[01/90] USB: option: add pid for ZTE

20 views
Skip to first unread message

Greg KH

unread,
Dec 16, 2009, 8:20:02 PM12/16/09
to linux-...@vger.kernel.org, sta...@kernel.org, stable...@kernel.org, torv...@linux-foundation.org, ak...@linux-foundation.org, al...@lxorguk.ukuu.org.uk, Ming Zhao
2.6.31-stable review patch. If anyone has any objections, please let us know.

------------------

From: zhao....@zte.com.cn <zhao....@zte.com.cn>

commit 8d87cacda7c8db5c131bfcaaa1d90bfe918c2ebc upstream.

This patch adds ZTE modem devices.

Signed-off-by: Ming Zhao <zhao....@zte.com.cn>
Signed-off-by: Greg Kroah-Hartman <gre...@suse.de>

---
drivers/usb/serial/option.c | 36 ++++++++++++++++++++++++++++++++++++
1 file changed, 36 insertions(+)

--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -577,12 +577,48 @@ static struct usb_device_id option_ids[]
{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0086, 0xff, 0xff, 0xff) },
{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x2002, 0xff, 0xff, 0xff) },
{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x2003, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0104, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0106, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0108, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0113, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0117, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0118, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0121, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0122, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0123, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0124, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0125, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0126, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0128, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0142, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0143, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0144, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0145, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0146, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0147, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0148, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0149, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0150, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0151, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0152, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0153, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0154, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0155, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0156, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0157, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0158, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0159, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0160, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0161, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0162, 0xff, 0xff, 0xff) },
{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0014, 0xff, 0xff, 0xff) }, /* ZTE CDMA products */
{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0027, 0xff, 0xff, 0xff) },
{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0059, 0xff, 0xff, 0xff) },
{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0060, 0xff, 0xff, 0xff) },
{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0070, 0xff, 0xff, 0xff) },
{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0073, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0130, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0141, 0xff, 0xff, 0xff) },
{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_CDMA_TECH, 0xff, 0xff, 0xff) },
{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_AC8710, 0xff, 0xff, 0xff) },
{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_AC2726, 0xff, 0xff, 0xff) },


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majo...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

Greg KH

unread,
Dec 16, 2009, 8:20:30 PM12/16/09
to linux-...@vger.kernel.org, sta...@kernel.org, stable...@kernel.org, torv...@linux-foundation.org, ak...@linux-foundation.org, al...@lxorguk.ukuu.org.uk, Jaroslav Kysela, Takashi Iwai
2.6.31-stable review patch. If anyone has any objections, please let us know.

------------------

From: Jaroslav Kysela <pe...@perex.cz>

commit 396087eaead95fcb29eb36f1e59517aeb58c545e upstream.

Confirmed from vendor and tests in RedHat bugzilla #536782 .

Signed-off-by: Jaroslav Kysela <pe...@perex.cz>
Signed-off-by: Takashi Iwai <ti...@suse.de>
Signed-off-by: Greg Kroah-Hartman <gre...@suse.de>

---
sound/pci/hda/hda_intel.c | 5 +++++
1 file changed, 5 insertions(+)

--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -2392,6 +2392,11 @@ static int __devinit azx_create(struct s
}
}

+ /* disable 64bit DMA address for Teradici */
+ /* it does not work with device 6549:1200 subsys e4a2:040b */
+ if (chip->driver_type == AZX_DRIVER_TERA)
+ gcap &= ~ICH6_GCAP_64OK;
+
/* allow 64bit DMA address if supported by H/W */
if ((gcap & ICH6_GCAP_64OK) && !pci_set_dma_mask(pci, DMA_BIT_MASK(64)))
pci_set_consistent_dma_mask(pci, DMA_BIT_MASK(64));

Greg KH

unread,
Dec 16, 2009, 8:20:46 PM12/16/09
to linux-...@vger.kernel.org, sta...@kernel.org, stable...@kernel.org, torv...@linux-foundation.org, ak...@linux-foundation.org, al...@lxorguk.ukuu.org.uk, Feng Tang, Heiko Carstens, Thomas Gleixner
2.6.31-stable review patch. If anyone has any objections, please let us know.

------------------

From: Feng Tang <feng...@intel.com>

commit 8629ea2eaba8ca0de2e38ce1b4a825e16255976e upstream.

commit 507e1231 (timer stats: Optimize by adding quick check to avoid
function calls) introduced a regression in /proc/timer_list.

/proc/timer_list shows now
#0: <c27d46b0>, tick_sched_timer, S:01, <(null)>, /-1
instead of
#0: <c27d46b0>, tick_sched_timer, S:01, hrtimer_start, swapper/0

Revert the hrtimer quick check for now. The optimization needs more
thought, but this is neither 2.6.32-rc7 nor stable material.

[ tglx: - Removed unrelated changes from the original patch
- Prevent unneccesary call to timer_stats_update_stats
- massaged the changelog ]

Signed-off-by: Feng Tang <feng...@intel.com>
LKML-Reference: <alpine.LFD.2.00.0...@localhost.localdomain>
Cc: Heiko Carstens <heiko.c...@de.ibm.com>
Signed-off-by: Andrew Morton <ak...@linux-foundation.org>
Signed-off-by: Thomas Gleixner <tg...@linutronix.de>
Signed-off-by: Greg Kroah-Hartman <gre...@suse.de>

---
include/linux/hrtimer.h | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)

--- a/include/linux/hrtimer.h
+++ b/include/linux/hrtimer.h
@@ -448,7 +448,7 @@ extern void timer_stats_update_stats(voi

static inline void timer_stats_account_hrtimer(struct hrtimer *timer)
{
- if (likely(!timer->start_site))
+ if (likely(!timer_stats_active))
return;
timer_stats_update_stats(timer, timer->start_pid, timer->start_site,
timer->function, timer->start_comm, 0);
@@ -459,8 +459,6 @@ extern void __timer_stats_hrtimer_set_st

static inline void timer_stats_hrtimer_set_start_info(struct hrtimer *timer)
{
- if (likely(!timer_stats_active))
- return;
__timer_stats_hrtimer_set_start_info(timer, __builtin_return_address(0));

Greg KH

unread,
Dec 16, 2009, 8:20:53 PM12/16/09
to linux-...@vger.kernel.org, sta...@kernel.org, stable...@kernel.org, torv...@linux-foundation.org, ak...@linux-foundation.org, al...@lxorguk.ukuu.org.uk, Roel Kluin, Michael Krufky, Mauro Carvalho Chehab
2.6.31-stable review patch. If anyone has any objections, please let us know.

------------------

From: Roel Kluin <roel....@gmail.com>

commit c95a419a5604ec8a23cd73f61e9bb151e8cbe89b upstream.

The reg_pair2[j].reg was tested twice.

Signed-off-by: Roel Kluin <roel....@gmail.com>
Acked-by: Michael Krufky <mkr...@linuxtv.org>
Signed-off-by: Andrew Morton <ak...@linux-foundation.org>
Signed-off-by: Mauro Carvalho Chehab <mch...@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gre...@suse.de>

---
drivers/media/common/tuners/mxl5007t.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/media/common/tuners/mxl5007t.c
+++ b/drivers/media/common/tuners/mxl5007t.c
@@ -196,7 +196,7 @@ static void copy_reg_bits(struct reg_pai
i = j = 0;

while (reg_pair1[i].reg || reg_pair1[i].val) {
- while (reg_pair2[j].reg || reg_pair2[j].reg) {
+ while (reg_pair2[j].reg || reg_pair2[j].val) {
if (reg_pair1[i].reg != reg_pair2[j].reg) {
j++;
continue;

Greg KH

unread,
Dec 16, 2009, 8:21:05 PM12/16/09
to linux-...@vger.kernel.org, sta...@kernel.org, stable...@kernel.org, torv...@linux-foundation.org, ak...@linux-foundation.org, al...@lxorguk.ukuu.org.uk, Benjamin Herrenschmidt
2.6.31-stable review patch. If anyone has any objections, please let us know.

------------------

From: Benjamin Herrenschmidt <be...@kernel.crashing.org>

commit e090aa80321b64c3b793f3b047e31ecf1af9538d upstream.

e821ea70f3b4873b50056a1e0f74befed1014c09 introduced a bug by copying
some 64-bit originated code as-is to be used by both 32 and 64-bit
but this code contains a 64-bit ony "cmpdi" instruction.

This changes it to cmpwi, which is fine since VRSAVE can only contains
a 32-bit value anyway.

Signed-off-by: Benjamin Herrenschmidt <be...@kernel.crashing.org>
Signed-off-by: Greg Kroah-Hartman <gre...@suse.de>

---
arch/powerpc/kernel/vector.S | 2 +-


1 file changed, 1 insertion(+), 1 deletion(-)

--- a/arch/powerpc/kernel/vector.S
+++ b/arch/powerpc/kernel/vector.S
@@ -58,7 +58,7 @@ _GLOBAL(load_up_altivec)
* all 1's
*/
mfspr r4,SPRN_VRSAVE
- cmpdi 0,r4,0
+ cmpwi 0,r4,0
bne+ 1f
li r4,-1
mtspr SPRN_VRSAVE,r4

Greg KH

unread,
Dec 16, 2009, 8:21:28 PM12/16/09
to linux-...@vger.kernel.org, sta...@kernel.org, stable...@kernel.org, torv...@linux-foundation.org, ak...@linux-foundation.org, al...@lxorguk.ukuu.org.uk, Bartlomiej Zolnierkiewicz, Sergei Shtylyov, David S. Miller
2.6.31-stable review patch. If anyone has any objections, please let us know.

------------------

From: Bartlomiej Zolnierkiewicz <bzol...@gmail.com>

[ Upstream commit ee31527a02b0a8e1aa4a5e4084d2db5fa34737ed ]

Fix checking of the currently programmed UDMA mode.

Signed-off-by: Bartlomiej Zolnierkiewicz <bzol...@gmail.com>
Acked-by: Sergei Shtylyov <ssht...@ru.mvista.com>
Signed-off-by: David S. Miller <da...@davemloft.net>


Signed-off-by: Greg Kroah-Hartman <gre...@suse.de>
---

drivers/ide/slc90e66.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)

--- a/drivers/ide/slc90e66.c
+++ b/drivers/ide/slc90e66.c
@@ -91,8 +91,7 @@ static void slc90e66_set_dma_mode(ide_dr

if (!(reg48 & u_flag))
pci_write_config_word(dev, 0x48, reg48|u_flag);
- /* FIXME: (reg4a & a_speed) ? */
- if ((reg4a & u_speed) != u_speed) {
+ if ((reg4a & a_speed) != u_speed) {
pci_write_config_word(dev, 0x4a, reg4a & ~a_speed);
pci_read_config_word(dev, 0x4a, &reg4a);
pci_write_config_word(dev, 0x4a, reg4a|u_speed);

Greg KH

unread,
Dec 16, 2009, 8:21:39 PM12/16/09
to linux-...@vger.kernel.org, sta...@kernel.org, stable...@kernel.org, torv...@linux-foundation.org, ak...@linux-foundation.org, al...@lxorguk.ukuu.org.uk, Alexander Beregalov, David S. Miller
2.6.31-stable review patch. If anyone has any objections, please let us know.

------------------

From: Alexander Beregalov <a.ber...@gmail.com>

[ Upstream commit 63edaf647607795a065e6956a79c47f500dc8447 ]

Andreas Lohre reported that the driver crashes when trying
to register_netdev(), he sugessted to move dev->netdev_ops initialization
before calling register_netdev(), it worked for him.

Reported-by: Andreas Lohre <alo...@gmail.com>
Signed-off-by: Alexander Beregalov <a.ber...@gmail.com>


Signed-off-by: David S. Miller <da...@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gre...@suse.de>

---
drivers/net/au1000_eth.c | 15 ++++++++-------
1 file changed, 8 insertions(+), 7 deletions(-)

--- a/drivers/net/au1000_eth.c
+++ b/drivers/net/au1000_eth.c
@@ -1089,7 +1089,14 @@ static struct net_device * au1000_probe(
return NULL;
}

- if ((err = register_netdev(dev)) != 0) {
+ dev->base_addr = base;
+ dev->irq = irq;
+ dev->netdev_ops = &au1000_netdev_ops;
+ SET_ETHTOOL_OPS(dev, &au1000_ethtool_ops);
+ dev->watchdog_timeo = ETH_TX_TIMEOUT;
+
+ err = register_netdev(dev);
+ if (err != 0) {
printk(KERN_ERR "%s: Cannot register net device, error %d\n",
DRV_NAME, err);
free_netdev(dev);
@@ -1207,12 +1214,6 @@ static struct net_device * au1000_probe(
aup->tx_db_inuse[i] = pDB;
}

- dev->base_addr = base;
- dev->irq = irq;
- dev->netdev_ops = &au1000_netdev_ops;
- SET_ETHTOOL_OPS(dev, &au1000_ethtool_ops);
- dev->watchdog_timeo = ETH_TX_TIMEOUT;
-
/*
* The boot code uses the ethernet controller, so reset it to start
* fresh. au1000_init() expects that the device is in reset state.

Greg KH

unread,
Dec 16, 2009, 8:21:52 PM12/16/09
to linux-...@vger.kernel.org, sta...@kernel.org, stable...@kernel.org, torv...@linux-foundation.org, ak...@linux-foundation.org, al...@lxorguk.ukuu.org.uk, David S. Miller
2.6.31-stable review patch. If anyone has any objections, please let us know.

------------------


From: David S. Miller <da...@davemloft.net>

[ Upstream commit 7f5620a5fcd658f219e85831d3691908f1eccbde ]

"ARCH" can be just about anything, so we shouldn't end up
with UTS_MACHINE of "sparc" in a 64-bit kernel build just
because someone set the personality using 'sparc32' or
similar. CONFIG_SPARC64 drives the compilation and
therefore provides the definitive value, not "ARCH".

This mirrors commit 8c6531f7a99f29ba8817ffb12cc9ecf190049bd6
(x86: correctly set UTS_MACHINE for "make ARCH=x86")

Signed-off-by: David S. Miller <da...@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gre...@suse.de>
---

arch/sparc/Makefile | 2 ++
1 file changed, 2 insertions(+)

--- a/arch/sparc/Makefile
+++ b/arch/sparc/Makefile
@@ -27,6 +27,7 @@ AS := $(AS) -32
LDFLAGS := -m elf32_sparc
CHECKFLAGS += -D__sparc__
export BITS := 32
+UTS_MACHINE := sparc

#KBUILD_CFLAGS += -g -pipe -fcall-used-g5 -fcall-used-g7
KBUILD_CFLAGS += -m32 -pipe -mno-fpu -fcall-used-g5 -fcall-used-g7
@@ -50,6 +51,7 @@ CHECKFLAGS += -D__sparc__ -D__sparc

LDFLAGS := -m elf64_sparc
export BITS := 64
+UTS_MACHINE := sparc64

KBUILD_CFLAGS += -m64 -pipe -mno-fpu -mcpu=ultrasparc -mcmodel=medlow \
-ffixed-g4 -ffixed-g5 -fcall-used-g7 -Wno-sign-compare \

Greg KH

unread,
Dec 16, 2009, 8:22:05 PM12/16/09
to linux-...@vger.kernel.org, sta...@kernel.org, stable...@kernel.org, torv...@linux-foundation.org, ak...@linux-foundation.org, al...@lxorguk.ukuu.org.uk, Zhao Yakui, Venkatesh Pallipadi, Len Brown
2.6.31-stable review patch. If anyone has any objections, please let us know.

------------------

From: Zhao Yakui <yakui...@intel.com>

commit 03a05ed1152944000151d57b71000de287a1eb02 upstream.

Currently, ARB_DISABLE is a NOP on all of the recent Intel platforms.
For such platforms, reduce contention on c3_lock by skipping the fake
ARB_DISABLE.

The cpu model id on one laptop is 14. If we disable ARB_DISABLE on this box,
the box can't be booted correctly. But if we still enable ARB_DISABLE on this
box, the box can be booted correctly.

So we still use the ARB_DISABLE for the cpu which mode id is less than 0x0f.

http://bugzilla.kernel.org/show_bug.cgi?id=14700

Signed-off-by: Zhao Yakui <yakui...@intel.com>
Acked-by: Venkatesh Pallipadi <venkatesh...@intel.com>
Signed-off-by: Len Brown <len....@intel.com>
Signed-off-by: Greg Kroah-Hartman <gre...@suse.de>

---
arch/x86/kernel/acpi/cstate.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

--- a/arch/x86/kernel/acpi/cstate.c
+++ b/arch/x86/kernel/acpi/cstate.c
@@ -48,7 +48,7 @@ void acpi_processor_power_init_bm_check(
* P4, Core and beyond CPUs
*/
if (c->x86_vendor == X86_VENDOR_INTEL &&
- (c->x86 > 0xf || (c->x86 == 6 && c->x86_model >= 14)))
+ (c->x86 > 0xf || (c->x86 == 6 && c->x86_model >= 0x0f)))
flags->bm_control = 0;
}
EXPORT_SYMBOL(acpi_processor_power_init_bm_check);

Greg KH

unread,
Dec 16, 2009, 8:22:23 PM12/16/09
to linux-...@vger.kernel.org, sta...@kernel.org, stable...@kernel.org, torv...@linux-foundation.org, ak...@linux-foundation.org, al...@lxorguk.ukuu.org.uk, Chris Wilson, David Woodhouse, Zhenyu Wang, Zhenyu Wang, Eric Anholt
2.6.31-stable review patch. If anyone has any objections, please let us know.

------------------

From: Chris Wilson <ch...@chris-wilson.co.uk>

commit d271817baecbccb47da0d9f28c285a0dae8a06b7 upstream.

In commit d2d9f2324, the guard for a valid video mode was removed. This
caused the regression:

kernel crash during kms graphic boot on Intel GM4500 platform
https://bugzilla.redhat.com/show_bug.cgi?id=540218

This patches changes the logic slightly not to rely on a coupled
variable, but to just check whether the video_modes is valid before
dereferencing.

Signed-off-by: Chris Wilson <ch...@chris-wilson.co.uk>
Cc: David Woodhouse <dw...@infradead.org>
Cc: Zhenyu Wang <zhenyu...@intel.com>
[ickle: Actually reference the correct bug report]
Acked-by: Zhenyu Wang <zhe...@linux.intel.com>
Signed-off-by: Eric Anholt <er...@anholt.net>
Signed-off-by: Greg Kroah-Hartman <gre...@suse.de>

---
drivers/gpu/drm/i915/intel_tv.c | 11 ++++-------
1 file changed, 4 insertions(+), 7 deletions(-)

--- a/drivers/gpu/drm/i915/intel_tv.c
+++ b/drivers/gpu/drm/i915/intel_tv.c
@@ -1212,20 +1212,17 @@ intel_tv_mode_set(struct drm_encoder *en
tv_ctl |= TV_TRILEVEL_SYNC;
if (tv_mode->pal_burst)
tv_ctl |= TV_PAL_BURST;
+
scctl1 = 0;
- /* dda1 implies valid video levels */
- if (tv_mode->dda1_inc) {
+ if (tv_mode->dda1_inc)
scctl1 |= TV_SC_DDA1_EN;
- }
-
if (tv_mode->dda2_inc)
scctl1 |= TV_SC_DDA2_EN;
-
if (tv_mode->dda3_inc)
scctl1 |= TV_SC_DDA3_EN;
-
scctl1 |= tv_mode->sc_reset;
- scctl1 |= video_levels->burst << TV_BURST_LEVEL_SHIFT;
+ if (video_levels)
+ scctl1 |= video_levels->burst << TV_BURST_LEVEL_SHIFT;
scctl1 |= tv_mode->dda1_inc << TV_SCDDA1_INC_SHIFT;

scctl2 = tv_mode->dda2_size << TV_SCDDA2_SIZE_SHIFT |

Greg KH

unread,
Dec 16, 2009, 8:22:31 PM12/16/09
to linux-...@vger.kernel.org, sta...@kernel.org, stable...@kernel.org, torv...@linux-foundation.org, ak...@linux-foundation.org, al...@lxorguk.ukuu.org.uk, Zhenyu Wang, Eric Anholt
2.6.31-stable review patch. If anyone has any objections, please let us know.

------------------

From: Zhenyu Wang <zhe...@linux.intel.com>

commit 8e9e0eea9955bffbe5e5cd6355157cabddc31f17 upstream.

For CRT hotplug detect status, we have four test results as blue
channel only, green channel only, both blue and green channel, and
no channel attached. Origin code only marks both blue and green channel
case as connected, but ignore other possible connected states. This one
trys to detect CRT by checking no channel attached case instead.

Signed-off-by: Zhenyu Wang <zhe...@linux.intel.com>


Signed-off-by: Eric Anholt <er...@anholt.net>
Signed-off-by: Greg Kroah-Hartman <gre...@suse.de>

---
drivers/gpu/drm/i915/intel_crt.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)

--- a/drivers/gpu/drm/i915/intel_crt.c
+++ b/drivers/gpu/drm/i915/intel_crt.c
@@ -234,8 +234,8 @@ static bool intel_crt_detect_hotplug(str
} while (time_after(timeout, jiffies));
}

- if ((I915_READ(PORT_HOTPLUG_STAT) & CRT_HOTPLUG_MONITOR_MASK) ==
- CRT_HOTPLUG_MONITOR_COLOR)
+ if ((I915_READ(PORT_HOTPLUG_STAT) & CRT_HOTPLUG_MONITOR_MASK) !=
+ CRT_HOTPLUG_MONITOR_NONE)
return true;

return false;

Greg KH

unread,
Dec 16, 2009, 8:22:40 PM12/16/09
to linux-...@vger.kernel.org, sta...@kernel.org, stable...@kernel.org, torv...@linux-foundation.org, ak...@linux-foundation.org, al...@lxorguk.ukuu.org.uk, Rafal Milecki, Jean-Francois Moine, Mauro Carvalho Chehab, Surbhi Palande
2.6.31-stable review patch. If anyone has any objections, please let us know.

------------------

From: Rafal Milecki <zaj...@gmail.com>

commit 518c8df77c21b7d1690dd8b96eb0e54c4ec1c9c1 upstream.

Signed-off-by: Rafal Milecki <zaj...@gmail.com>
Signed-off-by: Jean-Francois Moine <moi...@free.fr>


Signed-off-by: Mauro Carvalho Chehab <mch...@redhat.com>

Cc: Surbhi Palande <surbhi....@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gre...@suse.de>

---
Documentation/video4linux/gspca.txt | 1 +
drivers/media/video/gspca/ov519.c | 1 +
2 files changed, 2 insertions(+)

--- a/Documentation/video4linux/gspca.txt
+++ b/Documentation/video4linux/gspca.txt
@@ -37,6 +37,7 @@ ov519 041e:405f Creative Live! VISTA VF
ov519 041e:4060 Creative Live! VISTA VF0350
ov519 041e:4061 Creative Live! VISTA VF0400
ov519 041e:4064 Creative Live! VISTA VF0420
+ov519 041e:4067 Creative Live! Cam Video IM (VF0350)
ov519 041e:4068 Creative Live! VISTA VF0470
spca561 0458:7004 Genius VideoCAM Express V2
sunplus 0458:7006 Genius Dsc 1.3 Smart
--- a/drivers/media/video/gspca/ov519.c
+++ b/drivers/media/video/gspca/ov519.c
@@ -3364,6 +3364,7 @@ static const __devinitdata struct usb_de
{USB_DEVICE(0x041e, 0x4061), .driver_info = BRIDGE_OV519 },
{USB_DEVICE(0x041e, 0x4064),
.driver_info = BRIDGE_OV519 | BRIDGE_INVERT_LED },
+ {USB_DEVICE(0x041e, 0x4067), .driver_info = BRIDGE_OV519 },
{USB_DEVICE(0x041e, 0x4068),
.driver_info = BRIDGE_OV519 | BRIDGE_INVERT_LED },
{USB_DEVICE(0x045e, 0x028c), .driver_info = BRIDGE_OV519 },

Greg KH

unread,
Dec 16, 2009, 8:23:25 PM12/16/09
to linux-...@vger.kernel.org, sta...@kernel.org, stable...@kernel.org, torv...@linux-foundation.org, ak...@linux-foundation.org, al...@lxorguk.ukuu.org.uk, Henrique de Moraes Holschuh, Len Brown
2.6.31-stable review patch. If anyone has any objections, please let us know.

------------------

From: Henrique de Moraes Holschuh <h...@hmh.eng.br>

commit a9f8eacca4e9e8693de9b896c1fa7aadaa9402e8 upstream.

According to a report, the R50e wants EC-based brightness control,
even if it uses an Intel GPU. The current driver default was reported
to not work at all.

This bug can be worked around by the "brightness_mode=3" module
parameter.

Change the default of the R50e and R51 2xxx models (which use the same
EC firmware, 1V) to TPACPI_BRGHT_Q_EC, but keep TPACPI_BRGHT_Q_ASK set
for now, as I'd like to get more reports.

This fixes a regression caused by commit
59fe4fe34d7afdf63208124f313be9056feaa2f4,
"thinkpad-acpi: fix incorrect use of TPACPI_BRGHT_MODE_ECNVRAM"

Kernel 2.6.31 also needs this fix.

Reported-by: Ferenc Wagner <wf...@niif.hu>
Tested-by: Ferenc Wagner <wf...@niif.hu>
Signed-off-by: Henrique de Moraes Holschuh <h...@hmh.eng.br>
Cc: sta...@kernel.org
Signed-off-by: Len Brown <len....@intel.com>
Signed-off-by: Greg Kroah-Hartman <gre...@suse.de>

---
drivers/platform/x86/thinkpad_acpi.c | 4 ++--


1 file changed, 2 insertions(+), 2 deletions(-)

--- a/drivers/platform/x86/thinkpad_acpi.c
+++ b/drivers/platform/x86/thinkpad_acpi.c
@@ -5663,8 +5663,8 @@ static const struct tpacpi_quirk brightn

/* Models with Intel Extreme Graphics 2 */
TPACPI_Q_IBM('1', 'U', TPACPI_BRGHT_Q_NOEC),
- TPACPI_Q_IBM('1', 'V', TPACPI_BRGHT_Q_ASK|TPACPI_BRGHT_Q_NOEC),
- TPACPI_Q_IBM('1', 'W', TPACPI_BRGHT_Q_ASK|TPACPI_BRGHT_Q_NOEC),
+ TPACPI_Q_IBM('1', 'V', TPACPI_BRGHT_Q_ASK|TPACPI_BRGHT_Q_EC),
+ TPACPI_Q_IBM('1', 'W', TPACPI_BRGHT_Q_ASK|TPACPI_BRGHT_Q_EC),

/* Models with Intel GMA900 */
TPACPI_Q_IBM('7', '0', TPACPI_BRGHT_Q_NOEC), /* T43, R52 */

Greg KH

unread,
Dec 16, 2009, 8:23:34 PM12/16/09
to linux-...@vger.kernel.org, sta...@kernel.org, stable...@kernel.org, torv...@linux-foundation.org, ak...@linux-foundation.org, al...@lxorguk.ukuu.org.uk, Alan Cox, Petr Vandrovec, Pekka Enberg, Paul A. Clarke
2.6.31-stable review patch. If anyone has any objections, please let us know.

------------------

From: Alan Cox <al...@linux.intel.com>

commit 8c651311a3a08c1e4815de6933e00a760e498dae upstream.

Regression caused in 2.6.23 and then despite repeated requests never fixed
or dealt with (Petr promised to sort it in 2008 but seems to have
forgotten).

Enough is enough - remove the problem line that was added. If it upsets
someone they've had two years to deal with it and at the very least it'll
rattle their cage and wake them up.

Addresses http://bugzilla.kernel.org/show_bug.cgi?id=9709

Signed-off-by: Alan Cox <al...@linux.intel.com>
Reported-by: Damon <acc...@bugzilla.kernel.org.juxtaposition.net>
Tested-by: Ruud van Melick <rvm...@raketnet.nl>
Cc: Petr Vandrovec <VAND...@vc.cvut.cz>
Cc: Pekka Enberg <pen...@cs.helsinki.fi>
Cc: Paul A. Clarke <p...@us.ibm.com>
Signed-off-by: Andrew Morton <ak...@linux-foundation.org>
Signed-off-by: Linus Torvalds <torv...@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gre...@suse.de>

---
drivers/video/matrox/g450_pll.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)

--- a/drivers/video/matrox/g450_pll.c
+++ b/drivers/video/matrox/g450_pll.c
@@ -341,7 +341,8 @@ static int __g450_setclk(WPMINFO unsigne
M1064_XDVICLKCTRL_C1DVICLKEN |
M1064_XDVICLKCTRL_DVILOOPCTL |
M1064_XDVICLKCTRL_P1LOOPBWDTCTL;
- matroxfb_DAC_out(PMINFO M1064_XDVICLKCTRL,tmp);
+ /* Setting this breaks PC systems so don't do it */
+ /* matroxfb_DAC_out(PMINFO M1064_XDVICLKCTRL,tmp); */
matroxfb_DAC_out(PMINFO M1064_XPWRCTRL,
xpwrctrl);

Greg KH

unread,
Dec 16, 2009, 8:23:41 PM12/16/09
to linux-...@vger.kernel.org, sta...@kernel.org, stable...@kernel.org, torv...@linux-foundation.org, ak...@linux-foundation.org, al...@lxorguk.ukuu.org.uk, Zhu Yi, John W. Linville
2.6.31-stable review patch. If anyone has any objections, please let us know.

------------------

From: Zhu Yi <yi....@intel.com>

commit 52ce3e9a7db754b78cf2cbabc87013f921b25b28 upstream.

Add PCI .shutdown method so that we can disable the device during
shutdown or reboot. Without this, the reboot doesn't work well on
some platforms.

This fixes http://bugzilla.intellinuxwireless.org/show_bug.cgi?id=2124

Tested-by: pablo <pablo...@gmail.com>
Signed-off-by: Zhu Yi <yi....@intel.com>
Signed-off-by: John W. Linville <linv...@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gre...@suse.de>

---
drivers/net/wireless/ipw2x00/ipw2100.c | 11 +++++++++++
1 file changed, 11 insertions(+)

--- a/drivers/net/wireless/ipw2x00/ipw2100.c
+++ b/drivers/net/wireless/ipw2x00/ipw2100.c
@@ -6487,6 +6487,16 @@ static int ipw2100_resume(struct pci_dev
}
#endif

+static void ipw2100_shutdown(struct pci_dev *pci_dev)
+{
+ struct ipw2100_priv *priv = pci_get_drvdata(pci_dev);
+
+ /* Take down the device; powers it off, etc. */
+ ipw2100_down(priv);
+
+ pci_disable_device(pci_dev);
+}
+
#define IPW2100_DEV_ID(x) { PCI_VENDOR_ID_INTEL, 0x1043, 0x8086, x }

static struct pci_device_id ipw2100_pci_id_table[] __devinitdata = {
@@ -6550,6 +6560,7 @@ static struct pci_driver ipw2100_pci_dri
.suspend = ipw2100_suspend,
.resume = ipw2100_resume,
#endif
+ .shutdown = ipw2100_shutdown,
};

/**

Greg KH

unread,
Dec 16, 2009, 8:23:58 PM12/16/09
to linux-...@vger.kernel.org, sta...@kernel.org, stable...@kernel.org, torv...@linux-foundation.org, ak...@linux-foundation.org, al...@lxorguk.ukuu.org.uk, Shaohua Li, Zhenyu Wang, Eric Anholt
2.6.31-stable review patch. If anyone has any objections, please let us know.

------------------

From: Zhenyu Wang <zhe...@linux.intel.com>

commit 103a196f4224dc6872081305cf7f82ebf67aa7bd upstream.

PineView only has 2 ports for LVDS and CRT. Don't enable other
ports for it.

Cc: Shaohua Li <shaoh...@intel.com>


Signed-off-by: Zhenyu Wang <zhe...@linux.intel.com>
Signed-off-by: Eric Anholt <er...@anholt.net>

Signed-off-by: Greg Kroah-Hartman <gre...@suse.de>

---
drivers/gpu/drm/i915/i915_drv.h | 4 ++++
drivers/gpu/drm/i915/intel_display.c | 6 +++---
2 files changed, 7 insertions(+), 3 deletions(-)

--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -838,6 +838,7 @@ extern int i915_wait_ring(struct drm_dev
#define IS_I85X(dev) ((dev)->pci_device == 0x3582)
#define IS_I855(dev) ((dev)->pci_device == 0x3582)
#define IS_I865G(dev) ((dev)->pci_device == 0x2572)
+#define IS_I8XX(dev) (IS_I830(dev) || IS_845G(dev) || IS_I85X(dev) || IS_I865G(dev))

#define IS_I915G(dev) ((dev)->pci_device == 0x2582 || (dev)->pci_device == 0x258a)
#define IS_I915GM(dev) ((dev)->pci_device == 0x2592)
@@ -899,9 +900,12 @@ extern int i915_wait_ring(struct drm_dev
*/
#define HAS_128_BYTE_Y_TILING(dev) (IS_I9XX(dev) && !(IS_I915G(dev) || \
IS_I915GM(dev)))
+#define SUPPORTS_DIGITAL_OUTPUTS(dev) (IS_I9XX(dev) && !IS_IGD(dev))
#define SUPPORTS_INTEGRATED_HDMI(dev) (IS_G4X(dev) || IS_IGDNG(dev))
#define SUPPORTS_INTEGRATED_DP(dev) (IS_G4X(dev) || IS_IGDNG(dev))
#define SUPPORTS_EDP(dev) (IS_IGDNG_M(dev))
+#define SUPPORTS_TV(dev) (IS_I9XX(dev) && IS_MOBILE(dev) && \
+ !IS_IGDNG(dev) && !IS_IGD(dev))
#define I915_HAS_HOTPLUG(dev) (IS_I945G(dev) || IS_I945GM(dev) || IS_I965G(dev))
/* dsparb controlled by hw only */
#define DSPARB_HWCONTROL(dev) (IS_G4X(dev) || IS_IGDNG(dev))
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -3347,7 +3347,7 @@ static void intel_setup_outputs(struct d
if (I915_READ(PCH_DP_D) & DP_DETECTED)
intel_dp_init(dev, PCH_DP_D);

- } else if (IS_I9XX(dev)) {
+ } else if (SUPPORTS_DIGITAL_OUTPUTS(dev)) {
bool found = false;

if (I915_READ(SDVOB) & SDVO_DETECTED) {
@@ -3374,10 +3374,10 @@ static void intel_setup_outputs(struct d

if (SUPPORTS_INTEGRATED_DP(dev) && (I915_READ(DP_D) & DP_DETECTED))
intel_dp_init(dev, DP_D);
- } else
+ } else if (IS_I8XX(dev))
intel_dvo_init(dev);

- if (IS_I9XX(dev) && IS_MOBILE(dev) && !IS_IGDNG(dev))
+ if (SUPPORTS_TV(dev))
intel_tv_init(dev);

list_for_each_entry(connector, &dev->mode_config.connector_list, head) {

Greg KH

unread,
Dec 16, 2009, 8:24:19 PM12/16/09
to linux-...@vger.kernel.org, sta...@kernel.org, stable...@kernel.org, torv...@linux-foundation.org, ak...@linux-foundation.org, al...@lxorguk.ukuu.org.uk, Jesse Barnes, Eric Anholt, Stefan Bader
2.6.31-stable review patch. If anyone has any objections, please let us know.

------------------

From: Jesse Barnes <jba...@virtuousgeek.org>

commit 0eb96d6ed38430b72897adde58f5477a6b71757a upstream.

Turns out some machines, like the ThinkPad X40 don't come back if you
don't save/restore this register.

Signed-off-by: Jesse Barnes <jba...@virtuousgeek.org>
Signed-off-by: Eric Anholt <er...@anholt.net>
Cc: Stefan Bader <stefan...@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gre...@suse.de>

---
drivers/gpu/drm/i915/i915_drv.h | 1 +
drivers/gpu/drm/i915/i915_reg.h | 2 ++
drivers/gpu/drm/i915/i915_suspend.c | 2 ++
3 files changed, 5 insertions(+)

--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -264,6 +264,7 @@ typedef struct drm_i915_private {
u32 saveDSPASURF;
u32 saveDSPATILEOFF;
u32 savePFIT_PGM_RATIOS;
+ u32 saveBLC_HIST_CTL;
u32 saveBLC_PWM_CTL;
u32 saveBLC_PWM_CTL2;
u32 saveFPB0;
--- a/drivers/gpu/drm/i915/i915_reg.h
+++ b/drivers/gpu/drm/i915/i915_reg.h
@@ -915,6 +915,8 @@
#define BACKLIGHT_DUTY_CYCLE_SHIFT (0)
#define BACKLIGHT_DUTY_CYCLE_MASK (0xffff)

+#define BLC_HIST_CTL 0x61260
+
/* TV port control */
#define TV_CTL 0x68000
/** Enables the TV encoder */
--- a/drivers/gpu/drm/i915/i915_suspend.c
+++ b/drivers/gpu/drm/i915/i915_suspend.c
@@ -416,6 +416,7 @@ int i915_save_state(struct drm_device *d
dev_priv->savePP_CONTROL = I915_READ(PP_CONTROL);
dev_priv->savePFIT_PGM_RATIOS = I915_READ(PFIT_PGM_RATIOS);
dev_priv->saveBLC_PWM_CTL = I915_READ(BLC_PWM_CTL);
+ dev_priv->saveBLC_HIST_CTL = I915_READ(BLC_HIST_CTL);
if (IS_I965G(dev))
dev_priv->saveBLC_PWM_CTL2 = I915_READ(BLC_PWM_CTL2);
if (IS_MOBILE(dev) && !IS_I830(dev))
@@ -560,6 +561,7 @@ int i915_restore_state(struct drm_device

I915_WRITE(PFIT_PGM_RATIOS, dev_priv->savePFIT_PGM_RATIOS);
I915_WRITE(BLC_PWM_CTL, dev_priv->saveBLC_PWM_CTL);
+ I915_WRITE(BLC_HIST_CTL, dev_priv->saveBLC_HIST_CTL);
I915_WRITE(PP_ON_DELAYS, dev_priv->savePP_ON_DELAYS);
I915_WRITE(PP_OFF_DELAYS, dev_priv->savePP_OFF_DELAYS);
I915_WRITE(PP_DIVISOR, dev_priv->savePP_DIVISOR);

Greg KH

unread,
Dec 16, 2009, 8:24:45 PM12/16/09
to linux-...@vger.kernel.org, sta...@kernel.org, stable...@kernel.org, torv...@linux-foundation.org, ak...@linux-foundation.org, al...@lxorguk.ukuu.org.uk, Hemant Pedanekar, Bartlomiej Zolnierkiewicz, Sergei Shtylyov, David S. Miller
2.6.31-stable review patch. If anyone has any objections, please let us know.

------------------

From: Hemant Pedanekar <hem...@ti.com>

[ Upstream commit 28c1969ff887bc2a7df39272850dece01de03285 ]

Currently, ide_cmd_ioctl when invoked for setting DMA transfer mode calls
ide_find_dma_mode with requested mode as XFER_UDMA_6. This prevents setting DMA
mode to any other value than the default (maximum) supported by the device (or
UDMA6, if supported) irrespective of the actual requested transfer mode and
returns error.

For example, setting mode to UDMA2 using hdparm, where UDMA4 is the default
transfer mode gives following error:
# ./hdparm -d1 -Xudma2 /dev/hda
/dev/hda:hda: UDMA/66 mode selected
setting using_dma to 1 (on)
hda: UDMA/66 mode selected
setting xfermode to 66 (UltraDMA mode2)
HDIO_DRIVE_CMD(setxfermode) failed: Invalid argument
using_dma = 1 (on)

This patch fixes the issue.

Signed-off-by: Hemant Pedanekar <hem...@ti.com>
Acked-by: Bartlomiej Zolnierkiewicz <bzol...@gmail.com>
Acked-by: Sergei Shtylyov <ssht...@ru.mvista.com>


Signed-off-by: David S. Miller <da...@davemloft.net>

Signed-off-by: Greg Kroah-Hartman <gre...@suse.de>
---

drivers/ide/ide-ioctls.c | 2 +-


1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/ide/ide-ioctls.c
+++ b/drivers/ide/ide-ioctls.c
@@ -162,7 +162,7 @@ static int ide_cmd_ioctl(ide_drive_t *dr
if (tf->command == ATA_CMD_SET_FEATURES &&
tf->feature == SETFEATURES_XFER &&
tf->nsect >= XFER_SW_DMA_0) {
- xfer_rate = ide_find_dma_mode(drive, XFER_UDMA_6);
+ xfer_rate = ide_find_dma_mode(drive, tf->nsect);
if (xfer_rate != tf->nsect) {
err = -EINVAL;
goto abort;

Greg KH

unread,
Dec 16, 2009, 8:25:15 PM12/16/09
to linux-...@vger.kernel.org, sta...@kernel.org, stable...@kernel.org, torv...@linux-foundation.org, ak...@linux-foundation.org, al...@lxorguk.ukuu.org.uk, Henrique de Moraes Holschuh, Len Brown
2.6.31-stable review patch. If anyone has any objections, please let us know.

------------------

From: Henrique de Moraes Holschuh <h...@hmh.eng.br>

commit 208b996b6c460285650d39b2330f8ef82c007d10 upstream.

Since the rfkill rework in 2.6.31, the driver is always resuming with
the radios disabled.

Change thinkpad-acpi to ask the firmware to resume with the radios in
the last state. This fixes the Bluetooth and WWAN rfkill switches.

Note that it means we respect the firmware's oddities. Should the
user toggle the hardware rfkill switch on and off, it might cause the
radios to resume enabled.

UWB is an unknown quantity since it has nowhere the same level of
firmware support (no control over state storage in NVRAM, for
example), and might need further fixing. Testers welcome.

This change fixes a regression from 2.6.30.

Reported-by: Jerone Young <jerone...@canonical.com>
Reported-by: Ian Molton <ian.m...@collabora.co.uk>


Signed-off-by: Henrique de Moraes Holschuh <h...@hmh.eng.br>

Tested-by: Ian Molton <ian.m...@collabora.co.uk>
Signed-off-by: Len Brown <len....@intel.com>
Signed-off-by: Greg Kroah-Hartman <gre...@suse.de>

---
drivers/platform/x86/thinkpad_acpi.c | 32 +++++---------------------------
1 file changed, 5 insertions(+), 27 deletions(-)

--- a/drivers/platform/x86/thinkpad_acpi.c
+++ b/drivers/platform/x86/thinkpad_acpi.c
@@ -3406,15 +3406,6 @@ enum {

#define TPACPI_RFK_BLUETOOTH_SW_NAME "tpacpi_bluetooth_sw"

-static void bluetooth_suspend(pm_message_t state)
-{
- /* Try to make sure radio will resume powered off */
- if (!acpi_evalf(NULL, NULL, "\\BLTH", "vd",
- TP_ACPI_BLTH_PWR_OFF_ON_RESUME))
- vdbg_printk(TPACPI_DBG_RFKILL,
- "bluetooth power down on resume request failed\n");
-}
-
static int bluetooth_get_status(void)
{
int status;
@@ -3448,10 +3439,9 @@ static int bluetooth_set_status(enum tpa
#endif

/* We make sure to keep TP_ACPI_BLUETOOTH_RESUMECTRL off */
+ status = TP_ACPI_BLUETOOTH_RESUMECTRL;
if (state == TPACPI_RFK_RADIO_ON)
- status = TP_ACPI_BLUETOOTH_RADIOSSW;
- else
- status = 0;
+ status |= TP_ACPI_BLUETOOTH_RADIOSSW;

if (!acpi_evalf(hkey_handle, NULL, "SBDC", "vd", status))
return -EIO;
@@ -3590,7 +3580,6 @@ static struct ibm_struct bluetooth_drive
.read = bluetooth_read,
.write = bluetooth_write,
.exit = bluetooth_exit,
- .suspend = bluetooth_suspend,
.shutdown = bluetooth_shutdown,
};

@@ -3608,15 +3597,6 @@ enum {

#define TPACPI_RFK_WWAN_SW_NAME "tpacpi_wwan_sw"

-static void wan_suspend(pm_message_t state)
-{
- /* Try to make sure radio will resume powered off */
- if (!acpi_evalf(NULL, NULL, "\\WGSV", "qvd",
- TP_ACPI_WGSV_PWR_OFF_ON_RESUME))
- vdbg_printk(TPACPI_DBG_RFKILL,
- "WWAN power down on resume request failed\n");
-}
-
static int wan_get_status(void)
{
int status;
@@ -3649,11 +3629,10 @@ static int wan_set_status(enum tpacpi_rf
}
#endif

- /* We make sure to keep TP_ACPI_WANCARD_RESUMECTRL off */
+ /* We make sure to set TP_ACPI_WANCARD_RESUMECTRL */
+ status = TP_ACPI_WANCARD_RESUMECTRL;
if (state == TPACPI_RFK_RADIO_ON)
- status = TP_ACPI_WANCARD_RADIOSSW;
- else
- status = 0;
+ status |= TP_ACPI_WANCARD_RADIOSSW;

if (!acpi_evalf(hkey_handle, NULL, "SWAN", "vd", status))
return -EIO;
@@ -3791,7 +3770,6 @@ static struct ibm_struct wan_driver_data
.read = wan_read,
.write = wan_write,
.exit = wan_exit,
- .suspend = wan_suspend,
.shutdown = wan_shutdown,

Greg KH

unread,
Dec 16, 2009, 8:25:25 PM12/16/09
to linux-...@vger.kernel.org, sta...@kernel.org, stable...@kernel.org, torv...@linux-foundation.org, ak...@linux-foundation.org, al...@lxorguk.ukuu.org.uk, Thomas Renninger, Peter KÃŒppers, Michael Franzl, Ian Turner, Corentin Chary, Len Brown
2.6.31-stable review patch. If anyone has any objections, please let us know.

------------------

From: Corentin Chary <coren...@iksaif.net>

commit d951d4cc84e8b5ddb8e0ab81cf6a72cc73fdd668 upstream.

The light sensor disable brightness key and
/sys/class/backlight/ control. There was a lot of report
from users who didn't understand why they couldn't change their
brightness, including:

https://bugs.launchpad.net/bugs/222171
https://bugzilla.novell.com/show_bug.cgi?id=514747
http://bugzilla.kernel.org/show_bug.cgi?id=13671
http://bugzilla.kernel.org/show_bug.cgi?id=14432

Now the light sensor is disabled, and if the user want to enable
it, the level should be ok.

The funny thing is that comments where ok, not code.

Cc: sta...@kernel.org
Cc: Thomas Renninger <tr...@suse.de>
Cc: Peter Küppers <peter-...@web.de>
Cc: Michael Franzl <michae...@gmx.at>
Cc: Ian Turner <vec...@vectro.org>
Signed-off-by: Corentin Chary <coren...@iksaif.net>


Signed-off-by: Len Brown <len....@intel.com>
Signed-off-by: Greg Kroah-Hartman <gre...@suse.de>

---
drivers/platform/x86/asus-laptop.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)

--- a/drivers/platform/x86/asus-laptop.c
+++ b/drivers/platform/x86/asus-laptop.c
@@ -1172,8 +1172,8 @@ static int asus_hotk_add(struct acpi_dev
hotk->ledd_status = 0xFFF;

/* Set initial values of light sensor and level */
- hotk->light_switch = 1; /* Default to light sensor disabled */
- hotk->light_level = 0; /* level 5 for sensor sensitivity */
+ hotk->light_switch = 0; /* Default to light sensor disabled */
+ hotk->light_level = 5; /* level 5 for sensor sensitivity */

if (ls_switch_handle)
set_light_sens_switch(hotk->light_switch);

Greg KH

unread,
Dec 16, 2009, 8:25:53 PM12/16/09
to linux-...@vger.kernel.org, sta...@kernel.org, stable...@kernel.org, torv...@linux-foundation.org, ak...@linux-foundation.org, al...@lxorguk.ukuu.org.uk, WANG Cong, Ingo Molnar, Peter Zijlstra, James Morris, Alexey Dobriyan
2.6.31-stable review patch. If anyone has any objections, please let us know.

------------------

From: Amerigo Wang <amw...@redhat.com>

commit 70da2340fbc68e91e701762f785479ab495a0869 upstream.

Jan Engelhardt reported we have this problem:

setting max_map_count to a value large enough results in programs dying at
first try. This is on 2.6.31.6:

15:59 borg:/proc/sys/vm # echo $[1<<31-1] >max_map_count
15:59 borg:/proc/sys/vm # cat max_map_count
1073741824
15:59 borg:/proc/sys/vm # echo $[1<<31] >max_map_count
15:59 borg:/proc/sys/vm # cat max_map_count
Killed

This is because we have a chance to make 'max_map_count' negative. but
it's meaningless. Make it only accept non-negative values.

Reported-by: Jan Engelhardt <jen...@medozas.de>
Signed-off-by: WANG Cong <amw...@redhat.com>
Cc: Ingo Molnar <mi...@elte.hu>
Cc: Peter Zijlstra <a.p.zi...@chello.nl>
Cc: James Morris <jmo...@namei.org>
Cc: Alexey Dobriyan <adob...@gmail.com>


Signed-off-by: Andrew Morton <ak...@linux-foundation.org>
Signed-off-by: Linus Torvalds <torv...@linux-foundation.org>

Signed-off-by: Greg Kroah-Hartman <gre...@suse.de>

---
kernel/sysctl.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)

--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -1539,7 +1539,8 @@ static struct ctl_table debug_table[] =
.data = &show_unhandled_signals,
.maxlen = sizeof(int),
.mode = 0644,
- .proc_handler = proc_dointvec
+ .proc_handler = proc_dointvec,
+ .extra1 = &zero,
},
#endif
{ .ctl_name = 0 }

Greg KH

unread,
Dec 16, 2009, 8:26:05 PM12/16/09
to linux-...@vger.kernel.org, sta...@kernel.org, David Miller, stable...@kernel.org, torv...@linux-foundation.org, ak...@linux-foundation.org, al...@lxorguk.ukuu.org.uk, net...@vger.kernel.org, mar...@holtmann.org, Eric W. Biederman
2.6.31-stable review patch. If anyone has any objections, please let us know.

------------------

commit d90a909e1f3e006a1d57fe11fd417173b6494701 upstream.

I received some bug reports about userspace programs having problems
because after RTM_NEWLINK was received they could not immeidate
access files under /proc/sys/net/ because they had not been
registered yet.

The problem was trivailly fixed by moving the userspace
notification from rtnetlink_event to the end of register_netdevice.

Signed-off-by: Eric W. Biederman <ebie...@aristanetworks.com>
Cc: David Miller <da...@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gre...@suse.de>

---
net/core/dev.c | 11 +++++++++++
net/core/rtnetlink.c | 4 +---
2 files changed, 12 insertions(+), 3 deletions(-)

--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -4808,6 +4808,11 @@ int register_netdevice(struct net_device
rollback_registered(dev);
dev->reg_state = NETREG_UNREGISTERED;
}
+ /*
+ * Prevent userspace races by waiting until the network
+ * device is fully setup before sending notifications.
+ */
+ rtmsg_ifinfo(RTM_NEWLINK, dev, ~0U);

out:
return ret;
@@ -5343,6 +5348,12 @@ int dev_change_net_namespace(struct net_
/* Notify protocols, that a new device appeared. */
call_netdevice_notifiers(NETDEV_REGISTER, dev);

+ /*
+ * Prevent userspace races by waiting until the network
+ * device is fully setup before sending notifications.
+ */
+ rtmsg_ifinfo(RTM_NEWLINK, dev, ~0U);
+
synchronize_net();
err = 0;
out:
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -1347,13 +1347,11 @@ static int rtnetlink_event(struct notifi
case NETDEV_UNREGISTER:
rtmsg_ifinfo(RTM_DELLINK, dev, ~0U);
break;
- case NETDEV_REGISTER:
- rtmsg_ifinfo(RTM_NEWLINK, dev, ~0U);
- break;
case NETDEV_UP:
case NETDEV_DOWN:
rtmsg_ifinfo(RTM_NEWLINK, dev, IFF_UP|IFF_RUNNING);
break;
+ case NETDEV_REGISTER:
case NETDEV_CHANGE:
case NETDEV_GOING_DOWN:
break;

Greg KH

unread,
Dec 16, 2009, 8:26:44 PM12/16/09
to linux-...@vger.kernel.org, sta...@kernel.org, stable...@kernel.org, torv...@linux-foundation.org, ak...@linux-foundation.org, al...@lxorguk.ukuu.org.uk, David Woodhouse
2.6.31-stable review patch. If anyone has any objections, please let us know.

------------------

From: David Woodhouse <David.W...@intel.com>

commit 2e16cfca6e17ae37ae21feca080a6f2eca9087dc upstream.

Ever since jffs2_garbage_collect_metadata() was first half-written in
February 2001, it's been broken on architectures where 'char' is signed.
When garbage collecting a symlink with target length above 127, the payload
length would end up negative, causing interesting and bad things to happen.

Signed-off-by: David Woodhouse <David.W...@intel.com>
Signed-off-by: Greg Kroah-Hartman <gre...@suse.de>

---
fs/jffs2/gc.c | 3 ++-


1 file changed, 2 insertions(+), 1 deletion(-)

--- a/fs/jffs2/gc.c
+++ b/fs/jffs2/gc.c
@@ -700,7 +700,8 @@ static int jffs2_garbage_collect_metadat
struct jffs2_raw_inode ri;
struct jffs2_node_frag *last_frag;
union jffs2_device_node dev;
- char *mdata = NULL, mdatalen = 0;
+ char *mdata = NULL;
+ int mdatalen = 0;
uint32_t alloclen, ilen;
int ret;

Greg KH

unread,
Dec 16, 2009, 8:26:50 PM12/16/09
to linux-...@vger.kernel.org, sta...@kernel.org, stable...@kernel.org, torv...@linux-foundation.org, ak...@linux-foundation.org, al...@lxorguk.ukuu.org.uk, Jan Kara
2.6.31-stable review patch. If anyone has any objections, please let us know.

------------------

From: Jan Kara <ja...@suse.cz>

commit 68eb3db08344286733adac48304d9fb7a0e53b27 upstream.

When ext3_write_begin fails after allocating some blocks or
generic_perform_write fails to copy data to write, we truncate blocks already
instantiated beyond i_size. Although these blocks were never inside i_size, we
have to truncate pagecache of these blocks so that corresponding buffers get
unmapped. Otherwise subsequent __block_prepare_write (called because we are
retrying the write) will find the buffers mapped, not call ->get_block, and
thus the page will be backed by already freed blocks leading to filesystem and
data corruption.

Reported-by: James Y Knight <fo...@fuhm.net>
Signed-off-by: Jan Kara <ja...@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gre...@suse.de>

---
fs/ext3/inode.c | 18 ++++++++++++++----
1 file changed, 14 insertions(+), 4 deletions(-)

--- a/fs/ext3/inode.c
+++ b/fs/ext3/inode.c
@@ -1137,6 +1137,16 @@ static int do_journal_get_write_access(h
return ext3_journal_get_write_access(handle, bh);
}

+/*
+ * Truncate blocks that were not used by write. We have to truncate the
+ * pagecache as well so that corresponding buffers get properly unmapped.
+ */
+static void ext3_truncate_failed_write(struct inode *inode)
+{
+ truncate_inode_pages(inode->i_mapping, inode->i_size);
+ ext3_truncate(inode);
+}
+
static int ext3_write_begin(struct file *file, struct address_space *mapping,
loff_t pos, unsigned len, unsigned flags,
struct page **pagep, void **fsdata)
@@ -1195,7 +1205,7 @@ write_begin_failed:
unlock_page(page);
page_cache_release(page);
if (pos + len > inode->i_size)
- ext3_truncate(inode);
+ ext3_truncate_failed_write(inode);
}
if (ret == -ENOSPC && ext3_should_retry_alloc(inode->i_sb, &retries))
goto retry;
@@ -1290,7 +1300,7 @@ static int ext3_ordered_write_end(struct
page_cache_release(page);

if (pos + len > inode->i_size)
- ext3_truncate(inode);
+ ext3_truncate_failed_write(inode);
return ret ? ret : copied;
}

@@ -1316,7 +1326,7 @@ static int ext3_writeback_write_end(stru
page_cache_release(page);

if (pos + len > inode->i_size)
- ext3_truncate(inode);
+ ext3_truncate_failed_write(inode);
return ret ? ret : copied;
}

@@ -1369,7 +1379,7 @@ static int ext3_journalled_write_end(str
page_cache_release(page);

if (pos + len > inode->i_size)
- ext3_truncate(inode);
+ ext3_truncate_failed_write(inode);
return ret ? ret : copied;

Greg KH

unread,
Dec 16, 2009, 8:27:04 PM12/16/09
to linux-...@vger.kernel.org, sta...@kernel.org, stable...@kernel.org, torv...@linux-foundation.org, ak...@linux-foundation.org, al...@lxorguk.ukuu.org.uk, Deon van der Merwe, Julian Anastasov, Simon Horman, Patrick McHardy
2.6.31-stable review patch. If anyone has any objections, please let us know.

------------------

From: Simon Horman <ho...@verge.net.au>

commit 258c889362aa95d0ab534b38ce8c15d3009705b1 upstream.

Make sure that any otherwise uninitialised fields of usvc are zero.

This has been obvserved to cause a problem whereby the port of
fwmark services may end up as a non-zero value which causes
scheduling of a destination server to fail for persisitent services.

As observed by Deon van der Merwe <dv...@truteq.co.za>.
This fix suggested by Julian Anastasov <j...@ssi.bg>.

For good measure also zero udest.

Cc: Deon van der Merwe <dv...@truteq.co.za>
Acked-by: Julian Anastasov <j...@ssi.bg>
Signed-off-by: Simon Horman <ho...@verge.net.au>
Signed-off-by: Patrick McHardy <ka...@trash.net>
Signed-off-by: Greg Kroah-Hartman <gre...@suse.de>

---
net/netfilter/ipvs/ip_vs_ctl.c | 4 ++++
1 file changed, 4 insertions(+)

--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -2713,6 +2713,8 @@ static int ip_vs_genl_parse_service(stru
if (!(nla_af && (nla_fwmark || (nla_port && nla_protocol && nla_addr))))
return -EINVAL;

+ memset(usvc, 0, sizeof(*usvc));
+
usvc->af = nla_get_u16(nla_af);
#ifdef CONFIG_IP_VS_IPV6
if (usvc->af != AF_INET && usvc->af != AF_INET6)
@@ -2900,6 +2902,8 @@ static int ip_vs_genl_parse_dest(struct
if (!(nla_addr && nla_port))
return -EINVAL;

+ memset(udest, 0, sizeof(*udest));
+
nla_memcpy(&udest->addr, nla_addr, sizeof(udest->addr));
udest->port = nla_get_u16(nla_port);

Greg KH

unread,
Dec 16, 2009, 8:27:21 PM12/16/09
to linux-...@vger.kernel.org, sta...@kernel.org, stable...@kernel.org, torv...@linux-foundation.org, ak...@linux-foundation.org, al...@lxorguk.ukuu.org.uk, Zhenyu Wang, Eric Anholt
2.6.31-stable review patch. If anyone has any objections, please let us know.

------------------

From: Zhenyu Wang <zhe...@linux.intel.com>

commit 1b3c7a47f993bf9ab6c4c7cc3bbf5588052b58f4 upstream.

In disable sequence, all output ports on PCH have to be disabled
before PCH transcoder, but LVDS port was left always enabled. This
one fixes that by disable LVDS port properly during pipe disable
process, and resolved stability issue seen on Ironlake. Also move
panel fitting disable time just after pipe disable to align with
the spec.

Signed-off-by: Zhenyu Wang <zhe...@linux.intel.com>
Signed-off-by: Eric Anholt <er...@anholt.net>

Signed-off-by: Greg Kroah-Hartman <gre...@suse.de>

---
drivers/gpu/drm/i915/intel_display.c | 60 +++++++++++++++++++++++------------
1 file changed, 41 insertions(+), 19 deletions(-)

--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -1182,6 +1182,15 @@ static void igdng_crtc_dpms(struct drm_c
case DRM_MODE_DPMS_STANDBY:
case DRM_MODE_DPMS_SUSPEND:
DRM_DEBUG("crtc %d dpms on\n", pipe);
+
+ if (intel_pipe_has_type(crtc, INTEL_OUTPUT_LVDS)) {
+ temp = I915_READ(PCH_LVDS);
+ if ((temp & LVDS_PORT_EN) == 0) {
+ I915_WRITE(PCH_LVDS, temp | LVDS_PORT_EN);
+ POSTING_READ(PCH_LVDS);
+ }
+ }
+
if (HAS_eDP) {
/* enable eDP PLL */
igdng_enable_pll_edp(crtc);
@@ -1366,8 +1375,6 @@ static void igdng_crtc_dpms(struct drm_c
case DRM_MODE_DPMS_OFF:
DRM_DEBUG("crtc %d dpms off\n", pipe);

- i915_disable_vga(dev);
-
/* Disable display plane */
temp = I915_READ(dspcntr_reg);
if ((temp & DISPLAY_PLANE_ENABLE) != 0) {
@@ -1377,6 +1384,8 @@ static void igdng_crtc_dpms(struct drm_c
I915_READ(dspbase_reg);
}

+ i915_disable_vga(dev);
+
/* disable cpu pipe, disable after all planes disabled */
temp = I915_READ(pipeconf_reg);
if ((temp & PIPEACONF_ENABLE) != 0) {
@@ -1397,9 +1406,15 @@ static void igdng_crtc_dpms(struct drm_c
} else
DRM_DEBUG("crtc %d is disabled\n", pipe);

- if (HAS_eDP) {
- igdng_disable_pll_edp(crtc);
+ udelay(100);
+
+ /* Disable PF */
+ temp = I915_READ(pf_ctl_reg);
+ if ((temp & PF_ENABLE) != 0) {
+ I915_WRITE(pf_ctl_reg, temp & ~PF_ENABLE);
+ I915_READ(pf_ctl_reg);
}
+ I915_WRITE(pf_win_size, 0);

/* disable CPU FDI tx and PCH FDI rx */
temp = I915_READ(fdi_tx_reg);
@@ -1425,6 +1440,13 @@ static void igdng_crtc_dpms(struct drm_c

udelay(100);

+ if (intel_pipe_has_type(crtc, INTEL_OUTPUT_LVDS)) {
+ temp = I915_READ(PCH_LVDS);
+ I915_WRITE(PCH_LVDS, temp & ~LVDS_PORT_EN);
+ I915_READ(PCH_LVDS);
+ udelay(100);
+ }
+
/* disable PCH transcoder */
temp = I915_READ(transconf_reg);
if ((temp & TRANS_ENABLE) != 0) {
@@ -1444,6 +1466,8 @@ static void igdng_crtc_dpms(struct drm_c
}
}

+ udelay(100);
+
/* disable PCH DPLL */
temp = I915_READ(pch_dpll_reg);
if ((temp & DPLL_VCO_ENABLE) != 0) {
@@ -1451,14 +1475,20 @@ static void igdng_crtc_dpms(struct drm_c
I915_READ(pch_dpll_reg);
}

- temp = I915_READ(fdi_rx_reg);
- if ((temp & FDI_RX_PLL_ENABLE) != 0) {
- temp &= ~FDI_SEL_PCDCLK;
- temp &= ~FDI_RX_PLL_ENABLE;
- I915_WRITE(fdi_rx_reg, temp);
- I915_READ(fdi_rx_reg);
+ if (HAS_eDP) {
+ igdng_disable_pll_edp(crtc);
}

+ temp = I915_READ(fdi_rx_reg);
+ temp &= ~FDI_SEL_PCDCLK;
+ I915_WRITE(fdi_rx_reg, temp);
+ I915_READ(fdi_rx_reg);
+
+ temp = I915_READ(fdi_rx_reg);
+ temp &= ~FDI_RX_PLL_ENABLE;
+ I915_WRITE(fdi_rx_reg, temp);
+ I915_READ(fdi_rx_reg);
+
/* Disable CPU FDI TX PLL */
temp = I915_READ(fdi_tx_reg);
if ((temp & FDI_TX_PLL_ENABLE) != 0) {
@@ -1467,16 +1497,8 @@ static void igdng_crtc_dpms(struct drm_c
udelay(100);
}

- /* Disable PF */
- temp = I915_READ(pf_ctl_reg);
- if ((temp & PF_ENABLE) != 0) {
- I915_WRITE(pf_ctl_reg, temp & ~PF_ENABLE);
- I915_READ(pf_ctl_reg);
- }
- I915_WRITE(pf_win_size, 0);
-
/* Wait for the clocks to turn off. */
- udelay(150);
+ udelay(100);
break;

Greg KH

unread,
Dec 16, 2009, 8:27:41 PM12/16/09
to linux-...@vger.kernel.org, sta...@kernel.org, stable...@kernel.org, torv...@linux-foundation.org, ak...@linux-foundation.org, al...@lxorguk.ukuu.org.uk, Jan Beulich, Hidetoshi Seto, Ingo Molnar
2.6.31-stable review patch. If anyone has any objections, please let us know.

------------------

From: Jan Beulich <jbeu...@novell.com>

commit bc09effabf0c5c6c7021e5ef9af15a23579b32a8 upstream.

mce_timer must be passed to setup_timer() in all cases, no
matter whether it is going to be actually used. Otherwise, when
the CPU gets brought down, its call to del_timer_sync() will
never return, as the timer won't have a base associated, and
hence lock_timer_base() will loop infinitely.

Signed-off-by: Jan Beulich <jbeu...@novell.com>
Signed-off-by: Hidetoshi Seto <seto.hi...@jp.fujitsu.com>
LKML-Reference: <4B1DB831...@jp.fujitsu.com>
Signed-off-by: Ingo Molnar <mi...@elte.hu>
Signed-off-by: Greg Kroah-Hartman <gre...@suse.de>

---
arch/x86/kernel/cpu/mcheck/mce.c | 3 ++-


1 file changed, 2 insertions(+), 1 deletion(-)

--- a/arch/x86/kernel/cpu/mcheck/mce.c
+++ b/arch/x86/kernel/cpu/mcheck/mce.c
@@ -1327,13 +1327,14 @@ static void mce_init_timer(void)
struct timer_list *t = &__get_cpu_var(mce_timer);
int *n = &__get_cpu_var(next_interval);

+ setup_timer(t, mcheck_timer, smp_processor_id());
+
if (mce_ignore_ce)
return;

*n = check_interval * HZ;
if (!*n)
return;
- setup_timer(t, mcheck_timer, smp_processor_id());
t->expires = round_jiffies(jiffies + *n);
add_timer_on(t, smp_processor_id());

Greg KH

unread,
Dec 16, 2009, 8:27:53 PM12/16/09
to linux-...@vger.kernel.org, sta...@kernel.org, stable...@kernel.org, torv...@linux-foundation.org, ak...@linux-foundation.org, al...@lxorguk.ukuu.org.uk, Jean Delvare, Richard Purdie
2.6.31-stable review patch. If anyone has any objections, please let us know.

------------------

From: Jean Delvare <kh...@linux-fr.org>

commit 1e0fa6bd8c7468067f2e988c7a416dafd0651c34 upstream.

Which is why I have always preferred sizeof(struct foo) over
sizeof(var).

Signed-off-by: Jean Delvare <kh...@linux-fr.org>
Signed-off-by: Richard Purdie <rpu...@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gre...@suse.de>

---
drivers/video/backlight/lcd.c | 2 +-


1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/video/backlight/lcd.c
+++ b/drivers/video/backlight/lcd.c
@@ -56,7 +56,7 @@ static int fb_notifier_callback(struct n

static int lcd_register_fb(struct lcd_device *ld)
{
- memset(&ld->fb_notif, 0, sizeof(&ld->fb_notif));
+ memset(&ld->fb_notif, 0, sizeof(ld->fb_notif));
ld->fb_notif.notifier_call = fb_notifier_callback;
return fb_register_client(&ld->fb_notif);

Greg KH

unread,
Dec 16, 2009, 8:28:17 PM12/16/09
to linux-...@vger.kernel.org, sta...@kernel.org, stable...@kernel.org, torv...@linux-foundation.org, ak...@linux-foundation.org, al...@lxorguk.ukuu.org.uk, David S. Miller
2.6.31-stable review patch. If anyone has any objections, please let us know.

------------------


From: David S. Miller <da...@davemloft.net>

[ Upstream commit 166e553a575f09485f6d0df8a1ef3c5991f7d953 ]

Commit 4f70f7a91bffdcc39f088748dc678953eb9a3fbd
(sparc64: Implement IRQ stacks.) has two bugs.

First, the softirq range check forgets to subtract STACK_BIAS
before comparing with %sp. Next, on failure the wrong label
is jumped to, resulting in a bogus stack being loaded.

Reported-by: Igor Kovalenko <igor.v.k...@gmail.com>


Signed-off-by: David S. Miller <da...@davemloft.net>

Signed-off-by: Greg Kroah-Hartman <gre...@suse.de>
---

arch/sparc/lib/mcount.S | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)

--- a/arch/sparc/lib/mcount.S
+++ b/arch/sparc/lib/mcount.S
@@ -64,8 +64,9 @@ mcount:
2: sethi %hi(softirq_stack), %g3
or %g3, %lo(softirq_stack), %g3
ldx [%g3 + %g1], %g7
+ sub %g7, STACK_BIAS, %g7
cmp %sp, %g7
- bleu,pt %xcc, 2f
+ bleu,pt %xcc, 3f
sethi %hi(THREAD_SIZE), %g3
add %g7, %g3, %g7
cmp %sp, %g7
@@ -75,7 +76,7 @@ mcount:
* again, we are already trying to output the stack overflow
* message.
*/
- sethi %hi(ovstack), %g7 ! cant move to panic stack fast enough
+3: sethi %hi(ovstack), %g7 ! cant move to panic stack fast enough
or %g7, %lo(ovstack), %g7
add %g7, OVSTACKSIZE, %g3
sub %g3, STACK_BIAS + 192, %g3

Greg KH

unread,
Dec 16, 2009, 8:28:34 PM12/16/09
to linux-...@vger.kernel.org, sta...@kernel.org, stable...@kernel.org, torv...@linux-foundation.org, ak...@linux-foundation.org, al...@lxorguk.ukuu.org.uk, David S. Miller
2.6.31-stable review patch. If anyone has any objections, please let us know.

------------------


From: David S. Miller <da...@davemloft.net>

[ Upstream commit 08a036d583409e3517e3d15b7478d029b25f2cf2 ]

IRQF_SHARED and IRQF_DISABLED don't mix.

Signed-off-by: David S. Miller <da...@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gre...@suse.de>
---

arch/sparc/kernel/ldc.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)

--- a/arch/sparc/kernel/ldc.c
+++ b/arch/sparc/kernel/ldc.c
@@ -1242,13 +1242,13 @@ int ldc_bind(struct ldc_channel *lp, con
snprintf(lp->tx_irq_name, LDC_IRQ_NAME_MAX, "%s TX", name);

err = request_irq(lp->cfg.rx_irq, ldc_rx,
- IRQF_SAMPLE_RANDOM | IRQF_DISABLED | IRQF_SHARED,
+ IRQF_SAMPLE_RANDOM | IRQF_DISABLED,
lp->rx_irq_name, lp);
if (err)
return err;

err = request_irq(lp->cfg.tx_irq, ldc_tx,
- IRQF_SAMPLE_RANDOM | IRQF_DISABLED | IRQF_SHARED,
+ IRQF_SAMPLE_RANDOM | IRQF_DISABLED,
lp->tx_irq_name, lp);
if (err) {
free_irq(lp->cfg.rx_irq, lp);

Greg KH

unread,
Dec 16, 2009, 8:28:46 PM12/16/09
to linux-...@vger.kernel.org, sta...@kernel.org, Greg KH, stable...@kernel.org, torv...@linux-foundation.org, ak...@linux-foundation.org, al...@lxorguk.ukuu.org.uk, Yong Wang, Borislav Petkov, Arjan van de Ven, Ingo Molnar
2.6.31-stable review patch. If anyone has any objections, please let us know.

------------------

From: Yong Wang <yong....@linux.intel.com>

Upstream commit a2202aa29289db64ca7988b12343158b67b27f10.

On platforms where bios handles the thermal monitor interrupt,
APIC_LVTTHMR on each logical CPU is programmed to generate a SMI and OS
can't touch it.

Unfortunately AP bringup sequence using INIT-SIPI-SIPI clear all
the LVT entries except the mask bit. Essentially this results in
all LVT entries including the thermal monitoring interrupt set to masked
(clearing the bios programmed value for APIC_LVTTHMR).

And this leads to kernel take over the thermal monitoring interrupt
on AP's but not on BSP (leaving the bios programmed value only on BSP).

As a result of this, we have seen system hangs when the thermal
monitoring interrupt is generated.

Fix this by reading the initial value of thermal LVT entry on BSP
and if bios has taken over the control, then program the same value
on all AP's and leave the thermal monitoring interrupt control
on all the logical cpu's to the bios.

Signed-off-by: Yong Wang <yong....@intel.com>
Reviewed-by: Suresh Siddha <suresh....@intel.com>
Cc: Borislav Petkov <borisla...@amd.com>
Cc: Arjan van de Ven <ar...@infradead.org>
LKML-Reference: <20091110013...@ywang-moblin2.bj.intel.com>
Signed-off-by: Ingo Molnar <mi...@elte.hu>
Signed-off-by: Greg Kroah-Hartman <gre...@suse.de>

---
arch/x86/include/asm/mce.h | 6 ++++++
arch/x86/kernel/cpu/mcheck/therm_throt.c | 29 ++++++++++++++++++++++++++++-
arch/x86/kernel/setup.c | 3 +++
3 files changed, 37 insertions(+), 1 deletion(-)

--- a/arch/x86/include/asm/mce.h
+++ b/arch/x86/include/asm/mce.h
@@ -214,5 +214,11 @@ void mce_log_therm_throt_event(__u64 sta
static inline void mce_log_therm_throt_event(__u64 status) {}
#endif

+#ifdef CONFIG_X86_THERMAL_VECTOR
+extern void mcheck_intel_therm_init(void);
+#else
+static inline void mcheck_intel_therm_init(void) { }
+#endif
+
#endif /* __KERNEL__ */
#endif /* _ASM_X86_MCE_H */
--- a/arch/x86/kernel/cpu/mcheck/therm_throt.c
+++ b/arch/x86/kernel/cpu/mcheck/therm_throt.c
@@ -49,6 +49,8 @@ static DEFINE_PER_CPU(struct thermal_sta

static atomic_t therm_throt_en = ATOMIC_INIT(0);

+static u32 lvtthmr_init __read_mostly;
+
#ifdef CONFIG_SYSFS
#define define_therm_throt_sysdev_one_ro(_name) \
static SYSDEV_ATTR(_name, 0444, therm_throt_sysdev_show_##_name, NULL)
@@ -254,6 +256,18 @@ asmlinkage void smp_thermal_interrupt(st
ack_APIC_irq();
}

+void __init mcheck_intel_therm_init(void)
+{
+ /*
+ * This function is only called on boot CPU. Save the init thermal
+ * LVT value on BSP and use that value to restore APs' thermal LVT
+ * entry BIOS programmed later
+ */
+ if (cpu_has(&boot_cpu_data, X86_FEATURE_ACPI) &&
+ cpu_has(&boot_cpu_data, X86_FEATURE_ACC))
+ lvtthmr_init = apic_read(APIC_LVTTHMR);
+}
+
void intel_init_thermal(struct cpuinfo_x86 *c)
{
unsigned int cpu = smp_processor_id();
@@ -270,7 +284,20 @@ void intel_init_thermal(struct cpuinfo_x
* since it might be delivered via SMI already:
*/
rdmsr(MSR_IA32_MISC_ENABLE, l, h);
- h = apic_read(APIC_LVTTHMR);
+
+ /*
+ * The initial value of thermal LVT entries on all APs always reads
+ * 0x10000 because APs are woken up by BSP issuing INIT-SIPI-SIPI
+ * sequence to them and LVT registers are reset to 0s except for
+ * the mask bits which are set to 1s when APs receive INIT IPI.
+ * Always restore the value that BIOS has programmed on AP based on
+ * BSP's info we saved since BIOS is always setting the same value
+ * for all threads/cores
+ */
+ apic_write(APIC_LVTTHMR, lvtthmr_init);
+
+ h = lvtthmr_init;
+
if ((l & MSR_IA32_MISC_ENABLE_TM1) && (h & APIC_DM_SMI)) {
printk(KERN_DEBUG
"CPU%d: Thermal monitoring handled by SMI\n", cpu);
--- a/arch/x86/kernel/setup.c
+++ b/arch/x86/kernel/setup.c
@@ -107,6 +107,7 @@
#ifdef CONFIG_X86_64
#include <asm/numa_64.h>
#endif
+#include <asm/mce.h>

#ifndef ARCH_SETUP
#define ARCH_SETUP
@@ -1030,6 +1031,8 @@ void __init setup_arch(char **cmdline_p)
conswitchp = &dummy_con;
#endif
#endif
+
+ mcheck_intel_therm_init();
}

#ifdef CONFIG_X86_32

Greg KH

unread,
Dec 16, 2009, 8:29:25 PM12/16/09
to linux-...@vger.kernel.org, sta...@kernel.org, stable...@kernel.org, torv...@linux-foundation.org, ak...@linux-foundation.org, al...@lxorguk.ukuu.org.uk, Larry Finger, John W. Linville
2.6.31-stable review patch. If anyone has any objections, please let us know.

------------------

From: Larry Finger <Larry....@lwfinger.net>

commit 21d6c270f11c7d0ab5aafa48a6e79ba514f4e5e7 upstream.

On 2.6.32-rc6 from wireless-testing, the following warning is emitted:

------------[ cut here ]------------
WARNING: at lib/dma-debug.c:860 check_for_stack+0xaa/0xe0()
Hardware name: HP Pavilion dv2700 Notebook PC
ehci_hcd 0000:00:02.1: DMA-API: device driver maps memory fromstack
[addr=ffff8800b6e2bca8]
Modules linked in: <Removed>
Pid: 16378, comm: modprobe Not tainted 2.6.32-rc6-wl #244
Call Trace:
[<ffffffff81049698>] warn_slowpath_common+0x78/0xb0
[<ffffffff8104972c>] warn_slowpath_fmt+0x3c/0x40
[<ffffffff811ae52a>] check_for_stack+0xaa/0xe0
[<ffffffff811afc8d>] debug_dma_map_page+0xfd/0x170
[<ffffffffa006297a>] usb_hcd_submit_urb+0x3da/0x9c0 [usbcore]
[<ffffffff81076e6f>] ? lockdep_init_map+0x5f/0x5d0
[<ffffffffa0063365>] usb_submit_urb+0xe5/0x260 [usbcore]
[<ffffffffa0064b7e>] usb_start_wait_urb+0x5e/0xf0 [usbcore]
[<ffffffffa0063943>] ? usb_init_urb+0x23/0x40 [usbcore]
[<ffffffffa0064cd4>] usb_bulk_msg+0xc4/0x150 [usbcore]
[<ffffffffa0441a91>] T.719+0x31/0x40 [p54usb]
[<ffffffffa0441acf>] p54u_upload_firmware_3887+0x2f/0x490 [p54usb]
[<ffffffffa049c667>] ? p54_parse_firmware+0x427/0x450 [p54common]
<Rest of traceback removed>
---[ end trace f77df0316ddad3de ]---

Signed-off-by: Larry Finger <Larry....@lwfinger.net>


Signed-off-by: John W. Linville <linv...@tuxdriver.com>

Signed-off-by: Greg Kroah-Hartman <gre...@suse.de>

---
drivers/net/wireless/p54/p54usb.c | 10 +++++++---
1 file changed, 7 insertions(+), 3 deletions(-)

--- a/drivers/net/wireless/p54/p54usb.c
+++ b/drivers/net/wireless/p54/p54usb.c
@@ -427,12 +427,16 @@ static const char p54u_romboot_3887[] =
static int p54u_firmware_reset_3887(struct ieee80211_hw *dev)
{
struct p54u_priv *priv = dev->priv;
- u8 buf[4];
+ u8 *buf;
int ret;

- memcpy(&buf, p54u_romboot_3887, sizeof(buf));
+ buf = kmalloc(4, GFP_KERNEL);
+ if (!buf)
+ return -ENOMEM;
+ memcpy(buf, p54u_romboot_3887, 4);
ret = p54u_bulk_msg(priv, P54U_PIPE_DATA,
- buf, sizeof(buf));
+ buf, 4);
+ kfree(buf);
if (ret)
dev_err(&priv->udev->dev, "(p54usb) unable to jump to "
"boot ROM (%d)!\n", ret);

Greg KH

unread,
Dec 16, 2009, 8:29:37 PM12/16/09
to linux-...@vger.kernel.org, sta...@kernel.org, stable...@kernel.org, torv...@linux-foundation.org, ak...@linux-foundation.org, al...@lxorguk.ukuu.org.uk, David S. Miller
2.6.31-stable review patch. If anyone has any objections, please let us know.

------------------


From: David S. Miller <da...@davemloft.net>

[ Upstream commit be24656a5e2d68bfd0744f0742c4aceef2cf44b5 ]

Be like the other Sun serial drivers otherwise the special handling of
OpenFirmware options and hard-coded overrides for LOM/RSC consoles
will not be handled.

Signed-off-by: David S. Miller <da...@davemloft.net>

Signed-off-by: Greg Kroah-Hartman <gre...@suse.de>
---

drivers/serial/sunsu.c | 17 ++++++++++-------
1 file changed, 10 insertions(+), 7 deletions(-)

--- a/drivers/serial/sunsu.c
+++ b/drivers/serial/sunsu.c
@@ -1329,11 +1329,9 @@ static void sunsu_console_write(struct c
*/
static int __init sunsu_console_setup(struct console *co, char *options)
{
+ static struct ktermios dummy;
+ struct ktermios termios;
struct uart_port *port;
- int baud = 9600;
- int bits = 8;
- int parity = 'n';
- int flow = 'n';

printk("Console: ttyS%d (SU)\n",
(sunsu_reg.minor - 64) + co->index);
@@ -1352,10 +1350,15 @@ static int __init sunsu_console_setup(st
*/
spin_lock_init(&port->lock);

- if (options)
- uart_parse_options(options, &baud, &parity, &bits, &flow);
+ /* Get firmware console settings. */
+ sunserial_console_termios(co, to_of_device(port->dev)->node);

- return uart_set_options(port, co, baud, parity, bits, flow);
+ memset(&termios, 0, sizeof(struct ktermios));
+ termios.c_cflag = co->cflag;
+ port->mctrl |= TIOCM_DTR;
+ port->ops->set_termios(port, &termios, &dummy);
+
+ return 0;
}

static struct console sunsu_console = {

Greg KH

unread,
Dec 16, 2009, 8:29:46 PM12/16/09
to linux-...@vger.kernel.org, sta...@kernel.org, stable...@kernel.org, torv...@linux-foundation.org, ak...@linux-foundation.org, al...@lxorguk.ukuu.org.uk, Larry Finger, John W. Linville
2.6.31-stable review patch. If anyone has any objections, please let us know.

------------------

From: Larry Finger <Larry....@lwfinger.net>

commit 316a4d966cae3c2dec83ebb1ee1a3515f97b30ff upstream.

For PPC architecture with PHY Revision < 3, a read of the register
B43_MMIO_HWENABLED_LO will cause a CPU fault unless b43legacy_status()
returns a value of 2 (B43legacy_STAT_STARTED); however, one finds that
the driver is unable to associate after resuming from hibernation unless
this routine returns 1. To satisfy both conditions, the routine is rewritten
to return TRUE whenever b43legacy_status() returns a value < 2.

This patch fixes the second problem listed in the postings for Red Hat
Bugzilla #538523.

Signed-off-by: Larry Finger <Larry....@lwfinger.net>
Signed-off-by: John W. Linville <linv...@tuxdriver.com>

Signed-off-by: Greg Kroah-Hartman <gre...@suse.de>

---
drivers/net/wireless/b43legacy/rfkill.c | 7 +++++++
1 file changed, 7 insertions(+)

--- a/drivers/net/wireless/b43legacy/rfkill.c
+++ b/drivers/net/wireless/b43legacy/rfkill.c
@@ -34,6 +34,13 @@ bool b43legacy_is_hw_radio_enabled(struc
& B43legacy_MMIO_RADIO_HWENABLED_HI_MASK))
return 1;
} else {
+ /* To prevent CPU fault on PPC, do not read a register
+ * unless the interface is started; however, on resume
+ * for hibernation, this routine is entered early. When
+ * that happens, unconditionally return TRUE.
+ */
+ if (b43legacy_status(dev) < B43legacy_STAT_STARTED)
+ return 1;
if (b43legacy_read16(dev, B43legacy_MMIO_RADIO_HWENABLED_LO)
& B43legacy_MMIO_RADIO_HWENABLED_LO_MASK)
return 1;

Greg KH

unread,
Dec 16, 2009, 8:29:58 PM12/16/09
to linux-...@vger.kernel.org, sta...@kernel.org, stable...@kernel.org, torv...@linux-foundation.org, ak...@linux-foundation.org, al...@lxorguk.ukuu.org.uk, David S. Miller
2.6.31-stable review patch. If anyone has any objections, please let us know.

------------------


From: David S. Miller <da...@davemloft.net>

[ Upstream commit 8301d386afc55c877bafe2c6c7dc75a96ddd2838 ]

These device nodes are named "rsc-console" and "rsc-control" rather
than 'serial', but the device_type property is 'serial' so we'll
tip off of that for detection.

Signed-off-by: David S. Miller <da...@davemloft.net>

Signed-off-by: Greg Kroah-Hartman <gre...@suse.de>
---

drivers/serial/sunsu.c | 10 ++++++++++
1 file changed, 10 insertions(+)

--- a/drivers/serial/sunsu.c
+++ b/drivers/serial/sunsu.c
@@ -1517,6 +1517,10 @@ static const struct of_device_id su_matc
.name = "serial",
.compatible = "su",
},
+ {
+ .type = "serial",
+ .compatible = "su",
+ },
{},
};
MODULE_DEVICE_TABLE(of, su_match);
@@ -1548,6 +1552,12 @@ static int __init sunsu_init(void)
num_uart++;
}
}
+ for_each_node_by_type(dp, "serial") {
+ if (of_device_is_compatible(dp, "su")) {
+ if (su_get_type(dp) == SU_PORT_PORT)
+ num_uart++;
+ }
+ }

if (num_uart) {
err = sunserial_register_minors(&sunsu_reg, num_uart);

Greg KH

unread,
Dec 16, 2009, 8:30:52 PM12/16/09
to linux-...@vger.kernel.org, sta...@kernel.org, stable...@kernel.org, torv...@linux-foundation.org, ak...@linux-foundation.org, al...@lxorguk.ukuu.org.uk, David S. Miller
2.6.31-stable review patch. If anyone has any objections, please let us know.

------------------


From: David S. Miller <da...@davemloft.net>

[ Upstream commit 4230fa3b89ea1c413766bd411a8315a3d05aa6c7 ]

When we are trying to see if a range property entry applies
to a given address, we are overly strict about the type.

We should only allow I/O ranges for I/O addresses, and only allow
CONFIG space ranges for CONFIG space address.

However for MEM ranges, they come in 32-bit and 64-bit flavors.
And a lack of an exact match is OK if the range is 32-bit and
the address is 64-bit. We can assign a 64-bit address properly
into a 32-bit parent range just fine.

So allow it.

Reported-by: Patrick Finnegan <p...@computer-refuge.org>


Signed-off-by: David S. Miller <da...@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gre...@suse.de>
---

arch/sparc/kernel/of_device_64.c | 14 ++++++++++++--
1 file changed, 12 insertions(+), 2 deletions(-)

--- a/arch/sparc/kernel/of_device_64.c
+++ b/arch/sparc/kernel/of_device_64.c
@@ -104,9 +104,19 @@ static int of_bus_pci_map(u32 *addr, con
int i;

/* Check address type match */
- if ((addr[0] ^ range[0]) & 0x03000000)
- return -EINVAL;
+ if (!((addr[0] ^ range[0]) & 0x03000000))
+ goto type_match;
+
+ /* Special exception, we can map a 64-bit address into
+ * a 32-bit range.
+ */
+ if ((addr[0] & 0x03000000) == 0x03000000 &&
+ (range[0] & 0x03000000) == 0x02000000)
+ goto type_match;
+
+ return -EINVAL;

+type_match:
if (of_out_of_range(addr + 1, range + 1, range + na + pna,
na - 1, ns))
return -EINVAL;

Greg KH

unread,
Dec 16, 2009, 8:31:07 PM12/16/09
to linux-...@vger.kernel.org, sta...@kernel.org, stable...@kernel.org, torv...@linux-foundation.org, ak...@linux-foundation.org, al...@lxorguk.ukuu.org.uk, Steve Glendinning, David S. Miller
2.6.31-stable review patch. If anyone has any objections, please let us know.

------------------


From: Steve Glendinning <steve.gl...@smsc.com>

[ Upstream commit 6c53b1b15e222244358d3cbbefd2a13920faa352 ]

This patch fixes a null pointer dereference BUG() if ethtool is used on
an smsc9420 interface while it is down, because the phy_dev is only
allocated while the interface is up.

Signed-off-by: Steve Glendinning <steve.gl...@smsc.com>


Signed-off-by: David S. Miller <da...@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gre...@suse.de>
---

drivers/net/smsc9420.c | 14 ++++++++++++++
1 file changed, 14 insertions(+)

--- a/drivers/net/smsc9420.c
+++ b/drivers/net/smsc9420.c
@@ -252,6 +252,9 @@ static int smsc9420_ethtool_get_settings
{
struct smsc9420_pdata *pd = netdev_priv(dev);

+ if (!pd->phy_dev)
+ return -ENODEV;
+
cmd->maxtxpkt = 1;
cmd->maxrxpkt = 1;
return phy_ethtool_gset(pd->phy_dev, cmd);
@@ -262,6 +265,9 @@ static int smsc9420_ethtool_set_settings
{
struct smsc9420_pdata *pd = netdev_priv(dev);

+ if (!pd->phy_dev)
+ return -ENODEV;
+
return phy_ethtool_sset(pd->phy_dev, cmd);
}

@@ -290,6 +296,10 @@ static void smsc9420_ethtool_set_msgleve
static int smsc9420_ethtool_nway_reset(struct net_device *netdev)
{
struct smsc9420_pdata *pd = netdev_priv(netdev);
+
+ if (!pd->phy_dev)
+ return -ENODEV;
+
return phy_start_aneg(pd->phy_dev);
}

@@ -312,6 +322,10 @@ smsc9420_ethtool_getregs(struct net_devi
for (i = 0; i < 0x100; i += (sizeof(u32)))
data[j++] = smsc9420_reg_read(pd, i);

+ // cannot read phy registers if the net device is down
+ if (!phy_dev)
+ return;
+
for (i = 0; i <= 31; i++)
data[j++] = smsc9420_mii_read(phy_dev->bus, phy_dev->addr, i);

Greg KH

unread,
Dec 16, 2009, 8:31:41 PM12/16/09
to linux-...@vger.kernel.org, sta...@kernel.org, stable...@kernel.org, torv...@linux-foundation.org, ak...@linux-foundation.org, al...@lxorguk.ukuu.org.uk, Russell King, Eric Miao, David S. Miller
2.6.31-stable review patch. If anyone has any objections, please let us know.

------------------


From: Russell King - ARM Linux <li...@arm.linux.org.uk>

[ Upstream commit d5ccd67bb77ced5249067d05171992a7d5020393 ]

smc91x.h defines SMC_IRQ_FLAGS to be -1 when it wants the interrupt
flags to be taken from the resource structure. However, d280ead
changed this to checking for non-zero resource flags.

Unfortunately, this means that on some platforms, we end up passing
'-1' to request_irq rather than the desired result. Combine the two
conditions into one so that the IRQ flags are taken from the resource
if either SMC_IRQ_FLAGS is -1 or the resource flags specify an
interrupt trigger.

This restores network on at least the Versatile platform.

Signed-off-by: Russell King <rmk+k...@arm.linux.org.uk>
Acked-by: Eric Miao <eric....@gmail.com>


Signed-off-by: David S. Miller <da...@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gre...@suse.de>
---

drivers/net/smc91x.c | 2 +-


1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/net/smc91x.c
+++ b/drivers/net/smc91x.c
@@ -2283,7 +2283,7 @@ static int __devinit smc_drv_probe(struc

ndev->irq = ires->start;

- if (ires->flags & IRQF_TRIGGER_MASK)
+ if (irq_flags == -1 || ires->flags & IRQF_TRIGGER_MASK)
irq_flags = ires->flags & IRQF_TRIGGER_MASK;

ret = smc_request_attrib(pdev, ndev);

Greg KH

unread,
Dec 16, 2009, 8:31:53 PM12/16/09
to linux-...@vger.kernel.org, sta...@kernel.org, stable...@kernel.org, torv...@linux-foundation.org, ak...@linux-foundation.org, al...@lxorguk.ukuu.org.uk, David S. Miller
2.6.31-stable review patch. If anyone has any objections, please let us know.

------------------


From: David S. Miller <da...@davemloft.net>

[ Upstream commit e29d4363174949a7a4e46f670993d7ff43342c1c ]

This reverts commit 38783e671399b5405f1fd177d602c400a9577ae6.

It causes kernel bugzilla #14594

Signed-off-by: David S. Miller <da...@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gre...@suse.de>
---

drivers/isdn/i4l/isdn_ppp.c | 348 ++++++++++++++++++++------------------------
include/linux/isdn_ppp.h | 2
2 files changed, 162 insertions(+), 188 deletions(-)

--- a/drivers/isdn/i4l/isdn_ppp.c
+++ b/drivers/isdn/i4l/isdn_ppp.c
@@ -1535,10 +1535,8 @@ static int isdn_ppp_mp_bundle_array_init
int sz = ISDN_MAX_CHANNELS*sizeof(ippp_bundle);
if( (isdn_ppp_bundle_arr = kzalloc(sz, GFP_KERNEL)) == NULL )
return -ENOMEM;
- for (i = 0; i < ISDN_MAX_CHANNELS; i++) {
+ for( i = 0; i < ISDN_MAX_CHANNELS; i++ )
spin_lock_init(&isdn_ppp_bundle_arr[i].lock);
- skb_queue_head_init(&isdn_ppp_bundle_arr[i].frags);
- }
return 0;
}

@@ -1571,7 +1569,7 @@ static int isdn_ppp_mp_init( isdn_net_lo
if ((lp->netdev->pb = isdn_ppp_mp_bundle_alloc()) == NULL)
return -ENOMEM;
lp->next = lp->last = lp; /* nobody else in a queue */
- skb_queue_head_init(&lp->netdev->pb->frags);
+ lp->netdev->pb->frags = NULL;
lp->netdev->pb->frames = 0;
lp->netdev->pb->seq = UINT_MAX;
}
@@ -1583,29 +1581,28 @@ static int isdn_ppp_mp_init( isdn_net_lo

static u32 isdn_ppp_mp_get_seq( int short_seq,
struct sk_buff * skb, u32 last_seq );
-static void isdn_ppp_mp_discard(ippp_bundle *mp, struct sk_buff *from,
- struct sk_buff *to);
-static void isdn_ppp_mp_reassembly(isdn_net_dev *net_dev, isdn_net_local *lp,
- struct sk_buff *from, struct sk_buff *to,
- u32 lastseq);
-static void isdn_ppp_mp_free_skb(ippp_bundle *mp, struct sk_buff *skb);
+static struct sk_buff * isdn_ppp_mp_discard( ippp_bundle * mp,
+ struct sk_buff * from, struct sk_buff * to );
+static void isdn_ppp_mp_reassembly( isdn_net_dev * net_dev, isdn_net_local * lp,
+ struct sk_buff * from, struct sk_buff * to );
+static void isdn_ppp_mp_free_skb( ippp_bundle * mp, struct sk_buff * skb );
static void isdn_ppp_mp_print_recv_pkt( int slot, struct sk_buff * skb );

static void isdn_ppp_mp_receive(isdn_net_dev * net_dev, isdn_net_local * lp,
- struct sk_buff *skb)
+ struct sk_buff *skb)
{
- struct sk_buff *newfrag, *frag, *start, *nextf;
- u32 newseq, minseq, thisseq;
- isdn_mppp_stats *stats;
struct ippp_struct *is;
+ isdn_net_local * lpq;
+ ippp_bundle * mp;
+ isdn_mppp_stats * stats;
+ struct sk_buff * newfrag, * frag, * start, *nextf;
+ u32 newseq, minseq, thisseq;
unsigned long flags;
- isdn_net_local *lpq;
- ippp_bundle *mp;
int slot;

spin_lock_irqsave(&net_dev->pb->lock, flags);
- mp = net_dev->pb;
- stats = &mp->stats;
+ mp = net_dev->pb;
+ stats = &mp->stats;
slot = lp->ppp_slot;
if (slot < 0 || slot >= ISDN_MAX_CHANNELS) {
printk(KERN_ERR "%s: lp->ppp_slot(%d)\n",
@@ -1616,19 +1613,20 @@ static void isdn_ppp_mp_receive(isdn_net
return;
}
is = ippp_table[slot];
- if (++mp->frames > stats->max_queue_len)
+ if( ++mp->frames > stats->max_queue_len )
stats->max_queue_len = mp->frames;
-
+
if (is->debug & 0x8)
isdn_ppp_mp_print_recv_pkt(lp->ppp_slot, skb);

- newseq = isdn_ppp_mp_get_seq(is->mpppcfg & SC_IN_SHORT_SEQ,
- skb, is->last_link_seqno);
+ newseq = isdn_ppp_mp_get_seq(is->mpppcfg & SC_IN_SHORT_SEQ,
+ skb, is->last_link_seqno);
+

/* if this packet seq # is less than last already processed one,
* toss it right away, but check for sequence start case first
*/
- if (mp->seq > MP_LONGSEQ_MAX && (newseq & MP_LONGSEQ_MAXBIT)) {
+ if( mp->seq > MP_LONGSEQ_MAX && (newseq & MP_LONGSEQ_MAXBIT) ) {
mp->seq = newseq; /* the first packet: required for
* rfc1990 non-compliant clients --
* prevents constant packet toss */
@@ -1638,7 +1636,7 @@ static void isdn_ppp_mp_receive(isdn_net
spin_unlock_irqrestore(&mp->lock, flags);
return;
}
-
+
/* find the minimum received sequence number over all links */
is->last_link_seqno = minseq = newseq;
for (lpq = net_dev->queue;;) {
@@ -1659,31 +1657,22 @@ static void isdn_ppp_mp_receive(isdn_net
* packets */
newfrag = skb;

- /* Insert new fragment into the proper sequence slot. */
- skb_queue_walk(&mp->frags, frag) {
- if (MP_SEQ(frag) == newseq) {
- isdn_ppp_mp_free_skb(mp, newfrag);
- newfrag = NULL;
- break;
- }
- if (MP_LT(newseq, MP_SEQ(frag))) {
- __skb_queue_before(&mp->frags, frag, newfrag);
- newfrag = NULL;
- break;
- }
- }
- if (newfrag)
- __skb_queue_tail(&mp->frags, newfrag);
+ /* if this new fragment is before the first one, then enqueue it now. */
+ if ((frag = mp->frags) == NULL || MP_LT(newseq, MP_SEQ(frag))) {
+ newfrag->next = frag;
+ mp->frags = frag = newfrag;
+ newfrag = NULL;
+ }

- frag = skb_peek(&mp->frags);
- start = ((MP_FLAGS(frag) & MP_BEGIN_FRAG) &&
- (MP_SEQ(frag) == mp->seq)) ? frag : NULL;
- if (!start)
- goto check_overflow;
+ start = MP_FLAGS(frag) & MP_BEGIN_FRAG &&
+ MP_SEQ(frag) == mp->seq ? frag : NULL;

- /* main fragment traversing loop
+ /*
+ * main fragment traversing loop
*
* try to accomplish several tasks:
+ * - insert new fragment into the proper sequence slot (once that's done
+ * newfrag will be set to NULL)
* - reassemble any complete fragment sequence (non-null 'start'
* indicates there is a continguous sequence present)
* - discard any incomplete sequences that are below minseq -- due
@@ -1692,46 +1681,71 @@ static void isdn_ppp_mp_receive(isdn_net
* come to complete such sequence and it should be discarded
*
* loop completes when we accomplished the following tasks:
+ * - new fragment is inserted in the proper sequence ('newfrag' is
+ * set to NULL)
* - we hit a gap in the sequence, so no reassembly/processing is
* possible ('start' would be set to NULL)
*
* algorithm for this code is derived from code in the book
* 'PPP Design And Debugging' by James Carlson (Addison-Wesley)
*/
- skb_queue_walk_safe(&mp->frags, frag, nextf) {
- thisseq = MP_SEQ(frag);
+ while (start != NULL || newfrag != NULL) {

- /* check for misplaced start */
- if (start != frag && (MP_FLAGS(frag) & MP_BEGIN_FRAG)) {
- printk(KERN_WARNING"isdn_mppp(seq %d): new "
- "BEGIN flag with no prior END", thisseq);
- stats->seqerrs++;
- stats->frame_drops++;
- isdn_ppp_mp_discard(mp, start, frag);
- start = frag;
- } else if (MP_LE(thisseq, minseq)) {
- if (MP_FLAGS(frag) & MP_BEGIN_FRAG)
+ thisseq = MP_SEQ(frag);
+ nextf = frag->next;
+
+ /* drop any duplicate fragments */
+ if (newfrag != NULL && thisseq == newseq) {
+ isdn_ppp_mp_free_skb(mp, newfrag);
+ newfrag = NULL;
+ }
+
+ /* insert new fragment before next element if possible. */
+ if (newfrag != NULL && (nextf == NULL ||
+ MP_LT(newseq, MP_SEQ(nextf)))) {
+ newfrag->next = nextf;
+ frag->next = nextf = newfrag;
+ newfrag = NULL;
+ }
+
+ if (start != NULL) {
+ /* check for misplaced start */
+ if (start != frag && (MP_FLAGS(frag) & MP_BEGIN_FRAG)) {
+ printk(KERN_WARNING"isdn_mppp(seq %d): new "
+ "BEGIN flag with no prior END", thisseq);
+ stats->seqerrs++;
+ stats->frame_drops++;
+ start = isdn_ppp_mp_discard(mp, start,frag);
+ nextf = frag->next;
+ }
+ } else if (MP_LE(thisseq, minseq)) {
+ if (MP_FLAGS(frag) & MP_BEGIN_FRAG)
start = frag;
- else {
+ else {
if (MP_FLAGS(frag) & MP_END_FRAG)
- stats->frame_drops++;
- __skb_unlink(skb, &mp->frags);
+ stats->frame_drops++;
+ if( mp->frags == frag )
+ mp->frags = nextf;
isdn_ppp_mp_free_skb(mp, frag);
+ frag = nextf;
continue;
- }
+ }
}
-
- /* if we have end fragment, then we have full reassembly
- * sequence -- reassemble and process packet now
+
+ /* if start is non-null and we have end fragment, then
+ * we have full reassembly sequence -- reassemble
+ * and process packet now
*/
- if (MP_FLAGS(frag) & MP_END_FRAG) {
- minseq = mp->seq = (thisseq+1) & MP_LONGSEQ_MASK;
- /* Reassemble the packet then dispatch it */
- isdn_ppp_mp_reassembly(net_dev, lp, start, frag, thisseq);
+ if (start != NULL && (MP_FLAGS(frag) & MP_END_FRAG)) {
+ minseq = mp->seq = (thisseq+1) & MP_LONGSEQ_MASK;
+ /* Reassemble the packet then dispatch it */
+ isdn_ppp_mp_reassembly(net_dev, lp, start, nextf);
+
+ start = NULL;
+ frag = NULL;

- start = NULL;
- frag = NULL;
- }
+ mp->frags = nextf;
+ }

/* check if need to update start pointer: if we just
* reassembled the packet and sequence is contiguous
@@ -1742,25 +1756,26 @@ static void isdn_ppp_mp_receive(isdn_net
* below low watermark and set start to the next frag or
* clear start ptr.
*/
- if (nextf != (struct sk_buff *)&mp->frags &&
+ if (nextf != NULL &&
((thisseq+1) & MP_LONGSEQ_MASK) == MP_SEQ(nextf)) {
- /* if we just reassembled and the next one is here,
- * then start another reassembly.
- */
- if (frag == NULL) {
+ /* if we just reassembled and the next one is here,
+ * then start another reassembly. */
+
+ if (frag == NULL) {
if (MP_FLAGS(nextf) & MP_BEGIN_FRAG)
- start = nextf;
- else {
- printk(KERN_WARNING"isdn_mppp(seq %d):"
- " END flag with no following "
- "BEGIN", thisseq);
+ start = nextf;
+ else
+ {
+ printk(KERN_WARNING"isdn_mppp(seq %d):"
+ " END flag with no following "
+ "BEGIN", thisseq);
stats->seqerrs++;
}
}
- } else {
- if (nextf != (struct sk_buff *)&mp->frags &&
- frag != NULL &&
- MP_LT(thisseq, minseq)) {
+
+ } else {
+ if ( nextf != NULL && frag != NULL &&
+ MP_LT(thisseq, minseq)) {
/* we've got a break in the sequence
* and we not at the end yet
* and we did not just reassembled
@@ -1769,39 +1784,41 @@ static void isdn_ppp_mp_receive(isdn_net
* discard all the frames below low watermark
* and start over */
stats->frame_drops++;
- isdn_ppp_mp_discard(mp, start, nextf);
+ mp->frags = isdn_ppp_mp_discard(mp,start,nextf);
}
/* break in the sequence, no reassembly */
- start = NULL;
- }
- if (!start)
- break;
- }
-
-check_overflow:
+ start = NULL;
+ }
+
+ frag = nextf;
+ } /* while -- main loop */
+
+ if (mp->frags == NULL)
+ mp->frags = frag;
+
/* rather straighforward way to deal with (not very) possible
- * queue overflow
- */
+ * queue overflow */
if (mp->frames > MP_MAX_QUEUE_LEN) {
stats->overflows++;
- skb_queue_walk_safe(&mp->frags, frag, nextf) {
- if (mp->frames <= MP_MAX_QUEUE_LEN)
- break;
- __skb_unlink(frag, &mp->frags);
- isdn_ppp_mp_free_skb(mp, frag);
+ while (mp->frames > MP_MAX_QUEUE_LEN) {
+ frag = mp->frags->next;
+ isdn_ppp_mp_free_skb(mp, mp->frags);
+ mp->frags = frag;
}
}
spin_unlock_irqrestore(&mp->lock, flags);
}

-static void isdn_ppp_mp_cleanup(isdn_net_local *lp)
+static void isdn_ppp_mp_cleanup( isdn_net_local * lp )
{
- struct sk_buff *skb, *tmp;
-
- skb_queue_walk_safe(&lp->netdev->pb->frags, skb, tmp) {
- __skb_unlink(skb, &lp->netdev->pb->frags);
- isdn_ppp_mp_free_skb(lp->netdev->pb, skb);
+ struct sk_buff * frag = lp->netdev->pb->frags;
+ struct sk_buff * nextfrag;
+ while( frag ) {
+ nextfrag = frag->next;
+ isdn_ppp_mp_free_skb(lp->netdev->pb, frag);
+ frag = nextfrag;
}
+ lp->netdev->pb->frags = NULL;
}

static u32 isdn_ppp_mp_get_seq( int short_seq,
@@ -1838,115 +1855,72 @@ static u32 isdn_ppp_mp_get_seq( int shor
return seq;
}

-static void isdn_ppp_mp_discard(ippp_bundle *mp, struct sk_buff *from,
- struct sk_buff *to)
+struct sk_buff * isdn_ppp_mp_discard( ippp_bundle * mp,
+ struct sk_buff * from, struct sk_buff * to )
{
- if (from) {
- struct sk_buff *skb, *tmp;
- int freeing = 0;
-
- skb_queue_walk_safe(&mp->frags, skb, tmp) {
- if (skb == to)
- break;
- if (skb == from)
- freeing = 1;
- if (!freeing)
- continue;
- __skb_unlink(skb, &mp->frags);
- isdn_ppp_mp_free_skb(mp, skb);
+ if( from )
+ while (from != to) {
+ struct sk_buff * next = from->next;
+ isdn_ppp_mp_free_skb(mp, from);
+ from = next;
}
- }
+ return from;
}

-static unsigned int calc_tot_len(struct sk_buff_head *queue,
- struct sk_buff *from, struct sk_buff *to)
-{
- unsigned int tot_len = 0;
- struct sk_buff *skb;
- int found_start = 0;
-
- skb_queue_walk(queue, skb) {
- if (skb == from)
- found_start = 1;
- if (!found_start)
- continue;
- tot_len += skb->len - MP_HEADER_LEN;
- if (skb == to)
- break;
- }
- return tot_len;
-}
-
-/* Reassemble packet using fragments in the reassembly queue from
- * 'from' until 'to', inclusive.
- */
-static void isdn_ppp_mp_reassembly(isdn_net_dev *net_dev, isdn_net_local *lp,
- struct sk_buff *from, struct sk_buff *to,
- u32 lastseq)
+void isdn_ppp_mp_reassembly( isdn_net_dev * net_dev, isdn_net_local * lp,
+ struct sk_buff * from, struct sk_buff * to )
{
- ippp_bundle *mp = net_dev->pb;
- unsigned int tot_len;
- struct sk_buff *skb;
+ ippp_bundle * mp = net_dev->pb;
int proto;
+ struct sk_buff * skb;
+ unsigned int tot_len;

if (lp->ppp_slot < 0 || lp->ppp_slot >= ISDN_MAX_CHANNELS) {
printk(KERN_ERR "%s: lp->ppp_slot(%d) out of range\n",
__func__, lp->ppp_slot);
return;
}
-
- tot_len = calc_tot_len(&mp->frags, from, to);
-
- if (MP_FLAGS(from) == (MP_BEGIN_FRAG | MP_END_FRAG)) {
- if (ippp_table[lp->ppp_slot]->debug & 0x40)
+ if( MP_FLAGS(from) == (MP_BEGIN_FRAG | MP_END_FRAG) ) {
+ if( ippp_table[lp->ppp_slot]->debug & 0x40 )
printk(KERN_DEBUG "isdn_mppp: reassembly: frame %d, "
- "len %d\n", MP_SEQ(from), from->len);
+ "len %d\n", MP_SEQ(from), from->len );
skb = from;
skb_pull(skb, MP_HEADER_LEN);
- __skb_unlink(skb, &mp->frags);
mp->frames--;
} else {
- struct sk_buff *walk, *tmp;
- int found_start = 0;
+ struct sk_buff * frag;
+ int n;

- if (ippp_table[lp->ppp_slot]->debug & 0x40)
- printk(KERN_DEBUG"isdn_mppp: reassembling frames %d "
- "to %d, len %d\n", MP_SEQ(from), lastseq,
- tot_len);
+ for(tot_len=n=0, frag=from; frag != to; frag=frag->next, n++)
+ tot_len += frag->len - MP_HEADER_LEN;

- skb = dev_alloc_skb(tot_len);
- if (!skb)
+ if( ippp_table[lp->ppp_slot]->debug & 0x40 )
+ printk(KERN_DEBUG"isdn_mppp: reassembling frames %d "
+ "to %d, len %d\n", MP_SEQ(from),
+ (MP_SEQ(from)+n-1) & MP_LONGSEQ_MASK, tot_len );
+ if( (skb = dev_alloc_skb(tot_len)) == NULL ) {
printk(KERN_ERR "isdn_mppp: cannot allocate sk buff "
- "of size %d\n", tot_len);
-
- found_start = 0;
- skb_queue_walk_safe(&mp->frags, walk, tmp) {
- if (walk == from)
- found_start = 1;
- if (!found_start)
- continue;
+ "of size %d\n", tot_len);
+ isdn_ppp_mp_discard(mp, from, to);
+ return;
+ }

- if (skb) {
- unsigned int len = walk->len - MP_HEADER_LEN;
- skb_copy_from_linear_data_offset(walk, MP_HEADER_LEN,
- skb_put(skb, len),
- len);
- }
- __skb_unlink(walk, &mp->frags);
- isdn_ppp_mp_free_skb(mp, walk);
+ while( from != to ) {
+ unsigned int len = from->len - MP_HEADER_LEN;

- if (walk == to)
- break;
+ skb_copy_from_linear_data_offset(from, MP_HEADER_LEN,
+ skb_put(skb,len),
+ len);
+ frag = from->next;
+ isdn_ppp_mp_free_skb(mp, from);
+ from = frag;
}
}
- if (!skb)
- return;
-
proto = isdn_ppp_strip_proto(skb);
isdn_ppp_push_higher(net_dev, lp, skb, proto);
}

-static void isdn_ppp_mp_free_skb(ippp_bundle *mp, struct sk_buff *skb)
+static void isdn_ppp_mp_free_skb(ippp_bundle * mp, struct sk_buff * skb)
{
dev_kfree_skb(skb);
mp->frames--;
--- a/include/linux/isdn_ppp.h
+++ b/include/linux/isdn_ppp.h
@@ -157,7 +157,7 @@ typedef struct {

typedef struct {
int mp_mrru; /* unused */
- struct sk_buff_head frags; /* fragments sl list */
+ struct sk_buff * frags; /* fragments sl list -- use skb->next */
long frames; /* number of frames in the frame list */
unsigned int seq; /* last processed packet seq #: any packets
* with smaller seq # will be dropped

Greg KH

unread,
Dec 16, 2009, 8:32:13 PM12/16/09
to linux-...@vger.kernel.org, sta...@kernel.org, stable...@kernel.org, torv...@linux-foundation.org, ak...@linux-foundation.org, al...@lxorguk.ukuu.org.uk, David S. Miller
2.6.31-stable review patch. If anyone has any objections, please let us know.

------------------


From: David S. Miller <da...@davemloft.net>

[ Upstream commit 1917d17b903955b8b2903626a2e01d071a5d0ec9 ]

Signed-off-by: David S. Miller <da...@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gre...@suse.de>
---

drivers/serial/sunsu.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)

--- a/drivers/serial/sunsu.c
+++ b/drivers/serial/sunsu.c
@@ -1409,6 +1409,7 @@ static int __devinit su_probe(struct of_
struct uart_sunsu_port *up;
struct resource *rp;
enum su_type type;
+ bool ignore_line;
int err;

type = su_get_type(dp);
@@ -1467,9 +1468,14 @@ static int __devinit su_probe(struct of_

up->port.ops = &sunsu_pops;

+ ignore_line = false;
+ if (!strcmp(dp->name, "rsc-console") ||
+ !strcmp(dp->name, "lom-console"))
+ ignore_line = true;
+
sunserial_console_match(SUNSU_CONSOLE(), dp,
&sunsu_reg, up->port.line,
- false);
+ ignore_line);
err = uart_add_one_port(&sunsu_reg, &up->port);
if (err)
goto out_unmap;

Greg KH

unread,
Dec 16, 2009, 8:32:26 PM12/16/09
to linux-...@vger.kernel.org, sta...@kernel.org, stable...@kernel.org, torv...@linux-foundation.org, ak...@linux-foundation.org, al...@lxorguk.ukuu.org.uk, David S. Miller
2.6.31-stable review patch. If anyone has any objections, please let us know.

------------------


From: David S. Miller <da...@davemloft.net>

[ Upstream commit 457931de3b0925dc2eb941bc7d611a509be36dff ]

RSC and LOM devices have fixed speed settings.

We already had some code to match and handle "rsc" named devices on
E250 systems, but we also have to handle 'rsc-console', 'rsc-control',
and 'lom-console'.

Also, in order to get this right regardless of what 'output-device'
happens to be, explicitly pass the UART device node pointer to this
routine.

Signed-off-by: David S. Miller <da...@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gre...@suse.de>
---

drivers/serial/suncore.c | 18 ++++++++++--------
drivers/serial/suncore.h | 3 ++-
drivers/serial/sunhv.c | 2 +-
drivers/serial/sunsab.c | 2 +-
drivers/serial/sunzilog.c | 2 +-
5 files changed, 15 insertions(+), 12 deletions(-)

--- a/drivers/serial/suncore.c
+++ b/drivers/serial/suncore.c
@@ -77,23 +77,24 @@ int sunserial_console_match(struct conso
}
EXPORT_SYMBOL(sunserial_console_match);

-void
-sunserial_console_termios(struct console *con)
+void sunserial_console_termios(struct console *con, struct device_node *uart_dp)
{
- struct device_node *dp;
- const char *od, *mode, *s;
+ const char *mode, *s;
char mode_prop[] = "ttyX-mode";
int baud, bits, stop, cflag;
char parity;

- dp = of_find_node_by_path("/options");
- od = of_get_property(dp, "output-device", NULL);
- if (!strcmp(od, "rsc")) {
- mode = of_get_property(of_console_device,
+ if (!strcmp(uart_dp->name, "rsc") ||
+ !strcmp(uart_dp->name, "rsc-console") ||
+ !strcmp(uart_dp->name, "rsc-control")) {
+ mode = of_get_property(uart_dp,
"ssp-console-modes", NULL);
if (!mode)
mode = "115200,8,n,1,-";
+ } else if (!strcmp(uart_dp->name, "lom-console")) {
+ mode = "9600,8,n,1,-";
} else {
+ struct device_node *dp;
char c;

c = 'a';
@@ -102,6 +103,7 @@ sunserial_console_termios(struct console

mode_prop[3] = c;

+ dp = of_find_node_by_path("/options");
mode = of_get_property(dp, mode_prop, NULL);
if (!mode)
mode = "9600,8,n,1,-";
--- a/drivers/serial/suncore.h
+++ b/drivers/serial/suncore.h
@@ -27,6 +27,7 @@ extern void sunserial_unregister_minors(

extern int sunserial_console_match(struct console *, struct device_node *,
struct uart_driver *, int, bool);
-extern void sunserial_console_termios(struct console *);
+extern void sunserial_console_termios(struct console *,
+ struct device_node *);

#endif /* !(_SERIAL_SUN_H) */
--- a/drivers/serial/sunhv.c
+++ b/drivers/serial/sunhv.c
@@ -566,7 +566,7 @@ static int __devinit hv_probe(struct of_
goto out_free_con_read_page;

sunserial_console_match(&sunhv_console, op->node,
- &sunhv_reg, port->line);
+ &sunhv_reg, port->line, false);

err = uart_add_one_port(&sunhv_reg, port);
if (err)
--- a/drivers/serial/sunsab.c
+++ b/drivers/serial/sunsab.c
@@ -883,7 +883,7 @@ static int sunsab_console_setup(struct c
printk("Console: ttyS%d (SAB82532)\n",
(sunsab_reg.minor - 64) + con->index);

- sunserial_console_termios(con);
+ sunserial_console_termios(con, to_of_device(up->port.dev)->node);

switch (con->cflag & CBAUD) {
case B150: baud = 150; break;
--- a/drivers/serial/sunzilog.c
+++ b/drivers/serial/sunzilog.c
@@ -1180,7 +1180,7 @@ static int __init sunzilog_console_setup
(sunzilog_reg.minor - 64) + con->index, con->index);



/* Get firmware console settings. */

- sunserial_console_termios(con);
+ sunserial_console_termios(con, to_of_device(up->port.dev)->node);

/* Firmware console speed is limited to 150-->38400 baud so
* this hackish cflag thing is OK.

Greg KH

unread,
Dec 16, 2009, 8:32:51 PM12/16/09
to linux-...@vger.kernel.org, sta...@kernel.org, stable...@kernel.org, torv...@linux-foundation.org, ak...@linux-foundation.org, al...@lxorguk.ukuu.org.uk, Roger Oksanen, David S. Miller
2.6.31-stable review patch. If anyone has any objections, please let us know.

------------------


From: Roger Oksanen <roger....@cs.helsinki.fi>

[ Upstream commit 98468efddb101f8a29af974101c17ba513b07be1 ]

pci_alloc_consistent uses GFP_ATOMIC allocation that may fail on some systems
with limited memory (Bug #14265). pci_pool_alloc allows waiting with
GFP_KERNEL.

Tested-by: Karol Lewandowski <karol.k.l...@gmail.com>
Signed-off-by: Roger Oksanen <roger....@cs.helsinki.fi>


Signed-off-by: David S. Miller <da...@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gre...@suse.de>
---

drivers/net/e100.c | 17 +++++++++++------
1 file changed, 11 insertions(+), 6 deletions(-)

--- a/drivers/net/e100.c
+++ b/drivers/net/e100.c
@@ -156,6 +156,7 @@
#include <linux/init.h>
#include <linux/pci.h>
#include <linux/dma-mapping.h>
+#include <linux/dmapool.h>
#include <linux/netdevice.h>
#include <linux/etherdevice.h>
#include <linux/mii.h>
@@ -601,6 +602,7 @@ struct nic {
struct mem *mem;
dma_addr_t dma_addr;

+ struct pci_pool *cbs_pool;
dma_addr_t cbs_dma_addr;
u8 adaptive_ifs;
u8 tx_threshold;
@@ -1779,9 +1781,7 @@ static void e100_clean_cbs(struct nic *n
nic->cb_to_clean = nic->cb_to_clean->next;
nic->cbs_avail++;
}
- pci_free_consistent(nic->pdev,
- sizeof(struct cb) * nic->params.cbs.count,
- nic->cbs, nic->cbs_dma_addr);
+ pci_pool_free(nic->cbs_pool, nic->cbs, nic->cbs_dma_addr);
nic->cbs = NULL;
nic->cbs_avail = 0;
}
@@ -1799,8 +1799,8 @@ static int e100_alloc_cbs(struct nic *ni
nic->cb_to_use = nic->cb_to_send = nic->cb_to_clean = NULL;
nic->cbs_avail = 0;

- nic->cbs = pci_alloc_consistent(nic->pdev,
- sizeof(struct cb) * count, &nic->cbs_dma_addr);
+ nic->cbs = pci_pool_alloc(nic->cbs_pool, GFP_KERNEL,
+ &nic->cbs_dma_addr);
if (!nic->cbs)
return -ENOMEM;

@@ -2827,7 +2827,11 @@ static int __devinit e100_probe(struct p
DPRINTK(PROBE, ERR, "Cannot register net device, aborting.\n");
goto err_out_free;
}
-
+ nic->cbs_pool = pci_pool_create(netdev->name,
+ nic->pdev,
+ nic->params.cbs.count * sizeof(struct cb),
+ sizeof(u32),
+ 0);
DPRINTK(PROBE, INFO, "addr 0x%llx, irq %d, MAC addr %pM\n",
(unsigned long long)pci_resource_start(pdev, use_io ? 1 : 0),
pdev->irq, netdev->dev_addr);
@@ -2857,6 +2861,7 @@ static void __devexit e100_remove(struct
unregister_netdev(netdev);
e100_free(nic);
pci_iounmap(pdev, nic->csr);
+ pci_pool_destroy(nic->cbs_pool);
free_netdev(netdev);
pci_release_regions(pdev);
pci_disable_device(pdev);

Greg KH

unread,
Dec 16, 2009, 8:33:08 PM12/16/09
to linux-...@vger.kernel.org, sta...@kernel.org, stable...@kernel.org, torv...@linux-foundation.org, ak...@linux-foundation.org, al...@lxorguk.ukuu.org.uk, David S. Miller
2.6.31-stable review patch. If anyone has any objections, please let us know.

------------------


From: David S. Miller <da...@davemloft.net>

[ Upstream commit 4e3533d05b6e5e66d1cda27f6671251c99c62894 ]

This tells the logic to ignore the line match when deciding whether the
device is the OpenFirmware specified console device or not.

This is going to be used in the SU driver for rsc-console detection.

There is probably a better way to handle this, but this is the least
intrusive solution for now which we can validate won't break any other
cases.

Signed-off-by: David S. Miller <da...@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gre...@suse.de>
---

drivers/serial/suncore.c | 19 ++++++++++---------
drivers/serial/suncore.h | 2 +-
drivers/serial/sunsab.c | 6 ++++--
drivers/serial/sunsu.c | 3 ++-
drivers/serial/sunzilog.c | 6 ++++--
5 files changed, 21 insertions(+), 15 deletions(-)

--- a/drivers/serial/suncore.c
+++ b/drivers/serial/suncore.c
@@ -53,20 +53,21 @@ void sunserial_unregister_minors(struct
EXPORT_SYMBOL(sunserial_unregister_minors);

int sunserial_console_match(struct console *con, struct device_node *dp,
- struct uart_driver *drv, int line)
+ struct uart_driver *drv, int line, bool ignore_line)
{
- int off;
-
if (!con || of_console_device != dp)
return 0;

- off = 0;
- if (of_console_options &&
- *of_console_options == 'b')
- off = 1;
+ if (!ignore_line) {
+ int off = 0;

- if ((line & 1) != off)
- return 0;
+ if (of_console_options &&
+ *of_console_options == 'b')
+ off = 1;
+
+ if ((line & 1) != off)
+ return 0;
+ }

con->index = line;
drv->cons = con;
--- a/drivers/serial/suncore.h
+++ b/drivers/serial/suncore.h
@@ -26,7 +26,7 @@ extern int sunserial_register_minors(str
extern void sunserial_unregister_minors(struct uart_driver *, int);



extern int sunserial_console_match(struct console *, struct device_node *,

- struct uart_driver *, int);
+ struct uart_driver *, int, bool);
extern void sunserial_console_termios(struct console *);

#endif /* !(_SERIAL_SUN_H) */
--- a/drivers/serial/sunsab.c
+++ b/drivers/serial/sunsab.c
@@ -1027,10 +1027,12 @@ static int __devinit sab_probe(struct of
goto out1;

sunserial_console_match(SUNSAB_CONSOLE(), op->node,
- &sunsab_reg, up[0].port.line);
+ &sunsab_reg, up[0].port.line,
+ false);

sunserial_console_match(SUNSAB_CONSOLE(), op->node,
- &sunsab_reg, up[1].port.line);
+ &sunsab_reg, up[1].port.line,
+ false);

err = uart_add_one_port(&sunsab_reg, &up[0].port);
if (err)
--- a/drivers/serial/sunsu.c
+++ b/drivers/serial/sunsu.c
@@ -1468,7 +1468,8 @@ static int __devinit su_probe(struct of_
up->port.ops = &sunsu_pops;

sunserial_console_match(SUNSU_CONSOLE(), dp,
- &sunsu_reg, up->port.line);
+ &sunsu_reg, up->port.line,
+ false);


err = uart_add_one_port(&sunsu_reg, &up->port);
if (err)
goto out_unmap;

--- a/drivers/serial/sunzilog.c
+++ b/drivers/serial/sunzilog.c
@@ -1416,7 +1416,8 @@ static int __devinit zs_probe(struct of_

if (!keyboard_mouse) {
if (sunserial_console_match(SUNZILOG_CONSOLE(), op->node,
- &sunzilog_reg, up[0].port.line))
+ &sunzilog_reg, up[0].port.line,
+ false))
up->flags |= SUNZILOG_FLAG_IS_CONS;
err = uart_add_one_port(&sunzilog_reg, &up[0].port);
if (err) {
@@ -1425,7 +1426,8 @@ static int __devinit zs_probe(struct of_
return err;
}
if (sunserial_console_match(SUNZILOG_CONSOLE(), op->node,
- &sunzilog_reg, up[1].port.line))
+ &sunzilog_reg, up[1].port.line,
+ false))
up->flags |= SUNZILOG_FLAG_IS_CONS;
err = uart_add_one_port(&sunzilog_reg, &up[1].port);
if (err) {

Greg KH

unread,
Dec 16, 2009, 8:33:31 PM12/16/09
to linux-...@vger.kernel.org, sta...@kernel.org, stable...@kernel.org, torv...@linux-foundation.org, ak...@linux-foundation.org, al...@lxorguk.ukuu.org.uk, Eric Dumazet, David S. Miller
2.6.31-stable review patch. If anyone has any objections, please let us know.

------------------


From: Eric Dumazet <eric.d...@gmail.com>

[ Upstream commit 6b863d1d3239eff0f45c2e6e672f5b56db828db0 ]

In case register_netdevice() returns an error, and a new vlan_group
was allocated and inserted in vlan_group_hash[] we call
vlan_group_free() without deleting group from hash table. Future
lookups can give infinite loops or crashes.

We must delete the vlan_group using RCU safe procedure.

Signed-off-by: Eric Dumazet <eric.d...@gmail.com>


Signed-off-by: David S. Miller <da...@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gre...@suse.de>
---

net/8021q/vlan.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)

--- a/net/8021q/vlan.c
+++ b/net/8021q/vlan.c
@@ -287,8 +287,11 @@ out_uninit_applicant:
if (ngrp)
vlan_gvrp_uninit_applicant(real_dev);
out_free_group:
- if (ngrp)
- vlan_group_free(ngrp);
+ if (ngrp) {
+ hlist_del_rcu(&ngrp->hlist);
+ /* Free the group, after all cpu's are done. */
+ call_rcu(&ngrp->rcu, vlan_rcu_free);
+ }
return err;

Greg KH

unread,
Dec 16, 2009, 8:33:51 PM12/16/09
to linux-...@vger.kernel.org, sta...@kernel.org, stable...@kernel.org, torv...@linux-foundation.org, ak...@linux-foundation.org, al...@lxorguk.ukuu.org.uk, David S. Miller
2.6.31-stable review patch. If anyone has any objections, please let us know.

------------------


From: David S. Miller <da...@davemloft.net>

[ Upstream commit bffbc94a4d2c1769c3826fceddd2dbb75e72c80b ]

This was the cause of various boot failures on V480, V880, etc.
systems.

Kernel image memory was being overwritten because the vmemmap[]
array was being sized to small. So if you had physical memory
addresses past a certain point, the early bootup would spam
all over variables in the kernel data section.

The vmemmap mappings map page structs, not page struct pointers.
And that was the key thinko in the macro definition.

This was fixable thanks to the help, reports, and tireless patience
of Hermann Lauer.

Reported-by: Hermann Lauer <Herman...@iwr.uni-heidelberg.de>


Signed-off-by: David S. Miller <da...@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gre...@suse.de>
---

arch/sparc/mm/init_64.h | 2 +-


1 file changed, 1 insertion(+), 1 deletion(-)

--- a/arch/sparc/mm/init_64.h
+++ b/arch/sparc/mm/init_64.h
@@ -45,7 +45,7 @@ extern void free_initmem(void);
#define VMEMMAP_ALIGN(x) (((x)+VMEMMAP_CHUNK-1UL)&VMEMMAP_CHUNK_MASK)

#define VMEMMAP_SIZE ((((1UL << MAX_PHYSADDR_BITS) >> PAGE_SHIFT) * \
- sizeof(struct page *)) >> VMEMMAP_CHUNK_SHIFT)
+ sizeof(struct page)) >> VMEMMAP_CHUNK_SHIFT)
extern unsigned long vmemmap_table[VMEMMAP_SIZE];
#endif

Greg KH

unread,
Dec 16, 2009, 8:34:11 PM12/16/09
to linux-...@vger.kernel.org, sta...@kernel.org, stable...@kernel.org, torv...@linux-foundation.org, ak...@linux-foundation.org, al...@lxorguk.ukuu.org.uk, David S. Miller
2.6.31-stable review patch. If anyone has any objections, please let us know.

------------------


From: David S. Miller <da...@davemloft.net>

[ Upstream commit 4e68e188411ea98e40309700cf0c89ad4469ac1d ]

Other Sun serial drivers do not do this, and if we keep it this way
it ends up registering all serial devices as consoles rather than
just the one which we explicitly register via sunserial_console_match()
which uses add_preferred_console().

Signed-off-by: David S. Miller <da...@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gre...@suse.de>
---

drivers/serial/sunsab.c | 1 -
1 file changed, 1 deletion(-)

--- a/drivers/serial/sunsab.c
+++ b/drivers/serial/sunsab.c
@@ -1116,7 +1116,6 @@ static int __init sunsab_init(void)
if (!sunsab_ports)
return -ENOMEM;

- sunsab_reg.cons = SUNSAB_CONSOLE();
err = sunserial_register_minors(&sunsab_reg, num_channels);
if (err) {
kfree(sunsab_ports);

Greg KH

unread,
Dec 16, 2009, 8:34:58 PM12/16/09
to linux-...@vger.kernel.org, sta...@kernel.org, stable...@kernel.org, torv...@linux-foundation.org, ak...@linux-foundation.org, al...@lxorguk.ukuu.org.uk, Jarek Poplawski, Eric Dumazet, David S. Miller
2.6.31-stable review patch. If anyone has any objections, please let us know.

------------------


From: Eric Dumazet <eric.d...@gmail.com>

[ Upstream commit 91e9c07bd635353d1a278bdb38dbb56ac371bcb8 ]

net: Fix the rollback test in dev_change_name()

In dev_change_name() an err variable is used for storing the original
call_netdevice_notifiers() errno (negative) and testing for a rollback
error later, but the test for non-zero is wrong, because the err might
have positive value as well - from dev_alloc_name(). It means the
rollback for a netdevice with a number > 0 will never happen. (The err
test is reordered btw. to make it more readable.)

Signed-off-by: Jarek Poplawski <jar...@gmail.com>
Signed-off-by: Eric Dumazet <eric.d...@gmail.com>


Signed-off-by: David S. Miller <da...@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gre...@suse.de>
---

net/core/dev.c | 11 ++++++-----
1 file changed, 6 insertions(+), 5 deletions(-)

--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -933,14 +933,15 @@ rollback:
ret = notifier_to_errno(ret);

if (ret) {
- if (err) {
- printk(KERN_ERR
- "%s: name change rollback failed: %d.\n",
- dev->name, ret);
- } else {
+ /* err >= 0 after dev_alloc_name() or stores the first errno */
+ if (err >= 0) {
err = ret;
memcpy(dev->name, oldname, IFNAMSIZ);
goto rollback;
+ } else {
+ printk(KERN_ERR
+ "%s: name change rollback failed: %d.\n",
+ dev->name, ret);

Greg KH

unread,
Dec 16, 2009, 8:35:18 PM12/16/09
to linux-...@vger.kernel.org, sta...@kernel.org, stable...@kernel.org, torv...@linux-foundation.org, ak...@linux-foundation.org, al...@lxorguk.ukuu.org.uk, Herbert Xu, David S. Miller
2.6.31-stable review patch. If anyone has any objections, please let us know.

------------------


From: Herbert Xu <her...@gondor.apana.org.au>

[ Upstream commit 69c0cab120a85471054614418b447349caba22d7 ]

When we've merged skb's with page frags, and subsequently receive
a trailer skb (< MSS) that is not completely non-linear (this can
occur on Intel NICs if the packet size falls below the threshold),
GRO ends up producing an illegal GSO skb with a frag_list.

This is harmless unless the skb is then forwarded through an
interface that requires software GSO, whereupon the GSO code
will BUG.

This patch detects this case in GRO and avoids merging the
trailer skb.

Reported-by: Mark Wagner <mwa...@redhat.com>
Signed-off-by: Herbert Xu <her...@gondor.apana.org.au>


Signed-off-by: David S. Miller <da...@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gre...@suse.de>
---

net/core/skbuff.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)

--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -2704,7 +2704,8 @@ int skb_gro_receive(struct sk_buff **hea

NAPI_GRO_CB(skb)->free = 1;
goto done;
- }
+ } else if (skb_gro_len(p) != pinfo->gso_size)
+ return -E2BIG;

headroom = skb_headroom(p);
nskb = netdev_alloc_skb(p->dev, headroom + skb_gro_offset(p));

Greg KH

unread,
Dec 16, 2009, 8:35:34 PM12/16/09
to linux-...@vger.kernel.org, sta...@kernel.org, stable...@kernel.org, torv...@linux-foundation.org, ak...@linux-foundation.org, al...@lxorguk.ukuu.org.uk, Patrick McHardy, David S. Miller
2.6.31-stable review patch. If anyone has any objections, please let us know.

------------------


From: Patrick McHardy <ka...@trash.net>

[ Upstream commit b2722b1c3a893ec6021508da15b32282ec79f4da ]

When a large packet gets reassembled by ip_defrag(), the head skb
accounts for all the fragments in skb->truesize. If this packet is
refragmented again, skb->truesize is not re-adjusted to reflect only
the head size since its not owned by a socket. If the head fragment
then gets recycled and reused for another received fragment, it might
exceed the defragmentation limits due to its large truesize value.

skb_recycle_check() explicitly checks for linear skbs, so any recycled
skb should reflect its true size in skb->truesize. Change ip_fragment()
to also adjust the truesize value of skbs not owned by a socket.

Reported-and-tested-by: Ben Menchaca <b...@bigfootnetworks.com>
Signed-off-by: Patrick McHardy <ka...@trash.net>


Signed-off-by: David S. Miller <da...@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gre...@suse.de>
---

net/ipv4/ip_output.c | 2 +-


1 file changed, 1 insertion(+), 1 deletion(-)

--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -500,8 +500,8 @@ int ip_fragment(struct sk_buff *skb, int
if (skb->sk) {
frag->sk = skb->sk;
frag->destructor = sock_wfree;
- truesizes += frag->truesize;
}
+ truesizes += frag->truesize;
}

/* Everything is OK. Generate! */

Greg KH

unread,
Dec 16, 2009, 8:36:03 PM12/16/09
to linux-...@vger.kernel.org, sta...@kernel.org, stable...@kernel.org, torv...@linux-foundation.org, ak...@linux-foundation.org, al...@lxorguk.ukuu.org.uk, Vasanthakumar Thiagarajan, John W. Linville
2.6.31-stable review patch. If anyone has any objections, please let us know.

------------------

From: Vasanthakumar Thiagarajan <vas...@atheros.com>

commit 1814077fd12a9cdf478c10076e9c42094e9d9250 upstream.

On a 32-bit machine, BIT() macro does not give the required
bit value if the bit is mroe than 31. In ieee802_11_parse_elems_crc(),
BIT() is suppossed to get the bit value more than 31 (42 (id of ERP_INFO_IE),
37 (CHANNEL_SWITCH_IE), (42), 32 (POWER_CONSTRAINT_IE), 45 (HT_CAP_IE),
61 (HT_INFO_IE)). As we do not get the required bit value for the above
IEs, crc over these IEs are never calculated, so any dynamic change in these
IEs after the association is not really handled on 32-bit platforms.
This patch fixes this issue.

Signed-off-by: Vasanthakumar Thiagarajan <vas...@atheros.com>


Signed-off-by: John W. Linville <linv...@tuxdriver.com>

Signed-off-by: Greg Kroah-Hartman <gre...@suse.de>

---
net/mac80211/util.c | 2 +-


1 file changed, 1 insertion(+), 1 deletion(-)

--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -537,7 +537,7 @@ u32 ieee802_11_parse_elems_crc(u8 *start
if (elen > left)
break;

- if (calc_crc && id < 64 && (filter & BIT(id)))
+ if (calc_crc && id < 64 && (filter & (1ULL << id)))
crc = crc32_be(crc, pos - 2, elen + 2);

switch (id) {

Greg KH

unread,
Dec 16, 2009, 8:36:18 PM12/16/09