diff --git a/ACPICA-Fix-regression-in-FADT-revision-checks.patch b/ACPICA-Fix-regression-in-FADT-revision-checks.patch deleted file mode 100644 index d6b5903..0000000 --- a/ACPICA-Fix-regression-in-FADT-revision-checks.patch +++ /dev/null @@ -1,58 +0,0 @@ - commit 64b3db22c04586997ab4be46dd5a5b99f8a2d390 (2.6.39), -"Remove use of unreliable FADT revision field" causes regression -for old P4 systems because now cst_control and other fields are -not reset to 0. - - The effect is that acpi_processor_power_init will notice -cst_control != 0 and a write to CST_CNT register is performed -that should not happen. As result, the system oopses after the -"No _CST, giving up" message, sometimes in acpi_ns_internalize_name, -sometimes in acpi_ns_get_type, usually at random places. May be -during migration to CPU 1 in acpi_processor_get_throttling. - - Every one of these settings help to avoid this problem: - - acpi=off - - processor.nocst=1 - - maxcpus=1 - - The fix is to update acpi_gbl_FADT.header.length after -the original value is used to check for old revisions. - -Signed-off-by: Julian Anastasov ---- - drivers/acpi/acpica/tbfadt.c | 8 ++++---- - 1 files changed, 4 insertions(+), 4 deletions(-) - -diff --git a/drivers/acpi/acpica/tbfadt.c b/drivers/acpi/acpica/tbfadt.c -index c5d8704..4c9c760 100644 ---- a/drivers/acpi/acpica/tbfadt.c -+++ b/drivers/acpi/acpica/tbfadt.c -@@ -363,10 +363,6 @@ static void acpi_tb_convert_fadt(void) - u32 address32; - u32 i; - -- /* Update the local FADT table header length */ -- -- acpi_gbl_FADT.header.length = sizeof(struct acpi_table_fadt); -- - /* - * Expand the 32-bit FACS and DSDT addresses to 64-bit as necessary. - * Later code will always use the X 64-bit field. Also, check for an -@@ -408,6 +404,10 @@ static void acpi_tb_convert_fadt(void) - acpi_gbl_FADT.boot_flags = 0; - } - -+ /* Update the local FADT table header length */ -+ -+ acpi_gbl_FADT.header.length = sizeof(struct acpi_table_fadt); -+ - /* - * Expand the ACPI 1.0 32-bit addresses to the ACPI 2.0 64-bit "X" - * generic address structures as necessary. Later code will always use --- -1.7.3.4 - --- -To unsubscribe from this list: send the line "unsubscribe linux-acpi" in -the body of a message to majordomo@vger.kernel.org -More majordomo info at http://vger.kernel.org/majordomo-info.html \ No newline at end of file diff --git a/acpi-ensure-thermal-limits-match-cpu-freq.patch b/acpi-ensure-thermal-limits-match-cpu-freq.patch deleted file mode 100644 index 9d97b60..0000000 --- a/acpi-ensure-thermal-limits-match-cpu-freq.patch +++ /dev/null @@ -1,146 +0,0 @@ -From 9a056a5843ff83db987d6e18625f4a2ee64b5450 Mon Sep 17 00:00:00 2001 -From: Matthew Garrett -Date: Tue, 30 Aug 2011 10:07:24 -0400 -Subject: [PATCH] ACPI: Ensure thermal limits match CPU frequencies - -The ACPI thermal management code supports slowing down a CPU when it's -overheating. Right now that's done by choosing to run it at 100%, 75%, 50% -or 25% of full speed. However, most CPUs do not allow an arbitrary -frequency to be set and so will run at the first frequency below that value. -This doesn't match the intent of the specification, which is to drop the -frequency state by state until the temperature stabalises. Fix this up -so it uses actual frequencies rather than percentages. - -Reported by: Gene Snider -Signed-off-by: Matthew Garrett ---- - drivers/acpi/Kconfig | 1 + - drivers/acpi/processor_thermal.c | 45 +++++++++++++++++++++---------------- - 2 files changed, 26 insertions(+), 20 deletions(-) - -diff --git a/drivers/acpi/Kconfig b/drivers/acpi/Kconfig -index de0e3df..7d1bdb5 100644 ---- a/drivers/acpi/Kconfig -+++ b/drivers/acpi/Kconfig -@@ -185,6 +185,7 @@ config ACPI_PROCESSOR - tristate "Processor" - select THERMAL - select CPU_IDLE -+ select CPU_FREQ_TABLE - default y - help - This driver installs ACPI as the idle handler for Linux and uses -diff --git a/drivers/acpi/processor_thermal.c b/drivers/acpi/processor_thermal.c -index 870550d..1c4eb60 100644 ---- a/drivers/acpi/processor_thermal.c -+++ b/drivers/acpi/processor_thermal.c -@@ -52,10 +52,8 @@ ACPI_MODULE_NAME("processor_thermal"); - * _any_ cpufreq driver and not only the acpi-cpufreq driver. - */ - --#define CPUFREQ_THERMAL_MIN_STEP 0 --#define CPUFREQ_THERMAL_MAX_STEP 3 - --static DEFINE_PER_CPU(unsigned int, cpufreq_thermal_reduction_pctg); -+static DEFINE_PER_CPU(unsigned int, cpufreq_thermal_limit_state); - static unsigned int acpi_thermal_cpufreq_is_init = 0; - - static int cpu_has_cpufreq(unsigned int cpu) -@@ -70,19 +68,19 @@ static int acpi_thermal_cpufreq_notifier(struct notifier_block *nb, - unsigned long event, void *data) - { - struct cpufreq_policy *policy = data; -- unsigned long max_freq = 0; -+ int state = per_cpu(cpufreq_thermal_limit_state, policy->cpu); -+ struct cpufreq_frequency_table *table; - - if (event != CPUFREQ_ADJUST) -- goto out; -+ return 0; -+ -+ table = cpufreq_frequency_get_table(policy->cpu); - -- max_freq = ( -- policy->cpuinfo.max_freq * -- (100 - per_cpu(cpufreq_thermal_reduction_pctg, policy->cpu) * 20) -- ) / 100; -+ if (!table) -+ return 0; - -- cpufreq_verify_within_limits(policy, 0, max_freq); -+ cpufreq_verify_within_limits(policy, 0, table[state].frequency); - -- out: - return 0; - } - -@@ -92,10 +90,21 @@ static struct notifier_block acpi_thermal_cpufreq_notifier_block = { - - static int cpufreq_get_max_state(unsigned int cpu) - { -+ int count = 0; -+ struct cpufreq_frequency_table *table; -+ - if (!cpu_has_cpufreq(cpu)) - return 0; - -- return CPUFREQ_THERMAL_MAX_STEP; -+ table = cpufreq_frequency_get_table(cpu); -+ -+ if (!table) -+ return 0; -+ -+ while (table[count].frequency != CPUFREQ_TABLE_END) -+ count++; -+ -+ return count; - } - - static int cpufreq_get_cur_state(unsigned int cpu) -@@ -103,7 +112,7 @@ static int cpufreq_get_cur_state(unsigned int cpu) - if (!cpu_has_cpufreq(cpu)) - return 0; - -- return per_cpu(cpufreq_thermal_reduction_pctg, cpu); -+ return per_cpu(cpufreq_thermal_limit_state, cpu); - } - - static int cpufreq_set_cur_state(unsigned int cpu, int state) -@@ -111,7 +120,7 @@ static int cpufreq_set_cur_state(unsigned int cpu, int state) - if (!cpu_has_cpufreq(cpu)) - return 0; - -- per_cpu(cpufreq_thermal_reduction_pctg, cpu) = state; -+ per_cpu(cpufreq_thermal_limit_state, cpu) = state; - cpufreq_update_policy(cpu); - return 0; - } -@@ -122,7 +131,7 @@ void acpi_thermal_cpufreq_init(void) - - for (i = 0; i < nr_cpu_ids; i++) - if (cpu_present(i)) -- per_cpu(cpufreq_thermal_reduction_pctg, i) = 0; -+ per_cpu(cpufreq_thermal_limit_state, i) = 0; - - i = cpufreq_register_notifier(&acpi_thermal_cpufreq_notifier_block, - CPUFREQ_POLICY_NOTIFIER); -@@ -170,15 +179,11 @@ int acpi_processor_get_limit_info(struct acpi_processor *pr) - return 0; - } - --/* thermal coolign device callbacks */ -+/* thermal cooling device callbacks */ - static int acpi_processor_max_state(struct acpi_processor *pr) - { - int max_state = 0; - -- /* -- * There exists four states according to -- * cpufreq_thermal_reduction_ptg. 0, 1, 2, 3 -- */ - max_state += cpufreq_get_max_state(pr->id); - if (pr->flags.throttling) - max_state += (pr->throttling.state_count -1); --- -1.7.6 - diff --git a/iwlegacy-do-not-nulify-il-vif-on-reset.patch b/iwlegacy-do-not-nulify-il-vif-on-reset.patch deleted file mode 100644 index d1913d7..0000000 --- a/iwlegacy-do-not-nulify-il-vif-on-reset.patch +++ /dev/null @@ -1,77 +0,0 @@ -This il->vif is dereferenced in different part of iwlegacy code, so do -not nullify it. This should fix random crashes observed in companion -with microcode errors i.e. crash in il3945_config_ap(). - -Additionally this should address also -WARNING: at drivers/net/wireless/iwlegacy/common.c:4656 il_mac_remove_interface -at least one of the possible reasons of that warning. - -Cc: stable@vger.kernel.org -Signed-off-by: Stanislaw Gruszka ---- - drivers/net/wireless/iwlegacy/3945-mac.c | 2 -- - drivers/net/wireless/iwlegacy/4965-mac.c | 2 -- - drivers/net/wireless/iwlegacy/common.c | 15 ++++++++++++--- - 3 files changed, 12 insertions(+), 7 deletions(-) - ---- linux-3.3.noarch.orig/drivers/net/wireless/iwlegacy/3945-mac.c -+++ linux-3.3.noarch/drivers/net/wireless/iwlegacy/3945-mac.c -@@ -2684,7 +2684,6 @@ il3945_bg_restart(struct work_struct *da - - if (test_and_clear_bit(S_FW_ERROR, &il->status)) { - mutex_lock(&il->mutex); -- il->ctx.vif = NULL; - il->is_open = 0; - mutex_unlock(&il->mutex); - il3945_down(il); ---- linux-3.3.noarch.orig/drivers/net/wireless/iwlegacy/4965-mac.c -+++ linux-3.3.noarch/drivers/net/wireless/iwlegacy/4965-mac.c -@@ -5381,7 +5381,6 @@ il4965_bg_restart(struct work_struct *da - - if (test_and_clear_bit(S_FW_ERROR, &il->status)) { - mutex_lock(&il->mutex); -- il->ctx.vif = NULL; - il->is_open = 0; - - __il4965_down(il); ---- linux-3.3.noarch.orig/drivers/net/wireless/iwlegacy/common.c -+++ linux-3.3.noarch/drivers/net/wireless/iwlegacy/common.c -@@ -4575,6 +4575,7 @@ il_mac_add_interface(struct ieee80211_hw - struct il_priv *il = hw->priv; - struct il_vif_priv *vif_priv = (void *)vif->drv_priv; - int err; -+ bool reset; - u32 modes; - - D_MAC80211("enter: type %d, addr %pM\n", vif->type, vif->addr); -@@ -4594,6 +4595,16 @@ il_mac_add_interface(struct ieee80211_hw - goto out; - } - -+ /* -+ * We do not support multiple virtual interfaces, but on hardware reset -+ * we have to add the same interface again. -+ */ -+ reset = (il->ctx.vif == vif); -+ if (il->ctx.vif && !reset) { -+ err = -EOPNOTSUPP; -+ goto out; -+ } -+ - modes = il->ctx.interface_modes | il->ctx.exclusive_interface_modes; - if (!(modes & BIT(vif->type))) { - err = -EOPNOTSUPP; -@@ -4605,8 +4616,11 @@ il_mac_add_interface(struct ieee80211_hw - - err = il_setup_interface(il, &il->ctx); - if (err) { -- il->ctx.vif = NULL; -- il->iw_mode = NL80211_IFTYPE_STATION; -+ IL_WARN("Fail to set mode %d\n", vif->type); -+ if (!reset) { -+ il->ctx.vif = NULL; -+ il->iw_mode = NL80211_IFTYPE_STATION; -+ } - } - - out: diff --git a/kernel.spec b/kernel.spec index 2aedc02..d0a6fd5 100644 --- a/kernel.spec +++ b/kernel.spec @@ -51,7 +51,7 @@ Summary: The Linux kernel %define fake_sublevel %(echo $((40 + %{real_sublevel}))) # Do we have a -stable update to apply? -%define stable_update 1 +%define stable_update 2 # Is it a -stable RC? %define stable_rc 0 # Set rpm version accordingly @@ -588,7 +588,6 @@ Patch383: linux-2.6-defaults-aspm.patch Patch390: linux-2.6-defaults-acpi-video.patch Patch391: linux-2.6-acpi-video-dos.patch Patch394: linux-2.6-acpi-debug-infinite-loop.patch -Patch395: acpi-ensure-thermal-limits-match-cpu-freq.patch Patch396: acpi-sony-nonvs-blacklist.patch Patch450: linux-2.6-input-kill-stupid-messages.patch @@ -678,25 +677,15 @@ Patch21232: rt2x00_fix_MCU_request_failures.patch #rhbz 789644 Patch21237: mcelog-rcu-splat.patch -#rhbz 727865 730007 -Patch21240: ACPICA-Fix-regression-in-FADT-revision-checks.patch - #rhbz 728478 Patch21242: sony-laptop-Enable-keyboard-backlight-by-default.patch Patch21300: unhandled-irqs-switch-to-polling.patch -#rhbz 804007 -Patch21305: mac80211-fix-possible-tid_rx-reorder_timer-use-after-free.patch - #rhbz 804957 CVE-2012-1568 Patch21306: shlib_base_randomize.patch -#rhbz 806433 -Patch21360: uvcvideo-Fix-race-induced-crash-in-uvc_video_clock_update.patch - #rhbz 770476 -Patch21370: iwlegacy-do-not-nulify-il-vif-on-reset.patch Patch21371: iwlwifi-do-not-nulify-ctx-vif-on-reset.patch #rhbz 808603 @@ -709,8 +698,6 @@ Patch21385: libata-disable-runtime-pm-for-hotpluggable-port.patch Patch21390: x86-Use-correct-byte-sized-register-constraint-in-__xchg_op.patch Patch21391: x86-Use-correct-byte-sized-register-constraint-in-__add.patch -Patch21501: nfs-Fix-length-of-buffer-copied-in-__nfs4_get_acl_uncached.patch - #rhbz 808207 CVE-2012-1601 Patch21520: KVM-Ensure-all-vcpus-are-consistent-with-in-kernel-i.patch @@ -1176,7 +1163,6 @@ ApplyPatch NFSv4-Further-reduce-the-footprint-of-the-idmapper.patch ApplyPatch linux-2.6-defaults-acpi-video.patch ApplyPatch linux-2.6-acpi-video-dos.patch ApplyPatch linux-2.6-acpi-debug-infinite-loop.patch -ApplyPatch acpi-ensure-thermal-limits-match-cpu-freq.patch ApplyPatch acpi-sony-nonvs-blacklist.patch # force UTSNAME to show version 2.6.4X @@ -1250,7 +1236,7 @@ ApplyPatch quite-apm.patch # Media (V4L/DVB/IR) updates/fixes/experimental drivers # apply if non-empty ApplyPatch add-poll-requested-events.patch -ApplyOptionalPatch drivers-media-update.patch +#ApplyOptionalPatch drivers-media-update.patch # Patches headed upstream @@ -1284,15 +1270,9 @@ ApplyPatch bcma-brcmsmac-compat.patch #rhbz 789644 ApplyPatch mcelog-rcu-splat.patch -#rhbz 727865 730007 -ApplyPatch ACPICA-Fix-regression-in-FADT-revision-checks.patch - #rhbz 728478 ApplyPatch sony-laptop-Enable-keyboard-backlight-by-default.patch -#rhbz 804007 -ApplyPatch mac80211-fix-possible-tid_rx-reorder_timer-use-after-free.patch - #rhbz 804957 CVE-2012-1568 ApplyPatch shlib_base_randomize.patch @@ -1300,18 +1280,12 @@ ApplyPatch unhandled-irqs-switch-to-polling.patch ApplyPatch weird-root-dentry-name-debug.patch -ApplyPatch nfs-Fix-length-of-buffer-copied-in-__nfs4_get_acl_uncached.patch - #rhbz 808207 CVE-2012-1601 ApplyPatch KVM-Ensure-all-vcpus-are-consistent-with-in-kernel-i.patch #rhbz 770476 -ApplyPatch iwlegacy-do-not-nulify-il-vif-on-reset.patch ApplyPatch iwlwifi-do-not-nulify-ctx-vif-on-reset.patch -#rhbz 806433 -ApplyPatch uvcvideo-Fix-race-induced-crash-in-uvc_video_clock_update.patch - #rhbz 808603 ApplyPatch wimax-i2400m-prevent-a-possible-kernel-bug-due-to-mi.patch @@ -1974,10 +1948,13 @@ fi # and build. %changelog +* Fri Apr 13 2012 Dave Jones 2.6.43.1-5 +- Linux 3.3.2 + * Thu Apr 12 2012 Dennis Gilmore - KALLSYMS_EXTRA_PASS=1 has to be passed in on the command line so do so only for arm -* Tue Apr 10 2012 Mauro Carvalho Chehab 3.3.1-5 +* Tue Apr 10 2012 Mauro Carvalho Chehab - Backport dvb-core and a few driver fixes from media tree (rhbz808871) * Tue Apr 10 2012 Josh Boyer diff --git a/mac80211-fix-possible-tid_rx-reorder_timer-use-after-free.patch b/mac80211-fix-possible-tid_rx-reorder_timer-use-after-free.patch deleted file mode 100644 index accda8a..0000000 --- a/mac80211-fix-possible-tid_rx-reorder_timer-use-after-free.patch +++ /dev/null @@ -1,42 +0,0 @@ -Is possible that we will arm the tid_rx->reorder_timer after -del_timer_sync() in ___ieee80211_stop_rx_ba_session(). We need to stop -timer after RCU grace period finish, so move it to -ieee80211_free_tid_rx(). Timer will not be armed again, as -rcu_dereference(sta->ampdu_mlme.tid_rx[tid]) will return NULL. - -Debug object detected problem with the following warning: -ODEBUG: free active (active state 0) object type: timer_list hint: sta_rx_agg_reorder_timer_expired+0x0/0xf0 [mac80211] - -Bug report (with all warning messages): -https://bugzilla.redhat.com/show_bug.cgi?id=804007 - -Reported-by: "jan p. springer" -Cc: stable@vger.kernel.org -Signed-off-by: Stanislaw Gruszka ---- - net/mac80211/agg-rx.c | 3 ++- - 1 files changed, 2 insertions(+), 1 deletions(-) - -diff --git a/net/mac80211/agg-rx.c b/net/mac80211/agg-rx.c -index 1068f66..64d3ce5 100644 ---- a/net/mac80211/agg-rx.c -+++ b/net/mac80211/agg-rx.c -@@ -49,6 +49,8 @@ static void ieee80211_free_tid_rx(struct rcu_head *h) - container_of(h, struct tid_ampdu_rx, rcu_head); - int i; - -+ del_timer_sync(&tid_rx->reorder_timer); -+ - for (i = 0; i < tid_rx->buf_size; i++) - dev_kfree_skb(tid_rx->reorder_buf[i]); - kfree(tid_rx->reorder_buf); -@@ -91,7 +93,6 @@ void ___ieee80211_stop_rx_ba_session(struct sta_info *sta, u16 tid, - tid, WLAN_BACK_RECIPIENT, reason); - - del_timer_sync(&tid_rx->session_timer); -- del_timer_sync(&tid_rx->reorder_timer); - - call_rcu(&tid_rx->rcu_head, ieee80211_free_tid_rx); - } --- -1.7.1 diff --git a/nfs-Fix-length-of-buffer-copied-in-__nfs4_get_acl_uncached.patch b/nfs-Fix-length-of-buffer-copied-in-__nfs4_get_acl_uncached.patch deleted file mode 100644 index 981f1f4..0000000 --- a/nfs-Fix-length-of-buffer-copied-in-__nfs4_get_acl_uncached.patch +++ /dev/null @@ -1,32 +0,0 @@ -From 20e0fa98b751facf9a1101edaefbc19c82616a68 Mon Sep 17 00:00:00 2001 -From: Sachin Prabhu -Date: Thu, 22 Mar 2012 16:46:28 +0000 -Subject: [PATCH] Fix length of buffer copied in __nfs4_get_acl_uncached - -_copy_from_pages() used to copy data from the temporary buffer to the -user passed buffer is passed the wrong size parameter when copying -data. res.acl_len contains both the bitmap and acl lenghts while -acl_len contains the acl length after adjusting for the bitmap size. - -Signed-off-by: Sachin Prabhu -Signed-off-by: Trond Myklebust ---- - fs/nfs/nfs4proc.c | 2 +- - 1 files changed, 1 insertions(+), 1 deletions(-) - -diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c -index e809d23..45df7d4 100644 ---- a/fs/nfs/nfs4proc.c -+++ b/fs/nfs/nfs4proc.c -@@ -3712,7 +3712,7 @@ static ssize_t __nfs4_get_acl_uncached(struct inode *inode, void *buf, size_t bu - if (acl_len > buflen) - goto out_free; - _copy_from_pages(buf, pages, res.acl_data_offset, -- res.acl_len); -+ acl_len); - } - ret = acl_len; - out_free: --- -1.7.7.6 - diff --git a/sources b/sources index e8c9e05..413d6dc 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ 7133f5a2086a7d7ef97abac610c094f5 linux-3.3.tar.xz -10771d657c5bf342bcfe66ed06653ecb patch-3.3.1.xz +68907107b0f62a19608588bdb6b29e20 patch-3.3.2.xz