From: Greg Kroah-Hartman Date: Fri, 2 Dec 2011 22:58:27 +0000 (-0800) Subject: 3.0 patches X-Git-Tag: v3.0.13~16 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=b70e84572d2be87a4a5af7dd47725ea5d27aede6;p=thirdparty%2Fkernel%2Fstable-queue.git 3.0 patches added patches: cfg80211-fix-regulatory-null-dereference.patch cgroup_freezer-fix-freezing-groups-with-stopped-tasks.patch genirq-fix-regression-in-irqfixup-irqpoll.patch hrtimer-fix-extra-wakeups-from-__remove_hrtimer.patch mac80211-don-t-stop-a-single-aggregation-session-twice.patch mac80211-fix-race-between-the-agg-sm-and-the-tx-data-path.patch nl80211-fix-mac-address-validation.patch p54spi-add-missing-spin_lock_init.patch p54spi-fix-workqueue-deadlock.patch rt2800pci-handle-spurious-interrupts.patch rt2x00-fix-efuse-eeprom-reading-on-ppc32.patch rt2x00-handle-spurious-pci-interrupts.patch sunrpc-ensure-we-return-eagain-in-xs_nospace-if-congestion-is-cleared.patch timekeeping-add-arch_offset-hook-to-ktime_get-functions.patch --- diff --git a/queue-3.0/cfg80211-fix-regulatory-null-dereference.patch b/queue-3.0/cfg80211-fix-regulatory-null-dereference.patch new file mode 100644 index 00000000000..003d2a5c7f3 --- /dev/null +++ b/queue-3.0/cfg80211-fix-regulatory-null-dereference.patch @@ -0,0 +1,37 @@ +From de3584bd62d87b4c250129fbc46ca52c80330add Mon Sep 17 00:00:00 2001 +From: Johannes Berg +Date: Mon, 21 Nov 2011 10:44:00 +0100 +Subject: cfg80211: fix regulatory NULL dereference + +From: Johannes Berg + +commit de3584bd62d87b4c250129fbc46ca52c80330add upstream. + +By the time userspace returns with a response to +the regulatory domain request, the wiphy causing +the request might have gone away. If this is so, +reject the update but mark the request as having +been processed anyway. + +Cc: Luis R. Rodriguez +Signed-off-by: Johannes Berg +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + net/wireless/reg.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/net/wireless/reg.c ++++ b/net/wireless/reg.c +@@ -2026,6 +2026,10 @@ static int __set_regdom(const struct iee + } + + request_wiphy = wiphy_idx_to_wiphy(last_request->wiphy_idx); ++ if (!request_wiphy) { ++ reg_set_request_processed(); ++ return -ENODEV; ++ } + + if (!last_request->intersect) { + int r; diff --git a/queue-3.0/cgroup_freezer-fix-freezing-groups-with-stopped-tasks.patch b/queue-3.0/cgroup_freezer-fix-freezing-groups-with-stopped-tasks.patch new file mode 100644 index 00000000000..a7e038c690e --- /dev/null +++ b/queue-3.0/cgroup_freezer-fix-freezing-groups-with-stopped-tasks.patch @@ -0,0 +1,84 @@ +From 884a45d964dd395eda945842afff5e16bcaedf56 Mon Sep 17 00:00:00 2001 +From: Michal Hocko +Date: Tue, 22 Nov 2011 07:44:47 -0800 +Subject: cgroup_freezer: fix freezing groups with stopped tasks + +From: Michal Hocko + +commit 884a45d964dd395eda945842afff5e16bcaedf56 upstream. + +2d3cbf8b (cgroup_freezer: update_freezer_state() does incorrect state +transitions) removed is_task_frozen_enough and replaced it with a simple +frozen call. This, however, breaks freezing for a group with stopped tasks +because those cannot be frozen and so the group remains in CGROUP_FREEZING +state (update_if_frozen doesn't count stopped tasks) and never reaches +CGROUP_FROZEN. + +Let's add is_task_frozen_enough back and use it at the original locations +(update_if_frozen and try_to_freeze_cgroup). Semantically we consider +stopped tasks as frozen enough so we should consider both cases when +testing frozen tasks. + +Testcase: +mkdir /dev/freezer +mount -t cgroup -o freezer none /dev/freezer +mkdir /dev/freezer/foo +sleep 1h & +pid=$! +kill -STOP $pid +echo $pid > /dev/freezer/foo/tasks +echo FROZEN > /dev/freezer/foo/freezer.state +while true +do + cat /dev/freezer/foo/freezer.state + [ "`cat /dev/freezer/foo/freezer.state`" = "FROZEN" ] && break + sleep 1 +done +echo OK + +Signed-off-by: Michal Hocko +Acked-by: Li Zefan +Cc: Tomasz Buchert +Cc: Paul Menage +Cc: Andrew Morton +Signed-off-by: Tejun Heo +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/cgroup_freezer.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +--- a/kernel/cgroup_freezer.c ++++ b/kernel/cgroup_freezer.c +@@ -153,6 +153,13 @@ static void freezer_destroy(struct cgrou + kfree(cgroup_freezer(cgroup)); + } + ++/* task is frozen or will freeze immediately when next it gets woken */ ++static bool is_task_frozen_enough(struct task_struct *task) ++{ ++ return frozen(task) || ++ (task_is_stopped_or_traced(task) && freezing(task)); ++} ++ + /* + * The call to cgroup_lock() in the freezer.state write method prevents + * a write to that file racing against an attach, and hence the +@@ -231,7 +238,7 @@ static void update_if_frozen(struct cgro + cgroup_iter_start(cgroup, &it); + while ((task = cgroup_iter_next(cgroup, &it))) { + ntotal++; +- if (frozen(task)) ++ if (is_task_frozen_enough(task)) + nfrozen++; + } + +@@ -284,7 +291,7 @@ static int try_to_freeze_cgroup(struct c + while ((task = cgroup_iter_next(cgroup, &it))) { + if (!freeze_task(task, true)) + continue; +- if (frozen(task)) ++ if (is_task_frozen_enough(task)) + continue; + if (!freezing(task) && !freezer_should_skip(task)) + num_cant_freeze_now++; diff --git a/queue-3.0/genirq-fix-regression-in-irqfixup-irqpoll.patch b/queue-3.0/genirq-fix-regression-in-irqfixup-irqpoll.patch new file mode 100644 index 00000000000..305318f5bd9 --- /dev/null +++ b/queue-3.0/genirq-fix-regression-in-irqfixup-irqpoll.patch @@ -0,0 +1,47 @@ +From 52553ddffad76ccf192d4dd9ce88d5818f57f62a Mon Sep 17 00:00:00 2001 +From: Edward Donovan +Date: Sun, 27 Nov 2011 23:07:34 -0500 +Subject: genirq: fix regression in irqfixup, irqpoll +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Edward Donovan + +commit 52553ddffad76ccf192d4dd9ce88d5818f57f62a upstream. + +Commit fa27271bc8d2("genirq: Fixup poll handling") introduced a +regression that broke irqfixup/irqpoll for some hardware configurations. + +Amidst reorganizing 'try_one_irq', that patch removed a test that +checked for 'action->handler' returning IRQ_HANDLED, before acting on +the interrupt. Restoring this test back returns the functionality lost +since 2.6.39. In the current set of tests, after 'action' is set, it +must precede '!action->next' to take effect. + +With this and my previous patch to irq/spurious.c, c75d720fca8a, all +IRQ regressions that I have encountered are fixed. + +Signed-off-by: Edward Donovan +Reported-and-tested-by: Rogério Brito +Cc: Thomas Gleixner +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/irq/spurious.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/kernel/irq/spurious.c ++++ b/kernel/irq/spurious.c +@@ -84,7 +84,9 @@ static int try_one_irq(int irq, struct i + */ + action = desc->action; + if (!action || !(action->flags & IRQF_SHARED) || +- (action->flags & __IRQF_TIMER) || !action->next) ++ (action->flags & __IRQF_TIMER) || ++ (action->handler(irq, action->dev_id) == IRQ_HANDLED) || ++ !action->next) + goto out; + + /* Already running on another processor */ diff --git a/queue-3.0/hrtimer-fix-extra-wakeups-from-__remove_hrtimer.patch b/queue-3.0/hrtimer-fix-extra-wakeups-from-__remove_hrtimer.patch new file mode 100644 index 00000000000..067c076f002 --- /dev/null +++ b/queue-3.0/hrtimer-fix-extra-wakeups-from-__remove_hrtimer.patch @@ -0,0 +1,62 @@ +From 27c9cd7e601632b3794e1c3344d37b86917ffb43 Mon Sep 17 00:00:00 2001 +From: Jeff Ohlstein +Date: Fri, 18 Nov 2011 15:47:10 -0800 +Subject: hrtimer: Fix extra wakeups from __remove_hrtimer() + +From: Jeff Ohlstein + +commit 27c9cd7e601632b3794e1c3344d37b86917ffb43 upstream. + +__remove_hrtimer() attempts to reprogram the clockevent device when +the timer being removed is the next to expire. However, +__remove_hrtimer() reprograms the clockevent *before* removing the +timer from the timerqueue and thus when hrtimer_force_reprogram() +finds the next timer to expire it finds the timer we're trying to +remove. + +This is especially noticeable when the system switches to NOHz mode +and the system tick is removed. The timer tick is removed from the +system but the clockevent is programmed to wakeup in another HZ +anyway. + +Silence the extra wakeup by removing the timer from the timerqueue +before calling hrtimer_force_reprogram() so that we actually program +the clockevent for the next timer to expire. + +This was broken by 998adc3 "hrtimers: Convert hrtimers to use +timerlist infrastructure". + +Signed-off-by: Jeff Ohlstein +Link: http://lkml.kernel.org/r/1321660030-8520-1-git-send-email-johlstei@codeaurora.org +Signed-off-by: Thomas Gleixner +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/hrtimer.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/kernel/hrtimer.c ++++ b/kernel/hrtimer.c +@@ -885,10 +885,13 @@ static void __remove_hrtimer(struct hrti + struct hrtimer_clock_base *base, + unsigned long newstate, int reprogram) + { ++ struct timerqueue_node *next_timer; + if (!(timer->state & HRTIMER_STATE_ENQUEUED)) + goto out; + +- if (&timer->node == timerqueue_getnext(&base->active)) { ++ next_timer = timerqueue_getnext(&base->active); ++ timerqueue_del(&base->active, &timer->node); ++ if (&timer->node == next_timer) { + #ifdef CONFIG_HIGH_RES_TIMERS + /* Reprogram the clock event device. if enabled */ + if (reprogram && hrtimer_hres_active()) { +@@ -901,7 +904,6 @@ static void __remove_hrtimer(struct hrti + } + #endif + } +- timerqueue_del(&base->active, &timer->node); + if (!timerqueue_getnext(&base->active)) + base->cpu_base->active_bases &= ~(1 << base->index); + out: diff --git a/queue-3.0/mac80211-don-t-stop-a-single-aggregation-session-twice.patch b/queue-3.0/mac80211-don-t-stop-a-single-aggregation-session-twice.patch new file mode 100644 index 00000000000..524d7660c4c --- /dev/null +++ b/queue-3.0/mac80211-don-t-stop-a-single-aggregation-session-twice.patch @@ -0,0 +1,59 @@ +From 24f50a9d165745fd0701c6e089d35f58a229ea69 Mon Sep 17 00:00:00 2001 +From: Johannes Berg +Date: Thu, 24 Nov 2011 20:06:14 +0100 +Subject: mac80211: don't stop a single aggregation session twice + +From: Johannes Berg + +commit 24f50a9d165745fd0701c6e089d35f58a229ea69 upstream. + +Nikolay noticed (by code review) that mac80211 can +attempt to stop an aggregation session while it is +already being stopped. So to fix it, check whether +stop is already being done and bail out if so. + +Also move setting the STOPPING state into the lock +so things are properly atomic. + +Reported-by: Nikolay Martynov +Signed-off-by: Johannes Berg +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + net/mac80211/agg-tx.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +--- a/net/mac80211/agg-tx.c ++++ b/net/mac80211/agg-tx.c +@@ -162,6 +162,12 @@ int ___ieee80211_stop_tx_ba_session(stru + return -ENOENT; + } + ++ /* if we're already stopping ignore any new requests to stop */ ++ if (test_bit(HT_AGG_STATE_STOPPING, &tid_tx->state)) { ++ spin_unlock_bh(&sta->lock); ++ return -EALREADY; ++ } ++ + if (test_bit(HT_AGG_STATE_WANT_START, &tid_tx->state)) { + /* not even started yet! */ + ieee80211_assign_tid_tx(sta, tid, NULL); +@@ -170,6 +176,8 @@ int ___ieee80211_stop_tx_ba_session(stru + return 0; + } + ++ set_bit(HT_AGG_STATE_STOPPING, &tid_tx->state); ++ + spin_unlock_bh(&sta->lock); + + #ifdef CONFIG_MAC80211_HT_DEBUG +@@ -177,8 +185,6 @@ int ___ieee80211_stop_tx_ba_session(stru + sta->sta.addr, tid); + #endif /* CONFIG_MAC80211_HT_DEBUG */ + +- set_bit(HT_AGG_STATE_STOPPING, &tid_tx->state); +- + del_timer_sync(&tid_tx->addba_resp_timer); + + /* diff --git a/queue-3.0/mac80211-fix-race-between-the-agg-sm-and-the-tx-data-path.patch b/queue-3.0/mac80211-fix-race-between-the-agg-sm-and-the-tx-data-path.patch new file mode 100644 index 00000000000..c93afd4d68d --- /dev/null +++ b/queue-3.0/mac80211-fix-race-between-the-agg-sm-and-the-tx-data-path.patch @@ -0,0 +1,72 @@ +From 2a1e0fd175dcfd72096ba9291d31e3b1b5342e60 Mon Sep 17 00:00:00 2001 +From: Emmanuel Grumbach +Date: Sun, 27 Nov 2011 15:29:44 +0200 +Subject: mac80211: fix race between the AGG SM and the Tx data path + +From: Emmanuel Grumbach + +commit 2a1e0fd175dcfd72096ba9291d31e3b1b5342e60 upstream. + +When a packet is supposed to sent be as an a-MPDU, mac80211 sets +IEEE80211_TX_CTL_AMPDU to let the driver know. On the other +hand, mac80211 configures the driver for aggregration with the +ampdu_action callback. +There is race between these two mechanisms since the following +scenario can occur when the BA agreement is torn down: + +Tx softIRQ drv configuration +========== ================= + +check OPERATIONAL bit +Set the TX_CTL_AMPDU bit in the packet + + clear OPERATIONAL bit + stop Tx AGG +Pass Tx packet to the driver. + +In that case the driver would get a packet with TX_CTL_AMPDU set +although it has already been notified that the BA session has been +torn down. + +To fix this, we need to synchronize all the Qdisc activity after we +cleared the OPERATIONAL bit. After that step, all the following +packets will be buffered until the driver reports it is ready to get +new packets for this RA / TID. This buffering allows not to run into +another race that would send packets with TX_CTL_AMPDU unset while +the driver hasn't been requested to tear down the BA session yet. + +This race occurs in practice and iwlwifi complains with a WARN_ON +when it happens. + +Signed-off-by: Emmanuel Grumbach +Reviewed-by: Johannes Berg +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + net/mac80211/agg-tx.c | 14 ++++++++++++++ + 1 file changed, 14 insertions(+) + +--- a/net/mac80211/agg-tx.c ++++ b/net/mac80211/agg-tx.c +@@ -194,6 +194,20 @@ int ___ieee80211_stop_tx_ba_session(stru + */ + clear_bit(HT_AGG_STATE_OPERATIONAL, &tid_tx->state); + ++ /* ++ * There might be a few packets being processed right now (on ++ * another CPU) that have already gotten past the aggregation ++ * check when it was still OPERATIONAL and consequently have ++ * IEEE80211_TX_CTL_AMPDU set. In that case, this code might ++ * call into the driver at the same time or even before the ++ * TX paths calls into it, which could confuse the driver. ++ * ++ * Wait for all currently running TX paths to finish before ++ * telling the driver. New packets will not go through since ++ * the aggregation session is no longer OPERATIONAL. ++ */ ++ synchronize_net(); ++ + tid_tx->stop_initiator = initiator; + tid_tx->tx_stop = tx; + diff --git a/queue-3.0/nl80211-fix-mac-address-validation.patch b/queue-3.0/nl80211-fix-mac-address-validation.patch new file mode 100644 index 00000000000..fcdb106c60c --- /dev/null +++ b/queue-3.0/nl80211-fix-mac-address-validation.patch @@ -0,0 +1,34 @@ +From e007b857e88097c96c45620bf3b04a4e309053d1 Mon Sep 17 00:00:00 2001 +From: Eliad Peller +Date: Thu, 24 Nov 2011 18:13:56 +0200 +Subject: nl80211: fix MAC address validation + +From: Eliad Peller + +commit e007b857e88097c96c45620bf3b04a4e309053d1 upstream. + +MAC addresses have a fixed length. The current +policy allows passing < ETH_ALEN bytes, which +might result in reading beyond the buffer. + +Signed-off-by: Eliad Peller +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + net/wireless/nl80211.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/net/wireless/nl80211.c ++++ b/net/wireless/nl80211.c +@@ -83,8 +83,8 @@ static const struct nla_policy nl80211_p + [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 }, + [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 }, + +- [NL80211_ATTR_MAC] = { .type = NLA_BINARY, .len = ETH_ALEN }, +- [NL80211_ATTR_PREV_BSSID] = { .type = NLA_BINARY, .len = ETH_ALEN }, ++ [NL80211_ATTR_MAC] = { .len = ETH_ALEN }, ++ [NL80211_ATTR_PREV_BSSID] = { .len = ETH_ALEN }, + + [NL80211_ATTR_KEY] = { .type = NLA_NESTED, }, + [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY, diff --git a/queue-3.0/p54spi-add-missing-spin_lock_init.patch b/queue-3.0/p54spi-add-missing-spin_lock_init.patch new file mode 100644 index 00000000000..c08b10d4906 --- /dev/null +++ b/queue-3.0/p54spi-add-missing-spin_lock_init.patch @@ -0,0 +1,30 @@ +From 32d3a3922d617a5a685a5e2d24b20d0e88f192a9 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Michael=20B=C3=BCsch?= +Date: Wed, 16 Nov 2011 23:48:31 +0100 +Subject: p54spi: Add missing spin_lock_init + +From: =?UTF-8?q?Michael=20B=C3=BCsch?= + +commit 32d3a3922d617a5a685a5e2d24b20d0e88f192a9 upstream. + +The tx_lock is not initialized properly. Add spin_lock_init(). + +Signed-off-by: Michael Buesch +Acked-by: Christian Lamparter +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/p54/p54spi.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/wireless/p54/p54spi.c ++++ b/drivers/net/wireless/p54/p54spi.c +@@ -657,6 +657,7 @@ static int __devinit p54spi_probe(struct + init_completion(&priv->fw_comp); + INIT_LIST_HEAD(&priv->tx_pending); + mutex_init(&priv->mutex); ++ spin_lock_init(&priv->tx_lock); + SET_IEEE80211_DEV(hw, &spi->dev); + priv->common.open = p54spi_op_start; + priv->common.stop = p54spi_op_stop; diff --git a/queue-3.0/p54spi-fix-workqueue-deadlock.patch b/queue-3.0/p54spi-fix-workqueue-deadlock.patch new file mode 100644 index 00000000000..6027c2404bc --- /dev/null +++ b/queue-3.0/p54spi-fix-workqueue-deadlock.patch @@ -0,0 +1,44 @@ +From 2d1618170eb493d18f66f2ac03775409a6fb97c6 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Michael=20B=C3=BCsch?= +Date: Wed, 16 Nov 2011 23:55:46 +0100 +Subject: p54spi: Fix workqueue deadlock + +From: =?UTF-8?q?Michael=20B=C3=BCsch?= + +commit 2d1618170eb493d18f66f2ac03775409a6fb97c6 upstream. + +priv->work must not be synced while priv->mutex is locked, because +the mutex is taken in the work handler. +Move cancel_work_sync down to after the device shutdown code. +This is safe, because the work handler checks fw_state and bails out +early in case of a race. + +Signed-off-by: Michael Buesch +Acked-by: Christian Lamparter +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/p54/p54spi.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/net/wireless/p54/p54spi.c ++++ b/drivers/net/wireless/p54/p54spi.c +@@ -589,8 +589,6 @@ static void p54spi_op_stop(struct ieee80 + + WARN_ON(priv->fw_state != FW_STATE_READY); + +- cancel_work_sync(&priv->work); +- + p54spi_power_off(priv); + spin_lock_irqsave(&priv->tx_lock, flags); + INIT_LIST_HEAD(&priv->tx_pending); +@@ -598,6 +596,8 @@ static void p54spi_op_stop(struct ieee80 + + priv->fw_state = FW_STATE_OFF; + mutex_unlock(&priv->mutex); ++ ++ cancel_work_sync(&priv->work); + } + + static int __devinit p54spi_probe(struct spi_device *spi) diff --git a/queue-3.0/rt2800pci-handle-spurious-interrupts.patch b/queue-3.0/rt2800pci-handle-spurious-interrupts.patch new file mode 100644 index 00000000000..8fb7457cb71 --- /dev/null +++ b/queue-3.0/rt2800pci-handle-spurious-interrupts.patch @@ -0,0 +1,62 @@ +From 4ba7d9997869d25bd223dea7536fc1ce9fab3b3b Mon Sep 17 00:00:00 2001 +From: Stanislaw Gruszka +Date: Wed, 16 Nov 2011 11:09:17 +0100 +Subject: rt2800pci: handle spurious interrupts + +From: Stanislaw Gruszka + +commit 4ba7d9997869d25bd223dea7536fc1ce9fab3b3b upstream. + +Some devices may generate spurious interrupts, we have to handle them +otherwise interrupt line will be disabled with below message and driver +will not work: + +[ 2052.114334] irq 17: nobody cared (try booting with the "irqpoll" option) +[ 2052.114339] Pid: 0, comm: swapper Tainted: P 2.6.35.6-48.fc14.x86_64 #1 +[ 2052.114341] Call Trace: +[ 2052.114342] [] __report_bad_irq.clone.1+0x3d/0x8b +[ 2052.114349] [] note_interrupt+0x11a/0x17f +[ 2052.114352] [] handle_fasteoi_irq+0xa8/0xce +[ 2052.114355] [] handle_irq+0x88/0x90 +[ 2052.114357] [] do_IRQ+0x5c/0xb4 +[ 2052.114360] [] ret_from_intr+0x0/0x11 +[ 2052.114361] [] ? native_safe_halt+0xb/0xd +[ 2052.114366] [] ? need_resched+0x23/0x2d +[ 2052.114367] [] default_idle+0x34/0x4f +[ 2052.114370] [] cpu_idle+0xaa/0xcc +[ 2052.114373] [] start_secondary+0x24d/0x28e +[ 2052.114374] handlers: +[ 2052.114375] [] (usb_hcd_irq+0x0/0x7c) +[ 2052.114378] [] (rt2800pci_interrupt+0x0/0x18d [rt2800pci]) +[ 2052.114384] Disabling IRQ #17 + +Resolve: +https://bugzilla.redhat.com/show_bug.cgi?id=658451 + +Reported-and-tested-by: Amir Hedayaty +Signed-off-by: Stanislaw Gruszka +Acked-by: Ivo van Doorn +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/rt2x00/rt2800pci.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/drivers/net/wireless/rt2x00/rt2800pci.c ++++ b/drivers/net/wireless/rt2x00/rt2800pci.c +@@ -886,8 +886,13 @@ static irqreturn_t rt2800pci_interrupt(i + rt2x00pci_register_read(rt2x00dev, INT_SOURCE_CSR, ®); + rt2x00pci_register_write(rt2x00dev, INT_SOURCE_CSR, reg); + ++ /* ++ * Some devices can generate interrupts with empty CSR register, we ++ * "handle" such irq's to prevent interrupt controller treat them as ++ * spurious interrupts and disable irq line. ++ */ + if (!reg) +- return IRQ_NONE; ++ return IRQ_HANDLED; + + if (!test_bit(DEVICE_STATE_ENABLED_RADIO, &rt2x00dev->flags)) + return IRQ_HANDLED; diff --git a/queue-3.0/rt2x00-fix-efuse-eeprom-reading-on-ppc32.patch b/queue-3.0/rt2x00-fix-efuse-eeprom-reading-on-ppc32.patch new file mode 100644 index 00000000000..c44896bc03d --- /dev/null +++ b/queue-3.0/rt2x00-fix-efuse-eeprom-reading-on-ppc32.patch @@ -0,0 +1,34 @@ +From 68fa64ef606bcee688fce46d07aa68f175070156 Mon Sep 17 00:00:00 2001 +From: Gertjan van Wingerde +Date: Wed, 16 Nov 2011 23:16:15 +0100 +Subject: rt2x00: Fix efuse EEPROM reading on PPC32. + +From: Gertjan van Wingerde + +commit 68fa64ef606bcee688fce46d07aa68f175070156 upstream. + +Fix __le32 to __le16 conversion of the first word of an 8-word block +of EEPROM read via the efuse method. + +Reported-and-tested-by: Ingvar Hagelund +Signed-off-by: Gertjan van Wingerde +Acked-by: Helmut Schaa +Acked-by: Ivo van Doorn +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/rt2x00/rt2800lib.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/wireless/rt2x00/rt2800lib.c ++++ b/drivers/net/wireless/rt2x00/rt2800lib.c +@@ -3514,7 +3514,7 @@ static void rt2800_efuse_read(struct rt2 + /* Apparently the data is read from end to start */ + rt2800_register_read_lock(rt2x00dev, EFUSE_DATA3, ®); + /* The returned value is in CPU order, but eeprom is le */ +- rt2x00dev->eeprom[i] = cpu_to_le32(reg); ++ *(u32 *)&rt2x00dev->eeprom[i] = cpu_to_le32(reg); + rt2800_register_read_lock(rt2x00dev, EFUSE_DATA2, ®); + *(u32 *)&rt2x00dev->eeprom[i + 2] = cpu_to_le32(reg); + rt2800_register_read_lock(rt2x00dev, EFUSE_DATA1, ®); diff --git a/queue-3.0/rt2x00-handle-spurious-pci-interrupts.patch b/queue-3.0/rt2x00-handle-spurious-pci-interrupts.patch new file mode 100644 index 00000000000..da7077ee151 --- /dev/null +++ b/queue-3.0/rt2x00-handle-spurious-pci-interrupts.patch @@ -0,0 +1,62 @@ +From 23085d5796561625db4143a671f1de081f66ef08 Mon Sep 17 00:00:00 2001 +From: Stanislaw Gruszka +Date: Wed, 16 Nov 2011 13:58:42 +0100 +Subject: rt2x00: handle spurious pci interrupts + +From: Stanislaw Gruszka + +commit 23085d5796561625db4143a671f1de081f66ef08 upstream. + +We have documented case of very bad performance issue on rt2800pci +device, because it generate spurious interrupt, what cause irq line +is disabled: https://bugzilla.redhat.com/show_bug.cgi?id=658451 + +We already address that problem in separate patch by returning +IRQ_HANDLED from interrupt handler. We think similar fix is needed for +other rt2x00 PCI devices, because users report performance problems on +these devices too. + +Signed-off-by: Stanislaw Gruszka +Acked-by: Ivo van Doorn +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/rt2x00/rt2400pci.c | 2 +- + drivers/net/wireless/rt2x00/rt2500pci.c | 2 +- + drivers/net/wireless/rt2x00/rt61pci.c | 2 +- + 3 files changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/net/wireless/rt2x00/rt2400pci.c ++++ b/drivers/net/wireless/rt2x00/rt2400pci.c +@@ -1387,7 +1387,7 @@ static irqreturn_t rt2400pci_interrupt(i + rt2x00pci_register_write(rt2x00dev, CSR7, reg); + + if (!reg) +- return IRQ_NONE; ++ return IRQ_HANDLED; + + if (!test_bit(DEVICE_STATE_ENABLED_RADIO, &rt2x00dev->flags)) + return IRQ_HANDLED; +--- a/drivers/net/wireless/rt2x00/rt2500pci.c ++++ b/drivers/net/wireless/rt2x00/rt2500pci.c +@@ -1519,7 +1519,7 @@ static irqreturn_t rt2500pci_interrupt(i + rt2x00pci_register_write(rt2x00dev, CSR7, reg); + + if (!reg) +- return IRQ_NONE; ++ return IRQ_HANDLED; + + if (!test_bit(DEVICE_STATE_ENABLED_RADIO, &rt2x00dev->flags)) + return IRQ_HANDLED; +--- a/drivers/net/wireless/rt2x00/rt61pci.c ++++ b/drivers/net/wireless/rt2x00/rt61pci.c +@@ -2345,7 +2345,7 @@ static irqreturn_t rt61pci_interrupt(int + rt2x00pci_register_write(rt2x00dev, INT_SOURCE_CSR, reg); + + if (!reg && !reg_mcu) +- return IRQ_NONE; ++ return IRQ_HANDLED; + + if (!test_bit(DEVICE_STATE_ENABLED_RADIO, &rt2x00dev->flags)) + return IRQ_HANDLED; diff --git a/queue-3.0/series b/queue-3.0/series index 6cd6b1a81d8..9c551e962b4 100644 --- a/queue-3.0/series +++ b/queue-3.0/series @@ -21,3 +21,17 @@ alsa-lx6464es-fix-device-communication-via-command-bus.patch asoc-fsl_ssi-properly-initialize-the-sysfs-attribute-object.patch asoc-wm8753-skip-noop-reconfiguration-of-dai-mode.patch asoc-ensure-wm8731-register-cache-is-synced-when-resuming-from-disabled.patch +sunrpc-ensure-we-return-eagain-in-xs_nospace-if-congestion-is-cleared.patch +genirq-fix-regression-in-irqfixup-irqpoll.patch +cgroup_freezer-fix-freezing-groups-with-stopped-tasks.patch +timekeeping-add-arch_offset-hook-to-ktime_get-functions.patch +hrtimer-fix-extra-wakeups-from-__remove_hrtimer.patch +p54spi-add-missing-spin_lock_init.patch +p54spi-fix-workqueue-deadlock.patch +rt2800pci-handle-spurious-interrupts.patch +rt2x00-handle-spurious-pci-interrupts.patch +rt2x00-fix-efuse-eeprom-reading-on-ppc32.patch +nl80211-fix-mac-address-validation.patch +cfg80211-fix-regulatory-null-dereference.patch +mac80211-don-t-stop-a-single-aggregation-session-twice.patch +mac80211-fix-race-between-the-agg-sm-and-the-tx-data-path.patch diff --git a/queue-3.0/sunrpc-ensure-we-return-eagain-in-xs_nospace-if-congestion-is-cleared.patch b/queue-3.0/sunrpc-ensure-we-return-eagain-in-xs_nospace-if-congestion-is-cleared.patch new file mode 100644 index 00000000000..933b78337c4 --- /dev/null +++ b/queue-3.0/sunrpc-ensure-we-return-eagain-in-xs_nospace-if-congestion-is-cleared.patch @@ -0,0 +1,46 @@ +From 24ca9a847791fd53d9b217330b15f3c285827a18 Mon Sep 17 00:00:00 2001 +From: Trond Myklebust +Date: Tue, 22 Nov 2011 14:44:28 +0200 +Subject: SUNRPC: Ensure we return EAGAIN in xs_nospace if congestion is cleared + +From: Trond Myklebust + +commit 24ca9a847791fd53d9b217330b15f3c285827a18 upstream. + +By returning '0' instead of 'EAGAIN' when the tests in xs_nospace() fail +to find evidence of socket congestion, we are making the RPC engine believe +that the message was incorrectly sent and so it disconnects the socket +instead of just retrying. + +The bug appears to have been introduced by commit +5e3771ce2d6a69e10fcc870cdf226d121d868491 (SUNRPC: Ensure that xs_nospace +return values are propagated). + +Reported-by: Andrew Cooper +Signed-off-by: Trond Myklebust +Tested-by: Andrew Cooper +Signed-off-by: Greg Kroah-Hartman + +--- + net/sunrpc/xprtsock.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/net/sunrpc/xprtsock.c ++++ b/net/sunrpc/xprtsock.c +@@ -485,7 +485,7 @@ static int xs_nospace(struct rpc_task *t + struct rpc_rqst *req = task->tk_rqstp; + struct rpc_xprt *xprt = req->rq_xprt; + struct sock_xprt *transport = container_of(xprt, struct sock_xprt, xprt); +- int ret = 0; ++ int ret = -EAGAIN; + + dprintk("RPC: %5u xmit incomplete (%u left of %u)\n", + task->tk_pid, req->rq_slen - req->rq_bytes_sent, +@@ -497,7 +497,6 @@ static int xs_nospace(struct rpc_task *t + /* Don't race with disconnect */ + if (xprt_connected(xprt)) { + if (test_bit(SOCK_ASYNC_NOSPACE, &transport->sock->flags)) { +- ret = -EAGAIN; + /* + * Notify TCP that we're limited by the application + * window size diff --git a/queue-3.0/timekeeping-add-arch_offset-hook-to-ktime_get-functions.patch b/queue-3.0/timekeeping-add-arch_offset-hook-to-ktime_get-functions.patch new file mode 100644 index 00000000000..f5332810058 --- /dev/null +++ b/queue-3.0/timekeeping-add-arch_offset-hook-to-ktime_get-functions.patch @@ -0,0 +1,45 @@ +From d004e024058a0eaca097513ce62cbcf978913e0a Mon Sep 17 00:00:00 2001 +From: Hector Palacios +Date: Mon, 14 Nov 2011 11:15:25 +0100 +Subject: timekeeping: add arch_offset hook to ktime_get functions + +From: Hector Palacios + +commit d004e024058a0eaca097513ce62cbcf978913e0a upstream. + +ktime_get and ktime_get_ts were calling timekeeping_get_ns() +but later they were not calling arch_gettimeoffset() so architectures +using this mechanism returned 0 ns when calling these functions. + +This happened for example when running Busybox's ping which calls +syscall(__NR_clock_gettime, CLOCK_MONOTONIC, ts) which eventually +calls ktime_get. As a result the returned ping travel time was zero. + +Signed-off-by: Hector Palacios +Signed-off-by: John Stultz +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/time/timekeeping.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/kernel/time/timekeeping.c ++++ b/kernel/time/timekeeping.c +@@ -249,6 +249,8 @@ ktime_t ktime_get(void) + secs = xtime.tv_sec + wall_to_monotonic.tv_sec; + nsecs = xtime.tv_nsec + wall_to_monotonic.tv_nsec; + nsecs += timekeeping_get_ns(); ++ /* If arch requires, add in gettimeoffset() */ ++ nsecs += arch_gettimeoffset(); + + } while (read_seqretry(&xtime_lock, seq)); + /* +@@ -280,6 +282,8 @@ void ktime_get_ts(struct timespec *ts) + *ts = xtime; + tomono = wall_to_monotonic; + nsecs = timekeeping_get_ns(); ++ /* If arch requires, add in gettimeoffset() */ ++ nsecs += arch_gettimeoffset(); + + } while (read_seqretry(&xtime_lock, seq)); +