--- /dev/null
+From gregkh@mini.kroah.org Wed Sep 16 15:15:05 2009
+Message-Id: <20090916221505.716776628@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Sep 2009 15:13:21 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Roland McGrath <roland@redhat.com>,
+ James Morris <jmorris@namei.org>
+Subject: [patch 01/10] binfmt_elf: fix PT_INTERP bss handling
+References: <20090916221320.283781925@mini.kroah.org>
+Content-Disposition: inline; filename=binfmt_elf-fix-pt_interp-bss-handling.patch
+Content-Length: 2694
+Lines: 83
+
+From: Roland McGrath <roland@redhat.com>
+
+commit 9f0ab4a3f0fdb1ff404d150618ace2fa069bb2e1 upstream.
+
+In fs/binfmt_elf.c, load_elf_interp() calls padzero() for .bss even if
+the PT_LOAD has no PROT_WRITE and no .bss. This generates EFAULT.
+
+Here is a small test case. (Yes, there are other, useful PT_INTERP
+which have only .text and no .data/.bss.)
+
+ ----- ptinterp.S
+ _start: .globl _start
+ nop
+ int3
+ -----
+ $ gcc -m32 -nostartfiles -nostdlib -o ptinterp ptinterp.S
+ $ gcc -m32 -Wl,--dynamic-linker=ptinterp -o hello hello.c
+ $ ./hello
+ Segmentation fault # during execve() itself
+
+ After applying the patch:
+ $ ./hello
+ Trace trap # user-mode execution after execve() finishes
+
+If the ELF headers are actually self-inconsistent, then dying is fine.
+But having no PROT_WRITE segment is perfectly normal and correct if
+there is no segment with p_memsz > p_filesz (i.e. bss). John Reiser
+suggested checking for PROT_WRITE in the bss logic. I think it makes
+most sense to simply apply the bss logic only when there is bss.
+
+This patch looks less trivial than it is due to some reindentation.
+It just moves the "if (last_bss > elf_bss) {" test up to include the
+partial-page bss logic as well as the more-pages bss logic.
+
+Reported-by: John Reiser <jreiser@bitwagon.com>
+Signed-off-by: Roland McGrath <roland@redhat.com>
+Signed-off-by: James Morris <jmorris@namei.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/binfmt_elf.c | 28 ++++++++++++++--------------
+ 1 file changed, 14 insertions(+), 14 deletions(-)
+
+--- a/fs/binfmt_elf.c
++++ b/fs/binfmt_elf.c
+@@ -496,22 +496,22 @@ static unsigned long load_elf_interp(str
+ }
+ }
+
+- /*
+- * Now fill out the bss section. First pad the last page up
+- * to the page boundary, and then perform a mmap to make sure
+- * that there are zero-mapped pages up to and including the
+- * last bss page.
+- */
+- if (padzero(elf_bss)) {
+- error = -EFAULT;
+- goto out_close;
+- }
++ if (last_bss > elf_bss) {
++ /*
++ * Now fill out the bss section. First pad the last page up
++ * to the page boundary, and then perform a mmap to make sure
++ * that there are zero-mapped pages up to and including the
++ * last bss page.
++ */
++ if (padzero(elf_bss)) {
++ error = -EFAULT;
++ goto out_close;
++ }
+
+- /* What we have mapped so far */
+- elf_bss = ELF_PAGESTART(elf_bss + ELF_MIN_ALIGN - 1);
++ /* What we have mapped so far */
++ elf_bss = ELF_PAGESTART(elf_bss + ELF_MIN_ALIGN - 1);
+
+- /* Map the last of the bss segment */
+- if (last_bss > elf_bss) {
++ /* Map the last of the bss segment */
+ down_write(¤t->mm->mmap_sem);
+ error = do_brk(elf_bss, last_bss - elf_bss);
+ up_write(¤t->mm->mmap_sem);
+
+
+From gregkh@mini.kroah.org Wed Sep 16 15:15:06 2009
+Message-Id: <20090916221505.894792349@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Sep 2009 15:13:22 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Geoff Levand <geoffrey.levand@am.sony.com>,
+ Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Subject: [patch 02/10] powerpc/ps3: Workaround for flash memory I/O error
+References: <20090916221320.283781925@mini.kroah.org>
+Content-Disposition: inline; filename=powerpc-ps3-workaround-for-flash-memory-i-o-error.patch
+Content-Length: 3401
+Lines: 122
+
+From: Geoff Levand <geoffrey.levand@am.sony.com>
+
+commit bc00351edd5c1b84d48c3fdca740fedfce4ae6ce upstream.
+
+A workaround for flash memory I/O errors when the PS3 internal
+hard disk has not been formatted for OtherOS use.
+
+This error condition mainly effects 'Live CD' users who have not
+formatted the PS3's internal hard disk for OtherOS.
+
+Fixes errors similar to these when using the ps3-flash-util
+or ps3-boot-game-os programs:
+
+ ps3flash read failed 0x2050000
+ os_area_header_read: read error: os_area_header: Input/output error
+ main:627: os_area_read_hp error.
+ ERROR: can't change boot flag
+
+Signed-off-by: Geoff Levand <geoffrey.levand@am.sony.com>
+Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/ps3/ps3stor_lib.c | 65 +++++++++++++++++++++++++++++++++++++++++++---
+ 1 file changed, 62 insertions(+), 3 deletions(-)
+
+--- a/drivers/ps3/ps3stor_lib.c
++++ b/drivers/ps3/ps3stor_lib.c
+@@ -23,6 +23,65 @@
+ #include <asm/lv1call.h>
+ #include <asm/ps3stor.h>
+
++/*
++ * A workaround for flash memory I/O errors when the internal hard disk
++ * has not been formatted for OtherOS use. Delay disk close until flash
++ * memory is closed.
++ */
++
++static struct ps3_flash_workaround {
++ int flash_open;
++ int disk_open;
++ struct ps3_system_bus_device *disk_sbd;
++} ps3_flash_workaround;
++
++static int ps3stor_open_hv_device(struct ps3_system_bus_device *sbd)
++{
++ int error = ps3_open_hv_device(sbd);
++
++ if (error)
++ return error;
++
++ if (sbd->match_id == PS3_MATCH_ID_STOR_FLASH)
++ ps3_flash_workaround.flash_open = 1;
++
++ if (sbd->match_id == PS3_MATCH_ID_STOR_DISK)
++ ps3_flash_workaround.disk_open = 1;
++
++ return 0;
++}
++
++static int ps3stor_close_hv_device(struct ps3_system_bus_device *sbd)
++{
++ int error;
++
++ if (sbd->match_id == PS3_MATCH_ID_STOR_DISK
++ && ps3_flash_workaround.disk_open
++ && ps3_flash_workaround.flash_open) {
++ ps3_flash_workaround.disk_sbd = sbd;
++ return 0;
++ }
++
++ error = ps3_close_hv_device(sbd);
++
++ if (error)
++ return error;
++
++ if (sbd->match_id == PS3_MATCH_ID_STOR_DISK)
++ ps3_flash_workaround.disk_open = 0;
++
++ if (sbd->match_id == PS3_MATCH_ID_STOR_FLASH) {
++ ps3_flash_workaround.flash_open = 0;
++
++ if (ps3_flash_workaround.disk_sbd) {
++ ps3_close_hv_device(ps3_flash_workaround.disk_sbd);
++ ps3_flash_workaround.disk_open = 0;
++ ps3_flash_workaround.disk_sbd = NULL;
++ }
++ }
++
++ return 0;
++}
+
+ static int ps3stor_probe_access(struct ps3_storage_device *dev)
+ {
+@@ -90,7 +149,7 @@ int ps3stor_setup(struct ps3_storage_dev
+ int error, res, alignment;
+ enum ps3_dma_page_size page_size;
+
+- error = ps3_open_hv_device(&dev->sbd);
++ error = ps3stor_open_hv_device(&dev->sbd);
+ if (error) {
+ dev_err(&dev->sbd.core,
+ "%s:%u: ps3_open_hv_device failed %d\n", __func__,
+@@ -166,7 +225,7 @@ fail_free_irq:
+ fail_sb_event_receive_port_destroy:
+ ps3_sb_event_receive_port_destroy(&dev->sbd, dev->irq);
+ fail_close_device:
+- ps3_close_hv_device(&dev->sbd);
++ ps3stor_close_hv_device(&dev->sbd);
+ fail:
+ return error;
+ }
+@@ -193,7 +252,7 @@ void ps3stor_teardown(struct ps3_storage
+ "%s:%u: destroy event receive port failed %d\n",
+ __func__, __LINE__, error);
+
+- error = ps3_close_hv_device(&dev->sbd);
++ error = ps3stor_close_hv_device(&dev->sbd);
+ if (error)
+ dev_err(&dev->sbd.core,
+ "%s:%u: ps3_close_hv_device failed %d\n", __func__,
+
+
+From gregkh@mini.kroah.org Wed Sep 16 15:15:06 2009
+Message-Id: <20090916221506.058405734@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Sep 2009 15:13:23 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jason Gunthorpe <jgunthorpe@obsidianresearch.com>,
+ Rajiv Andrade <srajiv@linux.vnet.ibm.com>,
+ James Morris <jmorris@namei.org>
+Subject: [patch 03/10] TPM: Fixup boot probe timeout for tpm_tis driver
+References: <20090916221320.283781925@mini.kroah.org>
+Content-Disposition: inline; filename=tpm-fixup-boot-probe-timeout-for-tpm_tis-driver.patch
+Content-Length: 1887
+Lines: 51
+
+From: Jason Gunthorpe <jgunthorpe@obsidianresearch.com>
+
+commit ec57935837a78f9661125b08a5d08b697568e040 upstream.
+
+When probing the device in tpm_tis_init the call request_locality
+uses timeout_a, which wasn't being initalized until after
+request_locality. This results in request_locality falsely timing
+out if the chip is still starting. Move the initialization to before
+request_locality.
+
+This probably only matters for embedded cases (ie mine), a BIOS likely
+gets the TPM into a state where this code path isn't necessary.
+
+Signed-off-by: Jason Gunthorpe <jgunthorpe@obsidianresearch.com>
+Acked-by: Rajiv Andrade <srajiv@linux.vnet.ibm.com>
+Signed-off-by: James Morris <jmorris@namei.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/char/tpm/tpm_tis.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+--- a/drivers/char/tpm/tpm_tis.c
++++ b/drivers/char/tpm/tpm_tis.c
+@@ -450,6 +450,12 @@ static int tpm_tis_init(struct device *d
+ goto out_err;
+ }
+
++ /* Default timeouts */
++ chip->vendor.timeout_a = msecs_to_jiffies(TIS_SHORT_TIMEOUT);
++ chip->vendor.timeout_b = msecs_to_jiffies(TIS_LONG_TIMEOUT);
++ chip->vendor.timeout_c = msecs_to_jiffies(TIS_SHORT_TIMEOUT);
++ chip->vendor.timeout_d = msecs_to_jiffies(TIS_SHORT_TIMEOUT);
++
+ if (request_locality(chip, 0) != 0) {
+ rc = -ENODEV;
+ goto out_err;
+@@ -457,12 +463,6 @@ static int tpm_tis_init(struct device *d
+
+ vendor = ioread32(chip->vendor.iobase + TPM_DID_VID(0));
+
+- /* Default timeouts */
+- chip->vendor.timeout_a = msecs_to_jiffies(TIS_SHORT_TIMEOUT);
+- chip->vendor.timeout_b = msecs_to_jiffies(TIS_LONG_TIMEOUT);
+- chip->vendor.timeout_c = msecs_to_jiffies(TIS_SHORT_TIMEOUT);
+- chip->vendor.timeout_d = msecs_to_jiffies(TIS_SHORT_TIMEOUT);
+-
+ dev_info(dev,
+ "1.2 TPM (device-id 0x%X, rev-id %d)\n",
+ vendor >> 16, ioread8(chip->vendor.iobase + TPM_RID(0)));
+
+
+From gregkh@mini.kroah.org Wed Sep 16 15:15:06 2009
+Message-Id: <20090916221506.226614681@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Sep 2009 15:13:24 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jan Kara <jack@suse.cz>
+Subject: [patch 04/10] udf: Use device size when drive reported bogus number of written blocks
+References: <20090916221320.283781925@mini.kroah.org>
+Content-Disposition: inline; filename=udf-use-device-size-when-drive-reported-bogus-number-of-written-blocks.patch
+Content-Length: 955
+Lines: 32
+
+From: Jan Kara <jack@suse.cz>
+
+commit 24a5d59f3477bcff4c069ff4d0ca9a3e037d0235 upstream.
+
+Some drives report 0 as the number of written blocks when there are some blocks
+recorded. Use device size in such case so that we can automagically mount such
+media.
+
+Signed-off-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/udf/lowlevel.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/fs/udf/lowlevel.c
++++ b/fs/udf/lowlevel.c
+@@ -56,7 +56,12 @@ unsigned long udf_get_last_block(struct
+ struct block_device *bdev = sb->s_bdev;
+ unsigned long lblock = 0;
+
+- if (ioctl_by_bdev(bdev, CDROM_LAST_WRITTEN, (unsigned long) &lblock))
++ /*
++ * ioctl failed or returned obviously bogus value?
++ * Try using the device size...
++ */
++ if (ioctl_by_bdev(bdev, CDROM_LAST_WRITTEN, (unsigned long) &lblock) ||
++ lblock == 0)
+ lblock = bdev->bd_inode->i_size >> sb->s_blocksize_bits;
+
+ if (lblock)
+
+
+From gregkh@mini.kroah.org Wed Sep 16 15:15:06 2009
+Message-Id: <20090916221506.354537930@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Sep 2009 15:13:25 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Sophie Hamilton <kernel@theblob.org>,
+ Takashi Iwai <tiwai@suse.de>
+Subject: [patch 05/10] ALSA: cs46xx - Fix minimum period size
+References: <20090916221320.283781925@mini.kroah.org>
+Content-Disposition: inline; filename=alsa-cs46xx-fix-minimum-period-size.patch
+Content-Length: 820
+Lines: 28
+
+From: Sophie Hamilton <kernel@theblob.org>
+
+commit 6148b130eb84edc76e4fa88da1877b27be6c2f06 upstream.
+
+Fix minimum period size for cs46xx cards. This fixes a problem in the
+case where neither a period size nor a buffer size is passed to ALSA;
+this is the case in Audacious, OpenAL, and others.
+
+Signed-off-by: Sophie Hamilton <kernel@theblob.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/cs46xx/cs46xx_lib.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/pci/cs46xx/cs46xx_lib.h
++++ b/sound/pci/cs46xx/cs46xx_lib.h
+@@ -35,7 +35,7 @@
+
+
+ #ifdef CONFIG_SND_CS46XX_NEW_DSP
+-#define CS46XX_MIN_PERIOD_SIZE 1
++#define CS46XX_MIN_PERIOD_SIZE 64
+ #define CS46XX_MAX_PERIOD_SIZE 1024*1024
+ #else
+ #define CS46XX_MIN_PERIOD_SIZE 2048
+
+
+From gregkh@mini.kroah.org Wed Sep 16 15:15:06 2009
+Message-Id: <20090916221506.492585155@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Sep 2009 15:13:26 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Tejun Heo <tj@kernel.org>,
+ Jeff Garzik <jgarzik@redhat.com>
+Subject: [patch 06/10] libata: fix off-by-one error in ata_tf_read_block()
+References: <20090916221320.283781925@mini.kroah.org>
+Content-Disposition: inline; filename=libata-fix-off-by-one-error-in-ata_tf_read_block.patch
+Content-Length: 1147
+Lines: 38
+
+From: Tejun Heo <htejun@gmail.com>
+
+commit ac8672ea922bde59acf50eaa1eaa1640a6395fd2 upstream.
+
+ata_tf_read_block() has off-by-one error when converting CHS address
+to LBA. The bug isn't very visible because ata_tf_read_block() is
+used only when generating sense data for a failed RW command and CHS
+addressing isn't used too often these days.
+
+This problem was spotted by Atsushi Nemoto.
+
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Reported-by: Atsushi Nemoto <anemo@mba.ocn.ne.jp>
+Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/ata/libata-core.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -565,7 +565,13 @@ u64 ata_tf_read_block(struct ata_taskfil
+ head = tf->device & 0xf;
+ sect = tf->lbal;
+
+- block = (cyl * dev->heads + head) * dev->sectors + sect;
++ if (!sect) {
++ ata_dev_printk(dev, KERN_WARNING, "device reported "
++ "invalid CHS sector 0\n");
++ sect = 1; /* oh well */
++ }
++
++ block = (cyl * dev->heads + head) * dev->sectors + sect - 1;
+ }
+
+ return block;
+
+
+From gregkh@mini.kroah.org Wed Sep 16 15:15:06 2009
+Message-Id: <20090916221506.633681567@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Sep 2009 15:13:27 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Brian King <brking@linux.vnet.ibm.com>,
+ Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Subject: [patch 07/10] powerpc/pseries: Fix to handle slb resize across migration
+References: <20090916221320.283781925@mini.kroah.org>
+Content-Disposition: inline; filename=powerpc-pseries-fix-to-handle-slb-resize-across-migration.patch
+Content-Length: 4790
+Lines: 160
+
+From: Brian King <brking@linux.vnet.ibm.com>
+
+commit 46db2f86a3b2a94e0b33e0b4548fb7b7b6bdff66 upstream.
+
+The SLB can change sizes across a live migration, which was not
+being handled, resulting in possible machine crashes during
+migration if migrating to a machine which has a smaller max SLB
+size than the source machine. Fix this by first reducing the
+SLB size to the minimum possible value, which is 32, prior to
+migration. Then during the device tree update which occurs after
+migration, we make the call to ensure the SLB gets updated. Also
+add the slb_size to the lparcfg output so that the migration
+tools can check to make sure the kernel has this capability
+before allowing migration in scenarios where the SLB size will change.
+
+BenH: Fixed #include <asm/mmu-hash64.h> -> <asm/mmu.h> to avoid
+ breaking ppc32 build
+
+Signed-off-by: Brian King <brking@linux.vnet.ibm.com>
+Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/powerpc/include/asm/mmu-hash64.h | 2 ++
+ arch/powerpc/kernel/lparcfg.c | 3 +++
+ arch/powerpc/kernel/rtas.c | 7 ++++++-
+ arch/powerpc/mm/slb.c | 16 ++++++++++++----
+ arch/powerpc/platforms/pseries/reconfig.c | 9 ++++++++-
+ 5 files changed, 31 insertions(+), 6 deletions(-)
+
+--- a/arch/powerpc/include/asm/mmu-hash64.h
++++ b/arch/powerpc/include/asm/mmu-hash64.h
+@@ -41,6 +41,7 @@ extern char initial_stab[];
+
+ #define SLB_NUM_BOLTED 3
+ #define SLB_CACHE_ENTRIES 8
++#define SLB_MIN_SIZE 32
+
+ /* Bits in the SLB ESID word */
+ #define SLB_ESID_V ASM_CONST(0x0000000008000000) /* valid */
+@@ -299,6 +300,7 @@ extern void slb_flush_and_rebolt(void);
+ extern void stab_initialize(unsigned long stab);
+
+ extern void slb_vmalloc_update(void);
++extern void slb_set_size(u16 size);
+ #endif /* __ASSEMBLY__ */
+
+ /*
+--- a/arch/powerpc/kernel/lparcfg.c
++++ b/arch/powerpc/kernel/lparcfg.c
+@@ -35,6 +35,7 @@
+ #include <asm/prom.h>
+ #include <asm/vdso_datapage.h>
+ #include <asm/vio.h>
++#include <asm/mmu.h>
+
+ #define MODULE_VERS "1.8"
+ #define MODULE_NAME "lparcfg"
+@@ -485,6 +486,8 @@ static int pseries_lparcfg_data(struct s
+
+ seq_printf(m, "shared_processor_mode=%d\n", lppaca[0].shared_proc);
+
++ seq_printf(m, "slb_size=%d\n", mmu_slb_size);
++
+ return 0;
+ }
+
+--- a/arch/powerpc/kernel/rtas.c
++++ b/arch/powerpc/kernel/rtas.c
+@@ -38,6 +38,7 @@
+ #include <asm/syscalls.h>
+ #include <asm/smp.h>
+ #include <asm/atomic.h>
++#include <asm/mmu.h>
+
+ struct rtas_t rtas = {
+ .lock = SPIN_LOCK_UNLOCKED
+@@ -665,6 +666,7 @@ static void rtas_percpu_suspend_me(void
+ {
+ long rc;
+ unsigned long msr_save;
++ u16 slb_size = mmu_slb_size;
+ int cpu;
+ struct rtas_suspend_me_data *data =
+ (struct rtas_suspend_me_data *)info;
+@@ -686,13 +688,16 @@ static void rtas_percpu_suspend_me(void
+ /* All other cpus are in H_JOIN, this cpu does
+ * the suspend.
+ */
++ slb_set_size(SLB_MIN_SIZE);
+ printk(KERN_DEBUG "calling ibm,suspend-me on cpu %i\n",
+ smp_processor_id());
+ data->error = rtas_call(data->token, 0, 1, NULL);
+
+- if (data->error)
++ if (data->error) {
+ printk(KERN_DEBUG "ibm,suspend-me returned %d\n",
+ data->error);
++ slb_set_size(slb_size);
++ }
+ } else {
+ printk(KERN_ERR "H_JOIN on cpu %i failed with rc = %ld\n",
+ smp_processor_id(), rc);
+--- a/arch/powerpc/mm/slb.c
++++ b/arch/powerpc/mm/slb.c
+@@ -247,14 +247,22 @@ void switch_slb(struct task_struct *tsk,
+ static inline void patch_slb_encoding(unsigned int *insn_addr,
+ unsigned int immed)
+ {
+- /* Assume the instruction had a "0" immediate value, just
+- * "or" in the new value
+- */
+- *insn_addr |= immed;
++ *insn_addr = (*insn_addr & 0xffff0000) | immed;
+ flush_icache_range((unsigned long)insn_addr, 4+
+ (unsigned long)insn_addr);
+ }
+
++void slb_set_size(u16 size)
++{
++ extern unsigned int *slb_compare_rr_to_size;
++
++ if (mmu_slb_size == size)
++ return;
++
++ mmu_slb_size = size;
++ patch_slb_encoding(slb_compare_rr_to_size, mmu_slb_size);
++}
++
+ void slb_initialize(void)
+ {
+ unsigned long linear_llp, vmalloc_llp, io_llp;
+--- a/arch/powerpc/platforms/pseries/reconfig.c
++++ b/arch/powerpc/platforms/pseries/reconfig.c
+@@ -20,6 +20,7 @@
+ #include <asm/machdep.h>
+ #include <asm/uaccess.h>
+ #include <asm/pSeries_reconfig.h>
++#include <asm/mmu.h>
+
+
+
+@@ -439,9 +440,15 @@ static int do_update_property(char *buf,
+ if (!newprop)
+ return -ENOMEM;
+
++ if (!strcmp(name, "slb-size") || !strcmp(name, "ibm,slb-size"))
++ slb_set_size(*(int *)value);
++
+ oldprop = of_find_property(np, name,NULL);
+- if (!oldprop)
++ if (!oldprop) {
++ if (strlen(name))
++ return prom_add_property(np, newprop);
+ return -ENODEV;
++ }
+
+ rc = prom_update_property(np, newprop, oldprop);
+ if (rc)
+
+
+From gregkh@mini.kroah.org Wed Sep 16 15:15:06 2009
+Message-Id: <20090916221506.761243734@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Sep 2009 15:13:28 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Clemens Ladisch <clemens@ladisch.de>,
+ Takashi Iwai <tiwai@suse.de>
+Subject: [patch 08/10] sound: oxygen: work around MCE when changing volume
+References: <20090916221320.283781925@mini.kroah.org>
+Content-Disposition: inline; filename=sound-oxygen-work-around-mce-when-changing-volume.patch
+Content-Length: 1498
+Lines: 45
+
+From: Clemens Ladisch <clemens@ladisch.de>
+
+commit f1bc07af9a9edc5c1d4bdd971f7099316ed2e405 upstream.
+
+When the volume is changed continuously (e.g., when the user drags a
+volume slider with the mouse), the driver does lots of I2C writes.
+Apparently, the sound chip can get confused when we poll the I2C status
+register too much, and fails to complete a read from it. On the PCI-E
+models, the PCI-E/PCI bridge gets upset by this and generates a machine
+check exception.
+
+To avoid this, this patch replaces the polling with an unconditional
+wait that is guaranteed to be long enough.
+
+Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
+Tested-by: Johann Messner <johann.messner at jku.at>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/oxygen/oxygen_io.c | 11 +----------
+ 1 file changed, 1 insertion(+), 10 deletions(-)
+
+--- a/sound/pci/oxygen/oxygen_io.c
++++ b/sound/pci/oxygen/oxygen_io.c
+@@ -214,17 +214,8 @@ EXPORT_SYMBOL(oxygen_write_spi);
+
+ void oxygen_write_i2c(struct oxygen *chip, u8 device, u8 map, u8 data)
+ {
+- unsigned long timeout;
+-
+ /* should not need more than about 300 us */
+- timeout = jiffies + msecs_to_jiffies(1);
+- do {
+- if (!(oxygen_read16(chip, OXYGEN_2WIRE_BUS_STATUS)
+- & OXYGEN_2WIRE_BUSY))
+- break;
+- udelay(1);
+- cond_resched();
+- } while (time_after_eq(timeout, jiffies));
++ msleep(1);
+
+ oxygen_write8(chip, OXYGEN_2WIRE_MAP, map);
+ oxygen_write8(chip, OXYGEN_2WIRE_DATA, data);
+
+
+From gregkh@mini.kroah.org Wed Sep 16 15:15:07 2009
+Message-Id: <20090916221506.929363993@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Sep 2009 15:13:29 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ "J. Bruce Fields" <bfields@citi.umich.edu>,
+ David Shaw <dshaw@jabberwocky.com>,
+ Chuck Ebbert <cebbert@redhat.com>
+Subject: [patch 09/10] Short write in nfsd becomes a full write to the client
+References: <20090916221320.283781925@mini.kroah.org>
+Content-Disposition: inline; filename=short-write-in-nfsd-becomes-a-full-write-to-the-client.patch
+Content-Length: 5523
+Lines: 174
+
+
+From: David Shaw <dshaw@jabberwocky.com>
+
+commit 31dec2538e45e9fff2007ea1f4c6bae9f78db724 upstream.
+
+Short write in nfsd becomes a full write to the client
+
+If a filesystem being written to via NFS returns a short write count
+(as opposed to an error) to nfsd, nfsd treats that as a success for
+the entire write, rather than the short count that actually succeeded.
+
+For example, given a 8192 byte write, if the underlying filesystem
+only writes 4096 bytes, nfsd will ack back to the nfs client that all
+8192 bytes were written. The nfs client does have retry logic for
+short writes, but this is never called as the client is told the
+complete write succeeded.
+
+There are probably other ways it could happen, but in my case it
+happened with a fuse (filesystem in userspace) filesystem which can
+rather easily have a partial write.
+
+Here is a patch to properly return the short write count to the
+client.
+
+Signed-off-by: David Shaw <dshaw@jabberwocky.com>
+Signed-off-by: J. Bruce Fields <bfields@citi.umich.edu>
+Cc: Chuck Ebbert <cebbert@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/nfsd/nfs3proc.c | 5 +++--
+ fs/nfsd/nfs4proc.c | 7 +++++--
+ fs/nfsd/nfsproc.c | 3 ++-
+ fs/nfsd/vfs.c | 13 +++++++------
+ include/linux/nfsd/nfsd.h | 2 +-
+ 5 files changed, 18 insertions(+), 12 deletions(-)
+
+--- a/fs/nfsd/nfs3proc.c
++++ b/fs/nfsd/nfs3proc.c
+@@ -201,6 +201,7 @@ nfsd3_proc_write(struct svc_rqst *rqstp,
+ struct nfsd3_writeres *resp)
+ {
+ __be32 nfserr;
++ unsigned long cnt = argp->len;
+
+ dprintk("nfsd: WRITE(3) %s %d bytes at %ld%s\n",
+ SVCFH_fmt(&argp->fh),
+@@ -213,9 +214,9 @@ nfsd3_proc_write(struct svc_rqst *rqstp,
+ nfserr = nfsd_write(rqstp, &resp->fh, NULL,
+ argp->offset,
+ rqstp->rq_vec, argp->vlen,
+- argp->len,
++ &cnt,
+ &resp->committed);
+- resp->count = argp->count;
++ resp->count = cnt;
+ RETURN_STATUS(nfserr);
+ }
+
+--- a/fs/nfsd/nfs4proc.c
++++ b/fs/nfsd/nfs4proc.c
+@@ -685,6 +685,7 @@ nfsd4_write(struct svc_rqst *rqstp, stru
+ struct file *filp = NULL;
+ u32 *p;
+ __be32 status = nfs_ok;
++ unsigned long cnt;
+
+ /* no need to check permission - this will be done in nfsd_write() */
+
+@@ -703,7 +704,7 @@ nfsd4_write(struct svc_rqst *rqstp, stru
+ return status;
+ }
+
+- write->wr_bytes_written = write->wr_buflen;
++ cnt = write->wr_buflen;
+ write->wr_how_written = write->wr_stable_how;
+ p = (u32 *)write->wr_verifier.data;
+ *p++ = nfssvc_boot.tv_sec;
+@@ -711,10 +712,12 @@ nfsd4_write(struct svc_rqst *rqstp, stru
+
+ status = nfsd_write(rqstp, &cstate->current_fh, filp,
+ write->wr_offset, rqstp->rq_vec, write->wr_vlen,
+- write->wr_buflen, &write->wr_how_written);
++ &cnt, &write->wr_how_written);
+ if (filp)
+ fput(filp);
+
++ write->wr_bytes_written = cnt;
++
+ if (status == nfserr_symlink)
+ status = nfserr_inval;
+ return status;
+--- a/fs/nfsd/nfsproc.c
++++ b/fs/nfsd/nfsproc.c
+@@ -179,6 +179,7 @@ nfsd_proc_write(struct svc_rqst *rqstp,
+ {
+ __be32 nfserr;
+ int stable = 1;
++ unsigned long cnt = argp->len;
+
+ dprintk("nfsd: WRITE %s %d bytes at %d\n",
+ SVCFH_fmt(&argp->fh),
+@@ -187,7 +188,7 @@ nfsd_proc_write(struct svc_rqst *rqstp,
+ nfserr = nfsd_write(rqstp, fh_copy(&resp->fh, &argp->fh), NULL,
+ argp->offset,
+ rqstp->rq_vec, argp->vlen,
+- argp->len,
++ &cnt,
+ &stable);
+ return nfsd_return_attrs(nfserr, resp);
+ }
+--- a/fs/nfsd/vfs.c
++++ b/fs/nfsd/vfs.c
+@@ -957,7 +957,7 @@ static void kill_suid(struct dentry *den
+ static __be32
+ nfsd_vfs_write(struct svc_rqst *rqstp, struct svc_fh *fhp, struct file *file,
+ loff_t offset, struct kvec *vec, int vlen,
+- unsigned long cnt, int *stablep)
++ unsigned long *cnt, int *stablep)
+ {
+ struct svc_export *exp;
+ struct dentry *dentry;
+@@ -971,7 +971,7 @@ nfsd_vfs_write(struct svc_rqst *rqstp, s
+ err = nfserr_perm;
+
+ if ((fhp->fh_export->ex_flags & NFSEXP_MSNFS) &&
+- (!lock_may_write(file->f_path.dentry->d_inode, offset, cnt)))
++ (!lock_may_write(file->f_path.dentry->d_inode, offset, *cnt)))
+ goto out;
+ #endif
+
+@@ -1003,7 +1003,7 @@ nfsd_vfs_write(struct svc_rqst *rqstp, s
+ host_err = vfs_writev(file, (struct iovec __user *)vec, vlen, &offset);
+ set_fs(oldfs);
+ if (host_err >= 0) {
+- nfsdstats.io_write += cnt;
++ nfsdstats.io_write += host_err;
+ fsnotify_modify(file->f_path.dentry);
+ }
+
+@@ -1048,9 +1048,10 @@ nfsd_vfs_write(struct svc_rqst *rqstp, s
+ }
+
+ dprintk("nfsd: write complete host_err=%d\n", host_err);
+- if (host_err >= 0)
++ if (host_err >= 0) {
+ err = 0;
+- else
++ *cnt = host_err;
++ } else
+ err = nfserrno(host_err);
+ out:
+ return err;
+@@ -1092,7 +1093,7 @@ out:
+ */
+ __be32
+ nfsd_write(struct svc_rqst *rqstp, struct svc_fh *fhp, struct file *file,
+- loff_t offset, struct kvec *vec, int vlen, unsigned long cnt,
++ loff_t offset, struct kvec *vec, int vlen, unsigned long *cnt,
+ int *stablep)
+ {
+ __be32 err = 0;
+--- a/include/linux/nfsd/nfsd.h
++++ b/include/linux/nfsd/nfsd.h
+@@ -105,7 +105,7 @@ void nfsd_close(struct file *);
+ __be32 nfsd_read(struct svc_rqst *, struct svc_fh *, struct file *,
+ loff_t, struct kvec *, int, unsigned long *);
+ __be32 nfsd_write(struct svc_rqst *, struct svc_fh *,struct file *,
+- loff_t, struct kvec *,int, unsigned long, int *);
++ loff_t, struct kvec *,int, unsigned long *, int *);
+ __be32 nfsd_readlink(struct svc_rqst *, struct svc_fh *,
+ char *, int *);
+ __be32 nfsd_symlink(struct svc_rqst *, struct svc_fh *,
+
+
+From gregkh@mini.kroah.org Wed Sep 16 15:15:07 2009
+Message-Id: <20090916221507.102426758@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Sep 2009 15:13:30 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ "J. Bruce Fields" <bfields@citi.umich.edu>,
+ Wei Yongjun <yjwei@cn.fujitsu.com>,
+ Chuck Ebbert <cebbert@redhat.com>
+Subject: [patch 10/10] nfsd: fix hung up of nfs client while sync write data to nfs server
+References: <20090916221320.283781925@mini.kroah.org>
+Content-Disposition: inline; filename=nfsd-fix-hung-up-of-nfs-client-while-sync-write-data-to-nfs-server.patch
+Content-Length: 1615
+Lines: 57
+
+
+From: Wei Yongjun <yjwei@cn.fujitsu.com>
+
+commit a0d24b295aed7a9daf4ca36bd4784e4d40f82303 upstream.
+
+nfsd: fix hung up of nfs client while sync write data to nfs server
+
+Commit 'Short write in nfsd becomes a full write to the client'
+(31dec2538e45e9fff2007ea1f4c6bae9f78db724) broken the sync write.
+With the following commands to reproduce:
+
+ $ mount -t nfs -o sync 192.168.0.21:/nfsroot /mnt
+ $ cd /mnt
+ $ echo aaaa > temp.txt
+
+Then nfs client is hung up.
+
+In SYNC mode the server alaways return the write count 0 to the
+client. This is because the value of host_err in nfsd_vfs_write()
+will be overwrite in SYNC mode by 'host_err=nfsd_sync(file);',
+and then we return host_err(which is now 0) as write count.
+
+This patch fixed the problem.
+
+Signed-off-by: Wei Yongjun <yjwei@cn.fujitsu.com>
+Signed-off-by: J. Bruce Fields <bfields@citi.umich.edu>
+Cc: Chuck Ebbert <cebbert@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/nfsd/vfs.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/fs/nfsd/vfs.c
++++ b/fs/nfsd/vfs.c
+@@ -1003,6 +1003,7 @@ nfsd_vfs_write(struct svc_rqst *rqstp, s
+ host_err = vfs_writev(file, (struct iovec __user *)vec, vlen, &offset);
+ set_fs(oldfs);
+ if (host_err >= 0) {
++ *cnt = host_err;
+ nfsdstats.io_write += host_err;
+ fsnotify_modify(file->f_path.dentry);
+ }
+@@ -1048,10 +1049,9 @@ nfsd_vfs_write(struct svc_rqst *rqstp, s
+ }
+
+ dprintk("nfsd: write complete host_err=%d\n", host_err);
+- if (host_err >= 0) {
++ if (host_err >= 0)
+ err = 0;
+- *cnt = host_err;
+- } else
++ else
+ err = nfserrno(host_err);
+ out:
+ return err;
+
+
+From gregkh@mini.kroah.org Wed Sep 16 15:15:05 2009
+Message-Id: <20090916221320.283781925@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Sep 2009 15:13:20 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk
+Subject: [patch 00/10] 2.6.27.35-stable review
+Content-Length: 1964
+Lines: 44
+
+This is the start of the stable review cycle for the 2.6.27.35 release.
+There are 10 patches in this series, all will be posted as a response to
+this one. If anyone has any issues with these being applied, please let
+us know. If anyone is a maintainer of the proper subsystem, and wants
+to add a Signed-off-by: line to the patch, please respond with it.
+
+These patches are sent out with a number of different people on the Cc:
+line. If you wish to be a reviewer, please email stable@kernel.org to
+add your name to the list. If you want to be off the reviewer list,
+also email us.
+
+Responses should be made by Friday, September 18, 22:00:00 UTC.
+Anything received after that time might be too late.
+
+The whole patch series can be found in one patch at:
+ kernel.org/pub/linux/kernel/v2.6/stable-review/patch-2.6.27.35-rc1.gz
+and the diffstat can be found below.
+
+
+thanks,
+
+greg k-h
+
+----------
+
+ Makefile | 2 +-
+ arch/powerpc/include/asm/mmu-hash64.h | 2 +
+ arch/powerpc/kernel/lparcfg.c | 3 +
+ arch/powerpc/kernel/rtas.c | 7 +++-
+ arch/powerpc/mm/slb.c | 16 +++++--
+ arch/powerpc/platforms/pseries/reconfig.c | 9 ++++-
+ drivers/ata/libata-core.c | 8 +++-
+ drivers/char/tpm/tpm_tis.c | 12 +++---
+ drivers/ps3/ps3stor_lib.c | 65 +++++++++++++++++++++++++++-
+ fs/binfmt_elf.c | 28 ++++++------
+ fs/nfsd/nfs3proc.c | 5 +-
+ fs/nfsd/nfs4proc.c | 7 ++-
+ fs/nfsd/nfsproc.c | 3 +-
+ fs/nfsd/vfs.c | 11 +++--
+ fs/udf/lowlevel.c | 7 +++-
+ include/linux/nfsd/nfsd.h | 2 +-
+ sound/pci/cs46xx/cs46xx_lib.h | 2 +-
+ sound/pci/oxygen/oxygen_io.c | 11 +----
+ 18 files changed, 146 insertions(+), 54 deletions(-)
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
