2.6.34.7-58.fc13

6 files changed, 347 insertions, 2 deletions

diff --git a/freed-ora/current/f13/agp-intel-use-the-correct-mask-to-detect-i830-aperture-size.patch b/freed-ora/current/f13/agp-intel-use-the-correct-mask-to-detect-i830-aperture-size.patch
new file mode 100644
index 000000000..0850df6ba
--- /dev/null
+++ b/freed-ora/current/f13/agp-intel-use-the-correct-mask-to-detect-i830-aperture-size.patch
@@ -0,0 +1,62 @@
+From: Tim Gardner <tim.gardner@canonical.com>
+Date: Fri, 9 Jul 2010 20:48:50 +0000 (-0600)
+Subject: agp/intel: Use the correct mask to detect i830 aperture size.
+X-Git-Tag: v2.6.35~33^2~4
+X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Ftorvalds%2Flinux-2.6.git;a=commitdiff_plain;h=e7b96f28c58ca09f15f6c2e8ccbb889a30fab4f7
+
+agp/intel: Use the correct mask to detect i830 aperture size.
+
+BugLink: https://bugs.launchpad.net/bugs/597075
+
+commit f1befe71fa7a79ab733011b045639d8d809924ad introduced a
+regression when detecting aperture size of some i915 adapters, e.g.,
+those on the Intel Q35 chipset.
+
+The original report: https://bugzilla.kernel.org/show_bug.cgi?id=15733
+The regression report: https://bugzilla.kernel.org/show_bug.cgi?id=16294
+
+According to the specification found at
+http://intellinuxgraphics.org/VOL_1_graphics_core.pdf, the PCI config
+space register I830_GMCH_CTRL is a mirror of GMCH Graphics
+Control. The correct macro for isolating the aperture size bits is
+therefore I830_GMCH_GMS_MASK along with the attendant changes to the
+case statement.
+
+Signed-off-by: Tim Gardner <tim.gardner@canonical.com>
+Tested-by: Kees Cook <kees.cook@canonical.com>
+Cc: Chris Wilson <chris@chris-wilson.co.uk>
+Cc: Eric Anholt <eric@anholt.net>
+Cc: Jesse Barnes <jbarnes@virtuousgeek.org>
+Signed-off-by: Eric Anholt <eric@anholt.net>
+---
+
+diff --git a/drivers/char/agp/intel-gtt.c b/drivers/char/agp/intel-gtt.c
+index 9344216..a754715 100644
+--- a/drivers/char/agp/intel-gtt.c
++++ b/drivers/char/agp/intel-gtt.c
+@@ -1216,17 +1216,20 @@ static int intel_i915_get_gtt_size(void)
+ 
+ 		/* G33's GTT size defined in gmch_ctrl */
+ 		pci_read_config_word(agp_bridge->dev, I830_GMCH_CTRL, &gmch_ctrl);
+-		switch (gmch_ctrl & G33_PGETBL_SIZE_MASK) {
+-		case G33_PGETBL_SIZE_1M:
++		switch (gmch_ctrl & I830_GMCH_GMS_MASK) {
++		case I830_GMCH_GMS_STOLEN_512:
++			size = 512;
++			break;
++		case I830_GMCH_GMS_STOLEN_1024:
+ 			size = 1024;
+ 			break;
+-		case G33_PGETBL_SIZE_2M:
+-			size = 2048;
++		case I830_GMCH_GMS_STOLEN_8192:
++			size = 8*1024;
+ 			break;
+ 		default:
+ 			dev_info(&agp_bridge->dev->dev,
+ 				 "unknown page table size 0x%x, assuming 512KB\n",
+-				(gmch_ctrl & G33_PGETBL_SIZE_MASK));
++				(gmch_ctrl & I830_GMCH_GMS_MASK));
+ 			size = 512;
+ 		}
+ 	} else {
diff --git a/freed-ora/current/f13/drm-nouveau-pusher-intr.patch b/freed-ora/current/f13/drm-nouveau-pusher-intr.patch
new file mode 100644
index 000000000..a2eff995e
--- /dev/null
+++ b/freed-ora/current/f13/drm-nouveau-pusher-intr.patch
@@ -0,0 +1,78 @@
+From ef0744eff71f519db7641313d1588289f5cb49d2 Mon Sep 17 00:00:00 2001
+From: Ben Skeggs <bskeggs@redhat.com>
+Date: Wed, 8 Sep 2010 15:40:30 +1000
+Subject: [PATCH] drm/nouveau: handle fifo pusher errors better
+
+The most important part of this change is that we now instruct PFIFO to
+drop all pending fetches, rather than attempting to skip a single dword
+and hope that things would magically sort themselves out - they usually
+don't, and we end up with PFIFO being completely hung.
+
+This commit also adds somewhat more useful logging when these exceptions
+occur.
+
+Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
+---
+ drivers/gpu/drm/nouveau/nouveau_irq.c |   45 +++++++++++++++++++++++++++------
+ 1 files changed, 37 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/gpu/drm/nouveau/nouveau_irq.c b/drivers/gpu/drm/nouveau/nouveau_irq.c
+index 53360f1..a0f31e4 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_irq.c
++++ b/drivers/gpu/drm/nouveau/nouveau_irq.c
+@@ -200,16 +200,45 @@ nouveau_fifo_irq_handler(struct drm_device *dev)
+		}
+
+		if (status & NV_PFIFO_INTR_DMA_PUSHER) {
+-			NV_INFO(dev, "PFIFO_DMA_PUSHER - Ch %d\n", chid);
++			u32 get = nv_rd32(dev, 0x003244);
++			u32 put = nv_rd32(dev, 0x003240);
++			u32 push = nv_rd32(dev, 0x003220);
++			u32 state = nv_rd32(dev, 0x003228);
++
++			if (dev_priv->card_type == NV_50) {
++				u32 ho_get = nv_rd32(dev, 0x003328);
++				u32 ho_put = nv_rd32(dev, 0x003320);
++				u32 ib_get = nv_rd32(dev, 0x003334);
++				u32 ib_put = nv_rd32(dev, 0x003330);
++
++				NV_INFO(dev, "PFIFO_DMA_PUSHER - Ch %d Get 0x%02x%08x "
++					     "Put 0x%02x%08x IbGet 0x%08x IbPut 0x%08x "
++					     "State 0x%08x Push 0x%08x\n",
++					chid, ho_get, get, ho_put, put, ib_get, ib_put,
++					state, push);
++
++				/* METHOD_COUNT, in DMA_STATE on earlier chipsets */
++				nv_wr32(dev, 0x003364, 0x00000000);
++				if (get != put || ho_get != ho_put) {
++					nv_wr32(dev, 0x003244, put);
++					nv_wr32(dev, 0x003328, ho_put);
++				} else
++				if (ib_get != ib_put) {
++					nv_wr32(dev, 0x003334, ib_put);
++				}
++			} else {
++				NV_INFO(dev, "PFIFO_DMA_PUSHER - Ch %d Get 0x%08x "
++					     "Put 0x%08x State 0x%08x Push 0x%08x\n",
++					chid, get, put, state, push);
+
+-			status &= ~NV_PFIFO_INTR_DMA_PUSHER;
+-			nv_wr32(dev, NV03_PFIFO_INTR_0,
+-						NV_PFIFO_INTR_DMA_PUSHER);
++				if (get != put)
++					nv_wr32(dev, 0x003244, put);
++			}
+
+-			nv_wr32(dev, NV04_PFIFO_CACHE1_DMA_STATE, 0x00000000);
+-			if (nv_rd32(dev, NV04_PFIFO_CACHE1_DMA_PUT) != get)
+-				nv_wr32(dev, NV04_PFIFO_CACHE1_DMA_GET,
+-								get + 4);
++			nv_wr32(dev, 0x003228, 0x00000000);
++			nv_wr32(dev, 0x003220, 0x00000001);
++			nv_wr32(dev, 0x002100, NV_PFIFO_INTR_DMA_PUSHER);
++			status &= ~NV_PFIFO_INTR_DMA_PUSHER;
+		}
+
+		if (status & NV_PFIFO_INTR_SEMAPHORE) {
+--
+1.7.2.2
diff --git a/freed-ora/current/f13/kernel.spec b/freed-ora/current/f13/kernel.spec
index 5200069af..eb820a5fb 100644
--- a/freed-ora/current/f13/kernel.spec
+++ b/freed-ora/current/f13/kernel.spec
@@ -48,7 +48,7 @@ Summary: The Linux kernel
 # reset this by hand to 1 (or to 0 and then use rpmdev-bumpspec).
 # scripts/rebase.sh should be made to do that for you, actually.
 #
-%global baserelease 56
+%global baserelease 58
 %global fedora_build %{baserelease}
 
 # base_sublevel is the kernel version we're starting with and patching
@@ -737,6 +737,8 @@ Patch1826: drm-radeon-resume-fixes.patch
 Patch1830: drm-i915-explosion-following-oom-in-do_execbuffer.patch
 Patch1900: linux-2.6-intel-iommu-igfx.patch
 Patch1901: drm-nouveau-acpi-edid-fix.patch
+Patch1902: agp-intel-use-the-correct-mask-to-detect-i830-aperture-size.patch
+Patch1903: drm-nouveau-pusher-intr.patch
 # radeon
 
 # linux1394 git patches
@@ -832,6 +834,12 @@ Patch12550: alsa-seq-oss-fix-double-free-at-error-path-of-snd_seq_oss_open.patch
 # CVE-2010-3079
 Patch12560: tracing-do-not-allow-llseek-to-set_ftrace_filter.patch
 
+Patch12570: sched-00-fix-user-time-incorrectly-accounted-as-system-time-on-32-bit.patch
+
+# bz 636534
+Patch12580: xen-handle-events-as-edge-triggered.patch
+Patch12581: xen-use-percpu-interrupts-for-ipis-and-virqs.patch
+
 %endif
 
 BuildRoot: %{_tmppath}/kernel-%{KVERREL}-root
@@ -1449,11 +1457,14 @@ ApplyPatch drm-nouveau-race-fix.patch
 ApplyPatch drm-nouveau-nva3-noaccel.patch
 ApplyPatch drm-nouveau-nv50-crtc-update-delay.patch
 ApplyPatch drm-nouveau-acpi-edid-fix.patch
+ApplyPatch drm-nouveau-pusher-intr.patch
 
 ApplyPatch drm-intel-big-hammer.patch
 ApplyOptionalPatch drm-intel-next.patch
 ApplyPatch drm-intel-make-lvds-work.patch
 ApplyPatch drm-i915-explosion-following-oom-in-do_execbuffer.patch
+# broken in 2.6.35-rc2, fixed in 2.6.35, but our drm-next snapshot has the bug
+ApplyPatch agp-intel-use-the-correct-mask-to-detect-i830-aperture-size.patch
 
 ApplyPatch drm-radeon-resume-fixes.patch
 ApplyPatch linux-2.6-intel-iommu-igfx.patch
@@ -1575,6 +1586,13 @@ ApplyPatch alsa-seq-oss-fix-double-free-at-error-path-of-snd_seq_oss_open.patch
 # CVE-2010-3079
 ApplyPatch tracing-do-not-allow-llseek-to-set_ftrace_filter.patch
 
+# BZ 633037
+ApplyPatch sched-00-fix-user-time-incorrectly-accounted-as-system-time-on-32-bit.patch
+
+# BZ 636534
+ApplyPatch xen-handle-events-as-edge-triggered.patch
+ApplyPatch xen-use-percpu-interrupts-for-ipis-and-virqs.patch
+
 # END OF PATCH APPLICATIONS
 
 %endif
@@ -2196,6 +2214,21 @@ fi
 
 
 %changelog
+* Mon Sep 27 2010 Ben Skeggs <bskeggs@redhat.com> 2.6.34.7-58
+- nouveau: better handling of certain GPU errors
+
+* Fri Sep 24 2010 Chuck Ebbert <cebbert@redhat.com>
+- Fix typo in previous Xen fix that causes boot failure.
+
+* Wed Sep 22 2010 Chuck Ebbert <cebbert@redhat.com>
+- Copy two Xen fixes from 2.6.35-stable for RHBZ#636534
+
+* Tue Sep 21 2010 Chuck Ebbert <cebbert@redhat.com>
+- Fix RHBZ #633037, Process user time incorrectly accounted as system time
+
+* Mon Sep 20 2010 Chuck Ebbert <cebbert@redhat.com>
+- Fix AGP aperture size detection on Intel G33/Q35 chipsets (#629203)
+
 * Thu Sep 16 2010 Alexandre Oliva <lxoliva@fsfla.org> -libre
 - Adjusted patch-libre-2.6.34.7.
 
@@ -2216,7 +2249,7 @@ fi
   upgrading is highly recommended.
 - aio: check for multiplication overflow in do_io_submit. (CVE-2010-3067)
 
-* Tue Sep 14 2010 Chuck Ebbert <cebbert@redhat.com> 2.6.34.7-56
+* Tue Sep 14 2010 Chuck Ebbert <cebbert@redhat.com>
 - Linux 2.6.34.7, should fix multiple USB HID device issues.
 
 * Mon Sep 13 2010 Ben Skeggs <bskeggs@redhat.com> 2.6.34.6-55
diff --git a/freed-ora/current/f13/sched-00-fix-user-time-incorrectly-accounted-as-system-time-on-32-bit.patch b/freed-ora/current/f13/sched-00-fix-user-time-incorrectly-accounted-as-system-time-on-32-bit.patch
new file mode 100644
index 000000000..7c1512201
--- /dev/null
+++ b/freed-ora/current/f13/sched-00-fix-user-time-incorrectly-accounted-as-system-time-on-32-bit.patch
@@ -0,0 +1,55 @@
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+Date: Tue, 14 Sep 2010 14:35:14 +0000 (+0200)
+Subject: sched: Fix user time incorrectly accounted as system time on 32-bit
+X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Fx86%2Flinux-2.6-tip.git;a=commitdiff_plain;h=e75e863dd5c7d96b91ebbd241da5328fc38a78cc
+
+sched: Fix user time incorrectly accounted as system time on 32-bit
+
+We have 32-bit variable overflow possibility when multiply in
+task_times() and thread_group_times() functions. When the
+overflow happens then the scaled utime value becomes erroneously
+small and the scaled stime becomes i erroneously big.
+
+Reported here:
+
+ https://bugzilla.redhat.com/show_bug.cgi?id=633037
+ https://bugzilla.kernel.org/show_bug.cgi?id=16559
+
+Reported-by: Michael Chapman <redhat-bugzilla@very.puzzling.org>
+Reported-by: Ciriaco Garcia de Celis <sysman@etherpilot.com>
+Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
+Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
+Cc: Hidetoshi Seto <seto.hidetoshi@jp.fujitsu.com>
+Cc: <stable@kernel.org>  # 2.6.32.19+ (partially) and 2.6.33+
+LKML-Reference: <20100914143513.GB8415@redhat.com>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+---
+
+diff --git a/kernel/sched.c b/kernel/sched.c
+index ed09d4f..dc85ceb 100644
+--- a/kernel/sched.c
++++ b/kernel/sched.c
+@@ -3513,9 +3513,9 @@ void task_times(struct task_struct *p, cputime_t *ut, cputime_t *st)
+ 	rtime = nsecs_to_cputime(p->se.sum_exec_runtime);
+ 
+ 	if (total) {
+-		u64 temp;
++		u64 temp = rtime;
+ 
+-		temp = (u64)(rtime * utime);
++		temp *= utime;
+ 		do_div(temp, total);
+ 		utime = (cputime_t)temp;
+ 	} else
+@@ -3546,9 +3546,9 @@ void thread_group_times(struct task_struct *p, cputime_t *ut, cputime_t *st)
+ 	rtime = nsecs_to_cputime(cputime.sum_exec_runtime);
+ 
+ 	if (total) {
+-		u64 temp;
++		u64 temp = rtime;
+ 
+-		temp = (u64)(rtime * cputime.utime);
++		temp *= cputime.utime;
+ 		do_div(temp, total);
+ 		utime = (cputime_t)temp;
+ 	} else
diff --git a/freed-ora/current/f13/xen-handle-events-as-edge-triggered.patch b/freed-ora/current/f13/xen-handle-events-as-edge-triggered.patch
new file mode 100644
index 000000000..dd06bbfb8
--- /dev/null
+++ b/freed-ora/current/f13/xen-handle-events-as-edge-triggered.patch
@@ -0,0 +1,44 @@
+From dffe2e1e1a1ddb566a76266136c312801c66dcf7 Mon Sep 17 00:00:00 2001
+From: Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
+Date: Fri, 20 Aug 2010 19:10:01 -0700
+Subject: xen: handle events as edge-triggered
+
+From: Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
+
+commit dffe2e1e1a1ddb566a76266136c312801c66dcf7 upstream.
+
+Xen events are logically edge triggered, as Xen only calls the event
+upcall when an event is newly set, but not continuously as it remains set.
+As a result, use handle_edge_irq rather than handle_level_irq.
+
+This has the important side-effect of fixing a long-standing bug of
+events getting lost if:
+ - an event's interrupt handler is running
+ - the event is migrated to a different vcpu
+ - the event is re-triggered
+
+The most noticable symptom of these lost events is occasional lockups
+of blkfront.
+
+Many thanks to Tom Kopec and Daniel Stodden in tracking this down.
+
+Signed-off-by: Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
+Cc: Tom Kopec <tek@acm.org>
+Cc: Daniel Stodden <daniel.stodden@citrix.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/xen/events.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/xen/events.c
++++ b/drivers/xen/events.c
+@@ -363,7 +363,7 @@ int bind_evtchn_to_irq(unsigned int evtc
+ 		irq = find_unbound_irq();
+ 
+ 		set_irq_chip_and_handler_name(irq, &xen_dynamic_chip,
+-					      handle_level_irq, "event");
++					      handle_edge_irq, "event");
+ 
+ 		evtchn_to_irq[evtchn] = irq;
+ 		irq_info[irq] = mk_evtchn_info(evtchn);
diff --git a/freed-ora/current/f13/xen-use-percpu-interrupts-for-ipis-and-virqs.patch b/freed-ora/current/f13/xen-use-percpu-interrupts-for-ipis-and-virqs.patch
new file mode 100644
index 000000000..742a46545
--- /dev/null
+++ b/freed-ora/current/f13/xen-use-percpu-interrupts-for-ipis-and-virqs.patch
@@ -0,0 +1,73 @@
+From aaca49642b92c8a57d3ca5029a5a94019c7af69f Mon Sep 17 00:00:00 2001
+From: Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
+Date: Fri, 20 Aug 2010 18:57:53 -0700
+Subject: xen: use percpu interrupts for IPIs and VIRQs
+
+From: Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
+
+commit aaca49642b92c8a57d3ca5029a5a94019c7af69f upstream.
+
+IPIs and VIRQs are inherently per-cpu event types, so treat them as such:
+ - use a specific percpu irq_chip implementation, and
+ - handle them with handle_percpu_irq
+
+This makes the path for delivering these interrupts more efficient
+(no masking/unmasking, no locks), and it avoid problems with attempts
+to migrate them.
+
+Signed-off-by: Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/xen/events.c |   19 +++++++++++++++----
+ 1 file changed, 15 insertions(+), 4 deletions(-)
+
+--- a/drivers/xen/events.c
++++ b/drivers/xen/events.c
+@@ -107,6 +107,7 @@ static inline unsigned long *cpu_evtchn_
+ #define VALID_EVTCHN(chn)	((chn) != 0)
+ 
+ static struct irq_chip xen_dynamic_chip;
++static struct irq_chip xen_percpu_chip;
+ 
+ /* Constructor for packed IRQ information. */
+ static struct irq_info mk_unbound_info(void)
+@@ -389,8 +390,8 @@ static int bind_ipi_to_irq(unsigned int
+ 		if (irq < 0)
+ 			goto out;
+ 
+-		set_irq_chip_and_handler_name(irq, &xen_dynamic_chip,
+-					      handle_level_irq, "ipi");
++		set_irq_chip_and_handler_name(irq, &xen_percpu_chip,
++					      handle_percpu_irq, "ipi");
+ 
+ 		bind_ipi.vcpu = cpu;
+ 		if (HYPERVISOR_event_channel_op(EVTCHNOP_bind_ipi,
+@@ -430,8 +431,8 @@ static int bind_virq_to_irq(unsigned int
+ 
+ 		irq = find_unbound_irq();
+ 
+-		set_irq_chip_and_handler_name(irq, &xen_dynamic_chip,
+-					      handle_level_irq, "virq");
++		set_irq_chip_and_handler_name(irq, &xen_percpu_chip,
++					      handle_percpu_irq, "virq");
+ 
+ 		evtchn_to_irq[evtchn] = irq;
+ 		irq_info[irq] = mk_virq_info(evtchn, virq);
+@@ -934,6 +935,16 @@ static struct irq_chip xen_dynamic_chip
+ 	.retrigger	= retrigger_dynirq,
+ };
+ 
++static struct irq_chip xen_percpu_chip __read_mostly = {
++	.name		= "xen-percpu",
++
++	.disable	= disable_dynirq,
++	.mask		= disable_dynirq,
++	.unmask		= enable_dynirq,
++
++	.ack		= ack_dynirq,
++};
++
+ void __init xen_init_IRQ(void)
+ {
+ 	int i;