From: Greg Kroah-Hartman Date: Fri, 3 Dec 2010 23:23:15 +0000 (-0800) Subject: .36 patches X-Git-Tag: v2.6.27.57~60 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=9f934a6395ff060cc8d9a82365490751f4984bdd;p=thirdparty%2Fkernel%2Fstable-queue.git .36 patches --- diff --git a/queue-2.6.36/agp-intel-also-add-b43.1-to-list-of-supported-devices.patch b/queue-2.6.36/agp-intel-also-add-b43.1-to-list-of-supported-devices.patch new file mode 100644 index 00000000000..51c46967f97 --- /dev/null +++ b/queue-2.6.36/agp-intel-also-add-b43.1-to-list-of-supported-devices.patch @@ -0,0 +1,30 @@ +From 3dde04b0152634d42994b34b86bbf3c70fbc6b19 Mon Sep 17 00:00:00 2001 +From: Chris Wilson +Date: Thu, 14 Oct 2010 16:30:41 +0100 +Subject: agp/intel: Also add B43.1 to list of supported devices + +From: Chris Wilson + +commit 3dde04b0152634d42994b34b86bbf3c70fbc6b19 upstream. + +This was a missing piece from 41a5142 that dropped recognition of the +AGP module for the second B43 variant. + +Reported-by: Stefan Bader +Signed-off-by: Chris Wilson +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/char/agp/intel-agp.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/char/agp/intel-agp.c ++++ b/drivers/char/agp/intel-agp.c +@@ -1049,6 +1049,7 @@ static struct pci_device_id agp_intel_pc + ID(PCI_DEVICE_ID_INTEL_G45_HB), + ID(PCI_DEVICE_ID_INTEL_G41_HB), + ID(PCI_DEVICE_ID_INTEL_B43_HB), ++ ID(PCI_DEVICE_ID_INTEL_B43_1_HB), + ID(PCI_DEVICE_ID_INTEL_IRONLAKE_D_HB), + ID(PCI_DEVICE_ID_INTEL_IRONLAKE_M_HB), + ID(PCI_DEVICE_ID_INTEL_IRONLAKE_MA_HB), diff --git a/queue-2.6.36/alsa-hda-use-bios-auto-parsing-instead-of-existing-model-quirk-for-medion-md2.patch b/queue-2.6.36/alsa-hda-use-bios-auto-parsing-instead-of-existing-model-quirk-for-medion-md2.patch new file mode 100644 index 00000000000..758d8a130b5 --- /dev/null +++ b/queue-2.6.36/alsa-hda-use-bios-auto-parsing-instead-of-existing-model-quirk-for-medion-md2.patch @@ -0,0 +1,40 @@ +From ac70eb1305d5a81efd1e32327d7e79be15a63a5a Mon Sep 17 00:00:00 2001 +From: Daniel T Chen +Date: Sat, 27 Nov 2010 13:58:04 -0500 +Subject: ALSA: hda: Use BIOS auto-parsing instead of existing model quirk for MEDION MD2 + +From: Daniel T Chen + +commit ac70eb1305d5a81efd1e32327d7e79be15a63a5a upstream. + +BugLink: https://launchpad.net/bugs/682199 + +A 2.6.35 (Ubuntu Maverick) user, burningphantom1, reported a regression +in audio: playback was inaudible through both speakers and headphones. +In commit 272a527c04 of sound-2.6.git, a new model was added with this +machine's PCI SSID. Fortunately, it is now sufficient to use the auto +model for BIOS auto-parsing instead of the existing quirk. + +Playback, capture, and jack sense were verified working for both +2.6.35 and the alsa-driver snapshot from 2010-11-27 when model=auto is +used. + +Reported-and-tested-by: burningphantom1 +Signed-off-by: Daniel T Chen +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_realtek.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -9664,7 +9664,6 @@ static struct snd_pci_quirk alc882_cfg_t + SND_PCI_QUIRK(0x17aa, 0x3bfc, "Lenovo NB0763", ALC883_LENOVO_NB0763), + SND_PCI_QUIRK(0x17aa, 0x3bfd, "Lenovo NB0763", ALC883_LENOVO_NB0763), + SND_PCI_QUIRK(0x17aa, 0x101d, "Lenovo Sky", ALC888_LENOVO_SKY), +- SND_PCI_QUIRK(0x17c0, 0x4071, "MEDION MD2", ALC883_MEDION_MD2), + SND_PCI_QUIRK(0x17c0, 0x4085, "MEDION MD96630", ALC888_LENOVO_MS7195_DIG), + SND_PCI_QUIRK(0x17f2, 0x5000, "Albatron KI690-AM2", ALC883_6ST_DIG), + SND_PCI_QUIRK(0x1991, 0x5625, "Haier W66", ALC883_HAIER_W66), diff --git a/queue-2.6.36/b43-fix-warning-at-drivers-mmc-core-core.c-237-in-mmc_wait_for_cmd.patch b/queue-2.6.36/b43-fix-warning-at-drivers-mmc-core-core.c-237-in-mmc_wait_for_cmd.patch new file mode 100644 index 00000000000..0bf8f82ada9 --- /dev/null +++ b/queue-2.6.36/b43-fix-warning-at-drivers-mmc-core-core.c-237-in-mmc_wait_for_cmd.patch @@ -0,0 +1,68 @@ +From 9f2a0fac625bcef9c579bcf0b0c904ab1a56e7c4 Mon Sep 17 00:00:00 2001 +From: Larry Finger +Date: Thu, 28 Oct 2010 10:43:26 -0500 +Subject: b43: Fix warning at drivers/mmc/core/core.c:237 in mmc_wait_for_cmd + +From: Larry Finger + +commit 9f2a0fac625bcef9c579bcf0b0c904ab1a56e7c4 upstream. + +On module removal, the sdio version of b43 generates the following warning: + +[ 851.560519] ------------[ cut here ]------------ +[ 851.560531] WARNING: at drivers/mmc/core/core.c:237 mmc_wait_for_cmd+0x88/0x90() +[ 851.560534] Hardware name: 20552PG +[ 851.560536] Modules linked in: b43(-) ssb mmc_block binfmt_misc rfcomm sco bnep ppdev l2cap ipt_MASQUERADE iptable_nat nf_nat nf_conntrack_ipv4 nf_defrag_ipv4 xt_state nf_conntrack ipt_REJECT xt_tcpudp iptable_filter ip_tables x_tables bridge stp kvm_intel kvm arc4 iwlagn snd_hda_codec_conexant snd_hda_intel snd_hda_codec iwlcore snd_hwdep snd_pcm thinkpad_acpi mac80211 snd_seq_midi snd_rawmidi snd_seq_midi_event snd_seq r852 joydev snd_timer sm_common pcmcia nand snd_seq_device cfg80211 sdhci_pci btusb psmouse tpm_tis yenta_socket nand_ids lp snd pcmcia_rsrc nand_ecc bluetooth sdhci tpm pcmcia_core parport mtd snd_page_alloc serio_raw tpm_bios soundcore nvram led_class sha256_generic aes_i586 aes_generic dm_crypt i915 drm_kms_helper drm ahci intel_agp i2c_algo_bit intel_gtt e1000e libahci video agpgart output +[ 851.560620] Pid: 2504, comm: rmmod Not tainted 2.6.36-titan0+ #1 +[ 851.560622] Call Trace: +[ 851.560631] [] warn_slowpath_common+0x72/0xa0 +[ 851.560636] [] ? mmc_wait_for_cmd+0x88/0x90 +[ 851.560641] [] ? mmc_wait_for_cmd+0x88/0x90 +[ 851.560645] [] warn_slowpath_null+0x22/0x30 +[ 851.560649] [] mmc_wait_for_cmd+0x88/0x90 +[ 851.560655] [] ? device_release+0x25/0x80 +[ 851.560660] [] mmc_io_rw_direct_host+0xa0/0x150 +[ 851.560665] [] mmc_io_rw_direct+0x30/0x40 +[ 851.560669] [] sdio_disable_func+0x37/0xa0 +[ 851.560683] [] b43_sdio_remove+0x30/0x50 [b43] +[ 851.560687] [] sdio_bus_remove+0x1c/0x60 +[ 851.560692] [] ? blocking_notifier_call_chain+0x1f/0x30 +[ 851.560697] [] __device_release_driver+0x51/0xb0 +[ 851.560701] [] driver_detach+0x8f/0xa0 +[ 851.560705] [] bus_remove_driver+0x63/0xa0 +[ 851.560709] [] driver_unregister+0x49/0x80 +[ 851.560713] [] ? driver_unregister+0x49/0x80 +[ 851.560718] [] sdio_unregister_driver+0x17/0x20 +[ 851.560727] [] b43_sdio_exit+0x12/0x20 [b43] +[ 851.560734] [] b43_exit+0x17/0x3c [b43] +[ 851.560740] [] sys_delete_module+0x13d/0x200 +[ 851.560747] [] ? do_munmap+0x212/0x300 +[ 851.560752] [] sysenter_do_call+0x12/0x28 +[ 851.560757] ---[ end trace 31e14488072d2f7d ]--- +[ 851.560759] ------------[ cut here ]------------ + +The warning is caused by b43 not claiming the device before calling +sdio_disable_func(). + +Signed-off-by: Larry Finger +Reported-by: Arnd Hannemann +Tested-by: Arnd Hannemann +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/b43/sdio.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/net/wireless/b43/sdio.c ++++ b/drivers/net/wireless/b43/sdio.c +@@ -175,7 +175,9 @@ static void b43_sdio_remove(struct sdio_ + struct b43_sdio *sdio = sdio_get_drvdata(func); + + ssb_bus_unregister(&sdio->ssb); ++ sdio_claim_host(func); + sdio_disable_func(func); ++ sdio_release_host(func); + kfree(sdio); + sdio_set_drvdata(func, NULL); + } diff --git a/queue-2.6.36/drivers-char-vt_ioctl.c-fix-vt_openqry-error-value.patch b/queue-2.6.36/drivers-char-vt_ioctl.c-fix-vt_openqry-error-value.patch new file mode 100644 index 00000000000..1395336df37 --- /dev/null +++ b/queue-2.6.36/drivers-char-vt_ioctl.c-fix-vt_openqry-error-value.patch @@ -0,0 +1,72 @@ +From 1e0ad2881d50becaeea70ec696a80afeadf944d2 Mon Sep 17 00:00:00 2001 +From: Graham Gower +Date: Wed, 27 Oct 2010 15:33:00 -0700 +Subject: drivers/char/vt_ioctl.c: fix VT_OPENQRY error value + +From: Graham Gower + +commit 1e0ad2881d50becaeea70ec696a80afeadf944d2 upstream. + +When all VT's are in use, VT_OPENQRY casts -1 to unsigned char before +returning it to userspace as an int. VT255 is not the next available +console. + +Signed-off-by: Graham Gower +Cc: Greg KH +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/char/vt_ioctl.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +--- a/drivers/char/vt_ioctl.c ++++ b/drivers/char/vt_ioctl.c +@@ -503,6 +503,7 @@ int vt_ioctl(struct tty_struct *tty, str + struct kbd_struct * kbd; + unsigned int console; + unsigned char ucval; ++ unsigned int uival; + void __user *up = (void __user *)arg; + int i, perm; + int ret = 0; +@@ -657,7 +658,7 @@ int vt_ioctl(struct tty_struct *tty, str + break; + + case KDGETMODE: +- ucval = vc->vc_mode; ++ uival = vc->vc_mode; + goto setint; + + case KDMAPDISP: +@@ -695,7 +696,7 @@ int vt_ioctl(struct tty_struct *tty, str + break; + + case KDGKBMODE: +- ucval = ((kbd->kbdmode == VC_RAW) ? K_RAW : ++ uival = ((kbd->kbdmode == VC_RAW) ? K_RAW : + (kbd->kbdmode == VC_MEDIUMRAW) ? K_MEDIUMRAW : + (kbd->kbdmode == VC_UNICODE) ? K_UNICODE : + K_XLATE); +@@ -717,9 +718,9 @@ int vt_ioctl(struct tty_struct *tty, str + break; + + case KDGKBMETA: +- ucval = (vc_kbd_mode(kbd, VC_META) ? K_ESCPREFIX : K_METABIT); ++ uival = (vc_kbd_mode(kbd, VC_META) ? K_ESCPREFIX : K_METABIT); + setint: +- ret = put_user(ucval, (int __user *)arg); ++ ret = put_user(uival, (int __user *)arg); + break; + + case KDGETKEYCODE: +@@ -949,7 +950,7 @@ int vt_ioctl(struct tty_struct *tty, str + for (i = 0; i < MAX_NR_CONSOLES; ++i) + if (! VT_IS_IN_USE(i)) + break; +- ucval = i < MAX_NR_CONSOLES ? (i+1) : -1; ++ uival = i < MAX_NR_CONSOLES ? (i+1) : -1; + goto setint; + + /* diff --git a/queue-2.6.36/drivers-misc-ad525x_dpot.c-fix-typo-in-spi-write16-and-write24-transfer-counts.patch b/queue-2.6.36/drivers-misc-ad525x_dpot.c-fix-typo-in-spi-write16-and-write24-transfer-counts.patch new file mode 100644 index 00000000000..d100f4c876f --- /dev/null +++ b/queue-2.6.36/drivers-misc-ad525x_dpot.c-fix-typo-in-spi-write16-and-write24-transfer-counts.patch @@ -0,0 +1,43 @@ +From 1f9fa5216eacf4fdf9d3e4ab57feb8b642f0e78b Mon Sep 17 00:00:00 2001 +From: Michael Hennerich +Date: Tue, 26 Oct 2010 14:21:16 -0700 +Subject: drivers/misc/ad525x_dpot.c: fix typo in spi write16 and write24 transfer counts + +From: Michael Hennerich + +commit 1f9fa5216eacf4fdf9d3e4ab57feb8b642f0e78b upstream. + +This is a bug fix. Some SPI connected devices using 16/24 bit accesses, +previously failed, now work. + +This typo slipped in after testing, during some restructuring. + +Signed-off-by: Michael Hennerich +Cc: Mike Frysinger +Cc: Chris Verges +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/misc/ad525x_dpot-spi.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/misc/ad525x_dpot-spi.c ++++ b/drivers/misc/ad525x_dpot-spi.c +@@ -53,13 +53,13 @@ static int write8(void *client, u8 val) + static int write16(void *client, u8 reg, u8 val) + { + u8 data[2] = {reg, val}; +- return spi_write(client, data, 1); ++ return spi_write(client, data, 2); + } + + static int write24(void *client, u8 reg, u16 val) + { + u8 data[3] = {reg, val >> 8, val}; +- return spi_write(client, data, 1); ++ return spi_write(client, data, 3); + } + + static int read8(void *client) diff --git a/queue-2.6.36/ecryptfs-call-vfs_setxattr-in-ecryptfs_setxattr.patch b/queue-2.6.36/ecryptfs-call-vfs_setxattr-in-ecryptfs_setxattr.patch new file mode 100644 index 00000000000..174829409d4 --- /dev/null +++ b/queue-2.6.36/ecryptfs-call-vfs_setxattr-in-ecryptfs_setxattr.patch @@ -0,0 +1,59 @@ +From 48b512e6857139393cdfce26348c362b87537018 Mon Sep 17 00:00:00 2001 +From: Roberto Sassu +Date: Tue, 5 Oct 2010 18:53:45 +0200 +Subject: ecryptfs: call vfs_setxattr() in ecryptfs_setxattr() + +From: Roberto Sassu + +commit 48b512e6857139393cdfce26348c362b87537018 upstream. + +Ecryptfs is a stackable filesystem which relies on lower filesystems the +ability of setting/getting extended attributes. + +If there is a security module enabled on the system it updates the +'security' field of inodes according to the owned extended attribute set +with the function vfs_setxattr(). When this function is performed on a +ecryptfs filesystem the 'security' field is not updated for the lower +filesystem since the call security_inode_post_setxattr() is missing for +the lower inode. +Further, the call security_inode_setxattr() is missing for the lower inode, +leading to policy violations in the security module because specific +checks for this hook are not performed (i. e. filesystem +'associate' permission on SELinux is not checked for the lower filesystem). + +This patch replaces the call of the setxattr() method of the lower inode +in the function ecryptfs_setxattr() with vfs_setxattr(). + +Signed-off-by: Roberto Sassu +Cc: Dustin Kirkland +Acked-by: James Morris +Signed-off-by: Tyler Hicks +Signed-off-by: Greg Kroah-Hartman + +--- + fs/ecryptfs/inode.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +--- a/fs/ecryptfs/inode.c ++++ b/fs/ecryptfs/inode.c +@@ -32,6 +32,7 @@ + #include + #include + #include ++#include + #include + #include "ecryptfs_kernel.h" + +@@ -1112,10 +1113,8 @@ ecryptfs_setxattr(struct dentry *dentry, + rc = -EOPNOTSUPP; + goto out; + } +- mutex_lock(&lower_dentry->d_inode->i_mutex); +- rc = lower_dentry->d_inode->i_op->setxattr(lower_dentry, name, value, +- size, flags); +- mutex_unlock(&lower_dentry->d_inode->i_mutex); ++ ++ rc = vfs_setxattr(lower_dentry, name, value, size, flags); + out: + return rc; + } diff --git a/queue-2.6.36/ecryptfs-clear-lookup_open-flag-when-creating-lower-file.patch b/queue-2.6.36/ecryptfs-clear-lookup_open-flag-when-creating-lower-file.patch new file mode 100644 index 00000000000..17bddc43ba9 --- /dev/null +++ b/queue-2.6.36/ecryptfs-clear-lookup_open-flag-when-creating-lower-file.patch @@ -0,0 +1,50 @@ +From 2e21b3f124eceb6ab5a07c8a061adce14ac94e14 Mon Sep 17 00:00:00 2001 +From: Tyler Hicks +Date: Thu, 23 Sep 2010 02:35:04 -0500 +Subject: eCryptfs: Clear LOOKUP_OPEN flag when creating lower file + +From: Tyler Hicks + +commit 2e21b3f124eceb6ab5a07c8a061adce14ac94e14 upstream. + +eCryptfs was passing the LOOKUP_OPEN flag through to the lower file +system, even though ecryptfs_create() doesn't support the flag. A valid +filp for the lower filesystem could be returned in the nameidata if the +lower file system's create() function supported LOOKUP_OPEN, possibly +resulting in unencrypted writes to the lower file. + +However, this is only a potential problem in filesystems (FUSE, NFS, +CIFS, CEPH, 9p) that eCryptfs isn't known to support today. + +https://bugs.launchpad.net/ecryptfs/+bug/641703 + +Reported-by: Kevin Buhr +Signed-off-by: Tyler Hicks +Signed-off-by: Greg Kroah-Hartman + +--- + fs/ecryptfs/inode.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/fs/ecryptfs/inode.c ++++ b/fs/ecryptfs/inode.c +@@ -70,15 +70,19 @@ ecryptfs_create_underlying_file(struct i + struct vfsmount *lower_mnt = ecryptfs_dentry_to_lower_mnt(dentry); + struct dentry *dentry_save; + struct vfsmount *vfsmount_save; ++ unsigned int flags_save; + int rc; + + dentry_save = nd->path.dentry; + vfsmount_save = nd->path.mnt; ++ flags_save = nd->flags; + nd->path.dentry = lower_dentry; + nd->path.mnt = lower_mnt; ++ nd->flags &= ~LOOKUP_OPEN; + rc = vfs_create(lower_dir_inode, lower_dentry, mode, nd); + nd->path.dentry = dentry_save; + nd->path.mnt = vfsmount_save; ++ nd->flags = flags_save; + return rc; + } + diff --git a/queue-2.6.36/hostfs-fix-uml-crash-remove-f_spare-from-hostfs.patch b/queue-2.6.36/hostfs-fix-uml-crash-remove-f_spare-from-hostfs.patch new file mode 100644 index 00000000000..48e88a6ef9e --- /dev/null +++ b/queue-2.6.36/hostfs-fix-uml-crash-remove-f_spare-from-hostfs.patch @@ -0,0 +1,77 @@ +From 1b627d5771312c92404b66f0a0b16f66036dd2e1 Mon Sep 17 00:00:00 2001 +From: Richard Weinberger +Date: Tue, 26 Oct 2010 14:21:18 -0700 +Subject: hostfs: fix UML crash: remove f_spare from hostfs +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Richard Weinberger + +commit 1b627d5771312c92404b66f0a0b16f66036dd2e1 upstream. + +365b1818 ("add f_flags to struct statfs(64)") resized f_spare within +struct statfs which caused a UML crash. There is no need to copy f_spare. + +Signed-off-by: Richard Weinberger +Reported-by: Toralf Förster +Tested-by: Toralf Förster +Cc: Christoph Hellwig +Cc: Al Viro +Cc: Jeff Dike +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + fs/hostfs/hostfs.h | 3 +-- + fs/hostfs/hostfs_kern.c | 2 +- + fs/hostfs/hostfs_user.c | 9 ++------- + 3 files changed, 4 insertions(+), 10 deletions(-) + +--- a/fs/hostfs/hostfs.h ++++ b/fs/hostfs/hostfs.h +@@ -96,7 +96,6 @@ extern int rename_file(char *from, char + extern int do_statfs(char *root, long *bsize_out, long long *blocks_out, + long long *bfree_out, long long *bavail_out, + long long *files_out, long long *ffree_out, +- void *fsid_out, int fsid_size, long *namelen_out, +- long *spare_out); ++ void *fsid_out, int fsid_size, long *namelen_out); + + #endif +--- a/fs/hostfs/hostfs_kern.c ++++ b/fs/hostfs/hostfs_kern.c +@@ -217,7 +217,7 @@ int hostfs_statfs(struct dentry *dentry, + err = do_statfs(dentry->d_sb->s_fs_info, + &sf->f_bsize, &f_blocks, &f_bfree, &f_bavail, &f_files, + &f_ffree, &sf->f_fsid, sizeof(sf->f_fsid), +- &sf->f_namelen, sf->f_spare); ++ &sf->f_namelen); + if (err) + return err; + sf->f_blocks = f_blocks; +--- a/fs/hostfs/hostfs_user.c ++++ b/fs/hostfs/hostfs_user.c +@@ -364,8 +364,7 @@ int rename_file(char *from, char *to) + int do_statfs(char *root, long *bsize_out, long long *blocks_out, + long long *bfree_out, long long *bavail_out, + long long *files_out, long long *ffree_out, +- void *fsid_out, int fsid_size, long *namelen_out, +- long *spare_out) ++ void *fsid_out, int fsid_size, long *namelen_out) + { + struct statfs64 buf; + int err; +@@ -384,10 +383,6 @@ int do_statfs(char *root, long *bsize_ou + sizeof(buf.f_fsid) > fsid_size ? fsid_size : + sizeof(buf.f_fsid)); + *namelen_out = buf.f_namelen; +- spare_out[0] = buf.f_spare[0]; +- spare_out[1] = buf.f_spare[1]; +- spare_out[2] = buf.f_spare[2]; +- spare_out[3] = buf.f_spare[3]; +- spare_out[4] = buf.f_spare[4]; ++ + return 0; + } diff --git a/queue-2.6.36/hpet-fix-unwanted-interrupt-due-to-stale-irq-status-bit.patch b/queue-2.6.36/hpet-fix-unwanted-interrupt-due-to-stale-irq-status-bit.patch new file mode 100644 index 00000000000..81e64470c19 --- /dev/null +++ b/queue-2.6.36/hpet-fix-unwanted-interrupt-due-to-stale-irq-status-bit.patch @@ -0,0 +1,77 @@ +From 96e9694df446d1154ec2f4fdba8908588b9cba38 Mon Sep 17 00:00:00 2001 +From: Clemens Ladisch +Date: Tue, 26 Oct 2010 14:22:13 -0700 +Subject: hpet: fix unwanted interrupt due to stale irq status bit + +From: Clemens Ladisch + +commit 96e9694df446d1154ec2f4fdba8908588b9cba38 upstream. + +Jaswinder Singh Rajput wrote: +> By executing Documentation/timers/hpet_example.c +> +> for polling, I requested for 3 iterations but it seems iteration work +> for only 2 as first expired time is always very small. +> +> # ./hpet_example poll /dev/hpet 10 3 +> -hpet: executing poll +> hpet_poll: info.hi_flags 0x0 +> hpet_poll: expired time = 0x13 +> hpet_poll: revents = 0x1 +> hpet_poll: data 0x1 +> hpet_poll: expired time = 0x1868c +> hpet_poll: revents = 0x1 +> hpet_poll: data 0x1 +> hpet_poll: expired time = 0x18645 +> hpet_poll: revents = 0x1 +> hpet_poll: data 0x1 + +Clearing the HPET interrupt enable bit disables interrupt generation +but does not disable the timer, so the interrupt status bit will still +be set when the timer elapses. If another interrupt arrives before +the timer has been correctly programmed (due to some other device on +the same interrupt line, or CONFIG_DEBUG_SHIRQ), this results in an +extra unwanted interrupt event because the status bit is likely to be +set from comparator matches that happened before the device was opened. + +Therefore, we have to ensure that the interrupt status bit is and +stays cleared until we actually program the timer. + +Signed-off-by: Clemens Ladisch +Reported-by: Jaswinder Singh Rajput +Cc: Ingo Molnar +Cc: Thomas Gleixner +Cc: john stultz +Cc: Bob Picco +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/char/hpet.c | 15 +++++++++++++++ + 1 file changed, 15 insertions(+) + +--- a/drivers/char/hpet.c ++++ b/drivers/char/hpet.c +@@ -479,6 +479,21 @@ static int hpet_ioctl_ieon(struct hpet_d + if (irq) { + unsigned long irq_flags; + ++ if (devp->hd_flags & HPET_SHARED_IRQ) { ++ /* ++ * To prevent the interrupt handler from seeing an ++ * unwanted interrupt status bit, program the timer ++ * so that it will not fire in the near future ... ++ */ ++ writel(readl(&timer->hpet_config) & ~Tn_TYPE_CNF_MASK, ++ &timer->hpet_config); ++ write_counter(read_counter(&hpet->hpet_mc), ++ &timer->hpet_compare); ++ /* ... and clear any left-over status. */ ++ isr = 1 << (devp - devp->hd_hpets->hp_dev); ++ writel(isr, &hpet->hpet_isr); ++ } ++ + sprintf(devp->hd_name, "hpet%d", (int)(devp - hpetp->hp_dev)); + irq_flags = devp->hd_flags & HPET_SHARED_IRQ + ? IRQF_SHARED : IRQF_DISABLED; diff --git a/queue-2.6.36/hpet-unmap-unused-i-o-space.patch b/queue-2.6.36/hpet-unmap-unused-i-o-space.patch new file mode 100644 index 00000000000..f246c76f897 --- /dev/null +++ b/queue-2.6.36/hpet-unmap-unused-i-o-space.patch @@ -0,0 +1,88 @@ +From a56d5318716d120e040294bb258901ba89fb9c90 Mon Sep 17 00:00:00 2001 +From: Jiri Slaby +Date: Tue, 26 Oct 2010 14:22:11 -0700 +Subject: hpet: unmap unused I/O space + +From: Jiri Slaby + +commit a56d5318716d120e040294bb258901ba89fb9c90 upstream. + +When the initialization code in hpet finds a memory resource and does not +find an IRQ, it does not unmap the memory resource previously mapped. + +There are buggy BIOSes which report resources exactly like this and what +is worse the memory region bases point to normal RAM. This normally would +not matter since the space is not touched. But when PAT is turned on, +ioremap causes the page to be uncached and sets this bit in page->flags. + +Then when the page is about to be used by the allocator, it is reported +as: + +BUG: Bad page state in process md5sum pfn:3ed00 +page:ffffea0000dbd800 count:0 mapcount:0 mapping:(null) index:0x0 +page flags: 0x20000001000000(uncached) +Pid: 7956, comm: md5sum Not tainted 2.6.34-12-desktop #1 +Call Trace: + [] bad_page+0xb1/0x100 + [] prep_new_page+0x1a5/0x1c0 + [] get_page_from_freelist+0x3a1/0x640 + [] __alloc_pages_nodemask+0x10f/0x6b0 +... + +In this particular case: + +1) HPET returns 3ed00000 as memory region base, but it is not in +reserved ranges reported by the BIOS (excerpt): + BIOS-e820: 0000000000100000 - 00000000af6cf000 (usable) + BIOS-e820: 00000000af6cf000 - 00000000afdcf000 (reserved) + +2) there is no IRQ resource reported by HPET method. On the other +hand, the Intel HPET specs (1.0a) says (3.2.5.1): +_CRS ( + // Report 1K of memory consumed by this Timer Block + memory range consumed + // Optional: only used if BIOS allocates Interrupts [1] + IRQs consumed +) + +[1] For case where Timer Block is configured to consume IRQ0/IRQ8 AND +Legacy 8254/Legacy RTC hardware still exists, the device objects +associated with 8254 & RTC devices should not report IRQ0/IRQ8 as +"consumed resources". + +So in theory we should check whether if it is the case and use those +interrupts instead. + +Anyway the address reported by the BIOS here is bogus, so non-presence +of IRQ doesn't mean the "optional" part in point 2). + +Since I got no reply previously, fix this by simply unmapping the space +when IRQ is not found and memory region was mapped previously. It would +be probably more safe to walk the resources again and unmap appropriately +depending on type. But as we now use only ioremap for both 2 memory +resource types, it is not necessarily needed right now. + +Addresses https://bugzilla.novell.com/show_bug.cgi?id=629908 + +Reported-by: Olaf Hering +Signed-off-by: Jiri Slaby +Acked-by: Clemens Ladisch +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/char/hpet.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/char/hpet.c ++++ b/drivers/char/hpet.c +@@ -985,6 +985,8 @@ static int hpet_acpi_add(struct acpi_dev + return -ENODEV; + + if (!data.hd_address || !data.hd_nirqs) { ++ if (data.hd_address) ++ iounmap(data.hd_address); + printk("%s: no address or irqs in _CRS\n", __func__); + return -ENODEV; + } diff --git a/queue-2.6.36/hwmon-lm85-fix-adt7468-frequency-table.patch b/queue-2.6.36/hwmon-lm85-fix-adt7468-frequency-table.patch new file mode 100644 index 00000000000..f9dfbf8535f --- /dev/null +++ b/queue-2.6.36/hwmon-lm85-fix-adt7468-frequency-table.patch @@ -0,0 +1,30 @@ +From fa7a5797e57d2ed71f9a6fb44f0ae42c2d7b74b7 Mon Sep 17 00:00:00 2001 +From: Jean Delvare +Date: Thu, 28 Oct 2010 20:31:50 +0200 +Subject: hwmon: (lm85) Fix ADT7468 frequency table + +From: Jean Delvare + +commit fa7a5797e57d2ed71f9a6fb44f0ae42c2d7b74b7 upstream. + +The ADT7468 uses the same frequency table as the ADT7463. + +Signed-off-by: Jean Delvare +Cc: Darrick J. Wong +Acked-by: Guenter Roeck +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwmon/lm85.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/hwmon/lm85.c ++++ b/drivers/hwmon/lm85.c +@@ -1259,6 +1259,7 @@ static int lm85_probe(struct i2c_client + switch (data->type) { + case adm1027: + case adt7463: ++ case adt7468: + case emc6d100: + case emc6d102: + data->freq_map = adm1027_freq_map; diff --git a/queue-2.6.36/intel-gtt-fix-gtt_total_entries-detection.patch b/queue-2.6.36/intel-gtt-fix-gtt_total_entries-detection.patch new file mode 100644 index 00000000000..b088d904e98 --- /dev/null +++ b/queue-2.6.36/intel-gtt-fix-gtt_total_entries-detection.patch @@ -0,0 +1,128 @@ +From e5e408fc94595aab897f613b6f4e2f5b36870a6f Mon Sep 17 00:00:00 2001 +From: Daniel Vetter +Date: Sat, 28 Aug 2010 11:04:32 +0200 +Subject: intel-gtt: fix gtt_total_entries detection + +From: Daniel Vetter + +commit e5e408fc94595aab897f613b6f4e2f5b36870a6f upstream. + +In commit f1befe71 Chris Wilson added some code to clear the full gtt +on g33/pineview instead of just the mappable part. The code looks like +it was copy-pasted from agp/intel-gtt.c, at least an identical piece +of code is still there (in intel_i830_init_gtt_entries). This lead to +a regression in 2.6.35 which was supposedly fixed in commit e7b96f28 + +Now this commit makes absolutely no sense to me. It seems to be +slightly confused about chipset generations - it references docs for +4th gen but the regression concerns 3rd gen g33. Luckily the the g33 +gmch docs are available with the GMCH Graphics Control pci config +register definitions. The other (bigger problem) is that the new +check in there uses the i830 stolen mem bits (.5M, 1M or 8M of stolen +mem). They are different since the i855GM. + +The most likely case is that it hits the 512M fallback, which was +probably the right thing for the boxes this was tested on. + +So the original approach by Chris Wilson seems to be wrong and the +current code is definitely wrong. There is a third approach by Jesse +Barnes from his RFC patch "Who wants a bigger GTT mapping range?" +where he simply shoves g33 in the same clause like later chipset +generations. + +I've asked him and Jesse confirmed that this should work. So implement +it. + +Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=16891$ +Tested-by: Anisse Astier +Signed-off-by: Daniel Vetter +Signed-off-by: Chris Wilson +Signed-off-by: Greg Kroah-Hartman + +diff --git a/drivers/char/agp/intel-gtt.c b/drivers/char/agp/intel-gtt.c +index 56bcf27..3b84d84 100644 +--- a/drivers/char/agp/intel-gtt.c ++++ b/drivers/char/agp/intel-gtt.c +@@ -699,71 +699,43 @@ static unsigned int intel_gtt_stolen_entries(void) + static unsigned int intel_gtt_total_entries(void) + { + int size; +- u16 gmch_ctrl; + +- if (IS_I965) { ++ if (IS_G33 || IS_I965 || IS_G4X) { + u32 pgetbl_ctl; + pgetbl_ctl = readl(intel_private.registers+I810_PGETBL_CTL); + +- /* The 965 has a field telling us the size of the GTT, +- * which may be larger than what is necessary to map the +- * aperture. +- */ + switch (pgetbl_ctl & I965_PGETBL_SIZE_MASK) { + case I965_PGETBL_SIZE_128KB: +- size = 128; ++ size = KB(128); + break; + case I965_PGETBL_SIZE_256KB: +- size = 256; ++ size = KB(256); + break; + case I965_PGETBL_SIZE_512KB: +- size = 512; ++ size = KB(512); + break; + case I965_PGETBL_SIZE_1MB: +- size = 1024; ++ size = KB(1024); + break; + case I965_PGETBL_SIZE_2MB: +- size = 2048; ++ size = KB(2048); + break; + case I965_PGETBL_SIZE_1_5MB: +- size = 1024 + 512; ++ size = KB(1024 + 512); + break; + default: + dev_info(&intel_private.pcidev->dev, + "unknown page table size, assuming 512KB\n"); +- size = 512; +- } +- size += 4; /* add in BIOS popup space */ +- } else if (IS_G33 && !IS_PINEVIEW) { +- /* G33's GTT size defined in gmch_ctrl */ +- switch (gmch_ctrl & G33_PGETBL_SIZE_MASK) { +- case G33_PGETBL_SIZE_1M: +- size = 1024; +- break; +- case G33_PGETBL_SIZE_2M: +- size = 2048; +- break; +- default: +- dev_info(&intel_private.bridge_dev->dev, +- "unknown page table size 0x%x, assuming 512KB\n", +- (gmch_ctrl & G33_PGETBL_SIZE_MASK)); +- size = 512; ++ size = KB(512); + } +- size += 4; +- } else if (IS_G4X || IS_PINEVIEW) { +- /* On 4 series hardware, GTT stolen is separate from graphics +- * stolen, ignore it in stolen gtt entries counting. However, +- * 4KB of the stolen memory doesn't get mapped to the GTT. +- */ +- size = 4; ++ ++ return size/4; + } else { + /* On previous hardware, the GTT size was just what was + * required to map the aperture. + */ +- size = agp_bridge->driver->fetch_size() + 4; ++ return intel_private.base.gtt_mappable_entries; + } +- +- return size/KB(4); + } + #endif + diff --git a/queue-2.6.36/ipc-initialize-structure-memory-to-zero-for-compat-functions.patch b/queue-2.6.36/ipc-initialize-structure-memory-to-zero-for-compat-functions.patch new file mode 100644 index 00000000000..5bab7f1f871 --- /dev/null +++ b/queue-2.6.36/ipc-initialize-structure-memory-to-zero-for-compat-functions.patch @@ -0,0 +1,74 @@ +From 03145beb455cf5c20a761e8451e30b8a74ba58d9 Mon Sep 17 00:00:00 2001 +From: Dan Rosenberg +Date: Wed, 27 Oct 2010 15:34:17 -0700 +Subject: ipc: initialize structure memory to zero for compat functions + +From: Dan Rosenberg + +commit 03145beb455cf5c20a761e8451e30b8a74ba58d9 upstream. + +This takes care of leaking uninitialized kernel stack memory to +userspace from non-zeroed fields in structs in compat ipc functions. + +Signed-off-by: Dan Rosenberg +Cc: Manfred Spraul +Cc: Arnd Bergmann +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + ipc/compat.c | 6 ++++++ + ipc/compat_mq.c | 5 +++++ + 2 files changed, 11 insertions(+) + +--- a/ipc/compat.c ++++ b/ipc/compat.c +@@ -241,6 +241,8 @@ long compat_sys_semctl(int first, int se + struct semid64_ds __user *up64; + int version = compat_ipc_parse_version(&third); + ++ memset(&s64, 0, sizeof(s64)); ++ + if (!uptr) + return -EINVAL; + if (get_user(pad, (u32 __user *) uptr)) +@@ -421,6 +423,8 @@ long compat_sys_msgctl(int first, int se + int version = compat_ipc_parse_version(&second); + void __user *p; + ++ memset(&m64, 0, sizeof(m64)); ++ + switch (second & (~IPC_64)) { + case IPC_INFO: + case IPC_RMID: +@@ -594,6 +598,8 @@ long compat_sys_shmctl(int first, int se + int err, err2; + int version = compat_ipc_parse_version(&second); + ++ memset(&s64, 0, sizeof(s64)); ++ + switch (second & (~IPC_64)) { + case IPC_RMID: + case SHM_LOCK: +--- a/ipc/compat_mq.c ++++ b/ipc/compat_mq.c +@@ -53,6 +53,9 @@ asmlinkage long compat_sys_mq_open(const + void __user *p = NULL; + if (u_attr && oflag & O_CREAT) { + struct mq_attr attr; ++ ++ memset(&attr, 0, sizeof(attr)); ++ + p = compat_alloc_user_space(sizeof(attr)); + if (get_compat_mq_attr(&attr, u_attr) || + copy_to_user(p, &attr, sizeof(attr))) +@@ -127,6 +130,8 @@ asmlinkage long compat_sys_mq_getsetattr + struct mq_attr __user *p = compat_alloc_user_space(2 * sizeof(*p)); + long ret; + ++ memset(&mqstat, 0, sizeof(mqstat)); ++ + if (u_mqstat) { + if (get_compat_mq_attr(&mqstat, u_mqstat) || + copy_to_user(p, &mqstat, sizeof(mqstat))) diff --git a/queue-2.6.36/ipc-shm-fix-information-leak-to-userland.patch b/queue-2.6.36/ipc-shm-fix-information-leak-to-userland.patch new file mode 100644 index 00000000000..d405be283bd --- /dev/null +++ b/queue-2.6.36/ipc-shm-fix-information-leak-to-userland.patch @@ -0,0 +1,32 @@ +From 3af54c9bd9e6f14f896aac1bb0e8405ae0bc7a44 Mon Sep 17 00:00:00 2001 +From: Vasiliy Kulikov +Date: Sat, 30 Oct 2010 18:22:49 +0400 +Subject: ipc: shm: fix information leak to userland + +From: Vasiliy Kulikov + +commit 3af54c9bd9e6f14f896aac1bb0e8405ae0bc7a44 upstream. + +The shmid_ds structure is copied to userland with shm_unused{,2,3} +fields unitialized. It leads to leaking of contents of kernel stack +memory. + +Signed-off-by: Vasiliy Kulikov +Acked-by: Al Viro +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + ipc/shm.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/ipc/shm.c ++++ b/ipc/shm.c +@@ -473,6 +473,7 @@ static inline unsigned long copy_shmid_t + { + struct shmid_ds out; + ++ memset(&out, 0, sizeof(out)); + ipc64_perm_to_ipc_perm(&in->shm_perm, &out.shm_perm); + out.shm_segsz = in->shm_segsz; + out.shm_atime = in->shm_atime; diff --git a/queue-2.6.36/ipmi-proper-spinlock-initialization.patch b/queue-2.6.36/ipmi-proper-spinlock-initialization.patch new file mode 100644 index 00000000000..8c5bc341538 --- /dev/null +++ b/queue-2.6.36/ipmi-proper-spinlock-initialization.patch @@ -0,0 +1,146 @@ +From de5e2ddf9bb3ce7b643223b9b0718062254f302f Mon Sep 17 00:00:00 2001 +From: Eric Dumazet +Date: Tue, 26 Oct 2010 14:21:17 -0700 +Subject: ipmi: proper spinlock initialization + +From: Eric Dumazet + +commit de5e2ddf9bb3ce7b643223b9b0718062254f302f upstream. + +Unloading ipmi module can trigger following error. (if +CONFIG_DEBUG_SPINLOCK=y) + +[ 9633.779590] BUG: spinlock bad magic on CPU#1, rmmod/7170 +[ 9633.779606] lock: f41f5414, .magic: 00000000, .owner: +/-1, .owner_cpu: 0 +[ 9633.779626] Pid: 7170, comm: rmmod Not tainted +2.6.36-rc7-11474-gb71eb1e-dirty #328 +[ 9633.779644] Call Trace: +[ 9633.779657] [] ? printk+0x18/0x1c +[ 9633.779672] [] spin_bug+0xa3/0xf0 +[ 9633.779685] [] do_raw_spin_lock+0x7d/0x160 +[ 9633.779702] [] ? release_sysfs_dirent+0x47/0xb0 +[ 9633.779718] [] ? sysfs_addrm_finish+0xa8/0xd0 +[ 9633.779734] [] _raw_spin_lock_irqsave+0xc/0x20 +[ 9633.779752] [] cleanup_one_si+0x6a/0x200 [ipmi_si] +[ 9633.779768] [] ? sysfs_hash_and_remove+0x72/0x80 +[ 9633.779786] [] ipmi_pnp_remove+0xd/0xf [ipmi_si] +[ 9633.779802] [] pnp_device_remove+0x1b/0x40 + +Fix this by initializing spinlocks in a smi_info_alloc() helper function, +right after memory allocation and clearing. + +Signed-off-by: Eric Dumazet +Acked-by: David Miller +Cc: Yinghai Lu +Acked-by: Corey Minyard +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/char/ipmi/ipmi_si_intf.c | 30 +++++++++++++++++++----------- + 1 file changed, 19 insertions(+), 11 deletions(-) + +--- a/drivers/char/ipmi/ipmi_si_intf.c ++++ b/drivers/char/ipmi/ipmi_si_intf.c +@@ -1665,6 +1665,17 @@ static int check_hotmod_int_op(const cha + return 0; + } + ++static struct smi_info *smi_info_alloc(void) ++{ ++ struct smi_info *info = kzalloc(sizeof(*info), GFP_KERNEL); ++ ++ if (info) { ++ spin_lock_init(&info->si_lock); ++ spin_lock_init(&info->msg_lock); ++ } ++ return info; ++} ++ + static int hotmod_handler(const char *val, struct kernel_param *kp) + { + char *str = kstrdup(val, GFP_KERNEL); +@@ -1779,7 +1790,7 @@ static int hotmod_handler(const char *va + } + + if (op == HM_ADD) { +- info = kzalloc(sizeof(*info), GFP_KERNEL); ++ info = smi_info_alloc(); + if (!info) { + rv = -ENOMEM; + goto out; +@@ -1844,7 +1855,7 @@ static __devinit void hardcode_find_bmc( + if (!ports[i] && !addrs[i]) + continue; + +- info = kzalloc(sizeof(*info), GFP_KERNEL); ++ info = smi_info_alloc(); + if (!info) + return; + +@@ -2028,7 +2039,7 @@ static __devinit int try_init_spmi(struc + return -ENODEV; + } + +- info = kzalloc(sizeof(*info), GFP_KERNEL); ++ info = smi_info_alloc(); + if (!info) { + printk(KERN_ERR PFX "Could not allocate SI data (3)\n"); + return -ENOMEM; +@@ -2138,7 +2149,7 @@ static int __devinit ipmi_pnp_probe(stru + if (!acpi_dev) + return -ENODEV; + +- info = kzalloc(sizeof(*info), GFP_KERNEL); ++ info = smi_info_alloc(); + if (!info) + return -ENOMEM; + +@@ -2319,7 +2330,7 @@ static __devinit void try_init_dmi(struc + { + struct smi_info *info; + +- info = kzalloc(sizeof(*info), GFP_KERNEL); ++ info = smi_info_alloc(); + if (!info) { + printk(KERN_ERR PFX "Could not allocate SI data\n"); + return; +@@ -2426,7 +2437,7 @@ static int __devinit ipmi_pci_probe(stru + int class_type = pdev->class & PCI_ERMC_CLASSCODE_TYPE_MASK; + struct smi_info *info; + +- info = kzalloc(sizeof(*info), GFP_KERNEL); ++ info = smi_info_alloc(); + if (!info) + return -ENOMEM; + +@@ -2567,7 +2578,7 @@ static int __devinit ipmi_of_probe(struc + return -EINVAL; + } + +- info = kzalloc(sizeof(*info), GFP_KERNEL); ++ info = smi_info_alloc(); + + if (!info) { + dev_err(&dev->dev, +@@ -3014,7 +3025,7 @@ static __devinit void default_find_bmc(v + if (check_legacy_ioport(ipmi_defaults[i].port)) + continue; + #endif +- info = kzalloc(sizeof(*info), GFP_KERNEL); ++ info = smi_info_alloc(); + if (!info) + return; + +@@ -3139,9 +3150,6 @@ static int try_smi_init(struct smi_info + goto out_err; + } + +- spin_lock_init(&(new_smi->si_lock)); +- spin_lock_init(&(new_smi->msg_lock)); +- + /* Do low-level detection first. */ + if (new_smi->handlers->detect(new_smi->si_sm)) { + if (new_smi->addr_source) diff --git a/queue-2.6.36/kfifo-disable-__kfifo_must_check_helper.patch b/queue-2.6.36/kfifo-disable-__kfifo_must_check_helper.patch new file mode 100644 index 00000000000..c5d741f5e57 --- /dev/null +++ b/queue-2.6.36/kfifo-disable-__kfifo_must_check_helper.patch @@ -0,0 +1,46 @@ +From 52c5171214ff3327961d0ce0db7e8d2ce55004fd Mon Sep 17 00:00:00 2001 +From: Andrew Morton +Date: Tue, 26 Oct 2010 14:21:19 -0700 +Subject: kfifo: disable __kfifo_must_check_helper() + +From: Andrew Morton + +commit 52c5171214ff3327961d0ce0db7e8d2ce55004fd upstream. + +This helper is wrong: it coerces signed values into unsigned ones, so code +such as + + if (kfifo_alloc(...) < 0) { + error + } + +will fail to detect the error. + +So let's disable __kfifo_must_check_helper() for 2.6.36. + +Cc: Randy Dunlap +Cc: Stefani Seibold +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + include/linux/kfifo.h | 7 ++----- + 1 file changed, 2 insertions(+), 5 deletions(-) + +--- a/include/linux/kfifo.h ++++ b/include/linux/kfifo.h +@@ -171,11 +171,8 @@ struct kfifo_rec_ptr_2 __STRUCT_KFIFO_PT + } + + +-static inline unsigned int __must_check +-__kfifo_must_check_helper(unsigned int val) +-{ +- return val; +-} ++/* __kfifo_must_check_helper() is temporarily disabled because it was faulty */ ++#define __kfifo_must_check_helper(x) (x) + + /** + * kfifo_initialized - Check if the fifo is initialized diff --git a/queue-2.6.36/md-fix-regression-with-raid1-arrays-without-persistent-metadata.patch b/queue-2.6.36/md-fix-regression-with-raid1-arrays-without-persistent-metadata.patch new file mode 100644 index 00000000000..4e9ba9328b3 --- /dev/null +++ b/queue-2.6.36/md-fix-regression-with-raid1-arrays-without-persistent-metadata.patch @@ -0,0 +1,37 @@ +From d97a41dc9c44f5829b7af7aa69fda10fd82b6b4e Mon Sep 17 00:00:00 2001 +From: NeilBrown +Date: Thu, 28 Oct 2010 17:30:20 +1100 +Subject: md: Fix regression with raid1 arrays without persistent metadata. + +From: NeilBrown + +commit d97a41dc9c44f5829b7af7aa69fda10fd82b6b4e upstream. + +A RAID1 which has no persistent metadata, whether internal or +external, will hang on the first write. +This is caused by commit 070dc6dd7103b6b3f7e4d46e754354a5c15f366e +In that case, MD_CHANGE_PENDING never gets cleared. + +So during md_update_sb, is neither persistent or external, +clear MD_CHANGE_PENDING. + +This is suitable for 2.6.36-stable. + +Signed-off-by: NeilBrown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/md.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/md/md.c ++++ b/drivers/md/md.c +@@ -2172,6 +2172,8 @@ repeat: + if (!mddev->persistent) { + clear_bit(MD_CHANGE_CLEAN, &mddev->flags); + clear_bit(MD_CHANGE_DEVS, &mddev->flags); ++ if (!mddev->external) ++ clear_bit(MD_CHANGE_PENDING, &mddev->flags); + wake_up(&mddev->sb_wait); + return; + } diff --git a/queue-2.6.36/md-fix-return-value-of-rdev_size_change.patch b/queue-2.6.36/md-fix-return-value-of-rdev_size_change.patch new file mode 100644 index 00000000000..881785e11ca --- /dev/null +++ b/queue-2.6.36/md-fix-return-value-of-rdev_size_change.patch @@ -0,0 +1,45 @@ +From c26a44ed1e552aaa1d4ceb71842002d235fe98d7 Mon Sep 17 00:00:00 2001 +From: Justin Maggard +Date: Wed, 24 Nov 2010 16:36:17 +1100 +Subject: md: fix return value of rdev_size_change() + +From: Justin Maggard + +commit c26a44ed1e552aaa1d4ceb71842002d235fe98d7 upstream. + +When trying to grow an array by enlarging component devices, +rdev_size_store() expects the return value of rdev_size_change() to be +in sectors, but the actual value is returned in KBs. + +This functionality was broken by commit + dd8ac336c13fd8afdb082ebacb1cddd5cf727889 +so this patch is suitable for any kernel since 2.6.30. + +Signed-off-by: Justin Maggard +Signed-off-by: NeilBrown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/md.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/md/md.c ++++ b/drivers/md/md.c +@@ -1329,7 +1329,7 @@ super_90_rdev_size_change(mdk_rdev_t *rd + md_super_write(rdev->mddev, rdev, rdev->sb_start, rdev->sb_size, + rdev->sb_page); + md_super_wait(rdev->mddev); +- return num_sectors / 2; /* kB for sysfs */ ++ return num_sectors; + } + + +@@ -1697,7 +1697,7 @@ super_1_rdev_size_change(mdk_rdev_t *rde + md_super_write(rdev->mddev, rdev, rdev->sb_start, rdev->sb_size, + rdev->sb_page); + md_super_wait(rdev->mddev); +- return num_sectors / 2; /* kB for sysfs */ ++ return num_sectors; + } + + static struct super_type super_types[] = { diff --git a/queue-2.6.36/md-raid1-really-fix-recovery-looping-when-single-good-device-fails.patch b/queue-2.6.36/md-raid1-really-fix-recovery-looping-when-single-good-device-fails.patch new file mode 100644 index 00000000000..da5eb1ff656 --- /dev/null +++ b/queue-2.6.36/md-raid1-really-fix-recovery-looping-when-single-good-device-fails.patch @@ -0,0 +1,42 @@ +From 8f9e0ee38f75d4740daa9e42c8af628d33d19a02 Mon Sep 17 00:00:00 2001 +From: NeilBrown +Date: Wed, 24 Nov 2010 16:39:46 +1100 +Subject: md/raid1: really fix recovery looping when single good device fails. +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: NeilBrown + +commit 8f9e0ee38f75d4740daa9e42c8af628d33d19a02 upstream. + +Commit 4044ba58dd15cb01797c4fd034f39ef4a75f7cc3 supposedly fixed a +problem where if a raid1 with just one good device gets a read-error +during recovery, the recovery would abort and immediately restart in +an infinite loop. + +However it depended on raid1_remove_disk removing the spare device +from the array. But that does not happen in this case. So add a test +so that in the 'recovery_disabled' case, the device will be removed. + +This suitable for any kernel since 2.6.29 which is when +recovery_disabled was introduced. + +Reported-by: Sebastian Färber +Signed-off-by: NeilBrown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/raid1.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/md/raid1.c ++++ b/drivers/md/raid1.c +@@ -1210,6 +1210,7 @@ static int raid1_remove_disk(mddev_t *md + * is not possible. + */ + if (!test_bit(Faulty, &rdev->flags) && ++ !mddev->recovery_disabled && + mddev->degraded < conf->raid_disks) { + err = -EBUSY; + goto abort; diff --git a/queue-2.6.36/mm-fix-is_mem_section_removable-page_order-bug_on-check.patch b/queue-2.6.36/mm-fix-is_mem_section_removable-page_order-bug_on-check.patch new file mode 100644 index 00000000000..c40125dd1ad --- /dev/null +++ b/queue-2.6.36/mm-fix-is_mem_section_removable-page_order-bug_on-check.patch @@ -0,0 +1,51 @@ +From 572438f9b52236bd8938b1647cc15e027d27ef55 Mon Sep 17 00:00:00 2001 +From: KAMEZAWA Hiroyuki +Date: Tue, 26 Oct 2010 14:22:08 -0700 +Subject: mm: fix is_mem_section_removable() page_order BUG_ON check + +From: KAMEZAWA Hiroyuki + +commit 572438f9b52236bd8938b1647cc15e027d27ef55 upstream. + +page_order() is called by memory hotplug's user interface to check the +section is removable or not. (is_mem_section_removable()) + +It calls page_order() withoug holding zone->lock. +So, even if the caller does + + if (PageBuddy(page)) + ret = page_order(page) ... +The caller may hit BUG_ON(). + +For fixing this, there are 2 choices. + 1. add zone->lock. + 2. remove BUG_ON(). + +is_mem_section_removable() is used for some "advice" and doesn't need to +be 100% accurate. This is_removable() can be called via user program.. +We don't want to take this important lock for long by user's request. So, +this patch removes BUG_ON(). + +Signed-off-by: KAMEZAWA Hiroyuki +Acked-by: Wu Fengguang +Acked-by: Michal Hocko +Acked-by: Mel Gorman +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/internal.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/mm/internal.h ++++ b/mm/internal.h +@@ -62,7 +62,7 @@ extern bool is_free_buddy_page(struct pa + */ + static inline unsigned long page_order(struct page *page) + { +- VM_BUG_ON(!PageBuddy(page)); ++ /* PageBuddy() must be checked by the caller */ + return page_private(page); + } + diff --git a/queue-2.6.36/mm-fix-return-value-of-scan_lru_pages-in-memory-unplug.patch b/queue-2.6.36/mm-fix-return-value-of-scan_lru_pages-in-memory-unplug.patch new file mode 100644 index 00000000000..059a6d068bb --- /dev/null +++ b/queue-2.6.36/mm-fix-return-value-of-scan_lru_pages-in-memory-unplug.patch @@ -0,0 +1,38 @@ +From f8f72ad5396987e05a42cf7eff826fb2a15ff148 Mon Sep 17 00:00:00 2001 +From: KAMEZAWA Hiroyuki +Date: Tue, 26 Oct 2010 14:21:10 -0700 +Subject: mm: fix return value of scan_lru_pages in memory unplug + +From: KAMEZAWA Hiroyuki + +commit f8f72ad5396987e05a42cf7eff826fb2a15ff148 upstream. + +scan_lru_pages returns pfn. So, it's type should be "unsigned long" +not "int". + +Note: I guess this has been work until now because memory hotplug tester's + machine has not very big memory.... + physical address < 32bit << PAGE_SHIFT. + +Reported-by: KOSAKI Motohiro +Signed-off-by: KAMEZAWA Hiroyuki +Reviewed-by: KOSAKI Motohiro +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/memory_hotplug.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/mm/memory_hotplug.c ++++ b/mm/memory_hotplug.c +@@ -659,7 +659,7 @@ static int test_pages_in_a_zone(unsigned + * Scanning pfn is much easier than scanning lru list. + * Scan pfn from start to end and Find LRU page. + */ +-int scan_lru_pages(unsigned long start, unsigned long end) ++unsigned long scan_lru_pages(unsigned long start, unsigned long end) + { + unsigned long pfn; + struct page *page; diff --git a/queue-2.6.36/mm-hugetlb.c-add-missing-spin_lock-to-hugetlb_cow.patch b/queue-2.6.36/mm-hugetlb.c-add-missing-spin_lock-to-hugetlb_cow.patch new file mode 100644 index 00000000000..e5c1121b67b --- /dev/null +++ b/queue-2.6.36/mm-hugetlb.c-add-missing-spin_lock-to-hugetlb_cow.patch @@ -0,0 +1,37 @@ +From 44e2aa937e698ea95dd86b2a4fabd734ef2c76db Mon Sep 17 00:00:00 2001 +From: Dean Nelson +Date: Tue, 26 Oct 2010 14:22:08 -0700 +Subject: mm/hugetlb.c: add missing spin_lock() to hugetlb_cow() + +From: Dean Nelson + +commit 44e2aa937e698ea95dd86b2a4fabd734ef2c76db upstream. + +Add missing spin_lock() of the page_table_lock before an error return in +hugetlb_cow(). Callers of hugtelb_cow() expect it to be held upon return. + +Signed-off-by: Dean Nelson +Cc: Mel Gorman +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/hugetlb.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/mm/hugetlb.c ++++ b/mm/hugetlb.c +@@ -2380,8 +2380,11 @@ retry_avoidcopy: + * When the original hugepage is shared one, it does not have + * anon_vma prepared. + */ +- if (unlikely(anon_vma_prepare(vma))) ++ if (unlikely(anon_vma_prepare(vma))) { ++ /* Caller expects lock to be held */ ++ spin_lock(&mm->page_table_lock); + return VM_FAULT_OOM; ++ } + + copy_huge_page(new_page, old_page, address, vma); + __SetPageUptodate(new_page); diff --git a/queue-2.6.36/mm-page-allocator-do-not-check-the-state-of-a-non-existant-buddy-during-free.patch b/queue-2.6.36/mm-page-allocator-do-not-check-the-state-of-a-non-existant-buddy-during-free.patch new file mode 100644 index 00000000000..bbc86a6527d --- /dev/null +++ b/queue-2.6.36/mm-page-allocator-do-not-check-the-state-of-a-non-existant-buddy-during-free.patch @@ -0,0 +1,55 @@ +From b7f50cfa3630b6e079929ffccfd442d65064ee1f Mon Sep 17 00:00:00 2001 +From: Mel Gorman +Date: Tue, 26 Oct 2010 14:21:11 -0700 +Subject: mm, page-allocator: do not check the state of a non-existant buddy during free + +From: Mel Gorman + +commit b7f50cfa3630b6e079929ffccfd442d65064ee1f upstream. + +There is a bug in commit 6dda9d55 ("page allocator: reduce fragmentation +in buddy allocator by adding buddies that are merging to the tail of the +free lists") that means a buddy at order MAX_ORDER is checked for merging. + A page of this order never exists so at times, an effectively random +piece of memory is being checked. + +Alan Curry has reported that this is causing memory corruption in +userspace data on a PPC32 platform (http://lkml.org/lkml/2010/10/9/32). +It is not clear why this is happening. It could be a cache coherency +problem where pages mapped in both user and kernel space are getting +different cache lines due to the bad read from kernel space +(http://lkml.org/lkml/2010/10/13/179). It could also be that there are +some special registers being io-remapped at the end of the memmap array +and that a read has special meaning on them. Compiler bugs have been +ruled out because the assembly before and after the patch looks relatively +harmless. + +This patch fixes the problem by ensuring we are not reading a possibly +invalid location of memory. It's not clear why the read causes corruption +but one way or the other it is a buggy read. + +Signed-off-by: Mel Gorman +Cc: Corrado Zoccolo +Reported-by: Alan Curry +Cc: KOSAKI Motohiro +Cc: Christoph Lameter +Cc: Rik van Riel +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/page_alloc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/mm/page_alloc.c ++++ b/mm/page_alloc.c +@@ -530,7 +530,7 @@ static inline void __free_one_page(struc + * so it's less likely to be used soon and more likely to be merged + * as a higher order page + */ +- if ((order < MAX_ORDER-1) && pfn_valid_within(page_to_pfn(buddy))) { ++ if ((order < MAX_ORDER-2) && pfn_valid_within(page_to_pfn(buddy))) { + struct page *higher_page, *higher_buddy; + combined_idx = __find_combined_index(page_idx, order); + higher_page = page + combined_idx - page_idx; diff --git a/queue-2.6.36/net-netif_f_hw_csum-does-not-imply-fcoe-crc-offload.patch b/queue-2.6.36/net-netif_f_hw_csum-does-not-imply-fcoe-crc-offload.patch new file mode 100644 index 00000000000..55beefbd1fc --- /dev/null +++ b/queue-2.6.36/net-netif_f_hw_csum-does-not-imply-fcoe-crc-offload.patch @@ -0,0 +1,37 @@ +From 66c68bcc489fadd4f5e8839e966e3a366e50d1d5 Mon Sep 17 00:00:00 2001 +From: Ben Hutchings +Date: Fri, 22 Oct 2010 04:38:26 +0000 +Subject: net: NETIF_F_HW_CSUM does not imply FCoE CRC offload + +From: Ben Hutchings + +commit 66c68bcc489fadd4f5e8839e966e3a366e50d1d5 upstream. + +NETIF_F_HW_CSUM indicates the ability to update an TCP/IP-style 16-bit +checksum with the checksum of an arbitrary part of the packet data, +whereas the FCoE CRC is something entirely different. + +Signed-off-by: Ben Hutchings +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + net/core/dev.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/net/core/dev.c ++++ b/net/core/dev.c +@@ -1648,10 +1648,10 @@ EXPORT_SYMBOL(netif_device_attach); + + static bool can_checksum_protocol(unsigned long features, __be16 protocol) + { +- return ((features & NETIF_F_GEN_CSUM) || +- ((features & NETIF_F_IP_CSUM) && ++ return ((features & NETIF_F_NO_CSUM) || ++ ((features & NETIF_F_V4_CSUM) && + protocol == htons(ETH_P_IP)) || +- ((features & NETIF_F_IPV6_CSUM) && ++ ((features & NETIF_F_V6_CSUM) && + protocol == htons(ETH_P_IPV6)) || + ((features & NETIF_F_FCOE_CRC) && + protocol == htons(ETH_P_FCOE))); diff --git a/queue-2.6.36/numa-fix-slab_node-mpol_bind.patch b/queue-2.6.36/numa-fix-slab_node-mpol_bind.patch new file mode 100644 index 00000000000..47ef0b1e660 --- /dev/null +++ b/queue-2.6.36/numa-fix-slab_node-mpol_bind.patch @@ -0,0 +1,39 @@ +From 800416f799e0723635ac2d720ad4449917a1481c Mon Sep 17 00:00:00 2001 +From: Eric Dumazet +Date: Wed, 27 Oct 2010 19:33:43 +0200 +Subject: numa: fix slab_node(MPOL_BIND) + +From: Eric Dumazet + +commit 800416f799e0723635ac2d720ad4449917a1481c upstream. + +When a node contains only HighMem memory, slab_node(MPOL_BIND) +dereferences a NULL pointer. + +[ This code seems to go back all the way to commit 19770b32609b: "mm: + filter based on a nodemask as well as a gfp_mask". Which was back in + April 2008, and it got merged into 2.6.26. - Linus ] + +Signed-off-by: Eric Dumazet +Cc: Mel Gorman +Cc: Christoph Lameter +Cc: Lee Schermerhorn +Cc: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/mempolicy.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/mm/mempolicy.c ++++ b/mm/mempolicy.c +@@ -1588,7 +1588,7 @@ unsigned slab_node(struct mempolicy *pol + (void)first_zones_zonelist(zonelist, highest_zoneidx, + &policy->v.nodes, + &zone); +- return zone->node; ++ return zone ? zone->node : numa_node_id(); + } + + default: diff --git a/queue-2.6.36/olpc_battery-fix-endian-neutral-breakage-for-s16-values.patch b/queue-2.6.36/olpc_battery-fix-endian-neutral-breakage-for-s16-values.patch new file mode 100644 index 00000000000..5413083a0c2 --- /dev/null +++ b/queue-2.6.36/olpc_battery-fix-endian-neutral-breakage-for-s16-values.patch @@ -0,0 +1,60 @@ +From 7cfbb29466633e6ecdc14f76a693c8478c2b22af Mon Sep 17 00:00:00 2001 +From: Richard A. Smith +Date: Sat, 25 Sep 2010 19:19:26 +0100 +Subject: olpc_battery: Fix endian neutral breakage for s16 values + +From: Richard A. Smith + +commit 7cfbb29466633e6ecdc14f76a693c8478c2b22af upstream. + +When the driver was updated to be endian neutral (8e9c7716c) +the signed part of the s16 values was lost. This is because be16_to_cpu() +returns an unsigned value. This patch casts the values back to a s16 +number prior to the the implicit cast up to an int. + +Signed-off-by: Richard A. Smith +Signed-off-by: Daniel Drake +Signed-off-by: Anton Vorontsov +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/power/olpc_battery.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/power/olpc_battery.c ++++ b/drivers/power/olpc_battery.c +@@ -271,14 +271,14 @@ static int olpc_bat_get_property(struct + if (ret) + return ret; + +- val->intval = (int)be16_to_cpu(ec_word) * 9760L / 32; ++ val->intval = (s16)be16_to_cpu(ec_word) * 9760L / 32; + break; + case POWER_SUPPLY_PROP_CURRENT_AVG: + ret = olpc_ec_cmd(EC_BAT_CURRENT, NULL, 0, (void *)&ec_word, 2); + if (ret) + return ret; + +- val->intval = (int)be16_to_cpu(ec_word) * 15625L / 120; ++ val->intval = (s16)be16_to_cpu(ec_word) * 15625L / 120; + break; + case POWER_SUPPLY_PROP_CAPACITY: + ret = olpc_ec_cmd(EC_BAT_SOC, NULL, 0, &ec_byte, 1); +@@ -299,7 +299,7 @@ static int olpc_bat_get_property(struct + if (ret) + return ret; + +- val->intval = (int)be16_to_cpu(ec_word) * 100 / 256; ++ val->intval = (s16)be16_to_cpu(ec_word) * 100 / 256; + break; + case POWER_SUPPLY_PROP_TEMP_AMBIENT: + ret = olpc_ec_cmd(EC_AMB_TEMP, NULL, 0, (void *)&ec_word, 2); +@@ -313,7 +313,7 @@ static int olpc_bat_get_property(struct + if (ret) + return ret; + +- val->intval = (int)be16_to_cpu(ec_word) * 6250 / 15; ++ val->intval = (s16)be16_to_cpu(ec_word) * 6250 / 15; + break; + case POWER_SUPPLY_PROP_SERIAL_NUMBER: + ret = olpc_ec_cmd(EC_BAT_SERIAL, NULL, 0, (void *)&ser_buf, 8); diff --git a/queue-2.6.36/oprofile-fix-the-hang-while-taking-the-cpu-offline.patch b/queue-2.6.36/oprofile-fix-the-hang-while-taking-the-cpu-offline.patch new file mode 100644 index 00000000000..922a468b9f1 --- /dev/null +++ b/queue-2.6.36/oprofile-fix-the-hang-while-taking-the-cpu-offline.patch @@ -0,0 +1,94 @@ +From 4ac3dbec800d93485a5c84e37af676278eea657c Mon Sep 17 00:00:00 2001 +From: Santosh Shilimkar +Date: Wed, 27 Oct 2010 11:17:15 -0400 +Subject: oprofile: Fix the hang while taking the cpu offline + +From: Santosh Shilimkar + +commit 4ac3dbec800d93485a5c84e37af676278eea657c upstream. + +The kernel build with CONFIG_OPROFILE and CPU_HOTPLUG enabled. +The oprofile is initialised using system timer in absence of hardware +counters supports. Oprofile isn't started from userland. + +In this setup while doing a CPU offline the kernel hangs in infinite +for loop inside lock_hrtimer_base() function + +This happens because as part of oprofile_cpu_notify(, it tries to +stop an hrtimer which was never started. These per-cpu hrtimers +are started when the oprfile is started. + echo 1 > /dev/oprofile/enable + +This problem also existwhen the cpu is booted with maxcpus parameter +set. When bringing the remaining cpus online the timers are started +even if oprofile is not yet enabled. + +This patch fix this issue by adding a state variable so that +these hrtimer start/stop is only attempted when oprofile is +started + +For stable kernels v2.6.35.y and v2.6.36.y. + +Reported-by: Jan Sebastien +Tested-by: sricharan +Signed-off-by: Santosh Shilimkar +Signed-off-by: Robert Richter +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/oprofile/timer_int.c | 13 +++++++++++++ + 1 file changed, 13 insertions(+) + +--- a/drivers/oprofile/timer_int.c ++++ b/drivers/oprofile/timer_int.c +@@ -21,6 +21,7 @@ + #include "oprof.h" + + static DEFINE_PER_CPU(struct hrtimer, oprofile_hrtimer); ++static int ctr_running; + + static enum hrtimer_restart oprofile_hrtimer_notify(struct hrtimer *hrtimer) + { +@@ -33,6 +34,9 @@ static void __oprofile_hrtimer_start(voi + { + struct hrtimer *hrtimer = &__get_cpu_var(oprofile_hrtimer); + ++ if (!ctr_running) ++ return; ++ + hrtimer_init(hrtimer, CLOCK_MONOTONIC, HRTIMER_MODE_REL); + hrtimer->function = oprofile_hrtimer_notify; + +@@ -42,7 +46,10 @@ static void __oprofile_hrtimer_start(voi + + static int oprofile_hrtimer_start(void) + { ++ get_online_cpus(); ++ ctr_running = 1; + on_each_cpu(__oprofile_hrtimer_start, NULL, 1); ++ put_online_cpus(); + return 0; + } + +@@ -50,6 +57,9 @@ static void __oprofile_hrtimer_stop(int + { + struct hrtimer *hrtimer = &per_cpu(oprofile_hrtimer, cpu); + ++ if (!ctr_running) ++ return; ++ + hrtimer_cancel(hrtimer); + } + +@@ -57,8 +67,11 @@ static void oprofile_hrtimer_stop(void) + { + int cpu; + ++ get_online_cpus(); + for_each_online_cpu(cpu) + __oprofile_hrtimer_stop(cpu); ++ ctr_running = 0; ++ put_online_cpus(); + } + + static int __cpuinit oprofile_cpu_notify(struct notifier_block *self, diff --git a/queue-2.6.36/oprofile-remove-deprecated-use-of-flush_scheduled_work.patch b/queue-2.6.36/oprofile-remove-deprecated-use-of-flush_scheduled_work.patch new file mode 100644 index 00000000000..972532a8e29 --- /dev/null +++ b/queue-2.6.36/oprofile-remove-deprecated-use-of-flush_scheduled_work.patch @@ -0,0 +1,72 @@ +From 3d7851b3cdd43a734e5cc4c643fd886ab28ad4d5 Mon Sep 17 00:00:00 2001 +From: Tejun Heo +Date: Fri, 15 Oct 2010 09:51:08 -0400 +Subject: oprofile: Remove deprecated use of flush_scheduled_work() + +From: Tejun Heo + +commit 3d7851b3cdd43a734e5cc4c643fd886ab28ad4d5 upstream. + +flush_scheduled_work() is deprecated and scheduled to be removed. +sync_stop() currently cancels cpu_buffer works inside buffer_mutex and +flushes the system workqueue outside. Instead, split end_cpu_work() +into two parts - stopping further work enqueues and flushing works - +and do the former inside buffer_mutex and latter outside. + +For stable kernels v2.6.35.y and v2.6.36.y. + +Signed-off-by: Tejun Heo +Signed-off-by: Robert Richter +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/oprofile/buffer_sync.c | 2 +- + drivers/oprofile/cpu_buffer.c | 10 +++++++--- + drivers/oprofile/cpu_buffer.h | 1 + + 3 files changed, 9 insertions(+), 4 deletions(-) + +--- a/drivers/oprofile/buffer_sync.c ++++ b/drivers/oprofile/buffer_sync.c +@@ -190,7 +190,7 @@ void sync_stop(void) + profile_event_unregister(PROFILE_TASK_EXIT, &task_exit_nb); + task_handoff_unregister(&task_free_nb); + mutex_unlock(&buffer_mutex); +- flush_scheduled_work(); ++ flush_cpu_work(); + + /* make sure we don't leak task structs */ + process_task_mortuary(); +--- a/drivers/oprofile/cpu_buffer.c ++++ b/drivers/oprofile/cpu_buffer.c +@@ -111,14 +111,18 @@ void start_cpu_work(void) + + void end_cpu_work(void) + { +- int i; +- + work_enabled = 0; ++} ++ ++void flush_cpu_work(void) ++{ ++ int i; + + for_each_online_cpu(i) { + struct oprofile_cpu_buffer *b = &per_cpu(op_cpu_buffer, i); + +- cancel_delayed_work(&b->work); ++ /* these works are per-cpu, no need for flush_sync */ ++ flush_delayed_work(&b->work); + } + } + +--- a/drivers/oprofile/cpu_buffer.h ++++ b/drivers/oprofile/cpu_buffer.h +@@ -25,6 +25,7 @@ void free_cpu_buffers(void); + + void start_cpu_work(void); + void end_cpu_work(void); ++void flush_cpu_work(void); + + /* CPU buffer is composed of such entries (which are + * also used for context switch notes) diff --git a/queue-2.6.36/percpu-fix-list_head-init-bug-in-__percpu_counter_init.patch b/queue-2.6.36/percpu-fix-list_head-init-bug-in-__percpu_counter_init.patch new file mode 100644 index 00000000000..3b60a9a5cca --- /dev/null +++ b/queue-2.6.36/percpu-fix-list_head-init-bug-in-__percpu_counter_init.patch @@ -0,0 +1,58 @@ +From 8474b591faf3bb0a1e08a60d21d6baac498f15e4 Mon Sep 17 00:00:00 2001 +From: Masanori ITOH +Date: Tue, 26 Oct 2010 14:21:20 -0700 +Subject: percpu: fix list_head init bug in __percpu_counter_init() + +From: Masanori ITOH + +commit 8474b591faf3bb0a1e08a60d21d6baac498f15e4 upstream. + +WARNING: at lib/list_debug.c:26 __list_add+0x3f/0x81() +Hardware name: Express5800/B120a [N8400-085] +list_add corruption. next->prev should be prev (ffffffff81a7ea00), but was dead000000200200. (next=ffff88080b872d58). +Modules linked in: aoe ipt_MASQUERADE iptable_nat nf_nat autofs4 sunrpc bridge 8021q garp stp llc ipv6 cpufreq_ondemand acpi_cpufreq freq_table dm_round_robin dm_multipath kvm_intel kvm uinput lpfc scsi_transport_fc igb ioatdma scsi_tgt i2c_i801 i2c_core dca iTCO_wdt iTCO_vendor_support pcspkr shpchp megaraid_sas [last unloaded: aoe] +Pid: 54, comm: events/3 Tainted: G W 2.6.34-vanilla1 #1 +Call Trace: +[] warn_slowpath_common+0x7c/0x94 +[] warn_slowpath_fmt+0x41/0x43 +[] __list_add+0x3f/0x81 +[] __percpu_counter_init+0x59/0x6b +[] bdi_init+0x118/0x17e +[] blk_alloc_queue_node+0x79/0x143 +[] blk_alloc_queue+0x11/0x13 +[] aoeblk_gdalloc+0x8e/0x1c9 [aoe] +[] aoecmd_sleepwork+0x25/0xa8 [aoe] +[] worker_thread+0x1a9/0x237 +[] ? aoecmd_sleepwork+0x0/0xa8 [aoe] +[] ? autoremove_wake_function+0x0/0x39 +[] ? worker_thread+0x0/0x237 +[] kthread+0x7f/0x87 +[] kernel_thread_helper+0x4/0x10 +[] ? kthread+0x0/0x87 +[] ? kernel_thread_helper+0x0/0x10 + +It's because there is no initialization code for a list_head contained in +the struct backing_dev_info under CONFIG_HOTPLUG_CPU, and the bug comes up +when block device drivers calling blk_alloc_queue() are used. In case of +me, I got them by using aoe. + +Signed-off-by: Masanori Itoh +Cc: Tejun Heo +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + lib/percpu_counter.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/lib/percpu_counter.c ++++ b/lib/percpu_counter.c +@@ -76,6 +76,7 @@ int __percpu_counter_init(struct percpu_ + if (!fbc->counters) + return -ENOMEM; + #ifdef CONFIG_HOTPLUG_CPU ++ INIT_LIST_HEAD(&fbc->list); + mutex_lock(&percpu_counters_lock); + list_add(&fbc->list, &percpu_counters); + mutex_unlock(&percpu_counters_lock); diff --git a/queue-2.6.36/sata_via-apply-magic-fifo-fix-to-vt6420-too.patch b/queue-2.6.36/sata_via-apply-magic-fifo-fix-to-vt6420-too.patch new file mode 100644 index 00000000000..31572997f47 --- /dev/null +++ b/queue-2.6.36/sata_via-apply-magic-fifo-fix-to-vt6420-too.patch @@ -0,0 +1,63 @@ +From b1353e4f40f6179ab26a3bb1b2e1fe29ffe534f5 Mon Sep 17 00:00:00 2001 +From: Tejun Heo +Date: Fri, 19 Nov 2010 15:29:19 +0100 +Subject: sata_via: apply magic FIFO fix to vt6420 too + +From: Tejun Heo + +commit b1353e4f40f6179ab26a3bb1b2e1fe29ffe534f5 upstream. + +vt6420 has the same FIFO overflow problem as vt6421 when combined with +certain devices. This patch applies the magic fix to vt6420 too. + +Signed-off-by: Tejun Heo +Reported-by: Martin Qvist +Reported-by: Peter Zijlstra +Cc: Joseph Chan +Signed-off-by: Jeff Garzik +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ata/sata_via.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +--- a/drivers/ata/sata_via.c ++++ b/drivers/ata/sata_via.c +@@ -538,7 +538,7 @@ static int vt8251_prepare_host(struct pc + return 0; + } + +-static void svia_configure(struct pci_dev *pdev) ++static void svia_configure(struct pci_dev *pdev, int board_id) + { + u8 tmp8; + +@@ -577,7 +577,7 @@ static void svia_configure(struct pci_de + } + + /* +- * vt6421 has problems talking to some drives. The following ++ * vt6420/1 has problems talking to some drives. The following + * is the fix from Joseph Chan . + * + * When host issues HOLD, device may send up to 20DW of data +@@ -596,8 +596,9 @@ static void svia_configure(struct pci_de + * + * https://bugzilla.kernel.org/show_bug.cgi?id=15173 + * http://article.gmane.org/gmane.linux.ide/46352 ++ * http://thread.gmane.org/gmane.linux.kernel/1062139 + */ +- if (pdev->device == 0x3249) { ++ if (board_id == vt6420 || board_id == vt6421) { + pci_read_config_byte(pdev, 0x52, &tmp8); + tmp8 |= 1 << 2; + pci_write_config_byte(pdev, 0x52, tmp8); +@@ -652,7 +653,7 @@ static int svia_init_one(struct pci_dev + if (rc) + return rc; + +- svia_configure(pdev); ++ svia_configure(pdev, board_id); + + pci_set_master(pdev); + return ata_host_activate(host, pdev->irq, ata_bmdma_interrupt, diff --git a/queue-2.6.36/series b/queue-2.6.36/series index 9b27d8e6e49..cf20172a751 100644 --- a/queue-2.6.36/series +++ b/queue-2.6.36/series @@ -97,3 +97,42 @@ staging-asus_oled-fix-up-some-sysfs-attribute-permissions.patch staging-asus_oled-fix-up-my-fixup-for-some-sysfs-attribute-permissions.patch alsa-hda-use-hp-laptop-quirk-to-enable-headphones-automute-for-asus-a52j.patch staging-line6-fix-up-some-sysfs-attribute-permissions.patch +kfifo-disable-__kfifo_must_check_helper.patch +hpet-fix-unwanted-interrupt-due-to-stale-irq-status-bit.patch +hpet-unmap-unused-i-o-space.patch +olpc_battery-fix-endian-neutral-breakage-for-s16-values.patch +percpu-fix-list_head-init-bug-in-__percpu_counter_init.patch +hostfs-fix-uml-crash-remove-f_spare-from-hostfs.patch +ipmi-proper-spinlock-initialization.patch +um-remove-page_size-alignment-in-linker-script-causing-kernel-segfault.patch +um-fix-global-timer-issue-when-using-config_no_hz.patch +numa-fix-slab_node-mpol_bind.patch +hwmon-lm85-fix-adt7468-frequency-table.patch +oprofile-remove-deprecated-use-of-flush_scheduled_work.patch +oprofile-fix-the-hang-while-taking-the-cpu-offline.patch +mm-fix-return-value-of-scan_lru_pages-in-memory-unplug.patch +mm-page-allocator-do-not-check-the-state-of-a-non-existant-buddy-during-free.patch +mm-fix-is_mem_section_removable-page_order-bug_on-check.patch +mm-hugetlb.c-add-missing-spin_lock-to-hugetlb_cow.patch +agp-intel-also-add-b43.1-to-list-of-supported-devices.patch +b43-fix-warning-at-drivers-mmc-core-core.c-237-in-mmc_wait_for_cmd.patch +wireless-b43-fix-error-path-in-sdio.patch +ssb-b43-pci-bridge-add-new-vendor-for-bcm4318.patch +drivers-misc-ad525x_dpot.c-fix-typo-in-spi-write16-and-write24-transfer-counts.patch +sgi-xpc-xpc-fails-to-discover-partitions-with-all-nasids-above-128.patch +xen-ensure-that-all-event-channels-start-off-bound-to-vcpu-0.patch +xen-don-t-bother-to-stop-other-cpus-on-shutdown-reboot.patch +ipc-initialize-structure-memory-to-zero-for-compat-functions.patch +ipc-shm-fix-information-leak-to-userland.patch +net-netif_f_hw_csum-does-not-imply-fcoe-crc-offload.patch +drivers-char-vt_ioctl.c-fix-vt_openqry-error-value.patch +viafb-use-proper-register-for-colour-when-doing-fill-ops.patch +sata_via-apply-magic-fifo-fix-to-vt6420-too.patch +ecryptfs-clear-lookup_open-flag-when-creating-lower-file.patch +ecryptfs-call-vfs_setxattr-in-ecryptfs_setxattr.patch +md-fix-regression-with-raid1-arrays-without-persistent-metadata.patch +md-raid1-really-fix-recovery-looping-when-single-good-device-fails.patch +md-fix-return-value-of-rdev_size_change.patch +alsa-hda-use-bios-auto-parsing-instead-of-existing-model-quirk-for-medion-md2.patch +intel-gtt-fix-gtt_total_entries-detection.patch +sgi-xp-incoming-xpc-channel-messages-can-come-in-after-the-channel-s-partition-structures-have-been-torn-down.patch diff --git a/queue-2.6.36/sgi-xp-incoming-xpc-channel-messages-can-come-in-after-the-channel-s-partition-structures-have-been-torn-down.patch b/queue-2.6.36/sgi-xp-incoming-xpc-channel-messages-can-come-in-after-the-channel-s-partition-structures-have-been-torn-down.patch new file mode 100644 index 00000000000..a81e5d16d28 --- /dev/null +++ b/queue-2.6.36/sgi-xp-incoming-xpc-channel-messages-can-come-in-after-the-channel-s-partition-structures-have-been-torn-down.patch @@ -0,0 +1,93 @@ +From 09358972bff5ce99de496bbba97c85d417b3c054 Mon Sep 17 00:00:00 2001 +From: Robin Holt +Date: Tue, 26 Oct 2010 14:21:15 -0700 +Subject: sgi-xp: incoming XPC channel messages can come in after the channel's partition structures have been torn down + +From: Robin Holt + +commit 09358972bff5ce99de496bbba97c85d417b3c054 upstream. + +Under some workloads, some channel messages have been observed being +delayed on the sending side past the point where the receiving side has +been able to tear down its partition structures. + +This condition is already detected in xpc_handle_activate_IRQ_uv(), but +that information is not given to xpc_handle_activate_mq_msg_uv(). As a +result, xpc_handle_activate_mq_msg_uv() assumes the structures still exist +and references them, causing a NULL-pointer deref. + +Signed-off-by: Robin Holt +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +diff --git a/drivers/misc/sgi-xp/xpc_uv.c b/drivers/misc/sgi-xp/xpc_uv.c +index 1f59ee2..17bbacb 100644 +--- a/drivers/misc/sgi-xp/xpc_uv.c ++++ b/drivers/misc/sgi-xp/xpc_uv.c +@@ -417,6 +417,7 @@ xpc_process_activate_IRQ_rcvd_uv(void) + static void + xpc_handle_activate_mq_msg_uv(struct xpc_partition *part, + struct xpc_activate_mq_msghdr_uv *msg_hdr, ++ int part_setup, + int *wakeup_hb_checker) + { + unsigned long irq_flags; +@@ -481,6 +482,9 @@ xpc_handle_activate_mq_msg_uv(struct xpc_partition *part, + case XPC_ACTIVATE_MQ_MSG_CHCTL_CLOSEREQUEST_UV: { + struct xpc_activate_mq_msg_chctl_closerequest_uv *msg; + ++ if (!part_setup) ++ break; ++ + msg = container_of(msg_hdr, struct + xpc_activate_mq_msg_chctl_closerequest_uv, + hdr); +@@ -497,6 +501,9 @@ xpc_handle_activate_mq_msg_uv(struct xpc_partition *part, + case XPC_ACTIVATE_MQ_MSG_CHCTL_CLOSEREPLY_UV: { + struct xpc_activate_mq_msg_chctl_closereply_uv *msg; + ++ if (!part_setup) ++ break; ++ + msg = container_of(msg_hdr, struct + xpc_activate_mq_msg_chctl_closereply_uv, + hdr); +@@ -511,6 +518,9 @@ xpc_handle_activate_mq_msg_uv(struct xpc_partition *part, + case XPC_ACTIVATE_MQ_MSG_CHCTL_OPENREQUEST_UV: { + struct xpc_activate_mq_msg_chctl_openrequest_uv *msg; + ++ if (!part_setup) ++ break; ++ + msg = container_of(msg_hdr, struct + xpc_activate_mq_msg_chctl_openrequest_uv, + hdr); +@@ -528,6 +538,9 @@ xpc_handle_activate_mq_msg_uv(struct xpc_partition *part, + case XPC_ACTIVATE_MQ_MSG_CHCTL_OPENREPLY_UV: { + struct xpc_activate_mq_msg_chctl_openreply_uv *msg; + ++ if (!part_setup) ++ break; ++ + msg = container_of(msg_hdr, struct + xpc_activate_mq_msg_chctl_openreply_uv, hdr); + args = &part->remote_openclose_args[msg->ch_number]; +@@ -545,6 +558,9 @@ xpc_handle_activate_mq_msg_uv(struct xpc_partition *part, + case XPC_ACTIVATE_MQ_MSG_CHCTL_OPENCOMPLETE_UV: { + struct xpc_activate_mq_msg_chctl_opencomplete_uv *msg; + ++ if (!part_setup) ++ break; ++ + msg = container_of(msg_hdr, struct + xpc_activate_mq_msg_chctl_opencomplete_uv, hdr); + spin_lock_irqsave(&part->chctl_lock, irq_flags); +@@ -621,6 +637,7 @@ xpc_handle_activate_IRQ_uv(int irq, void *dev_id) + + part_referenced = xpc_part_ref(part); + xpc_handle_activate_mq_msg_uv(part, msg_hdr, ++ part_referenced, + &wakeup_hb_checker); + if (part_referenced) + xpc_part_deref(part); diff --git a/queue-2.6.36/sgi-xpc-xpc-fails-to-discover-partitions-with-all-nasids-above-128.patch b/queue-2.6.36/sgi-xpc-xpc-fails-to-discover-partitions-with-all-nasids-above-128.patch new file mode 100644 index 00000000000..6cf7c869b8b --- /dev/null +++ b/queue-2.6.36/sgi-xpc-xpc-fails-to-discover-partitions-with-all-nasids-above-128.patch @@ -0,0 +1,63 @@ +From c22c7aeff69796f46ae0fcec141538e28f50b24e Mon Sep 17 00:00:00 2001 +From: Robin@sgi.com +Date: Wed, 24 Nov 2010 12:56:59 -0800 +Subject: sgi-xpc: XPC fails to discover partitions with all nasids above 128 + +From: Robin@sgi.com + +commit c22c7aeff69796f46ae0fcec141538e28f50b24e upstream. + +UV hardware defines 256 memory protection regions versus the baseline 64 +with increasing size for the SN2 ia64. This was overlooked when XPC was +modified to accomodate both UV and SN2. + +Without this patch, a user could reconfigure their existing system and +suddenly disable cross-partition communications with no indication of what +has gone wrong. It also prevents larger configurations from using +cross-partition communication. + +Signed-off-by: Robin Holt +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/misc/sgi-xp/xpc_partition.c | 25 +++++++++++++++---------- + 1 file changed, 15 insertions(+), 10 deletions(-) + +--- a/drivers/misc/sgi-xp/xpc_partition.c ++++ b/drivers/misc/sgi-xp/xpc_partition.c +@@ -439,18 +439,23 @@ xpc_discovery(void) + * nodes that can comprise an access protection grouping. The access + * protection is in regards to memory, IOI and IPI. + */ +- max_regions = 64; + region_size = xp_region_size; + +- switch (region_size) { +- case 128: +- max_regions *= 2; +- case 64: +- max_regions *= 2; +- case 32: +- max_regions *= 2; +- region_size = 16; +- DBUG_ON(!is_shub2()); ++ if (is_uv()) ++ max_regions = 256; ++ else { ++ max_regions = 64; ++ ++ switch (region_size) { ++ case 128: ++ max_regions *= 2; ++ case 64: ++ max_regions *= 2; ++ case 32: ++ max_regions *= 2; ++ region_size = 16; ++ DBUG_ON(!is_shub2()); ++ } + } + + for (region = 0; region < max_regions; region++) { diff --git a/queue-2.6.36/ssb-b43-pci-bridge-add-new-vendor-for-bcm4318.patch b/queue-2.6.36/ssb-b43-pci-bridge-add-new-vendor-for-bcm4318.patch new file mode 100644 index 00000000000..a401add1946 --- /dev/null +++ b/queue-2.6.36/ssb-b43-pci-bridge-add-new-vendor-for-bcm4318.patch @@ -0,0 +1,41 @@ +From 1d8638d4038eb8709edc80e37a0bbb77253d86e9 Mon Sep 17 00:00:00 2001 +From: Daniel Klaffenbach +Date: Fri, 19 Nov 2010 21:25:21 -0600 +Subject: ssb: b43-pci-bridge: Add new vendor for BCM4318 + +From: Daniel Klaffenbach + +commit 1d8638d4038eb8709edc80e37a0bbb77253d86e9 upstream. + +Add new vendor for Broadcom 4318. + +Signed-off-by: Daniel Klaffenbach +Signed-off-by: Larry Finger +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ssb/b43_pci_bridge.c | 1 + + include/linux/pci_ids.h | 1 + + 2 files changed, 2 insertions(+) + +--- a/drivers/ssb/b43_pci_bridge.c ++++ b/drivers/ssb/b43_pci_bridge.c +@@ -24,6 +24,7 @@ static const struct pci_device_id b43_pc + { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4312) }, + { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4315) }, + { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4318) }, ++ { PCI_DEVICE(PCI_VENDOR_ID_BCM_GVC, 0x4318) }, + { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4319) }, + { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4320) }, + { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4321) }, +--- a/include/linux/pci_ids.h ++++ b/include/linux/pci_ids.h +@@ -2041,6 +2041,7 @@ + #define PCI_DEVICE_ID_AFAVLAB_P030 0x2182 + #define PCI_SUBDEVICE_ID_AFAVLAB_P061 0x2150 + ++#define PCI_VENDOR_ID_BCM_GVC 0x14a4 + #define PCI_VENDOR_ID_BROADCOM 0x14e4 + #define PCI_DEVICE_ID_TIGON3_5752 0x1600 + #define PCI_DEVICE_ID_TIGON3_5752M 0x1601 diff --git a/queue-2.6.36/um-fix-global-timer-issue-when-using-config_no_hz.patch b/queue-2.6.36/um-fix-global-timer-issue-when-using-config_no_hz.patch new file mode 100644 index 00000000000..d27db6b3c15 --- /dev/null +++ b/queue-2.6.36/um-fix-global-timer-issue-when-using-config_no_hz.patch @@ -0,0 +1,37 @@ +From 482db6df1746c4fa7d64a2441d4cb2610249c679 Mon Sep 17 00:00:00 2001 +From: Richard Weinberger +Date: Tue, 26 Oct 2010 14:21:13 -0700 +Subject: um: fix global timer issue when using CONFIG_NO_HZ + +From: Richard Weinberger + +commit 482db6df1746c4fa7d64a2441d4cb2610249c679 upstream. + +This fixes a issue which was introduced by fe2cc53e ("uml: track and make +up lost ticks"). + +timeval_to_ns() returns long long and not int. Due to that UML's timer +did not work properlt and caused timer freezes. + +Signed-off-by: Richard Weinberger +Acked-by: Pekka Enberg +Cc: Jeff Dike +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + arch/um/os-Linux/time.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/um/os-Linux/time.c ++++ b/arch/um/os-Linux/time.c +@@ -60,7 +60,7 @@ static inline long long timeval_to_ns(co + long long disable_timer(void) + { + struct itimerval time = ((struct itimerval) { { 0, 0 }, { 0, 0 } }); +- int remain, max = UM_NSEC_PER_SEC / UM_HZ; ++ long long remain, max = UM_NSEC_PER_SEC / UM_HZ; + + if (setitimer(ITIMER_VIRTUAL, &time, &time) < 0) + printk(UM_KERN_ERR "disable_timer - setitimer failed, " diff --git a/queue-2.6.36/um-remove-page_size-alignment-in-linker-script-causing-kernel-segfault.patch b/queue-2.6.36/um-remove-page_size-alignment-in-linker-script-causing-kernel-segfault.patch new file mode 100644 index 00000000000..c4473f18d85 --- /dev/null +++ b/queue-2.6.36/um-remove-page_size-alignment-in-linker-script-causing-kernel-segfault.patch @@ -0,0 +1,49 @@ +From 6915e04f8847bea16d0890f559694ad8eedd026c Mon Sep 17 00:00:00 2001 +From: Richard Weinberger +Date: Tue, 26 Oct 2010 14:21:16 -0700 +Subject: um: remove PAGE_SIZE alignment in linker script causing kernel segfault. + +From: Richard Weinberger + +commit 6915e04f8847bea16d0890f559694ad8eedd026c upstream. + +The linker script cleanup that I did in commit 5d150a97f93 ("um: Clean up +linker script using standard macros.") (2.6.32) accidentally introduced an +ALIGN(PAGE_SIZE) when converting to use INIT_TEXT_SECTION; Richard +Weinberger reported that this causes the kernel to segfault with +CONFIG_STATIC_LINK=y. + +I'm not certain why this extra alignment is a problem, but it seems likely +it is because previously + +__init_begin = _stext = _text = _sinittext + +and with the extra ALIGN(PAGE_SIZE), _sinittext becomes different from the +rest. So there is likely a bug here where something is assuming that +_sinittext is the same as one of those other symbols. But reverting the +accidental change fixes the regression, so it seems worth committing that +now. + +Signed-off-by: Tim Abbott +Reported-by: Richard Weinberger +Cc: Jeff Dike +Tested by: Antoine Martin +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + arch/um/kernel/uml.lds.S | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/um/kernel/uml.lds.S ++++ b/arch/um/kernel/uml.lds.S +@@ -22,7 +22,7 @@ SECTIONS + _text = .; + _stext = .; + __init_begin = .; +- INIT_TEXT_SECTION(PAGE_SIZE) ++ INIT_TEXT_SECTION(0) + . = ALIGN(PAGE_SIZE); + + .text : diff --git a/queue-2.6.36/viafb-use-proper-register-for-colour-when-doing-fill-ops.patch b/queue-2.6.36/viafb-use-proper-register-for-colour-when-doing-fill-ops.patch new file mode 100644 index 00000000000..6e84e0fb8c0 --- /dev/null +++ b/queue-2.6.36/viafb-use-proper-register-for-colour-when-doing-fill-ops.patch @@ -0,0 +1,46 @@ +From efd4f6398dc92b5bf392670df862f42a19f34cf2 Mon Sep 17 00:00:00 2001 +From: Florian Tobias Schandinat +Date: Wed, 22 Sep 2010 02:33:52 +0000 +Subject: viafb: use proper register for colour when doing fill ops + +From: Florian Tobias Schandinat + +commit efd4f6398dc92b5bf392670df862f42a19f34cf2 upstream. + +The colour was written to a wrong register for fillrect operations. +This sometimes caused empty console space (for example after 'clear') +to have a different colour than desired. Fix this by writing to the +correct register. +Many thanks to Daniel Drake and Jon Nettleton for pointing out this +issue and pointing me in the right direction for the fix. + +Fixes http://dev.laptop.org/ticket/9323 + +Signed-off-by: Florian Tobias Schandinat +Cc: Joseph Chan +Cc: Daniel Drake +Cc: Jon Nettleton +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/video/via/accel.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +--- a/drivers/video/via/accel.c ++++ b/drivers/video/via/accel.c +@@ -283,11 +283,12 @@ static int hw_bitblt_2(void __iomem *eng + writel(tmp, engine + 0x1C); + } + +- if (op != VIA_BITBLT_COLOR) ++ if (op == VIA_BITBLT_FILL) { ++ writel(fg_color, engine + 0x58); ++ } else if (op == VIA_BITBLT_MONO) { + writel(fg_color, engine + 0x4C); +- +- if (op == VIA_BITBLT_MONO) + writel(bg_color, engine + 0x50); ++ } + + if (op == VIA_BITBLT_FILL) + ge_cmd |= fill_rop << 24 | 0x00002000 | 0x00000001; diff --git a/queue-2.6.36/wireless-b43-fix-error-path-in-sdio.patch b/queue-2.6.36/wireless-b43-fix-error-path-in-sdio.patch new file mode 100644 index 00000000000..52bfc6771cf --- /dev/null +++ b/queue-2.6.36/wireless-b43-fix-error-path-in-sdio.patch @@ -0,0 +1,30 @@ +From e476a5a41ad67d0e2b4a652820c49a3923eb936b Mon Sep 17 00:00:00 2001 +From: Guennadi Liakhovetski +Date: Tue, 23 Nov 2010 17:10:24 +0100 +Subject: wireless: b43: fix error path in SDIO + +From: Guennadi Liakhovetski + +commit e476a5a41ad67d0e2b4a652820c49a3923eb936b upstream. + +Fix unbalanced call to sdio_release_host() on the error path. + +Signed-off-by: Guennadi Liakhovetski +Acked-by: Larry Finger +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/b43/sdio.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/wireless/b43/sdio.c ++++ b/drivers/net/wireless/b43/sdio.c +@@ -163,6 +163,7 @@ static int b43_sdio_probe(struct sdio_fu + err_free_ssb: + kfree(sdio); + err_disable_func: ++ sdio_claim_host(func); + sdio_disable_func(func); + err_release_host: + sdio_release_host(func); diff --git a/queue-2.6.36/xen-don-t-bother-to-stop-other-cpus-on-shutdown-reboot.patch b/queue-2.6.36/xen-don-t-bother-to-stop-other-cpus-on-shutdown-reboot.patch new file mode 100644 index 00000000000..283b5fc3a44 --- /dev/null +++ b/queue-2.6.36/xen-don-t-bother-to-stop-other-cpus-on-shutdown-reboot.patch @@ -0,0 +1,41 @@ +From 31e323cca9d5c8afd372976c35a5d46192f540d1 Mon Sep 17 00:00:00 2001 +From: Jeremy Fitzhardinge +Date: Mon, 29 Nov 2010 14:16:53 -0800 +Subject: xen: don't bother to stop other cpus on shutdown/reboot + +From: Jeremy Fitzhardinge + +commit 31e323cca9d5c8afd372976c35a5d46192f540d1 upstream. + +Xen will shoot all the VCPUs when we do a shutdown hypercall, so there's +no need to do it manually. + +In any case it will fail because all the IPI irqs have been pulled +down by this point, so the cross-CPU calls will simply hang forever. + +Until change 76fac077db6b34e2c6383a7b4f3f4f7b7d06d8ce the function calls +were not synchronously waited for, so this wasn't apparent. However after +that change the calls became synchronous leading to a hang on shutdown +on multi-VCPU guests. + +Signed-off-by: Jeremy Fitzhardinge +Cc: Alok Kataria +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/xen/enlighten.c | 4 ---- + 1 file changed, 4 deletions(-) + +--- a/arch/x86/xen/enlighten.c ++++ b/arch/x86/xen/enlighten.c +@@ -1017,10 +1017,6 @@ static void xen_reboot(int reason) + { + struct sched_shutdown r = { .reason = reason }; + +-#ifdef CONFIG_SMP +- stop_other_cpus(); +-#endif +- + if (HYPERVISOR_sched_op(SCHEDOP_shutdown, &r)) + BUG(); + } diff --git a/queue-2.6.36/xen-ensure-that-all-event-channels-start-off-bound-to-vcpu-0.patch b/queue-2.6.36/xen-ensure-that-all-event-channels-start-off-bound-to-vcpu-0.patch new file mode 100644 index 00000000000..57f843061db --- /dev/null +++ b/queue-2.6.36/xen-ensure-that-all-event-channels-start-off-bound-to-vcpu-0.patch @@ -0,0 +1,40 @@ +From b0097adeec27e30223c989561ab0f7aa60d1fe93 Mon Sep 17 00:00:00 2001 +From: Ian Campbell +Date: Fri, 8 Oct 2010 16:59:12 +0100 +Subject: xen: ensure that all event channels start off bound to VCPU 0 + +From: Ian Campbell + +commit b0097adeec27e30223c989561ab0f7aa60d1fe93 upstream. + +All event channels startbound to VCPU 0 so ensure that cpu_evtchn_mask +is initialised to reflect this. Otherwise there is a race after registering an +event channel but before the affinity is explicitly set where the event channel +can be delivered. If this happens then the event channel remains pending in the +L1 (evtchn_pending) array but is cleared in L2 (evtchn_pending_sel), this means +the event channel cannot be reraised until another event channel happens to +trigger the same L2 entry on that VCPU. + +sizeof(cpu_evtchn_mask(0))==sizeof(unsigned long*) which is not correct, and +causes only the first 32 or 64 event channels (depending on architecture) to be +initially bound to VCPU0. Use sizeof(struct cpu_evtchn_s) instead. + +Signed-off-by: Ian Campbell +Cc: Jeremy Fitzhardinge +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/xen/events.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/xen/events.c ++++ b/drivers/xen/events.c +@@ -261,7 +261,7 @@ static void init_evtchn_cpu_bindings(voi + } + #endif + +- memset(cpu_evtchn_mask(0), ~0, sizeof(cpu_evtchn_mask(0))); ++ memset(cpu_evtchn_mask(0), ~0, sizeof(struct cpu_evtchn_s)); + } + + static inline void clear_evtchn(int port)