--- /dev/null
+From gregkh@mini.kroah.org Thu Aug 13 12:51:24 2009
+Message-Id: <20090813195124.804107734@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 13 Aug 2009 12:49:36 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ Greg KH <greg@kroah.com>
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ "John W. Linville" <linville@tuxdriver.com>,
+ Reinette Chatre <reinette.chatre@intel.com>
+Subject: [patch 01/74] iwlwifi: only show active power level via sysfs
+References: <20090813194935.985368088@mini.kroah.org>
+Content-Disposition: inline; filename=iwlwifi-only-show-active-power-level-via-sysfs.patch
+Content-Length: 2616
+Lines: 84
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Reinette Chatre <reinette.chatre@intel.com>
+
+commit 872ed1902f511a8947021c562f5728a5bf0640b5 upstream.
+
+This changes the power_level file to adhere to the "one value
+per file" sysfs rule. The user will know which power level was
+requested as it will be the number just written to this file. It
+is thus not necessary to create a new sysfs file for this value.
+
+In addition it fixes a problem where powertop's parsing expects
+this value to be the first value in this file without any descriptions.
+
+Signed-off-by: Reinette Chatre <reinette.chatre@intel.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/iwlwifi/iwl-agn.c | 19 +------------------
+ drivers/net/wireless/iwlwifi/iwl3945-base.c | 19 +------------------
+ 2 files changed, 2 insertions(+), 36 deletions(-)
+
+--- a/drivers/net/wireless/iwlwifi/iwl3945-base.c
++++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c
+@@ -4623,27 +4623,10 @@ static ssize_t show_power_level(struct d
+ struct device_attribute *attr, char *buf)
+ {
+ struct iwl_priv *priv = dev_get_drvdata(d);
+- int mode = priv->power_data.user_power_setting;
+- int system = priv->power_data.system_power_setting;
+ int level = priv->power_data.power_mode;
+ char *p = buf;
+
+- switch (system) {
+- case IWL_POWER_SYS_AUTO:
+- p += sprintf(p, "SYSTEM:auto");
+- break;
+- case IWL_POWER_SYS_AC:
+- p += sprintf(p, "SYSTEM:ac");
+- break;
+- case IWL_POWER_SYS_BATTERY:
+- p += sprintf(p, "SYSTEM:battery");
+- break;
+- }
+-
+- p += sprintf(p, "\tMODE:%s", (mode < IWL_POWER_AUTO) ?
+- "fixed" : "auto");
+- p += sprintf(p, "\tINDEX:%d", level);
+- p += sprintf(p, "\n");
++ p += sprintf(p, "%d\n", level);
+ return p - buf + 1;
+ }
+
+--- a/drivers/net/wireless/iwlwifi/iwl-agn.c
++++ b/drivers/net/wireless/iwlwifi/iwl-agn.c
+@@ -3101,27 +3101,10 @@ static ssize_t show_power_level(struct d
+ struct device_attribute *attr, char *buf)
+ {
+ struct iwl_priv *priv = dev_get_drvdata(d);
+- int mode = priv->power_data.user_power_setting;
+- int system = priv->power_data.system_power_setting;
+ int level = priv->power_data.power_mode;
+ char *p = buf;
+
+- switch (system) {
+- case IWL_POWER_SYS_AUTO:
+- p += sprintf(p, "SYSTEM:auto");
+- break;
+- case IWL_POWER_SYS_AC:
+- p += sprintf(p, "SYSTEM:ac");
+- break;
+- case IWL_POWER_SYS_BATTERY:
+- p += sprintf(p, "SYSTEM:battery");
+- break;
+- }
+-
+- p += sprintf(p, "\tMODE:%s", (mode < IWL_POWER_AUTO) ?
+- "fixed" : "auto");
+- p += sprintf(p, "\tINDEX:%d", level);
+- p += sprintf(p, "\n");
++ p += sprintf(p, "%d\n", level);
+ return p - buf + 1;
+ }
+
+
+
+From gregkh@mini.kroah.org Thu Aug 13 12:51:25 2009
+Message-Id: <20090813195124.932621003@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 13 Aug 2009 12:49:37 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Ajit Khaparde <ajitk@serverengines.com>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [patch 02/74] be2net: Fix to avoid a crash seen on PPC with LRO and Jumbo frames.
+References: <20090813194935.985368088@mini.kroah.org>
+Content-Disposition: inline; filename=be2net-fix-to-avoid-a-crash-seen-on-ppc-with-lro-and-jumbo-frames.patch
+Content-Length: 4914
+Lines: 141
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Ajit Khaparde <ajitk@serverengines.com>
+
+[ Upstream commit bd46cb6cf11867130a41ea9546dd65688b71f3c2 ]
+
+While testing the driver on PPC, we ran into a crash with LRO, Jumbo frames.
+With CONFIG_PPC_64K_PAGES configured (a default in PPC), MAX_SKB_FRAGS drops to 3 and we were crossing the array limits on skb_shinfo(skb)->frags[].
+Now we coalesce the frags from the same physical page into one slot in
+skb_shinfo(skb)->frags[] and go to the next index when the frag is from
+
+different physical page.
+
+This patch is against the net-2.6 tree.
+
+Signed-off-by: Ajit Khaparde <ajitk@serverengines.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/net/benet/be.h | 2 -
+ drivers/net/benet/be_ethtool.c | 4 +--
+ drivers/net/benet/be_main.c | 45 +++++++++++++++++++++++++++++------------
+ 3 files changed, 35 insertions(+), 16 deletions(-)
+
+--- a/drivers/net/benet/be_ethtool.c
++++ b/drivers/net/benet/be_ethtool.c
+@@ -162,8 +162,8 @@ be_set_coalesce(struct net_device *netde
+ return -EINVAL;
+
+ adapter->max_rx_coal = coalesce->rx_max_coalesced_frames;
+- if (adapter->max_rx_coal > MAX_SKB_FRAGS)
+- adapter->max_rx_coal = MAX_SKB_FRAGS - 1;
++ if (adapter->max_rx_coal > BE_MAX_FRAGS_PER_FRAME)
++ adapter->max_rx_coal = BE_MAX_FRAGS_PER_FRAME;
+
+ /* if AIC is being turned on now, start with an EQD of 0 */
+ if (rx_eq->enable_aic == 0 &&
+--- a/drivers/net/benet/be.h
++++ b/drivers/net/benet/be.h
+@@ -73,7 +73,7 @@ static inline char *nic_name(struct pci_
+ #define RX_FRAGS_REFILL_WM (RX_Q_LEN - MAX_RX_POST)
+
+ #define BE_MAX_LRO_DESCRIPTORS 16
+-#define BE_MAX_FRAGS_PER_FRAME 16
++#define BE_MAX_FRAGS_PER_FRAME (min((u32) 16, (u32) MAX_SKB_FRAGS))
+
+ struct be_dma_mem {
+ void *va;
+--- a/drivers/net/benet/be_main.c
++++ b/drivers/net/benet/be_main.c
+@@ -682,7 +682,7 @@ static void skb_fill_rx_data(struct be_a
+ {
+ struct be_queue_info *rxq = &adapter->rx_obj.q;
+ struct be_rx_page_info *page_info;
+- u16 rxq_idx, i, num_rcvd;
++ u16 rxq_idx, i, num_rcvd, j;
+ u32 pktsize, hdr_len, curr_frag_len;
+ u8 *start;
+
+@@ -725,22 +725,33 @@ static void skb_fill_rx_data(struct be_a
+
+ /* More frags present for this completion */
+ pktsize -= curr_frag_len; /* account for above copied frag */
+- for (i = 1; i < num_rcvd; i++) {
++ for (i = 1, j = 0; i < num_rcvd; i++) {
+ index_inc(&rxq_idx, rxq->len);
+ page_info = get_rx_page_info(adapter, rxq_idx);
+
+ curr_frag_len = min(pktsize, rx_frag_size);
+
+- skb_shinfo(skb)->frags[i].page = page_info->page;
+- skb_shinfo(skb)->frags[i].page_offset = page_info->page_offset;
+- skb_shinfo(skb)->frags[i].size = curr_frag_len;
++ /* Coalesce all frags from the same physical page in one slot */
++ if (page_info->page_offset == 0) {
++ /* Fresh page */
++ j++;
++ skb_shinfo(skb)->frags[j].page = page_info->page;
++ skb_shinfo(skb)->frags[j].page_offset =
++ page_info->page_offset;
++ skb_shinfo(skb)->frags[j].size = 0;
++ skb_shinfo(skb)->nr_frags++;
++ } else {
++ put_page(page_info->page);
++ }
++
++ skb_shinfo(skb)->frags[j].size += curr_frag_len;
+ skb->len += curr_frag_len;
+ skb->data_len += curr_frag_len;
+- skb_shinfo(skb)->nr_frags++;
+ pktsize -= curr_frag_len;
+
+ memset(page_info, 0, sizeof(*page_info));
+ }
++ BUG_ON(j > MAX_SKB_FRAGS);
+
+ be_rx_stats_update(adapter, pktsize, num_rcvd);
+ return;
+@@ -803,7 +814,7 @@ static void be_rx_compl_process_lro(stru
+ struct skb_frag_struct rx_frags[BE_MAX_FRAGS_PER_FRAME];
+ struct be_queue_info *rxq = &adapter->rx_obj.q;
+ u32 num_rcvd, pkt_size, remaining, vlanf, curr_frag_len;
+- u16 i, rxq_idx = 0, vid;
++ u16 i, rxq_idx = 0, vid, j;
+
+ num_rcvd = AMAP_GET_BITS(struct amap_eth_rx_compl, numfrags, rxcp);
+ pkt_size = AMAP_GET_BITS(struct amap_eth_rx_compl, pktsize, rxcp);
+@@ -811,20 +822,28 @@ static void be_rx_compl_process_lro(stru
+ rxq_idx = AMAP_GET_BITS(struct amap_eth_rx_compl, fragndx, rxcp);
+
+ remaining = pkt_size;
+- for (i = 0; i < num_rcvd; i++) {
++ for (i = 0, j = -1; i < num_rcvd; i++) {
+ page_info = get_rx_page_info(adapter, rxq_idx);
+
+ curr_frag_len = min(remaining, rx_frag_size);
+
+- rx_frags[i].page = page_info->page;
+- rx_frags[i].page_offset = page_info->page_offset;
+- rx_frags[i].size = curr_frag_len;
+- remaining -= curr_frag_len;
++ /* Coalesce all frags from the same physical page in one slot */
++ if (i == 0 || page_info->page_offset == 0) {
++ /* First frag or Fresh page */
++ j++;
++ rx_frags[j].page = page_info->page;
++ rx_frags[j].page_offset = page_info->page_offset;
++ rx_frags[j].size = 0;
++ } else {
++ put_page(page_info->page);
++ }
++ rx_frags[j].size += curr_frag_len;
+
++ remaining -= curr_frag_len;
+ index_inc(&rxq_idx, rxq->len);
+-
+ memset(page_info, 0, sizeof(*page_info));
+ }
++ BUG_ON(j > MAX_SKB_FRAGS);
+
+ if (likely(!vlanf)) {
+ lro_receive_frags(&adapter->rx_obj.lro_mgr, rx_frags, pkt_size,
+
+
+From gregkh@mini.kroah.org Thu Aug 13 12:51:25 2009
+Message-Id: <20090813195125.088225988@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 13 Aug 2009 12:49:38 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Krzysztof Halasa <khc@pm.waw.pl>,
+ Jeff Kirsher <jeffrey.t.kirsher@intel.com>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [patch 03/74] E100: work around the driver using streaming DMA mapping for RX descriptors.
+References: <20090813194935.985368088@mini.kroah.org>
+Content-Disposition: inline; filename=e100-work-around-the-driver-using-streaming-dma-mapping-for-rx-descriptors.patch
+Content-Length: 1078
+Lines: 32
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Krzysztof Halasa <khc@pm.waw.pl>
+
+[ Upstream commit 303d67c288319768b19ed8dbed429fef7eb7c275 ]
+
+E100 places it's RX packet descriptors inside skb->data and uses them
+with bidirectional streaming DMA mapping. Unfortunately it fails to
+transfer skb->data ownership to the device after it reads the
+descriptor's status, breaking on non-coherent (e.g., ARM) platforms.
+
+This have to be converted to use coherent memory for the descriptors.
+
+Signed-off-by: Krzysztof Halasa <khc@pm.waw.pl>
+Acked-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/net/e100.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/net/e100.c
++++ b/drivers/net/e100.c
+@@ -1762,6 +1762,9 @@ static int e100_rx_indicate(struct nic *
+
+ if (ioread8(&nic->csr->scb.status) & rus_no_res)
+ nic->ru_running = RU_SUSPENDED;
++ pci_dma_sync_single_for_device(nic->pdev, rx->dma_addr,
++ sizeof(struct rfd),
++ PCI_DMA_BIDIRECTIONAL);
+ return -ENODATA;
+ }
+
+
+
+From gregkh@mini.kroah.org Thu Aug 13 12:51:25 2009
+Message-Id: <20090813195125.214786279@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 13 Aug 2009 12:49:39 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Herbert Xu <herbert@gondor.apana.org.au>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [patch 04/74] ipsec: Fix name of CAST algorithm
+References: <20090813194935.985368088@mini.kroah.org>
+Content-Disposition: inline; filename=ipsec-fix-name-of-cast-algorithm.patch
+Content-Length: 693
+Lines: 28
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Herbert Xu <herbert@gondor.apana.org.au>
+
+[ Upstream commit 245acb87729bc76ba65c7476665c01837e0cdccb ]
+
+Our CAST algorithm is called cast5, not cast128. Clearly nobody
+has ever used it :)
+
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/xfrm/xfrm_algo.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/net/xfrm/xfrm_algo.c
++++ b/net/xfrm/xfrm_algo.c
+@@ -292,8 +292,8 @@ static struct xfrm_algo_desc ealg_list[]
+ }
+ },
+ {
+- .name = "cbc(cast128)",
+- .compat = "cast128",
++ .name = "cbc(cast5)",
++ .compat = "cast5",
+
+ .uinfo = {
+ .encr = {
+
+
+From gregkh@mini.kroah.org Thu Aug 13 12:51:25 2009
+Message-Id: <20090813195125.351956918@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 13 Aug 2009 12:49:40 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Anton Vorontsov <avorontsov@ru.mvista.com>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [patch 05/74] sky2: Fix checksum endianness
+References: <20090813194935.985368088@mini.kroah.org>
+Content-Disposition: inline; filename=sky2-fix-checksum-endianness.patch
+Content-Length: 1546
+Lines: 42
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Anton Vorontsov <avorontsov@ru.mvista.com>
+
+[ Upstream commit b9389796fa4c87fbdff33816e317cdae5f36dd0b ]
+
+sky2 driver on PowerPC targets floods kernel log with following errors:
+
+ eth1: hw csum failure.
+ Call Trace:
+ [ef84b8a0] [c00075e4] show_stack+0x50/0x160 (unreliable)
+ [ef84b8d0] [c02fa178] netdev_rx_csum_fault+0x3c/0x5c
+ [ef84b8f0] [c02f6920] __skb_checksum_complete_head+0x7c/0x84
+ [ef84b900] [c02f693c] __skb_checksum_complete+0x14/0x24
+ [ef84b910] [c0337e08] tcp_v4_rcv+0x4c8/0x6f8
+ [ef84b940] [c031a9c8] ip_local_deliver+0x98/0x210
+ [ef84b960] [c031a788] ip_rcv+0x38c/0x534
+ [ef84b990] [c0300338] netif_receive_skb+0x260/0x36c
+ [ef84b9c0] [c025de00] sky2_poll+0x5dc/0xcf8
+ [ef84ba20] [c02fb7fc] net_rx_action+0xc0/0x144
+
+The NIC is Yukon-2 EC chip revision 1.
+
+Converting checksum field from le16 to CPU byte order fixes the issue.
+
+Signed-off-by: Anton Vorontsov <avorontsov@ru.mvista.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/net/sky2.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/sky2.c
++++ b/drivers/net/sky2.c
+@@ -2441,7 +2441,7 @@ static int sky2_status_intr(struct sky2_
+ if (likely(status >> 16 == (status & 0xffff))) {
+ skb = sky2->rx_ring[sky2->rx_next].skb;
+ skb->ip_summed = CHECKSUM_COMPLETE;
+- skb->csum = status & 0xffff;
++ skb->csum = le16_to_cpu(status);
+ } else {
+ printk(KERN_NOTICE PFX "%s: hardware receive "
+ "checksum problem (status = %#x)\n",
+
+
+From gregkh@mini.kroah.org Thu Aug 13 12:51:25 2009
+Message-Id: <20090813195125.508950830@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 13 Aug 2009 12:49:41 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ David Brownell <dbrownell@users.sourceforge.net>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [patch 06/74] usbnet cdc_subset: fix issues talking to PXA gadgets
+References: <20090813194935.985368088@mini.kroah.org>
+Content-Disposition: inline; filename=usbnet-cdc_subset-fix-issues-talking-to-pxa-gadgets.patch
+Content-Length: 1378
+Lines: 36
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: David Brownell <dbrownell@users.sourceforge.net>
+
+[ Upstream commit 6be832529a8129c9d90a1d3a78c5d503a710b6fc ]
+
+The host-side CDC subset driver is binding more specifically
+than it should ... only to PXA 210/25x/26x Linux-USB gadgets.
+
+Loosen that restriction to match the gadget driver driver.
+This will various PXA 27x and PXA 3xx devices happier when
+talking to Linux hosts, potentially others.
+
+Signed-off-by: David Brownell <dbrownell@users.sourceforge.net>
+Tested-by: Aric D. Blumer <aric@sdgsystems.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/net/usb/cdc_subset.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/usb/cdc_subset.c
++++ b/drivers/net/usb/cdc_subset.c
+@@ -307,9 +307,10 @@ static const struct usb_device_id produc
+ USB_DEVICE (0x1286, 0x8001), // "blob" bootloader
+ .driver_info = (unsigned long) &blob_info,
+ }, {
+- // Linux Ethernet/RNDIS gadget on pxa210/25x/26x, second config
+- // e.g. Gumstix, current OpenZaurus, ...
+- USB_DEVICE_VER (0x0525, 0xa4a2, 0x0203, 0x0203),
++ // Linux Ethernet/RNDIS gadget, mostly on PXA, second config
++ // e.g. Gumstix, current OpenZaurus, ... or anything else
++ // that just enables this gadget option.
++ USB_DEVICE (0x0525, 0xa4a2),
+ .driver_info = (unsigned long) &linuxdev_info,
+ },
+ #endif
+
+
+From gregkh@mini.kroah.org Thu Aug 13 12:51:25 2009
+Message-Id: <20090813195125.668127635@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 13 Aug 2009 12:49:42 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Eric Dumazet <eric.dumazet@gmail.com>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [patch 07/74] net: sk_prot_alloc() should not blindly overwrite memory
+References: <20090813194935.985368088@mini.kroah.org>
+Content-Disposition: inline; filename=net-sk_prot_alloc-should-not-blindly-overwrite-memory.patch
+Content-Length: 1509
+Lines: 48
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Eric Dumazet <eric.dumazet@gmail.com>
+
+[ Upstream commit e912b1142be8f1e2c71c71001dc992c6e5eb2ec1 ]
+
+Some sockets use SLAB_DESTROY_BY_RCU, and our RCU code correctness
+depends on sk->sk_nulls_node.next being always valid. A NULL
+value is not allowed as it might fault a lockless reader.
+
+Current sk_prot_alloc() implementation doesnt respect this hypothesis,
+calling kmem_cache_alloc() with __GFP_ZERO. Just call memset() around
+the forbidden field.
+
+Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/core/sock.c | 19 +++++++++++++++++--
+ 1 file changed, 17 insertions(+), 2 deletions(-)
+
+--- a/net/core/sock.c
++++ b/net/core/sock.c
+@@ -935,8 +935,23 @@ static struct sock *sk_prot_alloc(struct
+ struct kmem_cache *slab;
+
+ slab = prot->slab;
+- if (slab != NULL)
+- sk = kmem_cache_alloc(slab, priority);
++ if (slab != NULL) {
++ sk = kmem_cache_alloc(slab, priority & ~__GFP_ZERO);
++ if (!sk)
++ return sk;
++ if (priority & __GFP_ZERO) {
++ /*
++ * caches using SLAB_DESTROY_BY_RCU should let
++ * sk_node.next un-modified. Special care is taken
++ * when initializing object to zero.
++ */
++ if (offsetof(struct sock, sk_node.next) != 0)
++ memset(sk, 0, offsetof(struct sock, sk_node.next));
++ memset(&sk->sk_node.pprev, 0,
++ prot->obj_size - offsetof(struct sock,
++ sk_node.pprev));
++ }
++ }
+ else
+ sk = kmalloc(prot->obj_size, priority);
+
+
+
+From gregkh@mini.kroah.org Thu Aug 13 12:51:25 2009
+Message-Id: <20090813195125.796359983@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 13 Aug 2009 12:49:43 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Eric Dumazet <eric.dumazet@gmail.com>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [patch 08/74] net: sock_copy() fixes
+References: <20090813194935.985368088@mini.kroah.org>
+Content-Disposition: inline; filename=net-sock_copy-fixes.patch
+Content-Length: 5170
+Lines: 149
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Eric Dumazet <eric.dumazet@gmail.com>
+
+[ Upstream commit 4dc6dc7162c08b9965163c9ab3f9375d4adff2c7 ]
+
+Commit e912b1142be8f1e2c71c71001dc992c6e5eb2ec1
+(net: sk_prot_alloc() should not blindly overwrite memory)
+took care of not zeroing whole new socket at allocation time.
+
+sock_copy() is another spot where we should be very careful.
+We should not set refcnt to a non null value, until
+we are sure other fields are correctly setup, or
+a lockless reader could catch this socket by mistake,
+while not fully (re)initialized.
+
+This patch puts sk_node & sk_refcnt to the very beginning
+of struct sock to ease sock_copy() & sk_prot_alloc() job.
+
+We add appropriate smp_wmb() before sk_refcnt initializations
+to match our RCU requirements (changes to sock keys should
+be committed to memory before sk_refcnt setting)
+
+Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ include/net/sock.h | 32 +++++++++++++++++++-------------
+ net/core/sock.c | 20 ++++++++++++++++++--
+ 2 files changed, 37 insertions(+), 15 deletions(-)
+
+--- a/include/net/sock.h
++++ b/include/net/sock.h
+@@ -103,15 +103,15 @@ struct net;
+
+ /**
+ * struct sock_common - minimal network layer representation of sockets
++ * @skc_node: main hash linkage for various protocol lookup tables
++ * @skc_nulls_node: main hash linkage for UDP/UDP-Lite protocol
++ * @skc_refcnt: reference count
++ * @skc_hash: hash value used with various protocol lookup tables
+ * @skc_family: network address family
+ * @skc_state: Connection state
+ * @skc_reuse: %SO_REUSEADDR setting
+ * @skc_bound_dev_if: bound device index if != 0
+- * @skc_node: main hash linkage for various protocol lookup tables
+- * @skc_nulls_node: main hash linkage for UDP/UDP-Lite protocol
+ * @skc_bind_node: bind hash linkage for various protocol lookup tables
+- * @skc_refcnt: reference count
+- * @skc_hash: hash value used with various protocol lookup tables
+ * @skc_prot: protocol handlers inside a network family
+ * @skc_net: reference to the network namespace of this socket
+ *
+@@ -119,17 +119,21 @@ struct net;
+ * for struct sock and struct inet_timewait_sock.
+ */
+ struct sock_common {
+- unsigned short skc_family;
+- volatile unsigned char skc_state;
+- unsigned char skc_reuse;
+- int skc_bound_dev_if;
++ /*
++ * first fields are not copied in sock_copy()
++ */
+ union {
+ struct hlist_node skc_node;
+ struct hlist_nulls_node skc_nulls_node;
+ };
+- struct hlist_node skc_bind_node;
+ atomic_t skc_refcnt;
++
+ unsigned int skc_hash;
++ unsigned short skc_family;
++ volatile unsigned char skc_state;
++ unsigned char skc_reuse;
++ int skc_bound_dev_if;
++ struct hlist_node skc_bind_node;
+ struct proto *skc_prot;
+ #ifdef CONFIG_NET_NS
+ struct net *skc_net;
+@@ -207,15 +211,17 @@ struct sock {
+ * don't add nothing before this first member (__sk_common) --acme
+ */
+ struct sock_common __sk_common;
++#define sk_node __sk_common.skc_node
++#define sk_nulls_node __sk_common.skc_nulls_node
++#define sk_refcnt __sk_common.skc_refcnt
++
++#define sk_copy_start __sk_common.skc_hash
++#define sk_hash __sk_common.skc_hash
+ #define sk_family __sk_common.skc_family
+ #define sk_state __sk_common.skc_state
+ #define sk_reuse __sk_common.skc_reuse
+ #define sk_bound_dev_if __sk_common.skc_bound_dev_if
+-#define sk_node __sk_common.skc_node
+-#define sk_nulls_node __sk_common.skc_nulls_node
+ #define sk_bind_node __sk_common.skc_bind_node
+-#define sk_refcnt __sk_common.skc_refcnt
+-#define sk_hash __sk_common.skc_hash
+ #define sk_prot __sk_common.skc_prot
+ #define sk_net __sk_common.skc_net
+ unsigned char sk_shutdown : 2,
+--- a/net/core/sock.c
++++ b/net/core/sock.c
+@@ -915,13 +915,19 @@ static inline void sock_lock_init(struct
+ af_family_keys + sk->sk_family);
+ }
+
++/*
++ * Copy all fields from osk to nsk but nsk->sk_refcnt must not change yet,
++ * even temporarly, because of RCU lookups. sk_node should also be left as is.
++ */
+ static void sock_copy(struct sock *nsk, const struct sock *osk)
+ {
+ #ifdef CONFIG_SECURITY_NETWORK
+ void *sptr = nsk->sk_security;
+ #endif
+-
+- memcpy(nsk, osk, osk->sk_prot->obj_size);
++ BUILD_BUG_ON(offsetof(struct sock, sk_copy_start) !=
++ sizeof(osk->sk_node) + sizeof(osk->sk_refcnt));
++ memcpy(&nsk->sk_copy_start, &osk->sk_copy_start,
++ osk->sk_prot->obj_size - offsetof(struct sock, sk_copy_start));
+ #ifdef CONFIG_SECURITY_NETWORK
+ nsk->sk_security = sptr;
+ security_sk_clone(osk, nsk);
+@@ -1118,6 +1124,11 @@ struct sock *sk_clone(const struct sock
+
+ newsk->sk_err = 0;
+ newsk->sk_priority = 0;
++ /*
++ * Before updating sk_refcnt, we must commit prior changes to memory
++ * (Documentation/RCU/rculist_nulls.txt for details)
++ */
++ smp_wmb();
+ atomic_set(&newsk->sk_refcnt, 2);
+
+ /*
+@@ -1809,6 +1820,11 @@ void sock_init_data(struct socket *sock,
+
+ sk->sk_stamp = ktime_set(-1L, 0);
+
++ /*
++ * Before updating sk_refcnt, we must commit prior changes to memory
++ * (Documentation/RCU/rculist_nulls.txt for details)
++ */
++ smp_wmb();
+ atomic_set(&sk->sk_refcnt, 1);
+ atomic_set(&sk->sk_drops, 0);
+ }
+
+
+From gregkh@mini.kroah.org Thu Aug 13 12:51:26 2009
+Message-Id: <20090813195125.923244268@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 13 Aug 2009 12:49:44 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Herbert Xu <herbert@gondor.apana.org.au>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [patch 09/74] gro: Flush GRO packets in napi_disable_pending path
+References: <20090813194935.985368088@mini.kroah.org>
+Content-Disposition: inline; filename=gro-flush-gro-packets-in-napi_disable_pending-path.patch
+Content-Length: 1253
+Lines: 39
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Herbert Xu <herbert@gondor.apana.org.au>
+
+[ Upstream commit ff780cd8f2fa928b193554f593b36d1243554212 ]
+
+When NAPI is disabled while we're in net_rx_action, we end up
+calling __napi_complete without flushing GRO packets. This is
+a bug as it would cause the GRO packets to linger, of course it
+also literally BUGs to catch error like this :)
+
+This patch changes it to napi_complete, with the obligatory IRQ
+reenabling. This should be safe because we've only just disabled
+IRQs and it does not materially affect the test conditions in
+between.
+
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/core/dev.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -2788,9 +2788,11 @@ static void net_rx_action(struct softirq
+ * move the instance around on the list at-will.
+ */
+ if (unlikely(work == weight)) {
+- if (unlikely(napi_disable_pending(n)))
+- __napi_complete(n);
+- else
++ if (unlikely(napi_disable_pending(n))) {
++ local_irq_enable();
++ napi_complete(n);
++ local_irq_disable();
++ } else
+ list_move_tail(&n->poll_list, list);
+ }
+
+
+
+From gregkh@mini.kroah.org Thu Aug 13 12:51:26 2009
+Message-Id: <20090813195126.055293320@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 13 Aug 2009 12:49:45 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Herbert Xu <herbert@gondor.apana.org.au>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [patch 10/74] gso: Stop fraglists from escaping
+References: <20090813194935.985368088@mini.kroah.org>
+Content-Disposition: inline; filename=gso-stop-fraglists-from-escaping.patch
+Content-Length: 1614
+Lines: 47
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Herbert Xu <herbert@gondor.apana.org.au>
+
+[ Upstream commit 278b2513f76161a9cf1ebddd620dc9d1714fe573 ]
+
+As it stands skb fraglists can get past the check in dev_queue_xmit
+if the skb is marked as GSO. In particular, if the packet doesn't
+have the proper checksums for GSO, but can otherwise be handled by
+the underlying device, we will not perform the fraglist check on it
+at all.
+
+If the underlying device cannot handle fraglists, then this will
+break.
+
+The fix is as simple as moving the fraglist check from the device
+check into skb_gso_ok.
+
+This has caused crashes with Xen when used together with GRO which
+can generate GSO packets with fraglists.
+
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ include/linux/netdevice.h | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+--- a/include/linux/netdevice.h
++++ b/include/linux/netdevice.h
+@@ -1856,15 +1856,14 @@ static inline int net_gso_ok(int feature
+
+ static inline int skb_gso_ok(struct sk_buff *skb, int features)
+ {
+- return net_gso_ok(features, skb_shinfo(skb)->gso_type);
++ return net_gso_ok(features, skb_shinfo(skb)->gso_type) &&
++ (!skb_shinfo(skb)->frag_list || (features & NETIF_F_FRAGLIST));
+ }
+
+ static inline int netif_needs_gso(struct net_device *dev, struct sk_buff *skb)
+ {
+ return skb_is_gso(skb) &&
+ (!skb_gso_ok(skb, dev->features) ||
+- (skb_shinfo(skb)->frag_list &&
+- !(dev->features & NETIF_F_FRAGLIST)) ||
+ unlikely(skb->ip_summed != CHECKSUM_PARTIAL));
+ }
+
+
+
+From gregkh@mini.kroah.org Thu Aug 13 12:51:26 2009
+Message-Id: <20090813195126.188943619@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 13 Aug 2009 12:49:46 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Herbert Xu <herbert@gondor.apana.org.au>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [patch 11/74] net: Move rx skb_orphan call to where needed
+References: <20090813194935.985368088@mini.kroah.org>
+Content-Disposition: inline; filename=net-move-rx-skb_orphan-call-to-where-needed.patch
+Content-Length: 3381
+Lines: 102
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Herbert Xu <herbert@gondor.apana.org.au>
+
+[ Upstream commit 329c44e3948473916bccd253a37ac2a66dad9862 ]
+
+In order to get the tun driver to account packets, we need to be
+able to receive packets with destructors set. To be on the safe
+side, I added an skb_orphan call for all protocols by default since
+some of them (IP in particular) cannot handle receiving packets
+destructors properly.
+
+Now it seems that at least one protocol (CAN) expects to be able
+to pass skb->sk through the rx path without getting clobbered.
+
+So this patch attempts to fix this properly by moving the skb_orphan
+call to where it's actually needed. In particular, I've added it
+to skb_set_owner_[rw] which is what most users of skb->destructor
+call.
+
+This is actually an improvement for tun too since it means that
+we only give back the amount charged to the socket when the skb
+is passed to another socket that will also be charged accordingly.
+
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Tested-by: Oliver Hartkopp <olver@hartkopp.net>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ include/net/sctp/sctp.h | 1 +
+ include/net/sock.h | 2 ++
+ net/ax25/ax25_in.c | 3 +--
+ net/core/dev.c | 2 --
+ net/irda/af_irda.c | 3 ---
+ net/irda/ircomm/ircomm_lmp.c | 1 +
+ 6 files changed, 5 insertions(+), 7 deletions(-)
+
+--- a/include/net/sctp/sctp.h
++++ b/include/net/sctp/sctp.h
+@@ -448,6 +448,7 @@ static inline void sctp_skb_set_owner_r(
+ {
+ struct sctp_ulpevent *event = sctp_skb2event(skb);
+
++ skb_orphan(skb);
+ skb->sk = sk;
+ skb->destructor = sctp_sock_rfree;
+ atomic_add(event->rmem_len, &sk->sk_rmem_alloc);
+--- a/include/net/sock.h
++++ b/include/net/sock.h
+@@ -1231,6 +1231,8 @@ static inline void skb_set_owner_w(struc
+
+ static inline void skb_set_owner_r(struct sk_buff *skb, struct sock *sk)
+ {
++ skb_orphan(skb);
++ skb_orphan(skb);
+ skb->sk = sk;
+ skb->destructor = sock_rfree;
+ atomic_add(skb->truesize, &sk->sk_rmem_alloc);
+--- a/net/ax25/ax25_in.c
++++ b/net/ax25/ax25_in.c
+@@ -437,8 +437,7 @@ free:
+ int ax25_kiss_rcv(struct sk_buff *skb, struct net_device *dev,
+ struct packet_type *ptype, struct net_device *orig_dev)
+ {
+- skb->sk = NULL; /* Initially we don't know who it's for */
+- skb->destructor = NULL; /* Who initializes this, dammit?! */
++ skb_orphan(skb);
+
+ if (!net_eq(dev_net(dev), &init_net)) {
+ kfree_skb(skb);
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -2284,8 +2284,6 @@ ncls:
+ if (!skb)
+ goto out;
+
+- skb_orphan(skb);
+-
+ type = skb->protocol;
+ list_for_each_entry_rcu(ptype,
+ &ptype_base[ntohs(type) & PTYPE_HASH_MASK], list) {
+--- a/net/irda/af_irda.c
++++ b/net/irda/af_irda.c
+@@ -913,9 +913,6 @@ static int irda_accept(struct socket *so
+ /* Clean up the original one to keep it in listen state */
+ irttp_listen(self->tsap);
+
+- /* Wow ! What is that ? Jean II */
+- skb->sk = NULL;
+- skb->destructor = NULL;
+ kfree_skb(skb);
+ sk->sk_ack_backlog--;
+
+--- a/net/irda/ircomm/ircomm_lmp.c
++++ b/net/irda/ircomm/ircomm_lmp.c
+@@ -196,6 +196,7 @@ static int ircomm_lmp_data_request(struc
+ /* Don't forget to refcount it - see ircomm_tty_do_softint() */
+ skb_get(skb);
+
++ skb_orphan(skb);
+ skb->destructor = ircomm_lmp_flow_control;
+
+ if ((self->pkt_count++ > 7) && (self->flow_status == FLOW_START)) {
+
+
+From gregkh@mini.kroah.org Thu Aug 13 12:51:26 2009
+Message-Id: <20090813195126.321194634@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 13 Aug 2009 12:49:47 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Herbert Xu <herbert@gondor.apana.org.au>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [patch 12/74] inet: Call skb_orphan before tproxy activates
+References: <20090813194935.985368088@mini.kroah.org>
+Content-Disposition: inline; filename=inet-call-skb_orphan-before-tproxy-activates.patch
+Content-Length: 1306
+Lines: 42
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Herbert Xu <herbert@gondor.apana.org.au>
+
+[ Upstream commit 71f9dacd2e4d233029e9e956ca3f79531f411827 ]
+
+As transparent proxying looks up the socket early and assigns
+it to the skb for later processing, we must drop any existing
+socket ownership prior to that in order to distinguish between
+the case where tproxy is active and where it is not.
+
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/ipv4/ip_input.c | 3 +++
+ net/ipv6/ip6_input.c | 3 +++
+ 2 files changed, 6 insertions(+)
+
+--- a/net/ipv4/ip_input.c
++++ b/net/ipv4/ip_input.c
+@@ -437,6 +437,9 @@ int ip_rcv(struct sk_buff *skb, struct n
+ /* Remove any debris in the socket control block */
+ memset(IPCB(skb), 0, sizeof(struct inet_skb_parm));
+
++ /* Must drop socket now because of tproxy. */
++ skb_orphan(skb);
++
+ return NF_HOOK(PF_INET, NF_INET_PRE_ROUTING, skb, dev, NULL,
+ ip_rcv_finish);
+
+--- a/net/ipv6/ip6_input.c
++++ b/net/ipv6/ip6_input.c
+@@ -139,6 +139,9 @@ int ipv6_rcv(struct sk_buff *skb, struct
+
+ rcu_read_unlock();
+
++ /* Must drop socket now because of tproxy. */
++ skb_orphan(skb);
++
+ return NF_HOOK(PF_INET6, NF_INET_PRE_ROUTING, skb, dev, NULL,
+ ip6_rcv_finish);
+ err:
+
+
+From gregkh@mini.kroah.org Thu Aug 13 12:51:26 2009
+Message-Id: <20090813195126.482792691@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 13 Aug 2009 12:49:48 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Eric Anholt <eric@anholt.net>
+Subject: [patch 13/74] drm/i915: Save/restore cursor state on suspend/resume.
+References: <20090813194935.985368088@mini.kroah.org>
+Content-Disposition: inline; filename=drm-i915-save-restore-cursor-state-on-suspend-resume.patch
+Content-Length: 2614
+Lines: 79
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Eric Anholt <eric@anholt.net>
+
+(cherry picked from commit 1fd1c624362819ecc36db2458c6a972c48ae92d6)
+
+This may fix cursor corruption in X on resume, which would persist until
+the cursor was hidden and then shown again.
+
+V2: Also include the cursor control regs.
+
+Signed-off-by: Eric Anholt <eric@anholt.net>
+Reviewed-by: Jesse Barnes <jbarnes@virtuousgeek.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/i915/i915_drv.h | 8 ++++++++
+ drivers/gpu/drm/i915/i915_suspend.c | 20 ++++++++++++++++++++
+ 2 files changed, 28 insertions(+)
+
+--- a/drivers/gpu/drm/i915/i915_drv.h
++++ b/drivers/gpu/drm/i915/i915_drv.h
+@@ -285,6 +285,13 @@ typedef struct drm_i915_private {
+ u8 saveDACMASK;
+ u8 saveCR[37];
+ uint64_t saveFENCE[16];
++ u32 saveCURACNTR;
++ u32 saveCURAPOS;
++ u32 saveCURABASE;
++ u32 saveCURBCNTR;
++ u32 saveCURBPOS;
++ u32 saveCURBBASE;
++ u32 saveCURSIZE;
+
+ struct {
+ struct drm_mm gtt_space;
+@@ -642,6 +649,7 @@ void i915_gem_detach_phys_object(struct
+ void i915_gem_free_all_phys_object(struct drm_device *dev);
+ int i915_gem_object_get_pages(struct drm_gem_object *obj);
+ void i915_gem_object_put_pages(struct drm_gem_object *obj);
++void i915_gem_release(struct drm_device * dev, struct drm_file *file_priv);
+
+ /* i915_gem_tiling.c */
+ void i915_gem_detect_bit_6_swizzle(struct drm_device *dev);
+--- a/drivers/gpu/drm/i915/i915_suspend.c
++++ b/drivers/gpu/drm/i915/i915_suspend.c
+@@ -295,6 +295,16 @@ int i915_save_state(struct drm_device *d
+ i915_save_palette(dev, PIPE_B);
+ dev_priv->savePIPEBSTAT = I915_READ(PIPEBSTAT);
+
++ /* Cursor state */
++ dev_priv->saveCURACNTR = I915_READ(CURACNTR);
++ dev_priv->saveCURAPOS = I915_READ(CURAPOS);
++ dev_priv->saveCURABASE = I915_READ(CURABASE);
++ dev_priv->saveCURBCNTR = I915_READ(CURBCNTR);
++ dev_priv->saveCURBPOS = I915_READ(CURBPOS);
++ dev_priv->saveCURBBASE = I915_READ(CURBBASE);
++ if (!IS_I9XX(dev))
++ dev_priv->saveCURSIZE = I915_READ(CURSIZE);
++
+ /* CRT state */
+ dev_priv->saveADPA = I915_READ(ADPA);
+
+@@ -480,6 +490,16 @@ int i915_restore_state(struct drm_device
+ I915_WRITE(DSPBCNTR, dev_priv->saveDSPBCNTR);
+ I915_WRITE(DSPBADDR, I915_READ(DSPBADDR));
+
++ /* Cursor state */
++ I915_WRITE(CURAPOS, dev_priv->saveCURAPOS);
++ I915_WRITE(CURACNTR, dev_priv->saveCURACNTR);
++ I915_WRITE(CURABASE, dev_priv->saveCURABASE);
++ I915_WRITE(CURBPOS, dev_priv->saveCURBPOS);
++ I915_WRITE(CURBCNTR, dev_priv->saveCURBCNTR);
++ I915_WRITE(CURBBASE, dev_priv->saveCURBBASE);
++ if (!IS_I9XX(dev))
++ I915_WRITE(CURSIZE, dev_priv->saveCURSIZE);
++
+ /* CRT state */
+ I915_WRITE(ADPA, dev_priv->saveADPA);
+
+
+
+From gregkh@mini.kroah.org Thu Aug 13 12:51:26 2009
+Message-Id: <20090813195126.652068054@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 13 Aug 2009 12:49:49 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jarod Wilson <jarod@redhat.com>,
+ Florian Demmer <florian@demmer.org>,
+ Eric Anholt <eric@anholt.net>
+Subject: [patch 14/74] drm/i915: add ignore lvds quirk info for AOpen Mini PC
+References: <20090813194935.985368088@mini.kroah.org>
+Content-Disposition: inline; filename=0001-drm-i915-add-ignore-lvds-quirk-info-for-AOpen-Mini-P.patch
+Content-Length: 1043
+Lines: 36
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Jarod Wilson <jarod@redhat.com>
+
+(cherry picked from commit 70aa96ca2d8d938fc036ef8fd189b0151f4fc3ba)
+
+Fix a FIXME in the intel LVDS bring-up code, adding the appropriate
+blacklist entry for the AOpen Mini PC, courtesy of a dmidecode
+dump from Florian Demmer.
+
+Signed-off-by: Jarod Wilson <jarod@redhat.com>
+CC: Florian Demmer <florian@demmer.org>
+Signed-off-by: Eric Anholt <eric@anholt.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/gpu/drm/i915/intel_lvds.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/i915/intel_lvds.c
++++ b/drivers/gpu/drm/i915/intel_lvds.c
+@@ -420,8 +420,14 @@ static const struct dmi_system_id intel_
+ DMI_MATCH(DMI_PRODUCT_NAME, "Studio Hybrid 140g"),
+ },
+ },
+-
+- /* FIXME: add a check for the Aopen Mini PC */
++ {
++ .callback = intel_no_lvds_dmi_callback,
++ .ident = "AOpen Mini PC",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "AOpen"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "i965GMx-IF"),
++ },
++ },
+
+ { } /* terminating entry */
+ };
+
+
+From gregkh@mini.kroah.org Thu Aug 13 12:51:26 2009
+Message-Id: <20090813195126.779209273@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 13 Aug 2009 12:49:50 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jesse Barnes <jbarnes@virtuousgeek.org>,
+ Eric Anholt <eric@anholt.net>
+Subject: [patch 15/74] drm/i915: apply G45 vblank count code to all G4x chips and fix max_frame_count
+References: <20090813194935.985368088@mini.kroah.org>
+Content-Disposition: inline; filename=0002-drm-i915-apply-G45-vblank-count-code-to-all-G4x-chip.patch
+Content-Length: 1422
+Lines: 42
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Jesse Barnes <jbarnes@virtuousgeek.org>
+
+(cherry picked from commit 42c2798b35b95c471877133e19ccc3cab00e9b65)
+
+All G4x and newer chips use the new style frame count register, with a
+full 32 bit frame count. Update the code to reflect this.
+
+Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
+Signed-off-by: Eric Anholt <eric@anholt.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/gpu/drm/i915/i915_dma.c | 5 ++++-
+ drivers/gpu/drm/i915/i915_irq.c | 2 --
+ 2 files changed, 4 insertions(+), 3 deletions(-)
+
+--- a/drivers/gpu/drm/i915/i915_dma.c
++++ b/drivers/gpu/drm/i915/i915_dma.c
+@@ -1153,8 +1153,11 @@ int i915_driver_load(struct drm_device *
+ #endif
+
+ dev->driver->get_vblank_counter = i915_get_vblank_counter;
+- if (IS_GM45(dev))
++ dev->max_vblank_count = 0xffffff; /* only 24 bits of frame count */
++ if (IS_G4X(dev)) {
++ dev->max_vblank_count = 0xffffffff; /* full 32 bit counter */
+ dev->driver->get_vblank_counter = gm45_get_vblank_counter;
++ }
+
+ i915_gem_load(dev);
+
+--- a/drivers/gpu/drm/i915/i915_irq.c
++++ b/drivers/gpu/drm/i915/i915_irq.c
+@@ -572,8 +572,6 @@ int i915_driver_irq_postinstall(struct d
+
+ dev_priv->vblank_pipe = DRM_I915_VBLANK_PIPE_A | DRM_I915_VBLANK_PIPE_B;
+
+- dev->max_vblank_count = 0xffffff; /* only 24 bits of frame count */
+-
+ /* Unmask the interrupts that we always want on. */
+ dev_priv->irq_mask_reg = ~I915_INTERRUPT_ENABLE_FIX;
+
+
+
+From gregkh@mini.kroah.org Thu Aug 13 12:51:27 2009
+Message-Id: <20090813195126.920965349@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 13 Aug 2009 12:49:51 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jesse Barnes <jbarnes@virtuousgeek.org>,
+ Eric Anholt <eric@anholt.net>
+Subject: [patch 16/74] drm/i915: avoid non-atomic sysrq execution
+References: <20090813194935.985368088@mini.kroah.org>
+Content-Disposition: inline; filename=0003-drm-i915-avoid-non-atomic-sysrq-execution.patch
+Content-Length: 1113
+Lines: 37
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Jesse Barnes <jbarnes@virtuousgeek.org>
+
+(cherry picked from commit b66d18ddb16603d1e1ec39cb2ff3abf3fd212180)
+
+The sysrq functions are executed in hardirq context, so we shouldn't be
+calling sleeping functions from them, like mutex_locks or memory
+allocations.
+
+Fix up the i915 sysrq handler to avoid this.
+
+Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
+Signed-off-by: Eric Anholt <eric@anholt.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/gpu/drm/i915/intel_fb.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/i915/intel_fb.c
++++ b/drivers/gpu/drm/i915/intel_fb.c
+@@ -857,9 +857,15 @@ void intelfb_restore(void)
+ drm_crtc_helper_set_config(&kernelfb_mode);
+ }
+
++static void intelfb_restore_work_fn(struct work_struct *ignored)
++{
++ intelfb_restore();
++}
++static DECLARE_WORK(intelfb_restore_work, intelfb_restore_work_fn);
++
+ static void intelfb_sysrq(int dummy1, struct tty_struct *dummy3)
+ {
+- intelfb_restore();
++ schedule_work(&intelfb_restore_work);
+ }
+
+ static struct sysrq_key_op sysrq_intelfb_restore_op = {
+
+
+From gregkh@mini.kroah.org Thu Aug 13 12:51:27 2009
+Message-Id: <20090813195127.056965881@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 13 Aug 2009 12:49:52 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Michael Cousin <mika.cousin@gmail.com>,
+ Eric Anholt <eric@anholt.net>
+Subject: [patch 17/74] drm/i915: Skip lvds with Aopen i945GTt-VFA
+References: <20090813194935.985368088@mini.kroah.org>
+Content-Disposition: inline; filename=0004-drm-i915-Skip-lvds-with-Aopen-i945GTt-VFA.patch
+Content-Length: 746
+Lines: 28
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Michael Cousin <mika.cousin@gmail.com
+
+(cherry picked from commit fa0864b26b4bfa1dd4bb78eeffbc1f398cb56425)
+
+Signed-off-by: Michael Cousin <mika.cousin@gmail.com>
+Signed-off-by: Eric Anholt <eric@anholt.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/gpu/drm/i915/intel_lvds.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/gpu/drm/i915/intel_lvds.c
++++ b/drivers/gpu/drm/i915/intel_lvds.c
+@@ -428,6 +428,13 @@ static const struct dmi_system_id intel_
+ DMI_MATCH(DMI_PRODUCT_NAME, "i965GMx-IF"),
+ },
+ },
++ {
++ .callback = intel_no_lvds_dmi_callback,
++ .ident = "Aopen i945GTt-VFA",
++ .matches = {
++ DMI_MATCH(DMI_PRODUCT_VERSION, "AO00001JW"),
++ },
++ },
+
+ { } /* terminating entry */
+ };
+
+
+From gregkh@mini.kroah.org Thu Aug 13 12:51:27 2009
+Message-Id: <20090813195127.189458281@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 13 Aug 2009 12:49:53 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Keith Packard <keithp@keithp.com>,
+ Eric Anholt <eric@anholt.net>
+Subject: [patch 18/74] drm/i915: Hook connector to encoder during load detection (fixes tv/vga detect)
+References: <20090813194935.985368088@mini.kroah.org>
+Content-Disposition: inline; filename=0005-drm-i915-Hook-connector-to-encoder-during-load-detec.patch
+Content-Length: 1140
+Lines: 34
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Keith Packard <keithp@keithp.com>
+
+(cherry picked from commit 03d6069912babc07a3da20e715dd6a5dc8f0f867)
+
+With the DRM-driven DPMS code, encoders are considered idle unless a
+connector is hooked to them, so mode setting is skipped. This makes load
+detection fail as none of the hardware is enabled.
+
+Signed-off-by: Keith Packard <keithp@keithp.com>
+Signed-off-by: Eric Anholt <eric@anholt.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/gpu/drm/i915/intel_display.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -1590,6 +1590,7 @@ struct drm_crtc *intel_get_load_detect_p
+ }
+
+ encoder->crtc = crtc;
++ intel_output->base.encoder = encoder;
+ intel_output->load_detect_temp = true;
+
+ intel_crtc = to_intel_crtc(crtc);
+@@ -1625,6 +1626,7 @@ void intel_release_load_detect_pipe(stru
+
+ if (intel_output->load_detect_temp) {
+ encoder->crtc = NULL;
++ intel_output->base.encoder = NULL;
+ intel_output->load_detect_temp = false;
+ crtc->enabled = drm_helper_crtc_in_use(crtc);
+ drm_helper_disable_unused_functions(dev);
+
+
+From gregkh@mini.kroah.org Thu Aug 13 12:51:27 2009
+Message-Id: <20090813195127.336139759@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 13 Aug 2009 12:49:54 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ =?ISO-8859-15?q?Gr=C3=A9goire=20Henry?= <henry@pps.jussieu.fr>,
+ Eric Anholt <eric@anholt.net>
+Subject: [patch 19/74] drm/i915: initialize fence registers to zero when loading GEM
+References: <20090813194935.985368088@mini.kroah.org>
+Content-Disposition: inline; filename=0006-drm-i915-initialize-fence-registers-to-zero-when-loa.patch
+Content-Length: 1366
+Lines: 47
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Grégoire Henry <henry@pps.jussieu.fr>
+
+(cherry picked from commit b5aa8a0fc132dd512c33e7c2621d075e3b77a65e)
+
+Unitialized fence register could leads to corrupted display. Problem
+encountered on MacBooks (revision 1 and 2), directly booting from EFI
+or through BIOS emulation.
+
+(bug #21710 at freedestop.org)
+
+Signed-off-by: Grégoire Henry <henry@pps.jussieu.fr>
+Signed-off-by: Eric Anholt <eric@anholt.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/gpu/drm/i915/i915_gem.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+--- a/drivers/gpu/drm/i915/i915_gem.c
++++ b/drivers/gpu/drm/i915/i915_gem.c
+@@ -4154,6 +4154,7 @@ i915_gem_lastclose(struct drm_device *de
+ void
+ i915_gem_load(struct drm_device *dev)
+ {
++ int i;
+ drm_i915_private_t *dev_priv = dev->dev_private;
+
+ spin_lock_init(&dev_priv->mm.active_list_lock);
+@@ -4173,6 +4174,18 @@ i915_gem_load(struct drm_device *dev)
+ else
+ dev_priv->num_fence_regs = 8;
+
++ /* Initialize fence registers to zero */
++ if (IS_I965G(dev)) {
++ for (i = 0; i < 16; i++)
++ I915_WRITE64(FENCE_REG_965_0 + (i * 8), 0);
++ } else {
++ for (i = 0; i < 8; i++)
++ I915_WRITE(FENCE_REG_830_0 + (i * 4), 0);
++ if (IS_I945G(dev) || IS_I945GM(dev) || IS_G33(dev))
++ for (i = 0; i < 8; i++)
++ I915_WRITE(FENCE_REG_945_8 + (i * 4), 0);
++ }
++
+ i915_gem_detect_bit_6_swizzle(dev);
+ }
+
+
+
+From gregkh@mini.kroah.org Thu Aug 13 12:51:27 2009
+Message-Id: <20090813195127.465882440@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 13 Aug 2009 12:49:55 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Ma Ling <ling.ma@intel.com>,
+ Eric Anholt <eric@anholt.net>
+Subject: [patch 20/74] drm/i915: Set SSC frequency for 8xx chips correctly
+References: <20090813194935.985368088@mini.kroah.org>
+Content-Disposition: inline; filename=0007-drm-i915-Set-SSC-frequency-for-8xx-chips-correctly.patch
+Content-Length: 1043
+Lines: 34
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Ma Ling <ling.ma@intel.com>
+
+(cherry picked from commit 6ff4fd05676bc5b5c930bef25901e489f7843660)
+
+All 8xx class chips have the 66/48 split, not just 855.
+
+Signed-off-by: Ma Ling <ling.ma@intel.com>
+Reviewed-by: Jesse Barnes <jbarnes@virtuousgeek.org>
+Signed-off-by: Eric Anholt <eric@anholt.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/gpu/drm/i915/intel_bios.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+--- a/drivers/gpu/drm/i915/intel_bios.c
++++ b/drivers/gpu/drm/i915/intel_bios.c
+@@ -185,10 +185,12 @@ parse_general_features(struct drm_i915_p
+ dev_priv->lvds_use_ssc = general->enable_ssc;
+
+ if (dev_priv->lvds_use_ssc) {
+- if (IS_I855(dev_priv->dev))
+- dev_priv->lvds_ssc_freq = general->ssc_freq ? 66 : 48;
+- else
+- dev_priv->lvds_ssc_freq = general->ssc_freq ? 100 : 96;
++ if (IS_I85X(dev_priv->dev))
++ dev_priv->lvds_ssc_freq =
++ general->ssc_freq ? 66 : 48;
++ else
++ dev_priv->lvds_ssc_freq =
++ general->ssc_freq ? 100 : 96;
+ }
+ }
+ }
+
+
+From gregkh@mini.kroah.org Thu Aug 13 12:51:27 2009
+Message-Id: <20090813195127.628539086@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 13 Aug 2009 12:49:56 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Peter Oberparleiter <oberpar@linux.vnet.ibm.com>
+Subject: [patch 21/74] sysfs: fix hardlink count on device_move
+References: <20090813194935.985368088@mini.kroah.org>
+Content-Disposition: inline; filename=sysfs-fix-hardlink-count-on-device_move.patch
+Content-Length: 1143
+Lines: 36
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Peter Oberparleiter <oberpar@linux.vnet.ibm.com>
+
+commit 0f58b44582001c8bcdb75f36cf85ebbe5170e959 upstream.
+
+Update directory hardlink count when moving kobjects to a new parent.
+Fixes the following problem which occurs when several devices are
+moved to the same parent and then unregistered:
+
+> ls -laF /sys/devices/css0/defunct/
+> total 0
+> drwxr-xr-x 4294967295 root root 0 2009-07-14 17:02 ./
+> drwxr-xr-x 114 root root 0 2009-07-14 17:02 ../
+> drwxr-xr-x 2 root root 0 2009-07-14 17:01 power/
+> -rw-r--r-- 1 root root 4096 2009-07-14 17:01 uevent
+
+Signed-off-by: Peter Oberparleiter <oberpar@linux.vnet.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/sysfs/dir.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/fs/sysfs/dir.c
++++ b/fs/sysfs/dir.c
+@@ -939,8 +939,10 @@ again:
+ /* Remove from old parent's list and insert into new parent's list. */
+ sysfs_unlink_sibling(sd);
+ sysfs_get(new_parent_sd);
++ drop_nlink(old_parent->d_inode);
+ sysfs_put(sd->s_parent);
+ sd->s_parent = new_parent_sd;
++ inc_nlink(new_parent->d_inode);
+ sysfs_link_sibling(sd);
+
+ out_unlock:
+
+
+From gregkh@mini.kroah.org Thu Aug 13 12:51:27 2009
+Message-Id: <20090813195127.776055031@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 13 Aug 2009 12:49:57 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Giacomo Lozito <james@develia.org>,
+ Alan Stern <stern@rowland.harvard.edu>
+Subject: [patch 22/74] USB: storage: raise timeout in usb_stor_Bulk_max_lun
+References: <20090813194935.985368088@mini.kroah.org>
+Content-Disposition: inline; filename=usb-storage-raise-timeout-in-usb_stor_bulk_max_lun.patch
+Content-Length: 1155
+Lines: 33
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Giacomo Lozito <james@develia.org>
+
+commit 7a777919bbeec3eac1d7904a728a60e9c2bb9c67 upstream.
+
+Requests to get max LUN, for certain USB storage devices, require a
+longer timeout before a correct reply is returned. This happens for a
+Realtek USB Card Reader (0bda:0152), which has a max LUN of 3 but is set
+to 0, thus losing functionality, because of the timeout occurring too
+quickly.
+
+Raising the timeout value fixes the issue and might help other devices
+to return a correct max LUN value as well.
+
+Signed-off-by: Giacomo Lozito <james@develia.org>
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/storage/transport.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/storage/transport.c
++++ b/drivers/usb/storage/transport.c
+@@ -961,7 +961,7 @@ int usb_stor_Bulk_max_lun(struct us_data
+ US_BULK_GET_MAX_LUN,
+ USB_DIR_IN | USB_TYPE_CLASS |
+ USB_RECIP_INTERFACE,
+- 0, us->ifnum, us->iobuf, 1, HZ);
++ 0, us->ifnum, us->iobuf, 1, 10*HZ);
+
+ US_DEBUGP("GetMaxLUN command result is %d, data is %d\n",
+ result, us->iobuf[0]);
+
+
+From gregkh@mini.kroah.org Thu Aug 13 12:51:28 2009
+Message-Id: <20090813195127.947446438@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 13 Aug 2009 12:49:58 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Lu Zhihe <tombowfly@gmail.com>,
+ Doug Thompson <dougthompson@xmission.com>
+Subject: [patch 23/74] edac: x38 fix mchbar high register addr
+References: <20090813194935.985368088@mini.kroah.org>
+Content-Disposition: inline; filename=edac-x38-fix-mchbar-high-register-addr.patch
+Content-Length: 919
+Lines: 29
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Lu Zhihe <tombowfly@gmail.com>
+
+commit 3d768213a6c34a27fac1804143da8cf18b8b175f upstream.
+
+Intel X38 MCHBAR is a 64bits register, base from 0x48, so its higher base
+is 0x4C.
+
+Signed-off-by: Lu Zhihe <tombowfly@gmail.com>
+Signed-off-by: Doug Thompson <dougthompson@xmission.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/edac/x38_edac.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/edac/x38_edac.c
++++ b/drivers/edac/x38_edac.c
+@@ -30,7 +30,7 @@
+ /* Intel X38 register addresses - device 0 function 0 - DRAM Controller */
+
+ #define X38_MCHBAR_LOW 0x48 /* MCH Memory Mapped Register BAR */
+-#define X38_MCHBAR_HIGH 0x4b
++#define X38_MCHBAR_HIGH 0x4c
+ #define X38_MCHBAR_MASK 0xfffffc000ULL /* bits 35:14 */
+ #define X38_MMR_WINDOW_SIZE 16384
+
+
+
+From gregkh@mini.kroah.org Thu Aug 13 12:51:28 2009
+Message-Id: <20090813195128.100947730@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 13 Aug 2009 12:49:59 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ John Stoffel <john@stoffel.org>,
+ Jens Axboe <jens.axboe@oracle.com>
+Subject: [patch 24/74] Make SCSI SG v4 driver enabled by default and remove EXPERIMENTAL dependency, since udev depends on BSG
+References: <20090813194935.985368088@mini.kroah.org>
+Content-Disposition: inline; filename=make-scsi-sg-v4-driver-enabled-by-default-and-remove-experimental-dependency-since-udev-depends-on-bsg.patch
+Content-Length: 1286
+Lines: 46
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: John Stoffel <john@stoffel.org>
+
+commit 14d9fa352592582e457cf75022202766baac1348 upstream.
+
+Make Block Layer SG support v4 the default, since recent udev versions
+depend on this to access serial numbers and other low level info properly.
+
+This should be backported to older kernels as well, since most distros have
+enabled this for a long time.
+
+Signed-off-by: John Stoffel <john@stoffel.org>
+Signed-off-by: Jens Axboe <jens.axboe@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ block/Kconfig | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+--- a/block/Kconfig
++++ b/block/Kconfig
+@@ -45,9 +45,9 @@ config LBD
+ If unsure, say N.
+
+ config BLK_DEV_BSG
+- bool "Block layer SG support v4 (EXPERIMENTAL)"
+- depends on EXPERIMENTAL
+- ---help---
++ bool "Block layer SG support v4"
++ default y
++ help
+ Saying Y here will enable generic SG (SCSI generic) v4 support
+ for any block device.
+
+@@ -57,7 +57,10 @@ config BLK_DEV_BSG
+ protocols (e.g. Task Management Functions and SMP in Serial
+ Attached SCSI).
+
+- If unsure, say N.
++ This option is required by recent UDEV versions to properly
++ access device serial numbers, etc.
++
++ If unsure, say Y.
+
+ config BLK_DEV_INTEGRITY
+ bool "Block layer data integrity support"
+
+
+From gregkh@mini.kroah.org Thu Aug 13 12:51:28 2009
+Message-Id: <20090813195128.242130683@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 13 Aug 2009 12:50:00 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Tom Peng <tom_peng@usish.com>,
+ Jack Wang <jack_wang@usish.com>,
+ Lindar Liu <lindar_liu@usish.com>,
+ James Bottomley <James.Bottomley@HansenPartnership.com>
+Subject: [patch 25/74] SCSI: libsas: reuse the original port when hotplugging phys in wide ports
+References: <20090813194935.985368088@mini.kroah.org>
+Content-Disposition: inline; filename=libsas-reuse-the-original-port-when-hotplugging-phys-in-wide-ports.patch
+Content-Length: 2234
+Lines: 62
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Tom Peng <tom_peng@usish.com>
+
+commit 5381837f125cc62ad703fbcdfcd7566fc81fd404 upstream.
+
+There's a hotplug problem in the way libsas allocates ports: it loops over the
+available ports first trying to add to an existing for a wide port and
+otherwise allocating the next free port. This scheme only works if the port
+array is packed from zero, which fails if a port gets hot unplugged and the
+array becomes sparse. In that case, a new port is formed even if there's a
+wide port it should be part of. Fix this by creating two loops over all the
+ports: the first to see if the phy should be part of a wide port and the
+second to form a new port in an empty port slot.
+
+Signed-off-by: Tom Peng <tom_peng@usish.com>
+Signed-off-by: Jack Wang <jack_wang@usish.com>
+Signed-off-by: Lindar Liu <lindar_liu@usish.com>
+Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/scsi/libsas/sas_port.c | 19 +++++++++++++++----
+ 1 file changed, 15 insertions(+), 4 deletions(-)
+
+--- a/drivers/scsi/libsas/sas_port.c
++++ b/drivers/scsi/libsas/sas_port.c
+@@ -56,7 +56,7 @@ static void sas_form_port(struct asd_sas
+ }
+ }
+
+- /* find a port */
++ /* see if the phy should be part of a wide port */
+ spin_lock_irqsave(&sas_ha->phy_port_lock, flags);
+ for (i = 0; i < sas_ha->num_phys; i++) {
+ port = sas_ha->sas_port[i];
+@@ -69,12 +69,23 @@ static void sas_form_port(struct asd_sas
+ SAS_DPRINTK("phy%d matched wide port%d\n", phy->id,
+ port->id);
+ break;
+- } else if (*(u64 *) port->sas_addr == 0 && port->num_phys==0) {
+- memcpy(port->sas_addr, phy->sas_addr, SAS_ADDR_SIZE);
+- break;
+ }
+ spin_unlock(&port->phy_list_lock);
+ }
++ /* The phy does not match any existing port, create a new one */
++ if (i == sas_ha->num_phys) {
++ for (i = 0; i < sas_ha->num_phys; i++) {
++ port = sas_ha->sas_port[i];
++ spin_lock(&port->phy_list_lock);
++ if (*(u64 *)port->sas_addr == 0
++ && port->num_phys == 0) {
++ memcpy(port->sas_addr, phy->sas_addr,
++ SAS_ADDR_SIZE);
++ break;
++ }
++ spin_unlock(&port->phy_list_lock);
++ }
++ }
+
+ if (i >= sas_ha->num_phys) {
+ printk(KERN_NOTICE "%s: couldn't find a free port, bug?\n",
+
+
+From gregkh@mini.kroah.org Thu Aug 13 12:51:28 2009
+Message-Id: <20090813195128.394569326@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 13 Aug 2009 12:50:01 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Igor Mammedov <niallain@gmail.com>,
+ Jeff Layton <jlayton@redhat.com>,
+ Steve French <sfrench@us.ibm.com>
+Subject: [patch 26/74] cifs: fix error handling in mount-time DFS referral chasing code
+References: <20090813194935.985368088@mini.kroah.org>
+Content-Disposition: inline; filename=cifs-fix-error-handling-in-mount-time-dfs-referral-chasing-code.patch
+Content-Length: 2841
+Lines: 95
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Jeff Layton <jlayton@redhat.com>
+
+commit 7b91e2661addd8e2419cb45f6a322aa5dab9bcee upstream.
+
+If the referral is malformed or the hostname can't be resolved, then
+the current code generates an oops. Fix it to handle these errors
+gracefully.
+
+Reported-by: Sandro Mathys <sm@sandro-mathys.ch>
+Acked-by: Igor Mammedov <niallain@gmail.com>
+Signed-off-by: Jeff Layton <jlayton@redhat.com>
+Signed-off-by: Steve French <sfrench@us.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/cifs/cifs_dfs_ref.c | 12 +++++++++---
+ fs/cifs/connect.c | 13 ++++++++++---
+ 2 files changed, 19 insertions(+), 6 deletions(-)
+
+--- a/fs/cifs/cifs_dfs_ref.c
++++ b/fs/cifs/cifs_dfs_ref.c
+@@ -55,7 +55,7 @@ void cifs_dfs_release_automount_timer(vo
+ * i.e. strips from UNC trailing path that is not part of share
+ * name and fixup missing '\' in the begining of DFS node refferal
+ * if neccessary.
+- * Returns pointer to share name on success or NULL on error.
++ * Returns pointer to share name on success or ERR_PTR on error.
+ * Caller is responsible for freeing returned string.
+ */
+ static char *cifs_get_share_name(const char *node_name)
+@@ -68,7 +68,7 @@ static char *cifs_get_share_name(const c
+ UNC = kmalloc(len+2 /*for term null and additional \ if it's missed */,
+ GFP_KERNEL);
+ if (!UNC)
+- return NULL;
++ return ERR_PTR(-ENOMEM);
+
+ /* get share name and server name */
+ if (node_name[1] != '\\') {
+@@ -87,7 +87,7 @@ static char *cifs_get_share_name(const c
+ cERROR(1, ("%s: no server name end in node name: %s",
+ __func__, node_name));
+ kfree(UNC);
+- return NULL;
++ return ERR_PTR(-EINVAL);
+ }
+
+ /* find sharename end */
+@@ -133,6 +133,12 @@ char *cifs_compose_mount_options(const c
+ return ERR_PTR(-EINVAL);
+
+ *devname = cifs_get_share_name(ref->node_name);
++ if (IS_ERR(*devname)) {
++ rc = PTR_ERR(*devname);
++ *devname = NULL;
++ goto compose_mount_options_err;
++ }
++
+ rc = dns_resolve_server_name_to_ip(*devname, &srvIP);
+ if (rc != 0) {
+ cERROR(1, ("%s: Failed to resolve server part of %s to IP: %d",
+--- a/fs/cifs/connect.c
++++ b/fs/cifs/connect.c
+@@ -2563,11 +2563,20 @@ remote_path_check:
+
+ if (mount_data != mount_data_global)
+ kfree(mount_data);
++
+ mount_data = cifs_compose_mount_options(
+ cifs_sb->mountdata, full_path + 1,
+ referrals, &fake_devname);
+- kfree(fake_devname);
++
+ free_dfs_info_array(referrals, num_referrals);
++ kfree(fake_devname);
++ kfree(full_path);
++
++ if (IS_ERR(mount_data)) {
++ rc = PTR_ERR(mount_data);
++ mount_data = NULL;
++ goto mount_fail_check;
++ }
+
+ if (tcon)
+ cifs_put_tcon(tcon);
+@@ -2575,8 +2584,6 @@ remote_path_check:
+ cifs_put_smb_ses(pSesInfo);
+
+ cleanup_volume_info(&volume_info);
+- FreeXid(xid);
+- kfree(full_path);
+ referral_walks_count++;
+ goto try_mount_again;
+ }
+
+
+From gregkh@mini.kroah.org Thu Aug 13 12:51:28 2009
+Message-Id: <20090813195128.556439418@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 13 Aug 2009 12:50:02 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Henrique de Moraes Holschuh <hmh@hmh.eng.br>,
+ Len Brown <len.brown@intel.com>
+Subject: [patch 27/74] thinkpad-acpi: disable broken bay and dock subdrivers
+References: <20090813194935.985368088@mini.kroah.org>
+Content-Disposition: inline; filename=thinkpad-acpi-disable-broken-bay-and-dock-subdrivers.patch
+Content-Length: 1927
+Lines: 53
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Henrique de Moraes Holschuh <hmh@hmh.eng.br>
+
+commit 550e7fd8afb7664ae7cedb398c407694e2bf7d3c upstream.
+
+Currently, the ThinkPad-ACPI bay and dock drivers are completely
+broken, and cause a NULL pointer derreference in kernel mode (and,
+therefore, an OOPS) when they try to issue events (i.e. on dock,
+undock, bay ejection, etc).
+
+OTOH, the standard ACPI dock driver can handle the hotplug bays and
+docks of the ThinkPads just fine (including batteries) as of 2.6.27.
+In fact, it does a much better job of it than thinkpad-acpi ever did.
+
+It is just not worth the hassle to find a way to fix this crap without
+breaking the (deprecated) thinkpad-acpi dock/bay ABI. This is old,
+deprecated code that sees little testing or use.
+
+As a quick fix suitable for -stable backports, mark the thinkpad-acpi
+bay and dock subdrivers as BROKEN in Kconfig. The dead code will be
+removed by a later patch.
+
+This fixes bugzilla #13669, and should be applied to 2.6.27 and later.
+
+Signed-off-by: Henrique de Moraes Holschuh <hmh@hmh.eng.br>
+Reported-by: Joerg Platte <jplatte@naasa.net>
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/platform/x86/Kconfig | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/platform/x86/Kconfig
++++ b/drivers/platform/x86/Kconfig
+@@ -265,6 +265,7 @@ config THINKPAD_ACPI_DOCK
+ bool "Legacy Docking Station Support"
+ depends on THINKPAD_ACPI
+ depends on ACPI_DOCK=n
++ depends on BROKEN
+ default n
+ ---help---
+ Allows the thinkpad_acpi driver to handle docking station events.
+@@ -278,7 +279,8 @@ config THINKPAD_ACPI_DOCK
+ config THINKPAD_ACPI_BAY
+ bool "Legacy Removable Bay Support"
+ depends on THINKPAD_ACPI
+- default y
++ depends on BROKEN
++ default n
+ ---help---
+ Allows the thinkpad_acpi driver to handle removable bays. It will
+ electrically disable the device in the bay, and also generate
+
+
+From gregkh@mini.kroah.org Thu Aug 13 12:51:28 2009
+Message-Id: <20090813195128.703325684@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 13 Aug 2009 12:50:03 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Henrique de Moraes Holschuh <hmh@hmh.eng.br>,
+ Len Brown <len.brown@intel.com>
+Subject: [patch 28/74] thinkpad-acpi: fix incorrect use of TPACPI_BRGHT_MODE_ECNVRAM
+References: <20090813194935.985368088@mini.kroah.org>
+Content-Disposition: inline; filename=thinkpad-acpi-fix-incorrect-use-of-tpacpi_brght_mode_ecnvram.patch
+Content-Length: 4687
+Lines: 126
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Henrique de Moraes Holschuh <hmh@hmh.eng.br>
+
+commit 59fe4fe34d7afdf63208124f313be9056feaa2f4 upstream.
+
+HBRV-based default selection of backlight control strategy didn't work
+well, at least the X41 defines it but doesn't use it and I don't think
+it will stop there.
+
+Switch to a white/blacklist. All models that have HBRV defined have
+been included in the list, and initially all ATI GPUs will get
+ECNVRAM, and the Intel GPUs will get UCMS_STEP.
+
+Symptoms of incorrect backlight mode selection are:
+
+1. Non-working backlight control through sysfs;
+
+2. Backlight gets reset to the lowest level at every shutdown, reboot
+ and when thinkpad-acpi gets unloaded;
+
+This fixes a regression in 2.6.30, bugzilla #13826
+
+Signed-off-by: Henrique de Moraes Holschuh <hmh@hmh.eng.br>
+Reported-by: Tobias Diedrich <ranma+kernel@tdiedrich.de>
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/platform/x86/thinkpad_acpi.c | 61 ++++++++++++++++++++++++++---------
+ 1 file changed, 47 insertions(+), 14 deletions(-)
+
+--- a/drivers/platform/x86/thinkpad_acpi.c
++++ b/drivers/platform/x86/thinkpad_acpi.c
+@@ -5757,14 +5757,48 @@ static struct backlight_ops ibm_backligh
+
+ /* --------------------------------------------------------------------- */
+
++/*
++ * These are only useful for models that have only one possibility
++ * of GPU. If the BIOS model handles both ATI and Intel, don't use
++ * these quirks.
++ */
++#define TPACPI_BRGHT_Q_NOEC 0x0001 /* Must NOT use EC HBRV */
++#define TPACPI_BRGHT_Q_EC 0x0002 /* Should or must use EC HBRV */
++#define TPACPI_BRGHT_Q_ASK 0x8000 /* Ask for user report */
++
++static const struct tpacpi_quirk brightness_quirk_table[] __initconst = {
++ /* Models with ATI GPUs known to require ECNVRAM mode */
++ TPACPI_Q_IBM('1', 'Y', TPACPI_BRGHT_Q_EC), /* T43/p ATI */
++
++ /* Models with ATI GPUs (waiting confirmation) */
++ TPACPI_Q_IBM('1', 'R', TPACPI_BRGHT_Q_ASK|TPACPI_BRGHT_Q_EC),
++ TPACPI_Q_IBM('1', 'Q', TPACPI_BRGHT_Q_ASK|TPACPI_BRGHT_Q_EC),
++ TPACPI_Q_IBM('7', '6', TPACPI_BRGHT_Q_ASK|TPACPI_BRGHT_Q_EC),
++ TPACPI_Q_IBM('7', '8', TPACPI_BRGHT_Q_ASK|TPACPI_BRGHT_Q_EC),
++
++ /* Models with Intel Extreme Graphics 2 (waiting confirmation) */
++ TPACPI_Q_IBM('1', 'V', TPACPI_BRGHT_Q_ASK|TPACPI_BRGHT_Q_NOEC),
++ TPACPI_Q_IBM('1', 'W', TPACPI_BRGHT_Q_ASK|TPACPI_BRGHT_Q_NOEC),
++ TPACPI_Q_IBM('1', 'U', TPACPI_BRGHT_Q_ASK|TPACPI_BRGHT_Q_NOEC),
++
++ /* Models with Intel GMA900 */
++ TPACPI_Q_IBM('7', '0', TPACPI_BRGHT_Q_NOEC), /* T43, R52 */
++ TPACPI_Q_IBM('7', '4', TPACPI_BRGHT_Q_NOEC), /* X41 */
++ TPACPI_Q_IBM('7', '5', TPACPI_BRGHT_Q_NOEC), /* X41 Tablet */
++};
++
+ static int __init brightness_init(struct ibm_init_struct *iibm)
+ {
+ int b;
++ unsigned long quirks;
+
+ vdbg_printk(TPACPI_DBG_INIT, "initializing brightness subdriver\n");
+
+ mutex_init(&brightness_mutex);
+
++ quirks = tpacpi_check_quirks(brightness_quirk_table,
++ ARRAY_SIZE(brightness_quirk_table));
++
+ /*
+ * We always attempt to detect acpi support, so as to switch
+ * Lenovo Vista BIOS to ACPI brightness mode even if we are not
+@@ -5821,23 +5855,13 @@ static int __init brightness_init(struct
+ /* TPACPI_BRGHT_MODE_AUTO not implemented yet, just use default */
+ if (brightness_mode == TPACPI_BRGHT_MODE_AUTO ||
+ brightness_mode == TPACPI_BRGHT_MODE_MAX) {
+- if (thinkpad_id.vendor == PCI_VENDOR_ID_IBM) {
+- /*
+- * IBM models that define HBRV probably have
+- * EC-based backlight level control
+- */
+- if (acpi_evalf(ec_handle, NULL, "HBRV", "qd"))
+- /* T40-T43, R50-R52, R50e, R51e, X31-X41 */
+- brightness_mode = TPACPI_BRGHT_MODE_ECNVRAM;
+- else
+- /* all other IBM ThinkPads */
+- brightness_mode = TPACPI_BRGHT_MODE_UCMS_STEP;
+- } else
+- /* All Lenovo ThinkPads */
++ if (quirks & TPACPI_BRGHT_Q_EC)
++ brightness_mode = TPACPI_BRGHT_MODE_ECNVRAM;
++ else
+ brightness_mode = TPACPI_BRGHT_MODE_UCMS_STEP;
+
+ dbg_printk(TPACPI_DBG_BRGHT,
+- "selected brightness_mode=%d\n",
++ "driver auto-selected brightness_mode=%d\n",
+ brightness_mode);
+ }
+
+@@ -5858,6 +5882,15 @@ static int __init brightness_init(struct
+ vdbg_printk(TPACPI_DBG_INIT | TPACPI_DBG_BRGHT,
+ "brightness is supported\n");
+
++ if (quirks & TPACPI_BRGHT_Q_ASK) {
++ printk(TPACPI_NOTICE
++ "brightness: will use unverified default: "
++ "brightness_mode=%d\n", brightness_mode);
++ printk(TPACPI_NOTICE
++ "brightness: please report to %s whether it works well "
++ "or not on your ThinkPad\n", TPACPI_MAIL);
++ }
++
+ ibm_backlight_device->props.max_brightness =
+ (tp_features.bright_16levels)? 15 : 7;
+ ibm_backlight_device->props.brightness = b & TP_EC_BACKLIGHT_LVLMSK;
+
+
+From gregkh@mini.kroah.org Thu Aug 13 12:51:29 2009
+Message-Id: <20090813195128.860303934@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 13 Aug 2009 12:50:04 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp>
+Subject: [patch 29/74] nilfs2: fix oops due to inconsistent state in page with discrete b-tree nodes
+References: <20090813194935.985368088@mini.kroah.org>
+Content-Disposition: inline; filename=nilfs2-fix-oops-due-to-inconsistent-state-in-page-with-discrete-b-tree-nodes.patch
+Content-Length: 1873
+Lines: 57
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp>
+
+commit a97778457f22181e8c38c4cd7d7e528378738a98 upstream.
+
+Andrea Gelmini gave me a report that a kernel oops hit on a nilfs
+filesystem with a 1KB block size when doing rsync.
+
+This turned out to be caused by an inconsistency of dirty state
+between a page and its buffers storing b-tree node blocks.
+
+If the page had multiple buffers split over multiple logs, and if the
+logs were written at a time, a dirty flag remained in the page even
+every dirty flag in the buffers was cleared.
+
+This will fix the failure by dropping the dirty flag properly for
+pages with the discrete multiple b-tree nodes.
+
+Reported-by: Andrea Gelmini <andrea.gelmini@gmail.com>
+Signed-off-by: Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp>
+Tested-by: Andrea Gelmini <andrea.gelmini@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/nilfs2/segment.c | 16 +++++++++++++++-
+ 1 file changed, 15 insertions(+), 1 deletion(-)
+
+--- a/fs/nilfs2/segment.c
++++ b/fs/nilfs2/segment.c
+@@ -1876,12 +1876,26 @@ static void nilfs_end_page_io(struct pag
+ if (!page)
+ return;
+
+- if (buffer_nilfs_node(page_buffers(page)) && !PageWriteback(page))
++ if (buffer_nilfs_node(page_buffers(page)) && !PageWriteback(page)) {
+ /*
+ * For b-tree node pages, this function may be called twice
+ * or more because they might be split in a segment.
+ */
++ if (PageDirty(page)) {
++ /*
++ * For pages holding split b-tree node buffers, dirty
++ * flag on the buffers may be cleared discretely.
++ * In that case, the page is once redirtied for
++ * remaining buffers, and it must be cancelled if
++ * all the buffers get cleaned later.
++ */
++ lock_page(page);
++ if (nilfs_page_buffers_clean(page))
++ __nilfs_clear_page_dirty(page);
++ unlock_page(page);
++ }
+ return;
++ }
+
+ __nilfs_end_page_io(page, err);
+ }
+
+
+From gregkh@mini.kroah.org Thu Aug 13 12:51:29 2009
+Message-Id: <20090813195129.013296149@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 13 Aug 2009 12:50:05 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Lai Jiangshan <laijs@cn.fujitsu.com>,
+ Steven Rostedt <rostedt@goodmis.org>,
+ Frederic Weisbecker <fweisbec@gmail.com>
+Subject: [patch 30/74] tracing: Fix invalid function_graph entry
+References: <20090813194935.985368088@mini.kroah.org>
+Content-Disposition: inline; filename=tracing-fix-invalid-function_graph-entry.patch
+Content-Length: 1807
+Lines: 51
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Lai Jiangshan <laijs@cn.fujitsu.com>
+
+commit 38ceb592fcac9110c6b3c87ea0a27bff68c43486 upstream.
+
+When print_graph_entry() computes a function call entry event, it needs
+to also check the next entry to guess if it matches the return event of
+the current function entry.
+In order to look at this next event, it needs to consume the current
+entry before going ahead in the ring buffer.
+
+However, if the current event that gets consumed is the last one in the
+ring buffer head page, the ring_buffer may reuse the page for writers.
+The consumed entry will then become invalid because of possible
+racy overwriting.
+
+Me must then handle this entry by making a copy of it.
+
+The fix also applies on 2.6.30
+
+Signed-off-by: Lai Jiangshan <laijs@cn.fujitsu.com>
+Cc: Steven Rostedt <rostedt@goodmis.org>
+LKML-Reference: <4A6EEAEC.3050508@cn.fujitsu.com>
+Signed-off-by: Frederic Weisbecker <fweisbec@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/trace/trace_functions_graph.c | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+--- a/kernel/trace/trace_functions_graph.c
++++ b/kernel/trace/trace_functions_graph.c
+@@ -798,9 +798,16 @@ print_graph_function(struct trace_iterat
+
+ switch (entry->type) {
+ case TRACE_GRAPH_ENT: {
+- struct ftrace_graph_ent_entry *field;
++ /*
++ * print_graph_entry() may consume the current event,
++ * thus @field may become invalid, so we need to save it.
++ * sizeof(struct ftrace_graph_ent_entry) is very small,
++ * it can be safely saved at the stack.
++ */
++ struct ftrace_graph_ent_entry *field, saved;
+ trace_assign_type(field, entry);
+- return print_graph_entry(field, s, iter);
++ saved = *field;
++ return print_graph_entry(&saved, s, iter);
+ }
+ case TRACE_GRAPH_RET: {
+ struct ftrace_graph_ret_entry *field;
+
+
+From gregkh@mini.kroah.org Thu Aug 13 12:51:29 2009
+Message-Id: <20090813195129.165986932@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 13 Aug 2009 12:50:06 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Lai Jiangshan <laijs@cn.fujitsu.com>,
+ Steven Rostedt <rostedt@goodmis.org>,
+ Frederic Weisbecker <fweisbec@gmail.com>
+Subject: [patch 31/74] tracing: Fix missing function_graph events when we splice_read from trace_pipe
+References: <20090813194935.985368088@mini.kroah.org>
+Content-Disposition: inline; filename=tracing-fix-missing-function_graph-events-when-we-splice_read-from-trace_pipe.patch
+Content-Length: 1799
+Lines: 66
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Lai Jiangshan <laijs@cn.fujitsu.com>
+
+commit 74e7ff8c50b6b022e6ffaa736b16a4dc161d3eaf upstream.
+
+About a half events are missing when we splice_read
+from trace_pipe. They are unexpectedly consumed because we ignore
+the TRACE_TYPE_NO_CONSUME return value used by the function graph
+tracer when it needs to consume the events by itself to walk on
+the ring buffer.
+
+The same problem appears with ftrace_dump()
+
+Example of an output before this patch:
+
+1) | ktime_get_real() {
+1) 2.846 us | read_hpet();
+1) 4.558 us | }
+1) 6.195 us | }
+
+After this patch:
+
+0) | ktime_get_real() {
+0) | getnstimeofday() {
+0) 1.960 us | read_hpet();
+0) 3.597 us | }
+0) 5.196 us | }
+
+The fix also applies on 2.6.30
+
+Signed-off-by: Lai Jiangshan <laijs@cn.fujitsu.com>
+Cc: Steven Rostedt <rostedt@goodmis.org>
+LKML-Reference: <4A6EEC52.90704@cn.fujitsu.com>
+Signed-off-by: Frederic Weisbecker <fweisbec@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/trace/trace.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+--- a/kernel/trace/trace.c
++++ b/kernel/trace/trace.c
+@@ -2993,7 +2993,8 @@ tracing_fill_pipe_page(size_t rem, struc
+ break;
+ }
+
+- trace_consume(iter);
++ if (ret != TRACE_TYPE_NO_CONSUME)
++ trace_consume(iter);
+ rem -= count;
+ if (!find_next_entry_inc(iter)) {
+ rem = 0;
+@@ -4122,8 +4123,11 @@ static void __ftrace_dump(bool disable_t
+ iter.pos = -1;
+
+ if (find_next_entry_inc(&iter) != NULL) {
+- print_trace_line(&iter);
+- trace_consume(&iter);
++ int ret;
++
++ ret = print_trace_line(&iter);
++ if (ret != TRACE_TYPE_NO_CONSUME)
++ trace_consume(&iter);
+ }
+
+ trace_printk_seq(&iter.seq);
+
+
+From gregkh@mini.kroah.org Thu Aug 13 12:51:29 2009
+Message-Id: <20090813195129.309168736@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 13 Aug 2009 12:50:07 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Michael Buesch <mb@bu3sch.de>,
+ Helge Deller <deller@gmx.de>
+Subject: [patch 32/74] parisc: isa-eeprom - Fix loff_t usage
+References: <20090813194935.985368088@mini.kroah.org>
+Content-Disposition: inline; filename=parisc-isa-eeprom-fix-loff_t-usage.patch
+Content-Length: 905
+Lines: 29
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Michael Buesch <mb@bu3sch.de>
+
+commit 6b4dbcd86a9d464057fcc7abe4d0574093071fcc upstream.
+
+loff_t is a signed type. If userspace passes a negative ppos, the "count"
+range check is weakened. "count"s bigger than HPEE_MAX_LENGTH will pass the check.
+Also, if ppos is negative, the readb(eisa_eeprom_addr + *ppos) will poke in random
+memory.
+
+Signed-off-by: Michael Buesch <mb@bu3sch.de>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/parisc/eisa_eeprom.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/parisc/eisa_eeprom.c
++++ b/drivers/parisc/eisa_eeprom.c
+@@ -55,7 +55,7 @@ static ssize_t eisa_eeprom_read(struct f
+ ssize_t ret;
+ int i;
+
+- if (*ppos >= HPEE_MAX_LENGTH)
++ if (*ppos < 0 || *ppos >= HPEE_MAX_LENGTH)
+ return 0;
+
+ count = *ppos + count < HPEE_MAX_LENGTH ? count : HPEE_MAX_LENGTH - *ppos;
+
+
+From gregkh@mini.kroah.org Thu Aug 13 12:51:29 2009
+Message-Id: <20090813195129.458122866@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 13 Aug 2009 12:50:08 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Johannes Berg <johannes@sipsolutions.net>,
+ "John W. Linville" <linville@tuxdriver.com>
+Subject: [patch 33/74] cfg80211: add two missing NULL pointer checks
+References: <20090813194935.985368088@mini.kroah.org>
+Content-Disposition: inline; filename=cfg80211-add-two-missing-null-pointer-checks.patch
+Content-Length: 1005
+Lines: 37
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Johannes Berg <johannes@sipsolutions.net>
+
+commit cd3468bad96c00b5a512f551674f36776129520e upstream.
+
+These pointers can be NULL, the is_mesh() case isn't
+ever hit in the current kernel, but cmp_ies() can be
+hit under certain conditions.
+
+Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/wireless/scan.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/net/wireless/scan.c
++++ b/net/wireless/scan.c
+@@ -118,7 +118,7 @@ static int cmp_ies(u8 num, u8 *ies1, siz
+
+ if (!ie1 && !ie2)
+ return 0;
+- if (!ie1)
++ if (!ie1 || !ie2)
+ return -1;
+
+ r = memcmp(ie1 + 2, ie2 + 2, min(ie1[1], ie2[1]));
+@@ -171,6 +171,8 @@ static bool is_mesh(struct cfg80211_bss
+ ie = find_ie(WLAN_EID_MESH_CONFIG,
+ a->information_elements,
+ a->len_information_elements);
++ if (!ie)
++ return false;
+ if (ie[1] != IEEE80211_MESH_CONFIG_LEN)
+ return false;
+
+
+
+From gregkh@mini.kroah.org Thu Aug 13 12:51:29 2009
+Message-Id: <20090813195129.603296702@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 13 Aug 2009 12:50:09 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Hiroshi Shimamoto <h-shimamoto@ct.jp.nec.com>,
+ Thomas Gleixner <tglx@linutronix.de>,
+ John Stultz <johnstul@us.ibm.com>,
+ Ingo Molnar <mingo@elte.hu>
+Subject: [patch 34/74] posix-timers: Fix oops in clock_nanosleep() with CLOCK_MONOTONIC_RAW
+References: <20090813194935.985368088@mini.kroah.org>
+Content-Disposition: inline; filename=posix-timers-fix-oops-in-clock_nanosleep-with-clock_monotonic_raw.patch
+Content-Length: 1282
+Lines: 44
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Hiroshi Shimamoto <h-shimamoto@ct.jp.nec.com>
+
+commit 70d715fd0597f18528f389b5ac59102263067744 upstream.
+
+Prevent calling do_nanosleep() with clockid
+CLOCK_MONOTONIC_RAW, it may cause oops, such as NULL pointer
+dereference.
+
+Signed-off-by: Hiroshi Shimamoto <h-shimamoto@ct.jp.nec.com>
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: John Stultz <johnstul@us.ibm.com>
+LKML-Reference: <4A764FF3.50607@ct.jp.nec.com>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/posix-timers.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/kernel/posix-timers.c
++++ b/kernel/posix-timers.c
+@@ -202,6 +202,12 @@ static int no_timer_create(struct k_itim
+ return -EOPNOTSUPP;
+ }
+
++static int no_nsleep(const clockid_t which_clock, int flags,
++ struct timespec *tsave, struct timespec __user *rmtp)
++{
++ return -EOPNOTSUPP;
++}
++
+ /*
+ * Return nonzero if we know a priori this clockid_t value is bogus.
+ */
+@@ -254,6 +260,7 @@ static __init int init_posix_timers(void
+ .clock_get = posix_get_monotonic_raw,
+ .clock_set = do_posix_clock_nosettime,
+ .timer_create = no_timer_create,
++ .nsleep = no_nsleep,
+ };
+
+ register_posix_clock(CLOCK_REALTIME, &clock_realtime);
+
+
+From gregkh@mini.kroah.org Thu Aug 13 12:51:29 2009
+Message-Id: <20090813195129.754915826@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 13 Aug 2009 12:50:10 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>,
+ Len Brown <lenb@kernel.org>,
+ "Rafael J. Wysocki" <rjw@sisk.pl>
+Subject: [patch 35/74] PM / ACPI: HP G7000 Notebook needs a SCI_EN resume quirk
+References: <20090813194935.985368088@mini.kroah.org>
+Content-Disposition: inline; filename=pm-acpi-hp-g7000-notebook-needs-a-sci_en-resume-quirk.patch
+Content-Length: 1187
+Lines: 39
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
+
+commit ec79be26875f6c1468784876cb99192b7f41c7a5 upstream.
+
+This fixes regression (battery "vanishing" on resume) introduced by
+commit d0c71fe7ebc180f1b7bc7da1d39a07fc19eec768 ("ACPI Suspend: Enable
+ACPI during resume if SCI_EN is not set") and also the issue with
+the "screaming" IRQ 9.
+
+Fixes http://bugzilla.kernel.org/show_bug.cgi?id=13745
+
+Reported-and-tested-by: Alan Jenkins <alan-jenkins@tuffmail.co.uk>
+Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
+Acked-by: Len Brown <lenb@kernel.org>
+Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/acpi/sleep.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/drivers/acpi/sleep.c
++++ b/drivers/acpi/sleep.c
+@@ -397,6 +397,14 @@ static struct dmi_system_id __initdata a
+ },
+ },
+ {
++ .callback = init_set_sci_en_on_resume,
++ .ident = "Hewlett-Packard HP G7000 Notebook PC",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "HP G7000 Notebook PC"),
++ },
++ },
++ {
+ .callback = init_old_suspend_ordering,
+ .ident = "Panasonic CF51-2L",
+ .matches = {
+
+
+From gregkh@mini.kroah.org Thu Aug 13 12:51:30 2009
+Message-Id: <20090813195129.901571614@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 13 Aug 2009 12:50:11 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Peter Korsgaard <jacmet@sunsite.dk>,
+ Kumar Gala <galak@kernel.crashing.org>
+Subject: [patch 36/74] powerpc/mpc83xx: Fix usb mux setup for mpc834x
+References: <20090813194935.985368088@mini.kroah.org>
+Content-Disposition: inline; filename=powerpc-mpc83xx-fix-usb-mux-setup-for-mpc834x.patch
+Content-Length: 4194
+Lines: 125
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Peter Korsgaard <jacmet@sunsite.dk>
+
+commit b7d66c88c968379ebe683a28c4005895497ebbad upstream.
+
+usb0 and usb1 mux settings in the sicrl register were swapped (twice!)
+in mpc834x_usb_cfg(), leading to various strange issues with fsl-ehci
+and full speed devices.
+
+The USB port config on mpc834x is done using 2 muxes: Port 0 is always
+used for MPH port 0, and port 1 can either be used for MPH port 1 or DR
+(unless DR uses UTMI phy or OTG, then it uses both ports) - See 8349 RM
+figure 1-4..
+
+mpc8349_usb_cfg() had this inverted for the DR, and it also had the bit
+positions of the usb0 / usb1 mux settings swapped. It would basically
+work if you specified port1 instead of port0 for the MPH controller (and
+happened to use ULPI phys), which is what all the 834x dts have done,
+even though that configuration is physically invalid.
+
+Instead fix mpc8349_usb_cfg() and adjust the dts files to match reality.
+
+Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
+Signed-off-by: Kumar Gala <galak@kernel.crashing.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/powerpc/boot/dts/asp834x-redboot.dts | 2 +-
+ arch/powerpc/boot/dts/mpc8349emitx.dts | 2 +-
+ arch/powerpc/boot/dts/mpc834x_mds.dts | 2 +-
+ arch/powerpc/boot/dts/sbc8349.dts | 2 +-
+ arch/powerpc/platforms/83xx/mpc83xx.h | 4 ++--
+ arch/powerpc/platforms/83xx/usb.c | 10 +++++-----
+ 6 files changed, 11 insertions(+), 11 deletions(-)
+
+--- a/arch/powerpc/boot/dts/asp834x-redboot.dts
++++ b/arch/powerpc/boot/dts/asp834x-redboot.dts
+@@ -167,7 +167,7 @@
+ interrupt-parent = <&ipic>;
+ interrupts = <39 0x8>;
+ phy_type = "ulpi";
+- port1;
++ port0;
+ };
+ /* phy type (ULPI, UTMI, UTMI_WIDE, SERIAL) */
+ usb@23000 {
+--- a/arch/powerpc/boot/dts/mpc8349emitx.dts
++++ b/arch/powerpc/boot/dts/mpc8349emitx.dts
+@@ -156,7 +156,7 @@
+ interrupt-parent = <&ipic>;
+ interrupts = <39 0x8>;
+ phy_type = "ulpi";
+- port1;
++ port0;
+ };
+
+ usb@23000 {
+--- a/arch/powerpc/boot/dts/mpc834x_mds.dts
++++ b/arch/powerpc/boot/dts/mpc834x_mds.dts
+@@ -153,7 +153,7 @@
+ interrupt-parent = <&ipic>;
+ interrupts = <39 0x8>;
+ phy_type = "ulpi";
+- port1;
++ port0;
+ };
+ /* phy type (ULPI, UTMI, UTMI_WIDE, SERIAL) */
+ usb@23000 {
+--- a/arch/powerpc/boot/dts/sbc8349.dts
++++ b/arch/powerpc/boot/dts/sbc8349.dts
+@@ -144,7 +144,7 @@
+ interrupt-parent = <&ipic>;
+ interrupts = <39 0x8>;
+ phy_type = "ulpi";
+- port1;
++ port0;
+ };
+ /* phy type (ULPI, UTMI, UTMI_WIDE, SERIAL) */
+ usb@23000 {
+--- a/arch/powerpc/platforms/83xx/mpc83xx.h
++++ b/arch/powerpc/platforms/83xx/mpc83xx.h
+@@ -22,8 +22,8 @@
+ /* system i/o configuration register low */
+ #define MPC83XX_SICRL_OFFS 0x114
+ #define MPC834X_SICRL_USB_MASK 0x60000000
+-#define MPC834X_SICRL_USB0 0x40000000
+-#define MPC834X_SICRL_USB1 0x20000000
++#define MPC834X_SICRL_USB0 0x20000000
++#define MPC834X_SICRL_USB1 0x40000000
+ #define MPC831X_SICRL_USB_MASK 0x00000c00
+ #define MPC831X_SICRL_USB_ULPI 0x00000800
+ #define MPC8315_SICRL_USB_MASK 0x000000fc
+--- a/arch/powerpc/platforms/83xx/usb.c
++++ b/arch/powerpc/platforms/83xx/usb.c
+@@ -47,25 +47,25 @@ int mpc834x_usb_cfg(void)
+ sccr |= MPC83XX_SCCR_USB_DRCM_11; /* 1:3 */
+
+ prop = of_get_property(np, "phy_type", NULL);
++ port1_is_dr = 1;
+ if (prop && (!strcmp(prop, "utmi") ||
+ !strcmp(prop, "utmi_wide"))) {
+ sicrl |= MPC834X_SICRL_USB0 | MPC834X_SICRL_USB1;
+ sicrh |= MPC834X_SICRH_USB_UTMI;
+- port1_is_dr = 1;
++ port0_is_dr = 1;
+ } else if (prop && !strcmp(prop, "serial")) {
+ dr_mode = of_get_property(np, "dr_mode", NULL);
+ if (dr_mode && !strcmp(dr_mode, "otg")) {
+ sicrl |= MPC834X_SICRL_USB0 | MPC834X_SICRL_USB1;
+- port1_is_dr = 1;
++ port0_is_dr = 1;
+ } else {
+- sicrl |= MPC834X_SICRL_USB0;
++ sicrl |= MPC834X_SICRL_USB1;
+ }
+ } else if (prop && !strcmp(prop, "ulpi")) {
+- sicrl |= MPC834X_SICRL_USB0;
++ sicrl |= MPC834X_SICRL_USB1;
+ } else {
+ printk(KERN_WARNING "834x USB PHY type not supported\n");
+ }
+- port0_is_dr = 1;
+ of_node_put(np);
+ }
+ np = of_find_compatible_node(NULL, NULL, "fsl-usb2-mph");
+
+
+From gregkh@mini.kroah.org Thu Aug 13 12:51:30 2009
+Message-Id: <20090813195130.073928863@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 13 Aug 2009 12:50:12 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Eric Sandeen <sandeen@redhat.com>,
+ Andi Kleen <andi@firstfloor.org>,
+ William Lee Irwin III <wli@holomorphy.com>
+Subject: [patch 37/74] hugetlbfs: fix i_blocks accounting
+References: <20090813194935.985368088@mini.kroah.org>
+Content-Disposition: inline; filename=hugetlbfs-fix-i_blocks-accounting.patch
+Content-Length: 1694
+Lines: 52
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Eric Sandeen <sandeen@sandeen.net>
+
+commit e4c6f8bed01f9f9a5c607bd689bf67e7b8a36bd8 upstream.
+
+As reported in Red Hat bz #509671, i_blocks for files on hugetlbfs get
+accounting wrong when doing something like:
+
+ $ > foo
+ $ date > foo
+ date: write error: Invalid argument
+ $ /usr/bin/stat foo
+ File: `foo'
+ Size: 0 Blocks: 18446744073709547520 IO Block: 2097152 regular
+...
+
+This is because hugetlb_unreserve_pages() is unconditionally removing
+blocks_per_huge_page(h) on each call rather than using the freed amount.
+If there were 0 blocks, it goes negative, resulting in the above.
+
+This is a regression from commit a5516438959d90b071ff0a484ce4f3f523dc3152
+("hugetlb: modular state for hugetlb page size")
+
+which did:
+
+- inode->i_blocks -= BLOCKS_PER_HUGEPAGE * freed;
++ inode->i_blocks -= blocks_per_huge_page(h);
+
+so just put back the freed multiplier, and it's all happy again.
+
+Signed-off-by: Eric Sandeen <sandeen@redhat.com>
+Acked-by: Andi Kleen <andi@firstfloor.org>
+Cc: William Lee Irwin III <wli@holomorphy.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ mm/hugetlb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/mm/hugetlb.c
++++ b/mm/hugetlb.c
+@@ -2341,7 +2341,7 @@ void hugetlb_unreserve_pages(struct inod
+ long chg = region_truncate(&inode->i_mapping->private_list, offset);
+
+ spin_lock(&inode->i_lock);
+- inode->i_blocks -= blocks_per_huge_page(h);
++ inode->i_blocks -= (blocks_per_huge_page(h) * freed);
+ spin_unlock(&inode->i_lock);
+
+ hugetlb_put_quota(inode->i_mapping, (chg - freed));
+
+
+From gregkh@mini.kroah.org Thu Aug 13 12:51:30 2009
+Message-Id: <20090813195130.226828111@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 13 Aug 2009 12:50:13 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Mel Gorman <mel@csn.ul.ie>,
+ KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
+Subject: [patch 38/74] page-allocator: preserve PFN ordering when __GFP_COLD is set
+References: <20090813194935.985368088@mini.kroah.org>
+Content-Disposition: inline; filename=page-allocator-preserve-pfn-ordering-when-__gfp_cold-is-set.patch
+Content-Length: 2727
+Lines: 79
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Mel Gorman <mel@csn.ul.ie>
+
+commit e084b2d95e48b31aa45f9c49ffc6cdae8bdb21d4 upstream.
+
+Fix a post-2.6.24 performace regression caused by
+3dfa5721f12c3d5a441448086bee156887daa961 ("page-allocator: preserve PFN
+ordering when __GFP_COLD is set").
+
+Narayanan reports "The regression is around 15%. There is no disk controller
+as our setup is based on Samsung OneNAND used as a memory mapped device on a
+OMAP2430 based board."
+
+The page allocator tries to preserve contiguous PFN ordering when returning
+pages such that repeated callers to the allocator have a strong chance of
+getting physically contiguous pages, particularly when external fragmentation
+is low. However, of the bulk of the allocations have __GFP_COLD set as they
+are due to aio_read() for example, then the PFNs are in reverse PFN order.
+This can cause performance degration when used with IO controllers that could
+have merged the requests.
+
+This patch attempts to preserve the contiguous ordering of PFNs for users of
+__GFP_COLD.
+
+Signed-off-by: Mel Gorman <mel@csn.ul.ie>
+Reported-by: Narayananu Gopalakrishnan <narayanan.g@samsung.com>
+Tested-by: Narayanan Gopalakrishnan <narayanan.g@samsung.com>
+Cc: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ mm/page_alloc.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+--- a/mm/page_alloc.c
++++ b/mm/page_alloc.c
+@@ -858,7 +858,7 @@ static struct page *__rmqueue(struct zon
+ */
+ static int rmqueue_bulk(struct zone *zone, unsigned int order,
+ unsigned long count, struct list_head *list,
+- int migratetype)
++ int migratetype, int cold)
+ {
+ int i;
+
+@@ -877,7 +877,10 @@ static int rmqueue_bulk(struct zone *zon
+ * merge IO requests if the physical pages are ordered
+ * properly.
+ */
+- list_add(&page->lru, list);
++ if (likely(cold == 0))
++ list_add(&page->lru, list);
++ else
++ list_add_tail(&page->lru, list);
+ set_page_private(page, migratetype);
+ list = &page->lru;
+ }
+@@ -1077,7 +1080,8 @@ again:
+ local_irq_save(flags);
+ if (!pcp->count) {
+ pcp->count = rmqueue_bulk(zone, 0,
+- pcp->batch, &pcp->list, migratetype);
++ pcp->batch, &pcp->list,
++ migratetype, cold);
+ if (unlikely(!pcp->count))
+ goto failed;
+ }
+@@ -1096,7 +1100,8 @@ again:
+ /* Allocate more to the pcp list if necessary */
+ if (unlikely(&page->lru == &pcp->list)) {
+ pcp->count += rmqueue_bulk(zone, 0,
+- pcp->batch, &pcp->list, migratetype);
++ pcp->batch, &pcp->list,
++ migratetype, cold);
+ page = list_entry(pcp->list.next, struct page, lru);
+ }
+
+
+
+From gregkh@mini.kroah.org Thu Aug 13 12:51:30 2009
+Message-Id: <20090813195130.384492696@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 13 Aug 2009 12:50:14 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Thomas Hellstrom <thellstrom@vmware.com>,
+ Suresh Siddha <suresh.b.siddha@intel.com>,
+ dri-devel@lists.sourceforge.net,
+ venkatesh.pallipadi@intel.com,
+ Ingo Molnar <mingo@elte.hu>
+Subject: [patch 39/74] x86: Fix CPA memtype reserving in the set_pages_array*() cases
+References: <20090813194935.985368088@mini.kroah.org>
+Content-Disposition: inline; filename=x86-fix-cpa-memtype-reserving-in-the-set_pages_array-cases.patch
+Content-Length: 3166
+Lines: 94
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Thomas Hellstrom <thellstrom@vmware.com>
+
+commit 8523acfe40efc1a8d3da8f473ca67cb195b06f0c upstream.
+
+The code was incorrectly reserving memtypes using the page
+virtual address instead of the physical address. Furthermore,
+the code was not ignoring highmem pages as it ought to.
+
+( upstream does not pass in highmem pages yet - but upcoming
+ graphics code will do it and there's no reason to not handle
+ this properly in the CPA APIs.)
+
+Fixes: http://bugzilla.kernel.org/show_bug.cgi?id=13884
+
+Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com>
+Acked-by: Suresh Siddha <suresh.b.siddha@intel.com>
+Cc: dri-devel@lists.sourceforge.net
+Cc: venkatesh.pallipadi@intel.com
+LKML-Reference: <1249284345-7654-1-git-send-email-thellstrom@vmware.com>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/mm/pageattr.c | 30 +++++++++++++++++++++---------
+ 1 file changed, 21 insertions(+), 9 deletions(-)
+
+--- a/arch/x86/mm/pageattr.c
++++ b/arch/x86/mm/pageattr.c
+@@ -590,9 +590,12 @@ static int __change_page_attr(struct cpa
+ unsigned int level;
+ pte_t *kpte, old_pte;
+
+- if (cpa->flags & CPA_PAGES_ARRAY)
+- address = (unsigned long)page_address(cpa->pages[cpa->curpage]);
+- else if (cpa->flags & CPA_ARRAY)
++ if (cpa->flags & CPA_PAGES_ARRAY) {
++ struct page *page = cpa->pages[cpa->curpage];
++ if (unlikely(PageHighMem(page)))
++ return 0;
++ address = (unsigned long)page_address(page);
++ } else if (cpa->flags & CPA_ARRAY)
+ address = cpa->vaddr[cpa->curpage];
+ else
+ address = *cpa->vaddr;
+@@ -695,9 +698,12 @@ static int cpa_process_alias(struct cpa_
+ * No need to redo, when the primary call touched the direct
+ * mapping already:
+ */
+- if (cpa->flags & CPA_PAGES_ARRAY)
+- vaddr = (unsigned long)page_address(cpa->pages[cpa->curpage]);
+- else if (cpa->flags & CPA_ARRAY)
++ if (cpa->flags & CPA_PAGES_ARRAY) {
++ struct page *page = cpa->pages[cpa->curpage];
++ if (unlikely(PageHighMem(page)))
++ return 0;
++ vaddr = (unsigned long)page_address(page);
++ } else if (cpa->flags & CPA_ARRAY)
+ vaddr = cpa->vaddr[cpa->curpage];
+ else
+ vaddr = *cpa->vaddr;
+@@ -1118,7 +1124,9 @@ int set_pages_array_uc(struct page **pag
+ int free_idx;
+
+ for (i = 0; i < addrinarray; i++) {
+- start = (unsigned long)page_address(pages[i]);
++ if (PageHighMem(pages[i]))
++ continue;
++ start = page_to_pfn(pages[i]) << PAGE_SHIFT;
+ end = start + PAGE_SIZE;
+ if (reserve_memtype(start, end, _PAGE_CACHE_UC_MINUS, NULL))
+ goto err_out;
+@@ -1131,7 +1139,9 @@ int set_pages_array_uc(struct page **pag
+ err_out:
+ free_idx = i;
+ for (i = 0; i < free_idx; i++) {
+- start = (unsigned long)page_address(pages[i]);
++ if (PageHighMem(pages[i]))
++ continue;
++ start = page_to_pfn(pages[i]) << PAGE_SHIFT;
+ end = start + PAGE_SIZE;
+ free_memtype(start, end);
+ }
+@@ -1160,7 +1170,9 @@ int set_pages_array_wb(struct page **pag
+ return retval;
+
+ for (i = 0; i < addrinarray; i++) {
+- start = (unsigned long)page_address(pages[i]);
++ if (PageHighMem(pages[i]))
++ continue;
++ start = page_to_pfn(pages[i]) << PAGE_SHIFT;
+ end = start + PAGE_SIZE;
+ free_memtype(start, end);
+ }
+
+
+From gregkh@mini.kroah.org Thu Aug 13 12:51:30 2009
+Message-Id: <20090813195130.514363745@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 13 Aug 2009 12:50:15 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ "H. Peter Anvin" <hpa@zytor.com>
+Subject: [patch 40/74] x86: fix assembly constraints in native_save_fl()
+References: <20090813194935.985368088@mini.kroah.org>
+Content-Disposition: inline; filename=x86-fix-assembly-constraints-in-native_save_fl.patch
+Content-Length: 1966
+Lines: 60
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: H. Peter Anvin <hpa@zytor.com>
+
+commit f1f029c7bfbf4ee1918b90a431ab823bed812504 upstream.
+
+>From Gabe Black in bugzilla 13888:
+
+native_save_fl is implemented as follows:
+
+ 11static inline unsigned long native_save_fl(void)
+ 12{
+ 13 unsigned long flags;
+ 14
+ 15 asm volatile("# __raw_save_flags\n\t"
+ 16 "pushf ; pop %0"
+ 17 : "=g" (flags)
+ 18 : /* no input */
+ 19 : "memory");
+ 20
+ 21 return flags;
+ 22}
+
+If gcc chooses to put flags on the stack, for instance because this is
+inlined into a larger function with more register pressure, the offset
+of the flags variable from the stack pointer will change when the
+pushf is performed. gcc doesn't attempt to understand that fact, and
+address used for pop will still be the same. It will write to
+somewhere near flags on the stack but not actually into it and
+overwrite some other value.
+
+I saw this happen in the ide_device_add_all function when running in a
+simulator I work on. I'm assuming that some quirk of how the simulated
+hardware is set up caused the code path this is on to be executed when
+it normally wouldn't.
+
+A simple fix might be to change "=g" to "=r".
+
+Reported-by: Gabe Black <spamforgabe@umich.edu>
+Signed-off-by: H. Peter Anvin <hpa@zytor.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+--- a/arch/x86/include/asm/irqflags.h
++++ b/arch/x86/include/asm/irqflags.h
+@@ -12,9 +12,15 @@ static inline unsigned long native_save_fl(void)
+ {
+ unsigned long flags;
+
++ /*
++ * Note: this needs to be "=r" not "=rm", because we have the
++ * stack offset from what gcc expects at the time the "pop" is
++ * executed, and so a memory reference with respect to the stack
++ * would end up using the wrong address.
++ */
+ asm volatile("# __raw_save_flags\n\t"
+ "pushf ; pop %0"
+- : "=g" (flags)
++ : "=r" (flags)
+ : /* no input */
+ : "memory");
+
+
+
+From gregkh@mini.kroah.org Thu Aug 13 12:51:30 2009
+Message-Id: <20090813195130.664882602@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 13 Aug 2009 12:50:16 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Venkatesh Pallipadi <venkatesh.pallipadi@intel.com>,
+ Suresh Siddha <suresh.b.siddha@intel.com>,
+ Dave Airlie <airlied@redhat.com>,
+ "H. Peter Anvin" <hpa@zytor.com>
+Subject: [patch 41/74] x86, pat: Fix set_memory_wc related corruption
+References: <20090813194935.985368088@mini.kroah.org>
+Content-Disposition: inline; filename=x86-pat-fix-set_memory_wc-related-corruption.patch
+Content-Length: 2501
+Lines: 63
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Pallipadi, Venkatesh <venkatesh.pallipadi@intel.com>
+
+commit bdc6340f4eb68295b1e7c0ade2356b56dca93d93 upstream.
+
+Changeset 3869c4aa18835c8c61b44bd0f3ace36e9d3b5bd0
+that went in after 2.6.30-rc1 was a seemingly small change to _set_memory_wc()
+to make it complaint with SDM requirements. But, introduced a nasty bug, which
+can result in crash and/or strange corruptions when set_memory_wc is used.
+One such crash reported here
+http://lkml.org/lkml/2009/7/30/94
+
+Actually, that changeset introduced two bugs.
+* change_page_attr_set() takes &addr as first argument and can the addr value
+ might have changed on return, even for single page change_page_attr_set()
+ call. That will make the second change_page_attr_set() in this routine
+ operate on unrelated addr, that can eventually cause strange corruptions
+ and bad page state crash.
+* The second change_page_attr_set() call, before setting _PAGE_CACHE_WC, should
+ clear the earlier _PAGE_CACHE_UC_MINUS, as otherwise cache attribute will not
+ be WC (will be UC instead).
+
+The patch below fixes both these problems. Sending a single patch to fix both
+the problems, as the change is to the same line of code. The change to have a
+addr_copy is not very clean. But, it is simpler than making more changes
+through various routines in pageattr.c.
+
+A huge thanks to Jerome for reporting this problem and providing a simple test
+case that helped us root cause the problem.
+
+Reported-by: Jerome Glisse <glisse@freedesktop.org>
+Signed-off-by: Venkatesh Pallipadi <venkatesh.pallipadi@intel.com>
+Signed-off-by: Suresh Siddha <suresh.b.siddha@intel.com>
+LKML-Reference: <20090730214319.GA1889@linux-os.sc.intel.com>
+Acked-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: H. Peter Anvin <hpa@zytor.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/mm/pageattr.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+--- a/arch/x86/mm/pageattr.c
++++ b/arch/x86/mm/pageattr.c
+@@ -1002,12 +1002,15 @@ EXPORT_SYMBOL(set_memory_array_uc);
+ int _set_memory_wc(unsigned long addr, int numpages)
+ {
+ int ret;
++ unsigned long addr_copy = addr;
++
+ ret = change_page_attr_set(&addr, numpages,
+ __pgprot(_PAGE_CACHE_UC_MINUS), 0);
+-
+ if (!ret) {
+- ret = change_page_attr_set(&addr, numpages,
+- __pgprot(_PAGE_CACHE_WC), 0);
++ ret = change_page_attr_set_clr(&addr_copy, numpages,
++ __pgprot(_PAGE_CACHE_WC),
++ __pgprot(_PAGE_CACHE_MASK),
++ 0, 0, NULL);
+ }
+ return ret;
+ }
+
+
+From gregkh@mini.kroah.org Thu Aug 13 12:51:30 2009
+Message-Id: <20090813195130.818923467@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 13 Aug 2009 12:50:17 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Dan Williams <dan.j.williams@intel.com>,
+ NeilBrown <neilb@suse.de>
+Subject: [patch 42/74] md/raid6: release spare page at ->stop()
+References: <20090813194935.985368088@mini.kroah.org>
+Content-Disposition: inline; filename=md-raid6-release-spare-page-at-stop.patch
+Content-Length: 2049
+Lines: 76
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Dan Williams <dan.j.williams@intel.com>
+
+commit 95fc17aac45300f45968aacd97a536ddd8db8101 upstream.
+
+Add missing call to safe_put_page from stop() by unifying open coded
+raid5_conf_t de-allocation under free_conf().
+
+Signed-off-by: Dan Williams <dan.j.williams@intel.com>
+Signed-off-by: NeilBrown <neilb@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/raid5.c | 26 ++++++++++++--------------
+ 1 file changed, 12 insertions(+), 14 deletions(-)
+
+--- a/drivers/md/raid5.c
++++ b/drivers/md/raid5.c
+@@ -4310,6 +4310,15 @@ raid5_size(mddev_t *mddev, sector_t sect
+ return sectors * (raid_disks - conf->max_degraded);
+ }
+
++static void free_conf(raid5_conf_t *conf)
++{
++ shrink_stripes(conf);
++ safe_put_page(conf->spare_page);
++ kfree(conf->disks);
++ kfree(conf->stripe_hashtbl);
++ kfree(conf);
++}
++
+ static raid5_conf_t *setup_conf(mddev_t *mddev)
+ {
+ raid5_conf_t *conf;
+@@ -4439,11 +4448,7 @@ static raid5_conf_t *setup_conf(mddev_t
+
+ abort:
+ if (conf) {
+- shrink_stripes(conf);
+- safe_put_page(conf->spare_page);
+- kfree(conf->disks);
+- kfree(conf->stripe_hashtbl);
+- kfree(conf);
++ free_conf(conf);
+ return ERR_PTR(-EIO);
+ } else
+ return ERR_PTR(-ENOMEM);
+@@ -4609,12 +4614,8 @@ abort:
+ md_unregister_thread(mddev->thread);
+ mddev->thread = NULL;
+ if (conf) {
+- shrink_stripes(conf);
+ print_raid5_conf(conf);
+- safe_put_page(conf->spare_page);
+- kfree(conf->disks);
+- kfree(conf->stripe_hashtbl);
+- kfree(conf);
++ free_conf(conf);
+ }
+ mddev->private = NULL;
+ printk(KERN_ALERT "raid5: failed to run raid set %s\n", mdname(mddev));
+@@ -4629,13 +4630,10 @@ static int stop(mddev_t *mddev)
+
+ md_unregister_thread(mddev->thread);
+ mddev->thread = NULL;
+- shrink_stripes(conf);
+- kfree(conf->stripe_hashtbl);
+ mddev->queue->backing_dev_info.congested_fn = NULL;
+ blk_sync_queue(mddev->queue); /* the unplug fn references 'conf'*/
+ sysfs_remove_group(&mddev->kobj, &raid5_attrs_group);
+- kfree(conf->disks);
+- kfree(conf);
++ free_conf(conf);
+ mddev->private = NULL;
+ return 0;
+ }
+
+
+From gregkh@mini.kroah.org Thu Aug 13 12:51:31 2009
+Message-Id: <20090813195130.963233083@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 13 Aug 2009 12:50:18 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ NeilBrown <neilb@suse.de>
+Subject: [patch 43/74] md: when a level change reduces the number of devices, remove the excess.
+References: <20090813194935.985368088@mini.kroah.org>
+Content-Disposition: inline; filename=md-when-a-level-change-reduces-the-number-of-devices-remove-the-excess.patch
+Content-Length: 1229
+Lines: 41
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: NeilBrown <neilb@suse.de>
+
+commit 3a981b03f38dc3b8a69b77cbc679e66c1318a44a upstream.
+
+When an array is changed from RAID6 to RAID5, fewer drives are
+needed. So any device that is made superfluous by the level
+conversion must be marked as not-active.
+For the RAID6->RAID5 conversion, this will be a drive which only
+has 'Q' blocks on it.
+
+Signed-off-by: NeilBrown <neilb@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/md.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -2680,6 +2680,7 @@ level_store(mddev_t *mddev, const char *
+ ssize_t rv = len;
+ struct mdk_personality *pers;
+ void *priv;
++ mdk_rdev_t *rdev;
+
+ if (mddev->pers == NULL) {
+ if (len == 0)
+@@ -2759,6 +2760,12 @@ level_store(mddev_t *mddev, const char *
+ mddev_suspend(mddev);
+ mddev->pers->stop(mddev);
+ module_put(mddev->pers->owner);
++ /* Invalidate devices that are now superfluous */
++ list_for_each_entry(rdev, &mddev->disks, same_set)
++ if (rdev->raid_disk >= mddev->raid_disks) {
++ rdev->raid_disk = -1;
++ clear_bit(In_sync, &rdev->flags);
++ }
+ mddev->pers = pers;
+ mddev->private = priv;
+ strlcpy(mddev->clevel, pers->name, sizeof(mddev->clevel));
+
+
+From gregkh@mini.kroah.org Thu Aug 13 12:51:31 2009
+Message-Id: <20090813195131.095567787@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 13 Aug 2009 12:50:19 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [patch 44/74] ide: fix handling of unexpected IRQs vs request_irq()
+References: <20090813194935.985368088@mini.kroah.org>
+Content-Disposition: inline; filename=ide-fix-handling-of-unexpected-irqs-vs-request_irq.patch
+Content-Length: 1917
+Lines: 70
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
+
+commit ffc36c7610731115c77700dcc53901920361c235 upstream.
+
+Add ide_host_enable_irqs() helper and use it in ide_host_register()
+before registering ports. Then remove no longer needed IRQ unmasking
+from in init_irq().
+
+This should fix the problem with "screaming" shared IRQ on the first
+port (after request_irq() call while we have the unexpected IRQ pending
+on the second port) which was uncovered by my rework of the serialized
+interfaces support.
+
+Reported-by: Frans Pop <elendil@planet.nl>
+Tested-by: Frans Pop <elendil@planet.nl>
+Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/ide/ide-probe.c | 23 ++++++++++++++++++++---
+ 1 file changed, 20 insertions(+), 3 deletions(-)
+
+--- a/drivers/ide/ide-probe.c
++++ b/drivers/ide/ide-probe.c
+@@ -830,6 +830,24 @@ static int ide_port_setup_devices(ide_hw
+ return j;
+ }
+
++static void ide_host_enable_irqs(struct ide_host *host)
++{
++ ide_hwif_t *hwif;
++ int i;
++
++ ide_host_for_each_port(i, hwif, host) {
++ if (hwif == NULL)
++ continue;
++
++ /* clear any pending IRQs */
++ hwif->tp_ops->read_status(hwif);
++
++ /* unmask IRQs */
++ if (hwif->io_ports.ctl_addr)
++ hwif->tp_ops->write_devctl(hwif, ATA_DEVCTL_OBS);
++ }
++}
++
+ /*
+ * This routine sets up the IRQ for an IDE interface.
+ */
+@@ -843,9 +861,6 @@ static int init_irq (ide_hwif_t *hwif)
+ if (irq_handler == NULL)
+ irq_handler = ide_intr;
+
+- if (io_ports->ctl_addr)
+- hwif->tp_ops->write_devctl(hwif, ATA_DEVCTL_OBS);
+-
+ if (request_irq(hwif->irq, irq_handler, sa, hwif->name, hwif))
+ goto out_up;
+
+@@ -1389,6 +1404,8 @@ int ide_host_register(struct ide_host *h
+ ide_port_tune_devices(hwif);
+ }
+
++ ide_host_enable_irqs(host);
++
+ ide_host_for_each_port(i, hwif, host) {
+ if (hwif == NULL)
+ continue;
+
+
+From gregkh@mini.kroah.org Thu Aug 13 12:51:31 2009
+Message-Id: <20090813195131.225373807@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 13 Aug 2009 12:50:20 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [patch 45/74] ide: relax DMA info validity checking
+References: <20090813194935.985368088@mini.kroah.org>
+Content-Disposition: inline; filename=ide-relax-dma-info-validity-checking.patch
+Content-Length: 3027
+Lines: 96
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
+
+commit 346c17a6cf60375323adfaa4b8a9d841049f890e upstream.
+
+There are some broken devices that report multiple DMA xfer modes
+enabled at once (ATA spec doesn't allow it) but otherwise work fine
+with DMA so just delete ide_id_dma_bug().
+
+[ As discovered by detective work by Frans and Bart, due to how
+ handling of the ID block was handled before commit c419993
+ ("ide-iops: only clear DMA words on setting DMA mode") this
+ check was always seeing zeros in the fields or other similar
+ garbage. Therefore this check wasn't actually checking anything.
+ Now that the tests actually check the real bits, all we see are
+ devices that trigger the check yet work perfectly fine, therefore
+ killing this useless check is the best thing to do. -DaveM ]
+
+Reported-by: Frans Pop <elendil@planet.nl>
+Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/ide/ide-dma.c | 21 ---------------------
+ drivers/ide/ide-iops.c | 3 ---
+ include/linux/ide.h | 2 --
+ 3 files changed, 26 deletions(-)
+
+--- a/drivers/ide/ide-dma.c
++++ b/drivers/ide/ide-dma.c
+@@ -362,9 +362,6 @@ static int ide_tune_dma(ide_drive_t *dri
+ if (__ide_dma_bad_drive(drive))
+ return 0;
+
+- if (ide_id_dma_bug(drive))
+- return 0;
+-
+ if (hwif->host_flags & IDE_HFLAG_TRUST_BIOS_FOR_DMA)
+ return config_drive_for_dma(drive);
+
+@@ -395,24 +392,6 @@ static int ide_dma_check(ide_drive_t *dr
+ return -1;
+ }
+
+-int ide_id_dma_bug(ide_drive_t *drive)
+-{
+- u16 *id = drive->id;
+-
+- if (id[ATA_ID_FIELD_VALID] & 4) {
+- if ((id[ATA_ID_UDMA_MODES] >> 8) &&
+- (id[ATA_ID_MWDMA_MODES] >> 8))
+- goto err_out;
+- } else if ((id[ATA_ID_MWDMA_MODES] >> 8) &&
+- (id[ATA_ID_SWDMA_MODES] >> 8))
+- goto err_out;
+-
+- return 0;
+-err_out:
+- printk(KERN_ERR "%s: bad DMA info in identify block\n", drive->name);
+- return 1;
+-}
+-
+ int ide_set_dma(ide_drive_t *drive)
+ {
+ int rc;
+--- a/drivers/ide/ide-iops.c
++++ b/drivers/ide/ide-iops.c
+@@ -306,9 +306,6 @@ int ide_driveid_update(ide_drive_t *driv
+
+ kfree(id);
+
+- if ((drive->dev_flags & IDE_DFLAG_USING_DMA) && ide_id_dma_bug(drive))
+- ide_dma_off(drive);
+-
+ return 1;
+ out_err:
+ SELECT_MASK(drive, 0);
+--- a/include/linux/ide.h
++++ b/include/linux/ide.h
+@@ -1384,7 +1384,6 @@ int ide_in_drive_list(u16 *, const struc
+ #ifdef CONFIG_BLK_DEV_IDEDMA
+ int ide_dma_good_drive(ide_drive_t *);
+ int __ide_dma_bad_drive(ide_drive_t *);
+-int ide_id_dma_bug(ide_drive_t *);
+
+ u8 ide_find_dma_mode(ide_drive_t *, u8);
+
+@@ -1425,7 +1424,6 @@ void ide_dma_lost_irq(ide_drive_t *);
+ ide_startstop_t ide_dma_timeout_retry(ide_drive_t *, int);
+
+ #else
+-static inline int ide_id_dma_bug(ide_drive_t *drive) { return 0; }
+ static inline u8 ide_find_dma_mode(ide_drive_t *drive, u8 speed) { return 0; }
+ static inline u8 ide_max_dma_mode(ide_drive_t *drive) { return 0; }
+ static inline void ide_dma_off_quietly(ide_drive_t *drive) { ; }
+
+
+From gregkh@mini.kroah.org Thu Aug 13 12:51:31 2009
+Message-Id: <20090813195131.386899357@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 13 Aug 2009 12:50:21 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Luca Tettamanti <kronos.it@gmail.com>,
+ Jean Delvare <khali@linux-fr.org>
+Subject: [patch 46/74] hwmon: (asus_atk0110) Fix upper limit readings
+References: <20090813194935.985368088@mini.kroah.org>
+Content-Disposition: inline; filename=hwmon-fix-upper-limit-readings.patch
+Content-Length: 1133
+Lines: 33
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Luca Tettamanti <kronos.it@gmail.com>
+
+commit 8d282497cbf8124d6814d51a74fb13d69531c669 upstream.
+
+On newer Asus boards the "upper" limit of a sensor is encoded as
+delta from the "lower" limit. Fix the driver to correctly handle
+this case.
+
+Signed-off-by: Luca Tettamanti <kronos.it@gmail.com>
+Tested-by: Alex Macfarlane Smith <nospam@archifishal.co.uk>
+Signed-off-by: Jean Delvare <khali@linux-fr.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/hwmon/asus_atk0110.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/drivers/hwmon/asus_atk0110.c
++++ b/drivers/hwmon/asus_atk0110.c
+@@ -593,7 +593,11 @@ static int atk_add_sensor(struct atk_dat
+ sensor->data = data;
+ sensor->id = flags->integer.value;
+ sensor->limit1 = limit1->integer.value;
+- sensor->limit2 = limit2->integer.value;
++ if (data->old_interface)
++ sensor->limit2 = limit2->integer.value;
++ else
++ /* The upper limit is expressed as delta from lower limit */
++ sensor->limit2 = sensor->limit1 + limit2->integer.value;
+
+ snprintf(sensor->input_attr_name, ATTR_NAME_SIZE,
+ "%s%d_input", base_name, start + *num);
+
+
+From gregkh@mini.kroah.org Thu Aug 13 12:51:31 2009
+Message-Id: <20090813195131.532954238@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 13 Aug 2009 12:50:22 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jean Delvare <khali@linux-fr.org>,
+ Juerg Haefliger <juergh@gmail.com>,
+ Hans de Goede <hdegoede@redhat.com>
+Subject: [patch 47/74] hwmon: (smsc47m1) Differentiate between LPC47M233 and LPC47M292
+References: <20090813194935.985368088@mini.kroah.org>
+Content-Disposition: inline; filename=hwmon-differentiate-between-lpc47m233-and-lpc47m292.patch
+Content-Length: 1510
+Lines: 51
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Jean Delvare <khali@linux-fr.org>
+
+commit 1b54ab450b180eaeeb0eee6f0f64349246a22c14 upstream.
+
+The SMSC LPC47M233 and LPC47M292 chips have the same device ID but
+are not compatible.
+
+Signed-off-by: Jean Delvare <khali@linux-fr.org>
+Cc: Juerg Haefliger <juergh@gmail.com>
+Acked-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/hwmon/smsc47m1.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+--- a/drivers/hwmon/smsc47m1.c
++++ b/drivers/hwmon/smsc47m1.c
+@@ -86,6 +86,7 @@ superio_exit(void)
+ #define SUPERIO_REG_ACT 0x30
+ #define SUPERIO_REG_BASE 0x60
+ #define SUPERIO_REG_DEVID 0x20
++#define SUPERIO_REG_DEVREV 0x21
+
+ /* Logical device registers */
+
+@@ -429,6 +430,9 @@ static int __init smsc47m1_find(unsigned
+ * The LPC47M292 (device id 0x6B) is somewhat compatible, but it
+ * supports a 3rd fan, and the pin configuration registers are
+ * unfortunately different.
++ * The LPC47M233 has the same device id (0x6B) but is not compatible.
++ * We check the high bit of the device revision register to
++ * differentiate them.
+ */
+ switch (val) {
+ case 0x51:
+@@ -448,6 +452,13 @@ static int __init smsc47m1_find(unsigned
+ sio_data->type = smsc47m1;
+ break;
+ case 0x6B:
++ if (superio_inb(SUPERIO_REG_DEVREV) & 0x80) {
++ pr_debug(DRVNAME ": "
++ "Found SMSC LPC47M233, unsupported\n");
++ superio_exit();
++ return -ENODEV;
++ }
++
+ pr_info(DRVNAME ": Found SMSC LPC47M292\n");
+ sio_data->type = smsc47m2;
+ break;
+
+
+From gregkh@mini.kroah.org Thu Aug 13 12:51:31 2009
+Message-Id: <20090813195131.678614026@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 13 Aug 2009 12:50:23 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Michele Jr De Candia <michele.decandia@valueteam.com>,
+ Rodolfo Giometti <giometti@linux.it>,
+ Jean Delvare <khali@linux-fr.org>
+Subject: [patch 48/74] i2c/tsl2550: Fix lux value in dark environment
+References: <20090813194935.985368088@mini.kroah.org>
+Content-Disposition: inline; filename=i2c-tsl2550-fix-lux-value-in-dark-environment.patch
+Content-Length: 1399
+Lines: 51
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Michele Jr De Candia <michele.decandia@valueteam.com>
+
+commit 96f699ad09c8b3c55cd229506a9add0047838e3e upstream.
+
+I've tested TSL2550 driver and I've found a bug: when light is off,
+returned value from tsl2550_calculate_lux function is -1 when it should
+be 0 (sensor correctly read that light was off).
+
+I think the bug is that a zero c0 value (approximated value of ch0) is
+misinterpreted as an error.
+
+Signed-off-by: Michele Jr De Candia <michele.decandia@valueteam.com>
+Acked-by: Rodolfo Giometti <giometti@linux.it>
+Signed-off-by: Jean Delvare <khali@linux-fr.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+--- a/drivers/i2c/chips/tsl2550.c
++++ b/drivers/i2c/chips/tsl2550.c
+@@ -27,7 +27,7 @@
+ #include <linux/delay.h>
+
+ #define TSL2550_DRV_NAME "tsl2550"
+-#define DRIVER_VERSION "1.1.1"
++#define DRIVER_VERSION "1.1.2"
+
+ /*
+ * Defines
+@@ -189,13 +189,16 @@ static int tsl2550_calculate_lux(u8 ch0, u8 ch1)
+ u8 r = 128;
+
+ /* Avoid division by 0 and count 1 cannot be greater than count 0 */
+- if (c0 && (c1 <= c0))
+- r = c1 * 128 / c0;
++ if (c1 <= c0)
++ if (c0) {
++ r = c1 * 128 / c0;
++
++ /* Calculate LUX */
++ lux = ((c0 - c1) * ratio_lut[r]) / 256;
++ } else
++ lux = 0;
+ else
+- return -1;
+-
+- /* Calculate LUX */
+- lux = ((c0 - c1) * ratio_lut[r]) / 256;
++ return -EAGAIN;
+
+ /* LUX range check */
+ return lux > TSL2550_MAX_LUX ? TSL2550_MAX_LUX : lux;
+
+
+From gregkh@mini.kroah.org Thu Aug 13 12:51:31 2009
+Message-Id: <20090813195131.830210237@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 13 Aug 2009 12:50:24 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Stefan Richter <stefanr@s5r6.in-berlin.de>
+Subject: [patch 49/74] firewire: sbp2: add support for disks >2 TB (and 16 bytes long CDBs)
+References: <20090813194935.985368088@mini.kroah.org>
+Content-Disposition: inline; filename=firewire-sbp2-add-support-for-disks-2-tb.patch
+Content-Length: 1634
+Lines: 50
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Stefan Richter <stefanr@s5r6.in-berlin.de>
+
+Commit af2719415a5ceae06f2a6d33e78b555e64697fc8 upstream.
+
+Increase the command ORB data structure to transport up to 16 bytes long
+CDBs (instead of 12 bytes), and tell the SCSI mid layer about it. This
+is notably necessary for READ CAPACITY(16) and friends, i.e. support of
+large disks.
+
+Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/firewire/fw-sbp2.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+--- a/drivers/firewire/fw-sbp2.c
++++ b/drivers/firewire/fw-sbp2.c
+@@ -190,6 +190,12 @@ struct sbp2_target {
+ #define SBP2_CYCLE_LIMIT (0xc8 << 12) /* 200 125us cycles */
+
+ /*
++ * There is no transport protocol limit to the CDB length, but we implement
++ * a fixed length only. 16 bytes is enough for disks larger than 2 TB.
++ */
++#define SBP2_MAX_CDB_SIZE 16
++
++/*
+ * The default maximum s/g segment size of a FireWire controller is
+ * usually 0x10000, but SBP-2 only allows 0xffff. Since buffers have to
+ * be quadlet-aligned, we set the length limit to 0xffff & ~3.
+@@ -301,7 +307,7 @@ struct sbp2_command_orb {
+ struct sbp2_pointer next;
+ struct sbp2_pointer data_descriptor;
+ __be32 misc;
+- u8 command_block[12];
++ u8 command_block[SBP2_MAX_CDB_SIZE];
+ } request;
+ struct scsi_cmnd *cmd;
+ scsi_done_fn_t done;
+@@ -1135,6 +1141,8 @@ static int sbp2_probe(struct device *dev
+ if (fw_device_enable_phys_dma(device) < 0)
+ goto fail_shost_put;
+
++ shost->max_cmd_len = SBP2_MAX_CDB_SIZE;
++
+ if (scsi_add_host(shost, &unit->device) < 0)
+ goto fail_shost_put;
+
+
+
+From gregkh@mini.kroah.org Thu Aug 13 12:51:32 2009
+Message-Id: <20090813195131.992427366@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 13 Aug 2009 12:50:25 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Stefan Richter <stefanr@s5r6.in-berlin.de>
+Subject: [patch 50/74] ieee1394: sbp2: add support for disks >2 TB (and 16 bytes long CDBs)
+References: <20090813194935.985368088@mini.kroah.org>
+Content-Disposition: inline; filename=ieee1394-sbp2-add-support-for-disks-2-tb.patch
+Content-Length: 1422
+Lines: 51
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Stefan Richter <stefanr@s5r6.in-berlin.de>
+
+Commit ebbb16bffa646f853899ef3fdc0ac7abab888703 upstream.
+
+Increase the command ORB data structure to transport up to 16 bytes long
+CDBs (instead of 12 bytes), and tell the SCSI mid layer about it. This
+is notably necessary for READ CAPACITY(16) and friends, i.e. support of
+large disks.
+
+Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/ieee1394/sbp2.c | 1 +
+ drivers/ieee1394/sbp2.h | 8 +++++++-
+ 2 files changed, 8 insertions(+), 1 deletion(-)
+
+--- a/drivers/ieee1394/sbp2.c
++++ b/drivers/ieee1394/sbp2.c
+@@ -880,6 +880,7 @@ static struct sbp2_lu *sbp2_alloc_device
+ }
+
+ shost->hostdata[0] = (unsigned long)lu;
++ shost->max_cmd_len = SBP2_MAX_CDB_SIZE;
+
+ if (!scsi_add_host(shost, &ud->device)) {
+ lu->shost = shost;
+--- a/drivers/ieee1394/sbp2.h
++++ b/drivers/ieee1394/sbp2.h
+@@ -25,6 +25,12 @@
+ #define SBP2_DEVICE_NAME "sbp2"
+
+ /*
++ * There is no transport protocol limit to the CDB length, but we implement
++ * a fixed length only. 16 bytes is enough for disks larger than 2 TB.
++ */
++#define SBP2_MAX_CDB_SIZE 16
++
++/*
+ * SBP-2 specific definitions
+ */
+
+@@ -51,7 +57,7 @@ struct sbp2_command_orb {
+ u32 data_descriptor_hi;
+ u32 data_descriptor_lo;
+ u32 misc;
+- u8 cdb[12];
++ u8 cdb[SBP2_MAX_CDB_SIZE];
+ } __attribute__((packed));
+
+ #define SBP2_LOGIN_REQUEST 0x0
+
+
+From gregkh@mini.kroah.org Thu Aug 13 12:51:32 2009
+Message-Id: <20090813195132.153955097@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 13 Aug 2009 12:50:26 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Roel Kluin <roel.kluin@gmail.com>,
+ Jie Yang <jie.yang@atheros.com>,
+ Jay Cliburn <jcliburn@gmail.com>,
+ Chris Snook <csnook@redhat.com>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [patch 51/74] atl1c: WAKE_MCAST tested twice, not WAKE_UCAST
+References: <20090813194935.985368088@mini.kroah.org>
+Content-Disposition: inline; filename=atl1c-wake_mcast-tested-twice-not-wake_ucast.patch
+Content-Length: 1041
+Lines: 30
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Roel Kluin <roel.kluin@gmail.com>
+
+commit 0ed586d075ef65c0268982e5b7f36d0ffaa95547 upstream.
+
+The WAKE_MCAST bit is tested twice, the first should be WAKE_UCAST.
+
+Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
+Cc: Jie Yang <jie.yang@atheros.com>
+Cc: Jay Cliburn <jcliburn@gmail.com>
+Cc: Chris Snook <csnook@redhat.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/atl1c/atl1c_ethtool.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/atl1c/atl1c_ethtool.c
++++ b/drivers/net/atl1c/atl1c_ethtool.c
+@@ -271,7 +271,7 @@ static int atl1c_set_wol(struct net_devi
+ struct atl1c_adapter *adapter = netdev_priv(netdev);
+
+ if (wol->wolopts & (WAKE_ARP | WAKE_MAGICSECURE |
+- WAKE_MCAST | WAKE_BCAST | WAKE_MCAST))
++ WAKE_UCAST | WAKE_BCAST | WAKE_MCAST))
+ return -EOPNOTSUPP;
+ /* these settings will always override what we currently have */
+ adapter->wol = 0;
+
+
+From gregkh@mini.kroah.org Thu Aug 13 12:51:32 2009
+Message-Id: <20090813195132.283752239@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 13 Aug 2009 12:50:27 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Roel Kluin <roel.kluin@gmail.com>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [patch 52/74] atl1c: add missing parentheses
+References: <20090813194935.985368088@mini.kroah.org>
+Content-Disposition: inline; filename=atl1c-add-missing-parentheses.patch
+Content-Length: 1530
+Lines: 44
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: roel kluin <roel.kluin@gmail.com>
+
+commit c5ad4f592e27d782faea0a787d9181f192a69ef0 upstream.
+
+Parentheses are required or the comparison occurs before the bitand.
+
+Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/atl1c/atl1c.h | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/atl1c/atl1c.h
++++ b/drivers/net/atl1c/atl1c.h
+@@ -188,14 +188,14 @@ struct atl1c_tpd_ext_desc {
+ #define RRS_HDS_TYPE_DATA 2
+
+ #define RRS_IS_NO_HDS_TYPE(flag) \
+- (((flag) >> (RRS_HDS_TYPE_SHIFT)) & RRS_HDS_TYPE_MASK == 0)
++ ((((flag) >> (RRS_HDS_TYPE_SHIFT)) & RRS_HDS_TYPE_MASK) == 0)
+
+ #define RRS_IS_HDS_HEAD(flag) \
+- (((flag) >> (RRS_HDS_TYPE_SHIFT)) & RRS_HDS_TYPE_MASK == \
++ ((((flag) >> (RRS_HDS_TYPE_SHIFT)) & RRS_HDS_TYPE_MASK) == \
+ RRS_HDS_TYPE_HEAD)
+
+ #define RRS_IS_HDS_DATA(flag) \
+- (((flag) >> (RRS_HDS_TYPE_SHIFT)) & RRS_HDS_TYPE_MASK == \
++ ((((flag) >> (RRS_HDS_TYPE_SHIFT)) & RRS_HDS_TYPE_MASK) == \
+ RRS_HDS_TYPE_DATA)
+
+ /* rrs word 3 bit 0:31 */
+@@ -245,7 +245,7 @@ struct atl1c_tpd_ext_desc {
+ #define RRS_PACKET_TYPE_802_3 1
+ #define RRS_PACKET_TYPE_ETH 0
+ #define RRS_PACKET_IS_ETH(word) \
+- (((word) >> RRS_PACKET_TYPE_SHIFT) & RRS_PACKET_TYPE_MASK == \
++ ((((word) >> RRS_PACKET_TYPE_SHIFT) & RRS_PACKET_TYPE_MASK) == \
+ RRS_PACKET_TYPE_ETH)
+ #define RRS_RXD_IS_VALID(word) \
+ ((((word) >> RRS_RXD_UPDATED_SHIFT) & RRS_RXD_UPDATED_MASK) == 1)
+
+
+From gregkh@mini.kroah.org Thu Aug 13 12:51:32 2009
+Message-Id: <20090813195132.410969736@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 13 Aug 2009 12:50:28 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Roel Kluin <roel.kluin@gmail.com>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [patch 53/74] atl1c: misplaced parenthesis
+References: <20090813194935.985368088@mini.kroah.org>
+Content-Disposition: inline; filename=atl1c-misplaced-parenthesis.patch
+Content-Length: 797
+Lines: 26
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: roel kluin <roel.kluin@gmail.com>
+
+commit 37b76c697f4ac082e9923dfa8e8aecc8bc54a8e1 upstream.
+
+Fix misplaced parenthesis
+
+Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/atl1c/atl1c_main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/atl1c/atl1c_main.c
++++ b/drivers/net/atl1c/atl1c_main.c
+@@ -1701,7 +1701,7 @@ static void atl1c_clean_rx_irq(struct at
+ if (likely(RRS_RXD_IS_VALID(rrs->word3))) {
+ rfd_num = (rrs->word0 >> RRS_RX_RFD_CNT_SHIFT) &
+ RRS_RX_RFD_CNT_MASK;
+- if (unlikely(rfd_num) != 1)
++ if (unlikely(rfd_num != 1))
+ /* TODO support mul rfd*/
+ if (netif_msg_rx_err(adapter))
+ dev_warn(&pdev->dev,
+
+
+From gregkh@mini.kroah.org Thu Aug 13 12:51:32 2009
+Message-Id: <20090813195132.580843987@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 13 Aug 2009 12:50:29 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ Greg KH <greg@kroah.com>
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ NeilBrown <neilb@suse.de>
+Subject: [patch 54/74] md: Handle growth of v1.x metadata correctly.
+References: <20090813194935.985368088@mini.kroah.org>
+Content-Disposition: inline; filename=md-handle-growth-of-v1.x-metadata-correctly.patch
+Content-Length: 1168
+Lines: 40
+
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Neil Brown <neilb@suse.de>
+
+commit 70471dafe3390243c598a3165dfb86b8b8b3f4fe upstream.
+
+The v1.x metadata does not have a fixed size and can grow
+when devices are added.
+If it grows enough to require an extra sector of storage,
+we need to update the 'sb_size' to match.
+
+Without this, md can write out an incomplete superblock with a
+bad checksum, which will be rejected when trying to re-assemble
+the array.
+
+Signed-off-by: NeilBrown <neilb@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/md.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -1410,8 +1410,14 @@ static void super_1_sync(mddev_t *mddev,
+ if (rdev2->desc_nr+1 > max_dev)
+ max_dev = rdev2->desc_nr+1;
+
+- if (max_dev > le32_to_cpu(sb->max_dev))
++ if (max_dev > le32_to_cpu(sb->max_dev)) {
++ int bmask;
+ sb->max_dev = cpu_to_le32(max_dev);
++ rdev->sb_size = max_dev * 2 + 256;
++ bmask = queue_hardsect_size(rdev->bdev->bd_disk->queue)-1;
++ if (rdev->sb_size & bmask)
++ rdev->sb_size = (rdev->sb_size | bmask) + 1;
++ }
+ for (i=0; i<max_dev;i++)
+ sb->dev_roles[i] = cpu_to_le16(0xfffe);
+
+
+
+From gregkh@mini.kroah.org Thu Aug 13 12:51:32 2009
+Message-Id: <20090813195132.711720396@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 13 Aug 2009 12:50:30 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Eric Dumazet <eric.dumazet@gmail.com>,
+ Oleg Nesterov <oleg@redhat.com>,
+ Peter Zijlstra <peterz@infradead.org>,
+ Sonny Rao <sonnyrao@us.ibm.com>,
+ Ingo Molnar <mingo@elte.hu>,
+ Thomas Gleixner <tglx@linutronix.de>,
+ Ulrich Drepper <drepper@redhat.com>
+Subject: [patch 55/74] execve: must clear current->clear_child_tid
+References: <20090813194935.985368088@mini.kroah.org>
+Content-Disposition: inline; filename=execve-must-clear-current-clear_child_tid.patch
+Content-Length: 4327
+Lines: 122
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Eric Dumazet <eric.dumazet@gmail.com>
+
+commit 9c8a8228d0827e0d91d28527209988f672f97d28 upstream.
+
+While looking at Jens Rosenboom bug report
+(http://lkml.org/lkml/2009/7/27/35) about strange sys_futex call done from
+a dying "ps" program, we found following problem.
+
+clone() syscall has special support for TID of created threads. This
+support includes two features.
+
+One (CLONE_CHILD_SETTID) is to set an integer into user memory with the
+TID value.
+
+One (CLONE_CHILD_CLEARTID) is to clear this same integer once the created
+thread dies.
+
+The integer location is a user provided pointer, provided at clone()
+time.
+
+kernel keeps this pointer value into current->clear_child_tid.
+
+At execve() time, we should make sure kernel doesnt keep this user
+provided pointer, as full user memory is replaced by a new one.
+
+As glibc fork() actually uses clone() syscall with CLONE_CHILD_SETTID and
+CLONE_CHILD_CLEARTID set, chances are high that we might corrupt user
+memory in forked processes.
+
+Following sequence could happen:
+
+1) bash (or any program) starts a new process, by a fork() call that
+ glibc maps to a clone( ... CLONE_CHILD_SETTID | CLONE_CHILD_CLEARTID
+ ...) syscall
+
+2) When new process starts, its current->clear_child_tid is set to a
+ location that has a meaning only in bash (or initial program) context
+ (&THREAD_SELF->tid)
+
+3) This new process does the execve() syscall to start a new program.
+ current->clear_child_tid is left unchanged (a non NULL value)
+
+4) If this new program creates some threads, and initial thread exits,
+ kernel will attempt to clear the integer pointed by
+ current->clear_child_tid from mm_release() :
+
+ if (tsk->clear_child_tid
+ && !(tsk->flags & PF_SIGNALED)
+ && atomic_read(&mm->mm_users) > 1) {
+ u32 __user * tidptr = tsk->clear_child_tid;
+ tsk->clear_child_tid = NULL;
+
+ /*
+ * We don't check the error code - if userspace has
+ * not set up a proper pointer then tough luck.
+ */
+<< here >> put_user(0, tidptr);
+ sys_futex(tidptr, FUTEX_WAKE, 1, NULL, NULL, 0);
+ }
+
+5) OR : if new program is not multi-threaded, but spied by /proc/pid
+ users (ps command for example), mm_users > 1, and the exiting program
+ could corrupt 4 bytes in a persistent memory area (shm or memory mapped
+ file)
+
+If current->clear_child_tid points to a writeable portion of memory of the
+new program, kernel happily and silently corrupts 4 bytes of memory, with
+unexpected effects.
+
+Fix is straightforward and should not break any sane program.
+
+Reported-by: Jens Rosenboom <jens@mcbone.net>
+Acked-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
+Signed-off-by: Oleg Nesterov <oleg@redhat.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Sonny Rao <sonnyrao@us.ibm.com>
+Cc: Ingo Molnar <mingo@elte.hu>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Ulrich Drepper <drepper@redhat.com>
+Cc: Oleg Nesterov <oleg@redhat.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/fork.c | 22 +++++++++++-----------
+ 1 file changed, 11 insertions(+), 11 deletions(-)
+
+--- a/kernel/fork.c
++++ b/kernel/fork.c
+@@ -568,18 +568,18 @@ void mm_release(struct task_struct *tsk,
+ * the value intact in a core dump, and to save the unnecessary
+ * trouble otherwise. Userland only wants this done for a sys_exit.
+ */
+- if (tsk->clear_child_tid
+- && !(tsk->flags & PF_SIGNALED)
+- && atomic_read(&mm->mm_users) > 1) {
+- u32 __user * tidptr = tsk->clear_child_tid;
++ if (tsk->clear_child_tid) {
++ if (!(tsk->flags & PF_SIGNALED) &&
++ atomic_read(&mm->mm_users) > 1) {
++ /*
++ * We don't check the error code - if userspace has
++ * not set up a proper pointer then tough luck.
++ */
++ put_user(0, tsk->clear_child_tid);
++ sys_futex(tsk->clear_child_tid, FUTEX_WAKE,
++ 1, NULL, NULL, 0);
++ }
+ tsk->clear_child_tid = NULL;
+-
+- /*
+- * We don't check the error code - if userspace has
+- * not set up a proper pointer then tough luck.
+- */
+- put_user(0, tidptr);
+- sys_futex(tidptr, FUTEX_WAKE, 1, NULL, NULL, 0);
+ }
+ }
+
+
+
+From gregkh@mini.kroah.org Thu Aug 13 12:51:33 2009
+Message-Id: <20090813195132.877694343@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 13 Aug 2009 12:50:31 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Mike Frysinger <vapier@gentoo.org>,
+ David Howells <dhowells@redhat.com>
+Subject: [patch 56/74] flat: fix uninitialized ptr with shared libs
+References: <20090813194935.985368088@mini.kroah.org>
+Content-Disposition: inline; filename=flat-fix-uninitialized-ptr-with-shared-libs.patch
+Content-Length: 1230
+Lines: 50
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Linus Torvalds <torvalds@linux-foundation.org>
+
+commit 3440625d78711bee41a84cf29c3d8c579b522666 upstream.
+
+The new credentials code broke load_flat_shared_library() as it now uses
+an uninitialized cred pointer.
+
+Reported-by: Bernd Schmidt <bernds_cb1@t-online.de>
+Tested-by: Bernd Schmidt <bernds_cb1@t-online.de>
+Cc: Mike Frysinger <vapier@gentoo.org>
+Cc: David Howells <dhowells@redhat.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/binfmt_flat.c | 17 ++++++++++++-----
+ 1 file changed, 12 insertions(+), 5 deletions(-)
+
+--- a/fs/binfmt_flat.c
++++ b/fs/binfmt_flat.c
+@@ -828,15 +828,22 @@ static int load_flat_shared_library(int
+ if (IS_ERR(bprm.file))
+ return res;
+
++ bprm.cred = prepare_exec_creds();
++ res = -ENOMEM;
++ if (!bprm.cred)
++ goto out;
++
+ res = prepare_binprm(&bprm);
+
+ if (res <= (unsigned long)-4096)
+ res = load_flat_file(&bprm, libs, id, NULL);
+- if (bprm.file) {
+- allow_write_access(bprm.file);
+- fput(bprm.file);
+- bprm.file = NULL;
+- }
++
++ abort_creds(bprm.cred);
++
++out:
++ allow_write_access(bprm.file);
++ fput(bprm.file);
++
+ return(res);
+ }
+
+
+
+From gregkh@mini.kroah.org Thu Aug 13 12:51:33 2009
+Message-Id: <20090813195133.025035073@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 13 Aug 2009 12:50:32 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Eric Sandeen <sandeen@redhat.com>,
+ <linux-ext4@vger.kernel.org>,
+ Mark Lord <lkml@rtr.ca>,
+ Arnd Bergmann <arnd@arndb.de>,
+ Josef Bacik <josef@redhat.com>,
+ Jan Kara <jack@suse.cz>
+Subject: [patch 57/74] compat_ioctl: hook up compat handler for FIEMAP ioctl
+References: <20090813194935.985368088@mini.kroah.org>
+Content-Disposition: inline; filename=compat_ioctl-hook-up-compat-handler-for-fiemap-ioctl.patch
+Content-Length: 1160
+Lines: 38
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Eric Sandeen <sandeen@redhat.com>
+
+commit 69130c7cf96ea853dc5be599dd6a4b98907d39cc upstream.
+
+The FIEMAP_IOC_FIEMAP mapping ioctl was missing a 32-bit compat handler,
+which means that 32-bit suerspace on 64-bit kernels cannot use this ioctl
+command.
+
+The structure is nicely aligned, padded, and sized, so it is just this
+simple.
+
+Tested w/ 32-bit ioctl tester (from Josef) on a 64-bit kernel on ext4.
+
+Signed-off-by: Eric Sandeen <sandeen@redhat.com>
+Cc: <linux-ext4@vger.kernel.org>
+Cc: Mark Lord <lkml@rtr.ca>
+Cc: Arnd Bergmann <arnd@arndb.de>
+Cc: Josef Bacik <josef@redhat.com>
+Cc: Jan Kara <jack@suse.cz>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/compat_ioctl.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/fs/compat_ioctl.c
++++ b/fs/compat_ioctl.c
+@@ -1915,6 +1915,7 @@ COMPATIBLE_IOCTL(FIONCLEX)
+ COMPATIBLE_IOCTL(FIOASYNC)
+ COMPATIBLE_IOCTL(FIONBIO)
+ COMPATIBLE_IOCTL(FIONREAD) /* This is also TIOCINQ */
++COMPATIBLE_IOCTL(FS_IOC_FIEMAP)
+ /* 0x00 */
+ COMPATIBLE_IOCTL(FIBMAP)
+ COMPATIBLE_IOCTL(FIGETBSZ)
+
+
+From gregkh@mini.kroah.org Thu Aug 13 12:51:33 2009
+Message-Id: <20090813195133.179908882@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 13 Aug 2009 12:50:33 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Xiao Guangrong <xiaoguangrong@cn.fujitsu.com>,
+ Ingo Molnar <mingo@elte.hu>,
+ Jens Axboe <jens.axboe@oracle.com>,
+ Nick Piggin <nickpiggin@yahoo.com.au>,
+ Peter Zijlstra <peterz@infradead.org>,
+ Rusty Russell <rusty@rustcorp.com.au>
+Subject: [patch 58/74] generic-ipi: fix hotplug_cfd()
+References: <20090813194935.985368088@mini.kroah.org>
+Content-Disposition: inline; filename=generic-ipi-fix-hotplug_cfd.patch
+Content-Length: 1140
+Lines: 38
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Xiao Guangrong <xiaoguangrong@cn.fujitsu.com>
+
+commit 69dd647f969c28d18de77e2153f30d05a1874571 upstream.
+
+Use CONFIG_HOTPLUG_CPU, not CONFIG_CPU_HOTPLUG
+
+When hot-unpluging a cpu, it will leak memory allocated at cpu hotplug,
+but only if CPUMASK_OFFSTACK=y, which is default to n.
+
+The bug was introduced by 8969a5ede0f9e17da4b943712429aef2c9bcd82b
+("generic-ipi: remove kmalloc()").
+
+Signed-off-by: Xiao Guangrong <xiaoguangrong@cn.fujitsu.com>
+Cc: Ingo Molnar <mingo@elte.hu>
+Cc: Jens Axboe <jens.axboe@oracle.com>
+Cc: Nick Piggin <nickpiggin@yahoo.com.au>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Rusty Russell <rusty@rustcorp.com.au>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/smp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/kernel/smp.c
++++ b/kernel/smp.c
+@@ -57,7 +57,7 @@ hotplug_cfd(struct notifier_block *nfb,
+ return NOTIFY_BAD;
+ break;
+
+-#ifdef CONFIG_CPU_HOTPLUG
++#ifdef CONFIG_HOTPLUG_CPU
+ case CPU_UP_CANCELED:
+ case CPU_UP_CANCELED_FROZEN:
+
+
+
+From gregkh@mini.kroah.org Thu Aug 13 12:51:33 2009
+Message-Id: <20090813195133.309452779@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 13 Aug 2009 12:50:34 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Mike Galbraith <efault@gmx.de>,
+ Peter Teoh <htmldeveloper@gmail.com>
+Subject: [patch 59/74] Staging: rt2870: Revert d44ca7 Removal of kernel_thread() API
+References: <20090813194935.985368088@mini.kroah.org>
+Content-Disposition: inline; filename=staging-rt2870-revert-d44ca7-removal-of-kernel_thread-api.patch
+Content-Length: 10222
+Lines: 325
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Greg Kroah-Hartman <gregkh@suse.de>
+
+commit 2c63abf9e8a51dec886da482dfd8ae752581a61c upstream.
+
+[Mike Galbraith did the upstream revert, which was more complex]
+
+Staging: rt2870: Revert d44ca7 Removal of kernel_thread() API
+
+The sanity check this patch introduced triggers on shutdown, apparently due to
+threads having already exited by the time BUG_ON() is reached.
+
+Cc: Mike Galbraith <efault@gmx.de>
+Cc: Peter Teoh <htmldeveloper@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+
+---
+ drivers/staging/rt2870/2870_main_dev.c | 67 ++++++++++++++++---------
+ drivers/staging/rt2870/common/2870_rtmp_init.c | 35 +++++--------
+ drivers/staging/rt2870/common/cmm_data.c | 3 +
+ drivers/staging/rt2870/common/rtmp_init.c | 2
+ drivers/staging/rt2870/common/rtusb_io.c | 3 -
+ drivers/staging/rt2870/rt2870.h | 6 --
+ drivers/staging/rt2870/rt_linux.h | 11 ++--
+ 7 files changed, 74 insertions(+), 53 deletions(-)
+
+--- a/drivers/staging/rt2870/2870_main_dev.c
++++ b/drivers/staging/rt2870/2870_main_dev.c
+@@ -265,7 +265,7 @@ INT MlmeThread(
+ */
+ DBGPRINT(RT_DEBUG_TRACE,( "<---%s\n",__func__));
+
+- pObj->MLMEThr_task = NULL;
++ pObj->MLMEThr_pid = THREAD_PID_INIT_VALUE;
+
+ complete_and_exit (&pAd->mlmeComplete, 0);
+ return 0;
+@@ -373,7 +373,7 @@ INT RTUSBCmdThread(
+ */
+ DBGPRINT(RT_DEBUG_TRACE,( "<---RTUSBCmdThread\n"));
+
+- pObj->RTUSBCmdThr_task = NULL;
++ pObj->RTUSBCmdThr_pid = THREAD_PID_INIT_VALUE;
+
+ complete_and_exit (&pAd->CmdQComplete, 0);
+ return 0;
+@@ -467,7 +467,7 @@ INT TimerQThread(
+ */
+ DBGPRINT(RT_DEBUG_TRACE,( "<---%s\n",__func__));
+
+- pObj->TimerQThr_task = NULL;
++ pObj->TimerQThr_pid = THREAD_PID_INIT_VALUE;
+
+ complete_and_exit(&pAd->TimerQComplete, 0);
+ return 0;
+@@ -944,46 +944,69 @@ VOID RT28xxThreadTerminate(
+ RTUSBCancelPendingIRPs(pAd);
+
+ // Terminate Threads
+- BUG_ON(pObj->TimerQThr_task == NULL);
+- CHECK_PID_LEGALITY(task_pid(pObj->TimerQThr_task))
++ CHECK_PID_LEGALITY(pObj->TimerQThr_pid)
+ {
+ POS_COOKIE pObj = (POS_COOKIE)pAd->OS_Cookie;
+
+- printk(KERN_DEBUG "Terminate the TimerQThr pid=%d!\n",
+- pid_nr(task_pid(pObj->TimerQThr_task)));
++ printk("Terminate the TimerQThr_pid=%d!\n", GET_PID_NUMBER(pObj->TimerQThr_pid));
+ mb();
+ pAd->TimerFunc_kill = 1;
+ mb();
+- kthread_stop(pObj->TimerQThr_task);
+- pObj->TimerQThr_task = NULL;
++ ret = KILL_THREAD_PID(pObj->TimerQThr_pid, SIGTERM, 1);
++ if (ret)
++ {
++ printk(KERN_WARNING "%s: unable to stop TimerQThread, pid=%d, ret=%d!\n",
++ pAd->net_dev->name, GET_PID_NUMBER(pObj->TimerQThr_pid), ret);
++ }
++ else
++ {
++ wait_for_completion(&pAd->TimerQComplete);
++ pObj->TimerQThr_pid = THREAD_PID_INIT_VALUE;
++ }
+ }
+
+- BUG_ON(pObj->MLMEThr_task == NULL);
+- CHECK_PID_LEGALITY(task_pid(pObj->MLMEThr_task))
++ CHECK_PID_LEGALITY(pObj->MLMEThr_pid)
+ {
+- printk(KERN_DEBUG "Terminate the MLMEThr pid=%d!\n",
+- pid_nr(task_pid(pObj->MLMEThr_task)));
++ printk("Terminate the MLMEThr_pid=%d!\n", GET_PID_NUMBER(pObj->MLMEThr_pid));
+ mb();
+ pAd->mlme_kill = 1;
+ //RT28XX_MLME_HANDLER(pAd);
+ mb();
+- kthread_stop(pObj->MLMEThr_task);
+- pObj->MLMEThr_task = NULL;
++ ret = KILL_THREAD_PID(pObj->MLMEThr_pid, SIGTERM, 1);
++ if (ret)
++ {
++ printk (KERN_WARNING "%s: unable to Mlme thread, pid=%d, ret=%d!\n",
++ pAd->net_dev->name, GET_PID_NUMBER(pObj->MLMEThr_pid), ret);
++ }
++ else
++ {
++ //wait_for_completion (&pAd->notify);
++ wait_for_completion (&pAd->mlmeComplete);
++ pObj->MLMEThr_pid = THREAD_PID_INIT_VALUE;
++ }
+ }
+
+- BUG_ON(pObj->RTUSBCmdThr_task == NULL);
+- CHECK_PID_LEGALITY(task_pid(pObj->RTUSBCmdThr_task))
++ CHECK_PID_LEGALITY(pObj->RTUSBCmdThr_pid)
+ {
+- printk(KERN_DEBUG "Terminate the RTUSBCmdThr pid=%d!\n",
+- pid_nr(task_pid(pObj->RTUSBCmdThr_task)));
++ printk("Terminate the RTUSBCmdThr_pid=%d!\n", GET_PID_NUMBER(pObj->RTUSBCmdThr_pid));
+ mb();
+ NdisAcquireSpinLock(&pAd->CmdQLock);
+ pAd->CmdQ.CmdQState = RT2870_THREAD_STOPED;
+ NdisReleaseSpinLock(&pAd->CmdQLock);
+ mb();
+ //RTUSBCMDUp(pAd);
+- kthread_stop(pObj->RTUSBCmdThr_task);
+- pObj->RTUSBCmdThr_task = NULL;
++ ret = KILL_THREAD_PID(pObj->RTUSBCmdThr_pid, SIGTERM, 1);
++ if (ret)
++ {
++ printk(KERN_WARNING "%s: unable to RTUSBCmd thread, pid=%d, ret=%d!\n",
++ pAd->net_dev->name, GET_PID_NUMBER(pObj->RTUSBCmdThr_pid), ret);
++ }
++ else
++ {
++ //wait_for_completion (&pAd->notify);
++ wait_for_completion (&pAd->CmdQComplete);
++ pObj->RTUSBCmdThr_pid = THREAD_PID_INIT_VALUE;
++ }
+ }
+
+
+@@ -1044,7 +1067,7 @@ BOOLEAN RT28XXChipsetCheck(
+ if (dev_p->descriptor.idVendor == rtusb_usb_id[i].idVendor &&
+ dev_p->descriptor.idProduct == rtusb_usb_id[i].idProduct)
+ {
+- printk(KERN_DEBUG "rt2870: idVendor = 0x%x, idProduct = 0x%x\n",
++ printk("rt2870: idVendor = 0x%x, idProduct = 0x%x\n",
+ dev_p->descriptor.idVendor, dev_p->descriptor.idProduct);
+ break;
+ }
+--- a/drivers/staging/rt2870/common/2870_rtmp_init.c
++++ b/drivers/staging/rt2870/common/2870_rtmp_init.c
+@@ -727,8 +727,8 @@ NDIS_STATUS AdapterBlockAllocateMemory(
+
+ usb_dev = pObj->pUsb_Dev;
+
+- pObj->MLMEThr_task = NULL;
+- pObj->RTUSBCmdThr_task = NULL;
++ pObj->MLMEThr_pid = THREAD_PID_INIT_VALUE;
++ pObj->RTUSBCmdThr_pid = THREAD_PID_INIT_VALUE;
+
+ *ppAd = (PVOID)vmalloc(sizeof(RTMP_ADAPTER));
+
+@@ -765,7 +765,7 @@ NDIS_STATUS CreateThreads(
+ {
+ PRTMP_ADAPTER pAd = net_dev->ml_priv;
+ POS_COOKIE pObj = (POS_COOKIE) pAd->OS_Cookie;
+- struct task_struct *tsk;
++ pid_t pid_number = -1;
+
+ //init_MUTEX(&(pAd->usbdev_semaphore));
+
+@@ -779,39 +779,36 @@ NDIS_STATUS CreateThreads(
+ init_completion (&pAd->TimerQComplete);
+
+ // Creat MLME Thread
+- pObj->MLMEThr_task = NULL;
+- tsk = kthread_run(MlmeThread, pAd, pAd->net_dev->name);
+-
+- if (IS_ERR(tsk)) {
++ pObj->MLMEThr_pid= THREAD_PID_INIT_VALUE;
++ pid_number = kernel_thread(MlmeThread, pAd, CLONE_VM);
++ if (pid_number < 0)
++ {
+ printk (KERN_WARNING "%s: unable to start Mlme thread\n",pAd->net_dev->name);
+ return NDIS_STATUS_FAILURE;
+ }
+-
+- pObj->MLMEThr_task = tsk;
++ pObj->MLMEThr_pid = GET_PID(pid_number);
+ // Wait for the thread to start
+ wait_for_completion(&(pAd->mlmeComplete));
+
+ // Creat Command Thread
+- pObj->RTUSBCmdThr_task = NULL;
+- tsk = kthread_run(RTUSBCmdThread, pAd, pAd->net_dev->name);
+-
+- if (IS_ERR(tsk) < 0)
++ pObj->RTUSBCmdThr_pid= THREAD_PID_INIT_VALUE;
++ pid_number = kernel_thread(RTUSBCmdThread, pAd, CLONE_VM);
++ if (pid_number < 0)
+ {
+ printk (KERN_WARNING "%s: unable to start RTUSBCmd thread\n",pAd->net_dev->name);
+ return NDIS_STATUS_FAILURE;
+ }
+-
+- pObj->RTUSBCmdThr_task = tsk;
++ pObj->RTUSBCmdThr_pid = GET_PID(pid_number);
+ wait_for_completion(&(pAd->CmdQComplete));
+
+- pObj->TimerQThr_task = NULL;
+- tsk = kthread_run(TimerQThread, pAd, pAd->net_dev->name);
+- if (IS_ERR(tsk) < 0)
++ pObj->TimerQThr_pid= THREAD_PID_INIT_VALUE;
++ pid_number = kernel_thread(TimerQThread, pAd, CLONE_VM);
++ if (pid_number < 0)
+ {
+ printk (KERN_WARNING "%s: unable to start TimerQThread\n",pAd->net_dev->name);
+ return NDIS_STATUS_FAILURE;
+ }
+- pObj->TimerQThr_task = tsk;
++ pObj->TimerQThr_pid = GET_PID(pid_number);
+ // Wait for the thread to start
+ wait_for_completion(&(pAd->TimerQComplete));
+
+--- a/drivers/staging/rt2870/common/cmm_data.c
++++ b/drivers/staging/rt2870/common/cmm_data.c
+@@ -709,6 +709,9 @@ BOOLEAN RTMP_FillTxBlkInfo(
+ }
+
+ return TRUE;
++
++FillTxBlkErr:
++ return FALSE;
+ }
+
+
+--- a/drivers/staging/rt2870/common/rtmp_init.c
++++ b/drivers/staging/rt2870/common/rtmp_init.c
+@@ -3655,7 +3655,7 @@ VOID UserCfgInit(
+ #ifdef RALINK_28xx_QA
+ //pAd->ate.Repeat = 0;
+ pAd->ate.TxStatus = 0;
+- pAd->ate.AtePid = NULL;
++ pAd->ate.AtePid = THREAD_PID_INIT_VALUE;
+ #endif // RALINK_28xx_QA //
+ #endif // RALINK_ATE //
+
+--- a/drivers/staging/rt2870/common/rtusb_io.c
++++ b/drivers/staging/rt2870/common/rtusb_io.c
+@@ -958,8 +958,7 @@ NDIS_STATUS RTUSBEnqueueCmdFromNdis(
+ POS_COOKIE pObj = (POS_COOKIE) pAd->OS_Cookie;
+
+
+- BUG_ON(pObj->RTUSBCmdThr_task == NULL);
+- CHECK_PID_LEGALITY(task_pid(pObj->RTUSBCmdThr_task))
++ CHECK_PID_LEGALITY(pObj->RTUSBCmdThr_pid)
+ return (NDIS_STATUS_RESOURCES);
+
+ status = RTMPAllocateMemory((PVOID *)&cmdqelmt, sizeof(CmdQElmt));
+--- a/drivers/staging/rt2870/rt2870.h
++++ b/drivers/staging/rt2870/rt2870.h
+@@ -580,16 +580,14 @@ VOID RTUSBBulkRxComplete(purbb_t pUrb, s
+ #define RTUSBMlmeUp(pAd) \
+ { \
+ POS_COOKIE pObj = (POS_COOKIE) pAd->OS_Cookie; \
+- BUG_ON(pObj->MLMEThr_task == NULL); \
+- CHECK_PID_LEGALITY(task_pid(pObj->MLMEThr_task)) \
++ CHECK_PID_LEGALITY(pObj->MLMEThr_pid) \
+ up(&(pAd->mlme_semaphore)); \
+ }
+
+ #define RTUSBCMDUp(pAd) \
+ { \
+ POS_COOKIE pObj = (POS_COOKIE) pAd->OS_Cookie; \
+- BUG_ON(pObj->RTUSBCmdThr_task == NULL); \
+- CHECK_PID_LEGALITY(task_pid(pObj->RTUSBCmdThr_task)) \
++ CHECK_PID_LEGALITY(pObj->RTUSBCmdThr_pid) \
+ up(&(pAd->RTUSBCmd_semaphore)); \
+ }
+
+--- a/drivers/staging/rt2870/rt_linux.h
++++ b/drivers/staging/rt2870/rt_linux.h
+@@ -44,7 +44,6 @@
+ #include <linux/module.h>
+ #include <linux/version.h>
+ #include <linux/kernel.h>
+-#include <linux/kthread.h>
+
+ #include <linux/spinlock.h>
+ #include <linux/init.h>
+@@ -166,12 +165,14 @@ typedef int (*HARD_START_XMIT_FUNC)(stru
+
+ #if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,27)
+ typedef struct pid * THREAD_PID;
++#define THREAD_PID_INIT_VALUE NULL
+ #define GET_PID(_v) find_get_pid(_v)
+ #define GET_PID_NUMBER(_v) pid_nr(_v)
+ #define CHECK_PID_LEGALITY(_pid) if (pid_nr(_pid) >= 0)
+ #define KILL_THREAD_PID(_A, _B, _C) kill_pid(_A, _B, _C)
+ #else
+ typedef pid_t THREAD_PID;
++#define THREAD_PID_INIT_VALUE -1
+ #define GET_PID(_v) _v
+ #define GET_PID_NUMBER(_v) _v
+ #define CHECK_PID_LEGALITY(_pid) if (_pid >= 0)
+@@ -187,11 +188,11 @@ struct os_lock {
+ struct os_cookie {
+
+ #ifdef RT2870
+- struct usb_device *pUsb_Dev;
++ struct usb_device *pUsb_Dev;
+
+- struct task_struct *MLMEThr_task;
+- struct task_struct *RTUSBCmdThr_task;
+- struct task_struct *TimerQThr_task;
++ THREAD_PID MLMEThr_pid;
++ THREAD_PID RTUSBCmdThr_pid;
++ THREAD_PID TimerQThr_pid;
+ #endif // RT2870 //
+
+ struct tasklet_struct rx_done_task;
+
+
+From gregkh@mini.kroah.org Thu Aug 13 12:51:33 2009
+Message-Id: <20090813195133.435305300@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 13 Aug 2009 12:50:35 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ =?ISO-8859-15?q?Marko=20H=C3=A4nninen?= <bugitus@gmail.com>
+Subject: [patch 60/74] USB: ftdi_sio: add vendor and product id for Bayer glucose meter serial converter cable
+References: <20090813194935.985368088@mini.kroah.org>
+Content-Disposition: inline; filename=usb-ftdi_sio-add-vendor-and-product-id-for-bayer-glucose-meter-serial-converter-cable.patch
+Content-Length: 1473
+Lines: 45
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Marko Hänninen <bugitus@gmail.com>
+
+commit c47aacc67a3d26dfab9c9b8965975ed2b2010b30 upstream.
+
+Attached patch adds USB vendor and product IDs for Bayer's USB to serial
+converter cable used by Bayer blood glucose meters. It seems to be a
+FT232RL based device and works without any problem with ftdi_sio driver
+when this patch is applied. See: http://winglucofacts.com/cables/
+
+
+Signed-off-by: Marko Hänninen <bugitus@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/serial/ftdi_sio.c | 1 +
+ drivers/usb/serial/ftdi_sio.h | 7 +++++++
+ 2 files changed, 8 insertions(+)
+
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -672,6 +672,7 @@ static struct usb_device_id id_table_com
+ { USB_DEVICE(JETI_VID, JETI_SPC1201_PID) },
+ { USB_DEVICE(MARVELL_VID, MARVELL_SHEEVAPLUG_PID),
+ .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
++ { USB_DEVICE(BAYER_VID, BAYER_CONTOUR_CABLE_PID) },
+ { }, /* Optional parameter entry */
+ { } /* Terminating entry */
+ };
+--- a/drivers/usb/serial/ftdi_sio.h
++++ b/drivers/usb/serial/ftdi_sio.h
+@@ -926,6 +926,13 @@
+ #define MARVELL_SHEEVAPLUG_PID 0x9e8f
+
+ /*
++ * Bayer Ascensia Contour blood glucose meter USB-converter cable.
++ * http://winglucofacts.com/cables/
++ */
++#define BAYER_VID 0x1A79
++#define BAYER_CONTOUR_CABLE_PID 0x6001
++
++/*
+ * BmRequestType: 1100 0000b
+ * bRequest: FTDI_E2_READ
+ * wValue: 0
+
+
+From gregkh@mini.kroah.org Thu Aug 13 12:51:33 2009
+Message-Id: <20090813195133.580120781@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 13 Aug 2009 12:50:36 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Dhaval Vasa <dhaval.vasa@einfochips.com>
+Subject: [patch 61/74] USB: ftdi_sio: add product_id for Marvell OpenRD Base, Client
+References: <20090813194935.985368088@mini.kroah.org>
+Content-Disposition: inline; filename=usb-ftdi_sio-add-product_id-for-marvell-openrd-base-client.patch
+Content-Length: 1233
+Lines: 43
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Dhaval Vasa <dhaval.vasa@einfochips.com>
+
+commit 50d0678e2026c18e4147f0b16b5853113659b82d upstream.
+
+reference:
+http://www.open-rd.org
+
+Signed-off-by: Dhaval Vasa <dhaval.vasa@einfochips.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/serial/ftdi_sio.c | 2 ++
+ drivers/usb/serial/ftdi_sio.h | 7 +++++++
+ 2 files changed, 9 insertions(+)
+
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -673,6 +673,8 @@ static struct usb_device_id id_table_com
+ { USB_DEVICE(MARVELL_VID, MARVELL_SHEEVAPLUG_PID),
+ .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
+ { USB_DEVICE(BAYER_VID, BAYER_CONTOUR_CABLE_PID) },
++ { USB_DEVICE(FTDI_VID, MARVELL_OPENRD_PID),
++ .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
+ { }, /* Optional parameter entry */
+ { } /* Terminating entry */
+ };
+--- a/drivers/usb/serial/ftdi_sio.h
++++ b/drivers/usb/serial/ftdi_sio.h
+@@ -933,6 +933,13 @@
+ #define BAYER_CONTOUR_CABLE_PID 0x6001
+
+ /*
++ * Marvell OpenRD Base, Client
++ * http://www.open-rd.org
++ * OpenRD Base, Client use VID 0x0403
++ */
++#define MARVELL_OPENRD_PID 0x9e90
++
++/*
+ * BmRequestType: 1100 0000b
+ * bRequest: FTDI_E2_READ
+ * wValue: 0
+
+
+From gregkh@mini.kroah.org Thu Aug 13 12:51:33 2009
+Message-Id: <20090813195133.720254371@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 13 Aug 2009 12:50:37 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Rogerio Brito <rbrito@ime.usp.br>,
+ Phil Dibowitz <phil@ipom.com>,
+ Alan Stern <stern@rowland.harvard.edu>,
+ Robert Hancock <hancockrwd@gmail.com>
+Subject: [patch 62/74] USB: storage: include Prolific Technology USB drive in unusual_devs list
+References: <20090813194935.985368088@mini.kroah.org>
+Content-Disposition: inline; filename=usb-storage-include-prolific-technology-usb-drive-in-unusual_devs-list.patch
+Content-Length: 1291
+Lines: 39
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Rogerio Brito <rbrito@ime.usp.br>
+
+commit c15e3ca1d822abba78c00b1ffc3e7b382a50396e upstream.
+
+Add a quirk entry for the Leading Driver UD-11 usb flash drive.
+
+As Alan Stern told me, the device doesn't deal correctly with the
+locking media feature of the device, and this patch incorporates it.
+
+Compiled, tested, working.
+
+Signed-off-by: Rogerio Brito <rbrito@ime.usp.br>
+Cc: Phil Dibowitz <phil@ipom.com>
+Cc: Alan Stern <stern@rowland.harvard.edu>
+Cc: Robert Hancock <hancockrwd@gmail.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/storage/unusual_devs.h | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/usb/storage/unusual_devs.h
++++ b/drivers/usb/storage/unusual_devs.h
+@@ -838,6 +838,13 @@ UNUSUAL_DEV( 0x066f, 0x8000, 0x0001, 0x0
+ US_SC_DEVICE, US_PR_DEVICE, NULL,
+ US_FL_FIX_CAPACITY ),
+
++/* Reported by Rogerio Brito <rbrito@ime.usp.br> */
++UNUSUAL_DEV( 0x067b, 0x2317, 0x0001, 0x001,
++ "Prolific Technology, Inc.",
++ "Mass Storage Device",
++ US_SC_DEVICE, US_PR_DEVICE, NULL,
++ US_FL_NOT_LOCKABLE ),
++
+ /* Reported by Richard -=[]=- <micro_flyer@hotmail.com> */
+ /* Change to bcdDeviceMin (0x0100 to 0x0001) reported by
+ * Thomas Bartosik <tbartdev@gmx-topmail.de> */
+
+
+From gregkh@mini.kroah.org Thu Aug 13 12:51:34 2009
+Message-Id: <20090813195133.863693403@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 13 Aug 2009 12:50:38 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Alan Stern <stern@rowland.harvard.edu>,
+ Kay Sievers <kay.sievers@vrfy.org>
+Subject: [patch 63/74] USB: usbfs: fix -ENOENT error code to be -ENODEV
+References: <20090813194935.985368088@mini.kroah.org>
+Content-Disposition: inline; filename=usb-usbfs-fix-enoent-error-code-to-be-enodev.patch
+Content-Length: 780
+Lines: 28
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit 01105a246345f011fde64d24a601090b646e9e4c upstream.
+
+This patch (as1272) changes the error code returned when an open call
+for a USB device node fails to locate the corresponding device. The
+appropriate error code is -ENODEV, not -ENOENT.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+CC: Kay Sievers <kay.sievers@vrfy.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/core/devio.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/core/devio.c
++++ b/drivers/usb/core/devio.c
+@@ -582,7 +582,7 @@ static int usbdev_open(struct inode *ino
+ if (!ps)
+ goto out;
+
+- ret = -ENOENT;
++ ret = -ENODEV;
+
+ /* usbdev device-node */
+ if (imajor(inode) == USB_DEVICE_MAJOR)
+
+
+From gregkh@mini.kroah.org Thu Aug 13 12:51:34 2009
+Message-Id: <20090813195134.019510489@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 13 Aug 2009 12:50:39 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Michael Buesch <mb@bu3sch.de>,
+ Pete Zaitcev <zaitcev@redhat.com>
+Subject: [patch 64/74] USB: devio: Properly do access_ok() checks
+References: <20090813194935.985368088@mini.kroah.org>
+Content-Disposition: inline; filename=usb-devio-properly-do-access_ok-checks.patch
+Content-Length: 1616
+Lines: 45
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Michael Buesch <mb@bu3sch.de>
+
+commit 18753ebc8a98efe0e8ff6167afb31cef220c8e50 upstream.
+
+access_ok() checks must be done on every part of the userspace structure
+that is accessed. If access_ok() on one part of the struct succeeded, it
+does not imply it will succeed on other parts of the struct. (Does
+depend on the architecture implementation of access_ok()).
+
+This changes the __get_user() users to first check access_ok() on the
+data structure.
+
+Signed-off-by: Michael Buesch <mb@bu3sch.de>
+Cc: Pete Zaitcev <zaitcev@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/core/devio.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+--- a/drivers/usb/core/devio.c
++++ b/drivers/usb/core/devio.c
+@@ -1308,7 +1308,8 @@ static int get_urb32(struct usbdevfs_urb
+ struct usbdevfs_urb32 __user *uurb)
+ {
+ __u32 uptr;
+- if (get_user(kurb->type, &uurb->type) ||
++ if (!access_ok(VERIFY_READ, uurb, sizeof(*uurb)) ||
++ __get_user(kurb->type, &uurb->type) ||
+ __get_user(kurb->endpoint, &uurb->endpoint) ||
+ __get_user(kurb->status, &uurb->status) ||
+ __get_user(kurb->flags, &uurb->flags) ||
+@@ -1523,8 +1524,9 @@ static int proc_ioctl_compat(struct dev_
+ u32 udata;
+
+ uioc = compat_ptr((long)arg);
+- if (get_user(ctrl.ifno, &uioc->ifno) ||
+- get_user(ctrl.ioctl_code, &uioc->ioctl_code) ||
++ if (!access_ok(VERIFY_READ, uioc, sizeof(*uioc)) ||
++ __get_user(ctrl.ifno, &uioc->ifno) ||
++ __get_user(ctrl.ioctl_code, &uioc->ioctl_code) ||
+ __get_user(udata, &uioc->data))
+ return -EFAULT;
+ ctrl.data = compat_ptr(udata);
+
+
+From gregkh@mini.kroah.org Thu Aug 13 12:51:34 2009
+Message-Id: <20090813195134.194857291@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 13 Aug 2009 12:50:40 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Eric Dumazet <eric.dumazet@gmail.com>,
+ Steven Rostedt <rostedt@goodmis.org>
+Subject: [patch 65/74] ring-buffer: Fix memleak in ring_buffer_free()
+References: <20090813194935.985368088@mini.kroah.org>
+Content-Disposition: inline; filename=ring-buffer-fix-memleak-in-ring_buffer_free.patch
+Content-Length: 707
+Lines: 27
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Eric Dumazet <eric.dumazet@gmail.com>
+
+commit bd3f02212d6a457267e0c9c02c426151c436d9d4 upstream.
+
+I noticed oprofile memleaked in linux-2.6 current tree,
+and tracked this ring-buffer leak.
+
+Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
+LKML-Reference: <4A7C06B9.2090302@gmail.com>
+Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/trace/ring_buffer.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/kernel/trace/ring_buffer.c
++++ b/kernel/trace/ring_buffer.c
+@@ -695,6 +695,7 @@ ring_buffer_free(struct ring_buffer *buf
+
+ put_online_cpus();
+
++ kfree(buffer->buffers);
+ free_cpumask_var(buffer->cpumask);
+
+ kfree(buffer);
+
+
+From gregkh@mini.kroah.org Thu Aug 13 12:51:34 2009
+Message-Id: <20090813195134.338486356@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 13 Aug 2009 12:50:41 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Alok N Kataria <akataria@vmware.com>,
+ Ingo Molnar <mingo@elte.hu>
+Subject: [patch 66/74] x86: Fix VMI && stack protector
+References: <20090813194935.985368088@mini.kroah.org>
+Content-Disposition: inline; filename=x86-fix-vmi-stack-protector.patch
+Content-Length: 1027
+Lines: 34
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Alok Kataria <akataria@vmware.com>
+
+commit 7d5b005652bc5ae3e1e0efc53fd0e25a643ec506 upstream.
+
+With CONFIG_STACK_PROTECTOR turned on, VMI doesn't boot with
+more than one processor. The problem is with the gs value not
+being initialized correctly when registering the secondary
+processor for VMI's case.
+
+The patch below initializes the gs value for the AP to
+__KERNEL_STACK_CANARY. Without this the secondary processor
+keeps on taking a GP on every gs access.
+
+Signed-off-by: Alok N Kataria <akataria@vmware.com>
+LKML-Reference: <1249425262.18955.40.camel@ank32.eng.vmware.com>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/vmi_32.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/x86/kernel/vmi_32.c
++++ b/arch/x86/kernel/vmi_32.c
+@@ -441,7 +441,7 @@ vmi_startup_ipi_hook(int phys_apicid, un
+ ap.ds = __USER_DS;
+ ap.es = __USER_DS;
+ ap.fs = __KERNEL_PERCPU;
+- ap.gs = 0;
++ ap.gs = __KERNEL_STACK_CANARY;
+
+ ap.eflags = 0;
+
+
+
+From gregkh@mini.kroah.org Thu Aug 13 12:51:34 2009
+Message-Id: <20090813195134.500277035@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 13 Aug 2009 12:50:42 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Oleg Nesterov <oleg@redhat.com>,
+ James Morris <jmorris@namei.org>
+Subject: [patch 67/74] mm_for_maps: simplify, use ptrace_may_access()
+References: <20090813194935.985368088@mini.kroah.org>
+Content-Disposition: inline; filename=mm_for_maps-simplify-use-ptrace_may_access.patch
+Content-Length: 1722
+Lines: 61
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Oleg Nesterov <oleg@redhat.com>
+
+commit 13f0feafa6b8aead57a2a328e2fca6a5828bf286 upstream.
+
+It would be nice to kill __ptrace_may_access(). It requires task_lock(),
+but this lock is only needed to read mm->flags in the middle.
+
+Convert mm_for_maps() to use ptrace_may_access(), this also simplifies
+the code a little bit.
+
+Also, we do not need to take ->mmap_sem in advance. In fact I think
+mm_for_maps() should not play with ->mmap_sem at all, the caller should
+take this lock.
+
+With or without this patch, without ->cred_guard_mutex held we can race
+with exec() and get the new ->mm but check old creds.
+
+Signed-off-by: Oleg Nesterov <oleg@redhat.com>
+Reviewed-by: Serge Hallyn <serue@us.ibm.com>
+Signed-off-by: James Morris <jmorris@namei.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/proc/base.c | 23 +++++++++++------------
+ 1 file changed, 11 insertions(+), 12 deletions(-)
+
+--- a/fs/proc/base.c
++++ b/fs/proc/base.c
+@@ -237,20 +237,19 @@ struct mm_struct *mm_for_maps(struct tas
+ struct mm_struct *mm = get_task_mm(task);
+ if (!mm)
+ return NULL;
++ if (mm != current->mm) {
++ /*
++ * task->mm can be changed before security check,
++ * in that case we must notice the change after.
++ */
++ if (!ptrace_may_access(task, PTRACE_MODE_READ) ||
++ mm != task->mm) {
++ mmput(mm);
++ return NULL;
++ }
++ }
+ down_read(&mm->mmap_sem);
+- task_lock(task);
+- if (task->mm != mm)
+- goto out;
+- if (task->mm != current->mm &&
+- __ptrace_may_access(task, PTRACE_MODE_READ) < 0)
+- goto out;
+- task_unlock(task);
+ return mm;
+-out:
+- task_unlock(task);
+- up_read(&mm->mmap_sem);
+- mmput(mm);
+- return NULL;
+ }
+
+ static int proc_pid_cmdline(struct task_struct *task, char * buffer)
+
+
+From gregkh@mini.kroah.org Thu Aug 13 12:51:34 2009
+Message-Id: <20090813195134.630212134@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 13 Aug 2009 12:50:43 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Oleg Nesterov <oleg@redhat.com>,
+ Serge Hallyn <serue@us.ibm.com>,
+ James Morris <jmorris@namei.org>
+Subject: [patch 68/74] mm_for_maps: shift down_read(mmap_sem) to the caller
+References: <20090813194935.985368088@mini.kroah.org>
+Content-Disposition: inline; filename=mm_for_maps-shift-down_read-to-the-caller.patch
+Content-Length: 1786
+Lines: 66
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Oleg Nesterov <oleg@redhat.com>
+
+commit 00f89d218523b9bf6b522349c039d5ac80aa536d upstream.
+
+mm_for_maps() takes ->mmap_sem after security checks, this looks
+strange and obfuscates the locking rules. Move this lock to its
+single caller, m_start().
+
+Signed-off-by: Oleg Nesterov <oleg@redhat.com>
+Acked-by: Serge Hallyn <serue@us.ibm.com>
+Signed-off-by: James Morris <jmorris@namei.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/proc/base.c | 8 +++-----
+ fs/proc/task_mmu.c | 1 +
+ fs/proc/task_nommu.c | 1 +
+ 3 files changed, 5 insertions(+), 5 deletions(-)
+
+--- a/fs/proc/base.c
++++ b/fs/proc/base.c
+@@ -235,9 +235,8 @@ static int check_mem_permission(struct t
+ struct mm_struct *mm_for_maps(struct task_struct *task)
+ {
+ struct mm_struct *mm = get_task_mm(task);
+- if (!mm)
+- return NULL;
+- if (mm != current->mm) {
++
++ if (mm && mm != current->mm) {
+ /*
+ * task->mm can be changed before security check,
+ * in that case we must notice the change after.
+@@ -245,10 +244,9 @@ struct mm_struct *mm_for_maps(struct tas
+ if (!ptrace_may_access(task, PTRACE_MODE_READ) ||
+ mm != task->mm) {
+ mmput(mm);
+- return NULL;
++ mm = NULL;
+ }
+ }
+- down_read(&mm->mmap_sem);
+ return mm;
+ }
+
+--- a/fs/proc/task_mmu.c
++++ b/fs/proc/task_mmu.c
+@@ -119,6 +119,7 @@ static void *m_start(struct seq_file *m,
+ mm = mm_for_maps(priv->task);
+ if (!mm)
+ return NULL;
++ down_read(&mm->mmap_sem);
+
+ tail_vma = get_gate_vma(priv->task);
+ priv->tail_vma = tail_vma;
+--- a/fs/proc/task_nommu.c
++++ b/fs/proc/task_nommu.c
+@@ -189,6 +189,7 @@ static void *m_start(struct seq_file *m,
+ priv->task = NULL;
+ return NULL;
+ }
++ down_read(&mm->mmap_sem);
+
+ /* start from the Nth VMA */
+ for (p = rb_first(&mm->mm_rb); p; p = rb_next(p))
+
+
+From gregkh@mini.kroah.org Thu Aug 13 12:51:34 2009
+Message-Id: <20090813195134.782760213@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 13 Aug 2009 12:50:44 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Oleg Nesterov <oleg@redhat.com>,
+ Serge Hallyn <serue@us.ibm.com>,
+ James Morris <jmorris@namei.org>
+Subject: [patch 69/74] mm_for_maps: take ->cred_guard_mutex to fix the race with exec
+References: <20090813194935.985368088@mini.kroah.org>
+Content-Disposition: inline; filename=mm_for_maps-take-cred_guard_mutex-to-fix-the-race-with-exec.patch
+Content-Length: 1594
+Lines: 57
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Oleg Nesterov <oleg@redhat.com>
+
+commit 704b836cbf19e885f8366bccb2e4b0474346c02d upstream.
+
+The problem is minor, but without ->cred_guard_mutex held we can race
+with exec() and get the new ->mm but check old creds.
+
+Now we do not need to re-check task->mm after ptrace_may_access(), it
+can't be changed to the new mm under us.
+
+Strictly speaking, this also fixes another very minor problem. Unless
+security check fails or the task exits mm_for_maps() should never
+return NULL, the caller should get either old or new ->mm.
+
+Signed-off-by: Oleg Nesterov <oleg@redhat.com>
+Acked-by: Serge Hallyn <serue@us.ibm.com>
+Signed-off-by: James Morris <jmorris@namei.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/proc/base.c | 22 +++++++++++-----------
+ 1 file changed, 11 insertions(+), 11 deletions(-)
+
+--- a/fs/proc/base.c
++++ b/fs/proc/base.c
+@@ -234,19 +234,19 @@ static int check_mem_permission(struct t
+
+ struct mm_struct *mm_for_maps(struct task_struct *task)
+ {
+- struct mm_struct *mm = get_task_mm(task);
++ struct mm_struct *mm;
+
+- if (mm && mm != current->mm) {
+- /*
+- * task->mm can be changed before security check,
+- * in that case we must notice the change after.
+- */
+- if (!ptrace_may_access(task, PTRACE_MODE_READ) ||
+- mm != task->mm) {
+- mmput(mm);
+- mm = NULL;
+- }
++ if (mutex_lock_killable(&task->cred_exec_mutex))
++ return NULL;
++
++ mm = get_task_mm(task);
++ if (mm && mm != current->mm &&
++ !ptrace_may_access(task, PTRACE_MODE_READ)) {
++ mmput(mm);
++ mm = NULL;
+ }
++ mutex_unlock(&task->cred_exec_mutex);
++
+ return mm;
+ }
+
+
+
+From gregkh@mini.kroah.org Thu Aug 13 12:51:35 2009
+Message-Id: <20090813195134.928242950@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 13 Aug 2009 12:50:45 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ "David S. Miller" <davem@davemloft.net>,
+ Julien TINNES <julien@cr0.org>,
+ Tavis Ormandy <taviso@sdf.lonestar.org>
+Subject: [patch 70/74] Make sock_sendpage() use kernel_sendpage()
+References: <20090813194935.985368088@mini.kroah.org>
+Content-Disposition: inline; filename=make-sock_sendpage-use-kernel_sendpage.patch
+Content-Length: 1180
+Lines: 35
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Linus Torvalds <torvalds@linux-foundation.org>
+
+commit e694958388c50148389b0e9b9e9e8945cf0f1b98 upstream.
+
+kernel_sendpage() does the proper default case handling for when the
+socket doesn't have a native sendpage implementation.
+
+Now, arguably this might be something that we could instead solve by
+just specifying that all protocols should do it themselves at the
+protocol level, but we really only care about the common protocols.
+Does anybody really care about sendpage on something like Appletalk? Not
+likely.
+
+Acked-by: David S. Miller <davem@davemloft.net>
+Acked-by: Julien TINNES <julien@cr0.org>
+Acked-by: Tavis Ormandy <taviso@sdf.lonestar.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/socket.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/socket.c
++++ b/net/socket.c
+@@ -736,7 +736,7 @@ static ssize_t sock_sendpage(struct file
+ if (more)
+ flags |= MSG_MORE;
+
+- return sock->ops->sendpage(sock, page, offset, size, flags);
++ return kernel_sendpage(sock, page, offset, size, flags);
+ }
+
+ static ssize_t sock_splice_read(struct file *file, loff_t *ppos,
+
+
+From gregkh@mini.kroah.org Thu Aug 13 12:51:35 2009
+Message-Id: <20090813195135.112037059@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 13 Aug 2009 12:50:46 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ Greg KH <greg@kroah.com>
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Robert Richter <robert.richter@amd.com>,
+ Ingo Molnar <mingo@elte.hu>,
+ Steven Rostedt <rostedt@goodmis.org>
+Subject: [patch 71/74] ring-buffer: Fix advance of reader in rb_buffer_peek()
+References: <20090813194935.985368088@mini.kroah.org>
+Content-Disposition: inline; filename=ring-buffer-fix-advance-of-reader-in-rb_buffer_peek.patch
+Content-Length: 3069
+Lines: 85
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Robert Richter <robert.richter@amd.com>
+
+Backport for 2.6.30-stable of:
+
+ 469535a ring-buffer: Fix advance of reader in rb_buffer_peek()
+
+When calling rb_buffer_peek() from ring_buffer_consume() and a
+padding event is returned, the function rb_advance_reader() is
+called twice. This may lead to missing samples or under high
+workloads to the warning below. This patch fixes this. If a padding
+event is returned by rb_buffer_peek() it will be consumed by the
+calling function now.
+
+Also, I simplified some code in ring_buffer_consume().
+
+------------[ cut here ]------------
+WARNING: at /dev/shm/.source/linux/kernel/trace/ring_buffer.c:2289 rb_advance_reader+0x2e/0xc5()
+Hardware name: Anaheim
+Modules linked in:
+Pid: 29, comm: events/2 Tainted: G W 2.6.31-rc3-oprofile-x86_64-standard-00059-g5050dc2 #1
+Call Trace:
+[<ffffffff8106776f>] ? rb_advance_reader+0x2e/0xc5
+[<ffffffff81039ffe>] warn_slowpath_common+0x77/0x8f
+[<ffffffff8103a025>] warn_slowpath_null+0xf/0x11
+[<ffffffff8106776f>] rb_advance_reader+0x2e/0xc5
+[<ffffffff81068bda>] ring_buffer_consume+0xa0/0xd2
+[<ffffffff81326933>] op_cpu_buffer_read_entry+0x21/0x9e
+[<ffffffff810be3af>] ? __find_get_block+0x4b/0x165
+[<ffffffff8132749b>] sync_buffer+0xa5/0x401
+[<ffffffff810be3af>] ? __find_get_block+0x4b/0x165
+[<ffffffff81326c1b>] ? wq_sync_buffer+0x0/0x78
+[<ffffffff81326c76>] wq_sync_buffer+0x5b/0x78
+[<ffffffff8104aa30>] worker_thread+0x113/0x1ac
+[<ffffffff8104dd95>] ? autoremove_wake_function+0x0/0x38
+[<ffffffff8104a91d>] ? worker_thread+0x0/0x1ac
+[<ffffffff8104dc9a>] kthread+0x88/0x92
+[<ffffffff8100bdba>] child_rip+0xa/0x20
+[<ffffffff8104dc12>] ? kthread+0x0/0x92
+[<ffffffff8100bdb0>] ? child_rip+0x0/0x20
+---[ end trace f561c0a58fcc89bd ]---
+
+Cc: Steven Rostedt <rostedt@goodmis.org>
+Signed-off-by: Robert Richter <robert.richter@amd.com>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/trace/ring_buffer.c | 10 ++++------
+ 1 file changed, 4 insertions(+), 6 deletions(-)
+
+--- a/kernel/trace/ring_buffer.c
++++ b/kernel/trace/ring_buffer.c
+@@ -2102,7 +2102,6 @@ rb_buffer_peek(struct ring_buffer *buffe
+ * the box. Return the padding, and we will release
+ * the current locks, and try again.
+ */
+- rb_advance_reader(cpu_buffer);
+ return event;
+
+ case RINGBUF_TYPE_TIME_EXTEND:
+@@ -2219,6 +2218,8 @@ ring_buffer_peek(struct ring_buffer *buf
+ again:
+ spin_lock_irqsave(&cpu_buffer->reader_lock, flags);
+ event = rb_buffer_peek(buffer, cpu, ts);
++ if (event && event->type == RINGBUF_TYPE_PADDING)
++ rb_advance_reader(cpu_buffer);
+ spin_unlock_irqrestore(&cpu_buffer->reader_lock, flags);
+
+ if (event && event->type == RINGBUF_TYPE_PADDING) {
+@@ -2283,12 +2284,9 @@ ring_buffer_consume(struct ring_buffer *
+ spin_lock_irqsave(&cpu_buffer->reader_lock, flags);
+
+ event = rb_buffer_peek(buffer, cpu, ts);
+- if (!event)
+- goto out_unlock;
+-
+- rb_advance_reader(cpu_buffer);
++ if (event)
++ rb_advance_reader(cpu_buffer);
+
+- out_unlock:
+ spin_unlock_irqrestore(&cpu_buffer->reader_lock, flags);
+
+ out:
+
+
+From gregkh@mini.kroah.org Thu Aug 13 12:51:35 2009
+Message-Id: <20090813195135.282259870@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 13 Aug 2009 12:50:47 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Trond Myklebust <Trond.Myklebust@netapp.com>
+Subject: [patch 72/74] NFS: Fix an O_DIRECT Oops...
+References: <20090813194935.985368088@mini.kroah.org>
+Content-Disposition: inline; filename=nfs-fix-an-o_direct-oops.patch
+Content-Length: 7035
+Lines: 208
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Trond Myklebust <Trond.Myklebust@netapp.com>
+
+commit 1ae88b2e446261c038f2c0c3150ffae142b227a2 upstream.
+
+We can't call nfs_readdata_release()/nfs_writedata_release() without
+first initialising and referencing args.context. Doing so inside
+nfs_direct_read_schedule_segment()/nfs_direct_write_schedule_segment()
+causes an Oops.
+
+We should rather be calling nfs_readdata_free()/nfs_writedata_free() in
+those cases.
+
+Looking at the O_DIRECT code, the "struct nfs_direct_req" is already
+referencing the nfs_open_context for us. Since the readdata and writedata
+structures carry a reference to that, we can simplify things by getting rid
+of the extra nfs_open_context references, so that we can replace all
+instances of nfs_readdata_release()/nfs_writedata_release().
+
+Reported-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
+Tested-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/nfs/direct.c | 20 ++++++++++----------
+ fs/nfs/read.c | 6 ++----
+ fs/nfs/write.c | 6 ++----
+ include/linux/nfs_fs.h | 5 ++---
+ 4 files changed, 16 insertions(+), 21 deletions(-)
+
+--- a/fs/nfs/direct.c
++++ b/fs/nfs/direct.c
+@@ -255,7 +255,7 @@ static void nfs_direct_read_release(void
+
+ if (put_dreq(dreq))
+ nfs_direct_complete(dreq);
+- nfs_readdata_release(calldata);
++ nfs_readdata_free(data);
+ }
+
+ static const struct rpc_call_ops nfs_read_direct_ops = {
+@@ -311,14 +311,14 @@ static ssize_t nfs_direct_read_schedule_
+ data->npages, 1, 0, data->pagevec, NULL);
+ up_read(¤t->mm->mmap_sem);
+ if (result < 0) {
+- nfs_readdata_release(data);
++ nfs_readdata_free(data);
+ break;
+ }
+ if ((unsigned)result < data->npages) {
+ bytes = result * PAGE_SIZE;
+ if (bytes <= pgbase) {
+ nfs_direct_release_pages(data->pagevec, result);
+- nfs_readdata_release(data);
++ nfs_readdata_free(data);
+ break;
+ }
+ bytes -= pgbase;
+@@ -331,7 +331,7 @@ static ssize_t nfs_direct_read_schedule_
+ data->inode = inode;
+ data->cred = msg.rpc_cred;
+ data->args.fh = NFS_FH(inode);
+- data->args.context = get_nfs_open_context(ctx);
++ data->args.context = ctx;
+ data->args.offset = pos;
+ data->args.pgbase = pgbase;
+ data->args.pages = data->pagevec;
+@@ -438,7 +438,7 @@ static void nfs_direct_free_writedata(st
+ struct nfs_write_data *data = list_entry(dreq->rewrite_list.next, struct nfs_write_data, pages);
+ list_del(&data->pages);
+ nfs_direct_release_pages(data->pagevec, data->npages);
+- nfs_writedata_release(data);
++ nfs_writedata_free(data);
+ }
+ }
+
+@@ -531,7 +531,7 @@ static void nfs_direct_commit_release(vo
+
+ dprintk("NFS: %5u commit returned %d\n", data->task.tk_pid, status);
+ nfs_direct_write_complete(dreq, data->inode);
+- nfs_commitdata_release(calldata);
++ nfs_commit_free(data);
+ }
+
+ static const struct rpc_call_ops nfs_commit_direct_ops = {
+@@ -564,7 +564,7 @@ static void nfs_direct_commit_schedule(s
+ data->args.fh = NFS_FH(data->inode);
+ data->args.offset = 0;
+ data->args.count = 0;
+- data->args.context = get_nfs_open_context(dreq->ctx);
++ data->args.context = dreq->ctx;
+ data->res.count = 0;
+ data->res.fattr = &data->fattr;
+ data->res.verf = &data->verf;
+@@ -725,14 +725,14 @@ static ssize_t nfs_direct_write_schedule
+ data->npages, 0, 0, data->pagevec, NULL);
+ up_read(¤t->mm->mmap_sem);
+ if (result < 0) {
+- nfs_writedata_release(data);
++ nfs_writedata_free(data);
+ break;
+ }
+ if ((unsigned)result < data->npages) {
+ bytes = result * PAGE_SIZE;
+ if (bytes <= pgbase) {
+ nfs_direct_release_pages(data->pagevec, result);
+- nfs_writedata_release(data);
++ nfs_writedata_free(data);
+ break;
+ }
+ bytes -= pgbase;
+@@ -747,7 +747,7 @@ static ssize_t nfs_direct_write_schedule
+ data->inode = inode;
+ data->cred = msg.rpc_cred;
+ data->args.fh = NFS_FH(inode);
+- data->args.context = get_nfs_open_context(ctx);
++ data->args.context = ctx;
+ data->args.offset = pos;
+ data->args.pgbase = pgbase;
+ data->args.pages = data->pagevec;
+--- a/fs/nfs/read.c
++++ b/fs/nfs/read.c
+@@ -59,17 +59,15 @@ struct nfs_read_data *nfs_readdata_alloc
+ return p;
+ }
+
+-static void nfs_readdata_free(struct nfs_read_data *p)
++void nfs_readdata_free(struct nfs_read_data *p)
+ {
+ if (p && (p->pagevec != &p->page_array[0]))
+ kfree(p->pagevec);
+ mempool_free(p, nfs_rdata_mempool);
+ }
+
+-void nfs_readdata_release(void *data)
++static void nfs_readdata_release(struct nfs_read_data *rdata)
+ {
+- struct nfs_read_data *rdata = data;
+-
+ put_nfs_open_context(rdata->args.context);
+ nfs_readdata_free(rdata);
+ }
+--- a/fs/nfs/write.c
++++ b/fs/nfs/write.c
+@@ -84,17 +84,15 @@ struct nfs_write_data *nfs_writedata_all
+ return p;
+ }
+
+-static void nfs_writedata_free(struct nfs_write_data *p)
++void nfs_writedata_free(struct nfs_write_data *p)
+ {
+ if (p && (p->pagevec != &p->page_array[0]))
+ kfree(p->pagevec);
+ mempool_free(p, nfs_wdata_mempool);
+ }
+
+-void nfs_writedata_release(void *data)
++static void nfs_writedata_release(struct nfs_write_data *wdata)
+ {
+- struct nfs_write_data *wdata = data;
+-
+ put_nfs_open_context(wdata->args.context);
+ nfs_writedata_free(wdata);
+ }
+--- a/include/linux/nfs_fs.h
++++ b/include/linux/nfs_fs.h
+@@ -473,7 +473,6 @@ extern int nfs_writepages(struct addres
+ extern int nfs_flush_incompatible(struct file *file, struct page *page);
+ extern int nfs_updatepage(struct file *, struct page *, unsigned int, unsigned int);
+ extern int nfs_writeback_done(struct rpc_task *, struct nfs_write_data *);
+-extern void nfs_writedata_release(void *);
+
+ /*
+ * Try to write back everything synchronously (but check the
+@@ -488,7 +487,6 @@ extern int nfs_wb_page_cancel(struct ino
+ extern int nfs_commit_inode(struct inode *, int);
+ extern struct nfs_write_data *nfs_commitdata_alloc(void);
+ extern void nfs_commit_free(struct nfs_write_data *wdata);
+-extern void nfs_commitdata_release(void *wdata);
+ #else
+ static inline int
+ nfs_commit_inode(struct inode *inode, int how)
+@@ -507,6 +505,7 @@ nfs_have_writebacks(struct inode *inode)
+ * Allocate nfs_write_data structures
+ */
+ extern struct nfs_write_data *nfs_writedata_alloc(unsigned int npages);
++extern void nfs_writedata_free(struct nfs_write_data *);
+
+ /*
+ * linux/fs/nfs/read.c
+@@ -515,7 +514,6 @@ extern int nfs_readpage(struct file *,
+ extern int nfs_readpages(struct file *, struct address_space *,
+ struct list_head *, unsigned);
+ extern int nfs_readpage_result(struct rpc_task *, struct nfs_read_data *);
+-extern void nfs_readdata_release(void *data);
+ extern int nfs_readpage_async(struct nfs_open_context *, struct inode *,
+ struct page *);
+
+@@ -523,6 +521,7 @@ extern int nfs_readpage_async(struct nf
+ * Allocate nfs_read_data structures
+ */
+ extern struct nfs_read_data *nfs_readdata_alloc(unsigned int npages);
++extern void nfs_readdata_free(struct nfs_read_data *);
+
+ /*
+ * linux/fs/nfs3proc.c
+
+
+From gregkh@mini.kroah.org Thu Aug 13 12:51:35 2009
+Message-Id: <20090813195135.441844749@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 13 Aug 2009 12:50:48 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Takashi Iwai <tiwai@suse.de>
+Subject: [patch 73/74] ALSA: hda - Add missing vmaster initialization for ALC269
+References: <20090813194935.985368088@mini.kroah.org>
+Content-Disposition: inline; filename=alsa-hda-add-missing-vmaster-initialization-for-alc269.patch
+Content-Length: 799
+Lines: 29
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 100d5eb36ba20dc0b99a17ea2b9800c567bfc3d1 upstream.
+
+Without the initialization of vmaster NID, the dB information got
+confused for ALC269 codec.
+
+Reference: Novell bnc#527361
+ https://bugzilla.novell.com/show_bug.cgi?id=527361
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/hda/patch_realtek.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -13150,6 +13150,8 @@ static int patch_alc269(struct hda_codec
+ set_capture_mixer(spec);
+ set_beep_amp(spec, 0x0b, 0x04, HDA_INPUT);
+
++ spec->vmaster_nid = 0x02;
++
+ codec->patch_ops = alc_patch_ops;
+ if (board_config == ALC269_AUTO)
+ spec->init_hook = alc269_auto_init;
+
+
+From gregkh@mini.kroah.org Thu Aug 13 12:51:35 2009
+Message-Id: <20090813195135.602994150@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 13 Aug 2009 12:50:49 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Maxime Bizon <mbizon@freebox.fr>,
+ Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>,
+ "David S. Miller" <davem@davemloft.net>,
+ Simon Kirby <sim@netnation.com>
+Subject: [patch 74/74] ide: fix memory leak when flush command is issued
+References: <20090813194935.985368088@mini.kroah.org>
+Content-Disposition: inline; filename=ide-fix-memory-leak-when-flush-command-is-issued.patch
+Content-Length: 1228
+Lines: 36
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Maxime Bizon <mbizon@freebox.fr>
+
+commit bc146d23d1358af43f03793c3ad8c9f16bbcffcb upstream.
+
+I'm using ide on 2.6.30.1 with xfs filesystem. I noticed a kernel memory
+leak after writing lots of data, the kmalloc-96 slab cache keeps
+growing. It seems the struct ide_cmd kmalloced by idedisk_prepare_flush
+is never kfreed.
+
+Commit a09485df9cda49fbde2766c86eb18a9cae585162 ("ide: move request
+type specific code from ide_end_drive_cmd() to callers (v3)") and
+f505d49ffd25ed062e76ffd17568d3937fcd338c ("ide: fix barriers support")
+cause this regression, cmd->rq must now be set for ide_complete_cmd to
+honor the IDE_TFLAG_DYN flag.
+
+Signed-off-by: Maxime Bizon <mbizon@freebox.fr>
+Acked-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Cc: Simon Kirby <sim@netnation.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/ide/ide-disk.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/ide/ide-disk.c
++++ b/drivers/ide/ide-disk.c
+@@ -413,6 +413,7 @@ static void idedisk_prepare_flush(struct
+ rq->cmd_type = REQ_TYPE_ATA_TASKFILE;
+ rq->cmd_flags |= REQ_SOFTBARRIER;
+ rq->special = cmd;
++ cmd->rq = rq;
+ }
+
+ ide_devset_get(multcount, mult_count);
+
+
+From gregkh@mini.kroah.org Thu Aug 13 12:51:24 2009
+Message-Id: <20090813194935.985368088@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 13 Aug 2009 12:49:35 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk
+Subject: [patch 00/74] 2.6.30.5-stable review
+Content-Length: 6801
+Lines: 123
+
+This is the start of the stable review cycle for the 2.6.30.5 release.
+There are 74 patches in this series, all will be posted as a response to
+this one. If anyone has any issues with these being applied, please let
+us know. If anyone is a maintainer of the proper subsystem, and wants
+to add a Signed-off-by: line to the patch, please respond with it.
+
+These patches are sent out with a number of different people on the Cc:
+line. If you wish to be a reviewer, please email stable@kernel.org to
+add your name to the list. If you want to be off the reviewer list,
+also email us.
+
+Responses should be made by Saturday, August 15, 2009 19:00:00 UTC.
+Anything received after that time might be too late.
+
+The whole patch series can be found in one patch at:
+ kernel.org/pub/linux/kernel/v2.6/stable-review/patch-2.6.30.5-rc1.gz
+and the diffstat can be found below.
+
+
+thanks,
+
+greg k-h
+
+----------------
+
+ Makefile | 2 +-
+ arch/powerpc/boot/dts/asp834x-redboot.dts | 2 +-
+ arch/powerpc/boot/dts/mpc8349emitx.dts | 2 +-
+ arch/powerpc/boot/dts/mpc834x_mds.dts | 2 +-
+ arch/powerpc/boot/dts/sbc8349.dts | 2 +-
+ arch/powerpc/platforms/83xx/mpc83xx.h | 4 +-
+ arch/powerpc/platforms/83xx/usb.c | 10 ++--
+ arch/x86/include/asm/irqflags.h | 8 +++-
+ arch/x86/kernel/vmi_32.c | 2 +-
+ arch/x86/mm/pageattr.c | 39 ++++++++++----
+ block/Kconfig | 11 +++--
+ drivers/acpi/sleep.c | 8 +++
+ drivers/edac/x38_edac.c | 2 +-
+ drivers/firewire/fw-sbp2.c | 10 +++-
+ drivers/gpu/drm/i915/i915_dma.c | 5 ++-
+ drivers/gpu/drm/i915/i915_drv.h | 8 +++
+ drivers/gpu/drm/i915/i915_gem.c | 13 +++++
+ drivers/gpu/drm/i915/i915_irq.c | 2 -
+ drivers/gpu/drm/i915/i915_suspend.c | 20 +++++++
+ drivers/gpu/drm/i915/intel_bios.c | 10 ++--
+ drivers/gpu/drm/i915/intel_display.c | 2 +
+ drivers/gpu/drm/i915/intel_fb.c | 8 +++-
+ drivers/gpu/drm/i915/intel_lvds.c | 17 +++++-
+ drivers/hwmon/asus_atk0110.c | 6 ++-
+ drivers/hwmon/smsc47m1.c | 11 ++++
+ drivers/i2c/chips/tsl2550.c | 17 ++++---
+ drivers/ide/ide-disk.c | 1 +
+ drivers/ide/ide-dma.c | 21 -------
+ drivers/ide/ide-iops.c | 3 -
+ drivers/ide/ide-probe.c | 23 +++++++-
+ drivers/ieee1394/sbp2.c | 1 +
+ drivers/ieee1394/sbp2.h | 8 +++-
+ drivers/md/md.c | 15 +++++-
+ drivers/md/raid5.c | 26 ++++-----
+ drivers/net/atl1c/atl1c.h | 8 ++--
+ drivers/net/atl1c/atl1c_ethtool.c | 2 +-
+ drivers/net/atl1c/atl1c_main.c | 2 +-
+ drivers/net/benet/be.h | 2 +-
+ drivers/net/benet/be_ethtool.c | 4 +-
+ drivers/net/benet/be_main.c | 45 +++++++++++-----
+ drivers/net/e100.c | 3 +
+ drivers/net/sky2.c | 2 +-
+ drivers/net/usb/cdc_subset.c | 7 ++-
+ drivers/net/wireless/iwlwifi/iwl-agn.c | 19 +------
+ drivers/net/wireless/iwlwifi/iwl3945-base.c | 19 +------
+ drivers/parisc/eisa_eeprom.c | 2 +-
+ drivers/platform/x86/Kconfig | 4 +-
+ drivers/platform/x86/thinkpad_acpi.c | 61 +++++++++++++++++-----
+ drivers/scsi/libsas/sas_port.c | 19 +++++--
+ drivers/staging/rt2870/2870_main_dev.c | 67 ++++++++++++++++--------
+ drivers/staging/rt2870/common/2870_rtmp_init.c | 35 ++++++-------
+ drivers/staging/rt2870/common/cmm_data.c | 3 +
+ drivers/staging/rt2870/common/rtmp_init.c | 2 +-
+ drivers/staging/rt2870/common/rtusb_io.c | 3 +-
+ drivers/staging/rt2870/rt2870.h | 6 +--
+ drivers/staging/rt2870/rt_linux.h | 11 ++--
+ drivers/usb/core/devio.c | 10 ++--
+ drivers/usb/serial/ftdi_sio.c | 3 +
+ drivers/usb/serial/ftdi_sio.h | 14 +++++
+ drivers/usb/storage/transport.c | 2 +-
+ drivers/usb/storage/unusual_devs.h | 7 +++
+ fs/binfmt_flat.c | 17 ++++--
+ fs/cifs/cifs_dfs_ref.c | 12 +++-
+ fs/cifs/connect.c | 13 ++++-
+ fs/compat_ioctl.c | 1 +
+ fs/nfs/direct.c | 20 ++++----
+ fs/nfs/read.c | 6 +--
+ fs/nfs/write.c | 6 +--
+ fs/nilfs2/segment.c | 16 +++++-
+ fs/proc/base.c | 27 ++++-----
+ fs/proc/task_mmu.c | 1 +
+ fs/proc/task_nommu.c | 1 +
+ fs/sysfs/dir.c | 2 +
+ include/linux/ide.h | 2 -
+ include/linux/netdevice.h | 5 +-
+ include/linux/nfs_fs.h | 5 +-
+ include/net/sctp/sctp.h | 1 +
+ include/net/sock.h | 34 +++++++-----
+ kernel/fork.c | 22 ++++----
+ kernel/posix-timers.c | 7 +++
+ kernel/smp.c | 2 +-
+ kernel/trace/ring_buffer.c | 11 ++--
+ kernel/trace/trace.c | 10 +++-
+ kernel/trace/trace_functions_graph.c | 11 +++-
+ mm/hugetlb.c | 2 +-
+ mm/page_alloc.c | 13 +++--
+ net/ax25/ax25_in.c | 3 +-
+ net/core/dev.c | 10 ++--
+ net/core/sock.c | 39 ++++++++++++--
+ net/ipv4/ip_input.c | 3 +
+ net/ipv6/ip6_input.c | 3 +
+ net/irda/af_irda.c | 3 -
+ net/irda/ircomm/ircomm_lmp.c | 1 +
+ net/socket.c | 2 +-
+ net/wireless/scan.c | 4 +-
+ net/xfrm/xfrm_algo.c | 4 +-
+ sound/pci/hda/patch_realtek.c | 2 +
+ 97 files changed, 659 insertions(+), 345 deletions(-)
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
