From: Greg Kroah-Hartman Date: Fri, 22 Oct 2010 16:56:52 +0000 (-0700) Subject: .35 patches X-Git-Tag: v2.6.27.55~5 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=8d99f58d504c3c76c28b33a1f70198956c94c258;p=thirdparty%2Fkernel%2Fstable-queue.git .35 patches --- diff --git a/queue-2.6.35/acpi-delete-zepto-idle-nomwait-dmi-quirk.patch b/queue-2.6.35/acpi-delete-zepto-idle-nomwait-dmi-quirk.patch new file mode 100644 index 00000000000..fe62485d94e --- /dev/null +++ b/queue-2.6.35/acpi-delete-zepto-idle-nomwait-dmi-quirk.patch @@ -0,0 +1,36 @@ +From 64a32307b710c100beb101e9c78f8022f0e8ba61 Mon Sep 17 00:00:00 2001 +From: Len Brown +Date: Tue, 28 Sep 2010 17:20:20 -0400 +Subject: ACPI: delete ZEPTO idle=nomwait DMI quirk + +From: Len Brown + +commit 64a32307b710c100beb101e9c78f8022f0e8ba61 upstream. + +per comments in the bug report, this entry +seems to hurt at much as it helps. + +https://bugzilla.kernel.org/show_bug.cgi?id=10807 + +Signed-off-by: Len Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/acpi/processor_core.c | 6 ------ + 1 file changed, 6 deletions(-) + +--- a/drivers/acpi/processor_core.c ++++ b/drivers/acpi/processor_core.c +@@ -29,12 +29,6 @@ static int set_no_mwait(const struct dmi + + static struct dmi_system_id __cpuinitdata processor_idle_dmi_table[] = { + { +- set_no_mwait, "IFL91 board", { +- DMI_MATCH(DMI_BIOS_VENDOR, "COMPAL"), +- DMI_MATCH(DMI_SYS_VENDOR, "ZEPTO"), +- DMI_MATCH(DMI_PRODUCT_VERSION, "3215W"), +- DMI_MATCH(DMI_BOARD_NAME, "IFL91") }, NULL}, +- { + set_no_mwait, "Extensa 5220", { + DMI_MATCH(DMI_BIOS_VENDOR, "Phoenix Technologies LTD"), + DMI_MATCH(DMI_SYS_VENDOR, "Acer"), diff --git a/queue-2.6.35/acpi-disable-windows-vista-compatibility-for-toshiba-p305d.patch b/queue-2.6.35/acpi-disable-windows-vista-compatibility-for-toshiba-p305d.patch new file mode 100644 index 00000000000..e613c96fb11 --- /dev/null +++ b/queue-2.6.35/acpi-disable-windows-vista-compatibility-for-toshiba-p305d.patch @@ -0,0 +1,38 @@ +From 337279ce3aa85d81d34c0f837d1c204df105103b Mon Sep 17 00:00:00 2001 +From: Zhang Rui +Date: Tue, 28 Sep 2010 22:48:55 -0400 +Subject: ACPI: Disable Windows Vista compatibility for Toshiba P305D + +From: Zhang Rui + +commit 337279ce3aa85d81d34c0f837d1c204df105103b upstream. + +Disable the Windows Vista (SP1) compatibility for Toshiba P305D. + +http://bugzilla.kernel.org/show_bug.cgi?id=14736 + +Signed-off-by: Zhang Rui +Signed-off-by: Len Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/acpi/blacklist.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/drivers/acpi/blacklist.c ++++ b/drivers/acpi/blacklist.c +@@ -241,6 +241,14 @@ static struct dmi_system_id acpi_osi_dmi + DMI_MATCH(DMI_PRODUCT_NAME, "K50IJ"), + }, + }, ++ { ++ .callback = dmi_disable_osi_vista, ++ .ident = "Toshiba P305D", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "Satellite P305D"), ++ }, ++ }, + + /* + * BIOS invocation of _OSI(Linux) is almost always a BIOS bug. diff --git a/queue-2.6.35/acpi-ec-add-vista-incompatibility-dmi-entry-for-toshiba-satellite-l355.patch b/queue-2.6.35/acpi-ec-add-vista-incompatibility-dmi-entry-for-toshiba-satellite-l355.patch new file mode 100644 index 00000000000..2744374bf34 --- /dev/null +++ b/queue-2.6.35/acpi-ec-add-vista-incompatibility-dmi-entry-for-toshiba-satellite-l355.patch @@ -0,0 +1,35 @@ +From 7a1d602f5fc35d14907b7da98d5627acb69589d1 Mon Sep 17 00:00:00 2001 +From: Len Brown +Date: Tue, 28 Sep 2010 17:51:51 -0400 +Subject: ACPI: EC: add Vista incompatibility DMI entry for Toshiba Satellite L355 + +From: Len Brown + +commit 7a1d602f5fc35d14907b7da98d5627acb69589d1 upstream. + +https://bugzilla.kernel.org/show_bug.cgi?id=12641 + +Signed-off-by: Len Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/acpi/blacklist.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/drivers/acpi/blacklist.c ++++ b/drivers/acpi/blacklist.c +@@ -226,6 +226,14 @@ static struct dmi_system_id acpi_osi_dmi + }, + }, + { ++ .callback = dmi_disable_osi_vista, ++ .ident = "Toshiba Satellite L355", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"), ++ DMI_MATCH(DMI_PRODUCT_VERSION, "Satellite L355"), ++ }, ++ }, ++ { + .callback = dmi_disable_osi_win7, + .ident = "ASUS K50IJ", + .matches = { diff --git a/queue-2.6.35/acpi-enable-repeated-pciexp-wakeup-by-clearing-pciexp_wake_sts-on-resume.patch b/queue-2.6.35/acpi-enable-repeated-pciexp-wakeup-by-clearing-pciexp_wake_sts-on-resume.patch new file mode 100644 index 00000000000..9b2b6f13a6c --- /dev/null +++ b/queue-2.6.35/acpi-enable-repeated-pciexp-wakeup-by-clearing-pciexp_wake_sts-on-resume.patch @@ -0,0 +1,40 @@ +From 573b638158029898caf9470c8214b7ddd29751e3 Mon Sep 17 00:00:00 2001 +From: Colin Ian King +Date: Mon, 2 Aug 2010 15:14:43 +0000 +Subject: ACPI: enable repeated PCIEXP wakeup by clearing PCIEXP_WAKE_STS on resume + +From: Colin Ian King + +commit 573b638158029898caf9470c8214b7ddd29751e3 upstream. + +Section 4.7.3.1.1 (PM1 Status Registers) of version 4.0 of +the ACPI spec concerning PCIEXP_WAKE_STS points out in +in the final note field in table 4-11 that if this bit is +set to 1 and the system is put into a sleeping state then +the system will not automatically wake. + +This bit gets set by hardware to indicate that the system +woke up due to a PCI Express wakeup event, so clear it during +acpi_hw_clear_acpi_status() calls to enable subsequent +resumes to work. + +BugLink: http://bugs.launchpad.net/bugs/613381 + +Signed-off-by: Colin Ian King +Signed-off-by: Len Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/acpi/acpica/aclocal.h | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/acpi/acpica/aclocal.h ++++ b/drivers/acpi/acpica/aclocal.h +@@ -853,6 +853,7 @@ struct acpi_bit_register_info { + ACPI_BITMASK_POWER_BUTTON_STATUS | \ + ACPI_BITMASK_SLEEP_BUTTON_STATUS | \ + ACPI_BITMASK_RT_CLOCK_STATUS | \ ++ ACPI_BITMASK_PCIEXP_WAKE_DISABLE | \ + ACPI_BITMASK_WAKE_STATUS) + + #define ACPI_BITMASK_TIMER_ENABLE 0x0001 diff --git a/queue-2.6.35/agp-intel-fix-cache-control-for-sandybridge.patch b/queue-2.6.35/agp-intel-fix-cache-control-for-sandybridge.patch new file mode 100644 index 00000000000..5348185d41d --- /dev/null +++ b/queue-2.6.35/agp-intel-fix-cache-control-for-sandybridge.patch @@ -0,0 +1,180 @@ +From f8f235e5bbf4e61f3e0886a44afb1dc4cfe8f337 Mon Sep 17 00:00:00 2001 +From: Zhenyu Wang +Date: Fri, 27 Aug 2010 11:08:57 +0800 +Subject: agp/intel: Fix cache control for Sandybridge + +From: Zhenyu Wang + +commit f8f235e5bbf4e61f3e0886a44afb1dc4cfe8f337 upstream. + +Sandybridge GTT has new cache control bits in PTE, which controls +graphics page cache in LLC or LLC/MLC, so we need to extend the mask +function to respect the new bits. + +And set cache control to always LLC only by default on Gen6. + +Signed-off-by: Zhenyu Wang +Signed-off-by: Chris Wilson +Signed-off-by: Greg Kroah-Hartman + + +--- + drivers/char/agp/intel-agp.c | 1 + drivers/char/agp/intel-agp.h | 6 ++++ + drivers/char/agp/intel-gtt.c | 50 ++++++++++++++++++++++++++++++++-------- + drivers/gpu/drm/i915/i915_gem.c | 1 + include/linux/intel-gtt.h | 20 ++++++++++++++++ + 5 files changed, 68 insertions(+), 10 deletions(-) + +--- a/drivers/char/agp/intel-agp.c ++++ b/drivers/char/agp/intel-agp.c +@@ -12,6 +12,7 @@ + #include + #include "agp.h" + #include "intel-agp.h" ++#include + + #include "intel-gtt.c" + +--- a/drivers/char/agp/intel-agp.h ++++ b/drivers/char/agp/intel-agp.h +@@ -60,6 +60,12 @@ + #define I810_PTE_LOCAL 0x00000002 + #define I810_PTE_VALID 0x00000001 + #define I830_PTE_SYSTEM_CACHED 0x00000006 ++/* GT PTE cache control fields */ ++#define GEN6_PTE_UNCACHED 0x00000002 ++#define GEN6_PTE_LLC 0x00000004 ++#define GEN6_PTE_LLC_MLC 0x00000006 ++#define GEN6_PTE_GFDT 0x00000008 ++ + #define I810_SMRAM_MISCC 0x70 + #define I810_GFX_MEM_WIN_SIZE 0x00010000 + #define I810_GFX_MEM_WIN_32M 0x00010000 +--- a/drivers/char/agp/intel-gtt.c ++++ b/drivers/char/agp/intel-gtt.c +@@ -49,6 +49,26 @@ static struct gatt_mask intel_i810_masks + .type = INTEL_AGP_CACHED_MEMORY} + }; + ++#define INTEL_AGP_UNCACHED_MEMORY 0 ++#define INTEL_AGP_CACHED_MEMORY_LLC 1 ++#define INTEL_AGP_CACHED_MEMORY_LLC_GFDT 2 ++#define INTEL_AGP_CACHED_MEMORY_LLC_MLC 3 ++#define INTEL_AGP_CACHED_MEMORY_LLC_MLC_GFDT 4 ++ ++static struct gatt_mask intel_gen6_masks[] = ++{ ++ {.mask = I810_PTE_VALID | GEN6_PTE_UNCACHED, ++ .type = INTEL_AGP_UNCACHED_MEMORY }, ++ {.mask = I810_PTE_VALID | GEN6_PTE_LLC, ++ .type = INTEL_AGP_CACHED_MEMORY_LLC }, ++ {.mask = I810_PTE_VALID | GEN6_PTE_LLC | GEN6_PTE_GFDT, ++ .type = INTEL_AGP_CACHED_MEMORY_LLC_GFDT }, ++ {.mask = I810_PTE_VALID | GEN6_PTE_LLC_MLC, ++ .type = INTEL_AGP_CACHED_MEMORY_LLC_MLC }, ++ {.mask = I810_PTE_VALID | GEN6_PTE_LLC_MLC | GEN6_PTE_GFDT, ++ .type = INTEL_AGP_CACHED_MEMORY_LLC_MLC_GFDT }, ++}; ++ + static struct _intel_private { + struct pci_dev *pcidev; /* device one */ + u8 __iomem *registers; +@@ -175,13 +195,6 @@ static void intel_agp_insert_sg_entries( + off_t pg_start, int mask_type) + { + int i, j; +- u32 cache_bits = 0; +- +- if (agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_SANDYBRIDGE_HB || +- agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_SANDYBRIDGE_M_HB) +- { +- cache_bits = I830_PTE_SYSTEM_CACHED; +- } + + for (i = 0, j = pg_start; i < mem->page_count; i++, j++) { + writel(agp_bridge->driver->mask_memory(agp_bridge, +@@ -314,6 +327,23 @@ static int intel_i830_type_to_mask_type( + return 0; + } + ++static int intel_gen6_type_to_mask_type(struct agp_bridge_data *bridge, ++ int type) ++{ ++ unsigned int type_mask = type & ~AGP_USER_CACHED_MEMORY_GFDT; ++ unsigned int gfdt = type & AGP_USER_CACHED_MEMORY_GFDT; ++ ++ if (type_mask == AGP_USER_UNCACHED_MEMORY) ++ return INTEL_AGP_UNCACHED_MEMORY; ++ else if (type_mask == AGP_USER_CACHED_MEMORY_LLC_MLC) ++ return gfdt ? INTEL_AGP_CACHED_MEMORY_LLC_MLC_GFDT : ++ INTEL_AGP_CACHED_MEMORY_LLC_MLC; ++ else /* set 'normal'/'cached' to LLC by default */ ++ return gfdt ? INTEL_AGP_CACHED_MEMORY_LLC_GFDT : ++ INTEL_AGP_CACHED_MEMORY_LLC; ++} ++ ++ + static int intel_i810_insert_entries(struct agp_memory *mem, off_t pg_start, + int type) + { +@@ -1155,7 +1185,7 @@ static int intel_i915_insert_entries(str + + mask_type = agp_bridge->driver->agp_type_to_mask_type(agp_bridge, type); + +- if (mask_type != 0 && mask_type != AGP_PHYS_MEMORY && ++ if (!IS_SNB && mask_type != 0 && mask_type != AGP_PHYS_MEMORY && + mask_type != INTEL_AGP_CACHED_MEMORY) + goto out_err; + +@@ -1546,7 +1576,7 @@ static const struct agp_bridge_driver in + .fetch_size = intel_i9xx_fetch_size, + .cleanup = intel_i915_cleanup, + .mask_memory = intel_gen6_mask_memory, +- .masks = intel_i810_masks, ++ .masks = intel_gen6_masks, + .agp_enable = intel_i810_agp_enable, + .cache_flush = global_cache_flush, + .create_gatt_table = intel_i965_create_gatt_table, +@@ -1559,7 +1589,7 @@ static const struct agp_bridge_driver in + .agp_alloc_pages = agp_generic_alloc_pages, + .agp_destroy_page = agp_generic_destroy_page, + .agp_destroy_pages = agp_generic_destroy_pages, +- .agp_type_to_mask_type = intel_i830_type_to_mask_type, ++ .agp_type_to_mask_type = intel_gen6_type_to_mask_type, + .chipset_flush = intel_i915_chipset_flush, + #ifdef USE_PCI_DMA_API + .agp_map_page = intel_agp_map_page, +--- a/drivers/gpu/drm/i915/i915_gem.c ++++ b/drivers/gpu/drm/i915/i915_gem.c +@@ -34,6 +34,7 @@ + #include + #include + #include ++#include + + static void i915_gem_object_flush_gpu_write_domain(struct drm_gem_object *obj); + static void i915_gem_object_flush_gtt_write_domain(struct drm_gem_object *obj); +--- /dev/null ++++ b/include/linux/intel-gtt.h +@@ -0,0 +1,20 @@ ++/* ++ * Common Intel AGPGART and GTT definitions. ++ */ ++#ifndef _INTEL_GTT_H ++#define _INTEL_GTT_H ++ ++#include ++ ++/* This is for Intel only GTT controls. ++ * ++ * Sandybridge: AGP_USER_CACHED_MEMORY default to LLC only ++ */ ++ ++#define AGP_USER_CACHED_MEMORY_LLC_MLC (AGP_USER_TYPES + 2) ++#define AGP_USER_UNCACHED_MEMORY (AGP_USER_TYPES + 4) ++ ++/* flag for GFDT type */ ++#define AGP_USER_CACHED_MEMORY_GFDT (1 << 3) ++ ++#endif diff --git a/queue-2.6.35/alsa-hda-add-ideapad-model-for-conexant-5051-codec.patch b/queue-2.6.35/alsa-hda-add-ideapad-model-for-conexant-5051-codec.patch new file mode 100644 index 00000000000..53a401fe917 --- /dev/null +++ b/queue-2.6.35/alsa-hda-add-ideapad-model-for-conexant-5051-codec.patch @@ -0,0 +1,97 @@ +From f7154de220f14073ef0d76638f85e254ad2e202f Mon Sep 17 00:00:00 2001 +From: Herton Ronaldo Krzesinski +Date: Thu, 17 Jun 2010 14:15:06 -0300 +Subject: ALSA: hda - add ideapad model for Conexant 5051 codec + +From: Herton Ronaldo Krzesinski + +commit f7154de220f14073ef0d76638f85e254ad2e202f upstream. + +Lenovo IdeaPad Y430 has an additional subwoofer connected at pin 0x1b, +which isn't muted when headphone is plugged in. This adds additional +support to the extra subwoofer via new ideapad model. + +Signed-off-by: Herton Ronaldo Krzesinski +Signed-off-by: Takashi Iwai +Cc: David Henningsson +Signed-off-by: Greg Kroah-Hartman + +--- + Documentation/sound/alsa/HD-Audio-Models.txt | 1 + + sound/pci/hda/patch_conexant.c | 20 ++++++++++++++++++++ + 2 files changed, 21 insertions(+) + +--- a/Documentation/sound/alsa/HD-Audio-Models.txt ++++ b/Documentation/sound/alsa/HD-Audio-Models.txt +@@ -282,6 +282,7 @@ Conexant 5051 + hp HP Spartan laptop + hp-dv6736 HP dv6736 + hp-f700 HP Compaq Presario F700 ++ ideapad Lenovo IdeaPad laptop + lenovo-x200 Lenovo X200 laptop + toshiba Toshiba Satellite M300 + +--- a/sound/pci/hda/patch_conexant.c ++++ b/sound/pci/hda/patch_conexant.c +@@ -1633,6 +1633,11 @@ static void cxt5051_update_speaker(struc + pinctl = (!spec->hp_present && spec->cur_eapd) ? PIN_OUT : 0; + snd_hda_codec_write(codec, 0x1a, 0, AC_VERB_SET_PIN_WIDGET_CONTROL, + pinctl); ++ /* on ideapad there is an aditional speaker (subwoofer) to mute */ ++ if (spec->ideapad) ++ snd_hda_codec_write(codec, 0x1b, 0, ++ AC_VERB_SET_PIN_WIDGET_CONTROL, ++ pinctl); + } + + /* turn on/off EAPD (+ mute HP) as a master switch */ +@@ -1889,6 +1894,13 @@ static void cxt5051_init_mic_port(struct + #endif + } + ++static struct hda_verb cxt5051_ideapad_init_verbs[] = { ++ /* Subwoofer */ ++ {0x1b, AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_OUT}, ++ {0x1b, AC_VERB_SET_CONNECT_SEL, 0x00}, ++ { } /* end */ ++}; ++ + /* initialize jack-sensing, too */ + static int cxt5051_init(struct hda_codec *codec) + { +@@ -1918,6 +1930,7 @@ enum { + CXT5051_LENOVO_X200, /* Lenovo X200 laptop, also used for Advanced Mini Dock 250410 */ + CXT5051_F700, /* HP Compaq Presario F700 */ + CXT5051_TOSHIBA, /* Toshiba M300 & co */ ++ CXT5051_IDEAPAD, /* Lenovo IdeaPad Y430 */ + CXT5051_MODELS + }; + +@@ -1928,6 +1941,7 @@ static const char *cxt5051_models[CXT505 + [CXT5051_LENOVO_X200] = "lenovo-x200", + [CXT5051_F700] = "hp-700", + [CXT5051_TOSHIBA] = "toshiba", ++ [CXT5051_IDEAPAD] = "ideapad", + }; + + static struct snd_pci_quirk cxt5051_cfg_tbl[] = { +@@ -1939,6 +1953,7 @@ static struct snd_pci_quirk cxt5051_cfg_ + CXT5051_LAPTOP), + SND_PCI_QUIRK(0x14f1, 0x5051, "HP Spartan 1.1", CXT5051_HP), + SND_PCI_QUIRK(0x17aa, 0x20f2, "Lenovo X200", CXT5051_LENOVO_X200), ++ SND_PCI_QUIRK(0x17aa, 0x3a0d, "Lenovo IdeaPad", CXT5051_IDEAPAD), + {} + }; + +@@ -2000,6 +2015,11 @@ static int patch_cxt5051(struct hda_code + spec->mixers[0] = cxt5051_toshiba_mixers; + spec->auto_mic = AUTO_MIC_PORTB; + break; ++ case CXT5051_IDEAPAD: ++ spec->init_verbs[spec->num_init_verbs++] = ++ cxt5051_ideapad_init_verbs; ++ spec->ideapad = 1; ++ break; + } + + return 0; diff --git a/queue-2.6.35/b44-fix-carrier-detection-on-bind.patch b/queue-2.6.35/b44-fix-carrier-detection-on-bind.patch new file mode 100644 index 00000000000..d590b2f44ab --- /dev/null +++ b/queue-2.6.35/b44-fix-carrier-detection-on-bind.patch @@ -0,0 +1,41 @@ +From bcf64aa379fcadd074449cbf0c049da70071b06f Mon Sep 17 00:00:00 2001 +From: Paul Fertser +Date: Mon, 11 Oct 2010 15:45:35 -0700 +Subject: b44: fix carrier detection on bind + +From: Paul Fertser + +commit bcf64aa379fcadd074449cbf0c049da70071b06f upstream. + +For carrier detection to work properly when binding the driver with a cable +unplugged, netif_carrier_off() should be called after register_netdev(), +not before. + +Signed-off-by: Paul Fertser +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/b44.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/net/b44.c ++++ b/drivers/net/b44.c +@@ -2168,8 +2168,6 @@ static int __devinit b44_init_one(struct + dev->irq = sdev->irq; + SET_ETHTOOL_OPS(dev, &b44_ethtool_ops); + +- netif_carrier_off(dev); +- + err = ssb_bus_powerup(sdev->bus, 0); + if (err) { + dev_err(sdev->dev, +@@ -2209,6 +2207,8 @@ static int __devinit b44_init_one(struct + goto err_out_powerdown; + } + ++ netif_carrier_off(dev); ++ + ssb_set_drvdata(sdev, dev); + + /* Chip reset provides power to the b44 MAC & PCI cores, which diff --git a/queue-2.6.35/execve-improve-interactivity-with-large-arguments.patch b/queue-2.6.35/execve-improve-interactivity-with-large-arguments.patch new file mode 100644 index 00000000000..eede6826c6c --- /dev/null +++ b/queue-2.6.35/execve-improve-interactivity-with-large-arguments.patch @@ -0,0 +1,40 @@ +From 7993bc1f4663c0db67bb8f0d98e6678145b387cd Mon Sep 17 00:00:00 2001 +From: Roland McGrath +Date: Tue, 7 Sep 2010 19:36:28 -0700 +Subject: execve: improve interactivity with large arguments + +From: Roland McGrath + +commit 7993bc1f4663c0db67bb8f0d98e6678145b387cd upstream. + +This adds a preemption point during the copying of the argument and +environment strings for execve, in copy_strings(). There is already +a preemption point in the count() loop, so this doesn't add any new +points in the abstract sense. + +When the total argument+environment strings are very large, the time +spent copying them can be much more than a normal user time slice. +So this change improves the interactivity of the rest of the system +when one process is doing an execve with very large arguments. + +Signed-off-by: Roland McGrath +Reviewed-by: KOSAKI Motohiro +Signed-off-by: Linus Torvalds +Cc: Chuck Ebbert +Signed-off-by: Greg Kroah-Hartman + +--- + fs/exec.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/fs/exec.c ++++ b/fs/exec.c +@@ -420,6 +420,8 @@ static int copy_strings(int argc, char _ + while (len > 0) { + int offset, bytes_to_copy; + ++ cond_resched(); ++ + offset = pos % PAGE_SIZE; + if (offset == 0) + offset = PAGE_SIZE; diff --git a/queue-2.6.35/execve-make-responsive-to-sigkill-with-large-arguments.patch b/queue-2.6.35/execve-make-responsive-to-sigkill-with-large-arguments.patch new file mode 100644 index 00000000000..9cec384e7b6 --- /dev/null +++ b/queue-2.6.35/execve-make-responsive-to-sigkill-with-large-arguments.patch @@ -0,0 +1,54 @@ +From 9aea5a65aa7a1af9a4236dfaeb0088f1624f9919 Mon Sep 17 00:00:00 2001 +From: Roland McGrath +Date: Tue, 7 Sep 2010 19:37:06 -0700 +Subject: execve: make responsive to SIGKILL with large arguments + +From: Roland McGrath + +commit 9aea5a65aa7a1af9a4236dfaeb0088f1624f9919 upstream. + +An execve with a very large total of argument/environment strings +can take a really long time in the execve system call. It runs +uninterruptibly to count and copy all the strings. This change +makes it abort the exec quickly if sent a SIGKILL. + +Note that this is the conservative change, to interrupt only for +SIGKILL, by using fatal_signal_pending(). It would be perfectly +correct semantics to let any signal interrupt the string-copying in +execve, i.e. use signal_pending() instead of fatal_signal_pending(). +We'll save that change for later, since it could have user-visible +consequences, such as having a timer set too quickly make it so that +an execve can never complete, though it always happened to work before. + +Signed-off-by: Roland McGrath +Reviewed-by: KOSAKI Motohiro +Cc: Chuck Ebbert +Signed-off-by: Linus Torvalds + +--- + fs/exec.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/fs/exec.c ++++ b/fs/exec.c +@@ -377,6 +377,9 @@ static int count(char __user * __user * + argv++; + if (i++ >= max) + return -E2BIG; ++ ++ if (fatal_signal_pending(current)) ++ return -ERESTARTNOHAND; + cond_resched(); + } + } +@@ -420,6 +423,10 @@ static int copy_strings(int argc, char _ + while (len > 0) { + int offset, bytes_to_copy; + ++ if (fatal_signal_pending(current)) { ++ ret = -ERESTARTNOHAND; ++ goto out; ++ } + cond_resched(); + + offset = pos % PAGE_SIZE; diff --git a/queue-2.6.35/intel_idle-pci-quirk-to-prevent-lenovo-ideapad-s10-3-boot-hang.patch b/queue-2.6.35/intel_idle-pci-quirk-to-prevent-lenovo-ideapad-s10-3-boot-hang.patch new file mode 100644 index 00000000000..e251a6de901 --- /dev/null +++ b/queue-2.6.35/intel_idle-pci-quirk-to-prevent-lenovo-ideapad-s10-3-boot-hang.patch @@ -0,0 +1,58 @@ +From 4731fdcf6f7bdab3e369a3f844d4ea4d4017284d Mon Sep 17 00:00:00 2001 +From: Len Brown +Date: Fri, 24 Sep 2010 21:02:27 -0400 +Subject: intel_idle: PCI quirk to prevent Lenovo Ideapad s10-3 boot hang + +From: Len Brown + +commit 4731fdcf6f7bdab3e369a3f844d4ea4d4017284d upstream. + +When the Lenovo Ideapad S10-3 is booted with HT enabled, +it hits a boot hang in the intel_idle driver. + +This occurs when entering ATM-C4 for the first time, +unless BM_STS is first cleared. + +acpi_idle doesn't see this because it first checks +and clears BM_STS, but it would hit the same hang +if that check were disabled. + +http://bugs.meego.com/show_bug.cgi?id=7093 +https://bugs.launchpad.net/ubuntu/+source/linux/+bug/634702 + +Signed-off-by: Len Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pci/quirks.c | 20 ++++++++++++++++++++ + 1 file changed, 20 insertions(+) + +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -150,6 +150,26 @@ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_NE + DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_NEC, PCI_DEVICE_ID_NEC_CBUS_3, quirk_isa_dma_hangs); + + /* ++ * Intel NM10 "TigerPoint" LPC PM1a_STS.BM_STS must be clear ++ * for some HT machines to use C4 w/o hanging. ++ */ ++static void __devinit quirk_tigerpoint_bm_sts(struct pci_dev *dev) ++{ ++ u32 pmbase; ++ u16 pm1a; ++ ++ pci_read_config_dword(dev, 0x40, &pmbase); ++ pmbase = pmbase & 0xff80; ++ pm1a = inw(pmbase); ++ ++ if (pm1a & 0x10) { ++ dev_info(&dev->dev, FW_BUG "TigerPoint LPC.BM_STS cleared\n"); ++ outw(0x10, pmbase); ++ } ++} ++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_TGP_LPC, quirk_tigerpoint_bm_sts); ++ ++/* + * Chipsets where PCI->PCI transfers vanish or hang + */ + static void __devinit quirk_nopcipci(struct pci_dev *dev) diff --git a/queue-2.6.35/mm-move-vma_stack_continue-into-mm.h.patch b/queue-2.6.35/mm-move-vma_stack_continue-into-mm.h.patch new file mode 100644 index 00000000000..bd7d80aa78e --- /dev/null +++ b/queue-2.6.35/mm-move-vma_stack_continue-into-mm.h.patch @@ -0,0 +1,63 @@ +From 39aa3cb3e8250db9188a6f1e3fb62ffa1a717678 Mon Sep 17 00:00:00 2001 +From: Stefan Bader +Date: Tue, 31 Aug 2010 15:52:27 +0200 +Subject: mm: Move vma_stack_continue into mm.h + +From: Stefan Bader + +commit 39aa3cb3e8250db9188a6f1e3fb62ffa1a717678 upstream. + +So it can be used by all that need to check for that. + +Signed-off-by: Stefan Bader +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + fs/proc/task_mmu.c | 3 ++- + include/linux/mm.h | 6 ++++++ + mm/mlock.c | 6 ------ + 3 files changed, 8 insertions(+), 7 deletions(-) + +--- a/fs/proc/task_mmu.c ++++ b/fs/proc/task_mmu.c +@@ -224,7 +224,8 @@ static void show_map_vma(struct seq_file + /* We don't show the stack guard page in /proc/maps */ + start = vma->vm_start; + if (vma->vm_flags & VM_GROWSDOWN) +- start += PAGE_SIZE; ++ if (!vma_stack_continue(vma->vm_prev, vma->vm_start)) ++ start += PAGE_SIZE; + + seq_printf(m, "%08lx-%08lx %c%c%c%c %08llx %02x:%02x %lu %n", + start, +--- a/include/linux/mm.h ++++ b/include/linux/mm.h +@@ -863,6 +863,12 @@ int set_page_dirty(struct page *page); + int set_page_dirty_lock(struct page *page); + int clear_page_dirty_for_io(struct page *page); + ++/* Is the vma a continuation of the stack vma above it? */ ++static inline int vma_stack_continue(struct vm_area_struct *vma, unsigned long addr) ++{ ++ return vma && (vma->vm_end == addr) && (vma->vm_flags & VM_GROWSDOWN); ++} ++ + extern unsigned long move_page_tables(struct vm_area_struct *vma, + unsigned long old_addr, struct vm_area_struct *new_vma, + unsigned long new_addr, unsigned long len); +--- a/mm/mlock.c ++++ b/mm/mlock.c +@@ -135,12 +135,6 @@ void munlock_vma_page(struct page *page) + } + } + +-/* Is the vma a continuation of the stack vma above it? */ +-static inline int vma_stack_continue(struct vm_area_struct *vma, unsigned long addr) +-{ +- return vma && (vma->vm_end == addr) && (vma->vm_flags & VM_GROWSDOWN); +-} +- + static inline int stack_guard_page(struct vm_area_struct *vma, unsigned long addr) + { + return (vma->vm_flags & VM_GROWSDOWN) && diff --git a/queue-2.6.35/pm-acpi-blacklist-systems-known-to-require-acpi_sleep-nonvs.patch b/queue-2.6.35/pm-acpi-blacklist-systems-known-to-require-acpi_sleep-nonvs.patch new file mode 100644 index 00000000000..f67a62deb7e --- /dev/null +++ b/queue-2.6.35/pm-acpi-blacklist-systems-known-to-require-acpi_sleep-nonvs.patch @@ -0,0 +1,70 @@ +From 539986482b0db07b7164ab086d167ab99b4d3061 Mon Sep 17 00:00:00 2001 +From: Rafael J. Wysocki +Date: Fri, 24 Sep 2010 16:46:14 -0400 +Subject: PM / ACPI: Blacklist systems known to require acpi_sleep=nonvs + +From: Rafael J. Wysocki + +commit 539986482b0db07b7164ab086d167ab99b4d3061 upstream. + +Commit 2a6b69765ad794389f2fc3e14a0afa1a995221c2 (ACPI: Store NVS +state even when entering suspend to RAM) changed the ACPI suspend +to RAM code so that the NVS memory area is always unconditionally +saved during suspend and restored during resume, since some systems +evidently need that for the suspend-resume to work on them. However, +it turned out that this change broke suspend-resume on a few systems, +so commit 72ad5d77fb981963edae15eee8196c80238f5ed0 (ACPI / Sleep: +Allow the NVS saving to be skipped during suspend to RAM) introduced +the acpi_sleep=nonvs command line switch to allow their users to +work around this issue. To keep track of the systems that require +this workaround and to make the life of their users slightly easier +blacklist them in acpisleep_dmi_table[]. + +https://bugzilla.kernel.org/show_bug.cgi?id=16396 + +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Len Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/acpi/sleep.c | 22 ++++++++++++++++++++++ + 1 file changed, 22 insertions(+) + +--- a/drivers/acpi/sleep.c ++++ b/drivers/acpi/sleep.c +@@ -362,6 +362,12 @@ static int __init init_old_suspend_order + return 0; + } + ++static int __init init_nvs_nosave(const struct dmi_system_id *d) ++{ ++ acpi_nvs_nosave(); ++ return 0; ++} ++ + static struct dmi_system_id __initdata acpisleep_dmi_table[] = { + { + .callback = init_old_suspend_ordering, +@@ -396,6 +402,22 @@ static struct dmi_system_id __initdata a + DMI_MATCH(DMI_BOARD_NAME, "CF51-2L"), + }, + }, ++ { ++ .callback = init_nvs_nosave, ++ .ident = "Sony Vaio VGN-SR11M", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Sony Corporation"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "VGN-SR11M"), ++ }, ++ }, ++ { ++ .callback = init_nvs_nosave, ++ .ident = "Everex StepNote Series", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Everex Systems, Inc."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "Everex StepNote Series"), ++ }, ++ }, + {}, + }; + #endif /* CONFIG_SUSPEND */ diff --git a/queue-2.6.35/series b/queue-2.6.35/series index f00bbe64408..a7344364a99 100644 --- a/queue-2.6.35/series +++ b/queue-2.6.35/series @@ -84,3 +84,20 @@ virtio-console-don-t-block-entire-guest-if-host-doesn-t-read-data.patch acpi-handle-acpi0007-device-in-acpi_early_set_pdc.patch powerpc-initialise-paca-kstack-before-early_setup_secondary.patch powerpc-don-t-use-kernel-stack-with-translation-off.patch +b44-fix-carrier-detection-on-bind.patch +alsa-hda-add-ideapad-model-for-conexant-5051-codec.patch +acpi-enable-repeated-pciexp-wakeup-by-clearing-pciexp_wake_sts-on-resume.patch +intel_idle-pci-quirk-to-prevent-lenovo-ideapad-s10-3-boot-hang.patch +acpi-ec-add-vista-incompatibility-dmi-entry-for-toshiba-satellite-l355.patch +acpi-delete-zepto-idle-nomwait-dmi-quirk.patch +acpi-disable-windows-vista-compatibility-for-toshiba-p305d.patch +pm-acpi-blacklist-systems-known-to-require-acpi_sleep-nonvs.patch +x86-detect-scattered-cpuid-features-earlier.patch +agp-intel-fix-cache-control-for-sandybridge.patch +x86-32-separate-1-1-pagetables-from-swapper_pg_dir.patch +x86-32-fix-dummy-trampoline-related-inline-stubs.patch +x86-mm-fix-config_vmsplit_1g-and-2g_opt-trampoline.patch +setup_arg_pages-diagnose-excessive-argument-size.patch +execve-improve-interactivity-with-large-arguments.patch +execve-make-responsive-to-sigkill-with-large-arguments.patch +mm-move-vma_stack_continue-into-mm.h.patch diff --git a/queue-2.6.35/setup_arg_pages-diagnose-excessive-argument-size.patch b/queue-2.6.35/setup_arg_pages-diagnose-excessive-argument-size.patch new file mode 100644 index 00000000000..e33050eee02 --- /dev/null +++ b/queue-2.6.35/setup_arg_pages-diagnose-excessive-argument-size.patch @@ -0,0 +1,46 @@ +From 1b528181b2ffa14721fb28ad1bd539fe1732c583 Mon Sep 17 00:00:00 2001 +From: Roland McGrath +Date: Tue, 7 Sep 2010 19:35:49 -0700 +Subject: setup_arg_pages: diagnose excessive argument size + +From: Roland McGrath + +commit 1b528181b2ffa14721fb28ad1bd539fe1732c583 upstream. + +The CONFIG_STACK_GROWSDOWN variant of setup_arg_pages() does not +check the size of the argument/environment area on the stack. +When it is unworkably large, shift_arg_pages() hits its BUG_ON. +This is exploitable with a very large RLIMIT_STACK limit, to +create a crash pretty easily. + +Check that the initial stack is not too large to make it possible +to map in any executable. We're not checking that the actual +executable (or intepreter, for binfmt_elf) will fit. So those +mappings might clobber part of the initial stack mapping. But +that is just userland lossage that userland made happen, not a +kernel problem. + +Signed-off-by: Roland McGrath +Reviewed-by: KOSAKI Motohiro +Signed-off-by: Linus Torvalds +Cc: Chuck Ebbert +Signed-off-by: Greg Kroah-Hartman + +--- + fs/exec.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/fs/exec.c ++++ b/fs/exec.c +@@ -594,6 +594,11 @@ int setup_arg_pages(struct linux_binprm + #else + stack_top = arch_align_stack(stack_top); + stack_top = PAGE_ALIGN(stack_top); ++ ++ if (unlikely(stack_top < mmap_min_addr) || ++ unlikely(vma->vm_end - vma->vm_start >= stack_top - mmap_min_addr)) ++ return -ENOMEM; ++ + stack_shift = vma->vm_end - stack_top; + + bprm->p -= stack_shift; diff --git a/queue-2.6.35/x86-32-fix-dummy-trampoline-related-inline-stubs.patch b/queue-2.6.35/x86-32-fix-dummy-trampoline-related-inline-stubs.patch new file mode 100644 index 00000000000..a787183b697 --- /dev/null +++ b/queue-2.6.35/x86-32-fix-dummy-trampoline-related-inline-stubs.patch @@ -0,0 +1,36 @@ +From 8848a91068c018bc91f597038a0f41462a0f88a4 Mon Sep 17 00:00:00 2001 +From: H. Peter Anvin +Date: Wed, 18 Aug 2010 11:42:23 -0700 +Subject: x86-32: Fix dummy trampoline-related inline stubs + +From: H. Peter Anvin + +commit 8848a91068c018bc91f597038a0f41462a0f88a4 upstream. + +Fix dummy inline stubs for trampoline-related functions when no +trampolines exist (until we get rid of the no-trampoline case +entirely.) + +Signed-off-by: H. Peter Anvin +Cc: Joerg Roedel +Cc: Borislav Petkov +LKML-Reference: <4C6C294D.3030404@zytor.com> +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/include/asm/trampoline.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/x86/include/asm/trampoline.h ++++ b/arch/x86/include/asm/trampoline.h +@@ -22,8 +22,8 @@ extern unsigned long setup_trampoline(vo + extern void __init setup_trampoline_page_table(void); + extern void __init reserve_trampoline_memory(void); + #else +-static inline void reserve_trampoline_memory(void) {}; +-extern void __init setup_trampoline_page_table(void) {}; ++static inline void setup_trampoline_page_table(void) {} ++static inline void reserve_trampoline_memory(void) {} + #endif /* CONFIG_X86_TRAMPOLINE */ + + #endif /* __ASSEMBLY__ */ diff --git a/queue-2.6.35/x86-32-separate-1-1-pagetables-from-swapper_pg_dir.patch b/queue-2.6.35/x86-32-separate-1-1-pagetables-from-swapper_pg_dir.patch new file mode 100644 index 00000000000..6153c5e356d --- /dev/null +++ b/queue-2.6.35/x86-32-separate-1-1-pagetables-from-swapper_pg_dir.patch @@ -0,0 +1,252 @@ +From fd89a137924e0710078c3ae855e7cec1c43cb845 Mon Sep 17 00:00:00 2001 +From: Joerg Roedel +Date: Mon, 16 Aug 2010 14:38:33 +0200 +Subject: x86-32: Separate 1:1 pagetables from swapper_pg_dir + +From: Joerg Roedel + +commit fd89a137924e0710078c3ae855e7cec1c43cb845 upstream. + +This patch fixes machine crashes which occur when heavily exercising the +CPU hotplug codepaths on a 32-bit kernel. These crashes are caused by +AMD Erratum 383 and result in a fatal machine check exception. Here's +the scenario: + +1. On 32-bit, the swapper_pg_dir page table is used as the initial page +table for booting a secondary CPU. + +2. To make this work, swapper_pg_dir needs a direct mapping of physical +memory in it (the low mappings). By adding those low, large page (2M) +mappings (PAE kernel), we create the necessary conditions for Erratum +383 to occur. + +3. Other CPUs which do not participate in the off- and onlining game may +use swapper_pg_dir while the low mappings are present (when leave_mm is +called). For all steps below, the CPU referred to is a CPU that is using +swapper_pg_dir, and not the CPU which is being onlined. + +4. The presence of the low mappings in swapper_pg_dir can result +in TLB entries for addresses below __PAGE_OFFSET to be established +speculatively. These TLB entries are marked global and large. + +5. When the CPU with such TLB entry switches to another page table, this +TLB entry remains because it is global. + +6. The process then generates an access to an address covered by the +above TLB entry but there is a permission mismatch - the TLB entry +covers a large global page not accessible to userspace. + +7. Due to this permission mismatch a new 4kb, user TLB entry gets +established. Further, Erratum 383 provides for a small window of time +where both TLB entries are present. This results in an uncorrectable +machine check exception signalling a TLB multimatch which panics the +machine. + +There are two ways to fix this issue: + + 1. Always do a global TLB flush when a new cr3 is loaded and the + old page table was swapper_pg_dir. I consider this a hack hard + to understand and with performance implications + + 2. Do not use swapper_pg_dir to boot secondary CPUs like 64-bit + does. + +This patch implements solution 2. It introduces a trampoline_pg_dir +which has the same layout as swapper_pg_dir with low_mappings. This page +table is used as the initial page table of the booting CPU. Later in the +bringup process, it switches to swapper_pg_dir and does a global TLB +flush. This fixes the crashes in our test cases. + +-v2: switch to swapper_pg_dir right after entering start_secondary() so +that we are able to access percpu data which might not be mapped in the +trampoline page table. + +Signed-off-by: Joerg Roedel +LKML-Reference: <20100816123833.GB28147@aftab> +Signed-off-by: Borislav Petkov +Signed-off-by: H. Peter Anvin +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/include/asm/pgtable_32.h | 1 + + arch/x86/include/asm/trampoline.h | 3 +++ + arch/x86/kernel/head_32.S | 8 +++++++- + arch/x86/kernel/setup.c | 2 ++ + arch/x86/kernel/smpboot.c | 32 +++++++++++++------------------- + arch/x86/kernel/trampoline.c | 18 ++++++++++++++++++ + 6 files changed, 44 insertions(+), 20 deletions(-) + +--- a/arch/x86/include/asm/pgtable_32.h ++++ b/arch/x86/include/asm/pgtable_32.h +@@ -26,6 +26,7 @@ struct mm_struct; + struct vm_area_struct; + + extern pgd_t swapper_pg_dir[1024]; ++extern pgd_t trampoline_pg_dir[1024]; + + static inline void pgtable_cache_init(void) { } + static inline void check_pgt_cache(void) { } +--- a/arch/x86/include/asm/trampoline.h ++++ b/arch/x86/include/asm/trampoline.h +@@ -13,14 +13,17 @@ extern unsigned char *trampoline_base; + + extern unsigned long init_rsp; + extern unsigned long initial_code; ++extern unsigned long initial_page_table; + extern unsigned long initial_gs; + + #define TRAMPOLINE_SIZE roundup(trampoline_end - trampoline_data, PAGE_SIZE) + + extern unsigned long setup_trampoline(void); ++extern void __init setup_trampoline_page_table(void); + extern void __init reserve_trampoline_memory(void); + #else + static inline void reserve_trampoline_memory(void) {}; ++extern void __init setup_trampoline_page_table(void) {}; + #endif /* CONFIG_X86_TRAMPOLINE */ + + #endif /* __ASSEMBLY__ */ +--- a/arch/x86/kernel/head_32.S ++++ b/arch/x86/kernel/head_32.S +@@ -328,7 +328,7 @@ ENTRY(startup_32_smp) + /* + * Enable paging + */ +- movl $pa(swapper_pg_dir),%eax ++ movl pa(initial_page_table), %eax + movl %eax,%cr3 /* set the page table pointer.. */ + movl %cr0,%eax + orl $X86_CR0_PG,%eax +@@ -608,6 +608,8 @@ ignore_int: + .align 4 + ENTRY(initial_code) + .long i386_start_kernel ++ENTRY(initial_page_table) ++ .long pa(swapper_pg_dir) + + /* + * BSS section +@@ -623,6 +625,10 @@ ENTRY(swapper_pg_dir) + #endif + swapper_pg_fixmap: + .fill 1024,4,0 ++#ifdef CONFIG_X86_TRAMPOLINE ++ENTRY(trampoline_pg_dir) ++ .fill 1024,4,0 ++#endif + ENTRY(empty_zero_page) + .fill 4096,1,0 + +--- a/arch/x86/kernel/setup.c ++++ b/arch/x86/kernel/setup.c +@@ -1008,6 +1008,8 @@ void __init setup_arch(char **cmdline_p) + paging_init(); + x86_init.paging.pagetable_setup_done(swapper_pg_dir); + ++ setup_trampoline_page_table(); ++ + tboot_probe(); + + #ifdef CONFIG_X86_64 +--- a/arch/x86/kernel/smpboot.c ++++ b/arch/x86/kernel/smpboot.c +@@ -73,7 +73,6 @@ + + #ifdef CONFIG_X86_32 + u8 apicid_2_node[MAX_APICID]; +-static int low_mappings; + #endif + + /* State of each CPU */ +@@ -300,6 +299,18 @@ notrace static void __cpuinit start_seco + * fragile that we want to limit the things done here to the + * most necessary things. + */ ++ ++#ifdef CONFIG_X86_32 ++ /* ++ * Switch away from the trampoline page-table ++ * ++ * Do this before cpu_init() because it needs to access per-cpu ++ * data which may not be mapped in the trampoline page-table. ++ */ ++ load_cr3(swapper_pg_dir); ++ __flush_tlb_all(); ++#endif ++ + vmi_bringup(); + cpu_init(); + preempt_disable(); +@@ -318,12 +329,6 @@ notrace static void __cpuinit start_seco + legacy_pic->chip->unmask(0); + } + +-#ifdef CONFIG_X86_32 +- while (low_mappings) +- cpu_relax(); +- __flush_tlb_all(); +-#endif +- + /* This must be done before setting cpu_online_mask */ + set_cpu_sibling_map(raw_smp_processor_id()); + wmb(); +@@ -773,6 +778,7 @@ do_rest: + #ifdef CONFIG_X86_32 + /* Stack for startup_32 can be just as for start_secondary onwards */ + irq_ctx_init(cpu); ++ initial_page_table = __pa(&trampoline_pg_dir); + #else + clear_tsk_thread_flag(c_idle.idle, TIF_FORK); + initial_gs = per_cpu_offset(cpu); +@@ -920,20 +926,8 @@ int __cpuinit native_cpu_up(unsigned int + + per_cpu(cpu_state, cpu) = CPU_UP_PREPARE; + +-#ifdef CONFIG_X86_32 +- /* init low mem mapping */ +- clone_pgd_range(swapper_pg_dir, swapper_pg_dir + KERNEL_PGD_BOUNDARY, +- min_t(unsigned long, KERNEL_PGD_PTRS, KERNEL_PGD_BOUNDARY)); +- flush_tlb_all(); +- low_mappings = 1; +- + err = do_boot_cpu(apicid, cpu); + +- zap_low_mappings(false); +- low_mappings = 0; +-#else +- err = do_boot_cpu(apicid, cpu); +-#endif + if (err) { + pr_debug("do_boot_cpu failed %d\n", err); + return -EIO; +--- a/arch/x86/kernel/trampoline.c ++++ b/arch/x86/kernel/trampoline.c +@@ -1,6 +1,7 @@ + #include + + #include ++#include + #include + + #if defined(CONFIG_X86_64) && defined(CONFIG_ACPI_SLEEP) +@@ -37,3 +38,20 @@ unsigned long __trampinit setup_trampoli + memcpy(trampoline_base, trampoline_data, TRAMPOLINE_SIZE); + return virt_to_phys(trampoline_base); + } ++ ++void __init setup_trampoline_page_table(void) ++{ ++#ifdef CONFIG_X86_32 ++ /* Copy kernel address range */ ++ clone_pgd_range(trampoline_pg_dir + KERNEL_PGD_BOUNDARY, ++ swapper_pg_dir + KERNEL_PGD_BOUNDARY, ++ min_t(unsigned long, KERNEL_PGD_PTRS, ++ KERNEL_PGD_BOUNDARY)); ++ ++ /* Initialize low mappings */ ++ clone_pgd_range(trampoline_pg_dir, ++ swapper_pg_dir + KERNEL_PGD_BOUNDARY, ++ min_t(unsigned long, KERNEL_PGD_PTRS, ++ KERNEL_PGD_BOUNDARY)); ++#endif ++} diff --git a/queue-2.6.35/x86-detect-scattered-cpuid-features-earlier.patch b/queue-2.6.35/x86-detect-scattered-cpuid-features-earlier.patch new file mode 100644 index 00000000000..e7b41569da5 --- /dev/null +++ b/queue-2.6.35/x86-detect-scattered-cpuid-features-earlier.patch @@ -0,0 +1,44 @@ +From 1dedefd1a066a795a87afca9c0236e1a94de9bf6 Mon Sep 17 00:00:00 2001 +From: Jacob Pan +Date: Wed, 19 May 2010 12:01:23 -0700 +Subject: x86: detect scattered cpuid features earlier + +From: Jacob Pan + +commit 1dedefd1a066a795a87afca9c0236e1a94de9bf6 upstream. + +Some extra CPU features such as ARAT is needed in early boot so +that x86_init function pointers can be set up properly. +http://lkml.org/lkml/2010/5/18/519 +At start_kernel() level, this patch moves init_scattered_cpuid_features() +from check_bugs() to setup_arch() -> early_cpu_init() which is earlier than +platform specific x86_init layer setup. Suggested by HPA. + +Signed-off-by: Jacob Pan +LKML-Reference: <1274295685-6774-2-git-send-email-jacob.jun.pan@linux.intel.com> +Acked-by: Thomas Gleixner +Signed-off-by: H. Peter Anvin +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/cpu/common.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/x86/kernel/cpu/common.c ++++ b/arch/x86/kernel/cpu/common.c +@@ -576,6 +576,7 @@ void __cpuinit get_cpu_cap(struct cpuinf + if (c->extended_cpuid_level >= 0x80000007) + c->x86_power = cpuid_edx(0x80000007); + ++ init_scattered_cpuid_features(c); + } + + static void __cpuinit identify_cpu_without_cpuid(struct cpuinfo_x86 *c) +@@ -731,7 +732,6 @@ static void __cpuinit generic_identify(s + + get_model_name(c); /* Default name */ + +- init_scattered_cpuid_features(c); + detect_nopl(c); + } + diff --git a/queue-2.6.35/x86-mm-fix-config_vmsplit_1g-and-2g_opt-trampoline.patch b/queue-2.6.35/x86-mm-fix-config_vmsplit_1g-and-2g_opt-trampoline.patch new file mode 100644 index 00000000000..53b9c04d361 --- /dev/null +++ b/queue-2.6.35/x86-mm-fix-config_vmsplit_1g-and-2g_opt-trampoline.patch @@ -0,0 +1,35 @@ +From b7d460897739e02f186425b7276e3fdb1595cea7 Mon Sep 17 00:00:00 2001 +From: Hugh Dickins +Date: Tue, 24 Aug 2010 22:44:12 -0700 +Subject: x86, mm: Fix CONFIG_VMSPLIT_1G and 2G_OPT trampoline + +From: Hugh Dickins + +commit b7d460897739e02f186425b7276e3fdb1595cea7 upstream. + +rc2 kernel crashes when booting second cpu on this CONFIG_VMSPLIT_2G_OPT +laptop: whereas cloning from kernel to low mappings pgd range does need +to limit by both KERNEL_PGD_PTRS and KERNEL_PGD_BOUNDARY, cloning kernel +pgd range itself must not be limited by the smaller KERNEL_PGD_BOUNDARY. + +Signed-off-by: Hugh Dickins +LKML-Reference: +Signed-off-by: H. Peter Anvin +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/trampoline.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/arch/x86/kernel/trampoline.c ++++ b/arch/x86/kernel/trampoline.c +@@ -45,8 +45,7 @@ void __init setup_trampoline_page_table( + /* Copy kernel address range */ + clone_pgd_range(trampoline_pg_dir + KERNEL_PGD_BOUNDARY, + swapper_pg_dir + KERNEL_PGD_BOUNDARY, +- min_t(unsigned long, KERNEL_PGD_PTRS, +- KERNEL_PGD_BOUNDARY)); ++ KERNEL_PGD_PTRS); + + /* Initialize low mappings */ + clone_pgd_range(trampoline_pg_dir,