From 61ee496e7d2e34b197b9d4b2c9285fa1fb3ddd7d Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Thu, 6 May 2010 15:54:17 -0700 Subject: [PATCH] .33 patches --- ...-correctly-in-blk_rq_timed_out_timer.patch | 58 +++++++++ .../dm9601-fix-phy-eeprom-write-routine.patch | 42 +++++++ ...c-mce-fix-wrong-mask-and-macro-usage.patch | 48 ++++++++ ...ing-of-fsc-hardware-monitoring-chips.patch | 65 ++++++++++ ...ate-is-too-trigger-happy-with-d_drop.patch | 37 ++++++ ...-wsize-settings-ignored-on-v4-mounts.patch | 37 ++++++ ...for-superblocks-during-online-resize.patch | 38 ++++++ ...l-err_ptr-dereference-on-error-paths.patch | 30 +++++ ...te-vfs-inode-s-id-info-after-reflink.patch | 34 ++++++ ...lmfs-fix-math-error-when-reading-lvb.patch | 31 +++++ ...54pci-fix-bugs-in-p54p_check_tx_ring.patch | 36 ++++++ ...k-in-failure-path-of-perf_event_open.patch | 36 ++++++ .../powernow-k8-fix-frequency-reporting.patch | 35 ++++++ ...-fix-recovery-performance-regression.patch | 73 +++++++++++ ...dd-0x-prefix-to-hex-block_size_bytes.patch | 36 ++++++ ...al-8250_pnp-add-fujitsu-wacom-device.patch | 30 +++++ queue-2.6.33/series | 23 ++++ .../staging-hv-fix-a-bug-affecting-ipv6.patch | 31 +++++ ...g-hv-fix-up-memory-leak-on-hvcleanup.patch | 33 +++++ ...etwork-device-ethx-rather-than-sethx.patch | 35 ++++++ ...-base-on-fork-if-selector-is-nonzero.patch | 43 +++++++ ...ages-on-cpus-with-atom-erratum-aae44.patch | 72 +++++++++++ ...q_force_complete_move-for-xen-guests.patch | 37 ++++++ ...idges-unconditionally-on-amd-systems.patch | 114 ++++++++++++++++++ 24 files changed, 1054 insertions(+) create mode 100644 queue-2.6.33/block-ensure-jiffies-wrap-is-handled-correctly-in-blk_rq_timed_out_timer.patch create mode 100644 queue-2.6.33/dm9601-fix-phy-eeprom-write-routine.patch create mode 100644 queue-2.6.33/edac-mce-fix-wrong-mask-and-macro-usage.patch create mode 100644 queue-2.6.33/i2c-fix-probing-of-fsc-hardware-monitoring-chips.patch create mode 100644 queue-2.6.33/nfs-d_revalidate-is-too-trigger-happy-with-d_drop.patch create mode 100644 queue-2.6.33/nfs-rsize-and-wsize-settings-ignored-on-v4-mounts.patch create mode 100644 queue-2.6.33/ocfs2-compute-metaecc-for-superblocks-during-online-resize.patch create mode 100644 queue-2.6.33/ocfs2-potential-err_ptr-dereference-on-error-paths.patch create mode 100644 queue-2.6.33/ocfs2-update-vfs-inode-s-id-info-after-reflink.patch create mode 100644 queue-2.6.33/ocfs2_dlmfs-fix-math-error-when-reading-lvb.patch create mode 100644 queue-2.6.33/p54pci-fix-bugs-in-p54p_check_tx_ring.patch create mode 100644 queue-2.6.33/perf-fix-resource-leak-in-failure-path-of-perf_event_open.patch create mode 100644 queue-2.6.33/powernow-k8-fix-frequency-reporting.patch create mode 100644 queue-2.6.33/raid6-fix-recovery-performance-regression.patch create mode 100644 queue-2.6.33/revert-memory-hotplug-add-0x-prefix-to-hex-block_size_bytes.patch create mode 100644 queue-2.6.33/serial-8250_pnp-add-fujitsu-wacom-device.patch create mode 100644 queue-2.6.33/staging-hv-fix-a-bug-affecting-ipv6.patch create mode 100644 queue-2.6.33/staging-hv-fix-up-memory-leak-on-hvcleanup.patch create mode 100644 queue-2.6.33/staging-hv-name-network-device-ethx-rather-than-sethx.patch create mode 100644 queue-2.6.33/x86-64-clear-a-64-bit-fs-gs-base-on-fork-if-selector-is-nonzero.patch create mode 100644 queue-2.6.33/x86-disable-large-pages-on-cpus-with-atom-erratum-aae44.patch create mode 100644 queue-2.6.33/x86-fix-null-pointer-access-in-irq_force_complete_move-for-xen-guests.patch create mode 100644 queue-2.6.33/x86-k8-nb-fix-boot-crash-enable-k8_northbridges-unconditionally-on-amd-systems.patch diff --git a/queue-2.6.33/block-ensure-jiffies-wrap-is-handled-correctly-in-blk_rq_timed_out_timer.patch b/queue-2.6.33/block-ensure-jiffies-wrap-is-handled-correctly-in-blk_rq_timed_out_timer.patch new file mode 100644 index 00000000000..d75d06f196b --- /dev/null +++ b/queue-2.6.33/block-ensure-jiffies-wrap-is-handled-correctly-in-blk_rq_timed_out_timer.patch @@ -0,0 +1,58 @@ +From a534dbe96e9929c7245924d8252d89048c23d569 Mon Sep 17 00:00:00 2001 +From: Richard Kennedy +Date: Wed, 14 Apr 2010 20:54:03 +0200 +Subject: block: ensure jiffies wrap is handled correctly in blk_rq_timed_out_timer + +From: Richard Kennedy + +commit a534dbe96e9929c7245924d8252d89048c23d569 upstream. + +blk_rq_timed_out_timer() relied on blk_add_timer() never returning a +timer value of zero, but commit 7838c15b8dd18e78a523513749e5b54bda07b0cb +removed the code that bumped this value when it was zero. +Therefore when jiffies is near wrap we could get unlucky & not set the +timeout value correctly. + +This patch uses a flag to indicate that the timeout value was set and so +handles jiffies wrap correctly, and it keeps all the logic in one +function so should be easier to maintain in the future. + +Signed-off-by: Richard Kennedy +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman + +--- + block/blk-timeout.c | 12 +++++------- + 1 file changed, 5 insertions(+), 7 deletions(-) + +--- a/block/blk-timeout.c ++++ b/block/blk-timeout.c +@@ -109,6 +109,7 @@ void blk_rq_timed_out_timer(unsigned lon + struct request_queue *q = (struct request_queue *) data; + unsigned long flags, next = 0; + struct request *rq, *tmp; ++ int next_set = 0; + + spin_lock_irqsave(q->queue_lock, flags); + +@@ -122,16 +123,13 @@ void blk_rq_timed_out_timer(unsigned lon + if (blk_mark_rq_complete(rq)) + continue; + blk_rq_timed_out(rq); +- } else if (!next || time_after(next, rq->deadline)) ++ } else if (!next_set || time_after(next, rq->deadline)) { + next = rq->deadline; ++ next_set = 1; ++ } + } + +- /* +- * next can never be 0 here with the list non-empty, since we always +- * bump ->deadline to 1 so we can detect if the timer was ever added +- * or not. See comment in blk_add_timer() +- */ +- if (next) ++ if (next_set) + mod_timer(&q->timeout, round_jiffies_up(next)); + + spin_unlock_irqrestore(q->queue_lock, flags); diff --git a/queue-2.6.33/dm9601-fix-phy-eeprom-write-routine.patch b/queue-2.6.33/dm9601-fix-phy-eeprom-write-routine.patch new file mode 100644 index 00000000000..7920238280e --- /dev/null +++ b/queue-2.6.33/dm9601-fix-phy-eeprom-write-routine.patch @@ -0,0 +1,42 @@ +From e9162ab1610531d6ea6c1833daeb2613e44275e8 Mon Sep 17 00:00:00 2001 +From: Peter Korsgaard +Date: Mon, 3 May 2010 10:01:26 +0000 +Subject: dm9601: fix phy/eeprom write routine + +From: Peter Korsgaard + +commit e9162ab1610531d6ea6c1833daeb2613e44275e8 upstream. + +Use correct bit positions in DM_SHARED_CTRL register for writes. + +Michael Planes recently encountered a 'KY-RS9600 USB-LAN converter', which +came with a driver CD containing a Linux driver. This driver turns out to +be a copy of dm9601.c with symbols renamed and my copyright stripped. +That aside, it did contain 1 functional change in dm_write_shared_word(), +and after checking the datasheet the original value was indeed wrong +(read versus write bits). + +On Michaels HW, this change bumps receive speed from ~30KB/s to ~900KB/s. +On other devices the difference is less spectacular, but still significant +(~30%). + +Reported-by: Michael Planes +Signed-off-by: Peter Korsgaard +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/usb/dm9601.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/usb/dm9601.c ++++ b/drivers/net/usb/dm9601.c +@@ -238,7 +238,7 @@ static int dm_write_shared_word(struct u + goto out; + + dm_write_reg(dev, DM_SHARED_ADDR, phy ? (reg | 0x40) : reg); +- dm_write_reg(dev, DM_SHARED_CTRL, phy ? 0x1c : 0x14); ++ dm_write_reg(dev, DM_SHARED_CTRL, phy ? 0x1a : 0x12); + + for (i = 0; i < DM_TIMEOUT; i++) { + u8 tmp; diff --git a/queue-2.6.33/edac-mce-fix-wrong-mask-and-macro-usage.patch b/queue-2.6.33/edac-mce-fix-wrong-mask-and-macro-usage.patch new file mode 100644 index 00000000000..63ad9a23893 --- /dev/null +++ b/queue-2.6.33/edac-mce-fix-wrong-mask-and-macro-usage.patch @@ -0,0 +1,48 @@ +From 35d824b28fc5544d1eb7c1e3db15a1740df8ec4b Mon Sep 17 00:00:00 2001 +From: Borislav Petkov +Date: Fri, 30 Apr 2010 15:19:02 +0200 +Subject: edac, mce: Fix wrong mask and macro usage + +From: Borislav Petkov + +commit 35d824b28fc5544d1eb7c1e3db15a1740df8ec4b upstream. + +Correct two mishaps which prevented reporting error type (CECC vs UECC) +and extended error description. + +Signed-off-by: Borislav Petkov +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/edac/edac_mce_amd.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +--- a/drivers/edac/edac_mce_amd.c ++++ b/drivers/edac/edac_mce_amd.c +@@ -294,7 +294,6 @@ wrong_ls_mce: + void amd_decode_nb_mce(int node_id, struct err_regs *regs, int handle_errors) + { + u32 ec = ERROR_CODE(regs->nbsl); +- u32 xec = EXT_ERROR_CODE(regs->nbsl); + + if (!handle_errors) + return; +@@ -324,7 +323,7 @@ void amd_decode_nb_mce(int node_id, stru + pr_cont("\n"); + } + +- pr_emerg("%s.\n", EXT_ERR_MSG(xec)); ++ pr_emerg("%s.\n", EXT_ERR_MSG(regs->nbsl)); + + if (BUS_ERROR(ec) && nb_bus_decoder) + nb_bus_decoder(node_id, regs); +@@ -374,7 +373,7 @@ static int amd_decode_mce(struct notifie + ((m->status & MCI_STATUS_PCC) ? "yes" : "no")); + + /* do the two bits[14:13] together */ +- ecc = m->status & (3ULL << 45); ++ ecc = (m->status >> 45) & 0x3; + if (ecc) + pr_cont(", %sECC Error", ((ecc == 2) ? "C" : "U")); + diff --git a/queue-2.6.33/i2c-fix-probing-of-fsc-hardware-monitoring-chips.patch b/queue-2.6.33/i2c-fix-probing-of-fsc-hardware-monitoring-chips.patch new file mode 100644 index 00000000000..0d74bc6edb7 --- /dev/null +++ b/queue-2.6.33/i2c-fix-probing-of-fsc-hardware-monitoring-chips.patch @@ -0,0 +1,65 @@ +From b1d4b390ea4bb480e65974ce522a04022608a8df Mon Sep 17 00:00:00 2001 +From: Jean Delvare +Date: Tue, 4 May 2010 11:09:28 +0200 +Subject: i2c: Fix probing of FSC hardware monitoring chips + +From: Jean Delvare + +commit b1d4b390ea4bb480e65974ce522a04022608a8df upstream. + +Some FSC hardware monitoring chips (Syleus at least) doesn't like +quick writes we typically use to probe for I2C chips. Use a regular +byte read instead for the address they live at (0x73). These are the +only known chips living at this address on PC systems. + +For clarity, this fix should not be needed for kernels 2.6.30 and +later, as we started instantiating the hwmon devices explicitly based +on DMI data. Still, this fix is valuable in the following two cases: +* Support for recent FSC chips on older kernels. The DMI-based device + instantiation is more difficult to backport than the device support + itself. +* Case where the DMI-based device instantiation fails, whatever the + reason. We fall back to probing in that case, so it should work. + +This fixes kernel bug #15634: +https://bugzilla.kernel.org/show_bug.cgi?id=15634 + +Signed-off-by: Jean Delvare +Acked-by: Hans de Goede +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/i2c/i2c-core.c | 21 ++++++++++++++++----- + 1 file changed, 16 insertions(+), 5 deletions(-) + +--- a/drivers/i2c/i2c-core.c ++++ b/drivers/i2c/i2c-core.c +@@ -1210,12 +1210,23 @@ static int i2c_detect_address(struct i2c + return 0; + + /* Make sure there is something at this address */ +- if (i2c_smbus_xfer(adapter, addr, 0, 0, 0, I2C_SMBUS_QUICK, NULL) < 0) +- return 0; ++ if (addr == 0x73 && (adapter->class & I2C_CLASS_HWMON)) { ++ /* Special probe for FSC hwmon chips */ ++ union i2c_smbus_data dummy; ++ ++ if (i2c_smbus_xfer(adapter, addr, 0, I2C_SMBUS_READ, 0, ++ I2C_SMBUS_BYTE_DATA, &dummy) < 0) ++ return 0; ++ } else { ++ if (i2c_smbus_xfer(adapter, addr, 0, I2C_SMBUS_WRITE, 0, ++ I2C_SMBUS_QUICK, NULL) < 0) ++ return 0; + +- /* Prevent 24RF08 corruption */ +- if ((addr & ~0x0f) == 0x50) +- i2c_smbus_xfer(adapter, addr, 0, 0, 0, I2C_SMBUS_QUICK, NULL); ++ /* Prevent 24RF08 corruption */ ++ if ((addr & ~0x0f) == 0x50) ++ i2c_smbus_xfer(adapter, addr, 0, I2C_SMBUS_WRITE, 0, ++ I2C_SMBUS_QUICK, NULL); ++ } + + /* Finally call the custom detection function */ + memset(&info, 0, sizeof(struct i2c_board_info)); diff --git a/queue-2.6.33/nfs-d_revalidate-is-too-trigger-happy-with-d_drop.patch b/queue-2.6.33/nfs-d_revalidate-is-too-trigger-happy-with-d_drop.patch new file mode 100644 index 00000000000..d1bb266ff76 --- /dev/null +++ b/queue-2.6.33/nfs-d_revalidate-is-too-trigger-happy-with-d_drop.patch @@ -0,0 +1,37 @@ +From d9e80b7de91db05c1c4d2e5ebbfd70b3b3ba0e0f Mon Sep 17 00:00:00 2001 +From: Al Viro +Date: Thu, 29 Apr 2010 03:10:43 +0100 +Subject: nfs d_revalidate() is too trigger-happy with d_drop() + +From: Al Viro + +commit d9e80b7de91db05c1c4d2e5ebbfd70b3b3ba0e0f upstream. + +If dentry found stale happens to be a root of disconnected tree, we +can't d_drop() it; its d_hash is actually part of s_anon and d_drop() +would simply hide it from shrink_dcache_for_umount(), leading to +all sorts of fun, including busy inodes on umount and oopsen after +that. + +Bug had been there since at least 2006 (commit c636eb already has it), +so it's definitely -stable fodder. + +Signed-off-by: Al Viro +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + fs/nfs/dir.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/fs/nfs/dir.c ++++ b/fs/nfs/dir.c +@@ -837,6 +837,8 @@ out_zap_parent: + /* If we have submounts, don't unhash ! */ + if (have_submounts(dentry)) + goto out_valid; ++ if (dentry->d_flags & DCACHE_DISCONNECTED) ++ goto out_valid; + shrink_dcache_parent(dentry); + } + d_drop(dentry); diff --git a/queue-2.6.33/nfs-rsize-and-wsize-settings-ignored-on-v4-mounts.patch b/queue-2.6.33/nfs-rsize-and-wsize-settings-ignored-on-v4-mounts.patch new file mode 100644 index 00000000000..37cb2acdf94 --- /dev/null +++ b/queue-2.6.33/nfs-rsize-and-wsize-settings-ignored-on-v4-mounts.patch @@ -0,0 +1,37 @@ +From 356e76b855bdbfd8d1c5e75bcf0c6bf0dfe83496 Mon Sep 17 00:00:00 2001 +From: Chuck Lever +Date: Thu, 22 Apr 2010 15:35:56 -0400 +Subject: NFS: rsize and wsize settings ignored on v4 mounts + +From: Chuck Lever + +commit 356e76b855bdbfd8d1c5e75bcf0c6bf0dfe83496 upstream. + +NFSv4 mounts ignore the rsize and wsize mount options, and always use +the default transfer size for both. This seems to be because all +NFSv4 mounts are now cloned, and the cloning logic doesn't copy the +rsize and wsize settings from the parent nfs_server. + +I tested Fedora's 2.6.32.11-99 and it seems to have this problem as +well, so I'm guessing that .33, .32, and perhaps older kernels have +this issue as well. + +Signed-off-by: Chuck Lever +Signed-off-by: Trond Myklebust +Signed-off-by: Greg Kroah-Hartman + +--- + fs/nfs/client.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/fs/nfs/client.c ++++ b/fs/nfs/client.c +@@ -965,6 +965,8 @@ out_error: + static void nfs_server_copy_userdata(struct nfs_server *target, struct nfs_server *source) + { + target->flags = source->flags; ++ target->rsize = source->rsize; ++ target->wsize = source->wsize; + target->acregmin = source->acregmin; + target->acregmax = source->acregmax; + target->acdirmin = source->acdirmin; diff --git a/queue-2.6.33/ocfs2-compute-metaecc-for-superblocks-during-online-resize.patch b/queue-2.6.33/ocfs2-compute-metaecc-for-superblocks-during-online-resize.patch new file mode 100644 index 00000000000..217fffb4e43 --- /dev/null +++ b/queue-2.6.33/ocfs2-compute-metaecc-for-superblocks-during-online-resize.patch @@ -0,0 +1,38 @@ +From a42ab8e1a37257da37e0f018e707bf365ac24531 Mon Sep 17 00:00:00 2001 +From: Joel Becker +Date: Wed, 31 Mar 2010 18:25:44 -0700 +Subject: ocfs2: Compute metaecc for superblocks during online resize. + +From: Joel Becker + +commit a42ab8e1a37257da37e0f018e707bf365ac24531 upstream. + +Online resize writes out the new superblock and its backups directly. +The metaecc data wasn't being recomputed. Let's do that directly. + +Signed-off-by: Joel Becker +Acked-by: Mark Fasheh [ +Signed-off-by: Greg Kroah-Hartman + +--- + fs/ocfs2/buffer_head_io.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/fs/ocfs2/buffer_head_io.c ++++ b/fs/ocfs2/buffer_head_io.c +@@ -407,6 +407,7 @@ int ocfs2_write_super_or_backup(struct o + struct buffer_head *bh) + { + int ret = 0; ++ struct ocfs2_dinode *di = (struct ocfs2_dinode *)bh->b_data; + + mlog_entry_void(); + +@@ -426,6 +427,7 @@ int ocfs2_write_super_or_backup(struct o + + get_bh(bh); /* for end_buffer_write_sync() */ + bh->b_end_io = end_buffer_write_sync; ++ ocfs2_compute_meta_ecc(osb->sb, bh->b_data, &di->i_check); + submit_bh(WRITE, bh); + + wait_on_buffer(bh); diff --git a/queue-2.6.33/ocfs2-potential-err_ptr-dereference-on-error-paths.patch b/queue-2.6.33/ocfs2-potential-err_ptr-dereference-on-error-paths.patch new file mode 100644 index 00000000000..9099dea00cc --- /dev/null +++ b/queue-2.6.33/ocfs2-potential-err_ptr-dereference-on-error-paths.patch @@ -0,0 +1,30 @@ +From 0350cb078f5035716ebdad4ad4709d02fe466a8a Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Thu, 22 Apr 2010 11:39:29 +0200 +Subject: ocfs2: potential ERR_PTR dereference on error paths + +From: Dan Carpenter + +commit 0350cb078f5035716ebdad4ad4709d02fe466a8a upstream. + +If "handle" is non null at the end of the function then we assume it's a +valid pointer and pass it to ocfs2_commit_trans(); + +Signed-off-by: Dan Carpenter +Signed-off-by: Joel Becker +Signed-off-by: Greg Kroah-Hartman + +--- + fs/ocfs2/inode.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/fs/ocfs2/inode.c ++++ b/fs/ocfs2/inode.c +@@ -559,6 +559,7 @@ static int ocfs2_truncate_for_delete(str + handle = ocfs2_start_trans(osb, OCFS2_INODE_UPDATE_CREDITS); + if (IS_ERR(handle)) { + status = PTR_ERR(handle); ++ handle = NULL; + mlog_errno(status); + goto out; + } diff --git a/queue-2.6.33/ocfs2-update-vfs-inode-s-id-info-after-reflink.patch b/queue-2.6.33/ocfs2-update-vfs-inode-s-id-info-after-reflink.patch new file mode 100644 index 00000000000..41017e3707d --- /dev/null +++ b/queue-2.6.33/ocfs2-update-vfs-inode-s-id-info-after-reflink.patch @@ -0,0 +1,34 @@ +From c21a534e2f24968cf74976a4e721ac194db30ded Mon Sep 17 00:00:00 2001 +From: Tao Ma +Date: Wed, 21 Apr 2010 14:05:55 +0800 +Subject: ocfs2: Update VFS inode's id info after reflink. + +From: Tao Ma + +commit c21a534e2f24968cf74976a4e721ac194db30ded upstream. + +In reflink we update the id info on the disk but forgot to update +the corresponding information in the VFS inode. Update them +accordingly when we want to preserve the attributes. + +Reported-by: Jeff Liu +Signed-off-by: Tao Ma +Signed-off-by: Joel Becker +Signed-off-by: Greg Kroah-Hartman + +--- + fs/ocfs2/refcounttree.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/fs/ocfs2/refcounttree.c ++++ b/fs/ocfs2/refcounttree.c +@@ -4083,6 +4083,9 @@ static int ocfs2_complete_reflink(struct + di->i_attr = s_di->i_attr; + + if (preserve) { ++ t_inode->i_uid = s_inode->i_uid; ++ t_inode->i_gid = s_inode->i_gid; ++ t_inode->i_mode = s_inode->i_mode; + di->i_uid = s_di->i_uid; + di->i_gid = s_di->i_gid; + di->i_mode = s_di->i_mode; diff --git a/queue-2.6.33/ocfs2_dlmfs-fix-math-error-when-reading-lvb.patch b/queue-2.6.33/ocfs2_dlmfs-fix-math-error-when-reading-lvb.patch new file mode 100644 index 00000000000..87b055e023d --- /dev/null +++ b/queue-2.6.33/ocfs2_dlmfs-fix-math-error-when-reading-lvb.patch @@ -0,0 +1,31 @@ +From a36d515c7a2dfacebcf41729f6812dbc424ebcf0 Mon Sep 17 00:00:00 2001 +From: Joel Becker +Date: Fri, 23 Apr 2010 15:24:59 -0700 +Subject: ocfs2_dlmfs: Fix math error when reading LVB. + +From: Joel Becker + +commit a36d515c7a2dfacebcf41729f6812dbc424ebcf0 upstream. + +When asked for a partial read of the LVB in a dlmfs file, we can +accidentally calculate a negative count. + +Reported-by: Dan Carpenter +Signed-off-by: Joel Becker +Signed-off-by: Greg Kroah-Hartman + +--- + fs/ocfs2/dlm/dlmfs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/ocfs2/dlm/dlmfs.c ++++ b/fs/ocfs2/dlm/dlmfs.c +@@ -205,7 +205,7 @@ static ssize_t dlmfs_file_read(struct fi + if ((count + *ppos) > i_size_read(inode)) + readlen = i_size_read(inode) - *ppos; + else +- readlen = count - *ppos; ++ readlen = count; + + lvb_buf = kmalloc(readlen, GFP_NOFS); + if (!lvb_buf) diff --git a/queue-2.6.33/p54pci-fix-bugs-in-p54p_check_tx_ring.patch b/queue-2.6.33/p54pci-fix-bugs-in-p54p_check_tx_ring.patch new file mode 100644 index 00000000000..653c7fea5f6 --- /dev/null +++ b/queue-2.6.33/p54pci-fix-bugs-in-p54p_check_tx_ring.patch @@ -0,0 +1,36 @@ +From 0250ececdf6813457c98719e2d33b3684881fde0 Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Thu, 22 Apr 2010 19:52:16 +0200 +Subject: p54pci: fix bugs in p54p_check_tx_ring + +From: Hans de Goede + +commit 0250ececdf6813457c98719e2d33b3684881fde0 upstream. + +Hans de Goede identified a bug in p54p_check_tx_ring: + +there are two ring indices. 1 => tx data and 3 => tx management. +But the old code had a constant "1" and this resulted in spurious +dma unmapping failures. + +Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=583623 +Bug-Identified-by: Hans de Goede +Signed-off-by: Christian Lamparter +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/p54/p54pci.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/wireless/p54/p54pci.c ++++ b/drivers/net/wireless/p54/p54pci.c +@@ -245,7 +245,7 @@ static void p54p_check_tx_ring(struct ie + u32 idx, i; + + i = (*index) % ring_limit; +- (*index) = idx = le32_to_cpu(ring_control->device_idx[1]); ++ (*index) = idx = le32_to_cpu(ring_control->device_idx[ring_index]); + idx %= ring_limit; + + while (i != idx) { diff --git a/queue-2.6.33/perf-fix-resource-leak-in-failure-path-of-perf_event_open.patch b/queue-2.6.33/perf-fix-resource-leak-in-failure-path-of-perf_event_open.patch new file mode 100644 index 00000000000..ff0066b0e4f --- /dev/null +++ b/queue-2.6.33/perf-fix-resource-leak-in-failure-path-of-perf_event_open.patch @@ -0,0 +1,36 @@ +From 048c852051d2bd5da54a4488bc1f16b0fc74c695 Mon Sep 17 00:00:00 2001 +From: Tejun Heo +Date: Sat, 1 May 2010 10:11:35 +0200 +Subject: perf: Fix resource leak in failure path of perf_event_open() + +From: Tejun Heo + +commit 048c852051d2bd5da54a4488bc1f16b0fc74c695 upstream. + +perf_event_open() kfrees event after init failure which doesn't +release all resources allocated by perf_event_alloc(). Use +free_event() instead. + +Signed-off-by: Tejun Heo +Cc: Peter Zijlstra +Cc: Paul Mackerras +Cc: Arnaldo Carvalho de Melo +LKML-Reference: <4BDBE237.1040809@kernel.org> +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/perf_event.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/kernel/perf_event.c ++++ b/kernel/perf_event.c +@@ -4811,7 +4811,7 @@ err_fput_free_put_context: + + err_free_put_context: + if (err < 0) +- kfree(event); ++ free_event(event); + + err_put_context: + if (err < 0) diff --git a/queue-2.6.33/powernow-k8-fix-frequency-reporting.patch b/queue-2.6.33/powernow-k8-fix-frequency-reporting.patch new file mode 100644 index 00000000000..cfc95417217 --- /dev/null +++ b/queue-2.6.33/powernow-k8-fix-frequency-reporting.patch @@ -0,0 +1,35 @@ +From b810e94c9d8e3fff6741b66cd5a6f099a7887871 Mon Sep 17 00:00:00 2001 +From: Mark Langsdorf +Date: Wed, 31 Mar 2010 21:56:45 +0200 +Subject: powernow-k8: Fix frequency reporting + +From: Mark Langsdorf + +commit b810e94c9d8e3fff6741b66cd5a6f099a7887871 upstream. + +With F10, model 10, all valid frequencies are in the ACPI _PST table. + +Signed-off-by: Mark Langsdorf +LKML-Reference: <1270065406-1814-6-git-send-email-bp@amd64.org> +Signed-off-by: Borislav Petkov +Reviewed-by: Thomas Renninger +Signed-off-by: H. Peter Anvin +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/cpu/cpufreq/powernow-k8.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/arch/x86/kernel/cpu/cpufreq/powernow-k8.c ++++ b/arch/x86/kernel/cpu/cpufreq/powernow-k8.c +@@ -929,7 +929,8 @@ static int fill_powernow_table_pstate(st + powernow_table[i].index = index; + + /* Frequency may be rounded for these */ +- if (boot_cpu_data.x86 == 0x10 || boot_cpu_data.x86 == 0x11) { ++ if ((boot_cpu_data.x86 == 0x10 && boot_cpu_data.x86_model < 10) ++ || boot_cpu_data.x86 == 0x11) { + powernow_table[i].frequency = + freq_from_fid_did(lo & 0x3f, (lo >> 6) & 7); + } else diff --git a/queue-2.6.33/raid6-fix-recovery-performance-regression.patch b/queue-2.6.33/raid6-fix-recovery-performance-regression.patch new file mode 100644 index 00000000000..a79fdb85a3f --- /dev/null +++ b/queue-2.6.33/raid6-fix-recovery-performance-regression.patch @@ -0,0 +1,73 @@ +From 5157b4aa5b7de8787b6318e61bcc285031bb9088 Mon Sep 17 00:00:00 2001 +From: Dan Williams +Date: Tue, 4 May 2010 20:41:56 -0700 +Subject: raid6: fix recovery performance regression + +From: Dan Williams + +commit 5157b4aa5b7de8787b6318e61bcc285031bb9088 upstream. + +The raid6 recovery code should immediately drop back to the optimized +synchronous path when a p+q dma resource is not available. Otherwise we +run the non-optimized/multi-pass async code in sync mode. + +Verified with raid6test (NDISKS=255) + +Applies to kernels >= 2.6.32. + +Acked-by: NeilBrown +Reported-by: H. Peter Anvin +Signed-off-by: Dan Williams +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + crypto/async_tx/async_raid6_recov.c | 21 +++++++++++++-------- + 1 file changed, 13 insertions(+), 8 deletions(-) + +--- a/crypto/async_tx/async_raid6_recov.c ++++ b/crypto/async_tx/async_raid6_recov.c +@@ -324,6 +324,7 @@ struct dma_async_tx_descriptor * + async_raid6_2data_recov(int disks, size_t bytes, int faila, int failb, + struct page **blocks, struct async_submit_ctl *submit) + { ++ void *scribble = submit->scribble; + int non_zero_srcs, i; + + BUG_ON(faila == failb); +@@ -332,11 +333,13 @@ async_raid6_2data_recov(int disks, size_ + + pr_debug("%s: disks: %d len: %zu\n", __func__, disks, bytes); + +- /* we need to preserve the contents of 'blocks' for the async +- * case, so punt to synchronous if a scribble buffer is not available ++ /* if a dma resource is not available or a scribble buffer is not ++ * available punt to the synchronous path. In the 'dma not ++ * available' case be sure to use the scribble buffer to ++ * preserve the content of 'blocks' as the caller intended. + */ +- if (!submit->scribble) { +- void **ptrs = (void **) blocks; ++ if (!async_dma_find_channel(DMA_PQ) || !scribble) { ++ void **ptrs = scribble ? scribble : (void **) blocks; + + async_tx_quiesce(&submit->depend_tx); + for (i = 0; i < disks; i++) +@@ -406,11 +409,13 @@ async_raid6_datap_recov(int disks, size_ + + pr_debug("%s: disks: %d len: %zu\n", __func__, disks, bytes); + +- /* we need to preserve the contents of 'blocks' for the async +- * case, so punt to synchronous if a scribble buffer is not available ++ /* if a dma resource is not available or a scribble buffer is not ++ * available punt to the synchronous path. In the 'dma not ++ * available' case be sure to use the scribble buffer to ++ * preserve the content of 'blocks' as the caller intended. + */ +- if (!scribble) { +- void **ptrs = (void **) blocks; ++ if (!async_dma_find_channel(DMA_PQ) || !scribble) { ++ void **ptrs = scribble ? scribble : (void **) blocks; + + async_tx_quiesce(&submit->depend_tx); + for (i = 0; i < disks; i++) diff --git a/queue-2.6.33/revert-memory-hotplug-add-0x-prefix-to-hex-block_size_bytes.patch b/queue-2.6.33/revert-memory-hotplug-add-0x-prefix-to-hex-block_size_bytes.patch new file mode 100644 index 00000000000..4a628ce0045 --- /dev/null +++ b/queue-2.6.33/revert-memory-hotplug-add-0x-prefix-to-hex-block_size_bytes.patch @@ -0,0 +1,36 @@ +From 4dc86ae1f925b2121d4e75058675895f83e54c71 Mon Sep 17 00:00:00 2001 +From: Linus Torvalds +Date: Fri, 9 Apr 2010 10:05:33 -0700 +Subject: Revert "memory-hotplug: add 0x prefix to HEX block_size_bytes" + +From: Linus Torvalds + +commit 4dc86ae1f925b2121d4e75058675895f83e54c71 upstream. + +This reverts commit ba168fc37dea145deeb8fa9e7e71c748d2e00d74. + +It changes user-visible sysfs interfaces, and breaks some existing user +space applications which apparently rely on the fact that the output +does not contain the "0x" prefix. + +Requested-by: Heiko Carstens +Acked-by: KOSAKI Motohiro +Acked-by: Wu Fengguang +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/base/memory.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/base/memory.c ++++ b/drivers/base/memory.c +@@ -311,7 +311,7 @@ static SYSDEV_ATTR(removable, 0444, show + static ssize_t + print_block_size(struct class *class, char *buf) + { +- return sprintf(buf, "%#lx\n", (unsigned long)PAGES_PER_SECTION * PAGE_SIZE); ++ return sprintf(buf, "%lx\n", (unsigned long)PAGES_PER_SECTION * PAGE_SIZE); + } + + static CLASS_ATTR(block_size_bytes, 0444, print_block_size, NULL); diff --git a/queue-2.6.33/serial-8250_pnp-add-fujitsu-wacom-device.patch b/queue-2.6.33/serial-8250_pnp-add-fujitsu-wacom-device.patch new file mode 100644 index 00000000000..4504f4d81f2 --- /dev/null +++ b/queue-2.6.33/serial-8250_pnp-add-fujitsu-wacom-device.patch @@ -0,0 +1,30 @@ +From d9901660b53b92f0f3551c06588b8be38224b245 Mon Sep 17 00:00:00 2001 +From: Ping Cheng +Date: Mon, 22 Mar 2010 13:40:29 -0700 +Subject: serial: 8250_pnp - add Fujitsu Wacom device + +From: Ping Cheng + +commit d9901660b53b92f0f3551c06588b8be38224b245 upstream. + +Add Fujitsu Wacom 1FGT Tablet PC device + +Signed-off-by: Ping Cheng +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/serial/8250_pnp.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/serial/8250_pnp.c ++++ b/drivers/serial/8250_pnp.c +@@ -348,6 +348,8 @@ static const struct pnp_device_id pnp_de + { "FUJ02E6", 0 }, + /* Fujitsu Wacom 2FGT Tablet PC device */ + { "FUJ02E7", 0 }, ++ /* Fujitsu Wacom 1FGT Tablet PC device */ ++ { "FUJ02E9", 0 }, + /* + * LG C1 EXPRESS DUAL (C1-PB11A3) touch screen (actually a FUJ02E6 in + * disguise) diff --git a/queue-2.6.33/series b/queue-2.6.33/series index 9fc978a5548..d498e3ca2d4 100644 --- a/queue-2.6.33/series +++ b/queue-2.6.33/series @@ -28,3 +28,26 @@ usb-don-t-choose-configs-with-no-interfaces.patch usb-ohci-don-t-look-at-the-root-hub-to-get-the-number-of-ports.patch usb-xhci-properly-set-the-mult-field-of-the-endpoint-context.patch usb-xhci-properly-set-endpoint-context-fields-for-periodic-eps.patch +ocfs2-update-vfs-inode-s-id-info-after-reflink.patch +ocfs2-potential-err_ptr-dereference-on-error-paths.patch +ocfs2-compute-metaecc-for-superblocks-during-online-resize.patch +ocfs2_dlmfs-fix-math-error-when-reading-lvb.patch +powernow-k8-fix-frequency-reporting.patch +nfs-d_revalidate-is-too-trigger-happy-with-d_drop.patch +nfs-rsize-and-wsize-settings-ignored-on-v4-mounts.patch +staging-hv-fix-a-bug-affecting-ipv6.patch +staging-hv-fix-up-memory-leak-on-hvcleanup.patch +staging-hv-name-network-device-ethx-rather-than-sethx.patch +i2c-fix-probing-of-fsc-hardware-monitoring-chips.patch +perf-fix-resource-leak-in-failure-path-of-perf_event_open.patch +raid6-fix-recovery-performance-regression.patch +serial-8250_pnp-add-fujitsu-wacom-device.patch +block-ensure-jiffies-wrap-is-handled-correctly-in-blk_rq_timed_out_timer.patch +revert-memory-hotplug-add-0x-prefix-to-hex-block_size_bytes.patch +dm9601-fix-phy-eeprom-write-routine.patch +p54pci-fix-bugs-in-p54p_check_tx_ring.patch +edac-mce-fix-wrong-mask-and-macro-usage.patch +x86-64-clear-a-64-bit-fs-gs-base-on-fork-if-selector-is-nonzero.patch +x86-disable-large-pages-on-cpus-with-atom-erratum-aae44.patch +x86-fix-null-pointer-access-in-irq_force_complete_move-for-xen-guests.patch +x86-k8-nb-fix-boot-crash-enable-k8_northbridges-unconditionally-on-amd-systems.patch diff --git a/queue-2.6.33/staging-hv-fix-a-bug-affecting-ipv6.patch b/queue-2.6.33/staging-hv-fix-a-bug-affecting-ipv6.patch new file mode 100644 index 00000000000..3b346348d09 --- /dev/null +++ b/queue-2.6.33/staging-hv-fix-a-bug-affecting-ipv6.patch @@ -0,0 +1,31 @@ +From 95beae90aa4afce57fb28e6f8238b78217bd7c98 Mon Sep 17 00:00:00 2001 +From: Haiyang Zhang +Date: Mon, 19 Apr 2010 15:32:11 +0000 +Subject: Staging: hv: Fix a bug affecting IPv6 + +From: Haiyang Zhang + +commit 95beae90aa4afce57fb28e6f8238b78217bd7c98 upstream. + +Fix a bug affecting IPv6 +Added the multicast flag for proper IPv6 function. + +Reported-by: Toshikazu Sakai +Signed-off-by: Hank Janssen +Signed-off-by: Haiyang Zhang +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/hv/RndisFilter.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/staging/hv/RndisFilter.c ++++ b/drivers/staging/hv/RndisFilter.c +@@ -756,6 +756,7 @@ static int RndisFilterOpenDevice(struct + + ret = RndisFilterSetPacketFilter(Device, + NDIS_PACKET_TYPE_BROADCAST | ++ NDIS_PACKET_TYPE_ALL_MULTICAST | + NDIS_PACKET_TYPE_DIRECTED); + if (ret == 0) + Device->State = RNDIS_DEV_DATAINITIALIZED; diff --git a/queue-2.6.33/staging-hv-fix-up-memory-leak-on-hvcleanup.patch b/queue-2.6.33/staging-hv-fix-up-memory-leak-on-hvcleanup.patch new file mode 100644 index 00000000000..3ba99067470 --- /dev/null +++ b/queue-2.6.33/staging-hv-fix-up-memory-leak-on-hvcleanup.patch @@ -0,0 +1,33 @@ +From fa8ad0257ea256381126ecf447694622216c600f Mon Sep 17 00:00:00 2001 +From: Cyrill Gorcunov +Date: Mon, 5 Apr 2010 20:56:57 +0400 +Subject: Staging: hv: Fix up memory leak on HvCleanup + +From: Cyrill Gorcunov + +commit fa8ad0257ea256381126ecf447694622216c600f upstream. + +Don't assign NULL too early + +Signed-off-by: Cyrill Gorcunov +Cc: Hank Janssen +Cc: Haiyang Zhang +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/hv/Hv.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/staging/hv/Hv.c ++++ b/drivers/staging/hv/Hv.c +@@ -306,9 +306,9 @@ void HvCleanup(void) + DPRINT_ENTER(VMBUS); + + if (gHvContext.SignalEventBuffer) { ++ kfree(gHvContext.SignalEventBuffer); + gHvContext.SignalEventBuffer = NULL; + gHvContext.SignalEventParam = NULL; +- kfree(gHvContext.SignalEventBuffer); + } + + if (gHvContext.GuestId == HV_LINUX_GUEST_ID) { diff --git a/queue-2.6.33/staging-hv-name-network-device-ethx-rather-than-sethx.patch b/queue-2.6.33/staging-hv-name-network-device-ethx-rather-than-sethx.patch new file mode 100644 index 00000000000..894a307b45f --- /dev/null +++ b/queue-2.6.33/staging-hv-name-network-device-ethx-rather-than-sethx.patch @@ -0,0 +1,35 @@ +From 546d9e101e7a71e6202f47a13ddcd9b8fb05a52e Mon Sep 17 00:00:00 2001 +From: Stephen Hemminger +Date: Thu, 11 Mar 2010 09:11:37 -0800 +Subject: Staging: hv: name network device ethX rather than sethX + +From: Stephen Hemminger + +commit 546d9e101e7a71e6202f47a13ddcd9b8fb05a52e upstream. + +This patch makes the HyperV network device use the same naming scheme as +other virtual drivers (Xen, KVM). In an ideal world, userspace tools +would not care what the name is, but some users and applications do +care. Vyatta CLI is one of the tools that does depend on what the name +is. + +Signed-off-by: Stephen Hemminger +Cc: Hank Janssen +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/hv/netvsc_drv.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/drivers/staging/hv/netvsc_drv.c ++++ b/drivers/staging/hv/netvsc_drv.c +@@ -413,8 +413,7 @@ static int netvsc_probe(struct device *d + if (!net_drv_obj->Base.OnDeviceAdd) + return -1; + +- net = alloc_netdev(sizeof(struct net_device_context), "seth%d", +- ether_setup); ++ net = alloc_etherdev(sizeof(struct net_device_context)); + if (!net) + return -1; + diff --git a/queue-2.6.33/x86-64-clear-a-64-bit-fs-gs-base-on-fork-if-selector-is-nonzero.patch b/queue-2.6.33/x86-64-clear-a-64-bit-fs-gs-base-on-fork-if-selector-is-nonzero.patch new file mode 100644 index 00000000000..82e4f55b36c --- /dev/null +++ b/queue-2.6.33/x86-64-clear-a-64-bit-fs-gs-base-on-fork-if-selector-is-nonzero.patch @@ -0,0 +1,43 @@ +From 7ce5a2b9bb2e92902230e3121d8c3047fab9cb47 Mon Sep 17 00:00:00 2001 +From: H. Peter Anvin +Date: Fri, 23 Apr 2010 16:17:40 -0700 +Subject: x86-64: Clear a 64-bit FS/GS base on fork if selector is nonzero + +From: H. Peter Anvin + +commit 7ce5a2b9bb2e92902230e3121d8c3047fab9cb47 upstream. + +When we do a thread switch, we clear the outgoing FS/GS base if the +corresponding selector is nonzero. This is taken by __switch_to() as +an entry invariant; it does not verify that it is true on entry. +However, copy_thread() doesn't enforce this constraint, which can +result in inconsistent results after fork(). + +Make copy_thread() match the behavior of __switch_to(). + +Reported-and-tested-by: Samuel Thibault +Signed-off-by: H. Peter Anvin +LKML-Reference: <4BD1E061.8030605@zytor.com> +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/process_64.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/x86/kernel/process_64.c ++++ b/arch/x86/kernel/process_64.c +@@ -282,12 +282,12 @@ int copy_thread(unsigned long clone_flag + + set_tsk_thread_flag(p, TIF_FORK); + +- p->thread.fs = me->thread.fs; +- p->thread.gs = me->thread.gs; + p->thread.io_bitmap_ptr = NULL; + + savesegment(gs, p->thread.gsindex); ++ p->thread.gs = p->thread.gsindex ? 0 : me->thread.gs; + savesegment(fs, p->thread.fsindex); ++ p->thread.fs = p->thread.fsindex ? 0 : me->thread.fs; + savesegment(es, p->thread.es); + savesegment(ds, p->thread.ds); + diff --git a/queue-2.6.33/x86-disable-large-pages-on-cpus-with-atom-erratum-aae44.patch b/queue-2.6.33/x86-disable-large-pages-on-cpus-with-atom-erratum-aae44.patch new file mode 100644 index 00000000000..dd537004846 --- /dev/null +++ b/queue-2.6.33/x86-disable-large-pages-on-cpus-with-atom-erratum-aae44.patch @@ -0,0 +1,72 @@ +From 7a0fc404ae663776e96db43879a0fa24fec1fa3a Mon Sep 17 00:00:00 2001 +From: H. Peter Anvin +Date: Tue, 13 Apr 2010 14:40:54 -0700 +Subject: x86: Disable large pages on CPUs with Atom erratum AAE44 + +From: H. Peter Anvin + +commit 7a0fc404ae663776e96db43879a0fa24fec1fa3a upstream. + +Atom erratum AAE44/AAF40/AAG38/AAH41: + +"If software clears the PS (page size) bit in a present PDE (page +directory entry), that will cause linear addresses mapped through this +PDE to use 4-KByte pages instead of using a large page after old TLB +entries are invalidated. Due to this erratum, if a code fetch uses +this PDE before the TLB entry for the large page is invalidated then +it may fetch from a different physical address than specified by +either the old large page translation or the new 4-KByte page +translation. This erratum may also cause speculative code fetches from +incorrect addresses." + +[http://download.intel.com/design/processor/specupdt/319536.pdf] + +Where as commit 211b3d03c7400f48a781977a50104c9d12f4e229 seems to +workaround errata AAH41 (mixed 4K TLBs) it reduces the window of +opportunity for the bug to occur and does not totally remove it. This +patch disables mixed 4K/4MB page tables totally avoiding the page +splitting and not tripping this processor issue. + +This is based on an original patch by Colin King. + +Originally-by: Colin Ian King +Cc: Colin Ian King +Cc: Ingo Molnar +Signed-off-by: H. Peter Anvin +LKML-Reference: <1269271251-19775-1-git-send-email-colin.king@canonical.com> +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/cpu/intel.c | 21 +++++++++++++++++++++ + 1 file changed, 21 insertions(+) + +--- a/arch/x86/kernel/cpu/intel.c ++++ b/arch/x86/kernel/cpu/intel.c +@@ -47,6 +47,27 @@ static void __cpuinit early_init_intel(s + (c->x86 == 0x6 && c->x86_model >= 0x0e)) + set_cpu_cap(c, X86_FEATURE_CONSTANT_TSC); + ++ /* ++ * Atom erratum AAE44/AAF40/AAG38/AAH41: ++ * ++ * A race condition between speculative fetches and invalidating ++ * a large page. This is worked around in microcode, but we ++ * need the microcode to have already been loaded... so if it is ++ * not, recommend a BIOS update and disable large pages. ++ */ ++ if (c->x86 == 6 && c->x86_model == 0x1c && c->x86_mask <= 2) { ++ u32 ucode, junk; ++ ++ wrmsr(MSR_IA32_UCODE_REV, 0, 0); ++ sync_core(); ++ rdmsr(MSR_IA32_UCODE_REV, junk, ucode); ++ ++ if (ucode < 0x20e) { ++ printk(KERN_WARNING "Atom PSE erratum detected, BIOS microcode update recommended\n"); ++ clear_cpu_cap(c, X86_FEATURE_PSE); ++ } ++ } ++ + #ifdef CONFIG_X86_64 + set_cpu_cap(c, X86_FEATURE_SYSENTER32); + #else diff --git a/queue-2.6.33/x86-fix-null-pointer-access-in-irq_force_complete_move-for-xen-guests.patch b/queue-2.6.33/x86-fix-null-pointer-access-in-irq_force_complete_move-for-xen-guests.patch new file mode 100644 index 00000000000..14b86dfe928 --- /dev/null +++ b/queue-2.6.33/x86-fix-null-pointer-access-in-irq_force_complete_move-for-xen-guests.patch @@ -0,0 +1,37 @@ +From bbd391a15d82e14efe9d69ba64cadb855b061dba Mon Sep 17 00:00:00 2001 +From: Prarit Bhargava +Date: Tue, 27 Apr 2010 11:24:42 -0400 +Subject: x86: Fix NULL pointer access in irq_force_complete_move() for Xen guests + +From: Prarit Bhargava + +commit bbd391a15d82e14efe9d69ba64cadb855b061dba upstream. + +Upstream PV guests fail to boot because of a NULL pointer in +irq_force_complete_move(). It is possible that xen guests have +irq_desc->chip_data = NULL. + +Test for NULL chip_data pointer before attempting to complete an irq move. + +Signed-off-by: Prarit Bhargava +LKML-Reference: <20100427152434.16193.49104.sendpatchset@prarit.bos.redhat.com> +Acked-by: Suresh Siddha +Signed-off-by: H. Peter Anvin +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/apic/io_apic.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/arch/x86/kernel/apic/io_apic.c ++++ b/arch/x86/kernel/apic/io_apic.c +@@ -2539,6 +2539,9 @@ void irq_force_complete_move(int irq) + struct irq_desc *desc = irq_to_desc(irq); + struct irq_cfg *cfg = desc->chip_data; + ++ if (!cfg) ++ return; ++ + __irq_complete_move(&desc, cfg->vector); + } + #else diff --git a/queue-2.6.33/x86-k8-nb-fix-boot-crash-enable-k8_northbridges-unconditionally-on-amd-systems.patch b/queue-2.6.33/x86-k8-nb-fix-boot-crash-enable-k8_northbridges-unconditionally-on-amd-systems.patch new file mode 100644 index 00000000000..47bd2508882 --- /dev/null +++ b/queue-2.6.33/x86-k8-nb-fix-boot-crash-enable-k8_northbridges-unconditionally-on-amd-systems.patch @@ -0,0 +1,114 @@ +From 0e152cd7c16832bd5cadee0c2e41d9959bc9b6f9 Mon Sep 17 00:00:00 2001 +From: Borislav Petkov +Date: Fri, 12 Mar 2010 15:43:03 +0100 +Subject: x86, k8 nb: Fix boot crash: enable k8_northbridges unconditionally on AMD systems + +From: Borislav Petkov + +commit 0e152cd7c16832bd5cadee0c2e41d9959bc9b6f9 upstream. + +de957628ce7c84764ff41331111036b3ae5bad0f changed setting of the +x86_init.iommu.iommu_init function ptr only when GART IOMMU is +found. + +One side effect of it is that num_k8_northbridges +is not initialized anymore if not explicitly +called. This resulted in uninitialized pointers in +, +for example, which uses the num_k8_northbridges thing through +node_to_k8_nb_misc(). + +Fix that through an initcall that runs right after the PCI +subsystem and does all the scanning. Then, remove initialization +in gart_iommu_init() which is a rootfs_initcall and we're +running before that. + +What is more, since num_k8_northbridges is being used in other +places beside GART IOMMU, include it whenever we add AMD CPU +support. The previous dependency chain in kconfig contained + +K8_NB depends on AGP_AMD64|GART_IOMMU + +which was clearly incorrect. The more natural way in terms of +hardware dependency should be + +AGP_AMD64|GART_IOMMU depends on K8_NB depends on CPU_SUP_AMD && +PCI. Make it so Number One! + +Signed-off-by: Borislav Petkov +Cc: FUJITA Tomonori +Cc: Joerg Roedel +LKML-Reference: <20100312144303.GA29262@aftab> +Signed-off-by: Ingo Molnar +Tested-by: Joerg Roedel +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/Kconfig | 4 ++-- + arch/x86/kernel/k8.c | 14 ++++++++++++++ + arch/x86/kernel/pci-gart_64.c | 2 +- + drivers/char/agp/Kconfig | 2 +- + 4 files changed, 18 insertions(+), 4 deletions(-) + +--- a/arch/x86/Kconfig ++++ b/arch/x86/Kconfig +@@ -627,7 +627,7 @@ config GART_IOMMU + bool "GART IOMMU support" if EMBEDDED + default y + select SWIOTLB +- depends on X86_64 && PCI ++ depends on X86_64 && PCI && K8_NB + ---help--- + Support for full DMA access of devices with 32bit memory access only + on systems with more than 3GB. This is usually needed for USB, +@@ -2026,7 +2026,7 @@ endif # X86_32 + + config K8_NB + def_bool y +- depends on AGP_AMD64 || (X86_64 && (GART_IOMMU || (PCI && NUMA))) ++ depends on CPU_SUP_AMD && PCI + + source "drivers/pcmcia/Kconfig" + +--- a/arch/x86/kernel/k8.c ++++ b/arch/x86/kernel/k8.c +@@ -121,3 +121,17 @@ void k8_flush_garts(void) + } + EXPORT_SYMBOL_GPL(k8_flush_garts); + ++static __init int init_k8_nbs(void) ++{ ++ int err = 0; ++ ++ err = cache_k8_northbridges(); ++ ++ if (err < 0) ++ printk(KERN_NOTICE "K8 NB: Cannot enumerate AMD northbridges.\n"); ++ ++ return err; ++} ++ ++/* This has to go after the PCI subsystem */ ++fs_initcall(init_k8_nbs); +--- a/arch/x86/kernel/pci-gart_64.c ++++ b/arch/x86/kernel/pci-gart_64.c +@@ -738,7 +738,7 @@ int __init gart_iommu_init(void) + unsigned long scratch; + long i; + +- if (cache_k8_northbridges() < 0 || num_k8_northbridges == 0) ++ if (num_k8_northbridges == 0) + return 0; + + #ifndef CONFIG_AGP_AMD64 +--- a/drivers/char/agp/Kconfig ++++ b/drivers/char/agp/Kconfig +@@ -57,7 +57,7 @@ config AGP_AMD + + config AGP_AMD64 + tristate "AMD Opteron/Athlon64 on-CPU GART support" +- depends on AGP && X86 ++ depends on AGP && X86 && K8_NB + help + This option gives you AGP support for the GLX component of + X using the on-CPU northbridge of the AMD Athlon64/Opteron CPUs. -- 2.47.3