From f555f506c531a5aa4b40e32863b21101ed87de5f Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Tue, 30 Sep 2008 15:03:51 -0700 Subject: [PATCH] .25 patches --- ...hda-fix-model-for-dell-inspiron-1525.patch | 36 ++++ ...-fix-refcount-leak-in-mmc_block_open.patch | 41 +++++ .../pxa2xx_spi-chipselect-bugfixes.patch | 164 ++++++++++++++++++ queue-2.6.25/pxa2xx_spi-dma-bugfixes.patch | 130 ++++++++++++++ queue-2.6.25/series | 5 + .../usb-fix-hcd-interrupt-disabling.patch | 49 ++++++ 6 files changed, 425 insertions(+) create mode 100644 queue-2.6.25/alsa-hda-fix-model-for-dell-inspiron-1525.patch create mode 100644 queue-2.6.25/drivers-mmc-card-block.c-fix-refcount-leak-in-mmc_block_open.patch create mode 100644 queue-2.6.25/pxa2xx_spi-chipselect-bugfixes.patch create mode 100644 queue-2.6.25/pxa2xx_spi-dma-bugfixes.patch create mode 100644 queue-2.6.25/series create mode 100644 queue-2.6.25/usb-fix-hcd-interrupt-disabling.patch diff --git a/queue-2.6.25/alsa-hda-fix-model-for-dell-inspiron-1525.patch b/queue-2.6.25/alsa-hda-fix-model-for-dell-inspiron-1525.patch new file mode 100644 index 00000000000..5ed238c89a9 --- /dev/null +++ b/queue-2.6.25/alsa-hda-fix-model-for-dell-inspiron-1525.patch @@ -0,0 +1,36 @@ +From jejb@kernel.org Tue Sep 30 14:38:32 2008 +From: Takashi Iwai +Date: Tue, 30 Sep 2008 18:15:10 GMT +Subject: ALSA: hda - Fix model for Dell Inspiron 1525 +To: jejb@kernel.org, stable@kernel.org +Message-ID: <200809301815.m8UIFA86018882@hera.kernel.org> + +From: Takashi Iwai + +commit 24918b61b55c21e09a3e07cd82e1b3a8154782dc upstream + +Dell Inspiron 1525 seems to have a buggy BIOS setup and screws up +the recent codec parser, as reported by Oleksandr Natalenko: + http://lkml.org/lkml/2008/9/12/203 + +This patch adds the working model, dell-3stack, statically. + +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_sigmatel.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/pci/hda/patch_sigmatel.c ++++ b/sound/pci/hda/patch_sigmatel.c +@@ -1541,8 +1541,8 @@ static struct snd_pci_quirk stac927x_cfg + /* Dell 3 stack systems with verb table in BIOS */ + SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x01f3, "Dell Inspiron 1420", STAC_DELL_BIOS), + SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x0227, "Dell Vostro 1400 ", STAC_DELL_BIOS), +- SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x022f, "Dell ", STAC_DELL_BIOS), + SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x022e, "Dell ", STAC_DELL_BIOS), ++ SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x022f, "Dell Inspiron 1525", STAC_DELL_3ST), + SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x0242, "Dell ", STAC_DELL_BIOS), + SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x0243, "Dell ", STAC_DELL_BIOS), + SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x02ff, "Dell ", STAC_DELL_BIOS), diff --git a/queue-2.6.25/drivers-mmc-card-block.c-fix-refcount-leak-in-mmc_block_open.patch b/queue-2.6.25/drivers-mmc-card-block.c-fix-refcount-leak-in-mmc_block_open.patch new file mode 100644 index 00000000000..595ba66eed1 --- /dev/null +++ b/queue-2.6.25/drivers-mmc-card-block.c-fix-refcount-leak-in-mmc_block_open.patch @@ -0,0 +1,41 @@ +From jejb@kernel.org Tue Sep 30 14:30:45 2008 +From: Andrew Morton +Date: Sat, 6 Sep 2008 01:10:03 GMT +Subject: drivers/mmc/card/block.c: fix refcount leak in mmc_block_open() +To: jejb@kernel.org, stable@kernel.org +Message-ID: <200809060110.m861A3C0025941@hera.kernel.org> + +From: Andrew Morton + +commit 70bb08962ea9bd50797ae9f16b2493f5f7c65053 upstream + +mmc_block_open() increments md->usage although it returns with -EROFS when +default mounting a MMC/SD card with write protect switch on. This +reference counting bug prevents /dev/mmcblkX from being released on card +removal, and situation worsen with reinsertion until the minor number +range runs out. + +Reported-by: +Acked-by: Pierre Ossman +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mmc/card/block.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/mmc/card/block.c ++++ b/drivers/mmc/card/block.c +@@ -103,8 +103,10 @@ static int mmc_blk_open(struct inode *in + check_disk_change(inode->i_bdev); + ret = 0; + +- if ((filp->f_mode & FMODE_WRITE) && md->read_only) ++ if ((filp->f_mode & FMODE_WRITE) && md->read_only) { ++ mmc_blk_put(md); + ret = -EROFS; ++ } + } + + return ret; diff --git a/queue-2.6.25/pxa2xx_spi-chipselect-bugfixes.patch b/queue-2.6.25/pxa2xx_spi-chipselect-bugfixes.patch new file mode 100644 index 00000000000..1e2fbd08bdd --- /dev/null +++ b/queue-2.6.25/pxa2xx_spi-chipselect-bugfixes.patch @@ -0,0 +1,164 @@ +From jejb@kernel.org Tue Sep 30 14:35:17 2008 +From: Ned Forrester +Date: Sat, 13 Sep 2008 22:05:54 GMT +Subject: pxa2xx_spi: chipselect bugfixes +To: jejb@kernel.org, stable@kernel.org +Message-ID: <200809132205.m8DM5rSW029657@hera.kernel.org> + +From: Ned Forrester + +commit 8423597d676615f3dd2d9ab36f59f147086b90b8 upstream + +Fixes several chipselect bugs in the pxa2xx_spi driver. These bugs are in +all versions of this driver and prevent using it with chips like m25p16 +flash. + + 1. The spi_transfer.cs_change flag is handled too early: + before spi_transfer.delay_usecs applies, thus making the + delay ineffective at holding chip select. + + 2. spi_transfer.delay_usecs is ignored on the last transfer + of a message (likewise not holding chipselect long enough). + + 3. If spi_transfer.cs_change is set on the last transfer, the + chip select is always disabled, instead of the intended + meaning: optionally holding chip select enabled for the + next message. + +Those first three bugs were fixed with a relocation of delays +and chip select de-assertions. + + 4. If a message has the cs_change flag set on the last transfer, + and had the chip select stayed enabled as requested (see 3, + above), it would not have been disabled if the next message is + for a different chip. Fixed by dropping chip select regardless + of cs_change at end of a message, if there is no next message + or if the next message is for a different chip. + +This patch should apply to all kernels back to and including 2.6.20; +it was test patched against 2.6.20. An additional patch would be +required for older kernels, but those versions are very buggy anyway. + +Signed-off-by: Ned Forrester +Cc: Vernon Sauder +Cc: Eric Miao +Signed-off-by: David Brownell +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/spi/pxa2xx_spi.c | 59 ++++++++++++++++++++++++++++++++++++++--------- + 1 file changed, 48 insertions(+), 11 deletions(-) + +--- a/drivers/spi/pxa2xx_spi.c ++++ b/drivers/spi/pxa2xx_spi.c +@@ -143,7 +143,6 @@ struct driver_data { + size_t tx_map_len; + u8 n_bytes; + u32 dma_width; +- int cs_change; + int (*write)(struct driver_data *drv_data); + int (*read)(struct driver_data *drv_data); + irqreturn_t (*transfer_handler)(struct driver_data *drv_data); +@@ -405,8 +404,45 @@ static void giveback(struct driver_data + struct spi_transfer, + transfer_list); + ++ /* Delay if requested before any change in chip select */ ++ if (last_transfer->delay_usecs) ++ udelay(last_transfer->delay_usecs); ++ ++ /* Drop chip select UNLESS cs_change is true or we are returning ++ * a message with an error, or next message is for another chip ++ */ + if (!last_transfer->cs_change) + drv_data->cs_control(PXA2XX_CS_DEASSERT); ++ else { ++ struct spi_message *next_msg; ++ ++ /* Holding of cs was hinted, but we need to make sure ++ * the next message is for the same chip. Don't waste ++ * time with the following tests unless this was hinted. ++ * ++ * We cannot postpone this until pump_messages, because ++ * after calling msg->complete (below) the driver that ++ * sent the current message could be unloaded, which ++ * could invalidate the cs_control() callback... ++ */ ++ ++ /* get a pointer to the next message, if any */ ++ spin_lock_irqsave(&drv_data->lock, flags); ++ if (list_empty(&drv_data->queue)) ++ next_msg = NULL; ++ else ++ next_msg = list_entry(drv_data->queue.next, ++ struct spi_message, queue); ++ spin_unlock_irqrestore(&drv_data->lock, flags); ++ ++ /* see if the next and current messages point ++ * to the same chip ++ */ ++ if (next_msg && next_msg->spi != msg->spi) ++ next_msg = NULL; ++ if (!next_msg || msg->state == ERROR_STATE) ++ drv_data->cs_control(PXA2XX_CS_DEASSERT); ++ } + + msg->state = NULL; + if (msg->complete) +@@ -489,10 +525,9 @@ static void dma_transfer_complete(struct + msg->actual_length += drv_data->len - + (drv_data->rx_end - drv_data->rx); + +- /* Release chip select if requested, transfer delays are +- * handled in pump_transfers */ +- if (drv_data->cs_change) +- drv_data->cs_control(PXA2XX_CS_DEASSERT); ++ /* Transfer delays and chip select release are ++ * handled in pump_transfers or giveback ++ */ + + /* Move to next transfer */ + msg->state = next_transfer(drv_data); +@@ -601,10 +636,9 @@ static void int_transfer_complete(struct + drv_data->cur_msg->actual_length += drv_data->len - + (drv_data->rx_end - drv_data->rx); + +- /* Release chip select if requested, transfer delays are +- * handled in pump_transfers */ +- if (drv_data->cs_change) +- drv_data->cs_control(PXA2XX_CS_DEASSERT); ++ /* Transfer delays and chip select release are ++ * handled in pump_transfers or giveback ++ */ + + /* Move to next transfer */ + drv_data->cur_msg->state = next_transfer(drv_data); +@@ -838,13 +872,17 @@ static void pump_transfers(unsigned long + return; + } + +- /* Delay if requested at end of transfer*/ ++ /* Delay if requested at end of transfer before CS change */ + if (message->state == RUNNING_STATE) { + previous = list_entry(transfer->transfer_list.prev, + struct spi_transfer, + transfer_list); + if (previous->delay_usecs) + udelay(previous->delay_usecs); ++ ++ /* Drop chip select only if cs_change is requested */ ++ if (previous->cs_change) ++ drv_data->cs_control(PXA2XX_CS_DEASSERT); + } + + /* Check for transfers that need multiple DMA segments */ +@@ -889,7 +927,6 @@ static void pump_transfers(unsigned long + drv_data->len = transfer->len & DCMD_LENGTH; + drv_data->write = drv_data->tx ? chip->write : null_writer; + drv_data->read = drv_data->rx ? chip->read : null_reader; +- drv_data->cs_change = transfer->cs_change; + + /* Change speed and bit per word on a per transfer */ + cr0 = chip->cr0; diff --git a/queue-2.6.25/pxa2xx_spi-dma-bugfixes.patch b/queue-2.6.25/pxa2xx_spi-dma-bugfixes.patch new file mode 100644 index 00000000000..e2522b784dd --- /dev/null +++ b/queue-2.6.25/pxa2xx_spi-dma-bugfixes.patch @@ -0,0 +1,130 @@ +From jejb@kernel.org Tue Sep 30 14:34:36 2008 +From: Ned Forrester +Date: Sat, 13 Sep 2008 22:05:47 GMT +Subject: pxa2xx_spi: dma bugfixes +To: jejb@kernel.org, stable@kernel.org +Message-ID: <200809132205.m8DM5lh6029615@hera.kernel.org> + +From: Ned Forrester + +commit 7e96445533ac3f4f7964646a202ff3620602fab4 upstream + +Fixes two DMA bugs in the pxa2xx_spi driver. The first bug is in all +versions of this driver; the second was introduced in the 2.6.20 kernel, +and prevents using the driver with chips like m25p16 flash (which can +issue large DMA reads). + + 1. Zero length transfers are permitted for use to insert timing, + but pxa2xx_spi.c will fail if this is requested in DMA mode. + Fixed by using programmed I/O (PIO) mode for such transfers. + + 2. Transfers larger than 8191 are not permitted in DMA mode. A + test for length rejects all large transfers regardless of DMA + or PIO mode. Worked around by rejecting only large transfers + with DMA mapped buffers, and forcing all other transfers + larger than 8191 to use PIO mode. A rate limited warning is + issued for DMA transfers forced to PIO mode. + +This patch should apply to all kernels back to and including 2.6.20; +it was test patched against 2.6.20. An additional patch would be +required for older kernels, but those versions are very buggy anyway. + +Signed-off-by: Ned Forrester +Cc: Vernon Sauder +Cc: Eric Miao +Signed-off-by: David Brownell +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/spi/pxa2xx_spi.c | 57 +++++++++++++++++++++++++++++++++++------------ + 1 file changed, 43 insertions(+), 14 deletions(-) + +--- a/drivers/spi/pxa2xx_spi.c ++++ b/drivers/spi/pxa2xx_spi.c +@@ -48,9 +48,10 @@ MODULE_ALIAS("platform:pxa2xx-spi"); + + #define MAX_BUSES 3 + +-#define DMA_INT_MASK (DCSR_ENDINTR | DCSR_STARTINTR | DCSR_BUSERR) +-#define RESET_DMA_CHANNEL (DCSR_NODESC | DMA_INT_MASK) +-#define IS_DMA_ALIGNED(x) (((u32)(x)&0x07)==0) ++#define DMA_INT_MASK (DCSR_ENDINTR | DCSR_STARTINTR | DCSR_BUSERR) ++#define RESET_DMA_CHANNEL (DCSR_NODESC | DMA_INT_MASK) ++#define IS_DMA_ALIGNED(x) (((x) & 0x07) == 0) ++#define MAX_DMA_LEN 8191 + + /* + * for testing SSCR1 changes that require SSP restart, basically +@@ -846,14 +847,27 @@ static void pump_transfers(unsigned long + udelay(previous->delay_usecs); + } + +- /* Check transfer length */ +- if (transfer->len > 8191) +- { +- dev_warn(&drv_data->pdev->dev, "pump_transfers: transfer " +- "length greater than 8191\n"); +- message->status = -EINVAL; +- giveback(drv_data); +- return; ++ /* Check for transfers that need multiple DMA segments */ ++ if (transfer->len > MAX_DMA_LEN && chip->enable_dma) { ++ ++ /* reject already-mapped transfers; PIO won't always work */ ++ if (message->is_dma_mapped ++ || transfer->rx_dma || transfer->tx_dma) { ++ dev_err(&drv_data->pdev->dev, ++ "pump_transfers: mapped transfer length " ++ "of %lu is greater than %d\n", ++ transfer->len, MAX_DMA_LEN); ++ message->status = -EINVAL; ++ giveback(drv_data); ++ return; ++ } ++ ++ /* warn ... we force this to PIO mode */ ++ if (printk_ratelimit()) ++ dev_warn(&message->spi->dev, "pump_transfers: " ++ "DMA disabled for transfer length %ld " ++ "greater than %d\n", ++ (long)drv_data->len, MAX_DMA_LEN); + } + + /* Setup the transfer state based on the type of transfer */ +@@ -922,7 +936,7 @@ static void pump_transfers(unsigned long + &dma_thresh)) + if (printk_ratelimit()) + dev_warn(&message->spi->dev, +- "pump_transfer: " ++ "pump_transfers: " + "DMA burst size reduced to " + "match bits_per_word\n"); + } +@@ -936,8 +950,23 @@ static void pump_transfers(unsigned long + + message->state = RUNNING_STATE; + +- /* Try to map dma buffer and do a dma transfer if successful */ +- if ((drv_data->dma_mapped = map_dma_buffers(drv_data))) { ++ /* Try to map dma buffer and do a dma transfer if successful, but ++ * only if the length is non-zero and less than MAX_DMA_LEN. ++ * ++ * Zero-length non-descriptor DMA is illegal on PXA2xx; force use ++ * of PIO instead. Care is needed above because the transfer may ++ * have have been passed with buffers that are already dma mapped. ++ * A zero-length transfer in PIO mode will not try to write/read ++ * to/from the buffers ++ * ++ * REVISIT large transfers are exactly where we most want to be ++ * using DMA. If this happens much, split those transfers into ++ * multiple DMA segments rather than forcing PIO. ++ */ ++ drv_data->dma_mapped = 0; ++ if (drv_data->len > 0 && drv_data->len <= MAX_DMA_LEN) ++ drv_data->dma_mapped = map_dma_buffers(drv_data); ++ if (drv_data->dma_mapped) { + + /* Ensure we have the correct interrupt handler */ + drv_data->transfer_handler = dma_transfer; diff --git a/queue-2.6.25/series b/queue-2.6.25/series new file mode 100644 index 00000000000..95385c7f976 --- /dev/null +++ b/queue-2.6.25/series @@ -0,0 +1,5 @@ +usb-fix-hcd-interrupt-disabling.patch +pxa2xx_spi-dma-bugfixes.patch +pxa2xx_spi-chipselect-bugfixes.patch +drivers-mmc-card-block.c-fix-refcount-leak-in-mmc_block_open.patch +alsa-hda-fix-model-for-dell-inspiron-1525.patch diff --git a/queue-2.6.25/usb-fix-hcd-interrupt-disabling.patch b/queue-2.6.25/usb-fix-hcd-interrupt-disabling.patch new file mode 100644 index 00000000000..14f67c41021 --- /dev/null +++ b/queue-2.6.25/usb-fix-hcd-interrupt-disabling.patch @@ -0,0 +1,49 @@ +From jejb@kernel.org Tue Sep 30 14:36:59 2008 +From: Geoff Levand +Date: Tue, 23 Sep 2008 22:05:34 GMT +Subject: USB: fix hcd interrupt disabling +To: jejb@kernel.org, stable@kernel.org +Message-ID: <200809232205.m8NM5Y25006025@hera.kernel.org> + +From: Geoff Levand + +commit 83a798207361cc26385187b2e71efa2b5d75de7f upstream + +Commit de85422b94ddb23c021126815ea49414047c13dc, 'USB: fix interrupt +disabling for HCDs with shared interrupt handlers' changed usb_add_hcd() +to strip IRQF_DISABLED from irqflags prior to calling request_irq() +with the justification that such a removal was necessary for shared +interrupts to work properly. Unfortunately, the change in that commit +unconditionally removes the IRQF_DISABLED flag, causing problems on +platforms that don't use a shared interrupt but require IRQF_DISABLED. +This change adds a check for IRQF_SHARED prior to removing the +IRQF_DISABLED flag. + +Fixes the PS3 system startup hang reported with recent Fedora and +OpenSUSE kernels. + +Note that this problem is hidden when CONFIG_LOCKDEP=y (ps3_defconfig), +as local_irq_enable_in_hardirq() is defined as a null statement for +that config. + +Signed-off-by: Geoff Levand +Cc: Alan Stern +Cc: Stefan Becker +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/hcd.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/usb/core/hcd.c ++++ b/drivers/usb/core/hcd.c +@@ -1877,7 +1877,8 @@ int usb_add_hcd(struct usb_hcd *hcd, + * with IRQF_SHARED. As usb_hcd_irq() will always disable + * interrupts we can remove it here. + */ +- irqflags &= ~IRQF_DISABLED; ++ if (irqflags & IRQF_SHARED) ++ irqflags &= ~IRQF_DISABLED; + + snprintf(hcd->irq_descr, sizeof(hcd->irq_descr), "%s:usb%d", + hcd->driver->description, hcd->self.busnum); -- 2.47.3