From: Greg Kroah-Hartman Date: Tue, 6 Apr 2010 19:07:16 +0000 (-0700) Subject: .33 patches X-Git-Tag: v2.6.32.12~59 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=88afe94e68df74c10152443bc725aeb3964c83d7;p=thirdparty%2Fkernel%2Fstable-queue.git .33 patches --- diff --git a/queue-2.6.33/freezer-fix-buggy-resume-test-for-tasks-frozen-with-cgroup-freezer.patch b/queue-2.6.33/freezer-fix-buggy-resume-test-for-tasks-frozen-with-cgroup-freezer.patch new file mode 100644 index 00000000000..71c2f86ec97 --- /dev/null +++ b/queue-2.6.33/freezer-fix-buggy-resume-test-for-tasks-frozen-with-cgroup-freezer.patch @@ -0,0 +1,101 @@ +From 5a7aadfe2fcb0f69e2acc1fbefe22a096e792fc9 Mon Sep 17 00:00:00 2001 +From: Matt Helsley +Date: Fri, 26 Mar 2010 23:51:44 +0100 +Subject: Freezer: Fix buggy resume test for tasks frozen with cgroup freezer + +From: Matt Helsley + +commit 5a7aadfe2fcb0f69e2acc1fbefe22a096e792fc9 upstream. + +When the cgroup freezer is used to freeze tasks we do not want to thaw +those tasks during resume. Currently we test the cgroup freezer +state of the resuming tasks to see if the cgroup is FROZEN. If so +then we don't thaw the task. However, the FREEZING state also indicates +that the task should remain frozen. + +This also avoids a problem pointed out by Oren Ladaan: the freezer state +transition from FREEZING to FROZEN is updated lazily when userspace reads +or writes the freezer.state file in the cgroup filesystem. This means that +resume will thaw tasks in cgroups which should be in the FROZEN state if +there is no read/write of the freezer.state file to trigger this +transition before suspend. + +NOTE: Another "simple" solution would be to always update the cgroup +freezer state during resume. However it's a bad choice for several reasons: +Updating the cgroup freezer state is somewhat expensive because it requires +walking all the tasks in the cgroup and checking if they are each frozen. +Worse, this could easily make resume run in N^2 time where N is the number +of tasks in the cgroup. Finally, updating the freezer state from this code +path requires trickier locking because of the way locks must be ordered. + +Instead of updating the freezer state we rely on the fact that lazy +updates only manage the transition from FREEZING to FROZEN. We know that +a cgroup with the FREEZING state may actually be FROZEN so test for that +state too. This makes sense in the resume path even for partially-frozen +cgroups -- those that really are FREEZING but not FROZEN. + +Reported-by: Oren Ladaan +Signed-off-by: Matt Helsley +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman + +--- + include/linux/freezer.h | 7 +++++-- + kernel/cgroup_freezer.c | 9 ++++++--- + kernel/power/process.c | 2 +- + 3 files changed, 12 insertions(+), 6 deletions(-) + +--- a/include/linux/freezer.h ++++ b/include/linux/freezer.h +@@ -64,9 +64,12 @@ extern bool freeze_task(struct task_stru + extern void cancel_freezing(struct task_struct *p); + + #ifdef CONFIG_CGROUP_FREEZER +-extern int cgroup_frozen(struct task_struct *task); ++extern int cgroup_freezing_or_frozen(struct task_struct *task); + #else /* !CONFIG_CGROUP_FREEZER */ +-static inline int cgroup_frozen(struct task_struct *task) { return 0; } ++static inline int cgroup_freezing_or_frozen(struct task_struct *task) ++{ ++ return 0; ++} + #endif /* !CONFIG_CGROUP_FREEZER */ + + /* +--- a/kernel/cgroup_freezer.c ++++ b/kernel/cgroup_freezer.c +@@ -47,17 +47,20 @@ static inline struct freezer *task_freez + struct freezer, css); + } + +-int cgroup_frozen(struct task_struct *task) ++int cgroup_freezing_or_frozen(struct task_struct *task) + { + struct freezer *freezer; + enum freezer_state state; + + task_lock(task); + freezer = task_freezer(task); +- state = freezer->state; ++ if (!freezer->css.cgroup->parent) ++ state = CGROUP_THAWED; /* root cgroup can't be frozen */ ++ else ++ state = freezer->state; + task_unlock(task); + +- return state == CGROUP_FROZEN; ++ return (state == CGROUP_FREEZING) || (state == CGROUP_FROZEN); + } + + /* +--- a/kernel/power/process.c ++++ b/kernel/power/process.c +@@ -145,7 +145,7 @@ static void thaw_tasks(bool nosig_only) + if (nosig_only && should_send_signal(p)) + continue; + +- if (cgroup_frozen(p)) ++ if (cgroup_freezing_or_frozen(p)) + continue; + + thaw_process(p); diff --git a/queue-2.6.33/iwlwifi-counting-number-of-tfds-can-be-free-for-4965.patch b/queue-2.6.33/iwlwifi-counting-number-of-tfds-can-be-free-for-4965.patch new file mode 100644 index 00000000000..294e02be0d1 --- /dev/null +++ b/queue-2.6.33/iwlwifi-counting-number-of-tfds-can-be-free-for-4965.patch @@ -0,0 +1,42 @@ +From be6b38bcb175613f239e0b302607db346472c6b6 Mon Sep 17 00:00:00 2001 +From: Wey-Yi Guy +Date: Thu, 18 Mar 2010 09:05:00 -0700 +Subject: iwlwifi: counting number of tfds can be free for 4965 + +From: Wey-Yi Guy + +commit be6b38bcb175613f239e0b302607db346472c6b6 upstream. + +Forget one hunk in 4965 during "iwlwifi: error checking for number of tfds +in queue" patch. + +Reported-by: Shanyu Zhao +Signed-off-by: Wey-Yi Guy +Signed-off-by: Reinette Chatre +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/iwlwifi/iwl-4965.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +--- a/drivers/net/wireless/iwlwifi/iwl-4965.c ++++ b/drivers/net/wireless/iwlwifi/iwl-4965.c +@@ -2034,16 +2034,14 @@ static void iwl4965_rx_reply_tx(struct i + tx_resp->failure_frame); + + freed = iwl_tx_queue_reclaim(priv, txq_id, index); +- if (qc && likely(sta_id != IWL_INVALID_STATION)) +- priv->stations[sta_id].tid[tid].tfds_in_queue -= freed; ++ iwl_free_tfds_in_queue(priv, sta_id, tid, freed); + + if (priv->mac80211_registered && + (iwl_queue_space(&txq->q) > txq->q.low_mark)) + iwl_wake_queue(priv, txq_id); + } + +- if (qc && likely(sta_id != IWL_INVALID_STATION)) +- iwl_txq_check_empty(priv, sta_id, tid, txq_id); ++ iwl_txq_check_empty(priv, sta_id, tid, txq_id); + + if (iwl_check_bits(status, TX_ABORT_REQUIRED_MSK)) + IWL_ERR(priv, "TODO: Implement Tx ABORT REQUIRED!!!\n"); diff --git a/queue-2.6.33/iwlwifi-fix-regulatory.patch b/queue-2.6.33/iwlwifi-fix-regulatory.patch new file mode 100644 index 00000000000..2a39aa109b6 --- /dev/null +++ b/queue-2.6.33/iwlwifi-fix-regulatory.patch @@ -0,0 +1,44 @@ +From f6c8f1523a2de3b84340e45913cbcee8bee74570 Mon Sep 17 00:00:00 2001 +From: Reinette Chatre +Date: Fri, 12 Mar 2010 11:13:26 -0800 +Subject: iwlwifi: fix regulatory + +From: Reinette Chatre + +commit f6c8f1523a2de3b84340e45913cbcee8bee74570 upstream. + +Commit "cfg80211: convert bools into flags" mistakenly modified iwlwifi's +regulatory settings instead of just converting it. Fix this. + +This fixes http://bugzilla.intellinuxwireless.org/show_bug.cgi?id=2172 + +Signed-off-by: Reinette Chatre +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/iwlwifi/iwl-agn.c | 2 +- + drivers/net/wireless/iwlwifi/iwl3945-base.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/net/wireless/iwlwifi/iwl-agn.c ++++ b/drivers/net/wireless/iwlwifi/iwl-agn.c +@@ -2461,7 +2461,7 @@ static int iwl_setup_mac(struct iwl_priv + BIT(NL80211_IFTYPE_STATION) | + BIT(NL80211_IFTYPE_ADHOC); + +- hw->wiphy->flags |= WIPHY_FLAG_STRICT_REGULATORY | ++ hw->wiphy->flags |= WIPHY_FLAG_CUSTOM_REGULATORY | + WIPHY_FLAG_DISABLE_BEACON_HINTS; + + /* +--- a/drivers/net/wireless/iwlwifi/iwl3945-base.c ++++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c +@@ -3903,7 +3903,7 @@ static int iwl3945_setup_mac(struct iwl_ + BIT(NL80211_IFTYPE_STATION) | + BIT(NL80211_IFTYPE_ADHOC); + +- hw->wiphy->flags |= WIPHY_FLAG_STRICT_REGULATORY | ++ hw->wiphy->flags |= WIPHY_FLAG_CUSTOM_REGULATORY | + WIPHY_FLAG_DISABLE_BEACON_HINTS; + + hw->wiphy->max_scan_ssids = PROBE_OPTION_MAX_3945; diff --git a/queue-2.6.33/iwlwifi-range-checking-issue.patch b/queue-2.6.33/iwlwifi-range-checking-issue.patch new file mode 100644 index 00000000000..19003cd4cd2 --- /dev/null +++ b/queue-2.6.33/iwlwifi-range-checking-issue.patch @@ -0,0 +1,38 @@ +From 8e1a53c615e8efe0fac670f2973da64758748a8a Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Sun, 28 Mar 2010 14:55:00 +0300 +Subject: iwlwifi: range checking issue + +From: Dan Carpenter + +commit 8e1a53c615e8efe0fac670f2973da64758748a8a upstream. + +IWL_RATE_COUNT is 13 and IWL_RATE_COUNT_LEGACY is 12. + +IWL_RATE_COUNT_LEGACY is the right one here because iwl3945_rates +doesn't support 60M and also that's how "rates" is defined in +iwlcore_init_geos() from drivers/net/wireless/iwlwifi/iwl-core.c. + + rates = kzalloc((sizeof(struct ieee80211_rate) * IWL_RATE_COUNT_LEGACY), + GFP_KERNEL); + +Signed-off-by: Dan Carpenter +Acked-by: Zhu Yi +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/iwlwifi/iwl3945-base.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/wireless/iwlwifi/iwl3945-base.c ++++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c +@@ -1926,7 +1926,7 @@ static void iwl3945_init_hw_rates(struct + { + int i; + +- for (i = 0; i < IWL_RATE_COUNT; i++) { ++ for (i = 0; i < IWL_RATE_COUNT_LEGACY; i++) { + rates[i].bitrate = iwl3945_rates[i].ieee * 5; + rates[i].hw_value = i; /* Rate scaling will work on indexes */ + rates[i].hw_value_short = i; diff --git a/queue-2.6.33/libiscsi-fix-recovery-slowdown-regression.patch b/queue-2.6.33/libiscsi-fix-recovery-slowdown-regression.patch new file mode 100644 index 00000000000..1a562277fdd --- /dev/null +++ b/queue-2.6.33/libiscsi-fix-recovery-slowdown-regression.patch @@ -0,0 +1,51 @@ +From 4ae0a6c15efcc37e94e3f30e3533bdec03c53126 Mon Sep 17 00:00:00 2001 +From: Mike Christie +Date: Tue, 9 Mar 2010 14:14:51 -0600 +Subject: [SCSI] libiscsi: Fix recovery slowdown regression + +From: Mike Christie + +commit 4ae0a6c15efcc37e94e3f30e3533bdec03c53126 upstream. + +We could be failing/stopping a connection due to libiscsi starting +recovery/cleanup, but the xmit path or scsi eh thread path +could be dropping the connection at the same time. + +As a result the session->state gets set to failed instead of in +recovery. We end up not blocking the session +and so the replacement timeout never gets started and we only end up +failing the IO when scsi_softirq_done sees that the +cmd has been running for (cmd->allowed + 1) * rq->timeout secs. + +We used to fail the IO right away so users are seeing a long +delay when using dm-multipath. This problem was added in +2.6.28. + +Signed-off-by: Mike Christie +Signed-off-by: James Bottomley +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/libiscsi.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/drivers/scsi/libiscsi.c ++++ b/drivers/scsi/libiscsi.c +@@ -3027,14 +3027,15 @@ static void iscsi_start_session_recovery + session->state = ISCSI_STATE_TERMINATE; + else if (conn->stop_stage != STOP_CONN_RECOVER) + session->state = ISCSI_STATE_IN_RECOVERY; ++ ++ old_stop_stage = conn->stop_stage; ++ conn->stop_stage = flag; + spin_unlock_bh(&session->lock); + + del_timer_sync(&conn->transport_timer); + iscsi_suspend_tx(conn); + + spin_lock_bh(&session->lock); +- old_stop_stage = conn->stop_stage; +- conn->stop_stage = flag; + conn->c_stage = ISCSI_CONN_STOPPED; + spin_unlock_bh(&session->lock); + diff --git a/queue-2.6.33/mac80211-fix-preq-processing-and-one-small-bug.patch b/queue-2.6.33/mac80211-fix-preq-processing-and-one-small-bug.patch new file mode 100644 index 00000000000..bd70b2d5ffe --- /dev/null +++ b/queue-2.6.33/mac80211-fix-preq-processing-and-one-small-bug.patch @@ -0,0 +1,43 @@ +From 533866b12cce484994163b1e201778cbac4c04c5 Mon Sep 17 00:00:00 2001 +From: Porsch, Marco +Date: Wed, 24 Feb 2010 09:53:13 +0100 +Subject: mac80211: fix PREQ processing and one small bug + +From: Porsch, Marco + +commit 533866b12cce484994163b1e201778cbac4c04c5 upstream. + +1st) a PREQ should only be processed, if it has the same SN and better +metric (instead of better or equal). +2nd) next_hop[ETH_ALEN] now actually used to buffer +mpath->next_hop->sta.addr for use out of lock. + +Signed-off-by: Marco Porsch +Acked-by: Javier Cardona +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + net/mac80211/mesh_hwmp.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/net/mac80211/mesh_hwmp.c ++++ b/net/mac80211/mesh_hwmp.c +@@ -391,7 +391,7 @@ static u32 hwmp_route_info_get(struct ie + if (SN_GT(mpath->sn, orig_sn) || + (mpath->sn == orig_sn && + action == MPATH_PREQ && +- new_metric > mpath->metric)) { ++ new_metric >= mpath->metric)) { + process = false; + fresh_info = false; + } +@@ -611,7 +611,7 @@ static void hwmp_prep_frame_process(stru + + mesh_path_sel_frame_tx(MPATH_PREP, flags, orig_addr, + cpu_to_le32(orig_sn), 0, target_addr, +- cpu_to_le32(target_sn), mpath->next_hop->sta.addr, hopcount, ++ cpu_to_le32(target_sn), next_hop, hopcount, + ttl, cpu_to_le32(lifetime), cpu_to_le32(metric), + 0, sdata); + rcu_read_unlock(); diff --git a/queue-2.6.33/mac80211-move-netdev-queue-enabling-to-correct-spot.patch b/queue-2.6.33/mac80211-move-netdev-queue-enabling-to-correct-spot.patch new file mode 100644 index 00000000000..9c9036dbb10 --- /dev/null +++ b/queue-2.6.33/mac80211-move-netdev-queue-enabling-to-correct-spot.patch @@ -0,0 +1,76 @@ +From 7236fe29fd72d17074574ba312e7f1bb9d10abaa Mon Sep 17 00:00:00 2001 +From: Johannes Berg +Date: Mon, 22 Mar 2010 13:42:43 -0700 +Subject: mac80211: move netdev queue enabling to correct spot + +From: Johannes Berg + +commit 7236fe29fd72d17074574ba312e7f1bb9d10abaa upstream. + +"mac80211: fix skb buffering issue" still left a race +between enabling the hardware queues and the virtual +interface queues. In hindsight it's totally obvious +that enabling the netdev queues for a hardware queue +when the hardware queue is enabled is wrong, because +it could well possible that we can fill the hw queue +with packets we already have pending. Thus, we must +only enable the netdev queues once all the pending +packets have been processed and sent off to the device. + +In testing, I haven't been able to trigger this race +condition, but it's clearly there, possibly only when +aggregation is being enabled. + +Signed-off-by: Johannes Berg +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + net/mac80211/tx.c | 6 ++++++ + net/mac80211/util.c | 12 ++++++------ + 2 files changed, 12 insertions(+), 6 deletions(-) + +--- a/net/mac80211/tx.c ++++ b/net/mac80211/tx.c +@@ -1945,6 +1945,7 @@ static bool ieee80211_tx_pending_skb(str + void ieee80211_tx_pending(unsigned long data) + { + struct ieee80211_local *local = (struct ieee80211_local *)data; ++ struct ieee80211_sub_if_data *sdata; + unsigned long flags; + int i; + bool txok; +@@ -1983,6 +1984,11 @@ void ieee80211_tx_pending(unsigned long + if (!txok) + break; + } ++ ++ if (skb_queue_empty(&local->pending[i])) ++ list_for_each_entry_rcu(sdata, &local->interfaces, list) ++ netif_tx_wake_queue( ++ netdev_get_tx_queue(sdata->dev, i)); + } + spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags); + +--- a/net/mac80211/util.c ++++ b/net/mac80211/util.c +@@ -280,13 +280,13 @@ static void __ieee80211_wake_queue(struc + /* someone still has this queue stopped */ + return; + +- if (!skb_queue_empty(&local->pending[queue])) ++ if (skb_queue_empty(&local->pending[queue])) { ++ rcu_read_lock(); ++ list_for_each_entry_rcu(sdata, &local->interfaces, list) ++ netif_tx_wake_queue(netdev_get_tx_queue(sdata->dev, queue)); ++ rcu_read_unlock(); ++ } else + tasklet_schedule(&local->tx_pending_tasklet); +- +- rcu_read_lock(); +- list_for_each_entry_rcu(sdata, &local->interfaces, list) +- netif_tx_wake_queue(netdev_get_tx_queue(sdata->dev, queue)); +- rcu_read_unlock(); + } + + void ieee80211_wake_queue_by_reason(struct ieee80211_hw *hw, int queue, diff --git a/queue-2.6.33/mac80211-tear-down-all-agg-queues-when-restart-reconfig-hw.patch b/queue-2.6.33/mac80211-tear-down-all-agg-queues-when-restart-reconfig-hw.patch new file mode 100644 index 00000000000..7b5a95a478b --- /dev/null +++ b/queue-2.6.33/mac80211-tear-down-all-agg-queues-when-restart-reconfig-hw.patch @@ -0,0 +1,44 @@ +From 74e2bd1fa3ae9695af566ad5a7a288898787b909 Mon Sep 17 00:00:00 2001 +From: Wey-Yi Guy +Date: Wed, 3 Feb 2010 09:28:55 -0800 +Subject: mac80211: tear down all agg queues when restart/reconfig hw + +From: Wey-Yi Guy + +commit 74e2bd1fa3ae9695af566ad5a7a288898787b909 upstream. + +When there is a need to restart/reconfig hw, tear down all the +aggregation queues and let the mac80211 and driver get in-sync to have +the opportunity to re-establish the aggregation queues again. + +Need to wait until driver re-establish all the station information before tear +down the aggregation queues, driver(at least iwlwifi driver) will reject the +stop aggregation queue request if station is not ready. But also need to make +sure the aggregation queues are tear down before waking up the queues, so +mac80211 will not sending frames with aggregation bit set. + +Signed-off-by: Wey-Yi Guy +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + net/mac80211/util.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/net/mac80211/util.c ++++ b/net/mac80211/util.c +@@ -1145,6 +1145,14 @@ int ieee80211_reconfig(struct ieee80211_ + } + } + ++ rcu_read_lock(); ++ if (hw->flags & IEEE80211_HW_AMPDU_AGGREGATION) { ++ list_for_each_entry_rcu(sta, &local->sta_list, list) { ++ ieee80211_sta_tear_down_BA_sessions(sta); ++ } ++ } ++ rcu_read_unlock(); ++ + /* add back keys */ + list_for_each_entry(sdata, &local->interfaces, list) + if (netif_running(sdata->dev)) diff --git a/queue-2.6.33/reiserfs-fix-locking-bug-during-mount-failure.patch b/queue-2.6.33/reiserfs-fix-locking-bug-during-mount-failure.patch new file mode 100644 index 00000000000..d62adf684ca --- /dev/null +++ b/queue-2.6.33/reiserfs-fix-locking-bug-during-mount-failure.patch @@ -0,0 +1,65 @@ +From b7b7fa43103a9fb30dbcc60cbd5161fdfc25f904 Mon Sep 17 00:00:00 2001 +From: Jeff Mahoney +Date: Mon, 29 Mar 2010 15:12:39 -0400 +Subject: reiserfs: Fix locking BUG during mount failure + +From: Jeff Mahoney + +commit b7b7fa43103a9fb30dbcc60cbd5161fdfc25f904 upstream. + +Commit 8ebc423238341b52912c7295b045a32477b33f09 (reiserfs: kill-the-BKL) +introduced a bug in the mount failure case. + +The error label releases the lock before calling journal_release_error, +but it requires that the lock be held. do_journal_release unlocks and +retakes it. When it releases it without it held, we trigger a BUG(). + +The error_alloc label skips the unlock since the lock isn't held yet +but none of the other conditions that are clean up exist yet either. + +This patch returns immediately after the kzalloc failure and moves +the reiserfs_write_unlock after the journal_release_error call. + +This was reported in https://bugzilla.novell.com/show_bug.cgi?id=591807 + +Reported-by: Thomas Siedentopf +Signed-off-by: Jeff Mahoney +Cc: Thomas Siedentopf +Cc: Andrew Morton +Signed-off-by: Frederic Weisbecker +Signed-off-by: Greg Kroah-Hartman + +--- + fs/reiserfs/super.c | 10 ++++------ + 1 file changed, 4 insertions(+), 6 deletions(-) + +--- a/fs/reiserfs/super.c ++++ b/fs/reiserfs/super.c +@@ -1619,10 +1619,8 @@ static int reiserfs_fill_super(struct su + save_mount_options(s, data); + + sbi = kzalloc(sizeof(struct reiserfs_sb_info), GFP_KERNEL); +- if (!sbi) { +- errval = -ENOMEM; +- goto error_alloc; +- } ++ if (!sbi) ++ return -ENOMEM; + s->s_fs_info = sbi; + /* Set default values for options: non-aggressive tails, RO on errors */ + REISERFS_SB(s)->s_mount_opt |= (1 << REISERFS_SMALLTAIL); +@@ -1879,12 +1877,12 @@ static int reiserfs_fill_super(struct su + return (0); + + error: +- reiserfs_write_unlock(s); +-error_alloc: + if (jinit_done) { /* kill the commit thread, free journal ram */ + journal_release_error(NULL, s); + } + ++ reiserfs_write_unlock(s); ++ + reiserfs_free_bitmap_cache(s); + if (SB_BUFFER_WITH_SB(s)) + brelse(SB_BUFFER_WITH_SB(s)); diff --git a/queue-2.6.33/series b/queue-2.6.33/series index c059936fec3..48e792390cc 100644 --- a/queue-2.6.33/series +++ b/queue-2.6.33/series @@ -8,4 +8,17 @@ drm-radeon-kms-fix-null-pointer-dereference-if-memory-allocation-failed.patch drm-radeon-kms-don-t-print-error-on-erestartsys.patch drm-radeon-kms-fix-pal-tv-out-support-on-legacy-igp-chips.patch drm-return-enodev-if-the-inode-mapping-changes.patch -drm-radeon-kms-atom-spread-spectrum-fix.patch +sh-fix-fdpic-binary-loader.patch +sh-enable-the-mmu-in-start_secondary.patch +reiserfs-fix-locking-bug-during-mount-failure.patch +libiscsi-fix-recovery-slowdown-regression.patch +x86-kgdb-always-initialize-the-hw-breakpoint-attribute.patch +freezer-fix-buggy-resume-test-for-tasks-frozen-with-cgroup-freezer.patch +iwlwifi-fix-regulatory.patch +iwlwifi-counting-number-of-tfds-can-be-free-for-4965.patch +iwlwifi-range-checking-issue.patch +setup-correct-int-pipe-type-in-ar9170_usb_exec_cmd.patch +mac80211-fix-preq-processing-and-one-small-bug.patch +mac80211-move-netdev-queue-enabling-to-correct-spot.patch +mac80211-tear-down-all-agg-queues-when-restart-reconfig-hw.patch +wireless-convert-reg_regdb_search_lock-to-mutex.patch diff --git a/queue-2.6.33/setup-correct-int-pipe-type-in-ar9170_usb_exec_cmd.patch b/queue-2.6.33/setup-correct-int-pipe-type-in-ar9170_usb_exec_cmd.patch new file mode 100644 index 00000000000..ccb4d13cf17 --- /dev/null +++ b/queue-2.6.33/setup-correct-int-pipe-type-in-ar9170_usb_exec_cmd.patch @@ -0,0 +1,38 @@ +From 2d20c72c021d96f8b9230396c8e3782f204214ec Mon Sep 17 00:00:00 2001 +From: Valentin Longchamp +Date: Fri, 26 Mar 2010 11:44:33 +0100 +Subject: setup correct int pipe type in ar9170_usb_exec_cmd + +From: Valentin Longchamp + +commit 2d20c72c021d96f8b9230396c8e3782f204214ec upstream. + +An int urb is constructed but we fill it in with a bulk pipe type. + +Commit f661c6f8c67bd55e93348f160d590ff9edf08904 implemented a pipe type +check when CONFIG_USB_DEBUG is enabled. The check failed for all the ar9170 +usb transfers and the driver could not configure the wifi dongle. + +This went unnoticed until now because most people don't have +CONFIG_USB_DEBUG enabled. + +Signed-off-by: Valentin Longchamp +Acked-by: Christian Lamparter +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/ath/ar9170/usb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/wireless/ath/ar9170/usb.c ++++ b/drivers/net/wireless/ath/ar9170/usb.c +@@ -414,7 +414,7 @@ static int ar9170_usb_exec_cmd(struct ar + spin_unlock_irqrestore(&aru->common.cmdlock, flags); + + usb_fill_int_urb(urb, aru->udev, +- usb_sndbulkpipe(aru->udev, AR9170_EP_CMD), ++ usb_sndintpipe(aru->udev, AR9170_EP_CMD), + aru->common.cmdbuf, plen + 4, + ar9170_usb_tx_urb_complete, NULL, 1); + diff --git a/queue-2.6.33/sh-enable-the-mmu-in-start_secondary.patch b/queue-2.6.33/sh-enable-the-mmu-in-start_secondary.patch new file mode 100644 index 00000000000..8b153ab85b5 --- /dev/null +++ b/queue-2.6.33/sh-enable-the-mmu-in-start_secondary.patch @@ -0,0 +1,37 @@ +From 4bea3418c737891894b9d3d3e9f8bbd67d66fa38 Mon Sep 17 00:00:00 2001 +From: Matt Fleming +Date: Sun, 28 Mar 2010 20:08:25 +0000 +Subject: sh: Enable the mmu in start_secondary() + +From: Matt Fleming + +commit 4bea3418c737891894b9d3d3e9f8bbd67d66fa38 upstream. + +For the boot, enable_mmu() is called from setup_arch() but we don't call +setup_arch() for any of the other cpus. So turn on the non-boot cpu's +mmu inside of start_secondary(). + +I noticed this bug on an SMP board when trying to map I/O memory +(smsc911x registers) into the kernel address space. Since the Address +Translation bit in MMUCR wasn't set, accessing the virtual address where +the smsc911x registers were supposedly mapped actually performed a +physical address access. + +Signed-off-by: Matt Fleming +Signed-off-by: Paul Mundt +Signed-off-by: Greg Kroah-Hartman + +--- + arch/sh/kernel/smp.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/arch/sh/kernel/smp.c ++++ b/arch/sh/kernel/smp.c +@@ -69,6 +69,7 @@ asmlinkage void __cpuinit start_secondar + unsigned int cpu; + struct mm_struct *mm = &init_mm; + ++ enable_mmu(); + atomic_inc(&mm->mm_count); + atomic_inc(&mm->mm_users); + current->active_mm = mm; diff --git a/queue-2.6.33/sh-fix-fdpic-binary-loader.patch b/queue-2.6.33/sh-fix-fdpic-binary-loader.patch new file mode 100644 index 00000000000..3ce2226a5b1 --- /dev/null +++ b/queue-2.6.33/sh-fix-fdpic-binary-loader.patch @@ -0,0 +1,42 @@ +From d5ab780305bb6d60a7b5a74f18cf84eb6ad153b1 Mon Sep 17 00:00:00 2001 +From: Andrew Stubbs +Date: Mon, 29 Mar 2010 12:04:19 +0900 +Subject: sh: Fix FDPIC binary loader + +From: Andrew Stubbs + +commit d5ab780305bb6d60a7b5a74f18cf84eb6ad153b1 upstream. + +Ensure that the aux table is properly initialized, even when optional +features are missing. Without this, the FDPIC loader did not work. + +Signed-off-by: Andrew Stubbs +Signed-off-by: Paul Mundt +Signed-off-by: Greg Kroah-Hartman + +--- + arch/sh/include/asm/elf.h | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/arch/sh/include/asm/elf.h ++++ b/arch/sh/include/asm/elf.h +@@ -211,7 +211,9 @@ extern void __kernel_vsyscall; + + #define VSYSCALL_AUX_ENT \ + if (vdso_enabled) \ +- NEW_AUX_ENT(AT_SYSINFO_EHDR, VDSO_BASE); ++ NEW_AUX_ENT(AT_SYSINFO_EHDR, VDSO_BASE); \ ++ else \ ++ NEW_AUX_ENT(AT_IGNORE, 0); + #else + #define VSYSCALL_AUX_ENT + #endif /* CONFIG_VSYSCALL */ +@@ -219,7 +221,7 @@ extern void __kernel_vsyscall; + #ifdef CONFIG_SH_FPU + #define FPU_AUX_ENT NEW_AUX_ENT(AT_FPUCW, FPSCR_INIT) + #else +-#define FPU_AUX_ENT ++#define FPU_AUX_ENT NEW_AUX_ENT(AT_IGNORE, 0) + #endif + + extern int l1i_cache_shape, l1d_cache_shape, l2_cache_shape; diff --git a/queue-2.6.33/wireless-convert-reg_regdb_search_lock-to-mutex.patch b/queue-2.6.33/wireless-convert-reg_regdb_search_lock-to-mutex.patch new file mode 100644 index 00000000000..772edcc2455 --- /dev/null +++ b/queue-2.6.33/wireless-convert-reg_regdb_search_lock-to-mutex.patch @@ -0,0 +1,70 @@ +From 368d06f5b0eefcbf37d677d3b65381310a251f03 Mon Sep 17 00:00:00 2001 +From: John W. Linville +Date: Tue, 16 Mar 2010 15:40:59 -0400 +Subject: wireless: convert reg_regdb_search_lock to mutex + +From: John W. Linville + +commit 368d06f5b0eefcbf37d677d3b65381310a251f03 upstream. + +Stanse discovered that kmalloc is being called with GFP_KERNEL while +holding this spinlock. The spinlock can be a mutex instead, which also +enables the removal of the unlock/lock around the lock/unlock of +cfg80211_mutex and the call to set_regdom. + +Reported-by: Jiri Slaby +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- a/net/wireless/reg.c ++++ b/net/wireless/reg.c +@@ -324,7 +324,7 @@ struct reg_regdb_search_request { + }; + + static LIST_HEAD(reg_regdb_search_list); +-static DEFINE_SPINLOCK(reg_regdb_search_lock); ++static DEFINE_MUTEX(reg_regdb_search_mutex); + + static void reg_regdb_search(struct work_struct *work) + { +@@ -332,7 +332,7 @@ static void reg_regdb_search(struct work_struct *work) + const struct ieee80211_regdomain *curdom, *regdom; + int i, r; + +- spin_lock(®_regdb_search_lock); ++ mutex_lock(®_regdb_search_mutex); + while (!list_empty(®_regdb_search_list)) { + request = list_first_entry(®_regdb_search_list, + struct reg_regdb_search_request, +@@ -346,18 +346,16 @@ static void reg_regdb_search(struct work_struct *work) + r = reg_copy_regd(®dom, curdom); + if (r) + break; +- spin_unlock(®_regdb_search_lock); + mutex_lock(&cfg80211_mutex); + set_regdom(regdom); + mutex_unlock(&cfg80211_mutex); +- spin_lock(®_regdb_search_lock); + break; + } + } + + kfree(request); + } +- spin_unlock(®_regdb_search_lock); ++ mutex_unlock(®_regdb_search_mutex); + } + + static DECLARE_WORK(reg_regdb_work, reg_regdb_search); +@@ -375,9 +373,9 @@ static void reg_regdb_query(const char *alpha2) + + memcpy(request->alpha2, alpha2, 2); + +- spin_lock(®_regdb_search_lock); ++ mutex_lock(®_regdb_search_mutex); + list_add_tail(&request->list, ®_regdb_search_list); +- spin_unlock(®_regdb_search_lock); ++ mutex_unlock(®_regdb_search_mutex); + + schedule_work(®_regdb_work); + } diff --git a/queue-2.6.33/x86-kgdb-always-initialize-the-hw-breakpoint-attribute.patch b/queue-2.6.33/x86-kgdb-always-initialize-the-hw-breakpoint-attribute.patch new file mode 100644 index 00000000000..0bbcb177859 --- /dev/null +++ b/queue-2.6.33/x86-kgdb-always-initialize-the-hw-breakpoint-attribute.patch @@ -0,0 +1,35 @@ +From ab310b5edb8b601bcb02491ed6f7676da4fd1757 Mon Sep 17 00:00:00 2001 +From: Jason Wessel +Date: Tue, 30 Mar 2010 14:05:07 -0500 +Subject: x86,kgdb: Always initialize the hw breakpoint attribute + +From: Jason Wessel + +commit ab310b5edb8b601bcb02491ed6f7676da4fd1757 upstream. + +It is required to call hw_breakpoint_init() on an attr before using it +in any other calls. This fixes the problem where kgdb will sometimes +fail to initialize on x86_64. + +Signed-off-by: Jason Wessel +Cc: Ingo Molnar +LKML-Reference: <1269975907-27602-1-git-send-email-jason.wessel@windriver.com> +Signed-off-by: Frederic Weisbecker +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/kgdb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/x86/kernel/kgdb.c ++++ b/arch/x86/kernel/kgdb.c +@@ -618,8 +618,8 @@ int kgdb_arch_init(void) + * portion of kgdb because this operation requires mutexs to + * complete. + */ ++ hw_breakpoint_init(&attr); + attr.bp_addr = (unsigned long)kgdb_arch_init; +- attr.type = PERF_TYPE_BREAKPOINT; + attr.bp_len = HW_BREAKPOINT_LEN_1; + attr.bp_type = HW_BREAKPOINT_W; + attr.disabled = 1;