From 194090a769d75392225987fa46fb2c52d2649450 Mon Sep 17 00:00:00 2001 From: Tobias Powalowski Date: Sun, 17 Apr 2011 20:35:20 +0200 Subject: bump to 2.6.38.3 --- PATCHCFG | 15 +- patches/2.6.38.3-pre.patch | 1140 ----------------- patches/fix-hibernate-resume-2.6.38.patch | 18 + patches/kernel-2.6.38.4-pre.patch | 1923 +++++++++++++++++++++++++++++ 4 files changed, 1949 insertions(+), 1147 deletions(-) delete mode 100644 patches/2.6.38.3-pre.patch create mode 100644 patches/fix-hibernate-resume-2.6.38.patch create mode 100644 patches/kernel-2.6.38.4-pre.patch diff --git a/PATCHCFG b/PATCHCFG index c11e7b1..aad6cf6 100644 --- a/PATCHCFG +++ b/PATCHCFG @@ -10,18 +10,19 @@ SRCNAME="linux-2.6.38-ARCH" # filename%patchlevel (file must be in patches/ subdirectory) PATCHES=( # add upstream patch from 2.6.37 series - ftp://ftp.kernel.org/pub/linux/kernel/v2.6/patch-2.6.38.2.bz2%1 + ftp://ftp.kernel.org/pub/linux/kernel/v2.6/patch-2.6.38.3.bz2%1 # add latest fixes from stable queue, if needed # http://git.kernel.org/?p=linux/kernel/git/stable/stable-queue.git - 2.6.38.3-pre.patch%1 - + kernel-2.6.38.4-pre.patch%1 + + # fix hibernate resume + # https://bugs.archlinux.org/task/23528 + fix-hibernate-resume-2.6.38.patch%1 + # fix #19234 i1915 display size fix-i915.patch%1 - # fix #23390 radeon kms - radeon-kms-sanity-checks.patch%1 - # fix i915 pipelining glitches # https://bugs.freedesktop.org/show_bug.cgi?id=34584 i915-pipeline.patch%1 @@ -34,7 +35,7 @@ PATCHES=( aufs2-standalone-20110314.patch%1 ) # Name of the resulting patch (will be bzipped afterwards) -PATCHNAME="patch-2.6.38.2-1-ARCH" +PATCHNAME="patch-2.6.38.3-1-ARCH" # Run this before applying patches pre_apply() { diff --git a/patches/2.6.38.3-pre.patch b/patches/2.6.38.3-pre.patch deleted file mode 100644 index 6d5f835..0000000 --- a/patches/2.6.38.3-pre.patch +++ /dev/null @@ -1,1140 +0,0 @@ -From 677cd904aba939bc4cfdc3c1eada8ec46582127e Mon Sep 17 00:00:00 2001 -From: David Henningsson -Date: Mon, 7 Feb 2011 15:19:34 +0100 -Subject: ALSA: HDA: New AD1984A model for Dell Precision R5500 - -From: David Henningsson - -commit 677cd904aba939bc4cfdc3c1eada8ec46582127e upstream. - -For codec AD1984A, add a new model to support Dell Precision R5500 -or the microphone jack won't work correctly. - -BugLink: http://bugs.launchpad.net/bugs/741516 -Tested-by: Kent Baxley -Signed-off-by: David Henningsson -Signed-off-by: Takashi Iwai -Signed-off-by: Greg Kroah-Hartman - ---- - sound/pci/hda/patch_analog.c | 89 +++++++++++++++++++++++++++++++++++++++++++ - 1 file changed, 89 insertions(+) - ---- a/sound/pci/hda/patch_analog.c -+++ b/sound/pci/hda/patch_analog.c -@@ -4353,6 +4353,84 @@ static int ad1984a_thinkpad_init(struct - } - - /* -+ * Precision R5500 -+ * 0x12 - HP/line-out -+ * 0x13 - speaker (mono) -+ * 0x15 - mic-in -+ */ -+ -+static struct hda_verb ad1984a_precision_verbs[] = { -+ /* Unmute main output path */ -+ {0x03, AC_VERB_SET_AMP_GAIN_MUTE, 0x27}, /* 0dB */ -+ {0x21, AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_UNMUTE + 0x1f}, /* 0dB */ -+ {0x20, AC_VERB_SET_AMP_GAIN_MUTE, AMP_IN_UNMUTE(5) + 0x17}, /* 0dB */ -+ /* Analog mixer; mute as default */ -+ {0x20, AC_VERB_SET_AMP_GAIN_MUTE, AMP_IN_MUTE(0)}, -+ {0x20, AC_VERB_SET_AMP_GAIN_MUTE, AMP_IN_MUTE(1)}, -+ {0x20, AC_VERB_SET_AMP_GAIN_MUTE, AMP_IN_MUTE(2)}, -+ {0x20, AC_VERB_SET_AMP_GAIN_MUTE, AMP_IN_MUTE(3)}, -+ {0x20, AC_VERB_SET_AMP_GAIN_MUTE, AMP_IN_MUTE(4)}, -+ /* Select mic as input */ -+ {0x0c, AC_VERB_SET_CONNECT_SEL, 0x1}, -+ {0x0c, AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_UNMUTE + 0x27}, /* 0dB */ -+ /* Configure as mic */ -+ {0x15, AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_VREF80}, -+ {0x15, AC_VERB_SET_AMP_GAIN_MUTE, 0x7002}, /* raise mic as default */ -+ /* HP unmute */ -+ {0x12, AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_UNMUTE}, -+ /* turn on EAPD */ -+ {0x13, AC_VERB_SET_EAPD_BTLENABLE, 0x02}, -+ /* unsolicited event for pin-sense */ -+ {0x12, AC_VERB_SET_UNSOLICITED_ENABLE, AC_USRSP_EN | AD1884A_HP_EVENT}, -+ { } /* end */ -+}; -+ -+static struct snd_kcontrol_new ad1984a_precision_mixers[] = { -+ HDA_CODEC_VOLUME("Master Playback Volume", 0x21, 0x0, HDA_OUTPUT), -+ HDA_CODEC_MUTE("Master Playback Switch", 0x21, 0x0, HDA_OUTPUT), -+ HDA_CODEC_VOLUME("PCM Playback Volume", 0x20, 0x5, HDA_INPUT), -+ HDA_CODEC_MUTE("PCM Playback Switch", 0x20, 0x5, HDA_INPUT), -+ HDA_CODEC_VOLUME("Mic Playback Volume", 0x20, 0x01, HDA_INPUT), -+ HDA_CODEC_MUTE("Mic Playback Switch", 0x20, 0x01, HDA_INPUT), -+ HDA_CODEC_VOLUME("Mic Boost Volume", 0x15, 0x0, HDA_INPUT), -+ HDA_CODEC_MUTE("Front Playback Switch", 0x12, 0x0, HDA_OUTPUT), -+ HDA_CODEC_VOLUME("Speaker Playback Volume", 0x13, 0x0, HDA_OUTPUT), -+ HDA_CODEC_VOLUME("Capture Volume", 0x0c, 0x0, HDA_OUTPUT), -+ HDA_CODEC_MUTE("Capture Switch", 0x0c, 0x0, HDA_OUTPUT), -+ { } /* end */ -+}; -+ -+ -+/* mute internal speaker if HP is plugged */ -+static void ad1984a_precision_automute(struct hda_codec *codec) -+{ -+ unsigned int present; -+ -+ present = snd_hda_jack_detect(codec, 0x12); -+ snd_hda_codec_amp_stereo(codec, 0x13, HDA_OUTPUT, 0, -+ HDA_AMP_MUTE, present ? HDA_AMP_MUTE : 0); -+} -+ -+ -+/* unsolicited event for HP jack sensing */ -+static void ad1984a_precision_unsol_event(struct hda_codec *codec, -+ unsigned int res) -+{ -+ if ((res >> 26) != AD1884A_HP_EVENT) -+ return; -+ ad1984a_precision_automute(codec); -+} -+ -+/* initialize jack-sensing, too */ -+static int ad1984a_precision_init(struct hda_codec *codec) -+{ -+ ad198x_init(codec); -+ ad1984a_precision_automute(codec); -+ return 0; -+} -+ -+ -+/* - * HP Touchsmart - * port-A (0x11) - front hp-out - * port-B (0x14) - unused -@@ -4481,6 +4559,7 @@ enum { - AD1884A_MOBILE, - AD1884A_THINKPAD, - AD1984A_TOUCHSMART, -+ AD1984A_PRECISION, - AD1884A_MODELS - }; - -@@ -4490,9 +4569,11 @@ static const char * const ad1884a_models - [AD1884A_MOBILE] = "mobile", - [AD1884A_THINKPAD] = "thinkpad", - [AD1984A_TOUCHSMART] = "touchsmart", -+ [AD1984A_PRECISION] = "precision", - }; - - static struct snd_pci_quirk ad1884a_cfg_tbl[] = { -+ SND_PCI_QUIRK(0x1028, 0x04ac, "Precision R5500", AD1984A_PRECISION), - SND_PCI_QUIRK(0x103c, 0x3030, "HP", AD1884A_MOBILE), - SND_PCI_QUIRK(0x103c, 0x3037, "HP 2230s", AD1884A_LAPTOP), - SND_PCI_QUIRK(0x103c, 0x3056, "HP", AD1884A_MOBILE), -@@ -4586,6 +4667,14 @@ static int patch_ad1884a(struct hda_code - codec->patch_ops.unsol_event = ad1984a_thinkpad_unsol_event; - codec->patch_ops.init = ad1984a_thinkpad_init; - break; -+ case AD1984A_PRECISION: -+ spec->mixers[0] = ad1984a_precision_mixers; -+ spec->init_verbs[spec->num_init_verbs++] = -+ ad1984a_precision_verbs; -+ spec->multiout.dig_out_nid = 0; -+ codec->patch_ops.unsol_event = ad1984a_precision_unsol_event; -+ codec->patch_ops.init = ad1984a_precision_init; -+ break; - case AD1984A_TOUCHSMART: - spec->mixers[0] = ad1984a_touchsmart_mixers; - spec->init_verbs[0] = ad1984a_touchsmart_verbs; -From 20b67dddcc5f29d3d0c900225d85e0ac655bc69d Mon Sep 17 00:00:00 2001 -From: Takashi Iwai -Date: Wed, 23 Mar 2011 22:54:32 +0100 -Subject: ALSA: hda - Fix SPDIF out regression on ALC889 - -From: Takashi Iwai - -commit 20b67dddcc5f29d3d0c900225d85e0ac655bc69d upstream. - -The commit 5a8cfb4e8ae317d283f84122ed20faa069c5e0c4 - ALSA: hda - Use ALC_INIT_DEFAULT for really default initialization -changed to use the default initialization method for ALC889, but -this caused a regression on SPDIF output on some machines. -This seems due to the COEF setup included in the default init procedure. -For making SPDIF working again, the COEF-setup has to be avoided for -the id 0889. - -Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=24342 -Signed-off-by: Takashi Iwai -Signed-off-by: Greg Kroah-Hartman - ---- - sound/pci/hda/patch_realtek.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - ---- a/sound/pci/hda/patch_realtek.c -+++ b/sound/pci/hda/patch_realtek.c -@@ -1360,7 +1360,7 @@ static void alc_auto_init_amp(struct hda - case 0x10ec0883: - case 0x10ec0885: - case 0x10ec0887: -- case 0x10ec0889: -+ /*case 0x10ec0889:*/ /* this causes an SPDIF problem */ - alc889_coef_init(codec); - break; - case 0x10ec0888: -From a45e3d6b13e97506b616980c0f122c3389bcefa4 Mon Sep 17 00:00:00 2001 -From: Takashi Iwai -Date: Thu, 24 Mar 2011 09:50:15 +0100 -Subject: ALSA: Fix yet another race in disconnection - -From: Takashi Iwai - -commit a45e3d6b13e97506b616980c0f122c3389bcefa4 upstream. - -This patch fixes a race between snd_card_file_remove() and -snd_card_disconnect(). When the card is added to shutdown_files list -in snd_card_disconnect(), but it's freed in snd_card_file_remove() at -the same time, the shutdown_files list gets corrupted. The list member -must be freed in snd_card_file_remove() as well. - -Reported-and-tested-by: Russ Dill -Signed-off-by: Takashi Iwai -Signed-off-by: Greg Kroah-Hartman - ---- - sound/core/init.c | 4 ++++ - 1 file changed, 4 insertions(+) - ---- a/sound/core/init.c -+++ b/sound/core/init.c -@@ -848,6 +848,7 @@ int snd_card_file_add(struct snd_card *c - return -ENOMEM; - mfile->file = file; - mfile->disconnected_f_op = NULL; -+ INIT_LIST_HEAD(&mfile->shutdown_list); - spin_lock(&card->files_lock); - if (card->shutdown) { - spin_unlock(&card->files_lock); -@@ -883,6 +884,9 @@ int snd_card_file_remove(struct snd_card - list_for_each_entry(mfile, &card->files_list, list) { - if (mfile->file == file) { - list_del(&mfile->list); -+ spin_lock(&shutdown_lock); -+ list_del(&mfile->shutdown_list); -+ spin_unlock(&shutdown_lock); - if (mfile->disconnected_f_op) - fops_put(mfile->disconnected_f_op); - found = mfile; -From 3674f19dabd15f9541079a588149a370d888f4e6 Mon Sep 17 00:00:00 2001 -From: Benjamin Herrenschmidt -Date: Fri, 25 Mar 2011 17:51:54 +1100 -Subject: ALSA: vmalloc buffers should use normal mmap - -From: Benjamin Herrenschmidt - -commit 3674f19dabd15f9541079a588149a370d888f4e6 upstream. - -It's a big no-no to use pgprot_noncached() when mmap'ing such buffers -into userspace since they are mapped cachable in kernel space. - -This can cause all sort of interesting things ranging from to garbled -sound to lockups on various architectures. I've observed that usb-audio -is broken on powerpc 4xx for example because of that. - -Also remove the now unused snd_pcm_lib_mmap_noncached(). It's -an arch business to know when to use uncached mappings, there's -already hacks for MIPS inside snd_pcm_default_mmap() and other -archs are supposed to use dma_mmap_coherent(). - -(See my separate patch that adds dma_mmap_coherent() to powerpc) - -Signed-off-by: Benjamin Herrenschmidt -Signed-off-by: Takashi Iwai -Signed-off-by: Greg Kroah-Hartman - ---- - include/sound/pcm.h | 4 +--- - sound/core/pcm_native.c | 9 --------- - 2 files changed, 1 insertion(+), 12 deletions(-) - ---- a/include/sound/pcm.h -+++ b/include/sound/pcm.h -@@ -1030,9 +1030,7 @@ int snd_pcm_lib_mmap_iomem(struct snd_pc - #define snd_pcm_lib_mmap_iomem NULL - #endif - --int snd_pcm_lib_mmap_noncached(struct snd_pcm_substream *substream, -- struct vm_area_struct *area); --#define snd_pcm_lib_mmap_vmalloc snd_pcm_lib_mmap_noncached -+#define snd_pcm_lib_mmap_vmalloc NULL - - static inline void snd_pcm_limit_isa_dma_size(int dma, size_t *max) - { ---- a/sound/core/pcm_native.c -+++ b/sound/core/pcm_native.c -@@ -3201,15 +3201,6 @@ int snd_pcm_lib_mmap_iomem(struct snd_pc - EXPORT_SYMBOL(snd_pcm_lib_mmap_iomem); - #endif /* SNDRV_PCM_INFO_MMAP */ - --/* mmap callback with pgprot_noncached */ --int snd_pcm_lib_mmap_noncached(struct snd_pcm_substream *substream, -- struct vm_area_struct *area) --{ -- area->vm_page_prot = pgprot_noncached(area->vm_page_prot); -- return snd_pcm_default_mmap(substream, area); --} --EXPORT_SYMBOL(snd_pcm_lib_mmap_noncached); -- - /* - * mmap DMA buffer - */ -From 880f57318450dbead6a03f9e31a1468924d6dd88 Mon Sep 17 00:00:00 2001 -From: Frederic Weisbecker -Date: Wed, 23 Mar 2011 19:29:39 +0100 -Subject: perf: Better fit max unprivileged mlock pages for tools needs - -From: Frederic Weisbecker - -commit 880f57318450dbead6a03f9e31a1468924d6dd88 upstream. - -The maximum kilobytes of locked memory that an unprivileged user -can reserve is of 512 kB = 128 pages by default, scaled to the -number of onlined CPUs, which fits well with the tools that use -128 data pages by default. - -However tools actually use 129 pages, because they need one more -for the user control page. Thus the default mlock threshold is -not sufficient for the default tools needs and we always end up -to evaluate the constant mlock rlimit policy, which doesn't have -this scaling with the number of online CPUs. - -Hence, on systems that have more than 16 CPUs, we overlap the -rlimit threshold and fail to mmap: - - $ perf record ls - Error: failed to mmap with 1 (Operation not permitted) - -Just increase the max unprivileged mlock threshold by one page -so that it supports well perf tools even after 16 CPUs. - -Reported-by: Han Pingtian -Reported-by: Peter Zijlstra -Reported-by: Arnaldo Carvalho de Melo -Signed-off-by: Frederic Weisbecker -Acked-by: Arnaldo Carvalho de Melo -Cc: Stephane Eranian -LKML-Reference: <1300904979-5508-1-git-send-email-fweisbec@gmail.com> -Signed-off-by: Ingo Molnar -Signed-off-by: Greg Kroah-Hartman - ---- - kernel/perf_event.c | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - ---- a/kernel/perf_event.c -+++ b/kernel/perf_event.c -@@ -62,7 +62,8 @@ static struct srcu_struct pmus_srcu; - */ - int sysctl_perf_event_paranoid __read_mostly = 1; - --int sysctl_perf_event_mlock __read_mostly = 512; /* 'free' kb per user */ -+/* Minimum for 128 pages + 1 for the user control page */ -+int sysctl_perf_event_mlock __read_mostly = 516; /* 'free' kb per user */ - - /* - * max perf event sample rate -From cda6587c21a887254c8ed4b58da8fcc4040ab557 Mon Sep 17 00:00:00 2001 -From: Stanislaw Gruszka -Date: Wed, 23 Mar 2011 02:44:30 +0000 -Subject: myri10ge: fix rmmod crash - -From: Stanislaw Gruszka - -commit cda6587c21a887254c8ed4b58da8fcc4040ab557 upstream. - -Rmmod myri10ge crash at free_netdev() -> netif_napi_del(), because napi -structures are already deallocated. To fix call netif_napi_del() before -kfree() at myri10ge_free_slices(). - -Signed-off-by: Stanislaw Gruszka -Signed-off-by: David S. Miller -Signed-off-by: Greg Kroah-Hartman - ---- - drivers/net/myri10ge/myri10ge.c | 1 + - 1 file changed, 1 insertion(+) - ---- a/drivers/net/myri10ge/myri10ge.c -+++ b/drivers/net/myri10ge/myri10ge.c -@@ -3645,6 +3645,7 @@ static void myri10ge_free_slices(struct - dma_free_coherent(&pdev->dev, bytes, - ss->fw_stats, ss->fw_stats_bus); - ss->fw_stats = NULL; -+ netif_napi_del(&ss->napi); - } - } - kfree(mgp->ss); -From 1ddd5049545e0aa1a0ed19bca4d9c9c3ce1ac8a2 Mon Sep 17 00:00:00 2001 -From: Bud Brown -Date: Wed, 23 Mar 2011 20:47:11 +0100 -Subject: cciss: fix lost command issue - -From: Bud Brown - -commit 1ddd5049545e0aa1a0ed19bca4d9c9c3ce1ac8a2 upstream. - -Under certain workloads a command may seem to get lost. IOW, the Smart Array -thinks all commands have been completed but we still have commands in our -completion queue. This may lead to system instability, filesystems going -read-only, or even panics depending on the affected filesystem. We add an -extra read to force the write to complete. - -Testing shows this extra read avoids the problem. - -Signed-off-by: Mike Miller -Signed-off-by: Jens Axboe -Signed-off-by: Greg Kroah-Hartman - ---- - drivers/block/cciss.h | 1 + - 1 file changed, 1 insertion(+) - ---- a/drivers/block/cciss.h -+++ b/drivers/block/cciss.h -@@ -222,6 +222,7 @@ static void SA5_submit_command( ctlr_inf - h->ctlr, c->busaddr); - #endif /* CCISS_DEBUG */ - writel(c->busaddr, h->vaddr + SA5_REQUEST_PORT_OFFSET); -+ readl(h->vaddr + SA5_REQUEST_PORT_OFFSET); - h->commands_outstanding++; - if ( h->commands_outstanding > h->max_outstanding) - h->max_outstanding = h->commands_outstanding; -From 61e1b0b00c793ad5a32fe2181c9f77115fed5dc4 Mon Sep 17 00:00:00 2001 -From: Mohammed Shafi Shajakhan -Date: Mon, 21 Mar 2011 18:27:21 +0530 -Subject: ath9k: Fix kernel panic in AR2427 - -From: Mohammed Shafi Shajakhan - -commit 61e1b0b00c793ad5a32fe2181c9f77115fed5dc4 upstream. - -Kernel panic occurs just after AR2427 establishes connection with AP. -Unless aggregation is enabled we don't initialize the TID structure. -Thus accesing the elements of the TID structure when aggregation is -disabled, leads to NULL pointer dereferencing. - -[ 191.320358] Call Trace: -[ 191.320364] [] ? ath9k_tx+0xa7/0x200 [ath9k] -[ 191.320376] [] ? __ieee80211_tx+0x5c/0x1e0 [mac80211] -[ 191.320386] [] ? ieee80211_tx+0x7b/0x90 [mac80211] -[ 191.320395] [] ? ieee80211_xmit+0x9d/0x1d0 [mac80211] -[ 191.320401] [] ? wake_up_state+0xf/0x20 -[ 191.320405] [] ? signal_wake_up+0x28/0x40 -[ 191.320410] [] ? default_spin_lock_flags+0x8/0x10 -[ 191.320420] [] ? ieee80211_subif_start_xmit+0x2e8/0x7c0 -[mac80211] -[ 191.320425] [] ? do_page_fault+0x295/0x3a0 -[ 191.320431] [] ? dev_hard_start_xmit+0x1ad/0x210 -[ 191.320436] [] ? sch_direct_xmit+0x105/0x170 -[ 191.320445] [] ? get_sta_flags+0x2a/0x40 [mac80211] -[ 191.320449] [] ? dev_queue_xmit+0x37f/0x4b0 -[ 191.320452] [] ? eth_header+0x0/0xb0 -[ 191.320456] [] ? neigh_resolve_output+0xe9/0x310 -[ 191.320461] [] ? ip6_output_finish+0xa5/0x110 -[ 191.320464] [] ? ip6_output2+0x134/0x250 -[ 191.320468] [] ? ip6_output+0x6d/0x100 -[ 191.320471] [] ? mld_sendpack+0x395/0x3e0 -[ 191.320475] [] ? add_grhead+0x31/0xa0 -[ 191.320478] [] ? mld_send_cr+0x1bc/0x2b0 -[ 191.320482] [] ? irq_exit+0x39/0x70 -[ 191.320485] [] ? mld_ifc_timer_expire+0x10/0x40 -[ 191.320489] [] ? run_timer_softirq+0x13e/0x2c0 -[ 191.320493] [] ? common_interrupt+0x30/0x40 -[ 191.320498] [] ? mld_ifc_timer_expire+0x0/0x40 -[ 191.320502] [] ? __do_softirq+0x98/0x1b0 -[ 191.320506] [] ? do_softirq+0x45/0x50 -[ 191.320509] [] ? irq_exit+0x65/0x70 -[ 191.320513] [] ? smp_apic_timer_interrupt+0x5c/0x8b -[ 191.320516] [] ? apic_timer_interrupt+0x31/0x40 -[ 191.320521] [] ? k_getrusage+0x12b/0x2f0 -[ 191.320525] [] ? acpi_idle_enter_simple+0x117/0x148 -[ 191.320529] [] ? cpuidle_idle_call+0x7a/0x100 -[ 191.320532] [] ? cpu_idle+0x94/0xd0 -[ 191.320536] [] ? rest_init+0x58/0x60 -[ 191.320541] [] ? start_kernel+0x351/0x357 -[ 191.320544] [] ? unknown_bootoption+0x0/0x19e -[ 191.320548] [] ? i386_start_kernel+0xaa/0xb1 -[ 191.320550] Code: 03 66 3d 00 03 0f 84 7c 02 00 00 83 c3 18 0f b6 03 -8b 4d e0 89 c3 83 e3 0f 6b c3 48 89 5d d8 8d 04 06 8d 50 0c 89 55 d0 8b -40 20 <8b> 00 3b 01 0f 85 8e 02 00 00 f6 47 20 40 0f 84 29 ff ff ff 8b -[ 191.320634] EIP: [] ath_tx_start+0x474/0x770 [ath9k] SS:ESP -0068:c0761a90 -[ 191.320642] CR2: 0000000000000000 -[ 191.320647] ---[ end trace 9296ef23b9076ece ]--- -[ 191.320650] Kernel panic - not syncing: Fatal exception in interrupt - -Signed-off-by: Mohammed Shafi Shajakhan -Signed-off-by: John W. Linville -Signed-off-by: Greg Kroah-Hartman - ---- - drivers/net/wireless/ath/ath9k/xmit.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - ---- a/drivers/net/wireless/ath/ath9k/xmit.c -+++ b/drivers/net/wireless/ath/ath9k/xmit.c -@@ -1699,8 +1699,8 @@ static void ath_tx_start_dma(struct ath_ - u8 tidno; - - spin_lock_bh(&txctl->txq->axq_lock); -- -- if (ieee80211_is_data_qos(hdr->frame_control) && txctl->an) { -+ if ((sc->sc_flags & SC_OP_TXAGGR) && txctl->an && -+ ieee80211_is_data_qos(hdr->frame_control)) { - tidno = ieee80211_get_qos_ctl(hdr)[0] & - IEEE80211_QOS_CTL_TID_MASK; - tid = ATH_AN_2_TID(txctl->an, tidno); -From 4d00135a680727f6c3be78f8befaac009030e4df Mon Sep 17 00:00:00 2001 -From: Dan Rosenberg -Date: Wed, 23 Mar 2011 11:42:57 -0400 -Subject: sound/oss/opl3: validate voice and channel indexes - -From: Dan Rosenberg - -commit 4d00135a680727f6c3be78f8befaac009030e4df upstream. - -User-controllable indexes for voice and channel values may cause reading -and writing beyond the bounds of their respective arrays, leading to -potentially exploitable memory corruption. Validate these indexes. - -Signed-off-by: Dan Rosenberg -Signed-off-by: Takashi Iwai -Signed-off-by: Greg Kroah-Hartman - ---- - sound/oss/opl3.c | 15 +++++++++++++-- - 1 file changed, 13 insertions(+), 2 deletions(-) - ---- a/sound/oss/opl3.c -+++ b/sound/oss/opl3.c -@@ -849,6 +849,10 @@ static int opl3_load_patch(int dev, int - - static void opl3_panning(int dev, int voice, int value) - { -+ -+ if (voice < 0 || voice >= devc->nr_voice) -+ return; -+ - devc->voc[voice].panning = value; - } - -@@ -1066,8 +1070,15 @@ static int opl3_alloc_voice(int dev, int - - static void opl3_setup_voice(int dev, int voice, int chn) - { -- struct channel_info *info = -- &synth_devs[dev]->chn_info[chn]; -+ struct channel_info *info; -+ -+ if (voice < 0 || voice >= devc->nr_voice) -+ return; -+ -+ if (chn < 0 || chn > 15) -+ return; -+ -+ info = &synth_devs[dev]->chn_info[chn]; - - opl3_set_instr(dev, voice, info->pgm_num); - -From 8bc8aecdc5e26cfda12dbd6867af4aa67836da6a Mon Sep 17 00:00:00 2001 -From: Felix Fietkau -Date: Mon, 21 Mar 2011 20:01:00 +0100 -Subject: mac80211: initialize sta->last_rx in sta_info_alloc - -From: Felix Fietkau - -commit 8bc8aecdc5e26cfda12dbd6867af4aa67836da6a upstream. - -This field is used to determine the inactivity time. When in AP mode, -hostapd uses it for kicking out inactive clients after a while. Without this -patch, hostapd immediately deauthenticates a new client if it checks the -inactivity time before the client sends its first data frame. - -Signed-off-by: Felix Fietkau -Signed-off-by: John W. Linville -Signed-off-by: Greg Kroah-Hartman - ---- - net/mac80211/sta_info.c | 1 + - 1 file changed, 1 insertion(+) - ---- a/net/mac80211/sta_info.c -+++ b/net/mac80211/sta_info.c -@@ -243,6 +243,7 @@ struct sta_info *sta_info_alloc(struct i - memcpy(sta->sta.addr, addr, ETH_ALEN); - sta->local = local; - sta->sdata = sdata; -+ sta->last_rx = jiffies; - - ewma_init(&sta->avg_signal, 1024, 8); - -From 877a55979c189c590e819a61cbbe2b7947875f17 Mon Sep 17 00:00:00 2001 -From: John Hughes -Date: Wed, 4 Nov 2009 19:01:22 +0100 -Subject: [SCSI] ses: show devices for enclosures with no page 7 - -From: John Hughes - -commit 877a55979c189c590e819a61cbbe2b7947875f17 upstream. - -enclosure page 7 gives us the "pretty" names of the enclosure slots. -Without a page 7, we can still use the enclosure code as long as we -make up numeric names for the slots. Unfortunately, the current code -fails to add any devices because the check for page 10 is in the wrong -place if we have no page 7. Fix it so that devices show up even if -the enclosure has no page 7. - -Signed-off-by: James Bottomley -Signed-off-by: Greg Kroah-Hartman - ---- - drivers/scsi/ses.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - ---- a/drivers/scsi/ses.c -+++ b/drivers/scsi/ses.c -@@ -390,9 +390,9 @@ static void ses_enclosure_data_process(s - len = (desc_ptr[2] << 8) + desc_ptr[3]; - /* skip past overall descriptor */ - desc_ptr += len + 4; -- if (ses_dev->page10) -- addl_desc_ptr = ses_dev->page10 + 8; - } -+ if (ses_dev->page10) -+ addl_desc_ptr = ses_dev->page10 + 8; - type_ptr = ses_dev->page1 + 12 + ses_dev->page1[11]; - components = 0; - for (i = 0; i < types; i++, type_ptr += 4) { -From d1e12de804f9d8ad114786ca7c2ce593cba79891 Mon Sep 17 00:00:00 2001 -From: Krishnasamy, Somasundaram -Date: Mon, 28 Feb 2011 18:13:22 -0500 -Subject: [SCSI] ses: Avoid kernel panic when lun 0 is not mapped - -From: Krishnasamy, Somasundaram - -commit d1e12de804f9d8ad114786ca7c2ce593cba79891 upstream. - -During device discovery, scsi mid layer sends INQUIRY command to LUN -0. If the LUN 0 is not mapped to host, it creates a temporary -scsi_device with LUN id 0 and sends REPORT_LUNS command to it. After -the REPORT_LUNS succeeds, it walks through the LUN table and adds each -LUN found to sysfs. At the end of REPORT_LUNS lun table scan, it will -delete the temporary scsi_device of LUN 0. - -When scsi devices are added to sysfs, it calls add_dev function of all -the registered class interfaces. If ses driver has been registered, -ses_intf_add() of ses module will be called. This function calls -scsi_device_enclosure() to check the inquiry data for EncServ -bit. Since inquiry was not allocated for temporary LUN 0 scsi_device, -it will cause NULL pointer exception. - -To fix the problem, sdev->inquiry is checked for NULL before reading it. - -Signed-off-by: Somasundaram Krishnasamy -Signed-off-by: Babu Moger -Signed-off-by: James Bottomley -Signed-off-by: Greg Kroah-Hartman - ---- - include/scsi/scsi_device.h | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - ---- a/include/scsi/scsi_device.h -+++ b/include/scsi/scsi_device.h -@@ -461,7 +461,7 @@ static inline int scsi_device_qas(struct - } - static inline int scsi_device_enclosure(struct scsi_device *sdev) - { -- return sdev->inquiry[6] & (1<<6); -+ return sdev->inquiry ? (sdev->inquiry[6] & (1<<6)) : 1; - } - - static inline int scsi_device_protection(struct scsi_device *sdev) -From 8b8bae901ce23addbdcdb54fa1696fb2d049feb5 Mon Sep 17 00:00:00 2001 -From: Rafael J. Wysocki -Date: Sat, 5 Mar 2011 13:21:51 +0100 -Subject: PCI/ACPI: Report ASPM support to BIOS if not disabled from command line -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -From: Rafael J. Wysocki - -commit 8b8bae901ce23addbdcdb54fa1696fb2d049feb5 upstream. - -We need to distinguish the situation in which ASPM support is -disabled from the command line or through .config from the situation -in which it is disabled, because the hardware or BIOS can't handle -it. In the former case we should not report ASPM support to the BIOS -through ACPI _OSC, but in the latter case we should do that. - -Introduce pcie_aspm_support_enabled() that can be used by -acpi_pci_root_add() to determine whether or not it should report ASPM -support to the BIOS through _OSC. - -References: https://bugzilla.kernel.org/show_bug.cgi?id=29722 -References: https://bugzilla.kernel.org/show_bug.cgi?id=20232 -Reported-and-tested-by: Ortwin Glück -Reviewed-by: Kenji Kaneshige -Tested-by: Kenji Kaneshige -Signed-off-by: Rafael J. Wysocki -Signed-off-by: Jesse Barnes -Signed-off-by: Greg Kroah-Hartman - ---- - drivers/acpi/pci_root.c | 2 +- - drivers/pci/pcie/aspm.c | 7 +++++++ - include/linux/pci.h | 7 +++---- - 3 files changed, 11 insertions(+), 5 deletions(-) - ---- a/drivers/acpi/pci_root.c -+++ b/drivers/acpi/pci_root.c -@@ -564,7 +564,7 @@ static int __devinit acpi_pci_root_add(s - /* Indicate support for various _OSC capabilities. */ - if (pci_ext_cfg_avail(root->bus->self)) - flags |= OSC_EXT_PCI_CONFIG_SUPPORT; -- if (pcie_aspm_enabled()) -+ if (pcie_aspm_support_enabled()) - flags |= OSC_ACTIVE_STATE_PWR_SUPPORT | - OSC_CLOCK_PWR_CAPABILITY_SUPPORT; - if (pci_msi_enabled()) ---- a/drivers/pci/pcie/aspm.c -+++ b/drivers/pci/pcie/aspm.c -@@ -69,6 +69,7 @@ struct pcie_link_state { - }; - - static int aspm_disabled, aspm_force, aspm_clear_state; -+static bool aspm_support_enabled = true; - static DEFINE_MUTEX(aspm_lock); - static LIST_HEAD(link_list); - -@@ -896,6 +897,7 @@ static int __init pcie_aspm_disable(char - { - if (!strcmp(str, "off")) { - aspm_disabled = 1; -+ aspm_support_enabled = false; - printk(KERN_INFO "PCIe ASPM is disabled\n"); - } else if (!strcmp(str, "force")) { - aspm_force = 1; -@@ -930,3 +932,8 @@ int pcie_aspm_enabled(void) - } - EXPORT_SYMBOL(pcie_aspm_enabled); - -+bool pcie_aspm_support_enabled(void) -+{ -+ return aspm_support_enabled; -+} -+EXPORT_SYMBOL(pcie_aspm_support_enabled); ---- a/include/linux/pci.h -+++ b/include/linux/pci.h -@@ -1002,12 +1002,11 @@ extern bool pcie_ports_auto; - #endif - - #ifndef CONFIG_PCIEASPM --static inline int pcie_aspm_enabled(void) --{ -- return 0; --} -+static inline int pcie_aspm_enabled(void) { return 0; } -+static inline bool pcie_aspm_support_enabled(void) { return false; } - #else - extern int pcie_aspm_enabled(void); -+extern bool pcie_aspm_support_enabled(void); - #endif - - #ifdef CONFIG_PCIEAER -From 4b239f458c229de044d6905c2b0f9fe16ed9e01e Mon Sep 17 00:00:00 2001 -From: Yinghai Lu -Date: Fri, 17 Dec 2010 16:58:28 -0800 -Subject: x86-64, mm: Put early page table high - -From: Yinghai Lu - -commit 4b239f458c229de044d6905c2b0f9fe16ed9e01e upstream. - -While dubug kdump, found current kernel will have problem with crashkernel=512M. - -It turns out that initial mapping is to 512M, and later initial mapping to 4G -(acutally is 2040M in my platform), will put page table near 512M. -then initial mapping to 128g will be near 2g. - -before this patch: -[ 0.000000] initial memory mapped : 0 - 20000000 -[ 0.000000] init_memory_mapping: [0x00000000000000-0x0000007f74ffff] -[ 0.000000] 0000000000 - 007f600000 page 2M -[ 0.000000] 007f600000 - 007f750000 page 4k -[ 0.000000] kernel direct mapping tables up to 7f750000 @ [0x1fffc000-0x1fffffff] -[ 0.000000] memblock_x86_reserve_range: [0x1fffc000-0x1fffdfff] PGTABLE -[ 0.000000] init_memory_mapping: [0x00000100000000-0x0000207fffffff] -[ 0.000000] 0100000000 - 2080000000 page 2M -[ 0.000000] kernel direct mapping tables up to 2080000000 @ [0x7bc01000-0x7bc83fff] -[ 0.000000] memblock_x86_reserve_range: [0x7bc01000-0x7bc7efff] PGTABLE -[ 0.000000] RAMDISK: 7bc84000 - 7f745000 -[ 0.000000] crashkernel reservation failed - No suitable area found. - -after patch: -[ 0.000000] initial memory mapped : 0 - 20000000 -[ 0.000000] init_memory_mapping: [0x00000000000000-0x0000007f74ffff] -[ 0.000000] 0000000000 - 007f600000 page 2M -[ 0.000000] 007f600000 - 007f750000 page 4k -[ 0.000000] kernel direct mapping tables up to 7f750000 @ [0x7f74c000-0x7f74ffff] -[ 0.000000] memblock_x86_reserve_range: [0x7f74c000-0x7f74dfff] PGTABLE -[ 0.000000] init_memory_mapping: [0x00000100000000-0x0000207fffffff] -[ 0.000000] 0100000000 - 2080000000 page 2M -[ 0.000000] kernel direct mapping tables up to 2080000000 @ [0x207ff7d000-0x207fffffff] -[ 0.000000] memblock_x86_reserve_range: [0x207ff7d000-0x207fffafff] PGTABLE -[ 0.000000] RAMDISK: 7bc84000 - 7f745000 -[ 0.000000] memblock_x86_reserve_range: [0x17000000-0x36ffffff] CRASH KERNEL -[ 0.000000] Reserving 512MB of memory at 368MB for crashkernel (System RAM: 133120MB) - -It means with the patch, page table for [0, 2g) will need 2g, instead of under 512M, -page table for [4g, 128g) will be near 128g, instead of under 2g. - -That would good, if we have lots of memory above 4g, like 1024g, or 2048g or 16T, will not put -related page table under 2g. that would be have chance to fill the under 2g if 1G or 2M page is -not used. - -the code change will use add map_low_page() and update unmap_low_page() for 64bit, and use them -to get access the corresponding high memory for page table setting. - -Signed-off-by: Yinghai Lu -LKML-Reference: <4D0C0734.7060900@kernel.org> -Signed-off-by: H. Peter Anvin -Signed-off-by: Greg Kroah-Hartman - ---- - arch/x86/mm/init.c | 9 ++----- - arch/x86/mm/init_64.c | 63 +++++++++++++++++++++----------------------------- - 2 files changed, 30 insertions(+), 42 deletions(-) - ---- a/arch/x86/mm/init.c -+++ b/arch/x86/mm/init.c -@@ -33,7 +33,7 @@ int direct_gbpages - static void __init find_early_table_space(unsigned long end, int use_pse, - int use_gbpages) - { -- unsigned long puds, pmds, ptes, tables, start; -+ unsigned long puds, pmds, ptes, tables, start = 0, good_end = end; - phys_addr_t base; - - puds = (end + PUD_SIZE - 1) >> PUD_SHIFT; -@@ -73,12 +73,9 @@ static void __init find_early_table_spac - * need roughly 0.5KB per GB. - */ - #ifdef CONFIG_X86_32 -- start = 0x7000; --#else -- start = 0x8000; -+ good_end = max_pfn_mapped << PAGE_SHIFT; - #endif -- base = memblock_find_in_range(start, max_pfn_mapped< -Date: Wed, 9 Mar 2011 11:49:13 -0600 -Subject: eCryptfs: Unlock page in write_begin error path - -From: Tyler Hicks - -commit 50f198ae16ac66508d4b8d5a40967a8507ad19ee upstream. - -Unlock the page in error path of ecryptfs_write_begin(). This may -happen, for example, if decryption fails while bring the page -up-to-date. - -Signed-off-by: Tyler Hicks -Signed-off-by: Greg Kroah-Hartman - ---- - fs/ecryptfs/mmap.c | 5 +++++ - 1 file changed, 5 insertions(+) - ---- a/fs/ecryptfs/mmap.c -+++ b/fs/ecryptfs/mmap.c -@@ -374,6 +374,11 @@ static int ecryptfs_write_begin(struct f - && (pos != 0)) - zero_user(page, 0, PAGE_CACHE_SIZE); - out: -+ if (unlikely(rc)) { -+ unlock_page(page); -+ page_cache_release(page); -+ *pagep = NULL; -+ } - return rc; - } - -From 1821df040ac3cd6a57518739f345da6d50ea9d3f Mon Sep 17 00:00:00 2001 -From: Roberto Sassu -Date: Thu, 17 Mar 2011 12:48:50 +0100 -Subject: eCryptfs: ecryptfs_keyring_auth_tok_for_sig() bug fix - -From: Roberto Sassu - -commit 1821df040ac3cd6a57518739f345da6d50ea9d3f upstream. - -The pointer '(*auth_tok_key)' is set to NULL in case request_key() -fails, in order to prevent its use by functions calling -ecryptfs_keyring_auth_tok_for_sig(). - -Signed-off-by: Roberto Sassu -Signed-off-by: Tyler Hicks -Signed-off-by: Greg Kroah-Hartman - ---- - fs/ecryptfs/keystore.c | 1 + - 1 file changed, 1 insertion(+) - ---- a/fs/ecryptfs/keystore.c -+++ b/fs/ecryptfs/keystore.c -@@ -1563,6 +1563,7 @@ int ecryptfs_keyring_auth_tok_for_sig(st - printk(KERN_ERR "Could not find key with description: [%s]\n", - sig); - rc = process_request_key_err(PTR_ERR(*auth_tok_key)); -+ (*auth_tok_key) = NULL; - goto out; - } - (*auth_tok) = ecryptfs_get_key_payload_data(*auth_tok_key); -From 60af520cf264ea26b2af3a6871bbd71850522aea Mon Sep 17 00:00:00 2001 -From: Tadeusz Struk -Date: Sun, 13 Mar 2011 16:56:17 +0800 -Subject: crypto: aesni-intel - fixed problem with packets that are not multiple of 64bytes - -From: Tadeusz Struk - -commit 60af520cf264ea26b2af3a6871bbd71850522aea upstream. - -This patch fixes problem with packets that are not multiple of 64bytes. - -Signed-off-by: Adrian Hoban -Signed-off-by: Aidan O'Mahony -Signed-off-by: Gabriele Paoloni -Signed-off-by: Tadeusz Struk -Signed-off-by: Herbert Xu -Signed-off-by: Greg Kroah-Hartman - ---- - arch/x86/crypto/aesni-intel_asm.S | 5 ++++- - arch/x86/crypto/aesni-intel_glue.c | 14 ++++++++++++-- - 2 files changed, 16 insertions(+), 3 deletions(-) - ---- a/arch/x86/crypto/aesni-intel_asm.S -+++ b/arch/x86/crypto/aesni-intel_asm.S -@@ -1612,6 +1612,7 @@ _zero_cipher_left_encrypt: - movdqa SHUF_MASK(%rip), %xmm10 - PSHUFB_XMM %xmm10, %xmm0 - -+ - ENCRYPT_SINGLE_BLOCK %xmm0, %xmm1 # Encrypt(K, Yn) - sub $16, %r11 - add %r13, %r11 -@@ -1634,7 +1635,9 @@ _zero_cipher_left_encrypt: - # GHASH computation for the last <16 byte block - sub %r13, %r11 - add $16, %r11 -- PSHUFB_XMM %xmm10, %xmm1 -+ -+ movdqa SHUF_MASK(%rip), %xmm10 -+ PSHUFB_XMM %xmm10, %xmm0 - - # shuffle xmm0 back to output as ciphertext - ---- a/arch/x86/crypto/aesni-intel_glue.c -+++ b/arch/x86/crypto/aesni-intel_glue.c -@@ -828,9 +828,15 @@ static int rfc4106_init(struct crypto_tf - struct cryptd_aead *cryptd_tfm; - struct aesni_rfc4106_gcm_ctx *ctx = (struct aesni_rfc4106_gcm_ctx *) - PTR_ALIGN((u8 *)crypto_tfm_ctx(tfm), AESNI_ALIGN); -+ struct crypto_aead *cryptd_child; -+ struct aesni_rfc4106_gcm_ctx *child_ctx; - cryptd_tfm = cryptd_alloc_aead("__driver-gcm-aes-aesni", 0, 0); - if (IS_ERR(cryptd_tfm)) - return PTR_ERR(cryptd_tfm); -+ -+ cryptd_child = cryptd_aead_child(cryptd_tfm); -+ child_ctx = aesni_rfc4106_gcm_ctx_get(cryptd_child); -+ memcpy(child_ctx, ctx, sizeof(*ctx)); - ctx->cryptd_tfm = cryptd_tfm; - tfm->crt_aead.reqsize = sizeof(struct aead_request) - + crypto_aead_reqsize(&cryptd_tfm->base); -@@ -925,6 +931,9 @@ static int rfc4106_set_key(struct crypto - int ret = 0; - struct crypto_tfm *tfm = crypto_aead_tfm(parent); - struct aesni_rfc4106_gcm_ctx *ctx = aesni_rfc4106_gcm_ctx_get(parent); -+ struct crypto_aead *cryptd_child = cryptd_aead_child(ctx->cryptd_tfm); -+ struct aesni_rfc4106_gcm_ctx *child_ctx = -+ aesni_rfc4106_gcm_ctx_get(cryptd_child); - u8 *new_key_mem = NULL; - - if (key_len < 4) { -@@ -968,6 +977,7 @@ static int rfc4106_set_key(struct crypto - goto exit; - } - ret = rfc4106_set_hash_subkey(ctx->hash_subkey, key, key_len); -+ memcpy(child_ctx, ctx, sizeof(*ctx)); - exit: - kfree(new_key_mem); - return ret; -@@ -999,7 +1009,6 @@ static int rfc4106_encrypt(struct aead_r - int ret; - struct crypto_aead *tfm = crypto_aead_reqtfm(req); - struct aesni_rfc4106_gcm_ctx *ctx = aesni_rfc4106_gcm_ctx_get(tfm); -- struct crypto_aead *cryptd_child = cryptd_aead_child(ctx->cryptd_tfm); - - if (!irq_fpu_usable()) { - struct aead_request *cryptd_req = -@@ -1008,6 +1017,7 @@ static int rfc4106_encrypt(struct aead_r - aead_request_set_tfm(cryptd_req, &ctx->cryptd_tfm->base); - return crypto_aead_encrypt(cryptd_req); - } else { -+ struct crypto_aead *cryptd_child = cryptd_aead_child(ctx->cryptd_tfm); - kernel_fpu_begin(); - ret = cryptd_child->base.crt_aead.encrypt(req); - kernel_fpu_end(); -@@ -1020,7 +1030,6 @@ static int rfc4106_decrypt(struct aead_r - int ret; - struct crypto_aead *tfm = crypto_aead_reqtfm(req); - struct aesni_rfc4106_gcm_ctx *ctx = aesni_rfc4106_gcm_ctx_get(tfm); -- struct crypto_aead *cryptd_child = cryptd_aead_child(ctx->cryptd_tfm); - - if (!irq_fpu_usable()) { - struct aead_request *cryptd_req = -@@ -1029,6 +1038,7 @@ static int rfc4106_decrypt(struct aead_r - aead_request_set_tfm(cryptd_req, &ctx->cryptd_tfm->base); - return crypto_aead_decrypt(cryptd_req); - } else { -+ struct crypto_aead *cryptd_child = cryptd_aead_child(ctx->cryptd_tfm); - kernel_fpu_begin(); - ret = cryptd_child->base.crt_aead.decrypt(req); - kernel_fpu_end(); diff --git a/patches/fix-hibernate-resume-2.6.38.patch b/patches/fix-hibernate-resume-2.6.38.patch new file mode 100644 index 0000000..d5fffd8 --- /dev/null +++ b/patches/fix-hibernate-resume-2.6.38.patch @@ -0,0 +1,18 @@ +diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c +index 5a0484a..4be9b39 100644 +--- a/arch/x86/kernel/setup.c ++++ b/arch/x86/kernel/setup.c +@@ -976,6 +976,11 @@ void __init setup_arch(char **cmdline_p) + paging_init(); + x86_init.paging.pagetable_setup_done(swapper_pg_dir); + ++ if (boot_cpu_data.cpuid_level >= 0) { ++ /* A CPU has %cr4 if and only if it has CPUID */ ++ mmu_cr4_features = read_cr4(); ++ } ++ + #ifdef CONFIG_X86_32 + /* sync back kernel address range */ + clone_pgd_range(initial_page_table + KERNEL_PGD_BOUNDARY, + + \ No newline at end of file diff --git a/patches/kernel-2.6.38.4-pre.patch b/patches/kernel-2.6.38.4-pre.patch new file mode 100644 index 0000000..1e5ac15 --- /dev/null +++ b/patches/kernel-2.6.38.4-pre.patch @@ -0,0 +1,1923 @@ +From a626ca6a656450e9f4df91d0dda238fff23285f4 Mon Sep 17 00:00:00 2001 +From: Linus Torvalds +Date: Wed, 13 Apr 2011 08:07:28 -0700 +Subject: vm: fix vm_pgoff wrap in stack expansion +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Linus Torvalds + +commit a626ca6a656450e9f4df91d0dda238fff23285f4 upstream. + +Commit 982134ba6261 ("mm: avoid wrapping vm_pgoff in mremap()") fixed +the case of a expanding mapping causing vm_pgoff wrapping when you used +mremap. But there was another case where we expand mappings hiding in +plain sight: the automatic stack expansion. + +This fixes that case too. + +This one also found by Robert ÅšwiÄ™cki, using his nasty system call +fuzzer tool. Good job. + +Reported-and-tested-by: Robert ÅšwiÄ™cki +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/mmap.c | 13 ++++++++----- + 1 file changed, 8 insertions(+), 5 deletions(-) + +--- a/mm/mmap.c ++++ b/mm/mmap.c +@@ -1814,11 +1814,14 @@ static int expand_downwards(struct vm_ar + size = vma->vm_end - address; + grow = (vma->vm_start - address) >> PAGE_SHIFT; + +- error = acct_stack_growth(vma, size, grow); +- if (!error) { +- vma->vm_start = address; +- vma->vm_pgoff -= grow; +- perf_event_mmap(vma); ++ error = -ENOMEM; ++ if (grow <= vma->vm_pgoff) { ++ error = acct_stack_growth(vma, size, grow); ++ if (!error) { ++ vma->vm_start = address; ++ vma->vm_pgoff -= grow; ++ perf_event_mmap(vma); ++ } + } + } + vma_unlock_anon_vma(vma); +From 9bb09fa1b5b07459279301ac6220d575f307597b Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Thu, 7 Apr 2011 10:31:25 -0400 +Subject: drm/radeon/kms: pll tweaks for rv6xx + +From: Alex Deucher + +commit 9bb09fa1b5b07459279301ac6220d575f307597b upstream. + +Prefer minm over maxp. + +Fixes: +https://bugs.freedesktop.org/show_bug.cgi?id=35994 + +Signed-off-by: Alex Deucher +Signed-off-by: Dave Airlie +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/radeon/atombios_crtc.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/gpu/drm/radeon/atombios_crtc.c ++++ b/drivers/gpu/drm/radeon/atombios_crtc.c +@@ -531,6 +531,12 @@ static u32 atombios_adjust_pll(struct dr + pll->flags |= RADEON_PLL_PREFER_HIGH_FB_DIV; + else + pll->flags |= RADEON_PLL_PREFER_LOW_REF_DIV; ++ ++ if ((rdev->family == CHIP_R600) || ++ (rdev->family == CHIP_RV610) || ++ (rdev->family == CHIP_RV630) || ++ (rdev->family == CHIP_RV670)) ++ pll->flags |= RADEON_PLL_PREFER_MINM_OVER_MAXP; + } else { + pll->flags |= RADEON_PLL_LEGACY; + +From 71e16bfbd2b1c63d4d97cc5059694c9346aee340 Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Tue, 12 Apr 2011 13:33:27 -0400 +Subject: drm/radeon/kms: fix suspend on rv530 asics + +From: Alex Deucher + +commit 71e16bfbd2b1c63d4d97cc5059694c9346aee340 upstream. + +Apparently only rv515 asics need the workaround +added in f24d86f1a49505cdea56728b853a5d0a3f8e3d11 +(drm/radeon/kms: fix resume regression for some r5xx laptops). + +Fixes: +https://bugs.freedesktop.org/show_bug.cgi?id=34709 + +Signed-off-by: Alex Deucher +Signed-off-by: Dave Airlie +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/radeon/atom.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/radeon/atom.c ++++ b/drivers/gpu/drm/radeon/atom.c +@@ -32,6 +32,7 @@ + #include "atom.h" + #include "atom-names.h" + #include "atom-bits.h" ++#include "radeon.h" + + #define ATOM_COND_ABOVE 0 + #define ATOM_COND_ABOVEOREQUAL 1 +@@ -101,7 +102,9 @@ static void debug_print_spaces(int n) + static uint32_t atom_iio_execute(struct atom_context *ctx, int base, + uint32_t index, uint32_t data) + { ++ struct radeon_device *rdev = ctx->card->dev->dev_private; + uint32_t temp = 0xCDCDCDCD; ++ + while (1) + switch (CU8(base)) { + case ATOM_IIO_NOP: +@@ -112,7 +115,8 @@ static uint32_t atom_iio_execute(struct + base += 3; + break; + case ATOM_IIO_WRITE: +- (void)ctx->card->ioreg_read(ctx->card, CU16(base + 1)); ++ if (rdev->family == CHIP_RV515) ++ (void)ctx->card->ioreg_read(ctx->card, CU16(base + 1)); + ctx->card->ioreg_write(ctx->card, CU16(base + 1), temp); + base += 3; + break; +From 70945643722ffeac779d2529a348f99567fa5c33 Mon Sep 17 00:00:00 2001 +From: Jeff Layton +Date: Mon, 14 Mar 2011 13:48:08 -0400 +Subject: cifs: always do is_path_accessible check in cifs_mount + +From: Jeff Layton + +commit 70945643722ffeac779d2529a348f99567fa5c33 upstream. + +Currently, we skip doing the is_path_accessible check in cifs_mount if +there is no prefixpath. I have a report of at least one server however +that allows a TREE_CONNECT to a share that has a DFS referral at its +root. The reporter in this case was using a UNC that had no prefixpath, +so the is_path_accessible check was not triggered and the box later hit +a BUG() because we were chasing a DFS referral on the root dentry for +the mount. + +This patch fixes this by removing the check for a zero-length +prefixpath. That should make the is_path_accessible check be done in +this situation and should allow the client to chase the DFS referral at +mount time instead. + +Reported-and-Tested-by: Yogesh Sharma +Signed-off-by: Jeff Layton +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman + +--- + fs/cifs/connect.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/cifs/connect.c ++++ b/fs/cifs/connect.c +@@ -2826,7 +2826,7 @@ try_mount_again: + + remote_path_check: + /* check if a whole path (including prepath) is not remote */ +- if (!rc && cifs_sb->prepathlen && tcon) { ++ if (!rc && tcon) { + /* build_path_to_root works only when we have a valid tcon */ + full_path = cifs_build_path_to_root(cifs_sb, tcon); + if (full_path == NULL) { +From 7797069305d13252fd66cf722aa8f2cbeb3c95cd Mon Sep 17 00:00:00 2001 +From: Jeff Layton +Date: Tue, 5 Apr 2011 16:23:47 -0700 +Subject: cifs: check for private_data before trying to put it + +From: Jeff Layton + +commit 7797069305d13252fd66cf722aa8f2cbeb3c95cd upstream. + +cifs_close doesn't check that the filp->private_data is non-NULL before +trying to put it. That can cause an oops in certain error conditions +that can occur on open or lookup before the private_data is set. + +Reported-by: Ben Greear +Signed-off-by: Jeff Layton +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman + +--- + fs/cifs/file.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/fs/cifs/file.c ++++ b/fs/cifs/file.c +@@ -575,8 +575,10 @@ reopen_error_exit: + + int cifs_close(struct inode *inode, struct file *file) + { +- cifsFileInfo_put(file->private_data); +- file->private_data = NULL; ++ if (file->private_data != NULL) { ++ cifsFileInfo_put(file->private_data); ++ file->private_data = NULL; ++ } + + /* return code from the ->release op is always ignored */ + return 0; +From 2b6c26a0a62cc0bab0ad487533d5581d7c293fef Mon Sep 17 00:00:00 2001 +From: Jeff Layton +Date: Fri, 25 Mar 2011 16:25:57 -0400 +Subject: cifs: set ra_pages in backing_dev_info + +From: Jeff Layton + +commit 2b6c26a0a62cc0bab0ad487533d5581d7c293fef upstream. + +Commit 522440ed made cifs set backing_dev_info on the mapping attached +to new inodes. This change caused a fairly significant read performance +regression, as cifs started doing page-sized reads exclusively. + +By virtue of the fact that they're allocated as part of cifs_sb_info by +kzalloc, the ra_pages on cifs BDIs get set to 0, which prevents any +readahead. This forces the normal read codepaths to use readpage instead +of readpages causing a four-fold increase in the number of read calls +with the default rsize. + +Fix it by setting ra_pages in the BDI to the same value as that in the +default_backing_dev_info. + +Fixes https://bugzilla.kernel.org/show_bug.cgi?id=31662 + +Reported-and-Tested-by: Till +Signed-off-by: Jeff Layton +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman + +--- + fs/cifs/cifsfs.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/fs/cifs/cifsfs.c ++++ b/fs/cifs/cifsfs.c +@@ -127,6 +127,7 @@ cifs_read_super(struct super_block *sb, + kfree(cifs_sb); + return rc; + } ++ cifs_sb->bdi.ra_pages = default_backing_dev_info.ra_pages; + + #ifdef CONFIG_CIFS_DFS_UPCALL + /* copy mount params to sb for use in submounts */ +From 157c249114508aa71daa308a426e15d81a4eed00 Mon Sep 17 00:00:00 2001 +From: Jeff Layton +Date: Sat, 2 Apr 2011 07:34:30 -0400 +Subject: cifs: wrap received signature check in srv_mutex + +From: Jeff Layton + +commit 157c249114508aa71daa308a426e15d81a4eed00 upstream. + +While testing my patchset to fix asynchronous writes, I hit a bunch +of signature problems when testing with signing on. The problem seems +to be that signature checks on receive can be running at the same +time as a process that is sending, or even that multiple receives can +be checking signatures at the same time, clobbering the same data +structures. + +While we're at it, clean up the comments over cifs_calculate_signature +and add a note that the srv_mutex should be held when calling this +function. + +This patch seems to fix the problems for me, but I'm not clear on +whether it's the best approach. If it is, then this should probably +go to stable too. + +Cc: Shirish Pargaonkar +Signed-off-by: Jeff Layton +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman + +--- + fs/cifs/cifsencrypt.c | 15 +++++++++------ + 1 file changed, 9 insertions(+), 6 deletions(-) + +--- a/fs/cifs/cifsencrypt.c ++++ b/fs/cifs/cifsencrypt.c +@@ -30,12 +30,13 @@ + #include + #include + +-/* Calculate and return the CIFS signature based on the mac key and SMB PDU */ +-/* the 16 byte signature must be allocated by the caller */ +-/* Note we only use the 1st eight bytes */ +-/* Note that the smb header signature field on input contains the +- sequence number before this function is called */ +- ++/* ++ * Calculate and return the CIFS signature based on the mac key and SMB PDU. ++ * The 16 byte signature must be allocated by the caller. Note we only use the ++ * 1st eight bytes and that the smb header signature field on input contains ++ * the sequence number before this function is called. Also, this function ++ * should be called with the server->srv_mutex held. ++ */ + static int cifs_calculate_signature(const struct smb_hdr *cifs_pdu, + struct TCP_Server_Info *server, char *signature) + { +@@ -209,8 +210,10 @@ int cifs_verify_signature(struct smb_hdr + cpu_to_le32(expected_sequence_number); + cifs_pdu->Signature.Sequence.Reserved = 0; + ++ mutex_lock(&server->srv_mutex); + rc = cifs_calculate_signature(cifs_pdu, server, + what_we_think_sig_should_be); ++ mutex_unlock(&server->srv_mutex); + + if (rc) + return rc; +From 14ddc3188d50855ae2a419a6aced995e2834e5d4 Mon Sep 17 00:00:00 2001 +From: Vasiliy Kulikov +Date: Fri, 4 Feb 2011 09:23:33 -0300 +Subject: [media] video: sn9c102: world-wirtable sysfs files + +From: Vasiliy Kulikov + +commit 14ddc3188d50855ae2a419a6aced995e2834e5d4 upstream. + +Don't allow everybody to change video settings. + +Signed-off-by: Vasiliy Kulikov +Acked-by: Mauro Carvalho Chehab +Acked-by: Luca Risolia +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/video/sn9c102/sn9c102_core.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/media/video/sn9c102/sn9c102_core.c ++++ b/drivers/media/video/sn9c102/sn9c102_core.c +@@ -1430,9 +1430,9 @@ static DEVICE_ATTR(i2c_reg, S_IRUGO | S_ + sn9c102_show_i2c_reg, sn9c102_store_i2c_reg); + static DEVICE_ATTR(i2c_val, S_IRUGO | S_IWUSR, + sn9c102_show_i2c_val, sn9c102_store_i2c_val); +-static DEVICE_ATTR(green, S_IWUGO, NULL, sn9c102_store_green); +-static DEVICE_ATTR(blue, S_IWUGO, NULL, sn9c102_store_blue); +-static DEVICE_ATTR(red, S_IWUGO, NULL, sn9c102_store_red); ++static DEVICE_ATTR(green, S_IWUSR, NULL, sn9c102_store_green); ++static DEVICE_ATTR(blue, S_IWUSR, NULL, sn9c102_store_blue); ++static DEVICE_ATTR(red, S_IWUSR, NULL, sn9c102_store_red); + static DEVICE_ATTR(frame_header, S_IRUGO, sn9c102_show_frame_header, NULL); + + +From 8c559d30b4e59cf6994215ada1fe744928f494bf Mon Sep 17 00:00:00 2001 +From: Vasiliy Kulikov +Date: Fri, 4 Feb 2011 15:24:19 +0300 +Subject: UBIFS: restrict world-writable debugfs files + +From: Vasiliy Kulikov + +commit 8c559d30b4e59cf6994215ada1fe744928f494bf upstream. + +Don't allow everybody to dump sensitive information about filesystems. + +Signed-off-by: Vasiliy Kulikov +Signed-off-by: Artem Bityutskiy +Signed-off-by: Greg Kroah-Hartman + +--- + fs/ubifs/debug.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/fs/ubifs/debug.c ++++ b/fs/ubifs/debug.c +@@ -2844,19 +2844,19 @@ int dbg_debugfs_init_fs(struct ubifs_inf + } + + fname = "dump_lprops"; +- dent = debugfs_create_file(fname, S_IWUGO, d->dfs_dir, c, &dfs_fops); ++ dent = debugfs_create_file(fname, S_IWUSR, d->dfs_dir, c, &dfs_fops); + if (IS_ERR(dent)) + goto out_remove; + d->dfs_dump_lprops = dent; + + fname = "dump_budg"; +- dent = debugfs_create_file(fname, S_IWUGO, d->dfs_dir, c, &dfs_fops); ++ dent = debugfs_create_file(fname, S_IWUSR, d->dfs_dir, c, &dfs_fops); + if (IS_ERR(dent)) + goto out_remove; + d->dfs_dump_budg = dent; + + fname = "dump_tnc"; +- dent = debugfs_create_file(fname, S_IWUGO, d->dfs_dir, c, &dfs_fops); ++ dent = debugfs_create_file(fname, S_IWUSR, d->dfs_dir, c, &dfs_fops); + if (IS_ERR(dent)) + goto out_remove; + d->dfs_dump_tnc = dent; +From c6b358748e19ce7e230b0926ac42696bc485a562 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Mon, 28 Mar 2011 12:05:31 +0200 +Subject: ALSA: hda - Fix pin-config of Gigabyte mobo + +From: Takashi Iwai + +commit c6b358748e19ce7e230b0926ac42696bc485a562 upstream. + +Use pin-fix instead of the static quirk for Gigabyte mobos 1458:a002. + +Bugzilla: https://bugzilla.novell.com/show_bug.cgi?id=677256 +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_realtek.c | 21 ++++++++++++++++++--- + 1 file changed, 18 insertions(+), 3 deletions(-) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -9932,7 +9932,6 @@ static struct snd_pci_quirk alc882_cfg_t + SND_PCI_QUIRK(0x1071, 0x8258, "Evesham Voyaeger", ALC883_LAPTOP_EAPD), + SND_PCI_QUIRK(0x10f1, 0x2350, "TYAN-S2350", ALC888_6ST_DELL), + SND_PCI_QUIRK(0x108e, 0x534d, NULL, ALC883_3ST_6ch), +- SND_PCI_QUIRK(0x1458, 0xa002, "Gigabyte P35 DS3R", ALC882_6ST_DIG), + + SND_PCI_QUIRK(0x1462, 0x0349, "MSI", ALC883_TARGA_2ch_DIG), + SND_PCI_QUIRK(0x1462, 0x040d, "MSI", ALC883_TARGA_2ch_DIG), +@@ -10769,6 +10768,7 @@ enum { + PINFIX_LENOVO_Y530, + PINFIX_PB_M5210, + PINFIX_ACER_ASPIRE_7736, ++ PINFIX_GIGABYTE_880GM, + }; + + static const struct alc_fixup alc882_fixups[] = { +@@ -10800,6 +10800,13 @@ static const struct alc_fixup alc882_fix + .type = ALC_FIXUP_SKU, + .v.sku = ALC_FIXUP_SKU_IGNORE, + }, ++ [PINFIX_GIGABYTE_880GM] = { ++ .type = ALC_FIXUP_PINS, ++ .v.pins = (const struct alc_pincfg[]) { ++ { 0x14, 0x1114410 }, /* set as speaker */ ++ { } ++ } ++ }, + }; + + static struct snd_pci_quirk alc882_fixup_tbl[] = { +@@ -10807,6 +10814,7 @@ static struct snd_pci_quirk alc882_fixup + SND_PCI_QUIRK(0x17aa, 0x3a0d, "Lenovo Y530", PINFIX_LENOVO_Y530), + SND_PCI_QUIRK(0x147b, 0x107a, "Abit AW9D-MAX", PINFIX_ABIT_AW9D_MAX), + SND_PCI_QUIRK(0x1025, 0x0296, "Acer Aspire 7736z", PINFIX_ACER_ASPIRE_7736), ++ SND_PCI_QUIRK(0x1458, 0xa002, "Gigabyte", PINFIX_GIGABYTE_880GM), + {} + }; + +@@ -18851,8 +18859,6 @@ static struct snd_pci_quirk alc662_cfg_t + ALC662_3ST_6ch_DIG), + SND_PCI_QUIRK(0x1179, 0xff6e, "Toshiba NB20x", ALC662_AUTO), + SND_PCI_QUIRK(0x144d, 0xca00, "Samsung NC10", ALC272_SAMSUNG_NC10), +- SND_PCI_QUIRK(0x1458, 0xa002, "Gigabyte 945GCM-S2L", +- ALC662_3ST_6ch_DIG), + SND_PCI_QUIRK(0x152d, 0x2304, "Quanta WH1", ALC663_ASUS_H13), + SND_PCI_QUIRK(0x1565, 0x820f, "Biostar TA780G M2+", ALC662_3ST_6ch_DIG), + SND_PCI_QUIRK(0x1631, 0xc10c, "PB RS65", ALC663_ASUS_M51VA), +@@ -19526,6 +19532,7 @@ enum { + ALC662_FIXUP_IDEAPAD, + ALC272_FIXUP_MARIO, + ALC662_FIXUP_CZC_P10T, ++ ALC662_FIXUP_GIGABYTE, + }; + + static const struct alc_fixup alc662_fixups[] = { +@@ -19554,12 +19561,20 @@ static const struct alc_fixup alc662_fix + {} + } + }, ++ [ALC662_FIXUP_GIGABYTE] = { ++ .type = ALC_FIXUP_PINS, ++ .v.pins = (const struct alc_pincfg[]) { ++ { 0x14, 0x1114410 }, /* set as speaker */ ++ { } ++ } ++ }, + }; + + static struct snd_pci_quirk alc662_fixup_tbl[] = { + SND_PCI_QUIRK(0x1025, 0x0308, "Acer Aspire 8942G", ALC662_FIXUP_ASPIRE), + SND_PCI_QUIRK(0x1025, 0x038b, "Acer Aspire 8943G", ALC662_FIXUP_ASPIRE), + SND_PCI_QUIRK(0x144d, 0xc051, "Samsung R720", ALC662_FIXUP_IDEAPAD), ++ SND_PCI_QUIRK(0x1458, 0xa002, "Gigabyte", ALC662_FIXUP_GIGABYTE), + SND_PCI_QUIRK(0x17aa, 0x38af, "Lenovo Ideapad Y550P", ALC662_FIXUP_IDEAPAD), + SND_PCI_QUIRK(0x17aa, 0x3a0d, "Lenovo Ideapad Y550", ALC662_FIXUP_IDEAPAD), + SND_PCI_QUIRK(0x1b35, 0x2206, "CZC P10T", ALC662_FIXUP_CZC_P10T), +From 468c3f924f043cad7a04f4f4d5224a2c9bc886c1 Mon Sep 17 00:00:00 2001 +From: Jiri Slaby +Date: Sun, 13 Mar 2011 06:54:31 +0000 +Subject: NET: cdc-phonet, handle empty phonet header +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jiri Slaby + +commit 468c3f924f043cad7a04f4f4d5224a2c9bc886c1 upstream. + +Currently, for N 5800 XM I get: +cdc_phonet: probe of 1-6:1.10 failed with error -22 + +It's because phonet_header is empty. Extra altsetting looks like +there: +E 05 24 00 01 10 03 24 ab 05 24 06 0a 0b 04 24 fd .$....$..$....$. +E 00 . + +I don't see the header used anywhere so just check if the phonet +descriptor is there, not the structure itself. + +Signed-off-by: Jiri Slaby +Cc: Rémi Denis-Courmont +Cc: David S. Miller +Acked-by: Rémi Denis-Courmont +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/usb/cdc-phonet.c | 9 +++------ + 1 file changed, 3 insertions(+), 6 deletions(-) + +--- a/drivers/net/usb/cdc-phonet.c ++++ b/drivers/net/usb/cdc-phonet.c +@@ -328,13 +328,13 @@ int usbpn_probe(struct usb_interface *in + { + static const char ifname[] = "usbpn%d"; + const struct usb_cdc_union_desc *union_header = NULL; +- const struct usb_cdc_header_desc *phonet_header = NULL; + const struct usb_host_interface *data_desc; + struct usb_interface *data_intf; + struct usb_device *usbdev = interface_to_usbdev(intf); + struct net_device *dev; + struct usbpn_dev *pnd; + u8 *data; ++ int phonet = 0; + int len, err; + + data = intf->altsetting->extra; +@@ -355,10 +355,7 @@ int usbpn_probe(struct usb_interface *in + (struct usb_cdc_union_desc *)data; + break; + case 0xAB: +- if (phonet_header || dlen < 5) +- break; +- phonet_header = +- (struct usb_cdc_header_desc *)data; ++ phonet = 1; + break; + } + } +@@ -366,7 +363,7 @@ int usbpn_probe(struct usb_interface *in + len -= dlen; + } + +- if (!union_header || !phonet_header) ++ if (!union_header || !phonet) + return -EINVAL; + + data_intf = usb_ifnum_to_if(usbdev, union_header->bSlaveInterface0); +From e938c287ea8d977e079f07464ac69923412663ce Mon Sep 17 00:00:00 2001 +From: Jan Beulich +Date: Tue, 1 Mar 2011 14:28:02 +0000 +Subject: x86: Fix a bogus unwind annotation in lib/semaphore_32.S + +From: Jan Beulich + +commit e938c287ea8d977e079f07464ac69923412663ce upstream. + +'simple' would have required specifying current frame address +and return address location manually, but that's obviously not +the case (and not necessary) here. + +Signed-off-by: Jan Beulich +LKML-Reference: <4D6D1082020000780003454C@vpn.id2.novell.com> +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/lib/semaphore_32.S | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/x86/lib/semaphore_32.S ++++ b/arch/x86/lib/semaphore_32.S +@@ -36,7 +36,7 @@ + */ + #ifdef CONFIG_SMP + ENTRY(__write_lock_failed) +- CFI_STARTPROC simple ++ CFI_STARTPROC + FRAME + 2: LOCK_PREFIX + addl $ RW_LOCK_BIAS,(%eax) +From b4a6b3436531f6c5256e6d60d388c3c28ff1a0e9 Mon Sep 17 00:00:00 2001 +From: Jeff Mahoney +Date: Thu, 24 Feb 2011 15:33:24 -0500 +Subject: [IA64] tioca: Fix assignment from incompatible pointer warnings + +From: Jeff Mahoney + +commit b4a6b3436531f6c5256e6d60d388c3c28ff1a0e9 upstream. + +The prototype for sn_pci_provider->{dma_map,dma_map_consistent} expects +an unsigned long instead of a u64. + +Signed-off-by: Jeff Mahoney +Signed-off-by: Tony Luck +Signed-off-by: Greg Kroah-Hartman + +--- + arch/ia64/sn/pci/tioca_provider.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/ia64/sn/pci/tioca_provider.c ++++ b/arch/ia64/sn/pci/tioca_provider.c +@@ -509,7 +509,7 @@ tioca_dma_unmap(struct pci_dev *pdev, dm + * use the GART mapped mode. + */ + static u64 +-tioca_dma_map(struct pci_dev *pdev, u64 paddr, size_t byte_count, int dma_flags) ++tioca_dma_map(struct pci_dev *pdev, unsigned long paddr, size_t byte_count, int dma_flags) + { + u64 mapaddr; + +From c1d036c4d1cb00b7e8473a2ad0a78f13e13a8183 Mon Sep 17 00:00:00 2001 +From: Jeff Mahoney +Date: Thu, 24 Feb 2011 17:23:09 -0500 +Subject: [IA64] mca.c: Fix cast from integer to pointer warning + +From: Jeff Mahoney + +commit c1d036c4d1cb00b7e8473a2ad0a78f13e13a8183 upstream. + +ia64_mca_cpu_init has a void *data local variable that is assigned +the value from either __get_free_pages() or mca_bootmem(). The problem +is that __get_free_pages returns an unsigned long and mca_bootmem, via +alloc_bootmem(), returns a void *. format_mca_init_stack takes the void *, +and it's also used with __pa(), but that casts it to long anyway. + +This results in the following build warning: + +arch/ia64/kernel/mca.c:1898: warning: assignment makes pointer from +integer without a cast + +Cast the return of __get_free_pages to a void * to avoid +the warning. + +Signed-off-by: Jeff Mahoney +Signed-off-by: Tony Luck +Signed-off-by: Greg Kroah-Hartman + +--- + arch/ia64/kernel/mca.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/arch/ia64/kernel/mca.c ++++ b/arch/ia64/kernel/mca.c +@@ -1859,7 +1859,8 @@ ia64_mca_cpu_init(void *cpu_data) + data = mca_bootmem(); + first_time = 0; + } else +- data = __get_free_pages(GFP_KERNEL, get_order(sz)); ++ data = (void *)__get_free_pages(GFP_KERNEL, ++ get_order(sz)); + if (!data) + panic("Could not allocate MCA memory for cpu %d\n", + cpu); +From 95042f9eb78a8d9a17455e2ef263f2f310ecef15 Mon Sep 17 00:00:00 2001 +From: Linus Torvalds +Date: Tue, 12 Apr 2011 14:15:51 -0700 +Subject: vm: fix mlock() on stack guard page +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Linus Torvalds + +commit 95042f9eb78a8d9a17455e2ef263f2f310ecef15 upstream. + +Commit 53a7706d5ed8 ("mlock: do not hold mmap_sem for extended periods +of time") changed mlock() to care about the exact number of pages that +__get_user_pages() had brought it. Before, it would only care about +errors. + +And that doesn't work, because we also handled one page specially in +__mlock_vma_pages_range(), namely the stack guard page. So when that +case was handled, the number of pages that the function returned was off +by one. In particular, it could be zero, and then the caller would end +up not making any progress at all. + +Rather than try to fix up that off-by-one error for the mlock case +specially, this just moves the logic to handle the stack guard page +into__get_user_pages() itself, thus making all the counts come out +right automatically. + +Reported-by: Robert ÅšwiÄ™cki +Cc: Hugh Dickins +Cc: Oleg Nesterov +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + + +--- + mm/memory.c | 26 ++++++++++++++++++-------- + mm/mlock.c | 13 ------------- + 2 files changed, 18 insertions(+), 21 deletions(-) + +--- a/mm/memory.c ++++ b/mm/memory.c +@@ -1410,6 +1410,13 @@ no_page_table: + return page; + } + ++static inline int stack_guard_page(struct vm_area_struct *vma, unsigned long addr) ++{ ++ return (vma->vm_flags & VM_GROWSDOWN) && ++ (vma->vm_start == addr) && ++ !vma_stack_continue(vma->vm_prev, addr); ++} ++ + int __get_user_pages(struct task_struct *tsk, struct mm_struct *mm, + unsigned long start, int nr_pages, unsigned int gup_flags, + struct page **pages, struct vm_area_struct **vmas, +@@ -1439,7 +1446,6 @@ int __get_user_pages(struct task_struct + vma = find_extend_vma(mm, start); + if (!vma && in_gate_area(tsk, start)) { + unsigned long pg = start & PAGE_MASK; +- struct vm_area_struct *gate_vma = get_gate_vma(tsk); + pgd_t *pgd; + pud_t *pud; + pmd_t *pmd; +@@ -1464,10 +1470,11 @@ int __get_user_pages(struct task_struct + pte_unmap(pte); + return i ? : -EFAULT; + } ++ vma = get_gate_vma(tsk); + if (pages) { + struct page *page; + +- page = vm_normal_page(gate_vma, start, *pte); ++ page = vm_normal_page(vma, start, *pte); + if (!page) { + if (!(gup_flags & FOLL_DUMP) && + is_zero_pfn(pte_pfn(*pte))) +@@ -1481,12 +1488,7 @@ int __get_user_pages(struct task_struct + get_page(page); + } + pte_unmap(pte); +- if (vmas) +- vmas[i] = gate_vma; +- i++; +- start += PAGE_SIZE; +- nr_pages--; +- continue; ++ goto next_page; + } + + if (!vma || +@@ -1500,6 +1502,13 @@ int __get_user_pages(struct task_struct + continue; + } + ++ /* ++ * If we don't actually want the page itself, ++ * and it's the stack guard page, just skip it. ++ */ ++ if (!pages && stack_guard_page(vma, start)) ++ goto next_page; ++ + do { + struct page *page; + unsigned int foll_flags = gup_flags; +@@ -1569,6 +1578,7 @@ int __get_user_pages(struct task_struct + flush_anon_page(vma, page, start); + flush_dcache_page(page); + } ++next_page: + if (vmas) + vmas[i] = vma; + i++; +--- a/mm/mlock.c ++++ b/mm/mlock.c +@@ -135,13 +135,6 @@ void munlock_vma_page(struct page *page) + } + } + +-static inline int stack_guard_page(struct vm_area_struct *vma, unsigned long addr) +-{ +- return (vma->vm_flags & VM_GROWSDOWN) && +- (vma->vm_start == addr) && +- !vma_stack_continue(vma->vm_prev, addr); +-} +- + /** + * __mlock_vma_pages_range() - mlock a range of pages in the vma. + * @vma: target vma +@@ -188,12 +181,6 @@ static long __mlock_vma_pages_range(stru + if (vma->vm_flags & VM_LOCKED) + gup_flags |= FOLL_MLOCK; + +- /* We don't try to access the guard page of a stack vma */ +- if (stack_guard_page(vma, start)) { +- addr += PAGE_SIZE; +- nr_pages--; +- } +- + return __get_user_pages(current, mm, addr, nr_pages, gup_flags, + NULL, NULL, nonblocking); + } +From c88ac00c5af70c2a0741da14b22cdcf8507ddd92 Mon Sep 17 00:00:00 2001 +From: Artem Bityutskiy +Date: Tue, 29 Mar 2011 09:45:21 +0300 +Subject: UBIFS: fix assertion warnings + +From: Artem Bityutskiy + +commit c88ac00c5af70c2a0741da14b22cdcf8507ddd92 upstream. + +This patch fixes UBIFS assertion warnings like: + +UBIFS assert failed in ubifs_leb_unmap at 135 (pid 29365) +Pid: 29365, comm: integck Tainted: G I 2.6.37-ubi-2.6+ #34 +Call Trace: + [] ubifs_lpt_init+0x95e/0x9ee [ubifs] + [] ubifs_remount_fs+0x2c7/0x762 [ubifs] + [] do_remount_sb+0xb6/0x101 + [] ? do_mount+0x191/0x78e + [] do_mount+0x258/0x78e + [] ? alloc_pages_current+0xa2/0xc5 + [] sys_mount+0x83/0xbd + [] system_call_fastpath+0x16/0x1b + +They happen when we re-mount from R/O mode to R/W mode. While +re-mounting, we write to the media, but we still have the c->ro_mount +flag set. The fix is very simple - just clear the flag before +starting re-mounting R/W. + +These warnings are caused by the following commit: +2ef13294d29bcfb306e0d360f1b97f37b647b0c0 + +For -stable guys: this bug was introduced in 2.6.38, this is materieal +for 2.6.38-stable. + +Signed-off-by: Artem Bityutskiy +Signed-off-by: Greg Kroah-Hartman + +--- + fs/ubifs/super.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/fs/ubifs/super.c ++++ b/fs/ubifs/super.c +@@ -1543,6 +1543,7 @@ static int ubifs_remount_rw(struct ubifs + mutex_lock(&c->umount_mutex); + dbg_save_space_info(c); + c->remounting_rw = 1; ++ c->ro_mount = 0; + c->always_chk_crc = 1; + + err = check_free_space(c); +@@ -1648,7 +1649,6 @@ static int ubifs_remount_rw(struct ubifs + } + + dbg_gen("re-mounted read-write"); +- c->ro_mount = 0; + c->remounting_rw = 0; + c->always_chk_crc = 0; + err = dbg_check_space_info(c); +@@ -1656,6 +1656,7 @@ static int ubifs_remount_rw(struct ubifs + return err; + + out: ++ c->ro_mount = 1; + vfree(c->orph_buf); + c->orph_buf = NULL; + if (c->bgt) { +From ab711fe08297de1485fff0a366e6db8828cafd6a Mon Sep 17 00:00:00 2001 +From: Peter Zijlstra +Date: Thu, 31 Mar 2011 10:29:26 +0200 +Subject: perf: Fix task context scheduling + +From: Peter Zijlstra + +commit ab711fe08297de1485fff0a366e6db8828cafd6a upstream. + +Jiri reported: + + | + | - once an event is created by sys_perf_event_open, task context + | is created and it stays even if the event is closed, until the + | task is finished ... thats what I see in code and I assume it's + | correct + | + | - when the task opens event, perf_sched_events jump label is + | incremented and following callbacks are started from scheduler + | + | __perf_event_task_sched_in + | __perf_event_task_sched_out + | + | These callback *in/out set/unset cpuctx->task_ctx value to the + | task context. + | + | - close is called on event on CPU 0: + | - the task is scheduled on CPU 0 + | - __perf_event_task_sched_in is called + | - cpuctx->task_ctx is set + | - perf_sched_events jump label is decremented and == 0 + | - __perf_event_task_sched_out is not called + | - cpuctx->task_ctx on CPU 0 stays set + | + | - exit is called on CPU 1: + | - the task is scheduled on CPU 1 + | - perf_event_exit_task is called + | - task_ctx_sched_out unsets cpuctx->task_ctx on CPU 1 + | - put_ctx destroys the context + | + | - another call of perf_rotate_context on CPU 0 will use invalid + | task_ctx pointer, and eventualy panic. + | + +Cure this the simplest possibly way by partially reverting the +jump_label optimization for the sched_out case. + +Reported-and-tested-by: Jiri Olsa +Signed-off-by: Peter Zijlstra +Cc: Oleg Nesterov +LKML-Reference: <1301520405.4859.213.camel@twins> +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + include/linux/perf_event.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/include/linux/perf_event.h ++++ b/include/linux/perf_event.h +@@ -1052,7 +1052,7 @@ void perf_event_task_sched_out(struct ta + { + perf_sw_event(PERF_COUNT_SW_CONTEXT_SWITCHES, 1, 1, NULL, 0); + +- COND_STMT(&perf_task_events, __perf_event_task_sched_out(task, next)); ++ __perf_event_task_sched_out(task, next); + } + + extern void perf_event_mmap(struct vm_area_struct *vma); +From 30ae9139dc3b44d14a56fbbc2a3f8f63aa586a17 Mon Sep 17 00:00:00 2001 +From: Linus Lüssing +Date: Tue, 22 Mar 2011 11:40:32 +0000 +Subject: bridge: Fix possibly wrong MLD queries' ethernet source address + + +From: Linus Lüssing + +[ Upstream commit a7bff75b087e7a355838a32efe61707cfa73c194 ] + +The ipv6_dev_get_saddr() is currently called with an uninitialized +destination address. Although in tests it usually seemed to nevertheless +always fetch the right source address, there seems to be a possible race +condition. + +Therefore this commit changes this, first setting the destination +address and only after that fetching the source address. + +Reported-by: Jan Beulich +Signed-off-by: Linus Lüssing +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/bridge/br_multicast.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/bridge/br_multicast.c ++++ b/net/bridge/br_multicast.c +@@ -445,9 +445,9 @@ static struct sk_buff *br_ip6_multicast_ + ip6h->payload_len = htons(8 + sizeof(*mldq)); + ip6h->nexthdr = IPPROTO_HOPOPTS; + ip6h->hop_limit = 1; ++ ipv6_addr_set(&ip6h->daddr, htonl(0xff020000), 0, 0, htonl(1)); + ipv6_dev_get_saddr(dev_net(br->dev), br->dev, &ip6h->daddr, 0, + &ip6h->saddr); +- ipv6_addr_set(&ip6h->daddr, htonl(0xff020000), 0, 0, htonl(1)); + ipv6_eth_mc_map(&ip6h->daddr, eth->h_dest); + + hopopt = (u8 *)(ip6h + 1); +From 228f4d04e7d7a239b4c44e6f329aaec88f40e54a Mon Sep 17 00:00:00 2001 +From: Eric Dumazet +Date: Wed, 30 Mar 2011 16:57:46 -0700 +Subject: fib: add rtnl locking in ip_fib_net_exit + + +From: Eric Dumazet + +[ Upstream commit e2666f84958adb3a034b98e99699b55705117e01 ] + +Daniel J Blueman reported a lockdep splat in trie_firstleaf(), caused by +RTNL being not locked before a call to fib_table_flush() + +Reported-by: Daniel J Blueman +Signed-off-by: Eric Dumazet +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv4/fib_frontend.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/net/ipv4/fib_frontend.c ++++ b/net/ipv4/fib_frontend.c +@@ -1041,6 +1041,7 @@ static void ip_fib_net_exit(struct net * + fib4_rules_exit(net); + #endif + ++ rtnl_lock(); + for (i = 0; i < FIB_TABLE_HASHSZ; i++) { + struct fib_table *tb; + struct hlist_head *head; +@@ -1053,6 +1054,7 @@ static void ip_fib_net_exit(struct net * + fib_free_table(tb); + } + } ++ rtnl_unlock(); + kfree(net->ipv4.fib_table_hash); + } + +From 4dbd99fd8453ae681dad8fc1e7aa2c05e16b0cc1 Mon Sep 17 00:00:00 2001 +From: Alex Dubov +Date: Wed, 16 Mar 2011 17:57:13 +0000 +Subject: gianfar: Fall back to software tcp/udp checksum on older controllers + + +From: Alex Dubov + +[ Upstream commit 4363c2fddb1399b728ef21ee8101c148a311ea45 ] + +As specified by errata eTSEC49 of MPC8548 and errata eTSEC12 of MPC83xx, +older revisions of gianfar controllers will be unable to calculate a TCP/UDP +packet checksum for some alignments of the appropriate FCB. This patch checks +for FCB alignment on such controllers and falls back to software checksumming +if the alignment is known to be bad. + +Signed-off-by: Alex Dubov +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/gianfar.c | 16 ++++++++++++++-- + drivers/net/gianfar.h | 1 + + 2 files changed, 15 insertions(+), 2 deletions(-) + +--- a/drivers/net/gianfar.c ++++ b/drivers/net/gianfar.c +@@ -950,6 +950,11 @@ static void gfar_detect_errata(struct gf + (pvr == 0x80861010 && (mod & 0xfff9) == 0x80c0)) + priv->errata |= GFAR_ERRATA_A002; + ++ /* MPC8313 Rev < 2.0, MPC8548 rev 2.0 */ ++ if ((pvr == 0x80850010 && mod == 0x80b0 && rev < 0x0020) || ++ (pvr == 0x80210020 && mod == 0x8030 && rev == 0x0020)) ++ priv->errata |= GFAR_ERRATA_12; ++ + if (priv->errata) + dev_info(dev, "enabled errata workarounds, flags: 0x%x\n", + priv->errata); +@@ -2156,8 +2161,15 @@ static int gfar_start_xmit(struct sk_buf + /* Set up checksumming */ + if (CHECKSUM_PARTIAL == skb->ip_summed) { + fcb = gfar_add_fcb(skb); +- lstatus |= BD_LFLAG(TXBD_TOE); +- gfar_tx_checksum(skb, fcb); ++ /* as specified by errata */ ++ if (unlikely(gfar_has_errata(priv, GFAR_ERRATA_12) ++ && ((unsigned long)fcb % 0x20) > 0x18)) { ++ __skb_pull(skb, GMAC_FCB_LEN); ++ skb_checksum_help(skb); ++ } else { ++ lstatus |= BD_LFLAG(TXBD_TOE); ++ gfar_tx_checksum(skb, fcb); ++ } + } + + if (vlan_tx_tag_present(skb)) { +--- a/drivers/net/gianfar.h ++++ b/drivers/net/gianfar.h +@@ -1039,6 +1039,7 @@ enum gfar_errata { + GFAR_ERRATA_74 = 0x01, + GFAR_ERRATA_76 = 0x02, + GFAR_ERRATA_A002 = 0x04, ++ GFAR_ERRATA_12 = 0x08, /* a.k.a errata eTSEC49 */ + }; + + /* Struct stolen almost completely (and shamelessly) from the FCC enet source +From 2f288c99c4ba53a7ddbb5a7a77e42ae72d6da3b9 Mon Sep 17 00:00:00 2001 +From: James Chapman +Date: Mon, 21 Mar 2011 18:10:25 -0700 +Subject: l2tp: fix possible oops on l2tp_eth module unload + + +From: James Chapman + +[ Upstream commit 8aa525a9340da4227797a06221ca08399006635f ] + +A struct used in the l2tp_eth driver for registering network namespace +ops was incorrectly marked as __net_initdata, leading to oops when +module unloaded. + +BUG: unable to handle kernel paging request at ffffffffa00ec098 +IP: [] ops_exit_list+0x7/0x4b +PGD 142d067 PUD 1431063 PMD 195da8067 PTE 0 +Oops: 0000 [#1] SMP +last sysfs file: /sys/module/l2tp_eth/refcnt +Call Trace: + [] ? unregister_pernet_operations+0x32/0x93 + [] ? unregister_pernet_device+0x2b/0x38 + [] ? sys_delete_module+0x1b8/0x222 + [] ? do_munmap+0x254/0x318 + [] ? page_fault+0x25/0x30 + [] ? system_call_fastpath+0x16/0x1b + +Signed-off-by: James Chapman +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/l2tp/l2tp_eth.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/l2tp/l2tp_eth.c ++++ b/net/l2tp/l2tp_eth.c +@@ -283,7 +283,7 @@ static __net_init int l2tp_eth_init_net( + return 0; + } + +-static __net_initdata struct pernet_operations l2tp_eth_net_ops = { ++static struct pernet_operations l2tp_eth_net_ops = { + .init = l2tp_eth_init_net, + .id = &l2tp_eth_net_id, + .size = sizeof(struct l2tp_eth_net), +From c751cf0998164651824e1f68d124110d448d5ec3 Mon Sep 17 00:00:00 2001 +From: Eric W. Biederman +Date: Mon, 21 Mar 2011 18:23:34 -0700 +Subject: net ipv6: Fix duplicate /proc/sys/net/ipv6/neigh directory entries. + + +From: Eric W. Biederman + +[ Upstream commit 9d2a8fa96a44ba242de3a6f56acaef7a40a97b97 ] + +When I was fixing issues with unregisgtering tables under /proc/sys/net/ipv6/neigh +by adding a mount point it appears I missed a critical ordering issue, in the +ipv6 initialization. I had not realized that ipv6_sysctl_register is called +at the very end of the ipv6 initialization and in particular after we call +neigh_sysctl_register from ndisc_init. + +"neigh" needs to be initialized in ipv6_static_sysctl_register which is +the first ipv6 table to initialized, and definitely before ndisc_init. +This removes the weirdness of duplicate tables while still providing a +"neigh" mount point which prevents races in sysctl unregistering. + +This was initially reported at https://bugzilla.kernel.org/show_bug.cgi?id=31232 +Reported-by: sunkan@zappa.cx +Signed-off-by: Eric W. Biederman +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv6/sysctl_net_ipv6.c | 18 +++++++++++------- + 1 file changed, 11 insertions(+), 7 deletions(-) + +--- a/net/ipv6/sysctl_net_ipv6.c ++++ b/net/ipv6/sysctl_net_ipv6.c +@@ -17,6 +17,16 @@ + + static struct ctl_table empty[1]; + ++static ctl_table ipv6_static_skeleton[] = { ++ { ++ .procname = "neigh", ++ .maxlen = 0, ++ .mode = 0555, ++ .child = empty, ++ }, ++ { } ++}; ++ + static ctl_table ipv6_table_template[] = { + { + .procname = "route", +@@ -37,12 +47,6 @@ static ctl_table ipv6_table_template[] = + .mode = 0644, + .proc_handler = proc_dointvec + }, +- { +- .procname = "neigh", +- .maxlen = 0, +- .mode = 0555, +- .child = empty, +- }, + { } + }; + +@@ -160,7 +164,7 @@ static struct ctl_table_header *ip6_base + + int ipv6_static_sysctl_register(void) + { +- ip6_base = register_sysctl_paths(net_ipv6_ctl_path, empty); ++ ip6_base = register_sysctl_paths(net_ipv6_ctl_path, ipv6_static_skeleton); + if (ip6_base == NULL) + return -ENOMEM; + return 0; +From f041eaa28a108f73cf02e7059cf0616dfd43b232 Mon Sep 17 00:00:00 2001 +From: Dan Siemon +Date: Tue, 15 Mar 2011 13:56:07 +0000 +Subject: net_sched: fix ip_tos2prio + + +From: Dan Siemon + +[ Upstream commit 4a2b9c3756077c05dd8666e458a751d2248b61b6 ] + +ECN support incorrectly maps ECN BESTEFFORT packets to TC_PRIO_FILLER +(1) instead of TC_PRIO_BESTEFFORT (0) + +This means ECN enabled flows are placed in pfifo_fast/prio low priority +band, giving ECN enabled flows [ECT(0) and CE codepoints] higher drop +probabilities. + +This is rather unfortunate, given we would like ECN being more widely +used. + +Ref : http://www.coverfire.com/archives/2011/03/13/pfifo_fast-and-ecn/ + +Signed-off-by: Dan Siemon +Signed-off-by: Eric Dumazet +Cc: Dave Täht +Cc: Jonathan Morton +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv4/route.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/ipv4/route.c ++++ b/net/ipv4/route.c +@@ -171,7 +171,7 @@ static struct dst_ops ipv4_dst_ops = { + + const __u8 ip_tos2prio[16] = { + TC_PRIO_BESTEFFORT, +- ECN_OR_COST(FILLER), ++ ECN_OR_COST(BESTEFFORT), + TC_PRIO_BESTEFFORT, + ECN_OR_COST(BESTEFFORT), + TC_PRIO_BULK, +From 1a3ea69b2cb514439d4a5f6cabac89a845204f1b Mon Sep 17 00:00:00 2001 +From: Ulrich Weber +Date: Wed, 6 Apr 2011 14:04:49 -0700 +Subject: pppoe: drop PPPOX_ZOMBIEs in pppoe_flush_dev + + +From: Ulrich Weber + +[ Upstream commit ae07b0b221b6ab2edf9e3abd518aec6cd3f1ba66 ] + +otherwise we loop forever if a PPPoE socket was set +to PPPOX_ZOMBIE state by a PADT message when the +ethernet device is going down afterwards. + +Signed-off-by: Ulrich Weber +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/pppoe.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/pppoe.c ++++ b/drivers/net/pppoe.c +@@ -317,7 +317,7 @@ static void pppoe_flush_dev(struct net_d + lock_sock(sk); + + if (po->pppoe_dev == dev && +- sk->sk_state & (PPPOX_CONNECTED | PPPOX_BOUND)) { ++ sk->sk_state & (PPPOX_CONNECTED | PPPOX_BOUND | PPPOX_ZOMBIE)) { + pppox_unbind_sock(sk); + sk->sk_state = PPPOX_ZOMBIE; + sk->sk_state_change(sk); +From b51d6615ff5f9fc7c55727740b565b4eeafb7c4c Mon Sep 17 00:00:00 2001 +From: David S. Miller +Date: Wed, 30 Mar 2011 17:51:36 -0700 +Subject: sctp: Pass __GFP_NOWARN to hash table allocation attempts. + + +From: David S. Miller + +[ Upstream commit a84b50ceb7d640437d0dc28a2bef0d0de054de89 ] + +Like DCCP and other similar pieces of code, there are mechanisms +here to try allocating smaller hash tables if the allocation +fails. So pass in __GFP_NOWARN like the others do instead of +emitting a scary message. + +Reported-by: Dave Jones +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/sctp/protocol.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/net/sctp/protocol.c ++++ b/net/sctp/protocol.c +@@ -1204,7 +1204,7 @@ SCTP_STATIC __init int sctp_init(void) + if ((sctp_assoc_hashsize > (64 * 1024)) && order > 0) + continue; + sctp_assoc_hashtable = (struct sctp_hashbucket *) +- __get_free_pages(GFP_ATOMIC, order); ++ __get_free_pages(GFP_ATOMIC|__GFP_NOWARN, order); + } while (!sctp_assoc_hashtable && --order > 0); + if (!sctp_assoc_hashtable) { + pr_err("Failed association hash alloc\n"); +@@ -1237,7 +1237,7 @@ SCTP_STATIC __init int sctp_init(void) + if ((sctp_port_hashsize > (64 * 1024)) && order > 0) + continue; + sctp_port_hashtable = (struct sctp_bind_hashbucket *) +- __get_free_pages(GFP_ATOMIC, order); ++ __get_free_pages(GFP_ATOMIC|__GFP_NOWARN, order); + } while (!sctp_port_hashtable && --order > 0); + if (!sctp_port_hashtable) { + pr_err("Failed bind hash alloc\n"); +From bd59e4b2b325a4f0fcd491a8ec55a619fef91ded Mon Sep 17 00:00:00 2001 +From: Yuchung Cheng +Date: Mon, 14 Mar 2011 10:57:03 +0000 +Subject: tcp: avoid cwnd moderation in undo + + +From: Yuchung Cheng + +[ Upstream commit 67d4120a1793138bc9f4a6eb61d0fc5298ed97e0 ] + +In the current undo logic, cwnd is moderated after it was restored +to the value prior entering fast-recovery. It was moderated first +in tcp_try_undo_recovery then again in tcp_complete_cwr. + +Since the undo indicates recovery was false, these moderations +are not necessary. If the undo is triggered when most of the +outstanding data have been acknowledged, the (restored) cwnd is +falsely pulled down to a small value. + +This patch removes these cwnd moderations if cwnd is undone + a) during fast-recovery + b) by receiving DSACKs past fast-recovery + +Signed-off-by: Yuchung Cheng +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv4/tcp_input.c | 12 +++++++----- + 1 file changed, 7 insertions(+), 5 deletions(-) + +--- a/net/ipv4/tcp_input.c ++++ b/net/ipv4/tcp_input.c +@@ -2659,7 +2659,7 @@ static void DBGUNDO(struct sock *sk, con + #define DBGUNDO(x...) do { } while (0) + #endif + +-static void tcp_undo_cwr(struct sock *sk, const int undo) ++static void tcp_undo_cwr(struct sock *sk, const int undo_ssthresh) + { + struct tcp_sock *tp = tcp_sk(sk); + +@@ -2671,14 +2671,13 @@ static void tcp_undo_cwr(struct sock *sk + else + tp->snd_cwnd = max(tp->snd_cwnd, tp->snd_ssthresh << 1); + +- if (undo && tp->prior_ssthresh > tp->snd_ssthresh) { ++ if (undo_ssthresh && tp->prior_ssthresh > tp->snd_ssthresh) { + tp->snd_ssthresh = tp->prior_ssthresh; + TCP_ECN_withdraw_cwr(tp); + } + } else { + tp->snd_cwnd = max(tp->snd_cwnd, tp->snd_ssthresh); + } +- tcp_moderate_cwnd(tp); + tp->snd_cwnd_stamp = tcp_time_stamp; + } + +@@ -2822,8 +2821,11 @@ static int tcp_try_undo_loss(struct sock + static inline void tcp_complete_cwr(struct sock *sk) + { + struct tcp_sock *tp = tcp_sk(sk); +- tp->snd_cwnd = min(tp->snd_cwnd, tp->snd_ssthresh); +- tp->snd_cwnd_stamp = tcp_time_stamp; ++ /* Do not moderate cwnd if it's already undone in cwr or recovery */ ++ if (tp->undo_marker && tp->snd_cwnd > tp->snd_ssthresh) { ++ tp->snd_cwnd = tp->snd_ssthresh; ++ tp->snd_cwnd_stamp = tcp_time_stamp; ++ } + tcp_ca_event(sk, CA_EVENT_COMPLETE_CWR); + } + +From 6677647340a5d58b48b792af078701f4068be4b4 Mon Sep 17 00:00:00 2001 +From: Steffen Klassert +Date: Tue, 15 Mar 2011 21:12:49 +0000 +Subject: xfrm: Refcount destination entry on xfrm_lookup + + +From: Steffen Klassert + +[ Upstream commit fbd5060875d25f7764fd1c3d35b83a8ed1d88d7b ] + +We return a destination entry without refcount if a socket +policy is found in xfrm_lookup. This triggers a warning on +a negative refcount when freeeing this dst entry. So take +a refcount in this case to fix it. + +This refcount was forgotten when xfrm changed to cache bundles +instead of policies for outgoing flows. + +Signed-off-by: Steffen Klassert +Acked-by: Timo Teräs +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/xfrm/xfrm_policy.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/net/xfrm/xfrm_policy.c ++++ b/net/xfrm/xfrm_policy.c +@@ -1778,6 +1778,8 @@ restart: + goto no_transform; + } + ++ dst_hold(&xdst->u.dst); ++ + spin_lock_bh(&xfrm_policy_sk_bundle_lock); + xdst->u.dst.next = xfrm_policy_sk_bundles; + xfrm_policy_sk_bundles = &xdst->u.dst; +From c0fd11cf45228241f8b3fb42020b1c9493dcdac7 Mon Sep 17 00:00:00 2001 +From: Eric Dumazet +Date: Fri, 18 Mar 2011 00:27:27 +0000 +Subject: vlan: should take into account needed_headroom + + +From: Eric Dumazet + +[ Upstream commit d870bfb9d366c5d466c0f5419a4ec95a3f71ea8a ] + +Commit c95b819ad7 (gre: Use needed_headroom) +made gre use needed_headroom instead of hard_header_len + +This uncover a bug in vlan code. + +We should make sure vlan devices take into account their +real_dev->needed_headroom or we risk a crash in ipgre_header(), because +we dont have enough room to push IP header in skb. + +Reported-by: Diddi Oscarsson +Signed-off-by: Eric Dumazet +Cc: Patrick McHardy +Cc: Herbert Xu +Acked-by: Herbert Xu +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/8021q/vlan_dev.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/net/8021q/vlan_dev.c ++++ b/net/8021q/vlan_dev.c +@@ -707,6 +707,7 @@ static int vlan_dev_init(struct net_devi + dev->fcoe_ddp_xid = real_dev->fcoe_ddp_xid; + #endif + ++ dev->needed_headroom = real_dev->needed_headroom; + if (real_dev->features & NETIF_F_HW_VLAN_TX) { + dev->header_ops = real_dev->header_ops; + dev->hard_header_len = real_dev->hard_header_len; +From 0589d1f7a527e5f4c4c6d16b734cfed4e3608f1c Mon Sep 17 00:00:00 2001 +From: Herbert Xu +Date: Fri, 18 Mar 2011 05:27:28 +0000 +Subject: bridge: Reset IPCB when entering IP stack on NF_FORWARD + + +From: Herbert Xu + +[ Upstream commit 6b1e960fdbd75dcd9bcc3ba5ff8898ff1ad30b6e ] + +Whenever we enter the IP stack proper from bridge netfilter we +need to ensure that the skb is in a form the IP stack expects +it to be in. + +The entry point on NF_FORWARD did not meet the requirements of +the IP stack, therefore leading to potential crashes/panics. + +This patch fixes the problem. + +Signed-off-by: Herbert Xu +Acked-by: Stephen Hemminger +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/bridge/br_netfilter.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/net/bridge/br_netfilter.c ++++ b/net/bridge/br_netfilter.c +@@ -741,6 +741,9 @@ static unsigned int br_nf_forward_ip(uns + nf_bridge->mask |= BRNF_PKT_TYPE; + } + ++ if (br_parse_ip_options(skb)) ++ return NF_DROP; ++ + /* The physdev module checks on this */ + nf_bridge->mask |= BRNF_BRIDGED; + nf_bridge->physoutdev = skb->dev; +From 919a6006d36ab51a70ca5d80e192cba953c874cb Mon Sep 17 00:00:00 2001 +From: Ben Hutchings +Date: Wed, 9 Mar 2011 12:54:27 -0800 +Subject: sparc: Fix .size directive for do_int_load + + +From: Ben Hutchings + +[ Upstream commit 35043c428f1fcb92feb5792f5878a8852ee00771 ] + +gas used to accept (and ignore?) .size directives which referred to +undefined symbols, as this does. In binutils 2.21 these are treated +as errors. + +Signed-off-by: Ben Hutchings +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + arch/sparc/kernel/una_asm_64.S | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/sparc/kernel/una_asm_64.S ++++ b/arch/sparc/kernel/una_asm_64.S +@@ -127,7 +127,7 @@ do_int_load: + wr %o5, 0x0, %asi + retl + mov 0, %o0 +- .size __do_int_load, .-__do_int_load ++ .size do_int_load, .-do_int_load + + .section __ex_table,"a" + .word 4b, __retl_efault +From c90b2d78650ae1ec6db90f07533e0382fa63acad Mon Sep 17 00:00:00 2001 +From: David S. Miller +Date: Wed, 9 Mar 2011 13:00:47 -0800 +Subject: sparc32: Fix might-be-used-uninitialized warning in do_sparc_fault(). + + +From: David S. Miller + +[ Upstream commit c816be7b5f24585baa9eba1f2413935f771d6ad6 ] + +When we try to handle vmalloc faults, we can take a code +path which uses "code" before we actually set it. + +Amusingly gcc-3.3 notices this yet gcc-4.x does not. + +Reported-by: Bob Breuer +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + arch/sparc/mm/fault_32.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/arch/sparc/mm/fault_32.c ++++ b/arch/sparc/mm/fault_32.c +@@ -240,11 +240,10 @@ asmlinkage void do_sparc_fault(struct pt + * only copy the information from the master page table, + * nothing more. + */ ++ code = SEGV_MAPERR; + if (!ARCH_SUN4C && address >= TASK_SIZE) + goto vmalloc_fault; + +- code = SEGV_MAPERR; +- + /* + * If we're in an interrupt or have no user + * context, we must not take the fault.. +From d4f295b7863f094b4d76ce10cb99f4617b5d00ad Mon Sep 17 00:00:00 2001 +From: Tkhai Kirill +Date: Thu, 31 Mar 2011 00:52:38 -0700 +Subject: sparc32: Pass task_struct to schedule_tail() in ret_from_fork + + +From: Tkhai Kirill + +[ Upstream commit 47c7c97a93a5b8f719093dbf83555090b3b8228b ] + +We have to pass task_struct of previous process to function +schedule_tail(). Currently in ret_from_fork previous thread_info +is passed: + +switch_to: mov %g6, %g3 /* previous thread_info in g6 */ + +ret_from_fork: call schedule_tail + mov %g3, %o0 /* previous thread_info is passed */ + +void schedule_tail(struct task_struct *prev); + +Signed-off-by: Tkhai Kirill +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + arch/sparc/kernel/entry.S | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/sparc/kernel/entry.S ++++ b/arch/sparc/kernel/entry.S +@@ -1283,7 +1283,7 @@ linux_syscall_trace: + .globl ret_from_fork + ret_from_fork: + call schedule_tail +- mov %g3, %o0 ++ ld [%g3 + TI_TASK], %o0 + b ret_sys_call + ld [%sp + STACKFRAME_SZ + PT_I0], %o0 + +From 9567fc1bffdb332f7254c9bd2a913c80a6e18e16 Mon Sep 17 00:00:00 2001 +From: David S. Miller +Date: Sat, 26 Feb 2011 23:40:02 -0800 +Subject: sparc64: Fix build errors with gcc-4.6.0 + + +From: David S. Miller + +[ Upstream commit c6fee0810df4e0f4cf9c4834d2569ca01c02cffc ] + +Most of the warnings emitted (we fail arch/sparc file +builds with -Werror) were legitimate but harmless, however +one case (n2_pcr_write) was a genuine bug. + +Based almost entirely upon a patch by Sam Ravnborg. + +Reported-by: Dennis Gilmore +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + arch/sparc/kernel/iommu.c | 3 --- + arch/sparc/kernel/ldc.c | 28 ++++++++++++++++++---------- + arch/sparc/kernel/pci.c | 1 + + arch/sparc/kernel/pci_common.c | 11 +++++++---- + arch/sparc/kernel/pci_fire.c | 2 -- + arch/sparc/kernel/pci_schizo.c | 4 +--- + arch/sparc/kernel/pci_sun4v.c | 3 +-- + arch/sparc/kernel/pcr.c | 2 +- + arch/sparc/kernel/ptrace_64.c | 3 ++- + arch/sparc/kernel/smp_64.c | 11 ++++------- + arch/sparc/kernel/traps_64.c | 3 +-- + 11 files changed, 36 insertions(+), 35 deletions(-) + +--- a/arch/sparc/kernel/iommu.c ++++ b/arch/sparc/kernel/iommu.c +@@ -333,13 +333,10 @@ static void dma_4u_free_coherent(struct + void *cpu, dma_addr_t dvma) + { + struct iommu *iommu; +- iopte_t *iopte; + unsigned long flags, order, npages; + + npages = IO_PAGE_ALIGN(size) >> IO_PAGE_SHIFT; + iommu = dev->archdata.iommu; +- iopte = iommu->page_table + +- ((dvma - iommu->page_table_map_base) >> IO_PAGE_SHIFT); + + spin_lock_irqsave(&iommu->lock, flags); + +--- a/arch/sparc/kernel/ldc.c ++++ b/arch/sparc/kernel/ldc.c +@@ -790,16 +790,20 @@ static void send_events(struct ldc_chann + static irqreturn_t ldc_rx(int irq, void *dev_id) + { + struct ldc_channel *lp = dev_id; +- unsigned long orig_state, hv_err, flags; ++ unsigned long orig_state, flags; + unsigned int event_mask; + + spin_lock_irqsave(&lp->lock, flags); + + orig_state = lp->chan_state; +- hv_err = sun4v_ldc_rx_get_state(lp->id, +- &lp->rx_head, +- &lp->rx_tail, +- &lp->chan_state); ++ ++ /* We should probably check for hypervisor errors here and ++ * reset the LDC channel if we get one. ++ */ ++ sun4v_ldc_rx_get_state(lp->id, ++ &lp->rx_head, ++ &lp->rx_tail, ++ &lp->chan_state); + + ldcdbg(RX, "RX state[0x%02lx:0x%02lx] head[0x%04lx] tail[0x%04lx]\n", + orig_state, lp->chan_state, lp->rx_head, lp->rx_tail); +@@ -904,16 +908,20 @@ out: + static irqreturn_t ldc_tx(int irq, void *dev_id) + { + struct ldc_channel *lp = dev_id; +- unsigned long flags, hv_err, orig_state; ++ unsigned long flags, orig_state; + unsigned int event_mask = 0; + + spin_lock_irqsave(&lp->lock, flags); + + orig_state = lp->chan_state; +- hv_err = sun4v_ldc_tx_get_state(lp->id, +- &lp->tx_head, +- &lp->tx_tail, +- &lp->chan_state); ++ ++ /* We should probably check for hypervisor errors here and ++ * reset the LDC channel if we get one. ++ */ ++ sun4v_ldc_tx_get_state(lp->id, ++ &lp->tx_head, ++ &lp->tx_tail, ++ &lp->chan_state); + + ldcdbg(TX, " TX state[0x%02lx:0x%02lx] head[0x%04lx] tail[0x%04lx]\n", + orig_state, lp->chan_state, lp->tx_head, lp->tx_tail); +--- a/arch/sparc/kernel/pci.c ++++ b/arch/sparc/kernel/pci.c +@@ -675,6 +675,7 @@ static void __devinit pci_bus_register_o + * humanoid. + */ + err = sysfs_create_file(&dev->dev.kobj, &dev_attr_obppath.attr); ++ (void) err; + } + list_for_each_entry(child_bus, &bus->children, node) + pci_bus_register_of_sysfs(child_bus); +--- a/arch/sparc/kernel/pci_common.c ++++ b/arch/sparc/kernel/pci_common.c +@@ -295,14 +295,17 @@ static int sun4v_write_pci_cfg(struct pc + unsigned int bus = bus_dev->number; + unsigned int device = PCI_SLOT(devfn); + unsigned int func = PCI_FUNC(devfn); +- unsigned long ret; + + if (config_out_of_range(pbm, bus, devfn, where)) { + /* Do nothing. */ + } else { +- ret = pci_sun4v_config_put(devhandle, +- HV_PCI_DEVICE_BUILD(bus, device, func), +- where, size, value); ++ /* We don't check for hypervisor errors here, but perhaps ++ * we should and influence our return value depending upon ++ * what kind of error is thrown. ++ */ ++ pci_sun4v_config_put(devhandle, ++ HV_PCI_DEVICE_BUILD(bus, device, func), ++ where, size, value); + } + return PCIBIOS_SUCCESSFUL; + } +--- a/arch/sparc/kernel/pci_fire.c ++++ b/arch/sparc/kernel/pci_fire.c +@@ -214,11 +214,9 @@ static int pci_fire_msi_setup(struct pci + + static int pci_fire_msi_teardown(struct pci_pbm_info *pbm, unsigned long msi) + { +- unsigned long msiqid; + u64 val; + + val = upa_readq(pbm->pbm_regs + MSI_MAP(msi)); +- msiqid = (val & MSI_MAP_EQNUM); + + val &= ~MSI_MAP_VALID; + +--- a/arch/sparc/kernel/pci_schizo.c ++++ b/arch/sparc/kernel/pci_schizo.c +@@ -1313,7 +1313,7 @@ static int __devinit schizo_pbm_init(str + const struct linux_prom64_registers *regs; + struct device_node *dp = op->dev.of_node; + const char *chipset_name; +- int is_pbm_a, err; ++ int err; + + switch (chip_type) { + case PBM_CHIP_TYPE_TOMATILLO: +@@ -1343,8 +1343,6 @@ static int __devinit schizo_pbm_init(str + */ + regs = of_get_property(dp, "reg", NULL); + +- is_pbm_a = ((regs[0].phys_addr & 0x00700000) == 0x00600000); +- + pbm->next = pci_pbm_root; + pci_pbm_root = pbm; + +--- a/arch/sparc/kernel/pci_sun4v.c ++++ b/arch/sparc/kernel/pci_sun4v.c +@@ -580,7 +580,7 @@ static int __devinit pci_sun4v_iommu_ini + { + static const u32 vdma_default[] = { 0x80000000, 0x80000000 }; + struct iommu *iommu = pbm->iommu; +- unsigned long num_tsb_entries, sz, tsbsize; ++ unsigned long num_tsb_entries, sz; + u32 dma_mask, dma_offset; + const u32 *vdma; + +@@ -596,7 +596,6 @@ static int __devinit pci_sun4v_iommu_ini + + dma_mask = (roundup_pow_of_two(vdma[1]) - 1UL); + num_tsb_entries = vdma[1] / IO_PAGE_SIZE; +- tsbsize = num_tsb_entries * sizeof(iopte_t); + + dma_offset = vdma[0]; + +--- a/arch/sparc/kernel/pcr.c ++++ b/arch/sparc/kernel/pcr.c +@@ -81,7 +81,7 @@ static void n2_pcr_write(u64 val) + unsigned long ret; + + ret = sun4v_niagara2_setperf(HV_N2_PERF_SPARC_CTL, val); +- if (val != HV_EOK) ++ if (ret != HV_EOK) + write_pcr(val); + } + +--- a/arch/sparc/kernel/ptrace_64.c ++++ b/arch/sparc/kernel/ptrace_64.c +@@ -1086,6 +1086,7 @@ asmlinkage int syscall_trace_enter(struc + + asmlinkage void syscall_trace_leave(struct pt_regs *regs) + { ++#ifdef CONFIG_AUDITSYSCALL + if (unlikely(current->audit_context)) { + unsigned long tstate = regs->tstate; + int result = AUDITSC_SUCCESS; +@@ -1095,7 +1096,7 @@ asmlinkage void syscall_trace_leave(stru + + audit_syscall_exit(result, regs->u_regs[UREG_I0]); + } +- ++#endif + if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT))) + trace_sys_exit(regs, regs->u_regs[UREG_G1]); + +--- a/arch/sparc/kernel/smp_64.c ++++ b/arch/sparc/kernel/smp_64.c +@@ -189,7 +189,7 @@ static inline long get_delta (long *rt, + void smp_synchronize_tick_client(void) + { + long i, delta, adj, adjust_latency = 0, done = 0; +- unsigned long flags, rt, master_time_stamp, bound; ++ unsigned long flags, rt, master_time_stamp; + #if DEBUG_TICK_SYNC + struct { + long rt; /* roundtrip time */ +@@ -208,10 +208,8 @@ void smp_synchronize_tick_client(void) + { + for (i = 0; i < NUM_ROUNDS; i++) { + delta = get_delta(&rt, &master_time_stamp); +- if (delta == 0) { ++ if (delta == 0) + done = 1; /* let's lock on to this... */ +- bound = rt; +- } + + if (!done) { + if (i > 0) { +@@ -933,13 +931,12 @@ void smp_flush_dcache_page_impl(struct p + void flush_dcache_page_all(struct mm_struct *mm, struct page *page) + { + void *pg_addr; +- int this_cpu; + u64 data0; + + if (tlb_type == hypervisor) + return; + +- this_cpu = get_cpu(); ++ preempt_disable(); + + #ifdef CONFIG_DEBUG_DCFLUSH + atomic_inc(&dcpage_flushes); +@@ -964,7 +961,7 @@ void flush_dcache_page_all(struct mm_str + } + __local_flush_dcache_page(page); + +- put_cpu(); ++ preempt_enable(); + } + + void __irq_entry smp_new_mmu_context_version_client(int irq, struct pt_regs *regs) +--- a/arch/sparc/kernel/traps_64.c ++++ b/arch/sparc/kernel/traps_64.c +@@ -2152,7 +2152,7 @@ static void user_instruction_dump(unsign + + void show_stack(struct task_struct *tsk, unsigned long *_ksp) + { +- unsigned long fp, thread_base, ksp; ++ unsigned long fp, ksp; + struct thread_info *tp; + int count = 0; + #ifdef CONFIG_FUNCTION_GRAPH_TRACER +@@ -2173,7 +2173,6 @@ void show_stack(struct task_struct *tsk, + flushw_all(); + + fp = ksp + STACK_BIAS; +- thread_base = (unsigned long) tp; + + printk("Call Trace:\n"); + do { -- cgit v1.2.2