--- /dev/null
+From 1b678347121001c3c230c6eccfdf9f65c3ec1a4e Mon Sep 17 00:00:00 2001
+From: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Date: Fri, 19 Oct 2007 00:30:05 +0200
+Subject: ide: Add ide_get_paired_drive() helper
+Message-Id: <200710182310.13272.bzolnier@gmail.com>
+
+From: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+
+patch 1b678347121001c3c230c6eccfdf9f65c3ec1a4e in mainline.
+
+This adds a helper to get to the "other" drive on a pair connected
+to a given hwif.
+
+Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Cc: Andrew Morton <akpm@osdl.org>
+Acked-by: Sergei Shtylyov <sshtylyov@ru.mvista.com>
+Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ include/linux/ide.h | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/include/linux/ide.h
++++ b/include/linux/ide.h
+@@ -1437,4 +1437,11 @@ static inline int hwif_to_node(ide_hwif_
+ return dev ? pcibus_to_node(dev->bus) : -1;
+ }
+
++static inline ide_drive_t *ide_get_paired_drive(ide_drive_t *drive)
++{
++ ide_hwif_t *hwif = HWIF(drive);
++
++ return &hwif->drives[(drive->dn ^ 1) & 1];
++}
++
+ #endif /* _IDE_H */
--- /dev/null
+From 15d8061bf02aa299b2447f7a22fd18b4a503ea9d Mon Sep 17 00:00:00 2001
+From: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Date: Fri, 19 Oct 2007 00:30:05 +0200
+Subject: [PATCH] ide: Fix cs5535 driver accessing beyond array boundary
+Message-Id: <200710182310.50315.bzolnier@gmail.com>
+
+From: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+
+
+patch 15d8061bf02aa299b2447f7a22fd18b4a503ea9d in mainline.
+
+The cs5535 uses an incorrect construct to access the other drive of a pair,
+causing it to access beyond an array boundary on the secondary interface.
+
+This fixes it by using the new ide_get_paired_drive() helper instead.
+
+Bart: patch description fixes
+
+Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Cc: Andrew Morton <akpm@osdl.org>
+Acked-by: Sergei Shtylyov <sshtylyov@ru.mvista.com>
+Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/ide/pci/cs5535.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/ide/pci/cs5535.c
++++ b/drivers/ide/pci/cs5535.c
+@@ -84,7 +84,7 @@ static void cs5535_set_speed(ide_drive_t
+
+ /* Set the PIO timings */
+ if ((speed & XFER_MODE) == XFER_PIO) {
+- ide_drive_t *pair = &drive->hwif->drives[drive->dn ^ 1];
++ ide_drive_t *pair = ide_get_paired_drive(drive);
+ u8 cmd, pioa;
+
+ cmd = pioa = speed - XFER_PIO_0;
--- /dev/null
+From a87a87ccdc541e0a0cc8c7d01a365be8d9153a7b Mon Sep 17 00:00:00 2001
+From: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Date: Fri, 19 Oct 2007 00:30:05 +0200
+Subject: [PATCH] ide: Fix siimage driver accessing beyond array boundary
+Message-Id: <200710182310.46956.bzolnier@gmail.com>
+
+From: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+
+patch a87a87ccdc541e0a0cc8c7d01a365be8d9153a7b in mainline.
+
+The siimage uses an incorrect construct to access the other drive of a pair,
+causing it to access beyond an array boundary on the secondary interface.
+
+This fixes it by using the new ide_get_paired_drive() helper instead.
+
+Bart: patch description fixes
+
+Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Cc: Andrew Morton <akpm@osdl.org>
+Acked-by: Sergei Shtylyov <sshtylyov@ru.mvista.com>
+Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/ide/pci/siimage.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/ide/pci/siimage.c
++++ b/drivers/ide/pci/siimage.c
+@@ -180,7 +180,7 @@ static void sil_tune_pio(ide_drive_t *dr
+ const u16 data_speed[] = { 0x328a, 0x2283, 0x1104, 0x10c3, 0x10c1 };
+
+ ide_hwif_t *hwif = HWIF(drive);
+- ide_drive_t *pair = &hwif->drives[drive->dn ^ 1];
++ ide_drive_t *pair = ide_get_paired_drive(drive);
+ u32 speedt = 0;
+ u16 speedp = 0;
+ unsigned long addr = siimage_seldev(drive, 0x04);
--- /dev/null
+From stable-bounces@linux.kernel.org Mon Oct 22 20:45:35 2007
+From: akpm@linux-foundation.org
+Date: Mon, 22 Oct 2007 20:45:11 -0700
+Subject: md: fix an unsigned compare to allow creation of bitmaps with v1.0 metadata
+To: torvalds@linux-foundation.org
+Cc: neilb@suse.de, akpm@linux-foundation.org, stable@kernel.org
+Message-ID: <200710230345.l9N3jB65030288@imap1.linux-foundation.org>
+
+
+From: NeilBrown <neilb@suse.de>
+
+patch 85bfb4da8cad483a4e550ec89060d05a4daf895b in mainline.
+
+As page->index is unsigned, this all becomes an unsigned comparison, which
+ almost always returns an error.
+
+Signed-off-by: Neil Brown <neilb@suse.de>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/bitmap.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/md/bitmap.c
++++ b/drivers/md/bitmap.c
+@@ -274,7 +274,7 @@ static int write_sb_page(struct bitmap *
+ if (bitmap->offset < 0) {
+ /* DATA BITMAP METADATA */
+ if (bitmap->offset
+- + page->index * (PAGE_SIZE/512)
++ + (long)(page->index * (PAGE_SIZE/512))
+ + size/512 > 0)
+ /* bitmap runs in to metadata */
+ return -EINVAL;
--- /dev/null
+From stable-bounces@linux.kernel.org Mon Oct 22 20:45:44 2007
+From: Dan Williams <dan.j.williams@intel.com>
+Date: Mon, 22 Oct 2007 20:45:11 -0700
+Subject: md: raid5: fix clearing of biofill operations
+To: torvalds@linux-foundation.org
+Cc: joel.bertrand@systella.fr, neilb@suse.de, akpm@linux-foundation.org, dan.j.williams@intel.com, stable@kernel.org
+Message-ID: <200710230345.l9N3jC2M030292@imap1.linux-foundation.org>
+
+From: Dan Williams <dan.j.williams@intel.com>
+
+patch 4ae3f847e49e3787eca91bced31f8fd328d50496 in mainline.
+
+ops_complete_biofill() runs outside of spin_lock(&sh->lock) and clears the
+'pending' and 'ack' bits. Since the test_and_ack_op() macro only checks
+against 'complete' it can get an inconsistent snapshot of pending work.
+
+Move the clearing of these bits to handle_stripe5(), under the lock.
+
+Signed-off-by: Dan Williams <dan.j.williams@intel.com>
+Tested-by: Joel Bertrand <joel.bertrand@systella.fr>
+Signed-off-by: Neil Brown <neilb@suse.de>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/raid5.c | 17 ++++++++++++++---
+ 1 file changed, 14 insertions(+), 3 deletions(-)
+
+--- a/drivers/md/raid5.c
++++ b/drivers/md/raid5.c
+@@ -377,7 +377,12 @@ static unsigned long get_stripe_work(str
+ ack++;
+
+ sh->ops.count -= ack;
+- BUG_ON(sh->ops.count < 0);
++ if (unlikely(sh->ops.count < 0)) {
++ printk(KERN_ERR "pending: %#lx ops.pending: %#lx ops.ack: %#lx "
++ "ops.complete: %#lx\n", pending, sh->ops.pending,
++ sh->ops.ack, sh->ops.complete);
++ BUG();
++ }
+
+ return pending;
+ }
+@@ -551,8 +556,7 @@ static void ops_complete_biofill(void *s
+ }
+ }
+ }
+- clear_bit(STRIPE_OP_BIOFILL, &sh->ops.ack);
+- clear_bit(STRIPE_OP_BIOFILL, &sh->ops.pending);
++ set_bit(STRIPE_OP_BIOFILL, &sh->ops.complete);
+
+ return_io(return_bi);
+
+@@ -2903,6 +2907,13 @@ static void handle_stripe6(struct stripe
+ s.expanded = test_bit(STRIPE_EXPAND_READY, &sh->state);
+ /* Now to look around and see what can be done */
+
++ /* clean-up completed biofill operations */
++ if (test_bit(STRIPE_OP_BIOFILL, &sh->ops.complete)) {
++ clear_bit(STRIPE_OP_BIOFILL, &sh->ops.pending);
++ clear_bit(STRIPE_OP_BIOFILL, &sh->ops.ack);
++ clear_bit(STRIPE_OP_BIOFILL, &sh->ops.complete);
++ }
++
+ rcu_read_lock();
+ for (i=disks; i--; ) {
+ mdk_rdev_t *rdev;
--- /dev/null
+From stable-bounces@linux.kernel.org Fri Oct 19 14:26:57 2007
+From: Trond Myklebust <Trond.Myklebust@netapp.com>
+Date: Fri, 19 Oct 2007 17:26:11 -0400
+Subject: NFS: Fix a writeback race...
+To: stable <stable@kernel.org>
+Message-ID: <1192829171.7466.21.camel@heimdal.trondhjem.org>
+
+From: Trond Myklebust <Trond.Myklebust@netapp.com>
+
+patch 61e930a904966cc37e0a3404276f0b73037e57ca in mainline
+
+This patch fixes a regression that was introduced by commit
+44dd151d5c21234cc534c47d7382f5c28c3143cd
+
+We cannot zero the user page in nfs_mark_uptodate() any more, since
+
+ a) We'd be modifying the page without holding the page lock
+ b) We can race with other updates of the page, most notably
+ because of the call to nfs_wb_page() in nfs_writepage_setup().
+
+Instead, we do the zeroing in nfs_update_request() if we see that we're
+creating a request that might potentially be marked as up to date.
+
+Thanks to Olivier Paquet for reporting the bug and providing a test-case.
+
+Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/nfs/write.c | 17 +++++++++++++----
+ 1 file changed, 13 insertions(+), 4 deletions(-)
+
+--- a/fs/nfs/write.c
++++ b/fs/nfs/write.c
+@@ -167,8 +167,6 @@ static void nfs_mark_uptodate(struct pag
+ return;
+ if (count != nfs_page_length(page))
+ return;
+- if (count != PAGE_CACHE_SIZE)
+- zero_user_page(page, count, PAGE_CACHE_SIZE - count, KM_USER0);
+ SetPageUptodate(page);
+ }
+
+@@ -643,7 +641,8 @@ static struct nfs_page * nfs_update_requ
+ return ERR_PTR(error);
+ }
+ spin_unlock(&inode->i_lock);
+- return new;
++ req = new;
++ goto zero_page;
+ }
+ spin_unlock(&inode->i_lock);
+
+@@ -671,13 +670,23 @@ static struct nfs_page * nfs_update_requ
+ if (offset < req->wb_offset) {
+ req->wb_offset = offset;
+ req->wb_pgbase = offset;
+- req->wb_bytes = rqend - req->wb_offset;
++ req->wb_bytes = max(end, rqend) - req->wb_offset;
++ goto zero_page;
+ }
+
+ if (end > rqend)
+ req->wb_bytes = end - req->wb_offset;
+
+ return req;
++zero_page:
++ /* If this page might potentially be marked as up to date,
++ * then we need to zero any uninitalised data. */
++ if (req->wb_pgbase == 0 && req->wb_bytes != PAGE_CACHE_SIZE
++ && !PageUptodate(req->wb_page))
++ zero_user_page(req->wb_page, req->wb_bytes,
++ PAGE_CACHE_SIZE - req->wb_bytes,
++ KM_USER0);
++ return req;
+ }
+
+ int nfs_flush_incompatible(struct file *file, struct page *page)
i4l-fix-random-hard-freeze-with-avm-c4-card.patch
i4l-fix-random-freezes-with-avm-b1-drivers.patch
x86-fix-tsc-clock-source-calibration-error.patch
+ide-add-ide_get_paired_drive-helper.patch
+ide-fix-siimage-driver-accessing-beyond-array-boundary.patch
+ide-fix-cs5535-driver-accessing-beyond-array-boundary.patch
+tg3-fix-performance-regression-on-5705.patch
+nfs-fix-a-writeback-race.patch
+md-fix-an-unsigned-compare-to-allow-creation-of-bitmaps-with-v1.0-metadata.patch
+md-raid5-fix-clearing-of-biofill-operations.patch
--- /dev/null
+From 114342f2d38439cb1a54f1f724fa38729b093c48 Mon Sep 17 00:00:00 2001
+From: Michael Chan <mchan@broadcom.com>
+Date: Mon, 15 Oct 2007 02:12:26 -0700
+Subject: TG3: Fix performance regression on 5705.
+Message-ID: <1192744940.8500.1.camel@dell>
+
+
+From: Michael Chan <mchan@broadcom.com>
+
+patch 114342f2d38439cb1a54f1f724fa38729b093c48 in mainline.
+
+A performance regression was introduced by the following commit:
+
+ commit ee6a99b539a50b4e9398938a0a6d37f8bf911550
+ Author: Michael Chan <mchan@broadcom.com>
+ Date: Wed Jul 18 21:49:10 2007 -0700
+
+ [TG3]: Fix msi issue with kexec/kdump.
+
+In making that change, the PCI latency timer and cache line size
+registers were not restored after chip reset. On the 5705, the
+latency timer gets reset to 0 during chip reset and this causes
+very poor performance.
+
+Update version to 3.81.1
+
+Signed-off-by: Michael Chan <mchan@broadcom.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/tg3.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/tg3.c
++++ b/drivers/net/tg3.c
+@@ -64,8 +64,8 @@
+
+ #define DRV_MODULE_NAME "tg3"
+ #define PFX DRV_MODULE_NAME ": "
+-#define DRV_MODULE_VERSION "3.81"
+-#define DRV_MODULE_RELDATE "September 5, 2007"
++#define DRV_MODULE_VERSION "3.81.1"
++#define DRV_MODULE_RELDATE "October 18, 2007"
+
+ #define TG3_DEF_MAC_MODE 0
+ #define TG3_DEF_RX_MODE 0
+@@ -4874,6 +4874,12 @@ static void tg3_restore_pci_state(struct
+
+ pci_write_config_dword(tp->pdev, TG3PCI_COMMAND, tp->pci_cmd);
+
++ if (!(tp->tg3_flags2 & TG3_FLG2_PCI_EXPRESS)) {
++ pci_write_config_byte(tp->pdev, PCI_CACHE_LINE_SIZE,
++ tp->pci_cacheline_sz);
++ pci_write_config_byte(tp->pdev, PCI_LATENCY_TIMER,
++ tp->pci_lat_timer);
++ }
+ /* Make sure PCI-X relaxed ordering bit is clear. */
+ pci_read_config_dword(tp->pdev, TG3PCI_X_CAPS, &val);
+ val &= ~PCIX_CAPS_RELAXED_ORDERING;
projects / thirdparty / kernel / stable-queue.git / commitdiff
