commit a1c4c06a2e4d6f5fa7ce200d8df6dc0c0d89ae00 Author: Greg Kroah-Hartman Date: Thu Sep 24 08:28:02 2009 -0700 Linux 2.6.30.8 commit 98388802712ebe17ac81b7602fd4d2dce141235a Author: Brian King Date: Fri Aug 28 12:06:29 2009 +0000 powerpc/pseries: Fix to handle slb resize across migration commit 46db2f86a3b2a94e0b33e0b4548fb7b7b6bdff66 upstream. The SLB can change sizes across a live migration, which was not being handled, resulting in possible machine crashes during migration if migrating to a machine which has a smaller max SLB size than the source machine. Fix this by first reducing the SLB size to the minimum possible value, which is 32, prior to migration. Then during the device tree update which occurs after migration, we make the call to ensure the SLB gets updated. Also add the slb_size to the lparcfg output so that the migration tools can check to make sure the kernel has this capability before allowing migration in scenarios where the SLB size will change. BenH: Fixed #include -> to avoid breaking ppc32 build Signed-off-by: Brian King Signed-off-by: Benjamin Herrenschmidt Signed-off-by: Greg Kroah-Hartman commit 8717bad06ba13356600381e5babe5f62e74c49be Author: Jean Delvare Date: Tue Jul 28 11:49:19 2009 +0200 PCI: Unhide the SMBus on the Compaq Evo D510 USDT commit 6b5096e4d4496e185cd1ada5d1b8e1d941c805ed upstream. One more form factor for Compaq Evo D510, which needs the same quirk as the other form factors. Apparently there's no hardware monitoring chip on that one, but SPD EEPROMs, so it's still worth unhiding the SMBus. Signed-off-by: Jean Delvare Tested-by: Nuzhna Pomoshch Signed-off-by: Jesse Barnes Signed-off-by: Greg Kroah-Hartman commit db4d3b9dedd857ae5f90301a654b7997132be7ae Author: Tejun Heo Date: Sun Aug 16 21:21:21 2009 +0900 libata: fix off-by-one error in ata_tf_read_block() commit ac8672ea922bde59acf50eaa1eaa1640a6395fd2 upstream. ata_tf_read_block() has off-by-one error when converting CHS address to LBA. The bug isn't very visible because ata_tf_read_block() is used only when generating sense data for a failed RW command and CHS addressing isn't used too often these days. This problem was spotted by Atsushi Nemoto. Signed-off-by: Tejun Heo Reported-by: Atsushi Nemoto Signed-off-by: Jeff Garzik Signed-off-by: Greg Kroah-Hartman commit 98d53d73e1a28f0f55de4141ef91799aba0507b6 Author: Christoph Hellwig Date: Fri Sep 11 18:49:19 2009 -0400 virtio_blk: don't bounce highmem requests commit 4eff3cae9c9809720c636e64bc72f212258e0bd5 upstream virtio_blk: don't bounce highmem requests By default a block driver bounces highmem requests, but virtio-blk is perfectly fine with any request that fit into it's 64 bit addressing scheme, mapped in the kernel virtual space or not. Besides improving performance on highmem systems this also makes the reproducible oops in __bounce_end_io go away (but hiding the real cause). Signed-off-by: Christoph Hellwig Signed-off-by: Rusty Russell Cc: Chuck Ebbert Signed-off-by: Greg Kroah-Hartman commit 330c9c3402b93246476e685c41da974663c152cc Author: Franklin Meng Date: Sat Sep 12 10:31:05 2009 -0400 V4L: em28xx: set up tda9887_conf in em28xx_card_setup() V4L: em28xx: set up tda9887_conf in em28xx_card_setup() (cherry picked from commit ae3340cbf59ea362c2016eea762456cc0969fd9e) Added tda9887_conf set up into em28xx_card_setup() Signed-off-by: Franklin Meng Signed-off-by: Douglas Schilling Landgraf Signed-off-by: Mauro Carvalho Chehab Tested-by: Larry Finger Signed-off-by: Michael Krufky Signed-off-by: Greg Kroah-Hartman commit a3aa9dfe9a7ae1f4e7b6be739669a6d764f04481 Author: Jack Steiner Date: Thu Sep 3 12:56:02 2009 -0500 x86, pat: Fix cacheflush address in change_page_attr_set_clr() commit fa526d0d641b5365676a1fb821ce359e217c9b85 upstream. Fix address passed to cpa_flush_range() when changing page attributes from WB to UC. The address (*addr) is modified by __change_page_attr_set_clr(). The result is that the pages being flushed start at the _end_ of the changed range instead of the beginning. This should be considered for 2.6.30-stable and 2.6.31-stable. Signed-off-by: Jack Steiner Acked-by: Suresh Siddha Signed-off-by: H. Peter Anvin Signed-off-by: Greg Kroah-Hartman commit 0863b5e00d32b9adaf93226c893918af297b74f3 Author: Jeremy Fitzhardinge Date: Thu Sep 3 12:27:15 2009 -0700 x86/i386: Make sure stack-protector segment base is cache aligned commit 1ea0d14e480c245683927eecc03a70faf06e80c8 upstream. The Intel Optimization Reference Guide says: In Intel Atom microarchitecture, the address generation unit assumes that the segment base will be 0 by default. Non-zero segment base will cause load and store operations to experience a delay. - If the segment base isn't aligned to a cache line boundary, the max throughput of memory operations is reduced to one [e]very 9 cycles. [...] Assembly/Compiler Coding Rule 15. (H impact, ML generality) For Intel Atom processors, use segments with base set to 0 whenever possible; avoid non-zero segment base address that is not aligned to cache line boundary at all cost. We can't avoid having a non-zero base for the stack-protector segment, but we can make it cache-aligned. Signed-off-by: Jeremy Fitzhardinge LKML-Reference: <4AA01893.6000507@goop.org> Signed-off-by: Ingo Molnar Signed-off-by: Greg Kroah-Hartman commit 06849e6aac573df704bcb4889d4696cac6ecf8cd Author: Roel Kluin Date: Tue Aug 25 15:35:12 2009 +0200 x86: Fix x86_model test in es7000_apic_is_cluster() commit 005155b1f626d2b2d7932e4afdf4fead168c6888 upstream. For the x86_model to be greater than 6 or less than 12 is logically always true. Signed-off-by: Roel Kluin Cc: Andrew Morton Signed-off-by: Ingo Molnar Signed-off-by: Greg Kroah-Hartman commit 852a95da5412bb513bf83ad1daa39992fa72b81e Author: Clemens Ladisch Date: Mon Sep 7 10:18:54 2009 +0200 sound: oxygen: work around MCE when changing volume commit f1bc07af9a9edc5c1d4bdd971f7099316ed2e405 upstream. When the volume is changed continuously (e.g., when the user drags a volume slider with the mouse), the driver does lots of I2C writes. Apparently, the sound chip can get confused when we poll the I2C status register too much, and fails to complete a read from it. On the PCI-E models, the PCI-E/PCI bridge gets upset by this and generates a machine check exception. To avoid this, this patch replaces the polling with an unconditional wait that is guaranteed to be long enough. Signed-off-by: Clemens Ladisch Tested-by: Johann Messner Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit 23b7ff36511e0aea0b054d0c7236f8f91509da07 Author: Tejun Heo Date: Tue Jul 21 16:08:43 2009 -0700 PCI: apply nv_msi_ht_cap_quirk on resume too commit 6dab62ee5a3bf4f71b8320c09db2e6022a19f40e upstream. http://bugzilla.kernel.org/show_bug.cgi?id=12542 reports that with the quirk not applied on resume, msi stops working after resuming and mcp78s ahci fails due to IRQ mis-delivery. Apply it on resume too. Signed-off-by: Tejun Heo Cc: Peer Chen Cc: Tj Reported-by: Nicolas Derive Cc: Greg KH Signed-off-by: Andrew Morton Signed-off-by: Jesse Barnes Signed-off-by: Greg Kroah-Hartman commit 359de899b30a6c1c18e53ca4a8e4265d9f7f67c0 Author: Roland Dreier Date: Sat Sep 5 20:24:49 2009 -0700 mlx4_core: Allocate and map sufficient ICM memory for EQ context commit fa0681d2129732027355d6b7083dd8932b9b799d upstream. The current implementation allocates a single host page for EQ context memory, which was OK when we only allocated a few EQs. However, since we now allocate an EQ for each CPU core, this patch removes the hard-coded limit (which we exceed with 4 KB pages and 128 byte EQ context entries with 32 CPUs) and uses the same ICM table code as all other context tables, which ends up simplifying the code quite a bit while fixing the problem. This problem was actually hit in practice on a dual-socket Nehalem box with 16 real hardware threads and sufficiently odd ACPI tables that it shows on boot SMP: Allowing 32 CPUs, 16 hotplug CPUs so num_possible_cpus() ends up 32, and mlx4 ends up creating 33 MSI-X interrupts and 33 EQs. This mlx4 bug means that mlx4 can't even initialize at all on this quite mainstream system. Reported-by: Eli Cohen Tested-by: Christoph Lameter Signed-off-by: Roland Dreier Signed-off-by: Greg Kroah-Hartman commit 3817edf120ea09f196e4794aba72b97669f51dc1 Author: Mark Brown Date: Mon Sep 7 18:09:58 2009 +0100 ASoC: Fix WM835x Out4 capture enumeration commit 87831cb660954356d68cebdb1406f3be09e784e9 upstream. It's the 8th enum of a zero indexed array. This is why I don't let new drivers use these arrays of enums... Signed-off-by: Mark Brown Signed-off-by: Greg Kroah-Hartman commit 852c46ecee723c7ee5c248e96b4dd226e6649454 Author: Nicolas Pitre Date: Thu Sep 3 21:45:59 2009 +0100 ARM: 5691/1: fix cache aliasing issues between kmap() and kmap_atomic() with highmem commit 7929eb9cf643ae416e5081b2a6fa558d37b9854c upstream. Let's suppose a highmem page is kmap'd with kmap(). A pkmap entry is used, the page mapped to it, and the virtual cache is dirtied. Then kunmap() is used which does virtually nothing except for decrementing a usage count. Then, let's suppose the _same_ page gets mapped using kmap_atomic(). It is therefore mapped onto a fixmap entry instead, which has a different virtual address unaware of the dirty cache data for that page sitting in the pkmap mapping. Fortunately it is easy to know if a pkmap mapping still exists for that page and use it directly with kmap_atomic(), thanks to kmap_high_get(). And actual testing with a printk in the added code path shows that this condition is actually met *extremely* frequently. Seems that we've been quite lucky that things have worked so well with highmem so far. Signed-off-by: Nicolas Pitre Signed-off-by: Russell King Signed-off-by: Greg Kroah-Hartman commit 6d2bc6a9e03037619b34e1c1becff75e9c175bc6 Author: Sophie Hamilton Date: Tue Sep 8 10:58:42 2009 +0200 ALSA: cs46xx - Fix minimum period size commit 6148b130eb84edc76e4fa88da1877b27be6c2f06 upstream. Fix minimum period size for cs46xx cards. This fixes a problem in the case where neither a period size nor a buffer size is passed to ALSA; this is the case in Audacious, OpenAL, and others. Signed-off-by: Sophie Hamilton Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit 5bed4ac47c46cb9425ec1afb090ea3fed2017cbc Author: Jan Kara Date: Thu Jun 18 12:33:16 2009 +0200 udf: Use device size when drive reported bogus number of written blocks commit 24a5d59f3477bcff4c069ff4d0ca9a3e037d0235 upstream. Some drives report 0 as the number of written blocks when there are some blocks recorded. Use device size in such case so that we can automagically mount such media. Signed-off-by: Jan Kara Signed-off-by: Greg Kroah-Hartman commit 3aad23963b58deb117f763805176b5dec74dc5b0 Author: Jason Gunthorpe Date: Wed Sep 9 17:22:18 2009 -0600 TPM: Fixup boot probe timeout for tpm_tis driver commit ec57935837a78f9661125b08a5d08b697568e040 upstream. When probing the device in tpm_tis_init the call request_locality uses timeout_a, which wasn't being initalized until after request_locality. This results in request_locality falsely timing out if the chip is still starting. Move the initialization to before request_locality. This probably only matters for embedded cases (ie mine), a BIOS likely gets the TPM into a state where this code path isn't necessary. Signed-off-by: Jason Gunthorpe Acked-by: Rajiv Andrade Signed-off-by: James Morris Signed-off-by: Greg Kroah-Hartman commit 423b4ef5e712ef34d55d070d0cb84c9bb4a07ec2 Author: Geoff Levand Date: Wed Sep 9 13:28:05 2009 +0000 powerpc/ps3: Workaround for flash memory I/O error commit bc00351edd5c1b84d48c3fdca740fedfce4ae6ce upstream. A workaround for flash memory I/O errors when the PS3 internal hard disk has not been formatted for OtherOS use. This error condition mainly effects 'Live CD' users who have not formatted the PS3's internal hard disk for OtherOS. Fixes errors similar to these when using the ps3-flash-util or ps3-boot-game-os programs: ps3flash read failed 0x2050000 os_area_header_read: read error: os_area_header: Input/output error main:627: os_area_read_hp error. ERROR: can't change boot flag Signed-off-by: Geoff Levand Signed-off-by: Benjamin Herrenschmidt Signed-off-by: Greg Kroah-Hartman commit d4f93b323665e2fcf97de46f9740452ebaf43e4c Author: Hugh Dickins Date: Sat Sep 12 12:21:27 2009 +0100 fix undefined reference to user_shm_unlock commit 2195d2818c37bdf263865f1e9effccdd9fc5f9d4 upstream. My 353d5c30c666580347515da609dd74a2b8e9b828 "mm: fix hugetlb bug due to user_shm_unlock call" broke the CONFIG_SYSVIPC !CONFIG_MMU build of both 2.6.31 and 2.6.30.6: "undefined reference to `user_shm_unlock'". gcc didn't understand my comment! so couldn't figure out to optimize away user_shm_unlock() from the error path in the hugetlb-less case, as it does elsewhere. Help it to do so, in a language it understands. Reported-by: Mike Frysinger Signed-off-by: Hugh Dickins Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 222c06bae9ee5b2ecdabf6b54fc67e28f93867ea Author: Bob Copeland Date: Tue Sep 1 18:12:11 2009 -0400 cfg80211: fix looping soft lockup in find_ie() commit fcc6cb0c13555e78c2d47257b6d1b5e59b0c419a upstream. The find_ie() function uses a size_t for the len parameter, and directly uses len as a loop variable. If any received packets are malformed, it is possible for the decrease of len to overflow, and since the result is unsigned, the loop will not terminate. Change it to a signed int so the loop conditional works for negative values. This fixes the following soft lockup: [38573.102007] BUG: soft lockup - CPU#0 stuck for 61s! [phy0:2230] [38573.102007] Modules linked in: aes_i586 aes_generic fuse af_packet ipt_REJECT xt_tcpudp nf_conntrack_ipv4 nf_defrag_ipv4 xt_state iptable_filter ip_tables x_tables acpi_cpufreq binfmt_misc dm_mirror dm_region_hash dm_log dm_multipath dm_mod kvm_intel kvm uinput i915 arc4 ecb drm snd_hda_codec_idt ath5k snd_hda_intel hid_apple mac80211 usbhid appletouch snd_hda_codec snd_pcm ath cfg80211 snd_timer i2c_algo_bit ohci1394 video snd processor ieee1394 rfkill ehci_hcd sg sky2 backlight snd_page_alloc uhci_hcd joydev output ac thermal button battery sr_mod applesmc cdrom input_polldev evdev unix [last unloaded: scsi_wait_scan] [38573.102007] irq event stamp: 2547724535 [38573.102007] hardirqs last enabled at (2547724534): [] restore_all_notrace+0x0/0x18 [38573.102007] hardirqs last disabled at (2547724535): [] apic_timer_interrupt+0x28/0x34 [38573.102007] softirqs last enabled at (92950144): [] __do_softirq+0x108/0x210 [38573.102007] softirqs last disabled at (92950274): [] _spin_lock_bh+0x14/0x80 [38573.102007] [38573.102007] Pid: 2230, comm: phy0 Tainted: G W (2.6.31-rc7-wl #8) MacBook1,1 [38573.102007] EIP: 0060:[] EFLAGS: 00010292 CPU: 0 [38573.102007] EIP is at cmp_ies+0x30/0x180 [cfg80211] [38573.102007] EAX: 00000082 EBX: 00000000 ECX: ffffffc1 EDX: d8efd014 [38573.102007] ESI: ffffff7c EDI: 0000004d EBP: eee2dc50 ESP: eee2dc3c [38573.102007] DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068 [38573.102007] CR0: 8005003b CR2: d8efd014 CR3: 01694000 CR4: 000026d0 [38573.102007] DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000 [38573.102007] DR6: ffff0ff0 DR7: 00000400 [38573.102007] Call Trace: [38573.102007] [] cmp_bss+0xed/0x100 [cfg80211] [38573.102007] [] cfg80211_bss_update+0x84/0x410 [cfg80211] [38573.102007] [] cfg80211_inform_bss_frame+0x114/0x180 [cfg80211] [38573.102007] [] ieee80211_bss_info_update+0x4f/0x180 [mac80211] [38573.102007] [] ieee80211_rx_bss_info+0x88/0xf0 [mac80211] [38573.102007] [] ? ieee802_11_parse_elems+0x27/0x30 [mac80211] [38573.102007] [] ieee80211_rx_mgmt_probe_resp+0xa4/0x1c0 [mac80211] [38573.102007] [] ieee80211_sta_rx_queued_mgmt+0x919/0xc50 [mac80211] [38573.102007] [] ? sched_clock+0x27/0xa0 [38573.102007] [] ? sched_clock+0x27/0xa0 [38573.102007] [] ? mark_held_locks+0x60/0x80 [38573.102007] [] ? _spin_unlock_irqrestore+0x55/0x70 [38573.102007] [] ? sub_preempt_count+0x85/0xc0 [38573.102007] [] ? _spin_unlock_irqrestore+0x3e/0x70 [38573.102007] [] ? skb_dequeue+0x4f/0x70 [38573.102007] [] ieee80211_sta_work+0x91/0xb80 [mac80211] [38573.102007] [] ? sched_clock+0x27/0xa0 [38573.102007] [] ? sub_preempt_count+0x85/0xc0 [38573.102007] [] worker_thread+0x18f/0x320 [38573.102007] [] ? worker_thread+0x12e/0x320 [38573.102007] [] ? _spin_unlock_irqrestore+0x55/0x70 [38573.102007] [] ? ieee80211_sta_work+0x0/0xb80 [mac80211] [38573.102007] [] ? autoremove_wake_function+0x0/0x50 [38573.102007] [] ? worker_thread+0x0/0x320 [38573.102007] [] kthread+0x84/0x90 [38573.102007] [] ? kthread+0x0/0x90 [38573.102007] [] kernel_thread_helper+0x7/0x10 Signed-off-by: Bob Copeland Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit 1cb8fc89d73a27843d76c27974755df1f954e18c Author: Roland McGrath Date: Tue Sep 8 19:49:40 2009 -0700 binfmt_elf: fix PT_INTERP bss handling commit 9f0ab4a3f0fdb1ff404d150618ace2fa069bb2e1 upstream. In fs/binfmt_elf.c, load_elf_interp() calls padzero() for .bss even if the PT_LOAD has no PROT_WRITE and no .bss. This generates EFAULT. Here is a small test case. (Yes, there are other, useful PT_INTERP which have only .text and no .data/.bss.) ----- ptinterp.S _start: .globl _start nop int3 ----- $ gcc -m32 -nostartfiles -nostdlib -o ptinterp ptinterp.S $ gcc -m32 -Wl,--dynamic-linker=ptinterp -o hello hello.c $ ./hello Segmentation fault # during execve() itself After applying the patch: $ ./hello Trace trap # user-mode execution after execve() finishes If the ELF headers are actually self-inconsistent, then dying is fine. But having no PROT_WRITE segment is perfectly normal and correct if there is no segment with p_memsz > p_filesz (i.e. bss). John Reiser suggested checking for PROT_WRITE in the bss logic. I think it makes most sense to simply apply the bss logic only when there is bss. This patch looks less trivial than it is due to some reindentation. It just moves the "if (last_bss > elf_bss) {" test up to include the partial-page bss logic as well as the more-pages bss logic. Reported-by: John Reiser Signed-off-by: Roland McGrath Signed-off-by: James Morris Signed-off-by: Greg Kroah-Hartman commit f1d3ff8e09a2f7bf1ba969c1d38d29725ef1a4c4 Author: Bob Copeland Date: Sat Jul 4 21:03:13 2009 -0400 ath5k: write PCU registers on initial reset commit 3355443ad7601991affa5992b0d53870335af765 upstream. "Ath5k: unify resets" introduced a regression into 2.6.28 where the PCU registers are never initialized, due to ath5k_reset() always passing true for change_channel. We subsequently program a lot of these registers but several may start in an unknown state. Reported-by: Forrest Zhang Signed-off-by: Bob Copeland Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit 23c686de43928eb7d2bcc2485333e87498f5a27e Author: Zhenyu Wang Date: Mon Sep 14 10:47:06 2009 +0800 agp/intel: remove restore in resume commit 121264827656f5f06328b17983c796af17dc5949 upstream. As early pci resume has already restored config for host bridge and graphics device, don't need to restore it again, This removes an original order hack for graphics device restore. This fixed the resume hang issue found by Alan Stern on 845G, caused by extra config restore on graphics device. Cc: Alan Stern Signed-off-by: Zhenyu Wang Signed-off-by: Dave Airlie Signed-off-by: Greg Kroah-Hartman commit a9b9f4d868e06a2b98bf760dbd3325c11b03b416 Author: Michal Schmidt Date: Thu Sep 3 14:27:08 2009 +0200 sg: fix oops in the error path in sg_build_indirect() commit e71044ee2efa4792e21d243b03d49006db66aec9 upstream. When the allocation fails in sg_build_indirect(), an oops happens in the error path. It's caused by an obvious typo. Signed-off-by: Michal Schmidt Reported-by: Bob Tracy Acked-by: Douglas Gilbert Signed-off-by: James Bottomley Signed-off-by: Greg Kroah-Hartman commit e276bbcae3a15314c94ae97283697d818fbe8a1b Author: Stephen Kitt Date: Wed Aug 12 01:12:08 2009 -0700 Input: joydev - decouple axis and button map ioctls from input constants commit ec8b4b7085605e801a7740a2c3c33256aebe249c upstream. The KEY_MAX change in 2.6.28 changed the values of the JSIOCSBTNMAP and JSIOCGBTNMAP constants; software compiled with the old values no longer works with kernels following 2.6.28, because the ioctl switch statement no longer matches the values given by the software. This patch handles these ioctls independently of the length of data specified, and applies the same treatment to JSIOCSAXMAP and JSIOCGAXMAP which currently depend on ABS_MAX. Signed-off-by: Stephen Kitt Signed-off-by: Dmitry Torokhov Signed-off-by: Greg Kroah-Hartman