--- /dev/null
+From gregkh@mini.kroah.org Fri Nov 6 14:15:38 2009
+Message-Id: <20091106221538.846686350@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Fri, 06 Nov 2009 14:13:59 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Earl Chew <earl_chew@agilent.com>
+Subject: [01/99] fs: pipe.c null pointer dereference
+References: <20091106221358.309857998@mini.kroah.org>
+Content-Disposition: inline; filename=fs-pipe.c-null-pointer-dereference.patch
+Content-Length: 3550
+Lines: 131
+
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Earl Chew <earl_chew@agilent.com>
+
+commit ad3960243e55320d74195fb85c975e0a8cc4466c upstream.
+
+This patch fixes a null pointer exception in pipe_rdwr_open() which
+generates the stack trace:
+
+> Unable to handle kernel NULL pointer dereference at 0000000000000028 RIP:
+> [<ffffffff802899a5>] pipe_rdwr_open+0x35/0x70
+> [<ffffffff8028125c>] __dentry_open+0x13c/0x230
+> [<ffffffff8028143d>] do_filp_open+0x2d/0x40
+> [<ffffffff802814aa>] do_sys_open+0x5a/0x100
+> [<ffffffff8021faf3>] sysenter_do_call+0x1b/0x67
+
+The failure mode is triggered by an attempt to open an anonymous
+pipe via /proc/pid/fd/* as exemplified by this script:
+
+=============================================================
+while : ; do
+ { echo y ; sleep 1 ; } | { while read ; do echo z$REPLY; done ; } &
+ PID=$!
+ OUT=$(ps -efl | grep 'sleep 1' | grep -v grep |
+ { read PID REST ; echo $PID; } )
+ OUT="${OUT%% *}"
+ DELAY=$((RANDOM * 1000 / 32768))
+ usleep $((DELAY * 1000 + RANDOM % 1000 ))
+ echo n > /proc/$OUT/fd/1 # Trigger defect
+done
+=============================================================
+
+Note that the failure window is quite small and I could only
+reliably reproduce the defect by inserting a small delay
+in pipe_rdwr_open(). For example:
+
+ static int
+ pipe_rdwr_open(struct inode *inode, struct file *filp)
+ {
+ msleep(100);
+ mutex_lock(&inode->i_mutex);
+
+Although the defect was observed in pipe_rdwr_open(), I think it
+makes sense to replicate the change through all the pipe_*_open()
+functions.
+
+The core of the change is to verify that inode->i_pipe has not
+been released before attempting to manipulate it. If inode->i_pipe
+is no longer present, return ENOENT to indicate so.
+
+The comment about potentially using atomic_t for i_pipe->readers
+and i_pipe->writers has also been removed because it is no longer
+relevant in this context. The inode->i_mutex lock must be used so
+that inode->i_pipe can be dealt with correctly.
+
+Signed-off-by: Earl Chew <earl_chew@agilent.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/pipe.c | 41 ++++++++++++++++++++++++++++++-----------
+ 1 file changed, 30 insertions(+), 11 deletions(-)
+
+--- a/fs/pipe.c
++++ b/fs/pipe.c
+@@ -777,36 +777,55 @@ pipe_rdwr_release(struct inode *inode, s
+ static int
+ pipe_read_open(struct inode *inode, struct file *filp)
+ {
+- /* We could have perhaps used atomic_t, but this and friends
+- below are the only places. So it doesn't seem worthwhile. */
++ int ret = -ENOENT;
++
+ mutex_lock(&inode->i_mutex);
+- inode->i_pipe->readers++;
++
++ if (inode->i_pipe) {
++ ret = 0;
++ inode->i_pipe->readers++;
++ }
++
+ mutex_unlock(&inode->i_mutex);
+
+- return 0;
++ return ret;
+ }
+
+ static int
+ pipe_write_open(struct inode *inode, struct file *filp)
+ {
++ int ret = -ENOENT;
++
+ mutex_lock(&inode->i_mutex);
+- inode->i_pipe->writers++;
++
++ if (inode->i_pipe) {
++ ret = 0;
++ inode->i_pipe->writers++;
++ }
++
+ mutex_unlock(&inode->i_mutex);
+
+- return 0;
++ return ret;
+ }
+
+ static int
+ pipe_rdwr_open(struct inode *inode, struct file *filp)
+ {
++ int ret = -ENOENT;
++
+ mutex_lock(&inode->i_mutex);
+- if (filp->f_mode & FMODE_READ)
+- inode->i_pipe->readers++;
+- if (filp->f_mode & FMODE_WRITE)
+- inode->i_pipe->writers++;
++
++ if (inode->i_pipe) {
++ ret = 0;
++ if (filp->f_mode & FMODE_READ)
++ inode->i_pipe->readers++;
++ if (filp->f_mode & FMODE_WRITE)
++ inode->i_pipe->writers++;
++ }
++
+ mutex_unlock(&inode->i_mutex);
+
+- return 0;
++ return ret;
+ }
+
+ /*
+
+
+From gregkh@mini.kroah.org Fri Nov 6 14:15:39 2009
+Message-Id: <20091106221538.993410171@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Fri, 06 Nov 2009 14:14:00 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Yinghai Lu <yinghai@kernel.org>
+Subject: [02/99] pci: increase alignment to make more space for hidden code
+References: <20091106221358.309857998@mini.kroah.org>
+Content-Disposition: inline; filename=pci-increase-alignment-to-make-more-space-for-hidden-code.patch
+Content-Length: 1019
+Lines: 36
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Yinghai Lu <yinghai@kernel.org>
+
+commit 15b812f1d0a5ca8f5efe7f5882f468af10682ca8 upstream.
+
+As reported in
+
+ http://bugzilla.kernel.org/show_bug.cgi?id=13940
+
+on some system when acpi are enabled, acpi clears some BAR for some
+devices without reason, and kernel will need to allocate devices for
+them. It then apparently hits some undocumented resource conflict,
+resulting in non-working devices.
+
+Try to increase alignment to get more safe range for unassigned devices.
+
+Signed-off-by: Yinghai Lu <yinghai@kernel.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+
+---
+ arch/x86/kernel/e820.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/x86/kernel/e820.c
++++ b/arch/x86/kernel/e820.c
+@@ -1378,8 +1378,8 @@ static unsigned long ram_alignment(resou
+ if (mb < 16)
+ return 1024*1024;
+
+- /* To 32MB for anything above that */
+- return 32*1024*1024;
++ /* To 64MB for anything above that */
++ return 64*1024*1024;
+ }
+
+ #define MAX_RESOURCE_SIZE ((resource_size_t)-1)
+
+
+From gregkh@mini.kroah.org Fri Nov 6 14:15:39 2009
+Message-Id: <20091106221539.132843823@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Fri, 06 Nov 2009 14:14:01 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Tejun Heo <tj@kernel.org>,
+ Jeff Garzik <jgarzik@redhat.com>
+Subject: [03/99] libata: fix internal command failure handling
+References: <20091106221358.309857998@mini.kroah.org>
+Content-Disposition: inline; filename=libata-fix-internal-command-failure-handling.patch
+Content-Length: 1544
+Lines: 47
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Tejun Heo <tj@kernel.org>
+
+commit f4b31db92d163df8a639f5a8c8633bdeb6e8432d upstream.
+
+When an internal command fails, it should be failed directly without
+invoking EH. In the original implemetation, this was accomplished by
+letting internal command bypass failure handling in ata_qc_complete().
+However, later changes added post-successful-completion handling to
+that code path and the success path is no longer adequate as internal
+command failure path. One of the visible problems is that internal
+command failure due to timeout or other freeze conditions would
+spuriously trigger WARN_ON_ONCE() in the success path.
+
+This patch updates failure path such that internal command failure
+handling is contained there.
+
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/ata/libata-core.c | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -5008,12 +5008,14 @@ void ata_qc_complete(struct ata_queued_c
+ qc->flags |= ATA_QCFLAG_FAILED;
+
+ if (unlikely(qc->flags & ATA_QCFLAG_FAILED)) {
+- if (!ata_tag_internal(qc->tag)) {
+- /* always fill result TF for failed qc */
+- fill_result_tf(qc);
++ /* always fill result TF for failed qc */
++ fill_result_tf(qc);
++
++ if (!ata_tag_internal(qc->tag))
+ ata_qc_schedule_eh(qc);
+- return;
+- }
++ else
++ __ata_qc_complete(qc);
++ return;
+ }
+
+ /* read result TF if requested */
+
+
+From gregkh@mini.kroah.org Fri Nov 6 14:15:39 2009
+Message-Id: <20091106221539.257589628@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Fri, 06 Nov 2009 14:14:02 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Tejun Heo <tj@kernel.org>,
+ Jeff Garzik <jgarzik@redhat.com>
+Subject: [04/99] libata: fix PMP initialization
+References: <20091106221358.309857998@mini.kroah.org>
+Content-Disposition: inline; filename=libata-fix-pmp-initialization.patch
+Content-Length: 1737
+Lines: 49
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Tejun Heo <tj@kernel.org>
+
+commit 4f7c2874995ac48a4622755b8bd159eb2fb6d8f4 upstream.
+
+Commit 842faa6c1a1d6faddf3377948e5cf214812c6c90 fixed error handling
+during attach by not committing detected device class to dev->class
+while attaching a new device. However, this change missed the PMP
+class check in the configuration loop causing a new PMP device to go
+through ata_dev_configure() as if it were an ATA or ATAPI device.
+
+As PMP device doesn't have a regular IDENTIFY data, this makes
+ata_dev_configure() tries to configure a PMP device using an invalid
+data. For the most part, it wasn't too harmful and went unnoticed but
+this ends up clearing dev->flags which may have ATA_DFLAG_AN set by
+sata_pmp_attach(). This means that SATA_PMP_FEAT_NOTIFY ends up being
+disabled on PMPs and on PMPs which honor the flag breaks hotplug
+support.
+
+This problem was discovered and reported by Ethan Hsiao.
+
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Reported-by: Ethan Hsiao <ethanhsiao@jmicron.com>
+Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/ata/libata-eh.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/ata/libata-eh.c
++++ b/drivers/ata/libata-eh.c
+@@ -2849,12 +2849,14 @@ static int ata_eh_revalidate_and_attach(
+ * device detection messages backwards.
+ */
+ ata_for_each_dev(dev, link, ALL) {
+- if (!(new_mask & (1 << dev->devno)) ||
+- dev->class == ATA_DEV_PMP)
++ if (!(new_mask & (1 << dev->devno)))
+ continue;
+
+ dev->class = ehc->classes[dev->devno];
+
++ if (dev->class == ATA_DEV_PMP)
++ continue;
++
+ ehc->i.flags |= ATA_EHI_PRINTINFO;
+ rc = ata_dev_configure(dev);
+ ehc->i.flags &= ~ATA_EHI_PRINTINFO;
+
+
+From gregkh@mini.kroah.org Fri Nov 6 14:15:39 2009
+Message-Id: <20091106221539.385182515@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Fri, 06 Nov 2009 14:14:03 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Tejun Heo <tj@kernel.org>,
+ Jeff Garzik <jgarzik@redhat.com>
+Subject: [05/99] sata_nv: make sure link is brough up online when skipping hardreset
+References: <20091106221358.309857998@mini.kroah.org>
+Content-Disposition: inline; filename=sata_nv-make-sure-link-is-brough-up-online-when-skipping-hardreset.patch
+Content-Length: 1778
+Lines: 52
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Tejun Heo <tj@kernel.org>
+
+commit 6489e3262e6b188a1a009b65e8a94b7aa17645b7 upstream.
+
+prereset doesn't bring link online if hardreset is about to happen and
+nv_hardreset() may skip if conditions are not right so softreset may
+be entered with non-working link status if the system firmware didn't
+bring it up before entering OS code which can happen during resume.
+This patch makes nv_hardreset() to bring up the link if it's skipping
+reset.
+
+This bug was reported by frodone@gmail.com in the following bug entry.
+
+ http://bugzilla.kernel.org/show_bug.cgi?id=14329
+
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Reported-by: frodone@gmail.com
+Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/ata/sata_nv.c | 18 +++++++++++++++---
+ 1 file changed, 15 insertions(+), 3 deletions(-)
+
+--- a/drivers/ata/sata_nv.c
++++ b/drivers/ata/sata_nv.c
+@@ -1594,9 +1594,21 @@ static int nv_hardreset(struct ata_link
+ !ata_dev_enabled(link->device))
+ sata_link_hardreset(link, sata_deb_timing_hotplug, deadline,
+ NULL, NULL);
+- else if (!(ehc->i.flags & ATA_EHI_QUIET))
+- ata_link_printk(link, KERN_INFO,
+- "nv: skipping hardreset on occupied port\n");
++ else {
++ const unsigned long *timing = sata_ehc_deb_timing(ehc);
++ int rc;
++
++ if (!(ehc->i.flags & ATA_EHI_QUIET))
++ ata_link_printk(link, KERN_INFO, "nv: skipping "
++ "hardreset on occupied port\n");
++
++ /* make sure the link is online */
++ rc = sata_link_resume(link, timing, deadline);
++ /* whine about phy resume failure but proceed */
++ if (rc && rc != -EOPNOTSUPP)
++ ata_link_printk(link, KERN_WARNING, "failed to resume "
++ "link (errno=%d)\n", rc);
++ }
+
+ /* device signature acquisition is unreliable */
+ return -EAGAIN;
+
+
+From gregkh@mini.kroah.org Fri Nov 6 14:15:39 2009
+Message-Id: <20091106221539.517497730@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Fri, 06 Nov 2009 14:14:04 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Ingo Molnar <mingo@elte.hu>,
+ Trond Myklebust <Trond.Myklebust@netapp.com>
+Subject: [06/99] nfs: Fix nfs_parse_mount_options() kfree() leak
+References: <20091106221358.309857998@mini.kroah.org>
+Content-Disposition: inline; filename=nfs-fix-nfs_parse_mount_options-kfree-leak.patch
+Content-Length: 920
+Lines: 32
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Yinghai Lu <yinghai@kernel.org>
+
+commit 4223a4a155f245d41c350ed9eba4fc32e965c4da upstream.
+
+Fix a (small) memory leak in one of the error paths of the NFS mount
+options parsing code.
+
+Regression introduced in 2.6.30 by commit a67d18f (NFS: load the
+rpc/rdma transport module automatically).
+
+Reported-by: Yinghai Lu <yinghai@kernel.org>
+Reported-by: Pekka Enberg <penberg@cs.helsinki.fi>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/nfs/super.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/fs/nfs/super.c
++++ b/fs/nfs/super.c
+@@ -1323,6 +1323,7 @@ static int nfs_parse_mount_options(char
+ default:
+ dfprintk(MOUNT, "NFS: unrecognized "
+ "transport protocol\n");
++ kfree(string);
+ return 0;
+ }
+ break;
+
+
+From gregkh@mini.kroah.org Fri Nov 6 14:15:39 2009
+Message-Id: <20091106221539.652424942@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Fri, 06 Nov 2009 14:14:05 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Marcelo Tosatti <mtosatti@redhat.com>,
+ Avi Kivity <avi@redhat.com>
+Subject: [07/99] KVM: use proper hrtimer function to retrieve expiration time
+References: <20091106221358.309857998@mini.kroah.org>
+Content-Disposition: inline; filename=kvm-use-proper-hrtimer-function-to-retrieve-expiration-time.patch
+Content-Length: 1339
+Lines: 41
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Marcelo Tosatti <mtosatti@redhat.com>
+
+commit ace1546487a0fe4634e3251067f8a32cb2cdc099 upstream.
+
+hrtimer->base can be temporarily NULL due to racing hrtimer_start.
+See switch_hrtimer_base/lock_hrtimer_base.
+
+Use hrtimer_get_remaining which is robust against it.
+
+Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
+Signed-off-by: Avi Kivity <avi@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kvm/i8254.c | 2 +-
+ arch/x86/kvm/lapic.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/x86/kvm/i8254.c
++++ b/arch/x86/kvm/i8254.c
+@@ -116,7 +116,7 @@ static s64 __kpit_elapsed(struct kvm *kv
+ * itself with the initial count and continues counting
+ * from there.
+ */
+- remaining = hrtimer_expires_remaining(&ps->pit_timer.timer);
++ remaining = hrtimer_get_remaining(&ps->pit_timer.timer);
+ elapsed = ps->pit_timer.period - ktime_to_ns(remaining);
+ elapsed = mod_64(elapsed, ps->pit_timer.period);
+
+--- a/arch/x86/kvm/lapic.c
++++ b/arch/x86/kvm/lapic.c
+@@ -464,7 +464,7 @@ static u32 apic_get_tmcct(struct kvm_lap
+ if (apic_get_reg(apic, APIC_TMICT) == 0)
+ return 0;
+
+- remaining = hrtimer_expires_remaining(&apic->lapic_timer.timer);
++ remaining = hrtimer_get_remaining(&apic->lapic_timer.timer);
+ if (ktime_to_ns(remaining) < 0)
+ remaining = ktime_set(0, 0);
+
+
+
+From gregkh@mini.kroah.org Fri Nov 6 14:15:39 2009
+Message-Id: <20091106221539.777616263@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Fri, 06 Nov 2009 14:14:06 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Andre Przywara <andre.przywara@amd.com>,
+ Avi Kivity <avi@redhat.com>
+Subject: [08/99] KVM: ignore reads from AMDs C1E enabled MSR
+References: <20091106221358.309857998@mini.kroah.org>
+Content-Disposition: inline; filename=kvm-ignore-reads-from-amds-c1e-enabled-msr.patch
+Content-Length: 845
+Lines: 28
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Andre Przywara <andre.przywara@amd.com>
+
+commit 1fdbd48c242db996107f72ae4140ffe8163e26a8 upstream.
+
+If the Linux kernel detects an C1E capable AMD processor (K8 RevF and
+higher), it will access a certain MSR on every attempt to go to halt.
+Explicitly handle this read and return 0 to let KVM run a Linux guest
+with the native AMD host CPU propagated to the guest.
+
+Signed-off-by: Andre Przywara <andre.przywara@amd.com>
+Signed-off-by: Avi Kivity <avi@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kvm/x86.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -949,6 +949,7 @@ int kvm_get_msr_common(struct kvm_vcpu *
+ case MSR_P6_EVNTSEL0:
+ case MSR_P6_EVNTSEL1:
+ case MSR_K7_EVNTSEL0:
++ case MSR_K8_INT_PENDING_MSG:
+ data = 0;
+ break;
+ case MSR_MTRRcap:
+
+
+From gregkh@mini.kroah.org Fri Nov 6 14:15:40 2009
+Message-Id: <20091106221539.906129663@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Fri, 06 Nov 2009 14:14:07 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Thomas Gleixner <tglx@linutronix.de>,
+ Peter Zijlstra <peterz@infradead.org>
+Subject: [09/99] futex: Handle spurious wake up
+References: <20091106221358.309857998@mini.kroah.org>
+Content-Disposition: inline; filename=futex-handle-spurious-wake-up.patch
+Content-Length: 2703
+Lines: 90
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Thomas Gleixner <tglx@linutronix.de>
+
+commit d58e6576b0deec6f0b9ff8450fe282da18c50883 upstream.
+
+The futex code does not handle spurious wake up in futex_wait and
+futex_wait_requeue_pi.
+
+The code assumes that any wake up which was not caused by futex_wake /
+requeue or by a timeout was caused by a signal wake up and returns one
+of the syscall restart error codes.
+
+In case of a spurious wake up the signal delivery code which deals
+with the restart error codes is not invoked and we return that error
+code to user space. That causes applications which actually check the
+return codes to fail. Blaise reported that on preempt-rt a python test
+program run into a exception trap. -rt exposed that due to a built in
+spurious wake up accelerator :)
+
+Solve this by checking signal_pending(current) in the wake up path and
+handle the spurious wake up case w/o returning to user space.
+
+Reported-by: Blaise Gassend <blaise@willowgarage.com>
+Debugged-by: Darren Hart <dvhltc@us.ibm.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/futex.c | 18 +++++++++++++++---
+ 1 file changed, 15 insertions(+), 3 deletions(-)
+
+--- a/kernel/futex.c
++++ b/kernel/futex.c
+@@ -1767,6 +1767,7 @@ static int futex_wait(u32 __user *uaddr,
+ current->timer_slack_ns);
+ }
+
++retry:
+ /* Prepare to wait on uaddr. */
+ ret = futex_wait_setup(uaddr, val, fshared, &q, &hb);
+ if (ret)
+@@ -1784,9 +1785,14 @@ static int futex_wait(u32 __user *uaddr,
+ goto out_put_key;
+
+ /*
+- * We expect signal_pending(current), but another thread may
+- * have handled it for us already.
++ * We expect signal_pending(current), but we might be the
++ * victim of a spurious wakeup as well.
+ */
++ if (!signal_pending(current)) {
++ put_futex_key(fshared, &q.key);
++ goto retry;
++ }
++
+ ret = -ERESTARTSYS;
+ if (!abs_time)
+ goto out_put_key;
+@@ -2094,9 +2100,11 @@ int handle_early_requeue_pi_wakeup(struc
+ */
+ plist_del(&q->list, &q->list.plist);
+
++ /* Handle spurious wakeups gracefully */
++ ret = -EAGAIN;
+ if (timeout && !timeout->task)
+ ret = -ETIMEDOUT;
+- else
++ else if (signal_pending(current))
+ ret = -ERESTARTNOINTR;
+ }
+ return ret;
+@@ -2174,6 +2182,7 @@ static int futex_wait_requeue_pi(u32 __u
+ debug_rt_mutex_init_waiter(&rt_waiter);
+ rt_waiter.task = NULL;
+
++retry:
+ key2 = FUTEX_KEY_INIT;
+ ret = get_futex_key(uaddr2, fshared, &key2, VERIFY_WRITE);
+ if (unlikely(ret != 0))
+@@ -2271,6 +2280,9 @@ out_put_keys:
+ out_key2:
+ put_futex_key(fshared, &key2);
+
++ /* Spurious wakeup ? */
++ if (ret == -EAGAIN)
++ goto retry;
+ out:
+ if (to) {
+ hrtimer_cancel(&to->timer);
+
+
+From gregkh@mini.kroah.org Fri Nov 6 14:15:40 2009
+Message-Id: <20091106221540.027407931@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Fri, 06 Nov 2009 14:14:08 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Darren Hart <dvhltc@us.ibm.com>,
+ Peter Zijlstra <peterz@infradead.org>,
+ Ingo Molnar <mingo@elte.hu>,
+ Eric Dumazet <eric.dumazet@gmail.com>,
+ Dinakar Guniguntala <dino@in.ibm.com>,
+ John Stultz <johnstul@us.ibm.com>,
+ Thomas Gleixner <tglx@linutronix.de>
+Subject: [10/99] futex: Check for NULL keys in match_futex
+References: <20091106221358.309857998@mini.kroah.org>
+Content-Disposition: inline; filename=futex-check-for-null-keys-in-match_futex.patch
+Content-Length: 1306
+Lines: 39
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Darren Hart <dvhltc@us.ibm.com>
+
+commit 2bc872036e1c5948b5b02942810bbdd8dbdb9812 upstream.
+
+If userspace tries to perform a requeue_pi on a non-requeue_pi waiter,
+it will find the futex_q->requeue_pi_key to be NULL and OOPS.
+
+Check for NULL in match_futex() instead of doing explicit NULL pointer
+checks on all call sites. While match_futex(NULL, NULL) returning
+false is a little odd, it's still correct as we expect valid key
+references.
+
+Signed-off-by: Darren Hart <dvhltc@us.ibm.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Ingo Molnar <mingo@elte.hu>
+CC: Eric Dumazet <eric.dumazet@gmail.com>
+CC: Dinakar Guniguntala <dino@in.ibm.com>
+CC: John Stultz <johnstul@us.ibm.com>
+LKML-Reference: <4AD60687.10306@us.ibm.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/futex.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/kernel/futex.c
++++ b/kernel/futex.c
+@@ -150,7 +150,8 @@ static struct futex_hash_bucket *hash_fu
+ */
+ static inline int match_futex(union futex_key *key1, union futex_key *key2)
+ {
+- return (key1->both.word == key2->both.word
++ return (key1 && key2
++ && key1->both.word == key2->both.word
+ && key1->both.ptr == key2->both.ptr
+ && key1->both.offset == key2->both.offset);
+ }
+
+
+From gregkh@mini.kroah.org Fri Nov 6 14:15:40 2009
+Message-Id: <20091106221540.169575447@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Fri, 06 Nov 2009 14:14:09 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Darren Hart <dvhltc@us.ibm.com>,
+ Peter Zijlstra <peterz@infradead.org>,
+ Eric Dumazet <eric.dumazet@gmail.com>,
+ Dinakar Guniguntala <dino@in.ibm.com>,
+ John Stultz <johnstul@linux.vnet.ibm.com>,
+ Sven-Thorsten Dietrich <sdietrich@novell.com>,
+ John Kacur <jkacur@redhat.com>,
+ Ingo Molnar <mingo@elte.hu>
+Subject: [11/99] futex: Move drop_futex_key_refs out of spinlocked region
+References: <20091106221358.309857998@mini.kroah.org>
+Content-Disposition: inline; filename=futex-move-drop_futex_key_refs-out-of-spinlock-ed-region.patch
+Content-Length: 1752
+Lines: 58
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Darren Hart <dvhltc@us.ibm.com>
+
+commit 89061d3d58e1f0742139605dc6a7950aa1ecc019 upstream.
+
+When requeuing tasks from one futex to another, the reference held
+by the requeued task to the original futex location needs to be
+dropped eventually.
+
+Dropping the reference may ultimately lead to a call to
+"iput_final" and subsequently call into filesystem- specific code -
+which may be non-atomic.
+
+It is therefore safer to defer this drop operation until after the
+futex_hash_bucket spinlock has been dropped.
+
+Originally-From: Helge Bahmann <hcb@chaoticmind.net>
+Signed-off-by: Darren Hart <dvhltc@us.ibm.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Eric Dumazet <eric.dumazet@gmail.com>
+Cc: Dinakar Guniguntala <dino@in.ibm.com>
+Cc: John Stultz <johnstul@linux.vnet.ibm.com>
+Cc: Sven-Thorsten Dietrich <sdietrich@novell.com>
+Cc: John Kacur <jkacur@redhat.com>
+LKML-Reference: <4AD7A298.5040802@us.ibm.com>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/futex.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/kernel/futex.c
++++ b/kernel/futex.c
+@@ -1028,7 +1028,6 @@ static inline
+ void requeue_pi_wake_futex(struct futex_q *q, union futex_key *key,
+ struct futex_hash_bucket *hb)
+ {
+- drop_futex_key_refs(&q->key);
+ get_futex_key_refs(key);
+ q->key = *key;
+
+@@ -1226,6 +1225,7 @@ retry_private:
+ */
+ if (ret == 1) {
+ WARN_ON(pi_state);
++ drop_count++;
+ task_count++;
+ ret = get_futex_value_locked(&curval2, uaddr2);
+ if (!ret)
+@@ -1304,6 +1304,7 @@ retry_private:
+ if (ret == 1) {
+ /* We got the lock. */
+ requeue_pi_wake_futex(this, &key2, hb2);
++ drop_count++;
+ continue;
+ } else if (ret) {
+ /* -EDEADLK */
+
+
+From gregkh@mini.kroah.org Fri Nov 6 14:15:40 2009
+Message-Id: <20091106221540.293515838@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Fri, 06 Nov 2009 14:14:10 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Darren Hart <dvhltc@us.ibm.com>,
+ Peter Zijlstra <peterz@infradead.org>,
+ Eric Dumazet <eric.dumazet@gmail.com>,
+ John Stultz <johnstul@linux.vnet.ibm.com>,
+ Dinakar Guniguntala <dino@in.ibm.com>,
+ Thomas Gleixner <tglx@linutronix.de>
+Subject: [12/99] futex: Fix spurious wakeup for requeue_pi really
+References: <20091106221358.309857998@mini.kroah.org>
+Content-Disposition: inline; filename=futex-fix-spurious-wakeup-for-requeue_pi-really.patch
+Content-Length: 2071
+Lines: 63
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Thomas Gleixner <tglx@linutronix.de>
+
+commit 11df6dddcbc38affb7473aad3d962baf8414a947 upstream.
+
+The requeue_pi path doesn't use unqueue_me() (and the racy lock_ptr ==
+NULL test) nor does it use the wake_list of futex_wake() which where
+the reason for commit 41890f2 (futex: Handle spurious wake up)
+
+See debugging discussing on LKML Message-ID: <4AD4080C.20703@us.ibm.com>
+
+The changes in this fix to the wait_requeue_pi path were considered to
+be a likely unecessary, but harmless safety net. But it turns out that
+due to the fact that for unknown $@#!*( reasons EWOULDBLOCK is defined
+as EAGAIN we built an endless loop in the code path which returns
+correctly EWOULDBLOCK.
+
+Spurious wakeups in wait_requeue_pi code path are unlikely so we do
+the easy solution and return EWOULDBLOCK^WEAGAIN to user space and let
+it deal with the spurious wakeup.
+
+Cc: Darren Hart <dvhltc@us.ibm.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Eric Dumazet <eric.dumazet@gmail.com>
+Cc: John Stultz <johnstul@linux.vnet.ibm.com>
+Cc: Dinakar Guniguntala <dino@in.ibm.com>
+LKML-Reference: <4AE23C74.1090502@us.ibm.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/futex.c | 6 +-----
+ 1 file changed, 1 insertion(+), 5 deletions(-)
+
+--- a/kernel/futex.c
++++ b/kernel/futex.c
+@@ -2103,7 +2103,7 @@ int handle_early_requeue_pi_wakeup(struc
+ plist_del(&q->list, &q->list.plist);
+
+ /* Handle spurious wakeups gracefully */
+- ret = -EAGAIN;
++ ret = -EWOULDBLOCK;
+ if (timeout && !timeout->task)
+ ret = -ETIMEDOUT;
+ else if (signal_pending(current))
+@@ -2184,7 +2184,6 @@ static int futex_wait_requeue_pi(u32 __u
+ debug_rt_mutex_init_waiter(&rt_waiter);
+ rt_waiter.task = NULL;
+
+-retry:
+ key2 = FUTEX_KEY_INIT;
+ ret = get_futex_key(uaddr2, fshared, &key2, VERIFY_WRITE);
+ if (unlikely(ret != 0))
+@@ -2282,9 +2281,6 @@ out_put_keys:
+ out_key2:
+ put_futex_key(fshared, &key2);
+
+- /* Spurious wakeup ? */
+- if (ret == -EAGAIN)
+- goto retry;
+ out:
+ if (to) {
+ hrtimer_cancel(&to->timer);
+
+
+From gregkh@mini.kroah.org Fri Nov 6 14:15:40 2009
+Message-Id: <20091106221540.421494604@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Fri, 06 Nov 2009 14:14:11 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Tejun Heo <tj@kernel.org>,
+ Chuck Ebbert <cebbert@redhat.com>
+Subject: [13/99] ahci: revert "Restore SB600 sata controller 64 bit DMA"
+References: <20091106221358.309857998@mini.kroah.org>
+Content-Disposition: inline; filename=ahci-revert-restore-sb600-sata-controller-64-bit-dma.patch
+Content-Length: 3117
+Lines: 101
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Chuck Ebbert <cebbert@redhat.com>
+
+revert commit 58a09b38cfcd700b796ea07ae3d2e0efbb28b561
+("[libata] ahci: Restore SB600 SATA controller 64 bit DMA")
+
+Upstream commit 58a09b38cfcd700b796ea07ae3d2e0efbb28b561 does
+nearly the same thing but this patch is simplified for 2.6.31
+
+Disables 64-bit DMA for _all_ boards, unlike 2.6.32 which adds a
+whitelist. (The whitelist function requires a fairly large patch
+that touches unrelated code.)
+
+Doesn't revert the DMI part as other backported patches might need
+the exported symbol.
+
+Applies to 2.6.31.4
+
+Signed-off-by: Chuck Ebbert <cebbert@redhat.com>
+Acked-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/ata/ahci.c | 52 ++--------------------------------------------------
+ 1 file changed, 2 insertions(+), 50 deletions(-)
+
+--- a/drivers/ata/ahci.c
++++ b/drivers/ata/ahci.c
+@@ -433,7 +433,8 @@ static const struct ata_port_info ahci_p
+ [board_ahci_sb600] =
+ {
+ AHCI_HFLAGS (AHCI_HFLAG_IGN_SERR_INTERNAL |
+- AHCI_HFLAG_NO_MSI | AHCI_HFLAG_SECT255),
++ AHCI_HFLAG_32BIT_ONLY | AHCI_HFLAG_NO_MSI |
++ AHCI_HFLAG_SECT255),
+ .flags = AHCI_FLAG_COMMON,
+ .pio_mask = ATA_PIO4,
+ .udma_mask = ATA_UDMA6,
+@@ -2602,51 +2603,6 @@ static void ahci_p5wdh_workaround(struct
+ }
+ }
+
+-/*
+- * SB600 ahci controller on ASUS M2A-VM can't do 64bit DMA with older
+- * BIOS. The oldest version known to be broken is 0901 and working is
+- * 1501 which was released on 2007-10-26. Force 32bit DMA on anything
+- * older than 1501. Please read bko#9412 for more info.
+- */
+-static bool ahci_asus_m2a_vm_32bit_only(struct pci_dev *pdev)
+-{
+- static const struct dmi_system_id sysids[] = {
+- {
+- .ident = "ASUS M2A-VM",
+- .matches = {
+- DMI_MATCH(DMI_BOARD_VENDOR,
+- "ASUSTeK Computer INC."),
+- DMI_MATCH(DMI_BOARD_NAME, "M2A-VM"),
+- },
+- },
+- { }
+- };
+- const char *cutoff_mmdd = "10/26";
+- const char *date;
+- int year;
+-
+- if (pdev->bus->number != 0 || pdev->devfn != PCI_DEVFN(0x12, 0) ||
+- !dmi_check_system(sysids))
+- return false;
+-
+- /*
+- * Argh.... both version and date are free form strings.
+- * Let's hope they're using the same date format across
+- * different versions.
+- */
+- date = dmi_get_system_info(DMI_BIOS_DATE);
+- year = dmi_get_year(DMI_BIOS_DATE);
+- if (date && strlen(date) >= 10 && date[2] == '/' && date[5] == '/' &&
+- (year > 2007 ||
+- (year == 2007 && strncmp(date, cutoff_mmdd, 5) >= 0)))
+- return false;
+-
+- dev_printk(KERN_WARNING, &pdev->dev, "ASUS M2A-VM: BIOS too old, "
+- "forcing 32bit DMA, update BIOS\n");
+-
+- return true;
+-}
+-
+ static bool ahci_broken_system_poweroff(struct pci_dev *pdev)
+ {
+ static const struct dmi_system_id broken_systems[] = {
+@@ -2857,10 +2813,6 @@ static int ahci_init_one(struct pci_dev
+ if (board_id == board_ahci_sb700 && pdev->revision >= 0x40)
+ hpriv->flags &= ~AHCI_HFLAG_IGN_SERR_INTERNAL;
+
+- /* apply ASUS M2A_VM quirk */
+- if (ahci_asus_m2a_vm_32bit_only(pdev))
+- hpriv->flags |= AHCI_HFLAG_32BIT_ONLY;
+-
+ if ((hpriv->flags & AHCI_HFLAG_NO_MSI) || pci_enable_msi(pdev))
+ pci_intx(pdev, 1);
+
+
+
+From gregkh@mini.kroah.org Fri Nov 6 14:15:40 2009
+Message-Id: <20091106221540.545417553@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Fri, 06 Nov 2009 14:14:12 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [14/99] sparc64: Set IRQF_DISABLED on LDC channel IRQs.
+References: <20091106221358.309857998@mini.kroah.org>
+Content-Disposition: inline; filename=sparc64-set-irqf_disabled-on-ldc-channel-irqs.patch
+Content-Length: 1043
+Lines: 34
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: David S. Miller <davem@davemloft.net>
+
+[ Upstream commit c58543c869606532c2382f027d6466f4672ea756 ]
+
+With lots of virtual devices it's easy to generate a lot of
+events and chew up the kernel IRQ stack.
+
+Reported-by: hyl <heyongli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/sparc/kernel/ldc.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/sparc/kernel/ldc.c
++++ b/arch/sparc/kernel/ldc.c
+@@ -1242,13 +1242,13 @@ int ldc_bind(struct ldc_channel *lp, con
+ snprintf(lp->tx_irq_name, LDC_IRQ_NAME_MAX, "%s TX", name);
+
+ err = request_irq(lp->cfg.rx_irq, ldc_rx,
+- IRQF_SAMPLE_RANDOM | IRQF_SHARED,
++ IRQF_SAMPLE_RANDOM | IRQF_DISABLED | IRQF_SHARED,
+ lp->rx_irq_name, lp);
+ if (err)
+ return err;
+
+ err = request_irq(lp->cfg.tx_irq, ldc_tx,
+- IRQF_SAMPLE_RANDOM | IRQF_SHARED,
++ IRQF_SAMPLE_RANDOM | IRQF_DISABLED | IRQF_SHARED,
+ lp->tx_irq_name, lp);
+ if (err) {
+ free_irq(lp->cfg.rx_irq, lp);
+
+
+From gregkh@mini.kroah.org Fri Nov 6 14:15:40 2009
+Message-Id: <20091106221540.673374392@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Fri, 06 Nov 2009 14:14:13 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [15/99] sparc: Kill PROM console driver.
+References: <20091106221358.309857998@mini.kroah.org>
+Content-Disposition: inline; filename=sparc-kill-prom-console-driver.patch
+Content-Length: 17191
+Lines: 752
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: David S. Miller <davem@davemloft.net>
+
+[ Upstream commit 09d3f3f0e02c8a900d076c302c5c02227f33572d ]
+
+Many years ago when this driver was written, it had a use, but these
+days it's nothing but trouble and distributions should not enable it
+in any situation.
+
+Pretty much every console device a sparc machine could see has a
+bonafide real driver, making the PROM console hack unnecessary.
+
+If any new device shows up, we should write a driver instead of
+depending upon this crutch to save us. We've been able to take care
+of this even when no chip documentation exists (sunxvr500, sunxvr2500)
+so there are no excuses.
+
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ Documentation/dontdiff | 1
+ arch/sparc/kernel/setup_32.c | 2
+ arch/sparc/kernel/setup_64.c | 2
+ drivers/char/vt.c | 3
+ drivers/video/console/.gitignore | 2
+ drivers/video/console/Kconfig | 9
+ drivers/video/console/Makefile | 12
+ drivers/video/console/prom.uni | 11
+ drivers/video/console/promcon.c | 598 ---------------------------------------
+ scripts/Makefile | 1
+ 10 files changed, 1 insertion(+), 640 deletions(-)
+
+--- a/arch/sparc/kernel/setup_32.c
++++ b/arch/sparc/kernel/setup_32.c
+@@ -263,8 +263,6 @@ void __init setup_arch(char **cmdline_p)
+
+ #ifdef CONFIG_DUMMY_CONSOLE
+ conswitchp = &dummy_con;
+-#elif defined(CONFIG_PROM_CONSOLE)
+- conswitchp = &prom_con;
+ #endif
+ boot_flags_init(*cmdline_p);
+
+--- a/arch/sparc/kernel/setup_64.c
++++ b/arch/sparc/kernel/setup_64.c
+@@ -295,8 +295,6 @@ void __init setup_arch(char **cmdline_p)
+
+ #ifdef CONFIG_DUMMY_CONSOLE
+ conswitchp = &dummy_con;
+-#elif defined(CONFIG_PROM_CONSOLE)
+- conswitchp = &prom_con;
+ #endif
+
+ idprom_init();
+--- a/Documentation/dontdiff
++++ b/Documentation/dontdiff
+@@ -152,7 +152,6 @@ piggy.gz
+ piggyback
+ pnmtologo
+ ppc_defs.h*
+-promcon_tbl.c
+ pss_boot.h
+ qconf
+ raid6altivec*.c
+--- a/drivers/char/vt.c
++++ b/drivers/char/vt.c
+@@ -2948,9 +2948,6 @@ int __init vty_init(const struct file_op
+ panic("Couldn't register console driver\n");
+ kbd_init();
+ console_map_init();
+-#ifdef CONFIG_PROM_CONSOLE
+- prom_con_init();
+-#endif
+ #ifdef CONFIG_MDA_CONSOLE
+ mda_console_init();
+ #endif
+--- a/drivers/video/console/.gitignore
++++ /dev/null
+@@ -1,2 +0,0 @@
+-# conmakehash generated file
+-promcon_tbl.c
+--- a/drivers/video/console/Kconfig
++++ b/drivers/video/console/Kconfig
+@@ -67,16 +67,9 @@ config SGI_NEWPORT_CONSOLE
+
+ # bool 'IODC console' CONFIG_IODC_CONSOLE
+
+-config PROM_CONSOLE
+- bool "PROM console"
+- depends on SPARC
+- help
+- Say Y to build a console driver for Sun machines that uses the
+- terminal emulation built into their console PROMS.
+-
+ config DUMMY_CONSOLE
+ bool
+- depends on PROM_CONSOLE!=y || VGA_CONSOLE!=y || SGI_NEWPORT_CONSOLE!=y
++ depends on VGA_CONSOLE!=y || SGI_NEWPORT_CONSOLE!=y
+ default y
+
+ config DUMMY_CONSOLE_COLUMNS
+--- a/drivers/video/console/Makefile
++++ b/drivers/video/console/Makefile
+@@ -22,7 +22,6 @@ font-objs += $(font-objs-y)
+
+ obj-$(CONFIG_DUMMY_CONSOLE) += dummycon.o
+ obj-$(CONFIG_SGI_NEWPORT_CONSOLE) += newport_con.o font.o
+-obj-$(CONFIG_PROM_CONSOLE) += promcon.o promcon_tbl.o
+ obj-$(CONFIG_STI_CONSOLE) += sticon.o sticore.o font.o
+ obj-$(CONFIG_VGA_CONSOLE) += vgacon.o
+ obj-$(CONFIG_MDA_CONSOLE) += mdacon.o
+@@ -40,14 +39,3 @@ obj-$(CONFIG_FB_STI) += sti
+ ifeq ($(CONFIG_USB_SISUSBVGA_CON),y)
+ obj-$(CONFIG_USB_SISUSBVGA) += font.o
+ endif
+-
+-# Targets that kbuild needs to know about
+-targets := promcon_tbl.c
+-
+-quiet_cmd_conmakehash = CNMKHSH $@
+- cmd_conmakehash = scripts/conmakehash $< | \
+- sed -e '/\#include <[^>]*>/p' -e 's/types/init/' \
+- -e 's/dfont\(_uni.*\]\)/promfont\1 /' > $@
+-
+-$(obj)/promcon_tbl.c: $(src)/prom.uni
+- $(call cmd,conmakehash)
+--- a/drivers/video/console/promcon.c
++++ /dev/null
+@@ -1,598 +0,0 @@
+-/* $Id: promcon.c,v 1.17 2000/07/26 23:02:52 davem Exp $
+- * Console driver utilizing PROM sun terminal emulation
+- *
+- * Copyright (C) 1998 Eddie C. Dost (ecd@skynet.be)
+- * Copyright (C) 1998 Jakub Jelinek (jj@ultra.linux.cz)
+- */
+-
+-#include <linux/module.h>
+-#include <linux/kernel.h>
+-#include <linux/errno.h>
+-#include <linux/string.h>
+-#include <linux/mm.h>
+-#include <linux/slab.h>
+-#include <linux/delay.h>
+-#include <linux/console.h>
+-#include <linux/vt_kern.h>
+-#include <linux/selection.h>
+-#include <linux/fb.h>
+-#include <linux/init.h>
+-#include <linux/kd.h>
+-
+-#include <asm/oplib.h>
+-#include <asm/uaccess.h>
+-
+-static short pw = 80 - 1, ph = 34 - 1;
+-static short px, py;
+-static unsigned long promcon_uni_pagedir[2];
+-
+-extern u8 promfont_unicount[];
+-extern u16 promfont_unitable[];
+-
+-#define PROMCON_COLOR 0
+-
+-#if PROMCON_COLOR
+-#define inverted(s) ((((s) & 0x7700) == 0x0700) ? 0 : 1)
+-#else
+-#define inverted(s) (((s) & 0x0800) ? 1 : 0)
+-#endif
+-
+-static __inline__ void
+-promcon_puts(char *buf, int cnt)
+-{
+- prom_printf("%*.*s", cnt, cnt, buf);
+-}
+-
+-static int
+-promcon_start(struct vc_data *conp, char *b)
+-{
+- unsigned short *s = (unsigned short *)
+- (conp->vc_origin + py * conp->vc_size_row + (px << 1));
+- u16 cs;
+-
+- cs = scr_readw(s);
+- if (px == pw) {
+- unsigned short *t = s - 1;
+- u16 ct = scr_readw(t);
+-
+- if (inverted(cs) && inverted(ct))
+- return sprintf(b, "\b\033[7m%c\b\033[@%c\033[m", cs,
+- ct);
+- else if (inverted(cs))
+- return sprintf(b, "\b\033[7m%c\033[m\b\033[@%c", cs,
+- ct);
+- else if (inverted(ct))
+- return sprintf(b, "\b%c\b\033[@\033[7m%c\033[m", cs,
+- ct);
+- else
+- return sprintf(b, "\b%c\b\033[@%c", cs, ct);
+- }
+-
+- if (inverted(cs))
+- return sprintf(b, "\033[7m%c\033[m\b", cs);
+- else
+- return sprintf(b, "%c\b", cs);
+-}
+-
+-static int
+-promcon_end(struct vc_data *conp, char *b)
+-{
+- unsigned short *s = (unsigned short *)
+- (conp->vc_origin + py * conp->vc_size_row + (px << 1));
+- char *p = b;
+- u16 cs;
+-
+- b += sprintf(b, "\033[%d;%dH", py + 1, px + 1);
+-
+- cs = scr_readw(s);
+- if (px == pw) {
+- unsigned short *t = s - 1;
+- u16 ct = scr_readw(t);
+-
+- if (inverted(cs) && inverted(ct))
+- b += sprintf(b, "\b%c\b\033[@\033[7m%c\033[m", cs, ct);
+- else if (inverted(cs))
+- b += sprintf(b, "\b%c\b\033[@%c", cs, ct);
+- else if (inverted(ct))
+- b += sprintf(b, "\b\033[7m%c\b\033[@%c\033[m", cs, ct);
+- else
+- b += sprintf(b, "\b\033[7m%c\033[m\b\033[@%c", cs, ct);
+- return b - p;
+- }
+-
+- if (inverted(cs))
+- b += sprintf(b, "%c\b", cs);
+- else
+- b += sprintf(b, "\033[7m%c\033[m\b", cs);
+- return b - p;
+-}
+-
+-const char *promcon_startup(void)
+-{
+- const char *display_desc = "PROM";
+- int node;
+- char buf[40];
+-
+- node = prom_getchild(prom_root_node);
+- node = prom_searchsiblings(node, "options");
+- if (prom_getproperty(node, "screen-#columns", buf, 40) != -1) {
+- pw = simple_strtoul(buf, NULL, 0);
+- if (pw < 10 || pw > 256)
+- pw = 80;
+- pw--;
+- }
+- if (prom_getproperty(node, "screen-#rows", buf, 40) != -1) {
+- ph = simple_strtoul(buf, NULL, 0);
+- if (ph < 10 || ph > 256)
+- ph = 34;
+- ph--;
+- }
+- promcon_puts("\033[H\033[J", 6);
+- return display_desc;
+-}
+-
+-static void
+-promcon_init_unimap(struct vc_data *conp)
+-{
+- mm_segment_t old_fs = get_fs();
+- struct unipair *p, *p1;
+- u16 *q;
+- int i, j, k;
+-
+- p = kmalloc(256*sizeof(struct unipair), GFP_KERNEL);
+- if (!p) return;
+-
+- q = promfont_unitable;
+- p1 = p;
+- k = 0;
+- for (i = 0; i < 256; i++)
+- for (j = promfont_unicount[i]; j; j--) {
+- p1->unicode = *q++;
+- p1->fontpos = i;
+- p1++;
+- k++;
+- }
+- set_fs(KERNEL_DS);
+- con_clear_unimap(conp, NULL);
+- con_set_unimap(conp, k, p);
+- con_protect_unimap(conp, 1);
+- set_fs(old_fs);
+- kfree(p);
+-}
+-
+-static void
+-promcon_init(struct vc_data *conp, int init)
+-{
+- unsigned long p;
+-
+- conp->vc_can_do_color = PROMCON_COLOR;
+- if (init) {
+- conp->vc_cols = pw + 1;
+- conp->vc_rows = ph + 1;
+- }
+- p = *conp->vc_uni_pagedir_loc;
+- if (conp->vc_uni_pagedir_loc == &conp->vc_uni_pagedir ||
+- !--conp->vc_uni_pagedir_loc[1])
+- con_free_unimap(conp);
+- conp->vc_uni_pagedir_loc = promcon_uni_pagedir;
+- promcon_uni_pagedir[1]++;
+- if (!promcon_uni_pagedir[0] && p) {
+- promcon_init_unimap(conp);
+- }
+- if (!init) {
+- if (conp->vc_cols != pw + 1 || conp->vc_rows != ph + 1)
+- vc_resize(conp, pw + 1, ph + 1);
+- }
+-}
+-
+-static void
+-promcon_deinit(struct vc_data *conp)
+-{
+- /* When closing the last console, reset video origin */
+- if (!--promcon_uni_pagedir[1])
+- con_free_unimap(conp);
+- conp->vc_uni_pagedir_loc = &conp->vc_uni_pagedir;
+- con_set_default_unimap(conp);
+-}
+-
+-static int
+-promcon_switch(struct vc_data *conp)
+-{
+- return 1;
+-}
+-
+-static unsigned short *
+-promcon_repaint_line(unsigned short *s, unsigned char *buf, unsigned char **bp)
+-{
+- int cnt = pw + 1;
+- int attr = -1;
+- unsigned char *b = *bp;
+-
+- while (cnt--) {
+- u16 c = scr_readw(s);
+- if (attr != inverted(c)) {
+- attr = inverted(c);
+- if (attr) {
+- strcpy (b, "\033[7m");
+- b += 4;
+- } else {
+- strcpy (b, "\033[m");
+- b += 3;
+- }
+- }
+- *b++ = c;
+- s++;
+- if (b - buf >= 224) {
+- promcon_puts(buf, b - buf);
+- b = buf;
+- }
+- }
+- *bp = b;
+- return s;
+-}
+-
+-static void
+-promcon_putcs(struct vc_data *conp, const unsigned short *s,
+- int count, int y, int x)
+-{
+- unsigned char buf[256], *b = buf;
+- unsigned short attr = scr_readw(s);
+- unsigned char save;
+- int i, last = 0;
+-
+- if (console_blanked)
+- return;
+-
+- if (count <= 0)
+- return;
+-
+- b += promcon_start(conp, b);
+-
+- if (x + count >= pw + 1) {
+- if (count == 1) {
+- x -= 1;
+- save = scr_readw((unsigned short *)(conp->vc_origin
+- + y * conp->vc_size_row
+- + (x << 1)));
+-
+- if (px != x || py != y) {
+- b += sprintf(b, "\033[%d;%dH", y + 1, x + 1);
+- px = x;
+- py = y;
+- }
+-
+- if (inverted(attr))
+- b += sprintf(b, "\033[7m%c\033[m", scr_readw(s++));
+- else
+- b += sprintf(b, "%c", scr_readw(s++));
+-
+- strcpy(b, "\b\033[@");
+- b += 4;
+-
+- if (inverted(save))
+- b += sprintf(b, "\033[7m%c\033[m", save);
+- else
+- b += sprintf(b, "%c", save);
+-
+- px++;
+-
+- b += promcon_end(conp, b);
+- promcon_puts(buf, b - buf);
+- return;
+- } else {
+- last = 1;
+- count = pw - x - 1;
+- }
+- }
+-
+- if (inverted(attr)) {
+- strcpy(b, "\033[7m");
+- b += 4;
+- }
+-
+- if (px != x || py != y) {
+- b += sprintf(b, "\033[%d;%dH", y + 1, x + 1);
+- px = x;
+- py = y;
+- }
+-
+- for (i = 0; i < count; i++) {
+- if (b - buf >= 224) {
+- promcon_puts(buf, b - buf);
+- b = buf;
+- }
+- *b++ = scr_readw(s++);
+- }
+-
+- px += count;
+-
+- if (last) {
+- save = scr_readw(s++);
+- b += sprintf(b, "%c\b\033[@%c", scr_readw(s++), save);
+- px++;
+- }
+-
+- if (inverted(attr)) {
+- strcpy(b, "\033[m");
+- b += 3;
+- }
+-
+- b += promcon_end(conp, b);
+- promcon_puts(buf, b - buf);
+-}
+-
+-static void
+-promcon_putc(struct vc_data *conp, int c, int y, int x)
+-{
+- unsigned short s;
+-
+- if (console_blanked)
+- return;
+-
+- scr_writew(c, &s);
+- promcon_putcs(conp, &s, 1, y, x);
+-}
+-
+-static void
+-promcon_clear(struct vc_data *conp, int sy, int sx, int height, int width)
+-{
+- unsigned char buf[256], *b = buf;
+- int i, j;
+-
+- if (console_blanked)
+- return;
+-
+- b += promcon_start(conp, b);
+-
+- if (!sx && width == pw + 1) {
+-
+- if (!sy && height == ph + 1) {
+- strcpy(b, "\033[H\033[J");
+- b += 6;
+- b += promcon_end(conp, b);
+- promcon_puts(buf, b - buf);
+- return;
+- } else if (sy + height == ph + 1) {
+- b += sprintf(b, "\033[%dH\033[J", sy + 1);
+- b += promcon_end(conp, b);
+- promcon_puts(buf, b - buf);
+- return;
+- }
+-
+- b += sprintf(b, "\033[%dH", sy + 1);
+- for (i = 1; i < height; i++) {
+- strcpy(b, "\033[K\n");
+- b += 4;
+- }
+-
+- strcpy(b, "\033[K");
+- b += 3;
+-
+- b += promcon_end(conp, b);
+- promcon_puts(buf, b - buf);
+- return;
+-
+- } else if (sx + width == pw + 1) {
+-
+- b += sprintf(b, "\033[%d;%dH", sy + 1, sx + 1);
+- for (i = 1; i < height; i++) {
+- strcpy(b, "\033[K\n");
+- b += 4;
+- }
+-
+- strcpy(b, "\033[K");
+- b += 3;
+-
+- b += promcon_end(conp, b);
+- promcon_puts(buf, b - buf);
+- return;
+- }
+-
+- for (i = sy + 1; i <= sy + height; i++) {
+- b += sprintf(b, "\033[%d;%dH", i, sx + 1);
+- for (j = 0; j < width; j++)
+- *b++ = ' ';
+- if (b - buf + width >= 224) {
+- promcon_puts(buf, b - buf);
+- b = buf;
+- }
+- }
+-
+- b += promcon_end(conp, b);
+- promcon_puts(buf, b - buf);
+-}
+-
+-static void
+-promcon_bmove(struct vc_data *conp, int sy, int sx, int dy, int dx,
+- int height, int width)
+-{
+- char buf[256], *b = buf;
+-
+- if (console_blanked)
+- return;
+-
+- b += promcon_start(conp, b);
+- if (sy == dy && height == 1) {
+- if (dx > sx && dx + width == conp->vc_cols)
+- b += sprintf(b, "\033[%d;%dH\033[%d@\033[%d;%dH",
+- sy + 1, sx + 1, dx - sx, py + 1, px + 1);
+- else if (dx < sx && sx + width == conp->vc_cols)
+- b += sprintf(b, "\033[%d;%dH\033[%dP\033[%d;%dH",
+- dy + 1, dx + 1, sx - dx, py + 1, px + 1);
+-
+- b += promcon_end(conp, b);
+- promcon_puts(buf, b - buf);
+- return;
+- }
+-
+- /*
+- * FIXME: What to do here???
+- * Current console.c should not call it like that ever.
+- */
+- prom_printf("\033[7mFIXME: bmove not handled\033[m\n");
+-}
+-
+-static void
+-promcon_cursor(struct vc_data *conp, int mode)
+-{
+- char buf[32], *b = buf;
+-
+- switch (mode) {
+- case CM_ERASE:
+- break;
+-
+- case CM_MOVE:
+- case CM_DRAW:
+- b += promcon_start(conp, b);
+- if (px != conp->vc_x || py != conp->vc_y) {
+- px = conp->vc_x;
+- py = conp->vc_y;
+- b += sprintf(b, "\033[%d;%dH", py + 1, px + 1);
+- }
+- promcon_puts(buf, b - buf);
+- break;
+- }
+-}
+-
+-static int
+-promcon_blank(struct vc_data *conp, int blank, int mode_switch)
+-{
+- if (blank) {
+- promcon_puts("\033[H\033[J\033[7m \033[m\b", 15);
+- return 0;
+- } else {
+- /* Let console.c redraw */
+- return 1;
+- }
+-}
+-
+-static int
+-promcon_scroll(struct vc_data *conp, int t, int b, int dir, int count)
+-{
+- unsigned char buf[256], *p = buf;
+- unsigned short *s;
+- int i;
+-
+- if (console_blanked)
+- return 0;
+-
+- p += promcon_start(conp, p);
+-
+- switch (dir) {
+- case SM_UP:
+- if (b == ph + 1) {
+- p += sprintf(p, "\033[%dH\033[%dM", t + 1, count);
+- px = 0;
+- py = t;
+- p += promcon_end(conp, p);
+- promcon_puts(buf, p - buf);
+- break;
+- }
+-
+- s = (unsigned short *)(conp->vc_origin
+- + (t + count) * conp->vc_size_row);
+-
+- p += sprintf(p, "\033[%dH", t + 1);
+-
+- for (i = t; i < b - count; i++)
+- s = promcon_repaint_line(s, buf, &p);
+-
+- for (; i < b - 1; i++) {
+- strcpy(p, "\033[K\n");
+- p += 4;
+- if (p - buf >= 224) {
+- promcon_puts(buf, p - buf);
+- p = buf;
+- }
+- }
+-
+- strcpy(p, "\033[K");
+- p += 3;
+-
+- p += promcon_end(conp, p);
+- promcon_puts(buf, p - buf);
+- break;
+-
+- case SM_DOWN:
+- if (b == ph + 1) {
+- p += sprintf(p, "\033[%dH\033[%dL", t + 1, count);
+- px = 0;
+- py = t;
+- p += promcon_end(conp, p);
+- promcon_puts(buf, p - buf);
+- break;
+- }
+-
+- s = (unsigned short *)(conp->vc_origin + t * conp->vc_size_row);
+-
+- p += sprintf(p, "\033[%dH", t + 1);
+-
+- for (i = t; i < t + count; i++) {
+- strcpy(p, "\033[K\n");
+- p += 4;
+- if (p - buf >= 224) {
+- promcon_puts(buf, p - buf);
+- p = buf;
+- }
+- }
+-
+- for (; i < b; i++)
+- s = promcon_repaint_line(s, buf, &p);
+-
+- p += promcon_end(conp, p);
+- promcon_puts(buf, p - buf);
+- break;
+- }
+-
+- return 0;
+-}
+-
+-#if !(PROMCON_COLOR)
+-static u8 promcon_build_attr(struct vc_data *conp, u8 _color, u8 _intensity,
+- u8 _blink, u8 _underline, u8 _reverse, u8 _italic)
+-{
+- return (_reverse) ? 0xf : 0x7;
+-}
+-#endif
+-
+-/*
+- * The console 'switch' structure for the VGA based console
+- */
+-
+-static int promcon_dummy(void)
+-{
+- return 0;
+-}
+-
+-#define DUMMY (void *) promcon_dummy
+-
+-const struct consw prom_con = {
+- .owner = THIS_MODULE,
+- .con_startup = promcon_startup,
+- .con_init = promcon_init,
+- .con_deinit = promcon_deinit,
+- .con_clear = promcon_clear,
+- .con_putc = promcon_putc,
+- .con_putcs = promcon_putcs,
+- .con_cursor = promcon_cursor,
+- .con_scroll = promcon_scroll,
+- .con_bmove = promcon_bmove,
+- .con_switch = promcon_switch,
+- .con_blank = promcon_blank,
+- .con_set_palette = DUMMY,
+- .con_scrolldelta = DUMMY,
+-#if !(PROMCON_COLOR)
+- .con_build_attr = promcon_build_attr,
+-#endif
+-};
+-
+-void __init prom_con_init(void)
+-{
+-#ifdef CONFIG_DUMMY_CONSOLE
+- if (conswitchp == &dummy_con)
+- take_over_console(&prom_con, 0, MAX_NR_CONSOLES-1, 1);
+- else
+-#endif
+- if (conswitchp == &prom_con)
+- promcon_init_unimap(vc_cons[fg_console].d);
+-}
+--- a/drivers/video/console/prom.uni
++++ /dev/null
+@@ -1,11 +0,0 @@
+-#
+-# Unicode mapping table for font in Sun PROM
+-#
+-#
+-0x20-0x7e idem
+-0xa0-0xff idem
+-#
+-0x7c U+2502
+-0x2d U+2500
+-0x2b U+250c U+2510 U+2514 U+2518 U+251c U+2524 U+252c U+2534 U+253c
+-0xa4 U+fffd
+--- a/scripts/Makefile
++++ b/scripts/Makefile
+@@ -10,7 +10,6 @@
+ hostprogs-$(CONFIG_KALLSYMS) += kallsyms
+ hostprogs-$(CONFIG_LOGO) += pnmtologo
+ hostprogs-$(CONFIG_VT) += conmakehash
+-hostprogs-$(CONFIG_PROM_CONSOLE) += conmakehash
+ hostprogs-$(CONFIG_IKCONFIG) += bin2c
+
+ always := $(hostprogs-y) $(hostprogs-m)
+
+
+From gregkh@mini.kroah.org Fri Nov 6 14:15:40 2009
+Message-Id: <20091106221540.801628880@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Fri, 06 Nov 2009 14:14:14 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Thomas Gleixner <tglx@linutronix.de>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [16/99] watchdog: Fix rio watchdog probe function
+References: <20091106221358.309857998@mini.kroah.org>
+Content-Disposition: inline; filename=watchdog-fix-rio-watchdog-probe-function.patch
+Content-Length: 945
+Lines: 32
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Thomas Gleixner <tglx@linutronix.de>
+
+[ Upstream commit 03717e3d12b625268848414e39beda25e4515692 ]
+
+After sucessfully registering the misc device the driver iounmaps the
+hardware registers and kfree's the device data structure. Ouch !
+
+This was introduced with commit e42311d75 (riowatchdog: Convert to
+pure OF driver) and went unnoticed for more than a year :)
+
+Return success instead of dropping into the error cleanup code path.
+
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/watchdog/riowd.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/watchdog/riowd.c
++++ b/drivers/watchdog/riowd.c
+@@ -206,7 +206,7 @@ static int __devinit riowd_probe(struct
+
+ dev_set_drvdata(&op->dev, p);
+ riowd_device = p;
+- err = 0;
++ return 0;
+
+ out_iounmap:
+ of_iounmap(&op->resource[0], p->regs, 2);
+
+
+From gregkh@mini.kroah.org Fri Nov 6 14:15:41 2009
+Message-Id: <20091106221540.929583902@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Fri, 06 Nov 2009 14:14:15 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Dmitry Torokhov <dtor@mail.ru>
+Subject: [17/99] Input: synaptics - add another Protege M300 to rate blacklist
+References: <20091106221358.309857998@mini.kroah.org>
+Content-Disposition: inline; filename=input-synaptics-add-another-protege-m300-to-rate-blacklist.patch
+Content-Length: 1080
+Lines: 38
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+
+commit 5f5eeff4c93256ee93435a3bf08cf18c45e9a994 upstream.
+
+Apparently some of Toshiba Protege M300 identify themselves as
+"Portable PC" in DMI so we need to add that to the DMI table as
+well. We need DMI data so we can automatically lower Synaptics
+reporting rate from 80 to 40 pps to avoid over-taxing their
+keyboard controllers.
+
+Tested-by: Rod Davison <roddavison@gmail.com>
+Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/input/mouse/synaptics.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/drivers/input/mouse/synaptics.c
++++ b/drivers/input/mouse/synaptics.c
+@@ -652,6 +652,16 @@ static const struct dmi_system_id toshib
+ DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "PORTEGE M300"),
+ },
++
++ },
++ {
++ .ident = "Toshiba Portege M300",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Portable PC"),
++ DMI_MATCH(DMI_PRODUCT_VERSION, "Version 1.0"),
++ },
++
+ },
+ { }
+ };
+
+
+From gregkh@mini.kroah.org Fri Nov 6 14:15:41 2009
+Message-Id: <20091106221541.057271576@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Fri, 06 Nov 2009 14:14:16 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jonathan Brassow <jbrassow@redhat.com>,
+ Alasdair G Kergon <agk@redhat.com>
+Subject: [18/99] dm snapshot: free exception store on init failure
+References: <20091106221358.309857998@mini.kroah.org>
+Content-Disposition: inline; filename=dm-snapshot-free-exception-store-on-init-failure.patch
+Content-Length: 1115
+Lines: 40
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Jonathan Brassow <jbrassow@redhat.com>
+
+commit 034a186d29dbcef099e57ab23ec39440596be911 upstream.
+
+While initializing the snapshot module, if we fail to register
+the snapshot target then we must back-out the exception store
+module initialization.
+
+Signed-off-by: Jonathan Brassow <jbrassow@redhat.com>
+Reviewed-by: Mikulas Patocka <mpatocka@redhat.com>
+Reviewed-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Alasdair G Kergon <agk@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/dm-snap.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/md/dm-snap.c
++++ b/drivers/md/dm-snap.c
+@@ -1465,7 +1465,7 @@ static int __init dm_snapshot_init(void)
+ r = dm_register_target(&snapshot_target);
+ if (r) {
+ DMERR("snapshot target register failed %d", r);
+- return r;
++ goto bad_register_snapshot_target;
+ }
+
+ r = dm_register_target(&origin_target);
+@@ -1522,6 +1522,9 @@ bad2:
+ dm_unregister_target(&origin_target);
+ bad1:
+ dm_unregister_target(&snapshot_target);
++
++bad_register_snapshot_target:
++ dm_exception_store_exit();
+ return r;
+ }
+
+
+
+From gregkh@mini.kroah.org Fri Nov 6 14:15:41 2009
+Message-Id: <20091106221541.185278978@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Fri, 06 Nov 2009 14:14:17 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Mikulas Patocka <mpatocka@redhat.com>,
+ Alasdair G Kergon <agk@redhat.com>
+Subject: [19/99] dm snapshot: sort by chunk size to fix race
+References: <20091106221358.309857998@mini.kroah.org>
+Content-Disposition: inline; filename=dm-snapshot-sort-by-chunk-size-to-fix-race.patch
+Content-Length: 2518
+Lines: 68
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+commit 6d45d93ead319423099b82a4efd775bc0f159121 upstream.
+
+Avoid a race causing corruption when snapshots of the same origin have
+different chunk sizes by sorting the internal list of snapshots by chunk
+size, largest first.
+ https://bugzilla.redhat.com/show_bug.cgi?id=182659
+
+For example, let's have two snapshots with different chunk sizes. The
+first snapshot (1) has small chunk size and the second snapshot (2) has
+large chunk size. Let's have chunks A, B, C in these snapshots:
+snapshot1: ====A==== ====B====
+snapshot2: ==========C==========
+
+(Chunk size is a power of 2. Chunks are aligned.)
+
+A write to the origin at a position within A and C comes along. It
+triggers reallocation of A, then reallocation of C and links them
+together using A as the 'primary' exception.
+
+Then another write to the origin comes along at a position within B and
+C. It creates pending exception for B. C already has a reallocation in
+progress and it already has a primary exception (A), so nothing is done
+to it: B and C are not linked.
+
+If the reallocation of B finishes before the reallocation of C, because
+there is no link with the pending exception for C it does not know to
+wait for it and, the second write is dispatched to the origin and causes
+data corruption in the chunk C in snapshot2.
+
+To avoid this situation, we maintain snapshots sorted in descending
+order of chunk size. This leads to a guaranteed ordering on the links
+between the pending exceptions and avoids the problem explained above -
+both A and B now get linked to C.
+
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Alasdair G Kergon <agk@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/dm-snap.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/drivers/md/dm-snap.c
++++ b/drivers/md/dm-snap.c
+@@ -296,6 +296,7 @@ static void __insert_origin(struct origi
+ */
+ static int register_snapshot(struct dm_snapshot *snap)
+ {
++ struct dm_snapshot *l;
+ struct origin *o, *new_o;
+ struct block_device *bdev = snap->origin->bdev;
+
+@@ -319,7 +320,11 @@ static int register_snapshot(struct dm_s
+ __insert_origin(o);
+ }
+
+- list_add_tail(&snap->list, &o->snapshots);
++ /* Sort the list according to chunk size, largest-first smallest-last */
++ list_for_each_entry(l, &o->snapshots, list)
++ if (l->store->chunk_size < snap->store->chunk_size)
++ break;
++ list_add_tail(&snap->list, &l->list);
+
+ up_write(&_origins_lock);
+ return 0;
+
+
+From gregkh@mini.kroah.org Fri Nov 6 14:15:41 2009
+Message-Id: <20091106221541.312749218@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Fri, 06 Nov 2009 14:14:18 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jonathan Brassow <jbrassow@redhat.com>,
+ Alasdair G Kergon <agk@redhat.com>
+Subject: [20/99] dm log: userspace fix incorrect luid cast in userspace_ctr
+References: <20091106221358.309857998@mini.kroah.org>
+Content-Disposition: inline; filename=dm-log-userspace-fix-incorrect-luid-cast-in-userspace_ctr.patch
+Content-Length: 861
+Lines: 30
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Andrew Morton <akpm@linux-foundation.org>
+
+commit bca915aae803cf01fde4461fc9c093cf5a86d7fc upstream.
+
+mips:
+
+drivers/md/dm-log-userspace-base.c: In function `userspace_ctr':
+drivers/md/dm-log-userspace-base.c:159: warning: cast from pointer to integer of different size
+
+Cc: Jonathan Brassow <jbrassow@redhat.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Alasdair G Kergon <agk@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/dm-log-userspace-base.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/md/dm-log-userspace-base.c
++++ b/drivers/md/dm-log-userspace-base.c
+@@ -156,7 +156,7 @@ static int userspace_ctr(struct dm_dirty
+ }
+
+ /* The ptr value is sufficient for local unique id */
+- lc->luid = (uint64_t)lc;
++ lc->luid = (unsigned long)lc;
+
+ lc->ti = ti;
+
+
+
+From gregkh@mini.kroah.org Fri Nov 6 14:15:41 2009
+Message-Id: <20091106221541.441256753@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Fri, 06 Nov 2009 14:14:19 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Zdenek Kabelac <zkabelac@redhat.com>,
+ Alasdair G Kergon <agk@redhat.com>
+Subject: [21/99] dm: add missing del_gendisk to alloc_dev error path
+References: <20091106221358.309857998@mini.kroah.org>
+Content-Disposition: inline; filename=dm-add-missing-del_gendisk-to-alloc_dev-error-path.patch
+Content-Length: 894
+Lines: 30
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Zdenek Kabelac <zkabelac@redhat.com>
+
+commit 03022c54b9725026c0370a810168975c387ad04c upstream.
+
+Add missing del_gendisk() to error path when creation of workqueue fails.
+Otherwice there is a resource leak and following warning is shown:
+
+WARNING: at fs/sysfs/dir.c:487 sysfs_add_one+0xc5/0x160()
+sysfs: cannot create duplicate filename '/devices/virtual/block/dm-0'
+
+Signed-off-by: Zdenek Kabelac <zkabelac@redhat.com>
+Reviewed-by: Jonathan Brassow <jbrassow@redhat.com>
+Signed-off-by: Alasdair G Kergon <agk@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/dm.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/md/dm.c
++++ b/drivers/md/dm.c
+@@ -1819,6 +1819,7 @@ static struct mapped_device *alloc_dev(i
+ bad_bdev:
+ destroy_workqueue(md->wq);
+ bad_thread:
++ del_gendisk(md->disk);
+ put_disk(md->disk);
+ bad_disk:
+ blk_cleanup_queue(md->queue);
+
+
+From gregkh@mini.kroah.org Fri Nov 6 14:15:41 2009
+Message-Id: <20091106221541.565594071@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Fri, 06 Nov 2009 14:14:20 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Kiyoshi Ueda <k-ueda@ct.jp.nec.com>,
+ Junichi Nomura <j-nomura@ce.jp.nec.com>,
+ Alasdair G Kergon <agk@redhat.com>
+Subject: [22/99] dm: dec_pending needs locking to save error value
+References: <20091106221358.309857998@mini.kroah.org>
+Content-Disposition: inline; filename=dm-dec_pending-needs-locking-to-save-error-value.patch
+Content-Length: 1738
+Lines: 57
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Kiyoshi Ueda <k-ueda@ct.jp.nec.com>
+
+commit f88fb981183e71daf40bbd84bc8251bbf7b59e19 upstream.
+
+Multiple instances of dec_pending() can run concurrently so a lock is
+needed when it saves the first error code.
+
+I have never experienced actual problem without locking and just found
+this during code inspection while implementing the barrier support
+patch for request-based dm.
+
+This patch adds the locking.
+I've done compile, boot and basic I/O testings.
+
+Signed-off-by: Kiyoshi Ueda <k-ueda@ct.jp.nec.com>
+Signed-off-by: Jun'ichi Nomura <j-nomura@ce.jp.nec.com>
+Signed-off-by: Alasdair G Kergon <agk@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/dm.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+--- a/drivers/md/dm.c
++++ b/drivers/md/dm.c
+@@ -47,6 +47,7 @@ struct dm_io {
+ atomic_t io_count;
+ struct bio *bio;
+ unsigned long start_time;
++ spinlock_t endio_lock;
+ };
+
+ /*
+@@ -576,8 +577,12 @@ static void dec_pending(struct dm_io *io
+ struct mapped_device *md = io->md;
+
+ /* Push-back supersedes any I/O errors */
+- if (error && !(io->error > 0 && __noflush_suspending(md)))
+- io->error = error;
++ if (unlikely(error)) {
++ spin_lock_irqsave(&io->endio_lock, flags);
++ if (!(io->error > 0 && __noflush_suspending(md)))
++ io->error = error;
++ spin_unlock_irqrestore(&io->endio_lock, flags);
++ }
+
+ if (atomic_dec_and_test(&io->io_count)) {
+ if (io->error == DM_ENDIO_REQUEUE) {
+@@ -1224,6 +1229,7 @@ static void __split_and_process_bio(stru
+ atomic_set(&ci.io->io_count, 1);
+ ci.io->bio = bio;
+ ci.io->md = md;
++ spin_lock_init(&ci.io->endio_lock);
+ ci.sector = bio->bi_sector;
+ ci.sector_count = bio_sectors(bio);
+ if (unlikely(bio_empty_barrier(bio)))
+
+
+From gregkh@mini.kroah.org Fri Nov 6 14:15:41 2009
+Message-Id: <20091106221541.685797967@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Fri, 06 Nov 2009 14:14:21 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Mikulas Patocka <mpatocka@redhat.com>,
+ Alasdair G Kergon <agk@redhat.com>
+Subject: [23/99] dm exception store: fix failed set_chunk_size error path
+References: <20091106221358.309857998@mini.kroah.org>
+Content-Disposition: inline; filename=dm-exception-store-fix-failed-set_chunk_size-error-path.patch
+Content-Length: 713
+Lines: 26
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+commit 0e8c4e4e3ebb15756ddc4170a88149a2cd323cfe upstream.
+
+Properly close the device if failing because of an invalid chunk size.
+
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Alasdair G Kergon <agk@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/dm-exception-store.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/md/dm-exception-store.c
++++ b/drivers/md/dm-exception-store.c
+@@ -251,7 +251,7 @@ int dm_exception_store_create(struct dm_
+
+ r = set_chunk_size(tmp_store, argv[2], &ti->error);
+ if (r)
+- goto bad_cow;
++ goto bad_ctr;
+
+ r = type->ctr(tmp_store, 0, NULL);
+ if (r) {
+
+
+From gregkh@mini.kroah.org Fri Nov 6 14:15:41 2009
+Message-Id: <20091106221541.821263847@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Fri, 06 Nov 2009 14:14:22 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Mikulas Patocka <mpatocka@redhat.com>,
+ Alasdair G Kergon <agk@redhat.com>
+Subject: [24/99] dm snapshot: lock snapshot while supplying status
+References: <20091106221358.309857998@mini.kroah.org>
+Content-Disposition: inline; filename=dm-snapshot-lock-snapshot-while-supplying-status.patch
+Content-Length: 896
+Lines: 37
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+commit 4c6fff445d7aa753957856278d4d93bcad6e2c14 upstream.
+
+This patch locks the snapshot when returning status. It fixes a race
+when it could return an invalid number of free chunks if someone
+was simultaneously modifying it.
+
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Alasdair G Kergon <agk@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/dm-snap.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/md/dm-snap.c
++++ b/drivers/md/dm-snap.c
+@@ -1147,6 +1147,8 @@ static int snapshot_status(struct dm_tar
+ unsigned sz = 0;
+ struct dm_snapshot *snap = ti->private;
+
++ down_write(&snap->lock);
++
+ switch (type) {
+ case STATUSTYPE_INFO:
+ if (!snap->valid)
+@@ -1178,6 +1180,8 @@ static int snapshot_status(struct dm_tar
+ break;
+ }
+
++ up_write(&snap->lock);
++
+ return 0;
+ }
+
+
+
+From gregkh@mini.kroah.org Fri Nov 6 14:15:42 2009
+Message-Id: <20091106221541.949266293@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Fri, 06 Nov 2009 14:14:23 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Mikulas Patocka <mpatocka@redhat.com>,
+ Alasdair G Kergon <agk@redhat.com>
+Subject: [25/99] dm snapshot: require non zero chunk size by end of ctr
+References: <20091106221358.309857998@mini.kroah.org>
+Content-Disposition: inline; filename=dm-snapshot-require-non-zero-chunk-size-by-end-of-ctr.patch
+Content-Length: 1096
+Lines: 33
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+commit 3f2412dc85260e5aae7ebb03bf50d5b1407e3083 upstream.
+
+If we are creating snapshot with memory-stored exception store, fail if
+the user didn't specify chunk size. Zero chunk size would probably crash
+a lot of places in the rest of snapshot code.
+
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Reviewed-by: Jonathan Brassow <jbrassow@redhat.com>
+Reviewed-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Alasdair G Kergon <agk@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/dm-snap.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/md/dm-snap.c
++++ b/drivers/md/dm-snap.c
+@@ -673,6 +673,11 @@ static int snapshot_ctr(struct dm_target
+ bio_list_init(&s->queued_bios);
+ INIT_WORK(&s->queued_bios_work, flush_queued_bios);
+
++ if (!s->store->chunk_size) {
++ ti->error = "Chunk size not set";
++ goto bad_load_and_register;
++ }
++
+ /* Add snapshot to the list of snapshots for this origin */
+ /* Exceptions aren't triggered till snapshot_resume() is called */
+ if (register_snapshot(s)) {
+
+
+From gregkh@mini.kroah.org Fri Nov 6 14:15:42 2009
+Message-Id: <20091106221542.080522228@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Fri, 06 Nov 2009 14:14:24 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Mikulas Patocka <mpatocka@redhat.com>,
+ Mike Snitzer <snitzer@redhat.com>,
+ Alasdair G Kergon <agk@redhat.com>
+Subject: [26/99] dm snapshot: use unsigned integer chunk size
+References: <20091106221358.309857998@mini.kroah.org>
+Content-Disposition: inline; filename=dm-snapshot-use-unsigned-integer-chunk-size.patch
+Content-Length: 5521
+Lines: 167
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+commit df96eee679ba28c98cf722fa7c9f4286ee1ed0bd upstream.
+
+Use unsigned integer chunk size.
+
+Maximum chunk size is 512kB, there won't ever be need to use 4GB chunk size,
+so the number can be 32-bit. This fixes compiler failure on 32-bit systems
+with large block devices.
+
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Reviewed-by: Jonathan Brassow <jbrassow@redhat.com>
+Signed-off-by: Alasdair G Kergon <agk@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/dm-exception-store.c | 20 +++++++++++---------
+ drivers/md/dm-exception-store.h | 8 ++++----
+ drivers/md/dm-snap-persistent.c | 16 ++++++++--------
+ drivers/md/dm-snap.c | 4 ++--
+ 4 files changed, 25 insertions(+), 23 deletions(-)
+
+--- a/drivers/md/dm-exception-store.c
++++ b/drivers/md/dm-exception-store.c
+@@ -155,7 +155,8 @@ static int set_chunk_size(struct dm_exce
+ char *value;
+
+ chunk_size_ulong = simple_strtoul(chunk_size_arg, &value, 10);
+- if (*chunk_size_arg == '\0' || *value != '\0') {
++ if (*chunk_size_arg == '\0' || *value != '\0' ||
++ chunk_size_ulong > UINT_MAX) {
+ *error = "Invalid chunk size";
+ return -EINVAL;
+ }
+@@ -171,34 +172,35 @@ static int set_chunk_size(struct dm_exce
+ */
+ chunk_size_ulong = round_up(chunk_size_ulong, PAGE_SIZE >> 9);
+
+- return dm_exception_store_set_chunk_size(store, chunk_size_ulong,
++ return dm_exception_store_set_chunk_size(store,
++ (unsigned) chunk_size_ulong,
+ error);
+ }
+
+ int dm_exception_store_set_chunk_size(struct dm_exception_store *store,
+- unsigned long chunk_size_ulong,
++ unsigned chunk_size,
+ char **error)
+ {
+ /* Check chunk_size is a power of 2 */
+- if (!is_power_of_2(chunk_size_ulong)) {
++ if (!is_power_of_2(chunk_size)) {
+ *error = "Chunk size is not a power of 2";
+ return -EINVAL;
+ }
+
+ /* Validate the chunk size against the device block size */
+- if (chunk_size_ulong % (bdev_logical_block_size(store->cow->bdev) >> 9)) {
++ if (chunk_size % (bdev_logical_block_size(store->cow->bdev) >> 9)) {
+ *error = "Chunk size is not a multiple of device blocksize";
+ return -EINVAL;
+ }
+
+- if (chunk_size_ulong > INT_MAX >> SECTOR_SHIFT) {
++ if (chunk_size > INT_MAX >> SECTOR_SHIFT) {
+ *error = "Chunk size is too high";
+ return -EINVAL;
+ }
+
+- store->chunk_size = chunk_size_ulong;
+- store->chunk_mask = chunk_size_ulong - 1;
+- store->chunk_shift = ffs(chunk_size_ulong) - 1;
++ store->chunk_size = chunk_size;
++ store->chunk_mask = chunk_size - 1;
++ store->chunk_shift = ffs(chunk_size) - 1;
+
+ return 0;
+ }
+--- a/drivers/md/dm-exception-store.h
++++ b/drivers/md/dm-exception-store.h
+@@ -101,9 +101,9 @@ struct dm_exception_store {
+ struct dm_dev *cow;
+
+ /* Size of data blocks saved - must be a power of 2 */
+- chunk_t chunk_size;
+- chunk_t chunk_mask;
+- chunk_t chunk_shift;
++ unsigned chunk_size;
++ unsigned chunk_mask;
++ unsigned chunk_shift;
+
+ void *context;
+ };
+@@ -169,7 +169,7 @@ int dm_exception_store_type_register(str
+ int dm_exception_store_type_unregister(struct dm_exception_store_type *type);
+
+ int dm_exception_store_set_chunk_size(struct dm_exception_store *store,
+- unsigned long chunk_size_ulong,
++ unsigned chunk_size,
+ char **error);
+
+ int dm_exception_store_create(struct dm_target *ti, int argc, char **argv,
+--- a/drivers/md/dm-snap.c
++++ b/drivers/md/dm-snap.c
+@@ -961,7 +961,7 @@ static void start_copy(struct dm_snap_pe
+
+ src.bdev = bdev;
+ src.sector = chunk_to_sector(s->store, pe->e.old_chunk);
+- src.count = min(s->store->chunk_size, dev_size - src.sector);
++ src.count = min((sector_t)s->store->chunk_size, dev_size - src.sector);
+
+ dest.bdev = s->store->cow->bdev;
+ dest.sector = chunk_to_sector(s->store, pe->e.new_chunk);
+@@ -1402,7 +1402,7 @@ static void origin_resume(struct dm_targ
+ struct dm_dev *dev = ti->private;
+ struct dm_snapshot *snap;
+ struct origin *o;
+- chunk_t chunk_size = 0;
++ unsigned chunk_size = 0;
+
+ down_read(&_origins_lock);
+ o = __lookup_origin(dev->bdev);
+--- a/drivers/md/dm-snap-persistent.c
++++ b/drivers/md/dm-snap-persistent.c
+@@ -284,12 +284,13 @@ static int read_header(struct pstore *ps
+ {
+ int r;
+ struct disk_header *dh;
+- chunk_t chunk_size;
++ unsigned chunk_size;
+ int chunk_size_supplied = 1;
+ char *chunk_err;
+
+ /*
+- * Use default chunk size (or hardsect_size, if larger) if none supplied
++ * Use default chunk size (or logical_block_size, if larger)
++ * if none supplied
+ */
+ if (!ps->store->chunk_size) {
+ ps->store->chunk_size = max(DM_CHUNK_SIZE_DEFAULT_SECTORS,
+@@ -334,10 +335,9 @@ static int read_header(struct pstore *ps
+ return 0;
+
+ if (chunk_size_supplied)
+- DMWARN("chunk size %llu in device metadata overrides "
+- "table chunk size of %llu.",
+- (unsigned long long)chunk_size,
+- (unsigned long long)ps->store->chunk_size);
++ DMWARN("chunk size %u in device metadata overrides "
++ "table chunk size of %u.",
++ chunk_size, ps->store->chunk_size);
+
+ /* We had a bogus chunk_size. Fix stuff up. */
+ free_area(ps);
+@@ -345,8 +345,8 @@ static int read_header(struct pstore *ps
+ r = dm_exception_store_set_chunk_size(ps->store, chunk_size,
+ &chunk_err);
+ if (r) {
+- DMERR("invalid on-disk chunk size %llu: %s.",
+- (unsigned long long)chunk_size, chunk_err);
++ DMERR("invalid on-disk chunk size %u: %s.",
++ chunk_size, chunk_err);
+ return r;
+ }
+
+
+
+From gregkh@mini.kroah.org Fri Nov 6 14:15:42 2009
+Message-Id: <20091106221542.205393474@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Fri, 06 Nov 2009 14:14:25 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Alan Cox <alan@linux.intel.com>
+Subject: [27/99] ray_cs: Fix copy_from_user handling
+References: <20091106221358.309857998@mini.kroah.org>
+Content-Disposition: inline; filename=ray_cs-fix-copy_from_user-handling.patch
+Content-Length: 719
+Lines: 26
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Alan Cox <alan@linux.intel.com>
+
+commit 575c9ed7798218dc923f319c0d78f0c25ca506b9 upstream.
+
+I've not touched the other stuff here but the word "locking" comes to mind.
+
+Signed-off-by: Alan Cox <alan@linux.intel.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/ray_cs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/ray_cs.c
++++ b/drivers/net/wireless/ray_cs.c
+@@ -2878,7 +2878,7 @@ static int write_essid(struct file *file
+ unsigned long count, void *data)
+ {
+ static char proc_essid[33];
+- int len = count;
++ unsigned int len = count;
+
+ if (len > 32)
+ len = 32;
+
+
+From gregkh@mini.kroah.org Fri Nov 6 14:15:42 2009
+Message-Id: <20091106221542.333265650@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Fri, 06 Nov 2009 14:14:26 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>,
+ Christoph Lameter <cl@linux-foundation.org>
+Subject: [28/99] mbind(): fix leak of never putback pages
+References: <20091106221358.309857998@mini.kroah.org>
+Content-Disposition: inline; filename=mbind-fix-leak-of-never-putback-pages.patch
+Content-Length: 2100
+Lines: 101
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
+
+commit ab8a3e14e6f8e567560f664bbd29aefb306a274e upstream.
+
+If mbind() receives an invalid address, do_mbind leaks a page. The
+following test program detects this leak.
+
+This patch fixes it.
+
+migrate_efault.c
+=======================================
+ #include <numaif.h>
+ #include <numa.h>
+ #include <sys/mman.h>
+ #include <stdio.h>
+ #include <unistd.h>
+ #include <stdlib.h>
+ #include <string.h>
+
+static unsigned long pagesize;
+
+static void* make_hole_mapping(void)
+{
+
+ void* addr;
+
+ addr = mmap(NULL, pagesize*3, PROT_READ|PROT_WRITE,
+ MAP_ANON|MAP_PRIVATE, 0, 0);
+ if (addr == MAP_FAILED)
+ return NULL;
+
+ /* make page populate */
+ memset(addr, 0, pagesize*3);
+
+ /* make memory hole */
+ munmap(addr+pagesize, pagesize);
+
+ return addr;
+}
+
+int main(int argc, char** argv)
+{
+ void* addr;
+ int ch;
+ int node;
+ struct bitmask *nmask = numa_allocate_nodemask();
+ int err;
+ int node_set = 0;
+
+ while ((ch = getopt(argc, argv, "n:")) != -1){
+ switch (ch){
+ case 'n':
+ node = strtol(optarg, NULL, 0);
+ numa_bitmask_setbit(nmask, node);
+ node_set = 1;
+ break;
+ default:
+ ;
+ }
+ }
+ argc -= optind;
+ argv += optind;
+
+ if (!node_set)
+ numa_bitmask_setbit(nmask, 0);
+
+ pagesize = getpagesize();
+
+ addr = make_hole_mapping();
+
+ err = mbind(addr, pagesize*3, MPOL_BIND, nmask->maskp, nmask->size, MPOL_MF_MOVE_ALL);
+ if (err)
+ perror("mbind ");
+
+ return 0;
+}
+=======================================
+
+Signed-off-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
+Acked-by: Christoph Lameter <cl@linux-foundation.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ mm/mempolicy.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/mm/mempolicy.c
++++ b/mm/mempolicy.c
+@@ -1058,7 +1058,8 @@ static long do_mbind(unsigned long start
+
+ if (!err && nr_failed && (flags & MPOL_MF_STRICT))
+ err = -EIO;
+- }
++ } else
++ putback_lru_pages(&pagelist);
+
+ up_write(&mm->mmap_sem);
+ mpol_put(new);
+
+
+From gregkh@mini.kroah.org Fri Nov 6 14:15:42 2009
+Message-Id: <20091106221542.455186736@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Fri, 06 Nov 2009 14:14:27 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>,
+ Christoph Lameter <cl@linux-foundation.org>
+Subject: [29/99] do_mbind(): fix memory leak
+References: <20091106221358.309857998@mini.kroah.org>
+Content-Disposition: inline; filename=do_mbind-fix-memory-leak.patch
+Content-Length: 1245
+Lines: 50
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
+
+commit b05ca7385a2848abdc72051f832722641daed8b0 upstream.
+
+If migrate_prep is failed, new variable is leaked. This patch fixes it.
+
+Signed-off-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
+Acked-by: Christoph Lameter <cl@linux-foundation.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ mm/mempolicy.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+--- a/mm/mempolicy.c
++++ b/mm/mempolicy.c
+@@ -1024,7 +1024,7 @@ static long do_mbind(unsigned long start
+
+ err = migrate_prep();
+ if (err)
+- return err;
++ goto mpol_out;
+ }
+ {
+ NODEMASK_SCRATCH(scratch);
+@@ -1039,10 +1039,9 @@ static long do_mbind(unsigned long start
+ err = -ENOMEM;
+ NODEMASK_SCRATCH_FREE(scratch);
+ }
+- if (err) {
+- mpol_put(new);
+- return err;
+- }
++ if (err)
++ goto mpol_out;
++
+ vma = check_range(mm, start, end, nmask,
+ flags | MPOL_MF_INVERT, &pagelist);
+
+@@ -1062,6 +1061,7 @@ static long do_mbind(unsigned long start
+ putback_lru_pages(&pagelist);
+
+ up_write(&mm->mmap_sem);
++ mpol_out:
+ mpol_put(new);
+ return err;
+ }
+
+
+From gregkh@mini.kroah.org Fri Nov 6 14:15:42 2009
+Message-Id: <20091106221542.613588302@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Fri, 06 Nov 2009 14:14:28 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Benjamin Herrenschmidt <benh@kernel.crashing.org>,
+ Alan Cox <alan@linux.intel.com>,
+ Michael Reed <mreed10@us.ibm.com>
+Subject: [30/99] 8250_pci: add IBM Saturn serial card
+References: <20091106221358.309857998@mini.kroah.org>
+Content-Disposition: inline; filename=8250_pci-add-ibm-saturn-serial-card.patch
+Content-Length: 2173
+Lines: 69
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+
+commit c68d2b1594548cda7f6dbac6a4d9d30a9b01558c upstream.
+
+The IBM Saturn serial card has only one port. Without that fixup,
+the kernel thinks it has two, which confuses userland setup and
+admin tools as well.
+
+[akpm@linux-foundation.org: fix pci-ids.h layout]
+Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Acked-by: Alan Cox <alan@linux.intel.com>
+Cc: Michael Reed <mreed10@us.ibm.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Acked-by: Alan Cox <alan@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/serial/8250_pci.c | 11 +++++++++++
+ include/linux/pci_ids.h | 3 +++
+ 2 files changed, 14 insertions(+)
+
+--- a/drivers/serial/8250_pci.c
++++ b/drivers/serial/8250_pci.c
+@@ -1561,6 +1561,7 @@ enum pci_board_num_t {
+ pbn_exar_XR17C152,
+ pbn_exar_XR17C154,
+ pbn_exar_XR17C158,
++ pbn_exar_ibm_saturn,
+ pbn_pasemi_1682M,
+ pbn_ni8430_2,
+ pbn_ni8430_4,
+@@ -2146,6 +2147,13 @@ static struct pciserial_board pci_boards
+ .base_baud = 921600,
+ .uart_offset = 0x200,
+ },
++ [pbn_exar_ibm_saturn] = {
++ .flags = FL_BASE0,
++ .num_ports = 1,
++ .base_baud = 921600,
++ .uart_offset = 0x200,
++ },
++
+ /*
+ * PA Semi PWRficient PA6T-1682M on-chip UART
+ */
+@@ -2649,6 +2657,9 @@ static struct pci_device_id serial_pci_t
+ PCI_SUBVENDOR_ID_CONNECT_TECH,
+ PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_8_485, 0, 0,
+ pbn_b0_8_1843200_200 },
++ { PCI_VENDOR_ID_EXAR, PCI_DEVICE_ID_EXAR_XR17C152,
++ PCI_VENDOR_ID_IBM, PCI_SUBDEVICE_ID_IBM_SATURN_SERIAL_ONE_PORT,
++ 0, 0, pbn_exar_ibm_saturn },
+
+ { PCI_VENDOR_ID_SEALEVEL, PCI_DEVICE_ID_SEALEVEL_U530,
+ PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+--- a/include/linux/pci_ids.h
++++ b/include/linux/pci_ids.h
+@@ -479,6 +479,9 @@
+ #define PCI_DEVICE_ID_IBM_ICOM_V2_ONE_PORT_RVX_ONE_PORT_MDM_PCIE 0x0361
+ #define PCI_DEVICE_ID_IBM_ICOM_FOUR_PORT_MODEL 0x252
+
++#define PCI_SUBVENDOR_ID_IBM 0x1014
++#define PCI_SUBDEVICE_ID_IBM_SATURN_SERIAL_ONE_PORT 0x03d4
++
+ #define PCI_VENDOR_ID_UNISYS 0x1018
+ #define PCI_DEVICE_ID_UNISYS_DMA_DIRECTOR 0x001C
+
+
+
+From gregkh@mini.kroah.org Fri Nov 6 14:15:42 2009
+Message-Id: <20091106221542.713075246@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Fri, 06 Nov 2009 14:14:29 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Alan Cox <alan@linux.intel.com>
+Subject: [31/99] dpt_i2o: Fix up copy*user
+References: <20091106221358.309857998@mini.kroah.org>
+Content-Disposition: inline; filename=dpt_i2o-fix-up-copy-user.patch
+Content-Length: 680
+Lines: 26
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Alan Cox <alan@linux.intel.com>
+
+commit ef7562b7f28319e6dd1f85dc1af87df2a7a84832 upstream.
+
+Signed-off-by: Alan Cox <alan@linux.intel.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/scsi/dpt_i2o.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/scsi/dpt_i2o.c
++++ b/drivers/scsi/dpt_i2o.c
+@@ -1918,6 +1918,10 @@ static int adpt_i2o_passthru(adpt_hba* p
+ }
+ size = size>>16;
+ size *= 4;
++ if (size > MAX_MESSAGE_SIZE) {
++ rcode = EINVAL;
++ goto cleanup;
++ }
+ /* Copy in the user's I2O command */
+ if (copy_from_user (msg, user_msg, size)) {
+ rcode = -EFAULT;
+
+
+From gregkh@mini.kroah.org Fri Nov 6 14:15:42 2009
+Message-Id: <20091106221542.845204599@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Fri, 06 Nov 2009 14:14:30 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>,
+ Alan Cox <alan@linux.intel.com>
+Subject: [32/99] dpt_i2o: Fix typo of EINVAL
+References: <20091106221358.309857998@mini.kroah.org>
+Content-Disposition: inline; filename=dpt_i2o-fix-typo-of-einval.patch
+Content-Length: 824
+Lines: 28
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
+
+commit aefba418bfecd1985a08f50a95bd854a119f0153 upstream.
+
+Commit ef7562b7f28319e6dd1f85dc1af87df2a7a84832 ("dpt_i2o: Fix up
+copy*user") had a silly typo: EINVAL should be -EINVAL.
+
+Signed-off-by: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
+Cc: Alan Cox <alan@linux.intel.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/scsi/dpt_i2o.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/scsi/dpt_i2o.c
++++ b/drivers/scsi/dpt_i2o.c
+@@ -1919,7 +1919,7 @@ static int adpt_i2o_passthru(adpt_hba* p
+ size = size>>16;
+ size *= 4;
+ if (size > MAX_MESSAGE_SIZE) {
+- rcode = EINVAL;
++ rcode = -EINVAL;
+ goto cleanup;
+ }
+ /* Copy in the user's I2O command */
+
+
+From gregkh@mini.kroah.org Fri Nov 6 14:15:43 2009
+Message-Id: <20091106221542.973446321@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Fri, 06 Nov 2009 14:14:31 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Ben Hutchings <ben@decadent.org.uk>,
+ Eric Sesterhenn <snakebyte@gmx.de>,
+ Roman Zippel <zippel@linux-m68k.org>
+Subject: [33/99] hfsplus: refuse to mount volumes larger than 2TB
+References: <20091106221358.309857998@mini.kroah.org>
+Content-Disposition: inline; filename=hfsplus-refuse-to-mount-volumes-larger-than-2tb.patch
+Content-Length: 1480
+Lines: 43
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Ben Hutchings <ben@decadent.org.uk>
+
+commit 5c36fe3d87b3f0c85894a49193c66096a3d6b26f upstream.
+
+As found in <http://bugs.debian.org/550010>, hfsplus is using type u32
+rather than sector_t for some sector number calculations.
+
+In particular, hfsplus_get_block() does:
+
+ u32 ablock, dblock, mask;
+...
+ map_bh(bh_result, sb, (dblock << HFSPLUS_SB(sb).fs_shift) + HFSPLUS_SB(sb).blockoffset + (iblock & mask));
+
+I am not confident that I can find and fix all cases where a sector number
+may be truncated. For now, avoid data loss by refusing to mount HFS+
+volumes with more than 2^32 sectors (2TB).
+
+[akpm@linux-foundation.org: fix 32 and 64-bit issues]
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+Cc: Eric Sesterhenn <snakebyte@gmx.de>
+Cc: Roman Zippel <zippel@linux-m68k.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/hfsplus/wrapper.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/fs/hfsplus/wrapper.c
++++ b/fs/hfsplus/wrapper.c
+@@ -99,6 +99,10 @@ int hfsplus_read_wrapper(struct super_bl
+
+ if (hfsplus_get_last_session(sb, &part_start, &part_size))
+ return -EINVAL;
++ if ((u64)part_start + part_size > 0x100000000ULL) {
++ pr_err("hfs: volumes larger than 2TB are not supported yet\n");
++ return -EINVAL;
++ }
+ while (1) {
+ bh = sb_bread512(sb, part_start + HFSPLUS_VOLHEAD_SECTOR, vhdr);
+ if (!bh)
+
+
+From gregkh@mini.kroah.org Fri Nov 6 14:15:43 2009
+Message-Id: <20091106221543.125163308@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Fri, 06 Nov 2009 14:14:32 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Stas Sergeev <stsp@aknet.ru>
+Subject: [34/99] Driver core: fix driver_register() return value
+References: <20091106221358.309857998@mini.kroah.org>
+Content-Disposition: inline; filename=driver-core-fix-driver_register-return-value.patch
+Content-Length: 1078
+Lines: 31
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Stas Sergeev <stsp@aknet.ru>
+
+commit 39acbc12affcaa23ef1d887ba3d197baca8e6e47 upstream.
+
+In this patch:
+http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=16dc42e018c2868211b4928f20a957c0c216126c
+the check was added for another driver to already claim the same device
+on the same bus. But the returned error code was wrong: to modprobe, the
+-EEXIST means that _this_ driver is already installed. It therefore
+doesn't produce the needed error message when _another_ driver is trying
+to register for the same device. Returning -EBUSY fixes the problem.
+
+Signed-off-by: Stas Sergeev <stsp@aknet.ru>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/base/driver.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/base/driver.c
++++ b/drivers/base/driver.c
+@@ -236,7 +236,7 @@ int driver_register(struct device_driver
+ put_driver(other);
+ printk(KERN_ERR "Error: Driver '%s' is already registered, "
+ "aborting...\n", drv->name);
+- return -EEXIST;
++ return -EBUSY;
+ }
+
+ ret = bus_add_driver(drv);
+
+
+From gregkh@mini.kroah.org Fri Nov 6 14:15:43 2009
+Message-Id: <20091106221543.293510879@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Fri, 06 Nov 2009 14:14:33 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Alan Cox <alan@linux.intel.com>
+Subject: [35/99] tty: Mark generic_serial users as BROKEN
+References: <20091106221358.309857998@mini.kroah.org>
+Content-Disposition: inline; filename=tty-mark-generic_serial-users-as-broken.patch
+Content-Length: 2451
+Lines: 73
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Alan Cox <alan@linux.intel.com>
+
+commit 412145947adfca60a4b5b4893fbae82dffa25edd upstream.
+
+There isn't much else I can do with these. I can find no hardware for any
+of them and no users. The code is broken.
+
+Signed-off-by: Alan Cox <alan@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/m68k/Kconfig | 6 +++---
+ drivers/char/Kconfig | 6 +++---
+ 2 files changed, 6 insertions(+), 6 deletions(-)
+
+--- a/arch/m68k/Kconfig
++++ b/arch/m68k/Kconfig
+@@ -555,7 +555,7 @@ config HPAPCI
+
+ config MVME147_SCC
+ bool "SCC support for MVME147 serial ports"
+- depends on MVME147
++ depends on MVME147 && BROKEN
+ help
+ This is the driver for the serial ports on the Motorola MVME147
+ boards. Everyone using one of these boards should say Y here.
+@@ -570,14 +570,14 @@ config SERIAL167
+
+ config MVME162_SCC
+ bool "SCC support for MVME162 serial ports"
+- depends on MVME16x
++ depends on MVME16x && BROKEN
+ help
+ This is the driver for the serial ports on the Motorola MVME162 and
+ 172 boards. Everyone using one of these boards should say Y here.
+
+ config BVME6000_SCC
+ bool "SCC support for BVME6000 serial ports"
+- depends on BVME6000
++ depends on BVME6000 && BROKEN
+ help
+ This is the driver for the serial ports on the BVME4000 and BVME6000
+ boards from BVM Ltd. Everyone using one of these boards should say
+--- a/drivers/char/Kconfig
++++ b/drivers/char/Kconfig
+@@ -323,7 +323,7 @@ config SPECIALIX
+
+ config SX
+ tristate "Specialix SX (and SI) card support"
+- depends on SERIAL_NONSTANDARD && (PCI || EISA || ISA)
++ depends on SERIAL_NONSTANDARD && (PCI || EISA || ISA) && BROKEN
+ help
+ This is a driver for the SX and SI multiport serial cards.
+ Please read the file <file:Documentation/serial/sx.txt> for details.
+@@ -334,7 +334,7 @@ config SX
+
+ config RIO
+ tristate "Specialix RIO system support"
+- depends on SERIAL_NONSTANDARD
++ depends on SERIAL_NONSTANDARD && BROKEN
+ help
+ This is a driver for the Specialix RIO, a smart serial card which
+ drives an outboard box that can support up to 128 ports. Product
+@@ -395,7 +395,7 @@ config NOZOMI
+
+ config A2232
+ tristate "Commodore A2232 serial support (EXPERIMENTAL)"
+- depends on EXPERIMENTAL && ZORRO && BROKEN_ON_SMP
++ depends on EXPERIMENTAL && ZORRO && BROKEN
+ ---help---
+ This option supports the 2232 7-port serial card shipped with the
+ Amiga 2000 and other Zorro-bus machines, dating from 1989. At
+
+
+From gregkh@mini.kroah.org Fri Nov 6 14:15:43 2009
+Message-Id: <20091106221543.453166367@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Fri, 06 Nov 2009 14:14:34 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Sitsofe Wheeler <sitsofe@yahoo.com>,
+ Frederic Weisbecker <fweisbec@gmail.com>,
+ Christof Schmitt <christof.schmitt@de.ibm.com>,
+ Rusty Russell <rusty@rustcorp.com.au>
+Subject: [36/99] param: fix lots of bugs with writing charp params from sysfs, by leaking mem.
+References: <20091106221358.309857998@mini.kroah.org>
+Content-Disposition: inline; filename=param-fix-lots-of-bugs-with-writing-charp-params-from-sysfs-by-leaking-mem.patch
+Content-Length: 2526
+Lines: 73
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Rusty Russell <rusty@rustcorp.com.au>
+
+commit 65afac7d80ab3bc9f81e75eafb71eeb92a3ebdef upstream.
+
+e180a6b7759a "param: fix charp parameters set via sysfs" fixed the case
+where charp parameters written via sysfs were freed, leaving drivers
+accessing random memory.
+
+Unfortunately, storing a flag in the kparam struct was a bad idea: it's
+rodata so setting it causes an oops on some archs. But that's not all:
+
+1) module_param_array() on charp doesn't work reliably, since we use an
+ uninitialized temporary struct kernel_param.
+2) there's a fundamental race if a module uses this parameter and then
+ it's changed: they will still access the old, freed, memory.
+
+The simplest fix (ie. for 2.6.32) is to never free the memory. This
+prevents all these problems, at cost of a memory leak. In practice, there
+are only 18 places where a charp is writable via sysfs, and all are
+root-only writable.
+
+Reported-by: Takashi Iwai <tiwai@suse.de>
+Cc: Sitsofe Wheeler <sitsofe@yahoo.com>
+Cc: Frederic Weisbecker <fweisbec@gmail.com>
+Cc: Christof Schmitt <christof.schmitt@de.ibm.com>
+Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ include/linux/moduleparam.h | 1 -
+ kernel/params.c | 10 +---------
+ 2 files changed, 1 insertion(+), 10 deletions(-)
+
+--- a/include/linux/moduleparam.h
++++ b/include/linux/moduleparam.h
+@@ -37,7 +37,6 @@ typedef int (*param_set_fn)(const char *
+ typedef int (*param_get_fn)(char *buffer, struct kernel_param *kp);
+
+ /* Flag bits for kernel_param.flags */
+-#define KPARAM_KMALLOCED 1
+ #define KPARAM_ISBOOL 2
+
+ struct kernel_param {
+--- a/kernel/params.c
++++ b/kernel/params.c
+@@ -217,13 +217,9 @@ int param_set_charp(const char *val, str
+ return -ENOSPC;
+ }
+
+- if (kp->flags & KPARAM_KMALLOCED)
+- kfree(*(char **)kp->arg);
+-
+ /* This is a hack. We can't need to strdup in early boot, and we
+ * don't need to; this mangled commandline is preserved. */
+ if (slab_is_available()) {
+- kp->flags |= KPARAM_KMALLOCED;
+ *(char **)kp->arg = kstrdup(val, GFP_KERNEL);
+ if (!kp->arg)
+ return -ENOMEM;
+@@ -604,11 +600,7 @@ void module_param_sysfs_remove(struct mo
+
+ void destroy_params(const struct kernel_param *params, unsigned num)
+ {
+- unsigned int i;
+-
+- for (i = 0; i < num; i++)
+- if (params[i].flags & KPARAM_KMALLOCED)
+- kfree(*(char **)params[i].arg);
++ /* FIXME: This should free kmalloced charp parameters. It doesn't. */
+ }
+
+ static void __init kernel_add_sysfs_param(const char *name,
+
+
+From gregkh@mini.kroah.org Fri Nov 6 14:15:43 2009
+Message-Id: <20091106221543.601055424@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Fri, 06 Nov 2009 14:14:35 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Rusty Russell <rusty@rustcorp.com.au>
+Subject: [37/99] param: fix NULL comparison on oom
+References: <20091106221358.309857998@mini.kroah.org>
+Content-Disposition: inline; filename=param-fix-null-comparison-on-oom.patch
+Content-Length: 757
+Lines: 26
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Rusty Russell <rusty@rustcorp.com.au>
+
+commit d553ad864e3b3dde3f1038d491e207021b2d6293 upstream.
+
+kp->arg is always true: it's the contents of that pointer we care about.
+
+Reported-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/params.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/kernel/params.c
++++ b/kernel/params.c
+@@ -221,7 +221,7 @@ int param_set_charp(const char *val, str
+ * don't need to; this mangled commandline is preserved. */
+ if (slab_is_available()) {
+ *(char **)kp->arg = kstrdup(val, GFP_KERNEL);
+- if (!kp->arg)
++ if (!*(char **)kp->arg)
+ return -ENOMEM;
+ } else
+ *(const char **)kp->arg = val;
+
+
+From gregkh@mini.kroah.org Fri Nov 6 14:15:43 2009
+Message-Id: <20091106221543.777556060@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Fri, 06 Nov 2009 14:14:36 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Rusty Russell <rusty@rustcorp.com.au>
+Subject: [38/99] param: fix setting arrays of bool
+References: <20091106221358.309857998@mini.kroah.org>
+Content-Disposition: inline; filename=param-fix-setting-arrays-of-bool.patch
+Content-Length: 1439
+Lines: 46
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Rusty Russell <rusty@rustcorp.com.au>
+
+commit 3c7d76e371ac1a3802ae1673f5c63554af59325c upstream.
+
+We create a dummy struct kernel_param on the stack for parsing each
+array element, but we didn't initialize the flags word. This matters
+for arrays of type "bool", where the flag indicates if it really is
+an array of bools or unsigned int (old-style).
+
+Reported-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/params.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/kernel/params.c
++++ b/kernel/params.c
+@@ -299,6 +299,7 @@ static int param_array(const char *name,
+ unsigned int min, unsigned int max,
+ void *elem, int elemsize,
+ int (*set)(const char *, struct kernel_param *kp),
++ u16 flags,
+ unsigned int *num)
+ {
+ int ret;
+@@ -308,6 +309,7 @@ static int param_array(const char *name,
+ /* Get the name right for errors. */
+ kp.name = name;
+ kp.arg = elem;
++ kp.flags = flags;
+
+ /* No equals sign? */
+ if (!val) {
+@@ -353,7 +355,8 @@ int param_array_set(const char *val, str
+ unsigned int temp_num;
+
+ return param_array(kp->name, val, 1, arr->max, arr->elem,
+- arr->elemsize, arr->set, arr->num ?: &temp_num);
++ arr->elemsize, arr->set, kp->flags,
++ arr->num ?: &temp_num);
+ }
+
+ int param_array_get(char *buffer, struct kernel_param *kp)
+
+
+From gregkh@mini.kroah.org Fri Nov 6 14:15:44 2009
+Message-Id: <20091106221543.922283323@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Fri, 06 Nov 2009 14:14:37 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Elina Pasheva <epasheva@sierrawireless.com>
+Subject: [39/99] USB: serial: sierra driver send_setup() autopm fix
+References: <20091106221358.309857998@mini.kroah.org>
+Content-Disposition: inline; filename=usb-serial-sierra-driver-send_setup-autopm-fix.patch
+Content-Length: 2001
+Lines: 66
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Elina Pasheva <epasheva@sierrawireless.com>
+
+commit 3c77d5137d3f4ff41721e9b4f4812db56a6065c0 upstream.
+
+This patch presents a fix for the autosuspend feature implementation in
+sierra usb serial driver for function sierra_send_setup(). Because it
+is possible to call sierra_send_setup() before sierra_open() or after
+sierra_close() we added a get/put interface activity to assure that the
+usb control can happen even when the device is autosuspended.
+
+Signed-off-by: Elina Pasheva <epasheva@sierrawireless.com>
+Tested-by: Matthew Safar <msafar@sierrawireless.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/serial/sierra.c | 23 ++++++++++++++---------
+ 1 file changed, 14 insertions(+), 9 deletions(-)
+
+--- a/drivers/usb/serial/sierra.c
++++ b/drivers/usb/serial/sierra.c
+@@ -287,6 +287,8 @@ static int sierra_send_setup(struct usb_
+ struct sierra_port_private *portdata;
+ __u16 interface = 0;
+ int val = 0;
++ int do_send = 0;
++ int retval;
+
+ dev_dbg(&port->dev, "%s\n", __func__);
+
+@@ -305,10 +307,7 @@ static int sierra_send_setup(struct usb_
+ */
+ if (port->interrupt_in_urb) {
+ /* send control message */
+- return usb_control_msg(serial->dev,
+- usb_rcvctrlpipe(serial->dev, 0),
+- 0x22, 0x21, val, interface,
+- NULL, 0, USB_CTRL_SET_TIMEOUT);
++ do_send = 1;
+ }
+ }
+
+@@ -320,12 +319,18 @@ static int sierra_send_setup(struct usb_
+ interface = 1;
+ else if (port->bulk_out_endpointAddress == 5)
+ interface = 2;
+- return usb_control_msg(serial->dev,
+- usb_rcvctrlpipe(serial->dev, 0),
+- 0x22, 0x21, val, interface,
+- NULL, 0, USB_CTRL_SET_TIMEOUT);
++
++ do_send = 1;
+ }
+- return 0;
++ if (!do_send)
++ return 0;
++
++ usb_autopm_get_interface(serial->interface);
++ retval = usb_control_msg(serial->dev, usb_rcvctrlpipe(serial->dev, 0),
++ 0x22, 0x21, val, interface, NULL, 0, USB_CTRL_SET_TIMEOUT);
++ usb_autopm_put_interface(serial->interface);
++
++ return retval;
+ }
+
+ static void sierra_set_termios(struct tty_struct *tty,
+
+
+From gregkh@mini.kroah.org Fri Nov 6 14:15:44 2009
+Message-Id: <20091106221544.085690413@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Fri, 06 Nov 2009 14:14:38 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk
+Subject: [40/99] USB: option: Patch for Huawei Mobile Broadband E270+ Modem
+References: <20091106221358.309857998@mini.kroah.org>
+Content-Disposition: inline; filename=usb-option-patch-for-huawei-mobile-broadband-e270-modem.patch
+Content-Length: 1262
+Lines: 29
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Ronnie Furuskog <rofu7@hotmail.com>
+
+commit 0ee3a33a0481c8f5c9edb7a5a02f3c76496d9551 upstream.
+
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/serial/option.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -166,6 +166,7 @@ static int option_resume(struct usb_ser
+ #define HUAWEI_PRODUCT_E143D 0x143D
+ #define HUAWEI_PRODUCT_E143E 0x143E
+ #define HUAWEI_PRODUCT_E143F 0x143F
++#define HUAWEI_PRODUCT_E14AC 0x14AC
+
+ #define QUANTA_VENDOR_ID 0x0408
+ #define QUANTA_PRODUCT_Q101 0xEA02
+@@ -426,6 +427,7 @@ static struct usb_device_id option_ids[]
+ { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E143D, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E143E, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E143F, 0xff, 0xff, 0xff) },
++ { USB_DEVICE(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E14AC) },
+ { USB_DEVICE(AMOI_VENDOR_ID, AMOI_PRODUCT_9508) },
+ { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_V640) }, /* Novatel Merlin V640/XV620 */
+ { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_V620) }, /* Novatel Merlin V620/S620 */
+
+
+From gregkh@mini.kroah.org Fri Nov 6 14:15:44 2009
+Message-Id: <20091106221544.215126415@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Fri, 06 Nov 2009 14:14:39 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Huzaifa Sidhpurwala <sidhpurwala.huzaifa@gmail.com>
+Subject: [41/99] USB: option: Support for AIRPLUS MCD650 Datacard
+References: <20091106221358.309857998@mini.kroah.org>
+Content-Disposition: inline; filename=usb-option-support-for-airplus-mcd650-datacard.patch
+Content-Length: 1261
+Lines: 37
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Huzaifa Sidhpurwala <sidhpurwala.huzaifa@gmail.com>
+
+commit 12148da6722be3b44c2220206b6ccb80d2d9d8f8 upstream.
+
+Here is a patch for Airplus MCD 650 card
+
+Note: This device is with Victor V Kudlak, and he confirmed that this
+device works with the patch.
+
+Signed-off-by: Huzaifa Sidhpurwala <sidhpurwala.huzaifa@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/serial/option.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -329,6 +329,9 @@ static int option_resume(struct usb_ser
+ #define ALCATEL_VENDOR_ID 0x1bbb
+ #define ALCATEL_PRODUCT_X060S 0x0000
+
++/* Airplus products */
++#define AIRPLUS_VENDOR_ID 0x1011
++#define AIRPLUS_PRODUCT_MCD650 0x3198
+
+ static struct usb_device_id option_ids[] = {
+ { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_COLT) },
+@@ -590,6 +593,7 @@ static struct usb_device_id option_ids[]
+ { USB_DEVICE(ALINK_VENDOR_ID, 0x9000) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ALINK_VENDOR_ID, ALINK_PRODUCT_3GU, 0xff, 0xff, 0xff) },
+ { USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_X060S) },
++ { USB_DEVICE(AIRPLUS_VENDOR_ID, AIRPLUS_PRODUCT_MCD650) },
+ { } /* Terminating entry */
+ };
+ MODULE_DEVICE_TABLE(usb, option_ids);
+
+
+From gregkh@mini.kroah.org Fri Nov 6 14:15:44 2009
+Message-Id: <20091106221544.356196567@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Fri, 06 Nov 2009 14:14:40 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Bryan Wu <bryan.wu@canonical.com>,
+ Matthias Urlichs <matthias@urlichs.de>
+Subject: [42/99] USB: option: TLAYTECH TUE800 support
+References: <20091106221358.309857998@mini.kroah.org>
+Content-Disposition: inline; filename=usb-option-tlaytech-tue800-support.patch
+Content-Length: 1179
+Lines: 35
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Bryan Wu <bryan.wu@canonical.com>
+
+commit fead2ab6cf9ad3a84a06e68ccc20d1e460fad13e upstream.
+
+Add ID for Tlaytech TUE800 CDMA modem to the option driver.
+
+Signed-off-by: Bryan Wu <bryan.wu@canonical.com>
+Acked-By: Matthias Urlichs <matthias@urlichs.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/serial/option.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -316,6 +316,9 @@ static int option_resume(struct usb_ser
+ #define QISDA_PRODUCT_H20_4515 0x4515
+ #define QISDA_PRODUCT_H20_4519 0x4519
+
++/* TLAYTECH PRODUCTS */
++#define TLAYTECH_VENDOR_ID 0x20B9
++#define TLAYTECH_PRODUCT_TEU800 0x1682
+
+ /* TOSHIBA PRODUCTS */
+ #define TOSHIBA_VENDOR_ID 0x0930
+@@ -594,6 +597,7 @@ static struct usb_device_id option_ids[]
+ { USB_DEVICE_AND_INTERFACE_INFO(ALINK_VENDOR_ID, ALINK_PRODUCT_3GU, 0xff, 0xff, 0xff) },
+ { USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_X060S) },
+ { USB_DEVICE(AIRPLUS_VENDOR_ID, AIRPLUS_PRODUCT_MCD650) },
++ { USB_DEVICE(TLAYTECH_VENDOR_ID, TLAYTECH_PRODUCT_TEU800) },
+ { } /* Terminating entry */
+ };
+ MODULE_DEVICE_TABLE(usb, option_ids);
+
+
+From gregkh@mini.kroah.org Fri Nov 6 14:15:44 2009
+Message-Id: <20091106221544.491007280@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Fri, 06 Nov 2009 14:14:41 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ David Woodhouse <David.Woodhouse@intel.com>,
+ "David S. Miller" <davem@davemloft.net>,
+ "John W. Linville" <linville@tuxdriver.com>
+Subject: [43/99] libertas if_usb: Fix crash on 64-bit machines
+References: <20091106221358.309857998@mini.kroah.org>
+Content-Disposition: inline; filename=libertas-if_usb-fix-crash-on-64-bit-machines.patch
+Content-Length: 1455
+Lines: 37
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: David Woodhouse <dwmw2@infradead.org>
+
+commit e9024a059f2c17fb2bfab212ee9d31511d7b8e57 upstream.
+
+On a 64-bit kernel, skb->tail is an offset, not a pointer. The libertas
+usb driver passes it to usb_fill_bulk_urb() anyway, causing interesting
+crashes. Fix that by using skb->data instead.
+
+This highlights a problem with usb_fill_bulk_urb(). It doesn't notice
+when dma_map_single() fails and return the error to its caller as it
+should. In fact it _can't_ currently return the error, since it returns
+void.
+
+So this problem was showing up only at unmap time, after we'd already
+suffered memory corruption by doing DMA to a bogus address.
+
+Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+Acked-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/libertas/if_usb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/libertas/if_usb.c
++++ b/drivers/net/wireless/libertas/if_usb.c
+@@ -507,7 +507,7 @@ static int __if_usb_submit_rx_urb(struct
+ /* Fill the receive configuration URB and initialise the Rx call back */
+ usb_fill_bulk_urb(cardp->rx_urb, cardp->udev,
+ usb_rcvbulkpipe(cardp->udev, cardp->ep_in),
+- (void *) (skb->tail + (size_t) IPFIELD_ALIGN_OFFSET),
++ skb->data + IPFIELD_ALIGN_OFFSET,
+ MRVDRV_ETH_RX_PACKET_BUFFER_SIZE, callbackfn,
+ cardp);
+
+
+
+From gregkh@mini.kroah.org Fri Nov 6 14:15:44 2009
+Message-Id: <20091106221544.643003214@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Fri, 06 Nov 2009 14:14:42 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Kevin Hilman <khilman@deeprootsystems.com>,
+ Arjan van de Ven <arjan@linux.intel.com>,
+ Len Brown <len.brown@intel.com>,
+ Venkatesh Pallipadi <venkatesh.pallipadi@intel.com>,
+ Ingo Molnar <mingo@elte.hu>,
+ "Rafael J. Wysocki" <rjw@sisk.pl>
+Subject: [44/99] cpuidle: always return with interrupts enabled
+References: <20091106221358.309857998@mini.kroah.org>
+Content-Disposition: inline; filename=cpuidle-always-return-with-interrupts-enabled.patch
+Content-Length: 1855
+Lines: 52
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Kevin Hilman <khilman@deeprootsystems.com>
+
+commit 246eb7f0ed1a8aeddec5313137767658f378949b upstream.
+
+In the case where cpuidle_idle_call() returns before changing state due to
+a need_resched(), it was returning with IRQs disabled.
+
+The idle path assumes that the platform specific idle code returns with
+interrupts enabled (although this too is undocumented AFAICT) and on ARM
+we have a WARN_ON(!(irqs_disabled()) when returning from the idle loop, so
+the user-visible effects were only a warning since interrupts were
+eventually re-enabled later.
+
+On x86, this same problem exists, but there is no WARN_ON() to detect it.
+As on ARM, the interrupts are eventually re-enabled, so I'm not sure of
+any actual bugs triggered by this. It's primarily a
+correctness/consistency fix.
+
+This patch ensures IRQs are (re)enabled before returning.
+
+Reported-by: Hemanth V <hemanthv@ti.com>
+Signed-off-by: Kevin Hilman <khilman@deeprootsystems.com>
+Cc: Arjan van de Ven <arjan@linux.intel.com>
+Cc: Len Brown <len.brown@intel.com>
+Cc: Venkatesh Pallipadi <venkatesh.pallipadi@intel.com>
+Cc: Ingo Molnar <mingo@elte.hu>
+Cc: "Rafael J. Wysocki" <rjw@sisk.pl>
+Tested-by: Martin Michlmayr <tbm@cyrius.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/cpuidle/cpuidle.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/cpuidle/cpuidle.c
++++ b/drivers/cpuidle/cpuidle.c
+@@ -75,8 +75,11 @@ static void cpuidle_idle_call(void)
+ #endif
+ /* ask the governor for the next state */
+ next_state = cpuidle_curr_governor->select(dev);
+- if (need_resched())
++ if (need_resched()) {
++ local_irq_enable();
+ return;
++ }
++
+ target_state = &dev->states[next_state];
+
+ /* enter the state and update stats */
+
+
+From gregkh@mini.kroah.org Fri Nov 6 14:15:44 2009
+Message-Id: <20091106221544.780625234@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Fri, 06 Nov 2009 14:14:43 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ "Michael S. Tsirkin" <mst@redhat.com>,
+ Rusty Russell <rusty@rustcorp.com.au>
+Subject: [45/99] virtio: order used ring after used index read
+References: <20091106221358.309857998@mini.kroah.org>
+Content-Disposition: inline; filename=virtio-order-used-ring-after-used-index-read.patch
+Content-Length: 919
+Lines: 29
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Michael S. Tsirkin <mst@redhat.com>
+
+commit 2d61ba95034f1abbdec7729d52c740870a5eddb6 upstream.
+
+On SMP guests, reads from the ring might bypass used index reads. This
+causes guest crashes because host writes to used index to signal ring
+data readiness. Fix this by inserting rmb before used ring reads.
+
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/virtio/virtio_ring.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/virtio/virtio_ring.c
++++ b/drivers/virtio/virtio_ring.c
+@@ -281,6 +281,9 @@ static void *vring_get_buf(struct virtqu
+ return NULL;
+ }
+
++ /* Only get used array entries after they have been exposed by host. */
++ rmb();
++
+ i = vq->vring.used->ring[vq->last_used_idx%vq->vring.num].id;
+ *len = vq->vring.used->ring[vq->last_used_idx%vq->vring.num].len;
+
+
+
+From gregkh@mini.kroah.org Fri Nov 6 14:15:45 2009
+Message-Id: <20091106221544.917678408@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Fri, 06 Nov 2009 14:14:44 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Hitoshi Mitake <mitake@dcl.info.waseda.ac.jp>,
+ Steve French <sfrench@us.ibm.com>
+Subject: [46/99] CIFS: Fixing to avoid invalid kfree() in cifs_get_tcp_session()
+References: <20091106221358.309857998@mini.kroah.org>
+Content-Disposition: inline; filename=cifs-fixing-to-avoid-invalid-kfree-in-cifs_get_tcp_session.patch
+Content-Length: 4097
+Lines: 102
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Steve French <sfrench@us.ibm.com>
+
+commit 8347a5cdd1422eea0470ed586274c7f29e274b47 upstream.
+
+trivial bug in fs/cifs/connect.c .
+The bug is caused by fail of extract_hostname()
+when mounting cifs file system.
+
+This is the situation when I noticed this bug.
+
+% sudo mount -t cifs //192.168.10.208 mountpoint -o options...
+
+Then my kernel says,
+
+[ 1461.807776] ------------[ cut here ]------------
+[ 1461.807781] kernel BUG at mm/slab.c:521!
+[ 1461.807784] invalid opcode: 0000 [#2] PREEMPT SMP
+[ 1461.807790] last sysfs file:
+/sys/devices/pci0000:00/0000:00:1e.0/0000:09:02.0/resource
+[ 1461.807793] CPU 0
+[ 1461.807796] Modules linked in: nls_iso8859_1 usbhid sbp2 uhci_hcd
+ehci_hcd i2c_i801 ohci1394 ieee1394 psmouse serio_raw pcspkr sky2 usbcore
+evdev
+[ 1461.807816] Pid: 3446, comm: mount Tainted: G D 2.6.32-rc2-vanilla
+[ 1461.807820] RIP: 0010:[<ffffffff810b888e>] [<ffffffff810b888e>]
+kfree+0x63/0x156
+[ 1461.807829] RSP: 0018:ffff8800b4f7fbb8 EFLAGS: 00010046
+[ 1461.807832] RAX: ffffea00033fff98 RBX: ffff8800afbae7e2 RCX:
+0000000000000000
+[ 1461.807836] RDX: ffffea0000000000 RSI: 000000000000005c RDI:
+ffffffffffffffea
+[ 1461.807839] RBP: ffff8800b4f7fbf8 R08: 0000000000000001 R09:
+0000000000000000
+[ 1461.807842] R10: 0000000000000000 R11: ffff8800b4f7fbf8 R12:
+00000000ffffffea
+[ 1461.807845] R13: ffff8800afb23000 R14: ffff8800b4f87bc0 R15:
+ffffffffffffffea
+[ 1461.807849] FS: 00007f52b6f187c0(0000) GS:ffff880007600000(0000)
+knlGS:0000000000000000
+[ 1461.807852] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
+[ 1461.807855] CR2: 0000000000613000 CR3: 00000000af8f9000 CR4:
+00000000000006f0
+[ 1461.807858] DR0: 0000000000000000 DR1: 0000000000000000 DR2:
+0000000000000000
+[ 1461.807861] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7:
+0000000000000400
+[ 1461.807865] Process mount (pid: 3446, threadinfo ffff8800b4f7e000, task
+ffff8800950e4380)
+[ 1461.807867] Stack:
+[ 1461.807869] 0000000000000202 0000000000000282 ffff8800b4f7fbf8
+ffff8800afbae7e2
+[ 1461.807876] <0> 00000000ffffffea ffff8800afb23000 ffff8800b4f87bc0
+ffff8800b4f7fc28
+[ 1461.807884] <0> ffff8800b4f7fcd8 ffffffff81159f6d ffffffff81147bc2
+ffffffff816bfb48
+[ 1461.807892] Call Trace:
+[ 1461.807899] [<ffffffff81159f6d>] cifs_get_tcp_session+0x440/0x44b
+[ 1461.807904] [<ffffffff81147bc2>] ? find_nls+0x1c/0xe9
+[ 1461.807909] [<ffffffff8115b889>] cifs_mount+0x16bc/0x2167
+[ 1461.807917] [<ffffffff814455bd>] ? _spin_unlock+0x30/0x4b
+[ 1461.807923] [<ffffffff81150da9>] cifs_get_sb+0xa5/0x1a8
+[ 1461.807928] [<ffffffff810c1b94>] vfs_kern_mount+0x56/0xc9
+[ 1461.807933] [<ffffffff810c1c64>] do_kern_mount+0x47/0xe7
+[ 1461.807938] [<ffffffff810d8632>] do_mount+0x712/0x775
+[ 1461.807943] [<ffffffff810d671f>] ? copy_mount_options+0xcf/0x132
+[ 1461.807948] [<ffffffff810d8714>] sys_mount+0x7f/0xbf
+[ 1461.807953] [<ffffffff8144509a>] ? lockdep_sys_exit_thunk+0x35/0x67
+[ 1461.807960] [<ffffffff81011cc2>] system_call_fastpath+0x16/0x1b
+[ 1461.807963] Code: 00 00 00 00 ea ff ff 48 c1 e8 0c 48 6b c0 68 48 01 d0
+66 83 38 00 79 04 48 8b 40 10 66 83 38 00 79 04 48 8b 40 10 80 38 00 78 04
+<0f> 0b eb fe 4c 8b 70 58 4c 89 ff 41 8b 76 4c e8 b8 49 fb ff e8
+[ 1461.808022] RIP [<ffffffff810b888e>] kfree+0x63/0x156
+[ 1461.808027] RSP <ffff8800b4f7fbb8>
+[ 1461.808031] ---[ end trace ffe26fcdc72c0ce4 ]---
+
+The reason of this bug is that the error handling code of
+cifs_get_tcp_session()
+calls kfree() when corresponding kmalloc() failed.
+(The kmalloc() is called by extract_hostname().)
+
+Signed-off-by: Hitoshi Mitake <mitake@dcl.info.waseda.ac.jp>
+Reviewed-by: Jeff Layton <jlayton@redhat.com>
+Signed-off-by: Steve French <sfrench@us.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/cifs/connect.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/fs/cifs/connect.c
++++ b/fs/cifs/connect.c
+@@ -1556,7 +1556,8 @@ cifs_get_tcp_session(struct smb_vol *vol
+
+ out_err:
+ if (tcp_ses) {
+- kfree(tcp_ses->hostname);
++ if (!IS_ERR(tcp_ses->hostname))
++ kfree(tcp_ses->hostname);
+ if (tcp_ses->ssocket)
+ sock_release(tcp_ses->ssocket);
+ kfree(tcp_ses);
+
+
+From gregkh@mini.kroah.org Fri Nov 6 14:15:45 2009
+Message-Id: <20091106221545.069595559@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Fri, 06 Nov 2009 14:14:45 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ =?ISO-8859-15?q?Bj=C3=B6rn=20Smedman?= <bjorn.smedman@venatech.se>,
+ "John W. Linville" <linville@tuxdriver.com>
+Subject: [47/99] mac80211: fix for incorrect sequence number on hostapd injected frames
+References: <20091106221358.309857998@mini.kroah.org>
+Content-Disposition: inline; filename=mac80211-fix-for-incorrect-sequence-number-on-hostapd-injected-frames.patch
+Content-Length: 1422
+Lines: 37
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Björn Smedman <bjorn.smedman@venatech.se>
+
+commit 9b1ce526eb917c8b5c8497c327768130ee683392 upstream.
+
+When hostapd injects a frame, e.g. an authentication or association
+response, mac80211 looks for a suitable access point virtual interface
+to associate the frame with based on its source address. This makes it
+possible e.g. to correctly assign sequence numbers to the frames.
+
+A small typo in the ethernet address comparison statement caused a
+failure to find a suitable ap interface. Sequence numbers on such
+frames where therefore left unassigned causing some clients
+(especially windows-based 11b/g clients) to reject them and fail to
+authenticate or associate with the access point. This patch fixes the
+typo in the address comparison statement.
+
+Signed-off-by: Björn Smedman <bjorn.smedman@venatech.se>
+Reviewed-by: Johannes Berg <johannes@sipsolutions.net>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/mac80211/tx.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -1478,7 +1478,7 @@ int ieee80211_master_start_xmit(struct s
+ if (sdata->vif.type != NL80211_IFTYPE_AP)
+ continue;
+ if (compare_ether_addr(sdata->dev->dev_addr,
+- hdr->addr2)) {
++ hdr->addr2) == 0) {
+ dev_hold(sdata->dev);
+ dev_put(odev);
+ osdata = sdata;
+
+
+From gregkh@mini.kroah.org Fri Nov 6 14:15:45 2009
+Message-Id: <20091106221545.241612251@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Fri, 06 Nov 2009 14:14:46 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Arjan van de Ven <arjan@infradead.org>,
+ Johannes Berg <johannes@sipsolutions.net>,
+ "John W. Linville" <linville@tuxdriver.com>
+Subject: [48/99] mac80211: check interface is down before type change
+References: <20091106221358.309857998@mini.kroah.org>
+Content-Disposition: inline; filename=mac80211-check-interface-is-down-before-type-change.patch
+Content-Length: 1753
+Lines: 56
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Johannes Berg <johannes@sipsolutions.net>
+
+commit c1f9a764cf47686b1f5a0cf87ada68d90056136a upstream.
+
+For some strange reason the netif_running() check
+ended up after the actual type change instead of
+before, potentially causing all kinds of problems
+if the interface is up while changing the type;
+one of the problems manifests itself as a warning:
+
+WARNING: at net/mac80211/iface.c:651 ieee80211_teardown_sdata+0xda/0x1a0 [mac80211]()
+Hardware name: Aspire one
+Pid: 2596, comm: wpa_supplicant Tainted: G W 2.6.31-10-generic #32-Ubuntu
+Call Trace:
+ [] warn_slowpath_common+0x6d/0xa0
+ [] warn_slowpath_null+0x15/0x20
+ [] ieee80211_teardown_sdata+0xda/0x1a0 [mac80211]
+ [] ieee80211_if_change_type+0x4a/0xc0 [mac80211]
+ [] ieee80211_change_iface+0x61/0xa0 [mac80211]
+ [] cfg80211_wext_siwmode+0xc7/0x120 [cfg80211]
+ [] ioctl_standard_call+0x58/0xf0
+
+(http://www.kerneloops.org/searchweek.php?search=ieee80211_teardown_sdata)
+
+Cc: Arjan van de Ven <arjan@infradead.org>
+Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/mac80211/cfg.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -87,6 +87,9 @@ static int ieee80211_change_iface(struct
+ if (!dev)
+ return -ENODEV;
+
++ if (netif_running(dev))
++ return -EBUSY;
++
+ if (!nl80211_type_check(type))
+ return -EINVAL;
+
+@@ -96,9 +99,6 @@ static int ieee80211_change_iface(struct
+ if (ret)
+ return ret;
+
+- if (netif_running(sdata->dev))
+- return -EBUSY;
+-
+ if (ieee80211_vif_is_mesh(&sdata->vif) && params->mesh_id_len)
+ ieee80211_sdata_set_mesh_id(sdata,
+ params->mesh_id_len,
+
+
+From gregkh@mini.kroah.org Fri Nov 6 14:15:45 2009
+Message-Id: <20091106221545.409589249@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Fri, 06 Nov 2009 14:14:47 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Robin Holt <holt@sgi.com>,
+ Jack Steiner <steiner@sgi.com>,
+ Cliff Whickman <cpw@sgi.com>,
+ Ingo Molnar <mingo@elte.hu>
+Subject: [49/99] x86, UV: Fix information in __uv_hub_info structure
+References: <20091106221358.309857998@mini.kroah.org>
+Content-Disposition: inline; filename=x86-uv-fix-information-in-__uv_hub_info-structure.patch
+Content-Length: 2803
+Lines: 78
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Robin Holt <holt@sgi.com>
+
+commit 036ed8ba61b72c19dc5759446d4fe0844aa88255 upstream.
+
+A few parts of the uv_hub_info structure are initialized
+incorrectly.
+
+ - n_val is being loaded with m_val.
+ - gpa_mask is initialized with a bytes instead of an unsigned long.
+ - Handle the case where none of the alias registers are used.
+
+Lastly I converted the bau over to using the uv_hub_info->m_val
+which is the correct value.
+
+Without this patch, booting a large configuration hits a
+problem where the upper bits of the gnode affect the pnode
+and the bau will not operate.
+
+Signed-off-by: Robin Holt <holt@sgi.com>
+Acked-by: Jack Steiner <steiner@sgi.com>
+Cc: Cliff Whickman <cpw@sgi.com>
+LKML-Reference: <20091015224946.396355000@alcatraz.americas.sgi.com>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/apic/x2apic_uv_x.c | 8 ++++----
+ arch/x86/kernel/tlb_uv.c | 4 ++--
+ 2 files changed, 6 insertions(+), 6 deletions(-)
+
+--- a/arch/x86/kernel/apic/x2apic_uv_x.c
++++ b/arch/x86/kernel/apic/x2apic_uv_x.c
+@@ -352,14 +352,14 @@ static __init void get_lowmem_redirect(u
+
+ for (i = 0; i < ARRAY_SIZE(redir_addrs); i++) {
+ alias.v = uv_read_local_mmr(redir_addrs[i].alias);
+- if (alias.s.base == 0) {
++ if (alias.s.enable && alias.s.base == 0) {
+ *size = (1UL << alias.s.m_alias);
+ redirect.v = uv_read_local_mmr(redir_addrs[i].redirect);
+ *base = (unsigned long)redirect.s.dest_base << DEST_SHIFT;
+ return;
+ }
+ }
+- BUG();
++ *base = *size = 0;
+ }
+
+ enum map_type {map_wb, map_uc};
+@@ -609,12 +609,12 @@ void __init uv_system_init(void)
+ uv_cpu_hub_info(cpu)->lowmem_remap_base = lowmem_redir_base;
+ uv_cpu_hub_info(cpu)->lowmem_remap_top = lowmem_redir_size;
+ uv_cpu_hub_info(cpu)->m_val = m_val;
+- uv_cpu_hub_info(cpu)->n_val = m_val;
++ uv_cpu_hub_info(cpu)->n_val = n_val;
+ uv_cpu_hub_info(cpu)->numa_blade_id = blade;
+ uv_cpu_hub_info(cpu)->blade_processor_id = lcpu;
+ uv_cpu_hub_info(cpu)->pnode = pnode;
+ uv_cpu_hub_info(cpu)->pnode_mask = pnode_mask;
+- uv_cpu_hub_info(cpu)->gpa_mask = (1 << (m_val + n_val)) - 1;
++ uv_cpu_hub_info(cpu)->gpa_mask = (1UL << (m_val + n_val)) - 1;
+ uv_cpu_hub_info(cpu)->gnode_upper = gnode_upper;
+ uv_cpu_hub_info(cpu)->gnode_extra = gnode_extra;
+ uv_cpu_hub_info(cpu)->global_mmr_base = mmr_base;
+--- a/arch/x86/kernel/tlb_uv.c
++++ b/arch/x86/kernel/tlb_uv.c
+@@ -843,8 +843,8 @@ static int __init uv_bau_init(void)
+ GFP_KERNEL, cpu_to_node(cur_cpu));
+
+ uv_bau_retry_limit = 1;
+- uv_nshift = uv_hub_info->n_val;
+- uv_mmask = (1UL << uv_hub_info->n_val) - 1;
++ uv_nshift = uv_hub_info->m_val;
++ uv_mmask = (1UL << uv_hub_info->m_val) - 1;
+ nblades = uv_num_possible_blades();
+
+ uv_bau_table_bases = (struct bau_control **)
+
+
+From gregkh@mini.kroah.org Fri Nov 6 14:15:45 2009
+Message-Id: <20091106221545.557546609@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Fri, 06 Nov 2009 14:14:48 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Robin Holt <holt@sgi.com>,
+ Jack Steiner <steiner@sgi.com>,
+ Martin Hicks <mort@sgi.com>,
+ Ingo Molnar <mingo@elte.hu>
+Subject: [50/99] x86, UV: Set DELIVERY_MODE=4 for vector=NMI_VECTOR in uv_hub_send_ipi()
+References: <20091106221358.309857998@mini.kroah.org>
+Content-Disposition: inline; filename=x86-uv-set-delivery_mode-4-for-vector-nmi_vector-in-uv_hub_send_ipi.patch
+Content-Length: 1447
+Lines: 50
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Robin Holt <holt@sgi.com>
+
+commit 02dd0a0613e0d84c7dd8315e3fe6204d005b7c79 upstream.
+
+When sending a NMI_VECTOR IPI using the UV_HUB_IPI_INT register,
+we need to ensure the delivery mode field of that register has
+NMI delivery selected.
+
+This makes those IPIs true NMIs, instead of flat IPIs. It
+matters to reboot sequences and KGDB, both of which use NMI
+IPIs.
+
+Signed-off-by: Robin Holt <holt@sgi.com>
+Acked-by: Jack Steiner <steiner@sgi.com>
+Cc: Martin Hicks <mort@sgi.com>
+LKML-Reference: <20091020193620.877322000@alcatraz.americas.sgi.com>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/include/asm/uv/uv_hub.h | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/arch/x86/include/asm/uv/uv_hub.h
++++ b/arch/x86/include/asm/uv/uv_hub.h
+@@ -18,6 +18,8 @@
+ #include <asm/types.h>
+ #include <asm/percpu.h>
+ #include <asm/uv/uv_mmrs.h>
++#include <asm/irq_vectors.h>
++#include <asm/io_apic.h>
+
+
+ /*
+@@ -420,9 +422,14 @@ static inline void uv_set_cpu_scir_bits(
+ static inline void uv_hub_send_ipi(int pnode, int apicid, int vector)
+ {
+ unsigned long val;
++ unsigned long dmode = dest_Fixed;
++
++ if (vector == NMI_VECTOR)
++ dmode = dest_NMI;
+
+ val = (1UL << UVH_IPI_INT_SEND_SHFT) |
+ ((apicid) << UVH_IPI_INT_APIC_ID_SHFT) |
++ (dmode << UVH_IPI_INT_DELIVERY_MODE_SHFT) |
+ (vector << UVH_IPI_INT_VECTOR_SHFT);
+ uv_write_global_mmr64(pnode, UVH_IPI_INT, val);
+ }
+
+
+From gregkh@mini.kroah.org Fri Nov 6 14:15:45 2009
+Message-Id: <20091106221545.712888699@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Fri, 06 Nov 2009 14:14:49 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ David Howells <dhowells@redhat.com>,
+ Robin Getz <rgetz@blackfin.uclinux.org>
+Subject: [51/99] NOMMU: Dont pass NULL pointers to fput() in do_mmap_pgoff()
+References: <20091106221358.309857998@mini.kroah.org>
+Content-Disposition: inline; filename=nommu-don-t-pass-null-pointers-to-fput-in-do_mmap_pgoff.patch
+Content-Length: 1460
+Lines: 44
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: David Howells <dhowells@redhat.com>
+
+commit 89a8640279f8bb78aaf778d1fc5c4a6778f18064 upstream.
+
+Don't pass NULL pointers to fput() in the error handling paths of the NOMMU
+do_mmap_pgoff() as it can't handle it.
+
+The following can be used as a test program:
+
+ int main() { static long long a[1024 * 1024 * 20] = { 0 }; return a;}
+
+Without the patch, the code oopses in atomic_long_dec_and_test() as called by
+fput() after the kernel complains that it can't allocate that big a chunk of
+memory. With the patch, the kernel just complains about the allocation size
+and then the program segfaults during execve() as execve() can't complete the
+allocation of all the new ELF program segments.
+
+Reported-by: Robin Getz <rgetz@blackfin.uclinux.org>
+Signed-off-by: David Howells <dhowells@redhat.com>
+Acked-by: Robin Getz <rgetz@blackfin.uclinux.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ mm/nommu.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/mm/nommu.c
++++ b/mm/nommu.c
+@@ -1384,9 +1384,11 @@ share:
+ error_just_free:
+ up_write(&nommu_region_sem);
+ error:
+- fput(region->vm_file);
++ if (region->vm_file)
++ fput(region->vm_file);
+ kmem_cache_free(vm_region_jar, region);
+- fput(vma->vm_file);
++ if (vma->vm_file)
++ fput(vma->vm_file);
+ if (vma->vm_flags & VM_EXECUTABLE)
+ removed_exe_file_vma(vma->vm_mm);
+ kmem_cache_free(vm_area_cachep, vma);
+
+
+From gregkh@mini.kroah.org Fri Nov 6 14:15:45 2009
+Message-Id: <20091106221545.853603990@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Fri, 06 Nov 2009 14:14:50 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Bo Liu <bo-liu@hotmail.com>,
+ Hugh Dickins <hugh.dickins@tiscali.co.uk>
+Subject: [52/99] mm: remove incorrect swap_count() from try_to_unuse()
+References: <20091106221358.309857998@mini.kroah.org>
+Content-Disposition: inline; filename=mm-remove-incorrect-swap_count-from-try_to_unuse.patch
+Content-Length: 1458
+Lines: 39
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Bo Liu <bo-liu@hotmail.com>
+
+commit 32c5fc10e79a7053ac5728b01a0bff55cbcb9d49 upstream.
+
+In try_to_unuse(), swcount is a local copy of *swap_map, including the
+SWAP_HAS_CACHE bit; but a wrong comparison against swap_count(*swap_map),
+which masks off the SWAP_HAS_CACHE bit, succeeded where it should fail.
+
+That had the effect of resetting the mm from which to start searching
+for the next swap page, to an irrelevant mm instead of to an mm in which
+this swap page had been found: which may increase search time by ~20%.
+But we're used to swapoff being slow, so never noticed the slowdown.
+
+Remove that one spurious use of swap_count(): Bo Liu thought it merely
+redundant, Hugh rewrote the description since it was measurably wrong.
+
+Signed-off-by: Bo Liu <bo-liu@hotmail.com>
+Signed-off-by: Hugh Dickins <hugh.dickins@tiscali.co.uk>
+Reviewed-by: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ mm/swapfile.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/mm/swapfile.c
++++ b/mm/swapfile.c
+@@ -1149,8 +1149,7 @@ static int try_to_unuse(unsigned int typ
+ } else
+ retval = unuse_mm(mm, entry, page);
+
+- if (set_start_mm &&
+- swap_count(*swap_map) < swcount) {
++ if (set_start_mm && *swap_map < swcount) {
+ mmput(new_start_mm);
+ atomic_inc(&mm->mm_users);
+ new_start_mm = mm;
+
+
+From gregkh@mini.kroah.org Fri Nov 6 14:15:46 2009
+Message-Id: <20091106221546.018042424@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Fri, 06 Nov 2009 14:14:51 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jan Beulich <jbeulich@novell.com>,
+ Roland McGrath <roland@redhat.com>,
+ Ingo Molnar <mingo@elte.hu>
+Subject: [53/99] x86-64: Fix register leak in 32-bit syscall audting
+References: <20091106221358.309857998@mini.kroah.org>
+Content-Disposition: inline; filename=x86-64-fix-register-leak-in-32-bit-syscall-audting.patch
+Content-Length: 1651
+Lines: 50
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Jan Beulich <JBeulich@novell.com>
+
+commit 81766741fe1eee3884219e8daaf03f466f2ed52f upstream.
+
+Restoring %ebp after the call to audit_syscall_exit() is not
+only unnecessary (because the register didn't get clobbered),
+but in the sysenter case wasn't even doing the right thing: It
+loaded %ebp from a location below the top of stack (RBP <
+ARGOFFSET), i.e. arbitrary kernel data got passed back to user
+mode in the register.
+
+Signed-off-by: Jan Beulich <jbeulich@novell.com>
+Acked-by: Roland McGrath <roland@redhat.com>
+LKML-Reference: <4AE5CC4D020000780001BD13@vpn.id2.novell.com>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/ia32/ia32entry.S | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+--- a/arch/x86/ia32/ia32entry.S
++++ b/arch/x86/ia32/ia32entry.S
+@@ -204,7 +204,7 @@ sysexit_from_sys_call:
+ movl RDI-ARGOFFSET(%rsp),%r8d /* reload 5th syscall arg */
+ .endm
+
+- .macro auditsys_exit exit,ebpsave=RBP
++ .macro auditsys_exit exit
+ testl $(_TIF_ALLWORK_MASK & ~_TIF_SYSCALL_AUDIT),TI_flags(%r10)
+ jnz ia32_ret_from_sys_call
+ TRACE_IRQS_ON
+@@ -217,7 +217,6 @@ sysexit_from_sys_call:
+ call audit_syscall_exit
+ GET_THREAD_INFO(%r10)
+ movl RAX-ARGOFFSET(%rsp),%eax /* reload syscall return value */
+- movl \ebpsave-ARGOFFSET(%rsp),%ebp /* reload user register value */
+ movl $(_TIF_ALLWORK_MASK & ~_TIF_SYSCALL_AUDIT),%edi
+ cli
+ TRACE_IRQS_OFF
+@@ -351,7 +350,7 @@ cstar_auditsys:
+ jmp cstar_dispatch
+
+ sysretl_audit:
+- auditsys_exit sysretl_from_sys_call, RCX /* user %ebp in RCX slot */
++ auditsys_exit sysretl_from_sys_call
+ #endif
+
+ cstar_tracesys:
+
+
+From gregkh@mini.kroah.org Fri Nov 6 14:15:46 2009
+Message-Id: <20091106221546.158296779@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Fri, 06 Nov 2009 14:14:52 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp>
+Subject: [54/99] nilfs2: fix dirty page accounting leak causing hang at write
+References: <20091106221358.309857998@mini.kroah.org>
+Content-Disposition: inline; filename=nilfs2-fix-dirty-page-accounting-leak-causing-hang-at-write.patch
+Content-Length: 1251
+Lines: 37
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp>
+
+commit b1e19e5601277845b4f17ecd7c9ba04f73ee11aa upstream.
+
+Bruno Prémont and Dunphy, Bill noticed me that NILFS will certainly
+hang on ARM-based targets.
+
+I found this was caused by an underflow of dirty pages counter. A
+b-tree cache routine was marking page dirty without adjusting page
+account information.
+
+This fixes the dirty page accounting leak and resolves the hang on
+arm-based targets.
+
+Reported-by: Bruno Prémont <bonbons@linux-vserver.org>
+Reported-by: Dunphy, Bill <WDunphy@tandbergdata.com>
+Signed-off-by: Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp>
+Tested-by: Bruno Prémont <bonbons@linux-vserver.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/nilfs2/btnode.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/fs/nilfs2/btnode.c
++++ b/fs/nilfs2/btnode.c
+@@ -276,8 +276,7 @@ void nilfs_btnode_commit_change_key(stru
+ "invalid oldkey %lld (newkey=%lld)",
+ (unsigned long long)oldkey,
+ (unsigned long long)newkey);
+- if (!test_set_buffer_dirty(obh) && TestSetPageDirty(opage))
+- BUG();
++ nilfs_btnode_mark_dirty(obh);
+
+ spin_lock_irq(&btnc->tree_lock);
+ radix_tree_delete(&btnc->page_tree, oldkey);
+
+
+From gregkh@mini.kroah.org Fri Nov 6 14:15:46 2009
+Message-Id: <20091106221546.297423527@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Fri, 06 Nov 2009 14:14:53 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Zhenyu Wang <zhenyuw@linux.intel.com>,
+ Eric Anholt <eric@anholt.net>
+Subject: [55/99] drm/i915: Fix FDI M/N setting according with correct color depth
+References: <20091106221358.309857998@mini.kroah.org>
+Content-Disposition: inline; filename=drm-i915-fix-fdi-m-n-setting-according-with-correct-color-depth.patch
+Content-Length: 2912
+Lines: 97
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Zhenyu Wang <zhenyuw@linux.intel.com>
+
+commit 58a27471d00dc09945cbcfbbc5cbcdcd3c28211d upstream.
+
+FDI M/N calculation hasn't taken the current pipe color depth into account,
+but always set as 24bpp. This one checks current pipe color depth setting,
+and change FDI M/N calculation a little to use bits_per_pixel first, then
+convert to bytes_per_pixel later.
+
+This fixes display corrupt issue on Arrandle LVDS with 1600x900 panel
+in 18bpp dual-channel mode.
+
+Signed-off-by: Zhenyu Wang <zhenyuw@linux.intel.com>
+Signed-off-by: Eric Anholt <eric@anholt.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/i915/i915_reg.h | 5 +++++
+ drivers/gpu/drm/i915/intel_display.c | 31 +++++++++++++++++++++++++++----
+ 2 files changed, 32 insertions(+), 4 deletions(-)
+
+--- a/drivers/gpu/drm/i915/i915_reg.h
++++ b/drivers/gpu/drm/i915/i915_reg.h
+@@ -1616,6 +1616,11 @@
+ #define PIPE_START_VBLANK_INTERRUPT_STATUS (1UL<<2) /* 965 or later */
+ #define PIPE_VBLANK_INTERRUPT_STATUS (1UL<<1)
+ #define PIPE_OVERLAY_UPDATED_STATUS (1UL<<0)
++#define PIPE_BPC_MASK (7 << 5) /* Ironlake */
++#define PIPE_8BPC (0 << 5)
++#define PIPE_10BPC (1 << 5)
++#define PIPE_6BPC (2 << 5)
++#define PIPE_12BPC (3 << 5)
+
+ #define DSPARB 0x70030
+ #define DSPARB_CSTART_MASK (0x7f << 7)
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -1764,7 +1764,7 @@ fdi_reduce_ratio(u32 *num, u32 *den)
+ #define LINK_N 0x80000
+
+ static void
+-igdng_compute_m_n(int bytes_per_pixel, int nlanes,
++igdng_compute_m_n(int bits_per_pixel, int nlanes,
+ int pixel_clock, int link_clock,
+ struct fdi_m_n *m_n)
+ {
+@@ -1774,7 +1774,8 @@ igdng_compute_m_n(int bytes_per_pixel, i
+
+ temp = (u64) DATA_N * pixel_clock;
+ temp = div_u64(temp, link_clock);
+- m_n->gmch_m = div_u64(temp * bytes_per_pixel, nlanes);
++ m_n->gmch_m = div_u64(temp * bits_per_pixel, nlanes);
++ m_n->gmch_m >>= 3; /* convert to bytes_per_pixel */
+ m_n->gmch_n = DATA_N;
+ fdi_reduce_ratio(&m_n->gmch_m, &m_n->gmch_n);
+
+@@ -2396,7 +2397,7 @@ static int intel_crtc_mode_set(struct dr
+
+ /* FDI link */
+ if (IS_IGDNG(dev)) {
+- int lane, link_bw;
++ int lane, link_bw, bpp;
+ /* eDP doesn't require FDI link, so just set DP M/N
+ according to current link config */
+ if (is_edp) {
+@@ -2415,7 +2416,29 @@ static int intel_crtc_mode_set(struct dr
+ lane = 4;
+ link_bw = 270000;
+ }
+- igdng_compute_m_n(3, lane, target_clock,
++
++ /* determine panel color depth */
++ temp = I915_READ(pipeconf_reg);
++
++ switch (temp & PIPE_BPC_MASK) {
++ case PIPE_8BPC:
++ bpp = 24;
++ break;
++ case PIPE_10BPC:
++ bpp = 30;
++ break;
++ case PIPE_6BPC:
++ bpp = 18;
++ break;
++ case PIPE_12BPC:
++ bpp = 36;
++ break;
++ default:
++ DRM_ERROR("unknown pipe bpc value\n");
++ bpp = 24;
++ }
++
++ igdng_compute_m_n(bpp, lane, target_clock,
+ link_bw, &m_n);
+ }
+
+
+
+From gregkh@mini.kroah.org Fri Nov 6 14:15:46 2009
+Message-Id: <20091106221546.450155859@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Fri, 06 Nov 2009 14:14:54 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Zhenyu Wang <zhenyuw@linux.intel.com>,
+ Eric Anholt <eric@anholt.net>
+Subject: [56/99] drm/i915: fix to setup display reference clock control on Ironlake
+References: <20091106221358.309857998@mini.kroah.org>
+Content-Disposition: inline; filename=drm-i915-fix-to-setup-display-reference-clock-control-on-ironlake.patch
+Content-Length: 2924
+Lines: 87
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Zhenyu Wang <zhenyuw@linux.intel.com>
+
+commit c038e51e841581cc3fb9a76e5e16331331e9c85c upstream.
+
+For new stepping of PCH, the display reference clock
+is fully under driver's control. This one trys to setup
+all needed reference clock for different outputs. Older
+stepping of PCH chipset should be ignoring this.
+
+This fixes output failure issue on newer PCH which requires
+driver to take control of reference clock enabling.
+
+Signed-off-by: Zhenyu Wang <zhenyuw@linux.intel.com>
+Signed-off-by: Eric Anholt <eric@anholt.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/i915/i915_reg.h | 4 +--
+ drivers/gpu/drm/i915/intel_display.c | 40 +++++++++++++++++++++++++++++++++++
+ 2 files changed, 42 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/i915/i915_reg.h
++++ b/drivers/gpu/drm/i915/i915_reg.h
+@@ -1990,11 +1990,11 @@
+ #define DREF_CPU_SOURCE_OUTPUT_MASK (3<<13)
+ #define DREF_SSC_SOURCE_DISABLE (0<<11)
+ #define DREF_SSC_SOURCE_ENABLE (2<<11)
+-#define DREF_SSC_SOURCE_MASK (2<<11)
++#define DREF_SSC_SOURCE_MASK (3<<11)
+ #define DREF_NONSPREAD_SOURCE_DISABLE (0<<9)
+ #define DREF_NONSPREAD_CK505_ENABLE (1<<9)
+ #define DREF_NONSPREAD_SOURCE_ENABLE (2<<9)
+-#define DREF_NONSPREAD_SOURCE_MASK (2<<9)
++#define DREF_NONSPREAD_SOURCE_MASK (3<<9)
+ #define DREF_SUPERSPREAD_SOURCE_DISABLE (0<<7)
+ #define DREF_SUPERSPREAD_SOURCE_ENABLE (2<<7)
+ #define DREF_SSC4_DOWNSPREAD (0<<6)
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -2442,6 +2442,46 @@ static int intel_crtc_mode_set(struct dr
+ link_bw, &m_n);
+ }
+
++ /* Ironlake: try to setup display ref clock before DPLL
++ * enabling. This is only under driver's control after
++ * PCH B stepping, previous chipset stepping should be
++ * ignoring this setting.
++ */
++ if (IS_IGDNG(dev)) {
++ temp = I915_READ(PCH_DREF_CONTROL);
++ /* Always enable nonspread source */
++ temp &= ~DREF_NONSPREAD_SOURCE_MASK;
++ temp |= DREF_NONSPREAD_SOURCE_ENABLE;
++ I915_WRITE(PCH_DREF_CONTROL, temp);
++ POSTING_READ(PCH_DREF_CONTROL);
++
++ temp &= ~DREF_SSC_SOURCE_MASK;
++ temp |= DREF_SSC_SOURCE_ENABLE;
++ I915_WRITE(PCH_DREF_CONTROL, temp);
++ POSTING_READ(PCH_DREF_CONTROL);
++
++ udelay(200);
++
++ if (is_edp) {
++ if (dev_priv->lvds_use_ssc) {
++ temp |= DREF_SSC1_ENABLE;
++ I915_WRITE(PCH_DREF_CONTROL, temp);
++ POSTING_READ(PCH_DREF_CONTROL);
++
++ udelay(200);
++
++ temp &= ~DREF_CPU_SOURCE_OUTPUT_MASK;
++ temp |= DREF_CPU_SOURCE_OUTPUT_DOWNSPREAD;
++ I915_WRITE(PCH_DREF_CONTROL, temp);
++ POSTING_READ(PCH_DREF_CONTROL);
++ } else {
++ temp |= DREF_CPU_SOURCE_OUTPUT_NONSPREAD;
++ I915_WRITE(PCH_DREF_CONTROL, temp);
++ POSTING_READ(PCH_DREF_CONTROL);
++ }
++ }
++ }
++
+ if (IS_IGD(dev))
+ fp = (1 << clock.n) << 16 | clock.m1 << 8 | clock.m2;
+ else
+
+
+From gregkh@mini.kroah.org Fri Nov 6 14:15:46 2009
+Message-Id: <20091106221546.595113397@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Fri, 06 Nov 2009 14:14:55 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Zhenyu Wang <zhenyuw@linux.intel.com>,
+ Eric Anholt <eric@anholt.net>
+Subject: [57/99] drm/i915: fix panel fitting filter coefficient select for Ironlake
+References: <20091106221358.309857998@mini.kroah.org>
+Content-Disposition: inline; filename=drm-i915-fix-panel-fitting-filter-coefficient-select-for-ironlake.patch
+Content-Length: 1549
+Lines: 44
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Zhenyu Wang <zhenyuw@linux.intel.com>
+
+commit b1f60b7029989da71fd8ea1b1176480fac9e846c upstream.
+
+Must set filter selection as hardcoded coefficients for medium 3x3
+filtering, which matches vbios setting for Ironlake.
+
+This fixes display corrupt issue on HP arrandale with new vbios.
+
+Signed-off-by: Zhenyu Wang <zhenyuw@linux.intel.com>
+Signed-off-by: Eric Anholt <eric@anholt.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/i915/i915_reg.h | 5 +++++
+ drivers/gpu/drm/i915/intel_display.c | 2 +-
+ 2 files changed, 6 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/i915/i915_reg.h
++++ b/drivers/gpu/drm/i915/i915_reg.h
+@@ -1871,6 +1871,11 @@
+ #define PFA_CTL_1 0x68080
+ #define PFB_CTL_1 0x68880
+ #define PF_ENABLE (1<<31)
++#define PF_FILTER_MASK (3<<23)
++#define PF_FILTER_PROGRAMMED (0<<23)
++#define PF_FILTER_MED_3x3 (1<<23)
++#define PF_FILTER_EDGE_ENHANCE (2<<23)
++#define PF_FILTER_EDGE_SOFTEN (3<<23)
+ #define PFA_WIN_SZ 0x68074
+ #define PFB_WIN_SZ 0x68874
+ #define PFA_WIN_POS 0x68070
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -1213,7 +1213,7 @@ static void igdng_crtc_dpms(struct drm_c
+ /* Enable panel fitting for LVDS */
+ if (intel_pipe_has_type(crtc, INTEL_OUTPUT_LVDS)) {
+ temp = I915_READ(pf_ctl_reg);
+- I915_WRITE(pf_ctl_reg, temp | PF_ENABLE);
++ I915_WRITE(pf_ctl_reg, temp | PF_ENABLE | PF_FILTER_MED_3x3);
+
+ /* currently full aspect */
+ I915_WRITE(pf_win_pos, 0);
+
+
+From gregkh@mini.kroah.org Fri Nov 6 14:15:46 2009
+Message-Id: <20091106221546.733836681@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Fri, 06 Nov 2009 14:14:56 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Fabian Henze <hoacha@quantentunnel.de>,
+ Zhenyu Wang <zhenyuw@linux.intel.com>,
+ Eric Anholt <eric@anholt.net>
+Subject: [58/99] agp/intel: Add B43 chipset support
+References: <20091106221358.309857998@mini.kroah.org>
+Content-Disposition: inline; filename=agp-intel-add-b43-chipset-support.patch
+Content-Length: 2524
+Lines: 59
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Fabian Henze <hoacha@quantentunnel.de>
+
+commit 38d8a95621b20ed7868e232a35a26ee61bdcae6f upstream.
+
+Signed-off-by: Fabian Henze <hoacha@quantentunnel.de>
+[Fix reversed HB & IG ids for B43]
+Signed-off-by: Zhenyu Wang <zhenyuw@linux.intel.com>
+Signed-off-by: Eric Anholt <eric@anholt.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/char/agp/intel-agp.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/char/agp/intel-agp.c
++++ b/drivers/char/agp/intel-agp.c
+@@ -36,6 +36,8 @@
+ #define PCI_DEVICE_ID_INTEL_Q35_IG 0x29B2
+ #define PCI_DEVICE_ID_INTEL_Q33_HB 0x29D0
+ #define PCI_DEVICE_ID_INTEL_Q33_IG 0x29D2
++#define PCI_DEVICE_ID_INTEL_B43_HB 0x2E40
++#define PCI_DEVICE_ID_INTEL_B43_IG 0x2E42
+ #define PCI_DEVICE_ID_INTEL_GM45_HB 0x2A40
+ #define PCI_DEVICE_ID_INTEL_GM45_IG 0x2A42
+ #define PCI_DEVICE_ID_INTEL_IGD_E_HB 0x2E00
+@@ -81,6 +83,7 @@
+ agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_G45_HB || \
+ agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_GM45_HB || \
+ agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_G41_HB || \
++ agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_B43_HB || \
+ agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_IGDNG_D_HB || \
+ agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_IGDNG_M_HB || \
+ agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_IGDNG_MA_HB)
+@@ -1232,6 +1235,7 @@ static void intel_i965_get_gtt_range(int
+ case PCI_DEVICE_ID_INTEL_Q45_HB:
+ case PCI_DEVICE_ID_INTEL_G45_HB:
+ case PCI_DEVICE_ID_INTEL_G41_HB:
++ case PCI_DEVICE_ID_INTEL_B43_HB:
+ case PCI_DEVICE_ID_INTEL_IGDNG_D_HB:
+ case PCI_DEVICE_ID_INTEL_IGDNG_M_HB:
+ case PCI_DEVICE_ID_INTEL_IGDNG_MA_HB:
+@@ -2208,6 +2212,8 @@ static const struct intel_driver_descrip
+ "Q45/Q43", NULL, &intel_i965_driver },
+ { PCI_DEVICE_ID_INTEL_G45_HB, PCI_DEVICE_ID_INTEL_G45_IG, 0,
+ "G45/G43", NULL, &intel_i965_driver },
++ { PCI_DEVICE_ID_INTEL_B43_HB, PCI_DEVICE_ID_INTEL_B43_IG, 0,
++ "B43", NULL, &intel_i965_driver },
+ { PCI_DEVICE_ID_INTEL_G41_HB, PCI_DEVICE_ID_INTEL_G41_IG, 0,
+ "G41", NULL, &intel_i965_driver },
+ { PCI_DEVICE_ID_INTEL_IGDNG_D_HB, PCI_DEVICE_ID_INTEL_IGDNG_D_IG, 0,
+@@ -2408,6 +2414,7 @@ static struct pci_device_id agp_intel_pc
+ ID(PCI_DEVICE_ID_INTEL_Q45_HB),
+ ID(PCI_DEVICE_ID_INTEL_G45_HB),
+ ID(PCI_DEVICE_ID_INTEL_G41_HB),
++ ID(PCI_DEVICE_ID_INTEL_B43_HB),
+ ID(PCI_DEVICE_ID_INTEL_IGDNG_D_HB),
+ ID(PCI_DEVICE_ID_INTEL_IGDNG_M_HB),
+ ID(PCI_DEVICE_ID_INTEL_IGDNG_MA_HB),
+
+
+From gregkh@mini.kroah.org Fri Nov 6 14:15:47 2009
+Message-Id: <20091106221546.888116969@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Fri, 06 Nov 2009 14:14:57 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Fabian Henze <hoacha@quantentunnel.de>,
+ Zhenyu Wang <zhenyuw@linux.intel.com>,
+ Eric Anholt <eric@anholt.net>
+Subject: [59/99] drm/i915: add B43 chipset support
+References: <20091106221358.309857998@mini.kroah.org>
+Content-Disposition: inline; filename=drm-i915-add-b43-chipset-support.patch
+Content-Length: 1819
+Lines: 43
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Fabian Henze <hoacha@quantentunnel.de>
+
+commit 7839c5d5519b6d9e2ccf3cdbf1c39e3817ad0835 upstream.
+
+Signed-off-by: Fabian Henze <hoacha@quantentunnel.de>
+Signed-off-by: Zhenyu Wang <zhenyuw@linux.intel.com>
+Signed-off-by: Eric Anholt <eric@anholt.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/i915/i915_drv.h | 2 ++
+ include/drm/drm_pciids.h | 1 +
+ 2 files changed, 3 insertions(+)
+
+--- a/drivers/gpu/drm/i915/i915_drv.h
++++ b/drivers/gpu/drm/i915/i915_drv.h
+@@ -854,6 +854,7 @@ extern int i915_wait_ring(struct drm_dev
+ (dev)->pci_device == 0x2E12 || \
+ (dev)->pci_device == 0x2E22 || \
+ (dev)->pci_device == 0x2E32 || \
++ (dev)->pci_device == 0x2E42 || \
+ (dev)->pci_device == 0x0042 || \
+ (dev)->pci_device == 0x0046)
+
+@@ -866,6 +867,7 @@ extern int i915_wait_ring(struct drm_dev
+ (dev)->pci_device == 0x2E12 || \
+ (dev)->pci_device == 0x2E22 || \
+ (dev)->pci_device == 0x2E32 || \
++ (dev)->pci_device == 0x2E42 || \
+ IS_GM45(dev))
+
+ #define IS_IGDG(dev) ((dev)->pci_device == 0xa001)
+--- a/include/drm/drm_pciids.h
++++ b/include/drm/drm_pciids.h
+@@ -552,6 +552,7 @@
+ {0x8086, 0x2e12, PCI_ANY_ID, PCI_ANY_ID, PCI_CLASS_DISPLAY_VGA << 8, 0xffff00, 0}, \
+ {0x8086, 0x2e22, PCI_ANY_ID, PCI_ANY_ID, PCI_CLASS_DISPLAY_VGA << 8, 0xffff00, 0}, \
+ {0x8086, 0x2e32, PCI_ANY_ID, PCI_ANY_ID, PCI_CLASS_DISPLAY_VGA << 8, 0xffff00, 0}, \
++ {0x8086, 0x2e42, PCI_ANY_ID, PCI_ANY_ID, PCI_CLASS_DISPLAY_VGA << 8, 0xffff00, 0}, \
+ {0x8086, 0xa001, PCI_ANY_ID, PCI_ANY_ID, PCI_CLASS_DISPLAY_VGA << 8, 0xffff00, 0}, \
+ {0x8086, 0xa011, PCI_ANY_ID, PCI_ANY_ID, PCI_CLASS_DISPLAY_VGA << 8, 0xffff00, 0}, \
+ {0x8086, 0x35e8, PCI_ANY_ID, PCI_ANY_ID, PCI_CLASS_DISPLAY_VGA << 8, 0xffff00, 0}, \
+
+
+From gregkh@mini.kroah.org Fri Nov 6 14:15:47 2009
+Message-Id: <20091106221547.023042710@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Fri, 06 Nov 2009 14:14:58 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
+Subject: [60/99] xen/hvc: make sure console output is always emitted, with explicit polling
+References: <20091106221358.309857998@mini.kroah.org>
+Content-Disposition: inline; filename=xen-hvc-make-sure-console-output-is-always-emitted-with-explicit-polling.patch
+Content-Length: 1696
+Lines: 59
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
+
+commit 7825cf10e31c64ece3cac66fb01a742f1094da51 upstream.
+
+We never want to rely on the hvc workqueue to emit output, because the
+most interesting output is when the kernel is broken. This will
+improve oops/crash/console message for better debugging.
+
+Instead, we force-poll until all output is emitted.
+
+Signed-off-by: Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/char/hvc_xen.c | 25 ++++++++++++++++++++++++-
+ 1 file changed, 24 insertions(+), 1 deletion(-)
+
+--- a/drivers/char/hvc_xen.c
++++ b/drivers/char/hvc_xen.c
+@@ -55,7 +55,7 @@ static inline void notify_daemon(void)
+ notify_remote_via_evtchn(xen_start_info->console.domU.evtchn);
+ }
+
+-static int write_console(uint32_t vtermno, const char *data, int len)
++static int __write_console(const char *data, int len)
+ {
+ struct xencons_interface *intf = xencons_interface();
+ XENCONS_RING_IDX cons, prod;
+@@ -76,6 +76,29 @@ static int write_console(uint32_t vtermn
+ return sent;
+ }
+
++static int write_console(uint32_t vtermno, const char *data, int len)
++{
++ int ret = len;
++
++ /*
++ * Make sure the whole buffer is emitted, polling if
++ * necessary. We don't ever want to rely on the hvc daemon
++ * because the most interesting console output is when the
++ * kernel is crippled.
++ */
++ while (len) {
++ int sent = __write_console(data, len);
++
++ data += sent;
++ len -= sent;
++
++ if (unlikely(len))
++ HYPERVISOR_sched_op(SCHEDOP_yield, NULL);
++ }
++
++ return ret;
++}
++
+ static int read_console(uint32_t vtermno, char *buf, int len)
+ {
+ struct xencons_interface *intf = xencons_interface();
+
+
+From gregkh@mini.kroah.org Fri Nov 6 14:15:47 2009
+Message-Id: <20091106221547.180631669@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Fri, 06 Nov 2009 14:14:59 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
+Subject: [61/99] xen: mask extended topology info in cpuid
+References: <20091106221358.309857998@mini.kroah.org>
+Content-Disposition: inline; filename=xen-mask-extended-topology-info-in-cpuid.patch
+Content-Length: 1413
+Lines: 53
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
+
+commit 82d6469916c6fcfa345636a49004c9d1753905d1 upstream.
+
+A Xen guest never needs to know about extended topology, and knowing
+would just confuse it.
+
+This patch just zeros ebx in leaf 0xb which indicates no topology info,
+preventing a crash under Xen on cpus which support this leaf.
+
+Signed-off-by: Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
+
+---
+ arch/x86/xen/enlighten.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+--- a/arch/x86/xen/enlighten.c
++++ b/arch/x86/xen/enlighten.c
+@@ -178,6 +178,7 @@ static __read_mostly unsigned int cpuid_
+ static void xen_cpuid(unsigned int *ax, unsigned int *bx,
+ unsigned int *cx, unsigned int *dx)
+ {
++ unsigned maskebx = ~0;
+ unsigned maskecx = ~0;
+ unsigned maskedx = ~0;
+
+@@ -185,9 +186,16 @@ static void xen_cpuid(unsigned int *ax,
+ * Mask out inconvenient features, to try and disable as many
+ * unsupported kernel subsystems as possible.
+ */
+- if (*ax == 1) {
++ switch (*ax) {
++ case 1:
+ maskecx = cpuid_leaf1_ecx_mask;
+ maskedx = cpuid_leaf1_edx_mask;
++ break;
++
++ case 0xb:
++ /* Suppress extended topology stuff */
++ maskebx = 0;
++ break;
+ }
+
+ asm(XEN_EMULATE_PREFIX "cpuid"
+@@ -197,6 +205,7 @@ static void xen_cpuid(unsigned int *ax,
+ "=d" (*dx)
+ : "0" (*ax), "2" (*cx));
+
++ *bx &= maskebx;
+ *cx &= maskecx;
+ *dx &= maskedx;
+ }
+
+
+From gregkh@mini.kroah.org Fri Nov 6 14:15:47 2009
+Message-Id: <20091106221547.296924651@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Fri, 06 Nov 2009 14:15:00 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Michael Buesch <mb@bu3sch.de>,
+ Jiri Kosina <jkosina@suse.cz>,
+ Michael Gilbert <michael.s.gilbert@gmail.com>
+Subject: [62/99] sgi-gru: decrapfiy options_write() function
+References: <20091106221358.309857998@mini.kroah.org>
+Content-Disposition: inline; filename=sgi-gru-decrapfiy-options_write-function.patch
+Content-Length: 1519
+Lines: 50
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Linus Torvalds <torvalds@linux-foundation.org>
+
+commit d39b7dd1dcbf394a1cb897457c862dafe9a20ac5 upstream.
+
+Not a single line of actual code in the function was really
+fundamentally correct.
+
+Problems ranged from lack of proper range checking, to removing the last
+character written (which admittedly is usually '\n'), to not accepting
+hex numbers even though the 'show' routine would show the data in that
+format.
+
+This tries to do better.
+
+Acked-by: Michael Buesch <mb@bu3sch.de>
+Tested-and-acked-by: Jack Steiner <steiner@sgi.com>
+Cc: Jiri Kosina <jkosina@suse.cz>
+Cc: Michael Gilbert <michael.s.gilbert@gmail.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/misc/sgi-gru/gruprocfs.c | 13 +++++++------
+ 1 file changed, 7 insertions(+), 6 deletions(-)
+
+--- a/drivers/misc/sgi-gru/gruprocfs.c
++++ b/drivers/misc/sgi-gru/gruprocfs.c
+@@ -161,14 +161,15 @@ static int options_show(struct seq_file
+ static ssize_t options_write(struct file *file, const char __user *userbuf,
+ size_t count, loff_t *data)
+ {
+- unsigned long val;
+- char buf[80];
++ char buf[20];
+
+- if (strncpy_from_user(buf, userbuf, sizeof(buf) - 1) < 0)
++ if (count >= sizeof(buf))
++ return -EINVAL;
++ if (copy_from_user(buf, userbuf, count))
+ return -EFAULT;
+- buf[count - 1] = '\0';
+- if (!strict_strtoul(buf, 10, &val))
+- gru_options = val;
++ buf[count] = '\0';
++ if (strict_strtoul(buf, 0, &gru_options))
++ return -EINVAL;
+
+ return count;
+ }
+
+
+From gregkh@mini.kroah.org Fri Nov 6 14:15:47 2009
+Message-Id: <20091106221547.437604054@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Fri, 06 Nov 2009 14:15:01 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Gleb Natapov <gleb@redhat.com>,
+ Avi Kivity <avi@redhat.com>
+Subject: [63/99] KVM: get_tss_base_addr() should return a gpa_t
+References: <20091106221358.309857998@mini.kroah.org>
+Content-Disposition: inline; filename=kvm-get_tss_base_addr-should-return-a-gpa_t.patch
+Content-Length: 829
+Lines: 28
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Gleb Natapov <gleb@redhat.com>
+
+commit abb3911965c1bd8eea305f64d4840a314259d96d upstream.
+
+If TSS we are switching to resides in high memory task switch will fail
+since address will be truncated. Windows2k3 does this sometimes when
+running with more then 4G
+
+Signed-off-by: Gleb Natapov <gleb@redhat.com>
+Signed-off-by: Avi Kivity <avi@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kvm/x86.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -3762,7 +3762,7 @@ static int save_guest_segment_descriptor
+ return kvm_write_guest(vcpu->kvm, gpa, seg_desc, 8);
+ }
+
+-static u32 get_tss_base_addr(struct kvm_vcpu *vcpu,
++static gpa_t get_tss_base_addr(struct kvm_vcpu *vcpu,
+ struct desc_struct *seg_desc)
+ {
+ u32 base_addr;
+
+
+From gregkh@mini.kroah.org Fri Nov 6 14:15:47 2009
+Message-Id: <20091106221547.581202341@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Fri, 06 Nov 2009 14:15:02 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ "Anand V. Avati" <avati@gluster.com>,
+ Miklos Szeredi <mszeredi@suse.cz>
+Subject: [64/99] fuse: prevent fuse_put_request on invalid pointer
+References: <20091106221358.309857998@mini.kroah.org>
+Content-Disposition: inline; filename=fuse-prevent-fuse_put_request-on-invalid-pointer.patch
+Content-Length: 770
+Lines: 29
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Anand V. Avati <avati@gluster.com>
+
+commit f60311d5f7670d9539b424e4ed8b5c0872fc9e83 upstream.
+
+fuse_direct_io() has a loop where requests are allocated in each
+iteration. if allocation fails, the loop is broken out and follows
+into an unconditional fuse_put_request() on that invalid pointer.
+
+Signed-off-by: Anand V. Avati <avati@gluster.com>
+Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/fuse/file.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/fs/fuse/file.c
++++ b/fs/fuse/file.c
+@@ -1063,7 +1063,8 @@ ssize_t fuse_direct_io(struct file *file
+ break;
+ }
+ }
+- fuse_put_request(fc, req);
++ if (!IS_ERR(req))
++ fuse_put_request(fc, req);
+ if (res > 0)
+ *ppos = pos;
+
+
+
+From gregkh@mini.kroah.org Fri Nov 6 14:15:47 2009
+Message-Id: <20091106221547.727479100@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Fri, 06 Nov 2009 14:15:03 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jens Axboe <jens.axboe@oracle.com>,
+ Miklos Szeredi <mszeredi@suse.cz>,
+ Tejun Heo <tj@kernel.org>
+Subject: [65/99] fuse: fix kunmap in fuse_ioctl_copy_user
+References: <20091106221358.309857998@mini.kroah.org>
+Content-Disposition: inline; filename=fuse-fix-kunmap-in-fuse_ioctl_copy_user.patch
+Content-Length: 677
+Lines: 29
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Jens Axboe <jens.axboe@oracle.com>
+
+commit 0bd87182d3ab18a32a8e9175d3f68754c58e3432 upstream.
+
+Looks like another victim of the confusing kmap() vs kmap_atomic() API
+differences.
+
+Reported-by: Todor Gyumyushev <yodor1@gmail.com>
+Signed-off-by: Jens Axboe <jens.axboe@oracle.com>
+Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>
+Cc: Tejun Heo <tj@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/fuse/file.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/fuse/file.c
++++ b/fs/fuse/file.c
+@@ -1600,7 +1600,7 @@ static int fuse_ioctl_copy_user(struct p
+ kaddr += copy;
+ }
+
+- kunmap(map);
++ kunmap(page);
+ }
+
+ return 0;
+
+
+From gregkh@mini.kroah.org Fri Nov 6 14:15:47 2009
+Message-Id: <20091106221547.857126995@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Fri, 06 Nov 2009 14:15:04 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Joerg Roedel <joerg.roedel@amd.com>
+Subject: [66/99] x86/amd-iommu: Workaround for erratum 63
+References: <20091106221358.309857998@mini.kroah.org>
+Content-Disposition: inline; filename=x86-amd-iommu-workaround-for-erratum-63.patch
+Content-Length: 2527
+Lines: 82
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Joerg Roedel <joerg.roedel@amd.com>
+
+commit c5cca146aa03e1f60fb179df65f0dbaf17bc64ed upstream.
+
+There is an erratum for IOMMU hardware which documents
+undefined behavior when forwarding SMI requests from
+peripherals and the DTE of that peripheral has a sysmgt
+value of 01b. This problem caused weird IO_PAGE_FAULTS in my
+case.
+This patch implements the suggested workaround for that
+erratum into the AMD IOMMU driver. The erratum is
+documented with number 63.
+
+Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/include/asm/amd_iommu.h | 1 +
+ arch/x86/kernel/amd_iommu.c | 2 ++
+ arch/x86/kernel/amd_iommu_init.c | 22 ++++++++++++++++++++++
+ 3 files changed, 25 insertions(+)
+
+--- a/arch/x86/include/asm/amd_iommu.h
++++ b/arch/x86/include/asm/amd_iommu.h
+@@ -30,6 +30,7 @@ extern irqreturn_t amd_iommu_int_handler
+ extern void amd_iommu_flush_all_domains(void);
+ extern void amd_iommu_flush_all_devices(void);
+ extern void amd_iommu_shutdown(void);
++extern void amd_iommu_apply_erratum_63(u16 devid);
+ #else
+ static inline int amd_iommu_init(void) { return -ENODEV; }
+ static inline void amd_iommu_detect(void) { }
+--- a/arch/x86/kernel/amd_iommu.c
++++ b/arch/x86/kernel/amd_iommu.c
+@@ -1112,6 +1112,8 @@ static void __detach_device(struct prote
+ amd_iommu_dev_table[devid].data[1] = 0;
+ amd_iommu_dev_table[devid].data[2] = 0;
+
++ amd_iommu_apply_erratum_63(devid);
++
+ /* decrease reference counter */
+ domain->dev_cnt -= 1;
+
+--- a/arch/x86/kernel/amd_iommu_init.c
++++ b/arch/x86/kernel/amd_iommu_init.c
+@@ -509,6 +509,26 @@ static void set_dev_entry_bit(u16 devid,
+ amd_iommu_dev_table[devid].data[i] |= (1 << _bit);
+ }
+
++static int get_dev_entry_bit(u16 devid, u8 bit)
++{
++ int i = (bit >> 5) & 0x07;
++ int _bit = bit & 0x1f;
++
++ return (amd_iommu_dev_table[devid].data[i] & (1 << _bit)) >> _bit;
++}
++
++
++void amd_iommu_apply_erratum_63(u16 devid)
++{
++ int sysmgt;
++
++ sysmgt = get_dev_entry_bit(devid, DEV_ENTRY_SYSMGT1) |
++ (get_dev_entry_bit(devid, DEV_ENTRY_SYSMGT2) << 1);
++
++ if (sysmgt == 0x01)
++ set_dev_entry_bit(devid, DEV_ENTRY_IW);
++}
++
+ /* Writes the specific IOMMU for a device into the rlookup table */
+ static void __init set_iommu_for_device(struct amd_iommu *iommu, u16 devid)
+ {
+@@ -537,6 +557,8 @@ static void __init set_dev_entry_from_ac
+ if (flags & ACPI_DEVFLAG_LINT1)
+ set_dev_entry_bit(devid, DEV_ENTRY_LINT1_PASS);
+
++ amd_iommu_apply_erratum_63(devid);
++
+ set_iommu_for_device(iommu, devid);
+ }
+
+
+
+From gregkh@mini.kroah.org Fri Nov 6 14:15:48 2009
+Message-Id: <20091106221547.995120375@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Fri, 06 Nov 2009 14:15:05 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Eric Paris <eparis@redhat.com>
+Subject: [67/99] fsnotify: do not set group for a mark before it is on the i_list
+References: <20091106221358.309857998@mini.kroah.org>
+Content-Disposition: inline; filename=fsnotify-do-not-set-group-for-a-mark-before-it-is-on-the-i_list.patch
+Content-Length: 2204
+Lines: 66
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Eric Paris <eparis@redhat.com>
+
+commit 9f0d793b52eb2266359661369ef6303838904855 upstream.
+
+fsnotify_add_mark is supposed to add a mark to the g_list and i_list and to
+set the group and inode for the mark. fsnotify_destroy_mark_by_entry uses
+the fact that ->group != NULL to know if this group should be destroyed or
+if it's already been done.
+
+But fsnotify_add_mark sets the group and inode before it actually adds the
+mark to the i_list and g_list. This can result in a race in inotify, it
+requires 3 threads.
+
+sys_inotify_add_watch("file") sys_inotify_add_watch("file") sys_inotify_rm_watch([a])
+inotify_update_watch()
+inotify_new_watch()
+inotify_add_to_idr()
+ ^--- returns wd = [a]
+ inotfiy_update_watch()
+ inotify_new_watch()
+ inotify_add_to_idr()
+ fsnotify_add_mark()
+ ^--- returns wd = [b]
+ returns to userspace;
+ inotify_idr_find([a])
+ ^--- gives us the pointer from task 1
+fsnotify_add_mark()
+ ^--- this is going to set the mark->group and mark->inode fields, but will
+return -EEXIST because of the race with [b].
+ fsnotify_destroy_mark()
+ ^--- since ->group != NULL we call back
+ into inotify_freeing_mark() which calls
+ inotify_remove_from_idr([a])
+
+since fsnotify_add_mark() failed we call:
+inotify_remove_from_idr([a]) <------WHOOPS it's not in the idr, this could
+ have been any entry added later!
+
+The fix is to make sure we don't set mark->group until we are sure the mark is
+on the inode and fsnotify_add_mark will return success.
+
+Signed-off-by: Eric Paris <eparis@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/notify/inode_mark.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/fs/notify/inode_mark.c
++++ b/fs/notify/inode_mark.c
+@@ -324,11 +324,11 @@ int fsnotify_add_mark(struct fsnotify_ma
+ spin_lock(&group->mark_lock);
+ spin_lock(&inode->i_lock);
+
+- entry->group = group;
+- entry->inode = inode;
+-
+ lentry = fsnotify_find_mark_entry(group, inode);
+ if (!lentry) {
++ entry->group = group;
++ entry->inode = inode;
++
+ hlist_add_head(&entry->i_list, &inode->i_fsnotify_mark_entries);
+ list_add(&entry->g_list, &group->mark_entries);
+
+
+
+From gregkh@mini.kroah.org Fri Nov 6 14:15:48 2009
+Message-Id: <20091106221548.134452197@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Fri, 06 Nov 2009 14:15:06 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Manuel Lauss <manuel.lauss@gmail.com>,
+ Sam Ravnborg <sam@ravnborg.org>,
+ Dmitri Vorobiev <dmitri.vorobiev@movial.com>
+Subject: [68/99] mips: fix build of vmlinux.lds
+References: <20091106221358.309857998@mini.kroah.org>
+Content-Disposition: inline; filename=mips-fix-build-of-vmlinux.lds.patch
+Content-Length: 1546
+Lines: 58
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Manuel Lauss <manuel.lauss@gmail.com>
+
+commit d71789b6fa37c21ce5eb588d279f57904a62e7e2 upstream.
+
+Commit 51b563fc93c8cb5bff1d67a0a71c374e4a4ea049 ("arm, cris, mips,
+sparc, powerpc, um, xtensa: fix build with bash 4.0") removed a few
+CPPFLAGS with vital include paths necessary to build vmlinux.lds
+on MIPS, and moved the calculation of the 'jiffies' symbol
+directly to vmlinux.lds.S but forgot to change make ifdef/... to
+cpp macros.
+
+Signed-off-by: Manuel Lauss <manuel.lauss@gmail.com>
+[sam: moved assignment of CPPFLAGS arch/mips/kernel/Makefile]
+Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
+Acked-by: Dmitri Vorobiev <dmitri.vorobiev@movial.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/mips/kernel/Makefile | 2 ++
+ arch/mips/kernel/vmlinux.lds.S | 12 ++++++------
+ 2 files changed, 8 insertions(+), 6 deletions(-)
+
+--- a/arch/mips/kernel/Makefile
++++ b/arch/mips/kernel/Makefile
+@@ -2,6 +2,8 @@
+ # Makefile for the Linux/MIPS kernel.
+ #
+
++CPPFLAGS_vmlinux.lds := $(KBUILD_CFLAGS)
++
+ extra-y := head.o init_task.o vmlinux.lds
+
+ obj-y += cpu-probe.o branch.o entry.o genex.o irq.o process.o \
+--- a/arch/mips/kernel/vmlinux.lds.S
++++ b/arch/mips/kernel/vmlinux.lds.S
+@@ -10,15 +10,15 @@ PHDRS {
+ note PT_NOTE FLAGS(4); /* R__ */
+ }
+
+-ifdef CONFIG_32BIT
+- ifdef CONFIG_CPU_LITTLE_ENDIAN
++#ifdef CONFIG_32BIT
++ #ifdef CONFIG_CPU_LITTLE_ENDIAN
+ jiffies = jiffies_64;
+- else
++ #else
+ jiffies = jiffies_64 + 4;
+- endif
+-else
++ #endif
++#else
+ jiffies = jiffies_64;
+-endif
++#endif
+
+ SECTIONS
+ {
+
+
+From gregkh@mini.kroah.org Fri Nov 6 14:15:48 2009
+Message-Id: <20091106221548.274202771@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Fri, 06 Nov 2009 14:15:07 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Sam Ravnborg <sam@ravnborg.org>,
+ Tim Abbott <tabbott@ksplice.com>,
+ Ivan Kokshaysky <ink@jurassic.park.msu.ru>,
+ Richard Henderson <rth@twiddle.net>
+Subject: [69/99] alpha: fix build after vmlinux.lds.S cleanup
+References: <20091106221358.309857998@mini.kroah.org>
+Content-Disposition: inline; filename=alpha-fix-build-after-vmlinux.lds.s-cleanup.patch
+Content-Length: 667
+Lines: 25
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Sam Ravnborg <sam@ravnborg.org>
+
+commit de078ef55c74d02ee93d44513da5ee88a089d71d upstream.
+
+Add include to get missing THREAD_SIZE definition
+
+Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
+Cc: Tim Abbott <tabbott@ksplice.com>
+Cc: Ivan Kokshaysky <ink@jurassic.park.msu.ru>
+Cc: Richard Henderson <rth@twiddle.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/alpha/kernel/vmlinux.lds.S | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/arch/alpha/kernel/vmlinux.lds.S
++++ b/arch/alpha/kernel/vmlinux.lds.S
+@@ -1,4 +1,5 @@
+ #include <asm-generic/vmlinux.lds.h>
++#include <asm/thread_info.h>
+ #include <asm/page.h>
+
+ OUTPUT_FORMAT("elf64-alpha")
+
+
+From gregkh@mini.kroah.org Fri Nov 6 14:15:48 2009
+Message-Id: <20091106221548.424594928@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Fri, 06 Nov 2009 14:15:08 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ "Rafael J. Wysocki" <rjw@sisk.pl>,
+ Len Brown <len.brown@intel.com>,
+ Chuck Ebbert <cebbert@redhat.com>
+Subject: [70/99] ACPI / PCI: Fix NULL pointer dereference in acpi_get_pci_dev() (rev. 2)
+References: <20091106221358.309857998@mini.kroah.org>
+Content-Disposition: inline; filename=acpi-pci-fix-null-pointer-dereference-in-acpi_get_pci_dev-rev.-2.patch
+Content-Length: 1964
+Lines: 55
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Rafael J. Wysocki <rjw@sisk.pl>
+
+commit 497fb54f578efd2b479727bc88d5ef942c0a1e2d upstream.
+
+acpi_get_pci_dev() may be called for a non-PCI device, in which case
+it should return NULL. However, it assumes that every handle it
+finds in the ACPI CA name space, between given device handle and the
+PCI root bridge handle, corresponds to a PCI-to-PCI bridge with an
+existing secondary bus. For this reason, when it finds a struct
+pci_dev object corresponding to one of them, it doesn't check if
+its 'subordinate' field is a valid pointer. This obviously leads to
+a NULL pointer dereference if acpi_get_pci_dev() is called for a
+non-PCI device with a PCI parent which is not a bridge.
+
+To fix this issue make acpi_get_pci_dev() check if pdev->subordinate
+is not NULL for every device it finds on the path between the root
+bridge and the device it's supposed to get to and return NULL if the
+"target" device cannot be found.
+
+http://bugzilla.kernel.org/show_bug.cgi?id=14129
+(worked in 2.6.30, regression in 2.6.31)
+
+Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>
+Reported-by: Danny Feng <dfeng@redhat.com>
+Reviewed-by: Alex Chiang <achiang@hp.com>
+Tested-by: chepioq <chepioq@gmail.com>
+Signed-off-by: Len Brown <len.brown@intel.com>
+Cc: Chuck Ebbert <cebbert@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/acpi/pci_root.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+--- a/drivers/acpi/pci_root.c
++++ b/drivers/acpi/pci_root.c
+@@ -400,6 +400,17 @@ struct pci_dev *acpi_get_pci_dev(acpi_ha
+
+ pbus = pdev->subordinate;
+ pci_dev_put(pdev);
++
++ /*
++ * This function may be called for a non-PCI device that has a
++ * PCI parent (eg. a disk under a PCI SATA controller). In that
++ * case pdev->subordinate will be NULL for the parent.
++ */
++ if (!pbus) {
++ dev_dbg(&pdev->dev, "Not a PCI-to-PCI bridge\n");
++ pdev = NULL;
++ break;
++ }
+ }
+ out:
+ list_for_each_entry_safe(node, tmp, &device_list, node)
+
+
+From gregkh@mini.kroah.org Fri Nov 6 14:15:48 2009
+Message-Id: <20091106221548.548581013@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Fri, 06 Nov 2009 14:15:09 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Len Brown <len.brown@intel.com>,
+ Chuck Ebbert <cebbert@redhat.com>
+Subject: [71/99] Revert "ACPI: Attach the ACPI device to the ACPI handle as early as possible"
+References: <20091106221358.309857998@mini.kroah.org>
+Content-Disposition: inline; filename=revert-acpi-attach-the-acpi-device-to-the-acpi-handle-as-early-as-possible.patch
+Content-Length: 1211
+Lines: 45
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Len Brown <len.brown@intel.com>
+
+commit f61f925859c57f6175082aeeee17743c68558a6e upstream.
+
+This reverts commit eab4b645769fa2f8703f5a3cb0cc4ac090d347af.
+
+http://bugzilla.kernel.org/show_bug.cgi?id=13002
+
+Signed-off-by: Len Brown <len.brown@intel.com>
+Cc: Chuck Ebbert <cebbert@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/acpi/scan.c | 12 ++----------
+ 1 file changed, 2 insertions(+), 10 deletions(-)
+
+--- a/drivers/acpi/scan.c
++++ b/drivers/acpi/scan.c
+@@ -1264,16 +1264,6 @@ acpi_add_single_object(struct acpi_devic
+ acpi_device_set_id(device, parent, handle, type);
+
+ /*
+- * The ACPI device is attached to acpi handle before getting
+- * the power/wakeup/peformance flags. Otherwise OS can't get
+- * the corresponding ACPI device by the acpi handle in the course
+- * of getting the power/wakeup/performance flags.
+- */
+- result = acpi_device_set_context(device, type);
+- if (result)
+- goto end;
+-
+- /*
+ * Power Management
+ * ----------------
+ */
+@@ -1303,6 +1293,8 @@ acpi_add_single_object(struct acpi_devic
+ goto end;
+ }
+
++ if ((result = acpi_device_set_context(device, type)))
++ goto end;
+
+ result = acpi_device_register(device, parent);
+
+
+
+From gregkh@mini.kroah.org Fri Nov 6 14:15:48 2009
+Message-Id: <20091106221548.693605803@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Fri, 06 Nov 2009 14:15:10 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ David Howells <dhowells@redhat.com>,
+ Chuck Ebbert <cebbert@redhat.com>
+Subject: [72/99] KEYS: get_instantiation_keyring() should inc the keyring refcount in all cases
+References: <20091106221358.309857998@mini.kroah.org>
+Content-Disposition: inline; filename=keys-get_instantiation_keyring-should-inc-the-keyring-refcount-in-all-cases.patch
+Content-Length: 2756
+Lines: 69
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: David Howells <dhowells@redhat.com>
+
+commit 21279cfa107af07ef985539ac0de2152b9cba5f5 upstream.
+
+The destination keyring specified to request_key() and co. is made available to
+the process that instantiates the key (the slave process started by
+/sbin/request-key typically). This is passed in the request_key_auth struct as
+the dest_keyring member.
+
+keyctl_instantiate_key and keyctl_negate_key() call get_instantiation_keyring()
+to get the keyring to attach the newly constructed key to at the end of
+instantiation. This may be given a specific keyring into which a link will be
+made later, or it may be asked to find the keyring passed to request_key(). In
+the former case, it returns a keyring with the refcount incremented by
+lookup_user_key(); in the latter case, it returns the keyring from the
+request_key_auth struct - and does _not_ increment the refcount.
+
+The latter case will eventually result in an oops when the keyring prematurely
+runs out of references and gets destroyed. The effect may take some time to
+show up as the key is destroyed lazily.
+
+To fix this, the keyring returned by get_instantiation_keyring() must always
+have its refcount incremented, no matter where it comes from.
+
+This can be tested by setting /etc/request-key.conf to:
+
+#OP TYPE DESCRIPTION CALLOUT INFO PROGRAM ARG1 ARG2 ARG3 ...
+#====== ======= =============== =============== ===============================
+create * test:* * |/bin/false %u %g %d %{user:_display}
+negate * * * /bin/keyctl negate %k 10 @u
+
+and then doing:
+
+ keyctl add user _display aaaaaaaa @u
+ while keyctl request2 user test:x test:x @u &&
+ keyctl list @u;
+ do
+ keyctl request2 user test:x test:x @u;
+ sleep 31;
+ keyctl list @u;
+ done
+
+which will oops eventually. Changing the negate line to have @u rather than
+%S at the end is important as that forces the latter case by passing a special
+keyring ID rather than an actual keyring ID.
+
+Reported-by: Alexander Zangerl <az@bond.edu.au>
+Signed-off-by: David Howells <dhowells@redhat.com>
+Tested-by: Alexander Zangerl <az@bond.edu.au>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Chuck Ebbert <cebbert@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ security/keys/keyctl.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/security/keys/keyctl.c
++++ b/security/keys/keyctl.c
+@@ -860,7 +860,7 @@ static long get_instantiation_keyring(ke
+ /* otherwise specify the destination keyring recorded in the
+ * authorisation key (any KEY_SPEC_*_KEYRING) */
+ if (ringid >= KEY_SPEC_REQUESTOR_KEYRING) {
+- *_dest_keyring = rka->dest_keyring;
++ *_dest_keyring = key_get(rka->dest_keyring);
+ return 0;
+ }
+
+
+
+From gregkh@mini.kroah.org Fri Nov 6 14:15:48 2009
+Message-Id: <20091106221548.863722805@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Fri, 06 Nov 2009 14:15:11 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Larry Finger <Larry.Finger@lwfinger.net>,
+ "John W. Linville" <linville@tuxdriver.com>
+Subject: [73/99] b43: Fix Bugzilla #14181 and the bug from the previous fix
+References: <20091106221358.309857998@mini.kroah.org>
+Content-Disposition: inline; filename=b43-fix-bugzilla-14181-and-the-bug-from-the-previous-fix.patch
+Content-Length: 1322
+Lines: 35
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Larry Finger <Larry.Finger@lwfinger.net>
+
+commit d50bae33d1358b909ade05ae121d83d3a60ab63f upstream.
+
+"b43: Fix PPC crash in rfkill polling on unload" fixed the bug reported
+in Bugzilla No. 14181; however, it introduced a new bug. Whenever the
+radio switch was turned off, it was necessary to unload and reload
+the driver for it to recognize the switch again.
+
+This patch fixes both the original bug in #14181 and the bug introduced by
+the previous patch. It must be stated, however, that if there is a BCM4306/3
+with an rfkill switch (not yet proven), then the driver will need an
+unload/reload cycle to turn the device back on.
+
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/b43/rfkill.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/b43/rfkill.c
++++ b/drivers/net/wireless/b43/rfkill.c
+@@ -33,7 +33,8 @@ bool b43_is_hw_radio_enabled(struct b43_
+ & B43_MMIO_RADIO_HWENABLED_HI_MASK))
+ return 1;
+ } else {
+- if (b43_read16(dev, B43_MMIO_RADIO_HWENABLED_LO)
++ if (b43_status(dev) >= B43_STAT_STARTED &&
++ b43_read16(dev, B43_MMIO_RADIO_HWENABLED_LO)
+ & B43_MMIO_RADIO_HWENABLED_LO_MASK)
+ return 1;
+ }
+
+
+From gregkh@mini.kroah.org Fri Nov 6 14:15:49 2009
+Message-Id: <20091106221548.985237484@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Fri, 06 Nov 2009 14:15:12 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Alan Cox <alan@linux.intel.com>,
+ Jeff Garzik <jgarzik@redhat.com>
+Subject: [74/99] pata_sc1200: Fix crash on boot
+References: <20091106221358.309857998@mini.kroah.org>
+Content-Disposition: inline; filename=pata_sc1200-fix-crash-on-boot.patch
+Content-Length: 915
+Lines: 32
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Alan Cox <alan@linux.intel.com>
+
+commit 6d4f950e9ea15816c6a4f266ce6b9e438346771e upstream.
+
+The SC1200 needs a NULL terminator or it may cause a crash on boot.
+
+Bug #14227
+
+Also correct a bogus comment as the driver had serializing added so can run
+dual port.
+
+Signed-off-by: Alan Cox <alan@linux.intel.com>
+Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/ata/pata_sc1200.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/ata/pata_sc1200.c
++++ b/drivers/ata/pata_sc1200.c
+@@ -235,8 +235,7 @@ static int sc1200_init_one(struct pci_de
+ .udma_mask = ATA_UDMA2,
+ .port_ops = &sc1200_port_ops
+ };
+- /* Can't enable port 2 yet, see top comments */
+- const struct ata_port_info *ppi[] = { &info, };
++ const struct ata_port_info *ppi[] = { &info, NULL };
+
+ return ata_pci_sff_init_one(dev, ppi, &sc1200_sht, NULL);
+ }
+
+
+From gregkh@mini.kroah.org Fri Nov 6 14:15:49 2009
+Message-Id: <20091106221549.160832156@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Fri, 06 Nov 2009 14:15:13 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Tomoki Sekiyama <tomoki.sekiyama.qu@hitachi.com>,
+ Masanori Yoshida <masanori.yoshida.tv@hitachi.com>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [75/99] AF_UNIX: Fix deadlock on connecting to shutdown socket (CVE-2009-3621)
+References: <20091106221358.309857998@mini.kroah.org>
+Content-Disposition: inline; filename=af_unix-fix-deadlock-on-connecting-to-shutdown-socket-cve-2009-3621.patch
+Content-Length: 2533
+Lines: 85
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Tomoki Sekiyama <tomoki.sekiyama.qu@hitachi.com>
+
+commit 77238f2b942b38ab4e7f3aced44084493e4a8675 upstream.
+
+I found a deadlock bug in UNIX domain socket, which makes able to DoS
+attack against the local machine by non-root users.
+
+How to reproduce:
+1. Make a listening AF_UNIX/SOCK_STREAM socket with an abstruct
+ namespace(*), and shutdown(2) it.
+ 2. Repeat connect(2)ing to the listening socket from the other sockets
+ until the connection backlog is full-filled.
+ 3. connect(2) takes the CPU forever. If every core is taken, the
+ system hangs.
+
+PoC code: (Run as many times as cores on SMP machines.)
+
+int main(void)
+{
+ int ret;
+ int csd;
+ int lsd;
+ struct sockaddr_un sun;
+
+ /* make an abstruct name address (*) */
+ memset(&sun, 0, sizeof(sun));
+ sun.sun_family = PF_UNIX;
+ sprintf(&sun.sun_path[1], "%d", getpid());
+
+ /* create the listening socket and shutdown */
+ lsd = socket(AF_UNIX, SOCK_STREAM, 0);
+ bind(lsd, (struct sockaddr *)&sun, sizeof(sun));
+ listen(lsd, 1);
+ shutdown(lsd, SHUT_RDWR);
+
+ /* connect loop */
+ alarm(15); /* forcely exit the loop after 15 sec */
+ for (;;) {
+ csd = socket(AF_UNIX, SOCK_STREAM, 0);
+ ret = connect(csd, (struct sockaddr *)&sun, sizeof(sun));
+ if (-1 == ret) {
+ perror("connect()");
+ break;
+ }
+ puts("Connection OK");
+ }
+ return 0;
+}
+
+(*) Make sun_path[0] = 0 to use the abstruct namespace.
+ If a file-based socket is used, the system doesn't deadlock because
+ of context switches in the file system layer.
+
+Why this happens:
+ Error checks between unix_socket_connect() and unix_wait_for_peer() are
+ inconsistent. The former calls the latter to wait until the backlog is
+ processed. Despite the latter returns without doing anything when the
+ socket is shutdown, the former doesn't check the shutdown state and
+ just retries calling the latter forever.
+
+Patch:
+ The patch below adds shutdown check into unix_socket_connect(), so
+ connect(2) to the shutdown socket will return -ECONREFUSED.
+
+Signed-off-by: Tomoki Sekiyama <tomoki.sekiyama.qu@hitachi.com>
+Signed-off-by: Masanori Yoshida <masanori.yoshida.tv@hitachi.com>
+Cc: Chuck Ebbert <cebbert@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+
+---
+ net/unix/af_unix.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/net/unix/af_unix.c
++++ b/net/unix/af_unix.c
+@@ -1074,6 +1074,8 @@ restart:
+ err = -ECONNREFUSED;
+ if (other->sk_state != TCP_LISTEN)
+ goto out_unlock;
++ if (other->sk_shutdown & RCV_SHUTDOWN)
++ goto out_unlock;
+
+ if (unix_recvq_full(other)) {
+ err = -EAGAIN;
+
+
+From gregkh@mini.kroah.org Fri Nov 6 14:15:49 2009
+Message-Id: <20091106221549.324518938@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Fri, 06 Nov 2009 14:15:14 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ David Henningsson <launchpad.web@epost.diwic.se>,
+ Takashi Iwai <tiwai@suse.de>
+Subject: [76/99] ALSA: ice1724 - Make call to set hw params succeed on ESI Juli@
+References: <20091106221358.309857998@mini.kroah.org>
+Content-Disposition: inline; filename=alsa-ice1724-make-call-to-set-hw-params-succeed-on-esi-juli.patch
+Content-Length: 1055
+Lines: 29
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: David Henningsson <launchpad.web@epost.diwic.se>
+
+commit bd3c200e6d5495343c91db66d2acf1853b57a141 upstream.
+
+If two streams are started immediately after one another (such as a
+playback and a recording stream), the call to set hw params fails with
+EBUSY. This patch makes the call succeed, so playback and recording will
+work properly.
+
+Signed-off-by: David Henningsson <launchpad.web@epost.diwic.se>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/ice1712/ice1724.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/pci/ice1712/ice1724.c
++++ b/sound/pci/ice1712/ice1724.c
+@@ -643,7 +643,7 @@ static int snd_vt1724_set_pro_rate(struc
+ (inb(ICEMT1724(ice, DMA_PAUSE)) & DMA_PAUSES)) {
+ /* running? we cannot change the rate now... */
+ spin_unlock_irqrestore(&ice->reg_lock, flags);
+- return -EBUSY;
++ return ((rate == ice->cur_rate) && !force) ? 0 : -EBUSY;
+ }
+ if (!force && is_pro_rate_locked(ice)) {
+ spin_unlock_irqrestore(&ice->reg_lock, flags);
+
+
+From gregkh@mini.kroah.org Fri Nov 6 14:15:49 2009
+Message-Id: <20091106221549.488867204@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Fri, 06 Nov 2009 14:15:15 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jiri Bohac <jbohac@suse.cz>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [77/99] bonding: fix a race condition in calls to slave MII ioctls
+References: <20091106221358.309857998@mini.kroah.org>
+Content-Disposition: inline; filename=bonding-fix-a-race-condition-in-calls-to-slave-mii-ioctls.patch
+Content-Length: 1450
+Lines: 39
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Jiri Bohac <jbohac@suse.cz>
+
+commit d9d5283228d0c752f199c901fff6e1405dc91bcb upstream.
+
+In mii monitor mode, bond_check_dev_link() calls the the ioctl
+handler of slave devices. It stores the ndo_do_ioctl function
+pointer to a static (!) ioctl variable and later uses it to call the
+handler with the IOCTL macro.
+
+If another thread executes bond_check_dev_link() at the same time
+(even with a different bond, which none of the locks prevent), a
+race condition occurs. If the two racing slaves have different
+drivers, this may result in one driver's ioctl handler being
+called with a pointer to a net_device controlled with a different
+driver, resulting in unpredictable breakage.
+
+Unless I am overlooking something, the "static" must be a
+copy'n'paste error (?).
+
+Signed-off-by: Jiri Bohac <jbohac@suse.cz>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/bonding/bond_main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/bonding/bond_main.c
++++ b/drivers/net/bonding/bond_main.c
+@@ -691,7 +691,7 @@ static int bond_check_dev_link(struct bo
+ struct net_device *slave_dev, int reporting)
+ {
+ const struct net_device_ops *slave_ops = slave_dev->netdev_ops;
+- static int (*ioctl)(struct net_device *, struct ifreq *, int);
++ int (*ioctl)(struct net_device *, struct ifreq *, int);
+ struct ifreq ifr;
+ struct mii_ioctl_data *mii;
+
+
+
+From gregkh@mini.kroah.org Fri Nov 6 14:15:49 2009
+Message-Id: <20091106221549.637855004@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Fri, 06 Nov 2009 14:15:16 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jean Delvare <khali@linux-fr.org>
+Subject: [78/99] hwmon: (it87) Fix VID reading on IT8718F/IT8720F
+References: <20091106221358.309857998@mini.kroah.org>
+Content-Disposition: inline; filename=hwmon-it87-fix-vid-reading-on-it8718f-it8720f.patch
+Content-Length: 1115
+Lines: 36
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Jean Delvare <khali@linux-fr.org>
+
+commit 371dc4a6d8c3c74a9a1c74b87c2affb3fcef6500 upstream.
+
+Comparing apples to bananas doesn't seem right. Consistently use the
+chips enum for chip type comparisons, to avoid such bugs in the
+future.
+
+The bug has been there since support for the IT8718F was added, so
+VID never worked for this chip nor for the similar IT8720F.
+
+Signed-off-by: Jean Delvare <khali@linux-fr.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/hwmon/it87.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+--- a/drivers/hwmon/it87.c
++++ b/drivers/hwmon/it87.c
+@@ -1028,12 +1028,11 @@ static int __init it87_find(unsigned sho
+ chip_type, *address, sio_data->revision);
+
+ /* Read GPIO config and VID value from LDN 7 (GPIO) */
+- if (chip_type != IT8705F_DEVID) {
++ if (sio_data->type != it87) {
+ int reg;
+
+ superio_select(GPIO);
+- if ((chip_type == it8718) ||
+- (chip_type == it8720))
++ if (sio_data->type == it8718 || sio_data->type == it8720)
+ sio_data->vid_value = superio_inb(IT87_SIO_VID_REG);
+
+ reg = superio_inb(IT87_SIO_PINX2_REG);
+
+
+From gregkh@mini.kroah.org Fri Nov 6 14:15:49 2009
+Message-Id: <20091106221549.793440409@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Fri, 06 Nov 2009 14:15:17 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jiri Pirko <jpirko@redhat.com>,
+ "David S. Miller" <davem@davemloft.net>,
+ Chuck Ebbert <cebbert@redhat.com>
+Subject: [79/99] netlink: fix typo in initialization (CVE-2009-3612)
+References: <20091106221358.309857998@mini.kroah.org>
+Content-Disposition: inline; filename=netlink-fix-typo-in-initialization-cve-2009-3612.patch
+Content-Length: 902
+Lines: 29
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Jiri Pirko <jpirko@redhat.com>
+
+commit ad61df918c44316940404891d5082c63e79c256a upstream.
+
+Commit 9ef1d4c7c7aca1cd436612b6ca785b726ffb8ed8 ("[NETLINK]: Missing
+initializations in dumped data") introduced a typo in
+initialization. This patch fixes this.
+
+Signed-off-by: Jiri Pirko <jpirko@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Cc: Chuck Ebbert <cebbert@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/sched/cls_api.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/sched/cls_api.c
++++ b/net/sched/cls_api.c
+@@ -348,7 +348,7 @@ static int tcf_fill_node(struct sk_buff
+ tcm = NLMSG_DATA(nlh);
+ tcm->tcm_family = AF_UNSPEC;
+ tcm->tcm__pad1 = 0;
+- tcm->tcm__pad1 = 0;
++ tcm->tcm__pad2 = 0;
+ tcm->tcm_ifindex = qdisc_dev(tp->q)->ifindex;
+ tcm->tcm_parent = tp->classid;
+ tcm->tcm_info = TC_H_MAKE(tp->prio, tp->protocol);
+
+
+From gregkh@mini.kroah.org Fri Nov 6 14:15:50 2009
+Message-Id: <20091106221549.935130836@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Fri, 06 Nov 2009 14:15:18 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Ben Hutchings <ben@decadent.org.uk>,
+ Trond Myklebust <Trond.Myklebust@netapp.com>
+Subject: [80/99] nfs: Avoid overrun when copying client IP address string
+References: <20091106221358.309857998@mini.kroah.org>
+Content-Disposition: inline; filename=nfs-avoid-overrun-when-copying-client-ip-address-string.patch
+Content-Length: 1018
+Lines: 30
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Ben Hutchings <ben@decadent.org.uk>
+
+commit f4373bf9e67e4a653c8854acd7b02dac9714c98a upstream.
+
+As seen in <http://bugs.debian.org/549002>, nfs4_init_client() can
+overrun the source string when copying the client IP address from
+nfs_parsed_mount_data::client_address to nfs_client::cl_ipaddr. Since
+these are both treated as null-terminated strings elsewhere, the copy
+should be done with strlcpy() not memcpy().
+
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/nfs/client.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/nfs/client.c
++++ b/fs/nfs/client.c
+@@ -1171,7 +1171,7 @@ static int nfs4_init_client(struct nfs_c
+ 1, flags & NFS_MOUNT_NORESVPORT);
+ if (error < 0)
+ goto error;
+- memcpy(clp->cl_ipaddr, ip_addr, sizeof(clp->cl_ipaddr));
++ strlcpy(clp->cl_ipaddr, ip_addr, sizeof(clp->cl_ipaddr));
+
+ error = nfs_idmap_new(clp);
+ if (error < 0) {
+
+
+From gregkh@mini.kroah.org Fri Nov 6 14:15:50 2009
+Message-Id: <20091106221550.079264596@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Fri, 06 Nov 2009 14:15:19 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Terry Loftin <terry.loftin@hp.com>,
+ Trond Myklebust <Trond.Myklebust@netapp.com>
+Subject: [81/99] nfs: Panic when commit fails
+References: <20091106221358.309857998@mini.kroah.org>
+Content-Disposition: inline; filename=nfs-panic-when-commit-fails.patch
+Content-Length: 1250
+Lines: 34
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Terry Loftin <terry.loftin@hp.com>
+
+commit a8b40bc7e635831b61c43acc71a86d3a68b2dff0 upstream.
+
+Actually pass the NFS_FILE_SYNC option to the server to avoid a
+Panic in nfs_direct_write_complete() when a commit fails.
+
+At the end of an nfs write, if the nfs commit fails, all the writes
+will be rescheduled. They are supposed to be rescheduled as NFS_FILE_SYNC
+writes, but the rpc_task structure is not completely intialized and so
+the option is not passed. When the rescheduled writes complete, the
+return indicates that they are NFS_UNSTABLE and we try to do another
+commit. This leads to a Panic because the commit data structure pointer
+was set to null in the initial (failed) commit attempt.
+
+Signed-off-by: Terry Loftin <terry.loftin@hp.com>
+Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/nfs/direct.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/fs/nfs/direct.c
++++ b/fs/nfs/direct.c
+@@ -457,6 +457,7 @@ static void nfs_direct_write_reschedule(
+ };
+ struct rpc_task_setup task_setup_data = {
+ .rpc_client = NFS_CLIENT(inode),
++ .rpc_message = &msg,
+ .callback_ops = &nfs_write_direct_ops,
+ .workqueue = nfsiod_workqueue,
+ .flags = RPC_TASK_ASYNC,
+
+
+From gregkh@mini.kroah.org Fri Nov 6 14:15:50 2009
+Message-Id: <20091106221550.218945895@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Fri, 06 Nov 2009 14:15:20 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Trond Myklebust <Trond.Myklebust@netapp.com>
+Subject: [82/99] NFSv4: Fix a bug when the server returns NFS4ERR_RESOURCE
+References: <20091106221358.309857998@mini.kroah.org>
+Content-Disposition: inline; filename=nfsv4-fix-a-bug-when-the-server-returns-nfs4err_resource.patch
+Content-Length: 1582
+Lines: 55
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Trond Myklebust <Trond.Myklebust@netapp.com>
+
+commit 52567b03ca38b6e556ced450d64dba8d66e23b0e upstream.
+
+RFC 3530 states that when we recieve the error NFS4ERR_RESOURCE, we are not
+supposed to bump the sequence number on OPEN, LOCK, LOCKU, CLOSE, etc
+operations. The problem is that we map that error into EREMOTEIO in the XDR
+layer, and so the NFSv4 middle-layer routines like seqid_mutating_err(),
+and nfs_increment_seqid() don't recognise it.
+
+The fix is to defer the mapping until after the middle layers have
+processed the error.
+
+Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/nfs/nfs4proc.c | 11 ++++++++---
+ fs/nfs/nfs4xdr.c | 1 -
+ 2 files changed, 8 insertions(+), 4 deletions(-)
+
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -71,12 +71,17 @@ static int _nfs4_proc_getattr(struct nfs
+ /* Prevent leaks of NFSv4 errors into userland */
+ static int nfs4_map_errors(int err)
+ {
+- if (err < -1000) {
++ if (err >= -1000)
++ return err;
++ switch (err) {
++ case -NFS4ERR_RESOURCE:
++ return -EREMOTEIO;
++ default:
+ dprintk("%s could not handle NFSv4 error %d\n",
+ __func__, -err);
+- return -EIO;
++ break;
+ }
+- return err;
++ return -EIO;
+ }
+
+ /*
+--- a/fs/nfs/nfs4xdr.c
++++ b/fs/nfs/nfs4xdr.c
+@@ -5406,7 +5406,6 @@ static struct {
+ { NFS4ERR_SERVERFAULT, -ESERVERFAULT },
+ { NFS4ERR_BADTYPE, -EBADTYPE },
+ { NFS4ERR_LOCKED, -EAGAIN },
+- { NFS4ERR_RESOURCE, -EREMOTEIO },
+ { NFS4ERR_SYMLINK, -ELOOP },
+ { NFS4ERR_OP_ILLEGAL, -EOPNOTSUPP },
+ { NFS4ERR_DEADLOCK, -EDEADLK },
+
+
+From gregkh@mini.kroah.org Fri Nov 6 14:15:50 2009
+Message-Id: <20091106221550.359541615@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Fri, 06 Nov 2009 14:15:21 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Trond Myklebust <Trond.Myklebust@netapp.com>
+Subject: [83/99] NFSv4: Fix two unbalanced put_rpccred() issues.
+References: <20091106221358.309857998@mini.kroah.org>
+Content-Disposition: inline; filename=nfsv4-fix-two-unbalanced-put_rpccred-issues.patch
+Content-Length: 1242
+Lines: 38
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Trond Myklebust <Trond.Myklebust@netapp.com>
+
+commit 141aeb9f26f9f12f1584c128ce8697cdffb046e7 upstream.
+
+Commits 29fba38b (nfs41: lease renewal) and fc01cea9 (nfs41: sequence
+operation) introduce a couple of put_rpccred() calls on credentials for
+which there is no corresponding get_rpccred().
+
+See http://bugzilla.kernel.org/show_bug.cgi?id=14249
+
+Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/nfs/nfs4proc.c | 4 ----
+ 1 file changed, 4 deletions(-)
+
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -3038,9 +3038,6 @@ static void nfs4_renew_done(struct rpc_t
+ if (time_before(clp->cl_last_renewal,timestamp))
+ clp->cl_last_renewal = timestamp;
+ spin_unlock(&clp->cl_lock);
+- dprintk("%s calling put_rpccred on rpc_cred %p\n", __func__,
+- task->tk_msg.rpc_cred);
+- put_rpccred(task->tk_msg.rpc_cred);
+ }
+
+ static const struct rpc_call_ops nfs4_renew_ops = {
+@@ -4855,7 +4852,6 @@ void nfs41_sequence_call_done(struct rpc
+ nfs41_sequence_free_slot(clp, task->tk_msg.rpc_resp);
+ dprintk("%s rpc_cred %p\n", __func__, task->tk_msg.rpc_cred);
+
+- put_rpccred(task->tk_msg.rpc_cred);
+ kfree(task->tk_msg.rpc_argp);
+ kfree(task->tk_msg.rpc_resp);
+
+
+
+From gregkh@mini.kroah.org Fri Nov 6 14:15:50 2009
+Message-Id: <20091106221550.501722190@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Fri, 06 Nov 2009 14:15:22 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Trond Myklebust <Trond.Myklebust@netapp.com>
+Subject: [84/99] NFSv4: Kill nfs4_renewd_prepare_shutdown()
+References: <20091106221358.309857998@mini.kroah.org>
+Content-Disposition: inline; filename=nfsv4-kill-nfs4_renewd_prepare_shutdown.patch
+Content-Length: 1410
+Lines: 46
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Trond Myklebust <Trond.Myklebust@netapp.com>
+
+commit 3050141bae57984dd660e6861632ccf9b8bca77e upstream.
+
+The NFSv4 renew daemon is shared between all active super blocks that refer
+to a particular NFS server, so it is wrong to be shutting it down in
+nfs4_kill_super every time a super block is destroyed.
+
+This patch therefore kills nfs4_renewd_prepare_shutdown altogether, and
+leaves it up to nfs4_shutdown_client() to also shut down the renew daemon
+by means of the existing call to nfs4_kill_renewd().
+
+Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/nfs/nfs4renewd.c | 6 ------
+ fs/nfs/super.c | 1 -
+ 2 files changed, 7 deletions(-)
+
+--- a/fs/nfs/nfs4renewd.c
++++ b/fs/nfs/nfs4renewd.c
+@@ -127,12 +127,6 @@ nfs4_schedule_state_renewal(struct nfs_c
+ }
+
+ void
+-nfs4_renewd_prepare_shutdown(struct nfs_server *server)
+-{
+- cancel_delayed_work(&server->nfs_client->cl_renewd);
+-}
+-
+-void
+ nfs4_kill_renewd(struct nfs_client *clp)
+ {
+ cancel_delayed_work_sync(&clp->cl_renewd);
+--- a/fs/nfs/super.c
++++ b/fs/nfs/super.c
+@@ -2670,7 +2670,6 @@ static void nfs4_kill_super(struct super
+ dprintk("--> %s\n", __func__);
+ nfs_super_return_all_delegations(sb);
+ kill_anon_super(sb);
+- nfs4_renewd_prepare_shutdown(server);
+ nfs_fscache_release_super_cookie(sb);
+ nfs_free_server(server);
+ dprintk("<-- %s\n", __func__);
+
+
+From gregkh@mini.kroah.org Fri Nov 6 14:15:50 2009
+Message-Id: <20091106221550.653683831@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Fri, 06 Nov 2009 14:15:23 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Trond Myklebust <Trond.Myklebust@netapp.com>
+Subject: [85/99] NFSv4: The link() operation should return any delegation on the file
+References: <20091106221358.309857998@mini.kroah.org>
+Content-Disposition: inline; filename=nfsv4-the-link-operation-should-return-any-delegation-on-the-file.patch
+Content-Length: 704
+Lines: 25
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Trond Myklebust <Trond.Myklebust@netapp.com>
+
+commit 9a3936aac133037f65124fcb2d676a6c201a90a4 upstream.
+
+Otherwise, we have to wait for the server to recall it.
+
+Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/nfs/dir.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/fs/nfs/dir.c
++++ b/fs/nfs/dir.c
+@@ -1536,6 +1536,8 @@ nfs_link(struct dentry *old_dentry, stru
+ old_dentry->d_parent->d_name.name, old_dentry->d_name.name,
+ dentry->d_parent->d_name.name, dentry->d_name.name);
+
++ nfs_inode_return_delegation(inode);
++
+ d_drop(dentry);
+ error = NFS_PROTO(dir)->link(inode, dir, &dentry->d_name);
+ if (error == 0) {
+
+
+From gregkh@mini.kroah.org Fri Nov 6 14:15:50 2009
+Message-Id: <20091106221550.789625190@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Fri, 06 Nov 2009 14:15:24 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Bastian Blank <waldi@debian.org>,
+ Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Subject: [86/99] powerpc: Remove SMP warning from PowerMac cpufreq
+References: <20091106221358.309857998@mini.kroah.org>
+Content-Disposition: inline; filename=powerpc-remove-smp-warning-from-powermac-cpufreq.patch
+Content-Length: 1506
+Lines: 47
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Bastian Blank <bastian@waldi.eu.org>
+
+commit 6fdc31a2b86cf1f98e3eed896578ad9659eeb0f8 upstream.
+
+On Thu, Aug 13, 2009 at 04:14:58PM +1000, Benjamin Herrenschmidt wrote:
+> On Tue, 2009-08-11 at 11:39 +0200, Bastian Blank wrote:
+> > This patch just disables this driver on SMP kernels, as it is obviously
+> > not supported.
+> Why not remove the #error instead ? :-) I don't think it's still
+> meaningful, especially since we use the timebase for delays nowadays
+> which doesn't depend on the CPU frequency...
+
+Your call. Take this one:
+
+The build of a PowerMac 32bit kernel currently fails with
+
+error: #warning "WARNING, CPUFREQ not recommended on SMP kernels"
+
+Thie patch removes the not longer applicable SMP warning from the
+PowerMac cpufreq code.
+
+Signed-off-by: Bastian Blank <waldi@debian.org>
+Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/powerpc/platforms/powermac/cpufreq_32.c | 8 --------
+ 1 file changed, 8 deletions(-)
+
+--- a/arch/powerpc/platforms/powermac/cpufreq_32.c
++++ b/arch/powerpc/platforms/powermac/cpufreq_32.c
+@@ -44,14 +44,6 @@
+ */
+ #undef DEBUG_FREQ
+
+-/*
+- * There is a problem with the core cpufreq code on SMP kernels,
+- * it won't recalculate the Bogomips properly
+- */
+-#ifdef CONFIG_SMP
+-#warning "WARNING, CPUFREQ not recommended on SMP kernels"
+-#endif
+-
+ extern void low_choose_7447a_dfs(int dfs);
+ extern void low_choose_750fx_pll(int pll);
+ extern void low_sleep_handler(void);
+
+
+From gregkh@mini.kroah.org Fri Nov 6 14:15:51 2009
+Message-Id: <20091106221550.930885114@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Fri, 06 Nov 2009 14:15:25 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Wu Fengguang <fengguang.wu@intel.com>,
+ Hugh Dickins <hugh.dickins@tiscali.co.uk>
+Subject: [87/99] vmscan: limit VM_EXEC protection to file pages
+References: <20091106221358.309857998@mini.kroah.org>
+Content-Disposition: inline; filename=vmscan-limit-vm_exec-protection-to-file-pages.patch
+Content-Length: 1202
+Lines: 33
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Wu Fengguang <fengguang.wu@intel.com>
+
+commit 41e20983fe553b39bc2b00e07c7a379f0c86a4bc upstream.
+
+It is possible to have !Anon but SwapBacked pages, and some apps could
+create huge number of such pages with MAP_SHARED|MAP_ANONYMOUS. These
+pages go into the ANON lru list, and hence shall not be protected: we only
+care mapped executable files. Failing to do so may trigger OOM.
+
+Tested-by: Christian Borntraeger <borntraeger@de.ibm.com>
+Reviewed-by: Rik van Riel <riel@redhat.com>
+Signed-off-by: Wu Fengguang <fengguang.wu@intel.com>
+Cc: Hugh Dickins <hugh.dickins@tiscali.co.uk>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ mm/vmscan.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/mm/vmscan.c
++++ b/mm/vmscan.c
+@@ -1298,7 +1298,7 @@ static void shrink_active_list(unsigned
+ * IO, plus JVM can create lots of anon VM_EXEC pages,
+ * so we ignore them here.
+ */
+- if ((vm_flags & VM_EXEC) && !PageAnon(page)) {
++ if ((vm_flags & VM_EXEC) && page_is_file_cache(page)) {
+ list_add(&page->lru, &l_active);
+ continue;
+ }
+
+
+From gregkh@mini.kroah.org Fri Nov 6 14:15:51 2009
+Message-Id: <20091106221551.089571423@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Fri, 06 Nov 2009 14:15:26 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Hidetoshi Seto <seto.hidetoshi@jp.fujitsu.com>,
+ Huang Ying <ying.huang@intel.com>,
+ Andi Kleen <ak@linux.intel.com>,
+ Ingo Molnar <mingo@elte.hu>
+Subject: [88/99] x86: mce: Clean up thermal throttling state tracking code
+References: <20091106221358.309857998@mini.kroah.org>
+Content-Disposition: inline; filename=x86-mce-clean-up-thermal-throttling-state-tracking-code.patch
+Content-Length: 4990
+Lines: 153
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Ingo Molnar <mingo@elte.hu>
+
+commit 3967684006f30c253bc6d4a6604d1bad4a7fc672 upstream.
+
+Instead of a mess of three separate percpu variables, consolidate
+the state into a single structure.
+
+Also clean up therm_throt_process(), use cleaner and more
+understandable variable names and a clearer logic.
+
+This, without changing the logic, makes the code more
+streamlined, more readable and smaller as well:
+
+ text data bss dec hex filename
+ 1487 169 4 1660 67c therm_throt.o.before
+ 1432 176 4 1612 64c therm_throt.o.after
+
+Cc: Hidetoshi Seto <seto.hidetoshi@jp.fujitsu.com>
+Cc: Huang Ying <ying.huang@intel.com>
+Cc: Andi Kleen <ak@linux.intel.com>
+LKML-Reference: <new-submission>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/cpu/mcheck/therm_throt.c | 63 +++++++++++++++++++------------
+ 1 file changed, 39 insertions(+), 24 deletions(-)
+
+--- a/arch/x86/kernel/cpu/mcheck/therm_throt.c
++++ b/arch/x86/kernel/cpu/mcheck/therm_throt.c
+@@ -34,20 +34,30 @@
+ /* How long to wait between reporting thermal events */
+ #define CHECK_INTERVAL (300 * HZ)
+
+-static DEFINE_PER_CPU(__u64, next_check) = INITIAL_JIFFIES;
+-static DEFINE_PER_CPU(unsigned long, thermal_throttle_count);
+-static DEFINE_PER_CPU(bool, thermal_throttle_active);
++/*
++ * Current thermal throttling state:
++ */
++struct thermal_state {
++ bool is_throttled;
++
++ u64 next_check;
++ unsigned long throttle_count;
++};
++
++static DEFINE_PER_CPU(struct thermal_state, thermal_state);
+
+-static atomic_t therm_throt_en = ATOMIC_INIT(0);
++static atomic_t therm_throt_en = ATOMIC_INIT(0);
+
+ #ifdef CONFIG_SYSFS
+ #define define_therm_throt_sysdev_one_ro(_name) \
+ static SYSDEV_ATTR(_name, 0444, therm_throt_sysdev_show_##_name, NULL)
+
+ #define define_therm_throt_sysdev_show_func(name) \
+-static ssize_t therm_throt_sysdev_show_##name(struct sys_device *dev, \
+- struct sysdev_attribute *attr, \
+- char *buf) \
++ \
++static ssize_t therm_throt_sysdev_show_##name( \
++ struct sys_device *dev, \
++ struct sysdev_attribute *attr, \
++ char *buf) \
+ { \
+ unsigned int cpu = dev->id; \
+ ssize_t ret; \
+@@ -55,7 +65,7 @@ static ssize_t therm_throt_sysdev_show_#
+ preempt_disable(); /* CPU hotplug */ \
+ if (cpu_online(cpu)) \
+ ret = sprintf(buf, "%lu\n", \
+- per_cpu(thermal_throttle_##name, cpu)); \
++ per_cpu(thermal_state, cpu).name); \
+ else \
+ ret = 0; \
+ preempt_enable(); \
+@@ -63,11 +73,11 @@ static ssize_t therm_throt_sysdev_show_#
+ return ret; \
+ }
+
+-define_therm_throt_sysdev_show_func(count);
+-define_therm_throt_sysdev_one_ro(count);
++define_therm_throt_sysdev_show_func(throttle_count);
++define_therm_throt_sysdev_one_ro(throttle_count);
+
+ static struct attribute *thermal_throttle_attrs[] = {
+- &attr_count.attr,
++ &attr_throttle_count.attr,
+ NULL
+ };
+
+@@ -93,33 +103,38 @@ static struct attribute_group thermal_th
+ * 1 : Event should be logged further, and a message has been
+ * printed to the syslog.
+ */
+-static int therm_throt_process(int curr)
++static int therm_throt_process(bool is_throttled)
+ {
+- unsigned int cpu = smp_processor_id();
+- __u64 tmp_jiffs = get_jiffies_64();
+- bool was_throttled = __get_cpu_var(thermal_throttle_active);
+- bool is_throttled = __get_cpu_var(thermal_throttle_active) = curr;
++ struct thermal_state *state;
++ unsigned int this_cpu;
++ bool was_throttled;
++ u64 now;
++
++ this_cpu = smp_processor_id();
++ now = get_jiffies_64();
++ state = &per_cpu(thermal_state, this_cpu);
++
++ was_throttled = state->is_throttled;
++ state->is_throttled = is_throttled;
+
+ if (is_throttled)
+- __get_cpu_var(thermal_throttle_count)++;
++ state->throttle_count++;
+
+ if (!(was_throttled ^ is_throttled) &&
+- time_before64(tmp_jiffs, __get_cpu_var(next_check)))
++ time_before64(now, state->next_check))
+ return 0;
+
+- __get_cpu_var(next_check) = tmp_jiffs + CHECK_INTERVAL;
++ state->next_check = now + CHECK_INTERVAL;
+
+ /* if we just entered the thermal event */
+ if (is_throttled) {
+- printk(KERN_CRIT "CPU%d: Temperature above threshold, "
+- "cpu clock throttled (total events = %lu)\n",
+- cpu, __get_cpu_var(thermal_throttle_count));
++ printk(KERN_CRIT "CPU%d: Temperature above threshold, cpu clock throttled (total events = %lu)\n", this_cpu, state->throttle_count);
+
+ add_taint(TAINT_MACHINE_CHECK);
+ return 1;
+ }
+ if (was_throttled) {
+- printk(KERN_INFO "CPU%d: Temperature/speed normal\n", cpu);
++ printk(KERN_INFO "CPU%d: Temperature/speed normal\n", this_cpu);
+ return 1;
+ }
+
+@@ -213,7 +228,7 @@ static void intel_thermal_interrupt(void
+ __u64 msr_val;
+
+ rdmsrl(MSR_IA32_THERM_STATUS, msr_val);
+- if (therm_throt_process(msr_val & THERM_STATUS_PROCHOT))
++ if (therm_throt_process((msr_val & THERM_STATUS_PROCHOT) != 0))
+ mce_log_therm_throt_event(msr_val);
+ }
+
+
+
+From gregkh@mini.kroah.org Fri Nov 6 14:15:51 2009
+Message-Id: <20091106221551.250413089@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Fri, 06 Nov 2009 14:15:27 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Hidetoshi Seto <seto.hidetoshi@jp.fujitsu.com>,
+ Huang Ying <ying.huang@intel.com>,
+ Andi Kleen <ak@linux.intel.com>,
+ Ingo Molnar <mingo@elte.hu>
+Subject: [89/99] x86: mce: Fix thermal throttling message storm
+References: <20091106221358.309857998@mini.kroah.org>
+Content-Disposition: inline; filename=x86-mce-fix-thermal-throttling-message-storm.patch
+Content-Length: 2091
+Lines: 61
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Ingo Molnar <mingo@elte.hu>
+
+commit b417c9fd8690637f0c91479435ab3e2bf450c038 upstream.
+
+If a system switches back and forth between hot and cold mode,
+the MCE code will print a stream of critical kernel messages.
+
+Extend the throttling code to properly notice this, by
+only printing the first hot + cold transition and omitting
+the rest up to CHECK_INTERVAL (5 minutes).
+
+This way we'll only get a single incident of:
+
+ [ 102.356584] CPU0: Temperature above threshold, cpu clock throttled (total events = 1)
+ [ 102.357000] Disabling lock debugging due to kernel taint
+ [ 102.369223] CPU0: Temperature/speed normal
+
+Every 5 minutes. The 'total events' count tells the number of cold/hot
+transitions detected, should overheating occur after 5 minutes again:
+
+[ 402.357580] CPU0: Temperature above threshold, cpu clock throttled (total events = 24891)
+[ 402.358001] CPU0: Temperature/speed normal
+[ 450.704142] Machine check events logged
+
+Cc: Hidetoshi Seto <seto.hidetoshi@jp.fujitsu.com>
+Cc: Huang Ying <ying.huang@intel.com>
+Cc: Andi Kleen <ak@linux.intel.com>
+LKML-Reference: <new-submission>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/cpu/mcheck/therm_throt.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/arch/x86/kernel/cpu/mcheck/therm_throt.c
++++ b/arch/x86/kernel/cpu/mcheck/therm_throt.c
+@@ -42,6 +42,7 @@ struct thermal_state {
+
+ u64 next_check;
+ unsigned long throttle_count;
++ unsigned long last_throttle_count;
+ };
+
+ static DEFINE_PER_CPU(struct thermal_state, thermal_state);
+@@ -120,11 +121,12 @@ static int therm_throt_process(bool is_t
+ if (is_throttled)
+ state->throttle_count++;
+
+- if (!(was_throttled ^ is_throttled) &&
+- time_before64(now, state->next_check))
++ if (time_before64(now, state->next_check) &&
++ state->throttle_count != state->last_throttle_count)
+ return 0;
+
+ state->next_check = now + CHECK_INTERVAL;
++ state->last_throttle_count = state->throttle_count;
+
+ /* if we just entered the thermal event */
+ if (is_throttled) {
+
+
+From gregkh@mini.kroah.org Fri Nov 6 14:15:51 2009
+Message-Id: <20091106221551.389639017@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Fri, 06 Nov 2009 14:15:28 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Reinette Chatre <reinette.chatre@intel.com>,
+ "John W. Linville" <linville@tuxdriver.com>
+Subject: [90/99] iwlwifi: fix potential rx buffer loss
+References: <20091106221358.309857998@mini.kroah.org>
+Content-Disposition: inline; filename=iwlwifi-fix-potential-rx-buffer-loss.patch
+Content-Length: 4379
+Lines: 130
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Reinette Chatre <reinette.chatre@intel.com>
+
+commit de0bd50845eb5935ce3d503c5d2f565d6cb9ece1 upstream.
+
+RX handling maintains a few lists that keep track of the RX buffers.
+Buffers move from one list to the other as they are used, replenished, and
+again made available for usage. In one such instance, when a buffer is used
+it enters the "rx_used" list. When buffers are replenished an skb is
+attached to the buffer and it is moved to the "rx_free" list. The problem
+here is that the buffer is first removed from the "rx_used" list _before_ the
+skb is allocated. Thus, if the skb allocation fails this buffer remains
+removed from the "rx_used" list and is thus lost for future usage.
+
+Fix this by first allocating the skb before trying to attach it to a list.
+We add an additional check to not do this unnecessarily.
+
+Reported-by: Rick Farrington <rickdic@hotmail.com>
+Signed-off-by: Reinette Chatre <reinette.chatre@intel.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/iwlwifi/iwl-rx.c | 24 +++++++++++++++++-------
+ drivers/net/wireless/iwlwifi/iwl3945-base.c | 24 ++++++++++++++++--------
+ 2 files changed, 33 insertions(+), 15 deletions(-)
+
+--- a/drivers/net/wireless/iwlwifi/iwl3945-base.c
++++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c
+@@ -1196,6 +1196,7 @@ static void iwl3945_rx_allocate(struct i
+ struct iwl_rx_queue *rxq = &priv->rxq;
+ struct list_head *element;
+ struct iwl_rx_mem_buffer *rxb;
++ struct sk_buff *skb;
+ unsigned long flags;
+
+ while (1) {
+@@ -1205,17 +1206,11 @@ static void iwl3945_rx_allocate(struct i
+ spin_unlock_irqrestore(&rxq->lock, flags);
+ return;
+ }
+-
+- element = rxq->rx_used.next;
+- rxb = list_entry(element, struct iwl_rx_mem_buffer, list);
+- list_del(element);
+ spin_unlock_irqrestore(&rxq->lock, flags);
+
+ /* Alloc a new receive buffer */
+- rxb->skb =
+- alloc_skb(priv->hw_params.rx_buf_size,
+- priority);
+- if (!rxb->skb) {
++ skb = alloc_skb(priv->hw_params.rx_buf_size, priority);
++ if (!skb) {
+ if (net_ratelimit())
+ IWL_CRIT(priv, ": Can not allocate SKB buffers\n");
+ /* We don't reschedule replenish work here -- we will
+@@ -1224,6 +1219,19 @@ static void iwl3945_rx_allocate(struct i
+ break;
+ }
+
++ spin_lock_irqsave(&rxq->lock, flags);
++ if (list_empty(&rxq->rx_used)) {
++ spin_unlock_irqrestore(&rxq->lock, flags);
++ dev_kfree_skb_any(skb);
++ return;
++ }
++ element = rxq->rx_used.next;
++ rxb = list_entry(element, struct iwl_rx_mem_buffer, list);
++ list_del(element);
++ spin_unlock_irqrestore(&rxq->lock, flags);
++
++ rxb->skb = skb;
++
+ /* If radiotap head is required, reserve some headroom here.
+ * The physical head count is a variable rx_stats->phy_count.
+ * We reserve 4 bytes here. Plus these extra bytes, the
+--- a/drivers/net/wireless/iwlwifi/iwl-rx.c
++++ b/drivers/net/wireless/iwlwifi/iwl-rx.c
+@@ -239,26 +239,22 @@ void iwl_rx_allocate(struct iwl_priv *pr
+ struct iwl_rx_queue *rxq = &priv->rxq;
+ struct list_head *element;
+ struct iwl_rx_mem_buffer *rxb;
++ struct sk_buff *skb;
+ unsigned long flags;
+
+ while (1) {
+ spin_lock_irqsave(&rxq->lock, flags);
+-
+ if (list_empty(&rxq->rx_used)) {
+ spin_unlock_irqrestore(&rxq->lock, flags);
+ return;
+ }
+- element = rxq->rx_used.next;
+- rxb = list_entry(element, struct iwl_rx_mem_buffer, list);
+- list_del(element);
+-
+ spin_unlock_irqrestore(&rxq->lock, flags);
+
+ /* Alloc a new receive buffer */
+- rxb->skb = alloc_skb(priv->hw_params.rx_buf_size + 256,
++ skb = alloc_skb(priv->hw_params.rx_buf_size + 256,
+ priority);
+
+- if (!rxb->skb) {
++ if (!skb) {
+ IWL_CRIT(priv, "Can not allocate SKB buffers\n");
+ /* We don't reschedule replenish work here -- we will
+ * call the restock method and if it still needs
+@@ -266,6 +262,20 @@ void iwl_rx_allocate(struct iwl_priv *pr
+ break;
+ }
+
++ spin_lock_irqsave(&rxq->lock, flags);
++
++ if (list_empty(&rxq->rx_used)) {
++ spin_unlock_irqrestore(&rxq->lock, flags);
++ dev_kfree_skb_any(skb);
++ return;
++ }
++ element = rxq->rx_used.next;
++ rxb = list_entry(element, struct iwl_rx_mem_buffer, list);
++ list_del(element);
++
++ spin_unlock_irqrestore(&rxq->lock, flags);
++
++ rxb->skb = skb;
+ /* Get physical address of RB/SKB */
+ rxb->real_dma_addr = pci_map_single(
+ priv->pci_dev,
+
+
+From gregkh@mini.kroah.org Fri Nov 6 14:15:51 2009
+Message-Id: <20091106221551.539852739@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Fri, 06 Nov 2009 14:15:29 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Reinette Chatre <reinette.chatre@intel.com>,
+ Mel Gorman <mel@csn.ul.ie>,
+ "John W. Linville" <linville@tuxdriver.com>
+Subject: [91/99] iwlwifi: reduce noise when skb allocation fails
+References: <20091106221358.309857998@mini.kroah.org>
+Content-Disposition: inline; filename=iwlwifi-reduce-noise-when-skb-allocation-fails.patch
+Content-Length: 3315
+Lines: 78
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Reinette Chatre <reinette.chatre@intel.com>
+
+commit f82a924cc88a5541df1d4b9d38a0968cd077a051 upstream.
+
+Replenishment of receive buffers is done in the tasklet handling
+received frames as well as in a workqueue. When we are in the tasklet
+we cannot sleep and thus attempt atomic skb allocations. It is generally
+not a big problem if this fails since iwl_rx_allocate is always followed
+by a call to iwl_rx_queue_restock which will queue the work to replenish
+the buffers at a time when sleeping is allowed.
+
+We thus add the __GFP_NOWARN to the skb allocation in iwl_rx_allocate to
+reduce the noise if such an allocation fails while we still have enough
+buffers. We do maintain the warning and the error message when we are low
+on buffers to communicate to the user that there is a potential problem with
+memory availability on system
+
+This addresses issue reported upstream in thread "iwlagn: order 2 page
+allocation failures" in
+http://thread.gmane.org/gmane.linux.kernel.wireless.general/39187
+
+Signed-off-by: Reinette Chatre <reinette.chatre@intel.com>
+Acked-by: Mel Gorman <mel@csn.ul.ie>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/iwlwifi/iwl-rx.c | 10 +++++++++-
+ drivers/net/wireless/iwlwifi/iwl3945-base.c | 9 ++++++++-
+ 2 files changed, 17 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/iwlwifi/iwl3945-base.c
++++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c
+@@ -1208,11 +1208,18 @@ static void iwl3945_rx_allocate(struct i
+ }
+ spin_unlock_irqrestore(&rxq->lock, flags);
+
++ if (rxq->free_count > RX_LOW_WATERMARK)
++ priority |= __GFP_NOWARN;
+ /* Alloc a new receive buffer */
+ skb = alloc_skb(priv->hw_params.rx_buf_size, priority);
+ if (!skb) {
+ if (net_ratelimit())
+- IWL_CRIT(priv, ": Can not allocate SKB buffers\n");
++ IWL_DEBUG_INFO(priv, "Failed to allocate SKB buffer.\n");
++ if ((rxq->free_count <= RX_LOW_WATERMARK) &&
++ net_ratelimit())
++ IWL_CRIT(priv, "Failed to allocate SKB buffer with %s. Only %u free buffers remaining.\n",
++ priority == GFP_ATOMIC ? "GFP_ATOMIC" : "GFP_KERNEL",
++ rxq->free_count);
+ /* We don't reschedule replenish work here -- we will
+ * call the restock method and if it still needs
+ * more buffers it will schedule replenish */
+--- a/drivers/net/wireless/iwlwifi/iwl-rx.c
++++ b/drivers/net/wireless/iwlwifi/iwl-rx.c
+@@ -250,12 +250,20 @@ void iwl_rx_allocate(struct iwl_priv *pr
+ }
+ spin_unlock_irqrestore(&rxq->lock, flags);
+
++ if (rxq->free_count > RX_LOW_WATERMARK)
++ priority |= __GFP_NOWARN;
+ /* Alloc a new receive buffer */
+ skb = alloc_skb(priv->hw_params.rx_buf_size + 256,
+ priority);
+
+ if (!skb) {
+- IWL_CRIT(priv, "Can not allocate SKB buffers\n");
++ if (net_ratelimit())
++ IWL_DEBUG_INFO(priv, "Failed to allocate SKB buffer.\n");
++ if ((rxq->free_count <= RX_LOW_WATERMARK) &&
++ net_ratelimit())
++ IWL_CRIT(priv, "Failed to allocate SKB buffer with %s. Only %u free buffers remaining.\n",
++ priority == GFP_ATOMIC ? "GFP_ATOMIC" : "GFP_KERNEL",
++ rxq->free_count);
+ /* We don't reschedule replenish work here -- we will
+ * call the restock method and if it still needs
+ * more buffers it will schedule replenish */
+
+
+From gregkh@mini.kroah.org Fri Nov 6 14:15:51 2009
+Message-Id: <20091106221551.713475785@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Fri, 06 Nov 2009 14:15:30 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Joerg Roedel <joerg.roedel@amd.com>
+Subject: [92/99] x86/amd-iommu: Un__init function required on shutdown
+References: <20091106221358.309857998@mini.kroah.org>
+Content-Disposition: inline; filename=x86-amd-iommu-un__init-function-required-on-shutdown.patch
+Content-Length: 857
+Lines: 28
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Joerg Roedel <joerg.roedel@amd.com>
+
+commit ca0207114f1708b563f510b7781a360ec5b98359 upstream.
+
+The function iommu_feature_disable is required on system
+shutdown to disable the IOMMU but it is marked as __init.
+This may result in a panic if the memory is reused. This
+patch fixes this bug.
+
+Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/amd_iommu_init.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/x86/kernel/amd_iommu_init.c
++++ b/arch/x86/kernel/amd_iommu_init.c
+@@ -240,7 +240,7 @@ static void iommu_feature_enable(struct
+ writel(ctrl, iommu->mmio_base + MMIO_CONTROL_OFFSET);
+ }
+
+-static void __init iommu_feature_disable(struct amd_iommu *iommu, u8 bit)
++static void iommu_feature_disable(struct amd_iommu *iommu, u8 bit)
+ {
+ u32 ctrl;
+
+
+
+From gregkh@mini.kroah.org Fri Nov 6 14:15:52 2009
+Message-Id: <20091106221551.845376408@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Fri, 06 Nov 2009 14:15:31 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ Greg KH <greg@kroah.com>
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ "Darrick J. Wong" <djwong@us.ibm.com>,
+ Marcelo Tosatti <mtosatti@redhat.com>
+Subject: [93/99] KVM: Prevent kvm_init from corrupting debugfs structures
+References: <20091106221358.309857998@mini.kroah.org>
+Content-Disposition: inline; filename=kvm-prevent-kvm_init-from-corrupting-debugfs-structures.patch
+Content-Length: 2262
+Lines: 85
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Darrick J. Wong <djwong@us.ibm.com>
+
+commit: 0ea4ed8e948c30f88c824c973ee4b9529015fe65 upstream
+
+I'm seeing an oops condition when kvm-intel and kvm-amd are modprobe'd
+during boot (say on an Intel system) and then rmmod'd:
+
+ # modprobe kvm-intel
+ kvm_init()
+ kvm_init_debug()
+ kvm_arch_init() <-- stores debugfs dentries internally
+ (success, etc)
+
+ # modprobe kvm-amd
+ kvm_init()
+ kvm_init_debug() <-- second initialization clobbers kvm's
+ internal pointers to dentries
+ kvm_arch_init()
+ kvm_exit_debug() <-- and frees them
+
+ # rmmod kvm-intel
+ kvm_exit()
+ kvm_exit_debug() <-- double free of debugfs files!
+
+ *BOOM*
+
+If execution gets to the end of kvm_init(), then the calling module has been
+established as the kvm provider. Move the debugfs initialization to the end of
+the function, and remove the now-unnecessary call to kvm_exit_debug() from the
+error path. That way we avoid trampling on the debugfs entries and freeing
+them twice.
+
+Signed-off-by: Darrick J. Wong <djwong@us.ibm.com>
+Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ virt/kvm/kvm_main.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+--- a/virt/kvm/kvm_main.c
++++ b/virt/kvm/kvm_main.c
+@@ -2590,8 +2590,6 @@ int kvm_init(void *opaque, unsigned int
+ int r;
+ int cpu;
+
+- kvm_init_debug();
+-
+ r = kvm_arch_init(opaque);
+ if (r)
+ goto out_fail;
+@@ -2658,6 +2656,8 @@ int kvm_init(void *opaque, unsigned int
+ kvm_preempt_ops.sched_in = kvm_sched_in;
+ kvm_preempt_ops.sched_out = kvm_sched_out;
+
++ kvm_init_debug();
++
+ return 0;
+
+ out_free:
+@@ -2679,7 +2679,6 @@ out_free_0:
+ __free_page(bad_page);
+ out:
+ kvm_arch_exit();
+- kvm_exit_debug();
+ out_fail:
+ return r;
+ }
+@@ -2688,6 +2687,7 @@ EXPORT_SYMBOL_GPL(kvm_init);
+ void kvm_exit(void)
+ {
+ kvm_trace_cleanup();
++ kvm_exit_debug();
+ misc_deregister(&kvm_dev);
+ kmem_cache_destroy(kvm_vcpu_cache);
+ sysdev_unregister(&kvm_sysdev);
+@@ -2697,7 +2697,6 @@ void kvm_exit(void)
+ on_each_cpu(hardware_disable, NULL, 1);
+ kvm_arch_hardware_unsetup();
+ kvm_arch_exit();
+- kvm_exit_debug();
+ free_cpumask_var(cpus_hardware_enabled);
+ __free_page(bad_page);
+ }
+
+
+From gregkh@mini.kroah.org Fri Nov 6 14:15:52 2009
+Message-Id: <20091106221552.018297553@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Fri, 06 Nov 2009 14:15:32 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Subject: [94/99] powerpc/pmac: Fix PowerSurge SMP IPI allocation
+References: <20091106221358.309857998@mini.kroah.org>
+Content-Disposition: inline; filename=powerpc-pmac-fix-powersurge-smp-ipi-allocation.patch
+Content-Length: 897
+Lines: 26
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+
+commit 527b3639616b21c257518ee7c26fbf05232db0c0 upstream.
+
+The code for setting up the IPIs for SMP PowerSurge marchines bitrot,
+it needs to properly map the HW interrupt number
+
+Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/powerpc/platforms/powermac/smp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/powerpc/platforms/powermac/smp.c
++++ b/arch/powerpc/platforms/powermac/smp.c
+@@ -408,7 +408,7 @@ static void __init smp_psurge_setup_cpu(
+ /* reset the entry point so if we get another intr we won't
+ * try to startup again */
+ out_be32(psurge_start, 0x100);
+- if (setup_irq(30, &psurge_irqaction))
++ if (setup_irq(irq_create_mapping(NULL, 30), &psurge_irqaction))
+ printk(KERN_ERR "Couldn't get primary IPI interrupt");
+ }
+
+
+
+From gregkh@mini.kroah.org Fri Nov 6 14:15:52 2009
+Message-Id: <20091106221552.169581662@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Fri, 06 Nov 2009 14:15:33 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Subject: [95/99] powerpc/pmac: Fix issues with sleep on some powerbooks
+References: <20091106221358.309857998@mini.kroah.org>
+Content-Disposition: inline; filename=powerpc-pmac-fix-issues-with-sleep-on-some-powerbooks.patch
+Content-Length: 4839
+Lines: 151
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+
+commit 11a50873ef2b3c1c3fe99a661c22c08f35d93553 upstream.
+
+Since the change of how interrupts are disabled during suspend,
+certain PowerBook models started exhibiting various issues during
+suspend or resume from sleep.
+
+I finally tracked it down to the code that runs various "platform"
+functions (kind of little scripts extracted from the device-tree),
+which uses our i2c and PMU drivers expecting interrutps to work,
+and at a time where with the new scheme, they have been disabled.
+
+This causes timeouts internally which for some reason results in
+the PMU being unable to see the trackpad, among other issues, really
+it depends on the machine. Most of the time, we fail to properly adjust
+some clocks for suspend/resume so the results are not always
+predictable.
+
+This patch fixes it by using IRQF_TIMER for both the PMU and the I2C
+interrupts. I prefer doing it this way than moving the call sites since
+I really want those platform functions to still be called after all
+drivers (and before sysdevs).
+
+We also do a slight cleanup to via-pmu.c driver to make sure the
+ADB autopoll mask is handled correctly when doing bus resets
+
+Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/powerpc/platforms/powermac/low_i2c.c | 7 +++--
+ drivers/macintosh/via-pmu.c | 40 +++++++++++++++++-------------
+ 2 files changed, 28 insertions(+), 19 deletions(-)
+
+--- a/arch/powerpc/platforms/powermac/low_i2c.c
++++ b/arch/powerpc/platforms/powermac/low_i2c.c
+@@ -540,8 +540,11 @@ static struct pmac_i2c_host_kw *__init k
+ /* Make sure IRQ is disabled */
+ kw_write_reg(reg_ier, 0);
+
+- /* Request chip interrupt */
+- if (request_irq(host->irq, kw_i2c_irq, 0, "keywest i2c", host))
++ /* Request chip interrupt. We set IRQF_TIMER because we don't
++ * want that interrupt disabled between the 2 passes of driver
++ * suspend or we'll have issues running the pfuncs
++ */
++ if (request_irq(host->irq, kw_i2c_irq, IRQF_TIMER, "keywest i2c", host))
+ host->irq = NO_IRQ;
+
+ printk(KERN_INFO "KeyWest i2c @0x%08x irq %d %s\n",
+--- a/drivers/macintosh/via-pmu.c
++++ b/drivers/macintosh/via-pmu.c
+@@ -405,7 +405,11 @@ static int __init via_pmu_start(void)
+ printk(KERN_ERR "via-pmu: can't map interrupt\n");
+ return -ENODEV;
+ }
+- if (request_irq(irq, via_pmu_interrupt, 0, "VIA-PMU", (void *)0)) {
++ /* We set IRQF_TIMER because we don't want the interrupt to be disabled
++ * between the 2 passes of driver suspend, we control our own disabling
++ * for that one
++ */
++ if (request_irq(irq, via_pmu_interrupt, IRQF_TIMER, "VIA-PMU", (void *)0)) {
+ printk(KERN_ERR "via-pmu: can't request irq %d\n", irq);
+ return -ENODEV;
+ }
+@@ -419,7 +423,7 @@ static int __init via_pmu_start(void)
+ gpio_irq = irq_of_parse_and_map(gpio_node, 0);
+
+ if (gpio_irq != NO_IRQ) {
+- if (request_irq(gpio_irq, gpio1_interrupt, 0,
++ if (request_irq(gpio_irq, gpio1_interrupt, IRQF_TIMER,
+ "GPIO1 ADB", (void *)0))
+ printk(KERN_ERR "pmu: can't get irq %d"
+ " (GPIO1)\n", gpio_irq);
+@@ -925,8 +929,7 @@ proc_write_options(struct file *file, co
+
+ #ifdef CONFIG_ADB
+ /* Send an ADB command */
+-static int
+-pmu_send_request(struct adb_request *req, int sync)
++static int pmu_send_request(struct adb_request *req, int sync)
+ {
+ int i, ret;
+
+@@ -1005,16 +1008,11 @@ pmu_send_request(struct adb_request *req
+ }
+
+ /* Enable/disable autopolling */
+-static int
+-pmu_adb_autopoll(int devs)
++static int __pmu_adb_autopoll(int devs)
+ {
+ struct adb_request req;
+
+- if ((vias == NULL) || (!pmu_fully_inited) || !pmu_has_adb)
+- return -ENXIO;
+-
+ if (devs) {
+- adb_dev_map = devs;
+ pmu_request(&req, NULL, 5, PMU_ADB_CMD, 0, 0x86,
+ adb_dev_map >> 8, adb_dev_map);
+ pmu_adb_flags = 2;
+@@ -1027,9 +1025,17 @@ pmu_adb_autopoll(int devs)
+ return 0;
+ }
+
++static int pmu_adb_autopoll(int devs)
++{
++ if ((vias == NULL) || (!pmu_fully_inited) || !pmu_has_adb)
++ return -ENXIO;
++
++ adb_dev_map = devs;
++ return __pmu_adb_autopoll(devs);
++}
++
+ /* Reset the ADB bus */
+-static int
+-pmu_adb_reset_bus(void)
++static int pmu_adb_reset_bus(void)
+ {
+ struct adb_request req;
+ int save_autopoll = adb_dev_map;
+@@ -1038,13 +1044,13 @@ pmu_adb_reset_bus(void)
+ return -ENXIO;
+
+ /* anyone got a better idea?? */
+- pmu_adb_autopoll(0);
++ __pmu_adb_autopoll(0);
+
+- req.nbytes = 5;
++ req.nbytes = 4;
+ req.done = NULL;
+ req.data[0] = PMU_ADB_CMD;
+- req.data[1] = 0;
+- req.data[2] = ADB_BUSRESET;
++ req.data[1] = ADB_BUSRESET;
++ req.data[2] = 0;
+ req.data[3] = 0;
+ req.data[4] = 0;
+ req.reply_len = 0;
+@@ -1056,7 +1062,7 @@ pmu_adb_reset_bus(void)
+ pmu_wait_complete(&req);
+
+ if (save_autopoll != 0)
+- pmu_adb_autopoll(save_autopoll);
++ __pmu_adb_autopoll(save_autopoll);
+
+ return 0;
+ }
+
+
+From gregkh@mini.kroah.org Fri Nov 6 14:15:52 2009
+Message-Id: <20091106221552.296543736@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Fri, 06 Nov 2009 14:15:34 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Andre Detsch <adetsch@br.ibm.com>,
+ Michael Ellerman <michael@ellerman.id.au>,
+ Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Subject: [96/99] powerpc/pci: Fix regression in powerpc MSI-X
+References: <20091106221358.309857998@mini.kroah.org>
+Content-Disposition: inline; filename=powerpc-pci-fix-regression-in-powerpc-msi-x.patch
+Content-Length: 1811
+Lines: 59
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Andre Detsch <adetsch@br.ibm.com>
+
+commit 8435b027b87a78145992c37b0b8ed0f1b7761bf0 upstream.
+
+Patch f598282f5145036312d90875d0ed5c14b49fd8a7 exposed a problem in
+powerpc MSI-X functionality, making network interfaces such as ixgbe
+and cxgb3 stop to work when MSI-X is enabled. RX interrupts were not
+being generated.
+
+The problem was caused because MSI irq was not being effectively
+unmasked after device initialization.
+
+Signed-off-by: Andre Detsch <adetsch@br.ibm.com>
+Signed-off-by: Michael Ellerman <michael@ellerman.id.au>
+Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/powerpc/platforms/pseries/msi.c | 2 --
+ arch/powerpc/platforms/pseries/xics.c | 9 +++++++++
+ 2 files changed, 9 insertions(+), 2 deletions(-)
+
+--- a/arch/powerpc/platforms/pseries/msi.c
++++ b/arch/powerpc/platforms/pseries/msi.c
+@@ -432,8 +432,6 @@ static int rtas_setup_msi_irqs(struct pc
+ /* Read config space back so we can restore after reset */
+ read_msi_msg(virq, &msg);
+ entry->msg = msg;
+-
+- unmask_msi_irq(virq);
+ }
+
+ return 0;
+--- a/arch/powerpc/platforms/pseries/xics.c
++++ b/arch/powerpc/platforms/pseries/xics.c
+@@ -18,6 +18,7 @@
+ #include <linux/init.h>
+ #include <linux/radix-tree.h>
+ #include <linux/cpu.h>
++#include <linux/msi.h>
+ #include <linux/of.h>
+
+ #include <asm/firmware.h>
+@@ -219,6 +220,14 @@ static void xics_unmask_irq(unsigned int
+
+ static unsigned int xics_startup(unsigned int virq)
+ {
++ /*
++ * The generic MSI code returns with the interrupt disabled on the
++ * card, using the MSI mask bits. Firmware doesn't appear to unmask
++ * at that level, so we do it here by hand.
++ */
++ if (irq_to_desc(virq)->msi_desc)
++ unmask_msi_irq(virq);
++
+ /* unmask it */
+ xics_unmask_irq(virq);
+ return 0;
+
+
+From gregkh@mini.kroah.org Fri Nov 6 14:15:52 2009
+Message-Id: <20091106221552.428914681@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Fri, 06 Nov 2009 14:15:35 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Subject: [97/99] powerpc: Fix some late PowerMac G5 with PCIe ATI graphics
+References: <20091106221358.309857998@mini.kroah.org>
+Content-Disposition: inline; filename=powerpc-fix-some-late-powermac-g5-with-pcie-ati-graphics.patch
+Content-Length: 3847
+Lines: 99
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+
+commit cede3930f0ca6fef353fa01306c72a01420bd45e upstream.
+
+A misconfiguration by the firmware of the U4 PCIe bridge on PowerMac G5
+with the U4 bridge (latest generations, may also affect the iMac G5
+"iSight") is causing us to re-assign the PCI BARs of the video card,
+which can get it out of sync with the firmware, thus breaking offb.
+
+This works around it by fixing up the bridge configuration properly
+at boot time. It also fixes a bug where the firmware provides us with
+an incorrect set of accessible regions in the device-tree.
+
+Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/powerpc/platforms/powermac/pci.c | 61 ++++++++++++++++++++++++++++++++++
+ include/linux/pci_ids.h | 1
+ 2 files changed, 62 insertions(+)
+
+--- a/arch/powerpc/platforms/powermac/pci.c
++++ b/arch/powerpc/platforms/powermac/pci.c
+@@ -1286,3 +1286,64 @@ static void fixup_k2_sata(struct pci_dev
+ }
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_SERVERWORKS, 0x0240, fixup_k2_sata);
+
++/*
++ * On U4 (aka CPC945) the PCIe root complex "P2P" bridge resource ranges aren't
++ * configured by the firmware. The bridge itself seems to ignore them but it
++ * causes problems with Linux which then re-assigns devices below the bridge,
++ * thus changing addresses of those devices from what was in the device-tree,
++ * which sucks when those are video cards using offb
++ *
++ * We could just mark it transparent but I prefer fixing up the resources to
++ * properly show what's going on here, as I have some doubts about having them
++ * badly configured potentially being an issue for DMA.
++ *
++ * We leave PIO alone, it seems to be fine
++ *
++ * Oh and there's another funny bug. The OF properties advertize the region
++ * 0xf1000000..0xf1ffffff as being forwarded as memory space. But that's
++ * actually not true, this region is the memory mapped config space. So we
++ * also need to filter it out or we'll map things in the wrong place.
++ */
++static void fixup_u4_pcie(struct pci_dev* dev)
++{
++ struct pci_controller *host = pci_bus_to_host(dev->bus);
++ struct resource *region = NULL;
++ u32 reg;
++ int i;
++
++ /* Only do that on PowerMac */
++ if (!machine_is(powermac))
++ return;
++
++ /* Find the largest MMIO region */
++ for (i = 0; i < 3; i++) {
++ struct resource *r = &host->mem_resources[i];
++ if (!(r->flags & IORESOURCE_MEM))
++ continue;
++ /* Skip the 0xf0xxxxxx..f2xxxxxx regions, we know they
++ * are reserved by HW for other things
++ */
++ if (r->start >= 0xf0000000 && r->start < 0xf3000000)
++ continue;
++ if (!region || (r->end - r->start) >
++ (region->end - region->start))
++ region = r;
++ }
++ /* Nothing found, bail */
++ if (region == 0)
++ return;
++
++ /* Print things out */
++ printk(KERN_INFO "PCI: Fixup U4 PCIe bridge range: %pR\n", region);
++
++ /* Fixup bridge config space. We know it's a Mac, resource aren't
++ * offset so let's just blast them as-is. We also know that they
++ * fit in 32 bits
++ */
++ reg = ((region->start >> 16) & 0xfff0) | (region->end & 0xfff00000);
++ pci_write_config_dword(dev, PCI_MEMORY_BASE, reg);
++ pci_write_config_dword(dev, PCI_PREF_BASE_UPPER32, 0);
++ pci_write_config_dword(dev, PCI_PREF_LIMIT_UPPER32, 0);
++ pci_write_config_dword(dev, PCI_PREF_MEMORY_BASE, 0);
++}
++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_APPLE, PCI_DEVICE_ID_APPLE_U4_PCIE, fixup_u4_pcie);
+--- a/include/linux/pci_ids.h
++++ b/include/linux/pci_ids.h
+@@ -880,6 +880,7 @@
+ #define PCI_DEVICE_ID_APPLE_SH_SUNGEM 0x0051
+ #define PCI_DEVICE_ID_APPLE_U3L_AGP 0x0058
+ #define PCI_DEVICE_ID_APPLE_U3H_AGP 0x0059
++#define PCI_DEVICE_ID_APPLE_U4_PCIE 0x005b
+ #define PCI_DEVICE_ID_APPLE_IPID2_AGP 0x0066
+ #define PCI_DEVICE_ID_APPLE_IPID2_ATA 0x0069
+ #define PCI_DEVICE_ID_APPLE_IPID2_FW 0x006a
+
+
+From gregkh@mini.kroah.org Fri Nov 6 14:15:52 2009
+Message-Id: <20091106221552.566130941@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Fri, 06 Nov 2009 14:15:36 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Joseph Chan <josephchan@via.com.tw>,
+ Jeff Garzik <jgarzik@redhat.com>
+Subject: [98/99] sata_via: Remove redundant device ID for VIA VT8261
+References: <20091106221358.309857998@mini.kroah.org>
+Content-Disposition: inline; filename=sata_via-remove-redundant-device-id-for-via-vt8261.patch
+Content-Length: 826
+Lines: 27
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: JosephChan@via.com.tw <JosephChan@via.com.tw>
+
+commit f38e35b43f2924b3b4e51147b7193f32e9276db4 upstream.
+
+Just remove redundant device ID for VIA VT8261.
+The device ID 0x9000 and 0x9040 are redundant (for VT8261).
+The 0x9040 is reserved for other usage.
+
+Signed-off-by: Joseph Chan <josephchan@via.com.tw>
+Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/ata/sata_via.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/drivers/ata/sata_via.c
++++ b/drivers/ata/sata_via.c
+@@ -93,7 +93,6 @@ static const struct pci_device_id svia_p
+ { PCI_VDEVICE(VIA, 0x7372), vt6420 },
+ { PCI_VDEVICE(VIA, 0x5287), vt8251 }, /* 2 sata chnls (Master/Slave) */
+ { PCI_VDEVICE(VIA, 0x9000), vt8251 },
+- { PCI_VDEVICE(VIA, 0x9040), vt8251 },
+
+ { } /* terminate list */
+ };
+
+
+From gregkh@mini.kroah.org Fri Nov 6 14:15:52 2009
+Message-Id: <20091106221552.709553080@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Fri, 06 Nov 2009 14:15:37 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Joseph Chan <josephchan@via.com.tw>,
+ Jeff Garzik <jgarzik@redhat.com>
+Subject: [99/99] pata_via: extend the rev_max for VT6330
+References: <20091106221358.309857998@mini.kroah.org>
+Content-Disposition: inline; filename=pata_via-extend-the-rev_max-for-vt6330.patch
+Content-Length: 1324
+Lines: 27
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: JosephChan@via.com.tw <JosephChan@via.com.tw>
+
+commit 7d948b1114c7eded14e5a31f440af751d70ecde0 upstream.
+
+Fix the VT6330 issue, it's because the rev_max of VT6330 exceeds 0x2f.
+The VT6415 and VT6330 share the same device ID.
+
+Signed-off-by: Joseph Chan <josephchan@via.com.tw>
+Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/ata/pata_via.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/ata/pata_via.c
++++ b/drivers/ata/pata_via.c
+@@ -111,7 +111,7 @@ static const struct via_isa_bridge {
+ { "vt8251", PCI_DEVICE_ID_VIA_8251, 0x00, 0x2f, VIA_UDMA_133 | VIA_BAD_AST },
+ { "cx700", PCI_DEVICE_ID_VIA_CX700, 0x00, 0x2f, VIA_UDMA_133 | VIA_BAD_AST | VIA_SATA_PATA },
+ { "vt6410", PCI_DEVICE_ID_VIA_6410, 0x00, 0x2f, VIA_UDMA_133 | VIA_BAD_AST | VIA_NO_ENABLES },
+- { "vt6415", PCI_DEVICE_ID_VIA_6415, 0x00, 0x2f, VIA_UDMA_133 | VIA_BAD_AST | VIA_NO_ENABLES },
++ { "vt6415", PCI_DEVICE_ID_VIA_6415, 0x00, 0xff, VIA_UDMA_133 | VIA_BAD_AST | VIA_NO_ENABLES },
+ { "vt8237a", PCI_DEVICE_ID_VIA_8237A, 0x00, 0x2f, VIA_UDMA_133 | VIA_BAD_AST },
+ { "vt8237", PCI_DEVICE_ID_VIA_8237, 0x00, 0x2f, VIA_UDMA_133 | VIA_BAD_AST },
+ { "vt8235", PCI_DEVICE_ID_VIA_8235, 0x00, 0x2f, VIA_UDMA_133 | VIA_BAD_AST },
+
+
+From gregkh@mini.kroah.org Fri Nov 6 14:15:38 2009
+Message-Id: <20091106221358.309857998@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Fri, 06 Nov 2009 14:13:58 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk
+Subject: [00/99] 2.6.31.6 stable review
+Content-Length: 6493
+Lines: 124
+
+This is the start of the stable review cycle for the 2.6.31.6 release.
+There are 99 patches in this series, all will be posted as a response to
+this one. If anyone has any issues with these being applied, please let
+us know. If anyone is a maintainer of the proper subsystem, and wants
+to add a Signed-off-by: line to the patch, please respond with it.
+
+Responses should be made by November 8, 2009, 20:00:00 UTC. Anything
+received after that time might be too late.
+
+The whole patch series can be found in one patch at:
+ kernel.org/pub/linux/kernel/v2.6/stable-review/patch-2.6.31.6-rc1.gz
+and the diffstat can be found below.
+
+
+thanks,
+
+greg k-h
+
+----------------
+
+ Documentation/dontdiff | 1 -
+ Makefile | 2 +-
+ arch/alpha/kernel/vmlinux.lds.S | 1 +
+ arch/m68k/Kconfig | 6 +-
+ arch/mips/kernel/Makefile | 2 +
+ arch/mips/kernel/vmlinux.lds.S | 12 +-
+ arch/powerpc/platforms/powermac/cpufreq_32.c | 8 -
+ arch/powerpc/platforms/powermac/low_i2c.c | 7 +-
+ arch/powerpc/platforms/powermac/pci.c | 61 +++
+ arch/powerpc/platforms/powermac/smp.c | 2 +-
+ arch/powerpc/platforms/pseries/msi.c | 2 -
+ arch/powerpc/platforms/pseries/xics.c | 9 +
+ arch/sparc/kernel/ldc.c | 4 +-
+ arch/sparc/kernel/setup_32.c | 2 -
+ arch/sparc/kernel/setup_64.c | 2 -
+ arch/x86/ia32/ia32entry.S | 5 +-
+ arch/x86/include/asm/amd_iommu.h | 1 +
+ arch/x86/include/asm/uv/uv_hub.h | 7 +
+ arch/x86/kernel/amd_iommu.c | 2 +
+ arch/x86/kernel/amd_iommu_init.c | 24 +-
+ arch/x86/kernel/apic/x2apic_uv_x.c | 8 +-
+ arch/x86/kernel/cpu/mcheck/therm_throt.c | 67 ++--
+ arch/x86/kernel/e820.c | 4 +-
+ arch/x86/kernel/tlb_uv.c | 4 +-
+ arch/x86/kvm/i8254.c | 2 +-
+ arch/x86/kvm/lapic.c | 2 +-
+ arch/x86/kvm/x86.c | 3 +-
+ arch/x86/xen/enlighten.c | 11 +-
+ drivers/acpi/pci_root.c | 11 +
+ drivers/acpi/scan.c | 12 +-
+ drivers/ata/ahci.c | 52 +---
+ drivers/ata/libata-core.c | 12 +-
+ drivers/ata/libata-eh.c | 6 +-
+ drivers/ata/pata_sc1200.c | 3 +-
+ drivers/ata/pata_via.c | 2 +-
+ drivers/ata/sata_nv.c | 18 +-
+ drivers/ata/sata_via.c | 1 -
+ drivers/base/driver.c | 2 +-
+ drivers/char/Kconfig | 6 +-
+ drivers/char/agp/intel-agp.c | 7 +
+ drivers/char/hvc_xen.c | 25 +-
+ drivers/char/vt.c | 3 -
+ drivers/cpuidle/cpuidle.c | 5 +-
+ drivers/gpu/drm/i915/i915_drv.h | 2 +
+ drivers/gpu/drm/i915/i915_reg.h | 14 +-
+ drivers/gpu/drm/i915/intel_display.c | 73 +++-
+ drivers/hwmon/it87.c | 5 +-
+ drivers/input/mouse/synaptics.c | 10 +
+ drivers/macintosh/via-pmu.c | 40 +-
+ drivers/md/dm-exception-store.c | 22 +-
+ drivers/md/dm-exception-store.h | 8 +-
+ drivers/md/dm-log-userspace-base.c | 2 +-
+ drivers/md/dm-snap-persistent.c | 16 +-
+ drivers/md/dm-snap.c | 25 +-
+ drivers/md/dm.c | 11 +-
+ drivers/misc/sgi-gru/gruprocfs.c | 13 +-
+ drivers/net/bonding/bond_main.c | 2 +-
+ drivers/net/wireless/b43/rfkill.c | 3 +-
+ drivers/net/wireless/iwlwifi/iwl-rx.c | 34 ++-
+ drivers/net/wireless/iwlwifi/iwl3945-base.c | 33 +-
+ drivers/net/wireless/libertas/if_usb.c | 2 +-
+ drivers/net/wireless/ray_cs.c | 2 +-
+ drivers/scsi/dpt_i2o.c | 4 +
+ drivers/serial/8250_pci.c | 11 +
+ drivers/usb/serial/option.c | 10 +
+ drivers/usb/serial/sierra.c | 23 +-
+ drivers/video/console/.gitignore | 2 -
+ drivers/video/console/Kconfig | 9 +-
+ drivers/video/console/Makefile | 12 -
+ drivers/video/console/prom.uni | 11 -
+ drivers/video/console/promcon.c | 598 --------------------------
+ drivers/virtio/virtio_ring.c | 3 +
+ drivers/watchdog/riowd.c | 2 +-
+ fs/cifs/connect.c | 3 +-
+ fs/fuse/file.c | 5 +-
+ fs/hfsplus/wrapper.c | 4 +
+ fs/nfs/client.c | 2 +-
+ fs/nfs/dir.c | 2 +
+ fs/nfs/direct.c | 1 +
+ fs/nfs/nfs4proc.c | 15 +-
+ fs/nfs/nfs4renewd.c | 6 -
+ fs/nfs/nfs4xdr.c | 1 -
+ fs/nfs/super.c | 2 +-
+ fs/nilfs2/btnode.c | 3 +-
+ fs/notify/inode_mark.c | 6 +-
+ fs/pipe.c | 41 ++-
+ include/drm/drm_pciids.h | 1 +
+ include/linux/moduleparam.h | 1 -
+ include/linux/pci_ids.h | 4 +
+ kernel/futex.c | 20 +-
+ kernel/params.c | 17 +-
+ mm/mempolicy.c | 13 +-
+ mm/nommu.c | 6 +-
+ mm/swapfile.c | 3 +-
+ mm/vmscan.c | 2 +-
+ net/mac80211/cfg.c | 6 +-
+ net/mac80211/tx.c | 2 +-
+ net/sched/cls_api.c | 2 +-
+ net/unix/af_unix.c | 2 +
+ scripts/Makefile | 1 -
+ security/keys/keyctl.c | 2 +-
+ sound/pci/ice1712/ice1724.c | 2 +-
+ virt/kvm/kvm_main.c | 7 +-
+ 103 files changed, 657 insertions(+), 953 deletions(-)
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
