From 62e9f1ccd2890ed29a824ace028054ff6bfaff4a Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Wed, 4 Jun 2014 17:02:22 -0700 Subject: [PATCH] 3.4-stable patches added patches: can-c_can-set-reserved-bit-in-ifx_mask2-to-1-on-write.patch e1000e-dos-while-tso-enabled-caused-by-link-partner-with-small-mss.patch floppy-properly-handle-failure-on-add_disk-loop.patch i82975x_edac-fix-dimm-label-initialization.patch i915-ensure-that-vga-plane-is-disabled.patch input-synaptics-adjust-threshold-for-treating-position-values-as-negative.patch intel_idle-don-t-register-cpu-notifier-if-we-are-not-running.patch mac80211-introduce-ieee80211_hw_teardown_aggr_on_bar_fail.patch misc-hpilo-remove-pci_disable_device.patch pci-shpchp-use-per-slot-workqueues-to-avoid-deadlock.patch regulator-max8997-use-uv-in-voltage_map_desc.patch regulator-max8998-ensure-enough-delay-time-for-max8998_set_voltage_buck_time_sel.patch ubi-erase-free-peb-with-bitflip-in-ec-header.patch --- ...erved-bit-in-ifx_mask2-to-1-on-write.patch | 39 ++++ ...aused-by-link-partner-with-small-mss.patch | 180 +++++++++++++++++ ...erly-handle-failure-on-add_disk-loop.patch | 52 +++++ ...x_edac-fix-dimm-label-initialization.patch | 83 ++++++++ ...15-ensure-that-vga-plane-is-disabled.patch | 76 ++++++++ ...treating-position-values-as-negative.patch | 93 +++++++++ ...r-cpu-notifier-if-we-are-not-running.patch | 108 ++++++++++ ...ee80211_hw_teardown_aggr_on_bar_fail.patch | 77 ++++++++ ...misc-hpilo-remove-pci_disable_device.patch | 65 +++++++ ...er-slot-workqueues-to-avoid-deadlock.patch | 184 ++++++++++++++++++ ...r-max8997-use-uv-in-voltage_map_desc.patch | 155 +++++++++++++++ ...or-max8998_set_voltage_buck_time_sel.patch | 36 ++++ queue-3.4/series | 13 ++ ...e-free-peb-with-bitflip-in-ec-header.patch | 35 ++++ 14 files changed, 1196 insertions(+) create mode 100644 queue-3.4/can-c_can-set-reserved-bit-in-ifx_mask2-to-1-on-write.patch create mode 100644 queue-3.4/e1000e-dos-while-tso-enabled-caused-by-link-partner-with-small-mss.patch create mode 100644 queue-3.4/floppy-properly-handle-failure-on-add_disk-loop.patch create mode 100644 queue-3.4/i82975x_edac-fix-dimm-label-initialization.patch create mode 100644 queue-3.4/i915-ensure-that-vga-plane-is-disabled.patch create mode 100644 queue-3.4/input-synaptics-adjust-threshold-for-treating-position-values-as-negative.patch create mode 100644 queue-3.4/intel_idle-don-t-register-cpu-notifier-if-we-are-not-running.patch create mode 100644 queue-3.4/mac80211-introduce-ieee80211_hw_teardown_aggr_on_bar_fail.patch create mode 100644 queue-3.4/misc-hpilo-remove-pci_disable_device.patch create mode 100644 queue-3.4/pci-shpchp-use-per-slot-workqueues-to-avoid-deadlock.patch create mode 100644 queue-3.4/regulator-max8997-use-uv-in-voltage_map_desc.patch create mode 100644 queue-3.4/regulator-max8998-ensure-enough-delay-time-for-max8998_set_voltage_buck_time_sel.patch create mode 100644 queue-3.4/ubi-erase-free-peb-with-bitflip-in-ec-header.patch diff --git a/queue-3.4/can-c_can-set-reserved-bit-in-ifx_mask2-to-1-on-write.patch b/queue-3.4/can-c_can-set-reserved-bit-in-ifx_mask2-to-1-on-write.patch new file mode 100644 index 00000000000..2d4541d622e --- /dev/null +++ b/queue-3.4/can-c_can-set-reserved-bit-in-ifx_mask2-to-1-on-write.patch @@ -0,0 +1,39 @@ +From 61869db60d56417729327e0218d8b4afcd396c10 Mon Sep 17 00:00:00 2001 +From: Alexander Stein +Date: Thu, 13 Dec 2012 10:06:10 +0100 +Subject: can: c_can: Set reserved bit in IFx_MASK2 to 1 on write + +From: Alexander Stein + +commit 2bd3bc4e8472424f1a6009825397639a8968920a upstream. + +According to C_CAN documentation, the reserved bit in IFx_MASK2 register is +fixed 1. + +Signed-off-by: Alexander Stein +Signed-off-by: Marc Kleine-Budde +[bwh: Backported to 3.2: adjust context] +Signed-off-by: Ben Hutchings +Cc: Qiang Huang +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/can/c_can/c_can.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/drivers/net/can/c_can/c_can.c ++++ b/drivers/net/can/c_can/c_can.c +@@ -446,8 +446,12 @@ static void c_can_setup_receive_object(s + + priv->write_reg(priv, &priv->regs->ifregs[iface].mask1, + IFX_WRITE_LOW_16BIT(mask)); ++ ++ /* According to C_CAN documentation, the reserved bit ++ * in IFx_MASK2 register is fixed 1 ++ */ + priv->write_reg(priv, &priv->regs->ifregs[iface].mask2, +- IFX_WRITE_HIGH_16BIT(mask)); ++ IFX_WRITE_HIGH_16BIT(mask) | BIT(13)); + + priv->write_reg(priv, &priv->regs->ifregs[iface].arb1, + IFX_WRITE_LOW_16BIT(id)); diff --git a/queue-3.4/e1000e-dos-while-tso-enabled-caused-by-link-partner-with-small-mss.patch b/queue-3.4/e1000e-dos-while-tso-enabled-caused-by-link-partner-with-small-mss.patch new file mode 100644 index 00000000000..67cf4d83bfc --- /dev/null +++ b/queue-3.4/e1000e-dos-while-tso-enabled-caused-by-link-partner-with-small-mss.patch @@ -0,0 +1,180 @@ +From d821a4c4d11ad160925dab2bb009b8444beff484 Mon Sep 17 00:00:00 2001 +From: Bruce Allan +Date: Fri, 24 Aug 2012 20:38:11 +0000 +Subject: e1000e: DoS while TSO enabled caused by link partner with small MSS + +From: Bruce Allan + +commit d821a4c4d11ad160925dab2bb009b8444beff484 upstream. + +With a low enough MSS on the link partner and TSO enabled locally, the +networking stack can periodically send a very large (e.g. 64KB) TCP +message for which the driver will attempt to use more Tx descriptors than +are available by default in the Tx ring. This is due to a workaround in +the code that imposes a limit of only 4 MSS-sized segments per descriptor +which appears to be a carry-over from the older e1000 driver and may be +applicable only to some older PCI or PCIx parts which are not supported in +e1000e. When the driver gets a message that is too large to fit across the +configured number of Tx descriptors, it stops the upper stack from queueing +any more and gets stuck in this state. After a timeout, the upper stack +assumes the adapter is hung and calls the driver to reset it. + +Remove the unnecessary limitation of using up to only 4 MSS-sized segments +per Tx descriptor, and put in a hard failure test to catch when attempting +to check for message sizes larger than would fit in the whole Tx ring. +Refactor the remaining logic that limits the size of data per Tx descriptor +from a seemingly arbitrary 8KB to a limit based on the dynamic size of the +Tx packet buffer as described in the hardware specification. + +Also, fix the logic in the check for space in the Tx ring for the next +largest possible packet after the current one has been successfully queued +for transmit, and use the appropriate defines for default ring sizes in +e1000_probe instead of magic values. + +This issue goes back to the introduction of e1000e in 2.6.24 when it was +split off from e1000. + +Reported-by: Ben Hutchings +Signed-off-by: Bruce Allan +Tested-by: Aaron Brown +Signed-off-by: Jeff Kirsher +Signed-off-by: David S. Miller +Cc: Qiang Huang +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/ethernet/intel/e1000e/e1000.h | 1 + drivers/net/ethernet/intel/e1000e/netdev.c | 48 +++++++++++++---------------- + 2 files changed, 24 insertions(+), 25 deletions(-) + +--- a/drivers/net/ethernet/intel/e1000e/e1000.h ++++ b/drivers/net/ethernet/intel/e1000e/e1000.h +@@ -309,6 +309,7 @@ struct e1000_adapter { + */ + struct e1000_ring *tx_ring /* One per active queue */ + ____cacheline_aligned_in_smp; ++ u32 tx_fifo_limit; + + struct napi_struct napi; + +--- a/drivers/net/ethernet/intel/e1000e/netdev.c ++++ b/drivers/net/ethernet/intel/e1000e/netdev.c +@@ -3498,6 +3498,15 @@ void e1000e_reset(struct e1000_adapter * + } + + /* ++ * Alignment of Tx data is on an arbitrary byte boundary with the ++ * maximum size per Tx descriptor limited only to the transmit ++ * allocation of the packet buffer minus 96 bytes with an upper ++ * limit of 24KB due to receive synchronization limitations. ++ */ ++ adapter->tx_fifo_limit = min_t(u32, ((er32(PBA) >> 16) << 10) - 96, ++ 24 << 10); ++ ++ /* + * Disable Adaptive Interrupt Moderation if 2 full packets cannot + * fit in receive buffer. + */ +@@ -4766,12 +4775,9 @@ static bool e1000_tx_csum(struct e1000_r + return 1; + } + +-#define E1000_MAX_PER_TXD 8192 +-#define E1000_MAX_TXD_PWR 12 +- + static int e1000_tx_map(struct e1000_ring *tx_ring, struct sk_buff *skb, + unsigned int first, unsigned int max_per_txd, +- unsigned int nr_frags, unsigned int mss) ++ unsigned int nr_frags) + { + struct e1000_adapter *adapter = tx_ring->adapter; + struct pci_dev *pdev = adapter->pdev; +@@ -5004,20 +5010,19 @@ static int __e1000_maybe_stop_tx(struct + + static int e1000_maybe_stop_tx(struct e1000_ring *tx_ring, int size) + { ++ BUG_ON(size > tx_ring->count); ++ + if (e1000_desc_unused(tx_ring) >= size) + return 0; + return __e1000_maybe_stop_tx(tx_ring, size); + } + +-#define TXD_USE_COUNT(S, X) (((S) >> (X)) + 1) + static netdev_tx_t e1000_xmit_frame(struct sk_buff *skb, + struct net_device *netdev) + { + struct e1000_adapter *adapter = netdev_priv(netdev); + struct e1000_ring *tx_ring = adapter->tx_ring; + unsigned int first; +- unsigned int max_per_txd = E1000_MAX_PER_TXD; +- unsigned int max_txd_pwr = E1000_MAX_TXD_PWR; + unsigned int tx_flags = 0; + unsigned int len = skb_headlen(skb); + unsigned int nr_frags; +@@ -5037,18 +5042,8 @@ static netdev_tx_t e1000_xmit_frame(stru + } + + mss = skb_shinfo(skb)->gso_size; +- /* +- * The controller does a simple calculation to +- * make sure there is enough room in the FIFO before +- * initiating the DMA for each buffer. The calc is: +- * 4 = ceil(buffer len/mss). To make sure we don't +- * overrun the FIFO, adjust the max buffer len if mss +- * drops. +- */ + if (mss) { + u8 hdr_len; +- max_per_txd = min(mss << 2, max_per_txd); +- max_txd_pwr = fls(max_per_txd) - 1; + + /* + * TSO Workaround for 82571/2/3 Controllers -- if skb->data +@@ -5078,12 +5073,12 @@ static netdev_tx_t e1000_xmit_frame(stru + count++; + count++; + +- count += TXD_USE_COUNT(len, max_txd_pwr); ++ count += DIV_ROUND_UP(len, adapter->tx_fifo_limit); + + nr_frags = skb_shinfo(skb)->nr_frags; + for (f = 0; f < nr_frags; f++) +- count += TXD_USE_COUNT(skb_frag_size(&skb_shinfo(skb)->frags[f]), +- max_txd_pwr); ++ count += DIV_ROUND_UP(skb_frag_size(&skb_shinfo(skb)->frags[f]), ++ adapter->tx_fifo_limit); + + if (adapter->hw.mac.tx_pkt_filtering) + e1000_transfer_dhcp_info(adapter, skb); +@@ -5125,13 +5120,16 @@ static netdev_tx_t e1000_xmit_frame(stru + tx_flags |= E1000_TX_FLAGS_NO_FCS; + + /* if count is 0 then mapping error has occurred */ +- count = e1000_tx_map(tx_ring, skb, first, max_per_txd, nr_frags, mss); ++ count = e1000_tx_map(tx_ring, skb, first, adapter->tx_fifo_limit, ++ nr_frags); + if (count) { + netdev_sent_queue(netdev, skb->len); + e1000_tx_queue(tx_ring, tx_flags, count); + /* Make sure there is space in the ring for the next send. */ +- e1000_maybe_stop_tx(tx_ring, MAX_SKB_FRAGS + 2); +- ++ e1000_maybe_stop_tx(tx_ring, ++ (MAX_SKB_FRAGS * ++ DIV_ROUND_UP(PAGE_SIZE, ++ adapter->tx_fifo_limit) + 2)); + } else { + dev_kfree_skb_any(skb); + tx_ring->buffer_info[first].time_stamp = 0; +@@ -6303,8 +6301,8 @@ static int __devinit e1000_probe(struct + adapter->hw.phy.autoneg_advertised = 0x2f; + + /* ring size defaults */ +- adapter->rx_ring->count = 256; +- adapter->tx_ring->count = 256; ++ adapter->rx_ring->count = E1000_DEFAULT_RXD; ++ adapter->tx_ring->count = E1000_DEFAULT_TXD; + + /* + * Initial Wake on LAN setting - If APM wake is enabled in diff --git a/queue-3.4/floppy-properly-handle-failure-on-add_disk-loop.patch b/queue-3.4/floppy-properly-handle-failure-on-add_disk-loop.patch new file mode 100644 index 00000000000..17c210d2389 --- /dev/null +++ b/queue-3.4/floppy-properly-handle-failure-on-add_disk-loop.patch @@ -0,0 +1,52 @@ +From 5b4478f5dabb7f764e2fce480b47204e06095a73 Mon Sep 17 00:00:00 2001 +From: Herton Ronaldo Krzesinski +Date: Mon, 27 Aug 2012 20:56:54 -0300 +Subject: floppy: properly handle failure on add_disk loop + +From: Herton Ronaldo Krzesinski + +commit d60e7ec18c3fb2cbf90969ccd42889eb2d03aef9 upstream. + +On floppy initialization, if something failed inside the loop we call +add_disk, there was no cleanup of previous iterations in the error +handling. + +Signed-off-by: Herton Ronaldo Krzesinski +Signed-off-by: Jiri Kosina +Signed-off-by: Jens Axboe +[bwh: Backported to 3.2: adjust context] +Signed-off-by: Ben Hutchings +Cc: Qiang Huang +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/block/floppy.c | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +--- a/drivers/block/floppy.c ++++ b/drivers/block/floppy.c +@@ -4306,7 +4306,7 @@ static int __init floppy_init(void) + + err = platform_device_register(&floppy_device[drive]); + if (err) +- goto out_flush_work; ++ goto out_remove_drives; + + err = device_create_file(&floppy_device[drive].dev, + &dev_attr_cmos); +@@ -4324,6 +4324,15 @@ static int __init floppy_init(void) + + out_unreg_platform_dev: + platform_device_unregister(&floppy_device[drive]); ++out_remove_drives: ++ while (drive--) { ++ if ((allowed_drive_mask & (1 << drive)) && ++ fdc_state[FDC(drive)].version != FDC_NONE) { ++ del_gendisk(disks[drive]); ++ device_remove_file(&floppy_device[drive].dev, &dev_attr_cmos); ++ platform_device_unregister(&floppy_device[drive]); ++ } ++ } + out_flush_work: + flush_work_sync(&floppy_work); + if (atomic_read(&usage_count)) diff --git a/queue-3.4/i82975x_edac-fix-dimm-label-initialization.patch b/queue-3.4/i82975x_edac-fix-dimm-label-initialization.patch new file mode 100644 index 00000000000..db5faf09340 --- /dev/null +++ b/queue-3.4/i82975x_edac-fix-dimm-label-initialization.patch @@ -0,0 +1,83 @@ +From 850722ddad9d4307aeef02f874e2cdd33190bef0 Mon Sep 17 00:00:00 2001 +From: Mauro Carvalho Chehab +Date: Mon, 15 Oct 2012 21:48:48 -0300 +Subject: i82975x_edac: Fix dimm label initialization + +From: Mauro Carvalho Chehab + +commit 479696840239e0cc43efb3c917bdcad2174d2215 upstream. + +The driver has only 4 hardcoded labels, but allows much more memory. +Fix it by removing the hardcoded logic, using snprintf() instead. + +[ 19.833972] general protection fault: 0000 [#1] SMP +[ 19.837733] Modules linked in: i82975x_edac(+) edac_core firewire_ohci firewire_core crc_itu_t nouveau mxm_wmi wmi video i2c_algo_bit drm_kms_helper ttm drm i2c_core +[ 19.837733] CPU 0 +[ 19.837733] Pid: 390, comm: udevd Not tainted 3.6.1-1.fc17.x86_64.debug #1 Dell Inc. Precision WorkStation 390 /0MY510 +[ 19.837733] RIP: 0010:[] [] strncpy+0x18/0x30 +[ 19.837733] RSP: 0018:ffff880078535b68 EFLAGS: 00010202 +[ 19.837733] RAX: ffff880069fa9708 RBX: ffff880078588000 RCX: ffff880069fa9708 +[ 19.837733] RDX: 000000000000001f RSI: 5f706f5f63616465 RDI: ffff880069fa9708 +[ 19.837733] RBP: ffff880078535b68 R08: ffff880069fa9727 R09: 000000000000fffe +[ 19.837733] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000003 +[ 19.837733] R13: 0000000000000000 R14: ffff880069fa9290 R15: ffff880079624a80 +[ 19.837733] FS: 00007f3de01ee840(0000) GS:ffff88007c400000(0000) knlGS:0000000000000000 +[ 19.837733] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 19.837733] CR2: 00007f3de00b9000 CR3: 0000000078dbc000 CR4: 00000000000007f0 +[ 19.837733] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +[ 19.837733] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 +[ 19.837733] Process udevd (pid: 390, threadinfo ffff880078534000, task ffff880079642450) +[ 19.837733] Stack: +[ 19.837733] ffff880078535c18 ffffffffa017c6b8 00040000816d627f ffff880079624a88 +[ 19.837733] ffffc90004cd6000 ffff880079624520 ffff88007ac21148 0000000000000000 +[ 19.837733] 0000000000000000 0004000000000000 feda000078535bc8 ffffffff810d696d +[ 19.837733] Call Trace: +[ 19.837733] [] i82975x_init_one+0x2e6/0x3e6 [i82975x_edac] +... + +Fix bug reported at: + https://bugzilla.redhat.com/show_bug.cgi?id=848149 +And, very likely: + https://bbs.archlinux.org/viewtopic.php?id=148033 + https://bugzilla.kernel.org/show_bug.cgi?id=47171 + +Cc: Alan Cox +Signed-off-by: Mauro Carvalho Chehab +[bwh: Backported to 3.2: + - Adjust context + - Use csrow->channels[chan].label not csrow->channels[chan]->dimm->label] +Signed-off-by: Ben Hutchings +Cc: Qiang Huang +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/edac/i82975x_edac.c | 11 ++++------- + 1 file changed, 4 insertions(+), 7 deletions(-) + +--- a/drivers/edac/i82975x_edac.c ++++ b/drivers/edac/i82975x_edac.c +@@ -363,10 +363,6 @@ static enum dev_type i82975x_dram_type(v + static void i82975x_init_csrows(struct mem_ctl_info *mci, + struct pci_dev *pdev, void __iomem *mch_window) + { +- static const char *labels[4] = { +- "DIMM A1", "DIMM A2", +- "DIMM B1", "DIMM B2" +- }; + struct csrow_info *csrow; + unsigned long last_cumul_size; + u8 value; +@@ -407,9 +403,10 @@ static void i82975x_init_csrows(struct m + * [0-3] for dual-channel; i.e. csrow->nr_channels = 2 + */ + for (chan = 0; chan < csrow->nr_channels; chan++) +- strncpy(csrow->channels[chan].label, +- labels[(index >> 1) + (chan * 2)], +- EDAC_MC_LABEL_LEN); ++ ++ snprintf(csrow->channels[chan].label, EDAC_MC_LABEL_LEN, "DIMM %c%d", ++ (chan == 0) ? 'A' : 'B', ++ index); + + if (cumul_size == last_cumul_size) + continue; /* not populated */ diff --git a/queue-3.4/i915-ensure-that-vga-plane-is-disabled.patch b/queue-3.4/i915-ensure-that-vga-plane-is-disabled.patch new file mode 100644 index 00000000000..6e852779388 --- /dev/null +++ b/queue-3.4/i915-ensure-that-vga-plane-is-disabled.patch @@ -0,0 +1,76 @@ +From 29abfe4ddc74a2a597f4a47f02df1f5c4ad4a521 Mon Sep 17 00:00:00 2001 +From: Krzysztof Mazur +Date: Wed, 19 Dec 2012 11:03:41 +0100 +Subject: i915: ensure that VGA plane is disabled + +From: Krzysztof Mazur + +commit 0fde901f1ddd2ce0e380a6444f1fb7ca555859e9 upstream. + +Some broken systems (like HP nc6120) in some cases, usually after LID +close/open, enable VGA plane, making display unusable (black screen on LVDS, +some strange mode on VGA output). We used to disable VGA plane only once at +startup. Now we also check, if VGA plane is still disabled while changing +mode, and fix that if something changed it. + +Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=57434 +Signed-off-by: Krzysztof Mazur +Signed-off-by: Daniel Vetter +[bwh: Backported to 3.2: intel_modeset_setup_hw_state() does not + exist, so call i915_redisable_vga() directly from intel_lid_notify()] +Signed-off-by: Ben Hutchings +Cc: Qiang Huang +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/i915_drv.h | 1 + + drivers/gpu/drm/i915/intel_display.c | 17 +++++++++++++++++ + drivers/gpu/drm/i915/intel_lvds.c | 1 + + 3 files changed, 19 insertions(+) + +--- a/drivers/gpu/drm/i915/i915_drv.h ++++ b/drivers/gpu/drm/i915/i915_drv.h +@@ -1397,6 +1397,7 @@ static inline void intel_unregister_dsm_ + #endif /* CONFIG_ACPI */ + + /* modesetting */ ++extern void i915_redisable_vga(struct drm_device *dev); + extern void intel_modeset_init(struct drm_device *dev); + extern void intel_modeset_gem_init(struct drm_device *dev); + extern void intel_modeset_cleanup(struct drm_device *dev); +--- a/drivers/gpu/drm/i915/intel_display.c ++++ b/drivers/gpu/drm/i915/intel_display.c +@@ -9254,6 +9254,23 @@ static void i915_disable_vga(struct drm_ + POSTING_READ(vga_reg); + } + ++void i915_redisable_vga(struct drm_device *dev) ++{ ++ struct drm_i915_private *dev_priv = dev->dev_private; ++ u32 vga_reg; ++ ++ if (HAS_PCH_SPLIT(dev)) ++ vga_reg = CPU_VGACNTRL; ++ else ++ vga_reg = VGACNTRL; ++ ++ if (I915_READ(vga_reg) != VGA_DISP_DISABLE) { ++ DRM_DEBUG_KMS("Something enabled VGA plane, disabling it\n"); ++ I915_WRITE(vga_reg, VGA_DISP_DISABLE); ++ POSTING_READ(vga_reg); ++ } ++} ++ + void intel_modeset_init(struct drm_device *dev) + { + struct drm_i915_private *dev_priv = dev->dev_private; +--- a/drivers/gpu/drm/i915/intel_lvds.c ++++ b/drivers/gpu/drm/i915/intel_lvds.c +@@ -535,6 +535,7 @@ static int intel_lid_notify(struct notif + + mutex_lock(&dev->mode_config.mutex); + drm_helper_resume_force_mode(dev); ++ i915_redisable_vga(dev); + mutex_unlock(&dev->mode_config.mutex); + + return NOTIFY_OK; diff --git a/queue-3.4/input-synaptics-adjust-threshold-for-treating-position-values-as-negative.patch b/queue-3.4/input-synaptics-adjust-threshold-for-treating-position-values-as-negative.patch new file mode 100644 index 00000000000..da69ab8eb3c --- /dev/null +++ b/queue-3.4/input-synaptics-adjust-threshold-for-treating-position-values-as-negative.patch @@ -0,0 +1,93 @@ +From 0c53cadfdcd93f76f37fd1ad45e3fa8dacc73bad Mon Sep 17 00:00:00 2001 +From: Seth Forshee +Date: Fri, 28 Sep 2012 10:29:21 -0700 +Subject: Input: synaptics - adjust threshold for treating position values as negative + +From: Seth Forshee + +commit 824efd37415961d38821ecbd9694e213fb2e8b32 upstream. + +Commit c039450 (Input: synaptics - handle out of bounds values from the +hardware) caused any hardware reported values over 7167 to be treated as +a wrapped-around negative value. It turns out that some firmware uses +the value 8176 to indicate a finger near the edge of the touchpad whose +actual position cannot be determined. This value now gets treated as +negative, which can cause pointer jumps and broken edge scrolling on +these machines. + +I only know of one touchpad which reports negative values, and this +hardware never reports any value lower than -8 (i.e. 8184). Moving the +threshold for treating a value as negative up to 8176 should work fine +then for any hardware we currently know about, and since we're dealing +with unspecified behavior it's probably the best we can do. The special +8176 value is also likely to result in sudden jumps in position, so +let's also clamp this to the maximum specified value for the axis. + +BugLink: http://bugs.launchpad.net/bugs/1046512 +https://bugzilla.kernel.org/show_bug.cgi?id=46371 + +Signed-off-by: Seth Forshee +Reviewed-by: Daniel Kurtz +Tested-by: Alan Swanson +Tested-by: Arteom +Signed-off-by: Dmitry Torokhov +Signed-off-by: Ben Hutchings +Cc: Qiang Huang +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/input/mouse/synaptics.c | 31 +++++++++++++++++++++++-------- + 1 file changed, 23 insertions(+), 8 deletions(-) + +--- a/drivers/input/mouse/synaptics.c ++++ b/drivers/input/mouse/synaptics.c +@@ -53,14 +53,19 @@ + #define ABS_POS_BITS 13 + + /* +- * Any position values from the hardware above the following limits are +- * treated as "wrapped around negative" values that have been truncated to +- * the 13-bit reporting range of the hardware. These are just reasonable +- * guesses and can be adjusted if hardware is found that operates outside +- * of these parameters. ++ * These values should represent the absolute maximum value that will ++ * be reported for a positive position value. Some Synaptics firmware ++ * uses this value to indicate a finger near the edge of the touchpad ++ * whose precise position cannot be determined. ++ * ++ * At least one touchpad is known to report positions in excess of this ++ * value which are actually negative values truncated to the 13-bit ++ * reporting range. These values have never been observed to be lower ++ * than 8184 (i.e. -8), so we treat all values greater than 8176 as ++ * negative and any other value as positive. + */ +-#define X_MAX_POSITIVE (((1 << ABS_POS_BITS) + XMAX) / 2) +-#define Y_MAX_POSITIVE (((1 << ABS_POS_BITS) + YMAX) / 2) ++#define X_MAX_POSITIVE 8176 ++#define Y_MAX_POSITIVE 8176 + + /* + * Synaptics touchpads report the y coordinate from bottom to top, which is +@@ -583,11 +588,21 @@ static int synaptics_parse_hw_state(cons + hw->right = (buf[0] & 0x02) ? 1 : 0; + } + +- /* Convert wrap-around values to negative */ ++ /* ++ * Convert wrap-around values to negative. (X|Y)_MAX_POSITIVE ++ * is used by some firmware to indicate a finger at the edge of ++ * the touchpad whose precise position cannot be determined, so ++ * convert these values to the maximum axis value. ++ */ + if (hw->x > X_MAX_POSITIVE) + hw->x -= 1 << ABS_POS_BITS; ++ else if (hw->x == X_MAX_POSITIVE) ++ hw->x = XMAX; ++ + if (hw->y > Y_MAX_POSITIVE) + hw->y -= 1 << ABS_POS_BITS; ++ else if (hw->y == Y_MAX_POSITIVE) ++ hw->y = YMAX; + + return 0; + } diff --git a/queue-3.4/intel_idle-don-t-register-cpu-notifier-if-we-are-not-running.patch b/queue-3.4/intel_idle-don-t-register-cpu-notifier-if-we-are-not-running.patch new file mode 100644 index 00000000000..3f70c83673d --- /dev/null +++ b/queue-3.4/intel_idle-don-t-register-cpu-notifier-if-we-are-not-running.patch @@ -0,0 +1,108 @@ +From 24d64ff793d880d298aec64369babcdfd61e6bc2 Mon Sep 17 00:00:00 2001 +From: Konrad Rzeszutek Wilk +Date: Wed, 16 Jan 2013 23:40:01 +0100 +Subject: intel_idle: Don't register CPU notifier if we are not running. + +From: Konrad Rzeszutek Wilk + +commit 6f8c2e7933679f54b6478945dc72e59ef9a3d5e0 upstream. + +The 'intel_idle_probe' probes the CPU and sets the CPU notifier. +But if later on during the module initialization we fail (say +in cpuidle_register_driver), we stop loading, but we neglect +to unregister the CPU notifier. This means that during CPU +hotplug events the system will fail: + +calling intel_idle_init+0x0/0x326 @ 1 +intel_idle: MWAIT substates: 0x1120 +intel_idle: v0.4 model 0x2A +intel_idle: lapic_timer_reliable_states 0xffffffff +intel_idle: intel_idle yielding to none +initcall intel_idle_init+0x0/0x326 returned -19 after 14 usecs + +... some time later, offlining and onlining a CPU: + +cpu 3 spinlock event irq 62 +BUG: unable to ] __cpuidle_register_device+0x1c/0x120 +PGD 99b8b067 PUD 99b95067 PMD 0 +Oops: 0000 [#1] SMP +Modules linked in: xen_evtchn nouveau mxm_wmi wmi radeon ttm i915 fbcon tileblit font atl1c bitblit softcursor drm_kms_helper video xen_blkfront xen_netfront fb_sys_fops sysimgblt sysfillrect syscopyarea xenfs xen_privcmd mperf +CPU 0 +Pid: 2302, comm: udevd Not tainted 3.8.0-rc3upstream-00249-g09ad159 #1 MSI MS-7680/H61M-P23 (MS-7680) +RIP: e030:[] [] __cpuidle_register_device+0x1c/0x120 +RSP: e02b:ffff88009dacfcb8 EFLAGS: 00010286 +RAX: 0000000000000000 RBX: ffff880105380000 RCX: 000000000000001c +RDX: 0000000000000000 RSI: 0000000000000055 RDI: ffff880105380000 +RBP: ffff88009dacfce8 R08: ffffffff81a4f048 R09: 0000000000000008 +R10: 0000000000000008 R11: 0000000000000000 R12: ffff880105380000 +R13: 00000000ffffffdd R14: 0000000000000000 R15: ffffffff81a523d0 +FS: 00007f37bd83b7a0(0000) GS:ffff880105200000(0000) knlGS:0000000000000000 +CS: e033 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 0000000000000008 CR3: 00000000a09ea000 CR4: 0000000000042660 +DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 +Process udevd (pid: 2302, threadinfo ffff88009dace000, task ffff88009afb47f0) +Stack: + ffffffff8107f2d0 ffffffff810c2fb7 ffff88009dacfce8 00000000ffffffea + ffff880105380000 00000000ffffffdd ffff88009dacfd08 ffffffff814d9882 + 0000000000000003 ffff880105380000 ffff88009dacfd28 ffffffff81340afd +Call Trace: + [] ? collect_cpu_info_local+0x30/0x30 + [] ? __might_sleep+0xe7/0x100 + [] cpuidle_register_device+0x32/0x70 + [] intel_idle_cpu_init+0xad/0x110 + [] cpu_hotplug_notify+0x68/0x80 + [] notifier_call_chain+0x4d/0x70 + [] __raw_notifier_call_chain+0x9/0x10 + [] __cpu_notify+0x1b/0x30 + [] _cpu_up+0x103/0x14b + [] cpu_up+0xd9/0xec + [] store_online+0x94/0xd0 + [] dev_attr_store+0x1b/0x20 + [] sysfs_write_file+0xf4/0x170 + [] vfs_write+0xb4/0x130 + [] sys_write+0x5a/0xa0 + [] system_call_fastpath+0x16/0x1b +Code: 03 18 00 c9 c3 66 2e 0f 1f 84 00 00 00 00 00 55 48 89 e5 48 83 ec 30 48 89 5d e8 4c 89 65 f0 48 89 fb 4c 89 6d f8 e8 84 08 00 00 <48> 8b 78 08 49 89 c4 e8 f8 7f c1 ff 89 c2 b8 ea ff ff ff 84 d2 +RIP [] __cpuidle_register_device+0x1c/0x120 + RSP + +This patch fixes that by moving the CPU notifier registration +as the last item to be done by the module. + +Signed-off-by: Konrad Rzeszutek Wilk +Reviewed-by: Srivatsa S. Bhat +Signed-off-by: Rafael J. Wysocki +[bwh: Backported to 3.2: notifier is registered only if we do not have ARAT] +Signed-off-by: Ben Hutchings +Cc: Qiang Huang +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/idle/intel_idle.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +--- a/drivers/idle/intel_idle.c ++++ b/drivers/idle/intel_idle.c +@@ -443,10 +443,8 @@ static int intel_idle_probe(void) + + if (boot_cpu_has(X86_FEATURE_ARAT)) /* Always Reliable APIC Timer */ + lapic_timer_reliable_states = LAPIC_TIMER_ALWAYS_RELIABLE; +- else { ++ else + on_each_cpu(__setup_broadcast_timer, (void *)true, 1); +- register_cpu_notifier(&setup_broadcast_notifier); +- } + + pr_debug(PREFIX "v" INTEL_IDLE_VERSION + " model 0x%X\n", boot_cpu_data.x86_model); +@@ -612,6 +610,9 @@ static int __init intel_idle_init(void) + } + } + ++ if (lapic_timer_reliable_states != LAPIC_TIMER_ALWAYS_RELIABLE) ++ register_cpu_notifier(&setup_broadcast_notifier); ++ + return 0; + } + diff --git a/queue-3.4/mac80211-introduce-ieee80211_hw_teardown_aggr_on_bar_fail.patch b/queue-3.4/mac80211-introduce-ieee80211_hw_teardown_aggr_on_bar_fail.patch new file mode 100644 index 00000000000..12828951fc0 --- /dev/null +++ b/queue-3.4/mac80211-introduce-ieee80211_hw_teardown_aggr_on_bar_fail.patch @@ -0,0 +1,77 @@ +From 5b632fe85ec82e5c43740b52e74c66df50a37db3 Mon Sep 17 00:00:00 2001 +From: Stanislaw Gruszka +Date: Mon, 3 Dec 2012 12:56:33 +0100 +Subject: mac80211: introduce IEEE80211_HW_TEARDOWN_AGGR_ON_BAR_FAIL + +From: Stanislaw Gruszka + +commit 5b632fe85ec82e5c43740b52e74c66df50a37db3 upstream. + +Commit f0425beda4d404a6e751439b562100b902ba9c98 "mac80211: retry sending +failed BAR frames later instead of tearing down aggr" caused regression +on rt2x00 hardware (connection hangs). This regression was fixed by +commit be03d4a45c09ee5100d3aaaedd087f19bc20d01 "rt2x00: Don't let +mac80211 send a BAR when an AMPDU subframe fails". But the latter +commit caused yet another problem reported in +https://bugzilla.kernel.org/show_bug.cgi?id=42828#c22 + +After long discussion in this thread: +http://mid.gmane.org/20121018075615.GA18212@redhat.com +and testing various alternative solutions, which failed on one or other +setup, we have no other good fix for the issues like just revert both +mentioned earlier commits. + +To do not affect other hardware which benefit from commit +f0425beda4d404a6e751439b562100b902ba9c98, instead of reverting it, +introduce flag that when used will restore mac80211 behaviour before +the commit. + +Signed-off-by: Stanislaw Gruszka +[replaced link with mid.gmane.org that has message-id] +Signed-off-by: Johannes Berg +[bwh: Backported to 3.2: adjust context] +Signed-off-by: Ben Hutchings +[hq: Backported to 3.4: adjust context] +Signed-off-by: Qiang Huang +Signed-off-by: Greg Kroah-Hartman +--- + include/net/mac80211.h | 5 +++++ + net/mac80211/status.c | 6 +++++- + 2 files changed, 10 insertions(+), 1 deletion(-) + +--- a/include/net/mac80211.h ++++ b/include/net/mac80211.h +@@ -1174,6 +1174,10 @@ enum sta_notify_cmd { + * @IEEE80211_HW_SCAN_WHILE_IDLE: The device can do hw scan while + * being idle (i.e. mac80211 doesn't have to go idle-off during the + * the scan). ++ * ++ * @IEEE80211_HW_TEARDOWN_AGGR_ON_BAR_FAIL: On this hardware TX BA session ++ * should be tear down once BAR frame will not be acked. ++ * + */ + enum ieee80211_hw_flags { + IEEE80211_HW_HAS_RATE_CONTROL = 1<<0, +@@ -1201,6 +1205,7 @@ enum ieee80211_hw_flags { + IEEE80211_HW_AP_LINK_PS = 1<<22, + IEEE80211_HW_TX_AMPDU_SETUP_IN_HW = 1<<23, + IEEE80211_HW_SCAN_WHILE_IDLE = 1<<24, ++ IEEE80211_HW_TEARDOWN_AGGR_ON_BAR_FAIL = 1<<26, + }; + + /** +--- a/net/mac80211/status.c ++++ b/net/mac80211/status.c +@@ -432,7 +432,11 @@ void ieee80211_tx_status(struct ieee8021 + IEEE80211_BAR_CTRL_TID_INFO_MASK) >> + IEEE80211_BAR_CTRL_TID_INFO_SHIFT; + +- ieee80211_set_bar_pending(sta, tid, ssn); ++ if (local->hw.flags & ++ IEEE80211_HW_TEARDOWN_AGGR_ON_BAR_FAIL) ++ ieee80211_stop_tx_ba_session(&sta->sta, tid); ++ else ++ ieee80211_set_bar_pending(sta, tid, ssn); + } + } + diff --git a/queue-3.4/misc-hpilo-remove-pci_disable_device.patch b/queue-3.4/misc-hpilo-remove-pci_disable_device.patch new file mode 100644 index 00000000000..3f8e3f9ff23 --- /dev/null +++ b/queue-3.4/misc-hpilo-remove-pci_disable_device.patch @@ -0,0 +1,65 @@ +From 499f98ab5a0bd25310fe45b93baa524aae61d7cc Mon Sep 17 00:00:00 2001 +From: Jiri Slaby +Date: Thu, 13 Sep 2012 16:06:48 +0200 +Subject: MISC: hpilo, remove pci_disable_device + +From: Jiri Slaby + +commit bcdee04ea7ae0406ae69094f6df1aacb66a69a0b upstream. + +pci_disable_device(pdev) used to be in pci remove function. But this +PCI device has two functions with interrupt lines connected to a +single pin. The other one is a USB host controller. So when we disable +the PIN there e.g. by rmmod hpilo, the controller stops working. It is +because the interrupt link is disabled in ACPI since it is not +refcounted yet. See acpi_pci_link_free_irq called from +acpi_pci_irq_disable. + +It is not the best solution whatsoever, but as a workaround until the +ACPI irq link refcounting is sorted out this should fix the reported +errors. + +References: https://lkml.org/lkml/2008/11/4/535 + +Signed-off-by: Jiri Slaby +Cc: Grant Grundler +Cc: Nobin Mathew +Cc: Robert Hancock +Cc: Arnd Bergmann +Cc: David Altobelli +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Ben Hutchings +Cc: Qiang Huang +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/misc/hpilo.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +--- a/drivers/misc/hpilo.c ++++ b/drivers/misc/hpilo.c +@@ -735,7 +735,14 @@ static void ilo_remove(struct pci_dev *p + free_irq(pdev->irq, ilo_hw); + ilo_unmap_device(pdev, ilo_hw); + pci_release_regions(pdev); +- pci_disable_device(pdev); ++ /* ++ * pci_disable_device(pdev) used to be here. But this PCI device has ++ * two functions with interrupt lines connected to a single pin. The ++ * other one is a USB host controller. So when we disable the PIN here ++ * e.g. by rmmod hpilo, the controller stops working. It is because ++ * the interrupt link is disabled in ACPI since it is not refcounted ++ * yet. See acpi_pci_link_free_irq called from acpi_pci_irq_disable. ++ */ + kfree(ilo_hw); + ilo_hwdev[(minor / MAX_CCB)] = 0; + } +@@ -820,7 +827,7 @@ unmap: + free_regions: + pci_release_regions(pdev); + disable: +- pci_disable_device(pdev); ++/* pci_disable_device(pdev); see comment in ilo_remove */ + free: + kfree(ilo_hw); + out: diff --git a/queue-3.4/pci-shpchp-use-per-slot-workqueues-to-avoid-deadlock.patch b/queue-3.4/pci-shpchp-use-per-slot-workqueues-to-avoid-deadlock.patch new file mode 100644 index 00000000000..4c5dd5a1217 --- /dev/null +++ b/queue-3.4/pci-shpchp-use-per-slot-workqueues-to-avoid-deadlock.patch @@ -0,0 +1,184 @@ +From f652e7d2916fe2fcf9e7d709aa5b7476b431e2dd Mon Sep 17 00:00:00 2001 +From: Bjorn Helgaas +Date: Fri, 11 Jan 2013 12:21:15 -0700 +Subject: PCI: shpchp: Use per-slot workqueues to avoid deadlock + +From: Bjorn Helgaas + +commit f652e7d2916fe2fcf9e7d709aa5b7476b431e2dd upstream. + +When we have an SHPC-capable bridge with a second SHPC-capable bridge +below it, pushing the upstream bridge's attention button causes a +deadlock. + +The deadlock happens because we use the shpchp_wq workqueue to run +shpchp_pushbutton_thread(), which uses shpchp_disable_slot() to remove +devices below the upstream bridge. When we remove the downstream bridge, +we call shpc_remove(), the shpchp driver's .remove() method. That calls +flush_workqueue(shpchp_wq), which deadlocks because the +shpchp_pushbutton_thread() work item is still running. + +This patch avoids the deadlock by creating a workqueue for every slot +and removing the single shared workqueue. + +Here's the call path that leads to the deadlock: + + shpchp_queue_pushbutton_work + queue_work(shpchp_wq) # shpchp_pushbutton_thread + ... + + shpchp_pushbutton_thread + shpchp_disable_slot + remove_board + shpchp_unconfigure_device + pci_stop_and_remove_bus_device + ... + shpc_remove # shpchp driver .remove method + hpc_release_ctlr + cleanup_slots + flush_workqueue(shpchp_wq) + +This change is based on code inspection, since we don't have hardware +with this topology. + +Based-on-patch-by: Yijing Wang +Signed-off-by: Bjorn Helgaas +[bwh: Backported to 3.2: adjust context] +Signed-off-by: Ben Hutchings +[hq: Backported to 3.4: adjust context] +Signed-off-by: Qiang Huang +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pci/hotplug/shpchp.h | 2 +- + drivers/pci/hotplug/shpchp_core.c | 26 ++++++++++++++------------ + drivers/pci/hotplug/shpchp_ctrl.c | 6 +++--- + 3 files changed, 18 insertions(+), 16 deletions(-) + +--- a/drivers/pci/hotplug/shpchp.h ++++ b/drivers/pci/hotplug/shpchp.h +@@ -46,7 +46,6 @@ + extern bool shpchp_poll_mode; + extern int shpchp_poll_time; + extern bool shpchp_debug; +-extern struct workqueue_struct *shpchp_wq; + + #define dbg(format, arg...) \ + do { \ +@@ -90,6 +89,7 @@ struct slot { + struct list_head slot_list; + struct delayed_work work; /* work for button event */ + struct mutex lock; ++ struct workqueue_struct *wq; + u8 hp_slot; + }; + +--- a/drivers/pci/hotplug/shpchp_core.c ++++ b/drivers/pci/hotplug/shpchp_core.c +@@ -39,7 +39,6 @@ + bool shpchp_debug; + bool shpchp_poll_mode; + int shpchp_poll_time; +-struct workqueue_struct *shpchp_wq; + + #define DRIVER_VERSION "0.4" + #define DRIVER_AUTHOR "Dan Zink , Greg Kroah-Hartman , Dely Sy " +@@ -122,6 +121,14 @@ static int init_slots(struct controller + slot->device = ctrl->slot_device_offset + i; + slot->hpc_ops = ctrl->hpc_ops; + slot->number = ctrl->first_slot + (ctrl->slot_num_inc * i); ++ ++ snprintf(name, sizeof(name), "shpchp-%d", slot->number); ++ slot->wq = alloc_workqueue(name, 0, 0); ++ if (!slot->wq) { ++ retval = -ENOMEM; ++ goto error_info; ++ } ++ + mutex_init(&slot->lock); + INIT_DELAYED_WORK(&slot->work, shpchp_queue_pushbutton_work); + +@@ -141,7 +148,7 @@ static int init_slots(struct controller + if (retval) { + ctrl_err(ctrl, "pci_hp_register failed with error %d\n", + retval); +- goto error_info; ++ goto error_slotwq; + } + + get_power_status(hotplug_slot, &info->power_status); +@@ -153,6 +160,8 @@ static int init_slots(struct controller + } + + return 0; ++error_slotwq: ++ destroy_workqueue(slot->wq); + error_info: + kfree(info); + error_hpslot: +@@ -173,7 +182,7 @@ void cleanup_slots(struct controller *ct + slot = list_entry(tmp, struct slot, slot_list); + list_del(&slot->slot_list); + cancel_delayed_work(&slot->work); +- flush_workqueue(shpchp_wq); ++ destroy_workqueue(slot->wq); + pci_hp_deregister(slot->hotplug_slot); + } + } +@@ -356,18 +365,12 @@ static struct pci_driver shpc_driver = { + + static int __init shpcd_init(void) + { +- int retval = 0; +- +- shpchp_wq = alloc_ordered_workqueue("shpchp", 0); +- if (!shpchp_wq) +- return -ENOMEM; ++ int retval; + + retval = pci_register_driver(&shpc_driver); + dbg("%s: pci_register_driver = %d\n", __func__, retval); + info(DRIVER_DESC " version: " DRIVER_VERSION "\n"); +- if (retval) { +- destroy_workqueue(shpchp_wq); +- } ++ + return retval; + } + +@@ -375,7 +378,6 @@ static void __exit shpcd_cleanup(void) + { + dbg("unload_shpchpd()\n"); + pci_unregister_driver(&shpc_driver); +- destroy_workqueue(shpchp_wq); + info(DRIVER_DESC " version: " DRIVER_VERSION " unloaded\n"); + } + +--- a/drivers/pci/hotplug/shpchp_ctrl.c ++++ b/drivers/pci/hotplug/shpchp_ctrl.c +@@ -51,7 +51,7 @@ static int queue_interrupt_event(struct + info->p_slot = p_slot; + INIT_WORK(&info->work, interrupt_event_handler); + +- queue_work(shpchp_wq, &info->work); ++ queue_work(p_slot->wq, &info->work); + + return 0; + } +@@ -456,7 +456,7 @@ void shpchp_queue_pushbutton_work(struct + kfree(info); + goto out; + } +- queue_work(shpchp_wq, &info->work); ++ queue_work(p_slot->wq, &info->work); + out: + mutex_unlock(&p_slot->lock); + } +@@ -504,7 +504,7 @@ static void handle_button_press_event(st + p_slot->hpc_ops->green_led_blink(p_slot); + p_slot->hpc_ops->set_attention_status(p_slot, 0); + +- queue_delayed_work(shpchp_wq, &p_slot->work, 5*HZ); ++ queue_delayed_work(p_slot->wq, &p_slot->work, 5*HZ); + break; + case BLINKINGOFF_STATE: + case BLINKINGON_STATE: diff --git a/queue-3.4/regulator-max8997-use-uv-in-voltage_map_desc.patch b/queue-3.4/regulator-max8997-use-uv-in-voltage_map_desc.patch new file mode 100644 index 00000000000..2d2577f60e4 --- /dev/null +++ b/queue-3.4/regulator-max8997-use-uv-in-voltage_map_desc.patch @@ -0,0 +1,155 @@ +From 31980f8fa9e57f23b301e91dfa79f7f5c517233d Mon Sep 17 00:00:00 2001 +From: Axel Lin +Date: Fri, 28 Dec 2012 17:09:03 +0800 +Subject: regulator: max8997: Use uV in voltage_map_desc + +From: Axel Lin + +commit bc3b7756b5ff66828acf7bc24f148d28b8d61108 upstream. + +Current code does integer division (min_vol = min_uV / 1000) before pass +min_vol to max8997_get_voltage_proper_val(). +So it is possible min_vol is truncated to a smaller value. + +For example, if the request min_uV is 800900 for ldo. +min_vol = 800900 / 1000 = 800 (mV) +Then max8997_get_voltage_proper_val returns 800 mV for this case which is lower +than the requested voltage. + +Use uV rather than mV in voltage_map_desc to prevent truncation by integer +division. + +Signed-off-by: Axel Lin +Signed-off-by: Mark Brown +[bwh: Backported to 3.2: + - Adjust context + - voltage_map_desc also has an n_bits field] +Signed-off-by: Ben Hutchings +Cc: Qiang Huang +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/regulator/max8997.c | 36 +++++++++++++++++------------------- + 1 file changed, 17 insertions(+), 19 deletions(-) + +--- a/drivers/regulator/max8997.c ++++ b/drivers/regulator/max8997.c +@@ -71,26 +71,26 @@ struct voltage_map_desc { + unsigned int n_bits; + }; + +-/* Voltage maps in mV */ ++/* Voltage maps in uV */ + static const struct voltage_map_desc ldo_voltage_map_desc = { +- .min = 800, .max = 3950, .step = 50, .n_bits = 6, ++ .min = 800000, .max = 3950000, .step = 50000, .n_bits = 6, + }; /* LDO1 ~ 18, 21 all */ + + static const struct voltage_map_desc buck1245_voltage_map_desc = { +- .min = 650, .max = 2225, .step = 25, .n_bits = 6, ++ .min = 650000, .max = 2225000, .step = 25000, .n_bits = 6, + }; /* Buck1, 2, 4, 5 */ + + static const struct voltage_map_desc buck37_voltage_map_desc = { +- .min = 750, .max = 3900, .step = 50, .n_bits = 6, ++ .min = 750000, .max = 3900000, .step = 50000, .n_bits = 6, + }; /* Buck3, 7 */ + +-/* current map in mA */ ++/* current map in uA */ + static const struct voltage_map_desc charger_current_map_desc = { +- .min = 200, .max = 950, .step = 50, .n_bits = 4, ++ .min = 200000, .max = 950000, .step = 50000, .n_bits = 4, + }; + + static const struct voltage_map_desc topoff_current_map_desc = { +- .min = 50, .max = 200, .step = 10, .n_bits = 4, ++ .min = 50000, .max = 200000, .step = 10000, .n_bits = 4, + }; + + static const struct voltage_map_desc *reg_voltage_map[] = { +@@ -194,7 +194,7 @@ static int max8997_list_voltage(struct r + if (val > desc->max) + return -EINVAL; + +- return val * 1000; ++ return val; + } + + static int max8997_get_enable_register(struct regulator_dev *rdev, +@@ -496,7 +496,6 @@ static int max8997_set_voltage_ldobuck(s + { + struct max8997_data *max8997 = rdev_get_drvdata(rdev); + struct i2c_client *i2c = max8997->iodev->i2c; +- int min_vol = min_uV / 1000, max_vol = max_uV / 1000; + const struct voltage_map_desc *desc; + int rid = rdev_get_id(rdev); + int reg, shift = 0, mask, ret; +@@ -522,7 +521,7 @@ static int max8997_set_voltage_ldobuck(s + + desc = reg_voltage_map[rid]; + +- i = max8997_get_voltage_proper_val(desc, min_vol, max_vol); ++ i = max8997_get_voltage_proper_val(desc, min_uV, max_uV); + if (i < 0) + return i; + +@@ -541,7 +540,7 @@ static int max8997_set_voltage_ldobuck(s + /* If the voltage is increasing */ + if (org < i) + udelay(DIV_ROUND_UP(desc->step * (i - org), +- max8997->ramp_delay)); ++ max8997->ramp_delay * 1000)); + } + + return ret; +@@ -640,7 +639,6 @@ static int max8997_set_voltage_buck(stru + const struct voltage_map_desc *desc; + int new_val, new_idx, damage, tmp_val, tmp_idx, tmp_dmg; + bool gpio_dvs_mode = false; +- int min_vol = min_uV / 1000, max_vol = max_uV / 1000; + + if (rid < MAX8997_BUCK1 || rid > MAX8997_BUCK7) + return -EINVAL; +@@ -665,7 +663,7 @@ static int max8997_set_voltage_buck(stru + selector); + + desc = reg_voltage_map[rid]; +- new_val = max8997_get_voltage_proper_val(desc, min_vol, max_vol); ++ new_val = max8997_get_voltage_proper_val(desc, min_uV, max_uV); + if (new_val < 0) + return new_val; + +@@ -997,8 +995,8 @@ static __devinit int max8997_pmic_probe( + max8997->buck1_vol[i] = ret = + max8997_get_voltage_proper_val( + &buck1245_voltage_map_desc, +- pdata->buck1_voltage[i] / 1000, +- pdata->buck1_voltage[i] / 1000 + ++ pdata->buck1_voltage[i], ++ pdata->buck1_voltage[i] + + buck1245_voltage_map_desc.step); + if (ret < 0) + goto err_alloc; +@@ -1006,8 +1004,8 @@ static __devinit int max8997_pmic_probe( + max8997->buck2_vol[i] = ret = + max8997_get_voltage_proper_val( + &buck1245_voltage_map_desc, +- pdata->buck2_voltage[i] / 1000, +- pdata->buck2_voltage[i] / 1000 + ++ pdata->buck2_voltage[i], ++ pdata->buck2_voltage[i] + + buck1245_voltage_map_desc.step); + if (ret < 0) + goto err_alloc; +@@ -1015,8 +1013,8 @@ static __devinit int max8997_pmic_probe( + max8997->buck5_vol[i] = ret = + max8997_get_voltage_proper_val( + &buck1245_voltage_map_desc, +- pdata->buck5_voltage[i] / 1000, +- pdata->buck5_voltage[i] / 1000 + ++ pdata->buck5_voltage[i], ++ pdata->buck5_voltage[i] + + buck1245_voltage_map_desc.step); + if (ret < 0) + goto err_alloc; diff --git a/queue-3.4/regulator-max8998-ensure-enough-delay-time-for-max8998_set_voltage_buck_time_sel.patch b/queue-3.4/regulator-max8998-ensure-enough-delay-time-for-max8998_set_voltage_buck_time_sel.patch new file mode 100644 index 00000000000..41fe812190b --- /dev/null +++ b/queue-3.4/regulator-max8998-ensure-enough-delay-time-for-max8998_set_voltage_buck_time_sel.patch @@ -0,0 +1,36 @@ +From e8d9897ff064b1683c11c15ea1296a67a45d77b0 Mon Sep 17 00:00:00 2001 +From: Axel Lin +Date: Wed, 9 Jan 2013 19:34:57 +0800 +Subject: regulator: max8998: Ensure enough delay time for max8998_set_voltage_buck_time_sel + +From: Axel Lin + +commit e8d9897ff064b1683c11c15ea1296a67a45d77b0 upstream. + +commit 81d0a6ae7befb24c06f4aa4856af7f8d1f612171 upstream. + +Use DIV_ROUND_UP to prevent truncation by integer division issue. +This ensures we return enough delay time. + +Signed-off-by: Axel Lin +Signed-off-by: Mark Brown +[bwh: Backported to 3.2: delay is done by driver, not returned to the caller] +Signed-off-by: Ben Hutchings +Cc: Qiang Huang +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/regulator/max8998.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/regulator/max8998.c ++++ b/drivers/regulator/max8998.c +@@ -492,7 +492,7 @@ buck2_exit: + + difference = desc->min + desc->step*i - previous_vol/1000; + if (difference > 0) +- udelay(difference / ((val & 0x0f) + 1)); ++ udelay(DIV_ROUND_UP(difference, (val & 0x0f) + 1)); + + return ret; + } diff --git a/queue-3.4/series b/queue-3.4/series index 78b5e3b3505..ae00b4b138c 100644 --- a/queue-3.4/series +++ b/queue-3.4/series @@ -105,3 +105,16 @@ zram-destroy-all-devices-on-error-recovery-path-in-zram_init.patch zram-avoid-access-beyond-the-zram-device.patch zram-allow-request-end-to-coincide-with-disksize.patch staging-zram-fix-access-of-null-pointer.patch +ubi-erase-free-peb-with-bitflip-in-ec-header.patch +input-synaptics-adjust-threshold-for-treating-position-values-as-negative.patch +floppy-properly-handle-failure-on-add_disk-loop.patch +misc-hpilo-remove-pci_disable_device.patch +i82975x_edac-fix-dimm-label-initialization.patch +i915-ensure-that-vga-plane-is-disabled.patch +regulator-max8997-use-uv-in-voltage_map_desc.patch +regulator-max8998-ensure-enough-delay-time-for-max8998_set_voltage_buck_time_sel.patch +intel_idle-don-t-register-cpu-notifier-if-we-are-not-running.patch +can-c_can-set-reserved-bit-in-ifx_mask2-to-1-on-write.patch +e1000e-dos-while-tso-enabled-caused-by-link-partner-with-small-mss.patch +mac80211-introduce-ieee80211_hw_teardown_aggr_on_bar_fail.patch +pci-shpchp-use-per-slot-workqueues-to-avoid-deadlock.patch diff --git a/queue-3.4/ubi-erase-free-peb-with-bitflip-in-ec-header.patch b/queue-3.4/ubi-erase-free-peb-with-bitflip-in-ec-header.patch new file mode 100644 index 00000000000..7ae17011d89 --- /dev/null +++ b/queue-3.4/ubi-erase-free-peb-with-bitflip-in-ec-header.patch @@ -0,0 +1,35 @@ +From 04ed02cc7d431eb295bf9a4cb33c13319f34c48a Mon Sep 17 00:00:00 2001 +From: Matthieu CASTET +Date: Wed, 22 Aug 2012 16:03:46 +0200 +Subject: UBI: erase free PEB with bitflip in EC header + +From: Matthieu CASTET + +commit 193819cf2e6e395b1e1be2d36785dc5563a6edca upstream. + +Without this patch, these PEB are not scrubbed until we put data in them. +Bitflip can accumulate latter and we can loose the EC header (but VID header +should be intact and allow to recover data). + +Signed-off-by: Matthieu Castet +Signed-off-by: Artem Bityutskiy +[bwh: Backported to 3.2: adjust filename, context] +Signed-off-by: Ben Hutchings +Cc: Qiang Huang +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mtd/ubi/scan.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/mtd/ubi/scan.c ++++ b/drivers/mtd/ubi/scan.c +@@ -997,7 +997,7 @@ static int process_eb(struct ubi_device + return err; + goto adjust_mean_ec; + case UBI_IO_FF: +- if (ec_err) ++ if (ec_err || bitflips) + err = add_to_list(si, pnum, ec, 1, &si->erase); + else + err = add_to_list(si, pnum, ec, 0, &si->free); -- 2.47.3