 10073ef4 ffffffb9 ffffff94 +GPR16: 00000000 fde036c0 00200200 00100100 00000001 ffffff8d c34fabcc 00000000 +GPR24: c71120d4 00000000 00000000 0000000e 00021030 00000000 00000000 0000000e +NIP [c0175b3c] tty_buffer_request_room+0x2c/0x194 +LR [c0175e7c] tty_insert_flip_string_fixed_flag+0x3c/0xb0 +Call Trace: +[c77f7e00] [00000003] 0x3 (unreliable) +[c77f7e30] [c0175e7c] tty_insert_flip_string_fixed_flag+0x3c/0xb0 +[c77f7e60] [c0215df4] usb_wwan_indat_callback+0x164/0x170 +... + +References: https://bugzilla.kernel.org/show_bug.cgi?id=24582 +Cc: Amit Shah +Cc: baoyb +Signed-off-by: Jiri Slaby +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/usb_wwan.c | 15 +++++++++------ + 1 file changed, 9 insertions(+), 6 deletions(-) + +--- a/drivers/usb/serial/usb_wwan.c ++++ b/drivers/usb/serial/usb_wwan.c +@@ -216,12 +216,15 @@ static void usb_wwan_indat_callback(stru + __func__, status, endpoint); + } else { + tty = tty_port_tty_get(&port->port); +- if (urb->actual_length) { +- tty_insert_flip_string(tty, data, urb->actual_length); +- tty_flip_buffer_push(tty); +- } else +- dbg("%s: empty read urb received", __func__); +- tty_kref_put(tty); ++ if (tty) { ++ if (urb->actual_length) { ++ tty_insert_flip_string(tty, data, ++ urb->actual_length); ++ tty_flip_buffer_push(tty); ++ } else ++ dbg("%s: empty read urb received", __func__); ++ tty_kref_put(tty); ++ } + + /* Resubmit urb so we continue receiving */ + if (status != -ESHUTDOWN) {