rpms
/
kernel
2
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

- Update to kernel 2.6.33.7 

- Drop patches merged in 2.6.33.7:
    drm-i915-add-reclaimable-to-page-allocations.patch
    drm-i915-fix-hibernate-memory-corruption.patch
    drm-radeon-fix-shared-ddc-handling.patch
    linux-2.6-acpi-sleep-live-sci-live.patch
    drm-i915-make-G4X-style-PLL-search-more-permissive.patch
    mac80211-do-not-wipe-out-old-supported-rates.patch
    mac80211-fix-supported-rates-IE-if-AP-doesnt-give-us-its-rates.patch
    iwlwifi-cancel-scan-watchdog-in-iwl_bg_abort_scan.patch
    sched-fix-over-scheduling-bug.patch
    ethtool-fix-buffer-overflow.patch
    x86-debug-clear-reserved-bits-of-dr6.patch
    x86-debug-send-sigtrap-for-user-icebp.patch
    cifs-fix-malicious-redirect-problem-in-the-dns-lookup-code.patch
- Revert broken ssb patch from 2.6.33.7:
    ssb-handle-netbook-devices-where-the-sprom-address-is-changed.patch
This commit is contained in:
Chuck Ebbert 2010-08-14 23:31:39 -04:00
parent b5010d0d56
commit 7139dd832a
17 changed files with 258 additions and 1047 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

202
cifs-fix-malicious-redirect-problem-in-the-dns-lookup-code.patch
View File

@ -1,202 +0,0 @@
From: David Howells <dhowells@redhat.com>
Date: Thu, 22 Jul 2010 11:53:18 +0000 (+0100)
Subject: CIFS: Fix a malicious redirect problem in the DNS lookup code
X-Git-Tag: v2.6.35-rc6~6
X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Ftorvalds%2Flinux-2.6.git;a=commitdiff_plain;h=4c0c03ca54f72fdd5912516ad0a23ec5cf01bda7
CIFS: Fix a malicious redirect problem in the DNS lookup code
[ trivial backport to 2.6.3[23] : cebbert@redhat.com ]
Fix the security problem in the CIFS filesystem DNS lookup code in which a
malicious redirect could be installed by a random user by simply adding a
result record into one of their keyrings with add_key() and then invoking a
CIFS CFS lookup [CVE-2010-2524].
This is done by creating an internal keyring specifically for the caching of
DNS lookups. To enforce the use of this keyring, the module init routine
creates a set of override credentials with the keyring installed as the thread
keyring and instructs request_key() to only install lookup result keys in that
keyring.
The override is then applied around the call to request_key().
This has some additional benefits when a kernel service uses this module to
request a key:
(1) The result keys are owned by root, not the user that caused the lookup.
(2) The result keys don't pop up in the user's keyrings.
(3) The result keys don't come out of the quota of the user that caused the
lookup.
The keyring can be viewed as root by doing cat /proc/keys:
2a0ca6c3 I----- 1 perm 1f030000 0 0 keyring .dns_resolver: 1/4
It can then be listed with 'keyctl list' by root.
# keyctl list 0x2a0ca6c3
1 key in keyring:
726766307: --alswrv 0 0 dns_resolver: foo.bar.com
Signed-off-by: David Howells <dhowells@redhat.com>
Reviewed-and-Tested-by: Jeff Layton <jlayton@redhat.com>
Acked-by: Steve French <smfrench@gmail.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
---
diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
index 484e52b..2cb1a70 100644
--- a/fs/cifs/cifsfs.c
+++ b/fs/cifs/cifsfs.c
@@ -923,7 +923,7 @@ init_cifs(void)
goto out_unregister_filesystem;
#endif
#ifdef CONFIG_CIFS_DFS_UPCALL
- rc = register_key_type(&key_type_dns_resolver);
+ rc = cifs_init_dns_resolver();
if (rc)
goto out_unregister_key_type;
#endif
@@ -935,7 +935,7 @@ init_cifs(void)
out_unregister_resolver_key:
#ifdef CONFIG_CIFS_DFS_UPCALL
- unregister_key_type(&key_type_dns_resolver);
+ cifs_exit_dns_resolver();
out_unregister_key_type:
#endif
#ifdef CONFIG_CIFS_UPCALL
@@ -961,7 +961,7 @@ exit_cifs(void)
cifs_proc_clean();
#ifdef CONFIG_CIFS_DFS_UPCALL
cifs_dfs_release_automount_timer();
- unregister_key_type(&key_type_dns_resolver);
+ cifs_exit_dns_resolver();
#endif
#ifdef CONFIG_CIFS_UPCALL
unregister_key_type(&cifs_spnego_key_type);
diff --git a/fs/cifs/dns_resolve.c b/fs/cifs/dns_resolve.c
index 4db2c5e..49315cb 100644
--- a/fs/cifs/dns_resolve.c
+++ b/fs/cifs/dns_resolve.c
@@ -24,12 +24,16 @@
* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
*/
+#include <linux/keyctl.h>
+#include <linux/key-type.h>
#include <keys/user-type.h>
#include "dns_resolve.h"
#include "cifsglob.h"
#include "cifsproto.h"
#include "cifs_debug.h"
+static const struct cred *dns_resolver_cache;
+
/* Checks if supplied name is IP address
* returns:
* 1 - name is IP
@@ -94,6 +98,7 @@ struct key_type key_type_dns_resolver = {
int
dns_resolve_server_name_to_ip(const char *unc, char **ip_addr)
{
+ const struct cred *saved_cred;
int rc = -EAGAIN;
struct key *rkey = ERR_PTR(-EAGAIN);
char *name;
@@ -133,8 +138,15 @@ dns_resolve_server_name_to_ip(const char *unc, char **ip_addr)
goto skip_upcall;
}
+ saved_cred = override_creds(dns_resolver_cache);
rkey = request_key(&key_type_dns_resolver, name, "");
+ revert_creds(saved_cred);
if (!IS_ERR(rkey)) {
+ if (!(rkey->perm & KEY_USR_VIEW)) {
+ down_read(&rkey->sem);
+ rkey->perm |= KEY_USR_VIEW;
+ up_read(&rkey->sem);
+ }
len = rkey->type_data.x[0];
data = rkey->payload.data;
} else {
@@ -165,4 +177,61 @@ out:
return rc;
}
+int __init cifs_init_dns_resolver(void)
+{
+ struct cred *cred;
+ struct key *keyring;
+ int ret;
+
+ printk(KERN_NOTICE "Registering the %s key type\n",
+ key_type_dns_resolver.name);
+
+ /* create an override credential set with a special thread keyring in
+ * which DNS requests are cached
+ *
+ * this is used to prevent malicious redirections from being installed
+ * with add_key().
+ */
+ cred = prepare_kernel_cred(NULL);
+ if (!cred)
+ return -ENOMEM;
+
+ keyring = key_alloc(&key_type_keyring, ".dns_resolver", 0, 0, cred,
+ (KEY_POS_ALL & ~KEY_POS_SETATTR) |
+ KEY_USR_VIEW | KEY_USR_READ,
+ KEY_ALLOC_NOT_IN_QUOTA);
+ if (IS_ERR(keyring)) {
+ ret = PTR_ERR(keyring);
+ goto failed_put_cred;
+ }
+
+ ret = key_instantiate_and_link(keyring, NULL, 0, NULL, NULL);
+ if (ret < 0)
+ goto failed_put_key;
+
+ ret = register_key_type(&key_type_dns_resolver);
+ if (ret < 0)
+ goto failed_put_key;
+
+ /* instruct request_key() to use this special keyring as a cache for
+ * the results it looks up */
+ cred->thread_keyring = keyring;
+ cred->jit_keyring = KEY_REQKEY_DEFL_THREAD_KEYRING;
+ dns_resolver_cache = cred;
+ return 0;
+
+failed_put_key:
+ key_put(keyring);
+failed_put_cred:
+ put_cred(cred);
+ return ret;
+}
+void __exit cifs_exit_dns_resolver(void)
+{
+ key_revoke(dns_resolver_cache->thread_keyring);
+ unregister_key_type(&key_type_dns_resolver);
+ put_cred(dns_resolver_cache);
+ printk(KERN_NOTICE "Unregistered %s key type\n",
+ key_type_dns_resolver.name);
+}
diff --git a/fs/cifs/dns_resolve.h b/fs/cifs/dns_resolve.h
index 966e928..26b9eaa 100644
--- a/fs/cifs/dns_resolve.h
+++ b/fs/cifs/dns_resolve.h
@@ -24,8 +24,8 @@
#define _DNS_RESOLVE_H
#ifdef __KERNEL__
-#include <linux/key-type.h>
-extern struct key_type key_type_dns_resolver;
+extern int __init cifs_init_dns_resolver(void);
+extern void __exit cifs_exit_dns_resolver(void);
extern int dns_resolve_server_name_to_ip(const char *unc, char **ip_addr);
#endif /* KERNEL */

48
drm-i915-add-reclaimable-to-page-allocations.patch
View File

@ -1,48 +0,0 @@
From: Linus Torvalds <torvalds@linux-foundation.org>
Date: Sun, 18 Jul 2010 16:44:37 +0000 (-0700)
Subject: drm/i915: add 'reclaimable' to i915 self-reclaimable page allocations
X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Ftorvalds%2Flinux-2.6.git;a=commitdiff_plain;h=cd9f040df6ce46573760a507cb88192d05d27d86
drm/i915: add 'reclaimable' to i915 self-reclaimable page allocations
The hibernate issues that got fixed in commit 985b823b9192 ("drm/i915:
fix hibernation since i915 self-reclaim fixes") turn out to have been
incomplete. Vefa Bicakci tested lots of hibernate cycles, and without
the __GFP_RECLAIMABLE flag the system eventually fails to resume.
With the flag added, Vefa can apparently hibernate forever (or until he
gets bored running his automated scripts, whichever comes first).
The reclaimable flag was there originally, and was one of the flags that
were dropped (unintentionally) by commit 4bdadb978569 ("drm/i915:
Selectively enable self-reclaim") that introduced all these problems,
but I didn't want to just blindly add back all the flags in commit
985b823b9192, and it looked like __GFP_RECLAIM wasn't necessary. It
clearly was.
I still suspect that there is some subtle reason we're missing that
causes the problems, but __GFP_RECLAIMABLE is certainly not wrong to use
in this context, and is what the code historically used. And we have no
idea what the causes the corruption without it.
Reported-and-tested-by: M. Vefa Bicakci <bicave@superonline.com>
Cc: Dave Airlie <airlied@gmail.com>
Cc: Chris Wilson <chris@chris-wilson.co.uk>
Cc: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
Cc: Hugh Dickins <hugh.dickins@tiscali.co.uk>
Cc: stable@kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
---
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index 0743858..8757ecf 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -2241,6 +2241,7 @@ i915_gem_object_get_pages(struct drm_gem_object *obj,
page = read_cache_page_gfp(mapping, i,
GFP_HIGHUSER |
__GFP_COLD |
+ __GFP_RECLAIMABLE |
gfpmask);
if (IS_ERR(page))
goto err_pages;

36
drm-i915-fix-hibernate-memory-corruption.patch
View File

@ -1,36 +0,0 @@
From 0121d50088a9e04f3bbbee14043cd89164bdf4e6 Mon Sep 17 00:00:00 2001
From: Linus Torvalds <torvalds@linux-foundation.org>
Date: Fri, 2 Jul 2010 09:56:19 +1000
Subject: [PATCH] drm/i915: fix hibernation since 4bdadb9785696439c6e2b3efe34aa76df1149c83
Since 4bdadb9785696439c6e2b3efe34aa76df1149c83, we've been passing
GFP_MOVABLE where we weren't before caused hibernate on Intel hardware
to results in a lot of memory corruptions on resume.
[airlied: linus please enhance commit msg if you commit this]
http://bugzilla.kernel.org/show_bug.cgi?id=13811
Reported-by: Evengi Golov (in bugzilla)
Signed-off-by: Dave Airlie <airlied@redhat.com>
Tested-by: M. Vefa Bicakci <bicave@superonline.com>
---
drivers/gpu/drm/i915/i915_gem.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index 9ded3da..0743858 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -2239,7 +2239,7 @@ i915_gem_object_get_pages(struct drm_gem_object *obj,
mapping = inode->i_mapping;
for (i = 0; i < page_count; i++) {
page = read_cache_page_gfp(mapping, i,
- mapping_gfp_mask (mapping) |
+ GFP_HIGHUSER |
__GFP_COLD |
gfpmask);
if (IS_ERR(page))
--
1.7.0.1

51
drm-i915-make-G4X-style-PLL-search-more-permissive.patch
View File

@ -1,51 +0,0 @@
drm/i915: Make G4X-style PLL search more permissive
Fixes an Ironlake laptop with a 68.940MHz 1280x800 panel and 120MHz SSC
reference clock.
More generally, the 0.488% tolerance used before is just too tight to
reliably find a PLL setting. I extracted the search algorithm and
modified it to find the dot clocks with maximum error over the valid
range for the given output type:
http://people.freedesktop.org/~ajax/intel_g4x_find_best_pll.c
This gave:
Worst dotclock for Ironlake DAC refclk is 350000kHz (error 0.00571)
Worst dotclock for Ironlake SL-LVDS refclk is 102321kHz (error 0.00524)
Worst dotclock for Ironlake DL-LVDS refclk is 219642kHz (error 0.00488)
Worst dotclock for Ironlake SL-LVDS SSC refclk is 84374kHz (error 0.00529)
Worst dotclock for Ironlake DL-LVDS SSC refclk is 183035kHz (error 0.00488)
Worst dotclock for G4X SDVO refclk is 50000kHz (error 0.17332)
Worst dotclock for G4X HDMI refclk is 334400kHz (error 0.00478)
Worst dotclock for G4X SL-LVDS refclk is 95571kHz (error 0.00449)
Worst dotclock for G4X DL-LVDS refclk is 224000kHz (error 0.00510)
The SDVO number looks a bit suspicious, which I haven't tracked down
yet. But it's clear that the old threshold is too tight.
Signed-off-by: Adam Jackson <ajax at redhat.com>
[ RHBZ #572799 ]
---
drivers/gpu/drm/i915/intel_display.c | 4 ++--
1 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index a8d65b7..4b17722 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -862,8 +862,8 @@ intel_g4x_find_best_PLL(const intel_limit_t *limit, struct drm_crtc *crtc,
intel_clock_t clock;
int max_n;
bool found;
- /* approximately equals target * 0.00488 */
- int err_most = (target >> 8) + (target >> 10);
+ /* approximately equals target * 0.00585 */
+ int err_most = (target >> 8) + (target >> 9);
found = false;
if (intel_pipe_has_type(crtc, INTEL_OUTPUT_LVDS)) {
--
1.7.1

99
drm-intel-945gm-stability-fixes.patch
View File

@ -1,99 +0,0 @@
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index 0d05c6f..b87f65d 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -4967,6 +4967,16 @@ i915_gem_load(struct drm_device *dev)
list_add(&dev_priv->mm.shrink_list, &shrink_list);
spin_unlock(&shrink_list_lock);
+ /* On GEN3 we really need to make sure the ARB C3 LP bit is set */
+ if (IS_GEN3(dev)) {
+ u32 tmp = I915_READ(MI_ARB_STATE);
+ if (!(tmp & MI_ARB_C3_LP_WRITE_ENABLE)) {
+ /* arb state is a masked write, so set bit + bit in mask */
+ tmp = MI_ARB_C3_LP_WRITE_ENABLE | (MI_ARB_C3_LP_WRITE_ENABLE << MI_ARB_MASK_SHIFT);
+ I915_WRITE(MI_ARB_STATE, tmp);
+ }
+ }
+
/* Old X drivers will take 0-2 for front, back, depth buffers */
if (!drm_core_check_feature(dev, DRIVER_MODESET))
dev_priv->fence_reg_start = 3;
diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
index 4cbc521..4543975 100644
--- a/drivers/gpu/drm/i915/i915_reg.h
+++ b/drivers/gpu/drm/i915/i915_reg.h
@@ -357,6 +357,70 @@
#define LM_BURST_LENGTH 0x00000700
#define LM_FIFO_WATERMARK 0x0000001F
#define MI_ARB_STATE 0x020e4 /* 915+ only */
+#define MI_ARB_MASK_SHIFT 16 /* shift for enable bits */
+
+/* Make render/texture TLB fetches lower priorty than associated data
+ * fetches. This is not turned on by default
+ */
+#define MI_ARB_RENDER_TLB_LOW_PRIORITY (1 << 15)
+
+/* Isoch request wait on GTT enable (Display A/B/C streams).
+ * Make isoch requests stall on the TLB update. May cause
+ * display underruns (test mode only)
+ */
+#define MI_ARB_ISOCH_WAIT_GTT (1 << 14)
+
+/* Block grant count for isoch requests when block count is
+ * set to a finite value.
+ */
+#define MI_ARB_BLOCK_GRANT_MASK (3 << 12)
+#define MI_ARB_BLOCK_GRANT_8 (0 << 12) /* for 3 display planes */
+#define MI_ARB_BLOCK_GRANT_4 (1 << 12) /* for 2 display planes */
+#define MI_ARB_BLOCK_GRANT_2 (2 << 12) /* for 1 display plane */
+#define MI_ARB_BLOCK_GRANT_0 (3 << 12) /* don't use */
+
+/* Enable render writes to complete in C2/C3/C4 power states.
+ * If this isn't enabled, render writes are prevented in low
+ * power states. That seems bad to me.
+ */
+#define MI_ARB_C3_LP_WRITE_ENABLE (1 << 11)
+
+/* This acknowledges an async flip immediately instead
+ * of waiting for 2TLB fetches.
+ */
+#define MI_ARB_ASYNC_FLIP_ACK_IMMEDIATE (1 << 10)
+
+/* Enables non-sequential data reads through arbiter
+ */
+#define MI_ARB_DUAL_DATA_PHASE_DISABLE (1 << 9)
+
+/* Disable FSB snooping of cacheable write cycles from binner/render
+ * command stream
+ */
+#define MI_ARB_CACHE_SNOOP_DISABLE (1 << 8)
+
+/* Arbiter time slice for non-isoch streams */
+#define MI_ARB_TIME_SLICE_MASK (7 << 5)
+#define MI_ARB_TIME_SLICE_1 (0 << 5)
+#define MI_ARB_TIME_SLICE_2 (1 << 5)
+#define MI_ARB_TIME_SLICE_4 (2 << 5)
+#define MI_ARB_TIME_SLICE_6 (3 << 5)
+#define MI_ARB_TIME_SLICE_8 (4 << 5)
+#define MI_ARB_TIME_SLICE_10 (5 << 5)
+#define MI_ARB_TIME_SLICE_14 (6 << 5)
+#define MI_ARB_TIME_SLICE_16 (7 << 5)
+
+/* Low priority grace period page size */
+#define MI_ARB_LOW_PRIORITY_GRACE_4KB (0 << 4) /* default */
+#define MI_ARB_LOW_PRIORITY_GRACE_8KB (1 << 4)
+
+/* Disable display A/B trickle feed */
+#define MI_ARB_DISPLAY_TRICKLE_FEED_DISABLE (1 << 2)
+
+/* Set display plane priority */
+#define MI_ARB_DISPLAY_PRIORITY_A_B (0 << 0) /* display A > display B */
+#define MI_ARB_DISPLAY_PRIORITY_B_A (1 << 0) /* display B > display A */
+
#define CACHE_MODE_0 0x02120 /* 915+ only */
#define CM0_MASK_SHIFT 16
#define CM0_IZ_OPT_DISABLE (1<<6)
--
1.7.1

36
drm-radeon-fix-shared-ddc-handling.patch
View File

@ -1,36 +0,0 @@
From 557b452536c9390105539a264d342d963d71b087 Mon Sep 17 00:00:00 2001
From: Alex Deucher <alexdeucher@gmail.com>
Date: Mon, 21 Jun 2010 12:07:52 -0400
Subject: [PATCH] drm/radeon/kms: fix shared ddc handling
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Connectors with a shared ddc line can be connected to different
encoders.
Reported by Pasi Kärkkäinen <pasik@iki.fi> on dri-devel
Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
---
drivers/gpu/drm/radeon/radeon_connectors.c | 4 +++-
1 files changed, 3 insertions(+), 1 deletions(-)
diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c
index 0c7ccc6..f58f8bd 100644
--- a/drivers/gpu/drm/radeon/radeon_connectors.c
+++ b/drivers/gpu/drm/radeon/radeon_connectors.c
@@ -785,7 +785,9 @@ static enum drm_connector_status radeon_dvi_detect(struct drm_connector *connect
if (connector == list_connector)
continue;
list_radeon_connector = to_radeon_connector(list_connector);
- if (radeon_connector->devices == list_radeon_connector->devices) {
+ if (list_radeon_connector->shared_ddc &&
+ (list_radeon_connector->ddc_bus->rec.i2c_id ==
+ radeon_connector->ddc_bus->rec.i2c_id)) {
if (drm_detect_hdmi_monitor(radeon_connector->edid)) {
if (connector->connector_type == DRM_MODE_CONNECTOR_DVID) {
kfree(radeon_connector->edid);
--
1.7.0.1

33
ethtool-fix-buffer-overflow.patch
View File

@ -1,33 +0,0 @@
From: Ben Hutchings <bhutchings@solarflare.com>
Date: Mon, 28 Jun 2010 08:44:07 +0000 (+0000)
Subject: ethtool: Fix potential kernel buffer overflow in ETHTOOL_GRXCLSRLALL
X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Fdavem%2Fnet-2.6.git;a=commitdiff_plain;h=db048b69037e7fa6a7d9e95a1271a50dc08ae233
ethtool: Fix potential kernel buffer overflow in ETHTOOL_GRXCLSRLALL
On a 32-bit machine, info.rule_cnt >= 0x40000000 leads to integer
overflow and the buffer may be smaller than needed. Since
ETHTOOL_GRXCLSRLALL is unprivileged, this can presumably be used for at
least denial of service.
Signed-off-by: Ben Hutchings <bhutchings@solarflare.com>
Cc: stable@kernel.org
Signed-off-by: David S. Miller <davem@davemloft.net>
---
diff --git a/net/core/ethtool.c b/net/core/ethtool.c
index a0f4964..a3a7e9a 100644
--- a/net/core/ethtool.c
+++ b/net/core/ethtool.c
@@ -347,8 +347,9 @@ static noinline_for_stack int ethtool_get_rxnfc(struct net_device *dev,
if (info.cmd == ETHTOOL_GRXCLSRLALL) {
if (info.rule_cnt > 0) {
- rule_buf = kmalloc(info.rule_cnt * sizeof(u32),
- GFP_USER);
+ if (info.rule_cnt <= KMALLOC_MAX_SIZE / sizeof(u32))
+ rule_buf = kmalloc(info.rule_cnt * sizeof(u32),
+ GFP_USER);
if (!rule_buf)
return -ENOMEM;
}

58
iwlwifi-cancel-scan-watchdog-in-iwl_bg_abort_scan.patch
View File

@ -1,58 +0,0 @@
commit a69b03e941abae00380fc6bc1877fb797a1b31e6
Author: John W. Linville <linville@tuxdriver.com>
Date: Mon Jun 14 14:30:25 2010 -0400
iwlwifi: cancel scan watchdog in iwl_bg_abort_scan
Avoids this:
WARNING: at net/mac80211/scan.c:312 ieee80211_scan_completed+0x5f/0x1f1
[mac80211]()
Hardware name: Latitude E5400
Modules linked in: aes_x86_64 aes_generic fuse ipt_MASQUERADE iptable_nat
nf_nat rfcomm sco bridge stp llc bnep l2cap sunrpc cpufreq_ondemand
acpi_cpufreq freq_table xt_physdev ip6t_REJECT nf_conntrack_ipv6
ip6table_filter ip6_tables ipv6 kvm_intel kvm uinput arc4 ecb
snd_hda_codec_intelhdmi snd_hda_codec_idt snd_hda_intel iwlagn snd_hda_codec
snd_hwdep snd_seq snd_seq_device iwlcore snd_pcm dell_wmi sdhci_pci sdhci
iTCO_wdt tg3 dell_laptop mmc_core i2c_i801 wmi mac80211 snd_timer
iTCO_vendor_support btusb joydev dcdbas cfg80211 bluetooth snd soundcore
microcode rfkill snd_page_alloc firewire_ohci firewire_core crc_itu_t
yenta_socket rsrc_nonstatic i915 drm_kms_helper drm i2c_algo_bit i2c_core video
output [last unloaded: scsi_wait_scan]
Pid: 979, comm: iwlagn Tainted: G W 2.6.33.3-85.fc13.x86_64 #1
Call Trace:
[<ffffffff8104b558>] warn_slowpath_common+0x77/0x8f
[<ffffffff8104b57f>] warn_slowpath_null+0xf/0x11
[<ffffffffa01bb7d9>] ieee80211_scan_completed+0x5f/0x1f1 [mac80211]
[<ffffffffa02a23f0>] iwl_bg_scan_completed+0xbb/0x17a [iwlcore]
[<ffffffff81060d3d>] worker_thread+0x1a4/0x232
[<ffffffffa02a2335>] ? iwl_bg_scan_completed+0x0/0x17a [iwlcore]
[<ffffffff81064817>] ? autoremove_wake_function+0x0/0x34
[<ffffffff81060b99>] ? worker_thread+0x0/0x232
[<ffffffff810643c7>] kthread+0x7a/0x82
[<ffffffff8100a924>] kernel_thread_helper+0x4/0x10
[<ffffffff8106434d>] ? kthread+0x0/0x82
[<ffffffff8100a920>] ? kernel_thread_helper+0x0/0x10
Reported here:
https://bugzilla.redhat.com/show_bug.cgi?id=590436
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Reported-by: Mihai Harpau <mishu@piatafinanciara.ro>
Cc: stable@kernel.org
Acked-by: Reinette Chatre <reinette.chatre@intel.com>
diff --git a/drivers/net/wireless/iwlwifi/iwl-scan.c b/drivers/net/wireless/iwlwifi/iwl-scan.c
index 5d3f51f..386c5f9 100644
--- a/drivers/net/wireless/iwlwifi/iwl-scan.c
+++ b/drivers/net/wireless/iwlwifi/iwl-scan.c
@@ -491,6 +491,7 @@ void iwl_bg_abort_scan(struct work_struct *work)
mutex_lock(&priv->mutex);
+ cancel_delayed_work_sync(&priv->scan_check);
set_bit(STATUS_SCAN_ABORTING, &priv->status);
iwl_send_scan_abort(priv);

69
kernel.spec
View File

@ -60,7 +60,7 @@ Summary: The Linux kernel
%if 0%{?released_kernel}
# Do we have a -stable update to apply?
%define stable_update 6
%define stable_update 7
# Is it a -stable RC?
%define stable_rc 0
# Set rpm version accordingly
@ -684,7 +684,6 @@ Patch570: linux-2.6-selinux-mprotect-checks.patch
Patch580: linux-2.6-sparc-selinux-mprotect-checks.patch
Patch581: linux-2.6-selinux-avtab-size.patch
Patch600: linux-2.6-acpi-sleep-live-sci-live.patch
Patch601: linux-2.6-acpi-indirect_fan_control.patch
Patch610: hda_intel-prealloc-4mb-dmabuffer.patch
@ -722,7 +721,6 @@ Patch1809: drm-radeon-firemv-pciid.patch
Patch1810: drm-radeon-kms-fix-dual-link-dvi.patch
Patch1811: drm-radeon-fix-rs600-tlb.patch
Patch1812: drm-radeon-ss-fix.patch
Patch1813: drm-radeon-fix-shared-ddc-handling.patch
# nouveau fixes
# - these not until 2.6.34
Patch1815: drm-nouveau-abi16.patch
@ -748,10 +746,6 @@ Patch1830: drm-intel-sdvo-fix-2.patch
Patch1840: drm-i915-use-pipe_control-instruction-on-ironlake-and-sandy-bridge.patch
Patch1841: drm-i915-fix-non-ironlake-965-class-crashes.patch
Patch1842: drm-i915-fix-edp-panels.patch
Patch1843: drm-i915-fix-hibernate-memory-corruption.patch
Patch1844: drm-i915-add-reclaimable-to-page-allocations.patch
Patch1845: drm-i915-make-G4X-style-PLL-search-more-permissive.patch
Patch1846: drm-intel-945gm-stability-fixes.patch
Patch2100: linux-2.6-phylib-autoload.patch
@ -846,23 +840,11 @@ Patch12911: iwlwifi-fix-internal-scan-race.patch
Patch12912: iwlwifi-recover_from_tx_stall.patch
Patch12913: iwlwifi-manage-QoS-by-mac-stack.patch
Patch12914: mac80211-do-not-wipe-out-old-supported-rates.patch
Patch12915: mac80211-explicitly-disable-enable-QoS.patch
Patch12916: mac80211-fix-supported-rates-IE-if-AP-doesnt-give-us-its-rates.patch
# Disable rt20xx and rt35xx chipset support in rt2800pci and rt2800usb
Patch13010: rt2x00-rt2800-Make-rt30xx-and-rt35xx-chipsets-configurable.patch
# iwlwifi: cancel scan watchdog in iwl_bg_abort_scan
Patch13020: iwlwifi-cancel-scan-watchdog-in-iwl_bg_abort_scan.patch
Patch13030: sched-fix-over-scheduling-bug.patch
Patch13040: ethtool-fix-buffer-overflow.patch
Patch13050: x86-debug-clear-reserved-bits-of-dr6.patch
Patch13060: x86-debug-send-sigtrap-for-user-icebp.patch
Patch13070: cifs-fix-malicious-redirect-problem-in-the-dns-lookup-code.patch
Patch13074: inotify-fix-inotify-oneshot-support.patch
Patch13076: inotify-send-IN_UNMOUNT-events.patch
@ -1391,7 +1373,6 @@ ApplyPatch linux-2.6-defaults-aspm.patch
#
# ACPI
ApplyPatch linux-2.6-acpi-sleep-live-sci-live.patch
ApplyPatch linux-2.6-acpi-indirect_fan_control.patch
# ALSA
@ -1474,7 +1455,6 @@ ApplyPatch drm-radeon-firemv-pciid.patch
ApplyPatch drm-radeon-kms-fix-dual-link-dvi.patch
ApplyPatch drm-radeon-fix-rs600-tlb.patch
ApplyPatch drm-radeon-ss-fix.patch
ApplyPatch drm-radeon-fix-shared-ddc-handling.patch
ApplyPatch drm-nouveau-abi16.patch
ApplyPatch drm-nouveau-updates.patch
ApplyPatch drm-nouveau-acpi-edid-fallback.patch
@ -1491,14 +1471,6 @@ ApplyPatch drm-intel-sdvo-fix-2.patch
ApplyPatch drm-i915-use-pipe_control-instruction-on-ironlake-and-sandy-bridge.patch
ApplyPatch drm-i915-fix-non-ironlake-965-class-crashes.patch
ApplyPatch drm-i915-fix-edp-panels.patch
# hibernation memory corruption fixes
ApplyPatch drm-i915-fix-hibernate-memory-corruption.patch
ApplyPatch drm-i915-add-reclaimable-to-page-allocations.patch
# RHBZ#572799
ApplyPatch drm-i915-make-G4X-style-PLL-search-more-permissive.patch
ApplyPatch drm-intel-945gm-stability-fixes.patch
ApplyPatch linux-2.6-phylib-autoload.patch
@ -1576,28 +1548,10 @@ ApplyPatch iwlwifi-recover_from_tx_stall.patch
# mac80211/iwlwifi fix connections to some APs (rhbz#558002)
ApplyPatch mac80211-explicitly-disable-enable-QoS.patch
ApplyPatch iwlwifi-manage-QoS-by-mac-stack.patch
ApplyPatch mac80211-do-not-wipe-out-old-supported-rates.patch
ApplyPatch mac80211-fix-supported-rates-IE-if-AP-doesnt-give-us-its-rates.patch
# Disable rt20xx and rt35xx chipset support in rt2800pci and rt2800usb
ApplyPatch rt2x00-rt2800-Make-rt30xx-and-rt35xx-chipsets-configurable.patch
# iwlwifi: cancel scan watchdog in iwl_bg_abort_scan
ApplyPatch iwlwifi-cancel-scan-watchdog-in-iwl_bg_abort_scan.patch
# fix performance problem with CGROUPS
ApplyPatch sched-fix-over-scheduling-bug.patch
# CVE-2010-2478
ApplyPatch ethtool-fix-buffer-overflow.patch
# BZ#609548
ApplyPatch x86-debug-clear-reserved-bits-of-dr6.patch
ApplyPatch x86-debug-send-sigtrap-for-user-icebp.patch
# CVE-2010-2524
ApplyPatch cifs-fix-malicious-redirect-problem-in-the-dns-lookup-code.patch
# fix broken oneshot support and missing umount events (#607327)
ApplyPatch inotify-fix-inotify-oneshot-support.patch
ApplyPatch inotify-send-IN_UNMOUNT-events.patch
@ -2253,8 +2207,25 @@ fi
%changelog
* Sat Aug 14 2010 Chuck Ebbert <cebbert@redhat.com> 2.6.33.6-148
- Add 2.6.33 branch to git repository.
* Sat Aug 14 2010 Chuck Ebbert <cebbert@redhat.com> 2.6.33.7-148
- Update to kernel 2.6.33.7
- Drop patches merged in 2.6.33.7:
drm-i915-add-reclaimable-to-page-allocations.patch
drm-i915-fix-hibernate-memory-corruption.patch
drm-radeon-fix-shared-ddc-handling.patch
linux-2.6-acpi-sleep-live-sci-live.patch
drm-i915-make-G4X-style-PLL-search-more-permissive.patch
drm-intel-945gm-stability-fixes.patch
mac80211-do-not-wipe-out-old-supported-rates.patch
mac80211-fix-supported-rates-IE-if-AP-doesnt-give-us-its-rates.patch
iwlwifi-cancel-scan-watchdog-in-iwl_bg_abort_scan.patch
sched-fix-over-scheduling-bug.patch
ethtool-fix-buffer-overflow.patch
x86-debug-clear-reserved-bits-of-dr6.patch
x86-debug-send-sigtrap-for-user-icebp.patch
cifs-fix-malicious-redirect-problem-in-the-dns-lookup-code.patch
- Revert broken ssb patch from 2.6.33.7:
ssb-handle-netbook-devices-where-the-sprom-address-is-changed.patch
* Fri Jul 23 2010 Chuck Ebbert <cebbert@redhat.com> 2.6.33.6-147.2.4
- inotify-fix-inotify-oneshot-support.patch,

51
linux-2.6-acpi-sleep-live-sci-live.patch
View File

@ -1,51 +0,0 @@
commit 7ba0dea4158155a68b833982199691dbc2d4e6dc
Author: Matthew Garrett <mjg@redhat.com>
Date: Mon Apr 19 16:51:39 2010 -0400
acpi: Fall back to manually changing SCI_EN
The ACPI spec tells us that the ACPI SCI_EN bit is under hardware control
and shouldn't be touched by the OS. It seems that the Leading Other OS
ignores this and some machines expect this behaviour. We have a blacklist
for these, but given that we're able to detect the failure case and the
alternative to breaking the spec is letting the machine crash and burn,
let's try falling back when we know the alternative is a mostly-dead
machine.
Signed-off-by: Matthew Garrett <mjg@redhat.com>
diff --git a/drivers/acpi/sleep.c b/drivers/acpi/sleep.c
index f74834a..79df8d4 100644
--- a/drivers/acpi/sleep.c
+++ b/drivers/acpi/sleep.c
@@ -227,6 +227,7 @@ static int acpi_suspend_begin(suspend_state_t pm_state)
static int acpi_suspend_enter(suspend_state_t pm_state)
{
acpi_status status = AE_OK;
+ acpi_status enable_status = AE_OK;
unsigned long flags = 0;
u32 acpi_state = acpi_target_sleep_state;
@@ -254,10 +255,19 @@ static int acpi_suspend_enter(suspend_state_t pm_state)
}
/* If ACPI is not enabled by the BIOS, we need to enable it here. */
- if (set_sci_en_on_resume)
+ if (!set_sci_en_on_resume)
+ enable_status = acpi_enable();
+
+ if (set_sci_en_on_resume || enable_status == AE_NO_HARDWARE_RESPONSE)
+ /* If we're still in legacy mode then we have a problem. The
+ * spec tells us that this bit is under hardware control, but
+ * there's no plausible way that the OS can transition back to
+ * legacy mode so our choices here are to either ignore the
+ * spec or crash and burn horribly. The latter doesn't seem
+ * like it's ever going to be the preferable choice, so let's
+ * live dangerously.
+ */
acpi_write_bit_register(ACPI_BITREG_SCI_ENABLE, 1);
- else
- acpi_enable();
/* Reprogram control registers and execute _BFS */
acpi_leave_sleep_state_prep(acpi_state);

237
linux-2.6-upstream-reverts.patch
View File

@ -1,3 +1,240 @@
From stable-bounces@linux.kernel.org Sun Jul 11 16:26:25 2010
From: Larry Finger <Larry.Finger@lwfinger.net>
Date: Sun, 11 Jul 2010 18:26:15 -0500
Subject: ssb: Handle Netbook devices where the SPROM address is changed
To: Greg KH <gregkh@suse.de>
Cc: linux-stable <stable@kernel.org>
Message-ID: <4C3A5317.3090603@lwfinger.net>
From: Christoph Fritz <chf.fritz@googlemail.com>
For some Netbook computers with Broadcom BCM4312 wireless interfaces,
the SPROM has been moved to a new location. When the ssb driver tries to
read the old location, the systems hangs when trying to read a
non-existent location. Such freezes are particularly bad as they do not
log the failure.
This patch is modified from commit
da1fdb02d9200ff28b6f3a380d21930335fe5429 with some pieces from other
mainline changes so that it can be applied to stable 2.6.34.Y.
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/ssb/driver_chipcommon.c | 3 +
drivers/ssb/driver_chipcommon_pmu.c | 17 ++++-------
drivers/ssb/pci.c | 46 ++++++++++++++++++++++++++----
drivers/ssb/sprom.c | 15 +++++++++
include/linux/ssb/ssb.h | 1
include/linux/ssb/ssb_driver_chipcommon.h | 2 +
include/linux/ssb/ssb_regs.h | 3 +
7 files changed, 70 insertions(+), 17 deletions(-)
--- a/drivers/ssb/driver_chipcommon.c
+++ b/drivers/ssb/driver_chipcommon.c
@@ -233,6 +233,9 @@ void ssb_chipcommon_init(struct ssb_chip
{
if (!cc->dev)
return; /* We don't have a ChipCommon */
+ if (cc->dev->id.revision >= 11)
+ cc->status = chipco_read32(cc, SSB_CHIPCO_CHIPSTAT);
+ ssb_dprintk(KERN_INFO PFX "chipcommon status is 0x%x\n", cc->status);
ssb_pmu_init(cc);
chipco_powercontrol_init(cc);
ssb_chipco_set_clockmode(cc, SSB_CLKMODE_FAST);
--- a/drivers/ssb/driver_chipcommon_pmu.c
+++ b/drivers/ssb/driver_chipcommon_pmu.c
@@ -495,9 +495,9 @@ static void ssb_pmu_resources_init(struc
chipco_write32(cc, SSB_CHIPCO_PMU_MAXRES_MSK, max_msk);
}
+/* http://bcm-v4.sipsolutions.net/802.11/SSB/PmuInit */
void ssb_pmu_init(struct ssb_chipcommon *cc)
{
- struct ssb_bus *bus = cc->dev->bus;
u32 pmucap;
if (!(cc->capabilities & SSB_CHIPCO_CAP_PMU))
@@ -509,15 +509,12 @@ void ssb_pmu_init(struct ssb_chipcommon
ssb_dprintk(KERN_DEBUG PFX "Found rev %u PMU (capabilities 0x%08X)\n",
cc->pmu.rev, pmucap);
- if (cc->pmu.rev >= 1) {
- if ((bus->chip_id == 0x4325) && (bus->chip_rev < 2)) {
- chipco_mask32(cc, SSB_CHIPCO_PMU_CTL,
- ~SSB_CHIPCO_PMU_CTL_NOILPONW);
- } else {
- chipco_set32(cc, SSB_CHIPCO_PMU_CTL,
- SSB_CHIPCO_PMU_CTL_NOILPONW);
- }
- }
+ if (cc->pmu.rev == 1)
+ chipco_mask32(cc, SSB_CHIPCO_PMU_CTL,
+ ~SSB_CHIPCO_PMU_CTL_NOILPONW);
+ else
+ chipco_set32(cc, SSB_CHIPCO_PMU_CTL,
+ SSB_CHIPCO_PMU_CTL_NOILPONW);
ssb_pmu_pll_init(cc);
ssb_pmu_resources_init(cc);
}
--- a/drivers/ssb/pci.c
+++ b/drivers/ssb/pci.c
@@ -22,6 +22,7 @@
#include "ssb_private.h"
+bool ssb_is_sprom_available(struct ssb_bus *bus);
/* Define the following to 1 to enable a printk on each coreswitch. */
#define SSB_VERBOSE_PCICORESWITCH_DEBUG 0
@@ -167,7 +168,7 @@ err_pci:
}
/* Get the word-offset for a SSB_SPROM_XXX define. */
-#define SPOFF(offset) (((offset) - SSB_SPROM_BASE) / sizeof(u16))
+#define SPOFF(offset) ((offset) / sizeof(u16))
/* Helper to extract some _offset, which is one of the SSB_SPROM_XXX defines. */
#define SPEX16(_outvar, _offset, _mask, _shift) \
out->_outvar = ((in[SPOFF(_offset)] & (_mask)) >> (_shift))
@@ -252,8 +253,13 @@ static int sprom_do_read(struct ssb_bus
{
int i;
+ /* Check if SPROM can be read */
+ if (ioread16(bus->mmio + bus->sprom_offset) == 0xFFFF) {
+ ssb_printk(KERN_ERR PFX "Unable to read SPROM\n");
+ return -ENODEV;
+ }
for (i = 0; i < bus->sprom_size; i++)
- sprom[i] = ioread16(bus->mmio + SSB_SPROM_BASE + (i * 2));
+ sprom[i] = ioread16(bus->mmio + bus->sprom_offset + (i * 2));
return 0;
}
@@ -284,7 +290,7 @@ static int sprom_do_write(struct ssb_bus
ssb_printk("75%%");
else if (i % 2)
ssb_printk(".");
- writew(sprom[i], bus->mmio + SSB_SPROM_BASE + (i * 2));
+ writew(sprom[i], bus->mmio + bus->sprom_offset + (i * 2));
mmiowb();
msleep(20);
}
@@ -620,21 +626,49 @@ static int ssb_pci_sprom_get(struct ssb_
int err = -ENOMEM;
u16 *buf;
+ if (!ssb_is_sprom_available(bus)) {
+ ssb_printk(KERN_ERR PFX "No SPROM available!\n");
+ return -ENODEV;
+ }
+ if (bus->chipco.dev) { /* can be unavailible! */
+ /*
+ * get SPROM offset: SSB_SPROM_BASE1 except for
+ * chipcommon rev >= 31 or chip ID is 0x4312 and
+ * chipcommon status & 3 == 2
+ */
+ if (bus->chipco.dev->id.revision >= 31)
+ bus->sprom_offset = SSB_SPROM_BASE31;
+ else if (bus->chip_id == 0x4312 &&
+ (bus->chipco.status & 0x03) == 2)
+ bus->sprom_offset = SSB_SPROM_BASE31;
+ else
+ bus->sprom_offset = SSB_SPROM_BASE1;
+ } else {
+ bus->sprom_offset = SSB_SPROM_BASE1;
+ }
+ ssb_dprintk(KERN_INFO PFX "SPROM offset is 0x%x\n", bus->sprom_offset);
+
buf = kcalloc(SSB_SPROMSIZE_WORDS_R123, sizeof(u16), GFP_KERNEL);
if (!buf)
goto out;
bus->sprom_size = SSB_SPROMSIZE_WORDS_R123;
- sprom_do_read(bus, buf);
+ err = sprom_do_read(bus, buf);
+ if (err)
+ goto out_free;
err = sprom_check_crc(buf, bus->sprom_size);
if (err) {
/* try for a 440 byte SPROM - revision 4 and higher */
kfree(buf);
buf = kcalloc(SSB_SPROMSIZE_WORDS_R4, sizeof(u16),
GFP_KERNEL);
- if (!buf)
+ if (!buf) {
+ err = -ENOMEM;
goto out;
+ }
bus->sprom_size = SSB_SPROMSIZE_WORDS_R4;
- sprom_do_read(bus, buf);
+ err = sprom_do_read(bus, buf);
+ if (err)
+ goto out_free;
err = sprom_check_crc(buf, bus->sprom_size);
if (err) {
/* All CRC attempts failed.
--- a/drivers/ssb/sprom.c
+++ b/drivers/ssb/sprom.c
@@ -175,3 +175,18 @@ const struct ssb_sprom *ssb_get_fallback
{
return fallback_sprom;
}
+
+/* http://bcm-v4.sipsolutions.net/802.11/IsSpromAvailable */
+bool ssb_is_sprom_available(struct ssb_bus *bus)
+{
+ /* status register only exists on chipcomon rev >= 11 and we need check
+ for >= 31 only */
+ /* this routine differs from specs as we do not access SPROM directly
+ on PCMCIA */
+ if (bus->bustype == SSB_BUSTYPE_PCI &&
+ bus->chipco.dev && /* can be unavailible! */
+ bus->chipco.dev->id.revision >= 31)
+ return bus->chipco.capabilities & SSB_CHIPCO_CAP_SPROM;
+
+ return true;
+}
--- a/include/linux/ssb/ssb.h
+++ b/include/linux/ssb/ssb.h
@@ -306,6 +306,7 @@ struct ssb_bus {
u16 chip_id;
u16 chip_rev;
u16 sprom_size; /* number of words in sprom */
+ u16 sprom_offset;
u8 chip_package;
/* List of devices (cores) on the backplane. */
--- a/include/linux/ssb/ssb_driver_chipcommon.h
+++ b/include/linux/ssb/ssb_driver_chipcommon.h
@@ -46,6 +46,7 @@
#define SSB_PLLTYPE_7 0x00038000 /* 25Mhz, 4 dividers */
#define SSB_CHIPCO_CAP_PCTL 0x00040000 /* Power Control */
#define SSB_CHIPCO_CAP_OTPS 0x00380000 /* OTP size */
+#define SSB_CHIPCO_CAP_SPROM 0x40000000 /* SPROM present */
#define SSB_CHIPCO_CAP_OTPS_SHIFT 19
#define SSB_CHIPCO_CAP_OTPS_BASE 5
#define SSB_CHIPCO_CAP_JTAGM 0x00400000 /* JTAG master present */
@@ -564,6 +565,7 @@ struct ssb_chipcommon_pmu {
struct ssb_chipcommon {
struct ssb_device *dev;
u32 capabilities;
+ u32 status;
/* Fast Powerup Delay constant */
u16 fast_pwrup_delay;
struct ssb_chipcommon_pmu pmu;
--- a/include/linux/ssb/ssb_regs.h
+++ b/include/linux/ssb/ssb_regs.h
@@ -170,7 +170,8 @@
#define SSB_SPROMSIZE_WORDS_R4 220
#define SSB_SPROMSIZE_BYTES_R123 (SSB_SPROMSIZE_WORDS_R123 * sizeof(u16))
#define SSB_SPROMSIZE_BYTES_R4 (SSB_SPROMSIZE_WORDS_R4 * sizeof(u16))
-#define SSB_SPROM_BASE 0x1000
+#define SSB_SPROM_BASE1 0x1000
+#define SSB_SPROM_BASE31 0x0800
#define SSB_SPROM_REVISION 0x107E
#define SSB_SPROM_REVISION_REV 0x00FF /* SPROM Revision number */
#define SSB_SPROM_REVISION_CRC 0xFF00 /* SPROM CRC8 value */
From 5ce8ba7c9279a63f99e1f131602580472b8af968 Mon Sep 17 00:00:00 2001
From: Adam Jackson <ajax@redhat.com>
Date: Thu, 15 Apr 2010 14:03:30 -0400

70
mac80211-do-not-wipe-out-old-supported-rates.patch
View File

@ -1,70 +0,0 @@
From: Stanislaw Gruszka <sgruszka@redhat.com>
To: kernel@lists.fedoraproject.org, "John W. Linville" <linville@redhat.com>
Subject: [PATCH 3/4 2.6.33.y] mac80211: do not wip out old supported rates
Date: Fri, 11 Jun 2010 17:04:19 +0200
commit f0b058b61711ebf5be94d6865ca7b2c259b71d37 upstream.
Use old supported rates, if some buggy AP do not provide
supported rates information element in managment frame.
Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
---
net/mac80211/scan.c | 21 +++++++++++----------
1 files changed, 11 insertions(+), 10 deletions(-)
diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
index bc17cf7..697dc54 100644
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -60,7 +60,7 @@ ieee80211_bss_info_update(struct ieee80211_local *local,
bool beacon)
{
struct ieee80211_bss *bss;
- int clen;
+ int clen, srlen;
s32 signal = 0;
if (local->hw.flags & IEEE80211_HW_SIGNAL_DBM)
@@ -92,23 +92,24 @@ ieee80211_bss_info_update(struct ieee80211_local *local,
if (bss->dtim_period == 0)
bss->dtim_period = 1;
- bss->supp_rates_len = 0;
+ /* replace old supported rates if we get new values */
+ srlen = 0;
if (elems->supp_rates) {
- clen = IEEE80211_MAX_SUPP_RATES - bss->supp_rates_len;
+ clen = IEEE80211_MAX_SUPP_RATES;
if (clen > elems->supp_rates_len)
clen = elems->supp_rates_len;
- memcpy(&bss->supp_rates[bss->supp_rates_len], elems->supp_rates,
- clen);
- bss->supp_rates_len += clen;
+ memcpy(bss->supp_rates, elems->supp_rates, clen);
+ srlen += clen;
}
if (elems->ext_supp_rates) {
- clen = IEEE80211_MAX_SUPP_RATES - bss->supp_rates_len;
+ clen = IEEE80211_MAX_SUPP_RATES - srlen;
if (clen > elems->ext_supp_rates_len)
clen = elems->ext_supp_rates_len;
- memcpy(&bss->supp_rates[bss->supp_rates_len],
- elems->ext_supp_rates, clen);
- bss->supp_rates_len += clen;
+ memcpy(bss->supp_rates + srlen, elems->ext_supp_rates, clen);
+ srlen += clen;
}
+ if (srlen)
+ bss->supp_rates_len = srlen;
bss->wmm_used = elems->wmm_param || elems->wmm_info;
--
1.6.2.5
_______________________________________________
kernel mailing list
kernel@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/kernel

123
mac80211-fix-supported-rates-IE-if-AP-doesnt-give-us-its-rates.patch
View File

@ -1,123 +0,0 @@
Return-path: <kernel-bounces@lists.fedoraproject.org>
X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on
bombadil.infradead.org
X-Spam-Level:
X-Spam-Status: No, score=-0.0 required=5.0 tests=T_RP_MATCHES_RCVD
autolearn=ham version=3.3.1
Envelope-to: kyle@mcmartin.ca
Delivery-date: Fri, 11 Jun 2010 15:05:50 +0000
Received: from bastion02.fedoraproject.org ([209.132.181.3] helo=bastion.fedoraproject.org)
by bombadil.infradead.org with esmtp (Exim 4.72 #1 (Red Hat Linux))
id 1ON5np-0006qq-A4
for kyle@mcmartin.ca; Fri, 11 Jun 2010 15:05:50 +0000
Received: from lists.fedoraproject.org (collab1.vpn.fedoraproject.org [192.168.1.21])
by bastion02.phx2.fedoraproject.org (Postfix) with ESMTP id C8AFE110FA4;
Fri, 11 Jun 2010 15:05:48 +0000 (UTC)
Received: from collab1.fedoraproject.org (localhost.localdomain [127.0.0.1])
by lists.fedoraproject.org (Postfix) with ESMTP id 7CD7932677B;
Fri, 11 Jun 2010 15:05:48 +0000 (UTC)
X-Original-To: kernel@lists.fedoraproject.org
Delivered-To: kernel@lists.fedoraproject.org
Received: from smtp-mm2.fedoraproject.org (smtp-mm2.fedoraproject.org
[66.35.62.164])
by lists.fedoraproject.org (Postfix) with ESMTP id EBB823267E8
for <kernel@lists.fedoraproject.org>;
Fri, 11 Jun 2010 15:05:45 +0000 (UTC)
Received: from mx1.redhat.com (mx1.redhat.com [209.132.183.28])
by smtp-mm2.fedoraproject.org (Postfix) with ESMTP id 5F31DE71E6
for <kernel@lists.fedoraproject.org>;
Fri, 11 Jun 2010 15:05:45 +0000 (UTC)
Received: from int-mx01.intmail.prod.int.phx2.redhat.com
(int-mx01.intmail.prod.int.phx2.redhat.com [10.5.11.11])
by mx1.redhat.com (8.13.8/8.13.8) with ESMTP id o5BF5ifi002333
(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK)
for <kernel@lists.fedoraproject.org>; Fri, 11 Jun 2010 11:05:45 -0400
Received: from localhost (vpn-10-251.rdu.redhat.com [10.11.10.251])
by int-mx01.intmail.prod.int.phx2.redhat.com (8.13.8/8.13.8) with ESMTP
id o5BF5h8Z029086; Fri, 11 Jun 2010 11:05:44 -0400
From: Stanislaw Gruszka <sgruszka@redhat.com>
To: kernel@lists.fedoraproject.org, "John W. Linville" <linville@redhat.com>
Subject: [PATCH 4/4 2.6.33.y] mac80211: fix supported rates IE if AP doesn't
give us it's rates
Date: Fri, 11 Jun 2010 17:04:20 +0200
Message-Id: <1276268660-18830-4-git-send-email-sgruszka@redhat.com>
In-Reply-To: <1276268660-18830-3-git-send-email-sgruszka@redhat.com>
References: <1276268660-18830-1-git-send-email-sgruszka@redhat.com>
<1276268660-18830-2-git-send-email-sgruszka@redhat.com>
<1276268660-18830-3-git-send-email-sgruszka@redhat.com>
X-Scanned-By: MIMEDefang 2.67 on 10.5.11.11
Cc: Stanislaw Gruszka <sgruszka@redhat.com>
X-BeenThere: kernel@lists.fedoraproject.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: "Fedora kernel development." <kernel.lists.fedoraproject.org>
List-Unsubscribe: <https://admin.fedoraproject.org/mailman/listinfo/kernel>,
<mailto:kernel-request@lists.fedoraproject.org?subject=unsubscribe>
List-Archive: <http://lists.fedoraproject.org/pipermail/kernel>
List-Post: <mailto:kernel@lists.fedoraproject.org>
List-Help: <mailto:kernel-request@lists.fedoraproject.org?subject=help>
List-Subscribe: <https://admin.fedoraproject.org/mailman/listinfo/kernel>,
<mailto:kernel-request@lists.fedoraproject.org?subject=subscribe>
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Sender: kernel-bounces@lists.fedoraproject.org
Errors-To: kernel-bounces@lists.fedoraproject.org
X-CRM114-Version: 20090807-BlameThorstenAndJenny ( TRE 0.7.6 (BSD) ) MR-646709E3
X-CRM114-CacheID: sfid-20100611_110549_564657_0ED6FEC7
X-CRM114-Status: GOOD ( 17.72 )
Content-Length: 1846
commit 76f273640134f3eb8257179cd5b3bc6ba5fe4a96 upstream.
If AP do not provide us supported rates before assiociation, send
all rates we are supporting instead of empty information element.
Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
---
net/mac80211/mlme.c | 17 +++++++++++------
1 files changed, 11 insertions(+), 6 deletions(-)
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 950088d..aa90100 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -270,12 +270,6 @@ static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata,
if (wk->bss->wmm_used)
wmm = 1;
- /* get all rates supported by the device and the AP as
- * some APs don't like getting a superset of their rates
- * in the association request (e.g. D-Link DAP 1353 in
- * b-only mode) */
- rates_len = ieee80211_compatible_rates(wk->bss, sband, &rates);
-
if ((wk->bss->cbss.capability & WLAN_CAPABILITY_SPECTRUM_MGMT) &&
(local->hw.flags & IEEE80211_HW_SPECTRUM_MGMT))
capab |= WLAN_CAPABILITY_SPECTRUM_MGMT;
@@ -310,6 +304,17 @@ static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata,
*pos++ = wk->ssid_len;
memcpy(pos, wk->ssid, wk->ssid_len);
+ if (wk->bss->supp_rates_len) {
+ /* get all rates supported by the device and the AP as
+ * some APs don't like getting a superset of their rates
+ * in the association request (e.g. D-Link DAP 1353 in
+ * b-only mode) */
+ rates_len = ieee80211_compatible_rates(wk->bss, sband, &rates);
+ } else {
+ rates = ~0;
+ rates_len = sband->n_bitrates;
+ }
+
/* add all rates which were marked to be used above */
supp_rates_len = rates_len;
if (supp_rates_len > 8)
--
1.6.2.5
_______________________________________________
kernel mailing list
kernel@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/kernel

60
sched-fix-over-scheduling-bug.patch
View File

@ -1,60 +0,0 @@
From: Alex,Shi <alex.shi@intel.com>
Date: Thu, 17 Jun 2010 06:08:13 +0000 (+0800)
Subject: sched: Fix over-scheduling bug
X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Ftorvalds%2Flinux-2.6.git;a=commitdiff_plain;h=3c93717cfa51316e4dbb471e7c0f9d243359d5f8
sched: Fix over-scheduling bug
Commit e70971591 ("sched: Optimize unused cgroup configuration") introduced
an imbalanced scheduling bug. [[ in 2.6.32-rc1 ]]
If we do not use CGROUP, function update_h_load won't update h_load. When the
system has a large number of tasks far more than logical CPU number, the
incorrect cfs_rq[cpu]->h_load value will cause load_balance() to pull too
many tasks to the local CPU from the busiest CPU. So the busiest CPU keeps
going in a round robin. That will hurt performance.
The issue was found originally by a scientific calculation workload that
developed by Yanmin. With that commit, the workload performance drops
about 40%.
CPU before after
00 : 2 : 7
01 : 1 : 7
02 : 11 : 6
03 : 12 : 7
04 : 6 : 6
05 : 11 : 7
06 : 10 : 6
07 : 12 : 7
08 : 11 : 6
09 : 12 : 6
10 : 1 : 6
11 : 1 : 6
12 : 6 : 6
13 : 2 : 6
14 : 2 : 6
15 : 1 : 6
Reviewed-by: Yanmin zhang <yanmin.zhang@intel.com>
Signed-off-by: Alex Shi <alex.shi@intel.com>
Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
LKML-Reference: <1276754893.9452.5442.camel@debian>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
---
diff --git a/kernel/sched.c b/kernel/sched.c
index 2aaceeb..6c9e7c8 100644
--- a/kernel/sched.c
+++ b/kernel/sched.c
@@ -1657,9 +1657,6 @@ static void update_shares(struct sched_domain *sd)
static void update_h_load(long cpu)
{
- if (root_task_group_empty())
- return;
-
walk_tg_tree(tg_load_down, tg_nop, (void *)cpu);
}

2
sources
View File

@ -1,2 +1,2 @@
c3883760b18d50e8d78819c54d579b00 linux-2.6.33.tar.bz2
88390e48c301f9eaeb455d8c00cfda57 patch-2.6.33.6.bz2
04b3affb4f7fb3035303a32bd6080baf patch-2.6.33.7.bz2

50
x86-debug-clear-reserved-bits-of-dr6.patch
View File

@ -1,50 +0,0 @@
From: K.Prasad <prasad@linux.vnet.ibm.com>
Date: Thu, 28 Jan 2010 11:14:01 +0000 (+0530)
Subject: x86/debug: Clear reserved bits of DR6 in do_debug()
X-Git-Tag: v2.6.34-rc1~197^2~94
X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Ftorvalds%2Flinux-2.6.git;a=commitdiff_plain;h=40f9249a73f6c251adea492b1c3d19d39e2a9bda
x86/debug: Clear reserved bits of DR6 in do_debug()
Clear the reserved bits from the stored copy of debug status
register (DR6).
This will help easy bitwise operations such as quick testing
of a debug event origin.
Signed-off-by: K.Prasad <prasad@linux.vnet.ibm.com>
Cc: Roland McGrath <roland@redhat.com>
Cc: Jan Kiszka <jan.kiszka@siemens.com>
Cc: Alan Stern <stern@rowland.harvard.edu>
Cc: Ingo Molnar <mingo@elte.hu>
LKML-Reference: <20100128111401.GB13935@in.ibm.com>
Signed-off-by: Frederic Weisbecker <fweisbec@gmail.com>
---
diff --git a/arch/x86/include/asm/debugreg.h b/arch/x86/include/asm/debugreg.h
index 8240f76..b81002f 100644
--- a/arch/x86/include/asm/debugreg.h
+++ b/arch/x86/include/asm/debugreg.h
@@ -14,6 +14,9 @@
which debugging register was responsible for the trap. The other bits
are either reserved or not of interest to us. */
+/* Define reserved bits in DR6 which are always set to 1 */
+#define DR6_RESERVED (0xFFFF0FF0)
+
#define DR_TRAP0 (0x1) /* db0 */
#define DR_TRAP1 (0x2) /* db1 */
#define DR_TRAP2 (0x4) /* db2 */
diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c
index 3339917..1168e44 100644
--- a/arch/x86/kernel/traps.c
+++ b/arch/x86/kernel/traps.c
@@ -534,6 +534,9 @@ dotraplinkage void __kprobes do_debug(struct pt_regs *regs, long error_code)
get_debugreg(dr6, 6);
+ /* Filter out all the reserved bits which are preset to 1 */
+ dr6 &= ~DR6_RESERVED;
+
/* Catch kmemcheck conditions first of all! */
if ((dr6 & DR_STEP) && kmemcheck_trap(regs))
return;

80
x86-debug-send-sigtrap-for-user-icebp.patch
View File

@ -1,80 +0,0 @@
From: Frederic Weisbecker <fweisbec@gmail.com>
Date: Wed, 30 Jun 2010 13:09:06 +0000 (+0200)
Subject: x86: Send a SIGTRAP for user icebp traps
X-Git-Tag: v2.6.35-rc4~2^2~2
X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Ftorvalds%2Flinux-2.6.git;a=commitdiff_plain;h=a1e80fafc9f0742a1776a0490258cb64912411b0
x86: Send a SIGTRAP for user icebp traps
Before we had a generic breakpoint layer, x86 used to send a
sigtrap for any debug event that happened in userspace,
except if it was caused by lazy dr7 switches.
Currently we only send such signal for single step or breakpoint
events.
However, there are three other kind of debug exceptions:
- debug register access detected: trigger an exception if the
next instruction touches the debug registers. We don't use
it.
- task switch, but we don't use tss.
- icebp/int01 trap. This instruction (0xf1) is undocumented and
generates an int 1 exception. Unlike single step through TF
flag, it doesn't set the single step origin of the exception
in dr6.
icebp then used to be reported in userspace using trap signals
but this have been incidentally broken with the new breakpoint
code. Reenable this. Since this is the only debug event that
doesn't set anything in dr6, this is all we have to check.
This fixes a regression in Wine where World Of Warcraft got broken
as it uses this for software protection checks purposes. And
probably other apps do.
Reported-and-tested-by: Alexandre Julliard <julliard@winehq.org>
Signed-off-by: Frederic Weisbecker <fweisbec@gmail.com>
Cc: Ingo Molnar <mingo@elte.hu>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Prasad <prasad@linux.vnet.ibm.com>
Cc: 2.6.33.x 2.6.34.x <stable@kernel.org>
---
diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c
index 142d70c..725ef4d 100644
--- a/arch/x86/kernel/traps.c
+++ b/arch/x86/kernel/traps.c
@@ -526,6 +526,7 @@ asmlinkage __kprobes struct pt_regs *sync_regs(struct pt_regs *eregs)
dotraplinkage void __kprobes do_debug(struct pt_regs *regs, long error_code)
{
struct task_struct *tsk = current;
+ int user_icebp = 0;
unsigned long dr6;
int si_code;
@@ -534,6 +535,14 @@ dotraplinkage void __kprobes do_debug(struct pt_regs *regs, long error_code)
/* Filter out all the reserved bits which are preset to 1 */
dr6 &= ~DR6_RESERVED;
+ /*
+ * If dr6 has no reason to give us about the origin of this trap,
+ * then it's very likely the result of an icebp/int01 trap.
+ * User wants a sigtrap for that.
+ */
+ if (!dr6 && user_mode(regs))
+ user_icebp = 1;
+
/* Catch kmemcheck conditions first of all! */
if ((dr6 & DR_STEP) && kmemcheck_trap(regs))
return;
@@ -575,7 +584,7 @@ dotraplinkage void __kprobes do_debug(struct pt_regs *regs, long error_code)
regs->flags &= ~X86_EFLAGS_TF;
}
si_code = get_si_code(tsk->thread.debugreg6);
- if (tsk->thread.debugreg6 & (DR_STEP | DR_TRAP_BITS))
+ if (tsk->thread.debugreg6 & (DR_STEP | DR_TRAP_BITS) || user_icebp)
send_sigtrap(tsk, regs, error_code, si_code);
preempt_conditional_cli(regs);