--- /dev/null
+From 8c185ab6185bf5e67766edb000ce428269364c86 Mon Sep 17 00:00:00 2001
+From: Jarek Poplawski <jarkao2@gmail.com>
+Date: Sun, 27 Sep 2009 10:57:02 +0000
+Subject: ax25: Fix possible oops in ax25_make_new
+
+From: Jarek Poplawski <jarkao2@gmail.com>
+
+commit 8c185ab6185bf5e67766edb000ce428269364c86 upstream.
+
+In ax25_make_new, if kmemdup of digipeat returns an error, there would
+be an oops in sk_free while calling sk_destruct, because sk_protinfo
+is NULL at the moment; move sk->sk_destruct initialization after this.
+
+BTW of reported-by: Bernard Pidoux F6BVP <f6bvp@free.fr>
+
+Signed-off-by: Jarek Poplawski <jarkao2@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/ax25/af_ax25.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/ax25/af_ax25.c
++++ b/net/ax25/af_ax25.c
+@@ -894,7 +894,6 @@ struct sock *ax25_make_new(struct sock *
+
+ sock_init_data(NULL, sk);
+
+- sk->sk_destruct = ax25_free_sock;
+ sk->sk_type = osk->sk_type;
+ sk->sk_priority = osk->sk_priority;
+ sk->sk_protocol = osk->sk_protocol;
+@@ -932,6 +931,7 @@ struct sock *ax25_make_new(struct sock *
+ }
+
+ sk->sk_protinfo = ax25;
++ sk->sk_destruct = ax25_free_sock;
+ ax25->sk = sk;
+
+ return sk;
--- /dev/null
+From 730c586ad5228c339949b2eb4e72b80ae167abc4 Mon Sep 17 00:00:00 2001
+From: Salman Qazi <sqazi@google.com>
+Date: Thu, 4 Jun 2009 15:20:39 -0700
+Subject: drivers/char/mem.c: avoid OOM lockup during large reads from /dev/zero
+
+From: Salman Qazi <sqazi@google.com>
+
+commit 730c586ad5228c339949b2eb4e72b80ae167abc4 upstream.
+
+While running 20 parallel instances of dd as follows:
+
+ #!/bin/bash
+ for i in `seq 1 20`; do
+ dd if=/dev/zero of=/export/hda3/dd_$i bs=1073741824 count=1 &
+ done
+ wait
+
+on a 16G machine, we noticed that rather than just killing the processes,
+the entire kernel went down. Stracing dd reveals that it first does an
+mmap2, which makes 1GB worth of zero page mappings. Then it performs a
+read on those pages from /dev/zero, and finally it performs a write.
+
+The machine died during the reads. Looking at the code, it was noticed
+that /dev/zero's read operation had been changed by
+557ed1fa2620dc119adb86b34c614e152a629a80 ("remove ZERO_PAGE") from giving
+zero page mappings to actually zeroing the page.
+
+The zeroing of the pages causes physical pages to be allocated to the
+process. But, when the process exhausts all the memory that it can, the
+kernel cannot kill it, as it is still in the kernel mode allocating more
+memory. Consequently, the kernel eventually crashes.
+
+To fix this, I propose that when a fatal signal is pending during
+/dev/zero read operation, we simply return and let the user process die.
+
+Signed-off-by: Salman Qazi <sqazi@google.com>
+Cc: Nick Piggin <nickpiggin@yahoo.com.au>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+[ Modified error return and comment trivially. - Linus]
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/char/mem.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/char/mem.c
++++ b/drivers/char/mem.c
+@@ -724,6 +724,9 @@ static ssize_t read_zero(struct file * f
+ written += chunk - unwritten;
+ if (unwritten)
+ break;
++ /* Consider changing this to just 'signal_pending()' with lots of testing */
++ if (fatal_signal_pending(current))
++ return written ? written : -EINTR;
+ buf += chunk;
+ count -= chunk;
+ cond_resched();
--- /dev/null
+From stern@rowland.harvard.edu Fri Feb 12 15:37:33 2010
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Mon, 8 Feb 2010 09:43:22 -0500 (EST)
+Subject: EHCI: fix bug in keeping track of resuming ports
+To: Greg KH <greg@kroah.com>
+Cc: Corey Wright <undefined@pobox.com>, stable@kernel.org
+Message-ID: <Pine.LNX.4.44L0.1002080940430.1809-100000@iolanthe.rowland.org>
+
+
+This patch fixes a bug caused by backporting commit
+cec3a53c7fe794237b582e8e77fc0e48465e65ee (USB: EHCI & UHCI: fix race
+between root-hub suspend and port resume) to 2.6.27.stable without
+also backporting commit eafe5b99f2135488b21cf17a262c54997c44f784 (USB:
+EHCI: fix remote-wakeup support for ARC/TDI core). This extracts the
+necessary changes from the earlier patch and backports them.
+
+The symptom of the bug is that the system will fail to suspend more
+than once. The problem is caused by setting ehci->reset_done[i] but
+never clearing it. When ehci_bus_suspend() sees a nonzero value
+there, it assumes this means the port is in the middle of resuming so
+it aborts the bus suspend.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Cc: Corey Wright <undefined@pobox.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/host/ehci-hub.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/drivers/usb/host/ehci-hub.c
++++ b/drivers/usb/host/ehci-hub.c
+@@ -254,10 +254,8 @@ static int ehci_bus_resume (struct usb_h
+ temp = ehci_readl(ehci, &ehci->regs->port_status [i]);
+ temp &= ~(PORT_RWC_BITS | PORT_WAKE_BITS);
+ if (test_bit(i, &ehci->bus_suspended) &&
+- (temp & PORT_SUSPEND)) {
+- ehci->reset_done [i] = jiffies + msecs_to_jiffies (20);
++ (temp & PORT_SUSPEND))
+ temp |= PORT_RESUME;
+- }
+ ehci_writel(ehci, temp, &ehci->regs->port_status [i]);
+ }
+ i = HCS_N_PORTS (ehci->hcs_params);
+@@ -752,6 +750,9 @@ static int ehci_hub_control (
+ ehci_readl(ehci, status_reg));
+ }
+
++ if (!(temp & (PORT_RESUME|PORT_RESET)))
++ ehci->reset_done[wIndex] = 0;
++
+ /* transfer dedicated ports to the companion hc */
+ if ((temp & PORT_CONNECT) &&
+ test_bit(wIndex, &ehci->companion_ports)) {
--- /dev/null
+From khali@linux-fr.org Fri Feb 12 15:36:16 2010
+From: Jean Delvare <khali@linux-fr.org>
+Date: Tue, 9 Feb 2010 18:33:29 +0100
+Subject: hwmon: (lm78) Fix I/O resource conflict with PNP
+To: stable@kernel.org
+Message-ID: <20100209183329.15bb4ab2@hyperion.delvare>
+
+From: Jean Delvare <khali@linux-fr.org>
+
+This fix is the combination of the following two upstream patches:
+http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=197027e6ef830d60e10f76efc8d12bf3b6c35db5
+http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=47c15532ddcd6818f51cb15f914d63864b3ee9ab
+
+Only request I/O ports 0x295-0x296 instead of the full I/O address
+range. This solves a conflict with PNP resources on a few motherboards.
+
+Also request the I/O ports individually during device detection,
+otherwise the PNP resource may cause the request (and thus the
+detection) fail.
+
+Signed-off-by: Jean Delvare <khali@linux-fr.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/hwmon/lm78.c | 21 +++++++++++++++------
+ 1 file changed, 15 insertions(+), 6 deletions(-)
+
+--- a/drivers/hwmon/lm78.c
++++ b/drivers/hwmon/lm78.c
+@@ -655,7 +655,7 @@ static int __devinit lm78_isa_probe(stru
+
+ /* Reserve the ISA region */
+ res = platform_get_resource(pdev, IORESOURCE_IO, 0);
+- if (!request_region(res->start, LM78_EXTENT, "lm78")) {
++ if (!request_region(res->start + LM78_ADDR_REG_OFFSET, 2, "lm78")) {
+ err = -EBUSY;
+ goto exit;
+ }
+@@ -699,7 +699,7 @@ static int __devinit lm78_isa_probe(stru
+ device_remove_file(&pdev->dev, &dev_attr_name);
+ kfree(data);
+ exit_release_region:
+- release_region(res->start, LM78_EXTENT);
++ release_region(res->start + LM78_ADDR_REG_OFFSET, 2);
+ exit:
+ return err;
+ }
+@@ -711,7 +711,7 @@ static int __devexit lm78_isa_remove(str
+ hwmon_device_unregister(data->hwmon_dev);
+ sysfs_remove_group(&pdev->dev.kobj, &lm78_group);
+ device_remove_file(&pdev->dev, &dev_attr_name);
+- release_region(data->client.addr, LM78_EXTENT);
++ release_region(data->client.addr + LM78_ADDR_REG_OFFSET, 2);
+ kfree(data);
+
+ return 0;
+@@ -836,9 +836,17 @@ static struct lm78_data *lm78_update_dev
+ static int __init lm78_isa_found(unsigned short address)
+ {
+ int val, save, found = 0;
++ int port;
+
+- if (!request_region(address, LM78_EXTENT, "lm78"))
+- return 0;
++ /* Some boards declare base+0 to base+7 as a PNP device, some base+4
++ * to base+7 and some base+5 to base+6. So we better request each port
++ * individually for the probing phase. */
++ for (port = address; port < address + LM78_EXTENT; port++) {
++ if (!request_region(port, 1, "lm78")) {
++ pr_debug("lm78: Failed to request port 0x%x\n", port);
++ goto release;
++ }
++ }
+
+ #define REALLY_SLOW_IO
+ /* We need the timeouts for at least some LM78-like
+@@ -901,7 +909,8 @@ static int __init lm78_isa_found(unsigne
+ val & 0x80 ? "LM79" : "LM78", (int)address);
+
+ release:
+- release_region(address, LM78_EXTENT);
++ for (port--; port >= address; port--)
++ release_region(port, 1);
+ return found;
+ }
+
--- /dev/null
+From khali@linux-fr.org Fri Feb 12 15:44:41 2010
+From: Thadeu Lima de Souza Cascardo <cascardo@holoscopio.com>
+Date: Sun, 17 Jan 2010 19:05:58 +0100
+Subject: i2c: Do not use device name after device_unregister
+To: stable@kernel.org
+Message-ID: <20100117190558.0ff03c18@hyperion.delvare>
+
+
+From: Thadeu Lima de Souza Cascardo <cascardo@holoscopio.com>
+
+In Linus' tree:
+http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=c556752109794a5ff199b80a1673336b4df8433a
+
+dev_dbg outputs dev_name, which is released with device_unregister. This bug
+resulted in output like this:
+
+i2c Xy2�0: adapter [SMBus I801 adapter at 1880] unregistered
+
+The right output would be:
+i2c i2c-0: adapter [SMBus I801 adapter at 1880] unregistered
+
+Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@holoscopio.com>
+Signed-off-by: Jean Delvare <khali@linux-fr.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/i2c/i2c-core.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/i2c/i2c-core.c
++++ b/drivers/i2c/i2c-core.c
+@@ -644,6 +644,9 @@ int i2c_del_adapter(struct i2c_adapter *
+ }
+ }
+
++ /* device name is gone after device_unregister */
++ dev_dbg(&adap->dev, "adapter [%s] unregistered\n", adap->name);
++
+ /* clean up the sysfs representation */
+ init_completion(&adap->dev_released);
+ device_unregister(&adap->dev);
+@@ -654,8 +657,6 @@ int i2c_del_adapter(struct i2c_adapter *
+ /* free bus id */
+ idr_remove(&i2c_adapter_idr, adap->nr);
+
+- dev_dbg(&adap->dev, "adapter [%s] unregistered\n", adap->name);
+-
+ /* Clear the device structure in case this adapter is ever going to be
+ added again */
+ memset(&adap->dev, 0, sizeof(adap->dev));
--- /dev/null
+From 8ba69ba6a324b13e1190fc31e41954d190fd4f1d Mon Sep 17 00:00:00 2001
+From: Miklos Szeredi <mszeredi@suse.cz>
+Date: Fri, 11 Sep 2009 11:31:45 -0700
+Subject: net: unix: fix sending fds in multiple buffers
+
+From: Miklos Szeredi <mszeredi@suse.cz>
+
+commit 8ba69ba6a324b13e1190fc31e41954d190fd4f1d upstream.
+
+Kalle Olavi Niemitalo reported that:
+
+ "..., when one process calls sendmsg once to send 43804 bytes of
+ data and one file descriptor, and another process then calls recvmsg
+ three times to receive the 16032+16032+11740 bytes, each of those
+ recvmsg calls returns the file descriptor in the ancillary data. I
+ confirmed this with strace. The behaviour differs from Linux
+ 2.6.26, where reportedly only one of those recvmsg calls (I think
+ the first one) returned the file descriptor."
+
+This bug was introduced by a patch from me titled "net: unix: fix inflight
+counting bug in garbage collector", commit 6209344f5.
+
+And the reason is, quoting Kalle:
+
+ "Before your patch, unix_attach_fds() would set scm->fp = NULL, so
+ that if the loop in unix_stream_sendmsg() ran multiple iterations,
+ it could not call unix_attach_fds() again. But now,
+ unix_attach_fds() leaves scm->fp unchanged, and I think this causes
+ it to be called multiple times and duplicate the same file
+ descriptors to each struct sk_buff."
+
+Fix this by introducing a flag that is cleared at the start and set
+when the fds attached to the first buffer. The resulting code should
+work equivalently to the one on 2.6.26.
+
+Reported-by: Kalle Olavi Niemitalo <kon@iki.fi>
+Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/unix/af_unix.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/net/unix/af_unix.c
++++ b/net/unix/af_unix.c
+@@ -1491,6 +1491,7 @@ static int unix_stream_sendmsg(struct ki
+ struct sk_buff *skb;
+ int sent=0;
+ struct scm_cookie tmp_scm;
++ bool fds_sent = false;
+
+ if (NULL == siocb->scm)
+ siocb->scm = &tmp_scm;
+@@ -1552,12 +1553,14 @@ static int unix_stream_sendmsg(struct ki
+ size = min_t(int, size, skb_tailroom(skb));
+
+ memcpy(UNIXCREDS(skb), &siocb->scm->creds, sizeof(struct ucred));
+- if (siocb->scm->fp) {
++ /* Only send the fds in the first buffer */
++ if (siocb->scm->fp && !fds_sent) {
+ err = unix_attach_fds(siocb->scm, skb);
+ if (err) {
+ kfree_skb(skb);
+ goto out_err;
+ }
++ fds_sent = true;
+ }
+
+ if ((err = memcpy_fromiovec(skb_put(skb,size), msg->msg_iov, size)) != 0) {
--- /dev/null
+From fa33507a22623b3bd543b15a21c362cf364b6cff Mon Sep 17 00:00:00 2001
+From: Peter Zijlstra <a.p.zijlstra@chello.nl>
+Date: Wed, 20 Aug 2008 09:31:26 +0200
+Subject: printk: robustify printk, fix #2
+
+From: Peter Zijlstra <a.p.zijlstra@chello.nl>
+
+commit fa33507a22623b3bd543b15a21c362cf364b6cff upstream.
+
+Dmitry Adamushko reported:
+
+> [*] btw., with DEBUG being enabled, pr_debug() generates [1] when
+> debug_smp_processor_id() is used (CONFIG_DEBUG_PREEMPT).
+>
+> the problem seems to be caused by the following commit:
+> commit b845b517b5e3706a3729f6ea83b88ab85f0725b0
+> Author: Peter Zijlstra <a.p.zijlstra@chello.nl>
+> Date: Fri Aug 8 21:47:09 2008 +0200
+>
+> printk: robustify printk
+>
+>
+> wake_up_klogd() -> __get_cpu_var() -> smp_processor_id()
+>
+> and that's being called from release_console_sem() which is, in turn,
+> said to be "may be called from any context" [2]
+>
+> and in this case, it seems to be called from some non-preemptible
+> context (although, it can't be printk()...
+> although, I haven't looked carefully yet).
+>
+> Provided [2], __get_cpu_var() is perhaps not the right solution there.
+>
+>
+> [1]
+>
+> [ 7697.942005] BUG: using smp_processor_id() in preemptible [00000000] code: syslogd/3542
+> [ 7697.942005] caller is wake_up_klogd+0x1b/0x50
+> [ 7697.942005] Pid: 3542, comm: syslogd Not tainted 2.6.27-rc3-tip-git #2
+> [ 7697.942005] Call Trace:
+> [ 7697.942005] [<ffffffff8036b398>] debug_smp_processor_id+0xe8/0xf0
+> [ 7697.942005] [<ffffffff80239d3b>] wake_up_klogd+0x1b/0x50
+> [ 7697.942005] [<ffffffff8023a047>] release_console_sem+0x1e7/0x200
+> [ 7697.942005] [<ffffffff803c0f17>] do_con_write+0xb7/0x1f30
+> [ 7697.942005] [<ffffffff8020d920>] ? show_trace+0x10/0x20
+> [ 7697.942005] [<ffffffff8020dc42>] ? dump_stack+0x72/0x80
+> [ 7697.942005] [<ffffffff8036392d>] ? __ratelimit+0xbd/0xe0
+> [ 7697.942005] [<ffffffff8036b398>] ? debug_smp_processor_id+0xe8/0xf0
+> [ 7697.942005] [<ffffffff80239d3b>] ? wake_up_klogd+0x1b/0x50
+> [ 7697.942005] [<ffffffff8023a047>] ? release_console_sem+0x1e7/0x200
+> [ 7697.942005] [<ffffffff803c2de9>] con_write+0x19/0x30
+> [ 7697.942005] [<ffffffff803b37b6>] write_chan+0x276/0x3c0
+> [ 7697.942005] [<ffffffff80232b20>] ? default_wake_function+0x0/0x10
+> [ 7697.942005] [<ffffffff804cb872>] ? _spin_lock_irqsave+0x22/0x50
+> [ 7697.942005] [<ffffffff803b1334>] tty_write+0x194/0x260
+> [ 7697.942005] [<ffffffff803b3540>] ? write_chan+0x0/0x3c0
+> [ 7697.942005] [<ffffffff803b14a4>] redirected_tty_write+0xa4/0xb0
+> [ 7697.942005] [<ffffffff803b1400>] ? redirected_tty_write+0x0/0xb0
+> [ 7697.942005] [<ffffffff802a88c2>] do_loop_readv_writev+0x52/0x80
+> [ 7697.942005] [<ffffffff802a939d>] do_readv_writev+0x1bd/0x1d0
+> [ 7697.942005] [<ffffffff802a93e9>] vfs_writev+0x39/0x60
+> [ 7697.942005] [<ffffffff802a9870>] sys_writev+0x50/0x90
+> [ 7697.942005] [<ffffffff8020bb3b>] system_call_fastpath+0x16/0x1b
+
+Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
+Reported-by: Dmitry Adamushko <dmitry.adamushko@gmail.com>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Cc: Paul Gortmaker <paul.gortmaker@windriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/printk.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/kernel/printk.c
++++ b/kernel/printk.c
+@@ -995,7 +995,7 @@ int printk_needs_cpu(int cpu)
+ void wake_up_klogd(void)
+ {
+ if (waitqueue_active(&log_wait))
+- __get_cpu_var(printk_pending) = 1;
++ __raw_get_cpu_var(printk_pending) = 1;
+ }
+
+ /**
--- /dev/null
+From 8812304cf1110ae16b0778680f6022216cf4716a Mon Sep 17 00:00:00 2001
+From: Raimonds Cicans <ray@apollo.lv>
+Date: Fri, 13 Nov 2009 10:52:19 +0000
+Subject: r8169: Fix receive buffer length when MTU is between 1515 and 1536
+
+From: Raimonds Cicans <ray@apollo.lv>
+
+commit 8812304cf1110ae16b0778680f6022216cf4716a upstream.
+
+In r8169 driver MTU is used to calculate receive buffer size.
+Receive buffer size is used to configure hardware incoming packet filter.
+
+For jumbo frames:
+Receive buffer size = Max frame size = MTU + 14 (ethernet header) + 4
+(vlan header) + 4 (ethernet checksum) = MTU + 22
+
+Bug:
+driver for all MTU up to 1536 use receive buffer size 1536
+
+As you can see from formula, this mean all IP packets > 1536 - 22
+(for vlan tagged, 1536 - 18 for not tagged) are dropped by hardware
+filter.
+
+Example:
+
+host_good> ifconfig eth0 mtu 1536
+host_r8169> ifconfig eth0 mtu 1536
+host_good> ping host_r8169
+Ok
+host_good> ping -s 1500 host_r8169
+Fail
+host_good> ifconfig eth0 mtu 7000
+host_r8169> ifconfig eth0 mtu 7000
+host_good> ping -s 1500 host_r8169
+Ok
+
+Bonus: got rid of magic number 8
+
+Signed-off-by: Raimonds Cicans <ray@apollo.lv>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Cc: Jean Delvare <khali@linux-fr.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/r8169.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/r8169.c
++++ b/drivers/net/r8169.c
+@@ -1842,9 +1842,9 @@ static void __devexit rtl8169_remove_one
+ static void rtl8169_set_rxbufsize(struct rtl8169_private *tp,
+ struct net_device *dev)
+ {
+- unsigned int mtu = dev->mtu;
++ unsigned int max_frame = dev->mtu + VLAN_ETH_HLEN + ETH_FCS_LEN;
+
+- tp->rx_buf_sz = (mtu > RX_BUF_SIZE) ? mtu + ETH_HLEN + 8 : RX_BUF_SIZE;
++ tp->rx_buf_sz = (max_frame > RX_BUF_SIZE) ? max_frame : RX_BUF_SIZE;
+ }
+
+ static int rtl8169_open(struct net_device *dev)
--- /dev/null
+From 14800984706bf6936bbec5187f736e928be5c218 Mon Sep 17 00:00:00 2001
+From: Mike Galbraith <efault@gmx.de>
+Date: Fri, 7 Nov 2008 15:26:50 +0100
+Subject: sched: fine-tune SD_MC_INIT
+
+From: Mike Galbraith <efault@gmx.de>
+
+commit 14800984706bf6936bbec5187f736e928be5c218 upstream.
+
+Tune SD_MC_INIT the same way as SD_CPU_INIT:
+unset SD_BALANCE_NEWIDLE, and set SD_WAKE_BALANCE.
+
+This improves vmark by 5%:
+
+vmark 132102 125968 125497 messages/sec avg 127855.66 .984
+vmark 139404 131719 131272 messages/sec avg 134131.66 1.033
+
+Signed-off-by: Mike Galbraith <efault@gmx.de>
+Acked-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ include/linux/topology.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/include/linux/topology.h
++++ b/include/linux/topology.h
+@@ -120,10 +120,10 @@ void arch_update_cpu_topology(void);
+ .wake_idx = 1, \
+ .forkexec_idx = 1, \
+ .flags = SD_LOAD_BALANCE \
+- | SD_BALANCE_NEWIDLE \
+ | SD_BALANCE_FORK \
+ | SD_BALANCE_EXEC \
+ | SD_WAKE_AFFINE \
++ | SD_WAKE_BALANCE \
+ | SD_SHARE_PKG_RESOURCES\
+ | BALANCE_FOR_MC_POWER, \
+ .last_balance = jiffies, \
--- /dev/null
+From 52c642f33b14bfa1b00ef2b68296effb34a573f3 Mon Sep 17 00:00:00 2001
+From: Ingo Molnar <mingo@elte.hu>
+Date: Fri, 7 Nov 2008 16:09:23 +0100
+Subject: sched: fine-tune SD_SIBLING_INIT
+
+From: Ingo Molnar <mingo@elte.hu>
+
+commit 52c642f33b14bfa1b00ef2b68296effb34a573f3 upstream.
+
+fine-tune the HT sched-domains parameters as well.
+
+On a HT capable box, this increases lat_ctx performance from 23.87
+usecs to 1.49 usecs:
+
+ # before
+
+ $ ./lat_ctx -s 0 2
+
+ "size=0k ovr=1.89
+ 2 23.87
+
+ # after
+
+ $ ./lat_ctx -s 0 2
+
+ "size=0k ovr=1.84
+ 2 1.49
+
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ include/linux/topology.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/include/linux/topology.h
++++ b/include/linux/topology.h
+@@ -99,7 +99,7 @@ void arch_update_cpu_topology(void);
+ | SD_BALANCE_FORK \
+ | SD_BALANCE_EXEC \
+ | SD_WAKE_AFFINE \
+- | SD_WAKE_IDLE \
++ | SD_WAKE_BALANCE \
+ | SD_SHARE_CPUPOWER, \
+ .last_balance = jiffies, \
+ .balance_interval = 1, \
--- /dev/null
+From 15afe09bf496ae10c989e1a375a6b5da7bd3e16e Mon Sep 17 00:00:00 2001
+From: Peter Zijlstra <a.p.zijlstra@chello.nl>
+Date: Sat, 20 Sep 2008 23:38:02 +0200
+Subject: sched: wakeup preempt when small overlap
+
+From: Peter Zijlstra <a.p.zijlstra@chello.nl>
+
+commit 15afe09bf496ae10c989e1a375a6b5da7bd3e16e upstream.
+
+Lin Ming reported a 10% OLTP regression against 2.6.27-rc4.
+
+The difference seems to come from different preemption agressiveness,
+which affects the cache footprint of the workload and its effective
+cache trashing.
+
+Aggresively preempt a task if its avg overlap is very small, this should
+avoid the task going to sleep and find it still running when we schedule
+back to it - saving a wakeup.
+
+Reported-by: Lin Ming <ming.m.lin@intel.com>
+Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ include/linux/sched.h | 2 +-
+ kernel/sched.c | 12 ++++++------
+ kernel/sched_fair.c | 13 ++++++++++---
+ kernel/sched_features.h | 1 +
+ kernel/sched_idletask.c | 6 +++---
+ kernel/sched_rt.c | 2 +-
+ 6 files changed, 22 insertions(+), 14 deletions(-)
+
+--- a/include/linux/sched.h
++++ b/include/linux/sched.h
+@@ -901,7 +901,7 @@ struct sched_class {
+ void (*yield_task) (struct rq *rq);
+ int (*select_task_rq)(struct task_struct *p, int sync);
+
+- void (*check_preempt_curr) (struct rq *rq, struct task_struct *p);
++ void (*check_preempt_curr) (struct rq *rq, struct task_struct *p, int sync);
+
+ struct task_struct * (*pick_next_task) (struct rq *rq);
+ void (*put_prev_task) (struct rq *rq, struct task_struct *p);
+--- a/kernel/sched.c
++++ b/kernel/sched.c
+@@ -604,9 +604,9 @@ struct rq {
+
+ static DEFINE_PER_CPU_SHARED_ALIGNED(struct rq, runqueues);
+
+-static inline void check_preempt_curr(struct rq *rq, struct task_struct *p)
++static inline void check_preempt_curr(struct rq *rq, struct task_struct *p, int sync)
+ {
+- rq->curr->sched_class->check_preempt_curr(rq, p);
++ rq->curr->sched_class->check_preempt_curr(rq, p, sync);
+ }
+
+ static inline int cpu_of(struct rq *rq)
+@@ -2285,7 +2285,7 @@ out_running:
+ trace_mark(kernel_sched_wakeup,
+ "pid %d state %ld ## rq %p task %p rq->curr %p",
+ p->pid, p->state, rq, p, rq->curr);
+- check_preempt_curr(rq, p);
++ check_preempt_curr(rq, p, sync);
+
+ p->state = TASK_RUNNING;
+ #ifdef CONFIG_SMP
+@@ -2420,7 +2420,7 @@ void wake_up_new_task(struct task_struct
+ trace_mark(kernel_sched_wakeup_new,
+ "pid %d state %ld ## rq %p task %p rq->curr %p",
+ p->pid, p->state, rq, p, rq->curr);
+- check_preempt_curr(rq, p);
++ check_preempt_curr(rq, p, 0);
+ #ifdef CONFIG_SMP
+ if (p->sched_class->task_wake_up)
+ p->sched_class->task_wake_up(rq, p);
+@@ -2880,7 +2880,7 @@ static void pull_task(struct rq *src_rq,
+ * Note that idle threads have a prio of MAX_PRIO, for this test
+ * to be always true for them.
+ */
+- check_preempt_curr(this_rq, p);
++ check_preempt_curr(this_rq, p, 0);
+ }
+
+ /*
+@@ -5957,7 +5957,7 @@ static int __migrate_task(struct task_st
+ set_task_cpu(p, dest_cpu);
+ if (on_rq) {
+ activate_task(rq_dest, p, 0);
+- check_preempt_curr(rq_dest, p);
++ check_preempt_curr(rq_dest, p, 0);
+ }
+ done:
+ ret = 1;
+--- a/kernel/sched_fair.c
++++ b/kernel/sched_fair.c
+@@ -1331,7 +1331,7 @@ static inline int depth_se(struct sched_
+ /*
+ * Preempt the current task with a newly woken task if needed:
+ */
+-static void check_preempt_wakeup(struct rq *rq, struct task_struct *p)
++static void check_preempt_wakeup(struct rq *rq, struct task_struct *p, int sync)
+ {
+ struct task_struct *curr = rq->curr;
+ struct cfs_rq *cfs_rq = task_cfs_rq(curr);
+@@ -1360,6 +1360,13 @@ static void check_preempt_wakeup(struct
+ if (!sched_feat(WAKEUP_PREEMPT))
+ return;
+
++ if (sched_feat(WAKEUP_OVERLAP) && sync &&
++ se->avg_overlap < sysctl_sched_migration_cost &&
++ pse->avg_overlap < sysctl_sched_migration_cost) {
++ resched_task(curr);
++ return;
++ }
++
+ /*
+ * preemption test can be made between sibling entities who are in the
+ * same cfs_rq i.e who have a common parent. Walk up the hierarchy of
+@@ -1642,7 +1649,7 @@ static void prio_changed_fair(struct rq
+ if (p->prio > oldprio)
+ resched_task(rq->curr);
+ } else
+- check_preempt_curr(rq, p);
++ check_preempt_curr(rq, p, 0);
+ }
+
+ /*
+@@ -1659,7 +1666,7 @@ static void switched_to_fair(struct rq *
+ if (running)
+ resched_task(rq->curr);
+ else
+- check_preempt_curr(rq, p);
++ check_preempt_curr(rq, p, 0);
+ }
+
+ /* Account for a task changing its policy or group.
+--- a/kernel/sched_features.h
++++ b/kernel/sched_features.h
+@@ -11,3 +11,4 @@ SCHED_FEAT(ASYM_GRAN, 1)
+ SCHED_FEAT(LB_BIAS, 1)
+ SCHED_FEAT(LB_WAKEUP_UPDATE, 1)
+ SCHED_FEAT(ASYM_EFF_LOAD, 1)
++SCHED_FEAT(WAKEUP_OVERLAP, 1)
+--- a/kernel/sched_idletask.c
++++ b/kernel/sched_idletask.c
+@@ -14,7 +14,7 @@ static int select_task_rq_idle(struct ta
+ /*
+ * Idle tasks are unconditionally rescheduled:
+ */
+-static void check_preempt_curr_idle(struct rq *rq, struct task_struct *p)
++static void check_preempt_curr_idle(struct rq *rq, struct task_struct *p, int sync)
+ {
+ resched_task(rq->idle);
+ }
+@@ -76,7 +76,7 @@ static void switched_to_idle(struct rq *
+ if (running)
+ resched_task(rq->curr);
+ else
+- check_preempt_curr(rq, p);
++ check_preempt_curr(rq, p, 0);
+ }
+
+ static void prio_changed_idle(struct rq *rq, struct task_struct *p,
+@@ -93,7 +93,7 @@ static void prio_changed_idle(struct rq
+ if (p->prio > oldprio)
+ resched_task(rq->curr);
+ } else
+- check_preempt_curr(rq, p);
++ check_preempt_curr(rq, p, 0);
+ }
+
+ /*
+--- a/kernel/sched_rt.c
++++ b/kernel/sched_rt.c
+@@ -784,7 +784,7 @@ static void check_preempt_equal_prio(str
+ /*
+ * Preempt the current task with a newly woken task if needed:
+ */
+-static void check_preempt_curr_rt(struct rq *rq, struct task_struct *p)
++static void check_preempt_curr_rt(struct rq *rq, struct task_struct *p, int sync)
+ {
+ if (p->prio < rq->curr->prio) {
+ resched_task(rq->curr);
futex-handle-user-space-corruption-gracefully.patch
resource-add-helpers-for-fetching-rlimits.patch
fs-exec.c-restrict-initial-stack-space-expansion-to-rlimit.patch
+printk-robustify-printk-fix-2.patch
+hwmon-lm78-fix-i-o-resource-conflict-with-pnp.patch
+r8169-fix-receive-buffer-length-when-mtu-is-between-1515-and-1536.patch
+ehci-fix-bug-in-keeping-track-of-resuming-ports.patch
+ax25-fix-possible-oops-in-ax25_make_new.patch
+net-unix-fix-sending-fds-in-multiple-buffers.patch
+sit-fix-off-by-one-in-ipip6_tunnel_get_prl.patch
+tcp-fix-config_tcp_md5sig-config_preempt-timer-bug.patch
+x86-fix-csum_ipv6_magic-asm-memory-clobber.patch
+sky2-set-sky2_hw_ram_buffer-in-sky2_init.patch
+sched-fine-tune-sd_mc_init.patch
+sched-fine-tune-sd_sibling_init.patch
+sched-wakeup-preempt-when-small-overlap.patch
+drivers-char-mem.c-avoid-oom-lockup-during-large-reads-from-dev-zero.patch
+i2c-do-not-use-device-name-after-device_unregister.patch
--- /dev/null
+From 298bf12ddb25841804f26234a43b89da1b1c0e21 Mon Sep 17 00:00:00 2001
+From: Sascha Hlusiak <contact@saschahlusiak.de>
+Date: Tue, 29 Sep 2009 11:27:05 +0000
+Subject: sit: fix off-by-one in ipip6_tunnel_get_prl
+
+From: Sascha Hlusiak <contact@saschahlusiak.de>
+
+commit 298bf12ddb25841804f26234a43b89da1b1c0e21 upstream.
+
+When requesting all prl entries (kprl.addr == INADDR_ANY) and there are
+more prl entries than there is space passed from userspace, the existing
+code would always copy cmax+1 entries, which is more than can be handled.
+
+This patch makes the kernel copy only exactly cmax entries.
+
+Signed-off-by: Sascha Hlusiak <contact@saschahlusiak.de>
+Acked-By: Fred L. Templin <Fred.L.Templin@boeing.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/ipv6/sit.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/ipv6/sit.c
++++ b/net/ipv6/sit.c
+@@ -260,7 +260,7 @@ static int ipip6_tunnel_get_prl(struct i
+
+ c = 0;
+ for (prl = t->prl; prl; prl = prl->next) {
+- if (c > cmax)
++ if (c >= cmax)
+ break;
+ if (kprl.addr != htonl(INADDR_ANY) && prl->addr != kprl.addr)
+ continue;
--- /dev/null
+From 74a61ebf653c6abe459f228eb40e9f24f7ef1fb7 Mon Sep 17 00:00:00 2001
+From: Mike McCormack <mikem@ring3k.org>
+Date: Mon, 21 Sep 2009 04:08:52 +0000
+Subject: sky2: Set SKY2_HW_RAM_BUFFER in sky2_init
+
+From: Mike McCormack <mikem@ring3k.org>
+
+commit 74a61ebf653c6abe459f228eb40e9f24f7ef1fb7 upstream.
+
+The SKY2_HW_RAM_BUFFER bit in hw->flags was checked in sky2_mac_init(),
+ before being set later in sky2_up().
+
+Setting SKY2_HW_RAM_BUFFER in sky2_init() where other hw->flags are set
+ should avoid this problem recurring.
+
+Signed-off-by: Mike McCormack <mikem@ring3k.org>
+Acked-by: Stephen Hemminger <shemminger@vyatta.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/sky2.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/sky2.c
++++ b/drivers/net/sky2.c
+@@ -1438,7 +1438,6 @@ static int sky2_up(struct net_device *de
+ if (ramsize > 0) {
+ u32 rxspace;
+
+- hw->flags |= SKY2_HW_RAM_BUFFER;
+ pr_debug(PFX "%s: ram buffer %dK\n", dev->name, ramsize);
+ if (ramsize < 16)
+ rxspace = ramsize / 2;
+@@ -2846,6 +2845,9 @@ static int __devinit sky2_init(struct sk
+ ++hw->ports;
+ }
+
++ if (sky2_read8(hw, B2_E_0))
++ hw->flags |= SKY2_HW_RAM_BUFFER;
++
+ return 0;
+ }
+
--- /dev/null
+From 657e9649e745b06675aa5063c84430986cdc3afa Mon Sep 17 00:00:00 2001
+From: Robert Varga <nite@hq.alert.sk>
+Date: Tue, 15 Sep 2009 23:49:21 -0700
+Subject: tcp: fix CONFIG_TCP_MD5SIG + CONFIG_PREEMPT timer BUG()
+
+From: Robert Varga <nite@hq.alert.sk>
+
+commit 657e9649e745b06675aa5063c84430986cdc3afa upstream.
+
+I have recently came across a preemption imbalance detected by:
+
+<4>huh, entered ffffffff80644630 with preempt_count 00000102, exited with 00000101?
+<0>------------[ cut here ]------------
+<2>kernel BUG at /usr/src/linux/kernel/timer.c:664!
+<0>invalid opcode: 0000 [1] PREEMPT SMP
+
+with ffffffff80644630 being inet_twdr_hangman().
+
+This appeared after I enabled CONFIG_TCP_MD5SIG and played with it a
+bit, so I looked at what might have caused it.
+
+One thing that struck me as strange is tcp_twsk_destructor(), as it
+calls tcp_put_md5sig_pool() -- which entails a put_cpu(), causing the
+detected imbalance. Found on 2.6.23.9, but 2.6.31 is affected as well,
+as far as I can tell.
+
+Signed-off-by: Robert Varga <nite@hq.alert.sk>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/ipv4/tcp_minisocks.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/ipv4/tcp_minisocks.c
++++ b/net/ipv4/tcp_minisocks.c
+@@ -362,7 +362,7 @@ void tcp_twsk_destructor(struct sock *sk
+ #ifdef CONFIG_TCP_MD5SIG
+ struct tcp_timewait_sock *twsk = tcp_twsk(sk);
+ if (twsk->tw_md5_keylen)
+- tcp_put_md5sig_pool();
++ tcp_free_md5sig_pool();
+ #endif
+ }
+
--- /dev/null
+From 392d814daf460a9564d29b2cebc51e1ea34e0504 Mon Sep 17 00:00:00 2001
+From: Samuel Thibault <samuel.thibault@ens-lyon.org>
+Date: Thu, 1 Oct 2009 15:44:02 -0700
+Subject: x86: fix csum_ipv6_magic asm memory clobber
+
+From: Samuel Thibault <samuel.thibault@ens-lyon.org>
+
+commit 392d814daf460a9564d29b2cebc51e1ea34e0504 upstream.
+
+Just like ip_fast_csum, the assembly snippet in csum_ipv6_magic needs a
+memory clobber, as it is only passed the address of the buffer, not a
+memory reference to the buffer itself.
+
+This caused failures in Hurd's pfinetv4 when we tried to compile it with
+gcc-4.3 (bogus checksums).
+
+Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
+Cc: Ingo Molnar <mingo@elte.hu>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: "H. Peter Anvin" <hpa@zytor.com>
+Acked-by: "David S. Miller" <davem@davemloft.net>
+Cc: Andi Kleen <andi@firstfloor.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ include/asm-x86/checksum_32.h | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/include/asm-x86/checksum_32.h
++++ b/include/asm-x86/checksum_32.h
+@@ -161,7 +161,8 @@ static inline __sum16 csum_ipv6_magic(co
+ "adcl $0, %0 ;\n"
+ : "=&r" (sum)
+ : "r" (saddr), "r" (daddr),
+- "r" (htonl(len)), "r" (htonl(proto)), "0" (sum));
++ "r" (htonl(len)), "r" (htonl(proto)), "0" (sum)
++ : "memory");
+
+ return csum_fold(sum);
+ }
projects / thirdparty / kernel / stable-queue.git / commitdiff
