diff --git a/cifs-fix-malicious-redirect-problem-in-the-dns-lookup-code.patch b/cifs-fix-malicious-redirect-problem-in-the-dns-lookup-code.patch deleted file mode 100644 index 5b2cd7d21..000000000 --- a/cifs-fix-malicious-redirect-problem-in-the-dns-lookup-code.patch +++ /dev/null @@ -1,202 +0,0 @@ -From: David Howells -Date: Thu, 22 Jul 2010 11:53:18 +0000 (+0100) -Subject: CIFS: Fix a malicious redirect problem in the DNS lookup code -X-Git-Tag: v2.6.35-rc6~6 -X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Ftorvalds%2Flinux-2.6.git;a=commitdiff_plain;h=4c0c03ca54f72fdd5912516ad0a23ec5cf01bda7 - -CIFS: Fix a malicious redirect problem in the DNS lookup code - -[ trivial backport to 2.6.3[23] : cebbert@redhat.com ] - -Fix the security problem in the CIFS filesystem DNS lookup code in which a -malicious redirect could be installed by a random user by simply adding a -result record into one of their keyrings with add_key() and then invoking a -CIFS CFS lookup [CVE-2010-2524]. - -This is done by creating an internal keyring specifically for the caching of -DNS lookups. To enforce the use of this keyring, the module init routine -creates a set of override credentials with the keyring installed as the thread -keyring and instructs request_key() to only install lookup result keys in that -keyring. - -The override is then applied around the call to request_key(). - -This has some additional benefits when a kernel service uses this module to -request a key: - - (1) The result keys are owned by root, not the user that caused the lookup. - - (2) The result keys don't pop up in the user's keyrings. - - (3) The result keys don't come out of the quota of the user that caused the - lookup. - -The keyring can be viewed as root by doing cat /proc/keys: - -2a0ca6c3 I----- 1 perm 1f030000 0 0 keyring .dns_resolver: 1/4 - -It can then be listed with 'keyctl list' by root. - - # keyctl list 0x2a0ca6c3 - 1 key in keyring: - 726766307: --alswrv 0 0 dns_resolver: foo.bar.com - -Signed-off-by: David Howells -Reviewed-and-Tested-by: Jeff Layton -Acked-by: Steve French -Signed-off-by: Linus Torvalds ---- - -diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c -index 484e52b..2cb1a70 100644 ---- a/fs/cifs/cifsfs.c -+++ b/fs/cifs/cifsfs.c -@@ -923,7 +923,7 @@ init_cifs(void) - goto out_unregister_filesystem; - #endif - #ifdef CONFIG_CIFS_DFS_UPCALL -- rc = register_key_type(&key_type_dns_resolver); -+ rc = cifs_init_dns_resolver(); - if (rc) - goto out_unregister_key_type; - #endif -@@ -935,7 +935,7 @@ init_cifs(void) - - out_unregister_resolver_key: - #ifdef CONFIG_CIFS_DFS_UPCALL -- unregister_key_type(&key_type_dns_resolver); -+ cifs_exit_dns_resolver(); - out_unregister_key_type: - #endif - #ifdef CONFIG_CIFS_UPCALL -@@ -961,7 +961,7 @@ exit_cifs(void) - cifs_proc_clean(); - #ifdef CONFIG_CIFS_DFS_UPCALL - cifs_dfs_release_automount_timer(); -- unregister_key_type(&key_type_dns_resolver); -+ cifs_exit_dns_resolver(); - #endif - #ifdef CONFIG_CIFS_UPCALL - unregister_key_type(&cifs_spnego_key_type); -diff --git a/fs/cifs/dns_resolve.c b/fs/cifs/dns_resolve.c -index 4db2c5e..49315cb 100644 ---- a/fs/cifs/dns_resolve.c -+++ b/fs/cifs/dns_resolve.c -@@ -24,12 +24,16 @@ - * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA - */ - -+#include -+#include - #include - #include "dns_resolve.h" - #include "cifsglob.h" - #include "cifsproto.h" - #include "cifs_debug.h" - -+static const struct cred *dns_resolver_cache; -+ - /* Checks if supplied name is IP address - * returns: - * 1 - name is IP -@@ -94,6 +98,7 @@ struct key_type key_type_dns_resolver = { - int - dns_resolve_server_name_to_ip(const char *unc, char **ip_addr) - { -+ const struct cred *saved_cred; - int rc = -EAGAIN; - struct key *rkey = ERR_PTR(-EAGAIN); - char *name; -@@ -133,8 +138,15 @@ dns_resolve_server_name_to_ip(const char *unc, char **ip_addr) - goto skip_upcall; - } - -+ saved_cred = override_creds(dns_resolver_cache); - rkey = request_key(&key_type_dns_resolver, name, ""); -+ revert_creds(saved_cred); - if (!IS_ERR(rkey)) { -+ if (!(rkey->perm & KEY_USR_VIEW)) { -+ down_read(&rkey->sem); -+ rkey->perm |= KEY_USR_VIEW; -+ up_read(&rkey->sem); -+ } - len = rkey->type_data.x[0]; - data = rkey->payload.data; - } else { -@@ -165,4 +177,61 @@ out: - return rc; - } - -+int __init cifs_init_dns_resolver(void) -+{ -+ struct cred *cred; -+ struct key *keyring; -+ int ret; -+ -+ printk(KERN_NOTICE "Registering the %s key type\n", -+ key_type_dns_resolver.name); -+ -+ /* create an override credential set with a special thread keyring in -+ * which DNS requests are cached -+ * -+ * this is used to prevent malicious redirections from being installed -+ * with add_key(). -+ */ -+ cred = prepare_kernel_cred(NULL); -+ if (!cred) -+ return -ENOMEM; -+ -+ keyring = key_alloc(&key_type_keyring, ".dns_resolver", 0, 0, cred, -+ (KEY_POS_ALL & ~KEY_POS_SETATTR) | -+ KEY_USR_VIEW | KEY_USR_READ, -+ KEY_ALLOC_NOT_IN_QUOTA); -+ if (IS_ERR(keyring)) { -+ ret = PTR_ERR(keyring); -+ goto failed_put_cred; -+ } -+ -+ ret = key_instantiate_and_link(keyring, NULL, 0, NULL, NULL); -+ if (ret < 0) -+ goto failed_put_key; -+ -+ ret = register_key_type(&key_type_dns_resolver); -+ if (ret < 0) -+ goto failed_put_key; -+ -+ /* instruct request_key() to use this special keyring as a cache for -+ * the results it looks up */ -+ cred->thread_keyring = keyring; -+ cred->jit_keyring = KEY_REQKEY_DEFL_THREAD_KEYRING; -+ dns_resolver_cache = cred; -+ return 0; -+ -+failed_put_key: -+ key_put(keyring); -+failed_put_cred: -+ put_cred(cred); -+ return ret; -+} - -+void __exit cifs_exit_dns_resolver(void) -+{ -+ key_revoke(dns_resolver_cache->thread_keyring); -+ unregister_key_type(&key_type_dns_resolver); -+ put_cred(dns_resolver_cache); -+ printk(KERN_NOTICE "Unregistered %s key type\n", -+ key_type_dns_resolver.name); -+} -diff --git a/fs/cifs/dns_resolve.h b/fs/cifs/dns_resolve.h -index 966e928..26b9eaa 100644 ---- a/fs/cifs/dns_resolve.h -+++ b/fs/cifs/dns_resolve.h -@@ -24,8 +24,8 @@ - #define _DNS_RESOLVE_H - - #ifdef __KERNEL__ --#include --extern struct key_type key_type_dns_resolver; -+extern int __init cifs_init_dns_resolver(void); -+extern void __exit cifs_exit_dns_resolver(void); - extern int dns_resolve_server_name_to_ip(const char *unc, char **ip_addr); - #endif /* KERNEL */ - diff --git a/drm-i915-add-reclaimable-to-page-allocations.patch b/drm-i915-add-reclaimable-to-page-allocations.patch deleted file mode 100644 index 6014f2c15..000000000 --- a/drm-i915-add-reclaimable-to-page-allocations.patch +++ /dev/null @@ -1,48 +0,0 @@ -From: Linus Torvalds -Date: Sun, 18 Jul 2010 16:44:37 +0000 (-0700) -Subject: drm/i915: add 'reclaimable' to i915 self-reclaimable page allocations -X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Ftorvalds%2Flinux-2.6.git;a=commitdiff_plain;h=cd9f040df6ce46573760a507cb88192d05d27d86 - -drm/i915: add 'reclaimable' to i915 self-reclaimable page allocations - -The hibernate issues that got fixed in commit 985b823b9192 ("drm/i915: -fix hibernation since i915 self-reclaim fixes") turn out to have been -incomplete. Vefa Bicakci tested lots of hibernate cycles, and without -the __GFP_RECLAIMABLE flag the system eventually fails to resume. - -With the flag added, Vefa can apparently hibernate forever (or until he -gets bored running his automated scripts, whichever comes first). - -The reclaimable flag was there originally, and was one of the flags that -were dropped (unintentionally) by commit 4bdadb978569 ("drm/i915: -Selectively enable self-reclaim") that introduced all these problems, -but I didn't want to just blindly add back all the flags in commit -985b823b9192, and it looked like __GFP_RECLAIM wasn't necessary. It -clearly was. - -I still suspect that there is some subtle reason we're missing that -causes the problems, but __GFP_RECLAIMABLE is certainly not wrong to use -in this context, and is what the code historically used. And we have no -idea what the causes the corruption without it. - -Reported-and-tested-by: M. Vefa Bicakci -Cc: Dave Airlie -Cc: Chris Wilson -Cc: KOSAKI Motohiro -Cc: Hugh Dickins -Cc: stable@kernel.org -Signed-off-by: Linus Torvalds ---- - -diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c -index 0743858..8757ecf 100644 ---- a/drivers/gpu/drm/i915/i915_gem.c -+++ b/drivers/gpu/drm/i915/i915_gem.c -@@ -2241,6 +2241,7 @@ i915_gem_object_get_pages(struct drm_gem_object *obj, - page = read_cache_page_gfp(mapping, i, - GFP_HIGHUSER | - __GFP_COLD | -+ __GFP_RECLAIMABLE | - gfpmask); - if (IS_ERR(page)) - goto err_pages; diff --git a/drm-i915-fix-hibernate-memory-corruption.patch b/drm-i915-fix-hibernate-memory-corruption.patch deleted file mode 100644 index 3e7e860a2..000000000 --- a/drm-i915-fix-hibernate-memory-corruption.patch +++ /dev/null @@ -1,36 +0,0 @@ -From 0121d50088a9e04f3bbbee14043cd89164bdf4e6 Mon Sep 17 00:00:00 2001 -From: Linus Torvalds -Date: Fri, 2 Jul 2010 09:56:19 +1000 -Subject: [PATCH] drm/i915: fix hibernation since 4bdadb9785696439c6e2b3efe34aa76df1149c83 - -Since 4bdadb9785696439c6e2b3efe34aa76df1149c83, we've been passing -GFP_MOVABLE where we weren't before caused hibernate on Intel hardware -to results in a lot of memory corruptions on resume. - -[airlied: linus please enhance commit msg if you commit this] - -http://bugzilla.kernel.org/show_bug.cgi?id=13811 - -Reported-by: Evengi Golov (in bugzilla) -Signed-off-by: Dave Airlie -Tested-by: M. Vefa Bicakci ---- - drivers/gpu/drm/i915/i915_gem.c | 2 +- - 1 files changed, 1 insertions(+), 1 deletions(-) - -diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c -index 9ded3da..0743858 100644 ---- a/drivers/gpu/drm/i915/i915_gem.c -+++ b/drivers/gpu/drm/i915/i915_gem.c -@@ -2239,7 +2239,7 @@ i915_gem_object_get_pages(struct drm_gem_object *obj, - mapping = inode->i_mapping; - for (i = 0; i < page_count; i++) { - page = read_cache_page_gfp(mapping, i, -- mapping_gfp_mask (mapping) | -+ GFP_HIGHUSER | - __GFP_COLD | - gfpmask); - if (IS_ERR(page)) --- -1.7.0.1 - diff --git a/drm-i915-make-G4X-style-PLL-search-more-permissive.patch b/drm-i915-make-G4X-style-PLL-search-more-permissive.patch deleted file mode 100644 index b7d863076..000000000 --- a/drm-i915-make-G4X-style-PLL-search-more-permissive.patch +++ /dev/null @@ -1,51 +0,0 @@ -drm/i915: Make G4X-style PLL search more permissive - -Fixes an Ironlake laptop with a 68.940MHz 1280x800 panel and 120MHz SSC -reference clock. - -More generally, the 0.488% tolerance used before is just too tight to -reliably find a PLL setting. I extracted the search algorithm and -modified it to find the dot clocks with maximum error over the valid -range for the given output type: - -http://people.freedesktop.org/~ajax/intel_g4x_find_best_pll.c - -This gave: - -Worst dotclock for Ironlake DAC refclk is 350000kHz (error 0.00571) -Worst dotclock for Ironlake SL-LVDS refclk is 102321kHz (error 0.00524) -Worst dotclock for Ironlake DL-LVDS refclk is 219642kHz (error 0.00488) -Worst dotclock for Ironlake SL-LVDS SSC refclk is 84374kHz (error 0.00529) -Worst dotclock for Ironlake DL-LVDS SSC refclk is 183035kHz (error 0.00488) -Worst dotclock for G4X SDVO refclk is 50000kHz (error 0.17332) -Worst dotclock for G4X HDMI refclk is 334400kHz (error 0.00478) -Worst dotclock for G4X SL-LVDS refclk is 95571kHz (error 0.00449) -Worst dotclock for G4X DL-LVDS refclk is 224000kHz (error 0.00510) - -The SDVO number looks a bit suspicious, which I haven't tracked down -yet. But it's clear that the old threshold is too tight. - -Signed-off-by: Adam Jackson -[ RHBZ #572799 ] ---- - drivers/gpu/drm/i915/intel_display.c | 4 ++-- - 1 files changed, 2 insertions(+), 2 deletions(-) - -diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c -index a8d65b7..4b17722 100644 ---- a/drivers/gpu/drm/i915/intel_display.c -+++ b/drivers/gpu/drm/i915/intel_display.c -@@ -862,8 +862,8 @@ intel_g4x_find_best_PLL(const intel_limit_t *limit, struct drm_crtc *crtc, - intel_clock_t clock; - int max_n; - bool found; -- /* approximately equals target * 0.00488 */ -- int err_most = (target >> 8) + (target >> 10); -+ /* approximately equals target * 0.00585 */ -+ int err_most = (target >> 8) + (target >> 9); - found = false; - - if (intel_pipe_has_type(crtc, INTEL_OUTPUT_LVDS)) { --- -1.7.1 - diff --git a/drm-intel-945gm-stability-fixes.patch b/drm-intel-945gm-stability-fixes.patch deleted file mode 100644 index 4dbc4469b..000000000 --- a/drm-intel-945gm-stability-fixes.patch +++ /dev/null @@ -1,99 +0,0 @@ -diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c -index 0d05c6f..b87f65d 100644 ---- a/drivers/gpu/drm/i915/i915_gem.c -+++ b/drivers/gpu/drm/i915/i915_gem.c -@@ -4967,6 +4967,16 @@ i915_gem_load(struct drm_device *dev) - list_add(&dev_priv->mm.shrink_list, &shrink_list); - spin_unlock(&shrink_list_lock); - -+ /* On GEN3 we really need to make sure the ARB C3 LP bit is set */ -+ if (IS_GEN3(dev)) { -+ u32 tmp = I915_READ(MI_ARB_STATE); -+ if (!(tmp & MI_ARB_C3_LP_WRITE_ENABLE)) { -+ /* arb state is a masked write, so set bit + bit in mask */ -+ tmp = MI_ARB_C3_LP_WRITE_ENABLE | (MI_ARB_C3_LP_WRITE_ENABLE << MI_ARB_MASK_SHIFT); -+ I915_WRITE(MI_ARB_STATE, tmp); -+ } -+ } -+ - /* Old X drivers will take 0-2 for front, back, depth buffers */ - if (!drm_core_check_feature(dev, DRIVER_MODESET)) - dev_priv->fence_reg_start = 3; -diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h -index 4cbc521..4543975 100644 ---- a/drivers/gpu/drm/i915/i915_reg.h -+++ b/drivers/gpu/drm/i915/i915_reg.h -@@ -357,6 +357,70 @@ - #define LM_BURST_LENGTH 0x00000700 - #define LM_FIFO_WATERMARK 0x0000001F - #define MI_ARB_STATE 0x020e4 /* 915+ only */ -+#define MI_ARB_MASK_SHIFT 16 /* shift for enable bits */ -+ -+/* Make render/texture TLB fetches lower priorty than associated data -+ * fetches. This is not turned on by default -+ */ -+#define MI_ARB_RENDER_TLB_LOW_PRIORITY (1 << 15) -+ -+/* Isoch request wait on GTT enable (Display A/B/C streams). -+ * Make isoch requests stall on the TLB update. May cause -+ * display underruns (test mode only) -+ */ -+#define MI_ARB_ISOCH_WAIT_GTT (1 << 14) -+ -+/* Block grant count for isoch requests when block count is -+ * set to a finite value. -+ */ -+#define MI_ARB_BLOCK_GRANT_MASK (3 << 12) -+#define MI_ARB_BLOCK_GRANT_8 (0 << 12) /* for 3 display planes */ -+#define MI_ARB_BLOCK_GRANT_4 (1 << 12) /* for 2 display planes */ -+#define MI_ARB_BLOCK_GRANT_2 (2 << 12) /* for 1 display plane */ -+#define MI_ARB_BLOCK_GRANT_0 (3 << 12) /* don't use */ -+ -+/* Enable render writes to complete in C2/C3/C4 power states. -+ * If this isn't enabled, render writes are prevented in low -+ * power states. That seems bad to me. -+ */ -+#define MI_ARB_C3_LP_WRITE_ENABLE (1 << 11) -+ -+/* This acknowledges an async flip immediately instead -+ * of waiting for 2TLB fetches. -+ */ -+#define MI_ARB_ASYNC_FLIP_ACK_IMMEDIATE (1 << 10) -+ -+/* Enables non-sequential data reads through arbiter -+ */ -+#define MI_ARB_DUAL_DATA_PHASE_DISABLE (1 << 9) -+ -+/* Disable FSB snooping of cacheable write cycles from binner/render -+ * command stream -+ */ -+#define MI_ARB_CACHE_SNOOP_DISABLE (1 << 8) -+ -+/* Arbiter time slice for non-isoch streams */ -+#define MI_ARB_TIME_SLICE_MASK (7 << 5) -+#define MI_ARB_TIME_SLICE_1 (0 << 5) -+#define MI_ARB_TIME_SLICE_2 (1 << 5) -+#define MI_ARB_TIME_SLICE_4 (2 << 5) -+#define MI_ARB_TIME_SLICE_6 (3 << 5) -+#define MI_ARB_TIME_SLICE_8 (4 << 5) -+#define MI_ARB_TIME_SLICE_10 (5 << 5) -+#define MI_ARB_TIME_SLICE_14 (6 << 5) -+#define MI_ARB_TIME_SLICE_16 (7 << 5) -+ -+/* Low priority grace period page size */ -+#define MI_ARB_LOW_PRIORITY_GRACE_4KB (0 << 4) /* default */ -+#define MI_ARB_LOW_PRIORITY_GRACE_8KB (1 << 4) -+ -+/* Disable display A/B trickle feed */ -+#define MI_ARB_DISPLAY_TRICKLE_FEED_DISABLE (1 << 2) -+ -+/* Set display plane priority */ -+#define MI_ARB_DISPLAY_PRIORITY_A_B (0 << 0) /* display A > display B */ -+#define MI_ARB_DISPLAY_PRIORITY_B_A (1 << 0) /* display B > display A */ -+ - #define CACHE_MODE_0 0x02120 /* 915+ only */ - #define CM0_MASK_SHIFT 16 - #define CM0_IZ_OPT_DISABLE (1<<6) --- -1.7.1 - diff --git a/drm-radeon-fix-shared-ddc-handling.patch b/drm-radeon-fix-shared-ddc-handling.patch deleted file mode 100644 index f17827cdc..000000000 --- a/drm-radeon-fix-shared-ddc-handling.patch +++ /dev/null @@ -1,36 +0,0 @@ -From 557b452536c9390105539a264d342d963d71b087 Mon Sep 17 00:00:00 2001 -From: Alex Deucher -Date: Mon, 21 Jun 2010 12:07:52 -0400 -Subject: [PATCH] drm/radeon/kms: fix shared ddc handling -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -Connectors with a shared ddc line can be connected to different -encoders. - -Reported by Pasi Kärkkäinen on dri-devel - -Signed-off-by: Alex Deucher ---- - drivers/gpu/drm/radeon/radeon_connectors.c | 4 +++- - 1 files changed, 3 insertions(+), 1 deletions(-) - -diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c -index 0c7ccc6..f58f8bd 100644 ---- a/drivers/gpu/drm/radeon/radeon_connectors.c -+++ b/drivers/gpu/drm/radeon/radeon_connectors.c -@@ -785,7 +785,9 @@ static enum drm_connector_status radeon_dvi_detect(struct drm_connector *connect - if (connector == list_connector) - continue; - list_radeon_connector = to_radeon_connector(list_connector); -- if (radeon_connector->devices == list_radeon_connector->devices) { -+ if (list_radeon_connector->shared_ddc && -+ (list_radeon_connector->ddc_bus->rec.i2c_id == -+ radeon_connector->ddc_bus->rec.i2c_id)) { - if (drm_detect_hdmi_monitor(radeon_connector->edid)) { - if (connector->connector_type == DRM_MODE_CONNECTOR_DVID) { - kfree(radeon_connector->edid); --- -1.7.0.1 - diff --git a/ethtool-fix-buffer-overflow.patch b/ethtool-fix-buffer-overflow.patch deleted file mode 100644 index 01b1a41f3..000000000 --- a/ethtool-fix-buffer-overflow.patch +++ /dev/null @@ -1,33 +0,0 @@ -From: Ben Hutchings -Date: Mon, 28 Jun 2010 08:44:07 +0000 (+0000) -Subject: ethtool: Fix potential kernel buffer overflow in ETHTOOL_GRXCLSRLALL -X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Fdavem%2Fnet-2.6.git;a=commitdiff_plain;h=db048b69037e7fa6a7d9e95a1271a50dc08ae233 - -ethtool: Fix potential kernel buffer overflow in ETHTOOL_GRXCLSRLALL - -On a 32-bit machine, info.rule_cnt >= 0x40000000 leads to integer -overflow and the buffer may be smaller than needed. Since -ETHTOOL_GRXCLSRLALL is unprivileged, this can presumably be used for at -least denial of service. - -Signed-off-by: Ben Hutchings -Cc: stable@kernel.org -Signed-off-by: David S. Miller ---- - -diff --git a/net/core/ethtool.c b/net/core/ethtool.c -index a0f4964..a3a7e9a 100644 ---- a/net/core/ethtool.c -+++ b/net/core/ethtool.c -@@ -347,8 +347,9 @@ static noinline_for_stack int ethtool_get_rxnfc(struct net_device *dev, - - if (info.cmd == ETHTOOL_GRXCLSRLALL) { - if (info.rule_cnt > 0) { -- rule_buf = kmalloc(info.rule_cnt * sizeof(u32), -- GFP_USER); -+ if (info.rule_cnt <= KMALLOC_MAX_SIZE / sizeof(u32)) -+ rule_buf = kmalloc(info.rule_cnt * sizeof(u32), -+ GFP_USER); - if (!rule_buf) - return -ENOMEM; - } diff --git a/iwlwifi-cancel-scan-watchdog-in-iwl_bg_abort_scan.patch b/iwlwifi-cancel-scan-watchdog-in-iwl_bg_abort_scan.patch deleted file mode 100644 index 465d2ac73..000000000 --- a/iwlwifi-cancel-scan-watchdog-in-iwl_bg_abort_scan.patch +++ /dev/null @@ -1,58 +0,0 @@ -commit a69b03e941abae00380fc6bc1877fb797a1b31e6 -Author: John W. Linville -Date: Mon Jun 14 14:30:25 2010 -0400 - - iwlwifi: cancel scan watchdog in iwl_bg_abort_scan - - Avoids this: - - WARNING: at net/mac80211/scan.c:312 ieee80211_scan_completed+0x5f/0x1f1 - [mac80211]() - Hardware name: Latitude E5400 - Modules linked in: aes_x86_64 aes_generic fuse ipt_MASQUERADE iptable_nat - nf_nat rfcomm sco bridge stp llc bnep l2cap sunrpc cpufreq_ondemand - acpi_cpufreq freq_table xt_physdev ip6t_REJECT nf_conntrack_ipv6 - ip6table_filter ip6_tables ipv6 kvm_intel kvm uinput arc4 ecb - snd_hda_codec_intelhdmi snd_hda_codec_idt snd_hda_intel iwlagn snd_hda_codec - snd_hwdep snd_seq snd_seq_device iwlcore snd_pcm dell_wmi sdhci_pci sdhci - iTCO_wdt tg3 dell_laptop mmc_core i2c_i801 wmi mac80211 snd_timer - iTCO_vendor_support btusb joydev dcdbas cfg80211 bluetooth snd soundcore - microcode rfkill snd_page_alloc firewire_ohci firewire_core crc_itu_t - yenta_socket rsrc_nonstatic i915 drm_kms_helper drm i2c_algo_bit i2c_core video - output [last unloaded: scsi_wait_scan] - Pid: 979, comm: iwlagn Tainted: G W 2.6.33.3-85.fc13.x86_64 #1 - Call Trace: - [] warn_slowpath_common+0x77/0x8f - [] warn_slowpath_null+0xf/0x11 - [] ieee80211_scan_completed+0x5f/0x1f1 [mac80211] - [] iwl_bg_scan_completed+0xbb/0x17a [iwlcore] - [] worker_thread+0x1a4/0x232 - [] ? iwl_bg_scan_completed+0x0/0x17a [iwlcore] - [] ? autoremove_wake_function+0x0/0x34 - [] ? worker_thread+0x0/0x232 - [] kthread+0x7a/0x82 - [] kernel_thread_helper+0x4/0x10 - [] ? kthread+0x0/0x82 - [] ? kernel_thread_helper+0x0/0x10 - - Reported here: - - https://bugzilla.redhat.com/show_bug.cgi?id=590436 - - Signed-off-by: John W. Linville - Reported-by: Mihai Harpau - Cc: stable@kernel.org - Acked-by: Reinette Chatre - -diff --git a/drivers/net/wireless/iwlwifi/iwl-scan.c b/drivers/net/wireless/iwlwifi/iwl-scan.c -index 5d3f51f..386c5f9 100644 ---- a/drivers/net/wireless/iwlwifi/iwl-scan.c -+++ b/drivers/net/wireless/iwlwifi/iwl-scan.c -@@ -491,6 +491,7 @@ void iwl_bg_abort_scan(struct work_struct *work) - - mutex_lock(&priv->mutex); - -+ cancel_delayed_work_sync(&priv->scan_check); - set_bit(STATUS_SCAN_ABORTING, &priv->status); - iwl_send_scan_abort(priv); - diff --git a/kernel.spec b/kernel.spec index 6c46fe336..de4cdefe7 100644 --- a/kernel.spec +++ b/kernel.spec @@ -60,7 +60,7 @@ Summary: The Linux kernel %if 0%{?released_kernel} # Do we have a -stable update to apply? -%define stable_update 6 +%define stable_update 7 # Is it a -stable RC? %define stable_rc 0 # Set rpm version accordingly @@ -684,7 +684,6 @@ Patch570: linux-2.6-selinux-mprotect-checks.patch Patch580: linux-2.6-sparc-selinux-mprotect-checks.patch Patch581: linux-2.6-selinux-avtab-size.patch -Patch600: linux-2.6-acpi-sleep-live-sci-live.patch Patch601: linux-2.6-acpi-indirect_fan_control.patch Patch610: hda_intel-prealloc-4mb-dmabuffer.patch @@ -722,7 +721,6 @@ Patch1809: drm-radeon-firemv-pciid.patch Patch1810: drm-radeon-kms-fix-dual-link-dvi.patch Patch1811: drm-radeon-fix-rs600-tlb.patch Patch1812: drm-radeon-ss-fix.patch -Patch1813: drm-radeon-fix-shared-ddc-handling.patch # nouveau fixes # - these not until 2.6.34 Patch1815: drm-nouveau-abi16.patch @@ -748,10 +746,6 @@ Patch1830: drm-intel-sdvo-fix-2.patch Patch1840: drm-i915-use-pipe_control-instruction-on-ironlake-and-sandy-bridge.patch Patch1841: drm-i915-fix-non-ironlake-965-class-crashes.patch Patch1842: drm-i915-fix-edp-panels.patch -Patch1843: drm-i915-fix-hibernate-memory-corruption.patch -Patch1844: drm-i915-add-reclaimable-to-page-allocations.patch -Patch1845: drm-i915-make-G4X-style-PLL-search-more-permissive.patch -Patch1846: drm-intel-945gm-stability-fixes.patch Patch2100: linux-2.6-phylib-autoload.patch @@ -846,23 +840,11 @@ Patch12911: iwlwifi-fix-internal-scan-race.patch Patch12912: iwlwifi-recover_from_tx_stall.patch Patch12913: iwlwifi-manage-QoS-by-mac-stack.patch -Patch12914: mac80211-do-not-wipe-out-old-supported-rates.patch Patch12915: mac80211-explicitly-disable-enable-QoS.patch -Patch12916: mac80211-fix-supported-rates-IE-if-AP-doesnt-give-us-its-rates.patch # Disable rt20xx and rt35xx chipset support in rt2800pci and rt2800usb Patch13010: rt2x00-rt2800-Make-rt30xx-and-rt35xx-chipsets-configurable.patch -# iwlwifi: cancel scan watchdog in iwl_bg_abort_scan -Patch13020: iwlwifi-cancel-scan-watchdog-in-iwl_bg_abort_scan.patch - -Patch13030: sched-fix-over-scheduling-bug.patch -Patch13040: ethtool-fix-buffer-overflow.patch -Patch13050: x86-debug-clear-reserved-bits-of-dr6.patch -Patch13060: x86-debug-send-sigtrap-for-user-icebp.patch - -Patch13070: cifs-fix-malicious-redirect-problem-in-the-dns-lookup-code.patch - Patch13074: inotify-fix-inotify-oneshot-support.patch Patch13076: inotify-send-IN_UNMOUNT-events.patch @@ -1391,7 +1373,6 @@ ApplyPatch linux-2.6-defaults-aspm.patch # # ACPI -ApplyPatch linux-2.6-acpi-sleep-live-sci-live.patch ApplyPatch linux-2.6-acpi-indirect_fan_control.patch # ALSA @@ -1474,7 +1455,6 @@ ApplyPatch drm-radeon-firemv-pciid.patch ApplyPatch drm-radeon-kms-fix-dual-link-dvi.patch ApplyPatch drm-radeon-fix-rs600-tlb.patch ApplyPatch drm-radeon-ss-fix.patch -ApplyPatch drm-radeon-fix-shared-ddc-handling.patch ApplyPatch drm-nouveau-abi16.patch ApplyPatch drm-nouveau-updates.patch ApplyPatch drm-nouveau-acpi-edid-fallback.patch @@ -1491,14 +1471,6 @@ ApplyPatch drm-intel-sdvo-fix-2.patch ApplyPatch drm-i915-use-pipe_control-instruction-on-ironlake-and-sandy-bridge.patch ApplyPatch drm-i915-fix-non-ironlake-965-class-crashes.patch ApplyPatch drm-i915-fix-edp-panels.patch -# hibernation memory corruption fixes -ApplyPatch drm-i915-fix-hibernate-memory-corruption.patch -ApplyPatch drm-i915-add-reclaimable-to-page-allocations.patch - -# RHBZ#572799 -ApplyPatch drm-i915-make-G4X-style-PLL-search-more-permissive.patch - -ApplyPatch drm-intel-945gm-stability-fixes.patch ApplyPatch linux-2.6-phylib-autoload.patch @@ -1576,28 +1548,10 @@ ApplyPatch iwlwifi-recover_from_tx_stall.patch # mac80211/iwlwifi fix connections to some APs (rhbz#558002) ApplyPatch mac80211-explicitly-disable-enable-QoS.patch ApplyPatch iwlwifi-manage-QoS-by-mac-stack.patch -ApplyPatch mac80211-do-not-wipe-out-old-supported-rates.patch -ApplyPatch mac80211-fix-supported-rates-IE-if-AP-doesnt-give-us-its-rates.patch # Disable rt20xx and rt35xx chipset support in rt2800pci and rt2800usb ApplyPatch rt2x00-rt2800-Make-rt30xx-and-rt35xx-chipsets-configurable.patch -# iwlwifi: cancel scan watchdog in iwl_bg_abort_scan -ApplyPatch iwlwifi-cancel-scan-watchdog-in-iwl_bg_abort_scan.patch - -# fix performance problem with CGROUPS -ApplyPatch sched-fix-over-scheduling-bug.patch - -# CVE-2010-2478 -ApplyPatch ethtool-fix-buffer-overflow.patch - -# BZ#609548 -ApplyPatch x86-debug-clear-reserved-bits-of-dr6.patch -ApplyPatch x86-debug-send-sigtrap-for-user-icebp.patch - -# CVE-2010-2524 -ApplyPatch cifs-fix-malicious-redirect-problem-in-the-dns-lookup-code.patch - # fix broken oneshot support and missing umount events (#607327) ApplyPatch inotify-fix-inotify-oneshot-support.patch ApplyPatch inotify-send-IN_UNMOUNT-events.patch @@ -2253,8 +2207,25 @@ fi %changelog -* Sat Aug 14 2010 Chuck Ebbert 2.6.33.6-148 -- Add 2.6.33 branch to git repository. +* Sat Aug 14 2010 Chuck Ebbert 2.6.33.7-148 +- Update to kernel 2.6.33.7 +- Drop patches merged in 2.6.33.7: + drm-i915-add-reclaimable-to-page-allocations.patch + drm-i915-fix-hibernate-memory-corruption.patch + drm-radeon-fix-shared-ddc-handling.patch + linux-2.6-acpi-sleep-live-sci-live.patch + drm-i915-make-G4X-style-PLL-search-more-permissive.patch + drm-intel-945gm-stability-fixes.patch + mac80211-do-not-wipe-out-old-supported-rates.patch + mac80211-fix-supported-rates-IE-if-AP-doesnt-give-us-its-rates.patch + iwlwifi-cancel-scan-watchdog-in-iwl_bg_abort_scan.patch + sched-fix-over-scheduling-bug.patch + ethtool-fix-buffer-overflow.patch + x86-debug-clear-reserved-bits-of-dr6.patch + x86-debug-send-sigtrap-for-user-icebp.patch + cifs-fix-malicious-redirect-problem-in-the-dns-lookup-code.patch +- Revert broken ssb patch from 2.6.33.7: + ssb-handle-netbook-devices-where-the-sprom-address-is-changed.patch * Fri Jul 23 2010 Chuck Ebbert 2.6.33.6-147.2.4 - inotify-fix-inotify-oneshot-support.patch, diff --git a/linux-2.6-acpi-sleep-live-sci-live.patch b/linux-2.6-acpi-sleep-live-sci-live.patch deleted file mode 100644 index 5d4239c69..000000000 --- a/linux-2.6-acpi-sleep-live-sci-live.patch +++ /dev/null @@ -1,51 +0,0 @@ -commit 7ba0dea4158155a68b833982199691dbc2d4e6dc -Author: Matthew Garrett -Date: Mon Apr 19 16:51:39 2010 -0400 - - acpi: Fall back to manually changing SCI_EN - - The ACPI spec tells us that the ACPI SCI_EN bit is under hardware control - and shouldn't be touched by the OS. It seems that the Leading Other OS - ignores this and some machines expect this behaviour. We have a blacklist - for these, but given that we're able to detect the failure case and the - alternative to breaking the spec is letting the machine crash and burn, - let's try falling back when we know the alternative is a mostly-dead - machine. - - Signed-off-by: Matthew Garrett - -diff --git a/drivers/acpi/sleep.c b/drivers/acpi/sleep.c -index f74834a..79df8d4 100644 ---- a/drivers/acpi/sleep.c -+++ b/drivers/acpi/sleep.c -@@ -227,6 +227,7 @@ static int acpi_suspend_begin(suspend_state_t pm_state) - static int acpi_suspend_enter(suspend_state_t pm_state) - { - acpi_status status = AE_OK; -+ acpi_status enable_status = AE_OK; - unsigned long flags = 0; - u32 acpi_state = acpi_target_sleep_state; - -@@ -254,10 +255,19 @@ static int acpi_suspend_enter(suspend_state_t pm_state) - } - - /* If ACPI is not enabled by the BIOS, we need to enable it here. */ -- if (set_sci_en_on_resume) -+ if (!set_sci_en_on_resume) -+ enable_status = acpi_enable(); -+ -+ if (set_sci_en_on_resume || enable_status == AE_NO_HARDWARE_RESPONSE) -+ /* If we're still in legacy mode then we have a problem. The -+ * spec tells us that this bit is under hardware control, but -+ * there's no plausible way that the OS can transition back to -+ * legacy mode so our choices here are to either ignore the -+ * spec or crash and burn horribly. The latter doesn't seem -+ * like it's ever going to be the preferable choice, so let's -+ * live dangerously. -+ */ - acpi_write_bit_register(ACPI_BITREG_SCI_ENABLE, 1); -- else -- acpi_enable(); - - /* Reprogram control registers and execute _BFS */ - acpi_leave_sleep_state_prep(acpi_state); diff --git a/linux-2.6-upstream-reverts.patch b/linux-2.6-upstream-reverts.patch index 197189a05..234ee785c 100644 --- a/linux-2.6-upstream-reverts.patch +++ b/linux-2.6-upstream-reverts.patch @@ -1,3 +1,240 @@ +From stable-bounces@linux.kernel.org Sun Jul 11 16:26:25 2010 +From: Larry Finger +Date: Sun, 11 Jul 2010 18:26:15 -0500 +Subject: ssb: Handle Netbook devices where the SPROM address is changed +To: Greg KH +Cc: linux-stable +Message-ID: <4C3A5317.3090603@lwfinger.net> + +From: Christoph Fritz + +For some Netbook computers with Broadcom BCM4312 wireless interfaces, +the SPROM has been moved to a new location. When the ssb driver tries to +read the old location, the systems hangs when trying to read a +non-existent location. Such freezes are particularly bad as they do not +log the failure. + +This patch is modified from commit +da1fdb02d9200ff28b6f3a380d21930335fe5429 with some pieces from other +mainline changes so that it can be applied to stable 2.6.34.Y. + +Signed-off-by: Larry Finger +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ssb/driver_chipcommon.c | 3 + + drivers/ssb/driver_chipcommon_pmu.c | 17 ++++------- + drivers/ssb/pci.c | 46 ++++++++++++++++++++++++++---- + drivers/ssb/sprom.c | 15 +++++++++ + include/linux/ssb/ssb.h | 1 + include/linux/ssb/ssb_driver_chipcommon.h | 2 + + include/linux/ssb/ssb_regs.h | 3 + + 7 files changed, 70 insertions(+), 17 deletions(-) + +--- a/drivers/ssb/driver_chipcommon.c ++++ b/drivers/ssb/driver_chipcommon.c +@@ -233,6 +233,9 @@ void ssb_chipcommon_init(struct ssb_chip + { + if (!cc->dev) + return; /* We don't have a ChipCommon */ ++ if (cc->dev->id.revision >= 11) ++ cc->status = chipco_read32(cc, SSB_CHIPCO_CHIPSTAT); ++ ssb_dprintk(KERN_INFO PFX "chipcommon status is 0x%x\n", cc->status); + ssb_pmu_init(cc); + chipco_powercontrol_init(cc); + ssb_chipco_set_clockmode(cc, SSB_CLKMODE_FAST); +--- a/drivers/ssb/driver_chipcommon_pmu.c ++++ b/drivers/ssb/driver_chipcommon_pmu.c +@@ -495,9 +495,9 @@ static void ssb_pmu_resources_init(struc + chipco_write32(cc, SSB_CHIPCO_PMU_MAXRES_MSK, max_msk); + } + ++/* http://bcm-v4.sipsolutions.net/802.11/SSB/PmuInit */ + void ssb_pmu_init(struct ssb_chipcommon *cc) + { +- struct ssb_bus *bus = cc->dev->bus; + u32 pmucap; + + if (!(cc->capabilities & SSB_CHIPCO_CAP_PMU)) +@@ -509,15 +509,12 @@ void ssb_pmu_init(struct ssb_chipcommon + ssb_dprintk(KERN_DEBUG PFX "Found rev %u PMU (capabilities 0x%08X)\n", + cc->pmu.rev, pmucap); + +- if (cc->pmu.rev >= 1) { +- if ((bus->chip_id == 0x4325) && (bus->chip_rev < 2)) { +- chipco_mask32(cc, SSB_CHIPCO_PMU_CTL, +- ~SSB_CHIPCO_PMU_CTL_NOILPONW); +- } else { +- chipco_set32(cc, SSB_CHIPCO_PMU_CTL, +- SSB_CHIPCO_PMU_CTL_NOILPONW); +- } +- } ++ if (cc->pmu.rev == 1) ++ chipco_mask32(cc, SSB_CHIPCO_PMU_CTL, ++ ~SSB_CHIPCO_PMU_CTL_NOILPONW); ++ else ++ chipco_set32(cc, SSB_CHIPCO_PMU_CTL, ++ SSB_CHIPCO_PMU_CTL_NOILPONW); + ssb_pmu_pll_init(cc); + ssb_pmu_resources_init(cc); + } +--- a/drivers/ssb/pci.c ++++ b/drivers/ssb/pci.c +@@ -22,6 +22,7 @@ + + #include "ssb_private.h" + ++bool ssb_is_sprom_available(struct ssb_bus *bus); + + /* Define the following to 1 to enable a printk on each coreswitch. */ + #define SSB_VERBOSE_PCICORESWITCH_DEBUG 0 +@@ -167,7 +168,7 @@ err_pci: + } + + /* Get the word-offset for a SSB_SPROM_XXX define. */ +-#define SPOFF(offset) (((offset) - SSB_SPROM_BASE) / sizeof(u16)) ++#define SPOFF(offset) ((offset) / sizeof(u16)) + /* Helper to extract some _offset, which is one of the SSB_SPROM_XXX defines. */ + #define SPEX16(_outvar, _offset, _mask, _shift) \ + out->_outvar = ((in[SPOFF(_offset)] & (_mask)) >> (_shift)) +@@ -252,8 +253,13 @@ static int sprom_do_read(struct ssb_bus + { + int i; + ++ /* Check if SPROM can be read */ ++ if (ioread16(bus->mmio + bus->sprom_offset) == 0xFFFF) { ++ ssb_printk(KERN_ERR PFX "Unable to read SPROM\n"); ++ return -ENODEV; ++ } + for (i = 0; i < bus->sprom_size; i++) +- sprom[i] = ioread16(bus->mmio + SSB_SPROM_BASE + (i * 2)); ++ sprom[i] = ioread16(bus->mmio + bus->sprom_offset + (i * 2)); + + return 0; + } +@@ -284,7 +290,7 @@ static int sprom_do_write(struct ssb_bus + ssb_printk("75%%"); + else if (i % 2) + ssb_printk("."); +- writew(sprom[i], bus->mmio + SSB_SPROM_BASE + (i * 2)); ++ writew(sprom[i], bus->mmio + bus->sprom_offset + (i * 2)); + mmiowb(); + msleep(20); + } +@@ -620,21 +626,49 @@ static int ssb_pci_sprom_get(struct ssb_ + int err = -ENOMEM; + u16 *buf; + ++ if (!ssb_is_sprom_available(bus)) { ++ ssb_printk(KERN_ERR PFX "No SPROM available!\n"); ++ return -ENODEV; ++ } ++ if (bus->chipco.dev) { /* can be unavailible! */ ++ /* ++ * get SPROM offset: SSB_SPROM_BASE1 except for ++ * chipcommon rev >= 31 or chip ID is 0x4312 and ++ * chipcommon status & 3 == 2 ++ */ ++ if (bus->chipco.dev->id.revision >= 31) ++ bus->sprom_offset = SSB_SPROM_BASE31; ++ else if (bus->chip_id == 0x4312 && ++ (bus->chipco.status & 0x03) == 2) ++ bus->sprom_offset = SSB_SPROM_BASE31; ++ else ++ bus->sprom_offset = SSB_SPROM_BASE1; ++ } else { ++ bus->sprom_offset = SSB_SPROM_BASE1; ++ } ++ ssb_dprintk(KERN_INFO PFX "SPROM offset is 0x%x\n", bus->sprom_offset); ++ + buf = kcalloc(SSB_SPROMSIZE_WORDS_R123, sizeof(u16), GFP_KERNEL); + if (!buf) + goto out; + bus->sprom_size = SSB_SPROMSIZE_WORDS_R123; +- sprom_do_read(bus, buf); ++ err = sprom_do_read(bus, buf); ++ if (err) ++ goto out_free; + err = sprom_check_crc(buf, bus->sprom_size); + if (err) { + /* try for a 440 byte SPROM - revision 4 and higher */ + kfree(buf); + buf = kcalloc(SSB_SPROMSIZE_WORDS_R4, sizeof(u16), + GFP_KERNEL); +- if (!buf) ++ if (!buf) { ++ err = -ENOMEM; + goto out; ++ } + bus->sprom_size = SSB_SPROMSIZE_WORDS_R4; +- sprom_do_read(bus, buf); ++ err = sprom_do_read(bus, buf); ++ if (err) ++ goto out_free; + err = sprom_check_crc(buf, bus->sprom_size); + if (err) { + /* All CRC attempts failed. +--- a/drivers/ssb/sprom.c ++++ b/drivers/ssb/sprom.c +@@ -175,3 +175,18 @@ const struct ssb_sprom *ssb_get_fallback + { + return fallback_sprom; + } ++ ++/* http://bcm-v4.sipsolutions.net/802.11/IsSpromAvailable */ ++bool ssb_is_sprom_available(struct ssb_bus *bus) ++{ ++ /* status register only exists on chipcomon rev >= 11 and we need check ++ for >= 31 only */ ++ /* this routine differs from specs as we do not access SPROM directly ++ on PCMCIA */ ++ if (bus->bustype == SSB_BUSTYPE_PCI && ++ bus->chipco.dev && /* can be unavailible! */ ++ bus->chipco.dev->id.revision >= 31) ++ return bus->chipco.capabilities & SSB_CHIPCO_CAP_SPROM; ++ ++ return true; ++} +--- a/include/linux/ssb/ssb.h ++++ b/include/linux/ssb/ssb.h +@@ -306,6 +306,7 @@ struct ssb_bus { + u16 chip_id; + u16 chip_rev; + u16 sprom_size; /* number of words in sprom */ ++ u16 sprom_offset; + u8 chip_package; + + /* List of devices (cores) on the backplane. */ +--- a/include/linux/ssb/ssb_driver_chipcommon.h ++++ b/include/linux/ssb/ssb_driver_chipcommon.h +@@ -46,6 +46,7 @@ + #define SSB_PLLTYPE_7 0x00038000 /* 25Mhz, 4 dividers */ + #define SSB_CHIPCO_CAP_PCTL 0x00040000 /* Power Control */ + #define SSB_CHIPCO_CAP_OTPS 0x00380000 /* OTP size */ ++#define SSB_CHIPCO_CAP_SPROM 0x40000000 /* SPROM present */ + #define SSB_CHIPCO_CAP_OTPS_SHIFT 19 + #define SSB_CHIPCO_CAP_OTPS_BASE 5 + #define SSB_CHIPCO_CAP_JTAGM 0x00400000 /* JTAG master present */ +@@ -564,6 +565,7 @@ struct ssb_chipcommon_pmu { + struct ssb_chipcommon { + struct ssb_device *dev; + u32 capabilities; ++ u32 status; + /* Fast Powerup Delay constant */ + u16 fast_pwrup_delay; + struct ssb_chipcommon_pmu pmu; +--- a/include/linux/ssb/ssb_regs.h ++++ b/include/linux/ssb/ssb_regs.h +@@ -170,7 +170,8 @@ + #define SSB_SPROMSIZE_WORDS_R4 220 + #define SSB_SPROMSIZE_BYTES_R123 (SSB_SPROMSIZE_WORDS_R123 * sizeof(u16)) + #define SSB_SPROMSIZE_BYTES_R4 (SSB_SPROMSIZE_WORDS_R4 * sizeof(u16)) +-#define SSB_SPROM_BASE 0x1000 ++#define SSB_SPROM_BASE1 0x1000 ++#define SSB_SPROM_BASE31 0x0800 + #define SSB_SPROM_REVISION 0x107E + #define SSB_SPROM_REVISION_REV 0x00FF /* SPROM Revision number */ + #define SSB_SPROM_REVISION_CRC 0xFF00 /* SPROM CRC8 value */ From 5ce8ba7c9279a63f99e1f131602580472b8af968 Mon Sep 17 00:00:00 2001 From: Adam Jackson Date: Thu, 15 Apr 2010 14:03:30 -0400 diff --git a/mac80211-do-not-wipe-out-old-supported-rates.patch b/mac80211-do-not-wipe-out-old-supported-rates.patch deleted file mode 100644 index 3c300dfe5..000000000 --- a/mac80211-do-not-wipe-out-old-supported-rates.patch +++ /dev/null @@ -1,70 +0,0 @@ -From: Stanislaw Gruszka -To: kernel@lists.fedoraproject.org, "John W. Linville" -Subject: [PATCH 3/4 2.6.33.y] mac80211: do not wip out old supported rates -Date: Fri, 11 Jun 2010 17:04:19 +0200 - -commit f0b058b61711ebf5be94d6865ca7b2c259b71d37 upstream. - -Use old supported rates, if some buggy AP do not provide -supported rates information element in managment frame. - -Signed-off-by: Stanislaw Gruszka ---- - net/mac80211/scan.c | 21 +++++++++++---------- - 1 files changed, 11 insertions(+), 10 deletions(-) - -diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c -index bc17cf7..697dc54 100644 ---- a/net/mac80211/scan.c -+++ b/net/mac80211/scan.c -@@ -60,7 +60,7 @@ ieee80211_bss_info_update(struct ieee80211_local *local, - bool beacon) - { - struct ieee80211_bss *bss; -- int clen; -+ int clen, srlen; - s32 signal = 0; - - if (local->hw.flags & IEEE80211_HW_SIGNAL_DBM) -@@ -92,23 +92,24 @@ ieee80211_bss_info_update(struct ieee80211_local *local, - if (bss->dtim_period == 0) - bss->dtim_period = 1; - -- bss->supp_rates_len = 0; -+ /* replace old supported rates if we get new values */ -+ srlen = 0; - if (elems->supp_rates) { -- clen = IEEE80211_MAX_SUPP_RATES - bss->supp_rates_len; -+ clen = IEEE80211_MAX_SUPP_RATES; - if (clen > elems->supp_rates_len) - clen = elems->supp_rates_len; -- memcpy(&bss->supp_rates[bss->supp_rates_len], elems->supp_rates, -- clen); -- bss->supp_rates_len += clen; -+ memcpy(bss->supp_rates, elems->supp_rates, clen); -+ srlen += clen; - } - if (elems->ext_supp_rates) { -- clen = IEEE80211_MAX_SUPP_RATES - bss->supp_rates_len; -+ clen = IEEE80211_MAX_SUPP_RATES - srlen; - if (clen > elems->ext_supp_rates_len) - clen = elems->ext_supp_rates_len; -- memcpy(&bss->supp_rates[bss->supp_rates_len], -- elems->ext_supp_rates, clen); -- bss->supp_rates_len += clen; -+ memcpy(bss->supp_rates + srlen, elems->ext_supp_rates, clen); -+ srlen += clen; - } -+ if (srlen) -+ bss->supp_rates_len = srlen; - - bss->wmm_used = elems->wmm_param || elems->wmm_info; - --- -1.6.2.5 - -_______________________________________________ -kernel mailing list -kernel@lists.fedoraproject.org -https://admin.fedoraproject.org/mailman/listinfo/kernel - diff --git a/mac80211-fix-supported-rates-IE-if-AP-doesnt-give-us-its-rates.patch b/mac80211-fix-supported-rates-IE-if-AP-doesnt-give-us-its-rates.patch deleted file mode 100644 index 87ea093d7..000000000 --- a/mac80211-fix-supported-rates-IE-if-AP-doesnt-give-us-its-rates.patch +++ /dev/null @@ -1,123 +0,0 @@ -Return-path: -X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on - bombadil.infradead.org -X-Spam-Level: -X-Spam-Status: No, score=-0.0 required=5.0 tests=T_RP_MATCHES_RCVD - autolearn=ham version=3.3.1 -Envelope-to: kyle@mcmartin.ca -Delivery-date: Fri, 11 Jun 2010 15:05:50 +0000 -Received: from bastion02.fedoraproject.org ([209.132.181.3] helo=bastion.fedoraproject.org) - by bombadil.infradead.org with esmtp (Exim 4.72 #1 (Red Hat Linux)) - id 1ON5np-0006qq-A4 - for kyle@mcmartin.ca; Fri, 11 Jun 2010 15:05:50 +0000 -Received: from lists.fedoraproject.org (collab1.vpn.fedoraproject.org [192.168.1.21]) - by bastion02.phx2.fedoraproject.org (Postfix) with ESMTP id C8AFE110FA4; - Fri, 11 Jun 2010 15:05:48 +0000 (UTC) -Received: from collab1.fedoraproject.org (localhost.localdomain [127.0.0.1]) - by lists.fedoraproject.org (Postfix) with ESMTP id 7CD7932677B; - Fri, 11 Jun 2010 15:05:48 +0000 (UTC) -X-Original-To: kernel@lists.fedoraproject.org -Delivered-To: kernel@lists.fedoraproject.org -Received: from smtp-mm2.fedoraproject.org (smtp-mm2.fedoraproject.org - [66.35.62.164]) - by lists.fedoraproject.org (Postfix) with ESMTP id EBB823267E8 - for ; - Fri, 11 Jun 2010 15:05:45 +0000 (UTC) -Received: from mx1.redhat.com (mx1.redhat.com [209.132.183.28]) - by smtp-mm2.fedoraproject.org (Postfix) with ESMTP id 5F31DE71E6 - for ; - Fri, 11 Jun 2010 15:05:45 +0000 (UTC) -Received: from int-mx01.intmail.prod.int.phx2.redhat.com - (int-mx01.intmail.prod.int.phx2.redhat.com [10.5.11.11]) - by mx1.redhat.com (8.13.8/8.13.8) with ESMTP id o5BF5ifi002333 - (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK) - for ; Fri, 11 Jun 2010 11:05:45 -0400 -Received: from localhost (vpn-10-251.rdu.redhat.com [10.11.10.251]) - by int-mx01.intmail.prod.int.phx2.redhat.com (8.13.8/8.13.8) with ESMTP - id o5BF5h8Z029086; Fri, 11 Jun 2010 11:05:44 -0400 -From: Stanislaw Gruszka -To: kernel@lists.fedoraproject.org, "John W. Linville" -Subject: [PATCH 4/4 2.6.33.y] mac80211: fix supported rates IE if AP doesn't - give us it's rates -Date: Fri, 11 Jun 2010 17:04:20 +0200 -Message-Id: <1276268660-18830-4-git-send-email-sgruszka@redhat.com> -In-Reply-To: <1276268660-18830-3-git-send-email-sgruszka@redhat.com> -References: <1276268660-18830-1-git-send-email-sgruszka@redhat.com> - <1276268660-18830-2-git-send-email-sgruszka@redhat.com> - <1276268660-18830-3-git-send-email-sgruszka@redhat.com> -X-Scanned-By: MIMEDefang 2.67 on 10.5.11.11 -Cc: Stanislaw Gruszka -X-BeenThere: kernel@lists.fedoraproject.org -X-Mailman-Version: 2.1.9 -Precedence: list -List-Id: "Fedora kernel development." -List-Unsubscribe: , - -List-Archive: -List-Post: -List-Help: -List-Subscribe: , - -MIME-Version: 1.0 -Content-Type: text/plain; charset="us-ascii" -Content-Transfer-Encoding: 7bit -Sender: kernel-bounces@lists.fedoraproject.org -Errors-To: kernel-bounces@lists.fedoraproject.org -X-CRM114-Version: 20090807-BlameThorstenAndJenny ( TRE 0.7.6 (BSD) ) MR-646709E3 -X-CRM114-CacheID: sfid-20100611_110549_564657_0ED6FEC7 -X-CRM114-Status: GOOD ( 17.72 ) -Content-Length: 1846 - -commit 76f273640134f3eb8257179cd5b3bc6ba5fe4a96 upstream. - -If AP do not provide us supported rates before assiociation, send -all rates we are supporting instead of empty information element. - -Signed-off-by: Stanislaw Gruszka ---- - net/mac80211/mlme.c | 17 +++++++++++------ - 1 files changed, 11 insertions(+), 6 deletions(-) - -diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c -index 950088d..aa90100 100644 ---- a/net/mac80211/mlme.c -+++ b/net/mac80211/mlme.c -@@ -270,12 +270,6 @@ static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata, - if (wk->bss->wmm_used) - wmm = 1; - -- /* get all rates supported by the device and the AP as -- * some APs don't like getting a superset of their rates -- * in the association request (e.g. D-Link DAP 1353 in -- * b-only mode) */ -- rates_len = ieee80211_compatible_rates(wk->bss, sband, &rates); -- - if ((wk->bss->cbss.capability & WLAN_CAPABILITY_SPECTRUM_MGMT) && - (local->hw.flags & IEEE80211_HW_SPECTRUM_MGMT)) - capab |= WLAN_CAPABILITY_SPECTRUM_MGMT; -@@ -310,6 +304,17 @@ static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata, - *pos++ = wk->ssid_len; - memcpy(pos, wk->ssid, wk->ssid_len); - -+ if (wk->bss->supp_rates_len) { -+ /* get all rates supported by the device and the AP as -+ * some APs don't like getting a superset of their rates -+ * in the association request (e.g. D-Link DAP 1353 in -+ * b-only mode) */ -+ rates_len = ieee80211_compatible_rates(wk->bss, sband, &rates); -+ } else { -+ rates = ~0; -+ rates_len = sband->n_bitrates; -+ } -+ - /* add all rates which were marked to be used above */ - supp_rates_len = rates_len; - if (supp_rates_len > 8) --- -1.6.2.5 - -_______________________________________________ -kernel mailing list -kernel@lists.fedoraproject.org -https://admin.fedoraproject.org/mailman/listinfo/kernel - diff --git a/sched-fix-over-scheduling-bug.patch b/sched-fix-over-scheduling-bug.patch deleted file mode 100644 index b09c10196..000000000 --- a/sched-fix-over-scheduling-bug.patch +++ /dev/null @@ -1,60 +0,0 @@ -From: Alex,Shi -Date: Thu, 17 Jun 2010 06:08:13 +0000 (+0800) -Subject: sched: Fix over-scheduling bug -X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Ftorvalds%2Flinux-2.6.git;a=commitdiff_plain;h=3c93717cfa51316e4dbb471e7c0f9d243359d5f8 - -sched: Fix over-scheduling bug - -Commit e70971591 ("sched: Optimize unused cgroup configuration") introduced -an imbalanced scheduling bug. [[ in 2.6.32-rc1 ]] - -If we do not use CGROUP, function update_h_load won't update h_load. When the -system has a large number of tasks far more than logical CPU number, the -incorrect cfs_rq[cpu]->h_load value will cause load_balance() to pull too -many tasks to the local CPU from the busiest CPU. So the busiest CPU keeps -going in a round robin. That will hurt performance. - -The issue was found originally by a scientific calculation workload that -developed by Yanmin. With that commit, the workload performance drops -about 40%. - - CPU before after - - 00 : 2 : 7 - 01 : 1 : 7 - 02 : 11 : 6 - 03 : 12 : 7 - 04 : 6 : 6 - 05 : 11 : 7 - 06 : 10 : 6 - 07 : 12 : 7 - 08 : 11 : 6 - 09 : 12 : 6 - 10 : 1 : 6 - 11 : 1 : 6 - 12 : 6 : 6 - 13 : 2 : 6 - 14 : 2 : 6 - 15 : 1 : 6 - -Reviewed-by: Yanmin zhang -Signed-off-by: Alex Shi -Signed-off-by: Peter Zijlstra -LKML-Reference: <1276754893.9452.5442.camel@debian> -Signed-off-by: Ingo Molnar ---- - -diff --git a/kernel/sched.c b/kernel/sched.c -index 2aaceeb..6c9e7c8 100644 ---- a/kernel/sched.c -+++ b/kernel/sched.c -@@ -1657,9 +1657,6 @@ static void update_shares(struct sched_domain *sd) - - static void update_h_load(long cpu) - { -- if (root_task_group_empty()) -- return; -- - walk_tg_tree(tg_load_down, tg_nop, (void *)cpu); - } - diff --git a/sources b/sources index cd05c3baf..c1da3bf88 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ c3883760b18d50e8d78819c54d579b00 linux-2.6.33.tar.bz2 -88390e48c301f9eaeb455d8c00cfda57 patch-2.6.33.6.bz2 +04b3affb4f7fb3035303a32bd6080baf patch-2.6.33.7.bz2 diff --git a/x86-debug-clear-reserved-bits-of-dr6.patch b/x86-debug-clear-reserved-bits-of-dr6.patch deleted file mode 100644 index 192023359..000000000 --- a/x86-debug-clear-reserved-bits-of-dr6.patch +++ /dev/null @@ -1,50 +0,0 @@ -From: K.Prasad -Date: Thu, 28 Jan 2010 11:14:01 +0000 (+0530) -Subject: x86/debug: Clear reserved bits of DR6 in do_debug() -X-Git-Tag: v2.6.34-rc1~197^2~94 -X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Ftorvalds%2Flinux-2.6.git;a=commitdiff_plain;h=40f9249a73f6c251adea492b1c3d19d39e2a9bda - -x86/debug: Clear reserved bits of DR6 in do_debug() - -Clear the reserved bits from the stored copy of debug status -register (DR6). -This will help easy bitwise operations such as quick testing -of a debug event origin. - -Signed-off-by: K.Prasad -Cc: Roland McGrath -Cc: Jan Kiszka -Cc: Alan Stern -Cc: Ingo Molnar -LKML-Reference: <20100128111401.GB13935@in.ibm.com> -Signed-off-by: Frederic Weisbecker ---- - -diff --git a/arch/x86/include/asm/debugreg.h b/arch/x86/include/asm/debugreg.h -index 8240f76..b81002f 100644 ---- a/arch/x86/include/asm/debugreg.h -+++ b/arch/x86/include/asm/debugreg.h -@@ -14,6 +14,9 @@ - which debugging register was responsible for the trap. The other bits - are either reserved or not of interest to us. */ - -+/* Define reserved bits in DR6 which are always set to 1 */ -+#define DR6_RESERVED (0xFFFF0FF0) -+ - #define DR_TRAP0 (0x1) /* db0 */ - #define DR_TRAP1 (0x2) /* db1 */ - #define DR_TRAP2 (0x4) /* db2 */ -diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c -index 3339917..1168e44 100644 ---- a/arch/x86/kernel/traps.c -+++ b/arch/x86/kernel/traps.c -@@ -534,6 +534,9 @@ dotraplinkage void __kprobes do_debug(struct pt_regs *regs, long error_code) - - get_debugreg(dr6, 6); - -+ /* Filter out all the reserved bits which are preset to 1 */ -+ dr6 &= ~DR6_RESERVED; -+ - /* Catch kmemcheck conditions first of all! */ - if ((dr6 & DR_STEP) && kmemcheck_trap(regs)) - return; diff --git a/x86-debug-send-sigtrap-for-user-icebp.patch b/x86-debug-send-sigtrap-for-user-icebp.patch deleted file mode 100644 index 376fea20c..000000000 --- a/x86-debug-send-sigtrap-for-user-icebp.patch +++ /dev/null @@ -1,80 +0,0 @@ -From: Frederic Weisbecker -Date: Wed, 30 Jun 2010 13:09:06 +0000 (+0200) -Subject: x86: Send a SIGTRAP for user icebp traps -X-Git-Tag: v2.6.35-rc4~2^2~2 -X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Ftorvalds%2Flinux-2.6.git;a=commitdiff_plain;h=a1e80fafc9f0742a1776a0490258cb64912411b0 - -x86: Send a SIGTRAP for user icebp traps - -Before we had a generic breakpoint layer, x86 used to send a -sigtrap for any debug event that happened in userspace, -except if it was caused by lazy dr7 switches. - -Currently we only send such signal for single step or breakpoint -events. - -However, there are three other kind of debug exceptions: - -- debug register access detected: trigger an exception if the - next instruction touches the debug registers. We don't use - it. -- task switch, but we don't use tss. -- icebp/int01 trap. This instruction (0xf1) is undocumented and - generates an int 1 exception. Unlike single step through TF - flag, it doesn't set the single step origin of the exception - in dr6. - -icebp then used to be reported in userspace using trap signals -but this have been incidentally broken with the new breakpoint -code. Reenable this. Since this is the only debug event that -doesn't set anything in dr6, this is all we have to check. - -This fixes a regression in Wine where World Of Warcraft got broken -as it uses this for software protection checks purposes. And -probably other apps do. - -Reported-and-tested-by: Alexandre Julliard -Signed-off-by: Frederic Weisbecker -Cc: Ingo Molnar -Cc: H. Peter Anvin -Cc: Thomas Gleixner -Cc: Prasad -Cc: 2.6.33.x 2.6.34.x ---- - -diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c -index 142d70c..725ef4d 100644 ---- a/arch/x86/kernel/traps.c -+++ b/arch/x86/kernel/traps.c -@@ -526,6 +526,7 @@ asmlinkage __kprobes struct pt_regs *sync_regs(struct pt_regs *eregs) - dotraplinkage void __kprobes do_debug(struct pt_regs *regs, long error_code) - { - struct task_struct *tsk = current; -+ int user_icebp = 0; - unsigned long dr6; - int si_code; - -@@ -534,6 +535,14 @@ dotraplinkage void __kprobes do_debug(struct pt_regs *regs, long error_code) - /* Filter out all the reserved bits which are preset to 1 */ - dr6 &= ~DR6_RESERVED; - -+ /* -+ * If dr6 has no reason to give us about the origin of this trap, -+ * then it's very likely the result of an icebp/int01 trap. -+ * User wants a sigtrap for that. -+ */ -+ if (!dr6 && user_mode(regs)) -+ user_icebp = 1; -+ - /* Catch kmemcheck conditions first of all! */ - if ((dr6 & DR_STEP) && kmemcheck_trap(regs)) - return; -@@ -575,7 +584,7 @@ dotraplinkage void __kprobes do_debug(struct pt_regs *regs, long error_code) - regs->flags &= ~X86_EFLAGS_TF; - } - si_code = get_si_code(tsk->thread.debugreg6); -- if (tsk->thread.debugreg6 & (DR_STEP | DR_TRAP_BITS)) -+ if (tsk->thread.debugreg6 & (DR_STEP | DR_TRAP_BITS) || user_icebp) - send_sigtrap(tsk, regs, error_code, si_code); - preempt_conditional_cli(regs); -