--- /dev/null
+From gregkh@mini.kroah.org Wed Sep 16 15:37:13 2009
+Message-Id: <20090916223713.340746225@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Sep 2009 15:36:14 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Michal Schmidt <mschmidt@redhat.com>,
+ Douglas Gilbert <dgilbert@interlog.com>,
+ James Bottomley <James.Bottomley@suse.de>
+Subject: [patch 01/45] [SCSI] sg: fix oops in the error path in sg_build_indirect()
+References: <20090916223613.597295240@mini.kroah.org>
+Content-Disposition: inline; filename=sg-fix-oops-in-the-error-path-in-sg_build_indirect.patch
+Content-Length: 798
+Lines: 29
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Michal Schmidt <mschmidt@redhat.com>
+
+commit e71044ee2efa4792e21d243b03d49006db66aec9 upstream.
+
+When the allocation fails in sg_build_indirect(), an oops happens in
+the error path. It's caused by an obvious typo.
+
+Signed-off-by: Michal Schmidt <mschmidt@redhat.com>
+Reported-by: Bob Tracy <rct@gherkin.frus.com>
+Acked-by: Douglas Gilbert <dgilbert@interlog.com>
+Signed-off-by: James Bottomley <James.Bottomley@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/scsi/sg.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/scsi/sg.c
++++ b/drivers/scsi/sg.c
+@@ -1811,7 +1811,7 @@ retry:
+ return 0;
+ out:
+ for (i = 0; i < k; i++)
+- __free_pages(schp->pages[k], order);
++ __free_pages(schp->pages[i], order);
+
+ if (--order >= 0)
+ goto retry;
+
+
+From gregkh@mini.kroah.org Wed Sep 16 15:37:13 2009
+Message-Id: <20090916223713.500478052@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Sep 2009 15:36:15 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Kashyap Desai <kashyap.desai@lsi.com>,
+ James Bottomley <James.Bottomley@suse.de>
+Subject: [patch 02/45] [SCSI] mpt2sas : Rescan topology from Interrupt context instead of work thread
+References: <20090916223613.597295240@mini.kroah.org>
+Content-Disposition: inline; filename=mpt2sas-rescan-topology-from-interrupt-context-instead-of-work-thread.patch
+Content-Length: 7705
+Lines: 237
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Kashyap, Desai <kashyap.desai@lsi.com>
+
+commit cd4e12e8ad246ec5bc23ab04d0da0e6985025620 upstream.
+
+Following host reset its possible that the controller firmware could
+assign new handles for devices, as well as adding or deleting devices. There is
+code in the driver that will rescan the topology folowing host reset; updating
+device handles, and remove devices that are no longer responding. This patch
+will improve the responsivness by moving this rescaning from the delayed hotplug
+worker thread to immediately following the host reset.
+
+Signed-off-by: Kashyap Desai <kashyap.desai@lsi.com>
+Reviewed-by: Eric Moore <Eric.moore@lsi.com>
+Signed-off-by: James Bottomley <James.Bottomley@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/scsi/mpt2sas/mpt2sas_base.c | 3
+ drivers/scsi/mpt2sas/mpt2sas_base.h | 1
+ drivers/scsi/mpt2sas/mpt2sas_scsih.c | 142 +++++++++++++----------------------
+ 3 files changed, 57 insertions(+), 89 deletions(-)
+
+--- a/drivers/scsi/mpt2sas/mpt2sas_base.c
++++ b/drivers/scsi/mpt2sas/mpt2sas_base.c
+@@ -3536,5 +3536,8 @@ mpt2sas_base_hard_reset_handler(struct M
+ spin_lock_irqsave(&ioc->ioc_reset_in_progress_lock, flags);
+ ioc->ioc_reset_in_progress = 0;
+ spin_unlock_irqrestore(&ioc->ioc_reset_in_progress_lock, flags);
++
++ if (!r)
++ _base_reset_handler(ioc, MPT2_IOC_RUNNING);
+ return r;
+ }
+--- a/drivers/scsi/mpt2sas/mpt2sas_base.h
++++ b/drivers/scsi/mpt2sas/mpt2sas_base.h
+@@ -119,6 +119,7 @@
+ #define MPT2_IOC_PRE_RESET 1 /* prior to host reset */
+ #define MPT2_IOC_AFTER_RESET 2 /* just after host reset */
+ #define MPT2_IOC_DONE_RESET 3 /* links re-initialized */
++#define MPT2_IOC_RUNNING 4 /* shost running */
+
+ /*
+ * logging format
+--- a/drivers/scsi/mpt2sas/mpt2sas_scsih.c
++++ b/drivers/scsi/mpt2sas/mpt2sas_scsih.c
+@@ -103,7 +103,6 @@ struct sense_info {
+ };
+
+
+-#define MPT2SAS_RESCAN_AFTER_HOST_RESET (0xFFFF)
+ /**
+ * struct fw_event_work - firmware event struct
+ * @list: link list framework
+@@ -2405,27 +2404,6 @@ _scsih_check_topo_delete_events(struct M
+ }
+
+ /**
+- * _scsih_queue_rescan - queue a topology rescan from user context
+- * @ioc: per adapter object
+- *
+- * Return nothing.
+- */
+-static void
+-_scsih_queue_rescan(struct MPT2SAS_ADAPTER *ioc)
+-{
+- struct fw_event_work *fw_event;
+-
+- if (ioc->wait_for_port_enable_to_complete)
+- return;
+- fw_event = kzalloc(sizeof(struct fw_event_work), GFP_ATOMIC);
+- if (!fw_event)
+- return;
+- fw_event->event = MPT2SAS_RESCAN_AFTER_HOST_RESET;
+- fw_event->ioc = ioc;
+- _scsih_fw_event_add(ioc, fw_event);
+-}
+-
+-/**
+ * _scsih_flush_running_cmds - completing outstanding commands.
+ * @ioc: per adapter object
+ *
+@@ -2456,46 +2434,6 @@ _scsih_flush_running_cmds(struct MPT2SAS
+ }
+
+ /**
+- * mpt2sas_scsih_reset_handler - reset callback handler (for scsih)
+- * @ioc: per adapter object
+- * @reset_phase: phase
+- *
+- * The handler for doing any required cleanup or initialization.
+- *
+- * The reset phase can be MPT2_IOC_PRE_RESET, MPT2_IOC_AFTER_RESET,
+- * MPT2_IOC_DONE_RESET
+- *
+- * Return nothing.
+- */
+-void
+-mpt2sas_scsih_reset_handler(struct MPT2SAS_ADAPTER *ioc, int reset_phase)
+-{
+- switch (reset_phase) {
+- case MPT2_IOC_PRE_RESET:
+- dtmprintk(ioc, printk(MPT2SAS_DEBUG_FMT "%s: "
+- "MPT2_IOC_PRE_RESET\n", ioc->name, __func__));
+- _scsih_fw_event_off(ioc);
+- break;
+- case MPT2_IOC_AFTER_RESET:
+- dtmprintk(ioc, printk(MPT2SAS_DEBUG_FMT "%s: "
+- "MPT2_IOC_AFTER_RESET\n", ioc->name, __func__));
+- if (ioc->tm_cmds.status & MPT2_CMD_PENDING) {
+- ioc->tm_cmds.status |= MPT2_CMD_RESET;
+- mpt2sas_base_free_smid(ioc, ioc->tm_cmds.smid);
+- complete(&ioc->tm_cmds.done);
+- }
+- _scsih_fw_event_on(ioc);
+- _scsih_flush_running_cmds(ioc);
+- break;
+- case MPT2_IOC_DONE_RESET:
+- dtmprintk(ioc, printk(MPT2SAS_DEBUG_FMT "%s: "
+- "MPT2_IOC_DONE_RESET\n", ioc->name, __func__));
+- _scsih_queue_rescan(ioc);
+- break;
+- }
+-}
+-
+-/**
+ * _scsih_setup_eedp - setup MPI request for EEDP transfer
+ * @scmd: pointer to scsi command object
+ * @mpi_request: pointer to the SCSI_IO reqest message frame
+@@ -5156,22 +5094,9 @@ static void
+ _scsih_remove_unresponding_devices(struct MPT2SAS_ADAPTER *ioc)
+ {
+ struct _sas_device *sas_device, *sas_device_next;
+- struct _sas_node *sas_expander, *sas_expander_next;
++ struct _sas_node *sas_expander;
+ struct _raid_device *raid_device, *raid_device_next;
+- unsigned long flags;
+
+- _scsih_search_responding_sas_devices(ioc);
+- _scsih_search_responding_raid_devices(ioc);
+- _scsih_search_responding_expanders(ioc);
+-
+- spin_lock_irqsave(&ioc->ioc_reset_in_progress_lock, flags);
+- ioc->shost_recovery = 0;
+- if (ioc->shost->shost_state == SHOST_RECOVERY) {
+- printk(MPT2SAS_INFO_FMT "putting controller into "
+- "SHOST_RUNNING\n", ioc->name);
+- scsi_host_set_state(ioc->shost, SHOST_RUNNING);
+- }
+- spin_unlock_irqrestore(&ioc->ioc_reset_in_progress_lock, flags);
+
+ list_for_each_entry_safe(sas_device, sas_device_next,
+ &ioc->sas_device_list, list) {
+@@ -5207,16 +5132,63 @@ _scsih_remove_unresponding_devices(struc
+ _scsih_raid_device_remove(ioc, raid_device);
+ }
+
+- list_for_each_entry_safe(sas_expander, sas_expander_next,
+- &ioc->sas_expander_list, list) {
++ retry_expander_search:
++ sas_expander = NULL;
++ list_for_each_entry(sas_expander, &ioc->sas_expander_list, list) {
+ if (sas_expander->responding) {
+ sas_expander->responding = 0;
+ continue;
+ }
+- printk("\tremoving expander: handle(0x%04x), "
+- " sas_addr(0x%016llx)\n", sas_expander->handle,
+- (unsigned long long)sas_expander->sas_address);
+ _scsih_expander_remove(ioc, sas_expander->handle);
++ goto retry_expander_search;
++ }
++}
++
++/**
++ * mpt2sas_scsih_reset_handler - reset callback handler (for scsih)
++ * @ioc: per adapter object
++ * @reset_phase: phase
++ *
++ * The handler for doing any required cleanup or initialization.
++ *
++ * The reset phase can be MPT2_IOC_PRE_RESET, MPT2_IOC_AFTER_RESET,
++ * MPT2_IOC_DONE_RESET
++ *
++ * Return nothing.
++ */
++void
++mpt2sas_scsih_reset_handler(struct MPT2SAS_ADAPTER *ioc, int reset_phase)
++{
++ switch (reset_phase) {
++ case MPT2_IOC_PRE_RESET:
++ dtmprintk(ioc, printk(MPT2SAS_DEBUG_FMT "%s: "
++ "MPT2_IOC_PRE_RESET\n", ioc->name, __func__));
++ _scsih_fw_event_off(ioc);
++ break;
++ case MPT2_IOC_AFTER_RESET:
++ dtmprintk(ioc, printk(MPT2SAS_DEBUG_FMT "%s: "
++ "MPT2_IOC_AFTER_RESET\n", ioc->name, __func__));
++ if (ioc->tm_cmds.status & MPT2_CMD_PENDING) {
++ ioc->tm_cmds.status |= MPT2_CMD_RESET;
++ mpt2sas_base_free_smid(ioc, ioc->tm_cmds.smid);
++ complete(&ioc->tm_cmds.done);
++ }
++ _scsih_fw_event_on(ioc);
++ _scsih_flush_running_cmds(ioc);
++ break;
++ case MPT2_IOC_DONE_RESET:
++ dtmprintk(ioc, printk(MPT2SAS_DEBUG_FMT "%s: "
++ "MPT2_IOC_DONE_RESET\n", ioc->name, __func__));
++ _scsih_sas_host_refresh(ioc, 0);
++ _scsih_search_responding_sas_devices(ioc);
++ _scsih_search_responding_raid_devices(ioc);
++ _scsih_search_responding_expanders(ioc);
++ break;
++ case MPT2_IOC_RUNNING:
++ dtmprintk(ioc, printk(MPT2SAS_DEBUG_FMT "%s: "
++ "MPT2_IOC_RUNNING\n", ioc->name, __func__));
++ _scsih_remove_unresponding_devices(ioc);
++ break;
+ }
+ }
+
+@@ -5236,14 +5208,6 @@ _firmware_event_work(struct work_struct
+ unsigned long flags;
+ struct MPT2SAS_ADAPTER *ioc = fw_event->ioc;
+
+- /* This is invoked by calling _scsih_queue_rescan(). */
+- if (fw_event->event == MPT2SAS_RESCAN_AFTER_HOST_RESET) {
+- _scsih_fw_event_free(ioc, fw_event);
+- _scsih_sas_host_refresh(ioc, 1);
+- _scsih_remove_unresponding_devices(ioc);
+- return;
+- }
+-
+ /* the queue is being flushed so ignore this event */
+ spin_lock_irqsave(&ioc->fw_event_lock, flags);
+ if (ioc->fw_events_off || ioc->remove_host) {
+
+
+From gregkh@mini.kroah.org Wed Sep 16 15:37:13 2009
+Message-Id: <20090916223713.647767294@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Sep 2009 15:36:16 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Kashyap Desai <kashyap.desai@lsi.com>,
+ James Bottomley <James.Bottomley@suse.de>
+Subject: [patch 03/45] [SCSI] mpt2sas: Prevent sending command to FW while Host Reset
+References: <20090916223613.597295240@mini.kroah.org>
+Content-Disposition: inline; filename=mpt2sas-prevent-sending-command-to-fw-while-host-reset.patch
+Content-Length: 11846
+Lines: 348
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Kashyap, Desai <kashyap.desai@lsi.com>
+
+commit 155dd4c763694222c125e65438d823f58ea653bc upstream.
+
+This patch renames the flag for indicating host reset from
+ioc_reset_in_progress to shost_recovery. It also removes the spin locks
+surrounding the setting of this flag, which are unnecessary. Sanity checks on
+the shost_recovery flag were added thru out the code so as to prevent sending
+firmware commands during host reset. Also, the setting of the shost state to
+SHOST_RECOVERY was removed to prevent deadlocks, this is actually better
+handled by the shost_recovery flag.
+
+Signed-off-by: Kashyap Desai <kashyap.desai@lsi.com>
+Reviewed-by: Eric Moore <Eric.moore@lsi.com>
+Signed-off-by: James Bottomley <James.Bottomley@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/scsi/mpt2sas/mpt2sas_base.c | 13 ++--------
+ drivers/scsi/mpt2sas/mpt2sas_base.h | 3 --
+ drivers/scsi/mpt2sas/mpt2sas_ctl.c | 16 +-----------
+ drivers/scsi/mpt2sas/mpt2sas_scsih.c | 40 ++++++++++++++++++-------------
+ drivers/scsi/mpt2sas/mpt2sas_transport.c | 29 +++++++++++++---------
+ 5 files changed, 47 insertions(+), 54 deletions(-)
+
+--- a/drivers/scsi/mpt2sas/mpt2sas_base.c
++++ b/drivers/scsi/mpt2sas/mpt2sas_base.c
+@@ -94,7 +94,7 @@ _base_fault_reset_work(struct work_struc
+ int rc;
+
+ spin_lock_irqsave(&ioc->ioc_reset_in_progress_lock, flags);
+- if (ioc->ioc_reset_in_progress)
++ if (ioc->shost_recovery)
+ goto rearm_timer;
+ spin_unlock_irqrestore(&ioc->ioc_reset_in_progress_lock, flags);
+
+@@ -3501,20 +3501,13 @@ mpt2sas_base_hard_reset_handler(struct M
+ __func__));
+
+ spin_lock_irqsave(&ioc->ioc_reset_in_progress_lock, flags);
+- if (ioc->ioc_reset_in_progress) {
++ if (ioc->shost_recovery) {
+ spin_unlock_irqrestore(&ioc->ioc_reset_in_progress_lock, flags);
+ printk(MPT2SAS_ERR_FMT "%s: busy\n",
+ ioc->name, __func__);
+ return -EBUSY;
+ }
+- ioc->ioc_reset_in_progress = 1;
+ ioc->shost_recovery = 1;
+- if (ioc->shost->shost_state == SHOST_RUNNING) {
+- /* set back to SHOST_RUNNING in mpt2sas_scsih.c */
+- scsi_host_set_state(ioc->shost, SHOST_RECOVERY);
+- printk(MPT2SAS_INFO_FMT "putting controller into "
+- "SHOST_RECOVERY\n", ioc->name);
+- }
+ spin_unlock_irqrestore(&ioc->ioc_reset_in_progress_lock, flags);
+
+ _base_reset_handler(ioc, MPT2_IOC_PRE_RESET);
+@@ -3534,7 +3527,7 @@ mpt2sas_base_hard_reset_handler(struct M
+ ioc->name, __func__, ((r == 0) ? "SUCCESS" : "FAILED")));
+
+ spin_lock_irqsave(&ioc->ioc_reset_in_progress_lock, flags);
+- ioc->ioc_reset_in_progress = 0;
++ ioc->shost_recovery = 0;
+ spin_unlock_irqrestore(&ioc->ioc_reset_in_progress_lock, flags);
+
+ if (!r)
+--- a/drivers/scsi/mpt2sas/mpt2sas_base.h
++++ b/drivers/scsi/mpt2sas/mpt2sas_base.h
+@@ -432,7 +432,7 @@ typedef void (*MPT_ADD_SGE)(void *paddr,
+ * @fw_event_list: list of fw events
+ * @aen_event_read_flag: event log was read
+ * @broadcast_aen_busy: broadcast aen waiting to be serviced
+- * @ioc_reset_in_progress: host reset in progress
++ * @shost_recovery: host reset in progress
+ * @ioc_reset_in_progress_lock:
+ * @ioc_link_reset_in_progress: phy/hard reset in progress
+ * @ignore_loginfos: ignore loginfos during task managment
+@@ -545,7 +545,6 @@ struct MPT2SAS_ADAPTER {
+ /* misc flags */
+ int aen_event_read_flag;
+ u8 broadcast_aen_busy;
+- u8 ioc_reset_in_progress;
+ u8 shost_recovery;
+ spinlock_t ioc_reset_in_progress_lock;
+ u8 ioc_link_reset_in_progress;
+--- a/drivers/scsi/mpt2sas/mpt2sas_ctl.c
++++ b/drivers/scsi/mpt2sas/mpt2sas_ctl.c
+@@ -1963,7 +1963,6 @@ _ctl_ioctl_main(struct file *file, unsig
+ {
+ enum block_state state;
+ long ret = -EINVAL;
+- unsigned long flags;
+
+ state = (file->f_flags & O_NONBLOCK) ? NON_BLOCKING :
+ BLOCKING;
+@@ -1989,13 +1988,8 @@ _ctl_ioctl_main(struct file *file, unsig
+ !ioc)
+ return -ENODEV;
+
+- spin_lock_irqsave(&ioc->ioc_reset_in_progress_lock, flags);
+- if (ioc->shost_recovery) {
+- spin_unlock_irqrestore(&ioc->ioc_reset_in_progress_lock,
+- flags);
++ if (ioc->shost_recovery)
+ return -EAGAIN;
+- }
+- spin_unlock_irqrestore(&ioc->ioc_reset_in_progress_lock, flags);
+
+ if (_IOC_SIZE(cmd) == sizeof(struct mpt2_ioctl_command)) {
+ uarg = arg;
+@@ -2098,7 +2092,6 @@ _ctl_compat_mpt_command(struct file *fil
+ struct mpt2_ioctl_command karg;
+ struct MPT2SAS_ADAPTER *ioc;
+ enum block_state state;
+- unsigned long flags;
+
+ if (_IOC_SIZE(cmd) != sizeof(struct mpt2_ioctl_command32))
+ return -EINVAL;
+@@ -2113,13 +2106,8 @@ _ctl_compat_mpt_command(struct file *fil
+ if (_ctl_verify_adapter(karg32.hdr.ioc_number, &ioc) == -1 || !ioc)
+ return -ENODEV;
+
+- spin_lock_irqsave(&ioc->ioc_reset_in_progress_lock, flags);
+- if (ioc->shost_recovery) {
+- spin_unlock_irqrestore(&ioc->ioc_reset_in_progress_lock,
+- flags);
++ if (ioc->shost_recovery)
+ return -EAGAIN;
+- }
+- spin_unlock_irqrestore(&ioc->ioc_reset_in_progress_lock, flags);
+
+ memset(&karg, 0, sizeof(struct mpt2_ioctl_command));
+ karg.hdr.ioc_number = karg32.hdr.ioc_number;
+--- a/drivers/scsi/mpt2sas/mpt2sas_scsih.c
++++ b/drivers/scsi/mpt2sas/mpt2sas_scsih.c
+@@ -1785,17 +1785,18 @@ mpt2sas_scsih_issue_tm(struct MPT2SAS_AD
+ u32 ioc_state;
+ unsigned long timeleft;
+ u8 VF_ID = 0;
+- unsigned long flags;
+
+- spin_lock_irqsave(&ioc->ioc_reset_in_progress_lock, flags);
+- if (ioc->tm_cmds.status != MPT2_CMD_NOT_USED ||
+- ioc->shost_recovery) {
+- spin_unlock_irqrestore(&ioc->ioc_reset_in_progress_lock, flags);
++ if (ioc->tm_cmds.status != MPT2_CMD_NOT_USED) {
++ printk(MPT2SAS_INFO_FMT "%s: tm_cmd busy!!!\n",
++ __func__, ioc->name);
++ return;
++ }
++
++ if (ioc->shost_recovery) {
+ printk(MPT2SAS_INFO_FMT "%s: host reset in progress!\n",
+ __func__, ioc->name);
+ return;
+ }
+- spin_unlock_irqrestore(&ioc->ioc_reset_in_progress_lock, flags);
+
+ ioc_state = mpt2sas_base_get_iocstate(ioc, 0);
+ if (ioc_state & MPI2_DOORBELL_USED) {
+@@ -2553,7 +2554,6 @@ _scsih_qcmd(struct scsi_cmnd *scmd, void
+ Mpi2SCSIIORequest_t *mpi_request;
+ u32 mpi_control;
+ u16 smid;
+- unsigned long flags;
+
+ scmd->scsi_done = done;
+ sas_device_priv_data = scmd->device->hostdata;
+@@ -2572,13 +2572,10 @@ _scsih_qcmd(struct scsi_cmnd *scmd, void
+ }
+
+ /* see if we are busy with task managment stuff */
+- spin_lock_irqsave(&ioc->ioc_reset_in_progress_lock, flags);
+- if (sas_target_priv_data->tm_busy ||
+- ioc->shost_recovery || ioc->ioc_link_reset_in_progress) {
+- spin_unlock_irqrestore(&ioc->ioc_reset_in_progress_lock, flags);
++ if (sas_target_priv_data->tm_busy)
++ return SCSI_MLQUEUE_DEVICE_BUSY;
++ else if (ioc->shost_recovery || ioc->ioc_link_reset_in_progress)
+ return SCSI_MLQUEUE_HOST_BUSY;
+- }
+- spin_unlock_irqrestore(&ioc->ioc_reset_in_progress_lock, flags);
+
+ if (scmd->sc_data_direction == DMA_FROM_DEVICE)
+ mpi_control = MPI2_SCSIIO_CONTROL_READ;
+@@ -3374,6 +3371,9 @@ _scsih_expander_add(struct MPT2SAS_ADAPT
+ if (!handle)
+ return -1;
+
++ if (ioc->shost_recovery)
++ return -1;
++
+ if ((mpt2sas_config_get_expander_pg0(ioc, &mpi_reply, &expander_pg0,
+ MPI2_SAS_EXPAND_PGAD_FORM_HNDL, handle))) {
+ printk(MPT2SAS_ERR_FMT "failure at %s:%d/%s()!\n",
+@@ -3510,6 +3510,9 @@ _scsih_expander_remove(struct MPT2SAS_AD
+ struct _sas_node *sas_expander;
+ unsigned long flags;
+
++ if (ioc->shost_recovery)
++ return;
++
+ spin_lock_irqsave(&ioc->sas_node_lock, flags);
+ sas_expander = mpt2sas_scsih_expander_find_by_handle(ioc, handle);
+ spin_unlock_irqrestore(&ioc->sas_node_lock, flags);
+@@ -3681,6 +3684,8 @@ _scsih_remove_device(struct MPT2SAS_ADAP
+ mutex_unlock(&ioc->tm_cmds.mutex);
+ dewtprintk(ioc, printk(MPT2SAS_INFO_FMT "issue target reset "
+ "done: handle(0x%04x)\n", ioc->name, device_handle));
++ if (ioc->shost_recovery)
++ goto out;
+ }
+
+ /* SAS_IO_UNIT_CNTR - send REMOVE_DEVICE */
+@@ -3846,6 +3851,8 @@ _scsih_sas_topology_change_event(struct
+ "expander event\n", ioc->name));
+ return;
+ }
++ if (ioc->shost_recovery)
++ return;
+ if (event_data->PHY[i].PhyStatus &
+ MPI2_EVENT_SAS_TOPO_PHYSTATUS_VACANT)
+ continue;
+@@ -5217,13 +5224,10 @@ _firmware_event_work(struct work_struct
+ }
+ spin_unlock_irqrestore(&ioc->fw_event_lock, flags);
+
+- spin_lock_irqsave(&ioc->ioc_reset_in_progress_lock, flags);
+ if (ioc->shost_recovery) {
+- spin_unlock_irqrestore(&ioc->ioc_reset_in_progress_lock, flags);
+ _scsih_fw_event_requeue(ioc, fw_event, 1000);
+ return;
+ }
+- spin_unlock_irqrestore(&ioc->ioc_reset_in_progress_lock, flags);
+
+ switch (fw_event->event) {
+ case MPI2_EVENT_SAS_TOPOLOGY_CHANGE_LIST:
+@@ -5425,6 +5429,8 @@ _scsih_expander_node_remove(struct MPT2S
+ if (!sas_device)
+ continue;
+ _scsih_remove_device(ioc, sas_device->handle);
++ if (ioc->shost_recovery)
++ return;
+ goto retry_device_search;
+ }
+ }
+@@ -5446,6 +5452,8 @@ _scsih_expander_node_remove(struct MPT2S
+ if (!expander_sibling)
+ continue;
+ _scsih_expander_remove(ioc, expander_sibling->handle);
++ if (ioc->shost_recovery)
++ return;
+ goto retry_expander_search;
+ }
+ }
+--- a/drivers/scsi/mpt2sas/mpt2sas_transport.c
++++ b/drivers/scsi/mpt2sas/mpt2sas_transport.c
+@@ -140,11 +140,18 @@ _transport_set_identify(struct MPT2SAS_A
+ u32 device_info;
+ u32 ioc_status;
+
++ if (ioc->shost_recovery) {
++ printk(MPT2SAS_INFO_FMT "%s: host reset in progress!\n",
++ __func__, ioc->name);
++ return -EFAULT;
++ }
++
+ if ((mpt2sas_config_get_sas_device_pg0(ioc, &mpi_reply, &sas_device_pg0,
+ MPI2_SAS_DEVICE_PGAD_FORM_HANDLE, handle))) {
+ printk(MPT2SAS_ERR_FMT "failure at %s:%d/%s()!\n",
++
+ ioc->name, __FILE__, __LINE__, __func__);
+- return -1;
++ return -ENXIO;
+ }
+
+ ioc_status = le16_to_cpu(mpi_reply.IOCStatus) &
+@@ -153,7 +160,7 @@ _transport_set_identify(struct MPT2SAS_A
+ printk(MPT2SAS_ERR_FMT "handle(0x%04x), ioc_status(0x%04x)"
+ "\nfailure at %s:%d/%s()!\n", ioc->name, handle, ioc_status,
+ __FILE__, __LINE__, __func__);
+- return -1;
++ return -EIO;
+ }
+
+ memset(identify, 0, sizeof(identify));
+@@ -288,21 +295,17 @@ _transport_expander_report_manufacture(s
+ void *psge;
+ u32 sgl_flags;
+ u8 issue_reset = 0;
+- unsigned long flags;
+ void *data_out = NULL;
+ dma_addr_t data_out_dma;
+ u32 sz;
+ u64 *sas_address_le;
+ u16 wait_state_count;
+
+- spin_lock_irqsave(&ioc->ioc_reset_in_progress_lock, flags);
+- if (ioc->ioc_reset_in_progress) {
+- spin_unlock_irqrestore(&ioc->ioc_reset_in_progress_lock, flags);
++ if (ioc->shost_recovery) {
+ printk(MPT2SAS_INFO_FMT "%s: host reset in progress!\n",
+ __func__, ioc->name);
+ return -EFAULT;
+ }
+- spin_unlock_irqrestore(&ioc->ioc_reset_in_progress_lock, flags);
+
+ mutex_lock(&ioc->transport_cmds.mutex);
+
+@@ -806,6 +809,12 @@ mpt2sas_transport_update_phy_link_change
+ struct _sas_node *sas_node;
+ struct _sas_phy *mpt2sas_phy;
+
++ if (ioc->shost_recovery) {
++ printk(MPT2SAS_INFO_FMT "%s: host reset in progress!\n",
++ __func__, ioc->name);
++ return;
++ }
++
+ spin_lock_irqsave(&ioc->sas_node_lock, flags);
+ sas_node = _transport_sas_node_find_by_handle(ioc, handle);
+ spin_unlock_irqrestore(&ioc->sas_node_lock, flags);
+@@ -1025,7 +1034,6 @@ _transport_smp_handler(struct Scsi_Host
+ void *psge;
+ u32 sgl_flags;
+ u8 issue_reset = 0;
+- unsigned long flags;
+ dma_addr_t dma_addr_in = 0;
+ dma_addr_t dma_addr_out = 0;
+ u16 wait_state_count;
+@@ -1045,14 +1053,11 @@ _transport_smp_handler(struct Scsi_Host
+ return -EINVAL;
+ }
+
+- spin_lock_irqsave(&ioc->ioc_reset_in_progress_lock, flags);
+- if (ioc->ioc_reset_in_progress) {
+- spin_unlock_irqrestore(&ioc->ioc_reset_in_progress_lock, flags);
++ if (ioc->shost_recovery) {
+ printk(MPT2SAS_INFO_FMT "%s: host reset in progress!\n",
+ __func__, ioc->name);
+ return -EFAULT;
+ }
+- spin_unlock_irqrestore(&ioc->ioc_reset_in_progress_lock, flags);
+
+ rc = mutex_lock_interruptible(&ioc->transport_cmds.mutex);
+ if (rc)
+
+
+From gregkh@mini.kroah.org Wed Sep 16 15:37:13 2009
+Message-Id: <20090916223713.797208638@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Sep 2009 15:36:17 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Kashyap Desai <kashyap.desai@lsi.com>,
+ James Bottomley <James.Bottomley@suse.de>
+Subject: [patch 04/45] [SCSI] mpt2sas: setting SDEV into RUNNING state from Interrupt context
+References: <20090916223613.597295240@mini.kroah.org>
+Content-Disposition: inline; filename=mpt2sas-setting-sdev-into-running-state-from-interrupt-context.patch
+Content-Length: 3411
+Lines: 95
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Kashyap, Desai <kashyap.desai@lsi.com>
+
+commit 34a03bef2202d0c9983a8da0a8abaee37d285847 upstream.
+
+Changing SDEV Running state from interrupt context. Previously It was
+handle in work queue thread. With this change It will not wait for work
+queue thread to execute scsih_ublock_io_device to put SDEV into Running
+state. This will reduce delay for Device becoming RUNNING.
+
+Modified this patch considering James comment "Not to change SDEV state
+using scsi_device_set_state API, instead use scsi_internal_device_unblock
+scsi_internal_device_block API"
+
+Signed-off-by: Kashyap Desai <kashyap.desai@lsi.com>
+Reviewed-by: Eric Moore <Eric.moore@lsi.com>
+Signed-off-by: James Bottomley <James.Bottomley@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/scsi/mpt2sas/mpt2sas_base.h | 2 ++
+ drivers/scsi/mpt2sas/mpt2sas_scsih.c | 17 +++++++++++------
+ 2 files changed, 13 insertions(+), 6 deletions(-)
+
+--- a/drivers/scsi/mpt2sas/mpt2sas_base.h
++++ b/drivers/scsi/mpt2sas/mpt2sas_base.h
+@@ -802,5 +802,7 @@ void mpt2sas_transport_update_phy_link_c
+ u16 attached_handle, u8 phy_number, u8 link_rate);
+ extern struct sas_function_template mpt2sas_transport_functions;
+ extern struct scsi_transport_template *mpt2sas_transport_template;
++extern int scsi_internal_device_block(struct scsi_device *sdev);
++extern int scsi_internal_device_unblock(struct scsi_device *sdev);
+
+ #endif /* MPT2SAS_BASE_H_INCLUDED */
+--- a/drivers/scsi/mpt2sas/mpt2sas_scsih.c
++++ b/drivers/scsi/mpt2sas/mpt2sas_scsih.c
+@@ -2222,7 +2222,7 @@ _scsih_ublock_io_device(struct MPT2SAS_A
+ MPT2SAS_INFO_FMT "SDEV_RUNNING: "
+ "handle(0x%04x)\n", ioc->name, handle));
+ sas_device_priv_data->block = 0;
+- scsi_device_set_state(sdev, SDEV_RUNNING);
++ scsi_internal_device_unblock(sdev);
+ }
+ }
+ }
+@@ -2251,7 +2251,7 @@ _scsih_block_io_device(struct MPT2SAS_AD
+ MPT2SAS_INFO_FMT "SDEV_BLOCK: "
+ "handle(0x%04x)\n", ioc->name, handle));
+ sas_device_priv_data->block = 1;
+- scsi_device_set_state(sdev, SDEV_BLOCK);
++ scsi_internal_device_block(sdev);
+ }
+ }
+ }
+@@ -2327,6 +2327,7 @@ _scsih_block_io_to_children_attached_dir
+ u16 handle;
+ u16 reason_code;
+ u8 phy_number;
++ u8 link_rate;
+
+ for (i = 0; i < event_data->NumEntries; i++) {
+ handle = le16_to_cpu(event_data->PHY[i].AttachedDevHandle);
+@@ -2337,6 +2338,11 @@ _scsih_block_io_to_children_attached_dir
+ MPI2_EVENT_SAS_TOPO_RC_MASK;
+ if (reason_code == MPI2_EVENT_SAS_TOPO_RC_DELAY_NOT_RESPONDING)
+ _scsih_block_io_device(ioc, handle);
++ if (reason_code == MPI2_EVENT_SAS_TOPO_RC_PHY_CHANGED) {
++ link_rate = event_data->PHY[i].LinkRate >> 4;
++ if (link_rate >= MPI2_SAS_NEG_LINK_RATE_1_5)
++ _scsih_ublock_io_device(ioc, handle);
++ }
+ }
+ }
+
+@@ -3708,6 +3714,9 @@ _scsih_remove_device(struct MPT2SAS_ADAP
+ le32_to_cpu(mpi_reply.IOCLogInfo)));
+
+ out:
++
++ _scsih_ublock_io_device(ioc, handle);
++
+ mpt2sas_transport_port_remove(ioc, sas_device->sas_address,
+ sas_device->parent_handle);
+
+@@ -3887,10 +3896,6 @@ _scsih_sas_topology_change_event(struct
+ link_rate_);
+ }
+ }
+- if (reason_code == MPI2_EVENT_SAS_TOPO_RC_PHY_CHANGED) {
+- if (link_rate_ >= MPI2_SAS_NEG_LINK_RATE_1_5)
+- _scsih_ublock_io_device(ioc, handle);
+- }
+ if (reason_code == MPI2_EVENT_SAS_TOPO_RC_TARG_ADDED) {
+ if (link_rate_ < MPI2_SAS_NEG_LINK_RATE_1_5)
+ break;
+
+
+From gregkh@mini.kroah.org Wed Sep 16 15:37:14 2009
+Message-Id: <20090916223713.953025868@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Sep 2009 15:36:18 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Kashyap Desai <kashyap.desai@lsi.com>,
+ James Bottomley <James.Bottomley@suse.de>
+Subject: [patch 05/45] [SCSI] mpt2sas: Raid 10 Volume is showing as Raid 1E in dmesg
+References: <20090916223613.597295240@mini.kroah.org>
+Content-Disposition: inline; filename=mpt2sas-raid-10-volume-is-showing-as-raid-1e-in-dmesg.patch
+Content-Length: 8991
+Lines: 216
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Kashyap, Desai <kashyap.desai@lsi.com>
+
+commit ed79f1280d1bc54f168abcffc8c3e0bf8ffb1873 upstream.
+
+This patch modifies the slave_configure callback so the messages that get sent
+to system log for RAID1E volumes contain the string "RAID10" instead of
+"RAID1E". These messages contain information regarding what kind of scsi device
+is being added. Certain OEMS can enable displaying the RAID10 string instead of
+RAID1E via manufacturing page 10. The driver will read this config page at
+driver load time, then determine from the GenericFlags0 bits whether display
+the RAID10 or RAID1E string, also even drive count is taken into consideration.
+
+Signed-off-by: Kashyap Desai <kashyap.desai@lsi.com>
+Reviewed-by: Eric Moore <Eric.moore@lsi.com>
+Signed-off-by: James Bottomley <James.Bottomley@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/scsi/mpt2sas/mpt2sas_base.c | 7 ++-
+ drivers/scsi/mpt2sas/mpt2sas_base.h | 37 ++++++++++++++++++++
+ drivers/scsi/mpt2sas/mpt2sas_config.c | 61 ++++++++++++++++++++++++++++++++++
+ drivers/scsi/mpt2sas/mpt2sas_scsih.c | 8 +++-
+ 4 files changed, 109 insertions(+), 4 deletions(-)
+
+--- a/drivers/scsi/mpt2sas/mpt2sas_base.c
++++ b/drivers/scsi/mpt2sas/mpt2sas_base.c
+@@ -1542,6 +1542,8 @@ _base_display_ioc_capabilities(struct MP
+ (ioc->bios_pg3.BiosVersion & 0x0000FF00) >> 8,
+ ioc->bios_pg3.BiosVersion & 0x000000FF);
+
++ _base_display_dell_branding(ioc);
++
+ printk(MPT2SAS_INFO_FMT "Protocol=(", ioc->name);
+
+ if (ioc->facts.ProtocolFlags & MPI2_IOCFACTS_PROTOCOL_SCSI_INITIATOR) {
+@@ -1554,8 +1556,6 @@ _base_display_ioc_capabilities(struct MP
+ i++;
+ }
+
+- _base_display_dell_branding(ioc);
+-
+ i = 0;
+ printk("), ");
+ printk("Capabilities=(");
+@@ -1627,6 +1627,9 @@ _base_static_config_pages(struct MPT2SAS
+ u32 iounit_pg1_flags;
+
+ mpt2sas_config_get_manufacturing_pg0(ioc, &mpi_reply, &ioc->manu_pg0);
++ if (ioc->ir_firmware)
++ mpt2sas_config_get_manufacturing_pg10(ioc, &mpi_reply,
++ &ioc->manu_pg10);
+ mpt2sas_config_get_bios_pg2(ioc, &mpi_reply, &ioc->bios_pg2);
+ mpt2sas_config_get_bios_pg3(ioc, &mpi_reply, &ioc->bios_pg3);
+ mpt2sas_config_get_ioc_pg8(ioc, &mpi_reply, &ioc->ioc_pg8);
+--- a/drivers/scsi/mpt2sas/mpt2sas_base.h
++++ b/drivers/scsi/mpt2sas/mpt2sas_base.h
+@@ -197,6 +197,38 @@ struct MPT2SAS_TARGET {
+ * @block: device is in SDEV_BLOCK state
+ * @tlr_snoop_check: flag used in determining whether to disable TLR
+ */
++
++/* OEM Identifiers */
++#define MFG10_OEM_ID_INVALID (0x00000000)
++#define MFG10_OEM_ID_DELL (0x00000001)
++#define MFG10_OEM_ID_FSC (0x00000002)
++#define MFG10_OEM_ID_SUN (0x00000003)
++#define MFG10_OEM_ID_IBM (0x00000004)
++
++/* GENERIC Flags 0*/
++#define MFG10_GF0_OCE_DISABLED (0x00000001)
++#define MFG10_GF0_R1E_DRIVE_COUNT (0x00000002)
++#define MFG10_GF0_R10_DISPLAY (0x00000004)
++#define MFG10_GF0_SSD_DATA_SCRUB_DISABLE (0x00000008)
++#define MFG10_GF0_SINGLE_DRIVE_R0 (0x00000010)
++
++/* OEM Specific Flags will come from OEM specific header files */
++typedef struct _MPI2_CONFIG_PAGE_MAN_10 {
++ MPI2_CONFIG_PAGE_HEADER Header; /* 00h */
++ U8 OEMIdentifier; /* 04h */
++ U8 Reserved1; /* 05h */
++ U16 Reserved2; /* 08h */
++ U32 Reserved3; /* 0Ch */
++ U32 GenericFlags0; /* 10h */
++ U32 GenericFlags1; /* 14h */
++ U32 Reserved4; /* 18h */
++ U32 OEMSpecificFlags0; /* 1Ch */
++ U32 OEMSpecificFlags1; /* 20h */
++ U32 Reserved5[18]; /* 24h-60h*/
++} MPI2_CONFIG_PAGE_MAN_10,
++ MPI2_POINTER PTR_MPI2_CONFIG_PAGE_MAN_10,
++ Mpi2ManufacturingPage10_t, MPI2_POINTER pMpi2ManufacturingPage10_t;
++
+ struct MPT2SAS_DEVICE {
+ struct MPT2SAS_TARGET *sas_target;
+ unsigned int lun;
+@@ -461,6 +493,7 @@ typedef void (*MPT_ADD_SGE)(void *paddr,
+ * @facts: static facts data
+ * @pfacts: static port facts data
+ * @manu_pg0: static manufacturing page 0
++ * @manu_pg10: static manufacturing page 10
+ * @bios_pg2: static bios page 2
+ * @bios_pg3: static bios page 3
+ * @ioc_pg8: static ioc page 8
+@@ -663,6 +696,7 @@ struct MPT2SAS_ADAPTER {
+ dma_addr_t diag_buffer_dma[MPI2_DIAG_BUF_TYPE_COUNT];
+ u8 diag_buffer_status[MPI2_DIAG_BUF_TYPE_COUNT];
+ u32 unique_id[MPI2_DIAG_BUF_TYPE_COUNT];
++ Mpi2ManufacturingPage10_t manu_pg10;
+ u32 product_specific[MPI2_DIAG_BUF_TYPE_COUNT][23];
+ u32 diagnostic_flags[MPI2_DIAG_BUF_TYPE_COUNT];
+ };
+@@ -734,6 +768,8 @@ void mpt2sas_config_done(struct MPT2SAS_
+ int mpt2sas_config_get_number_hba_phys(struct MPT2SAS_ADAPTER *ioc, u8 *num_phys);
+ int mpt2sas_config_get_manufacturing_pg0(struct MPT2SAS_ADAPTER *ioc,
+ Mpi2ConfigReply_t *mpi_reply, Mpi2ManufacturingPage0_t *config_page);
++int mpt2sas_config_get_manufacturing_pg10(struct MPT2SAS_ADAPTER *ioc,
++ Mpi2ConfigReply_t *mpi_reply, Mpi2ManufacturingPage10_t *config_page);
+ int mpt2sas_config_get_bios_pg2(struct MPT2SAS_ADAPTER *ioc, Mpi2ConfigReply_t
+ *mpi_reply, Mpi2BiosPage2_t *config_page);
+ int mpt2sas_config_get_bios_pg3(struct MPT2SAS_ADAPTER *ioc, Mpi2ConfigReply_t
+@@ -776,7 +812,6 @@ int mpt2sas_config_get_volume_handle(str
+ u16 *volume_handle);
+ int mpt2sas_config_get_volume_wwid(struct MPT2SAS_ADAPTER *ioc, u16 volume_handle,
+ u64 *wwid);
+-
+ /* ctl shared API */
+ extern struct device_attribute *mpt2sas_host_attrs[];
+ extern struct device_attribute *mpt2sas_dev_attrs[];
+--- a/drivers/scsi/mpt2sas/mpt2sas_config.c
++++ b/drivers/scsi/mpt2sas/mpt2sas_config.c
+@@ -426,6 +426,67 @@ mpt2sas_config_get_manufacturing_pg0(str
+ }
+
+ /**
++ * mpt2sas_config_get_manufacturing_pg10 - obtain manufacturing page 10
++ * @ioc: per adapter object
++ * @mpi_reply: reply mf payload returned from firmware
++ * @config_page: contents of the config page
++ * Context: sleep.
++ *
++ * Returns 0 for success, non-zero for failure.
++ */
++int
++mpt2sas_config_get_manufacturing_pg10(struct MPT2SAS_ADAPTER *ioc,
++ Mpi2ConfigReply_t *mpi_reply, Mpi2ManufacturingPage10_t *config_page)
++{
++ Mpi2ConfigRequest_t mpi_request;
++ int r;
++ struct config_request mem;
++
++ memset(config_page, 0, sizeof(Mpi2ManufacturingPage10_t));
++ memset(&mpi_request, 0, sizeof(Mpi2ConfigRequest_t));
++ mpi_request.Function = MPI2_FUNCTION_CONFIG;
++ mpi_request.Action = MPI2_CONFIG_ACTION_PAGE_HEADER;
++ mpi_request.Header.PageType = MPI2_CONFIG_PAGETYPE_MANUFACTURING;
++ mpi_request.Header.PageNumber = 10;
++ mpi_request.Header.PageVersion = MPI2_MANUFACTURING0_PAGEVERSION;
++ mpt2sas_base_build_zero_len_sge(ioc, &mpi_request.PageBufferSGE);
++ r = _config_request(ioc, &mpi_request, mpi_reply,
++ MPT2_CONFIG_PAGE_DEFAULT_TIMEOUT);
++ if (r)
++ goto out;
++
++ mpi_request.Action = MPI2_CONFIG_ACTION_PAGE_READ_CURRENT;
++ mpi_request.Header.PageVersion = mpi_reply->Header.PageVersion;
++ mpi_request.Header.PageNumber = mpi_reply->Header.PageNumber;
++ mpi_request.Header.PageType = mpi_reply->Header.PageType;
++ mpi_request.Header.PageLength = mpi_reply->Header.PageLength;
++ mem.config_page_sz = le16_to_cpu(mpi_reply->Header.PageLength) * 4;
++ if (mem.config_page_sz > ioc->config_page_sz) {
++ r = _config_alloc_config_dma_memory(ioc, &mem);
++ if (r)
++ goto out;
++ } else {
++ mem.config_page_dma = ioc->config_page_dma;
++ mem.config_page = ioc->config_page;
++ }
++ ioc->base_add_sg_single(&mpi_request.PageBufferSGE,
++ MPT2_CONFIG_COMMON_SGLFLAGS | mem.config_page_sz,
++ mem.config_page_dma);
++ r = _config_request(ioc, &mpi_request, mpi_reply,
++ MPT2_CONFIG_PAGE_DEFAULT_TIMEOUT);
++ if (!r)
++ memcpy(config_page, mem.config_page,
++ min_t(u16, mem.config_page_sz,
++ sizeof(Mpi2ManufacturingPage10_t)));
++
++ if (mem.config_page_sz > ioc->config_page_sz)
++ _config_free_config_dma_memory(ioc, &mem);
++
++ out:
++ return r;
++}
++
++/**
+ * mpt2sas_config_get_bios_pg2 - obtain bios page 2
+ * @ioc: per adapter object
+ * @mpi_reply: reply mf payload returned from firmware
+--- a/drivers/scsi/mpt2sas/mpt2sas_scsih.c
++++ b/drivers/scsi/mpt2sas/mpt2sas_scsih.c
+@@ -1501,7 +1501,13 @@ _scsih_slave_configure(struct scsi_devic
+ break;
+ case MPI2_RAID_VOL_TYPE_RAID1E:
+ qdepth = MPT2SAS_RAID_QUEUE_DEPTH;
+- r_level = "RAID1E";
++ if (ioc->manu_pg10.OEMIdentifier &&
++ (ioc->manu_pg10.GenericFlags0 &
++ MFG10_GF0_R10_DISPLAY) &&
++ !(raid_device->num_pds % 2))
++ r_level = "RAID10";
++ else
++ r_level = "RAID1E";
+ break;
+ case MPI2_RAID_VOL_TYPE_RAID1:
+ qdepth = MPT2SAS_RAID_QUEUE_DEPTH;
+
+
+From gregkh@mini.kroah.org Wed Sep 16 15:37:14 2009
+Message-Id: <20090916223714.118636080@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Sep 2009 15:36:19 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ James Bottomley <James.Bottomley@suse.de>
+Subject: [patch 06/45] SCSI: fix oops during scsi scanning
+References: <20090916223613.597295240@mini.kroah.org>
+Content-Disposition: inline; filename=scsi-fix-oops-during-scsi-scanning.patch
+Content-Length: 5801
+Lines: 101
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: James Bottomley <James.Bottomley@suse.de>
+
+commit ea038f63ac52439e7816295fa6064fe95e6c1f51 upstream.
+
+Chris Webb reported:
+ p0# uname -a
+ Linux f7ea8425-d45b-490f-a738-d181d0df6963.host.elastichosts.com 2.6.30.4-elastic-lon-p #2 SMP PREEMPT Thu Aug 20 14:30:50 BST 2009 x86_64 Intel(R) Xeon(R) CPU E5420 @ 2.50GHz GenuineIntel GNU/Linux
+ p0# zgrep SCAN_ASYNC /proc/config.gz
+ # CONFIG_SCSI_SCAN_ASYNC is not set
+
+ p0# cat /var/log/kern/2009-08-20
+ [...]
+ 15:27:10.485 kernel: scsi9 : iSCSI Initiator over TCP/IP
+ 15:27:11.493 kernel: scsi 9:0:0:0: RAID IET Controller 0001 PQ: 0 ANSI: 5
+ 15:27:11.493 kernel: scsi 9:0:0:0: Attached scsi generic sg6 type 12
+ 15:27:11.495 kernel: scsi 9:0:0:1: Direct-Access IET VIRTUAL-DISK 0001 PQ: 0 ANSI: 5
+ 15:27:11.495 kernel: sd 9:0:0:1: Attached scsi generic sg7 type 0
+ 15:27:11.495 kernel: sd 9:0:0:1: [sdg] 4194304 512-byte hardware sectors: (2.14 GB/2.00 GiB)
+ 15:27:11.495 kernel: sd 9:0:0:1: [sdg] Write Protect is off
+ 15:27:11.495 kernel: sd 9:0:0:1: [sdg] Write cache: disabled, read cache: enabled, doesn't support DPO or FUA
+ 15:27:13.012 kernel: sdg:<6>scsi 9:0:0:1: [sdg] Unhandled error code
+ 15:27:13.012 kernel: scsi 9:0:0:1: [sdg] Result: hostbyte=0x07 driverbyte=0x00
+ 15:27:13.012 kernel: end_request: I/O error, dev sdg, sector 0
+ 15:27:13.012 kernel: Buffer I/O error on device sdg, logical block 0
+ 15:27:13.012 kernel: ldm_validate_partition_table(): Disk read failed.
+ 15:27:13.012 kernel: unable to read partition table
+ 15:27:13.014 kernel: BUG: unable to handle kernel NULL pointer dereference at 0000000000000010
+ 15:27:13.014 kernel: IP: [<ffffffff803f0d77>] disk_part_iter_next+0x74/0xfd
+ 15:27:13.014 kernel: PGD 82ad0b067 PUD 82cd7e067 PMD 0
+ 15:27:13.014 kernel: Oops: 0000 [#1] PREEMPT SMP
+ 15:27:13.014 kernel: last sysfs file: /sys/devices/platform/host9/session4/iscsi_session/session4/ifacename
+ 15:27:13.014 kernel: CPU 5
+ 15:27:13.014 kernel: Modules linked in:
+ 15:27:13.014 kernel: Pid: 13999, comm: async/0 Not tainted 2.6.30.4-elastic-lon-p #2 X7DBN
+ 15:27:13.014 kernel: RIP: 0010:[<ffffffff803f0d77>] [<ffffffff803f0d77>] disk_part_iter_next+0x74/0xfd
+ 15:27:13.014 kernel: RSP: 0018:ffff88066afa3dd0 EFLAGS: 00010246
+ 15:27:13.014 kernel: RAX: ffff88082b58a000 RBX: ffff88066afa3e00 RCX: 0000000000000000
+ 15:27:13.014 kernel: RDX: 0000000000000000 RSI: ffff88082b58a000 RDI: 0000000000000000
+ 15:27:13.014 kernel: RBP: ffff88066afa3df0 R08: ffff88066afa2000 R09: ffff8806a204f000
+ 15:27:13.014 kernel: R10: 000000fb12c7d274 R11: ffff8806c2bf0628 R12: ffff88066afa3e00
+ 15:27:13.014 kernel: R13: ffff88082c829a00 R14: 0000000000000000 R15: ffff8806bc50c920
+ 15:27:13.014 kernel: FS: 0000000000000000(0000) GS:ffff88002818a000(0000) knlGS:0000000000000000
+ 15:27:13.014 kernel: CS: 0010 DS: 0018 ES: 0018 CR0: 000000008005003b
+ 15:27:13.014 kernel: CR2: 0000000000000010 CR3: 000000082ade3000 CR4: 00000000000426e0
+ 15:27:13.014 kernel: DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+ 15:27:13.014 kernel: DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
+ 15:27:13.014 kernel: Process async/0 (pid: 13999, threadinfo ffff88066afa2000, task ffff8806c2bf05e0)
+ 15:27:13.014 kernel: Stack:
+ 15:27:13.014 kernel: 0000000000000000 ffff88066afa3e00 ffff88066afa3e00 ffff88082c829a00
+ 15:27:13.014 kernel: ffff88066afa3e40 ffffffff80306feb ffff88082b58a000 0000000000000000
+ 15:27:13.014 kernel: 0000000000000001 ffff8806bc50c920 ffff88066afa3e40 ffff88082b58a000
+ 15:27:13.014 kernel: Call Trace:
+ 15:27:13.014 kernel: [<ffffffff80306feb>] register_disk+0x122/0x13a
+ 15:27:13.014 kernel: [<ffffffff803f0b0f>] add_disk+0xaa/0x106
+ 15:27:13.014 kernel: [<ffffffff80493609>] sd_probe_async+0x198/0x25b
+ 15:27:13.014 kernel: [<ffffffff80270482>] async_thread+0x10c/0x20d
+ 15:27:13.014 kernel: [<ffffffff802545ff>] ? default_wake_function+0x0/0xf
+ 15:27:13.014 kernel: [<ffffffff80270376>] ? async_thread+0x0/0x20d
+ 15:27:13.014 kernel: [<ffffffff8026ad89>] kthread+0x55/0x80
+ 15:27:13.014 kernel: [<ffffffff8022be6a>] child_rip+0xa/0x20
+ 15:27:13.014 kernel: [<ffffffff8026ad34>] ? kthread+0x0/0x80
+ 15:27:13.014 kernel: [<ffffffff8022be60>] ? child_rip+0x0/0x20
+ 15:27:13.014 kernel: Code: c8 ff 80 e1 0c b9 00 00 00 00 0f 44 c1 41 83 cd ff 48 8d 7a 20 48 be ff ff ff ff 08 00 00 00 48 b9 00 00 00 00 08 00 00 00 eb 50 <8b> 42 10 41 bd 01 00 00 00 eb db 4c 63 c2 4e 8d 04 c7 4d 8b 20
+ 15:27:13.015 kernel: RIP [<ffffffff803f0d77>] disk_part_iter_next+0x74/0xfd
+ 15:27:13.015 kernel: RSP <ffff88066afa3dd0>
+ 15:27:13.015 kernel: CR2: 0000000000000010
+ 15:27:13.015 kernel: ---[ end trace 6104b56ef5590e25 ]---
+
+The problem is caused because the async scanning split in sd.c doesn't hold
+any reference to the device when it kicks off the async piece. What's
+happening is that an iSCSI disconnect is destorying the device again *before*
+the async sd scanning thread even starts. Fix this by taking a reference
+before starting the thread and dropping it again when the thread completes.
+
+Reported-by: Chris Webb <chris@arachsys.com>
+Signed-off-by: James Bottomley <James.Bottomley@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/scsi/sd.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/scsi/sd.c
++++ b/drivers/scsi/sd.c
+@@ -2021,6 +2021,7 @@ static void sd_probe_async(void *data, a
+
+ sd_printk(KERN_NOTICE, sdkp, "Attached SCSI %sdisk\n",
+ sdp->removable ? "removable " : "");
++ put_device(&sdkp->dev);
+ }
+
+ /**
+@@ -2106,6 +2107,7 @@ static int sd_probe(struct device *dev)
+
+ get_device(&sdp->sdev_gendev);
+
++ get_device(&sdkp->dev); /* prevent release before async_schedule */
+ async_schedule(sd_probe_async, sdkp);
+
+ return 0;
+
+
+From gregkh@mini.kroah.org Wed Sep 16 15:37:14 2009
+Message-Id: <20090916223714.254153168@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Sep 2009 15:36:20 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Bart Van Assche <bart.vanassche@gmail.com>,
+ FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>,
+ James Bottomley <James.Bottomley@suse.de>
+Subject: [patch 07/45] SCSI: libsrp: fix memory leak in srp_ring_free()
+References: <20090916223613.597295240@mini.kroah.org>
+Content-Disposition: inline; filename=scsi-libsrp-fix-memory-leak-in-srp_ring_free.patch
+Content-Length: 1259
+Lines: 35
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Bart Van Assche <bart.vanassche@gmail.com>
+
+commit afffd3dabe5209882c8cc59a373a4d33b5db304a upstream.
+
+This patch fixes a memory leak in the libsrp function srp_ring_free().
+It is not documented whether or not this function should free the ring
+pointer itself. But the source code of the callers of this function
+(srp_target_alloc() and srp_target_free()) makes it clear that
+srp_ring_free() should deallocate the ring pointer itself. Furthermore,
+the patch below makes srp_ring_free() deallocate all memory allocated by
+srp_ring_alloc().
+
+This patch affects the ibmvstgt driver, which is the only in-tree driver
+that calls the srp_ring_free() function (indirectly).
+
+Signed-off-by: Bart Van Assche <bart.vanassche@gmail.com>
+Acked-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
+Signed-off-by: James Bottomley <James.Bottomley@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/scsi/libsrp.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/scsi/libsrp.c
++++ b/drivers/scsi/libsrp.c
+@@ -124,6 +124,7 @@ static void srp_ring_free(struct device
+ dma_free_coherent(dev, size, ring[i]->buf, ring[i]->dma);
+ kfree(ring[i]);
+ }
++ kfree(ring);
+ }
+
+ int srp_target_alloc(struct srp_target *target, struct device *dev,
+
+
+From gregkh@mini.kroah.org Wed Sep 16 15:37:14 2009
+Message-Id: <20090916223714.392730496@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Sep 2009 15:36:21 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Bob Copeland <me@bobcopeland.com>,
+ "John W. Linville" <linville@tuxdriver.com>
+Subject: [patch 08/45] cfg80211: fix looping soft lockup in find_ie()
+References: <20090916223613.597295240@mini.kroah.org>
+Content-Disposition: inline; filename=cfg80211-fix-looping-soft-lockup-in-find_ie.patch
+Content-Length: 4471
+Lines: 79
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Bob Copeland <me@bobcopeland.com>
+
+commit fcc6cb0c13555e78c2d47257b6d1b5e59b0c419a upstream.
+
+The find_ie() function uses a size_t for the len parameter, and
+directly uses len as a loop variable. If any received packets
+are malformed, it is possible for the decrease of len to overflow,
+and since the result is unsigned, the loop will not terminate.
+Change it to a signed int so the loop conditional works for
+negative values.
+
+This fixes the following soft lockup:
+
+[38573.102007] BUG: soft lockup - CPU#0 stuck for 61s! [phy0:2230]
+[38573.102007] Modules linked in: aes_i586 aes_generic fuse af_packet ipt_REJECT xt_tcpudp nf_conntrack_ipv4 nf_defrag_ipv4 xt_state iptable_filter ip_tables x_tables acpi_cpufreq binfmt_misc dm_mirror dm_region_hash dm_log dm_multipath dm_mod kvm_intel kvm uinput i915 arc4 ecb drm snd_hda_codec_idt ath5k snd_hda_intel hid_apple mac80211 usbhid appletouch snd_hda_codec snd_pcm ath cfg80211 snd_timer i2c_algo_bit ohci1394 video snd processor ieee1394 rfkill ehci_hcd sg sky2 backlight snd_page_alloc uhci_hcd joydev output ac thermal button battery sr_mod applesmc cdrom input_polldev evdev unix [last unloaded: scsi_wait_scan]
+[38573.102007] irq event stamp: 2547724535
+[38573.102007] hardirqs last enabled at (2547724534): [<c1002ffc>] restore_all_notrace+0x0/0x18
+[38573.102007] hardirqs last disabled at (2547724535): [<c10038f4>] apic_timer_interrupt+0x28/0x34
+[38573.102007] softirqs last enabled at (92950144): [<c103ab48>] __do_softirq+0x108/0x210
+[38573.102007] softirqs last disabled at (92950274): [<c1348e74>] _spin_lock_bh+0x14/0x80
+[38573.102007]
+[38573.102007] Pid: 2230, comm: phy0 Tainted: G W (2.6.31-rc7-wl #8) MacBook1,1
+[38573.102007] EIP: 0060:[<f8ea2d50>] EFLAGS: 00010292 CPU: 0
+[38573.102007] EIP is at cmp_ies+0x30/0x180 [cfg80211]
+[38573.102007] EAX: 00000082 EBX: 00000000 ECX: ffffffc1 EDX: d8efd014
+[38573.102007] ESI: ffffff7c EDI: 0000004d EBP: eee2dc50 ESP: eee2dc3c
+[38573.102007] DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068
+[38573.102007] CR0: 8005003b CR2: d8efd014 CR3: 01694000 CR4: 000026d0
+[38573.102007] DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000
+[38573.102007] DR6: ffff0ff0 DR7: 00000400
+[38573.102007] Call Trace:
+[38573.102007] [<f8ea2f8d>] cmp_bss+0xed/0x100 [cfg80211]
+[38573.102007] [<f8ea33e4>] cfg80211_bss_update+0x84/0x410 [cfg80211]
+[38573.102007] [<f8ea3884>] cfg80211_inform_bss_frame+0x114/0x180 [cfg80211]
+[38573.102007] [<f97255ff>] ieee80211_bss_info_update+0x4f/0x180 [mac80211]
+[38573.102007] [<f972b118>] ieee80211_rx_bss_info+0x88/0xf0 [mac80211]
+[38573.102007] [<f9739297>] ? ieee802_11_parse_elems+0x27/0x30 [mac80211]
+[38573.102007] [<f972b224>] ieee80211_rx_mgmt_probe_resp+0xa4/0x1c0 [mac80211]
+[38573.102007] [<f972bc59>] ieee80211_sta_rx_queued_mgmt+0x919/0xc50 [mac80211]
+[38573.102007] [<c1009707>] ? sched_clock+0x27/0xa0
+[38573.102007] [<c1009707>] ? sched_clock+0x27/0xa0
+[38573.102007] [<c105ffd0>] ? mark_held_locks+0x60/0x80
+[38573.102007] [<c1348be5>] ? _spin_unlock_irqrestore+0x55/0x70
+[38573.102007] [<c134baa5>] ? sub_preempt_count+0x85/0xc0
+[38573.102007] [<c1348bce>] ? _spin_unlock_irqrestore+0x3e/0x70
+[38573.102007] [<c12c1c0f>] ? skb_dequeue+0x4f/0x70
+[38573.102007] [<f972c021>] ieee80211_sta_work+0x91/0xb80 [mac80211]
+[38573.102007] [<c1009707>] ? sched_clock+0x27/0xa0
+[38573.102007] [<c134baa5>] ? sub_preempt_count+0x85/0xc0
+[38573.102007] [<c10479af>] worker_thread+0x18f/0x320
+[38573.102007] [<c104794e>] ? worker_thread+0x12e/0x320
+[38573.102007] [<c1348be5>] ? _spin_unlock_irqrestore+0x55/0x70
+[38573.102007] [<f972bf90>] ? ieee80211_sta_work+0x0/0xb80 [mac80211]
+[38573.102007] [<c104cbb0>] ? autoremove_wake_function+0x0/0x50
+[38573.102007] [<c1047820>] ? worker_thread+0x0/0x320
+[38573.102007] [<c104c854>] kthread+0x84/0x90
+[38573.102007] [<c104c7d0>] ? kthread+0x0/0x90
+[38573.102007] [<c1003ab7>] kernel_thread_helper+0x7/0x10
+
+Signed-off-by: Bob Copeland <me@bobcopeland.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/wireless/scan.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/wireless/scan.c
++++ b/net/wireless/scan.c
+@@ -97,7 +97,7 @@ void cfg80211_bss_expire(struct cfg80211
+ dev->bss_generation++;
+ }
+
+-static u8 *find_ie(u8 num, u8 *ies, size_t len)
++static u8 *find_ie(u8 num, u8 *ies, int len)
+ {
+ while (len > 2 && ies[0] != num) {
+ len -= ies[1] + 2;
+
+
+From gregkh@mini.kroah.org Wed Sep 16 15:37:14 2009
+Message-Id: <20090916223714.527518502@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Sep 2009 15:36:22 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Bob Copeland <me@bobcopeland.com>,
+ "John W. Linville" <linville@tuxdriver.com>
+Subject: [patch 09/45] ath5k: write PCU registers on initial reset
+References: <20090916223613.597295240@mini.kroah.org>
+Content-Disposition: inline; filename=ath5k-write-pcu-registers-on-initial-reset.patch
+Content-Length: 1097
+Lines: 31
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Bob Copeland <me@bobcopeland.com>
+
+commit 3355443ad7601991affa5992b0d53870335af765 upstream.
+
+"Ath5k: unify resets"
+introduced a regression into 2.6.28 where the PCU registers are never
+initialized, due to ath5k_reset() always passing true for change_channel.
+We subsequently program a lot of these registers but several may start
+in an unknown state.
+
+Reported-by: Forrest Zhang <forrest@hifulltech.com>
+Signed-off-by: Bob Copeland <me@bobcopeland.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/ath/ath5k/base.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/ath/ath5k/base.c
++++ b/drivers/net/wireless/ath/ath5k/base.c
+@@ -2676,7 +2676,7 @@ ath5k_reset(struct ath5k_softc *sc, stru
+ sc->curchan = chan;
+ sc->curband = &sc->sbands[chan->band];
+ }
+- ret = ath5k_hw_reset(ah, sc->opmode, sc->curchan, true);
++ ret = ath5k_hw_reset(ah, sc->opmode, sc->curchan, chan != NULL);
+ if (ret) {
+ ATH5K_ERR(sc, "can't reset hardware (%d)\n", ret);
+ goto err;
+
+
+From gregkh@mini.kroah.org Wed Sep 16 15:37:14 2009
+Message-Id: <20090916223714.674467550@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Sep 2009 15:36:23 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Roland McGrath <roland@redhat.com>,
+ James Morris <jmorris@namei.org>
+Subject: [patch 10/45] binfmt_elf: fix PT_INTERP bss handling
+References: <20090916223613.597295240@mini.kroah.org>
+Content-Disposition: inline; filename=binfmt_elf-fix-pt_interp-bss-handling.patch
+Content-Length: 2694
+Lines: 83
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Roland McGrath <roland@redhat.com>
+
+commit 9f0ab4a3f0fdb1ff404d150618ace2fa069bb2e1 upstream.
+
+In fs/binfmt_elf.c, load_elf_interp() calls padzero() for .bss even if
+the PT_LOAD has no PROT_WRITE and no .bss. This generates EFAULT.
+
+Here is a small test case. (Yes, there are other, useful PT_INTERP
+which have only .text and no .data/.bss.)
+
+ ----- ptinterp.S
+ _start: .globl _start
+ nop
+ int3
+ -----
+ $ gcc -m32 -nostartfiles -nostdlib -o ptinterp ptinterp.S
+ $ gcc -m32 -Wl,--dynamic-linker=ptinterp -o hello hello.c
+ $ ./hello
+ Segmentation fault # during execve() itself
+
+ After applying the patch:
+ $ ./hello
+ Trace trap # user-mode execution after execve() finishes
+
+If the ELF headers are actually self-inconsistent, then dying is fine.
+But having no PROT_WRITE segment is perfectly normal and correct if
+there is no segment with p_memsz > p_filesz (i.e. bss). John Reiser
+suggested checking for PROT_WRITE in the bss logic. I think it makes
+most sense to simply apply the bss logic only when there is bss.
+
+This patch looks less trivial than it is due to some reindentation.
+It just moves the "if (last_bss > elf_bss) {" test up to include the
+partial-page bss logic as well as the more-pages bss logic.
+
+Reported-by: John Reiser <jreiser@bitwagon.com>
+Signed-off-by: Roland McGrath <roland@redhat.com>
+Signed-off-by: James Morris <jmorris@namei.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/binfmt_elf.c | 28 ++++++++++++++--------------
+ 1 file changed, 14 insertions(+), 14 deletions(-)
+
+--- a/fs/binfmt_elf.c
++++ b/fs/binfmt_elf.c
+@@ -501,22 +501,22 @@ static unsigned long load_elf_interp(str
+ }
+ }
+
+- /*
+- * Now fill out the bss section. First pad the last page up
+- * to the page boundary, and then perform a mmap to make sure
+- * that there are zero-mapped pages up to and including the
+- * last bss page.
+- */
+- if (padzero(elf_bss)) {
+- error = -EFAULT;
+- goto out_close;
+- }
++ if (last_bss > elf_bss) {
++ /*
++ * Now fill out the bss section. First pad the last page up
++ * to the page boundary, and then perform a mmap to make sure
++ * that there are zero-mapped pages up to and including the
++ * last bss page.
++ */
++ if (padzero(elf_bss)) {
++ error = -EFAULT;
++ goto out_close;
++ }
+
+- /* What we have mapped so far */
+- elf_bss = ELF_PAGESTART(elf_bss + ELF_MIN_ALIGN - 1);
++ /* What we have mapped so far */
++ elf_bss = ELF_PAGESTART(elf_bss + ELF_MIN_ALIGN - 1);
+
+- /* Map the last of the bss segment */
+- if (last_bss > elf_bss) {
++ /* Map the last of the bss segment */
+ down_write(¤t->mm->mmap_sem);
+ error = do_brk(elf_bss, last_bss - elf_bss);
+ up_write(¤t->mm->mmap_sem);
+
+
+From gregkh@mini.kroah.org Wed Sep 16 15:37:14 2009
+Message-Id: <20090916223714.807142378@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Sep 2009 15:36:24 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jason Gunthorpe <jgunthorpe@obsidianresearch.com>,
+ Rajiv Andrade <srajiv@linux.vnet.ibm.com>,
+ James Morris <jmorris@namei.org>
+Subject: [patch 11/45] TPM: Fixup boot probe timeout for tpm_tis driver
+References: <20090916223613.597295240@mini.kroah.org>
+Content-Disposition: inline; filename=tpm-fixup-boot-probe-timeout-for-tpm_tis-driver.patch
+Content-Length: 1887
+Lines: 51
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Jason Gunthorpe <jgunthorpe@obsidianresearch.com>
+
+commit ec57935837a78f9661125b08a5d08b697568e040 upstream.
+
+When probing the device in tpm_tis_init the call request_locality
+uses timeout_a, which wasn't being initalized until after
+request_locality. This results in request_locality falsely timing
+out if the chip is still starting. Move the initialization to before
+request_locality.
+
+This probably only matters for embedded cases (ie mine), a BIOS likely
+gets the TPM into a state where this code path isn't necessary.
+
+Signed-off-by: Jason Gunthorpe <jgunthorpe@obsidianresearch.com>
+Acked-by: Rajiv Andrade <srajiv@linux.vnet.ibm.com>
+Signed-off-by: James Morris <jmorris@namei.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/char/tpm/tpm_tis.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+--- a/drivers/char/tpm/tpm_tis.c
++++ b/drivers/char/tpm/tpm_tis.c
+@@ -450,6 +450,12 @@ static int tpm_tis_init(struct device *d
+ goto out_err;
+ }
+
++ /* Default timeouts */
++ chip->vendor.timeout_a = msecs_to_jiffies(TIS_SHORT_TIMEOUT);
++ chip->vendor.timeout_b = msecs_to_jiffies(TIS_LONG_TIMEOUT);
++ chip->vendor.timeout_c = msecs_to_jiffies(TIS_SHORT_TIMEOUT);
++ chip->vendor.timeout_d = msecs_to_jiffies(TIS_SHORT_TIMEOUT);
++
+ if (request_locality(chip, 0) != 0) {
+ rc = -ENODEV;
+ goto out_err;
+@@ -457,12 +463,6 @@ static int tpm_tis_init(struct device *d
+
+ vendor = ioread32(chip->vendor.iobase + TPM_DID_VID(0));
+
+- /* Default timeouts */
+- chip->vendor.timeout_a = msecs_to_jiffies(TIS_SHORT_TIMEOUT);
+- chip->vendor.timeout_b = msecs_to_jiffies(TIS_LONG_TIMEOUT);
+- chip->vendor.timeout_c = msecs_to_jiffies(TIS_SHORT_TIMEOUT);
+- chip->vendor.timeout_d = msecs_to_jiffies(TIS_SHORT_TIMEOUT);
+-
+ dev_info(dev,
+ "1.2 TPM (device-id 0x%X, rev-id %d)\n",
+ vendor >> 16, ioread8(chip->vendor.iobase + TPM_RID(0)));
+
+
+From gregkh@mini.kroah.org Wed Sep 16 15:37:15 2009
+Message-Id: <20090916223714.964459375@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Sep 2009 15:36:25 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Geert Uytterhoeven <geert@linux-m68k.org>
+Subject: [patch 12/45] md: Fix "strchr" [drivers/md/dm-log-userspace.ko] undefined!
+References: <20090916223613.597295240@mini.kroah.org>
+Content-Disposition: inline; filename=md-fix-strchr-undefined.patch
+Content-Length: 1254
+Lines: 36
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Geert Uytterhoeven <geert@linux-m68k.org>
+
+commit 0d03d59d9b31cd1e33b7e46a80b6fef66244b1f2 upstream.
+
+Commit b8313b6da7e2e7c7f47d93d8561969a3ff9ba0ea ("dm log: remove incorrect
+field from userspace table output") added a call to strstr() with a
+single-character "needle" string parameter.
+
+Unfortunately some versions of gcc replace such calls to strstr() by calls
+to strchr() behind our back. This causes linking errors if strchr() is
+defined as an inline function in <asm/string.h> (e.g. on m68k):
+
+| WARNING: "strchr" [drivers/md/dm-log-userspace.ko] undefined!
+
+Avoid this by explicitly calling strchr() instead.
+
+Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/dm-log-userspace-base.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/md/dm-log-userspace-base.c
++++ b/drivers/md/dm-log-userspace-base.c
+@@ -582,7 +582,7 @@ static int userspace_status(struct dm_di
+ break;
+ case STATUSTYPE_TABLE:
+ sz = 0;
+- table_args = strstr(lc->usr_argv_str, " ");
++ table_args = strchr(lc->usr_argv_str, ' ');
+ BUG_ON(!table_args); /* There will always be a ' ' */
+ table_args++;
+
+
+
+From gregkh@mini.kroah.org Wed Sep 16 15:37:15 2009
+Message-Id: <20090916223715.136276870@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Sep 2009 15:36:26 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Joerg Roedel <joerg.roedel@amd.com>
+Subject: [patch 13/45] x86/amd-iommu: fix broken check in amd_iommu_flush_all_devices
+References: <20090916223613.597295240@mini.kroah.org>
+Content-Disposition: inline; filename=x86-amd-iommu-fix-broken-check-in-amd_iommu_flush_all_devices.patch
+Content-Length: 704
+Lines: 27
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Joerg Roedel <joerg.roedel@amd.com>
+
+commit e0faf54ee82bf9c07f0307b4391caad4020bd659 upstream.
+
+The amd_iommu_pd_table is indexed by protection domain
+number and not by device id. So this check is broken and
+must be removed.
+
+Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/amd_iommu.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/arch/x86/kernel/amd_iommu.c
++++ b/arch/x86/kernel/amd_iommu.c
+@@ -485,8 +485,6 @@ void amd_iommu_flush_all_devices(void)
+ int i;
+
+ for (i = 0; i <= amd_iommu_last_bdf; ++i) {
+- if (amd_iommu_pd_table[i] == NULL)
+- continue;
+
+ iommu = amd_iommu_rlookup_table[i];
+ if (!iommu)
+
+
+From gregkh@mini.kroah.org Wed Sep 16 15:37:15 2009
+Message-Id: <20090916223715.315062589@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Sep 2009 15:36:27 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Hugh Dickins <hugh.dickins@tiscali.co.uk>
+Subject: [patch 14/45] fix undefined reference to user_shm_unlock
+References: <20090916223613.597295240@mini.kroah.org>
+Content-Disposition: inline; filename=fix-undefined-reference-to-user_shm_unlock.patch
+Content-Length: 1113
+Lines: 33
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Hugh Dickins <hugh.dickins@tiscali.co.uk>
+
+commit 2195d2818c37bdf263865f1e9effccdd9fc5f9d4 upstream.
+
+My 353d5c30c666580347515da609dd74a2b8e9b828 "mm: fix hugetlb bug due to
+user_shm_unlock call" broke the CONFIG_SYSVIPC !CONFIG_MMU build of both
+2.6.31 and 2.6.30.6: "undefined reference to `user_shm_unlock'".
+
+gcc didn't understand my comment! so couldn't figure out to optimize
+away user_shm_unlock() from the error path in the hugetlb-less case, as
+it does elsewhere. Help it to do so, in a language it understands.
+
+Reported-by: Mike Frysinger <vapier@gentoo.org>
+Signed-off-by: Hugh Dickins <hugh.dickins@tiscali.co.uk>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ ipc/shm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/ipc/shm.c
++++ b/ipc/shm.c
+@@ -410,7 +410,7 @@ static int newseg(struct ipc_namespace *
+ return error;
+
+ no_id:
+- if (shp->mlock_user) /* shmflg & SHM_HUGETLB case */
++ if (is_file_hugepages(file) && shp->mlock_user)
+ user_shm_unlock(size, shp->mlock_user);
+ fput(file);
+ no_file:
+
+
+From gregkh@mini.kroah.org Wed Sep 16 15:37:15 2009
+Message-Id: <20090916223715.431178121@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Sep 2009 15:36:28 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Xiao Guangrong <xiaoguangrong@cn.fujitsu.com>,
+ Peter Zijlstra <peterz@infradead.org>,
+ Paul Mackerras <paulus@samba.org>,
+ Ingo Molnar <mingo@elte.hu>
+Subject: [patch 15/45] perf_counter: Fix buffer overflow in perf_copy_attr()
+References: <20090916223613.597295240@mini.kroah.org>
+Content-Disposition: inline; filename=perf_counter-fix-buffer-overflow-in-perf_copy_attr.patch
+Content-Length: 925
+Lines: 33
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Xiao Guangrong <xiaoguangrong@cn.fujitsu.com>
+
+commit b3e62e35058fc744ac794611f4e79bcd1c5a4b83 upstream.
+
+If we pass a big size data over perf_counter_open() syscall,
+the kernel will copy this data to a small buffer, it will
+cause kernel crash.
+
+This bug makes the kernel unsafe and non-root local user can
+trigger it.
+
+Signed-off-by: Xiao Guangrong <xiaoguangrong@cn.fujitsu.com>
+Acked-by: Peter Zijlstra <peterz@infradead.org>
+Acked-by: Paul Mackerras <paulus@samba.org>
+LKML-Reference: <4AAF37D4.5010706@cn.fujitsu.com>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/perf_counter.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/kernel/perf_counter.c
++++ b/kernel/perf_counter.c
+@@ -4171,6 +4171,7 @@ static int perf_copy_attr(struct perf_co
+ if (val)
+ goto err_size;
+ }
++ size = sizeof(*attr);
+ }
+
+ ret = copy_from_user(attr, uattr, size);
+
+
+From gregkh@mini.kroah.org Wed Sep 16 15:37:15 2009
+Message-Id: <20090916223715.565352707@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Sep 2009 15:36:29 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Paul Mackerras <paulus@samba.org>,
+ Peter Zijlstra <a.p.zijlstra@chello.nl>,
+ Ingo Molnar <mingo@elte.hu>
+Subject: [patch 16/45] perf_counter: Start counting time enabled when group leader gets enabled
+References: <20090916223613.597295240@mini.kroah.org>
+Content-Disposition: inline; filename=perf_counter-start-counting-time-enabled-when-group-leader-gets-enabled.patch
+Content-Length: 4663
+Lines: 132
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Paul Mackerras <paulus@samba.org>
+
+commit fa289beca9de9119c7760bd984f3640da21bc94c upstream.
+
+Currently, if a group is created where the group leader is
+initially disabled but a non-leader member is initially
+enabled, and then the leader is subsequently enabled some time
+later, the time_enabled for the non-leader member will reflect
+the whole time since it was created, not just the time since
+the leader was enabled.
+
+This is incorrect, because all of the members are effectively
+disabled while the leader is disabled, since none of the
+members can go on the PMU if the leader can't.
+
+Thus we have to update the ->tstamp_enabled for all the enabled
+group members when a group leader is enabled, so that the
+time_enabled computation only counts the time since the leader
+was enabled.
+
+Similarly, when disabling a group leader we have to update the
+time_enabled and time_running for all of the group members.
+
+Also, in update_counter_times, we have to treat a counter whose
+group leader is disabled as being disabled.
+
+Reported-by: Stephane Eranian <eranian@googlemail.com>
+Signed-off-by: Paul Mackerras <paulus@samba.org>
+Acked-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
+LKML-Reference: <19091.29664.342227.445006@drongo.ozlabs.ibm.com>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/perf_counter.c | 43 ++++++++++++++++++++++++++++++-------------
+ 1 file changed, 30 insertions(+), 13 deletions(-)
+
+--- a/kernel/perf_counter.c
++++ b/kernel/perf_counter.c
+@@ -469,7 +469,8 @@ static void update_counter_times(struct
+ struct perf_counter_context *ctx = counter->ctx;
+ u64 run_end;
+
+- if (counter->state < PERF_COUNTER_STATE_INACTIVE)
++ if (counter->state < PERF_COUNTER_STATE_INACTIVE ||
++ counter->group_leader->state < PERF_COUNTER_STATE_INACTIVE)
+ return;
+
+ counter->total_time_enabled = ctx->time - counter->tstamp_enabled;
+@@ -518,7 +519,7 @@ static void __perf_counter_disable(void
+ */
+ if (counter->state >= PERF_COUNTER_STATE_INACTIVE) {
+ update_context_time(ctx);
+- update_counter_times(counter);
++ update_group_times(counter);
+ if (counter == counter->group_leader)
+ group_sched_out(counter, cpuctx, ctx);
+ else
+@@ -573,7 +574,7 @@ static void perf_counter_disable(struct
+ * in, so we can change the state safely.
+ */
+ if (counter->state == PERF_COUNTER_STATE_INACTIVE) {
+- update_counter_times(counter);
++ update_group_times(counter);
+ counter->state = PERF_COUNTER_STATE_OFF;
+ }
+
+@@ -851,6 +852,27 @@ retry:
+ }
+
+ /*
++ * Put a counter into inactive state and update time fields.
++ * Enabling the leader of a group effectively enables all
++ * the group members that aren't explicitly disabled, so we
++ * have to update their ->tstamp_enabled also.
++ * Note: this works for group members as well as group leaders
++ * since the non-leader members' sibling_lists will be empty.
++ */
++static void __perf_counter_mark_enabled(struct perf_counter *counter,
++ struct perf_counter_context *ctx)
++{
++ struct perf_counter *sub;
++
++ counter->state = PERF_COUNTER_STATE_INACTIVE;
++ counter->tstamp_enabled = ctx->time - counter->total_time_enabled;
++ list_for_each_entry(sub, &counter->sibling_list, list_entry)
++ if (sub->state >= PERF_COUNTER_STATE_INACTIVE)
++ sub->tstamp_enabled =
++ ctx->time - sub->total_time_enabled;
++}
++
++/*
+ * Cross CPU call to enable a performance counter
+ */
+ static void __perf_counter_enable(void *info)
+@@ -877,8 +899,7 @@ static void __perf_counter_enable(void *
+
+ if (counter->state >= PERF_COUNTER_STATE_INACTIVE)
+ goto unlock;
+- counter->state = PERF_COUNTER_STATE_INACTIVE;
+- counter->tstamp_enabled = ctx->time - counter->total_time_enabled;
++ __perf_counter_mark_enabled(counter, ctx);
+
+ /*
+ * If the counter is in a group and isn't the group leader,
+@@ -971,11 +992,9 @@ static void perf_counter_enable(struct p
+ * Since we have the lock this context can't be scheduled
+ * in, so we can change the state safely.
+ */
+- if (counter->state == PERF_COUNTER_STATE_OFF) {
+- counter->state = PERF_COUNTER_STATE_INACTIVE;
+- counter->tstamp_enabled =
+- ctx->time - counter->total_time_enabled;
+- }
++ if (counter->state == PERF_COUNTER_STATE_OFF)
++ __perf_counter_mark_enabled(counter, ctx);
++
+ out:
+ spin_unlock_irq(&ctx->lock);
+ }
+@@ -1479,9 +1498,7 @@ static void perf_counter_enable_on_exec(
+ counter->attr.enable_on_exec = 0;
+ if (counter->state >= PERF_COUNTER_STATE_INACTIVE)
+ continue;
+- counter->state = PERF_COUNTER_STATE_INACTIVE;
+- counter->tstamp_enabled =
+- ctx->time - counter->total_time_enabled;
++ __perf_counter_mark_enabled(counter, ctx);
+ enabled = 1;
+ }
+
+
+
+From gregkh@mini.kroah.org Wed Sep 16 15:37:15 2009
+Message-Id: <20090916223715.733319934@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Sep 2009 15:36:30 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Paul Mackerras <paulus@samba.org>,
+ Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Subject: [patch 17/45] powerpc/perf_counters: Reduce stack usage of power_check_constraints
+References: <20090916223613.597295240@mini.kroah.org>
+Content-Disposition: inline; filename=powerpc-perf_counters-reduce-stack-usage-of-power_check_constraints.patch
+Content-Length: 6474
+Lines: 176
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Paul Mackerras <paulus@samba.org>
+
+commit e51ee31e8af22948dcc3b115978469b09c96c3fd upstream.
+
+Michael Ellerman reported stack-frame size warnings being produced
+for power_check_constraints(), which uses an 8*8 array of u64 and
+two 8*8 arrays of unsigned long, which are currently allocated on the
+stack, along with some other smaller variables. These arrays come
+to 1.5kB on 64-bit or 1kB on 32-bit, which is a bit too much for the
+stack.
+
+This fixes the problem by putting these arrays in the existing
+per-cpu cpu_hw_counters struct. This is OK because two of the call
+sites have interrupts disabled already; for the third call site we
+use get_cpu_var, which disables preemption, so we know we won't
+get a context switch while we're in power_check_constraints().
+Note that power_check_constraints() can be called during context
+switch but is not called from interrupts.
+
+Reported-by: Michael Ellerman <michael@ellerman.id.au>
+Signed-off-by: Paul Mackerras <paulus@samba.org>
+Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/powerpc/kernel/perf_counter.c | 55 +++++++++++++++++++++----------------
+ 1 file changed, 32 insertions(+), 23 deletions(-)
+
+--- a/arch/powerpc/kernel/perf_counter.c
++++ b/arch/powerpc/kernel/perf_counter.c
+@@ -32,6 +32,9 @@ struct cpu_hw_counters {
+ unsigned long mmcr[3];
+ struct perf_counter *limited_counter[MAX_LIMITED_HWCOUNTERS];
+ u8 limited_hwidx[MAX_LIMITED_HWCOUNTERS];
++ u64 alternatives[MAX_HWCOUNTERS][MAX_EVENT_ALTERNATIVES];
++ unsigned long amasks[MAX_HWCOUNTERS][MAX_EVENT_ALTERNATIVES];
++ unsigned long avalues[MAX_HWCOUNTERS][MAX_EVENT_ALTERNATIVES];
+ };
+ DEFINE_PER_CPU(struct cpu_hw_counters, cpu_hw_counters);
+
+@@ -245,13 +248,11 @@ static void write_pmc(int idx, unsigned
+ * and see if any combination of alternative codes is feasible.
+ * The feasible set is returned in event[].
+ */
+-static int power_check_constraints(u64 event[], unsigned int cflags[],
++static int power_check_constraints(struct cpu_hw_counters *cpuhw,
++ u64 event[], unsigned int cflags[],
+ int n_ev)
+ {
+ unsigned long mask, value, nv;
+- u64 alternatives[MAX_HWCOUNTERS][MAX_EVENT_ALTERNATIVES];
+- unsigned long amasks[MAX_HWCOUNTERS][MAX_EVENT_ALTERNATIVES];
+- unsigned long avalues[MAX_HWCOUNTERS][MAX_EVENT_ALTERNATIVES];
+ unsigned long smasks[MAX_HWCOUNTERS], svalues[MAX_HWCOUNTERS];
+ int n_alt[MAX_HWCOUNTERS], choice[MAX_HWCOUNTERS];
+ int i, j;
+@@ -266,21 +267,23 @@ static int power_check_constraints(u64 e
+ if ((cflags[i] & PPMU_LIMITED_PMC_REQD)
+ && !ppmu->limited_pmc_event(event[i])) {
+ ppmu->get_alternatives(event[i], cflags[i],
+- alternatives[i]);
+- event[i] = alternatives[i][0];
++ cpuhw->alternatives[i]);
++ event[i] = cpuhw->alternatives[i][0];
+ }
+- if (ppmu->get_constraint(event[i], &amasks[i][0],
+- &avalues[i][0]))
++ if (ppmu->get_constraint(event[i], &cpuhw->amasks[i][0],
++ &cpuhw->avalues[i][0]))
+ return -1;
+ }
+ value = mask = 0;
+ for (i = 0; i < n_ev; ++i) {
+- nv = (value | avalues[i][0]) + (value & avalues[i][0] & addf);
++ nv = (value | cpuhw->avalues[i][0]) +
++ (value & cpuhw->avalues[i][0] & addf);
+ if ((((nv + tadd) ^ value) & mask) != 0 ||
+- (((nv + tadd) ^ avalues[i][0]) & amasks[i][0]) != 0)
++ (((nv + tadd) ^ cpuhw->avalues[i][0]) &
++ cpuhw->amasks[i][0]) != 0)
+ break;
+ value = nv;
+- mask |= amasks[i][0];
++ mask |= cpuhw->amasks[i][0];
+ }
+ if (i == n_ev)
+ return 0; /* all OK */
+@@ -291,10 +294,11 @@ static int power_check_constraints(u64 e
+ for (i = 0; i < n_ev; ++i) {
+ choice[i] = 0;
+ n_alt[i] = ppmu->get_alternatives(event[i], cflags[i],
+- alternatives[i]);
++ cpuhw->alternatives[i]);
+ for (j = 1; j < n_alt[i]; ++j)
+- ppmu->get_constraint(alternatives[i][j],
+- &amasks[i][j], &avalues[i][j]);
++ ppmu->get_constraint(cpuhw->alternatives[i][j],
++ &cpuhw->amasks[i][j],
++ &cpuhw->avalues[i][j]);
+ }
+
+ /* enumerate all possibilities and see if any will work */
+@@ -313,11 +317,11 @@ static int power_check_constraints(u64 e
+ * where k > j, will satisfy the constraints.
+ */
+ while (++j < n_alt[i]) {
+- nv = (value | avalues[i][j]) +
+- (value & avalues[i][j] & addf);
++ nv = (value | cpuhw->avalues[i][j]) +
++ (value & cpuhw->avalues[i][j] & addf);
+ if ((((nv + tadd) ^ value) & mask) == 0 &&
+- (((nv + tadd) ^ avalues[i][j])
+- & amasks[i][j]) == 0)
++ (((nv + tadd) ^ cpuhw->avalues[i][j])
++ & cpuhw->amasks[i][j]) == 0)
+ break;
+ }
+ if (j >= n_alt[i]) {
+@@ -339,7 +343,7 @@ static int power_check_constraints(u64 e
+ svalues[i] = value;
+ smasks[i] = mask;
+ value = nv;
+- mask |= amasks[i][j];
++ mask |= cpuhw->amasks[i][j];
+ ++i;
+ j = -1;
+ }
+@@ -347,7 +351,7 @@ static int power_check_constraints(u64 e
+
+ /* OK, we have a feasible combination, tell the caller the solution */
+ for (i = 0; i < n_ev; ++i)
+- event[i] = alternatives[i][choice[i]];
++ event[i] = cpuhw->alternatives[i][choice[i]];
+ return 0;
+ }
+
+@@ -752,7 +756,7 @@ int hw_perf_group_sched_in(struct perf_c
+ return -EAGAIN;
+ if (check_excludes(cpuhw->counter, cpuhw->flags, n0, n))
+ return -EAGAIN;
+- i = power_check_constraints(cpuhw->events, cpuhw->flags, n + n0);
++ i = power_check_constraints(cpuhw, cpuhw->events, cpuhw->flags, n + n0);
+ if (i < 0)
+ return -EAGAIN;
+ cpuhw->n_counters = n0 + n;
+@@ -807,7 +811,7 @@ static int power_pmu_enable(struct perf_
+ cpuhw->flags[n0] = counter->hw.counter_base;
+ if (check_excludes(cpuhw->counter, cpuhw->flags, n0, 1))
+ goto out;
+- if (power_check_constraints(cpuhw->events, cpuhw->flags, n0 + 1))
++ if (power_check_constraints(cpuhw, cpuhw->events, cpuhw->flags, n0 + 1))
+ goto out;
+
+ counter->hw.config = cpuhw->events[n0];
+@@ -1012,6 +1016,7 @@ const struct pmu *hw_perf_counter_init(s
+ unsigned int cflags[MAX_HWCOUNTERS];
+ int n;
+ int err;
++ struct cpu_hw_counters *cpuhw;
+
+ if (!ppmu)
+ return ERR_PTR(-ENXIO);
+@@ -1090,7 +1095,11 @@ const struct pmu *hw_perf_counter_init(s
+ cflags[n] = flags;
+ if (check_excludes(ctrs, cflags, n, 1))
+ return ERR_PTR(-EINVAL);
+- if (power_check_constraints(events, cflags, n + 1))
++
++ cpuhw = &get_cpu_var(cpu_hw_counters);
++ err = power_check_constraints(cpuhw, events, cflags, n + 1);
++ put_cpu_var(cpu_hw_counters);
++ if (err)
+ return ERR_PTR(-EINVAL);
+
+ counter->hw.config = events[n];
+
+
+From gregkh@mini.kroah.org Wed Sep 16 15:37:16 2009
+Message-Id: <20090916223715.891840230@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Sep 2009 15:36:31 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Paul Mackerras <paulus@samba.org>,
+ Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Subject: [patch 18/45] powerpc: Fix bug where perf_counters breaks oprofile
+References: <20090916223613.597295240@mini.kroah.org>
+Content-Disposition: inline; filename=powerpc-fix-bug-where-perf_counters-breaks-oprofile.patch
+Content-Length: 4936
+Lines: 154
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Paul Mackerras <paulus@samba.org>
+
+commit a6dbf93a2ad853585409e715eb96dca9177e3c39 upstream.
+
+Currently there is a bug where if you use oprofile on a pSeries
+machine, then use perf_counters, then use oprofile again, oprofile
+will not work correctly; it will lose the PMU configuration the next
+time the hypervisor does a partition context switch, and thereafter
+won't count anything.
+
+Maynard Johnson identified the sequence causing the problem:
+- oprofile setup calls ppc_enable_pmcs(), which calls
+ pseries_lpar_enable_pmcs, which tells the hypervisor that we want
+ to use the PMU, and sets the "PMU in use" flag in the lppaca.
+ This flag tells the hypervisor whether it needs to save and restore
+ the PMU config.
+- The perf_counter code sets and clears the "PMU in use" flag directly
+ as it context-switches the PMU between tasks, and leaves it clear
+ when it finishes.
+- oprofile setup, called for a new oprofile run, calls ppc_enable_pmcs,
+ which does nothing because it has already been called. In particular
+ it doesn't set the "PMU in use" flag.
+
+This fixes the problem by arranging for ppc_enable_pmcs to always set
+the "PMU in use" flag. It makes the perf_counter code call
+ppc_enable_pmcs also rather than calling the lower-level function
+directly, and removes the setting of the "PMU in use" flag from
+pseries_lpar_enable_pmcs, since that is now done in its caller.
+
+This also removes the declaration of pasemi_enable_pmcs because it
+isn't defined anywhere.
+
+Reported-by: Maynard Johnson <mpjohn@us.ibm.com>
+Signed-off-by: Paul Mackerras <paulus@samba.org>
+Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/powerpc/include/asm/pmc.h | 16 ++++++++++++++--
+ arch/powerpc/kernel/perf_counter.c | 13 +++----------
+ arch/powerpc/kernel/sysfs.c | 3 +++
+ arch/powerpc/platforms/pseries/setup.c | 4 ----
+ 4 files changed, 20 insertions(+), 16 deletions(-)
+
+--- a/arch/powerpc/include/asm/pmc.h
++++ b/arch/powerpc/include/asm/pmc.h
+@@ -27,10 +27,22 @@ extern perf_irq_t perf_irq;
+
+ int reserve_pmc_hardware(perf_irq_t new_perf_irq);
+ void release_pmc_hardware(void);
++void ppc_enable_pmcs(void);
+
+ #ifdef CONFIG_PPC64
+-void power4_enable_pmcs(void);
+-void pasemi_enable_pmcs(void);
++#include <asm/lppaca.h>
++
++static inline void ppc_set_pmu_inuse(int inuse)
++{
++ get_lppaca()->pmcregs_in_use = inuse;
++}
++
++extern void power4_enable_pmcs(void);
++
++#else /* CONFIG_PPC64 */
++
++static inline void ppc_set_pmu_inuse(int inuse) { }
++
+ #endif
+
+ #endif /* __KERNEL__ */
+--- a/arch/powerpc/kernel/perf_counter.c
++++ b/arch/powerpc/kernel/perf_counter.c
+@@ -65,7 +65,6 @@ static inline unsigned long perf_ip_adju
+ {
+ return 0;
+ }
+-static inline void perf_set_pmu_inuse(int inuse) { }
+ static inline void perf_get_data_addr(struct pt_regs *regs, u64 *addrp) { }
+ static inline u32 perf_get_misc_flags(struct pt_regs *regs)
+ {
+@@ -96,11 +95,6 @@ static inline unsigned long perf_ip_adju
+ return 0;
+ }
+
+-static inline void perf_set_pmu_inuse(int inuse)
+-{
+- get_lppaca()->pmcregs_in_use = inuse;
+-}
+-
+ /*
+ * The user wants a data address recorded.
+ * If we're not doing instruction sampling, give them the SDAR
+@@ -535,8 +529,7 @@ void hw_perf_disable(void)
+ * Check if we ever enabled the PMU on this cpu.
+ */
+ if (!cpuhw->pmcs_enabled) {
+- if (ppc_md.enable_pmcs)
+- ppc_md.enable_pmcs();
++ ppc_enable_pmcs();
+ cpuhw->pmcs_enabled = 1;
+ }
+
+@@ -598,7 +591,7 @@ void hw_perf_enable(void)
+ mtspr(SPRN_MMCRA, cpuhw->mmcr[2] & ~MMCRA_SAMPLE_ENABLE);
+ mtspr(SPRN_MMCR1, cpuhw->mmcr[1]);
+ if (cpuhw->n_counters == 0)
+- perf_set_pmu_inuse(0);
++ ppc_set_pmu_inuse(0);
+ goto out_enable;
+ }
+
+@@ -631,7 +624,7 @@ void hw_perf_enable(void)
+ * bit set and set the hardware counters to their initial values.
+ * Then unfreeze the counters.
+ */
+- perf_set_pmu_inuse(1);
++ ppc_set_pmu_inuse(1);
+ mtspr(SPRN_MMCRA, cpuhw->mmcr[2] & ~MMCRA_SAMPLE_ENABLE);
+ mtspr(SPRN_MMCR1, cpuhw->mmcr[1]);
+ mtspr(SPRN_MMCR0, (cpuhw->mmcr[0] & ~(MMCR0_PMC1CE | MMCR0_PMCjCE))
+--- a/arch/powerpc/kernel/sysfs.c
++++ b/arch/powerpc/kernel/sysfs.c
+@@ -17,6 +17,7 @@
+ #include <asm/prom.h>
+ #include <asm/machdep.h>
+ #include <asm/smp.h>
++#include <asm/pmc.h>
+
+ #include "cacheinfo.h"
+
+@@ -123,6 +124,8 @@ static DEFINE_PER_CPU(char, pmcs_enabled
+
+ void ppc_enable_pmcs(void)
+ {
++ ppc_set_pmu_inuse(1);
++
+ /* Only need to enable them once */
+ if (__get_cpu_var(pmcs_enabled))
+ return;
+--- a/arch/powerpc/platforms/pseries/setup.c
++++ b/arch/powerpc/platforms/pseries/setup.c
+@@ -223,10 +223,6 @@ static void pseries_lpar_enable_pmcs(voi
+ set = 1UL << 63;
+ reset = 0;
+ plpar_hcall_norets(H_PERFMON, set, reset);
+-
+- /* instruct hypervisor to maintain PMCs */
+- if (firmware_has_feature(FW_FEATURE_SPLPAR))
+- get_lppaca()->pmcregs_in_use = 1;
+ }
+
+ static void __init pseries_discover_pic(void)
+
+
+From gregkh@mini.kroah.org Wed Sep 16 15:37:16 2009
+Message-Id: <20090916223716.038596167@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Sep 2009 15:36:32 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Geoff Levand <geoffrey.levand@am.sony.com>,
+ Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Subject: [patch 19/45] powerpc/ps3: Workaround for flash memory I/O error
+References: <20090916223613.597295240@mini.kroah.org>
+Content-Disposition: inline; filename=powerpc-ps3-workaround-for-flash-memory-i-o-error.patch
+Content-Length: 3401
+Lines: 122
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Geoff Levand <geoffrey.levand@am.sony.com>
+
+commit bc00351edd5c1b84d48c3fdca740fedfce4ae6ce upstream.
+
+A workaround for flash memory I/O errors when the PS3 internal
+hard disk has not been formatted for OtherOS use.
+
+This error condition mainly effects 'Live CD' users who have not
+formatted the PS3's internal hard disk for OtherOS.
+
+Fixes errors similar to these when using the ps3-flash-util
+or ps3-boot-game-os programs:
+
+ ps3flash read failed 0x2050000
+ os_area_header_read: read error: os_area_header: Input/output error
+ main:627: os_area_read_hp error.
+ ERROR: can't change boot flag
+
+Signed-off-by: Geoff Levand <geoffrey.levand@am.sony.com>
+Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/ps3/ps3stor_lib.c | 65 +++++++++++++++++++++++++++++++++++++++++++---
+ 1 file changed, 62 insertions(+), 3 deletions(-)
+
+--- a/drivers/ps3/ps3stor_lib.c
++++ b/drivers/ps3/ps3stor_lib.c
+@@ -23,6 +23,65 @@
+ #include <asm/lv1call.h>
+ #include <asm/ps3stor.h>
+
++/*
++ * A workaround for flash memory I/O errors when the internal hard disk
++ * has not been formatted for OtherOS use. Delay disk close until flash
++ * memory is closed.
++ */
++
++static struct ps3_flash_workaround {
++ int flash_open;
++ int disk_open;
++ struct ps3_system_bus_device *disk_sbd;
++} ps3_flash_workaround;
++
++static int ps3stor_open_hv_device(struct ps3_system_bus_device *sbd)
++{
++ int error = ps3_open_hv_device(sbd);
++
++ if (error)
++ return error;
++
++ if (sbd->match_id == PS3_MATCH_ID_STOR_FLASH)
++ ps3_flash_workaround.flash_open = 1;
++
++ if (sbd->match_id == PS3_MATCH_ID_STOR_DISK)
++ ps3_flash_workaround.disk_open = 1;
++
++ return 0;
++}
++
++static int ps3stor_close_hv_device(struct ps3_system_bus_device *sbd)
++{
++ int error;
++
++ if (sbd->match_id == PS3_MATCH_ID_STOR_DISK
++ && ps3_flash_workaround.disk_open
++ && ps3_flash_workaround.flash_open) {
++ ps3_flash_workaround.disk_sbd = sbd;
++ return 0;
++ }
++
++ error = ps3_close_hv_device(sbd);
++
++ if (error)
++ return error;
++
++ if (sbd->match_id == PS3_MATCH_ID_STOR_DISK)
++ ps3_flash_workaround.disk_open = 0;
++
++ if (sbd->match_id == PS3_MATCH_ID_STOR_FLASH) {
++ ps3_flash_workaround.flash_open = 0;
++
++ if (ps3_flash_workaround.disk_sbd) {
++ ps3_close_hv_device(ps3_flash_workaround.disk_sbd);
++ ps3_flash_workaround.disk_open = 0;
++ ps3_flash_workaround.disk_sbd = NULL;
++ }
++ }
++
++ return 0;
++}
+
+ static int ps3stor_probe_access(struct ps3_storage_device *dev)
+ {
+@@ -90,7 +149,7 @@ int ps3stor_setup(struct ps3_storage_dev
+ int error, res, alignment;
+ enum ps3_dma_page_size page_size;
+
+- error = ps3_open_hv_device(&dev->sbd);
++ error = ps3stor_open_hv_device(&dev->sbd);
+ if (error) {
+ dev_err(&dev->sbd.core,
+ "%s:%u: ps3_open_hv_device failed %d\n", __func__,
+@@ -166,7 +225,7 @@ fail_free_irq:
+ fail_sb_event_receive_port_destroy:
+ ps3_sb_event_receive_port_destroy(&dev->sbd, dev->irq);
+ fail_close_device:
+- ps3_close_hv_device(&dev->sbd);
++ ps3stor_close_hv_device(&dev->sbd);
+ fail:
+ return error;
+ }
+@@ -193,7 +252,7 @@ void ps3stor_teardown(struct ps3_storage
+ "%s:%u: destroy event receive port failed %d\n",
+ __func__, __LINE__, error);
+
+- error = ps3_close_hv_device(&dev->sbd);
++ error = ps3stor_close_hv_device(&dev->sbd);
+ if (error)
+ dev_err(&dev->sbd.core,
+ "%s:%u: ps3_close_hv_device failed %d\n", __func__,
+
+
+From gregkh@mini.kroah.org Wed Sep 16 15:37:16 2009
+Message-Id: <20090916223716.166513955@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Sep 2009 15:36:33 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jens Axboe <jens.axboe@oracle.com>
+Subject: [patch 20/45] block: dont assume device has a request list backing in nr_requests store
+References: <20090916223613.597295240@mini.kroah.org>
+Content-Disposition: inline; filename=block-don-t-assume-device-has-a-request-list-backing-in-nr_requests-store.patch
+Content-Length: 899
+Lines: 38
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Jens Axboe <jens.axboe@oracle.com>
+
+commit b8a9ae779f2c7049071034661e09cb7e1e82250c upstream.
+
+Stacked devices do not. For now, just error out with -EINVAL. Later
+we could make the limit apply on stacked devices too, for throttling
+reasons.
+
+This fixes
+
+5a54cd13353bb3b88887604e2c980aa01e314309
+
+and should go into 2.6.31 stable as well.
+
+Signed-off-by: Jens Axboe <jens.axboe@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ block/blk-sysfs.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/block/blk-sysfs.c
++++ b/block/blk-sysfs.c
+@@ -40,7 +40,12 @@ queue_requests_store(struct request_queu
+ {
+ struct request_list *rl = &q->rq;
+ unsigned long nr;
+- int ret = queue_var_store(&nr, page, count);
++ int ret;
++
++ if (!q->request_fn)
++ return -EINVAL;
++
++ ret = queue_var_store(&nr, page, count);
+ if (nr < BLKDEV_MIN_RQ)
+ nr = BLKDEV_MIN_RQ;
+
+
+
+From gregkh@mini.kroah.org Wed Sep 16 15:37:16 2009
+Message-Id: <20090916223716.291883593@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Sep 2009 15:36:34 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Alan Stern <stern@rowland.harvard.edu>,
+ Zhenyu Wang <zhenyuw@linux.intel.com>,
+ Dave Airlie <airlied@linux.ie>
+Subject: [patch 21/45] agp/intel: remove restore in resume
+References: <20090916223613.597295240@mini.kroah.org>
+Content-Disposition: inline; filename=agp-intel-remove-restore-in-resume.patch
+Content-Length: 1296
+Lines: 39
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Zhenyu Wang <zhenyuw@linux.intel.com>
+
+commit 121264827656f5f06328b17983c796af17dc5949 upstream.
+
+As early pci resume has already restored config for host
+bridge and graphics device, don't need to restore it again,
+This removes an original order hack for graphics device restore.
+
+This fixed the resume hang issue found by Alan Stern on 845G,
+caused by extra config restore on graphics device.
+
+Cc: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Zhenyu Wang <zhenyuw@linux.intel.com>
+Signed-off-by: Dave Airlie <airlied@linux.ie>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/char/agp/intel-agp.c | 9 ---------
+ 1 file changed, 9 deletions(-)
+
+--- a/drivers/char/agp/intel-agp.c
++++ b/drivers/char/agp/intel-agp.c
+@@ -2313,15 +2313,6 @@ static int agp_intel_resume(struct pci_d
+ struct agp_bridge_data *bridge = pci_get_drvdata(pdev);
+ int ret_val;
+
+- pci_restore_state(pdev);
+-
+- /* We should restore our graphics device's config space,
+- * as host bridge (00:00) resumes before graphics device (02:00),
+- * then our access to its pci space can work right.
+- */
+- if (intel_private.pcidev)
+- pci_restore_state(intel_private.pcidev);
+-
+ if (bridge->driver == &intel_generic_driver)
+ intel_configure();
+ else if (bridge->driver == &intel_850_driver)
+
+
+From gregkh@mini.kroah.org Wed Sep 16 15:37:16 2009
+Message-Id: <20090916223716.463198391@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Sep 2009 15:36:35 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Sophie Hamilton <kernel@theblob.org>,
+ Takashi Iwai <tiwai@suse.de>
+Subject: [patch 22/45] ALSA: cs46xx - Fix minimum period size
+References: <20090916223613.597295240@mini.kroah.org>
+Content-Disposition: inline; filename=alsa-cs46xx-fix-minimum-period-size.patch
+Content-Length: 820
+Lines: 28
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Sophie Hamilton <kernel@theblob.org>
+
+commit 6148b130eb84edc76e4fa88da1877b27be6c2f06 upstream.
+
+Fix minimum period size for cs46xx cards. This fixes a problem in the
+case where neither a period size nor a buffer size is passed to ALSA;
+this is the case in Audacious, OpenAL, and others.
+
+Signed-off-by: Sophie Hamilton <kernel@theblob.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/cs46xx/cs46xx_lib.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/pci/cs46xx/cs46xx_lib.h
++++ b/sound/pci/cs46xx/cs46xx_lib.h
+@@ -35,7 +35,7 @@
+
+
+ #ifdef CONFIG_SND_CS46XX_NEW_DSP
+-#define CS46XX_MIN_PERIOD_SIZE 1
++#define CS46XX_MIN_PERIOD_SIZE 64
+ #define CS46XX_MAX_PERIOD_SIZE 1024*1024
+ #else
+ #define CS46XX_MIN_PERIOD_SIZE 2048
+
+
+From gregkh@mini.kroah.org Wed Sep 16 15:37:16 2009
+Message-Id: <20090916223716.611135827@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Sep 2009 15:36:36 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Mark Brown <broonie@opensource.wolfsonmicro.com>
+Subject: [patch 23/45] ASoC: Fix WM835x Out4 capture enumeration
+References: <20090916223613.597295240@mini.kroah.org>
+Content-Disposition: inline; filename=asoc-fix-wm835x-out4-capture-enumeration.patch
+Content-Length: 803
+Lines: 26
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Mark Brown <broonie@opensource.wolfsonmicro.com>
+
+commit 87831cb660954356d68cebdb1406f3be09e784e9 upstream.
+
+It's the 8th enum of a zero indexed array. This is why I don't let
+new drivers use these arrays of enums...
+
+Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/soc/codecs/wm8350.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/soc/codecs/wm8350.c
++++ b/sound/soc/codecs/wm8350.c
+@@ -613,7 +613,7 @@ SOC_DAPM_SINGLE("Switch", WM8350_BEEP_VO
+
+ /* Out4 Capture Mux */
+ static const struct snd_kcontrol_new wm8350_out4_capture_controls =
+-SOC_DAPM_ENUM("Route", wm8350_enum[8]);
++SOC_DAPM_ENUM("Route", wm8350_enum[7]);
+
+ static const struct snd_soc_dapm_widget wm8350_dapm_widgets[] = {
+
+
+
+From gregkh@mini.kroah.org Wed Sep 16 15:37:16 2009
+Message-Id: <20090916223716.768405051@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Sep 2009 15:36:37 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Clemens Ladisch <clemens@ladisch.de>,
+ Takashi Iwai <tiwai@suse.de>
+Subject: [patch 24/45] sound: oxygen: work around MCE when changing volume
+References: <20090916223613.597295240@mini.kroah.org>
+Content-Disposition: inline; filename=sound-oxygen-work-around-mce-when-changing-volume.patch
+Content-Length: 1498
+Lines: 45
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Clemens Ladisch <clemens@ladisch.de>
+
+commit f1bc07af9a9edc5c1d4bdd971f7099316ed2e405 upstream.
+
+When the volume is changed continuously (e.g., when the user drags a
+volume slider with the mouse), the driver does lots of I2C writes.
+Apparently, the sound chip can get confused when we poll the I2C status
+register too much, and fails to complete a read from it. On the PCI-E
+models, the PCI-E/PCI bridge gets upset by this and generates a machine
+check exception.
+
+To avoid this, this patch replaces the polling with an unconditional
+wait that is guaranteed to be long enough.
+
+Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
+Tested-by: Johann Messner <johann.messner at jku.at>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/oxygen/oxygen_io.c | 11 +----------
+ 1 file changed, 1 insertion(+), 10 deletions(-)
+
+--- a/sound/pci/oxygen/oxygen_io.c
++++ b/sound/pci/oxygen/oxygen_io.c
+@@ -215,17 +215,8 @@ EXPORT_SYMBOL(oxygen_write_spi);
+
+ void oxygen_write_i2c(struct oxygen *chip, u8 device, u8 map, u8 data)
+ {
+- unsigned long timeout;
+-
+ /* should not need more than about 300 us */
+- timeout = jiffies + msecs_to_jiffies(1);
+- do {
+- if (!(oxygen_read16(chip, OXYGEN_2WIRE_BUS_STATUS)
+- & OXYGEN_2WIRE_BUSY))
+- break;
+- udelay(1);
+- cond_resched();
+- } while (time_after_eq(timeout, jiffies));
++ msleep(1);
+
+ oxygen_write8(chip, OXYGEN_2WIRE_MAP, map);
+ oxygen_write8(chip, OXYGEN_2WIRE_DATA, data);
+
+
+From gregkh@mini.kroah.org Wed Sep 16 15:37:17 2009
+Message-Id: <20090916223716.909441419@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Sep 2009 15:36:38 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Roland Dreier <rolandd@cisco.com>
+Subject: [patch 25/45] mlx4_core: Allocate and map sufficient ICM memory for EQ context
+References: <20090916223613.597295240@mini.kroah.org>
+Content-Disposition: inline; filename=mlx4_core-allocate-and-map-sufficient-icm-memory-for-eq-context.patch
+Content-Length: 5008
+Lines: 144
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Roland Dreier <rolandd@cisco.com>
+
+commit fa0681d2129732027355d6b7083dd8932b9b799d upstream.
+
+The current implementation allocates a single host page for EQ context
+memory, which was OK when we only allocated a few EQs. However, since
+we now allocate an EQ for each CPU core, this patch removes the
+hard-coded limit (which we exceed with 4 KB pages and 128 byte EQ
+context entries with 32 CPUs) and uses the same ICM table code as all
+other context tables, which ends up simplifying the code quite a bit
+while fixing the problem.
+
+This problem was actually hit in practice on a dual-socket Nehalem box
+with 16 real hardware threads and sufficiently odd ACPI tables that it
+shows on boot
+
+ SMP: Allowing 32 CPUs, 16 hotplug CPUs
+
+so num_possible_cpus() ends up 32, and mlx4 ends up creating 33 MSI-X
+interrupts and 33 EQs. This mlx4 bug means that mlx4 can't even
+initialize at all on this quite mainstream system.
+
+Reported-by: Eli Cohen <eli@mellanox.co.il>
+Tested-by: Christoph Lameter <cl@linux-foundation.org>
+Signed-off-by: Roland Dreier <rolandd@cisco.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/mlx4/eq.c | 42 ------------------------------------------
+ drivers/net/mlx4/main.c | 9 ++++++---
+ drivers/net/mlx4/mlx4.h | 7 +------
+ 3 files changed, 7 insertions(+), 51 deletions(-)
+
+--- a/drivers/net/mlx4/eq.c
++++ b/drivers/net/mlx4/eq.c
+@@ -526,48 +526,6 @@ static void mlx4_unmap_clr_int(struct ml
+ iounmap(priv->clr_base);
+ }
+
+-int mlx4_map_eq_icm(struct mlx4_dev *dev, u64 icm_virt)
+-{
+- struct mlx4_priv *priv = mlx4_priv(dev);
+- int ret;
+-
+- /*
+- * We assume that mapping one page is enough for the whole EQ
+- * context table. This is fine with all current HCAs, because
+- * we only use 32 EQs and each EQ uses 64 bytes of context
+- * memory, or 1 KB total.
+- */
+- priv->eq_table.icm_virt = icm_virt;
+- priv->eq_table.icm_page = alloc_page(GFP_HIGHUSER);
+- if (!priv->eq_table.icm_page)
+- return -ENOMEM;
+- priv->eq_table.icm_dma = pci_map_page(dev->pdev, priv->eq_table.icm_page, 0,
+- PAGE_SIZE, PCI_DMA_BIDIRECTIONAL);
+- if (pci_dma_mapping_error(dev->pdev, priv->eq_table.icm_dma)) {
+- __free_page(priv->eq_table.icm_page);
+- return -ENOMEM;
+- }
+-
+- ret = mlx4_MAP_ICM_page(dev, priv->eq_table.icm_dma, icm_virt);
+- if (ret) {
+- pci_unmap_page(dev->pdev, priv->eq_table.icm_dma, PAGE_SIZE,
+- PCI_DMA_BIDIRECTIONAL);
+- __free_page(priv->eq_table.icm_page);
+- }
+-
+- return ret;
+-}
+-
+-void mlx4_unmap_eq_icm(struct mlx4_dev *dev)
+-{
+- struct mlx4_priv *priv = mlx4_priv(dev);
+-
+- mlx4_UNMAP_ICM(dev, priv->eq_table.icm_virt, 1);
+- pci_unmap_page(dev->pdev, priv->eq_table.icm_dma, PAGE_SIZE,
+- PCI_DMA_BIDIRECTIONAL);
+- __free_page(priv->eq_table.icm_page);
+-}
+-
+ int mlx4_alloc_eq_table(struct mlx4_dev *dev)
+ {
+ struct mlx4_priv *priv = mlx4_priv(dev);
+--- a/drivers/net/mlx4/main.c
++++ b/drivers/net/mlx4/main.c
+@@ -525,7 +525,10 @@ static int mlx4_init_icm(struct mlx4_dev
+ goto err_unmap_aux;
+ }
+
+- err = mlx4_map_eq_icm(dev, init_hca->eqc_base);
++ err = mlx4_init_icm_table(dev, &priv->eq_table.table,
++ init_hca->eqc_base, dev_cap->eqc_entry_sz,
++ dev->caps.num_eqs, dev->caps.num_eqs,
++ 0, 0);
+ if (err) {
+ mlx4_err(dev, "Failed to map EQ context memory, aborting.\n");
+ goto err_unmap_cmpt;
+@@ -668,7 +671,7 @@ err_unmap_mtt:
+ mlx4_cleanup_icm_table(dev, &priv->mr_table.mtt_table);
+
+ err_unmap_eq:
+- mlx4_unmap_eq_icm(dev);
++ mlx4_cleanup_icm_table(dev, &priv->eq_table.table);
+
+ err_unmap_cmpt:
+ mlx4_cleanup_icm_table(dev, &priv->eq_table.cmpt_table);
+@@ -698,11 +701,11 @@ static void mlx4_free_icms(struct mlx4_d
+ mlx4_cleanup_icm_table(dev, &priv->qp_table.qp_table);
+ mlx4_cleanup_icm_table(dev, &priv->mr_table.dmpt_table);
+ mlx4_cleanup_icm_table(dev, &priv->mr_table.mtt_table);
++ mlx4_cleanup_icm_table(dev, &priv->eq_table.table);
+ mlx4_cleanup_icm_table(dev, &priv->eq_table.cmpt_table);
+ mlx4_cleanup_icm_table(dev, &priv->cq_table.cmpt_table);
+ mlx4_cleanup_icm_table(dev, &priv->srq_table.cmpt_table);
+ mlx4_cleanup_icm_table(dev, &priv->qp_table.cmpt_table);
+- mlx4_unmap_eq_icm(dev);
+
+ mlx4_UNMAP_ICM_AUX(dev);
+ mlx4_free_icm(dev, priv->fw.aux_icm, 0);
+--- a/drivers/net/mlx4/mlx4.h
++++ b/drivers/net/mlx4/mlx4.h
+@@ -205,9 +205,7 @@ struct mlx4_eq_table {
+ void __iomem **uar_map;
+ u32 clr_mask;
+ struct mlx4_eq *eq;
+- u64 icm_virt;
+- struct page *icm_page;
+- dma_addr_t icm_dma;
++ struct mlx4_icm_table table;
+ struct mlx4_icm_table cmpt_table;
+ int have_irq;
+ u8 inta_pin;
+@@ -373,9 +371,6 @@ u64 mlx4_make_profile(struct mlx4_dev *d
+ struct mlx4_dev_cap *dev_cap,
+ struct mlx4_init_hca_param *init_hca);
+
+-int mlx4_map_eq_icm(struct mlx4_dev *dev, u64 icm_virt);
+-void mlx4_unmap_eq_icm(struct mlx4_dev *dev);
+-
+ int mlx4_cmd_init(struct mlx4_dev *dev);
+ void mlx4_cmd_cleanup(struct mlx4_dev *dev);
+ void mlx4_cmd_event(struct mlx4_dev *dev, u16 token, u8 status, u64 out_param);
+
+
+From gregkh@mini.kroah.org Wed Sep 16 15:37:17 2009
+Message-Id: <20090916223717.042342662@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Sep 2009 15:36:39 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Peter Zijlstra <a.p.zijlstra@chello.nl>,
+ Ingo Molnar <mingo@elte.hu>
+Subject: [patch 26/45] perf stat: Change noise calculation to use stddev
+References: <20090916223613.597295240@mini.kroah.org>
+Content-Disposition: inline; filename=perf-stat-change-noise-calculation-to-use-stddev.patch
+Content-Length: 8549
+Lines: 286
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Peter Zijlstra <a.p.zijlstra@chello.nl>
+
+commit 506d4bc8d5dab20d84624aa07cdc6dcd77915d52 upstream.
+
+The current noise computation does:
+
+ \Sum abs(n_i - avg(n)) * N^-1.5
+
+Which is (afaik) not a regular noise function, and needs the
+complete sample set available to post-process.
+
+Change this to use a regular stddev computation which can be
+done by keeping a two sums:
+
+ stddev = sqrt( 1/N (\Sum n_i^2) - avg(n)^2 )
+
+For which we only need to keep \Sum n_i and \Sum n_i^2.
+
+Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
+Cc: <stable@kernel.org>
+LKML-Reference: <new-submission>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ tools/perf/builtin-stat.c | 170 ++++++++++++++++++----------------------------
+ 1 file changed, 69 insertions(+), 101 deletions(-)
+
+--- a/tools/perf/builtin-stat.c
++++ b/tools/perf/builtin-stat.c
+@@ -82,19 +82,32 @@ static u64 runtime_cycles[MAX_RUN];
+ static u64 event_res[MAX_RUN][MAX_COUNTERS][3];
+ static u64 event_scaled[MAX_RUN][MAX_COUNTERS];
+
+-static u64 event_res_avg[MAX_COUNTERS][3];
+-static u64 event_res_noise[MAX_COUNTERS][3];
++struct stats
++{
++ double sum;
++ double sum_sq;
++};
+
+-static u64 event_scaled_avg[MAX_COUNTERS];
++static double avg_stats(struct stats *stats)
++{
++ return stats->sum / run_count;
++}
+
+-static u64 runtime_nsecs_avg;
+-static u64 runtime_nsecs_noise;
++/*
++ * stddev = sqrt(1/N (\Sum n_i^2) - avg(n)^2)
++ */
++static double stddev_stats(struct stats *stats)
++{
++ double avg = stats->sum / run_count;
+
+-static u64 walltime_nsecs_avg;
+-static u64 walltime_nsecs_noise;
++ return sqrt(stats->sum_sq/run_count - avg*avg);
++}
+
+-static u64 runtime_cycles_avg;
+-static u64 runtime_cycles_noise;
++struct stats event_res_stats[MAX_COUNTERS][3];
++struct stats event_scaled_stats[MAX_COUNTERS];
++struct stats runtime_nsecs_stats;
++struct stats walltime_nsecs_stats;
++struct stats runtime_cycles_stats;
+
+ #define MATCH_EVENT(t, c, counter) \
+ (attrs[counter].type == PERF_TYPE_##t && \
+@@ -278,42 +291,37 @@ static int run_perf_stat(int argc __used
+ return WEXITSTATUS(status);
+ }
+
+-static void print_noise(u64 *count, u64 *noise)
++static void print_noise(double avg, double stddev)
+ {
+ if (run_count > 1)
+- fprintf(stderr, " ( +- %7.3f%% )",
+- (double)noise[0]/(count[0]+1)*100.0);
++ fprintf(stderr, " ( +- %7.3f%% )", 100*stddev / avg);
+ }
+
+-static void nsec_printout(int counter, u64 *count, u64 *noise)
++static void nsec_printout(int counter, double avg, double stddev)
+ {
+- double msecs = (double)count[0] / 1000000;
++ double msecs = avg / 1e6;
+
+ fprintf(stderr, " %14.6f %-24s", msecs, event_name(counter));
+
+ if (MATCH_EVENT(SOFTWARE, SW_TASK_CLOCK, counter)) {
+- if (walltime_nsecs_avg)
+- fprintf(stderr, " # %10.3f CPUs ",
+- (double)count[0] / (double)walltime_nsecs_avg);
++ fprintf(stderr, " # %10.3f CPUs ",
++ avg / avg_stats(&walltime_nsecs_stats));
+ }
+- print_noise(count, noise);
++ print_noise(avg, stddev);
+ }
+
+-static void abs_printout(int counter, u64 *count, u64 *noise)
++static void abs_printout(int counter, double avg, double stddev)
+ {
+- fprintf(stderr, " %14Ld %-24s", count[0], event_name(counter));
++ fprintf(stderr, " %14.0f %-24s", avg, event_name(counter));
+
+- if (runtime_cycles_avg &&
+- MATCH_EVENT(HARDWARE, HW_INSTRUCTIONS, counter)) {
++ if (MATCH_EVENT(HARDWARE, HW_INSTRUCTIONS, counter)) {
+ fprintf(stderr, " # %10.3f IPC ",
+- (double)count[0] / (double)runtime_cycles_avg);
++ avg / avg_stats(&runtime_cycles_stats));
+ } else {
+- if (runtime_nsecs_avg) {
+- fprintf(stderr, " # %10.3f M/sec",
+- (double)count[0]/runtime_nsecs_avg*1000.0);
+- }
++ fprintf(stderr, " # %10.3f M/sec",
++ 1000.0 * avg / avg_stats(&runtime_nsecs_stats));
+ }
+- print_noise(count, noise);
++ print_noise(avg, stddev);
+ }
+
+ /*
+@@ -321,12 +329,12 @@ static void abs_printout(int counter, u6
+ */
+ static void print_counter(int counter)
+ {
+- u64 *count, *noise;
++ double avg, stddev;
+ int scaled;
+
+- count = event_res_avg[counter];
+- noise = event_res_noise[counter];
+- scaled = event_scaled_avg[counter];
++ avg = avg_stats(&event_res_stats[counter][0]);
++ stddev = stddev_stats(&event_res_stats[counter][0]);
++ scaled = avg_stats(&event_scaled_stats[counter]);
+
+ if (scaled == -1) {
+ fprintf(stderr, " %14s %-24s\n",
+@@ -335,36 +343,34 @@ static void print_counter(int counter)
+ }
+
+ if (nsec_counter(counter))
+- nsec_printout(counter, count, noise);
++ nsec_printout(counter, avg, stddev);
+ else
+- abs_printout(counter, count, noise);
++ abs_printout(counter, avg, stddev);
++
++ if (scaled) {
++ double avg_enabled, avg_running;
++
++ avg_enabled = avg_stats(&event_res_stats[counter][1]);
++ avg_running = avg_stats(&event_res_stats[counter][2]);
+
+- if (scaled)
+ fprintf(stderr, " (scaled from %.2f%%)",
+- (double) count[2] / count[1] * 100);
++ 100 * avg_running / avg_enabled);
++ }
+
+ fprintf(stderr, "\n");
+ }
+
+-/*
+- * normalize_noise noise values down to stddev:
+- */
+-static void normalize_noise(u64 *val)
++static void update_stats(const char *name, int idx, struct stats *stats, u64 *val)
+ {
+- double res;
++ double sq = *val;
+
+- res = (double)*val / (run_count * sqrt((double)run_count));
+-
+- *val = (u64)res;
+-}
+-
+-static void update_avg(const char *name, int idx, u64 *avg, u64 *val)
+-{
+- *avg += *val;
++ stats->sum += *val;
++ stats->sum_sq += sq * sq;
+
+ if (verbose > 1)
+ fprintf(stderr, "debug: %20s[%d]: %Ld\n", name, idx, *val);
+ }
++
+ /*
+ * Calculate the averages and noises:
+ */
+@@ -376,61 +382,22 @@ static void calc_avg(void)
+ fprintf(stderr, "\n");
+
+ for (i = 0; i < run_count; i++) {
+- update_avg("runtime", 0, &runtime_nsecs_avg, runtime_nsecs + i);
+- update_avg("walltime", 0, &walltime_nsecs_avg, walltime_nsecs + i);
+- update_avg("runtime_cycles", 0, &runtime_cycles_avg, runtime_cycles + i);
++ update_stats("runtime", 0, &runtime_nsecs_stats, runtime_nsecs + i);
++ update_stats("walltime", 0, &walltime_nsecs_stats, walltime_nsecs + i);
++ update_stats("runtime_cycles", 0, &runtime_cycles_stats, runtime_cycles + i);
+
+ for (j = 0; j < nr_counters; j++) {
+- update_avg("counter/0", j,
+- event_res_avg[j]+0, event_res[i][j]+0);
+- update_avg("counter/1", j,
+- event_res_avg[j]+1, event_res[i][j]+1);
+- update_avg("counter/2", j,
+- event_res_avg[j]+2, event_res[i][j]+2);
++ update_stats("counter/0", j,
++ event_res_stats[j]+0, event_res[i][j]+0);
++ update_stats("counter/1", j,
++ event_res_stats[j]+1, event_res[i][j]+1);
++ update_stats("counter/2", j,
++ event_res_stats[j]+2, event_res[i][j]+2);
+ if (event_scaled[i][j] != (u64)-1)
+- update_avg("scaled", j,
+- event_scaled_avg + j, event_scaled[i]+j);
+- else
+- event_scaled_avg[j] = -1;
+- }
+- }
+- runtime_nsecs_avg /= run_count;
+- walltime_nsecs_avg /= run_count;
+- runtime_cycles_avg /= run_count;
+-
+- for (j = 0; j < nr_counters; j++) {
+- event_res_avg[j][0] /= run_count;
+- event_res_avg[j][1] /= run_count;
+- event_res_avg[j][2] /= run_count;
+- }
+-
+- for (i = 0; i < run_count; i++) {
+- runtime_nsecs_noise +=
+- abs((s64)(runtime_nsecs[i] - runtime_nsecs_avg));
+- walltime_nsecs_noise +=
+- abs((s64)(walltime_nsecs[i] - walltime_nsecs_avg));
+- runtime_cycles_noise +=
+- abs((s64)(runtime_cycles[i] - runtime_cycles_avg));
+-
+- for (j = 0; j < nr_counters; j++) {
+- event_res_noise[j][0] +=
+- abs((s64)(event_res[i][j][0] - event_res_avg[j][0]));
+- event_res_noise[j][1] +=
+- abs((s64)(event_res[i][j][1] - event_res_avg[j][1]));
+- event_res_noise[j][2] +=
+- abs((s64)(event_res[i][j][2] - event_res_avg[j][2]));
++ update_stats("scaled", j,
++ event_scaled_stats + j, event_scaled[i]+j);
+ }
+ }
+-
+- normalize_noise(&runtime_nsecs_noise);
+- normalize_noise(&walltime_nsecs_noise);
+- normalize_noise(&runtime_cycles_noise);
+-
+- for (j = 0; j < nr_counters; j++) {
+- normalize_noise(&event_res_noise[j][0]);
+- normalize_noise(&event_res_noise[j][1]);
+- normalize_noise(&event_res_noise[j][2]);
+- }
+ }
+
+ static void print_stat(int argc, const char **argv)
+@@ -457,10 +424,11 @@ static void print_stat(int argc, const c
+
+ fprintf(stderr, "\n");
+ fprintf(stderr, " %14.9f seconds time elapsed",
+- (double)walltime_nsecs_avg/1e9);
++ avg_stats(&walltime_nsecs_stats)/1e9);
+ if (run_count > 1) {
+ fprintf(stderr, " ( +- %7.3f%% )",
+- 100.0*(double)walltime_nsecs_noise/(double)walltime_nsecs_avg);
++ 100*stddev_stats(&walltime_nsecs_stats) /
++ avg_stats(&walltime_nsecs_stats));
+ }
+ fprintf(stderr, "\n\n");
+ }
+
+
+From gregkh@mini.kroah.org Wed Sep 16 15:37:17 2009
+Message-Id: <20090916223717.186277850@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Sep 2009 15:36:40 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Roel Kluin <roel.kluin@gmail.com>,
+ Ingo Molnar <mingo@elte.hu>
+Subject: [patch 27/45] x86: Fix x86_model test in es7000_apic_is_cluster()
+References: <20090916223613.597295240@mini.kroah.org>
+Content-Disposition: inline; filename=x86-fix-x86_model-test-in-es7000_apic_is_cluster.patch
+Content-Length: 831
+Lines: 28
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Roel Kluin <roel.kluin@gmail.com>
+
+commit 005155b1f626d2b2d7932e4afdf4fead168c6888 upstream.
+
+For the x86_model to be greater than 6 or less than 12 is
+logically always true.
+
+Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/apic/es7000_32.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/x86/kernel/apic/es7000_32.c
++++ b/arch/x86/kernel/apic/es7000_32.c
+@@ -167,7 +167,7 @@ static int es7000_apic_is_cluster(void)
+ {
+ /* MPENTIUMIII */
+ if (boot_cpu_data.x86 == 6 &&
+- (boot_cpu_data.x86_model >= 7 || boot_cpu_data.x86_model <= 11))
++ (boot_cpu_data.x86_model >= 7 && boot_cpu_data.x86_model <= 11))
+ return 1;
+
+ return 0;
+
+
+From gregkh@mini.kroah.org Wed Sep 16 15:37:17 2009
+Message-Id: <20090916223717.345216913@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Sep 2009 15:36:41 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>,
+ Ingo Molnar <mingo@elte.hu>
+Subject: [patch 28/45] x86/i386: Make sure stack-protector segment base is cache aligned
+References: <20090916223613.597295240@mini.kroah.org>
+Content-Disposition: inline; filename=x86-i386-make-sure-stack-protector-segment-base-is-cache-aligned.patch
+Content-Length: 3976
+Lines: 108
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Jeremy Fitzhardinge <jeremy@goop.org>
+
+commit 1ea0d14e480c245683927eecc03a70faf06e80c8 upstream.
+
+The Intel Optimization Reference Guide says:
+
+ In Intel Atom microarchitecture, the address generation unit
+ assumes that the segment base will be 0 by default. Non-zero
+ segment base will cause load and store operations to experience
+ a delay.
+ - If the segment base isn't aligned to a cache line
+ boundary, the max throughput of memory operations is
+ reduced to one [e]very 9 cycles.
+ [...]
+ Assembly/Compiler Coding Rule 15. (H impact, ML generality)
+ For Intel Atom processors, use segments with base set to 0
+ whenever possible; avoid non-zero segment base address that is
+ not aligned to cache line boundary at all cost.
+
+We can't avoid having a non-zero base for the stack-protector
+segment, but we can make it cache-aligned.
+
+Signed-off-by: Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
+LKML-Reference: <4AA01893.6000507@goop.org>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/include/asm/processor.h | 12 +++++++++++-
+ arch/x86/include/asm/stackprotector.h | 4 ++--
+ arch/x86/include/asm/system.h | 2 +-
+ arch/x86/kernel/cpu/common.c | 2 +-
+ arch/x86/kernel/head_32.S | 1 -
+ 5 files changed, 15 insertions(+), 6 deletions(-)
+
+--- a/arch/x86/include/asm/processor.h
++++ b/arch/x86/include/asm/processor.h
+@@ -403,7 +403,17 @@ extern unsigned long kernel_eflags;
+ extern asmlinkage void ignore_sysret(void);
+ #else /* X86_64 */
+ #ifdef CONFIG_CC_STACKPROTECTOR
+-DECLARE_PER_CPU(unsigned long, stack_canary);
++/*
++ * Make sure stack canary segment base is cached-aligned:
++ * "For Intel Atom processors, avoid non zero segment base address
++ * that is not aligned to cache line boundary at all cost."
++ * (Optim Ref Manual Assembly/Compiler Coding Rule 15.)
++ */
++struct stack_canary {
++ char __pad[20]; /* canary at %gs:20 */
++ unsigned long canary;
++};
++DECLARE_PER_CPU(struct stack_canary, stack_canary) ____cacheline_aligned;
+ #endif
+ #endif /* X86_64 */
+
+--- a/arch/x86/include/asm/stackprotector.h
++++ b/arch/x86/include/asm/stackprotector.h
+@@ -78,14 +78,14 @@ static __always_inline void boot_init_st
+ #ifdef CONFIG_X86_64
+ percpu_write(irq_stack_union.stack_canary, canary);
+ #else
+- percpu_write(stack_canary, canary);
++ percpu_write(stack_canary.canary, canary);
+ #endif
+ }
+
+ static inline void setup_stack_canary_segment(int cpu)
+ {
+ #ifdef CONFIG_X86_32
+- unsigned long canary = (unsigned long)&per_cpu(stack_canary, cpu) - 20;
++ unsigned long canary = (unsigned long)&per_cpu(stack_canary, cpu);
+ struct desc_struct *gdt_table = get_cpu_gdt_table(cpu);
+ struct desc_struct desc;
+
+--- a/arch/x86/include/asm/system.h
++++ b/arch/x86/include/asm/system.h
+@@ -31,7 +31,7 @@ void __switch_to_xtra(struct task_struct
+ "movl %P[task_canary](%[next]), %%ebx\n\t" \
+ "movl %%ebx, "__percpu_arg([stack_canary])"\n\t"
+ #define __switch_canary_oparam \
+- , [stack_canary] "=m" (per_cpu_var(stack_canary))
++ , [stack_canary] "=m" (per_cpu_var(stack_canary.canary))
+ #define __switch_canary_iparam \
+ , [task_canary] "i" (offsetof(struct task_struct, stack_canary))
+ #else /* CC_STACKPROTECTOR */
+--- a/arch/x86/kernel/cpu/common.c
++++ b/arch/x86/kernel/cpu/common.c
+@@ -1043,7 +1043,7 @@ DEFINE_PER_CPU(struct orig_ist, orig_ist
+ #else /* CONFIG_X86_64 */
+
+ #ifdef CONFIG_CC_STACKPROTECTOR
+-DEFINE_PER_CPU(unsigned long, stack_canary);
++DEFINE_PER_CPU(struct stack_canary, stack_canary) ____cacheline_aligned;
+ #endif
+
+ /* Make sure %fs and %gs are initialized properly in idle threads */
+--- a/arch/x86/kernel/head_32.S
++++ b/arch/x86/kernel/head_32.S
+@@ -439,7 +439,6 @@ is386: movl $2,%ecx # set MP
+ jne 1f
+ movl $per_cpu__gdt_page,%eax
+ movl $per_cpu__stack_canary,%ecx
+- subl $20, %ecx
+ movw %cx, 8 * GDT_ENTRY_STACK_CANARY + 2(%eax)
+ shrl $16, %ecx
+ movb %cl, 8 * GDT_ENTRY_STACK_CANARY + 4(%eax)
+
+
+From gregkh@mini.kroah.org Wed Sep 16 15:37:17 2009
+Message-Id: <20090916223717.514881842@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Sep 2009 15:36:42 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Tejun Heo <tj@kernel.org>,
+ Peer Chen <pchen@nvidia.com>,
+ Tj <linux@tjworld.net>,
+ Greg KH <greg@kroah.com>,
+ Jesse Barnes <jbarnes@virtuousgeek.org>
+Subject: [patch 29/45] PCI: apply nv_msi_ht_cap_quirk on resume too
+References: <20090916223613.597295240@mini.kroah.org>
+Content-Disposition: inline; filename=pci-apply-nv_msi_ht_cap_quirk-on-resume-too.patch
+Content-Length: 1218
+Lines: 31
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Tejun Heo <tj@kernel.org>
+
+commit 6dab62ee5a3bf4f71b8320c09db2e6022a19f40e upstream.
+
+http://bugzilla.kernel.org/show_bug.cgi?id=12542 reports that with the
+quirk not applied on resume, msi stops working after resuming and mcp78s
+ahci fails due to IRQ mis-delivery. Apply it on resume too.
+
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Cc: Peer Chen <pchen@nvidia.com>
+Cc: Tj <linux@tjworld.net>
+Reported-by: Nicolas Derive <kalon33@ubuntu.com>
+Cc: Greg KH <greg@kroah.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -2383,8 +2383,10 @@ static void __devinit nv_msi_ht_cap_quirk_leaf(struct pci_dev *dev)
+ }
+
+ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_NVIDIA, PCI_ANY_ID, nv_msi_ht_cap_quirk_leaf);
++DECLARE_PCI_FIXUP_RESUME_EARLY(PCI_VENDOR_ID_NVIDIA, PCI_ANY_ID, nv_msi_ht_cap_quirk_leaf);
+
+ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AL, PCI_ANY_ID, nv_msi_ht_cap_quirk_all);
++DECLARE_PCI_FIXUP_RESUME_EARLY(PCI_VENDOR_ID_AL, PCI_ANY_ID, nv_msi_ht_cap_quirk_all);
+
+ static void __devinit quirk_msi_intx_disable_bug(struct pci_dev *dev)
+ {
+
+
+From gregkh@mini.kroah.org Wed Sep 16 15:37:17 2009
+Message-Id: <20090916223717.644239405@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Sep 2009 15:36:43 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jack Steiner <steiner@sgi.com>,
+ Suresh Siddha <suresh.b.siddha@intel.com>,
+ "H. Peter Anvin" <hpa@zytor.com>
+Subject: [patch 30/45] x86, pat: Fix cacheflush address in change_page_attr_set_clr()
+References: <20090916223613.597295240@mini.kroah.org>
+Content-Disposition: inline; filename=x86-pat-fix-cacheflush-address-in-change_page_attr_set_clr.patch
+Content-Length: 1544
+Lines: 53
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Jack Steiner <steiner@sgi.com>
+
+commit fa526d0d641b5365676a1fb821ce359e217c9b85 upstream.
+
+Fix address passed to cpa_flush_range() when changing page
+attributes from WB to UC. The address (*addr) is
+modified by __change_page_attr_set_clr(). The result is that
+the pages being flushed start at the _end_ of the changed range
+instead of the beginning.
+
+This should be considered for 2.6.30-stable and 2.6.31-stable.
+
+Signed-off-by: Jack Steiner <steiner@sgi.com>
+Acked-by: Suresh Siddha <suresh.b.siddha@intel.com>
+Signed-off-by: H. Peter Anvin <hpa@zytor.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/mm/pageattr.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+--- a/arch/x86/mm/pageattr.c
++++ b/arch/x86/mm/pageattr.c
+@@ -822,6 +822,7 @@ static int change_page_attr_set_clr(unsi
+ {
+ struct cpa_data cpa;
+ int ret, cache, checkalias;
++ unsigned long baddr = 0;
+
+ /*
+ * Check, if we are requested to change a not supported
+@@ -853,6 +854,11 @@ static int change_page_attr_set_clr(unsi
+ */
+ WARN_ON_ONCE(1);
+ }
++ /*
++ * Save address for cache flush. *addr is modified in the call
++ * to __change_page_attr_set_clr() below.
++ */
++ baddr = *addr;
+ }
+
+ /* Must avoid aliasing mappings in the highmem code */
+@@ -900,7 +906,7 @@ static int change_page_attr_set_clr(unsi
+ cpa_flush_array(addr, numpages, cache,
+ cpa.flags, pages);
+ } else
+- cpa_flush_range(*addr, numpages, cache);
++ cpa_flush_range(baddr, numpages, cache);
+ } else
+ cpa_flush_all(cache);
+
+
+
+From gregkh@mini.kroah.org Wed Sep 16 15:37:17 2009
+Message-Id: <20090916223717.810489941@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Sep 2009 15:36:44 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Nicolas Pitre <nico@marvell.com>,
+ Russell King <rmk+kernel@arm.linux.org.uk>
+Subject: [patch 31/45] ARM: 5691/1: fix cache aliasing issues between kmap() and kmap_atomic() with highmem
+References: <20090916223613.597295240@mini.kroah.org>
+Content-Disposition: inline; filename=arm-5691-1-fix-cache-aliasing-issues-between-kmap-and-kmap_atomic-with-highmem.patch
+Content-Length: 1877
+Lines: 55
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Nicolas Pitre <nico@cam.org>
+
+commit 7929eb9cf643ae416e5081b2a6fa558d37b9854c upstream.
+
+Let's suppose a highmem page is kmap'd with kmap(). A pkmap entry is
+used, the page mapped to it, and the virtual cache is dirtied. Then
+kunmap() is used which does virtually nothing except for decrementing a
+usage count.
+
+Then, let's suppose the _same_ page gets mapped using kmap_atomic().
+It is therefore mapped onto a fixmap entry instead, which has a
+different virtual address unaware of the dirty cache data for that page
+sitting in the pkmap mapping.
+
+Fortunately it is easy to know if a pkmap mapping still exists for that
+page and use it directly with kmap_atomic(), thanks to kmap_high_get().
+
+And actual testing with a printk in the added code path shows that this
+condition is actually met *extremely* frequently. Seems that we've been
+quite lucky that things have worked so well with highmem so far.
+
+Signed-off-by: Nicolas Pitre <nico@marvell.com>
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+--- a/arch/arm/mm/highmem.c
++++ b/arch/arm/mm/highmem.c
+@@ -40,11 +40,16 @@ void *kmap_atomic(struct page *page, enum km_type type)
+ {
+ unsigned int idx;
+ unsigned long vaddr;
++ void *kmap;
+
+ pagefault_disable();
+ if (!PageHighMem(page))
+ return page_address(page);
+
++ kmap = kmap_high_get(page);
++ if (kmap)
++ return kmap;
++
+ idx = type + KM_TYPE_NR * smp_processor_id();
+ vaddr = __fix_to_virt(FIX_KMAP_BEGIN + idx);
+ #ifdef CONFIG_DEBUG_HIGHMEM
+@@ -80,6 +85,9 @@ void kunmap_atomic(void *kvaddr, enum km_type type)
+ #else
+ (void) idx; /* to kill a warning */
+ #endif
++ } else if (vaddr >= PKMAP_ADDR(0) && vaddr < PKMAP_ADDR(LAST_PKMAP)) {
++ /* this address was obtained through kmap_high_get() */
++ kunmap_high(pte_page(pkmap_page_table[PKMAP_NR(vaddr)]));
+ }
+ pagefault_enable();
+ }
+
+
+From gregkh@mini.kroah.org Wed Sep 16 15:37:18 2009
+Message-Id: <20090916223717.952693286@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Sep 2009 15:36:45 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Marcelo Tosatti <mtosatti@redhat.com>,
+ Avi Kivity <avi@redhat.com>
+Subject: [patch 32/45] KVM guest: do not batch pte updates from interrupt context
+References: <20090916223613.597295240@mini.kroah.org>
+Content-Disposition: inline; filename=kvm-guest-do-not-batch-pte-updates-from-interrupt-context.patch
+Content-Length: 1760
+Lines: 63
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Marcelo Tosatti <mtosatti@redhat.com>
+
+commit 6ba661787594868512a71c129062ebd57d0c01e7 upstream.
+
+Commit b8bcfe997e4 made paravirt pte updates synchronous in interrupt
+context.
+
+Unfortunately the KVM pv mmu code caches the lazy/nonlazy mode
+internally, so a pte update from interrupt context during a lazy mmu
+operation can be batched while it should be performed synchronously.
+
+https://bugzilla.redhat.com/show_bug.cgi?id=518022
+
+Drop the internal mode variable and use paravirt_get_lazy_mode(), which
+returns the correct state.
+
+Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
+Signed-off-by: Avi Kivity <avi@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/kvm.c | 7 +------
+ 1 file changed, 1 insertion(+), 6 deletions(-)
+
+--- a/arch/x86/kernel/kvm.c
++++ b/arch/x86/kernel/kvm.c
+@@ -34,7 +34,6 @@
+ struct kvm_para_state {
+ u8 mmu_queue[MMU_QUEUE_SIZE];
+ int mmu_queue_len;
+- enum paravirt_lazy_mode mode;
+ };
+
+ static DEFINE_PER_CPU(struct kvm_para_state, para_state);
+@@ -77,7 +76,7 @@ static void kvm_deferred_mmu_op(void *bu
+ {
+ struct kvm_para_state *state = kvm_para_state();
+
+- if (state->mode != PARAVIRT_LAZY_MMU) {
++ if (paravirt_get_lazy_mode() != PARAVIRT_LAZY_MMU) {
+ kvm_mmu_op(buffer, len);
+ return;
+ }
+@@ -185,10 +184,7 @@ static void kvm_release_pt(unsigned long
+
+ static void kvm_enter_lazy_mmu(void)
+ {
+- struct kvm_para_state *state = kvm_para_state();
+-
+ paravirt_enter_lazy_mmu();
+- state->mode = paravirt_get_lazy_mode();
+ }
+
+ static void kvm_leave_lazy_mmu(void)
+@@ -197,7 +193,6 @@ static void kvm_leave_lazy_mmu(void)
+
+ mmu_queue_flush(state);
+ paravirt_leave_lazy_mmu();
+- state->mode = paravirt_get_lazy_mode();
+ }
+
+ static void __init paravirt_ops_setup(void)
+
+
+From gregkh@mini.kroah.org Wed Sep 16 15:37:18 2009
+Message-Id: <20090916223718.130918299@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Sep 2009 15:36:46 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Gleb Natapov <gleb@redhat.com>,
+ Marcelo Tosatti <mtosatti@redhat.com>,
+ Avi Kivity <avi@redhat.com>
+Subject: [patch 33/45] KVM: Fix coalesced interrupt reporting in IOAPIC
+References: <20090916223613.597295240@mini.kroah.org>
+Content-Disposition: inline; filename=kvm-fix-coalesced-interrupt-reporting-in-ioapic.patch
+Content-Length: 725
+Lines: 27
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Gleb Natapov <gleb@redhat.com>
+
+commit 65a82211636f156a276cac3f8665605ae18f371f upstream.
+
+This bug was introduced by b4a2f5e723e4f7df467.
+
+Signed-off-by: Gleb Natapov <gleb@redhat.com>
+Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
+Signed-off-by: Avi Kivity <avi@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ virt/kvm/ioapic.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/virt/kvm/ioapic.c
++++ b/virt/kvm/ioapic.c
+@@ -188,6 +188,8 @@ int kvm_ioapic_set_irq(struct kvm_ioapic
+ if ((edge && old_irr != ioapic->irr) ||
+ (!edge && !entry.fields.remote_irr))
+ ret = ioapic_service(ioapic, irq);
++ else
++ ret = 0; /* report coalesced interrupt */
+ }
+ }
+ return ret;
+
+
+From gregkh@mini.kroah.org Wed Sep 16 15:37:18 2009
+Message-Id: <20090916223718.283870494@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Sep 2009 15:36:47 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Avi Kivity <avi@redhat.com>,
+ Marcelo Tosatti <mtosatti@redhat.com>
+Subject: [patch 34/45] KVM: VMX: Check cpl before emulating debug register access
+References: <20090916223613.597295240@mini.kroah.org>
+Content-Disposition: inline; filename=kvm-vmx-check-cpl-before-emulating-debug-register-access.patch
+Content-Length: 1905
+Lines: 62
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Avi Kivity <avi@redhat.com>
+
+commit 0a79b009525b160081d75cef5dbf45817956acf2 upstream.
+
+Debug registers may only be accessed from cpl 0. Unfortunately, vmx will
+code to emulate the instruction even though it was issued from guest
+userspace, possibly leading to an unexpected trap later.
+
+Signed-off-by: Avi Kivity <avi@redhat.com>
+Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/include/asm/kvm_host.h | 1 +
+ arch/x86/kvm/vmx.c | 2 ++
+ arch/x86/kvm/x86.c | 13 +++++++++++++
+ 3 files changed, 16 insertions(+)
+
+--- a/arch/x86/include/asm/kvm_host.h
++++ b/arch/x86/include/asm/kvm_host.h
+@@ -618,6 +618,7 @@ void kvm_queue_exception(struct kvm_vcpu
+ void kvm_queue_exception_e(struct kvm_vcpu *vcpu, unsigned nr, u32 error_code);
+ void kvm_inject_page_fault(struct kvm_vcpu *vcpu, unsigned long cr2,
+ u32 error_code);
++bool kvm_require_cpl(struct kvm_vcpu *vcpu, int required_cpl);
+
+ int kvm_pic_set_irq(void *opaque, int irq, int level);
+
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -2841,6 +2841,8 @@ static int handle_dr(struct kvm_vcpu *vc
+ unsigned long val;
+ int dr, reg;
+
++ if (!kvm_require_cpl(vcpu, 0))
++ return 1;
+ dr = vmcs_readl(GUEST_DR7);
+ if (dr & DR7_GD) {
+ /*
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -215,6 +215,19 @@ static void __queue_exception(struct kvm
+ }
+
+ /*
++ * Checks if cpl <= required_cpl; if true, return true. Otherwise queue
++ * a #GP and return false.
++ */
++bool kvm_require_cpl(struct kvm_vcpu *vcpu, int required_cpl)
++{
++ if (kvm_x86_ops->get_cpl(vcpu) <= required_cpl)
++ return true;
++ kvm_queue_exception_e(vcpu, GP_VECTOR, 0);
++ return false;
++}
++EXPORT_SYMBOL_GPL(kvm_require_cpl);
++
++/*
+ * Load the pae pdptrs. Return true is they are all valid.
+ */
+ int load_pdptrs(struct kvm_vcpu *vcpu, unsigned long cr3)
+
+
+From gregkh@mini.kroah.org Wed Sep 16 15:37:18 2009
+Message-Id: <20090916223718.433647359@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Sep 2009 15:36:48 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Glauber Costa <glommer@redhat.com>,
+ Avi Kivity <avi@redhat.com>
+Subject: [patch 35/45] KVM guest: fix bogus wallclock physical address calculation
+References: <20090916223613.597295240@mini.kroah.org>
+Content-Disposition: inline; filename=kvm-guest-fix-bogus-wallclock-physical-address-calculation.patch
+Content-Length: 1127
+Lines: 34
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Glauber Costa <glommer@redhat.com>
+
+commit a20316d2aa41a8f4fd171648bad8f044f6060826 upstream.
+
+The use of __pa() to calculate the address of a C-visible symbol
+is wrong, and can lead to unpredictable results. See arch/x86/include/asm/page.h
+for details.
+
+It should be replaced with __pa_symbol(), that does the correct math here,
+by taking relocations into account. This ensures the correct wallclock data
+structure physical address is passed to the hypervisor.
+
+Signed-off-by: Glauber Costa <glommer@redhat.com>
+Signed-off-by: Avi Kivity <avi@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/kvmclock.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/x86/kernel/kvmclock.c
++++ b/arch/x86/kernel/kvmclock.c
+@@ -50,8 +50,8 @@ static unsigned long kvm_get_wallclock(v
+ struct timespec ts;
+ int low, high;
+
+- low = (int)__pa(&wall_clock);
+- high = ((u64)__pa(&wall_clock) >> 32);
++ low = (int)__pa_symbol(&wall_clock);
++ high = ((u64)__pa_symbol(&wall_clock) >> 32);
+ native_write_msr(MSR_KVM_WALL_CLOCK, low, high);
+
+ vcpu_time = &get_cpu_var(hv_clock);
+
+
+From gregkh@mini.kroah.org Wed Sep 16 15:37:18 2009
+Message-Id: <20090916223718.589833958@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Sep 2009 15:36:49 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jan Kiszka <jan.kiszka@siemens.com>,
+ Avi Kivity <avi@redhat.com>
+Subject: [patch 36/45] KVM: x86: Disallow hypercalls for guest callers in rings > 0
+References: <20090916223613.597295240@mini.kroah.org>
+Content-Disposition: inline; filename=kvm-x86-disallow-hypercalls-for-guest-callers-in-rings-0.patch
+Content-Length: 1537
+Lines: 55
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Jan Kiszka <jan.kiszka@siemens.com>
+
+commit 07708c4af1346ab1521b26a202f438366b7bcffd upstream.
+
+So far unprivileged guest callers running in ring 3 can issue, e.g., MMU
+hypercalls. Normally, such callers cannot provide any hand-crafted MMU
+command structure as it has to be passed by its physical address, but
+they can still crash the guest kernel by passing random addresses.
+
+To close the hole, this patch considers hypercalls valid only if issued
+from guest ring 0. This may still be relaxed on a per-hypercall base in
+the future once required.
+
+Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
+Signed-off-by: Avi Kivity <avi@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kvm/x86.c | 6 ++++++
+ include/linux/kvm_para.h | 1 +
+ 2 files changed, 7 insertions(+)
+
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -2911,6 +2911,11 @@ int kvm_emulate_hypercall(struct kvm_vcp
+ a3 &= 0xFFFFFFFF;
+ }
+
++ if (kvm_x86_ops->get_cpl(vcpu) != 0) {
++ ret = -KVM_EPERM;
++ goto out;
++ }
++
+ switch (nr) {
+ case KVM_HC_VAPIC_POLL_IRQ:
+ ret = 0;
+@@ -2922,6 +2927,7 @@ int kvm_emulate_hypercall(struct kvm_vcp
+ ret = -KVM_ENOSYS;
+ break;
+ }
++out:
+ kvm_register_write(vcpu, VCPU_REGS_RAX, ret);
+ ++vcpu->stat.hypercalls;
+ return r;
+--- a/include/linux/kvm_para.h
++++ b/include/linux/kvm_para.h
+@@ -13,6 +13,7 @@
+ #define KVM_ENOSYS 1000
+ #define KVM_EFAULT EFAULT
+ #define KVM_E2BIG E2BIG
++#define KVM_EPERM EPERM
+
+ #define KVM_HC_VAPIC_POLL_IRQ 1
+ #define KVM_HC_MMU_OP 2
+
+
+From gregkh@mini.kroah.org Wed Sep 16 15:37:18 2009
+Message-Id: <20090916223718.746468813@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Sep 2009 15:36:50 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Gleb Natapov <gleb@redhat.com>,
+ Avi Kivity <avi@redhat.com>
+Subject: [patch 37/45] KVM: VMX: Fix cr8 exiting control clobbering by EPT
+References: <20090916223613.597295240@mini.kroah.org>
+Content-Disposition: inline; filename=kvm-vmx-fix-cr8-exiting-control-clobbering-by-ept.patch
+Content-Length: 1262
+Lines: 35
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Gleb Natapov <gleb@redhat.com>
+
+commit 5fff7d270bd6a4759b6d663741b729cdee370257 upstream.
+
+Don't call adjust_vmx_controls() two times for the same control.
+It restores options that were dropped earlier. This loses us the cr8
+exit control, which causes a massive performance regression Windows x64.
+
+Signed-off-by: Gleb Natapov <gleb@redhat.com>
+Signed-off-by: Avi Kivity <avi@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kvm/vmx.c | 9 +++------
+ 1 file changed, 3 insertions(+), 6 deletions(-)
+
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -1217,12 +1217,9 @@ static __init int setup_vmcs_config(stru
+ if (_cpu_based_2nd_exec_control & SECONDARY_EXEC_ENABLE_EPT) {
+ /* CR3 accesses and invlpg don't need to cause VM Exits when EPT
+ enabled */
+- min &= ~(CPU_BASED_CR3_LOAD_EXITING |
+- CPU_BASED_CR3_STORE_EXITING |
+- CPU_BASED_INVLPG_EXITING);
+- if (adjust_vmx_controls(min, opt, MSR_IA32_VMX_PROCBASED_CTLS,
+- &_cpu_based_exec_control) < 0)
+- return -EIO;
++ _cpu_based_exec_control &= ~(CPU_BASED_CR3_LOAD_EXITING |
++ CPU_BASED_CR3_STORE_EXITING |
++ CPU_BASED_INVLPG_EXITING);
+ rdmsr(MSR_IA32_VMX_EPT_VPID_CAP,
+ vmx_capability.ept, vmx_capability.vpid);
+ }
+
+
+From gregkh@mini.kroah.org Wed Sep 16 15:37:19 2009
+Message-Id: <20090916223718.880939612@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Sep 2009 15:36:51 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Avi Kivity <avi@redhat.com>
+Subject: [patch 38/45] KVM: x86 emulator: Implement zero-extended immediate decoding
+References: <20090916223613.597295240@mini.kroah.org>
+Content-Disposition: inline; filename=kvm-x86-emulator-implement-zero-extended-immediate-decoding.patch
+Content-Length: 1366
+Lines: 52
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Avi Kivity <avi@redhat.com>
+
+commit c9eaf20f268c7051bfde2ba212c5ea76a6cbc7a1 upstream.
+
+Absolute jumps use zero extended immediate operands.
+
+Signed-off-by: Avi Kivity <avi@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kvm/x86_emulate.c | 15 +++++++++++++++
+ 1 file changed, 15 insertions(+)
+
+--- a/arch/x86/kvm/x86_emulate.c
++++ b/arch/x86/kvm/x86_emulate.c
+@@ -60,6 +60,7 @@
+ #define SrcImmByte (6<<4) /* 8-bit sign-extended immediate operand. */
+ #define SrcOne (7<<4) /* Implied '1' */
+ #define SrcImmUByte (8<<4) /* 8-bit unsigned immediate operand. */
++#define SrcImmU (9<<4) /* Immediate operand, unsigned */
+ #define SrcMask (0xf<<4)
+ /* Generic ModRM decode. */
+ #define ModRM (1<<8)
+@@ -1027,6 +1028,7 @@ done_prefixes:
+ c->src.type = OP_MEM;
+ break;
+ case SrcImm:
++ case SrcImmU:
+ c->src.type = OP_IMM;
+ c->src.ptr = (unsigned long *)c->eip;
+ c->src.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
+@@ -1044,6 +1046,19 @@ done_prefixes:
+ c->src.val = insn_fetch(s32, 4, c->eip);
+ break;
+ }
++ if ((c->d & SrcMask) == SrcImmU) {
++ switch (c->src.bytes) {
++ case 1:
++ c->src.val &= 0xff;
++ break;
++ case 2:
++ c->src.val &= 0xffff;
++ break;
++ case 4:
++ c->src.val &= 0xffffffff;
++ break;
++ }
++ }
+ break;
+ case SrcImmByte:
+ case SrcImmUByte:
+
+
+From gregkh@mini.kroah.org Wed Sep 16 15:37:19 2009
+Message-Id: <20090916223719.027326510@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Sep 2009 15:36:52 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Izik Eidus <ieidus@redhat.com>,
+ Marcelo Tosatti <mtosatti@redhat.com>,
+ Avi Kivity <avi@redhat.com>
+Subject: [patch 39/45] KVM: MMU: make __kvm_mmu_free_some_pages handle empty list
+References: <20090916223613.597295240@mini.kroah.org>
+Content-Disposition: inline; filename=kvm-mmu-make-__kvm_mmu_free_some_pages-handle-empty-list.patch
+Content-Length: 903
+Lines: 29
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Izik Eidus <ieidus@redhat.com>
+
+commit 3b80fffe2b31fb716d3ebe729c54464ee7856723 upstream.
+
+First check if the list is empty before attempting to look at list
+entries.
+
+Signed-off-by: Izik Eidus <ieidus@redhat.com>
+Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
+Signed-off-by: Avi Kivity <avi@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kvm/mmu.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/arch/x86/kvm/mmu.c
++++ b/arch/x86/kvm/mmu.c
+@@ -2633,7 +2633,8 @@ EXPORT_SYMBOL_GPL(kvm_mmu_unprotect_page
+
+ void __kvm_mmu_free_some_pages(struct kvm_vcpu *vcpu)
+ {
+- while (vcpu->kvm->arch.n_free_mmu_pages < KVM_REFILL_PAGES) {
++ while (vcpu->kvm->arch.n_free_mmu_pages < KVM_REFILL_PAGES &&
++ !list_empty(&vcpu->kvm->arch.active_mmu_pages)) {
+ struct kvm_mmu_page *sp;
+
+ sp = container_of(vcpu->kvm->arch.active_mmu_pages.prev,
+
+
+From gregkh@mini.kroah.org Wed Sep 16 15:37:19 2009
+Message-Id: <20090916223719.185046828@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Sep 2009 15:36:53 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Avi Kivity <avi@redhat.com>
+Subject: [patch 40/45] KVM: x86 emulator: fix jmp far decoding (opcode 0xea)
+References: <20090916223613.597295240@mini.kroah.org>
+Content-Disposition: inline; filename=kvm-x86-emulator-fix-jmp-far-decoding.patch
+Content-Length: 801
+Lines: 25
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Avi Kivity <avi@redhat.com>
+
+commit ee3d29e8bee8d7c321279a9bd9bd25d4cfbf79b7 upstream.
+
+The jump target should not be sign extened; use an unsigned decode flag.
+
+Signed-off-by: Avi Kivity <avi@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kvm/x86_emulate.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/x86/kvm/x86_emulate.c
++++ b/arch/x86/kvm/x86_emulate.c
+@@ -196,7 +196,7 @@ static u32 opcode_table[256] = {
+ ByteOp | SrcImmUByte, SrcImmUByte,
+ /* 0xE8 - 0xEF */
+ SrcImm | Stack, SrcImm | ImplicitOps,
+- SrcImm | Src2Imm16, SrcImmByte | ImplicitOps,
++ SrcImmU | Src2Imm16, SrcImmByte | ImplicitOps,
+ SrcNone | ByteOp | ImplicitOps, SrcNone | ImplicitOps,
+ SrcNone | ByteOp | ImplicitOps, SrcNone | ImplicitOps,
+ /* 0xF0 - 0xF7 */
+
+
+From gregkh@mini.kroah.org Wed Sep 16 15:37:19 2009
+Message-Id: <20090916223719.346977542@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Sep 2009 15:36:54 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Marcelo Tosatti <mtosatti@redhat.com>,
+ Avi Kivity <avi@redhat.com>
+Subject: [patch 41/45] KVM: limit lapic periodic timer frequency
+References: <20090916223613.597295240@mini.kroah.org>
+Content-Disposition: inline; filename=kvm-limit-lapic-periodic-timer-frequency.patch
+Content-Length: 980
+Lines: 34
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Marcelo Tosatti <mtosatti@redhat.com>
+
+commit 1444885a045fe3b1905a14ea1b52540bf556578b upstream.
+
+Otherwise its possible to starve the host by programming lapic timer
+with a very high frequency.
+
+Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
+Signed-off-by: Avi Kivity <avi@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kvm/lapic.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/arch/x86/kvm/lapic.c
++++ b/arch/x86/kvm/lapic.c
+@@ -573,6 +573,15 @@ static void start_apic_timer(struct kvm_
+
+ if (!apic->lapic_timer.period)
+ return;
++ /*
++ * Do not allow the guest to program periodic timers with small
++ * interval, since the hrtimers are not throttled by the host
++ * scheduler.
++ */
++ if (apic_lvtt_period(apic)) {
++ if (apic->lapic_timer.period < NSEC_PER_MSEC/2)
++ apic->lapic_timer.period = NSEC_PER_MSEC/2;
++ }
+
+ hrtimer_start(&apic->lapic_timer.timer,
+ ktime_add_ns(now, apic->lapic_timer.period),
+
+
+From gregkh@mini.kroah.org Wed Sep 16 15:37:19 2009
+Message-Id: <20090916223719.521373239@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Sep 2009 15:36:55 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Tejun Heo <tj@kernel.org>,
+ Jeff Garzik <jgarzik@redhat.com>
+Subject: [patch 42/45] libata: fix off-by-one error in ata_tf_read_block()
+References: <20090916223613.597295240@mini.kroah.org>
+Content-Disposition: inline; filename=libata-fix-off-by-one-error-in-ata_tf_read_block.patch
+Content-Length: 1147
+Lines: 38
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Tejun Heo <htejun@gmail.com>
+
+commit ac8672ea922bde59acf50eaa1eaa1640a6395fd2 upstream.
+
+ata_tf_read_block() has off-by-one error when converting CHS address
+to LBA. The bug isn't very visible because ata_tf_read_block() is
+used only when generating sense data for a failed RW command and CHS
+addressing isn't used too often these days.
+
+This problem was spotted by Atsushi Nemoto.
+
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Reported-by: Atsushi Nemoto <anemo@mba.ocn.ne.jp>
+Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/ata/libata-core.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -709,7 +709,13 @@ u64 ata_tf_read_block(struct ata_taskfil
+ head = tf->device & 0xf;
+ sect = tf->lbal;
+
+- block = (cyl * dev->heads + head) * dev->sectors + sect;
++ if (!sect) {
++ ata_dev_printk(dev, KERN_WARNING, "device reported "
++ "invalid CHS sector 0\n");
++ sect = 1; /* oh well */
++ }
++
++ block = (cyl * dev->heads + head) * dev->sectors + sect - 1;
+ }
+
+ return block;
+
+
+From gregkh@mini.kroah.org Wed Sep 16 15:37:19 2009
+Message-Id: <20090916223719.697894760@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Sep 2009 15:36:56 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Alexander Duyck <alexander.h.duyck@intel.com>,
+ Jeff Kirsher <jeffrey.t.kirsher@intel.com>,
+ Jesse Barnes <jbarnes@virtuousgeek.org>
+Subject: [patch 43/45] PCI quirk: update 82576 device ids in SR-IOV quirks list
+References: <20090916223613.597295240@mini.kroah.org>
+Content-Disposition: inline; filename=pci-quirk-update-82576-device-ids-in-sr-iov-quirks-list.patch
+Content-Length: 985
+Lines: 27
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Alexander Duyck <alexander.h.duyck@intel.com>
+
+commit 6f1186be4feb3364d3a52cbea81e43e4d5296196 upstream.
+
+This patch adds the most recent additions to the list of 82576 device IDs
+to the list of devices needing the SR-IOV quirk.
+
+Signed-off-by: Alexander Duyck <alexander.h.duyck@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/pci/quirks.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -2494,6 +2494,7 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_I
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x10e7, quirk_i82576_sriov);
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x10e8, quirk_i82576_sriov);
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x150a, quirk_i82576_sriov);
++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x150d, quirk_i82576_sriov);
+
+ #endif /* CONFIG_PCI_IOV */
+
+
+
+From gregkh@mini.kroah.org Wed Sep 16 15:37:19 2009
+Message-Id: <20090916223719.861500408@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Sep 2009 15:36:57 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jean Delvare <khali@linux-fr.org>,
+ Jesse Barnes <jbarnes@virtuousgeek.org>
+Subject: [patch 44/45] PCI: Unhide the SMBus on the Compaq Evo D510 USDT
+References: <20090916223613.597295240@mini.kroah.org>
+Content-Disposition: inline; filename=pci-unhide-the-smbus-on-the-compaq-evo-d510-usdt.patch
+Content-Length: 1020
+Lines: 29
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Jean Delvare <khali@linux-fr.org>
+
+commit 6b5096e4d4496e185cd1ada5d1b8e1d941c805ed upstream.
+
+One more form factor for Compaq Evo D510, which needs the same quirk
+as the other form factors. Apparently there's no hardware monitoring
+chip on that one, but SPD EEPROMs, so it's still worth unhiding the
+SMBus.
+
+Signed-off-by: Jean Delvare <khali@linux-fr.org>
+Tested-by: Nuzhna Pomoshch <nuzhna_pomoshch@yahoo.com>
+Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/pci/quirks.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -1201,6 +1201,7 @@ static void __init asus_hides_smbus_host
+ switch(dev->subsystem_device) {
+ case 0x00b8: /* Compaq Evo D510 CMT */
+ case 0x00b9: /* Compaq Evo D510 SFF */
++ case 0x00ba: /* Compaq Evo D510 USDT */
+ /* Motherboard doesn't have Host bridge
+ * subvendor/subdevice IDs and on-board VGA
+ * controller is disabled if an AGP card is
+
+
+From gregkh@mini.kroah.org Wed Sep 16 15:37:20 2009
+Message-Id: <20090916223719.999597150@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Sep 2009 15:36:58 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Brian King <brking@linux.vnet.ibm.com>,
+ Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Subject: [patch 45/45] powerpc/pseries: Fix to handle slb resize across migration
+References: <20090916223613.597295240@mini.kroah.org>
+Content-Disposition: inline; filename=powerpc-pseries-fix-to-handle-slb-resize-across-migration.patch
+Content-Length: 4804
+Lines: 160
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Brian King <brking@linux.vnet.ibm.com>
+
+commit 46db2f86a3b2a94e0b33e0b4548fb7b7b6bdff66 upstream.
+
+The SLB can change sizes across a live migration, which was not
+being handled, resulting in possible machine crashes during
+migration if migrating to a machine which has a smaller max SLB
+size than the source machine. Fix this by first reducing the
+SLB size to the minimum possible value, which is 32, prior to
+migration. Then during the device tree update which occurs after
+migration, we make the call to ensure the SLB gets updated. Also
+add the slb_size to the lparcfg output so that the migration
+tools can check to make sure the kernel has this capability
+before allowing migration in scenarios where the SLB size will change.
+
+BenH: Fixed #include <asm/mmu-hash64.h> -> <asm/mmu.h> to avoid
+ breaking ppc32 build
+
+Signed-off-by: Brian King <brking@linux.vnet.ibm.com>
+Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/powerpc/include/asm/mmu-hash64.h | 2 ++
+ arch/powerpc/kernel/lparcfg.c | 3 +++
+ arch/powerpc/kernel/rtas.c | 7 ++++++-
+ arch/powerpc/mm/slb.c | 16 ++++++++++++----
+ arch/powerpc/platforms/pseries/reconfig.c | 9 ++++++++-
+ 5 files changed, 31 insertions(+), 6 deletions(-)
+
+--- a/arch/powerpc/include/asm/mmu-hash64.h
++++ b/arch/powerpc/include/asm/mmu-hash64.h
+@@ -41,6 +41,7 @@ extern char initial_stab[];
+
+ #define SLB_NUM_BOLTED 3
+ #define SLB_CACHE_ENTRIES 8
++#define SLB_MIN_SIZE 32
+
+ /* Bits in the SLB ESID word */
+ #define SLB_ESID_V ASM_CONST(0x0000000008000000) /* valid */
+@@ -296,6 +297,7 @@ extern void slb_flush_and_rebolt(void);
+ extern void stab_initialize(unsigned long stab);
+
+ extern void slb_vmalloc_update(void);
++extern void slb_set_size(u16 size);
+ #endif /* __ASSEMBLY__ */
+
+ /*
+--- a/arch/powerpc/kernel/lparcfg.c
++++ b/arch/powerpc/kernel/lparcfg.c
+@@ -35,6 +35,7 @@
+ #include <asm/prom.h>
+ #include <asm/vdso_datapage.h>
+ #include <asm/vio.h>
++#include <asm/mmu.h>
+
+ #define MODULE_VERS "1.8"
+ #define MODULE_NAME "lparcfg"
+@@ -537,6 +538,8 @@ static int pseries_lparcfg_data(struct s
+
+ seq_printf(m, "shared_processor_mode=%d\n", lppaca[0].shared_proc);
+
++ seq_printf(m, "slb_size=%d\n", mmu_slb_size);
++
+ return 0;
+ }
+
+--- a/arch/powerpc/kernel/rtas.c
++++ b/arch/powerpc/kernel/rtas.c
+@@ -39,6 +39,7 @@
+ #include <asm/smp.h>
+ #include <asm/atomic.h>
+ #include <asm/time.h>
++#include <asm/mmu.h>
+
+ struct rtas_t rtas = {
+ .lock = __RAW_SPIN_LOCK_UNLOCKED
+@@ -713,6 +714,7 @@ static void rtas_percpu_suspend_me(void
+ {
+ long rc = H_SUCCESS;
+ unsigned long msr_save;
++ u16 slb_size = mmu_slb_size;
+ int cpu;
+ struct rtas_suspend_me_data *data =
+ (struct rtas_suspend_me_data *)info;
+@@ -735,13 +737,16 @@ static void rtas_percpu_suspend_me(void
+ /* All other cpus are in H_JOIN, this cpu does
+ * the suspend.
+ */
++ slb_set_size(SLB_MIN_SIZE);
+ printk(KERN_DEBUG "calling ibm,suspend-me on cpu %i\n",
+ smp_processor_id());
+ data->error = rtas_call(data->token, 0, 1, NULL);
+
+- if (data->error)
++ if (data->error) {
+ printk(KERN_DEBUG "ibm,suspend-me returned %d\n",
+ data->error);
++ slb_set_size(slb_size);
++ }
+ } else {
+ printk(KERN_ERR "H_JOIN on cpu %i failed with rc = %ld\n",
+ smp_processor_id(), rc);
+--- a/arch/powerpc/mm/slb.c
++++ b/arch/powerpc/mm/slb.c
+@@ -240,14 +240,22 @@ void switch_slb(struct task_struct *tsk,
+ static inline void patch_slb_encoding(unsigned int *insn_addr,
+ unsigned int immed)
+ {
+- /* Assume the instruction had a "0" immediate value, just
+- * "or" in the new value
+- */
+- *insn_addr |= immed;
++ *insn_addr = (*insn_addr & 0xffff0000) | immed;
+ flush_icache_range((unsigned long)insn_addr, 4+
+ (unsigned long)insn_addr);
+ }
+
++void slb_set_size(u16 size)
++{
++ extern unsigned int *slb_compare_rr_to_size;
++
++ if (mmu_slb_size == size)
++ return;
++
++ mmu_slb_size = size;
++ patch_slb_encoding(slb_compare_rr_to_size, mmu_slb_size);
++}
++
+ void slb_initialize(void)
+ {
+ unsigned long linear_llp, vmalloc_llp, io_llp;
+--- a/arch/powerpc/platforms/pseries/reconfig.c
++++ b/arch/powerpc/platforms/pseries/reconfig.c
+@@ -20,6 +20,7 @@
+ #include <asm/machdep.h>
+ #include <asm/uaccess.h>
+ #include <asm/pSeries_reconfig.h>
++#include <asm/mmu.h>
+
+
+
+@@ -439,9 +440,15 @@ static int do_update_property(char *buf,
+ if (!newprop)
+ return -ENOMEM;
+
++ if (!strcmp(name, "slb-size") || !strcmp(name, "ibm,slb-size"))
++ slb_set_size(*(int *)value);
++
+ oldprop = of_find_property(np, name,NULL);
+- if (!oldprop)
++ if (!oldprop) {
++ if (strlen(name))
++ return prom_add_property(np, newprop);
+ return -ENODEV;
++ }
+
+ rc = prom_update_property(np, newprop, oldprop);
+ if (rc)
+
+
+From gregkh@mini.kroah.org Wed Sep 16 15:37:13 2009
+Message-Id: <20090916223613.597295240@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Sep 2009 15:36:13 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk
+Subject: [patch 00/45] 2.6.31.1-stable review
+Content-Length: 882
+Lines: 22
+
+This is the start of the stable review cycle for the 2.6.31.1 release.
+There are 45 patches in this series, all will be posted as a response
+to this one. If anyone has any issues with these being applied, please
+let us know. If anyone is a maintainer of the proper subsystem, and
+wants to add a Signed-off-by: line to the patch, please respond with it.
+
+These patches are sent out with a number of different people on the Cc:
+line. If you wish to be a reviewer, please email stable@kernel.org to
+add your name to the list. If you want to be off the reviewer list,
+also email us.
+
+Responses should be made by Friday, September 18, 22:00:00 UTC.
+Anything received after that time might be too late.
+
+The whole patch series can be found in one patch at:
+ kernel.org/pub/linux/kernel/v2.6/stable-review/patch-2.6.31.1-rc1.gz
+and the diffstat can be found below.
+
+
+thanks,
+
+greg k-h
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
