From: Greg Kroah-Hartman Date: Fri, 19 Mar 2010 00:27:36 +0000 (-0700) Subject: .32 patches X-Git-Tag: v2.6.27.46~41 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=456c97f3c41c0fcc4ef51451e3a5e43775acac68;p=thirdparty%2Fkernel%2Fstable-queue.git .32 patches --- diff --git a/queue-2.6.32/ath9k-fix-lockdep-warning-when-unloading-module.patch b/queue-2.6.32/ath9k-fix-lockdep-warning-when-unloading-module.patch new file mode 100644 index 00000000000..a81af8574d1 --- /dev/null +++ b/queue-2.6.32/ath9k-fix-lockdep-warning-when-unloading-module.patch @@ -0,0 +1,143 @@ +From a9f042cbe5284f34ccff15f3084477e11b39b17b Mon Sep 17 00:00:00 2001 +From: Ming Lei +Date: Sun, 28 Feb 2010 00:56:24 +0800 +Subject: ath9k: fix lockdep warning when unloading module + +From: Ming Lei + +commit a9f042cbe5284f34ccff15f3084477e11b39b17b upstream. + +Since txq->axq_lock may be hold in softirq context, it must be +acquired with spin_lock_bh() instead of spin_lock() if softieq is +enabled. + +The patch fixes the lockdep warning below when unloading ath9k modules. + +================================= +[ INFO: inconsistent lock state ] +2.6.33-wl #12 +--------------------------------- +inconsistent {IN-SOFTIRQ-W} -> {SOFTIRQ-ON-W} usage. +rmmod/3642 [HC0[0]:SC0[0]:HE1:SE1] takes: + (&(&txq->axq_lock)->rlock){+.?...}, at: [] ath_tx_node_cleanup+0x62/0x180 [ath9k] +{IN-SOFTIRQ-W} state was registered at: + [] __lock_acquire+0x2f6/0xd35 + [] lock_acquire+0xcd/0xf1 + [] _raw_spin_lock_bh+0x3b/0x6e + [] spin_lock_bh+0xe/0x10 [ath9k] + [] ath_tx_tasklet+0xcd/0x391 [ath9k] + [] ath9k_tasklet+0x70/0xc8 [ath9k] + [] tasklet_action+0x8c/0xf4 + [] __do_softirq+0xf8/0x1cd + [] call_softirq+0x1c/0x30 + [] do_softirq+0x4b/0xa3 + [] irq_exit+0x4a/0x8c + [] do_IRQ+0xac/0xc3 + [] ret_from_intr+0x0/0x16 + [] cpuidle_idle_call+0x9e/0xf8 + [] cpu_idle+0x62/0x9d + [] rest_init+0x7e/0x80 + [] start_kernel+0x3e8/0x3f3 + [] x86_64_start_reservations+0xa7/0xab + [] x86_64_start_kernel+0xf8/0x107 +irq event stamp: 42037 +hardirqs last enabled at (42037): [] _raw_spin_unlock_irqrestore+0x47/0x56 +hardirqs last disabled at (42036): [] _raw_spin_lock_irqsave+0x2b/0x88 +softirqs last enabled at (42000): [] spin_unlock_bh+0xe/0x10 [ath9k] +softirqs last disabled at (41998): [] _raw_spin_lock_bh+0x18/0x6e + +other info that might help us debug this: +4 locks held by rmmod/3642: + #0: (rtnl_mutex){+.+.+.}, at: [] rtnl_lock+0x17/0x19 + #1: (&wdev->mtx){+.+.+.}, at: [] cfg80211_netdev_notifier_call+0x28d/0x46d [cfg80211] + #2: (&ifmgd->mtx){+.+.+.}, at: [] ieee80211_mgd_deauth+0x3f/0x17e [mac80211] + #3: (&local->sta_mtx){+.+.+.}, at: [] sta_info_destroy_addr+0x2b/0x5e [mac80211] + +stack backtrace: +Pid: 3642, comm: rmmod Not tainted 2.6.33-wl #12 +Call Trace: + [] valid_state+0x178/0x18b + [] ? save_stack_trace+0x2f/0x4c + [] ? check_usage_backwards+0x0/0x88 + [] mark_lock+0x113/0x230 + [] __lock_acquire+0x36a/0xd35 + [] ? native_sched_clock+0x2d/0x5f + [] ? ath_tx_node_cleanup+0x62/0x180 [ath9k] + [] lock_acquire+0xcd/0xf1 + [] ? ath_tx_node_cleanup+0x62/0x180 [ath9k] + [] ? trace_hardirqs_off+0xd/0xf + [] _raw_spin_lock+0x36/0x69 + [] ? ath_tx_node_cleanup+0x62/0x180 [ath9k] + [] ath_tx_node_cleanup+0x62/0x180 [ath9k] + [] ? trace_hardirqs_on+0xd/0xf + [] ath9k_sta_remove+0x22/0x26 [ath9k] + [] __sta_info_destroy+0x1ad/0x38c [mac80211] + [] sta_info_destroy_addr+0x3e/0x5e [mac80211] + [] ieee80211_set_disassoc+0x175/0x180 [mac80211] + [] ieee80211_mgd_deauth+0x58/0x17e [mac80211] + [] ? __mutex_lock_common+0x37f/0x3a4 + [] ? cfg80211_netdev_notifier_call+0x28d/0x46d [cfg80211] + [] ieee80211_deauth+0x1e/0x20 [mac80211] + [] __cfg80211_mlme_deauth+0x130/0x13f [cfg80211] + [] ? cfg80211_netdev_notifier_call+0x28d/0x46d [cfg80211] + [] ? trace_hardirqs_off+0xd/0xf + [] __cfg80211_disconnect+0x111/0x189 [cfg80211] + [] cfg80211_netdev_notifier_call+0x2ce/0x46d [cfg80211] + [] notifier_call_chain+0x37/0x63 + [] raw_notifier_call_chain+0x14/0x16 + [] call_netdevice_notifiers+0x1b/0x1d + [] dev_close+0x6a/0xa6 + [] rollback_registered_many+0xb6/0x2f4 + [] unregister_netdevice_many+0x1b/0x66 + [] ieee80211_remove_interfaces+0xc5/0xd0 [mac80211] + [] ieee80211_unregister_hw+0x47/0xe8 [mac80211] + [] ath9k_deinit_device+0x7a/0x9b [ath9k] + [] ath_pci_remove+0x38/0x76 [ath9k] + [] pci_device_remove+0x2d/0x51 + [] __device_release_driver+0x7b/0xd1 + [] driver_detach+0x98/0xbe + [] bus_remove_driver+0x94/0xb7 + [] driver_unregister+0x6c/0x74 + [] pci_unregister_driver+0x46/0xad + [] ath_pci_exit+0x15/0x17 [ath9k] + [] ath9k_exit+0xe/0x2f [ath9k] + [] sys_delete_module+0x1c7/0x236 + [] ? retint_swapgs+0x13/0x1b + [] ? trace_hardirqs_on_caller+0x119/0x144 + [] ? audit_syscall_entry+0x11e/0x14a + [] system_call_fastpath+0x16/0x1b +wlan1: deauthenticating from 00:23:cd:e1:f9:b2 by local choice (reason=3) +PM: Removing info for No Bus:wlan1 +cfg80211: Calling CRDA to update world regulatory domain +PM: Removing info for No Bus:rfkill2 +PM: Removing info for No Bus:phy1 +ath9k 0000:16:00.0: PCI INT A disabled + +Signed-off-by: Ming Lei +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/ath/ath9k/xmit.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/net/wireless/ath/ath9k/xmit.c ++++ b/drivers/net/wireless/ath/ath9k/xmit.c +@@ -2210,7 +2210,7 @@ void ath_tx_node_cleanup(struct ath_soft + if (ATH_TXQ_SETUP(sc, i)) { + txq = &sc->tx.txq[i]; + +- spin_lock(&txq->axq_lock); ++ spin_lock_bh(&txq->axq_lock); + + list_for_each_entry_safe(ac, + ac_tmp, &txq->axq_acq, list) { +@@ -2231,7 +2231,7 @@ void ath_tx_node_cleanup(struct ath_soft + } + } + +- spin_unlock(&txq->axq_lock); ++ spin_unlock_bh(&txq->axq_lock); + } + } + } diff --git a/queue-2.6.32/b43-workaround-circular-locking-in-hw-tkip-key-update-callback.patch b/queue-2.6.32/b43-workaround-circular-locking-in-hw-tkip-key-update-callback.patch new file mode 100644 index 00000000000..93751e8632b --- /dev/null +++ b/queue-2.6.32/b43-workaround-circular-locking-in-hw-tkip-key-update-callback.patch @@ -0,0 +1,60 @@ +From Larry.Finger@lwfinger.net Thu Mar 18 17:21:44 2010 +From: Larry Finger +Date: Wed, 10 Mar 2010 22:10:32 -0600 +Subject: b43: Workaround circular locking in hw-tkip key update callback +To: Greg Kroah-Hartman +Cc: Michael Buesch +Message-ID: <4b986d38.aOKVIPS3U9/aYsOP%Larry.Finger@lwfinger.net> + +From: Michael Buesch + +commit 96869a39399269a776a94812e9fff3d38b47d838 upstream + +The TKIP key update callback is called from the RX path, where the driver +mutex is already locked. This results in a circular locking bug. +Avoid this by removing the lock. + +Johannes noted that there is a separate bug: The callback still breaks on SDIO +hardware, because SDIO hardware access needs to sleep, but we are not allowed +to sleep in the callback due to mac80211's RCU locking. + +Signed-off-by: Michael Buesch +Tested-by: Larry Finger +Reported-by: kecsa@kutfo.hit.bme.hu +Cc: Johannes Berg +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/b43/main.c | 14 +++++++------- + 1 file changed, 7 insertions(+), 7 deletions(-) + +--- a/drivers/net/wireless/b43/main.c ++++ b/drivers/net/wireless/b43/main.c +@@ -852,19 +852,19 @@ static void b43_op_update_tkip_key(struc + if (B43_WARN_ON(!modparam_hwtkip)) + return; + +- mutex_lock(&wl->mutex); +- ++ /* This is only called from the RX path through mac80211, where ++ * our mutex is already locked. */ ++ B43_WARN_ON(!mutex_is_locked(&wl->mutex)); + dev = wl->current_dev; +- if (!dev || b43_status(dev) < B43_STAT_INITIALIZED) +- goto out_unlock; ++ B43_WARN_ON(!dev || b43_status(dev) < B43_STAT_INITIALIZED); + + keymac_write(dev, index, NULL); /* First zero out mac to avoid race */ + + rx_tkip_phase1_write(dev, index, iv32, phase1key); ++ /* only pairwise TKIP keys are supported right now */ ++ if (WARN_ON(!sta)) ++ return; + keymac_write(dev, index, addr); +- +-out_unlock: +- mutex_unlock(&wl->mutex); + } + + static void do_key_write(struct b43_wldev *dev, diff --git a/queue-2.6.32/coredump-suppress-uid-comparison-test-if-core-output-files-are-pipes.patch b/queue-2.6.32/coredump-suppress-uid-comparison-test-if-core-output-files-are-pipes.patch new file mode 100644 index 00000000000..799b7120325 --- /dev/null +++ b/queue-2.6.32/coredump-suppress-uid-comparison-test-if-core-output-files-are-pipes.patch @@ -0,0 +1,62 @@ +From 76595f79d76fbe6267a51b3a866a028d150f06d4 Mon Sep 17 00:00:00 2001 +From: Neil Horman +Date: Fri, 5 Mar 2010 13:44:16 -0800 +Subject: coredump: suppress uid comparison test if core output files are pipes + +From: Neil Horman + +commit 76595f79d76fbe6267a51b3a866a028d150f06d4 upstream. + +Modify uid check in do_coredump so as to not apply it in the case of +pipes. + +This just got noticed in testing. The end of do_coredump validates the +uid of the inode for the created file against the uid of the crashing +process to ensure that no one can pre-create a core file with different +ownership and grab the information contained in the core when they +shouldn' tbe able to. This causes failures when using pipes for a core +dumps if the crashing process is not root, which is the uid of the pipe +when it is created. + +The fix is simple. Since the check for matching uid's isn't relevant for +pipes (a process can't create a pipe that the uermodehelper code will open +anyway), we can just just skip it in the event ispipe is non-zero + +Reverts a pipe-affecting change which was accidentally made in + +: commit c46f739dd39db3b07ab5deb4e3ec81e1c04a91af +: Author: Ingo Molnar +: AuthorDate: Wed Nov 28 13:59:18 2007 +0100 +: Commit: Linus Torvalds +: CommitDate: Wed Nov 28 10:58:01 2007 -0800 +: +: vfs: coredumping fix + +Signed-off-by: Neil Horman +Cc: Andi Kleen +Cc: Oleg Nesterov +Cc: Alan Cox +Cc: Al Viro +Cc: Ingo Molnar +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Cc: maximilian attems +Signed-off-by: Greg Kroah-Hartman + +--- + fs/exec.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/fs/exec.c ++++ b/fs/exec.c +@@ -1913,8 +1913,9 @@ void do_coredump(long signr, int exit_co + /* + * Dont allow local users get cute and trick others to coredump + * into their pre-created files: ++ * Note, this is not relevant for pipes + */ +- if (inode->i_uid != current_fsuid()) ++ if (!ispipe && (inode->i_uid != current_fsuid())) + goto close_fail; + if (!file->f_op) + goto close_fail; diff --git a/queue-2.6.32/drm-edid-unify-detailed-block-parsing-between-base-and-extension-blocks.patch b/queue-2.6.32/drm-edid-unify-detailed-block-parsing-between-base-and-extension-blocks.patch new file mode 100644 index 00000000000..fc7382ec166 --- /dev/null +++ b/queue-2.6.32/drm-edid-unify-detailed-block-parsing-between-base-and-extension-blocks.patch @@ -0,0 +1,226 @@ +From 9cf00977da092096c7a983276dad8b3002d23a99 Mon Sep 17 00:00:00 2001 +From: Adam Jackson +Date: Thu, 3 Dec 2009 17:44:36 -0500 +Subject: drm/edid: Unify detailed block parsing between base and extension blocks + +From: Adam Jackson + +commit 9cf00977da092096c7a983276dad8b3002d23a99 upstream. + +Also fix an embarassing bug in standard timing subblock parsing that +would result in an infinite loop. + +Signed-off-by: Adam Jackson +Signed-off-by: Dave Airlie +Cc: maximilian attems +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/drm_edid.c | 163 ++++++++++++++++----------------------------- + 1 file changed, 61 insertions(+), 102 deletions(-) + +--- a/drivers/gpu/drm/drm_edid.c ++++ b/drivers/gpu/drm/drm_edid.c +@@ -834,8 +834,57 @@ static int add_standard_modes(struct drm + return modes; + } + ++static int add_detailed_modes(struct drm_connector *connector, ++ struct detailed_timing *timing, ++ struct edid *edid, u32 quirks, int preferred) ++{ ++ int i, modes = 0; ++ struct detailed_non_pixel *data = &timing->data.other_data; ++ int timing_level = standard_timing_level(edid); ++ struct drm_display_mode *newmode; ++ struct drm_device *dev = connector->dev; ++ ++ if (timing->pixel_clock) { ++ newmode = drm_mode_detailed(dev, edid, timing, quirks); ++ if (!newmode) ++ return 0; ++ ++ if (preferred) ++ newmode->type |= DRM_MODE_TYPE_PREFERRED; ++ ++ drm_mode_probed_add(connector, newmode); ++ return 1; ++ } ++ ++ /* other timing types */ ++ switch (data->type) { ++ case EDID_DETAIL_MONITOR_RANGE: ++ /* Get monitor range data */ ++ break; ++ case EDID_DETAIL_STD_MODES: ++ /* Six modes per detailed section */ ++ for (i = 0; i < 6; i++) { ++ struct std_timing *std; ++ struct drm_display_mode *newmode; ++ ++ std = &data->data.timings[i]; ++ newmode = drm_mode_std(dev, std, edid->revision, ++ timing_level); ++ if (newmode) { ++ drm_mode_probed_add(connector, newmode); ++ modes++; ++ } ++ } ++ break; ++ default: ++ break; ++ } ++ ++ return modes; ++} ++ + /** +- * add_detailed_modes - get detailed mode info from EDID data ++ * add_detailed_info - get detailed mode info from EDID data + * @connector: attached connector + * @edid: EDID block to scan + * @quirks: quirks to apply +@@ -846,67 +895,24 @@ static int add_standard_modes(struct drm + static int add_detailed_info(struct drm_connector *connector, + struct edid *edid, u32 quirks) + { +- struct drm_device *dev = connector->dev; +- int i, j, modes = 0; +- int timing_level; +- +- timing_level = standard_timing_level(edid); ++ int i, modes = 0; + + for (i = 0; i < EDID_DETAILED_TIMINGS; i++) { + struct detailed_timing *timing = &edid->detailed_timings[i]; +- struct detailed_non_pixel *data = &timing->data.other_data; +- struct drm_display_mode *newmode; ++ int preferred = (i == 0) && (edid->features & DRM_EDID_FEATURE_PREFERRED_TIMING); + +- /* X server check is version 1.1 or higher */ +- if (edid->version == 1 && edid->revision >= 1 && +- !timing->pixel_clock) { +- /* Other timing or info */ +- switch (data->type) { +- case EDID_DETAIL_MONITOR_SERIAL: +- break; +- case EDID_DETAIL_MONITOR_STRING: +- break; +- case EDID_DETAIL_MONITOR_RANGE: +- /* Get monitor range data */ +- break; +- case EDID_DETAIL_MONITOR_NAME: +- break; +- case EDID_DETAIL_MONITOR_CPDATA: +- break; +- case EDID_DETAIL_STD_MODES: +- for (j = 0; j < 6; i++) { +- struct std_timing *std; +- struct drm_display_mode *newmode; +- +- std = &data->data.timings[j]; +- newmode = drm_mode_std(dev, std, +- edid->revision, +- timing_level); +- if (newmode) { +- drm_mode_probed_add(connector, newmode); +- modes++; +- } +- } +- break; +- default: +- break; +- } +- } else { +- newmode = drm_mode_detailed(dev, edid, timing, quirks); +- if (!newmode) +- continue; +- +- /* First detailed mode is preferred */ +- if (i == 0 && (edid->features & DRM_EDID_FEATURE_PREFERRED_TIMING)) +- newmode->type |= DRM_MODE_TYPE_PREFERRED; +- drm_mode_probed_add(connector, newmode); ++ /* In 1.0, only timings are allowed */ ++ if (!timing->pixel_clock && edid->version == 1 && ++ edid->revision == 0) ++ continue; + +- modes++; +- } ++ modes += add_detailed_modes(connector, timing, edid, quirks, ++ preferred); + } + + return modes; + } ++ + /** + * add_detailed_mode_eedid - get detailed mode info from addtional timing + * EDID block +@@ -920,12 +926,9 @@ static int add_detailed_info(struct drm_ + static int add_detailed_info_eedid(struct drm_connector *connector, + struct edid *edid, u32 quirks) + { +- struct drm_device *dev = connector->dev; +- int i, j, modes = 0; ++ int i, modes = 0; + char *edid_ext = NULL; + struct detailed_timing *timing; +- struct detailed_non_pixel *data; +- struct drm_display_mode *newmode; + int edid_ext_num; + int start_offset, end_offset; + int timing_level; +@@ -976,51 +979,7 @@ static int add_detailed_info_eedid(struc + for (i = start_offset; i < end_offset; + i += sizeof(struct detailed_timing)) { + timing = (struct detailed_timing *)(edid_ext + i); +- data = &timing->data.other_data; +- /* Detailed mode timing */ +- if (timing->pixel_clock) { +- newmode = drm_mode_detailed(dev, edid, timing, quirks); +- if (!newmode) +- continue; +- +- drm_mode_probed_add(connector, newmode); +- +- modes++; +- continue; +- } +- +- /* Other timing or info */ +- switch (data->type) { +- case EDID_DETAIL_MONITOR_SERIAL: +- break; +- case EDID_DETAIL_MONITOR_STRING: +- break; +- case EDID_DETAIL_MONITOR_RANGE: +- /* Get monitor range data */ +- break; +- case EDID_DETAIL_MONITOR_NAME: +- break; +- case EDID_DETAIL_MONITOR_CPDATA: +- break; +- case EDID_DETAIL_STD_MODES: +- /* Five modes per detailed section */ +- for (j = 0; j < 5; i++) { +- struct std_timing *std; +- struct drm_display_mode *newmode; +- +- std = &data->data.timings[j]; +- newmode = drm_mode_std(dev, std, +- edid->revision, +- timing_level); +- if (newmode) { +- drm_mode_probed_add(connector, newmode); +- modes++; +- } +- } +- break; +- default: +- break; +- } ++ modes += add_detailed_modes(connector, timing, edid, quirks, 0); + } + + return modes; diff --git a/queue-2.6.32/e1000e-enable-new-82567v-3-device.patch b/queue-2.6.32/e1000e-enable-new-82567v-3-device.patch new file mode 100644 index 00000000000..c2d2fea4f25 --- /dev/null +++ b/queue-2.6.32/e1000e-enable-new-82567v-3-device.patch @@ -0,0 +1,56 @@ +From 9e135a2e6266eba276f33c404a2478499bc07ff5 Mon Sep 17 00:00:00 2001 +From: Bruce Allan +Date: Tue, 1 Dec 2009 15:50:31 +0000 +Subject: e1000e: enable new 82567V-3 device + +From: Bruce Allan + +commit 9e135a2e6266eba276f33c404a2478499bc07ff5 upstream. + +This new PCI device ID is for a new combination of MAC and PHY both of +which already have supporting code in the driver, just not yet in this +combination. During validation of the device, an intermittent issue was +discovered with waking it from a suspended state which can be resolved with +the pre-existing workaround to disable gigabit speed prior to suspending. + +Signed-off-by: Bruce Allan +Signed-off-by: Jeff Kirsher +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/e1000e/hw.h | 1 + + drivers/net/e1000e/ich8lan.c | 1 + + drivers/net/e1000e/netdev.c | 1 + + 3 files changed, 3 insertions(+) + +--- a/drivers/net/e1000e/hw.h ++++ b/drivers/net/e1000e/hw.h +@@ -356,6 +356,7 @@ enum e1e_registers { + #define E1000_DEV_ID_80003ES2LAN_COPPER_SPT 0x10BA + #define E1000_DEV_ID_80003ES2LAN_SERDES_SPT 0x10BB + ++#define E1000_DEV_ID_ICH8_82567V_3 0x1501 + #define E1000_DEV_ID_ICH8_IGP_M_AMT 0x1049 + #define E1000_DEV_ID_ICH8_IGP_AMT 0x104A + #define E1000_DEV_ID_ICH8_IGP_C 0x104B +--- a/drivers/net/e1000e/ich8lan.c ++++ b/drivers/net/e1000e/ich8lan.c +@@ -3209,6 +3209,7 @@ void e1000e_disable_gig_wol_ich8lan(stru + u32 phy_ctrl; + + switch (hw->mac.type) { ++ case e1000_ich8lan: + case e1000_ich9lan: + case e1000_ich10lan: + case e1000_pchlan: +--- a/drivers/net/e1000e/netdev.c ++++ b/drivers/net/e1000e/netdev.c +@@ -5360,6 +5360,7 @@ static struct pci_device_id e1000_pci_tb + { PCI_VDEVICE(INTEL, E1000_DEV_ID_ICH8_IGP_C), board_ich8lan }, + { PCI_VDEVICE(INTEL, E1000_DEV_ID_ICH8_IGP_M), board_ich8lan }, + { PCI_VDEVICE(INTEL, E1000_DEV_ID_ICH8_IGP_M_AMT), board_ich8lan }, ++ { PCI_VDEVICE(INTEL, E1000_DEV_ID_ICH8_82567V_3), board_ich8lan }, + + { PCI_VDEVICE(INTEL, E1000_DEV_ID_ICH9_IFE), board_ich9lan }, + { PCI_VDEVICE(INTEL, E1000_DEV_ID_ICH9_IFE_G), board_ich9lan }, diff --git a/queue-2.6.32/efifb-fix-framebuffer-handoff.patch b/queue-2.6.32/efifb-fix-framebuffer-handoff.patch new file mode 100644 index 00000000000..c7bf4501a8f --- /dev/null +++ b/queue-2.6.32/efifb-fix-framebuffer-handoff.patch @@ -0,0 +1,61 @@ +From 89f3f2199084a160a3a45fa6d9af235696321758 Mon Sep 17 00:00:00 2001 +From: Marcin Slusarz +Date: Mon, 22 Feb 2010 12:44:22 -0800 +Subject: efifb: fix framebuffer handoff + +From: Marcin Slusarz + +commit 89f3f2199084a160a3a45fa6d9af235696321758 upstream. + +Commit 4410f3910947dcea8672280b3adecd53cec4e85e ("fbdev: add support for +handoff from firmware to hw framebuffers") didn't add fb_destroy +operation to efifb. Fix it and change aperture_size to match size +passed to request_mem_region. + +Addresses http://bugzilla.kernel.org/show_bug.cgi?id=15151 + +Signed-off-by: Marcin Slusarz +Reported-by: Alex Zhavnerchik +Tested-by: Alex Zhavnerchik +Acked-by: Peter Jones +Cc: Huang Ying +Cc: Dave Airlie +Cc: "Rafael J. Wysocki" +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Cc: maximilian attems +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/video/efifb.c | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +--- a/drivers/video/efifb.c ++++ b/drivers/video/efifb.c +@@ -161,8 +161,17 @@ static int efifb_setcolreg(unsigned regn + return 0; + } + ++static void efifb_destroy(struct fb_info *info) ++{ ++ if (info->screen_base) ++ iounmap(info->screen_base); ++ release_mem_region(info->aperture_base, info->aperture_size); ++ framebuffer_release(info); ++} ++ + static struct fb_ops efifb_ops = { + .owner = THIS_MODULE, ++ .fb_destroy = efifb_destroy, + .fb_setcolreg = efifb_setcolreg, + .fb_fillrect = cfb_fillrect, + .fb_copyarea = cfb_copyarea, +@@ -281,7 +290,7 @@ static int __init efifb_probe(struct pla + info->par = NULL; + + info->aperture_base = efifb_fix.smem_start; +- info->aperture_size = size_total; ++ info->aperture_size = size_remap; + + info->screen_base = ioremap(efifb_fix.smem_start, efifb_fix.smem_len); + if (!info->screen_base) { diff --git a/queue-2.6.32/hrtimer-tune-hrtimer_interrupt-hang-logic.patch b/queue-2.6.32/hrtimer-tune-hrtimer_interrupt-hang-logic.patch new file mode 100644 index 00000000000..b96ea6dbeaa --- /dev/null +++ b/queue-2.6.32/hrtimer-tune-hrtimer_interrupt-hang-logic.patch @@ -0,0 +1,239 @@ +From 41d2e494937715d3150e5c75d01f0e75ae899337 Mon Sep 17 00:00:00 2001 +From: Thomas Gleixner +Date: Fri, 13 Nov 2009 17:05:44 +0100 +Subject: hrtimer: Tune hrtimer_interrupt hang logic + +From: Thomas Gleixner + +commit 41d2e494937715d3150e5c75d01f0e75ae899337 upstream. + +The hrtimer_interrupt hang logic adjusts min_delta_ns based on the +execution time of the hrtimer callbacks. + +This is error-prone for virtual machines, where a guest vcpu can be +scheduled out during the execution of the callbacks (and the callbacks +themselves can do operations that translate to blocking operations in +the hypervisor), which in can lead to large min_delta_ns rendering the +system unusable. + +Replace the current heuristics with something more reliable. Allow the +interrupt code to try 3 times to catch up with the lost time. If that +fails use the total time spent in the interrupt handler to defer the +next timer interrupt so the system can catch up with other things +which got delayed. Limit that deferment to 100ms. + +The retry events and the maximum time spent in the interrupt handler +are recorded and exposed via /proc/timer_list + +Inspired by a patch from Marcelo. + +Reported-by: Michael Tokarev +Signed-off-by: Thomas Gleixner +Tested-by: Marcelo Tosatti +Cc: kvm@vger.kernel.org +Cc: Jeremy Fitzhardinge +Signed-off-by: Greg Kroah-Hartman + +--- + include/linux/hrtimer.h | 13 ++++-- + kernel/hrtimer.c | 96 +++++++++++++++++++++++++++-------------------- + kernel/time/timer_list.c | 5 +- + 3 files changed, 70 insertions(+), 44 deletions(-) + +--- a/include/linux/hrtimer.h ++++ b/include/linux/hrtimer.h +@@ -162,10 +162,11 @@ struct hrtimer_clock_base { + * @expires_next: absolute time of the next event which was scheduled + * via clock_set_next_event() + * @hres_active: State of high resolution mode +- * @check_clocks: Indictator, when set evaluate time source and clock +- * event devices whether high resolution mode can be +- * activated. +- * @nr_events: Total number of timer interrupt events ++ * @hang_detected: The last hrtimer interrupt detected a hang ++ * @nr_events: Total number of hrtimer interrupt events ++ * @nr_retries: Total number of hrtimer interrupt retries ++ * @nr_hangs: Total number of hrtimer interrupt hangs ++ * @max_hang_time: Maximum time spent in hrtimer_interrupt + */ + struct hrtimer_cpu_base { + spinlock_t lock; +@@ -173,7 +174,11 @@ struct hrtimer_cpu_base { + #ifdef CONFIG_HIGH_RES_TIMERS + ktime_t expires_next; + int hres_active; ++ int hang_detected; + unsigned long nr_events; ++ unsigned long nr_retries; ++ unsigned long nr_hangs; ++ ktime_t max_hang_time; + #endif + }; + +--- a/kernel/hrtimer.c ++++ b/kernel/hrtimer.c +@@ -557,7 +557,7 @@ hrtimer_force_reprogram(struct hrtimer_c + static int hrtimer_reprogram(struct hrtimer *timer, + struct hrtimer_clock_base *base) + { +- ktime_t *expires_next = &__get_cpu_var(hrtimer_bases).expires_next; ++ struct hrtimer_cpu_base *cpu_base = &__get_cpu_var(hrtimer_bases); + ktime_t expires = ktime_sub(hrtimer_get_expires(timer), base->offset); + int res; + +@@ -582,7 +582,16 @@ static int hrtimer_reprogram(struct hrti + if (expires.tv64 < 0) + return -ETIME; + +- if (expires.tv64 >= expires_next->tv64) ++ if (expires.tv64 >= cpu_base->expires_next.tv64) ++ return 0; ++ ++ /* ++ * If a hang was detected in the last timer interrupt then we ++ * do not schedule a timer which is earlier than the expiry ++ * which we enforced in the hang detection. We want the system ++ * to make progress. ++ */ ++ if (cpu_base->hang_detected) + return 0; + + /* +@@ -590,7 +599,7 @@ static int hrtimer_reprogram(struct hrti + */ + res = tick_program_event(expires, 0); + if (!IS_ERR_VALUE(res)) +- *expires_next = expires; ++ cpu_base->expires_next = expires; + return res; + } + +@@ -1217,29 +1226,6 @@ static void __run_hrtimer(struct hrtimer + + #ifdef CONFIG_HIGH_RES_TIMERS + +-static int force_clock_reprogram; +- +-/* +- * After 5 iteration's attempts, we consider that hrtimer_interrupt() +- * is hanging, which could happen with something that slows the interrupt +- * such as the tracing. Then we force the clock reprogramming for each future +- * hrtimer interrupts to avoid infinite loops and use the min_delta_ns +- * threshold that we will overwrite. +- * The next tick event will be scheduled to 3 times we currently spend on +- * hrtimer_interrupt(). This gives a good compromise, the cpus will spend +- * 1/4 of their time to process the hrtimer interrupts. This is enough to +- * let it running without serious starvation. +- */ +- +-static inline void +-hrtimer_interrupt_hanging(struct clock_event_device *dev, +- ktime_t try_time) +-{ +- force_clock_reprogram = 1; +- dev->min_delta_ns = (unsigned long)try_time.tv64 * 3; +- printk(KERN_WARNING "hrtimer: interrupt too slow, " +- "forcing clock min delta to %lu ns\n", dev->min_delta_ns); +-} + /* + * High resolution timer interrupt + * Called with interrupts disabled +@@ -1248,21 +1234,15 @@ void hrtimer_interrupt(struct clock_even + { + struct hrtimer_cpu_base *cpu_base = &__get_cpu_var(hrtimer_bases); + struct hrtimer_clock_base *base; +- ktime_t expires_next, now; +- int nr_retries = 0; +- int i; ++ ktime_t expires_next, now, entry_time, delta; ++ int i, retries = 0; + + BUG_ON(!cpu_base->hres_active); + cpu_base->nr_events++; + dev->next_event.tv64 = KTIME_MAX; + +- retry: +- /* 5 retries is enough to notice a hang */ +- if (!(++nr_retries % 5)) +- hrtimer_interrupt_hanging(dev, ktime_sub(ktime_get(), now)); +- +- now = ktime_get(); +- ++ entry_time = now = ktime_get(); ++retry: + expires_next.tv64 = KTIME_MAX; + + spin_lock(&cpu_base->lock); +@@ -1324,10 +1304,48 @@ void hrtimer_interrupt(struct clock_even + spin_unlock(&cpu_base->lock); + + /* Reprogramming necessary ? */ +- if (expires_next.tv64 != KTIME_MAX) { +- if (tick_program_event(expires_next, force_clock_reprogram)) +- goto retry; ++ if (expires_next.tv64 == KTIME_MAX || ++ !tick_program_event(expires_next, 0)) { ++ cpu_base->hang_detected = 0; ++ return; + } ++ ++ /* ++ * The next timer was already expired due to: ++ * - tracing ++ * - long lasting callbacks ++ * - being scheduled away when running in a VM ++ * ++ * We need to prevent that we loop forever in the hrtimer ++ * interrupt routine. We give it 3 attempts to avoid ++ * overreacting on some spurious event. ++ */ ++ now = ktime_get(); ++ cpu_base->nr_retries++; ++ if (++retries < 3) ++ goto retry; ++ /* ++ * Give the system a chance to do something else than looping ++ * here. We stored the entry time, so we know exactly how long ++ * we spent here. We schedule the next event this amount of ++ * time away. ++ */ ++ cpu_base->nr_hangs++; ++ cpu_base->hang_detected = 1; ++ delta = ktime_sub(now, entry_time); ++ if (delta.tv64 > cpu_base->max_hang_time.tv64) ++ cpu_base->max_hang_time = delta; ++ /* ++ * Limit it to a sensible value as we enforce a longer ++ * delay. Give the CPU at least 100ms to catch up. ++ */ ++ if (delta.tv64 > 100 * NSEC_PER_MSEC) ++ expires_next = ktime_add_ns(now, 100 * NSEC_PER_MSEC); ++ else ++ expires_next = ktime_add(now, delta); ++ tick_program_event(expires_next, 1); ++ printk_once(KERN_WARNING "hrtimer: interrupt took %llu ns\n", ++ ktime_to_ns(delta)); + } + + /* +--- a/kernel/time/timer_list.c ++++ b/kernel/time/timer_list.c +@@ -150,6 +150,9 @@ static void print_cpu(struct seq_file *m + P_ns(expires_next); + P(hres_active); + P(nr_events); ++ P(nr_retries); ++ P(nr_hangs); ++ P_ns(max_hang_time); + #endif + #undef P + #undef P_ns +@@ -252,7 +255,7 @@ static int timer_list_show(struct seq_fi + u64 now = ktime_to_ns(ktime_get()); + int cpu; + +- SEQ_printf(m, "Timer List Version: v0.4\n"); ++ SEQ_printf(m, "Timer List Version: v0.5\n"); + SEQ_printf(m, "HRTIMER_MAX_CLOCK_BASES: %d\n", HRTIMER_MAX_CLOCK_BASES); + SEQ_printf(m, "now at %Ld nsecs\n", (unsigned long long)now); + diff --git a/queue-2.6.32/input-wacom-ensure-the-device-is-initialized-properly-upon-resume.patch b/queue-2.6.32/input-wacom-ensure-the-device-is-initialized-properly-upon-resume.patch new file mode 100644 index 00000000000..87d0296dc17 --- /dev/null +++ b/queue-2.6.32/input-wacom-ensure-the-device-is-initialized-properly-upon-resume.patch @@ -0,0 +1,77 @@ +From 232f5693e5c9483e222528ef81979e42ea2f2908 Mon Sep 17 00:00:00 2001 +From: Ping Cheng +Date: Tue, 15 Dec 2009 00:35:24 -0800 +Subject: Input: wacom - ensure the device is initialized properly upon resume + +From: Ping Cheng + +commit 232f5693e5c9483e222528ef81979e42ea2f2908 upstream. + +Call wacom_query_tablet_data() from wacom_resume() so the device will be +switched to Wacom mode upon resume. Devices that require this are: regular +tablets and two finger touch devices. + +Signed-off-by: Ping Cheng +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/input/tablet/wacom.h | 7 ++++--- + drivers/input/tablet/wacom_sys.c | 7 ++++--- + 2 files changed, 8 insertions(+), 6 deletions(-) + +--- a/drivers/input/tablet/wacom.h ++++ b/drivers/input/tablet/wacom.h +@@ -1,7 +1,7 @@ + /* + * drivers/input/tablet/wacom.h + * +- * USB Wacom Graphire and Wacom Intuos tablet support ++ * USB Wacom tablet support + * + * Copyright (c) 2000-2004 Vojtech Pavlik + * Copyright (c) 2000 Andreas Bach Aaen +@@ -69,6 +69,7 @@ + * v1.49 (pc) - Added support for USB Tablet PC (0x90, 0x93, and 0x9A) + * v1.50 (pc) - Fixed a TabletPC touch bug in 2.6.28 + * v1.51 (pc) - Added support for Intuos4 ++ * v1.52 (pc) - Query Wacom data upon system resume + */ + + /* +@@ -89,9 +90,9 @@ + /* + * Version Information + */ +-#define DRIVER_VERSION "v1.51" ++#define DRIVER_VERSION "v1.52" + #define DRIVER_AUTHOR "Vojtech Pavlik " +-#define DRIVER_DESC "USB Wacom Graphire and Wacom Intuos tablet driver" ++#define DRIVER_DESC "USB Wacom tablet driver" + #define DRIVER_LICENSE "GPL" + + MODULE_AUTHOR(DRIVER_AUTHOR); +--- a/drivers/input/tablet/wacom_sys.c ++++ b/drivers/input/tablet/wacom_sys.c +@@ -1,7 +1,7 @@ + /* + * drivers/input/tablet/wacom_sys.c + * +- * USB Wacom Graphire and Wacom Intuos tablet support - system specific code ++ * USB Wacom tablet support - system specific code + */ + + /* +@@ -562,9 +562,10 @@ static int wacom_resume(struct usb_inter + int rv; + + mutex_lock(&wacom->lock); +- if (wacom->open) ++ if (wacom->open) { + rv = usb_submit_urb(wacom->irq, GFP_NOIO); +- else ++ wacom_query_tablet_data(intf); ++ } else + rv = 0; + mutex_unlock(&wacom->lock); + diff --git a/queue-2.6.32/ixgbe-add-support-for-82599-kr-device-0x1517.patch b/queue-2.6.32/ixgbe-add-support-for-82599-kr-device-0x1517.patch new file mode 100644 index 00000000000..24201409cf1 --- /dev/null +++ b/queue-2.6.32/ixgbe-add-support-for-82599-kr-device-0x1517.patch @@ -0,0 +1,52 @@ +From 74757d49016a8b06ca028196886641d7aeb78de5 Mon Sep 17 00:00:00 2001 +From: Don Skidmore +Date: Tue, 8 Dec 2009 07:22:23 +0000 +Subject: ixgbe: add support for 82599 KR device 0x1517 + +From: Don Skidmore + +commit 74757d49016a8b06ca028196886641d7aeb78de5 upstream. + +Signed-off-by: Don Skidmore +Acked-by: Peter P Waskiewicz Jr +Signed-off-by: Jeff Kirsher +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/ixgbe/ixgbe_82599.c | 1 + + drivers/net/ixgbe/ixgbe_main.c | 2 ++ + drivers/net/ixgbe/ixgbe_type.h | 1 + + 3 files changed, 4 insertions(+) + +--- a/drivers/net/ixgbe/ixgbe_82599.c ++++ b/drivers/net/ixgbe/ixgbe_82599.c +@@ -332,6 +332,7 @@ static enum ixgbe_media_type ixgbe_get_m + case IXGBE_DEV_ID_82599_KX4: + case IXGBE_DEV_ID_82599_KX4_MEZZ: + case IXGBE_DEV_ID_82599_COMBO_BACKPLANE: ++ case IXGBE_DEV_ID_82599_KR: + case IXGBE_DEV_ID_82599_XAUI_LOM: + /* Default device ID is mezzanine card KX/KX4 */ + media_type = ixgbe_media_type_backplane; +--- a/drivers/net/ixgbe/ixgbe_main.c ++++ b/drivers/net/ixgbe/ixgbe_main.c +@@ -96,6 +96,8 @@ static struct pci_device_id ixgbe_pci_tb + board_82599 }, + {PCI_VDEVICE(INTEL, IXGBE_DEV_ID_82599_XAUI_LOM), + board_82599 }, ++ {PCI_VDEVICE(INTEL, IXGBE_DEV_ID_82599_KR), ++ board_82599 }, + {PCI_VDEVICE(INTEL, IXGBE_DEV_ID_82599_SFP), + board_82599 }, + {PCI_VDEVICE(INTEL, IXGBE_DEV_ID_82599_KX4_MEZZ), +--- a/drivers/net/ixgbe/ixgbe_type.h ++++ b/drivers/net/ixgbe/ixgbe_type.h +@@ -50,6 +50,7 @@ + #define IXGBE_DEV_ID_82598EB_XF_LR 0x10F4 + #define IXGBE_DEV_ID_82599_KX4 0x10F7 + #define IXGBE_DEV_ID_82599_KX4_MEZZ 0x1514 ++#define IXGBE_DEV_ID_82599_KR 0x1517 + #define IXGBE_DEV_ID_82599_CX4 0x10F9 + #define IXGBE_DEV_ID_82599_SFP 0x10FB + #define IXGBE_DEV_ID_82599_XAUI_LOM 0x10FC diff --git a/queue-2.6.32/mqueue-fix-mq_open-file-descriptor-leak-on-user-space-processes.patch b/queue-2.6.32/mqueue-fix-mq_open-file-descriptor-leak-on-user-space-processes.patch new file mode 100644 index 00000000000..b356faa0d63 --- /dev/null +++ b/queue-2.6.32/mqueue-fix-mq_open-file-descriptor-leak-on-user-space-processes.patch @@ -0,0 +1,38 @@ +From 4294a8eedb17bbc45e1e7447c2a4d05332943248 Mon Sep 17 00:00:00 2001 +From: André Goddard Rosa +Date: Tue, 23 Feb 2010 04:04:28 -0300 +Subject: mqueue: fix mq_open() file descriptor leak on user-space processes + +From: André Goddard Rosa + +commit 4294a8eedb17bbc45e1e7447c2a4d05332943248 upstream. + +We leak fd on lookup_one_len() failure + +Signed-off-by: André Goddard Rosa +Signed-off-by: Al Viro +Signed-off-by: Greg Kroah-Hartman + +--- + ipc/mqueue.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/ipc/mqueue.c ++++ b/ipc/mqueue.c +@@ -706,7 +706,7 @@ SYSCALL_DEFINE4(mq_open, const char __us + dentry = lookup_one_len(name, ipc_ns->mq_mnt->mnt_root, strlen(name)); + if (IS_ERR(dentry)) { + error = PTR_ERR(dentry); +- goto out_err; ++ goto out_putfd; + } + mntget(ipc_ns->mq_mnt); + +@@ -744,7 +744,6 @@ out: + mntput(ipc_ns->mq_mnt); + out_putfd: + put_unused_fd(fd); +-out_err: + fd = error; + out_upsem: + mutex_unlock(&ipc_ns->mq_mnt->mnt_root->d_inode->i_mutex); diff --git a/queue-2.6.32/mvsas-add-support-for-adaptec-asc-1045-1405-sas-sata-hba.patch b/queue-2.6.32/mvsas-add-support-for-adaptec-asc-1045-1405-sas-sata-hba.patch new file mode 100644 index 00000000000..f07a49cc06f --- /dev/null +++ b/queue-2.6.32/mvsas-add-support-for-adaptec-asc-1045-1405-sas-sata-hba.patch @@ -0,0 +1,32 @@ +From 7ec4ad0125db0222e397508c190b01c8f2b5f7cd Mon Sep 17 00:00:00 2001 +From: Srinivas +Date: Tue, 24 Nov 2009 20:07:39 +0530 +Subject: [SCSI] mvsas: add support for Adaptec ASC-1045/1405 SAS/SATA HBA + +From: Srinivas + +commit 7ec4ad0125db0222e397508c190b01c8f2b5f7cd upstream. + +This is support for Adaptec ASC-1045/1405 SAS/SATA HBA on mvsas, which +is based on Marvell 88SE6440 chipset. + +Signed-off-by: Srinivas +Cc: Andy Yan +Signed-off-by: James Bottomley +Cc: Thomas Voegtle +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/mvsas/mv_init.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/scsi/mvsas/mv_init.c ++++ b/drivers/scsi/mvsas/mv_init.c +@@ -657,6 +657,7 @@ static struct pci_device_id __devinitdat + { PCI_VDEVICE(MARVELL, 0x9180), chip_9180 }, + { PCI_VDEVICE(ARECA, PCI_DEVICE_ID_ARECA_1300), chip_1300 }, + { PCI_VDEVICE(ARECA, PCI_DEVICE_ID_ARECA_1320), chip_1320 }, ++ { PCI_VDEVICE(ADAPTEC2, 0x0450), chip_6440 }, + + { } /* terminate list */ + }; diff --git a/queue-2.6.32/pci-add-support-for-82576ns-serdes-to-existing-sr-iov-quirk.patch b/queue-2.6.32/pci-add-support-for-82576ns-serdes-to-existing-sr-iov-quirk.patch new file mode 100644 index 00000000000..f24fb13d6c5 --- /dev/null +++ b/queue-2.6.32/pci-add-support-for-82576ns-serdes-to-existing-sr-iov-quirk.patch @@ -0,0 +1,31 @@ +From 7a0deb6bcda98c2a764cb87f1441eef920fd3663 Mon Sep 17 00:00:00 2001 +From: Alexander Duyck +Date: Fri, 19 Feb 2010 17:57:46 +0000 +Subject: pci: add support for 82576NS serdes to existing SR-IOV quirk + +From: Alexander Duyck + +commit 7a0deb6bcda98c2a764cb87f1441eef920fd3663 upstream. + +This patch adds support for the 82576NS Serdes adapter to the existing pci +quirk for 82576 parts. + +Signed-off-by: Alexander Duyck +Signed-off-by: Jeff Kirsher +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pci/quirks.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -2513,6 +2513,7 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_I + DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x10e8, quirk_i82576_sriov); + DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x150a, quirk_i82576_sriov); + DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x150d, quirk_i82576_sriov); ++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x1518, quirk_i82576_sriov); + + #endif /* CONFIG_PCI_IOV */ + diff --git a/queue-2.6.32/readahead-add-blk_run_backing_dev.patch b/queue-2.6.32/readahead-add-blk_run_backing_dev.patch new file mode 100644 index 00000000000..3ad3fbce473 --- /dev/null +++ b/queue-2.6.32/readahead-add-blk_run_backing_dev.patch @@ -0,0 +1,99 @@ +From 65a80b4c61f5b5f6eb0f5669c8fb120893bfb388 Mon Sep 17 00:00:00 2001 +From: Hisashi Hifumi +Date: Thu, 17 Dec 2009 15:27:26 -0800 +Subject: readahead: add blk_run_backing_dev + +From: Hisashi Hifumi + +commit 65a80b4c61f5b5f6eb0f5669c8fb120893bfb388 upstream. + +I added blk_run_backing_dev on page_cache_async_readahead so readahead I/O +is unpluged to improve throughput on especially RAID environment. + +The normal case is, if page N become uptodate at time T(N), then T(N) <= +T(N+1) holds. With RAID (and NFS to some degree), there is no strict +ordering, the data arrival time depends on runtime status of individual +disks, which breaks that formula. So in do_generic_file_read(), just +after submitting the async readahead IO request, the current page may well +be uptodate, so the page won't be locked, and the block device won't be +implicitly unplugged: + + if (PageReadahead(page)) + page_cache_async_readahead() + if (!PageUptodate(page)) + goto page_not_up_to_date; + //... +page_not_up_to_date: + lock_page_killable(page); + +Therefore explicit unplugging can help. + +Following is the test result with dd. + +#dd if=testdir/testfile of=/dev/null bs=16384 + +-2.6.30-rc6 +1048576+0 records in +1048576+0 records out +17179869184 bytes (17 GB) copied, 224.182 seconds, 76.6 MB/s + +-2.6.30-rc6-patched +1048576+0 records in +1048576+0 records out +17179869184 bytes (17 GB) copied, 206.465 seconds, 83.2 MB/s + +(7Disks RAID-0 Array) + +-2.6.30-rc6 +1054976+0 records in +1054976+0 records out +17284726784 bytes (17 GB) copied, 212.233 seconds, 81.4 MB/s + +-2.6.30-rc6-patched +1054976+0 records out +17284726784 bytes (17 GB) copied, 198.878 seconds, 86.9 MB/s + +(7Disks RAID-5 Array) + +The patch was found to improve performance with the SCST scsi target +driver. See +http://sourceforge.net/mailarchive/forum.php?thread_name=a0272b440906030714g67eabc5k8f847fb1e538cc62%40mail.gmail.com&forum_name=scst-devel + +[akpm@linux-foundation.org: unbust comment layout] +[akpm@linux-foundation.org: "fix" CONFIG_BLOCK=n] +Signed-off-by: Hisashi Hifumi +Acked-by: Wu Fengguang +Cc: Jens Axboe +Cc: KOSAKI Motohiro +Tested-by: Ronald +Cc: Bart Van Assche +Cc: Vladislav Bolkhovitin +Cc: Randy Dunlap +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/readahead.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +--- a/mm/readahead.c ++++ b/mm/readahead.c +@@ -553,5 +553,17 @@ page_cache_async_readahead(struct addres + + /* do read-ahead */ + ondemand_readahead(mapping, ra, filp, true, offset, req_size); ++ ++#ifdef CONFIG_BLOCK ++ /* ++ * Normally the current page is !uptodate and lock_page() will be ++ * immediately called to implicitly unplug the device. However this ++ * is not always true for RAID conifgurations, where data arrives ++ * not strictly in their submission order. In this case we need to ++ * explicitly kick off the IO. ++ */ ++ if (PageUptodate(page)) ++ blk_run_backing_dev(mapping->backing_dev_info, NULL); ++#endif + } + EXPORT_SYMBOL_GPL(page_cache_async_readahead); diff --git a/queue-2.6.32/sched-fix-sched_mc-regression-caused-by-change-in-sched-cpu_power.patch b/queue-2.6.32/sched-fix-sched_mc-regression-caused-by-change-in-sched-cpu_power.patch new file mode 100644 index 00000000000..d89adda2552 --- /dev/null +++ b/queue-2.6.32/sched-fix-sched_mc-regression-caused-by-change-in-sched-cpu_power.patch @@ -0,0 +1,225 @@ +From peterz@infradead.org Thu Mar 18 17:22:59 2010 +From: Suresh Siddha +Date: Thu, 11 Mar 2010 09:45:44 +0100 +Subject: sched: Fix SCHED_MC regression caused by change in sched cpu_power +To: Greg KH +Cc: Ma Ling , Zhang@kroah.com, Yanmin , Suresh Siddha , Ingo Molnar , stable@kernel.org +Message-ID: <1268297144.5279.940.camel@twins> + +From: Suresh Siddha + +commit dd5feea14a7de4edbd9f36db1a2db785de91b88d upstream + +On platforms like dual socket quad-core platform, the scheduler load +balancer is not detecting the load imbalances in certain scenarios. This +is leading to scenarios like where one socket is completely busy (with +all the 4 cores running with 4 tasks) and leaving another socket +completely idle. This causes performance issues as those 4 tasks share +the memory controller, last-level cache bandwidth etc. Also we won't be +taking advantage of turbo-mode as much as we would like, etc. + +Some of the comparisons in the scheduler load balancing code are +comparing the "weighted cpu load that is scaled wrt sched_group's +cpu_power" with the "weighted average load per task that is not scaled +wrt sched_group's cpu_power". While this has probably been broken for a +longer time (for multi socket numa nodes etc), the problem got aggrevated +via this recent change: + +| +| commit f93e65c186ab3c05ce2068733ca10e34fd00125e +| Author: Peter Zijlstra +| Date: Tue Sep 1 10:34:32 2009 +0200 +| +| sched: Restore __cpu_power to a straight sum of power +| + +Also with this change, the sched group cpu power alone no longer reflects +the group capacity that is needed to implement MC, MT performance +(default) and power-savings (user-selectable) policies. + +We need to use the computed group capacity (sgs.group_capacity, that is +computed using the SD_PREFER_SIBLING logic in update_sd_lb_stats()) to +find out if the group with the max load is above its capacity and how +much load to move etc. + +Reported-by: Ma Ling +Initial-Analysis-by: Zhang, Yanmin +Signed-off-by: Suresh Siddha +[ -v2: build fix ] +Signed-off-by: Peter Zijlstra +LKML-Reference: <1266970432.11588.22.camel@sbs-t61.sc.intel.com> +Signed-off-by: Ingo Molnar + +--- + kernel/sched.c | 76 ++++++++++++++++++++++++++++++++------------------------- + 1 file changed, 43 insertions(+), 33 deletions(-) + +--- a/kernel/sched.c ++++ b/kernel/sched.c +@@ -3402,6 +3402,7 @@ struct sd_lb_stats { + unsigned long max_load; + unsigned long busiest_load_per_task; + unsigned long busiest_nr_running; ++ unsigned long busiest_group_capacity; + + int group_imb; /* Is there imbalance in this sd */ + #if defined(CONFIG_SCHED_MC) || defined(CONFIG_SCHED_SMT) +@@ -3721,8 +3722,7 @@ static inline void update_sg_lb_stats(st + unsigned long load, max_cpu_load, min_cpu_load; + int i; + unsigned int balance_cpu = -1, first_idle_cpu = 0; +- unsigned long sum_avg_load_per_task; +- unsigned long avg_load_per_task; ++ unsigned long avg_load_per_task = 0; + + if (local_group) { + balance_cpu = group_first_cpu(group); +@@ -3731,7 +3731,6 @@ static inline void update_sg_lb_stats(st + } + + /* Tally up the load of all CPUs in the group */ +- sum_avg_load_per_task = avg_load_per_task = 0; + max_cpu_load = 0; + min_cpu_load = ~0UL; + +@@ -3761,7 +3760,6 @@ static inline void update_sg_lb_stats(st + sgs->sum_nr_running += rq->nr_running; + sgs->sum_weighted_load += weighted_cpuload(i); + +- sum_avg_load_per_task += cpu_avg_load_per_task(i); + } + + /* +@@ -3779,7 +3777,6 @@ static inline void update_sg_lb_stats(st + /* Adjust by relative CPU power of the group */ + sgs->avg_load = (sgs->group_load * SCHED_LOAD_SCALE) / group->cpu_power; + +- + /* + * Consider the group unbalanced when the imbalance is larger + * than the average weight of two tasks. +@@ -3789,8 +3786,8 @@ static inline void update_sg_lb_stats(st + * normalized nr_running number somewhere that negates + * the hierarchy? + */ +- avg_load_per_task = (sum_avg_load_per_task * SCHED_LOAD_SCALE) / +- group->cpu_power; ++ if (sgs->sum_nr_running) ++ avg_load_per_task = sgs->sum_weighted_load / sgs->sum_nr_running; + + if ((max_cpu_load - min_cpu_load) > 2*avg_load_per_task) + sgs->group_imb = 1; +@@ -3859,6 +3856,7 @@ static inline void update_sd_lb_stats(st + sds->max_load = sgs.avg_load; + sds->busiest = group; + sds->busiest_nr_running = sgs.sum_nr_running; ++ sds->busiest_group_capacity = sgs.group_capacity; + sds->busiest_load_per_task = sgs.sum_weighted_load; + sds->group_imb = sgs.group_imb; + } +@@ -3881,6 +3879,7 @@ static inline void fix_small_imbalance(s + { + unsigned long tmp, pwr_now = 0, pwr_move = 0; + unsigned int imbn = 2; ++ unsigned long scaled_busy_load_per_task; + + if (sds->this_nr_running) { + sds->this_load_per_task /= sds->this_nr_running; +@@ -3891,8 +3890,12 @@ static inline void fix_small_imbalance(s + sds->this_load_per_task = + cpu_avg_load_per_task(this_cpu); + +- if (sds->max_load - sds->this_load + sds->busiest_load_per_task >= +- sds->busiest_load_per_task * imbn) { ++ scaled_busy_load_per_task = sds->busiest_load_per_task ++ * SCHED_LOAD_SCALE; ++ scaled_busy_load_per_task /= sds->busiest->cpu_power; ++ ++ if (sds->max_load - sds->this_load + scaled_busy_load_per_task >= ++ (scaled_busy_load_per_task * imbn)) { + *imbalance = sds->busiest_load_per_task; + return; + } +@@ -3943,7 +3946,14 @@ static inline void fix_small_imbalance(s + static inline void calculate_imbalance(struct sd_lb_stats *sds, int this_cpu, + unsigned long *imbalance) + { +- unsigned long max_pull; ++ unsigned long max_pull, load_above_capacity = ~0UL; ++ ++ sds->busiest_load_per_task /= sds->busiest_nr_running; ++ if (sds->group_imb) { ++ sds->busiest_load_per_task = ++ min(sds->busiest_load_per_task, sds->avg_load); ++ } ++ + /* + * In the presence of smp nice balancing, certain scenarios can have + * max load less than avg load(as we skip the groups at or below +@@ -3954,9 +3964,29 @@ static inline void calculate_imbalance(s + return fix_small_imbalance(sds, this_cpu, imbalance); + } + +- /* Don't want to pull so many tasks that a group would go idle */ +- max_pull = min(sds->max_load - sds->avg_load, +- sds->max_load - sds->busiest_load_per_task); ++ if (!sds->group_imb) { ++ /* ++ * Don't want to pull so many tasks that a group would go idle. ++ */ ++ load_above_capacity = (sds->busiest_nr_running - ++ sds->busiest_group_capacity); ++ ++ load_above_capacity *= (SCHED_LOAD_SCALE * SCHED_LOAD_SCALE); ++ ++ load_above_capacity /= sds->busiest->cpu_power; ++ } ++ ++ /* ++ * We're trying to get all the cpus to the average_load, so we don't ++ * want to push ourselves above the average load, nor do we wish to ++ * reduce the max loaded cpu below the average load. At the same time, ++ * we also don't want to reduce the group load below the group capacity ++ * (so that we can implement power-savings policies etc). Thus we look ++ * for the minimum possible imbalance. ++ * Be careful of negative numbers as they'll appear as very large values ++ * with unsigned longs. ++ */ ++ max_pull = min(sds->max_load - sds->avg_load, load_above_capacity); + + /* How much load to actually move to equalise the imbalance */ + *imbalance = min(max_pull * sds->busiest->cpu_power, +@@ -4024,7 +4054,6 @@ find_busiest_group(struct sched_domain * + * 4) This group is more busy than the avg busieness at this + * sched_domain. + * 5) The imbalance is within the specified limit. +- * 6) Any rebalance would lead to ping-pong + */ + if (balance && !(*balance)) + goto ret; +@@ -4043,25 +4072,6 @@ find_busiest_group(struct sched_domain * + if (100 * sds.max_load <= sd->imbalance_pct * sds.this_load) + goto out_balanced; + +- sds.busiest_load_per_task /= sds.busiest_nr_running; +- if (sds.group_imb) +- sds.busiest_load_per_task = +- min(sds.busiest_load_per_task, sds.avg_load); +- +- /* +- * We're trying to get all the cpus to the average_load, so we don't +- * want to push ourselves above the average load, nor do we wish to +- * reduce the max loaded cpu below the average load, as either of these +- * actions would just result in more rebalancing later, and ping-pong +- * tasks around. Thus we look for the minimum possible imbalance. +- * Negative imbalances (*we* are more loaded than anyone else) will +- * be counted as no imbalance for these purposes -- we can't fix that +- * by pulling tasks to us. Be careful of negative numbers as they'll +- * appear as very large values with unsigned longs. +- */ +- if (sds.max_load <= sds.busiest_load_per_task) +- goto out_balanced; +- + /* Looks like there is an imbalance. Compute it */ + calculate_imbalance(&sds, this_cpu, imbalance); + return sds.busiest; diff --git a/queue-2.6.32/sched-mark-boot-cpu-active-before-smp_init.patch b/queue-2.6.32/sched-mark-boot-cpu-active-before-smp_init.patch new file mode 100644 index 00000000000..735ded07835 --- /dev/null +++ b/queue-2.6.32/sched-mark-boot-cpu-active-before-smp_init.patch @@ -0,0 +1,46 @@ +From 933b0618d8b2a59c7a0742e43836544e02f1e9bd Mon Sep 17 00:00:00 2001 +From: Peter Zijlstra +Date: Wed, 16 Dec 2009 18:04:31 +0100 +Subject: sched: Mark boot-cpu active before smp_init() + +From: Peter Zijlstra + +commit 933b0618d8b2a59c7a0742e43836544e02f1e9bd upstream. + +A UP machine has 1 active cpu, not having the boot-cpu in the +active map when starting the scheduler confuses things. + +Signed-off-by: Peter Zijlstra +Cc: Mike Galbraith +LKML-Reference: <20091216170517.423469527@chello.nl> +Signed-off-by: Ingo Molnar +Cc: Christoph Biedl +Signed-off-by: Greg Kroah-Hartman + +--- + init/main.c | 7 +------ + 1 file changed, 1 insertion(+), 6 deletions(-) + +--- a/init/main.c ++++ b/init/main.c +@@ -369,12 +369,6 @@ static void __init smp_init(void) + { + unsigned int cpu; + +- /* +- * Set up the current CPU as possible to migrate to. +- * The other ones will be done by cpu_up/cpu_down() +- */ +- set_cpu_active(smp_processor_id(), true); +- + /* FIXME: This should be done in userspace --RR */ + for_each_present_cpu(cpu) { + if (num_online_cpus() >= setup_max_cpus) +@@ -486,6 +480,7 @@ static void __init boot_cpu_init(void) + int cpu = smp_processor_id(); + /* Mark the boot cpu "present", "online" etc for SMP and UP case */ + set_cpu_online(cpu, true); ++ set_cpu_active(cpu, true); + set_cpu_present(cpu, true); + set_cpu_possible(cpu, true); + } diff --git a/queue-2.6.32/series b/queue-2.6.32/series index c295716f8ab..d1db570ccf8 100644 --- a/queue-2.6.32/series +++ b/queue-2.6.32/series @@ -21,3 +21,25 @@ tracing-use-same-local-variable-when-resetting-the-ring-buffer.patch tracing-disable-buffer-switching-when-starting-or-stopping-trace.patch tracing-do-not-record-user-stack-trace-from-nmi-context.patch pci-unconditionally-clear-aer-uncorr-status-register-during-cleanup.patch +drm-edid-unify-detailed-block-parsing-between-base-and-extension-blocks.patch +efifb-fix-framebuffer-handoff.patch +coredump-suppress-uid-comparison-test-if-core-output-files-are-pipes.patch +v4l-dvb-13961-em28xx-dvb-fix-memleak-in-dvb_fini.patch +hrtimer-tune-hrtimer_interrupt-hang-logic.patch +x86-apic-don-t-use-logical-flat-mode-when-cpu-hotplug-may-exceed-8-cpus.patch +mvsas-add-support-for-adaptec-asc-1045-1405-sas-sata-hba.patch +pci-add-support-for-82576ns-serdes-to-existing-sr-iov-quirk.patch +sched-mark-boot-cpu-active-before-smp_init.patch +sparc64-make-prom-entry-spinlock-nmi-safe.patch +sysctl-require-cap_sys_rawio-to-set-mmap_min_addr.patch +e1000e-enable-new-82567v-3-device.patch +ixgbe-add-support-for-82599-kr-device-0x1517.patch +input-wacom-ensure-the-device-is-initialized-properly-upon-resume.patch +ath9k-fix-lockdep-warning-when-unloading-module.patch +mqueue-fix-mq_open-file-descriptor-leak-on-user-space-processes.patch +virtio-fix-out-of-range-array-access.patch +x86-set_personality_ia32-misses-force_personality32.patch +b43-workaround-circular-locking-in-hw-tkip-key-update-callback.patch +sched-fix-sched_mc-regression-caused-by-change-in-sched-cpu_power.patch +readahead-add-blk_run_backing_dev.patch +thinkpad-acpi-lock-down-video-output-state-access.patch diff --git a/queue-2.6.32/sparc64-make-prom-entry-spinlock-nmi-safe.patch b/queue-2.6.32/sparc64-make-prom-entry-spinlock-nmi-safe.patch new file mode 100644 index 00000000000..abf6135ffb7 --- /dev/null +++ b/queue-2.6.32/sparc64-make-prom-entry-spinlock-nmi-safe.patch @@ -0,0 +1,54 @@ +From c682420e87cdd8db0212e29eb70c325cdfc0860c Mon Sep 17 00:00:00 2001 +From: David S. Miller +Date: Wed, 3 Mar 2010 09:06:03 -0800 +Subject: [PATCH] sparc64: Make prom entry spinlock NMI safe. + +From: David S. Miller + +[ Upstream commit 8a4fd1e4922413cfdfa6c51a59efb720d904a5eb ] + +If we do something like try to print to the OF console from an NMI +while we're already in OpenFirmware, we'll deadlock on the spinlock. + +Use a raw spinlock and disable NMIs when we take it. + +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + arch/sparc/prom/p1275.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +--- a/arch/sparc/prom/p1275.c ++++ b/arch/sparc/prom/p1275.c +@@ -32,8 +32,7 @@ extern void prom_cif_interface(void); + extern void prom_cif_callback(void); + + /* +- * This provides SMP safety on the p1275buf. prom_callback() drops this lock +- * to allow recursuve acquisition. ++ * This provides SMP safety on the p1275buf. + */ + DEFINE_SPINLOCK(prom_entry_lock); + +@@ -47,7 +46,9 @@ long p1275_cmd(const char *service, long + + p = p1275buf.prom_buffer; + +- spin_lock_irqsave(&prom_entry_lock, flags); ++ raw_local_save_flags(flags); ++ raw_local_irq_restore(PIL_NMI); ++ spin_lock(&prom_entry_lock); + + p1275buf.prom_args[0] = (unsigned long)p; /* service */ + strcpy (p, service); +@@ -139,7 +140,8 @@ long p1275_cmd(const char *service, long + va_end(list); + x = p1275buf.prom_args [nargs + 3]; + +- spin_unlock_irqrestore(&prom_entry_lock, flags); ++ spin_unlock(&prom_entry_lock); ++ raw_local_irq_restore(flags); + + return x; + } diff --git a/queue-2.6.32/sysctl-require-cap_sys_rawio-to-set-mmap_min_addr.patch b/queue-2.6.32/sysctl-require-cap_sys_rawio-to-set-mmap_min_addr.patch new file mode 100644 index 00000000000..1609a3a2730 --- /dev/null +++ b/queue-2.6.32/sysctl-require-cap_sys_rawio-to-set-mmap_min_addr.patch @@ -0,0 +1,36 @@ +From 0e1a6ef2dea88101b056b6d9984f3325c5efced3 Mon Sep 17 00:00:00 2001 +From: Kees Cook +Date: Sun, 8 Nov 2009 09:37:00 -0800 +Subject: sysctl: require CAP_SYS_RAWIO to set mmap_min_addr + +From: Kees Cook + +commit 0e1a6ef2dea88101b056b6d9984f3325c5efced3 upstream. + +Currently the mmap_min_addr value can only be bypassed during mmap when +the task has CAP_SYS_RAWIO. However, the mmap_min_addr sysctl value itself +can be adjusted to 0 if euid == 0, allowing a bypass without CAP_SYS_RAWIO. +This patch adds a check for the capability before allowing mmap_min_addr to +be changed. + +Signed-off-by: Kees Cook +Acked-by: Serge Hallyn +Signed-off-by: James Morris +Signed-off-by: Greg Kroah-Hartman + +--- + security/min_addr.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/security/min_addr.c ++++ b/security/min_addr.c +@@ -33,6 +33,9 @@ int mmap_min_addr_handler(struct ctl_tab + { + int ret; + ++ if (!capable(CAP_SYS_RAWIO)) ++ return -EPERM; ++ + ret = proc_doulongvec_minmax(table, write, buffer, lenp, ppos); + + update_mmap_min_addr(); diff --git a/queue-2.6.32/thinkpad-acpi-lock-down-video-output-state-access.patch b/queue-2.6.32/thinkpad-acpi-lock-down-video-output-state-access.patch new file mode 100644 index 00000000000..6b8e6aa3f22 --- /dev/null +++ b/queue-2.6.32/thinkpad-acpi-lock-down-video-output-state-access.patch @@ -0,0 +1,115 @@ +From b525c06cdbd8a3963f0173ccd23f9147d4c384b5 Mon Sep 17 00:00:00 2001 +From: Henrique de Moraes Holschuh +Date: Thu, 25 Feb 2010 22:22:22 -0300 +Subject: thinkpad-acpi: lock down video output state access + +From: Henrique de Moraes Holschuh + +commit b525c06cdbd8a3963f0173ccd23f9147d4c384b5 upstream. + +Given the right combination of ThinkPad and X.org, just reading the +video output control state is enough to hard-crash X.org. + +Until the day I somehow find out a model or BIOS cut date to not +provide this feature to ThinkPads that can do video switching through +X RandR, change permissions so that only processes with CAP_SYS_ADMIN +can access any sort of video output control state. + +This bug could be considered a local DoS I suppose, as it allows any +non-privledged local user to cause some versions of X.org to +hard-crash some ThinkPads. + +Reported-by: Jidanni +Signed-off-by: Henrique de Moraes Holschuh +Signed-off-by: Greg Kroah-Hartman + +--- a/Documentation/laptops/thinkpad-acpi.txt ++++ b/Documentation/laptops/thinkpad-acpi.txt +@@ -650,6 +650,10 @@ LCD, CRT or DVI (if available). The following commands are available: + echo expand_toggle > /proc/acpi/ibm/video + echo video_switch > /proc/acpi/ibm/video + ++NOTE: Access to this feature is restricted to processes owning the ++CAP_SYS_ADMIN capability for safety reasons, as it can interact badly ++enough with some versions of X.org to crash it. ++ + Each video output device can be enabled or disabled individually. + Reading /proc/acpi/ibm/video shows the status of each device. + +diff --git a/drivers/platform/x86/Kconfig b/drivers/platform/x86/Kconfig +index f526e73..11fce79 100644 +--- a/drivers/platform/x86/Kconfig ++++ b/drivers/platform/x86/Kconfig +@@ -319,9 +319,15 @@ config THINKPAD_ACPI_VIDEO + server running, phase of the moon, and the current mood of + Schroedinger's cat. If you can use X.org's RandR to control + your ThinkPad's video output ports instead of this feature, +- don't think twice: do it and say N here to save some memory. ++ don't think twice: do it and say N here to save memory and avoid ++ bad interactions with X.org. + +- If you are not sure, say Y here. ++ NOTE: access to this feature is limited to processes with the ++ CAP_SYS_ADMIN capability, to avoid local DoS issues in platforms ++ where it interacts badly with X.org. ++ ++ If you are not sure, say Y here but do try to check if you could ++ be using X.org RandR instead. + + config THINKPAD_ACPI_HOTKEY_POLL + bool "Support NVRAM polling for hot keys" +diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c +index 3af4628..5d02cc0 100644 +--- a/drivers/platform/x86/thinkpad_acpi.c ++++ b/drivers/platform/x86/thinkpad_acpi.c +@@ -286,6 +286,7 @@ struct ibm_init_struct { + char param[32]; + + int (*init) (struct ibm_init_struct *); ++ mode_t base_procfs_mode; + struct ibm_struct *data; + }; + +@@ -4629,6 +4630,10 @@ static int video_read(struct seq_file *m) + return 0; + } + ++ /* Even reads can crash X.org, so... */ ++ if (!capable(CAP_SYS_ADMIN)) ++ return -EPERM; ++ + status = video_outputsw_get(); + if (status < 0) + return status; +@@ -4662,6 +4667,10 @@ static int video_write(char *buf) + if (video_supported == TPACPI_VIDEO_NONE) + return -ENODEV; + ++ /* Even reads can crash X.org, let alone writes... */ ++ if (!capable(CAP_SYS_ADMIN)) ++ return -EPERM; ++ + enable = 0; + disable = 0; + +@@ -8487,9 +8496,10 @@ static int __init ibm_init(struct ibm_init_struct *iibm) + "%s installed\n", ibm->name); + + if (ibm->read) { +- mode_t mode; ++ mode_t mode = iibm->base_procfs_mode; + +- mode = S_IRUGO; ++ if (!mode) ++ mode = S_IRUGO; + if (ibm->write) + mode |= S_IWUSR; + entry = proc_create_data(ibm->name, mode, proc_dir, +@@ -8680,6 +8690,7 @@ static struct ibm_init_struct ibms_init[] __initdata = { + #ifdef CONFIG_THINKPAD_ACPI_VIDEO + { + .init = video_init, ++ .base_procfs_mode = S_IRUSR, + .data = &video_driver_data, + }, + #endif diff --git a/queue-2.6.32/v4l-dvb-13961-em28xx-dvb-fix-memleak-in-dvb_fini.patch b/queue-2.6.32/v4l-dvb-13961-em28xx-dvb-fix-memleak-in-dvb_fini.patch new file mode 100644 index 00000000000..703e6b69729 --- /dev/null +++ b/queue-2.6.32/v4l-dvb-13961-em28xx-dvb-fix-memleak-in-dvb_fini.patch @@ -0,0 +1,33 @@ +From 19f48cb105b7fa18d0dcab435919a3a29b7a7c4c Mon Sep 17 00:00:00 2001 +From: Francesco Lavra +Date: Thu, 31 Dec 2009 08:47:11 -0300 +Subject: V4L/DVB (13961): em28xx-dvb: fix memleak in dvb_fini() + +From: Francesco Lavra + +commit 19f48cb105b7fa18d0dcab435919a3a29b7a7c4c upstream. + +this patch fixes a memory leak which occurs when an em28xx card with DVB +extension is unplugged or its DVB extension driver is unloaded. In +dvb_fini(), dev->dvb must be freed before being set to NULL, as is done +in dvb_init() in case of error. +Note that this bug is also present in the latest stable kernel release. + +Signed-off-by: Francesco Lavra +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/video/em28xx/em28xx-dvb.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/media/video/em28xx/em28xx-dvb.c ++++ b/drivers/media/video/em28xx/em28xx-dvb.c +@@ -610,6 +610,7 @@ static int dvb_fini(struct em28xx *dev) + + if (dev->dvb) { + unregister_dvb(dev->dvb); ++ kfree(dev->dvb); + dev->dvb = NULL; + } + diff --git a/queue-2.6.32/virtio-fix-out-of-range-array-access.patch b/queue-2.6.32/virtio-fix-out-of-range-array-access.patch new file mode 100644 index 00000000000..5608c27c457 --- /dev/null +++ b/queue-2.6.32/virtio-fix-out-of-range-array-access.patch @@ -0,0 +1,69 @@ +From 3119815912a220bdac943dfbdfee640414c0c611 Mon Sep 17 00:00:00 2001 +From: Michael S. Tsirkin +Date: Thu, 25 Feb 2010 19:08:55 +0200 +Subject: virtio: fix out of range array access + +From: Michael S. Tsirkin + +commit 3119815912a220bdac943dfbdfee640414c0c611 upstream. + +I have observed the following error on virtio-net module unload: + +------------[ cut here ]------------ +WARNING: at kernel/irq/manage.c:858 __free_irq+0xa0/0x14c() +Hardware name: Bochs +Trying to free already-free IRQ 0 +Modules linked in: virtio_net(-) virtio_blk virtio_pci virtio_ring +virtio af_packet e1000 shpchp aacraid uhci_hcd ohci_hcd ehci_hcd [last +unloaded: scsi_wait_scan] +Pid: 1957, comm: rmmod Not tainted 2.6.33-rc8-vhost #24 +Call Trace: + [] warn_slowpath_common+0x7c/0x94 + [] warn_slowpath_fmt+0x41/0x43 + [] ? __free_pages+0x5a/0x70 + [] __free_irq+0xa0/0x14c + [] free_irq+0x3f/0x65 + [] vp_del_vqs+0x81/0xb1 [virtio_pci] + [] virtnet_remove+0xda/0x10b [virtio_net] + [] virtio_dev_remove+0x22/0x4a [virtio] + [] __device_release_driver+0x66/0xac + [] driver_detach+0x83/0xa9 + [] bus_remove_driver+0x91/0xb4 + [] driver_unregister+0x6c/0x74 + [] unregister_virtio_driver+0xe/0x10 [virtio] + [] fini+0x15/0x17 [virtio_net] + [] sys_delete_module+0x1c3/0x230 + [] ? old_ich_force_enable_hpet+0x117/0x164 + [] ? do_page_fault+0x29c/0x2cc + [] sysenter_dispatch+0x7/0x27 +---[ end trace 15e88e4c576cc62b ]--- + +The bug is in virtio-pci: we use msix_vector as array index to get irq +entry, but some vqs do not have a dedicated vector so this causes an out +of bounds access. By chance, we seem to often get 0 value, which +results in this error. + +Fix by verifying that vector is legal before using it as index. + +Signed-off-by: Michael S. Tsirkin +Acked-by: Anthony Liguori +Acked-by: Shirley Ma +Acked-by: Amit Shah +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/virtio/virtio_pci.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/virtio/virtio_pci.c ++++ b/drivers/virtio/virtio_pci.c +@@ -473,7 +473,8 @@ static void vp_del_vqs(struct virtio_dev + + list_for_each_entry_safe(vq, n, &vdev->vqs, list) { + info = vq->priv; +- if (vp_dev->per_vq_vectors) ++ if (vp_dev->per_vq_vectors && ++ info->msix_vector != VIRTIO_MSI_NO_VECTOR) + free_irq(vp_dev->msix_entries[info->msix_vector].vector, + vq); + vp_del_vq(vq); diff --git a/queue-2.6.32/x86-apic-don-t-use-logical-flat-mode-when-cpu-hotplug-may-exceed-8-cpus.patch b/queue-2.6.32/x86-apic-don-t-use-logical-flat-mode-when-cpu-hotplug-may-exceed-8-cpus.patch new file mode 100644 index 00000000000..0ac4ad62651 --- /dev/null +++ b/queue-2.6.32/x86-apic-don-t-use-logical-flat-mode-when-cpu-hotplug-may-exceed-8-cpus.patch @@ -0,0 +1,184 @@ +From suresh.b.siddha@intel.com Thu Mar 18 16:25:46 2010 +From: Suresh Siddha +Date: Thu, 18 Feb 2010 15:30:55 -0800 +Subject: x86, apic: Don't use logical-flat mode when CPU hotplug may exceed 8 CPUs +To: Greg KH +Cc: "Zheng, Shaohui" , Yinghai Lu , "H. Peter Anvin" , "stable@kernel.org" +Message-ID: <1266535855.2909.36.camel@sbs-t61.sc.intel.com> + +From: Suresh Siddha + +commit 681ee44d40d7c93b42118320e4620d07d8704fd6 upstream + +We need to fall back from logical-flat APIC mode to physical-flat mode +when we have more than 8 CPUs. However, in the presence of CPU +hotplug(with bios listing not enabled but possible cpus as disabled cpus in +MADT), we have to consider the number of possible CPUs rather than +the number of current CPUs; otherwise we may cross the 8-CPU boundary +when CPUs are added later. + +32bit apic code can use more cleanups (like the removal of vendor checks in +32bit default_setup_apic_routing()) and more unifications with 64bit code. +Yinghai has some patches in works already. This patch addresses the boot issue +that is reported in the virtualization guest context. + +Signed-off-by: Suresh Siddha +Acked-by: Shaohui Zheng +Reviewed-by: Yinghai Lu +Signed-off-by: H. Peter Anvin +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/acpi/boot.c | 5 ----- + arch/x86/kernel/apic/apic.c | 14 -------------- + arch/x86/kernel/apic/probe_32.c | 27 ++++++++++++++++++++++++++- + arch/x86/kernel/apic/probe_64.c | 13 ++----------- + arch/x86/kernel/mpparse.c | 7 ------- + arch/x86/kernel/smpboot.c | 2 -- + 6 files changed, 28 insertions(+), 40 deletions(-) + +--- a/arch/x86/kernel/acpi/boot.c ++++ b/arch/x86/kernel/acpi/boot.c +@@ -1191,9 +1191,6 @@ static void __init acpi_process_madt(voi + if (!error) { + acpi_lapic = 1; + +-#ifdef CONFIG_X86_BIGSMP +- generic_bigsmp_probe(); +-#endif + /* + * Parse MADT IO-APIC entries + */ +@@ -1203,8 +1200,6 @@ static void __init acpi_process_madt(voi + acpi_ioapic = 1; + + smp_found_config = 1; +- if (apic->setup_apic_routing) +- apic->setup_apic_routing(); + } + } + if (error == -EINVAL) { +--- a/arch/x86/kernel/apic/apic.c ++++ b/arch/x86/kernel/apic/apic.c +@@ -1665,9 +1665,7 @@ int __init APIC_init_uniprocessor(void) + #endif + + enable_IR_x2apic(); +-#ifdef CONFIG_X86_64 + default_setup_apic_routing(); +-#endif + + verify_local_APIC(); + connect_bsp_APIC(); +@@ -1915,18 +1913,6 @@ void __cpuinit generic_processor_info(in + if (apicid > max_physical_apicid) + max_physical_apicid = apicid; + +-#ifdef CONFIG_X86_32 +- switch (boot_cpu_data.x86_vendor) { +- case X86_VENDOR_INTEL: +- if (num_processors > 8) +- def_to_bigsmp = 1; +- break; +- case X86_VENDOR_AMD: +- if (max_physical_apicid >= 8) +- def_to_bigsmp = 1; +- } +-#endif +- + #if defined(CONFIG_SMP) || defined(CONFIG_X86_64) + early_per_cpu(x86_cpu_to_apicid, cpu) = apicid; + early_per_cpu(x86_bios_cpu_apicid, cpu) = apicid; +--- a/arch/x86/kernel/apic/probe_32.c ++++ b/arch/x86/kernel/apic/probe_32.c +@@ -54,6 +54,31 @@ late_initcall(print_ipi_mode); + + void default_setup_apic_routing(void) + { ++ int version = apic_version[boot_cpu_physical_apicid]; ++ ++ if (num_possible_cpus() > 8) { ++ switch (boot_cpu_data.x86_vendor) { ++ case X86_VENDOR_INTEL: ++ if (!APIC_XAPIC(version)) { ++ def_to_bigsmp = 0; ++ break; ++ } ++ /* If P4 and above fall through */ ++ case X86_VENDOR_AMD: ++ def_to_bigsmp = 1; ++ } ++ } ++ ++#ifdef CONFIG_X86_BIGSMP ++ generic_bigsmp_probe(); ++#endif ++ ++ if (apic->setup_apic_routing) ++ apic->setup_apic_routing(); ++} ++ ++void setup_apic_flat_routing(void) ++{ + #ifdef CONFIG_X86_IO_APIC + printk(KERN_INFO + "Enabling APIC mode: Flat. Using %d I/O APICs\n", +@@ -103,7 +128,7 @@ struct apic apic_default = { + .init_apic_ldr = default_init_apic_ldr, + + .ioapic_phys_id_map = default_ioapic_phys_id_map, +- .setup_apic_routing = default_setup_apic_routing, ++ .setup_apic_routing = setup_apic_flat_routing, + .multi_timer_check = NULL, + .apicid_to_node = default_apicid_to_node, + .cpu_to_logical_apicid = default_cpu_to_logical_apicid, +--- a/arch/x86/kernel/apic/probe_64.c ++++ b/arch/x86/kernel/apic/probe_64.c +@@ -67,17 +67,8 @@ void __init default_setup_apic_routing(v + } + #endif + +- if (apic == &apic_flat) { +- switch (boot_cpu_data.x86_vendor) { +- case X86_VENDOR_INTEL: +- if (num_processors > 8) +- apic = &apic_physflat; +- break; +- case X86_VENDOR_AMD: +- if (max_physical_apicid >= 8) +- apic = &apic_physflat; +- } +- } ++ if (apic == &apic_flat && num_possible_cpus() > 8) ++ apic = &apic_physflat; + + printk(KERN_INFO "Setting APIC routing to %s\n", apic->name); + +--- a/arch/x86/kernel/mpparse.c ++++ b/arch/x86/kernel/mpparse.c +@@ -359,13 +359,6 @@ static int __init smp_read_mpc(struct mp + x86_init.mpparse.mpc_record(1); + } + +-#ifdef CONFIG_X86_BIGSMP +- generic_bigsmp_probe(); +-#endif +- +- if (apic->setup_apic_routing) +- apic->setup_apic_routing(); +- + if (!num_processors) + printk(KERN_ERR "MPTABLE: no processors registered!\n"); + return num_processors; +--- a/arch/x86/kernel/smpboot.c ++++ b/arch/x86/kernel/smpboot.c +@@ -1066,9 +1066,7 @@ void __init native_smp_prepare_cpus(unsi + set_cpu_sibling_map(0); + + enable_IR_x2apic(); +-#ifdef CONFIG_X86_64 + default_setup_apic_routing(); +-#endif + + if (smp_sanity_check(max_cpus) < 0) { + printk(KERN_INFO "SMP disabled\n"); diff --git a/queue-2.6.32/x86-set_personality_ia32-misses-force_personality32.patch b/queue-2.6.32/x86-set_personality_ia32-misses-force_personality32.patch new file mode 100644 index 00000000000..dc1981d8df7 --- /dev/null +++ b/queue-2.6.32/x86-set_personality_ia32-misses-force_personality32.patch @@ -0,0 +1,30 @@ +From 1252f238db48ec419f40c1bdf30fda649860eed9 Mon Sep 17 00:00:00 2001 +From: Oleg Nesterov +Date: Tue, 16 Feb 2010 15:02:13 +0100 +Subject: x86: set_personality_ia32() misses force_personality32 + +From: Oleg Nesterov + +commit 1252f238db48ec419f40c1bdf30fda649860eed9 upstream. + +05d43ed8a "x86: get rid of the insane TIF_ABI_PENDING bit" forgot about +force_personality32. Fix. + +Signed-off-by: Oleg Nesterov +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/process_64.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/arch/x86/kernel/process_64.c ++++ b/arch/x86/kernel/process_64.c +@@ -546,6 +546,7 @@ void set_personality_ia32(void) + + /* Make sure to be in 32bit mode */ + set_thread_flag(TIF_IA32); ++ current->personality |= force_personality32; + + /* Prepare the first "return" to user space */ + current_thread_info()->status |= TS_COMPAT;