diff options
| author | Greg Kroah-Hartman <gregkh@suse.de> | 2011-05-30 12:06:05 +0800 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@suse.de> | 2011-05-30 12:06:05 +0800 |
| commit | 655783a6b95676576a840e17bba4c7340f4d02ae (patch) | |
| tree | a4be510a8d27c46517d55cdc60c00ba793f752d7 | |
| parent | 2ce07e7646683a15d7a9dccc547ccc7aa876690c (diff) | |
| download | stable-queue-655783a6b95676576a840e17bba4c7340f4d02ae.tar.gz | |
.39 patches
41 files changed, 2837 insertions, 0 deletions
diff --git a/queue-2.6.39/alsa-hda-add-quirk-for-lenovo-u350.patch b/queue-2.6.39/alsa-hda-add-quirk-for-lenovo-u350.patch new file mode 100644 index 0000000000..b75e0762f4 --- /dev/null +++ b/queue-2.6.39/alsa-hda-add-quirk-for-lenovo-u350.patch @@ -0,0 +1,32 @@ +From d2859fd49200f1f3efd8acdb54b6d51d3ab82302 Mon Sep 17 00:00:00 2001 +From: David Henningsson <david.henningsson@canonical.com> +Date: Mon, 23 May 2011 08:26:16 +0200 +Subject: ALSA: HDA: Add quirk for Lenovo U350 + +From: David Henningsson <david.henningsson@canonical.com> + +commit d2859fd49200f1f3efd8acdb54b6d51d3ab82302 upstream. + +Add model=asus quirk for Lenovo Ideapad U350 to make internal mic +work correctly. + +BugLink: http://bugs.launchpad.net/bugs/751681 +Reported-by: Kent Baxley <kent.baxley@canonical.com> +Signed-off-by: David Henningsson <david.henningsson@canonical.com> +Signed-off-by: Takashi Iwai <tiwai@suse.de> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + sound/pci/hda/patch_conexant.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/pci/hda/patch_conexant.c ++++ b/sound/pci/hda/patch_conexant.c +@@ -3036,6 +3036,7 @@ static struct snd_pci_quirk cxt5066_cfg_ + SND_PCI_QUIRK(0x17aa, 0x215e, "Lenovo Thinkpad", CXT5066_THINKPAD), + SND_PCI_QUIRK(0x17aa, 0x21da, "Lenovo X220", CXT5066_THINKPAD), + SND_PCI_QUIRK(0x17aa, 0x21db, "Lenovo X220-tablet", CXT5066_THINKPAD), ++ SND_PCI_QUIRK(0x17aa, 0x3a0d, "Lenovo U350", CXT5066_ASUS), + SND_PCI_QUIRK(0x17aa, 0x38af, "Lenovo G560", CXT5066_ASUS), + SND_PCI_QUIRK_VENDOR(0x17aa, "Lenovo", CXT5066_IDEAPAD), /* Fallback for Lenovos without dock mic */ + {} diff --git a/queue-2.6.39/alsa-hda-fix-input-src-parse-in-patch_analog.c.patch b/queue-2.6.39/alsa-hda-fix-input-src-parse-in-patch_analog.c.patch new file mode 100644 index 0000000000..f4025e3eec --- /dev/null +++ b/queue-2.6.39/alsa-hda-fix-input-src-parse-in-patch_analog.c.patch @@ -0,0 +1,39 @@ +From 5a2d227fdc7a02ed1b4cebba391d8fb9ad57caaf Mon Sep 17 00:00:00 2001 +From: Adrian Wilkins <adrian.wilkins@nhs.net> +Date: Thu, 19 May 2011 21:52:38 +0100 +Subject: ALSA: hda - Fix input-src parse in patch_analog.c + +From: Adrian Wilkins <adrian.wilkins@nhs.net> + +commit 5a2d227fdc7a02ed1b4cebba391d8fb9ad57caaf upstream. + +Compare pin type enum to the pin type and not the array index. +Fixes bug#0005368. + +Signed-off-by: Adrian Wilkins <adrian.wilkins@nhs.net> +Signed-off-by: Takashi Iwai <tiwai@suse.de> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + sound/pci/hda/patch_analog.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/sound/pci/hda/patch_analog.c ++++ b/sound/pci/hda/patch_analog.c +@@ -3070,6 +3070,7 @@ static void ad1988_auto_init_analog_inpu + + for (i = 0; i < cfg->num_inputs; i++) { + hda_nid_t nid = cfg->inputs[i].pin; ++ int type = cfg->inputs[i].type; + switch (nid) { + case 0x15: /* port-C */ + snd_hda_codec_write(codec, 0x33, 0, AC_VERB_SET_CONNECT_SEL, 0x0); +@@ -3079,7 +3080,7 @@ static void ad1988_auto_init_analog_inpu + break; + } + snd_hda_codec_write(codec, nid, 0, AC_VERB_SET_PIN_WIDGET_CONTROL, +- i == AUTO_PIN_MIC ? PIN_VREF80 : PIN_IN); ++ type == AUTO_PIN_MIC ? PIN_VREF80 : PIN_IN); + if (nid != AD1988_PIN_CD_NID) + snd_hda_codec_write(codec, nid, 0, AC_VERB_SET_AMP_GAIN_MUTE, + AMP_OUT_MUTE); diff --git a/queue-2.6.39/alsa-hda-use-lpib-for-ati-amd-chipsets-as-default.patch b/queue-2.6.39/alsa-hda-use-lpib-for-ati-amd-chipsets-as-default.patch new file mode 100644 index 0000000000..1abf922467 --- /dev/null +++ b/queue-2.6.39/alsa-hda-use-lpib-for-ati-amd-chipsets-as-default.patch @@ -0,0 +1,41 @@ +From 50e3bbf9898840eead86f90a43b3625a2b2f4112 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai <tiwai@suse.de> +Date: Fri, 20 May 2011 16:29:09 +0200 +Subject: ALSA: hda - Use LPIB for ATI/AMD chipsets as default + +From: Takashi Iwai <tiwai@suse.de> + +commit 50e3bbf9898840eead86f90a43b3625a2b2f4112 upstream. + +ATI and AMD chipsets seem not providing the proper position-buffer +information, and it also doesn't provide FIFO register required by +VIACOMBO fix. It's better to use LPIB for these. + +Reported-by: David Henningsson <david.henningsson@canonical.com> +Signed-off-by: Takashi Iwai <tiwai@suse.de> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + sound/pci/hda/hda_intel.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +--- a/sound/pci/hda/hda_intel.c ++++ b/sound/pci/hda/hda_intel.c +@@ -2349,9 +2349,16 @@ static int __devinit check_position_fix( + /* Check VIA/ATI HD Audio Controller exist */ + switch (chip->driver_type) { + case AZX_DRIVER_VIA: +- case AZX_DRIVER_ATI: + /* Use link position directly, avoid any transfer problem. */ + return POS_FIX_VIACOMBO; ++ case AZX_DRIVER_ATI: ++ /* ATI chipsets don't work well with position-buffer */ ++ return POS_FIX_LPIB; ++ case AZX_DRIVER_GENERIC: ++ /* AMD chipsets also don't work with position-buffer */ ++ if (chip->pci->vendor == PCI_VENDOR_ID_AMD) ++ return POS_FIX_LPIB; ++ break; + } + + return POS_FIX_AUTO; diff --git a/queue-2.6.39/alsa-hda-use-one-dmic-only-for-dell-studio-1558.patch b/queue-2.6.39/alsa-hda-use-one-dmic-only-for-dell-studio-1558.patch new file mode 100644 index 0000000000..ef0d22ae5d --- /dev/null +++ b/queue-2.6.39/alsa-hda-use-one-dmic-only-for-dell-studio-1558.patch @@ -0,0 +1,34 @@ +From e033ebfb399227e01686260ac271029011bc6b47 Mon Sep 17 00:00:00 2001 +From: David Henningsson <david.henningsson@canonical.com> +Date: Mon, 16 May 2011 12:09:29 +0200 +Subject: ALSA: HDA: Use one dmic only for Dell Studio 1558 + +From: David Henningsson <david.henningsson@canonical.com> + +commit e033ebfb399227e01686260ac271029011bc6b47 upstream. + +There are no signs of a dmic at node 0x0b, so the user is left with +an additional internal mic which does not exist. This commit removes +that non-existing mic. + +BugLink: http://bugs.launchpad.net/bugs/731706 +Reported-by: James Page <james.page@canonical.com> +Signed-off-by: David Henningsson <david.henningsson@canonical.com> +Signed-off-by: Takashi Iwai <tiwai@suse.de> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + sound/pci/hda/patch_sigmatel.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/pci/hda/patch_sigmatel.c ++++ b/sound/pci/hda/patch_sigmatel.c +@@ -1600,7 +1600,7 @@ static struct snd_pci_quirk stac92hd73xx + SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x02fe, + "Dell Studio XPS 1645", STAC_DELL_M6_BOTH), + SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x0413, +- "Dell Studio 1558", STAC_DELL_M6_BOTH), ++ "Dell Studio 1558", STAC_DELL_M6_DMIC), + {} /* terminator */ + }; + diff --git a/queue-2.6.39/asoc-add-some-missing-volume-update-bit-sets-for-wm_hubs.patch b/queue-2.6.39/asoc-add-some-missing-volume-update-bit-sets-for-wm_hubs.patch new file mode 100644 index 0000000000..e638bb5257 --- /dev/null +++ b/queue-2.6.39/asoc-add-some-missing-volume-update-bit-sets-for-wm_hubs.patch @@ -0,0 +1,44 @@ +From fb5af53d421d80725172427e9076f6e889603df6 Mon Sep 17 00:00:00 2001 +From: Mark Brown <broonie@opensource.wolfsonmicro.com> +Date: Sun, 15 May 2011 12:18:38 -0700 +Subject: ASoC: Add some missing volume update bit sets for wm_hubs + devices + +From: Mark Brown <broonie@opensource.wolfsonmicro.com> + +commit fb5af53d421d80725172427e9076f6e889603df6 upstream. + +Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com> +Acked-by: Liam Girdwood <lrg@ti.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + sound/soc/codecs/wm_hubs.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +--- a/sound/soc/codecs/wm_hubs.c ++++ b/sound/soc/codecs/wm_hubs.c +@@ -836,17 +836,21 @@ int wm_hubs_add_analogue_controls(struct + snd_soc_update_bits(codec, WM8993_RIGHT_LINE_INPUT_3_4_VOLUME, + WM8993_IN2_VU, WM8993_IN2_VU); + ++ snd_soc_update_bits(codec, WM8993_SPEAKER_VOLUME_LEFT, ++ WM8993_SPKOUT_VU, WM8993_SPKOUT_VU); + snd_soc_update_bits(codec, WM8993_SPEAKER_VOLUME_RIGHT, + WM8993_SPKOUT_VU, WM8993_SPKOUT_VU); + + snd_soc_update_bits(codec, WM8993_LEFT_OUTPUT_VOLUME, +- WM8993_HPOUT1L_ZC, WM8993_HPOUT1L_ZC); ++ WM8993_HPOUT1_VU | WM8993_HPOUT1L_ZC, ++ WM8993_HPOUT1_VU | WM8993_HPOUT1L_ZC); + snd_soc_update_bits(codec, WM8993_RIGHT_OUTPUT_VOLUME, + WM8993_HPOUT1_VU | WM8993_HPOUT1R_ZC, + WM8993_HPOUT1_VU | WM8993_HPOUT1R_ZC); + + snd_soc_update_bits(codec, WM8993_LEFT_OPGA_VOLUME, +- WM8993_MIXOUTL_ZC, WM8993_MIXOUTL_ZC); ++ WM8993_MIXOUTL_ZC | WM8993_MIXOUT_VU, ++ WM8993_MIXOUTL_ZC | WM8993_MIXOUT_VU); + snd_soc_update_bits(codec, WM8993_RIGHT_OPGA_VOLUME, + WM8993_MIXOUTR_ZC | WM8993_MIXOUT_VU, + WM8993_MIXOUTR_ZC | WM8993_MIXOUT_VU); diff --git a/queue-2.6.39/asoc-ensure-output-pga-is-enabled-for-line-outputs-in.patch b/queue-2.6.39/asoc-ensure-output-pga-is-enabled-for-line-outputs-in.patch new file mode 100644 index 0000000000..14aaf63a06 --- /dev/null +++ b/queue-2.6.39/asoc-ensure-output-pga-is-enabled-for-line-outputs-in.patch @@ -0,0 +1,66 @@ +From d0b48af6c2b887354d0893e598d92911ce52620e Mon Sep 17 00:00:00 2001 +From: Mark Brown <broonie@opensource.wolfsonmicro.com> +Date: Sat, 14 May 2011 17:21:28 -0700 +Subject: ASoC: Ensure output PGA is enabled for line outputs in + wm_hubs + +From: Mark Brown <broonie@opensource.wolfsonmicro.com> + +commit d0b48af6c2b887354d0893e598d92911ce52620e upstream. + +Also fix a left/right typo while we're at it. + +Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com> +Acked-by: Liam Girdwood <lrg@ti.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + sound/soc/codecs/wm_hubs.c | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +--- a/sound/soc/codecs/wm_hubs.c ++++ b/sound/soc/codecs/wm_hubs.c +@@ -787,17 +787,17 @@ static const struct snd_soc_dapm_route a + static const struct snd_soc_dapm_route lineout1_diff_routes[] = { + { "LINEOUT1 Mixer", "IN1L Switch", "IN1L PGA" }, + { "LINEOUT1 Mixer", "IN1R Switch", "IN1R PGA" }, +- { "LINEOUT1 Mixer", "Output Switch", "Left Output Mixer" }, ++ { "LINEOUT1 Mixer", "Output Switch", "Left Output PGA" }, + + { "LINEOUT1N Driver", NULL, "LINEOUT1 Mixer" }, + { "LINEOUT1P Driver", NULL, "LINEOUT1 Mixer" }, + }; + + static const struct snd_soc_dapm_route lineout1_se_routes[] = { +- { "LINEOUT1N Mixer", "Left Output Switch", "Left Output Mixer" }, +- { "LINEOUT1N Mixer", "Right Output Switch", "Left Output Mixer" }, ++ { "LINEOUT1N Mixer", "Left Output Switch", "Left Output PGA" }, ++ { "LINEOUT1N Mixer", "Right Output Switch", "Right Output PGA" }, + +- { "LINEOUT1P Mixer", "Left Output Switch", "Left Output Mixer" }, ++ { "LINEOUT1P Mixer", "Left Output Switch", "Left Output PGA" }, + + { "LINEOUT1N Driver", NULL, "LINEOUT1N Mixer" }, + { "LINEOUT1P Driver", NULL, "LINEOUT1P Mixer" }, +@@ -806,17 +806,17 @@ static const struct snd_soc_dapm_route l + static const struct snd_soc_dapm_route lineout2_diff_routes[] = { + { "LINEOUT2 Mixer", "IN2L Switch", "IN2L PGA" }, + { "LINEOUT2 Mixer", "IN2R Switch", "IN2R PGA" }, +- { "LINEOUT2 Mixer", "Output Switch", "Right Output Mixer" }, ++ { "LINEOUT2 Mixer", "Output Switch", "Right Output PGA" }, + + { "LINEOUT2N Driver", NULL, "LINEOUT2 Mixer" }, + { "LINEOUT2P Driver", NULL, "LINEOUT2 Mixer" }, + }; + + static const struct snd_soc_dapm_route lineout2_se_routes[] = { +- { "LINEOUT2N Mixer", "Left Output Switch", "Left Output Mixer" }, +- { "LINEOUT2N Mixer", "Right Output Switch", "Left Output Mixer" }, ++ { "LINEOUT2N Mixer", "Left Output Switch", "Left Output PGA" }, ++ { "LINEOUT2N Mixer", "Right Output Switch", "Right Output PGA" }, + +- { "LINEOUT2P Mixer", "Right Output Switch", "Right Output Mixer" }, ++ { "LINEOUT2P Mixer", "Right Output Switch", "Right Output PGA" }, + + { "LINEOUT2N Driver", NULL, "LINEOUT2N Mixer" }, + { "LINEOUT2P Driver", NULL, "LINEOUT2P Mixer" }, diff --git a/queue-2.6.39/asoc-fix-raumfeld-platform.patch b/queue-2.6.39/asoc-fix-raumfeld-platform.patch new file mode 100644 index 0000000000..a0a4897d19 --- /dev/null +++ b/queue-2.6.39/asoc-fix-raumfeld-platform.patch @@ -0,0 +1,156 @@ +From 477a66948ef8683f182682cc68e8520baf8a5b43 Mon Sep 17 00:00:00 2001 +From: Daniel Mack <zonque@gmail.com> +Date: Tue, 24 May 2011 14:10:32 +0200 +Subject: ASoC: fix raumfeld platform + +From: Daniel Mack <zonque@gmail.com> + +commit 477a66948ef8683f182682cc68e8520baf8a5b43 upstream. + +Commit f0fba2ad (ASoC: multi-component - ASoC Multi-Component Support) +broke support for Raumfeld platforms as it didn't take into account the +different hardware features on individual devices. + +In particular, Raumfeld speakers have no S/PDIF output, so the members +of the snd_soc_card struct must be set dynamically. + +Signed-off-by: Daniel Mack <zonque@gmail.com> +Acked-by: Liam Girdwood <lrg@slimlogic.co.uk> +Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + sound/soc/pxa/raumfeld.c | 94 +++++++++++++++++++++++++++++------------------ + 1 file changed, 59 insertions(+), 35 deletions(-) + +--- a/sound/soc/pxa/raumfeld.c ++++ b/sound/soc/pxa/raumfeld.c +@@ -151,13 +151,13 @@ static struct snd_soc_ops raumfeld_cs427 + .hw_params = raumfeld_cs4270_hw_params, + }; + +-static int raumfeld_line_suspend(struct snd_soc_card *card) ++static int raumfeld_analog_suspend(struct snd_soc_card *card) + { + raumfeld_enable_audio(false); + return 0; + } + +-static int raumfeld_line_resume(struct snd_soc_card *card) ++static int raumfeld_analog_resume(struct snd_soc_card *card) + { + raumfeld_enable_audio(true); + return 0; +@@ -225,32 +225,53 @@ static struct snd_soc_ops raumfeld_ak410 + .hw_params = raumfeld_ak4104_hw_params, + }; + +-static struct snd_soc_dai_link raumfeld_dai[] = { ++#define DAI_LINK_CS4270 \ ++{ \ ++ .name = "CS4270", \ ++ .stream_name = "CS4270", \ ++ .cpu_dai_name = "pxa-ssp-dai.0", \ ++ .platform_name = "pxa-pcm-audio", \ ++ .codec_dai_name = "cs4270-hifi", \ ++ .codec_name = "cs4270-codec.0-0048", \ ++ .ops = &raumfeld_cs4270_ops, \ ++} ++ ++#define DAI_LINK_AK4104 \ ++{ \ ++ .name = "ak4104", \ ++ .stream_name = "Playback", \ ++ .cpu_dai_name = "pxa-ssp-dai.1", \ ++ .codec_dai_name = "ak4104-hifi", \ ++ .platform_name = "pxa-pcm-audio", \ ++ .ops = &raumfeld_ak4104_ops, \ ++ .codec_name = "spi0.0", \ ++} ++ ++static struct snd_soc_dai_link snd_soc_raumfeld_connector_dai[] = ++{ ++ DAI_LINK_CS4270, ++ DAI_LINK_AK4104, ++}; ++ ++static struct snd_soc_dai_link snd_soc_raumfeld_speaker_dai[] = + { +- .name = "ak4104", +- .stream_name = "Playback", +- .cpu_dai_name = "pxa-ssp-dai.1", +- .codec_dai_name = "ak4104-hifi", +- .platform_name = "pxa-pcm-audio", +- .ops = &raumfeld_ak4104_ops, +- .codec_name = "ak4104-codec.0", +-}, +-{ +- .name = "CS4270", +- .stream_name = "CS4270", +- .cpu_dai_name = "pxa-ssp-dai.0", +- .platform_name = "pxa-pcm-audio", +- .codec_dai_name = "cs4270-hifi", +- .codec_name = "cs4270-codec.0-0048", +- .ops = &raumfeld_cs4270_ops, +-},}; +- +-static struct snd_soc_card snd_soc_raumfeld = { +- .name = "Raumfeld", +- .dai_link = raumfeld_dai, +- .suspend_post = raumfeld_line_suspend, +- .resume_pre = raumfeld_line_resume, +- .num_links = ARRAY_SIZE(raumfeld_dai), ++ DAI_LINK_CS4270, ++}; ++ ++static struct snd_soc_card snd_soc_raumfeld_connector = { ++ .name = "Raumfeld Connector", ++ .dai_link = snd_soc_raumfeld_connector_dai, ++ .num_links = ARRAY_SIZE(snd_soc_raumfeld_connector_dai), ++ .suspend_post = raumfeld_analog_suspend, ++ .resume_pre = raumfeld_analog_resume, ++}; ++ ++static struct snd_soc_card snd_soc_raumfeld_speaker = { ++ .name = "Raumfeld Speaker", ++ .dai_link = snd_soc_raumfeld_speaker_dai, ++ .num_links = ARRAY_SIZE(snd_soc_raumfeld_speaker_dai), ++ .suspend_post = raumfeld_analog_suspend, ++ .resume_pre = raumfeld_analog_resume, + }; + + static struct platform_device *raumfeld_audio_device; +@@ -271,22 +292,25 @@ static int __init raumfeld_audio_init(vo + + set_max9485_clk(MAX9485_MCLK_FREQ_122880); + +- /* Register LINE and SPDIF */ ++ /* Register analog device */ + raumfeld_audio_device = platform_device_alloc("soc-audio", 0); + if (!raumfeld_audio_device) + return -ENOMEM; + +- platform_set_drvdata(raumfeld_audio_device, +- &snd_soc_raumfeld); +- ret = platform_device_add(raumfeld_audio_device); +- +- /* no S/PDIF on Speakers */ + if (machine_is_raumfeld_speaker()) ++ platform_set_drvdata(raumfeld_audio_device, ++ &snd_soc_raumfeld_speaker); ++ ++ if (machine_is_raumfeld_connector()) ++ platform_set_drvdata(raumfeld_audio_device, ++ &snd_soc_raumfeld_connector); ++ ++ ret = platform_device_add(raumfeld_audio_device); ++ if (ret < 0) + return ret; + + raumfeld_enable_audio(true); +- +- return ret; ++ return 0; + } + + static void __exit raumfeld_audio_exit(void) diff --git a/queue-2.6.39/bnx2i-fixed-packet-error-created-when-the-sq_size-is.patch b/queue-2.6.39/bnx2i-fixed-packet-error-created-when-the-sq_size-is.patch new file mode 100644 index 0000000000..70f0296d62 --- /dev/null +++ b/queue-2.6.39/bnx2i-fixed-packet-error-created-when-the-sq_size-is.patch @@ -0,0 +1,49 @@ +From 7287c63e986fe1a51a89f4bb1327320274a7a741 Mon Sep 17 00:00:00 2001 +From: Eddie Wai <eddie.wai@broadcom.com> +Date: Mon, 16 May 2011 11:13:18 -0700 +Subject: [SCSI] bnx2i: Fixed packet error created when the sq_size is + set to 16 + +From: Eddie Wai <eddie.wai@broadcom.com> + +commit 7287c63e986fe1a51a89f4bb1327320274a7a741 upstream. + +The number of chip's internal command cell, which is use to generate +SCSI cmd packets to the target, was not initialized correctly by +the driver when the sq_size is changed from the default 128. +This, in turn, will create a problem where the chip's transmit pipe +will erroneously reuse an old command cell that is no longer valid. +The fix is to correctly initialize the chip's command cell upon setup. + +Signed-off-by: Eddie Wai <eddie.wai@broadcom.com> +Reviewed-by: Mike Christie <michaelc@cs.wisc.edu> +Signed-off-by: James Bottomley <jbottomley@parallels.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/scsi/bnx2i/bnx2i_hwi.c | 1 + + drivers/scsi/bnx2i/bnx2i_iscsi.c | 3 +++ + 2 files changed, 4 insertions(+) + +--- a/drivers/scsi/bnx2i/bnx2i_hwi.c ++++ b/drivers/scsi/bnx2i/bnx2i_hwi.c +@@ -1274,6 +1274,7 @@ int bnx2i_send_fw_iscsi_init_msg(struct + iscsi_init.dummy_buffer_addr_hi = + (u32) ((u64) hba->dummy_buf_dma >> 32); + ++ hba->num_ccell = hba->max_sqes >> 1; + hba->ctx_ccell_tasks = + ((hba->num_ccell & 0xFFFF) | (hba->max_sqes << 16)); + iscsi_init.num_ccells_per_conn = hba->num_ccell; +--- a/drivers/scsi/bnx2i/bnx2i_iscsi.c ++++ b/drivers/scsi/bnx2i/bnx2i_iscsi.c +@@ -1208,6 +1208,9 @@ static int bnx2i_task_xmit(struct iscsi_ + struct bnx2i_cmd *cmd = task->dd_data; + struct iscsi_cmd *hdr = (struct iscsi_cmd *) task->hdr; + ++ if (bnx2i_conn->ep->num_active_cmds + 1 > hba->max_sqes) ++ return -ENOMEM; ++ + /* + * If there is no scsi_cmnd this must be a mgmt task + */ diff --git a/queue-2.6.39/bnx2i-updated-the-connection-shutdown-cleanup.patch b/queue-2.6.39/bnx2i-updated-the-connection-shutdown-cleanup.patch new file mode 100644 index 0000000000..266132d6cd --- /dev/null +++ b/queue-2.6.39/bnx2i-updated-the-connection-shutdown-cleanup.patch @@ -0,0 +1,46 @@ +From d5307a078bb0288945c900c6f4a2fd77ba6d0817 Mon Sep 17 00:00:00 2001 +From: Eddie Wai <eddie.wai@broadcom.com> +Date: Mon, 16 May 2011 11:13:19 -0700 +Subject: [SCSI] bnx2i: Updated the connection shutdown/cleanup + timeout + +From: Eddie Wai <eddie.wai@broadcom.com> + +commit d5307a078bb0288945c900c6f4a2fd77ba6d0817 upstream. + +Modified the 10s wait time for inflight offload connections to +advance to the next state to 2s based on test result. +Modified the 20s shutdown timeout to 30s based on test result. + +Signed-off-by: Eddie Wai <eddie.wai@broadcom.com> +Reviewed-by: Mike Christie <michaelc@cs.wisc.edu> +Signed-off-by: James Bottomley <jbottomley@parallels.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/scsi/bnx2i/bnx2i_init.c | 2 +- + drivers/scsi/bnx2i/bnx2i_iscsi.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/scsi/bnx2i/bnx2i_init.c ++++ b/drivers/scsi/bnx2i/bnx2i_init.c +@@ -244,7 +244,7 @@ void bnx2i_stop(void *handle) + wait_event_interruptible_timeout(hba->eh_wait, + (list_empty(&hba->ep_ofld_list) && + list_empty(&hba->ep_destroy_list)), +- 10 * HZ); ++ 2 * HZ); + /* Wait for all endpoints to be torn down, Chip will be reset once + * control returns to network driver. So it is required to cleanup and + * release all connection resources before returning from this routine. +--- a/drivers/scsi/bnx2i/bnx2i_iscsi.c ++++ b/drivers/scsi/bnx2i/bnx2i_iscsi.c +@@ -858,7 +858,7 @@ struct bnx2i_hba *bnx2i_alloc_hba(struct + mutex_init(&hba->net_dev_lock); + init_waitqueue_head(&hba->eh_wait); + if (test_bit(BNX2I_NX2_DEV_57710, &hba->cnic_dev_type)) { +- hba->hba_shutdown_tmo = 20 * HZ; ++ hba->hba_shutdown_tmo = 30 * HZ; + hba->conn_teardown_tmo = 20 * HZ; + hba->conn_ctx_destroy_tmo = 6 * HZ; + } else { /* 5706/5708/5709 */ diff --git a/queue-2.6.39/fix-for-buffer-overflow-in-ldm_frag_add-not-sufficient.patch b/queue-2.6.39/fix-for-buffer-overflow-in-ldm_frag_add-not-sufficient.patch new file mode 100644 index 0000000000..b54940b821 --- /dev/null +++ b/queue-2.6.39/fix-for-buffer-overflow-in-ldm_frag_add-not-sufficient.patch @@ -0,0 +1,40 @@ +From cae13fe4cc3f24820ffb990c09110626837e85d4 Mon Sep 17 00:00:00 2001 +From: Timo Warns <Warns@pre-sense.de> +Date: Thu, 19 May 2011 09:24:17 +0200 +Subject: Fix for buffer overflow in ldm_frag_add not sufficient + +From: Timo Warns <Warns@pre-sense.de> + +commit cae13fe4cc3f24820ffb990c09110626837e85d4 upstream. + +As Ben Hutchings discovered [1], the patch for CVE-2011-1017 (buffer +overflow in ldm_frag_add) is not sufficient. The original patch in +commit c340b1d64000 ("fs/partitions/ldm.c: fix oops caused by corrupted +partition table") does not consider that, for subsequent fragments, +previously allocated memory is used. + +[1] http://lkml.org/lkml/2011/5/6/407 + +Reported-by: Ben Hutchings <ben@decadent.org.uk> +Signed-off-by: Timo Warns <warns@pre-sense.de> +Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + fs/partitions/ldm.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/fs/partitions/ldm.c ++++ b/fs/partitions/ldm.c +@@ -1335,6 +1335,11 @@ static bool ldm_frag_add (const u8 *data + + list_add_tail (&f->list, frags); + found: ++ if (rec >= f->num) { ++ ldm_error("REC value (%d) exceeds NUM value (%d)", rec, f->num); ++ return false; ++ } ++ + if (f->map & (1 << rec)) { + ldm_error ("Duplicate VBLK, part %d.", rec); + f->map &= 0x7F; /* Mark the group as broken */ diff --git a/queue-2.6.39/fix-ultrastor-asm-snippet.patch b/queue-2.6.39/fix-ultrastor-asm-snippet.patch new file mode 100644 index 0000000000..413ce65022 --- /dev/null +++ b/queue-2.6.39/fix-ultrastor-asm-snippet.patch @@ -0,0 +1,40 @@ +From fad4dab5e44e10acf6b0235e469cb8e773b58e31 Mon Sep 17 00:00:00 2001 +From: Samuel Thibault <samuel.thibault@ens-lyon.org> +Date: Wed, 18 May 2011 17:06:05 +0200 +Subject: [SCSI] Fix Ultrastor asm snippet + +From: Samuel Thibault <samuel.thibault@ens-lyon.org> + +commit fad4dab5e44e10acf6b0235e469cb8e773b58e31 upstream. + +Commit 1292500b replaced + +"=m" (*field) : "1" (*field) + +with + +"=m" (*field) : + +with comment "The following patch fixes it by using the '+' operator on +the (*field) operand, marking it as read-write to gcc." +'+' was actually forgotten. This really puts it. + +Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org> +Signed-off-by: James Bottomley <jbottomley@parallels.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/scsi/ultrastor.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/scsi/ultrastor.c ++++ b/drivers/scsi/ultrastor.c +@@ -307,7 +307,7 @@ static inline int find_and_clear_bit_16( + "0: bsfw %1,%w0\n\t" + "btr %0,%1\n\t" + "jnc 0b" +- : "=&r" (rv), "=m" (*field) :); ++ : "=&r" (rv), "+m" (*field) :); + + return rv; + } diff --git a/queue-2.6.39/hid-magicmouse-ignore-ivalid-report-id-while-switching.patch b/queue-2.6.39/hid-magicmouse-ignore-ivalid-report-id-while-switching.patch new file mode 100644 index 0000000000..db1b48360f --- /dev/null +++ b/queue-2.6.39/hid-magicmouse-ignore-ivalid-report-id-while-switching.patch @@ -0,0 +1,53 @@ +From 23746a66d7d9e73402c68ef00d708796b97ebd72 Mon Sep 17 00:00:00 2001 +From: Jiri Kosina <jkosina@suse.cz> +Date: Thu, 19 May 2011 17:58:07 +0200 +Subject: HID: magicmouse: ignore 'ivalid report id' while switching + modes + +From: Jiri Kosina <jkosina@suse.cz> + +commit 23746a66d7d9e73402c68ef00d708796b97ebd72 upstream. + +The device reponds with 'invalid report id' when feature report switching it +into multitouch mode is sent to it. + +This has been silently ignored before 0825411ade ("HID: bt: Wait for ACK +on Sent Reports"), but since this commit, it propagates -EIO from the _raw +callback . + +So let the driver ignore -EIO as response to 0xd7,0x01 report, as that's +how the device reacts in normal mode. + +Sad, but following reality. + +This fixes https://bugzilla.kernel.org/show_bug.cgi?id=35022 + +Tested-by: Chase Douglas <chase.douglas@canonical.com> +Signed-off-by: Jiri Kosina <jkosina@suse.cz> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/hid/hid-magicmouse.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +--- a/drivers/hid/hid-magicmouse.c ++++ b/drivers/hid/hid-magicmouse.c +@@ -501,9 +501,17 @@ static int magicmouse_probe(struct hid_d + } + report->size = 6; + ++ /* ++ * The device reponds with 'invalid report id' when feature ++ * report switching it into multitouch mode is sent to it. ++ * ++ * This results in -EIO from the _raw low-level transport callback, ++ * but there seems to be no other way of switching the mode. ++ * Thus the super-ugly hacky success check below. ++ */ + ret = hdev->hid_output_raw_report(hdev, feature, sizeof(feature), + HID_FEATURE_REPORT); +- if (ret != sizeof(feature)) { ++ if (ret != -EIO) { + hid_err(hdev, "unable to request touch data (%d)\n", ret); + goto err_stop_hw; + } diff --git a/queue-2.6.39/i2c-tegra-enable-new-slave-mode.patch b/queue-2.6.39/i2c-tegra-enable-new-slave-mode.patch new file mode 100644 index 0000000000..0bb2d684b1 --- /dev/null +++ b/queue-2.6.39/i2c-tegra-enable-new-slave-mode.patch @@ -0,0 +1,50 @@ +From 65a1a0ace554d61ea5a90377a54df1505275c1b1 Mon Sep 17 00:00:00 2001 +From: Kenneth Waters <kwaters@chromium.org> +Date: Mon, 25 Apr 2011 12:29:54 -0600 +Subject: i2c: tegra: Enable new slave mode. + +From: Kenneth Waters <kwaters@chromium.org> + +commit 65a1a0ace554d61ea5a90377a54df1505275c1b1 upstream. + +For Tegra i2c controller to function properly new slave mode must be +enabled. + +swarren notes: + +In particular, I found this was needed when working on enabling the +Tegra audio driver on the Seaboard board. There are two different PCB +layouts for this board; a "clamshell" version, which works just fine +without this change, and the original non-clamshell version, which needs +this change in order for I2C to operate correctly. Without it, I2C +probing fails for some devices, e.g. with: + +wm8903 0-001a: Device with ID register 0 is not a WM8903 +wm8903 0-001a: asoc: failed to probe CODEC wm8903.0-001a: -19 +asoc: failed to instantiate card tegra-wm8903: -19 +ALSA device list: + No soundcards found. + +Signed-off-by: Rakesh Iyer <riyer@nvidia.com> +Signed-off-by: Stephen Warren <swarren@nvidia.com> +Signed-off-by: Ben Dooks <ben-linux@fluff.org> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/i2c/busses/i2c-tegra.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/i2c/busses/i2c-tegra.c ++++ b/drivers/i2c/busses/i2c-tegra.c +@@ -330,6 +330,11 @@ static int tegra_i2c_init(struct tegra_i + i2c_writel(i2c_dev, 0, I2C_INT_MASK); + clk_set_rate(i2c_dev->clk, i2c_dev->bus_clk_rate * 8); + ++ if (!i2c_dev->is_dvc) { ++ u32 sl_cfg = i2c_readl(i2c_dev, I2C_SL_CNFG); ++ i2c_writel(i2c_dev, sl_cfg | I2C_SL_CNFG_NEWSL, I2C_SL_CNFG); ++ } ++ + val = 7 << I2C_FIFO_CONTROL_TX_TRIG_SHIFT | + 0 << I2C_FIFO_CONTROL_RX_TRIG_SHIFT; + i2c_writel(i2c_dev, val, I2C_FIFO_CONTROL); diff --git a/queue-2.6.39/i2c-writing-clients-fix-foo_driver.id_table.patch b/queue-2.6.39/i2c-writing-clients-fix-foo_driver.id_table.patch new file mode 100644 index 0000000000..c9ea9c7cda --- /dev/null +++ b/queue-2.6.39/i2c-writing-clients-fix-foo_driver.id_table.patch @@ -0,0 +1,31 @@ +From 3116c86033079a1d4d4e84c40028f96b614843b8 Mon Sep 17 00:00:00 2001 +From: Vikram Narayanan <vikram186@gmail.com> +Date: Tue, 24 May 2011 20:58:48 +0200 +Subject: i2c/writing-clients: Fix foo_driver.id_table + +From: Vikram Narayanan <vikram186@gmail.com> + +commit 3116c86033079a1d4d4e84c40028f96b614843b8 upstream. + +The i2c_device_id structure variable's name is not used in the +i2c_driver structure. + +Signed-off-by: Vikram Narayanan <vikram186@gmail.com> +Signed-off-by: Jean Delvare <khali@linux-fr.org> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + Documentation/i2c/writing-clients | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/Documentation/i2c/writing-clients ++++ b/Documentation/i2c/writing-clients +@@ -38,7 +38,7 @@ static struct i2c_driver foo_driver = { + .name = "foo", + }, + +- .id_table = foo_ids, ++ .id_table = foo_idtable, + .probe = foo_probe, + .remove = foo_remove, + /* if device autodetection is needed: */ diff --git a/queue-2.6.39/loop-handle-on-demand-devices-correctly.patch b/queue-2.6.39/loop-handle-on-demand-devices-correctly.patch new file mode 100644 index 0000000000..9abc46a853 --- /dev/null +++ b/queue-2.6.39/loop-handle-on-demand-devices-correctly.patch @@ -0,0 +1,92 @@ +From a1c15c59feee36267c43142a41152fbf7402afb6 Mon Sep 17 00:00:00 2001 +From: Namhyung Kim <namhyung@gmail.com> +Date: Tue, 24 May 2011 16:48:55 +0200 +Subject: loop: handle on-demand devices correctly + +From: Namhyung Kim <namhyung@gmail.com> + +commit a1c15c59feee36267c43142a41152fbf7402afb6 upstream. + +When finding or allocating a loop device, loop_probe() did not take +partition numbers into account so that it can result to a different +device. Consider following example: + +$ sudo modprobe loop max_part=15 +$ ls -l /dev/loop* +brw-rw---- 1 root disk 7, 0 2011-05-24 22:16 /dev/loop0 +brw-rw---- 1 root disk 7, 16 2011-05-24 22:16 /dev/loop1 +brw-rw---- 1 root disk 7, 32 2011-05-24 22:16 /dev/loop2 +brw-rw---- 1 root disk 7, 48 2011-05-24 22:16 /dev/loop3 +brw-rw---- 1 root disk 7, 64 2011-05-24 22:16 /dev/loop4 +brw-rw---- 1 root disk 7, 80 2011-05-24 22:16 /dev/loop5 +brw-rw---- 1 root disk 7, 96 2011-05-24 22:16 /dev/loop6 +brw-rw---- 1 root disk 7, 112 2011-05-24 22:16 /dev/loop7 +$ sudo mknod /dev/loop8 b 7 128 +$ sudo losetup /dev/loop8 ~/temp/disk-with-3-parts.img +$ sudo losetup -a +/dev/loop128: [0805]:278201 (/home/namhyung/temp/disk-with-3-parts.img) +$ ls -l /dev/loop* +brw-rw---- 1 root disk 7, 0 2011-05-24 22:16 /dev/loop0 +brw-rw---- 1 root disk 7, 16 2011-05-24 22:16 /dev/loop1 +brw-rw---- 1 root disk 7, 2048 2011-05-24 22:18 /dev/loop128 +brw-rw---- 1 root disk 7, 2049 2011-05-24 22:18 /dev/loop128p1 +brw-rw---- 1 root disk 7, 2050 2011-05-24 22:18 /dev/loop128p2 +brw-rw---- 1 root disk 7, 2051 2011-05-24 22:18 /dev/loop128p3 +brw-rw---- 1 root disk 7, 32 2011-05-24 22:16 /dev/loop2 +brw-rw---- 1 root disk 7, 48 2011-05-24 22:16 /dev/loop3 +brw-rw---- 1 root disk 7, 64 2011-05-24 22:16 /dev/loop4 +brw-rw---- 1 root disk 7, 80 2011-05-24 22:16 /dev/loop5 +brw-rw---- 1 root disk 7, 96 2011-05-24 22:16 /dev/loop6 +brw-rw---- 1 root disk 7, 112 2011-05-24 22:16 /dev/loop7 +brw-r--r-- 1 root root 7, 128 2011-05-24 22:17 /dev/loop8 + +After this patch, /dev/loop8 - instead of /dev/loop128 - was +accessed correctly. + +In addition, 'range' passed to blk_register_region() should +include all range of dev_t that LOOP_MAJOR can address. It does +not need to be limited by partition numbers unless 'max_loop' +param was specified. + +Signed-off-by: Namhyung Kim <namhyung@gmail.com> +Cc: Laurent Vivier <Laurent.Vivier@bull.net> +Signed-off-by: Jens Axboe <jaxboe@fusionio.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/block/loop.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/block/loop.c ++++ b/drivers/block/loop.c +@@ -1658,7 +1658,7 @@ static struct kobject *loop_probe(dev_t + struct kobject *kobj; + + mutex_lock(&loop_devices_mutex); +- lo = loop_init_one(dev & MINORMASK); ++ lo = loop_init_one(MINOR(dev) >> part_shift); + kobj = lo ? get_disk(lo->lo_disk) : ERR_PTR(-ENOMEM); + mutex_unlock(&loop_devices_mutex); + +@@ -1699,10 +1699,10 @@ static int __init loop_init(void) + + if (max_loop) { + nr = max_loop; +- range = max_loop; ++ range = max_loop << part_shift; + } else { + nr = 8; +- range = 1UL << (MINORBITS - part_shift); ++ range = 1UL << MINORBITS; + } + + if (register_blkdev(LOOP_MAJOR, "loop")) +@@ -1741,7 +1741,7 @@ static void __exit loop_exit(void) + unsigned long range; + struct loop_device *lo, *next; + +- range = max_loop ? max_loop : 1UL << (MINORBITS - part_shift); ++ range = max_loop ? max_loop << part_shift : 1UL << MINORBITS; + + list_for_each_entry_safe(lo, next, &loop_devices, lo_list) + loop_del_one(lo); diff --git a/queue-2.6.39/loop-limit-max_part-module-param-to-disk_max_parts.patch b/queue-2.6.39/loop-limit-max_part-module-param-to-disk_max_parts.patch new file mode 100644 index 0000000000..aee1ca082f --- /dev/null +++ b/queue-2.6.39/loop-limit-max_part-module-param-to-disk_max_parts.patch @@ -0,0 +1,87 @@ +From 78f4bb367fd147a0e7e3998ba6e47109999d8814 Mon Sep 17 00:00:00 2001 +From: Namhyung Kim <namhyung@gmail.com> +Date: Tue, 24 May 2011 16:48:54 +0200 +Subject: loop: limit 'max_part' module param to DISK_MAX_PARTS + +From: Namhyung Kim <namhyung@gmail.com> + +commit 78f4bb367fd147a0e7e3998ba6e47109999d8814 upstream. + +The 'max_part' parameter controls the number of maximum partition +a loop block device can have. However if a user specifies very +large value it would exceed the limitation of device minor number +and can cause a kernel panic (or, at least, produce invalid +device nodes in some cases). + +On my desktop system, following command kills the kernel. On qemu, +it triggers similar oops but the kernel was alive: + +$ sudo modprobe loop max_part0000 + ------------[ cut here ]------------ + kernel BUG at /media/Linux_Data/project/linux/fs/sysfs/group.c:65! + invalid opcode: 0000 [#1] SMP + last sysfs file: + CPU 0 + Modules linked in: loop(+) + + Pid: 43, comm: insmod Tainted: G W 2.6.39-qemu+ #155 Bochs Bochs + RIP: 0010:[<ffffffff8113ce61>] [<ffffffff8113ce61>] internal_create_group= ++0x2a/0x170 + RSP: 0018:ffff880007b3fde8 EFLAGS: 00000246 + RAX: 00000000ffffffef RBX: ffff880007b3d878 RCX: 00000000000007b4 + RDX: ffffffff8152da50 RSI: 0000000000000000 RDI: ffff880007b3d878 + RBP: ffff880007b3fe38 R08: ffff880007b3fde8 R09: 0000000000000000 + R10: ffff88000783b4a8 R11: ffff880007b3d878 R12: ffffffff8152da50 + R13: ffff880007b3d868 R14: 0000000000000000 R15: ffff880007b3d800 + FS: 0000000002137880(0063) GS:ffff880007c00000(0000) knlGS:00000000000000= +00 + CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + CR2: 0000000000422680 CR3: 0000000007b50000 CR4: 00000000000006b0 + DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 + DR3: 0000000000000000 DR6: 0000000000000000 DR7: 0000000000000000 + Process insmod (pid: 43, threadinfo ffff880007b3e000, task ffff880007afb9c= +0) + Stack: + ffff880007b3fe58 ffffffff811e66dd ffff880007b3fe58 ffffffff811e570b + 0000000000000010 ffff880007b3d800 ffff880007a7b390 ffff880007b3d868 + 0000000000400920 ffff880007b3d800 ffff880007b3fe48 ffffffff8113cfc8 + Call Trace: + [<ffffffff811e66dd>] ? device_add+0x4bc/0x5af + [<ffffffff811e570b>] ? dev_set_name+0x3c/0x3e + [<ffffffff8113cfc8>] sysfs_create_group+0xe/0x12 + [<ffffffff810b420e>] blk_trace_init_sysfs+0x14/0x16 + [<ffffffff8116a090>] blk_register_queue+0x47/0xf7 + [<ffffffff8116f527>] add_disk+0xdf/0x290 + [<ffffffffa00060eb>] loop_init+0xeb/0x1b8 [loop] + [<ffffffffa0006000>] ? 0xffffffffa0005fff + [<ffffffff8100020a>] do_one_initcall+0x7a/0x12e + [<ffffffff81096804>] sys_init_module+0x9c/0x1e0 + [<ffffffff813329bb>] system_call_fastpath+0x16/0x1b + Code: c3 55 48 89 e5 41 57 41 56 41 89 f6 41 55 41 54 49 89 d4 53 48 89 fb= + 48 83 ec 28 48 85 ff 74 0b 85 f6 75 0b 48 83 7f 30 00 75 14 <0f> 0b eb fe = +48 83 7f 30 00 b9 ea ff ff ff 0f 84 18 01 00 00 49 + RIP [<ffffffff8113ce61>] internal_create_group+0x2a/0x170 + RSP <ffff880007b3fde8> + ---[ end trace a123eb592043acad ]--- + +Signed-off-by: Namhyung Kim <namhyung@gmail.com> +Cc: Laurent Vivier <Laurent.Vivier@bull.net> +Signed-off-by: Jens Axboe <jaxboe@fusionio.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/block/loop.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/block/loop.c ++++ b/drivers/block/loop.c +@@ -1691,6 +1691,9 @@ static int __init loop_init(void) + if (max_part > 0) + part_shift = fls(max_part); + ++ if ((1UL << part_shift) > DISK_MAX_PARTS) ++ return -EINVAL; ++ + if (max_loop > 1UL << (MINORBITS - part_shift)) + return -EINVAL; + diff --git a/queue-2.6.39/md-bitmap-fix-saving-of-events_cleared-and-other-state.patch b/queue-2.6.39/md-bitmap-fix-saving-of-events_cleared-and-other-state.patch new file mode 100644 index 0000000000..9a1861fa4a --- /dev/null +++ b/queue-2.6.39/md-bitmap-fix-saving-of-events_cleared-and-other-state.patch @@ -0,0 +1,67 @@ +From 8258c53208d7a9b7207e7d4dae36d2ea384cb278 Mon Sep 17 00:00:00 2001 +From: NeilBrown <neilb@suse.de> +Date: Wed, 11 May 2011 14:26:30 +1000 +Subject: md/bitmap: fix saving of events_cleared and other state. + +From: NeilBrown <neilb@suse.de> + +commit 8258c53208d7a9b7207e7d4dae36d2ea384cb278 upstream. + +If a bitmap is found to be 'stale' the events_cleared value +is set to match 'events'. +However if the array is degraded this does not get stored on disk. +This can subsequently lead to incorrect behaviour. + +So change bitmap_update_sb to always update events_cleared in the +superblock from the known events_cleared. +For neatness also set ->state from ->flags. +This requires updating ->state whenever we update ->flags, which makes +sense anyway. + +This is suitable for any active -stable release. + +Signed-off-by: NeilBrown <neilb@suse.de> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/md/bitmap.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +--- a/drivers/md/bitmap.c ++++ b/drivers/md/bitmap.c +@@ -493,11 +493,11 @@ void bitmap_update_sb(struct bitmap *bit + spin_unlock_irqrestore(&bitmap->lock, flags); + sb = kmap_atomic(bitmap->sb_page, KM_USER0); + sb->events = cpu_to_le64(bitmap->mddev->events); +- if (bitmap->mddev->events < bitmap->events_cleared) { ++ if (bitmap->mddev->events < bitmap->events_cleared) + /* rocking back to read-only */ + bitmap->events_cleared = bitmap->mddev->events; +- sb->events_cleared = cpu_to_le64(bitmap->events_cleared); +- } ++ sb->events_cleared = cpu_to_le64(bitmap->events_cleared); ++ sb->state = cpu_to_le32(bitmap->flags); + /* Just in case these have been changed via sysfs: */ + sb->daemon_sleep = cpu_to_le32(bitmap->mddev->bitmap_info.daemon_sleep/HZ); + sb->write_behind = cpu_to_le32(bitmap->mddev->bitmap_info.max_write_behind); +@@ -618,7 +618,7 @@ success: + if (le32_to_cpu(sb->version) == BITMAP_MAJOR_HOSTENDIAN) + bitmap->flags |= BITMAP_HOSTENDIAN; + bitmap->events_cleared = le64_to_cpu(sb->events_cleared); +- if (sb->state & cpu_to_le32(BITMAP_STALE)) ++ if (bitmap->flags & BITMAP_STALE) + bitmap->events_cleared = bitmap->mddev->events; + err = 0; + out: +@@ -652,9 +652,11 @@ static int bitmap_mask_state(struct bitm + switch (op) { + case MASK_SET: + sb->state |= cpu_to_le32(bits); ++ bitmap->flags |= bits; + break; + case MASK_UNSET: + sb->state &= cpu_to_le32(~bits); ++ bitmap->flags &= ~bits; + break; + default: + BUG(); diff --git a/queue-2.6.39/md-fix-race-when-creating-a-new-md-device.patch b/queue-2.6.39/md-fix-race-when-creating-a-new-md-device.patch new file mode 100644 index 0000000000..ea1ad04eac --- /dev/null +++ b/queue-2.6.39/md-fix-race-when-creating-a-new-md-device.patch @@ -0,0 +1,89 @@ +From b0140891a8cea36469f58d23859e599b1122bd37 Mon Sep 17 00:00:00 2001 +From: NeilBrown <neilb@suse.de> +Date: Tue, 10 May 2011 17:49:01 +1000 +Subject: md: Fix race when creating a new md device. + +From: NeilBrown <neilb@suse.de> + +commit b0140891a8cea36469f58d23859e599b1122bd37 upstream. + +There is a race when creating an md device by opening /dev/mdXX. + +If two processes do this at much the same time they will follow the +call path + __blkdev_get -> get_gendisk -> kobj_lookup + +The first will call + -> md_probe -> md_alloc -> add_disk -> blk_register_region + +and the race happens when the second gets to kobj_lookup after +add_disk has called blk_register_region but before it returns to +md_alloc. + +In the case the second will not call md_probe (as the probe is already +done) but will get a handle on the gendisk, return to __blkdev_get +which will then call md_open (via the ->open) pointer. + +As mddev->gendisk hasn't been set yet, md_open will think something is +wrong an return with ERESTARTSYS. + +This can loop endlessly while the first thread makes no progress +through add_disk. Nothing is blocking it, but due to scheduler +behaviour it doesn't get a turn. +So this is essentially a live-lock. + +We fix this by simply moving the assignment to mddev->gendisk before +the call the add_disk() so md_open doesn't get confused. +Also move blk_queue_flush earlier because add_disk should be as late +as possible. + +To make sure that md_open doesn't complete until md_alloc has done all +that is needed, we take mddev->open_mutex during the last part of +md_alloc. md_open will wait for this. + +This can cause a lock-up on boot so Cc:ing for stable. +For 2.6.36 and earlier a different patch will be needed as the +'blk_queue_flush' call isn't there. + +Signed-off-by: NeilBrown <neilb@suse.de> +Reported-by: Thomas Jarosch <thomas.jarosch@intra2net.com> +Tested-by: Thomas Jarosch <thomas.jarosch@intra2net.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/md/md.c | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +--- a/drivers/md/md.c ++++ b/drivers/md/md.c +@@ -4347,13 +4347,19 @@ static int md_alloc(dev_t dev, char *nam + disk->fops = &md_fops; + disk->private_data = mddev; + disk->queue = mddev->queue; ++ blk_queue_flush(mddev->queue, REQ_FLUSH | REQ_FUA); + /* Allow extended partitions. This makes the + * 'mdp' device redundant, but we can't really + * remove it now. + */ + disk->flags |= GENHD_FL_EXT_DEVT; +- add_disk(disk); + mddev->gendisk = disk; ++ /* As soon as we call add_disk(), another thread could get ++ * through to md_open, so make sure it doesn't get too far ++ */ ++ mutex_lock(&mddev->open_mutex); ++ add_disk(disk); ++ + error = kobject_init_and_add(&mddev->kobj, &md_ktype, + &disk_to_dev(disk)->kobj, "%s", "md"); + if (error) { +@@ -4367,8 +4373,7 @@ static int md_alloc(dev_t dev, char *nam + if (mddev->kobj.sd && + sysfs_create_group(&mddev->kobj, &md_bitmap_group)) + printk(KERN_DEBUG "pointless warning\n"); +- +- blk_queue_flush(mddev->queue, REQ_FLUSH | REQ_FUA); ++ mutex_unlock(&mddev->open_mutex); + abort: + mutex_unlock(&disks_mutex); + if (!error && mddev->kobj.sd) { diff --git a/queue-2.6.39/mm-page_alloc.c-prevent-unending-loop-in.patch b/queue-2.6.39/mm-page_alloc.c-prevent-unending-loop-in.patch new file mode 100644 index 0000000000..b1639ff656 --- /dev/null +++ b/queue-2.6.39/mm-page_alloc.c-prevent-unending-loop-in.patch @@ -0,0 +1,65 @@ +From cfa54a0fcfc1017c6f122b6f21aaba36daa07f71 Mon Sep 17 00:00:00 2001 +From: Andrew Barry <abarry@cray.com> +Date: Tue, 24 May 2011 17:12:52 -0700 +Subject: mm/page_alloc.c: prevent unending loop in + __alloc_pages_slowpath() + +From: Andrew Barry <abarry@cray.com> + +commit cfa54a0fcfc1017c6f122b6f21aaba36daa07f71 upstream. + +I believe I found a problem in __alloc_pages_slowpath, which allows a +process to get stuck endlessly looping, even when lots of memory is +available. + +Running an I/O and memory intensive stress-test I see a 0-order page +allocation with __GFP_IO and __GFP_WAIT, running on a system with very +little free memory. Right about the same time that the stress-test gets +killed by the OOM-killer, the utility trying to allocate memory gets stuck +in __alloc_pages_slowpath even though most of the systems memory was freed +by the oom-kill of the stress-test. + +The utility ends up looping from the rebalance label down through the +wait_iff_congested continiously. Because order=0, +__alloc_pages_direct_compact skips the call to get_page_from_freelist. +Because all of the reclaimable memory on the system has already been +reclaimed, __alloc_pages_direct_reclaim skips the call to +get_page_from_freelist. Since there is no __GFP_FS flag, the block with +__alloc_pages_may_oom is skipped. The loop hits the wait_iff_congested, +then jumps back to rebalance without ever trying to +get_page_from_freelist. This loop repeats infinitely. + +The test case is pretty pathological. Running a mix of I/O stress-tests +that do a lot of fork() and consume all of the system memory, I can pretty +reliably hit this on 600 nodes, in about 12 hours. 32GB/node. + +Signed-off-by: Andrew Barry <abarry@cray.com> +Signed-off-by: Minchan Kim <minchan.kim@gmail.com> +Reviewed-by: Rik van Riel<riel@redhat.com> +Acked-by: Mel Gorman <mgorman@suse.de> +Signed-off-by: Andrew Morton <akpm@linux-foundation.org> +Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + mm/page_alloc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/mm/page_alloc.c ++++ b/mm/page_alloc.c +@@ -2064,6 +2064,7 @@ restart: + first_zones_zonelist(zonelist, high_zoneidx, NULL, + &preferred_zone); + ++rebalance: + /* This is the last chance, in general, before the goto nopage. */ + page = get_page_from_freelist(gfp_mask, nodemask, order, zonelist, + high_zoneidx, alloc_flags & ~ALLOC_NO_WATERMARKS, +@@ -2071,7 +2072,6 @@ restart: + if (page) + goto got_pg; + +-rebalance: + /* Allocate without watermarks if the context allows */ + if (alloc_flags & ALLOC_NO_WATERMARKS) { + page = __alloc_pages_high_priority(gfp_mask, order, diff --git a/queue-2.6.39/mm-vmscan-correct-use-of-pgdat_balanced-in.patch b/queue-2.6.39/mm-vmscan-correct-use-of-pgdat_balanced-in.patch new file mode 100644 index 0000000000..0a1c72d2d0 --- /dev/null +++ b/queue-2.6.39/mm-vmscan-correct-use-of-pgdat_balanced-in.patch @@ -0,0 +1,71 @@ +From afc7e326a3f5bafc41324d7926c324414e343ee5 Mon Sep 17 00:00:00 2001 +From: Johannes Weiner <hannes@cmpxchg.org> +Date: Tue, 24 May 2011 17:11:09 -0700 +Subject: mm: vmscan: correct use of pgdat_balanced in + sleeping_prematurely + +From: Johannes Weiner <hannes@cmpxchg.org> + +commit afc7e326a3f5bafc41324d7926c324414e343ee5 upstream. + +There are a few reports of people experiencing hangs when copying large +amounts of data with kswapd using a large amount of CPU which appear to be +due to recent reclaim changes. SLUB using high orders is the trigger but +not the root cause as SLUB has been using high orders for a while. The +root cause was bugs introduced into reclaim which are addressed by the +following two patches. + +Patch 1 corrects logic introduced by commit 1741c877 ("mm: kswapd: + keep kswapd awake for high-order allocations until a percentage of + the node is balanced") to allow kswapd to go to sleep when + balanced for high orders. + +Patch 2 notes that it is possible for kswapd to miss every + cond_resched() and updates shrink_slab() so it'll at least reach + that scheduling point. + +Chris Wood reports that these two patches in isolation are sufficient to +prevent the system hanging. AFAIK, they should also resolve similar hangs +experienced by James Bottomley. + +This patch: + +Johannes Weiner poined out that the logic in commit 1741c877 ("mm: kswapd: +keep kswapd awake for high-order allocations until a percentage of the +node is balanced") is backwards. Instead of allowing kswapd to go to +sleep when balancing for high order allocations, it keeps it kswapd +running uselessly. + +Signed-off-by: Mel Gorman <mgorman@suse.de> +Reviewed-by: Rik van Riel <riel@redhat.com> +Signed-off-by: Johannes Weiner <hannes@cmpxchg.org> +Reviewed-by: Wu Fengguang <fengguang.wu@intel.com> +Cc: James Bottomley <James.Bottomley@HansenPartnership.com> +Tested-by: Colin King <colin.king@canonical.com> +Cc: Raghavendra D Prabhu <raghu.prabhu13@gmail.com> +Cc: Jan Kara <jack@suse.cz> +Cc: Chris Mason <chris.mason@oracle.com> +Cc: Christoph Lameter <cl@linux.com> +Cc: Pekka Enberg <penberg@kernel.org> +Cc: Rik van Riel <riel@redhat.com> +Reviewed-by: Minchan Kim <minchan.kim@gmail.com> +Reviewed-by: Wu Fengguang <fengguang.wu@intel.com> +Signed-off-by: Andrew Morton <akpm@linux-foundation.org> +Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + mm/vmscan.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/mm/vmscan.c ++++ b/mm/vmscan.c +@@ -2286,7 +2286,7 @@ static bool sleeping_prematurely(pg_data + * must be balanced + */ + if (order) +- return pgdat_balanced(pgdat, balanced, classzone_idx); ++ return !pgdat_balanced(pgdat, balanced, classzone_idx); + else + return !all_zones_ok; + } diff --git a/queue-2.6.39/mm-vmscan-correctly-check-if-reclaimer-should-schedule.patch b/queue-2.6.39/mm-vmscan-correctly-check-if-reclaimer-should-schedule.patch new file mode 100644 index 0000000000..929a79786a --- /dev/null +++ b/queue-2.6.39/mm-vmscan-correctly-check-if-reclaimer-should-schedule.patch @@ -0,0 +1,85 @@ +From f06590bd718ed950c98828e30ef93204028f3210 Mon Sep 17 00:00:00 2001 +From: Minchan Kim <minchan.kim@gmail.com> +Date: Tue, 24 May 2011 17:11:11 -0700 +Subject: mm: vmscan: correctly check if reclaimer should schedule + during shrink_slab + +From: Minchan Kim <minchan.kim@gmail.com> + +commit f06590bd718ed950c98828e30ef93204028f3210 upstream. + +It has been reported on some laptops that kswapd is consuming large +amounts of CPU and not being scheduled when SLUB is enabled during large +amounts of file copying. It is expected that this is due to kswapd +missing every cond_resched() point because; + +shrink_page_list() calls cond_resched() if inactive pages were isolated + which in turn may not happen if all_unreclaimable is set in + shrink_zones(). If for whatver reason, all_unreclaimable is + set on all zones, we can miss calling cond_resched(). + +balance_pgdat() only calls cond_resched if the zones are not + balanced. For a high-order allocation that is balanced, it + checks order-0 again. During that window, order-0 might have + become unbalanced so it loops again for order-0 and returns + that it was reclaiming for order-0 to kswapd(). It can then + find that a caller has rewoken kswapd for a high-order and + re-enters balance_pgdat() without ever calling cond_resched(). + +shrink_slab only calls cond_resched() if we are reclaiming slab + pages. If there are a large number of direct reclaimers, the + shrinker_rwsem can be contended and prevent kswapd calling + cond_resched(). + +This patch modifies the shrink_slab() case. If the semaphore is +contended, the caller will still check cond_resched(). After each +successful call into a shrinker, the check for cond_resched() remains in +case one shrinker is particularly slow. + +[mgorman@suse.de: preserve call to cond_resched after each call into shrinker] +Signed-off-by: Mel Gorman <mgorman@suse.de> +Signed-off-by: Minchan Kim <minchan.kim@gmail.com> +Cc: Rik van Riel <riel@redhat.com> +Cc: Johannes Weiner <hannes@cmpxchg.org> +Cc: Wu Fengguang <fengguang.wu@intel.com> +Cc: James Bottomley <James.Bottomley@HansenPartnership.com> +Tested-by: Colin King <colin.king@canonical.com> +Cc: Raghavendra D Prabhu <raghu.prabhu13@gmail.com> +Cc: Jan Kara <jack@suse.cz> +Cc: Chris Mason <chris.mason@oracle.com> +Cc: Christoph Lameter <cl@linux.com> +Cc: Pekka Enberg <penberg@kernel.org> +Cc: Rik van Riel <riel@redhat.com> +Signed-off-by: Andrew Morton <akpm@linux-foundation.org> +Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + mm/vmscan.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +--- a/mm/vmscan.c ++++ b/mm/vmscan.c +@@ -230,8 +230,11 @@ unsigned long shrink_slab(unsigned long + if (scanned == 0) + scanned = SWAP_CLUSTER_MAX; + +- if (!down_read_trylock(&shrinker_rwsem)) +- return 1; /* Assume we'll be able to shrink next time */ ++ if (!down_read_trylock(&shrinker_rwsem)) { ++ /* Assume we'll be able to shrink next time */ ++ ret = 1; ++ goto out; ++ } + + list_for_each_entry(shrinker, &shrinker_list, list) { + unsigned long long delta; +@@ -282,6 +285,8 @@ unsigned long shrink_slab(unsigned long + shrinker->nr += total_scan; + } + up_read(&shrinker_rwsem); ++out: ++ cond_resched(); + return ret; + } + diff --git a/queue-2.6.39/mpt2sas-move-even-handling-of.patch b/queue-2.6.39/mpt2sas-move-even-handling-of.patch new file mode 100644 index 0000000000..831ae503e4 --- /dev/null +++ b/queue-2.6.39/mpt2sas-move-even-handling-of.patch @@ -0,0 +1,173 @@ +From 3ace8e052be5293ebb3e00f819effccc64108a38 Mon Sep 17 00:00:00 2001 +From: "Kashyap, Desai" <kashyap.desai@lsi.com> +Date: Wed, 4 May 2011 16:35:58 +0530 +Subject: [SCSI] mpt2sas: move even handling of + MPT2SAS_TURN_ON_FAULT_LED into process context + +From: "Kashyap, Desai" <kashyap.desai@lsi.com> + +commit 3ace8e052be5293ebb3e00f819effccc64108a38 upstream. + +Driver was a sending a SEP request during interrupt context which +required to go to sleep. + +The fix is to rearrange the code so a fake event +MPT2SAS_TURN_ON_FAULT_LED is fired from interrupt context, then later +during the kernel worker threads processing, the SEP request is issued +to firmware. + +Signed-off-by: Kashyap Desai <kashyap.desai@lsi.com> +Signed-off-by: James Bottomley <jbottomley@parallels.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/scsi/mpt2sas/mpt2sas_scsih.c | 94 +++++++++++++++++++++++++---------- + 1 file changed, 68 insertions(+), 26 deletions(-) + +--- a/drivers/scsi/mpt2sas/mpt2sas_scsih.c ++++ b/drivers/scsi/mpt2sas/mpt2sas_scsih.c +@@ -113,6 +113,7 @@ struct sense_info { + }; + + ++#define MPT2SAS_TURN_ON_FAULT_LED (0xFFFC) + #define MPT2SAS_RESCAN_AFTER_HOST_RESET (0xFFFF) + + /** +@@ -121,6 +122,7 @@ struct sense_info { + * @work: work object (ioc->fault_reset_work_q) + * @cancel_pending_work: flag set during reset handling + * @ioc: per adapter object ++ * @device_handle: device handle + * @VF_ID: virtual function id + * @VP_ID: virtual port id + * @ignore: flag meaning this event has been marked to ignore +@@ -134,6 +136,7 @@ struct fw_event_work { + u8 cancel_pending_work; + struct delayed_work delayed_work; + struct MPT2SAS_ADAPTER *ioc; ++ u16 device_handle; + u8 VF_ID; + u8 VP_ID; + u8 ignore; +@@ -3708,17 +3711,75 @@ _scsih_scsi_ioc_info(struct MPT2SAS_ADAP + #endif + + /** +- * _scsih_smart_predicted_fault - illuminate Fault LED ++ * _scsih_turn_on_fault_led - illuminate Fault LED + * @ioc: per adapter object + * @handle: device handle ++ * Context: process + * + * Return nothing. + */ + static void +-_scsih_smart_predicted_fault(struct MPT2SAS_ADAPTER *ioc, u16 handle) ++_scsih_turn_on_fault_led(struct MPT2SAS_ADAPTER *ioc, u16 handle) + { + Mpi2SepReply_t mpi_reply; + Mpi2SepRequest_t mpi_request; ++ ++ memset(&mpi_request, 0, sizeof(Mpi2SepRequest_t)); ++ mpi_request.Function = MPI2_FUNCTION_SCSI_ENCLOSURE_PROCESSOR; ++ mpi_request.Action = MPI2_SEP_REQ_ACTION_WRITE_STATUS; ++ mpi_request.SlotStatus = ++ cpu_to_le32(MPI2_SEP_REQ_SLOTSTATUS_PREDICTED_FAULT); ++ mpi_request.DevHandle = cpu_to_le16(handle); ++ mpi_request.Flags = MPI2_SEP_REQ_FLAGS_DEVHANDLE_ADDRESS; ++ if ((mpt2sas_base_scsi_enclosure_processor(ioc, &mpi_reply, ++ &mpi_request)) != 0) { ++ printk(MPT2SAS_ERR_FMT "failure at %s:%d/%s()!\n", ioc->name, ++ __FILE__, __LINE__, __func__); ++ return; ++ } ++ ++ if (mpi_reply.IOCStatus || mpi_reply.IOCLogInfo) { ++ dewtprintk(ioc, printk(MPT2SAS_INFO_FMT "enclosure_processor: " ++ "ioc_status (0x%04x), loginfo(0x%08x)\n", ioc->name, ++ le16_to_cpu(mpi_reply.IOCStatus), ++ le32_to_cpu(mpi_reply.IOCLogInfo))); ++ return; ++ } ++} ++ ++/** ++ * _scsih_send_event_to_turn_on_fault_led - fire delayed event ++ * @ioc: per adapter object ++ * @handle: device handle ++ * Context: interrupt. ++ * ++ * Return nothing. ++ */ ++static void ++_scsih_send_event_to_turn_on_fault_led(struct MPT2SAS_ADAPTER *ioc, u16 handle) ++{ ++ struct fw_event_work *fw_event; ++ ++ fw_event = kzalloc(sizeof(struct fw_event_work), GFP_ATOMIC); ++ if (!fw_event) ++ return; ++ fw_event->event = MPT2SAS_TURN_ON_FAULT_LED; ++ fw_event->device_handle = handle; ++ fw_event->ioc = ioc; ++ _scsih_fw_event_add(ioc, fw_event); ++} ++ ++/** ++ * _scsih_smart_predicted_fault - process smart errors ++ * @ioc: per adapter object ++ * @handle: device handle ++ * Context: interrupt. ++ * ++ * Return nothing. ++ */ ++static void ++_scsih_smart_predicted_fault(struct MPT2SAS_ADAPTER *ioc, u16 handle) ++{ + struct scsi_target *starget; + struct MPT2SAS_TARGET *sas_target_priv_data; + Mpi2EventNotificationReply_t *event_reply; +@@ -3745,30 +3806,8 @@ _scsih_smart_predicted_fault(struct MPT2 + starget_printk(KERN_WARNING, starget, "predicted fault\n"); + spin_unlock_irqrestore(&ioc->sas_device_lock, flags); + +- if (ioc->pdev->subsystem_vendor == PCI_VENDOR_ID_IBM) { +- memset(&mpi_request, 0, sizeof(Mpi2SepRequest_t)); +- mpi_request.Function = MPI2_FUNCTION_SCSI_ENCLOSURE_PROCESSOR; +- mpi_request.Action = MPI2_SEP_REQ_ACTION_WRITE_STATUS; +- mpi_request.SlotStatus = +- cpu_to_le32(MPI2_SEP_REQ_SLOTSTATUS_PREDICTED_FAULT); +- mpi_request.DevHandle = cpu_to_le16(handle); +- mpi_request.Flags = MPI2_SEP_REQ_FLAGS_DEVHANDLE_ADDRESS; +- if ((mpt2sas_base_scsi_enclosure_processor(ioc, &mpi_reply, +- &mpi_request)) != 0) { +- printk(MPT2SAS_ERR_FMT "failure at %s:%d/%s()!\n", +- ioc->name, __FILE__, __LINE__, __func__); +- return; +- } +- +- if (mpi_reply.IOCStatus || mpi_reply.IOCLogInfo) { +- dewtprintk(ioc, printk(MPT2SAS_INFO_FMT +- "enclosure_processor: ioc_status (0x%04x), " +- "loginfo(0x%08x)\n", ioc->name, +- le16_to_cpu(mpi_reply.IOCStatus), +- le32_to_cpu(mpi_reply.IOCLogInfo))); +- return; +- } +- } ++ if (ioc->pdev->subsystem_vendor == PCI_VENDOR_ID_IBM) ++ _scsih_send_event_to_turn_on_fault_led(ioc, handle); + + /* insert into event log */ + sz = offsetof(Mpi2EventNotificationReply_t, EventData) + +@@ -6330,6 +6369,9 @@ _firmware_event_work(struct work_struct + } + + switch (fw_event->event) { ++ case MPT2SAS_TURN_ON_FAULT_LED: ++ _scsih_turn_on_fault_led(ioc, fw_event->device_handle); ++ break; + case MPI2_EVENT_SAS_TOPOLOGY_CHANGE_LIST: + _scsih_sas_topology_change_event(ioc, fw_event); + break; diff --git a/queue-2.6.39/oprofile-x86-enable-preemption-during-pci-device-setup-in.patch b/queue-2.6.39/oprofile-x86-enable-preemption-during-pci-device-setup-in.patch new file mode 100644 index 0000000000..3ef17acc7e --- /dev/null +++ b/queue-2.6.39/oprofile-x86-enable-preemption-during-pci-device-setup-in.patch @@ -0,0 +1,205 @@ +From 3d2606f42984613d324ad3047cf503bcddc3880a Mon Sep 17 00:00:00 2001 +From: Robert Richter <robert.richter@amd.com> +Date: Fri, 20 May 2011 09:46:54 +0200 +Subject: oprofile, x86: Enable preemption during pci device setup in + IBS init + +From: Robert Richter <robert.richter@amd.com> + +commit 3d2606f42984613d324ad3047cf503bcddc3880a upstream. + +IBS initialization is a mix of per-core register access and per-node +pci device setup. Register access should be pinned to the cpu, but pci +setup must run with preemption enabled. + +This patch better separates the code into non-/preemptible sections +and fixes sleeping with preemption disabled. See bug message below. + +Fixes also freeing the eilvt entry by introducing put_eilvt(). + +BUG: sleeping function called from invalid context at mm/slub.c:824 +in_atomic(): 1, irqs_disabled(): 0, pid: 32357, name: modprobe +INFO: lockdep is turned off. +Pid: 32357, comm: modprobe Not tainted 2.6.39-rc7+ #14 +Call Trace: + [<ffffffff8104bdc8>] __might_sleep+0x112/0x117 + [<ffffffff81129693>] kmem_cache_alloc_trace+0x4b/0xe7 + [<ffffffff81278f14>] kzalloc.constprop.0+0x29/0x2b + [<ffffffff81278f4c>] pci_get_subsys+0x36/0x78 + [<ffffffff81022689>] ? setup_APIC_eilvt+0xfb/0x139 + [<ffffffff81278fa4>] pci_get_device+0x16/0x18 + [<ffffffffa06c8b5d>] op_amd_init+0xd3/0x211 [oprofile] + [<ffffffffa064d000>] ? 0xffffffffa064cfff + [<ffffffffa064d298>] op_nmi_init+0x21e/0x26a [oprofile] + [<ffffffffa064d062>] oprofile_arch_init+0xe/0x26 [oprofile] + [<ffffffffa064d010>] oprofile_init+0x10/0x42 [oprofile] + [<ffffffff81002099>] do_one_initcall+0x7f/0x13a + [<ffffffff81096524>] sys_init_module+0x132/0x281 + [<ffffffff814cc682>] system_call_fastpath+0x16/0x1b + +Reported-by: Dave Jones <davej@redhat.com> +Signed-off-by: Robert Richter <robert.richter@amd.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + arch/x86/oprofile/op_model_amd.c | 95 ++++++++++++++++++++++----------------- + 1 file changed, 54 insertions(+), 41 deletions(-) + +--- a/arch/x86/oprofile/op_model_amd.c ++++ b/arch/x86/oprofile/op_model_amd.c +@@ -316,16 +316,23 @@ static void op_amd_stop_ibs(void) + wrmsrl(MSR_AMD64_IBSOPCTL, 0); + } + +-static inline int eilvt_is_available(int offset) ++static inline int get_eilvt(int offset) + { +- /* check if we may assign a vector */ + return !setup_APIC_eilvt(offset, 0, APIC_EILVT_MSG_NMI, 1); + } + ++static inline int put_eilvt(int offset) ++{ ++ return !setup_APIC_eilvt(offset, 0, 0, 1); ++} ++ + static inline int ibs_eilvt_valid(void) + { + int offset; + u64 val; ++ int valid = 0; ++ ++ preempt_disable(); + + rdmsrl(MSR_AMD64_IBSCTL, val); + offset = val & IBSCTL_LVT_OFFSET_MASK; +@@ -333,16 +340,20 @@ static inline int ibs_eilvt_valid(void) + if (!(val & IBSCTL_LVT_OFFSET_VALID)) { + pr_err(FW_BUG "cpu %d, invalid IBS interrupt offset %d (MSR%08X=0x%016llx)\n", + smp_processor_id(), offset, MSR_AMD64_IBSCTL, val); +- return 0; ++ goto out; + } + +- if (!eilvt_is_available(offset)) { ++ if (!get_eilvt(offset)) { + pr_err(FW_BUG "cpu %d, IBS interrupt offset %d not available (MSR%08X=0x%016llx)\n", + smp_processor_id(), offset, MSR_AMD64_IBSCTL, val); +- return 0; ++ goto out; + } + +- return 1; ++ valid = 1; ++out: ++ preempt_enable(); ++ ++ return valid; + } + + static inline int get_ibs_offset(void) +@@ -600,67 +611,69 @@ static int setup_ibs_ctl(int ibs_eilvt_o + + static int force_ibs_eilvt_setup(void) + { +- int i; ++ int offset; + int ret; + +- /* find the next free available EILVT entry */ +- for (i = 1; i < 4; i++) { +- if (!eilvt_is_available(i)) +- continue; +- ret = setup_ibs_ctl(i); +- if (ret) +- return ret; +- pr_err(FW_BUG "using offset %d for IBS interrupts\n", i); +- return 0; ++ /* ++ * find the next free available EILVT entry, skip offset 0, ++ * pin search to this cpu ++ */ ++ preempt_disable(); ++ for (offset = 1; offset < APIC_EILVT_NR_MAX; offset++) { ++ if (get_eilvt(offset)) ++ break; + } ++ preempt_enable(); + +- printk(KERN_DEBUG "No EILVT entry available\n"); +- +- return -EBUSY; +-} +- +-static int __init_ibs_nmi(void) +-{ +- int ret; +- +- if (ibs_eilvt_valid()) +- return 0; ++ if (offset == APIC_EILVT_NR_MAX) { ++ printk(KERN_DEBUG "No EILVT entry available\n"); ++ return -EBUSY; ++ } + +- ret = force_ibs_eilvt_setup(); ++ ret = setup_ibs_ctl(offset); + if (ret) +- return ret; ++ goto out; + +- if (!ibs_eilvt_valid()) +- return -EFAULT; ++ if (!ibs_eilvt_valid()) { ++ ret = -EFAULT; ++ goto out; ++ } + ++ pr_err(FW_BUG "using offset %d for IBS interrupts\n", offset); + pr_err(FW_BUG "workaround enabled for IBS LVT offset\n"); + + return 0; ++out: ++ preempt_disable(); ++ put_eilvt(offset); ++ preempt_enable(); ++ return ret; + } + + /* + * check and reserve APIC extended interrupt LVT offset for IBS if + * available +- * +- * init_ibs() preforms implicitly cpu-local operations, so pin this +- * thread to its current CPU + */ + + static void init_ibs(void) + { +- preempt_disable(); +- + ibs_caps = get_ibs_caps(); ++ + if (!ibs_caps) ++ return; ++ ++ if (ibs_eilvt_valid()) + goto out; + +- if (__init_ibs_nmi() < 0) +- ibs_caps = 0; +- else +- printk(KERN_INFO "oprofile: AMD IBS detected (0x%08x)\n", ibs_caps); ++ if (!force_ibs_eilvt_setup()) ++ goto out; ++ ++ /* Failed to setup ibs */ ++ ibs_caps = 0; ++ return; + + out: +- preempt_enable(); ++ printk(KERN_INFO "oprofile: AMD IBS detected (0x%08x)\n", ibs_caps); + } + + static int (*create_arch_files)(struct super_block *sb, struct dentry *root); diff --git a/queue-2.6.39/rcu-fix-unpaired-rcu_irq_enter-from-locking-selftests.patch b/queue-2.6.39/rcu-fix-unpaired-rcu_irq_enter-from-locking-selftests.patch new file mode 100644 index 0000000000..598861eabe --- /dev/null +++ b/queue-2.6.39/rcu-fix-unpaired-rcu_irq_enter-from-locking-selftests.patch @@ -0,0 +1,55 @@ +From ba9f207c9f82115aba4ce04b22e0081af0ae300f Mon Sep 17 00:00:00 2001 +From: Frederic Weisbecker <fweisbec@gmail.com> +Date: Fri, 20 May 2011 02:09:54 +0200 +Subject: rcu: Fix unpaired rcu_irq_enter() from locking selftests + +From: Frederic Weisbecker <fweisbec@gmail.com> + +commit ba9f207c9f82115aba4ce04b22e0081af0ae300f upstream. + +HARDIRQ_ENTER() maps to irq_enter() which calls rcu_irq_enter(). +But HARDIRQ_EXIT() maps to __irq_exit() which doesn't call +rcu_irq_exit(). + +So for every locking selftest that simulates hardirq disabled, +we create an imbalance in the rcu extended quiescent state +internal state. + +As a result, after the first missing rcu_irq_exit(), subsequent +irqs won't exit dyntick-idle mode after leaving the interrupt +handler. This means that RCU won't see the affected CPU as being +in an extended quiescent state, resulting in long grace-period +delays (as in grace periods extending for hours). + +To fix this, just use __irq_enter() to simulate the hardirq +context. This is sufficient for the locking selftests as we +don't need to exit any extended quiescent state or perform +any check that irqs normally do when they wake up from idle. + +As a side effect, this patch makes it possible to restore +"rcu: Decrease memory-barrier usage based on semi-formal proof", +which eventually helped finding this bug. + +Reported-and-tested-by: Yinghai Lu <yinghai@kernel.org> +Signed-off-by: Frederic Weisbecker <fweisbec@gmail.com> +Cc: Paul E. McKenney <paulmck@linux.vnet.ibm.com> +Cc: Ingo Molnar <mingo@elte.hu> +Cc: Peter Zijlstra <a.p.zijlstra@chello.nl> +Signed-off-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + lib/locking-selftest.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/lib/locking-selftest.c ++++ b/lib/locking-selftest.c +@@ -144,7 +144,7 @@ static void init_shared_classes(void) + + #define HARDIRQ_ENTER() \ + local_irq_disable(); \ +- irq_enter(); \ ++ __irq_enter(); \ + WARN_ON(!in_irq()); + + #define HARDIRQ_EXIT() \ diff --git a/queue-2.6.39/seqlock-don-t-smp_rmb-in-seqlock-reader-spin-loop.patch b/queue-2.6.39/seqlock-don-t-smp_rmb-in-seqlock-reader-spin-loop.patch new file mode 100644 index 0000000000..73afc54d54 --- /dev/null +++ b/queue-2.6.39/seqlock-don-t-smp_rmb-in-seqlock-reader-spin-loop.patch @@ -0,0 +1,75 @@ +From 5db1256a5131d3b133946fa02ac9770a784e6eb2 Mon Sep 17 00:00:00 2001 +From: Milton Miller <miltonm@bga.com> +Date: Thu, 12 May 2011 04:13:54 -0500 +Subject: seqlock: Don't smp_rmb in seqlock reader spin loop + +From: Milton Miller <miltonm@bga.com> + +commit 5db1256a5131d3b133946fa02ac9770a784e6eb2 upstream. + +Move the smp_rmb after cpu_relax loop in read_seqlock and add +ACCESS_ONCE to make sure the test and return are consistent. + +A multi-threaded core in the lab didn't like the update +from 2.6.35 to 2.6.36, to the point it would hang during +boot when multiple threads were active. Bisection showed +af5ab277ded04bd9bc6b048c5a2f0e7d70ef0867 (clockevents: +Remove the per cpu tick skew) as the culprit and it is +supported with stack traces showing xtime_lock waits including +tick_do_update_jiffies64 and/or update_vsyscall. + +Experimentation showed the combination of cpu_relax and smp_rmb +was significantly slowing the progress of other threads sharing +the core, and this patch is effective in avoiding the hang. + +A theory is the rmb is affecting the whole core while the +cpu_relax is causing a resource rebalance flush, together they +cause an interfernce cadance that is unbroken when the seqlock +reader has interrupts disabled. + +At first I was confused why the refactor in +3c22cd5709e8143444a6d08682a87f4c57902df3 (kernel: optimise +seqlock) didn't affect this patch application, but after some +study that affected seqcount not seqlock. The new seqcount was +not factored back into the seqlock. I defer that the future. + +While the removal of the timer interrupt offset created +contention for the xtime lock while a cpu does the +additonal work to update the system clock, the seqlock +implementation with the tight rmb spin loop goes back much +further, and is just waiting for the right trigger. + +Signed-off-by: Milton Miller <miltonm@bga.com> +Cc: <linuxppc-dev@lists.ozlabs.org> +Cc: Linus Torvalds <torvalds@linux-foundation.org> +Cc: Andi Kleen <andi@firstfloor.org> +Cc: Nick Piggin <npiggin@kernel.dk> +Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org> +Cc: Anton Blanchard <anton@samba.org> +Cc: Paul McKenney <paulmck@linux.vnet.ibm.com> +Acked-by: Eric Dumazet <eric.dumazet@gmail.com> +Link: http://lkml.kernel.org/r/%3Cseqlock-rmb%40mdm.bga.com%3E +Signed-off-by: Thomas Gleixner <tglx@linutronix.de> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + include/linux/seqlock.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/include/linux/seqlock.h ++++ b/include/linux/seqlock.h +@@ -88,12 +88,12 @@ static __always_inline unsigned read_seq + unsigned ret; + + repeat: +- ret = sl->sequence; +- smp_rmb(); ++ ret = ACCESS_ONCE(sl->sequence); + if (unlikely(ret & 1)) { + cpu_relax(); + goto repeat; + } ++ smp_rmb(); + + return ret; + } diff --git a/queue-2.6.39/series b/queue-2.6.39/series index 57d9fa04d4..68a5444f5a 100644 --- a/queue-2.6.39/series +++ b/queue-2.6.39/series @@ -64,3 +64,43 @@ bonding-prevent-deadlock-on-slave-store-with-alb-mode-v3.patch sch_sfq-avoid-giving-spurious-net_xmit_cn-signals.patch net-fix-__dst_destroy_metrics_generic.patch dst-catch-uninitialized-metrics.patch +mpt2sas-move-even-handling-of.patch +bnx2i-fixed-packet-error-created-when-the-sq_size-is.patch +bnx2i-updated-the-connection-shutdown-cleanup.patch +fix-ultrastor-asm-snippet.patch +target-fix-multi-task-task_sg-chaining-logic-bug.patch +target-fix-interrupt-context-bug-with-stats_lock-and.patch +target-fix-bug-with-task_sg-chained.patch +target-fix-task-task_execute_queue-1-clear-bug.patch +um-use-rwsem_generic_spinlock-on-x86.patch +x86-ioapic-fix-potential-resume-deadlock.patch +x86-amd-do-not-enable-arat-feature-on-amd-processors-below.patch +x86-amd-use-_safe-msr-access-for-garttlbwlk-disable-code.patch +x86-efi-retain-boot-service-code-until-after-switching-to.patch +x86-cpufeature-update-cpu-feature-rdrnd-to-rdrand.patch +oprofile-x86-enable-preemption-during-pci-device-setup-in.patch +rcu-fix-unpaired-rcu_irq_enter-from-locking-selftests.patch +when-mandatory-encryption-on-share-fail-mount.patch +staging-usbip-fix-wrong-endian-conversion.patch +staging-r8712u-fix-driver-to-support-ad-hoc-mode.patch +staging-brcm80211-bugfix-for-div-by-zero-in.patch +fix-for-buffer-overflow-in-ldm_frag_add-not-sufficient.patch +seqlock-don-t-smp_rmb-in-seqlock-reader-spin-loop.patch +md-fix-race-when-creating-a-new-md-device.patch +md-bitmap-fix-saving-of-events_cleared-and-other-state.patch +mm-vmscan-correct-use-of-pgdat_balanced-in.patch +mm-vmscan-correctly-check-if-reclaimer-should-schedule.patch +slub-make-config_debug_page_alloc-work-with-new-fastpath.patch +alsa-hda-use-one-dmic-only-for-dell-studio-1558.patch +alsa-hda-add-quirk-for-lenovo-u350.patch +alsa-hda-fix-input-src-parse-in-patch_analog.c.patch +alsa-hda-use-lpib-for-ati-amd-chipsets-as-default.patch +asoc-ensure-output-pga-is-enabled-for-line-outputs-in.patch +asoc-add-some-missing-volume-update-bit-sets-for-wm_hubs.patch +asoc-fix-raumfeld-platform.patch +hid-magicmouse-ignore-ivalid-report-id-while-switching.patch +mm-page_alloc.c-prevent-unending-loop-in.patch +loop-limit-max_part-module-param-to-disk_max_parts.patch +loop-handle-on-demand-devices-correctly.patch +i2c-tegra-enable-new-slave-mode.patch +i2c-writing-clients-fix-foo_driver.id_table.patch diff --git a/queue-2.6.39/slub-make-config_debug_page_alloc-work-with-new-fastpath.patch b/queue-2.6.39/slub-make-config_debug_page_alloc-work-with-new-fastpath.patch new file mode 100644 index 0000000000..2b648518d0 --- /dev/null +++ b/queue-2.6.39/slub-make-config_debug_page_alloc-work-with-new-fastpath.patch @@ -0,0 +1,54 @@ +From 1393d9a1857471f816d0be1ccc1d6433a86050f6 Mon Sep 17 00:00:00 2001 +From: Christoph Lameter <cl@linux.com> +Date: Mon, 16 May 2011 15:26:08 -0500 +Subject: slub: Make CONFIG_DEBUG_PAGE_ALLOC work with new fastpath + +From: Christoph Lameter <cl@linux.com> + +commit 1393d9a1857471f816d0be1ccc1d6433a86050f6 upstream. + +Fastpath can do a speculative access to a page that CONFIG_DEBUG_PAGE_ALLOC may have +marked as invalid to retrieve the pointer to the next free object. + +Use probe_kernel_read in that case in order not to cause a page fault. + +Reported-by: Eric Dumazet <eric.dumazet@gmail.com> +Signed-off-by: Christoph Lameter <cl@linux.com> +Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> +Signed-off-by: Pekka Enberg <penberg@kernel.org> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + mm/slub.c | 14 +++++++++++++- + 1 file changed, 13 insertions(+), 1 deletion(-) + +--- a/mm/slub.c ++++ b/mm/slub.c +@@ -261,6 +261,18 @@ static inline void *get_freepointer(stru + return *(void **)(object + s->offset); + } + ++static inline void *get_freepointer_safe(struct kmem_cache *s, void *object) ++{ ++ void *p; ++ ++#ifdef CONFIG_DEBUG_PAGEALLOC ++ probe_kernel_read(&p, (void **)(object + s->offset), sizeof(p)); ++#else ++ p = get_freepointer(s, object); ++#endif ++ return p; ++} ++ + static inline void set_freepointer(struct kmem_cache *s, void *object, void *fp) + { + *(void **)(object + s->offset) = fp; +@@ -1943,7 +1955,7 @@ redo: + if (unlikely(!irqsafe_cpu_cmpxchg_double( + s->cpu_slab->freelist, s->cpu_slab->tid, + object, tid, +- get_freepointer(s, object), next_tid(tid)))) { ++ get_freepointer_safe(s, object), next_tid(tid)))) { + + note_cmpxchg_failure("slab_alloc", s, tid); + goto redo; diff --git a/queue-2.6.39/staging-brcm80211-bugfix-for-div-by-zero-in.patch b/queue-2.6.39/staging-brcm80211-bugfix-for-div-by-zero-in.patch new file mode 100644 index 0000000000..827f7d7d55 --- /dev/null +++ b/queue-2.6.39/staging-brcm80211-bugfix-for-div-by-zero-in.patch @@ -0,0 +1,58 @@ +From e9c661e08c2a6015c1b7cba1cecefa27a089df71 Mon Sep 17 00:00:00 2001 +From: Roland Vossen <rvossen@broadcom.com> +Date: Tue, 12 Apr 2011 14:34:41 +0200 +Subject: staging: brcm80211: bugfix for div by zero in + minstrel_ht_tx_status + +From: Roland Vossen <rvossen@broadcom.com> + +commit e9c661e08c2a6015c1b7cba1cecefa27a089df71 upstream. + +Caused by brcmsmac.ko suppling a 0 value to Mac80211. Mac80211 subsequently +divides by this number. Bug only occurred on AMPDU traffic. This is a fix +for https://bugzilla.kernel.org/show_bug.cgi?id=32032, titled +'Divide error in minstrel_ht_tx_status followed by hang', reported by +Wouter Cloetens. + +Signed-off-by: Roland Vossen <rvossen@broadcom.com> +Reviewed-by: Arend van Spriel <arend@broadcom.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/staging/brcm80211/brcmsmac/wlc_ampdu.c | 13 +++---------- + 1 file changed, 3 insertions(+), 10 deletions(-) + +--- a/drivers/staging/brcm80211/brcmsmac/wlc_ampdu.c ++++ b/drivers/staging/brcm80211/brcmsmac/wlc_ampdu.c +@@ -1123,21 +1123,12 @@ wlc_ampdu_dotxstatus_complete(struct amp + ini->txretry[index] = 0; + + /* ampdu_ack_len: number of acked aggregated frames */ +- /* ampdu_ack_map: block ack bit map for the aggregation */ + /* ampdu_len: number of aggregated frames */ + rate_status(wlc, tx_info, txs, mcs); + tx_info->flags |= IEEE80211_TX_STAT_ACK; + tx_info->flags |= IEEE80211_TX_STAT_AMPDU; +- +- /* XXX TODO: Make these accurate. */ + tx_info->status.ampdu_ack_len = +- (txs-> +- status & TX_STATUS_FRM_RTX_MASK) >> +- TX_STATUS_FRM_RTX_SHIFT; +- tx_info->status.ampdu_len = +- (txs-> +- status & TX_STATUS_FRM_RTX_MASK) >> +- TX_STATUS_FRM_RTX_SHIFT; ++ tx_info->status.ampdu_len = 1; + + skb_pull(p, D11_PHY_HDR_LEN); + skb_pull(p, D11_TXH_LEN); +@@ -1163,6 +1154,8 @@ wlc_ampdu_dotxstatus_complete(struct amp + /* Retry timeout */ + ini->tx_in_transit--; + ieee80211_tx_info_clear_status(tx_info); ++ tx_info->status.ampdu_ack_len = 0; ++ tx_info->status.ampdu_len = 1; + tx_info->flags |= + IEEE80211_TX_STAT_AMPDU_NO_BACK; + skb_pull(p, D11_PHY_HDR_LEN); diff --git a/queue-2.6.39/staging-r8712u-fix-driver-to-support-ad-hoc-mode.patch b/queue-2.6.39/staging-r8712u-fix-driver-to-support-ad-hoc-mode.patch new file mode 100644 index 0000000000..91f0377877 --- /dev/null +++ b/queue-2.6.39/staging-r8712u-fix-driver-to-support-ad-hoc-mode.patch @@ -0,0 +1,39 @@ +From 62819fd9481021db7f87d5f61f2e2fd2be1dfcfa Mon Sep 17 00:00:00 2001 +From: Jeff Chua <jeff.chua.linux@gmail.com> +Date: Wed, 27 Apr 2011 11:25:14 -0500 +Subject: staging: r8712u: Fix driver to support ad-hoc mode + +From: Jeff Chua <jeff.chua.linux@gmail.com> + +commit 62819fd9481021db7f87d5f61f2e2fd2be1dfcfa upstream. + +Driver r8712u is unable to handle ad-hoc mode. The issue is that when +the driver first starts, there will not be an SSID for association. +The fix is to always call the "select and join from scan" routine when +in ad-hoc mode. + +Note: Ad-hoc mode worked intermittently before. If the driver had +previously been associated, then things were OK. + +Signed-off-by: Jeff Chua <jeff.chua.linux@gmail.com> +Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/staging/rtl8712/rtl871x_ioctl_set.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/drivers/staging/rtl8712/rtl871x_ioctl_set.c ++++ b/drivers/staging/rtl8712/rtl871x_ioctl_set.c +@@ -68,7 +68,10 @@ static u8 do_join(struct _adapter *padap + pmlmepriv->fw_state |= _FW_UNDER_LINKING; + pmlmepriv->pscanned = plist; + pmlmepriv->to_join = true; +- if (_queue_empty(queue) == true) { ++ ++ /* adhoc mode will start with an empty queue, but skip checking */ ++ if (!check_fwstate(pmlmepriv, WIFI_ADHOC_STATE) && ++ _queue_empty(queue)) { + if (pmlmepriv->fw_state & _FW_UNDER_LINKING) + pmlmepriv->fw_state ^= _FW_UNDER_LINKING; + /* when set_ssid/set_bssid for do_join(), but scanning queue diff --git a/queue-2.6.39/staging-usbip-fix-wrong-endian-conversion.patch b/queue-2.6.39/staging-usbip-fix-wrong-endian-conversion.patch new file mode 100644 index 0000000000..3a0bf4ed42 --- /dev/null +++ b/queue-2.6.39/staging-usbip-fix-wrong-endian-conversion.patch @@ -0,0 +1,31 @@ +From cacd18a8476ce145ca5dcd46dc5b75585fd1289c Mon Sep 17 00:00:00 2001 +From: David Chang <dchang@novell.com> +Date: Thu, 12 May 2011 18:31:11 +0800 +Subject: staging: usbip: fix wrong endian conversion + +From: David Chang <dchang@novell.com> + +commit cacd18a8476ce145ca5dcd46dc5b75585fd1289c upstream. + +Fix number_of_packets wrong endian conversion in function +correct_endian_ret_submit() + +Signed-off-by: David Chang <dchang@novell.com> +Acked-by: Arjan Mels <arjan.mels@gmx.net> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/staging/usbip/usbip_common.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/staging/usbip/usbip_common.c ++++ b/drivers/staging/usbip/usbip_common.c +@@ -604,7 +604,7 @@ static void correct_endian_ret_submit(st + be32_to_cpus(&pdu->status); + be32_to_cpus(&pdu->actual_length); + be32_to_cpus(&pdu->start_frame); +- cpu_to_be32s(&pdu->number_of_packets); ++ be32_to_cpus(&pdu->number_of_packets); + be32_to_cpus(&pdu->error_count); + } + } diff --git a/queue-2.6.39/target-fix-bug-with-task_sg-chained.patch b/queue-2.6.39/target-fix-bug-with-task_sg-chained.patch new file mode 100644 index 0000000000..a3312e6c10 --- /dev/null +++ b/queue-2.6.39/target-fix-bug-with-task_sg-chained.patch @@ -0,0 +1,97 @@ +From f436677262a5b524ac87675014c6d4e8ee153029 Mon Sep 17 00:00:00 2001 +From: Nicholas Bellinger <nab@linux-iscsi.org> +Date: Thu, 19 May 2011 20:19:11 -0700 +Subject: [SCSI] target: Fix bug with task_sg chained + transport_free_dev_tasks release + +From: Nicholas Bellinger <nab@linux-iscsi.org> + +commit f436677262a5b524ac87675014c6d4e8ee153029 upstream. + +This patch addresses a bug in the target core release path for HW +operation where transport_free_dev_tasks() was incorrectly being called +from transport_lun_remove_cmd() while releasing a se_cmd reference and +calling struct target_core_fabric_ops->queue_data_in(). + +This would result in a OOPs with HW target mode when the release of +se_task->task_sg[] would happen before pci_unmap_sg() can be called in +HW target mode fabric module code. This patch addresses the issue by +moving transport_free_dev_tasks() from transport_lun_remove_cmd() into +transport_generic_free_cmd(), and adding TRANSPORT_FREE_CMD_INTR and +transport_generic_free_cmd_intr() to allow se_cmd descriptor release +to happen fromfrom within transport_processing_thread() process context +when release of se_cmd is not possible from HW interrupt context. + +Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org> +Signed-off-by: James Bottomley <jbottomley@parallels.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/target/target_core_transport.c | 13 ++++++++++++- + include/target/target_core_base.h | 1 + + include/target/target_core_transport.h | 1 + + 3 files changed, 14 insertions(+), 1 deletion(-) + +--- a/drivers/target/target_core_transport.c ++++ b/drivers/target/target_core_transport.c +@@ -762,7 +762,6 @@ static void transport_lun_remove_cmd(str + transport_all_task_dev_remove_state(cmd); + spin_unlock_irqrestore(&T_TASK(cmd)->t_state_lock, flags); + +- transport_free_dev_tasks(cmd); + + check_lun: + spin_lock_irqsave(&lun->lun_cmd_lock, flags); +@@ -2058,6 +2057,13 @@ int transport_generic_handle_tmr( + } + EXPORT_SYMBOL(transport_generic_handle_tmr); + ++void transport_generic_free_cmd_intr( ++ struct se_cmd *cmd) ++{ ++ transport_add_cmd_to_queue(cmd, TRANSPORT_FREE_CMD_INTR); ++} ++EXPORT_SYMBOL(transport_generic_free_cmd_intr); ++ + static int transport_stop_tasks_for_cmd(struct se_cmd *cmd) + { + struct se_task *task, *task_tmp; +@@ -5301,6 +5307,8 @@ void transport_generic_free_cmd( + if (wait_for_tasks && cmd->transport_wait_for_tasks) + cmd->transport_wait_for_tasks(cmd, 0, 0); + ++ transport_free_dev_tasks(cmd); ++ + transport_generic_remove(cmd, release_to_pool, + session_reinstatement); + } +@@ -6136,6 +6144,9 @@ get_cmd: + case TRANSPORT_REMOVE: + transport_generic_remove(cmd, 1, 0); + break; ++ case TRANSPORT_FREE_CMD_INTR: ++ transport_generic_free_cmd(cmd, 0, 1, 0); ++ break; + case TRANSPORT_PROCESS_TMR: + transport_generic_do_tmr(cmd); + break; +--- a/include/target/target_core_base.h ++++ b/include/target/target_core_base.h +@@ -98,6 +98,7 @@ enum transport_state_table { + TRANSPORT_REMOVE = 14, + TRANSPORT_FREE = 15, + TRANSPORT_NEW_CMD_MAP = 16, ++ TRANSPORT_FREE_CMD_INTR = 17, + }; + + /* Used for struct se_cmd->se_cmd_flags */ +--- a/include/target/target_core_transport.h ++++ b/include/target/target_core_transport.h +@@ -172,6 +172,7 @@ extern int transport_generic_handle_cdb_ + extern int transport_generic_handle_data(struct se_cmd *); + extern void transport_new_cmd_failure(struct se_cmd *); + extern int transport_generic_handle_tmr(struct se_cmd *); ++extern void transport_generic_free_cmd_intr(struct se_cmd *); + extern void __transport_stop_task_timer(struct se_task *, unsigned long *); + extern unsigned char transport_asciihex_to_binaryhex(unsigned char val[2]); + extern int transport_generic_map_mem_to_cmd(struct se_cmd *cmd, struct scatterlist *, u32, diff --git a/queue-2.6.39/target-fix-interrupt-context-bug-with-stats_lock-and.patch b/queue-2.6.39/target-fix-interrupt-context-bug-with-stats_lock-and.patch new file mode 100644 index 0000000000..a16b3d34da --- /dev/null +++ b/queue-2.6.39/target-fix-interrupt-context-bug-with-stats_lock-and.patch @@ -0,0 +1,71 @@ +From 53ab6709b4d35b1924240854d794482fd7d33d4a Mon Sep 17 00:00:00 2001 +From: Nicholas Bellinger <nab@linux-iscsi.org> +Date: Thu, 19 May 2011 20:19:10 -0700 +Subject: [SCSI] target: Fix interrupt context bug with stats_lock and + core_tmr_alloc_req + +From: Nicholas Bellinger <nab@linux-iscsi.org> + +commit 53ab6709b4d35b1924240854d794482fd7d33d4a upstream. + +This patch fixes two bugs wrt to the interrupt context usage of target +core with HW target mode drivers. It first converts the usage of struct +se_device->stats_lock in transport_get_lun_for_cmd() and core_tmr_lun_reset() +to properly use spin_lock_irq() to address an BUG with CONFIG_LOCKDEP_SUPPORT=y +enabled. + +This patch also adds a 'in_interrupt()' check to allow GFP_ATOMIC usage from +core_tmr_alloc_req() to fix a 'sleeping in interrupt context' BUG with HW +target fabrics that require this logic to function. + +Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org> +Signed-off-by: James Bottomley <jbottomley@parallels.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/target/target_core_device.c | 4 ++-- + drivers/target/target_core_tmr.c | 7 ++++--- + 2 files changed, 6 insertions(+), 5 deletions(-) + +--- a/drivers/target/target_core_device.c ++++ b/drivers/target/target_core_device.c +@@ -150,13 +150,13 @@ out: + + { + struct se_device *dev = se_lun->lun_se_dev; +- spin_lock(&dev->stats_lock); ++ spin_lock_irq(&dev->stats_lock); + dev->num_cmds++; + if (se_cmd->data_direction == DMA_TO_DEVICE) + dev->write_bytes += se_cmd->data_length; + else if (se_cmd->data_direction == DMA_FROM_DEVICE) + dev->read_bytes += se_cmd->data_length; +- spin_unlock(&dev->stats_lock); ++ spin_unlock_irq(&dev->stats_lock); + } + + /* +--- a/drivers/target/target_core_tmr.c ++++ b/drivers/target/target_core_tmr.c +@@ -55,7 +55,8 @@ struct se_tmr_req *core_tmr_alloc_req( + { + struct se_tmr_req *tmr; + +- tmr = kmem_cache_zalloc(se_tmr_req_cache, GFP_KERNEL); ++ tmr = kmem_cache_zalloc(se_tmr_req_cache, (in_interrupt()) ? ++ GFP_ATOMIC : GFP_KERNEL); + if (!(tmr)) { + printk(KERN_ERR "Unable to allocate struct se_tmr_req\n"); + return ERR_PTR(-ENOMEM); +@@ -398,9 +399,9 @@ int core_tmr_lun_reset( + printk(KERN_INFO "LUN_RESET: SCSI-2 Released reservation\n"); + } + +- spin_lock(&dev->stats_lock); ++ spin_lock_irq(&dev->stats_lock); + dev->num_resets++; +- spin_unlock(&dev->stats_lock); ++ spin_unlock_irq(&dev->stats_lock); + + DEBUG_LR("LUN_RESET: %s for [%s] Complete\n", + (preempt_and_abort_list) ? "Preempt" : "TMR", diff --git a/queue-2.6.39/target-fix-multi-task-task_sg-chaining-logic-bug.patch b/queue-2.6.39/target-fix-multi-task-task_sg-chaining-logic-bug.patch new file mode 100644 index 0000000000..3e9369d17e --- /dev/null +++ b/queue-2.6.39/target-fix-multi-task-task_sg-chaining-logic-bug.patch @@ -0,0 +1,98 @@ +From 97868c8905a1537153d406c4a3aa39a503a5c299 Mon Sep 17 00:00:00 2001 +From: Nicholas Bellinger <nab@linux-iscsi.org> +Date: Thu, 19 May 2011 20:19:09 -0700 +Subject: [SCSI] target: Fix multi task->task_sg[] chaining logic bug + +From: Nicholas Bellinger <nab@linux-iscsi.org> + +commit 97868c8905a1537153d406c4a3aa39a503a5c299 upstream. + +This patch fixes a bug in transport_do_task_sg_chain() used by HW target +mode modules with sg_chain() to provide a single sg_next() walkable memory +layout for use with pci_map_sg() and friends. This patch addresses an +issue with mapping multiple small block max_sector tasks across multiple +struct se_task->task_sg[] mappings for HW target mode operation. + +This was causing OOPs with (cmd->t_task->t_tasks_no > 1) I/O traffic for +HW target drivers using transport_do_task_sg_chain(), and has been tested +so far with tcm_fc(openfcoe), tcm_qla2xxx, and ib_srpt fabrics with +t_tasks_no > 1 IBLOCK backends using a smaller max_sectors to trigger the +original issue. + +Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org> +Acked-by: Kiran Patil <kiran.patil@intel.com> +Signed-off-by: James Bottomley <jbottomley@parallels.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/target/target_core_transport.c | 26 +++++++++++++++----------- + 1 file changed, 15 insertions(+), 11 deletions(-) + +--- a/drivers/target/target_core_transport.c ++++ b/drivers/target/target_core_transport.c +@@ -4776,18 +4776,20 @@ void transport_do_task_sg_chain(struct s + sg_end_cur->page_link &= ~0x02; + + sg_chain(sg_head, task_sg_num, sg_head_cur); +- sg_count += (task->task_sg_num + 1); +- } else + sg_count += task->task_sg_num; ++ task_sg_num = (task->task_sg_num + 1); ++ } else { ++ sg_chain(sg_head, task_sg_num, sg_head_cur); ++ sg_count += task->task_sg_num; ++ task_sg_num = task->task_sg_num; ++ } + + sg_head = sg_head_cur; + sg_link = sg_link_cur; +- task_sg_num = task->task_sg_num; + continue; + } + sg_head = sg_first = &task->task_sg[0]; + sg_link = &task->task_sg[task->task_sg_num]; +- task_sg_num = task->task_sg_num; + /* + * Check for single task.. + */ +@@ -4798,9 +4800,12 @@ void transport_do_task_sg_chain(struct s + */ + sg_end = &task->task_sg[task->task_sg_num - 1]; + sg_end->page_link &= ~0x02; +- sg_count += (task->task_sg_num + 1); +- } else + sg_count += task->task_sg_num; ++ task_sg_num = (task->task_sg_num + 1); ++ } else { ++ sg_count += task->task_sg_num; ++ task_sg_num = task->task_sg_num; ++ } + } + /* + * Setup the starting pointer and total t_tasks_sg_linked_no including +@@ -4809,21 +4814,20 @@ void transport_do_task_sg_chain(struct s + T_TASK(cmd)->t_tasks_sg_chained = sg_first; + T_TASK(cmd)->t_tasks_sg_chained_no = sg_count; + +- DEBUG_CMD_M("Setup T_TASK(cmd)->t_tasks_sg_chained: %p and" +- " t_tasks_sg_chained_no: %u\n", T_TASK(cmd)->t_tasks_sg_chained, ++ DEBUG_CMD_M("Setup cmd: %p T_TASK(cmd)->t_tasks_sg_chained: %p and" ++ " t_tasks_sg_chained_no: %u\n", cmd, T_TASK(cmd)->t_tasks_sg_chained, + T_TASK(cmd)->t_tasks_sg_chained_no); + + for_each_sg(T_TASK(cmd)->t_tasks_sg_chained, sg, + T_TASK(cmd)->t_tasks_sg_chained_no, i) { + +- DEBUG_CMD_M("SG: %p page: %p length: %d offset: %d\n", +- sg, sg_page(sg), sg->length, sg->offset); ++ DEBUG_CMD_M("SG[%d]: %p page: %p length: %d offset: %d, magic: 0x%08x\n", ++ i, sg, sg_page(sg), sg->length, sg->offset, sg->sg_magic); + if (sg_is_chain(sg)) + DEBUG_CMD_M("SG: %p sg_is_chain=1\n", sg); + if (sg_is_last(sg)) + DEBUG_CMD_M("SG: %p sg_is_last=1\n", sg); + } +- + } + EXPORT_SYMBOL(transport_do_task_sg_chain); + diff --git a/queue-2.6.39/target-fix-task-task_execute_queue-1-clear-bug.patch b/queue-2.6.39/target-fix-task-task_execute_queue-1-clear-bug.patch new file mode 100644 index 0000000000..aae0c7d480 --- /dev/null +++ b/queue-2.6.39/target-fix-task-task_execute_queue-1-clear-bug.patch @@ -0,0 +1,57 @@ +From af57c3ac9947990da2608561b71f4799eb7795c6 Mon Sep 17 00:00:00 2001 +From: Nicholas Bellinger <nab@linux-iscsi.org> +Date: Thu, 19 May 2011 20:19:12 -0700 +Subject: [SCSI] target: Fix task->task_execute_queue=1 clear bug + + LUN_RESET OOPs + +From: Nicholas Bellinger <nab@linux-iscsi.org> + +commit af57c3ac9947990da2608561b71f4799eb7795c6 upstream. + +This patch fixes a bug where task->task_execute_queue=1 was not being +cleared once se_task had been removed from se_device->execute_task_list, +resulting in an OOPs in core_tmr_lun_reset() for the task->task_active=0 +case where transport_remove_task_from_execute_queue() was incorrectly +being called. + +This patch fixes two cases in transport_get_task_from_execute_queue() +and transport_remove_task_from_execute_queue() to properly clear +task->task_execute_queue=0 once list_del(&task->t_execute_list) has +been called. + +It also adds an explict check in transport_remove_task_from_execute_queue() +to dump_stack + return if called with task->task_execute_queue=0. + +Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org> +Signed-off-by: James Bottomley <jbottomley@parallels.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/target/target_core_transport.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/target/target_core_transport.c ++++ b/drivers/target/target_core_transport.c +@@ -1194,6 +1194,7 @@ transport_get_task_from_execute_queue(st + break; + + list_del(&task->t_execute_list); ++ atomic_set(&task->task_execute_queue, 0); + atomic_dec(&dev->execute_tasks); + + return task; +@@ -1209,8 +1210,14 @@ void transport_remove_task_from_execute_ + { + unsigned long flags; + ++ if (atomic_read(&task->task_execute_queue) == 0) { ++ dump_stack(); ++ return; ++ } ++ + spin_lock_irqsave(&dev->execute_task_lock, flags); + list_del(&task->t_execute_list); ++ atomic_set(&task->task_execute_queue, 0); + atomic_dec(&dev->execute_tasks); + spin_unlock_irqrestore(&dev->execute_task_lock, flags); + } diff --git a/queue-2.6.39/um-use-rwsem_generic_spinlock-on-x86.patch b/queue-2.6.39/um-use-rwsem_generic_spinlock-on-x86.patch new file mode 100644 index 0000000000..aa2a6b46d2 --- /dev/null +++ b/queue-2.6.39/um-use-rwsem_generic_spinlock-on-x86.patch @@ -0,0 +1,47 @@ +From 3a3679078aed2c451ebc32836bbd3b8219a65e01 Mon Sep 17 00:00:00 2001 +From: Richard Weinberger <richard@nod.at> +Date: Mon, 23 May 2011 22:51:33 +0200 +Subject: um: Use RWSEM_GENERIC_SPINLOCK on x86 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Richard Weinberger <richard@nod.at> + +commit 3a3679078aed2c451ebc32836bbd3b8219a65e01 upstream. + +Commit d12337 (rwsem: Remove redundant asmregparm annotation) +broke rwsem on UML. + +As we cannot compile UML with -mregparm=3 and keeping asmregparm only +for UML is inadequate the easiest solution is using RWSEM_GENERIC_SPINLOCK. + +Thanks to Thomas Gleixner for the idea. + +Reported-by: Toralf Förster <toralf.foerster@gmx.de> +Tested-by: Toralf Förster <toralf.foerster@gmx.de> +Signed-off-by: Richard Weinberger <richard@nod.at> +Cc: user-mode-linux-devel@lists.sourceforge.net +Link: http://lkml.kernel.org/r/%3C1306183893-26655-1-git-send-email-richard%40nod.at%3E +Signed-off-by: Thomas Gleixner <tglx@linutronix.de> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + arch/um/Kconfig.x86 | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/um/Kconfig.x86 ++++ b/arch/um/Kconfig.x86 +@@ -29,10 +29,10 @@ config X86_64 + def_bool 64BIT + + config RWSEM_XCHGADD_ALGORITHM +- def_bool X86_XADD ++ def_bool X86_XADD && 64BIT + + config RWSEM_GENERIC_SPINLOCK +- def_bool !X86_XADD ++ def_bool !RWSEM_XCHGADD_ALGORITHM + + config 3_LEVEL_PGTABLES + bool "Three-level pagetables (EXPERIMENTAL)" if !64BIT diff --git a/queue-2.6.39/when-mandatory-encryption-on-share-fail-mount.patch b/queue-2.6.39/when-mandatory-encryption-on-share-fail-mount.patch new file mode 100644 index 0000000000..e38489097f --- /dev/null +++ b/queue-2.6.39/when-mandatory-encryption-on-share-fail-mount.patch @@ -0,0 +1,97 @@ +From 6848b7334b24b47aa3d0e70342ff839ffa95d5fa Mon Sep 17 00:00:00 2001 +From: Steve French <sfrench@us.ibm.com> +Date: Thu, 26 May 2011 18:38:54 +0000 +Subject: [CIFS] When mandatory encryption on share, fail mount + +From: Steve French <sfrench@us.ibm.com> + +commit 6848b7334b24b47aa3d0e70342ff839ffa95d5fa upstream. + + When mandatory encryption is configured in samba server on a + share (smb.conf parameter "smb encrypt = mandatory") the + server will hang up the tcp session when we try to send + the first frame after the tree connect if it is not a + QueryFSUnixInfo, this causes cifs mount to hang (it must + be killed with ctl-c). Move the QueryFSUnixInfo call + earlier in the mount sequence, and check whether the SetFSUnixInfo + fails due to mandatory encryption so we can return a sensible + error (EACCES) on mount. + + In a future patch (for 2.6.40) we will support mandatory + encryption. + +Reviewed-by: Pavel Shilovsky <piastry@etersoft.ru> +Signed-off-by: Steve French <sfrench@us.ibm.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + fs/cifs/connect.c | 31 ++++++++++++++++++++++--------- + 1 file changed, 22 insertions(+), 9 deletions(-) + +--- a/fs/cifs/connect.c ++++ b/fs/cifs/connect.c +@@ -2447,7 +2447,7 @@ void reset_cifs_unix_caps(int xid, struc + + if (!CIFSSMBQFSUnixInfo(xid, tcon)) { + __u64 cap = le64_to_cpu(tcon->fsUnixInfo.Capability); +- ++ cFYI(1, "unix caps which server supports %lld", cap); + /* check for reconnect case in which we do not + want to change the mount behavior if we can avoid it */ + if (vol_info == NULL) { +@@ -2465,6 +2465,9 @@ void reset_cifs_unix_caps(int xid, struc + } + } + ++ if (cap & CIFS_UNIX_TRANSPORT_ENCRYPTION_MANDATORY_CAP) ++ cERROR(1, "per-share encryption not supported yet"); ++ + cap &= CIFS_UNIX_CAP_MASK; + if (vol_info && vol_info->no_psx_acl) + cap &= ~CIFS_UNIX_POSIX_ACL_CAP; +@@ -2513,6 +2516,10 @@ void reset_cifs_unix_caps(int xid, struc + cFYI(1, "very large read cap"); + if (cap & CIFS_UNIX_LARGE_WRITE_CAP) + cFYI(1, "very large write cap"); ++ if (cap & CIFS_UNIX_TRANSPORT_ENCRYPTION_CAP) ++ cFYI(1, "transport encryption cap"); ++ if (cap & CIFS_UNIX_TRANSPORT_ENCRYPTION_MANDATORY_CAP) ++ cFYI(1, "mandatory transport encryption cap"); + #endif /* CIFS_DEBUG2 */ + if (CIFSSMBSetFSUnixInfo(xid, tcon, cap)) { + if (vol_info == NULL) { +@@ -2831,20 +2838,26 @@ try_mount_again: + goto remote_path_check; + } + +- /* do not care if following two calls succeed - informational */ +- if (!tcon->ipc) { +- CIFSSMBQFSDeviceInfo(xid, tcon); +- CIFSSMBQFSAttributeInfo(xid, tcon); +- } +- + /* tell server which Unix caps we support */ +- if (tcon->ses->capabilities & CAP_UNIX) ++ if (tcon->ses->capabilities & CAP_UNIX) { + /* reset of caps checks mount to see if unix extensions + disabled for just this mount */ + reset_cifs_unix_caps(xid, tcon, sb, volume_info); +- else ++ if ((tcon->ses->server->tcpStatus == CifsNeedReconnect) && ++ (le64_to_cpu(tcon->fsUnixInfo.Capability) & ++ CIFS_UNIX_TRANSPORT_ENCRYPTION_MANDATORY_CAP)) { ++ rc = -EACCES; ++ goto mount_fail_check; ++ } ++ } else + tcon->unix_ext = 0; /* server does not support them */ + ++ /* do not care if following two calls succeed - informational */ ++ if (!tcon->ipc) { ++ CIFSSMBQFSDeviceInfo(xid, tcon); ++ CIFSSMBQFSAttributeInfo(xid, tcon); ++ } ++ + /* convert forward to back slashes in prepath here if needed */ + if ((cifs_sb->mnt_cifs_flags & CIFS_MOUNT_POSIX_PATHS) == 0) + convert_delimiter(cifs_sb->prepath, CIFS_DIR_SEP(cifs_sb)); diff --git a/queue-2.6.39/x86-amd-do-not-enable-arat-feature-on-amd-processors-below.patch b/queue-2.6.39/x86-amd-do-not-enable-arat-feature-on-amd-processors-below.patch new file mode 100644 index 0000000000..3fe5bda59a --- /dev/null +++ b/queue-2.6.39/x86-amd-do-not-enable-arat-feature-on-amd-processors-below.patch @@ -0,0 +1,51 @@ +From e9cdd343a5e42c43bcda01e609fa23089e026470 Mon Sep 17 00:00:00 2001 +From: Boris Ostrovsky <ostr@amd64.org> +Date: Thu, 26 May 2011 11:19:52 -0400 +Subject: x86, amd: Do not enable ARAT feature on AMD processors below + family 0x12 + +From: Boris Ostrovsky <ostr@amd64.org> + +commit e9cdd343a5e42c43bcda01e609fa23089e026470 upstream. + +Commit b87cf80af3ba4b4c008b4face3c68d604e1715c6 added support for +ARAT (Always Running APIC timer) on AMD processors that are not +affected by erratum 400. This erratum is present on certain processor +families and prevents APIC timer from waking up the CPU when it +is in a deep C state, including C1E state. + +Determining whether a processor is affected by this erratum may +have some corner cases and handling these cases is somewhat +complicated. In the interest of simplicity we won't claim ARAT +support on processor families below 0x12 and will go back to +broadcasting timer when going idle. + +Signed-off-by: Boris Ostrovsky <ostr@amd64.org> +Link: http://lkml.kernel.org/r/1306423192-19774-1-git-send-email-ostr@amd64.org +Tested-by: Boris Petkov <borislav.petkov@amd.com> +Cc: Hans Rosenfeld <Hans.Rosenfeld@amd.com> +Cc: Andreas Herrmann <Andreas.Herrmann3@amd.com> +Cc: Chuck Ebbert <cebbert@redhat.com> +Signed-off-by: H. Peter Anvin <hpa@linux.intel.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + arch/x86/kernel/cpu/amd.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/arch/x86/kernel/cpu/amd.c ++++ b/arch/x86/kernel/cpu/amd.c +@@ -612,8 +612,11 @@ static void __cpuinit init_amd(struct cp + } + #endif + +- /* As a rule processors have APIC timer running in deep C states */ +- if (c->x86 > 0xf && !cpu_has_amd_erratum(amd_erratum_400)) ++ /* ++ * Family 0x12 and above processors have APIC timer ++ * running in deep C states. ++ */ ++ if (c->x86 > 0x11) + set_cpu_cap(c, X86_FEATURE_ARAT); + + /* diff --git a/queue-2.6.39/x86-amd-use-_safe-msr-access-for-garttlbwlk-disable-code.patch b/queue-2.6.39/x86-amd-use-_safe-msr-access-for-garttlbwlk-disable-code.patch new file mode 100644 index 0000000000..75dd5ff5b9 --- /dev/null +++ b/queue-2.6.39/x86-amd-use-_safe-msr-access-for-garttlbwlk-disable-code.patch @@ -0,0 +1,62 @@ +From d47cc0db8fd6011de2248df505fc34990b7451bf Mon Sep 17 00:00:00 2001 +From: "Roedel, Joerg" <Joerg.Roedel@amd.com> +Date: Thu, 19 May 2011 11:13:39 +0200 +Subject: x86, amd: Use _safe() msr access for GartTlbWlk disable code +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: "Roedel, Joerg" <Joerg.Roedel@amd.com> + +commit d47cc0db8fd6011de2248df505fc34990b7451bf upstream. + +The workaround for Bugzilla: + + https://bugzilla.kernel.org/show_bug.cgi?id=33012 + +introduced a read and a write to the MC4 mask msr. + +Unfortunatly this MSR is not emulated by the KVM hypervisor +so that the kernel will get a #GP and crashes when applying +this workaround when running inside KVM. + +This issue was reported as: + + https://bugzilla.kernel.org/show_bug.cgi?id=35132 + +and is fixed with this patch. The change just let the kernel +ignore any #GP it gets while accessing this MSR by using the +_safe msr access methods. + +Reported-by: Török Edwin <edwintorok@gmail.com> +Signed-off-by: Joerg Roedel <joerg.roedel@amd.com> +Cc: Rafael J. Wysocki <rjw@sisk.pl> +Cc: Maciej Rutecki <maciej.rutecki@gmail.com> +Cc: Avi Kivity <avi@redhat.com> +Cc: Andrew Morton <akpm@linux-foundation.org> +Signed-off-by: Ingo Molnar <mingo@elte.hu> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + arch/x86/kernel/cpu/amd.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +--- a/arch/x86/kernel/cpu/amd.c ++++ b/arch/x86/kernel/cpu/amd.c +@@ -632,10 +632,13 @@ static void __cpuinit init_amd(struct cp + * Fixes: https://bugzilla.kernel.org/show_bug.cgi?id=33012 + */ + u64 mask; ++ int err; + +- rdmsrl(MSR_AMD64_MCx_MASK(4), mask); +- mask |= (1 << 10); +- wrmsrl(MSR_AMD64_MCx_MASK(4), mask); ++ err = rdmsrl_safe(MSR_AMD64_MCx_MASK(4), &mask); ++ if (err == 0) { ++ mask |= (1 << 10); ++ checking_wrmsrl(MSR_AMD64_MCx_MASK(4), mask); ++ } + } + } + diff --git a/queue-2.6.39/x86-cpufeature-update-cpu-feature-rdrnd-to-rdrand.patch b/queue-2.6.39/x86-cpufeature-update-cpu-feature-rdrnd-to-rdrand.patch new file mode 100644 index 0000000000..0f86ec7581 --- /dev/null +++ b/queue-2.6.39/x86-cpufeature-update-cpu-feature-rdrnd-to-rdrand.patch @@ -0,0 +1,38 @@ +From 7ccafc5f75c87853f3c49845d5a884f2376e03ce Mon Sep 17 00:00:00 2001 +From: Kees Cook <kees.cook@canonical.com> +Date: Tue, 24 May 2011 16:29:26 -0700 +Subject: x86, cpufeature: Update CPU feature RDRND to RDRAND + +From: Kees Cook <kees.cook@canonical.com> + +commit 7ccafc5f75c87853f3c49845d5a884f2376e03ce upstream. + +The Intel manual changed the name of the CPUID bit to match the +instruction name. We should follow suit for sanity's sake. (See Intel SDM +Volume 2, Table 3-20 "Feature Information Returned in the ECX Register".) + +[ hpa: we can only do this at this time because there are currently no CPUs + with this feature on the market, hence this is pre-hardware enabling. + However, Cc:'ing stable so that stable can present a consistent ABI. ] + +Signed-off-by: Kees Cook <kees.cook@canonical.com> +Link: http://lkml.kernel.org/r/20110524232926.GA27728@outflux.net +Signed-off-by: H. Peter Anvin <hpa@linux.intel.com> +Cc: Fenghua Yu <fenghua.yu@intel.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + arch/x86/include/asm/cpufeature.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/x86/include/asm/cpufeature.h ++++ b/arch/x86/include/asm/cpufeature.h +@@ -125,7 +125,7 @@ + #define X86_FEATURE_OSXSAVE (4*32+27) /* "" XSAVE enabled in the OS */ + #define X86_FEATURE_AVX (4*32+28) /* Advanced Vector Extensions */ + #define X86_FEATURE_F16C (4*32+29) /* 16-bit fp conversions */ +-#define X86_FEATURE_RDRND (4*32+30) /* The RDRAND instruction */ ++#define X86_FEATURE_RDRAND (4*32+30) /* The RDRAND instruction */ + #define X86_FEATURE_HYPERVISOR (4*32+31) /* Running on a hypervisor */ + + /* VIA/Cyrix/Centaur-defined CPU features, CPUID level 0xC0000001, word 5 */ diff --git a/queue-2.6.39/x86-efi-retain-boot-service-code-until-after-switching-to.patch b/queue-2.6.39/x86-efi-retain-boot-service-code-until-after-switching-to.patch new file mode 100644 index 0000000000..859b917bb7 --- /dev/null +++ b/queue-2.6.39/x86-efi-retain-boot-service-code-until-after-switching-to.patch @@ -0,0 +1,164 @@ +From 916f676f8dc016103f983c7ec54c18ecdbb6e349 Mon Sep 17 00:00:00 2001 +From: Matthew Garrett <mjg@redhat.com> +Date: Wed, 25 May 2011 09:53:13 -0400 +Subject: x86, efi: Retain boot service code until after switching to + virtual mode + +From: Matthew Garrett <mjg@redhat.com> + +commit 916f676f8dc016103f983c7ec54c18ecdbb6e349 upstream. + +UEFI stands for "Unified Extensible Firmware Interface", where "Firmware" +is an ancient African word meaning "Why do something right when you can +do it so wrong that children will weep and brave adults will cower before +you", and "UEI" is Celtic for "We missed DOS so we burned it into your +ROMs". The UEFI specification provides for runtime services (ie, another +way for the operating system to be forced to depend on the firmware) and +we rely on these for certain trivial tasks such as setting up the +bootloader. But some hardware fails to work if we attempt to use these +runtime services from physical mode, and so we have to switch into virtual +mode. So far so dreadful. + +The specification makes it clear that the operating system is free to do +whatever it wants with boot services code after ExitBootServices() has been +called. SetVirtualAddressMap() can't be called until ExitBootServices() has +been. So, obviously, a whole bunch of EFI implementations call into boot +services code when we do that. Since we've been charmingly naive and +trusted that the specification may be somehow relevant to the real world, +we've already stuffed a picture of a penguin or something in that address +space. And just to make things more entertaining, we've also marked it +non-executable. + +This patch allocates the boot services regions during EFI init and makes +sure that they're executable. Then, after SetVirtualAddressMap(), it +discards them and everyone lives happily ever after. Except for the ones +who have to work on EFI, who live sad lives haunted by the knowledge that +someone's eventually going to write yet another firmware specification. + +[ hpa: adding this to urgent with a stable tag since it fixes currently-broken + hardware. However, I do not know what the dependencies are and so I do + not know which -stable versions this may be a candidate for. ] + +Signed-off-by: Matthew Garrett <mjg@redhat.com> +Link: http://lkml.kernel.org/r/1306331593-28715-1-git-send-email-mjg@redhat.com +Signed-off-by: H. Peter Anvin <hpa@linux.intel.com> +Cc: Tony Luck <tony.luck@intel.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + arch/x86/kernel/setup.c | 7 ++++++ + arch/x86/platform/efi/efi.c | 45 ++++++++++++++++++++++++++++++++++++++++- + arch/x86/platform/efi/efi_64.c | 5 ++-- + include/linux/efi.h | 1 + 4 files changed, 55 insertions(+), 3 deletions(-) + +--- a/arch/x86/kernel/setup.c ++++ b/arch/x86/kernel/setup.c +@@ -912,6 +912,13 @@ void __init setup_arch(char **cmdline_p) + memblock.current_limit = get_max_mapped(); + memblock_x86_fill(); + ++ /* ++ * The EFI specification says that boot service code won't be called ++ * after ExitBootServices(). This is, in fact, a lie. ++ */ ++ if (efi_enabled) ++ efi_reserve_boot_services(); ++ + /* preallocate 4k for mptable mpc */ + early_reserve_e820_mpc_new(); + +--- a/arch/x86/platform/efi/efi.c ++++ b/arch/x86/platform/efi/efi.c +@@ -315,6 +315,40 @@ static void __init print_efi_memmap(void + } + #endif /* EFI_DEBUG */ + ++void __init efi_reserve_boot_services(void) ++{ ++ void *p; ++ ++ for (p = memmap.map; p < memmap.map_end; p += memmap.desc_size) { ++ efi_memory_desc_t *md = p; ++ unsigned long long start = md->phys_addr; ++ unsigned long long size = md->num_pages << EFI_PAGE_SHIFT; ++ ++ if (md->type != EFI_BOOT_SERVICES_CODE && ++ md->type != EFI_BOOT_SERVICES_DATA) ++ continue; ++ ++ memblock_x86_reserve_range(start, start + size, "EFI Boot"); ++ } ++} ++ ++static void __init efi_free_boot_services(void) ++{ ++ void *p; ++ ++ for (p = memmap.map; p < memmap.map_end; p += memmap.desc_size) { ++ efi_memory_desc_t *md = p; ++ unsigned long long start = md->phys_addr; ++ unsigned long long size = md->num_pages << EFI_PAGE_SHIFT; ++ ++ if (md->type != EFI_BOOT_SERVICES_CODE && ++ md->type != EFI_BOOT_SERVICES_DATA) ++ continue; ++ ++ free_bootmem_late(start, size); ++ } ++} ++ + void __init efi_init(void) + { + efi_config_table_t *config_tables; +@@ -507,7 +541,9 @@ void __init efi_enter_virtual_mode(void) + efi.systab = NULL; + for (p = memmap.map; p < memmap.map_end; p += memmap.desc_size) { + md = p; +- if (!(md->attribute & EFI_MEMORY_RUNTIME)) ++ if (!(md->attribute & EFI_MEMORY_RUNTIME) && ++ md->type != EFI_BOOT_SERVICES_CODE && ++ md->type != EFI_BOOT_SERVICES_DATA) + continue; + + size = md->num_pages << EFI_PAGE_SHIFT; +@@ -558,6 +594,13 @@ void __init efi_enter_virtual_mode(void) + } + + /* ++ * Thankfully, it does seem that no runtime services other than ++ * SetVirtualAddressMap() will touch boot services code, so we can ++ * get rid of it all at this point ++ */ ++ efi_free_boot_services(); ++ ++ /* + * Now that EFI is in virtual mode, update the function + * pointers in the runtime service table to the new virtual addresses. + * +--- a/arch/x86/platform/efi/efi_64.c ++++ b/arch/x86/platform/efi/efi_64.c +@@ -64,10 +64,11 @@ static void __init early_runtime_code_ma + if (!(__supported_pte_mask & _PAGE_NX)) + return; + +- /* Make EFI runtime service code area executable */ ++ /* Make EFI service code area executable */ + for (p = memmap.map; p < memmap.map_end; p += memmap.desc_size) { + md = p; +- if (md->type == EFI_RUNTIME_SERVICES_CODE) { ++ if (md->type == EFI_RUNTIME_SERVICES_CODE || ++ md->type == EFI_BOOT_SERVICES_CODE) + unsigned long end; + end = md->phys_addr + (md->num_pages << EFI_PAGE_SHIFT); + early_mapping_set_exec(md->phys_addr, end, executable); +--- a/include/linux/efi.h ++++ b/include/linux/efi.h +@@ -299,6 +299,7 @@ extern void efi_initialize_iomem_resourc + struct resource *data_resource, struct resource *bss_resource); + extern unsigned long efi_get_time(void); + extern int efi_set_rtc_mmss(unsigned long nowtime); ++extern void efi_reserve_boot_services(void); + extern struct efi_memory_map memmap; + + /** diff --git a/queue-2.6.39/x86-ioapic-fix-potential-resume-deadlock.patch b/queue-2.6.39/x86-ioapic-fix-potential-resume-deadlock.patch new file mode 100644 index 0000000000..94288a4fc3 --- /dev/null +++ b/queue-2.6.39/x86-ioapic-fix-potential-resume-deadlock.patch @@ -0,0 +1,48 @@ +From b64ce24daffb634b5b3133a2e411bd4de50654e8 Mon Sep 17 00:00:00 2001 +From: Daniel J Blueman <daniel.blueman@gmail.com> +Date: Wed, 18 May 2011 16:31:31 -0700 +Subject: x86, ioapic: Fix potential resume deadlock + +From: Daniel J Blueman <daniel.blueman@gmail.com> + +commit b64ce24daffb634b5b3133a2e411bd4de50654e8 upstream. + +Fix a potential deadlock when resuming; here the calling +function has disabled interrupts, so we cannot sleep. + +Change the memory allocation flag from GFP_KERNEL to GFP_ATOMIC. + +TODO: We can do away with this memory allocation during resume + by reusing the ioapic suspend/resume code that uses boot time + allocated buffers, but we want to keep this -stable patch + simple. + +Signed-off-by: Daniel J Blueman <daniel.blueman@gmail.com> +Signed-off-by: Suresh Siddha <suresh.b.siddha@intel.com> +Link: http://lkml.kernel.org/r/20110518233157.385970138@sbsiddha-MOBL3.sc.intel.com +Signed-off-by: Ingo Molnar <mingo@elte.hu> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + arch/x86/kernel/apic/io_apic.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/x86/kernel/apic/io_apic.c ++++ b/arch/x86/kernel/apic/io_apic.c +@@ -621,14 +621,14 @@ struct IO_APIC_route_entry **alloc_ioapi + struct IO_APIC_route_entry **ioapic_entries; + + ioapic_entries = kzalloc(sizeof(*ioapic_entries) * nr_ioapics, +- GFP_KERNEL); ++ GFP_ATOMIC); + if (!ioapic_entries) + return 0; + + for (apic = 0; apic < nr_ioapics; apic++) { + ioapic_entries[apic] = + kzalloc(sizeof(struct IO_APIC_route_entry) * +- nr_ioapic_registers[apic], GFP_KERNEL); ++ nr_ioapic_registers[apic], GFP_ATOMIC); + if (!ioapic_entries[apic]) + goto nomem; + } |