From: Greg Kroah-Hartman Date: Wed, 16 Sep 2009 22:16:48 +0000 (-0700) Subject: start .27 review cycle X-Git-Tag: v2.6.30.8~4 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=d672be7ce3e900a3709028b80dc51f4663aaf272;p=thirdparty%2Fkernel%2Fstable-queue.git start .27 review cycle --- diff --git a/queue-2.6.27/alsa-cs46xx-fix-minimum-period-size.patch b/review-2.6.27/alsa-cs46xx-fix-minimum-period-size.patch similarity index 100% rename from queue-2.6.27/alsa-cs46xx-fix-minimum-period-size.patch rename to review-2.6.27/alsa-cs46xx-fix-minimum-period-size.patch diff --git a/queue-2.6.27/binfmt_elf-fix-pt_interp-bss-handling.patch b/review-2.6.27/binfmt_elf-fix-pt_interp-bss-handling.patch similarity index 100% rename from queue-2.6.27/binfmt_elf-fix-pt_interp-bss-handling.patch rename to review-2.6.27/binfmt_elf-fix-pt_interp-bss-handling.patch diff --git a/queue-2.6.27/libata-fix-off-by-one-error-in-ata_tf_read_block.patch b/review-2.6.27/libata-fix-off-by-one-error-in-ata_tf_read_block.patch similarity index 100% rename from queue-2.6.27/libata-fix-off-by-one-error-in-ata_tf_read_block.patch rename to review-2.6.27/libata-fix-off-by-one-error-in-ata_tf_read_block.patch diff --git a/review-2.6.27/mbox b/review-2.6.27/mbox new file mode 100644 index 00000000000..5794db35d52 --- /dev/null +++ b/review-2.6.27/mbox @@ -0,0 +1,1052 @@ +From gregkh@mini.kroah.org Wed Sep 16 15:15:05 2009 +Message-Id: <20090916221505.716776628@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Sep 2009 15:13:21 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Roland McGrath , + James Morris +Subject: [patch 01/10] binfmt_elf: fix PT_INTERP bss handling +References: <20090916221320.283781925@mini.kroah.org> +Content-Disposition: inline; filename=binfmt_elf-fix-pt_interp-bss-handling.patch +Content-Length: 2694 +Lines: 83 + +From: Roland McGrath + +commit 9f0ab4a3f0fdb1ff404d150618ace2fa069bb2e1 upstream. + +In fs/binfmt_elf.c, load_elf_interp() calls padzero() for .bss even if +the PT_LOAD has no PROT_WRITE and no .bss. This generates EFAULT. + +Here is a small test case. (Yes, there are other, useful PT_INTERP +which have only .text and no .data/.bss.) + + ----- ptinterp.S + _start: .globl _start + nop + int3 + ----- + $ gcc -m32 -nostartfiles -nostdlib -o ptinterp ptinterp.S + $ gcc -m32 -Wl,--dynamic-linker=ptinterp -o hello hello.c + $ ./hello + Segmentation fault # during execve() itself + + After applying the patch: + $ ./hello + Trace trap # user-mode execution after execve() finishes + +If the ELF headers are actually self-inconsistent, then dying is fine. +But having no PROT_WRITE segment is perfectly normal and correct if +there is no segment with p_memsz > p_filesz (i.e. bss). John Reiser +suggested checking for PROT_WRITE in the bss logic. I think it makes +most sense to simply apply the bss logic only when there is bss. + +This patch looks less trivial than it is due to some reindentation. +It just moves the "if (last_bss > elf_bss) {" test up to include the +partial-page bss logic as well as the more-pages bss logic. + +Reported-by: John Reiser +Signed-off-by: Roland McGrath +Signed-off-by: James Morris +Signed-off-by: Greg Kroah-Hartman + +--- + fs/binfmt_elf.c | 28 ++++++++++++++-------------- + 1 file changed, 14 insertions(+), 14 deletions(-) + +--- a/fs/binfmt_elf.c ++++ b/fs/binfmt_elf.c +@@ -496,22 +496,22 @@ static unsigned long load_elf_interp(str + } + } + +- /* +- * Now fill out the bss section. First pad the last page up +- * to the page boundary, and then perform a mmap to make sure +- * that there are zero-mapped pages up to and including the +- * last bss page. +- */ +- if (padzero(elf_bss)) { +- error = -EFAULT; +- goto out_close; +- } ++ if (last_bss > elf_bss) { ++ /* ++ * Now fill out the bss section. First pad the last page up ++ * to the page boundary, and then perform a mmap to make sure ++ * that there are zero-mapped pages up to and including the ++ * last bss page. ++ */ ++ if (padzero(elf_bss)) { ++ error = -EFAULT; ++ goto out_close; ++ } + +- /* What we have mapped so far */ +- elf_bss = ELF_PAGESTART(elf_bss + ELF_MIN_ALIGN - 1); ++ /* What we have mapped so far */ ++ elf_bss = ELF_PAGESTART(elf_bss + ELF_MIN_ALIGN - 1); + +- /* Map the last of the bss segment */ +- if (last_bss > elf_bss) { ++ /* Map the last of the bss segment */ + down_write(¤t->mm->mmap_sem); + error = do_brk(elf_bss, last_bss - elf_bss); + up_write(¤t->mm->mmap_sem); + + +From gregkh@mini.kroah.org Wed Sep 16 15:15:06 2009 +Message-Id: <20090916221505.894792349@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Sep 2009 15:13:22 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Geoff Levand , + Benjamin Herrenschmidt +Subject: [patch 02/10] powerpc/ps3: Workaround for flash memory I/O error +References: <20090916221320.283781925@mini.kroah.org> +Content-Disposition: inline; filename=powerpc-ps3-workaround-for-flash-memory-i-o-error.patch +Content-Length: 3401 +Lines: 122 + +From: Geoff Levand + +commit bc00351edd5c1b84d48c3fdca740fedfce4ae6ce upstream. + +A workaround for flash memory I/O errors when the PS3 internal +hard disk has not been formatted for OtherOS use. + +This error condition mainly effects 'Live CD' users who have not +formatted the PS3's internal hard disk for OtherOS. + +Fixes errors similar to these when using the ps3-flash-util +or ps3-boot-game-os programs: + + ps3flash read failed 0x2050000 + os_area_header_read: read error: os_area_header: Input/output error + main:627: os_area_read_hp error. + ERROR: can't change boot flag + +Signed-off-by: Geoff Levand +Signed-off-by: Benjamin Herrenschmidt +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ps3/ps3stor_lib.c | 65 +++++++++++++++++++++++++++++++++++++++++++--- + 1 file changed, 62 insertions(+), 3 deletions(-) + +--- a/drivers/ps3/ps3stor_lib.c ++++ b/drivers/ps3/ps3stor_lib.c +@@ -23,6 +23,65 @@ + #include + #include + ++/* ++ * A workaround for flash memory I/O errors when the internal hard disk ++ * has not been formatted for OtherOS use. Delay disk close until flash ++ * memory is closed. ++ */ ++ ++static struct ps3_flash_workaround { ++ int flash_open; ++ int disk_open; ++ struct ps3_system_bus_device *disk_sbd; ++} ps3_flash_workaround; ++ ++static int ps3stor_open_hv_device(struct ps3_system_bus_device *sbd) ++{ ++ int error = ps3_open_hv_device(sbd); ++ ++ if (error) ++ return error; ++ ++ if (sbd->match_id == PS3_MATCH_ID_STOR_FLASH) ++ ps3_flash_workaround.flash_open = 1; ++ ++ if (sbd->match_id == PS3_MATCH_ID_STOR_DISK) ++ ps3_flash_workaround.disk_open = 1; ++ ++ return 0; ++} ++ ++static int ps3stor_close_hv_device(struct ps3_system_bus_device *sbd) ++{ ++ int error; ++ ++ if (sbd->match_id == PS3_MATCH_ID_STOR_DISK ++ && ps3_flash_workaround.disk_open ++ && ps3_flash_workaround.flash_open) { ++ ps3_flash_workaround.disk_sbd = sbd; ++ return 0; ++ } ++ ++ error = ps3_close_hv_device(sbd); ++ ++ if (error) ++ return error; ++ ++ if (sbd->match_id == PS3_MATCH_ID_STOR_DISK) ++ ps3_flash_workaround.disk_open = 0; ++ ++ if (sbd->match_id == PS3_MATCH_ID_STOR_FLASH) { ++ ps3_flash_workaround.flash_open = 0; ++ ++ if (ps3_flash_workaround.disk_sbd) { ++ ps3_close_hv_device(ps3_flash_workaround.disk_sbd); ++ ps3_flash_workaround.disk_open = 0; ++ ps3_flash_workaround.disk_sbd = NULL; ++ } ++ } ++ ++ return 0; ++} + + static int ps3stor_probe_access(struct ps3_storage_device *dev) + { +@@ -90,7 +149,7 @@ int ps3stor_setup(struct ps3_storage_dev + int error, res, alignment; + enum ps3_dma_page_size page_size; + +- error = ps3_open_hv_device(&dev->sbd); ++ error = ps3stor_open_hv_device(&dev->sbd); + if (error) { + dev_err(&dev->sbd.core, + "%s:%u: ps3_open_hv_device failed %d\n", __func__, +@@ -166,7 +225,7 @@ fail_free_irq: + fail_sb_event_receive_port_destroy: + ps3_sb_event_receive_port_destroy(&dev->sbd, dev->irq); + fail_close_device: +- ps3_close_hv_device(&dev->sbd); ++ ps3stor_close_hv_device(&dev->sbd); + fail: + return error; + } +@@ -193,7 +252,7 @@ void ps3stor_teardown(struct ps3_storage + "%s:%u: destroy event receive port failed %d\n", + __func__, __LINE__, error); + +- error = ps3_close_hv_device(&dev->sbd); ++ error = ps3stor_close_hv_device(&dev->sbd); + if (error) + dev_err(&dev->sbd.core, + "%s:%u: ps3_close_hv_device failed %d\n", __func__, + + +From gregkh@mini.kroah.org Wed Sep 16 15:15:06 2009 +Message-Id: <20090916221506.058405734@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Sep 2009 15:13:23 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jason Gunthorpe , + Rajiv Andrade , + James Morris +Subject: [patch 03/10] TPM: Fixup boot probe timeout for tpm_tis driver +References: <20090916221320.283781925@mini.kroah.org> +Content-Disposition: inline; filename=tpm-fixup-boot-probe-timeout-for-tpm_tis-driver.patch +Content-Length: 1887 +Lines: 51 + +From: Jason Gunthorpe + +commit ec57935837a78f9661125b08a5d08b697568e040 upstream. + +When probing the device in tpm_tis_init the call request_locality +uses timeout_a, which wasn't being initalized until after +request_locality. This results in request_locality falsely timing +out if the chip is still starting. Move the initialization to before +request_locality. + +This probably only matters for embedded cases (ie mine), a BIOS likely +gets the TPM into a state where this code path isn't necessary. + +Signed-off-by: Jason Gunthorpe +Acked-by: Rajiv Andrade +Signed-off-by: James Morris +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/char/tpm/tpm_tis.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +--- a/drivers/char/tpm/tpm_tis.c ++++ b/drivers/char/tpm/tpm_tis.c +@@ -450,6 +450,12 @@ static int tpm_tis_init(struct device *d + goto out_err; + } + ++ /* Default timeouts */ ++ chip->vendor.timeout_a = msecs_to_jiffies(TIS_SHORT_TIMEOUT); ++ chip->vendor.timeout_b = msecs_to_jiffies(TIS_LONG_TIMEOUT); ++ chip->vendor.timeout_c = msecs_to_jiffies(TIS_SHORT_TIMEOUT); ++ chip->vendor.timeout_d = msecs_to_jiffies(TIS_SHORT_TIMEOUT); ++ + if (request_locality(chip, 0) != 0) { + rc = -ENODEV; + goto out_err; +@@ -457,12 +463,6 @@ static int tpm_tis_init(struct device *d + + vendor = ioread32(chip->vendor.iobase + TPM_DID_VID(0)); + +- /* Default timeouts */ +- chip->vendor.timeout_a = msecs_to_jiffies(TIS_SHORT_TIMEOUT); +- chip->vendor.timeout_b = msecs_to_jiffies(TIS_LONG_TIMEOUT); +- chip->vendor.timeout_c = msecs_to_jiffies(TIS_SHORT_TIMEOUT); +- chip->vendor.timeout_d = msecs_to_jiffies(TIS_SHORT_TIMEOUT); +- + dev_info(dev, + "1.2 TPM (device-id 0x%X, rev-id %d)\n", + vendor >> 16, ioread8(chip->vendor.iobase + TPM_RID(0))); + + +From gregkh@mini.kroah.org Wed Sep 16 15:15:06 2009 +Message-Id: <20090916221506.226614681@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Sep 2009 15:13:24 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jan Kara +Subject: [patch 04/10] udf: Use device size when drive reported bogus number of written blocks +References: <20090916221320.283781925@mini.kroah.org> +Content-Disposition: inline; filename=udf-use-device-size-when-drive-reported-bogus-number-of-written-blocks.patch +Content-Length: 955 +Lines: 32 + +From: Jan Kara + +commit 24a5d59f3477bcff4c069ff4d0ca9a3e037d0235 upstream. + +Some drives report 0 as the number of written blocks when there are some blocks +recorded. Use device size in such case so that we can automagically mount such +media. + +Signed-off-by: Jan Kara +Signed-off-by: Greg Kroah-Hartman + +--- + fs/udf/lowlevel.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/fs/udf/lowlevel.c ++++ b/fs/udf/lowlevel.c +@@ -56,7 +56,12 @@ unsigned long udf_get_last_block(struct + struct block_device *bdev = sb->s_bdev; + unsigned long lblock = 0; + +- if (ioctl_by_bdev(bdev, CDROM_LAST_WRITTEN, (unsigned long) &lblock)) ++ /* ++ * ioctl failed or returned obviously bogus value? ++ * Try using the device size... ++ */ ++ if (ioctl_by_bdev(bdev, CDROM_LAST_WRITTEN, (unsigned long) &lblock) || ++ lblock == 0) + lblock = bdev->bd_inode->i_size >> sb->s_blocksize_bits; + + if (lblock) + + +From gregkh@mini.kroah.org Wed Sep 16 15:15:06 2009 +Message-Id: <20090916221506.354537930@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Sep 2009 15:13:25 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Sophie Hamilton , + Takashi Iwai +Subject: [patch 05/10] ALSA: cs46xx - Fix minimum period size +References: <20090916221320.283781925@mini.kroah.org> +Content-Disposition: inline; filename=alsa-cs46xx-fix-minimum-period-size.patch +Content-Length: 820 +Lines: 28 + +From: Sophie Hamilton + +commit 6148b130eb84edc76e4fa88da1877b27be6c2f06 upstream. + +Fix minimum period size for cs46xx cards. This fixes a problem in the +case where neither a period size nor a buffer size is passed to ALSA; +this is the case in Audacious, OpenAL, and others. + +Signed-off-by: Sophie Hamilton +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/cs46xx/cs46xx_lib.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/pci/cs46xx/cs46xx_lib.h ++++ b/sound/pci/cs46xx/cs46xx_lib.h +@@ -35,7 +35,7 @@ + + + #ifdef CONFIG_SND_CS46XX_NEW_DSP +-#define CS46XX_MIN_PERIOD_SIZE 1 ++#define CS46XX_MIN_PERIOD_SIZE 64 + #define CS46XX_MAX_PERIOD_SIZE 1024*1024 + #else + #define CS46XX_MIN_PERIOD_SIZE 2048 + + +From gregkh@mini.kroah.org Wed Sep 16 15:15:06 2009 +Message-Id: <20090916221506.492585155@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Sep 2009 15:13:26 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Tejun Heo , + Jeff Garzik +Subject: [patch 06/10] libata: fix off-by-one error in ata_tf_read_block() +References: <20090916221320.283781925@mini.kroah.org> +Content-Disposition: inline; filename=libata-fix-off-by-one-error-in-ata_tf_read_block.patch +Content-Length: 1147 +Lines: 38 + +From: Tejun Heo + +commit ac8672ea922bde59acf50eaa1eaa1640a6395fd2 upstream. + +ata_tf_read_block() has off-by-one error when converting CHS address +to LBA. The bug isn't very visible because ata_tf_read_block() is +used only when generating sense data for a failed RW command and CHS +addressing isn't used too often these days. + +This problem was spotted by Atsushi Nemoto. + +Signed-off-by: Tejun Heo +Reported-by: Atsushi Nemoto +Signed-off-by: Jeff Garzik +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ata/libata-core.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +--- a/drivers/ata/libata-core.c ++++ b/drivers/ata/libata-core.c +@@ -565,7 +565,13 @@ u64 ata_tf_read_block(struct ata_taskfil + head = tf->device & 0xf; + sect = tf->lbal; + +- block = (cyl * dev->heads + head) * dev->sectors + sect; ++ if (!sect) { ++ ata_dev_printk(dev, KERN_WARNING, "device reported " ++ "invalid CHS sector 0\n"); ++ sect = 1; /* oh well */ ++ } ++ ++ block = (cyl * dev->heads + head) * dev->sectors + sect - 1; + } + + return block; + + +From gregkh@mini.kroah.org Wed Sep 16 15:15:06 2009 +Message-Id: <20090916221506.633681567@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Sep 2009 15:13:27 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Brian King , + Benjamin Herrenschmidt +Subject: [patch 07/10] powerpc/pseries: Fix to handle slb resize across migration +References: <20090916221320.283781925@mini.kroah.org> +Content-Disposition: inline; filename=powerpc-pseries-fix-to-handle-slb-resize-across-migration.patch +Content-Length: 4790 +Lines: 160 + +From: Brian King + +commit 46db2f86a3b2a94e0b33e0b4548fb7b7b6bdff66 upstream. + +The SLB can change sizes across a live migration, which was not +being handled, resulting in possible machine crashes during +migration if migrating to a machine which has a smaller max SLB +size than the source machine. Fix this by first reducing the +SLB size to the minimum possible value, which is 32, prior to +migration. Then during the device tree update which occurs after +migration, we make the call to ensure the SLB gets updated. Also +add the slb_size to the lparcfg output so that the migration +tools can check to make sure the kernel has this capability +before allowing migration in scenarios where the SLB size will change. + +BenH: Fixed #include -> to avoid + breaking ppc32 build + +Signed-off-by: Brian King +Signed-off-by: Benjamin Herrenschmidt +Signed-off-by: Greg Kroah-Hartman + +--- + arch/powerpc/include/asm/mmu-hash64.h | 2 ++ + arch/powerpc/kernel/lparcfg.c | 3 +++ + arch/powerpc/kernel/rtas.c | 7 ++++++- + arch/powerpc/mm/slb.c | 16 ++++++++++++---- + arch/powerpc/platforms/pseries/reconfig.c | 9 ++++++++- + 5 files changed, 31 insertions(+), 6 deletions(-) + +--- a/arch/powerpc/include/asm/mmu-hash64.h ++++ b/arch/powerpc/include/asm/mmu-hash64.h +@@ -41,6 +41,7 @@ extern char initial_stab[]; + + #define SLB_NUM_BOLTED 3 + #define SLB_CACHE_ENTRIES 8 ++#define SLB_MIN_SIZE 32 + + /* Bits in the SLB ESID word */ + #define SLB_ESID_V ASM_CONST(0x0000000008000000) /* valid */ +@@ -299,6 +300,7 @@ extern void slb_flush_and_rebolt(void); + extern void stab_initialize(unsigned long stab); + + extern void slb_vmalloc_update(void); ++extern void slb_set_size(u16 size); + #endif /* __ASSEMBLY__ */ + + /* +--- a/arch/powerpc/kernel/lparcfg.c ++++ b/arch/powerpc/kernel/lparcfg.c +@@ -35,6 +35,7 @@ + #include + #include + #include ++#include + + #define MODULE_VERS "1.8" + #define MODULE_NAME "lparcfg" +@@ -485,6 +486,8 @@ static int pseries_lparcfg_data(struct s + + seq_printf(m, "shared_processor_mode=%d\n", lppaca[0].shared_proc); + ++ seq_printf(m, "slb_size=%d\n", mmu_slb_size); ++ + return 0; + } + +--- a/arch/powerpc/kernel/rtas.c ++++ b/arch/powerpc/kernel/rtas.c +@@ -38,6 +38,7 @@ + #include + #include + #include ++#include + + struct rtas_t rtas = { + .lock = SPIN_LOCK_UNLOCKED +@@ -665,6 +666,7 @@ static void rtas_percpu_suspend_me(void + { + long rc; + unsigned long msr_save; ++ u16 slb_size = mmu_slb_size; + int cpu; + struct rtas_suspend_me_data *data = + (struct rtas_suspend_me_data *)info; +@@ -686,13 +688,16 @@ static void rtas_percpu_suspend_me(void + /* All other cpus are in H_JOIN, this cpu does + * the suspend. + */ ++ slb_set_size(SLB_MIN_SIZE); + printk(KERN_DEBUG "calling ibm,suspend-me on cpu %i\n", + smp_processor_id()); + data->error = rtas_call(data->token, 0, 1, NULL); + +- if (data->error) ++ if (data->error) { + printk(KERN_DEBUG "ibm,suspend-me returned %d\n", + data->error); ++ slb_set_size(slb_size); ++ } + } else { + printk(KERN_ERR "H_JOIN on cpu %i failed with rc = %ld\n", + smp_processor_id(), rc); +--- a/arch/powerpc/mm/slb.c ++++ b/arch/powerpc/mm/slb.c +@@ -247,14 +247,22 @@ void switch_slb(struct task_struct *tsk, + static inline void patch_slb_encoding(unsigned int *insn_addr, + unsigned int immed) + { +- /* Assume the instruction had a "0" immediate value, just +- * "or" in the new value +- */ +- *insn_addr |= immed; ++ *insn_addr = (*insn_addr & 0xffff0000) | immed; + flush_icache_range((unsigned long)insn_addr, 4+ + (unsigned long)insn_addr); + } + ++void slb_set_size(u16 size) ++{ ++ extern unsigned int *slb_compare_rr_to_size; ++ ++ if (mmu_slb_size == size) ++ return; ++ ++ mmu_slb_size = size; ++ patch_slb_encoding(slb_compare_rr_to_size, mmu_slb_size); ++} ++ + void slb_initialize(void) + { + unsigned long linear_llp, vmalloc_llp, io_llp; +--- a/arch/powerpc/platforms/pseries/reconfig.c ++++ b/arch/powerpc/platforms/pseries/reconfig.c +@@ -20,6 +20,7 @@ + #include + #include + #include ++#include + + + +@@ -439,9 +440,15 @@ static int do_update_property(char *buf, + if (!newprop) + return -ENOMEM; + ++ if (!strcmp(name, "slb-size") || !strcmp(name, "ibm,slb-size")) ++ slb_set_size(*(int *)value); ++ + oldprop = of_find_property(np, name,NULL); +- if (!oldprop) ++ if (!oldprop) { ++ if (strlen(name)) ++ return prom_add_property(np, newprop); + return -ENODEV; ++ } + + rc = prom_update_property(np, newprop, oldprop); + if (rc) + + +From gregkh@mini.kroah.org Wed Sep 16 15:15:06 2009 +Message-Id: <20090916221506.761243734@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Sep 2009 15:13:28 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Clemens Ladisch , + Takashi Iwai +Subject: [patch 08/10] sound: oxygen: work around MCE when changing volume +References: <20090916221320.283781925@mini.kroah.org> +Content-Disposition: inline; filename=sound-oxygen-work-around-mce-when-changing-volume.patch +Content-Length: 1498 +Lines: 45 + +From: Clemens Ladisch + +commit f1bc07af9a9edc5c1d4bdd971f7099316ed2e405 upstream. + +When the volume is changed continuously (e.g., when the user drags a +volume slider with the mouse), the driver does lots of I2C writes. +Apparently, the sound chip can get confused when we poll the I2C status +register too much, and fails to complete a read from it. On the PCI-E +models, the PCI-E/PCI bridge gets upset by this and generates a machine +check exception. + +To avoid this, this patch replaces the polling with an unconditional +wait that is guaranteed to be long enough. + +Signed-off-by: Clemens Ladisch +Tested-by: Johann Messner +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/oxygen/oxygen_io.c | 11 +---------- + 1 file changed, 1 insertion(+), 10 deletions(-) + +--- a/sound/pci/oxygen/oxygen_io.c ++++ b/sound/pci/oxygen/oxygen_io.c +@@ -214,17 +214,8 @@ EXPORT_SYMBOL(oxygen_write_spi); + + void oxygen_write_i2c(struct oxygen *chip, u8 device, u8 map, u8 data) + { +- unsigned long timeout; +- + /* should not need more than about 300 us */ +- timeout = jiffies + msecs_to_jiffies(1); +- do { +- if (!(oxygen_read16(chip, OXYGEN_2WIRE_BUS_STATUS) +- & OXYGEN_2WIRE_BUSY)) +- break; +- udelay(1); +- cond_resched(); +- } while (time_after_eq(timeout, jiffies)); ++ msleep(1); + + oxygen_write8(chip, OXYGEN_2WIRE_MAP, map); + oxygen_write8(chip, OXYGEN_2WIRE_DATA, data); + + +From gregkh@mini.kroah.org Wed Sep 16 15:15:07 2009 +Message-Id: <20090916221506.929363993@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Sep 2009 15:13:29 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + "J. Bruce Fields" , + David Shaw , + Chuck Ebbert +Subject: [patch 09/10] Short write in nfsd becomes a full write to the client +References: <20090916221320.283781925@mini.kroah.org> +Content-Disposition: inline; filename=short-write-in-nfsd-becomes-a-full-write-to-the-client.patch +Content-Length: 5523 +Lines: 174 + + +From: David Shaw + +commit 31dec2538e45e9fff2007ea1f4c6bae9f78db724 upstream. + +Short write in nfsd becomes a full write to the client + +If a filesystem being written to via NFS returns a short write count +(as opposed to an error) to nfsd, nfsd treats that as a success for +the entire write, rather than the short count that actually succeeded. + +For example, given a 8192 byte write, if the underlying filesystem +only writes 4096 bytes, nfsd will ack back to the nfs client that all +8192 bytes were written. The nfs client does have retry logic for +short writes, but this is never called as the client is told the +complete write succeeded. + +There are probably other ways it could happen, but in my case it +happened with a fuse (filesystem in userspace) filesystem which can +rather easily have a partial write. + +Here is a patch to properly return the short write count to the +client. + +Signed-off-by: David Shaw +Signed-off-by: J. Bruce Fields +Cc: Chuck Ebbert +Signed-off-by: Greg Kroah-Hartman + +--- + fs/nfsd/nfs3proc.c | 5 +++-- + fs/nfsd/nfs4proc.c | 7 +++++-- + fs/nfsd/nfsproc.c | 3 ++- + fs/nfsd/vfs.c | 13 +++++++------ + include/linux/nfsd/nfsd.h | 2 +- + 5 files changed, 18 insertions(+), 12 deletions(-) + +--- a/fs/nfsd/nfs3proc.c ++++ b/fs/nfsd/nfs3proc.c +@@ -201,6 +201,7 @@ nfsd3_proc_write(struct svc_rqst *rqstp, + struct nfsd3_writeres *resp) + { + __be32 nfserr; ++ unsigned long cnt = argp->len; + + dprintk("nfsd: WRITE(3) %s %d bytes at %ld%s\n", + SVCFH_fmt(&argp->fh), +@@ -213,9 +214,9 @@ nfsd3_proc_write(struct svc_rqst *rqstp, + nfserr = nfsd_write(rqstp, &resp->fh, NULL, + argp->offset, + rqstp->rq_vec, argp->vlen, +- argp->len, ++ &cnt, + &resp->committed); +- resp->count = argp->count; ++ resp->count = cnt; + RETURN_STATUS(nfserr); + } + +--- a/fs/nfsd/nfs4proc.c ++++ b/fs/nfsd/nfs4proc.c +@@ -685,6 +685,7 @@ nfsd4_write(struct svc_rqst *rqstp, stru + struct file *filp = NULL; + u32 *p; + __be32 status = nfs_ok; ++ unsigned long cnt; + + /* no need to check permission - this will be done in nfsd_write() */ + +@@ -703,7 +704,7 @@ nfsd4_write(struct svc_rqst *rqstp, stru + return status; + } + +- write->wr_bytes_written = write->wr_buflen; ++ cnt = write->wr_buflen; + write->wr_how_written = write->wr_stable_how; + p = (u32 *)write->wr_verifier.data; + *p++ = nfssvc_boot.tv_sec; +@@ -711,10 +712,12 @@ nfsd4_write(struct svc_rqst *rqstp, stru + + status = nfsd_write(rqstp, &cstate->current_fh, filp, + write->wr_offset, rqstp->rq_vec, write->wr_vlen, +- write->wr_buflen, &write->wr_how_written); ++ &cnt, &write->wr_how_written); + if (filp) + fput(filp); + ++ write->wr_bytes_written = cnt; ++ + if (status == nfserr_symlink) + status = nfserr_inval; + return status; +--- a/fs/nfsd/nfsproc.c ++++ b/fs/nfsd/nfsproc.c +@@ -179,6 +179,7 @@ nfsd_proc_write(struct svc_rqst *rqstp, + { + __be32 nfserr; + int stable = 1; ++ unsigned long cnt = argp->len; + + dprintk("nfsd: WRITE %s %d bytes at %d\n", + SVCFH_fmt(&argp->fh), +@@ -187,7 +188,7 @@ nfsd_proc_write(struct svc_rqst *rqstp, + nfserr = nfsd_write(rqstp, fh_copy(&resp->fh, &argp->fh), NULL, + argp->offset, + rqstp->rq_vec, argp->vlen, +- argp->len, ++ &cnt, + &stable); + return nfsd_return_attrs(nfserr, resp); + } +--- a/fs/nfsd/vfs.c ++++ b/fs/nfsd/vfs.c +@@ -957,7 +957,7 @@ static void kill_suid(struct dentry *den + static __be32 + nfsd_vfs_write(struct svc_rqst *rqstp, struct svc_fh *fhp, struct file *file, + loff_t offset, struct kvec *vec, int vlen, +- unsigned long cnt, int *stablep) ++ unsigned long *cnt, int *stablep) + { + struct svc_export *exp; + struct dentry *dentry; +@@ -971,7 +971,7 @@ nfsd_vfs_write(struct svc_rqst *rqstp, s + err = nfserr_perm; + + if ((fhp->fh_export->ex_flags & NFSEXP_MSNFS) && +- (!lock_may_write(file->f_path.dentry->d_inode, offset, cnt))) ++ (!lock_may_write(file->f_path.dentry->d_inode, offset, *cnt))) + goto out; + #endif + +@@ -1003,7 +1003,7 @@ nfsd_vfs_write(struct svc_rqst *rqstp, s + host_err = vfs_writev(file, (struct iovec __user *)vec, vlen, &offset); + set_fs(oldfs); + if (host_err >= 0) { +- nfsdstats.io_write += cnt; ++ nfsdstats.io_write += host_err; + fsnotify_modify(file->f_path.dentry); + } + +@@ -1048,9 +1048,10 @@ nfsd_vfs_write(struct svc_rqst *rqstp, s + } + + dprintk("nfsd: write complete host_err=%d\n", host_err); +- if (host_err >= 0) ++ if (host_err >= 0) { + err = 0; +- else ++ *cnt = host_err; ++ } else + err = nfserrno(host_err); + out: + return err; +@@ -1092,7 +1093,7 @@ out: + */ + __be32 + nfsd_write(struct svc_rqst *rqstp, struct svc_fh *fhp, struct file *file, +- loff_t offset, struct kvec *vec, int vlen, unsigned long cnt, ++ loff_t offset, struct kvec *vec, int vlen, unsigned long *cnt, + int *stablep) + { + __be32 err = 0; +--- a/include/linux/nfsd/nfsd.h ++++ b/include/linux/nfsd/nfsd.h +@@ -105,7 +105,7 @@ void nfsd_close(struct file *); + __be32 nfsd_read(struct svc_rqst *, struct svc_fh *, struct file *, + loff_t, struct kvec *, int, unsigned long *); + __be32 nfsd_write(struct svc_rqst *, struct svc_fh *,struct file *, +- loff_t, struct kvec *,int, unsigned long, int *); ++ loff_t, struct kvec *,int, unsigned long *, int *); + __be32 nfsd_readlink(struct svc_rqst *, struct svc_fh *, + char *, int *); + __be32 nfsd_symlink(struct svc_rqst *, struct svc_fh *, + + +From gregkh@mini.kroah.org Wed Sep 16 15:15:07 2009 +Message-Id: <20090916221507.102426758@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Sep 2009 15:13:30 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + "J. Bruce Fields" , + Wei Yongjun , + Chuck Ebbert +Subject: [patch 10/10] nfsd: fix hung up of nfs client while sync write data to nfs server +References: <20090916221320.283781925@mini.kroah.org> +Content-Disposition: inline; filename=nfsd-fix-hung-up-of-nfs-client-while-sync-write-data-to-nfs-server.patch +Content-Length: 1615 +Lines: 57 + + +From: Wei Yongjun + +commit a0d24b295aed7a9daf4ca36bd4784e4d40f82303 upstream. + +nfsd: fix hung up of nfs client while sync write data to nfs server + +Commit 'Short write in nfsd becomes a full write to the client' +(31dec2538e45e9fff2007ea1f4c6bae9f78db724) broken the sync write. +With the following commands to reproduce: + + $ mount -t nfs -o sync 192.168.0.21:/nfsroot /mnt + $ cd /mnt + $ echo aaaa > temp.txt + +Then nfs client is hung up. + +In SYNC mode the server alaways return the write count 0 to the +client. This is because the value of host_err in nfsd_vfs_write() +will be overwrite in SYNC mode by 'host_err=nfsd_sync(file);', +and then we return host_err(which is now 0) as write count. + +This patch fixed the problem. + +Signed-off-by: Wei Yongjun +Signed-off-by: J. Bruce Fields +Cc: Chuck Ebbert +Signed-off-by: Greg Kroah-Hartman + +--- + fs/nfsd/vfs.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/fs/nfsd/vfs.c ++++ b/fs/nfsd/vfs.c +@@ -1003,6 +1003,7 @@ nfsd_vfs_write(struct svc_rqst *rqstp, s + host_err = vfs_writev(file, (struct iovec __user *)vec, vlen, &offset); + set_fs(oldfs); + if (host_err >= 0) { ++ *cnt = host_err; + nfsdstats.io_write += host_err; + fsnotify_modify(file->f_path.dentry); + } +@@ -1048,10 +1049,9 @@ nfsd_vfs_write(struct svc_rqst *rqstp, s + } + + dprintk("nfsd: write complete host_err=%d\n", host_err); +- if (host_err >= 0) { ++ if (host_err >= 0) + err = 0; +- *cnt = host_err; +- } else ++ else + err = nfserrno(host_err); + out: + return err; + + +From gregkh@mini.kroah.org Wed Sep 16 15:15:05 2009 +Message-Id: <20090916221320.283781925@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Sep 2009 15:13:20 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk +Subject: [patch 00/10] 2.6.27.35-stable review +Content-Length: 1964 +Lines: 44 + +This is the start of the stable review cycle for the 2.6.27.35 release. +There are 10 patches in this series, all will be posted as a response to +this one. If anyone has any issues with these being applied, please let +us know. If anyone is a maintainer of the proper subsystem, and wants +to add a Signed-off-by: line to the patch, please respond with it. + +These patches are sent out with a number of different people on the Cc: +line. If you wish to be a reviewer, please email stable@kernel.org to +add your name to the list. If you want to be off the reviewer list, +also email us. + +Responses should be made by Friday, September 18, 22:00:00 UTC. +Anything received after that time might be too late. + +The whole patch series can be found in one patch at: + kernel.org/pub/linux/kernel/v2.6/stable-review/patch-2.6.27.35-rc1.gz +and the diffstat can be found below. + + +thanks, + +greg k-h + +---------- + + Makefile | 2 +- + arch/powerpc/include/asm/mmu-hash64.h | 2 + + arch/powerpc/kernel/lparcfg.c | 3 + + arch/powerpc/kernel/rtas.c | 7 +++- + arch/powerpc/mm/slb.c | 16 +++++-- + arch/powerpc/platforms/pseries/reconfig.c | 9 ++++- + drivers/ata/libata-core.c | 8 +++- + drivers/char/tpm/tpm_tis.c | 12 +++--- + drivers/ps3/ps3stor_lib.c | 65 +++++++++++++++++++++++++++- + fs/binfmt_elf.c | 28 ++++++------ + fs/nfsd/nfs3proc.c | 5 +- + fs/nfsd/nfs4proc.c | 7 ++- + fs/nfsd/nfsproc.c | 3 +- + fs/nfsd/vfs.c | 11 +++-- + fs/udf/lowlevel.c | 7 +++- + include/linux/nfsd/nfsd.h | 2 +- + sound/pci/cs46xx/cs46xx_lib.h | 2 +- + sound/pci/oxygen/oxygen_io.c | 11 +---- + 18 files changed, 146 insertions(+), 54 deletions(-) + diff --git a/queue-2.6.27/nfsd-fix-hung-up-of-nfs-client-while-sync-write-data-to-nfs-server.patch b/review-2.6.27/nfsd-fix-hung-up-of-nfs-client-while-sync-write-data-to-nfs-server.patch similarity index 100% rename from queue-2.6.27/nfsd-fix-hung-up-of-nfs-client-while-sync-write-data-to-nfs-server.patch rename to review-2.6.27/nfsd-fix-hung-up-of-nfs-client-while-sync-write-data-to-nfs-server.patch diff --git a/queue-2.6.27/powerpc-ps3-workaround-for-flash-memory-i-o-error.patch b/review-2.6.27/powerpc-ps3-workaround-for-flash-memory-i-o-error.patch similarity index 100% rename from queue-2.6.27/powerpc-ps3-workaround-for-flash-memory-i-o-error.patch rename to review-2.6.27/powerpc-ps3-workaround-for-flash-memory-i-o-error.patch diff --git a/queue-2.6.27/powerpc-pseries-fix-to-handle-slb-resize-across-migration.patch b/review-2.6.27/powerpc-pseries-fix-to-handle-slb-resize-across-migration.patch similarity index 100% rename from queue-2.6.27/powerpc-pseries-fix-to-handle-slb-resize-across-migration.patch rename to review-2.6.27/powerpc-pseries-fix-to-handle-slb-resize-across-migration.patch diff --git a/queue-2.6.27/series b/review-2.6.27/series similarity index 100% rename from queue-2.6.27/series rename to review-2.6.27/series diff --git a/queue-2.6.27/short-write-in-nfsd-becomes-a-full-write-to-the-client.patch b/review-2.6.27/short-write-in-nfsd-becomes-a-full-write-to-the-client.patch similarity index 100% rename from queue-2.6.27/short-write-in-nfsd-becomes-a-full-write-to-the-client.patch rename to review-2.6.27/short-write-in-nfsd-becomes-a-full-write-to-the-client.patch diff --git a/queue-2.6.27/sound-oxygen-work-around-mce-when-changing-volume.patch b/review-2.6.27/sound-oxygen-work-around-mce-when-changing-volume.patch similarity index 100% rename from queue-2.6.27/sound-oxygen-work-around-mce-when-changing-volume.patch rename to review-2.6.27/sound-oxygen-work-around-mce-when-changing-volume.patch diff --git a/queue-2.6.27/tpm-fixup-boot-probe-timeout-for-tpm_tis-driver.patch b/review-2.6.27/tpm-fixup-boot-probe-timeout-for-tpm_tis-driver.patch similarity index 100% rename from queue-2.6.27/tpm-fixup-boot-probe-timeout-for-tpm_tis-driver.patch rename to review-2.6.27/tpm-fixup-boot-probe-timeout-for-tpm_tis-driver.patch diff --git a/queue-2.6.27/udf-use-device-size-when-drive-reported-bogus-number-of-written-blocks.patch b/review-2.6.27/udf-use-device-size-when-drive-reported-bogus-number-of-written-blocks.patch similarity index 100% rename from queue-2.6.27/udf-use-device-size-when-drive-reported-bogus-number-of-written-blocks.patch rename to review-2.6.27/udf-use-device-size-when-drive-reported-bogus-number-of-written-blocks.patch