--- /dev/null
+From 7b574b7b0124ed344911f5d581e9bc2d83bbeb19 Mon Sep 17 00:00:00 2001
+From: Li Zefan <lizf@cn.fujitsu.com>
+Date: Sun, 4 Jan 2009 12:00:45 -0800
+Subject: cgroups: fix a race between cgroup_clone and umount
+
+From: Li Zefan <lizf@cn.fujitsu.com>
+
+commit 7b574b7b0124ed344911f5d581e9bc2d83bbeb19 upstream.
+
+The race is calling cgroup_clone() while umounting the ns cgroup subsys,
+and thus cgroup_clone() might access invalid cgroup_fs, or kill_sb() is
+called after cgroup_clone() created a new dir in it.
+
+The BUG I triggered is BUG_ON(root->number_of_cgroups != 1);
+
+ ------------[ cut here ]------------
+ kernel BUG at kernel/cgroup.c:1093!
+ invalid opcode: 0000 [#1] SMP
+ ...
+ Process umount (pid: 5177, ti=e411e000 task=e40c4670 task.ti=e411e000)
+ ...
+ Call Trace:
+ [<c0493df7>] ? deactivate_super+0x3f/0x51
+ [<c04a3600>] ? mntput_no_expire+0xb3/0xdd
+ [<c04a3ab2>] ? sys_umount+0x265/0x2ac
+ [<c04a3b06>] ? sys_oldumount+0xd/0xf
+ [<c0403911>] ? sysenter_do_call+0x12/0x31
+ ...
+ EIP: [<c0456e76>] cgroup_kill_sb+0x23/0xe0 SS:ESP 0068:e411ef2c
+ ---[ end trace c766c1be3bf944ac ]---
+
+Cc: Serge E. Hallyn <serue@us.ibm.com>
+Signed-off-by: Li Zefan <lizf@cn.fujitsu.com>
+Cc: Paul Menage <menage@google.com>
+Cc: "Serge E. Hallyn" <serue@us.ibm.com>
+Cc: Balbir Singh <balbir@in.ibm.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/cgroup.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/kernel/cgroup.c
++++ b/kernel/cgroup.c
+@@ -2942,7 +2942,11 @@ int cgroup_clone(struct task_struct *tsk
+ parent = task_cgroup(tsk, subsys->subsys_id);
+
+ /* Pin the hierarchy */
+- atomic_inc(&parent->root->sb->s_active);
++ if (!atomic_inc_not_zero(&parent->root->sb->s_active)) {
++ /* We race with the final deactivate_super() */
++ mutex_unlock(&cgroup_mutex);
++ return 0;
++ }
+
+ /* Keep the cgroup alive */
+ get_css_set(cg);
--- /dev/null
+From 0b82ac37b889ec881b645860da3775118effb3ca Mon Sep 17 00:00:00 2001
+From: Serge E. Hallyn <serue@us.ibm.com>
+Date: Wed, 7 Jan 2009 18:07:46 -0800
+Subject: devices cgroup: allow mkfifo
+
+From: Serge E. Hallyn <serue@us.ibm.com>
+
+commit 0b82ac37b889ec881b645860da3775118effb3ca upstream.
+
+The devcgroup_inode_permission() hook in the devices whitelist cgroup has
+always bypassed access checks on fifos. But the mknod hook did not. The
+devices whitelist is only about block and char devices, and fifos can't
+even be added to the whitelist, so fifos can't be created at all except by
+tasks which have 'a' in their whitelist (meaning they have access to all
+devices).
+
+Fix the behavior by bypassing access checks to mkfifo.
+
+Signed-off-by: Serge E. Hallyn <serue@us.ibm.com>
+Cc: Li Zefan <lizf@cn.fujitsu.com>
+Cc: Pavel Emelyanov <xemul@openvz.org>
+Cc: Paul Menage <menage@google.com>
+Cc: Lai Jiangshan <laijs@cn.fujitsu.com>
+Cc: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
+Cc: James Morris <jmorris@namei.org>
+Reported-by: Daniel Lezcano <dlezcano@fr.ibm.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ security/device_cgroup.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/security/device_cgroup.c
++++ b/security/device_cgroup.c
+@@ -513,6 +513,9 @@ int devcgroup_inode_mknod(int mode, dev_
+ struct dev_cgroup *dev_cgroup;
+ struct dev_whitelist_item *wh;
+
++ if (!S_ISBLK(mode) && !S_ISCHR(mode))
++ return 0;
++
+ rcu_read_lock();
+
+ dev_cgroup = task_devcgroup(current);
--- /dev/null
+From c7a2bd19b7c1e0bd2c7604c53d2583e91e536948 Mon Sep 17 00:00:00 2001
+From: Takahiro Yasui <tyasui@redhat.com>
+Date: Tue, 6 Jan 2009 03:04:56 +0000
+Subject: dm log: fix dm_io_client leak on error paths
+
+From: Takahiro Yasui <tyasui@redhat.com>
+
+commit c7a2bd19b7c1e0bd2c7604c53d2583e91e536948 upstream.
+
+In create_log_context function, dm_io_client_destroy function needs
+to be called, when memory allocation of disk_header, sync_bits and
+recovering_bits failed, but dm_io_client_destroy is not called.
+
+Signed-off-by: Takahiro Yasui <tyasui@redhat.com>
+Acked-by: Jonathan Brassow <jbrassow@redhat.com>
+Signed-off-by: Alasdair G Kergon <agk@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/dm-log.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/md/dm-log.c
++++ b/drivers/md/dm-log.c
+@@ -467,6 +467,7 @@ static int create_log_context(struct dm_
+ lc->disk_header = vmalloc(buf_size);
+ if (!lc->disk_header) {
+ DMWARN("couldn't allocate disk log buffer");
++ dm_io_client_destroy(lc->io_req.client);
+ kfree(lc);
+ return -ENOMEM;
+ }
+@@ -482,6 +483,8 @@ static int create_log_context(struct dm_
+ DMWARN("couldn't allocate sync bitset");
+ if (!dev)
+ vfree(lc->clean_bits);
++ else
++ dm_io_client_destroy(lc->io_req.client);
+ vfree(lc->disk_header);
+ kfree(lc);
+ return -ENOMEM;
+@@ -495,6 +498,8 @@ static int create_log_context(struct dm_
+ vfree(lc->sync_bits);
+ if (!dev)
+ vfree(lc->clean_bits);
++ else
++ dm_io_client_destroy(lc->io_req.client);
+ vfree(lc->disk_header);
+ kfree(lc);
+ return -ENOMEM;
--- /dev/null
+From d460c65a6a9ec9e0d284864ec3a9a2d1b73f0e43 Mon Sep 17 00:00:00 2001
+From: Jonathan Brassow <jbrassow@redhat.com>
+Date: Tue, 6 Jan 2009 03:04:57 +0000
+Subject: dm raid1: fix error count
+
+From: Jonathan Brassow <jbrassow@redhat.com>
+
+commit d460c65a6a9ec9e0d284864ec3a9a2d1b73f0e43 upstream.
+
+Always increase the error count when I/O on a leg of a mirror fails.
+
+The error count is used to decide whether to select an alternative
+mirror leg. If the target doesn't use the "handle_errors" feature, the
+error count is not updated and the bio can get requeued forever by the
+read callback.
+
+Fix it by increasing error_count before the handle_errors feature
+checking.
+
+Signed-off-by: Milan Broz <mbroz@redhat.com>
+Signed-off-by: Jonathan Brassow <jbrassow@redhat.com>
+Signed-off-by: Alasdair G Kergon <agk@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/dm-raid1.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/md/dm-raid1.c
++++ b/drivers/md/dm-raid1.c
+@@ -197,9 +197,6 @@ static void fail_mirror(struct mirror *m
+ struct mirror_set *ms = m->ms;
+ struct mirror *new;
+
+- if (!errors_handled(ms))
+- return;
+-
+ /*
+ * error_count is used for nothing more than a
+ * simple way to tell if a device has encountered
+@@ -210,6 +207,9 @@ static void fail_mirror(struct mirror *m
+ if (test_and_set_bit(error_type, &m->error_type))
+ return;
+
++ if (!errors_handled(ms))
++ return;
++
+ if (m != get_default_mirror(ms))
+ goto out;
+
--- /dev/null
+From 54566b2c1594c2326a645a3551f9d989f7ba3c5e Mon Sep 17 00:00:00 2001
+From: Nick Piggin <npiggin@suse.de>
+Date: Sun, 4 Jan 2009 12:00:53 -0800
+Subject: fs: symlink write_begin allocation context fix
+
+From: Nick Piggin <npiggin@suse.de>
+
+commit 54566b2c1594c2326a645a3551f9d989f7ba3c5e upstream.
+
+With the write_begin/write_end aops, page_symlink was broken because it
+could no longer pass a GFP_NOFS type mask into the point where the
+allocations happened. They are done in write_begin, which would always
+assume that the filesystem can be entered from reclaim. This bug could
+cause filesystem deadlocks.
+
+The funny thing with having a gfp_t mask there is that it doesn't really
+allow the caller to arbitrarily tinker with the context in which it can be
+called. It couldn't ever be GFP_ATOMIC, for example, because it needs to
+take the page lock. The only thing any callers care about is __GFP_FS
+anyway, so turn that into a single flag.
+
+Add a new flag for write_begin, AOP_FLAG_NOFS. Filesystems can now act on
+this flag in their write_begin function. Change __grab_cache_page to
+accept a nofs argument as well, to honour that flag (while we're there,
+change the name to grab_cache_page_write_begin which is more instructive
+and does away with random leading underscores).
+
+This is really a more flexible way to go in the end anyway -- if a
+filesystem happens to want any extra allocations aside from the pagecache
+ones in ints write_begin function, it may now use GFP_KERNEL (rather than
+GFP_NOFS) for common case allocations (eg. ocfs2_alloc_write_ctxt, for a
+random example).
+
+[kosaki.motohiro@jp.fujitsu.com: fix ubifs]
+[kosaki.motohiro@jp.fujitsu.com: fix fuse]
+Signed-off-by: Nick Piggin <npiggin@suse.de>
+Reviewed-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
+Signed-off-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+[ Cleaned up the calling convention: just pass in the AOP flags
+ untouched to the grab_cache_page_write_begin() function. That
+ just simplifies everybody, and may even allow future expansion of the
+ logic. - Linus ]
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/affs/file.c | 2 +-
+ fs/afs/write.c | 2 +-
+ fs/buffer.c | 4 ++--
+ fs/cifs/file.c | 2 +-
+ fs/ecryptfs/mmap.c | 2 +-
+ fs/ext3/inode.c | 2 +-
+ fs/ext3/namei.c | 3 +--
+ fs/ext4/inode.c | 4 ++--
+ fs/ext4/namei.c | 3 +--
+ fs/fuse/file.c | 4 ++--
+ fs/gfs2/ops_address.c | 2 +-
+ fs/hostfs/hostfs_kern.c | 2 +-
+ fs/jffs2/file.c | 2 +-
+ fs/libfs.c | 2 +-
+ fs/namei.c | 13 +++++++++----
+ fs/nfs/file.c | 2 +-
+ fs/reiserfs/inode.c | 2 +-
+ fs/smbfs/file.c | 2 +-
+ fs/ubifs/file.c | 9 +++++----
+ include/linux/fs.h | 5 ++++-
+ include/linux/pagemap.h | 3 ++-
+ mm/filemap.c | 13 +++++++++----
+ 22 files changed, 49 insertions(+), 36 deletions(-)
+
+--- a/fs/affs/file.c
++++ b/fs/affs/file.c
+@@ -628,7 +628,7 @@ static int affs_write_begin_ofs(struct f
+ }
+
+ index = pos >> PAGE_CACHE_SHIFT;
+- page = __grab_cache_page(mapping, index);
++ page = grab_cache_page_write_begin(mapping, index, flags);
+ if (!page)
+ return -ENOMEM;
+ *pagep = page;
+--- a/fs/afs/write.c
++++ b/fs/afs/write.c
+@@ -144,7 +144,7 @@ int afs_write_begin(struct file *file, s
+ candidate->state = AFS_WBACK_PENDING;
+ init_waitqueue_head(&candidate->waitq);
+
+- page = __grab_cache_page(mapping, index);
++ page = grab_cache_page_write_begin(mapping, index, flags);
+ if (!page) {
+ kfree(candidate);
+ return -ENOMEM;
+--- a/fs/buffer.c
++++ b/fs/buffer.c
+@@ -1988,7 +1988,7 @@ int block_write_begin(struct file *file,
+ page = *pagep;
+ if (page == NULL) {
+ ownpage = 1;
+- page = __grab_cache_page(mapping, index);
++ page = grab_cache_page_write_begin(mapping, index, flags);
+ if (!page) {
+ status = -ENOMEM;
+ goto out;
+@@ -2494,7 +2494,7 @@ int nobh_write_begin(struct file *file,
+ from = pos & (PAGE_CACHE_SIZE - 1);
+ to = from + len;
+
+- page = __grab_cache_page(mapping, index);
++ page = grab_cache_page_write_begin(mapping, index, flags);
+ if (!page)
+ return -ENOMEM;
+ *pagep = page;
+--- a/fs/cifs/file.c
++++ b/fs/cifs/file.c
+@@ -2073,7 +2073,7 @@ static int cifs_write_begin(struct file
+
+ cFYI(1, ("write_begin from %lld len %d", (long long)pos, len));
+
+- page = __grab_cache_page(mapping, index);
++ page = grab_cache_page_write_begin(mapping, index, flags);
+ if (!page) {
+ rc = -ENOMEM;
+ goto out;
+--- a/fs/ecryptfs/mmap.c
++++ b/fs/ecryptfs/mmap.c
+@@ -288,7 +288,7 @@ static int ecryptfs_write_begin(struct f
+ loff_t prev_page_end_size;
+ int rc = 0;
+
+- page = __grab_cache_page(mapping, index);
++ page = grab_cache_page_write_begin(mapping, index, flags);
+ if (!page)
+ return -ENOMEM;
+ *pagep = page;
+--- a/fs/ext3/inode.c
++++ b/fs/ext3/inode.c
+@@ -1160,7 +1160,7 @@ static int ext3_write_begin(struct file
+ to = from + len;
+
+ retry:
+- page = __grab_cache_page(mapping, index);
++ page = grab_cache_page_write_begin(mapping, index, flags);
+ if (!page)
+ return -ENOMEM;
+ *pagep = page;
+--- a/fs/ext3/namei.c
++++ b/fs/ext3/namei.c
+@@ -2170,8 +2170,7 @@ retry:
+ * We have a transaction open. All is sweetness. It also sets
+ * i_size in generic_commit_write().
+ */
+- err = __page_symlink(inode, symname, l,
+- mapping_gfp_mask(inode->i_mapping) & ~__GFP_FS);
++ err = __page_symlink(inode, symname, l, 1);
+ if (err) {
+ drop_nlink(inode);
+ ext3_mark_inode_dirty(handle, inode);
+--- a/fs/ext4/inode.c
++++ b/fs/ext4/inode.c
+@@ -1345,7 +1345,7 @@ retry:
+ goto out;
+ }
+
+- page = __grab_cache_page(mapping, index);
++ page = grab_cache_page_write_begin(mapping, index, flags);
+ if (!page) {
+ ext4_journal_stop(handle);
+ ret = -ENOMEM;
+@@ -2549,7 +2549,7 @@ retry:
+ goto out;
+ }
+
+- page = __grab_cache_page(mapping, index);
++ page = grab_cache_page_write_begin(mapping, index, flags);
+ if (!page) {
+ ext4_journal_stop(handle);
+ ret = -ENOMEM;
+--- a/fs/ext4/namei.c
++++ b/fs/ext4/namei.c
+@@ -2208,8 +2208,7 @@ retry:
+ * We have a transaction open. All is sweetness. It also sets
+ * i_size in generic_commit_write().
+ */
+- err = __page_symlink(inode, symname, l,
+- mapping_gfp_mask(inode->i_mapping) & ~__GFP_FS);
++ err = __page_symlink(inode, symname, l, 1);
+ if (err) {
+ clear_nlink(inode);
+ ext4_mark_inode_dirty(handle, inode);
+--- a/fs/fuse/file.c
++++ b/fs/fuse/file.c
+@@ -646,7 +646,7 @@ static int fuse_write_begin(struct file
+ {
+ pgoff_t index = pos >> PAGE_CACHE_SHIFT;
+
+- *pagep = __grab_cache_page(mapping, index);
++ *pagep = grab_cache_page_write_begin(mapping, index, flags);
+ if (!*pagep)
+ return -ENOMEM;
+ return 0;
+@@ -779,7 +779,7 @@ static ssize_t fuse_fill_write_pages(str
+ break;
+
+ err = -ENOMEM;
+- page = __grab_cache_page(mapping, index);
++ page = grab_cache_page_write_begin(mapping, index, 0);
+ if (!page)
+ break;
+
+--- a/fs/gfs2/ops_address.c
++++ b/fs/gfs2/ops_address.c
+@@ -675,7 +675,7 @@ static int gfs2_write_begin(struct file
+ goto out_trans_fail;
+
+ error = -ENOMEM;
+- page = __grab_cache_page(mapping, index);
++ page = grab_cache_page_write_begin(mapping, index, flags);
+ *pagep = page;
+ if (unlikely(!page))
+ goto out_endtrans;
+--- a/fs/hostfs/hostfs_kern.c
++++ b/fs/hostfs/hostfs_kern.c
+@@ -501,7 +501,7 @@ int hostfs_write_begin(struct file *file
+ {
+ pgoff_t index = pos >> PAGE_CACHE_SHIFT;
+
+- *pagep = __grab_cache_page(mapping, index);
++ *pagep = grab_cache_page_write_begin(mapping, index, flags);
+ if (!*pagep)
+ return -ENOMEM;
+ return 0;
+--- a/fs/jffs2/file.c
++++ b/fs/jffs2/file.c
+@@ -132,7 +132,7 @@ static int jffs2_write_begin(struct file
+ uint32_t pageofs = index << PAGE_CACHE_SHIFT;
+ int ret = 0;
+
+- pg = __grab_cache_page(mapping, index);
++ pg = grab_cache_page_write_begin(mapping, index, flags);
+ if (!pg)
+ return -ENOMEM;
+ *pagep = pg;
+--- a/fs/libfs.c
++++ b/fs/libfs.c
+@@ -360,7 +360,7 @@ int simple_write_begin(struct file *file
+ index = pos >> PAGE_CACHE_SHIFT;
+ from = pos & (PAGE_CACHE_SIZE - 1);
+
+- page = __grab_cache_page(mapping, index);
++ page = grab_cache_page_write_begin(mapping, index, flags);
+ if (!page)
+ return -ENOMEM;
+
+--- a/fs/namei.c
++++ b/fs/namei.c
+@@ -2786,18 +2786,23 @@ void page_put_link(struct dentry *dentry
+ }
+ }
+
+-int __page_symlink(struct inode *inode, const char *symname, int len,
+- gfp_t gfp_mask)
++/*
++ * The nofs argument instructs pagecache_write_begin to pass AOP_FLAG_NOFS
++ */
++int __page_symlink(struct inode *inode, const char *symname, int len, int nofs)
+ {
+ struct address_space *mapping = inode->i_mapping;
+ struct page *page;
+ void *fsdata;
+ int err;
+ char *kaddr;
++ unsigned int flags = AOP_FLAG_UNINTERRUPTIBLE;
++ if (nofs)
++ flags |= AOP_FLAG_NOFS;
+
+ retry:
+ err = pagecache_write_begin(NULL, mapping, 0, len-1,
+- AOP_FLAG_UNINTERRUPTIBLE, &page, &fsdata);
++ flags, &page, &fsdata);
+ if (err)
+ goto fail;
+
+@@ -2821,7 +2826,7 @@ fail:
+ int page_symlink(struct inode *inode, const char *symname, int len)
+ {
+ return __page_symlink(inode, symname, len,
+- mapping_gfp_mask(inode->i_mapping));
++ !(mapping_gfp_mask(inode->i_mapping) & __GFP_FS));
+ }
+
+ const struct inode_operations page_symlink_inode_operations = {
+--- a/fs/nfs/file.c
++++ b/fs/nfs/file.c
+@@ -354,7 +354,7 @@ static int nfs_write_begin(struct file *
+ file->f_path.dentry->d_name.name,
+ mapping->host->i_ino, len, (long long) pos);
+
+- page = __grab_cache_page(mapping, index);
++ page = grab_cache_page_write_begin(mapping, index, flags);
+ if (!page)
+ return -ENOMEM;
+ *pagep = page;
+--- a/fs/reiserfs/inode.c
++++ b/fs/reiserfs/inode.c
+@@ -2556,7 +2556,7 @@ static int reiserfs_write_begin(struct f
+ }
+
+ index = pos >> PAGE_CACHE_SHIFT;
+- page = __grab_cache_page(mapping, index);
++ page = grab_cache_page_write_begin(mapping, index, flags);
+ if (!page)
+ return -ENOMEM;
+ *pagep = page;
+--- a/fs/smbfs/file.c
++++ b/fs/smbfs/file.c
+@@ -297,7 +297,7 @@ static int smb_write_begin(struct file *
+ struct page **pagep, void **fsdata)
+ {
+ pgoff_t index = pos >> PAGE_CACHE_SHIFT;
+- *pagep = __grab_cache_page(mapping, index);
++ *pagep = grab_cache_page_write_begin(mapping, index, flags);
+ if (!*pagep)
+ return -ENOMEM;
+ return 0;
+--- a/fs/ubifs/file.c
++++ b/fs/ubifs/file.c
+@@ -219,7 +219,8 @@ static void release_existing_page_budget
+ }
+
+ static int write_begin_slow(struct address_space *mapping,
+- loff_t pos, unsigned len, struct page **pagep)
++ loff_t pos, unsigned len, struct page **pagep,
++ unsigned flags)
+ {
+ struct inode *inode = mapping->host;
+ struct ubifs_info *c = inode->i_sb->s_fs_info;
+@@ -247,7 +248,7 @@ static int write_begin_slow(struct addre
+ if (unlikely(err))
+ return err;
+
+- page = __grab_cache_page(mapping, index);
++ page = grab_cache_page_write_begin(mapping, index, flags);
+ if (unlikely(!page)) {
+ ubifs_release_budget(c, &req);
+ return -ENOMEM;
+@@ -438,7 +439,7 @@ static int ubifs_write_begin(struct file
+ return -EROFS;
+
+ /* Try out the fast-path part first */
+- page = __grab_cache_page(mapping, index);
++ page = grab_cache_page_write_begin(mapping, index, flags);
+ if (unlikely(!page))
+ return -ENOMEM;
+
+@@ -483,7 +484,7 @@ static int ubifs_write_begin(struct file
+ unlock_page(page);
+ page_cache_release(page);
+
+- return write_begin_slow(mapping, pos, len, pagep);
++ return write_begin_slow(mapping, pos, len, pagep, flags);
+ }
+
+ /*
+--- a/include/linux/fs.h
++++ b/include/linux/fs.h
+@@ -414,6 +414,9 @@ enum positive_aop_returns {
+
+ #define AOP_FLAG_UNINTERRUPTIBLE 0x0001 /* will not do a short write */
+ #define AOP_FLAG_CONT_EXPAND 0x0002 /* called from cont_expand */
++#define AOP_FLAG_NOFS 0x0004 /* used by filesystem to direct
++ * helper code (eg buffer layer)
++ * to clear GFP_FS from alloc */
+
+ /*
+ * oh the beauties of C type declarations.
+@@ -2023,7 +2026,7 @@ extern int page_readlink(struct dentry *
+ extern void *page_follow_link_light(struct dentry *, struct nameidata *);
+ extern void page_put_link(struct dentry *, struct nameidata *, void *);
+ extern int __page_symlink(struct inode *inode, const char *symname, int len,
+- gfp_t gfp_mask);
++ int nofs);
+ extern int page_symlink(struct inode *inode, const char *symname, int len);
+ extern const struct inode_operations page_symlink_inode_operations;
+ extern int generic_readlink(struct dentry *, char __user *, int);
+--- a/include/linux/pagemap.h
++++ b/include/linux/pagemap.h
+@@ -241,7 +241,8 @@ unsigned find_get_pages_contig(struct ad
+ unsigned find_get_pages_tag(struct address_space *mapping, pgoff_t *index,
+ int tag, unsigned int nr_pages, struct page **pages);
+
+-struct page *__grab_cache_page(struct address_space *mapping, pgoff_t index);
++struct page *grab_cache_page_write_begin(struct address_space *mapping,
++ pgoff_t index, unsigned flags);
+
+ /*
+ * Returns locked page at given index in given cache, creating it if needed.
+--- a/mm/filemap.c
++++ b/mm/filemap.c
+@@ -2140,19 +2140,24 @@ EXPORT_SYMBOL(generic_file_direct_write)
+ * Find or create a page at the given pagecache position. Return the locked
+ * page. This function is specifically for buffered writes.
+ */
+-struct page *__grab_cache_page(struct address_space *mapping, pgoff_t index)
++struct page *grab_cache_page_write_begin(struct address_space *mapping,
++ pgoff_t index, unsigned flags)
+ {
+ int status;
+ struct page *page;
++ gfp_t gfp_notmask = 0;
++ if (flags & AOP_FLAG_NOFS)
++ gfp_notmask = __GFP_FS;
+ repeat:
+ page = find_lock_page(mapping, index);
+ if (likely(page))
+ return page;
+
+- page = page_cache_alloc(mapping);
++ page = __page_cache_alloc(mapping_gfp_mask(mapping) & ~gfp_notmask);
+ if (!page)
+ return NULL;
+- status = add_to_page_cache_lru(page, mapping, index, GFP_KERNEL);
++ status = add_to_page_cache_lru(page, mapping, index,
++ GFP_KERNEL & ~gfp_notmask);
+ if (unlikely(status)) {
+ page_cache_release(page);
+ if (status == -EEXIST)
+@@ -2161,7 +2166,7 @@ repeat:
+ }
+ return page;
+ }
+-EXPORT_SYMBOL(__grab_cache_page);
++EXPORT_SYMBOL(grab_cache_page_write_begin);
+
+ static ssize_t generic_perform_write(struct file *file,
+ struct iov_iter *i, loff_t pos)
--- /dev/null
+From b9bdcbba010c2e49c8f837ea7a49fe006b636f41 Mon Sep 17 00:00:00 2001
+From: Dan Williams <dan.j.williams@intel.com>
+Date: Tue, 6 Jan 2009 11:38:22 -0700
+Subject: ioat: fix self test for multi-channel case
+
+From: Dan Williams <dan.j.williams@intel.com>
+
+commit b9bdcbba010c2e49c8f837ea7a49fe006b636f41 upstream.
+
+In the multiple device case we need to re-arm the completion and protect
+against concurrent self-tests. The printk from the test callback is
+removed as it can arbitrarily delay completion of the test.
+
+Cc: Maciej Sosnowski <maciej.sosnowski@intel.com>
+Signed-off-by: Dan Williams <dan.j.williams@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/dma/ioat_dma.c | 13 +++++++------
+ 1 file changed, 7 insertions(+), 6 deletions(-)
+
+--- a/drivers/dma/ioat_dma.c
++++ b/drivers/dma/ioat_dma.c
+@@ -1341,12 +1341,11 @@ static void ioat_dma_start_null_desc(str
+ */
+ #define IOAT_TEST_SIZE 2000
+
+-DECLARE_COMPLETION(test_completion);
+ static void ioat_dma_test_callback(void *dma_async_param)
+ {
+- printk(KERN_ERR "ioatdma: ioat_dma_test_callback(%p)\n",
+- dma_async_param);
+- complete(&test_completion);
++ struct completion *cmp = dma_async_param;
++
++ complete(cmp);
+ }
+
+ /**
+@@ -1363,6 +1362,7 @@ static int ioat_dma_self_test(struct ioa
+ dma_addr_t dma_dest, dma_src;
+ dma_cookie_t cookie;
+ int err = 0;
++ struct completion cmp;
+
+ src = kzalloc(sizeof(u8) * IOAT_TEST_SIZE, GFP_KERNEL);
+ if (!src)
+@@ -1402,8 +1402,9 @@ static int ioat_dma_self_test(struct ioa
+ }
+
+ async_tx_ack(tx);
++ init_completion(&cmp);
+ tx->callback = ioat_dma_test_callback;
+- tx->callback_param = (void *)0x8086;
++ tx->callback_param = &cmp;
+ cookie = tx->tx_submit(tx);
+ if (cookie < 0) {
+ dev_err(&device->pdev->dev,
+@@ -1413,7 +1414,7 @@ static int ioat_dma_self_test(struct ioa
+ }
+ device->common.device_issue_pending(dma_chan);
+
+- wait_for_completion_timeout(&test_completion, msecs_to_jiffies(3000));
++ wait_for_completion_timeout(&cmp, msecs_to_jiffies(3000));
+
+ if (device->common.device_is_tx_complete(dma_chan, cookie, NULL, NULL)
+ != DMA_SUCCESS) {
--- /dev/null
+From 538452700d95480c16e7aa6b10ff77cd937d33f4 Mon Sep 17 00:00:00 2001
+From: NeilBrown <neilb@suse.de>
+Date: Fri, 9 Jan 2009 08:31:05 +1100
+Subject: md: fix bitmap-on-external-file bug.
+
+From: NeilBrown <neilb@suse.de>
+
+commit 538452700d95480c16e7aa6b10ff77cd937d33f4 upstream.
+
+commit a2ed9615e3222645007fc19991aedf30eed3ecfd
+fixed a bug with 'internal' bitmaps, but in the process broke
+'in a file' bitmaps. So they are broken in 2.6.28
+
+This fixes it, and needs to go in 2.6.28-stable.
+
+Signed-off-by: NeilBrown <neilb@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/bitmap.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+--- a/drivers/md/bitmap.c
++++ b/drivers/md/bitmap.c
+@@ -964,9 +964,11 @@ static int bitmap_init_from_disk(struct
+ */
+ page = bitmap->sb_page;
+ offset = sizeof(bitmap_super_t);
+- read_sb_page(bitmap->mddev, bitmap->offset,
+- page,
+- index, count);
++ if (!file)
++ read_sb_page(bitmap->mddev,
++ bitmap->offset,
++ page,
++ index, count);
+ } else if (file) {
+ page = read_page(file, index, bitmap, count);
+ offset = 0;
--- /dev/null
+From d6b54841f4ddd836c886d1e6ac381cf309ee98a3 Mon Sep 17 00:00:00 2001
+From: Evgeniy Dushistov <dushistov@mail.ru>
+Date: Tue, 6 Jan 2009 14:42:38 -0800
+Subject: minix: fix add link's wrong position calculation
+
+From: Evgeniy Dushistov <dushistov@mail.ru>
+
+commit d6b54841f4ddd836c886d1e6ac381cf309ee98a3 upstream.
+
+Fix the add link method. The oosition in the directory was calculated in
+wrong way - it had the incorrect shift direction.
+
+[akpm@linux-foundation.org: coding-style fixes]
+Signed-off-by: Evgeniy Dushistov <dushistov@mail.ru>
+Cc: Nick Piggin <nickpiggin@yahoo.com.au>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/minix/dir.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/minix/dir.c
++++ b/fs/minix/dir.c
+@@ -280,7 +280,7 @@ int minix_add_link(struct dentry *dentry
+ return -EINVAL;
+
+ got_it:
+- pos = (page->index >> PAGE_CACHE_SHIFT) + p - (char*)page_address(page);
++ pos = page_offset(page) + p - (char *)page_address(page);
+ err = __minix_write_begin(NULL, page->mapping, pos, sbi->s_dirsize,
+ AOP_FLAG_UNINTERRUPTIBLE, &page, NULL);
+ if (err)
--- /dev/null
+From 1c5745aa380efb6417b5681104b007c8612fb496 Mon Sep 17 00:00:00 2001
+From: Thomas Gleixner <tglx@linutronix.de>
+Date: Mon, 22 Dec 2008 23:05:28 +0100
+Subject: sched_clock: prevent scd->clock from moving backwards, take #2
+
+From: Thomas Gleixner <tglx@linutronix.de>
+
+commit 1c5745aa380efb6417b5681104b007c8612fb496 upstream.
+
+Redo:
+
+ 5b7dba4: sched_clock: prevent scd->clock from moving backwards
+
+which had to be reverted due to s2ram hangs:
+
+ ca7e716: Revert "sched_clock: prevent scd->clock from moving backwards"
+
+... this time with resume restoring GTOD later in the sequence
+taken into account as well.
+
+The "timekeeping_suspended" flag is not very nice but we cannot call into
+GTOD before it has been properly resumed and the scheduler will run very
+early in the resume sequence.
+
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ include/linux/time.h | 1 +
+ kernel/sched_clock.c | 5 ++++-
+ kernel/time/timekeeping.c | 7 +++++--
+ 3 files changed, 10 insertions(+), 3 deletions(-)
+
+--- a/include/linux/time.h
++++ b/include/linux/time.h
+@@ -105,6 +105,7 @@ extern unsigned long read_persistent_clo
+ extern int update_persistent_clock(struct timespec now);
+ extern int no_sync_cmos_clock __read_mostly;
+ void timekeeping_init(void);
++extern int timekeeping_suspended;
+
+ unsigned long get_seconds(void);
+ struct timespec current_kernel_time(void);
+--- a/kernel/sched_clock.c
++++ b/kernel/sched_clock.c
+@@ -124,7 +124,7 @@ static u64 __update_sched_clock(struct s
+
+ clock = scd->tick_gtod + delta;
+ min_clock = wrap_max(scd->tick_gtod, scd->clock);
+- max_clock = scd->tick_gtod + TICK_NSEC;
++ max_clock = wrap_max(scd->clock, scd->tick_gtod + TICK_NSEC);
+
+ clock = wrap_max(clock, min_clock);
+ clock = wrap_min(clock, max_clock);
+@@ -227,6 +227,9 @@ EXPORT_SYMBOL_GPL(sched_clock_idle_sleep
+ */
+ void sched_clock_idle_wakeup_event(u64 delta_ns)
+ {
++ if (timekeeping_suspended)
++ return;
++
+ sched_clock_tick();
+ touch_softlockup_watchdog();
+ }
+--- a/kernel/time/timekeeping.c
++++ b/kernel/time/timekeeping.c
+@@ -46,6 +46,9 @@ struct timespec xtime __attribute__ ((al
+ struct timespec wall_to_monotonic __attribute__ ((aligned (16)));
+ static unsigned long total_sleep_time; /* seconds */
+
++/* flag for if timekeeping is suspended */
++int __read_mostly timekeeping_suspended;
++
+ static struct timespec xtime_cache __attribute__ ((aligned (16)));
+ void update_xtime_cache(u64 nsec)
+ {
+@@ -92,6 +95,8 @@ void getnstimeofday(struct timespec *ts)
+ unsigned long seq;
+ s64 nsecs;
+
++ WARN_ON(timekeeping_suspended);
++
+ do {
+ seq = read_seqbegin(&xtime_lock);
+
+@@ -299,8 +304,6 @@ void __init timekeeping_init(void)
+ write_sequnlock_irqrestore(&xtime_lock, flags);
+ }
+
+-/* flag for if timekeeping is suspended */
+-static int timekeeping_suspended;
+ /* time in seconds when suspend began */
+ static unsigned long timekeeping_suspend_time;
+
--- /dev/null
+From 58607b30fc0f2230a189500112c7a7cca02804cf Mon Sep 17 00:00:00 2001
+From: Larry Finger <Larry.Finger@lwfinger.net>
+Date: Sat, 3 Jan 2009 23:28:25 -0600
+Subject: SCSI: aha152x_cs: Fix regression that keeps driver from using shared interrupts
+
+From: Larry Finger <Larry.Finger@lwfinger.net>
+
+commit 58607b30fc0f2230a189500112c7a7cca02804cf upstream.
+
+At some point since 2.6.22, the aha152x_cs driver stopped working and
+started erring on load with the following messages:
+
+kernel: pcmcia: request for exclusive IRQ could not be fulfilled.
+kernel: pcmcia: the driver needs updating to supported shared IRQ lines.
+
+With the following change, the driver works with shared IRQs.
+
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/scsi/pcmcia/aha152x_stub.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/scsi/pcmcia/aha152x_stub.c
++++ b/drivers/scsi/pcmcia/aha152x_stub.c
+@@ -114,7 +114,7 @@ static int aha152x_probe(struct pcmcia_d
+ link->io.NumPorts1 = 0x20;
+ link->io.Attributes1 = IO_DATA_PATH_WIDTH_AUTO;
+ link->io.IOAddrLines = 10;
+- link->irq.Attributes = IRQ_TYPE_EXCLUSIVE;
++ link->irq.Attributes = IRQ_TYPE_DYNAMIC_SHARING;
+ link->irq.IRQInfo1 = IRQ_LEVEL_ID;
+ link->conf.Attributes = CONF_ENABLE_IRQ;
+ link->conf.IntType = INT_MEMORY_AND_IO;
tx4939ide-do-not-use-zero-count-prd-entry.patch
scsi-eata-fix-the-data-buffer-accessors-conversion-regression.patch
usb-emi26-fix-oops-on-load.patch
+x86-uv-remove-erroneous-bau-initialization.patch
+x86-fix-incorrect-__read_mostly-on-_boot_cpu_pda.patch
+vmalloc.c-fix-flushing-in-vmap_page_range.patch
+fs-symlink-write_begin-allocation-context-fix.patch
+cgroups-fix-a-race-between-cgroup_clone-and-umount.patch
+dm-raid1-fix-error-count.patch
+dm-log-fix-dm_io_client-leak-on-error-paths.patch
+minix-fix-add-link-s-wrong-position-calculation.patch
+md-fix-bitmap-on-external-file-bug.patch
+sched_clock-prevent-scd-clock-from-moving-backwards-take-2.patch
+devices-cgroup-allow-mkfifo.patch
+scsi-aha152x_cs-fix-regression-that-keeps-driver-from-using-shared-interrupts.patch
+ioat-fix-self-test-for-multi-channel-case.patch
+usb-isp1760-use-a-specific-plx-bridge-instead-of-any-bdridge.patch
+usb-isp1760-fix-probe-in-pci-glue-code.patch
+usb-unusual_devs.h-additions-for-pentax-k10d.patch
--- /dev/null
+From 6013bbbab0dcbc43bcf9dd70beeab2a0b1ec5ea7 Mon Sep 17 00:00:00 2001
+From: Karl Bongers <kbongers@jged.com>
+Date: Mon, 1 Dec 2008 11:47:40 +0100
+Subject: USB: isp1760: Fix probe in PCI glue code
+
+From: Karl Bongers <kbongers@jged.com>
+
+commit 6013bbbab0dcbc43bcf9dd70beeab2a0b1ec5ea7 upstream.
+
+Contains fixes so probe on x86 PCI runs, apparently I'm first to try
+this. Several fixes to memory access to probe host scratch register.
+Previously would bug check on chip_addr var used uninitialized.
+Scratch reg write failed in one instance due to 16-bit initial access
+mode, so added "& 0x0000ffff" to the readl as fix.
+Includes some general cleanup - remove global vars, organize memory map
+resource use.
+
+Signed-off-by: Karl Bongers <kbongers@jged.com>
+Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/host/isp1760-if.c | 97 +++++++++++++++++++++++-------------------
+ 1 file changed, 55 insertions(+), 42 deletions(-)
+
+--- a/drivers/usb/host/isp1760-if.c
++++ b/drivers/usb/host/isp1760-if.c
+@@ -129,23 +129,23 @@ static struct of_platform_driver isp1760
+ #endif
+
+ #ifdef CONFIG_PCI
+-static u32 nxp_pci_io_base;
+-static u32 iolength;
+-static u32 pci_mem_phy0;
+-static u32 length;
+-static u8 __iomem *chip_addr;
+-static u8 __iomem *iobase;
+-
+ static int __devinit isp1761_pci_probe(struct pci_dev *dev,
+ const struct pci_device_id *id)
+ {
+ u8 latency, limit;
+ __u32 reg_data;
+ int retry_count;
+- int length;
+- int status = 1;
+ struct usb_hcd *hcd;
+ unsigned int devflags = 0;
++ int ret_status = 0;
++
++ resource_size_t pci_mem_phy0;
++ resource_size_t memlength;
++
++ u8 __iomem *chip_addr;
++ u8 __iomem *iobase;
++ resource_size_t nxp_pci_io_base;
++ resource_size_t iolength;
+
+ if (usb_disabled())
+ return -ENODEV;
+@@ -168,26 +168,30 @@ static int __devinit isp1761_pci_probe(s
+ iobase = ioremap_nocache(nxp_pci_io_base, iolength);
+ if (!iobase) {
+ printk(KERN_ERR "ioremap #1\n");
+- release_mem_region(nxp_pci_io_base, iolength);
+- return -ENOMEM;
++ ret_status = -ENOMEM;
++ goto cleanup1;
+ }
+ /* Grab the PLX PCI shared memory of the ISP 1761 we need */
+ pci_mem_phy0 = pci_resource_start(dev, 3);
+- length = pci_resource_len(dev, 3);
+-
+- if (length < 0xffff) {
+- printk(KERN_ERR "memory length for this resource is less than "
+- "required\n");
+- release_mem_region(nxp_pci_io_base, iolength);
+- iounmap(iobase);
+- return -ENOMEM;
++ memlength = pci_resource_len(dev, 3);
++ if (memlength < 0xffff) {
++ printk(KERN_ERR "memory length for this resource is wrong\n");
++ ret_status = -ENOMEM;
++ goto cleanup2;
+ }
+
+- if (!request_mem_region(pci_mem_phy0, length, "ISP-PCI")) {
++ if (!request_mem_region(pci_mem_phy0, memlength, "ISP-PCI")) {
+ printk(KERN_ERR "host controller already in use\n");
+- release_mem_region(nxp_pci_io_base, iolength);
+- iounmap(iobase);
+- return -EBUSY;
++ ret_status = -EBUSY;
++ goto cleanup2;
++ }
++
++ /* map available memory */
++ chip_addr = ioremap_nocache(pci_mem_phy0,memlength);
++ if (!chip_addr) {
++ printk(KERN_ERR "Error ioremap failed\n");
++ ret_status = -ENOMEM;
++ goto cleanup3;
+ }
+
+ /* bad pci latencies can contribute to overruns */
+@@ -210,39 +214,54 @@ static int __devinit isp1761_pci_probe(s
+ * */
+ writel(0xface, chip_addr + HC_SCRATCH_REG);
+ udelay(100);
+- reg_data = readl(chip_addr + HC_SCRATCH_REG);
++ reg_data = readl(chip_addr + HC_SCRATCH_REG) & 0x0000ffff;
+ retry_count--;
+ }
+
++ iounmap(chip_addr);
++
+ /* Host Controller presence is detected by writing to scratch register
+ * and reading back and checking the contents are same or not
+ */
+ if (reg_data != 0xFACE) {
+ dev_err(&dev->dev, "scratch register mismatch %x\n", reg_data);
+- goto clean;
++ ret_status = -ENOMEM;
++ goto cleanup3;
+ }
+
+ pci_set_master(dev);
+
+- status = readl(iobase + 0x68);
+- status |= 0x900;
+- writel(status, iobase + 0x68);
++ /* configure PLX PCI chip to pass interrupts */
++#define PLX_INT_CSR_REG 0x68
++ reg_data = readl(iobase + PLX_INT_CSR_REG);
++ reg_data |= 0x900;
++ writel(reg_data, iobase + PLX_INT_CSR_REG);
+
+ dev->dev.dma_mask = NULL;
+- hcd = isp1760_register(pci_mem_phy0, length, dev->irq,
++ hcd = isp1760_register(pci_mem_phy0, memlength, dev->irq,
+ IRQF_SHARED | IRQF_DISABLED, &dev->dev, dev_name(&dev->dev),
+ devflags);
+- if (!IS_ERR(hcd)) {
+- pci_set_drvdata(dev, hcd);
+- return 0;
++ if (IS_ERR(hcd)) {
++ ret_status = -ENODEV;
++ goto cleanup3;
+ }
+-clean:
+- status = -ENODEV;
++
++ /* done with PLX IO access */
+ iounmap(iobase);
+- release_mem_region(pci_mem_phy0, length);
+ release_mem_region(nxp_pci_io_base, iolength);
+- return status;
++
++ pci_set_drvdata(dev, hcd);
++ return 0;
++
++cleanup3:
++ release_mem_region(pci_mem_phy0, memlength);
++cleanup2:
++ iounmap(iobase);
++cleanup1:
++ release_mem_region(nxp_pci_io_base, iolength);
++ return ret_status;
+ }
++
+ static void isp1761_pci_remove(struct pci_dev *dev)
+ {
+ struct usb_hcd *hcd;
+@@ -255,12 +274,6 @@ static void isp1761_pci_remove(struct pc
+ usb_put_hcd(hcd);
+
+ pci_disable_device(dev);
+-
+- iounmap(iobase);
+- iounmap(chip_addr);
+-
+- release_mem_region(nxp_pci_io_base, iolength);
+- release_mem_region(pci_mem_phy0, length);
+ }
+
+ static void isp1761_pci_shutdown(struct pci_dev *dev)
--- /dev/null
+From 6c0735687d37e25a65866823881bcbf39a6a023f Mon Sep 17 00:00:00 2001
+From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Date: Sun, 30 Nov 2008 16:50:04 +0100
+Subject: USB: isp1760: use a specific PLX bridge instead of any bdridge
+
+From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+
+commit 6c0735687d37e25a65866823881bcbf39a6a023f upstream.
+
+this driver can't handle (of course) any brdige class devices. So we
+now are just active on one specific bridge which should be only the
+isp1761 chip behind a PLX bridge.
+
+Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Tested-by: Karl Bongers <kblists08@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/host/isp1760-if.c | 16 ++++++++++------
+ 1 file changed, 10 insertions(+), 6 deletions(-)
+
+--- a/drivers/usb/host/isp1760-if.c
++++ b/drivers/usb/host/isp1760-if.c
+@@ -268,12 +268,16 @@ static void isp1761_pci_shutdown(struct
+ printk(KERN_ERR "ips1761_pci_shutdown\n");
+ }
+
+-static const struct pci_device_id isp1760_plx [] = { {
+- /* handle any USB 2.0 EHCI controller */
+- PCI_DEVICE_CLASS(((PCI_CLASS_BRIDGE_OTHER << 8) | (0x06 << 16)), ~0),
+- .driver_data = 0,
+-},
+-{ /* end: all zeroes */ }
++static const struct pci_device_id isp1760_plx [] = {
++ {
++ .class = PCI_CLASS_BRIDGE_OTHER << 8,
++ .class_mask = ~0,
++ .vendor = PCI_VENDOR_ID_PLX,
++ .device = 0x5406,
++ .subvendor = PCI_VENDOR_ID_PLX,
++ .subdevice = 0x9054,
++ },
++ { }
+ };
+ MODULE_DEVICE_TABLE(pci, isp1760_plx);
+
--- /dev/null
+From e3f47f89a57ef115755184a8b3f03a47ee227418 Mon Sep 17 00:00:00 2001
+From: Daniel Drake <dsd@gentoo.org>
+Date: Wed, 10 Dec 2008 23:28:25 +0200
+Subject: USB: unusual_devs.h additions for Pentax K10D
+
+From: Daniel Drake <dsd@gentoo.org>
+
+commit e3f47f89a57ef115755184a8b3f03a47ee227418 upstream.
+
+Jaak Ristioja reported problems with his Pentax K10D camera:
+https://bugs.gentoo.org/show_bug.cgi?id=250406
+
+/proc/bus/usb/devices:
+T: Bus=02 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=12 MxCh= 0
+D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1
+P: Vendor=0a17 ProdID=006e Rev= 1.00
+S: Manufacturer=PENTAX Corporation
+S: Product=K10D
+C:* #Ifs= 1 Cfg#= 1 Atr=c0 MxPwr= 2mA
+I:* If#= 0 Alt= 0 #EPs= 3 Cls=08(stor.) Sub=06 Prot=50 Driver=usb-storage
+E: Ad=81(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms
+E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms
+E: Ad=83(I) Atr=03(Int.) MxPS= 64 Ivl=100ms
+The number of reported sectors is off-by-one.
+
+Signed-off-by: Daniel Drake <dsd@gentoo.org>
+Cc: Kadianakis George <desnacked@gmail.com>
+Signed-off-by: Phil Dibowitz <phil@ipom.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/storage/unusual_devs.h | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/usb/storage/unusual_devs.h
++++ b/drivers/usb/storage/unusual_devs.h
+@@ -1425,6 +1425,13 @@ UNUSUAL_DEV( 0x0a17, 0x006, 0x0000, 0xff
+ US_SC_DEVICE, US_PR_DEVICE, NULL,
+ US_FL_FIX_INQUIRY ),
+
++/* Reported by Jaak Ristioja <Ristioja@gmail.com> */
++UNUSUAL_DEV( 0x0a17, 0x006e, 0x0100, 0x0100,
++ "Pentax",
++ "K10D",
++ US_SC_DEVICE, US_PR_DEVICE, NULL,
++ US_FL_FIX_CAPACITY ),
++
+ /* These are virtual windows driver CDs, which the zd1211rw driver
+ * automatically converts into WLAN devices. */
+ UNUSUAL_DEV( 0x0ace, 0x2011, 0x0101, 0x0101,
--- /dev/null
+From 2e4e27c7d082b2198b63041310609d7191185a9d Mon Sep 17 00:00:00 2001
+From: Adam Lackorzynski <adam@os.inf.tu-dresden.de>
+Date: Sun, 4 Jan 2009 12:00:46 -0800
+Subject: vmalloc.c: fix flushing in vmap_page_range()
+
+From: Adam Lackorzynski <adam@os.inf.tu-dresden.de>
+
+commit 2e4e27c7d082b2198b63041310609d7191185a9d upstream.
+
+The flush_cache_vmap in vmap_page_range() is called with the end of the
+range twice. The following patch fixes this for me.
+
+Signed-off-by: Adam Lackorzynski <adam@os.inf.tu-dresden.de>
+Cc: Nick Piggin <nickpiggin@yahoo.com.au>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ mm/vmalloc.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/mm/vmalloc.c
++++ b/mm/vmalloc.c
+@@ -151,11 +151,12 @@ static int vmap_pud_range(pgd_t *pgd, un
+ *
+ * Ie. pte at addr+N*PAGE_SIZE shall point to pfn corresponding to pages[N]
+ */
+-static int vmap_page_range(unsigned long addr, unsigned long end,
++static int vmap_page_range(unsigned long start, unsigned long end,
+ pgprot_t prot, struct page **pages)
+ {
+ pgd_t *pgd;
+ unsigned long next;
++ unsigned long addr = start;
+ int err = 0;
+ int nr = 0;
+
+@@ -167,7 +168,7 @@ static int vmap_page_range(unsigned long
+ if (err)
+ break;
+ } while (pgd++, addr = next, addr != end);
+- flush_cache_vmap(addr, end);
++ flush_cache_vmap(start, end);
+
+ if (unlikely(err))
+ return err;
--- /dev/null
+From 26799a63110dcbe81291ea53178f6b4810d07424 Mon Sep 17 00:00:00 2001
+From: Ravikiran G Thirumalai <kiran@scalex86.org>
+Date: Wed, 31 Dec 2008 13:44:46 -0800
+Subject: x86: fix incorrect __read_mostly on _boot_cpu_pda
+
+From: Ravikiran G Thirumalai <kiran@scalex86.org>
+
+commit 26799a63110dcbe81291ea53178f6b4810d07424 upstream.
+
+The pda rework (commit 3461b0af025251bbc6b3d56c821c6ac2de6f7209)
+to remove static boot cpu pdas introduced a performance bug.
+
+_boot_cpu_pda is the actual pda used by the boot cpu and is definitely
+not "__read_mostly" and ended up polluting the read mostly section with
+writes. This bug caused regression of about 8-10% on certain syscall
+intensive workloads.
+
+Signed-off-by: Ravikiran Thirumalai <kiran@scalex86.org>
+Acked-by: Mike Travis <travis@sgi.com>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/head64.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/x86/kernel/head64.c
++++ b/arch/x86/kernel/head64.c
+@@ -26,7 +26,7 @@
+ #include <asm/bios_ebda.h>
+
+ /* boot cpu pda */
+-static struct x8664_pda _boot_cpu_pda __read_mostly;
++static struct x8664_pda _boot_cpu_pda;
+
+ #ifdef CONFIG_SMP
+ /*
--- /dev/null
+From 46814dded1b972a07b1609d81632eef3009fbb10 Mon Sep 17 00:00:00 2001
+From: Cliff Wickman <cpw@sgi.com>
+Date: Wed, 31 Dec 2008 13:20:50 -0600
+Subject: x86, UV: remove erroneous BAU initialization
+
+From: Cliff Wickman <cpw@sgi.com>
+
+commit 46814dded1b972a07b1609d81632eef3009fbb10 upstream.
+
+Impact: fix crash on x86/UV
+
+UV is the SGI "UltraViolet" machine, which is x86_64 based.
+BAU is the "Broadcast Assist Unit", used for TLB shootdown in UV.
+
+This patch removes the allocation and initialization of an unused table.
+
+This table is left over from a development test mode. It is unused in
+the present code.
+
+And it was incorrectly initialized: 8 entries allocated but 17 initialized,
+causing slab corruption.
+
+This patch should go into 2.6.27 and 2.6.28 as well as the current tree.
+
+Diffed against 2.6.28 (linux-next, 12/30/08)
+
+Signed-off-by: Cliff Wickman <cpw@sgi.com>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/tlb_uv.c | 9 ---------
+ 1 file changed, 9 deletions(-)
+
+--- a/arch/x86/kernel/tlb_uv.c
++++ b/arch/x86/kernel/tlb_uv.c
+@@ -586,7 +586,6 @@ static int __init uv_ptc_init(void)
+ static struct bau_control * __init uv_table_bases_init(int blade, int node)
+ {
+ int i;
+- int *ip;
+ struct bau_msg_status *msp;
+ struct bau_control *bau_tabp;
+
+@@ -603,13 +602,6 @@ static struct bau_control * __init uv_ta
+ bau_cpubits_clear(&msp->seen_by, (int)
+ uv_blade_nr_possible_cpus(blade));
+
+- bau_tabp->watching =
+- kmalloc_node(sizeof(int) * DEST_NUM_RESOURCES, GFP_KERNEL, node);
+- BUG_ON(!bau_tabp->watching);
+-
+- for (i = 0, ip = bau_tabp->watching; i < DEST_Q_SIZE; i++, ip++)
+- *ip = 0;
+-
+ uv_bau_table_bases[blade] = bau_tabp;
+
+ return bau_tabp;
+@@ -632,7 +624,6 @@ uv_table_bases_finish(int blade, int nod
+ bcp->bau_msg_head = bau_tablesp->va_queue_first;
+ bcp->va_queue_first = bau_tablesp->va_queue_first;
+ bcp->va_queue_last = bau_tablesp->va_queue_last;
+- bcp->watching = bau_tablesp->watching;
+ bcp->msg_statuses = bau_tablesp->msg_statuses;
+ bcp->descriptor_base = adp;
+ }
projects / thirdparty / kernel / stable-queue.git / commitdiff
