--- /dev/null
+From gregkh@mini.kroah.org Tue Jun 30 17:24:11 2009
+Message-Id: <20090701002411.182474102@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:22:50 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Yinghai Lu <yinghai@kernel.org>,
+ Ingo Molnar <mingo@elte.hu>,
+ "H. Peter Anvin" <hpa@zytor.com>,
+ Thomas Gleixner <tglx@linutronix.de>
+Subject: [patch 001/108] firmware_map: fix hang with x86/32bit
+References: <20090701002249.937782934@mini.kroah.org>
+Content-Disposition: inline; filename=firmware_map-fix-hang-with-x86-32bit.patch
+Content-Length: 4211
+Lines: 113
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Yinghai Lu <yinghai@kernel.org>
+
+commit 3b0fde0fac19c180317eb0601b3504083f4b9bf5 upstream.
+
+Addresses http://bugzilla.kernel.org/show_bug.cgi?id=13484
+
+Peer reported:
+| The bug is introduced from kernel 2.6.27, if E820 table reserve the memory
+| above 4G in 32bit OS(BIOS-e820: 00000000fff80000 - 0000000120000000
+| (reserved)), system will report Int 6 error and hang up. The bug is caused by
+| the following code in drivers/firmware/memmap.c, the resource_size_t is 32bit
+| variable in 32bit OS, the BUG_ON() will be invoked to result in the Int 6
+| error. I try the latest 32bit Ubuntu and Fedora distributions, all hit this
+| bug.
+|======
+|static int firmware_map_add_entry(resource_size_t start, resource_size_t end,
+| const char *type,
+| struct firmware_map_entry *entry)
+
+and it only happen with CONFIG_PHYS_ADDR_T_64BIT is not set.
+
+it turns out we need to pass u64 instead of resource_size_t for that.
+
+[akpm@linux-foundation.org: add comment]
+Reported-and-tested-by: Peer Chen <pchen@nvidia.com>
+Signed-off-by: Yinghai Lu <yinghai@kernel.org>
+Cc: Ingo Molnar <mingo@elte.hu>
+Acked-by: H. Peter Anvin <hpa@zytor.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/firmware/memmap.c | 16 +++++++++-------
+ include/linux/firmware-map.h | 12 ++++--------
+ 2 files changed, 13 insertions(+), 15 deletions(-)
+
+--- a/drivers/firmware/memmap.c
++++ b/drivers/firmware/memmap.c
+@@ -31,8 +31,12 @@
+ * information is necessary as for the resource tree.
+ */
+ struct firmware_map_entry {
+- resource_size_t start; /* start of the memory range */
+- resource_size_t end; /* end of the memory range (incl.) */
++ /*
++ * start and end must be u64 rather than resource_size_t, because e820
++ * resources can lie at addresses above 4G.
++ */
++ u64 start; /* start of the memory range */
++ u64 end; /* end of the memory range (incl.) */
+ const char *type; /* type of the memory range */
+ struct list_head list; /* entry for the linked list */
+ struct kobject kobj; /* kobject for each entry */
+@@ -101,7 +105,7 @@ static LIST_HEAD(map_entries);
+ * Common implementation of firmware_map_add() and firmware_map_add_early()
+ * which expects a pre-allocated struct firmware_map_entry.
+ **/
+-static int firmware_map_add_entry(resource_size_t start, resource_size_t end,
++static int firmware_map_add_entry(u64 start, u64 end,
+ const char *type,
+ struct firmware_map_entry *entry)
+ {
+@@ -132,8 +136,7 @@ static int firmware_map_add_entry(resour
+ *
+ * Returns 0 on success, or -ENOMEM if no memory could be allocated.
+ **/
+-int firmware_map_add(resource_size_t start, resource_size_t end,
+- const char *type)
++int firmware_map_add(u64 start, u64 end, const char *type)
+ {
+ struct firmware_map_entry *entry;
+
+@@ -157,8 +160,7 @@ int firmware_map_add(resource_size_t sta
+ *
+ * Returns 0 on success, or -ENOMEM if no memory could be allocated.
+ **/
+-int __init firmware_map_add_early(resource_size_t start, resource_size_t end,
+- const char *type)
++int __init firmware_map_add_early(u64 start, u64 end, const char *type)
+ {
+ struct firmware_map_entry *entry;
+
+--- a/include/linux/firmware-map.h
++++ b/include/linux/firmware-map.h
+@@ -24,21 +24,17 @@
+ */
+ #ifdef CONFIG_FIRMWARE_MEMMAP
+
+-int firmware_map_add(resource_size_t start, resource_size_t end,
+- const char *type);
+-int firmware_map_add_early(resource_size_t start, resource_size_t end,
+- const char *type);
++int firmware_map_add(u64 start, u64 end, const char *type);
++int firmware_map_add_early(u64 start, u64 end, const char *type);
+
+ #else /* CONFIG_FIRMWARE_MEMMAP */
+
+-static inline int firmware_map_add(resource_size_t start, resource_size_t end,
+- const char *type)
++static inline int firmware_map_add(u64 start, u64 end, const char *type)
+ {
+ return 0;
+ }
+
+-static inline int firmware_map_add_early(resource_size_t start,
+- resource_size_t end, const char *type)
++static inline int firmware_map_add_early(u64 start, u64 end, const char *type)
+ {
+ return 0;
+ }
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:24:12 2009
+Message-Id: <20090701002411.695417787@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:22:51 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Nick Piggin <npiggin@suse.de>,
+ Al Viro <viro@zeniv.linux.org.uk>
+Subject: [patch 002/108] fs: remove incorrect I_NEW warnings
+References: <20090701002249.937782934@mini.kroah.org>
+Content-Disposition: inline; filename=fs-remove-incorrect-i_new-warnings.patch
+Content-Length: 1335
+Lines: 42
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Nick Piggin <npiggin@suse.de>
+
+commit 545b9fd3d737afc0bb5203b1e79194a471605acd upstream.
+
+Some filesystems can call in to sync an inode that is still in the
+I_NEW state (eg. ext family, when mounted with -osync). This is OK
+because the filesystem has sole access to the new inode, so it can
+modify i_state without races (because no other thread should be
+modifying it, by definition of I_NEW). Ie. a false positive, so
+remove the warnings.
+
+The races are described here 7ef0d7377cb287e08f3ae94cebc919448e1f5dff,
+which is also where the warnings were introduced.
+
+Reported-by: Stephen Hemminger <shemminger@vyatta.com>
+Signed-off-by: Nick Piggin <npiggin@suse.de>
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/fs-writeback.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/fs/fs-writeback.c
++++ b/fs/fs-writeback.c
+@@ -289,7 +289,6 @@ __sync_single_inode(struct inode *inode,
+ int ret;
+
+ BUG_ON(inode->i_state & I_SYNC);
+- WARN_ON(inode->i_state & I_NEW);
+
+ /* Set I_SYNC, reset I_DIRTY */
+ dirty = inode->i_state & I_DIRTY;
+@@ -314,7 +313,6 @@ __sync_single_inode(struct inode *inode,
+ }
+
+ spin_lock(&inode_lock);
+- WARN_ON(inode->i_state & I_NEW);
+ inode->i_state &= ~I_SYNC;
+ if (!(inode->i_state & I_FREEING)) {
+ if (!(inode->i_state & I_DIRTY) &&
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:24:12 2009
+Message-Id: <20090701002412.207950874@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:22:52 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Shaohua Li <shaohua.li@intel.com>,
+ Jesse Barnes <jbarnes@virtuousgeek.org>
+Subject: [patch 003/108] PCI: disable ASPM on VIA root-port-under-bridge configurations
+References: <20090701002249.937782934@mini.kroah.org>
+Content-Disposition: inline; filename=pci-disable-aspm-on-via-root-port-under-bridge-configurations.patch
+Content-Length: 933
+Lines: 30
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Shaohua Li <shaohua.li@intel.com>
+
+commit 8e822df700694ca6850d1e0c122fd7004b2778d8 upstream.
+
+VIA has a strange chipset, it has root port under a bridge. Disable ASPM
+for such strange chipset.
+
+Tested-by: Wolfgang Denk <wd@denx.de>
+Signed-off-by: Shaohua Li <shaohua.li@intel.com>
+Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/pci/pcie/aspm.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/pci/pcie/aspm.c
++++ b/drivers/pci/pcie/aspm.c
+@@ -638,6 +638,10 @@ void pcie_aspm_init_link_state(struct pc
+ if (pdev->pcie_type != PCI_EXP_TYPE_ROOT_PORT &&
+ pdev->pcie_type != PCI_EXP_TYPE_DOWNSTREAM)
+ return;
++ /* VIA has a strange chipset, root port is under a bridge */
++ if (pdev->pcie_type == PCI_EXP_TYPE_ROOT_PORT &&
++ pdev->bus->self)
++ return;
+ down_read(&pci_bus_sem);
+ if (list_empty(&pdev->subordinate->devices))
+ goto out;
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:24:12 2009
+Message-Id: <20090701002412.598019788@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:22:53 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Gleb Natapov <gleb@redhat.com>,
+ Avi Kivity <avi@redhat.com>
+Subject: [patch 004/108] KVM: VMX: Fix handling of a fault during NMI unblocked due to IRET
+References: <20090701002249.937782934@mini.kroah.org>
+Content-Disposition: inline; filename=kvm-vmx-fix-handling-of-a-fault-during-nmi-unblocked-due-to-iret.patch
+Content-Length: 2331
+Lines: 67
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Gleb Natapov <gleb@redhat.com>
+
+commit 7b4a25cb296e2a73d2e87a4af65361d45d450a27 upstream.
+
+Bit 12 is undefined in any of the following cases:
+ If the VM exit sets the valid bit in the IDT-vectoring information field.
+ If the VM exit is due to a double fault.
+
+Signed-off-by: Gleb Natapov <gleb@redhat.com>
+Signed-off-by: Avi Kivity <avi@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kvm/vmx.c | 17 +++++++++++------
+ 1 file changed, 11 insertions(+), 6 deletions(-)
+
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -3248,36 +3248,41 @@ static void update_tpr_threshold(struct
+ static void vmx_complete_interrupts(struct vcpu_vmx *vmx)
+ {
+ u32 exit_intr_info;
+- u32 idt_vectoring_info;
++ u32 idt_vectoring_info = vmx->idt_vectoring_info;
+ bool unblock_nmi;
+ u8 vector;
+ int type;
+ bool idtv_info_valid;
+ u32 error;
+
++ idtv_info_valid = idt_vectoring_info & VECTORING_INFO_VALID_MASK;
+ exit_intr_info = vmcs_read32(VM_EXIT_INTR_INFO);
+ if (cpu_has_virtual_nmis()) {
+ unblock_nmi = (exit_intr_info & INTR_INFO_UNBLOCK_NMI) != 0;
+ vector = exit_intr_info & INTR_INFO_VECTOR_MASK;
+ /*
+- * SDM 3: 25.7.1.2
++ * SDM 3: 27.7.1.2 (September 2008)
+ * Re-set bit "block by NMI" before VM entry if vmexit caused by
+ * a guest IRET fault.
++ * SDM 3: 23.2.2 (September 2008)
++ * Bit 12 is undefined in any of the following cases:
++ * If the VM exit sets the valid bit in the IDT-vectoring
++ * information field.
++ * If the VM exit is due to a double fault.
+ */
+- if (unblock_nmi && vector != DF_VECTOR)
++ if ((exit_intr_info & INTR_INFO_VALID_MASK) && unblock_nmi &&
++ vector != DF_VECTOR && !idtv_info_valid)
+ vmcs_set_bits(GUEST_INTERRUPTIBILITY_INFO,
+ GUEST_INTR_STATE_NMI);
+ } else if (unlikely(vmx->soft_vnmi_blocked))
+ vmx->vnmi_blocked_time +=
+ ktime_to_ns(ktime_sub(ktime_get(), vmx->entry_time));
+
+- idt_vectoring_info = vmx->idt_vectoring_info;
+- idtv_info_valid = idt_vectoring_info & VECTORING_INFO_VALID_MASK;
+ vector = idt_vectoring_info & VECTORING_INFO_VECTOR_MASK;
+ type = idt_vectoring_info & VECTORING_INFO_TYPE_MASK;
+ if (vmx->vcpu.arch.nmi_injected) {
+ /*
+- * SDM 3: 25.7.1.2
++ * SDM 3: 27.7.1.2 (September 2008)
+ * Clear bit "block by NMI" before VM entry if a NMI delivery
+ * faulted.
+ */
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:24:13 2009
+Message-Id: <20090701002413.036101160@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:22:54 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Gleb Natapov <gleb@redhat.com>,
+ Avi Kivity <avi@redhat.com>
+Subject: [patch 005/108] KVM: Move "exit due to NMI" handling into vmx_complete_interrupts()
+References: <20090701002249.937782934@mini.kroah.org>
+Content-Disposition: inline; filename=kvm-move-exit-due-to-nmi-handling-into-vmx_complete_interrupts.patch
+Content-Length: 1931
+Lines: 60
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Gleb Natapov <gleb@redhat.com>
+
+commit 20f65983e30f222e5383f77206e3f571d1d64610 upstream.
+
+To save us one reading of VM_EXIT_INTR_INFO.
+
+Signed-off-by: Gleb Natapov <gleb@redhat.com>
+Signed-off-by: Avi Kivity <avi@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kvm/vmx.c | 21 ++++++++++-----------
+ 1 file changed, 10 insertions(+), 11 deletions(-)
+
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -3255,8 +3255,17 @@ static void vmx_complete_interrupts(stru
+ bool idtv_info_valid;
+ u32 error;
+
+- idtv_info_valid = idt_vectoring_info & VECTORING_INFO_VALID_MASK;
+ exit_intr_info = vmcs_read32(VM_EXIT_INTR_INFO);
++
++ /* We need to handle NMIs before interrupts are enabled */
++ if ((exit_intr_info & INTR_INFO_INTR_TYPE_MASK) == INTR_TYPE_NMI_INTR &&
++ (exit_intr_info & INTR_INFO_VALID_MASK)) {
++ KVMTRACE_0D(NMI, &vmx->vcpu, handler);
++ asm("int $2");
++ }
++
++ idtv_info_valid = idt_vectoring_info & VECTORING_INFO_VALID_MASK;
++
+ if (cpu_has_virtual_nmis()) {
+ unblock_nmi = (exit_intr_info & INTR_INFO_UNBLOCK_NMI) != 0;
+ vector = exit_intr_info & INTR_INFO_VECTOR_MASK;
+@@ -3386,7 +3395,6 @@ static void fixup_rmode_irq(struct vcpu_
+ static void vmx_vcpu_run(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run)
+ {
+ struct vcpu_vmx *vmx = to_vmx(vcpu);
+- u32 intr_info;
+
+ /* Record the guest's net vcpu time for enforced NMI injections. */
+ if (unlikely(!cpu_has_virtual_nmis() && vmx->soft_vnmi_blocked))
+@@ -3515,15 +3523,6 @@ static void vmx_vcpu_run(struct kvm_vcpu
+ asm("mov %0, %%ds; mov %0, %%es" : : "r"(__USER_DS));
+ vmx->launched = 1;
+
+- intr_info = vmcs_read32(VM_EXIT_INTR_INFO);
+-
+- /* We need to handle NMIs before interrupts are enabled */
+- if ((intr_info & INTR_INFO_INTR_TYPE_MASK) == INTR_TYPE_NMI_INTR &&
+- (intr_info & INTR_INFO_VALID_MASK)) {
+- KVMTRACE_0D(NMI, vcpu, handler);
+- asm("int $2");
+- }
+-
+ vmx_complete_interrupts(vmx);
+ }
+
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:24:13 2009
+Message-Id: <20090701002413.194902498@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:22:55 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Andi Kleen <ak@linux.intel.com>,
+ Huang Ying <ying.huang@intel.com>,
+ Avi Kivity <avi@redhat.com>
+Subject: [patch 006/108] KVM: Add VT-x machine check support
+References: <20090701002249.937782934@mini.kroah.org>
+Content-Disposition: inline; filename=kvm-add-vt-x-machine-check-support.patch
+Content-Length: 5436
+Lines: 164
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Andi Kleen <ak@linux.intel.com>
+
+commit a0861c02a981c943573478ea13b29b1fb958ee5b upstream.
+
+VT-x needs an explicit MC vector intercept to handle machine checks in the
+hyper visor.
+
+It also has a special option to catch machine checks that happen
+during VT entry.
+
+Do these interceptions and forward them to the Linux machine check
+handler. Make it always look like user space is interrupted because
+the machine check handler treats kernel/user space differently.
+
+Thanks to Jiang Yunhong for help and testing.
+
+Signed-off-by: Andi Kleen <ak@linux.intel.com>
+Signed-off-by: Huang Ying <ying.huang@intel.com>
+Signed-off-by: Avi Kivity <avi@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/include/asm/vmx.h | 1
+ arch/x86/kernel/cpu/mcheck/mce_64.c | 1
+ arch/x86/kvm/vmx.c | 50 ++++++++++++++++++++++++++++++++++--
+ 3 files changed, 50 insertions(+), 2 deletions(-)
+
+--- a/arch/x86/include/asm/vmx.h
++++ b/arch/x86/include/asm/vmx.h
+@@ -247,6 +247,7 @@ enum vmcs_field {
+ #define EXIT_REASON_MSR_READ 31
+ #define EXIT_REASON_MSR_WRITE 32
+ #define EXIT_REASON_MWAIT_INSTRUCTION 36
++#define EXIT_REASON_MCE_DURING_VMENTRY 41
+ #define EXIT_REASON_TPR_BELOW_THRESHOLD 43
+ #define EXIT_REASON_APIC_ACCESS 44
+ #define EXIT_REASON_EPT_VIOLATION 48
+--- a/arch/x86/kernel/cpu/mcheck/mce_64.c
++++ b/arch/x86/kernel/cpu/mcheck/mce_64.c
+@@ -420,6 +420,7 @@ void do_machine_check(struct pt_regs * r
+ out2:
+ atomic_dec(&mce_entry);
+ }
++EXPORT_SYMBOL_GPL(do_machine_check);
+
+ #ifdef CONFIG_X86_MCE_INTEL
+ /***
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -32,6 +32,7 @@
+ #include <asm/desc.h>
+ #include <asm/vmx.h>
+ #include <asm/virtext.h>
++#include <asm/mce.h>
+
+ #define __ex(x) __kvm_handle_fault_on_reboot(x)
+
+@@ -97,6 +98,7 @@ struct vcpu_vmx {
+ int soft_vnmi_blocked;
+ ktime_t entry_time;
+ s64 vnmi_blocked_time;
++ u32 exit_reason;
+ };
+
+ static inline struct vcpu_vmx *to_vmx(struct kvm_vcpu *vcpu)
+@@ -213,6 +215,13 @@ static inline int is_external_interrupt(
+ == (INTR_TYPE_EXT_INTR | INTR_INFO_VALID_MASK);
+ }
+
++static inline int is_machine_check(u32 intr_info)
++{
++ return (intr_info & (INTR_INFO_INTR_TYPE_MASK | INTR_INFO_VECTOR_MASK |
++ INTR_INFO_VALID_MASK)) ==
++ (INTR_TYPE_HARD_EXCEPTION | MC_VECTOR | INTR_INFO_VALID_MASK);
++}
++
+ static inline int cpu_has_vmx_msr_bitmap(void)
+ {
+ return (vmcs_config.cpu_based_exec_ctrl & CPU_BASED_USE_MSR_BITMAPS);
+@@ -478,7 +487,7 @@ static void update_exception_bitmap(stru
+ {
+ u32 eb;
+
+- eb = (1u << PF_VECTOR) | (1u << UD_VECTOR);
++ eb = (1u << PF_VECTOR) | (1u << UD_VECTOR) | (1u << MC_VECTOR);
+ if (!vcpu->fpu_active)
+ eb |= 1u << NM_VECTOR;
+ if (vcpu->guest_debug & KVM_GUESTDBG_ENABLE) {
+@@ -2585,6 +2594,31 @@ static int handle_rmode_exception(struct
+ return 0;
+ }
+
++/*
++ * Trigger machine check on the host. We assume all the MSRs are already set up
++ * by the CPU and that we still run on the same CPU as the MCE occurred on.
++ * We pass a fake environment to the machine check handler because we want
++ * the guest to be always treated like user space, no matter what context
++ * it used internally.
++ */
++static void kvm_machine_check(void)
++{
++#if defined(CONFIG_X86_MCE) && defined(CONFIG_X86_64)
++ struct pt_regs regs = {
++ .cs = 3, /* Fake ring 3 no matter what the guest ran on */
++ .flags = X86_EFLAGS_IF,
++ };
++
++ do_machine_check(®s, 0);
++#endif
++}
++
++static int handle_machine_check(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run)
++{
++ /* already handled by vcpu_run */
++ return 1;
++}
++
+ static int handle_exception(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run)
+ {
+ struct vcpu_vmx *vmx = to_vmx(vcpu);
+@@ -2596,6 +2630,9 @@ static int handle_exception(struct kvm_v
+ vect_info = vmx->idt_vectoring_info;
+ intr_info = vmcs_read32(VM_EXIT_INTR_INFO);
+
++ if (is_machine_check(intr_info))
++ return handle_machine_check(vcpu, kvm_run);
++
+ if ((vect_info & VECTORING_INFO_VALID_MASK) &&
+ !is_page_fault(intr_info))
+ printk(KERN_ERR "%s: unexpected, vectoring info 0x%x "
+@@ -3150,6 +3187,7 @@ static int (*kvm_vmx_exit_handlers[])(st
+ [EXIT_REASON_WBINVD] = handle_wbinvd,
+ [EXIT_REASON_TASK_SWITCH] = handle_task_switch,
+ [EXIT_REASON_EPT_VIOLATION] = handle_ept_violation,
++ [EXIT_REASON_MCE_DURING_VMENTRY] = handle_machine_check,
+ };
+
+ static const int kvm_vmx_max_exit_handlers =
+@@ -3161,8 +3199,8 @@ static const int kvm_vmx_max_exit_handle
+ */
+ static int kvm_handle_exit(struct kvm_run *kvm_run, struct kvm_vcpu *vcpu)
+ {
+- u32 exit_reason = vmcs_read32(VM_EXIT_REASON);
+ struct vcpu_vmx *vmx = to_vmx(vcpu);
++ u32 exit_reason = vmx->exit_reason;
+ u32 vectoring_info = vmx->idt_vectoring_info;
+
+ KVMTRACE_3D(VMEXIT, vcpu, exit_reason, (u32)kvm_rip_read(vcpu),
+@@ -3257,6 +3295,14 @@ static void vmx_complete_interrupts(stru
+
+ exit_intr_info = vmcs_read32(VM_EXIT_INTR_INFO);
+
++ vmx->exit_reason = vmcs_read32(VM_EXIT_REASON);
++
++ /* Handle machine checks before interrupts are enabled */
++ if ((vmx->exit_reason == EXIT_REASON_MCE_DURING_VMENTRY)
++ || (vmx->exit_reason == EXIT_REASON_EXCEPTION_NMI
++ && is_machine_check(exit_intr_info)))
++ kvm_machine_check();
++
+ /* We need to handle NMIs before interrupts are enabled */
+ if ((exit_intr_info & INTR_INFO_INTR_TYPE_MASK) == INTR_TYPE_NMI_INTR &&
+ (exit_intr_info & INTR_INFO_VALID_MASK)) {
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:24:13 2009
+Message-Id: <20090701002413.536284495@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:22:56 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Avi Kivity <avi@redhat.com>
+Subject: [patch 007/108] KVM: Disable large pages on misaligned memory slots
+References: <20090701002249.937782934@mini.kroah.org>
+Content-Disposition: inline; filename=kvm-disable-large-pages-on-misaligned-memory-slots.patch
+Content-Length: 1356
+Lines: 43
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Avi Kivity <avi@redhat.com>
+
+commit ac04527f7947020c5890090b2ac87af4e98d977e upstream.
+
+If a slots guest physical address and host virtual address unequal (mod
+large page size), then we would erronously try to back guest large pages
+with host large pages. Detect this misalignment and diable large page
+support for the trouble slot.
+
+Signed-off-by: Avi Kivity <avi@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ virt/kvm/kvm_main.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+--- a/virt/kvm/kvm_main.c
++++ b/virt/kvm/kvm_main.c
+@@ -919,7 +919,7 @@ int __kvm_set_memory_region(struct kvm *
+ {
+ int r;
+ gfn_t base_gfn;
+- unsigned long npages;
++ unsigned long npages, ugfn;
+ int largepages;
+ unsigned long i;
+ struct kvm_memory_slot *memslot;
+@@ -1010,6 +1010,14 @@ int __kvm_set_memory_region(struct kvm *
+ new.lpage_info[0].write_count = 1;
+ if ((base_gfn+npages) % KVM_PAGES_PER_HPAGE)
+ new.lpage_info[largepages-1].write_count = 1;
++ ugfn = new.userspace_addr >> PAGE_SHIFT;
++ /*
++ * If the gfn and userspace address are not aligned wrt each
++ * other, disable large page support for this slot
++ */
++ if ((base_gfn ^ ugfn) & (KVM_PAGES_PER_HPAGE - 1))
++ for (i = 0; i < largepages; ++i)
++ new.lpage_info[i].write_count = 1;
+ }
+
+ /* Allocate page dirty bitmap if needed */
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:24:14 2009
+Message-Id: <20090701002414.000432799@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:22:57 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Avi Kivity <avi@redhat.com>
+Subject: [patch 008/108] KVM: Prevent overflow in largepages calculation
+References: <20090701002249.937782934@mini.kroah.org>
+Content-Disposition: inline; filename=kvm-prevent-overflow-in-largepages-calculation.patch
+Content-Length: 699
+Lines: 27
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Avi Kivity <avi@redhat.com>
+
+commit 09f8ca74ae6c2d78b2c7f6c0751ed0cbe815a3d9 upstream.
+
+If userspace specifies a memory slot that is larger than 8 petabytes, it
+could overflow the largepages variable.
+
+Signed-off-by: Avi Kivity <avi@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ virt/kvm/kvm_main.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/virt/kvm/kvm_main.c
++++ b/virt/kvm/kvm_main.c
+@@ -920,8 +920,7 @@ int __kvm_set_memory_region(struct kvm *
+ int r;
+ gfn_t base_gfn;
+ unsigned long npages, ugfn;
+- int largepages;
+- unsigned long i;
++ unsigned long largepages, i;
+ struct kvm_memory_slot *memslot;
+ struct kvm_memory_slot old, new;
+
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:24:14 2009
+Message-Id: <20090701002414.580133016@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:22:58 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Marcelo Tosatti <mtosatti@redhat.com>,
+ Avi Kivity <avi@redhat.com>
+Subject: [patch 009/108] KVM: x86: check for cr3 validity in ioctl_set_sregs
+References: <20090701002249.937782934@mini.kroah.org>
+Content-Disposition: inline; filename=kvm-x86-check-for-cr3-validity-in-ioctl_set_sregs.patch
+Content-Length: 1730
+Lines: 49
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Marcelo Tosatti <mtosatti@redhat.com>
+
+commit 59839dfff5eabca01cc4e20b45797a60a80af8cb upstream.
+
+Matt T. Yourst notes that kvm_arch_vcpu_ioctl_set_sregs lacks validity
+checking for the new cr3 value:
+
+"Userspace callers of KVM_SET_SREGS can pass a bogus value of cr3 to
+the kernel. This will trigger a NULL pointer access in gfn_to_rmap()
+when userspace next tries to call KVM_RUN on the affected VCPU and kvm
+attempts to activate the new non-existent page table root.
+
+This happens since kvm only validates that cr3 points to a valid guest
+physical memory page when code *inside* the guest sets cr3. However, kvm
+currently trusts the userspace caller (e.g. QEMU) on the host machine to
+always supply a valid page table root, rather than properly validating
+it along with the rest of the reloaded guest state."
+
+http://sourceforge.net/tracker/?func=detail&atid=893831&aid=2687641&group_id=180599
+
+Check for a valid cr3 address in kvm_arch_vcpu_ioctl_set_sregs, triple
+fault in case of failure.
+
+Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
+Signed-off-by: Avi Kivity <avi@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kvm/x86.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -3934,7 +3934,13 @@ int kvm_arch_vcpu_ioctl_set_sregs(struct
+
+ vcpu->arch.cr2 = sregs->cr2;
+ mmu_reset_needed |= vcpu->arch.cr3 != sregs->cr3;
+- vcpu->arch.cr3 = sregs->cr3;
++
++ down_read(&vcpu->kvm->slots_lock);
++ if (gfn_to_memslot(vcpu->kvm, sregs->cr3 >> PAGE_SHIFT))
++ vcpu->arch.cr3 = sregs->cr3;
++ else
++ set_bit(KVM_REQ_TRIPLE_FAULT, &vcpu->requests);
++ up_read(&vcpu->kvm->slots_lock);
+
+ kvm_set_cr8(vcpu, sregs->cr8);
+
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:24:15 2009
+Message-Id: <20090701002415.081558754@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:22:59 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Avi Kivity <avi@redhat.com>
+Subject: [patch 010/108] KVM: VMX: Handle vmx instruction vmexits
+References: <20090701002249.937782934@mini.kroah.org>
+Content-Disposition: inline; filename=kvm-vmx-handle-vmx-instruction-vmexits.patch
+Content-Length: 1809
+Lines: 48
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Avi Kivity <avi@redhat.com>
+
+commit e3c7cb6ad7191e92ba89d00a7ae5f5dd1ca0c214 upstream.
+
+IF a guest tries to use vmx instructions, inject a #UD to let it know the
+instruction is not implemented, rather than crashing.
+
+This prevents guest userspace from crashing the guest kernel.
+
+Signed-off-by: Avi Kivity <avi@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kvm/vmx.c | 15 +++++++++++++++
+ 1 file changed, 15 insertions(+)
+
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -3015,6 +3015,12 @@ static int handle_vmcall(struct kvm_vcpu
+ return 1;
+ }
+
++static int handle_vmx_insn(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run)
++{
++ kvm_queue_exception(vcpu, UD_VECTOR);
++ return 1;
++}
++
+ static int handle_invlpg(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run)
+ {
+ u64 exit_qualification = vmcs_read64(EXIT_QUALIFICATION);
+@@ -3182,6 +3188,15 @@ static int (*kvm_vmx_exit_handlers[])(st
+ [EXIT_REASON_HLT] = handle_halt,
+ [EXIT_REASON_INVLPG] = handle_invlpg,
+ [EXIT_REASON_VMCALL] = handle_vmcall,
++ [EXIT_REASON_VMCLEAR] = handle_vmx_insn,
++ [EXIT_REASON_VMLAUNCH] = handle_vmx_insn,
++ [EXIT_REASON_VMPTRLD] = handle_vmx_insn,
++ [EXIT_REASON_VMPTRST] = handle_vmx_insn,
++ [EXIT_REASON_VMREAD] = handle_vmx_insn,
++ [EXIT_REASON_VMRESUME] = handle_vmx_insn,
++ [EXIT_REASON_VMWRITE] = handle_vmx_insn,
++ [EXIT_REASON_VMOFF] = handle_vmx_insn,
++ [EXIT_REASON_VMON] = handle_vmx_insn,
+ [EXIT_REASON_TPR_BELOW_THRESHOLD] = handle_tpr_below_threshold,
+ [EXIT_REASON_APIC_ACCESS] = handle_apic_access,
+ [EXIT_REASON_WBINVD] = handle_wbinvd,
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:24:15 2009
+Message-Id: <20090701002415.528425884@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:23:00 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Andrea Arcangeli <aarcange@redhat.com>,
+ Marcelo Tosatti <mtosatti@redhat.com>,
+ Avi Kivity <avi@redhat.com>
+Subject: [patch 011/108] KVM: protect concurrent make_all_cpus_request
+References: <20090701002249.937782934@mini.kroah.org>
+Content-Disposition: inline; filename=kvm-protect-concurrent-make_all_cpus_request.patch
+Content-Length: 2023
+Lines: 63
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Marcelo Tosatti <mtosatti@redhat.com>
+
+commit 84261923d3dddb766736023bead6fa07b7e218d5 upstream.
+
+make_all_cpus_request contains a race condition which can
+trigger false request completed status, as follows:
+
+CPU0 CPU1
+
+if (test_and_set_bit(req,&vcpu->requests))
+ .... if (test_and_set_bit(req,&vcpu->requests))
+ .. return
+proceed to smp_call_function_many(wait=1)
+
+Use a spinlock to serialize concurrent CPUs.
+
+Signed-off-by: Andrea Arcangeli <aarcange@redhat.com>
+Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
+Signed-off-by: Avi Kivity <avi@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ include/linux/kvm_host.h | 1 +
+ virt/kvm/kvm_main.c | 3 +++
+ 2 files changed, 4 insertions(+)
+
+--- a/include/linux/kvm_host.h
++++ b/include/linux/kvm_host.h
+@@ -125,6 +125,7 @@ struct kvm_kernel_irq_routing_entry {
+ struct kvm {
+ struct mutex lock; /* protects the vcpus array and APIC accesses */
+ spinlock_t mmu_lock;
++ spinlock_t requests_lock;
+ struct rw_semaphore slots_lock;
+ struct mm_struct *mm; /* userspace tied to this vm */
+ int nmemslots;
+--- a/virt/kvm/kvm_main.c
++++ b/virt/kvm/kvm_main.c
+@@ -581,6 +581,7 @@ static bool make_all_cpus_request(struct
+ cpumask_clear(cpus);
+
+ me = get_cpu();
++ spin_lock(&kvm->requests_lock);
+ for (i = 0; i < KVM_MAX_VCPUS; ++i) {
+ vcpu = kvm->vcpus[i];
+ if (!vcpu)
+@@ -597,6 +598,7 @@ static bool make_all_cpus_request(struct
+ smp_call_function_many(cpus, ack_flush, NULL, 1);
+ else
+ called = false;
++ spin_unlock(&kvm->requests_lock);
+ put_cpu();
+ free_cpumask_var(cpus);
+ return called;
+@@ -817,6 +819,7 @@ static struct kvm *kvm_create_vm(void)
+ kvm->mm = current->mm;
+ atomic_inc(&kvm->mm->mm_count);
+ spin_lock_init(&kvm->mmu_lock);
++ spin_lock_init(&kvm->requests_lock);
+ kvm_io_bus_init(&kvm->pio_bus);
+ mutex_init(&kvm->lock);
+ kvm_io_bus_init(&kvm->mmio_bus);
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:24:16 2009
+Message-Id: <20090701002415.739953685@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:23:01 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Izik Eidus <ieidus@redhat.com>,
+ Avi Kivity <avi@redhat.com>
+Subject: [patch 012/108] KVM: Fix dirty bit tracking for slots with large pages
+References: <20090701002249.937782934@mini.kroah.org>
+Content-Disposition: inline; filename=kvm-fix-dirty-bit-tracking-for-slots-with-large-pages.patch
+Content-Length: 782
+Lines: 30
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Izik Eidus <ieidus@redhat.com>
+
+commit e244584fe3a5c20deddeca246548ac86dbc6e1d1 upstream.
+
+When slot is already allocated and being asked to be tracked we need
+to break the large pages.
+
+This code flush the mmu when someone ask a slot to start dirty bit
+tracking.
+
+Signed-off-by: Izik Eidus <ieidus@redhat.com>
+Signed-off-by: Avi Kivity <avi@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ virt/kvm/kvm_main.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/virt/kvm/kvm_main.c
++++ b/virt/kvm/kvm_main.c
+@@ -1030,6 +1030,8 @@ int __kvm_set_memory_region(struct kvm *
+ if (!new.dirty_bitmap)
+ goto out_free;
+ memset(new.dirty_bitmap, 0, dirty_bytes);
++ if (old.npages)
++ kvm_arch_flush_shadow(kvm);
+ }
+ #endif /* not defined CONFIG_S390 */
+
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:24:16 2009
+Message-Id: <20090701002416.135885567@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:23:02 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Eric Paris <eparis@redhat.com>,
+ Mimi Zohar <zohar@us.ibm.com>,
+ James Morris <jmorris@namei.org>
+Subject: [patch 013/108] IMA: use current_cred() instead of current->cred
+References: <20090701002249.937782934@mini.kroah.org>
+Content-Disposition: inline; filename=ima-use-current_cred-instead-of-current-cred.patch
+Content-Length: 1457
+Lines: 40
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Eric Paris <eparis@redhat.com>
+
+commit 37bcbf13d32e4e453e9def79ee72bd953b88302f upstream.
+
+Proper invocation of the current credentials is to use current_cred() not
+current->cred. This patches makes IMA use the new method.
+
+Signed-off-by: Eric Paris <eparis@redhat.com>
+Acked-by: Mimi Zohar <zohar@us.ibm.com>
+Signed-off-by: James Morris <jmorris@namei.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ security/integrity/ima/ima_audit.c | 2 +-
+ security/integrity/ima/ima_main.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+--- a/security/integrity/ima/ima_audit.c
++++ b/security/integrity/ima/ima_audit.c
+@@ -50,7 +50,7 @@ void integrity_audit_msg(int audit_msgno
+
+ ab = audit_log_start(current->audit_context, GFP_KERNEL, audit_msgno);
+ audit_log_format(ab, "integrity: pid=%d uid=%u auid=%u ses=%u",
+- current->pid, current->cred->uid,
++ current->pid, current_cred()->uid,
+ audit_get_loginuid(current),
+ audit_get_sessionid(current));
+ audit_log_task_context(ab);
+--- a/security/integrity/ima/ima_main.c
++++ b/security/integrity/ima/ima_main.c
+@@ -196,7 +196,7 @@ int ima_path_check(struct path *path, in
+ struct dentry *dentry = dget(path->dentry);
+ struct vfsmount *mnt = mntget(path->mnt);
+
+- file = dentry_open(dentry, mnt, O_RDONLY, current->cred);
++ file = dentry_open(dentry, mnt, O_RDONLY, current_cred());
+ rc = get_path_measurement(iint, file, dentry->d_name.name);
+ }
+ out:
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:24:17 2009
+Message-Id: <20090701002416.562974968@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:23:03 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Eric Paris <eparis@redhat.com>,
+ Mimi Zohar <zohar@us.ibm.com>,
+ James Morris <jmorris@namei.org>
+Subject: [patch 014/108] IMA: Handle dentry_open failures
+References: <20090701002249.937782934@mini.kroah.org>
+Content-Disposition: inline; filename=ima-handle-dentry_open-failures.patch
+Content-Length: 1255
+Lines: 44
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Eric Paris <eparis@redhat.com>
+
+commit f06dd16a03f6f7f72fab4db03be36e28c28c6fd6 upstream.
+
+Currently IMA does not handle failures from dentry_open(). This means that we
+leave a pointer set to ERR_PTR(errno) and then try to use it just a few lines
+later in fput(). Oops.
+
+Signed-off-by: Eric Paris <eparis@redhat.com>
+Acked-by: Mimi Zohar <zohar@us.ibm.com>
+Signed-off-by: James Morris <jmorris@namei.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ security/integrity/ima/ima_main.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+--- a/security/integrity/ima/ima_main.c
++++ b/security/integrity/ima/ima_main.c
+@@ -128,10 +128,6 @@ static int get_path_measurement(struct i
+ {
+ int rc = 0;
+
+- if (IS_ERR(file)) {
+- pr_info("%s dentry_open failed\n", filename);
+- return rc;
+- }
+ iint->opencount++;
+ iint->readcount++;
+
+@@ -197,6 +193,12 @@ int ima_path_check(struct path *path, in
+ struct vfsmount *mnt = mntget(path->mnt);
+
+ file = dentry_open(dentry, mnt, O_RDONLY, current_cred());
++ if (IS_ERR(file)) {
++ pr_info("%s dentry_open failed\n", dentry->d_name.name);
++ rc = PTR_ERR(file);
++ file = NULL;
++ goto out;
++ }
+ rc = get_path_measurement(iint, file, dentry->d_name.name);
+ }
+ out:
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:24:17 2009
+Message-Id: <20090701002417.180909517@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:23:04 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Eric Paris <eparis@redhat.com>,
+ Mimi Zohar <zohar@us.ibm.com>,
+ James Morris <jmorris@namei.org>
+Subject: [patch 015/108] IMA: open all files O_LARGEFILE
+References: <20090701002249.937782934@mini.kroah.org>
+Content-Disposition: inline; filename=ima-open-all-files-o_largefile.patch
+Content-Length: 1077
+Lines: 30
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Eric Paris <eparis@redhat.com>
+
+commit 1a62e958fa4aaeeb752311b4f5e16b2a86737b23 upstream.
+
+If IMA tried to measure a file which was larger than 4G dentry_open would fail
+with -EOVERFLOW since IMA wasn't passing O_LARGEFILE. This patch passes
+O_LARGEFILE to all IMA opens to avoid this problem.
+
+Signed-off-by: Eric Paris <eparis@redhat.com>
+Acked-by: Mimi Zohar <zohar@us.ibm.com>
+Signed-off-by: James Morris <jmorris@namei.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ security/integrity/ima/ima_main.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/security/integrity/ima/ima_main.c
++++ b/security/integrity/ima/ima_main.c
+@@ -192,7 +192,8 @@ int ima_path_check(struct path *path, in
+ struct dentry *dentry = dget(path->dentry);
+ struct vfsmount *mnt = mntget(path->mnt);
+
+- file = dentry_open(dentry, mnt, O_RDONLY, current_cred());
++ file = dentry_open(dentry, mnt, O_RDONLY | O_LARGEFILE,
++ current_cred());
+ if (IS_ERR(file)) {
+ pr_info("%s dentry_open failed\n", dentry->d_name.name);
+ rc = PTR_ERR(file);
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:24:17 2009
+Message-Id: <20090701002417.581497504@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:23:05 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Andy Gospodarek <andy@greyhouse.net>,
+ Alexander Duyck <alexander.h.duyck@intel.com>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [patch 016/108] e1000e: stop unnecessary polling when using msi-x
+References: <20090701002249.937782934@mini.kroah.org>
+Content-Disposition: inline; filename=e1000e-stop-unnecessary-polling-when-using-msi-x.patch
+Content-Length: 1469
+Lines: 44
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Andy Gospodarek <andy@greyhouse.net>
+
+[ Upstream commit 679e8a0f0ae3333e94b1d374d07775fce9066025 ]
+
+The last hunk of this commit:
+
+ commit 12d04a3c12b420f23398b4d650127642469a60a6
+ Author: Alexander Duyck <alexander.h.duyck@intel.com>
+ Date: Wed Mar 25 22:05:03 2009 +0000
+
+ e1000e: commonize tx cleanup routine to match e1000 & igb
+
+changed the logic for determining if we should call napi_complete or
+not at then end of a napi poll.
+
+If the NIC is using MSI-X with no work to do in ->poll, net_rx_action
+can just spin indefinitely on older kernels and for 2 jiffies on newer
+kernels since napi_complete is never called and budget isn't
+decremented.
+
+Discovered and verified while testing driver backport to an older
+kernel.
+
+Signed-off-by: Andy Gospodarek <andy@greyhouse.net>
+Acked-by: Alexander Duyck <alexander.h.duyck@intel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/e1000e/netdev.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/e1000e/netdev.c
++++ b/drivers/net/e1000e/netdev.c
+@@ -1996,7 +1996,7 @@ static int e1000_clean(struct napi_struc
+ struct e1000_adapter *adapter = container_of(napi, struct e1000_adapter, napi);
+ struct e1000_hw *hw = &adapter->hw;
+ struct net_device *poll_dev = adapter->netdev;
+- int tx_cleaned = 0, work_done = 0;
++ int tx_cleaned = 1, work_done = 0;
+
+ adapter = netdev_priv(poll_dev);
+
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:24:18 2009
+Message-Id: <20090701002417.910884894@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:23:06 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Michael Buesch <mb@bu3sch.de>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [patch 017/108] pegasus usb-net: Fix endianness bugs
+References: <20090701002249.937782934@mini.kroah.org>
+Content-Disposition: inline; filename=pegasus-usb-net-fix-endianness-bugs.patch
+Content-Length: 2980
+Lines: 93
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Michael Buesch <mb@bu3sch.de>
+
+[ Upstream commit e3453f6342110d60edb37be92c4a4f668ca8b0c4 ]
+
+This fixes various endianness bugs. Some harmless and some real ones.
+This is tested on a PowerPC-64 machine.
+
+Signed-off-by: Michael Buesch <mb@bu3sch.de>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/usb/pegasus.c | 29 +++++++++++++++++------------
+ 1 file changed, 17 insertions(+), 12 deletions(-)
+
+--- a/drivers/net/usb/pegasus.c
++++ b/drivers/net/usb/pegasus.c
+@@ -297,7 +297,7 @@ static int update_eth_regs_async(pegasus
+
+ pegasus->dr.bRequestType = PEGASUS_REQT_WRITE;
+ pegasus->dr.bRequest = PEGASUS_REQ_SET_REGS;
+- pegasus->dr.wValue = 0;
++ pegasus->dr.wValue = cpu_to_le16(0);
+ pegasus->dr.wIndex = cpu_to_le16(EthCtrl0);
+ pegasus->dr.wLength = cpu_to_le16(3);
+ pegasus->ctrl_urb->transfer_buffer_length = 3;
+@@ -446,11 +446,12 @@ static int write_eprom_word(pegasus_t *
+ int i;
+ __u8 tmp, d[4] = { 0x3f, 0, 0, EPROM_WRITE };
+ int ret;
++ __le16 le_data = cpu_to_le16(data);
+
+ set_registers(pegasus, EpromOffset, 4, d);
+ enable_eprom_write(pegasus);
+ set_register(pegasus, EpromOffset, index);
+- set_registers(pegasus, EpromData, 2, &data);
++ set_registers(pegasus, EpromData, 2, &le_data);
+ set_register(pegasus, EpromCtrl, EPROM_WRITE);
+
+ for (i = 0; i < REG_TIMEOUT; i++) {
+@@ -923,29 +924,32 @@ static struct net_device_stats *pegasus_
+
+ static inline void disable_net_traffic(pegasus_t * pegasus)
+ {
+- int tmp = 0;
++ __le16 tmp = cpu_to_le16(0);
+
+- set_registers(pegasus, EthCtrl0, 2, &tmp);
++ set_registers(pegasus, EthCtrl0, sizeof(tmp), &tmp);
+ }
+
+ static inline void get_interrupt_interval(pegasus_t * pegasus)
+ {
+- __u8 data[2];
++ u16 data;
++ u8 interval;
+
+- read_eprom_word(pegasus, 4, (__u16 *) data);
++ read_eprom_word(pegasus, 4, &data);
++ interval = data >> 8;
+ if (pegasus->usb->speed != USB_SPEED_HIGH) {
+- if (data[1] < 0x80) {
++ if (interval < 0x80) {
+ if (netif_msg_timer(pegasus))
+ dev_info(&pegasus->intf->dev, "intr interval "
+ "changed from %ums to %ums\n",
+- data[1], 0x80);
+- data[1] = 0x80;
++ interval, 0x80);
++ interval = 0x80;
++ data = (data & 0x00FF) | ((u16)interval << 8);
+ #ifdef PEGASUS_WRITE_EEPROM
+- write_eprom_word(pegasus, 4, *(__u16 *) data);
++ write_eprom_word(pegasus, 4, data);
+ #endif
+ }
+ }
+- pegasus->intr_interval = data[1];
++ pegasus->intr_interval = interval;
+ }
+
+ static void set_carrier(struct net_device *net)
+@@ -1299,7 +1303,8 @@ static int pegasus_blacklisted(struct us
+ /* Special quirk to keep the driver from handling the Belkin Bluetooth
+ * dongle which happens to have the same ID.
+ */
+- if ((udd->idVendor == VENDOR_BELKIN && udd->idProduct == 0x0121) &&
++ if ((udd->idVendor == cpu_to_le16(VENDOR_BELKIN)) &&
++ (udd->idProduct == cpu_to_le16(0x0121)) &&
+ (udd->bDeviceClass == USB_CLASS_WIRELESS_CONTROLLER) &&
+ (udd->bDeviceProtocol == 1))
+ return 1;
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:24:18 2009
+Message-Id: <20090701002418.219188826@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:23:07 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Neil Horman <nhorman@tuxdriver.com>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [patch 018/108] ipv4: fix NULL pointer + success return in route lookup path
+References: <20090701002249.937782934@mini.kroah.org>
+Content-Disposition: inline; filename=ipv4-fix-null-pointer-success-return-in-route-lookup-path.patch
+Content-Length: 2348
+Lines: 61
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Neil Horman <nhorman@tuxdriver.com>
+
+[ Upstream commit 73e42897e8e5619eacb787d2ce69be12f47cfc21 ]
+
+Don't drop route if we're not caching
+
+ I recently got a report of an oops on a route lookup. Maxime was
+testing what would happen if route caching was turned off (doing so by setting
+making rt_caching always return 0), and found that it triggered an oops. I
+looked at it and found that the problem stemmed from the fact that the route
+lookup routines were returning success from their lookup paths (which is good),
+but never set the **rp pointer to anything (which is bad). This happens because
+in rt_intern_hash, if rt_caching returns false, we call rt_drop and return 0.
+This almost emulates slient success. What we should be doing is assigning *rp =
+rt and _not_ dropping the route. This way, during slow path lookups, when we
+create a new route cache entry, we don't immediately discard it, rather we just
+don't add it into the cache hash table, but we let this one lookup use it for
+the purpose of this route request. Maxime has tested and reports it prevents
+the oops. There is still a subsequent routing issue that I'm looking into
+further, but I'm confident that, even if its related to this same path, this
+patch makes sense to take.
+
+Signed-off-by: Neil Horman <nhorman@tuxdriver.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/ipv4/route.c | 14 ++++++++++++--
+ 1 file changed, 12 insertions(+), 2 deletions(-)
+
+--- a/net/ipv4/route.c
++++ b/net/ipv4/route.c
+@@ -1081,8 +1081,16 @@ restart:
+ now = jiffies;
+
+ if (!rt_caching(dev_net(rt->u.dst.dev))) {
+- rt_drop(rt);
+- return 0;
++ /*
++ * If we're not caching, just tell the caller we
++ * were successful and don't touch the route. The
++ * caller hold the sole reference to the cache entry, and
++ * it will be released when the caller is done with it.
++ * If we drop it here, the callers have no way to resolve routes
++ * when we're not caching. Instead, just point *rp at rt, so
++ * the caller gets a single use out of the route
++ */
++ goto report_and_exit;
+ }
+
+ rthp = &rt_hash_table[hash].chain;
+@@ -1210,6 +1218,8 @@ restart:
+ rcu_assign_pointer(rt_hash_table[hash].chain, rt);
+
+ spin_unlock_bh(rt_hash_lock_addr(hash));
++
++report_and_exit:
+ *rp = rt;
+ return 0;
+ }
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:24:18 2009
+Message-Id: <20090701002418.436619378@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:23:08 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Neil Horman <nhorman@redhat.com>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [patch 019/108] ipv4 routing: Ensure that route cache entries are usable and reclaimable with caching is off
+References: <20090701002249.937782934@mini.kroah.org>
+Content-Disposition: inline; filename=ipv4-routing-ensure-that-route-cache-entries-are-usable-and-reclaimable-with-caching-is-off.patch
+Content-Length: 3485
+Lines: 90
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Neil Horman <nhorman@tuxdriver.com>
+
+[ Upstream commit b6280b47a7a42970d098a3059f4ebe7e55e90d8d ]
+
+When route caching is disabled (rt_caching returns false), We still use route
+cache entries that are created and passed into rt_intern_hash once. These
+routes need to be made usable for the one call path that holds a reference to
+them, and they need to be reclaimed when they're finished with their use. To be
+made usable, they need to be associated with a neighbor table entry (which they
+currently are not), otherwise iproute_finish2 just discards the packet, since we
+don't know which L2 peer to send the packet to. To do this binding, we need to
+follow the path a bit higher up in rt_intern_hash, which calls
+arp_bind_neighbour, but not assign the route entry to the hash table.
+Currently, if caching is off, we simply assign the route to the rp pointer and
+are reutrn success. This patch associates us with a neighbor entry first.
+
+Secondly, we need to make sure that any single use routes like this are known to
+the garbage collector when caching is off. If caching is off, and we try to
+hash in a route, it will leak when its refcount reaches zero. To avoid this,
+this patch calls rt_free on the route cache entry passed into rt_intern_hash.
+This places us on the gc list for the route cache garbage collector, so that
+when its refcount reaches zero, it will be reclaimed (Thanks to Alexey for this
+suggestion).
+
+I've tested this on a local system here, and with these patches in place, I'm
+able to maintain routed connectivity to remote systems, even if I set
+/proc/sys/net/ipv4/rt_cache_rebuild_count to -1, which forces rt_caching to
+return false.
+
+Signed-off-by: Neil Horman <nhorman@redhat.com>
+Reported-by: Jarek Poplawski <jarkao2@gmail.com>
+Reported-by: Maxime Bizon <mbizon@freebox.fr>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/ipv4/route.c | 26 +++++++++++++++++++++++---
+ 1 file changed, 23 insertions(+), 3 deletions(-)
+
+--- a/net/ipv4/route.c
++++ b/net/ipv4/route.c
+@@ -1089,8 +1089,27 @@ restart:
+ * If we drop it here, the callers have no way to resolve routes
+ * when we're not caching. Instead, just point *rp at rt, so
+ * the caller gets a single use out of the route
++ * Note that we do rt_free on this new route entry, so that
++ * once its refcount hits zero, we are still able to reap it
++ * (Thanks Alexey)
++ * Note also the rt_free uses call_rcu. We don't actually
++ * need rcu protection here, this is just our path to get
++ * on the route gc list.
+ */
+- goto report_and_exit;
++
++ if (rt->rt_type == RTN_UNICAST || rt->fl.iif == 0) {
++ int err = arp_bind_neighbour(&rt->u.dst);
++ if (err) {
++ if (net_ratelimit())
++ printk(KERN_WARNING
++ "Neighbour table failure & not caching routes.\n");
++ rt_drop(rt);
++ return err;
++ }
++ }
++
++ rt_free(rt);
++ goto skip_hashing;
+ }
+
+ rthp = &rt_hash_table[hash].chain;
+@@ -1204,7 +1223,8 @@ restart:
+ #if RT_CACHE_DEBUG >= 2
+ if (rt->u.dst.rt_next) {
+ struct rtable *trt;
+- printk(KERN_DEBUG "rt_cache @%02x: %pI4", hash, &rt->rt_dst);
++ printk(KERN_DEBUG "rt_cache @%02x: %pI4",
++ hash, &rt->rt_dst);
+ for (trt = rt->u.dst.rt_next; trt; trt = trt->u.dst.rt_next)
+ printk(" . %pI4", &trt->rt_dst);
+ printk("\n");
+@@ -1219,7 +1239,7 @@ restart:
+
+ spin_unlock_bh(rt_hash_lock_addr(hash));
+
+-report_and_exit:
++skip_hashing:
+ *rp = rt;
+ return 0;
+ }
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:24:18 2009
+Message-Id: <20090701002418.606152665@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:23:09 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Stephen Hemminger <shemminger@vyatta.com>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [patch 020/108] sky2: dont look for VPD size
+References: <20090701002249.937782934@mini.kroah.org>
+Content-Disposition: inline; filename=sky2-don-t-look-for-vpd-size.patch
+Content-Length: 2395
+Lines: 74
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Stephen Hemminger <shemminger@vyatta.com>
+
+[ Upstream commit 6cc90a5a6061428358d0f726a53fb44af5254111 ]
+
+The code to compute VPD size didn't handle some systems that use
+chip without VPD. Also some of the newer chips use some additional
+registers to store the actual size, and wasn't worth putting the
+additional complexity in, so just remove the code.
+
+No big loss since the code to set the VPD size was only a
+convenience so that utilities would not read the extra space past
+the end of the available VPD.
+
+Move the first PCI config read earlier to detect bad hardware
+where it returns all ones and refuse loading driver before furthur
+damage.
+
+Signed-off-by: Stephen Hemminger <shemminger@vyatta.com>
+Tested-by: Andy Whitcroft <apw@canonical.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/sky2.c | 31 ++++++++++++++++---------------
+ 1 file changed, 16 insertions(+), 15 deletions(-)
+
+--- a/drivers/net/sky2.c
++++ b/drivers/net/sky2.c
+@@ -4365,6 +4365,22 @@ static int __devinit sky2_probe(struct p
+ goto err_out;
+ }
+
++ /* Get configuration information
++ * Note: only regular PCI config access once to test for HW issues
++ * other PCI access through shared memory for speed and to
++ * avoid MMCONFIG problems.
++ */
++ err = pci_read_config_dword(pdev, PCI_DEV_REG2, ®);
++ if (err) {
++ dev_err(&pdev->dev, "PCI read config failed\n");
++ goto err_out;
++ }
++
++ if (~reg == 0) {
++ dev_err(&pdev->dev, "PCI configuration read error\n");
++ goto err_out;
++ }
++
+ err = pci_request_regions(pdev, DRV_NAME);
+ if (err) {
+ dev_err(&pdev->dev, "cannot obtain PCI resources\n");
+@@ -4390,21 +4406,6 @@ static int __devinit sky2_probe(struct p
+ }
+ }
+
+- /* Get configuration information
+- * Note: only regular PCI config access once to test for HW issues
+- * other PCI access through shared memory for speed and to
+- * avoid MMCONFIG problems.
+- */
+- err = pci_read_config_dword(pdev, PCI_DEV_REG2, ®);
+- if (err) {
+- dev_err(&pdev->dev, "PCI read config failed\n");
+- goto err_out_free_regions;
+- }
+-
+- /* size of available VPD, only impact sysfs */
+- err = pci_vpd_truncate(pdev, 1ul << (((reg & PCI_VPD_ROM_SZ) >> 14) + 8));
+- if (err)
+- dev_warn(&pdev->dev, "Can't set VPD size\n");
+
+ #ifdef __BIG_ENDIAN
+ /* The sk98lin vendor driver uses hardware byte swapping but
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:24:19 2009
+Message-Id: <20090701002418.865780488@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:23:10 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ "Eric W. Biederman" <ebiederm@aristanetworks.com>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [patch 021/108] tun: Fix unregister race
+References: <20090701002249.937782934@mini.kroah.org>
+Content-Disposition: inline; filename=tun-fix-unregister-race.patch
+Content-Length: 1621
+Lines: 54
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Eric W. Biederman <ebiederm@aristanetworks.com>
+
+[ Upstream commit f0a4d0e5b5bfd271e6737f7c095994835b70d450 ]
+
+It is possible for tun_chr_close to race with dellink on the
+a tun device. In which case if __tun_get runs before dellink
+but dellink runs before tun_chr_close calls unregister_netdevice
+we will attempt to unregister the netdevice after it is already
+gone.
+
+The two cases are already serialized on the rtnl_lock, so I have
+gone for the cheap simple fix of moving rtnl_lock to cover __tun_get
+in tun_chr_close. Eliminating the possibility of the tun device
+being unregistered between __tun_get and unregister_netdevice in
+tun_chr_close.
+
+Signed-off-by: Eric W. Biederman <ebiederm@aristanetworks.com>
+Tested-by: David Woodhouse <David.Woodhouse@intel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/tun.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/tun.c
++++ b/drivers/net/tun.c
+@@ -1275,21 +1275,22 @@ static int tun_chr_open(struct inode *in
+ static int tun_chr_close(struct inode *inode, struct file *file)
+ {
+ struct tun_file *tfile = file->private_data;
+- struct tun_struct *tun = __tun_get(tfile);
++ struct tun_struct *tun;
+
+
++ rtnl_lock();
++ tun = __tun_get(tfile);
+ if (tun) {
+ DBG(KERN_INFO "%s: tun_chr_close\n", tun->dev->name);
+
+- rtnl_lock();
+ __tun_detach(tun);
+
+ /* If desireable, unregister the netdevice. */
+ if (!(tun->flags & TUN_PERSIST))
+ unregister_netdevice(tun->dev);
+
+- rtnl_unlock();
+ }
++ rtnl_unlock();
+
+ tun = tfile->tun;
+ if (tun)
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:24:19 2009
+Message-Id: <20090701002419.250025565@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:23:11 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Dave Jones <davej@redhat.com>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [patch 022/108] via-velocity: Fix velocity driver unmapping incorrect size.
+References: <20090701002249.937782934@mini.kroah.org>
+Content-Disposition: inline; filename=via-velocity-fix-velocity-driver-unmapping-incorrect-size.patch
+Content-Length: 901
+Lines: 27
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Dave Jones <davej@redhat.com>
+
+[ Upstream commit f6b24caaf933a466397915a08e30e885a32f905a ]
+
+When a packet is greater than ETH_ZLEN, we end up assigning the
+boolean result of a comparison to the size we unmap.
+
+Signed-off-by: Dave Jones <davej@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/via-velocity.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/via-velocity.c
++++ b/drivers/net/via-velocity.c
+@@ -1845,7 +1845,7 @@ static void velocity_free_tx_buf(struct
+ */
+ if (tdinfo->skb_dma) {
+
+- pktlen = (skb->len > ETH_ZLEN ? : ETH_ZLEN);
++ pktlen = max_t(unsigned int, skb->len, ETH_ZLEN);
+ for (i = 0; i < tdinfo->nskb_dma; i++) {
+ #ifdef VELOCITY_ZERO_COPY_SUPPORT
+ pci_unmap_single(vptr->pdev, tdinfo->skb_dma[i], le16_to_cpu(td->tdesc1.len), PCI_DMA_TODEVICE);
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:24:19 2009
+Message-Id: <20090701002419.672727891@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:23:12 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [patch 023/108] x25: Fix sleep from timer on socket destroy.
+References: <20090701002249.937782934@mini.kroah.org>
+Content-Disposition: inline; filename=x25-fix-sleep-from-timer-on-socket-destroy.patch
+Content-Length: 2651
+Lines: 98
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: David S. Miller <davem@davemloft.net>
+
+[ Upstream commit 14ebaf81e13ce66bff275380b246796fd16cbfa1 ]
+
+If socket destuction gets delayed to a timer, we try to
+lock_sock() from that timer which won't work.
+
+Use bh_lock_sock() in that case.
+
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Tested-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ include/net/x25.h | 2 +-
+ net/x25/af_x25.c | 23 ++++++++++++++++++-----
+ net/x25/x25_timer.c | 2 +-
+ 3 files changed, 20 insertions(+), 7 deletions(-)
+
+--- a/include/net/x25.h
++++ b/include/net/x25.h
+@@ -187,7 +187,7 @@ extern int x25_addr_ntoa(unsigned char
+ extern int x25_addr_aton(unsigned char *, struct x25_address *,
+ struct x25_address *);
+ extern struct sock *x25_find_socket(unsigned int, struct x25_neigh *);
+-extern void x25_destroy_socket(struct sock *);
++extern void x25_destroy_socket_from_timer(struct sock *);
+ extern int x25_rx_call_request(struct sk_buff *, struct x25_neigh *, unsigned int);
+ extern void x25_kill_by_neigh(struct x25_neigh *);
+
+--- a/net/x25/af_x25.c
++++ b/net/x25/af_x25.c
+@@ -332,14 +332,14 @@ static unsigned int x25_new_lci(struct x
+ /*
+ * Deferred destroy.
+ */
+-void x25_destroy_socket(struct sock *);
++static void __x25_destroy_socket(struct sock *);
+
+ /*
+ * handler for deferred kills.
+ */
+ static void x25_destroy_timer(unsigned long data)
+ {
+- x25_destroy_socket((struct sock *)data);
++ x25_destroy_socket_from_timer((struct sock *)data);
+ }
+
+ /*
+@@ -349,12 +349,10 @@ static void x25_destroy_timer(unsigned l
+ * will touch it and we are (fairly 8-) ) safe.
+ * Not static as it's used by the timer
+ */
+-void x25_destroy_socket(struct sock *sk)
++static void __x25_destroy_socket(struct sock *sk)
+ {
+ struct sk_buff *skb;
+
+- sock_hold(sk);
+- lock_sock(sk);
+ x25_stop_heartbeat(sk);
+ x25_stop_timer(sk);
+
+@@ -385,7 +383,22 @@ void x25_destroy_socket(struct sock *sk)
+ /* drop last reference so sock_put will free */
+ __sock_put(sk);
+ }
++}
+
++void x25_destroy_socket_from_timer(struct sock *sk)
++{
++ sock_hold(sk);
++ bh_lock_sock(sk);
++ __x25_destroy_socket(sk);
++ bh_unlock_sock(sk);
++ sock_put(sk);
++}
++
++static void x25_destroy_socket(struct sock *sk)
++{
++ sock_hold(sk);
++ lock_sock(sk);
++ __x25_destroy_socket(sk);
+ release_sock(sk);
+ sock_put(sk);
+ }
+--- a/net/x25/x25_timer.c
++++ b/net/x25/x25_timer.c
+@@ -113,7 +113,7 @@ static void x25_heartbeat_expiry(unsigne
+ (sk->sk_state == TCP_LISTEN &&
+ sock_flag(sk, SOCK_DEAD))) {
+ bh_unlock_sock(sk);
+- x25_destroy_socket(sk);
++ x25_destroy_socket_from_timer(sk);
+ return;
+ }
+ break;
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:24:20 2009
+Message-Id: <20090701002419.889885576@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:23:13 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Stephen Hemminger <shemminger@vyatta.com>,
+ Jay Vosburgh <fubar@us.ibm.com>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [patch 024/108] bonding: fix multiple module load problem
+References: <20090701002249.937782934@mini.kroah.org>
+Content-Disposition: inline; filename=bonding-fix-multiple-module-load-problem.patch
+Content-Length: 1185
+Lines: 37
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Stephen Hemminger <shemminger@vyatta.com>
+
+[ Upstream commit 130aa61a77b8518f1ea618e1b7d214d60b405f10 ]
+
+Some users still load bond module multiple times to create bonding
+devices. This accidentally was broken by a later patch about
+the time sysfs was fixed. According to Jay, it was broken
+by:
+ commit b8a9787eddb0e4665f31dd1d64584732b2b5d051
+ Author: Jay Vosburgh <fubar@us.ibm.com>
+ Date: Fri Jun 13 18:12:04 2008 -0700
+
+ bonding: Allow setting max_bonds to zero
+
+Note: sysfs and procfs still produce WARN() messages when this is done
+so the sysfs method is the recommended API.
+
+Signed-off-by: Stephen Hemminger <shemminger@vyatta.com>
+Signed-off-by: Jay Vosburgh <fubar@us.ibm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/bonding/bond_sysfs.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/bonding/bond_sysfs.c
++++ b/drivers/net/bonding/bond_sysfs.c
+@@ -1538,6 +1538,7 @@ int bond_create_sysfs(void)
+ printk(KERN_ERR
+ "network device named %s already exists in sysfs",
+ class_attr_bonding_masters.attr.name);
++ ret = 0;
+ }
+
+ return ret;
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:24:20 2009
+Message-Id: <20090701002420.141480274@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:23:14 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Joerg Roedel <joerg.roedel@amd.com>,
+ lethal@linux-sh.org,
+ just.for.lkml@googlemail.com,
+ hancockrwd@gmail.com,
+ jens.axboe@oracle.com,
+ bharrosh@panasas.com,
+ FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>,
+ Ingo Molnar <mingo@elte.hu>
+Subject: [patch 025/108] dma-debug: change hash_bucket_find from first-fit to best-fit
+References: <20090701002249.937782934@mini.kroah.org>
+Content-Disposition: inline; filename=dma-debug-change-hash_bucket_find-from-first-fit-to-best-fit.patch
+Content-Length: 2890
+Lines: 89
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Joerg Roedel <joerg.roedel@amd.com>
+
+commit 7caf6a49bb17d0377210693af5737563b31aa5ee upstream.
+
+Some device drivers map the same physical address multiple times to a
+dma address. Without an IOMMU this results in the same dma address being
+put into the dma-debug hash multiple times. With a first-fit match in
+hash_bucket_find() this function may return the wrong dma_debug_entry.
+
+This can result in false positive warnings. This patch fixes it by
+changing the first-fit behavior of hash_bucket_find() into a best-fit
+algorithm.
+
+Reported-by: Torsten Kaiser <just.for.lkml@googlemail.com>
+Reported-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
+Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
+Cc: lethal@linux-sh.org
+Cc: just.for.lkml@googlemail.com
+Cc: hancockrwd@gmail.com
+Cc: jens.axboe@oracle.com
+Cc: bharrosh@panasas.com
+Cc: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+LKML-Reference: <20090605104132.GE24836@amd.com>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ lib/dma-debug.c | 43 +++++++++++++++++++++++++++++++++++++++----
+ 1 file changed, 39 insertions(+), 4 deletions(-)
+
+--- a/lib/dma-debug.c
++++ b/lib/dma-debug.c
+@@ -185,15 +185,50 @@ static void put_hash_bucket(struct hash_
+ static struct dma_debug_entry *hash_bucket_find(struct hash_bucket *bucket,
+ struct dma_debug_entry *ref)
+ {
+- struct dma_debug_entry *entry;
++ struct dma_debug_entry *entry, *ret = NULL;
++ int matches = 0, match_lvl, last_lvl = 0;
+
+ list_for_each_entry(entry, &bucket->list, list) {
+- if ((entry->dev_addr == ref->dev_addr) &&
+- (entry->dev == ref->dev))
++ if ((entry->dev_addr != ref->dev_addr) ||
++ (entry->dev != ref->dev))
++ continue;
++
++ /*
++ * Some drivers map the same physical address multiple
++ * times. Without a hardware IOMMU this results in the
++ * same device addresses being put into the dma-debug
++ * hash multiple times too. This can result in false
++ * positives being reported. Therfore we implement a
++ * best-fit algorithm here which returns the entry from
++ * the hash which fits best to the reference value
++ * instead of the first-fit.
++ */
++ matches += 1;
++ match_lvl = 0;
++ entry->size == ref->size ? ++match_lvl : match_lvl;
++ entry->type == ref->type ? ++match_lvl : match_lvl;
++ entry->direction == ref->direction ? ++match_lvl : match_lvl;
++
++ if (match_lvl == 3) {
++ /* perfect-fit - return the result */
+ return entry;
++ } else if (match_lvl > last_lvl) {
++ /*
++ * We found an entry that fits better then the
++ * previous one
++ */
++ last_lvl = match_lvl;
++ ret = entry;
++ }
+ }
+
+- return NULL;
++ /*
++ * If we have multiple matches but no perfect-fit, just return
++ * NULL.
++ */
++ ret = (matches == 1) ? ret : NULL;
++
++ return ret;
+ }
+
+ /*
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:24:20 2009
+Message-Id: <20090701002420.426675306@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:23:15 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Dirk Eibach <eibach@gdsys.de>,
+ Jiri Slaby <jirislaby@gmail.com>
+Subject: [patch 026/108] char: moxa, prevent opening unavailable ports
+References: <20090701002249.937782934@mini.kroah.org>
+Content-Disposition: inline; filename=char-moxa-prevent-opening-unavailable-ports.patch
+Content-Length: 1431
+Lines: 47
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Dirk Eibach <eibach@gdsys.de>
+
+commit a90b037583d5f1ae3e54e9c687c79df82d1d34a4 upstream.
+
+In moxa.c there are 32 minor numbers reserved for each device. The number
+of ports actually available per device is stored in
+moxa_board_conf->numPorts. This number is not considered in moxa_open().
+Opening a port that is not available results in a kernel oops. This patch
+adds a test to moxa_open() that prevents opening unavailable ports.
+
+[akpm@linux-foundation.org: avoid multiple returns]
+Signed-off-by: Dirk Eibach <eibach@gdsys.de>
+Signed-off-by: Jiri Slaby <jirislaby@gmail.com>
+Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/char/moxa.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/drivers/char/moxa.c
++++ b/drivers/char/moxa.c
+@@ -1184,6 +1184,11 @@ static int moxa_open(struct tty_struct *
+ return -ENODEV;
+ }
+
++ if (port % MAX_PORTS_PER_BOARD >= brd->numPorts) {
++ retval = -ENODEV;
++ goto out_unlock;
++ }
++
+ ch = &brd->ports[port % MAX_PORTS_PER_BOARD];
+ ch->port.count++;
+ tty->driver_data = ch;
+@@ -1208,8 +1213,8 @@ static int moxa_open(struct tty_struct *
+ moxa_close_port(tty);
+ } else
+ ch->port.flags |= ASYNC_NORMAL_ACTIVE;
++out_unlock:
+ mutex_unlock(&moxa_openlock);
+-
+ return retval;
+ }
+
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:24:20 2009
+Message-Id: <20090701002420.652198255@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:23:16 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jiri Slaby <jirislaby@gmail.com>,
+ Alan Cox <alan@linux.intel.com>
+Subject: [patch 027/108] serial: refactor ASYNC_ flags
+References: <20090701002249.937782934@mini.kroah.org>
+Content-Disposition: inline; filename=serial-refactor-async_-flags.patch
+Content-Length: 7376
+Lines: 162
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Jiri Slaby <jirislaby@gmail.com>
+
+commit 70beaed22cbe12979e55d99b370e147e2e168562 upstream.
+
+Define ASYNCB_* flags which are bit numbers of the ASYNC_* flags.
+This is useful for {test,set,clear}_bit.
+
+Also convert each ASYNC_% to be (1 << ASYNCB_%) and define masks
+with the macros, not constants.
+
+Tested with:
+#include "PATH_TO_KERNEL/include/linux/serial.h"
+static struct {
+ unsigned int new, old;
+} as[] = {
+ { ASYNC_HUP_NOTIFY, 0x0001 },
+ { ASYNC_FOURPORT, 0x0002 },
+...
+ { ASYNC_BOOT_ONLYMCA, 0x00400000 },
+ { ASYNC_INTERNAL_FLAGS, 0xFFC00000 }
+};
+...
+ for (a = 0; a < ARRAY_SIZE(as); a++)
+ if (as[a].old != as[a].new)
+ printf("%.8x != %.8x\n", as[a].old, as[a].new);
+
+Signed-off-by: Jiri Slaby <jirislaby@gmail.com>
+Signed-off-by: Alan Cox <alan@linux.intel.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ include/linux/serial.h | 116 +++++++++++++++++++++++++++++--------------------
+ 1 file changed, 69 insertions(+), 47 deletions(-)
+
+--- a/include/linux/serial.h
++++ b/include/linux/serial.h
+@@ -96,54 +96,76 @@ struct serial_uart_config {
+
+ /*
+ * Definitions for async_struct (and serial_struct) flags field
++ *
++ * Define ASYNCB_* for convenient use with {test,set,clear}_bit.
+ */
+-#define ASYNC_HUP_NOTIFY 0x0001 /* Notify getty on hangups and closes
+- on the callout port */
+-#define ASYNC_FOURPORT 0x0002 /* Set OU1, OUT2 per AST Fourport settings */
+-#define ASYNC_SAK 0x0004 /* Secure Attention Key (Orange book) */
+-#define ASYNC_SPLIT_TERMIOS 0x0008 /* Separate termios for dialin/callout */
+-
+-#define ASYNC_SPD_MASK 0x1030
+-#define ASYNC_SPD_HI 0x0010 /* Use 56000 instead of 38400 bps */
+-
+-#define ASYNC_SPD_VHI 0x0020 /* Use 115200 instead of 38400 bps */
+-#define ASYNC_SPD_CUST 0x0030 /* Use user-specified divisor */
+-
+-#define ASYNC_SKIP_TEST 0x0040 /* Skip UART test during autoconfiguration */
+-#define ASYNC_AUTO_IRQ 0x0080 /* Do automatic IRQ during autoconfiguration */
+-#define ASYNC_SESSION_LOCKOUT 0x0100 /* Lock out cua opens based on session */
+-#define ASYNC_PGRP_LOCKOUT 0x0200 /* Lock out cua opens based on pgrp */
+-#define ASYNC_CALLOUT_NOHUP 0x0400 /* Don't do hangups for cua device */
+-
+-#define ASYNC_HARDPPS_CD 0x0800 /* Call hardpps when CD goes high */
+-
+-#define ASYNC_SPD_SHI 0x1000 /* Use 230400 instead of 38400 bps */
+-#define ASYNC_SPD_WARP 0x1010 /* Use 460800 instead of 38400 bps */
+-
+-#define ASYNC_LOW_LATENCY 0x2000 /* Request low latency behaviour */
+-
+-#define ASYNC_BUGGY_UART 0x4000 /* This is a buggy UART, skip some safety
+- * checks. Note: can be dangerous! */
+-
+-#define ASYNC_AUTOPROBE 0x8000 /* Port was autoprobed by PCI or PNP code */
+-
+-#define ASYNC_FLAGS 0x7FFF /* Possible legal async flags */
+-#define ASYNC_USR_MASK 0x3430 /* Legal flags that non-privileged
+- * users can set or reset */
+-
+-/* Internal flags used only by kernel/chr_drv/serial.c */
+-#define ASYNC_INITIALIZED 0x80000000 /* Serial port was initialized */
+-#define ASYNC_NORMAL_ACTIVE 0x20000000 /* Normal device is active */
+-#define ASYNC_BOOT_AUTOCONF 0x10000000 /* Autoconfigure port on bootup */
+-#define ASYNC_CLOSING 0x08000000 /* Serial port is closing */
+-#define ASYNC_CTS_FLOW 0x04000000 /* Do CTS flow control */
+-#define ASYNC_CHECK_CD 0x02000000 /* i.e., CLOCAL */
+-#define ASYNC_SHARE_IRQ 0x01000000 /* for multifunction cards
+- --- no longer used */
+-#define ASYNC_CONS_FLOW 0x00800000 /* flow control for console */
+-
+-#define ASYNC_BOOT_ONLYMCA 0x00400000 /* Probe only if MCA bus */
+-#define ASYNC_INTERNAL_FLAGS 0xFFC00000 /* Internal flags */
++#define ASYNCB_HUP_NOTIFY 0 /* Notify getty on hangups and closes
++ * on the callout port */
++#define ASYNCB_FOURPORT 1 /* Set OU1, OUT2 per AST Fourport settings */
++#define ASYNCB_SAK 2 /* Secure Attention Key (Orange book) */
++#define ASYNCB_SPLIT_TERMIOS 3 /* Separate termios for dialin/callout */
++#define ASYNCB_SPD_HI 4 /* Use 56000 instead of 38400 bps */
++#define ASYNCB_SPD_VHI 5 /* Use 115200 instead of 38400 bps */
++#define ASYNCB_SKIP_TEST 6 /* Skip UART test during autoconfiguration */
++#define ASYNCB_AUTO_IRQ 7 /* Do automatic IRQ during
++ * autoconfiguration */
++#define ASYNCB_SESSION_LOCKOUT 8 /* Lock out cua opens based on session */
++#define ASYNCB_PGRP_LOCKOUT 9 /* Lock out cua opens based on pgrp */
++#define ASYNCB_CALLOUT_NOHUP 10 /* Don't do hangups for cua device */
++#define ASYNCB_HARDPPS_CD 11 /* Call hardpps when CD goes high */
++#define ASYNCB_SPD_SHI 12 /* Use 230400 instead of 38400 bps */
++#define ASYNCB_LOW_LATENCY 13 /* Request low latency behaviour */
++#define ASYNCB_BUGGY_UART 14 /* This is a buggy UART, skip some safety
++ * checks. Note: can be dangerous! */
++#define ASYNCB_AUTOPROBE 15 /* Port was autoprobed by PCI or PNP code */
++#define ASYNCB_LAST_USER 15
++
++/* Internal flags used only by kernel */
++#define ASYNCB_INITIALIZED 31 /* Serial port was initialized */
++#define ASYNCB_NORMAL_ACTIVE 29 /* Normal device is active */
++#define ASYNCB_BOOT_AUTOCONF 28 /* Autoconfigure port on bootup */
++#define ASYNCB_CLOSING 27 /* Serial port is closing */
++#define ASYNCB_CTS_FLOW 26 /* Do CTS flow control */
++#define ASYNCB_CHECK_CD 25 /* i.e., CLOCAL */
++#define ASYNCB_SHARE_IRQ 24 /* for multifunction cards, no longer used */
++#define ASYNCB_CONS_FLOW 23 /* flow control for console */
++#define ASYNCB_BOOT_ONLYMCA 22 /* Probe only if MCA bus */
++#define ASYNCB_FIRST_KERNEL 22
++
++#define ASYNC_HUP_NOTIFY (1U << ASYNCB_HUP_NOTIFY)
++#define ASYNC_FOURPORT (1U << ASYNCB_FOURPORT)
++#define ASYNC_SAK (1U << ASYNCB_SAK)
++#define ASYNC_SPLIT_TERMIOS (1U << ASYNCB_SPLIT_TERMIOS)
++#define ASYNC_SPD_HI (1U << ASYNCB_SPD_HI)
++#define ASYNC_SPD_VHI (1U << ASYNCB_SPD_VHI)
++#define ASYNC_SKIP_TEST (1U << ASYNCB_SKIP_TEST)
++#define ASYNC_AUTO_IRQ (1U << ASYNCB_AUTO_IRQ)
++#define ASYNC_SESSION_LOCKOUT (1U << ASYNCB_SESSION_LOCKOUT)
++#define ASYNC_PGRP_LOCKOUT (1U << ASYNCB_PGRP_LOCKOUT)
++#define ASYNC_CALLOUT_NOHUP (1U << ASYNCB_CALLOUT_NOHUP)
++#define ASYNC_HARDPPS_CD (1U << ASYNCB_HARDPPS_CD)
++#define ASYNC_SPD_SHI (1U << ASYNCB_SPD_SHI)
++#define ASYNC_LOW_LATENCY (1U << ASYNCB_LOW_LATENCY)
++#define ASYNC_BUGGY_UART (1U << ASYNCB_BUGGY_UART)
++#define ASYNC_AUTOPROBE (1U << ASYNCB_AUTOPROBE)
++
++#define ASYNC_FLAGS ((1U << ASYNCB_LAST_USER) - 1)
++#define ASYNC_USR_MASK (ASYNC_SPD_HI|ASYNC_SPD_VHI| \
++ ASYNC_CALLOUT_NOHUP|ASYNC_SPD_SHI|ASYNC_LOW_LATENCY)
++#define ASYNC_SPD_CUST (ASYNC_SPD_HI|ASYNC_SPD_VHI)
++#define ASYNC_SPD_WARP (ASYNC_SPD_HI|ASYNC_SPD_SHI)
++#define ASYNC_SPD_MASK (ASYNC_SPD_HI|ASYNC_SPD_VHI|ASYNC_SPD_SHI)
++
++#define ASYNC_INITIALIZED (1U << ASYNCB_INITIALIZED)
++#define ASYNC_NORMAL_ACTIVE (1U << ASYNCB_NORMAL_ACTIVE)
++#define ASYNC_BOOT_AUTOCONF (1U << ASYNCB_BOOT_AUTOCONF)
++#define ASYNC_CLOSING (1U << ASYNCB_CLOSING)
++#define ASYNC_CTS_FLOW (1U << ASYNCB_CTS_FLOW)
++#define ASYNC_CHECK_CD (1U << ASYNCB_CHECK_CD)
++#define ASYNC_SHARE_IRQ (1U << ASYNCB_SHARE_IRQ)
++#define ASYNC_CONS_FLOW (1U << ASYNCB_CONS_FLOW)
++#define ASYNC_BOOT_ONLYMCA (1U << ASYNCB_BOOT_ONLYMCA)
++#define ASYNC_INTERNAL_FLAGS (~((1U << ASYNCB_FIRST_KERNEL) - 1))
+
+ /*
+ * Multiport serial configuration structure --- external structure
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:24:21 2009
+Message-Id: <20090701002421.050263995@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:23:17 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jiri Slaby <jirislaby@gmail.com>,
+ Alan Cox <alan@linux.intel.com>
+Subject: [patch 028/108] rocket: fix test_bit parameters
+References: <20090701002249.937782934@mini.kroah.org>
+Content-Disposition: inline; filename=rocket-fix-test_bit-parameters.patch
+Content-Length: 1497
+Lines: 46
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Jiri Slaby <jirislaby@gmail.com>
+
+commit a391ad0f09014856bbc4eeea309593eba977b3b0 upstream.
+
+Switch from ASYNC_* to ASYNCB_*, because {test,set}_bit expect
+bit number, not mask.
+
+Signed-off-by: Jiri Slaby <jirislaby@gmail.com>
+Signed-off-by: Alan Cox <alan@linux.intel.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/char/rocket.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/char/rocket.c
++++ b/drivers/char/rocket.c
+@@ -934,7 +934,7 @@ static int rp_open(struct tty_struct *tt
+ /*
+ * Info->count is now 1; so it's safe to sleep now.
+ */
+- if (!test_bit(ASYNC_INITIALIZED, &port->flags)) {
++ if (!test_bit(ASYNCB_INITIALIZED, &port->flags)) {
+ cp = &info->channel;
+ sSetRxTrigger(cp, TRIG_1);
+ if (sGetChanStatus(cp) & CD_ACT)
+@@ -958,7 +958,7 @@ static int rp_open(struct tty_struct *tt
+ sEnRxFIFO(cp);
+ sEnTransmit(cp);
+
+- set_bit(ASYNC_INITIALIZED, &info->port.flags);
++ set_bit(ASYNCB_INITIALIZED, &info->port.flags);
+
+ /*
+ * Set up the tty->alt_speed kludge
+@@ -1641,7 +1641,7 @@ static int rp_write(struct tty_struct *t
+ /* Write remaining data into the port's xmit_buf */
+ while (1) {
+ /* Hung up ? */
+- if (!test_bit(ASYNC_NORMAL_ACTIVE, &info->port.flags))
++ if (!test_bit(ASYNCB_NORMAL_ACTIVE, &info->port.flags))
+ goto end;
+ c = min(count, XMIT_BUF_SIZE - info->xmit_cnt - 1);
+ c = min(c, XMIT_BUF_SIZE - info->xmit_head);
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:24:21 2009
+Message-Id: <20090701002421.479018764@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:23:18 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jiri Slaby <jirislaby@gmail.com>,
+ Alan Cox <alan@linux.intel.com>
+Subject: [patch 029/108] epca: fix test_bit parameters
+References: <20090701002249.937782934@mini.kroah.org>
+Content-Disposition: inline; filename=epca-fix-test_bit-parameters.patch
+Content-Length: 1711
+Lines: 50
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Jiri Slaby <jirislaby@gmail.com>
+
+commit c3301a5c04800bcf8afc8a815bf9e570a4e25a08 upstream.
+
+Switch from ASYNC_* to ASYNCB_*, because test_bit expects
+bit number, not mask.
+
+Signed-off-by: Jiri Slaby <jirislaby@gmail.com>
+Signed-off-by: Alan Cox <alan@linux.intel.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/char/epca.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+--- a/drivers/char/epca.c
++++ b/drivers/char/epca.c
+@@ -1518,7 +1518,7 @@ static void doevent(int crd)
+ if (event & MODEMCHG_IND) {
+ /* A modem signal change has been indicated */
+ ch->imodem = mstat;
+- if (test_bit(ASYNC_CHECK_CD, &ch->port.flags)) {
++ if (test_bit(ASYNCB_CHECK_CD, &ch->port.flags)) {
+ /* We are now receiving dcd */
+ if (mstat & ch->dcd)
+ wake_up_interruptible(&ch->port.open_wait);
+@@ -1765,9 +1765,9 @@ static void epcaparam(struct tty_struct
+ * that the driver will wait on carrier detect.
+ */
+ if (ts->c_cflag & CLOCAL)
+- clear_bit(ASYNC_CHECK_CD, &ch->port.flags);
++ clear_bit(ASYNCB_CHECK_CD, &ch->port.flags);
+ else
+- set_bit(ASYNC_CHECK_CD, &ch->port.flags);
++ set_bit(ASYNCB_CHECK_CD, &ch->port.flags);
+ mval = ch->m_dtr | ch->m_rts;
+ } /* End CBAUD not detected */
+ iflag = termios2digi_i(ch, ts->c_iflag);
+@@ -2244,7 +2244,8 @@ static void do_softint(struct work_struc
+ if (test_and_clear_bit(EPCA_EVENT_HANGUP, &ch->event)) {
+ tty_hangup(tty);
+ wake_up_interruptible(&ch->port.open_wait);
+- clear_bit(ASYNC_NORMAL_ACTIVE, &ch->port.flags);
++ clear_bit(ASYNCB_NORMAL_ACTIVE,
++ &ch->port.flags);
+ }
+ }
+ tty_kref_put(tty);
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:24:22 2009
+Message-Id: <20090701002421.984876144@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:23:19 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Andreas Herrmann <andreas.herrmann3@amd.com>,
+ Ingo Molnar <mingo@elte.hu>
+Subject: [patch 030/108] x86: Detect use of extended APIC ID for AMD CPUs
+References: <20090701002249.937782934@mini.kroah.org>
+Content-Disposition: inline; filename=x86-detect-use-of-extended-apic-id-for-amd-cpus.patch
+Content-Length: 3253
+Lines: 96
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Andreas Herrmann <andreas.herrmann3@amd.com>
+
+commit 42937e81a82b6bbc51a309c83da140b3a7ca5945 upstream.
+
+Booting a 32-bit kernel on Magny-Cours results in the following panic:
+
+ ...
+ Using APIC driver default
+ ...
+ Overriding APIC driver with bigsmp
+ ...
+ Getting VERSION: 80050010
+ Getting VERSION: 80050010
+ Getting ID: 10000000
+ Getting ID: ef000000
+ Getting LVT0: 700
+ Getting LVT1: 10000
+ Kernel panic - not syncing: Boot APIC ID in local APIC unexpected (16 vs 0)
+ Pid: 1, comm: swapper Not tainted 2.6.30-rcX #2
+ Call Trace:
+ [<c05194da>] ? panic+0x38/0xd3
+ [<c0743102>] ? native_smp_prepare_cpus+0x259/0x31f
+ [<c073b19d>] ? kernel_init+0x3e/0x141
+ [<c073b15f>] ? kernel_init+0x0/0x141
+ [<c020325f>] ? kernel_thread_helper+0x7/0x10
+
+The reason is that default_get_apic_id handled extension of local APIC
+ID field just in case of XAPIC.
+
+Thus for this AMD CPU, default_get_apic_id() returns 0 and
+bigsmp_get_apic_id() returns 16 which leads to the respective kernel
+panic.
+
+This patch introduces a Linux specific feature flag to indicate
+support for extended APIC id (8 bits instead of 4 bits width) and sets
+the flag on AMD CPUs if applicable.
+
+Signed-off-by: Andreas Herrmann <andreas.herrmann3@amd.com>
+LKML-Reference: <20090608135509.GA12431@alberich.amd.com>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/include/asm/apic.h | 2 +-
+ arch/x86/include/asm/cpufeature.h | 1 +
+ arch/x86/kernel/cpu/amd.c | 10 ++++++++++
+ 3 files changed, 12 insertions(+), 1 deletion(-)
+
+--- a/arch/x86/include/asm/apic.h
++++ b/arch/x86/include/asm/apic.h
+@@ -410,7 +410,7 @@ static inline unsigned default_get_apic_
+ {
+ unsigned int ver = GET_APIC_VERSION(apic_read(APIC_LVR));
+
+- if (APIC_XAPIC(ver))
++ if (APIC_XAPIC(ver) || boot_cpu_has(X86_FEATURE_EXTD_APICID))
+ return (x >> 24) & 0xFF;
+ else
+ return (x >> 24) & 0x0F;
+--- a/arch/x86/include/asm/cpufeature.h
++++ b/arch/x86/include/asm/cpufeature.h
+@@ -94,6 +94,7 @@
+ #define X86_FEATURE_TSC_RELIABLE (3*32+23) /* TSC is known to be reliable */
+ #define X86_FEATURE_NONSTOP_TSC (3*32+24) /* TSC does not stop in C states */
+ #define X86_FEATURE_CLFLUSH_MONITOR (3*32+25) /* "" clflush reqd with monitor */
++#define X86_FEATURE_EXTD_APICID (3*32+26) /* has extended APICID (8 bits) */
+
+ /* Intel-defined CPU features, CPUID level 0x00000001 (ecx), word 4 */
+ #define X86_FEATURE_XMM3 (4*32+ 0) /* "pni" SSE-3 */
+--- a/arch/x86/kernel/cpu/amd.c
++++ b/arch/x86/kernel/cpu/amd.c
+@@ -6,6 +6,7 @@
+ #include <asm/processor.h>
+ #include <asm/apic.h>
+ #include <asm/cpu.h>
++#include <asm/pci-direct.h>
+
+ #ifdef CONFIG_X86_64
+ # include <asm/numa_64.h>
+@@ -351,6 +352,15 @@ static void __cpuinit early_init_amd(str
+ (c->x86_model == 8 && c->x86_mask >= 8))
+ set_cpu_cap(c, X86_FEATURE_K6_MTRR);
+ #endif
++#if defined(CONFIG_X86_LOCAL_APIC) && defined(CONFIG_PCI)
++ /* check CPU config space for extended APIC ID */
++ if (c->x86 >= 0xf) {
++ unsigned int val;
++ val = read_pci_config(0, 24, 0, 0x68);
++ if ((val & ((1 << 17) | (1 << 18))) == ((1 << 17) | (1 << 18)))
++ set_cpu_cap(c, X86_FEATURE_EXTD_APICID);
++ }
++#endif
+ }
+
+ static void __cpuinit init_amd(struct cpuinfo_x86 *c)
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:24:22 2009
+Message-Id: <20090701002422.510267149@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:23:20 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk
+Subject: [patch 031/108] USB: usbtmc: fix switch statment
+References: <20090701002249.937782934@mini.kroah.org>
+Content-Disposition: inline; filename=usb-usbtmc-fix-switch-statment.patch
+Content-Length: 1244
+Lines: 49
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Greg Kroah-Hartman <gregkh@suse.de>
+
+commit a92b63e7e4c185b4dd9e87762e2cb716e54482d0 upstream.
+
+Steve Holland pointed out that we forgot to call break; in the switch
+statment. This probably resolves a lot of the bug reports I've gotten
+for the driver lately.
+
+Stupid me...
+
+Reported-by: Steve Holland <sdh4@iastate.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/class/usbtmc.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/usb/class/usbtmc.c
++++ b/drivers/usb/class/usbtmc.c
+@@ -927,21 +927,27 @@ static long usbtmc_ioctl(struct file *fi
+ switch (cmd) {
+ case USBTMC_IOCTL_CLEAR_OUT_HALT:
+ retval = usbtmc_ioctl_clear_out_halt(data);
++ break;
+
+ case USBTMC_IOCTL_CLEAR_IN_HALT:
+ retval = usbtmc_ioctl_clear_in_halt(data);
++ break;
+
+ case USBTMC_IOCTL_INDICATOR_PULSE:
+ retval = usbtmc_ioctl_indicator_pulse(data);
++ break;
+
+ case USBTMC_IOCTL_CLEAR:
+ retval = usbtmc_ioctl_clear(data);
++ break;
+
+ case USBTMC_IOCTL_ABORT_BULK_OUT:
+ retval = usbtmc_ioctl_abort_bulk_out(data);
++ break;
+
+ case USBTMC_IOCTL_ABORT_BULK_IN:
+ retval = usbtmc_ioctl_abort_bulk_in(data);
++ break;
+ }
+
+ mutex_unlock(&data->io_mutex);
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:24:23 2009
+Message-Id: <20090701002422.816483097@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:23:21 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Michael Krufky <mkrufky@kernellabs.com>,
+ Mauro Carvalho Chehab <mchehab@redhat.com>
+Subject: [patch 032/108] DVB: lgdt3305: fix 64bit division in function lgdt3305_set_if
+References: <20090701002249.937782934@mini.kroah.org>
+Content-Disposition: inline; filename=dvb-lgdt3305-fix-64bit-division-in-function-lgdt3305_set_if.patch
+Content-Length: 1274
+Lines: 53
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Michael Krufky <mkrufky@kernellabs.com>
+
+(cherry picked from commit 511da457340d3b30336f7a6731bad9bbe3ffaf08)
+
+Signed-off-by: Michael Krufky <mkrufky@kernellabs.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/media/dvb/frontends/lgdt3305.c | 17 +++--------------
+ 1 file changed, 3 insertions(+), 14 deletions(-)
+
+--- a/drivers/media/dvb/frontends/lgdt3305.c
++++ b/drivers/media/dvb/frontends/lgdt3305.c
+@@ -19,6 +19,7 @@
+ *
+ */
+
++#include <asm/div64.h>
+ #include <linux/dvb/frontend.h>
+ #include "dvb_math.h"
+ #include "lgdt3305.h"
+@@ -496,27 +497,15 @@ static int lgdt3305_set_if(struct lgdt33
+
+ nco = if_freq_khz / 10;
+
+-#define LGDT3305_64BIT_DIVISION_ENABLED 0
+- /* FIXME: 64bit division disabled to avoid linking error:
+- * WARNING: "__udivdi3" [lgdt3305.ko] undefined!
+- */
+ switch (param->u.vsb.modulation) {
+ case VSB_8:
+-#if LGDT3305_64BIT_DIVISION_ENABLED
+ nco <<= 24;
+- nco /= 625;
+-#else
+- nco *= ((1 << 24) / 625);
+-#endif
++ do_div(nco, 625);
+ break;
+ case QAM_64:
+ case QAM_256:
+-#if LGDT3305_64BIT_DIVISION_ENABLED
+ nco <<= 28;
+- nco /= 625;
+-#else
+- nco *= ((1 << 28) / 625);
+-#endif
++ do_div(nco, 625);
+ break;
+ default:
+ return -EINVAL;
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:24:23 2009
+Message-Id: <20090701002423.303460286@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:23:22 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Hans Verkuil <hverkuil@xs4all.nl>,
+ Mauro Carvalho Chehab <mchehab@redhat.com>,
+ Michael Krufky <mkrufky@linuxtv.org>
+Subject: [patch 033/108] V4L: ivtv/cx18: fix regression: class controls are no longer seen
+References: <20090701002249.937782934@mini.kroah.org>
+Content-Disposition: inline; filename=v4l-ivtv-cx18-fix-regression-class-controls-are-no-longer-seen.patch
+Content-Length: 1917
+Lines: 56
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Hans Verkuil <hverkuil@xs4all.nl>
+
+(cherry picked from commit c6711c3e6d4976716633047c0f6bbd953d6831fb)
+
+A previous change (v4l2-common: remove v4l2_ctrl_query_fill_std) broke
+the handling of class controls in VIDIOC_QUERYCTRL. The MPEG class control
+was broken for all drivers that use the cx2341x module and the USER class
+control was broken for ivtv and cx18.
+
+This change adds back proper class control support.
+
+Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/media/video/cx18/cx18-controls.c | 2 ++
+ drivers/media/video/cx2341x.c | 2 ++
+ drivers/media/video/ivtv/ivtv-controls.c | 2 ++
+ 3 files changed, 6 insertions(+)
+
+--- a/drivers/media/video/cx18/cx18-controls.c
++++ b/drivers/media/video/cx18/cx18-controls.c
+@@ -61,6 +61,8 @@ int cx18_queryctrl(struct file *file, vo
+
+ switch (qctrl->id) {
+ /* Standard V4L2 controls */
++ case V4L2_CID_USER_CLASS:
++ return v4l2_ctrl_query_fill(qctrl, 0, 0, 0, 0);
+ case V4L2_CID_BRIGHTNESS:
+ case V4L2_CID_HUE:
+ case V4L2_CID_SATURATION:
+--- a/drivers/media/video/cx2341x.c
++++ b/drivers/media/video/cx2341x.c
+@@ -500,6 +500,8 @@ int cx2341x_ctrl_query(const struct cx23
+ int err;
+
+ switch (qctrl->id) {
++ case V4L2_CID_MPEG_CLASS:
++ return v4l2_ctrl_query_fill(qctrl, 0, 0, 0, 0);
+ case V4L2_CID_MPEG_STREAM_TYPE:
+ return v4l2_ctrl_query_fill(qctrl,
+ V4L2_MPEG_STREAM_TYPE_MPEG2_PS,
+--- a/drivers/media/video/ivtv/ivtv-controls.c
++++ b/drivers/media/video/ivtv/ivtv-controls.c
+@@ -60,6 +60,8 @@ int ivtv_queryctrl(struct file *file, vo
+
+ switch (qctrl->id) {
+ /* Standard V4L2 controls */
++ case V4L2_CID_USER_CLASS:
++ return v4l2_ctrl_query_fill(qctrl, 0, 0, 0, 0);
+ case V4L2_CID_BRIGHTNESS:
+ case V4L2_CID_HUE:
+ case V4L2_CID_SATURATION:
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:24:23 2009
+Message-Id: <20090701002423.713660817@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:23:23 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Mike Isely <isely@pobox.com>,
+ Mauro Carvalho Chehab <mchehab@redhat.com>,
+ Michael Krufky <mkrufky@linuxtv.org>
+Subject: [patch 034/108] V4L: pvrusb2: Fix hardware scaling when used with cx25840
+References: <20090701002249.937782934@mini.kroah.org>
+Content-Disposition: inline; filename=v4l-pvrusb2-fix-hardware-scaling-when-used-with-cx25840.patch
+Content-Length: 5165
+Lines: 131
+
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Mike Isely <isely@pobox.com>
+
+(cherry picked from commit e17d787c513f41f59969247062561fff6340f211)
+
+The cx25840 module requires that its VBI initialization entry point be
+called in order for hardware-scaled video capture to work properly -
+even if we don't care about VBI. Making this behavior even more
+subtle is that if the capture resolution is set to 720x480 - which is
+the default that the pvrusb2 driver sets up - then the cx25840
+bypasses the hardware scaler. Therefore this problem does not
+manifest itself until some other resolution, e.g. 640x480, is tried.
+MythTV typically defaults to 640x480 or 480x480, which means that
+things break whenever the driver is used with MythTV.
+
+This all has been known for a while (since at least Nov 2006), but
+recent changes in the pvrusb2 driver (specifically in regards to
+sub-device support) caused this to break again. VBI initialization
+must happen *after* the chip's firmware is loaded, not before. With
+this fix, 24xxx devices work correctly again.
+
+A related fix that is part of this changeset is that now we
+re-initialize VBI any time after we issue a reset to the cx25840
+driver. Issuing a chip reset erases the state that the VBI setup
+previously did. Until the HVR-1950 came along this subtlety went
+unnoticed, because the pvrusb2 driver previously never issued such a
+reset. But with the HVR-1950 we have to do that reset in order to
+correctly transition from digital back to analog mode - and since the
+HVR-1950 always starts in digital mode (required for the DVB side to
+initialize correctly) then this device has never had a chance to work
+correctly in analog mode! Analog capture on the HVR-1950 has been
+broken this *ENTIRE* time. I had missed it until now because I've
+usually been testing at the default 720x480 resolution which does not
+require scaling... What fun. By re-initializing VBI after a cx25840
+chip reset, correct behavior is restored.
+
+Signed-off-by: Mike Isely <isely@pobox.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/media/video/pvrusb2/pvrusb2-hdw.c | 55 ++++++++++++++++--------------
+ 1 file changed, 31 insertions(+), 24 deletions(-)
+
+--- a/drivers/media/video/pvrusb2/pvrusb2-hdw.c
++++ b/drivers/media/video/pvrusb2/pvrusb2-hdw.c
+@@ -1978,6 +1978,34 @@ static unsigned int pvr2_copy_i2c_addr_l
+ }
+
+
++static void pvr2_hdw_cx25840_vbi_hack(struct pvr2_hdw *hdw)
++{
++ /*
++ Mike Isely <isely@pobox.com> 19-Nov-2006 - This bit of nuttiness
++ for cx25840 causes that module to correctly set up its video
++ scaling. This is really a problem in the cx25840 module itself,
++ but we work around it here. The problem has not been seen in
++ ivtv because there VBI is supported and set up. We don't do VBI
++ here (at least not yet) and thus we never attempted to even set
++ it up.
++ */
++ struct v4l2_format fmt;
++ if (hdw->decoder_client_id != PVR2_CLIENT_ID_CX25840) {
++ /* We're not using a cx25840 so don't enable the hack */
++ return;
++ }
++
++ pvr2_trace(PVR2_TRACE_INIT,
++ "Module ID %u:"
++ " Executing cx25840 VBI hack",
++ hdw->decoder_client_id);
++ memset(&fmt, 0, sizeof(fmt));
++ fmt.type = V4L2_BUF_TYPE_SLICED_VBI_CAPTURE;
++ v4l2_device_call_all(&hdw->v4l2_dev, hdw->decoder_client_id,
++ video, s_fmt, &fmt);
++}
++
++
+ static int pvr2_hdw_load_subdev(struct pvr2_hdw *hdw,
+ const struct pvr2_device_client_desc *cd)
+ {
+@@ -2069,30 +2097,6 @@ static int pvr2_hdw_load_subdev(struct p
+ /* client-specific setup... */
+ switch (mid) {
+ case PVR2_CLIENT_ID_CX25840:
+- hdw->decoder_client_id = mid;
+- {
+- /*
+- Mike Isely <isely@pobox.com> 19-Nov-2006 - This
+- bit of nuttiness for cx25840 causes that module
+- to correctly set up its video scaling. This is
+- really a problem in the cx25840 module itself,
+- but we work around it here. The problem has not
+- been seen in ivtv because there VBI is supported
+- and set up. We don't do VBI here (at least not
+- yet) and thus we never attempted to even set it
+- up.
+- */
+- struct v4l2_format fmt;
+- pvr2_trace(PVR2_TRACE_INIT,
+- "Module ID %u:"
+- " Executing cx25840 VBI hack",
+- mid);
+- memset(&fmt, 0, sizeof(fmt));
+- fmt.type = V4L2_BUF_TYPE_SLICED_VBI_CAPTURE;
+- v4l2_device_call_all(&hdw->v4l2_dev, mid,
+- video, s_fmt, &fmt);
+- }
+- break;
+ case PVR2_CLIENT_ID_SAA7115:
+ hdw->decoder_client_id = mid;
+ break;
+@@ -2193,6 +2197,8 @@ static void pvr2_hdw_setup_low(struct pv
+ cptr->info->set_value(cptr,~0,cptr->info->default_value);
+ }
+
++ pvr2_hdw_cx25840_vbi_hack(hdw);
++
+ /* Set up special default values for the television and radio
+ frequencies here. It's not really important what these defaults
+ are, but I set them to something usable in the Chicago area just
+@@ -4066,6 +4072,7 @@ int pvr2_hdw_cmd_decoder_reset(struct pv
+ if (hdw->decoder_client_id) {
+ v4l2_device_call_all(&hdw->v4l2_dev, hdw->decoder_client_id,
+ core, reset, 0);
++ pvr2_hdw_cx25840_vbi_hack(hdw);
+ return 0;
+ }
+ pvr2_trace(PVR2_TRACE_INIT,
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:24:24 2009
+Message-Id: <20090701002424.089082409@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:23:24 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Mike Isely <isely@pobox.com>,
+ Mauro Carvalho Chehab <mchehab@redhat.com>,
+ Michael Krufky <mkrufky@linuxtv.org>
+Subject: [patch 035/108] V4L: pvrusb2: Re-fix hardware scaling on video standard change
+References: <20090701002249.937782934@mini.kroah.org>
+Content-Disposition: inline; filename=v4l-pvrusb2-re-fix-hardware-scaling-on-video-standard-change.patch
+Content-Length: 1499
+Lines: 39
+
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Mike Isely <isely@pobox.com>
+
+(cherry picked from commit a6862da2f3c7ce3ec6644958bc8937b630b9e2c1)
+
+The cx25840 module's VBI initialization logic uses the current video
+standard as part of its internal algorithm. This therefore means that
+we probably need to make sure that the correct video standard has been
+set before initializing VBI. (Normally we would not care about VBI,
+but as described in an earlier changeset, VBI must be initialized
+correctly on the cx25840 in order for the chip's hardware scaler to
+operate correctly.)
+
+It's kind of messy to force the video standard to be set before
+initializing VBI (mainly because we can't know what the app really
+wants that early in the initialization process). So this patch does
+the next best thing: VBI is re-initialized after any point where the
+video standard has been set.
+
+Signed-off-by: Mike Isely <isely@pobox.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/media/video/pvrusb2/pvrusb2-hdw.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/media/video/pvrusb2/pvrusb2-hdw.c
++++ b/drivers/media/video/pvrusb2/pvrusb2-hdw.c
+@@ -2950,6 +2950,7 @@ static void pvr2_subdev_update(struct pv
+ vs = hdw->std_mask_cur;
+ v4l2_device_call_all(&hdw->v4l2_dev, 0,
+ core, s_std, vs);
++ pvr2_hdw_cx25840_vbi_hack(hdw);
+ }
+ hdw->tuner_signal_stale = !0;
+ hdw->cropcap_stale = !0;
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:24:24 2009
+Message-Id: <20090701002424.245854224@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:23:25 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Hans Verkuil <hverkuil@xs4all.nl>,
+ Mauro Carvalho Chehab <mchehab@redhat.com>,
+ Michael Krufky <mkrufky@linuxtv.org>
+Subject: [patch 036/108] V4L: i2c modules must be linked before the v4l2 drivers
+References: <20090701002249.937782934@mini.kroah.org>
+Content-Disposition: inline; filename=v4l-i2c-modules-must-be-linked-before-the-v4l2-drivers.patch
+Content-Length: 7294
+Lines: 193
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Hans Verkuil <hverkuil@xs4all.nl>
+
+(backported from commit df59f0b3df3cc35fa03ea395f5106d1625e3726a)
+
+Please note that this patch attached has been BACKPORTED to fit kernel
+2.6.30.y
+
+Since i2c autoprobing is no longer supported by v4l2 we need to make sure
+that the i2c modules are linked before the v4l2 modules. The v4l2 modules
+now rely on the presence of the i2c modules, so these must have initialized
+themselves before the v4l2 modules.
+
+The exception is the ir-kbd-i2c module, which is the only one still using
+autoprobing. This one should be loaded at the end of the v4l2 module. Loading
+it earlier actually causes problems with tveeprom. Once ir-kbd-i2c is no
+longer autoprobing, then it has to move up as well.
+
+This is only an issue when everything is compiled into the kernel.
+
+Thanks to Marcus Swoboda for reporting this and Udo Steinberg for testing
+this patch.
+
+Tested-by: Udo A. Steinberg <udo@hypervisor.org>
+Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/media/video/Makefile | 77 ++++++++++++++++++-----------------
+ drivers/media/video/saa7134/Makefile | 3 -
+ 2 files changed, 42 insertions(+), 38 deletions(-)
+
+--- a/drivers/media/video/Makefile
++++ b/drivers/media/video/Makefile
+@@ -12,6 +12,8 @@ omap2cam-objs := omap24xxcam.o omap24xxc
+
+ videodev-objs := v4l2-dev.o v4l2-ioctl.o v4l2-device.o
+
++# V4L2 core modules
++
+ obj-$(CONFIG_VIDEO_DEV) += videodev.o v4l2-int-device.o
+ ifeq ($(CONFIG_COMPAT),y)
+ obj-$(CONFIG_VIDEO_DEV) += v4l2-compat-ioctl32.o
+@@ -23,21 +25,15 @@ ifeq ($(CONFIG_VIDEO_V4L1_COMPAT),y)
+ obj-$(CONFIG_VIDEO_DEV) += v4l1-compat.o
+ endif
+
+-obj-$(CONFIG_VIDEO_TUNER) += tuner.o
++# All i2c modules must come first:
+
+-obj-$(CONFIG_VIDEO_BT848) += bt8xx/
+-obj-$(CONFIG_VIDEO_IR_I2C) += ir-kbd-i2c.o
++obj-$(CONFIG_VIDEO_TUNER) += tuner.o
+ obj-$(CONFIG_VIDEO_TVAUDIO) += tvaudio.o
+ obj-$(CONFIG_VIDEO_TDA7432) += tda7432.o
+ obj-$(CONFIG_VIDEO_TDA9875) += tda9875.o
+-
+ obj-$(CONFIG_VIDEO_SAA6588) += saa6588.o
+ obj-$(CONFIG_VIDEO_SAA5246A) += saa5246a.o
+ obj-$(CONFIG_VIDEO_SAA5249) += saa5249.o
+-obj-$(CONFIG_VIDEO_CQCAM) += c-qcam.o
+-obj-$(CONFIG_VIDEO_BWQCAM) += bw-qcam.o
+-obj-$(CONFIG_VIDEO_W9966) += w9966.o
+-
+ obj-$(CONFIG_VIDEO_TDA9840) += tda9840.o
+ obj-$(CONFIG_VIDEO_TEA6415C) += tea6415c.o
+ obj-$(CONFIG_VIDEO_TEA6420) += tea6420.o
+@@ -54,11 +50,40 @@ obj-$(CONFIG_VIDEO_BT819) += bt819.o
+ obj-$(CONFIG_VIDEO_BT856) += bt856.o
+ obj-$(CONFIG_VIDEO_BT866) += bt866.o
+ obj-$(CONFIG_VIDEO_KS0127) += ks0127.o
++obj-$(CONFIG_VIDEO_VINO) += indycam.o
++obj-$(CONFIG_VIDEO_TVP5150) += tvp5150.o
++obj-$(CONFIG_VIDEO_TVP514X) += tvp514x.o
++obj-$(CONFIG_VIDEO_MSP3400) += msp3400.o
++obj-$(CONFIG_VIDEO_CS5345) += cs5345.o
++obj-$(CONFIG_VIDEO_CS53L32A) += cs53l32a.o
++obj-$(CONFIG_VIDEO_M52790) += m52790.o
++obj-$(CONFIG_VIDEO_TLV320AIC23B) += tlv320aic23b.o
++obj-$(CONFIG_VIDEO_WM8775) += wm8775.o
++obj-$(CONFIG_VIDEO_WM8739) += wm8739.o
++obj-$(CONFIG_VIDEO_VP27SMPX) += vp27smpx.o
++obj-$(CONFIG_VIDEO_CX25840) += cx25840/
++obj-$(CONFIG_VIDEO_UPD64031A) += upd64031a.o
++obj-$(CONFIG_VIDEO_UPD64083) += upd64083.o
++obj-$(CONFIG_VIDEO_OV7670) += ov7670.o
++obj-$(CONFIG_VIDEO_TCM825X) += tcm825x.o
++obj-$(CONFIG_VIDEO_TVEEPROM) += tveeprom.o
+
+-obj-$(CONFIG_VIDEO_ZORAN) += zoran/
++obj-$(CONFIG_SOC_CAMERA_MT9M001) += mt9m001.o
++obj-$(CONFIG_SOC_CAMERA_MT9M111) += mt9m111.o
++obj-$(CONFIG_SOC_CAMERA_MT9T031) += mt9t031.o
++obj-$(CONFIG_SOC_CAMERA_MT9V022) += mt9v022.o
++obj-$(CONFIG_SOC_CAMERA_OV772X) += ov772x.o
++obj-$(CONFIG_SOC_CAMERA_TW9910) += tw9910.o
+
++# And now the v4l2 drivers:
++
++obj-$(CONFIG_VIDEO_BT848) += bt8xx/
++obj-$(CONFIG_VIDEO_ZORAN) += zoran/
++obj-$(CONFIG_VIDEO_CQCAM) += c-qcam.o
++obj-$(CONFIG_VIDEO_BWQCAM) += bw-qcam.o
++obj-$(CONFIG_VIDEO_W9966) += w9966.o
+ obj-$(CONFIG_VIDEO_PMS) += pms.o
+-obj-$(CONFIG_VIDEO_VINO) += vino.o indycam.o
++obj-$(CONFIG_VIDEO_VINO) += vino.o
+ obj-$(CONFIG_VIDEO_STRADIS) += stradis.o
+ obj-$(CONFIG_VIDEO_CPIA) += cpia.o
+ obj-$(CONFIG_VIDEO_CPIA_PP) += cpia_pp.o
+@@ -69,17 +94,7 @@ obj-$(CONFIG_VIDEO_CX88) += cx88/
+ obj-$(CONFIG_VIDEO_EM28XX) += em28xx/
+ obj-$(CONFIG_VIDEO_CX231XX) += cx231xx/
+ obj-$(CONFIG_VIDEO_USBVISION) += usbvision/
+-obj-$(CONFIG_VIDEO_TVP5150) += tvp5150.o
+-obj-$(CONFIG_VIDEO_TVP514X) += tvp514x.o
+ obj-$(CONFIG_VIDEO_PVRUSB2) += pvrusb2/
+-obj-$(CONFIG_VIDEO_MSP3400) += msp3400.o
+-obj-$(CONFIG_VIDEO_CS5345) += cs5345.o
+-obj-$(CONFIG_VIDEO_CS53L32A) += cs53l32a.o
+-obj-$(CONFIG_VIDEO_M52790) += m52790.o
+-obj-$(CONFIG_VIDEO_TLV320AIC23B) += tlv320aic23b.o
+-obj-$(CONFIG_VIDEO_WM8775) += wm8775.o
+-obj-$(CONFIG_VIDEO_WM8739) += wm8739.o
+-obj-$(CONFIG_VIDEO_VP27SMPX) += vp27smpx.o
+ obj-$(CONFIG_VIDEO_OVCAMCHIP) += ovcamchip/
+ obj-$(CONFIG_VIDEO_CPIA2) += cpia2/
+ obj-$(CONFIG_VIDEO_MXB) += mxb.o
+@@ -92,19 +107,12 @@ obj-$(CONFIG_VIDEOBUF_DMA_CONTIG) += vid
+ obj-$(CONFIG_VIDEOBUF_VMALLOC) += videobuf-vmalloc.o
+ obj-$(CONFIG_VIDEOBUF_DVB) += videobuf-dvb.o
+ obj-$(CONFIG_VIDEO_BTCX) += btcx-risc.o
+-obj-$(CONFIG_VIDEO_TVEEPROM) += tveeprom.o
+
+ obj-$(CONFIG_VIDEO_M32R_AR_M64278) += arv.o
+
+-obj-$(CONFIG_VIDEO_CX25840) += cx25840/
+-obj-$(CONFIG_VIDEO_UPD64031A) += upd64031a.o
+-obj-$(CONFIG_VIDEO_UPD64083) += upd64083.o
+ obj-$(CONFIG_VIDEO_CX2341X) += cx2341x.o
+
+ obj-$(CONFIG_VIDEO_CAFE_CCIC) += cafe_ccic.o
+-obj-$(CONFIG_VIDEO_OV7670) += ov7670.o
+-
+-obj-$(CONFIG_VIDEO_TCM825X) += tcm825x.o
+
+ obj-$(CONFIG_USB_DABUSB) += dabusb.o
+ obj-$(CONFIG_USB_OV511) += ov511.o
+@@ -134,24 +142,21 @@ obj-$(CONFIG_VIDEO_CX18) += cx18/
+ obj-$(CONFIG_VIDEO_VIVI) += vivi.o
+ obj-$(CONFIG_VIDEO_CX23885) += cx23885/
+
++obj-$(CONFIG_VIDEO_OMAP2) += omap2cam.o
++obj-$(CONFIG_SOC_CAMERA) += soc_camera.o
++obj-$(CONFIG_SOC_CAMERA_PLATFORM) += soc_camera_platform.o
++# soc-camera host drivers have to be linked after camera drivers
+ obj-$(CONFIG_VIDEO_MX1) += mx1_camera.o
+ obj-$(CONFIG_VIDEO_MX3) += mx3_camera.o
+ obj-$(CONFIG_VIDEO_PXA27x) += pxa_camera.o
+ obj-$(CONFIG_VIDEO_SH_MOBILE_CEU) += sh_mobile_ceu_camera.o
+-obj-$(CONFIG_VIDEO_OMAP2) += omap2cam.o
+-obj-$(CONFIG_SOC_CAMERA) += soc_camera.o
+-obj-$(CONFIG_SOC_CAMERA_MT9M001) += mt9m001.o
+-obj-$(CONFIG_SOC_CAMERA_MT9M111) += mt9m111.o
+-obj-$(CONFIG_SOC_CAMERA_MT9T031) += mt9t031.o
+-obj-$(CONFIG_SOC_CAMERA_MT9V022) += mt9v022.o
+-obj-$(CONFIG_SOC_CAMERA_OV772X) += ov772x.o
+-obj-$(CONFIG_SOC_CAMERA_PLATFORM) += soc_camera_platform.o
+-obj-$(CONFIG_SOC_CAMERA_TW9910) += tw9910.o
+
+ obj-$(CONFIG_VIDEO_AU0828) += au0828/
+
+ obj-$(CONFIG_USB_VIDEO_CLASS) += uvc/
+
++obj-$(CONFIG_VIDEO_IR_I2C) += ir-kbd-i2c.o
++
+ EXTRA_CFLAGS += -Idrivers/media/dvb/dvb-core
+ EXTRA_CFLAGS += -Idrivers/media/dvb/frontends
+ EXTRA_CFLAGS += -Idrivers/media/common/tuners
+--- a/drivers/media/video/saa7134/Makefile
++++ b/drivers/media/video/saa7134/Makefile
+@@ -3,8 +3,7 @@ saa7134-objs := saa7134-cards.o saa7134-
+ saa7134-ts.o saa7134-tvaudio.o saa7134-vbi.o \
+ saa7134-video.o saa7134-input.o
+
+-obj-$(CONFIG_VIDEO_SAA7134) += saa7134.o saa7134-empress.o \
+- saa6752hs.o
++obj-$(CONFIG_VIDEO_SAA7134) += saa6752hs.o saa7134.o saa7134-empress.o
+
+ obj-$(CONFIG_VIDEO_SAA7134_ALSA) += saa7134-alsa.o
+
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:24:24 2009
+Message-Id: <20090701002424.559577537@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:23:26 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ John Stoffel <john@stoffel.org>,
+ James Bottomley <James.Bottomley@HansenPartnership.com>
+Subject: [patch 037/108] sym53c8xx: ratelimit parity errors
+References: <20090701002249.937782934@mini.kroah.org>
+Content-Disposition: inline; filename=sym53c8xx-ratelimit-parity-errors.patch
+Content-Length: 1007
+Lines: 30
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: John Stoffel <john@stoffel.org>
+
+commit 75be63bcf73ebdd1fdc1d49f6bf2d1326a1ba7de upstream.
+
+This makes a huge difference when you have a serial console on bootup to limit
+these messages to a sane number.
+
+Signed-off-by: John Stoffel <john@stoffel.org>
+Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/scsi/sym53c8xx_2/sym_hipd.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/scsi/sym53c8xx_2/sym_hipd.c
++++ b/drivers/scsi/sym53c8xx_2/sym_hipd.c
+@@ -2312,8 +2312,9 @@ static void sym_int_par (struct sym_hcb
+ int phase = cmd & 7;
+ struct sym_ccb *cp = sym_ccb_from_dsa(np, dsa);
+
+- printf("%s: SCSI parity error detected: SCR1=%d DBC=%x SBCL=%x\n",
+- sym_name(np), hsts, dbc, sbcl);
++ if (printk_ratelimit())
++ printf("%s: SCSI parity error detected: SCR1=%d DBC=%x SBCL=%x\n",
++ sym_name(np), hsts, dbc, sbcl);
+
+ /*
+ * Check that the chip is connected to the SCSI BUS.
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:24:25 2009
+Message-Id: <20090701002424.978718378@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:23:27 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Karsten Keil <keil@b1-systems.de>
+Subject: [patch 038/108] ISDN: Fix DMA alloc for hfcpci
+References: <20090701002249.937782934@mini.kroah.org>
+Content-Disposition: inline; filename=isdn-fix-dma-alloc-for-hfcpci.patch
+Content-Length: 3794
+Lines: 99
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Karsten Keil <keil@b1-systems.de>
+
+commit 8a745b9d91962991ce87a649a4dc3af3206c2c8b upstream.
+
+Replace wrong code with correct DMA API functions.
+
+Signed-off-by: Karsten Keil <keil@b1-systems.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/isdn/hisax/hfc_pci.c | 41 ++++++++++++++++++++++++++++++-----------
+ drivers/isdn/hisax/hisax.h | 2 +-
+ 2 files changed, 31 insertions(+), 12 deletions(-)
+
+--- a/drivers/isdn/hisax/hfc_pci.c
++++ b/drivers/isdn/hisax/hfc_pci.c
+@@ -82,8 +82,9 @@ release_io_hfcpci(struct IsdnCardState *
+ Write_hfc(cs, HFCPCI_INT_M2, cs->hw.hfcpci.int_m2);
+ pci_write_config_word(cs->hw.hfcpci.dev, PCI_COMMAND, 0); /* disable memory mapped ports + busmaster */
+ del_timer(&cs->hw.hfcpci.timer);
+- kfree(cs->hw.hfcpci.share_start);
+- cs->hw.hfcpci.share_start = NULL;
++ pci_free_consistent(cs->hw.hfcpci.dev, 0x8000,
++ cs->hw.hfcpci.fifos, cs->hw.hfcpci.dma);
++ cs->hw.hfcpci.fifos = NULL;
+ iounmap((void *)cs->hw.hfcpci.pci_io);
+ }
+
+@@ -1663,8 +1664,19 @@ setup_hfcpci(struct IsdnCard *card)
+ dev_hfcpci);
+ i++;
+ if (tmp_hfcpci) {
++ dma_addr_t dma_mask = DMA_BIT_MASK(32) & ~0x7fffUL;
+ if (pci_enable_device(tmp_hfcpci))
+ continue;
++ if (pci_set_dma_mask(tmp_hfcpci, dma_mask)) {
++ printk(KERN_WARNING
++ "HiSax hfc_pci: No suitable DMA available.\n");
++ continue;
++ }
++ if (pci_set_consistent_dma_mask(tmp_hfcpci, dma_mask)) {
++ printk(KERN_WARNING
++ "HiSax hfc_pci: No suitable consistent DMA available.\n");
++ continue;
++ }
+ pci_set_master(tmp_hfcpci);
+ if ((card->para[0]) && (card->para[0] != (tmp_hfcpci->resource[ 0].start & PCI_BASE_ADDRESS_IO_MASK)))
+ continue;
+@@ -1693,22 +1705,29 @@ setup_hfcpci(struct IsdnCard *card)
+ printk(KERN_WARNING "HFC-PCI: No IO-Mem for PCI card found\n");
+ return (0);
+ }
++
+ /* Allocate memory for FIFOS */
+- /* Because the HFC-PCI needs a 32K physical alignment, we */
+- /* need to allocate the double mem and align the address */
+- if (!(cs->hw.hfcpci.share_start = kmalloc(65536, GFP_KERNEL))) {
+- printk(KERN_WARNING "HFC-PCI: Error allocating memory for FIFO!\n");
++ cs->hw.hfcpci.fifos = pci_alloc_consistent(cs->hw.hfcpci.dev,
++ 0x8000, &cs->hw.hfcpci.dma);
++ if (!cs->hw.hfcpci.fifos) {
++ printk(KERN_WARNING "HFC-PCI: Error allocating FIFO memory!\n");
++ return 0;
++ }
++ if (cs->hw.hfcpci.dma & 0x7fff) {
++ printk(KERN_WARNING
++ "HFC-PCI: Error DMA memory not on 32K boundary (%lx)\n",
++ (u_long)cs->hw.hfcpci.dma);
++ pci_free_consistent(cs->hw.hfcpci.dev, 0x8000,
++ cs->hw.hfcpci.fifos, cs->hw.hfcpci.dma);
+ return 0;
+ }
+- cs->hw.hfcpci.fifos = (void *)
+- (((ulong) cs->hw.hfcpci.share_start) & ~0x7FFF) + 0x8000;
+- pci_write_config_dword(cs->hw.hfcpci.dev, 0x80, (u_int) virt_to_bus(cs->hw.hfcpci.fifos));
++ pci_write_config_dword(cs->hw.hfcpci.dev, 0x80, (u32)cs->hw.hfcpci.dma);
+ cs->hw.hfcpci.pci_io = ioremap((ulong) cs->hw.hfcpci.pci_io, 256);
+ printk(KERN_INFO
+- "HFC-PCI: defined at mem %p fifo %p(%#x) IRQ %d HZ %d\n",
++ "HFC-PCI: defined at mem %p fifo %p(%lx) IRQ %d HZ %d\n",
+ cs->hw.hfcpci.pci_io,
+ cs->hw.hfcpci.fifos,
+- (u_int) virt_to_bus(cs->hw.hfcpci.fifos),
++ (u_long)cs->hw.hfcpci.dma,
+ cs->irq, HZ);
+
+ spin_lock_irqsave(&cs->lock, flags);
+--- a/drivers/isdn/hisax/hisax.h
++++ b/drivers/isdn/hisax/hisax.h
+@@ -703,7 +703,7 @@ struct hfcPCI_hw {
+ int nt_timer;
+ struct pci_dev *dev;
+ unsigned char *pci_io; /* start of PCI IO memory */
+- void *share_start; /* shared memory for Fifos start */
++ dma_addr_t dma; /* dma handle for Fifos */
+ void *fifos; /* FIFO memory */
+ int last_bfifo_cnt[2]; /* marker saving last b-fifo frame count */
+ struct timer_list timer;
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:24:25 2009
+Message-Id: <20090701002425.282771625@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:23:28 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Dave Kleikamp <shaggy@linux.vnet.ibm.com>
+Subject: [patch 039/108] jfs: fix regression preventing coalescing of extents
+References: <20090701002249.937782934@mini.kroah.org>
+Content-Disposition: inline; filename=jfs-fix-regression-preventing-coalescing-of-extents.patch
+Content-Length: 1056
+Lines: 33
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Dave Kleikamp <shaggy@linux.vnet.ibm.com>
+
+commit f7c52fd17a7dda42fc9e88c2b2678403419bfe63 upstream.
+
+Commit fec1878fe952b994125a3be7c94b1322db586f3b caused a regression in
+which contiguous blocks being allocated to the end of an extent were
+getting a new extent created. This typically results in files entirely
+made up of 1-block extents even though the blocks are contiguous on
+disk.
+
+Apparently grub doesn't handle a jfs file being fragmented into too many
+extents, since it refuses to boot a kernel from jfs that was created by
+the 2.6.30 kernel.
+
+Signed-off-by: Dave Kleikamp <shaggy@linux.vnet.ibm.com>
+Reported-by: Alex <alevkovich@tut.by>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/jfs/jfs_extent.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/fs/jfs/jfs_extent.c
++++ b/fs/jfs/jfs_extent.c
+@@ -391,6 +391,7 @@ int extHint(struct inode *ip, s64 offset
+ }
+ XADaddress(xp, xaddr);
+ XADlength(xp, xlen);
++ XADoffset(xp, prev);
+ /*
+ * only preserve the abnr flag within the xad flags
+ * of the returned hint.
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:24:25 2009
+Message-Id: <20090701002425.484463869@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:23:29 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Roel Kluin <roel.kluin@gmail.com>,
+ Anton Vorontsov <avorontsov@ru.mvista.com>,
+ David Brownell <david-b@pacbell.net>,
+ Benjamin Herrenschmidt <benh@kernel.crashing.org>,
+ Kumar Gala <galak@gate.crashing.org>,
+ Grant Likely <grant.likely@secretlab.ca>
+Subject: [patch 040/108] spi: takes size of a pointer to determine the size of the pointed-to type
+References: <20090701002249.937782934@mini.kroah.org>
+Content-Disposition: inline; filename=spi-takes-size-of-a-pointer-to-determine-the-size-of-the-pointed-to-type.patch
+Content-Length: 1384
+Lines: 40
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Roel Kluin <roel.kluin@gmail.com>
+
+commit 021415468c889979117b1a07b96f7e36de33e995 upstream.
+
+Do not take the size of a pointer to determine the size of the pointed-to
+type.
+
+Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
+Acked-by: Anton Vorontsov <avorontsov@ru.mvista.com>
+Cc: David Brownell <david-b@pacbell.net>
+Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Cc: Kumar Gala <galak@gate.crashing.org>
+Acked-by: Grant Likely <grant.likely@secretlab.ca>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/spi/spi_mpc83xx.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/spi/spi_mpc83xx.c
++++ b/drivers/spi/spi_mpc83xx.c
+@@ -711,12 +711,12 @@ static int of_mpc83xx_spi_get_chipselect
+ return 0;
+ }
+
+- pinfo->gpios = kmalloc(ngpios * sizeof(pinfo->gpios), GFP_KERNEL);
++ pinfo->gpios = kmalloc(ngpios * sizeof(*pinfo->gpios), GFP_KERNEL);
+ if (!pinfo->gpios)
+ return -ENOMEM;
+- memset(pinfo->gpios, -1, ngpios * sizeof(pinfo->gpios));
++ memset(pinfo->gpios, -1, ngpios * sizeof(*pinfo->gpios));
+
+- pinfo->alow_flags = kzalloc(ngpios * sizeof(pinfo->alow_flags),
++ pinfo->alow_flags = kzalloc(ngpios * sizeof(*pinfo->alow_flags),
+ GFP_KERNEL);
+ if (!pinfo->alow_flags) {
+ ret = -ENOMEM;
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:24:25 2009
+Message-Id: <20090701002425.687060928@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:23:30 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Mike Frysinger <vapier@gentoo.org>,
+ Alan Cox <alan@linux.intel.com>
+Subject: [patch 041/108] serial: bfin_5xx: add missing spin_lock init
+References: <20090701002249.937782934@mini.kroah.org>
+Content-Disposition: inline; filename=serial-bfin_5xx-add-missing-spin_lock-init.patch
+Content-Length: 1017
+Lines: 28
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Mike Frysinger <vapier@gentoo.org>
+
+commit 9c529a3d76dffae943868ebad07b042d15764712 upstream.
+
+The Blackfin serial driver never initialized the spin_lock that is part of
+the serial core structure, but we never noticed because spin_lock's are
+rarely enabled on UP systems. Yeah lockdep and friends.
+
+Signed-off-by: Mike Frysinger <vapier@gentoo.org>
+Signed-off-by: Alan Cox <alan@linux.intel.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/serial/bfin_5xx.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/serial/bfin_5xx.c
++++ b/drivers/serial/bfin_5xx.c
+@@ -1058,6 +1058,7 @@ static void __init bfin_serial_init_port
+ bfin_serial_hw_init();
+
+ for (i = 0; i < nr_active_ports; i++) {
++ spin_lock_init(&bfin_serial_ports[i].port.lock);
+ bfin_serial_ports[i].port.uartclk = get_sclk();
+ bfin_serial_ports[i].port.fifosize = BFIN_UART_TX_FIFO_SIZE;
+ bfin_serial_ports[i].port.ops = &bfin_serial_pops;
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:24:26 2009
+Message-Id: <20090701002426.050559424@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:23:31 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Andreas Herrmann <andreas.herrmann3@amd.com>,
+ Yinghai Lu <yinghai@kernel.org>,
+ xiyou.wangcong@gmail.com,
+ Ingo Molnar <mingo@elte.hu>
+Subject: [patch 042/108] x86: memtest: remove 64-bit division
+References: <20090701002249.937782934@mini.kroah.org>
+Content-Disposition: inline; filename=x86-memtest-remove-64-bit-division.patch
+Content-Length: 2073
+Lines: 68
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Andreas Herrmann <andreas.herrmann3@amd.com>
+
+commit c9690998ef48ffefeccb91c70a7739eebdea57f9 upstream.
+
+Using gcc 3.3.5 a "make allmodconfig" + "CONFIG_KVM=n"
+triggers a build error:
+
+ arch/x86/mm/built-in.o(.init.text+0x43f7): In function `__change_page_attr':
+ arch/x86/mm/pageattr.c:114: undefined reference to `__udivdi3'
+ make: *** [.tmp_vmlinux1] Error 1
+
+The culprit turned out to be a division in arch/x86/mm/memtest.c
+For more info see this thread:
+
+ http://marc.info/?l=linux-kernel&m=124416232620683
+
+The patch entirely removes the division that caused the build
+error.
+
+[ Impact: build fix with certain GCC versions ]
+
+Reported-by: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
+Signed-off-by: Andreas Herrmann <andreas.herrmann3@amd.com>
+Cc: Yinghai Lu <yinghai@kernel.org>
+Cc: xiyou.wangcong@gmail.com
+Cc: Andrew Morton <akpm@linux-foundation.org>
+LKML-Reference: <20090608170939.GB12431@alberich.amd.com>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/mm/memtest.c | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+--- a/arch/x86/mm/memtest.c
++++ b/arch/x86/mm/memtest.c
+@@ -40,23 +40,23 @@ static void __init reserve_bad_mem(u64 p
+
+ static void __init memtest(u64 pattern, u64 start_phys, u64 size)
+ {
+- u64 i, count;
+- u64 *start;
++ u64 *p;
++ void *start, *end;
+ u64 start_bad, last_bad;
+ u64 start_phys_aligned;
+ size_t incr;
+
+ incr = sizeof(pattern);
+ start_phys_aligned = ALIGN(start_phys, incr);
+- count = (size - (start_phys_aligned - start_phys))/incr;
+ start = __va(start_phys_aligned);
++ end = start + size - (start_phys_aligned - start_phys);
+ start_bad = 0;
+ last_bad = 0;
+
+- for (i = 0; i < count; i++)
+- start[i] = pattern;
+- for (i = 0; i < count; i++, start++, start_phys_aligned += incr) {
+- if (*start == pattern)
++ for (p = start; p < end; p++)
++ *p = pattern;
++ for (p = start; p < end; p++, start_phys_aligned += incr) {
++ if (*p == pattern)
+ continue;
+ if (start_phys_aligned == last_bad + incr) {
+ last_bad += incr;
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:24:26 2009
+Message-Id: <20090701002426.544692405@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:23:32 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Cliff Wickman <cpw@sgi.com>,
+ Ingo Molnar <mingo@elte.hu>
+Subject: [patch 043/108] x86: Fix UV BAU activation descriptor init
+References: <20090701002249.937782934@mini.kroah.org>
+Content-Disposition: inline; filename=x86-fix-uv-bau-activation-descriptor-init.patch
+Content-Length: 2502
+Lines: 73
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Cliff Wickman <cpw@sgi.com>
+
+commit 0e2595cdfd7df9f1128f7185152601ae5417483b upstream.
+
+The UV tlb shootdown code has a serious initialization error.
+
+An array of structures [32*8] is initialized as if it were [32].
+The array is indexed by (cpu number on the blade)*8, so the short
+initialization works for up to 4 cpus on a blade.
+But above that, we provide an invalid opcode to the hub's
+broadcast assist unit.
+
+This patch changes the allocation of the array to use its symbolic
+dimensions for better clarity. And initializes all 32*8 entries.
+
+Shortened 'UV_ACTIVATION_DESCRIPTOR_SIZE' to 'UV_ADP_SIZE' per Ingo's
+recommendation.
+
+Tested on the UV simulator.
+
+Signed-off-by: Cliff Wickman <cpw@sgi.com>
+LKML-Reference: <E1M6lZR-0007kV-Aq@eag09.americas.sgi.com>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/include/asm/uv/uv_bau.h | 2 +-
+ arch/x86/kernel/tlb_uv.c | 15 +++++++++++++--
+ 2 files changed, 14 insertions(+), 3 deletions(-)
+
+--- a/arch/x86/include/asm/uv/uv_bau.h
++++ b/arch/x86/include/asm/uv/uv_bau.h
+@@ -37,7 +37,7 @@
+ #define UV_CPUS_PER_ACT_STATUS 32
+ #define UV_ACT_STATUS_MASK 0x3
+ #define UV_ACT_STATUS_SIZE 2
+-#define UV_ACTIVATION_DESCRIPTOR_SIZE 32
++#define UV_ADP_SIZE 32
+ #define UV_DISTRIBUTION_SIZE 256
+ #define UV_SW_ACK_NPENDING 8
+ #define UV_NET_ENDPOINT_INTD 0x38
+--- a/arch/x86/kernel/tlb_uv.c
++++ b/arch/x86/kernel/tlb_uv.c
+@@ -715,7 +715,12 @@ uv_activation_descriptor_init(int node,
+ struct bau_desc *adp;
+ struct bau_desc *ad2;
+
+- adp = (struct bau_desc *)kmalloc_node(16384, GFP_KERNEL, node);
++ /*
++ * each bau_desc is 64 bytes; there are 8 (UV_ITEMS_PER_DESCRIPTOR)
++ * per cpu; and up to 32 (UV_ADP_SIZE) cpu's per blade
++ */
++ adp = (struct bau_desc *)kmalloc_node(sizeof(struct bau_desc)*
++ UV_ADP_SIZE*UV_ITEMS_PER_DESCRIPTOR, GFP_KERNEL, node);
+ BUG_ON(!adp);
+
+ pa = uv_gpa(adp); /* need the real nasid*/
+@@ -729,7 +734,13 @@ uv_activation_descriptor_init(int node,
+ (n << UV_DESC_BASE_PNODE_SHIFT | m));
+ }
+
+- for (i = 0, ad2 = adp; i < UV_ACTIVATION_DESCRIPTOR_SIZE; i++, ad2++) {
++ /*
++ * initializing all 8 (UV_ITEMS_PER_DESCRIPTOR) descriptors for each
++ * cpu even though we only use the first one; one descriptor can
++ * describe a broadcast to 256 nodes.
++ */
++ for (i = 0, ad2 = adp; i < (UV_ADP_SIZE*UV_ITEMS_PER_DESCRIPTOR);
++ i++, ad2++) {
+ memset(ad2, 0, sizeof(struct bau_desc));
+ ad2->header.sw_ack_flag = 1;
+ /*
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:24:27 2009
+Message-Id: <20090701002426.887203672@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:23:33 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jack Steiner <steiner@sgi.com>,
+ Ingo Molnar <mingo@elte.hu>
+Subject: [patch 044/108] x86, UV: Fix macros for multiple coherency domains
+References: <20090701002249.937782934@mini.kroah.org>
+Content-Disposition: inline; filename=x86-uv-fix-macros-for-multiple-coherency-domains.patch
+Content-Length: 3987
+Lines: 102
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Jack Steiner <steiner@sgi.com>
+
+commit c4ed3f04ba9defe22aa729d1646f970f791c03d7 upstream.
+
+Fix bug in the SGI UV macros that support systems with multiple
+coherency domains. The macros used for referencing global MMR
+(chipset registers) are failing to correctly "or" the NASID
+(node identifier) bits that reside above M+N. These high bits
+are supplied automatically by the chipset for memory accesses
+coming from the processor socket.
+
+However, the bits must be present for references to the special
+global MMR space used to map chipset registers. (See uv_hub.h
+for more details ...)
+
+The bug results in references to invalid/incorrect nodes.
+
+Signed-off-by: Jack Steiner <steiner@sgi.com>
+LKML-Reference: <20090608154405.GA16395@sgi.com>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/include/asm/uv/uv_hub.h | 6 ++++--
+ arch/x86/kernel/apic/x2apic_uv_x.c | 15 +++++++++------
+ 2 files changed, 13 insertions(+), 8 deletions(-)
+
+--- a/arch/x86/include/asm/uv/uv_hub.h
++++ b/arch/x86/include/asm/uv/uv_hub.h
+@@ -133,6 +133,7 @@ struct uv_scir_s {
+ struct uv_hub_info_s {
+ unsigned long global_mmr_base;
+ unsigned long gpa_mask;
++ unsigned int gnode_extra;
+ unsigned long gnode_upper;
+ unsigned long lowmem_remap_top;
+ unsigned long lowmem_remap_base;
+@@ -159,7 +160,8 @@ DECLARE_PER_CPU(struct uv_hub_info_s, __
+ * p - PNODE (local part of nsids, right shifted 1)
+ */
+ #define UV_NASID_TO_PNODE(n) (((n) >> 1) & uv_hub_info->pnode_mask)
+-#define UV_PNODE_TO_NASID(p) (((p) << 1) | uv_hub_info->gnode_upper)
++#define UV_PNODE_TO_GNODE(p) ((p) |uv_hub_info->gnode_extra)
++#define UV_PNODE_TO_NASID(p) (UV_PNODE_TO_GNODE(p) << 1)
+
+ #define UV_LOCAL_MMR_BASE 0xf4000000UL
+ #define UV_GLOBAL_MMR32_BASE 0xf8000000UL
+@@ -173,7 +175,7 @@ DECLARE_PER_CPU(struct uv_hub_info_s, __
+ #define UV_GLOBAL_MMR32_PNODE_BITS(p) ((p) << (UV_GLOBAL_MMR32_PNODE_SHIFT))
+
+ #define UV_GLOBAL_MMR64_PNODE_BITS(p) \
+- ((unsigned long)(p) << UV_GLOBAL_MMR64_PNODE_SHIFT)
++ ((unsigned long)(UV_PNODE_TO_GNODE(p)) << UV_GLOBAL_MMR64_PNODE_SHIFT)
+
+ #define UV_APIC_PNODE_SHIFT 6
+
+--- a/arch/x86/kernel/apic/x2apic_uv_x.c
++++ b/arch/x86/kernel/apic/x2apic_uv_x.c
+@@ -562,7 +562,7 @@ void __init uv_system_init(void)
+ union uvh_node_id_u node_id;
+ unsigned long gnode_upper, lowmem_redir_base, lowmem_redir_size;
+ int bytes, nid, cpu, lcpu, pnode, blade, i, j, m_val, n_val;
+- int max_pnode = 0;
++ int gnode_extra, max_pnode = 0;
+ unsigned long mmr_base, present, paddr;
+ unsigned short pnode_mask;
+
+@@ -574,6 +574,13 @@ void __init uv_system_init(void)
+ mmr_base =
+ uv_read_local_mmr(UVH_RH_GAM_MMR_OVERLAY_CONFIG_MMR) &
+ ~UV_MMR_ENABLE;
++ pnode_mask = (1 << n_val) - 1;
++ node_id.v = uv_read_local_mmr(UVH_NODE_ID);
++ gnode_extra = (node_id.s.node_id & ~((1 << n_val) - 1)) >> 1;
++ gnode_upper = ((unsigned long)gnode_extra << m_val);
++ printk(KERN_DEBUG "UV: N %d, M %d, gnode_upper 0x%lx, gnode_extra 0x%x\n",
++ n_val, m_val, gnode_upper, gnode_extra);
++
+ printk(KERN_DEBUG "UV: global MMR base 0x%lx\n", mmr_base);
+
+ for(i = 0; i < UVH_NODE_PRESENT_TABLE_DEPTH; i++)
+@@ -607,11 +614,6 @@ void __init uv_system_init(void)
+ }
+ }
+
+- pnode_mask = (1 << n_val) - 1;
+- node_id.v = uv_read_local_mmr(UVH_NODE_ID);
+- gnode_upper = (((unsigned long)node_id.s.node_id) &
+- ~((1 << n_val) - 1)) << m_val;
+-
+ uv_bios_init();
+ uv_bios_get_sn_info(0, &uv_type, &sn_partition_id,
+ &sn_coherency_id, &sn_region_size);
+@@ -634,6 +636,7 @@ void __init uv_system_init(void)
+ uv_cpu_hub_info(cpu)->pnode_mask = pnode_mask;
+ uv_cpu_hub_info(cpu)->gpa_mask = (1 << (m_val + n_val)) - 1;
+ uv_cpu_hub_info(cpu)->gnode_upper = gnode_upper;
++ uv_cpu_hub_info(cpu)->gnode_extra = gnode_extra;
+ uv_cpu_hub_info(cpu)->global_mmr_base = mmr_base;
+ uv_cpu_hub_info(cpu)->coherency_domain_number = sn_coherency_id;
+ uv_cpu_hub_info(cpu)->scir.offset = SCIR_LOCAL_MMR_BASE + lcpu;
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:24:27 2009
+Message-Id: <20090701002427.223080661@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:23:34 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Mark Langsdorf <mark.langsdorf@amd.com>,
+ Joerg Roedel <joerg.roedel@amd.com>,
+ jbarnes@virtuousgeek.org,
+ Ingo Molnar <mingo@elte.hu>
+Subject: [patch 045/108] x86: enable GART-IOMMU only after setting up protection methods
+References: <20090701002249.937782934@mini.kroah.org>
+Content-Disposition: inline; filename=x86-enable-gart-iommu-only-after-setting-up-protection-methods.patch
+Content-Length: 1768
+Lines: 56
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Mark Langsdorf <mark.langsdorf@amd.com>
+
+commit fe2245c905631a3a353504fc04388ce3dfaf9d9e upstream.
+
+The current code to set up the GART as an IOMMU enables GART
+translations before it removes the aperture from the kernel memory
+map, sets the GART PTEs to UC, sets up the guard and scratch
+pages, or does a wbinvd(). This leaves the possibility of cache
+aliasing open and can cause system crashes.
+
+Re-order the code so as to enable the GART translations only
+after all safeguards are in place and the tlb has been flushed.
+
+AMD has tested this patch on both Istanbul systems and 1st
+generation Opteron systems with APG enabled and seen no adverse
+effects. Istanbul systems with HT Assist enabled sometimes
+see MCE errors due to cache artifacts with the unmodified
+code.
+
+Signed-off-by: Mark Langsdorf <mark.langsdorf@amd.com>
+Cc: Joerg Roedel <joerg.roedel@amd.com>
+Cc: akpm@linux-foundation.org
+Cc: jbarnes@virtuousgeek.org
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+
+---
+ arch/x86/kernel/pci-gart_64.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+--- a/arch/x86/kernel/pci-gart_64.c
++++ b/arch/x86/kernel/pci-gart_64.c
+@@ -688,8 +688,6 @@ static __init int init_k8_gatt(struct ag
+
+ agp_gatt_table = gatt;
+
+- enable_gart_translations();
+-
+ error = sysdev_class_register(&gart_sysdev_class);
+ if (!error)
+ error = sysdev_register(&device_gart);
+@@ -845,6 +843,14 @@ void __init gart_iommu_init(void)
+ * the pages as Not-Present:
+ */
+ wbinvd();
++
++ /*
++ * Now all caches are flushed and we can safely enable
++ * GART hardware. Doing it early leaves the possibility
++ * of stale cache entries that can lead to GART PTE
++ * errors.
++ */
++ enable_gart_translations();
+
+ /*
+ * Try to workaround a bug (thanks to BenH):
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:24:27 2009
+Message-Id: <20090701002427.764470416@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:23:35 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Petr Tesarik <ptesarik@suse.cz>,
+ Thomas Gleixner <tglx@linutronix.de>
+Subject: [patch 046/108] x86: move rdtsc_barrier() into the TSC vread method
+References: <20090701002249.937782934@mini.kroah.org>
+Content-Disposition: inline; filename=x86-move-rdtsc_barrier-into-the-tsc-vread-method.patch
+Content-Length: 1904
+Lines: 62
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Petr Tesarik <ptesarik@suse.cz>
+
+commit 7d96fd41cadc55f4e00231c8c71b8e25c779f122 upstream.
+
+The *fence instructions were moved to vsyscall_64.c by commit
+cb9e35dce94a1b9c59d46224e8a94377d673e204. But this breaks the
+vDSO, because vread methods are also called from there.
+
+Besides, the synchronization might be unnecessary for other
+time sources than TSC.
+
+[ Impact: fix potential time warp in VDSO ]
+
+Signed-off-by: Petr Tesarik <ptesarik@suse.cz>
+LKML-Reference: <9d0ea9ea0f866bdc1f4d76831221ae117f11ea67.1243241859.git.ptesarik@suse.cz>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/tsc.c | 11 ++++++++++-
+ arch/x86/kernel/vsyscall_64.c | 8 --------
+ 2 files changed, 10 insertions(+), 9 deletions(-)
+
+--- a/arch/x86/kernel/tsc.c
++++ b/arch/x86/kernel/tsc.c
+@@ -710,7 +710,16 @@ static cycle_t read_tsc(struct clocksour
+ #ifdef CONFIG_X86_64
+ static cycle_t __vsyscall_fn vread_tsc(void)
+ {
+- cycle_t ret = (cycle_t)vget_cycles();
++ cycle_t ret;
++
++ /*
++ * Surround the RDTSC by barriers, to make sure it's not
++ * speculated to outside the seqlock critical section and
++ * does not cause time warps:
++ */
++ rdtsc_barrier();
++ ret = (cycle_t)vget_cycles();
++ rdtsc_barrier();
+
+ return ret >= __vsyscall_gtod_data.clock.cycle_last ?
+ ret : __vsyscall_gtod_data.clock.cycle_last;
+--- a/arch/x86/kernel/vsyscall_64.c
++++ b/arch/x86/kernel/vsyscall_64.c
+@@ -132,15 +132,7 @@ static __always_inline void do_vgettimeo
+ return;
+ }
+
+- /*
+- * Surround the RDTSC by barriers, to make sure it's not
+- * speculated to outside the seqlock critical section and
+- * does not cause time warps:
+- */
+- rdtsc_barrier();
+ now = vread();
+- rdtsc_barrier();
+-
+ base = __vsyscall_gtod_data.clock.cycle_last;
+ mask = __vsyscall_gtod_data.clock.mask;
+ mult = __vsyscall_gtod_data.clock.mult;
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:24:28 2009
+Message-Id: <20090701002428.090919305@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:23:36 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Cliff Wickman <cpw@sgi.com>,
+ Ingo Molnar <mingo@elte.hu>
+Subject: [patch 047/108] x86: Fix uv bau sending buffer initialization
+References: <20090701002249.937782934@mini.kroah.org>
+Content-Disposition: inline; filename=x86-fix-uv-bau-sending-buffer-initialization.patch
+Content-Length: 1477
+Lines: 48
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Cliff Wickman <cpw@sgi.com>
+
+commit 9c26f52b900f7207135bafc8789e1a4f5d43e096 upstream.
+
+The initialization of the UV Broadcast Assist Unit's sending
+buffers was making an invalid assumption about the
+initialization of an MMR that defines its address.
+
+The BIOS will not be providing that MMR. So
+uv_activation_descriptor_init() should unconditionally set it.
+
+Tested on UV simulator.
+
+Signed-off-by: Cliff Wickman <cpw@sgi.com>
+LKML-Reference: <E1MJTfj-0005i1-W8@eag09.americas.sgi.com>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/tlb_uv.c | 9 ++-------
+ 1 file changed, 2 insertions(+), 7 deletions(-)
+
+--- a/arch/x86/kernel/tlb_uv.c
++++ b/arch/x86/kernel/tlb_uv.c
+@@ -711,7 +711,6 @@ uv_activation_descriptor_init(int node,
+ unsigned long pa;
+ unsigned long m;
+ unsigned long n;
+- unsigned long mmr_image;
+ struct bau_desc *adp;
+ struct bau_desc *ad2;
+
+@@ -727,12 +726,8 @@ uv_activation_descriptor_init(int node,
+ n = pa >> uv_nshift;
+ m = pa & uv_mmask;
+
+- mmr_image = uv_read_global_mmr64(pnode, UVH_LB_BAU_SB_DESCRIPTOR_BASE);
+- if (mmr_image) {
+- uv_write_global_mmr64(pnode, (unsigned long)
+- UVH_LB_BAU_SB_DESCRIPTOR_BASE,
+- (n << UV_DESC_BASE_PNODE_SHIFT | m));
+- }
++ uv_write_global_mmr64(pnode, UVH_LB_BAU_SB_DESCRIPTOR_BASE,
++ (n << UV_DESC_BASE_PNODE_SHIFT | m));
+
+ /*
+ * initializing all 8 (UV_ITEMS_PER_DESCRIPTOR) descriptors for each
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:24:28 2009
+Message-Id: <20090701002428.381134605@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:23:37 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jean Delvare <jdelvare@suse.de>,
+ Steve Conklin <steve.conklin@canonical.com>,
+ Leann Ogasawara <leann.ogasawara@canonical.com>,
+ Ingo Molnar <mingo@elte.hu>
+Subject: [patch 048/108] x86: Add quirk for reboot stalls on a Dell Optiplex 360
+References: <20090701002249.937782934@mini.kroah.org>
+Content-Disposition: inline; filename=x86-add-quirk-for-reboot-stalls-on-a-dell-optiplex-360.patch
+Content-Length: 1174
+Lines: 37
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Jean Delvare <jdelvare@suse.de>
+
+commit 4a4aca641bc4598e77b866804f47c651ec4a764d upstream.
+
+The Dell Optiplex 360 hangs on reboot, just like the Optiplex 330, so
+the same quirk is needed.
+
+Signed-off-by: Jean Delvare <jdelvare@suse.de>
+Cc: Steve Conklin <steve.conklin@canonical.com>
+Cc: Leann Ogasawara <leann.ogasawara@canonical.com>
+LKML-Reference: <200906051202.38311.jdelvare@suse.de>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/reboot.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/arch/x86/kernel/reboot.c
++++ b/arch/x86/kernel/reboot.c
+@@ -192,6 +192,15 @@ static struct dmi_system_id __initdata r
+ DMI_MATCH(DMI_BOARD_NAME, "0KP561"),
+ },
+ },
++ { /* Handle problems with rebooting on Dell Optiplex 360 with 0T656F */
++ .callback = set_bios_reboot,
++ .ident = "Dell OptiPlex 360",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "OptiPlex 360"),
++ DMI_MATCH(DMI_BOARD_NAME, "0T656F"),
++ },
++ },
+ { /* Handle problems with rebooting on Dell 2400's */
+ .callback = set_bios_reboot,
+ .ident = "Dell PowerEdge 2400",
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:24:28 2009
+Message-Id: <20090701002428.620627552@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:23:38 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Yinghai Lu <yinghai@kernel.org>,
+ "H. Peter Anvin" <hpa@zytor.com>
+Subject: [patch 049/108] x86: handle initrd that extends into unusable memory
+References: <20090701002249.937782934@mini.kroah.org>
+Content-Disposition: inline; filename=x86-handle-initrd-that-extends-into-unusable-memory.patch
+Content-Length: 2138
+Lines: 72
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Yinghai Lu <yinghai@kernel.org>
+
+commit 8c5dd8f43367f4f266dd616f11658005bc2d20ef upstream.
+
+On a system where system memory (according e820) is not covered by
+mtrr, mtrr_trim_memory converts a portion of memory to reserved, but
+bootloader has already put the initrd in that range.
+
+Thus, we need to have 64bit to use relocate_initrd too.
+
+[ Impact: fix using initrd when mtrr_trim_memory happen ]
+
+Signed-off-by: Yinghai Lu <yinghai@kernel.org>
+Signed-off-by: H. Peter Anvin <hpa@zytor.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/setup.c | 15 +++------------
+ 1 file changed, 3 insertions(+), 12 deletions(-)
+
+--- a/arch/x86/kernel/setup.c
++++ b/arch/x86/kernel/setup.c
+@@ -293,15 +293,13 @@ static void __init reserve_brk(void)
+
+ #ifdef CONFIG_BLK_DEV_INITRD
+
+-#ifdef CONFIG_X86_32
+-
+ #define MAX_MAP_CHUNK (NR_FIX_BTMAPS << PAGE_SHIFT)
+ static void __init relocate_initrd(void)
+ {
+
+ u64 ramdisk_image = boot_params.hdr.ramdisk_image;
+ u64 ramdisk_size = boot_params.hdr.ramdisk_size;
+- u64 end_of_lowmem = max_low_pfn << PAGE_SHIFT;
++ u64 end_of_lowmem = max_low_pfn_mapped << PAGE_SHIFT;
+ u64 ramdisk_here;
+ unsigned long slop, clen, mapaddr;
+ char *p, *q;
+@@ -357,14 +355,13 @@ static void __init relocate_initrd(void)
+ ramdisk_image, ramdisk_image + ramdisk_size - 1,
+ ramdisk_here, ramdisk_here + ramdisk_size - 1);
+ }
+-#endif
+
+ static void __init reserve_initrd(void)
+ {
+ u64 ramdisk_image = boot_params.hdr.ramdisk_image;
+ u64 ramdisk_size = boot_params.hdr.ramdisk_size;
+ u64 ramdisk_end = ramdisk_image + ramdisk_size;
+- u64 end_of_lowmem = max_low_pfn << PAGE_SHIFT;
++ u64 end_of_lowmem = max_low_pfn_mapped << PAGE_SHIFT;
+
+ if (!boot_params.hdr.type_of_loader ||
+ !ramdisk_image || !ramdisk_size)
+@@ -394,14 +391,8 @@ static void __init reserve_initrd(void)
+ return;
+ }
+
+-#ifdef CONFIG_X86_32
+ relocate_initrd();
+-#else
+- printk(KERN_ERR "initrd extends beyond end of memory "
+- "(0x%08llx > 0x%08llx)\ndisabling initrd\n",
+- ramdisk_end, end_of_lowmem);
+- initrd_start = 0;
+-#endif
++
+ free_early(ramdisk_image, ramdisk_end);
+ }
+ #else
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:24:29 2009
+Message-Id: <20090701002429.036408184@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:23:39 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Takashi Iwai <tiwai@suse.de>
+Subject: [patch 050/108] ALSA: ca0106 - Add missing registrations of vmaster controls
+References: <20090701002249.937782934@mini.kroah.org>
+Content-Disposition: inline; filename=alsa-ca0106-add-missing-registrations-of-vmaster-controls.patch
+Content-Length: 1035
+Lines: 38
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 601e1cc5df940b59e71c947726640811897d30df upstream.
+
+Although the vmaster controls are created, they aren't registered thus
+they don't appear in the real world. Added the missing snd_ctl_add()
+calls.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/ca0106/ca0106_mixer.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/sound/pci/ca0106/ca0106_mixer.c
++++ b/sound/pci/ca0106/ca0106_mixer.c
+@@ -841,6 +841,9 @@ int __devinit snd_ca0106_mixer(struct sn
+ snd_ca0106_master_db_scale);
+ if (!vmaster)
+ return -ENOMEM;
++ err = snd_ctl_add(card, vmaster);
++ if (err < 0)
++ return err;
+ add_slaves(card, vmaster, slave_vols);
+
+ if (emu->details->spi_dac == 1) {
+@@ -848,6 +851,9 @@ int __devinit snd_ca0106_mixer(struct sn
+ NULL);
+ if (!vmaster)
+ return -ENOMEM;
++ err = snd_ctl_add(card, vmaster);
++ if (err < 0)
++ return err;
+ add_slaves(card, vmaster, slave_sws);
+ }
+ return 0;
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:24:29 2009
+Message-Id: <20090701002429.246830955@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:23:40 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Takashi Iwai <tiwai@suse.de>
+Subject: [patch 051/108] ALSA: intel8x0 - Fix PCM position craziness
+References: <20090701002249.937782934@mini.kroah.org>
+Content-Disposition: inline; filename=alsa-intel8x0-fix-pcm-position-craziness.patch
+Content-Length: 2741
+Lines: 85
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit f708eb1d71dc8ffb184da9f0bc53461c6dc10653 upstream.
+
+The PCM pointer callback sometimes returns invalid positions and this
+screws up the hw_ptr updater in PCM core. Especially since now the
+jiffies check is optional with xrun_debug, the invalid position is
+handled as is, and causes serious sound skips, etc.
+
+This patch simplifies the position-fix strategy in intel8x0 to be more
+robust:
+- just falls back to the last position if bogus position is detected
+- another sanity check for the backward move of the position due to
+ a race of register update and the base-index update
+
+This patch is applicable also for 2.6.30.
+
+Tested-by: David Miller <davem@davemloft.net>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/intel8x0.c | 24 ++++++++++++------------
+ 1 file changed, 12 insertions(+), 12 deletions(-)
+
+--- a/sound/pci/intel8x0.c
++++ b/sound/pci/intel8x0.c
+@@ -356,8 +356,6 @@ struct ichdev {
+ unsigned int position;
+ unsigned int pos_shift;
+ unsigned int last_pos;
+- unsigned long last_pos_jiffies;
+- unsigned int jiffy_to_bytes;
+ int frags;
+ int lvi;
+ int lvi_frag;
+@@ -844,7 +842,6 @@ static int snd_intel8x0_pcm_trigger(stru
+ case SNDRV_PCM_TRIGGER_PAUSE_RELEASE:
+ val = ICH_IOCE | ICH_STARTBM;
+ ichdev->last_pos = ichdev->position;
+- ichdev->last_pos_jiffies = jiffies;
+ break;
+ case SNDRV_PCM_TRIGGER_SUSPEND:
+ ichdev->suspended = 1;
+@@ -1048,7 +1045,6 @@ static int snd_intel8x0_pcm_prepare(stru
+ ichdev->pos_shift = (runtime->sample_bits > 16) ? 2 : 1;
+ }
+ snd_intel8x0_setup_periods(chip, ichdev);
+- ichdev->jiffy_to_bytes = (runtime->rate * 4 * ichdev->pos_shift) / HZ;
+ return 0;
+ }
+
+@@ -1073,19 +1069,23 @@ static snd_pcm_uframes_t snd_intel8x0_pc
+ ptr1 == igetword(chip, ichdev->reg_offset + ichdev->roff_picb))
+ break;
+ } while (timeout--);
++ ptr = ichdev->last_pos;
+ if (ptr1 != 0) {
+ ptr1 <<= ichdev->pos_shift;
+ ptr = ichdev->fragsize1 - ptr1;
+ ptr += position;
+- ichdev->last_pos = ptr;
+- ichdev->last_pos_jiffies = jiffies;
+- } else {
+- ptr1 = jiffies - ichdev->last_pos_jiffies;
+- if (ptr1)
+- ptr1 -= 1;
+- ptr = ichdev->last_pos + ptr1 * ichdev->jiffy_to_bytes;
+- ptr %= ichdev->size;
++ if (ptr < ichdev->last_pos) {
++ unsigned int pos_base, last_base;
++ pos_base = position / ichdev->fragsize1;
++ last_base = ichdev->last_pos / ichdev->fragsize1;
++ /* another sanity check; ptr1 can go back to full
++ * before the base position is updated
++ */
++ if (pos_base == last_base)
++ ptr = ichdev->last_pos;
++ }
+ }
++ ichdev->last_pos = ptr;
+ spin_unlock(&chip->reg_lock);
+ if (ptr >= ichdev->size)
+ return 0;
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:24:29 2009
+Message-Id: <20090701002429.486907616@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:23:41 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Takashi Iwai <tiwai@suse.de>
+Subject: [patch 052/108] ALSA: hda - Get back Input Source for ALC262 toshiba-s06 model
+References: <20090701002249.937782934@mini.kroah.org>
+Content-Disposition: inline; filename=alsa-hda-get-back-input-source-for-alc262-toshiba-s06-model.patch
+Content-Length: 950
+Lines: 29
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit ae14ef68e8e67ca5b8b29f0eb640f7c106617f4e upstream.
+
+The commit f9e336f65b666b8f1764d17e9b7c21c90748a37e
+ ALSA: hda - Unify capture mixer creation in realtek codes
+removed the "Input Source" mixer element creation for toshiba-s06 model
+because it contains a digital-mic input.
+
+This patch take the control back.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/hda/patch_realtek.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -11122,6 +11122,7 @@ static struct alc_config_preset alc262_p
+ .capsrc_nids = alc262_dmic_capsrc_nids,
+ .dac_nids = alc262_dac_nids,
+ .adc_nids = alc262_dmic_adc_nids, /* ADC0 */
++ .num_adc_nids = 1, /* single ADC */
+ .dig_out_nid = ALC262_DIGOUT_NID,
+ .num_channel_mode = ARRAY_SIZE(alc262_modes),
+ .channel_mode = alc262_modes,
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:24:29 2009
+Message-Id: <20090701002429.681512248@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:23:42 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Takashi Iwai <tiwai@suse.de>
+Subject: [patch 053/108] ALSA: hda - Add quirk for Sony VAIO Z21MN
+References: <20090701002249.937782934@mini.kroah.org>
+Content-Disposition: inline; filename=alsa-hda-add-quirk-for-sony-vaio-z21mn.patch
+Content-Length: 884
+Lines: 24
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 376b508ffde3b17e105265f89b83bdb044b1c1ae upstream.
+
+It needs model=toshiba-s06 to work with the digital-mic.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/hda/patch_realtek.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -10915,6 +10915,7 @@ static struct snd_pci_quirk alc262_cfg_t
+ SND_PCI_QUIRK(0x104d, 0x8203, "Sony UX-90", ALC262_HIPPO),
+ SND_PCI_QUIRK(0x104d, 0x820f, "Sony ASSAMD", ALC262_SONY_ASSAMD),
+ SND_PCI_QUIRK(0x104d, 0x9016, "Sony VAIO", ALC262_AUTO), /* dig-only */
++ SND_PCI_QUIRK(0x104d, 0x9025, "Sony VAIO Z21MN", ALC262_TOSHIBA_S06),
+ SND_PCI_QUIRK_MASK(0x104d, 0xff00, 0x9000, "Sony VAIO",
+ ALC262_SONY_ASSAMD),
+ SND_PCI_QUIRK(0x1179, 0x0001, "Toshiba dynabook SS RX1",
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:24:30 2009
+Message-Id: <20090701002429.939348846@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:23:43 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Ondrej Zary <linux@rainbow-software.org>,
+ Takashi Iwai <tiwai@suse.de>
+Subject: [patch 054/108] ALSA: cmi8330: fix MPU-401 PnP init copy&paste bug
+References: <20090701002249.937782934@mini.kroah.org>
+Content-Disposition: inline; filename=alsa-cmi8330-fix-mpu-401-pnp-init-copy-paste-bug.patch
+Content-Length: 689
+Lines: 26
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Ondrej Zary <linux@rainbow-software.org>
+
+commit c2a30d711852e4f39c8a79135b3caa701f7a8e02 upstream.
+
+Fix copy&paste bug in PnP MPU-401 initialization.
+
+Signed-off-by: Ondrej Zary <linux@rainbow-software.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/isa/cmi8330.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/isa/cmi8330.c
++++ b/sound/isa/cmi8330.c
+@@ -338,7 +338,7 @@ static int __devinit snd_cmi8330_pnp(int
+ return -EBUSY;
+
+ acard->mpu = pnp_request_card_device(card, id->devs[2].id, NULL);
+- if (acard->play == NULL)
++ if (acard->mpu == NULL)
+ return -EBUSY;
+
+ pdev = acard->cap;
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:24:30 2009
+Message-Id: <20090701002430.420296635@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:23:44 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Thomas Gleixner <tglx@linutronix.de>
+Subject: [patch 055/108] x86: hpet: Mark per cpu interrupts IRQF_TIMER to prevent resume failure
+References: <20090701002249.937782934@mini.kroah.org>
+Content-Disposition: inline; filename=x86-hpet-mark-per-cpu-interrupts-irqf_timer-to-prevent-resume-failure.patch
+Content-Length: 1263
+Lines: 38
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Thomas Gleixner <tglx@linutronix.de>
+
+commit 507fa3a3d80365c595113a5ac3232309e3dbf5d8 upstream.
+
+timer interrupts are excluded from being disabled during suspend. The
+clock events code manages the disabling of clock events on its own
+because the timer interrupt needs to be functional before the resume
+code reenables the device interrupts.
+
+The hpet per cpu timers request their interrupt without setting the
+IRQF_TIMER flag so suspend_device_irqs() disables them as well which
+results in a fatal resume failure on the boot CPU.
+
+Adding IRQF_TIMER to the interupt flags when requesting the hpet per
+cpu timer interrupts solves the problem.
+
+Reported-by: Benjamin S. <sbenni@gmx.de>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Tested-by: Benjamin S. <sbenni@gmx.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/hpet.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/arch/x86/kernel/hpet.c
++++ b/arch/x86/kernel/hpet.c
+@@ -510,7 +510,8 @@ static int hpet_setup_irq(struct hpet_de
+ {
+
+ if (request_irq(dev->irq, hpet_interrupt_handler,
+- IRQF_DISABLED|IRQF_NOBALANCING, dev->name, dev))
++ IRQF_TIMER | IRQF_DISABLED | IRQF_NOBALANCING,
++ dev->name, dev))
+ return -1;
+
+ disable_irq(dev->irq);
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:24:30 2009
+Message-Id: <20090701002430.625001014@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:23:45 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Nicolas Pitre <nico@marvell.com>,
+ Russell King <rmk+kernel@arm.linux.org.uk>
+Subject: [patch 056/108] ARM: 5545/2: add flush_kernel_dcache_page() for ARM
+References: <20090701002249.937782934@mini.kroah.org>
+Content-Disposition: inline; filename=arm-5545-2-add-flush_kernel_dcache_page-for-arm.patch
+Content-Length: 1180
+Lines: 36
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Nicolas Pitre <nico@cam.org>
+
+commit 73be1591579084a8103a7005dd3172f3e9dd7362 upstream.
+
+Without this, the default implementation is a no op which is completely
+wrong with a VIVT cache, and usage of sg_copy_buffer() produces
+unpredictable results.
+
+Tested-by: Sebastian Andrzej Siewior <bigeasy@breakpoint.cc>
+
+Signed-off-by: Nicolas Pitre <nico@marvell.com>
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/arm/include/asm/cacheflush.h | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/arch/arm/include/asm/cacheflush.h
++++ b/arch/arm/include/asm/cacheflush.h
+@@ -429,6 +429,14 @@ static inline void flush_anon_page(struc
+ __flush_anon_page(vma, page, vmaddr);
+ }
+
++#define ARCH_HAS_FLUSH_KERNEL_DCACHE_PAGE
++static inline void flush_kernel_dcache_page(struct page *page)
++{
++ /* highmem pages are always flushed upon kunmap already */
++ if ((cache_is_vivt() || cache_is_vipt_aliasing()) && !PageHighMem(page))
++ __cpuc_flush_dcache_page(page_address(page));
++}
++
+ #define flush_dcache_mmap_lock(mapping) \
+ spin_lock_irq(&(mapping)->tree_lock)
+ #define flush_dcache_mmap_unlock(mapping) \
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:24:31 2009
+Message-Id: <20090701002430.902345957@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:23:46 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jack Morgenstein <jackm@dev.mellanox.co.il>,
+ Roland Dreier <rolandd@cisco.com>
+Subject: [patch 057/108] IB/mlx4: Add strong ordering to local inval and fast reg work requests
+References: <20090701002249.937782934@mini.kroah.org>
+Content-Disposition: inline; filename=ib-mlx4-add-strong-ordering-to-local-inval-and-fast-reg-work-requests.patch
+Content-Length: 1887
+Lines: 54
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Jack Morgenstein <jackm@dev.mellanox.co.il>
+
+commit 2ac6bf4ddc87c3b6b609f8fa82f6ebbffeac12f4 upstream.
+
+The ConnectX Programmer's Reference Manual states that the "SO" bit
+must be set when posting Fast Register and Local Invalidate send work
+requests. When this bit is set, the work request will be executed
+only after all previous work requests on the send queue have been
+executed. (If the bit is not set, Fast Register and Local Invalidate
+WQEs may begin execution too early, which violates the defined
+semantics for these operations)
+
+This fixes the issue with NFS/RDMA reported in
+<http://lists.openfabrics.org/pipermail/general/2009-April/059253.html>
+
+Signed-off-by: Jack Morgenstein <jackm@dev.mellanox.co.il>
+Signed-off-by: Roland Dreier <rolandd@cisco.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/infiniband/hw/mlx4/qp.c | 4 ++++
+ include/linux/mlx4/qp.h | 1 +
+ 2 files changed, 5 insertions(+)
+
+--- a/drivers/infiniband/hw/mlx4/qp.c
++++ b/drivers/infiniband/hw/mlx4/qp.c
+@@ -1585,12 +1585,16 @@ int mlx4_ib_post_send(struct ib_qp *ibqp
+ break;
+
+ case IB_WR_LOCAL_INV:
++ ctrl->srcrb_flags |=
++ cpu_to_be32(MLX4_WQE_CTRL_STRONG_ORDER);
+ set_local_inv_seg(wqe, wr->ex.invalidate_rkey);
+ wqe += sizeof (struct mlx4_wqe_local_inval_seg);
+ size += sizeof (struct mlx4_wqe_local_inval_seg) / 16;
+ break;
+
+ case IB_WR_FAST_REG_MR:
++ ctrl->srcrb_flags |=
++ cpu_to_be32(MLX4_WQE_CTRL_STRONG_ORDER);
+ set_fmr_seg(wqe, wr);
+ wqe += sizeof (struct mlx4_wqe_fmr_seg);
+ size += sizeof (struct mlx4_wqe_fmr_seg) / 16;
+--- a/include/linux/mlx4/qp.h
++++ b/include/linux/mlx4/qp.h
+@@ -165,6 +165,7 @@ enum {
+ MLX4_WQE_CTRL_IP_CSUM = 1 << 4,
+ MLX4_WQE_CTRL_TCP_UDP_CSUM = 1 << 5,
+ MLX4_WQE_CTRL_INS_VLAN = 1 << 6,
++ MLX4_WQE_CTRL_STRONG_ORDER = 1 << 7,
+ };
+
+ struct mlx4_wqe_ctrl_seg {
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:24:31 2009
+Message-Id: <20090701002431.096318663@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:23:47 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Davide Libenzi <davidel@xmailserver.org>
+Subject: [patch 058/108] epoll: fix nested calls support
+References: <20090701002249.937782934@mini.kroah.org>
+Content-Disposition: inline; filename=epoll-fix-nested-calls-support.patch
+Content-Length: 3602
+Lines: 114
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Davide Libenzi <davidel@xmailserver.org>
+
+commit 3fe4a975d662f11037cb710f8b4b158a3e38f9c0 upstream.
+
+This fixes a regression in 2.6.30.
+
+I unfortunately accepted a patch time ago, to drop the "current" usage
+from possible IRQ context, w/out proper thought over it. The patch
+switched to using the CPU id by bounding the nested call callback with a
+get_cpu()/put_cpu().
+
+Unfortunately the ep_call_nested() function can be called with a callback
+that grabs sleepy locks (from own f_op->poll()), that results in epic
+fails. The following patch uses the proper "context" depending on the
+path where it is called, and on the kind of callback.
+
+This has been reported by Stefan Richter, that has also verified the patch
+is his previously failing environment.
+
+Signed-off-by: Davide Libenzi <davidel@xmailserver.org>
+Reported-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/eventpoll.c | 21 ++++++++++++---------
+ 1 file changed, 12 insertions(+), 9 deletions(-)
+
+--- a/fs/eventpoll.c
++++ b/fs/eventpoll.c
+@@ -98,7 +98,7 @@ struct epoll_filefd {
+ struct nested_call_node {
+ struct list_head llink;
+ void *cookie;
+- int cpu;
++ void *ctx;
+ };
+
+ /*
+@@ -317,17 +317,17 @@ static void ep_nested_calls_init(struct
+ * @nproc: Nested call core function pointer.
+ * @priv: Opaque data to be passed to the @nproc callback.
+ * @cookie: Cookie to be used to identify this nested call.
++ * @ctx: This instance context.
+ *
+ * Returns: Returns the code returned by the @nproc callback, or -1 if
+ * the maximum recursion limit has been exceeded.
+ */
+ static int ep_call_nested(struct nested_calls *ncalls, int max_nests,
+ int (*nproc)(void *, void *, int), void *priv,
+- void *cookie)
++ void *cookie, void *ctx)
+ {
+ int error, call_nests = 0;
+ unsigned long flags;
+- int this_cpu = get_cpu();
+ struct list_head *lsthead = &ncalls->tasks_call_list;
+ struct nested_call_node *tncur;
+ struct nested_call_node tnode;
+@@ -340,7 +340,7 @@ static int ep_call_nested(struct nested_
+ * very much limited.
+ */
+ list_for_each_entry(tncur, lsthead, llink) {
+- if (tncur->cpu == this_cpu &&
++ if (tncur->ctx == ctx &&
+ (tncur->cookie == cookie || ++call_nests > max_nests)) {
+ /*
+ * Ops ... loop detected or maximum nest level reached.
+@@ -352,7 +352,7 @@ static int ep_call_nested(struct nested_
+ }
+
+ /* Add the current task and cookie to the list */
+- tnode.cpu = this_cpu;
++ tnode.ctx = ctx;
+ tnode.cookie = cookie;
+ list_add(&tnode.llink, lsthead);
+
+@@ -364,10 +364,9 @@ static int ep_call_nested(struct nested_
+ /* Remove the current task from the list */
+ spin_lock_irqsave(&ncalls->lock, flags);
+ list_del(&tnode.llink);
+- out_unlock:
++out_unlock:
+ spin_unlock_irqrestore(&ncalls->lock, flags);
+
+- put_cpu();
+ return error;
+ }
+
+@@ -408,8 +407,12 @@ static int ep_poll_wakeup_proc(void *pri
+ */
+ static void ep_poll_safewake(wait_queue_head_t *wq)
+ {
++ int this_cpu = get_cpu();
++
+ ep_call_nested(&poll_safewake_ncalls, EP_MAX_NESTS,
+- ep_poll_wakeup_proc, NULL, wq);
++ ep_poll_wakeup_proc, NULL, wq, (void *) (long) this_cpu);
++
++ put_cpu();
+ }
+
+ /*
+@@ -663,7 +666,7 @@ static unsigned int ep_eventpoll_poll(st
+ * could re-enter here.
+ */
+ pollflags = ep_call_nested(&poll_readywalk_ncalls, EP_MAX_NESTS,
+- ep_poll_readyevents_proc, ep, ep);
++ ep_poll_readyevents_proc, ep, ep, current);
+
+ return pollflags != -1 ? pollflags : 0;
+ }
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:24:31 2009
+Message-Id: <20090701002431.551098249@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:23:48 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Peter Zijlstra <a.p.zijlstra@chello.nl>,
+ Ingo Molnar <mingo@elte.hu>
+Subject: [patch 059/108] lockdep: Select frame pointers on x86
+References: <20090701002249.937782934@mini.kroah.org>
+Content-Disposition: inline; filename=lockdep-select-frame-pointers-on-x86.patch
+Content-Length: 973
+Lines: 30
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Peter Zijlstra <a.p.zijlstra@chello.nl>
+
+commit 00540e5d54be972a94a3b2ce6da8621bebe731a2 upstream.
+
+x86 stack traces are a piece of crap without frame pointers, and its not
+like the 'performance gain' of not having stack pointers matters when you
+selected lockdep.
+
+Reported-by: Andrew Morton <akpm@linux-foundation.org>
+LKML-Reference: <new-submission>
+Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ lib/Kconfig.debug | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/lib/Kconfig.debug
++++ b/lib/Kconfig.debug
+@@ -440,7 +440,7 @@ config LOCKDEP
+ bool
+ depends on DEBUG_KERNEL && TRACE_IRQFLAGS_SUPPORT && STACKTRACE_SUPPORT && LOCKDEP_SUPPORT
+ select STACKTRACE
+- select FRAME_POINTER if !X86 && !MIPS && !PPC && !ARM_UNWIND && !S390
++ select FRAME_POINTER if !MIPS && !PPC && !ARM_UNWIND && !S390
+ select KALLSYMS
+ select KALLSYMS_ALL
+
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:24:32 2009
+Message-Id: <20090701002431.928514647@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:23:49 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Mark Brown <broonie@opensource.wolfsonmicro.com>
+Subject: [patch 060/108] ASoC: Remove odd bit clock ratios for WM8903
+References: <20090701002249.937782934@mini.kroah.org>
+Content-Disposition: inline; filename=asoc-remove-odd-bit-clock-ratios-for-wm8903.patch
+Content-Length: 829
+Lines: 40
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Mark Brown <broonie@opensource.wolfsonmicro.com>
+
+commit ba2533a47865ec0dbc72834287a8a048e9337a95 upstream.
+
+These are not supported since performance can not be guaranteed
+when they are in use.
+
+Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/soc/codecs/wm8903.c | 4 ----
+ 1 file changed, 4 deletions(-)
+
+--- a/sound/soc/codecs/wm8903.c
++++ b/sound/soc/codecs/wm8903.c
+@@ -1215,22 +1215,18 @@ static struct {
+ int div;
+ } bclk_divs[] = {
+ { 10, 0 },
+- { 15, 1 },
+ { 20, 2 },
+ { 30, 3 },
+ { 40, 4 },
+ { 50, 5 },
+- { 55, 6 },
+ { 60, 7 },
+ { 80, 8 },
+ { 100, 9 },
+- { 110, 10 },
+ { 120, 11 },
+ { 160, 12 },
+ { 200, 13 },
+ { 220, 14 },
+ { 240, 15 },
+- { 250, 16 },
+ { 300, 17 },
+ { 320, 18 },
+ { 440, 19 },
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:24:32 2009
+Message-Id: <20090701002432.106047414@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:23:50 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Mike Frysinger <vapier@gentoo.org>,
+ Hugh Dickins <hugh.dickins@tiscali.co.uk>,
+ Matt Mackall <mpm@selenic.com>,
+ Wu Fengguang <fengguang.wu@intel.com>
+Subject: [patch 061/108] ramfs: ignore unknown mount options
+References: <20090701002249.937782934@mini.kroah.org>
+Content-Disposition: inline; filename=ramfs-ignore-unknown-mount-options.patch
+Content-Length: 1834
+Lines: 50
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Mike Frysinger <vapier@gentoo.org>
+
+commit 0a8eba9b7f7aa3ad0305627c99ad4d6deedd871d upstream.
+
+On systems where CONFIG_SHMEM is disabled, mounting tmpfs filesystems can
+fail when tmpfs options are used. This is because tmpfs creates a small
+wrapper around ramfs which rejects unknown options, and ramfs itself only
+supports a tiny subset of what tmpfs supports. This makes it pretty hard
+to use the same userspace systems across different configuration systems.
+As such, ramfs should ignore the tmpfs options when tmpfs is merely a
+wrapper around ramfs.
+
+This used to work before commit c3b1b1cbf0 as previously, ramfs would
+ignore all options. But now, we get:
+ramfs: bad mount option: size=10M
+mount: mounting mdev on /dev failed: Invalid argument
+
+Another option might be to restore the previous behavior, where ramfs
+simply ignored all unknown mount options ... which is what Hugh prefers.
+
+Signed-off-by: Mike Frysinger <vapier@gentoo.org>
+Signed-off-by: Hugh Dickins <hugh.dickins@tiscali.co.uk>
+Acked-by: Matt Mackall <mpm@selenic.com>
+Acked-by: Wu Fengguang <fengguang.wu@intel.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/ramfs/inode.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+--- a/fs/ramfs/inode.c
++++ b/fs/ramfs/inode.c
+@@ -202,9 +202,12 @@ static int ramfs_parse_options(char *dat
+ return -EINVAL;
+ opts->mode = option & S_IALLUGO;
+ break;
+- default:
+- printk(KERN_ERR "ramfs: bad mount option: %s\n", p);
+- return -EINVAL;
++ /*
++ * We might like to report bad mount options here;
++ * but traditionally ramfs has ignored all mount options,
++ * and as it is used as a !CONFIG_SHMEM simple substitute
++ * for tmpfs, better continue to ignore other mount options.
++ */
+ }
+ }
+
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:24:32 2009
+Message-Id: <20090701002432.385500243@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:23:51 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Bob Copeland <me@bobcopeland.com>,
+ "John W. Linville" <linville@tuxdriver.com>
+Subject: [patch 062/108] mac80211: fix minstrel single-rate memory corruption
+References: <20090701002249.937782934@mini.kroah.org>
+Content-Disposition: inline; filename=mac80211-fix-minstrel-single-rate-memory-corruption.patch
+Content-Length: 1975
+Lines: 49
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Bob Copeland <me@bobcopeland.com>
+
+commit 5ee58d7e6ad019675b4090582aec4fa1180d8703 upstream.
+
+The minstrel rate controller periodically looks up rate indexes in
+a sampling table. When accessing a specific row and column, minstrel
+correctly does a bounds check which, on the surface, appears to handle
+the case where mi->n_rates < 2. However, mi->sample_idx is actually
+defined as an unsigned, so the right hand side is taken to be a huge
+positive number when negative, and the check will always fail.
+
+Consequently, the RC will overrun the array and cause random memory
+corruption when communicating with a peer that has only a single rate.
+The max value of mi->sample_idx is around 25 so casting to int should
+have no ill effects.
+
+Without the change, uptime is a few minutes under load with an AP
+that has a single hard-coded rate, and both the AP and STA could
+potentially crash. With the change, both lasted 12 hours with a
+steady load.
+
+Thanks to Ognjen Maric for providing the single-rate clue so I could
+reproduce this.
+
+This fixes http://bugzilla.kernel.org/show_bug.cgi?id=12490 on the
+regression list (also http://bugzilla.kernel.org/show_bug.cgi?id=13000).
+
+Reported-by: Sergey S. Kostyliov <rathamahata@gmail.com>
+Reported-by: Ognjen Maric <ognjen.maric@gmail.com>
+Signed-off-by: Bob Copeland <me@bobcopeland.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/mac80211/rc80211_minstrel.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/mac80211/rc80211_minstrel.c
++++ b/net/mac80211/rc80211_minstrel.c
+@@ -216,7 +216,7 @@ minstrel_get_next_sample(struct minstrel
+ unsigned int sample_ndx;
+ sample_ndx = SAMPLE_TBL(mi, mi->sample_idx, mi->sample_column);
+ mi->sample_idx++;
+- if (mi->sample_idx > (mi->n_rates - 2)) {
++ if ((int) mi->sample_idx > (mi->n_rates - 2)) {
+ mi->sample_idx = 0;
+ mi->sample_column++;
+ if (mi->sample_column >= SAMPLE_COLUMNS)
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:24:32 2009
+Message-Id: <20090701002432.655132080@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:23:52 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ "Luis R. Rodriguez" <lrodriguez@atheros.com>,
+ "John W. Linville" <linville@tuxdriver.com>
+Subject: [patch 063/108] cfg80211: fix for duplicate userspace replies
+References: <20090701002249.937782934@mini.kroah.org>
+Content-Disposition: inline; filename=cfg80211-fix-for-duplicate-userspace-replies.patch
+Content-Length: 1555
+Lines: 46
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Luis R. Rodriguez <lrodriguez@atheros.com>
+
+commit 729e9c7663190d71fe5e29831634df80f38199c1 upstream.
+
+This fixes an incorrect assumption (BUG_ON) made in
+cfg80211 when handling country IE regulatory requests.
+The assumption was that we won't try to call_crda()
+twice for the same event and therefore we will not
+recieve two replies through nl80211 for the regulatory
+request. As it turns out it is true we don't call_crda()
+twice for the same event, however, kobject_uevent_env()
+*might* send the udev event twice and/or userspace can
+simply process the udev event twice. We remove the BUG_ON()
+and simply ignore the duplicate request.
+
+For details refer to this thread:
+
+http://marc.info/?l=linux-wireless&m=124149987921337&w=2
+
+Reported-by: Maxim Levitsky <maximlevitsky@gmail.com>
+Signed-off-by: Luis R. Rodriguez <lrodriguez@atheros.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/wireless/reg.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+--- a/net/wireless/reg.c
++++ b/net/wireless/reg.c
+@@ -2042,7 +2042,13 @@ static int __set_regdom(const struct iee
+ * the country IE rd with what CRDA believes that country should have
+ */
+
+- BUG_ON(!country_ie_regdomain);
++ /*
++ * Userspace could have sent two replies with only
++ * one kernel request. By the second reply we would have
++ * already processed and consumed the country_ie_regdomain.
++ */
++ if (!country_ie_regdomain)
++ return -EALREADY;
+ BUG_ON(rd == country_ie_regdomain);
+
+ /*
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:24:33 2009
+Message-Id: <20090701002432.844204006@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:23:53 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ "Luis R. Rodriguez" <lrodriguez@atheros.com>,
+ "John W. Linville" <linville@tuxdriver.com>
+Subject: [patch 064/108] cfg80211: cleanup return calls on nl80211_set_reg()
+References: <20090701002249.937782934@mini.kroah.org>
+Content-Disposition: inline; filename=cfg80211-cleanup-return-calls-on-nl80211_set_reg.patch
+Content-Length: 1611
+Lines: 68
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Luis R. Rodriguez <lrodriguez@atheros.com>
+
+commit d0e18f833d23afefb6751a21d14a2cd71d2d4d66 upstream.
+
+This has no functional change, but it will make the race
+fix easier to spot in my next patch.
+
+Signed-off-by: Luis R. Rodriguez <lrodriguez@atheros.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/wireless/nl80211.c | 19 +++++++++++++------
+ 1 file changed, 13 insertions(+), 6 deletions(-)
+
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -2388,15 +2388,19 @@ static int nl80211_set_reg(struct sk_buf
+ goto bad_reg;
+ }
+
+- if (!reg_is_valid_request(alpha2))
+- return -EINVAL;
++ if (!reg_is_valid_request(alpha2)) {
++ r = -EINVAL;
++ goto bad_reg;
++ }
+
+ size_of_regd = sizeof(struct ieee80211_regdomain) +
+ (num_rules * sizeof(struct ieee80211_reg_rule));
+
+ rd = kzalloc(size_of_regd, GFP_KERNEL);
+- if (!rd)
+- return -ENOMEM;
++ if (!rd) {
++ r = -ENOMEM;
++ goto bad_reg;
++ }
+
+ rd->n_reg_rules = num_rules;
+ rd->alpha2[0] = alpha2[0];
+@@ -2413,8 +2417,10 @@ static int nl80211_set_reg(struct sk_buf
+
+ rule_idx++;
+
+- if (rule_idx > NL80211_MAX_SUPP_REG_RULES)
++ if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
++ r = -EINVAL;
+ goto bad_reg;
++ }
+ }
+
+ BUG_ON(rule_idx != num_rules);
+@@ -2422,11 +2428,12 @@ static int nl80211_set_reg(struct sk_buf
+ mutex_lock(&cfg80211_mutex);
+ r = set_regdom(rd);
+ mutex_unlock(&cfg80211_mutex);
++
+ return r;
+
+ bad_reg:
+ kfree(rd);
+- return -EINVAL;
++ return r;
+ }
+
+ static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:24:33 2009
+Message-Id: <20090701002433.285649572@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:23:54 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ "Luis R. Rodriguez" <lrodriguez@atheros.com>,
+ "John W. Linville" <linville@tuxdriver.com>
+Subject: [patch 065/108] cfg80211: return immediately if num reg rules > NL80211_MAX_SUPP_REG_RULES
+References: <20090701002249.937782934@mini.kroah.org>
+Content-Disposition: inline; filename=cfg80211-return-immediately-if-num-reg-rules-nl80211_max_supp_reg_rules.patch
+Content-Length: 831
+Lines: 28
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Luis R. Rodriguez <lrodriguez@atheros.com>
+
+commit 4776c6e7f66f853011bc1fd6fe37fa63f0b6982c upstream.
+
+This has no functional change except we save a kfree(rd) and
+allows us to clean this code up a bit after this. We do
+avoid an unnecessary kfree(NULL) but calling that was OK too.
+
+Signed-off-by: Luis R. Rodriguez <lrodriguez@atheros.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/wireless/nl80211.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -2385,7 +2385,7 @@ static int nl80211_set_reg(struct sk_buf
+ rem_reg_rules) {
+ num_rules++;
+ if (num_rules > NL80211_MAX_SUPP_REG_RULES)
+- goto bad_reg;
++ return -EINVAL;
+ }
+
+ if (!reg_is_valid_request(alpha2)) {
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:24:33 2009
+Message-Id: <20090701002433.711620126@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:23:55 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ "Luis R. Rodriguez" <lrodriguez@atheros.com>,
+ "John W. Linville" <linville@tuxdriver.com>
+Subject: [patch 066/108] cfg80211: fix in nl80211_set_reg()
+References: <20090701002249.937782934@mini.kroah.org>
+Content-Disposition: inline; filename=cfg80211-fix-in-nl80211_set_reg.patch
+Content-Length: 1563
+Lines: 59
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Luis R. Rodriguez <lrodriguez@atheros.com>
+
+commit 61405e97788b1bc4e7c5be5b4ec04a73fc11bac2 upstream.
+
+There is a race on access to last_request and its alpha2
+through reg_is_valid_request() and us possibly processing
+first another regulatory request on another CPU. We avoid
+this improbably race by locking with the cfg80211_mutex as
+we should have done in the first place. While at it add
+the assert on locking on reg_is_valid_request().
+
+Signed-off-by: Luis R. Rodriguez <lrodriguez@atheros.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/wireless/nl80211.c | 5 ++++-
+ net/wireless/reg.c | 2 ++
+ 2 files changed, 6 insertions(+), 1 deletion(-)
+
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -2388,6 +2388,8 @@ static int nl80211_set_reg(struct sk_buf
+ return -EINVAL;
+ }
+
++ mutex_lock(&cfg80211_mutex);
++
+ if (!reg_is_valid_request(alpha2)) {
+ r = -EINVAL;
+ goto bad_reg;
+@@ -2425,13 +2427,14 @@ static int nl80211_set_reg(struct sk_buf
+
+ BUG_ON(rule_idx != num_rules);
+
+- mutex_lock(&cfg80211_mutex);
+ r = set_regdom(rd);
++
+ mutex_unlock(&cfg80211_mutex);
+
+ return r;
+
+ bad_reg:
++ mutex_unlock(&cfg80211_mutex);
+ kfree(rd);
+ return r;
+ }
+--- a/net/wireless/reg.c
++++ b/net/wireless/reg.c
+@@ -389,6 +389,8 @@ static int call_crda(const char *alpha2)
+ /* Used by nl80211 before kmalloc'ing our regulatory domain */
+ bool reg_is_valid_request(const char *alpha2)
+ {
++ assert_cfg80211_lock();
++
+ if (!last_request)
+ return false;
+
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:24:34 2009
+Message-Id: <20090701002434.033636810@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:23:56 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ "Luis R. Rodriguez" <lrodriguez@atheros.com>,
+ "John W. Linville" <linville@tuxdriver.com>
+Subject: [patch 067/108] ath9k: Fix bug when using a card with a busted EEPROM
+References: <20090701002249.937782934@mini.kroah.org>
+Content-Disposition: inline; filename=ath9k-fix-bug-when-using-a-card-with-a-busted-eeprom.patch
+Content-Length: 1812
+Lines: 56
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Luis R. Rodriguez <lrodriguez@atheros.com>
+
+backport of commit 85efc86eb7c6cbb1c8ce8d99b10b948be033fbb9 upstream.
+
+We fail if your EEPROM is busted but we were never propagated the
+error back so such users could end up with a cryptic oops message
+like:
+
+IP: [<f883e1b9>] ath9k_reg_apply_world_flags+0x29/0x130 [ath9k]
+*pde = 00000000
+Oops: 0000 [#1] SMP
+Modules linked in: ath9k(+) mac80211 cfg80211
+Pid: 4284, comm: insmod Not tainted (2.6.29-wl #3) 7660A14
+EIP: 0060:[<f883e1b9>] EFLAGS: 00010286 CPU: 1
+EIP is at ath9k_reg_apply_world_flags+0x29/0x130 [ath9k]
+
+Fix this by propagating the error and also lets not leave the
+user in the dark and communicate what's going on. When this
+happens you will now see this:
+
+ath9k 0000:16:00.0: PCI INT A -> GSI 16 (level, low) -> IRQ 16
+ath9k: Invalid EEPROM contents
+
+Signed-off-by: Luis R. Rodriguez <lrodriguez@atheros.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/ath9k/main.c | 3 ++-
+ drivers/net/wireless/ath9k/regd.c | 2 +-
+ 2 files changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/ath9k/main.c
++++ b/drivers/net/wireless/ath9k/main.c
+@@ -1416,7 +1416,8 @@ static int ath_init(u16 devid, struct at
+ for (i = 0; i < sc->keymax; i++)
+ ath9k_hw_keyreset(ah, (u16) i);
+
+- if (ath9k_regd_init(sc->sc_ah))
++ error = ath9k_regd_init(sc->sc_ah);
++ if (error)
+ goto bad;
+
+ /* default to MONITOR mode */
+--- a/drivers/net/wireless/ath9k/regd.c
++++ b/drivers/net/wireless/ath9k/regd.c
+@@ -439,7 +439,7 @@ int ath9k_regd_init(struct ath_hw *ah)
+ u16 regdmn;
+
+ if (!ath9k_regd_is_eeprom_valid(ah)) {
+- DPRINTF(ah->ah_sc, ATH_DBG_REGULATORY,
++ DPRINTF(ah->ah_sc, ATH_DBG_FATAL,
+ "Invalid EEPROM contents\n");
+ return -EINVAL;
+ }
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:24:34 2009
+Message-Id: <20090701002434.361785637@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:23:57 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Sujith <Sujith.Manoharan@atheros.com>,
+ "John W. Linville" <linville@tuxdriver.com>
+Subject: [patch 068/108] ath9k: Fix bug in calibration initialization
+References: <20090701002249.937782934@mini.kroah.org>
+Content-Disposition: inline; filename=ath9k-fix-bug-in-calibration-initialization.patch
+Content-Length: 4318
+Lines: 125
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Sujith <Sujith.Manoharan@atheros.com>
+
+commit 04d19ddd254b404703151ab25aa5041e50ff40f7 upstream.
+
+This patch fixes a bug in ath9k_hw_init_cal() where the wrong
+calibration was being done for non-AR9285 chipsets.
+Also add a few helpful comments.
+
+Signed-off-by: Sujith <Sujith.Manoharan@atheros.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/ath9k/calib.c | 61 +++++++++++++------------------------
+ 1 file changed, 22 insertions(+), 39 deletions(-)
+
+--- a/drivers/net/wireless/ath9k/calib.c
++++ b/drivers/net/wireless/ath9k/calib.c
+@@ -919,83 +919,66 @@ static bool ar9285_clc(struct ath_hw *ah
+ return true;
+ }
+
+-bool ath9k_hw_init_cal(struct ath_hw *ah,
+- struct ath9k_channel *chan)
++bool ath9k_hw_init_cal(struct ath_hw *ah, struct ath9k_channel *chan)
+ {
+ if (AR_SREV_9285(ah) && AR_SREV_9285_12_OR_LATER(ah)) {
+ if (!ar9285_clc(ah, chan))
+ return false;
+- } else if (AR_SREV_9280_10_OR_LATER(ah)) {
+- REG_CLR_BIT(ah, AR_PHY_ADC_CTL, AR_PHY_ADC_CTL_OFF_PWDADC);
+- REG_SET_BIT(ah, AR_PHY_AGC_CONTROL, AR_PHY_AGC_CONTROL_FLTR_CAL);
+- REG_CLR_BIT(ah, AR_PHY_CL_CAL_CTL, AR_PHY_CL_CAL_ENABLE);
++ } else {
++ if (AR_SREV_9280_10_OR_LATER(ah)) {
++ REG_CLR_BIT(ah, AR_PHY_ADC_CTL, AR_PHY_ADC_CTL_OFF_PWDADC);
++ REG_SET_BIT(ah, AR_PHY_AGC_CONTROL, AR_PHY_AGC_CONTROL_FLTR_CAL);
++ }
+
+- /* Kick off the cal */
++ /* Calibrate the AGC */
+ REG_WRITE(ah, AR_PHY_AGC_CONTROL,
+- REG_READ(ah, AR_PHY_AGC_CONTROL) |
+- AR_PHY_AGC_CONTROL_CAL);
++ REG_READ(ah, AR_PHY_AGC_CONTROL) |
++ AR_PHY_AGC_CONTROL_CAL);
+
+- if (!ath9k_hw_wait(ah, AR_PHY_AGC_CONTROL,
+- AR_PHY_AGC_CONTROL_CAL, 0,
+- AH_WAIT_TIMEOUT)) {
++ /* Poll for offset calibration complete */
++ if (!ath9k_hw_wait(ah, AR_PHY_AGC_CONTROL, AR_PHY_AGC_CONTROL_CAL,
++ 0, AH_WAIT_TIMEOUT)) {
+ DPRINTF(ah->ah_sc, ATH_DBG_CALIBRATE,
+ "offset calibration failed to complete in 1ms; "
+ "noisy environment?\n");
+ return false;
+ }
+
+- REG_CLR_BIT(ah, AR_PHY_ADC_CTL, AR_PHY_ADC_CTL_OFF_PWDADC);
+- REG_SET_BIT(ah, AR_PHY_AGC_CONTROL, AR_PHY_AGC_CONTROL_FLTR_CAL);
+- REG_SET_BIT(ah, AR_PHY_CL_CAL_CTL, AR_PHY_CL_CAL_ENABLE);
+- }
+-
+- /* Calibrate the AGC */
+- REG_WRITE(ah, AR_PHY_AGC_CONTROL,
+- REG_READ(ah, AR_PHY_AGC_CONTROL) |
+- AR_PHY_AGC_CONTROL_CAL);
+-
+- if (!ath9k_hw_wait(ah, AR_PHY_AGC_CONTROL, AR_PHY_AGC_CONTROL_CAL,
+- 0, AH_WAIT_TIMEOUT)) {
+- DPRINTF(ah->ah_sc, ATH_DBG_CALIBRATE,
+- "offset calibration failed to complete in 1ms; "
+- "noisy environment?\n");
+- return false;
+- }
+-
+- if (AR_SREV_9280_10_OR_LATER(ah)) {
+- REG_SET_BIT(ah, AR_PHY_ADC_CTL, AR_PHY_ADC_CTL_OFF_PWDADC);
+- REG_CLR_BIT(ah, AR_PHY_AGC_CONTROL, AR_PHY_AGC_CONTROL_FLTR_CAL);
++ if (AR_SREV_9280_10_OR_LATER(ah)) {
++ REG_SET_BIT(ah, AR_PHY_ADC_CTL, AR_PHY_ADC_CTL_OFF_PWDADC);
++ REG_CLR_BIT(ah, AR_PHY_AGC_CONTROL, AR_PHY_AGC_CONTROL_FLTR_CAL);
++ }
+ }
+
+ /* Do PA Calibration */
+ if (AR_SREV_9285(ah) && AR_SREV_9285_11_OR_LATER(ah))
+ ath9k_hw_9285_pa_cal(ah);
+
+- /* Do NF Calibration */
++ /* Do NF Calibration after DC offset and other calibrations */
+ REG_WRITE(ah, AR_PHY_AGC_CONTROL,
+- REG_READ(ah, AR_PHY_AGC_CONTROL) |
+- AR_PHY_AGC_CONTROL_NF);
++ REG_READ(ah, AR_PHY_AGC_CONTROL) | AR_PHY_AGC_CONTROL_NF);
+
+ ah->cal_list = ah->cal_list_last = ah->cal_list_curr = NULL;
+
++ /* Enable IQ, ADC Gain and ADC DC offset CALs */
+ if (AR_SREV_9100(ah) || AR_SREV_9160_10_OR_LATER(ah)) {
+ if (ath9k_hw_iscal_supported(ah, ADC_GAIN_CAL)) {
+ INIT_CAL(&ah->adcgain_caldata);
+ INSERT_CAL(ah, &ah->adcgain_caldata);
+ DPRINTF(ah->ah_sc, ATH_DBG_CALIBRATE,
+- "enabling ADC Gain Calibration.\n");
++ "enabling ADC Gain Calibration.\n");
+ }
+ if (ath9k_hw_iscal_supported(ah, ADC_DC_CAL)) {
+ INIT_CAL(&ah->adcdc_caldata);
+ INSERT_CAL(ah, &ah->adcdc_caldata);
+ DPRINTF(ah->ah_sc, ATH_DBG_CALIBRATE,
+- "enabling ADC DC Calibration.\n");
++ "enabling ADC DC Calibration.\n");
+ }
+ if (ath9k_hw_iscal_supported(ah, IQ_MISMATCH_CAL)) {
+ INIT_CAL(&ah->iq_caldata);
+ INSERT_CAL(ah, &ah->iq_caldata);
+ DPRINTF(ah->ah_sc, ATH_DBG_CALIBRATE,
+- "enabling IQ Calibration.\n");
++ "enabling IQ Calibration.\n");
+ }
+
+ ah->cal_list_curr = ah->cal_list;
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:24:35 2009
+Message-Id: <20090701002434.723163004@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:23:58 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Sujith <Sujith.Manoharan@atheros.com>,
+ "John W. Linville" <linville@tuxdriver.com>
+Subject: [patch 069/108] ath9k: Fix bug in determining calibration support
+References: <20090701002249.937782934@mini.kroah.org>
+Content-Disposition: inline; filename=ath9k-fix-bug-in-determining-calibration-support.patch
+Content-Length: 905
+Lines: 29
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Sujith <Sujith.Manoharan@atheros.com>
+
+commit a451aa66dcb14efcb7addf1d8edcac8df76a97b6 upstream.
+
+ADC gain calibration has to be done for all non 2GHZ-HT20 channels.
+Regression from "ath9k: use ieee80211_conf on ath9k_hw_iscal_supported()"
+
+Signed-off-by: Sujith <Sujith.Manoharan@atheros.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/ath9k/calib.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/ath9k/calib.c
++++ b/drivers/net/wireless/ath9k/calib.c
+@@ -284,8 +284,8 @@ static bool ath9k_hw_iscal_supported(str
+ return true;
+ case ADC_GAIN_CAL:
+ case ADC_DC_CAL:
+- if (conf->channel->band == IEEE80211_BAND_5GHZ &&
+- conf_is_ht20(conf))
++ if (!(conf->channel->band == IEEE80211_BAND_2GHZ &&
++ conf_is_ht20(conf)))
+ return true;
+ break;
+ }
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:24:35 2009
+Message-Id: <20090701002435.151808471@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:23:59 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Sujith <Sujith.Manoharan@atheros.com>,
+ "John W. Linville" <linville@tuxdriver.com>
+Subject: [patch 070/108] ath9k: Fix bug in checking HT flag
+References: <20090701002249.937782934@mini.kroah.org>
+Content-Disposition: inline; filename=ath9k-fix-bug-in-checking-ht-flag.patch
+Content-Length: 942
+Lines: 27
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Sujith <Sujith.Manoharan@atheros.com>
+
+commit db2f63f60a087ed29ae04310c1076c61f77a5d20 upstream.
+
+The operating HT mode is stored in chanmode and
+not channelFlags.
+
+Signed-off-by: Sujith <Sujith.Manoharan@atheros.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/ath9k/calib.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/ath9k/calib.c
++++ b/drivers/net/wireless/ath9k/calib.c
+@@ -883,7 +883,7 @@ bool ath9k_hw_calibrate(struct ath_hw *a
+ static bool ar9285_clc(struct ath_hw *ah, struct ath9k_channel *chan)
+ {
+ REG_SET_BIT(ah, AR_PHY_CL_CAL_CTL, AR_PHY_CL_CAL_ENABLE);
+- if (chan->channelFlags & CHANNEL_HT20) {
++ if (IS_CHAN_HT20(chan)) {
+ REG_SET_BIT(ah, AR_PHY_CL_CAL_CTL, AR_PHY_PARALLEL_CAL_ENABLE);
+ REG_SET_BIT(ah, AR_PHY_TURBO, AR_PHY_FC_DYN2040_EN);
+ REG_CLR_BIT(ah, AR_PHY_AGC_CONTROL,
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:24:35 2009
+Message-Id: <20090701002435.626499318@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:24:00 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Sujith <Sujith.Manoharan@atheros.com>,
+ "John W. Linville" <linville@tuxdriver.com>
+Subject: [patch 071/108] ath9k: Fix bug in scan termination
+References: <20090701002249.937782934@mini.kroah.org>
+Content-Disposition: inline; filename=ath9k-fix-bug-in-scan-termination.patch
+Content-Length: 789
+Lines: 27
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Sujith <Sujith.Manoharan@atheros.com>
+
+commit 9c07a7777f44c7e39accec5ad8c4293d6a9b2a47 upstream.
+
+A full HW reset needs to be done on termination of a scan run.
+Not setting SC_OP_FULL_RESET resulted in doing a
+fast channel change.
+
+Signed-off-by: Sujith <Sujith.Manoharan@atheros.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/ath9k/main.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/wireless/ath9k/main.c
++++ b/drivers/net/wireless/ath9k/main.c
+@@ -2772,6 +2772,7 @@ static void ath9k_sw_scan_complete(struc
+ mutex_lock(&sc->mutex);
+ aphy->state = ATH_WIPHY_ACTIVE;
+ sc->sc_flags &= ~SC_OP_SCANNING;
++ sc->sc_flags |= SC_OP_FULL_RESET;
+ mutex_unlock(&sc->mutex);
+ }
+
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:24:36 2009
+Message-Id: <20090701002435.938429664@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:24:01 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Sujith <Sujith.Manoharan@atheros.com>,
+ "John W. Linville" <linville@tuxdriver.com>
+Subject: [patch 072/108] ath9k: Fix memleak on TX DMA failure
+References: <20090701002249.937782934@mini.kroah.org>
+Content-Disposition: inline; filename=ath9k-fix-memleak-on-tx-dma-failure.patch
+Content-Length: 931
+Lines: 30
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Sujith <Sujith.Manoharan@atheros.com>
+
+commit 675902ef822c114c0dac17ed10eed43eb8f5c9ec upstream.
+
+The driver-specific region has to be freed in case
+of a DMA mapping failure.
+
+Signed-off-by: Sujith <Sujith.Manoharan@atheros.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/ath9k/xmit.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/ath9k/xmit.c
++++ b/drivers/net/wireless/ath9k/xmit.c
+@@ -1573,8 +1573,9 @@ static int ath_tx_setup_buffer(struct ie
+ skb->len, DMA_TO_DEVICE);
+ if (unlikely(dma_mapping_error(sc->dev, bf->bf_dmacontext))) {
+ bf->bf_mpdu = NULL;
+- DPRINTF(sc, ATH_DBG_CONFIG,
+- "dma_mapping_error() on TX\n");
++ kfree(tx_info_priv);
++ tx_info->rate_driver_data[0] = NULL;
++ DPRINTF(sc, ATH_DBG_FATAL, "dma_mapping_error() on TX\n");
+ return -ENOMEM;
+ }
+
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:24:36 2009
+Message-Id: <20090701002436.136350710@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:24:02 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Sujith <Sujith.Manoharan@atheros.com>,
+ "John W. Linville" <linville@tuxdriver.com>
+Subject: [patch 073/108] ath9k: Initialize ANI timers
+References: <20090701002249.937782934@mini.kroah.org>
+Content-Disposition: inline; filename=ath9k-initialize-ani-timers.patch
+Content-Length: 1909
+Lines: 63
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Sujith <Sujith.Manoharan@atheros.com>
+
+commit 415f738ecf41b427921b503ecfd427e26f89dc23 upstream.
+
+The various ANI timers have to be initialized properly when
+starting the calibration timer.
+
+Signed-off-by: Sujith <Sujith.Manoharan@atheros.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/ath9k/main.c | 24 +++++++++++++++---------
+ 1 file changed, 15 insertions(+), 9 deletions(-)
+
+--- a/drivers/net/wireless/ath9k/main.c
++++ b/drivers/net/wireless/ath9k/main.c
+@@ -408,6 +408,18 @@ set_timer:
+ mod_timer(&sc->ani.timer, jiffies + msecs_to_jiffies(cal_interval));
+ }
+
++static void ath_start_ani(struct ath_softc *sc)
++{
++ unsigned long timestamp = jiffies_to_msecs(jiffies);
++
++ sc->ani.longcal_timer = timestamp;
++ sc->ani.shortcal_timer = timestamp;
++ sc->ani.checkani_timer = timestamp;
++
++ mod_timer(&sc->ani.timer,
++ jiffies + msecs_to_jiffies(ATH_ANI_POLLINTERVAL));
++}
++
+ /*
+ * Update tx/rx chainmask. For legacy association,
+ * hard code chainmask to 1x1, for 11n association, use
+@@ -920,9 +932,7 @@ static void ath9k_bss_assoc_info(struct
+ sc->nodestats.ns_avgtxrssi = ATH_RSSI_DUMMY_MARKER;
+ sc->nodestats.ns_avgtxrate = ATH_RATE_DUMMY_MARKER;
+
+- /* Start ANI */
+- mod_timer(&sc->ani.timer,
+- jiffies + msecs_to_jiffies(ATH_ANI_POLLINTERVAL));
++ ath_start_ani(sc);
+ } else {
+ DPRINTF(sc, ATH_DBG_CONFIG, "Bss Info DISSOC\n");
+ sc->curaid = 0;
+@@ -2271,12 +2281,8 @@ static int ath9k_add_interface(struct ie
+
+ ath9k_hw_set_interrupts(sc->sc_ah, sc->imask);
+
+- if (conf->type == NL80211_IFTYPE_AP) {
+- /* TODO: is this a suitable place to start ANI for AP mode? */
+- /* Start ANI */
+- mod_timer(&sc->ani.timer,
+- jiffies + msecs_to_jiffies(ATH_ANI_POLLINTERVAL));
+- }
++ if (conf->type == NL80211_IFTYPE_AP)
++ ath_start_ani(sc);
+
+ out:
+ mutex_unlock(&sc->mutex);
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:24:36 2009
+Message-Id: <20090701002436.333343967@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:24:03 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jouni Malinen <jouni.malinen@atheros.com>,
+ "John W. Linville" <linville@tuxdriver.com>
+Subject: [patch 074/108] ath9k: Fix PCI FATAL interrupts by restoring RETRY_TIMEOUT disabling
+References: <20090701002249.937782934@mini.kroah.org>
+Content-Disposition: inline; filename=ath9k-fix-pci-fatal-interrupts-by-restoring-retry_timeout-disabling.patch
+Content-Length: 2718
+Lines: 78
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Jouni Malinen <jouni.malinen@atheros.com>
+
+commit f0214843ba23d9bf6dc6b8ad2c6ee27b60f0322e upstream.
+
+An earlier commit, 'ath9k: remove dummy PCI "retry timeout" fix', removed
+code that was documented to disable RETRY_TIMEOUT register (PCI reg
+0x41) since it was claimed to be a no-op. However, it turns out that
+there are some combinations of hosts and ath9k-supported cards for
+which this is not a no-op (reg 0x41 has value 0x80, not 0) and this
+code (or something similar) is needed. In such cases, the driver may
+be next to unusable due to very frequent PCI FATAL interrupts from the
+card.
+
+Reverting the earlier commit, i.e., restoring the RETRY_TIMEOUT
+disabling, seems to resolve the issue. Since the removal of this code
+was not based on any known issue and was purely a cleanup change, the
+safest option here is to just revert that commit. Should there be
+desire to clean this up in the future, the change will need to be
+tested with a more complete coverage of cards and host systems.
+
+http://bugzilla.kernel.org/show_bug.cgi?id=13483
+
+Signed-off-by: Jouni Malinen <jouni.malinen@atheros.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/ath9k/pci.c | 18 ++++++++++++++++++
+ 1 file changed, 18 insertions(+)
+
+--- a/drivers/net/wireless/ath9k/pci.c
++++ b/drivers/net/wireless/ath9k/pci.c
+@@ -87,6 +87,7 @@ static int ath_pci_probe(struct pci_dev
+ struct ath_softc *sc;
+ struct ieee80211_hw *hw;
+ u8 csz;
++ u32 val;
+ int ret = 0;
+ struct ath_hw *ah;
+
+@@ -133,6 +134,14 @@ static int ath_pci_probe(struct pci_dev
+
+ pci_set_master(pdev);
+
++ /*
++ * Disable the RETRY_TIMEOUT register (0x41) to keep
++ * PCI Tx retries from interfering with C3 CPU state.
++ */
++ pci_read_config_dword(pdev, 0x40, &val);
++ if ((val & 0x0000ff00) != 0)
++ pci_write_config_dword(pdev, 0x40, val & 0xffff00ff);
++
+ ret = pci_request_region(pdev, 0, "ath9k");
+ if (ret) {
+ dev_err(&pdev->dev, "PCI memory region reserve error\n");
+@@ -244,12 +253,21 @@ static int ath_pci_resume(struct pci_dev
+ struct ieee80211_hw *hw = pci_get_drvdata(pdev);
+ struct ath_wiphy *aphy = hw->priv;
+ struct ath_softc *sc = aphy->sc;
++ u32 val;
+ int err;
+
+ err = pci_enable_device(pdev);
+ if (err)
+ return err;
+ pci_restore_state(pdev);
++ /*
++ * Suspend/Resume resets the PCI configuration space, so we have to
++ * re-disable the RETRY_TIMEOUT register (0x41) to keep
++ * PCI Tx retries from interfering with C3 CPU state
++ */
++ pci_read_config_dword(pdev, 0x40, &val);
++ if ((val & 0x0000ff00) != 0)
++ pci_write_config_dword(pdev, 0x40, val & 0xffff00ff);
+
+ /* Enable LED */
+ ath9k_hw_cfg_output(sc->sc_ah, ATH_LED_PIN,
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:24:37 2009
+Message-Id: <20090701002436.682141659@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:24:04 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Huang Ying <ying.huang@intel.com>,
+ Herbert Xu <herbert@gondor.apana.org.au>
+Subject: [patch 075/108] crypto: aes-ni - Fix cbc mode IV saving
+References: <20090701002249.937782934@mini.kroah.org>
+Content-Disposition: inline; filename=crypto-aes-ni-fix-cbc-mode-iv-saving.patch
+Content-Length: 930
+Lines: 36
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Huang Ying <ying.huang@intel.com>
+
+commit e6efaa025384f86a18814a6b9f4e5d54484ab9ff upstream.
+
+Original implementation of aesni_cbc_dec do not save IV if input
+length % 4 == 0. This will make decryption of next block failed.
+
+Signed-off-by: Huang Ying <ying.huang@intel.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/crypto/aesni-intel_asm.S | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/arch/x86/crypto/aesni-intel_asm.S
++++ b/arch/x86/crypto/aesni-intel_asm.S
+@@ -845,7 +845,7 @@ ENTRY(aesni_cbc_enc)
+ */
+ ENTRY(aesni_cbc_dec)
+ cmp $16, LEN
+- jb .Lcbc_dec_ret
++ jb .Lcbc_dec_just_ret
+ mov 480(KEYP), KLEN
+ add $240, KEYP
+ movups (IVP), IV
+@@ -891,6 +891,7 @@ ENTRY(aesni_cbc_dec)
+ add $16, OUTP
+ cmp $16, LEN
+ jge .Lcbc_dec_loop1
+- movups IV, (IVP)
+ .Lcbc_dec_ret:
++ movups IV, (IVP)
++.Lcbc_dec_just_ret:
+ ret
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:24:37 2009
+Message-Id: <20090701002437.050628914@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:24:05 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Dan Williams <dan.j.williams@intel.com>,
+ NeilBrown <neilb@suse.de>
+Subject: [patch 076/108] md/raid5: add missing call to schedule() after prepare_to_wait()
+References: <20090701002249.937782934@mini.kroah.org>
+Content-Disposition: inline; filename=md-raid5-add-missing-call-to-schedule-after-prepare_to_wait.patch
+Content-Length: 911
+Lines: 31
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Dan Williams <dan.j.williams@intel.com>
+
+commit 7a3ab908948b6296ee7e81d42f7c176361c51975 upstream.
+
+In the unlikely event that reshape progresses past the current request
+while it is waiting for a stripe we need to schedule() before retrying
+for 2 reasons:
+1/ Prevent list corruption from duplicated list_add() calls without
+ intervening list_del().
+2/ Give the reshape code a chance to make some progress to resolve the
+ conflict.
+
+Signed-off-by: Dan Williams <dan.j.williams@intel.com>
+Signed-off-by: NeilBrown <neilb@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/raid5.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/md/raid5.c
++++ b/drivers/md/raid5.c
+@@ -3696,6 +3696,7 @@ static int make_request(struct request_q
+ spin_unlock_irq(&conf->device_lock);
+ if (must_retry) {
+ release_stripe(sh);
++ schedule();
+ goto retry;
+ }
+ }
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:24:37 2009
+Message-Id: <20090701002437.409563985@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:24:06 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Frederic Weisbecker <fweisbec@gmail.com>,
+ Steven Rostedt <rostedt@goodmis.org>
+Subject: [patch 077/108] tracing/urgent: fix unbalanced ftrace_start_up
+References: <20090701002249.937782934@mini.kroah.org>
+Content-Disposition: inline; filename=tracing-urgent-fix-unbalanced-ftrace_start_up.patch
+Content-Length: 2986
+Lines: 81
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Frederic Weisbecker <fweisbec@gmail.com>
+
+commit c85a17e22695969aa24a7ffa40cf26d6e6fcfd50 upstream.
+
+Perfcounter reports the following stats for a wide system
+profiling:
+
+ #
+ # (2364 samples)
+ #
+ # Overhead Symbol
+ # ........ ......
+ #
+ 15.40% [k] mwait_idle_with_hints
+ 8.29% [k] read_hpet
+ 5.75% [k] ftrace_caller
+ 3.60% [k] ftrace_call
+ [...]
+
+This snapshot has been taken while neither the function tracer nor
+the function graph tracer was running.
+With dynamic ftrace, such results show a wrong ftrace behaviour
+because all calls to ftrace_caller or ftrace_graph_caller (the patched
+calls to mcount) are supposed to be patched into nop if none of those
+tracers are running.
+
+The problem occurs after the first run of the function tracer. Once we
+launch it a second time, the callsites will never be nopped back,
+unless you set custom filters.
+For example it happens during the self tests at boot time.
+The function tracer selftest runs, and then the dynamic tracing is
+tested too. After that, the callsites are left un-nopped.
+
+This is because the reset callback of the function tracer tries to
+unregister two ftrace callbacks in once: the common function tracer
+and the function tracer with stack backtrace, regardless of which
+one is currently in use.
+It then creates an unbalance on ftrace_start_up value which is expected
+to be zero when the last ftrace callback is unregistered. When it
+reaches zero, the FTRACE_DISABLE_CALLS is set on the next ftrace
+command, triggering the patching into nop. But since it becomes
+unbalanced, ie becomes lower than zero, if the kernel functions
+are patched again (as in every further function tracer runs), they
+won't ever be nopped back.
+
+Note that ftrace_call and ftrace_graph_call are still patched back
+to ftrace_stub in the off case, but not the callers of ftrace_call
+and ftrace_graph_caller. It means that the tracing is well deactivated
+but we waste a useless call into every kernel function.
+
+This patch just unregisters the right ftrace_ops for the function
+tracer on its reset callback and ignores the other one which is
+not registered, fixing the unbalance. The problem also happens
+is .30
+
+Signed-off-by: Frederic Weisbecker <fweisbec@gmail.com>
+Cc: Steven Rostedt <rostedt@goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/trace/trace_functions.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+--- a/kernel/trace/trace_functions.c
++++ b/kernel/trace/trace_functions.c
+@@ -193,9 +193,11 @@ static void tracing_start_function_trace
+ static void tracing_stop_function_trace(void)
+ {
+ ftrace_function_enabled = 0;
+- /* OK if they are not registered */
+- unregister_ftrace_function(&trace_stack_ops);
+- unregister_ftrace_function(&trace_ops);
++
++ if (func_flags.val & TRACE_FUNC_OPT_STACK)
++ unregister_ftrace_function(&trace_stack_ops);
++ else
++ unregister_ftrace_function(&trace_ops);
+ }
+
+ static int func_set_flag(u32 old_flags, u32 bit, int set)
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:24:38 2009
+Message-Id: <20090701002437.962186526@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:24:07 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jeff Layton <jlayton@redhat.com>,
+ Shirish Pargaonkar <shirishp@us.ibm.com>,
+ Steve French <sfrench@us.ibm.com>
+Subject: [patch 078/108] cifs: fix fh_mutex locking in cifs_reopen_file
+References: <20090701002249.937782934@mini.kroah.org>
+Content-Disposition: inline; filename=cifs-fix-fh_mutex-locking-in-cifs_reopen_file.patch
+Content-Length: 1695
+Lines: 59
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Jeff Layton <jlayton@redhat.com>
+
+commit f0a71eb820596bd8f6abf64beb4cb181edaa2341 upstream.
+
+Fixes a regression caused by commit a6ce4932fbdbcd8f8e8c6df76812014351c32892
+
+When this lock was converted to a mutex, the locks were turned into
+unlocks and vice-versa.
+
+Signed-off-by: Jeff Layton <jlayton@redhat.com>
+Acked-by: Shirish Pargaonkar <shirishp@us.ibm.com>
+Signed-off-by: Steve French <sfrench@us.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/cifs/file.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+--- a/fs/cifs/file.c
++++ b/fs/cifs/file.c
+@@ -491,9 +491,9 @@ static int cifs_reopen_file(struct file
+ return -EBADF;
+
+ xid = GetXid();
+- mutex_unlock(&pCifsFile->fh_mutex);
++ mutex_lock(&pCifsFile->fh_mutex);
+ if (!pCifsFile->invalidHandle) {
+- mutex_lock(&pCifsFile->fh_mutex);
++ mutex_unlock(&pCifsFile->fh_mutex);
+ FreeXid(xid);
+ return 0;
+ }
+@@ -524,7 +524,7 @@ static int cifs_reopen_file(struct file
+ if (full_path == NULL) {
+ rc = -ENOMEM;
+ reopen_error_exit:
+- mutex_lock(&pCifsFile->fh_mutex);
++ mutex_unlock(&pCifsFile->fh_mutex);
+ FreeXid(xid);
+ return rc;
+ }
+@@ -566,14 +566,14 @@ reopen_error_exit:
+ cifs_sb->local_nls, cifs_sb->mnt_cifs_flags &
+ CIFS_MOUNT_MAP_SPECIAL_CHR);
+ if (rc) {
+- mutex_lock(&pCifsFile->fh_mutex);
++ mutex_unlock(&pCifsFile->fh_mutex);
+ cFYI(1, ("cifs_open returned 0x%x", rc));
+ cFYI(1, ("oplock: %d", oplock));
+ } else {
+ reopen_success:
+ pCifsFile->netfid = netfid;
+ pCifsFile->invalidHandle = false;
+- mutex_lock(&pCifsFile->fh_mutex);
++ mutex_unlock(&pCifsFile->fh_mutex);
+ pCifsInode = CIFS_I(inode);
+ if (pCifsInode) {
+ if (can_flush) {
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:24:38 2009
+Message-Id: <20090701002438.308543471@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:24:08 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jiri Slaby <jirislaby@gmail.com>,
+ Alan Cox <alan@linux.intel.com>
+Subject: [patch 079/108] vt_ioctl: fix lock imbalance
+References: <20090701002249.937782934@mini.kroah.org>
+Content-Disposition: inline; filename=vt_ioctl-fix-lock-imbalance.patch
+Content-Length: 804
+Lines: 29
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Jiri Slaby <jirislaby@gmail.com>
+
+commit a115902f67ef51fbbe83e214fb761aaa9734c1ce upstream.
+
+Don't return from switch/case directly in vt_ioctl. Set ret and break
+instead so that we unlock BKL.
+
+Signed-off-by: Jiri Slaby <jirislaby@gmail.com>
+Signed-off-by: Alan Cox <alan@linux.intel.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/char/vt_ioctl.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/char/vt_ioctl.c
++++ b/drivers/char/vt_ioctl.c
+@@ -396,7 +396,8 @@ int vt_ioctl(struct tty_struct *tty, str
+ kbd = kbd_table + console;
+ switch (cmd) {
+ case TIOCLINUX:
+- return tioclinux(tty, arg);
++ ret = tioclinux(tty, arg);
++ break;
+ case KIOCSOUND:
+ if (!perm)
+ goto eperm;
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:24:38 2009
+Message-Id: <20090701002438.502935424@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:24:09 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Lubomir Rintel <lkundrak@v3.sk>,
+ "H. Peter Anvin" <hpa@zytor.com>,
+ Ingo Molnar <mingo@elte.hu>,
+ Steven Noonan <steven@uplinklabs.net>
+Subject: [patch 080/108] x86: Fix non-lazy GS handling in sys_vm86()
+References: <20090701002249.937782934@mini.kroah.org>
+Content-Disposition: inline; filename=x86-fix-non-lazy-gs-handling-in-sys_vm86.patch
+Content-Length: 1450
+Lines: 49
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Lubomir Rintel <lkundrak@v3.sk>
+
+commit 3aa6b186f86c5d06d6d92d14311ffed51f091f40 upstream.
+
+This fixes a stack corruption panic or null dereference oops
+due to a bad GS in resume_userspace() when returning from
+sys_vm86() and calling lockdep_sys_exit().
+
+Only a problem when CONFIG_LOCKDEP and CONFIG_CC_STACKPROTECTOR
+enabled.
+
+Signed-off-by: Lubomir Rintel <lkundrak@v3.sk>
+Cc: H. Peter Anvin <hpa@zytor.com>
+LKML-Reference: <1244384628.2323.4.camel@bimbo>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Cc: Steven Noonan <steven@uplinklabs.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/vm86_32.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+--- a/arch/x86/kernel/vm86_32.c
++++ b/arch/x86/kernel/vm86_32.c
+@@ -287,10 +287,9 @@ static void do_sys_vm86(struct kernel_vm
+ info->regs.pt.ds = 0;
+ info->regs.pt.es = 0;
+ info->regs.pt.fs = 0;
+-
+-/* we are clearing gs later just before "jmp resume_userspace",
+- * because it is not saved/restored.
+- */
++#ifndef CONFIG_X86_32_LAZY_GS
++ info->regs.pt.gs = 0;
++#endif
+
+ /*
+ * The flags register is also special: we cannot trust that the user
+@@ -343,7 +342,9 @@ static void do_sys_vm86(struct kernel_vm
+ __asm__ __volatile__(
+ "movl %0,%%esp\n\t"
+ "movl %1,%%ebp\n\t"
++#ifdef CONFIG_X86_32_LAZY_GS
+ "mov %2, %%gs\n\t"
++#endif
+ "jmp resume_userspace"
+ : /* no outputs */
+ :"r" (&info->regs), "r" (task_thread_info(tsk)), "r" (0));
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:24:38 2009
+Message-Id: <20090701002438.714465250@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:24:10 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Andreas Herrmann <andreas.herrmann3@amd.com>,
+ Ingo Molnar <mingo@elte.hu>
+Subject: [patch 081/108] x86: Set cpu_llc_id on AMD CPUs
+References: <20090701002249.937782934@mini.kroah.org>
+Content-Disposition: inline; filename=x86-set-cpu_llc_id-on-amd-cpus.patch
+Content-Length: 1958
+Lines: 72
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Andreas Herrmann <andreas.herrmann3@amd.com>
+
+commit 99bd0c0fc4b04da54cb311953ef9489931c19c63 upstream.
+
+This counts when building sched domains in case NUMA information
+is not available.
+
+( See cpu_coregroup_mask() which uses llc_shared_map which in turn is
+ created based on cpu_llc_id. )
+
+Currently Linux builds domains as follows:
+(example from a dual socket quad-core system)
+
+ CPU0 attaching sched-domain:
+ domain 0: span 0-7 level CPU
+ groups: 0 1 2 3 4 5 6 7
+
+ ...
+
+ CPU7 attaching sched-domain:
+ domain 0: span 0-7 level CPU
+ groups: 7 0 1 2 3 4 5 6
+
+Ever since that is borked for multi-core AMD CPU systems.
+This patch fixes that and now we get a proper:
+
+ CPU0 attaching sched-domain:
+ domain 0: span 0-3 level MC
+ groups: 0 1 2 3
+ domain 1: span 0-7 level CPU
+ groups: 0-3 4-7
+
+ ...
+
+ CPU7 attaching sched-domain:
+ domain 0: span 4-7 level MC
+ groups: 7 4 5 6
+ domain 1: span 0-7 level CPU
+ groups: 4-7 0-3
+
+This allows scheduler to assign tasks to cores on different sockets
+(i.e. that don't share last level cache) for performance reasons.
+
+Signed-off-by: Andreas Herrmann <andreas.herrmann3@amd.com>
+LKML-Reference: <20090619085909.GJ5218@alberich.amd.com>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/cpu/amd.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/arch/x86/kernel/cpu/amd.c
++++ b/arch/x86/kernel/cpu/amd.c
+@@ -258,13 +258,15 @@ static void __cpuinit amd_detect_cmp(str
+ {
+ #ifdef CONFIG_X86_HT
+ unsigned bits;
++ int cpu = smp_processor_id();
+
+ bits = c->x86_coreid_bits;
+-
+ /* Low order bits define the core id (index of core in socket) */
+ c->cpu_core_id = c->initial_apicid & ((1 << bits)-1);
+ /* Convert the initial APIC ID into the socket ID */
+ c->phys_proc_id = c->initial_apicid >> bits;
++ /* use socket ID also for last level cache */
++ per_cpu(cpu_llc_id, cpu) = c->phys_proc_id;
+ #endif
+ }
+
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:24:39 2009
+Message-Id: <20090701002438.907510161@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:24:11 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Alan Stern <stern@rowland.harvard.edu>
+Subject: [patch 082/108] usb-serial: replace shutdown with disconnect, release
+References: <20090701002249.937782934@mini.kroah.org>
+Content-Disposition: inline; filename=usb-serial-replace-shutdown-with-disconnect-release.patch
+Content-Length: 52260
+Lines: 1598
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit f9c99bb8b3a1ec81af68d484a551307326c2e933 upstream
+
+This patch splits up the shutdown method of usb_serial_driver into a
+disconnect and a release method.
+
+The problem is that the usb-serial core was calling shutdown during
+disconnect handling, but drivers didn't expect it to be called until
+after all the open file references had been closed. The result was an
+oops when the close method tried to use memory that had been
+deallocated by shutdown.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/staging/uc2322/aten2011.c | 4 +--
+ drivers/usb/serial/aircable.c | 5 +---
+ drivers/usb/serial/belkin_sa.c | 7 ++---
+ drivers/usb/serial/cp210x.c | 6 ++--
+ drivers/usb/serial/cyberjack.c | 20 ++++++++++++----
+ drivers/usb/serial/cypress_m8.c | 11 ++++----
+ drivers/usb/serial/digi_acceleport.c | 20 ++++++++++++----
+ drivers/usb/serial/empeg.c | 8 ------
+ drivers/usb/serial/ftdi_sio.c | 14 -----------
+ drivers/usb/serial/garmin_gps.c | 16 ++++++++++--
+ drivers/usb/serial/generic.c | 9 +++++--
+ drivers/usb/serial/io_edgeport.c | 29 ++++++++++++++++-------
+ drivers/usb/serial/io_tables.h | 12 ++++++---
+ drivers/usb/serial/io_ti.c | 22 +++++++++++++----
+ drivers/usb/serial/ipaq.c | 7 -----
+ drivers/usb/serial/iuu_phoenix.c | 6 ++--
+ drivers/usb/serial/keyspan.c | 13 +++++++++-
+ drivers/usb/serial/keyspan.h | 12 ++++++---
+ drivers/usb/serial/keyspan_pda.c | 4 +--
+ drivers/usb/serial/kl5kusb105.c | 39 +++++++++++++++++--------------
+ drivers/usb/serial/kobil_sct.c | 12 +++------
+ drivers/usb/serial/mct_u232.c | 13 ++++------
+ drivers/usb/serial/mos7720.c | 9 ++-----
+ drivers/usb/serial/mos7840.c | 42 +++++++++++++++++++++++++++++-----
+ drivers/usb/serial/omninet.c | 19 ++++++++++++---
+ drivers/usb/serial/opticon.c | 14 ++++++++---
+ drivers/usb/serial/option.c | 17 +++++++++----
+ drivers/usb/serial/oti6858.c | 7 ++---
+ drivers/usb/serial/pl2303.c | 5 +---
+ drivers/usb/serial/sierra.c | 28 +++++++++++++++++++---
+ drivers/usb/serial/spcp8x5.c | 5 +---
+ drivers/usb/serial/symbolserial.c | 14 ++++++++---
+ drivers/usb/serial/ti_usb_3410_5052.c | 10 +++-----
+ drivers/usb/serial/usb-serial.c | 29 ++++++++++-------------
+ drivers/usb/serial/visor.c | 13 ++++------
+ drivers/usb/serial/whiteheat.c | 6 ++--
+ include/linux/usb/serial.h | 12 ++++++---
+ 37 files changed, 319 insertions(+), 200 deletions(-)
+
+--- a/drivers/staging/uc2322/aten2011.c
++++ b/drivers/staging/uc2322/aten2011.c
+@@ -2336,7 +2336,7 @@ static int ATEN2011_startup(struct usb_s
+ return 0;
+ }
+
+-static void ATEN2011_shutdown(struct usb_serial *serial)
++static void ATEN2011_release(struct usb_serial *serial)
+ {
+ int i;
+ struct ATENINTL_port *ATEN2011_port;
+@@ -2382,7 +2382,7 @@ static struct usb_serial_driver aten_ser
+ .tiocmget = ATEN2011_tiocmget,
+ .tiocmset = ATEN2011_tiocmset,
+ .attach = ATEN2011_startup,
+- .shutdown = ATEN2011_shutdown,
++ .release = ATEN2011_release,
+ .read_bulk_callback = ATEN2011_bulk_in_callback,
+ .read_int_callback = ATEN2011_interrupt_callback,
+ };
+--- a/drivers/usb/serial/aircable.c
++++ b/drivers/usb/serial/aircable.c
+@@ -364,7 +364,7 @@ static int aircable_attach(struct usb_se
+ return 0;
+ }
+
+-static void aircable_shutdown(struct usb_serial *serial)
++static void aircable_release(struct usb_serial *serial)
+ {
+
+ struct usb_serial_port *port = serial->port[0];
+@@ -375,7 +375,6 @@ static void aircable_shutdown(struct usb
+ if (priv) {
+ serial_buf_free(priv->tx_buf);
+ serial_buf_free(priv->rx_buf);
+- usb_set_serial_port_data(port, NULL);
+ kfree(priv);
+ }
+ }
+@@ -601,7 +600,7 @@ static struct usb_serial_driver aircable
+ .num_ports = 1,
+ .attach = aircable_attach,
+ .probe = aircable_probe,
+- .shutdown = aircable_shutdown,
++ .release = aircable_release,
+ .write = aircable_write,
+ .write_room = aircable_write_room,
+ .write_bulk_callback = aircable_write_bulk_callback,
+--- a/drivers/usb/serial/belkin_sa.c
++++ b/drivers/usb/serial/belkin_sa.c
+@@ -90,7 +90,7 @@ static int debug;
+
+ /* function prototypes for a Belkin USB Serial Adapter F5U103 */
+ static int belkin_sa_startup(struct usb_serial *serial);
+-static void belkin_sa_shutdown(struct usb_serial *serial);
++static void belkin_sa_release(struct usb_serial *serial);
+ static int belkin_sa_open(struct tty_struct *tty,
+ struct usb_serial_port *port, struct file *filp);
+ static void belkin_sa_close(struct tty_struct *tty,
+@@ -143,7 +143,7 @@ static struct usb_serial_driver belkin_d
+ .tiocmget = belkin_sa_tiocmget,
+ .tiocmset = belkin_sa_tiocmset,
+ .attach = belkin_sa_startup,
+- .shutdown = belkin_sa_shutdown,
++ .release = belkin_sa_release,
+ };
+
+
+@@ -198,14 +198,13 @@ static int belkin_sa_startup(struct usb_
+ }
+
+
+-static void belkin_sa_shutdown(struct usb_serial *serial)
++static void belkin_sa_release(struct usb_serial *serial)
+ {
+ struct belkin_sa_private *priv;
+ int i;
+
+ dbg("%s", __func__);
+
+- /* stop reads and writes on all ports */
+ for (i = 0; i < serial->num_ports; ++i) {
+ /* My special items, the standard routines free my urbs */
+ priv = usb_get_serial_port_data(serial->port[i]);
+--- a/drivers/usb/serial/cp210x.c
++++ b/drivers/usb/serial/cp210x.c
+@@ -51,7 +51,7 @@ static int cp2101_tiocmset_port(struct u
+ unsigned int, unsigned int);
+ static void cp2101_break_ctl(struct tty_struct *, int);
+ static int cp2101_startup(struct usb_serial *);
+-static void cp2101_shutdown(struct usb_serial *);
++static void cp2101_disconnect(struct usb_serial *);
+
+ static int debug;
+
+@@ -131,7 +131,7 @@ static struct usb_serial_driver cp2101_d
+ .tiocmget = cp2101_tiocmget,
+ .tiocmset = cp2101_tiocmset,
+ .attach = cp2101_startup,
+- .shutdown = cp2101_shutdown,
++ .disconnect = cp2101_disconnect,
+ };
+
+ /* Config request types */
+@@ -773,7 +773,7 @@ static int cp2101_startup(struct usb_ser
+ return 0;
+ }
+
+-static void cp2101_shutdown(struct usb_serial *serial)
++static void cp2101_disconnect(struct usb_serial *serial)
+ {
+ int i;
+
+--- a/drivers/usb/serial/cyberjack.c
++++ b/drivers/usb/serial/cyberjack.c
+@@ -58,7 +58,8 @@ static int debug;
+
+ /* Function prototypes */
+ static int cyberjack_startup(struct usb_serial *serial);
+-static void cyberjack_shutdown(struct usb_serial *serial);
++static void cyberjack_disconnect(struct usb_serial *serial);
++static void cyberjack_release(struct usb_serial *serial);
+ static int cyberjack_open(struct tty_struct *tty,
+ struct usb_serial_port *port, struct file *filp);
+ static void cyberjack_close(struct tty_struct *tty,
+@@ -95,7 +96,8 @@ static struct usb_serial_driver cyberjac
+ .id_table = id_table,
+ .num_ports = 1,
+ .attach = cyberjack_startup,
+- .shutdown = cyberjack_shutdown,
++ .disconnect = cyberjack_disconnect,
++ .release = cyberjack_release,
+ .open = cyberjack_open,
+ .close = cyberjack_close,
+ .write = cyberjack_write,
+@@ -149,17 +151,25 @@ static int cyberjack_startup(struct usb_
+ return 0;
+ }
+
+-static void cyberjack_shutdown(struct usb_serial *serial)
++static void cyberjack_disconnect(struct usb_serial *serial)
+ {
+ int i;
+
+ dbg("%s", __func__);
+
+- for (i = 0; i < serial->num_ports; ++i) {
++ for (i = 0; i < serial->num_ports; ++i)
+ usb_kill_urb(serial->port[i]->interrupt_in_urb);
++}
++
++static void cyberjack_release(struct usb_serial *serial)
++{
++ int i;
++
++ dbg("%s", __func__);
++
++ for (i = 0; i < serial->num_ports; ++i) {
+ /* My special items, the standard routines free my urbs */
+ kfree(usb_get_serial_port_data(serial->port[i]));
+- usb_set_serial_port_data(serial->port[i], NULL);
+ }
+ }
+
+--- a/drivers/usb/serial/cypress_m8.c
++++ b/drivers/usb/serial/cypress_m8.c
+@@ -171,7 +171,7 @@ struct cypress_buf {
+ static int cypress_earthmate_startup(struct usb_serial *serial);
+ static int cypress_hidcom_startup(struct usb_serial *serial);
+ static int cypress_ca42v2_startup(struct usb_serial *serial);
+-static void cypress_shutdown(struct usb_serial *serial);
++static void cypress_release(struct usb_serial *serial);
+ static int cypress_open(struct tty_struct *tty,
+ struct usb_serial_port *port, struct file *filp);
+ static void cypress_close(struct tty_struct *tty,
+@@ -215,7 +215,7 @@ static struct usb_serial_driver cypress_
+ .id_table = id_table_earthmate,
+ .num_ports = 1,
+ .attach = cypress_earthmate_startup,
+- .shutdown = cypress_shutdown,
++ .release = cypress_release,
+ .open = cypress_open,
+ .close = cypress_close,
+ .write = cypress_write,
+@@ -241,7 +241,7 @@ static struct usb_serial_driver cypress_
+ .id_table = id_table_cyphidcomrs232,
+ .num_ports = 1,
+ .attach = cypress_hidcom_startup,
+- .shutdown = cypress_shutdown,
++ .release = cypress_release,
+ .open = cypress_open,
+ .close = cypress_close,
+ .write = cypress_write,
+@@ -267,7 +267,7 @@ static struct usb_serial_driver cypress_
+ .id_table = id_table_nokiaca42v2,
+ .num_ports = 1,
+ .attach = cypress_ca42v2_startup,
+- .shutdown = cypress_shutdown,
++ .release = cypress_release,
+ .open = cypress_open,
+ .close = cypress_close,
+ .write = cypress_write,
+@@ -613,7 +613,7 @@ static int cypress_ca42v2_startup(struct
+ } /* cypress_ca42v2_startup */
+
+
+-static void cypress_shutdown(struct usb_serial *serial)
++static void cypress_release(struct usb_serial *serial)
+ {
+ struct cypress_private *priv;
+
+@@ -626,7 +626,6 @@ static void cypress_shutdown(struct usb_
+ if (priv) {
+ cypress_buf_free(priv->buf);
+ kfree(priv);
+- usb_set_serial_port_data(serial->port[0], NULL);
+ }
+ }
+
+--- a/drivers/usb/serial/digi_acceleport.c
++++ b/drivers/usb/serial/digi_acceleport.c
+@@ -460,7 +460,8 @@ static void digi_close(struct tty_struct
+ struct file *filp);
+ static int digi_startup_device(struct usb_serial *serial);
+ static int digi_startup(struct usb_serial *serial);
+-static void digi_shutdown(struct usb_serial *serial);
++static void digi_disconnect(struct usb_serial *serial);
++static void digi_release(struct usb_serial *serial);
+ static void digi_read_bulk_callback(struct urb *urb);
+ static int digi_read_inb_callback(struct urb *urb);
+ static int digi_read_oob_callback(struct urb *urb);
+@@ -522,7 +523,8 @@ static struct usb_serial_driver digi_acc
+ .tiocmget = digi_tiocmget,
+ .tiocmset = digi_tiocmset,
+ .attach = digi_startup,
+- .shutdown = digi_shutdown,
++ .disconnect = digi_disconnect,
++ .release = digi_release,
+ };
+
+ static struct usb_serial_driver digi_acceleport_4_device = {
+@@ -548,7 +550,8 @@ static struct usb_serial_driver digi_acc
+ .tiocmget = digi_tiocmget,
+ .tiocmset = digi_tiocmset,
+ .attach = digi_startup,
+- .shutdown = digi_shutdown,
++ .disconnect = digi_disconnect,
++ .release = digi_release,
+ };
+
+
+@@ -1589,16 +1592,23 @@ static int digi_startup(struct usb_seria
+ }
+
+
+-static void digi_shutdown(struct usb_serial *serial)
++static void digi_disconnect(struct usb_serial *serial)
+ {
+ int i;
+- dbg("digi_shutdown: TOP, in_interrupt()=%ld", in_interrupt());
++ dbg("digi_disconnect: TOP, in_interrupt()=%ld", in_interrupt());
+
+ /* stop reads and writes on all ports */
+ for (i = 0; i < serial->type->num_ports + 1; i++) {
+ usb_kill_urb(serial->port[i]->read_urb);
+ usb_kill_urb(serial->port[i]->write_urb);
+ }
++}
++
++
++static void digi_release(struct usb_serial *serial)
++{
++ int i;
++ dbg("digi_release: TOP, in_interrupt()=%ld", in_interrupt());
+
+ /* free the private data structures for all ports */
+ /* number of regular ports + 1 for the out-of-band port */
+--- a/drivers/usb/serial/empeg.c
++++ b/drivers/usb/serial/empeg.c
+@@ -91,7 +91,6 @@ static int empeg_chars_in_buffer(struct
+ static void empeg_throttle(struct tty_struct *tty);
+ static void empeg_unthrottle(struct tty_struct *tty);
+ static int empeg_startup(struct usb_serial *serial);
+-static void empeg_shutdown(struct usb_serial *serial);
+ static void empeg_set_termios(struct tty_struct *tty,
+ struct usb_serial_port *port, struct ktermios *old_termios);
+ static void empeg_write_bulk_callback(struct urb *urb);
+@@ -125,7 +124,6 @@ static struct usb_serial_driver empeg_de
+ .throttle = empeg_throttle,
+ .unthrottle = empeg_unthrottle,
+ .attach = empeg_startup,
+- .shutdown = empeg_shutdown,
+ .set_termios = empeg_set_termios,
+ .write = empeg_write,
+ .write_room = empeg_write_room,
+@@ -429,12 +427,6 @@ static int empeg_startup(struct usb_ser
+ }
+
+
+-static void empeg_shutdown(struct usb_serial *serial)
+-{
+- dbg("%s", __func__);
+-}
+-
+-
+ static void empeg_set_termios(struct tty_struct *tty,
+ struct usb_serial_port *port, struct ktermios *old_termios)
+ {
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -714,7 +714,6 @@ static const char *ftdi_chip_name[] = {
+ /* function prototypes for a FTDI serial converter */
+ static int ftdi_sio_probe(struct usb_serial *serial,
+ const struct usb_device_id *id);
+-static void ftdi_shutdown(struct usb_serial *serial);
+ static int ftdi_sio_port_probe(struct usb_serial_port *port);
+ static int ftdi_sio_port_remove(struct usb_serial_port *port);
+ static int ftdi_open(struct tty_struct *tty,
+@@ -770,7 +769,6 @@ static struct usb_serial_driver ftdi_sio
+ .ioctl = ftdi_ioctl,
+ .set_termios = ftdi_set_termios,
+ .break_ctl = ftdi_break_ctl,
+- .shutdown = ftdi_shutdown,
+ };
+
+
+@@ -1460,18 +1458,6 @@ static int ftdi_mtxorb_hack_setup(struct
+ return 0;
+ }
+
+-/* ftdi_shutdown is called from usbserial:usb_serial_disconnect
+- * it is called when the usb device is disconnected
+- *
+- * usbserial:usb_serial_disconnect
+- * calls __serial_close for each open of the port
+- * shutdown is called then (ie ftdi_shutdown)
+- */
+-static void ftdi_shutdown(struct usb_serial *serial)
+-{
+- dbg("%s", __func__);
+-}
+-
+ static void ftdi_sio_priv_release(struct kref *k)
+ {
+ struct ftdi_private *priv = container_of(k, struct ftdi_private, kref);
+--- a/drivers/usb/serial/garmin_gps.c
++++ b/drivers/usb/serial/garmin_gps.c
+@@ -1528,7 +1528,7 @@ static int garmin_attach(struct usb_seri
+ }
+
+
+-static void garmin_shutdown(struct usb_serial *serial)
++static void garmin_disconnect(struct usb_serial *serial)
+ {
+ struct usb_serial_port *port = serial->port[0];
+ struct garmin_data *garmin_data_p = usb_get_serial_port_data(port);
+@@ -1537,8 +1537,17 @@ static void garmin_shutdown(struct usb_s
+
+ usb_kill_urb(port->interrupt_in_urb);
+ del_timer_sync(&garmin_data_p->timer);
++}
++
++
++static void garmin_release(struct usb_serial *serial)
++{
++ struct usb_serial_port *port = serial->port[0];
++ struct garmin_data *garmin_data_p = usb_get_serial_port_data(port);
++
++ dbg("%s", __func__);
++
+ kfree(garmin_data_p);
+- usb_set_serial_port_data(port, NULL);
+ }
+
+
+@@ -1557,7 +1566,8 @@ static struct usb_serial_driver garmin_d
+ .throttle = garmin_throttle,
+ .unthrottle = garmin_unthrottle,
+ .attach = garmin_attach,
+- .shutdown = garmin_shutdown,
++ .disconnect = garmin_disconnect,
++ .release = garmin_release,
+ .write = garmin_write,
+ .write_room = garmin_write_room,
+ .write_bulk_callback = garmin_write_bulk_callback,
+--- a/drivers/usb/serial/generic.c
++++ b/drivers/usb/serial/generic.c
+@@ -63,7 +63,8 @@ struct usb_serial_driver usb_serial_gene
+ .id_table = generic_device_ids,
+ .usb_driver = &generic_driver,
+ .num_ports = 1,
+- .shutdown = usb_serial_generic_shutdown,
++ .disconnect = usb_serial_generic_disconnect,
++ .release = usb_serial_generic_release,
+ .throttle = usb_serial_generic_throttle,
+ .unthrottle = usb_serial_generic_unthrottle,
+ .resume = usb_serial_generic_resume,
+@@ -413,7 +414,7 @@ void usb_serial_generic_unthrottle(struc
+ }
+ }
+
+-void usb_serial_generic_shutdown(struct usb_serial *serial)
++void usb_serial_generic_disconnect(struct usb_serial *serial)
+ {
+ int i;
+
+@@ -424,3 +425,7 @@ void usb_serial_generic_shutdown(struct
+ generic_cleanup(serial->port[i]);
+ }
+
++void usb_serial_generic_release(struct usb_serial *serial)
++{
++ dbg("%s", __func__);
++}
+--- a/drivers/usb/serial/io_edgeport.c
++++ b/drivers/usb/serial/io_edgeport.c
+@@ -225,7 +225,8 @@ static int edge_tiocmget(struct tty_str
+ static int edge_tiocmset(struct tty_struct *tty, struct file *file,
+ unsigned int set, unsigned int clear);
+ static int edge_startup(struct usb_serial *serial);
+-static void edge_shutdown(struct usb_serial *serial);
++static void edge_disconnect(struct usb_serial *serial);
++static void edge_release(struct usb_serial *serial);
+
+ #include "io_tables.h" /* all of the devices that this driver supports */
+
+@@ -3195,21 +3196,16 @@ static int edge_startup(struct usb_seria
+
+
+ /****************************************************************************
+- * edge_shutdown
++ * edge_disconnect
+ * This function is called whenever the device is removed from the usb bus.
+ ****************************************************************************/
+-static void edge_shutdown(struct usb_serial *serial)
++static void edge_disconnect(struct usb_serial *serial)
+ {
+ struct edgeport_serial *edge_serial = usb_get_serial_data(serial);
+- int i;
+
+ dbg("%s", __func__);
+
+ /* stop reads and writes on all ports */
+- for (i = 0; i < serial->num_ports; ++i) {
+- kfree(usb_get_serial_port_data(serial->port[i]));
+- usb_set_serial_port_data(serial->port[i], NULL);
+- }
+ /* free up our endpoint stuff */
+ if (edge_serial->is_epic) {
+ usb_kill_urb(edge_serial->interrupt_read_urb);
+@@ -3220,9 +3216,24 @@ static void edge_shutdown(struct usb_ser
+ usb_free_urb(edge_serial->read_urb);
+ kfree(edge_serial->bulk_in_buffer);
+ }
++}
++
++
++/****************************************************************************
++ * edge_release
++ * This function is called when the device structure is deallocated.
++ ****************************************************************************/
++static void edge_release(struct usb_serial *serial)
++{
++ struct edgeport_serial *edge_serial = usb_get_serial_data(serial);
++ int i;
++
++ dbg("%s", __func__);
++
++ for (i = 0; i < serial->num_ports; ++i)
++ kfree(usb_get_serial_port_data(serial->port[i]));
+
+ kfree(edge_serial);
+- usb_set_serial_data(serial, NULL);
+ }
+
+
+--- a/drivers/usb/serial/io_tables.h
++++ b/drivers/usb/serial/io_tables.h
+@@ -117,7 +117,8 @@ static struct usb_serial_driver edgeport
+ .throttle = edge_throttle,
+ .unthrottle = edge_unthrottle,
+ .attach = edge_startup,
+- .shutdown = edge_shutdown,
++ .disconnect = edge_disconnect,
++ .release = edge_release,
+ .ioctl = edge_ioctl,
+ .set_termios = edge_set_termios,
+ .tiocmget = edge_tiocmget,
+@@ -145,7 +146,8 @@ static struct usb_serial_driver edgeport
+ .throttle = edge_throttle,
+ .unthrottle = edge_unthrottle,
+ .attach = edge_startup,
+- .shutdown = edge_shutdown,
++ .disconnect = edge_disconnect,
++ .release = edge_release,
+ .ioctl = edge_ioctl,
+ .set_termios = edge_set_termios,
+ .tiocmget = edge_tiocmget,
+@@ -173,7 +175,8 @@ static struct usb_serial_driver edgeport
+ .throttle = edge_throttle,
+ .unthrottle = edge_unthrottle,
+ .attach = edge_startup,
+- .shutdown = edge_shutdown,
++ .disconnect = edge_disconnect,
++ .release = edge_release,
+ .ioctl = edge_ioctl,
+ .set_termios = edge_set_termios,
+ .tiocmget = edge_tiocmget,
+@@ -200,7 +203,8 @@ static struct usb_serial_driver epic_dev
+ .throttle = edge_throttle,
+ .unthrottle = edge_unthrottle,
+ .attach = edge_startup,
+- .shutdown = edge_shutdown,
++ .disconnect = edge_disconnect,
++ .release = edge_release,
+ .ioctl = edge_ioctl,
+ .set_termios = edge_set_termios,
+ .tiocmget = edge_tiocmget,
+--- a/drivers/usb/serial/io_ti.c
++++ b/drivers/usb/serial/io_ti.c
+@@ -2664,7 +2664,7 @@ cleanup:
+ return -ENOMEM;
+ }
+
+-static void edge_shutdown(struct usb_serial *serial)
++static void edge_disconnect(struct usb_serial *serial)
+ {
+ int i;
+ struct edgeport_port *edge_port;
+@@ -2674,12 +2674,22 @@ static void edge_shutdown(struct usb_ser
+ for (i = 0; i < serial->num_ports; ++i) {
+ edge_port = usb_get_serial_port_data(serial->port[i]);
+ edge_remove_sysfs_attrs(edge_port->port);
++ }
++}
++
++static void edge_release(struct usb_serial *serial)
++{
++ int i;
++ struct edgeport_port *edge_port;
++
++ dbg("%s", __func__);
++
++ for (i = 0; i < serial->num_ports; ++i) {
++ edge_port = usb_get_serial_port_data(serial->port[i]);
+ edge_buf_free(edge_port->ep_out_buf);
+ kfree(edge_port);
+- usb_set_serial_port_data(serial->port[i], NULL);
+ }
+ kfree(usb_get_serial_data(serial));
+- usb_set_serial_data(serial, NULL);
+ }
+
+
+@@ -2916,7 +2926,8 @@ static struct usb_serial_driver edgeport
+ .throttle = edge_throttle,
+ .unthrottle = edge_unthrottle,
+ .attach = edge_startup,
+- .shutdown = edge_shutdown,
++ .disconnect = edge_disconnect,
++ .release = edge_release,
+ .port_probe = edge_create_sysfs_attrs,
+ .ioctl = edge_ioctl,
+ .set_termios = edge_set_termios,
+@@ -2945,7 +2956,8 @@ static struct usb_serial_driver edgeport
+ .throttle = edge_throttle,
+ .unthrottle = edge_unthrottle,
+ .attach = edge_startup,
+- .shutdown = edge_shutdown,
++ .disconnect = edge_disconnect,
++ .release = edge_release,
+ .port_probe = edge_create_sysfs_attrs,
+ .ioctl = edge_ioctl,
+ .set_termios = edge_set_termios,
+--- a/drivers/usb/serial/ipaq.c
++++ b/drivers/usb/serial/ipaq.c
+@@ -80,7 +80,6 @@ static void ipaq_close(struct tty_struct
+ struct usb_serial_port *port, struct file *filp);
+ static int ipaq_calc_num_ports(struct usb_serial *serial);
+ static int ipaq_startup(struct usb_serial *serial);
+-static void ipaq_shutdown(struct usb_serial *serial);
+ static int ipaq_write(struct tty_struct *tty, struct usb_serial_port *port,
+ const unsigned char *buf, int count);
+ static int ipaq_write_bulk(struct usb_serial_port *port,
+@@ -577,7 +576,6 @@ static struct usb_serial_driver ipaq_dev
+ .close = ipaq_close,
+ .attach = ipaq_startup,
+ .calc_num_ports = ipaq_calc_num_ports,
+- .shutdown = ipaq_shutdown,
+ .write = ipaq_write,
+ .write_room = ipaq_write_room,
+ .chars_in_buffer = ipaq_chars_in_buffer,
+@@ -992,11 +990,6 @@ static int ipaq_startup(struct usb_seria
+ return usb_reset_configuration(serial->dev);
+ }
+
+-static void ipaq_shutdown(struct usb_serial *serial)
+-{
+- dbg("%s", __func__);
+-}
+-
+ static int __init ipaq_init(void)
+ {
+ int retval;
+--- a/drivers/usb/serial/iuu_phoenix.c
++++ b/drivers/usb/serial/iuu_phoenix.c
+@@ -122,8 +122,8 @@ static int iuu_startup(struct usb_serial
+ return 0;
+ }
+
+-/* Shutdown function */
+-static void iuu_shutdown(struct usb_serial *serial)
++/* Release function */
++static void iuu_release(struct usb_serial *serial)
+ {
+ struct usb_serial_port *port = serial->port[0];
+ struct iuu_private *priv = usb_get_serial_port_data(port);
+@@ -1176,7 +1176,7 @@ static struct usb_serial_driver iuu_devi
+ .tiocmget = iuu_tiocmget,
+ .tiocmset = iuu_tiocmset,
+ .attach = iuu_startup,
+- .shutdown = iuu_shutdown,
++ .release = iuu_release,
+ };
+
+ static int __init iuu_init(void)
+--- a/drivers/usb/serial/keyspan.c
++++ b/drivers/usb/serial/keyspan.c
+@@ -2682,7 +2682,7 @@ static int keyspan_startup(struct usb_se
+ return 0;
+ }
+
+-static void keyspan_shutdown(struct usb_serial *serial)
++static void keyspan_disconnect(struct usb_serial *serial)
+ {
+ int i, j;
+ struct usb_serial_port *port;
+@@ -2722,6 +2722,17 @@ static void keyspan_shutdown(struct usb_
+ usb_free_urb(p_priv->out_urbs[j]);
+ }
+ }
++}
++
++static void keyspan_release(struct usb_serial *serial)
++{
++ int i;
++ struct usb_serial_port *port;
++ struct keyspan_serial_private *s_priv;
++
++ dbg("%s", __func__);
++
++ s_priv = usb_get_serial_data(serial);
+
+ /* dbg("Freeing serial->private."); */
+ kfree(s_priv);
+--- a/drivers/usb/serial/keyspan.h
++++ b/drivers/usb/serial/keyspan.h
+@@ -42,7 +42,8 @@ static void keyspan_close (struct tty_s
+ struct usb_serial_port *port,
+ struct file *filp);
+ static int keyspan_startup (struct usb_serial *serial);
+-static void keyspan_shutdown (struct usb_serial *serial);
++static void keyspan_disconnect (struct usb_serial *serial);
++static void keyspan_release (struct usb_serial *serial);
+ static int keyspan_write_room (struct tty_struct *tty);
+
+ static int keyspan_write (struct tty_struct *tty,
+@@ -569,7 +570,8 @@ static struct usb_serial_driver keyspan_
+ .tiocmget = keyspan_tiocmget,
+ .tiocmset = keyspan_tiocmset,
+ .attach = keyspan_startup,
+- .shutdown = keyspan_shutdown,
++ .disconnect = keyspan_disconnect,
++ .release = keyspan_release,
+ };
+
+ static struct usb_serial_driver keyspan_2port_device = {
+@@ -589,7 +591,8 @@ static struct usb_serial_driver keyspan_
+ .tiocmget = keyspan_tiocmget,
+ .tiocmset = keyspan_tiocmset,
+ .attach = keyspan_startup,
+- .shutdown = keyspan_shutdown,
++ .disconnect = keyspan_disconnect,
++ .release = keyspan_release,
+ };
+
+ static struct usb_serial_driver keyspan_4port_device = {
+@@ -609,7 +612,8 @@ static struct usb_serial_driver keyspan_
+ .tiocmget = keyspan_tiocmget,
+ .tiocmset = keyspan_tiocmset,
+ .attach = keyspan_startup,
+- .shutdown = keyspan_shutdown,
++ .disconnect = keyspan_disconnect,
++ .release = keyspan_release,
+ };
+
+ #endif
+--- a/drivers/usb/serial/keyspan_pda.c
++++ b/drivers/usb/serial/keyspan_pda.c
+@@ -795,7 +795,7 @@ static int keyspan_pda_startup(struct us
+ return 0;
+ }
+
+-static void keyspan_pda_shutdown(struct usb_serial *serial)
++static void keyspan_pda_release(struct usb_serial *serial)
+ {
+ dbg("%s", __func__);
+
+@@ -853,7 +853,7 @@ static struct usb_serial_driver keyspan_
+ .tiocmget = keyspan_pda_tiocmget,
+ .tiocmset = keyspan_pda_tiocmset,
+ .attach = keyspan_pda_startup,
+- .shutdown = keyspan_pda_shutdown,
++ .release = keyspan_pda_release,
+ };
+
+
+--- a/drivers/usb/serial/kl5kusb105.c
++++ b/drivers/usb/serial/kl5kusb105.c
+@@ -73,7 +73,8 @@ static int debug;
+ * Function prototypes
+ */
+ static int klsi_105_startup(struct usb_serial *serial);
+-static void klsi_105_shutdown(struct usb_serial *serial);
++static void klsi_105_disconnect(struct usb_serial *serial);
++static void klsi_105_release(struct usb_serial *serial);
+ static int klsi_105_open(struct tty_struct *tty,
+ struct usb_serial_port *port, struct file *filp);
+ static void klsi_105_close(struct tty_struct *tty,
+@@ -132,7 +133,8 @@ static struct usb_serial_driver kl5kusb1
+ .tiocmget = klsi_105_tiocmget,
+ .tiocmset = klsi_105_tiocmset,
+ .attach = klsi_105_startup,
+- .shutdown = klsi_105_shutdown,
++ .disconnect = klsi_105_disconnect,
++ .release = klsi_105_release,
+ .throttle = klsi_105_throttle,
+ .unthrottle = klsi_105_unthrottle,
+ };
+@@ -316,7 +318,7 @@ err_cleanup:
+ } /* klsi_105_startup */
+
+
+-static void klsi_105_shutdown(struct usb_serial *serial)
++static void klsi_105_disconnect(struct usb_serial *serial)
+ {
+ int i;
+
+@@ -326,33 +328,36 @@ static void klsi_105_shutdown(struct usb
+ for (i = 0; i < serial->num_ports; ++i) {
+ struct klsi_105_private *priv =
+ usb_get_serial_port_data(serial->port[i]);
+- unsigned long flags;
+
+ if (priv) {
+ /* kill our write urb pool */
+ int j;
+ struct urb **write_urbs = priv->write_urb_pool;
+- spin_lock_irqsave(&priv->lock, flags);
+
+ for (j = 0; j < NUM_URBS; j++) {
+ if (write_urbs[j]) {
+- /* FIXME - uncomment the following
+- * usb_kill_urb call when the host
+- * controllers get fixed to set
+- * urb->dev = NULL after the urb is
+- * finished. Otherwise this call
+- * oopses. */
+- /* usb_kill_urb(write_urbs[j]); */
+- kfree(write_urbs[j]->transfer_buffer);
++ usb_kill_urb(write_urbs[j]);
+ usb_free_urb(write_urbs[j]);
+ }
+ }
+- spin_unlock_irqrestore(&priv->lock, flags);
+- kfree(priv);
+- usb_set_serial_port_data(serial->port[i], NULL);
+ }
+ }
+-} /* klsi_105_shutdown */
++} /* klsi_105_disconnect */
++
++
++static void klsi_105_release(struct usb_serial *serial)
++{
++ int i;
++
++ dbg("%s", __func__);
++
++ for (i = 0; i < serial->num_ports; ++i) {
++ struct klsi_105_private *priv =
++ usb_get_serial_port_data(serial->port[i]);
++
++ kfree(priv);
++ }
++} /* klsi_105_release */
+
+ static int klsi_105_open(struct tty_struct *tty,
+ struct usb_serial_port *port, struct file *filp)
+--- a/drivers/usb/serial/kobil_sct.c
++++ b/drivers/usb/serial/kobil_sct.c
+@@ -69,7 +69,7 @@ static int debug;
+
+ /* Function prototypes */
+ static int kobil_startup(struct usb_serial *serial);
+-static void kobil_shutdown(struct usb_serial *serial);
++static void kobil_release(struct usb_serial *serial);
+ static int kobil_open(struct tty_struct *tty,
+ struct usb_serial_port *port, struct file *filp);
+ static void kobil_close(struct tty_struct *tty, struct usb_serial_port *port,
+@@ -118,7 +118,7 @@ static struct usb_serial_driver kobil_de
+ .id_table = id_table,
+ .num_ports = 1,
+ .attach = kobil_startup,
+- .shutdown = kobil_shutdown,
++ .release = kobil_release,
+ .ioctl = kobil_ioctl,
+ .set_termios = kobil_set_termios,
+ .tiocmget = kobil_tiocmget,
+@@ -202,17 +202,13 @@ static int kobil_startup(struct usb_seri
+ }
+
+
+-static void kobil_shutdown(struct usb_serial *serial)
++static void kobil_release(struct usb_serial *serial)
+ {
+ int i;
+ dbg("%s - port %d", __func__, serial->port[0]->number);
+
+- for (i = 0; i < serial->num_ports; ++i) {
+- while (serial->port[i]->port.count > 0)
+- kobil_close(NULL, serial->port[i], NULL);
++ for (i = 0; i < serial->num_ports; ++i)
+ kfree(usb_get_serial_port_data(serial->port[i]));
+- usb_set_serial_port_data(serial->port[i], NULL);
+- }
+ }
+
+
+--- a/drivers/usb/serial/mct_u232.c
++++ b/drivers/usb/serial/mct_u232.c
+@@ -92,7 +92,7 @@ static int debug;
+ * Function prototypes
+ */
+ static int mct_u232_startup(struct usb_serial *serial);
+-static void mct_u232_shutdown(struct usb_serial *serial);
++static void mct_u232_release(struct usb_serial *serial);
+ static int mct_u232_open(struct tty_struct *tty,
+ struct usb_serial_port *port, struct file *filp);
+ static void mct_u232_close(struct tty_struct *tty,
+@@ -148,7 +148,7 @@ static struct usb_serial_driver mct_u232
+ .tiocmget = mct_u232_tiocmget,
+ .tiocmset = mct_u232_tiocmset,
+ .attach = mct_u232_startup,
+- .shutdown = mct_u232_shutdown,
++ .release = mct_u232_release,
+ };
+
+
+@@ -406,7 +406,7 @@ static int mct_u232_startup(struct usb_s
+ } /* mct_u232_startup */
+
+
+-static void mct_u232_shutdown(struct usb_serial *serial)
++static void mct_u232_release(struct usb_serial *serial)
+ {
+ struct mct_u232_private *priv;
+ int i;
+@@ -416,12 +416,9 @@ static void mct_u232_shutdown(struct usb
+ for (i = 0; i < serial->num_ports; ++i) {
+ /* My special items, the standard routines free my urbs */
+ priv = usb_get_serial_port_data(serial->port[i]);
+- if (priv) {
+- usb_set_serial_port_data(serial->port[i], NULL);
+- kfree(priv);
+- }
++ kfree(priv);
+ }
+-} /* mct_u232_shutdown */
++} /* mct_u232_release */
+
+ static int mct_u232_open(struct tty_struct *tty,
+ struct usb_serial_port *port, struct file *filp)
+--- a/drivers/usb/serial/mos7720.c
++++ b/drivers/usb/serial/mos7720.c
+@@ -1522,19 +1522,16 @@ static int mos7720_startup(struct usb_se
+ return 0;
+ }
+
+-static void mos7720_shutdown(struct usb_serial *serial)
++static void mos7720_release(struct usb_serial *serial)
+ {
+ int i;
+
+ /* free private structure allocated for serial port */
+- for (i = 0; i < serial->num_ports; ++i) {
++ for (i = 0; i < serial->num_ports; ++i)
+ kfree(usb_get_serial_port_data(serial->port[i]));
+- usb_set_serial_port_data(serial->port[i], NULL);
+- }
+
+ /* free private structure allocated for serial device */
+ kfree(usb_get_serial_data(serial));
+- usb_set_serial_data(serial, NULL);
+ }
+
+ static struct usb_driver usb_driver = {
+@@ -1559,7 +1556,7 @@ static struct usb_serial_driver moschip7
+ .throttle = mos7720_throttle,
+ .unthrottle = mos7720_unthrottle,
+ .attach = mos7720_startup,
+- .shutdown = mos7720_shutdown,
++ .release = mos7720_release,
+ .ioctl = mos7720_ioctl,
+ .set_termios = mos7720_set_termios,
+ .write = mos7720_write,
+--- a/drivers/usb/serial/mos7840.c
++++ b/drivers/usb/serial/mos7840.c
+@@ -2673,16 +2673,16 @@ error:
+ }
+
+ /****************************************************************************
+- * mos7840_shutdown
++ * mos7840_disconnect
+ * This function is called whenever the device is removed from the usb bus.
+ ****************************************************************************/
+
+-static void mos7840_shutdown(struct usb_serial *serial)
++static void mos7840_disconnect(struct usb_serial *serial)
+ {
+ int i;
+ unsigned long flags;
+ struct moschip_port *mos7840_port;
+- dbg("%s \n", " shutdown :entering..........");
++ dbg("%s \n", " disconnect :entering..........");
+
+ if (!serial) {
+ dbg("%s", "Invalid Handler \n");
+@@ -2702,11 +2702,42 @@ static void mos7840_shutdown(struct usb_
+ mos7840_port->zombie = 1;
+ spin_unlock_irqrestore(&mos7840_port->pool_lock, flags);
+ usb_kill_urb(mos7840_port->control_urb);
++ }
++ }
++
++ dbg("%s", "Thank u :: ");
++
++}
++
++/****************************************************************************
++ * mos7840_release
++ * This function is called when the usb_serial structure is freed.
++ ****************************************************************************/
++
++static void mos7840_release(struct usb_serial *serial)
++{
++ int i;
++ struct moschip_port *mos7840_port;
++ dbg("%s", " release :entering..........");
++
++ if (!serial) {
++ dbg("%s", "Invalid Handler");
++ return;
++ }
++
++ /* check for the ports to be closed,close the ports and disconnect */
++
++ /* free private structure allocated for serial port *
++ * stop reads and writes on all ports */
++
++ for (i = 0; i < serial->num_ports; ++i) {
++ mos7840_port = mos7840_get_port_private(serial->port[i]);
++ dbg("mos7840_port %d = %p", i, mos7840_port);
++ if (mos7840_port) {
+ kfree(mos7840_port->ctrl_buf);
+ kfree(mos7840_port->dr);
+ kfree(mos7840_port);
+ }
+- mos7840_set_port_private(serial->port[i], NULL);
+ }
+
+ dbg("%s\n", "Thank u :: ");
+@@ -2747,7 +2778,8 @@ static struct usb_serial_driver moschip7
+ .tiocmget = mos7840_tiocmget,
+ .tiocmset = mos7840_tiocmset,
+ .attach = mos7840_startup,
+- .shutdown = mos7840_shutdown,
++ .disconnect = mos7840_disconnect,
++ .release = mos7840_release,
+ .read_bulk_callback = mos7840_bulk_in_callback,
+ .read_int_callback = mos7840_interrupt_callback,
+ };
+--- a/drivers/usb/serial/omninet.c
++++ b/drivers/usb/serial/omninet.c
+@@ -73,7 +73,8 @@ static void omninet_write_bulk_callback(
+ static int omninet_write(struct tty_struct *tty, struct usb_serial_port *port,
+ const unsigned char *buf, int count);
+ static int omninet_write_room(struct tty_struct *tty);
+-static void omninet_shutdown(struct usb_serial *serial);
++static void omninet_disconnect(struct usb_serial *serial);
++static void omninet_release(struct usb_serial *serial);
+ static int omninet_attach(struct usb_serial *serial);
+
+ static struct usb_device_id id_table[] = {
+@@ -109,7 +110,8 @@ static struct usb_serial_driver zyxel_om
+ .write_room = omninet_write_room,
+ .read_bulk_callback = omninet_read_bulk_callback,
+ .write_bulk_callback = omninet_write_bulk_callback,
+- .shutdown = omninet_shutdown,
++ .disconnect = omninet_disconnect,
++ .release = omninet_release,
+ };
+
+
+@@ -347,13 +349,22 @@ static void omninet_write_bulk_callback(
+ }
+
+
+-static void omninet_shutdown(struct usb_serial *serial)
++static void omninet_disconnect(struct usb_serial *serial)
+ {
+ struct usb_serial_port *wport = serial->port[1];
+- struct usb_serial_port *port = serial->port[0];
++
+ dbg("%s", __func__);
+
+ usb_kill_urb(wport->write_urb);
++}
++
++
++static void omninet_release(struct usb_serial *serial)
++{
++ struct usb_serial_port *port = serial->port[0];
++
++ dbg("%s", __func__);
++
+ kfree(usb_get_serial_port_data(port));
+ }
+
+--- a/drivers/usb/serial/opticon.c
++++ b/drivers/usb/serial/opticon.c
+@@ -464,7 +464,7 @@ error:
+ return retval;
+ }
+
+-static void opticon_shutdown(struct usb_serial *serial)
++static void opticon_disconnect(struct usb_serial *serial)
+ {
+ struct opticon_private *priv = usb_get_serial_data(serial);
+
+@@ -472,9 +472,16 @@ static void opticon_shutdown(struct usb_
+
+ usb_kill_urb(priv->bulk_read_urb);
+ usb_free_urb(priv->bulk_read_urb);
++}
++
++static void opticon_release(struct usb_serial *serial)
++{
++ struct opticon_private *priv = usb_get_serial_data(serial);
++
++ dbg("%s", __func__);
++
+ kfree(priv->bulk_in_buffer);
+ kfree(priv);
+- usb_set_serial_data(serial, NULL);
+ }
+
+ static int opticon_suspend(struct usb_interface *intf, pm_message_t message)
+@@ -525,7 +532,8 @@ static struct usb_serial_driver opticon_
+ .close = opticon_close,
+ .write = opticon_write,
+ .write_room = opticon_write_room,
+- .shutdown = opticon_shutdown,
++ .disconnect = opticon_disconnect,
++ .release = opticon_release,
+ .throttle = opticon_throttle,
+ .unthrottle = opticon_unthrottle,
+ .ioctl = opticon_ioctl,
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -48,7 +48,8 @@ static int option_open(struct tty_struc
+ static void option_close(struct tty_struct *tty, struct usb_serial_port *port,
+ struct file *filp);
+ static int option_startup(struct usb_serial *serial);
+-static void option_shutdown(struct usb_serial *serial);
++static void option_disconnect(struct usb_serial *serial);
++static void option_release(struct usb_serial *serial);
+ static int option_write_room(struct tty_struct *tty);
+
+ static void option_instat_callback(struct urb *urb);
+@@ -558,7 +559,8 @@ static struct usb_serial_driver option_1
+ .tiocmget = option_tiocmget,
+ .tiocmset = option_tiocmset,
+ .attach = option_startup,
+- .shutdown = option_shutdown,
++ .disconnect = option_disconnect,
++ .release = option_release,
+ .read_int_callback = option_instat_callback,
+ .suspend = option_suspend,
+ .resume = option_resume,
+@@ -1129,7 +1131,14 @@ static void stop_read_write_urbs(struct
+ }
+ }
+
+-static void option_shutdown(struct usb_serial *serial)
++static void option_disconnect(struct usb_serial *serial)
++{
++ dbg("%s", __func__);
++
++ stop_read_write_urbs(serial);
++}
++
++static void option_release(struct usb_serial *serial)
+ {
+ int i, j;
+ struct usb_serial_port *port;
+@@ -1137,8 +1146,6 @@ static void option_shutdown(struct usb_s
+
+ dbg("%s", __func__);
+
+- stop_read_write_urbs(serial);
+-
+ /* Now free them */
+ for (i = 0; i < serial->num_ports; ++i) {
+ port = serial->port[i];
+--- a/drivers/usb/serial/oti6858.c
++++ b/drivers/usb/serial/oti6858.c
+@@ -160,7 +160,7 @@ static int oti6858_tiocmget(struct tty_s
+ static int oti6858_tiocmset(struct tty_struct *tty, struct file *file,
+ unsigned int set, unsigned int clear);
+ static int oti6858_startup(struct usb_serial *serial);
+-static void oti6858_shutdown(struct usb_serial *serial);
++static void oti6858_release(struct usb_serial *serial);
+
+ /* functions operating on buffers */
+ static struct oti6858_buf *oti6858_buf_alloc(unsigned int size);
+@@ -195,7 +195,7 @@ static struct usb_serial_driver oti6858_
+ .write_room = oti6858_write_room,
+ .chars_in_buffer = oti6858_chars_in_buffer,
+ .attach = oti6858_startup,
+- .shutdown = oti6858_shutdown,
++ .release = oti6858_release,
+ };
+
+ struct oti6858_private {
+@@ -829,7 +829,7 @@ static int oti6858_ioctl(struct tty_stru
+ }
+
+
+-static void oti6858_shutdown(struct usb_serial *serial)
++static void oti6858_release(struct usb_serial *serial)
+ {
+ struct oti6858_private *priv;
+ int i;
+@@ -841,7 +841,6 @@ static void oti6858_shutdown(struct usb_
+ if (priv) {
+ oti6858_buf_free(priv->buf);
+ kfree(priv);
+- usb_set_serial_port_data(serial->port[i], NULL);
+ }
+ }
+ }
+--- a/drivers/usb/serial/pl2303.c
++++ b/drivers/usb/serial/pl2303.c
+@@ -897,7 +897,7 @@ static void pl2303_break_ctl(struct tty_
+ dbg("%s - error sending break = %d", __func__, result);
+ }
+
+-static void pl2303_shutdown(struct usb_serial *serial)
++static void pl2303_release(struct usb_serial *serial)
+ {
+ int i;
+ struct pl2303_private *priv;
+@@ -909,7 +909,6 @@ static void pl2303_shutdown(struct usb_s
+ if (priv) {
+ pl2303_buf_free(priv->buf);
+ kfree(priv);
+- usb_set_serial_port_data(serial->port[i], NULL);
+ }
+ }
+ }
+@@ -1137,7 +1136,7 @@ static struct usb_serial_driver pl2303_d
+ .write_room = pl2303_write_room,
+ .chars_in_buffer = pl2303_chars_in_buffer,
+ .attach = pl2303_startup,
+- .shutdown = pl2303_shutdown,
++ .release = pl2303_release,
+ };
+
+ static int __init pl2303_init(void)
+--- a/drivers/usb/serial/sierra.c
++++ b/drivers/usb/serial/sierra.c
+@@ -699,7 +699,7 @@ static int sierra_startup(struct usb_ser
+ return 0;
+ }
+
+-static void sierra_shutdown(struct usb_serial *serial)
++static void sierra_disconnect(struct usb_serial *serial)
+ {
+ int i, j;
+ struct usb_serial_port *port;
+@@ -718,10 +718,29 @@ static void sierra_shutdown(struct usb_s
+ for (j = 0; j < N_IN_URB; j++) {
+ usb_kill_urb(portdata->in_urbs[j]);
+ usb_free_urb(portdata->in_urbs[j]);
+- kfree(portdata->in_buffer[j]);
+ }
++ }
++}
++
++static void sierra_release(struct usb_serial *serial)
++{
++ int i, j;
++ struct usb_serial_port *port;
++ struct sierra_port_private *portdata;
++
++ dev_dbg(&serial->dev->dev, "%s\n", __func__);
++
++ for (i = 0; i < serial->num_ports; ++i) {
++ port = serial->port[i];
++ if (!port)
++ continue;
++ portdata = usb_get_serial_port_data(port);
++ if (!portdata)
++ continue;
++
++ for (j = 0; j < N_IN_URB; j++)
++ kfree(portdata->in_buffer[j]);
+ kfree(portdata);
+- usb_set_serial_port_data(port, NULL);
+ }
+ }
+
+@@ -743,7 +762,8 @@ static struct usb_serial_driver sierra_d
+ .tiocmget = sierra_tiocmget,
+ .tiocmset = sierra_tiocmset,
+ .attach = sierra_startup,
+- .shutdown = sierra_shutdown,
++ .disconnect = sierra_disconnect,
++ .release = sierra_release,
+ .read_int_callback = sierra_instat_callback,
+ };
+
+--- a/drivers/usb/serial/spcp8x5.c
++++ b/drivers/usb/serial/spcp8x5.c
+@@ -356,7 +356,7 @@ cleanup:
+ }
+
+ /* call when the device plug out. free all the memory alloced by probe */
+-static void spcp8x5_shutdown(struct usb_serial *serial)
++static void spcp8x5_release(struct usb_serial *serial)
+ {
+ int i;
+ struct spcp8x5_private *priv;
+@@ -366,7 +366,6 @@ static void spcp8x5_shutdown(struct usb_
+ if (priv) {
+ free_ringbuf(priv->buf);
+ kfree(priv);
+- usb_set_serial_port_data(serial->port[i] , NULL);
+ }
+ }
+ }
+@@ -1043,7 +1042,7 @@ static struct usb_serial_driver spcp8x5_
+ .write_bulk_callback = spcp8x5_write_bulk_callback,
+ .chars_in_buffer = spcp8x5_chars_in_buffer,
+ .attach = spcp8x5_startup,
+- .shutdown = spcp8x5_shutdown,
++ .release = spcp8x5_release,
+ };
+
+ static int __init spcp8x5_init(void)
+--- a/drivers/usb/serial/symbolserial.c
++++ b/drivers/usb/serial/symbolserial.c
+@@ -268,7 +268,7 @@ error:
+ return retval;
+ }
+
+-static void symbol_shutdown(struct usb_serial *serial)
++static void symbol_disconnect(struct usb_serial *serial)
+ {
+ struct symbol_private *priv = usb_get_serial_data(serial);
+
+@@ -276,9 +276,16 @@ static void symbol_shutdown(struct usb_s
+
+ usb_kill_urb(priv->int_urb);
+ usb_free_urb(priv->int_urb);
++}
++
++static void symbol_release(struct usb_serial *serial)
++{
++ struct symbol_private *priv = usb_get_serial_data(serial);
++
++ dbg("%s", __func__);
++
+ kfree(priv->int_buffer);
+ kfree(priv);
+- usb_set_serial_data(serial, NULL);
+ }
+
+ static struct usb_driver symbol_driver = {
+@@ -300,7 +307,8 @@ static struct usb_serial_driver symbol_d
+ .attach = symbol_startup,
+ .open = symbol_open,
+ .close = symbol_close,
+- .shutdown = symbol_shutdown,
++ .disconnect = symbol_disconnect,
++ .release = symbol_release,
+ .throttle = symbol_throttle,
+ .unthrottle = symbol_unthrottle,
+ };
+--- a/drivers/usb/serial/ti_usb_3410_5052.c
++++ b/drivers/usb/serial/ti_usb_3410_5052.c
+@@ -97,7 +97,7 @@ struct ti_device {
+ /* Function Declarations */
+
+ static int ti_startup(struct usb_serial *serial);
+-static void ti_shutdown(struct usb_serial *serial);
++static void ti_release(struct usb_serial *serial);
+ static int ti_open(struct tty_struct *tty, struct usb_serial_port *port,
+ struct file *file);
+ static void ti_close(struct tty_struct *tty, struct usb_serial_port *port,
+@@ -231,7 +231,7 @@ static struct usb_serial_driver ti_1port
+ .id_table = ti_id_table_3410,
+ .num_ports = 1,
+ .attach = ti_startup,
+- .shutdown = ti_shutdown,
++ .release = ti_release,
+ .open = ti_open,
+ .close = ti_close,
+ .write = ti_write,
+@@ -259,7 +259,7 @@ static struct usb_serial_driver ti_2port
+ .id_table = ti_id_table_5052,
+ .num_ports = 2,
+ .attach = ti_startup,
+- .shutdown = ti_shutdown,
++ .release = ti_release,
+ .open = ti_open,
+ .close = ti_close,
+ .write = ti_write,
+@@ -474,7 +474,7 @@ free_tdev:
+ }
+
+
+-static void ti_shutdown(struct usb_serial *serial)
++static void ti_release(struct usb_serial *serial)
+ {
+ int i;
+ struct ti_device *tdev = usb_get_serial_data(serial);
+@@ -487,12 +487,10 @@ static void ti_shutdown(struct usb_seria
+ if (tport) {
+ ti_buf_free(tport->tp_write_buf);
+ kfree(tport);
+- usb_set_serial_port_data(serial->port[i], NULL);
+ }
+ }
+
+ kfree(tdev);
+- usb_set_serial_data(serial, NULL);
+ }
+
+
+--- a/drivers/usb/serial/usb-serial.c
++++ b/drivers/usb/serial/usb-serial.c
+@@ -141,6 +141,14 @@ static void destroy_serial(struct kref *
+ if (serial->minor != SERIAL_TTY_NO_MINOR)
+ return_serial(serial);
+
++ serial->type->release(serial);
++
++ for (i = 0; i < serial->num_ports; ++i) {
++ port = serial->port[i];
++ if (port)
++ put_device(&port->dev);
++ }
++
+ /* If this is a "fake" port, we have to clean it up here, as it will
+ * not get cleaned up in port_release() as it was never registered with
+ * the driver core */
+@@ -148,9 +156,8 @@ static void destroy_serial(struct kref *
+ for (i = serial->num_ports;
+ i < serial->num_port_pointers; ++i) {
+ port = serial->port[i];
+- if (!port)
+- continue;
+- port_free(port);
++ if (port)
++ port_free(port);
+ }
+ }
+
+@@ -1062,10 +1069,6 @@ void usb_serial_disconnect(struct usb_in
+ serial->disconnected = 1;
+ mutex_unlock(&serial->disc_mutex);
+
+- /* Unfortunately, many of the sub-drivers expect the port structures
+- * to exist when their shutdown method is called, so we have to go
+- * through this awkward two-step unregistration procedure.
+- */
+ for (i = 0; i < serial->num_ports; ++i) {
+ port = serial->port[i];
+ if (port) {
+@@ -1079,14 +1082,7 @@ void usb_serial_disconnect(struct usb_in
+ device_del(&port->dev);
+ }
+ }
+- serial->type->shutdown(serial);
+- for (i = 0; i < serial->num_ports; ++i) {
+- port = serial->port[i];
+- if (port) {
+- put_device(&port->dev);
+- serial->port[i] = NULL;
+- }
+- }
++ serial->type->disconnect(serial);
+
+ /* let the last holder of this object
+ * cause it to be cleaned up */
+@@ -1262,7 +1258,8 @@ static void fixup_generic(struct usb_ser
+ set_to_generic_if_null(device, chars_in_buffer);
+ set_to_generic_if_null(device, read_bulk_callback);
+ set_to_generic_if_null(device, write_bulk_callback);
+- set_to_generic_if_null(device, shutdown);
++ set_to_generic_if_null(device, disconnect);
++ set_to_generic_if_null(device, release);
+ }
+
+ int usb_serial_register(struct usb_serial_driver *driver)
+--- a/drivers/usb/serial/visor.c
++++ b/drivers/usb/serial/visor.c
+@@ -48,7 +48,7 @@ static void visor_unthrottle(struct tty_
+ static int visor_probe(struct usb_serial *serial,
+ const struct usb_device_id *id);
+ static int visor_calc_num_ports(struct usb_serial *serial);
+-static void visor_shutdown(struct usb_serial *serial);
++static void visor_release(struct usb_serial *serial);
+ static void visor_write_bulk_callback(struct urb *urb);
+ static void visor_read_bulk_callback(struct urb *urb);
+ static void visor_read_int_callback(struct urb *urb);
+@@ -203,7 +203,7 @@ static struct usb_serial_driver handspri
+ .attach = treo_attach,
+ .probe = visor_probe,
+ .calc_num_ports = visor_calc_num_ports,
+- .shutdown = visor_shutdown,
++ .release = visor_release,
+ .write = visor_write,
+ .write_room = visor_write_room,
+ .write_bulk_callback = visor_write_bulk_callback,
+@@ -228,7 +228,7 @@ static struct usb_serial_driver clie_5_d
+ .attach = clie_5_attach,
+ .probe = visor_probe,
+ .calc_num_ports = visor_calc_num_ports,
+- .shutdown = visor_shutdown,
++ .release = visor_release,
+ .write = visor_write,
+ .write_room = visor_write_room,
+ .write_bulk_callback = visor_write_bulk_callback,
+@@ -920,7 +920,7 @@ static int clie_5_attach(struct usb_seri
+ return generic_startup(serial);
+ }
+
+-static void visor_shutdown(struct usb_serial *serial)
++static void visor_release(struct usb_serial *serial)
+ {
+ struct visor_private *priv;
+ int i;
+@@ -929,10 +929,7 @@ static void visor_shutdown(struct usb_se
+
+ for (i = 0; i < serial->num_ports; i++) {
+ priv = usb_get_serial_port_data(serial->port[i]);
+- if (priv) {
+- usb_set_serial_port_data(serial->port[i], NULL);
+- kfree(priv);
+- }
++ kfree(priv);
+ }
+ }
+
+--- a/drivers/usb/serial/whiteheat.c
++++ b/drivers/usb/serial/whiteheat.c
+@@ -144,7 +144,7 @@ static int whiteheat_firmware_attach(st
+
+ /* function prototypes for the Connect Tech WhiteHEAT serial converter */
+ static int whiteheat_attach(struct usb_serial *serial);
+-static void whiteheat_shutdown(struct usb_serial *serial);
++static void whiteheat_release(struct usb_serial *serial);
+ static int whiteheat_open(struct tty_struct *tty,
+ struct usb_serial_port *port, struct file *filp);
+ static void whiteheat_close(struct tty_struct *tty,
+@@ -190,7 +190,7 @@ static struct usb_serial_driver whitehea
+ .id_table = id_table_std,
+ .num_ports = 4,
+ .attach = whiteheat_attach,
+- .shutdown = whiteheat_shutdown,
++ .release = whiteheat_release,
+ .open = whiteheat_open,
+ .close = whiteheat_close,
+ .write = whiteheat_write,
+@@ -618,7 +618,7 @@ no_command_buffer:
+ }
+
+
+-static void whiteheat_shutdown(struct usb_serial *serial)
++static void whiteheat_release(struct usb_serial *serial)
+ {
+ struct usb_serial_port *command_port;
+ struct usb_serial_port *port;
+--- a/include/linux/usb/serial.h
++++ b/include/linux/usb/serial.h
+@@ -181,8 +181,10 @@ static inline void usb_set_serial_data(s
+ * This will be called when the struct usb_serial structure is fully set
+ * set up. Do any local initialization of the device, or any private
+ * memory structure allocation at this point in time.
+- * @shutdown: pointer to the driver's shutdown function. This will be
+- * called when the device is removed from the system.
++ * @disconnect: pointer to the driver's disconnect function. This will be
++ * called when the device is unplugged or unbound from the driver.
++ * @release: pointer to the driver's release function. This will be called
++ * when the usb_serial data structure is about to be destroyed.
+ * @usb_driver: pointer to the struct usb_driver that controls this
+ * device. This is necessary to allow dynamic ids to be added to
+ * the driver from sysfs.
+@@ -212,7 +214,8 @@ struct usb_serial_driver {
+ int (*attach)(struct usb_serial *serial);
+ int (*calc_num_ports) (struct usb_serial *serial);
+
+- void (*shutdown)(struct usb_serial *serial);
++ void (*disconnect)(struct usb_serial *serial);
++ void (*release)(struct usb_serial *serial);
+
+ int (*port_probe)(struct usb_serial_port *port);
+ int (*port_remove)(struct usb_serial_port *port);
+@@ -292,7 +295,8 @@ extern void usb_serial_generic_read_bulk
+ extern void usb_serial_generic_write_bulk_callback(struct urb *urb);
+ extern void usb_serial_generic_throttle(struct tty_struct *tty);
+ extern void usb_serial_generic_unthrottle(struct tty_struct *tty);
+-extern void usb_serial_generic_shutdown(struct usb_serial *serial);
++extern void usb_serial_generic_disconnect(struct usb_serial *serial);
++extern void usb_serial_generic_release(struct usb_serial *serial);
+ extern int usb_serial_generic_register(int debug);
+ extern void usb_serial_generic_deregister(void);
+
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:24:39 2009
+Message-Id: <20090701002439.222808279@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:24:12 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jiri Slaby <jirislaby@gmail.com>,
+ Alan Cox <alan@linux.intel.com>
+Subject: [patch 083/108] pcmcia/cm4000: fix lock imbalance
+References: <20090701002249.937782934@mini.kroah.org>
+Content-Disposition: inline; filename=pcmcia-cm4000-fix-lock-imbalance.patch
+Content-Length: 777
+Lines: 28
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Jiri Slaby <jirislaby@gmail.com>
+
+commit 69ae59d7d8df14413cf0a97b3e372d7dc8352563 upstream.
+
+Don't return from switch/case, break instead, so that we unlock BKL.
+
+Signed-off-by: Jiri Slaby <jirislaby@gmail.com>
+Signed-off-by: Alan Cox <alan@linux.intel.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/char/pcmcia/cm4000_cs.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/char/pcmcia/cm4000_cs.c
++++ b/drivers/char/pcmcia/cm4000_cs.c
+@@ -1575,7 +1575,8 @@ static long cmm_ioctl(struct file *filp,
+ clear_bit(LOCK_IO, &dev->flags);
+ wake_up_interruptible(&dev->ioq);
+
+- return 0;
++ rc = 0;
++ break;
+ case CM_IOCSPTS:
+ {
+ struct ptsreq krnptsreq;
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:24:39 2009
+Message-Id: <20090701002439.494893968@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:24:13 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jiri Slaby <jirislaby@gmail.com>,
+ Alan Cox <alan@linux.intel.com>
+Subject: [patch 084/108] n_r3964: fix lock imbalance
+References: <20090701002249.937782934@mini.kroah.org>
+Content-Disposition: inline; filename=n_r3964-fix-lock-imbalance.patch
+Content-Length: 2097
+Lines: 81
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Jiri Slaby <jirislaby@gmail.com>
+
+commit eca41044268887838fa122aa24475df8f23d614c upstream.
+
+There is omitted BKunL in r3964_read.
+
+Centralize the paths to one point with one unlock.
+
+Signed-off-by: Jiri Slaby <jirislaby@gmail.com>
+Signed-off-by: Alan Cox <alan@linux.intel.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/char/n_r3964.c | 26 ++++++++++++++------------
+ 1 file changed, 14 insertions(+), 12 deletions(-)
+
+--- a/drivers/char/n_r3964.c
++++ b/drivers/char/n_r3964.c
+@@ -1062,7 +1062,7 @@ static ssize_t r3964_read(struct tty_str
+ struct r3964_client_info *pClient;
+ struct r3964_message *pMsg;
+ struct r3964_client_message theMsg;
+- int count;
++ int ret;
+
+ TRACE_L("read()");
+
+@@ -1074,8 +1074,8 @@ static ssize_t r3964_read(struct tty_str
+ if (pMsg == NULL) {
+ /* no messages available. */
+ if (file->f_flags & O_NONBLOCK) {
+- unlock_kernel();
+- return -EAGAIN;
++ ret = -EAGAIN;
++ goto unlock;
+ }
+ /* block until there is a message: */
+ wait_event_interruptible(pInfo->read_wait,
+@@ -1085,29 +1085,31 @@ static ssize_t r3964_read(struct tty_str
+ /* If we still haven't got a message, we must have been signalled */
+
+ if (!pMsg) {
+- unlock_kernel();
+- return -EINTR;
++ ret = -EINTR;
++ goto unlock;
+ }
+
+ /* deliver msg to client process: */
+ theMsg.msg_id = pMsg->msg_id;
+ theMsg.arg = pMsg->arg;
+ theMsg.error_code = pMsg->error_code;
+- count = sizeof(struct r3964_client_message);
++ ret = sizeof(struct r3964_client_message);
+
+ kfree(pMsg);
+ TRACE_M("r3964_read - msg kfree %p", pMsg);
+
+- if (copy_to_user(buf, &theMsg, count)) {
+- unlock_kernel();
+- return -EFAULT;
++ if (copy_to_user(buf, &theMsg, ret)) {
++ ret = -EFAULT;
++ goto unlock;
+ }
+
+- TRACE_PS("read - return %d", count);
+- return count;
++ TRACE_PS("read - return %d", ret);
++ goto unlock;
+ }
++ ret = -EPERM;
++unlock:
+ unlock_kernel();
+- return -EPERM;
++ return ret;
+ }
+
+ static ssize_t r3964_write(struct tty_struct *tty, struct file *file,
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:24:39 2009
+Message-Id: <20090701002439.690770689@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:24:14 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>,
+ Alan Cox <alan@linux.intel.com>,
+ Jeff Garzik <jgarzik@redhat.com>
+Subject: [patch 085/108] parport_pc: set properly the dma_mask for parport_pc device
+References: <20090701002249.937782934@mini.kroah.org>
+Content-Disposition: inline; filename=parport_pc-set-properly-the-dma_mask-for-parport_pc-device.patch
+Content-Length: 1666
+Lines: 44
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
+
+commit dfa7c4d869b7d3d37b70f1de856f2901b6ebfcf0 upstream.
+
+parport_pc_probe_port() creates the own 'parport_pc' device if the
+device argument is NULL. Then parport_pc_probe_port() doesn't
+initialize the dma_mask and coherent_dma_mask of the device and calls
+dma_alloc_coherent with it. dma_alloc_coherent fails because
+dma_alloc_coherent() doesn't accept the uninitialized dma_mask:
+
+http://lkml.org/lkml/2009/6/16/150
+
+Long ago, X86_32 and X86_64 had the own dma_alloc_coherent
+implementations; X86_32 accepted a device having dma_mask that is not
+initialized however X86_64 didn't. When we merged them, we chose to
+prohibit a device having dma_mask that is not initialized. I think
+that it's good to require drivers to set up dma_mask (and
+coherent_dma_mask) properly if the drivers want DMA.
+
+Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
+Reported-by: Malcom Blaney <malcolm.blaney@maptek.com.au>
+Tested-by: Malcom Blaney <malcolm.blaney@maptek.com.au>
+Signed-off-by: Alan Cox <alan@linux.intel.com>
+Acked-by: Jeff Garzik <jgarzik@redhat.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/parport/parport_pc.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/parport/parport_pc.c
++++ b/drivers/parport/parport_pc.c
+@@ -2193,6 +2193,9 @@ struct parport *parport_pc_probe_port(un
+ if (IS_ERR(pdev))
+ return NULL;
+ dev = &pdev->dev;
++
++ dev->coherent_dma_mask = DMA_BIT_MASK(24);
++ dev->dma_mask = &dev->coherent_dma_mask;
+ }
+
+ ops = kmalloc(sizeof(struct parport_operations), GFP_KERNEL);
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:24:40 2009
+Message-Id: <20090701002439.893135640@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:24:15 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jens Rottmann <JRottmann@LiPPERTEmbedded.de>,
+ Alan Cox <alan@linux.intel.com>,
+ Jeff Garzik <jgarzik@redhat.com>
+Subject: [patch 086/108] parport_pc: after superio probing restore original register values
+References: <20090701002249.937782934@mini.kroah.org>
+Content-Disposition: inline; filename=parport_pc-after-superio-probing-restore-original-register-values.patch
+Content-Length: 4217
+Lines: 130
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Jens Rottmann <JRottmann@LiPPERTEmbedded.de>
+
+commit e2434dc1c19412639dd047a4d4eff8ed0e5d0d50 upstream.
+
+CONFIG_PARPORT_PC_SUPERIO probes for various superio chips by writing
+byte sequences to a set of different potential I/O ranges. But the
+probed ranges are not exclusive to parallel ports. Some of our boards
+just happen to have a watchdog in one of them. Took us almost a week
+to figure out why some distros reboot without warning after running
+flawlessly for 3 hours. For exactly 170 = 0xAA minutes, that is ...
+
+Fixed by restoring original values after probing. Also fixed too small
+request_region() in detect_and_report_it87().
+
+Signed-off-by: Jens Rottmann <JRottmann@LiPPERTEmbedded.de>
+Signed-off-by: Alan Cox <alan@linux.intel.com>
+Acked-by: Jeff Garzik <jgarzik@redhat.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/parport/parport_pc.c | 31 +++++++++++++++++++++++++------
+ 1 file changed, 25 insertions(+), 6 deletions(-)
+
+--- a/drivers/parport/parport_pc.c
++++ b/drivers/parport/parport_pc.c
+@@ -1413,11 +1413,13 @@ static void __devinit decode_smsc(int ef
+
+ static void __devinit winbond_check(int io, int key)
+ {
+- int devid,devrev,oldid,x_devid,x_devrev,x_oldid;
++ int origval, devid, devrev, oldid, x_devid, x_devrev, x_oldid;
+
+ if (!request_region(io, 3, __func__))
+ return;
+
++ origval = inb(io); /* Save original value */
++
+ /* First probe without key */
+ outb(0x20,io);
+ x_devid=inb(io+1);
+@@ -1437,6 +1439,8 @@ static void __devinit winbond_check(int
+ oldid=inb(io+1);
+ outb(0xaa,io); /* Magic Seal */
+
++ outb(origval, io); /* in case we poked some entirely different hardware */
++
+ if ((x_devid == devid) && (x_devrev == devrev) && (x_oldid == oldid))
+ goto out; /* protection against false positives */
+
+@@ -1447,11 +1451,15 @@ out:
+
+ static void __devinit winbond_check2(int io,int key)
+ {
+- int devid,devrev,oldid,x_devid,x_devrev,x_oldid;
++ int origval[3], devid, devrev, oldid, x_devid, x_devrev, x_oldid;
+
+ if (!request_region(io, 3, __func__))
+ return;
+
++ origval[0] = inb(io); /* Save original values */
++ origval[1] = inb(io + 1);
++ origval[2] = inb(io + 2);
++
+ /* First probe without the key */
+ outb(0x20,io+2);
+ x_devid=inb(io+2);
+@@ -1470,6 +1478,10 @@ static void __devinit winbond_check2(int
+ oldid=inb(io+2);
+ outb(0xaa,io); /* Magic Seal */
+
++ outb(origval[0], io); /* in case we poked some entirely different hardware */
++ outb(origval[1], io + 1);
++ outb(origval[2], io + 2);
++
+ if ((x_devid == devid) && (x_devrev == devrev) && (x_oldid == oldid))
+ goto out; /* protection against false positives */
+
+@@ -1480,11 +1492,13 @@ out:
+
+ static void __devinit smsc_check(int io, int key)
+ {
+- int id,rev,oldid,oldrev,x_id,x_rev,x_oldid,x_oldrev;
++ int origval, id, rev, oldid, oldrev, x_id, x_rev, x_oldid, x_oldrev;
+
+ if (!request_region(io, 3, __func__))
+ return;
+
++ origval = inb(io); /* Save original value */
++
+ /* First probe without the key */
+ outb(0x0d,io);
+ x_oldid=inb(io+1);
+@@ -1508,6 +1522,8 @@ static void __devinit smsc_check(int io,
+ rev=inb(io+1);
+ outb(0xaa,io); /* Magic Seal */
+
++ outb(origval, io); /* in case we poked some entirely different hardware */
++
+ if ((x_id == id) && (x_oldrev == oldrev) &&
+ (x_oldid == oldid) && (x_rev == rev))
+ goto out; /* protection against false positives */
+@@ -1544,11 +1560,12 @@ static void __devinit detect_and_report_
+ static void __devinit detect_and_report_it87(void)
+ {
+ u16 dev;
+- u8 r;
++ u8 origval, r;
+ if (verbose_probing)
+ printk(KERN_DEBUG "IT8705 Super-IO detection, now testing port 2E ...\n");
+- if (!request_region(0x2e, 1, __func__))
++ if (!request_region(0x2e, 2, __func__))
+ return;
++ origval = inb(0x2e); /* Save original value */
+ outb(0x87, 0x2e);
+ outb(0x01, 0x2e);
+ outb(0x55, 0x2e);
+@@ -1568,8 +1585,10 @@ static void __devinit detect_and_report_
+ outb(r | 8, 0x2F);
+ outb(0x02, 0x2E); /* Lock */
+ outb(0x02, 0x2F);
++ } else {
++ outb(origval, 0x2e); /* Oops, sorry to disturb */
+ }
+- release_region(0x2e, 1);
++ release_region(0x2e, 2);
+ }
+ #endif /* CONFIG_PARPORT_PC_SUPERIO */
+
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:24:40 2009
+Message-Id: <20090701002440.077312404@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:24:16 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Prabhanjan Sarnaik <sarnaik@marvell.com>,
+ Lennert Buytenhek <buytenh@marvell.com>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [patch 087/108] mv643xx_eth: fix unicast filter programming in promiscuous mode
+References: <20090701002249.937782934@mini.kroah.org>
+Content-Disposition: inline; filename=mv643xx_eth-fix-unicast-filter-programming-in-promiscuous-mode.patch
+Content-Length: 1898
+Lines: 56
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Prabhanjan Sarnaik <sarnaik@marvell.com>
+
+commit 6877f54e6a3326c99aaf84b7bff6a3019da0b847 upstream.
+
+The Unicast Promiscious Mode (UPM) bit in the mv643xx_eth port
+configuration register doesn't do exactly what its name would suggest:
+setting this bit merely enables reception of all unicast frames with a
+destination address that differs from our local MAC address in bits
+[47:4]. In particular, it doesn't have any effect on unicast frames
+with a destination address that matches our MAC address in bits [47:4]
+-- these will still be tested against the 16-entry unicast address
+filter table.
+
+Therefore, if the interface is set to promiscuous mode, just setting
+the unicast promiscuous bit isn't enough -- we need to set all filter
+bits in the unicast filter table to 1 as well.
+
+Reported-by: Sachin Sanap <ssanap@marvell.com>
+Signed-off-by: Prabhanjan Sarnaik <sarnaik@marvell.com>
+Tested-by: Siddarth Gore <gores@marvell.com>
+Tested-by: Mahavir Jain <mjain@marvell.com>
+Signed-off-by: Lennert Buytenhek <buytenh@marvell.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/mv643xx_eth.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/mv643xx_eth.c
++++ b/drivers/net/mv643xx_eth.c
+@@ -1751,12 +1751,12 @@ static void mv643xx_eth_program_unicast_
+
+ uc_addr_set(mp, dev->dev_addr);
+
+- port_config = rdlp(mp, PORT_CONFIG);
++ port_config = rdlp(mp, PORT_CONFIG) & ~UNICAST_PROMISCUOUS_MODE;
++
+ nibbles = uc_addr_filter_mask(dev);
+ if (!nibbles) {
+ port_config |= UNICAST_PROMISCUOUS_MODE;
+- wrlp(mp, PORT_CONFIG, port_config);
+- return;
++ nibbles = 0xffff;
+ }
+
+ for (i = 0; i < 16; i += 4) {
+@@ -1777,7 +1777,6 @@ static void mv643xx_eth_program_unicast_
+ wrl(mp, off, v);
+ }
+
+- port_config &= ~UNICAST_PROMISCUOUS_MODE;
+ wrlp(mp, PORT_CONFIG, port_config);
+ }
+
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:24:40 2009
+Message-Id: <20090701002440.327606088@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:24:17 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ "John W. Linville" <linville@tuxdriver.com>
+Subject: [patch 088/108] ath5k: avoid PCI FATAL interrupts by restoring RETRY_TIMEOUT disabling
+References: <20090701002249.937782934@mini.kroah.org>
+Content-Disposition: inline; filename=ath5k-avoid-pci-fatal-interrupts-by-restoring-retry_timeout-disabling.patch
+Content-Length: 1037
+Lines: 33
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Jouni Malinen <jouni.malinen@atheros.com>
+
+commit 8451d22dad40a66416b8d9c0952efa09ec5398c5 upstream.
+
+This reverts 'ath5k: remove dummy PCI "retry timeout" fix' on the
+same theory as in 'ath9k: Fix PCI FATAL interrupts by restoring
+RETRY_TIMEOUT disabling'.
+
+Reported-by: Bob Copeland <me@bobcopeland.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/ath5k/base.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/net/wireless/ath5k/base.c
++++ b/drivers/net/wireless/ath5k/base.c
+@@ -685,6 +685,13 @@ ath5k_pci_resume(struct pci_dev *pdev)
+ if (err)
+ return err;
+
++ /*
++ * Suspend/Resume resets the PCI configuration space, so we have to
++ * re-disable the RETRY_TIMEOUT register (0x41) to keep
++ * PCI Tx retries from interfering with C3 CPU state
++ */
++ pci_write_config_byte(pdev, 0x41, 0);
++
+ err = request_irq(pdev->irq, ath5k_intr, IRQF_SHARED, "ath", sc);
+ if (err) {
+ ATH5K_ERR(sc, "request_irq failed\n");
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:24:40 2009
+Message-Id: <20090701002440.509344548@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:24:18 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Clemens Ladisch <clemens@ladisch.de>,
+ Takashi Iwai <tiwai@suse.de>
+Subject: [patch 089/108] sound: seq_midi_event: fix decoding of (N)RPN events
+References: <20090701002249.937782934@mini.kroah.org>
+Content-Disposition: inline; filename=sound-seq_midi_event-fix-decoding-of-rpn-events.patch
+Content-Length: 1289
+Lines: 34
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Clemens Ladisch <clemens@ladisch.de>
+
+commit 6423f9ea8035138d70bae1a278d3b57b743f8b3e upstream.
+
+When decoding (N)RPN sequencer events into raw MIDI commands, the
+extra_decode_xrpn() function had accidentally swapped the MSB and LSB
+controller values of both the parameter number and the data value.
+
+Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/core/seq/seq_midi_event.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/sound/core/seq/seq_midi_event.c
++++ b/sound/core/seq/seq_midi_event.c
+@@ -504,10 +504,10 @@ static int extra_decode_xrpn(struct snd_
+ if (dev->nostat && count < 12)
+ return -ENOMEM;
+ cmd = MIDI_CMD_CONTROL|(ev->data.control.channel & 0x0f);
+- bytes[0] = ev->data.control.param & 0x007f;
+- bytes[1] = (ev->data.control.param & 0x3f80) >> 7;
+- bytes[2] = ev->data.control.value & 0x007f;
+- bytes[3] = (ev->data.control.value & 0x3f80) >> 7;
++ bytes[0] = (ev->data.control.param & 0x3f80) >> 7;
++ bytes[1] = ev->data.control.param & 0x007f;
++ bytes[2] = (ev->data.control.value & 0x3f80) >> 7;
++ bytes[3] = ev->data.control.value & 0x007f;
+ if (cmd != dev->lastcmd && !dev->nostat) {
+ if (count < 9)
+ return -ENOMEM;
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:24:40 2009
+Message-Id: <20090701002440.703390309@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:24:19 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ "Rafael J. Wysocki" <rjw@sisk.pl>,
+ Jesse Barnes <jbarnes@virtuousgeek.org>
+Subject: [patch 090/108] PCI PM: Fix handling of devices without PM support by pci_target_state()
+References: <20090701002249.937782934@mini.kroah.org>
+Content-Disposition: inline; filename=pci-pm-fix-handling-of-devices-without-pm-support-by-pci_target_state.patch
+Content-Length: 1472
+Lines: 44
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Rafael J. Wysocki <rjw@sisk.pl>
+
+commit d2abdf62882d982c58e7a6b09ecdcfcc28075e2e upstream.
+
+If a PCI device is not power-manageable either by the platform, or
+with the help of the native PCI PM interface, pci_target_state() will
+return either PCI_D3hot, or PCI_POWER_ERROR for it, depending on
+whether or not the device is configured to wake up the system. Alas,
+none of these return values is correct, because each of them causes
+pci_prepare_to_sleep() to return error code, although it should
+complete successfully in such a case.
+
+Fix this problem by making pci_target_state() always return PCI_D0
+for devices that cannot be power managed.
+
+Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>
+Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/pci/pci.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+--- a/drivers/pci/pci.c
++++ b/drivers/pci/pci.c
+@@ -1282,15 +1282,14 @@ pci_power_t pci_target_state(struct pci_
+ default:
+ target_state = state;
+ }
++ } else if (!dev->pm_cap) {
++ target_state = PCI_D0;
+ } else if (device_may_wakeup(&dev->dev)) {
+ /*
+ * Find the deepest state from which the device can generate
+ * wake-up events, make it the target state and enable device
+ * to generate PME#.
+ */
+- if (!dev->pm_cap)
+- return PCI_POWER_ERROR;
+-
+ if (dev->pme_support) {
+ while (target_state
+ && !(dev->pme_support & (1 << target_state)))
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:24:41 2009
+Message-Id: <20090701002440.895036580@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:24:20 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ "Rafael J. Wysocki" <rjw@sisk.pl>,
+ Jesse Barnes <jbarnes@virtuousgeek.org>
+Subject: [patch 091/108] PCI PM: Follow PCI_PM_CTRL_NO_SOFT_RESET during transitions from D3
+References: <20090701002249.937782934@mini.kroah.org>
+Content-Disposition: inline; filename=pci-pm-follow-pci_pm_ctrl_no_soft_reset-during-transitions-from-d3.patch
+Content-Length: 1442
+Lines: 38
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Rafael J. Wysocki <rjw@sisk.pl>
+
+commit f62795f1e892ca9269849fa83de97621da7e02c0 upstream.
+
+According to the PCI PM specification (PCI Bus Power Management
+Interface Specification, Rev. 1.2, Section 5.4.1) we are supposed to
+reinitialize devices that have PCI_PM_CTRL_NO_SOFT_RESET clear during
+all transitions from PCI_D3hot to PCI_D0, but we only do it if the
+device's current_state field is equal to PCI_UNKNOWN.
+
+This may lead to problems if a device with PCI_PM_CTRL_NO_SOFT_RESET
+unset is put into PCI_D3hot at run time by its driver and
+pci_set_power_state() is used to put it back into PCI_D0, because in
+that case the device will remain uninitialized after
+pci_set_power_state() has returned. Prevent that from happening by
+modifying pci_raw_set_power_state() to reinitialize devices with
+PCI_PM_CTRL_NO_SOFT_RESET unset during all transitions from D3 to D0.
+
+Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>
+Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/pci/pci.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/pci/pci.c
++++ b/drivers/pci/pci.c
+@@ -480,6 +480,8 @@ static int pci_raw_set_power_state(struc
+ pmcsr &= ~PCI_PM_CTRL_STATE_MASK;
+ pmcsr |= state;
+ break;
++ case PCI_D3hot:
++ case PCI_D3cold:
+ case PCI_UNKNOWN: /* Boot-up */
+ if ((pmcsr & PCI_PM_CTRL_STATE_MASK) == PCI_D3hot
+ && !(pmcsr & PCI_PM_CTRL_NO_SOFT_RESET))
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:24:41 2009
+Message-Id: <20090701002441.091270814@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:24:21 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Andrew Vasquez <andrew.vasquez@qlogic.com>,
+ James Bottomley <James.Bottomley@HansenPartnership.com>
+Subject: [patch 092/108] qla2xxx: Correct (again) overflow during dump-processing on large-memory ISP23xx parts.
+References: <20090701002249.937782934@mini.kroah.org>
+Content-Disposition: inline; filename=qla2xxx-correct-overflow-during-dump-processing-on-large-memory-isp23xx-parts.patch
+Content-Length: 986
+Lines: 29
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Andrew Vasquez <andrew.vasquez@qlogic.com>
+
+commit e18e963b7e533149676b5d387d0a56160df9f111 upstream.
+
+Commit 7b867cf76fbcc8d77867cbec6f509f71dce8a98f ([SCSI] qla2xxx:
+Refactor qla data structures) inadvertently reverted
+e792121ec85672c1fa48f79d13986a3f4f56c590 ([SCSI] qla2xxx: Correct
+overflow during dump-processing on large-memory ISP23xx parts.).
+
+Signed-off-by: Andrew Vasquez <andrew.vasquez@qlogic.com>
+Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/scsi/qla2xxx/qla_dbg.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/scsi/qla2xxx/qla_dbg.c
++++ b/drivers/scsi/qla2xxx/qla_dbg.c
+@@ -218,7 +218,7 @@ qla24xx_soft_reset(struct qla_hw_data *h
+
+ static int
+ qla2xxx_dump_ram(struct qla_hw_data *ha, uint32_t addr, uint16_t *ram,
+- uint16_t ram_words, void **nxt)
++ uint32_t ram_words, void **nxt)
+ {
+ int rval;
+ uint32_t cnt, stat, timer, words, idx;
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:24:41 2009
+Message-Id: <20090701002441.356908481@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:24:22 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Dimitri Sivanich <sivanich@sgi.com>,
+ Christoph Lameter <cl@linux-foundation.org>,
+ Nick Piggin <nickpiggin@yahoo.com.au>,
+ Mel Gorman <mel@csn.ul.ie>
+Subject: [patch 093/108] mm: fix handling of pagesets for downed cpus
+References: <20090701002249.937782934@mini.kroah.org>
+Content-Disposition: inline; filename=mm-fix-handling-of-pagesets-for-downed-cpus.patch
+Content-Length: 1898
+Lines: 58
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Dimitri Sivanich <sivanich@sgi.com>
+
+commit 364df0ebfbbb1330bfc6ca159f4d6020efc15a12 upstream.
+
+After downing/upping a cpu, an attempt to set
+/proc/sys/vm/percpu_pagelist_fraction results in an oops in
+percpu_pagelist_fraction_sysctl_handler().
+
+If a processor is downed then we need to set the pageset pointer back to
+the boot pageset.
+
+Updates of the high water marks should not access pagesets of unpopulated
+zones (those pointer go to the boot pagesets which would be no longer
+functional if their size would be increased beyond zero).
+
+Signed-off-by: Dimitri Sivanich <sivanich@sgi.com>
+Signed-off-by: Christoph Lameter <cl@linux-foundation.org>
+Reviewed-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
+Cc: Nick Piggin <nickpiggin@yahoo.com.au>
+Cc: Mel Gorman <mel@csn.ul.ie>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ mm/page_alloc.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/mm/page_alloc.c
++++ b/mm/page_alloc.c
+@@ -2812,7 +2812,7 @@ bad:
+ if (dzone == zone)
+ break;
+ kfree(zone_pcp(dzone, cpu));
+- zone_pcp(dzone, cpu) = NULL;
++ zone_pcp(dzone, cpu) = &boot_pageset[cpu];
+ }
+ return -ENOMEM;
+ }
+@@ -2827,7 +2827,7 @@ static inline void free_zone_pagesets(in
+ /* Free per_cpu_pageset if it is slab allocated */
+ if (pset != &boot_pageset[cpu])
+ kfree(pset);
+- zone_pcp(zone, cpu) = NULL;
++ zone_pcp(zone, cpu) = &boot_pageset[cpu];
+ }
+ }
+
+@@ -4501,7 +4501,7 @@ int percpu_pagelist_fraction_sysctl_hand
+ ret = proc_dointvec_minmax(table, write, file, buffer, length, ppos);
+ if (!write || (ret == -EINVAL))
+ return ret;
+- for_each_zone(zone) {
++ for_each_populated_zone(zone) {
+ for_each_online_cpu(cpu) {
+ unsigned long high;
+ high = zone->present_pages / percpu_pagelist_fraction;
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:24:41 2009
+Message-Id: <20090701002441.583020954@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:24:23 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Mikulas Patocka <mpatocka@redhat.com>,
+ Alasdair G Kergon <agk@redhat.com>
+Subject: [patch 094/108] dm mpath: validate hw_handler argument count
+References: <20090701002249.937782934@mini.kroah.org>
+Content-Disposition: inline; filename=dm-mpath-validate-hw_handler-argument-count.patch
+Content-Length: 804
+Lines: 29
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+commit e094f4f15f5169526c7200b9bde44b900548a81e upstream.
+
+Fix arg count parsing error in hw handlers.
+
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Alasdair G Kergon <agk@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/dm-mpath.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/md/dm-mpath.c
++++ b/drivers/md/dm-mpath.c
+@@ -699,6 +699,11 @@ static int parse_hw_handler(struct arg_s
+ if (!hw_argc)
+ return 0;
+
++ if (hw_argc > as->argc) {
++ ti->error = "not enough arguments for hardware handler";
++ return -EINVAL;
++ }
++
+ m->hw_handler_name = kstrdup(shift(as), GFP_KERNEL);
+ request_module("scsi_dh_%s", m->hw_handler_name);
+ if (scsi_dh_handler_exist(m->hw_handler_name) == 0) {
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:24:42 2009
+Message-Id: <20090701002441.908488777@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:24:24 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Mikulas Patocka <mpatocka@redhat.com>,
+ Alasdair G Kergon <agk@redhat.com>
+Subject: [patch 095/108] dm mpath: validate table argument count
+References: <20090701002249.937782934@mini.kroah.org>
+Content-Disposition: inline; filename=dm-mpath-validate-table-argument-count.patch
+Content-Length: 1060
+Lines: 36
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+commit 0e0497c0c017664994819f4602dc07fd95896c52 upstream.
+
+The parser reads the argument count as a number but doesn't check that
+sufficient arguments are supplied. This command triggers the bug:
+
+dmsetup create mpath --table "0 `blockdev --getsize /dev/mapper/cr0`
+ multipath 0 0 2 1 round-robin 1000 0 1 1 /dev/mapper/cr0
+ round-robin 0 1 1 /dev/mapper/cr1 1000"
+kernel BUG at drivers/md/dm-mpath.c:530!
+
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Alasdair G Kergon <agk@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/dm-mpath.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/md/dm-mpath.c
++++ b/drivers/md/dm-mpath.c
+@@ -553,6 +553,12 @@ static int parse_path_selector(struct ar
+ return -EINVAL;
+ }
+
++ if (ps_argc > as->argc) {
++ dm_put_path_selector(pst);
++ ti->error = "not enough arguments for path selector";
++ return -EINVAL;
++ }
++
+ r = pst->create(&pg->ps, ps_argc, as->argv);
+ if (r) {
+ dm_put_path_selector(pst);
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:24:42 2009
+Message-Id: <20090701002442.075083210@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:24:25 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Milan Broz <mbroz@redhat.com>,
+ Alasdair G Kergon <agk@redhat.com>
+Subject: [patch 096/108] dm: sysfs skip output when device is being destroyed
+References: <20090701002249.937782934@mini.kroah.org>
+Content-Disposition: inline; filename=dm-sysfs-skip-output-when-device-is-being-destroyed.patch
+Content-Length: 749
+Lines: 32
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Milan Broz <mbroz@redhat.com>
+
+commit 4d89b7b4e4726893453d0fb4ddbb5b3e16353994 upstream.
+
+Do not process sysfs attributes when device is being destroyed.
+
+Otherwise code can cause
+ BUG_ON(test_bit(DMF_FREEING, &md->flags));
+in dm_put() call.
+
+Signed-off-by: Milan Broz <mbroz@redhat.com>
+Signed-off-by: Alasdair G Kergon <agk@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/dm.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/md/dm.c
++++ b/drivers/md/dm.c
+@@ -1780,6 +1780,10 @@ struct mapped_device *dm_get_from_kobjec
+ if (&md->kobj != kobj)
+ return NULL;
+
++ if (test_bit(DMF_FREEING, &md->flags) ||
++ test_bit(DMF_DELETING, &md->flags))
++ return NULL;
++
+ dm_get(md);
+ return md;
+ }
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:24:42 2009
+Message-Id: <20090701002442.283134938@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:24:26 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Mikulas Patocka <mpatocka@redhat.com>,
+ Alasdair G Kergon <agk@redhat.com>
+Subject: [patch 097/108] dm mpath: flush keventd queue in destructor
+References: <20090701002249.937782934@mini.kroah.org>
+Content-Disposition: inline; filename=dm-mpath-flush-keventd-queue-in-destructor.patch
+Content-Length: 1193
+Lines: 38
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+commit 53b351f972a882ea8b6cdb19602535f1057c884a upstream.
+
+The commit fe9cf30eb8186ef267d1868dc9f12f2d0f40835a moves dm table event
+submission from kmultipath queue to kernel kevent queue to avoid a
+deadlock.
+
+There is a possibility of race condition because kevent queue is not flushed
+in the multipath destructor. The scenario is:
+- some event happens and is queued to keventd
+- keventd thread is delayed due to scheuling latency or some other work
+- multipath device is destroyed
+- keventd now attempts to process work_struct that is residing in already
+ released memory.
+
+The patch flushes the keventd queue in multipath constructor.
+I've already fixed similar bug in dm-raid1.
+
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Alasdair G Kergon <agk@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/dm-mpath.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/md/dm-mpath.c
++++ b/drivers/md/dm-mpath.c
+@@ -847,6 +847,7 @@ static void multipath_dtr(struct dm_targ
+
+ flush_workqueue(kmpath_handlerd);
+ flush_workqueue(kmultipathd);
++ flush_scheduled_work();
+ free_multipath(m);
+ }
+
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:24:42 2009
+Message-Id: <20090701002442.471525145@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:24:27 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jonathan Brassow <jbrassow@redhat.com>,
+ Alasdair G Kergon <agk@redhat.com>,
+ Arjan van de Ven <arjan@infradead.org>
+Subject: [patch 098/108] dm exception store: fix exstore lookup to be case insensitive
+References: <20090701002249.937782934@mini.kroah.org>
+Content-Disposition: inline; filename=dm-exception-store-fix-exstore-lookup-to-be-case-insensitive.patch
+Content-Length: 950
+Lines: 31
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Jonathan Brassow <jbrassow@redhat.com>
+
+commit f6bd4eb73cdf2a5bf954e497972842f39cabb7e3 upstream.
+
+When snapshots are created using 'p' instead of 'P' as the
+exception store type, the device-mapper table loading fails.
+
+This patch makes the code case insensitive as intended and fixes some
+regressions reported with device-mapper snapshots.
+
+Signed-off-by: Jonathan Brassow <jbrassow@redhat.com>
+Signed-off-by: Alasdair G Kergon <agk@redhat.com>
+Cc: Arjan van de Ven <arjan@infradead.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/dm-exception-store.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/md/dm-exception-store.c
++++ b/drivers/md/dm-exception-store.c
+@@ -216,7 +216,7 @@ int dm_exception_store_create(struct dm_
+ return -EINVAL;
+ }
+
+- type = get_type(argv[1]);
++ type = get_type(&persistent);
+ if (!type) {
+ ti->error = "Exception store type not recognised";
+ r = -EINVAL;
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:24:43 2009
+Message-Id: <20090701002442.919795661@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:24:28 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Mikulas Patocka <mpatocka@redhat.com>,
+ Alasdair G Kergon <agk@redhat.com>
+Subject: [patch 099/108] dm: use i_size_read
+References: <20090701002249.937782934@mini.kroah.org>
+Content-Disposition: inline; filename=dm-use-i_size_read.patch
+Content-Length: 2087
+Lines: 58
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+commit 5657e8fa45cf230df278040c420fb80e06309d8f upstream.
+
+Use i_size_read() instead of reading i_size.
+
+If someone changes the size of the device simultaneously, i_size_read
+is guaranteed to return a valid value (either the old one or the new one).
+
+i_size can return some intermediate invalid value (on 32-bit computers
+with 64-bit i_size, the reads to both halves of i_size can be interleaved
+with updates to i_size, resulting in garbage being returned).
+
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Alasdair G Kergon <agk@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/dm-exception-store.h | 2 +-
+ drivers/md/dm-log.c | 2 +-
+ drivers/md/dm-table.c | 3 ++-
+ 3 files changed, 4 insertions(+), 3 deletions(-)
+
+--- a/drivers/md/dm-exception-store.h
++++ b/drivers/md/dm-exception-store.h
+@@ -156,7 +156,7 @@ static inline void dm_consecutive_chunk_
+ */
+ static inline sector_t get_dev_size(struct block_device *bdev)
+ {
+- return bdev->bd_inode->i_size >> SECTOR_SHIFT;
++ return i_size_read(bdev->bd_inode) >> SECTOR_SHIFT;
+ }
+
+ static inline chunk_t sector_to_chunk(struct dm_exception_store *store,
+--- a/drivers/md/dm-log.c
++++ b/drivers/md/dm-log.c
+@@ -415,7 +415,7 @@ static int create_log_context(struct dm_
+ buf_size = dm_round_up((LOG_OFFSET << SECTOR_SHIFT) +
+ bitset_size, ti->limits.hardsect_size);
+
+- if (buf_size > dev->bdev->bd_inode->i_size) {
++ if (buf_size > i_size_read(dev->bdev->bd_inode)) {
+ DMWARN("log device %s too small: need %llu bytes",
+ dev->name, (unsigned long long)buf_size);
+ kfree(lc);
+--- a/drivers/md/dm-table.c
++++ b/drivers/md/dm-table.c
+@@ -387,7 +387,8 @@ static void close_dev(struct dm_dev_inte
+ static int check_device_area(struct dm_dev_internal *dd, sector_t start,
+ sector_t len)
+ {
+- sector_t dev_size = dd->dm_dev.bdev->bd_inode->i_size >> SECTOR_SHIFT;
++ sector_t dev_size = i_size_read(dd->dm_dev.bdev->bd_inode) >>
++ SECTOR_SHIFT;
+
+ if (!dev_size)
+ return 1;
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:24:43 2009
+Message-Id: <20090701002443.184726273@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:24:29 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Mel Gorman <mel@csn.ul.ie>,
+ Christoph Lameter <cl@linux-foundation.org>,
+ KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>,
+ Wu Fengguang <fengguang.wu@intel.com>
+Subject: [patch 100/108] vmscan: properly account for the number of page cache pages zone_reclaim() can reclaim
+References: <20090701002249.937782934@mini.kroah.org>
+Content-Disposition: inline; filename=vmscan-properly-account-for-the-number-of-page-cache-pages-zone_reclaim-can-reclaim.patch
+Content-Length: 7823
+Lines: 181
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Mel Gorman <mel@csn.ul.ie>
+
+commit 90afa5de6f3fa89a733861e843377302479fcf7e upstream.
+
+A bug was brought to my attention against a distro kernel but it affects
+mainline and I believe problems like this have been reported in various
+guises on the mailing lists although I don't have specific examples at the
+moment.
+
+The reported problem was that malloc() stalled for a long time (minutes in
+some cases) if a large tmpfs mount was occupying a large percentage of
+memory overall. The pages did not get cleaned or reclaimed by
+zone_reclaim() because the zone_reclaim_mode was unsuitable, but the lists
+are uselessly scanned frequencly making the CPU spin at near 100%.
+
+This patchset intends to address that bug and bring the behaviour of
+zone_reclaim() more in line with expectations which were noticed during
+investigation. It is based on top of mmotm and takes advantage of
+Kosaki's work with respect to zone_reclaim().
+
+Patch 1 fixes the heuristics that zone_reclaim() uses to determine if the
+ scan should go ahead. The broken heuristic is what was causing the
+ malloc() stall as it uselessly scanned the LRU constantly. Currently,
+ zone_reclaim is assuming zone_reclaim_mode is 1 and historically it
+ could not deal with tmpfs pages at all. This fixes up the heuristic so
+ that an unnecessary scan is more likely to be correctly avoided.
+
+Patch 2 notes that zone_reclaim() returning a failure automatically means
+ the zone is marked full. This is not always true. It could have
+ failed because the GFP mask or zone_reclaim_mode were unsuitable.
+
+Patch 3 introduces a counter zreclaim_failed that will increment each
+ time the zone_reclaim scan-avoidance heuristics fail. If that
+ counter is rapidly increasing, then zone_reclaim_mode should be
+ set to 0 as a temporarily resolution and a bug reported because
+ the scan-avoidance heuristic is still broken.
+
+This patch:
+
+On NUMA machines, the administrator can configure zone_reclaim_mode that
+is a more targetted form of direct reclaim. On machines with large NUMA
+distances for example, a zone_reclaim_mode defaults to 1 meaning that
+clean unmapped pages will be reclaimed if the zone watermarks are not
+being met.
+
+There is a heuristic that determines if the scan is worthwhile but the
+problem is that the heuristic is not being properly applied and is
+basically assuming zone_reclaim_mode is 1 if it is enabled. The lack of
+proper detection can manfiest as high CPU usage as the LRU list is scanned
+uselessly.
+
+Historically, once enabled it was depending on NR_FILE_PAGES which may
+include swapcache pages that the reclaim_mode cannot deal with. Patch
+vmscan-change-the-number-of-the-unmapped-files-in-zone-reclaim.patch by
+Kosaki Motohiro noted that zone_page_state(zone, NR_FILE_PAGES) included
+pages that were not file-backed such as swapcache and made a calculation
+based on the inactive, active and mapped files. This is far superior when
+zone_reclaim==1 but if RECLAIM_SWAP is set, then NR_FILE_PAGES is a
+reasonable starting figure.
+
+This patch alters how zone_reclaim() works out how many pages it might be
+able to reclaim given the current reclaim_mode. If RECLAIM_SWAP is set in
+the reclaim_mode it will either consider NR_FILE_PAGES as potential
+candidates or else use NR_{IN}ACTIVE}_PAGES-NR_FILE_MAPPED to discount
+swapcache and other non-file-backed pages. If RECLAIM_WRITE is not set,
+then NR_FILE_DIRTY number of pages are not candidates. If RECLAIM_SWAP is
+not set, then NR_FILE_MAPPED are not.
+
+[kosaki.motohiro@jp.fujitsu.com: Estimate unmapped pages minus tmpfs pages]
+[fengguang.wu@intel.com: Fix underflow problem in Kosaki's estimate]
+Signed-off-by: Mel Gorman <mel@csn.ul.ie>
+Reviewed-by: Rik van Riel <riel@redhat.com>
+Acked-by: Christoph Lameter <cl@linux-foundation.org>
+Cc: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
+Cc: Wu Fengguang <fengguang.wu@intel.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ Documentation/sysctl/vm.txt | 12 ++++++----
+ mm/vmscan.c | 52 ++++++++++++++++++++++++++++++++++++++------
+ 2 files changed, 53 insertions(+), 11 deletions(-)
+
+--- a/Documentation/sysctl/vm.txt
++++ b/Documentation/sysctl/vm.txt
+@@ -314,10 +314,14 @@ min_unmapped_ratio:
+
+ This is available only on NUMA kernels.
+
+-A percentage of the total pages in each zone. Zone reclaim will only
+-occur if more than this percentage of pages are file backed and unmapped.
+-This is to insure that a minimal amount of local pages is still available for
+-file I/O even if the node is overallocated.
++This is a percentage of the total pages in each zone. Zone reclaim will
++only occur if more than this percentage of pages are in a state that
++zone_reclaim_mode allows to be reclaimed.
++
++If zone_reclaim_mode has the value 4 OR'd, then the percentage is compared
++against all file-backed unmapped pages including swapcache pages and tmpfs
++files. Otherwise, only unmapped pages backed by normal files but not tmpfs
++files and similar are considered.
+
+ The default is 1 percent.
+
+--- a/mm/vmscan.c
++++ b/mm/vmscan.c
+@@ -2290,6 +2290,48 @@ int sysctl_min_unmapped_ratio = 1;
+ */
+ int sysctl_min_slab_ratio = 5;
+
++static inline unsigned long zone_unmapped_file_pages(struct zone *zone)
++{
++ unsigned long file_mapped = zone_page_state(zone, NR_FILE_MAPPED);
++ unsigned long file_lru = zone_page_state(zone, NR_INACTIVE_FILE) +
++ zone_page_state(zone, NR_ACTIVE_FILE);
++
++ /*
++ * It's possible for there to be more file mapped pages than
++ * accounted for by the pages on the file LRU lists because
++ * tmpfs pages accounted for as ANON can also be FILE_MAPPED
++ */
++ return (file_lru > file_mapped) ? (file_lru - file_mapped) : 0;
++}
++
++/* Work out how many page cache pages we can reclaim in this reclaim_mode */
++static long zone_pagecache_reclaimable(struct zone *zone)
++{
++ long nr_pagecache_reclaimable;
++ long delta = 0;
++
++ /*
++ * If RECLAIM_SWAP is set, then all file pages are considered
++ * potentially reclaimable. Otherwise, we have to worry about
++ * pages like swapcache and zone_unmapped_file_pages() provides
++ * a better estimate
++ */
++ if (zone_reclaim_mode & RECLAIM_SWAP)
++ nr_pagecache_reclaimable = zone_page_state(zone, NR_FILE_PAGES);
++ else
++ nr_pagecache_reclaimable = zone_unmapped_file_pages(zone);
++
++ /* If we can't clean pages, remove dirty pages from consideration */
++ if (!(zone_reclaim_mode & RECLAIM_WRITE))
++ delta += zone_page_state(zone, NR_FILE_DIRTY);
++
++ /* Watch for any possible underflows due to delta */
++ if (unlikely(delta > nr_pagecache_reclaimable))
++ delta = nr_pagecache_reclaimable;
++
++ return nr_pagecache_reclaimable - delta;
++}
++
+ /*
+ * Try to free up some pages from this zone through reclaim.
+ */
+@@ -2324,9 +2366,7 @@ static int __zone_reclaim(struct zone *z
+ reclaim_state.reclaimed_slab = 0;
+ p->reclaim_state = &reclaim_state;
+
+- if (zone_page_state(zone, NR_FILE_PAGES) -
+- zone_page_state(zone, NR_FILE_MAPPED) >
+- zone->min_unmapped_pages) {
++ if (zone_pagecache_reclaimable(zone) > zone->min_unmapped_pages) {
+ /*
+ * Free memory by calling shrink zone with increasing
+ * priorities until we have enough memory freed.
+@@ -2384,10 +2424,8 @@ int zone_reclaim(struct zone *zone, gfp_
+ * if less than a specified percentage of the zone is used by
+ * unmapped file backed pages.
+ */
+- if (zone_page_state(zone, NR_FILE_PAGES) -
+- zone_page_state(zone, NR_FILE_MAPPED) <= zone->min_unmapped_pages
+- && zone_page_state(zone, NR_SLAB_RECLAIMABLE)
+- <= zone->min_slab_pages)
++ if (zone_pagecache_reclaimable(zone) <= zone->min_unmapped_pages &&
++ zone_page_state(zone, NR_SLAB_RECLAIMABLE) <= zone->min_slab_pages)
+ return 0;
+
+ if (zone_is_all_unreclaimable(zone))
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:24:43 2009
+Message-Id: <20090701002443.452696983@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:24:30 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Mel Gorman <mel@csn.ul.ie>,
+ Christoph Lameter <cl@linux-foundation.org>,
+ Wu Fengguang <fengguang.wu@intel.com>
+Subject: [patch 101/108] vmscan: count the number of times zone_reclaim() scans and fails
+References: <20090701002249.937782934@mini.kroah.org>
+Content-Disposition: inline; filename=vmscan-count-the-number-of-times-zone_reclaim-scans-and-fails.patch
+Content-Length: 2400
+Lines: 71
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Mel Gorman <mel@csn.ul.ie>
+
+commit 24cf72518c79cdcda486ed26074ff8151291cf65 upstream.
+
+On NUMA machines, the administrator can configure zone_reclaim_mode that
+is a more targetted form of direct reclaim. On machines with large NUMA
+distances for example, a zone_reclaim_mode defaults to 1 meaning that
+clean unmapped pages will be reclaimed if the zone watermarks are not
+being met.
+
+There is a heuristic that determines if the scan is worthwhile but it is
+possible that the heuristic will fail and the CPU gets tied up scanning
+uselessly. Detecting the situation requires some guesswork and
+experimentation so this patch adds a counter "zreclaim_failed" to
+/proc/vmstat. If during high CPU utilisation this counter is increasing
+rapidly, then the resolution to the problem may be to set
+/proc/sys/vm/zone_reclaim_mode to 0.
+
+[akpm@linux-foundation.org: name things consistently]
+Signed-off-by: Mel Gorman <mel@csn.ul.ie>
+Reviewed-by: Rik van Riel <riel@redhat.com>
+Cc: Christoph Lameter <cl@linux-foundation.org>
+Reviewed-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
+Cc: Wu Fengguang <fengguang.wu@intel.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ include/linux/vmstat.h | 3 +++
+ mm/vmscan.c | 3 +++
+ mm/vmstat.c | 3 +++
+ 3 files changed, 9 insertions(+)
+
+--- a/include/linux/vmstat.h
++++ b/include/linux/vmstat.h
+@@ -36,6 +36,9 @@ enum vm_event_item { PGPGIN, PGPGOUT, PS
+ FOR_ALL_ZONES(PGSTEAL),
+ FOR_ALL_ZONES(PGSCAN_KSWAPD),
+ FOR_ALL_ZONES(PGSCAN_DIRECT),
++#ifdef CONFIG_NUMA
++ PGSCAN_ZONE_RECLAIM_FAILED,
++#endif
+ PGINODESTEAL, SLABS_SCANNED, KSWAPD_STEAL, KSWAPD_INODESTEAL,
+ PAGEOUTRUN, ALLOCSTALL, PGROTATED,
+ #ifdef CONFIG_HUGETLB_PAGE
+--- a/mm/vmscan.c
++++ b/mm/vmscan.c
+@@ -2452,6 +2452,9 @@ int zone_reclaim(struct zone *zone, gfp_
+ ret = __zone_reclaim(zone, gfp_mask, order);
+ zone_clear_flag(zone, ZONE_RECLAIM_LOCKED);
+
++ if (!ret)
++ count_vm_event(PGSCAN_ZONE_RECLAIM_FAILED);
++
+ return ret;
+ }
+ #endif
+--- a/mm/vmstat.c
++++ b/mm/vmstat.c
+@@ -675,6 +675,9 @@ static const char * const vmstat_text[]
+ TEXTS_FOR_ZONES("pgscan_kswapd")
+ TEXTS_FOR_ZONES("pgscan_direct")
+
++#ifdef CONFIG_NUMA
++ "zone_reclaim_failed",
++#endif
+ "pginodesteal",
+ "slabs_scanned",
+ "kswapd_steal",
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:24:43 2009
+Message-Id: <20090701002443.637484445@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:24:31 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Zygo Blaxell <zygo.blaxell@xandros.com>,
+ Jiri Kosina <trivial@kernel.org>,
+ Steve Wise <swise@opengridcomputing.com>
+Subject: [patch 102/108] lib/genalloc.c: remove unmatched write_lock() in gen_pool_destroy
+References: <20090701002249.937782934@mini.kroah.org>
+Content-Disposition: inline; filename=lib-genalloc.c-remove-unmatched-write_lock-in-gen_pool_destroy.patch
+Content-Length: 1147
+Lines: 32
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Zygo Blaxell <zygo.blaxell@xandros.com>
+
+commit 8e8a2dea0ca91fe2cb7de7ea212124cfe8c82c35 upstream.
+
+There is a call to write_lock() in gen_pool_destroy which is not balanced
+by any corresponding write_unlock(). This causes problems with preemption
+because the preemption-disable counter is incremented in the write_lock()
+call, but never decremented by any call to write_unlock(). This bug is
+gen_pool_destroy, and one of them is non-x86 arch-specific code.
+
+Signed-off-by: Zygo Blaxell <zygo.blaxell@xandros.com>
+Cc: Jiri Kosina <trivial@kernel.org>
+Cc: Steve Wise <swise@opengridcomputing.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ lib/genalloc.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/lib/genalloc.c
++++ b/lib/genalloc.c
+@@ -85,7 +85,6 @@ void gen_pool_destroy(struct gen_pool *p
+ int bit, end_bit;
+
+
+- write_lock(&pool->lock);
+ list_for_each_safe(_chunk, _next_chunk, &pool->chunks) {
+ chunk = list_entry(_chunk, struct gen_pool_chunk, next_chunk);
+ list_del(&chunk->next_chunk);
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:24:44 2009
+Message-Id: <20090701002444.090084909@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:24:32 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk
+Subject: [patch 103/108] CONFIG_FILE_LOCKING should not depend on CONFIG_BLOCK
+References: <20090701002249.937782934@mini.kroah.org>
+Content-Disposition: inline; filename=config_file_locking-should-not-depend-on-config_block.patch
+Content-Length: 1200
+Lines: 48
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Tomas Szepe <szepe@pinerecords.com>
+
+commit 69050eee8e08a6234f29fe71a56f8c7c7d4d7186 upstream.
+
+CONFIG_FILE_LOCKING should not depend on CONFIG_BLOCK.
+
+This makes it possible to run complete systems out of a CONFIG_BLOCK=n
+initramfs on current kernels again (this last worked on 2.6.27.*).
+
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/Kconfig | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+--- a/fs/Kconfig
++++ b/fs/Kconfig
+@@ -39,6 +39,13 @@ config FS_POSIX_ACL
+ bool
+ default n
+
++source "fs/xfs/Kconfig"
++source "fs/gfs2/Kconfig"
++source "fs/ocfs2/Kconfig"
++source "fs/btrfs/Kconfig"
++
++endif # BLOCK
++
+ config FILE_LOCKING
+ bool "Enable POSIX file locking API" if EMBEDDED
+ default y
+@@ -47,13 +54,6 @@ config FILE_LOCKING
+ for filesystems like NFS and for the flock() system
+ call. Disabling this option saves about 11k.
+
+-source "fs/xfs/Kconfig"
+-source "fs/gfs2/Kconfig"
+-source "fs/ocfs2/Kconfig"
+-source "fs/btrfs/Kconfig"
+-
+-endif # BLOCK
+-
+ source "fs/notify/Kconfig"
+
+ source "fs/quota/Kconfig"
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:24:44 2009
+Message-Id: <20090701002444.463759633@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:24:33 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Mike Frysinger <vapier@gentoo.org>,
+ Alan Cox <alan@linux.intel.com>
+Subject: [patch 104/108] serial: bfin_5xx: fix building as module when early printk is enabled
+References: <20090701002249.937782934@mini.kroah.org>
+Content-Disposition: inline; filename=serial-bfin_5xx-fix-building-as-module-when-early-printk-is-enabled.patch
+Content-Length: 919
+Lines: 32
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Mike Frysinger <vapier@gentoo.org>
+
+commit 607c268ef9a4675287e77f732071e426e62c2d86 upstream.
+
+Since early printk only makes sense/works when the serial driver is built
+into the kernel, disable the option for this driver when it is going to be
+built as a module. Otherwise we get build failures due to the ifdef
+handling.
+
+Signed-off-by: Mike Frysinger <vapier@gentoo.org>
+Signed-off-by: Alan Cox <alan@linux.intel.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/serial/bfin_5xx.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/serial/bfin_5xx.c
++++ b/drivers/serial/bfin_5xx.c
+@@ -38,6 +38,10 @@
+ #include <asm/cacheflush.h>
+ #endif
+
++#ifdef CONFIG_SERIAL_BFIN_MODULE
++# undef CONFIG_EARLY_PRINTK
++#endif
++
+ /* UART name and device definitions */
+ #define BFIN_SERIAL_NAME "ttyBF"
+ #define BFIN_SERIAL_MAJOR 204
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:24:45 2009
+Message-Id: <20090701002444.956184017@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:24:34 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Sunil Mushran <sunil.mushran@oracle.com>,
+ Joel Becker <joel.becker@oracle.com>
+Subject: [patch 105/108] ocfs2: Fix ocfs2_osb_dump()
+References: <20090701002249.937782934@mini.kroah.org>
+Content-Disposition: inline; filename=ocfs2-fix-ocfs2_osb_dump.patch
+Content-Length: 2789
+Lines: 79
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Sunil Mushran <sunil.mushran@oracle.com>
+
+commit c3d38840abaa45c1c5a5fabbb8ffc9a0d1a764d1 upstream.
+
+Skip printing information that is not valid for local mounts.
+
+Signed-off-by: Sunil Mushran <sunil.mushran@oracle.com>
+Signed-off-by: Joel Becker <joel.becker@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/ocfs2/super.c | 32 ++++++++++++++++++--------------
+ 1 file changed, 18 insertions(+), 14 deletions(-)
+
+--- a/fs/ocfs2/super.c
++++ b/fs/ocfs2/super.c
+@@ -232,20 +232,24 @@ static int ocfs2_osb_dump(struct ocfs2_s
+ "%10s => Opts: 0x%lX AtimeQuanta: %u\n", "Mount",
+ osb->s_mount_opt, osb->s_atime_quantum);
+
+- out += snprintf(buf + out, len - out,
+- "%10s => Stack: %s Name: %*s Version: %d.%d\n",
+- "Cluster",
+- (*osb->osb_cluster_stack == '\0' ?
+- "o2cb" : osb->osb_cluster_stack),
+- cconn->cc_namelen, cconn->cc_name,
+- cconn->cc_version.pv_major, cconn->cc_version.pv_minor);
++ if (cconn) {
++ out += snprintf(buf + out, len - out,
++ "%10s => Stack: %s Name: %*s "
++ "Version: %d.%d\n", "Cluster",
++ (*osb->osb_cluster_stack == '\0' ?
++ "o2cb" : osb->osb_cluster_stack),
++ cconn->cc_namelen, cconn->cc_name,
++ cconn->cc_version.pv_major,
++ cconn->cc_version.pv_minor);
++ }
+
+ spin_lock(&osb->dc_task_lock);
+ out += snprintf(buf + out, len - out,
+ "%10s => Pid: %d Count: %lu WakeSeq: %lu "
+ "WorkSeq: %lu\n", "DownCnvt",
+- task_pid_nr(osb->dc_task), osb->blocked_lock_count,
+- osb->dc_wake_sequence, osb->dc_work_sequence);
++ (osb->dc_task ? task_pid_nr(osb->dc_task) : -1),
++ osb->blocked_lock_count, osb->dc_wake_sequence,
++ osb->dc_work_sequence);
+ spin_unlock(&osb->dc_task_lock);
+
+ spin_lock(&osb->osb_lock);
+@@ -265,14 +269,15 @@ static int ocfs2_osb_dump(struct ocfs2_s
+
+ out += snprintf(buf + out, len - out,
+ "%10s => Pid: %d Interval: %lu Needs: %d\n", "Commit",
+- task_pid_nr(osb->commit_task), osb->osb_commit_interval,
++ (osb->commit_task ? task_pid_nr(osb->commit_task) : -1),
++ osb->osb_commit_interval,
+ atomic_read(&osb->needs_checkpoint));
+
+ out += snprintf(buf + out, len - out,
+- "%10s => State: %d NumTxns: %d TxnId: %lu\n",
++ "%10s => State: %d TxnId: %lu NumTxns: %d\n",
+ "Journal", osb->journal->j_state,
+- atomic_read(&osb->journal->j_num_trans),
+- osb->journal->j_trans_id);
++ osb->journal->j_trans_id,
++ atomic_read(&osb->journal->j_num_trans));
+
+ out += snprintf(buf + out, len - out,
+ "%10s => GlobalAllocs: %d LocalAllocs: %d "
+@@ -300,7 +305,6 @@ static int ocfs2_osb_dump(struct ocfs2_s
+
+ out += snprintf(buf + out, len - out, "%10s => %3s %10s\n",
+ "Slots", "Num", "RecoGen");
+-
+ for (i = 0; i < osb->max_slots; ++i) {
+ out += snprintf(buf + out, len - out,
+ "%10s %c %3d %10d\n",
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:24:45 2009
+Message-Id: <20090701002445.375631252@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:24:35 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Rainer Weikusat <rweikusat@mssgmbh.com>,
+ Borislav Petkov <petkovbb@gmail.com>,
+ Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
+Subject: [patch 106/108] ide-cd: prevent null pointer deref via cdrom_newpc_intr
+References: <20090701002249.937782934@mini.kroah.org>
+Content-Disposition: inline; filename=ide-cd-prevent-null-pointer-deref-via-cdrom_newpc_intr.patch
+Content-Length: 1426
+Lines: 40
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Rainer Weikusat <rweikusat@mssgmbh.com>
+
+commit 39c58f37a10198054c656c28202fb1e6d22fd505 upstream.
+
+With 2.6.30, the error handling code in cdrom_newpc_intr was changed
+to deal with partial request failures by normally completing the 'good'
+parts of a request and only 'error' the last (and presumably,
+incompletely transferred) bio associated with a particular
+request. In order to do this, ide_complete_rq is called over
+ide_cd_error_cmd() to partially complete the rq. The block layer
+does partial completion only for requests with bio's and if the
+rq doesn't have one (eg 'GPCMD_READ_DISC_INFO') the request is
+completed as a whole and the drive->hwif->rq pointer set to NULL
+afterwards. When calling ide_complete_rq again to report
+the error, this null pointer is derefenced, resulting in a kernel
+crash.
+
+This fixes http://bugzilla.kernel.org/show_bug.cgi?id=13399.
+
+Signed-off-by: Rainer Weikusat <rweikusat@mssgmbh.com>
+Signed-off-by: Borislav Petkov <petkovbb@gmail.com>
+Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/ide/ide-cd.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/ide/ide-cd.c
++++ b/drivers/ide/ide-cd.c
+@@ -758,7 +758,7 @@ out_end:
+ rq->errors = -EIO;
+ }
+
+- if (uptodate == 0)
++ if (uptodate == 0 && rq->bio)
+ ide_cd_error_cmd(drive, cmd);
+
+ /* make sure it's fully ended */
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:24:46 2009
+Message-Id: <20090701002445.747864187@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:24:36 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jesse Barnes <jbarnes@virtuousgeek.org>,
+ Eric Anholt <eric@anholt.net>,
+ Jie Luo <clotho67@gmail.com>
+Subject: [patch 107/108] drm/i915: correct suspend/resume ordering
+References: <20090701002249.937782934@mini.kroah.org>
+Content-Disposition: inline; filename=drm-i915-correct-suspend-resume-ordering.patch
+Content-Length: 1394
+Lines: 44
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Jesse Barnes <jbarnes@virtuousgeek.org>
+
+commit 9e06dd39f2b6d7e35981e0d7aded618686b32ccb upstream.
+
+We need to save register state *after* idling GEM, clearing the ring,
+and uninstalling the IRQ handler, or we might end up saving bogus
+fence regs, for one. Our restore ordering should already be correct,
+since we do GEM, ring and IRQ init after restoring the last register
+state, which prevents us from clobbering things.
+
+I put this together to potentially address a bug, but I haven't heard
+back if it fixes it yet. However I think it stands on its own, so I'm
+sending it in.
+
+Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
+Signed-off-by: Eric Anholt <eric@anholt.net>
+Cc: Jie Luo <clotho67@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/i915/i915_drv.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/i915/i915_drv.c
++++ b/drivers/gpu/drm/i915/i915_drv.c
+@@ -67,8 +67,6 @@ static int i915_suspend(struct drm_devic
+
+ pci_save_state(dev->pdev);
+
+- i915_save_state(dev);
+-
+ /* If KMS is active, we do the leavevt stuff here */
+ if (drm_core_check_feature(dev, DRIVER_MODESET)) {
+ if (i915_gem_idle(dev))
+@@ -77,6 +75,8 @@ static int i915_suspend(struct drm_devic
+ drm_irq_uninstall(dev);
+ }
+
++ i915_save_state(dev);
++
+ intel_opregion_free(dev, 1);
+
+ if (state.event == PM_EVENT_SUSPEND) {
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:24:46 2009
+Message-Id: <20090701002446.414993796@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:24:37 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Marcelo Tosatti <mtosatti@redhat.com>,
+ Avi Kivity <avi@redhat.com>
+Subject: [patch 108/108] KVM: x86: silence preempt warning on kvm_write_guest_time
+References: <20090701002249.937782934@mini.kroah.org>
+Content-Disposition: inline; filename=kvm-x86-silence-preempt-warning-on-kvm_write_guest_time.patch
+Content-Length: 2120
+Lines: 65
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Matt T. Yourst <yourst@users.sourceforge.net>
+
+commit 2dea4c84bc936731668b5a7a9fba5b436a422668 upstream.
+
+This issue just appeared in kvm-84 when running on 2.6.28.7 (x86-64)
+with PREEMPT enabled.
+
+We're getting syslog warnings like this many (but not all) times qemu
+tells KVM to run the VCPU:
+
+BUG: using smp_processor_id() in preemptible [00000000] code:
+qemu-system-x86/28938
+caller is kvm_arch_vcpu_ioctl_run+0x5d1/0xc70 [kvm]
+Pid: 28938, comm: qemu-system-x86 2.6.28.7-mtyrel-64bit
+Call Trace:
+debug_smp_processor_id+0xf7/0x100
+kvm_arch_vcpu_ioctl_run+0x5d1/0xc70 [kvm]
+? __wake_up+0x4e/0x70
+? wake_futex+0x27/0x40
+kvm_vcpu_ioctl+0x2e9/0x5a0 [kvm]
+enqueue_hrtimer+0x8a/0x110
+_spin_unlock_irqrestore+0x27/0x50
+vfs_ioctl+0x31/0xa0
+do_vfs_ioctl+0x74/0x480
+sys_futex+0xb4/0x140
+sys_ioctl+0x99/0xa0
+system_call_fastpath+0x16/0x1b
+
+As it turns out, the call trace is messed up due to gcc's inlining, but
+I isolated the problem anyway: kvm_write_guest_time() is being used in a
+non-thread-safe manner on preemptable kernels.
+
+Basically kvm_write_guest_time()'s body needs to be surrounded by
+preempt_disable() and preempt_enable(), since the kernel won't let us
+query any per-CPU data (indirectly using smp_processor_id()) without
+preemption disabled. The attached patch fixes this issue by disabling
+preemption inside kvm_write_guest_time().
+
+[marcelo: surround only __get_cpu_var calls since the warning
+is harmless]
+
+Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
+Signed-off-by: Avi Kivity <avi@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kvm/x86.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -634,10 +634,12 @@ static void kvm_write_guest_time(struct
+ if ((!vcpu->time_page))
+ return;
+
++ preempt_disable();
+ if (unlikely(vcpu->hv_clock_tsc_khz != __get_cpu_var(cpu_tsc_khz))) {
+ kvm_set_time_scale(__get_cpu_var(cpu_tsc_khz), &vcpu->hv_clock);
+ vcpu->hv_clock_tsc_khz = __get_cpu_var(cpu_tsc_khz);
+ }
++ preempt_enable();
+
+ /* Keep irq disabled to prevent changes to the clock */
+ local_irq_save(flags);
+
+
+From gregkh@mini.kroah.org Tue Jun 30 17:24:10 2009
+Message-Id: <20090701002249.937782934@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 30 Jun 2009 17:22:49 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk
+Subject: [patch 000/108] 2.6.30-stable review
+Content-Length: 8787
+Lines: 170
+
+This is the start of the stable review cycle for the 2.6.30.1 release.
+
+Sorry for the delay in getting this out, it's a big one.
+
+There are 108 patches in this series, all will be posted as a response
+to this one. If anyone has any issues with these being applied, please
+let us know. If anyone is a maintainer of the proper subsystem, and
+wants to add a Signed-off-by: line to the patch, please respond with it.
+
+These patches are sent out with a number of different people on the Cc:
+line. If you wish to be a reviewer, please email stable@kernel.org to
+add your name to the list. If you want to be off the reviewer list,
+also email us.
+
+Responses should be made by Friday, Jul 3, 00:00:00 2009 UTC.
+Anything received after that time might be too late.
+
+The whole patch series can be found in one patch at:
+ kernel.org/pub/linux/kernel/v2.6/stable-review/patch-2.6.30.1-rc1.gz
+and the diffstat can be found below.
+
+
+thanks,
+
+greg k-h
+
+
+ Documentation/sysctl/vm.txt | 12 ++-
+ Makefile | 2 +-
+ arch/arm/include/asm/cacheflush.h | 8 ++
+ arch/x86/crypto/aesni-intel_asm.S | 5 +-
+ arch/x86/include/asm/apic.h | 2 +-
+ arch/x86/include/asm/cpufeature.h | 1 +
+ arch/x86/include/asm/uv/uv_bau.h | 2 +-
+ arch/x86/include/asm/uv/uv_hub.h | 6 +-
+ arch/x86/include/asm/vmx.h | 1 +
+ arch/x86/kernel/apic/x2apic_uv_x.c | 15 ++--
+ arch/x86/kernel/cpu/amd.c | 14 +++-
+ arch/x86/kernel/cpu/mcheck/mce_64.c | 1 +
+ arch/x86/kernel/hpet.c | 3 +-
+ arch/x86/kernel/pci-gart_64.c | 10 ++-
+ arch/x86/kernel/reboot.c | 9 ++
+ arch/x86/kernel/setup.c | 15 +---
+ arch/x86/kernel/tlb_uv.c | 24 ++++--
+ arch/x86/kernel/tsc.c | 11 +++-
+ arch/x86/kernel/vm86_32.c | 9 +-
+ arch/x86/kernel/vsyscall_64.c | 8 --
+ arch/x86/kvm/vmx.c | 101 ++++++++++++++++++++-----
+ arch/x86/kvm/x86.c | 10 ++-
+ arch/x86/mm/memtest.c | 14 ++--
+ drivers/char/epca.c | 9 +-
+ drivers/char/moxa.c | 7 ++-
+ drivers/char/n_r3964.c | 26 ++++---
+ drivers/char/pcmcia/cm4000_cs.c | 3 +-
+ drivers/char/rocket.c | 6 +-
+ drivers/char/vt_ioctl.c | 3 +-
+ drivers/firmware/memmap.c | 16 ++--
+ drivers/gpu/drm/i915/i915_drv.c | 4 +-
+ drivers/ide/ide-cd.c | 2 +-
+ drivers/infiniband/hw/mlx4/qp.c | 4 +
+ drivers/isdn/hisax/hfc_pci.c | 41 ++++++++---
+ drivers/isdn/hisax/hisax.h | 2 +-
+ drivers/md/dm-exception-store.c | 2 +-
+ drivers/md/dm-exception-store.h | 2 +-
+ drivers/md/dm-log.c | 2 +-
+ drivers/md/dm-mpath.c | 12 +++
+ drivers/md/dm-table.c | 3 +-
+ drivers/md/dm.c | 4 +
+ drivers/md/raid5.c | 1 +
+ drivers/media/dvb/frontends/lgdt3305.c | 17 +----
+ drivers/media/video/Makefile | 77 ++++++++++---------
+ drivers/media/video/cx18/cx18-controls.c | 2 +
+ drivers/media/video/cx2341x.c | 2 +
+ drivers/media/video/ivtv/ivtv-controls.c | 2 +
+ drivers/media/video/pvrusb2/pvrusb2-hdw.c | 56 ++++++++------
+ drivers/media/video/saa7134/Makefile | 3 +-
+ drivers/net/bonding/bond_sysfs.c | 1 +
+ drivers/net/e1000e/netdev.c | 2 +-
+ drivers/net/mv643xx_eth.c | 7 +-
+ drivers/net/sky2.c | 31 ++++----
+ drivers/net/tun.c | 7 +-
+ drivers/net/usb/pegasus.c | 29 ++++---
+ drivers/net/via-velocity.c | 2 +-
+ drivers/net/wireless/ath5k/base.c | 7 ++
+ drivers/net/wireless/ath9k/calib.c | 67 ++++++----------
+ drivers/net/wireless/ath9k/main.c | 28 +++++---
+ drivers/net/wireless/ath9k/pci.c | 18 +++++
+ drivers/net/wireless/ath9k/regd.c | 2 +-
+ drivers/net/wireless/ath9k/xmit.c | 5 +-
+ drivers/parport/parport_pc.c | 34 +++++++--
+ drivers/pci/pci.c | 7 +-
+ drivers/pci/pcie/aspm.c | 4 +
+ drivers/scsi/qla2xxx/qla_dbg.c | 2 +-
+ drivers/scsi/sym53c8xx_2/sym_hipd.c | 5 +-
+ drivers/serial/bfin_5xx.c | 5 +
+ drivers/spi/spi_mpc83xx.c | 6 +-
+ drivers/staging/uc2322/aten2011.c | 4 +-
+ drivers/usb/class/usbtmc.c | 6 ++
+ drivers/usb/serial/aircable.c | 5 +-
+ drivers/usb/serial/belkin_sa.c | 7 +-
+ drivers/usb/serial/cp210x.c | 6 +-
+ drivers/usb/serial/cyberjack.c | 20 ++++-
+ drivers/usb/serial/cypress_m8.c | 11 +--
+ drivers/usb/serial/digi_acceleport.c | 20 ++++-
+ drivers/usb/serial/empeg.c | 8 --
+ drivers/usb/serial/ftdi_sio.c | 14 ----
+ drivers/usb/serial/garmin_gps.c | 16 +++-
+ drivers/usb/serial/generic.c | 9 ++-
+ drivers/usb/serial/io_edgeport.c | 29 +++++--
+ drivers/usb/serial/io_tables.h | 12 ++-
+ drivers/usb/serial/io_ti.c | 22 ++++-
+ drivers/usb/serial/ipaq.c | 7 --
+ drivers/usb/serial/iuu_phoenix.c | 6 +-
+ drivers/usb/serial/keyspan.c | 13 +++-
+ drivers/usb/serial/keyspan.h | 12 ++-
+ drivers/usb/serial/keyspan_pda.c | 4 +-
+ drivers/usb/serial/kl5kusb105.c | 39 ++++++----
+ drivers/usb/serial/kobil_sct.c | 12 +--
+ drivers/usb/serial/mct_u232.c | 13 +--
+ drivers/usb/serial/mos7720.c | 9 +--
+ drivers/usb/serial/mos7840.c | 42 +++++++++-
+ drivers/usb/serial/omninet.c | 19 ++++-
+ drivers/usb/serial/opticon.c | 14 +++-
+ drivers/usb/serial/option.c | 17 +++-
+ drivers/usb/serial/oti6858.c | 7 +-
+ drivers/usb/serial/pl2303.c | 5 +-
+ drivers/usb/serial/sierra.c | 28 ++++++-
+ drivers/usb/serial/spcp8x5.c | 5 +-
+ drivers/usb/serial/symbolserial.c | 14 +++-
+ drivers/usb/serial/ti_usb_3410_5052.c | 10 +--
+ drivers/usb/serial/usb-serial.c | 29 +++----
+ drivers/usb/serial/visor.c | 13 +--
+ drivers/usb/serial/whiteheat.c | 6 +-
+ fs/Kconfig | 14 ++--
+ fs/cifs/file.c | 10 +-
+ fs/eventpoll.c | 21 +++--
+ fs/fs-writeback.c | 2 -
+ fs/jfs/jfs_extent.c | 1 +
+ fs/ocfs2/super.c | 32 +++++----
+ fs/ramfs/inode.c | 9 ++-
+ include/linux/firmware-map.h | 12 +--
+ include/linux/kvm_host.h | 1 +
+ include/linux/mlx4/qp.h | 1 +
+ include/linux/serial.h | 116 +++++++++++++++++------------
+ include/linux/usb/serial.h | 12 ++-
+ include/linux/vmstat.h | 3 +
+ include/net/x25.h | 2 +-
+ kernel/trace/trace_functions.c | 8 +-
+ lib/Kconfig.debug | 2 +-
+ lib/dma-debug.c | 43 ++++++++++-
+ lib/genalloc.c | 1 -
+ mm/page_alloc.c | 6 +-
+ mm/vmscan.c | 55 ++++++++++++--
+ mm/vmstat.c | 3 +
+ net/ipv4/route.c | 36 ++++++++-
+ net/mac80211/rc80211_minstrel.c | 2 +-
+ net/wireless/nl80211.c | 26 +++++--
+ net/wireless/reg.c | 10 ++-
+ net/x25/af_x25.c | 23 +++++-
+ net/x25/x25_timer.c | 2 +-
+ security/integrity/ima/ima_audit.c | 2 +-
+ security/integrity/ima/ima_main.c | 13 ++-
+ sound/core/seq/seq_midi_event.c | 8 +-
+ sound/isa/cmi8330.c | 2 +-
+ sound/pci/ca0106/ca0106_mixer.c | 6 ++
+ sound/pci/hda/patch_realtek.c | 2 +
+ sound/pci/intel8x0.c | 24 +++---
+ sound/soc/codecs/wm8903.c | 4 -
+ virt/kvm/kvm_main.c | 18 ++++-
+ 142 files changed, 1230 insertions(+), 675 deletions(-)
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
