commit 3e7ad8ed979ce9e3ad897dd87c50bf577966f89c Author: Greg Kroah-Hartman Date: Mon Apr 26 07:48:30 2010 -0700 Linux 2.6.33.3 commit 8dc1df692d2cc167fbd37a29180c14115498e7e3 Author: Neil Horman Date: Thu Apr 1 07:30:07 2010 +0000 r8169: clean up my printk uglyness commit 93f4d91d879acfcb0ba9c2725e3133fcff2dfd1e upstream. Fix formatting on r8169 printk Brandon Philips noted that I had a spacing issue in my printk for the last r8169 patch that made it quite ugly. Fix that up and add the PFX macro to it as well so it looks like the other r8169 printks Signed-off-by: Neil Horman Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit f78a4090514f62d2db8085d56721c11333cf2796 Author: Joerg Roedel Date: Wed Apr 7 12:57:35 2010 +0200 x86/gart: Disable GART explicitly before initialization commit 4b83873d3da0704987cb116833818ed96214ee29 upstream. If we boot into a crash-kernel the gart might still be enabled and its caches might be dirty. This can result in undefined behavior later. Fix it by explicitly disabling the gart hardware before initialization and flushing the caches after enablement. Signed-off-by: Joerg Roedel Signed-off-by: Greg Kroah-Hartman commit 151b026f22691dfb64247f9505a259405b6a1d04 Author: Jan Kiszka Date: Wed Apr 14 16:57:11 2010 +0200 KVM: x86: Fix TSS size check for 16-bit tasks (Cherry-picked from commit e8861cfe2c75bdce36655b64d7ce02c2b31b604d) A 16-bit TSS is only 44 bytes long. So make sure to test for the correct size on task switch. Signed-off-by: Jan Kiszka Signed-off-by: Avi Kivity Signed-off-by: Greg Kroah-Hartman commit 00e7035cabdd49657b80b4e0b6995310dc198847 Author: Sridhar Samudrala Date: Tue Mar 30 16:48:25 2010 -0700 KVM: Increase NR_IOBUS_DEVS limit to 200 (Cherry-picked from commit e80e2a60ff7914dae691345a976c80bbbff3ec74) This patch increases the current hardcoded limit of NR_IOBUS_DEVS from 6 to 200. We are hitting this limit when creating a guest with more than 1 virtio-net device using vhost-net backend. Each virtio-net device requires 2 such devices to service notifications from rx/tx queues. Signed-off-by: Sridhar Samudrala Signed-off-by: Avi Kivity Signed-off-by: Greg Kroah-Hartman commit ff5bfd4f4896c3f27dafcc4ae533b0d803968499 Author: Takuya Yoshikawa Date: Mon Apr 12 19:35:35 2010 +0900 KVM: fix the handling of dirty bitmaps to avoid overflows (Cherry-picked from commit 87bf6e7de1134f48681fd2ce4b7c1ec45458cb6d) Int is not long enough to store the size of a dirty bitmap. This patch fixes this problem with the introduction of a wrapper function to calculate the sizes of dirty bitmaps. Note: in mark_page_dirty(), we have to consider the fact that __set_bit() takes the offset as int, not long. Signed-off-by: Takuya Yoshikawa Signed-off-by: Marcelo Tosatti Signed-off-by: Greg Kroah-Hartman commit f1f52e1094fc4e39bfd3071e33803fbbf0543d49 Author: Xiao Guangrong Date: Fri Apr 16 16:34:42 2010 +0800 KVM: MMU: fix kvm_mmu_zap_page() and its calling path (Cherry-picked from commit 77662e0028c7c63e34257fda03ff9625c59d939d) This patch fix: - calculate zapped page number properly in mmu_zap_unsync_children() - calculate freeed page number properly kvm_mmu_change_mmu_pages() - if zapped children page it shoud restart hlist walking KVM-Stable-Tag. Signed-off-by: Xiao Guangrong Signed-off-by: Marcelo Tosatti Signed-off-by: Greg Kroah-Hartman commit 01b0fb7b85b4b8a3027e5cc7663ae8b2193b1104 Author: Avi Kivity Date: Thu Apr 8 18:19:35 2010 +0300 KVM: VMX: Save/restore rflags.vm correctly in real mode (Cherry-picked from commit 78ac8b47c566dd6177a3b9b291b756ccb70670b7) Currently we set eflags.vm unconditionally when entering real mode emulation through virtual-8086 mode, and clear it unconditionally when we enter protected mode. The means that the following sequence KVM_SET_REGS (rflags.vm=1) KVM_SET_SREGS (cr0.pe=1) Ends up with rflags.vm clear due to KVM_SET_SREGS triggering enter_pmode(). Fix by shadowing rflags.vm (and rflags.iopl) correctly while in real mode: reads and writes to those bits access a shadow register instead of the actual register. Signed-off-by: Avi Kivity Signed-off-by: Marcelo Tosatti Signed-off-by: Greg Kroah-Hartman commit ec861e75183fa0049917cbfa44d8a17e7ece7b4f Author: Andre Przywara Date: Wed Mar 24 17:46:42 2010 +0100 KVM: allow bit 10 to be cleared in MSR_IA32_MC4_CTL (Cherry-picked from commit 114be429c8cd44e57f312af2bbd6734e5a185b0d) There is a quirk for AMD K8 CPUs in many Linux kernels (see arch/x86/kernel/cpu/mcheck/mce.c:__mcheck_cpu_apply_quirks()) that clears bit 10 in that MCE related MSR. KVM can only cope with all zeros or all ones, so it will inject a #GP into the guest, which will let it panic. So lets add a quirk to the quirk and ignore this single cleared bit. This fixes -cpu kvm64 on all machines and -cpu host on K8 machines with some guest Linux kernels. Signed-off-by: Andre Przywara Signed-off-by: Avi Kivity Signed-off-by: Greg Kroah-Hartman commit 34ae17fafc868b82dbc3314a046d654feff43254 Author: Avi Kivity Date: Thu Mar 11 12:20:03 2010 +0200 KVM: Don't spam kernel log when injecting exceptions due to bad cr writes (Cherry-picked from commit d6a23895aa82353788a1cc5a1d9a1c963465463e) These are guest-triggerable. Signed-off-by: Avi Kivity Signed-off-by: Greg Kroah-Hartman commit dee49b4925d922229656f4d3c15da33ae5d036ed Author: Takuya Yoshikawa Date: Tue Mar 9 14:55:19 2010 +0900 KVM: SVM: Fix memory leaks that happen when svm_create_vcpu() fails (Cherry-picked from commit b7af40433870aa0636932ad39b0c48a0cb319057) svm_create_vcpu() does not free the pages allocated during the creation when it fails to complete the allocations. This patch fixes it. Signed-off-by: Takuya Yoshikawa Signed-off-by: Avi Kivity Signed-off-by: Greg Kroah-Hartman commit 68f35500d733ed5cc3153c09f685e0abcfce4956 Author: Jan Kiszka Date: Tue Feb 23 17:47:53 2010 +0100 KVM: VMX: Update instruction length on intercepted BP (Cherry-picked from commit c573cd22939e54fc1b8e672054a505048987a7cb) We intercept #BP while in guest debugging mode. As VM exits due to intercepted exceptions do not necessarily come with valid idt_vectoring, we have to update event_exit_inst_len explicitly in such cases. At least in the absence of migration, this ensures that re-injections of #BP will find and use the correct instruction length. Signed-off-by: Jan Kiszka Signed-off-by: Avi Kivity Signed-off-by: Greg Kroah-Hartman commit e6b2d9c9a2e5689aa03d3d38b6c19dc86738a536 Author: KOSAKI Motohiro Date: Wed Mar 17 09:36:58 2010 +0900 sched: Use proper type in sched_getaffinity() commit 8bc037fb89bb3104b9ae290d18c877624cd7d9cc upstream. Using the proper type fixes the following compiler warning: kernel/sched.c:4850: warning: comparison of distinct pointer types lacks a cast Signed-off-by: KOSAKI Motohiro Cc: torvalds@linux-foundation.org Cc: travis@sgi.com Cc: peterz@infradead.org Cc: drepper@redhat.com Cc: rja@sgi.com Cc: sharyath@in.ibm.com Cc: steiner@sgi.com LKML-Reference: <20100317090046.4C79.A69D9226@jp.fujitsu.com> Signed-off-by: Ingo Molnar Signed-off-by: Greg Kroah-Hartman commit 4c08f09270bdf83ca42a058970613cabe3fc8b41 Author: Eric Sandeen Date: Thu Feb 4 23:58:38 2010 -0500 ext4: fix async i/o writes beyond 4GB to a sparse file commit a1de02dccf906faba2ee2d99cac56799bda3b96a upstream. The "offset" member in ext4_io_end holds bytes, not blocks, so ext4_lblk_t is wrong - and too small (u32). This caused the async i/o writes to sparse files beyond 4GB to fail when they wrapped around to 0. Also fix up the type of arguments to ext4_convert_unwritten_extents(), it gets ssize_t from ext4_end_aio_dio_nolock() and ext4_ext_direct_IO(). Reported-by: Giel de Nijs Signed-off-by: Eric Sandeen Cc: maximilian attems Signed-off-by: Greg Kroah-Hartman commit c081243f7a9278f093bbc87bc5c56f1f2d203904 Author: Adam Lackorzynski Date: Sat Feb 27 07:07:59 2010 +0000 powerpc: Fix SMP build with disabled CPU hotplugging. commit 5b72d74ce2fccca2a301de60f31b16ddf5c93984 upstream. Compiling 2.6.33 with SMP enabled and HOTPLUG_CPU disabled gives me the following link errors: LD init/built-in.o LD .tmp_vmlinux1 arch/powerpc/platforms/built-in.o: In function `.smp_xics_setup_cpu': smp.c:(.devinit.text+0x88): undefined reference to `.set_cpu_current_state' smp.c:(.devinit.text+0x94): undefined reference to `.set_default_offline_state' arch/powerpc/platforms/built-in.o: In function `.smp_pSeries_kick_cpu': smp.c:(.devinit.text+0x13c): undefined reference to `.set_preferred_offline_state' smp.c:(.devinit.text+0x148): undefined reference to `.get_cpu_current_state' smp.c:(.devinit.text+0x1a8): undefined reference to `.get_cpu_current_state' make: *** [.tmp_vmlinux1] Error 1 The following change fixes that for me and seems to work as expected. Signed-off-by: Adam Lackorzynski Signed-off-by: Benjamin Herrenschmidt Signed-off-by: Greg Kroah-Hartman commit 11d0dfa8ce268e40b625e26537f21cf5b74007af Author: NeilBrown Date: Wed Mar 31 12:07:16 2010 +1100 md: deal with merge_bvec_fn in component devices better. commit 627a2d3c29427637f4c5d31ccc7fcbd8d312cd71 upstream. If a component device has a merge_bvec_fn then as we never call it we must ensure we never need to. Currently this is done by setting max_sector to 1 PAGE, however this does not stop a bio being created with several sub-page iovecs that would violate the merge_bvec_fn. So instead set max_phys_segments to 1 and set the segment boundary to the same as a page boundary to ensure there is only ever one single-page segment of IO requested at a time. This can particularly be an issue when 'xen' is used as it is known to submit multiple small buffers in a single bio. Signed-off-by: NeilBrown Signed-off-by: Greg Kroah-Hartman commit e6813c83b2ef1fe0abb88fca3c4dfc4c5a01f473 Author: Mathieu Desnoyers Date: Tue Apr 20 10:38:10 2010 -0400 module: fix __module_ref_addr() The __module_ref_addr() problem disappears in 2.6.34-rc kernels because these percpu accesses were re-factored. __module_ref_addr() should use per_cpu_ptr() to obfuscate the pointer (RELOC_HIDE is needed for per cpu pointers). This non-standard per-cpu pointer use has been introduced by commit 720eba31f47aeade8ec130ca7f4353223c49170f It causes a NULL pointer exception on some configurations when CONFIG_TRACING is enabled on 2.6.33. This patch fixes the problem (acknowledged by Randy who reported the bug). It did not appear to hurt previously because most of the accesses were done through local_inc, which probably obfuscated the access enough that no compiler optimizations were done. But with local_read() done when CONFIG_TRACING is active, this becomes a problem. Non-CONFIG_TRACING is probably affected as well (module.c contains local_set and local_read that use __module_ref_addr()), but I guess nobody noticed because we've been lucky enough that the compiler did not generate the inappropriate optimization pattern there. This patch should be queued for the 2.6.29.x through 2.6.33.x stable branches. (tested on 2.6.33.1 x86_64) Signed-off-by: Mathieu Desnoyers Tested-by: Randy Dunlap CC: Eric Dumazet CC: Rusty Russell CC: Peter Zijlstra CC: Tejun Heo CC: Ingo Molnar CC: Andrew Morton CC: Linus Torvalds CC: Greg Kroah-Hartman CC: Steven Rostedt Signed-off-by: Greg Kroah-Hartman commit eabe8c241a9ecbc15a9d51e0bfc3dde1c27d8a65 Author: Mathieu Desnoyers Date: Tue Apr 20 10:33:50 2010 -0400 lockdep: fix incorrect percpu usage The mainline kernel as of 2.6.34-rc5 is not affected by this problem because commit 10fad5e46f6c7bdfb01b1a012380a38e3c6ab346 fixed it by refactoring. lockdep fix incorrect percpu usage Should use per_cpu_ptr() to obfuscate the per cpu pointers (RELOC_HIDE is needed for per cpu pointers). git blame points to commit: lockdep.c: commit 8e18257d29238311e82085152741f0c3aa18b74d But it's really just moving the code around. But it's enough to say that the problems appeared before Jul 19 01:48:54 2007, which brings us back to 2.6.23. It should be applied to stable 2.6.23.x to 2.6.33.x (or whichever of these stable branches are still maintained). (tested on 2.6.33.1 x86_64) Signed-off-by: Mathieu Desnoyers CC: Randy Dunlap CC: Eric Dumazet CC: Rusty Russell CC: Peter Zijlstra CC: Tejun Heo CC: Ingo Molnar CC: Andrew Morton CC: Linus Torvalds CC: Greg Kroah-Hartman CC: Steven Rostedt Signed-off-by: Greg Kroah-Hartman commit 0fa07b3f945860507361d53be4f9f948b06b401f Author: Mathieu Desnoyers Date: Tue Apr 20 10:34:57 2010 -0400 modules: fix incorrect percpu usage Mainline does not need this fix, as commit 259354deaaf03d49a02dbb9975d6ec2a54675672 fixed the problem by refactoring. Should use per_cpu_ptr() to obfuscate the per cpu pointers (RELOC_HIDE is needed for per cpu pointers). Introduced by commit: module.c: commit 6b588c18f8dacfa6d7957c33c5ff832096e752d3 This patch should be queued for the stable branch, for kernels 2.6.29.x to 2.6.33.x. (tested on 2.6.33.1 x86_64) Signed-off-by: Mathieu Desnoyers CC: Randy Dunlap CC: Eric Dumazet CC: Rusty Russell CC: Peter Zijlstra CC: Tejun Heo CC: Ingo Molnar CC: Andrew Morton CC: Linus Torvalds CC: Greg Kroah-Hartman CC: Steven Rostedt Signed-off-by: Greg Kroah-Hartman commit f7c3b8d3f3bce2c0972165fc65721b735e60de6d Author: Alexey Starikovskiy Date: Fri Apr 16 15:36:40 2010 -0400 ACPI: EC: Limit burst to 64 bits commit 2060c44576c79086ff24718878d7edaa7384a985 upstream. access_bit_width field is u8 in ACPICA, thus 256 value written to it becomes 0, causing divide by zero later. Proper fix would be to remove access_bit_width at all, just because we already have access_byte_width, which is access_bit_width / 8. Limit access width to 64 bit for now. https://bugzilla.kernel.org/show_bug.cgi?id=15749 fixes regression caused by the fix for: https://bugzilla.kernel.org/show_bug.cgi?id=14667 Signed-off-by: Alexey Starikovskiy Signed-off-by: Len Brown Signed-off-by: Greg Kroah-Hartman commit 3064d4245eecba89cc2eb2ce3cf89fd5ffe060de Author: Alexey Starikovskiy Date: Sat Apr 10 02:18:35 2010 +0100 ACPI: EC: Allow multibyte access to EC commit dadf28a10c3eb29421837a2e413ab869ebd upstream http://bugzilla.kernel.org/show_bug.cgi?id=14667 [bwh: Backport to 2.6.32; same applies to 2.6.33] Signed-off-by: Alexey Starikovskiy Signed-off-by: Len Brown Cc: Ben Hutchings Signed-off-by: Greg Kroah-Hartman commit d4187adfe63696f0abc60d32320271f1ec7e8110 Author: Dave Chinner Date: Thu Mar 4 01:46:23 2010 +0000 xfs: check for more work before sleeping in xfssyncd commit 20f6b2c785cf187445f126321638ab8ba7aa7494 upstream. xfssyncd processes a queue of work by detaching the queue and then iterating over all the work items. It then sleeps for a time period or until new work comes in. If new work is queued while xfssyncd is actively processing the detached work queue, it will not process that new work until after a sleep timeout or the next work event queued wakes it. Fix this by checking the work queue again before going to sleep. Signed-off-by: Dave Chinner Signed-off-by: Christoph Hellwig Signed-off-by: Alex Elder Signed-off-by: Greg Kroah-Hartman commit 87bcb4b15d9443cf9a12943fb9162e53ac045b55 Author: Christoph Hellwig Date: Mon Mar 1 11:30:31 2010 +0000 xfs: fix locking for inode cache radix tree tag updates commit f1f724e4b523d444c5a598d74505aefa3d6844d2 upstream. The radix-tree code requires it's users to serialize tag updates against other updates to the tree. While XFS protects tag updates against each other it does not serialize them against updates of the tree contents, which can lead to tag corruption. Fix the inode cache to always take pag_ici_lock in exclusive mode when updating radix tree tags. Signed-off-by: Christoph Hellwig Reported-by: Patrick Schreurs Tested-by: Patrick Schreurs Signed-off-by: Alex Elder Cc: Dave Chinner Signed-off-by: Greg Kroah-Hartman commit 30cd163f7c089175033d643bcd475c552926fbbf Author: Dave Chinner Date: Wed Feb 17 05:36:29 2010 +0000 xfs: Non-blocking inode locking in IO completion commit 77d7a0c2eeb285c9069e15396703d0cb9690ac50 upstream. The introduction of barriers to loop devices has created a new IO order completion dependency that XFS does not handle. The loop device implements barriers using fsync and so turns a log IO in the XFS filesystem on the loop device into a data IO in the backing filesystem. That is, the completion of log IOs in the loop filesystem are now dependent on completion of data IO in the backing filesystem. This can cause deadlocks when a flush daemon issues a log force with an inode locked because the IO completion of IO on the inode is blocked by the inode lock. This in turn prevents further data IO completion from occuring on all XFS filesystems on that CPU (due to the shared nature of the completion queues). This then prevents the log IO from completing because the log is waiting for data IO completion as well. The fix for this new completion order dependency issue is to make the IO completion inode locking non-blocking. If the inode lock can't be grabbed, simply requeue the IO completion back to the work queue so that it can be processed later. This prevents the completion queue from being blocked and allows data IO completion on other inodes to proceed, hence avoiding completion order dependent deadlocks. Signed-off-by: Dave Chinner Reviewed-by: Christoph Hellwig Signed-off-by: Alex Elder Signed-off-by: Greg Kroah-Hartman commit c4b78d3de51f5acdcf328719c79259e465d16e61 Author: Peter Zijlstra Date: Fri Apr 16 05:14:41 2010 -0400 perf_events, x86: Implement Intel Westmere/Nehalem-EX support original patch commit ids: 452a339a976e7f782c786eb3f73080401e2fa3a6 and 134fbadf028a5977a1b06b0253d3ee33e6f0c642 perf_events, x86: Implement Intel Westmere support The new Intel documentation includes Westmere arch specific event maps that are significantly different from the Nehalem ones. Add support for this generation. Found the CPUID model numbers on wikipedia. Also ammend some Nehalem constraints, spotted those when looking for the differences between Nehalem and Westmere. Signed-off-by: Peter Zijlstra Cc: Arjan van de Ven Cc: "H. Peter Anvin" Cc: Stephane Eranian LKML-Reference: <20100127221122.151865645@chello.nl> Signed-off-by: Ingo Molnar perf, x86: Enable Nehalem-EX support According to Intel Software Devel Manual Volume 3B, the Nehalem-EX PMU is just like regular Nehalem (except for the uncore support, which is completely different). Signed-off-by: Vince Weaver Cc: Peter Zijlstra Cc: Paul Mackerras Cc: Arnaldo Carvalho de Melo Cc: "H. Peter Anvin" Cc: Arjan van de Ven Cc: Lin Ming LKML-Reference: Signed-off-by: Ingo Molnar Cc: Youquan Song commit d69ac822016964c25bfbdcad165668f22d058390 Author: Terry Loftin Date: Fri Apr 9 10:29:49 2010 +0000 e1000e: stop cleaning when we reach tx_ring->next_to_use commit dac876193cd79ced36d0462749ea47c05844fb49 upstream. Tx ring buffers after tx_ring->next_to_use are volatile and could change, possibly causing a crash. Stop cleaning when we hit tx_ring->next_to_use. Signed-off-by: Terry Loftin Acked-by: Bruce Allan Signed-off-by: Jeff Kirsher Signed-off-by: David S. Miller Cc: Matthew Burgess Signed-off-by: Greg Kroah-Hartman commit 6722260b066a1de80228d71da99ab71ebdcc7ae8 Author: Reinette Chatre Date: Tue Feb 2 10:57:12 2010 -0800 iwlwifi: fix scan race commit bbcbb9ef9735c67da303d30bd6beb9e699f0f508 upstream. There is a problem if an "internal short scan" is in progress when a mac80211 requested scan arrives. If this new scan request arrives within the "next_scan_jiffies" period then driver will immediately return success and complete the scan. The problem here is that the scan has not been fully initialized at this time (is_internal_short_scan is still set to true because of the currently running scan), which results in the scan completion never to be sent to mac80211. At this time also, evan though the internal short scan is still running the state (is_internal_short_scan) will be set to false, so when the internal scan does complete then mac80211 will receive a scan completion. Fix this by checking right away if a scan is in progress when a scan request arrives from mac80211. Signed-off-by: Reinette Chatre Cc: maximilian attems Signed-off-by: Greg Kroah-Hartman commit 5393cd90a45d38d8457855ccff2240666554c815 Author: Wey-Yi Guy Date: Tue Feb 2 16:58:34 2010 -0800 iwlwifi: clear all tx queues when firmware ready commit dff010ac8e57e43669518a14c0e945dfeb80c2a7 upstream. Reset and clear all the tx queues when finished downloading runtime uCode and ready to go into operation mode. Signed-off-by: Wey-Yi Guy Signed-off-by: Reinette Chatre Cc: maximilian attems Signed-off-by: Greg Kroah-Hartman commit 8391cca35dbeb0543ab48c06cf580ecf68ffa60d Author: Oliver Neukum Date: Wed Mar 3 00:37:56 2010 +0100 USB: cdc-acm: Fix stupid NULL pointer in resume() commit f0730924e9e32bb8935c60040a26d94179355088 upstream. Stupid logic bug passing a just nulled pointer Signed-off-by: Oliver Neukum Signed-off-by: Greg Kroah-Hartman Signed-off-by: Greg Kroah-Hartman commit ae78cf088478592bde4e7711535968283b4c3b59 Author: Oliver Neukum Date: Wed Dec 16 17:05:57 2009 +0100 USB: cdc-acm: Update to new autopm API commit 97d35f95552c9a0ee4777a7f04431a9fd1260478 upstream. Update cdc-acm to the async methods eliminating the workqueue [This fixes a reported lockup for the cdc-acm driver - gregkh] Signed-off-by: Oliver Neukum Signed-off-by: Greg Kroah-Hartman commit ffa1b5d9e6bf7d944f3bfa119a66af639fca98c4 Author: Christian Pulvermacher Date: Tue Mar 23 11:51:38 2010 -0500 ecryptfs: fix error code for missing xattrs in lower fs commit cfce08c6bdfb20ade979284e55001ca1f100ed51 upstream. If the lower file system driver has extended attributes disabled, ecryptfs' own access functions return -ENOSYS instead of -EOPNOTSUPP. This breaks execution of programs in the ecryptfs mount, since the kernel expects the latter error when checking for security capabilities in xattrs. Signed-off-by: Christian Pulvermacher Signed-off-by: Tyler Hicks Signed-off-by: Greg Kroah-Hartman commit 8371038fa54c8051c6624560f3777e629b9eef68 Author: Tyler Hicks Date: Mon Mar 22 00:41:35 2010 -0500 eCryptfs: Decrypt symlink target for stat size commit 3a60a1686f0d51c99bd0df8ac93050fb6dfce647 upstream. Create a getattr handler for eCryptfs symlinks that is capable of reading the lower target and decrypting its path. Prior to this patch, a stat's st_size field would represent the strlen of the encrypted path, while readlink() would return the strlen of the decrypted path. This could lead to confusion in some userspace applications, since the two values should be equal. https://bugs.launchpad.net/bugs/524919 Reported-by: Loïc Minier Signed-off-by: Tyler Hicks Signed-off-by: Greg Kroah-Hartman commit 0766ff5226c060424f7d5d6f9e5904b22879b389 Author: Jeff Mahoney Date: Fri Mar 19 15:35:46 2010 -0400 ecryptfs: fix use with tmpfs by removing d_drop from ecryptfs_destroy_inode commit 133b8f9d632cc23715c6d72d1c5ac449e054a12a upstream. Since tmpfs has no persistent storage, it pins all its dentries in memory so they have d_count=1 when other file systems would have d_count=0. ->lookup is only used to create new dentries. If the caller doesn't instantiate it, it's freed immediately at dput(). ->readdir reads directly from the dcache and depends on the dentries being hashed. When an ecryptfs mount is mounted, it associates the lower file and dentry with the ecryptfs files as they're accessed. When it's umounted and destroys all the in-memory ecryptfs inodes, it fput's the lower_files and d_drop's the lower_dentries. Commit 4981e081 added this and a d_delete in 2008 and several months later commit caeeeecf removed the d_delete. I believe the d_drop() needs to be removed as well. The d_drop effectively hides any file that has been accessed via ecryptfs from the underlying tmpfs since it depends on it being hashed for it to be accessible. I've removed the d_drop on my development node and see no ill effects with basic testing on both tmpfs and persistent storage. As a side effect, after ecryptfs d_drops the dentries on tmpfs, tmpfs BUGs on umount. This is due to the dentries being unhashed. tmpfs->kill_sb is kill_litter_super which calls d_genocide to drop the reference pinning the dentry. It skips unhashed and negative dentries, but shrink_dcache_for_umount_subtree doesn't. Since those dentries still have an elevated d_count, we get a BUG(). This patch removes the d_drop call and fixes both issues. This issue was reported at: https://bugzilla.novell.com/show_bug.cgi?id=567887 Reported-by: Árpád Bíró Signed-off-by: Jeff Mahoney Cc: Dustin Kirkland Signed-off-by: Tyler Hicks Signed-off-by: Greg Kroah-Hartman commit 21ce895980226f5ec1f0caba10db88e758fedc18 Author: Takashi Iwai Date: Thu Apr 15 09:02:41 2010 +0200 ALSA: hda - Add position_fix quirk for Biostar mobo commit 8815cd030fdd73932a791d1f06194c8db807cde7 upstream. The Biostar mobo seems to give a wrong DMA position, resulting in stuttering or skipping sounds on 2.6.34. Since the commit 7b3a177b0d4f92b3431b8dca777313a07533a710, "ALSA: pcm_lib: fix "something must be really wrong" condition", makes the position check more strictly, the DMA position problem is revealed more clearly now. The fix is to use only LPIB for obtaining the position, i.e. passing position_fix=1. This patch adds a static quirk to achieve it as default. Reported-by: Frank Griffin Cc: Eric Piel Signed-off-by: Takashi Iwai Cc: maximilian attems Signed-off-by: Greg Kroah-Hartman commit 9a4caec9cf9c1d95e4a59974de6d9c2797bb117f Author: Linus Torvalds Date: Fri Feb 26 10:34:27 2010 -0800 b43: fall back gracefully to PIO mode after fatal DMA errors commit 9e3bd9190800e8209b4a3e1d724c35f0738dcad2 upstream. This makes the b43 driver just automatically fall back to PIO mode when DMA doesn't work. The driver already told the user to do it, so rather than have the user reload the module with a new flag, just make the driver do it automatically. We keep the message as an indication that something is wrong, but now just automatically fall back to the hopefully working PIO case. (Some post-2.6.33 merge fixups by Larry Finger and yours truly... -- JWL) Signed-off-by: Linus Torvalds Signed-off-by: John W. Linville Cc: maximilian attems Signed-off-by: Greg Kroah-Hartman commit ca18b87fd44231563f72c598c169c147b9a899c3 Author: Larry Finger Date: Thu Dec 10 17:35:01 2009 -0600 b43: Allow PIO mode to be selected at module load commit b02914af4d7020828ce921a572589dd793517c09 upstream. If userencounter the "Fatal DMA Problem" with a BCM43XX device, and still wish to use b43 as the driver, their only option is to rebuild the kernel with CONFIG_B43_FORCE_PIO. This patch removes this option and allows PIO mode to be selected with a load-time parameter for the module. Note that the configuration variable CONFIG_B43_PIO is also removed. Once the DMA problem with the BCM4312 devices is solved, this patch will likely be reverted. Signed-off-by: Larry Finger Tested-by: John Daiker Cc: maximilian attems Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit faab88ee678576f5280517c54a5ecbd67a64fadc Author: Seth Heasley Date: Tue Mar 2 12:23:39 2010 +0100 i2c-i801: Add Intel Cougar Point device IDs commit 393764340beb595c1ad7dd2d2243c2b6551aaa71 upstream. Add the Intel Cougar Point (PCH) SMBus controller device IDs. Signed-off-by: Seth Heasley Signed-off-by: Jean Delvare Cc: maximilian attems Signed-off-by: Greg Kroah-Hartman commit 84f04e46ed7f6e824365598c961d20d0dd249b44 Author: Seth Heasley Date: Tue Jan 12 17:00:18 2010 -0800 ahci: AHCI and RAID mode SATA patch for Intel Cougar Point DeviceIDs commit 5623cab83ea61e0420f2064216d83eab067a24c6 upstream. Signed-off-by: Seth Heasley Signed-off-by: Jeff Garzik Cc: maximilian attems Signed-off-by: Greg Kroah-Hartman commit 4cbfe0a7ce911922bb67e8596515a13236cca451 Author: Seth Heasley Date: Tue Jan 12 17:01:28 2010 -0800 ata_piix: IDE Mode SATA patch for Intel Cougar Point DeviceIDs commit 88e8201e67aace3d86de9e75122ea525f0e7248e upstream. Signed-off-by: Seth Heasley Signed-off-by: Jeff Garzik Cc: maximilian attems Signed-off-by: Greg Kroah-Hartman commit 8feb91430b3b5c0e6921f2768b705460b479d3ac Author: Seth Heasley Date: Mon Feb 22 17:31:09 2010 -0800 ALSA: hda - enable snoop for Intel Cougar Point commit 32679f95cac3b1bdf27dce8b5273e06af186fd91 upstream. This patch enables snoop, eliminating static during playback. This patch supersedes the previous Cougar Point audio patch. Signed-off-by: Seth Heasley Signed-off-by: Takashi Iwai Cc: maximilian attems Signed-off-by: Greg Kroah-Hartman commit e394b8d741c2879fcfc89a2f0cacaca19bb62383 Author: Seth Heasley Date: Tue Jan 12 17:03:35 2010 -0800 ALSA: hda_intel: ALSA HD Audio patch for Intel Cougar Point DeviceIDs commit d2f2fcd2541bae004db7f4798ffd9d2cb75ae817 upstream. This patch adds the Intel Cougar Point (PCH) HD Audio Controller DeviceIDs. Signed-off-by: Seth Heasley Signed-off-by: Takashi Iwai Cc: maximilian attems Signed-off-by: Greg Kroah-Hartman commit 8767aba388feb33c80e0052d7a45791294d374fa Author: Seth Heasley Date: Tue Jan 12 16:56:37 2010 -0800 x86/PCI: irq and pci_ids patch for Intel Cougar Point DeviceIDs commit 93da6202264ce1256b04db8008a43882ae62d060 upstream. This patch adds the Intel Cougar Point (PCH) LPC and SMBus Controller DeviceIDs. Signed-off-by: Seth Heasley Signed-off-by: Jesse Barnes Cc: maximilian attems Signed-off-by: Greg Kroah-Hartman commit 3d5692adad451b650f09ff41aba6d2787b6ded8b Author: Eli Cohen Date: Wed Mar 3 12:27:52 2010 +0000 IPoIB: Fix TX queue lockup with mixed UD/CM traffic commit f0dc117abdfa9a0e96c3d013d836460ef3cd08c7 upstream. The IPoIB UD QP reports send completions to priv->send_cq, which is usually left unarmed; it only gets armed when the number of outstanding send requests reaches the size of the TX queue. This arming is done only in the send path for the UD QP. However, when sending CM packets, the net queue may be stopped for the same reasons but no measures are taken to recover the UD path from a lockup. Consider this scenario: a host sends high rate of both CM and UD packets, with a TX queue length of N. If at some time the number of outstanding UD packets is more than N/2 and the overall outstanding packets is N-1, and CM sends a packet (making the number of outstanding sends equal N), the TX queue will be stopped. When all the CM packets complete, the number of outstanding packets will still be higher than N/2 so the TX queue will not be restarted. Fix this by calling ib_req_notify_cq() when the queue is stopped in the CM path. Signed-off-by: Eli Cohen Signed-off-by: Roland Dreier Cc: maximilian attems Signed-off-by: Greg Kroah-Hartman commit e85038358dd8b63c3407d5897b352f1e591ecf58 Author: Paul Mundt Date: Thu Mar 11 14:08:33 2010 -0800 PCI: kill off pci_register_set_vga_state() symbol export. commit ded1d8f29b4d315a2093cafc3ee17ac870a87972 upstream. When pci_register_set_vga_state() was made __init, the EXPORT_SYMBOL() was retained, which now leaves us with a section mismatch. Signed-off-by: Paul Mundt Cc: Mike Travis Signed-off-by: Andrew Morton Signed-off-by: Jesse Barnes Cc: maximilian attems Signed-off-by: Greg Kroah-Hartman commit 2f27df301575640e60cdcdb1352ca0ec1fda2b94 Author: Mike Travis Date: Tue Feb 2 14:38:13 2010 -0800 pci: Update pci_set_vga_state() to call arch functions commit 95a8b6efc5d07103583f706c8a5889437d537939 upstream. Update pci_set_vga_state to call arch dependent functions to enable Legacy VGA I/O transactions to be redirected to correct target. [akpm@linux-foundation.org: make pci_register_set_vga_state() __init] Signed-off-by: Mike Travis LKML-Reference: <201002022238.o12McE1J018723@imap1.linux-foundation.org> Cc: Thomas Gleixner Cc: Robin Holt Cc: Jack Steiner Cc: Ingo Molnar Cc: Jesse Barnes Cc: David Airlie Signed-off-by: Andrew Morton Signed-off-by: H. Peter Anvin Cc: maximilian attems Signed-off-by: Greg Kroah-Hartman commit b5cc76ffd6a95b4281580c7bc0dbfca70c23369e Author: Sachin Prabhu Date: Sat Mar 13 09:03:55 2010 -0600 9p: Skip check for mandatory locks when unlocking commit f78233dd44a110c574fe760ad6f9c1e8741a0d00 upstream. While investigating a bug, I came across a possible bug in v9fs. The problem is similar to the one reported for NFS by ASANO Masahiro in http://lkml.org/lkml/2005/12/21/334. v9fs_file_lock() will skip locks on file which has mode set to 02666. This is a problem in cases where the mode of the file is changed after a process has obtained a lock on the file. Such a lock will be skipped during unlock and the machine will end up with a BUG in locks_remove_flock(). v9fs_file_lock() should skip the check for mandatory locks when unlocking a file. Signed-off-by: Sachin Prabhu Signed-off-by: Eric Van Hensbergen Cc: maximilian attems Signed-off-by: Greg Kroah-Hartman commit 53d737879cbbe3886e26f155007dbc148aec1cb6 Author: Tao Ma Date: Wed Mar 3 11:26:27 2010 +0800 ocfs2: Change bg_chain check for ocfs2_validate_gd_parent. commit 78c37eb0d5e6a9727b12ea0f1821795ffaa66cfe upstream. In ocfs2_validate_gd_parent, we check bg_chain against the cl_next_free_rec of the dinode. Actually in resize, we have the chance of bg_chain == cl_next_free_rec. So add some additional condition check for it. I also rename paramter "clean_error" to "resize", since the old one is not clearly enough to indicate that we should only meet with this case in resize. btw, the correpsonding bug is http://oss.oracle.com/bugzilla/show_bug.cgi?id=1230. Signed-off-by: Tao Ma Signed-off-by: Joel Becker Cc: maximilian attems Signed-off-by: Greg Kroah-Hartman commit 4cf04e523cb863e6d8cc59a25ff7836917f39c45 Author: Mark Fasheh Date: Mon Mar 15 15:39:00 2010 -0700 ocfs2: set i_mode on disk during acl operations commit fcefd25ac89239cb57fa198f125a79ff85468c75 upstream. ocfs2_set_acl() and ocfs2_init_acl() were setting i_mode on the in-memory inode, but never setting it on the disk copy. Thus, acls were some times not getting propagated between nodes. This patch fixes the issue by adding a helper function ocfs2_acl_set_mode() which does this the right way. ocfs2_set_acl() and ocfs2_init_acl() are then updated to call ocfs2_acl_set_mode(). Signed-off-by: Mark Fasheh Signed-off-by: Joel Becker Cc: maximilian attems Signed-off-by: Greg Kroah-Hartman commit 527230ce812fb139ec4047c06acd4db63a15ff3e Author: Andrew Perepechko Date: Mon Apr 12 22:16:50 2010 +0400 quota: Fix possible dq_flags corruption commit 08261673cb6dc638c39f44d69b76fffb57b92a8b upstream. dq_flags are modified non-atomically in do_set_dqblk via __set_bit calls and atomically for example in mark_dquot_dirty or clear_dquot_dirty. Hence a change done by an atomic operation can be overwritten by a change done by a non-atomic one. Fix the problem by using atomic bitops even in do_set_dqblk. Signed-off-by: Andrew Perepechko Signed-off-by: Jan Kara Signed-off-by: Greg Kroah-Hartman commit 5e462ec4eb77a087383a384d2067d04e0b6d0621 Author: Al Viro Date: Sat Jan 30 16:11:21 2010 -0500 fix NFS4 handling of mountpoint stat commit 462d60577a997aa87c935ae4521bd303733a9f2b upstream. RFC says we need to follow the chain of mounts if there's more than one stacked on that point. Signed-off-by: Al Viro Signed-off-by: Greg Kroah-Hartman commit fab9024d006d3768b9ea46861ea5302ce1fe6268 Author: Avi Kivity Date: Sat Feb 13 10:33:12 2010 +0200 x86-64, rwsem: Avoid store forwarding hazard in __downgrade_write commit 0d1622d7f526311d87d7da2ee7dd14b73e45d3fc upstream. The Intel Architecture Optimization Reference Manual states that a short load that follows a long store to the same object will suffer a store forwading penalty, particularly if the two accesses use different addresses. Trivially, a long load that follows a short store will also suffer a penalty. __downgrade_write() in rwsem incurs both penalties: the increment operation will not be able to reuse a recently-loaded rwsem value, and its result will not be reused by any recently-following rwsem operation. A comment in the code states that this is because 64-bit immediates are special and expensive; but while they are slightly special (only a single instruction allows them), they aren't expensive: a test shows that two loops, one loading a 32-bit immediate and one loading a 64-bit immediate, both take 1.5 cycles per iteration. Fix this by changing __downgrade_write to use the same add instruction on i386 and on x86_64, so that it uses the same operand size as all the other rwsem functions. Signed-off-by: Avi Kivity LKML-Reference: <1266049992-17419-1-git-send-email-avi@redhat.com> Signed-off-by: H. Peter Anvin Signed-off-by: Greg Kroah-Hartman commit d7a0f8f96011e65bbdd7544653897442507776de Author: Linus Torvalds Date: Sun Jan 17 10:24:07 2010 -0800 x86: Fix breakage of UML from the changes in the rwsem system commit 4126faf0ab7417fbc6eb99fb0fd407e01e9e9dfe upstream. The patches 5d0b7235d83eefdafda300656e97d368afcafc9a and bafaecd11df15ad5b1e598adc7736afcd38ee13d broke the UML build: On Sun, 17 Jan 2010, Ingo Molnar wrote: > > FYI, -tip testing found that these changes break the UML build: > > kernel/built-in.o: In function `__up_read': > /home/mingo/tip/arch/x86/include/asm/rwsem.h:192: undefined reference to `call_rwsem_wake' > kernel/built-in.o: In function `__up_write': > /home/mingo/tip/arch/x86/include/asm/rwsem.h:210: undefined reference to `call_rwsem_wake' > kernel/built-in.o: In function `__downgrade_write': > /home/mingo/tip/arch/x86/include/asm/rwsem.h:228: undefined reference to `call_rwsem_downgrade_wake' > kernel/built-in.o: In function `__down_read': > /home/mingo/tip/arch/x86/include/asm/rwsem.h:112: undefined reference to `call_rwsem_down_read_failed' > kernel/built-in.o: In function `__down_write_nested': > /home/mingo/tip/arch/x86/include/asm/rwsem.h:154: undefined reference to `call_rwsem_down_write_failed' > collect2: ld returned 1 exit status Add lib/rwsem_64.o to the UML subarch objects to fix. LKML-Reference: Signed-off-by: H. Peter Anvin Signed-off-by: Greg Kroah-Hartman commit a1f4212b5add68a969c0bb5ed08bc3f0bb9d6540 Author: Linus Torvalds Date: Tue Jan 12 18:16:42 2010 -0800 x86-64: support native xadd rwsem implementation commit bafaecd11df15ad5b1e598adc7736afcd38ee13d upstream. This one is much faster than the spinlock based fallback rwsem code, with certain artifical benchmarks having shown 300%+ improvement on threaded page faults etc. Again, note the 32767-thread limit here. So this really does need that whole "make rwsem_count_t be 64-bit and fix the BIAS values to match" extension on top of it, but that is conceptually a totally independent issue. NOT TESTED! The original patch that this all was based on were tested by KAMEZAWA Hiroyuki, but maybe I screwed up something when I created the cleaned-up series, so caveat emptor.. Also note that it _may_ be a good idea to mark some more registers clobbered on x86-64 in the inline asms instead of saving/restoring them. They are inline functions, but they are only used in places where there are not a lot of live registers _anyway_, so doing for example the clobbers of %r8-%r11 in the asm wouldn't make the fast-path code any worse, and would make the slow-path code smaller. (Not that the slow-path really matters to that degree. Saving a few unnecessary registers is the _least_ of our problems when we hit the slow path. The instruction/cycle counting really only matters in the fast path). Signed-off-by: Linus Torvalds LKML-Reference: Signed-off-by: H. Peter Anvin Signed-off-by: Greg Kroah-Hartman commit 6c7ba7a3df486d5e2940881c0983e063857dee72 Author: H. Peter Anvin Date: Mon Jan 18 14:00:34 2010 -0800 x86-64, rwsem: 64-bit xadd rwsem implementation commit 1838ef1d782f7527e6defe87e180598622d2d071 upstream. For x86-64, 32767 threads really is not enough. Change rwsem_count_t to a signed long, so that it is 64 bits on x86-64. This required the following changes to the assembly code: a) %z0 doesn't work on all versions of gcc! At least gcc 4.4.2 as shipped with Fedora 12 emits "ll" not "q" for 64 bits, even for integer operands. Newer gccs apparently do this correctly, but avoid this problem by using the _ASM_ macros instead of %z. b) 64 bits immediates are only allowed in "movq $imm,%reg" constructs... no others. Change some of the constraints to "e", and fix the one case where we would have had to use an invalid immediate -- in that case, we only care about the upper half anyway, so just access the upper half. Signed-off-by: H. Peter Anvin Cc: Linus Torvalds LKML-Reference: Signed-off-by: Greg Kroah-Hartman commit e7ca1656d8124ec81c9b86944010040f1dfd8191 Author: Linus Torvalds Date: Tue Jan 12 17:57:35 2010 -0800 x86: clean up rwsem type system commit 5d0b7235d83eefdafda300656e97d368afcafc9a upstream. The fast version of the rwsems (the code that uses xadd) has traditionally only worked on x86-32, and as a result it mixes different kinds of types wildly - they just all happen to be 32-bit. We have "long", we have "__s32", and we have "int". To make it work on x86-64, the types suddenly matter a lot more. It can be either a 32-bit or 64-bit signed type, and both work (with the caveat that a 32-bit counter will only have 15 bits of effective write counters, so it's limited to 32767 users). But whatever type you choose, it needs to be used consistently. This makes a new 'rwsem_counter_t', that is a 32-bit signed type. For a 64-bit type, you'd need to also update the BIAS values. Signed-off-by: Linus Torvalds LKML-Reference: Signed-off-by: H. Peter Anvin Signed-off-by: Greg Kroah-Hartman commit f64d00b4b1486643545e9854db3a1c5d361c5d04 Author: Linus Torvalds Date: Tue Jan 12 16:21:09 2010 -0800 x86-32: clean up rwsem inline asm statements commit 59c33fa7791e9948ba467c2b83e307a0d087ab49 upstream. This makes gcc use the right register names and instruction operand sizes automatically for the rwsem inline asm statements. So instead of using "(%%eax)" to specify the memory address that is the semaphore, we use "(%1)" or similar. And instead of forcing the operation to always be 32-bit, we use "%z0", taking the size from the actual semaphore data structure itself. This doesn't actually matter on x86-32, but if we want to use the same inline asm for x86-64, we'll need to have the compiler generate the proper 64-bit names for the registers (%rax instead of %eax), and if we want to use a 64-bit counter too (in order to avoid the 15-bit limit on the write counter that limits concurrent users to 32767 threads), we'll need to be able to generate instructions with "q" accesses rather than "l". Since this header currently isn't enabled on x86-64, none of that matters, but we do want to use the xadd version of the semaphores rather than have to take spinlocks to do a rwsem. The mm->mmap_sem can be heavily contended when you have lots of threads all taking page faults, and the fallback rwsem code that uses a spinlock performs abysmally badly in that case. [ hpa: modified the patch to skip size suffixes entirely when they are redundant due to register operands. ] Signed-off-by: Linus Torvalds LKML-Reference: Signed-off-by: H. Peter Anvin Signed-off-by: Greg Kroah-Hartman commit 76eeb36bb43163c0aa49be6c952e2f4246e7f582 Author: Peter Rajnoha Date: Sat Mar 6 02:32:31 2010 +0000 dm ioctl: introduce flag indicating uevent was generated commit 3abf85b5b5851b5f28d3d8a920ebb844edd08352 upstream. Set a new DM_UEVENT_GENERATED_FLAG when returning from ioctls to indicate that a uevent was actually generated. This tells the userspace caller that it may need to wait for the event to be processed. Signed-off-by: Peter Rajnoha Signed-off-by: Alasdair G Kergon Signed-off-by: Greg Kroah-Hartman commit faef0b851da169e44a842ab3b257a84857ac8f7f Author: Borislav Petkov Date: Thu Feb 18 19:37:14 2010 +0100 x86, cacheinfo: Enable L3 CID only on AMD commit cb19060abfdecac0d1eb2d2f0e7d6b7a3f8bc4f4 upstream. Final stage linking can fail with arch/x86/built-in.o: In function `store_cache_disable': intel_cacheinfo.c:(.text+0xc509): undefined reference to `amd_get_nb_id' arch/x86/built-in.o: In function `show_cache_disable': intel_cacheinfo.c:(.text+0xc7d3): undefined reference to `amd_get_nb_id' when CONFIG_CPU_SUP_AMD is not enabled because the amd_get_nb_id helper is defined in AMD-specific code but also used in generic code (intel_cacheinfo.c). Reorganize the L3 cache index disable code under CONFIG_CPU_SUP_AMD since it is AMD-only anyway. Signed-off-by: Borislav Petkov LKML-Reference: <20100218184210.GF20473@aftab> Signed-off-by: H. Peter Anvin Signed-off-by: Greg Kroah-Hartman commit f8b1a072d4f260c203eb500beb70a1e1c2ff8689 Author: Borislav Petkov Date: Thu Feb 4 12:09:07 2010 +0100 x86, cacheinfo: Remove NUMA dependency, fix for AMD Fam10h rev D1 commit f619b3d8427eb57f0134dab75b0d217325c72411 upstream. The show/store_cache_disable routines depend unnecessarily on NUMA's cpu_to_node and the disabling of cache indices broke when !CONFIG_NUMA. Remove that dependency by using a helper which is always correct. While at it, enable L3 Cache Index disable on rev D1 Istanbuls which sport the feature too. Signed-off-by: Borislav Petkov LKML-Reference: <20100218184339.GG20473@aftab> Signed-off-by: H. Peter Anvin Signed-off-by: Greg Kroah-Hartman commit ad98454d28b70fafe526fbab77e67560bacde482 Author: Borislav Petkov Date: Fri Jan 22 16:01:07 2010 +0100 x86, cacheinfo: Calculate L3 indices commit 048a8774ca43488d78605031f11cc206d7a2682a upstream. We need to know the valid L3 indices interval when disabling them over /sysfs. Do that when the core is brought online and add boundary checks to the sysfs .store attribute. Signed-off-by: Borislav Petkov LKML-Reference: <1264172467-25155-6-git-send-email-bp@amd64.org> Signed-off-by: H. Peter Anvin Signed-off-by: Greg Kroah-Hartman commit 233c0fce667f9277557638617bcd1d914c555c83 Author: Borislav Petkov Date: Fri Jan 22 16:01:06 2010 +0100 x86, cacheinfo: Add cache index disable sysfs attrs only to L3 caches commit 897de50e08937663912c86fb12ad7f708af2386c upstream. The cache_disable_[01] attribute in /sys/devices/system/cpu/cpu?/cache/index[0-3]/ is enabled on all cache levels although only L3 supports it. Add it only to the cache level that actually supports it. Signed-off-by: Borislav Petkov LKML-Reference: <1264172467-25155-5-git-send-email-bp@amd64.org> Signed-off-by: H. Peter Anvin Signed-off-by: Greg Kroah-Hartman commit 4db62486719bfdac5a7d911322aa55975adbc360 Author: Borislav Petkov Date: Fri Jan 22 16:01:04 2010 +0100 intel-agp: Switch to wbinvd_on_all_cpus commit 48a719c238bcbb72d6da79de9c5b3b93ab472107 upstream. Simplify if-statement while at it. [ hpa: we need to #include ] Cc: Dave Jones Cc: David Airlie Signed-off-by: Borislav Petkov LKML-Reference: <1264172467-25155-3-git-send-email-bp@amd64.org> Signed-off-by: H. Peter Anvin Signed-off-by: Greg Kroah-Hartman commit 819fbc552c8b1376926a726b92eff8b446264c3c Author: Borislav Petkov Date: Fri Jan 22 16:01:05 2010 +0100 x86, cacheinfo: Fix disabling of L3 cache indices commit dcf39daf3d6d97f8741e82f0b9fb7554704ed2d1 upstream. * Correct the masks used for writing the cache index disable indices. * Do not turn off L3 scrubber - it is not necessary. * Make sure wbinvd is executed on the same node where the L3 is. * Check for out-of-bounds values written to the registers. * Make show_cache_disable hex values unambiguous * Check for Erratum #388 Signed-off-by: Borislav Petkov LKML-Reference: <1264172467-25155-4-git-send-email-bp@amd64.org> Signed-off-by: H. Peter Anvin Signed-off-by: Greg Kroah-Hartman commit 7d4f404ff0b85103b84fd896c7217d34cc505d85 Author: Borislav Petkov Date: Fri Jan 22 16:01:03 2010 +0100 x86, lib: Add wbinvd smp helpers commit a7b480e7f30b3813353ec009f10f2ac7a6669f3b upstream. Add wbinvd_on_cpu and wbinvd_on_all_cpus stubs for executing wbinvd on a particular CPU. [ hpa: renamed lib/smp.c to lib/cache-smp.c ] [ hpa: wbinvd_on_all_cpus() returns int, but wbinvd() returns void. Thus, the former cannot be a macro for the latter, replace with an inline function. ] Signed-off-by: Borislav Petkov LKML-Reference: <1264172467-25155-2-git-send-email-bp@amd64.org> Signed-off-by: H. Peter Anvin Signed-off-by: Greg Kroah-Hartman commit 61190b356dfc400db691f1ea0311fed103fe8111 Author: Chris Wright Date: Fri Apr 2 18:27:54 2010 -0700 Revert "x86: disable IOMMUs on kernel crash" commit 8f9f55e83e939724490d7cde3833c4883c6d1310 upstream. This effectively reverts commit 61d047be99757fd9b0af900d7abce9a13a337488. Disabling the IOMMU can potetially allow DMA transactions to complete without being translated. Leave it enabled, and allow crash kernel to do the IOMMU reinitialization properly. Cc: Joerg Roedel Cc: Eric Biederman Cc: Neil Horman Cc: Vivek Goyal Signed-off-by: Chris Wright Signed-off-by: Joerg Roedel Signed-off-by: Greg Kroah-Hartman commit 678e83d206a8cca18afc008cc290a75eeb6a67cd Author: Chris Wright Date: Fri Apr 2 18:27:52 2010 -0700 x86/amd-iommu: enable iommu before attaching devices commit 75f66533bc883f761a7adcab3281fe3323efbc90 upstream. Hit another kdump problem as reported by Neil Horman. When initializaing the IOMMU, we attach devices to their domains before the IOMMU is fully (re)initialized. Attaching a device will issue some important invalidations. In the context of the newly kexec'd kdump kernel, the IOMMU may have stale cached data from the original kernel. Because we do the attach too early, the invalidation commands are placed in the new command buffer before the IOMMU is updated w/ that buffer. This leaves the stale entries in the kdump context and can renders device unusable. Simply enable the IOMMU before we do the attach. Cc: Neil Horman Cc: Vivek Goyal Signed-off-by: Chris Wright Signed-off-by: Joerg Roedel Signed-off-by: Greg Kroah-Hartman commit 78b124998ce07bb27cf23bd6d1a7337ba22cb262 Author: Joerg Roedel Date: Mon Mar 8 14:20:07 2010 +0100 x86/amd-iommu: Use helper function to destroy domain commit 8b408fe4f853dcfa18d133aa4cf1d7546b4c3870 upstream. In the amd_iommu_domain_destroy the protection_domain_free function is partly reimplemented. The 'partly' is the bug here because the domain is not deleted from the domain list. This results in use-after-free errors and data-corruption. Fix it by just using protection_domain_free instead. Signed-off-by: Joerg Roedel Signed-off-by: Greg Kroah-Hartman commit 544e6619c3b8339698c96a05d26016013454e654 Author: Chris Wright Date: Wed Feb 17 08:51:20 2010 -0800 x86/amd-iommu: Pt mode fix for domain_destroy commit 04e856c072b84042bb56c487c2868638bb3f78db upstream. After a guest is shutdown, assigned devices are not properly returned to the pt domain. This can leave the device using stale cached IOMMU data, and result in a non-functional device after it's re-bound to the host driver. For example, I see this upon rebinding: AMD-Vi: Event logged [IO_PAGE_FAULT device=02:00.0 domain=0x0000 address=0x000000007e2a8000 flags=0x0050] AMD-Vi: Event logged [IO_PAGE_FAULT device=02:00.0 domain=0x0000 address=0x000000007e2a8040 flags=0x0050] AMD-Vi: Event logged [IO_PAGE_FAULT device=02:00.0 domain=0x0000 address=0x000000007e2a8080 flags=0x0050] AMD-Vi: Event logged [IO_PAGE_FAULT device=02:00.0 domain=0x0000 address=0x000000007e2a80c0 flags=0x0050] 0000:02:00.0: eth2: Detected Hardware Unit Hang: ... The amd_iommu_destroy_domain() function calls do_detach() which doesn't reattach the pt domain to the device. Use __detach_device() instead. Signed-off-by: Chris Wright Signed-off-by: Joerg Roedel Signed-off-by: Greg Kroah-Hartman commit 5e3a88a86e70947aa6b21fba6bcf9d5e1b2ac845 Author: Dave Airlie Date: Mon Apr 19 17:54:31 2010 +1000 drm/radeon/kms: add FireMV 2400 PCI ID. commit 79b9517a33a283c5d9db875c263670ed1e055f7e upstream. This is an M24/X600 chip. From RH# 581927 Signed-off-by: Dave Airlie Signed-off-by: Greg Kroah-Hartman commit f7d90a6e98bf191d43416da4d70fb5817f5738b9 Author: Jerome Glisse Date: Fri Apr 16 18:46:35 2010 +0200 drm/radeon/kms: fix rs600 tlb flush commit 30f69f3fb20bd719b5e1bf879339914063d38f47 upstream. Typo in in flush leaded to no flush of the RS600 tlb which ultimately leaded to massive system ram corruption, with this patch everythings seems to work properly. Signed-off-by: Jerome Glisse Signed-off-by: Dave Airlie Signed-off-by: Greg Kroah-Hartman commit 203b9d5e958f9334df805f3de0c7bd131463dc99 Author: Alex Deucher Date: Thu Apr 15 13:31:12 2010 -0400 drm/radeon/kms: fix tv dac conflict resolver commit 08d075116db3592db218bfe0f554cd93c9e12505 upstream. On systems with the tv dac shared between DVI and TV, we can only use the dac for one of the connectors. However, when using a digital monitor on the DVI port, you can use the dac for the TV connector just fine. Check the use_digital status when resolving the conflict. Fixes fdo bug 27649, possibly others. Signed-off-by: Alex Deucher Signed-off-by: Dave Airlie Signed-off-by: Greg Kroah-Hartman commit 1cda055bf9f47370067223da823342756fed786b Author: Alex Deucher Date: Tue Apr 13 11:21:59 2010 -0400 drm/radeon/kms: disable the tv encoder when tv/cv is not in use commit d3a67a43b0460bae3e2ac14092497833344ac10d upstream. Switching between TV and VGA caused VGA to break on some systems since the TV encoder was left enabled when VGA was used. fixes fdo bug 25520. Signed-off-by: Alex Deucher Signed-off-by: Dave Airlie Signed-off-by: Greg Kroah-Hartman commit 4a9f5b424287bb6469caee0be5e8305429d7a180 Author: Alex Deucher Date: Fri Apr 9 15:01:25 2010 -0400 drm/radeon/kms: more atom parser fixes (v2) commit 65384a1d41c4e91f0b49d90d11b7f424d6e5c58e upstream. shr/shl ops need the full dst rather than the pre-masked version. Fixes fdo bug 27478 and kernel bug 15738. v2: remove some unsed vars, add comments Signed-off-by: Alex Deucher Signed-off-by: Dave Airlie Signed-off-by: Greg Kroah-Hartman commit 951a0c46c5b9810962ca116396c8881ee5b96b71 Author: Stefan Bader Date: Mon Mar 29 17:53:12 2010 +0200 drm/i915: Add no_lvds entry for the Clientron U800 commit 9875557ee8247c3f7390d378c027b45c7535a224 upstream. BugLink: http://bugs.launchpad.net/ubuntu/bugs/544671 This system claims to have a LVDS but has not. Signed-off-by: Stephane Graber Signed-off-by: Stefan Bader Signed-off-by: Eric Anholt Signed-off-by: Greg Kroah-Hartman commit d610bdc6a23398217d9d0c5207cb85676e2a3193 Author: Jean Delvare Date: Wed Apr 14 16:14:08 2010 +0200 hwmon: (sht15) Properly handle the case CONFIG_REGULATOR=n commit c7a78d2c2e2537fd24903e966f34aae50319d587 upstream. When CONFIG_REGULATOR isn't set, regulator_get_voltage() returns 0. Properly handle this case by not trusting the value. Reported-by: Jerome Oufella Signed-off-by: Jean Delvare Cc: Jonathan Cameron Acked-by: Mark Brown Signed-off-by: Greg Kroah-Hartman commit eeb5f3b99a8ccc55e4ae4b0511a0b05e86d0b78d Author: Jerome Oufella Date: Wed Apr 14 16:14:07 2010 +0200 hwmon: (sht15) Fix sht15_calc_temp interpolation function commit 328a2c22abd08911e37fa66f1358f829cecd72e9 upstream. I discovered two issues. First the previous sht15_calc_temp() loop did not iterate through the temppoints array since the (data->supply_uV > temppoints[i - 1].vdd) test is always true in this direction. Also the two-points linear interpolation function was returning biased values due to a stray division by 1000 which shouldn't be there. [JD: Also change the default value for d1 from 0 to something saner.] Signed-off-by: Jerome Oufella Acked-by: Jonathan Cameron Signed-off-by: Jean Delvare Signed-off-by: Greg Kroah-Hartman commit fae0017ccf08a2d2ddb5c420793f3591d8ab85cb Author: Takashi Iwai Date: Sat Apr 10 21:27:23 2010 +0200 ALSA: usb - Fix Oops after usb-midi disconnection commit 29aac005ff4dc8a5f50b80f4e5c4f59b21c0fb50 upstream. usb-midi causes sometimes Oops at snd_usbmidi_output_drain() after disconnection. This is due to the access to the endpoints which have been already released at disconnection while the files are still alive. This patch fixes the problem by checking disconnection state at snd_usbmidi_output_drain() and by releasing urbs but keeping the endpoint instances until really all freed. Tested-by: Tvrtko Ursulin Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit 2ea24ea2243e358ca74541d159da329a7e734d81 Author: Joerg Schirottke Date: Thu Apr 15 08:37:41 2010 +0200 ALSA: hda - add a quirk for Clevo M570U laptop commit d1501ea844eefdf925f6b711875b4b2b928fddf8 upstream. Added the matching model for Clevo laptop M570U. Signed-off-by: Joerg Schirottke Tested-by: Maximilian Gerhard Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit f0736a48d05685fae9afa5b13d9eab5b8dcd34f4 Author: Yong Wang Date: Fri Mar 19 23:02:16 2010 -0700 Input: sparse-keymap - free the right keymap on error commit 88fcf710c13bd41f2b98c5411e4f21ab98da4fb4 upstream. 'map' is allocated in sparse_keymap_setup() and it it the one that should be freed on error instead of 'keymap'. Signed-off-by: Yong Wang Signed-off-by: Dmitry Torokhov Signed-off-by: Greg Kroah-Hartman commit e58bcaf0556d4507abab778f1a919e45d4d5639a Author: Ping Cheng Date: Tue Apr 13 23:07:52 2010 -0700 Input: wacom - switch mode upon system resume commit 014f61504af276ba9d9544d8a7401d8f8526eb73 upstream. When Wacom devices wake up from a sleep, the switch mode command (wacom_query_tablet_data) is needed before wacom_open is called. wacom_query_tablet_data should not be executed inside wacom_open since wacom_open is called more than once during probe. wacom_retrieve_hid_descriptor is removed from wacom_resume due to the fact that the required descriptors are stored properly upon system resume. Reported-and-tested-by: Anton Anikin Signed-off-by: Ping Cheng Signed-off-by: Dmitry Torokhov Signed-off-by: Greg Kroah-Hartman commit 9c84e4813a02a219d61f61967d7058f2d8037d88 Author: Trond Myklebust Date: Sun Apr 11 16:48:44 2010 -0400 NFSv4: fix delegated locking commit 0df5dd4aae211edeeeb84f7f84f6d093406d7c22 upstream. Arnaud Giersch reports that NFSv4 locking is broken when we hold a delegation since commit 8e469ebd6dc32cbaf620e134d79f740bf0ebab79 (NFSv4: Don't allow posix locking against servers that don't support it). According to Arnaud, the lock succeeds the first time he opens the file (since we cannot do a delegated open) but then fails after we start using delegated opens. The following patch fixes it by ensuring that locking behaviour is governed by a per-filesystem capability flag that is initially set, but gets cleared if the server ever returns an OPEN without the NFS4_OPEN_RESULT_LOCKTYPE_POSIX flag being set. Reported-by: Arnaud Giersch Signed-off-by: Trond Myklebust Signed-off-by: Greg Kroah-Hartman commit a354226edbcd28cd1a55d0abbbbc9a703ba26f1c Author: Trond Myklebust Date: Thu Mar 25 13:51:05 2010 -0400 NFSv4: Fall back to ordinary lookup if nfs4_atomic_open() returns EISDIR commit 80e60639f1b7c121a7fea53920c5a4b94009361a upstream. Signed-off-by: Trond Myklebust Signed-off-by: Greg Kroah-Hartman commit 9d82f5e75d0cb6eff722a21f5949425b6a270f4d Author: Anton Blanchard Date: Tue Apr 6 17:02:19 2010 +1000 sched: Fix sched_getaffinity() commit 84fba5ec91f11c0efb27d0ed6098f7447491f0df upstream. taskset on 2.6.34-rc3 fails on one of my ppc64 test boxes with the following error: sched_getaffinity(0, 16, 0x10029650030) = -1 EINVAL (Invalid argument) This box has 128 threads and 16 bytes is enough to cover it. Commit cd3d8031eb4311e516329aee03c79a08333141f1 (sched: sched_getaffinity(): Allow less than NR_CPUS length) is comparing this 16 bytes agains nr_cpu_ids. Fix it by comparing nr_cpu_ids to the number of bits in the cpumask we pass in. Signed-off-by: Anton Blanchard Reviewed-by: KOSAKI Motohiro Cc: Sharyathi Nagesh Cc: Ulrich Drepper Cc: Peter Zijlstra Cc: Linus Torvalds Cc: Jack Steiner Cc: Russ Anderson Cc: Mike Travis LKML-Reference: <20100406070218.GM5594@kryten> Signed-off-by: Ingo Molnar Signed-off-by: Greg Kroah-Hartman commit 4eda4e44c72f3594196db58e9bf25055f2156547 Author: KOSAKI Motohiro Date: Fri Mar 12 16:15:36 2010 +0900 sched: sched_getaffinity(): Allow less than NR_CPUS length commit cd3d8031eb4311e516329aee03c79a08333141f1 upstream. [ Note, this commit changes the syscall ABI for > 1024 CPUs systems. ] Recently, some distro decided to use NR_CPUS=4096 for mysterious reasons. Unfortunately, glibc sched interface has the following definition: # define __CPU_SETSIZE 1024 # define __NCPUBITS (8 * sizeof (__cpu_mask)) typedef unsigned long int __cpu_mask; typedef struct { __cpu_mask __bits[__CPU_SETSIZE / __NCPUBITS]; } cpu_set_t; It mean, if NR_CPUS is bigger than 1024, cpu_set_t makes an ABI issue ... More recently, Sharyathi Nagesh reported following test program makes misterious syscall failure: ----------------------------------------------------------------------- #define _GNU_SOURCE #include #include #include int main() { cpu_set_t set; if (sched_getaffinity(0, sizeof(cpu_set_t), &set) < 0) printf("\n Call is failing with:%d", errno); } ----------------------------------------------------------------------- Because the kernel assumes len argument of sched_getaffinity() is bigger than NR_CPUS. But now it is not correct. Now we are faced with the following annoying dilemma, due to the limitations of the glibc interface built in years ago: (1) if we change glibc's __CPU_SETSIZE definition, we lost binary compatibility of _all_ application. (2) if we don't change it, we also lost binary compatibility of Sharyathi's use case. Then, I would propse to change the rule of the len argument of sched_getaffinity(). Old: len should be bigger than NR_CPUS New: len should be bigger than maximum possible cpu id This creates the following behavior: (A) In the real 4096 cpus machine, the above test program still return -EINVAL. (B) NR_CPUS=4096 but the machine have less than 1024 cpus (almost all machines in the world), the above can run successfully. Fortunatelly, BIG SGI machine is mainly used for HPC use case. It means they can rebuild their programs. IOW we hope they are not annoyed by this issue ... Reported-by: Sharyathi Nagesh Signed-off-by: KOSAKI Motohiro Acked-by: Ulrich Drepper Acked-by: Peter Zijlstra Cc: Linus Torvalds Cc: Andrew Morton Cc: Jack Steiner Cc: Russ Anderson Cc: Mike Travis LKML-Reference: <20100312161316.9520.A69D9226@jp.fujitsu.com> Signed-off-by: Ingo Molnar Signed-off-by: Greg Kroah-Hartman commit e5f509bf8e83b274b464ea02d79a1bdc648ea3ba Author: Suresh Siddha Date: Wed Mar 31 18:04:47 2010 -0700 x86: Fix double enable_IR_x2apic() call on SMP kernel on !SMP boards commit 472a474c6630efd195d3738339fd1bdc8aa3b1aa upstream. Jan Grossmann reported kernel boot panic while booting SMP kernel on his system with a single core cpu. SMP kernels call enable_IR_x2apic() from native_smp_prepare_cpus() and on platforms where the kernel doesn't find SMP configuration we ended up again calling enable_IR_x2apic() from the APIC_init_uniprocessor() call in the smp_sanity_check(). Thus leading to kernel panic. Don't call enable_IR_x2apic() and default_setup_apic_routing() from APIC_init_uniprocessor() in CONFIG_SMP case. NOTE: this kind of non-idempotent and assymetric initialization sequence is rather fragile and unclean, we'll clean that up in v2.6.35. This is the minimal fix for v2.6.34. Reported-by: Jan.Grossmann@kielnet.net Signed-off-by: Suresh Siddha Cc: Cc: Cc: Cc: Cc: LKML-Reference: <1270083887.7835.78.camel@sbs-t61.sc.intel.com> Signed-off-by: Ingo Molnar Signed-off-by: Greg Kroah-Hartman commit 9f03442b0fcd587afd232ce8386114a5290e9f8f Author: Pallipadi, Venkatesh Date: Thu Feb 25 10:53:48 2010 -0800 x86, hpet: Erratum workaround for read after write of HPET comparator commit 8da854cb02156c90028233ae1e85ce46a1d3f82c upstream. On Wed, Feb 24, 2010 at 03:37:04PM -0800, Justin Piszcz wrote: > Hello, > > Again, on the Intel DP55KG board: > > # uname -a > Linux host 2.6.33 #1 SMP Wed Feb 24 18:31:00 EST 2010 x86_64 GNU/Linux > > [ 1.237600] ------------[ cut here ]------------ > [ 1.237890] WARNING: at arch/x86/kernel/hpet.c:404 hpet_next_event+0x70/0x80() > [ 1.238221] Hardware name: > [ 1.238504] hpet: compare register read back failed. > [ 1.238793] Modules linked in: > [ 1.239315] Pid: 0, comm: swapper Not tainted 2.6.33 #1 > [ 1.239605] Call Trace: > [ 1.239886] [] ? warn_slowpath_common+0x73/0xb0 > [ 1.240409] [] ? tick_dev_program_event+0x38/0xc0 > [ 1.240699] [] ? warn_slowpath_fmt+0x40/0x50 > [ 1.240992] [] ? tick_dev_program_event+0x38/0xc0 > [ 1.241281] [] ? hpet_next_event+0x70/0x80 > [ 1.241573] [] ? tick_dev_program_event+0x38/0xc0 > [ 1.241859] [] ? tick_handle_oneshot_broadcast+0xe2/0x100 > [ 1.246533] [] ? timer_interrupt+0x1a/0x30 > [ 1.246826] [] ? handle_IRQ_event+0x39/0xd0 > [ 1.247118] [] ? handle_edge_irq+0xb8/0x160 > [ 1.247407] [] ? handle_irq+0x15/0x20 > [ 1.247689] [] ? do_IRQ+0x62/0xe0 > [ 1.247976] [] ? ret_from_intr+0x0/0xa > [ 1.248262] [] ? mwait_idle+0x57/0x80 > [ 1.248796] [] ? cpu_idle+0x5c/0xb0 > [ 1.249080] ---[ end trace db7f668fb6fef4e1 ]--- > > Is this something Intel has to fix or is it a bug in the kernel? This is a chipset erratum. Thomas: You mentioned we can retain this check only for known-buggy and hpet debug kind of options. But here is the simple workaround patch for this particular erratum. Some chipsets have a erratum due to which read immediately following a write of HPET comparator returns old comparator value instead of most recently written value. Erratum 15 in "Intel I/O Controller Hub 9 (ICH9) Family Specification Update" (http://www.intel.com/assets/pdf/specupdate/316973.pdf) Workaround for the errata is to read the comparator twice if the first one fails. Signed-off-by: Venkatesh Pallipadi LKML-Reference: <20100225185348.GA9674@linux-os.sc.intel.com> Signed-off-by: H. Peter Anvin Cc: Venkatesh Pallipadi Signed-off-by: Greg Kroah-Hartman commit 16f886e00b3d52dca4b4d4a7e8ceaeaef7bb2b6c Author: Andi Kleen Date: Mon Mar 29 09:41:11 2010 +0200 x86: Handle overlapping mptables commit 909fc87b32b3b9e3f0b87dcc5d98319c41900c58 upstream. We found a system where the MP table MPC and MPF structures overlap. That doesn't really matter because the mptable is not used anyways with ACPI, but it leads to a panic in the early allocator due to the overlapping reservations in 2.6.33. Earlier kernels handled this without problems. Simply change these reservations to reserve_early_overlap_ok to avoid the panic. Reported-by: Thomas Renninger Tested-by: Thomas Renninger Signed-off-by: Andi Kleen LKML-Reference: <20100329074111.GA22821@basil.fritz.box> Signed-off-by: H. Peter Anvin Signed-off-by: Greg Kroah-Hartman commit 43831ff4536d3f828060a228220ee723b58642dd Author: Shaohua Li Date: Fri Mar 5 08:59:32 2010 +0800 x86-32, resume: do a global tlb flush in S4 resume commit 8ae06d223f8203c72104e5c0c4ee49a000aedb42 upstream. Colin King reported a strange oops in S4 resume code path (see below). The test system has i5/i7 CPU. The kernel doesn't open PAE, so 4M page table is used. The oops always happen a virtual address 0xc03ff000, which is mapped to the last 4k of first 4M memory. Doing a global tlb flush fixes the issue. EIP: 0060:[] EFLAGS: 00010086 CPU: 0 EIP is at copy_loop+0xe/0x15 EAX: 36aeb000 EBX: 00000000 ECX: 00000400 EDX: f55ad46c ESI: 0f800000 EDI: c03ff000 EBP: f67fbec4 ESP: f67fbea8 DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068 ... ... CR2: 00000000c03ff000 Tested-by: Colin Ian King Signed-off-by: Shaohua Li LKML-Reference: <20100305005932.GA22675@sli10-desk.sh.intel.com> Acked-by: Rafael J. Wysocki Signed-off-by: H. Peter Anvin Signed-off-by: Greg Kroah-Hartman commit bc4ae10e707a7872095264607f049893e9656efb Author: Alex Deucher Date: Tue Apr 6 12:35:26 2010 -0400 drm/radeon/kms/combios: verify dac_adj values are valid commit 3a89b4a9ca7ce11e3b7d5119aea917b9fc29a302 upstream. Some vbios dac_adj tables are all zeros. Check for that case and use the default table if so. Should fix fdo bug 27478. Signed-off-by: Alex Deucher Signed-off-by: Dave Airlie Signed-off-by: Greg Kroah-Hartman commit 7f4be8b0c326cd9d0a62a4d85809979a3428c5de Author: Alex Deucher Date: Mon Apr 5 23:57:52 2010 -0400 drm/radeon/kms: fix washed out image on legacy tv dac commit 643acacf02679befd0f98ac3c5fecb805f1c9548 upstream. bad cast was overwriting the tvdac adj values Fixes fdo bug 27478 Signed-off-by: Alex Deucher Signed-off-by: Dave Airlie Signed-off-by: Greg Kroah-Hartman commit 23e8082246a1c0da3b1772e272059040c401ab78 Author: Michel Dänzer Date: Fri Apr 2 16:59:06 2010 +0000 drm/radeon: R300 AD only has one quad pipe. commit 57b54ea6b7863ccfeb41851b5f58f9fd1b83c79e upstream. Gleaned from the Mesa code. Fixes https://bugs.freedesktop.org/show_bug.cgi?id=27355 . Signed-off-by: Michel Dänzer Signed-off-by: Dave Airlie Signed-off-by: Greg Kroah-Hartman commit 6a5cc5148653284857728844ab0169643ffe7cf4 Author: Adam Jackson Date: Tue Apr 6 16:11:00 2010 +0000 drm/edid/quirks: Envision EN2028 commit ba1163de2f74d624e7b0e530c4104c98ede0045a upstream. Claims 1280x1024 preferred, physically 1600x1200 cf. http://bugzilla.redhat.com/530399 Signed-off-by: Adam Jackson Signed-off-by: Dave Airlie Signed-off-by: Greg Kroah-Hartman commit 88f4affa120a63961a7dbd677539b1a89f8f8cfe Author: Rabin Vincent Date: Wed Apr 7 18:10:20 2010 +0100 ARM: 6031/1: fix Thumb-2 decompressor commit d4d9959c099751158c5cf14813fe378e206339c6 upstream. 98e12b5a6e05413 ("ARM: Fix decompressor's kernel size estimation for ROM=y") broke the Thumb-2 decompressor because it added an entry in the LC0 table but didn't adjust the offset the Thumb-2 code uses to load the SP from that table. Fix it. Signed-off-by: Rabin Vincent Signed-off-by: Russell King Signed-off-by: Greg Kroah-Hartman commit a426c6e7ec8c7208cfcaf1a57d10d4d07c5e7f3f Author: Javier Cardona Date: Mon Mar 29 11:00:20 2010 -0700 mac80211: Handle mesh action frames in ieee80211_rx_h_action commit 1cb561f83793191cf86a2db3948d28f5f42df9ff upstream. This fixes the problem introduced in commit 8404080568613d93ad7cf0a16dfb68 which broke mesh peer link establishment. changes: v2 Added missing break (Johannes) v3 Broke original patch into two (Johannes) Signed-off-by: Javier Cardona Reviewed-by: Johannes Berg Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit cc0ffdadee6e17cabcb9ce2081b5a637c87113ea Author: Wey-Yi Guy Date: Thu Apr 8 13:17:37 2010 -0700 iwlwifi: need check for valid qos packet before free commit ece6444c2fe80dab679beb5f0d58b091f1933b00 upstream. For 4965, need to check it is valid qos frame before free, only valid QoS frame has the tid used to free the packets. Signed-off-by: Wey-Yi Guy Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit 0d54cd89c5cb669505946ab6789ef68b3a7d7f75 Author: Felix Fietkau Date: Tue Apr 6 12:05:01 2010 -0700 ath9k: fix double calls to ath_radio_enable commit 1144601118507f8b3b676a9a392584d216d3f2cc upstream. With the enable_radio being uninitialized, ath_radio_enable() might be called twice, which can leave some hardware in an undefined state. Signed-off-by: Felix Fietkau Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit 328f7088efe2d95b00fe277c51896062aa82942e Author: Steve French Date: Sat Apr 3 17:20:21 2010 +0000 CIFS: initialize nbytes at the beginning of CIFSSMBWrite() commit a24e2d7d8f512340991ef0a59cb5d08d491b8e98 upstream. By doing this we always overwrite nbytes value that is being passed on to CIFSSMBWrite() and need not rely on the callers to initialize. CIFSSMBWrite2 is doing this already. Reviewed-by: Shirish Pargaonkar Reviewed-by: Jeff Layton Signed-off-by: Suresh Jayaraman Signed-off-by: Steve French Signed-off-by: Greg Kroah-Hartman commit c171476c7ddde592eafb085d8a5d95ce4f1b3ef2 Author: Suresh Jayaraman Date: Wed Mar 31 12:00:03 2010 +0530 cifs: Fix a kernel BUG with remote OS/2 server (try #3) commit 6513a81e9325d712f1bfb9a1d7b750134e49ff18 upstream. While chasing a bug report involving a OS/2 server, I noticed the server sets pSMBr->CountHigh to a incorrect value even in case of normal writes. This results in 'nbytes' being computed wrongly and triggers a kernel BUG at mm/filemap.c. void iov_iter_advance(struct iov_iter *i, size_t bytes) { BUG_ON(i->count < bytes); <--- BUG here Why the server is setting 'CountHigh' is not clear but only does so after writing 64k bytes. Though this looks like the server bug, the client side crash may not be acceptable. The workaround is to mask off high 16 bits if the number of bytes written as returned by the server is greater than the bytes requested by the client as suggested by Jeff Layton. Reviewed-by: Jeff Layton Signed-off-by: Suresh Jayaraman Signed-off-by: Steve French Signed-off-by: Greg Kroah-Hartman commit 86c4129a017aaade3bc1fe3f47156ffd99e16f16 Author: Christian Borntraeger Date: Fri Apr 9 13:43:01 2010 +0200 s390: disable change bit override commit 6af7eea2aee57b869f34eba0a94ef122fe90fbfd upstream. commit 6a985c6194017de2c062916ad1cd00dee0302c40 ([S390] s390: use change recording override for kernel mapping) deactivated the change bit recording for the kernel mapping to improve the performance. This works most of the time, but there are cases (e.g. kernel runs in home space, futex atomic compare xcmg) where we modify user memory with the kernel mapping instead of the user mapping. Instead of fixing these cases, this patch just deactivates change bit override to avoid future problems with other kernel code that might use the kernel mapping for user memory. Signed-off-by: Christian Borntraeger Signed-off-by: Martin Schwidefsky Signed-off-by: Greg Kroah-Hartman commit 351bb6c3608dca332b5a84be8302cbff8b835612 Author: Tejun Heo Date: Mon Apr 5 10:51:26 2010 +0900 libata: disable NCQ on Crucial C300 SSD commit 68b0ddb289220b6d4d865be128939663be34959d upstream. Crucial said, Thank you for contacting us. We know that with our M225 line of SSDs you sometimes need to disable NCQ (native command queuing) to avoid just the type of errors you're seeing. Our recommendation for the M225 is to add libata.force=noncq to your Linux kernel boot options, under the kernel ATA library option. I have sent your feedback to the engineers working on the C300, and asked them to please pass it on to the firmware team. I have been notified that they are in the process of testing and finalizing a new firmware version, that you can expect to see released around the end of April. We’ll keep you posted as to when it will be available for download. So, turn off NCQ on the drive w/ the current firmware revision. Reported in the following bug. https://bugzilla.kernel.org/show_bug.cgi?id=15573 Signed-off-by: Tejun Heo Reported-by: lethalwp@scarlet.be Reported-by: Luke Macken Signed-off-by: Jeff Garzik Signed-off-by: Greg Kroah-Hartman commit 7da23d3cfc92dd092f440f1c43b7a308985669f7 Author: JosephChan@via.com.tw Date: Fri Mar 19 14:08:11 2010 +0800 pata_via: Add VIA VX900 support commit 4f1deba435ef75380c1d06fda860c7a15ea16fdf upstream. Signed-off-by: Joseph Chan Signed-off-by: Jeff Garzik Signed-off-by: Greg Kroah-Hartman commit 15809a0a043f49a9ddae9c2d86da90520ee1e3d3 Author: Evan McClain Date: Tue Mar 9 19:20:58 2010 -0500 backlight: mbp_nvidia_bl - add five more MacBook variants commit 36bc5ee6a8d13333980fa54e97d3469d3d4cda98 upstream. This adds the MacBook 1,1 2,1 3,1 4,1 and 4,2 to the DMI tables. Signed-off-by: Evan McClain Signed-off-by: Richard Purdie Signed-off-by: Greg Kroah-Hartman commit 7fad95abc15c38de2c8acc27a203dae79abf4256 Author: Takashi Iwai Date: Sun Apr 4 12:14:03 2010 +0200 ALSA: hda - Add MSI blacklist for Aopen MZ915-M commit 3815595e78d2baae6feb866e737f92d8ef48b337 upstream. The device needs MSI disablement. Added to the quirk list. Reported-by: Harald Dunkel Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit 4834ffcbc9293b3db44d4f336dad38c8bfd272ab Author: Michele Ballabio Date: Sat Mar 6 21:06:46 2010 +0100 ALSA: hda - Add ASRock mobo to MSI blacklist commit 4193d13b2c2b694aa59e629e6daf6269d7922f13 upstream. This avoids a lockup at boot. Signed-off-by: Michele Ballabio Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit 6658958a7f9a980b50037d721ea248232821e72c Author: Daniel T Chen Date: Tue Mar 30 13:29:28 2010 -0400 ALSA: hda: Fix 0 dB offset for Lenovo Thinkpad models using AD1981 commit b8e80cf386419453678b01bef830f53445ebb15d upstream. BugLink: https://launchpad.net/bugs/551606 The OR's hardware distorts at PCM 100% because it does not correspond to 0 dB. Fix this in patch_ad1981() for all models using the Thinkpad quirk. Reported-by: Jane Silber Signed-off-by: Daniel T Chen Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit c352b9625ae8fcf8b9c7f2c6bb8aee14ef5af9b6 Author: Dan Carpenter Date: Tue Apr 6 19:31:26 2010 +0300 ALSA: mixart: range checking proc file commit b0cc58a25d04160d39a80e436847eaa2fbc5aa09 upstream. The original code doesn't take into consideration that the value of MIXART_BA0_SIZE - pos can be less than zero which would lead to a large unsigned value for "count". Also I moved the check that read size is a multiple of 4 bytes below the code that adjusts "count". Signed-off-by: Dan Carpenter Acked-by: Linus Torvalds Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit 8dac5264253a00220ff12404dd1a318590783f1a Author: David Härdeman Date: Tue Apr 6 14:34:43 2010 -0700 include/linux/kfifo.h: fix INIT_KFIFO() commit 530cd330dc3865e3107304a6e84fdc332aa72f7d upstream. DECLARE_KFIFO creates a union with a struct kfifo and a buffer array with size [size + sizeof(struct kfifo)]. INIT_KFIFO then sets the buffer pointer in struct kfifo to point to the beginning of the buffer array which means that the first call to kfifo_in will overwrite members of the struct kfifo. Signed-off-by: David Härdeman Acked-by: Stefani Seibold Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 92ee813c7f2241000f9d35e71b01273cd871482b Author: Wu Fengguang Date: Tue Apr 6 14:34:53 2010 -0700 readahead: fix NULL filp dereference commit 70655c06bd3f25111312d63985888112aed15ac5 upstream. btrfs relocate_file_extent_cluster() calls us with NULL filp: [ 4005.426805] BUG: unable to handle kernel NULL pointer dereference at 00000021 [ 4005.426818] IP: [] page_cache_sync_readahead+0x18/0x3e Signed-off-by: Wu Fengguang Cc: Yan Zheng Reported-by: Kirill A. Shutemov Tested-by: Kirill A. Shutemov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 769c76538f4a274f17b8d895475f97d4ab5cbeee Author: Anton Blanchard Date: Tue Apr 6 14:34:58 2010 -0700 raw: fsync method is now required commit 55ab3a1ff843e3f0e24d2da44e71bffa5d853010 upstream. Commit 148f948ba877f4d3cdef036b1ff6d9f68986706a (vfs: Introduce new helpers for syncing after writing to O_SYNC file or IS_SYNC inode) broke the raw driver. We now call through generic_file_aio_write -> generic_write_sync -> vfs_fsync_range. vfs_fsync_range has: if (!fop || !fop->fsync) { ret = -EINVAL; goto out; } But drivers/char/raw.c doesn't set an fsync method. We have two options: fix it or remove the raw driver completely. I'm happy to do either, the fact this has been broken for so long suggests it is rarely used. The patch below adds an fsync method to the raw driver. My knowledge of the block layer is pretty sketchy so this could do with a once over. If we instead decide to remove the raw driver, this patch might still be useful as a backport to 2.6.33 and 2.6.32. Signed-off-by: Anton Blanchard Reviewed-by: Jan Kara Cc: Christoph Hellwig Cc: Alexander Viro Cc: Jens Axboe Reviewed-by: Jeff Moyer Tested-by: Jeff Moyer Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 7a48779f900760fb368efdef7e839b066527bb17 Author: Jiri Kosina Date: Tue Mar 23 16:32:37 2010 +0100 HID: fix oops in gyration_event() commit d8e4ebf8b603bdcd091540e6b5bddf0dec10d516 upstream. Fix oops caused by dereferencing field->hidinput in cases where the device hasn't been claimed by hid-input. Reported-by: Andreas Demmer Signed-off-by: Jiri Kosina Signed-off-by: Greg Kroah-Hartman commit c49916829f7503eec91d3916f7ffbcb6993edbba Author: Oleg Nesterov Date: Fri Apr 2 18:05:12 2010 +0200 tty: release_one_tty() forgets to put pids commit 6da8d866d0d39e9509ff826660f6a86a6757c966 upstream. release_one_tty(tty) can be called when tty still has a reference to pgrp/session. In this case we leak the pid. Signed-off-by: Oleg Nesterov Reported-by: Catalin Marinas Reported-and-tested-by: Tetsuo Handa Acked-by: Linus Torvalds Acked-by: Eric W. Biederman Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit bfb7a32508e7b7af99ee9dc76c3d6d1a4a4eee10 Author: Thomas Gleixner Date: Wed Mar 31 13:30:19 2010 +0200 genirq: Force MSI irq handlers to run with interrupts disabled commit 753649dbc49345a73a2454c770a3f2d54d11aec6 upstream. Network folks reported that directing all MSI-X vectors of their multi queue NICs to a single core can cause interrupt stack overflows when enough interrupts fire at the same time. This is caused by the fact that we run interrupt handlers by default with interrupts enabled unless the driver reuqests the interrupt with the IRQF_DISABLED set. The NIC handlers do not set this flag, so simultaneous interrupts can nest unlimited and cause the stack overflow. The only safe counter measure is to run the interrupt handlers with interrupts disabled. We can't switch to this mode in general right now, but it is safe to do so for MSI interrupts. Force IRQF_DISABLED for MSI interrupt handlers. Signed-off-by: Thomas Gleixner Cc: Andi Kleen Cc: Linus Torvalds Cc: Andrew Morton Cc: Ingo Molnar Cc: Peter Zijlstra Cc: Alan Cox Cc: David Miller Cc: Greg Kroah-Hartman Cc: Arnaldo Carvalho de Melo Signed-off-by: Greg Kroah-Hartman commit 235f60c1a10e7f14f200cc9148a93bb283f56074 Author: Seth Heasley Date: Thu Mar 25 16:14:41 2010 -0700 WATCHDOG: iTCO_wdt: TCO Watchdog patch for additional Intel Cougar Point DeviceIDs commit 4c7d849204341dea19be941a3c1eb4bdffac9cc4 upstream. This patch adds the Intel Cougar Point PCH LPC Controller DeviceIDs for iTCO Watchdog. Signed-off-by: Seth Heasley Signed-off-by: Wim Van Sebroeck Signed-off-by: Greg Kroah-Hartman commit f203bac72baf17d2a4fc8bb996f46c81c7dada31 Author: Thomas Mingarelli Date: Wed Mar 17 15:33:31 2010 +0000 WATCHDOG: hpwdt - fix lower timeout limit commit 8ba42bd88c6982fe224b09c33151c797b0fdf1a5 upstream. [Novell Bug 581103] HP Watchdog driver has arbitrary (wrong) timeout limits. Fix the lower timeout limit to a more appropriate value. Signed-off-by: Thomas Mingarelli Signed-off-by: Wim Van Sebroeck Signed-off-by: Greg Kroah-Hartman commit 075d79fd335fed6648fa2db5c99d0d38ad099a64 Author: David S. Miller Date: Sun Apr 4 01:12:50 2010 -0700 sunxvr500: Ignore secondary output PCI devices. [ Upstream commit bdd32ce95f79fb5cc964cd789d7ae4500bba7c6f ] These just represent the secondary and further heads attached to the card, and they have different sets of PCI bar registers to map. So don't try to drive them in the main driver. Reported-by: Frans van Berckel Tested-by: Frans van Berckel Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit a9815f9fb1aa837dc99b84222a6ea4b709741913 Author: David S. Miller Date: Wed Mar 31 18:05:05 2010 -0700 sparc: Fix regset register window handling. [ Upstream commit b857bd292223f54aaae3693c82fa7299a99991cd ] We have to adjust 'reg_window' down by 16 becuase the 'pos' iterator we'll use to index into the stack slots will be between 16 and 32. Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 4c35513318cdb86f13ce5d46a32b1d4045dc0856 Author: Wey-Yi Guy Date: Wed Feb 3 09:28:55 2010 -0800 mac80211: tear down all agg queues when restart/reconfig hw commit 74e2bd1fa3ae9695af566ad5a7a288898787b909 upstream. When there is a need to restart/reconfig hw, tear down all the aggregation queues and let the mac80211 and driver get in-sync to have the opportunity to re-establish the aggregation queues again. Need to wait until driver re-establish all the station information before tear down the aggregation queues, driver(at least iwlwifi driver) will reject the stop aggregation queue request if station is not ready. But also need to make sure the aggregation queues are tear down before waking up the queues, so mac80211 will not sending frames with aggregation bit set. Signed-off-by: Wey-Yi Guy Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit 358f3455718bf3db530eddf4c85ba5465e5f3e2d Author: Johannes Berg Date: Mon Mar 22 13:42:43 2010 -0700 mac80211: move netdev queue enabling to correct spot commit 7236fe29fd72d17074574ba312e7f1bb9d10abaa upstream. "mac80211: fix skb buffering issue" still left a race between enabling the hardware queues and the virtual interface queues. In hindsight it's totally obvious that enabling the netdev queues for a hardware queue when the hardware queue is enabled is wrong, because it could well possible that we can fill the hw queue with packets we already have pending. Thus, we must only enable the netdev queues once all the pending packets have been processed and sent off to the device. In testing, I haven't been able to trigger this race condition, but it's clearly there, possibly only when aggregation is being enabled. Signed-off-by: Johannes Berg Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit 19247cfcced8bd22953a04e7cedef591c0ea1ec4 Author: Porsch, Marco Date: Wed Feb 24 09:53:13 2010 +0100 mac80211: fix PREQ processing and one small bug commit 533866b12cce484994163b1e201778cbac4c04c5 upstream. 1st) a PREQ should only be processed, if it has the same SN and better metric (instead of better or equal). 2nd) next_hop[ETH_ALEN] now actually used to buffer mpath->next_hop->sta.addr for use out of lock. Signed-off-by: Marco Porsch Acked-by: Javier Cardona Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit e0db64375f23e12bbb2c43f89abc099bb61fc2f1 Author: Valentin Longchamp Date: Fri Mar 26 11:44:33 2010 +0100 setup correct int pipe type in ar9170_usb_exec_cmd commit 2d20c72c021d96f8b9230396c8e3782f204214ec upstream. An int urb is constructed but we fill it in with a bulk pipe type. Commit f661c6f8c67bd55e93348f160d590ff9edf08904 implemented a pipe type check when CONFIG_USB_DEBUG is enabled. The check failed for all the ar9170 usb transfers and the driver could not configure the wifi dongle. This went unnoticed until now because most people don't have CONFIG_USB_DEBUG enabled. Signed-off-by: Valentin Longchamp Acked-by: Christian Lamparter Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit 2596e91190508f987871ad58589adb6016668b87 Author: Dan Carpenter Date: Sun Mar 28 14:55:00 2010 +0300 iwlwifi: range checking issue commit 8e1a53c615e8efe0fac670f2973da64758748a8a upstream. IWL_RATE_COUNT is 13 and IWL_RATE_COUNT_LEGACY is 12. IWL_RATE_COUNT_LEGACY is the right one here because iwl3945_rates doesn't support 60M and also that's how "rates" is defined in iwlcore_init_geos() from drivers/net/wireless/iwlwifi/iwl-core.c. rates = kzalloc((sizeof(struct ieee80211_rate) * IWL_RATE_COUNT_LEGACY), GFP_KERNEL); Signed-off-by: Dan Carpenter Acked-by: Zhu Yi Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit 82ebe78ace38cfc37d16166fcff7ff3064e7460b Author: Wey-Yi Guy Date: Thu Mar 18 09:05:00 2010 -0700 iwlwifi: counting number of tfds can be free for 4965 commit be6b38bcb175613f239e0b302607db346472c6b6 upstream. Forget one hunk in 4965 during "iwlwifi: error checking for number of tfds in queue" patch. Reported-by: Shanyu Zhao Signed-off-by: Wey-Yi Guy Signed-off-by: Reinette Chatre Signed-off-by: Greg Kroah-Hartman commit 6f73e60d90f8b29e1707810c422826b5310ca353 Author: Reinette Chatre Date: Fri Mar 12 11:13:26 2010 -0800 iwlwifi: fix regulatory commit f6c8f1523a2de3b84340e45913cbcee8bee74570 upstream. Commit "cfg80211: convert bools into flags" mistakenly modified iwlwifi's regulatory settings instead of just converting it. Fix this. This fixes http://bugzilla.intellinuxwireless.org/show_bug.cgi?id=2172 Signed-off-by: Reinette Chatre Signed-off-by: Greg Kroah-Hartman commit 56bc455e2077fc13c6618e4938dcb8874a061557 Author: Matt Helsley Date: Fri Mar 26 23:51:44 2010 +0100 Freezer: Fix buggy resume test for tasks frozen with cgroup freezer commit 5a7aadfe2fcb0f69e2acc1fbefe22a096e792fc9 upstream. When the cgroup freezer is used to freeze tasks we do not want to thaw those tasks during resume. Currently we test the cgroup freezer state of the resuming tasks to see if the cgroup is FROZEN. If so then we don't thaw the task. However, the FREEZING state also indicates that the task should remain frozen. This also avoids a problem pointed out by Oren Ladaan: the freezer state transition from FREEZING to FROZEN is updated lazily when userspace reads or writes the freezer.state file in the cgroup filesystem. This means that resume will thaw tasks in cgroups which should be in the FROZEN state if there is no read/write of the freezer.state file to trigger this transition before suspend. NOTE: Another "simple" solution would be to always update the cgroup freezer state during resume. However it's a bad choice for several reasons: Updating the cgroup freezer state is somewhat expensive because it requires walking all the tasks in the cgroup and checking if they are each frozen. Worse, this could easily make resume run in N^2 time where N is the number of tasks in the cgroup. Finally, updating the freezer state from this code path requires trickier locking because of the way locks must be ordered. Instead of updating the freezer state we rely on the fact that lazy updates only manage the transition from FREEZING to FROZEN. We know that a cgroup with the FREEZING state may actually be FROZEN so test for that state too. This makes sense in the resume path even for partially-frozen cgroups -- those that really are FREEZING but not FROZEN. Reported-by: Oren Ladaan Signed-off-by: Matt Helsley Signed-off-by: Rafael J. Wysocki Signed-off-by: Greg Kroah-Hartman commit dc13af9b05a8f30456431f706f907dbc10405814 Author: Jason Wessel Date: Tue Mar 30 14:05:07 2010 -0500 x86,kgdb: Always initialize the hw breakpoint attribute commit ab310b5edb8b601bcb02491ed6f7676da4fd1757 upstream. It is required to call hw_breakpoint_init() on an attr before using it in any other calls. This fixes the problem where kgdb will sometimes fail to initialize on x86_64. Signed-off-by: Jason Wessel Cc: Ingo Molnar LKML-Reference: <1269975907-27602-1-git-send-email-jason.wessel@windriver.com> Signed-off-by: Frederic Weisbecker Signed-off-by: Greg Kroah-Hartman commit 0a5693e82c90479a012c903915fa970c7bf22593 Author: Mike Christie Date: Tue Mar 9 14:14:51 2010 -0600 libiscsi: Fix recovery slowdown regression commit 4ae0a6c15efcc37e94e3f30e3533bdec03c53126 upstream. We could be failing/stopping a connection due to libiscsi starting recovery/cleanup, but the xmit path or scsi eh thread path could be dropping the connection at the same time. As a result the session->state gets set to failed instead of in recovery. We end up not blocking the session and so the replacement timeout never gets started and we only end up failing the IO when scsi_softirq_done sees that the cmd has been running for (cmd->allowed + 1) * rq->timeout secs. We used to fail the IO right away so users are seeing a long delay when using dm-multipath. This problem was added in 2.6.28. Signed-off-by: Mike Christie Signed-off-by: James Bottomley Signed-off-by: Greg Kroah-Hartman commit 14d209ccb3a6eb7916f1d282e586afe8fd01b1dd Author: Jeff Mahoney Date: Mon Mar 29 15:12:39 2010 -0400 reiserfs: Fix locking BUG during mount failure commit b7b7fa43103a9fb30dbcc60cbd5161fdfc25f904 upstream. Commit 8ebc423238341b52912c7295b045a32477b33f09 (reiserfs: kill-the-BKL) introduced a bug in the mount failure case. The error label releases the lock before calling journal_release_error, but it requires that the lock be held. do_journal_release unlocks and retakes it. When it releases it without it held, we trigger a BUG(). The error_alloc label skips the unlock since the lock isn't held yet but none of the other conditions that are clean up exist yet either. This patch returns immediately after the kzalloc failure and moves the reiserfs_write_unlock after the journal_release_error call. This was reported in https://bugzilla.novell.com/show_bug.cgi?id=591807 Reported-by: Thomas Siedentopf Signed-off-by: Jeff Mahoney Cc: Thomas Siedentopf Cc: Andrew Morton Signed-off-by: Frederic Weisbecker Signed-off-by: Greg Kroah-Hartman commit 59849d29a6d4dca434d2589e72e28d0c0ac99fcc Author: Matt Fleming Date: Sun Mar 28 20:08:25 2010 +0000 sh: Enable the mmu in start_secondary() commit 4bea3418c737891894b9d3d3e9f8bbd67d66fa38 upstream. For the boot, enable_mmu() is called from setup_arch() but we don't call setup_arch() for any of the other cpus. So turn on the non-boot cpu's mmu inside of start_secondary(). I noticed this bug on an SMP board when trying to map I/O memory (smsc911x registers) into the kernel address space. Since the Address Translation bit in MMUCR wasn't set, accessing the virtual address where the smsc911x registers were supposedly mapped actually performed a physical address access. Signed-off-by: Matt Fleming Signed-off-by: Paul Mundt Signed-off-by: Greg Kroah-Hartman commit be366f07087f374dcf5f038c187828697ddc7480 Author: Andrew Stubbs Date: Mon Mar 29 12:04:19 2010 +0900 sh: Fix FDPIC binary loader commit d5ab780305bb6d60a7b5a74f18cf84eb6ad153b1 upstream. Ensure that the aux table is properly initialized, even when optional features are missing. Without this, the FDPIC loader did not work. Signed-off-by: Andrew Stubbs Signed-off-by: Paul Mundt Signed-off-by: Greg Kroah-Hartman commit f7a475acff3f1eea581c1e3ea1e46163c3408070 Author: Chris Wilson Date: Thu Mar 18 11:56:54 2010 +0000 drm: Return ENODEV if the inode mapping changes commit da58405860b992d2bb21ebae5d685fe3204dd3f0 upstream. Replace a BUG_ON with an error code in the event that the inode mapping changes between calls to drm_open. This may happen for instance if udev is loaded subsequent to the original opening of the device: [ 644.291870] kernel BUG at drivers/gpu/drm/drm_fops.c:146! [ 644.291876] invalid opcode: 0000 [#1] SMP [ 644.291882] last sysfs file: /sys/kernel/uevent_seqnum [ 644.291888] [ 644.291895] Pid: 7276, comm: lt-cairo-test-s Not tainted 2.6.34-rc1 #2 N150/N210/N220 /N150/N210/N220 [ 644.291903] EIP: 0060:[] EFLAGS: 00210283 CPU: 0 [ 644.291912] EIP is at drm_open+0x4b1/0x4e2 [ 644.291918] EAX: f72d8d18 EBX: f790a400 ECX: f73176b8 EDX: 00000000 [ 644.291923] ESI: f790a414 EDI: f790a414 EBP: f647ae20 ESP: f647adfc [ 644.291929] DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068 [ 644.291937] Process lt-cairo-test-s (pid: 7276, ti=f647a000 task=f73f5c80 task.ti=f647a000) [ 644.291941] Stack: [ 644.291945] 00000000 f7bb7400 00000080 f6451100 f73176b8 f6479214 f6451100 f73176b8 [ 644.291957] <0> c1297ce0 f647ae34 c11c6c04 f73176b8 f7949800 00000000 f647ae54 c1080ac5 [ 644.291969] <0> f7949800 f6451100 00000000 f6451100 f73176b8 f6452780 f647ae70 c107d1e6 [ 644.291982] Call Trace: [ 644.291991] [] ? drm_stub_open+0x8a/0xb8 [ 644.292000] [] ? chrdev_open+0xef/0x106 [ 644.292008] [] ? __dentry_open+0xd4/0x1a6 [ 644.292015] [] ? nameidata_to_filp+0x31/0x45 [ 644.292022] [] ? chrdev_open+0x0/0x106 [ 644.292030] [] ? do_last+0x346/0x423 [ 644.292037] [] ? do_filp_open+0x190/0x415 [ 644.292046] [] ? handle_mm_fault+0x214/0x710 [ 644.292053] [] ? do_sys_open+0x4d/0xe9 [ 644.292061] [] ? do_page_fault+0x211/0x23f [ 644.292068] [] ? sys_open+0x23/0x2b [ 644.292075] [] ? sysenter_do_call+0x12/0x26 [ 644.292079] Code: 89 f0 89 55 dc e8 8d 96 0a 00 8b 45 e0 8b 55 dc 83 78 04 01 75 28 8b 83 18 02 00 00 85 c0 74 0f 8b 4d ec 3b 81 ac 00 00 00 74 13 <0f> 0b eb fe 8b 4d ec 8b 81 ac 00 00 00 89 83 18 02 00 00 89 f0 [ 644.292143] EIP: [] drm_open+0x4b1/0x4e2 SS:ESP 0068:f647adfc [ 644.292175] ---[ end trace 2ddd476af89a60fa ]--- Signed-off-by: Chris Wilson Signed-off-by: Dave Airlie Signed-off-by: Greg Kroah-Hartman commit fdac43e66321f00fbc5cbaef9eace49767c92d12 Author: Alex Deucher Date: Wed Mar 10 18:33:03 2010 -0500 drm/radeon/kms: fix pal tv-out support on legacy IGP chips commit 15f7207761cfcf8f53fb6e5cacffe060478782c3 upstream. Based on ddx patch by Andrzej Hajda. Signed-off-by: Alex Deucher Signed-off-by: Dave Airlie Signed-off-by: Greg Kroah-Hartman commit 48f824862ae88412e7263eba546a570fd874b74f Author: Dave Airlie Date: Fri Mar 19 10:33:44 2010 +1000 drm/radeon/kms: don't print error on -ERESTARTSYS. commit 97f23b3d85a4d734a8584dade3a34579931c8f8d upstream. We can get this if the user moves the mouse when we are waiting to move some stuff around in the validate. Don't fail. Signed-off-by: Dave Airlie Signed-off-by: Greg Kroah-Hartman commit 7cf84e3ccb91a9e5b2c4fe25ec6a3a79f0e24f98 Author: Stefan Lippers-Hollmann Date: Tue Apr 6 23:45:38 2010 +0200 drm/radeon/kms: Fix NULL pointer dereference if memory allocation failed in a simple way > From: Pauli Nieminen > Date: Fri, 19 Mar 2010 07:44:33 +0000 > Subject: drm/radeon/kms: Fix NULL pointer dereference if memory allocation failed. > > From: Pauli Nieminen > > commit fcbc451ba1948fba967198bd150ecbd10bbb7075 upstream. > > When there is allocation failure in radeon_cs_parser_relocs parser->nrelocs > is not cleaned. This causes NULL pointer defeference in radeon_cs_parser_fini > when clean up code is trying to loop over the relocation array and free the > objects. > > Fix adds a check for a possible NULL pointer in clean up code. [...] This patch breaks compiling kernel 2.6.33 + the current stable queue: CC [M] drivers/gpu/drm/radeon/radeon_cs.o /tmp/buildd/linux-sidux-2.6-2.6.33/debian/build/source_amd64_none/drivers/gpu/drm/radeon/radeon_cs.c: In function 'radeon_cs_parser_fini': /tmp/buildd/linux-sidux-2.6-2.6.33/debian/build/source_amd64_none/drivers/gpu/drm/radeon/radeon_cs.c:200: error: implicit declaration of function 'drm_gem_object_unreference_unlocked' make[6]: *** [drivers/gpu/drm/radeon/radeon_cs.o] Error 1 as it depends on the introduction of drm_gem_object_unreference_unlocked() in: Commit: c3ae90c099bb62387507e86da7cf799850444b08 Author: Luca Barbieri AuthorDate: Tue Feb 9 05:49:11 2010 +0000 drm: introduce drm_gem_object_[handle_]unreference_unlocked This patch introduces the drm_gem_object_unreference_unlocked and drm_gem_object_handle_unreference_unlocked functions that do not require holding struct_mutex. drm_gem_object_unreference_unlocked calls the new ->gem_free_object_unlocked entry point if available, and otherwise just takes struct_mutex and just calls ->gem_free_object which in turn suggests: Commit: bc9025bdc4e2b591734cca17697093845007b63d Author: Luca Barbieri AuthorDate: Tue Feb 9 05:49:12 2010 +0000 Use drm_gem_object_[handle_]unreference_unlocked where possible Mostly obvious simplifications. The i915 pread/pwrite ioctls, intel_overlay_put_image and nouveau_gem_new were incorrectly using the locked versions without locking: this is also fixed in this patch. which don't really look like candidates for 2.6.33-stable. > --- a/drivers/gpu/drm/radeon/radeon_cs.c > +++ b/drivers/gpu/drm/radeon/radeon_cs.c > @@ -193,11 +193,13 @@ static void radeon_cs_parser_fini(struct > radeon_bo_list_fence(&parser->validated, parser->ib->fence); > } > radeon_bo_list_unreserve(&parser->validated); > - for (i = 0; i < parser->nrelocs; i++) { > - if (parser->relocs[i].gobj) { > - mutex_lock(&parser->rdev->ddev->struct_mutex); > - drm_gem_object_unreference(parser->relocs[i].gobj); > - mutex_unlock(&parser->rdev->ddev->struct_mutex); > + if (parser->relocs != NULL) { ^ the only important part, the rest merely covers the new indentation level > + for (i = 0; i < parser->nrelocs; i++) { > + if (parser->relocs[i].gobj) { > + mutex_lock(&parser->rdev->ddev->struct_mutex); > + drm_gem_object_unreference_unlocked(parser->relocs[i].gobj); ^ drm_gem_object_unreference_unlocked() doesn't exist in 2.6.33, yet we can use drm_gem_object_unreference() instead. > + mutex_unlock(&parser->rdev->ddev->struct_mutex); > + } > } > } > kfree(parser->track); As a consequence, I'd suggest to merely backport the NULL pointer check, while ignoring the simplification of using the newly introduced drm_gem_object_unreference_unlocked() from 2.6.34: Signed-off-by: Stefan Lippers-Hollmann Cc: Pauli Nieminen Cc: Dave Airlie Signed-off-by: Greg Kroah-Hartman commit f72fea6955869fa30548ee1617f51b6f4b053c88 Author: Alex Deucher Date: Sun Mar 21 14:02:25 2010 -0400 drm/radeon/kms: never treat rs4xx as AGP commit f95df9ca6896978108201a77422a1ae2cdc595ec upstream. RS4xx+ IGP chips use an internal gart, however, some of them have the agp cap bits set in their pci configs. Make sure to clear the AGP flag as AGP will not work with them. Should fix fdo bug 27225 Signed-off-by: Alex Deucher Signed-off-by: Dave Airlie Signed-off-by: Greg Kroah-Hartman commit 1628711eab4c0e5b82416b609e38e67a92006c13 Author: Oleg Nesterov Date: Thu Apr 1 15:13:57 2010 +0200 oom: fix the unsafe usage of badness() in proc_oom_score() commit b95c35e76b29ba812e5dabdd91592e25ec640e93 upstream. proc_oom_score(task) has a reference to task_struct, but that is all. If this task was already released before we take tasklist_lock - we can't use task->group_leader, it points to nowhere - it is not safe to call badness() even if this task is ->group_leader, has_intersects_mems_allowed() assumes it is safe to iterate over ->thread_group list. - even worse, badness() can hit ->signal == NULL Add the pid_alive() check to ensure __unhash_process() was not called. Also, use "task" instead of task->group_leader. badness() should return the same result for any sub-thread. Currently this is not true, but this should be changed anyway. Signed-off-by: Oleg Nesterov Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 898b5ece63b796443073f505a4403a35906f1b0b Author: Nikolaus Schulz Date: Thu Apr 1 02:21:10 2010 +0900 fat: fix buffer overflow in vfat_create_shortname() commit 30d1872d9eb3663b4cf7bdebcbf5cd465674cced upstream. When using the string representation of a random counter as part of the base name, ensure that it is no longer than 4 bytes. Since we are repeatedly decrementing the counter in a loop until we have found a unique base name, the counter may wrap around zero; therefore, it is not enough to mask its higher bits before entering the loop, this must be done inside the loop. [hirofumi@mail.parknet.co.jp: use snprintf()] Signed-off-by: Nikolaus Schulz Signed-off-by: OGAWA Hirofumi Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 5d085d89715692c6b4c918a42ee6638468544812 Author: Zhao Yakui Date: Thu Mar 4 08:25:55 2010 +0000 drm: remove the EDID blob stored in the EDID property when it is disconnected commit 725398322d05486109375fbb85c3404108881e17 upstream. Now the EDID property will be updated when the corresponding EDID can be obtained from the external display device. But after the external device is plugged-out, the EDID property is not updated. In such case we still get the corresponding EDID property although it is already detected as disconnected. https://bugs.freedesktop.org/show_bug.cgi?id=26743 Signed-off-by: Zhao Yakui Signed-off-by: Zhenyu Wang Signed-off-by: Dave Airlie Signed-off-by: Greg Kroah-Hartman commit e651edd883a9334c059615d7d829ae290a72b66c Author: Alex Deucher Date: Wed Mar 3 13:39:13 2010 -0500 drm/radeon: add new RS880 pci id commit 338e2b1d571e4873908b199c90d6a31f65137fe3 upstream. This should go to 2.6.33 stable as well. Signed-off-by: Alex Deucher Signed-off-by: Dave Airlie Signed-off-by: Greg Kroah-Hartman commit 6497174793773e9a72bc3ea6d49469c5846e9e9a Author: Ben Skeggs Date: Thu Feb 18 09:12:09 2010 +1000 drm/edid: allow certain bogus edids to hit a fixup path rather than fail commit 44fef22416886a04d432043f741a6faf2c6ffefd upstream. Signed-off-by: Ben Skeggs Signed-off-by: Dave Airlie Signed-off-by: Greg Kroah-Hartman