summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorGreg Kroah-Hartman <gregkh@suse.de>2011-03-21 14:56:12 -0700
committerGreg Kroah-Hartman <gregkh@suse.de>2011-03-21 14:56:12 -0700
commit7a64611185420e25245ed2e55a44476558b3f475 (patch)
tree31e8df82caee4009dd66053eca6947394ac5746c
parentd04779316610a5ff04e6ebe24eeb0821a4975813 (diff)
downloadlongterm-queue-2.6.33-7a64611185420e25245ed2e55a44476558b3f475.tar.gz
.33 patches
-rw-r--r--queue-2.6.33/fix-per-cpu-flag-problem-in-the-cpu-affinity-checkers.patch31
-rw-r--r--queue-2.6.33/hwmon-sht15-fix-integer-overflow-in-humidity-calculation.patch38
-rw-r--r--queue-2.6.33/i2c-fix-typo-in-instantiating-devices-document.patch31
-rw-r--r--queue-2.6.33/mmc-sdio-remember-new-card-rca-when-redetecting-card.patch43
-rw-r--r--queue-2.6.33/powerpc-kdump-fix-race-in-kdump-shutdown.patch79
-rw-r--r--queue-2.6.33/powerpc-rtas_flash-needs-to-use-rtas_data_buf.patch143
-rw-r--r--queue-2.6.33/series8
-rw-r--r--queue-2.6.33/smp_call_function_many-handle-concurrent-clearing-of-mask.patch82
-rw-r--r--queue-2.6.33/x86-binutils-xen-fix-another-wrong-size-directive.patch75
9 files changed, 530 insertions, 0 deletions
diff --git a/queue-2.6.33/fix-per-cpu-flag-problem-in-the-cpu-affinity-checkers.patch b/queue-2.6.33/fix-per-cpu-flag-problem-in-the-cpu-affinity-checkers.patch
new file mode 100644
index 0000000..a7dd4e3
--- /dev/null
+++ b/queue-2.6.33/fix-per-cpu-flag-problem-in-the-cpu-affinity-checkers.patch
@@ -0,0 +1,31 @@
+From 9804c9eaeacfe78651052c5ddff31099f60ef78c Mon Sep 17 00:00:00 2001
+From: Thomas Gleixner <tglx@linutronix.de>
+Date: Mon, 7 Feb 2011 19:28:01 +0100
+Subject: [PARISC] fix per-cpu flag problem in the cpu affinity checkers
+
+From: Thomas Gleixner <tglx@linutronix.de>
+
+commit 9804c9eaeacfe78651052c5ddff31099f60ef78c upstream.
+
+The CHECK_IRQ_PER_CPU is wrong, it should be checking
+irq_to_desc(irq)->status not just irq.
+
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: James Bottomley <James.Bottomley@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/parisc/kernel/irq.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/parisc/kernel/irq.c
++++ b/arch/parisc/kernel/irq.c
+@@ -117,7 +117,7 @@ int cpu_check_affinity(unsigned int irq,
+ int cpu_dest;
+
+ /* timer and ipi have to always be received on all CPUs */
+- if (CHECK_IRQ_PER_CPU(irq)) {
++ if (CHECK_IRQ_PER_CPU(irq_to_desc(irq)->status)) {
+ /* Bad linux design decision. The mask has already
+ * been set; we must reset it */
+ cpumask_setall(irq_desc[irq].affinity);
diff --git a/queue-2.6.33/hwmon-sht15-fix-integer-overflow-in-humidity-calculation.patch b/queue-2.6.33/hwmon-sht15-fix-integer-overflow-in-humidity-calculation.patch
new file mode 100644
index 0000000..18257a9
--- /dev/null
+++ b/queue-2.6.33/hwmon-sht15-fix-integer-overflow-in-humidity-calculation.patch
@@ -0,0 +1,38 @@
+From ccd32e735de7a941906e093f8dca924bb05c5794 Mon Sep 17 00:00:00 2001
+From: Vivien Didelot <vivien.didelot@savoirfairelinux.com>
+Date: Mon, 21 Mar 2011 17:59:35 +0100
+Subject: hwmon: (sht15) Fix integer overflow in humidity calculation
+
+From: Vivien Didelot <vivien.didelot@savoirfairelinux.com>
+
+commit ccd32e735de7a941906e093f8dca924bb05c5794 upstream.
+
+An integer overflow occurs in the calculation of RHlinear when the
+relative humidity is greater than around 30%. The consequence is a subtle
+(but noticeable) error in the resulting humidity measurement.
+
+Signed-off-by: Vivien Didelot <vivien.didelot@savoirfairelinux.com>
+Signed-off-by: Jean Delvare <khali@linux-fr.org>
+Cc: Jonathan Cameron <jic23@cam.ac.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/hwmon/sht15.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/hwmon/sht15.c
++++ b/drivers/hwmon/sht15.c
+@@ -332,11 +332,11 @@ static inline int sht15_calc_humid(struc
+
+ const int c1 = -4;
+ const int c2 = 40500; /* x 10 ^ -6 */
+- const int c3 = -2800; /* x10 ^ -9 */
++ const int c3 = -28; /* x 10 ^ -7 */
+
+ RHlinear = c1*1000
+ + c2 * data->val_humid/1000
+- + (data->val_humid * data->val_humid * c3)/1000000;
++ + (data->val_humid * data->val_humid * c3) / 10000;
+ return (temp - 25000) * (10000 + 80 * data->val_humid)
+ / 1000000 + RHlinear;
+ }
diff --git a/queue-2.6.33/i2c-fix-typo-in-instantiating-devices-document.patch b/queue-2.6.33/i2c-fix-typo-in-instantiating-devices-document.patch
new file mode 100644
index 0000000..aae5535
--- /dev/null
+++ b/queue-2.6.33/i2c-fix-typo-in-instantiating-devices-document.patch
@@ -0,0 +1,31 @@
+From 6ced9e6b3901af4ab6ac0a11231402c888286ea6 Mon Sep 17 00:00:00 2001
+From: Roman Fietze <roman.fietze@telemotive.de>
+Date: Sun, 20 Mar 2011 14:50:52 +0100
+Subject: i2c: Fix typo in instantiating-devices document
+
+From: Roman Fietze <roman.fietze@telemotive.de>
+
+commit 6ced9e6b3901af4ab6ac0a11231402c888286ea6 upstream.
+
+The struct i2c_board_info member holding the name is "type", not
+"name".
+
+Signed-off-by: Roman Fietze <roman.fietze@telemotive.de>
+Signed-off-by: Jean Delvare <khali@linux-fr.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ Documentation/i2c/instantiating-devices | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/Documentation/i2c/instantiating-devices
++++ b/Documentation/i2c/instantiating-devices
+@@ -100,7 +100,7 @@ static int __devinit usb_hcd_pnx4008_pro
+ (...)
+ i2c_adap = i2c_get_adapter(2);
+ memset(&i2c_info, 0, sizeof(struct i2c_board_info));
+- strlcpy(i2c_info.name, "isp1301_pnx", I2C_NAME_SIZE);
++ strlcpy(i2c_info.type, "isp1301_pnx", I2C_NAME_SIZE);
+ isp1301_i2c_client = i2c_new_probed_device(i2c_adap, &i2c_info,
+ normal_i2c);
+ i2c_put_adapter(i2c_adap);
diff --git a/queue-2.6.33/mmc-sdio-remember-new-card-rca-when-redetecting-card.patch b/queue-2.6.33/mmc-sdio-remember-new-card-rca-when-redetecting-card.patch
new file mode 100644
index 0000000..32a0da6
--- /dev/null
+++ b/queue-2.6.33/mmc-sdio-remember-new-card-rca-when-redetecting-card.patch
@@ -0,0 +1,43 @@
+From 0aab3995485b8a994bf29a995a008c9ea4a28054 Mon Sep 17 00:00:00 2001
+From: Stefan Nilsson XK <stefan.xk.nilsson@stericsson.com>
+Date: Tue, 1 Mar 2011 14:41:04 +0100
+Subject: mmc: sdio: remember new card RCA when redetecting card
+
+From: Stefan Nilsson XK <stefan.xk.nilsson@stericsson.com>
+
+commit 0aab3995485b8a994bf29a995a008c9ea4a28054 upstream.
+
+During redetection of a SDIO card, a request for a new card RCA
+was submitted to the card, but was then overwritten by the old RCA.
+This caused the card to be deselected instead of selected when using
+the incorrect RCA. This bug's been present since the "oldcard"
+handling was introduced in 2.6.32.
+
+Signed-off-by: Stefan Nilsson XK <stefan.xk.nilsson@stericsson.com>
+Reviewed-by: Ulf Hansson <ulf.hansson@stericsson.com>
+Reviewed-by: Pawel Wieczorkiewicz <pawel.wieczorkiewicz@stericsson.com>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Chris Ball <cjb@laptop.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/mmc/core/sdio.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/drivers/mmc/core/sdio.c
++++ b/drivers/mmc/core/sdio.c
+@@ -267,6 +267,14 @@ static int mmc_sdio_init_card(struct mmc
+ if (err)
+ goto remove;
+
++ /*
++ * Update oldcard with the new RCA received from the SDIO
++ * device -- we're doing this so that it's updated in the
++ * "card" struct when oldcard overwrites that later.
++ */
++ if (oldcard)
++ oldcard->rca = card->rca;
++
+ mmc_set_bus_mode(host, MMC_BUSMODE_PUSHPULL);
+ }
+
diff --git a/queue-2.6.33/powerpc-kdump-fix-race-in-kdump-shutdown.patch b/queue-2.6.33/powerpc-kdump-fix-race-in-kdump-shutdown.patch
new file mode 100644
index 0000000..8749952
--- /dev/null
+++ b/queue-2.6.33/powerpc-kdump-fix-race-in-kdump-shutdown.patch
@@ -0,0 +1,79 @@
+From 60adec6226bbcf061d4c2d10944fced209d1847d Mon Sep 17 00:00:00 2001
+From: Michael Neuling <mikey@neuling.org>
+Date: Thu, 13 May 2010 19:40:11 +0000
+Subject: powerpc/kdump: Fix race in kdump shutdown
+
+From: Michael Neuling <mikey@neuling.org>
+
+commit 60adec6226bbcf061d4c2d10944fced209d1847d upstream.
+
+When we are crashing, the crashing/primary CPU IPIs the secondaries to
+turn off IRQs, go into real mode and wait in kexec_wait. While this
+is happening, the primary tears down all the MMU maps. Unfortunately
+the primary doesn't check to make sure the secondaries have entered
+real mode before doing this.
+
+On PHYP machines, the secondaries can take a long time shutting down
+the IRQ controller as RTAS calls are need. These RTAS calls need to
+be serialised which resilts in the secondaries contending in
+lock_rtas() and hence taking a long time to shut down.
+
+We've hit this on large POWER7 machines, where some secondaries are
+still waiting in lock_rtas(), when the primary tears down the HPTEs.
+
+This patch makes sure all secondaries are in real mode before the
+primary tears down the MMU. It uses the new kexec_state entry in the
+paca. It times out if the secondaries don't reach real mode after
+10sec.
+
+Signed-off-by: Michael Neuling <mikey@neuling.org>
+Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/powerpc/kernel/crash.c | 27 +++++++++++++++++++++++++++
+ 1 file changed, 27 insertions(+)
+
+--- a/arch/powerpc/kernel/crash.c
++++ b/arch/powerpc/kernel/crash.c
+@@ -162,6 +162,32 @@ static void crash_kexec_prepare_cpus(int
+ /* Leave the IPI callback set */
+ }
+
++/* wait for all the CPUs to hit real mode but timeout if they don't come in */
++static void crash_kexec_wait_realmode(int cpu)
++{
++ unsigned int msecs;
++ int i;
++
++ msecs = 10000;
++ for (i=0; i < NR_CPUS && msecs > 0; i++) {
++ if (i == cpu)
++ continue;
++
++ while (paca[i].kexec_state < KEXEC_STATE_REAL_MODE) {
++ barrier();
++ if (!cpu_possible(i)) {
++ break;
++ }
++ if (!cpu_online(i)) {
++ break;
++ }
++ msecs--;
++ mdelay(1);
++ }
++ }
++ mb();
++}
++
+ /*
+ * This function will be called by secondary cpus or by kexec cpu
+ * if soft-reset is activated to stop some CPUs.
+@@ -419,6 +445,7 @@ void default_machine_crash_shutdown(stru
+ crash_kexec_prepare_cpus(crashing_cpu);
+ cpu_set(crashing_cpu, cpus_in_crash);
+ crash_kexec_stop_spus();
++ crash_kexec_wait_realmode(crashing_cpu);
+ if (ppc_md.kexec_cpu_down)
+ ppc_md.kexec_cpu_down(1, 0);
+ }
diff --git a/queue-2.6.33/powerpc-rtas_flash-needs-to-use-rtas_data_buf.patch b/queue-2.6.33/powerpc-rtas_flash-needs-to-use-rtas_data_buf.patch
new file mode 100644
index 0000000..a0be1f4
--- /dev/null
+++ b/queue-2.6.33/powerpc-rtas_flash-needs-to-use-rtas_data_buf.patch
@@ -0,0 +1,143 @@
+From bd2b64a12bf55bec0d1b949e3dca3f8863409646 Mon Sep 17 00:00:00 2001
+From: Milton Miller <miltonm@us.ibm.com>
+Date: Sat, 12 Jun 2010 03:48:47 +0000
+Subject: powerpc: rtas_flash needs to use rtas_data_buf
+
+From: Milton Miller <miltonm@us.ibm.com>
+
+commit bd2b64a12bf55bec0d1b949e3dca3f8863409646 upstream.
+
+When trying to flash a machine via the update_flash command, Anton received the
+following error:
+
+ Restarting system.
+ FLASH: kernel bug...flash list header addr above 4GB
+
+The code in question has a comment that the flash list should be in
+the kernel data and therefore under 4GB:
+
+ /* NOTE: the "first" block list is a global var with no data
+ * blocks in the kernel data segment. We do this because
+ * we want to ensure this block_list addr is under 4GB.
+ */
+
+Unfortunately the Kconfig option is marked tristate which means the variable
+may not be in the kernel data and could be above 4GB.
+
+Instead of relying on the data segment being below 4GB, use the static
+data buffer allocated by the kernel for use by rtas. Since we don't
+use the header struct directly anymore, convert it to a simple pointer.
+
+Reported-By: Anton Blanchard <anton@samba.org>
+Signed-Off-By: Milton Miller <miltonm@bga.com
+Tested-By: Anton Blanchard <anton@samba.org>
+Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/powerpc/kernel/rtas_flash.c | 39 +++++++++++++++++++++------------------
+ 1 file changed, 21 insertions(+), 18 deletions(-)
+
+--- a/arch/powerpc/kernel/rtas_flash.c
++++ b/arch/powerpc/kernel/rtas_flash.c
+@@ -93,12 +93,8 @@ struct flash_block_list {
+ struct flash_block_list *next;
+ struct flash_block blocks[FLASH_BLOCKS_PER_NODE];
+ };
+-struct flash_block_list_header { /* just the header of flash_block_list */
+- unsigned long num_blocks;
+- struct flash_block_list *next;
+-};
+
+-static struct flash_block_list_header rtas_firmware_flash_list = {0, NULL};
++static struct flash_block_list *rtas_firmware_flash_list;
+
+ /* Use slab cache to guarantee 4k alignment */
+ static struct kmem_cache *flash_block_cache = NULL;
+@@ -107,13 +103,14 @@ static struct kmem_cache *flash_block_ca
+
+ /* Local copy of the flash block list.
+ * We only allow one open of the flash proc file and create this
+- * list as we go. This list will be put in the
+- * rtas_firmware_flash_list var once it is fully read.
++ * list as we go. The rtas_firmware_flash_list varable will be
++ * set once the data is fully read.
+ *
+ * For convenience as we build the list we use virtual addrs,
+ * we do not fill in the version number, and the length field
+ * is treated as the number of entries currently in the block
+- * (i.e. not a byte count). This is all fixed on release.
++ * (i.e. not a byte count). This is all fixed when calling
++ * the flash routine.
+ */
+
+ /* Status int must be first member of struct */
+@@ -200,16 +197,16 @@ static int rtas_flash_release(struct ino
+ if (uf->flist) {
+ /* File was opened in write mode for a new flash attempt */
+ /* Clear saved list */
+- if (rtas_firmware_flash_list.next) {
+- free_flash_list(rtas_firmware_flash_list.next);
+- rtas_firmware_flash_list.next = NULL;
++ if (rtas_firmware_flash_list) {
++ free_flash_list(rtas_firmware_flash_list);
++ rtas_firmware_flash_list = NULL;
+ }
+
+ if (uf->status != FLASH_AUTH)
+ uf->status = flash_list_valid(uf->flist);
+
+ if (uf->status == FLASH_IMG_READY)
+- rtas_firmware_flash_list.next = uf->flist;
++ rtas_firmware_flash_list = uf->flist;
+ else
+ free_flash_list(uf->flist);
+
+@@ -592,7 +589,7 @@ static void rtas_flash_firmware(int rebo
+ unsigned long rtas_block_list;
+ int i, status, update_token;
+
+- if (rtas_firmware_flash_list.next == NULL)
++ if (rtas_firmware_flash_list == NULL)
+ return; /* nothing to do */
+
+ if (reboot_type != SYS_RESTART) {
+@@ -609,20 +606,25 @@ static void rtas_flash_firmware(int rebo
+ return;
+ }
+
+- /* NOTE: the "first" block list is a global var with no data
+- * blocks in the kernel data segment. We do this because
+- * we want to ensure this block_list addr is under 4GB.
++ /*
++ * NOTE: the "first" block must be under 4GB, so we create
++ * an entry with no data blocks in the reserved buffer in
++ * the kernel data segment.
+ */
+- rtas_firmware_flash_list.num_blocks = 0;
+- flist = (struct flash_block_list *)&rtas_firmware_flash_list;
++ spin_lock(&rtas_data_buf_lock);
++ flist = (struct flash_block_list *)&rtas_data_buf[0];
++ flist->num_blocks = 0;
++ flist->next = rtas_firmware_flash_list;
+ rtas_block_list = virt_to_abs(flist);
+ if (rtas_block_list >= 4UL*1024*1024*1024) {
+ printk(KERN_ALERT "FLASH: kernel bug...flash list header addr above 4GB\n");
++ spin_unlock(&rtas_data_buf_lock);
+ return;
+ }
+
+ printk(KERN_ALERT "FLASH: preparing saved firmware image for flash\n");
+ /* Update the block_list in place. */
++ rtas_firmware_flash_list = NULL; /* too hard to backout on error */
+ image_size = 0;
+ for (f = flist; f; f = next) {
+ /* Translate data addrs to absolute */
+@@ -663,6 +665,7 @@ static void rtas_flash_firmware(int rebo
+ printk(KERN_ALERT "FLASH: unknown flash return code %d\n", status);
+ break;
+ }
++ spin_unlock(&rtas_data_buf_lock);
+ }
+
+ static void remove_flash_pde(struct proc_dir_entry *dp)
diff --git a/queue-2.6.33/series b/queue-2.6.33/series
new file mode 100644
index 0000000..33f55ad
--- /dev/null
+++ b/queue-2.6.33/series
@@ -0,0 +1,8 @@
+smp_call_function_many-handle-concurrent-clearing-of-mask.patch
+fix-per-cpu-flag-problem-in-the-cpu-affinity-checkers.patch
+i2c-fix-typo-in-instantiating-devices-document.patch
+mmc-sdio-remember-new-card-rca-when-redetecting-card.patch
+powerpc-kdump-fix-race-in-kdump-shutdown.patch
+powerpc-rtas_flash-needs-to-use-rtas_data_buf.patch
+x86-binutils-xen-fix-another-wrong-size-directive.patch
+hwmon-sht15-fix-integer-overflow-in-humidity-calculation.patch
diff --git a/queue-2.6.33/smp_call_function_many-handle-concurrent-clearing-of-mask.patch b/queue-2.6.33/smp_call_function_many-handle-concurrent-clearing-of-mask.patch
new file mode 100644
index 0000000..0d8506f
--- /dev/null
+++ b/queue-2.6.33/smp_call_function_many-handle-concurrent-clearing-of-mask.patch
@@ -0,0 +1,82 @@
+From 723aae25d5cdb09962901d36d526b44d4be1051c Mon Sep 17 00:00:00 2001
+From: Milton Miller <miltonm@bga.com>
+Date: Tue, 15 Mar 2011 13:27:17 -0600
+Subject: smp_call_function_many: handle concurrent clearing of mask
+
+From: Milton Miller <miltonm@bga.com>
+
+commit 723aae25d5cdb09962901d36d526b44d4be1051c upstream.
+
+Mike Galbraith reported finding a lockup ("perma-spin bug") where the
+cpumask passed to smp_call_function_many was cleared by other cpu(s)
+while a cpu was preparing its call_data block, resulting in no cpu to
+clear the last ref and unlock the block.
+
+Having cpus clear their bit asynchronously could be useful on a mask of
+cpus that might have a translation context, or cpus that need a push to
+complete an rcu window.
+
+Instead of adding a BUG_ON and requiring yet another cpumask copy, just
+detect the race and handle it.
+
+Note: arch_send_call_function_ipi_mask must still handle an empty
+cpumask because the data block is globally visible before the that arch
+callback is made. And (obviously) there are no guarantees to which cpus
+are notified if the mask is changed during the call; only cpus that were
+online and had their mask bit set during the whole call are guaranteed
+to be called.
+
+Reported-by: Mike Galbraith <efault@gmx.de>
+Reported-by: Jan Beulich <JBeulich@novell.com>
+Acked-by: Jan Beulich <jbeulich@novell.com>
+Signed-off-by: Milton Miller <miltonm@bga.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/smp.c | 13 ++++++++++---
+ 1 file changed, 10 insertions(+), 3 deletions(-)
+
+--- a/kernel/smp.c
++++ b/kernel/smp.c
+@@ -428,7 +428,7 @@ void smp_call_function_many(const struct
+ {
+ struct call_function_data *data;
+ unsigned long flags;
+- int cpu, next_cpu, this_cpu = smp_processor_id();
++ int refs, cpu, next_cpu, this_cpu = smp_processor_id();
+
+ /*
+ * Can deadlock when called with interrupts disabled.
+@@ -439,7 +439,7 @@ void smp_call_function_many(const struct
+ WARN_ON_ONCE(cpu_online(this_cpu) && irqs_disabled()
+ && !oops_in_progress);
+
+- /* So, what's a CPU they want? Ignoring this one. */
++ /* Try to fastpath. So, what's a CPU they want? Ignoring this one. */
+ cpu = cpumask_first_and(mask, cpu_online_mask);
+ if (cpu == this_cpu)
+ cpu = cpumask_next_and(cpu, mask, cpu_online_mask);
+@@ -497,6 +497,13 @@ void smp_call_function_many(const struct
+ /* We rely on the "and" being processed before the store */
+ cpumask_and(data->cpumask, mask, cpu_online_mask);
+ cpumask_clear_cpu(this_cpu, data->cpumask);
++ refs = cpumask_weight(data->cpumask);
++
++ /* Some callers race with other cpus changing the passed mask */
++ if (unlikely(!refs)) {
++ csd_unlock(&data->csd);
++ return;
++ }
+
+ raw_spin_lock_irqsave(&call_function.lock, flags);
+ /*
+@@ -510,7 +517,7 @@ void smp_call_function_many(const struct
+ * to the cpumask before this write to refs, which indicates
+ * data is on the list and is ready to be processed.
+ */
+- atomic_set(&data->refs, cpumask_weight(data->cpumask));
++ atomic_set(&data->refs, refs);
+ raw_spin_unlock_irqrestore(&call_function.lock, flags);
+
+ /*
diff --git a/queue-2.6.33/x86-binutils-xen-fix-another-wrong-size-directive.patch b/queue-2.6.33/x86-binutils-xen-fix-another-wrong-size-directive.patch
new file mode 100644
index 0000000..875da3b
--- /dev/null
+++ b/queue-2.6.33/x86-binutils-xen-fix-another-wrong-size-directive.patch
@@ -0,0 +1,75 @@
+From 371c394af27ab7d1e58a66bc19d9f1f3ac1f67b4 Mon Sep 17 00:00:00 2001
+From: Alexander van Heukelum <heukelum@fastmail.fm>
+Date: Fri, 11 Mar 2011 21:59:38 +0100
+Subject: x86, binutils, xen: Fix another wrong size directive
+
+From: Alexander van Heukelum <heukelum@fastmail.fm>
+
+commit 371c394af27ab7d1e58a66bc19d9f1f3ac1f67b4 upstream.
+
+The latest binutils (2.21.0.20110302/Ubuntu) breaks the build
+yet another time, under CONFIG_XEN=y due to a .size directive that
+refers to a slightly differently named (hence, to the now very
+strict and unforgiving assembler, non-existent) symbol.
+
+[ mingo:
+
+ This unnecessary build breakage caused by new binutils
+ version 2.21 gets escallated back several kernel releases spanning
+ several years of Linux history, affecting over 130,000 upstream
+ kernel commits (!), on CONFIG_XEN=y 64-bit kernels (i.e. essentially
+ affecting all major Linux distro kernel configs).
+
+ Git annotate tells us that this slight debug symbol code mismatch
+ bug has been introduced in 2008 in commit 3d75e1b8:
+
+ 3d75e1b8 (Jeremy Fitzhardinge 2008-07-08 15:06:49 -0700 1231) ENTRY(xen_do_hypervisor_callback) # do_hypervisor_callback(struct *pt_regs)
+
+ The 'bug' is just a slight assymetry in ENTRY()/END()
+ debug-symbols sequences, with lots of assembly code between the
+ ENTRY() and the END():
+
+ ENTRY(xen_do_hypervisor_callback) # do_hypervisor_callback(struct *pt_regs)
+ ...
+ END(do_hypervisor_callback)
+
+ Human reviewers almost never catch such small mismatches, and binutils
+ never even warned about it either.
+
+ This new binutils version thus breaks the Xen build on all upstream kernels
+ since v2.6.27, out of the blue.
+
+ This makes a straightforward Git bisection of all 64-bit Xen-enabled kernels
+ impossible on such binutils, for a bisection window of over hundred
+ thousand historic commits. (!)
+
+ This is a major fail on the side of binutils and binutils needs to turn
+ this show-stopper build failure into a warning ASAP. ]
+
+Signed-off-by: Alexander van Heukelum <heukelum@fastmail.fm>
+Cc: Jeremy Fitzhardinge <jeremy@goop.org>
+Cc: Jan Beulich <jbeulich@novell.com>
+Cc: H.J. Lu <hjl.tools@gmail.com>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Cc: "H. Peter Anvin" <hpa@zytor.com>
+Cc: Kees Cook <kees.cook@canonical.com>
+LKML-Reference: <1299877178-26063-1-git-send-email-heukelum@fastmail.fm>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/entry_64.S | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/x86/kernel/entry_64.S
++++ b/arch/x86/kernel/entry_64.S
+@@ -1268,7 +1268,7 @@ ENTRY(xen_do_hypervisor_callback) # do
+ decl PER_CPU_VAR(irq_count)
+ jmp error_exit
+ CFI_ENDPROC
+-END(do_hypervisor_callback)
++END(xen_do_hypervisor_callback)
+
+ /*
+ * Hypervisor uses this for application faults while it executes.