From: Greg Kroah-Hartman Date: Tue, 13 Apr 2010 21:04:57 +0000 (-0700) Subject: .32 patches X-Git-Tag: v2.6.32.12~41 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=ca9403171e9e8ff14a6142e7942c9f441e07b688;p=thirdparty%2Fkernel%2Fstable-queue.git .32 patches --- diff --git a/queue-2.6.32/arm-6031-1-fix-thumb-2-decompressor.patch b/queue-2.6.32/arm-6031-1-fix-thumb-2-decompressor.patch new file mode 100644 index 00000000000..1bed7f5ee28 --- /dev/null +++ b/queue-2.6.32/arm-6031-1-fix-thumb-2-decompressor.patch @@ -0,0 +1,33 @@ +From d4d9959c099751158c5cf14813fe378e206339c6 Mon Sep 17 00:00:00 2001 +From: Rabin Vincent +Date: Wed, 7 Apr 2010 18:10:20 +0100 +Subject: ARM: 6031/1: fix Thumb-2 decompressor + +From: Rabin Vincent + +commit d4d9959c099751158c5cf14813fe378e206339c6 upstream. + +98e12b5a6e05413 ("ARM: Fix decompressor's kernel size estimation for +ROM=y") broke the Thumb-2 decompressor because it added an entry in the +LC0 table but didn't adjust the offset the Thumb-2 code uses to load the +SP from that table. Fix it. + +Signed-off-by: Rabin Vincent +Signed-off-by: Russell King +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/boot/compressed/head.S | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/arm/boot/compressed/head.S ++++ b/arch/arm/boot/compressed/head.S +@@ -164,7 +164,7 @@ not_angel: + adr r0, LC0 + ARM( ldmia r0, {r1, r2, r3, r4, r5, r6, r11, ip, sp}) + THUMB( ldmia r0, {r1, r2, r3, r4, r5, r6, r11, ip} ) +- THUMB( ldr sp, [r0, #28] ) ++ THUMB( ldr sp, [r0, #32] ) + subs r0, r0, r1 @ calculate the delta offset + + @ if delta is zero, we are diff --git a/queue-2.6.32/cifs-fix-a-kernel-bug-with-remote-os-2-server-try-3.patch b/queue-2.6.32/cifs-fix-a-kernel-bug-with-remote-os-2-server-try-3.patch new file mode 100644 index 00000000000..0c27d1ea6fc --- /dev/null +++ b/queue-2.6.32/cifs-fix-a-kernel-bug-with-remote-os-2-server-try-3.patch @@ -0,0 +1,67 @@ +From 6513a81e9325d712f1bfb9a1d7b750134e49ff18 Mon Sep 17 00:00:00 2001 +From: Suresh Jayaraman +Date: Wed, 31 Mar 2010 12:00:03 +0530 +Subject: cifs: Fix a kernel BUG with remote OS/2 server (try #3) + +From: Suresh Jayaraman + +commit 6513a81e9325d712f1bfb9a1d7b750134e49ff18 upstream. + +While chasing a bug report involving a OS/2 server, I noticed the server sets +pSMBr->CountHigh to a incorrect value even in case of normal writes. This +results in 'nbytes' being computed wrongly and triggers a kernel BUG at +mm/filemap.c. + +void iov_iter_advance(struct iov_iter *i, size_t bytes) +{ + BUG_ON(i->count < bytes); <--- BUG here + +Why the server is setting 'CountHigh' is not clear but only does so after +writing 64k bytes. Though this looks like the server bug, the client side +crash may not be acceptable. + +The workaround is to mask off high 16 bits if the number of bytes written as +returned by the server is greater than the bytes requested by the client as +suggested by Jeff Layton. + +Reviewed-by: Jeff Layton +Signed-off-by: Suresh Jayaraman +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman + +--- + fs/cifs/cifssmb.c | 16 ++++++++++++++++ + 1 file changed, 16 insertions(+) + +--- a/fs/cifs/cifssmb.c ++++ b/fs/cifs/cifssmb.c +@@ -1517,6 +1517,14 @@ CIFSSMBWrite(const int xid, struct cifsT + *nbytes = le16_to_cpu(pSMBr->CountHigh); + *nbytes = (*nbytes) << 16; + *nbytes += le16_to_cpu(pSMBr->Count); ++ ++ /* ++ * Mask off high 16 bits when bytes written as returned by the ++ * server is greater than bytes requested by the client. Some ++ * OS/2 servers are known to set incorrect CountHigh values. ++ */ ++ if (*nbytes > count) ++ *nbytes &= 0xFFFF; + } + + cifs_buf_release(pSMB); +@@ -1605,6 +1613,14 @@ CIFSSMBWrite2(const int xid, struct cifs + *nbytes = le16_to_cpu(pSMBr->CountHigh); + *nbytes = (*nbytes) << 16; + *nbytes += le16_to_cpu(pSMBr->Count); ++ ++ /* ++ * Mask off high 16 bits when bytes written as returned by the ++ * server is greater than bytes requested by the client. OS/2 ++ * servers are known to set incorrect CountHigh values. ++ */ ++ if (*nbytes > count) ++ *nbytes &= 0xFFFF; + } + + /* cifs_small_buf_release(pSMB); */ /* Freed earlier now in SendReceive2 */ diff --git a/queue-2.6.32/cifs-initialize-nbytes-at-the-beginning-of-cifssmbwrite.patch b/queue-2.6.32/cifs-initialize-nbytes-at-the-beginning-of-cifssmbwrite.patch new file mode 100644 index 00000000000..d506fe3e39a --- /dev/null +++ b/queue-2.6.32/cifs-initialize-nbytes-at-the-beginning-of-cifssmbwrite.patch @@ -0,0 +1,42 @@ +From a24e2d7d8f512340991ef0a59cb5d08d491b8e98 Mon Sep 17 00:00:00 2001 +From: Steve French +Date: Sat, 3 Apr 2010 17:20:21 +0000 +Subject: CIFS: initialize nbytes at the beginning of CIFSSMBWrite() + +From: Steve French + +commit a24e2d7d8f512340991ef0a59cb5d08d491b8e98 upstream. + +By doing this we always overwrite nbytes value that is being passed on to +CIFSSMBWrite() and need not rely on the callers to initialize. CIFSSMBWrite2 is +doing this already. + +Reviewed-by: Shirish Pargaonkar +Reviewed-by: Jeff Layton +Signed-off-by: Suresh Jayaraman +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman + +--- + fs/cifs/cifssmb.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/fs/cifs/cifssmb.c ++++ b/fs/cifs/cifssmb.c +@@ -1430,6 +1430,8 @@ CIFSSMBWrite(const int xid, struct cifsT + __u32 bytes_sent; + __u16 byte_count; + ++ *nbytes = 0; ++ + /* cFYI(1, ("write at %lld %d bytes", offset, count));*/ + if (tcon->ses == NULL) + return -ECONNABORTED; +@@ -1512,7 +1514,6 @@ CIFSSMBWrite(const int xid, struct cifsT + cifs_stats_inc(&tcon->num_writes); + if (rc) { + cFYI(1, ("Send error in write = %d", rc)); +- *nbytes = 0; + } else { + *nbytes = le16_to_cpu(pSMBr->CountHigh); + *nbytes = (*nbytes) << 16; diff --git a/queue-2.6.32/drm-edid-quirks-envision-en2028.patch b/queue-2.6.32/drm-edid-quirks-envision-en2028.patch new file mode 100644 index 00000000000..dfb2383c734 --- /dev/null +++ b/queue-2.6.32/drm-edid-quirks-envision-en2028.patch @@ -0,0 +1,32 @@ +From ba1163de2f74d624e7b0e530c4104c98ede0045a Mon Sep 17 00:00:00 2001 +From: Adam Jackson +Date: Tue, 6 Apr 2010 16:11:00 +0000 +Subject: drm/edid/quirks: Envision EN2028 + +From: Adam Jackson + +commit ba1163de2f74d624e7b0e530c4104c98ede0045a upstream. + +Claims 1280x1024 preferred, physically 1600x1200 + +cf. http://bugzilla.redhat.com/530399 + +Signed-off-by: Adam Jackson +Signed-off-by: Dave Airlie +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/drm_edid.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/gpu/drm/drm_edid.c ++++ b/drivers/gpu/drm/drm_edid.c +@@ -85,6 +85,8 @@ static struct edid_quirk { + + /* Envision Peripherals, Inc. EN-7100e */ + { "EPI", 59264, EDID_QUIRK_135_CLOCK_TOO_HIGH }, ++ /* Envision EN2028 */ ++ { "EPI", 8232, EDID_QUIRK_PREFER_LARGE_60 }, + + /* Funai Electronics PM36B */ + { "FCM", 13600, EDID_QUIRK_PREFER_LARGE_75 | diff --git a/queue-2.6.32/drm-radeon-kms-fix-washed-out-image-on-legacy-tv-dac.patch b/queue-2.6.32/drm-radeon-kms-fix-washed-out-image-on-legacy-tv-dac.patch new file mode 100644 index 00000000000..c8c48848b55 --- /dev/null +++ b/queue-2.6.32/drm-radeon-kms-fix-washed-out-image-on-legacy-tv-dac.patch @@ -0,0 +1,31 @@ +From 643acacf02679befd0f98ac3c5fecb805f1c9548 Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Mon, 5 Apr 2010 23:57:52 -0400 +Subject: drm/radeon/kms: fix washed out image on legacy tv dac + +From: Alex Deucher + +commit 643acacf02679befd0f98ac3c5fecb805f1c9548 upstream. + +bad cast was overwriting the tvdac adj values +Fixes fdo bug 27478 + +Signed-off-by: Alex Deucher +Signed-off-by: Dave Airlie +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/radeon/radeon_connectors.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/radeon/radeon_connectors.c ++++ b/drivers/gpu/drm/radeon/radeon_connectors.c +@@ -281,7 +281,7 @@ int radeon_connector_set_property(struct + radeon_encoder = to_radeon_encoder(encoder); + if (!radeon_encoder->enc_priv) + return 0; +- if (rdev->is_atom_bios) { ++ if (ASIC_IS_AVIVO(rdev) || radeon_r4xx_atom) { + struct radeon_encoder_atom_dac *dac_int; + dac_int = radeon_encoder->enc_priv; + dac_int->tv_std = val; diff --git a/queue-2.6.32/drm-radeon-r300-ad-only-has-one-quad-pipe.patch b/queue-2.6.32/drm-radeon-r300-ad-only-has-one-quad-pipe.patch new file mode 100644 index 00000000000..1192864a9bc --- /dev/null +++ b/queue-2.6.32/drm-radeon-r300-ad-only-has-one-quad-pipe.patch @@ -0,0 +1,79 @@ +From 57b54ea6b7863ccfeb41851b5f58f9fd1b83c79e Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Michel=20D=C3=A4nzer?= +Date: Fri, 2 Apr 2010 16:59:06 +0000 +Subject: drm/radeon: R300 AD only has one quad pipe. +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: =?UTF-8?q?Michel=20D=C3=A4nzer?= + +commit 57b54ea6b7863ccfeb41851b5f58f9fd1b83c79e upstream. + +Gleaned from the Mesa code. + +Fixes https://bugs.freedesktop.org/show_bug.cgi?id=27355 . + +Signed-off-by: Michel Dänzer +Signed-off-by: Dave Airlie +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/radeon/r300.c | 5 +++-- + drivers/gpu/drm/radeon/radeon_cp.c | 10 ++++++---- + 2 files changed, 9 insertions(+), 6 deletions(-) + +--- a/drivers/gpu/drm/radeon/r300.c ++++ b/drivers/gpu/drm/radeon/r300.c +@@ -346,11 +346,12 @@ void r300_gpu_init(struct radeon_device + + r100_hdp_reset(rdev); + /* FIXME: rv380 one pipes ? */ +- if ((rdev->family == CHIP_R300) || (rdev->family == CHIP_R350)) { ++ if ((rdev->family == CHIP_R300 && rdev->pdev->device != 0x4144) || ++ (rdev->family == CHIP_R350)) { + /* r300,r350 */ + rdev->num_gb_pipes = 2; + } else { +- /* rv350,rv370,rv380 */ ++ /* rv350,rv370,rv380,r300 AD */ + rdev->num_gb_pipes = 1; + } + rdev->num_z_pipes = 1; +--- a/drivers/gpu/drm/radeon/radeon_cp.c ++++ b/drivers/gpu/drm/radeon/radeon_cp.c +@@ -417,8 +417,9 @@ static int radeon_do_wait_for_idle(drm_r + return -EBUSY; + } + +-static void radeon_init_pipes(drm_radeon_private_t *dev_priv) ++static void radeon_init_pipes(struct drm_device *dev) + { ++ drm_radeon_private_t *dev_priv = dev->dev_private; + uint32_t gb_tile_config, gb_pipe_sel = 0; + + if ((dev_priv->flags & RADEON_FAMILY_MASK) == CHIP_RV530) { +@@ -436,11 +437,12 @@ static void radeon_init_pipes(drm_radeon + dev_priv->num_gb_pipes = ((gb_pipe_sel >> 12) & 0x3) + 1; + } else { + /* R3xx */ +- if (((dev_priv->flags & RADEON_FAMILY_MASK) == CHIP_R300) || ++ if (((dev_priv->flags & RADEON_FAMILY_MASK) == CHIP_R300 && ++ dev->pdev->device != 0x4144) || + ((dev_priv->flags & RADEON_FAMILY_MASK) == CHIP_R350)) { + dev_priv->num_gb_pipes = 2; + } else { +- /* R3Vxx */ ++ /* RV3xx/R300 AD */ + dev_priv->num_gb_pipes = 1; + } + } +@@ -736,7 +738,7 @@ static int radeon_do_engine_reset(struct + + /* setup the raster pipes */ + if ((dev_priv->flags & RADEON_FAMILY_MASK) >= CHIP_R300) +- radeon_init_pipes(dev_priv); ++ radeon_init_pipes(dev); + + /* Reset the CP ring */ + radeon_do_cp_reset(dev_priv); diff --git a/queue-2.6.32/iwlwifi-need-check-for-valid-qos-packet-before-free.patch b/queue-2.6.32/iwlwifi-need-check-for-valid-qos-packet-before-free.patch new file mode 100644 index 00000000000..f48c3441efc --- /dev/null +++ b/queue-2.6.32/iwlwifi-need-check-for-valid-qos-packet-before-free.patch @@ -0,0 +1,54 @@ +From ece6444c2fe80dab679beb5f0d58b091f1933b00 Mon Sep 17 00:00:00 2001 +From: Wey-Yi Guy +Date: Thu, 8 Apr 2010 13:17:37 -0700 +Subject: iwlwifi: need check for valid qos packet before free + +From: Wey-Yi Guy + +commit ece6444c2fe80dab679beb5f0d58b091f1933b00 upstream. + +For 4965, need to check it is valid qos frame before free, only valid +QoS frame has the tid used to free the packets. + +Signed-off-by: Wey-Yi Guy +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/iwlwifi/iwl-4965.c | 13 +++++++++---- + 1 file changed, 9 insertions(+), 4 deletions(-) + +--- a/drivers/net/wireless/iwlwifi/iwl-4965.c ++++ b/drivers/net/wireless/iwlwifi/iwl-4965.c +@@ -2134,7 +2134,9 @@ static void iwl4965_rx_reply_tx(struct i + IWL_DEBUG_TX_REPLY(priv, "Retry scheduler reclaim scd_ssn " + "%d index %d\n", scd_ssn , index); + freed = iwl_tx_queue_reclaim(priv, txq_id, index); +- iwl_free_tfds_in_queue(priv, sta_id, tid, freed); ++ if (qc) ++ iwl_free_tfds_in_queue(priv, sta_id, ++ tid, freed); + + if (priv->mac80211_registered && + (iwl_queue_space(&txq->q) > txq->q.low_mark) && +@@ -2161,14 +2163,17 @@ static void iwl4965_rx_reply_tx(struct i + tx_resp->failure_frame); + + freed = iwl_tx_queue_reclaim(priv, txq_id, index); +- iwl_free_tfds_in_queue(priv, sta_id, tid, freed); ++ if (qc && likely(sta_id != IWL_INVALID_STATION)) ++ iwl_free_tfds_in_queue(priv, sta_id, tid, freed); ++ else if (sta_id == IWL_INVALID_STATION) ++ IWL_DEBUG_TX_REPLY(priv, "Station not known\n"); + + if (priv->mac80211_registered && + (iwl_queue_space(&txq->q) > txq->q.low_mark)) + iwl_wake_queue(priv, txq_id); + } +- +- iwl_txq_check_empty(priv, sta_id, tid, txq_id); ++ if (qc && likely(sta_id != IWL_INVALID_STATION)) ++ iwl_txq_check_empty(priv, sta_id, tid, txq_id); + + if (iwl_check_bits(status, TX_ABORT_REQUIRED_MSK)) + IWL_ERR(priv, "TODO: Implement Tx ABORT REQUIRED!!!\n"); diff --git a/queue-2.6.32/mac80211-handle-mesh-action-frames-in-ieee80211_rx_h_action.patch b/queue-2.6.32/mac80211-handle-mesh-action-frames-in-ieee80211_rx_h_action.patch new file mode 100644 index 00000000000..2360361a6e3 --- /dev/null +++ b/queue-2.6.32/mac80211-handle-mesh-action-frames-in-ieee80211_rx_h_action.patch @@ -0,0 +1,52 @@ +From 1cb561f83793191cf86a2db3948d28f5f42df9ff Mon Sep 17 00:00:00 2001 +From: Javier Cardona +Date: Mon, 29 Mar 2010 11:00:20 -0700 +Subject: mac80211: Handle mesh action frames in ieee80211_rx_h_action + +From: Javier Cardona + +commit 1cb561f83793191cf86a2db3948d28f5f42df9ff upstream. + +This fixes the problem introduced in commit +8404080568613d93ad7cf0a16dfb68 which broke mesh peer link establishment. + +changes: +v2 Added missing break (Johannes) +v3 Broke original patch into two (Johannes) + +Signed-off-by: Javier Cardona +Reviewed-by: Johannes Berg +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + net/mac80211/mesh.c | 3 --- + net/mac80211/rx.c | 5 +++++ + 2 files changed, 5 insertions(+), 3 deletions(-) + +--- a/net/mac80211/mesh.c ++++ b/net/mac80211/mesh.c +@@ -704,9 +704,6 @@ ieee80211_mesh_rx_mgmt(struct ieee80211_ + + switch (fc & IEEE80211_FCTL_STYPE) { + case IEEE80211_STYPE_ACTION: +- if (skb->len < IEEE80211_MIN_ACTION_SIZE) +- return RX_DROP_MONITOR; +- /* fall through */ + case IEEE80211_STYPE_PROBE_RESP: + case IEEE80211_STYPE_BEACON: + skb_queue_tail(&ifmsh->skb_queue, skb); +--- a/net/mac80211/rx.c ++++ b/net/mac80211/rx.c +@@ -2038,6 +2038,11 @@ static void ieee80211_invoke_rx_handlers + case RX_QUEUED: + I802_DEBUG_INC(sdata->local->rx_handlers_queued); + break; ++ case MESH_PLINK_CATEGORY: ++ case MESH_PATH_SEL_CATEGORY: ++ if (ieee80211_vif_is_mesh(&sdata->vif)) ++ return ieee80211_mesh_rx_mgmt(sdata, rx->skb); ++ break; + } + } + diff --git a/queue-2.6.32/series b/queue-2.6.32/series index 5192e698aa7..016f15379ca 100644 --- a/queue-2.6.32/series +++ b/queue-2.6.32/series @@ -79,3 +79,15 @@ eeepc-laptop-add-hotplug_disable-parameter.patch eeepc-laptop-disable-wireless-hotplug-for-1201n.patch eeepc-laptop-disable-wireless-hotplug-for-1005pe.patch libata-disable-ncq-on-crucial-c300-ssd.patch +cifs-fix-a-kernel-bug-with-remote-os-2-server-try-3.patch +cifs-initialize-nbytes-at-the-beginning-of-cifssmbwrite.patch +iwlwifi-need-check-for-valid-qos-packet-before-free.patch +mac80211-handle-mesh-action-frames-in-ieee80211_rx_h_action.patch +arm-6031-1-fix-thumb-2-decompressor.patch +drm-edid-quirks-envision-en2028.patch +drm-radeon-r300-ad-only-has-one-quad-pipe.patch +drm-radeon-kms-fix-washed-out-image-on-legacy-tv-dac.patch +x86-32-resume-do-a-global-tlb-flush-in-s4-resume.patch +x86-hpet-make-warn_on-understandable.patch +x86-hpet-erratum-workaround-for-read-after-write-of-hpet-comparator.patch +x86-fix-double-enable_ir_x2apic-call-on-smp-kernel-on-smp-boards.patch diff --git a/queue-2.6.32/x86-32-resume-do-a-global-tlb-flush-in-s4-resume.patch b/queue-2.6.32/x86-32-resume-do-a-global-tlb-flush-in-s4-resume.patch new file mode 100644 index 00000000000..d7dcd66ab23 --- /dev/null +++ b/queue-2.6.32/x86-32-resume-do-a-global-tlb-flush-in-s4-resume.patch @@ -0,0 +1,71 @@ +From 8ae06d223f8203c72104e5c0c4ee49a000aedb42 Mon Sep 17 00:00:00 2001 +From: Shaohua Li +Date: Fri, 5 Mar 2010 08:59:32 +0800 +Subject: x86-32, resume: do a global tlb flush in S4 resume + +From: Shaohua Li + +commit 8ae06d223f8203c72104e5c0c4ee49a000aedb42 upstream. + +Colin King reported a strange oops in S4 resume code path (see below). The test +system has i5/i7 CPU. The kernel doesn't open PAE, so 4M page table is used. +The oops always happen a virtual address 0xc03ff000, which is mapped to the +last 4k of first 4M memory. Doing a global tlb flush fixes the issue. + +EIP: 0060:[] EFLAGS: 00010086 CPU: 0 +EIP is at copy_loop+0xe/0x15 +EAX: 36aeb000 EBX: 00000000 ECX: 00000400 EDX: f55ad46c +ESI: 0f800000 EDI: c03ff000 EBP: f67fbec4 ESP: f67fbea8 +DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068 +... +... +CR2: 00000000c03ff000 + +Tested-by: Colin Ian King +Signed-off-by: Shaohua Li +LKML-Reference: <20100305005932.GA22675@sli10-desk.sh.intel.com> +Acked-by: Rafael J. Wysocki +Signed-off-by: H. Peter Anvin +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/power/hibernate_asm_32.S | 15 +++++++-------- + 1 file changed, 7 insertions(+), 8 deletions(-) + +--- a/arch/x86/power/hibernate_asm_32.S ++++ b/arch/x86/power/hibernate_asm_32.S +@@ -27,10 +27,17 @@ ENTRY(swsusp_arch_suspend) + ret + + ENTRY(restore_image) ++ movl mmu_cr4_features, %ecx + movl resume_pg_dir, %eax + subl $__PAGE_OFFSET, %eax + movl %eax, %cr3 + ++ jecxz 1f # cr4 Pentium and higher, skip if zero ++ andl $~(X86_CR4_PGE), %ecx ++ movl %ecx, %cr4; # turn off PGE ++ movl %cr3, %eax; # flush TLB ++ movl %eax, %cr3 ++1: + movl restore_pblist, %edx + .p2align 4,,7 + +@@ -54,16 +61,8 @@ done: + movl $swapper_pg_dir, %eax + subl $__PAGE_OFFSET, %eax + movl %eax, %cr3 +- /* Flush TLB, including "global" things (vmalloc) */ + movl mmu_cr4_features, %ecx + jecxz 1f # cr4 Pentium and higher, skip if zero +- movl %ecx, %edx +- andl $~(X86_CR4_PGE), %edx +- movl %edx, %cr4; # turn off PGE +-1: +- movl %cr3, %eax; # flush TLB +- movl %eax, %cr3 +- jecxz 1f # cr4 Pentium and higher, skip if zero + movl %ecx, %cr4; # turn PGE back on + 1: + diff --git a/queue-2.6.32/x86-fix-double-enable_ir_x2apic-call-on-smp-kernel-on-smp-boards.patch b/queue-2.6.32/x86-fix-double-enable_ir_x2apic-call-on-smp-kernel-on-smp-boards.patch new file mode 100644 index 00000000000..74c641c3032 --- /dev/null +++ b/queue-2.6.32/x86-fix-double-enable_ir_x2apic-call-on-smp-kernel-on-smp-boards.patch @@ -0,0 +1,52 @@ +From 472a474c6630efd195d3738339fd1bdc8aa3b1aa Mon Sep 17 00:00:00 2001 +From: Suresh Siddha +Date: Wed, 31 Mar 2010 18:04:47 -0700 +Subject: x86: Fix double enable_IR_x2apic() call on SMP kernel on !SMP boards + +From: Suresh Siddha + +commit 472a474c6630efd195d3738339fd1bdc8aa3b1aa upstream. + +Jan Grossmann reported kernel boot panic while booting SMP +kernel on his system with a single core cpu. SMP kernels call +enable_IR_x2apic() from native_smp_prepare_cpus() and on +platforms where the kernel doesn't find SMP configuration we +ended up again calling enable_IR_x2apic() from the +APIC_init_uniprocessor() call in the smp_sanity_check(). Thus +leading to kernel panic. + +Don't call enable_IR_x2apic() and default_setup_apic_routing() +from APIC_init_uniprocessor() in CONFIG_SMP case. + +NOTE: this kind of non-idempotent and assymetric initialization +sequence is rather fragile and unclean, we'll clean that up +in v2.6.35. This is the minimal fix for v2.6.34. + +Reported-by: Jan.Grossmann@kielnet.net +Signed-off-by: Suresh Siddha +Cc: +Cc: +Cc: +Cc: +Cc: +LKML-Reference: <1270083887.7835.78.camel@sbs-t61.sc.intel.com> +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/apic/apic.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/arch/x86/kernel/apic/apic.c ++++ b/arch/x86/kernel/apic/apic.c +@@ -1664,8 +1664,10 @@ int __init APIC_init_uniprocessor(void) + } + #endif + ++#ifndef CONFIG_SMP + enable_IR_x2apic(); + default_setup_apic_routing(); ++#endif + + verify_local_APIC(); + connect_bsp_APIC(); diff --git a/queue-2.6.32/x86-hpet-erratum-workaround-for-read-after-write-of-hpet-comparator.patch b/queue-2.6.32/x86-hpet-erratum-workaround-for-read-after-write-of-hpet-comparator.patch new file mode 100644 index 00000000000..55ad31d23d5 --- /dev/null +++ b/queue-2.6.32/x86-hpet-erratum-workaround-for-read-after-write-of-hpet-comparator.patch @@ -0,0 +1,89 @@ +From 8da854cb02156c90028233ae1e85ce46a1d3f82c Mon Sep 17 00:00:00 2001 +From: Pallipadi, Venkatesh +Date: Thu, 25 Feb 2010 10:53:48 -0800 +Subject: x86, hpet: Erratum workaround for read after write of HPET comparator + +From: Pallipadi, Venkatesh + +commit 8da854cb02156c90028233ae1e85ce46a1d3f82c upstream. + +On Wed, Feb 24, 2010 at 03:37:04PM -0800, Justin Piszcz wrote: +> Hello, +> +> Again, on the Intel DP55KG board: +> +> # uname -a +> Linux host 2.6.33 #1 SMP Wed Feb 24 18:31:00 EST 2010 x86_64 GNU/Linux +> +> [ 1.237600] ------------[ cut here ]------------ +> [ 1.237890] WARNING: at arch/x86/kernel/hpet.c:404 hpet_next_event+0x70/0x80() +> [ 1.238221] Hardware name: +> [ 1.238504] hpet: compare register read back failed. +> [ 1.238793] Modules linked in: +> [ 1.239315] Pid: 0, comm: swapper Not tainted 2.6.33 #1 +> [ 1.239605] Call Trace: +> [ 1.239886] [] ? warn_slowpath_common+0x73/0xb0 +> [ 1.240409] [] ? tick_dev_program_event+0x38/0xc0 +> [ 1.240699] [] ? warn_slowpath_fmt+0x40/0x50 +> [ 1.240992] [] ? tick_dev_program_event+0x38/0xc0 +> [ 1.241281] [] ? hpet_next_event+0x70/0x80 +> [ 1.241573] [] ? tick_dev_program_event+0x38/0xc0 +> [ 1.241859] [] ? tick_handle_oneshot_broadcast+0xe2/0x100 +> [ 1.246533] [] ? timer_interrupt+0x1a/0x30 +> [ 1.246826] [] ? handle_IRQ_event+0x39/0xd0 +> [ 1.247118] [] ? handle_edge_irq+0xb8/0x160 +> [ 1.247407] [] ? handle_irq+0x15/0x20 +> [ 1.247689] [] ? do_IRQ+0x62/0xe0 +> [ 1.247976] [] ? ret_from_intr+0x0/0xa +> [ 1.248262] [] ? mwait_idle+0x57/0x80 +> [ 1.248796] [] ? cpu_idle+0x5c/0xb0 +> [ 1.249080] ---[ end trace db7f668fb6fef4e1 ]--- +> +> Is this something Intel has to fix or is it a bug in the kernel? + +This is a chipset erratum. + +Thomas: You mentioned we can retain this check only for known-buggy and +hpet debug kind of options. But here is the simple workaround patch for +this particular erratum. + +Some chipsets have a erratum due to which read immediately following a +write of HPET comparator returns old comparator value instead of most +recently written value. + +Erratum 15 in +"Intel I/O Controller Hub 9 (ICH9) Family Specification Update" +(http://www.intel.com/assets/pdf/specupdate/316973.pdf) + +Workaround for the errata is to read the comparator twice if the first +one fails. + +Signed-off-by: Venkatesh Pallipadi +LKML-Reference: <20100225185348.GA9674@linux-os.sc.intel.com> +Signed-off-by: H. Peter Anvin +Cc: Venkatesh Pallipadi +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/hpet.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +--- a/arch/x86/kernel/hpet.c ++++ b/arch/x86/kernel/hpet.c +@@ -398,9 +398,15 @@ static int hpet_next_event(unsigned long + * then we might have a real hardware problem. We can not do + * much about it here, but at least alert the user/admin with + * a prominent warning. ++ * An erratum on some chipsets (ICH9,..), results in comparator read ++ * immediately following a write returning old value. Workaround ++ * for this is to read this value second time, when first ++ * read returns old value. + */ +- WARN_ONCE((u32)hpet_readl(HPET_Tn_CMP(timer)) != cnt, ++ if (unlikely((u32)hpet_readl(HPET_Tn_CMP(timer)) != cnt)) { ++ WARN_ONCE((u32)hpet_readl(HPET_Tn_CMP(timer)) != cnt, + KERN_WARNING "hpet: compare register read back failed.\n"); ++ } + + return (s32)((u32)hpet_readl(HPET_COUNTER) - cnt) >= 0 ? -ETIME : 0; + } diff --git a/queue-2.6.32/x86-hpet-make-warn_on-understandable.patch b/queue-2.6.32/x86-hpet-make-warn_on-understandable.patch new file mode 100644 index 00000000000..64f5707a09d --- /dev/null +++ b/queue-2.6.32/x86-hpet-make-warn_on-understandable.patch @@ -0,0 +1,56 @@ +From 18ed61da985c57eea3fe8038b13fa2837c9b3c3f Mon Sep 17 00:00:00 2001 +From: Thomas Gleixner +Date: Fri, 27 Nov 2009 15:24:44 +0100 +Subject: x86: hpet: Make WARN_ON understandable + +From: Thomas Gleixner + +commit 18ed61da985c57eea3fe8038b13fa2837c9b3c3f upstream. + +Andrew complained rightly that the WARN_ON in hpet_next_event() is +confusing and the code comment not really helpful. + +Change it to WARN_ONCE and print the reason in clear text. Change the +comment to explain what kind of hardware wreckage we deal with. + +Pointed-out-by: Andrew Morton +Signed-off-by: Thomas Gleixner +Cc: Venki Pallipadi +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/hpet.c | 23 +++++++++++++++++------ + 1 file changed, 17 insertions(+), 6 deletions(-) + +--- a/arch/x86/kernel/hpet.c ++++ b/arch/x86/kernel/hpet.c +@@ -384,12 +384,23 @@ static int hpet_next_event(unsigned long + cnt += (u32) delta; + hpet_writel(cnt, HPET_Tn_CMP(timer)); + +- /* +- * We need to read back the CMP register to make sure that +- * what we wrote hit the chip before we compare it to the +- * counter. +- */ +- WARN_ON_ONCE((u32)hpet_readl(HPET_Tn_CMP(timer)) != cnt); ++ /* ++ * We need to read back the CMP register on certain HPET ++ * implementations (ATI chipsets) which seem to delay the ++ * transfer of the compare register into the internal compare ++ * logic. With small deltas this might actually be too late as ++ * the counter could already be higher than the compare value ++ * at that point and we would wait for the next hpet interrupt ++ * forever. We found out that reading the CMP register back ++ * forces the transfer so we can rely on the comparison with ++ * the counter register below. If the read back from the ++ * compare register does not match the value we programmed ++ * then we might have a real hardware problem. We can not do ++ * much about it here, but at least alert the user/admin with ++ * a prominent warning. ++ */ ++ WARN_ONCE((u32)hpet_readl(HPET_Tn_CMP(timer)) != cnt, ++ KERN_WARNING "hpet: compare register read back failed.\n"); + + return (s32)((u32)hpet_readl(HPET_COUNTER) - cnt) >= 0 ? -ETIME : 0; + }