--- /dev/null
+From 6148b130eb84edc76e4fa88da1877b27be6c2f06 Mon Sep 17 00:00:00 2001
+From: Sophie Hamilton <kernel@theblob.org>
+Date: Tue, 8 Sep 2009 10:58:42 +0200
+Subject: ALSA: cs46xx - Fix minimum period size
+
+From: Sophie Hamilton <kernel@theblob.org>
+
+commit 6148b130eb84edc76e4fa88da1877b27be6c2f06 upstream.
+
+Fix minimum period size for cs46xx cards. This fixes a problem in the
+case where neither a period size nor a buffer size is passed to ALSA;
+this is the case in Audacious, OpenAL, and others.
+
+Signed-off-by: Sophie Hamilton <kernel@theblob.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/cs46xx/cs46xx_lib.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/pci/cs46xx/cs46xx_lib.h
++++ b/sound/pci/cs46xx/cs46xx_lib.h
+@@ -35,7 +35,7 @@
+
+
+ #ifdef CONFIG_SND_CS46XX_NEW_DSP
+-#define CS46XX_MIN_PERIOD_SIZE 1
++#define CS46XX_MIN_PERIOD_SIZE 64
+ #define CS46XX_MAX_PERIOD_SIZE 1024*1024
+ #else
+ #define CS46XX_MIN_PERIOD_SIZE 2048
--- /dev/null
+From ac8672ea922bde59acf50eaa1eaa1640a6395fd2 Mon Sep 17 00:00:00 2001
+From: Tejun Heo <htejun@gmail.com>
+Date: Sun, 16 Aug 2009 21:21:21 +0900
+Subject: libata: fix off-by-one error in ata_tf_read_block()
+
+From: Tejun Heo <htejun@gmail.com>
+
+commit ac8672ea922bde59acf50eaa1eaa1640a6395fd2 upstream.
+
+ata_tf_read_block() has off-by-one error when converting CHS address
+to LBA. The bug isn't very visible because ata_tf_read_block() is
+used only when generating sense data for a failed RW command and CHS
+addressing isn't used too often these days.
+
+This problem was spotted by Atsushi Nemoto.
+
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Reported-by: Atsushi Nemoto <anemo@mba.ocn.ne.jp>
+Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/ata/libata-core.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -565,7 +565,13 @@ u64 ata_tf_read_block(struct ata_taskfil
+ head = tf->device & 0xf;
+ sect = tf->lbal;
+
+- block = (cyl * dev->heads + head) * dev->sectors + sect;
++ if (!sect) {
++ ata_dev_printk(dev, KERN_WARNING, "device reported "
++ "invalid CHS sector 0\n");
++ sect = 1; /* oh well */
++ }
++
++ block = (cyl * dev->heads + head) * dev->sectors + sect - 1;
+ }
+
+ return block;
--- /dev/null
+From cebbert@redhat.com Wed Sep 16 14:52:00 2009
+From: Wei Yongjun <yjwei@cn.fujitsu.com>
+Date: Fri, 11 Sep 2009 18:45:47 -0400
+Subject: nfsd: fix hung up of nfs client while sync write data to nfs server
+To: stable@kernel.org
+Cc: "J. Bruce Fields" <bfields@citi.umich.edu>
+Message-ID: <20090911184547.75570335@dhcp-100-2-144.bos.redhat.com>
+
+
+From: Wei Yongjun <yjwei@cn.fujitsu.com>
+
+commit a0d24b295aed7a9daf4ca36bd4784e4d40f82303 upstream.
+
+nfsd: fix hung up of nfs client while sync write data to nfs server
+
+Commit 'Short write in nfsd becomes a full write to the client'
+(31dec2538e45e9fff2007ea1f4c6bae9f78db724) broken the sync write.
+With the following commands to reproduce:
+
+ $ mount -t nfs -o sync 192.168.0.21:/nfsroot /mnt
+ $ cd /mnt
+ $ echo aaaa > temp.txt
+
+Then nfs client is hung up.
+
+In SYNC mode the server alaways return the write count 0 to the
+client. This is because the value of host_err in nfsd_vfs_write()
+will be overwrite in SYNC mode by 'host_err=nfsd_sync(file);',
+and then we return host_err(which is now 0) as write count.
+
+This patch fixed the problem.
+
+Signed-off-by: Wei Yongjun <yjwei@cn.fujitsu.com>
+Signed-off-by: J. Bruce Fields <bfields@citi.umich.edu>
+Cc: Chuck Ebbert <cebbert@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/nfsd/vfs.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/fs/nfsd/vfs.c
++++ b/fs/nfsd/vfs.c
+@@ -1003,6 +1003,7 @@ nfsd_vfs_write(struct svc_rqst *rqstp, s
+ host_err = vfs_writev(file, (struct iovec __user *)vec, vlen, &offset);
+ set_fs(oldfs);
+ if (host_err >= 0) {
++ *cnt = host_err;
+ nfsdstats.io_write += host_err;
+ fsnotify_modify(file->f_path.dentry);
+ }
+@@ -1048,10 +1049,9 @@ nfsd_vfs_write(struct svc_rqst *rqstp, s
+ }
+
+ dprintk("nfsd: write complete host_err=%d\n", host_err);
+- if (host_err >= 0) {
++ if (host_err >= 0)
+ err = 0;
+- *cnt = host_err;
+- } else
++ else
+ err = nfserrno(host_err);
+ out:
+ return err;
--- /dev/null
+From 46db2f86a3b2a94e0b33e0b4548fb7b7b6bdff66 Mon Sep 17 00:00:00 2001
+From: Brian King <brking@linux.vnet.ibm.com>
+Date: Fri, 28 Aug 2009 12:06:29 +0000
+Subject: powerpc/pseries: Fix to handle slb resize across migration
+
+From: Brian King <brking@linux.vnet.ibm.com>
+
+commit 46db2f86a3b2a94e0b33e0b4548fb7b7b6bdff66 upstream.
+
+The SLB can change sizes across a live migration, which was not
+being handled, resulting in possible machine crashes during
+migration if migrating to a machine which has a smaller max SLB
+size than the source machine. Fix this by first reducing the
+SLB size to the minimum possible value, which is 32, prior to
+migration. Then during the device tree update which occurs after
+migration, we make the call to ensure the SLB gets updated. Also
+add the slb_size to the lparcfg output so that the migration
+tools can check to make sure the kernel has this capability
+before allowing migration in scenarios where the SLB size will change.
+
+BenH: Fixed #include <asm/mmu-hash64.h> -> <asm/mmu.h> to avoid
+ breaking ppc32 build
+
+Signed-off-by: Brian King <brking@linux.vnet.ibm.com>
+Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/powerpc/include/asm/mmu-hash64.h | 2 ++
+ arch/powerpc/kernel/lparcfg.c | 3 +++
+ arch/powerpc/kernel/rtas.c | 7 ++++++-
+ arch/powerpc/mm/slb.c | 16 ++++++++++++----
+ arch/powerpc/platforms/pseries/reconfig.c | 9 ++++++++-
+ 5 files changed, 31 insertions(+), 6 deletions(-)
+
+--- a/arch/powerpc/include/asm/mmu-hash64.h
++++ b/arch/powerpc/include/asm/mmu-hash64.h
+@@ -41,6 +41,7 @@ extern char initial_stab[];
+
+ #define SLB_NUM_BOLTED 3
+ #define SLB_CACHE_ENTRIES 8
++#define SLB_MIN_SIZE 32
+
+ /* Bits in the SLB ESID word */
+ #define SLB_ESID_V ASM_CONST(0x0000000008000000) /* valid */
+@@ -299,6 +300,7 @@ extern void slb_flush_and_rebolt(void);
+ extern void stab_initialize(unsigned long stab);
+
+ extern void slb_vmalloc_update(void);
++extern void slb_set_size(u16 size);
+ #endif /* __ASSEMBLY__ */
+
+ /*
+--- a/arch/powerpc/kernel/lparcfg.c
++++ b/arch/powerpc/kernel/lparcfg.c
+@@ -35,6 +35,7 @@
+ #include <asm/prom.h>
+ #include <asm/vdso_datapage.h>
+ #include <asm/vio.h>
++#include <asm/mmu.h>
+
+ #define MODULE_VERS "1.8"
+ #define MODULE_NAME "lparcfg"
+@@ -485,6 +486,8 @@ static int pseries_lparcfg_data(struct s
+
+ seq_printf(m, "shared_processor_mode=%d\n", lppaca[0].shared_proc);
+
++ seq_printf(m, "slb_size=%d\n", mmu_slb_size);
++
+ return 0;
+ }
+
+--- a/arch/powerpc/kernel/rtas.c
++++ b/arch/powerpc/kernel/rtas.c
+@@ -38,6 +38,7 @@
+ #include <asm/syscalls.h>
+ #include <asm/smp.h>
+ #include <asm/atomic.h>
++#include <asm/mmu.h>
+
+ struct rtas_t rtas = {
+ .lock = SPIN_LOCK_UNLOCKED
+@@ -665,6 +666,7 @@ static void rtas_percpu_suspend_me(void
+ {
+ long rc;
+ unsigned long msr_save;
++ u16 slb_size = mmu_slb_size;
+ int cpu;
+ struct rtas_suspend_me_data *data =
+ (struct rtas_suspend_me_data *)info;
+@@ -686,13 +688,16 @@ static void rtas_percpu_suspend_me(void
+ /* All other cpus are in H_JOIN, this cpu does
+ * the suspend.
+ */
++ slb_set_size(SLB_MIN_SIZE);
+ printk(KERN_DEBUG "calling ibm,suspend-me on cpu %i\n",
+ smp_processor_id());
+ data->error = rtas_call(data->token, 0, 1, NULL);
+
+- if (data->error)
++ if (data->error) {
+ printk(KERN_DEBUG "ibm,suspend-me returned %d\n",
+ data->error);
++ slb_set_size(slb_size);
++ }
+ } else {
+ printk(KERN_ERR "H_JOIN on cpu %i failed with rc = %ld\n",
+ smp_processor_id(), rc);
+--- a/arch/powerpc/mm/slb.c
++++ b/arch/powerpc/mm/slb.c
+@@ -247,14 +247,22 @@ void switch_slb(struct task_struct *tsk,
+ static inline void patch_slb_encoding(unsigned int *insn_addr,
+ unsigned int immed)
+ {
+- /* Assume the instruction had a "0" immediate value, just
+- * "or" in the new value
+- */
+- *insn_addr |= immed;
++ *insn_addr = (*insn_addr & 0xffff0000) | immed;
+ flush_icache_range((unsigned long)insn_addr, 4+
+ (unsigned long)insn_addr);
+ }
+
++void slb_set_size(u16 size)
++{
++ extern unsigned int *slb_compare_rr_to_size;
++
++ if (mmu_slb_size == size)
++ return;
++
++ mmu_slb_size = size;
++ patch_slb_encoding(slb_compare_rr_to_size, mmu_slb_size);
++}
++
+ void slb_initialize(void)
+ {
+ unsigned long linear_llp, vmalloc_llp, io_llp;
+--- a/arch/powerpc/platforms/pseries/reconfig.c
++++ b/arch/powerpc/platforms/pseries/reconfig.c
+@@ -20,6 +20,7 @@
+ #include <asm/machdep.h>
+ #include <asm/uaccess.h>
+ #include <asm/pSeries_reconfig.h>
++#include <asm/mmu.h>
+
+
+
+@@ -439,9 +440,15 @@ static int do_update_property(char *buf,
+ if (!newprop)
+ return -ENOMEM;
+
++ if (!strcmp(name, "slb-size") || !strcmp(name, "ibm,slb-size"))
++ slb_set_size(*(int *)value);
++
+ oldprop = of_find_property(np, name,NULL);
+- if (!oldprop)
++ if (!oldprop) {
++ if (strlen(name))
++ return prom_add_property(np, newprop);
+ return -ENODEV;
++ }
+
+ rc = prom_update_property(np, newprop, oldprop);
+ if (rc)
powerpc-ps3-workaround-for-flash-memory-i-o-error.patch
tpm-fixup-boot-probe-timeout-for-tpm_tis-driver.patch
udf-use-device-size-when-drive-reported-bogus-number-of-written-blocks.patch
+alsa-cs46xx-fix-minimum-period-size.patch
+libata-fix-off-by-one-error-in-ata_tf_read_block.patch
+powerpc-pseries-fix-to-handle-slb-resize-across-migration.patch
+sound-oxygen-work-around-mce-when-changing-volume.patch
+short-write-in-nfsd-becomes-a-full-write-to-the-client.patch
+nfsd-fix-hung-up-of-nfs-client-while-sync-write-data-to-nfs-server.patch
--- /dev/null
+From cebbert@redhat.com Wed Sep 16 14:51:11 2009
+From: David Shaw <dshaw@jabberwocky.com>
+Date: Fri, 11 Sep 2009 18:44:45 -0400
+Subject: Short write in nfsd becomes a full write to the client
+To: stable@kernel.org
+Cc: "J. Bruce Fields" <bfields@citi.umich.edu>
+Message-ID: <20090911184445.3a0617b1@dhcp-100-2-144.bos.redhat.com>
+
+
+From: David Shaw <dshaw@jabberwocky.com>
+
+commit 31dec2538e45e9fff2007ea1f4c6bae9f78db724 upstream.
+
+Short write in nfsd becomes a full write to the client
+
+If a filesystem being written to via NFS returns a short write count
+(as opposed to an error) to nfsd, nfsd treats that as a success for
+the entire write, rather than the short count that actually succeeded.
+
+For example, given a 8192 byte write, if the underlying filesystem
+only writes 4096 bytes, nfsd will ack back to the nfs client that all
+8192 bytes were written. The nfs client does have retry logic for
+short writes, but this is never called as the client is told the
+complete write succeeded.
+
+There are probably other ways it could happen, but in my case it
+happened with a fuse (filesystem in userspace) filesystem which can
+rather easily have a partial write.
+
+Here is a patch to properly return the short write count to the
+client.
+
+Signed-off-by: David Shaw <dshaw@jabberwocky.com>
+Signed-off-by: J. Bruce Fields <bfields@citi.umich.edu>
+Cc: Chuck Ebbert <cebbert@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/nfsd/nfs3proc.c | 5 +++--
+ fs/nfsd/nfs4proc.c | 7 +++++--
+ fs/nfsd/nfsproc.c | 3 ++-
+ fs/nfsd/vfs.c | 13 +++++++------
+ include/linux/nfsd/nfsd.h | 2 +-
+ 5 files changed, 18 insertions(+), 12 deletions(-)
+
+--- a/fs/nfsd/nfs3proc.c
++++ b/fs/nfsd/nfs3proc.c
+@@ -201,6 +201,7 @@ nfsd3_proc_write(struct svc_rqst *rqstp,
+ struct nfsd3_writeres *resp)
+ {
+ __be32 nfserr;
++ unsigned long cnt = argp->len;
+
+ dprintk("nfsd: WRITE(3) %s %d bytes at %ld%s\n",
+ SVCFH_fmt(&argp->fh),
+@@ -213,9 +214,9 @@ nfsd3_proc_write(struct svc_rqst *rqstp,
+ nfserr = nfsd_write(rqstp, &resp->fh, NULL,
+ argp->offset,
+ rqstp->rq_vec, argp->vlen,
+- argp->len,
++ &cnt,
+ &resp->committed);
+- resp->count = argp->count;
++ resp->count = cnt;
+ RETURN_STATUS(nfserr);
+ }
+
+--- a/fs/nfsd/nfs4proc.c
++++ b/fs/nfsd/nfs4proc.c
+@@ -685,6 +685,7 @@ nfsd4_write(struct svc_rqst *rqstp, stru
+ struct file *filp = NULL;
+ u32 *p;
+ __be32 status = nfs_ok;
++ unsigned long cnt;
+
+ /* no need to check permission - this will be done in nfsd_write() */
+
+@@ -703,7 +704,7 @@ nfsd4_write(struct svc_rqst *rqstp, stru
+ return status;
+ }
+
+- write->wr_bytes_written = write->wr_buflen;
++ cnt = write->wr_buflen;
+ write->wr_how_written = write->wr_stable_how;
+ p = (u32 *)write->wr_verifier.data;
+ *p++ = nfssvc_boot.tv_sec;
+@@ -711,10 +712,12 @@ nfsd4_write(struct svc_rqst *rqstp, stru
+
+ status = nfsd_write(rqstp, &cstate->current_fh, filp,
+ write->wr_offset, rqstp->rq_vec, write->wr_vlen,
+- write->wr_buflen, &write->wr_how_written);
++ &cnt, &write->wr_how_written);
+ if (filp)
+ fput(filp);
+
++ write->wr_bytes_written = cnt;
++
+ if (status == nfserr_symlink)
+ status = nfserr_inval;
+ return status;
+--- a/fs/nfsd/nfsproc.c
++++ b/fs/nfsd/nfsproc.c
+@@ -179,6 +179,7 @@ nfsd_proc_write(struct svc_rqst *rqstp,
+ {
+ __be32 nfserr;
+ int stable = 1;
++ unsigned long cnt = argp->len;
+
+ dprintk("nfsd: WRITE %s %d bytes at %d\n",
+ SVCFH_fmt(&argp->fh),
+@@ -187,7 +188,7 @@ nfsd_proc_write(struct svc_rqst *rqstp,
+ nfserr = nfsd_write(rqstp, fh_copy(&resp->fh, &argp->fh), NULL,
+ argp->offset,
+ rqstp->rq_vec, argp->vlen,
+- argp->len,
++ &cnt,
+ &stable);
+ return nfsd_return_attrs(nfserr, resp);
+ }
+--- a/fs/nfsd/vfs.c
++++ b/fs/nfsd/vfs.c
+@@ -957,7 +957,7 @@ static void kill_suid(struct dentry *den
+ static __be32
+ nfsd_vfs_write(struct svc_rqst *rqstp, struct svc_fh *fhp, struct file *file,
+ loff_t offset, struct kvec *vec, int vlen,
+- unsigned long cnt, int *stablep)
++ unsigned long *cnt, int *stablep)
+ {
+ struct svc_export *exp;
+ struct dentry *dentry;
+@@ -971,7 +971,7 @@ nfsd_vfs_write(struct svc_rqst *rqstp, s
+ err = nfserr_perm;
+
+ if ((fhp->fh_export->ex_flags & NFSEXP_MSNFS) &&
+- (!lock_may_write(file->f_path.dentry->d_inode, offset, cnt)))
++ (!lock_may_write(file->f_path.dentry->d_inode, offset, *cnt)))
+ goto out;
+ #endif
+
+@@ -1003,7 +1003,7 @@ nfsd_vfs_write(struct svc_rqst *rqstp, s
+ host_err = vfs_writev(file, (struct iovec __user *)vec, vlen, &offset);
+ set_fs(oldfs);
+ if (host_err >= 0) {
+- nfsdstats.io_write += cnt;
++ nfsdstats.io_write += host_err;
+ fsnotify_modify(file->f_path.dentry);
+ }
+
+@@ -1048,9 +1048,10 @@ nfsd_vfs_write(struct svc_rqst *rqstp, s
+ }
+
+ dprintk("nfsd: write complete host_err=%d\n", host_err);
+- if (host_err >= 0)
++ if (host_err >= 0) {
+ err = 0;
+- else
++ *cnt = host_err;
++ } else
+ err = nfserrno(host_err);
+ out:
+ return err;
+@@ -1092,7 +1093,7 @@ out:
+ */
+ __be32
+ nfsd_write(struct svc_rqst *rqstp, struct svc_fh *fhp, struct file *file,
+- loff_t offset, struct kvec *vec, int vlen, unsigned long cnt,
++ loff_t offset, struct kvec *vec, int vlen, unsigned long *cnt,
+ int *stablep)
+ {
+ __be32 err = 0;
+--- a/include/linux/nfsd/nfsd.h
++++ b/include/linux/nfsd/nfsd.h
+@@ -105,7 +105,7 @@ void nfsd_close(struct file *);
+ __be32 nfsd_read(struct svc_rqst *, struct svc_fh *, struct file *,
+ loff_t, struct kvec *, int, unsigned long *);
+ __be32 nfsd_write(struct svc_rqst *, struct svc_fh *,struct file *,
+- loff_t, struct kvec *,int, unsigned long, int *);
++ loff_t, struct kvec *,int, unsigned long *, int *);
+ __be32 nfsd_readlink(struct svc_rqst *, struct svc_fh *,
+ char *, int *);
+ __be32 nfsd_symlink(struct svc_rqst *, struct svc_fh *,
--- /dev/null
+From f1bc07af9a9edc5c1d4bdd971f7099316ed2e405 Mon Sep 17 00:00:00 2001
+From: Clemens Ladisch <clemens@ladisch.de>
+Date: Mon, 7 Sep 2009 10:18:54 +0200
+Subject: sound: oxygen: work around MCE when changing volume
+
+From: Clemens Ladisch <clemens@ladisch.de>
+
+commit f1bc07af9a9edc5c1d4bdd971f7099316ed2e405 upstream.
+
+When the volume is changed continuously (e.g., when the user drags a
+volume slider with the mouse), the driver does lots of I2C writes.
+Apparently, the sound chip can get confused when we poll the I2C status
+register too much, and fails to complete a read from it. On the PCI-E
+models, the PCI-E/PCI bridge gets upset by this and generates a machine
+check exception.
+
+To avoid this, this patch replaces the polling with an unconditional
+wait that is guaranteed to be long enough.
+
+Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
+Tested-by: Johann Messner <johann.messner at jku.at>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/oxygen/oxygen_io.c | 11 +----------
+ 1 file changed, 1 insertion(+), 10 deletions(-)
+
+--- a/sound/pci/oxygen/oxygen_io.c
++++ b/sound/pci/oxygen/oxygen_io.c
+@@ -214,17 +214,8 @@ EXPORT_SYMBOL(oxygen_write_spi);
+
+ void oxygen_write_i2c(struct oxygen *chip, u8 device, u8 map, u8 data)
+ {
+- unsigned long timeout;
+-
+ /* should not need more than about 300 us */
+- timeout = jiffies + msecs_to_jiffies(1);
+- do {
+- if (!(oxygen_read16(chip, OXYGEN_2WIRE_BUS_STATUS)
+- & OXYGEN_2WIRE_BUSY))
+- break;
+- udelay(1);
+- cond_resched();
+- } while (time_after_eq(timeout, jiffies));
++ msleep(1);
+
+ oxygen_write8(chip, OXYGEN_2WIRE_MAP, map);
+ oxygen_write8(chip, OXYGEN_2WIRE_DATA, data);
projects / thirdparty / kernel / stable-queue.git / commitdiff
