--- /dev/null
+From gregkh@mini.kroah.org Thu Oct 1 16:33:19 2009
+Message-Id: <20091001233318.969422820@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 01 Oct 2009 16:31:17 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Alex Chiang <achiang@hp.com>,
+ Len Brown <len.brown@intel.com>
+Subject: [patch 01/30] ACPI: pci_slot.ko wants a 64-bit _SUN
+References: <20091001233116.947658905@mini.kroah.org>
+Content-Disposition: inline; filename=acpi-pci_slot.ko-wants-a-64-bit-_sun.patch
+Content-Length: 1334
+Lines: 41
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Alex Chiang <achiang@hp.com>
+
+commit 7e24bc1ce669b2876ffa475ea1147f2bb9ffdc52 upstream.
+
+Similar to commit b6adc195 (PCI hotplug: acpiphp wants a 64-bit
+_SUN), pci_slot.ko reads and creates sysfs directories based on
+the _SUN method.
+
+Certain HP platforms return 64 bits in _SUN. This change to
+pci_slot.ko allows us to see the correct sysfs directories.
+
+Reported-by: Chad Smith <chad.smith@hp.com>
+Signed-off-by: Alex Chiang <achiang@hp.com>
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/acpi/pci_slot.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/acpi/pci_slot.c
++++ b/drivers/acpi/pci_slot.c
+@@ -57,7 +57,7 @@ ACPI_MODULE_NAME("pci_slot");
+ MY_NAME , ## arg); \
+ } while (0)
+
+-#define SLOT_NAME_SIZE 20 /* Inspired by #define in acpiphp.h */
++#define SLOT_NAME_SIZE 21 /* Inspired by #define in acpiphp.h */
+
+ struct acpi_pci_slot {
+ acpi_handle root_handle; /* handle of the root bridge */
+@@ -149,7 +149,7 @@ register_slot(acpi_handle handle, u32 lv
+ return AE_OK;
+ }
+
+- snprintf(name, sizeof(name), "%u", (u32)sun);
++ snprintf(name, sizeof(name), "%llu", sun);
+ pci_slot = pci_create_slot(pci_bus, device, name, NULL);
+ if (IS_ERR(pci_slot)) {
+ err("pci_create_slot returned %ld\n", PTR_ERR(pci_slot));
+
+
+From gregkh@mini.kroah.org Thu Oct 1 16:33:19 2009
+Message-Id: <20091001233319.139191343@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 01 Oct 2009 16:31:18 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jan Kara <jack@suse.cz>,
+ Christoph Hellwig <hch@infradead.org>
+Subject: [patch 02/30] fs: make sure data stored into inode is properly seen before unlocking new inode
+References: <20091001233116.947658905@mini.kroah.org>
+Content-Disposition: inline; filename=fs-make-sure-data-stored-into-inode-is-properly-seen-before-unlocking-new-inode.patch
+Content-Length: 1763
+Lines: 47
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Jan Kara <jack@suse.cz>
+
+commit 580be0837a7a59b207c3d5c661d044d8dd0a6a30 upstream.
+
+In theory it could happen that on one CPU we initialize a new inode but
+clearing of I_NEW | I_LOCK gets reordered before some of the
+initialization. Thus on another CPU we return not fully uptodate inode
+from iget_locked().
+
+This seems to fix a corruption issue on ext3 mounted over NFS.
+
+[akpm@linux-foundation.org: add some commentary]
+Signed-off-by: Jan Kara <jack@suse.cz>
+Cc: Christoph Hellwig <hch@infradead.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/inode.c | 14 ++++++++------
+ 1 file changed, 8 insertions(+), 6 deletions(-)
+
+--- a/fs/inode.c
++++ b/fs/inode.c
+@@ -672,13 +672,15 @@ void unlock_new_inode(struct inode *inod
+ }
+ #endif
+ /*
+- * This is special! We do not need the spinlock
+- * when clearing I_LOCK, because we're guaranteed
+- * that nobody else tries to do anything about the
+- * state of the inode when it is locked, as we
+- * just created it (so there can be no old holders
+- * that haven't tested I_LOCK).
++ * This is special! We do not need the spinlock when clearing I_LOCK,
++ * because we're guaranteed that nobody else tries to do anything about
++ * the state of the inode when it is locked, as we just created it (so
++ * there can be no old holders that haven't tested I_LOCK).
++ * However we must emit the memory barrier so that other CPUs reliably
++ * see the clearing of I_LOCK after the other inode initialisation has
++ * completed.
+ */
++ smp_mb();
+ WARN_ON((inode->i_state & (I_LOCK|I_NEW)) != (I_LOCK|I_NEW));
+ inode->i_state &= ~(I_LOCK|I_NEW);
+ wake_up_inode(inode);
+
+
+From gregkh@mini.kroah.org Thu Oct 1 16:33:19 2009
+Message-Id: <20091001233319.270212254@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 01 Oct 2009 16:31:19 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Paul Mundt <lethal@linux-sh.org>,
+ Lai Jiangshan <laijs@cn.fujitsu.com>,
+ Sam Ravnborg <sam@ravnborg.org>,
+ Paulo Marques <pmarques@grupopie.com>,
+ Ingo Molnar <mingo@elte.hu>
+Subject: [patch 03/30] kallsyms: fix segfault in prefix_underscores_count()
+References: <20091001233116.947658905@mini.kroah.org>
+Content-Disposition: inline; filename=kallsyms-fix-segfault-in-prefix_underscores_count.patch
+Content-Length: 1582
+Lines: 48
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Paul Mundt <lethal@linux-sh.org>
+
+commit a9ece53c4089ef23d4002d34c4c7148d94622a40 upstream.
+
+Commit b478b782e110fdb4135caa3062b6d687e989d994 "kallsyms, tracing: output
+more proper symbol name" introduces a "bugfix" that introduces a segfault
+in kallsyms in my configurations.
+
+The cause is the introduction of prefix_underscores_count() which attempts
+to count underscores, even in symbols that do not have them. As a result,
+it just uselessly runs past the end of the buffer until it crashes:
+
+ CC init/version.o
+ LD init/built-in.o
+ LD .tmp_vmlinux1
+ KSYM .tmp_kallsyms1.S
+/bin/sh: line 1: 16934 Done sh-linux-gnu-nm -n .tmp_vmlinux1
+ 16935 Segmentation fault | scripts/kallsyms > .tmp_kallsyms1.S
+make: *** [.tmp_kallsyms1.S] Error 139
+
+This simplifies the logic and just does a straightforward count.
+
+Signed-off-by: Paul Mundt <lethal@linux-sh.org>
+Reviewed-by: Li Zefan <lizf@cn.fujitsu.com>
+Cc: Lai Jiangshan <laijs@cn.fujitsu.com>
+Cc: Sam Ravnborg <sam@ravnborg.org>
+Cc: Paulo Marques <pmarques@grupopie.com>
+Cc: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ scripts/kallsyms.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/scripts/kallsyms.c
++++ b/scripts/kallsyms.c
+@@ -539,7 +539,7 @@ static int prefix_underscores_count(cons
+ {
+ const char *tail = str;
+
+- while (*tail != '_')
++ while (*tail == '_')
+ tail++;
+
+ return tail - str;
+
+
+From gregkh@mini.kroah.org Thu Oct 1 16:33:19 2009
+Message-Id: <20091001233319.401694678@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 01 Oct 2009 16:31:20 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp>
+Subject: [patch 04/30] nilfs2: fix missing zero-fill initialization of btree node cache
+References: <20091001233116.947658905@mini.kroah.org>
+Content-Disposition: inline; filename=nilfs2-fix-missing-zero-fill-initialization-of-btree-node-cache.patch
+Content-Length: 1603
+Lines: 43
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp>
+
+commit 1f28fcd925b2b3157411bbd08f0024b55b70d8dd upstream.
+
+This will fix file system corruption which infrequently happens after
+mount. The problem was reported from users with the title "[NILFS
+users] Fail to mount NILFS." (Message-ID:
+<200908211918.34720.yuri@itinteg.net>), and so forth. I've also
+experienced the corruption multiple times on kernel 2.6.30 and 2.6.31.
+
+The problem turned out to be caused due to discordance between
+mapping->nrpages of a btree node cache and the actual number of pages
+hung on the cache; if the mapping->nrpages becomes zero even as it has
+pages, truncate_inode_pages() returns without doing anything. Usually
+this is harmless except it may cause page leak, but garbage collection
+fairly infrequently sees a stale page remained in the btree node cache
+of DAT (i.e. disk address translation file of nilfs), and induces the
+corruption.
+
+I identified a missing initialization in btree node caches was the
+root cause. This corrects the bug.
+
+I've tested this for kernel 2.6.30 and 2.6.31.
+
+Reported-by: Yuri Chislov <yuri@itinteg.net>
+Signed-off-by: Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/nilfs2/btnode.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/fs/nilfs2/btnode.c
++++ b/fs/nilfs2/btnode.c
+@@ -36,6 +36,7 @@
+
+ void nilfs_btnode_cache_init_once(struct address_space *btnc)
+ {
++ memset(btnc, 0, sizeof(*btnc));
+ INIT_RADIX_TREE(&btnc->page_tree, GFP_ATOMIC);
+ spin_lock_init(&btnc->tree_lock);
+ INIT_LIST_HEAD(&btnc->private_list);
+
+
+From gregkh@mini.kroah.org Thu Oct 1 16:33:19 2009
+Message-Id: <20091001233319.556002429@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 01 Oct 2009 16:31:21 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Christian Lamparter <chunkeey@googlemail.com>,
+ "John W. Linville" <linville@tuxdriver.com>
+Subject: [patch 05/30] p54usb: add Zcomax XG-705A usbid
+References: <20091001233116.947658905@mini.kroah.org>
+Content-Disposition: inline; filename=p54usb-add-zcomax-xg-705a-usbid.patch
+Content-Length: 1034
+Lines: 26
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Christian Lamparter <chunkeey@googlemail.com>
+
+commit f7f71173ea69d4dabf166533beffa9294090b7ef upstream.
+
+This patch adds a new usbid for Zcomax XG-705A to the device table.
+
+Reported-by: Jari Jaakola <jari.jaakola@gmail.com>
+Signed-off-by: Christian Lamparter <chunkeey@googlemail.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/p54/p54usb.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/wireless/p54/p54usb.c
++++ b/drivers/net/wireless/p54/p54usb.c
+@@ -66,6 +66,7 @@ static struct usb_device_id p54u_table[]
+ {USB_DEVICE(0x0bf8, 0x1009)}, /* FUJITSU E-5400 USB D1700*/
+ {USB_DEVICE(0x0cde, 0x0006)}, /* Medion MD40900 */
+ {USB_DEVICE(0x0cde, 0x0008)}, /* Sagem XG703A */
++ {USB_DEVICE(0x0cde, 0x0015)}, /* Zcomax XG-705A */
+ {USB_DEVICE(0x0d8e, 0x3762)}, /* DLink DWL-G120 Cohiba */
+ {USB_DEVICE(0x124a, 0x4025)}, /* IOGear GWU513 (GW3887IK chip) */
+ {USB_DEVICE(0x1260, 0xee22)}, /* SMC 2862W-G version 2 */
+
+
+From gregkh@mini.kroah.org Thu Oct 1 16:33:19 2009
+Message-Id: <20091001233319.687218132@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 01 Oct 2009 16:31:22 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Steve French <sfrench@us.ibm.com>
+Subject: [patch 06/30] [CIFS] Re-enable Lanman security
+References: <20091001233116.947658905@mini.kroah.org>
+Content-Disposition: inline; filename=re-enable-lanman-security.patch
+Content-Length: 1226
+Lines: 32
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Chuck Ebbert <cebbert@redhat.com>
+
+commit 20d1752f3d6bd32beb90949559e0d14a0b234445 upstream.
+
+commit ac68392460ffefed13020967bae04edc4d3add06 ("[CIFS] Allow raw
+ntlmssp code to be enabled with sec=ntlmssp") added a new bit to the
+allowed security flags mask but seems to have inadvertently removed
+Lanman security from the allowed flags. Add it back.
+
+Signed-off-by: Chuck Ebbert <cebbert@redhat.com>
+Signed-off-by: Steve French <sfrench@us.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/cifs/cifsglob.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/fs/cifs/cifsglob.h
++++ b/fs/cifs/cifsglob.h
+@@ -544,9 +544,9 @@ require use of the stronger protocol */
+ #define CIFSSEC_MUST_LANMAN 0x10010
+ #define CIFSSEC_MUST_PLNTXT 0x20020
+ #ifdef CONFIG_CIFS_UPCALL
+-#define CIFSSEC_MASK 0xAF0AF /* allows weak security but also krb5 */
++#define CIFSSEC_MASK 0xBF0BF /* allows weak security but also krb5 */
+ #else
+-#define CIFSSEC_MASK 0xA70A7 /* current flags supported if weak */
++#define CIFSSEC_MASK 0xB70B7 /* current flags supported if weak */
+ #endif /* UPCALL */
+ #else /* do not allow weak pw hash */
+ #ifdef CONFIG_CIFS_UPCALL
+
+
+From gregkh@mini.kroah.org Thu Oct 1 16:33:19 2009
+Message-Id: <20091001233319.817064863@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 01 Oct 2009 16:31:23 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Marcelo Tosatti <mtosatti@redhat.com>,
+ Avi Kivity <avi@redhat.com>
+Subject: [patch 07/30] KVM: VMX: Check cpl before emulating debug register access
+References: <20091001233116.947658905@mini.kroah.org>
+Content-Disposition: inline; filename=kvm-vmx-check-cpl-before-emulating-debug-register-access.patch
+Content-Length: 1916
+Lines: 62
+
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Avi Kivity <avi@redhat.com>
+
+(cherry picked from commit 0a79b009525b160081d75cef5dbf45817956acf2)
+
+Debug registers may only be accessed from cpl 0. Unfortunately, vmx will
+code to emulate the instruction even though it was issued from guest
+userspace, possibly leading to an unexpected trap later.
+
+Signed-off-by: Avi Kivity <avi@redhat.com>
+Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ arch/x86/include/asm/kvm_host.h | 1 +
+ arch/x86/kvm/vmx.c | 2 ++
+ arch/x86/kvm/x86.c | 13 +++++++++++++
+ 3 files changed, 16 insertions(+)
+
+--- a/arch/x86/include/asm/kvm_host.h
++++ b/arch/x86/include/asm/kvm_host.h
+@@ -620,6 +620,7 @@ void kvm_queue_exception(struct kvm_vcpu
+ void kvm_queue_exception_e(struct kvm_vcpu *vcpu, unsigned nr, u32 error_code);
+ void kvm_inject_page_fault(struct kvm_vcpu *vcpu, unsigned long cr2,
+ u32 error_code);
++bool kvm_require_cpl(struct kvm_vcpu *vcpu, int required_cpl);
+
+ int kvm_pic_set_irq(void *opaque, int irq, int level);
+
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -2865,6 +2865,8 @@ static int handle_dr(struct kvm_vcpu *vc
+ unsigned long val;
+ int dr, reg;
+
++ if (!kvm_require_cpl(vcpu, 0))
++ return 1;
+ dr = vmcs_readl(GUEST_DR7);
+ if (dr & DR7_GD) {
+ /*
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -217,6 +217,19 @@ static void __queue_exception(struct kvm
+ }
+
+ /*
++ * Checks if cpl <= required_cpl; if true, return true. Otherwise queue
++ * a #GP and return false.
++ */
++bool kvm_require_cpl(struct kvm_vcpu *vcpu, int required_cpl)
++{
++ if (kvm_x86_ops->get_cpl(vcpu) <= required_cpl)
++ return true;
++ kvm_queue_exception_e(vcpu, GP_VECTOR, 0);
++ return false;
++}
++EXPORT_SYMBOL_GPL(kvm_require_cpl);
++
++/*
+ * Load the pae pdptrs. Return true is they are all valid.
+ */
+ int load_pdptrs(struct kvm_vcpu *vcpu, unsigned long cr3)
+
+
+From gregkh@mini.kroah.org Thu Oct 1 16:33:20 2009
+Message-Id: <20091001233319.941189720@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 01 Oct 2009 16:31:24 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ avi@redhat.com,
+ Gleb Natapov <gleb@redhat.com>
+Subject: [patch 08/30] KVM: VMX: Fix cr8 exiting control clobbering by EPT
+References: <20091001233116.947658905@mini.kroah.org>
+Content-Disposition: inline; filename=kvm-vmx-fix-cr8-exiting-control-clobbering-by-ept.patch
+Content-Length: 1272
+Lines: 34
+
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Gleb Natapov <gleb@redhat.com>
+
+(cherry picked from commit 5fff7d270bd6a4759b6d663741b729cdee370257)
+Don't call adjust_vmx_controls() two times for the same control.
+It restores options that were dropped earlier. This loses us the cr8
+exit control, which causes a massive performance regression Windows x64.
+
+Signed-off-by: Gleb Natapov <gleb@redhat.com>
+Signed-off-by: Avi Kivity <avi@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ arch/x86/kvm/vmx.c | 9 +++------
+ 1 file changed, 3 insertions(+), 6 deletions(-)
+
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -1206,12 +1206,9 @@ static __init int setup_vmcs_config(stru
+ if (_cpu_based_2nd_exec_control & SECONDARY_EXEC_ENABLE_EPT) {
+ /* CR3 accesses and invlpg don't need to cause VM Exits when EPT
+ enabled */
+- min &= ~(CPU_BASED_CR3_LOAD_EXITING |
+- CPU_BASED_CR3_STORE_EXITING |
+- CPU_BASED_INVLPG_EXITING);
+- if (adjust_vmx_controls(min, opt, MSR_IA32_VMX_PROCBASED_CTLS,
+- &_cpu_based_exec_control) < 0)
+- return -EIO;
++ _cpu_based_exec_control &= ~(CPU_BASED_CR3_LOAD_EXITING |
++ CPU_BASED_CR3_STORE_EXITING |
++ CPU_BASED_INVLPG_EXITING);
+ rdmsr(MSR_IA32_VMX_EPT_VPID_CAP,
+ vmx_capability.ept, vmx_capability.vpid);
+ }
+
+
+From gregkh@mini.kroah.org Thu Oct 1 16:33:20 2009
+Message-Id: <20091001233320.095488110@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 01 Oct 2009 16:31:25 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Izik Eidus <ieidus@redhat.com>,
+ avi@redhat.com,
+ Marcelo Tosatti <mtosatti@redhat.com>
+Subject: [patch 09/30] KVM: MMU: make __kvm_mmu_free_some_pages handle empty list
+References: <20091001233116.947658905@mini.kroah.org>
+Content-Disposition: inline; filename=kvm-mmu-make-__kvm_mmu_free_some_pages-handle-empty-list.patch
+Content-Length: 914
+Lines: 29
+
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Izik Eidus <ieidus@redhat.com>
+
+(cherry picked from commit 3b80fffe2b31fb716d3ebe729c54464ee7856723)
+
+First check if the list is empty before attempting to look at list
+entries.
+
+Signed-off-by: Izik Eidus <ieidus@redhat.com>
+Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
+Signed-off-by: Avi Kivity <avi@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ arch/x86/kvm/mmu.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/arch/x86/kvm/mmu.c
++++ b/arch/x86/kvm/mmu.c
+@@ -2612,7 +2612,8 @@ EXPORT_SYMBOL_GPL(kvm_mmu_unprotect_page
+
+ void __kvm_mmu_free_some_pages(struct kvm_vcpu *vcpu)
+ {
+- while (vcpu->kvm->arch.n_free_mmu_pages < KVM_REFILL_PAGES) {
++ while (vcpu->kvm->arch.n_free_mmu_pages < KVM_REFILL_PAGES &&
++ !list_empty(&vcpu->kvm->arch.active_mmu_pages)) {
+ struct kvm_mmu_page *sp;
+
+ sp = container_of(vcpu->kvm->arch.active_mmu_pages.prev,
+
+
+From gregkh@mini.kroah.org Thu Oct 1 16:33:20 2009
+Message-Id: <20091001233320.245354779@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 01 Oct 2009 16:31:26 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jan Kiszka <jan.kiszka@siemens.com>,
+ avi@redhat.com
+Subject: [patch 10/30] KVM: x86: Disallow hypercalls for guest callers in rings > 0
+References: <20091001233116.947658905@mini.kroah.org>
+Content-Disposition: inline; filename=kvm-x86-disallow-hypercalls-for-guest-callers-in-rings-0.patch
+Content-Length: 1548
+Lines: 55
+
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Jan Kiszka <jan.kiszka@siemens.com>
+
+(cherry picked from commit 07708c4af1346ab1521b26a202f438366b7bcffd)
+
+So far unprivileged guest callers running in ring 3 can issue, e.g., MMU
+hypercalls. Normally, such callers cannot provide any hand-crafted MMU
+command structure as it has to be passed by its physical address, but
+they can still crash the guest kernel by passing random addresses.
+
+To close the hole, this patch considers hypercalls valid only if issued
+from guest ring 0. This may still be relaxed on a per-hypercall base in
+the future once required.
+
+Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
+Signed-off-by: Avi Kivity <avi@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ arch/x86/kvm/x86.c | 6 ++++++
+ include/linux/kvm_para.h | 1 +
+ 2 files changed, 7 insertions(+)
+
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -2898,6 +2898,11 @@ int kvm_emulate_hypercall(struct kvm_vcp
+ a3 &= 0xFFFFFFFF;
+ }
+
++ if (kvm_x86_ops->get_cpl(vcpu) != 0) {
++ ret = -KVM_EPERM;
++ goto out;
++ }
++
+ switch (nr) {
+ case KVM_HC_VAPIC_POLL_IRQ:
+ ret = 0;
+@@ -2909,6 +2914,7 @@ int kvm_emulate_hypercall(struct kvm_vcp
+ ret = -KVM_ENOSYS;
+ break;
+ }
++out:
+ kvm_register_write(vcpu, VCPU_REGS_RAX, ret);
+ ++vcpu->stat.hypercalls;
+ return r;
+--- a/include/linux/kvm_para.h
++++ b/include/linux/kvm_para.h
+@@ -13,6 +13,7 @@
+ #define KVM_ENOSYS 1000
+ #define KVM_EFAULT EFAULT
+ #define KVM_E2BIG E2BIG
++#define KVM_EPERM EPERM
+
+ #define KVM_HC_VAPIC_POLL_IRQ 1
+ #define KVM_HC_MMU_OP 2
+
+
+From gregkh@mini.kroah.org Thu Oct 1 16:33:20 2009
+Message-Id: <20091001233320.400713767@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 01 Oct 2009 16:31:27 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Marcelo Tosatti <mtosatti@redhat.com>,
+ avi@redhat.com
+Subject: [patch 11/30] KVM: MMU: fix missing locking in alloc_mmu_pages
+References: <20091001233116.947658905@mini.kroah.org>
+Content-Disposition: inline; filename=kvm-mmu-fix-missing-locking-in-alloc_mmu_pages.patch
+Content-Length: 1166
+Lines: 35
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Marcelo Tosatti <mtosatti@redhat.com>
+
+(cherry picked from commit 6a1ac77110ee3e8d8dfdef8442f3b30b3d83e6a2)
+
+n_requested_mmu_pages/n_free_mmu_pages are used by
+kvm_mmu_change_mmu_pages to calculate the number of pages to zap.
+
+alloc_mmu_pages, called from the vcpu initialization path, modifies this
+variables without proper locking, which can result in a negative value
+in kvm_mmu_change_mmu_pages (say, with cpu hotplug).
+
+Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ arch/x86/kvm/mmu.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/arch/x86/kvm/mmu.c
++++ b/arch/x86/kvm/mmu.c
+@@ -2692,12 +2692,14 @@ static int alloc_mmu_pages(struct kvm_vc
+
+ ASSERT(vcpu);
+
++ spin_lock(&vcpu->kvm->mmu_lock);
+ if (vcpu->kvm->arch.n_requested_mmu_pages)
+ vcpu->kvm->arch.n_free_mmu_pages =
+ vcpu->kvm->arch.n_requested_mmu_pages;
+ else
+ vcpu->kvm->arch.n_free_mmu_pages =
+ vcpu->kvm->arch.n_alloc_mmu_pages;
++ spin_unlock(&vcpu->kvm->mmu_lock);
+ /*
+ * When emulating 32-bit mode, cr3 is only 32 bits even on x86_64.
+ * Therefore we need to allocate shadow page tables in the first
+
+
+From gregkh@mini.kroah.org Thu Oct 1 16:33:20 2009
+Message-Id: <20091001233320.549424364@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 01 Oct 2009 16:31:28 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Marcelo Tosatti <mtosatti@redhat.com>,
+ avi@redhat.com
+Subject: [patch 12/30] KVM: MMU: fix bogus alloc_mmu_pages assignment
+References: <20091001233116.947658905@mini.kroah.org>
+Content-Disposition: inline; filename=kvm-mmu-fix-bogus-alloc_mmu_pages-assignment.patch
+Content-Length: 1084
+Lines: 35
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Marcelo Tosatti <mtosatti@redhat.com>
+
+(cherry picked from commit b90c062c65cc8839edfac39778a37a55ca9bda36)
+
+Remove the bogus n_free_mmu_pages assignment from alloc_mmu_pages.
+
+It breaks accounting of mmu pages, since n_free_mmu_pages is modified
+but the real number of pages remains the same.
+
+Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
+Signed-off-by: Avi Kivity <avi@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kvm/mmu.c | 8 --------
+ 1 file changed, 8 deletions(-)
+
+--- a/arch/x86/kvm/mmu.c
++++ b/arch/x86/kvm/mmu.c
+@@ -2692,14 +2692,6 @@ static int alloc_mmu_pages(struct kvm_vc
+
+ ASSERT(vcpu);
+
+- spin_lock(&vcpu->kvm->mmu_lock);
+- if (vcpu->kvm->arch.n_requested_mmu_pages)
+- vcpu->kvm->arch.n_free_mmu_pages =
+- vcpu->kvm->arch.n_requested_mmu_pages;
+- else
+- vcpu->kvm->arch.n_free_mmu_pages =
+- vcpu->kvm->arch.n_alloc_mmu_pages;
+- spin_unlock(&vcpu->kvm->mmu_lock);
+ /*
+ * When emulating 32-bit mode, cr3 is only 32 bits even on x86_64.
+ * Therefore we need to allocate shadow page tables in the first
+
+
+From gregkh@mini.kroah.org Thu Oct 1 16:33:20 2009
+Message-Id: <20091001233320.677886993@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 01 Oct 2009 16:31:29 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Marcelo Tosatti <mtosatti@redhat.com>,
+ avi@redhat.com
+Subject: [patch 13/30] KVM: limit lapic periodic timer frequency
+References: <20091001233116.947658905@mini.kroah.org>
+Content-Disposition: inline; filename=kvm-limit-lapic-periodic-timer-frequency.patch
+Content-Length: 959
+Lines: 34
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Marcelo Tosatti <mtosatti@redhat.com>
+
+(cherry picked from commit 1444885a045fe3b1905a14ea1b52540bf556578b)
+
+Otherwise its possible to starve the host by programming lapic timer
+with a very high frequency.
+
+Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
+Signed-off-by: Avi Kivity <avi@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kvm/lapic.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/arch/x86/kvm/lapic.c
++++ b/arch/x86/kvm/lapic.c
+@@ -635,6 +635,15 @@ static void start_apic_timer(struct kvm_
+
+ if (!apic->timer.period)
+ return;
++ /*
++ * Do not allow the guest to program periodic timers with small
++ * interval, since the hrtimers are not throttled by the host
++ * scheduler.
++ */
++ if (apic_lvtt_period(apic)) {
++ if (apic->timer.period < NSEC_PER_MSEC/2)
++ apic->timer.period = NSEC_PER_MSEC/2;
++ }
+
+ hrtimer_start(&apic->timer.dev,
+ ktime_add_ns(now, apic->timer.period),
+
+
+From gregkh@mini.kroah.org Thu Oct 1 16:33:20 2009
+Message-Id: <20091001233320.826090384@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 01 Oct 2009 16:31:30 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Glauber Costa <glommer@redhat.com>,
+ avi@redhat.com
+Subject: [patch 14/30] KVM guest: fix bogus wallclock physical address calculation
+References: <20091001233116.947658905@mini.kroah.org>
+Content-Disposition: inline; filename=kvm-guest-fix-bogus-wallclock-physical-address-calculation.patch
+Content-Length: 1138
+Lines: 34
+
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Glauber Costa <glommer@redhat.com>
+
+(cherry picked from commit a20316d2aa41a8f4fd171648bad8f044f6060826)
+
+The use of __pa() to calculate the address of a C-visible symbol
+is wrong, and can lead to unpredictable results. See arch/x86/include/asm/page.h
+for details.
+
+It should be replaced with __pa_symbol(), that does the correct math here,
+by taking relocations into account. This ensures the correct wallclock data
+structure physical address is passed to the hypervisor.
+
+Signed-off-by: Glauber Costa <glommer@redhat.com>
+Signed-off-by: Avi Kivity <avi@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ arch/x86/kernel/kvmclock.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/x86/kernel/kvmclock.c
++++ b/arch/x86/kernel/kvmclock.c
+@@ -50,8 +50,8 @@ static unsigned long kvm_get_wallclock(v
+ struct timespec ts;
+ int low, high;
+
+- low = (int)__pa(&wall_clock);
+- high = ((u64)__pa(&wall_clock) >> 32);
++ low = (int)__pa_symbol(&wall_clock);
++ high = ((u64)__pa_symbol(&wall_clock) >> 32);
+ native_write_msr(MSR_KVM_WALL_CLOCK, low, high);
+
+ vcpu_time = &get_cpu_var(hv_clock);
+
+
+From gregkh@mini.kroah.org Thu Oct 1 16:33:21 2009
+Message-Id: <20091001233320.964047795@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 01 Oct 2009 16:31:31 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Mark McLoughlin <markmc@redhat.com>,
+ avi@redhat.com
+Subject: [patch 15/30] KVM: fix cpuid E2BIG handling for extended request types
+References: <20091001233116.947658905@mini.kroah.org>
+Content-Disposition: inline; filename=kvm-fix-cpuid-e2big-handling-for-extended-request-types.patch
+Content-Length: 889
+Lines: 30
+
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Mark McLoughlin <markmc@redhat.com>
+
+(cherry picked from commit cb007648de83cf226d69ec76e1c01848b4e8e49f)
+
+If we run out of cpuid entries for extended request types
+we should return -E2BIG, just like we do for the standard
+request types.
+
+Signed-off-by: Mark McLoughlin <markmc@redhat.com>
+Signed-off-by: Avi Kivity <avi@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ arch/x86/kvm/x86.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -1438,6 +1438,10 @@ static int kvm_dev_ioctl_get_supported_c
+ for (func = 0x80000001; func <= limit && nent < cpuid->nent; ++func)
+ do_cpuid_ent(&cpuid_entries[nent], func, 0,
+ &nent, cpuid->nent);
++ r = -E2BIG;
++ if (nent >= cpuid->nent)
++ goto out_free;
++
+ r = -EFAULT;
+ if (copy_to_user(entries, cpuid_entries,
+ nent * sizeof(struct kvm_cpuid_entry2)))
+
+
+From gregkh@mini.kroah.org Thu Oct 1 16:33:21 2009
+Message-Id: <20091001233321.135633369@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 01 Oct 2009 16:31:32 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ avi@redhat.com
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Juan Quintela <quintela@redhat.com>,
+ Jan Kiszka <jan.kiszka@siemens.com>
+Subject: [patch 16/30] Revert "KVM: x86: check for cr3 validity in ioctl_set_sregs"
+References: <20091001233116.947658905@mini.kroah.org>
+Content-Disposition: inline; filename=revert-kvm-x86-check-for-cr3-validity-in-ioctl_set_sregs.patch
+Content-Length: 1171
+Lines: 42
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Marcelo Tosatti <mtosatti@redhat.com>
+
+(cherry picked from commit dc7e795e3dd2a763e5ceaa1615f307e808cf3932)
+
+This reverts commit 6c20e1442bb1c62914bb85b7f4a38973d2a423ba.
+
+To my understanding, it became obsolete with the advent of the more
+robust check in mmu_alloc_roots (89da4ff17f). Moreover, it prevents
+the conceptually safe pattern
+
+ 1. set sregs
+ 2. register mem-slots
+ 3. run vcpu
+
+by setting a sticky triple fault during step 1.
+
+Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
+Signed-off-by: Avi Kivity <avi@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kvm/x86.c | 8 +-------
+ 1 file changed, 1 insertion(+), 7 deletions(-)
+
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -4012,13 +4012,7 @@ int kvm_arch_vcpu_ioctl_set_sregs(struct
+
+ vcpu->arch.cr2 = sregs->cr2;
+ mmu_reset_needed |= vcpu->arch.cr3 != sregs->cr3;
+-
+- down_read(&vcpu->kvm->slots_lock);
+- if (gfn_to_memslot(vcpu->kvm, sregs->cr3 >> PAGE_SHIFT))
+- vcpu->arch.cr3 = sregs->cr3;
+- else
+- set_bit(KVM_REQ_TRIPLE_FAULT, &vcpu->requests);
+- up_read(&vcpu->kvm->slots_lock);
++ vcpu->arch.cr3 = sregs->cr3;
+
+ kvm_set_cr8(vcpu, sregs->cr8);
+
+
+
+From gregkh@mini.kroah.org Thu Oct 1 16:33:21 2009
+Message-Id: <20091001233321.303910330@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 01 Oct 2009 16:31:33 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Tejun Heo <tj@kernel.org>,
+ Jeff Garzik <jgarzik@redhat.com>
+Subject: [patch 17/30] ahci: restore pci_intx() handling
+References: <20091001233116.947658905@mini.kroah.org>
+Content-Disposition: inline; filename=ahci-restore-pci_intx-handling.patch
+Content-Length: 1484
+Lines: 41
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Tejun Heo <tj@kernel.org>
+
+commit 31b239ad1ba7225435e13f5afc47e48eb674c0cc upstream.
+
+Commit a5bfc4714b3f01365aef89a92673f2ceb1ccf246 dropped explicit
+pci_intx() manipulation from ahci because it seemed unnecessary and
+ahci doesn't seem to be the right place to be tweaking it if it were.
+This was largely okay but there are exceptions. There was one on an
+embedded platform which was fixed via firmware and now bko#14124
+reports it on a HP DL320.
+
+ http://bugzilla.kernel.org/show_bug.cgi?id=14124
+
+I still think this isn't something libata drivers should be caring
+about (the only ones which are calling pci_intx() explicitly are
+libata ones and one other driver) but for now reverting the change
+seems to be the right thing to do.
+
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Reported-by: Thomas Jarosch <thomas.jarosch@intra2net.com>
+Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/ata/ahci.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/ata/ahci.c
++++ b/drivers/ata/ahci.c
+@@ -2744,8 +2744,8 @@ static int ahci_init_one(struct pci_dev
+ if (board_id == board_ahci_sb700 && pdev->revision >= 0x40)
+ hpriv->flags &= ~AHCI_HFLAG_IGN_SERR_INTERNAL;
+
+- if (!(hpriv->flags & AHCI_HFLAG_NO_MSI))
+- pci_enable_msi(pdev);
++ if ((hpriv->flags & AHCI_HFLAG_NO_MSI) || pci_enable_msi(pdev))
++ pci_intx(pdev, 1);
+
+ /* save initial config */
+ ahci_save_initial_config(pdev, hpriv);
+
+
+From gregkh@mini.kroah.org Thu Oct 1 16:33:21 2009
+Message-Id: <20091001233321.426432538@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 01 Oct 2009 16:31:34 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ davem@davemloft.net
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ jakub@redhat.com,
+ security@kernel.org,
+ mingo@elte.hu,
+ Arjan van de Ven <arjan@linux.intel.com>
+Subject: [patch 18/30] net ax25: Fix signed comparison in the sockopt handler
+References: <20091001233116.947658905@mini.kroah.org>
+Content-Disposition: inline; filename=net-ax25-fix-signed-comparison-in-the-sockopt-handler.patch
+Content-Length: 1260
+Lines: 47
+
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Arjan van de Ven <arjan@linux.intel.com>
+
+fixed upstream in commit b7058842c940ad2c08dd829b21e5c92ebe3b8758 in a different way
+
+The ax25 code tried to use
+
+ if (optlen < sizeof(int))
+ return -EINVAL;
+
+as a security check against optlen being negative (or zero) in the
+set socket option.
+
+Unfortunately, "sizeof(int)" is an unsigned property, with the
+result that the whole comparison is done in unsigned, letting
+negative values slip through.
+
+This patch changes this to
+
+ if (optlen < (int)sizeof(int))
+ return -EINVAL;
+
+so that the comparison is done as signed, and negative values
+get properly caught.
+
+Signed-off-by: Arjan van de Ven <arjan@linux.intel.com>
+Cc: David S. Miller <davem@davemloft.net>
+Cc: Ingo Molnar <mingo@elte.hu>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/ax25/af_ax25.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/ax25/af_ax25.c
++++ b/net/ax25/af_ax25.c
+@@ -539,7 +539,7 @@ static int ax25_setsockopt(struct socket
+ if (level != SOL_AX25)
+ return -ENOPROTOOPT;
+
+- if (optlen < sizeof(int))
++ if (optlen < (int)sizeof(int))
+ return -EINVAL;
+
+ if (get_user(opt, (int __user *)optval))
+
+
+From gregkh@mini.kroah.org Thu Oct 1 16:33:21 2009
+Message-Id: <20091001233321.578747017@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 01 Oct 2009 16:31:35 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ Arjan van de Ven <arjan@infradead.org>
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ jakub@redhat.com,
+ security@kernel.org,
+ mingo@elte.hu,
+ davem@davemloft.net,
+ Arjan van de Ven <arjan@linux.intel.com>
+Subject: [patch 19/30] net: Make the copy length in af_packet sockopt handler unsigned
+References: <20091001233116.947658905@mini.kroah.org>
+Content-Disposition: inline; filename=net-make-the-copy-length-in-af_packet-sockopt-handler-unsigned.patch
+Content-Length: 1260
+Lines: 41
+
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Arjan van de Ven <arjan@linux.intel.com>
+
+fixed upstream in commit b7058842c940ad2c08dd829b21e5c92ebe3b8758 in a different way
+
+The length of the to-copy data structure is currently stored in
+a signed integer. However many comparisons are done with sizeof(..)
+which is unsigned. It's more suitable for this variable to be unsigned
+to make these comparisons more naturally right.
+
+Signed-off-by: Arjan van de Ven <arjan@linux.intel.com>
+Cc: David S. Miller <davem@davemloft.net>
+Cc: Ingo Molnar <mingo@elte.hu>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/packet/af_packet.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -1501,7 +1501,7 @@ packet_setsockopt(struct socket *sock, i
+ static int packet_getsockopt(struct socket *sock, int level, int optname,
+ char __user *optval, int __user *optlen)
+ {
+- int len;
++ unsigned int len;
+ int val;
+ struct sock *sk = sock->sk;
+ struct packet_sock *po = pkt_sk(sk);
+@@ -1514,7 +1514,7 @@ static int packet_getsockopt(struct sock
+ if (get_user(len, optlen))
+ return -EFAULT;
+
+- if (len < 0)
++ if ((int)len < 0)
+ return -EINVAL;
+
+ switch(optname) {
+
+
+From gregkh@mini.kroah.org Thu Oct 1 16:33:21 2009
+Message-Id: <20091001233321.739706856@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 01 Oct 2009 16:31:36 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Dave Jones <davej@redhat.com>
+Subject: [patch 20/30] [CPUFREQ] Fix NULL ptr regression in powernow-k8
+References: <20091001233116.947658905@mini.kroah.org>
+Content-Disposition: inline; filename=fix-null-ptr-regression-in-powernow-k8.patch
+Content-Length: 2239
+Lines: 73
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Kurt Roeckx <kurt@roeckx.be>
+
+commit f0adb134d8dc9993a9998dc50845ec4f6ff4fadc upstream.
+
+Fixes bugzilla #13780
+
+From: Kurt Roeckx <kurt@roeckx.be>
+Signed-off-by: Dave Jones <davej@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/cpu/cpufreq/powernow-k8.c | 15 ++++++++-------
+ 1 file changed, 8 insertions(+), 7 deletions(-)
+
+--- a/arch/x86/kernel/cpu/cpufreq/powernow-k8.c
++++ b/arch/x86/kernel/cpu/cpufreq/powernow-k8.c
+@@ -618,9 +618,10 @@ static int check_pst_table(struct powern
+ return 0;
+ }
+
+-static void invalidate_entry(struct powernow_k8_data *data, unsigned int entry)
++static void invalidate_entry(struct cpufreq_frequency_table *powernow_table,
++ unsigned int entry)
+ {
+- data->powernow_table[entry].frequency = CPUFREQ_ENTRY_INVALID;
++ powernow_table[entry].frequency = CPUFREQ_ENTRY_INVALID;
+ }
+
+ static void print_basics(struct powernow_k8_data *data)
+@@ -926,13 +927,13 @@ static int fill_powernow_table_pstate(st
+ "bad value %d.\n", i, index);
+ printk(KERN_ERR PFX "Please report to BIOS "
+ "manufacturer\n");
+- invalidate_entry(data, i);
++ invalidate_entry(powernow_table, i);
+ continue;
+ }
+ rdmsr(MSR_PSTATE_DEF_BASE + index, lo, hi);
+ if (!(hi & HW_PSTATE_VALID_MASK)) {
+ dprintk("invalid pstate %d, ignoring\n", index);
+- invalidate_entry(data, i);
++ invalidate_entry(powernow_table, i);
+ continue;
+ }
+
+@@ -982,7 +983,7 @@ static int fill_powernow_table_fidvid(st
+ /* verify frequency is OK */
+ if ((freq > (MAX_FREQ * 1000)) || (freq < (MIN_FREQ * 1000))) {
+ dprintk("invalid freq %u kHz, ignoring\n", freq);
+- invalidate_entry(data, i);
++ invalidate_entry(powernow_table, i);
+ continue;
+ }
+
+@@ -990,7 +991,7 @@ static int fill_powernow_table_fidvid(st
+ * BIOSs are using "off" to indicate invalid */
+ if (vid == VID_OFF) {
+ dprintk("invalid vid %u, ignoring\n", vid);
+- invalidate_entry(data, i);
++ invalidate_entry(powernow_table, i);
+ continue;
+ }
+
+@@ -1021,7 +1022,7 @@ static int fill_powernow_table_fidvid(st
+ (unsigned int)
+ (data->acpi_data.states[i].core_frequency
+ * 1000));
+- invalidate_entry(data, i);
++ invalidate_entry(powernow_table, i);
+ continue;
+ }
+ }
+
+
+From gregkh@mini.kroah.org Thu Oct 1 16:33:22 2009
+Message-Id: <20091001233321.895031689@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 01 Oct 2009 16:31:37 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ netdev@vger.kernel.org,
+ netfilter-devel@vger.kernel.org,
+ Patrick McHardy <kaber@trash.net>,
+ davem@davemloft.net,
+ Eric Dumazet <eric.dumazet@gmail.com>
+Subject: [patch 21/30] netfilter: bridge: refcount fix
+References: <20091001233116.947658905@mini.kroah.org>
+Content-Disposition: inline; filename=netfilter-bridge-refcount-fix.patch
+Content-Length: 999
+Lines: 35
+
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Patrick McHardy <kaber@trash.net>
+
+netfilter: bridge: refcount fix
+
+Upstream commit f3abc9b9:
+
+commit f216f082b2b37c4943f1e7c393e2786648d48f6f
+([NETFILTER]: bridge netfilter: deal with martians correctly)
+added a refcount leak on in_dev.
+
+Instead of using in_dev_get(), we can use __in_dev_get_rcu(),
+as netfilter hooks are running under rcu_read_lock(), as pointed
+by Patrick.
+
+Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
+Signed-off-by: Patrick McHardy <kaber@trash.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/bridge/br_netfilter.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/bridge/br_netfilter.c
++++ b/net/bridge/br_netfilter.c
+@@ -357,7 +357,7 @@ static int br_nf_pre_routing_finish(stru
+ },
+ .proto = 0,
+ };
+- struct in_device *in_dev = in_dev_get(dev);
++ struct in_device *in_dev = __in_dev_get_rcu(dev);
+
+ /* If err equals -EHOSTUNREACH the error is due to a
+ * martian destination or due to the fact that
+
+
+From gregkh@mini.kroah.org Thu Oct 1 16:33:22 2009
+Message-Id: <20091001233322.057476155@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 01 Oct 2009 16:31:38 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ netdev@vger.kernel.org,
+ netfilter-devel@vger.kernel.org,
+ Patrick McHardy <kaber@trash.net>,
+ davem@davemloft.net
+Subject: [patch 22/30] netfilter: ebt_ulog: fix checkentry return value
+References: <20091001233116.947658905@mini.kroah.org>
+Content-Disposition: inline; filename=netfilter-ebt_ulog-fix-checkentry-return-value.patch
+Content-Length: 800
+Lines: 30
+
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Patrick McHardy <kaber@trash.net>
+
+netfilter: ebt_ulog: fix checkentry return value
+
+Upstream commit 8a56df0a:
+
+Commit 19eda87 (netfilter: change return types of check functions for
+Ebtables extensions) broke the ebtables ulog module by missing a return
+value conversion.
+
+Signed-off-by: Patrick McHardy <kaber@trash.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/bridge/netfilter/ebt_ulog.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/bridge/netfilter/ebt_ulog.c
++++ b/net/bridge/netfilter/ebt_ulog.c
+@@ -266,7 +266,7 @@ static bool ebt_ulog_tg_check(const stru
+ if (uloginfo->qthreshold > EBT_ULOG_MAX_QLEN)
+ uloginfo->qthreshold = EBT_ULOG_MAX_QLEN;
+
+- return 0;
++ return true;
+ }
+
+ static struct xt_target ebt_ulog_tg_reg __read_mostly = {
+
+
+From gregkh@mini.kroah.org Thu Oct 1 16:33:22 2009
+Message-Id: <20091001233322.211355350@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 01 Oct 2009 16:31:39 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ netdev@vger.kernel.org,
+ netfilter-devel@vger.kernel.org,
+ Patrick McHardy <kaber@trash.net>,
+ davem@davemloft.net,
+ Maximilian Engelhardt <maxi@daemonizer.de>
+Subject: [patch 23/30] netfilter: nf_nat: fix inverted logic for persistent NAT mappings
+References: <20091001233116.947658905@mini.kroah.org>
+Content-Disposition: inline; filename=netfilter-nf_nat-fix-inverted-logic-for-persistent-nat-mappings.patch
+Content-Length: 1454
+Lines: 39
+
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Patrick McHardy <kaber@trash.net>
+
+netfilter: nf_nat: fix inverted logic for persistent NAT mappings
+
+Upstream commit cce5a5c3:
+
+Kernel 2.6.30 introduced a patch [1] for the persistent option in the
+netfilter SNAT target. This is exactly what we need here so I had a quick look
+at the code and noticed that the patch is wrong. The logic is simply inverted.
+The patch below fixes this.
+
+Also note that because of this the default behavior of the SNAT target has
+changed since kernel 2.6.30 as it now ignores the destination IP in choosing
+the source IP for nating (which should only be the case if the persistent
+option is set).
+
+[1] http://git.eu.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=98d500d66cb7940747b424b245fc6a51ecfbf005
+
+Signed-off-by: Maximilian Engelhardt <maxi@daemonizer.de>
+Signed-off-by: Patrick McHardy <kaber@trash.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/ipv4/netfilter/nf_nat_core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/ipv4/netfilter/nf_nat_core.c
++++ b/net/ipv4/netfilter/nf_nat_core.c
+@@ -212,7 +212,7 @@ find_best_ips_proto(struct nf_conntrack_
+ maxip = ntohl(range->max_ip);
+ j = jhash_2words((__force u32)tuple->src.u3.ip,
+ range->flags & IP_NAT_RANGE_PERSISTENT ?
+- (__force u32)tuple->dst.u3.ip : 0, 0);
++ 0 : (__force u32)tuple->dst.u3.ip, 0);
+ j = ((u64)j * (maxip - minip + 1)) >> 32;
+ *var_ipp = htonl(minip + j);
+ }
+
+
+From gregkh@mini.kroah.org Thu Oct 1 16:33:22 2009
+Message-Id: <20091001233322.365718536@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 01 Oct 2009 16:31:40 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Michael Abbott <michael.abbott@diamond.ac.uk>,
+ Martin Schwidefsky <schwidefsky@de.ibm.com>
+Subject: [patch 24/30] Fix idle time field in /proc/uptime
+References: <20091001233116.947658905@mini.kroah.org>
+Content-Disposition: inline; filename=fix-idle-time-field-in-proc-uptime.patch
+Content-Length: 1154
+Lines: 39
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Michael Abbott <michael.abbott@diamond.ac.uk>
+
+commit 96830a57de1197519b62af6a4c9ceea556c18c3d upstream.
+
+Git commit 79741dd changes idle cputime accounting, but unfortunately
+the /proc/uptime file hasn't caught up. Here the idle time calculation
+from /proc/stat is copied over.
+
+Signed-off-by: Michael Abbott <michael.abbott@diamond.ac.uk>
+Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/proc/uptime.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/fs/proc/uptime.c
++++ b/fs/proc/uptime.c
+@@ -4,13 +4,18 @@
+ #include <linux/sched.h>
+ #include <linux/seq_file.h>
+ #include <linux/time.h>
++#include <linux/kernel_stat.h>
+ #include <asm/cputime.h>
+
+ static int uptime_proc_show(struct seq_file *m, void *v)
+ {
+ struct timespec uptime;
+ struct timespec idle;
+- cputime_t idletime = cputime_add(init_task.utime, init_task.stime);
++ int i;
++ cputime_t idletime = cputime_zero;
++
++ for_each_possible_cpu(i)
++ idletime = cputime64_add(idletime, kstat_cpu(i).cpustat.idle);
+
+ do_posix_clock_monotonic_gettime(&uptime);
+ monotonic_to_bootbased(&uptime);
+
+
+From gregkh@mini.kroah.org Thu Oct 1 16:33:22 2009
+Message-Id: <20091001233322.522313514@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 01 Oct 2009 16:31:41 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ torvalds@linux-foundation.org
+Cc: stable-review@kernel.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Lee.Schermerhorn@hp.com,
+ lee.schermerhorn@hp.com,
+ ak@linux.intel.com,
+ eric.whitney@hp.com,
+ mel@csn.ul.ie,
+ rientjes@google.com,
+ agl@us.ibm.com,
+ apw@canonical.com
+Subject: [patch 25/30] hugetlb: restore interleaving of bootmem huge pages (2.6.31)
+References: <20091001233116.947658905@mini.kroah.org>
+Content-Disposition: inline; filename=hugetlb-restore-interleaving-of-bootmem-huge-pages.patch
+Content-Length: 2330
+Lines: 66
+
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Lee Schermerhorn <Lee.Schermerhorn@hp.com>
+
+Not upstream as it is fixed differently in .32
+
+I noticed that alloc_bootmem_huge_page() will only advance to the next
+node on failure to allocate a huge page. I asked about this on linux-mm
+and linux-numa, cc'ing the usual huge page suspects. Mel Gorman
+responded:
+
+ I strongly suspect that the same node being used until allocation
+ failure instead of round-robin is an oversight and not deliberate
+ at all. It appears to be a side-effect of a fix made way back in
+ commit 63b4613c3f0d4b724ba259dc6c201bb68b884e1a ["hugetlb: fix
+ hugepage allocation with memoryless nodes"]. Prior to that patch
+ it looked like allocations would always round-robin even when
+ allocation was successful.
+
+Andy Whitcroft countered that the existing behavior looked like Andi
+Kleen's original implementation and suggested that we ask him. We did and
+Andy replied that his intention was to interleave the allocations. So,
+...
+
+This patch moves the advance of the hstate next node from which to
+allocate up before the test for success of the attempted allocation. This
+will unconditionally advance the next node from which to alloc,
+interleaving successful allocations over the nodes with sufficient
+contiguous memory, and skipping over nodes that fail the huge page
+allocation attempt.
+
+Note that alloc_bootmem_huge_page() will only be called for huge pages of
+order > MAX_ORDER.
+
+Signed-off-by: Lee Schermerhorn <lee.schermerhorn@hp.com>
+Reviewed-by: Andi Kleen <ak@linux.intel.com>
+Cc: Mel Gorman <mel@csn.ul.ie>
+Cc: David Rientjes <rientjes@google.com>
+Cc: Adam Litke <agl@us.ibm.com>
+Cc: Andy Whitcroft <apw@canonical.com>
+Cc: Eric Whitney <eric.whitney@hp.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ mm/hugetlb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/mm/hugetlb.c
++++ b/mm/hugetlb.c
+@@ -1017,6 +1017,7 @@ int __weak alloc_bootmem_huge_page(struc
+ NODE_DATA(h->hugetlb_next_nid),
+ huge_page_size(h), huge_page_size(h), 0);
+
++ hstate_next_node(h);
+ if (addr) {
+ /*
+ * Use the beginning of the huge page to store the
+@@ -1026,7 +1027,6 @@ int __weak alloc_bootmem_huge_page(struc
+ m = addr;
+ goto found;
+ }
+- hstate_next_node(h);
+ nr_nodes--;
+ }
+ return 0;
+
+
+From gregkh@mini.kroah.org Thu Oct 1 16:33:22 2009
+Message-Id: <20091001233322.677176498@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 01 Oct 2009 16:31:42 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ linuxppc-dev list <linuxppc-dev@ozlabs.org>,
+ RFeany@mrv.com,
+ Rex Feany <rfeany@mrv.com>,
+ Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Subject: [patch 26/30] powerpc/8xx: Fix regression introduced by cache coherency rewrite
+References: <20091001233116.947658905@mini.kroah.org>
+Content-Disposition: inline; filename=powerpc-8xx-fix-regression-introduced-by-cache-coherency-rewrite.patch
+Content-Length: 2579
+Lines: 75
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Rex Feany <RFeany@mrv.com>
+
+commit e0908085fc2391c85b85fb814ae1df377c8e0dcb upstream.
+
+After upgrading to the latest kernel on my mpc875 userspace started
+running incredibly slow (hours to get to a shell, even!).
+I tracked it down to commit 8d30c14cab30d405a05f2aaceda1e9ad57800f36,
+that patch removed a work-around for the 8xx. Adding it
+back makes my problem go away.
+
+Signed-off-by: Rex Feany <rfeany@mrv.com>
+Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/powerpc/mm/pgtable.c | 19 ++++++++++++++++---
+ 1 file changed, 16 insertions(+), 3 deletions(-)
+
+--- a/arch/powerpc/mm/pgtable.c
++++ b/arch/powerpc/mm/pgtable.c
+@@ -30,6 +30,8 @@
+ #include <asm/tlbflush.h>
+ #include <asm/tlb.h>
+
++#include "mmu_decl.h"
++
+ static DEFINE_PER_CPU(struct pte_freelist_batch *, pte_freelist_cur);
+ static unsigned long pte_freelist_forced_free;
+
+@@ -119,7 +121,7 @@ void pte_free_finish(void)
+ /*
+ * Handle i/d cache flushing, called from set_pte_at() or ptep_set_access_flags()
+ */
+-static pte_t do_dcache_icache_coherency(pte_t pte)
++static pte_t do_dcache_icache_coherency(pte_t pte, unsigned long addr)
+ {
+ unsigned long pfn = pte_pfn(pte);
+ struct page *page;
+@@ -128,6 +130,17 @@ static pte_t do_dcache_icache_coherency(
+ return pte;
+ page = pfn_to_page(pfn);
+
++#ifdef CONFIG_8xx
++ /* On 8xx, cache control instructions (particularly
++ * "dcbst" from flush_dcache_icache) fault as write
++ * operation if there is an unpopulated TLB entry
++ * for the address in question. To workaround that,
++ * we invalidate the TLB here, thus avoiding dcbst
++ * misbehaviour.
++ */
++ _tlbil_va(addr, 0 /* 8xx doesn't care about PID */);
++#endif
++
+ if (!PageReserved(page) && !test_bit(PG_arch_1, &page->flags)) {
+ pr_debug("do_dcache_icache_coherency... flushing\n");
+ flush_dcache_icache_page(page);
+@@ -198,7 +211,7 @@ void set_pte_at(struct mm_struct *mm, un
+ */
+ pte = __pte(pte_val(pte) & ~_PAGE_HPTEFLAGS);
+ if (pte_need_exec_flush(pte, 1))
+- pte = do_dcache_icache_coherency(pte);
++ pte = do_dcache_icache_coherency(pte, addr);
+
+ /* Perform the setting of the PTE */
+ __set_pte_at(mm, addr, ptep, pte, 0);
+@@ -216,7 +229,7 @@ int ptep_set_access_flags(struct vm_area
+ {
+ int changed;
+ if (!dirty && pte_need_exec_flush(entry, 0))
+- entry = do_dcache_icache_coherency(entry);
++ entry = do_dcache_icache_coherency(entry, address);
+ changed = !pte_same(*(ptep), entry);
+ if (changed) {
+ if (!(vma->vm_flags & VM_HUGETLB))
+
+
+From gregkh@mini.kroah.org Thu Oct 1 16:33:22 2009
+Message-Id: <20091001233322.806126675@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 01 Oct 2009 16:31:43 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ linuxppc-dev list <linuxppc-dev@ozlabs.org>,
+ bernhard.weirich@riedel.net,
+ RFeany@mrv.com,
+ Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Subject: [patch 27/30] powerpc: Fix incorrect setting of __HAVE_ARCH_PTE_SPECIAL
+References: <20091001233116.947658905@mini.kroah.org>
+Content-Disposition: inline; filename=powerpc-fix-incorrect-setting-of-__have_arch_pte_special.patch
+Content-Length: 1021
+Lines: 33
+
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Weirich, Bernhard <Bernhard.Weirich@riedel.net>
+
+[I'm going to fix upstream differently, by having all CPU types
+actually support _PAGE_SPECIAL, but I prefer the simple and obvious
+fix for -stable. -- Ben]
+
+The test that decides whether to define __HAVE_ARCH_PTE_SPECIAL on
+powerpc is bogus and will end up always defining it, even when
+_PAGE_SPECIAL is not supported (in which case it's 0) such as on
+8xx or 40x processors.
+
+Signed-off-by: Bernhard Weirich <bernhard.weirich@riedel.net>
+Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+
+---
+ arch/powerpc/include/asm/pte-common.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/powerpc/include/asm/pte-common.h
++++ b/arch/powerpc/include/asm/pte-common.h
+@@ -176,7 +176,7 @@ extern unsigned long bad_call_to_PMD_PAG
+ #define HAVE_PAGE_AGP
+
+ /* Advertise support for _PAGE_SPECIAL */
+-#ifdef _PAGE_SPECIAL
++#if _PAGE_SPECIAL != 0
+ #define __HAVE_ARCH_PTE_SPECIAL
+ #endif
+
+
+
+From gregkh@mini.kroah.org Thu Oct 1 16:33:23 2009
+Message-Id: <20091001233322.964817376@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 01 Oct 2009 16:31:44 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ torvalds@linux-foundation.org
+Cc: stable-review@kernel.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ nick@craig-wood.com,
+ kbowa@tuxedu.org,
+ penberg@cs.helsinki.fi,
+ kamezawa.hiroyu@jp.fujitsu.com
+Subject: [patch 28/30] /proc/kcore: work around a BUG()
+References: <20091001233116.947658905@mini.kroah.org>
+Content-Disposition: inline; filename=proc-kcore-work-around-a-bug.patch
+Content-Length: 3295
+Lines: 78
+
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
+
+Not upstream due to other fixes in .32
+
+
+Works around a BUG() which is triggered when the kernel accesses holes in
+vmalloc regions.
+
+BUG: unable to handle kernel paging request at fa54c000
+IP: [<c04f687a>] read_kcore+0x260/0x31a
+*pde = 3540b067 *pte = 00000000
+Oops: 0000 [#1] SMP
+last sysfs file: /sys/devices/pci0000:00/0000:00:1c.2/0000:03:00.0/ieee80211/phy0/rfkill0/state
+Modules linked in: fuse sco bridge stp llc bnep l2cap bluetooth sunrpc nf_conntrack_ftp ip6t_REJECT nf_conntrack_ipv6 ip6table_filter ip6_tables ipv6 cpufreq_ondemand acpi_cpufreq dm_multipath uinput usb_storage arc4 ecb snd_hda_codec_realtek snd_hda_intel ath5k snd_hda_codec snd_hwdep iTCO_wdt snd_pcm iTCO_vendor_support pcspkr i2c_i801 mac80211 joydev snd_timer serio_raw r8169 snd soundcore mii snd_page_alloc ath cfg80211 ata_generic i915 drm i2c_algo_bit i2c_core video output [last unloaded: scsi_wait_scan]
+Sep 4 12:45:16 tuxedu kernel: Pid: 2266, comm: cat Not tainted (2.6.31-rc8 #2) Joybook Lite U101
+EIP: 0060:[<c04f687a>] EFLAGS: 00010286 CPU: 0
+EIP is at read_kcore+0x260/0x31a
+EAX: f5e5ea00 EBX: fa54d000 ECX: 00000400 EDX: 00001000
+ESI: fa54c000 EDI: f44ad000 EBP: e4533f4c ESP: e4533f24
+DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068
+Process cat (pid: 2266, ti=e4532000 task=f09d19a0 task.ti=e4532000)
+Stack:
+00005000 00000000 f44ad000 09d9c000 00003000 fa54c000 00001000 f6d16f60
+ e4520b80 fffffffb e4533f70 c04ef8eb e4533f98 00008000 09d97000 c04f661a
+ e4520b80 09d97000 c04ef88c e4533f8c c04ba531 e4533f98 c04c0930 e4520b80
+Call Trace:
+[<c04ef8eb>] ? proc_reg_read+0x5f/0x73
+[<c04f661a>] ? read_kcore+0x0/0x31a
+[<c04ef88c>] ? proc_reg_read+0x0/0x73
+[<c04ba531>] ? vfs_read+0x82/0xe1
+[<c04c0930>] ? path_put+0x1a/0x1d
+[<c04ba62e>] ? sys_read+0x40/0x62
+[<c0403298>] ? sysenter_do_call+0x12/0x2d
+Code: 39 f3 89 ca 0f 43 f3 89 fb 29 f2 29 f3 39 cf 0f 46 d3 29 55 dc 8d 1c 32 f6 40 0c 01 75 18 89 d1 89 f7 c1 e9 02 2b 7d ec 03 7d e0 <f3> a5 89 d1 83 e1 03 74 02 f3 a4 8b 00 83 7d dc 00 74 04 85 c0
+EIP: [<c04f687a>] read_kcore+0x260/0x31a SS:ESP 0068:e4533f24
+CR2: 00000000fa54c000
+
+
+To access vmalloc area which may have memory holes, copy_from_user is
+useful. So this:
+
+ # cat /proc/kcore > /dev/null
+
+will not panic.
+
+This is a minimal fix, suitable for 2.6.30.x and 2.6.31. More extensive
+/proc/kcore changes are planned for 2.6.32.
+
+Signed-off-by: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
+Tested-by: Nick Craig-Wood <nick@craig-wood.com>
+Cc: Pekka Enberg <penberg@cs.helsinki.fi>
+Reported-by: <kbowa@tuxedu.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/proc/kcore.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+--- a/fs/proc/kcore.c
++++ b/fs/proc/kcore.c
+@@ -361,7 +361,13 @@ read_kcore(struct file *file, char __use
+ /* don't dump ioremap'd stuff! (TA) */
+ if (m->flags & VM_IOREMAP)
+ continue;
+- memcpy(elf_buf + (vmstart - start),
++ /*
++ * we may access memory holes, then use
++ * ex_table. checking return value just for
++ * avoid warnings.
++ */
++ vmsize = __copy_from_user_inatomic(
++ elf_buf + (vmstart - start),
+ (char *)vmstart, vmsize);
+ }
+ read_unlock(&vmlist_lock);
+
+
+From gregkh@mini.kroah.org Thu Oct 1 16:33:23 2009
+Message-Id: <20091001233323.116532896@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 01 Oct 2009 16:31:45 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ "Rafael J. Wysocki" <rjw@sisk.pl>
+Subject: [patch 29/30] PM / PCMCIA: Drop second argument of pcmcia_socket_dev_suspend()
+References: <20091001233116.947658905@mini.kroah.org>
+Content-Disposition: inline; filename=pm-pcmcia-drop-second-argument-of-pcmcia_socket_dev_suspend.patch
+Content-Length: 8297
+Lines: 232
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Rafael J. Wysocki <rjw@sisk.pl>
+
+commit 827b4649d4626bf97b203b4bcd69476bb9b4e760 upstream.
+
+pcmcia_socket_dev_suspend() doesn't use its second argument, so it
+may be dropped safely.
+
+This change is necessary for the subsequent yenta suspend/resume fix.
+
+Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/pcmcia/at91_cf.c | 2 +-
+ drivers/pcmcia/au1000_generic.c | 2 +-
+ drivers/pcmcia/bfin_cf_pcmcia.c | 2 +-
+ drivers/pcmcia/cs.c | 2 +-
+ drivers/pcmcia/i82092.c | 2 +-
+ drivers/pcmcia/i82365.c | 2 +-
+ drivers/pcmcia/m32r_cfc.c | 2 +-
+ drivers/pcmcia/m32r_pcc.c | 2 +-
+ drivers/pcmcia/m8xx_pcmcia.c | 2 +-
+ drivers/pcmcia/omap_cf.c | 2 +-
+ drivers/pcmcia/pd6729.c | 2 +-
+ drivers/pcmcia/pxa2xx_base.c | 2 +-
+ drivers/pcmcia/sa1100_generic.c | 2 +-
+ drivers/pcmcia/sa1111_generic.c | 2 +-
+ drivers/pcmcia/tcic.c | 2 +-
+ drivers/pcmcia/vrc4171_card.c | 2 +-
+ drivers/pcmcia/yenta_socket.c | 2 +-
+ include/pcmcia/ss.h | 2 +-
+ 18 files changed, 18 insertions(+), 18 deletions(-)
+
+--- a/drivers/pcmcia/at91_cf.c
++++ b/drivers/pcmcia/at91_cf.c
+@@ -363,7 +363,7 @@ static int at91_cf_suspend(struct platfo
+ struct at91_cf_socket *cf = platform_get_drvdata(pdev);
+ struct at91_cf_data *board = cf->board;
+
+- pcmcia_socket_dev_suspend(&pdev->dev, mesg);
++ pcmcia_socket_dev_suspend(&pdev->dev);
+ if (device_may_wakeup(&pdev->dev)) {
+ enable_irq_wake(board->det_pin);
+ if (board->irq_pin)
+--- a/drivers/pcmcia/au1000_generic.c
++++ b/drivers/pcmcia/au1000_generic.c
+@@ -515,7 +515,7 @@ static int au1x00_drv_pcmcia_probe(struc
+ static int au1x00_drv_pcmcia_suspend(struct platform_device *dev,
+ pm_message_t state)
+ {
+- return pcmcia_socket_dev_suspend(&dev->dev, state);
++ return pcmcia_socket_dev_suspend(&dev->dev);
+ }
+
+ static int au1x00_drv_pcmcia_resume(struct platform_device *dev)
+--- a/drivers/pcmcia/bfin_cf_pcmcia.c
++++ b/drivers/pcmcia/bfin_cf_pcmcia.c
+@@ -302,7 +302,7 @@ static int __devexit bfin_cf_remove(stru
+
+ static int bfin_cf_suspend(struct platform_device *pdev, pm_message_t mesg)
+ {
+- return pcmcia_socket_dev_suspend(&pdev->dev, mesg);
++ return pcmcia_socket_dev_suspend(&pdev->dev);
+ }
+
+ static int bfin_cf_resume(struct platform_device *pdev)
+--- a/drivers/pcmcia/cs.c
++++ b/drivers/pcmcia/cs.c
+@@ -101,7 +101,7 @@ EXPORT_SYMBOL(pcmcia_socket_list_rwsem);
+ static int socket_resume(struct pcmcia_socket *skt);
+ static int socket_suspend(struct pcmcia_socket *skt);
+
+-int pcmcia_socket_dev_suspend(struct device *dev, pm_message_t state)
++int pcmcia_socket_dev_suspend(struct device *dev)
+ {
+ struct pcmcia_socket *socket;
+
+--- a/drivers/pcmcia/i82092.c
++++ b/drivers/pcmcia/i82092.c
+@@ -42,7 +42,7 @@ MODULE_DEVICE_TABLE(pci, i82092aa_pci_id
+ #ifdef CONFIG_PM
+ static int i82092aa_socket_suspend (struct pci_dev *dev, pm_message_t state)
+ {
+- return pcmcia_socket_dev_suspend(&dev->dev, state);
++ return pcmcia_socket_dev_suspend(&dev->dev);
+ }
+
+ static int i82092aa_socket_resume (struct pci_dev *dev)
+--- a/drivers/pcmcia/i82365.c
++++ b/drivers/pcmcia/i82365.c
+@@ -1241,7 +1241,7 @@ static int pcic_init(struct pcmcia_socke
+ static int i82365_drv_pcmcia_suspend(struct platform_device *dev,
+ pm_message_t state)
+ {
+- return pcmcia_socket_dev_suspend(&dev->dev, state);
++ return pcmcia_socket_dev_suspend(&dev->dev);
+ }
+
+ static int i82365_drv_pcmcia_resume(struct platform_device *dev)
+--- a/drivers/pcmcia/m32r_cfc.c
++++ b/drivers/pcmcia/m32r_cfc.c
+@@ -699,7 +699,7 @@ static struct pccard_operations pcc_oper
+ static int cfc_drv_pcmcia_suspend(struct platform_device *dev,
+ pm_message_t state)
+ {
+- return pcmcia_socket_dev_suspend(&dev->dev, state);
++ return pcmcia_socket_dev_suspend(&dev->dev);
+ }
+
+ static int cfc_drv_pcmcia_resume(struct platform_device *dev)
+--- a/drivers/pcmcia/m32r_pcc.c
++++ b/drivers/pcmcia/m32r_pcc.c
+@@ -675,7 +675,7 @@ static struct pccard_operations pcc_oper
+ static int pcc_drv_pcmcia_suspend(struct platform_device *dev,
+ pm_message_t state)
+ {
+- return pcmcia_socket_dev_suspend(&dev->dev, state);
++ return pcmcia_socket_dev_suspend(&dev->dev);
+ }
+
+ static int pcc_drv_pcmcia_resume(struct platform_device *dev)
+--- a/drivers/pcmcia/m8xx_pcmcia.c
++++ b/drivers/pcmcia/m8xx_pcmcia.c
+@@ -1296,7 +1296,7 @@ static int m8xx_remove(struct of_device
+ #ifdef CONFIG_PM
+ static int m8xx_suspend(struct platform_device *pdev, pm_message_t state)
+ {
+- return pcmcia_socket_dev_suspend(&pdev->dev, state);
++ return pcmcia_socket_dev_suspend(&pdev->dev);
+ }
+
+ static int m8xx_resume(struct platform_device *pdev)
+--- a/drivers/pcmcia/omap_cf.c
++++ b/drivers/pcmcia/omap_cf.c
+@@ -334,7 +334,7 @@ static int __exit omap_cf_remove(struct
+
+ static int omap_cf_suspend(struct platform_device *pdev, pm_message_t mesg)
+ {
+- return pcmcia_socket_dev_suspend(&pdev->dev, mesg);
++ return pcmcia_socket_dev_suspend(&pdev->dev);
+ }
+
+ static int omap_cf_resume(struct platform_device *pdev)
+--- a/drivers/pcmcia/pd6729.c
++++ b/drivers/pcmcia/pd6729.c
+@@ -758,7 +758,7 @@ static void __devexit pd6729_pci_remove(
+ #ifdef CONFIG_PM
+ static int pd6729_socket_suspend(struct pci_dev *dev, pm_message_t state)
+ {
+- return pcmcia_socket_dev_suspend(&dev->dev, state);
++ return pcmcia_socket_dev_suspend(&dev->dev);
+ }
+
+ static int pd6729_socket_resume(struct pci_dev *dev)
+--- a/drivers/pcmcia/pxa2xx_base.c
++++ b/drivers/pcmcia/pxa2xx_base.c
+@@ -302,7 +302,7 @@ static int pxa2xx_drv_pcmcia_remove(stru
+
+ static int pxa2xx_drv_pcmcia_suspend(struct platform_device *dev, pm_message_t state)
+ {
+- return pcmcia_socket_dev_suspend(&dev->dev, state);
++ return pcmcia_socket_dev_suspend(&dev->dev);
+ }
+
+ static int pxa2xx_drv_pcmcia_resume(struct platform_device *dev)
+--- a/drivers/pcmcia/sa1100_generic.c
++++ b/drivers/pcmcia/sa1100_generic.c
+@@ -89,7 +89,7 @@ static int sa11x0_drv_pcmcia_remove(stru
+ static int sa11x0_drv_pcmcia_suspend(struct platform_device *dev,
+ pm_message_t state)
+ {
+- return pcmcia_socket_dev_suspend(&dev->dev, state);
++ return pcmcia_socket_dev_suspend(&dev->dev);
+ }
+
+ static int sa11x0_drv_pcmcia_resume(struct platform_device *dev)
+--- a/drivers/pcmcia/sa1111_generic.c
++++ b/drivers/pcmcia/sa1111_generic.c
+@@ -159,7 +159,7 @@ static int __devexit pcmcia_remove(struc
+
+ static int pcmcia_suspend(struct sa1111_dev *dev, pm_message_t state)
+ {
+- return pcmcia_socket_dev_suspend(&dev->dev, state);
++ return pcmcia_socket_dev_suspend(&dev->dev);
+ }
+
+ static int pcmcia_resume(struct sa1111_dev *dev)
+--- a/drivers/pcmcia/tcic.c
++++ b/drivers/pcmcia/tcic.c
+@@ -366,7 +366,7 @@ static int __init get_tcic_id(void)
+ static int tcic_drv_pcmcia_suspend(struct platform_device *dev,
+ pm_message_t state)
+ {
+- return pcmcia_socket_dev_suspend(&dev->dev, state);
++ return pcmcia_socket_dev_suspend(&dev->dev);
+ }
+
+ static int tcic_drv_pcmcia_resume(struct platform_device *dev)
+--- a/drivers/pcmcia/vrc4171_card.c
++++ b/drivers/pcmcia/vrc4171_card.c
+@@ -707,7 +707,7 @@ __setup("vrc4171_card=", vrc4171_card_se
+ static int vrc4171_card_suspend(struct platform_device *dev,
+ pm_message_t state)
+ {
+- return pcmcia_socket_dev_suspend(&dev->dev, state);
++ return pcmcia_socket_dev_suspend(&dev->dev);
+ }
+
+ static int vrc4171_card_resume(struct platform_device *dev)
+--- a/drivers/pcmcia/yenta_socket.c
++++ b/drivers/pcmcia/yenta_socket.c
+@@ -1230,7 +1230,7 @@ static int yenta_dev_suspend (struct pci
+ struct yenta_socket *socket = pci_get_drvdata(dev);
+ int ret;
+
+- ret = pcmcia_socket_dev_suspend(&dev->dev, state);
++ ret = pcmcia_socket_dev_suspend(&dev->dev);
+
+ if (socket) {
+ if (socket->type && socket->type->save_state)
+--- a/include/pcmcia/ss.h
++++ b/include/pcmcia/ss.h
+@@ -279,7 +279,7 @@ extern struct pccard_resource_ops pccard
+ extern struct pccard_resource_ops pccard_nonstatic_ops;
+
+ /* socket drivers are expected to use these callbacks in their .drv struct */
+-extern int pcmcia_socket_dev_suspend(struct device *dev, pm_message_t state);
++extern int pcmcia_socket_dev_suspend(struct device *dev);
+ extern int pcmcia_socket_dev_resume(struct device *dev);
+
+ /* socket drivers use this callback in their IRQ handler */
+
+
+From gregkh@mini.kroah.org Thu Oct 1 16:33:23 2009
+Message-Id: <20091001233323.256648044@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 01 Oct 2009 16:31:46 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ "Rafael J. Wysocki" <rjw@sisk.pl>
+Subject: [patch 30/30] PM / yenta: Fix cardbus suspend/resume regression
+References: <20091001233116.947658905@mini.kroah.org>
+Content-Disposition: inline; filename=pm-yenta-fix-cardbus-suspend-resume-regression.patch
+Content-Length: 4773
+Lines: 154
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Rafael J. Wysocki <rjw@sisk.pl>
+
+commit 0c570cdeb8fdfcb354a3e9cd81bfc6a09c19de0c upstream.
+
+Since 2.6.29 the PCI PM core have been restoring the standard
+configuration registers of PCI devices in the early phase of
+resume. In particular, PCI devices without drivers have been handled
+this way since commit 355a72d75b3b4f4877db4c9070c798238028ecb5
+(PCI: Rework default handling of suspend and resume). Unfortunately,
+this leads to post-resume problems with CardBus devices which cannot
+be accessed in the early phase of resume, because the sockets they
+are on have not been woken up yet at that point.
+
+To solve this problem, move the yenta socket resume to the early
+phase of resume and, analogously, move the suspend of it to the late
+phase of suspend. Additionally, remove some unnecessary PCI code
+from the yenta socket's resume routine.
+
+Fixes http://bugzilla.kernel.org/show_bug.cgi?id=13092, which is a
+post-2.6.28 regression.
+
+Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>
+Reported-by: Florian <fs-kernelbugzilla@spline.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/pcmcia/yenta_socket.c | 92 ++++++++++++++++++++++--------------------
+ 1 file changed, 50 insertions(+), 42 deletions(-)
+
+--- a/drivers/pcmcia/yenta_socket.c
++++ b/drivers/pcmcia/yenta_socket.c
+@@ -1225,60 +1225,71 @@ static int __devinit yenta_probe (struct
+ }
+
+ #ifdef CONFIG_PM
+-static int yenta_dev_suspend (struct pci_dev *dev, pm_message_t state)
++static int yenta_dev_suspend_noirq(struct device *dev)
+ {
+- struct yenta_socket *socket = pci_get_drvdata(dev);
++ struct pci_dev *pdev = to_pci_dev(dev);
++ struct yenta_socket *socket = pci_get_drvdata(pdev);
+ int ret;
+
+- ret = pcmcia_socket_dev_suspend(&dev->dev);
++ ret = pcmcia_socket_dev_suspend(dev);
+
+- if (socket) {
+- if (socket->type && socket->type->save_state)
+- socket->type->save_state(socket);
+-
+- /* FIXME: pci_save_state needs to have a better interface */
+- pci_save_state(dev);
+- pci_read_config_dword(dev, 16*4, &socket->saved_state[0]);
+- pci_read_config_dword(dev, 17*4, &socket->saved_state[1]);
+- pci_disable_device(dev);
+-
+- /*
+- * Some laptops (IBM T22) do not like us putting the Cardbus
+- * bridge into D3. At a guess, some other laptop will
+- * probably require this, so leave it commented out for now.
+- */
+- /* pci_set_power_state(dev, 3); */
+- }
++ if (!socket)
++ return ret;
++
++ if (socket->type && socket->type->save_state)
++ socket->type->save_state(socket);
++
++ pci_save_state(pdev);
++ pci_read_config_dword(pdev, 16*4, &socket->saved_state[0]);
++ pci_read_config_dword(pdev, 17*4, &socket->saved_state[1]);
++ pci_disable_device(pdev);
++
++ /*
++ * Some laptops (IBM T22) do not like us putting the Cardbus
++ * bridge into D3. At a guess, some other laptop will
++ * probably require this, so leave it commented out for now.
++ */
++ /* pci_set_power_state(dev, 3); */
+
+ return ret;
+ }
+
+-
+-static int yenta_dev_resume (struct pci_dev *dev)
++static int yenta_dev_resume_noirq(struct device *dev)
+ {
+- struct yenta_socket *socket = pci_get_drvdata(dev);
++ struct pci_dev *pdev = to_pci_dev(dev);
++ struct yenta_socket *socket = pci_get_drvdata(pdev);
++ int ret;
+
+- if (socket) {
+- int rc;
++ if (!socket)
++ return 0;
+
+- pci_set_power_state(dev, 0);
+- /* FIXME: pci_restore_state needs to have a better interface */
+- pci_restore_state(dev);
+- pci_write_config_dword(dev, 16*4, socket->saved_state[0]);
+- pci_write_config_dword(dev, 17*4, socket->saved_state[1]);
++ pci_write_config_dword(pdev, 16*4, socket->saved_state[0]);
++ pci_write_config_dword(pdev, 17*4, socket->saved_state[1]);
+
+- rc = pci_enable_device(dev);
+- if (rc)
+- return rc;
++ ret = pci_enable_device(pdev);
++ if (ret)
++ return ret;
+
+- pci_set_master(dev);
++ pci_set_master(pdev);
+
+- if (socket->type && socket->type->restore_state)
+- socket->type->restore_state(socket);
+- }
++ if (socket->type && socket->type->restore_state)
++ socket->type->restore_state(socket);
+
+- return pcmcia_socket_dev_resume(&dev->dev);
++ return pcmcia_socket_dev_resume(dev);
+ }
++
++static struct dev_pm_ops yenta_pm_ops = {
++ .suspend_noirq = yenta_dev_suspend_noirq,
++ .resume_noirq = yenta_dev_resume_noirq,
++ .freeze_noirq = yenta_dev_suspend_noirq,
++ .thaw_noirq = yenta_dev_resume_noirq,
++ .poweroff_noirq = yenta_dev_suspend_noirq,
++ .restore_noirq = yenta_dev_resume_noirq,
++};
++
++#define YENTA_PM_OPS (¥ta_pm_ops)
++#else
++#define YENTA_PM_OPS NULL
+ #endif
+
+ #define CB_ID(vend,dev,type) \
+@@ -1376,10 +1387,7 @@ static struct pci_driver yenta_cardbus_d
+ .id_table = yenta_table,
+ .probe = yenta_probe,
+ .remove = __devexit_p(yenta_close),
+-#ifdef CONFIG_PM
+- .suspend = yenta_dev_suspend,
+- .resume = yenta_dev_resume,
+-#endif
++ .driver.pm = YENTA_PM_OPS,
+ };
+
+
+
+
+From gregkh@mini.kroah.org Thu Oct 1 16:33:18 2009
+Message-Id: <20091001233116.947658905@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 01 Oct 2009 16:31:16 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk
+Subject: [patch 00/30] 2.6.30.9-stable review
+Content-Length: 3469
+Lines: 73
+
+NOTE: This is going to be the last .30 kernel release unless something
+odd happens. Everyone should move to the .31 kernel release soon.
+
+This is the start of the stable review cycle for the 2.6.30.9 release.
+There are 30 patches in this series, all will be posted as a response to
+this one. If anyone has any issues with these being applied, please let
+us know. If anyone is a maintainer of the proper subsystem, and wants
+to add a Signed-off-by: line to the patch, please respond with it.
+
+These patches are sent out with a number of different people on the Cc:
+line. If you wish to be a reviewer, please email stable@kernel.org to
+add your name to the list. If you want to be off the reviewer list,
+also email us.
+
+Responses should be made by Saturday, October 3, 2009 23:00:00 UTC.
+Anything received after that time might be too late.
+
+The whole patch series can be found in one patch at:
+ kernel.org/pub/linux/kernel/v2.6/stable-review/patch-2.6.30.9-rc1.gz
+and the diffstat can be found below.
+
+
+thanks,
+
+greg k-h
+
+------
+
+ Makefile | 2 +-
+ arch/powerpc/include/asm/pte-common.h | 2 +-
+ arch/powerpc/mm/pgtable.c | 19 +++++-
+ arch/x86/include/asm/kvm_host.h | 1 +
+ arch/x86/kernel/cpu/cpufreq/powernow-k8.c | 15 +++--
+ arch/x86/kernel/kvmclock.c | 4 +-
+ arch/x86/kvm/lapic.c | 9 +++
+ arch/x86/kvm/mmu.c | 9 +--
+ arch/x86/kvm/vmx.c | 11 ++--
+ arch/x86/kvm/x86.c | 31 ++++++++--
+ drivers/acpi/pci_slot.c | 4 +-
+ drivers/ata/ahci.c | 4 +-
+ drivers/net/wireless/p54/p54usb.c | 1 +
+ drivers/pcmcia/at91_cf.c | 2 +-
+ drivers/pcmcia/au1000_generic.c | 2 +-
+ drivers/pcmcia/bfin_cf_pcmcia.c | 2 +-
+ drivers/pcmcia/cs.c | 2 +-
+ drivers/pcmcia/i82092.c | 2 +-
+ drivers/pcmcia/i82365.c | 2 +-
+ drivers/pcmcia/m32r_cfc.c | 2 +-
+ drivers/pcmcia/m32r_pcc.c | 2 +-
+ drivers/pcmcia/m8xx_pcmcia.c | 2 +-
+ drivers/pcmcia/omap_cf.c | 2 +-
+ drivers/pcmcia/pd6729.c | 2 +-
+ drivers/pcmcia/pxa2xx_base.c | 2 +-
+ drivers/pcmcia/sa1100_generic.c | 2 +-
+ drivers/pcmcia/sa1111_generic.c | 2 +-
+ drivers/pcmcia/tcic.c | 2 +-
+ drivers/pcmcia/vrc4171_card.c | 2 +-
+ drivers/pcmcia/yenta_socket.c | 88 ++++++++++++++++-------------
+ fs/cifs/cifsglob.h | 4 +-
+ fs/inode.c | 14 +++--
+ fs/nilfs2/btnode.c | 1 +
+ fs/proc/kcore.c | 8 ++-
+ fs/proc/uptime.c | 7 ++-
+ include/linux/kvm_para.h | 1 +
+ include/pcmcia/ss.h | 2 +-
+ mm/hugetlb.c | 2 +-
+ net/ax25/af_ax25.c | 2 +-
+ net/bridge/br_netfilter.c | 2 +-
+ net/bridge/netfilter/ebt_ulog.c | 2 +-
+ net/ipv4/netfilter/nf_nat_core.c | 2 +-
+ net/packet/af_packet.c | 4 +-
+ scripts/kallsyms.c | 2 +-
+ 44 files changed, 172 insertions(+), 113 deletions(-)
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
