--- /dev/null
+From greg@quad.kroah.org Thu Apr 27 17:13:22 2006
+Message-Id: <20060428001226.204293000@quad.kroah.org>
+User-Agent: quilt/0.44-1
+Date: Thu, 27 Apr 2006 17:12:26 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ torvalds@osdl.org,
+ akpm@osdl.org,
+ alan@lxorguk.ukuu.org.uk
+Subject: [patch 00/24] -stable review
+Content-Length: 734
+Lines: 17
+
+This is the start of the stable review cycle for the 2.6.16.12 release.
+There are 24 patches in this series, all will be posted as a response to
+this one. If anyone has any issues with these being applied, please let
+us know. If anyone is a maintainer of the proper subsystem, and wants
+to add a signed-off-by: line to the patch, please respond with it.
+
+These patches are sent out with a number of different people on the Cc:
+line. If you wish to be a reviewer, please email stable@kernel.org to
+add your name to the list. If you want to be off the reviewer list,
+also email us.
+
+Responses should be made by Sunday, April 30 00:00:00 UTC. Anything
+received after that time, might be too late.
+
+thanks,
+
+the -stable release team
+
+From greg@quad.kroah.org Thu Apr 27 17:13:22 2006
+Message-Id: <20060428001322.190063000@quad.kroah.org>
+References: <20060428001226.204293000@quad.kroah.org>
+User-Agent: quilt/0.44-1
+Date: Thu, 27 Apr 2006 17:12:27 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ git-commits-head@vger.kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ torvalds@osdl.org,
+ akpm@osdl.org,
+ alan@lxorguk.ukuu.org.uk,
+ Arnaud MAZIN <arnaud.mazin@gmail.com>,
+ Stelian Pop <stelian@poppies.net>,
+ Greg Kroah-Hartman <gregkh@suse.de>
+Subject: [patch 01/24] sonypi: correct detection of new ICH7-based laptops
+Content-Disposition: inline; filename=sonypi-correct-detection-of-new-ich7-based-laptops.patch
+Content-Length: 1132
+Lines: 34
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Arnaud MAZIN <arnaud.mazin@gmail.com>
+
+[PATCH] sonypi: correct detection of new ICH7-based laptops
+
+Add a test to detect the ICH7 based Core Duo SONY laptops (such as the SZ1)
+as type3 models.
+
+Signed-off-by: Arnaud MAZIN <arnaud.mazin@gmail.com>
+Acked-by: Stelian Pop <stelian@poppies.net>
+Signed-off-by: Andrew Morton <akpm@osdl.org>
+Signed-off-by: Linus Torvalds <torvalds@osdl.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/char/sonypi.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- linux-2.6.16.11.orig/drivers/char/sonypi.c
++++ linux-2.6.16.11/drivers/char/sonypi.c
+@@ -1341,6 +1341,9 @@ static int __devinit sonypi_probe(struct
+ else if ((pcidev = pci_get_device(PCI_VENDOR_ID_INTEL,
+ PCI_DEVICE_ID_INTEL_ICH6_1, NULL)))
+ sonypi_device.model = SONYPI_DEVICE_MODEL_TYPE3;
++ else if ((pcidev = pci_get_device(PCI_VENDOR_ID_INTEL,
++ PCI_DEVICE_ID_INTEL_ICH7_1, NULL)))
++ sonypi_device.model = SONYPI_DEVICE_MODEL_TYPE3;
+ else
+ sonypi_device.model = SONYPI_DEVICE_MODEL_TYPE2;
+
+
+--
+
+From greg@quad.kroah.org Thu Apr 27 17:13:22 2006
+Message-Id: <20060428001322.331437000@quad.kroah.org>
+References: <20060428001226.204293000@quad.kroah.org>
+User-Agent: quilt/0.44-1
+Date: Thu, 27 Apr 2006 17:12:28 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ git-commits-head@vger.kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ torvalds@osdl.org,
+ akpm@osdl.org,
+ alan@lxorguk.ukuu.org.uk,
+ Thayumanavar Sachithanantham <thayumk@gmail.com>,
+ Greg Kroah-Hartman <gregkh@suse.de>
+Subject: [patch 02/24] cs5535_gpio.c: call cdev_del() during module_exit to unmap kobject references and other cleanups
+Content-Disposition: inline; filename=cs5535_gpio.c-call-cdev_del-during-module_exit-to-unmap-kobject-references-and-other-cleanups.patch
+Content-Length: 1422
+Lines: 41
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Thayumanavar Sachithanantham <thayumk@gmail.com>
+
+[PATCH] cs5535_gpio.c: call cdev_del() during module_exit to unmap kobject references and other cleanups
+
+During module unloading, cdev_del() must be called to unmap cdev related
+kobject references and other cleanups(such as inode->i_cdev being set to
+NULL) which prevents the OOPS upon subsequent loading, usage and unloading
+of modules(as seen in the mail thread
+http://marc.theaimsgroup.com/?l=linux-kernel&m=114533640609018&w=2).
+
+Also, remove unneeded test of gpio_base.
+
+Signed-off-by: Thayumanavar Sachithanantham <thayumk@gmail.com>
+Signed-off-by: Andrew Morton <akpm@osdl.org>
+Signed-off-by: Linus Torvalds <torvalds@osdl.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/char/cs5535_gpio.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- linux-2.6.16.11.orig/drivers/char/cs5535_gpio.c
++++ linux-2.6.16.11/drivers/char/cs5535_gpio.c
+@@ -241,9 +241,10 @@ static int __init cs5535_gpio_init(void)
+ static void __exit cs5535_gpio_cleanup(void)
+ {
+ dev_t dev_id = MKDEV(major, 0);
++
++ cdev_del(&cs5535_gpio_cdev);
+ unregister_chrdev_region(dev_id, CS5535_GPIO_COUNT);
+- if (gpio_base != 0)
+- release_region(gpio_base, CS5535_GPIO_SIZE);
++ release_region(gpio_base, CS5535_GPIO_SIZE);
+ }
+
+ module_init(cs5535_gpio_init);
+
+--
+
+From greg@quad.kroah.org Thu Apr 27 17:13:22 2006
+Message-Id: <20060428001322.474436000@quad.kroah.org>
+References: <20060428001226.204293000@quad.kroah.org>
+User-Agent: quilt/0.44-1
+Date: Thu, 27 Apr 2006 17:12:29 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ torvalds@osdl.org,
+ akpm@osdl.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jason Baron <jbaron@redhat.com>,
+ Al Viro <viro@zeniv.linux.org.uk>,
+ Greg Kroah-Hartman <gregkh@suse.de>
+Subject: [patch 03/24] make vm86 call audit_syscall_exit
+Content-Disposition: inline; filename=make-vm86-call-audit_syscall_exit.patch
+Content-Length: 3573
+Lines: 106
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+hi,
+
+The motivation behind the patch below was to address messages in
+/var/log/messages such as:
+
+Jan 31 10:54:15 mets kernel: audit(:0): major=252 name_count=0: freeing
+multiple contexts (1)
+Jan 31 10:54:15 mets kernel: audit(:0): major=113 name_count=0: freeing
+multiple contexts (2)
+
+I can reproduce by running 'get-edid' from:
+http://john.fremlin.de/programs/linux/read-edid/.
+
+These messages come about in the log b/c the vm86 calls do not exit via
+the normal system call exit paths and thus do not call
+'audit_syscall_exit'. The next system call will then free the context for
+itself and for the vm86 context, thus generating the above messages. This
+patch addresses the issue by simply adding a call to 'audit_syscall_exit'
+from the vm86 code.
+
+Besides fixing the above error messages the patch also now allows vm86
+system calls to become auditable. This is useful since strace does not
+appear to properly record the return values from sys_vm86.
+
+I think this patch is also a step in the right direction in terms of
+cleaning up some core auditing code. If we can correct any other paths
+that do not properly call the audit exit and entries points, then we can
+also eliminate the notion of context chaining.
+
+I've tested this patch by verifying that the log messages no longer
+appear, and that the audit records for sys_vm86 appear to be correct.
+Also, 'read_edid' produces itentical output.
+
+thanks,
+
+-Jason
+
+Signed-off-by: Jason Baron <jbaron@redhat.com>
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+---
+ arch/i386/kernel/vm86.c | 12 ++++++++++--
+ kernel/auditsc.c | 5 -----
+ 2 files changed, 10 insertions(+), 7 deletions(-)
+
+--- linux-2.6.16.11.orig/arch/i386/kernel/vm86.c
++++ linux-2.6.16.11/arch/i386/kernel/vm86.c
+@@ -43,6 +43,7 @@
+ #include <linux/smp_lock.h>
+ #include <linux/highmem.h>
+ #include <linux/ptrace.h>
++#include <linux/audit.h>
+
+ #include <asm/uaccess.h>
+ #include <asm/io.h>
+@@ -252,6 +253,7 @@ out:
+ static void do_sys_vm86(struct kernel_vm86_struct *info, struct task_struct *tsk)
+ {
+ struct tss_struct *tss;
++ long eax;
+ /*
+ * make sure the vm86() system call doesn't try to do anything silly
+ */
+@@ -305,13 +307,19 @@ static void do_sys_vm86(struct kernel_vm
+ tsk->thread.screen_bitmap = info->screen_bitmap;
+ if (info->flags & VM86_SCREEN_BITMAP)
+ mark_screen_rdonly(tsk->mm);
++ __asm__ __volatile__("xorl %eax,%eax; movl %eax,%fs; movl %eax,%gs\n\t");
++ __asm__ __volatile__("movl %%eax, %0\n" :"=r"(eax));
++
++ /*call audit_syscall_exit since we do not exit via the normal paths */
++ if (unlikely(current->audit_context))
++ audit_syscall_exit(current, AUDITSC_RESULT(eax), eax);
++
+ __asm__ __volatile__(
+- "xorl %%eax,%%eax; movl %%eax,%%fs; movl %%eax,%%gs\n\t"
+ "movl %0,%%esp\n\t"
+ "movl %1,%%ebp\n\t"
+ "jmp resume_userspace"
+ : /* no outputs */
+- :"r" (&info->regs), "r" (task_thread_info(tsk)) : "ax");
++ :"r" (&info->regs), "r" (task_thread_info(tsk)));
+ /* we never return here */
+ }
+
+--- linux-2.6.16.11.orig/kernel/auditsc.c
++++ linux-2.6.16.11/kernel/auditsc.c
+@@ -966,11 +966,6 @@ void audit_syscall_entry(struct task_str
+ if (context->in_syscall) {
+ struct audit_context *newctx;
+
+-#if defined(__NR_vm86) && defined(__NR_vm86old)
+- /* vm86 mode should only be entered once */
+- if (major == __NR_vm86 || major == __NR_vm86old)
+- return;
+-#endif
+ #if AUDIT_DEBUG
+ printk(KERN_ERR
+ "audit(:%d) pid=%d in syscall=%d;"
+
+--
+
+From greg@quad.kroah.org Thu Apr 27 17:13:22 2006
+Message-Id: <20060428001322.615019000@quad.kroah.org>
+References: <20060428001226.204293000@quad.kroah.org>
+User-Agent: quilt/0.44-1
+Date: Thu, 27 Apr 2006 17:12:30 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ torvalds@osdl.org,
+ akpm@osdl.org,
+ alan@lxorguk.ukuu.org.uk,
+ brian.b@hp.com,
+ Andi Kleen <ak@suse.de>,
+ Greg Kroah-Hartman <gregkh@suse.de>
+Subject: [patch 04/24] x86_64: Pass -32 to the assembler when compiling the 32bit vsyscall pages
+Content-Disposition: inline; filename=x86_64-pass-32-to-the-assembler-when-compiling-the-32bit-vsyscall-pages.patch
+Content-Length: 1070
+Lines: 35
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+This quietens warnings and actually fixes a bug. The unwind tables would
+come out wrong without -32, causing pthread cancellation during them
+to crash in the gcc runtime.
+
+The problem seems to only happen with newer binutils
+(it doesn't happen with 2.16.91.0.2 but happens wit 2.16.91.0.5)
+
+Thanks to Brian Baker @ HP for test case and initial analysis.
+
+Cc: brian.b@hp.com
+
+Signed-off-by: Andi Kleen <ak@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+
+---
+ arch/x86_64/ia32/Makefile | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- linux-2.6.16.11.orig/arch/x86_64/ia32/Makefile
++++ linux-2.6.16.11/arch/x86_64/ia32/Makefile
+@@ -27,5 +27,5 @@ $(obj)/vsyscall-sysenter.so $(obj)/vsysc
+ $(obj)/vsyscall-%.so: $(src)/vsyscall.lds $(obj)/vsyscall-%.o FORCE
+ $(call if_changed,syscall)
+
+-AFLAGS_vsyscall-sysenter.o = -m32
+-AFLAGS_vsyscall-syscall.o = -m32
++AFLAGS_vsyscall-sysenter.o = -m32 -Wa,-32
++AFLAGS_vsyscall-syscall.o = -m32 -Wa,-32
+
+--
+
+From greg@quad.kroah.org Thu Apr 27 17:13:22 2006
+Message-Id: <20060428001322.752580000@quad.kroah.org>
+References: <20060428001226.204293000@quad.kroah.org>
+User-Agent: quilt/0.44-1
+Date: Thu, 27 Apr 2006 17:12:31 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ torvalds@osdl.org,
+ akpm@osdl.org,
+ alan@lxorguk.ukuu.org.uk,
+ mikew@google.com,
+ Andi Kleen <ak@suse.de>,
+ Greg Kroah-Hartman <gregkh@suse.de>
+Subject: [patch 05/24] x86_64: Fix a race in the free_iommu path.
+Content-Disposition: inline; filename=x86_64-fix-a-race-in-the-free_iommu-path.patch
+Content-Length: 1308
+Lines: 40
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Mike Waychison <mikew@google.com>
+
+We do this by removing a micro-optimization that tries to avoid grabbing
+the iommu_bitmap_lock spinlock and using a bus-locked operation.
+
+This still races with other simultaneous alloc_iommu or free_iommu(size
+> 1) which both use bus-unlocked operations.
+
+The end result of this race is eventually ending
+up with an iommu_gart_bitmap that has bits errornously set all over,
+making large contiguous iommu space allocations fail with 'PCI-DMA:
+Out of IOMMU space'.
+
+Signed-off-by: Mike Waychison <mikew@google.com>
+Signed-off-by: Andi Kleen <ak@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86_64/kernel/pci-gart.c | 4 ----
+ 1 file changed, 4 deletions(-)
+
+--- linux-2.6.16.11.orig/arch/x86_64/kernel/pci-gart.c
++++ linux-2.6.16.11/arch/x86_64/kernel/pci-gart.c
+@@ -114,10 +114,6 @@ static unsigned long alloc_iommu(int siz
+ static void free_iommu(unsigned long offset, int size)
+ {
+ unsigned long flags;
+- if (size == 1) {
+- clear_bit(offset, iommu_gart_bitmap);
+- return;
+- }
+ spin_lock_irqsave(&iommu_bitmap_lock, flags);
+ __clear_bit_string(iommu_gart_bitmap, offset, size);
+ spin_unlock_irqrestore(&iommu_bitmap_lock, flags);
+
+--
+
+From greg@quad.kroah.org Thu Apr 27 17:13:23 2006
+Message-Id: <20060428001322.901074000@quad.kroah.org>
+References: <20060428001226.204293000@quad.kroah.org>
+User-Agent: quilt/0.44-1
+Date: Thu, 27 Apr 2006 17:12:32 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ torvalds@osdl.org,
+ akpm@osdl.org,
+ alan@lxorguk.ukuu.org.uk,
+ Eric Sesterhenn <snakebyte@gmx.de>,
+ smurf@smurf.noris.de,
+ Adrian Bunk <bunk@stusta.de>,
+ Greg Kroah-Hartman <gregkh@suse.de>
+Subject: [patch 06/24] USB: fix array overrun in drivers/usb/serial/option.c
+Content-Disposition: inline; filename=usb-fix-array-overrun-in-drivers-usb-serial-option.c.patch
+Content-Length: 1404
+Lines: 40
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Eric Sesterhenn <snakebyte@gmx.de>
+
+since the arrays are declared as in_urbs[N_IN_URB]
+and out_urbs[N_OUT_URB] both for loops, go one
+over the end of the array. This fixes coverity id #555
+
+This patch was already included in Linus' tree.
+
+Signed-off-by: Eric Sesterhenn <snakebyte@gmx.de>
+Signed-off-by: Adrian Bunk <bunk@stusta.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/serial/option.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- linux-2.6.16.11.orig/drivers/usb/serial/option.c
++++ linux-2.6.16.11/drivers/usb/serial/option.c
+@@ -582,14 +582,14 @@ static void option_setup_urbs(struct usb
+ portdata = usb_get_serial_port_data(port);
+
+ /* Do indat endpoints first */
+- for (j = 0; j <= N_IN_URB; ++j) {
++ for (j = 0; j < N_IN_URB; ++j) {
+ portdata->in_urbs[j] = option_setup_urb (serial,
+ port->bulk_in_endpointAddress, USB_DIR_IN, port,
+ portdata->in_buffer[j], IN_BUFLEN, option_indat_callback);
+ }
+
+ /* outdat endpoints */
+- for (j = 0; j <= N_OUT_URB; ++j) {
++ for (j = 0; j < N_OUT_URB; ++j) {
+ portdata->out_urbs[j] = option_setup_urb (serial,
+ port->bulk_out_endpointAddress, USB_DIR_OUT, port,
+ portdata->out_buffer[j], OUT_BUFLEN, option_outdat_callback);
+
+--
+
+From greg@quad.kroah.org Thu Apr 27 17:13:23 2006
+Message-Id: <20060428001323.038996000@quad.kroah.org>
+References: <20060428001226.204293000@quad.kroah.org>
+User-Agent: quilt/0.44-1
+Date: Thu, 27 Apr 2006 17:12:33 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ dsd@gentoo.org,
+ mm-commits@vger.kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ torvalds@osdl.org,
+ akpm@osdl.org,
+ alan@lxorguk.ukuu.org.uk,
+ Greg Kroah-Hartman <gregkh@suse.de>
+Subject: [patch 07/24] tipar oops fix
+Content-Disposition: inline; filename=tipar-oops-fix.patch
+Content-Length: 1036
+Lines: 33
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Daniel Drake <dsd@gentoo.org>
+
+If compiled into the kernel, parport_register_driver() is called before the
+parport driver has been initalised.
+
+This means that it is expected that tp_count is 0 after the
+parport_register_driver() call() - tipar's attach function will not be
+called until later during bootup.
+
+Signed-off-by: Daniel Drake <dsd@gentoo.org>
+Signed-off-by: Andrew Morton <akpm@osdl.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/char/tipar.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- linux-2.6.16.11.orig/drivers/char/tipar.c
++++ linux-2.6.16.11/drivers/char/tipar.c
+@@ -515,7 +515,7 @@ tipar_init_module(void)
+ err = PTR_ERR(tipar_class);
+ goto out_chrdev;
+ }
+- if (parport_register_driver(&tipar_driver) || tp_count == 0) {
++ if (parport_register_driver(&tipar_driver)) {
+ printk(KERN_ERR "tipar: unable to register with parport\n");
+ err = -EIO;
+ goto out_class;
+
+--
+
+From greg@quad.kroah.org Thu Apr 27 17:13:23 2006
+Message-Id: <20060428001323.183224000@quad.kroah.org>
+References: <20060428001226.204293000@quad.kroah.org>
+User-Agent: quilt/0.44-1
+Date: Thu, 27 Apr 2006 17:12:34 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ torvalds@osdl.org,
+ akpm@osdl.org,
+ alan@lxorguk.ukuu.org.uk,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Greg Kroah-Hartman <gregkh@suse.de>
+Subject: [patch 08/24] get_dvb_firmware: download nxt2002 firmware from new driver location
+Content-Disposition: inline; filename=get_dvb_firmware-download-nxt2002-firmware-from-new-driver-location.patch
+Content-Length: 1403
+Lines: 44
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Michael Krufky <mkrufky@linuxtv.org>
+
+BBTI has updated their driver, and removed the old one from their website.
+This patch updates the get_dvb_firmware script to download the firmware
+from the new driver location.
+
+Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+
+---
+ Documentation/dvb/get_dvb_firmware | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- linux-2.6.16.11.orig/Documentation/dvb/get_dvb_firmware
++++ linux-2.6.16.11/Documentation/dvb/get_dvb_firmware
+@@ -240,9 +240,9 @@ sub dibusb {
+ }
+
+ sub nxt2002 {
+- my $sourcefile = "Broadband4PC_4_2_11.zip";
++ my $sourcefile = "Technisat_DVB-PC_4_4_COMPACT.zip";
+ my $url = "http://www.bbti.us/download/windows/$sourcefile";
+- my $hash = "c6d2ea47a8f456d887ada0cfb718ff2a";
++ my $hash = "476befae8c7c1bb9648954060b1eec1f";
+ my $outfile = "dvb-fe-nxt2002.fw";
+ my $tmpdir = tempdir(DIR => "/tmp", CLEANUP => 1);
+
+@@ -250,8 +250,8 @@ sub nxt2002 {
+
+ wgetfile($sourcefile, $url);
+ unzip($sourcefile, $tmpdir);
+- verify("$tmpdir/SkyNETU.sys", $hash);
+- extract("$tmpdir/SkyNETU.sys", 375832, 5908, $outfile);
++ verify("$tmpdir/SkyNET.sys", $hash);
++ extract("$tmpdir/SkyNET.sys", 331624, 5908, $outfile);
+
+ $outfile;
+ }
+
+--
+
+From greg@quad.kroah.org Thu Apr 27 17:13:23 2006
+Message-Id: <20060428001323.317460000@quad.kroah.org>
+References: <20060428001226.204293000@quad.kroah.org>
+User-Agent: quilt/0.44-1
+Date: Thu, 27 Apr 2006 17:12:35 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ torvalds@osdl.org,
+ akpm@osdl.org,
+ alan@lxorguk.ukuu.org.uk,
+ norbert@tretkowski.de,
+ Greg Kroah-Hartman <gregkh@suse.de>
+Subject: [patch 09/24] for_each_possible_cpu
+Content-Disposition: inline; filename=for_each_possible_cpu.patch
+Content-Length: 863
+Lines: 29
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Andrew Morton <akpm@osdl.org>
+
+Backport for_each_possible_cpu() into 2.6.16. Fixes the alpha build, and any
+future occurrences.
+
+
+Signed-off-by: Andrew Morton <akpm@osdl.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ include/linux/cpumask.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- linux-2.6.16.11.orig/include/linux/cpumask.h
++++ linux-2.6.16.11/include/linux/cpumask.h
+@@ -408,6 +408,7 @@ extern cpumask_t cpu_present_map;
+ })
+
+ #define for_each_cpu(cpu) for_each_cpu_mask((cpu), cpu_possible_map)
++#define for_each_possible_cpu(cpu) for_each_cpu_mask((cpu), cpu_possible_map)
+ #define for_each_online_cpu(cpu) for_each_cpu_mask((cpu), cpu_online_map)
+ #define for_each_present_cpu(cpu) for_each_cpu_mask((cpu), cpu_present_map)
+
+
+--
+
+From greg@quad.kroah.org Thu Apr 27 17:13:23 2006
+Message-Id: <20060428001323.459743000@quad.kroah.org>
+References: <20060428001226.204293000@quad.kroah.org>
+User-Agent: quilt/0.44-1
+Date: Thu, 27 Apr 2006 17:12:36 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ torvalds@osdl.org,
+ akpm@osdl.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jose Alberto Reguero <jareguero@telefonica.net>,
+ Mauro Carvalho Chehab <mchehab@infradead.org>,
+ Hans Verkuil <hverkuil@xs4all.nl>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Greg Kroah-Hartman <gregkh@suse.de>
+Subject: [patch 10/24] fix saa7129 support in saa7127 module for pvr350 tv out
+Content-Disposition: inline; filename=fix-saa7129-support-in-saa7127-module-for-pvr350-tv-out.patch
+Content-Length: 1013
+Lines: 32
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Jose Alberto Reguero <jareguero@telefonica.net>
+
+This patch fixes tv-out support for the newer model of
+the pvr350, which has a saa7129 instead of a saa7127
+video encoder.
+
+Signed-off-by: Jose Alberto Reguero <jareguero@telefonica.net>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
+Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
+Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+
+---
+ drivers/media/video/saa7127.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- linux-2.6.16.11.orig/drivers/media/video/saa7127.c
++++ linux-2.6.16.11/drivers/media/video/saa7127.c
+@@ -141,6 +141,7 @@ struct i2c_reg_value {
+ static const struct i2c_reg_value saa7129_init_config_extra[] = {
+ { SAA7127_REG_OUTPUT_PORT_CONTROL, 0x38 },
+ { SAA7127_REG_VTRIG, 0xfa },
++ { 0, 0 }
+ };
+
+ static const struct i2c_reg_value saa7127_init_config_common[] = {
+
+--
+
+From greg@quad.kroah.org Thu Apr 27 17:13:23 2006
+Message-Id: <20060428001323.610742000@quad.kroah.org>
+References: <20060428001226.204293000@quad.kroah.org>
+User-Agent: quilt/0.44-1
+Date: Thu, 27 Apr 2006 17:12:37 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ torvalds@osdl.org,
+ akpm@osdl.org,
+ alan@lxorguk.ukuu.org.uk,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Greg Kroah-Hartman <gregkh@suse.de>
+Subject: [patch 11/24] cxusb-bluebird: bug-fix: power down corrupts frontend
+Content-Disposition: inline; filename=cxusb-bluebird-bug-fix-power-down-corrupts-frontend.patch
+Content-Length: 2736
+Lines: 77
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Michael Krufky <mkrufky@linuxtv.org>
+
+This patch prevents a bug where the frontend is unable to tune after waking
+from powered down state. Now, the device remains powered on until it is
+disconnected, just like the windows driver. It seems that the bluebird
+firmware is unable to successfully handle tuning after a powered down state.
+
+This patch fixes all of the FusionHDTV Bluebird USB2 devices. The Medion
+MD95700 will still behave as before, since it was unaffected by this bug.
+
+Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+
+---
+ drivers/media/dvb/dvb-usb/cxusb.c | 17 +++++++++++++----
+ 1 file changed, 13 insertions(+), 4 deletions(-)
+
+--- linux-2.6.16.11.orig/drivers/media/dvb/dvb-usb/cxusb.c
++++ linux-2.6.16.11/drivers/media/dvb/dvb-usb/cxusb.c
+@@ -149,6 +149,15 @@ static int cxusb_power_ctrl(struct dvb_u
+ return cxusb_ctrl_msg(d, CMD_POWER_OFF, &b, 1, NULL, 0);
+ }
+
++static int cxusb_bluebird_power_ctrl(struct dvb_usb_device *d, int onoff)
++{
++ u8 b = 0;
++ if (onoff)
++ return cxusb_ctrl_msg(d, CMD_POWER_ON, &b, 1, NULL, 0);
++ else
++ return 0;
++}
++
+ static int cxusb_streaming_ctrl(struct dvb_usb_device *d, int onoff)
+ {
+ u8 buf[2] = { 0x03, 0x00 };
+@@ -505,7 +514,7 @@ static struct dvb_usb_properties cxusb_b
+ .size_of_priv = sizeof(struct cxusb_state),
+
+ .streaming_ctrl = cxusb_streaming_ctrl,
+- .power_ctrl = cxusb_power_ctrl,
++ .power_ctrl = cxusb_bluebird_power_ctrl,
+ .frontend_attach = cxusb_lgdt3303_frontend_attach,
+ .tuner_attach = cxusb_lgh064f_tuner_attach,
+
+@@ -545,7 +554,7 @@ static struct dvb_usb_properties cxusb_b
+ .size_of_priv = sizeof(struct cxusb_state),
+
+ .streaming_ctrl = cxusb_streaming_ctrl,
+- .power_ctrl = cxusb_power_ctrl,
++ .power_ctrl = cxusb_bluebird_power_ctrl,
+ .frontend_attach = cxusb_dee1601_frontend_attach,
+ .tuner_attach = cxusb_dee1601_tuner_attach,
+
+@@ -594,7 +603,7 @@ static struct dvb_usb_properties cxusb_b
+ .size_of_priv = sizeof(struct cxusb_state),
+
+ .streaming_ctrl = cxusb_streaming_ctrl,
+- .power_ctrl = cxusb_power_ctrl,
++ .power_ctrl = cxusb_bluebird_power_ctrl,
+ .frontend_attach = cxusb_mt352_frontend_attach,
+ .tuner_attach = cxusb_lgz201_tuner_attach,
+
+@@ -634,7 +643,7 @@ static struct dvb_usb_properties cxusb_b
+ .size_of_priv = sizeof(struct cxusb_state),
+
+ .streaming_ctrl = cxusb_streaming_ctrl,
+- .power_ctrl = cxusb_power_ctrl,
++ .power_ctrl = cxusb_bluebird_power_ctrl,
+ .frontend_attach = cxusb_mt352_frontend_attach,
+ .tuner_attach = cxusb_dtt7579_tuner_attach,
+
+
+--
+
+From greg@quad.kroah.org Thu Apr 27 17:13:23 2006
+Message-Id: <20060428001323.749218000@quad.kroah.org>
+References: <20060428001226.204293000@quad.kroah.org>
+User-Agent: quilt/0.44-1
+Date: Thu, 27 Apr 2006 17:12:38 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ torvalds@osdl.org,
+ akpm@osdl.org,
+ alan@lxorguk.ukuu.org.uk,
+ Alasdair G Kergon <agk@redhat.com>,
+ Greg Kroah-Hartman <gregkh@suse.de>
+Subject: [patch 12/24] dm snapshot: fix kcopyd destructor
+Content-Disposition: inline; filename=dm-snapshot-fix-kcopyd-destructor.patch
+Content-Length: 3140
+Lines: 111
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Alasdair G Kergon <agk@redhat.com>
+
+Before removing a snapshot, wait for the completion of any kcopyd jobs using
+it.
+
+Do this by maintaining a count (nr_jobs) of how many outstanding jobs each
+kcopyd_client has.
+
+The snapshot destructor first unregisters the snapshot so that no new kcopyd
+jobs (created by writes to the origin) will reference that particular
+snapshot. kcopyd_client_destroy() is now run next to wait for the completion
+of any outstanding jobs before the snapshot exception structures (that those
+jobs reference) are freed.
+
+Signed-off-by: Alasdair G Kergon <agk@redhat.com>
+Signed-off-by: Andrew Morton <akpm@osdl.org>
+Signed-off-by: Linus Torvalds <torvalds@osdl.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/dm-snap.c | 6 +++++-
+ drivers/md/kcopyd.c | 17 ++++++++++++++++-
+ 2 files changed, 21 insertions(+), 2 deletions(-)
+
+--- linux-2.6.16.11.orig/drivers/md/dm-snap.c
++++ linux-2.6.16.11/drivers/md/dm-snap.c
+@@ -542,8 +542,12 @@ static void snapshot_dtr(struct dm_targe
+ {
+ struct dm_snapshot *s = (struct dm_snapshot *) ti->private;
+
++ /* Prevent further origin writes from using this snapshot. */
++ /* After this returns there can be no new kcopyd jobs. */
+ unregister_snapshot(s);
+
++ kcopyd_client_destroy(s->kcopyd_client);
++
+ exit_exception_table(&s->pending, pending_cache);
+ exit_exception_table(&s->complete, exception_cache);
+
+@@ -552,7 +556,7 @@ static void snapshot_dtr(struct dm_targe
+
+ dm_put_device(ti, s->origin);
+ dm_put_device(ti, s->cow);
+- kcopyd_client_destroy(s->kcopyd_client);
++
+ kfree(s);
+ }
+
+--- linux-2.6.16.11.orig/drivers/md/kcopyd.c
++++ linux-2.6.16.11/drivers/md/kcopyd.c
+@@ -44,6 +44,9 @@ struct kcopyd_client {
+ struct page_list *pages;
+ unsigned int nr_pages;
+ unsigned int nr_free_pages;
++
++ wait_queue_head_t destroyq;
++ atomic_t nr_jobs;
+ };
+
+ static struct page_list *alloc_pl(void)
+@@ -293,10 +296,15 @@ static int run_complete_job(struct kcopy
+ int read_err = job->read_err;
+ unsigned int write_err = job->write_err;
+ kcopyd_notify_fn fn = job->fn;
++ struct kcopyd_client *kc = job->kc;
+
+- kcopyd_put_pages(job->kc, job->pages);
++ kcopyd_put_pages(kc, job->pages);
+ mempool_free(job, _job_pool);
+ fn(read_err, write_err, context);
++
++ if (atomic_dec_and_test(&kc->nr_jobs))
++ wake_up(&kc->destroyq);
++
+ return 0;
+ }
+
+@@ -431,6 +439,7 @@ static void do_work(void *ignored)
+ */
+ static void dispatch_job(struct kcopyd_job *job)
+ {
++ atomic_inc(&job->kc->nr_jobs);
+ push(&_pages_jobs, job);
+ wake();
+ }
+@@ -670,6 +679,9 @@ int kcopyd_client_create(unsigned int nr
+ return r;
+ }
+
++ init_waitqueue_head(&kc->destroyq);
++ atomic_set(&kc->nr_jobs, 0);
++
+ client_add(kc);
+ *result = kc;
+ return 0;
+@@ -677,6 +689,9 @@ int kcopyd_client_create(unsigned int nr
+
+ void kcopyd_client_destroy(struct kcopyd_client *kc)
+ {
++ /* Wait for completion of all jobs submitted by this client. */
++ wait_event(kc->destroyq, !atomic_read(&kc->nr_jobs));
++
+ dm_io_put(kc->nr_pages);
+ client_free_pages(kc);
+ client_del(kc);
+
+--
+
+From greg@quad.kroah.org Thu Apr 27 17:13:24 2006
+Message-Id: <20060428001323.890281000@quad.kroah.org>
+References: <20060428001226.204293000@quad.kroah.org>
+User-Agent: quilt/0.44-1
+Date: Thu, 27 Apr 2006 17:12:39 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ torvalds@osdl.org,
+ akpm@osdl.org,
+ alan@lxorguk.ukuu.org.uk,
+ Junichi Nomura <j-nomura@ce.jp.nec.com>,
+ Alasdair G Kergon <agk@redhat.com>,
+ Greg Kroah-Hartman <gregkh@suse.de>
+Subject: [patch 13/24] dm flush queue EINTR
+Content-Disposition: inline; filename=dm-flush-queue-EINTR.patch
+Content-Length: 1248
+Lines: 41
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+If dm_suspend() is cancelled, bios already added to the deferred list need to
+be submitted. Otherwise they remain 'in limbo' until there's a dm_resume().
+
+Signed-off-by: Jun'ichi Nomura <j-nomura@ce.jp.nec.com>
+Signed-off-by: Alasdair G Kergon <agk@redhat.com>
+Signed-off-by: Andrew Morton <akpm@osdl.org>
+Signed-off-by: Linus Torvalds <torvalds@osdl.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/dm.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- linux-2.6.16.11.orig/drivers/md/dm.c
++++ linux-2.6.16.11/drivers/md/dm.c
+@@ -1098,6 +1098,7 @@ int dm_suspend(struct mapped_device *md,
+ {
+ struct dm_table *map = NULL;
+ DECLARE_WAITQUEUE(wait, current);
++ struct bio *def;
+ int r = -EINVAL;
+
+ down(&md->suspend_lock);
+@@ -1157,9 +1158,11 @@ int dm_suspend(struct mapped_device *md,
+ /* were we interrupted ? */
+ r = -EINTR;
+ if (atomic_read(&md->pending)) {
++ clear_bit(DMF_BLOCK_IO, &md->flags);
++ def = bio_list_get(&md->deferred);
++ __flush_deferred_io(md, def);
+ up_write(&md->io_lock);
+ unlock_fs(md);
+- clear_bit(DMF_BLOCK_IO, &md->flags);
+ goto out;
+ }
+ up_write(&md->io_lock);
+
+--
+
+From greg@quad.kroah.org Thu Apr 27 17:13:24 2006
+Message-Id: <20060428001324.028668000@quad.kroah.org>
+References: <20060428001226.204293000@quad.kroah.org>
+User-Agent: quilt/0.44-1
+Date: Thu, 27 Apr 2006 17:12:40 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ torvalds@osdl.org,
+ akpm@osdl.org,
+ alan@lxorguk.ukuu.org.uk,
+ Joe Korty <joe.korty@ccur.com>,
+ Greg Kroah-Hartman <gregkh@suse.de>
+Subject: [patch 14/24] Simplify proc/devices and fix early termination regression
+Content-Disposition: inline; filename=simplify-proc-devices-and-fix-early-termination-regression.patch
+Content-Length: 13788
+Lines: 537
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+Repair /proc/devices early-termination regression.
+
+2.6.16 broke /proc/devices. An application often gets an
+EOF before the end of data is reached, if that application
+uses a series of short read(2)s to access the data. I have
+used read buffers of varying sizes with varying degrees
+of unsuccess (larger sizes get further into the data than
+smaller sizes, following a simple pattern). It appears
+that the only safe way to get the data is to use a single
+read buffer larger than all the data in /proc/devices.
+
+The following example demonstates the problem:
+
+ # dd if=/proc/devices bs=1
+ Character devices:
+ 1 mem
+ 27+0 records in
+ 27+0 records out
+
+This patch is a backport of the fix recently accepted to
+Linus's tree:
+
+ commit 68eef3b4791572ecb70249c7fb145bb3742dd899
+ [PATCH] Simplify proc/devices and fix early termination regression
+
+It replaces the complex, state-machine algorithm introduced
+in 2.6.16 with a simple algorithm, modeled on the implementation
+of /proc/interrupts.
+
+[akpm@osdl.org: cleanups, simplifications]
+
+Signed-off-by: Joe Korty <joe.korty@ccur.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+
+---
+ block/genhd.c | 103 +++------------------------------
+ fs/char_dev.c | 87 +++-------------------------
+ fs/proc/proc_misc.c | 161 +++++++++++-----------------------------------------
+ include/linux/fs.h | 15 +---
+ 4 files changed, 61 insertions(+), 305 deletions(-)
+
+--- linux-2.6.16.11.orig/block/genhd.c
++++ linux-2.6.16.11/block/genhd.c
+@@ -16,8 +16,6 @@
+ #include <linux/kobj_map.h>
+ #include <linux/buffer_head.h>
+
+-#define MAX_PROBE_HASH 255 /* random */
+-
+ static struct subsystem block_subsys;
+
+ static DECLARE_MUTEX(block_subsys_sem);
+@@ -30,108 +28,29 @@ static struct blk_major_name {
+ struct blk_major_name *next;
+ int major;
+ char name[16];
+-} *major_names[MAX_PROBE_HASH];
++} *major_names[BLKDEV_MAJOR_HASH_SIZE];
+
+ /* index in the above - for now: assume no multimajor ranges */
+ static inline int major_to_index(int major)
+ {
+- return major % MAX_PROBE_HASH;
+-}
+-
+-struct blkdev_info {
+- int index;
+- struct blk_major_name *bd;
+-};
+-
+-/*
+- * iterate over a list of blkdev_info structures. allows
+- * the major_names array to be iterated over from outside this file
+- * must be called with the block_subsys_sem held
+- */
+-void *get_next_blkdev(void *dev)
+-{
+- struct blkdev_info *info;
+-
+- if (dev == NULL) {
+- info = kmalloc(sizeof(*info), GFP_KERNEL);
+- if (!info)
+- goto out;
+- info->index=0;
+- info->bd = major_names[info->index];
+- if (info->bd)
+- goto out;
+- } else {
+- info = dev;
+- }
+-
+- while (info->index < ARRAY_SIZE(major_names)) {
+- if (info->bd)
+- info->bd = info->bd->next;
+- if (info->bd)
+- goto out;
+- /*
+- * No devices on this chain, move to the next
+- */
+- info->index++;
+- info->bd = (info->index < ARRAY_SIZE(major_names)) ?
+- major_names[info->index] : NULL;
+- if (info->bd)
+- goto out;
+- }
+-
+-out:
+- return info;
+-}
+-
+-void *acquire_blkdev_list(void)
+-{
+- down(&block_subsys_sem);
+- return get_next_blkdev(NULL);
+-}
+-
+-void release_blkdev_list(void *dev)
+-{
+- up(&block_subsys_sem);
+- kfree(dev);
++ return major % BLKDEV_MAJOR_HASH_SIZE;
+ }
+
++#ifdef CONFIG_PROC_FS
+
+-/*
+- * Count the number of records in the blkdev_list.
+- * must be called with the block_subsys_sem held
+- */
+-int count_blkdev_list(void)
++void blkdev_show(struct seq_file *f, off_t offset)
+ {
+- struct blk_major_name *n;
+- int i, count;
+-
+- count = 0;
++ struct blk_major_name *dp;
+
+- for (i = 0; i < ARRAY_SIZE(major_names); i++) {
+- for (n = major_names[i]; n; n = n->next)
+- count++;
++ if (offset < BLKDEV_MAJOR_HASH_SIZE) {
++ down(&block_subsys_sem);
++ for (dp = major_names[offset]; dp; dp = dp->next)
++ seq_printf(f, "%3d %s\n", dp->major, dp->name);
++ up(&block_subsys_sem);
+ }
+-
+- return count;
+-}
+-
+-/*
+- * extract the major and name values from a blkdev_info struct
+- * passed in as a void to *dev. Must be called with
+- * block_subsys_sem held
+- */
+-int get_blkdev_info(void *dev, int *major, char **name)
+-{
+- struct blkdev_info *info = dev;
+-
+- if (info->bd == NULL)
+- return 1;
+-
+- *major = info->bd->major;
+- *name = info->bd->name;
+- return 0;
+ }
+
++#endif /* CONFIG_PROC_FS */
+
+ int register_blkdev(unsigned int major, const char *name)
+ {
+--- linux-2.6.16.11.orig/fs/char_dev.c
++++ linux-2.6.16.11/fs/char_dev.c
+@@ -15,6 +15,7 @@
+ #include <linux/module.h>
+ #include <linux/smp_lock.h>
+ #include <linux/devfs_fs_kernel.h>
++#include <linux/seq_file.h>
+
+ #include <linux/kobject.h>
+ #include <linux/kobj_map.h>
+@@ -26,8 +27,6 @@
+
+ static struct kobj_map *cdev_map;
+
+-#define MAX_PROBE_HASH 255 /* random */
+-
+ static DECLARE_MUTEX(chrdevs_lock);
+
+ static struct char_device_struct {
+@@ -38,93 +37,29 @@ static struct char_device_struct {
+ char name[64];
+ struct file_operations *fops;
+ struct cdev *cdev; /* will die */
+-} *chrdevs[MAX_PROBE_HASH];
++} *chrdevs[CHRDEV_MAJOR_HASH_SIZE];
+
+ /* index in the above */
+ static inline int major_to_index(int major)
+ {
+- return major % MAX_PROBE_HASH;
+-}
+-
+-struct chrdev_info {
+- int index;
+- struct char_device_struct *cd;
+-};
+-
+-void *get_next_chrdev(void *dev)
+-{
+- struct chrdev_info *info;
+-
+- if (dev == NULL) {
+- info = kmalloc(sizeof(*info), GFP_KERNEL);
+- if (!info)
+- goto out;
+- info->index=0;
+- info->cd = chrdevs[info->index];
+- if (info->cd)
+- goto out;
+- } else {
+- info = dev;
+- }
+-
+- while (info->index < ARRAY_SIZE(chrdevs)) {
+- if (info->cd)
+- info->cd = info->cd->next;
+- if (info->cd)
+- goto out;
+- /*
+- * No devices on this chain, move to the next
+- */
+- info->index++;
+- info->cd = (info->index < ARRAY_SIZE(chrdevs)) ?
+- chrdevs[info->index] : NULL;
+- if (info->cd)
+- goto out;
+- }
+-
+-out:
+- return info;
+-}
+-
+-void *acquire_chrdev_list(void)
+-{
+- down(&chrdevs_lock);
+- return get_next_chrdev(NULL);
+-}
+-
+-void release_chrdev_list(void *dev)
+-{
+- up(&chrdevs_lock);
+- kfree(dev);
++ return major % CHRDEV_MAJOR_HASH_SIZE;
+ }
+
++#ifdef CONFIG_PROC_FS
+
+-int count_chrdev_list(void)
++void chrdev_show(struct seq_file *f, off_t offset)
+ {
+ struct char_device_struct *cd;
+- int i, count;
+-
+- count = 0;
+
+- for (i = 0; i < ARRAY_SIZE(chrdevs) ; i++) {
+- for (cd = chrdevs[i]; cd; cd = cd->next)
+- count++;
++ if (offset < CHRDEV_MAJOR_HASH_SIZE) {
++ down(&chrdevs_lock);
++ for (cd = chrdevs[offset]; cd; cd = cd->next)
++ seq_printf(f, "%3d %s\n", cd->major, cd->name);
++ up(&chrdevs_lock);
+ }
+-
+- return count;
+ }
+
+-int get_chrdev_info(void *dev, int *major, char **name)
+-{
+- struct chrdev_info *info = dev;
+-
+- if (info->cd == NULL)
+- return 1;
+-
+- *major = info->cd->major;
+- *name = info->cd->name;
+- return 0;
+-}
++#endif /* CONFIG_PROC_FS */
+
+ /*
+ * Register a single major with a specified minor range.
+--- linux-2.6.16.11.orig/fs/proc/proc_misc.c
++++ linux-2.6.16.11/fs/proc/proc_misc.c
+@@ -249,144 +249,60 @@ static int cpuinfo_open(struct inode *in
+ return seq_open(file, &cpuinfo_op);
+ }
+
+-enum devinfo_states {
+- CHR_HDR,
+- CHR_LIST,
+- BLK_HDR,
+- BLK_LIST,
+- DEVINFO_DONE
+-};
+-
+-struct devinfo_state {
+- void *chrdev;
+- void *blkdev;
+- unsigned int num_records;
+- unsigned int cur_record;
+- enum devinfo_states state;
++static struct file_operations proc_cpuinfo_operations = {
++ .open = cpuinfo_open,
++ .read = seq_read,
++ .llseek = seq_lseek,
++ .release = seq_release,
+ };
+
+-static void *devinfo_start(struct seq_file *f, loff_t *pos)
++static int devinfo_show(struct seq_file *f, void *v)
+ {
+- struct devinfo_state *info = f->private;
++ int i = *(loff_t *) v;
+
+- if (*pos) {
+- if ((info) && (*pos <= info->num_records))
+- return info;
+- return NULL;
++ if (i < CHRDEV_MAJOR_HASH_SIZE) {
++ if (i == 0)
++ seq_printf(f, "Character devices:\n");
++ chrdev_show(f, i);
++ } else {
++ i -= CHRDEV_MAJOR_HASH_SIZE;
++ if (i == 0)
++ seq_printf(f, "\nBlock devices:\n");
++ blkdev_show(f, i);
+ }
+- info = kmalloc(sizeof(*info), GFP_KERNEL);
+- f->private = info;
+- info->chrdev = acquire_chrdev_list();
+- info->blkdev = acquire_blkdev_list();
+- info->state = CHR_HDR;
+- info->num_records = count_chrdev_list();
+- info->num_records += count_blkdev_list();
+- info->num_records += 2; /* Character and Block headers */
+- *pos = 1;
+- info->cur_record = *pos;
+- return info;
++ return 0;
+ }
+
+-static void *devinfo_next(struct seq_file *f, void *v, loff_t *pos)
++static void *devinfo_start(struct seq_file *f, loff_t *pos)
+ {
+- int idummy;
+- char *ndummy;
+- struct devinfo_state *info = f->private;
+-
+- switch (info->state) {
+- case CHR_HDR:
+- info->state = CHR_LIST;
+- (*pos)++;
+- /*fallthrough*/
+- case CHR_LIST:
+- if (get_chrdev_info(info->chrdev,&idummy,&ndummy)) {
+- /*
+- * The character dev list is complete
+- */
+- info->state = BLK_HDR;
+- } else {
+- info->chrdev = get_next_chrdev(info->chrdev);
+- }
+- (*pos)++;
+- break;
+- case BLK_HDR:
+- info->state = BLK_LIST;
+- (*pos)++;
+- /*fallthrough*/
+- case BLK_LIST:
+- if (get_blkdev_info(info->blkdev,&idummy,&ndummy)) {
+- /*
+- * The block dev list is complete
+- */
+- info->state = DEVINFO_DONE;
+- } else {
+- info->blkdev = get_next_blkdev(info->blkdev);
+- }
+- (*pos)++;
+- break;
+- case DEVINFO_DONE:
+- (*pos)++;
+- info->cur_record = *pos;
+- info = NULL;
+- break;
+- default:
+- break;
+- }
+- if (info)
+- info->cur_record = *pos;
+- return info;
++ if (*pos < (BLKDEV_MAJOR_HASH_SIZE + CHRDEV_MAJOR_HASH_SIZE))
++ return pos;
++ return NULL;
+ }
+
+-static void devinfo_stop(struct seq_file *f, void *v)
++static void *devinfo_next(struct seq_file *f, void *v, loff_t *pos)
+ {
+- struct devinfo_state *info = f->private;
+-
+- if (info) {
+- release_chrdev_list(info->chrdev);
+- release_blkdev_list(info->blkdev);
+- f->private = NULL;
+- kfree(info);
+- }
++ (*pos)++;
++ if (*pos >= (BLKDEV_MAJOR_HASH_SIZE + CHRDEV_MAJOR_HASH_SIZE))
++ return NULL;
++ return pos;
+ }
+
+-static int devinfo_show(struct seq_file *f, void *arg)
++static void devinfo_stop(struct seq_file *f, void *v)
+ {
+- int major;
+- char *name;
+- struct devinfo_state *info = f->private;
+-
+- switch(info->state) {
+- case CHR_HDR:
+- seq_printf(f,"Character devices:\n");
+- /* fallthrough */
+- case CHR_LIST:
+- if (!get_chrdev_info(info->chrdev,&major,&name))
+- seq_printf(f,"%3d %s\n",major,name);
+- break;
+- case BLK_HDR:
+- seq_printf(f,"\nBlock devices:\n");
+- /* fallthrough */
+- case BLK_LIST:
+- if (!get_blkdev_info(info->blkdev,&major,&name))
+- seq_printf(f,"%3d %s\n",major,name);
+- break;
+- default:
+- break;
+- }
+-
+- return 0;
++ /* Nothing to do */
+ }
+
+-static struct seq_operations devinfo_op = {
+- .start = devinfo_start,
+- .next = devinfo_next,
+- .stop = devinfo_stop,
+- .show = devinfo_show,
++static struct seq_operations devinfo_ops = {
++ .start = devinfo_start,
++ .next = devinfo_next,
++ .stop = devinfo_stop,
++ .show = devinfo_show
+ };
+
+-static int devinfo_open(struct inode *inode, struct file *file)
++static int devinfo_open(struct inode *inode, struct file *filp)
+ {
+- return seq_open(file, &devinfo_op);
++ return seq_open(filp, &devinfo_ops);
+ }
+
+ static struct file_operations proc_devinfo_operations = {
+@@ -396,13 +312,6 @@ static struct file_operations proc_devin
+ .release = seq_release,
+ };
+
+-static struct file_operations proc_cpuinfo_operations = {
+- .open = cpuinfo_open,
+- .read = seq_read,
+- .llseek = seq_lseek,
+- .release = seq_release,
+-};
+-
+ extern struct seq_operations vmstat_op;
+ static int vmstat_open(struct inode *inode, struct file *file)
+ {
+--- linux-2.6.16.11.orig/include/linux/fs.h
++++ linux-2.6.16.11/include/linux/fs.h
+@@ -1383,6 +1383,7 @@ extern int bd_claim(struct block_device
+ extern void bd_release(struct block_device *);
+
+ /* fs/char_dev.c */
++#define CHRDEV_MAJOR_HASH_SIZE 255
+ extern int alloc_chrdev_region(dev_t *, unsigned, unsigned, const char *);
+ extern int register_chrdev_region(dev_t, unsigned, const char *);
+ extern int register_chrdev(unsigned int, const char *,
+@@ -1390,25 +1391,17 @@ extern int register_chrdev(unsigned int,
+ extern int unregister_chrdev(unsigned int, const char *);
+ extern void unregister_chrdev_region(dev_t, unsigned);
+ extern int chrdev_open(struct inode *, struct file *);
+-extern int get_chrdev_list(char *);
+-extern void *acquire_chrdev_list(void);
+-extern int count_chrdev_list(void);
+-extern void *get_next_chrdev(void *);
+-extern int get_chrdev_info(void *, int *, char **);
+-extern void release_chrdev_list(void *);
++extern void chrdev_show(struct seq_file *,off_t);
+
+ /* fs/block_dev.c */
++#define BLKDEV_MAJOR_HASH_SIZE 255
+ #define BDEVNAME_SIZE 32 /* Largest string for a blockdev identifier */
+ extern const char *__bdevname(dev_t, char *buffer);
+ extern const char *bdevname(struct block_device *bdev, char *buffer);
+ extern struct block_device *lookup_bdev(const char *);
+ extern struct block_device *open_bdev_excl(const char *, int, void *);
+ extern void close_bdev_excl(struct block_device *);
+-extern void *acquire_blkdev_list(void);
+-extern int count_blkdev_list(void);
+-extern void *get_next_blkdev(void *);
+-extern int get_blkdev_info(void *, int *, char **);
+-extern void release_blkdev_list(void *);
++extern void blkdev_show(struct seq_file *,off_t);
+
+ extern void init_special_inode(struct inode *, umode_t, dev_t);
+
+
+--
+
+From greg@quad.kroah.org Thu Apr 27 17:13:24 2006
+Message-Id: <20060428001324.174508000@quad.kroah.org>
+References: <20060428001226.204293000@quad.kroah.org>
+User-Agent: quilt/0.44-1
+Date: Thu, 27 Apr 2006 17:12:41 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ git-commits-head@vger.kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ torvalds@osdl.org,
+ akpm@osdl.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jan Kara <jack@suse.cz>,
+ <reiserfs-dev@namesys.com>,
+ Greg Kroah-Hartman <gregkh@suse.de>
+Subject: [patch 15/24] Fix reiserfs deadlock
+Content-Disposition: inline; filename=fix-reiserfs-deadlock.patch
+Content-Length: 1315
+Lines: 40
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Jan Kara <jack@suse.cz>
+
+[PATCH] Fix reiserfs deadlock
+
+reiserfs_cache_default_acl() should return whether we successfully found
+the acl or not. We have to return correct value even if reiserfs_get_acl()
+returns error code and not just 0. Otherwise callers such as
+reiserfs_mkdir() can unnecessarily lock the xattrs and later functions such
+as reiserfs_new_inode() fail to notice that we have already taken the lock
+and try to take it again with obvious consequences.
+
+Signed-off-by: Jan Kara <jack@suse.cz>
+Cc: <reiserfs-dev@namesys.com>
+Signed-off-by: Andrew Morton <akpm@osdl.org>
+Signed-off-by: Linus Torvalds <torvalds@osdl.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/reiserfs/xattr_acl.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- linux-2.6.16.11.orig/fs/reiserfs/xattr_acl.c
++++ linux-2.6.16.11/fs/reiserfs/xattr_acl.c
+@@ -408,8 +408,9 @@ int reiserfs_cache_default_acl(struct in
+ acl = reiserfs_get_acl(inode, ACL_TYPE_DEFAULT);
+ reiserfs_read_unlock_xattrs(inode->i_sb);
+ reiserfs_read_unlock_xattr_i(inode);
+- ret = acl ? 1 : 0;
+- posix_acl_release(acl);
++ ret = (acl && !IS_ERR(acl));
++ if (ret)
++ posix_acl_release(acl);
+ }
+
+ return ret;
+
+--
+
+From greg@quad.kroah.org Thu Apr 27 17:13:24 2006
+Message-Id: <20060428001324.314150000@quad.kroah.org>
+References: <20060428001226.204293000@quad.kroah.org>
+User-Agent: quilt/0.44-1
+Date: Thu, 27 Apr 2006 17:12:42 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ git-commits-head@vger.kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ torvalds@osdl.org,
+ akpm@osdl.org,
+ alan@lxorguk.ukuu.org.uk,
+ Greg Howard <ghoward@sgi.com>,
+ Greg Kroah-Hartman <gregkh@suse.de>
+Subject: [patch 16/24] Altix snsc: duplicate kobject fix
+Content-Disposition: inline; filename=altix-snsc-duplicate-kobject-fix.patch
+Content-Length: 1196
+Lines: 35
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Greg Howard <ghoward@sgi.com>
+
+Fix Altix system controller (snsc) device names to include the slot number
+of the blade whose associated system controller is the target of the device
+interface. Including the slot number avoids a problem we're currently
+having where slots within the same enclosure are attempting to create
+multiple kobjects with identical names.
+
+Signed-off-by: Greg Howard <ghoward@sgi.com>
+Signed-off-by: Andrew Morton <akpm@osdl.org>
+Signed-off-by: Linus Torvalds <torvalds@osdl.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/char/snsc.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- linux-2.6.16.11.orig/drivers/char/snsc.c
++++ linux-2.6.16.11/drivers/char/snsc.c
+@@ -391,7 +391,8 @@ scdrv_init(void)
+ format_module_id(devnamep, geo_module(geoid),
+ MODULE_FORMAT_BRIEF);
+ devnamep = devname + strlen(devname);
+- sprintf(devnamep, "#%d", geo_slab(geoid));
++ sprintf(devnamep, "^%d#%d", geo_slot(geoid),
++ geo_slab(geoid));
+
+ /* allocate sysctl device data */
+ scd = kmalloc(sizeof (struct sysctl_data_s),
+
+--
+
+From greg@quad.kroah.org Thu Apr 27 17:13:24 2006
+Message-Id: <20060428001324.452969000@quad.kroah.org>
+References: <20060428001226.204293000@quad.kroah.org>
+User-Agent: quilt/0.44-1
+Date: Thu, 27 Apr 2006 17:12:43 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ git-commits-head@vger.kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ torvalds@osdl.org,
+ akpm@osdl.org,
+ alan@lxorguk.ukuu.org.uk,
+ Ivan Kokshaysky <ink@jurassic.park.msu.ru>,
+ Greg Kroah-Hartman <gregkh@suse.de>
+Subject: [patch 17/24] Alpha: strncpy() fix
+Content-Disposition: inline; filename=alpha-strncpy-fix.patch
+Content-Length: 1236
+Lines: 47
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Ivan Kokshaysky <ink@jurassic.park.msu.ru>
+
+[PATCH] Alpha: strncpy() fix
+
+As it turned out after recent SCSI changes, strncpy() was broken -
+it mixed up the return values from __stxncpy() in registers $24 and $27.
+
+Thanks to Mathieu Chouquet-Stringer for tracking down the problem
+and providing an excellent test case.
+
+Signed-off-by: Ivan Kokshaysky <ink@jurassic.park.msu.ru>
+Signed-off-by: Linus Torvalds <torvalds@osdl.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/alpha/lib/strncpy.S | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- linux-2.6.16.11.orig/arch/alpha/lib/strncpy.S
++++ linux-2.6.16.11/arch/alpha/lib/strncpy.S
+@@ -43,8 +43,8 @@ strncpy:
+
+ .align 4
+ $multiword:
+- subq $24, 1, $2 # clear the final bits in the prev word
+- or $2, $24, $2
++ subq $27, 1, $2 # clear the final bits in the prev word
++ or $2, $27, $2
+ zapnot $1, $2, $1
+ subq $18, 1, $18
+
+@@ -70,8 +70,8 @@ $multiword:
+ bne $18, 0b
+
+ 1: ldq_u $1, 0($16) # clear the leading bits in the final word
+- subq $27, 1, $2
+- or $2, $27, $2
++ subq $24, 1, $2
++ or $2, $24, $2
+
+ zap $1, $2, $1
+ stq_u $1, 0($16)
+
+--
+
+From greg@quad.kroah.org Thu Apr 27 17:13:24 2006
+Message-Id: <20060428001324.594722000@quad.kroah.org>
+References: <20060428001226.204293000@quad.kroah.org>
+User-Agent: quilt/0.44-1
+Date: Thu, 27 Apr 2006 17:12:44 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ git-commits-head@vger.kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ torvalds@osdl.org,
+ akpm@osdl.org,
+ alan@lxorguk.ukuu.org.uk,
+ James Morris <jmorris@namei.org>,
+ Al Viro <viro@zeniv.linux.org.uk>,
+ Greg Kroah-Hartman <gregkh@suse.de>,
+ Chris Wright <chrisw@sous-sol.org>
+Subject: [patch 18/24] LSM: add missing hook to do_compat_readv_writev()
+Content-Disposition: inline; filename=lsm-add-missing-hook-to-do_compat_readv_writev.patch
+Content-Length: 1113
+Lines: 39
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: James Morris <jmorris@namei.org>
+
+This patch addresses a flaw in LSM, where there is no mediation of readv()
+and writev() in for 32-bit compatible apps using a 64-bit kernel.
+
+This bug was discovered and fixed initially in the native readv/writev
+code [1], but was not fixed in the compat code. Thanks to Al for spotting
+this one.
+
+ [1] http://lwn.net/Articles/154282/
+
+Signed-off-by: James Morris <jmorris@namei.org>
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Linus Torvalds <torvalds@osdl.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+
+---
+ fs/compat.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- linux-2.6.16.11.orig/fs/compat.c
++++ linux-2.6.16.11/fs/compat.c
+@@ -1215,6 +1215,10 @@ static ssize_t compat_do_readv_writev(in
+ if (ret < 0)
+ goto out;
+
++ ret = security_file_permission(file, type == READ ? MAY_READ:MAY_WRITE);
++ if (ret)
++ goto out;
++
+ fnv = NULL;
+ if (type == READ) {
+ fn = file->f_op->read;
+
+--
+
+From greg@quad.kroah.org Thu Apr 27 17:13:24 2006
+Message-Id: <20060428001324.738152000@quad.kroah.org>
+References: <20060428001226.204293000@quad.kroah.org>
+User-Agent: quilt/0.44-1
+Date: Thu, 27 Apr 2006 17:12:45 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ git-commits-head@vger.kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ torvalds@osdl.org,
+ akpm@osdl.org,
+ alan@lxorguk.ukuu.org.uk,
+ Zachary Amsden <zach@vmware.com>,
+ Greg Kroah-Hartman <gregkh@suse.de>
+Subject: [patch 19/24] x86/PAE: Fix pte_clear for the >4GB RAM case
+Content-Disposition: inline; filename=x86-pae-fix-pte_clear-for-the-4gb-ram-case.patch
+Content-Length: 5572
+Lines: 130
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Zachary Amsden <zach@vmware.com>
+
+[PATCH] x86/PAE: Fix pte_clear for the >4GB RAM case
+
+Proposed fix for ptep_get_and_clear_full PAE bug. Pte_clear had the same bug,
+so use the same fix for both. Turns out pmd_clear had it as well, but pgds
+are not affected.
+
+The problem is rather intricate. Page table entries in PAE mode are 64-bits
+wide, but the only atomic 8-byte write operation available in 32-bit mode is
+cmpxchg8b, which is expensive (at least on P4), and thus avoided. But it can
+happen that the processor may prefetch entries into the TLB in the middle of an
+operation which clears a page table entry. So one must always clear the P-bit
+in the low word of the page table entry first when clearing it.
+
+Since the sequence *ptep = __pte(0) leaves the order of the write dependent on
+the compiler, it must be coded explicitly as a clear of the low word followed
+by a clear of the high word. Further, there must be a write memory barrier
+here to enforce proper ordering by the compiler (and, in the future, by the
+processor as well).
+
+On > 4GB memory machines, the implementation of pte_clear for PAE was clearly
+deficient, as it could leave virtual mappings of physical memory above 4GB
+aliased to memory below 4GB in the TLB. The implementation of
+ptep_get_and_clear_full has a similar bug, although not nearly as likely to
+occur, since the mappings being cleared are in the process of being destroyed,
+and should never be dereferenced again.
+
+But, as luck would have it, it is possible to trigger bugs even without ever
+dereferencing these bogus TLB mappings, even if the clear is followed fairly
+soon after with a TLB flush or invalidation. The problem is that memory above
+4GB may now be aliased into the first 4GB of memory, and in fact, may hit a
+region of memory with non-memory semantics. These regions include AGP and PCI
+space. As such, these memory regions are not cached by the processor. This
+introduces the bug.
+
+The processor can speculate memory operations, including memory writes, as long
+as they are committed with the proper ordering. Speculating a memory write to
+a linear address that has a bogus TLB mapping is possible. Normally, the
+speculation is harmless. But for cached memory, it does leave the falsely
+speculated cacheline unmodified, but in a dirty state. This cache line will be
+eventually written back. If this cacheline happens to intersect a region of
+memory that is not protected by the cache coherency protocol, it can corrupt
+data in I/O memory, which is generally a very bad thing to do, and can cause
+total system failure or just plain undefined behavior.
+
+These bugs are extremely unlikely, but the severity is of such magnitude, and
+the fix so simple that I think fixing them immediately is justified. Also,
+they are nearly impossible to debug.
+
+Signed-off-by: Zachary Amsden <zach@vmware.com>
+Signed-off-by: Linus Torvalds <torvalds@osdl.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ include/asm-i386/pgtable-2level.h | 3 +++
+ include/asm-i386/pgtable-3level.h | 20 ++++++++++++++++++++
+ include/asm-i386/pgtable.h | 4 +---
+ 3 files changed, 24 insertions(+), 3 deletions(-)
+
+--- linux-2.6.16.11.orig/include/asm-i386/pgtable-2level.h
++++ linux-2.6.16.11/include/asm-i386/pgtable-2level.h
+@@ -18,6 +18,9 @@
+ #define set_pte_atomic(pteptr, pteval) set_pte(pteptr,pteval)
+ #define set_pmd(pmdptr, pmdval) (*(pmdptr) = (pmdval))
+
++#define pte_clear(mm,addr,xp) do { set_pte_at(mm, addr, xp, __pte(0)); } while (0)
++#define pmd_clear(xp) do { set_pmd(xp, __pmd(0)); } while (0)
++
+ #define ptep_get_and_clear(mm,addr,xp) __pte(xchg(&(xp)->pte_low, 0))
+ #define pte_same(a, b) ((a).pte_low == (b).pte_low)
+ #define pte_page(x) pfn_to_page(pte_pfn(x))
+--- linux-2.6.16.11.orig/include/asm-i386/pgtable-3level.h
++++ linux-2.6.16.11/include/asm-i386/pgtable-3level.h
+@@ -85,6 +85,26 @@ static inline void pud_clear (pud_t * pu
+ #define pmd_offset(pud, address) ((pmd_t *) pud_page(*(pud)) + \
+ pmd_index(address))
+
++/*
++ * For PTEs and PDEs, we must clear the P-bit first when clearing a page table
++ * entry, so clear the bottom half first and enforce ordering with a compiler
++ * barrier.
++ */
++static inline void pte_clear(struct mm_struct *mm, unsigned long addr, pte_t *ptep)
++{
++ ptep->pte_low = 0;
++ smp_wmb();
++ ptep->pte_high = 0;
++}
++
++static inline void pmd_clear(pmd_t *pmd)
++{
++ u32 *tmp = (u32 *)pmd;
++ *tmp = 0;
++ smp_wmb();
++ *(tmp + 1) = 0;
++}
++
+ static inline pte_t ptep_get_and_clear(struct mm_struct *mm, unsigned long addr, pte_t *ptep)
+ {
+ pte_t res;
+--- linux-2.6.16.11.orig/include/asm-i386/pgtable.h
++++ linux-2.6.16.11/include/asm-i386/pgtable.h
+@@ -204,12 +204,10 @@ extern unsigned long long __PAGE_KERNEL,
+ extern unsigned long pg0[];
+
+ #define pte_present(x) ((x).pte_low & (_PAGE_PRESENT | _PAGE_PROTNONE))
+-#define pte_clear(mm,addr,xp) do { set_pte_at(mm, addr, xp, __pte(0)); } while (0)
+
+ /* To avoid harmful races, pmd_none(x) should check only the lower when PAE */
+ #define pmd_none(x) (!(unsigned long)pmd_val(x))
+ #define pmd_present(x) (pmd_val(x) & _PAGE_PRESENT)
+-#define pmd_clear(xp) do { set_pmd(xp, __pmd(0)); } while (0)
+ #define pmd_bad(x) ((pmd_val(x) & (~PAGE_MASK & ~_PAGE_USER)) != _KERNPG_TABLE)
+
+
+@@ -269,7 +267,7 @@ static inline pte_t ptep_get_and_clear_f
+ pte_t pte;
+ if (full) {
+ pte = *ptep;
+- *ptep = __pte(0);
++ pte_clear(mm, addr, ptep);
+ } else {
+ pte = ptep_get_and_clear(mm, addr, ptep);
+ }
+
+--
+
+From greg@quad.kroah.org Thu Apr 27 17:13:25 2006
+Message-Id: <20060428001324.879818000@quad.kroah.org>
+References: <20060428001226.204293000@quad.kroah.org>
+User-Agent: quilt/0.44-1
+Date: Thu, 27 Apr 2006 17:12:46 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ <jgarzik@pobox.com>
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ torvalds@osdl.org,
+ akpm@osdl.org,
+ alan@lxorguk.ukuu.org.uk,
+ netdev@vger.kernel.org,
+ <jesse.brandeburg@intel.com>,
+ <john.ronciak@intel.com>,
+ <Jeffrey.t.kirsher@intel.com>,
+ <auke@foo-projects.org>,
+ <davem@davemloft.net>,
+ Auke Kok <auke-jan.h.kok@intel.com>,
+ Greg Kroah-Hartman <gregkh@suse.de>
+Subject: [patch 20/24] NET: e1000: Update truesize with the length of the packet for packet split
+Content-Disposition: inline; filename=net-e1000-update-truesize-with-the-length-of-the-packet-for-packet-split.patch
+Content-Length: 764
+Lines: 28
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+Update skb with the real packet size.
+
+
+Signed-off-by: Jesse Brandeburg <jesse.brandeburg@intel.com>
+Signed-off-by: Auke Kok <auke-jan.h.kok@intel.com>
+Signed-off-by: John Ronciak <john.ronciak@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/e1000/e1000_main.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- linux-2.6.16.11.orig/drivers/net/e1000/e1000_main.c
++++ linux-2.6.16.11/drivers/net/e1000/e1000_main.c
+@@ -3851,6 +3851,7 @@ e1000_clean_rx_irq_ps(struct e1000_adapt
+ skb_shinfo(skb)->nr_frags++;
+ skb->len += length;
+ skb->data_len += length;
++ skb->truesize += length;
+ }
+
+ e1000_rx_checksum(adapter, staterr,
+
+--
+
+From greg@quad.kroah.org Thu Apr 27 17:13:25 2006
+Message-Id: <20060428001325.019060000@quad.kroah.org>
+References: <20060428001226.204293000@quad.kroah.org>
+User-Agent: quilt/0.44-1
+Date: Thu, 27 Apr 2006 17:12:47 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ torvalds@osdl.org,
+ akpm@osdl.org,
+ alan@lxorguk.ukuu.org.uk,
+ Ralf Baechle <ralf@linux-mips.org>,
+ Greg Kroah-Hartman <gregkh@suse.de>
+Subject: [patch 21/24] MIPS: Use "R" constraint for cache_op.
+Content-Disposition: inline; filename=MIPS-0001.patch
+Content-Length: 743
+Lines: 26
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+Gcc might emit an absolute address for the the "m" constraint which
+gas unfortunately does not permit.
+
+Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ include/asm-mips/r4kcache.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- linux-2.6.16.11.orig/include/asm-mips/r4kcache.h
++++ linux-2.6.16.11/include/asm-mips/r4kcache.h
+@@ -37,7 +37,7 @@
+ " cache %0, %1 \n" \
+ " .set pop \n" \
+ : \
+- : "i" (op), "m" (*(unsigned char *)(addr)))
++ : "i" (op), "R" (*(unsigned char *)(addr)))
+
+ static inline void flush_icache_line_indexed(unsigned long addr)
+ {
+
+--
+
+From greg@quad.kroah.org Thu Apr 27 17:13:25 2006
+Message-Id: <20060428001325.159252000@quad.kroah.org>
+References: <20060428001226.204293000@quad.kroah.org>
+User-Agent: quilt/0.44-1
+Date: Thu, 27 Apr 2006 17:12:48 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ torvalds@osdl.org,
+ akpm@osdl.org,
+ alan@lxorguk.ukuu.org.uk,
+ Ralf Baechle <ralf@linux-mips.org>,
+ Greg Kroah-Hartman <gregkh@suse.de>
+Subject: [patch 22/24] MIPS: R2 build fixes for gcc < 3.4.
+Content-Disposition: inline; filename=MIPS-0002.patch
+Content-Length: 2821
+Lines: 113
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ include/asm-mips/bitops.h | 14 ++++++++++++--
+ include/asm-mips/byteorder.h | 4 ++++
+ include/asm-mips/interrupt.h | 8 ++++++++
+ 3 files changed, 24 insertions(+), 2 deletions(-)
+
+--- linux-2.6.16.11.orig/include/asm-mips/bitops.h
++++ linux-2.6.16.11/include/asm-mips/bitops.h
+@@ -654,7 +654,12 @@ static inline unsigned long fls(unsigned
+ {
+ #ifdef CONFIG_32BIT
+ #ifdef CONFIG_CPU_MIPS32
+- __asm__ ("clz %0, %1" : "=r" (word) : "r" (word));
++ __asm__ (
++ " .set mips32 \n"
++ " clz %0, %1 \n"
++ " .set mips0 \n"
++ : "=r" (word)
++ : "r" (word));
+
+ return 32 - word;
+ #else
+@@ -678,7 +683,12 @@ static inline unsigned long fls(unsigned
+ #ifdef CONFIG_64BIT
+ #ifdef CONFIG_CPU_MIPS64
+
+- __asm__ ("dclz %0, %1" : "=r" (word) : "r" (word));
++ __asm__ (
++ " .set mips64 \n"
++ " dclz %0, %1 \n"
++ " .set mips0 \n"
++ : "=r" (word)
++ : "r" (word));
+
+ return 64 - word;
+ #else
+--- linux-2.6.16.11.orig/include/asm-mips/byteorder.h
++++ linux-2.6.16.11/include/asm-mips/byteorder.h
+@@ -19,7 +19,9 @@
+ static __inline__ __attribute_const__ __u16 ___arch__swab16(__u16 x)
+ {
+ __asm__(
++ " .set mips32r2 \n"
+ " wsbh %0, %1 \n"
++ " .set mips0 \n"
+ : "=r" (x)
+ : "r" (x));
+
+@@ -30,8 +32,10 @@ static __inline__ __attribute_const__ __
+ static __inline__ __attribute_const__ __u32 ___arch__swab32(__u32 x)
+ {
+ __asm__(
++ " .set mips32r2 \n"
+ " wsbh %0, %1 \n"
+ " rotr %0, %0, 16 \n"
++ " .set mips0 \n"
+ : "=r" (x)
+ : "r" (x));
+
+--- linux-2.6.16.11.orig/include/asm-mips/interrupt.h
++++ linux-2.6.16.11/include/asm-mips/interrupt.h
+@@ -20,7 +20,9 @@ __asm__ (
+ " .set reorder \n"
+ " .set noat \n"
+ #ifdef CONFIG_CPU_MIPSR2
++ " .set mips32r2 \n"
+ " ei \n"
++ " .set mips0 \n"
+ #else
+ " mfc0 $1,$12 \n"
+ " ori $1,0x1f \n"
+@@ -63,7 +65,9 @@ __asm__ (
+ " .set push \n"
+ " .set noat \n"
+ #ifdef CONFIG_CPU_MIPSR2
++ " .set mips32r2 \n"
+ " di \n"
++ " .set mips0 \n"
+ #else
+ " mfc0 $1,$12 \n"
+ " ori $1,0x1f \n"
+@@ -103,8 +107,10 @@ __asm__ (
+ " .set reorder \n"
+ " .set noat \n"
+ #ifdef CONFIG_CPU_MIPSR2
++ " .set mips32r2 \n"
+ " di \\result \n"
+ " andi \\result, 1 \n"
++ " .set mips0 \n"
+ #else
+ " mfc0 \\result, $12 \n"
+ " ori $1, \\result, 0x1f \n"
+@@ -133,9 +139,11 @@ __asm__ (
+ * Slow, but doesn't suffer from a relativly unlikely race
+ * condition we're having since days 1.
+ */
++ " .set mips32r2 \n"
+ " beqz \\flags, 1f \n"
+ " di \n"
+ " ei \n"
++ " .set mips0 \n"
+ "1: \n"
+ #elif defined(CONFIG_CPU_MIPSR2)
+ /*
+
+--
+
+From greg@quad.kroah.org Thu Apr 27 17:13:25 2006
+Message-Id: <20060428001325.298860000@quad.kroah.org>
+References: <20060428001226.204293000@quad.kroah.org>
+User-Agent: quilt/0.44-1
+Date: Thu, 27 Apr 2006 17:12:49 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ torvalds@osdl.org,
+ akpm@osdl.org,
+ alan@lxorguk.ukuu.org.uk,
+ Atsushi Nemoto <anemo@mba.ocn.ne.jp>,
+ Ralf Baechle <ralf@linux-mips.org>,
+ Greg Kroah-Hartman <gregkh@suse.de>
+Subject: [patch 23/24] MIPS: Fix tx49_blast_icache32_page_indexed.
+Content-Disposition: inline; filename=MIPS-0003.patch
+Content-Length: 1058
+Lines: 30
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Atsushi Nemoto <anemo@mba.ocn.ne.jp>
+
+Fix the cache index value in tx49_blast_icache32_page_indexed().
+This is damage by de62893bc0725f8b5f0445250577cd7a10b2d8f8 commit.
+
+Signed-off-by: Atsushi Nemoto <anemo@mba.ocn.ne.jp>
+Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/mips/mm/c-r4k.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- linux-2.6.16.11.orig/arch/mips/mm/c-r4k.c
++++ linux-2.6.16.11/arch/mips/mm/c-r4k.c
+@@ -154,7 +154,8 @@ static inline void blast_icache32_r4600_
+
+ static inline void tx49_blast_icache32_page_indexed(unsigned long page)
+ {
+- unsigned long start = page;
++ unsigned long indexmask = current_cpu_data.icache.waysize - 1;
++ unsigned long start = INDEX_BASE + (page & indexmask);
+ unsigned long end = start + PAGE_SIZE;
+ unsigned long ws_inc = 1UL << current_cpu_data.icache.waybit;
+ unsigned long ws_end = current_cpu_data.icache.ways <<
+
+--
+
+From greg@quad.kroah.org Thu Apr 27 17:13:25 2006
+Message-Id: <20060428001325.444493000@quad.kroah.org>
+References: <20060428001226.204293000@quad.kroah.org>
+User-Agent: quilt/0.44-1
+Date: Thu, 27 Apr 2006 17:12:50 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ torvalds@osdl.org,
+ akpm@osdl.org,
+ alan@lxorguk.ukuu.org.uk,
+ Win Treese <treese@acm.org>,
+ Ralf Baechle <ralf@linux-mips.org>,
+ Greg Kroah-Hartman <gregkh@suse.de>
+Subject: [patch 24/24] MIPS: Fix branch emulation for floating-point exceptions.
+Content-Disposition: inline; filename=MIPS-0004.patch
+Content-Length: 1095
+Lines: 33
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Win Treese <treese@acm.org>
+
+In the branch emulation for floating-point exceptions, __compute_return_epc
+must determine for bc1f et al which condition code bit to test. This is
+based on bits <4:2> of the rt field. The switch statement to distinguish
+bc1f et al needs to use only the two low bits of rt, but the old code tests
+on the whole rt field. This patch masks off the proper bits.
+
+Signed-off-by: Win Treese <treese@acm.org>
+Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/mips/kernel/branch.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- linux-2.6.16.11.orig/arch/mips/kernel/branch.c
++++ linux-2.6.16.11/arch/mips/kernel/branch.c
+@@ -184,7 +184,7 @@ int __compute_return_epc(struct pt_regs
+ bit = (insn.i_format.rt >> 2);
+ bit += (bit != 0);
+ bit += 23;
+- switch (insn.i_format.rt) {
++ switch (insn.i_format.rt & 3) {
+ case 0: /* bc1f */
+ case 2: /* bc1fl */
+ if (~fcr31 & (1 << bit))
+
+--
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
