From: Greg Kroah-Hartman Date: Fri, 18 Mar 2011 22:51:24 +0000 (-0700) Subject: .37 patches X-Git-Tag: v2.6.37.5~7 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=dc4eee47eb61799d59247f88361bebf1b470d271;p=thirdparty%2Fkernel%2Fstable-queue.git .37 patches --- diff --git a/queue-2.6.37/alsa-aloop-fix-possible-irq-lock-inversion.patch b/queue-2.6.37/alsa-aloop-fix-possible-irq-lock-inversion.patch new file mode 100644 index 00000000000..5d7b236d270 --- /dev/null +++ b/queue-2.6.37/alsa-aloop-fix-possible-irq-lock-inversion.patch @@ -0,0 +1,67 @@ +From 98d21df431ad55281e1abf780f8d51e3391900b2 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Fri, 18 Mar 2011 07:31:53 +0100 +Subject: ALSA: aloop - Fix possible IRQ lock inversion + +From: Takashi Iwai + +commit 98d21df431ad55281e1abf780f8d51e3391900b2 upstream. + +loopback_pos_update() can be called in the timer callback, thus the lock +held should be irq-safe. Otherwise you'll get AB/BA deadlock together +with substream->self_group.lock. + +Reported-and-tested-by: Knut Petersen +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/drivers/aloop.c | 19 +++++++++---------- + 1 file changed, 9 insertions(+), 10 deletions(-) + +--- a/sound/drivers/aloop.c ++++ b/sound/drivers/aloop.c +@@ -482,8 +482,9 @@ static unsigned int loopback_pos_update( + cable->streams[SNDRV_PCM_STREAM_CAPTURE]; + unsigned long delta_play = 0, delta_capt = 0; + unsigned int running; ++ unsigned long flags; + +- spin_lock(&cable->lock); ++ spin_lock_irqsave(&cable->lock, flags); + running = cable->running ^ cable->pause; + if (running & (1 << SNDRV_PCM_STREAM_PLAYBACK)) { + delta_play = jiffies - dpcm_play->last_jiffies; +@@ -495,10 +496,8 @@ static unsigned int loopback_pos_update( + dpcm_capt->last_jiffies += delta_capt; + } + +- if (delta_play == 0 && delta_capt == 0) { +- spin_unlock(&cable->lock); +- return running; +- } ++ if (delta_play == 0 && delta_capt == 0) ++ goto unlock; + + if (delta_play > delta_capt) { + loopback_bytepos_update(dpcm_play, delta_play - delta_capt, +@@ -510,14 +509,14 @@ static unsigned int loopback_pos_update( + delta_capt = delta_play; + } + +- if (delta_play == 0 && delta_capt == 0) { +- spin_unlock(&cable->lock); +- return running; +- } ++ if (delta_play == 0 && delta_capt == 0) ++ goto unlock; ++ + /* note delta_capt == delta_play at this moment */ + loopback_bytepos_update(dpcm_capt, delta_capt, BYTEPOS_UPDATE_COPY); + loopback_bytepos_update(dpcm_play, delta_play, BYTEPOS_UPDATE_POSONLY); +- spin_unlock(&cable->lock); ++ unlock: ++ spin_unlock_irqrestore(&cable->lock, flags); + return running; + } + diff --git a/queue-2.6.37/alsa-ctxfi-clear-input-settings-before-initialization.patch b/queue-2.6.37/alsa-ctxfi-clear-input-settings-before-initialization.patch new file mode 100644 index 00000000000..a07b9aeafd2 --- /dev/null +++ b/queue-2.6.37/alsa-ctxfi-clear-input-settings-before-initialization.patch @@ -0,0 +1,37 @@ +From efed5f26664f93991c929d5bb343e65f900d72bc Mon Sep 17 00:00:00 2001 +From: Przemyslaw Bruski +Date: Sun, 13 Mar 2011 16:18:58 +0100 +Subject: ALSA: ctxfi - Clear input settings before initialization + +From: Przemyslaw Bruski + +commit efed5f26664f93991c929d5bb343e65f900d72bc upstream. + +Clear input settings before initialization. + +Signed-off-by: Przemyslaw Bruski +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/ctxfi/ctdaio.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/sound/pci/ctxfi/ctdaio.c ++++ b/sound/pci/ctxfi/ctdaio.c +@@ -176,6 +176,7 @@ static int dao_set_left_input(struct dao + if (!entry) + return -ENOMEM; + ++ dao->ops->clear_left_input(dao); + /* Program master and conjugate resources */ + input->ops->master(input); + daio->rscl.ops->master(&daio->rscl); +@@ -204,6 +205,7 @@ static int dao_set_right_input(struct da + if (!entry) + return -ENOMEM; + ++ dao->ops->clear_right_input(dao); + /* Program master and conjugate resources */ + input->ops->master(input); + daio->rscr.ops->master(&daio->rscr); diff --git a/queue-2.6.37/alsa-ctxfi-fix-incorrect-spdif-status-bit-mask.patch b/queue-2.6.37/alsa-ctxfi-fix-incorrect-spdif-status-bit-mask.patch new file mode 100644 index 00000000000..5fee165fd34 --- /dev/null +++ b/queue-2.6.37/alsa-ctxfi-fix-incorrect-spdif-status-bit-mask.patch @@ -0,0 +1,30 @@ +From 4c1847e884efddcc3ede371f7839e5e65b25c34d Mon Sep 17 00:00:00 2001 +From: Przemyslaw Bruski +Date: Sun, 13 Mar 2011 16:18:56 +0100 +Subject: ALSA: ctxfi - Fix incorrect SPDIF status bit mask + +From: Przemyslaw Bruski + +commit 4c1847e884efddcc3ede371f7839e5e65b25c34d upstream. + +SPDIF status mask creation was incorrect. + +Signed-off-by: Przemyslaw Bruski +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/ctxfi/ctatc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/pci/ctxfi/ctatc.c ++++ b/sound/pci/ctxfi/ctatc.c +@@ -869,7 +869,7 @@ spdif_passthru_playback_setup(struct ct_ + mutex_lock(&atc->atc_mutex); + dao->ops->get_spos(dao, &status); + if (((status >> 24) & IEC958_AES3_CON_FS) != iec958_con_fs) { +- status &= ((~IEC958_AES3_CON_FS) << 24); ++ status &= ~(IEC958_AES3_CON_FS << 24); + status |= (iec958_con_fs << 24); + dao->ops->set_spos(dao, status); + dao->ops->commit_write(dao); diff --git a/queue-2.6.37/alsa-ctxfi-fix-spdif-status-retrieval.patch b/queue-2.6.37/alsa-ctxfi-fix-spdif-status-retrieval.patch new file mode 100644 index 00000000000..aa51ba7e079 --- /dev/null +++ b/queue-2.6.37/alsa-ctxfi-fix-spdif-status-retrieval.patch @@ -0,0 +1,62 @@ +From f164753a263bfd2daaf3e0273b179de7e099c57d Mon Sep 17 00:00:00 2001 +From: Przemyslaw Bruski +Date: Sun, 13 Mar 2011 16:18:57 +0100 +Subject: ALSA: ctxfi - Fix SPDIF status retrieval + +From: Przemyslaw Bruski + +commit f164753a263bfd2daaf3e0273b179de7e099c57d upstream. + +SDPIF status retrieval always returned the default settings instead of +the actual ones. + +Signed-off-by: Przemyslaw Bruski +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/ctxfi/ctmixer.c | 19 +++++-------------- + 1 file changed, 5 insertions(+), 14 deletions(-) + +--- a/sound/pci/ctxfi/ctmixer.c ++++ b/sound/pci/ctxfi/ctmixer.c +@@ -566,19 +566,6 @@ static int ct_spdif_get_mask(struct snd_ + return 0; + } + +-static int ct_spdif_default_get(struct snd_kcontrol *kcontrol, +- struct snd_ctl_elem_value *ucontrol) +-{ +- unsigned int status = SNDRV_PCM_DEFAULT_CON_SPDIF; +- +- ucontrol->value.iec958.status[0] = (status >> 0) & 0xff; +- ucontrol->value.iec958.status[1] = (status >> 8) & 0xff; +- ucontrol->value.iec958.status[2] = (status >> 16) & 0xff; +- ucontrol->value.iec958.status[3] = (status >> 24) & 0xff; +- +- return 0; +-} +- + static int ct_spdif_get(struct snd_kcontrol *kcontrol, + struct snd_ctl_elem_value *ucontrol) + { +@@ -586,6 +573,10 @@ static int ct_spdif_get(struct snd_kcont + unsigned int status; + + atc->spdif_out_get_status(atc, &status); ++ ++ if (status == 0) ++ status = SNDRV_PCM_DEFAULT_CON_SPDIF; ++ + ucontrol->value.iec958.status[0] = (status >> 0) & 0xff; + ucontrol->value.iec958.status[1] = (status >> 8) & 0xff; + ucontrol->value.iec958.status[2] = (status >> 16) & 0xff; +@@ -629,7 +620,7 @@ static struct snd_kcontrol_new iec958_de + .name = SNDRV_CTL_NAME_IEC958("", PLAYBACK, DEFAULT), + .count = 1, + .info = ct_spdif_info, +- .get = ct_spdif_default_get, ++ .get = ct_spdif_get, + .put = ct_spdif_put, + .private_value = MIXER_IEC958_DEFAULT + }; diff --git a/queue-2.6.37/alsa-hda-fix-digital-mic-selection-in-mixer-on-92hd8x-codecs.patch b/queue-2.6.37/alsa-hda-fix-digital-mic-selection-in-mixer-on-92hd8x-codecs.patch new file mode 100644 index 00000000000..7d44097a042 --- /dev/null +++ b/queue-2.6.37/alsa-hda-fix-digital-mic-selection-in-mixer-on-92hd8x-codecs.patch @@ -0,0 +1,57 @@ +From 094a42452abd5564429045e210281c6d22e67fca Mon Sep 17 00:00:00 2001 +From: Vitaliy Kulikov +Date: Wed, 9 Mar 2011 19:47:43 -0600 +Subject: ALSA: hda - fix digital mic selection in mixer on 92HD8X codecs + +From: Vitaliy Kulikov + +commit 094a42452abd5564429045e210281c6d22e67fca upstream. + +When the mux for digital mic is different from the mux for other mics, +the current auto-parser doesn't handle them in a right way but provides +only one mic. This patch fixes the issue. + +Signed-off-by: Vitaliy Kulikov +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_sigmatel.c | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +--- a/sound/pci/hda/patch_sigmatel.c ++++ b/sound/pci/hda/patch_sigmatel.c +@@ -749,7 +749,7 @@ static int stac92xx_mux_enum_put(struct + struct sigmatel_spec *spec = codec->spec; + unsigned int adc_idx = snd_ctl_get_ioffidx(kcontrol, &ucontrol->id); + const struct hda_input_mux *imux = spec->input_mux; +- unsigned int idx, prev_idx; ++ unsigned int idx, prev_idx, didx; + + idx = ucontrol->value.enumerated.item[0]; + if (idx >= imux->num_items) +@@ -761,7 +761,8 @@ static int stac92xx_mux_enum_put(struct + snd_hda_codec_write_cache(codec, spec->mux_nids[adc_idx], 0, + AC_VERB_SET_CONNECT_SEL, + imux->items[idx].index); +- if (prev_idx >= spec->num_analog_muxes) { ++ if (prev_idx >= spec->num_analog_muxes && ++ spec->mux_nids[adc_idx] != spec->dmux_nids[adc_idx]) { + imux = spec->dinput_mux; + /* 0 = analog */ + snd_hda_codec_write_cache(codec, +@@ -771,9 +772,13 @@ static int stac92xx_mux_enum_put(struct + } + } else { + imux = spec->dinput_mux; ++ /* first dimux item is hardcoded to select analog imux, ++ * so lets skip it ++ */ ++ didx = idx - spec->num_analog_muxes + 1; + snd_hda_codec_write_cache(codec, spec->dmux_nids[adc_idx], 0, + AC_VERB_SET_CONNECT_SEL, +- imux->items[idx - 1].index); ++ imux->items[didx].index); + } + spec->cur_mux[adc_idx] = idx; + return 1; diff --git a/queue-2.6.37/alsa-hda-initialize-special-cases-for-input-src-in-init-phase.patch b/queue-2.6.37/alsa-hda-initialize-special-cases-for-input-src-in-init-phase.patch new file mode 100644 index 00000000000..a53d27e244d --- /dev/null +++ b/queue-2.6.37/alsa-hda-initialize-special-cases-for-input-src-in-init-phase.patch @@ -0,0 +1,94 @@ +From 584c0c4c359bdac37d94157f8d7fc513d26c8328 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Thu, 10 Mar 2011 12:51:11 +0100 +Subject: ALSA: hda - Initialize special cases for input src in init phase + +From: Takashi Iwai + +commit 584c0c4c359bdac37d94157f8d7fc513d26c8328 upstream. + +Currently some special handling for the unusual case like dual-ADCs +or a single-input-src is done in the tree-parse time in +set_capture_mixer(). But this setup could be overwritten by static +init verbs. + +This patch moves the initialization into the init phase so that +such input-src setup won't be lost. + +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_realtek.c | 19 ++++++++++++++++--- + 1 file changed, 16 insertions(+), 3 deletions(-) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -393,6 +393,7 @@ struct alc_spec { + /* other flags */ + unsigned int no_analog :1; /* digital I/O only */ + unsigned int dual_adc_switch:1; /* switch ADCs (for ALC275) */ ++ unsigned int single_input_src:1; + int init_amp; + int codec_variant; /* flag for other variants */ + +@@ -3798,6 +3799,8 @@ static struct hda_amp_list alc880_lg_loo + * Common callbacks + */ + ++static void alc_init_special_input_src(struct hda_codec *codec); ++ + static int alc_init(struct hda_codec *codec) + { + struct alc_spec *spec = codec->spec; +@@ -3808,6 +3811,7 @@ static int alc_init(struct hda_codec *co + + for (i = 0; i < spec->num_init_verbs; i++) + snd_hda_sequence_write(codec, spec->init_verbs[i]); ++ alc_init_special_input_src(codec); + + if (spec->init_hook) + spec->init_hook(codec); +@@ -5441,6 +5445,7 @@ static void fixup_single_adc(struct hda_ + spec->capsrc_nids += i; + spec->adc_nids += i; + spec->num_adc_nids = 1; ++ spec->single_input_src = 1; + } + } + +@@ -5452,6 +5457,16 @@ static void fixup_dual_adc_switch(struct + init_capsrc_for_pin(codec, spec->int_mic.pin); + } + ++/* initialize some special cases for input sources */ ++static void alc_init_special_input_src(struct hda_codec *codec) ++{ ++ struct alc_spec *spec = codec->spec; ++ if (spec->dual_adc_switch) ++ fixup_dual_adc_switch(codec); ++ else if (spec->single_input_src) ++ init_capsrc_for_pin(codec, spec->autocfg.inputs[0].pin); ++} ++ + static void set_capture_mixer(struct hda_codec *codec) + { + struct alc_spec *spec = codec->spec; +@@ -5467,7 +5482,7 @@ static void set_capture_mixer(struct hda + int mux = 0; + int num_adcs = spec->num_adc_nids; + if (spec->dual_adc_switch) +- fixup_dual_adc_switch(codec); ++ num_adcs = 1; + else if (spec->auto_mic) + fixup_automic_adc(codec); + else if (spec->input_mux) { +@@ -5476,8 +5491,6 @@ static void set_capture_mixer(struct hda + else if (spec->input_mux->num_items == 1) + fixup_single_adc(codec); + } +- if (spec->dual_adc_switch) +- num_adcs = 1; + spec->cap_mixer = caps[mux][num_adcs - 1]; + } + } diff --git a/queue-2.6.37/alsa-hda-realtek-alc88x-do-not-over-initialize-speakers-and-hp-that-are-primary-outputs.patch b/queue-2.6.37/alsa-hda-realtek-alc88x-do-not-over-initialize-speakers-and-hp-that-are-primary-outputs.patch new file mode 100644 index 00000000000..fe11e4e9902 --- /dev/null +++ b/queue-2.6.37/alsa-hda-realtek-alc88x-do-not-over-initialize-speakers-and-hp-that-are-primary-outputs.patch @@ -0,0 +1,71 @@ +From 0a3fabe30e1a3b2037a12b863b8c45fffce38ee9 Mon Sep 17 00:00:00 2001 +From: David Henningsson +Date: Fri, 4 Mar 2011 16:54:52 +0100 +Subject: ALSA: HDA: Realtek ALC88x: Do not over-initialize speakers and hp that are primary outputs +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: David Henningsson + +commit 0a3fabe30e1a3b2037a12b863b8c45fffce38ee9 upstream. + +Do not initialize again the what has already been initialized as +multi outs, as this breaks surround speakers. + +Tested-by: Bartłomiej Å»ogała +Signed-off-by: David Henningsson +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_realtek.c | 37 +++++++++++++++++++++---------------- + 1 file changed, 21 insertions(+), 16 deletions(-) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -10736,23 +10736,28 @@ static void alc882_auto_init_hp_out(stru + hda_nid_t pin, dac; + int i; + +- for (i = 0; i < ARRAY_SIZE(spec->autocfg.hp_pins); i++) { +- pin = spec->autocfg.hp_pins[i]; +- if (!pin) +- break; +- dac = spec->multiout.hp_nid; +- if (!dac) +- dac = spec->multiout.dac_nids[0]; /* to front */ +- alc882_auto_set_output_and_unmute(codec, pin, PIN_HP, dac); ++ if (spec->autocfg.line_out_type != AUTO_PIN_HP_OUT) { ++ for (i = 0; i < ARRAY_SIZE(spec->autocfg.hp_pins); i++) { ++ pin = spec->autocfg.hp_pins[i]; ++ if (!pin) ++ break; ++ dac = spec->multiout.hp_nid; ++ if (!dac) ++ dac = spec->multiout.dac_nids[0]; /* to front */ ++ alc882_auto_set_output_and_unmute(codec, pin, PIN_HP, dac); ++ } + } +- for (i = 0; i < ARRAY_SIZE(spec->autocfg.speaker_pins); i++) { +- pin = spec->autocfg.speaker_pins[i]; +- if (!pin) +- break; +- dac = spec->multiout.extra_out_nid[0]; +- if (!dac) +- dac = spec->multiout.dac_nids[0]; /* to front */ +- alc882_auto_set_output_and_unmute(codec, pin, PIN_OUT, dac); ++ ++ if (spec->autocfg.line_out_type != AUTO_PIN_SPEAKER_OUT) { ++ for (i = 0; i < ARRAY_SIZE(spec->autocfg.speaker_pins); i++) { ++ pin = spec->autocfg.speaker_pins[i]; ++ if (!pin) ++ break; ++ dac = spec->multiout.extra_out_nid[0]; ++ if (!dac) ++ dac = spec->multiout.dac_nids[0]; /* to front */ ++ alc882_auto_set_output_and_unmute(codec, pin, PIN_OUT, dac); ++ } + } + } + diff --git a/queue-2.6.37/alsa-sound-pci-asihpi-check-adapter-index-in-hpi_ioctl.patch b/queue-2.6.37/alsa-sound-pci-asihpi-check-adapter-index-in-hpi_ioctl.patch new file mode 100644 index 00000000000..38901e5fa0f --- /dev/null +++ b/queue-2.6.37/alsa-sound-pci-asihpi-check-adapter-index-in-hpi_ioctl.patch @@ -0,0 +1,35 @@ +From 4a122c10fbfe9020df469f0f669da129c5757671 Mon Sep 17 00:00:00 2001 +From: Dan Rosenberg +Date: Thu, 17 Mar 2011 18:32:24 -0400 +Subject: ALSA: sound/pci/asihpi: check adapter index in hpi_ioctl + +From: Dan Rosenberg + +commit 4a122c10fbfe9020df469f0f669da129c5757671 upstream. + +The user-supplied index into the adapters array needs to be checked, or +an out-of-bounds kernel pointer could be accessed and used, leading to +potentially exploitable memory corruption. + +Signed-off-by: Dan Rosenberg +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/asihpi/hpioctl.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/sound/pci/asihpi/hpioctl.c ++++ b/sound/pci/asihpi/hpioctl.c +@@ -155,6 +155,11 @@ long asihpi_hpi_ioctl(struct file *file, + goto out; + } + ++ if (hm->h.adapter_index >= HPI_MAX_ADAPTERS) { ++ err = -EINVAL; ++ goto out; ++ } ++ + pa = &adapters[hm->h.adapter_index]; + hr->h.size = 0; + if (hm->h.object == HPI_OBJ_SUBSYSTEM) { diff --git a/queue-2.6.37/call_function_many-add-missing-ordering.patch b/queue-2.6.37/call_function_many-add-missing-ordering.patch new file mode 100644 index 00000000000..6e073929cd4 --- /dev/null +++ b/queue-2.6.37/call_function_many-add-missing-ordering.patch @@ -0,0 +1,119 @@ +From 45a5791920ae643eafc02e2eedef1a58e341b736 Mon Sep 17 00:00:00 2001 +From: Milton Miller +Date: Tue, 15 Mar 2011 13:27:16 -0600 +Subject: call_function_many: add missing ordering + +From: Milton Miller + +commit 45a5791920ae643eafc02e2eedef1a58e341b736 upstream. + +Paul McKenney's review pointed out two problems with the barriers in the +2.6.38 update to the smp call function many code. + +First, a barrier that would force the func and info members of data to +be visible before their consumption in the interrupt handler was +missing. This can be solved by adding a smp_wmb between setting the +func and info members and setting setting the cpumask; this will pair +with the existing and required smp_rmb ordering the cpumask read before +the read of refs. This placement avoids the need a second smp_rmb in +the interrupt handler which would be executed on each of the N cpus +executing the call request. (I was thinking this barrier was present +but was not). + +Second, the previous write to refs (establishing the zero that we the +interrupt handler was testing from all cpus) was performed by a third +party cpu. This would invoke transitivity which, as a recient or +concurrent addition to memory-barriers.txt now explicitly states, would +require a full smp_mb(). + +However, we know the cpumask will only be set by one cpu (the data +owner) and any preivous iteration of the mask would have cleared by the +reading cpu. By redundantly writing refs to 0 on the owning cpu before +the smp_wmb, the write to refs will follow the same path as the writes +that set the cpumask, which in turn allows us to keep the barrier in the +interrupt handler a smp_rmb instead of promoting it to a smp_mb (which +will be be executed by N cpus for each of the possible M elements on the +list). + +I moved and expanded the comment about our (ab)use of the rcu list +primitives for the concurrent walk earlier into this function. I +considered moving the first two paragraphs to the queue list head and +lock, but felt it would have been too disconected from the code. + +Cc: Paul McKinney +Signed-off-by: Milton Miller +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/smp.c | 46 +++++++++++++++++++++++++++++++++------------- + 1 file changed, 33 insertions(+), 13 deletions(-) + +--- a/kernel/smp.c ++++ b/kernel/smp.c +@@ -473,23 +473,42 @@ void smp_call_function_many(const struct + + data = &__get_cpu_var(cfd_data); + csd_lock(&data->csd); +- BUG_ON(atomic_read(&data->refs) || !cpumask_empty(data->cpumask)); + +- data->csd.func = func; +- data->csd.info = info; +- cpumask_and(data->cpumask, mask, cpu_online_mask); +- cpumask_clear_cpu(this_cpu, data->cpumask); ++ /* This BUG_ON verifies our reuse assertions and can be removed */ ++ BUG_ON(atomic_read(&data->refs) || !cpumask_empty(data->cpumask)); + + /* ++ * The global call function queue list add and delete are protected ++ * by a lock, but the list is traversed without any lock, relying ++ * on the rcu list add and delete to allow safe concurrent traversal. + * We reuse the call function data without waiting for any grace + * period after some other cpu removes it from the global queue. +- * This means a cpu might find our data block as it is writen. +- * The interrupt handler waits until it sees refs filled out +- * while its cpu mask bit is set; here we may only clear our +- * own cpu mask bit, and must wait to set refs until we are sure +- * previous writes are complete and we have obtained the lock to +- * add the element to the queue. ++ * This means a cpu might find our data block as it is being ++ * filled out. ++ * ++ * We hold off the interrupt handler on the other cpu by ++ * ordering our writes to the cpu mask vs our setting of the ++ * refs counter. We assert only the cpu owning the data block ++ * will set a bit in cpumask, and each bit will only be cleared ++ * by the subject cpu. Each cpu must first find its bit is ++ * set and then check that refs is set indicating the element is ++ * ready to be processed, otherwise it must skip the entry. ++ * ++ * On the previous iteration refs was set to 0 by another cpu. ++ * To avoid the use of transitivity, set the counter to 0 here ++ * so the wmb will pair with the rmb in the interrupt handler. + */ ++ atomic_set(&data->refs, 0); /* convert 3rd to 1st party write */ ++ ++ data->csd.func = func; ++ data->csd.info = info; ++ ++ /* Ensure 0 refs is visible before mask. Also orders func and info */ ++ smp_wmb(); ++ ++ /* We rely on the "and" being processed before the store */ ++ cpumask_and(data->cpumask, mask, cpu_online_mask); ++ cpumask_clear_cpu(this_cpu, data->cpumask); + + raw_spin_lock_irqsave(&call_function.lock, flags); + /* +@@ -499,8 +518,9 @@ void smp_call_function_many(const struct + */ + list_add_rcu(&data->csd.list, &call_function.queue); + /* +- * We rely on the wmb() in list_add_rcu to order the writes +- * to func, data, and cpumask before this write to refs. ++ * We rely on the wmb() in list_add_rcu to complete our writes ++ * to the cpumask before this write to refs, which indicates ++ * data is on the list and is ready to be processed. + */ + atomic_set(&data->refs, cpumask_weight(data->cpumask)); + raw_spin_unlock_irqrestore(&call_function.lock, flags); diff --git a/queue-2.6.37/call_function_many-fix-list-delete-vs-add-race.patch b/queue-2.6.37/call_function_many-fix-list-delete-vs-add-race.patch new file mode 100644 index 00000000000..2aab0151418 --- /dev/null +++ b/queue-2.6.37/call_function_many-fix-list-delete-vs-add-race.patch @@ -0,0 +1,68 @@ +From e6cd1e07a185d5f9b0aa75e020df02d3c1c44940 Mon Sep 17 00:00:00 2001 +From: Milton Miller +Date: Tue, 15 Mar 2011 13:27:16 -0600 +Subject: call_function_many: fix list delete vs add race + +From: Milton Miller + +commit e6cd1e07a185d5f9b0aa75e020df02d3c1c44940 upstream. + +Peter pointed out there was nothing preventing the list_del_rcu in +smp_call_function_interrupt from running before the list_add_rcu in +smp_call_function_many. + +Fix this by not setting refs until we have gotten the lock for the list. +Take advantage of the wmb in list_add_rcu to save an explicit additional +one. + +I tried to force this race with a udelay before the lock & list_add and +by mixing all 64 online cpus with just 3 random cpus in the mask, but +was unsuccessful. Still, inspection shows a valid race, and the fix is +a extension of the existing protection window in the current code. + +Reported-by: Peter Zijlstra +Signed-off-by: Milton Miller +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/smp.c | 20 +++++++++++++------- + 1 file changed, 13 insertions(+), 7 deletions(-) + +--- a/kernel/smp.c ++++ b/kernel/smp.c +@@ -481,14 +481,15 @@ void smp_call_function_many(const struct + cpumask_clear_cpu(this_cpu, data->cpumask); + + /* +- * To ensure the interrupt handler gets an complete view +- * we order the cpumask and refs writes and order the read +- * of them in the interrupt handler. In addition we may +- * only clear our own cpu bit from the mask. ++ * We reuse the call function data without waiting for any grace ++ * period after some other cpu removes it from the global queue. ++ * This means a cpu might find our data block as it is writen. ++ * The interrupt handler waits until it sees refs filled out ++ * while its cpu mask bit is set; here we may only clear our ++ * own cpu mask bit, and must wait to set refs until we are sure ++ * previous writes are complete and we have obtained the lock to ++ * add the element to the queue. + */ +- smp_wmb(); +- +- atomic_set(&data->refs, cpumask_weight(data->cpumask)); + + raw_spin_lock_irqsave(&call_function.lock, flags); + /* +@@ -497,6 +498,11 @@ void smp_call_function_many(const struct + * will not miss any other list entries: + */ + list_add_rcu(&data->csd.list, &call_function.queue); ++ /* ++ * We rely on the wmb() in list_add_rcu to order the writes ++ * to func, data, and cpumask before this write to refs. ++ */ ++ atomic_set(&data->refs, cpumask_weight(data->cpumask)); + raw_spin_unlock_irqrestore(&call_function.lock, flags); + + /* diff --git a/queue-2.6.37/ext3-always-set-dx_node-s-fake_dirent-explicitly.patch b/queue-2.6.37/ext3-always-set-dx_node-s-fake_dirent-explicitly.patch new file mode 100644 index 00000000000..7bcfb2e880a --- /dev/null +++ b/queue-2.6.37/ext3-always-set-dx_node-s-fake_dirent-explicitly.patch @@ -0,0 +1,37 @@ +From d7433142b63d727b5a217c37b1a1468b116a9771 Mon Sep 17 00:00:00 2001 +From: Eric Sandeen +Date: Fri, 4 Mar 2011 16:04:08 -0600 +Subject: ext3: Always set dx_node's fake_dirent explicitly. + +From: Eric Sandeen + +commit d7433142b63d727b5a217c37b1a1468b116a9771 upstream. + +(crossport of 1f7bebb9e911d870fa8f997ddff838e82b5715ea +by Andreas Schlick ) + +When ext3_dx_add_entry() has to split an index node, it has to ensure that +name_len of dx_node's fake_dirent is also zero, because otherwise e2fsck +won't recognise it as an intermediate htree node and consider the htree to +be corrupted. + +Signed-off-by: Eric Sandeen +Signed-off-by: Jan Kara +Signed-off-by: Greg Kroah-Hartman + +--- + fs/ext3/namei.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/ext3/namei.c ++++ b/fs/ext3/namei.c +@@ -1549,8 +1549,8 @@ static int ext3_dx_add_entry(handle_t *h + goto cleanup; + node2 = (struct dx_node *)(bh2->b_data); + entries2 = node2->entries; ++ memset(&node2->fake, 0, sizeof(struct fake_dirent)); + node2->fake.rec_len = ext3_rec_len_to_disk(sb->s_blocksize); +- node2->fake.inode = 0; + BUFFER_TRACE(frame->bh, "get_write_access"); + err = ext3_journal_get_write_access(handle, frame->bh); + if (err) diff --git a/queue-2.6.37/hid-add-support-for-ortek-pkb-1700.patch b/queue-2.6.37/hid-add-support-for-ortek-pkb-1700.patch new file mode 100644 index 00000000000..72a93017741 --- /dev/null +++ b/queue-2.6.37/hid-add-support-for-ortek-pkb-1700.patch @@ -0,0 +1,77 @@ +From 270fdc0748bd3f7b625caff985f2fcf8e2185ec7 Mon Sep 17 00:00:00 2001 +From: Herton Ronaldo Krzesinski +Date: Wed, 16 Mar 2011 14:13:53 -0300 +Subject: HID: add support for Ortek PKB-1700 + +From: Herton Ronaldo Krzesinski + +commit 270fdc0748bd3f7b625caff985f2fcf8e2185ec7 upstream. + +As reported on http://ubuntuforums.org/showthread.php?t=1594007 the +PKB-1700 needs same special handling as WKB-2000. This change is +originally based on patch posted by user asmoore82 on the Ubuntu +forums. + +Signed-off-by: Herton Ronaldo Krzesinski +Signed-off-by: Jiri Kosina +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hid/Kconfig | 4 ++-- + drivers/hid/hid-core.c | 1 + + drivers/hid/hid-ids.h | 1 + + drivers/hid/hid-ortek.c | 3 ++- + 4 files changed, 6 insertions(+), 3 deletions(-) + +--- a/drivers/hid/Kconfig ++++ b/drivers/hid/Kconfig +@@ -291,10 +291,10 @@ config HID_NTRIG + Support for N-Trig touch screen. + + config HID_ORTEK +- tristate "Ortek WKB-2000 wireless keyboard and mouse trackpad" ++ tristate "Ortek PKB-1700/WKB-2000 wireless keyboard and mouse trackpad" + depends on USB_HID + ---help--- +- Support for Ortek WKB-2000 wireless keyboard + mouse trackpad. ++ Support for Ortek PKB-1700/WKB-2000 wireless keyboard + mouse trackpad. + + config HID_PANTHERLORD + tristate "Pantherlord/GreenAsia game controller" +--- a/drivers/hid/hid-core.c ++++ b/drivers/hid/hid-core.c +@@ -1365,6 +1365,7 @@ static const struct hid_device_id hid_bl + { HID_USB_DEVICE(USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_16) }, + { HID_USB_DEVICE(USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_17) }, + { HID_USB_DEVICE(USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_18) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_ORTEK, USB_DEVICE_ID_ORTEK_PKB1700) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ORTEK, USB_DEVICE_ID_ORTEK_WKB2000) }, + { HID_USB_DEVICE(USB_VENDOR_ID_PETALYNX, USB_DEVICE_ID_PETALYNX_MAXTER_REMOTE) }, + { HID_USB_DEVICE(USB_VENDOR_ID_QUANTA, USB_DEVICE_ID_QUANTA_OPTICAL_TOUCH) }, +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -445,6 +445,7 @@ + #define USB_DEVICE_ID_ONTRAK_ADU100 0x0064 + + #define USB_VENDOR_ID_ORTEK 0x05a4 ++#define USB_DEVICE_ID_ORTEK_PKB1700 0x1700 + #define USB_DEVICE_ID_ORTEK_WKB2000 0x2000 + + #define USB_VENDOR_ID_PANJIT 0x134c +--- a/drivers/hid/hid-ortek.c ++++ b/drivers/hid/hid-ortek.c +@@ -1,5 +1,5 @@ + /* +- * HID driver for Ortek WKB-2000 (wireless keyboard + mouse trackpad). ++ * HID driver for Ortek PKB-1700/WKB-2000 (wireless keyboard + mouse trackpad). + * Fixes LogicalMaximum error in USB report description, see + * http://bugzilla.kernel.org/show_bug.cgi?id=14787 + * +@@ -31,6 +31,7 @@ static __u8 *ortek_report_fixup(struct h + } + + static const struct hid_device_id ortek_devices[] = { ++ { HID_USB_DEVICE(USB_VENDOR_ID_ORTEK, USB_DEVICE_ID_ORTEK_PKB1700) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ORTEK, USB_DEVICE_ID_ORTEK_WKB2000) }, + { } + }; diff --git a/queue-2.6.37/hid-hid-magicmouse-correct-touch-orientation-direction.patch b/queue-2.6.37/hid-hid-magicmouse-correct-touch-orientation-direction.patch new file mode 100644 index 00000000000..683dda6fdf5 --- /dev/null +++ b/queue-2.6.37/hid-hid-magicmouse-correct-touch-orientation-direction.patch @@ -0,0 +1,48 @@ +From 2d9ca4e9f393d81d8f37ed37505aecbf3a5e1bd6 Mon Sep 17 00:00:00 2001 +From: Henrik Rydberg +Date: Wed, 9 Mar 2011 18:38:57 +0100 +Subject: HID: hid-magicmouse: Correct touch orientation direction + +From: Henrik Rydberg + +commit 2d9ca4e9f393d81d8f37ed37505aecbf3a5e1bd6 upstream. + +The magic trackpad and mouse both report touch orientation in opposite +direction to the bcm5974 driver and what is written in +Documents/input/multi-touch-protocol.txt. This patch reverts the +direction, so that all in-kernel devices with this feature behave the +same way. + +Since no known application has been utilizing this information yet, it +seems appropriate also for stable. + +Cc: Michael Poole +Signed-off-by: Henrik Rydberg +Acked-by: Chase Douglas +Signed-off-by: Jiri Kosina +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hid/hid-magicmouse.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/hid/hid-magicmouse.c ++++ b/drivers/hid/hid-magicmouse.c +@@ -256,7 +256,7 @@ static void magicmouse_emit_touch(struct + input_report_abs(input, ABS_MT_TRACKING_ID, id); + input_report_abs(input, ABS_MT_TOUCH_MAJOR, touch_major << 2); + input_report_abs(input, ABS_MT_TOUCH_MINOR, touch_minor << 2); +- input_report_abs(input, ABS_MT_ORIENTATION, orientation); ++ input_report_abs(input, ABS_MT_ORIENTATION, -orientation); + input_report_abs(input, ABS_MT_POSITION_X, x); + input_report_abs(input, ABS_MT_POSITION_Y, y); + +@@ -395,7 +395,7 @@ static void magicmouse_setup_input(struc + input_set_abs_params(input, ABS_MT_TRACKING_ID, 0, 15, 0, 0); + input_set_abs_params(input, ABS_MT_TOUCH_MAJOR, 0, 255, 4, 0); + input_set_abs_params(input, ABS_MT_TOUCH_MINOR, 0, 255, 4, 0); +- input_set_abs_params(input, ABS_MT_ORIENTATION, -32, 31, 1, 0); ++ input_set_abs_params(input, ABS_MT_ORIENTATION, -31, 32, 1, 0); + + /* Note: Touch Y position from the device is inverted relative + * to how pointer motion is reported (and relative to how USB diff --git a/queue-2.6.37/nfs-fix-a-decoding-problem-in-nfs3_decode_dirent.patch b/queue-2.6.37/nfs-fix-a-decoding-problem-in-nfs3_decode_dirent.patch new file mode 100644 index 00000000000..a5ae746c27e --- /dev/null +++ b/queue-2.6.37/nfs-fix-a-decoding-problem-in-nfs3_decode_dirent.patch @@ -0,0 +1,68 @@ +From Trond.Myklebust@netapp.com Fri Mar 18 14:52:55 2011 +From: Trond Myklebust +Date: Thu, 17 Mar 2011 21:54:39 -0400 +Subject: NFS: Fix a decoding problem in nfs3_decode_dirent +To: stable@kernel.org +Cc: Trond Myklebust +Message-ID: <1300413279-12570-1-git-send-email-Trond.Myklebust@netapp.com> + +[This needs to be applied to 2.6.37 only. The bug in question was +inadvertently fixed by a series of cleanups in 2.6.38, but the patches +in question are too large to be backported. This patch is a minimal fix +that serves the same purpose.] + +When we decode a filename followed by an 8-byte cookie, we need to +consider the fact that the filename and cookie are 32-bit word aligned. +Presently, we may end up copying insufficient amounts of data when +xdr_inline_decode() needs to invoke xdr_copy_to_scratch to deal +with a page boundary. + +The following patch fixes the issue by first decoding the filename, and +then decoding the cookie. + +Reported-by: Neil Brown +Signed-off-by: Trond Myklebust +Reviewed-by: NeilBrown +Signed-off-by: Greg Kroah-Hartman + +--- + fs/nfs/nfs2xdr.c | 6 ++++-- + fs/nfs/nfs3xdr.c | 6 ++++-- + 2 files changed, 8 insertions(+), 4 deletions(-) + +--- a/fs/nfs/nfs2xdr.c ++++ b/fs/nfs/nfs2xdr.c +@@ -477,11 +477,13 @@ nfs_decode_dirent(struct xdr_stream *xdr + entry->ino = ntohl(*p++); + entry->len = ntohl(*p++); + +- p = xdr_inline_decode(xdr, entry->len + 4); ++ p = xdr_inline_decode(xdr, entry->len); + if (unlikely(!p)) + goto out_overflow; + entry->name = (const char *) p; +- p += XDR_QUADLEN(entry->len); ++ p = xdr_inline_decode(xdr, 4); ++ if (unlikely(!p)) ++ goto out_overflow; + entry->prev_cookie = entry->cookie; + entry->cookie = ntohl(*p++); + +--- a/fs/nfs/nfs3xdr.c ++++ b/fs/nfs/nfs3xdr.c +@@ -614,11 +614,13 @@ nfs3_decode_dirent(struct xdr_stream *xd + p = xdr_decode_hyper(p, &entry->ino); + entry->len = ntohl(*p++); + +- p = xdr_inline_decode(xdr, entry->len + 8); ++ p = xdr_inline_decode(xdr, entry->len); + if (unlikely(!p)) + goto out_overflow; + entry->name = (const char *) p; +- p += XDR_QUADLEN(entry->len); ++ p = xdr_inline_decode(xdr, 8); ++ if (unlikely(!p)) ++ goto out_overflow; + entry->prev_cookie = entry->cookie; + p = xdr_decode_hyper(p, &entry->cookie); + diff --git a/queue-2.6.37/pci-add-more-checking-to-ich-region-quirks.patch b/queue-2.6.37/pci-add-more-checking-to-ich-region-quirks.patch new file mode 100644 index 00000000000..de9d0a79c44 --- /dev/null +++ b/queue-2.6.37/pci-add-more-checking-to-ich-region-quirks.patch @@ -0,0 +1,100 @@ +From cdb9755849fbaf2bb9c0a009ba5baa817a0f152d Mon Sep 17 00:00:00 2001 +From: Jiri Slaby +Date: Mon, 28 Feb 2011 10:45:09 +0100 +Subject: PCI: add more checking to ICH region quirks + +From: Jiri Slaby + +commit cdb9755849fbaf2bb9c0a009ba5baa817a0f152d upstream. + +Per ICH4 and ICH6 specs, ACPI and GPIO regions are valid iff ACPI_EN +and GPIO_EN bits are set to 1. Add checks for these bits into the +quirks prior to the region creation. + +While at it, name the constants by macros. + +Signed-off-by: Jiri Slaby +Cc: Bjorn Helgaas +Cc: "David S. Miller" +Cc: Thomas Renninger +Signed-off-by: Jesse Barnes +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pci/quirks.c | 49 +++++++++++++++++++++++++++++++++++++++---------- + 1 file changed, 39 insertions(+), 10 deletions(-) + +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -533,6 +533,17 @@ static void __devinit quirk_piix4_acpi(s + DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82371AB_3, quirk_piix4_acpi); + DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82443MX_3, quirk_piix4_acpi); + ++#define ICH_PMBASE 0x40 ++#define ICH_ACPI_CNTL 0x44 ++#define ICH4_ACPI_EN 0x10 ++#define ICH6_ACPI_EN 0x80 ++#define ICH4_GPIOBASE 0x58 ++#define ICH4_GPIO_CNTL 0x5c ++#define ICH4_GPIO_EN 0x10 ++#define ICH6_GPIOBASE 0x48 ++#define ICH6_GPIO_CNTL 0x4c ++#define ICH6_GPIO_EN 0x10 ++ + /* + * ICH4, ICH4-M, ICH5, ICH5-M ACPI: Three IO regions pointed to by longwords at + * 0x40 (128 bytes of ACPI, GPIO & TCO registers) +@@ -541,12 +552,21 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_I + static void __devinit quirk_ich4_lpc_acpi(struct pci_dev *dev) + { + u32 region; ++ u8 enable; + +- pci_read_config_dword(dev, 0x40, ®ion); +- quirk_io_region(dev, region, 128, PCI_BRIDGE_RESOURCES, "ICH4 ACPI/GPIO/TCO"); +- +- pci_read_config_dword(dev, 0x58, ®ion); +- quirk_io_region(dev, region, 64, PCI_BRIDGE_RESOURCES+1, "ICH4 GPIO"); ++ pci_read_config_byte(dev, ICH_ACPI_CNTL, &enable); ++ if (enable & ICH4_ACPI_EN) { ++ pci_read_config_dword(dev, ICH_PMBASE, ®ion); ++ quirk_io_region(dev, region, 128, PCI_BRIDGE_RESOURCES, ++ "ICH4 ACPI/GPIO/TCO"); ++ } ++ ++ pci_read_config_byte(dev, ICH4_GPIO_CNTL, &enable); ++ if (enable & ICH4_GPIO_EN) { ++ pci_read_config_dword(dev, ICH4_GPIOBASE, ®ion); ++ quirk_io_region(dev, region, 64, PCI_BRIDGE_RESOURCES + 1, ++ "ICH4 GPIO"); ++ } + } + DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82801AA_0, quirk_ich4_lpc_acpi); + DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82801AB_0, quirk_ich4_lpc_acpi); +@@ -562,12 +582,21 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_I + static void __devinit ich6_lpc_acpi_gpio(struct pci_dev *dev) + { + u32 region; ++ u8 enable; + +- pci_read_config_dword(dev, 0x40, ®ion); +- quirk_io_region(dev, region, 128, PCI_BRIDGE_RESOURCES, "ICH6 ACPI/GPIO/TCO"); +- +- pci_read_config_dword(dev, 0x48, ®ion); +- quirk_io_region(dev, region, 64, PCI_BRIDGE_RESOURCES+1, "ICH6 GPIO"); ++ pci_read_config_byte(dev, ICH_ACPI_CNTL, &enable); ++ if (enable & ICH6_ACPI_EN) { ++ pci_read_config_dword(dev, ICH_PMBASE, ®ion); ++ quirk_io_region(dev, region, 128, PCI_BRIDGE_RESOURCES, ++ "ICH6 ACPI/GPIO/TCO"); ++ } ++ ++ pci_read_config_byte(dev, ICH6_GPIO_CNTL, &enable); ++ if (enable & ICH4_GPIO_EN) { ++ pci_read_config_dword(dev, ICH6_GPIOBASE, ®ion); ++ quirk_io_region(dev, region, 64, PCI_BRIDGE_RESOURCES + 1, ++ "ICH6 GPIO"); ++ } + } + + static void __devinit ich6_lpc_generic_decode(struct pci_dev *dev, unsigned reg, const char *name, int dynsize) diff --git a/queue-2.6.37/pci-do-not-create-quirk-i-o-regions-below-pcibios_min_io-for-ich.patch b/queue-2.6.37/pci-do-not-create-quirk-i-o-regions-below-pcibios_min_io-for-ich.patch new file mode 100644 index 00000000000..7c700849cdd --- /dev/null +++ b/queue-2.6.37/pci-do-not-create-quirk-i-o-regions-below-pcibios_min_io-for-ich.patch @@ -0,0 +1,103 @@ +From 87e3dc3855430bd254370afc79f2ed92250f5b7c Mon Sep 17 00:00:00 2001 +From: Jiri Slaby +Date: Mon, 28 Feb 2011 10:45:10 +0100 +Subject: PCI: do not create quirk I/O regions below PCIBIOS_MIN_IO for ICH + +From: Jiri Slaby + +commit 87e3dc3855430bd254370afc79f2ed92250f5b7c upstream. + +Some broken BIOSes on ICH4 chipset report an ACPI region which is in +conflict with legacy IDE ports when ACPI is disabled. Even though the +regions overlap, IDE ports are working correctly (we cannot find out +the decoding rules on chipsets). + +So the only problem is the reported region itself, if we don't reserve +the region in the quirk everything works as expected. + +This patch avoids reserving any quirk regions below PCIBIOS_MIN_IO +which is 0x1000. Some regions might be (and are by a fast google +query) below this border, but the only difference is that they won't +be reserved anymore. They should still work though the same as before. + +The conflicts look like (1f.0 is bridge, 1f.1 is IDE ctrl): +pci 0000:00:1f.1: address space collision: [io 0x0170-0x0177] conflicts with 0000:00:1f.0 [io 0x0100-0x017f] + +At 0x0100 a 128 bytes long ACPI region is reported in the quirk for +ICH4. ata_piix then fails to find disks because the IDE legacy ports +are zeroed: +ata_piix 0000:00:1f.1: device not available (can't reserve [io 0x0000-0x0007]) + +References: https://bugzilla.novell.com/show_bug.cgi?id=558740 +Signed-off-by: Jiri Slaby +Cc: Bjorn Helgaas +Cc: "David S. Miller" +Cc: Thomas Renninger +Signed-off-by: Jesse Barnes +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pci/quirks.c | 32 ++++++++++++++++++++++++-------- + 1 file changed, 24 insertions(+), 8 deletions(-) + +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -554,18 +554,30 @@ static void __devinit quirk_ich4_lpc_acp + u32 region; + u8 enable; + ++ /* ++ * The check for PCIBIOS_MIN_IO is to ensure we won't create a conflict ++ * with low legacy (and fixed) ports. We don't know the decoding ++ * priority and can't tell whether the legacy device or the one created ++ * here is really at that address. This happens on boards with broken ++ * BIOSes. ++ */ ++ + pci_read_config_byte(dev, ICH_ACPI_CNTL, &enable); + if (enable & ICH4_ACPI_EN) { + pci_read_config_dword(dev, ICH_PMBASE, ®ion); +- quirk_io_region(dev, region, 128, PCI_BRIDGE_RESOURCES, +- "ICH4 ACPI/GPIO/TCO"); ++ region &= PCI_BASE_ADDRESS_IO_MASK; ++ if (region >= PCIBIOS_MIN_IO) ++ quirk_io_region(dev, region, 128, PCI_BRIDGE_RESOURCES, ++ "ICH4 ACPI/GPIO/TCO"); + } + + pci_read_config_byte(dev, ICH4_GPIO_CNTL, &enable); + if (enable & ICH4_GPIO_EN) { + pci_read_config_dword(dev, ICH4_GPIOBASE, ®ion); +- quirk_io_region(dev, region, 64, PCI_BRIDGE_RESOURCES + 1, +- "ICH4 GPIO"); ++ region &= PCI_BASE_ADDRESS_IO_MASK; ++ if (region >= PCIBIOS_MIN_IO) ++ quirk_io_region(dev, region, 64, ++ PCI_BRIDGE_RESOURCES + 1, "ICH4 GPIO"); + } + } + DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82801AA_0, quirk_ich4_lpc_acpi); +@@ -587,15 +599,19 @@ static void __devinit ich6_lpc_acpi_gpio + pci_read_config_byte(dev, ICH_ACPI_CNTL, &enable); + if (enable & ICH6_ACPI_EN) { + pci_read_config_dword(dev, ICH_PMBASE, ®ion); +- quirk_io_region(dev, region, 128, PCI_BRIDGE_RESOURCES, +- "ICH6 ACPI/GPIO/TCO"); ++ region &= PCI_BASE_ADDRESS_IO_MASK; ++ if (region >= PCIBIOS_MIN_IO) ++ quirk_io_region(dev, region, 128, PCI_BRIDGE_RESOURCES, ++ "ICH6 ACPI/GPIO/TCO"); + } + + pci_read_config_byte(dev, ICH6_GPIO_CNTL, &enable); + if (enable & ICH4_GPIO_EN) { + pci_read_config_dword(dev, ICH6_GPIOBASE, ®ion); +- quirk_io_region(dev, region, 64, PCI_BRIDGE_RESOURCES + 1, +- "ICH6 GPIO"); ++ region &= PCI_BASE_ADDRESS_IO_MASK; ++ if (region >= PCIBIOS_MIN_IO) ++ quirk_io_region(dev, region, 64, ++ PCI_BRIDGE_RESOURCES + 1, "ICH6 GPIO"); + } + } + diff --git a/queue-2.6.37/pci-remove-quirk-for-pre-production-systems.patch b/queue-2.6.37/pci-remove-quirk-for-pre-production-systems.patch new file mode 100644 index 00000000000..03fc667e011 --- /dev/null +++ b/queue-2.6.37/pci-remove-quirk-for-pre-production-systems.patch @@ -0,0 +1,100 @@ +From b99af4b002e4908d1a5cdaf424529bdf1dc69768 Mon Sep 17 00:00:00 2001 +From: Brandeburg, Jesse +Date: Mon, 14 Feb 2011 09:05:02 -0800 +Subject: PCI: remove quirk for pre-production systems + +From: Brandeburg, Jesse + +commit b99af4b002e4908d1a5cdaf424529bdf1dc69768 upstream. + +Revert commit 7eb93b175d4de9438a4b0af3a94a112cb5266944 +Author: Yu Zhao +Date: Fri Apr 3 15:18:11 2009 +0800 + + PCI: SR-IOV quirk for Intel 82576 NIC + + If BIOS doesn't allocate resources for the SR-IOV BARs, zero the Flash + BAR and program the SR-IOV BARs to use the old Flash Memory Space. + + Please refer to Intel 82576 Gigabit Ethernet Controller Datasheet + section 7.9.2.14.2 for details. + http://download.intel.com/design/network/datashts/82576_Datasheet.pdf + + Signed-off-by: Yu Zhao + Signed-off-by: Jesse Barnes + +This quirk was added before SR-IOV was in production and now all machines that +originally had this issue alreayd have bios updates to correct the issue. The +quirk itself is no longer needed and in fact causes bugs if run. Remove it. + +Signed-off-by: Jesse Brandeburg +CC: Yu Zhao +CC: Jesse Barnes +Signed-off-by: Jesse Barnes +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pci/quirks.c | 52 --------------------------------------------------- + 1 file changed, 52 deletions(-) + +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -2618,58 +2618,6 @@ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AT + + #endif /* CONFIG_PCI_MSI */ + +-#ifdef CONFIG_PCI_IOV +- +-/* +- * For Intel 82576 SR-IOV NIC, if BIOS doesn't allocate resources for the +- * SR-IOV BARs, zero the Flash BAR and program the SR-IOV BARs to use the +- * old Flash Memory Space. +- */ +-static void __devinit quirk_i82576_sriov(struct pci_dev *dev) +-{ +- int pos, flags; +- u32 bar, start, size; +- +- if (PAGE_SIZE > 0x10000) +- return; +- +- flags = pci_resource_flags(dev, 0); +- if ((flags & PCI_BASE_ADDRESS_SPACE) != +- PCI_BASE_ADDRESS_SPACE_MEMORY || +- (flags & PCI_BASE_ADDRESS_MEM_TYPE_MASK) != +- PCI_BASE_ADDRESS_MEM_TYPE_32) +- return; +- +- pos = pci_find_ext_capability(dev, PCI_EXT_CAP_ID_SRIOV); +- if (!pos) +- return; +- +- pci_read_config_dword(dev, pos + PCI_SRIOV_BAR, &bar); +- if (bar & PCI_BASE_ADDRESS_MEM_MASK) +- return; +- +- start = pci_resource_start(dev, 1); +- size = pci_resource_len(dev, 1); +- if (!start || size != 0x400000 || start & (size - 1)) +- return; +- +- pci_resource_flags(dev, 1) = 0; +- pci_write_config_dword(dev, PCI_BASE_ADDRESS_1, 0); +- pci_write_config_dword(dev, pos + PCI_SRIOV_BAR, start); +- pci_write_config_dword(dev, pos + PCI_SRIOV_BAR + 12, start + size / 2); +- +- dev_info(&dev->dev, "use Flash Memory Space for SR-IOV BARs\n"); +-} +-DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x10c9, quirk_i82576_sriov); +-DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x10e6, quirk_i82576_sriov); +-DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x10e7, quirk_i82576_sriov); +-DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x10e8, quirk_i82576_sriov); +-DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x150a, quirk_i82576_sriov); +-DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x150d, quirk_i82576_sriov); +-DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x1518, quirk_i82576_sriov); +- +-#endif /* CONFIG_PCI_IOV */ +- + /* Allow manual resource allocation for PCI hotplug bridges + * via pci=hpmemsize=nnM and pci=hpiosize=nnM parameters. For + * some PCI-PCI hotplug bridges, like PLX 6254 (former HINT HB6), diff --git a/queue-2.6.37/pci-sysfs-fix-failure-path-for-addition-of-vpd-attribute.patch b/queue-2.6.37/pci-sysfs-fix-failure-path-for-addition-of-vpd-attribute.patch new file mode 100644 index 00000000000..9f0cc315434 --- /dev/null +++ b/queue-2.6.37/pci-sysfs-fix-failure-path-for-addition-of-vpd-attribute.patch @@ -0,0 +1,38 @@ +From 0f12a4e29368a9476076515881d9ef4e5876c6e2 Mon Sep 17 00:00:00 2001 +From: Ben Hutchings +Date: Thu, 13 Jan 2011 19:47:56 +0000 +Subject: PCI: sysfs: Fix failure path for addition of "vpd" attribute + +From: Ben Hutchings + +commit 0f12a4e29368a9476076515881d9ef4e5876c6e2 upstream. + +Commit 280c73d ("PCI: centralize the capabilities code in +pci-sysfs.c") changed the initialisation of the "rom" and "vpd" +attributes, and made the failure path for the "vpd" attribute +incorrect. We must free the new attribute structure (attr), but +instead we currently free dev->vpd->attr. That will normally be NULL, +resulting in a memory leak, but it might be a stale pointer, resulting +in a double-free. + +Found by inspection; compile-tested only. + +Signed-off-by: Ben Hutchings +Signed-off-by: Jesse Barnes +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pci/pci-sysfs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/pci/pci-sysfs.c ++++ b/drivers/pci/pci-sysfs.c +@@ -1088,7 +1088,7 @@ static int pci_create_capabilities_sysfs + attr->write = write_vpd_attr; + retval = sysfs_create_bin_file(&dev->dev.kobj, attr); + if (retval) { +- kfree(dev->vpd->attr); ++ kfree(attr); + return retval; + } + dev->vpd->attr = attr; diff --git a/queue-2.6.37/perf-fix-the-software-events-state-check.patch b/queue-2.6.37/perf-fix-the-software-events-state-check.patch new file mode 100644 index 00000000000..f965e544ce7 --- /dev/null +++ b/queue-2.6.37/perf-fix-the-software-events-state-check.patch @@ -0,0 +1,35 @@ +From 91b2f482e62ad0d444222253026a5cbca28c4ab9 Mon Sep 17 00:00:00 2001 +From: Frederic Weisbecker +Date: Mon, 7 Mar 2011 21:27:08 +0100 +Subject: perf: Fix the software events state check + +From: Frederic Weisbecker + +commit 91b2f482e62ad0d444222253026a5cbca28c4ab9 upstream. + +Fix the mistakenly inverted check of events state. + +Signed-off-by: Frederic Weisbecker +Signed-off-by: Peter Zijlstra +Cc: Arnaldo Carvalho de Melo +Cc: Paul Mackerras +Cc: Stephane Eranian +LKML-Reference: <1299529629-18280-1-git-send-email-fweisbec@gmail.com> +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/perf_event.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/kernel/perf_event.c ++++ b/kernel/perf_event.c +@@ -4414,7 +4414,7 @@ static int perf_exclude_event(struct per + struct pt_regs *regs) + { + if (event->hw.state & PERF_HES_STOPPED) +- return 0; ++ return 1; + + if (regs) { + if (event->attr.exclude_user && user_mode(regs)) diff --git a/queue-2.6.37/perf-handle-stopped-state-with-tracepoints.patch b/queue-2.6.37/perf-handle-stopped-state-with-tracepoints.patch new file mode 100644 index 00000000000..f65f12ef46a --- /dev/null +++ b/queue-2.6.37/perf-handle-stopped-state-with-tracepoints.patch @@ -0,0 +1,37 @@ +From a0f7d0f7fc02465bb9758501f611f63381792996 Mon Sep 17 00:00:00 2001 +From: Frederic Weisbecker +Date: Mon, 7 Mar 2011 21:27:09 +0100 +Subject: perf: Handle stopped state with tracepoints + +From: Frederic Weisbecker + +commit a0f7d0f7fc02465bb9758501f611f63381792996 upstream. + +We toggle the state from start and stop callbacks but actually +don't check it when the event triggers. Do it so that +these callbacks actually work. + +Signed-off-by: Frederic Weisbecker +Cc: Arnaldo Carvalho de Melo +Cc: Paul Mackerras +Cc: Stephane Eranian +Signed-off-by: Peter Zijlstra +LKML-Reference: <1299529629-18280-2-git-send-email-fweisbec@gmail.com> +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/perf_event.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/kernel/perf_event.c ++++ b/kernel/perf_event.c +@@ -4770,6 +4770,8 @@ static int perf_tp_event_match(struct pe + struct perf_sample_data *data, + struct pt_regs *regs) + { ++ if (event->hw.state & PERF_HES_STOPPED) ++ return 0; + /* + * All tracepoints are from kernel-space. + */ diff --git a/queue-2.6.37/perf-powerpc-handle-events-that-raise-an-exception-without-overflowing.patch b/queue-2.6.37/perf-powerpc-handle-events-that-raise-an-exception-without-overflowing.patch new file mode 100644 index 00000000000..a24627783b4 --- /dev/null +++ b/queue-2.6.37/perf-powerpc-handle-events-that-raise-an-exception-without-overflowing.patch @@ -0,0 +1,76 @@ +From 0837e3242c73566fc1c0196b4ec61779c25ffc93 Mon Sep 17 00:00:00 2001 +From: Anton Blanchard +Date: Wed, 9 Mar 2011 14:38:42 +1100 +Subject: perf, powerpc: Handle events that raise an exception without overflowing + +From: Anton Blanchard + +commit 0837e3242c73566fc1c0196b4ec61779c25ffc93 upstream. + +Events on POWER7 can roll back if a speculative event doesn't +eventually complete. Unfortunately in some rare cases they will +raise a performance monitor exception. We need to catch this to +ensure we reset the PMC. In all cases the PMC will be 256 or less +cycles from overflow. + +Signed-off-by: Anton Blanchard +Signed-off-by: Peter Zijlstra +LKML-Reference: <20110309143842.6c22845e@kryten> +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + arch/powerpc/include/asm/reg.h | 1 + + arch/powerpc/kernel/perf_event.c | 24 +++++++++++++++++++++++- + 2 files changed, 24 insertions(+), 1 deletion(-) + +--- a/arch/powerpc/include/asm/reg.h ++++ b/arch/powerpc/include/asm/reg.h +@@ -878,6 +878,7 @@ + #define PV_970 0x0039 + #define PV_POWER5 0x003A + #define PV_POWER5p 0x003B ++#define PV_POWER7 0x003F + #define PV_970FX 0x003C + #define PV_630 0x0040 + #define PV_630p 0x0041 +--- a/arch/powerpc/kernel/perf_event.c ++++ b/arch/powerpc/kernel/perf_event.c +@@ -1268,6 +1268,28 @@ unsigned long perf_instruction_pointer(s + return ip; + } + ++static bool pmc_overflow(unsigned long val) ++{ ++ if ((int)val < 0) ++ return true; ++ ++ /* ++ * Events on POWER7 can roll back if a speculative event doesn't ++ * eventually complete. Unfortunately in some rare cases they will ++ * raise a performance monitor exception. We need to catch this to ++ * ensure we reset the PMC. In all cases the PMC will be 256 or less ++ * cycles from overflow. ++ * ++ * We only do this if the first pass fails to find any overflowing ++ * PMCs because a user might set a period of less than 256 and we ++ * don't want to mistakenly reset them. ++ */ ++ if (__is_processor(PV_POWER7) && ((0x80000000 - val) <= 256)) ++ return true; ++ ++ return false; ++} ++ + /* + * Performance monitor interrupt stuff + */ +@@ -1315,7 +1337,7 @@ static void perf_event_interrupt(struct + if (is_limited_pmc(i + 1)) + continue; + val = read_pmc(i + 1); +- if ((int)val < 0) ++ if (pmc_overflow(val)) + write_pmc(i + 1, 0); + } + } diff --git a/queue-2.6.37/perf-tools-version-incorrect-with-some-versions-of-grep.patch b/queue-2.6.37/perf-tools-version-incorrect-with-some-versions-of-grep.patch new file mode 100644 index 00000000000..c1cdb7cc18b --- /dev/null +++ b/queue-2.6.37/perf-tools-version-incorrect-with-some-versions-of-grep.patch @@ -0,0 +1,47 @@ +From 58d406ed6a5f1ca4bc1dba5390b718c67847fa5f Mon Sep 17 00:00:00 2001 +From: Josh Hunt +Date: Tue, 15 Mar 2011 19:16:40 -0700 +Subject: perf tools: Version incorrect with some versions of grep + +From: Josh Hunt + +commit 58d406ed6a5f1ca4bc1dba5390b718c67847fa5f upstream. + +Some versions of grep don't treat '\s' properly. When building perf on such +systems and using a kernel tarball the perf version is unable to be determined +from the main kernel Makefile and the user is left with a version of '..'. +Replacing the use of '\s' with '[[:space:]]', which should work in all grep +versions, gives a usable version number. + +Reported-by: Tapan Dhimant +Cc: Ingo Molnar +Cc: Paul Mackerras +Cc: Peter Zijlstra +Cc: Tapan Dhimant +Cc: linux-kernel@vger.kernel.org +LKML-Reference: <1300241800-30281-1-git-send-email-johunt@akamai.com> +Signed-off-by: Josh Hunt +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Greg Kroah-Hartman + +--- + tools/perf/util/PERF-VERSION-GEN | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/tools/perf/util/PERF-VERSION-GEN ++++ b/tools/perf/util/PERF-VERSION-GEN +@@ -23,10 +23,10 @@ if test -d ../../.git -o -f ../../.git & + then + VN=$(echo "$VN" | sed -e 's/-/./g'); + else +- eval `grep '^VERSION\s*=' ../../Makefile|tr -d ' '` +- eval `grep '^PATCHLEVEL\s*=' ../../Makefile|tr -d ' '` +- eval `grep '^SUBLEVEL\s*=' ../../Makefile|tr -d ' '` +- eval `grep '^EXTRAVERSION\s*=' ../../Makefile|tr -d ' '` ++ eval $(grep '^VERSION[[:space:]]*=' ../../Makefile|tr -d ' ') ++ eval $(grep '^PATCHLEVEL[[:space:]]*=' ../../Makefile|tr -d ' ') ++ eval $(grep '^SUBLEVEL[[:space:]]*=' ../../Makefile|tr -d ' ') ++ eval $(grep '^EXTRAVERSION[[:space:]]*=' ../../Makefile|tr -d ' ') + + VN="${VERSION}.${PATCHLEVEL}.${SUBLEVEL}${EXTRAVERSION}" + fi diff --git a/queue-2.6.37/rpc-killing-rpc-tasks-races-fixed.patch b/queue-2.6.37/rpc-killing-rpc-tasks-races-fixed.patch new file mode 100644 index 00000000000..dae236d38de --- /dev/null +++ b/queue-2.6.37/rpc-killing-rpc-tasks-races-fixed.patch @@ -0,0 +1,62 @@ +From 8e26de238fd794c8ea56a5c98bf67c40cfeb051d Mon Sep 17 00:00:00 2001 +From: Stanislav Kinsbursky +Date: Thu, 17 Mar 2011 18:54:23 +0300 +Subject: RPC: killing RPC tasks races fixed + +From: Stanislav Kinsbursky + +commit 8e26de238fd794c8ea56a5c98bf67c40cfeb051d upstream. + +RPC task RPC_TASK_QUEUED bit is set must be checked before trying to wake up +task rpc_killall_tasks() because task->tk_waitqueue can not be set (equal to +NULL). +Also, as Trond Myklebust mentioned, such approach (instead of checking +tk_waitqueue to NULL) allows us to "optimise away the call to +rpc_wake_up_queued_task() altogether for those +tasks that aren't queued". + +Here is an example of dereferencing of tk_waitqueue equal to NULL: + +CPU 0 CPU 1 CPU 2 +-------------------- --------------------- -------------------------- +nfs4_run_open_task +rpc_run_task +rpc_execute +rpc_set_active +rpc_make_runnable +(waiting) + rpc_async_schedule + nfs4_open_prepare + nfs_wait_on_sequence + nfs_umount_begin + rpc_killall_tasks + rpc_wake_up_task + rpc_wake_up_queued_task + spin_lock(tk_waitqueue == NULL) + BUG() + rpc_sleep_on + spin_lock(&q->lock) + __rpc_sleep_on + task->tk_waitqueue = q + +Signed-off-by: Stanislav Kinsbursky +Signed-off-by: Trond Myklebust +Signed-off-by: Greg Kroah-Hartman + +--- + net/sunrpc/clnt.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/net/sunrpc/clnt.c ++++ b/net/sunrpc/clnt.c +@@ -436,7 +436,9 @@ void rpc_killall_tasks(struct rpc_clnt * + if (!(rovr->tk_flags & RPC_TASK_KILLED)) { + rovr->tk_flags |= RPC_TASK_KILLED; + rpc_exit(rovr, -EIO); +- rpc_wake_up_queued_task(rovr->tk_waitqueue, rovr); ++ if (RPC_IS_QUEUED(rovr)) ++ rpc_wake_up_queued_task(rovr->tk_waitqueue, ++ rovr); + } + } + spin_unlock(&clnt->cl_lock); diff --git a/queue-2.6.37/scsi_dh_alua-fix-deadlock-in-stpg_endio.patch b/queue-2.6.37/scsi_dh_alua-fix-deadlock-in-stpg_endio.patch new file mode 100644 index 00000000000..d360595254d --- /dev/null +++ b/queue-2.6.37/scsi_dh_alua-fix-deadlock-in-stpg_endio.patch @@ -0,0 +1,35 @@ +From ed0f36bc5719b25659b637f80ceea85494b84502 Mon Sep 17 00:00:00 2001 +From: Joseph Gruher +Date: Wed, 5 Jan 2011 16:00:21 -0500 +Subject: [SCSI] scsi_dh_alua: fix deadlock in stpg_endio + +From: Joseph Gruher + +commit ed0f36bc5719b25659b637f80ceea85494b84502 upstream. + +The use of blk_execute_rq_nowait() implies __blk_put_request() is needed +in stpg_endio() rather than blk_put_request() -- blk_finish_request() is +called with queue lock already held. + +Signed-off-by: Joseph Gruher +Signed-off-by: Ilgu Hong +Signed-off-by: Mike Snitzer +Signed-off-by: James Bottomley +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/device_handler/scsi_dh_alua.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/scsi/device_handler/scsi_dh_alua.c ++++ b/drivers/scsi/device_handler/scsi_dh_alua.c +@@ -285,7 +285,8 @@ static void stpg_endio(struct request *r + print_alua_state(h->state)); + } + done: +- blk_put_request(req); ++ req->end_io_data = NULL; ++ __blk_put_request(req->q, req); + if (h->callback_fn) { + h->callback_fn(h->callback_data, err); + h->callback_fn = h->callback_data = NULL; diff --git a/queue-2.6.37/series b/queue-2.6.37/series index b15316a1027..b0efa22bc1e 100644 --- a/queue-2.6.37/series +++ b/queue-2.6.37/series @@ -49,3 +49,30 @@ usb-move-usbcore-away-from-hcd-state.patch xhci-update-internal-dequeue-pointers-after-stalls.patch xhci-fix-cycle-bit-calculation-during-stall-handling.patch usb-add-support-for-superspeed-isoc-endpoints.patch +nfs-fix-a-decoding-problem-in-nfs3_decode_dirent.patch +alsa-hda-realtek-alc88x-do-not-over-initialize-speakers-and-hp-that-are-primary-outputs.patch +alsa-hda-fix-digital-mic-selection-in-mixer-on-92hd8x-codecs.patch +alsa-hda-initialize-special-cases-for-input-src-in-init-phase.patch +hid-hid-magicmouse-correct-touch-orientation-direction.patch +hid-add-support-for-ortek-pkb-1700.patch +pci-remove-quirk-for-pre-production-systems.patch +pci-add-more-checking-to-ich-region-quirks.patch +pci-do-not-create-quirk-i-o-regions-below-pcibios_min_io-for-ich.patch +pci-sysfs-fix-failure-path-for-addition-of-vpd-attribute.patch +alsa-sound-pci-asihpi-check-adapter-index-in-hpi_ioctl.patch +alsa-aloop-fix-possible-irq-lock-inversion.patch +alsa-ctxfi-fix-incorrect-spdif-status-bit-mask.patch +alsa-ctxfi-fix-spdif-status-retrieval.patch +alsa-ctxfi-clear-input-settings-before-initialization.patch +scsi_dh_alua-fix-deadlock-in-stpg_endio.patch +sunrpc-ensure-we-always-run-the-tk_callback-before-tk_action.patch +rpc-killing-rpc-tasks-races-fixed.patch +perf-fix-the-software-events-state-check.patch +perf-handle-stopped-state-with-tracepoints.patch +perf-powerpc-handle-events-that-raise-an-exception-without-overflowing.patch +perf-tools-version-incorrect-with-some-versions-of-grep.patch +ext3-always-set-dx_node-s-fake_dirent-explicitly.patch +call_function_many-fix-list-delete-vs-add-race.patch +call_function_many-add-missing-ordering.patch +smp_call_function_many-handle-concurrent-clearing-of-mask.patch +x86-flush-tlb-if-pgd-entry-is-changed-in-i386-pae-mode.patch diff --git a/queue-2.6.37/smp_call_function_many-handle-concurrent-clearing-of-mask.patch b/queue-2.6.37/smp_call_function_many-handle-concurrent-clearing-of-mask.patch new file mode 100644 index 00000000000..74306932521 --- /dev/null +++ b/queue-2.6.37/smp_call_function_many-handle-concurrent-clearing-of-mask.patch @@ -0,0 +1,82 @@ +From 723aae25d5cdb09962901d36d526b44d4be1051c Mon Sep 17 00:00:00 2001 +From: Milton Miller +Date: Tue, 15 Mar 2011 13:27:17 -0600 +Subject: smp_call_function_many: handle concurrent clearing of mask + +From: Milton Miller + +commit 723aae25d5cdb09962901d36d526b44d4be1051c upstream. + +Mike Galbraith reported finding a lockup ("perma-spin bug") where the +cpumask passed to smp_call_function_many was cleared by other cpu(s) +while a cpu was preparing its call_data block, resulting in no cpu to +clear the last ref and unlock the block. + +Having cpus clear their bit asynchronously could be useful on a mask of +cpus that might have a translation context, or cpus that need a push to +complete an rcu window. + +Instead of adding a BUG_ON and requiring yet another cpumask copy, just +detect the race and handle it. + +Note: arch_send_call_function_ipi_mask must still handle an empty +cpumask because the data block is globally visible before the that arch +callback is made. And (obviously) there are no guarantees to which cpus +are notified if the mask is changed during the call; only cpus that were +online and had their mask bit set during the whole call are guaranteed +to be called. + +Reported-by: Mike Galbraith +Reported-by: Jan Beulich +Acked-by: Jan Beulich +Signed-off-by: Milton Miller +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/smp.c | 13 ++++++++++--- + 1 file changed, 10 insertions(+), 3 deletions(-) + +--- a/kernel/smp.c ++++ b/kernel/smp.c +@@ -440,7 +440,7 @@ void smp_call_function_many(const struct + { + struct call_function_data *data; + unsigned long flags; +- int cpu, next_cpu, this_cpu = smp_processor_id(); ++ int refs, cpu, next_cpu, this_cpu = smp_processor_id(); + + /* + * Can deadlock when called with interrupts disabled. +@@ -451,7 +451,7 @@ void smp_call_function_many(const struct + WARN_ON_ONCE(cpu_online(this_cpu) && irqs_disabled() + && !oops_in_progress); + +- /* So, what's a CPU they want? Ignoring this one. */ ++ /* Try to fastpath. So, what's a CPU they want? Ignoring this one. */ + cpu = cpumask_first_and(mask, cpu_online_mask); + if (cpu == this_cpu) + cpu = cpumask_next_and(cpu, mask, cpu_online_mask); +@@ -509,6 +509,13 @@ void smp_call_function_many(const struct + /* We rely on the "and" being processed before the store */ + cpumask_and(data->cpumask, mask, cpu_online_mask); + cpumask_clear_cpu(this_cpu, data->cpumask); ++ refs = cpumask_weight(data->cpumask); ++ ++ /* Some callers race with other cpus changing the passed mask */ ++ if (unlikely(!refs)) { ++ csd_unlock(&data->csd); ++ return; ++ } + + raw_spin_lock_irqsave(&call_function.lock, flags); + /* +@@ -522,7 +529,7 @@ void smp_call_function_many(const struct + * to the cpumask before this write to refs, which indicates + * data is on the list and is ready to be processed. + */ +- atomic_set(&data->refs, cpumask_weight(data->cpumask)); ++ atomic_set(&data->refs, refs); + raw_spin_unlock_irqrestore(&call_function.lock, flags); + + /* diff --git a/queue-2.6.37/sunrpc-ensure-we-always-run-the-tk_callback-before-tk_action.patch b/queue-2.6.37/sunrpc-ensure-we-always-run-the-tk_callback-before-tk_action.patch new file mode 100644 index 00000000000..80a92e467c4 --- /dev/null +++ b/queue-2.6.37/sunrpc-ensure-we-always-run-the-tk_callback-before-tk_action.patch @@ -0,0 +1,44 @@ +From e020c6800c9621a77223bf2c1ff68180e41e8ebf Mon Sep 17 00:00:00 2001 +From: Trond Myklebust +Date: Tue, 15 Mar 2011 19:56:30 -0400 +Subject: SUNRPC: Ensure we always run the tk_callback before tk_action + +From: Trond Myklebust + +commit e020c6800c9621a77223bf2c1ff68180e41e8ebf upstream. + +This fixes a race in which the task->tk_callback() puts the rpc_task +to sleep, setting a new callback. Under certain circumstances, the current +code may end up executing the task->tk_action before it gets round to the +callback. + +Signed-off-by: Trond Myklebust +Signed-off-by: Greg Kroah-Hartman + +--- + net/sunrpc/sched.c | 14 ++++++-------- + 1 file changed, 6 insertions(+), 8 deletions(-) + +--- a/net/sunrpc/sched.c ++++ b/net/sunrpc/sched.c +@@ -623,14 +623,12 @@ static void __rpc_execute(struct rpc_tas + save_callback = task->tk_callback; + task->tk_callback = NULL; + save_callback(task); +- } +- +- /* +- * Perform the next FSM step. +- * tk_action may be NULL when the task has been killed +- * by someone else. +- */ +- if (!RPC_IS_QUEUED(task)) { ++ } else { ++ /* ++ * Perform the next FSM step. ++ * tk_action may be NULL when the task has been killed ++ * by someone else. ++ */ + if (task->tk_action == NULL) + break; + task->tk_action(task); diff --git a/queue-2.6.37/x86-flush-tlb-if-pgd-entry-is-changed-in-i386-pae-mode.patch b/queue-2.6.37/x86-flush-tlb-if-pgd-entry-is-changed-in-i386-pae-mode.patch new file mode 100644 index 00000000000..872cfdeff85 --- /dev/null +++ b/queue-2.6.37/x86-flush-tlb-if-pgd-entry-is-changed-in-i386-pae-mode.patch @@ -0,0 +1,80 @@ +From 4981d01eada5354d81c8929d5b2836829ba3df7b Mon Sep 17 00:00:00 2001 +From: Shaohua Li +Date: Wed, 16 Mar 2011 11:37:29 +0800 +Subject: x86: Flush TLB if PGD entry is changed in i386 PAE mode + +From: Shaohua Li + +commit 4981d01eada5354d81c8929d5b2836829ba3df7b upstream. + +According to intel CPU manual, every time PGD entry is changed in i386 PAE +mode, we need do a full TLB flush. Current code follows this and there is +comment for this too in the code. + +But current code misses the multi-threaded case. A changed page table +might be used by several CPUs, every such CPU should flush TLB. Usually +this isn't a problem, because we prepopulate all PGD entries at process +fork. But when the process does munmap and follows new mmap, this issue +will be triggered. + +When it happens, some CPUs keep doing page faults: + + http://marc.info/?l=linux-kernel&m=129915020508238&w=2 + +Reported-by: Yasunori Goto +Tested-by: Yasunori Goto +Reviewed-by: Rik van Riel +Signed-off-by: Shaohua Li +Cc: Mallick Asit K +Cc: Linus Torvalds +Cc: Andrew Morton +Cc: linux-mm +LKML-Reference: <1300246649.2337.95.camel@sli10-conroe> +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/include/asm/pgtable-3level.h | 11 +++-------- + arch/x86/mm/pgtable.c | 3 +-- + 2 files changed, 4 insertions(+), 10 deletions(-) + +--- a/arch/x86/include/asm/pgtable-3level.h ++++ b/arch/x86/include/asm/pgtable-3level.h +@@ -69,8 +69,6 @@ static inline void native_pmd_clear(pmd_ + + static inline void pud_clear(pud_t *pudp) + { +- unsigned long pgd; +- + set_pud(pudp, __pud(0)); + + /* +@@ -79,13 +77,10 @@ static inline void pud_clear(pud_t *pudp + * section 8.1: in PAE mode we explicitly have to flush the + * TLB via cr3 if the top-level pgd is changed... + * +- * Make sure the pud entry we're updating is within the +- * current pgd to avoid unnecessary TLB flushes. ++ * Currently all places where pud_clear() is called either have ++ * flush_tlb_mm() followed or don't need TLB flush (x86_64 code or ++ * pud_clear_bad()), so we don't need TLB flush here. + */ +- pgd = read_cr3(); +- if (__pa(pudp) >= pgd && __pa(pudp) < +- (pgd + sizeof(pgd_t)*PTRS_PER_PGD)) +- write_cr3(pgd); + } + + #ifdef CONFIG_SMP +--- a/arch/x86/mm/pgtable.c ++++ b/arch/x86/mm/pgtable.c +@@ -168,8 +168,7 @@ void pud_populate(struct mm_struct *mm, + * section 8.1: in PAE mode we explicitly have to flush the + * TLB via cr3 if the top-level pgd is changed... + */ +- if (mm == current->active_mm) +- write_cr3(read_cr3()); ++ flush_tlb_mm(mm); + } + #else /* !CONFIG_X86_PAE */ +