From: Greg Kroah-Hartman Date: Wed, 16 Sep 2009 22:55:07 +0000 (-0700) Subject: start .31 review cycle X-Git-Tag: v2.6.30.8~1 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=5b27906a50ba53efb8a28f2acea5b1164e483770;p=thirdparty%2Fkernel%2Fstable-queue.git start .31 review cycle --- diff --git a/queue-2.6.31/agp-intel-remove-restore-in-resume.patch b/review-2.6.31/agp-intel-remove-restore-in-resume.patch similarity index 100% rename from queue-2.6.31/agp-intel-remove-restore-in-resume.patch rename to review-2.6.31/agp-intel-remove-restore-in-resume.patch diff --git a/queue-2.6.31/alsa-cs46xx-fix-minimum-period-size.patch b/review-2.6.31/alsa-cs46xx-fix-minimum-period-size.patch similarity index 100% rename from queue-2.6.31/alsa-cs46xx-fix-minimum-period-size.patch rename to review-2.6.31/alsa-cs46xx-fix-minimum-period-size.patch diff --git a/queue-2.6.31/arm-5691-1-fix-cache-aliasing-issues-between-kmap-and-kmap_atomic-with-highmem.patch b/review-2.6.31/arm-5691-1-fix-cache-aliasing-issues-between-kmap-and-kmap_atomic-with-highmem.patch similarity index 100% rename from queue-2.6.31/arm-5691-1-fix-cache-aliasing-issues-between-kmap-and-kmap_atomic-with-highmem.patch rename to review-2.6.31/arm-5691-1-fix-cache-aliasing-issues-between-kmap-and-kmap_atomic-with-highmem.patch diff --git a/queue-2.6.31/asoc-fix-wm835x-out4-capture-enumeration.patch b/review-2.6.31/asoc-fix-wm835x-out4-capture-enumeration.patch similarity index 100% rename from queue-2.6.31/asoc-fix-wm835x-out4-capture-enumeration.patch rename to review-2.6.31/asoc-fix-wm835x-out4-capture-enumeration.patch diff --git a/queue-2.6.31/ath5k-write-pcu-registers-on-initial-reset.patch b/review-2.6.31/ath5k-write-pcu-registers-on-initial-reset.patch similarity index 100% rename from queue-2.6.31/ath5k-write-pcu-registers-on-initial-reset.patch rename to review-2.6.31/ath5k-write-pcu-registers-on-initial-reset.patch diff --git a/queue-2.6.31/binfmt_elf-fix-pt_interp-bss-handling.patch b/review-2.6.31/binfmt_elf-fix-pt_interp-bss-handling.patch similarity index 100% rename from queue-2.6.31/binfmt_elf-fix-pt_interp-bss-handling.patch rename to review-2.6.31/binfmt_elf-fix-pt_interp-bss-handling.patch diff --git a/queue-2.6.31/block-don-t-assume-device-has-a-request-list-backing-in-nr_requests-store.patch b/review-2.6.31/block-don-t-assume-device-has-a-request-list-backing-in-nr_requests-store.patch similarity index 100% rename from queue-2.6.31/block-don-t-assume-device-has-a-request-list-backing-in-nr_requests-store.patch rename to review-2.6.31/block-don-t-assume-device-has-a-request-list-backing-in-nr_requests-store.patch diff --git a/queue-2.6.31/cfg80211-fix-looping-soft-lockup-in-find_ie.patch b/review-2.6.31/cfg80211-fix-looping-soft-lockup-in-find_ie.patch similarity index 100% rename from queue-2.6.31/cfg80211-fix-looping-soft-lockup-in-find_ie.patch rename to review-2.6.31/cfg80211-fix-looping-soft-lockup-in-find_ie.patch diff --git a/queue-2.6.31/fix-undefined-reference-to-user_shm_unlock.patch b/review-2.6.31/fix-undefined-reference-to-user_shm_unlock.patch similarity index 100% rename from queue-2.6.31/fix-undefined-reference-to-user_shm_unlock.patch rename to review-2.6.31/fix-undefined-reference-to-user_shm_unlock.patch diff --git a/queue-2.6.31/kvm-fix-coalesced-interrupt-reporting-in-ioapic.patch b/review-2.6.31/kvm-fix-coalesced-interrupt-reporting-in-ioapic.patch similarity index 100% rename from queue-2.6.31/kvm-fix-coalesced-interrupt-reporting-in-ioapic.patch rename to review-2.6.31/kvm-fix-coalesced-interrupt-reporting-in-ioapic.patch diff --git a/queue-2.6.31/kvm-guest-do-not-batch-pte-updates-from-interrupt-context.patch b/review-2.6.31/kvm-guest-do-not-batch-pte-updates-from-interrupt-context.patch similarity index 100% rename from queue-2.6.31/kvm-guest-do-not-batch-pte-updates-from-interrupt-context.patch rename to review-2.6.31/kvm-guest-do-not-batch-pte-updates-from-interrupt-context.patch diff --git a/queue-2.6.31/kvm-guest-fix-bogus-wallclock-physical-address-calculation.patch b/review-2.6.31/kvm-guest-fix-bogus-wallclock-physical-address-calculation.patch similarity index 100% rename from queue-2.6.31/kvm-guest-fix-bogus-wallclock-physical-address-calculation.patch rename to review-2.6.31/kvm-guest-fix-bogus-wallclock-physical-address-calculation.patch diff --git a/queue-2.6.31/kvm-limit-lapic-periodic-timer-frequency.patch b/review-2.6.31/kvm-limit-lapic-periodic-timer-frequency.patch similarity index 100% rename from queue-2.6.31/kvm-limit-lapic-periodic-timer-frequency.patch rename to review-2.6.31/kvm-limit-lapic-periodic-timer-frequency.patch diff --git a/queue-2.6.31/kvm-mmu-make-__kvm_mmu_free_some_pages-handle-empty-list.patch b/review-2.6.31/kvm-mmu-make-__kvm_mmu_free_some_pages-handle-empty-list.patch similarity index 100% rename from queue-2.6.31/kvm-mmu-make-__kvm_mmu_free_some_pages-handle-empty-list.patch rename to review-2.6.31/kvm-mmu-make-__kvm_mmu_free_some_pages-handle-empty-list.patch diff --git a/queue-2.6.31/kvm-vmx-check-cpl-before-emulating-debug-register-access.patch b/review-2.6.31/kvm-vmx-check-cpl-before-emulating-debug-register-access.patch similarity index 100% rename from queue-2.6.31/kvm-vmx-check-cpl-before-emulating-debug-register-access.patch rename to review-2.6.31/kvm-vmx-check-cpl-before-emulating-debug-register-access.patch diff --git a/queue-2.6.31/kvm-vmx-fix-cr8-exiting-control-clobbering-by-ept.patch b/review-2.6.31/kvm-vmx-fix-cr8-exiting-control-clobbering-by-ept.patch similarity index 100% rename from queue-2.6.31/kvm-vmx-fix-cr8-exiting-control-clobbering-by-ept.patch rename to review-2.6.31/kvm-vmx-fix-cr8-exiting-control-clobbering-by-ept.patch diff --git a/queue-2.6.31/kvm-x86-disallow-hypercalls-for-guest-callers-in-rings-0.patch b/review-2.6.31/kvm-x86-disallow-hypercalls-for-guest-callers-in-rings-0.patch similarity index 100% rename from queue-2.6.31/kvm-x86-disallow-hypercalls-for-guest-callers-in-rings-0.patch rename to review-2.6.31/kvm-x86-disallow-hypercalls-for-guest-callers-in-rings-0.patch diff --git a/queue-2.6.31/kvm-x86-emulator-fix-jmp-far-decoding.patch b/review-2.6.31/kvm-x86-emulator-fix-jmp-far-decoding.patch similarity index 100% rename from queue-2.6.31/kvm-x86-emulator-fix-jmp-far-decoding.patch rename to review-2.6.31/kvm-x86-emulator-fix-jmp-far-decoding.patch diff --git a/queue-2.6.31/kvm-x86-emulator-implement-zero-extended-immediate-decoding.patch b/review-2.6.31/kvm-x86-emulator-implement-zero-extended-immediate-decoding.patch similarity index 100% rename from queue-2.6.31/kvm-x86-emulator-implement-zero-extended-immediate-decoding.patch rename to review-2.6.31/kvm-x86-emulator-implement-zero-extended-immediate-decoding.patch diff --git a/queue-2.6.31/libata-fix-off-by-one-error-in-ata_tf_read_block.patch b/review-2.6.31/libata-fix-off-by-one-error-in-ata_tf_read_block.patch similarity index 100% rename from queue-2.6.31/libata-fix-off-by-one-error-in-ata_tf_read_block.patch rename to review-2.6.31/libata-fix-off-by-one-error-in-ata_tf_read_block.patch diff --git a/review-2.6.31/mbox b/review-2.6.31/mbox new file mode 100644 index 00000000000..46b27eb48b5 --- /dev/null +++ b/review-2.6.31/mbox @@ -0,0 +1,4647 @@ +From gregkh@mini.kroah.org Wed Sep 16 15:37:13 2009 +Message-Id: <20090916223713.340746225@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Sep 2009 15:36:14 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Michal Schmidt , + Douglas Gilbert , + James Bottomley +Subject: [patch 01/45] [SCSI] sg: fix oops in the error path in sg_build_indirect() +References: <20090916223613.597295240@mini.kroah.org> +Content-Disposition: inline; filename=sg-fix-oops-in-the-error-path-in-sg_build_indirect.patch +Content-Length: 798 +Lines: 29 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Michal Schmidt + +commit e71044ee2efa4792e21d243b03d49006db66aec9 upstream. + +When the allocation fails in sg_build_indirect(), an oops happens in +the error path. It's caused by an obvious typo. + +Signed-off-by: Michal Schmidt +Reported-by: Bob Tracy +Acked-by: Douglas Gilbert +Signed-off-by: James Bottomley +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/sg.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/scsi/sg.c ++++ b/drivers/scsi/sg.c +@@ -1811,7 +1811,7 @@ retry: + return 0; + out: + for (i = 0; i < k; i++) +- __free_pages(schp->pages[k], order); ++ __free_pages(schp->pages[i], order); + + if (--order >= 0) + goto retry; + + +From gregkh@mini.kroah.org Wed Sep 16 15:37:13 2009 +Message-Id: <20090916223713.500478052@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Sep 2009 15:36:15 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Kashyap Desai , + James Bottomley +Subject: [patch 02/45] [SCSI] mpt2sas : Rescan topology from Interrupt context instead of work thread +References: <20090916223613.597295240@mini.kroah.org> +Content-Disposition: inline; filename=mpt2sas-rescan-topology-from-interrupt-context-instead-of-work-thread.patch +Content-Length: 7705 +Lines: 237 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Kashyap, Desai + +commit cd4e12e8ad246ec5bc23ab04d0da0e6985025620 upstream. + +Following host reset its possible that the controller firmware could +assign new handles for devices, as well as adding or deleting devices. There is +code in the driver that will rescan the topology folowing host reset; updating +device handles, and remove devices that are no longer responding. This patch +will improve the responsivness by moving this rescaning from the delayed hotplug +worker thread to immediately following the host reset. + +Signed-off-by: Kashyap Desai +Reviewed-by: Eric Moore +Signed-off-by: James Bottomley +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/mpt2sas/mpt2sas_base.c | 3 + drivers/scsi/mpt2sas/mpt2sas_base.h | 1 + drivers/scsi/mpt2sas/mpt2sas_scsih.c | 142 +++++++++++++---------------------- + 3 files changed, 57 insertions(+), 89 deletions(-) + +--- a/drivers/scsi/mpt2sas/mpt2sas_base.c ++++ b/drivers/scsi/mpt2sas/mpt2sas_base.c +@@ -3536,5 +3536,8 @@ mpt2sas_base_hard_reset_handler(struct M + spin_lock_irqsave(&ioc->ioc_reset_in_progress_lock, flags); + ioc->ioc_reset_in_progress = 0; + spin_unlock_irqrestore(&ioc->ioc_reset_in_progress_lock, flags); ++ ++ if (!r) ++ _base_reset_handler(ioc, MPT2_IOC_RUNNING); + return r; + } +--- a/drivers/scsi/mpt2sas/mpt2sas_base.h ++++ b/drivers/scsi/mpt2sas/mpt2sas_base.h +@@ -119,6 +119,7 @@ + #define MPT2_IOC_PRE_RESET 1 /* prior to host reset */ + #define MPT2_IOC_AFTER_RESET 2 /* just after host reset */ + #define MPT2_IOC_DONE_RESET 3 /* links re-initialized */ ++#define MPT2_IOC_RUNNING 4 /* shost running */ + + /* + * logging format +--- a/drivers/scsi/mpt2sas/mpt2sas_scsih.c ++++ b/drivers/scsi/mpt2sas/mpt2sas_scsih.c +@@ -103,7 +103,6 @@ struct sense_info { + }; + + +-#define MPT2SAS_RESCAN_AFTER_HOST_RESET (0xFFFF) + /** + * struct fw_event_work - firmware event struct + * @list: link list framework +@@ -2405,27 +2404,6 @@ _scsih_check_topo_delete_events(struct M + } + + /** +- * _scsih_queue_rescan - queue a topology rescan from user context +- * @ioc: per adapter object +- * +- * Return nothing. +- */ +-static void +-_scsih_queue_rescan(struct MPT2SAS_ADAPTER *ioc) +-{ +- struct fw_event_work *fw_event; +- +- if (ioc->wait_for_port_enable_to_complete) +- return; +- fw_event = kzalloc(sizeof(struct fw_event_work), GFP_ATOMIC); +- if (!fw_event) +- return; +- fw_event->event = MPT2SAS_RESCAN_AFTER_HOST_RESET; +- fw_event->ioc = ioc; +- _scsih_fw_event_add(ioc, fw_event); +-} +- +-/** + * _scsih_flush_running_cmds - completing outstanding commands. + * @ioc: per adapter object + * +@@ -2456,46 +2434,6 @@ _scsih_flush_running_cmds(struct MPT2SAS + } + + /** +- * mpt2sas_scsih_reset_handler - reset callback handler (for scsih) +- * @ioc: per adapter object +- * @reset_phase: phase +- * +- * The handler for doing any required cleanup or initialization. +- * +- * The reset phase can be MPT2_IOC_PRE_RESET, MPT2_IOC_AFTER_RESET, +- * MPT2_IOC_DONE_RESET +- * +- * Return nothing. +- */ +-void +-mpt2sas_scsih_reset_handler(struct MPT2SAS_ADAPTER *ioc, int reset_phase) +-{ +- switch (reset_phase) { +- case MPT2_IOC_PRE_RESET: +- dtmprintk(ioc, printk(MPT2SAS_DEBUG_FMT "%s: " +- "MPT2_IOC_PRE_RESET\n", ioc->name, __func__)); +- _scsih_fw_event_off(ioc); +- break; +- case MPT2_IOC_AFTER_RESET: +- dtmprintk(ioc, printk(MPT2SAS_DEBUG_FMT "%s: " +- "MPT2_IOC_AFTER_RESET\n", ioc->name, __func__)); +- if (ioc->tm_cmds.status & MPT2_CMD_PENDING) { +- ioc->tm_cmds.status |= MPT2_CMD_RESET; +- mpt2sas_base_free_smid(ioc, ioc->tm_cmds.smid); +- complete(&ioc->tm_cmds.done); +- } +- _scsih_fw_event_on(ioc); +- _scsih_flush_running_cmds(ioc); +- break; +- case MPT2_IOC_DONE_RESET: +- dtmprintk(ioc, printk(MPT2SAS_DEBUG_FMT "%s: " +- "MPT2_IOC_DONE_RESET\n", ioc->name, __func__)); +- _scsih_queue_rescan(ioc); +- break; +- } +-} +- +-/** + * _scsih_setup_eedp - setup MPI request for EEDP transfer + * @scmd: pointer to scsi command object + * @mpi_request: pointer to the SCSI_IO reqest message frame +@@ -5156,22 +5094,9 @@ static void + _scsih_remove_unresponding_devices(struct MPT2SAS_ADAPTER *ioc) + { + struct _sas_device *sas_device, *sas_device_next; +- struct _sas_node *sas_expander, *sas_expander_next; ++ struct _sas_node *sas_expander; + struct _raid_device *raid_device, *raid_device_next; +- unsigned long flags; + +- _scsih_search_responding_sas_devices(ioc); +- _scsih_search_responding_raid_devices(ioc); +- _scsih_search_responding_expanders(ioc); +- +- spin_lock_irqsave(&ioc->ioc_reset_in_progress_lock, flags); +- ioc->shost_recovery = 0; +- if (ioc->shost->shost_state == SHOST_RECOVERY) { +- printk(MPT2SAS_INFO_FMT "putting controller into " +- "SHOST_RUNNING\n", ioc->name); +- scsi_host_set_state(ioc->shost, SHOST_RUNNING); +- } +- spin_unlock_irqrestore(&ioc->ioc_reset_in_progress_lock, flags); + + list_for_each_entry_safe(sas_device, sas_device_next, + &ioc->sas_device_list, list) { +@@ -5207,16 +5132,63 @@ _scsih_remove_unresponding_devices(struc + _scsih_raid_device_remove(ioc, raid_device); + } + +- list_for_each_entry_safe(sas_expander, sas_expander_next, +- &ioc->sas_expander_list, list) { ++ retry_expander_search: ++ sas_expander = NULL; ++ list_for_each_entry(sas_expander, &ioc->sas_expander_list, list) { + if (sas_expander->responding) { + sas_expander->responding = 0; + continue; + } +- printk("\tremoving expander: handle(0x%04x), " +- " sas_addr(0x%016llx)\n", sas_expander->handle, +- (unsigned long long)sas_expander->sas_address); + _scsih_expander_remove(ioc, sas_expander->handle); ++ goto retry_expander_search; ++ } ++} ++ ++/** ++ * mpt2sas_scsih_reset_handler - reset callback handler (for scsih) ++ * @ioc: per adapter object ++ * @reset_phase: phase ++ * ++ * The handler for doing any required cleanup or initialization. ++ * ++ * The reset phase can be MPT2_IOC_PRE_RESET, MPT2_IOC_AFTER_RESET, ++ * MPT2_IOC_DONE_RESET ++ * ++ * Return nothing. ++ */ ++void ++mpt2sas_scsih_reset_handler(struct MPT2SAS_ADAPTER *ioc, int reset_phase) ++{ ++ switch (reset_phase) { ++ case MPT2_IOC_PRE_RESET: ++ dtmprintk(ioc, printk(MPT2SAS_DEBUG_FMT "%s: " ++ "MPT2_IOC_PRE_RESET\n", ioc->name, __func__)); ++ _scsih_fw_event_off(ioc); ++ break; ++ case MPT2_IOC_AFTER_RESET: ++ dtmprintk(ioc, printk(MPT2SAS_DEBUG_FMT "%s: " ++ "MPT2_IOC_AFTER_RESET\n", ioc->name, __func__)); ++ if (ioc->tm_cmds.status & MPT2_CMD_PENDING) { ++ ioc->tm_cmds.status |= MPT2_CMD_RESET; ++ mpt2sas_base_free_smid(ioc, ioc->tm_cmds.smid); ++ complete(&ioc->tm_cmds.done); ++ } ++ _scsih_fw_event_on(ioc); ++ _scsih_flush_running_cmds(ioc); ++ break; ++ case MPT2_IOC_DONE_RESET: ++ dtmprintk(ioc, printk(MPT2SAS_DEBUG_FMT "%s: " ++ "MPT2_IOC_DONE_RESET\n", ioc->name, __func__)); ++ _scsih_sas_host_refresh(ioc, 0); ++ _scsih_search_responding_sas_devices(ioc); ++ _scsih_search_responding_raid_devices(ioc); ++ _scsih_search_responding_expanders(ioc); ++ break; ++ case MPT2_IOC_RUNNING: ++ dtmprintk(ioc, printk(MPT2SAS_DEBUG_FMT "%s: " ++ "MPT2_IOC_RUNNING\n", ioc->name, __func__)); ++ _scsih_remove_unresponding_devices(ioc); ++ break; + } + } + +@@ -5236,14 +5208,6 @@ _firmware_event_work(struct work_struct + unsigned long flags; + struct MPT2SAS_ADAPTER *ioc = fw_event->ioc; + +- /* This is invoked by calling _scsih_queue_rescan(). */ +- if (fw_event->event == MPT2SAS_RESCAN_AFTER_HOST_RESET) { +- _scsih_fw_event_free(ioc, fw_event); +- _scsih_sas_host_refresh(ioc, 1); +- _scsih_remove_unresponding_devices(ioc); +- return; +- } +- + /* the queue is being flushed so ignore this event */ + spin_lock_irqsave(&ioc->fw_event_lock, flags); + if (ioc->fw_events_off || ioc->remove_host) { + + +From gregkh@mini.kroah.org Wed Sep 16 15:37:13 2009 +Message-Id: <20090916223713.647767294@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Sep 2009 15:36:16 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Kashyap Desai , + James Bottomley +Subject: [patch 03/45] [SCSI] mpt2sas: Prevent sending command to FW while Host Reset +References: <20090916223613.597295240@mini.kroah.org> +Content-Disposition: inline; filename=mpt2sas-prevent-sending-command-to-fw-while-host-reset.patch +Content-Length: 11846 +Lines: 348 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Kashyap, Desai + +commit 155dd4c763694222c125e65438d823f58ea653bc upstream. + +This patch renames the flag for indicating host reset from +ioc_reset_in_progress to shost_recovery. It also removes the spin locks +surrounding the setting of this flag, which are unnecessary. Sanity checks on +the shost_recovery flag were added thru out the code so as to prevent sending +firmware commands during host reset. Also, the setting of the shost state to +SHOST_RECOVERY was removed to prevent deadlocks, this is actually better +handled by the shost_recovery flag. + +Signed-off-by: Kashyap Desai +Reviewed-by: Eric Moore +Signed-off-by: James Bottomley +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/mpt2sas/mpt2sas_base.c | 13 ++-------- + drivers/scsi/mpt2sas/mpt2sas_base.h | 3 -- + drivers/scsi/mpt2sas/mpt2sas_ctl.c | 16 +----------- + drivers/scsi/mpt2sas/mpt2sas_scsih.c | 40 ++++++++++++++++++------------- + drivers/scsi/mpt2sas/mpt2sas_transport.c | 29 +++++++++++++--------- + 5 files changed, 47 insertions(+), 54 deletions(-) + +--- a/drivers/scsi/mpt2sas/mpt2sas_base.c ++++ b/drivers/scsi/mpt2sas/mpt2sas_base.c +@@ -94,7 +94,7 @@ _base_fault_reset_work(struct work_struc + int rc; + + spin_lock_irqsave(&ioc->ioc_reset_in_progress_lock, flags); +- if (ioc->ioc_reset_in_progress) ++ if (ioc->shost_recovery) + goto rearm_timer; + spin_unlock_irqrestore(&ioc->ioc_reset_in_progress_lock, flags); + +@@ -3501,20 +3501,13 @@ mpt2sas_base_hard_reset_handler(struct M + __func__)); + + spin_lock_irqsave(&ioc->ioc_reset_in_progress_lock, flags); +- if (ioc->ioc_reset_in_progress) { ++ if (ioc->shost_recovery) { + spin_unlock_irqrestore(&ioc->ioc_reset_in_progress_lock, flags); + printk(MPT2SAS_ERR_FMT "%s: busy\n", + ioc->name, __func__); + return -EBUSY; + } +- ioc->ioc_reset_in_progress = 1; + ioc->shost_recovery = 1; +- if (ioc->shost->shost_state == SHOST_RUNNING) { +- /* set back to SHOST_RUNNING in mpt2sas_scsih.c */ +- scsi_host_set_state(ioc->shost, SHOST_RECOVERY); +- printk(MPT2SAS_INFO_FMT "putting controller into " +- "SHOST_RECOVERY\n", ioc->name); +- } + spin_unlock_irqrestore(&ioc->ioc_reset_in_progress_lock, flags); + + _base_reset_handler(ioc, MPT2_IOC_PRE_RESET); +@@ -3534,7 +3527,7 @@ mpt2sas_base_hard_reset_handler(struct M + ioc->name, __func__, ((r == 0) ? "SUCCESS" : "FAILED"))); + + spin_lock_irqsave(&ioc->ioc_reset_in_progress_lock, flags); +- ioc->ioc_reset_in_progress = 0; ++ ioc->shost_recovery = 0; + spin_unlock_irqrestore(&ioc->ioc_reset_in_progress_lock, flags); + + if (!r) +--- a/drivers/scsi/mpt2sas/mpt2sas_base.h ++++ b/drivers/scsi/mpt2sas/mpt2sas_base.h +@@ -432,7 +432,7 @@ typedef void (*MPT_ADD_SGE)(void *paddr, + * @fw_event_list: list of fw events + * @aen_event_read_flag: event log was read + * @broadcast_aen_busy: broadcast aen waiting to be serviced +- * @ioc_reset_in_progress: host reset in progress ++ * @shost_recovery: host reset in progress + * @ioc_reset_in_progress_lock: + * @ioc_link_reset_in_progress: phy/hard reset in progress + * @ignore_loginfos: ignore loginfos during task managment +@@ -545,7 +545,6 @@ struct MPT2SAS_ADAPTER { + /* misc flags */ + int aen_event_read_flag; + u8 broadcast_aen_busy; +- u8 ioc_reset_in_progress; + u8 shost_recovery; + spinlock_t ioc_reset_in_progress_lock; + u8 ioc_link_reset_in_progress; +--- a/drivers/scsi/mpt2sas/mpt2sas_ctl.c ++++ b/drivers/scsi/mpt2sas/mpt2sas_ctl.c +@@ -1963,7 +1963,6 @@ _ctl_ioctl_main(struct file *file, unsig + { + enum block_state state; + long ret = -EINVAL; +- unsigned long flags; + + state = (file->f_flags & O_NONBLOCK) ? NON_BLOCKING : + BLOCKING; +@@ -1989,13 +1988,8 @@ _ctl_ioctl_main(struct file *file, unsig + !ioc) + return -ENODEV; + +- spin_lock_irqsave(&ioc->ioc_reset_in_progress_lock, flags); +- if (ioc->shost_recovery) { +- spin_unlock_irqrestore(&ioc->ioc_reset_in_progress_lock, +- flags); ++ if (ioc->shost_recovery) + return -EAGAIN; +- } +- spin_unlock_irqrestore(&ioc->ioc_reset_in_progress_lock, flags); + + if (_IOC_SIZE(cmd) == sizeof(struct mpt2_ioctl_command)) { + uarg = arg; +@@ -2098,7 +2092,6 @@ _ctl_compat_mpt_command(struct file *fil + struct mpt2_ioctl_command karg; + struct MPT2SAS_ADAPTER *ioc; + enum block_state state; +- unsigned long flags; + + if (_IOC_SIZE(cmd) != sizeof(struct mpt2_ioctl_command32)) + return -EINVAL; +@@ -2113,13 +2106,8 @@ _ctl_compat_mpt_command(struct file *fil + if (_ctl_verify_adapter(karg32.hdr.ioc_number, &ioc) == -1 || !ioc) + return -ENODEV; + +- spin_lock_irqsave(&ioc->ioc_reset_in_progress_lock, flags); +- if (ioc->shost_recovery) { +- spin_unlock_irqrestore(&ioc->ioc_reset_in_progress_lock, +- flags); ++ if (ioc->shost_recovery) + return -EAGAIN; +- } +- spin_unlock_irqrestore(&ioc->ioc_reset_in_progress_lock, flags); + + memset(&karg, 0, sizeof(struct mpt2_ioctl_command)); + karg.hdr.ioc_number = karg32.hdr.ioc_number; +--- a/drivers/scsi/mpt2sas/mpt2sas_scsih.c ++++ b/drivers/scsi/mpt2sas/mpt2sas_scsih.c +@@ -1785,17 +1785,18 @@ mpt2sas_scsih_issue_tm(struct MPT2SAS_AD + u32 ioc_state; + unsigned long timeleft; + u8 VF_ID = 0; +- unsigned long flags; + +- spin_lock_irqsave(&ioc->ioc_reset_in_progress_lock, flags); +- if (ioc->tm_cmds.status != MPT2_CMD_NOT_USED || +- ioc->shost_recovery) { +- spin_unlock_irqrestore(&ioc->ioc_reset_in_progress_lock, flags); ++ if (ioc->tm_cmds.status != MPT2_CMD_NOT_USED) { ++ printk(MPT2SAS_INFO_FMT "%s: tm_cmd busy!!!\n", ++ __func__, ioc->name); ++ return; ++ } ++ ++ if (ioc->shost_recovery) { + printk(MPT2SAS_INFO_FMT "%s: host reset in progress!\n", + __func__, ioc->name); + return; + } +- spin_unlock_irqrestore(&ioc->ioc_reset_in_progress_lock, flags); + + ioc_state = mpt2sas_base_get_iocstate(ioc, 0); + if (ioc_state & MPI2_DOORBELL_USED) { +@@ -2553,7 +2554,6 @@ _scsih_qcmd(struct scsi_cmnd *scmd, void + Mpi2SCSIIORequest_t *mpi_request; + u32 mpi_control; + u16 smid; +- unsigned long flags; + + scmd->scsi_done = done; + sas_device_priv_data = scmd->device->hostdata; +@@ -2572,13 +2572,10 @@ _scsih_qcmd(struct scsi_cmnd *scmd, void + } + + /* see if we are busy with task managment stuff */ +- spin_lock_irqsave(&ioc->ioc_reset_in_progress_lock, flags); +- if (sas_target_priv_data->tm_busy || +- ioc->shost_recovery || ioc->ioc_link_reset_in_progress) { +- spin_unlock_irqrestore(&ioc->ioc_reset_in_progress_lock, flags); ++ if (sas_target_priv_data->tm_busy) ++ return SCSI_MLQUEUE_DEVICE_BUSY; ++ else if (ioc->shost_recovery || ioc->ioc_link_reset_in_progress) + return SCSI_MLQUEUE_HOST_BUSY; +- } +- spin_unlock_irqrestore(&ioc->ioc_reset_in_progress_lock, flags); + + if (scmd->sc_data_direction == DMA_FROM_DEVICE) + mpi_control = MPI2_SCSIIO_CONTROL_READ; +@@ -3374,6 +3371,9 @@ _scsih_expander_add(struct MPT2SAS_ADAPT + if (!handle) + return -1; + ++ if (ioc->shost_recovery) ++ return -1; ++ + if ((mpt2sas_config_get_expander_pg0(ioc, &mpi_reply, &expander_pg0, + MPI2_SAS_EXPAND_PGAD_FORM_HNDL, handle))) { + printk(MPT2SAS_ERR_FMT "failure at %s:%d/%s()!\n", +@@ -3510,6 +3510,9 @@ _scsih_expander_remove(struct MPT2SAS_AD + struct _sas_node *sas_expander; + unsigned long flags; + ++ if (ioc->shost_recovery) ++ return; ++ + spin_lock_irqsave(&ioc->sas_node_lock, flags); + sas_expander = mpt2sas_scsih_expander_find_by_handle(ioc, handle); + spin_unlock_irqrestore(&ioc->sas_node_lock, flags); +@@ -3681,6 +3684,8 @@ _scsih_remove_device(struct MPT2SAS_ADAP + mutex_unlock(&ioc->tm_cmds.mutex); + dewtprintk(ioc, printk(MPT2SAS_INFO_FMT "issue target reset " + "done: handle(0x%04x)\n", ioc->name, device_handle)); ++ if (ioc->shost_recovery) ++ goto out; + } + + /* SAS_IO_UNIT_CNTR - send REMOVE_DEVICE */ +@@ -3846,6 +3851,8 @@ _scsih_sas_topology_change_event(struct + "expander event\n", ioc->name)); + return; + } ++ if (ioc->shost_recovery) ++ return; + if (event_data->PHY[i].PhyStatus & + MPI2_EVENT_SAS_TOPO_PHYSTATUS_VACANT) + continue; +@@ -5217,13 +5224,10 @@ _firmware_event_work(struct work_struct + } + spin_unlock_irqrestore(&ioc->fw_event_lock, flags); + +- spin_lock_irqsave(&ioc->ioc_reset_in_progress_lock, flags); + if (ioc->shost_recovery) { +- spin_unlock_irqrestore(&ioc->ioc_reset_in_progress_lock, flags); + _scsih_fw_event_requeue(ioc, fw_event, 1000); + return; + } +- spin_unlock_irqrestore(&ioc->ioc_reset_in_progress_lock, flags); + + switch (fw_event->event) { + case MPI2_EVENT_SAS_TOPOLOGY_CHANGE_LIST: +@@ -5425,6 +5429,8 @@ _scsih_expander_node_remove(struct MPT2S + if (!sas_device) + continue; + _scsih_remove_device(ioc, sas_device->handle); ++ if (ioc->shost_recovery) ++ return; + goto retry_device_search; + } + } +@@ -5446,6 +5452,8 @@ _scsih_expander_node_remove(struct MPT2S + if (!expander_sibling) + continue; + _scsih_expander_remove(ioc, expander_sibling->handle); ++ if (ioc->shost_recovery) ++ return; + goto retry_expander_search; + } + } +--- a/drivers/scsi/mpt2sas/mpt2sas_transport.c ++++ b/drivers/scsi/mpt2sas/mpt2sas_transport.c +@@ -140,11 +140,18 @@ _transport_set_identify(struct MPT2SAS_A + u32 device_info; + u32 ioc_status; + ++ if (ioc->shost_recovery) { ++ printk(MPT2SAS_INFO_FMT "%s: host reset in progress!\n", ++ __func__, ioc->name); ++ return -EFAULT; ++ } ++ + if ((mpt2sas_config_get_sas_device_pg0(ioc, &mpi_reply, &sas_device_pg0, + MPI2_SAS_DEVICE_PGAD_FORM_HANDLE, handle))) { + printk(MPT2SAS_ERR_FMT "failure at %s:%d/%s()!\n", ++ + ioc->name, __FILE__, __LINE__, __func__); +- return -1; ++ return -ENXIO; + } + + ioc_status = le16_to_cpu(mpi_reply.IOCStatus) & +@@ -153,7 +160,7 @@ _transport_set_identify(struct MPT2SAS_A + printk(MPT2SAS_ERR_FMT "handle(0x%04x), ioc_status(0x%04x)" + "\nfailure at %s:%d/%s()!\n", ioc->name, handle, ioc_status, + __FILE__, __LINE__, __func__); +- return -1; ++ return -EIO; + } + + memset(identify, 0, sizeof(identify)); +@@ -288,21 +295,17 @@ _transport_expander_report_manufacture(s + void *psge; + u32 sgl_flags; + u8 issue_reset = 0; +- unsigned long flags; + void *data_out = NULL; + dma_addr_t data_out_dma; + u32 sz; + u64 *sas_address_le; + u16 wait_state_count; + +- spin_lock_irqsave(&ioc->ioc_reset_in_progress_lock, flags); +- if (ioc->ioc_reset_in_progress) { +- spin_unlock_irqrestore(&ioc->ioc_reset_in_progress_lock, flags); ++ if (ioc->shost_recovery) { + printk(MPT2SAS_INFO_FMT "%s: host reset in progress!\n", + __func__, ioc->name); + return -EFAULT; + } +- spin_unlock_irqrestore(&ioc->ioc_reset_in_progress_lock, flags); + + mutex_lock(&ioc->transport_cmds.mutex); + +@@ -806,6 +809,12 @@ mpt2sas_transport_update_phy_link_change + struct _sas_node *sas_node; + struct _sas_phy *mpt2sas_phy; + ++ if (ioc->shost_recovery) { ++ printk(MPT2SAS_INFO_FMT "%s: host reset in progress!\n", ++ __func__, ioc->name); ++ return; ++ } ++ + spin_lock_irqsave(&ioc->sas_node_lock, flags); + sas_node = _transport_sas_node_find_by_handle(ioc, handle); + spin_unlock_irqrestore(&ioc->sas_node_lock, flags); +@@ -1025,7 +1034,6 @@ _transport_smp_handler(struct Scsi_Host + void *psge; + u32 sgl_flags; + u8 issue_reset = 0; +- unsigned long flags; + dma_addr_t dma_addr_in = 0; + dma_addr_t dma_addr_out = 0; + u16 wait_state_count; +@@ -1045,14 +1053,11 @@ _transport_smp_handler(struct Scsi_Host + return -EINVAL; + } + +- spin_lock_irqsave(&ioc->ioc_reset_in_progress_lock, flags); +- if (ioc->ioc_reset_in_progress) { +- spin_unlock_irqrestore(&ioc->ioc_reset_in_progress_lock, flags); ++ if (ioc->shost_recovery) { + printk(MPT2SAS_INFO_FMT "%s: host reset in progress!\n", + __func__, ioc->name); + return -EFAULT; + } +- spin_unlock_irqrestore(&ioc->ioc_reset_in_progress_lock, flags); + + rc = mutex_lock_interruptible(&ioc->transport_cmds.mutex); + if (rc) + + +From gregkh@mini.kroah.org Wed Sep 16 15:37:13 2009 +Message-Id: <20090916223713.797208638@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Sep 2009 15:36:17 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Kashyap Desai , + James Bottomley +Subject: [patch 04/45] [SCSI] mpt2sas: setting SDEV into RUNNING state from Interrupt context +References: <20090916223613.597295240@mini.kroah.org> +Content-Disposition: inline; filename=mpt2sas-setting-sdev-into-running-state-from-interrupt-context.patch +Content-Length: 3411 +Lines: 95 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Kashyap, Desai + +commit 34a03bef2202d0c9983a8da0a8abaee37d285847 upstream. + +Changing SDEV Running state from interrupt context. Previously It was +handle in work queue thread. With this change It will not wait for work +queue thread to execute scsih_ublock_io_device to put SDEV into Running +state. This will reduce delay for Device becoming RUNNING. + +Modified this patch considering James comment "Not to change SDEV state +using scsi_device_set_state API, instead use scsi_internal_device_unblock +scsi_internal_device_block API" + +Signed-off-by: Kashyap Desai +Reviewed-by: Eric Moore +Signed-off-by: James Bottomley +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/mpt2sas/mpt2sas_base.h | 2 ++ + drivers/scsi/mpt2sas/mpt2sas_scsih.c | 17 +++++++++++------ + 2 files changed, 13 insertions(+), 6 deletions(-) + +--- a/drivers/scsi/mpt2sas/mpt2sas_base.h ++++ b/drivers/scsi/mpt2sas/mpt2sas_base.h +@@ -802,5 +802,7 @@ void mpt2sas_transport_update_phy_link_c + u16 attached_handle, u8 phy_number, u8 link_rate); + extern struct sas_function_template mpt2sas_transport_functions; + extern struct scsi_transport_template *mpt2sas_transport_template; ++extern int scsi_internal_device_block(struct scsi_device *sdev); ++extern int scsi_internal_device_unblock(struct scsi_device *sdev); + + #endif /* MPT2SAS_BASE_H_INCLUDED */ +--- a/drivers/scsi/mpt2sas/mpt2sas_scsih.c ++++ b/drivers/scsi/mpt2sas/mpt2sas_scsih.c +@@ -2222,7 +2222,7 @@ _scsih_ublock_io_device(struct MPT2SAS_A + MPT2SAS_INFO_FMT "SDEV_RUNNING: " + "handle(0x%04x)\n", ioc->name, handle)); + sas_device_priv_data->block = 0; +- scsi_device_set_state(sdev, SDEV_RUNNING); ++ scsi_internal_device_unblock(sdev); + } + } + } +@@ -2251,7 +2251,7 @@ _scsih_block_io_device(struct MPT2SAS_AD + MPT2SAS_INFO_FMT "SDEV_BLOCK: " + "handle(0x%04x)\n", ioc->name, handle)); + sas_device_priv_data->block = 1; +- scsi_device_set_state(sdev, SDEV_BLOCK); ++ scsi_internal_device_block(sdev); + } + } + } +@@ -2327,6 +2327,7 @@ _scsih_block_io_to_children_attached_dir + u16 handle; + u16 reason_code; + u8 phy_number; ++ u8 link_rate; + + for (i = 0; i < event_data->NumEntries; i++) { + handle = le16_to_cpu(event_data->PHY[i].AttachedDevHandle); +@@ -2337,6 +2338,11 @@ _scsih_block_io_to_children_attached_dir + MPI2_EVENT_SAS_TOPO_RC_MASK; + if (reason_code == MPI2_EVENT_SAS_TOPO_RC_DELAY_NOT_RESPONDING) + _scsih_block_io_device(ioc, handle); ++ if (reason_code == MPI2_EVENT_SAS_TOPO_RC_PHY_CHANGED) { ++ link_rate = event_data->PHY[i].LinkRate >> 4; ++ if (link_rate >= MPI2_SAS_NEG_LINK_RATE_1_5) ++ _scsih_ublock_io_device(ioc, handle); ++ } + } + } + +@@ -3708,6 +3714,9 @@ _scsih_remove_device(struct MPT2SAS_ADAP + le32_to_cpu(mpi_reply.IOCLogInfo))); + + out: ++ ++ _scsih_ublock_io_device(ioc, handle); ++ + mpt2sas_transport_port_remove(ioc, sas_device->sas_address, + sas_device->parent_handle); + +@@ -3887,10 +3896,6 @@ _scsih_sas_topology_change_event(struct + link_rate_); + } + } +- if (reason_code == MPI2_EVENT_SAS_TOPO_RC_PHY_CHANGED) { +- if (link_rate_ >= MPI2_SAS_NEG_LINK_RATE_1_5) +- _scsih_ublock_io_device(ioc, handle); +- } + if (reason_code == MPI2_EVENT_SAS_TOPO_RC_TARG_ADDED) { + if (link_rate_ < MPI2_SAS_NEG_LINK_RATE_1_5) + break; + + +From gregkh@mini.kroah.org Wed Sep 16 15:37:14 2009 +Message-Id: <20090916223713.953025868@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Sep 2009 15:36:18 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Kashyap Desai , + James Bottomley +Subject: [patch 05/45] [SCSI] mpt2sas: Raid 10 Volume is showing as Raid 1E in dmesg +References: <20090916223613.597295240@mini.kroah.org> +Content-Disposition: inline; filename=mpt2sas-raid-10-volume-is-showing-as-raid-1e-in-dmesg.patch +Content-Length: 8991 +Lines: 216 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Kashyap, Desai + +commit ed79f1280d1bc54f168abcffc8c3e0bf8ffb1873 upstream. + +This patch modifies the slave_configure callback so the messages that get sent +to system log for RAID1E volumes contain the string "RAID10" instead of +"RAID1E". These messages contain information regarding what kind of scsi device +is being added. Certain OEMS can enable displaying the RAID10 string instead of +RAID1E via manufacturing page 10. The driver will read this config page at +driver load time, then determine from the GenericFlags0 bits whether display +the RAID10 or RAID1E string, also even drive count is taken into consideration. + +Signed-off-by: Kashyap Desai +Reviewed-by: Eric Moore +Signed-off-by: James Bottomley +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/mpt2sas/mpt2sas_base.c | 7 ++- + drivers/scsi/mpt2sas/mpt2sas_base.h | 37 ++++++++++++++++++++ + drivers/scsi/mpt2sas/mpt2sas_config.c | 61 ++++++++++++++++++++++++++++++++++ + drivers/scsi/mpt2sas/mpt2sas_scsih.c | 8 +++- + 4 files changed, 109 insertions(+), 4 deletions(-) + +--- a/drivers/scsi/mpt2sas/mpt2sas_base.c ++++ b/drivers/scsi/mpt2sas/mpt2sas_base.c +@@ -1542,6 +1542,8 @@ _base_display_ioc_capabilities(struct MP + (ioc->bios_pg3.BiosVersion & 0x0000FF00) >> 8, + ioc->bios_pg3.BiosVersion & 0x000000FF); + ++ _base_display_dell_branding(ioc); ++ + printk(MPT2SAS_INFO_FMT "Protocol=(", ioc->name); + + if (ioc->facts.ProtocolFlags & MPI2_IOCFACTS_PROTOCOL_SCSI_INITIATOR) { +@@ -1554,8 +1556,6 @@ _base_display_ioc_capabilities(struct MP + i++; + } + +- _base_display_dell_branding(ioc); +- + i = 0; + printk("), "); + printk("Capabilities=("); +@@ -1627,6 +1627,9 @@ _base_static_config_pages(struct MPT2SAS + u32 iounit_pg1_flags; + + mpt2sas_config_get_manufacturing_pg0(ioc, &mpi_reply, &ioc->manu_pg0); ++ if (ioc->ir_firmware) ++ mpt2sas_config_get_manufacturing_pg10(ioc, &mpi_reply, ++ &ioc->manu_pg10); + mpt2sas_config_get_bios_pg2(ioc, &mpi_reply, &ioc->bios_pg2); + mpt2sas_config_get_bios_pg3(ioc, &mpi_reply, &ioc->bios_pg3); + mpt2sas_config_get_ioc_pg8(ioc, &mpi_reply, &ioc->ioc_pg8); +--- a/drivers/scsi/mpt2sas/mpt2sas_base.h ++++ b/drivers/scsi/mpt2sas/mpt2sas_base.h +@@ -197,6 +197,38 @@ struct MPT2SAS_TARGET { + * @block: device is in SDEV_BLOCK state + * @tlr_snoop_check: flag used in determining whether to disable TLR + */ ++ ++/* OEM Identifiers */ ++#define MFG10_OEM_ID_INVALID (0x00000000) ++#define MFG10_OEM_ID_DELL (0x00000001) ++#define MFG10_OEM_ID_FSC (0x00000002) ++#define MFG10_OEM_ID_SUN (0x00000003) ++#define MFG10_OEM_ID_IBM (0x00000004) ++ ++/* GENERIC Flags 0*/ ++#define MFG10_GF0_OCE_DISABLED (0x00000001) ++#define MFG10_GF0_R1E_DRIVE_COUNT (0x00000002) ++#define MFG10_GF0_R10_DISPLAY (0x00000004) ++#define MFG10_GF0_SSD_DATA_SCRUB_DISABLE (0x00000008) ++#define MFG10_GF0_SINGLE_DRIVE_R0 (0x00000010) ++ ++/* OEM Specific Flags will come from OEM specific header files */ ++typedef struct _MPI2_CONFIG_PAGE_MAN_10 { ++ MPI2_CONFIG_PAGE_HEADER Header; /* 00h */ ++ U8 OEMIdentifier; /* 04h */ ++ U8 Reserved1; /* 05h */ ++ U16 Reserved2; /* 08h */ ++ U32 Reserved3; /* 0Ch */ ++ U32 GenericFlags0; /* 10h */ ++ U32 GenericFlags1; /* 14h */ ++ U32 Reserved4; /* 18h */ ++ U32 OEMSpecificFlags0; /* 1Ch */ ++ U32 OEMSpecificFlags1; /* 20h */ ++ U32 Reserved5[18]; /* 24h-60h*/ ++} MPI2_CONFIG_PAGE_MAN_10, ++ MPI2_POINTER PTR_MPI2_CONFIG_PAGE_MAN_10, ++ Mpi2ManufacturingPage10_t, MPI2_POINTER pMpi2ManufacturingPage10_t; ++ + struct MPT2SAS_DEVICE { + struct MPT2SAS_TARGET *sas_target; + unsigned int lun; +@@ -461,6 +493,7 @@ typedef void (*MPT_ADD_SGE)(void *paddr, + * @facts: static facts data + * @pfacts: static port facts data + * @manu_pg0: static manufacturing page 0 ++ * @manu_pg10: static manufacturing page 10 + * @bios_pg2: static bios page 2 + * @bios_pg3: static bios page 3 + * @ioc_pg8: static ioc page 8 +@@ -663,6 +696,7 @@ struct MPT2SAS_ADAPTER { + dma_addr_t diag_buffer_dma[MPI2_DIAG_BUF_TYPE_COUNT]; + u8 diag_buffer_status[MPI2_DIAG_BUF_TYPE_COUNT]; + u32 unique_id[MPI2_DIAG_BUF_TYPE_COUNT]; ++ Mpi2ManufacturingPage10_t manu_pg10; + u32 product_specific[MPI2_DIAG_BUF_TYPE_COUNT][23]; + u32 diagnostic_flags[MPI2_DIAG_BUF_TYPE_COUNT]; + }; +@@ -734,6 +768,8 @@ void mpt2sas_config_done(struct MPT2SAS_ + int mpt2sas_config_get_number_hba_phys(struct MPT2SAS_ADAPTER *ioc, u8 *num_phys); + int mpt2sas_config_get_manufacturing_pg0(struct MPT2SAS_ADAPTER *ioc, + Mpi2ConfigReply_t *mpi_reply, Mpi2ManufacturingPage0_t *config_page); ++int mpt2sas_config_get_manufacturing_pg10(struct MPT2SAS_ADAPTER *ioc, ++ Mpi2ConfigReply_t *mpi_reply, Mpi2ManufacturingPage10_t *config_page); + int mpt2sas_config_get_bios_pg2(struct MPT2SAS_ADAPTER *ioc, Mpi2ConfigReply_t + *mpi_reply, Mpi2BiosPage2_t *config_page); + int mpt2sas_config_get_bios_pg3(struct MPT2SAS_ADAPTER *ioc, Mpi2ConfigReply_t +@@ -776,7 +812,6 @@ int mpt2sas_config_get_volume_handle(str + u16 *volume_handle); + int mpt2sas_config_get_volume_wwid(struct MPT2SAS_ADAPTER *ioc, u16 volume_handle, + u64 *wwid); +- + /* ctl shared API */ + extern struct device_attribute *mpt2sas_host_attrs[]; + extern struct device_attribute *mpt2sas_dev_attrs[]; +--- a/drivers/scsi/mpt2sas/mpt2sas_config.c ++++ b/drivers/scsi/mpt2sas/mpt2sas_config.c +@@ -426,6 +426,67 @@ mpt2sas_config_get_manufacturing_pg0(str + } + + /** ++ * mpt2sas_config_get_manufacturing_pg10 - obtain manufacturing page 10 ++ * @ioc: per adapter object ++ * @mpi_reply: reply mf payload returned from firmware ++ * @config_page: contents of the config page ++ * Context: sleep. ++ * ++ * Returns 0 for success, non-zero for failure. ++ */ ++int ++mpt2sas_config_get_manufacturing_pg10(struct MPT2SAS_ADAPTER *ioc, ++ Mpi2ConfigReply_t *mpi_reply, Mpi2ManufacturingPage10_t *config_page) ++{ ++ Mpi2ConfigRequest_t mpi_request; ++ int r; ++ struct config_request mem; ++ ++ memset(config_page, 0, sizeof(Mpi2ManufacturingPage10_t)); ++ memset(&mpi_request, 0, sizeof(Mpi2ConfigRequest_t)); ++ mpi_request.Function = MPI2_FUNCTION_CONFIG; ++ mpi_request.Action = MPI2_CONFIG_ACTION_PAGE_HEADER; ++ mpi_request.Header.PageType = MPI2_CONFIG_PAGETYPE_MANUFACTURING; ++ mpi_request.Header.PageNumber = 10; ++ mpi_request.Header.PageVersion = MPI2_MANUFACTURING0_PAGEVERSION; ++ mpt2sas_base_build_zero_len_sge(ioc, &mpi_request.PageBufferSGE); ++ r = _config_request(ioc, &mpi_request, mpi_reply, ++ MPT2_CONFIG_PAGE_DEFAULT_TIMEOUT); ++ if (r) ++ goto out; ++ ++ mpi_request.Action = MPI2_CONFIG_ACTION_PAGE_READ_CURRENT; ++ mpi_request.Header.PageVersion = mpi_reply->Header.PageVersion; ++ mpi_request.Header.PageNumber = mpi_reply->Header.PageNumber; ++ mpi_request.Header.PageType = mpi_reply->Header.PageType; ++ mpi_request.Header.PageLength = mpi_reply->Header.PageLength; ++ mem.config_page_sz = le16_to_cpu(mpi_reply->Header.PageLength) * 4; ++ if (mem.config_page_sz > ioc->config_page_sz) { ++ r = _config_alloc_config_dma_memory(ioc, &mem); ++ if (r) ++ goto out; ++ } else { ++ mem.config_page_dma = ioc->config_page_dma; ++ mem.config_page = ioc->config_page; ++ } ++ ioc->base_add_sg_single(&mpi_request.PageBufferSGE, ++ MPT2_CONFIG_COMMON_SGLFLAGS | mem.config_page_sz, ++ mem.config_page_dma); ++ r = _config_request(ioc, &mpi_request, mpi_reply, ++ MPT2_CONFIG_PAGE_DEFAULT_TIMEOUT); ++ if (!r) ++ memcpy(config_page, mem.config_page, ++ min_t(u16, mem.config_page_sz, ++ sizeof(Mpi2ManufacturingPage10_t))); ++ ++ if (mem.config_page_sz > ioc->config_page_sz) ++ _config_free_config_dma_memory(ioc, &mem); ++ ++ out: ++ return r; ++} ++ ++/** + * mpt2sas_config_get_bios_pg2 - obtain bios page 2 + * @ioc: per adapter object + * @mpi_reply: reply mf payload returned from firmware +--- a/drivers/scsi/mpt2sas/mpt2sas_scsih.c ++++ b/drivers/scsi/mpt2sas/mpt2sas_scsih.c +@@ -1501,7 +1501,13 @@ _scsih_slave_configure(struct scsi_devic + break; + case MPI2_RAID_VOL_TYPE_RAID1E: + qdepth = MPT2SAS_RAID_QUEUE_DEPTH; +- r_level = "RAID1E"; ++ if (ioc->manu_pg10.OEMIdentifier && ++ (ioc->manu_pg10.GenericFlags0 & ++ MFG10_GF0_R10_DISPLAY) && ++ !(raid_device->num_pds % 2)) ++ r_level = "RAID10"; ++ else ++ r_level = "RAID1E"; + break; + case MPI2_RAID_VOL_TYPE_RAID1: + qdepth = MPT2SAS_RAID_QUEUE_DEPTH; + + +From gregkh@mini.kroah.org Wed Sep 16 15:37:14 2009 +Message-Id: <20090916223714.118636080@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Sep 2009 15:36:19 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + James Bottomley +Subject: [patch 06/45] SCSI: fix oops during scsi scanning +References: <20090916223613.597295240@mini.kroah.org> +Content-Disposition: inline; filename=scsi-fix-oops-during-scsi-scanning.patch +Content-Length: 5801 +Lines: 101 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: James Bottomley + +commit ea038f63ac52439e7816295fa6064fe95e6c1f51 upstream. + +Chris Webb reported: + p0# uname -a + Linux f7ea8425-d45b-490f-a738-d181d0df6963.host.elastichosts.com 2.6.30.4-elastic-lon-p #2 SMP PREEMPT Thu Aug 20 14:30:50 BST 2009 x86_64 Intel(R) Xeon(R) CPU E5420 @ 2.50GHz GenuineIntel GNU/Linux + p0# zgrep SCAN_ASYNC /proc/config.gz + # CONFIG_SCSI_SCAN_ASYNC is not set + + p0# cat /var/log/kern/2009-08-20 + [...] + 15:27:10.485 kernel: scsi9 : iSCSI Initiator over TCP/IP + 15:27:11.493 kernel: scsi 9:0:0:0: RAID IET Controller 0001 PQ: 0 ANSI: 5 + 15:27:11.493 kernel: scsi 9:0:0:0: Attached scsi generic sg6 type 12 + 15:27:11.495 kernel: scsi 9:0:0:1: Direct-Access IET VIRTUAL-DISK 0001 PQ: 0 ANSI: 5 + 15:27:11.495 kernel: sd 9:0:0:1: Attached scsi generic sg7 type 0 + 15:27:11.495 kernel: sd 9:0:0:1: [sdg] 4194304 512-byte hardware sectors: (2.14 GB/2.00 GiB) + 15:27:11.495 kernel: sd 9:0:0:1: [sdg] Write Protect is off + 15:27:11.495 kernel: sd 9:0:0:1: [sdg] Write cache: disabled, read cache: enabled, doesn't support DPO or FUA + 15:27:13.012 kernel: sdg:<6>scsi 9:0:0:1: [sdg] Unhandled error code + 15:27:13.012 kernel: scsi 9:0:0:1: [sdg] Result: hostbyte=0x07 driverbyte=0x00 + 15:27:13.012 kernel: end_request: I/O error, dev sdg, sector 0 + 15:27:13.012 kernel: Buffer I/O error on device sdg, logical block 0 + 15:27:13.012 kernel: ldm_validate_partition_table(): Disk read failed. + 15:27:13.012 kernel: unable to read partition table + 15:27:13.014 kernel: BUG: unable to handle kernel NULL pointer dereference at 0000000000000010 + 15:27:13.014 kernel: IP: [] disk_part_iter_next+0x74/0xfd + 15:27:13.014 kernel: PGD 82ad0b067 PUD 82cd7e067 PMD 0 + 15:27:13.014 kernel: Oops: 0000 [#1] PREEMPT SMP + 15:27:13.014 kernel: last sysfs file: /sys/devices/platform/host9/session4/iscsi_session/session4/ifacename + 15:27:13.014 kernel: CPU 5 + 15:27:13.014 kernel: Modules linked in: + 15:27:13.014 kernel: Pid: 13999, comm: async/0 Not tainted 2.6.30.4-elastic-lon-p #2 X7DBN + 15:27:13.014 kernel: RIP: 0010:[] [] disk_part_iter_next+0x74/0xfd + 15:27:13.014 kernel: RSP: 0018:ffff88066afa3dd0 EFLAGS: 00010246 + 15:27:13.014 kernel: RAX: ffff88082b58a000 RBX: ffff88066afa3e00 RCX: 0000000000000000 + 15:27:13.014 kernel: RDX: 0000000000000000 RSI: ffff88082b58a000 RDI: 0000000000000000 + 15:27:13.014 kernel: RBP: ffff88066afa3df0 R08: ffff88066afa2000 R09: ffff8806a204f000 + 15:27:13.014 kernel: R10: 000000fb12c7d274 R11: ffff8806c2bf0628 R12: ffff88066afa3e00 + 15:27:13.014 kernel: R13: ffff88082c829a00 R14: 0000000000000000 R15: ffff8806bc50c920 + 15:27:13.014 kernel: FS: 0000000000000000(0000) GS:ffff88002818a000(0000) knlGS:0000000000000000 + 15:27:13.014 kernel: CS: 0010 DS: 0018 ES: 0018 CR0: 000000008005003b + 15:27:13.014 kernel: CR2: 0000000000000010 CR3: 000000082ade3000 CR4: 00000000000426e0 + 15:27:13.014 kernel: DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 + 15:27:13.014 kernel: DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 + 15:27:13.014 kernel: Process async/0 (pid: 13999, threadinfo ffff88066afa2000, task ffff8806c2bf05e0) + 15:27:13.014 kernel: Stack: + 15:27:13.014 kernel: 0000000000000000 ffff88066afa3e00 ffff88066afa3e00 ffff88082c829a00 + 15:27:13.014 kernel: ffff88066afa3e40 ffffffff80306feb ffff88082b58a000 0000000000000000 + 15:27:13.014 kernel: 0000000000000001 ffff8806bc50c920 ffff88066afa3e40 ffff88082b58a000 + 15:27:13.014 kernel: Call Trace: + 15:27:13.014 kernel: [] register_disk+0x122/0x13a + 15:27:13.014 kernel: [] add_disk+0xaa/0x106 + 15:27:13.014 kernel: [] sd_probe_async+0x198/0x25b + 15:27:13.014 kernel: [] async_thread+0x10c/0x20d + 15:27:13.014 kernel: [] ? default_wake_function+0x0/0xf + 15:27:13.014 kernel: [] ? async_thread+0x0/0x20d + 15:27:13.014 kernel: [] kthread+0x55/0x80 + 15:27:13.014 kernel: [] child_rip+0xa/0x20 + 15:27:13.014 kernel: [] ? kthread+0x0/0x80 + 15:27:13.014 kernel: [] ? child_rip+0x0/0x20 + 15:27:13.014 kernel: Code: c8 ff 80 e1 0c b9 00 00 00 00 0f 44 c1 41 83 cd ff 48 8d 7a 20 48 be ff ff ff ff 08 00 00 00 48 b9 00 00 00 00 08 00 00 00 eb 50 <8b> 42 10 41 bd 01 00 00 00 eb db 4c 63 c2 4e 8d 04 c7 4d 8b 20 + 15:27:13.015 kernel: RIP [] disk_part_iter_next+0x74/0xfd + 15:27:13.015 kernel: RSP + 15:27:13.015 kernel: CR2: 0000000000000010 + 15:27:13.015 kernel: ---[ end trace 6104b56ef5590e25 ]--- + +The problem is caused because the async scanning split in sd.c doesn't hold +any reference to the device when it kicks off the async piece. What's +happening is that an iSCSI disconnect is destorying the device again *before* +the async sd scanning thread even starts. Fix this by taking a reference +before starting the thread and dropping it again when the thread completes. + +Reported-by: Chris Webb +Signed-off-by: James Bottomley +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/sd.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/scsi/sd.c ++++ b/drivers/scsi/sd.c +@@ -2021,6 +2021,7 @@ static void sd_probe_async(void *data, a + + sd_printk(KERN_NOTICE, sdkp, "Attached SCSI %sdisk\n", + sdp->removable ? "removable " : ""); ++ put_device(&sdkp->dev); + } + + /** +@@ -2106,6 +2107,7 @@ static int sd_probe(struct device *dev) + + get_device(&sdp->sdev_gendev); + ++ get_device(&sdkp->dev); /* prevent release before async_schedule */ + async_schedule(sd_probe_async, sdkp); + + return 0; + + +From gregkh@mini.kroah.org Wed Sep 16 15:37:14 2009 +Message-Id: <20090916223714.254153168@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Sep 2009 15:36:20 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Bart Van Assche , + FUJITA Tomonori , + James Bottomley +Subject: [patch 07/45] SCSI: libsrp: fix memory leak in srp_ring_free() +References: <20090916223613.597295240@mini.kroah.org> +Content-Disposition: inline; filename=scsi-libsrp-fix-memory-leak-in-srp_ring_free.patch +Content-Length: 1259 +Lines: 35 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Bart Van Assche + +commit afffd3dabe5209882c8cc59a373a4d33b5db304a upstream. + +This patch fixes a memory leak in the libsrp function srp_ring_free(). +It is not documented whether or not this function should free the ring +pointer itself. But the source code of the callers of this function +(srp_target_alloc() and srp_target_free()) makes it clear that +srp_ring_free() should deallocate the ring pointer itself. Furthermore, +the patch below makes srp_ring_free() deallocate all memory allocated by +srp_ring_alloc(). + +This patch affects the ibmvstgt driver, which is the only in-tree driver +that calls the srp_ring_free() function (indirectly). + +Signed-off-by: Bart Van Assche +Acked-by: FUJITA Tomonori +Signed-off-by: James Bottomley +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/libsrp.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/scsi/libsrp.c ++++ b/drivers/scsi/libsrp.c +@@ -124,6 +124,7 @@ static void srp_ring_free(struct device + dma_free_coherent(dev, size, ring[i]->buf, ring[i]->dma); + kfree(ring[i]); + } ++ kfree(ring); + } + + int srp_target_alloc(struct srp_target *target, struct device *dev, + + +From gregkh@mini.kroah.org Wed Sep 16 15:37:14 2009 +Message-Id: <20090916223714.392730496@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Sep 2009 15:36:21 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Bob Copeland , + "John W. Linville" +Subject: [patch 08/45] cfg80211: fix looping soft lockup in find_ie() +References: <20090916223613.597295240@mini.kroah.org> +Content-Disposition: inline; filename=cfg80211-fix-looping-soft-lockup-in-find_ie.patch +Content-Length: 4471 +Lines: 79 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Bob Copeland + +commit fcc6cb0c13555e78c2d47257b6d1b5e59b0c419a upstream. + +The find_ie() function uses a size_t for the len parameter, and +directly uses len as a loop variable. If any received packets +are malformed, it is possible for the decrease of len to overflow, +and since the result is unsigned, the loop will not terminate. +Change it to a signed int so the loop conditional works for +negative values. + +This fixes the following soft lockup: + +[38573.102007] BUG: soft lockup - CPU#0 stuck for 61s! [phy0:2230] +[38573.102007] Modules linked in: aes_i586 aes_generic fuse af_packet ipt_REJECT xt_tcpudp nf_conntrack_ipv4 nf_defrag_ipv4 xt_state iptable_filter ip_tables x_tables acpi_cpufreq binfmt_misc dm_mirror dm_region_hash dm_log dm_multipath dm_mod kvm_intel kvm uinput i915 arc4 ecb drm snd_hda_codec_idt ath5k snd_hda_intel hid_apple mac80211 usbhid appletouch snd_hda_codec snd_pcm ath cfg80211 snd_timer i2c_algo_bit ohci1394 video snd processor ieee1394 rfkill ehci_hcd sg sky2 backlight snd_page_alloc uhci_hcd joydev output ac thermal button battery sr_mod applesmc cdrom input_polldev evdev unix [last unloaded: scsi_wait_scan] +[38573.102007] irq event stamp: 2547724535 +[38573.102007] hardirqs last enabled at (2547724534): [] restore_all_notrace+0x0/0x18 +[38573.102007] hardirqs last disabled at (2547724535): [] apic_timer_interrupt+0x28/0x34 +[38573.102007] softirqs last enabled at (92950144): [] __do_softirq+0x108/0x210 +[38573.102007] softirqs last disabled at (92950274): [] _spin_lock_bh+0x14/0x80 +[38573.102007] +[38573.102007] Pid: 2230, comm: phy0 Tainted: G W (2.6.31-rc7-wl #8) MacBook1,1 +[38573.102007] EIP: 0060:[] EFLAGS: 00010292 CPU: 0 +[38573.102007] EIP is at cmp_ies+0x30/0x180 [cfg80211] +[38573.102007] EAX: 00000082 EBX: 00000000 ECX: ffffffc1 EDX: d8efd014 +[38573.102007] ESI: ffffff7c EDI: 0000004d EBP: eee2dc50 ESP: eee2dc3c +[38573.102007] DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068 +[38573.102007] CR0: 8005003b CR2: d8efd014 CR3: 01694000 CR4: 000026d0 +[38573.102007] DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000 +[38573.102007] DR6: ffff0ff0 DR7: 00000400 +[38573.102007] Call Trace: +[38573.102007] [] cmp_bss+0xed/0x100 [cfg80211] +[38573.102007] [] cfg80211_bss_update+0x84/0x410 [cfg80211] +[38573.102007] [] cfg80211_inform_bss_frame+0x114/0x180 [cfg80211] +[38573.102007] [] ieee80211_bss_info_update+0x4f/0x180 [mac80211] +[38573.102007] [] ieee80211_rx_bss_info+0x88/0xf0 [mac80211] +[38573.102007] [] ? ieee802_11_parse_elems+0x27/0x30 [mac80211] +[38573.102007] [] ieee80211_rx_mgmt_probe_resp+0xa4/0x1c0 [mac80211] +[38573.102007] [] ieee80211_sta_rx_queued_mgmt+0x919/0xc50 [mac80211] +[38573.102007] [] ? sched_clock+0x27/0xa0 +[38573.102007] [] ? sched_clock+0x27/0xa0 +[38573.102007] [] ? mark_held_locks+0x60/0x80 +[38573.102007] [] ? _spin_unlock_irqrestore+0x55/0x70 +[38573.102007] [] ? sub_preempt_count+0x85/0xc0 +[38573.102007] [] ? _spin_unlock_irqrestore+0x3e/0x70 +[38573.102007] [] ? skb_dequeue+0x4f/0x70 +[38573.102007] [] ieee80211_sta_work+0x91/0xb80 [mac80211] +[38573.102007] [] ? sched_clock+0x27/0xa0 +[38573.102007] [] ? sub_preempt_count+0x85/0xc0 +[38573.102007] [] worker_thread+0x18f/0x320 +[38573.102007] [] ? worker_thread+0x12e/0x320 +[38573.102007] [] ? _spin_unlock_irqrestore+0x55/0x70 +[38573.102007] [] ? ieee80211_sta_work+0x0/0xb80 [mac80211] +[38573.102007] [] ? autoremove_wake_function+0x0/0x50 +[38573.102007] [] ? worker_thread+0x0/0x320 +[38573.102007] [] kthread+0x84/0x90 +[38573.102007] [] ? kthread+0x0/0x90 +[38573.102007] [] kernel_thread_helper+0x7/0x10 + +Signed-off-by: Bob Copeland +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + net/wireless/scan.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/wireless/scan.c ++++ b/net/wireless/scan.c +@@ -97,7 +97,7 @@ void cfg80211_bss_expire(struct cfg80211 + dev->bss_generation++; + } + +-static u8 *find_ie(u8 num, u8 *ies, size_t len) ++static u8 *find_ie(u8 num, u8 *ies, int len) + { + while (len > 2 && ies[0] != num) { + len -= ies[1] + 2; + + +From gregkh@mini.kroah.org Wed Sep 16 15:37:14 2009 +Message-Id: <20090916223714.527518502@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Sep 2009 15:36:22 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Bob Copeland , + "John W. Linville" +Subject: [patch 09/45] ath5k: write PCU registers on initial reset +References: <20090916223613.597295240@mini.kroah.org> +Content-Disposition: inline; filename=ath5k-write-pcu-registers-on-initial-reset.patch +Content-Length: 1097 +Lines: 31 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Bob Copeland + +commit 3355443ad7601991affa5992b0d53870335af765 upstream. + +"Ath5k: unify resets" +introduced a regression into 2.6.28 where the PCU registers are never +initialized, due to ath5k_reset() always passing true for change_channel. +We subsequently program a lot of these registers but several may start +in an unknown state. + +Reported-by: Forrest Zhang +Signed-off-by: Bob Copeland +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/ath/ath5k/base.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/wireless/ath/ath5k/base.c ++++ b/drivers/net/wireless/ath/ath5k/base.c +@@ -2676,7 +2676,7 @@ ath5k_reset(struct ath5k_softc *sc, stru + sc->curchan = chan; + sc->curband = &sc->sbands[chan->band]; + } +- ret = ath5k_hw_reset(ah, sc->opmode, sc->curchan, true); ++ ret = ath5k_hw_reset(ah, sc->opmode, sc->curchan, chan != NULL); + if (ret) { + ATH5K_ERR(sc, "can't reset hardware (%d)\n", ret); + goto err; + + +From gregkh@mini.kroah.org Wed Sep 16 15:37:14 2009 +Message-Id: <20090916223714.674467550@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Sep 2009 15:36:23 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Roland McGrath , + James Morris +Subject: [patch 10/45] binfmt_elf: fix PT_INTERP bss handling +References: <20090916223613.597295240@mini.kroah.org> +Content-Disposition: inline; filename=binfmt_elf-fix-pt_interp-bss-handling.patch +Content-Length: 2694 +Lines: 83 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Roland McGrath + +commit 9f0ab4a3f0fdb1ff404d150618ace2fa069bb2e1 upstream. + +In fs/binfmt_elf.c, load_elf_interp() calls padzero() for .bss even if +the PT_LOAD has no PROT_WRITE and no .bss. This generates EFAULT. + +Here is a small test case. (Yes, there are other, useful PT_INTERP +which have only .text and no .data/.bss.) + + ----- ptinterp.S + _start: .globl _start + nop + int3 + ----- + $ gcc -m32 -nostartfiles -nostdlib -o ptinterp ptinterp.S + $ gcc -m32 -Wl,--dynamic-linker=ptinterp -o hello hello.c + $ ./hello + Segmentation fault # during execve() itself + + After applying the patch: + $ ./hello + Trace trap # user-mode execution after execve() finishes + +If the ELF headers are actually self-inconsistent, then dying is fine. +But having no PROT_WRITE segment is perfectly normal and correct if +there is no segment with p_memsz > p_filesz (i.e. bss). John Reiser +suggested checking for PROT_WRITE in the bss logic. I think it makes +most sense to simply apply the bss logic only when there is bss. + +This patch looks less trivial than it is due to some reindentation. +It just moves the "if (last_bss > elf_bss) {" test up to include the +partial-page bss logic as well as the more-pages bss logic. + +Reported-by: John Reiser +Signed-off-by: Roland McGrath +Signed-off-by: James Morris +Signed-off-by: Greg Kroah-Hartman + +--- + fs/binfmt_elf.c | 28 ++++++++++++++-------------- + 1 file changed, 14 insertions(+), 14 deletions(-) + +--- a/fs/binfmt_elf.c ++++ b/fs/binfmt_elf.c +@@ -501,22 +501,22 @@ static unsigned long load_elf_interp(str + } + } + +- /* +- * Now fill out the bss section. First pad the last page up +- * to the page boundary, and then perform a mmap to make sure +- * that there are zero-mapped pages up to and including the +- * last bss page. +- */ +- if (padzero(elf_bss)) { +- error = -EFAULT; +- goto out_close; +- } ++ if (last_bss > elf_bss) { ++ /* ++ * Now fill out the bss section. First pad the last page up ++ * to the page boundary, and then perform a mmap to make sure ++ * that there are zero-mapped pages up to and including the ++ * last bss page. ++ */ ++ if (padzero(elf_bss)) { ++ error = -EFAULT; ++ goto out_close; ++ } + +- /* What we have mapped so far */ +- elf_bss = ELF_PAGESTART(elf_bss + ELF_MIN_ALIGN - 1); ++ /* What we have mapped so far */ ++ elf_bss = ELF_PAGESTART(elf_bss + ELF_MIN_ALIGN - 1); + +- /* Map the last of the bss segment */ +- if (last_bss > elf_bss) { ++ /* Map the last of the bss segment */ + down_write(¤t->mm->mmap_sem); + error = do_brk(elf_bss, last_bss - elf_bss); + up_write(¤t->mm->mmap_sem); + + +From gregkh@mini.kroah.org Wed Sep 16 15:37:14 2009 +Message-Id: <20090916223714.807142378@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Sep 2009 15:36:24 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jason Gunthorpe , + Rajiv Andrade , + James Morris +Subject: [patch 11/45] TPM: Fixup boot probe timeout for tpm_tis driver +References: <20090916223613.597295240@mini.kroah.org> +Content-Disposition: inline; filename=tpm-fixup-boot-probe-timeout-for-tpm_tis-driver.patch +Content-Length: 1887 +Lines: 51 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Jason Gunthorpe + +commit ec57935837a78f9661125b08a5d08b697568e040 upstream. + +When probing the device in tpm_tis_init the call request_locality +uses timeout_a, which wasn't being initalized until after +request_locality. This results in request_locality falsely timing +out if the chip is still starting. Move the initialization to before +request_locality. + +This probably only matters for embedded cases (ie mine), a BIOS likely +gets the TPM into a state where this code path isn't necessary. + +Signed-off-by: Jason Gunthorpe +Acked-by: Rajiv Andrade +Signed-off-by: James Morris +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/char/tpm/tpm_tis.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +--- a/drivers/char/tpm/tpm_tis.c ++++ b/drivers/char/tpm/tpm_tis.c +@@ -450,6 +450,12 @@ static int tpm_tis_init(struct device *d + goto out_err; + } + ++ /* Default timeouts */ ++ chip->vendor.timeout_a = msecs_to_jiffies(TIS_SHORT_TIMEOUT); ++ chip->vendor.timeout_b = msecs_to_jiffies(TIS_LONG_TIMEOUT); ++ chip->vendor.timeout_c = msecs_to_jiffies(TIS_SHORT_TIMEOUT); ++ chip->vendor.timeout_d = msecs_to_jiffies(TIS_SHORT_TIMEOUT); ++ + if (request_locality(chip, 0) != 0) { + rc = -ENODEV; + goto out_err; +@@ -457,12 +463,6 @@ static int tpm_tis_init(struct device *d + + vendor = ioread32(chip->vendor.iobase + TPM_DID_VID(0)); + +- /* Default timeouts */ +- chip->vendor.timeout_a = msecs_to_jiffies(TIS_SHORT_TIMEOUT); +- chip->vendor.timeout_b = msecs_to_jiffies(TIS_LONG_TIMEOUT); +- chip->vendor.timeout_c = msecs_to_jiffies(TIS_SHORT_TIMEOUT); +- chip->vendor.timeout_d = msecs_to_jiffies(TIS_SHORT_TIMEOUT); +- + dev_info(dev, + "1.2 TPM (device-id 0x%X, rev-id %d)\n", + vendor >> 16, ioread8(chip->vendor.iobase + TPM_RID(0))); + + +From gregkh@mini.kroah.org Wed Sep 16 15:37:15 2009 +Message-Id: <20090916223714.964459375@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Sep 2009 15:36:25 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Geert Uytterhoeven +Subject: [patch 12/45] md: Fix "strchr" [drivers/md/dm-log-userspace.ko] undefined! +References: <20090916223613.597295240@mini.kroah.org> +Content-Disposition: inline; filename=md-fix-strchr-undefined.patch +Content-Length: 1254 +Lines: 36 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Geert Uytterhoeven + +commit 0d03d59d9b31cd1e33b7e46a80b6fef66244b1f2 upstream. + +Commit b8313b6da7e2e7c7f47d93d8561969a3ff9ba0ea ("dm log: remove incorrect +field from userspace table output") added a call to strstr() with a +single-character "needle" string parameter. + +Unfortunately some versions of gcc replace such calls to strstr() by calls +to strchr() behind our back. This causes linking errors if strchr() is +defined as an inline function in (e.g. on m68k): + +| WARNING: "strchr" [drivers/md/dm-log-userspace.ko] undefined! + +Avoid this by explicitly calling strchr() instead. + +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/dm-log-userspace-base.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/md/dm-log-userspace-base.c ++++ b/drivers/md/dm-log-userspace-base.c +@@ -582,7 +582,7 @@ static int userspace_status(struct dm_di + break; + case STATUSTYPE_TABLE: + sz = 0; +- table_args = strstr(lc->usr_argv_str, " "); ++ table_args = strchr(lc->usr_argv_str, ' '); + BUG_ON(!table_args); /* There will always be a ' ' */ + table_args++; + + + +From gregkh@mini.kroah.org Wed Sep 16 15:37:15 2009 +Message-Id: <20090916223715.136276870@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Sep 2009 15:36:26 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Joerg Roedel +Subject: [patch 13/45] x86/amd-iommu: fix broken check in amd_iommu_flush_all_devices +References: <20090916223613.597295240@mini.kroah.org> +Content-Disposition: inline; filename=x86-amd-iommu-fix-broken-check-in-amd_iommu_flush_all_devices.patch +Content-Length: 704 +Lines: 27 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Joerg Roedel + +commit e0faf54ee82bf9c07f0307b4391caad4020bd659 upstream. + +The amd_iommu_pd_table is indexed by protection domain +number and not by device id. So this check is broken and +must be removed. + +Signed-off-by: Joerg Roedel +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/amd_iommu.c | 2 -- + 1 file changed, 2 deletions(-) + +--- a/arch/x86/kernel/amd_iommu.c ++++ b/arch/x86/kernel/amd_iommu.c +@@ -485,8 +485,6 @@ void amd_iommu_flush_all_devices(void) + int i; + + for (i = 0; i <= amd_iommu_last_bdf; ++i) { +- if (amd_iommu_pd_table[i] == NULL) +- continue; + + iommu = amd_iommu_rlookup_table[i]; + if (!iommu) + + +From gregkh@mini.kroah.org Wed Sep 16 15:37:15 2009 +Message-Id: <20090916223715.315062589@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Sep 2009 15:36:27 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Hugh Dickins +Subject: [patch 14/45] fix undefined reference to user_shm_unlock +References: <20090916223613.597295240@mini.kroah.org> +Content-Disposition: inline; filename=fix-undefined-reference-to-user_shm_unlock.patch +Content-Length: 1113 +Lines: 33 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Hugh Dickins + +commit 2195d2818c37bdf263865f1e9effccdd9fc5f9d4 upstream. + +My 353d5c30c666580347515da609dd74a2b8e9b828 "mm: fix hugetlb bug due to +user_shm_unlock call" broke the CONFIG_SYSVIPC !CONFIG_MMU build of both +2.6.31 and 2.6.30.6: "undefined reference to `user_shm_unlock'". + +gcc didn't understand my comment! so couldn't figure out to optimize +away user_shm_unlock() from the error path in the hugetlb-less case, as +it does elsewhere. Help it to do so, in a language it understands. + +Reported-by: Mike Frysinger +Signed-off-by: Hugh Dickins +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + ipc/shm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/ipc/shm.c ++++ b/ipc/shm.c +@@ -410,7 +410,7 @@ static int newseg(struct ipc_namespace * + return error; + + no_id: +- if (shp->mlock_user) /* shmflg & SHM_HUGETLB case */ ++ if (is_file_hugepages(file) && shp->mlock_user) + user_shm_unlock(size, shp->mlock_user); + fput(file); + no_file: + + +From gregkh@mini.kroah.org Wed Sep 16 15:37:15 2009 +Message-Id: <20090916223715.431178121@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Sep 2009 15:36:28 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Xiao Guangrong , + Peter Zijlstra , + Paul Mackerras , + Ingo Molnar +Subject: [patch 15/45] perf_counter: Fix buffer overflow in perf_copy_attr() +References: <20090916223613.597295240@mini.kroah.org> +Content-Disposition: inline; filename=perf_counter-fix-buffer-overflow-in-perf_copy_attr.patch +Content-Length: 925 +Lines: 33 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Xiao Guangrong + +commit b3e62e35058fc744ac794611f4e79bcd1c5a4b83 upstream. + +If we pass a big size data over perf_counter_open() syscall, +the kernel will copy this data to a small buffer, it will +cause kernel crash. + +This bug makes the kernel unsafe and non-root local user can +trigger it. + +Signed-off-by: Xiao Guangrong +Acked-by: Peter Zijlstra +Acked-by: Paul Mackerras +LKML-Reference: <4AAF37D4.5010706@cn.fujitsu.com> +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/perf_counter.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/kernel/perf_counter.c ++++ b/kernel/perf_counter.c +@@ -4171,6 +4171,7 @@ static int perf_copy_attr(struct perf_co + if (val) + goto err_size; + } ++ size = sizeof(*attr); + } + + ret = copy_from_user(attr, uattr, size); + + +From gregkh@mini.kroah.org Wed Sep 16 15:37:15 2009 +Message-Id: <20090916223715.565352707@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Sep 2009 15:36:29 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Paul Mackerras , + Peter Zijlstra , + Ingo Molnar +Subject: [patch 16/45] perf_counter: Start counting time enabled when group leader gets enabled +References: <20090916223613.597295240@mini.kroah.org> +Content-Disposition: inline; filename=perf_counter-start-counting-time-enabled-when-group-leader-gets-enabled.patch +Content-Length: 4663 +Lines: 132 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Paul Mackerras + +commit fa289beca9de9119c7760bd984f3640da21bc94c upstream. + +Currently, if a group is created where the group leader is +initially disabled but a non-leader member is initially +enabled, and then the leader is subsequently enabled some time +later, the time_enabled for the non-leader member will reflect +the whole time since it was created, not just the time since +the leader was enabled. + +This is incorrect, because all of the members are effectively +disabled while the leader is disabled, since none of the +members can go on the PMU if the leader can't. + +Thus we have to update the ->tstamp_enabled for all the enabled +group members when a group leader is enabled, so that the +time_enabled computation only counts the time since the leader +was enabled. + +Similarly, when disabling a group leader we have to update the +time_enabled and time_running for all of the group members. + +Also, in update_counter_times, we have to treat a counter whose +group leader is disabled as being disabled. + +Reported-by: Stephane Eranian +Signed-off-by: Paul Mackerras +Acked-by: Peter Zijlstra +LKML-Reference: <19091.29664.342227.445006@drongo.ozlabs.ibm.com> +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/perf_counter.c | 43 ++++++++++++++++++++++++++++++------------- + 1 file changed, 30 insertions(+), 13 deletions(-) + +--- a/kernel/perf_counter.c ++++ b/kernel/perf_counter.c +@@ -469,7 +469,8 @@ static void update_counter_times(struct + struct perf_counter_context *ctx = counter->ctx; + u64 run_end; + +- if (counter->state < PERF_COUNTER_STATE_INACTIVE) ++ if (counter->state < PERF_COUNTER_STATE_INACTIVE || ++ counter->group_leader->state < PERF_COUNTER_STATE_INACTIVE) + return; + + counter->total_time_enabled = ctx->time - counter->tstamp_enabled; +@@ -518,7 +519,7 @@ static void __perf_counter_disable(void + */ + if (counter->state >= PERF_COUNTER_STATE_INACTIVE) { + update_context_time(ctx); +- update_counter_times(counter); ++ update_group_times(counter); + if (counter == counter->group_leader) + group_sched_out(counter, cpuctx, ctx); + else +@@ -573,7 +574,7 @@ static void perf_counter_disable(struct + * in, so we can change the state safely. + */ + if (counter->state == PERF_COUNTER_STATE_INACTIVE) { +- update_counter_times(counter); ++ update_group_times(counter); + counter->state = PERF_COUNTER_STATE_OFF; + } + +@@ -851,6 +852,27 @@ retry: + } + + /* ++ * Put a counter into inactive state and update time fields. ++ * Enabling the leader of a group effectively enables all ++ * the group members that aren't explicitly disabled, so we ++ * have to update their ->tstamp_enabled also. ++ * Note: this works for group members as well as group leaders ++ * since the non-leader members' sibling_lists will be empty. ++ */ ++static void __perf_counter_mark_enabled(struct perf_counter *counter, ++ struct perf_counter_context *ctx) ++{ ++ struct perf_counter *sub; ++ ++ counter->state = PERF_COUNTER_STATE_INACTIVE; ++ counter->tstamp_enabled = ctx->time - counter->total_time_enabled; ++ list_for_each_entry(sub, &counter->sibling_list, list_entry) ++ if (sub->state >= PERF_COUNTER_STATE_INACTIVE) ++ sub->tstamp_enabled = ++ ctx->time - sub->total_time_enabled; ++} ++ ++/* + * Cross CPU call to enable a performance counter + */ + static void __perf_counter_enable(void *info) +@@ -877,8 +899,7 @@ static void __perf_counter_enable(void * + + if (counter->state >= PERF_COUNTER_STATE_INACTIVE) + goto unlock; +- counter->state = PERF_COUNTER_STATE_INACTIVE; +- counter->tstamp_enabled = ctx->time - counter->total_time_enabled; ++ __perf_counter_mark_enabled(counter, ctx); + + /* + * If the counter is in a group and isn't the group leader, +@@ -971,11 +992,9 @@ static void perf_counter_enable(struct p + * Since we have the lock this context can't be scheduled + * in, so we can change the state safely. + */ +- if (counter->state == PERF_COUNTER_STATE_OFF) { +- counter->state = PERF_COUNTER_STATE_INACTIVE; +- counter->tstamp_enabled = +- ctx->time - counter->total_time_enabled; +- } ++ if (counter->state == PERF_COUNTER_STATE_OFF) ++ __perf_counter_mark_enabled(counter, ctx); ++ + out: + spin_unlock_irq(&ctx->lock); + } +@@ -1479,9 +1498,7 @@ static void perf_counter_enable_on_exec( + counter->attr.enable_on_exec = 0; + if (counter->state >= PERF_COUNTER_STATE_INACTIVE) + continue; +- counter->state = PERF_COUNTER_STATE_INACTIVE; +- counter->tstamp_enabled = +- ctx->time - counter->total_time_enabled; ++ __perf_counter_mark_enabled(counter, ctx); + enabled = 1; + } + + + +From gregkh@mini.kroah.org Wed Sep 16 15:37:15 2009 +Message-Id: <20090916223715.733319934@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Sep 2009 15:36:30 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Paul Mackerras , + Benjamin Herrenschmidt +Subject: [patch 17/45] powerpc/perf_counters: Reduce stack usage of power_check_constraints +References: <20090916223613.597295240@mini.kroah.org> +Content-Disposition: inline; filename=powerpc-perf_counters-reduce-stack-usage-of-power_check_constraints.patch +Content-Length: 6474 +Lines: 176 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Paul Mackerras + +commit e51ee31e8af22948dcc3b115978469b09c96c3fd upstream. + +Michael Ellerman reported stack-frame size warnings being produced +for power_check_constraints(), which uses an 8*8 array of u64 and +two 8*8 arrays of unsigned long, which are currently allocated on the +stack, along with some other smaller variables. These arrays come +to 1.5kB on 64-bit or 1kB on 32-bit, which is a bit too much for the +stack. + +This fixes the problem by putting these arrays in the existing +per-cpu cpu_hw_counters struct. This is OK because two of the call +sites have interrupts disabled already; for the third call site we +use get_cpu_var, which disables preemption, so we know we won't +get a context switch while we're in power_check_constraints(). +Note that power_check_constraints() can be called during context +switch but is not called from interrupts. + +Reported-by: Michael Ellerman +Signed-off-by: Paul Mackerras +Signed-off-by: Benjamin Herrenschmidt +Signed-off-by: Greg Kroah-Hartman + +--- + arch/powerpc/kernel/perf_counter.c | 55 +++++++++++++++++++++---------------- + 1 file changed, 32 insertions(+), 23 deletions(-) + +--- a/arch/powerpc/kernel/perf_counter.c ++++ b/arch/powerpc/kernel/perf_counter.c +@@ -32,6 +32,9 @@ struct cpu_hw_counters { + unsigned long mmcr[3]; + struct perf_counter *limited_counter[MAX_LIMITED_HWCOUNTERS]; + u8 limited_hwidx[MAX_LIMITED_HWCOUNTERS]; ++ u64 alternatives[MAX_HWCOUNTERS][MAX_EVENT_ALTERNATIVES]; ++ unsigned long amasks[MAX_HWCOUNTERS][MAX_EVENT_ALTERNATIVES]; ++ unsigned long avalues[MAX_HWCOUNTERS][MAX_EVENT_ALTERNATIVES]; + }; + DEFINE_PER_CPU(struct cpu_hw_counters, cpu_hw_counters); + +@@ -245,13 +248,11 @@ static void write_pmc(int idx, unsigned + * and see if any combination of alternative codes is feasible. + * The feasible set is returned in event[]. + */ +-static int power_check_constraints(u64 event[], unsigned int cflags[], ++static int power_check_constraints(struct cpu_hw_counters *cpuhw, ++ u64 event[], unsigned int cflags[], + int n_ev) + { + unsigned long mask, value, nv; +- u64 alternatives[MAX_HWCOUNTERS][MAX_EVENT_ALTERNATIVES]; +- unsigned long amasks[MAX_HWCOUNTERS][MAX_EVENT_ALTERNATIVES]; +- unsigned long avalues[MAX_HWCOUNTERS][MAX_EVENT_ALTERNATIVES]; + unsigned long smasks[MAX_HWCOUNTERS], svalues[MAX_HWCOUNTERS]; + int n_alt[MAX_HWCOUNTERS], choice[MAX_HWCOUNTERS]; + int i, j; +@@ -266,21 +267,23 @@ static int power_check_constraints(u64 e + if ((cflags[i] & PPMU_LIMITED_PMC_REQD) + && !ppmu->limited_pmc_event(event[i])) { + ppmu->get_alternatives(event[i], cflags[i], +- alternatives[i]); +- event[i] = alternatives[i][0]; ++ cpuhw->alternatives[i]); ++ event[i] = cpuhw->alternatives[i][0]; + } +- if (ppmu->get_constraint(event[i], &amasks[i][0], +- &avalues[i][0])) ++ if (ppmu->get_constraint(event[i], &cpuhw->amasks[i][0], ++ &cpuhw->avalues[i][0])) + return -1; + } + value = mask = 0; + for (i = 0; i < n_ev; ++i) { +- nv = (value | avalues[i][0]) + (value & avalues[i][0] & addf); ++ nv = (value | cpuhw->avalues[i][0]) + ++ (value & cpuhw->avalues[i][0] & addf); + if ((((nv + tadd) ^ value) & mask) != 0 || +- (((nv + tadd) ^ avalues[i][0]) & amasks[i][0]) != 0) ++ (((nv + tadd) ^ cpuhw->avalues[i][0]) & ++ cpuhw->amasks[i][0]) != 0) + break; + value = nv; +- mask |= amasks[i][0]; ++ mask |= cpuhw->amasks[i][0]; + } + if (i == n_ev) + return 0; /* all OK */ +@@ -291,10 +294,11 @@ static int power_check_constraints(u64 e + for (i = 0; i < n_ev; ++i) { + choice[i] = 0; + n_alt[i] = ppmu->get_alternatives(event[i], cflags[i], +- alternatives[i]); ++ cpuhw->alternatives[i]); + for (j = 1; j < n_alt[i]; ++j) +- ppmu->get_constraint(alternatives[i][j], +- &amasks[i][j], &avalues[i][j]); ++ ppmu->get_constraint(cpuhw->alternatives[i][j], ++ &cpuhw->amasks[i][j], ++ &cpuhw->avalues[i][j]); + } + + /* enumerate all possibilities and see if any will work */ +@@ -313,11 +317,11 @@ static int power_check_constraints(u64 e + * where k > j, will satisfy the constraints. + */ + while (++j < n_alt[i]) { +- nv = (value | avalues[i][j]) + +- (value & avalues[i][j] & addf); ++ nv = (value | cpuhw->avalues[i][j]) + ++ (value & cpuhw->avalues[i][j] & addf); + if ((((nv + tadd) ^ value) & mask) == 0 && +- (((nv + tadd) ^ avalues[i][j]) +- & amasks[i][j]) == 0) ++ (((nv + tadd) ^ cpuhw->avalues[i][j]) ++ & cpuhw->amasks[i][j]) == 0) + break; + } + if (j >= n_alt[i]) { +@@ -339,7 +343,7 @@ static int power_check_constraints(u64 e + svalues[i] = value; + smasks[i] = mask; + value = nv; +- mask |= amasks[i][j]; ++ mask |= cpuhw->amasks[i][j]; + ++i; + j = -1; + } +@@ -347,7 +351,7 @@ static int power_check_constraints(u64 e + + /* OK, we have a feasible combination, tell the caller the solution */ + for (i = 0; i < n_ev; ++i) +- event[i] = alternatives[i][choice[i]]; ++ event[i] = cpuhw->alternatives[i][choice[i]]; + return 0; + } + +@@ -752,7 +756,7 @@ int hw_perf_group_sched_in(struct perf_c + return -EAGAIN; + if (check_excludes(cpuhw->counter, cpuhw->flags, n0, n)) + return -EAGAIN; +- i = power_check_constraints(cpuhw->events, cpuhw->flags, n + n0); ++ i = power_check_constraints(cpuhw, cpuhw->events, cpuhw->flags, n + n0); + if (i < 0) + return -EAGAIN; + cpuhw->n_counters = n0 + n; +@@ -807,7 +811,7 @@ static int power_pmu_enable(struct perf_ + cpuhw->flags[n0] = counter->hw.counter_base; + if (check_excludes(cpuhw->counter, cpuhw->flags, n0, 1)) + goto out; +- if (power_check_constraints(cpuhw->events, cpuhw->flags, n0 + 1)) ++ if (power_check_constraints(cpuhw, cpuhw->events, cpuhw->flags, n0 + 1)) + goto out; + + counter->hw.config = cpuhw->events[n0]; +@@ -1012,6 +1016,7 @@ const struct pmu *hw_perf_counter_init(s + unsigned int cflags[MAX_HWCOUNTERS]; + int n; + int err; ++ struct cpu_hw_counters *cpuhw; + + if (!ppmu) + return ERR_PTR(-ENXIO); +@@ -1090,7 +1095,11 @@ const struct pmu *hw_perf_counter_init(s + cflags[n] = flags; + if (check_excludes(ctrs, cflags, n, 1)) + return ERR_PTR(-EINVAL); +- if (power_check_constraints(events, cflags, n + 1)) ++ ++ cpuhw = &get_cpu_var(cpu_hw_counters); ++ err = power_check_constraints(cpuhw, events, cflags, n + 1); ++ put_cpu_var(cpu_hw_counters); ++ if (err) + return ERR_PTR(-EINVAL); + + counter->hw.config = events[n]; + + +From gregkh@mini.kroah.org Wed Sep 16 15:37:16 2009 +Message-Id: <20090916223715.891840230@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Sep 2009 15:36:31 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Paul Mackerras , + Benjamin Herrenschmidt +Subject: [patch 18/45] powerpc: Fix bug where perf_counters breaks oprofile +References: <20090916223613.597295240@mini.kroah.org> +Content-Disposition: inline; filename=powerpc-fix-bug-where-perf_counters-breaks-oprofile.patch +Content-Length: 4936 +Lines: 154 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Paul Mackerras + +commit a6dbf93a2ad853585409e715eb96dca9177e3c39 upstream. + +Currently there is a bug where if you use oprofile on a pSeries +machine, then use perf_counters, then use oprofile again, oprofile +will not work correctly; it will lose the PMU configuration the next +time the hypervisor does a partition context switch, and thereafter +won't count anything. + +Maynard Johnson identified the sequence causing the problem: +- oprofile setup calls ppc_enable_pmcs(), which calls + pseries_lpar_enable_pmcs, which tells the hypervisor that we want + to use the PMU, and sets the "PMU in use" flag in the lppaca. + This flag tells the hypervisor whether it needs to save and restore + the PMU config. +- The perf_counter code sets and clears the "PMU in use" flag directly + as it context-switches the PMU between tasks, and leaves it clear + when it finishes. +- oprofile setup, called for a new oprofile run, calls ppc_enable_pmcs, + which does nothing because it has already been called. In particular + it doesn't set the "PMU in use" flag. + +This fixes the problem by arranging for ppc_enable_pmcs to always set +the "PMU in use" flag. It makes the perf_counter code call +ppc_enable_pmcs also rather than calling the lower-level function +directly, and removes the setting of the "PMU in use" flag from +pseries_lpar_enable_pmcs, since that is now done in its caller. + +This also removes the declaration of pasemi_enable_pmcs because it +isn't defined anywhere. + +Reported-by: Maynard Johnson +Signed-off-by: Paul Mackerras +Signed-off-by: Benjamin Herrenschmidt +Signed-off-by: Greg Kroah-Hartman + +--- + arch/powerpc/include/asm/pmc.h | 16 ++++++++++++++-- + arch/powerpc/kernel/perf_counter.c | 13 +++---------- + arch/powerpc/kernel/sysfs.c | 3 +++ + arch/powerpc/platforms/pseries/setup.c | 4 ---- + 4 files changed, 20 insertions(+), 16 deletions(-) + +--- a/arch/powerpc/include/asm/pmc.h ++++ b/arch/powerpc/include/asm/pmc.h +@@ -27,10 +27,22 @@ extern perf_irq_t perf_irq; + + int reserve_pmc_hardware(perf_irq_t new_perf_irq); + void release_pmc_hardware(void); ++void ppc_enable_pmcs(void); + + #ifdef CONFIG_PPC64 +-void power4_enable_pmcs(void); +-void pasemi_enable_pmcs(void); ++#include ++ ++static inline void ppc_set_pmu_inuse(int inuse) ++{ ++ get_lppaca()->pmcregs_in_use = inuse; ++} ++ ++extern void power4_enable_pmcs(void); ++ ++#else /* CONFIG_PPC64 */ ++ ++static inline void ppc_set_pmu_inuse(int inuse) { } ++ + #endif + + #endif /* __KERNEL__ */ +--- a/arch/powerpc/kernel/perf_counter.c ++++ b/arch/powerpc/kernel/perf_counter.c +@@ -65,7 +65,6 @@ static inline unsigned long perf_ip_adju + { + return 0; + } +-static inline void perf_set_pmu_inuse(int inuse) { } + static inline void perf_get_data_addr(struct pt_regs *regs, u64 *addrp) { } + static inline u32 perf_get_misc_flags(struct pt_regs *regs) + { +@@ -96,11 +95,6 @@ static inline unsigned long perf_ip_adju + return 0; + } + +-static inline void perf_set_pmu_inuse(int inuse) +-{ +- get_lppaca()->pmcregs_in_use = inuse; +-} +- + /* + * The user wants a data address recorded. + * If we're not doing instruction sampling, give them the SDAR +@@ -535,8 +529,7 @@ void hw_perf_disable(void) + * Check if we ever enabled the PMU on this cpu. + */ + if (!cpuhw->pmcs_enabled) { +- if (ppc_md.enable_pmcs) +- ppc_md.enable_pmcs(); ++ ppc_enable_pmcs(); + cpuhw->pmcs_enabled = 1; + } + +@@ -598,7 +591,7 @@ void hw_perf_enable(void) + mtspr(SPRN_MMCRA, cpuhw->mmcr[2] & ~MMCRA_SAMPLE_ENABLE); + mtspr(SPRN_MMCR1, cpuhw->mmcr[1]); + if (cpuhw->n_counters == 0) +- perf_set_pmu_inuse(0); ++ ppc_set_pmu_inuse(0); + goto out_enable; + } + +@@ -631,7 +624,7 @@ void hw_perf_enable(void) + * bit set and set the hardware counters to their initial values. + * Then unfreeze the counters. + */ +- perf_set_pmu_inuse(1); ++ ppc_set_pmu_inuse(1); + mtspr(SPRN_MMCRA, cpuhw->mmcr[2] & ~MMCRA_SAMPLE_ENABLE); + mtspr(SPRN_MMCR1, cpuhw->mmcr[1]); + mtspr(SPRN_MMCR0, (cpuhw->mmcr[0] & ~(MMCR0_PMC1CE | MMCR0_PMCjCE)) +--- a/arch/powerpc/kernel/sysfs.c ++++ b/arch/powerpc/kernel/sysfs.c +@@ -17,6 +17,7 @@ + #include + #include + #include ++#include + + #include "cacheinfo.h" + +@@ -123,6 +124,8 @@ static DEFINE_PER_CPU(char, pmcs_enabled + + void ppc_enable_pmcs(void) + { ++ ppc_set_pmu_inuse(1); ++ + /* Only need to enable them once */ + if (__get_cpu_var(pmcs_enabled)) + return; +--- a/arch/powerpc/platforms/pseries/setup.c ++++ b/arch/powerpc/platforms/pseries/setup.c +@@ -223,10 +223,6 @@ static void pseries_lpar_enable_pmcs(voi + set = 1UL << 63; + reset = 0; + plpar_hcall_norets(H_PERFMON, set, reset); +- +- /* instruct hypervisor to maintain PMCs */ +- if (firmware_has_feature(FW_FEATURE_SPLPAR)) +- get_lppaca()->pmcregs_in_use = 1; + } + + static void __init pseries_discover_pic(void) + + +From gregkh@mini.kroah.org Wed Sep 16 15:37:16 2009 +Message-Id: <20090916223716.038596167@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Sep 2009 15:36:32 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Geoff Levand , + Benjamin Herrenschmidt +Subject: [patch 19/45] powerpc/ps3: Workaround for flash memory I/O error +References: <20090916223613.597295240@mini.kroah.org> +Content-Disposition: inline; filename=powerpc-ps3-workaround-for-flash-memory-i-o-error.patch +Content-Length: 3401 +Lines: 122 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Geoff Levand + +commit bc00351edd5c1b84d48c3fdca740fedfce4ae6ce upstream. + +A workaround for flash memory I/O errors when the PS3 internal +hard disk has not been formatted for OtherOS use. + +This error condition mainly effects 'Live CD' users who have not +formatted the PS3's internal hard disk for OtherOS. + +Fixes errors similar to these when using the ps3-flash-util +or ps3-boot-game-os programs: + + ps3flash read failed 0x2050000 + os_area_header_read: read error: os_area_header: Input/output error + main:627: os_area_read_hp error. + ERROR: can't change boot flag + +Signed-off-by: Geoff Levand +Signed-off-by: Benjamin Herrenschmidt +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ps3/ps3stor_lib.c | 65 +++++++++++++++++++++++++++++++++++++++++++--- + 1 file changed, 62 insertions(+), 3 deletions(-) + +--- a/drivers/ps3/ps3stor_lib.c ++++ b/drivers/ps3/ps3stor_lib.c +@@ -23,6 +23,65 @@ + #include + #include + ++/* ++ * A workaround for flash memory I/O errors when the internal hard disk ++ * has not been formatted for OtherOS use. Delay disk close until flash ++ * memory is closed. ++ */ ++ ++static struct ps3_flash_workaround { ++ int flash_open; ++ int disk_open; ++ struct ps3_system_bus_device *disk_sbd; ++} ps3_flash_workaround; ++ ++static int ps3stor_open_hv_device(struct ps3_system_bus_device *sbd) ++{ ++ int error = ps3_open_hv_device(sbd); ++ ++ if (error) ++ return error; ++ ++ if (sbd->match_id == PS3_MATCH_ID_STOR_FLASH) ++ ps3_flash_workaround.flash_open = 1; ++ ++ if (sbd->match_id == PS3_MATCH_ID_STOR_DISK) ++ ps3_flash_workaround.disk_open = 1; ++ ++ return 0; ++} ++ ++static int ps3stor_close_hv_device(struct ps3_system_bus_device *sbd) ++{ ++ int error; ++ ++ if (sbd->match_id == PS3_MATCH_ID_STOR_DISK ++ && ps3_flash_workaround.disk_open ++ && ps3_flash_workaround.flash_open) { ++ ps3_flash_workaround.disk_sbd = sbd; ++ return 0; ++ } ++ ++ error = ps3_close_hv_device(sbd); ++ ++ if (error) ++ return error; ++ ++ if (sbd->match_id == PS3_MATCH_ID_STOR_DISK) ++ ps3_flash_workaround.disk_open = 0; ++ ++ if (sbd->match_id == PS3_MATCH_ID_STOR_FLASH) { ++ ps3_flash_workaround.flash_open = 0; ++ ++ if (ps3_flash_workaround.disk_sbd) { ++ ps3_close_hv_device(ps3_flash_workaround.disk_sbd); ++ ps3_flash_workaround.disk_open = 0; ++ ps3_flash_workaround.disk_sbd = NULL; ++ } ++ } ++ ++ return 0; ++} + + static int ps3stor_probe_access(struct ps3_storage_device *dev) + { +@@ -90,7 +149,7 @@ int ps3stor_setup(struct ps3_storage_dev + int error, res, alignment; + enum ps3_dma_page_size page_size; + +- error = ps3_open_hv_device(&dev->sbd); ++ error = ps3stor_open_hv_device(&dev->sbd); + if (error) { + dev_err(&dev->sbd.core, + "%s:%u: ps3_open_hv_device failed %d\n", __func__, +@@ -166,7 +225,7 @@ fail_free_irq: + fail_sb_event_receive_port_destroy: + ps3_sb_event_receive_port_destroy(&dev->sbd, dev->irq); + fail_close_device: +- ps3_close_hv_device(&dev->sbd); ++ ps3stor_close_hv_device(&dev->sbd); + fail: + return error; + } +@@ -193,7 +252,7 @@ void ps3stor_teardown(struct ps3_storage + "%s:%u: destroy event receive port failed %d\n", + __func__, __LINE__, error); + +- error = ps3_close_hv_device(&dev->sbd); ++ error = ps3stor_close_hv_device(&dev->sbd); + if (error) + dev_err(&dev->sbd.core, + "%s:%u: ps3_close_hv_device failed %d\n", __func__, + + +From gregkh@mini.kroah.org Wed Sep 16 15:37:16 2009 +Message-Id: <20090916223716.166513955@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Sep 2009 15:36:33 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jens Axboe +Subject: [patch 20/45] block: dont assume device has a request list backing in nr_requests store +References: <20090916223613.597295240@mini.kroah.org> +Content-Disposition: inline; filename=block-don-t-assume-device-has-a-request-list-backing-in-nr_requests-store.patch +Content-Length: 899 +Lines: 38 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Jens Axboe + +commit b8a9ae779f2c7049071034661e09cb7e1e82250c upstream. + +Stacked devices do not. For now, just error out with -EINVAL. Later +we could make the limit apply on stacked devices too, for throttling +reasons. + +This fixes + +5a54cd13353bb3b88887604e2c980aa01e314309 + +and should go into 2.6.31 stable as well. + +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman + +--- + block/blk-sysfs.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/block/blk-sysfs.c ++++ b/block/blk-sysfs.c +@@ -40,7 +40,12 @@ queue_requests_store(struct request_queu + { + struct request_list *rl = &q->rq; + unsigned long nr; +- int ret = queue_var_store(&nr, page, count); ++ int ret; ++ ++ if (!q->request_fn) ++ return -EINVAL; ++ ++ ret = queue_var_store(&nr, page, count); + if (nr < BLKDEV_MIN_RQ) + nr = BLKDEV_MIN_RQ; + + + +From gregkh@mini.kroah.org Wed Sep 16 15:37:16 2009 +Message-Id: <20090916223716.291883593@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Sep 2009 15:36:34 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Alan Stern , + Zhenyu Wang , + Dave Airlie +Subject: [patch 21/45] agp/intel: remove restore in resume +References: <20090916223613.597295240@mini.kroah.org> +Content-Disposition: inline; filename=agp-intel-remove-restore-in-resume.patch +Content-Length: 1296 +Lines: 39 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Zhenyu Wang + +commit 121264827656f5f06328b17983c796af17dc5949 upstream. + +As early pci resume has already restored config for host +bridge and graphics device, don't need to restore it again, +This removes an original order hack for graphics device restore. + +This fixed the resume hang issue found by Alan Stern on 845G, +caused by extra config restore on graphics device. + +Cc: Alan Stern +Signed-off-by: Zhenyu Wang +Signed-off-by: Dave Airlie +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/char/agp/intel-agp.c | 9 --------- + 1 file changed, 9 deletions(-) + +--- a/drivers/char/agp/intel-agp.c ++++ b/drivers/char/agp/intel-agp.c +@@ -2313,15 +2313,6 @@ static int agp_intel_resume(struct pci_d + struct agp_bridge_data *bridge = pci_get_drvdata(pdev); + int ret_val; + +- pci_restore_state(pdev); +- +- /* We should restore our graphics device's config space, +- * as host bridge (00:00) resumes before graphics device (02:00), +- * then our access to its pci space can work right. +- */ +- if (intel_private.pcidev) +- pci_restore_state(intel_private.pcidev); +- + if (bridge->driver == &intel_generic_driver) + intel_configure(); + else if (bridge->driver == &intel_850_driver) + + +From gregkh@mini.kroah.org Wed Sep 16 15:37:16 2009 +Message-Id: <20090916223716.463198391@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Sep 2009 15:36:35 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Sophie Hamilton , + Takashi Iwai +Subject: [patch 22/45] ALSA: cs46xx - Fix minimum period size +References: <20090916223613.597295240@mini.kroah.org> +Content-Disposition: inline; filename=alsa-cs46xx-fix-minimum-period-size.patch +Content-Length: 820 +Lines: 28 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Sophie Hamilton + +commit 6148b130eb84edc76e4fa88da1877b27be6c2f06 upstream. + +Fix minimum period size for cs46xx cards. This fixes a problem in the +case where neither a period size nor a buffer size is passed to ALSA; +this is the case in Audacious, OpenAL, and others. + +Signed-off-by: Sophie Hamilton +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/cs46xx/cs46xx_lib.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/pci/cs46xx/cs46xx_lib.h ++++ b/sound/pci/cs46xx/cs46xx_lib.h +@@ -35,7 +35,7 @@ + + + #ifdef CONFIG_SND_CS46XX_NEW_DSP +-#define CS46XX_MIN_PERIOD_SIZE 1 ++#define CS46XX_MIN_PERIOD_SIZE 64 + #define CS46XX_MAX_PERIOD_SIZE 1024*1024 + #else + #define CS46XX_MIN_PERIOD_SIZE 2048 + + +From gregkh@mini.kroah.org Wed Sep 16 15:37:16 2009 +Message-Id: <20090916223716.611135827@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Sep 2009 15:36:36 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Mark Brown +Subject: [patch 23/45] ASoC: Fix WM835x Out4 capture enumeration +References: <20090916223613.597295240@mini.kroah.org> +Content-Disposition: inline; filename=asoc-fix-wm835x-out4-capture-enumeration.patch +Content-Length: 803 +Lines: 26 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Mark Brown + +commit 87831cb660954356d68cebdb1406f3be09e784e9 upstream. + +It's the 8th enum of a zero indexed array. This is why I don't let +new drivers use these arrays of enums... + +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/codecs/wm8350.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/soc/codecs/wm8350.c ++++ b/sound/soc/codecs/wm8350.c +@@ -613,7 +613,7 @@ SOC_DAPM_SINGLE("Switch", WM8350_BEEP_VO + + /* Out4 Capture Mux */ + static const struct snd_kcontrol_new wm8350_out4_capture_controls = +-SOC_DAPM_ENUM("Route", wm8350_enum[8]); ++SOC_DAPM_ENUM("Route", wm8350_enum[7]); + + static const struct snd_soc_dapm_widget wm8350_dapm_widgets[] = { + + + +From gregkh@mini.kroah.org Wed Sep 16 15:37:16 2009 +Message-Id: <20090916223716.768405051@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Sep 2009 15:36:37 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Clemens Ladisch , + Takashi Iwai +Subject: [patch 24/45] sound: oxygen: work around MCE when changing volume +References: <20090916223613.597295240@mini.kroah.org> +Content-Disposition: inline; filename=sound-oxygen-work-around-mce-when-changing-volume.patch +Content-Length: 1498 +Lines: 45 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Clemens Ladisch + +commit f1bc07af9a9edc5c1d4bdd971f7099316ed2e405 upstream. + +When the volume is changed continuously (e.g., when the user drags a +volume slider with the mouse), the driver does lots of I2C writes. +Apparently, the sound chip can get confused when we poll the I2C status +register too much, and fails to complete a read from it. On the PCI-E +models, the PCI-E/PCI bridge gets upset by this and generates a machine +check exception. + +To avoid this, this patch replaces the polling with an unconditional +wait that is guaranteed to be long enough. + +Signed-off-by: Clemens Ladisch +Tested-by: Johann Messner +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/oxygen/oxygen_io.c | 11 +---------- + 1 file changed, 1 insertion(+), 10 deletions(-) + +--- a/sound/pci/oxygen/oxygen_io.c ++++ b/sound/pci/oxygen/oxygen_io.c +@@ -215,17 +215,8 @@ EXPORT_SYMBOL(oxygen_write_spi); + + void oxygen_write_i2c(struct oxygen *chip, u8 device, u8 map, u8 data) + { +- unsigned long timeout; +- + /* should not need more than about 300 us */ +- timeout = jiffies + msecs_to_jiffies(1); +- do { +- if (!(oxygen_read16(chip, OXYGEN_2WIRE_BUS_STATUS) +- & OXYGEN_2WIRE_BUSY)) +- break; +- udelay(1); +- cond_resched(); +- } while (time_after_eq(timeout, jiffies)); ++ msleep(1); + + oxygen_write8(chip, OXYGEN_2WIRE_MAP, map); + oxygen_write8(chip, OXYGEN_2WIRE_DATA, data); + + +From gregkh@mini.kroah.org Wed Sep 16 15:37:17 2009 +Message-Id: <20090916223716.909441419@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Sep 2009 15:36:38 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Roland Dreier +Subject: [patch 25/45] mlx4_core: Allocate and map sufficient ICM memory for EQ context +References: <20090916223613.597295240@mini.kroah.org> +Content-Disposition: inline; filename=mlx4_core-allocate-and-map-sufficient-icm-memory-for-eq-context.patch +Content-Length: 5008 +Lines: 144 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Roland Dreier + +commit fa0681d2129732027355d6b7083dd8932b9b799d upstream. + +The current implementation allocates a single host page for EQ context +memory, which was OK when we only allocated a few EQs. However, since +we now allocate an EQ for each CPU core, this patch removes the +hard-coded limit (which we exceed with 4 KB pages and 128 byte EQ +context entries with 32 CPUs) and uses the same ICM table code as all +other context tables, which ends up simplifying the code quite a bit +while fixing the problem. + +This problem was actually hit in practice on a dual-socket Nehalem box +with 16 real hardware threads and sufficiently odd ACPI tables that it +shows on boot + + SMP: Allowing 32 CPUs, 16 hotplug CPUs + +so num_possible_cpus() ends up 32, and mlx4 ends up creating 33 MSI-X +interrupts and 33 EQs. This mlx4 bug means that mlx4 can't even +initialize at all on this quite mainstream system. + +Reported-by: Eli Cohen +Tested-by: Christoph Lameter +Signed-off-by: Roland Dreier +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/mlx4/eq.c | 42 ------------------------------------------ + drivers/net/mlx4/main.c | 9 ++++++--- + drivers/net/mlx4/mlx4.h | 7 +------ + 3 files changed, 7 insertions(+), 51 deletions(-) + +--- a/drivers/net/mlx4/eq.c ++++ b/drivers/net/mlx4/eq.c +@@ -526,48 +526,6 @@ static void mlx4_unmap_clr_int(struct ml + iounmap(priv->clr_base); + } + +-int mlx4_map_eq_icm(struct mlx4_dev *dev, u64 icm_virt) +-{ +- struct mlx4_priv *priv = mlx4_priv(dev); +- int ret; +- +- /* +- * We assume that mapping one page is enough for the whole EQ +- * context table. This is fine with all current HCAs, because +- * we only use 32 EQs and each EQ uses 64 bytes of context +- * memory, or 1 KB total. +- */ +- priv->eq_table.icm_virt = icm_virt; +- priv->eq_table.icm_page = alloc_page(GFP_HIGHUSER); +- if (!priv->eq_table.icm_page) +- return -ENOMEM; +- priv->eq_table.icm_dma = pci_map_page(dev->pdev, priv->eq_table.icm_page, 0, +- PAGE_SIZE, PCI_DMA_BIDIRECTIONAL); +- if (pci_dma_mapping_error(dev->pdev, priv->eq_table.icm_dma)) { +- __free_page(priv->eq_table.icm_page); +- return -ENOMEM; +- } +- +- ret = mlx4_MAP_ICM_page(dev, priv->eq_table.icm_dma, icm_virt); +- if (ret) { +- pci_unmap_page(dev->pdev, priv->eq_table.icm_dma, PAGE_SIZE, +- PCI_DMA_BIDIRECTIONAL); +- __free_page(priv->eq_table.icm_page); +- } +- +- return ret; +-} +- +-void mlx4_unmap_eq_icm(struct mlx4_dev *dev) +-{ +- struct mlx4_priv *priv = mlx4_priv(dev); +- +- mlx4_UNMAP_ICM(dev, priv->eq_table.icm_virt, 1); +- pci_unmap_page(dev->pdev, priv->eq_table.icm_dma, PAGE_SIZE, +- PCI_DMA_BIDIRECTIONAL); +- __free_page(priv->eq_table.icm_page); +-} +- + int mlx4_alloc_eq_table(struct mlx4_dev *dev) + { + struct mlx4_priv *priv = mlx4_priv(dev); +--- a/drivers/net/mlx4/main.c ++++ b/drivers/net/mlx4/main.c +@@ -525,7 +525,10 @@ static int mlx4_init_icm(struct mlx4_dev + goto err_unmap_aux; + } + +- err = mlx4_map_eq_icm(dev, init_hca->eqc_base); ++ err = mlx4_init_icm_table(dev, &priv->eq_table.table, ++ init_hca->eqc_base, dev_cap->eqc_entry_sz, ++ dev->caps.num_eqs, dev->caps.num_eqs, ++ 0, 0); + if (err) { + mlx4_err(dev, "Failed to map EQ context memory, aborting.\n"); + goto err_unmap_cmpt; +@@ -668,7 +671,7 @@ err_unmap_mtt: + mlx4_cleanup_icm_table(dev, &priv->mr_table.mtt_table); + + err_unmap_eq: +- mlx4_unmap_eq_icm(dev); ++ mlx4_cleanup_icm_table(dev, &priv->eq_table.table); + + err_unmap_cmpt: + mlx4_cleanup_icm_table(dev, &priv->eq_table.cmpt_table); +@@ -698,11 +701,11 @@ static void mlx4_free_icms(struct mlx4_d + mlx4_cleanup_icm_table(dev, &priv->qp_table.qp_table); + mlx4_cleanup_icm_table(dev, &priv->mr_table.dmpt_table); + mlx4_cleanup_icm_table(dev, &priv->mr_table.mtt_table); ++ mlx4_cleanup_icm_table(dev, &priv->eq_table.table); + mlx4_cleanup_icm_table(dev, &priv->eq_table.cmpt_table); + mlx4_cleanup_icm_table(dev, &priv->cq_table.cmpt_table); + mlx4_cleanup_icm_table(dev, &priv->srq_table.cmpt_table); + mlx4_cleanup_icm_table(dev, &priv->qp_table.cmpt_table); +- mlx4_unmap_eq_icm(dev); + + mlx4_UNMAP_ICM_AUX(dev); + mlx4_free_icm(dev, priv->fw.aux_icm, 0); +--- a/drivers/net/mlx4/mlx4.h ++++ b/drivers/net/mlx4/mlx4.h +@@ -205,9 +205,7 @@ struct mlx4_eq_table { + void __iomem **uar_map; + u32 clr_mask; + struct mlx4_eq *eq; +- u64 icm_virt; +- struct page *icm_page; +- dma_addr_t icm_dma; ++ struct mlx4_icm_table table; + struct mlx4_icm_table cmpt_table; + int have_irq; + u8 inta_pin; +@@ -373,9 +371,6 @@ u64 mlx4_make_profile(struct mlx4_dev *d + struct mlx4_dev_cap *dev_cap, + struct mlx4_init_hca_param *init_hca); + +-int mlx4_map_eq_icm(struct mlx4_dev *dev, u64 icm_virt); +-void mlx4_unmap_eq_icm(struct mlx4_dev *dev); +- + int mlx4_cmd_init(struct mlx4_dev *dev); + void mlx4_cmd_cleanup(struct mlx4_dev *dev); + void mlx4_cmd_event(struct mlx4_dev *dev, u16 token, u8 status, u64 out_param); + + +From gregkh@mini.kroah.org Wed Sep 16 15:37:17 2009 +Message-Id: <20090916223717.042342662@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Sep 2009 15:36:39 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Peter Zijlstra , + Ingo Molnar +Subject: [patch 26/45] perf stat: Change noise calculation to use stddev +References: <20090916223613.597295240@mini.kroah.org> +Content-Disposition: inline; filename=perf-stat-change-noise-calculation-to-use-stddev.patch +Content-Length: 8549 +Lines: 286 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Peter Zijlstra + +commit 506d4bc8d5dab20d84624aa07cdc6dcd77915d52 upstream. + +The current noise computation does: + + \Sum abs(n_i - avg(n)) * N^-1.5 + +Which is (afaik) not a regular noise function, and needs the +complete sample set available to post-process. + +Change this to use a regular stddev computation which can be +done by keeping a two sums: + + stddev = sqrt( 1/N (\Sum n_i^2) - avg(n)^2 ) + +For which we only need to keep \Sum n_i and \Sum n_i^2. + +Signed-off-by: Peter Zijlstra +Cc: +LKML-Reference: +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + tools/perf/builtin-stat.c | 170 ++++++++++++++++++---------------------------- + 1 file changed, 69 insertions(+), 101 deletions(-) + +--- a/tools/perf/builtin-stat.c ++++ b/tools/perf/builtin-stat.c +@@ -82,19 +82,32 @@ static u64 runtime_cycles[MAX_RUN]; + static u64 event_res[MAX_RUN][MAX_COUNTERS][3]; + static u64 event_scaled[MAX_RUN][MAX_COUNTERS]; + +-static u64 event_res_avg[MAX_COUNTERS][3]; +-static u64 event_res_noise[MAX_COUNTERS][3]; ++struct stats ++{ ++ double sum; ++ double sum_sq; ++}; + +-static u64 event_scaled_avg[MAX_COUNTERS]; ++static double avg_stats(struct stats *stats) ++{ ++ return stats->sum / run_count; ++} + +-static u64 runtime_nsecs_avg; +-static u64 runtime_nsecs_noise; ++/* ++ * stddev = sqrt(1/N (\Sum n_i^2) - avg(n)^2) ++ */ ++static double stddev_stats(struct stats *stats) ++{ ++ double avg = stats->sum / run_count; + +-static u64 walltime_nsecs_avg; +-static u64 walltime_nsecs_noise; ++ return sqrt(stats->sum_sq/run_count - avg*avg); ++} + +-static u64 runtime_cycles_avg; +-static u64 runtime_cycles_noise; ++struct stats event_res_stats[MAX_COUNTERS][3]; ++struct stats event_scaled_stats[MAX_COUNTERS]; ++struct stats runtime_nsecs_stats; ++struct stats walltime_nsecs_stats; ++struct stats runtime_cycles_stats; + + #define MATCH_EVENT(t, c, counter) \ + (attrs[counter].type == PERF_TYPE_##t && \ +@@ -278,42 +291,37 @@ static int run_perf_stat(int argc __used + return WEXITSTATUS(status); + } + +-static void print_noise(u64 *count, u64 *noise) ++static void print_noise(double avg, double stddev) + { + if (run_count > 1) +- fprintf(stderr, " ( +- %7.3f%% )", +- (double)noise[0]/(count[0]+1)*100.0); ++ fprintf(stderr, " ( +- %7.3f%% )", 100*stddev / avg); + } + +-static void nsec_printout(int counter, u64 *count, u64 *noise) ++static void nsec_printout(int counter, double avg, double stddev) + { +- double msecs = (double)count[0] / 1000000; ++ double msecs = avg / 1e6; + + fprintf(stderr, " %14.6f %-24s", msecs, event_name(counter)); + + if (MATCH_EVENT(SOFTWARE, SW_TASK_CLOCK, counter)) { +- if (walltime_nsecs_avg) +- fprintf(stderr, " # %10.3f CPUs ", +- (double)count[0] / (double)walltime_nsecs_avg); ++ fprintf(stderr, " # %10.3f CPUs ", ++ avg / avg_stats(&walltime_nsecs_stats)); + } +- print_noise(count, noise); ++ print_noise(avg, stddev); + } + +-static void abs_printout(int counter, u64 *count, u64 *noise) ++static void abs_printout(int counter, double avg, double stddev) + { +- fprintf(stderr, " %14Ld %-24s", count[0], event_name(counter)); ++ fprintf(stderr, " %14.0f %-24s", avg, event_name(counter)); + +- if (runtime_cycles_avg && +- MATCH_EVENT(HARDWARE, HW_INSTRUCTIONS, counter)) { ++ if (MATCH_EVENT(HARDWARE, HW_INSTRUCTIONS, counter)) { + fprintf(stderr, " # %10.3f IPC ", +- (double)count[0] / (double)runtime_cycles_avg); ++ avg / avg_stats(&runtime_cycles_stats)); + } else { +- if (runtime_nsecs_avg) { +- fprintf(stderr, " # %10.3f M/sec", +- (double)count[0]/runtime_nsecs_avg*1000.0); +- } ++ fprintf(stderr, " # %10.3f M/sec", ++ 1000.0 * avg / avg_stats(&runtime_nsecs_stats)); + } +- print_noise(count, noise); ++ print_noise(avg, stddev); + } + + /* +@@ -321,12 +329,12 @@ static void abs_printout(int counter, u6 + */ + static void print_counter(int counter) + { +- u64 *count, *noise; ++ double avg, stddev; + int scaled; + +- count = event_res_avg[counter]; +- noise = event_res_noise[counter]; +- scaled = event_scaled_avg[counter]; ++ avg = avg_stats(&event_res_stats[counter][0]); ++ stddev = stddev_stats(&event_res_stats[counter][0]); ++ scaled = avg_stats(&event_scaled_stats[counter]); + + if (scaled == -1) { + fprintf(stderr, " %14s %-24s\n", +@@ -335,36 +343,34 @@ static void print_counter(int counter) + } + + if (nsec_counter(counter)) +- nsec_printout(counter, count, noise); ++ nsec_printout(counter, avg, stddev); + else +- abs_printout(counter, count, noise); ++ abs_printout(counter, avg, stddev); ++ ++ if (scaled) { ++ double avg_enabled, avg_running; ++ ++ avg_enabled = avg_stats(&event_res_stats[counter][1]); ++ avg_running = avg_stats(&event_res_stats[counter][2]); + +- if (scaled) + fprintf(stderr, " (scaled from %.2f%%)", +- (double) count[2] / count[1] * 100); ++ 100 * avg_running / avg_enabled); ++ } + + fprintf(stderr, "\n"); + } + +-/* +- * normalize_noise noise values down to stddev: +- */ +-static void normalize_noise(u64 *val) ++static void update_stats(const char *name, int idx, struct stats *stats, u64 *val) + { +- double res; ++ double sq = *val; + +- res = (double)*val / (run_count * sqrt((double)run_count)); +- +- *val = (u64)res; +-} +- +-static void update_avg(const char *name, int idx, u64 *avg, u64 *val) +-{ +- *avg += *val; ++ stats->sum += *val; ++ stats->sum_sq += sq * sq; + + if (verbose > 1) + fprintf(stderr, "debug: %20s[%d]: %Ld\n", name, idx, *val); + } ++ + /* + * Calculate the averages and noises: + */ +@@ -376,61 +382,22 @@ static void calc_avg(void) + fprintf(stderr, "\n"); + + for (i = 0; i < run_count; i++) { +- update_avg("runtime", 0, &runtime_nsecs_avg, runtime_nsecs + i); +- update_avg("walltime", 0, &walltime_nsecs_avg, walltime_nsecs + i); +- update_avg("runtime_cycles", 0, &runtime_cycles_avg, runtime_cycles + i); ++ update_stats("runtime", 0, &runtime_nsecs_stats, runtime_nsecs + i); ++ update_stats("walltime", 0, &walltime_nsecs_stats, walltime_nsecs + i); ++ update_stats("runtime_cycles", 0, &runtime_cycles_stats, runtime_cycles + i); + + for (j = 0; j < nr_counters; j++) { +- update_avg("counter/0", j, +- event_res_avg[j]+0, event_res[i][j]+0); +- update_avg("counter/1", j, +- event_res_avg[j]+1, event_res[i][j]+1); +- update_avg("counter/2", j, +- event_res_avg[j]+2, event_res[i][j]+2); ++ update_stats("counter/0", j, ++ event_res_stats[j]+0, event_res[i][j]+0); ++ update_stats("counter/1", j, ++ event_res_stats[j]+1, event_res[i][j]+1); ++ update_stats("counter/2", j, ++ event_res_stats[j]+2, event_res[i][j]+2); + if (event_scaled[i][j] != (u64)-1) +- update_avg("scaled", j, +- event_scaled_avg + j, event_scaled[i]+j); +- else +- event_scaled_avg[j] = -1; +- } +- } +- runtime_nsecs_avg /= run_count; +- walltime_nsecs_avg /= run_count; +- runtime_cycles_avg /= run_count; +- +- for (j = 0; j < nr_counters; j++) { +- event_res_avg[j][0] /= run_count; +- event_res_avg[j][1] /= run_count; +- event_res_avg[j][2] /= run_count; +- } +- +- for (i = 0; i < run_count; i++) { +- runtime_nsecs_noise += +- abs((s64)(runtime_nsecs[i] - runtime_nsecs_avg)); +- walltime_nsecs_noise += +- abs((s64)(walltime_nsecs[i] - walltime_nsecs_avg)); +- runtime_cycles_noise += +- abs((s64)(runtime_cycles[i] - runtime_cycles_avg)); +- +- for (j = 0; j < nr_counters; j++) { +- event_res_noise[j][0] += +- abs((s64)(event_res[i][j][0] - event_res_avg[j][0])); +- event_res_noise[j][1] += +- abs((s64)(event_res[i][j][1] - event_res_avg[j][1])); +- event_res_noise[j][2] += +- abs((s64)(event_res[i][j][2] - event_res_avg[j][2])); ++ update_stats("scaled", j, ++ event_scaled_stats + j, event_scaled[i]+j); + } + } +- +- normalize_noise(&runtime_nsecs_noise); +- normalize_noise(&walltime_nsecs_noise); +- normalize_noise(&runtime_cycles_noise); +- +- for (j = 0; j < nr_counters; j++) { +- normalize_noise(&event_res_noise[j][0]); +- normalize_noise(&event_res_noise[j][1]); +- normalize_noise(&event_res_noise[j][2]); +- } + } + + static void print_stat(int argc, const char **argv) +@@ -457,10 +424,11 @@ static void print_stat(int argc, const c + + fprintf(stderr, "\n"); + fprintf(stderr, " %14.9f seconds time elapsed", +- (double)walltime_nsecs_avg/1e9); ++ avg_stats(&walltime_nsecs_stats)/1e9); + if (run_count > 1) { + fprintf(stderr, " ( +- %7.3f%% )", +- 100.0*(double)walltime_nsecs_noise/(double)walltime_nsecs_avg); ++ 100*stddev_stats(&walltime_nsecs_stats) / ++ avg_stats(&walltime_nsecs_stats)); + } + fprintf(stderr, "\n\n"); + } + + +From gregkh@mini.kroah.org Wed Sep 16 15:37:17 2009 +Message-Id: <20090916223717.186277850@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Sep 2009 15:36:40 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Roel Kluin , + Ingo Molnar +Subject: [patch 27/45] x86: Fix x86_model test in es7000_apic_is_cluster() +References: <20090916223613.597295240@mini.kroah.org> +Content-Disposition: inline; filename=x86-fix-x86_model-test-in-es7000_apic_is_cluster.patch +Content-Length: 831 +Lines: 28 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Roel Kluin + +commit 005155b1f626d2b2d7932e4afdf4fead168c6888 upstream. + +For the x86_model to be greater than 6 or less than 12 is +logically always true. + +Signed-off-by: Roel Kluin +Cc: Andrew Morton +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/apic/es7000_32.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/x86/kernel/apic/es7000_32.c ++++ b/arch/x86/kernel/apic/es7000_32.c +@@ -167,7 +167,7 @@ static int es7000_apic_is_cluster(void) + { + /* MPENTIUMIII */ + if (boot_cpu_data.x86 == 6 && +- (boot_cpu_data.x86_model >= 7 || boot_cpu_data.x86_model <= 11)) ++ (boot_cpu_data.x86_model >= 7 && boot_cpu_data.x86_model <= 11)) + return 1; + + return 0; + + +From gregkh@mini.kroah.org Wed Sep 16 15:37:17 2009 +Message-Id: <20090916223717.345216913@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Sep 2009 15:36:41 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jeremy Fitzhardinge , + Ingo Molnar +Subject: [patch 28/45] x86/i386: Make sure stack-protector segment base is cache aligned +References: <20090916223613.597295240@mini.kroah.org> +Content-Disposition: inline; filename=x86-i386-make-sure-stack-protector-segment-base-is-cache-aligned.patch +Content-Length: 3976 +Lines: 108 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Jeremy Fitzhardinge + +commit 1ea0d14e480c245683927eecc03a70faf06e80c8 upstream. + +The Intel Optimization Reference Guide says: + + In Intel Atom microarchitecture, the address generation unit + assumes that the segment base will be 0 by default. Non-zero + segment base will cause load and store operations to experience + a delay. + - If the segment base isn't aligned to a cache line + boundary, the max throughput of memory operations is + reduced to one [e]very 9 cycles. + [...] + Assembly/Compiler Coding Rule 15. (H impact, ML generality) + For Intel Atom processors, use segments with base set to 0 + whenever possible; avoid non-zero segment base address that is + not aligned to cache line boundary at all cost. + +We can't avoid having a non-zero base for the stack-protector +segment, but we can make it cache-aligned. + +Signed-off-by: Jeremy Fitzhardinge +LKML-Reference: <4AA01893.6000507@goop.org> +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/include/asm/processor.h | 12 +++++++++++- + arch/x86/include/asm/stackprotector.h | 4 ++-- + arch/x86/include/asm/system.h | 2 +- + arch/x86/kernel/cpu/common.c | 2 +- + arch/x86/kernel/head_32.S | 1 - + 5 files changed, 15 insertions(+), 6 deletions(-) + +--- a/arch/x86/include/asm/processor.h ++++ b/arch/x86/include/asm/processor.h +@@ -403,7 +403,17 @@ extern unsigned long kernel_eflags; + extern asmlinkage void ignore_sysret(void); + #else /* X86_64 */ + #ifdef CONFIG_CC_STACKPROTECTOR +-DECLARE_PER_CPU(unsigned long, stack_canary); ++/* ++ * Make sure stack canary segment base is cached-aligned: ++ * "For Intel Atom processors, avoid non zero segment base address ++ * that is not aligned to cache line boundary at all cost." ++ * (Optim Ref Manual Assembly/Compiler Coding Rule 15.) ++ */ ++struct stack_canary { ++ char __pad[20]; /* canary at %gs:20 */ ++ unsigned long canary; ++}; ++DECLARE_PER_CPU(struct stack_canary, stack_canary) ____cacheline_aligned; + #endif + #endif /* X86_64 */ + +--- a/arch/x86/include/asm/stackprotector.h ++++ b/arch/x86/include/asm/stackprotector.h +@@ -78,14 +78,14 @@ static __always_inline void boot_init_st + #ifdef CONFIG_X86_64 + percpu_write(irq_stack_union.stack_canary, canary); + #else +- percpu_write(stack_canary, canary); ++ percpu_write(stack_canary.canary, canary); + #endif + } + + static inline void setup_stack_canary_segment(int cpu) + { + #ifdef CONFIG_X86_32 +- unsigned long canary = (unsigned long)&per_cpu(stack_canary, cpu) - 20; ++ unsigned long canary = (unsigned long)&per_cpu(stack_canary, cpu); + struct desc_struct *gdt_table = get_cpu_gdt_table(cpu); + struct desc_struct desc; + +--- a/arch/x86/include/asm/system.h ++++ b/arch/x86/include/asm/system.h +@@ -31,7 +31,7 @@ void __switch_to_xtra(struct task_struct + "movl %P[task_canary](%[next]), %%ebx\n\t" \ + "movl %%ebx, "__percpu_arg([stack_canary])"\n\t" + #define __switch_canary_oparam \ +- , [stack_canary] "=m" (per_cpu_var(stack_canary)) ++ , [stack_canary] "=m" (per_cpu_var(stack_canary.canary)) + #define __switch_canary_iparam \ + , [task_canary] "i" (offsetof(struct task_struct, stack_canary)) + #else /* CC_STACKPROTECTOR */ +--- a/arch/x86/kernel/cpu/common.c ++++ b/arch/x86/kernel/cpu/common.c +@@ -1043,7 +1043,7 @@ DEFINE_PER_CPU(struct orig_ist, orig_ist + #else /* CONFIG_X86_64 */ + + #ifdef CONFIG_CC_STACKPROTECTOR +-DEFINE_PER_CPU(unsigned long, stack_canary); ++DEFINE_PER_CPU(struct stack_canary, stack_canary) ____cacheline_aligned; + #endif + + /* Make sure %fs and %gs are initialized properly in idle threads */ +--- a/arch/x86/kernel/head_32.S ++++ b/arch/x86/kernel/head_32.S +@@ -439,7 +439,6 @@ is386: movl $2,%ecx # set MP + jne 1f + movl $per_cpu__gdt_page,%eax + movl $per_cpu__stack_canary,%ecx +- subl $20, %ecx + movw %cx, 8 * GDT_ENTRY_STACK_CANARY + 2(%eax) + shrl $16, %ecx + movb %cl, 8 * GDT_ENTRY_STACK_CANARY + 4(%eax) + + +From gregkh@mini.kroah.org Wed Sep 16 15:37:17 2009 +Message-Id: <20090916223717.514881842@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Sep 2009 15:36:42 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Tejun Heo , + Peer Chen , + Tj , + Greg KH , + Jesse Barnes +Subject: [patch 29/45] PCI: apply nv_msi_ht_cap_quirk on resume too +References: <20090916223613.597295240@mini.kroah.org> +Content-Disposition: inline; filename=pci-apply-nv_msi_ht_cap_quirk-on-resume-too.patch +Content-Length: 1218 +Lines: 31 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Tejun Heo + +commit 6dab62ee5a3bf4f71b8320c09db2e6022a19f40e upstream. + +http://bugzilla.kernel.org/show_bug.cgi?id=12542 reports that with the +quirk not applied on resume, msi stops working after resuming and mcp78s +ahci fails due to IRQ mis-delivery. Apply it on resume too. + +Signed-off-by: Tejun Heo +Cc: Peer Chen +Cc: Tj +Reported-by: Nicolas Derive +Cc: Greg KH +Signed-off-by: Andrew Morton +Signed-off-by: Jesse Barnes +Signed-off-by: Greg Kroah-Hartman + +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -2383,8 +2383,10 @@ static void __devinit nv_msi_ht_cap_quirk_leaf(struct pci_dev *dev) + } + + DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_NVIDIA, PCI_ANY_ID, nv_msi_ht_cap_quirk_leaf); ++DECLARE_PCI_FIXUP_RESUME_EARLY(PCI_VENDOR_ID_NVIDIA, PCI_ANY_ID, nv_msi_ht_cap_quirk_leaf); + + DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AL, PCI_ANY_ID, nv_msi_ht_cap_quirk_all); ++DECLARE_PCI_FIXUP_RESUME_EARLY(PCI_VENDOR_ID_AL, PCI_ANY_ID, nv_msi_ht_cap_quirk_all); + + static void __devinit quirk_msi_intx_disable_bug(struct pci_dev *dev) + { + + +From gregkh@mini.kroah.org Wed Sep 16 15:37:17 2009 +Message-Id: <20090916223717.644239405@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Sep 2009 15:36:43 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jack Steiner , + Suresh Siddha , + "H. Peter Anvin" +Subject: [patch 30/45] x86, pat: Fix cacheflush address in change_page_attr_set_clr() +References: <20090916223613.597295240@mini.kroah.org> +Content-Disposition: inline; filename=x86-pat-fix-cacheflush-address-in-change_page_attr_set_clr.patch +Content-Length: 1544 +Lines: 53 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Jack Steiner + +commit fa526d0d641b5365676a1fb821ce359e217c9b85 upstream. + +Fix address passed to cpa_flush_range() when changing page +attributes from WB to UC. The address (*addr) is +modified by __change_page_attr_set_clr(). The result is that +the pages being flushed start at the _end_ of the changed range +instead of the beginning. + +This should be considered for 2.6.30-stable and 2.6.31-stable. + +Signed-off-by: Jack Steiner +Acked-by: Suresh Siddha +Signed-off-by: H. Peter Anvin +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/mm/pageattr.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +--- a/arch/x86/mm/pageattr.c ++++ b/arch/x86/mm/pageattr.c +@@ -822,6 +822,7 @@ static int change_page_attr_set_clr(unsi + { + struct cpa_data cpa; + int ret, cache, checkalias; ++ unsigned long baddr = 0; + + /* + * Check, if we are requested to change a not supported +@@ -853,6 +854,11 @@ static int change_page_attr_set_clr(unsi + */ + WARN_ON_ONCE(1); + } ++ /* ++ * Save address for cache flush. *addr is modified in the call ++ * to __change_page_attr_set_clr() below. ++ */ ++ baddr = *addr; + } + + /* Must avoid aliasing mappings in the highmem code */ +@@ -900,7 +906,7 @@ static int change_page_attr_set_clr(unsi + cpa_flush_array(addr, numpages, cache, + cpa.flags, pages); + } else +- cpa_flush_range(*addr, numpages, cache); ++ cpa_flush_range(baddr, numpages, cache); + } else + cpa_flush_all(cache); + + + +From gregkh@mini.kroah.org Wed Sep 16 15:37:17 2009 +Message-Id: <20090916223717.810489941@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Sep 2009 15:36:44 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Nicolas Pitre , + Russell King +Subject: [patch 31/45] ARM: 5691/1: fix cache aliasing issues between kmap() and kmap_atomic() with highmem +References: <20090916223613.597295240@mini.kroah.org> +Content-Disposition: inline; filename=arm-5691-1-fix-cache-aliasing-issues-between-kmap-and-kmap_atomic-with-highmem.patch +Content-Length: 1877 +Lines: 55 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Nicolas Pitre + +commit 7929eb9cf643ae416e5081b2a6fa558d37b9854c upstream. + +Let's suppose a highmem page is kmap'd with kmap(). A pkmap entry is +used, the page mapped to it, and the virtual cache is dirtied. Then +kunmap() is used which does virtually nothing except for decrementing a +usage count. + +Then, let's suppose the _same_ page gets mapped using kmap_atomic(). +It is therefore mapped onto a fixmap entry instead, which has a +different virtual address unaware of the dirty cache data for that page +sitting in the pkmap mapping. + +Fortunately it is easy to know if a pkmap mapping still exists for that +page and use it directly with kmap_atomic(), thanks to kmap_high_get(). + +And actual testing with a printk in the added code path shows that this +condition is actually met *extremely* frequently. Seems that we've been +quite lucky that things have worked so well with highmem so far. + +Signed-off-by: Nicolas Pitre +Signed-off-by: Russell King +Signed-off-by: Greg Kroah-Hartman + +--- a/arch/arm/mm/highmem.c ++++ b/arch/arm/mm/highmem.c +@@ -40,11 +40,16 @@ void *kmap_atomic(struct page *page, enum km_type type) + { + unsigned int idx; + unsigned long vaddr; ++ void *kmap; + + pagefault_disable(); + if (!PageHighMem(page)) + return page_address(page); + ++ kmap = kmap_high_get(page); ++ if (kmap) ++ return kmap; ++ + idx = type + KM_TYPE_NR * smp_processor_id(); + vaddr = __fix_to_virt(FIX_KMAP_BEGIN + idx); + #ifdef CONFIG_DEBUG_HIGHMEM +@@ -80,6 +85,9 @@ void kunmap_atomic(void *kvaddr, enum km_type type) + #else + (void) idx; /* to kill a warning */ + #endif ++ } else if (vaddr >= PKMAP_ADDR(0) && vaddr < PKMAP_ADDR(LAST_PKMAP)) { ++ /* this address was obtained through kmap_high_get() */ ++ kunmap_high(pte_page(pkmap_page_table[PKMAP_NR(vaddr)])); + } + pagefault_enable(); + } + + +From gregkh@mini.kroah.org Wed Sep 16 15:37:18 2009 +Message-Id: <20090916223717.952693286@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Sep 2009 15:36:45 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Marcelo Tosatti , + Avi Kivity +Subject: [patch 32/45] KVM guest: do not batch pte updates from interrupt context +References: <20090916223613.597295240@mini.kroah.org> +Content-Disposition: inline; filename=kvm-guest-do-not-batch-pte-updates-from-interrupt-context.patch +Content-Length: 1760 +Lines: 63 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Marcelo Tosatti + +commit 6ba661787594868512a71c129062ebd57d0c01e7 upstream. + +Commit b8bcfe997e4 made paravirt pte updates synchronous in interrupt +context. + +Unfortunately the KVM pv mmu code caches the lazy/nonlazy mode +internally, so a pte update from interrupt context during a lazy mmu +operation can be batched while it should be performed synchronously. + +https://bugzilla.redhat.com/show_bug.cgi?id=518022 + +Drop the internal mode variable and use paravirt_get_lazy_mode(), which +returns the correct state. + +Signed-off-by: Marcelo Tosatti +Signed-off-by: Avi Kivity +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/kvm.c | 7 +------ + 1 file changed, 1 insertion(+), 6 deletions(-) + +--- a/arch/x86/kernel/kvm.c ++++ b/arch/x86/kernel/kvm.c +@@ -34,7 +34,6 @@ + struct kvm_para_state { + u8 mmu_queue[MMU_QUEUE_SIZE]; + int mmu_queue_len; +- enum paravirt_lazy_mode mode; + }; + + static DEFINE_PER_CPU(struct kvm_para_state, para_state); +@@ -77,7 +76,7 @@ static void kvm_deferred_mmu_op(void *bu + { + struct kvm_para_state *state = kvm_para_state(); + +- if (state->mode != PARAVIRT_LAZY_MMU) { ++ if (paravirt_get_lazy_mode() != PARAVIRT_LAZY_MMU) { + kvm_mmu_op(buffer, len); + return; + } +@@ -185,10 +184,7 @@ static void kvm_release_pt(unsigned long + + static void kvm_enter_lazy_mmu(void) + { +- struct kvm_para_state *state = kvm_para_state(); +- + paravirt_enter_lazy_mmu(); +- state->mode = paravirt_get_lazy_mode(); + } + + static void kvm_leave_lazy_mmu(void) +@@ -197,7 +193,6 @@ static void kvm_leave_lazy_mmu(void) + + mmu_queue_flush(state); + paravirt_leave_lazy_mmu(); +- state->mode = paravirt_get_lazy_mode(); + } + + static void __init paravirt_ops_setup(void) + + +From gregkh@mini.kroah.org Wed Sep 16 15:37:18 2009 +Message-Id: <20090916223718.130918299@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Sep 2009 15:36:46 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Gleb Natapov , + Marcelo Tosatti , + Avi Kivity +Subject: [patch 33/45] KVM: Fix coalesced interrupt reporting in IOAPIC +References: <20090916223613.597295240@mini.kroah.org> +Content-Disposition: inline; filename=kvm-fix-coalesced-interrupt-reporting-in-ioapic.patch +Content-Length: 725 +Lines: 27 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Gleb Natapov + +commit 65a82211636f156a276cac3f8665605ae18f371f upstream. + +This bug was introduced by b4a2f5e723e4f7df467. + +Signed-off-by: Gleb Natapov +Signed-off-by: Marcelo Tosatti +Signed-off-by: Avi Kivity +Signed-off-by: Greg Kroah-Hartman + +--- + virt/kvm/ioapic.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/virt/kvm/ioapic.c ++++ b/virt/kvm/ioapic.c +@@ -188,6 +188,8 @@ int kvm_ioapic_set_irq(struct kvm_ioapic + if ((edge && old_irr != ioapic->irr) || + (!edge && !entry.fields.remote_irr)) + ret = ioapic_service(ioapic, irq); ++ else ++ ret = 0; /* report coalesced interrupt */ + } + } + return ret; + + +From gregkh@mini.kroah.org Wed Sep 16 15:37:18 2009 +Message-Id: <20090916223718.283870494@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Sep 2009 15:36:47 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Avi Kivity , + Marcelo Tosatti +Subject: [patch 34/45] KVM: VMX: Check cpl before emulating debug register access +References: <20090916223613.597295240@mini.kroah.org> +Content-Disposition: inline; filename=kvm-vmx-check-cpl-before-emulating-debug-register-access.patch +Content-Length: 1905 +Lines: 62 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Avi Kivity + +commit 0a79b009525b160081d75cef5dbf45817956acf2 upstream. + +Debug registers may only be accessed from cpl 0. Unfortunately, vmx will +code to emulate the instruction even though it was issued from guest +userspace, possibly leading to an unexpected trap later. + +Signed-off-by: Avi Kivity +Signed-off-by: Marcelo Tosatti +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/include/asm/kvm_host.h | 1 + + arch/x86/kvm/vmx.c | 2 ++ + arch/x86/kvm/x86.c | 13 +++++++++++++ + 3 files changed, 16 insertions(+) + +--- a/arch/x86/include/asm/kvm_host.h ++++ b/arch/x86/include/asm/kvm_host.h +@@ -618,6 +618,7 @@ void kvm_queue_exception(struct kvm_vcpu + void kvm_queue_exception_e(struct kvm_vcpu *vcpu, unsigned nr, u32 error_code); + void kvm_inject_page_fault(struct kvm_vcpu *vcpu, unsigned long cr2, + u32 error_code); ++bool kvm_require_cpl(struct kvm_vcpu *vcpu, int required_cpl); + + int kvm_pic_set_irq(void *opaque, int irq, int level); + +--- a/arch/x86/kvm/vmx.c ++++ b/arch/x86/kvm/vmx.c +@@ -2841,6 +2841,8 @@ static int handle_dr(struct kvm_vcpu *vc + unsigned long val; + int dr, reg; + ++ if (!kvm_require_cpl(vcpu, 0)) ++ return 1; + dr = vmcs_readl(GUEST_DR7); + if (dr & DR7_GD) { + /* +--- a/arch/x86/kvm/x86.c ++++ b/arch/x86/kvm/x86.c +@@ -215,6 +215,19 @@ static void __queue_exception(struct kvm + } + + /* ++ * Checks if cpl <= required_cpl; if true, return true. Otherwise queue ++ * a #GP and return false. ++ */ ++bool kvm_require_cpl(struct kvm_vcpu *vcpu, int required_cpl) ++{ ++ if (kvm_x86_ops->get_cpl(vcpu) <= required_cpl) ++ return true; ++ kvm_queue_exception_e(vcpu, GP_VECTOR, 0); ++ return false; ++} ++EXPORT_SYMBOL_GPL(kvm_require_cpl); ++ ++/* + * Load the pae pdptrs. Return true is they are all valid. + */ + int load_pdptrs(struct kvm_vcpu *vcpu, unsigned long cr3) + + +From gregkh@mini.kroah.org Wed Sep 16 15:37:18 2009 +Message-Id: <20090916223718.433647359@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Sep 2009 15:36:48 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Glauber Costa , + Avi Kivity +Subject: [patch 35/45] KVM guest: fix bogus wallclock physical address calculation +References: <20090916223613.597295240@mini.kroah.org> +Content-Disposition: inline; filename=kvm-guest-fix-bogus-wallclock-physical-address-calculation.patch +Content-Length: 1127 +Lines: 34 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Glauber Costa + +commit a20316d2aa41a8f4fd171648bad8f044f6060826 upstream. + +The use of __pa() to calculate the address of a C-visible symbol +is wrong, and can lead to unpredictable results. See arch/x86/include/asm/page.h +for details. + +It should be replaced with __pa_symbol(), that does the correct math here, +by taking relocations into account. This ensures the correct wallclock data +structure physical address is passed to the hypervisor. + +Signed-off-by: Glauber Costa +Signed-off-by: Avi Kivity +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/kvmclock.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/x86/kernel/kvmclock.c ++++ b/arch/x86/kernel/kvmclock.c +@@ -50,8 +50,8 @@ static unsigned long kvm_get_wallclock(v + struct timespec ts; + int low, high; + +- low = (int)__pa(&wall_clock); +- high = ((u64)__pa(&wall_clock) >> 32); ++ low = (int)__pa_symbol(&wall_clock); ++ high = ((u64)__pa_symbol(&wall_clock) >> 32); + native_write_msr(MSR_KVM_WALL_CLOCK, low, high); + + vcpu_time = &get_cpu_var(hv_clock); + + +From gregkh@mini.kroah.org Wed Sep 16 15:37:18 2009 +Message-Id: <20090916223718.589833958@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Sep 2009 15:36:49 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jan Kiszka , + Avi Kivity +Subject: [patch 36/45] KVM: x86: Disallow hypercalls for guest callers in rings > 0 +References: <20090916223613.597295240@mini.kroah.org> +Content-Disposition: inline; filename=kvm-x86-disallow-hypercalls-for-guest-callers-in-rings-0.patch +Content-Length: 1537 +Lines: 55 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Jan Kiszka + +commit 07708c4af1346ab1521b26a202f438366b7bcffd upstream. + +So far unprivileged guest callers running in ring 3 can issue, e.g., MMU +hypercalls. Normally, such callers cannot provide any hand-crafted MMU +command structure as it has to be passed by its physical address, but +they can still crash the guest kernel by passing random addresses. + +To close the hole, this patch considers hypercalls valid only if issued +from guest ring 0. This may still be relaxed on a per-hypercall base in +the future once required. + +Signed-off-by: Jan Kiszka +Signed-off-by: Avi Kivity +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kvm/x86.c | 6 ++++++ + include/linux/kvm_para.h | 1 + + 2 files changed, 7 insertions(+) + +--- a/arch/x86/kvm/x86.c ++++ b/arch/x86/kvm/x86.c +@@ -2911,6 +2911,11 @@ int kvm_emulate_hypercall(struct kvm_vcp + a3 &= 0xFFFFFFFF; + } + ++ if (kvm_x86_ops->get_cpl(vcpu) != 0) { ++ ret = -KVM_EPERM; ++ goto out; ++ } ++ + switch (nr) { + case KVM_HC_VAPIC_POLL_IRQ: + ret = 0; +@@ -2922,6 +2927,7 @@ int kvm_emulate_hypercall(struct kvm_vcp + ret = -KVM_ENOSYS; + break; + } ++out: + kvm_register_write(vcpu, VCPU_REGS_RAX, ret); + ++vcpu->stat.hypercalls; + return r; +--- a/include/linux/kvm_para.h ++++ b/include/linux/kvm_para.h +@@ -13,6 +13,7 @@ + #define KVM_ENOSYS 1000 + #define KVM_EFAULT EFAULT + #define KVM_E2BIG E2BIG ++#define KVM_EPERM EPERM + + #define KVM_HC_VAPIC_POLL_IRQ 1 + #define KVM_HC_MMU_OP 2 + + +From gregkh@mini.kroah.org Wed Sep 16 15:37:18 2009 +Message-Id: <20090916223718.746468813@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Sep 2009 15:36:50 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Gleb Natapov , + Avi Kivity +Subject: [patch 37/45] KVM: VMX: Fix cr8 exiting control clobbering by EPT +References: <20090916223613.597295240@mini.kroah.org> +Content-Disposition: inline; filename=kvm-vmx-fix-cr8-exiting-control-clobbering-by-ept.patch +Content-Length: 1262 +Lines: 35 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Gleb Natapov + +commit 5fff7d270bd6a4759b6d663741b729cdee370257 upstream. + +Don't call adjust_vmx_controls() two times for the same control. +It restores options that were dropped earlier. This loses us the cr8 +exit control, which causes a massive performance regression Windows x64. + +Signed-off-by: Gleb Natapov +Signed-off-by: Avi Kivity +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kvm/vmx.c | 9 +++------ + 1 file changed, 3 insertions(+), 6 deletions(-) + +--- a/arch/x86/kvm/vmx.c ++++ b/arch/x86/kvm/vmx.c +@@ -1217,12 +1217,9 @@ static __init int setup_vmcs_config(stru + if (_cpu_based_2nd_exec_control & SECONDARY_EXEC_ENABLE_EPT) { + /* CR3 accesses and invlpg don't need to cause VM Exits when EPT + enabled */ +- min &= ~(CPU_BASED_CR3_LOAD_EXITING | +- CPU_BASED_CR3_STORE_EXITING | +- CPU_BASED_INVLPG_EXITING); +- if (adjust_vmx_controls(min, opt, MSR_IA32_VMX_PROCBASED_CTLS, +- &_cpu_based_exec_control) < 0) +- return -EIO; ++ _cpu_based_exec_control &= ~(CPU_BASED_CR3_LOAD_EXITING | ++ CPU_BASED_CR3_STORE_EXITING | ++ CPU_BASED_INVLPG_EXITING); + rdmsr(MSR_IA32_VMX_EPT_VPID_CAP, + vmx_capability.ept, vmx_capability.vpid); + } + + +From gregkh@mini.kroah.org Wed Sep 16 15:37:19 2009 +Message-Id: <20090916223718.880939612@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Sep 2009 15:36:51 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Avi Kivity +Subject: [patch 38/45] KVM: x86 emulator: Implement zero-extended immediate decoding +References: <20090916223613.597295240@mini.kroah.org> +Content-Disposition: inline; filename=kvm-x86-emulator-implement-zero-extended-immediate-decoding.patch +Content-Length: 1366 +Lines: 52 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Avi Kivity + +commit c9eaf20f268c7051bfde2ba212c5ea76a6cbc7a1 upstream. + +Absolute jumps use zero extended immediate operands. + +Signed-off-by: Avi Kivity +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kvm/x86_emulate.c | 15 +++++++++++++++ + 1 file changed, 15 insertions(+) + +--- a/arch/x86/kvm/x86_emulate.c ++++ b/arch/x86/kvm/x86_emulate.c +@@ -60,6 +60,7 @@ + #define SrcImmByte (6<<4) /* 8-bit sign-extended immediate operand. */ + #define SrcOne (7<<4) /* Implied '1' */ + #define SrcImmUByte (8<<4) /* 8-bit unsigned immediate operand. */ ++#define SrcImmU (9<<4) /* Immediate operand, unsigned */ + #define SrcMask (0xf<<4) + /* Generic ModRM decode. */ + #define ModRM (1<<8) +@@ -1027,6 +1028,7 @@ done_prefixes: + c->src.type = OP_MEM; + break; + case SrcImm: ++ case SrcImmU: + c->src.type = OP_IMM; + c->src.ptr = (unsigned long *)c->eip; + c->src.bytes = (c->d & ByteOp) ? 1 : c->op_bytes; +@@ -1044,6 +1046,19 @@ done_prefixes: + c->src.val = insn_fetch(s32, 4, c->eip); + break; + } ++ if ((c->d & SrcMask) == SrcImmU) { ++ switch (c->src.bytes) { ++ case 1: ++ c->src.val &= 0xff; ++ break; ++ case 2: ++ c->src.val &= 0xffff; ++ break; ++ case 4: ++ c->src.val &= 0xffffffff; ++ break; ++ } ++ } + break; + case SrcImmByte: + case SrcImmUByte: + + +From gregkh@mini.kroah.org Wed Sep 16 15:37:19 2009 +Message-Id: <20090916223719.027326510@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Sep 2009 15:36:52 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Izik Eidus , + Marcelo Tosatti , + Avi Kivity +Subject: [patch 39/45] KVM: MMU: make __kvm_mmu_free_some_pages handle empty list +References: <20090916223613.597295240@mini.kroah.org> +Content-Disposition: inline; filename=kvm-mmu-make-__kvm_mmu_free_some_pages-handle-empty-list.patch +Content-Length: 903 +Lines: 29 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Izik Eidus + +commit 3b80fffe2b31fb716d3ebe729c54464ee7856723 upstream. + +First check if the list is empty before attempting to look at list +entries. + +Signed-off-by: Izik Eidus +Signed-off-by: Marcelo Tosatti +Signed-off-by: Avi Kivity +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kvm/mmu.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/arch/x86/kvm/mmu.c ++++ b/arch/x86/kvm/mmu.c +@@ -2633,7 +2633,8 @@ EXPORT_SYMBOL_GPL(kvm_mmu_unprotect_page + + void __kvm_mmu_free_some_pages(struct kvm_vcpu *vcpu) + { +- while (vcpu->kvm->arch.n_free_mmu_pages < KVM_REFILL_PAGES) { ++ while (vcpu->kvm->arch.n_free_mmu_pages < KVM_REFILL_PAGES && ++ !list_empty(&vcpu->kvm->arch.active_mmu_pages)) { + struct kvm_mmu_page *sp; + + sp = container_of(vcpu->kvm->arch.active_mmu_pages.prev, + + +From gregkh@mini.kroah.org Wed Sep 16 15:37:19 2009 +Message-Id: <20090916223719.185046828@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Sep 2009 15:36:53 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Avi Kivity +Subject: [patch 40/45] KVM: x86 emulator: fix jmp far decoding (opcode 0xea) +References: <20090916223613.597295240@mini.kroah.org> +Content-Disposition: inline; filename=kvm-x86-emulator-fix-jmp-far-decoding.patch +Content-Length: 801 +Lines: 25 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Avi Kivity + +commit ee3d29e8bee8d7c321279a9bd9bd25d4cfbf79b7 upstream. + +The jump target should not be sign extened; use an unsigned decode flag. + +Signed-off-by: Avi Kivity +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kvm/x86_emulate.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/x86/kvm/x86_emulate.c ++++ b/arch/x86/kvm/x86_emulate.c +@@ -196,7 +196,7 @@ static u32 opcode_table[256] = { + ByteOp | SrcImmUByte, SrcImmUByte, + /* 0xE8 - 0xEF */ + SrcImm | Stack, SrcImm | ImplicitOps, +- SrcImm | Src2Imm16, SrcImmByte | ImplicitOps, ++ SrcImmU | Src2Imm16, SrcImmByte | ImplicitOps, + SrcNone | ByteOp | ImplicitOps, SrcNone | ImplicitOps, + SrcNone | ByteOp | ImplicitOps, SrcNone | ImplicitOps, + /* 0xF0 - 0xF7 */ + + +From gregkh@mini.kroah.org Wed Sep 16 15:37:19 2009 +Message-Id: <20090916223719.346977542@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Sep 2009 15:36:54 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Marcelo Tosatti , + Avi Kivity +Subject: [patch 41/45] KVM: limit lapic periodic timer frequency +References: <20090916223613.597295240@mini.kroah.org> +Content-Disposition: inline; filename=kvm-limit-lapic-periodic-timer-frequency.patch +Content-Length: 980 +Lines: 34 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Marcelo Tosatti + +commit 1444885a045fe3b1905a14ea1b52540bf556578b upstream. + +Otherwise its possible to starve the host by programming lapic timer +with a very high frequency. + +Signed-off-by: Marcelo Tosatti +Signed-off-by: Avi Kivity +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kvm/lapic.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +--- a/arch/x86/kvm/lapic.c ++++ b/arch/x86/kvm/lapic.c +@@ -573,6 +573,15 @@ static void start_apic_timer(struct kvm_ + + if (!apic->lapic_timer.period) + return; ++ /* ++ * Do not allow the guest to program periodic timers with small ++ * interval, since the hrtimers are not throttled by the host ++ * scheduler. ++ */ ++ if (apic_lvtt_period(apic)) { ++ if (apic->lapic_timer.period < NSEC_PER_MSEC/2) ++ apic->lapic_timer.period = NSEC_PER_MSEC/2; ++ } + + hrtimer_start(&apic->lapic_timer.timer, + ktime_add_ns(now, apic->lapic_timer.period), + + +From gregkh@mini.kroah.org Wed Sep 16 15:37:19 2009 +Message-Id: <20090916223719.521373239@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Sep 2009 15:36:55 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Tejun Heo , + Jeff Garzik +Subject: [patch 42/45] libata: fix off-by-one error in ata_tf_read_block() +References: <20090916223613.597295240@mini.kroah.org> +Content-Disposition: inline; filename=libata-fix-off-by-one-error-in-ata_tf_read_block.patch +Content-Length: 1147 +Lines: 38 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Tejun Heo + +commit ac8672ea922bde59acf50eaa1eaa1640a6395fd2 upstream. + +ata_tf_read_block() has off-by-one error when converting CHS address +to LBA. The bug isn't very visible because ata_tf_read_block() is +used only when generating sense data for a failed RW command and CHS +addressing isn't used too often these days. + +This problem was spotted by Atsushi Nemoto. + +Signed-off-by: Tejun Heo +Reported-by: Atsushi Nemoto +Signed-off-by: Jeff Garzik +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ata/libata-core.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +--- a/drivers/ata/libata-core.c ++++ b/drivers/ata/libata-core.c +@@ -709,7 +709,13 @@ u64 ata_tf_read_block(struct ata_taskfil + head = tf->device & 0xf; + sect = tf->lbal; + +- block = (cyl * dev->heads + head) * dev->sectors + sect; ++ if (!sect) { ++ ata_dev_printk(dev, KERN_WARNING, "device reported " ++ "invalid CHS sector 0\n"); ++ sect = 1; /* oh well */ ++ } ++ ++ block = (cyl * dev->heads + head) * dev->sectors + sect - 1; + } + + return block; + + +From gregkh@mini.kroah.org Wed Sep 16 15:37:19 2009 +Message-Id: <20090916223719.697894760@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Sep 2009 15:36:56 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Alexander Duyck , + Jeff Kirsher , + Jesse Barnes +Subject: [patch 43/45] PCI quirk: update 82576 device ids in SR-IOV quirks list +References: <20090916223613.597295240@mini.kroah.org> +Content-Disposition: inline; filename=pci-quirk-update-82576-device-ids-in-sr-iov-quirks-list.patch +Content-Length: 985 +Lines: 27 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Alexander Duyck + +commit 6f1186be4feb3364d3a52cbea81e43e4d5296196 upstream. + +This patch adds the most recent additions to the list of 82576 device IDs +to the list of devices needing the SR-IOV quirk. + +Signed-off-by: Alexander Duyck +Signed-off-by: Jeff Kirsher +Signed-off-by: Jesse Barnes +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pci/quirks.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -2494,6 +2494,7 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_I + DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x10e7, quirk_i82576_sriov); + DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x10e8, quirk_i82576_sriov); + DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x150a, quirk_i82576_sriov); ++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x150d, quirk_i82576_sriov); + + #endif /* CONFIG_PCI_IOV */ + + + +From gregkh@mini.kroah.org Wed Sep 16 15:37:19 2009 +Message-Id: <20090916223719.861500408@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Sep 2009 15:36:57 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jean Delvare , + Jesse Barnes +Subject: [patch 44/45] PCI: Unhide the SMBus on the Compaq Evo D510 USDT +References: <20090916223613.597295240@mini.kroah.org> +Content-Disposition: inline; filename=pci-unhide-the-smbus-on-the-compaq-evo-d510-usdt.patch +Content-Length: 1020 +Lines: 29 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Jean Delvare + +commit 6b5096e4d4496e185cd1ada5d1b8e1d941c805ed upstream. + +One more form factor for Compaq Evo D510, which needs the same quirk +as the other form factors. Apparently there's no hardware monitoring +chip on that one, but SPD EEPROMs, so it's still worth unhiding the +SMBus. + +Signed-off-by: Jean Delvare +Tested-by: Nuzhna Pomoshch +Signed-off-by: Jesse Barnes +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pci/quirks.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -1201,6 +1201,7 @@ static void __init asus_hides_smbus_host + switch(dev->subsystem_device) { + case 0x00b8: /* Compaq Evo D510 CMT */ + case 0x00b9: /* Compaq Evo D510 SFF */ ++ case 0x00ba: /* Compaq Evo D510 USDT */ + /* Motherboard doesn't have Host bridge + * subvendor/subdevice IDs and on-board VGA + * controller is disabled if an AGP card is + + +From gregkh@mini.kroah.org Wed Sep 16 15:37:20 2009 +Message-Id: <20090916223719.999597150@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Sep 2009 15:36:58 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Brian King , + Benjamin Herrenschmidt +Subject: [patch 45/45] powerpc/pseries: Fix to handle slb resize across migration +References: <20090916223613.597295240@mini.kroah.org> +Content-Disposition: inline; filename=powerpc-pseries-fix-to-handle-slb-resize-across-migration.patch +Content-Length: 4804 +Lines: 160 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Brian King + +commit 46db2f86a3b2a94e0b33e0b4548fb7b7b6bdff66 upstream. + +The SLB can change sizes across a live migration, which was not +being handled, resulting in possible machine crashes during +migration if migrating to a machine which has a smaller max SLB +size than the source machine. Fix this by first reducing the +SLB size to the minimum possible value, which is 32, prior to +migration. Then during the device tree update which occurs after +migration, we make the call to ensure the SLB gets updated. Also +add the slb_size to the lparcfg output so that the migration +tools can check to make sure the kernel has this capability +before allowing migration in scenarios where the SLB size will change. + +BenH: Fixed #include -> to avoid + breaking ppc32 build + +Signed-off-by: Brian King +Signed-off-by: Benjamin Herrenschmidt +Signed-off-by: Greg Kroah-Hartman + +--- + arch/powerpc/include/asm/mmu-hash64.h | 2 ++ + arch/powerpc/kernel/lparcfg.c | 3 +++ + arch/powerpc/kernel/rtas.c | 7 ++++++- + arch/powerpc/mm/slb.c | 16 ++++++++++++---- + arch/powerpc/platforms/pseries/reconfig.c | 9 ++++++++- + 5 files changed, 31 insertions(+), 6 deletions(-) + +--- a/arch/powerpc/include/asm/mmu-hash64.h ++++ b/arch/powerpc/include/asm/mmu-hash64.h +@@ -41,6 +41,7 @@ extern char initial_stab[]; + + #define SLB_NUM_BOLTED 3 + #define SLB_CACHE_ENTRIES 8 ++#define SLB_MIN_SIZE 32 + + /* Bits in the SLB ESID word */ + #define SLB_ESID_V ASM_CONST(0x0000000008000000) /* valid */ +@@ -296,6 +297,7 @@ extern void slb_flush_and_rebolt(void); + extern void stab_initialize(unsigned long stab); + + extern void slb_vmalloc_update(void); ++extern void slb_set_size(u16 size); + #endif /* __ASSEMBLY__ */ + + /* +--- a/arch/powerpc/kernel/lparcfg.c ++++ b/arch/powerpc/kernel/lparcfg.c +@@ -35,6 +35,7 @@ + #include + #include + #include ++#include + + #define MODULE_VERS "1.8" + #define MODULE_NAME "lparcfg" +@@ -537,6 +538,8 @@ static int pseries_lparcfg_data(struct s + + seq_printf(m, "shared_processor_mode=%d\n", lppaca[0].shared_proc); + ++ seq_printf(m, "slb_size=%d\n", mmu_slb_size); ++ + return 0; + } + +--- a/arch/powerpc/kernel/rtas.c ++++ b/arch/powerpc/kernel/rtas.c +@@ -39,6 +39,7 @@ + #include + #include + #include ++#include + + struct rtas_t rtas = { + .lock = __RAW_SPIN_LOCK_UNLOCKED +@@ -713,6 +714,7 @@ static void rtas_percpu_suspend_me(void + { + long rc = H_SUCCESS; + unsigned long msr_save; ++ u16 slb_size = mmu_slb_size; + int cpu; + struct rtas_suspend_me_data *data = + (struct rtas_suspend_me_data *)info; +@@ -735,13 +737,16 @@ static void rtas_percpu_suspend_me(void + /* All other cpus are in H_JOIN, this cpu does + * the suspend. + */ ++ slb_set_size(SLB_MIN_SIZE); + printk(KERN_DEBUG "calling ibm,suspend-me on cpu %i\n", + smp_processor_id()); + data->error = rtas_call(data->token, 0, 1, NULL); + +- if (data->error) ++ if (data->error) { + printk(KERN_DEBUG "ibm,suspend-me returned %d\n", + data->error); ++ slb_set_size(slb_size); ++ } + } else { + printk(KERN_ERR "H_JOIN on cpu %i failed with rc = %ld\n", + smp_processor_id(), rc); +--- a/arch/powerpc/mm/slb.c ++++ b/arch/powerpc/mm/slb.c +@@ -240,14 +240,22 @@ void switch_slb(struct task_struct *tsk, + static inline void patch_slb_encoding(unsigned int *insn_addr, + unsigned int immed) + { +- /* Assume the instruction had a "0" immediate value, just +- * "or" in the new value +- */ +- *insn_addr |= immed; ++ *insn_addr = (*insn_addr & 0xffff0000) | immed; + flush_icache_range((unsigned long)insn_addr, 4+ + (unsigned long)insn_addr); + } + ++void slb_set_size(u16 size) ++{ ++ extern unsigned int *slb_compare_rr_to_size; ++ ++ if (mmu_slb_size == size) ++ return; ++ ++ mmu_slb_size = size; ++ patch_slb_encoding(slb_compare_rr_to_size, mmu_slb_size); ++} ++ + void slb_initialize(void) + { + unsigned long linear_llp, vmalloc_llp, io_llp; +--- a/arch/powerpc/platforms/pseries/reconfig.c ++++ b/arch/powerpc/platforms/pseries/reconfig.c +@@ -20,6 +20,7 @@ + #include + #include + #include ++#include + + + +@@ -439,9 +440,15 @@ static int do_update_property(char *buf, + if (!newprop) + return -ENOMEM; + ++ if (!strcmp(name, "slb-size") || !strcmp(name, "ibm,slb-size")) ++ slb_set_size(*(int *)value); ++ + oldprop = of_find_property(np, name,NULL); +- if (!oldprop) ++ if (!oldprop) { ++ if (strlen(name)) ++ return prom_add_property(np, newprop); + return -ENODEV; ++ } + + rc = prom_update_property(np, newprop, oldprop); + if (rc) + + +From gregkh@mini.kroah.org Wed Sep 16 15:37:13 2009 +Message-Id: <20090916223613.597295240@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Sep 2009 15:36:13 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk +Subject: [patch 00/45] 2.6.31.1-stable review +Content-Length: 882 +Lines: 22 + +This is the start of the stable review cycle for the 2.6.31.1 release. +There are 45 patches in this series, all will be posted as a response +to this one. If anyone has any issues with these being applied, please +let us know. If anyone is a maintainer of the proper subsystem, and +wants to add a Signed-off-by: line to the patch, please respond with it. + +These patches are sent out with a number of different people on the Cc: +line. If you wish to be a reviewer, please email stable@kernel.org to +add your name to the list. If you want to be off the reviewer list, +also email us. + +Responses should be made by Friday, September 18, 22:00:00 UTC. +Anything received after that time might be too late. + +The whole patch series can be found in one patch at: + kernel.org/pub/linux/kernel/v2.6/stable-review/patch-2.6.31.1-rc1.gz +and the diffstat can be found below. + + +thanks, + +greg k-h + diff --git a/queue-2.6.31/md-fix-strchr-undefined.patch b/review-2.6.31/md-fix-strchr-undefined.patch similarity index 100% rename from queue-2.6.31/md-fix-strchr-undefined.patch rename to review-2.6.31/md-fix-strchr-undefined.patch diff --git a/queue-2.6.31/mlx4_core-allocate-and-map-sufficient-icm-memory-for-eq-context.patch b/review-2.6.31/mlx4_core-allocate-and-map-sufficient-icm-memory-for-eq-context.patch similarity index 100% rename from queue-2.6.31/mlx4_core-allocate-and-map-sufficient-icm-memory-for-eq-context.patch rename to review-2.6.31/mlx4_core-allocate-and-map-sufficient-icm-memory-for-eq-context.patch diff --git a/queue-2.6.31/mpt2sas-prevent-sending-command-to-fw-while-host-reset.patch b/review-2.6.31/mpt2sas-prevent-sending-command-to-fw-while-host-reset.patch similarity index 100% rename from queue-2.6.31/mpt2sas-prevent-sending-command-to-fw-while-host-reset.patch rename to review-2.6.31/mpt2sas-prevent-sending-command-to-fw-while-host-reset.patch diff --git a/queue-2.6.31/mpt2sas-raid-10-volume-is-showing-as-raid-1e-in-dmesg.patch b/review-2.6.31/mpt2sas-raid-10-volume-is-showing-as-raid-1e-in-dmesg.patch similarity index 100% rename from queue-2.6.31/mpt2sas-raid-10-volume-is-showing-as-raid-1e-in-dmesg.patch rename to review-2.6.31/mpt2sas-raid-10-volume-is-showing-as-raid-1e-in-dmesg.patch diff --git a/queue-2.6.31/mpt2sas-rescan-topology-from-interrupt-context-instead-of-work-thread.patch b/review-2.6.31/mpt2sas-rescan-topology-from-interrupt-context-instead-of-work-thread.patch similarity index 100% rename from queue-2.6.31/mpt2sas-rescan-topology-from-interrupt-context-instead-of-work-thread.patch rename to review-2.6.31/mpt2sas-rescan-topology-from-interrupt-context-instead-of-work-thread.patch diff --git a/queue-2.6.31/mpt2sas-setting-sdev-into-running-state-from-interrupt-context.patch b/review-2.6.31/mpt2sas-setting-sdev-into-running-state-from-interrupt-context.patch similarity index 100% rename from queue-2.6.31/mpt2sas-setting-sdev-into-running-state-from-interrupt-context.patch rename to review-2.6.31/mpt2sas-setting-sdev-into-running-state-from-interrupt-context.patch diff --git a/queue-2.6.31/pci-apply-nv_msi_ht_cap_quirk-on-resume-too.patch b/review-2.6.31/pci-apply-nv_msi_ht_cap_quirk-on-resume-too.patch similarity index 100% rename from queue-2.6.31/pci-apply-nv_msi_ht_cap_quirk-on-resume-too.patch rename to review-2.6.31/pci-apply-nv_msi_ht_cap_quirk-on-resume-too.patch diff --git a/queue-2.6.31/pci-quirk-update-82576-device-ids-in-sr-iov-quirks-list.patch b/review-2.6.31/pci-quirk-update-82576-device-ids-in-sr-iov-quirks-list.patch similarity index 100% rename from queue-2.6.31/pci-quirk-update-82576-device-ids-in-sr-iov-quirks-list.patch rename to review-2.6.31/pci-quirk-update-82576-device-ids-in-sr-iov-quirks-list.patch diff --git a/queue-2.6.31/pci-unhide-the-smbus-on-the-compaq-evo-d510-usdt.patch b/review-2.6.31/pci-unhide-the-smbus-on-the-compaq-evo-d510-usdt.patch similarity index 100% rename from queue-2.6.31/pci-unhide-the-smbus-on-the-compaq-evo-d510-usdt.patch rename to review-2.6.31/pci-unhide-the-smbus-on-the-compaq-evo-d510-usdt.patch diff --git a/queue-2.6.31/perf-stat-change-noise-calculation-to-use-stddev.patch b/review-2.6.31/perf-stat-change-noise-calculation-to-use-stddev.patch similarity index 100% rename from queue-2.6.31/perf-stat-change-noise-calculation-to-use-stddev.patch rename to review-2.6.31/perf-stat-change-noise-calculation-to-use-stddev.patch diff --git a/queue-2.6.31/perf_counter-fix-buffer-overflow-in-perf_copy_attr.patch b/review-2.6.31/perf_counter-fix-buffer-overflow-in-perf_copy_attr.patch similarity index 100% rename from queue-2.6.31/perf_counter-fix-buffer-overflow-in-perf_copy_attr.patch rename to review-2.6.31/perf_counter-fix-buffer-overflow-in-perf_copy_attr.patch diff --git a/queue-2.6.31/perf_counter-start-counting-time-enabled-when-group-leader-gets-enabled.patch b/review-2.6.31/perf_counter-start-counting-time-enabled-when-group-leader-gets-enabled.patch similarity index 100% rename from queue-2.6.31/perf_counter-start-counting-time-enabled-when-group-leader-gets-enabled.patch rename to review-2.6.31/perf_counter-start-counting-time-enabled-when-group-leader-gets-enabled.patch diff --git a/queue-2.6.31/powerpc-fix-bug-where-perf_counters-breaks-oprofile.patch b/review-2.6.31/powerpc-fix-bug-where-perf_counters-breaks-oprofile.patch similarity index 100% rename from queue-2.6.31/powerpc-fix-bug-where-perf_counters-breaks-oprofile.patch rename to review-2.6.31/powerpc-fix-bug-where-perf_counters-breaks-oprofile.patch diff --git a/queue-2.6.31/powerpc-perf_counters-reduce-stack-usage-of-power_check_constraints.patch b/review-2.6.31/powerpc-perf_counters-reduce-stack-usage-of-power_check_constraints.patch similarity index 100% rename from queue-2.6.31/powerpc-perf_counters-reduce-stack-usage-of-power_check_constraints.patch rename to review-2.6.31/powerpc-perf_counters-reduce-stack-usage-of-power_check_constraints.patch diff --git a/queue-2.6.31/powerpc-ps3-workaround-for-flash-memory-i-o-error.patch b/review-2.6.31/powerpc-ps3-workaround-for-flash-memory-i-o-error.patch similarity index 100% rename from queue-2.6.31/powerpc-ps3-workaround-for-flash-memory-i-o-error.patch rename to review-2.6.31/powerpc-ps3-workaround-for-flash-memory-i-o-error.patch diff --git a/queue-2.6.31/powerpc-pseries-fix-to-handle-slb-resize-across-migration.patch b/review-2.6.31/powerpc-pseries-fix-to-handle-slb-resize-across-migration.patch similarity index 100% rename from queue-2.6.31/powerpc-pseries-fix-to-handle-slb-resize-across-migration.patch rename to review-2.6.31/powerpc-pseries-fix-to-handle-slb-resize-across-migration.patch diff --git a/queue-2.6.31/scsi-fix-oops-during-scsi-scanning.patch b/review-2.6.31/scsi-fix-oops-during-scsi-scanning.patch similarity index 100% rename from queue-2.6.31/scsi-fix-oops-during-scsi-scanning.patch rename to review-2.6.31/scsi-fix-oops-during-scsi-scanning.patch diff --git a/queue-2.6.31/scsi-libsrp-fix-memory-leak-in-srp_ring_free.patch b/review-2.6.31/scsi-libsrp-fix-memory-leak-in-srp_ring_free.patch similarity index 100% rename from queue-2.6.31/scsi-libsrp-fix-memory-leak-in-srp_ring_free.patch rename to review-2.6.31/scsi-libsrp-fix-memory-leak-in-srp_ring_free.patch diff --git a/queue-2.6.31/series b/review-2.6.31/series similarity index 100% rename from queue-2.6.31/series rename to review-2.6.31/series diff --git a/queue-2.6.31/sg-fix-oops-in-the-error-path-in-sg_build_indirect.patch b/review-2.6.31/sg-fix-oops-in-the-error-path-in-sg_build_indirect.patch similarity index 100% rename from queue-2.6.31/sg-fix-oops-in-the-error-path-in-sg_build_indirect.patch rename to review-2.6.31/sg-fix-oops-in-the-error-path-in-sg_build_indirect.patch diff --git a/queue-2.6.31/sound-oxygen-work-around-mce-when-changing-volume.patch b/review-2.6.31/sound-oxygen-work-around-mce-when-changing-volume.patch similarity index 100% rename from queue-2.6.31/sound-oxygen-work-around-mce-when-changing-volume.patch rename to review-2.6.31/sound-oxygen-work-around-mce-when-changing-volume.patch diff --git a/queue-2.6.31/tpm-fixup-boot-probe-timeout-for-tpm_tis-driver.patch b/review-2.6.31/tpm-fixup-boot-probe-timeout-for-tpm_tis-driver.patch similarity index 100% rename from queue-2.6.31/tpm-fixup-boot-probe-timeout-for-tpm_tis-driver.patch rename to review-2.6.31/tpm-fixup-boot-probe-timeout-for-tpm_tis-driver.patch diff --git a/queue-2.6.31/x86-amd-iommu-fix-broken-check-in-amd_iommu_flush_all_devices.patch b/review-2.6.31/x86-amd-iommu-fix-broken-check-in-amd_iommu_flush_all_devices.patch similarity index 100% rename from queue-2.6.31/x86-amd-iommu-fix-broken-check-in-amd_iommu_flush_all_devices.patch rename to review-2.6.31/x86-amd-iommu-fix-broken-check-in-amd_iommu_flush_all_devices.patch diff --git a/queue-2.6.31/x86-fix-x86_model-test-in-es7000_apic_is_cluster.patch b/review-2.6.31/x86-fix-x86_model-test-in-es7000_apic_is_cluster.patch similarity index 100% rename from queue-2.6.31/x86-fix-x86_model-test-in-es7000_apic_is_cluster.patch rename to review-2.6.31/x86-fix-x86_model-test-in-es7000_apic_is_cluster.patch diff --git a/queue-2.6.31/x86-i386-make-sure-stack-protector-segment-base-is-cache-aligned.patch b/review-2.6.31/x86-i386-make-sure-stack-protector-segment-base-is-cache-aligned.patch similarity index 100% rename from queue-2.6.31/x86-i386-make-sure-stack-protector-segment-base-is-cache-aligned.patch rename to review-2.6.31/x86-i386-make-sure-stack-protector-segment-base-is-cache-aligned.patch diff --git a/queue-2.6.31/x86-pat-fix-cacheflush-address-in-change_page_attr_set_clr.patch b/review-2.6.31/x86-pat-fix-cacheflush-address-in-change_page_attr_set_clr.patch similarity index 100% rename from queue-2.6.31/x86-pat-fix-cacheflush-address-in-change_page_attr_set_clr.patch rename to review-2.6.31/x86-pat-fix-cacheflush-address-in-change_page_attr_set_clr.patch