.33 patches

9 files changed, 396 insertions, 0 deletions

diff --git a/queue-2.6.33/ath-add-missing-regdomain-pair-0x5c-mapping.patch b/queue-2.6.33/ath-add-missing-regdomain-pair-0x5c-mapping.patch
new file mode 100644
index 0000000..c817b3b
--- /dev/null
+++ b/queue-2.6.33/ath-add-missing-regdomain-pair-0x5c-mapping.patch
@@ -0,0 +1,41 @@
+From bd39a274fb7b43374c797bafdb7f506598f36f77 Mon Sep 17 00:00:00 2001
+From: Christian Lamparter <chunkeey@googlemail.com>
+Date: Wed, 6 Apr 2011 20:40:31 +0200
+Subject: ath: add missing regdomain pair 0x5c mapping
+
+From: Christian Lamparter <chunkeey@googlemail.com>
+
+commit bd39a274fb7b43374c797bafdb7f506598f36f77 upstream.
+
+Joe Culler reported a problem with his AR9170 device:
+
+> ath: EEPROM regdomain: 0x5c
+> ath: EEPROM indicates we should expect a direct regpair map
+> ath: invalid regulatory domain/country code 0x5c
+> ath: Invalid EEPROM contents
+
+It turned out that the regdomain 'APL7_FCCA' was not mapped yet.
+According to Luis R. Rodriguez [Atheros' engineer] APL7 maps to
+FCC_CTL and FCCA maps to FCC_CTL as well, so the attached patch
+should be correct.
+
+Reported-by: Joe Culler <joe.culler@gmail.com>
+Acked-by: Luis R. Rodriguez <lrodriguez@atheros.com>
+Signed-off-by: Christian Lamparter <chunkeey@googlemail.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/ath/regd_common.h |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/wireless/ath/regd_common.h
++++ b/drivers/net/wireless/ath/regd_common.h
+@@ -195,6 +195,7 @@ static struct reg_dmn_pair_mapping regDo
+ 	{APL9_WORLD, CTL_ETSI, CTL_ETSI},
+ 
+ 	{APL3_FCCA, CTL_FCC, CTL_FCC},
++	{APL7_FCCA, CTL_FCC, CTL_FCC},
+ 	{APL1_ETSIC, CTL_FCC, CTL_ETSI},
+ 	{APL2_ETSIC, CTL_FCC, CTL_ETSI},
+ 	{APL2_APLD, CTL_FCC, NO_CTL},
diff --git a/queue-2.6.33/block-blk-sysfs-fix-an-err-return-path-in-blk_register_queue.patch b/queue-2.6.33/block-blk-sysfs-fix-an-err-return-path-in-blk_register_queue.patch
new file mode 100644
index 0000000..83fbdf5
--- /dev/null
+++ b/queue-2.6.33/block-blk-sysfs-fix-an-err-return-path-in-blk_register_queue.patch
@@ -0,0 +1,34 @@
+From ed5302d3c25006a9edc7a7fbea97a30483f89ef7 Mon Sep 17 00:00:00 2001
+From: Liu Yuan <tailai.ly@taobao.com>
+Date: Tue, 19 Apr 2011 13:47:58 +0200
+Subject: block, blk-sysfs: Fix an err return path in blk_register_queue()
+
+From: Liu Yuan <tailai.ly@taobao.com>
+
+commit ed5302d3c25006a9edc7a7fbea97a30483f89ef7 upstream.
+
+We do not call blk_trace_remove_sysfs() in err return path
+if kobject_add() fails. This path fixes it.
+
+Signed-off-by: Liu Yuan <tailai.ly@taobao.com>
+Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ block/blk-sysfs.c |    4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/block/blk-sysfs.c
++++ b/block/blk-sysfs.c
+@@ -473,8 +473,10 @@ int blk_register_queue(struct gendisk *d
+ 		return ret;
+ 
+ 	ret = kobject_add(&q->kobj, kobject_get(&dev->kobj), "%s", "queue");
+-	if (ret < 0)
++	if (ret < 0) {
++		blk_trace_remove_sysfs(dev);
+ 		return ret;
++	}
+ 
+ 	kobject_uevent(&q->kobj, KOBJ_ADD);
+ 
diff --git a/queue-2.6.33/drm-radeon-kms-fix-bad-shift-in-atom-iio-table-parser.patch b/queue-2.6.33/drm-radeon-kms-fix-bad-shift-in-atom-iio-table-parser.patch
new file mode 100644
index 0000000..a1e2e13
--- /dev/null
+++ b/queue-2.6.33/drm-radeon-kms-fix-bad-shift-in-atom-iio-table-parser.patch
@@ -0,0 +1,48 @@
+From 8e461123f28e6b17456225e70eb834b3b30d28bb Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexdeucher@gmail.com>
+Date: Thu, 14 Apr 2011 11:19:50 -0400
+Subject: drm/radeon/kms: fix bad shift in atom iio table parser
+
+From: Alex Deucher <alexdeucher@gmail.com>
+
+commit 8e461123f28e6b17456225e70eb834b3b30d28bb upstream.
+
+Noticed by Patrick Lowry.
+
+Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/radeon/atom.c |    6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/gpu/drm/radeon/atom.c
++++ b/drivers/gpu/drm/radeon/atom.c
+@@ -128,7 +128,7 @@ static uint32_t atom_iio_execute(struct
+ 		case ATOM_IIO_MOVE_INDEX:
+ 			temp &=
+ 			    ~((0xFFFFFFFF >> (32 - CU8(base + 1))) <<
+-			      CU8(base + 2));
++			      CU8(base + 3));
+ 			temp |=
+ 			    ((index >> CU8(base + 2)) &
+ 			     (0xFFFFFFFF >> (32 - CU8(base + 1)))) << CU8(base +
+@@ -138,7 +138,7 @@ static uint32_t atom_iio_execute(struct
+ 		case ATOM_IIO_MOVE_DATA:
+ 			temp &=
+ 			    ~((0xFFFFFFFF >> (32 - CU8(base + 1))) <<
+-			      CU8(base + 2));
++			      CU8(base + 3));
+ 			temp |=
+ 			    ((data >> CU8(base + 2)) &
+ 			     (0xFFFFFFFF >> (32 - CU8(base + 1)))) << CU8(base +
+@@ -148,7 +148,7 @@ static uint32_t atom_iio_execute(struct
+ 		case ATOM_IIO_MOVE_ATTR:
+ 			temp &=
+ 			    ~((0xFFFFFFFF >> (32 - CU8(base + 1))) <<
+-			      CU8(base + 2));
++			      CU8(base + 3));
+ 			temp |=
+ 			    ((ctx->
+ 			      io_attr >> CU8(base + 2)) & (0xFFFFFFFF >> (32 -
diff --git a/queue-2.6.33/intel-iommu-fix-get_domain_for_dev-error-path.patch b/queue-2.6.33/intel-iommu-fix-get_domain_for_dev-error-path.patch
new file mode 100644
index 0000000..924c8bd
--- /dev/null
+++ b/queue-2.6.33/intel-iommu-fix-get_domain_for_dev-error-path.patch
@@ -0,0 +1,35 @@
+From 2fe9723df8e45fd247782adea244a5e653c30bf4 Mon Sep 17 00:00:00 2001
+From: Alex Williamson <alex.williamson@redhat.com>
+Date: Fri, 4 Mar 2011 14:52:30 -0700
+Subject: intel-iommu: Fix get_domain_for_dev() error path
+
+From: Alex Williamson <alex.williamson@redhat.com>
+
+commit 2fe9723df8e45fd247782adea244a5e653c30bf4 upstream.
+
+If we run out of domain_ids and fail iommu_attach_domain(), we
+fall into domain_exit() without having setup enough of the
+domain structure for this to do anything useful.  In fact, it
+typically runs off into the weeds walking the bogus domain->devices
+list.  Just free the domain.
+
+Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
+Acked-by: Donald Dutile <ddutile@redhat.com>
+Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/pci/intel-iommu.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/pci/intel-iommu.c
++++ b/drivers/pci/intel-iommu.c
+@@ -1852,7 +1852,7 @@ static struct dmar_domain *get_domain_fo
+ 
+ 	ret = iommu_attach_domain(domain, iommu);
+ 	if (ret) {
+-		domain_exit(domain);
++		free_domain_mem(domain);
+ 		goto error;
+ 	}
+ 
diff --git a/queue-2.6.33/intel-iommu-unlink-domain-from-iommu.patch b/queue-2.6.33/intel-iommu-unlink-domain-from-iommu.patch
new file mode 100644
index 0000000..5e4148c
--- /dev/null
+++ b/queue-2.6.33/intel-iommu-unlink-domain-from-iommu.patch
@@ -0,0 +1,55 @@
+From a97590e56d0d58e1dd262353f7cbd84e81d8e600 Mon Sep 17 00:00:00 2001
+From: Alex Williamson <alex.williamson@redhat.com>
+Date: Fri, 4 Mar 2011 14:52:16 -0700
+Subject: intel-iommu: Unlink domain from iommu
+
+From: Alex Williamson <alex.williamson@redhat.com>
+
+commit a97590e56d0d58e1dd262353f7cbd84e81d8e600 upstream.
+
+When we remove a device, we unlink the iommu from the domain, but
+we never do the reverse unlinking of the domain from the iommu.
+This means that we never clear iommu->domain_ids, eventually leading
+to resource exhaustion if we repeatedly bind and unbind a device
+to a driver.  Also free empty domains to avoid a resource leak.
+
+Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
+Acked-by: Donald Dutile <ddutile@redhat.com>
+Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/pci/intel-iommu.c |   13 ++++++++++++-
+ 1 file changed, 12 insertions(+), 1 deletion(-)
+
+--- a/drivers/pci/intel-iommu.c
++++ b/drivers/pci/intel-iommu.c
+@@ -3238,9 +3238,15 @@ static int device_notifier(struct notifi
+ 	if (!domain)
+ 		return 0;
+ 
+-	if (action == BUS_NOTIFY_UNBOUND_DRIVER && !iommu_pass_through)
++	if (action == BUS_NOTIFY_UNBOUND_DRIVER && !iommu_pass_through) {
+ 		domain_remove_one_dev_info(domain, pdev);
+ 
++		if (!(domain->flags & DOMAIN_FLAG_VIRTUAL_MACHINE) &&
++		    !(domain->flags & DOMAIN_FLAG_STATIC_IDENTITY) &&
++		    list_empty(&domain->devices))
++			domain_exit(domain);
++	}
++
+ 	return 0;
+ }
+ 
+@@ -3389,6 +3395,11 @@ static void domain_remove_one_dev_info(s
+ 		domain->iommu_count--;
+ 		domain_update_iommu_cap(domain);
+ 		spin_unlock_irqrestore(&domain->iommu_lock, tmp_flags);
++
++		spin_lock_irqsave(&iommu->lock, tmp_flags);
++		clear_bit(domain->id, iommu->domain_ids);
++		iommu->domains[domain->id] = NULL;
++		spin_unlock_irqrestore(&iommu->lock, tmp_flags);
+ 	}
+ 
+ 	spin_unlock_irqrestore(&device_domain_lock, flags);
diff --git a/queue-2.6.33/nfs-nfs_wcc_update_inode-should-set-nfsi-attr_gencount.patch b/queue-2.6.33/nfs-nfs_wcc_update_inode-should-set-nfsi-attr_gencount.patch
new file mode 100644
index 0000000..1fba47f
--- /dev/null
+++ b/queue-2.6.33/nfs-nfs_wcc_update_inode-should-set-nfsi-attr_gencount.patch
@@ -0,0 +1,83 @@
+From 27dc1cd3ad9300f81e1219e5fc305d91d85353f8 Mon Sep 17 00:00:00 2001
+From: Trond Myklebust <Trond.Myklebust@netapp.com>
+Date: Tue, 25 Jan 2011 15:28:21 -0500
+Subject: NFS: nfs_wcc_update_inode() should set nfsi->attr_gencount
+
+From: Trond Myklebust <Trond.Myklebust@netapp.com>
+
+commit 27dc1cd3ad9300f81e1219e5fc305d91d85353f8 upstream.
+
+If the call to nfs_wcc_update_inode() results in an attribute update, we
+need to ensure that the inode's attr_gencount gets bumped too, otherwise
+we are not protected against races with other GETATTR calls.
+
+Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/nfs/inode.c |   26 +++++++++++++++++---------
+ 1 file changed, 17 insertions(+), 9 deletions(-)
+
+--- a/fs/nfs/inode.c
++++ b/fs/nfs/inode.c
+@@ -861,9 +861,10 @@ out:
+ 	return ret;
+ }
+ 
+-static void nfs_wcc_update_inode(struct inode *inode, struct nfs_fattr *fattr)
++static unsigned long nfs_wcc_update_inode(struct inode *inode, struct nfs_fattr *fattr)
+ {
+ 	struct nfs_inode *nfsi = NFS_I(inode);
++	unsigned long ret = 0;
+ 
+ 	if ((fattr->valid & NFS_ATTR_FATTR_PRECHANGE)
+ 			&& (fattr->valid & NFS_ATTR_FATTR_CHANGE)
+@@ -871,25 +872,32 @@ static void nfs_wcc_update_inode(struct
+ 		nfsi->change_attr = fattr->change_attr;
+ 		if (S_ISDIR(inode->i_mode))
+ 			nfsi->cache_validity |= NFS_INO_INVALID_DATA;
++		ret |= NFS_INO_INVALID_ATTR;
+ 	}
+ 	/* If we have atomic WCC data, we may update some attributes */
+ 	if ((fattr->valid & NFS_ATTR_FATTR_PRECTIME)
+ 			&& (fattr->valid & NFS_ATTR_FATTR_CTIME)
+-			&& timespec_equal(&inode->i_ctime, &fattr->pre_ctime))
+-			memcpy(&inode->i_ctime, &fattr->ctime, sizeof(inode->i_ctime));
++			&& timespec_equal(&inode->i_ctime, &fattr->pre_ctime)) {
++		memcpy(&inode->i_ctime, &fattr->ctime, sizeof(inode->i_ctime));
++		ret |= NFS_INO_INVALID_ATTR;
++	}
+ 
+ 	if ((fattr->valid & NFS_ATTR_FATTR_PREMTIME)
+ 			&& (fattr->valid & NFS_ATTR_FATTR_MTIME)
+ 			&& timespec_equal(&inode->i_mtime, &fattr->pre_mtime)) {
+-			memcpy(&inode->i_mtime, &fattr->mtime, sizeof(inode->i_mtime));
+-			if (S_ISDIR(inode->i_mode))
+-				nfsi->cache_validity |= NFS_INO_INVALID_DATA;
++		memcpy(&inode->i_mtime, &fattr->mtime, sizeof(inode->i_mtime));
++		if (S_ISDIR(inode->i_mode))
++			nfsi->cache_validity |= NFS_INO_INVALID_DATA;
++		ret |= NFS_INO_INVALID_ATTR;
+ 	}
+ 	if ((fattr->valid & NFS_ATTR_FATTR_PRESIZE)
+ 			&& (fattr->valid & NFS_ATTR_FATTR_SIZE)
+ 			&& i_size_read(inode) == nfs_size_to_loff_t(fattr->pre_size)
+-			&& nfsi->npages == 0)
+-			i_size_write(inode, nfs_size_to_loff_t(fattr->size));
++			&& nfsi->npages == 0) {
++		i_size_write(inode, nfs_size_to_loff_t(fattr->size));
++		ret |= NFS_INO_INVALID_ATTR;
++	}
++	return ret;
+ }
+ 
+ /**
+@@ -1183,7 +1191,7 @@ static int nfs_update_inode(struct inode
+ 			| NFS_INO_REVAL_PAGECACHE);
+ 
+ 	/* Do atomic weak cache consistency updates */
+-	nfs_wcc_update_inode(inode, fattr);
++	invalid |= nfs_wcc_update_inode(inode, fattr);
+ 
+ 	/* More cache consistency checks */
+ 	if (fattr->valid & NFS_ATTR_FATTR_CHANGE) {
diff --git a/queue-2.6.33/p54-initialize-extra_len-in-p54_tx_80211.patch b/queue-2.6.33/p54-initialize-extra_len-in-p54_tx_80211.patch
new file mode 100644
index 0000000..ec147a1
--- /dev/null
+++ b/queue-2.6.33/p54-initialize-extra_len-in-p54_tx_80211.patch
@@ -0,0 +1,43 @@
+From a6756da9eace8b4af73e9dea43f1fc2889224c94 Mon Sep 17 00:00:00 2001
+From: Jason Conti <jason.conti@gmail.com>
+Date: Thu, 7 Apr 2011 21:09:57 +0200
+Subject: p54: Initialize extra_len in p54_tx_80211
+
+From: Jason Conti <jason.conti@gmail.com>
+
+commit a6756da9eace8b4af73e9dea43f1fc2889224c94 upstream.
+
+This patch fixes a very serious off-by-one bug in
+the driver, which could leave the device in an
+unresponsive state.
+
+The problem was that the extra_len variable [used to
+reserve extra scratch buffer space for the firmware]
+was left uninitialized. Because p54_assign_address
+later needs the value to reserve additional space,
+the resulting frame could be to big for the small
+device's memory window and everything would
+immediately come to a grinding halt.
+
+Reference: https://bugs.launchpad.net/bugs/722185
+
+Acked-by: Christian Lamparter <chunkeey@googlemail.com>
+Signed-off-by: Jason Conti <jason.conti@gmail.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/p54/txrx.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/p54/txrx.c
++++ b/drivers/net/wireless/p54/txrx.c
+@@ -703,7 +703,7 @@ int p54_tx_80211(struct ieee80211_hw *de
+ 	struct p54_tx_info *p54info;
+ 	struct p54_hdr *hdr;
+ 	struct p54_tx_data *txhdr;
+-	unsigned int padding, len, extra_len;
++	unsigned int padding, len, extra_len = 0;
+ 	int i, j, ridx;
+ 	u16 hdr_flags = 0, aid = 0;
+ 	u8 rate, queue = 0, crypt_offset = 0;
diff --git a/queue-2.6.33/series b/queue-2.6.33/series
new file mode 100644
index 0000000..8b3fafa
--- /dev/null
+++ b/queue-2.6.33/series
@@ -0,0 +1,8 @@
+ath-add-missing-regdomain-pair-0x5c-mapping.patch
+block-blk-sysfs-fix-an-err-return-path-in-blk_register_queue.patch
+p54-initialize-extra_len-in-p54_tx_80211.patch
+x86-gart-make-sure-gart-does-not-map-physmem-above-1tb.patch
+intel-iommu-unlink-domain-from-iommu.patch
+intel-iommu-fix-get_domain_for_dev-error-path.patch
+drm-radeon-kms-fix-bad-shift-in-atom-iio-table-parser.patch
+nfs-nfs_wcc_update_inode-should-set-nfsi-attr_gencount.patch
diff --git a/queue-2.6.33/x86-gart-make-sure-gart-does-not-map-physmem-above-1tb.patch b/queue-2.6.33/x86-gart-make-sure-gart-does-not-map-physmem-above-1tb.patch
new file mode 100644
index 0000000..1fe5f87
--- /dev/null
+++ b/queue-2.6.33/x86-gart-make-sure-gart-does-not-map-physmem-above-1tb.patch
@@ -0,0 +1,49 @@
+From 665d3e2af83c8fbd149534db8f57d82fa6fa6753 Mon Sep 17 00:00:00 2001
+From: Joerg Roedel <joerg.roedel@amd.com>
+Date: Mon, 18 Apr 2011 15:45:46 +0200
+Subject: x86, gart: Make sure GART does not map physmem above 1TB
+
+From: Joerg Roedel <joerg.roedel@amd.com>
+
+commit 665d3e2af83c8fbd149534db8f57d82fa6fa6753 upstream.
+
+The GART can only map physical memory below 1TB. Make sure
+the gart driver in the kernel does not try to map memory
+above 1TB.
+
+Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
+Link: http://lkml.kernel.org/r/1303134346-5805-5-git-send-email-joerg.roedel@amd.com
+Signed-off-by: H. Peter Anvin <hpa@zytor.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/pci-gart_64.c |    9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+--- a/arch/x86/kernel/pci-gart_64.c
++++ b/arch/x86/kernel/pci-gart_64.c
+@@ -79,6 +79,9 @@ static u32 gart_unmapped_entry;
+ #define AGPEXTERN
+ #endif
+ 
++/* GART can only remap to physical addresses < 1TB */
++#define GART_MAX_PHYS_ADDR	(1ULL << 40)
++
+ /* backdoor interface to AGP driver */
+ AGPEXTERN int agp_memory_reserved;
+ AGPEXTERN __u32 *agp_gatt_table;
+@@ -210,9 +213,13 @@ static dma_addr_t dma_map_area(struct de
+ 				size_t size, int dir, unsigned long align_mask)
+ {
+ 	unsigned long npages = iommu_num_pages(phys_mem, size, PAGE_SIZE);
+-	unsigned long iommu_page = alloc_iommu(dev, npages, align_mask);
++	unsigned long iommu_page;
+ 	int i;
+ 
++	if (unlikely(phys_mem + size > GART_MAX_PHYS_ADDR))
++		return bad_dma_addr;
++
++	iommu_page = alloc_iommu(dev, npages, align_mask);
+ 	if (iommu_page == -1) {
+ 		if (!nonforced_iommu(dev, phys_mem, size))
+ 			return phys_mem;