From: Greg Kroah-Hartman Date: Mon, 8 Mar 2010 20:43:50 +0000 (-0800) Subject: more .32 patches X-Git-Tag: v2.6.32.10~35 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=f5b18a1ba69ecfeeb9b66adffa2f8b3cba1fc20b;p=thirdparty%2Fkernel%2Fstable-queue.git more .32 patches --- diff --git a/queue-2.6.32/ahci-disable-fpdma-auto-activate-optimization-on-nvidia-ahci.patch b/queue-2.6.32/ahci-disable-fpdma-auto-activate-optimization-on-nvidia-ahci.patch new file mode 100644 index 00000000000..28e276848dc --- /dev/null +++ b/queue-2.6.32/ahci-disable-fpdma-auto-activate-optimization-on-nvidia-ahci.patch @@ -0,0 +1,51 @@ +From 453d3131ec7aab82eaaa8401a50522a337092aa8 Mon Sep 17 00:00:00 2001 +From: Robert Hancock +Date: Tue, 26 Jan 2010 22:33:23 -0600 +Subject: ahci: disable FPDMA auto-activate optimization on NVIDIA AHCI + +From: Robert Hancock + +commit 453d3131ec7aab82eaaa8401a50522a337092aa8 upstream. + +Mike Cui reported that his system with an NVIDIA MCP79 (aka MCP7A) +chipset stopped working with 2.6.32. The problem appears to be that +2.6.32 now enables the FPDMA auto-activate optimization in the ahci +driver. The drive works fine with this enabled on an Intel AHCI so +this appears to be a chipset bug. Since MCP79 is a fairly recent +NVIDIA chipset and we don't have any info on whether any other NVIDIA +chipsets have this issue, disable FPDMA AA optimization on all NVIDIA +AHCI controllers for now. + +Should address http://bugzilla.kernel.org/show_bug.cgi?id=14922 + +Signed-off-by: Robert Hancock +While-we-investigate-issue-this-patch-looks-good-to-me-by: + Prajakta Gudadhe +Signed-off-by: Jeff Garzik +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ata/ahci.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +--- a/drivers/ata/ahci.c ++++ b/drivers/ata/ahci.c +@@ -3074,8 +3074,16 @@ static int ahci_init_one(struct pci_dev + ahci_save_initial_config(pdev, hpriv); + + /* prepare host */ +- if (hpriv->cap & HOST_CAP_NCQ) +- pi.flags |= ATA_FLAG_NCQ | ATA_FLAG_FPDMA_AA; ++ if (hpriv->cap & HOST_CAP_NCQ) { ++ pi.flags |= ATA_FLAG_NCQ; ++ /* Auto-activate optimization is supposed to be supported on ++ all AHCI controllers indicating NCQ support, but it seems ++ to be broken at least on some NVIDIA MCP79 chipsets. ++ Until we get info on which NVIDIA chipsets don't have this ++ issue, if any, disable AA on all NVIDIA AHCIs. */ ++ if (pdev->vendor != PCI_VENDOR_ID_NVIDIA) ++ pi.flags |= ATA_FLAG_FPDMA_AA; ++ } + + if (hpriv->cap & HOST_CAP_PMP) + pi.flags |= ATA_FLAG_PMP; diff --git a/queue-2.6.32/arm-5944-1-scsi-fix-timer-setup-in-fas216.c.patch b/queue-2.6.32/arm-5944-1-scsi-fix-timer-setup-in-fas216.c.patch new file mode 100644 index 00000000000..17dd70e0b38 --- /dev/null +++ b/queue-2.6.32/arm-5944-1-scsi-fix-timer-setup-in-fas216.c.patch @@ -0,0 +1,30 @@ +From b857df1acc634b18db1db2a40864af985100266e Mon Sep 17 00:00:00 2001 +From: Guennadi Liakhovetski +Date: Thu, 18 Feb 2010 18:07:18 +0100 +Subject: ARM: 5944/1: scsi: fix timer setup in fas216.c + +From: Guennadi Liakhovetski + +commit b857df1acc634b18db1db2a40864af985100266e upstream. + +mod_timer() takes an absolute time and not a delay as its argument. + +Signed-off-by: Guennadi Liakhovetski +Signed-off-by: Russell King +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/arm/fas216.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/scsi/arm/fas216.c ++++ b/drivers/scsi/arm/fas216.c +@@ -2516,7 +2516,7 @@ int fas216_eh_device_reset(struct scsi_c + if (info->scsi.phase == PHASE_IDLE) + fas216_kick(info); + +- mod_timer(&info->eh_timer, 30 * HZ); ++ mod_timer(&info->eh_timer, jiffies + 30 * HZ); + spin_unlock_irqrestore(&info->host_lock, flags); + + /* diff --git a/queue-2.6.32/bfin-fix-max-timeout-calculation.patch b/queue-2.6.32/bfin-fix-max-timeout-calculation.patch new file mode 100644 index 00000000000..e2685b6799e --- /dev/null +++ b/queue-2.6.32/bfin-fix-max-timeout-calculation.patch @@ -0,0 +1,54 @@ +From 3dae93ec3ee1fceec69f40ef9b97892ce62ba7a5 Mon Sep 17 00:00:00 2001 +From: Mike Frysinger +Date: Mon, 15 Feb 2010 19:32:25 -0500 +Subject: [WATCHDOG] bfin: fix max timeout calculation + +From: Mike Frysinger + +commit 3dae93ec3ee1fceec69f40ef9b97892ce62ba7a5 upstream. + +Relying on overflow/wrap around isn't exact because if you wrap far +enough, you get back to "valid" values. + +Reported-by: Thorsten Pohlmann +Signed-off-by: Mike Frysinger +Signed-off-by: Wim Van Sebroeck +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/watchdog/bfin_wdt.c | 13 +++++++------ + 1 file changed, 7 insertions(+), 6 deletions(-) + +--- a/drivers/watchdog/bfin_wdt.c ++++ b/drivers/watchdog/bfin_wdt.c +@@ -1,9 +1,8 @@ + /* + * Blackfin On-Chip Watchdog Driver +- * Supports BF53[123]/BF53[467]/BF54[2489]/BF561 + * + * Originally based on softdog.c +- * Copyright 2006-2007 Analog Devices Inc. ++ * Copyright 2006-2010 Analog Devices Inc. + * Copyright 2006-2007 Michele d'Amico + * Copyright 1996 Alan Cox + * +@@ -137,13 +136,15 @@ static int bfin_wdt_running(void) + */ + static int bfin_wdt_set_timeout(unsigned long t) + { +- u32 cnt; ++ u32 cnt, max_t, sclk; + unsigned long flags; + +- stampit(); ++ sclk = get_sclk(); ++ max_t = -1 / sclk; ++ cnt = t * sclk; ++ stamp("maxtimeout=%us newtimeout=%lus (cnt=%#x)", max_t, t, cnt); + +- cnt = t * get_sclk(); +- if (cnt < get_sclk()) { ++ if (t > max_t) { + printk(KERN_WARNING PFX "timeout value is too large\n"); + return -EINVAL; + } diff --git a/queue-2.6.32/fs-exec.c-fix-initial-stack-reservation.patch b/queue-2.6.32/fs-exec.c-fix-initial-stack-reservation.patch new file mode 100644 index 00000000000..7d5d5bc66ca --- /dev/null +++ b/queue-2.6.32/fs-exec.c-fix-initial-stack-reservation.patch @@ -0,0 +1,47 @@ +From a17e18790a8c47113a73139d54a375dc9ccd8f08 Mon Sep 17 00:00:00 2001 +From: Michael Neuling +Date: Mon, 22 Feb 2010 12:44:24 -0800 +Subject: fs/exec.c: fix initial stack reservation + +From: Michael Neuling + +commit a17e18790a8c47113a73139d54a375dc9ccd8f08 upstream. + +803bf5ec259941936262d10ecc84511b76a20921 ("fs/exec.c: restrict initial +stack space expansion to rlimit") attempts to limit the initial stack to +20*PAGE_SIZE. Unfortunately, in attempting ensure the stack is not +reduced in size, we ended up not changing the stack at all. + +This size reduction check is not necessary as the expand_stack call does +this already. + +This caused a regression in UML resulting in most guest processes being +killed. + +Signed-off-by: Michael Neuling +Reviewed-by: KOSAKI Motohiro +Acked-by: WANG Cong +Cc: Anton Blanchard +Cc: Oleg Nesterov +Cc: James Morris +Cc: Serge Hallyn +Cc: Benjamin Herrenschmidt +Cc: Jouni Malinen +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + fs/exec.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/fs/exec.c ++++ b/fs/exec.c +@@ -638,7 +638,6 @@ int setup_arg_pages(struct linux_binprm + * will align it up. + */ + rlim_stack = rlimit(RLIMIT_STACK) & PAGE_MASK; +- rlim_stack = min(rlim_stack, stack_size); + #ifdef CONFIG_STACK_GROWSUP + if (stack_size + stack_expand > rlim_stack) + stack_base = vma->vm_start + rlim_stack; diff --git a/queue-2.6.32/iwlwifi-error-checking-for-number-of-tfds-in-queue.patch b/queue-2.6.32/iwlwifi-error-checking-for-number-of-tfds-in-queue.patch new file mode 100644 index 00000000000..eb4498b245f --- /dev/null +++ b/queue-2.6.32/iwlwifi-error-checking-for-number-of-tfds-in-queue.patch @@ -0,0 +1,99 @@ +From a239a8b47cc0e5e6d7416a89f340beac06d5edaa Mon Sep 17 00:00:00 2001 +From: Wey-Yi Guy +Date: Fri, 19 Feb 2010 15:47:32 -0800 +Subject: iwlwifi: error checking for number of tfds in queue + +From: Wey-Yi Guy + +commit a239a8b47cc0e5e6d7416a89f340beac06d5edaa upstream. + +When receive reply_tx and ready to decrement the count for number of +tfds in queue, do error checking to prevent error condition and +tfds_in_queue become negative number. + +Signed-off-by: Wey-Yi Guy +Signed-off-by: Reinette Chatre +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/iwlwifi/iwl-4965.c | 2 +- + drivers/net/wireless/iwlwifi/iwl-5000.c | 4 ++-- + drivers/net/wireless/iwlwifi/iwl-core.h | 2 ++ + drivers/net/wireless/iwlwifi/iwl-tx.c | 16 +++++++++++++++- + 4 files changed, 20 insertions(+), 4 deletions(-) + +--- a/drivers/net/wireless/iwlwifi/iwl-4965.c ++++ b/drivers/net/wireless/iwlwifi/iwl-4965.c +@@ -2134,7 +2134,7 @@ static void iwl4965_rx_reply_tx(struct i + IWL_DEBUG_TX_REPLY(priv, "Retry scheduler reclaim scd_ssn " + "%d index %d\n", scd_ssn , index); + freed = iwl_tx_queue_reclaim(priv, txq_id, index); +- priv->stations[sta_id].tid[tid].tfds_in_queue -= freed; ++ iwl_free_tfds_in_queue(priv, sta_id, tid, freed); + + if (priv->mac80211_registered && + (iwl_queue_space(&txq->q) > txq->q.low_mark) && +--- a/drivers/net/wireless/iwlwifi/iwl-5000.c ++++ b/drivers/net/wireless/iwlwifi/iwl-5000.c +@@ -1264,7 +1264,7 @@ static void iwl5000_rx_reply_tx(struct i + scd_ssn , index, txq_id, txq->swq_id); + + freed = iwl_tx_queue_reclaim(priv, txq_id, index); +- priv->stations[sta_id].tid[tid].tfds_in_queue -= freed; ++ iwl_free_tfds_in_queue(priv, sta_id, tid, freed); + + if (priv->mac80211_registered && + (iwl_queue_space(&txq->q) > txq->q.low_mark) && +@@ -1294,7 +1294,7 @@ static void iwl5000_rx_reply_tx(struct i + + freed = iwl_tx_queue_reclaim(priv, txq_id, index); + if (ieee80211_is_data_qos(tx_resp->frame_ctrl)) +- priv->stations[sta_id].tid[tid].tfds_in_queue -= freed; ++ iwl_free_tfds_in_queue(priv, sta_id, tid, freed); + + if (priv->mac80211_registered && + (iwl_queue_space(&txq->q) > txq->q.low_mark)) +--- a/drivers/net/wireless/iwlwifi/iwl-core.h ++++ b/drivers/net/wireless/iwlwifi/iwl-core.h +@@ -410,6 +410,8 @@ void iwl_hw_txq_ctx_free(struct iwl_priv + int iwl_hw_tx_queue_init(struct iwl_priv *priv, + struct iwl_tx_queue *txq); + int iwl_txq_update_write_ptr(struct iwl_priv *priv, struct iwl_tx_queue *txq); ++void iwl_free_tfds_in_queue(struct iwl_priv *priv, ++ int sta_id, int tid, int freed); + int iwl_tx_queue_init(struct iwl_priv *priv, struct iwl_tx_queue *txq, + int slots_num, u32 txq_id); + void iwl_tx_queue_free(struct iwl_priv *priv, int txq_id); +--- a/drivers/net/wireless/iwlwifi/iwl-tx.c ++++ b/drivers/net/wireless/iwlwifi/iwl-tx.c +@@ -119,6 +119,20 @@ int iwl_txq_update_write_ptr(struct iwl_ + EXPORT_SYMBOL(iwl_txq_update_write_ptr); + + ++void iwl_free_tfds_in_queue(struct iwl_priv *priv, ++ int sta_id, int tid, int freed) ++{ ++ if (priv->stations[sta_id].tid[tid].tfds_in_queue >= freed) ++ priv->stations[sta_id].tid[tid].tfds_in_queue -= freed; ++ else { ++ IWL_ERR(priv, "free more than tfds_in_queue (%u:%d)\n", ++ priv->stations[sta_id].tid[tid].tfds_in_queue, ++ freed); ++ priv->stations[sta_id].tid[tid].tfds_in_queue = 0; ++ } ++} ++EXPORT_SYMBOL(iwl_free_tfds_in_queue); ++ + /** + * iwl_tx_queue_free - Deallocate DMA queue. + * @txq: Transmit queue to deallocate. +@@ -1485,7 +1499,7 @@ void iwl_rx_reply_compressed_ba(struct i + if (txq->q.read_ptr != (ba_resp_scd_ssn & 0xff)) { + /* calculate mac80211 ampdu sw queue to wake */ + int freed = iwl_tx_queue_reclaim(priv, scd_flow, index); +- priv->stations[sta_id].tid[tid].tfds_in_queue -= freed; ++ iwl_free_tfds_in_queue(priv, sta_id, tid, freed); + + if ((iwl_queue_space(&txq->q) > txq->q.low_mark) && + priv->mac80211_registered && diff --git a/queue-2.6.32/iwlwifi-sanity-check-before-counting-number-of-tfds-can-be-free.patch b/queue-2.6.32/iwlwifi-sanity-check-before-counting-number-of-tfds-can-be-free.patch new file mode 100644 index 00000000000..e32cd732202 --- /dev/null +++ b/queue-2.6.32/iwlwifi-sanity-check-before-counting-number-of-tfds-can-be-free.patch @@ -0,0 +1,70 @@ +From a120e912eb51e347f36c71b60a1d13af74d30e83 Mon Sep 17 00:00:00 2001 +From: Stanislaw Gruszka +Date: Fri, 19 Feb 2010 15:47:33 -0800 +Subject: iwlwifi: sanity check before counting number of tfds can be free + +From: Stanislaw Gruszka + +commit a120e912eb51e347f36c71b60a1d13af74d30e83 upstream. + +Check the frame control for ieee80211_is_data_qos() is true before +counting the number of tfds can be free, the tfds_in_queue only +increment when ieee80211_is_data_qos() is true before transmit; so it +should only decrement if the type match. + +Remove ieee80211_is_data_qos check for frame_ctrl in tx_resp to avoid +invalid information pass from uCode. + +Signed-off-by: Stanislaw Gruszka +Signed-off-by: Wey-Yi Guy +Signed-off-by: Reinette Chatre +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/iwlwifi/iwl-5000.c | 6 ++---- + drivers/net/wireless/iwlwifi/iwl-tx.c | 5 +++++ + 2 files changed, 7 insertions(+), 4 deletions(-) + +--- a/drivers/net/wireless/iwlwifi/iwl-5000.c ++++ b/drivers/net/wireless/iwlwifi/iwl-5000.c +@@ -1293,16 +1293,14 @@ static void iwl5000_rx_reply_tx(struct i + tx_resp->failure_frame); + + freed = iwl_tx_queue_reclaim(priv, txq_id, index); +- if (ieee80211_is_data_qos(tx_resp->frame_ctrl)) +- iwl_free_tfds_in_queue(priv, sta_id, tid, freed); ++ iwl_free_tfds_in_queue(priv, sta_id, tid, freed); + + if (priv->mac80211_registered && + (iwl_queue_space(&txq->q) > txq->q.low_mark)) + iwl_wake_queue(priv, txq_id); + } + +- if (ieee80211_is_data_qos(tx_resp->frame_ctrl)) +- iwl_txq_check_empty(priv, sta_id, tid, txq_id); ++ iwl_txq_check_empty(priv, sta_id, tid, txq_id); + + if (iwl_check_bits(status, TX_ABORT_REQUIRED_MSK)) + IWL_ERR(priv, "TODO: Implement Tx ABORT REQUIRED!!!\n"); +--- a/drivers/net/wireless/iwlwifi/iwl-tx.c ++++ b/drivers/net/wireless/iwlwifi/iwl-tx.c +@@ -1071,6 +1071,7 @@ int iwl_tx_queue_reclaim(struct iwl_priv + struct iwl_queue *q = &txq->q; + struct iwl_tx_info *tx_info; + int nfreed = 0; ++ struct ieee80211_hdr *hdr; + + if ((index >= q->n_bd) || (iwl_queue_used(q, index) == 0)) { + IWL_ERR(priv, "Read index for DMA queue txq id (%d), index %d, " +@@ -1085,6 +1086,10 @@ int iwl_tx_queue_reclaim(struct iwl_priv + + tx_info = &txq->txb[txq->q.read_ptr]; + ieee80211_tx_status_irqsafe(priv->hw, tx_info->skb[0]); ++ ++ hdr = (struct ieee80211_hdr *)tx_info->skb[0]->data; ++ if (hdr && ieee80211_is_data_qos(hdr->frame_control)) ++ nfreed++; + tx_info->skb[0] = NULL; + + if (priv->cfg->ops->lib->txq_inval_byte_cnt_tbl) diff --git a/queue-2.6.32/iwlwifi-set-ht-flags-after-channel-in-rxon.patch b/queue-2.6.32/iwlwifi-set-ht-flags-after-channel-in-rxon.patch new file mode 100644 index 00000000000..9aa13519bb8 --- /dev/null +++ b/queue-2.6.32/iwlwifi-set-ht-flags-after-channel-in-rxon.patch @@ -0,0 +1,51 @@ +From 5e2f75b8993a0d83d469388b50716dd5551f2eb4 Mon Sep 17 00:00:00 2001 +From: Dan Halperin +Date: Thu, 18 Feb 2010 22:01:39 -0800 +Subject: iwlwifi: set HT flags after channel in rxon + +From: Dan Halperin + +commit 5e2f75b8993a0d83d469388b50716dd5551f2eb4 upstream. + +The HT extension channel settings require priv->staging_rxon.channel to be +accurate. However, iwl_set_rxon_ht was being called before iwl_set_rxon_channel +and thus HT40 could be broken unless another call to iwl_mac_config came in. + +This problem was recently introduced by "iwlwifi: Fix to set correct ht +configuration" + +The particular setting in which I noticed this was monitor mode: + + iwconfig wlan0 mode monitor + ifconfig wlan0 up + ./iw wlan0 set channel 64 HT40- + #./iw wlan0 set channel 64 HT40- + tcpdump -i wlan0 -y IEEE802_11_RADIO + +would only catch HT40 packets if I issued the IW command twice. + +From visual inspection, iwl_set_rxon_channel does not depend on +iwl_set_rxon_ht, so simply swapping them should be safe and fixes this problem. + +Signed-off-by: Daniel Halperin +Acked-by: Wey-Yi Guy +Signed-off-by: Reinette Chatre +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/iwlwifi/iwl-core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/wireless/iwlwifi/iwl-core.c ++++ b/drivers/net/wireless/iwlwifi/iwl-core.c +@@ -2645,8 +2645,8 @@ int iwl_mac_config(struct ieee80211_hw * + if ((le16_to_cpu(priv->staging_rxon.channel) != ch)) + priv->staging_rxon.flags = 0; + +- iwl_set_rxon_ht(priv, ht_conf); + iwl_set_rxon_channel(priv, conf->channel); ++ iwl_set_rxon_ht(priv, ht_conf); + + iwl_set_flags_for_band(priv, conf->channel->band); + spin_unlock_irqrestore(&priv->lock, flags); diff --git a/queue-2.6.32/memcg-fix-oom-killing-a-child-process-in-an-other-cgroup.patch b/queue-2.6.32/memcg-fix-oom-killing-a-child-process-in-an-other-cgroup.patch new file mode 100644 index 00000000000..30661f65541 --- /dev/null +++ b/queue-2.6.32/memcg-fix-oom-killing-a-child-process-in-an-other-cgroup.patch @@ -0,0 +1,42 @@ +From 5a2d41961dd6815b874b5c0afec0ac96cd90eea4 Mon Sep 17 00:00:00 2001 +From: KAMEZAWA Hiroyuki +Date: Mon, 22 Feb 2010 12:44:14 -0800 +Subject: memcg: fix oom killing a child process in an other cgroup + +From: KAMEZAWA Hiroyuki + +commit 5a2d41961dd6815b874b5c0afec0ac96cd90eea4 upstream. + +Presently the oom-killer is memcg aware and it finds the worst process +from processes under memcg(s) in oom. Then, it kills victim's child +first. + +It may kill a child in another cgroup and may not be any help for +recovery. And it will break the assumption users have. + +This patch fixes it. + +Signed-off-by: KAMEZAWA Hiroyuki +Reviewed-by: Minchan Kim +Cc: Balbir Singh +Reviewed-by: Daisuke Nishimura +Acked-by: David Rientjes +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/oom_kill.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/mm/oom_kill.c ++++ b/mm/oom_kill.c +@@ -426,6 +426,8 @@ static int oom_kill_process(struct task_ + list_for_each_entry(c, &p->children, sibling) { + if (c->mm == p->mm) + continue; ++ if (mem && !task_in_mem_cgroup(c, mem)) ++ continue; + if (!oom_kill_task(c)) + return 0; + } diff --git a/queue-2.6.32/netlabel-fix-export-of-selinux-categories-127.patch b/queue-2.6.32/netlabel-fix-export-of-selinux-categories-127.patch new file mode 100644 index 00000000000..c514e6f2884 --- /dev/null +++ b/queue-2.6.32/netlabel-fix-export-of-selinux-categories-127.patch @@ -0,0 +1,35 @@ +From c36f74e67fa12202dbcb4ad92c5ac844f9d36b98 Mon Sep 17 00:00:00 2001 +From: Joshua Roys +Date: Wed, 24 Feb 2010 18:52:44 -0500 +Subject: netlabel: fix export of SELinux categories > 127 + +From: Joshua Roys + +commit c36f74e67fa12202dbcb4ad92c5ac844f9d36b98 upstream. + +This fixes corrupted CIPSO packets when SELinux categories greater than 127 +are used. The bug occured on the second (and later) loops through the +while; the inner for loop through the ebitmap->maps array used the same +index as the NetLabel catmap->bitmap array, even though the NetLabel bitmap +is twice as long as the SELinux bitmap. + +Signed-off-by: Joshua Roys +Acked-by: Paul Moore +Signed-off-by: James Morris +Signed-off-by: Greg Kroah-Hartman + +--- + security/selinux/ss/ebitmap.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/security/selinux/ss/ebitmap.c ++++ b/security/selinux/ss/ebitmap.c +@@ -128,7 +128,7 @@ int ebitmap_netlbl_export(struct ebitmap + cmap_idx = delta / NETLBL_CATMAP_MAPSIZE; + cmap_sft = delta % NETLBL_CATMAP_MAPSIZE; + c_iter->bitmap[cmap_idx] +- |= e_iter->maps[cmap_idx] << cmap_sft; ++ |= e_iter->maps[i] << cmap_sft; + } + e_iter = e_iter->next; + } diff --git a/queue-2.6.32/pci-hotplug-check-ioremap-return-value-in-ibmphp_ebda.c.patch b/queue-2.6.32/pci-hotplug-check-ioremap-return-value-in-ibmphp_ebda.c.patch new file mode 100644 index 00000000000..34d6707b2b9 --- /dev/null +++ b/queue-2.6.32/pci-hotplug-check-ioremap-return-value-in-ibmphp_ebda.c.patch @@ -0,0 +1,30 @@ +From ba02b242bbf8e4e1bc63d62e8ccec33b4e5ea132 Mon Sep 17 00:00:00 2001 +From: Andrew Morton +Date: Tue, 2 Feb 2010 14:45:54 -0800 +Subject: PCI hotplug: check ioremap() return value in ibmphp_ebda.c + +From: Andrew Morton + +commit ba02b242bbf8e4e1bc63d62e8ccec33b4e5ea132 upstream. + +check ioremap() return value. + +Signed-off-by: Andrew Morton +Signed-off-by: Jesse Barnes +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pci/hotplug/ibmphp_ebda.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/pci/hotplug/ibmphp_ebda.c ++++ b/drivers/pci/hotplug/ibmphp_ebda.c +@@ -261,6 +261,8 @@ int __init ibmphp_access_ebda (void) + debug ("returned ebda segment: %x\n", ebda_seg); + + io_mem = ioremap(ebda_seg<<4, 1); ++ if (!io_mem) ++ return -ENOMEM; + ebda_sz = readb(io_mem); + iounmap(io_mem); + debug("ebda size: %d(KiB)\n", ebda_sz); diff --git a/queue-2.6.32/pci-hotplug-ibmphp-read-the-length-of-ebda-and-map-entire-ebda-region.patch b/queue-2.6.32/pci-hotplug-ibmphp-read-the-length-of-ebda-and-map-entire-ebda-region.patch new file mode 100644 index 00000000000..766e7db009c --- /dev/null +++ b/queue-2.6.32/pci-hotplug-ibmphp-read-the-length-of-ebda-and-map-entire-ebda-region.patch @@ -0,0 +1,51 @@ +From b0fc889c4311835ae7d02f433154bc20cad9ee11 Mon Sep 17 00:00:00 2001 +From: Chandru +Date: Mon, 11 Jan 2010 11:49:21 +0530 +Subject: PCI hotplug: ibmphp: read the length of ebda and map entire ebda region + +From: Chandru + +commit b0fc889c4311835ae7d02f433154bc20cad9ee11 upstream. + +ibmphp driver currently maps only 1KB of ebda memory area into kernel address +space during driver initialization. This causes kernel oops when the driver is +modprobe'd and it accesses memory beyond 1KB within ebda segment. The first +byte of ebda segment actually stores the length of the ebda region in +Kilobytes. Hence make use of the length parameter and map the entire ebda +region. + +Signed-off-by: Chandru Siddalingappa +Signed-off-by: Jesse Barnes +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pci/hotplug/ibmphp_ebda.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +--- a/drivers/pci/hotplug/ibmphp_ebda.c ++++ b/drivers/pci/hotplug/ibmphp_ebda.c +@@ -245,7 +245,7 @@ static void __init print_ebda_hpc (void) + + int __init ibmphp_access_ebda (void) + { +- u8 format, num_ctlrs, rio_complete, hs_complete; ++ u8 format, num_ctlrs, rio_complete, hs_complete, ebda_sz; + u16 ebda_seg, num_entries, next_offset, offset, blk_id, sub_addr, re, rc_id, re_id, base; + int rc = 0; + +@@ -260,7 +260,14 @@ int __init ibmphp_access_ebda (void) + iounmap (io_mem); + debug ("returned ebda segment: %x\n", ebda_seg); + +- io_mem = ioremap(ebda_seg<<4, 1024); ++ io_mem = ioremap(ebda_seg<<4, 1); ++ ebda_sz = readb(io_mem); ++ iounmap(io_mem); ++ debug("ebda size: %d(KiB)\n", ebda_sz); ++ if (ebda_sz == 0) ++ return -ENOMEM; ++ ++ io_mem = ioremap(ebda_seg<<4, (ebda_sz * 1024)); + if (!io_mem ) + return -ENOMEM; + next_offset = 0x180; diff --git a/queue-2.6.32/series b/queue-2.6.32/series index 20894ee07c3..960936c8252 100644 --- a/queue-2.6.32/series +++ b/queue-2.6.32/series @@ -1 +1,16 @@ fix-lookup_follow-on-automount-symlinks.patch +arm-5944-1-scsi-fix-timer-setup-in-fas216.c.patch +v4l-dvb-dvb-l64781.ko-broken-with-gcc-4.5.patch +bfin-fix-max-timeout-calculation.patch +v4l-dvb-video-pwc-fix-regression-in-pwc_set_shutter_speed-caused-by-bad-constant-sizeof-conversion.patch +v4l-dvb-bttv-move-i2c-ir-initialization.patch +v4l-dvb-cxusb-select-all-required-frontend-and-tuner-modules.patch +memcg-fix-oom-killing-a-child-process-in-an-other-cgroup.patch +fs-exec.c-fix-initial-stack-reservation.patch +iwlwifi-error-checking-for-number-of-tfds-in-queue.patch +iwlwifi-set-ht-flags-after-channel-in-rxon.patch +iwlwifi-sanity-check-before-counting-number-of-tfds-can-be-free.patch +netlabel-fix-export-of-selinux-categories-127.patch +ahci-disable-fpdma-auto-activate-optimization-on-nvidia-ahci.patch +pci-hotplug-ibmphp-read-the-length-of-ebda-and-map-entire-ebda-region.patch +pci-hotplug-check-ioremap-return-value-in-ibmphp_ebda.c.patch diff --git a/queue-2.6.32/v4l-dvb-bttv-move-i2c-ir-initialization.patch b/queue-2.6.32/v4l-dvb-bttv-move-i2c-ir-initialization.patch new file mode 100644 index 00000000000..cb60bc0f2cd --- /dev/null +++ b/queue-2.6.32/v4l-dvb-bttv-move-i2c-ir-initialization.patch @@ -0,0 +1,72 @@ +From 2434466432464110b5307757e0285dd41f15512e Mon Sep 17 00:00:00 2001 +From: Jean Delvare +Date: Fri, 19 Feb 2010 00:18:41 -0300 +Subject: V4L/DVB: bttv: Move I2C IR initialization + +From: Jean Delvare + +commit 2434466432464110b5307757e0285dd41f15512e upstream. + +Move I2C IR initialization from just after I2C bus setup to right +before non-I2C IR initialization. This avoids the case where an I2C IR +device is blocking audio support (at least the PV951 suffers from +this). It is also more logical to group IR support together, +regardless of the connectivity. + +This fixes bug #15184: +http://bugzilla.kernel.org/show_bug.cgi?id=15184 + +Signed-off-by: Jean Delvare +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/video/bt8xx/bttv-driver.c | 1 + + drivers/media/video/bt8xx/bttv-i2c.c | 8 ++++++-- + drivers/media/video/bt8xx/bttvp.h | 1 + + 3 files changed, 8 insertions(+), 2 deletions(-) + +--- a/drivers/media/video/bt8xx/bttv-driver.c ++++ b/drivers/media/video/bt8xx/bttv-driver.c +@@ -4468,6 +4468,7 @@ static int __devinit bttv_probe(struct p + request_modules(btv); + } + ++ init_bttv_i2c_ir(btv); + bttv_input_init(btv); + + /* everything is fine */ +--- a/drivers/media/video/bt8xx/bttv-i2c.c ++++ b/drivers/media/video/bt8xx/bttv-i2c.c +@@ -388,7 +388,12 @@ int __devinit init_bttv_i2c(struct bttv + if (0 == btv->i2c_rc && i2c_scan) + do_i2c_scan(btv->c.v4l2_dev.name, &btv->i2c_client); + +- /* Instantiate the IR receiver device, if present */ ++ return btv->i2c_rc; ++} ++ ++/* Instantiate the I2C IR receiver device, if present */ ++void __devinit init_bttv_i2c_ir(struct bttv *btv) ++{ + if (0 == btv->i2c_rc) { + struct i2c_board_info info; + /* The external IR receiver is at i2c address 0x34 (0x35 for +@@ -408,7 +413,6 @@ int __devinit init_bttv_i2c(struct bttv + strlcpy(info.type, "ir_video", I2C_NAME_SIZE); + i2c_new_probed_device(&btv->c.i2c_adap, &info, addr_list); + } +- return btv->i2c_rc; + } + + int __devexit fini_bttv_i2c(struct bttv *btv) +--- a/drivers/media/video/bt8xx/bttvp.h ++++ b/drivers/media/video/bt8xx/bttvp.h +@@ -279,6 +279,7 @@ extern unsigned int bttv_debug; + extern unsigned int bttv_gpio; + extern void bttv_gpio_tracking(struct bttv *btv, char *comment); + extern int init_bttv_i2c(struct bttv *btv); ++extern void init_bttv_i2c_ir(struct bttv *btv); + extern int fini_bttv_i2c(struct bttv *btv); + + #define bttv_printk if (bttv_verbose) printk diff --git a/queue-2.6.32/v4l-dvb-cxusb-select-all-required-frontend-and-tuner-modules.patch b/queue-2.6.32/v4l-dvb-cxusb-select-all-required-frontend-and-tuner-modules.patch new file mode 100644 index 00000000000..694efc9f523 --- /dev/null +++ b/queue-2.6.32/v4l-dvb-cxusb-select-all-required-frontend-and-tuner-modules.patch @@ -0,0 +1,37 @@ +From fc4a7f93087a48619005111895dcaa115f807399 Mon Sep 17 00:00:00 2001 +From: Ben Hutchings +Date: Wed, 10 Feb 2010 23:57:17 -0300 +Subject: V4L/DVB: cxusb: Select all required frontend and tuner modules + +From: Ben Hutchings + +commit fc4a7f93087a48619005111895dcaa115f807399 upstream. + +cxusb uses the atbm8830 and lgs8gxx (not lgs8gl5) frontends and the +max2165 tuner, so it needs to select them. + +Signed-off-by: Ben Hutchings +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/dvb/dvb-usb/Kconfig | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/media/dvb/dvb-usb/Kconfig ++++ b/drivers/media/dvb/dvb-usb/Kconfig +@@ -112,11 +112,13 @@ config DVB_USB_CXUSB + select DVB_MT352 if !DVB_FE_CUSTOMISE + select DVB_ZL10353 if !DVB_FE_CUSTOMISE + select DVB_DIB7000P if !DVB_FE_CUSTOMISE +- select DVB_LGS8GL5 if !DVB_FE_CUSTOMISE + select DVB_TUNER_DIB0070 if !DVB_FE_CUSTOMISE ++ select DVB_ATBM8830 if !DVB_FE_CUSTOMISE ++ select DVB_LGS8GXX if !DVB_FE_CUSTOMISE + select MEDIA_TUNER_SIMPLE if !MEDIA_TUNER_CUSTOMISE + select MEDIA_TUNER_XC2028 if !MEDIA_TUNER_CUSTOMISE + select MEDIA_TUNER_MXL5005S if !MEDIA_TUNER_CUSTOMISE ++ select MEDIA_TUNER_MAX2165 if !MEDIA_TUNER_CUSTOMISE + help + Say Y here to support the Conexant USB2.0 hybrid reference design. + Currently, only DVB and ATSC modes are supported, analog mode diff --git a/queue-2.6.32/v4l-dvb-dvb-l64781.ko-broken-with-gcc-4.5.patch b/queue-2.6.32/v4l-dvb-dvb-l64781.ko-broken-with-gcc-4.5.patch new file mode 100644 index 00000000000..e7eb606fca6 --- /dev/null +++ b/queue-2.6.32/v4l-dvb-dvb-l64781.ko-broken-with-gcc-4.5.patch @@ -0,0 +1,48 @@ +From c1db53b36633e6a7511dbec7c372f01a31528f0c Mon Sep 17 00:00:00 2001 +From: Richard Guenther +Date: Tue, 9 Feb 2010 20:16:03 -0300 +Subject: V4L/DVB: dvb: l64781.ko broken with gcc 4.5 + +From: Richard Guenther + +commit c1db53b36633e6a7511dbec7c372f01a31528f0c upstream. + +I'm trying to fix it on the GCC side (PR43007), but the module is +quite stupid in using ULL constants to operate on u32 values: + +static int apply_frontend_param (struct dvb_frontend* fe, struct +dvb_frontend_parameters *param) +{ +... + static const u32 ppm = 8000; + u32 spi_bias; +... + + spi_bias *= 1000ULL; + spi_bias /= 1000ULL + ppm/1000; + +which causes current GCC 4.5 to emit calls to __udivdi3 for i?86 again. + +This patch fixes this issue. + +Signed-off-by: Richard Guenther +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Mauro Carvalho Chehab + +--- + drivers/media/dvb/frontends/l64781.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/media/dvb/frontends/l64781.c ++++ b/drivers/media/dvb/frontends/l64781.c +@@ -192,8 +192,8 @@ static int apply_frontend_param (struct + spi_bias *= qam_tab[p->constellation]; + spi_bias /= p->code_rate_HP + 1; + spi_bias /= (guard_tab[p->guard_interval] + 32); +- spi_bias *= 1000ULL; +- spi_bias /= 1000ULL + ppm/1000; ++ spi_bias *= 1000; ++ spi_bias /= 1000 + ppm/1000; + spi_bias *= p->code_rate_HP; + + val0x04 = (p->transmission_mode << 2) | p->guard_interval; diff --git a/queue-2.6.32/v4l-dvb-video-pwc-fix-regression-in-pwc_set_shutter_speed-caused-by-bad-constant-sizeof-conversion.patch b/queue-2.6.32/v4l-dvb-video-pwc-fix-regression-in-pwc_set_shutter_speed-caused-by-bad-constant-sizeof-conversion.patch new file mode 100644 index 00000000000..ba41a6bea22 --- /dev/null +++ b/queue-2.6.32/v4l-dvb-video-pwc-fix-regression-in-pwc_set_shutter_speed-caused-by-bad-constant-sizeof-conversion.patch @@ -0,0 +1,37 @@ +From 53f68607caba85db9a73846ccd289e4b7fa96295 Mon Sep 17 00:00:00 2001 +From: Martin Fuzzey +Date: Thu, 11 Feb 2010 10:50:31 -0300 +Subject: V4L/DVB: Video : pwc : Fix regression in pwc_set_shutter_speed caused by bad constant => sizeof conversion. + +From: Martin Fuzzey + +commit 53f68607caba85db9a73846ccd289e4b7fa96295 upstream. + +Regression was caused by my commit 6b35ca0d3d586b8ecb8396821af21186e20afaf0 +which determined message size using sizeof rather than hardcoded constants. + +Unfortunately pwc_set_shutter_speed reuses a 2 byte buffer for a one byte +message too so the sizeof was bogus in this case. + +All other uses of sizeof checked and are ok. + +Acked-by: Laurent Pinchart +Signed-off-by: Martin Fuzzey +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/video/pwc/pwc-ctrl.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/media/video/pwc/pwc-ctrl.c ++++ b/drivers/media/video/pwc/pwc-ctrl.c +@@ -753,7 +753,7 @@ int pwc_set_shutter_speed(struct pwc_dev + buf[0] = 0xff; /* fixed */ + + ret = send_control_msg(pdev, +- SET_LUM_CTL, SHUTTER_MODE_FORMATTER, &buf, sizeof(buf)); ++ SET_LUM_CTL, SHUTTER_MODE_FORMATTER, &buf, 1); + + if (!mode && ret >= 0) { + if (value < 0)