From: Greg Kroah-Hartman Date: Wed, 16 Sep 2009 22:30:02 +0000 (-0700) Subject: start .30 review cycle X-Git-Tag: v2.6.30.8~3 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=80f698363d5e73f18c4a60f1f375789db991e25c;p=thirdparty%2Fkernel%2Fstable-queue.git start .30 review cycle --- diff --git a/queue-2.6.30/agp-intel-remove-restore-in-resume.patch b/review-2.6.30/agp-intel-remove-restore-in-resume.patch similarity index 100% rename from queue-2.6.30/agp-intel-remove-restore-in-resume.patch rename to review-2.6.30/agp-intel-remove-restore-in-resume.patch diff --git a/queue-2.6.30/alsa-cs46xx-fix-minimum-period-size.patch b/review-2.6.30/alsa-cs46xx-fix-minimum-period-size.patch similarity index 100% rename from queue-2.6.30/alsa-cs46xx-fix-minimum-period-size.patch rename to review-2.6.30/alsa-cs46xx-fix-minimum-period-size.patch diff --git a/queue-2.6.30/arm-5691-1-fix-cache-aliasing-issues-between-kmap-and-kmap_atomic-with-highmem.patch b/review-2.6.30/arm-5691-1-fix-cache-aliasing-issues-between-kmap-and-kmap_atomic-with-highmem.patch similarity index 100% rename from queue-2.6.30/arm-5691-1-fix-cache-aliasing-issues-between-kmap-and-kmap_atomic-with-highmem.patch rename to review-2.6.30/arm-5691-1-fix-cache-aliasing-issues-between-kmap-and-kmap_atomic-with-highmem.patch diff --git a/queue-2.6.30/asoc-fix-wm835x-out4-capture-enumeration.patch b/review-2.6.30/asoc-fix-wm835x-out4-capture-enumeration.patch similarity index 100% rename from queue-2.6.30/asoc-fix-wm835x-out4-capture-enumeration.patch rename to review-2.6.30/asoc-fix-wm835x-out4-capture-enumeration.patch diff --git a/queue-2.6.30/ath5k-write-pcu-registers-on-initial-reset.patch b/review-2.6.30/ath5k-write-pcu-registers-on-initial-reset.patch similarity index 100% rename from queue-2.6.30/ath5k-write-pcu-registers-on-initial-reset.patch rename to review-2.6.30/ath5k-write-pcu-registers-on-initial-reset.patch diff --git a/queue-2.6.30/binfmt_elf-fix-pt_interp-bss-handling.patch b/review-2.6.30/binfmt_elf-fix-pt_interp-bss-handling.patch similarity index 100% rename from queue-2.6.30/binfmt_elf-fix-pt_interp-bss-handling.patch rename to review-2.6.30/binfmt_elf-fix-pt_interp-bss-handling.patch diff --git a/queue-2.6.30/cfg80211-fix-looping-soft-lockup-in-find_ie.patch b/review-2.6.30/cfg80211-fix-looping-soft-lockup-in-find_ie.patch similarity index 100% rename from queue-2.6.30/cfg80211-fix-looping-soft-lockup-in-find_ie.patch rename to review-2.6.30/cfg80211-fix-looping-soft-lockup-in-find_ie.patch diff --git a/queue-2.6.30/fix-undefined-reference-to-user_shm_unlock.patch b/review-2.6.30/fix-undefined-reference-to-user_shm_unlock.patch similarity index 100% rename from queue-2.6.30/fix-undefined-reference-to-user_shm_unlock.patch rename to review-2.6.30/fix-undefined-reference-to-user_shm_unlock.patch diff --git a/queue-2.6.30/input-joydev-decouple-axis-and-button-map-ioctls-from-input-constants.patch b/review-2.6.30/input-joydev-decouple-axis-and-button-map-ioctls-from-input-constants.patch similarity index 100% rename from queue-2.6.30/input-joydev-decouple-axis-and-button-map-ioctls-from-input-constants.patch rename to review-2.6.30/input-joydev-decouple-axis-and-button-map-ioctls-from-input-constants.patch diff --git a/queue-2.6.30/libata-fix-off-by-one-error-in-ata_tf_read_block.patch b/review-2.6.30/libata-fix-off-by-one-error-in-ata_tf_read_block.patch similarity index 100% rename from queue-2.6.30/libata-fix-off-by-one-error-in-ata_tf_read_block.patch rename to review-2.6.30/libata-fix-off-by-one-error-in-ata_tf_read_block.patch diff --git a/review-2.6.30/mbox b/review-2.6.30/mbox new file mode 100644 index 00000000000..203c80216b4 --- /dev/null +++ b/review-2.6.30/mbox @@ -0,0 +1,1959 @@ +From gregkh@mini.kroah.org Wed Sep 16 15:29:00 2009 +Message-Id: <20090916222900.766305892@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Sep 2009 15:28:20 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Stephen Kitt , + Dmitry Torokhov +Subject: [patch 01/24] Input: joydev - decouple axis and button map ioctls from input constants +References: <20090916222819.244332644@mini.kroah.org> +Content-Disposition: inline; filename=input-joydev-decouple-axis-and-button-map-ioctls-from-input-constants.patch +Content-Length: 3628 +Lines: 121 + +From: Stephen Kitt + +commit ec8b4b7085605e801a7740a2c3c33256aebe249c upstream. + +The KEY_MAX change in 2.6.28 changed the values of the JSIOCSBTNMAP and +JSIOCGBTNMAP constants; software compiled with the old values no longer +works with kernels following 2.6.28, because the ioctl switch statement +no longer matches the values given by the software. This patch handles +these ioctls independently of the length of data specified, and applies the +same treatment to JSIOCSAXMAP and JSIOCGAXMAP which currently depend on +ABS_MAX. + +Signed-off-by: Stephen Kitt +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/input/joydev.c | 66 ++++++++++++++++++++++++++++++------------------- + 1 file changed, 41 insertions(+), 25 deletions(-) + +--- a/drivers/input/joydev.c ++++ b/drivers/input/joydev.c +@@ -457,8 +457,11 @@ static int joydev_ioctl_common(struct jo + unsigned int cmd, void __user *argp) + { + struct input_dev *dev = joydev->handle.dev; ++ size_t len; + int i, j; ++ const char *name; + ++ /* Process fixed-sized commands. */ + switch (cmd) { + + case JS_SET_CAL: +@@ -500,9 +503,22 @@ static int joydev_ioctl_common(struct jo + return copy_to_user(argp, joydev->corr, + sizeof(joydev->corr[0]) * joydev->nabs) ? -EFAULT : 0; + +- case JSIOCSAXMAP: +- if (copy_from_user(joydev->abspam, argp, +- sizeof(__u8) * (ABS_MAX + 1))) ++ } ++ ++ /* ++ * Process variable-sized commands (the axis and button map commands ++ * are considered variable-sized to decouple them from the values of ++ * ABS_MAX and KEY_MAX). ++ */ ++ switch (cmd & ~IOCSIZE_MASK) { ++ ++ case (JSIOCSAXMAP & ~IOCSIZE_MASK): ++ len = min_t(size_t, _IOC_SIZE(cmd), sizeof(joydev->abspam)); ++ /* ++ * FIXME: we should not copy into our axis map before ++ * validating the data. ++ */ ++ if (copy_from_user(joydev->abspam, argp, len)) + return -EFAULT; + + for (i = 0; i < joydev->nabs; i++) { +@@ -512,13 +528,17 @@ static int joydev_ioctl_common(struct jo + } + return 0; + +- case JSIOCGAXMAP: +- return copy_to_user(argp, joydev->abspam, +- sizeof(__u8) * (ABS_MAX + 1)) ? -EFAULT : 0; +- +- case JSIOCSBTNMAP: +- if (copy_from_user(joydev->keypam, argp, +- sizeof(__u16) * (KEY_MAX - BTN_MISC + 1))) ++ case (JSIOCGAXMAP & ~IOCSIZE_MASK): ++ len = min_t(size_t, _IOC_SIZE(cmd), sizeof(joydev->abspam)); ++ return copy_to_user(argp, joydev->abspam, len) ? -EFAULT : 0; ++ ++ case (JSIOCSBTNMAP & ~IOCSIZE_MASK): ++ len = min_t(size_t, _IOC_SIZE(cmd), sizeof(joydev->keypam)); ++ /* ++ * FIXME: we should not copy into our keymap before ++ * validating the data. ++ */ ++ if (copy_from_user(joydev->keypam, argp, len)) + return -EFAULT; + + for (i = 0; i < joydev->nkey; i++) { +@@ -530,23 +550,19 @@ static int joydev_ioctl_common(struct jo + + return 0; + +- case JSIOCGBTNMAP: +- return copy_to_user(argp, joydev->keypam, +- sizeof(__u16) * (KEY_MAX - BTN_MISC + 1)) ? -EFAULT : 0; ++ case (JSIOCGBTNMAP & ~IOCSIZE_MASK): ++ len = min_t(size_t, _IOC_SIZE(cmd), sizeof(joydev->keypam)); ++ return copy_to_user(argp, joydev->keypam, len) ? -EFAULT : 0; ++ ++ case JSIOCGNAME(0): ++ name = dev->name; ++ if (!name) ++ return 0; + +- default: +- if ((cmd & ~IOCSIZE_MASK) == JSIOCGNAME(0)) { +- int len; +- if (!dev->name) +- return 0; +- len = strlen(dev->name) + 1; +- if (len > _IOC_SIZE(cmd)) +- len = _IOC_SIZE(cmd); +- if (copy_to_user(argp, dev->name, len)) +- return -EFAULT; +- return len; +- } ++ len = min_t(size_t, _IOC_SIZE(cmd), strlen(name) + 1); ++ return copy_to_user(argp, name, len) ? -EFAULT : len; + } ++ + return -EINVAL; + } + + + +From gregkh@mini.kroah.org Wed Sep 16 15:29:01 2009 +Message-Id: <20090916222900.956520721@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Sep 2009 15:28:21 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Michal Schmidt , + Douglas Gilbert , + James Bottomley +Subject: [patch 02/24] [SCSI] sg: fix oops in the error path in sg_build_indirect() +References: <20090916222819.244332644@mini.kroah.org> +Content-Disposition: inline; filename=sg-fix-oops-in-the-error-path-in-sg_build_indirect.patch +Content-Length: 798 +Lines: 29 + +From: Michal Schmidt + +commit e71044ee2efa4792e21d243b03d49006db66aec9 upstream. + +When the allocation fails in sg_build_indirect(), an oops happens in +the error path. It's caused by an obvious typo. + +Signed-off-by: Michal Schmidt +Reported-by: Bob Tracy +Acked-by: Douglas Gilbert +Signed-off-by: James Bottomley +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/sg.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/scsi/sg.c ++++ b/drivers/scsi/sg.c +@@ -1811,7 +1811,7 @@ retry: + return 0; + out: + for (i = 0; i < k; i++) +- __free_pages(schp->pages[k], order); ++ __free_pages(schp->pages[i], order); + + if (--order >= 0) + goto retry; + + +From gregkh@mini.kroah.org Wed Sep 16 15:29:01 2009 +Message-Id: <20090916222901.073774303@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Sep 2009 15:28:22 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Alan Stern , + Zhenyu Wang , + Dave Airlie +Subject: [patch 03/24] agp/intel: remove restore in resume +References: <20090916222819.244332644@mini.kroah.org> +Content-Disposition: inline; filename=agp-intel-remove-restore-in-resume.patch +Content-Length: 1296 +Lines: 39 + +From: Zhenyu Wang + +commit 121264827656f5f06328b17983c796af17dc5949 upstream. + +As early pci resume has already restored config for host +bridge and graphics device, don't need to restore it again, +This removes an original order hack for graphics device restore. + +This fixed the resume hang issue found by Alan Stern on 845G, +caused by extra config restore on graphics device. + +Cc: Alan Stern +Signed-off-by: Zhenyu Wang +Signed-off-by: Dave Airlie +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/char/agp/intel-agp.c | 9 --------- + 1 file changed, 9 deletions(-) + +--- a/drivers/char/agp/intel-agp.c ++++ b/drivers/char/agp/intel-agp.c +@@ -2299,15 +2299,6 @@ static int agp_intel_resume(struct pci_d + struct agp_bridge_data *bridge = pci_get_drvdata(pdev); + int ret_val; + +- pci_restore_state(pdev); +- +- /* We should restore our graphics device's config space, +- * as host bridge (00:00) resumes before graphics device (02:00), +- * then our access to its pci space can work right. +- */ +- if (intel_private.pcidev) +- pci_restore_state(intel_private.pcidev); +- + if (bridge->driver == &intel_generic_driver) + intel_configure(); + else if (bridge->driver == &intel_850_driver) + + +From gregkh@mini.kroah.org Wed Sep 16 15:29:01 2009 +Message-Id: <20090916222901.250338017@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Sep 2009 15:28:23 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Bob Copeland , + "John W. Linville" +Subject: [patch 04/24] ath5k: write PCU registers on initial reset +References: <20090916222819.244332644@mini.kroah.org> +Content-Disposition: inline; filename=ath5k-write-pcu-registers-on-initial-reset.patch +Content-Length: 1085 +Lines: 31 + +From: Bob Copeland + +commit 3355443ad7601991affa5992b0d53870335af765 upstream. + +"Ath5k: unify resets" +introduced a regression into 2.6.28 where the PCU registers are never +initialized, due to ath5k_reset() always passing true for change_channel. +We subsequently program a lot of these registers but several may start +in an unknown state. + +Reported-by: Forrest Zhang +Signed-off-by: Bob Copeland +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/ath5k/base.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/wireless/ath5k/base.c ++++ b/drivers/net/wireless/ath5k/base.c +@@ -2623,7 +2623,7 @@ ath5k_reset(struct ath5k_softc *sc, stru + sc->curchan = chan; + sc->curband = &sc->sbands[chan->band]; + } +- ret = ath5k_hw_reset(ah, sc->opmode, sc->curchan, true); ++ ret = ath5k_hw_reset(ah, sc->opmode, sc->curchan, chan != NULL); + if (ret) { + ATH5K_ERR(sc, "can't reset hardware (%d)\n", ret); + goto err; + + +From gregkh@mini.kroah.org Wed Sep 16 15:29:01 2009 +Message-Id: <20090916222901.411537914@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Sep 2009 15:28:24 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Roland McGrath , + James Morris +Subject: [patch 05/24] binfmt_elf: fix PT_INTERP bss handling +References: <20090916222819.244332644@mini.kroah.org> +Content-Disposition: inline; filename=binfmt_elf-fix-pt_interp-bss-handling.patch +Content-Length: 2694 +Lines: 83 + +From: Roland McGrath + +commit 9f0ab4a3f0fdb1ff404d150618ace2fa069bb2e1 upstream. + +In fs/binfmt_elf.c, load_elf_interp() calls padzero() for .bss even if +the PT_LOAD has no PROT_WRITE and no .bss. This generates EFAULT. + +Here is a small test case. (Yes, there are other, useful PT_INTERP +which have only .text and no .data/.bss.) + + ----- ptinterp.S + _start: .globl _start + nop + int3 + ----- + $ gcc -m32 -nostartfiles -nostdlib -o ptinterp ptinterp.S + $ gcc -m32 -Wl,--dynamic-linker=ptinterp -o hello hello.c + $ ./hello + Segmentation fault # during execve() itself + + After applying the patch: + $ ./hello + Trace trap # user-mode execution after execve() finishes + +If the ELF headers are actually self-inconsistent, then dying is fine. +But having no PROT_WRITE segment is perfectly normal and correct if +there is no segment with p_memsz > p_filesz (i.e. bss). John Reiser +suggested checking for PROT_WRITE in the bss logic. I think it makes +most sense to simply apply the bss logic only when there is bss. + +This patch looks less trivial than it is due to some reindentation. +It just moves the "if (last_bss > elf_bss) {" test up to include the +partial-page bss logic as well as the more-pages bss logic. + +Reported-by: John Reiser +Signed-off-by: Roland McGrath +Signed-off-by: James Morris +Signed-off-by: Greg Kroah-Hartman + +--- + fs/binfmt_elf.c | 28 ++++++++++++++-------------- + 1 file changed, 14 insertions(+), 14 deletions(-) + +--- a/fs/binfmt_elf.c ++++ b/fs/binfmt_elf.c +@@ -501,22 +501,22 @@ static unsigned long load_elf_interp(str + } + } + +- /* +- * Now fill out the bss section. First pad the last page up +- * to the page boundary, and then perform a mmap to make sure +- * that there are zero-mapped pages up to and including the +- * last bss page. +- */ +- if (padzero(elf_bss)) { +- error = -EFAULT; +- goto out_close; +- } ++ if (last_bss > elf_bss) { ++ /* ++ * Now fill out the bss section. First pad the last page up ++ * to the page boundary, and then perform a mmap to make sure ++ * that there are zero-mapped pages up to and including the ++ * last bss page. ++ */ ++ if (padzero(elf_bss)) { ++ error = -EFAULT; ++ goto out_close; ++ } + +- /* What we have mapped so far */ +- elf_bss = ELF_PAGESTART(elf_bss + ELF_MIN_ALIGN - 1); ++ /* What we have mapped so far */ ++ elf_bss = ELF_PAGESTART(elf_bss + ELF_MIN_ALIGN - 1); + +- /* Map the last of the bss segment */ +- if (last_bss > elf_bss) { ++ /* Map the last of the bss segment */ + down_write(¤t->mm->mmap_sem); + error = do_brk(elf_bss, last_bss - elf_bss); + up_write(¤t->mm->mmap_sem); + + +From gregkh@mini.kroah.org Wed Sep 16 15:29:01 2009 +Message-Id: <20090916222901.570305710@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Sep 2009 15:28:25 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Bob Copeland , + "John W. Linville" +Subject: [patch 06/24] cfg80211: fix looping soft lockup in find_ie() +References: <20090916222819.244332644@mini.kroah.org> +Content-Disposition: inline; filename=cfg80211-fix-looping-soft-lockup-in-find_ie.patch +Content-Length: 4471 +Lines: 79 + +From: Bob Copeland + +commit fcc6cb0c13555e78c2d47257b6d1b5e59b0c419a upstream. + +The find_ie() function uses a size_t for the len parameter, and +directly uses len as a loop variable. If any received packets +are malformed, it is possible for the decrease of len to overflow, +and since the result is unsigned, the loop will not terminate. +Change it to a signed int so the loop conditional works for +negative values. + +This fixes the following soft lockup: + +[38573.102007] BUG: soft lockup - CPU#0 stuck for 61s! [phy0:2230] +[38573.102007] Modules linked in: aes_i586 aes_generic fuse af_packet ipt_REJECT xt_tcpudp nf_conntrack_ipv4 nf_defrag_ipv4 xt_state iptable_filter ip_tables x_tables acpi_cpufreq binfmt_misc dm_mirror dm_region_hash dm_log dm_multipath dm_mod kvm_intel kvm uinput i915 arc4 ecb drm snd_hda_codec_idt ath5k snd_hda_intel hid_apple mac80211 usbhid appletouch snd_hda_codec snd_pcm ath cfg80211 snd_timer i2c_algo_bit ohci1394 video snd processor ieee1394 rfkill ehci_hcd sg sky2 backlight snd_page_alloc uhci_hcd joydev output ac thermal button battery sr_mod applesmc cdrom input_polldev evdev unix [last unloaded: scsi_wait_scan] +[38573.102007] irq event stamp: 2547724535 +[38573.102007] hardirqs last enabled at (2547724534): [] restore_all_notrace+0x0/0x18 +[38573.102007] hardirqs last disabled at (2547724535): [] apic_timer_interrupt+0x28/0x34 +[38573.102007] softirqs last enabled at (92950144): [] __do_softirq+0x108/0x210 +[38573.102007] softirqs last disabled at (92950274): [] _spin_lock_bh+0x14/0x80 +[38573.102007] +[38573.102007] Pid: 2230, comm: phy0 Tainted: G W (2.6.31-rc7-wl #8) MacBook1,1 +[38573.102007] EIP: 0060:[] EFLAGS: 00010292 CPU: 0 +[38573.102007] EIP is at cmp_ies+0x30/0x180 [cfg80211] +[38573.102007] EAX: 00000082 EBX: 00000000 ECX: ffffffc1 EDX: d8efd014 +[38573.102007] ESI: ffffff7c EDI: 0000004d EBP: eee2dc50 ESP: eee2dc3c +[38573.102007] DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068 +[38573.102007] CR0: 8005003b CR2: d8efd014 CR3: 01694000 CR4: 000026d0 +[38573.102007] DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000 +[38573.102007] DR6: ffff0ff0 DR7: 00000400 +[38573.102007] Call Trace: +[38573.102007] [] cmp_bss+0xed/0x100 [cfg80211] +[38573.102007] [] cfg80211_bss_update+0x84/0x410 [cfg80211] +[38573.102007] [] cfg80211_inform_bss_frame+0x114/0x180 [cfg80211] +[38573.102007] [] ieee80211_bss_info_update+0x4f/0x180 [mac80211] +[38573.102007] [] ieee80211_rx_bss_info+0x88/0xf0 [mac80211] +[38573.102007] [] ? ieee802_11_parse_elems+0x27/0x30 [mac80211] +[38573.102007] [] ieee80211_rx_mgmt_probe_resp+0xa4/0x1c0 [mac80211] +[38573.102007] [] ieee80211_sta_rx_queued_mgmt+0x919/0xc50 [mac80211] +[38573.102007] [] ? sched_clock+0x27/0xa0 +[38573.102007] [] ? sched_clock+0x27/0xa0 +[38573.102007] [] ? mark_held_locks+0x60/0x80 +[38573.102007] [] ? _spin_unlock_irqrestore+0x55/0x70 +[38573.102007] [] ? sub_preempt_count+0x85/0xc0 +[38573.102007] [] ? _spin_unlock_irqrestore+0x3e/0x70 +[38573.102007] [] ? skb_dequeue+0x4f/0x70 +[38573.102007] [] ieee80211_sta_work+0x91/0xb80 [mac80211] +[38573.102007] [] ? sched_clock+0x27/0xa0 +[38573.102007] [] ? sub_preempt_count+0x85/0xc0 +[38573.102007] [] worker_thread+0x18f/0x320 +[38573.102007] [] ? worker_thread+0x12e/0x320 +[38573.102007] [] ? _spin_unlock_irqrestore+0x55/0x70 +[38573.102007] [] ? ieee80211_sta_work+0x0/0xb80 [mac80211] +[38573.102007] [] ? autoremove_wake_function+0x0/0x50 +[38573.102007] [] ? worker_thread+0x0/0x320 +[38573.102007] [] kthread+0x84/0x90 +[38573.102007] [] ? kthread+0x0/0x90 +[38573.102007] [] kernel_thread_helper+0x7/0x10 + +Signed-off-by: Bob Copeland +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + net/wireless/scan.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/wireless/scan.c ++++ b/net/wireless/scan.c +@@ -97,7 +97,7 @@ void cfg80211_bss_expire(struct cfg80211 + dev->bss_generation++; + } + +-static u8 *find_ie(u8 num, u8 *ies, size_t len) ++static u8 *find_ie(u8 num, u8 *ies, int len) + { + while (len > 2 && ies[0] != num) { + len -= ies[1] + 2; + + +From gregkh@mini.kroah.org Wed Sep 16 15:29:01 2009 +Message-Id: <20090916222901.703180069@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Sep 2009 15:28:26 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Hugh Dickins +Subject: [patch 07/24] fix undefined reference to user_shm_unlock +References: <20090916222819.244332644@mini.kroah.org> +Content-Disposition: inline; filename=fix-undefined-reference-to-user_shm_unlock.patch +Content-Length: 1113 +Lines: 33 + +From: Hugh Dickins + +commit 2195d2818c37bdf263865f1e9effccdd9fc5f9d4 upstream. + +My 353d5c30c666580347515da609dd74a2b8e9b828 "mm: fix hugetlb bug due to +user_shm_unlock call" broke the CONFIG_SYSVIPC !CONFIG_MMU build of both +2.6.31 and 2.6.30.6: "undefined reference to `user_shm_unlock'". + +gcc didn't understand my comment! so couldn't figure out to optimize +away user_shm_unlock() from the error path in the hugetlb-less case, as +it does elsewhere. Help it to do so, in a language it understands. + +Reported-by: Mike Frysinger +Signed-off-by: Hugh Dickins +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + ipc/shm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/ipc/shm.c ++++ b/ipc/shm.c +@@ -411,7 +411,7 @@ static int newseg(struct ipc_namespace * + return error; + + no_id: +- if (shp->mlock_user) /* shmflg & SHM_HUGETLB case */ ++ if (is_file_hugepages(file) && shp->mlock_user) + user_shm_unlock(size, shp->mlock_user); + fput(file); + no_file: + + +From gregkh@mini.kroah.org Wed Sep 16 15:29:01 2009 +Message-Id: <20090916222901.862708454@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Sep 2009 15:28:27 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Geoff Levand , + Benjamin Herrenschmidt +Subject: [patch 08/24] powerpc/ps3: Workaround for flash memory I/O error +References: <20090916222819.244332644@mini.kroah.org> +Content-Disposition: inline; filename=powerpc-ps3-workaround-for-flash-memory-i-o-error.patch +Content-Length: 3401 +Lines: 122 + +From: Geoff Levand + +commit bc00351edd5c1b84d48c3fdca740fedfce4ae6ce upstream. + +A workaround for flash memory I/O errors when the PS3 internal +hard disk has not been formatted for OtherOS use. + +This error condition mainly effects 'Live CD' users who have not +formatted the PS3's internal hard disk for OtherOS. + +Fixes errors similar to these when using the ps3-flash-util +or ps3-boot-game-os programs: + + ps3flash read failed 0x2050000 + os_area_header_read: read error: os_area_header: Input/output error + main:627: os_area_read_hp error. + ERROR: can't change boot flag + +Signed-off-by: Geoff Levand +Signed-off-by: Benjamin Herrenschmidt +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ps3/ps3stor_lib.c | 65 +++++++++++++++++++++++++++++++++++++++++++--- + 1 file changed, 62 insertions(+), 3 deletions(-) + +--- a/drivers/ps3/ps3stor_lib.c ++++ b/drivers/ps3/ps3stor_lib.c +@@ -23,6 +23,65 @@ + #include + #include + ++/* ++ * A workaround for flash memory I/O errors when the internal hard disk ++ * has not been formatted for OtherOS use. Delay disk close until flash ++ * memory is closed. ++ */ ++ ++static struct ps3_flash_workaround { ++ int flash_open; ++ int disk_open; ++ struct ps3_system_bus_device *disk_sbd; ++} ps3_flash_workaround; ++ ++static int ps3stor_open_hv_device(struct ps3_system_bus_device *sbd) ++{ ++ int error = ps3_open_hv_device(sbd); ++ ++ if (error) ++ return error; ++ ++ if (sbd->match_id == PS3_MATCH_ID_STOR_FLASH) ++ ps3_flash_workaround.flash_open = 1; ++ ++ if (sbd->match_id == PS3_MATCH_ID_STOR_DISK) ++ ps3_flash_workaround.disk_open = 1; ++ ++ return 0; ++} ++ ++static int ps3stor_close_hv_device(struct ps3_system_bus_device *sbd) ++{ ++ int error; ++ ++ if (sbd->match_id == PS3_MATCH_ID_STOR_DISK ++ && ps3_flash_workaround.disk_open ++ && ps3_flash_workaround.flash_open) { ++ ps3_flash_workaround.disk_sbd = sbd; ++ return 0; ++ } ++ ++ error = ps3_close_hv_device(sbd); ++ ++ if (error) ++ return error; ++ ++ if (sbd->match_id == PS3_MATCH_ID_STOR_DISK) ++ ps3_flash_workaround.disk_open = 0; ++ ++ if (sbd->match_id == PS3_MATCH_ID_STOR_FLASH) { ++ ps3_flash_workaround.flash_open = 0; ++ ++ if (ps3_flash_workaround.disk_sbd) { ++ ps3_close_hv_device(ps3_flash_workaround.disk_sbd); ++ ps3_flash_workaround.disk_open = 0; ++ ps3_flash_workaround.disk_sbd = NULL; ++ } ++ } ++ ++ return 0; ++} + + static int ps3stor_probe_access(struct ps3_storage_device *dev) + { +@@ -90,7 +149,7 @@ int ps3stor_setup(struct ps3_storage_dev + int error, res, alignment; + enum ps3_dma_page_size page_size; + +- error = ps3_open_hv_device(&dev->sbd); ++ error = ps3stor_open_hv_device(&dev->sbd); + if (error) { + dev_err(&dev->sbd.core, + "%s:%u: ps3_open_hv_device failed %d\n", __func__, +@@ -166,7 +225,7 @@ fail_free_irq: + fail_sb_event_receive_port_destroy: + ps3_sb_event_receive_port_destroy(&dev->sbd, dev->irq); + fail_close_device: +- ps3_close_hv_device(&dev->sbd); ++ ps3stor_close_hv_device(&dev->sbd); + fail: + return error; + } +@@ -193,7 +252,7 @@ void ps3stor_teardown(struct ps3_storage + "%s:%u: destroy event receive port failed %d\n", + __func__, __LINE__, error); + +- error = ps3_close_hv_device(&dev->sbd); ++ error = ps3stor_close_hv_device(&dev->sbd); + if (error) + dev_err(&dev->sbd.core, + "%s:%u: ps3_close_hv_device failed %d\n", __func__, + + +From gregkh@mini.kroah.org Wed Sep 16 15:29:02 2009 +Message-Id: <20090916222902.000624166@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Sep 2009 15:28:28 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jason Gunthorpe , + Rajiv Andrade , + James Morris +Subject: [patch 09/24] TPM: Fixup boot probe timeout for tpm_tis driver +References: <20090916222819.244332644@mini.kroah.org> +Content-Disposition: inline; filename=tpm-fixup-boot-probe-timeout-for-tpm_tis-driver.patch +Content-Length: 1887 +Lines: 51 + +From: Jason Gunthorpe + +commit ec57935837a78f9661125b08a5d08b697568e040 upstream. + +When probing the device in tpm_tis_init the call request_locality +uses timeout_a, which wasn't being initalized until after +request_locality. This results in request_locality falsely timing +out if the chip is still starting. Move the initialization to before +request_locality. + +This probably only matters for embedded cases (ie mine), a BIOS likely +gets the TPM into a state where this code path isn't necessary. + +Signed-off-by: Jason Gunthorpe +Acked-by: Rajiv Andrade +Signed-off-by: James Morris +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/char/tpm/tpm_tis.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +--- a/drivers/char/tpm/tpm_tis.c ++++ b/drivers/char/tpm/tpm_tis.c +@@ -450,6 +450,12 @@ static int tpm_tis_init(struct device *d + goto out_err; + } + ++ /* Default timeouts */ ++ chip->vendor.timeout_a = msecs_to_jiffies(TIS_SHORT_TIMEOUT); ++ chip->vendor.timeout_b = msecs_to_jiffies(TIS_LONG_TIMEOUT); ++ chip->vendor.timeout_c = msecs_to_jiffies(TIS_SHORT_TIMEOUT); ++ chip->vendor.timeout_d = msecs_to_jiffies(TIS_SHORT_TIMEOUT); ++ + if (request_locality(chip, 0) != 0) { + rc = -ENODEV; + goto out_err; +@@ -457,12 +463,6 @@ static int tpm_tis_init(struct device *d + + vendor = ioread32(chip->vendor.iobase + TPM_DID_VID(0)); + +- /* Default timeouts */ +- chip->vendor.timeout_a = msecs_to_jiffies(TIS_SHORT_TIMEOUT); +- chip->vendor.timeout_b = msecs_to_jiffies(TIS_LONG_TIMEOUT); +- chip->vendor.timeout_c = msecs_to_jiffies(TIS_SHORT_TIMEOUT); +- chip->vendor.timeout_d = msecs_to_jiffies(TIS_SHORT_TIMEOUT); +- + dev_info(dev, + "1.2 TPM (device-id 0x%X, rev-id %d)\n", + vendor >> 16, ioread8(chip->vendor.iobase + TPM_RID(0))); + + +From gregkh@mini.kroah.org Wed Sep 16 15:29:02 2009 +Message-Id: <20090916222902.178026313@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Sep 2009 15:28:29 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jan Kara +Subject: [patch 10/24] udf: Use device size when drive reported bogus number of written blocks +References: <20090916222819.244332644@mini.kroah.org> +Content-Disposition: inline; filename=udf-use-device-size-when-drive-reported-bogus-number-of-written-blocks.patch +Content-Length: 955 +Lines: 32 + +From: Jan Kara + +commit 24a5d59f3477bcff4c069ff4d0ca9a3e037d0235 upstream. + +Some drives report 0 as the number of written blocks when there are some blocks +recorded. Use device size in such case so that we can automagically mount such +media. + +Signed-off-by: Jan Kara +Signed-off-by: Greg Kroah-Hartman + +--- + fs/udf/lowlevel.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/fs/udf/lowlevel.c ++++ b/fs/udf/lowlevel.c +@@ -56,7 +56,12 @@ unsigned long udf_get_last_block(struct + struct block_device *bdev = sb->s_bdev; + unsigned long lblock = 0; + +- if (ioctl_by_bdev(bdev, CDROM_LAST_WRITTEN, (unsigned long) &lblock)) ++ /* ++ * ioctl failed or returned obviously bogus value? ++ * Try using the device size... ++ */ ++ if (ioctl_by_bdev(bdev, CDROM_LAST_WRITTEN, (unsigned long) &lblock) || ++ lblock == 0) + lblock = bdev->bd_inode->i_size >> sb->s_blocksize_bits; + + if (lblock) + + +From gregkh@mini.kroah.org Wed Sep 16 15:29:02 2009 +Message-Id: <20090916222902.328239195@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Sep 2009 15:28:30 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Sophie Hamilton , + Takashi Iwai +Subject: [patch 11/24] ALSA: cs46xx - Fix minimum period size +References: <20090916222819.244332644@mini.kroah.org> +Content-Disposition: inline; filename=alsa-cs46xx-fix-minimum-period-size.patch +Content-Length: 820 +Lines: 28 + +From: Sophie Hamilton + +commit 6148b130eb84edc76e4fa88da1877b27be6c2f06 upstream. + +Fix minimum period size for cs46xx cards. This fixes a problem in the +case where neither a period size nor a buffer size is passed to ALSA; +this is the case in Audacious, OpenAL, and others. + +Signed-off-by: Sophie Hamilton +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/cs46xx/cs46xx_lib.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/pci/cs46xx/cs46xx_lib.h ++++ b/sound/pci/cs46xx/cs46xx_lib.h +@@ -35,7 +35,7 @@ + + + #ifdef CONFIG_SND_CS46XX_NEW_DSP +-#define CS46XX_MIN_PERIOD_SIZE 1 ++#define CS46XX_MIN_PERIOD_SIZE 64 + #define CS46XX_MAX_PERIOD_SIZE 1024*1024 + #else + #define CS46XX_MIN_PERIOD_SIZE 2048 + + +From gregkh@mini.kroah.org Wed Sep 16 15:29:02 2009 +Message-Id: <20090916222902.497530826@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Sep 2009 15:28:31 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Nicolas Pitre , + Russell King +Subject: [patch 12/24] ARM: 5691/1: fix cache aliasing issues between kmap() and kmap_atomic() with highmem +References: <20090916222819.244332644@mini.kroah.org> +Content-Disposition: inline; filename=arm-5691-1-fix-cache-aliasing-issues-between-kmap-and-kmap_atomic-with-highmem.patch +Content-Length: 1928 +Lines: 59 + +From: Nicolas Pitre + +commit 7929eb9cf643ae416e5081b2a6fa558d37b9854c upstream. + +Let's suppose a highmem page is kmap'd with kmap(). A pkmap entry is +used, the page mapped to it, and the virtual cache is dirtied. Then +kunmap() is used which does virtually nothing except for decrementing a +usage count. + +Then, let's suppose the _same_ page gets mapped using kmap_atomic(). +It is therefore mapped onto a fixmap entry instead, which has a +different virtual address unaware of the dirty cache data for that page +sitting in the pkmap mapping. + +Fortunately it is easy to know if a pkmap mapping still exists for that +page and use it directly with kmap_atomic(), thanks to kmap_high_get(). + +And actual testing with a printk in the added code path shows that this +condition is actually met *extremely* frequently. Seems that we've been +quite lucky that things have worked so well with highmem so far. + +Signed-off-by: Nicolas Pitre +Signed-off-by: Russell King +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/mm/highmem.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/arch/arm/mm/highmem.c ++++ b/arch/arm/mm/highmem.c +@@ -40,11 +40,16 @@ void *kmap_atomic(struct page *page, enu + { + unsigned int idx; + unsigned long vaddr; ++ void *kmap; + + pagefault_disable(); + if (!PageHighMem(page)) + return page_address(page); + ++ kmap = kmap_high_get(page); ++ if (kmap) ++ return kmap; ++ + idx = type + KM_TYPE_NR * smp_processor_id(); + vaddr = __fix_to_virt(FIX_KMAP_BEGIN + idx); + #ifdef CONFIG_DEBUG_HIGHMEM +@@ -80,6 +85,9 @@ void kunmap_atomic(void *kvaddr, enum km + #else + (void) idx; /* to kill a warning */ + #endif ++ } else if (vaddr >= PKMAP_ADDR(0) && vaddr < PKMAP_ADDR(LAST_PKMAP)) { ++ /* this address was obtained through kmap_high_get() */ ++ kunmap_high(pte_page(pkmap_page_table[PKMAP_NR(vaddr)])); + } + pagefault_enable(); + } + + +From gregkh@mini.kroah.org Wed Sep 16 15:29:02 2009 +Message-Id: <20090916222902.670048692@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Sep 2009 15:28:32 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Mark Brown +Subject: [patch 13/24] ASoC: Fix WM835x Out4 capture enumeration +References: <20090916222819.244332644@mini.kroah.org> +Content-Disposition: inline; filename=asoc-fix-wm835x-out4-capture-enumeration.patch +Content-Length: 803 +Lines: 26 + +From: Mark Brown + +commit 87831cb660954356d68cebdb1406f3be09e784e9 upstream. + +It's the 8th enum of a zero indexed array. This is why I don't let +new drivers use these arrays of enums... + +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/codecs/wm8350.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/soc/codecs/wm8350.c ++++ b/sound/soc/codecs/wm8350.c +@@ -613,7 +613,7 @@ SOC_DAPM_SINGLE("Switch", WM8350_BEEP_VO + + /* Out4 Capture Mux */ + static const struct snd_kcontrol_new wm8350_out4_capture_controls = +-SOC_DAPM_ENUM("Route", wm8350_enum[8]); ++SOC_DAPM_ENUM("Route", wm8350_enum[7]); + + static const struct snd_soc_dapm_widget wm8350_dapm_widgets[] = { + + + +From gregkh@mini.kroah.org Wed Sep 16 15:29:02 2009 +Message-Id: <20090916222902.799848712@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Sep 2009 15:28:33 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Roland Dreier +Subject: [patch 14/24] mlx4_core: Allocate and map sufficient ICM memory for EQ context +References: <20090916222819.244332644@mini.kroah.org> +Content-Disposition: inline; filename=mlx4_core-allocate-and-map-sufficient-icm-memory-for-eq-context.patch +Content-Length: 5008 +Lines: 144 + +From: Roland Dreier + +commit fa0681d2129732027355d6b7083dd8932b9b799d upstream. + +The current implementation allocates a single host page for EQ context +memory, which was OK when we only allocated a few EQs. However, since +we now allocate an EQ for each CPU core, this patch removes the +hard-coded limit (which we exceed with 4 KB pages and 128 byte EQ +context entries with 32 CPUs) and uses the same ICM table code as all +other context tables, which ends up simplifying the code quite a bit +while fixing the problem. + +This problem was actually hit in practice on a dual-socket Nehalem box +with 16 real hardware threads and sufficiently odd ACPI tables that it +shows on boot + + SMP: Allowing 32 CPUs, 16 hotplug CPUs + +so num_possible_cpus() ends up 32, and mlx4 ends up creating 33 MSI-X +interrupts and 33 EQs. This mlx4 bug means that mlx4 can't even +initialize at all on this quite mainstream system. + +Reported-by: Eli Cohen +Tested-by: Christoph Lameter +Signed-off-by: Roland Dreier +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/mlx4/eq.c | 42 ------------------------------------------ + drivers/net/mlx4/main.c | 9 ++++++--- + drivers/net/mlx4/mlx4.h | 7 +------ + 3 files changed, 7 insertions(+), 51 deletions(-) + +--- a/drivers/net/mlx4/eq.c ++++ b/drivers/net/mlx4/eq.c +@@ -524,48 +524,6 @@ static void mlx4_unmap_clr_int(struct ml + iounmap(priv->clr_base); + } + +-int mlx4_map_eq_icm(struct mlx4_dev *dev, u64 icm_virt) +-{ +- struct mlx4_priv *priv = mlx4_priv(dev); +- int ret; +- +- /* +- * We assume that mapping one page is enough for the whole EQ +- * context table. This is fine with all current HCAs, because +- * we only use 32 EQs and each EQ uses 64 bytes of context +- * memory, or 1 KB total. +- */ +- priv->eq_table.icm_virt = icm_virt; +- priv->eq_table.icm_page = alloc_page(GFP_HIGHUSER); +- if (!priv->eq_table.icm_page) +- return -ENOMEM; +- priv->eq_table.icm_dma = pci_map_page(dev->pdev, priv->eq_table.icm_page, 0, +- PAGE_SIZE, PCI_DMA_BIDIRECTIONAL); +- if (pci_dma_mapping_error(dev->pdev, priv->eq_table.icm_dma)) { +- __free_page(priv->eq_table.icm_page); +- return -ENOMEM; +- } +- +- ret = mlx4_MAP_ICM_page(dev, priv->eq_table.icm_dma, icm_virt); +- if (ret) { +- pci_unmap_page(dev->pdev, priv->eq_table.icm_dma, PAGE_SIZE, +- PCI_DMA_BIDIRECTIONAL); +- __free_page(priv->eq_table.icm_page); +- } +- +- return ret; +-} +- +-void mlx4_unmap_eq_icm(struct mlx4_dev *dev) +-{ +- struct mlx4_priv *priv = mlx4_priv(dev); +- +- mlx4_UNMAP_ICM(dev, priv->eq_table.icm_virt, 1); +- pci_unmap_page(dev->pdev, priv->eq_table.icm_dma, PAGE_SIZE, +- PCI_DMA_BIDIRECTIONAL); +- __free_page(priv->eq_table.icm_page); +-} +- + int mlx4_alloc_eq_table(struct mlx4_dev *dev) + { + struct mlx4_priv *priv = mlx4_priv(dev); +--- a/drivers/net/mlx4/main.c ++++ b/drivers/net/mlx4/main.c +@@ -520,7 +520,10 @@ static int mlx4_init_icm(struct mlx4_dev + goto err_unmap_aux; + } + +- err = mlx4_map_eq_icm(dev, init_hca->eqc_base); ++ err = mlx4_init_icm_table(dev, &priv->eq_table.table, ++ init_hca->eqc_base, dev_cap->eqc_entry_sz, ++ dev->caps.num_eqs, dev->caps.num_eqs, ++ 0, 0); + if (err) { + mlx4_err(dev, "Failed to map EQ context memory, aborting.\n"); + goto err_unmap_cmpt; +@@ -663,7 +666,7 @@ err_unmap_mtt: + mlx4_cleanup_icm_table(dev, &priv->mr_table.mtt_table); + + err_unmap_eq: +- mlx4_unmap_eq_icm(dev); ++ mlx4_cleanup_icm_table(dev, &priv->eq_table.table); + + err_unmap_cmpt: + mlx4_cleanup_icm_table(dev, &priv->eq_table.cmpt_table); +@@ -693,11 +696,11 @@ static void mlx4_free_icms(struct mlx4_d + mlx4_cleanup_icm_table(dev, &priv->qp_table.qp_table); + mlx4_cleanup_icm_table(dev, &priv->mr_table.dmpt_table); + mlx4_cleanup_icm_table(dev, &priv->mr_table.mtt_table); ++ mlx4_cleanup_icm_table(dev, &priv->eq_table.table); + mlx4_cleanup_icm_table(dev, &priv->eq_table.cmpt_table); + mlx4_cleanup_icm_table(dev, &priv->cq_table.cmpt_table); + mlx4_cleanup_icm_table(dev, &priv->srq_table.cmpt_table); + mlx4_cleanup_icm_table(dev, &priv->qp_table.cmpt_table); +- mlx4_unmap_eq_icm(dev); + + mlx4_UNMAP_ICM_AUX(dev); + mlx4_free_icm(dev, priv->fw.aux_icm, 0); +--- a/drivers/net/mlx4/mlx4.h ++++ b/drivers/net/mlx4/mlx4.h +@@ -205,9 +205,7 @@ struct mlx4_eq_table { + void __iomem **uar_map; + u32 clr_mask; + struct mlx4_eq *eq; +- u64 icm_virt; +- struct page *icm_page; +- dma_addr_t icm_dma; ++ struct mlx4_icm_table table; + struct mlx4_icm_table cmpt_table; + int have_irq; + u8 inta_pin; +@@ -373,9 +371,6 @@ u64 mlx4_make_profile(struct mlx4_dev *d + struct mlx4_dev_cap *dev_cap, + struct mlx4_init_hca_param *init_hca); + +-int mlx4_map_eq_icm(struct mlx4_dev *dev, u64 icm_virt); +-void mlx4_unmap_eq_icm(struct mlx4_dev *dev); +- + int mlx4_cmd_init(struct mlx4_dev *dev); + void mlx4_cmd_cleanup(struct mlx4_dev *dev); + void mlx4_cmd_event(struct mlx4_dev *dev, u16 token, u8 status, u64 out_param); + + +From gregkh@mini.kroah.org Wed Sep 16 15:29:03 2009 +Message-Id: <20090916222902.964796499@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Sep 2009 15:28:34 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Tejun Heo , + Peer Chen , + Tj , + Greg KH , + Jesse Barnes +Subject: [patch 15/24] PCI: apply nv_msi_ht_cap_quirk on resume too +References: <20090916222819.244332644@mini.kroah.org> +Content-Disposition: inline; filename=pci-apply-nv_msi_ht_cap_quirk-on-resume-too.patch +Content-Length: 1261 +Lines: 35 + +From: Tejun Heo + +commit 6dab62ee5a3bf4f71b8320c09db2e6022a19f40e upstream. + +http://bugzilla.kernel.org/show_bug.cgi?id=12542 reports that with the +quirk not applied on resume, msi stops working after resuming and mcp78s +ahci fails due to IRQ mis-delivery. Apply it on resume too. + +Signed-off-by: Tejun Heo +Cc: Peer Chen +Cc: Tj +Reported-by: Nicolas Derive +Cc: Greg KH +Signed-off-by: Andrew Morton +Signed-off-by: Jesse Barnes +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pci/quirks.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -2353,8 +2353,10 @@ static void __devinit nv_msi_ht_cap_quir + } + + DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_NVIDIA, PCI_ANY_ID, nv_msi_ht_cap_quirk_leaf); ++DECLARE_PCI_FIXUP_RESUME_EARLY(PCI_VENDOR_ID_NVIDIA, PCI_ANY_ID, nv_msi_ht_cap_quirk_leaf); + + DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AL, PCI_ANY_ID, nv_msi_ht_cap_quirk_all); ++DECLARE_PCI_FIXUP_RESUME_EARLY(PCI_VENDOR_ID_AL, PCI_ANY_ID, nv_msi_ht_cap_quirk_all); + + static void __devinit quirk_msi_intx_disable_bug(struct pci_dev *dev) + { + + +From gregkh@mini.kroah.org Wed Sep 16 15:29:03 2009 +Message-Id: <20090916222903.134440464@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Sep 2009 15:28:35 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Clemens Ladisch , + Takashi Iwai +Subject: [patch 16/24] sound: oxygen: work around MCE when changing volume +References: <20090916222819.244332644@mini.kroah.org> +Content-Disposition: inline; filename=sound-oxygen-work-around-mce-when-changing-volume.patch +Content-Length: 1498 +Lines: 45 + +From: Clemens Ladisch + +commit f1bc07af9a9edc5c1d4bdd971f7099316ed2e405 upstream. + +When the volume is changed continuously (e.g., when the user drags a +volume slider with the mouse), the driver does lots of I2C writes. +Apparently, the sound chip can get confused when we poll the I2C status +register too much, and fails to complete a read from it. On the PCI-E +models, the PCI-E/PCI bridge gets upset by this and generates a machine +check exception. + +To avoid this, this patch replaces the polling with an unconditional +wait that is guaranteed to be long enough. + +Signed-off-by: Clemens Ladisch +Tested-by: Johann Messner +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/oxygen/oxygen_io.c | 11 +---------- + 1 file changed, 1 insertion(+), 10 deletions(-) + +--- a/sound/pci/oxygen/oxygen_io.c ++++ b/sound/pci/oxygen/oxygen_io.c +@@ -215,17 +215,8 @@ EXPORT_SYMBOL(oxygen_write_spi); + + void oxygen_write_i2c(struct oxygen *chip, u8 device, u8 map, u8 data) + { +- unsigned long timeout; +- + /* should not need more than about 300 us */ +- timeout = jiffies + msecs_to_jiffies(1); +- do { +- if (!(oxygen_read16(chip, OXYGEN_2WIRE_BUS_STATUS) +- & OXYGEN_2WIRE_BUSY)) +- break; +- udelay(1); +- cond_resched(); +- } while (time_after_eq(timeout, jiffies)); ++ msleep(1); + + oxygen_write8(chip, OXYGEN_2WIRE_MAP, map); + oxygen_write8(chip, OXYGEN_2WIRE_DATA, data); + + +From gregkh@mini.kroah.org Wed Sep 16 15:29:03 2009 +Message-Id: <20090916222903.412688481@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Sep 2009 15:28:36 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Roel Kluin , + Ingo Molnar +Subject: [patch 17/24] x86: Fix x86_model test in es7000_apic_is_cluster() +References: <20090916222819.244332644@mini.kroah.org> +Content-Disposition: inline; filename=x86-fix-x86_model-test-in-es7000_apic_is_cluster.patch +Content-Length: 831 +Lines: 28 + +From: Roel Kluin + +commit 005155b1f626d2b2d7932e4afdf4fead168c6888 upstream. + +For the x86_model to be greater than 6 or less than 12 is +logically always true. + +Signed-off-by: Roel Kluin +Cc: Andrew Morton +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/apic/es7000_32.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/x86/kernel/apic/es7000_32.c ++++ b/arch/x86/kernel/apic/es7000_32.c +@@ -167,7 +167,7 @@ static int es7000_apic_is_cluster(void) + { + /* MPENTIUMIII */ + if (boot_cpu_data.x86 == 6 && +- (boot_cpu_data.x86_model >= 7 || boot_cpu_data.x86_model <= 11)) ++ (boot_cpu_data.x86_model >= 7 && boot_cpu_data.x86_model <= 11)) + return 1; + + return 0; + + +From gregkh@mini.kroah.org Wed Sep 16 15:29:03 2009 +Message-Id: <20090916222903.695585319@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Sep 2009 15:28:37 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jeremy Fitzhardinge , + Ingo Molnar +Subject: [patch 18/24] x86/i386: Make sure stack-protector segment base is cache aligned +References: <20090916222819.244332644@mini.kroah.org> +Content-Disposition: inline; filename=x86-i386-make-sure-stack-protector-segment-base-is-cache-aligned.patch +Content-Length: 3976 +Lines: 108 + +From: Jeremy Fitzhardinge + +commit 1ea0d14e480c245683927eecc03a70faf06e80c8 upstream. + +The Intel Optimization Reference Guide says: + + In Intel Atom microarchitecture, the address generation unit + assumes that the segment base will be 0 by default. Non-zero + segment base will cause load and store operations to experience + a delay. + - If the segment base isn't aligned to a cache line + boundary, the max throughput of memory operations is + reduced to one [e]very 9 cycles. + [...] + Assembly/Compiler Coding Rule 15. (H impact, ML generality) + For Intel Atom processors, use segments with base set to 0 + whenever possible; avoid non-zero segment base address that is + not aligned to cache line boundary at all cost. + +We can't avoid having a non-zero base for the stack-protector +segment, but we can make it cache-aligned. + +Signed-off-by: Jeremy Fitzhardinge +LKML-Reference: <4AA01893.6000507@goop.org> +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/include/asm/processor.h | 12 +++++++++++- + arch/x86/include/asm/stackprotector.h | 4 ++-- + arch/x86/include/asm/system.h | 2 +- + arch/x86/kernel/cpu/common.c | 2 +- + arch/x86/kernel/head_32.S | 1 - + 5 files changed, 15 insertions(+), 6 deletions(-) + +--- a/arch/x86/include/asm/processor.h ++++ b/arch/x86/include/asm/processor.h +@@ -402,7 +402,17 @@ extern unsigned long kernel_eflags; + extern asmlinkage void ignore_sysret(void); + #else /* X86_64 */ + #ifdef CONFIG_CC_STACKPROTECTOR +-DECLARE_PER_CPU(unsigned long, stack_canary); ++/* ++ * Make sure stack canary segment base is cached-aligned: ++ * "For Intel Atom processors, avoid non zero segment base address ++ * that is not aligned to cache line boundary at all cost." ++ * (Optim Ref Manual Assembly/Compiler Coding Rule 15.) ++ */ ++struct stack_canary { ++ char __pad[20]; /* canary at %gs:20 */ ++ unsigned long canary; ++}; ++DECLARE_PER_CPU(struct stack_canary, stack_canary) ____cacheline_aligned; + #endif + #endif /* X86_64 */ + +--- a/arch/x86/include/asm/stackprotector.h ++++ b/arch/x86/include/asm/stackprotector.h +@@ -78,14 +78,14 @@ static __always_inline void boot_init_st + #ifdef CONFIG_X86_64 + percpu_write(irq_stack_union.stack_canary, canary); + #else +- percpu_write(stack_canary, canary); ++ percpu_write(stack_canary.canary, canary); + #endif + } + + static inline void setup_stack_canary_segment(int cpu) + { + #ifdef CONFIG_X86_32 +- unsigned long canary = (unsigned long)&per_cpu(stack_canary, cpu) - 20; ++ unsigned long canary = (unsigned long)&per_cpu(stack_canary, cpu); + struct desc_struct *gdt_table = get_cpu_gdt_table(cpu); + struct desc_struct desc; + +--- a/arch/x86/include/asm/system.h ++++ b/arch/x86/include/asm/system.h +@@ -31,7 +31,7 @@ void __switch_to_xtra(struct task_struct + "movl %P[task_canary](%[next]), %%ebx\n\t" \ + "movl %%ebx, "__percpu_arg([stack_canary])"\n\t" + #define __switch_canary_oparam \ +- , [stack_canary] "=m" (per_cpu_var(stack_canary)) ++ , [stack_canary] "=m" (per_cpu_var(stack_canary.canary)) + #define __switch_canary_iparam \ + , [task_canary] "i" (offsetof(struct task_struct, stack_canary)) + #else /* CC_STACKPROTECTOR */ +--- a/arch/x86/kernel/cpu/common.c ++++ b/arch/x86/kernel/cpu/common.c +@@ -1033,7 +1033,7 @@ DEFINE_PER_CPU(struct orig_ist, orig_ist + #else /* CONFIG_X86_64 */ + + #ifdef CONFIG_CC_STACKPROTECTOR +-DEFINE_PER_CPU(unsigned long, stack_canary); ++DEFINE_PER_CPU(struct stack_canary, stack_canary) ____cacheline_aligned; + #endif + + /* Make sure %fs and %gs are initialized properly in idle threads */ +--- a/arch/x86/kernel/head_32.S ++++ b/arch/x86/kernel/head_32.S +@@ -442,7 +442,6 @@ is386: movl $2,%ecx # set MP + jne 1f + movl $per_cpu__gdt_page,%eax + movl $per_cpu__stack_canary,%ecx +- subl $20, %ecx + movw %cx, 8 * GDT_ENTRY_STACK_CANARY + 2(%eax) + shrl $16, %ecx + movb %cl, 8 * GDT_ENTRY_STACK_CANARY + 4(%eax) + + +From gregkh@mini.kroah.org Wed Sep 16 15:29:04 2009 +Message-Id: <20090916222903.948477177@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Sep 2009 15:28:38 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jack Steiner , + Suresh Siddha , + "H. Peter Anvin" +Subject: [patch 19/24] x86, pat: Fix cacheflush address in change_page_attr_set_clr() +References: <20090916222819.244332644@mini.kroah.org> +Content-Disposition: inline; filename=x86-pat-fix-cacheflush-address-in-change_page_attr_set_clr.patch +Content-Length: 1544 +Lines: 53 + +From: Jack Steiner + +commit fa526d0d641b5365676a1fb821ce359e217c9b85 upstream. + +Fix address passed to cpa_flush_range() when changing page +attributes from WB to UC. The address (*addr) is +modified by __change_page_attr_set_clr(). The result is that +the pages being flushed start at the _end_ of the changed range +instead of the beginning. + +This should be considered for 2.6.30-stable and 2.6.31-stable. + +Signed-off-by: Jack Steiner +Acked-by: Suresh Siddha +Signed-off-by: H. Peter Anvin +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/mm/pageattr.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +--- a/arch/x86/mm/pageattr.c ++++ b/arch/x86/mm/pageattr.c +@@ -807,6 +807,7 @@ static int change_page_attr_set_clr(unsi + { + struct cpa_data cpa; + int ret, cache, checkalias; ++ unsigned long baddr = 0; + + /* + * Check, if we are requested to change a not supported +@@ -838,6 +839,11 @@ static int change_page_attr_set_clr(unsi + */ + WARN_ON_ONCE(1); + } ++ /* ++ * Save address for cache flush. *addr is modified in the call ++ * to __change_page_attr_set_clr() below. ++ */ ++ baddr = *addr; + } + + /* Must avoid aliasing mappings in the highmem code */ +@@ -892,7 +898,7 @@ static int change_page_attr_set_clr(unsi + cpa_flush_array(addr, numpages, cache, + cpa.flags, pages); + } else +- cpa_flush_range(*addr, numpages, cache); ++ cpa_flush_range(baddr, numpages, cache); + } else + cpa_flush_all(cache); + + + +From gregkh@mini.kroah.org Wed Sep 16 15:29:04 2009 +Message-Id: <20090916222904.181440643@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Sep 2009 15:28:39 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Larry Finger , + linux-media , + Mauro Carvalho Chehab , + Douglas Schilling Landgraf , + Franklin Meng , + Michael Krufky +Subject: [patch 20/24] V4L: em28xx: set up tda9887_conf in em28xx_card_setup() +References: <20090916222819.244332644@mini.kroah.org> +Content-Disposition: inline; filename=v4l-em28xx-set-up-tda9887_conf-in-em28xx_card_setup.patch +Content-Length: 1116 +Lines: 32 + +From: Franklin Meng + +V4L: em28xx: set up tda9887_conf in em28xx_card_setup() + +(cherry picked from commit ae3340cbf59ea362c2016eea762456cc0969fd9e) + +Added tda9887_conf set up into em28xx_card_setup() + +Signed-off-by: Franklin Meng +Signed-off-by: Douglas Schilling Landgraf +Signed-off-by: Mauro Carvalho Chehab +Tested-by: Larry Finger +Signed-off-by: Michael Krufky +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/video/em28xx/em28xx-cards.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/media/video/em28xx/em28xx-cards.c ++++ b/drivers/media/video/em28xx/em28xx-cards.c +@@ -1886,6 +1886,9 @@ void em28xx_card_setup(struct em28xx *de + if (em28xx_boards[dev->model].tuner_addr) + dev->tuner_addr = em28xx_boards[dev->model].tuner_addr; + ++ if (em28xx_boards[dev->model].tda9887_conf) ++ dev->tda9887_conf = em28xx_boards[dev->model].tda9887_conf; ++ + /* request some modules */ + switch (dev->model) { + case EM2820_BOARD_HAUPPAUGE_WINTV_USB_2: + + +From gregkh@mini.kroah.org Wed Sep 16 15:29:04 2009 +Message-Id: <20090916222904.399551476@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Sep 2009 15:28:40 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Christoph Hellwig , + Rusty Russell , + Chuck Ebbert +Subject: [patch 21/24] virtio_blk: dont bounce highmem requests +References: <20090916222819.244332644@mini.kroah.org> +Content-Disposition: inline; filename=virtio_blk-don-t-bounce-highmem-requests.patch +Content-Length: 1209 +Lines: 36 + +From: Christoph Hellwig + +commit 4eff3cae9c9809720c636e64bc72f212258e0bd5 upstream + +virtio_blk: don't bounce highmem requests + +By default a block driver bounces highmem requests, but virtio-blk is +perfectly fine with any request that fit into it's 64 bit addressing scheme, +mapped in the kernel virtual space or not. + +Besides improving performance on highmem systems this also makes the +reproducible oops in __bounce_end_io go away (but hiding the real cause). + +Signed-off-by: Christoph Hellwig +Signed-off-by: Rusty Russell +Cc: Chuck Ebbert +Signed-off-by: Greg Kroah-Hartman +--- + +--- + drivers/block/virtio_blk.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/block/virtio_blk.c ++++ b/drivers/block/virtio_blk.c +@@ -308,6 +308,9 @@ static int virtblk_probe(struct virtio_d + else + blk_queue_max_segment_size(vblk->disk->queue, -1U); + ++ /* No need to bounce any requests */ ++ blk_queue_bounce_limit(vblk->disk->queue, BLK_BOUNCE_ANY); ++ + /* Host can optionally specify the block size of the device */ + err = virtio_config_val(vdev, VIRTIO_BLK_F_BLK_SIZE, + offsetof(struct virtio_blk_config, blk_size), + + +From gregkh@mini.kroah.org Wed Sep 16 15:29:04 2009 +Message-Id: <20090916222904.562048865@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Sep 2009 15:28:41 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Tejun Heo , + Jeff Garzik +Subject: [patch 22/24] libata: fix off-by-one error in ata_tf_read_block() +References: <20090916222819.244332644@mini.kroah.org> +Content-Disposition: inline; filename=libata-fix-off-by-one-error-in-ata_tf_read_block.patch +Content-Length: 1081 +Lines: 34 + +From: Tejun Heo + +commit ac8672ea922bde59acf50eaa1eaa1640a6395fd2 upstream. + +ata_tf_read_block() has off-by-one error when converting CHS address +to LBA. The bug isn't very visible because ata_tf_read_block() is +used only when generating sense data for a failed RW command and CHS +addressing isn't used too often these days. + +This problem was spotted by Atsushi Nemoto. + +Signed-off-by: Tejun Heo +Reported-by: Atsushi Nemoto +Signed-off-by: Jeff Garzik +Signed-off-by: Greg Kroah-Hartman + +--- a/drivers/ata/libata-core.c ++++ b/drivers/ata/libata-core.c +@@ -709,7 +709,13 @@ u64 ata_tf_read_block(struct ata_taskfile *tf, struct ata_device *dev) + head = tf->device & 0xf; + sect = tf->lbal; + +- block = (cyl * dev->heads + head) * dev->sectors + sect; ++ if (!sect) { ++ ata_dev_printk(dev, KERN_WARNING, "device reported " ++ "invalid CHS sector 0\n"); ++ sect = 1; /* oh well */ ++ } ++ ++ block = (cyl * dev->heads + head) * dev->sectors + sect - 1; + } + + return block; + + +From gregkh@mini.kroah.org Wed Sep 16 15:29:04 2009 +Message-Id: <20090916222904.712761455@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Sep 2009 15:28:42 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jean Delvare , + Jesse Barnes +Subject: [patch 23/24] PCI: Unhide the SMBus on the Compaq Evo D510 USDT +References: <20090916222819.244332644@mini.kroah.org> +Content-Disposition: inline; filename=pci-unhide-the-smbus-on-the-compaq-evo-d510-usdt.patch +Content-Length: 979 +Lines: 25 + +From: Jean Delvare + +commit 6b5096e4d4496e185cd1ada5d1b8e1d941c805ed upstream. + +One more form factor for Compaq Evo D510, which needs the same quirk +as the other form factors. Apparently there's no hardware monitoring +chip on that one, but SPD EEPROMs, so it's still worth unhiding the +SMBus. + +Signed-off-by: Jean Delvare +Tested-by: Nuzhna Pomoshch +Signed-off-by: Jesse Barnes +Signed-off-by: Greg Kroah-Hartman + +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -1201,6 +1201,7 @@ static void __init asus_hides_smbus_hostbridge(struct pci_dev *dev) + switch(dev->subsystem_device) { + case 0x00b8: /* Compaq Evo D510 CMT */ + case 0x00b9: /* Compaq Evo D510 SFF */ ++ case 0x00ba: /* Compaq Evo D510 USDT */ + /* Motherboard doesn't have Host bridge + * subvendor/subdevice IDs and on-board VGA + * controller is disabled if an AGP card is + + +From gregkh@mini.kroah.org Wed Sep 16 15:29:05 2009 +Message-Id: <20090916222904.882120418@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Sep 2009 15:28:43 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Brian King , + Benjamin Herrenschmidt +Subject: [patch 24/24] powerpc/pseries: Fix to handle slb resize across migration +References: <20090916222819.244332644@mini.kroah.org> +Content-Disposition: inline; filename=powerpc-pseries-fix-to-handle-slb-resize-across-migration.patch +Content-Length: 4802 +Lines: 160 + +From: Brian King + +commit 46db2f86a3b2a94e0b33e0b4548fb7b7b6bdff66 upstream. + +The SLB can change sizes across a live migration, which was not +being handled, resulting in possible machine crashes during +migration if migrating to a machine which has a smaller max SLB +size than the source machine. Fix this by first reducing the +SLB size to the minimum possible value, which is 32, prior to +migration. Then during the device tree update which occurs after +migration, we make the call to ensure the SLB gets updated. Also +add the slb_size to the lparcfg output so that the migration +tools can check to make sure the kernel has this capability +before allowing migration in scenarios where the SLB size will change. + +BenH: Fixed #include -> to avoid + breaking ppc32 build + +Signed-off-by: Brian King +Signed-off-by: Benjamin Herrenschmidt +Signed-off-by: Greg Kroah-Hartman + +--- + arch/powerpc/include/asm/mmu-hash64.h | 2 ++ + arch/powerpc/kernel/lparcfg.c | 3 +++ + arch/powerpc/kernel/rtas.c | 7 ++++++- + arch/powerpc/mm/slb.c | 16 ++++++++++++---- + arch/powerpc/platforms/pseries/reconfig.c | 9 ++++++++- + 5 files changed, 31 insertions(+), 6 deletions(-) + +--- a/arch/powerpc/include/asm/mmu-hash64.h ++++ b/arch/powerpc/include/asm/mmu-hash64.h +@@ -41,6 +41,7 @@ extern char initial_stab[]; + + #define SLB_NUM_BOLTED 3 + #define SLB_CACHE_ENTRIES 8 ++#define SLB_MIN_SIZE 32 + + /* Bits in the SLB ESID word */ + #define SLB_ESID_V ASM_CONST(0x0000000008000000) /* valid */ +@@ -296,6 +297,7 @@ extern void slb_flush_and_rebolt(void); + extern void stab_initialize(unsigned long stab); + + extern void slb_vmalloc_update(void); ++extern void slb_set_size(u16 size); + #endif /* __ASSEMBLY__ */ + + /* +--- a/arch/powerpc/kernel/lparcfg.c ++++ b/arch/powerpc/kernel/lparcfg.c +@@ -35,6 +35,7 @@ + #include + #include + #include ++#include + + #define MODULE_VERS "1.8" + #define MODULE_NAME "lparcfg" +@@ -501,6 +502,8 @@ static int pseries_lparcfg_data(struct s + + seq_printf(m, "shared_processor_mode=%d\n", lppaca[0].shared_proc); + ++ seq_printf(m, "slb_size=%d\n", mmu_slb_size); ++ + return 0; + } + +--- a/arch/powerpc/kernel/rtas.c ++++ b/arch/powerpc/kernel/rtas.c +@@ -38,6 +38,7 @@ + #include + #include + #include ++#include + + struct rtas_t rtas = { + .lock = SPIN_LOCK_UNLOCKED +@@ -692,6 +693,7 @@ static void rtas_percpu_suspend_me(void + { + long rc = H_SUCCESS; + unsigned long msr_save; ++ u16 slb_size = mmu_slb_size; + int cpu; + struct rtas_suspend_me_data *data = + (struct rtas_suspend_me_data *)info; +@@ -714,13 +716,16 @@ static void rtas_percpu_suspend_me(void + /* All other cpus are in H_JOIN, this cpu does + * the suspend. + */ ++ slb_set_size(SLB_MIN_SIZE); + printk(KERN_DEBUG "calling ibm,suspend-me on cpu %i\n", + smp_processor_id()); + data->error = rtas_call(data->token, 0, 1, NULL); + +- if (data->error) ++ if (data->error) { + printk(KERN_DEBUG "ibm,suspend-me returned %d\n", + data->error); ++ slb_set_size(slb_size); ++ } + } else { + printk(KERN_ERR "H_JOIN on cpu %i failed with rc = %ld\n", + smp_processor_id(), rc); +--- a/arch/powerpc/mm/slb.c ++++ b/arch/powerpc/mm/slb.c +@@ -247,14 +247,22 @@ void switch_slb(struct task_struct *tsk, + static inline void patch_slb_encoding(unsigned int *insn_addr, + unsigned int immed) + { +- /* Assume the instruction had a "0" immediate value, just +- * "or" in the new value +- */ +- *insn_addr |= immed; ++ *insn_addr = (*insn_addr & 0xffff0000) | immed; + flush_icache_range((unsigned long)insn_addr, 4+ + (unsigned long)insn_addr); + } + ++void slb_set_size(u16 size) ++{ ++ extern unsigned int *slb_compare_rr_to_size; ++ ++ if (mmu_slb_size == size) ++ return; ++ ++ mmu_slb_size = size; ++ patch_slb_encoding(slb_compare_rr_to_size, mmu_slb_size); ++} ++ + void slb_initialize(void) + { + unsigned long linear_llp, vmalloc_llp, io_llp; +--- a/arch/powerpc/platforms/pseries/reconfig.c ++++ b/arch/powerpc/platforms/pseries/reconfig.c +@@ -20,6 +20,7 @@ + #include + #include + #include ++#include + + + +@@ -439,9 +440,15 @@ static int do_update_property(char *buf, + if (!newprop) + return -ENOMEM; + ++ if (!strcmp(name, "slb-size") || !strcmp(name, "ibm,slb-size")) ++ slb_set_size(*(int *)value); ++ + oldprop = of_find_property(np, name,NULL); +- if (!oldprop) ++ if (!oldprop) { ++ if (strlen(name)) ++ return prom_add_property(np, newprop); + return -ENODEV; ++ } + + rc = prom_update_property(np, newprop, oldprop); + if (rc) + + +From gregkh@mini.kroah.org Wed Sep 16 15:29:00 2009 +Message-Id: <20090916222819.244332644@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Sep 2009 15:28:19 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk +Subject: [patch 00/24] 2.6.30.8-stable review +Content-Length: 882 +Lines: 22 + +This is the start of the stable review cycle for the 2.6.30.8 release. +There are 24 patches in this series, all will be posted as a response to +this one. If anyone has any issues with these being applied, please let +us know. If anyone is a maintainer of the proper subsystem, and wants +to add a Signed-off-by: line to the patch, please respond with it. + +These patches are sent out with a number of different people on the Cc: +line. If you wish to be a reviewer, please email stable@kernel.org to +add your name to the list. If you want to be off the reviewer list, +also email us. + +Responses should be made by Friday, September 18, 22:00:00 UTC. +Anything received after that time might be too late. + +The whole patch series can be found in one patch at: + kernel.org/pub/linux/kernel/v2.6/stable-review/patch-2.6.30.8-rc1.gz +and the diffstat can be found below. + + +thanks, + +greg k-h + diff --git a/queue-2.6.30/mlx4_core-allocate-and-map-sufficient-icm-memory-for-eq-context.patch b/review-2.6.30/mlx4_core-allocate-and-map-sufficient-icm-memory-for-eq-context.patch similarity index 100% rename from queue-2.6.30/mlx4_core-allocate-and-map-sufficient-icm-memory-for-eq-context.patch rename to review-2.6.30/mlx4_core-allocate-and-map-sufficient-icm-memory-for-eq-context.patch diff --git a/queue-2.6.30/pci-apply-nv_msi_ht_cap_quirk-on-resume-too.patch b/review-2.6.30/pci-apply-nv_msi_ht_cap_quirk-on-resume-too.patch similarity index 100% rename from queue-2.6.30/pci-apply-nv_msi_ht_cap_quirk-on-resume-too.patch rename to review-2.6.30/pci-apply-nv_msi_ht_cap_quirk-on-resume-too.patch diff --git a/queue-2.6.30/pci-unhide-the-smbus-on-the-compaq-evo-d510-usdt.patch b/review-2.6.30/pci-unhide-the-smbus-on-the-compaq-evo-d510-usdt.patch similarity index 100% rename from queue-2.6.30/pci-unhide-the-smbus-on-the-compaq-evo-d510-usdt.patch rename to review-2.6.30/pci-unhide-the-smbus-on-the-compaq-evo-d510-usdt.patch diff --git a/queue-2.6.30/powerpc-ps3-workaround-for-flash-memory-i-o-error.patch b/review-2.6.30/powerpc-ps3-workaround-for-flash-memory-i-o-error.patch similarity index 100% rename from queue-2.6.30/powerpc-ps3-workaround-for-flash-memory-i-o-error.patch rename to review-2.6.30/powerpc-ps3-workaround-for-flash-memory-i-o-error.patch diff --git a/queue-2.6.30/powerpc-pseries-fix-to-handle-slb-resize-across-migration.patch b/review-2.6.30/powerpc-pseries-fix-to-handle-slb-resize-across-migration.patch similarity index 100% rename from queue-2.6.30/powerpc-pseries-fix-to-handle-slb-resize-across-migration.patch rename to review-2.6.30/powerpc-pseries-fix-to-handle-slb-resize-across-migration.patch diff --git a/queue-2.6.30/series b/review-2.6.30/series similarity index 100% rename from queue-2.6.30/series rename to review-2.6.30/series diff --git a/queue-2.6.30/sg-fix-oops-in-the-error-path-in-sg_build_indirect.patch b/review-2.6.30/sg-fix-oops-in-the-error-path-in-sg_build_indirect.patch similarity index 100% rename from queue-2.6.30/sg-fix-oops-in-the-error-path-in-sg_build_indirect.patch rename to review-2.6.30/sg-fix-oops-in-the-error-path-in-sg_build_indirect.patch diff --git a/queue-2.6.30/sound-oxygen-work-around-mce-when-changing-volume.patch b/review-2.6.30/sound-oxygen-work-around-mce-when-changing-volume.patch similarity index 100% rename from queue-2.6.30/sound-oxygen-work-around-mce-when-changing-volume.patch rename to review-2.6.30/sound-oxygen-work-around-mce-when-changing-volume.patch diff --git a/queue-2.6.30/tpm-fixup-boot-probe-timeout-for-tpm_tis-driver.patch b/review-2.6.30/tpm-fixup-boot-probe-timeout-for-tpm_tis-driver.patch similarity index 100% rename from queue-2.6.30/tpm-fixup-boot-probe-timeout-for-tpm_tis-driver.patch rename to review-2.6.30/tpm-fixup-boot-probe-timeout-for-tpm_tis-driver.patch diff --git a/queue-2.6.30/udf-use-device-size-when-drive-reported-bogus-number-of-written-blocks.patch b/review-2.6.30/udf-use-device-size-when-drive-reported-bogus-number-of-written-blocks.patch similarity index 100% rename from queue-2.6.30/udf-use-device-size-when-drive-reported-bogus-number-of-written-blocks.patch rename to review-2.6.30/udf-use-device-size-when-drive-reported-bogus-number-of-written-blocks.patch diff --git a/queue-2.6.30/v4l-em28xx-set-up-tda9887_conf-in-em28xx_card_setup.patch b/review-2.6.30/v4l-em28xx-set-up-tda9887_conf-in-em28xx_card_setup.patch similarity index 100% rename from queue-2.6.30/v4l-em28xx-set-up-tda9887_conf-in-em28xx_card_setup.patch rename to review-2.6.30/v4l-em28xx-set-up-tda9887_conf-in-em28xx_card_setup.patch diff --git a/queue-2.6.30/virtio_blk-don-t-bounce-highmem-requests.patch b/review-2.6.30/virtio_blk-don-t-bounce-highmem-requests.patch similarity index 100% rename from queue-2.6.30/virtio_blk-don-t-bounce-highmem-requests.patch rename to review-2.6.30/virtio_blk-don-t-bounce-highmem-requests.patch diff --git a/queue-2.6.30/x86-fix-x86_model-test-in-es7000_apic_is_cluster.patch b/review-2.6.30/x86-fix-x86_model-test-in-es7000_apic_is_cluster.patch similarity index 100% rename from queue-2.6.30/x86-fix-x86_model-test-in-es7000_apic_is_cluster.patch rename to review-2.6.30/x86-fix-x86_model-test-in-es7000_apic_is_cluster.patch diff --git a/queue-2.6.30/x86-i386-make-sure-stack-protector-segment-base-is-cache-aligned.patch b/review-2.6.30/x86-i386-make-sure-stack-protector-segment-base-is-cache-aligned.patch similarity index 100% rename from queue-2.6.30/x86-i386-make-sure-stack-protector-segment-base-is-cache-aligned.patch rename to review-2.6.30/x86-i386-make-sure-stack-protector-segment-base-is-cache-aligned.patch diff --git a/queue-2.6.30/x86-pat-fix-cacheflush-address-in-change_page_attr_set_clr.patch b/review-2.6.30/x86-pat-fix-cacheflush-address-in-change_page_attr_set_clr.patch similarity index 100% rename from queue-2.6.30/x86-pat-fix-cacheflush-address-in-change_page_attr_set_clr.patch rename to review-2.6.30/x86-pat-fix-cacheflush-address-in-change_page_attr_set_clr.patch