--- /dev/null
+From gregkh@mini.kroah.org Tue Jun 30 17:15:48 2009
+Message-Id: <20090701001548.065942448@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:13:57 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Philippe De Muyter <phdm@macqel.be>
+Subject: [patch 01/35] parport: netmos 9845 & 9855 1P4S fixes
+References: <20090701001356.007288418@mini.kroah.org>
+Content-Disposition: inline; filename=parport-netmos-9845-9855-1p4s-fixes.patch
+Content-Length: 5045
+Lines: 121
+
+2.6.29-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Philippe De Muyter <phdm@macqel.be>
+
+commit 50db9d8e4ca17974595e3848cb65f9371a304de4 upstream.
+
+netmos serial/parallel adapters come in different flavour differing only
+by the number of parallel and serial ports, which are encoded in the
+subdevice ID.
+
+Last fix of Christian Pellegrin for 9855 2P2S broke support for 9855 1P4S,
+and works only by side-effect for the first parallel port of a 2P2S, as
+this first parallel port is found by reading the second addr entry of
+(struct parport_pc_pci) cards[netmos_9855], which is not initialized, and
+hence has value 0, which happens to be the BAR of the first parallel port.
+
+netmos_9xx5_combo entry in (struct parport_pc_pci) cards[], which is used
+for a 9845 1P4S must also be fixed for the parallel port support when
+there are 4 serial ports because this entry currently gives 2 as BAR index
+for the parallel port. Actually, in this case, BAR 2 is the 3rd serial
+port while the parallel port is at BAR 4.
+
+I fixed 9845 1P4S and 9855 1P4S support, while preserving 9855 2P2S support,
+
+- by creating a netmos_9855_2p entry and using it for 9855 boards with 2
+ parallel ports : 9855 2P2S and 9855 2P0S boards,
+
+- and by allowing netmos_parallel_init to change not only the number of
+ parallel ports (0 or 1), but making it also change the BAR index of the
+ parallel port when the serial ports are before the parallel port.
+
+PS: the netmos_9855_2p entry in (struct pciserial_board)
+pci_parport_serial_boards[] is needed because netmos_parallel_init has no
+clean way to replace FL_BASE2 by FL_BASE4 in the description of the serial
+ports in function of the number of parallel ports on the card.
+
+Tested with 9845 1P4S, 9855 1P4S and 9855 2P2S boards.
+
+Signed-off-by: Philippe De Muyter <phdm@macqel.be>
+Tested-by: Christian Pellegrin <chripell@fsfe.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/parport/parport_serial.c | 30 +++++++++++++++++++++++++-----
+ 1 file changed, 25 insertions(+), 5 deletions(-)
+
+--- a/drivers/parport/parport_serial.c
++++ b/drivers/parport/parport_serial.c
+@@ -30,6 +30,7 @@ enum parport_pc_pci_cards {
+ titan_210l,
+ netmos_9xx5_combo,
+ netmos_9855,
++ netmos_9855_2p,
+ avlab_1s1p,
+ avlab_1s2p,
+ avlab_2s1p,
+@@ -62,7 +63,7 @@ struct parport_pc_pci {
+ struct parport_pc_pci *card, int failed);
+ };
+
+-static int __devinit netmos_parallel_init(struct pci_dev *dev, struct parport_pc_pci *card, int autoirq, int autodma)
++static int __devinit netmos_parallel_init(struct pci_dev *dev, struct parport_pc_pci *par, int autoirq, int autodma)
+ {
+ /* the rule described below doesn't hold for this device */
+ if (dev->device == PCI_DEVICE_ID_NETMOS_9835 &&
+@@ -74,9 +75,17 @@ static int __devinit netmos_parallel_ini
+ * and serial ports. The form is 0x00PS, where <P> is the number of
+ * parallel ports and <S> is the number of serial ports.
+ */
+- card->numports = (dev->subsystem_device & 0xf0) >> 4;
+- if (card->numports > ARRAY_SIZE(card->addr))
+- card->numports = ARRAY_SIZE(card->addr);
++ par->numports = (dev->subsystem_device & 0xf0) >> 4;
++ if (par->numports > ARRAY_SIZE(par->addr))
++ par->numports = ARRAY_SIZE(par->addr);
++ /*
++ * This function is currently only called for cards with up to
++ * one parallel port.
++ * Parallel port BAR is either before or after serial ports BARS;
++ * hence, lo should be either 0 or equal to the number of serial ports.
++ */
++ if (par->addr[0].lo != 0)
++ par->addr[0].lo = dev->subsystem_device & 0xf;
+ return 0;
+ }
+
+@@ -84,7 +93,8 @@ static struct parport_pc_pci cards[] __d
+ /* titan_110l */ { 1, { { 3, -1 }, } },
+ /* titan_210l */ { 1, { { 3, -1 }, } },
+ /* netmos_9xx5_combo */ { 1, { { 2, -1 }, }, netmos_parallel_init },
+- /* netmos_9855 */ { 1, { { 2, -1 }, }, netmos_parallel_init },
++ /* netmos_9855 */ { 1, { { 0, -1 }, }, netmos_parallel_init },
++ /* netmos_9855_2p */ { 2, { { 0, -1 }, { 2, -1 }, } },
+ /* avlab_1s1p */ { 1, { { 1, 2}, } },
+ /* avlab_1s2p */ { 2, { { 1, 2}, { 3, 4 },} },
+ /* avlab_2s1p */ { 1, { { 2, 3}, } },
+@@ -110,6 +120,10 @@ static struct pci_device_id parport_seri
+ { PCI_VENDOR_ID_NETMOS, PCI_DEVICE_ID_NETMOS_9845,
+ PCI_ANY_ID, PCI_ANY_ID, 0, 0, netmos_9xx5_combo },
+ { PCI_VENDOR_ID_NETMOS, PCI_DEVICE_ID_NETMOS_9855,
++ 0x1000, 0x0020, 0, 0, netmos_9855_2p },
++ { PCI_VENDOR_ID_NETMOS, PCI_DEVICE_ID_NETMOS_9855,
++ 0x1000, 0x0022, 0, 0, netmos_9855_2p },
++ { PCI_VENDOR_ID_NETMOS, PCI_DEVICE_ID_NETMOS_9855,
+ PCI_ANY_ID, PCI_ANY_ID, 0, 0, netmos_9855 },
+ /* PCI_VENDOR_ID_AVLAB/Intek21 has another bunch of cards ...*/
+ { PCI_VENDOR_ID_AFAVLAB, 0x2110,
+@@ -192,6 +206,12 @@ static struct pciserial_board pci_parpor
+ .uart_offset = 8,
+ },
+ [netmos_9855] = {
++ .flags = FL_BASE2 | FL_BASE_BARS,
++ .num_ports = 1,
++ .base_baud = 115200,
++ .uart_offset = 8,
++ },
++ [netmos_9855_2p] = {
+ .flags = FL_BASE4 | FL_BASE_BARS,
+ .num_ports = 1,
+ .base_baud = 115200,
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:15:48 2009
+Message-Id: <20090701001548.246214392@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:13:58 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Alan Cox <alan@linux.intel.com>,
+ Kirill Smelkov <kirr@mns.spb.ru>
+Subject: [patch 02/35] 8250: Fix oops from setserial
+References: <20090701001356.007288418@mini.kroah.org>
+Content-Disposition: inline; filename=8250-fix-oops-from-setserial.patch
+Content-Length: 2528
+Lines: 83
+
+2.6.29-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Alan Cox <alan@linux.intel.com>
+
+commit b8e7e40abeac49644fec4a4f52ffe74c7b05eca0 upstream.
+
+If you setserial a port which has never been initialised we change the type
+but don't update the I/O method pointers. The same problem is true if you
+change the io type of a port - but nobody ever does that so nobody noticed!
+
+Remember the old type and when attaching if the type has changed reload the
+port accessor pointers. We can't do it blindly as some 8250 drivers load custom
+accessors and we must not stomp those.
+
+Tested-by: Victor Seryodkin <vvscore@gmail.com>
+Closes-bug: #13367
+Signed-off-by: Alan Cox <alan@linux.intel.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Kirill Smelkov <kirr@mns.spb.ru>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/serial/8250.c | 15 +++++++++++++++
+ 1 file changed, 15 insertions(+)
+
+--- a/drivers/serial/8250.c
++++ b/drivers/serial/8250.c
+@@ -137,6 +137,7 @@ struct uart_8250_port {
+ unsigned char mcr;
+ unsigned char mcr_mask; /* mask of user bits */
+ unsigned char mcr_force; /* mask of forced bits */
++ unsigned char cur_iotype; /* Running I/O type */
+
+ /*
+ * Some bits in registers are cleared on a read, so they must
+@@ -471,6 +472,7 @@ static void io_serial_out(struct uart_po
+
+ static void set_io_from_upio(struct uart_port *p)
+ {
++ struct uart_8250_port *up = (struct uart_8250_port *)p;
+ switch (p->iotype) {
+ case UPIO_HUB6:
+ p->serial_in = hub6_serial_in;
+@@ -509,6 +511,8 @@ static void set_io_from_upio(struct uart
+ p->serial_out = io_serial_out;
+ break;
+ }
++ /* Remember loaded iotype */
++ up->cur_iotype = p->iotype;
+ }
+
+ static void
+@@ -1937,6 +1941,9 @@ static int serial8250_startup(struct uar
+ up->capabilities = uart_config[up->port.type].flags;
+ up->mcr = 0;
+
++ if (up->port.iotype != up->cur_iotype)
++ set_io_from_upio(port);
++
+ if (up->port.type == PORT_16C950) {
+ /* Wake up and initialize UART */
+ up->acr = 0;
+@@ -2563,6 +2570,9 @@ static void serial8250_config_port(struc
+ if (ret < 0)
+ probeflags &= ~PROBE_RSA;
+
++ if (up->port.iotype != up->cur_iotype)
++ set_io_from_upio(port);
++
+ if (flags & UART_CONFIG_TYPE)
+ autoconfig(up, probeflags);
+ if (up->port.type != PORT_UNKNOWN && flags & UART_CONFIG_IRQ)
+@@ -2671,6 +2681,11 @@ serial8250_register_ports(struct uart_dr
+ {
+ int i;
+
++ for (i = 0; i < nr_uarts; i++) {
++ struct uart_8250_port *up = &serial8250_ports[i];
++ up->cur_iotype = 0xFF;
++ }
++
+ serial8250_isa_init_ports();
+
+ for (i = 0; i < nr_uarts; i++) {
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:15:48 2009
+Message-Id: <20090701001548.420416552@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:13:59 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ "Peter Botha" <peterb@goldcircle.co.za>,
+ Jiri Slaby <jirislaby@gmail.com>
+Subject: [patch 03/35] char: mxser, fix ISA board lookup
+References: <20090701001356.007288418@mini.kroah.org>
+Content-Disposition: inline; filename=char-mxser-fix-isa-board-lookup.patch
+Content-Length: 1134
+Lines: 35
+
+2.6.29-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Peter Botha <peterb@goldcircle.co.za>
+
+commit 96050dfb25966612008dcea7d342e91fa01e993c upstream.
+
+There's a bug in the mxser kernel module that still appears in the
+2.6.29.4 kernel.
+
+mxser_get_ISA_conf takes a ioaddress as its first argument, by passing the
+not of the ioaddr, you're effectively passing 0 which means it won't be
+able to talk to an ISA card. I have tested this, and removing the !
+fixes the problem.
+
+Cc: "Peter Botha" <peterb@goldcircle.co.za>
+Signed-off-by: Jiri Slaby <jirislaby@gmail.com>
+Acked-by: Alan Cox <alan@lxorguk.ukuu.org.uk>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/char/mxser.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/char/mxser.c
++++ b/drivers/char/mxser.c
+@@ -2712,7 +2712,7 @@ static int __init mxser_module_init(void
+ continue;
+
+ brd = &mxser_boards[m];
+- retval = mxser_get_ISA_conf(!ioaddr[b], brd);
++ retval = mxser_get_ISA_conf(ioaddr[b], brd);
+ if (retval <= 0) {
+ brd->info = NULL;
+ continue;
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:15:48 2009
+Message-Id: <20090701001548.636200762@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:14:00 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jan Kara <jack@suse.cz>,
+ <linux-ext4@vger.kernel.org>
+Subject: [patch 04/35] jbd: fix race in buffer processing in commit code
+References: <20090701001356.007288418@mini.kroah.org>
+Content-Disposition: inline; filename=jbd-fix-race-in-buffer-processing-in-commit-code.patch
+Content-Length: 1753
+Lines: 48
+
+2.6.29-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Jan Kara <jack@suse.cz>
+
+commit a61d90d75d0f9e86432c45b496b4b0fbf0fd03dc upstream.
+
+In commit code, we scan buffers attached to a transaction. During this
+scan, we sometimes have to drop j_list_lock and then we recheck whether
+the journal buffer head didn't get freed by journal_try_to_free_buffers().
+ But checking for buffer_jbd(bh) isn't enough because a new journal head
+could get attached to our buffer head. So add a check whether the journal
+head remained the same and whether it's still at the same transaction and
+list.
+
+This is a nasty bug and can cause problems like memory corruption (use after
+free) or trigger various assertions in JBD code (observed).
+
+Signed-off-by: Jan Kara <jack@suse.cz>
+Cc: <linux-ext4@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/jbd/commit.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/fs/jbd/commit.c
++++ b/fs/jbd/commit.c
+@@ -238,7 +238,7 @@ write_out_data:
+ spin_lock(&journal->j_list_lock);
+ }
+ /* Someone already cleaned up the buffer? */
+- if (!buffer_jbd(bh)
++ if (!buffer_jbd(bh) || bh2jh(bh) != jh
+ || jh->b_transaction != commit_transaction
+ || jh->b_jlist != BJ_SyncData) {
+ jbd_unlock_bh_state(bh);
+@@ -466,7 +466,9 @@ void journal_commit_transaction(journal_
+ spin_lock(&journal->j_list_lock);
+ continue;
+ }
+- if (buffer_jbd(bh) && jh->b_jlist == BJ_Locked) {
++ if (buffer_jbd(bh) && bh2jh(bh) == jh &&
++ jh->b_transaction == commit_transaction &&
++ jh->b_jlist == BJ_Locked) {
+ __journal_unfile_buffer(jh);
+ jbd_unlock_bh_state(bh);
+ journal_remove_journal_head(bh);
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:15:49 2009
+Message-Id: <20090701001548.822249123@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:14:01 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Eric Dumazet <eric.dumazet@gmail.com>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [patch 05/35] r8169: fix crash when large packets are received
+References: <20090701001356.007288418@mini.kroah.org>
+Content-Disposition: inline; filename=r8169-fix-crash-when-large-packets-are-received.patch
+Content-Length: 2792
+Lines: 82
+
+2.6.29-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Eric Dumazet <eric.dumazet@gmail.com>
+
+commit fdd7b4c3302c93f6833e338903ea77245eb510b4 upstream.
+
+Michael Tokarev reported receiving a large packet could crash
+a machine with RTL8169 NIC.
+( original thread at http://lkml.org/lkml/2009/6/8/192 )
+
+Problem is this driver tells that NIC frames up to 16383 bytes
+can be received but provides skb to rx ring allocated with
+smaller sizes (1536 bytes in case standard 1500 bytes MTU is used)
+
+When a frame larger than what was allocated by driver is received,
+dma transfert can occurs past the end of buffer and corrupt
+kernel memory.
+
+Fix is to tell to NIC what is the maximum size a frame can be.
+
+This bug is very old, (before git introduction, linux-2.6.10), and
+should be backported to stable versions.
+
+Reported-by: Michael Tokarev <mjt@tls.msk.ru>
+Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
+Tested-by: Michael Tokarev <mjt@tls.msk.ru>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/r8169.c | 11 +++++------
+ 1 file changed, 5 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/r8169.c
++++ b/drivers/net/r8169.c
+@@ -66,7 +66,6 @@ static const int multicast_filter_limit
+ #define RX_DMA_BURST 6 /* Maximum PCI burst, '6' is 1024 */
+ #define TX_DMA_BURST 6 /* Maximum PCI burst, '6' is 1024 */
+ #define EarlyTxThld 0x3F /* 0x3F means NO early transmit */
+-#define RxPacketMaxSize 0x3FE8 /* 16K - 1 - ETH_HLEN - VLAN - CRC... */
+ #define SafeMtu 0x1c20 /* ... actually life sucks beyond ~7k */
+ #define InterFrameGap 0x03 /* 3 means InterFrameGap = the shortest one */
+
+@@ -2357,10 +2356,10 @@ static u16 rtl_rw_cpluscmd(void __iomem
+ return cmd;
+ }
+
+-static void rtl_set_rx_max_size(void __iomem *ioaddr)
++static void rtl_set_rx_max_size(void __iomem *ioaddr, unsigned int rx_buf_sz)
+ {
+ /* Low hurts. Let's disable the filtering. */
+- RTL_W16(RxMaxSize, 16383);
++ RTL_W16(RxMaxSize, rx_buf_sz);
+ }
+
+ static void rtl8169_set_magic_reg(void __iomem *ioaddr, unsigned mac_version)
+@@ -2407,7 +2406,7 @@ static void rtl_hw_start_8169(struct net
+
+ RTL_W8(EarlyTxThres, EarlyTxThld);
+
+- rtl_set_rx_max_size(ioaddr);
++ rtl_set_rx_max_size(ioaddr, tp->rx_buf_sz);
+
+ if ((tp->mac_version == RTL_GIGA_MAC_VER_01) ||
+ (tp->mac_version == RTL_GIGA_MAC_VER_02) ||
+@@ -2668,7 +2667,7 @@ static void rtl_hw_start_8168(struct net
+
+ RTL_W8(EarlyTxThres, EarlyTxThld);
+
+- rtl_set_rx_max_size(ioaddr);
++ rtl_set_rx_max_size(ioaddr, tp->rx_buf_sz);
+
+ tp->cp_cmd |= RTL_R16(CPlusCmd) | PktCntrDisable | INTT_1;
+
+@@ -2846,7 +2845,7 @@ static void rtl_hw_start_8101(struct net
+
+ RTL_W8(EarlyTxThres, EarlyTxThld);
+
+- rtl_set_rx_max_size(ioaddr);
++ rtl_set_rx_max_size(ioaddr, tp->rx_buf_sz);
+
+ tp->cp_cmd |= rtl_rw_cpluscmd(ioaddr) | PCIMulRW;
+
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:15:49 2009
+Message-Id: <20090701001549.014483188@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:14:02 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Nick Piggin <npiggin@suse.de>,
+ Al Viro <viro@zeniv.linux.org.uk>
+Subject: [patch 06/35] fs: remove incorrect I_NEW warnings
+References: <20090701001356.007288418@mini.kroah.org>
+Content-Disposition: inline; filename=fs-remove-incorrect-i_new-warnings.patch
+Content-Length: 1335
+Lines: 42
+
+2.6.29-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Nick Piggin <npiggin@suse.de>
+
+commit 545b9fd3d737afc0bb5203b1e79194a471605acd upstream.
+
+Some filesystems can call in to sync an inode that is still in the
+I_NEW state (eg. ext family, when mounted with -osync). This is OK
+because the filesystem has sole access to the new inode, so it can
+modify i_state without races (because no other thread should be
+modifying it, by definition of I_NEW). Ie. a false positive, so
+remove the warnings.
+
+The races are described here 7ef0d7377cb287e08f3ae94cebc919448e1f5dff,
+which is also where the warnings were introduced.
+
+Reported-by: Stephen Hemminger <shemminger@vyatta.com>
+Signed-off-by: Nick Piggin <npiggin@suse.de>
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/fs-writeback.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/fs/fs-writeback.c
++++ b/fs/fs-writeback.c
+@@ -274,7 +274,6 @@ __sync_single_inode(struct inode *inode,
+ int ret;
+
+ BUG_ON(inode->i_state & I_SYNC);
+- WARN_ON(inode->i_state & I_NEW);
+
+ /* Set I_SYNC, reset I_DIRTY */
+ dirty = inode->i_state & I_DIRTY;
+@@ -299,7 +298,6 @@ __sync_single_inode(struct inode *inode,
+ }
+
+ spin_lock(&inode_lock);
+- WARN_ON(inode->i_state & I_NEW);
+ inode->i_state &= ~I_SYNC;
+ if (!(inode->i_state & I_FREEING)) {
+ if (!(inode->i_state & I_DIRTY) &&
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:15:49 2009
+Message-Id: <20090701001549.207107959@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:14:03 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Yinghai Lu <yinghai@kernel.org>,
+ Ingo Molnar <mingo@elte.hu>,
+ "H. Peter Anvin" <hpa@zytor.com>,
+ Thomas Gleixner <tglx@linutronix.de>
+Subject: [patch 07/35] firmware_map: fix hang with x86/32bit
+References: <20090701001356.007288418@mini.kroah.org>
+Content-Disposition: inline; filename=firmware_map-fix-hang-with-x86-32bit.patch
+Content-Length: 4211
+Lines: 113
+
+2.6.29-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Yinghai Lu <yinghai@kernel.org>
+
+commit 3b0fde0fac19c180317eb0601b3504083f4b9bf5 upstream.
+
+Addresses http://bugzilla.kernel.org/show_bug.cgi?id=13484
+
+Peer reported:
+| The bug is introduced from kernel 2.6.27, if E820 table reserve the memory
+| above 4G in 32bit OS(BIOS-e820: 00000000fff80000 - 0000000120000000
+| (reserved)), system will report Int 6 error and hang up. The bug is caused by
+| the following code in drivers/firmware/memmap.c, the resource_size_t is 32bit
+| variable in 32bit OS, the BUG_ON() will be invoked to result in the Int 6
+| error. I try the latest 32bit Ubuntu and Fedora distributions, all hit this
+| bug.
+|======
+|static int firmware_map_add_entry(resource_size_t start, resource_size_t end,
+| const char *type,
+| struct firmware_map_entry *entry)
+
+and it only happen with CONFIG_PHYS_ADDR_T_64BIT is not set.
+
+it turns out we need to pass u64 instead of resource_size_t for that.
+
+[akpm@linux-foundation.org: add comment]
+Reported-and-tested-by: Peer Chen <pchen@nvidia.com>
+Signed-off-by: Yinghai Lu <yinghai@kernel.org>
+Cc: Ingo Molnar <mingo@elte.hu>
+Acked-by: H. Peter Anvin <hpa@zytor.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/firmware/memmap.c | 16 +++++++++-------
+ include/linux/firmware-map.h | 12 ++++--------
+ 2 files changed, 13 insertions(+), 15 deletions(-)
+
+--- a/drivers/firmware/memmap.c
++++ b/drivers/firmware/memmap.c
+@@ -31,8 +31,12 @@
+ * information is necessary as for the resource tree.
+ */
+ struct firmware_map_entry {
+- resource_size_t start; /* start of the memory range */
+- resource_size_t end; /* end of the memory range (incl.) */
++ /*
++ * start and end must be u64 rather than resource_size_t, because e820
++ * resources can lie at addresses above 4G.
++ */
++ u64 start; /* start of the memory range */
++ u64 end; /* end of the memory range (incl.) */
+ const char *type; /* type of the memory range */
+ struct list_head list; /* entry for the linked list */
+ struct kobject kobj; /* kobject for each entry */
+@@ -101,7 +105,7 @@ static LIST_HEAD(map_entries);
+ * Common implementation of firmware_map_add() and firmware_map_add_early()
+ * which expects a pre-allocated struct firmware_map_entry.
+ **/
+-static int firmware_map_add_entry(resource_size_t start, resource_size_t end,
++static int firmware_map_add_entry(u64 start, u64 end,
+ const char *type,
+ struct firmware_map_entry *entry)
+ {
+@@ -132,8 +136,7 @@ static int firmware_map_add_entry(resour
+ *
+ * Returns 0 on success, or -ENOMEM if no memory could be allocated.
+ **/
+-int firmware_map_add(resource_size_t start, resource_size_t end,
+- const char *type)
++int firmware_map_add(u64 start, u64 end, const char *type)
+ {
+ struct firmware_map_entry *entry;
+
+@@ -157,8 +160,7 @@ int firmware_map_add(resource_size_t sta
+ *
+ * Returns 0 on success, or -ENOMEM if no memory could be allocated.
+ **/
+-int __init firmware_map_add_early(resource_size_t start, resource_size_t end,
+- const char *type)
++int __init firmware_map_add_early(u64 start, u64 end, const char *type)
+ {
+ struct firmware_map_entry *entry;
+
+--- a/include/linux/firmware-map.h
++++ b/include/linux/firmware-map.h
+@@ -24,21 +24,17 @@
+ */
+ #ifdef CONFIG_FIRMWARE_MEMMAP
+
+-int firmware_map_add(resource_size_t start, resource_size_t end,
+- const char *type);
+-int firmware_map_add_early(resource_size_t start, resource_size_t end,
+- const char *type);
++int firmware_map_add(u64 start, u64 end, const char *type);
++int firmware_map_add_early(u64 start, u64 end, const char *type);
+
+ #else /* CONFIG_FIRMWARE_MEMMAP */
+
+-static inline int firmware_map_add(resource_size_t start, resource_size_t end,
+- const char *type)
++static inline int firmware_map_add(u64 start, u64 end, const char *type)
+ {
+ return 0;
+ }
+
+-static inline int firmware_map_add_early(resource_size_t start,
+- resource_size_t end, const char *type)
++static inline int firmware_map_add_early(u64 start, u64 end, const char *type)
+ {
+ return 0;
+ }
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:15:49 2009
+Message-Id: <20090701001549.472261271@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:14:04 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Shaohua Li <shaohua.li@intel.com>,
+ Jesse Barnes <jbarnes@virtuousgeek.org>
+Subject: [patch 08/35] PCI: disable ASPM on VIA root-port-under-bridge configurations
+References: <20090701001356.007288418@mini.kroah.org>
+Content-Disposition: inline; filename=pci-disable-aspm-on-via-root-port-under-bridge-configurations.patch
+Content-Length: 870
+Lines: 26
+
+2.6.29-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Shaohua Li <shaohua.li@intel.com>
+
+commit 8e822df700694ca6850d1e0c122fd7004b2778d8 upstream.
+
+VIA has a strange chipset, it has root port under a bridge. Disable ASPM
+for such strange chipset.
+
+Tested-by: Wolfgang Denk <wd@denx.de>
+Signed-off-by: Shaohua Li <shaohua.li@intel.com>
+Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+--- a/drivers/pci/pcie/aspm.c
++++ b/drivers/pci/pcie/aspm.c
+@@ -638,6 +638,10 @@ void pcie_aspm_init_link_state(struct pci_dev *pdev)
+ if (pdev->pcie_type != PCI_EXP_TYPE_ROOT_PORT &&
+ pdev->pcie_type != PCI_EXP_TYPE_DOWNSTREAM)
+ return;
++ /* VIA has a strange chipset, root port is under a bridge */
++ if (pdev->pcie_type == PCI_EXP_TYPE_ROOT_PORT &&
++ pdev->bus->self)
++ return;
+ down_read(&pci_bus_sem);
+ if (list_empty(&pdev->subordinate->devices))
+ goto out;
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:15:49 2009
+Message-Id: <20090701001549.565804796@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:14:05 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Dmitry Torokhov <dtor@mail.ru>
+Subject: [patch 09/35] atkbd: add forced release quirks for four more keyboard models
+References: <20090701001356.007288418@mini.kroah.org>
+Content-Disposition: inline; filename=atkbd-add-forced-release-quirks-for-four-more-keyboard-models.patch
+Content-Length: 8721
+Lines: 285
+
+2.6.29-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Chuck Ebbert <cebbert@redhat.com>
+
+Add atkbd forced key release quirks for four more notebook models.
+
+Rollup of:
+linux-2.6.git-391916985b009b8934d00f772a3bde0d8a495ebd.patch
+linux-2.6.git-adcb523eb39e0dd2f712d8dbd8e18b5d36a97825.patch
+linux-2.6.git-157f3a3e17cd498571db2a472dc3a15a7679ee3f.patch
+linux-2.6.git-e04126c79242d2740b469292d42c239bad7807cc.patch
+linux-2.6.git-9166d0f620d5dd4a128711bdeedb3e0f534d9d49.patch
+
+Cc: Dmitry Torokhov <dtor@mail.ru>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/input/keyboard/atkbd.c | 169 +++++++++++++++++++++++------------------
+ 1 file changed, 96 insertions(+), 73 deletions(-)
+
+--- a/drivers/input/keyboard/atkbd.c
++++ b/drivers/input/keyboard/atkbd.c
+@@ -229,7 +229,8 @@ struct atkbd {
+ /*
+ * System-specific ketymap fixup routine
+ */
+-static void (*atkbd_platform_fixup)(struct atkbd *);
++static void (*atkbd_platform_fixup)(struct atkbd *, const void *data);
++static void *atkbd_platform_fixup_data;
+
+ static ssize_t atkbd_attr_show_helper(struct device *dev, char *buf,
+ ssize_t (*handler)(struct atkbd *, char *));
+@@ -834,87 +835,71 @@ static void atkbd_disconnect(struct seri
+ }
+
+ /*
+- * Most special keys (Fn+F?) on Dell laptops do not generate release
+- * events so we have to do it ourselves.
++ * generate release events for the keycodes given in data
+ */
+-static void atkbd_dell_laptop_keymap_fixup(struct atkbd *atkbd)
++static void atkbd_apply_forced_release_keylist(struct atkbd* atkbd,
++ const void *data)
+ {
+- static const unsigned int forced_release_keys[] = {
+- 0x85, 0x86, 0x87, 0x88, 0x89, 0x8a, 0x8b, 0x8f, 0x93,
+- };
+- int i;
++ const unsigned int *keys = data;
++ unsigned int i;
+
+ if (atkbd->set == 2)
+- for (i = 0; i < ARRAY_SIZE(forced_release_keys); i++)
+- __set_bit(forced_release_keys[i],
+- atkbd->force_release_mask);
++ for (i = 0; keys[i] != -1U; i++)
++ __set_bit(keys[i], atkbd->force_release_mask);
+ }
+
+ /*
++ * Most special keys (Fn+F?) on Dell laptops do not generate release
++ * events so we have to do it ourselves.
++ */
++static unsigned int atkbd_dell_laptop_forced_release_keys[] = {
++ 0x85, 0x86, 0x87, 0x88, 0x89, 0x8a, 0x8b, 0x8f, 0x93, -1U
++};
++
++/*
+ * Perform fixup for HP system that doesn't generate release
+ * for its video switch
+ */
+-static void atkbd_hp_keymap_fixup(struct atkbd *atkbd)
+-{
+- static const unsigned int forced_release_keys[] = {
+- 0x94,
+- };
+- int i;
+-
+- if (atkbd->set == 2)
+- for (i = 0; i < ARRAY_SIZE(forced_release_keys); i++)
+- __set_bit(forced_release_keys[i],
+- atkbd->force_release_mask);
+-}
++static unsigned int atkbd_hp_forced_release_keys[] = {
++ 0x94, -1U
++};
+
+ /*
+ * Inventec system with broken key release on volume keys
+ */
+-static void atkbd_inventec_keymap_fixup(struct atkbd *atkbd)
+-{
+- const unsigned int forced_release_keys[] = {
+- 0xae, 0xb0,
+- };
+- int i;
+-
+- if (atkbd->set == 2)
+- for (i = 0; i < ARRAY_SIZE(forced_release_keys); i++)
+- __set_bit(forced_release_keys[i],
+- atkbd->force_release_mask);
+-}
++static unsigned int atkbd_inventec_forced_release_keys[] = {
++ 0xae, 0xb0, -1U
++};
+
+ /*
+ * Perform fixup for HP Pavilion ZV6100 laptop that doesn't generate release
+ * for its volume buttons
+ */
+-static void atkbd_hp_zv6100_keymap_fixup(struct atkbd *atkbd)
+-{
+- const unsigned int forced_release_keys[] = {
+- 0xae, 0xb0,
+- };
+- int i;
++static unsigned int atkbd_hp_zv6100_forced_release_keys[] = {
++ 0xae, 0xb0, -1U
++};
+
+- if (atkbd->set == 2)
+- for (i = 0; i < ARRAY_SIZE(forced_release_keys); i++)
+- __set_bit(forced_release_keys[i],
+- atkbd->force_release_mask);
+-}
++/*
++ * Samsung NC10,NC20 with Fn+F? key release not working
++ */
++static unsigned int atkbd_samsung_forced_release_keys[] = {
++ 0x82, 0x83, 0x84, 0x86, 0x88, 0x89, 0xb3, 0xf7, 0xf9, -1U
++};
+
+ /*
+- * Samsung NC10 with Fn+F? key release not working
++ * The volume up and volume down special keys on a Fujitsu Amilo PA 1510 laptop
++ * do not generate release events so we have to do it ourselves.
+ */
+-static void atkbd_samsung_keymap_fixup(struct atkbd *atkbd)
+-{
+- const unsigned int forced_release_keys[] = {
+- 0x82, 0x83, 0x84, 0x86, 0x88, 0x89, 0xb3, 0xf7, 0xf9,
+- };
+- int i;
++static unsigned int atkbd_amilo_pa1510_forced_release_keys[] = {
++ 0xb0, 0xae, -1U
++};
+
+- if (atkbd->set == 2)
+- for (i = 0; i < ARRAY_SIZE(forced_release_keys); i++)
+- __set_bit(forced_release_keys[i],
+- atkbd->force_release_mask);
+-}
++/*
++ * Amilo Xi 3650 key release for light touch bar not working
++ */
++static unsigned int atkbd_amilo_xi3650_forced_release_keys[] = {
++ 0x67, 0xed, 0x90, 0xa2, 0x99, 0xa4, 0xae, 0xb0, -1U
++};
+
+ /*
+ * atkbd_set_keycode_table() initializes keyboard's keycode table
+@@ -967,7 +952,7 @@ static void atkbd_set_keycode_table(stru
+ * Perform additional fixups
+ */
+ if (atkbd_platform_fixup)
+- atkbd_platform_fixup(atkbd);
++ atkbd_platform_fixup(atkbd, atkbd_platform_fixup_data);
+ }
+
+ /*
+@@ -1492,9 +1477,11 @@ static ssize_t atkbd_show_err_count(stru
+ return sprintf(buf, "%lu\n", atkbd->err_count);
+ }
+
+-static int __init atkbd_setup_fixup(const struct dmi_system_id *id)
++static int __init atkbd_setup_forced_release(const struct dmi_system_id *id)
+ {
+- atkbd_platform_fixup = id->driver_data;
++ atkbd_platform_fixup = atkbd_apply_forced_release_keylist;
++ atkbd_platform_fixup_data = id->driver_data;
++
+ return 0;
+ }
+
+@@ -1505,8 +1492,8 @@ static struct dmi_system_id atkbd_dmi_qu
+ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+ DMI_MATCH(DMI_CHASSIS_TYPE, "8"), /* Portable */
+ },
+- .callback = atkbd_setup_fixup,
+- .driver_data = atkbd_dell_laptop_keymap_fixup,
++ .callback = atkbd_setup_forced_release,
++ .driver_data = atkbd_dell_laptop_forced_release_keys,
+ },
+ {
+ .ident = "Dell Laptop",
+@@ -1514,8 +1501,8 @@ static struct dmi_system_id atkbd_dmi_qu
+ DMI_MATCH(DMI_SYS_VENDOR, "Dell Computer Corporation"),
+ DMI_MATCH(DMI_CHASSIS_TYPE, "8"), /* Portable */
+ },
+- .callback = atkbd_setup_fixup,
+- .driver_data = atkbd_dell_laptop_keymap_fixup,
++ .callback = atkbd_setup_forced_release,
++ .driver_data = atkbd_dell_laptop_forced_release_keys,
+ },
+ {
+ .ident = "HP 2133",
+@@ -1523,8 +1510,8 @@ static struct dmi_system_id atkbd_dmi_qu
+ DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "HP 2133"),
+ },
+- .callback = atkbd_setup_fixup,
+- .driver_data = atkbd_hp_keymap_fixup,
++ .callback = atkbd_setup_forced_release,
++ .driver_data = atkbd_hp_forced_release_keys,
+ },
+ {
+ .ident = "HP Pavilion ZV6100",
+@@ -1532,8 +1519,8 @@ static struct dmi_system_id atkbd_dmi_qu
+ DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "Pavilion ZV6100"),
+ },
+- .callback = atkbd_setup_fixup,
+- .driver_data = atkbd_hp_zv6100_keymap_fixup,
++ .callback = atkbd_setup_forced_release,
++ .driver_data = atkbd_hp_zv6100_forced_release_keys,
+ },
+ {
+ .ident = "Inventec Symphony",
+@@ -1541,8 +1528,8 @@ static struct dmi_system_id atkbd_dmi_qu
+ DMI_MATCH(DMI_SYS_VENDOR, "INVENTEC"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "SYMPHONY 6.0/7.0"),
+ },
+- .callback = atkbd_setup_fixup,
+- .driver_data = atkbd_inventec_keymap_fixup,
++ .callback = atkbd_setup_forced_release,
++ .driver_data = atkbd_inventec_forced_release_keys,
+ },
+ {
+ .ident = "Samsung NC10",
+@@ -1550,8 +1537,44 @@ static struct dmi_system_id atkbd_dmi_qu
+ DMI_MATCH(DMI_SYS_VENDOR, "SAMSUNG ELECTRONICS CO., LTD."),
+ DMI_MATCH(DMI_PRODUCT_NAME, "NC10"),
+ },
+- .callback = atkbd_setup_fixup,
+- .driver_data = atkbd_samsung_keymap_fixup,
++ .callback = atkbd_setup_forced_release,
++ .driver_data = atkbd_samsung_forced_release_keys,
++ },
++ {
++ .ident = "Samsung NC20",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "SAMSUNG ELECTRONICS CO., LTD."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "NC20"),
++ },
++ .callback = atkbd_setup_forced_release,
++ .driver_data = atkbd_samsung_forced_release_keys,
++ },
++ {
++ .ident = "Samsung SQ45S70S",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "SAMSUNG ELECTRONICS CO., LTD."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "SQ45S70S"),
++ },
++ .callback = atkbd_setup_forced_release,
++ .driver_data = atkbd_samsung_forced_release_keys,
++ },
++ {
++ .ident = "Fujitsu Amilo PA 1510",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU SIEMENS"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "AMILO Pa 1510"),
++ },
++ .callback = atkbd_setup_forced_release,
++ .driver_data = atkbd_amilo_pa1510_forced_release_keys,
++ },
++ {
++ .ident = "Fujitsu Amilo Xi 3650",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU SIEMENS"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "AMILO Xi 3650"),
++ },
++ .callback = atkbd_setup_forced_release,
++ .driver_data = atkbd_amilo_xi3650_forced_release_keys,
+ },
+ { }
+ };
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:15:49 2009
+Message-Id: <20090701001549.750098757@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:14:06 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Nicolas Ferre <nicolas.ferre@atmel.com>,
+ Andrew Victor <avictor.za@gmail.com>,
+ Haavard Skinnemoen <hskinnemoen@atmel.com>
+Subject: [patch 10/35] atmel_lcdfb: correct fifo size for some products
+References: <20090701001356.007288418@mini.kroah.org>
+Content-Disposition: inline; filename=atmel_lcdfb-correct-fifo-size-for-some-products.patch
+Content-Length: 1354
+Lines: 41
+
+2.6.29-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Nicolas Ferre <nicolas.ferre@atmel.com>
+
+commit 53b7479bbdaedcc7846c66fd608fe66f1b5aa35b upstream.
+
+Remove wrong fifo size definition for some AT91 products.
+
+Due to a misunderstanding of some AT91 datasheets, a fifo size of 2048
+(words) has been introduced by mistake. In fact, all products (AT91/AT32)
+are sharing the same fifo size of 512 words.
+
+Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>
+Cc: Andrew Victor <avictor.za@gmail.com>
+Acked-by: Haavard Skinnemoen <hskinnemoen@atmel.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/video/atmel_lcdfb.c | 10 ++--------
+ 1 file changed, 2 insertions(+), 8 deletions(-)
+
+--- a/drivers/video/atmel_lcdfb.c
++++ b/drivers/video/atmel_lcdfb.c
+@@ -29,14 +29,8 @@
+
+ /* configurable parameters */
+ #define ATMEL_LCDC_CVAL_DEFAULT 0xc8
+-#define ATMEL_LCDC_DMA_BURST_LEN 8
+-
+-#if defined(CONFIG_ARCH_AT91SAM9263) || defined(CONFIG_ARCH_AT91CAP9) || \
+- defined(CONFIG_ARCH_AT91SAM9RL)
+-#define ATMEL_LCDC_FIFO_SIZE 2048
+-#else
+-#define ATMEL_LCDC_FIFO_SIZE 512
+-#endif
++#define ATMEL_LCDC_DMA_BURST_LEN 8 /* words */
++#define ATMEL_LCDC_FIFO_SIZE 512 /* words */
+
+ #if defined(CONFIG_ARCH_AT91)
+ #define ATMEL_LCDFB_FBINFO_DEFAULT (FBINFO_DEFAULT \
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:15:50 2009
+Message-Id: <20090701001549.948288390@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:14:07 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Stephen Hemminger <shemminger@vyatta.com>,
+ Jay Vosburgh <fubar@us.ibm.com>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [patch 11/35] bonding: fix multiple module load problem
+References: <20090701001356.007288418@mini.kroah.org>
+Content-Disposition: inline; filename=bonding-fix-multiple-module-load-problem.patch
+Content-Length: 1185
+Lines: 37
+
+2.6.29-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Stephen Hemminger <shemminger@vyatta.com>
+
+[ Upstream commit 130aa61a77b8518f1ea618e1b7d214d60b405f10 ]
+
+Some users still load bond module multiple times to create bonding
+devices. This accidentally was broken by a later patch about
+the time sysfs was fixed. According to Jay, it was broken
+by:
+ commit b8a9787eddb0e4665f31dd1d64584732b2b5d051
+ Author: Jay Vosburgh <fubar@us.ibm.com>
+ Date: Fri Jun 13 18:12:04 2008 -0700
+
+ bonding: Allow setting max_bonds to zero
+
+Note: sysfs and procfs still produce WARN() messages when this is done
+so the sysfs method is the recommended API.
+
+Signed-off-by: Stephen Hemminger <shemminger@vyatta.com>
+Signed-off-by: Jay Vosburgh <fubar@us.ibm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/bonding/bond_sysfs.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/bonding/bond_sysfs.c
++++ b/drivers/net/bonding/bond_sysfs.c
+@@ -1538,6 +1538,7 @@ int bond_create_sysfs(void)
+ printk(KERN_ERR
+ "network device named %s already exists in sysfs",
+ class_attr_bonding_masters.attr.name);
++ ret = 0;
+ }
+
+ return ret;
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:15:50 2009
+Message-Id: <20090701001550.157928733@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:14:08 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Dirk Eibach <eibach@gdsys.de>,
+ Jiri Slaby <jirislaby@gmail.com>
+Subject: [patch 12/35] char: moxa, prevent opening unavailable ports
+References: <20090701001356.007288418@mini.kroah.org>
+Content-Disposition: inline; filename=char-moxa-prevent-opening-unavailable-ports.patch
+Content-Length: 1431
+Lines: 47
+
+2.6.29-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Dirk Eibach <eibach@gdsys.de>
+
+commit a90b037583d5f1ae3e54e9c687c79df82d1d34a4 upstream.
+
+In moxa.c there are 32 minor numbers reserved for each device. The number
+of ports actually available per device is stored in
+moxa_board_conf->numPorts. This number is not considered in moxa_open().
+Opening a port that is not available results in a kernel oops. This patch
+adds a test to moxa_open() that prevents opening unavailable ports.
+
+[akpm@linux-foundation.org: avoid multiple returns]
+Signed-off-by: Dirk Eibach <eibach@gdsys.de>
+Signed-off-by: Jiri Slaby <jirislaby@gmail.com>
+Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/char/moxa.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/drivers/char/moxa.c
++++ b/drivers/char/moxa.c
+@@ -1184,6 +1184,11 @@ static int moxa_open(struct tty_struct *
+ return -ENODEV;
+ }
+
++ if (port % MAX_PORTS_PER_BOARD >= brd->numPorts) {
++ retval = -ENODEV;
++ goto out_unlock;
++ }
++
+ ch = &brd->ports[port % MAX_PORTS_PER_BOARD];
+ ch->port.count++;
+ tty->driver_data = ch;
+@@ -1208,8 +1213,8 @@ static int moxa_open(struct tty_struct *
+ moxa_close_port(tty);
+ } else
+ ch->port.flags |= ASYNC_NORMAL_ACTIVE;
++out_unlock:
+ mutex_unlock(&moxa_openlock);
+-
+ return retval;
+ }
+
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:15:50 2009
+Message-Id: <20090701001550.312076882@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:14:09 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Karsten Keil <keil@b1-systems.de>
+Subject: [patch 13/35] ISDN: Fix DMA alloc for hfcpci
+References: <20090701001356.007288418@mini.kroah.org>
+Content-Disposition: inline; filename=isdn-fix-dma-alloc-for-hfcpci.patch
+Content-Length: 3794
+Lines: 99
+
+2.6.29-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Karsten Keil <keil@b1-systems.de>
+
+commit 8a745b9d91962991ce87a649a4dc3af3206c2c8b upstream.
+
+Replace wrong code with correct DMA API functions.
+
+Signed-off-by: Karsten Keil <keil@b1-systems.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/isdn/hisax/hfc_pci.c | 41 ++++++++++++++++++++++++++++++-----------
+ drivers/isdn/hisax/hisax.h | 2 +-
+ 2 files changed, 31 insertions(+), 12 deletions(-)
+
+--- a/drivers/isdn/hisax/hfc_pci.c
++++ b/drivers/isdn/hisax/hfc_pci.c
+@@ -82,8 +82,9 @@ release_io_hfcpci(struct IsdnCardState *
+ Write_hfc(cs, HFCPCI_INT_M2, cs->hw.hfcpci.int_m2);
+ pci_write_config_word(cs->hw.hfcpci.dev, PCI_COMMAND, 0); /* disable memory mapped ports + busmaster */
+ del_timer(&cs->hw.hfcpci.timer);
+- kfree(cs->hw.hfcpci.share_start);
+- cs->hw.hfcpci.share_start = NULL;
++ pci_free_consistent(cs->hw.hfcpci.dev, 0x8000,
++ cs->hw.hfcpci.fifos, cs->hw.hfcpci.dma);
++ cs->hw.hfcpci.fifos = NULL;
+ iounmap((void *)cs->hw.hfcpci.pci_io);
+ }
+
+@@ -1663,8 +1664,19 @@ setup_hfcpci(struct IsdnCard *card)
+ dev_hfcpci);
+ i++;
+ if (tmp_hfcpci) {
++ dma_addr_t dma_mask = DMA_BIT_MASK(32) & ~0x7fffUL;
+ if (pci_enable_device(tmp_hfcpci))
+ continue;
++ if (pci_set_dma_mask(tmp_hfcpci, dma_mask)) {
++ printk(KERN_WARNING
++ "HiSax hfc_pci: No suitable DMA available.\n");
++ continue;
++ }
++ if (pci_set_consistent_dma_mask(tmp_hfcpci, dma_mask)) {
++ printk(KERN_WARNING
++ "HiSax hfc_pci: No suitable consistent DMA available.\n");
++ continue;
++ }
+ pci_set_master(tmp_hfcpci);
+ if ((card->para[0]) && (card->para[0] != (tmp_hfcpci->resource[ 0].start & PCI_BASE_ADDRESS_IO_MASK)))
+ continue;
+@@ -1693,22 +1705,29 @@ setup_hfcpci(struct IsdnCard *card)
+ printk(KERN_WARNING "HFC-PCI: No IO-Mem for PCI card found\n");
+ return (0);
+ }
++
+ /* Allocate memory for FIFOS */
+- /* Because the HFC-PCI needs a 32K physical alignment, we */
+- /* need to allocate the double mem and align the address */
+- if (!(cs->hw.hfcpci.share_start = kmalloc(65536, GFP_KERNEL))) {
+- printk(KERN_WARNING "HFC-PCI: Error allocating memory for FIFO!\n");
++ cs->hw.hfcpci.fifos = pci_alloc_consistent(cs->hw.hfcpci.dev,
++ 0x8000, &cs->hw.hfcpci.dma);
++ if (!cs->hw.hfcpci.fifos) {
++ printk(KERN_WARNING "HFC-PCI: Error allocating FIFO memory!\n");
++ return 0;
++ }
++ if (cs->hw.hfcpci.dma & 0x7fff) {
++ printk(KERN_WARNING
++ "HFC-PCI: Error DMA memory not on 32K boundary (%lx)\n",
++ (u_long)cs->hw.hfcpci.dma);
++ pci_free_consistent(cs->hw.hfcpci.dev, 0x8000,
++ cs->hw.hfcpci.fifos, cs->hw.hfcpci.dma);
+ return 0;
+ }
+- cs->hw.hfcpci.fifos = (void *)
+- (((ulong) cs->hw.hfcpci.share_start) & ~0x7FFF) + 0x8000;
+- pci_write_config_dword(cs->hw.hfcpci.dev, 0x80, (u_int) virt_to_bus(cs->hw.hfcpci.fifos));
++ pci_write_config_dword(cs->hw.hfcpci.dev, 0x80, (u32)cs->hw.hfcpci.dma);
+ cs->hw.hfcpci.pci_io = ioremap((ulong) cs->hw.hfcpci.pci_io, 256);
+ printk(KERN_INFO
+- "HFC-PCI: defined at mem %p fifo %p(%#x) IRQ %d HZ %d\n",
++ "HFC-PCI: defined at mem %p fifo %p(%lx) IRQ %d HZ %d\n",
+ cs->hw.hfcpci.pci_io,
+ cs->hw.hfcpci.fifos,
+- (u_int) virt_to_bus(cs->hw.hfcpci.fifos),
++ (u_long)cs->hw.hfcpci.dma,
+ cs->irq, HZ);
+
+ spin_lock_irqsave(&cs->lock, flags);
+--- a/drivers/isdn/hisax/hisax.h
++++ b/drivers/isdn/hisax/hisax.h
+@@ -694,7 +694,7 @@ struct hfcPCI_hw {
+ int nt_timer;
+ struct pci_dev *dev;
+ unsigned char *pci_io; /* start of PCI IO memory */
+- void *share_start; /* shared memory for Fifos start */
++ dma_addr_t dma; /* dma handle for Fifos */
+ void *fifos; /* FIFO memory */
+ int last_bfifo_cnt[2]; /* marker saving last b-fifo frame count */
+ struct timer_list timer;
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:15:50 2009
+Message-Id: <20090701001550.521446575@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:14:10 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk
+Subject: [patch 14/35] USB: usbtmc: fix switch statment
+References: <20090701001356.007288418@mini.kroah.org>
+Content-Disposition: inline; filename=usb-usbtmc-fix-switch-statment.patch
+Content-Length: 1244
+Lines: 49
+
+2.6.29-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Greg Kroah-Hartman <gregkh@suse.de>
+
+commit a92b63e7e4c185b4dd9e87762e2cb716e54482d0 upstream.
+
+Steve Holland pointed out that we forgot to call break; in the switch
+statment. This probably resolves a lot of the bug reports I've gotten
+for the driver lately.
+
+Stupid me...
+
+Reported-by: Steve Holland <sdh4@iastate.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/class/usbtmc.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/usb/class/usbtmc.c
++++ b/drivers/usb/class/usbtmc.c
+@@ -927,21 +927,27 @@ static long usbtmc_ioctl(struct file *fi
+ switch (cmd) {
+ case USBTMC_IOCTL_CLEAR_OUT_HALT:
+ retval = usbtmc_ioctl_clear_out_halt(data);
++ break;
+
+ case USBTMC_IOCTL_CLEAR_IN_HALT:
+ retval = usbtmc_ioctl_clear_in_halt(data);
++ break;
+
+ case USBTMC_IOCTL_INDICATOR_PULSE:
+ retval = usbtmc_ioctl_indicator_pulse(data);
++ break;
+
+ case USBTMC_IOCTL_CLEAR:
+ retval = usbtmc_ioctl_clear(data);
++ break;
+
+ case USBTMC_IOCTL_ABORT_BULK_OUT:
+ retval = usbtmc_ioctl_abort_bulk_out(data);
++ break;
+
+ case USBTMC_IOCTL_ABORT_BULK_IN:
+ retval = usbtmc_ioctl_abort_bulk_in(data);
++ break;
+ }
+
+ mutex_unlock(&data->io_mutex);
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:15:50 2009
+Message-Id: <20090701001550.709903218@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:14:11 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jean Delvare <jdelvare@suse.de>,
+ Steve Conklin <steve.conklin@canonical.com>,
+ Leann Ogasawara <leann.ogasawara@canonical.com>,
+ Ingo Molnar <mingo@elte.hu>
+Subject: [patch 15/35] x86: Add quirk for reboot stalls on a Dell Optiplex 360
+References: <20090701001356.007288418@mini.kroah.org>
+Content-Disposition: inline; filename=x86-add-quirk-for-reboot-stalls-on-a-dell-optiplex-360.patch
+Content-Length: 1174
+Lines: 37
+
+2.6.29-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Jean Delvare <jdelvare@suse.de>
+
+commit 4a4aca641bc4598e77b866804f47c651ec4a764d upstream.
+
+The Dell Optiplex 360 hangs on reboot, just like the Optiplex 330, so
+the same quirk is needed.
+
+Signed-off-by: Jean Delvare <jdelvare@suse.de>
+Cc: Steve Conklin <steve.conklin@canonical.com>
+Cc: Leann Ogasawara <leann.ogasawara@canonical.com>
+LKML-Reference: <200906051202.38311.jdelvare@suse.de>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/reboot.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/arch/x86/kernel/reboot.c
++++ b/arch/x86/kernel/reboot.c
+@@ -193,6 +193,15 @@ static struct dmi_system_id __initdata r
+ DMI_MATCH(DMI_BOARD_NAME, "0KP561"),
+ },
+ },
++ { /* Handle problems with rebooting on Dell Optiplex 360 with 0T656F */
++ .callback = set_bios_reboot,
++ .ident = "Dell OptiPlex 360",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "OptiPlex 360"),
++ DMI_MATCH(DMI_BOARD_NAME, "0T656F"),
++ },
++ },
+ { /* Handle problems with rebooting on Dell 2400's */
+ .callback = set_bios_reboot,
+ .ident = "Dell PowerEdge 2400",
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:15:51 2009
+Message-Id: <20090701001550.955339915@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:14:12 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Takashi Iwai <tiwai@suse.de>
+Subject: [patch 16/35] ALSA: ca0106 - Add missing registrations of vmaster controls
+References: <20090701001356.007288418@mini.kroah.org>
+Content-Disposition: inline; filename=alsa-ca0106-add-missing-registrations-of-vmaster-controls.patch
+Content-Length: 1035
+Lines: 38
+
+2.6.29-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 601e1cc5df940b59e71c947726640811897d30df upstream.
+
+Although the vmaster controls are created, they aren't registered thus
+they don't appear in the real world. Added the missing snd_ctl_add()
+calls.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/ca0106/ca0106_mixer.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/sound/pci/ca0106/ca0106_mixer.c
++++ b/sound/pci/ca0106/ca0106_mixer.c
+@@ -841,6 +841,9 @@ int __devinit snd_ca0106_mixer(struct sn
+ snd_ca0106_master_db_scale);
+ if (!vmaster)
+ return -ENOMEM;
++ err = snd_ctl_add(card, vmaster);
++ if (err < 0)
++ return err;
+ add_slaves(card, vmaster, slave_vols);
+
+ if (emu->details->spi_dac == 1) {
+@@ -848,6 +851,9 @@ int __devinit snd_ca0106_mixer(struct sn
+ NULL);
+ if (!vmaster)
+ return -ENOMEM;
++ err = snd_ctl_add(card, vmaster);
++ if (err < 0)
++ return err;
+ add_slaves(card, vmaster, slave_sws);
+ }
+ return 0;
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:15:51 2009
+Message-Id: <20090701001551.101806792@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:14:13 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Scott James Remnant <scott@canonical.com>,
+ Tim Gardner <tim.gardner@canonical.com>,
+ Bjorn Helgaas <bjorn.helgaas@hp.com>,
+ Philippe De Muyter <phdm@macqel.be>,
+ Kay Sievers <kay.sievers@vrfy.org>
+Subject: [patch 17/35] floppy: provide a PNP device table in the module.
+References: <20090701001356.007288418@mini.kroah.org>
+Content-Disposition: inline; filename=floppy-provide-a-pnp-device-table-in-the-module.patch
+Content-Length: 1587
+Lines: 49
+
+2.6.29-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Scott James Remnant <scott@canonical.com>
+
+commit 83f9ef463bcb4ba7b4fee1d6212fac7d277010d3 upstream.
+
+The missing device table means that the floppy module is not auto-loaded,
+even when the appropriate PNP device (0700) is found.
+
+We don't actually use the table in the module, since the device doesn't
+have a struct pnp_driver, but it's sufficient to cause an alias in the
+module that udev/modprobe will use.
+
+Signed-off-by: Scott James Remnant <scott@canonical.com>
+Signed-off-by: Tim Gardner <tim.gardner@canonical.com>
+Cc: Bjorn Helgaas <bjorn.helgaas@hp.com>
+Cc: Philippe De Muyter <phdm@macqel.be>
+Acked-by: Kay Sievers <kay.sievers@vrfy.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/block/floppy.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/drivers/block/floppy.c
++++ b/drivers/block/floppy.c
+@@ -177,6 +177,7 @@ static int print_unex = 1;
+ #include <linux/interrupt.h>
+ #include <linux/init.h>
+ #include <linux/platform_device.h>
++#include <linux/mod_devicetable.h>
+ #include <linux/buffer_head.h> /* for invalidate_buffers() */
+ #include <linux/mutex.h>
+
+@@ -4598,6 +4599,13 @@ MODULE_AUTHOR("Alain L. Knaff");
+ MODULE_SUPPORTED_DEVICE("fd");
+ MODULE_LICENSE("GPL");
+
++/* This doesn't actually get used other than for module information */
++static const struct pnp_device_id floppy_pnpids[] = {
++ { "PNP0700", 0 },
++ { }
++};
++MODULE_DEVICE_TABLE(pnp, floppy_pnpids);
++
+ #else
+
+ __setup("floppy=", floppy_setup);
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:15:51 2009
+Message-Id: <20090701001551.313300221@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:14:14 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jack Morgenstein <jackm@dev.mellanox.co.il>,
+ Roland Dreier <rolandd@cisco.com>
+Subject: [patch 18/35] IB/mlx4: Add strong ordering to local inval and fast reg work requests
+References: <20090701001356.007288418@mini.kroah.org>
+Content-Disposition: inline; filename=ib-mlx4-add-strong-ordering-to-local-inval-and-fast-reg-work-requests.patch
+Content-Length: 1887
+Lines: 54
+
+2.6.29-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Jack Morgenstein <jackm@dev.mellanox.co.il>
+
+commit 2ac6bf4ddc87c3b6b609f8fa82f6ebbffeac12f4 upstream.
+
+The ConnectX Programmer's Reference Manual states that the "SO" bit
+must be set when posting Fast Register and Local Invalidate send work
+requests. When this bit is set, the work request will be executed
+only after all previous work requests on the send queue have been
+executed. (If the bit is not set, Fast Register and Local Invalidate
+WQEs may begin execution too early, which violates the defined
+semantics for these operations)
+
+This fixes the issue with NFS/RDMA reported in
+<http://lists.openfabrics.org/pipermail/general/2009-April/059253.html>
+
+Signed-off-by: Jack Morgenstein <jackm@dev.mellanox.co.il>
+Signed-off-by: Roland Dreier <rolandd@cisco.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/infiniband/hw/mlx4/qp.c | 4 ++++
+ include/linux/mlx4/qp.h | 1 +
+ 2 files changed, 5 insertions(+)
+
+--- a/drivers/infiniband/hw/mlx4/qp.c
++++ b/drivers/infiniband/hw/mlx4/qp.c
+@@ -1585,12 +1585,16 @@ int mlx4_ib_post_send(struct ib_qp *ibqp
+ break;
+
+ case IB_WR_LOCAL_INV:
++ ctrl->srcrb_flags |=
++ cpu_to_be32(MLX4_WQE_CTRL_STRONG_ORDER);
+ set_local_inv_seg(wqe, wr->ex.invalidate_rkey);
+ wqe += sizeof (struct mlx4_wqe_local_inval_seg);
+ size += sizeof (struct mlx4_wqe_local_inval_seg) / 16;
+ break;
+
+ case IB_WR_FAST_REG_MR:
++ ctrl->srcrb_flags |=
++ cpu_to_be32(MLX4_WQE_CTRL_STRONG_ORDER);
+ set_fmr_seg(wqe, wr);
+ wqe += sizeof (struct mlx4_wqe_fmr_seg);
+ size += sizeof (struct mlx4_wqe_fmr_seg) / 16;
+--- a/include/linux/mlx4/qp.h
++++ b/include/linux/mlx4/qp.h
+@@ -165,6 +165,7 @@ enum {
+ MLX4_WQE_CTRL_IP_CSUM = 1 << 4,
+ MLX4_WQE_CTRL_TCP_UDP_CSUM = 1 << 5,
+ MLX4_WQE_CTRL_INS_VLAN = 1 << 6,
++ MLX4_WQE_CTRL_STRONG_ORDER = 1 << 7,
+ };
+
+ struct mlx4_wqe_ctrl_seg {
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:15:51 2009
+Message-Id: <20090701001551.517170262@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:14:15 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Yinghai Lu <yinghai@kernel.org>,
+ "H. Peter Anvin" <hpa@zytor.com>
+Subject: [patch 19/35] x86: handle initrd that extends into unusable memory
+References: <20090701001356.007288418@mini.kroah.org>
+Content-Disposition: inline; filename=x86-handle-initrd-that-extends-into-unusable-memory.patch
+Content-Length: 2135
+Lines: 72
+
+2.6.29-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Yinghai Lu <yinghai@kernel.org>
+
+commit 8c5dd8f43367f4f266dd616f11658005bc2d20ef upstream.
+
+On a system where system memory (according e820) is not covered by
+mtrr, mtrr_trim_memory converts a portion of memory to reserved, but
+bootloader has already put the initrd in that range.
+
+Thus, we need to have 64bit to use relocate_initrd too.
+
+[ Impact: fix using initrd when mtrr_trim_memory happen ]
+
+Signed-off-by: Yinghai Lu <yinghai@kernel.org>
+Signed-off-by: H. Peter Anvin <hpa@zytor.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/setup.c | 15 +++------------
+ 1 file changed, 3 insertions(+), 12 deletions(-)
+
+--- a/arch/x86/kernel/setup.c
++++ b/arch/x86/kernel/setup.c
+@@ -255,15 +255,13 @@ static inline void copy_edd(void)
+
+ #ifdef CONFIG_BLK_DEV_INITRD
+
+-#ifdef CONFIG_X86_32
+-
+ #define MAX_MAP_CHUNK (NR_FIX_BTMAPS << PAGE_SHIFT)
+ static void __init relocate_initrd(void)
+ {
+
+ u64 ramdisk_image = boot_params.hdr.ramdisk_image;
+ u64 ramdisk_size = boot_params.hdr.ramdisk_size;
+- u64 end_of_lowmem = max_low_pfn << PAGE_SHIFT;
++ u64 end_of_lowmem = max_low_pfn_mapped << PAGE_SHIFT;
+ u64 ramdisk_here;
+ unsigned long slop, clen, mapaddr;
+ char *p, *q;
+@@ -319,14 +317,13 @@ static void __init relocate_initrd(void)
+ ramdisk_image, ramdisk_image + ramdisk_size - 1,
+ ramdisk_here, ramdisk_here + ramdisk_size - 1);
+ }
+-#endif
+
+ static void __init reserve_initrd(void)
+ {
+ u64 ramdisk_image = boot_params.hdr.ramdisk_image;
+ u64 ramdisk_size = boot_params.hdr.ramdisk_size;
+ u64 ramdisk_end = ramdisk_image + ramdisk_size;
+- u64 end_of_lowmem = max_low_pfn << PAGE_SHIFT;
++ u64 end_of_lowmem = max_low_pfn_mapped << PAGE_SHIFT;
+
+ if (!boot_params.hdr.type_of_loader ||
+ !ramdisk_image || !ramdisk_size)
+@@ -356,14 +353,8 @@ static void __init reserve_initrd(void)
+ return;
+ }
+
+-#ifdef CONFIG_X86_32
+ relocate_initrd();
+-#else
+- printk(KERN_ERR "initrd extends beyond end of memory "
+- "(0x%08llx > 0x%08llx)\ndisabling initrd\n",
+- ramdisk_end, end_of_lowmem);
+- initrd_start = 0;
+-#endif
++
+ free_early(ramdisk_image, ramdisk_end);
+ }
+ #else
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:15:51 2009
+Message-Id: <20090701001551.690481544@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:14:16 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Peter Zijlstra <a.p.zijlstra@chello.nl>,
+ Ingo Molnar <mingo@elte.hu>
+Subject: [patch 20/35] lockdep: Select frame pointers on x86
+References: <20090701001356.007288418@mini.kroah.org>
+Content-Disposition: inline; filename=lockdep-select-frame-pointers-on-x86.patch
+Content-Length: 925
+Lines: 30
+
+2.6.29-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Peter Zijlstra <a.p.zijlstra@chello.nl>
+
+commit 00540e5d54be972a94a3b2ce6da8621bebe731a2 upstream.
+
+x86 stack traces are a piece of crap without frame pointers, and its not
+like the 'performance gain' of not having stack pointers matters when you
+selected lockdep.
+
+Reported-by: Andrew Morton <akpm@linux-foundation.org>
+LKML-Reference: <new-submission>
+Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ lib/Kconfig.debug | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/lib/Kconfig.debug
++++ b/lib/Kconfig.debug
+@@ -402,7 +402,7 @@ config LOCKDEP
+ bool
+ depends on DEBUG_KERNEL && TRACE_IRQFLAGS_SUPPORT && STACKTRACE_SUPPORT && LOCKDEP_SUPPORT
+ select STACKTRACE
+- select FRAME_POINTER if !X86 && !MIPS && !PPC
++ select FRAME_POINTER if !MIPS && !PPC
+ select KALLSYMS
+ select KALLSYMS_ALL
+
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:15:52 2009
+Message-Id: <20090701001551.874389473@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:14:17 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Bob Copeland <me@bobcopeland.com>,
+ "John W. Linville" <linville@tuxdriver.com>
+Subject: [patch 21/35] mac80211: fix minstrel single-rate memory corruption
+References: <20090701001356.007288418@mini.kroah.org>
+Content-Disposition: inline; filename=mac80211-fix-minstrel-single-rate-memory-corruption.patch
+Content-Length: 1975
+Lines: 49
+
+2.6.29-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Bob Copeland <me@bobcopeland.com>
+
+commit 5ee58d7e6ad019675b4090582aec4fa1180d8703 upstream.
+
+The minstrel rate controller periodically looks up rate indexes in
+a sampling table. When accessing a specific row and column, minstrel
+correctly does a bounds check which, on the surface, appears to handle
+the case where mi->n_rates < 2. However, mi->sample_idx is actually
+defined as an unsigned, so the right hand side is taken to be a huge
+positive number when negative, and the check will always fail.
+
+Consequently, the RC will overrun the array and cause random memory
+corruption when communicating with a peer that has only a single rate.
+The max value of mi->sample_idx is around 25 so casting to int should
+have no ill effects.
+
+Without the change, uptime is a few minutes under load with an AP
+that has a single hard-coded rate, and both the AP and STA could
+potentially crash. With the change, both lasted 12 hours with a
+steady load.
+
+Thanks to Ognjen Maric for providing the single-rate clue so I could
+reproduce this.
+
+This fixes http://bugzilla.kernel.org/show_bug.cgi?id=12490 on the
+regression list (also http://bugzilla.kernel.org/show_bug.cgi?id=13000).
+
+Reported-by: Sergey S. Kostyliov <rathamahata@gmail.com>
+Reported-by: Ognjen Maric <ognjen.maric@gmail.com>
+Signed-off-by: Bob Copeland <me@bobcopeland.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/mac80211/rc80211_minstrel.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/mac80211/rc80211_minstrel.c
++++ b/net/mac80211/rc80211_minstrel.c
+@@ -216,7 +216,7 @@ minstrel_get_next_sample(struct minstrel
+ unsigned int sample_ndx;
+ sample_ndx = SAMPLE_TBL(mi, mi->sample_idx, mi->sample_column);
+ mi->sample_idx++;
+- if (mi->sample_idx > (mi->n_rates - 2)) {
++ if ((int) mi->sample_idx > (mi->n_rates - 2)) {
+ mi->sample_idx = 0;
+ mi->sample_column++;
+ if (mi->sample_column >= SAMPLE_COLUMNS)
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:15:52 2009
+Message-Id: <20090701001552.051321322@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:14:18 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Dan Williams <dan.j.williams@intel.com>,
+ NeilBrown <neilb@suse.de>
+Subject: [patch 22/35] md/raid5: add missing call to schedule() after prepare_to_wait()
+References: <20090701001356.007288418@mini.kroah.org>
+Content-Disposition: inline; filename=md-raid5-add-missing-call-to-schedule-after-prepare_to_wait.patch
+Content-Length: 911
+Lines: 31
+
+2.6.29-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Dan Williams <dan.j.williams@intel.com>
+
+commit 7a3ab908948b6296ee7e81d42f7c176361c51975 upstream.
+
+In the unlikely event that reshape progresses past the current request
+while it is waiting for a stripe we need to schedule() before retrying
+for 2 reasons:
+1/ Prevent list corruption from duplicated list_add() calls without
+ intervening list_del().
+2/ Give the reshape code a chance to make some progress to resolve the
+ conflict.
+
+Signed-off-by: Dan Williams <dan.j.williams@intel.com>
+Signed-off-by: NeilBrown <neilb@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/raid5.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/md/raid5.c
++++ b/drivers/md/raid5.c
+@@ -3465,6 +3465,7 @@ static int make_request(struct request_q
+ spin_unlock_irq(&conf->device_lock);
+ if (must_retry) {
+ release_stripe(sh);
++ schedule();
+ goto retry;
+ }
+ }
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:15:52 2009
+Message-Id: <20090701001552.244954110@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:14:19 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jiri Slaby <jirislaby@gmail.com>,
+ Alan Cox <alan@linux.intel.com>
+Subject: [patch 23/35] vt_ioctl: fix lock imbalance
+References: <20090701001356.007288418@mini.kroah.org>
+Content-Disposition: inline; filename=vt_ioctl-fix-lock-imbalance.patch
+Content-Length: 804
+Lines: 29
+
+2.6.29-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Jiri Slaby <jirislaby@gmail.com>
+
+commit a115902f67ef51fbbe83e214fb761aaa9734c1ce upstream.
+
+Don't return from switch/case directly in vt_ioctl. Set ret and break
+instead so that we unlock BKL.
+
+Signed-off-by: Jiri Slaby <jirislaby@gmail.com>
+Signed-off-by: Alan Cox <alan@linux.intel.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/char/vt_ioctl.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/char/vt_ioctl.c
++++ b/drivers/char/vt_ioctl.c
+@@ -396,7 +396,8 @@ int vt_ioctl(struct tty_struct *tty, str
+ kbd = kbd_table + console;
+ switch (cmd) {
+ case TIOCLINUX:
+- return tioclinux(tty, arg);
++ ret = tioclinux(tty, arg);
++ break;
+ case KIOCSOUND:
+ if (!perm)
+ goto eperm;
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:15:52 2009
+Message-Id: <20090701001552.431397625@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:14:20 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Andreas Herrmann <andreas.herrmann3@amd.com>,
+ Ingo Molnar <mingo@elte.hu>
+Subject: [patch 24/35] x86: Set cpu_llc_id on AMD CPUs
+References: <20090701001356.007288418@mini.kroah.org>
+Content-Disposition: inline; filename=x86-set-cpu_llc_id-on-amd-cpus.patch
+Content-Length: 1958
+Lines: 72
+
+2.6.29-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Andreas Herrmann <andreas.herrmann3@amd.com>
+
+commit 99bd0c0fc4b04da54cb311953ef9489931c19c63 upstream.
+
+This counts when building sched domains in case NUMA information
+is not available.
+
+( See cpu_coregroup_mask() which uses llc_shared_map which in turn is
+ created based on cpu_llc_id. )
+
+Currently Linux builds domains as follows:
+(example from a dual socket quad-core system)
+
+ CPU0 attaching sched-domain:
+ domain 0: span 0-7 level CPU
+ groups: 0 1 2 3 4 5 6 7
+
+ ...
+
+ CPU7 attaching sched-domain:
+ domain 0: span 0-7 level CPU
+ groups: 7 0 1 2 3 4 5 6
+
+Ever since that is borked for multi-core AMD CPU systems.
+This patch fixes that and now we get a proper:
+
+ CPU0 attaching sched-domain:
+ domain 0: span 0-3 level MC
+ groups: 0 1 2 3
+ domain 1: span 0-7 level CPU
+ groups: 0-3 4-7
+
+ ...
+
+ CPU7 attaching sched-domain:
+ domain 0: span 4-7 level MC
+ groups: 7 4 5 6
+ domain 1: span 0-7 level CPU
+ groups: 4-7 0-3
+
+This allows scheduler to assign tasks to cores on different sockets
+(i.e. that don't share last level cache) for performance reasons.
+
+Signed-off-by: Andreas Herrmann <andreas.herrmann3@amd.com>
+LKML-Reference: <20090619085909.GJ5218@alberich.amd.com>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/cpu/amd.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/arch/x86/kernel/cpu/amd.c
++++ b/arch/x86/kernel/cpu/amd.c
+@@ -207,13 +207,15 @@ static void __cpuinit amd_detect_cmp(str
+ {
+ #ifdef CONFIG_X86_HT
+ unsigned bits;
++ int cpu = smp_processor_id();
+
+ bits = c->x86_coreid_bits;
+-
+ /* Low order bits define the core id (index of core in socket) */
+ c->cpu_core_id = c->initial_apicid & ((1 << bits)-1);
+ /* Convert the initial APIC ID into the socket ID */
+ c->phys_proc_id = c->initial_apicid >> bits;
++ /* use socket ID also for last level cache */
++ per_cpu(cpu_llc_id, cpu) = c->phys_proc_id;
+ #endif
+ }
+
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:15:52 2009
+Message-Id: <20090701001552.616407113@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:14:21 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jens Rottmann <JRottmann@LiPPERTEmbedded.de>,
+ Alan Cox <alan@linux.intel.com>,
+ Jeff Garzik <jgarzik@redhat.com>
+Subject: [patch 25/35] parport_pc: after superio probing restore original register values
+References: <20090701001356.007288418@mini.kroah.org>
+Content-Disposition: inline; filename=parport_pc-after-superio-probing-restore-original-register-values.patch
+Content-Length: 4217
+Lines: 130
+
+2.6.29-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Jens Rottmann <JRottmann@LiPPERTEmbedded.de>
+
+commit e2434dc1c19412639dd047a4d4eff8ed0e5d0d50 upstream.
+
+CONFIG_PARPORT_PC_SUPERIO probes for various superio chips by writing
+byte sequences to a set of different potential I/O ranges. But the
+probed ranges are not exclusive to parallel ports. Some of our boards
+just happen to have a watchdog in one of them. Took us almost a week
+to figure out why some distros reboot without warning after running
+flawlessly for 3 hours. For exactly 170 = 0xAA minutes, that is ...
+
+Fixed by restoring original values after probing. Also fixed too small
+request_region() in detect_and_report_it87().
+
+Signed-off-by: Jens Rottmann <JRottmann@LiPPERTEmbedded.de>
+Signed-off-by: Alan Cox <alan@linux.intel.com>
+Acked-by: Jeff Garzik <jgarzik@redhat.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/parport/parport_pc.c | 31 +++++++++++++++++++++++++------
+ 1 file changed, 25 insertions(+), 6 deletions(-)
+
+--- a/drivers/parport/parport_pc.c
++++ b/drivers/parport/parport_pc.c
+@@ -1413,11 +1413,13 @@ static void __devinit decode_smsc(int ef
+
+ static void __devinit winbond_check(int io, int key)
+ {
+- int devid,devrev,oldid,x_devid,x_devrev,x_oldid;
++ int origval, devid, devrev, oldid, x_devid, x_devrev, x_oldid;
+
+ if (!request_region(io, 3, __func__))
+ return;
+
++ origval = inb(io); /* Save original value */
++
+ /* First probe without key */
+ outb(0x20,io);
+ x_devid=inb(io+1);
+@@ -1437,6 +1439,8 @@ static void __devinit winbond_check(int
+ oldid=inb(io+1);
+ outb(0xaa,io); /* Magic Seal */
+
++ outb(origval, io); /* in case we poked some entirely different hardware */
++
+ if ((x_devid == devid) && (x_devrev == devrev) && (x_oldid == oldid))
+ goto out; /* protection against false positives */
+
+@@ -1447,11 +1451,15 @@ out:
+
+ static void __devinit winbond_check2(int io,int key)
+ {
+- int devid,devrev,oldid,x_devid,x_devrev,x_oldid;
++ int origval[3], devid, devrev, oldid, x_devid, x_devrev, x_oldid;
+
+ if (!request_region(io, 3, __func__))
+ return;
+
++ origval[0] = inb(io); /* Save original values */
++ origval[1] = inb(io + 1);
++ origval[2] = inb(io + 2);
++
+ /* First probe without the key */
+ outb(0x20,io+2);
+ x_devid=inb(io+2);
+@@ -1470,6 +1478,10 @@ static void __devinit winbond_check2(int
+ oldid=inb(io+2);
+ outb(0xaa,io); /* Magic Seal */
+
++ outb(origval[0], io); /* in case we poked some entirely different hardware */
++ outb(origval[1], io + 1);
++ outb(origval[2], io + 2);
++
+ if ((x_devid == devid) && (x_devrev == devrev) && (x_oldid == oldid))
+ goto out; /* protection against false positives */
+
+@@ -1480,11 +1492,13 @@ out:
+
+ static void __devinit smsc_check(int io, int key)
+ {
+- int id,rev,oldid,oldrev,x_id,x_rev,x_oldid,x_oldrev;
++ int origval, id, rev, oldid, oldrev, x_id, x_rev, x_oldid, x_oldrev;
+
+ if (!request_region(io, 3, __func__))
+ return;
+
++ origval = inb(io); /* Save original value */
++
+ /* First probe without the key */
+ outb(0x0d,io);
+ x_oldid=inb(io+1);
+@@ -1508,6 +1522,8 @@ static void __devinit smsc_check(int io,
+ rev=inb(io+1);
+ outb(0xaa,io); /* Magic Seal */
+
++ outb(origval, io); /* in case we poked some entirely different hardware */
++
+ if ((x_id == id) && (x_oldrev == oldrev) &&
+ (x_oldid == oldid) && (x_rev == rev))
+ goto out; /* protection against false positives */
+@@ -1544,11 +1560,12 @@ static void __devinit detect_and_report_
+ static void __devinit detect_and_report_it87(void)
+ {
+ u16 dev;
+- u8 r;
++ u8 origval, r;
+ if (verbose_probing)
+ printk(KERN_DEBUG "IT8705 Super-IO detection, now testing port 2E ...\n");
+- if (!request_region(0x2e, 1, __func__))
++ if (!request_region(0x2e, 2, __func__))
+ return;
++ origval = inb(0x2e); /* Save original value */
+ outb(0x87, 0x2e);
+ outb(0x01, 0x2e);
+ outb(0x55, 0x2e);
+@@ -1568,8 +1585,10 @@ static void __devinit detect_and_report_
+ outb(r | 8, 0x2F);
+ outb(0x02, 0x2E); /* Lock */
+ outb(0x02, 0x2F);
++ } else {
++ outb(origval, 0x2e); /* Oops, sorry to disturb */
+ }
+- release_region(0x2e, 1);
++ release_region(0x2e, 2);
+ }
+ #endif /* CONFIG_PARPORT_PC_SUPERIO */
+
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:15:52 2009
+Message-Id: <20090701001552.820343714@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:14:22 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>,
+ Alan Cox <alan@linux.intel.com>,
+ Jeff Garzik <jgarzik@redhat.com>
+Subject: [patch 26/35] parport_pc: set properly the dma_mask for parport_pc device
+References: <20090701001356.007288418@mini.kroah.org>
+Content-Disposition: inline; filename=parport_pc-set-properly-the-dma_mask-for-parport_pc-device.patch
+Content-Length: 1667
+Lines: 44
+
+2.6.29-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
+
+commit dfa7c4d869b7d3d37b70f1de856f2901b6ebfcf0 upstream.
+
+parport_pc_probe_port() creates the own 'parport_pc' device if the
+device argument is NULL. Then parport_pc_probe_port() doesn't
+initialize the dma_mask and coherent_dma_mask of the device and calls
+dma_alloc_coherent with it. dma_alloc_coherent fails because
+dma_alloc_coherent() doesn't accept the uninitialized dma_mask:
+
+http://lkml.org/lkml/2009/6/16/150
+
+Long ago, X86_32 and X86_64 had the own dma_alloc_coherent
+implementations; X86_32 accepted a device having dma_mask that is not
+initialized however X86_64 didn't. When we merged them, we chose to
+prohibit a device having dma_mask that is not initialized. I think
+that it's good to require drivers to set up dma_mask (and
+coherent_dma_mask) properly if the drivers want DMA.
+
+Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
+Reported-by: Malcom Blaney <malcolm.blaney@maptek.com.au>
+Tested-by: Malcom Blaney <malcolm.blaney@maptek.com.au>
+Signed-off-by: Alan Cox <alan@linux.intel.com>
+Acked-by: Jeff Garzik <jgarzik@redhat.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/parport/parport_pc.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/parport/parport_pc.c
++++ b/drivers/parport/parport_pc.c
+@@ -2211,6 +2211,9 @@ struct parport *parport_pc_probe_port (u
+ if (IS_ERR(pdev))
+ return NULL;
+ dev = &pdev->dev;
++
++ dev->coherent_dma_mask = DMA_BIT_MASK(24);
++ dev->dma_mask = &dev->coherent_dma_mask;
+ }
+
+ ops = kmalloc(sizeof (struct parport_operations), GFP_KERNEL);
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:15:53 2009
+Message-Id: <20090701001553.003289449@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:14:23 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ "Rafael J. Wysocki" <rjw@sisk.pl>,
+ Jesse Barnes <jbarnes@virtuousgeek.org>
+Subject: [patch 27/35] PCI PM: Fix handling of devices without PM support by pci_target_state()
+References: <20090701001356.007288418@mini.kroah.org>
+Content-Disposition: inline; filename=pci-pm-fix-handling-of-devices-without-pm-support-by-pci_target_state.patch
+Content-Length: 1472
+Lines: 44
+
+2.6.29-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Rafael J. Wysocki <rjw@sisk.pl>
+
+commit d2abdf62882d982c58e7a6b09ecdcfcc28075e2e upstream.
+
+If a PCI device is not power-manageable either by the platform, or
+with the help of the native PCI PM interface, pci_target_state() will
+return either PCI_D3hot, or PCI_POWER_ERROR for it, depending on
+whether or not the device is configured to wake up the system. Alas,
+none of these return values is correct, because each of them causes
+pci_prepare_to_sleep() to return error code, although it should
+complete successfully in such a case.
+
+Fix this problem by making pci_target_state() always return PCI_D0
+for devices that cannot be power managed.
+
+Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>
+Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/pci/pci.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+--- a/drivers/pci/pci.c
++++ b/drivers/pci/pci.c
+@@ -1196,15 +1196,14 @@ pci_power_t pci_target_state(struct pci_
+ default:
+ target_state = state;
+ }
++ } else if (!dev->pm_cap) {
++ target_state = PCI_D0;
+ } else if (device_may_wakeup(&dev->dev)) {
+ /*
+ * Find the deepest state from which the device can generate
+ * wake-up events, make it the target state and enable device
+ * to generate PME#.
+ */
+- if (!dev->pm_cap)
+- return PCI_POWER_ERROR;
+-
+ if (dev->pme_support) {
+ while (target_state
+ && !(dev->pme_support & (1 << target_state)))
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:15:53 2009
+Message-Id: <20090701001553.278599027@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:14:24 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ "Rafael J. Wysocki" <rjw@sisk.pl>,
+ Jesse Barnes <jbarnes@virtuousgeek.org>
+Subject: [patch 28/35] PCI PM: Follow PCI_PM_CTRL_NO_SOFT_RESET during transitions from D3
+References: <20090701001356.007288418@mini.kroah.org>
+Content-Disposition: inline; filename=pci-pm-follow-pci_pm_ctrl_no_soft_reset-during-transitions-from-d3.patch
+Content-Length: 1444
+Lines: 38
+
+2.6.29-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Rafael J. Wysocki <rjw@sisk.pl>
+
+commit f62795f1e892ca9269849fa83de97621da7e02c0 upstream.
+
+According to the PCI PM specification (PCI Bus Power Management
+Interface Specification, Rev. 1.2, Section 5.4.1) we are supposed to
+reinitialize devices that have PCI_PM_CTRL_NO_SOFT_RESET clear during
+all transitions from PCI_D3hot to PCI_D0, but we only do it if the
+device's current_state field is equal to PCI_UNKNOWN.
+
+This may lead to problems if a device with PCI_PM_CTRL_NO_SOFT_RESET
+unset is put into PCI_D3hot at run time by its driver and
+pci_set_power_state() is used to put it back into PCI_D0, because in
+that case the device will remain uninitialized after
+pci_set_power_state() has returned. Prevent that from happening by
+modifying pci_raw_set_power_state() to reinitialize devices with
+PCI_PM_CTRL_NO_SOFT_RESET unset during all transitions from D3 to D0.
+
+Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>
+Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/pci/pci.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/pci/pci.c
++++ b/drivers/pci/pci.c
+@@ -479,6 +479,8 @@ pci_raw_set_power_state(struct pci_dev *
+ pmcsr &= ~PCI_PM_CTRL_STATE_MASK;
+ pmcsr |= state;
+ break;
++ case PCI_D3hot:
++ case PCI_D3cold:
+ case PCI_UNKNOWN: /* Boot-up */
+ if ((pmcsr & PCI_PM_CTRL_STATE_MASK) == PCI_D3hot
+ && !(pmcsr & PCI_PM_CTRL_NO_SOFT_RESET)) {
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:15:53 2009
+Message-Id: <20090701001553.429647333@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:14:25 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jiri Slaby <jirislaby@gmail.com>,
+ Alan Cox <alan@linux.intel.com>
+Subject: [patch 29/35] pcmcia/cm4000: fix lock imbalance
+References: <20090701001356.007288418@mini.kroah.org>
+Content-Disposition: inline; filename=pcmcia-cm4000-fix-lock-imbalance.patch
+Content-Length: 777
+Lines: 28
+
+2.6.29-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Jiri Slaby <jirislaby@gmail.com>
+
+commit 69ae59d7d8df14413cf0a97b3e372d7dc8352563 upstream.
+
+Don't return from switch/case, break instead, so that we unlock BKL.
+
+Signed-off-by: Jiri Slaby <jirislaby@gmail.com>
+Signed-off-by: Alan Cox <alan@linux.intel.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/char/pcmcia/cm4000_cs.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/char/pcmcia/cm4000_cs.c
++++ b/drivers/char/pcmcia/cm4000_cs.c
+@@ -1575,7 +1575,8 @@ static long cmm_ioctl(struct file *filp,
+ clear_bit(LOCK_IO, &dev->flags);
+ wake_up_interruptible(&dev->ioq);
+
+- return 0;
++ rc = 0;
++ break;
+ case CM_IOCSPTS:
+ {
+ struct ptsreq krnptsreq;
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:15:53 2009
+Message-Id: <20090701001553.621173501@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:14:26 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Andrew Vasquez <andrew.vasquez@qlogic.com>,
+ James Bottomley <James.Bottomley@HansenPartnership.com>
+Subject: [patch 30/35] qla2xxx: Correct (again) overflow during dump-processing on large-memory ISP23xx parts.
+References: <20090701001356.007288418@mini.kroah.org>
+Content-Disposition: inline; filename=qla2xxx-correct-overflow-during-dump-processing-on-large-memory-isp23xx-parts.patch
+Content-Length: 986
+Lines: 29
+
+2.6.29-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Andrew Vasquez <andrew.vasquez@qlogic.com>
+
+commit e18e963b7e533149676b5d387d0a56160df9f111 upstream.
+
+Commit 7b867cf76fbcc8d77867cbec6f509f71dce8a98f ([SCSI] qla2xxx:
+Refactor qla data structures) inadvertently reverted
+e792121ec85672c1fa48f79d13986a3f4f56c590 ([SCSI] qla2xxx: Correct
+overflow during dump-processing on large-memory ISP23xx parts.).
+
+Signed-off-by: Andrew Vasquez <andrew.vasquez@qlogic.com>
+Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/scsi/qla2xxx/qla_dbg.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/scsi/qla2xxx/qla_dbg.c
++++ b/drivers/scsi/qla2xxx/qla_dbg.c
+@@ -218,7 +218,7 @@ qla24xx_soft_reset(struct qla_hw_data *h
+
+ static int
+ qla2xxx_dump_ram(struct qla_hw_data *ha, uint32_t addr, uint16_t *ram,
+- uint16_t ram_words, void **nxt)
++ uint32_t ram_words, void **nxt)
+ {
+ int rval;
+ uint32_t cnt, stat, timer, words, idx;
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:15:53 2009
+Message-Id: <20090701001553.803002126@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:14:27 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Clemens Ladisch <clemens@ladisch.de>,
+ Takashi Iwai <tiwai@suse.de>
+Subject: [patch 31/35] sound: seq_midi_event: fix decoding of (N)RPN events
+References: <20090701001356.007288418@mini.kroah.org>
+Content-Disposition: inline; filename=sound-seq_midi_event-fix-decoding-of-rpn-events.patch
+Content-Length: 1289
+Lines: 34
+
+2.6.29-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Clemens Ladisch <clemens@ladisch.de>
+
+commit 6423f9ea8035138d70bae1a278d3b57b743f8b3e upstream.
+
+When decoding (N)RPN sequencer events into raw MIDI commands, the
+extra_decode_xrpn() function had accidentally swapped the MSB and LSB
+controller values of both the parameter number and the data value.
+
+Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/core/seq/seq_midi_event.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/sound/core/seq/seq_midi_event.c
++++ b/sound/core/seq/seq_midi_event.c
+@@ -504,10 +504,10 @@ static int extra_decode_xrpn(struct snd_
+ if (dev->nostat && count < 12)
+ return -ENOMEM;
+ cmd = MIDI_CMD_CONTROL|(ev->data.control.channel & 0x0f);
+- bytes[0] = ev->data.control.param & 0x007f;
+- bytes[1] = (ev->data.control.param & 0x3f80) >> 7;
+- bytes[2] = ev->data.control.value & 0x007f;
+- bytes[3] = (ev->data.control.value & 0x3f80) >> 7;
++ bytes[0] = (ev->data.control.param & 0x3f80) >> 7;
++ bytes[1] = ev->data.control.param & 0x007f;
++ bytes[2] = (ev->data.control.value & 0x3f80) >> 7;
++ bytes[3] = ev->data.control.value & 0x007f;
+ if (cmd != dev->lastcmd && !dev->nostat) {
+ if (count < 9)
+ return -ENOMEM;
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:15:54 2009
+Message-Id: <20090701001553.976012658@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:14:28 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Dimitri Sivanich <sivanich@sgi.com>,
+ Christoph Lameter <cl@linux-foundation.org>,
+ Nick Piggin <nickpiggin@yahoo.com.au>,
+ Mel Gorman <mel@csn.ul.ie>
+Subject: [patch 32/35] mm: fix handling of pagesets for downed cpus
+References: <20090701001356.007288418@mini.kroah.org>
+Content-Disposition: inline; filename=mm-fix-handling-of-pagesets-for-downed-cpus.patch
+Content-Length: 1836
+Lines: 58
+
+2.6.29-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Dimitri Sivanich <sivanich@sgi.com>
+
+commit 364df0ebfbbb1330bfc6ca159f4d6020efc15a12 upstream.
+
+After downing/upping a cpu, an attempt to set
+/proc/sys/vm/percpu_pagelist_fraction results in an oops in
+percpu_pagelist_fraction_sysctl_handler().
+
+If a processor is downed then we need to set the pageset pointer back to
+the boot pageset.
+
+Updates of the high water marks should not access pagesets of unpopulated
+zones (those pointer go to the boot pagesets which would be no longer
+functional if their size would be increased beyond zero).
+
+Signed-off-by: Dimitri Sivanich <sivanich@sgi.com>
+Signed-off-by: Christoph Lameter <cl@linux-foundation.org>
+Reviewed-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
+Cc: Nick Piggin <nickpiggin@yahoo.com.au>
+Cc: Mel Gorman <mel@csn.ul.ie>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ mm/page_alloc.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/mm/page_alloc.c
++++ b/mm/page_alloc.c
+@@ -2804,7 +2804,7 @@ bad:
+ if (dzone == zone)
+ break;
+ kfree(zone_pcp(dzone, cpu));
+- zone_pcp(dzone, cpu) = NULL;
++ zone_pcp(dzone, cpu) = &boot_pageset[cpu];
+ }
+ return -ENOMEM;
+ }
+@@ -2819,7 +2819,7 @@ static inline void free_zone_pagesets(in
+ /* Free per_cpu_pageset if it is slab allocated */
+ if (pset != &boot_pageset[cpu])
+ kfree(pset);
+- zone_pcp(zone, cpu) = NULL;
++ zone_pcp(zone, cpu) = &boot_pageset[cpu];
+ }
+ }
+
+@@ -4494,6 +4494,8 @@ int percpu_pagelist_fraction_sysctl_hand
+ if (!write || (ret == -EINVAL))
+ return ret;
+ for_each_zone(zone) {
++ if (!populated_zone(zone))
++ continue;
+ for_each_online_cpu(cpu) {
+ unsigned long high;
+ high = zone->present_pages / percpu_pagelist_fraction;
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:15:54 2009
+Message-Id: <20090701001554.157008086@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:14:29 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Mikulas Patocka <mpatocka@redhat.com>,
+ Alasdair G Kergon <agk@redhat.com>
+Subject: [patch 33/35] dm mpath: validate table argument count
+References: <20090701001356.007288418@mini.kroah.org>
+Content-Disposition: inline; filename=dm-mpath-validate-table-argument-count.patch
+Content-Length: 1060
+Lines: 36
+
+2.6.29-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+commit 0e0497c0c017664994819f4602dc07fd95896c52 upstream.
+
+The parser reads the argument count as a number but doesn't check that
+sufficient arguments are supplied. This command triggers the bug:
+
+dmsetup create mpath --table "0 `blockdev --getsize /dev/mapper/cr0`
+ multipath 0 0 2 1 round-robin 1000 0 1 1 /dev/mapper/cr0
+ round-robin 0 1 1 /dev/mapper/cr1 1000"
+kernel BUG at drivers/md/dm-mpath.c:530!
+
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Alasdair G Kergon <agk@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/dm-mpath.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/md/dm-mpath.c
++++ b/drivers/md/dm-mpath.c
+@@ -554,6 +554,12 @@ static int parse_path_selector(struct ar
+ return -EINVAL;
+ }
+
++ if (ps_argc > as->argc) {
++ dm_put_path_selector(pst);
++ ti->error = "not enough arguments for path selector";
++ return -EINVAL;
++ }
++
+ r = pst->create(&pg->ps, ps_argc, as->argv);
+ if (r) {
+ dm_put_path_selector(pst);
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:15:54 2009
+Message-Id: <20090701001554.377000070@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:14:30 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Mikulas Patocka <mpatocka@redhat.com>,
+ Alasdair G Kergon <agk@redhat.com>
+Subject: [patch 34/35] dm mpath: validate hw_handler argument count
+References: <20090701001356.007288418@mini.kroah.org>
+Content-Disposition: inline; filename=dm-mpath-validate-hw_handler-argument-count.patch
+Content-Length: 804
+Lines: 29
+
+2.6.29-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+commit e094f4f15f5169526c7200b9bde44b900548a81e upstream.
+
+Fix arg count parsing error in hw handlers.
+
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Alasdair G Kergon <agk@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/dm-mpath.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/md/dm-mpath.c
++++ b/drivers/md/dm-mpath.c
+@@ -706,6 +706,11 @@ static int parse_hw_handler(struct arg_s
+ if (!hw_argc)
+ return 0;
+
++ if (hw_argc > as->argc) {
++ ti->error = "not enough arguments for hardware handler";
++ return -EINVAL;
++ }
++
+ m->hw_handler_name = kstrdup(shift(as), GFP_KERNEL);
+ request_module("scsi_dh_%s", m->hw_handler_name);
+ if (scsi_dh_handler_exist(m->hw_handler_name) == 0) {
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:15:54 2009
+Message-Id: <20090701001554.551074711@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:14:31 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Milan Broz <mbroz@redhat.com>,
+ Alasdair G Kergon <agk@redhat.com>
+Subject: [patch 35/35] dm: sysfs skip output when device is being destroyed
+References: <20090701001356.007288418@mini.kroah.org>
+Content-Disposition: inline; filename=dm-sysfs-skip-output-when-device-is-being-destroyed.patch
+Content-Length: 749
+Lines: 32
+
+2.6.29-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Milan Broz <mbroz@redhat.com>
+
+commit 4d89b7b4e4726893453d0fb4ddbb5b3e16353994 upstream.
+
+Do not process sysfs attributes when device is being destroyed.
+
+Otherwise code can cause
+ BUG_ON(test_bit(DMF_FREEING, &md->flags));
+in dm_put() call.
+
+Signed-off-by: Milan Broz <mbroz@redhat.com>
+Signed-off-by: Alasdair G Kergon <agk@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/dm.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/md/dm.c
++++ b/drivers/md/dm.c
+@@ -1728,6 +1728,10 @@ struct mapped_device *dm_get_from_kobjec
+ if (&md->kobj != kobj)
+ return NULL;
+
++ if (test_bit(DMF_FREEING, &md->flags) ||
++ test_bit(DMF_DELETING, &md->flags))
++ return NULL;
++
+ dm_get(md);
+ return md;
+ }
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:15:48 2009
+Message-Id: <20090701001356.007288418@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:13:56 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk
+Subject: [patch 00/35] 2.6.29-stable review
+Content-Length: 2680
+Lines: 66
+
+
+This is the start of the stable review cycle for the 2.6.29.6 release.
+
+This is going to be the last of the .29 kernel series releases, barring
+anything major happening.
+
+There are 35 patches in this series, all will be posted as a response to
+this one. If anyone has any issues with these being applied, please let
+us know. If anyone is a maintainer of the proper subsystem, and wants
+to add a Signed-off-by: line to the patch, please respond with it.
+
+These patches are sent out with a number of different people on the Cc:
+line. If you wish to be a reviewer, please email stable@kernel.org to
+add your name to the list. If you want to be off the reviewer list,
+also email us.
+
+Responses should be made by Friday, Jul 3, 00:00:00 2009 UTC.
+Anything received after that time might be too late.
+
+The whole patch series can be found in one patch at:
+ kernel.org/pub/linux/kernel/v2.6/stable-review/patch-2.6.29.6-rc1.gz
+and the diffstat can be found below.
+
+
+thanks,
+
+greg k-h
+
+
+ Makefile | 2 +-
+ arch/x86/kernel/cpu/amd.c | 4 +-
+ arch/x86/kernel/reboot.c | 9 ++
+ arch/x86/kernel/setup.c | 15 +---
+ drivers/block/floppy.c | 8 ++
+ drivers/char/moxa.c | 7 ++-
+ drivers/char/mxser.c | 2 +-
+ drivers/char/pcmcia/cm4000_cs.c | 3 +-
+ drivers/char/vt_ioctl.c | 3 +-
+ drivers/firmware/memmap.c | 16 ++--
+ drivers/infiniband/hw/mlx4/qp.c | 4 +
+ drivers/input/keyboard/atkbd.c | 169 +++++++++++++++++++++----------------
+ drivers/isdn/hisax/hfc_pci.c | 41 +++++++---
+ drivers/isdn/hisax/hisax.h | 2 +-
+ drivers/md/dm-mpath.c | 11 +++
+ drivers/md/dm.c | 4 +
+ drivers/md/raid5.c | 1 +
+ drivers/net/bonding/bond_sysfs.c | 1 +
+ drivers/net/r8169.c | 11 +--
+ drivers/parport/parport_pc.c | 34 ++++++--
+ drivers/parport/parport_serial.c | 30 ++++++-
+ drivers/pci/pci.c | 7 +-
+ drivers/pci/pcie/aspm.c | 4 +
+ drivers/scsi/qla2xxx/qla_dbg.c | 2 +-
+ drivers/serial/8250.c | 15 ++++
+ drivers/usb/class/usbtmc.c | 6 ++
+ drivers/video/atmel_lcdfb.c | 10 +--
+ fs/fs-writeback.c | 2 -
+ fs/jbd/commit.c | 6 +-
+ include/linux/firmware-map.h | 12 +--
+ include/linux/mlx4/qp.h | 1 +
+ lib/Kconfig.debug | 2 +-
+ mm/page_alloc.c | 6 +-
+ net/mac80211/rc80211_minstrel.c | 2 +-
+ sound/core/seq/seq_midi_event.c | 8 +-
+ sound/pci/ca0106/ca0106_mixer.c | 6 ++
+ 36 files changed, 307 insertions(+), 159 deletions(-)
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
