Mon Oct 29 23:57:39 UTC 2007

Author: cebbert

Update of /cvs/pkgs/rpms/kernel/F-7
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv15219

Modified Files:
	kernel-2.6.spec 
Added Files:
	linux-2.6-cifs-fix-bad-handling-of-EAGAIN.patch 
	linux-2.6-irq-synchronization.patch 
	linux-2.6-libata-correct-handling-of-SRST-reset-sequences.patch 
	linux-2.6-md-raid5-fix-clearing-of-biofill-operations.patch 
	linux-2.6-serial_pnp-add-new-wacom-ids.patch 
	linux-2.6-x86-tsc-calibration-1.patch 
	linux-2.6-x86-tsc-calibration-2.patch 
	linux-2.6-x86_64-fix-global_flush_tlb-bug.patch 
	linux-2.6-x86_64-revert-sparsemem-4g.patch 
Log Message:
* Mon Oct 29 2007 Chuck Ebbert <cebbert at redhat.com>
- Fix oops for some x86_64 systems with AGP (#249174, #336281)
- Properly synchronize IRQs
- CIFS: fix file corruption when server returns EAGAIN (F8 #357001)
- serial: support new Wacom pads (F8 #352811)
- libata: properly handle reset sequences
- md/raid5: fix data corruption race
- i386: TSC calibration fixes
- x86_64: fix races in TLB flushing code


linux-2.6-cifs-fix-bad-handling-of-EAGAIN.patch:

--- NEW FILE linux-2.6-cifs-fix-bad-handling-of-EAGAIN.patch ---
>From c18c732ec6bf372aa959ca6534cbfc32e464defd Mon Sep 17 00:00:00 2001
From: Steve French <sfrench at us.ibm.com>
Date: Wed, 17 Oct 2007 18:01:11 +0000
Subject: [PATCH] [CIFS] fix bad handling of EAGAIN error on kernel_recvmsg in cifs_demultiplex_thread

When kernel_recvmsg returns -EAGAIN or -ERESTARTSYS, then
cifs_demultiplex_thread sleeps for a bit and then tries the read again.
When it does this, it's not zeroing out the length and that throws off
the value of total_read. Fix it to zero out the length.

Can cause memory corruption:
If kernel_recvmsg returns an error and total_read is a large enough
value, then we'll end up going through the loop again. total_read will
be a bogus value, as will (pdu_length-total_read). When this happens we
end up calling kernel_recvmsg with a bogus value (possibly larger than
the current iov_len).

At that point, memcpy_toiovec can overrun iov. It will start walking
up the stack, casting other things that are there to struct iovecs
(since it assumes that it's been passed an array of them). Any pointer
on the stack at an address above the kvec is a candidate for corruption
here.

Many thanks to Ulrich Obergfell for pointing this out.

Signed-off-by: Jeff Layton <jlayton at redhat.com>
Signed-off-by: Steve French <sfrench at us.ibm.com>
[cebbert: removed CHANGES patch]
---
 fs/cifs/connect.c |    6 +++++-
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index 494455e..676bbf2 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -415,7 +415,10 @@ incomplete_rcv:
 			msleep(1); /* minimum sleep to prevent looping
 				allowing socket to clear and app threads to set
 				tcpStatus CifsNeedReconnect if server hung */
-			continue;
+			if (pdu_length < 4)
+				goto incomplete_rcv;
+			else
+				continue;
 		} else if (length <= 0) {
 			if (server->tcpStatus == CifsNew) {
 				cFYI(1, ("tcp session abend after SMBnegprot"));
@@ -543,6 +546,7 @@ incomplete_rcv:
 					      allowing socket to clear and app
 					      threads to set tcpStatus
 					      CifsNeedReconnect if server hung*/
+				length = 0;
 				continue;
 			} else if (length <= 0) {
 				cERROR(1, ("Received no data, expecting %d",
-- 
1.5.3.3


linux-2.6-irq-synchronization.patch:

--- NEW FILE linux-2.6-irq-synchronization.patch ---
Gitweb:     http://git.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=a98ce5c6feead6bfedefabd46cb3d7f5be148d9a
Commit:     a98ce5c6feead6bfedefabd46cb3d7f5be148d9a
Parent:     48d2268473a66fe3aa78fb13b09ee59d6ee95073
Author:     Herbert Xu <herbert at gondor.apana.org.au>
AuthorDate: Tue Oct 23 11:26:25 2007 +0800
Committer:  Linus Torvalds <torvalds at woody.linux-foundation.org>
CommitDate: Tue Oct 23 09:01:31 2007 -0700

    Fix synchronize_irq races with IRQ handler
    
    As it is some callers of synchronize_irq rely on memory barriers
    to provide synchronisation against the IRQ handlers.  For example,
    the tg3 driver does
    
    	tp->irq_sync = 1;
    	smp_mb();
    	synchronize_irq();
    
    and then in the IRQ handler:
    
    	if (!tp->irq_sync)
    		netif_rx_schedule(dev, &tp->napi);
    
    Unfortunately memory barriers only work well when they come in
    pairs.  Because we don't actually have memory barriers on the
    IRQ path, the memory barrier before the synchronize_irq() doesn't
    actually protect us.
    
    In particular, synchronize_irq() may return followed by the
    result of netif_rx_schedule being made visible.
    
    This patch (mostly written by Linus) fixes this by using spin
    locks instead of memory barries on the synchronize_irq() path.
    
    Signed-off-by: Herbert Xu <herbert at gondor.apana.org.au>
    Acked-by: Benjamin Herrenschmidt <benh at kernel.crashing.org>
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>
---
 kernel/irq/manage.c |   20 ++++++++++++++++++--
 1 files changed, 18 insertions(+), 2 deletions(-)

diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
index 80eab7a..1f31422 100644
--- a/kernel/irq/manage.c
+++ b/kernel/irq/manage.c
@@ -29,12 +29,28 @@
 void synchronize_irq(unsigned int irq)
 {
 	struct irq_desc *desc = irq_desc + irq;
+	unsigned int status;
 
 	if (irq >= NR_IRQS)
 		return;
 
-	while (desc->status & IRQ_INPROGRESS)
-		cpu_relax();
+	do {
+		unsigned long flags;
+
+		/*
+		 * Wait until we're out of the critical section.  This might
+		 * give the wrong answer due to the lack of memory barriers.
+		 */
+		while (desc->status & IRQ_INPROGRESS)
+			cpu_relax();
+
+		/* Ok, that indicated we're done: double-check carefully. */
+		spin_lock_irqsave(&desc->lock, flags);
+		status = desc->status;
+		spin_unlock_irqrestore(&desc->lock, flags);
+
+		/* Oops, that failed? */
+	} while (status & IRQ_INPROGRESS);
 }
 EXPORT_SYMBOL(synchronize_irq);
 
-

linux-2.6-libata-correct-handling-of-SRST-reset-sequences.patch:

--- NEW FILE linux-2.6-libata-correct-handling-of-SRST-reset-sequences.patch ---
Gitweb:     http://git.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=681c80b5d96076f447e8101ac4325c82d8dce508
Commit:     681c80b5d96076f447e8101ac4325c82d8dce508
Parent:     237d8440cb2b104a3b97fc971a9bce67960bb616
Author:     Alan Cox <alan at lxorguk.ukuu.org.uk>
AuthorDate: Wed Oct 3 13:23:18 2007 +0100
Committer:  Jeff Garzik <jeff at garzik.org>
CommitDate: Fri Oct 12 14:55:45 2007 -0400

    libata: correct handling of SRST reset sequences
    
    Correct handling of SRST reset sequences.  After an SRST it is undefined
    whether the drive has gone back to PIO0.  In order to talk safely we should
    talk slowly and carefully until we know.
    
    Thus when we do the reset if the controller has a pio setup method we call it
    to flip back to PIO 0 and a known state.  After the reset completes the
    identify will then be done at the safe speed and the drive/controller will
    pick suitable faster modes and reconfigure the controller to these timings.
    
    As a side effect it means we force the controller to PIO 0 as we bring it up
    which fixes funnies on a few systems where the BIOS firmware leaves us in an
    interesting choice of modes, or embedded boxes with no firmware which come up
    in random states.
    
    For smart controllers there is nothing to do - they know about this
    internally.
    
    Signed-off-by: Alan Cox <alan at redhat.com>
    Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
    Signed-off-by: Jeff Garzik <jeff at garzik.org>
---
 drivers/ata/libata-core.c |   21 +++++++++++++++++++++
 1 files changed, 21 insertions(+), 0 deletions(-)

diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 1501d63..aecbdad 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -3209,6 +3209,8 @@ static int ata_bus_softreset(struct ata_port *ap, unsigned int devmask,
 			     unsigned long deadline)
 {
 	struct ata_ioports *ioaddr = &ap->ioaddr;
+	struct ata_device *dev;
+	int i = 0;
 
 	DPRINTK("ata%u: bus reset via SRST\n", ap->print_id);
 
@@ -3219,6 +3221,25 @@ static int ata_bus_softreset(struct ata_port *ap, unsigned int devmask,
 	udelay(20);	/* FIXME: flush */
 	iowrite8(ap->ctl, ioaddr->ctl_addr);
 
+	/* If we issued an SRST then an ATA drive (not ATAPI)
+	 * may have changed configuration and be in PIO0 timing. If
+	 * we did a hard reset (or are coming from power on) this is
+	 * true for ATA or ATAPI. Until we've set a suitable controller
+	 * mode we should not touch the bus as we may be talking too fast.
+	 */
+
+	ata_link_for_each_dev(dev, &ap->link)
+		dev->pio_mode = XFER_PIO_0;
+
+	/* If the controller has a pio mode setup function then use
+	   it to set the chipset to rights. Don't touch the DMA setup
+	   as that will be dealt with when revalidating */
+	if (ap->ops->set_piomode) {
+		ata_link_for_each_dev(dev, &ap->link)
+			if (devmask & (1 << i++))
+				ap->ops->set_piomode(ap, dev);
+	}
+
 	/* spec mandates ">= 2ms" before checking status.
 	 * We wait 150ms, because that was the magic delay used for
 	 * ATAPI devices in Hale Landis's ATADRVR, for the period of time

linux-2.6-md-raid5-fix-clearing-of-biofill-operations.patch:

--- NEW FILE linux-2.6-md-raid5-fix-clearing-of-biofill-operations.patch ---
Gitweb:     http://git.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=4ae3f847e49e3787eca91bced31f8fd328d50496
Commit:     4ae3f847e49e3787eca91bced31f8fd328d50496
Parent:     85bfb4da8cad483a4e550ec89060d05a4daf895b
Author:     Dan Williams <dan.j.williams at intel.com>
AuthorDate: Mon Oct 22 20:45:11 2007 -0700
Committer:  Linus Torvalds <torvalds at woody.linux-foundation.org>
CommitDate: Tue Oct 23 08:32:06 2007 -0700

    md: raid5: fix clearing of biofill operations
    
    ops_complete_biofill() runs outside of spin_lock(&sh->lock) and clears the
    'pending' and 'ack' bits.  Since the test_and_ack_op() macro only checks
    against 'complete' it can get an inconsistent snapshot of pending work.
    
    Move the clearing of these bits to handle_stripe5(), under the lock.
    
    Signed-off-by: Dan Williams <dan.j.williams at intel.com>
    Tested-by: Joel Bertrand <joel.bertrand at systella.fr>
    Signed-off-by: Neil Brown <neilb at suse.de>
    Cc: Stable <stable at kernel.org>
    Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>
---
 drivers/md/raid5.c |   17 ++++++++++++++---
 1 files changed, 14 insertions(+), 3 deletions(-)

diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index 8ee181a..80a67d7 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -376,7 +376,12 @@ static unsigned long get_stripe_work(struct stripe_head *sh)
 		ack++;
 
 	sh->ops.count -= ack;
-	BUG_ON(sh->ops.count < 0);
+	if (unlikely(sh->ops.count < 0)) {
+		printk(KERN_ERR "pending: %#lx ops.pending: %#lx ops.ack: %#lx "
+			"ops.complete: %#lx\n", pending, sh->ops.pending,
+			sh->ops.ack, sh->ops.complete);
+		BUG();
+	}
 
 	return pending;
 }
@@ -550,8 +555,7 @@ static void ops_complete_biofill(void *stripe_head_ref)
 			}
 		}
 	}
-	clear_bit(STRIPE_OP_BIOFILL, &sh->ops.ack);
-	clear_bit(STRIPE_OP_BIOFILL, &sh->ops.pending);
+	set_bit(STRIPE_OP_BIOFILL, &sh->ops.complete);
 
 	return_io(return_bi);
 
@@ -2893,6 +2897,13 @@ static void handle_stripe6(struct stripe_head *sh, struct page *tmp_page)
 	s.expanded = test_bit(STRIPE_EXPAND_READY, &sh->state);
 	/* Now to look around and see what can be done */
 
+	/* clean-up completed biofill operations */
+	if (test_bit(STRIPE_OP_BIOFILL, &sh->ops.complete)) {
+		clear_bit(STRIPE_OP_BIOFILL, &sh->ops.pending);
+		clear_bit(STRIPE_OP_BIOFILL, &sh->ops.ack);
+		clear_bit(STRIPE_OP_BIOFILL, &sh->ops.complete);
+	}
+
 	rcu_read_lock();
 	for (i=disks; i--; ) {
 		mdk_rdev_t *rdev;
-

linux-2.6-serial_pnp-add-new-wacom-ids.patch:

--- NEW FILE linux-2.6-serial_pnp-add-new-wacom-ids.patch ---

# HG changeset patch
# User Maik Broemme <mbroemme at plusserver.de>
# Date 1192552970 25200
# Node ID 4bf08ed71375ff2b6d0c287680af52783f3f1d56
# Parent 456cc6637cbe404fdfe63e3ef16523bfdb1438b0
Add support for Wacom WACF007 and WACF008 to serial pnp driver

Notebook manufacturer seems to built a newer Wacom pen enabled tablet to
recent tablet pcs which are not recognized by the serial pnp driver.

Attached is a patch which makes the newer Wacom WACF007 and WACF008 tablets
useable with the serial driver.  The device is fully compatible with it.

Signed-off-by: Maik Broemme <mbroemme at plusserver.de>
Cc: Andrey Panin <pazke at orbita1.ru>
Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

committer: Linus Torvalds <torvalds at woody.linux-foundation.org>

--- a/drivers/serial/8250_pnp.c	Tue Oct 16 09:42:50 2007 -0700
+++ b/drivers/serial/8250_pnp.c	Tue Oct 16 09:42:50 2007 -0700
@@ -327,6 +327,8 @@ static const struct pnp_device_id pnp_de
 	{	"WACF004",		0	},
 	{	"WACF005",		0	},
 	{       "WACF006",              0       },
+	{       "WACF007",              0       },
+	{       "WACF008",              0       },
 	/* Compaq touchscreen */
 	{       "FPI2002",              0 },
 	/* Fujitsu Stylistic touchscreens */


linux-2.6-x86-tsc-calibration-1.patch:

--- NEW FILE linux-2.6-x86-tsc-calibration-1.patch ---
Gitweb:     http://git.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=edaf420fdc122e7a42326fe39274c8b8c9b19d41
Commit:     edaf420fdc122e7a42326fe39274c8b8c9b19d41
Parent:     418ccbe37f70f5021c4cd1cdcb0ce7f98d05f2dd
Author:     Dave Johnson <djohnson at sw.starentnetworks.com>
AuthorDate: Tue Oct 23 22:37:22 2007 +0200
Committer:  Thomas Gleixner <tglx at linutronix.de>
CommitDate: Tue Oct 23 22:37:22 2007 +0200

    x86: fix TSC clock source calibration error
    
    I ran into this problem on a system that was unable to obtain NTP sync
    because the clock was running very slow (over 10000ppm slow). ntpd had
    declared all of its peers 'reject' with 'peer_dist' reason.
    
    On investigation, the tsc_khz variable was significantly incorrect
    causing xtime to run slow.  After a reboot tsc_khz was correct so I
    did a reboot test to see how often the problem occurred:
    
    Test was done on a 2000 Mhz Xeon system.  Of 689 reboots, 8 of them
    had unacceptable tsc_khz values (>500ppm):
    
     range of tsc_khz  # of boots  % of boots
     ----------------  ----------  ----------
            < 1999750           0      0.000%
    1999750 - 1999800          21      3.048%
    1999800 - 1999850         166     24.128%
    1999850 - 1999900         241     35.029%
    1999900 - 1999950         211     30.669%
    1999950 - 2000000          42      6.105%
    2000000 - 2000000           0      0.000%
    2000050 - 2000100           0      0.000%
                       [...]
    2000100 - 2015000           1      0.145%  << BAD
    2015000 - 2030000           6      0.872%  << BAD
    2030000 - 2045000           1      0.145%  << BAD
    2045000 <                   0      0.000%
    
    The worst boot was 2032.577 Mhz, over 1.5% off!
    
    It appears that on rare occasions, mach_countup() is taking longer to
    complete than necessary.
    
    I suspect that this is caused by the CPU taking a periodic SMI
    interrupt right at the end of the 30ms calibration loop.  This would
    cause the loop to delay while the SMI BIOS hander runs. The resulting
    TSC value is beyond what it actually should be resulting in a higher
    tsc_khz.
    
    The below patch makes native_calculate_cpu_khz() take the best
    (shortest duration, lowest khz) run of it's 3 calibration loops.  If a
    SMI goes off causing a bad result (long duration, higher khz) it will
    be discarded.
    
    With the patch applied, 300 boots of the same system produce good
    results:
    
     range of tsc_khz  # of boots  % of boots
     ----------------  ----------  ----------
            < 1999750           0      0.000%
    1999750 - 1999800          30     10.000%
    1999800 - 1999850         166     55.333%
    1999850 - 1999900          89     29.667%
    1999900 - 1999950          15      5.000%
    1999950 <                   0      0.000%
    
    Problem was found and tested against 2.6.18.  Patch is against 2.6.22.
    
    Signed-off-by: Dave Johnson <djohnson at sw.starentnetworks.com>
    Signed-off-by: Ingo Molnar <mingo at elte.hu>
    Signed-off-by: Thomas Gleixner <tglx at linutronix.de>
---
 arch/x86/kernel/tsc_32.c |    5 ++---
 1 files changed, 2 insertions(+), 3 deletions(-)

diff --git a/arch/x86/kernel/tsc_32.c b/arch/x86/kernel/tsc_32.c
index d78444c..f04d08a 100644
--- a/arch/i386/kernel/tsc.c
+++ b/arch/i386/kernel/tsc.c
@@ -131,7 +131,7 @@ unsigned long native_calculate_cpu_khz(void)
 {
 	unsigned long long start, end;
 	unsigned long count;
-	u64 delta64;
+	u64 delta64 = (u64)ULLONG_MAX;
 	int i;
 	unsigned long flags;
 
@@ -143,6 +143,7 @@ unsigned long native_calculate_cpu_khz(void)
 		rdtscll(start);
 		mach_countup(&count);
 		rdtscll(end);
+		delta64 = min(delta64, (end - start));
 	}
 	/*
 	 * Error: ECTCNEVERSET
@@ -153,8 +154,6 @@ unsigned long native_calculate_cpu_khz(void)
 	if (count <= 1)
 		goto err;
 
-	delta64 = end - start;
-
 	/* cpu freq too fast: */
 	if (delta64 > (1ULL<<32))
 		goto err;
-

linux-2.6-x86-tsc-calibration-2.patch:

--- NEW FILE linux-2.6-x86-tsc-calibration-2.patch ---
Gitweb:     http://git.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=8c660065383976f09fbdae86c33448c8da643d4e
Commit:     8c660065383976f09fbdae86c33448c8da643d4e
Parent:     edaf420fdc122e7a42326fe39274c8b8c9b19d41
Author:     Dave Johnson <djohnson at sw.starentnetworks.com>
AuthorDate: Tue Oct 23 22:37:22 2007 +0200
Committer:  Thomas Gleixner <tglx at linutronix.de>
CommitDate: Tue Oct 23 22:37:22 2007 +0200

    x86: fix more TSC clock source calibration errors
    
    The previous patch wasn't correctly handling the 'count' variable.  If
    a CPU gave bad results on the 1st or 2nd run but good results on the
    3rd, it wouldn't do the correct thing.  No idea if any such CPU
    exists, but the patch below handles that case by discarding the bad
    runs.
    
    If a bad result (too quick, or too slow) occurs on any of the 3 runs
    it will be discarded.
    
    Also updated some comments to explain what's going on.
    
    Signed-off-by: Dave Johnson <djohnson at sw.starentnetworks.com>
    Signed-off-by: Ingo Molnar <mingo at elte.hu>
    Signed-off-by: Thomas Gleixner <tglx at linutronix.de>
---
 arch/x86/kernel/tsc_32.c |   34 ++++++++++++++++++++--------------
 1 files changed, 20 insertions(+), 14 deletions(-)

diff --git a/arch/x86/kernel/tsc_32.c b/arch/x86/kernel/tsc_32.c
index f04d08a..9ebc0da 100644
--- a/arch/i386/kernel/tsc.c
+++ b/arch/i386/kernel/tsc.c
@@ -137,31 +137,37 @@ unsigned long native_calculate_cpu_khz(void)
 
 	local_irq_save(flags);
 
-	/* run 3 times to ensure the cache is warm */
+	/* run 3 times to ensure the cache is warm and to get an accurate reading */
 	for (i = 0; i < 3; i++) {
 		mach_prepare_counter();
 		rdtscll(start);
 		mach_countup(&count);
 		rdtscll(end);
+
+		/*
+		 * Error: ECTCNEVERSET
+		 * The CTC wasn't reliable: we got a hit on the very first read,
+		 * or the CPU was so fast/slow that the quotient wouldn't fit in
+		 * 32 bits..
+		 */
+		if (count <= 1)
+			continue;
+
+		/* cpu freq too slow: */
+		if ((end - start) <= CALIBRATE_TIME_MSEC)
+			continue;
+
+		/*
+		 * We want the minimum time of all runs in case one of them
+		 * is inaccurate due to SMI or other delay
+		 */
 		delta64 = min(delta64, (end - start));
 	}
-	/*
-	 * Error: ECTCNEVERSET
-	 * The CTC wasn't reliable: we got a hit on the very first read,
-	 * or the CPU was so fast/slow that the quotient wouldn't fit in
-	 * 32 bits..
-	 */
-	if (count <= 1)
-		goto err;
 
-	/* cpu freq too fast: */
+	/* cpu freq too fast (or every run was bad): */
 	if (delta64 > (1ULL<<32))
 		goto err;
 
-	/* cpu freq too slow: */
-	if (delta64 <= CALIBRATE_TIME_MSEC)
-		goto err;
-
 	delta64 += CALIBRATE_TIME_MSEC/2; /* round for do_div */
 	do_div(delta64,CALIBRATE_TIME_MSEC);
 
-

linux-2.6-x86_64-fix-global_flush_tlb-bug.patch:

--- NEW FILE linux-2.6-x86_64-fix-global_flush_tlb-bug.patch ---
Gitweb:     http://git.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=9a24d04a3c26c223f22493492c5c9085b8773d4a
Commit:     9a24d04a3c26c223f22493492c5c9085b8773d4a
Parent:     4fa4d23fa20de67df919030c1216295664866ad7
Author:     Ingo Molnar <mingo at elte.hu>
AuthorDate: Fri Oct 19 12:19:26 2007 +0200
Committer:  Thomas Gleixner <tglx at linutronix.de>
CommitDate: Fri Oct 19 12:19:26 2007 +0200

    x86: fix global_flush_tlb() bug
    
    While we were reviewing pageattr_32/64.c for unification,
    Thomas Gleixner noticed the following serious SMP bug in
    global_flush_tlb():
    
    	down_read(&init_mm.mmap_sem);
    	list_replace_init(&deferred_pages, &l);
    	up_read(&init_mm.mmap_sem);
    
    this is SMP-unsafe because list_replace_init() done on two CPUs in
    parallel can corrupt the list.
    
    This bug has been introduced about a year ago in the 64-bit tree:
    
           commit ea7322decb974a4a3e804f96a0201e893ff88ce3
           Author: Andi Kleen <ak at suse.de>
           Date:   Thu Dec 7 02:14:05 2006 +0100
    
           [PATCH] x86-64: Speed and clean up cache flushing in change_page_attr
    
                    down_read(&init_mm.mmap_sem);
            -       dpage = xchg(&deferred_pages, NULL);
            +       list_replace_init(&deferred_pages, &l);
                    up_read(&init_mm.mmap_sem);
    
    the xchg() based version was SMP-safe, but list_replace_init() is not.
    So this "cleanup" introduced a nasty bug.
    
    why this bug never become prominent is a mystery - it can probably be
    explained with the (still) relative obscurity of the x86_64 architecture.
    
    the safe fix for now is to write-lock init_mm.mmap_sem.
    
    Signed-off-by: Ingo Molnar <mingo at elte.hu>
    Signed-off-by: Thomas Gleixner <tglx at linutronix.de>
---
 arch/x86/mm/pageattr_64.c |    9 +++++++--
 1 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/arch/x86/mm/pageattr_64.c b/arch/x86/mm/pageattr_64.c
index 8a4f65b..c7b7dfe 100644
--- a/arch/x86_64/mm/pageattr.c
+++ b/arch/x86_64/mm/pageattr.c
@@ -230,9 +230,14 @@ void global_flush_tlb(void)
 	struct page *pg, *next;
 	struct list_head l;
 
-	down_read(&init_mm.mmap_sem);
+	/*
+	 * Write-protect the semaphore, to exclude two contexts
+	 * doing a list_replace_init() call in parallel and to
+	 * exclude new additions to the deferred_pages list:
+	 */
+	down_write(&init_mm.mmap_sem);
 	list_replace_init(&deferred_pages, &l);
-	up_read(&init_mm.mmap_sem);
+	up_write(&init_mm.mmap_sem);
 
 	flush_map(&l);
 


linux-2.6-x86_64-revert-sparsemem-4g.patch:

--- NEW FILE linux-2.6-x86_64-revert-sparsemem-4g.patch ---
Reverted upstream by:
Commit:     6a22c57b8d2a62dea7280a6b2ac807a539ef0716

Revert this commit:
commit 2e1c49db4c640b35df13889b86b9d62215ade4b6
Author: Zou Nan hai <nanhai.zou at intel.com>
Date:   Fri Jun 1 00:46:28 2007 -0700

    x86_64: allocate sparsemem memmap above 4G
    
    On systems with huge amount of physical memory, VFS cache and memory memmap
    may eat all available system memory under 4G, then the system may fail to
    allocate swiotlb bounce buffer.
    
    There was a fix for this issue in arch/x86_64/mm/numa.c, but that fix dose
    not cover sparsemem model.
    
    This patch add fix to sparsemem model by first try to allocate memmap above
    4G.
    
    Signed-off-by: Zou Nan hai <nanhai.zou at intel.com>
    Acked-by: Suresh Siddha <suresh.b.siddha at intel.com>
    Cc: Andi Kleen <ak at suse.de>
    Cc: <stable at kernel.org>
    Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

diff --git a/arch/x86_64/mm/init.c b/arch/x86_64/mm/init.c
index 458893b..e2d6bad 100644
--- a/arch/x86_64/mm/init.c
+++ b/arch/x86_64/mm/init.c
@@ -734,12 +734,6 @@ int in_gate_area_no_task(unsigned long addr)
 	return (addr >= VSYSCALL_START) && (addr < VSYSCALL_END);
 }
 
-void * __init alloc_bootmem_high_node(pg_data_t *pgdat, unsigned long size)
-{
-	return __alloc_bootmem_core(pgdat->bdata, size,
-			SMP_CACHE_BYTES, (4UL*1024*1024*1024), 0);
-}
-
 const char *arch_vma_name(struct vm_area_struct *vma)
 {
 	if (vma->vm_mm && vma->vm_start == (long)vma->vm_mm->context.vdso)
diff --git a/include/linux/bootmem.h b/include/linux/bootmem.h
index c83534e..0365ec9 100644
--- a/include/linux/bootmem.h
+++ b/include/linux/bootmem.h
@@ -59,7 +59,6 @@ extern void *__alloc_bootmem_core(struct bootmem_data *bdata,
 				  unsigned long align,
 				  unsigned long goal,
 				  unsigned long limit);
-extern void *alloc_bootmem_high_node(pg_data_t *pgdat, unsigned long size);
 
 #ifndef CONFIG_HAVE_ARCH_BOOTMEM_NODE
 extern void reserve_bootmem(unsigned long addr, unsigned long size);
diff --git a/mm/sparse.c b/mm/sparse.c
index 239f5a7..1facdff 100644
--- a/mm/sparse.c
+++ b/mm/sparse.c
@@ -215,12 +215,6 @@ static int __meminit sparse_init_one_section(struct mem_section *ms,
 	return 1;
 }
 
-__attribute__((weak)) __init
-void *alloc_bootmem_high_node(pg_data_t *pgdat, unsigned long size)
-{
-	return NULL;
-}
-
 static struct page __init *sparse_early_mem_map_alloc(unsigned long pnum)
 {
 	struct page *map;
@@ -231,11 +225,6 @@ static struct page __init *sparse_early_mem_map_alloc(unsigned long pnum)
 	if (map)
 		return map;
 
-  	map = alloc_bootmem_high_node(NODE_DATA(nid),
-                       sizeof(struct page) * PAGES_PER_SECTION);
-	if (map)
-		return map;
-
 	map = alloc_bootmem_node(NODE_DATA(nid),
 			sizeof(struct page) * PAGES_PER_SECTION);
 	if (map)


Index: kernel-2.6.spec
===================================================================
RCS file: /cvs/pkgs/rpms/kernel/F-7/kernel-2.6.spec,v
retrieving revision 1.3365
retrieving revision 1.3366
diff -u -r1.3365 -r1.3366
--- kernel-2.6.spec	29 Oct 2007 20:52:39 -0000	1.3365
+++ kernel-2.6.spec	29 Oct 2007 23:57:05 -0000	1.3366
@@ -522,7 +522,13 @@
 Patch26: linux-2.6-utrace-ptrace-compat-avr32.patch
 #Patch20: nouveau-drm.patch
 Patch30: linux-2.6-sysrq-c.patch
-Patch40: linux-2.6-x86-tune-generic.patch
+
+Patch50: linux-2.6-x86_64-revert-sparsemem-4g.patch
+Patch51: linux-2.6-x86_64-fix-global_flush_tlb-bug.patch
+
+Patch70: linux-2.6-x86-tune-generic.patch
+Patch71: linux-2.6-x86-tsc-calibration-1.patch
+Patch72: linux-2.6-x86-tsc-calibration-2.patch
 
 Patch100: linux-2.6-g5-therm-shutdown.patch
 Patch120: linux-2.6-ppc32-ucmpdi2.patch
@@ -538,6 +544,7 @@
 Patch210: linux-2.6-modsign-ksign.patch
 Patch220: linux-2.6-modsign-core.patch
 Patch230: linux-2.6-modsign-script.patch
+
 Patch250: linux-2.6-debug-sizeof-structs.patch
 Patch260: linux-2.6-debug-nmi-timeout.patch
 Patch270: linux-2.6-debug-taint-vm.patch
@@ -547,32 +554,39 @@
 Patch350: linux-2.6-devmem.patch
 Patch370: linux-2.6-crash-driver.patch
 
+Patch380: linux-2.6-irq-synchronization.patch
+
 Patch400: linux-2.6-scsi-cpqarray-set-master.patch
 Patch401: linux-2.6-scsi-async-double-add.patch
 Patch404: linux-2.6-scsi-mpt-vmware-fix.patch
 
 Patch420: linux-2.6-squashfs.patch
 Patch423: linux-2.6-gfs-locking-exports.patch
+Patch428: linux-2.6-cifs-fix-bad-handling-of-EAGAIN.patch
 
 Patch430: linux-2.6-net-silence-noisy-printks.patch
 
 Patch440: linux-2.6-sha_alignment.patch
 Patch450: linux-2.6-input-kill-stupid-messages.patch
 Patch460: linux-2.6-serial-460800.patch
+Patch461: linux-2.6-serial_pnp-add-new-wacom-ids.patch
 Patch480: linux-2.6-proc-self-maps-fix.patch
 Patch510: linux-2.6-silence-noise.patch
 Patch570: linux-2.6-selinux-mprotect-checks.patch
 Patch590: linux-2.6-unexport-symbols.patch
+
 Patch600: linux-2.6-vm-silence-atomic-alloc-failures.patch
 Patch601: linux-2.6-input-ff-create-limit-memory.patch
+
 Patch610: linux-2.6-defaults-fat-utf8.patch
 Patch620: linux-2.6-defaults-unicode-vt.patch
 Patch630: linux-2.6-defaults-nonmi.patch
 
 Patch660: linux-2.6-libata-ali-atapi-dma.patch
-Patch663: linux-2.6-ata-quirk.patch
-Patch672: linux-2.6-libata-add-dma-disable-option.patch
-Patch676: linux-2.6-ppc-pegasos-via-ata-legacy-irq.patch
+Patch662: linux-2.6-ata-quirk.patch
+Patch664: linux-2.6-libata-add-dma-disable-option.patch
+Patch666: linux-2.6-ppc-pegasos-via-ata-legacy-irq.patch
+Patch668: linux-2.6-libata-correct-handling-of-SRST-reset-sequences.patch
 
 Patch680: linux-2.6-wireless.patch
 Patch682: linux-2.6-bcm43xx-pci-neuter.patch
@@ -608,7 +622,7 @@
 Patch800: linux-2.6-wakeups-hdaps.patch
 Patch801: linux-2.6-wakeups.patch
 
-Patch1021: linux-2.6-usb-suspend-classes.patch
+Patch900: linux-2.6-md-raid5-fix-clearing-of-biofill-operations.patch
 
 # PS3 updates from 2.6.23
 
@@ -1093,16 +1107,22 @@
 # Some USB devices don't work after auto-suspend, disable by default.
 ApplyPatch linux-2.6-usb-suspend-classes.patch
 
-# Nouveau DRM
-#ApplyPatch nouveau-drm.patch
-
 # enable sysrq-c on all kernels, not only kexec
 ApplyPatch linux-2.6-sysrq-c.patch
 
 # Architecture patches
 # x86(-64)
+# fixes oops on boot with AGP
+ApplyPatch linux-2.6-x86_64-revert-sparsemem-4g.patch
+# fix race in tlb flushing
+ApplyPatch linux-2.6-x86_64-fix-global_flush_tlb-bug.patch
+
 # Compile 686 kernels tuned for Pentium4.
 ApplyPatch linux-2.6-x86-tune-generic.patch
+# fix tsc calibration
+ApplyPatch linux-2.6-x86-tsc-calibration-1.patch
+ApplyPatch linux-2.6-x86-tsc-calibration-2.patch
+
 # add vidfail capability;
 # without this patch specifying a framebuffer on the kernel prompt would
 # make the boot stop if there's no supported framebuffer device; this is bad
@@ -1138,7 +1158,6 @@
 #
 # bugfixes to drivers and filesystems
 #
-
 # Various low-impact patches to aid debugging.
 ApplyPatch linux-2.6-debug-sizeof-structs.patch
 ApplyPatch linux-2.6-debug-nmi-timeout.patch
@@ -1165,7 +1184,7 @@
 #
 # driver core
 #
-
+ApplyPatch linux-2.6-irq-synchronization.patch
 #
 # SCSI Bits.
 #
@@ -1182,6 +1201,8 @@
 # gfs2 update
 # export symbols for gfs2 locking modules
 ApplyPatch linux-2.6-gfs-locking-exports.patch
+# CIFS
+ApplyPatch linux-2.6-cifs-fix-bad-handling-of-EAGAIN.patch
 
 # Networking
 # Disable easy to trigger printk's.
@@ -1194,6 +1215,8 @@
 ApplyPatch linux-2.6-input-kill-stupid-messages.patch
 # Allow to use 480600 baud on 16C950 UARTs
 ApplyPatch linux-2.6-serial-460800.patch
+# support new wacom pads
+ApplyPatch linux-2.6-serial_pnp-add-new-wacom-ids.patch
 # Silence some useless messages that still get printed with 'quiet'
 ApplyPatch linux-2.6-silence-noise.patch
 
@@ -1228,6 +1251,8 @@
 ApplyPatch linux-2.6-libata-add-dma-disable-option.patch
 # fix Pegasos libata glitches
 ApplyPatch linux-2.6-ppc-pegasos-via-ata-legacy-irq.patch
+# fix reset sequences
+ApplyPatch linux-2.6-libata-correct-handling-of-SRST-reset-sequences.patch
 
 # post-2.6.23 wireless patches from upstream
 ApplyPatch linux-2.6-wireless.patch
@@ -1285,6 +1310,10 @@
 ApplyPatch linux-2.6-wakeups-hdaps.patch
 ApplyPatch linux-2.6-wakeups.patch
 
+# dm / md
+# raid5 data corruption fix
+ApplyPatch linux-2.6-md-raid5-fix-clearing-of-biofill-operations.patch
+
 # Pending PS3 patches
 ApplyPatch linux-2.6-ps3-gelic-wireless.patch
 # Temporary hacks
@@ -2223,6 +2252,16 @@
 
 %changelog
 * Mon Oct 29 2007 Chuck Ebbert <cebbert at redhat.com>
+- Fix oops for some x86_64 systems with AGP (#249174, #336281)
+- Properly synchronize IRQs
+- CIFS: fix file corruption when server returns EAGAIN (F8 #357001)
+- serial: support new Wacom pads (F8 #352811)
+- libata: properly handle reset sequences
+- md/raid5: fix data corruption race
+- i386: TSC calibration fixes
+- x86_64: fix races in TLB flushing code
+
+* Mon Oct 29 2007 Chuck Ebbert <cebbert at redhat.com>
 - Enable hamradio drivers.
 
 * Wed Oct 24 2007 Roland McGrath <roland at redhat.com>


