This commit is contained in:
Dave Jones 2011-07-12 20:17:56 -04:00
parent 24958d9bb6
commit e99605611a
8 changed files with 16 additions and 319 deletions

View File

@ -1,72 +0,0 @@
From c564db51fe187362c4da0a9de2905c020e981c75 Mon Sep 17 00:00:00 2001
From: Nick Kossifidis <mickflemm@gmail.com>
Date: Thu, 2 Jun 2011 03:09:48 +0300
Subject: ath5k: Disable fast channel switching by default
Disable fast channel change by default on AR2413/AR5413 due to
some bug reports (it still works for me but it's better to be safe).
Add a module parameter "fastchanswitch" in case anyone wants to enable
it and play with it.
Signed-off-by: Nick Kossifidis <mickflemm@gmail.com>
Tested-by: Sedat Dilek <sedat.dilek@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
---
drivers/net/wireless/ath/ath5k/base.c | 9 ++++++++-
drivers/net/wireless/ath/ath5k/reset.c | 5 ++++-
2 files changed, 12 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/ath/ath5k/base.c b/drivers/net/wireless/ath/ath5k/base.c
index 09ae4ef..0fb6333 100644
--- a/drivers/net/wireless/ath/ath5k/base.c
+++ b/drivers/net/wireless/ath/ath5k/base.c
@@ -69,6 +69,11 @@ static int modparam_all_channels;
module_param_named(all_channels, modparam_all_channels, bool, S_IRUGO);
MODULE_PARM_DESC(all_channels, "Expose all channels the device can use.");
+static int modparam_fastchanswitch;
+module_param_named(fastchanswitch, modparam_fastchanswitch, bool, S_IRUGO);
+MODULE_PARM_DESC(fastchanswitch, "Enable fast channel switching for AR2413/AR5413 radios.");
+
+
/* Module info */
MODULE_AUTHOR("Jiri Slaby");
MODULE_AUTHOR("Nick Kossifidis");
@@ -2664,6 +2669,7 @@ ath5k_reset(struct ath5k_softc *sc, struct ieee80211_channel *chan,
struct ath5k_hw *ah = sc->ah;
struct ath_common *common = ath5k_hw_common(ah);
int ret, ani_mode;
+ bool fast;
ATH5K_DBG(sc, ATH5K_DEBUG_RESET, "resetting\n");
@@ -2669,7 +2669,8 @@ ath5k_reset(struct ath5k_softc *sc, stru
ath5k_drain_tx_buffs(sc);
if (chan)
sc->curchan = chan;
- ret = ath5k_hw_reset(ah, sc->opmode, sc->curchan, chan != NULL,
+ fast = ((chan != NULL) && modparam_fastchanswitch) ? 1 : 0;
+ ret = ath5k_hw_reset(ah, sc->opmode, sc->curchan, fast,
skip_pcu);
if (ret) {
ATH5K_ERR(sc, "can't reset hardware (%d)\n", ret);
diff --git a/drivers/net/wireless/ath/ath5k/reset.c b/drivers/net/wireless/ath/ath5k/reset.c
index 8420689..6f53d2b 100644
--- a/drivers/net/wireless/ath/ath5k/reset.c
+++ b/drivers/net/wireless/ath/ath5k/reset.c
@@ -1119,8 +1119,11 @@ int ath5k_hw_reset(struct ath5k_hw *ah, enum nl80211_iftype op_mode,
/* Non fatal, can happen eg.
* on mode change */
ret = 0;
- } else
+ } else {
+ ATH5K_DBG(ah->ah_sc, ATH5K_DEBUG_RESET,
+ "fast chan change successful\n");
return 0;
+ }
}
/*
--
1.7.5.2

View File

@ -1,44 +0,0 @@
From: Jens Axboe <jaxboe@fusionio.com>
Date: Sun, 5 Jun 2011 04:01:13 +0000 (+0200)
Subject: cfq-iosched: fix locking around ioc->ioc_data assignment
X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Ftorvalds%2Flinux-2.6.git;a=commitdiff_plain;h=ab4bd22d3cce6977dc039664cc2d052e3147d662
cfq-iosched: fix locking around ioc->ioc_data assignment
Since we are modifying this RCU pointer, we need to hold
the lock protecting it around it.
This fixes a potential reuse and double free of a cfq
io_context structure. The bug has been in CFQ for a long
time, it hit very few people but those it did hit seemed
to see it a lot.
Tracked in RH bugzilla here:
https://bugzilla.redhat.com/show_bug.cgi?id=577968
Credit goes to Paul Bolle for figuring out that the issue
was around the one-hit ioc->ioc_data cache. Thanks to his
hard work the issue is now fixed.
Cc: stable@kernel.org
Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
---
diff --git a/block/cfq-iosched.c b/block/cfq-iosched.c
index 3c7b537..545b8d4 100644
--- a/block/cfq-iosched.c
+++ b/block/cfq-iosched.c
@@ -2772,8 +2772,11 @@ static void __cfq_exit_single_io_context(struct cfq_data *cfqd,
smp_wmb();
cic->key = cfqd_dead_key(cfqd);
- if (ioc->ioc_data == cic)
+ if (rcu_dereference(ioc->ioc_data) == cic) {
+ spin_lock(&ioc->lock);
rcu_assign_pointer(ioc->ioc_data, NULL);
+ spin_unlock(&ioc->lock);
+ }
if (cic->cfqq[BLK_RW_ASYNC]) {
cfq_exit_cfqq(cfqd, cic->cfqq[BLK_RW_ASYNC]);

View File

@ -1,43 +0,0 @@
From: Chris Wilson <chris@chris-wilson.co.uk>
Date: Tue, 21 Jun 2011 17:37:59 +0000 (+0100)
Subject: drm/i915: Apply HWSTAM workaround for BSD ring on SandyBridge
X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Ftorvalds%2Flinux-2.6.git;a=commitdiff_plain;h=ec6a890dfed7dd245beba5e5bcdfcffbd934c284
drm/i915: Apply HWSTAM workaround for BSD ring on SandyBridge
...we need to apply exactly the same workaround for missing interrupts
from BSD as for the BLT ring, apparently.
See also commit 498e720b96379d8ee9c294950a01534a73defcf3
(drm/i915: Fix gen6 (SNB) missed BLT ring interrupts).
Reported-and-tested-by: nkalkhof@web.de
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=38529
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: Keith Packard <keithp@keithp.com>
---
diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
index 9e34a1a..ae2b499 100644
--- a/drivers/gpu/drm/i915/i915_irq.c
+++ b/drivers/gpu/drm/i915/i915_irq.c
@@ -1749,6 +1749,7 @@ void ironlake_irq_preinstall(struct drm_device *dev)
* happens.
*/
I915_WRITE(GEN6_BLITTER_HWSTAM, ~GEN6_BLITTER_USER_INTERRUPT);
+ I915_WRITE(GEN6_BSD_HWSTAM, ~GEN6_BSD_USER_INTERRUPT);
}
/* XXX hotplug from PCH */
diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
index 2f967af..5d5def7 100644
--- a/drivers/gpu/drm/i915/i915_reg.h
+++ b/drivers/gpu/drm/i915/i915_reg.h
@@ -531,6 +531,7 @@
#define GEN6_BSD_SLEEP_PSMI_CONTROL_RC_ILDL_MESSAGE_ENABLE 0
#define GEN6_BSD_SLEEP_PSMI_CONTROL_IDLE_INDICATOR (1 << 3)
+#define GEN6_BSD_HWSTAM 0x12098
#define GEN6_BSD_IMR 0x120a8
#define GEN6_BSD_USER_INTERRUPT (1 << 12)

View File

@ -1,53 +0,0 @@
commit 498e720b96379d8ee9c294950a01534a73defcf3
Author: Daniel J Blueman <daniel.blueman@gmail.com>
Date: Fri Jun 17 11:32:19 2011 -0700
drm/i915: Fix gen6 (SNB) missed BLT ring interrupts.
The failure appeared in dmesg as:
[drm:i915_hangcheck_ring_idle] *ERROR* Hangcheck timer elapsed... blt
ring idle [waiting on 35064155, at 35064155], missed IRQ?
This works around that problem on by making the blitter command
streamer write interrupt state to the Hardware Status Page when a
MI_USER_INTERRUPT command is decoded, which appears to force the seqno
out to memory before the interrupt happens.
v1->v2: Moved to prior interrupt handler installation and RMW flags as
per feedback.
v2->v3: Removed RMW of flags (by anholt)
Cc: stable@kernel.org
Signed-off-by: Daniel J Blueman <daniel.blueman@gmail.com>
Signed-off-by: Eric Anholt <eric@anholt.net>
Tested-by: Chris Wilson <chris@chris-wilson.co.uk> [v1]
Tested-by: Eric Anholt <eric@anholt.net> [v1,v3]
(incidence of the bug with a testcase went from avg 2/1000 to
0/12651 in the latest test run (plus more for v1))
Tested-by: Kenneth Graunke <kenneth@whitecape.org> [v1]
Tested-by: Robert Hooker <robert.hooker@canonical.com> [v1]
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=33394
Signed-off-by: Dave Airlie <airlied@redhat.com>
diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
index b9fafe3..9e34a1a 100644
--- a/drivers/gpu/drm/i915/i915_irq.c
+++ b/drivers/gpu/drm/i915/i915_irq.c
@@ -1740,6 +1740,16 @@ void ironlake_irq_preinstall(struct drm_device *dev)
INIT_WORK(&dev_priv->rps_work, gen6_pm_rps_work);
I915_WRITE(HWSTAM, 0xeffe);
+ if (IS_GEN6(dev)) {
+ /* Workaround stalls observed on Sandy Bridge GPUs by
+ * making the blitter command streamer generate a
+ * write to the Hardware Status Page for
+ * MI_USER_INTERRUPT. This appears to serialize the
+ * previous seqno write out before the interrupt
+ * happens.
+ */
+ I915_WRITE(GEN6_BLITTER_HWSTAM, ~GEN6_BLITTER_USER_INTERRUPT);
+ }
/* XXX hotplug from PCH */

View File

@ -63,7 +63,7 @@ Summary: The Linux kernel
%if 0%{?released_kernel}
# Do we have a -stable update to apply?
%define stable_update 2
%define stable_update 3
# Is it a -stable RC?
%define stable_rc 0
# Set rpm version accordingly
@ -614,9 +614,6 @@ Patch30: linux-2.6-tracehook.patch
Patch31: linux-2.6-utrace.patch
Patch32: linux-2.6-utrace-ptrace.patch
# CVE-2011-2183
Patch80: ksm-fix-null-pointer-dereference-in-scan-get-next-rmap-item.patch
Patch150: linux-2.6.29-sparc-IOC_TYPECHECK.patch
Patch160: linux-2.6-32bit-mmap-exec-randomization.patch
@ -654,7 +651,6 @@ Patch570: linux-2.6-selinux-mprotect-checks.patch
Patch580: linux-2.6-sparc-selinux-mprotect-checks.patch
# scsi / block
Patch603: cfq-iosched-fix-locking-around-ioc-ioc-data-assignment.patch
# libata
Patch621: libata-sas-only-set-frozen-flag-if-new-eh-is-supported.patch
@ -681,8 +677,6 @@ Patch1824: drm-intel-next.patch
# make sure the lvds comes back on lid open
Patch1825: drm-intel-make-lvds-work.patch
Patch1826: drm-intel-edp-fixes.patch
Patch1830: drm-i915-snb-irq-stalls-fix.patch
Patch1831: drm-i915-apply-hwstam-workaround-for-bsd-ring-on-sandybridge.patch
# radeon - new hw + fixes for fusion and t500 regression
Patch1839: drm-radeon-fix-regression-on-atom-cards-with-hardcoded-EDID-record.patch
@ -727,8 +721,6 @@ Patch12404: x86-pci-preserve-existing-pci-bfsort-whitelist-for-dell-systems.patc
Patch12416: bluetooth-device-ids-for-ath3k-on-pegatron-lucid-tablets.patch
Patch12418: ath5k-disable-fast-channel-switching-by-default.patch
Patch12420: crypto-aesni_intel-merge-with-fpu_ko.patch
%endif
@ -1173,8 +1165,6 @@ ApplyPatch linux-2.6-utrace.patch
ApplyPatch linux-2.6-utrace-ptrace.patch
# mm patches
# CVE-2011-2183
ApplyPatch ksm-fix-null-pointer-dereference-in-scan-get-next-rmap-item.patch
# Architecture patches
# x86(-64)
@ -1240,8 +1230,6 @@ ApplyPatch x86-pci-preserve-existing-pci-bfsort-whitelist-for-dell-systems.patch
#
# SCSI / block Bits.
#
# rhbz#577968
ApplyPatch cfq-iosched-fix-locking-around-ioc-ioc-data-assignment.patch
# libata
# Fix drive detection failure on mvsas (rhbz#705019)
@ -1305,8 +1293,6 @@ ApplyPatch drm-intel-big-hammer.patch
ApplyPatch drm-intel-make-lvds-work.patch
ApplyPatch linux-2.6-intel-iommu-igfx.patch
ApplyPatch drm-intel-edp-fixes.patch
ApplyPatch drm-i915-snb-irq-stalls-fix.patch
ApplyPatch drm-i915-apply-hwstam-workaround-for-bsd-ring-on-sandybridge.patch
# radeon DRM (add cayman support)
ApplyPatch drm-radeon-fix-regression-on-atom-cards-with-hardcoded-EDID-record.patch -R
@ -1344,9 +1330,6 @@ ApplyPatch scsi-sd-downgrade-caching-printk-from-error-to-notice.patch
ApplyPatch bluetooth-device-ids-for-ath3k-on-pegatron-lucid-tablets.patch
# rhbz#709122
ApplyPatch ath5k-disable-fast-channel-switching-by-default.patch
# rhbz#589390
ApplyPatch crypto-aesni_intel-merge-with-fpu_ko.patch
@ -1958,8 +1941,17 @@ fi
# and build.
%changelog
* Tue Jul 12 2011 Dave Jones <davej@redhat.com>
- 2.6.39.3
dropped: (merged upstream)
ath5k-disable-fast-channel-switching-by-default.patch
cfq-iosched-fix-locking-around-ioc-ioc-data-assignment.patch
drm-i915-apply-hwstam-workaround-for-bsd-ring-on-sandybridge.patch
drm-i915-snb-irq-stalls-fix.patch
ksm-fix-null-pointer-dereference-in-scan-get-next-rmap-item.patch
* Wed Jun 29 2011 Dave Jones <davej@redhat.com>
- 2.6.39
- 2.6.39.2
* Mon Jun 27 2011 Dave Jones <davej@redhat.com>
- Disable CONFIG_CRYPTO_MANAGER_DISABLE_TESTS, as this also disables FIPS (rhbz 716942)

View File

@ -1,82 +0,0 @@
From: Hugh Dickins <hughd@google.com>
Date: Wed, 15 Jun 2011 22:08:58 +0000 (-0700)
Subject: ksm: fix NULL pointer dereference in scan_get_next_rmap_item()
X-Git-Tag: v3.0-rc4~44
X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Ftorvalds%2Flinux-2.6.git;a=commitdiff_plain;h=2b472611a32a72f4a118c069c2d62a1a3f087afd
ksm: fix NULL pointer dereference in scan_get_next_rmap_item()
Andrea Righi reported a case where an exiting task can race against
ksmd::scan_get_next_rmap_item (http://lkml.org/lkml/2011/6/1/742) easily
triggering a NULL pointer dereference in ksmd.
ksm_scan.mm_slot == &ksm_mm_head with only one registered mm
CPU 1 (__ksm_exit) CPU 2 (scan_get_next_rmap_item)
list_empty() is false
lock slot == &ksm_mm_head
list_del(slot->mm_list)
(list now empty)
unlock
lock
slot = list_entry(slot->mm_list.next)
(list is empty, so slot is still ksm_mm_head)
unlock
slot->mm == NULL ... Oops
Close this race by revalidating that the new slot is not simply the list
head again.
Andrea's test case:
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/mman.h>
#define BUFSIZE getpagesize()
int main(int argc, char **argv)
{
void *ptr;
if (posix_memalign(&ptr, getpagesize(), BUFSIZE) < 0) {
perror("posix_memalign");
exit(1);
}
if (madvise(ptr, BUFSIZE, MADV_MERGEABLE) < 0) {
perror("madvise");
exit(1);
}
*(char *)NULL = 0;
return 0;
}
Reported-by: Andrea Righi <andrea@betterlinux.com>
Tested-by: Andrea Righi <andrea@betterlinux.com>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Signed-off-by: Hugh Dickins <hughd@google.com>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Cc: <stable@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
---
diff --git a/mm/ksm.c b/mm/ksm.c
index d708b3e..9a68b0c 100644
--- a/mm/ksm.c
+++ b/mm/ksm.c
@@ -1302,6 +1302,12 @@ static struct rmap_item *scan_get_next_rmap_item(struct page **page)
slot = list_entry(slot->mm_list.next, struct mm_slot, mm_list);
ksm_scan.mm_slot = slot;
spin_unlock(&ksm_mmlist_lock);
+ /*
+ * Although we tested list_empty() above, a racing __ksm_exit
+ * of the last mm on the list may have removed it since then.
+ */
+ if (slot == &ksm_mm_head)
+ return NULL;
next_mm:
ksm_scan.address = 0;
ksm_scan.rmap_list = &slot->rmap_list;

View File

@ -57,16 +57,14 @@ in ye olde CVS tree. I have no idea why. Originally the pr_debug in
device_pm_remove was nuked as well, but that seems to have gotten lost in
the r1.634 of kernel.spec (2.6.26-rc2-git5.)
diff --git a/drivers/base/power/main.c b/drivers/base/power/main.c
index 2a52270..bacbdd2 100644
--- a/drivers/base/power/main.c
+++ b/drivers/base/power/main.c
@@ -87,8 +87,6 @@ void device_pm_unlock(void)
--- linux-2.6.39.x86_64/drivers/base/power/main.c~ 2011-07-12 19:58:19.788854464 -0400
+++ linux-2.6.39.x86_64/drivers/base/power/main.c 2011-07-12 19:58:39.684798674 -0400
@@ -89,8 +89,6 @@ void device_pm_unlock(void)
*/
void device_pm_add(struct device *dev)
{
- pr_debug("PM: Adding info for %s:%s\n",
- dev->bus ? dev->bus->name : "No Bus", dev_name(dev));
mutex_lock(&dpm_list_mtx);
if (dev->parent && dev->parent->power.in_suspend)
if (dev->parent && dev->parent->power.is_prepared)
dev_warn(dev, "parent %s should not be sleeping\n",

View File

@ -1,2 +1,3 @@
1aab7a741abe08d42e8eccf20de61e05 linux-2.6.39.tar.bz2
06b858e8f81600038129afe7bcd4e162 patch-2.6.39.3.bz2
6f81e64e790eb7847773eec4f7cbf207 patch-2.6.39.2.bz2