--- /dev/null
+From gregkh@mini.kroah.org Wed Dec 16 17:15:57 2009
+Message-Id: <20091217011411.258723779@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 17:14:11 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk
+Subject: [00/90] 2.6.31.9-stable review
+
+This is the start of the stable review cycle for the 2.6.31.9 release.
+There are 90 patches in this series, all will be posted as a response to
+this one. If anyone has any issues with these being applied, please let
+us know. If anyone is a maintainer of the proper subsystem, and wants
+to add a Signed-off-by: line to the patch, please respond with it.
+
+Responses should be made by Friday, December 19, 00:00:00 UTC.
+Anything received after that time might be too late.
+
+The whole patch series can be found in one patch at:
+ kernel.org/pub/linux/kernel/v2.6/stable-review/patch-2.6.31.9-rc1.gz
+and the diffstat can be found below.
+
+
+thanks,
+
+greg k-h
+
+--------------
+
+ Documentation/kernel-parameters.txt | 2 +
+ Documentation/video4linux/gspca.txt | 1 +
+ Makefile | 2 +-
+ arch/arm/mach-pxa/em-x270.c | 11 +-
+ arch/powerpc/kernel/vector.S | 2 +-
+ arch/s390/include/asm/kvm.h | 3 +-
+ arch/s390/kvm/kvm-s390.c | 25 ++-
+ arch/sparc/Makefile | 2 +
+ arch/sparc/kernel/ldc.c | 4 +-
+ arch/sparc/kernel/of_device_64.c | 14 +-
+ arch/sparc/lib/mcount.S | 5 +-
+ arch/sparc/mm/init_64.h | 2 +-
+ arch/x86/include/asm/mce.h | 6 +
+ arch/x86/kernel/acpi/cstate.c | 2 +-
+ arch/x86/kernel/amd_iommu.c | 8 +-
+ arch/x86/kernel/amd_iommu_init.c | 2 +-
+ arch/x86/kernel/cpu/intel_cacheinfo.c | 5 +-
+ arch/x86/kernel/cpu/mcheck/mce.c | 3 +-
+ arch/x86/kernel/cpu/mcheck/therm_throt.c | 29 +++-
+ arch/x86/kernel/cpu/perfctr-watchdog.c | 2 +-
+ arch/x86/kernel/pci-calgary_64.c | 12 +-
+ arch/x86/kernel/pci-dma.c | 2 +-
+ arch/x86/kernel/pci-gart_64.c | 2 +-
+ arch/x86/kernel/reboot.c | 8 +
+ arch/x86/kernel/setup.c | 3 +
+ drivers/ata/pata_hpt37x.c | 32 ++--
+ drivers/ata/pata_hpt3x2n.c | 17 +-
+ drivers/firewire/ohci.c | 12 +-
+ drivers/gpu/drm/i915/i915_drv.h | 5 +
+ drivers/gpu/drm/i915/i915_reg.h | 2 +
+ drivers/gpu/drm/i915/i915_suspend.c | 2 +
+ drivers/gpu/drm/i915/intel_crt.c | 4 +-
+ drivers/gpu/drm/i915/intel_display.c | 66 ++++--
+ drivers/gpu/drm/i915/intel_tv.c | 11 +-
+ drivers/gpu/drm/radeon/radeon_atombios.c | 8 +
+ drivers/gpu/drm/radeon/radeon_legacy_crtc.c | 7 +-
+ drivers/ide/cmd64x.c | 6 +-
+ drivers/ide/ide-ioctls.c | 2 +-
+ drivers/ide/ide-probe.c | 9 -
+ drivers/ide/slc90e66.c | 3 +-
+ drivers/isdn/i4l/isdn_ppp.c | 342 ++++++++++++--------------
+ drivers/md/bitmap.c | 24 ++-
+ drivers/md/bitmap.h | 2 +-
+ drivers/md/md.c | 3 +-
+ drivers/md/md.h | 1 +
+ drivers/media/common/tuners/mxl5007t.c | 2 +-
+ drivers/media/video/gspca/ov519.c | 1 +
+ drivers/net/au1000_eth.c | 15 +-
+ drivers/net/b44.c | 6 +-
+ drivers/net/e100.c | 17 +-
+ drivers/net/smc91x.c | 2 +-
+ drivers/net/smsc9420.c | 14 +
+ drivers/net/wireless/ath/ath5k/eeprom.c | 3 +-
+ drivers/net/wireless/ath/ath5k/phy.c | 2 -
+ drivers/net/wireless/b43legacy/rfkill.c | 7 +
+ drivers/net/wireless/ipw2x00/ipw2100.c | 11 +
+ drivers/net/wireless/p54/p54usb.c | 10 +-
+ drivers/platform/x86/asus-laptop.c | 4 +-
+ drivers/platform/x86/thinkpad_acpi.c | 36 +---
+ drivers/serial/8250.c | 8 +-
+ drivers/serial/suncore.c | 37 ++--
+ drivers/serial/suncore.h | 5 +-
+ drivers/serial/sunhv.c | 2 +-
+ drivers/serial/sunsab.c | 9 +-
+ drivers/serial/sunsu.c | 36 +++-
+ drivers/serial/sunzilog.c | 8 +-
+ drivers/ssb/sprom.c | 20 ++-
+ drivers/usb/class/usbtmc.c | 14 +-
+ drivers/usb/core/usb.c | 31 ++--
+ drivers/usb/musb/musb_gadget_ep0.c | 1 -
+ drivers/usb/serial/option.c | 37 +++
+ drivers/usb/storage/transport.c | 17 +-
+ drivers/usb/storage/unusual_devs.h | 7 +
+ drivers/usb/storage/usb.c | 18 +-
+ drivers/video/backlight/lcd.c | 2 +-
+ drivers/video/matrox/g450_pll.c | 3 +-
+ fs/debugfs/inode.c | 55 +++--
+ fs/devpts/inode.c | 16 +-
+ fs/ext3/inode.c | 18 +-
+ fs/hfs/catalog.c | 4 +
+ fs/hfs/dir.c | 11 +
+ fs/hfs/super.c | 7 +-
+ fs/jbd2/journal.c | 7 +
+ fs/jffs2/gc.c | 3 +-
+ include/linux/hrtimer.h | 4 +-
+ include/linux/isdn_ppp.h | 2 +-
+ include/linux/kvm.h | 8 +-
+ include/linux/usb_usual.h | 4 +-
+ kernel/acct.c | 3 +-
+ kernel/futex.c | 10 +-
+ kernel/sysctl.c | 3 +-
+ mm/mincore.c | 37 +++
+ mm/pagewalk.c | 16 ++-
+ net/8021q/vlan.c | 7 +-
+ net/core/dev.c | 22 ++-
+ net/core/rtnetlink.c | 4 +-
+ net/core/skbuff.c | 3 +-
+ net/ipv4/ip_output.c | 2 +-
+ net/mac80211/util.c | 2 +-
+ net/netfilter/ipvs/ip_vs_ctl.c | 4 +
+ net/sunrpc/auth_gss/auth_gss.c | 2 +-
+ sound/core/hrtimer.c | 15 +-
+ sound/pci/hda/hda_intel.c | 5 +
+ 103 files changed, 872 insertions(+), 502 deletions(-)
+
+From gregkh@mini.kroah.org Wed Dec 16 17:15:58 2009
+Message-Id: <20091217011557.947684930@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 17:14:12 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Ming Zhao <zhao.ming9@zte.com.cn>
+Subject: [01/90] USB: option: add pid for ZTE
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: zhao.ming9@zte.com.cn <zhao.ming9@zte.com.cn>
+
+commit 8d87cacda7c8db5c131bfcaaa1d90bfe918c2ebc upstream.
+
+This patch adds ZTE modem devices.
+
+Signed-off-by: Ming Zhao <zhao.ming9@zte.com.cn>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/serial/option.c | 36 ++++++++++++++++++++++++++++++++++++
+ 1 file changed, 36 insertions(+)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -577,12 +577,48 @@ static struct usb_device_id option_ids[]
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0086, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x2002, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x2003, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0104, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0106, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0108, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0113, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0117, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0118, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0121, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0122, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0123, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0124, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0125, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0126, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0128, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0142, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0143, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0144, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0145, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0146, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0147, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0148, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0149, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0150, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0151, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0152, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0153, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0154, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0155, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0156, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0157, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0158, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0159, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0160, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0161, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0162, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0014, 0xff, 0xff, 0xff) }, /* ZTE CDMA products */
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0027, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0059, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0060, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0070, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0073, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0130, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0141, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_CDMA_TECH, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_AC8710, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_AC2726, 0xff, 0xff, 0xff) },
+
+
+From gregkh@mini.kroah.org Wed Dec 16 17:15:58 2009
+Message-Id: <20091217011558.080872855@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 17:14:13 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Alan Stern <stern@rowland.harvard.edu>
+Subject: [02/90] USB: usb-storage: fix bug in fill_inquiry
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit f3f6faa9edf67c1018270793e0547b0f81abb47e upstream.
+
+This patch (as1312) fixes a minor bug in usb-storage. The
+fill_inquiry() routine neglects to pre-load the inquiry data buffer
+with spaces. As a result, if the vendor name is shorter than 8
+characters or the product name is shorter than 16, the remainder will
+be filled with garbage.
+
+The patch also removes some unnecessary calls to strlen().
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/storage/usb.c | 15 ++++++++-------
+ 1 file changed, 8 insertions(+), 7 deletions(-)
+
+--- a/drivers/usb/storage/usb.c
++++ b/drivers/usb/storage/usb.c
+@@ -228,6 +228,7 @@ void fill_inquiry_response(struct us_dat
+ if (data_len<36) // You lose.
+ return;
+
++ memset(data+8, ' ', 28);
+ if(data[0]&0x20) { /* USB device currently not connected. Return
+ peripheral qualifier 001b ("...however, the
+ physical device is not currently connected
+@@ -237,15 +238,15 @@ void fill_inquiry_response(struct us_dat
+ device, it may return zeros or ASCII spaces
+ (20h) in those fields until the data is
+ available from the device."). */
+- memset(data+8,0,28);
+ } else {
+ u16 bcdDevice = le16_to_cpu(us->pusb_dev->descriptor.bcdDevice);
+- memcpy(data+8, us->unusual_dev->vendorName,
+- strlen(us->unusual_dev->vendorName) > 8 ? 8 :
+- strlen(us->unusual_dev->vendorName));
+- memcpy(data+16, us->unusual_dev->productName,
+- strlen(us->unusual_dev->productName) > 16 ? 16 :
+- strlen(us->unusual_dev->productName));
++ int n;
++
++ n = strlen(us->unusual_dev->vendorName);
++ memcpy(data+8, us->unusual_dev->vendorName, min(8, n));
++ n = strlen(us->unusual_dev->productName);
++ memcpy(data+16, us->unusual_dev->productName, min(16, n));
++
+ data[32] = 0x30 + ((bcdDevice>>12) & 0x0F);
+ data[33] = 0x30 + ((bcdDevice>>8) & 0x0F);
+ data[34] = 0x30 + ((bcdDevice>>4) & 0x0F);
+
+
+From gregkh@mini.kroah.org Wed Dec 16 17:15:58 2009
+Message-Id: <20091217011558.216332496@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 17:14:14 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jay Fenlason <fenlason@redhat.com>,
+ Stefan Richter <stefanr@s5r6.in-berlin.de>
+Subject: [03/90] firewire: ohci: handle receive packets with a data length of zero
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Jay Fenlason <fenlason@redhat.com>
+
+commit 8c0c0cc2d9f4c523fde04bdfe41e4380dec8ee54 upstream.
+
+Queueing to receive an ISO packet with a payload length of zero
+silently does nothing in dualbuffer mode, and crashes the kernel in
+packet-per-buffer mode. Return an error in dualbuffer mode, because
+the DMA controller won't let us do what we want, and work correctly in
+packet-per-buffer mode.
+
+Signed-off-by: Jay Fenlason <fenlason@redhat.com>
+Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/firewire/ohci.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+--- a/drivers/firewire/ohci.c
++++ b/drivers/firewire/ohci.c
+@@ -2180,6 +2180,13 @@ static int ohci_queue_iso_receive_dualbu
+ page = payload >> PAGE_SHIFT;
+ offset = payload & ~PAGE_MASK;
+ rest = p->payload_length;
++ /*
++ * The controllers I've tested have not worked correctly when
++ * second_req_count is zero. Rather than do something we know won't
++ * work, return an error
++ */
++ if (rest == 0)
++ return -EINVAL;
+
+ /* FIXME: make packet-per-buffer/dual-buffer a context option */
+ while (rest > 0) {
+@@ -2233,7 +2240,7 @@ static int ohci_queue_iso_receive_packet
+ unsigned long payload)
+ {
+ struct iso_context *ctx = container_of(base, struct iso_context, base);
+- struct descriptor *d = NULL, *pd = NULL;
++ struct descriptor *d, *pd;
+ struct fw_iso_packet *p = packet;
+ dma_addr_t d_bus, page_bus;
+ u32 z, header_z, rest;
+@@ -2271,8 +2278,9 @@ static int ohci_queue_iso_receive_packet
+ d->data_address = cpu_to_le32(d_bus + (z * sizeof(*d)));
+
+ rest = payload_per_buffer;
++ pd = d;
+ for (j = 1; j < z; j++) {
+- pd = d + j;
++ pd++;
+ pd->control = cpu_to_le16(DESCRIPTOR_STATUS |
+ DESCRIPTOR_INPUT_MORE);
+
+
+
+From gregkh@mini.kroah.org Wed Dec 16 17:15:58 2009
+Message-Id: <20091217011558.346236779@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 17:14:15 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jaroslav Kysela <perex@perex.cz>,
+ Takashi Iwai <tiwai@suse.de>
+Subject: [04/90] ALSA: hda - Terradici HDA controllers does not support 64-bit mode
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Jaroslav Kysela <perex@perex.cz>
+
+commit 396087eaead95fcb29eb36f1e59517aeb58c545e upstream.
+
+Confirmed from vendor and tests in RedHat bugzilla #536782 .
+
+Signed-off-by: Jaroslav Kysela <perex@perex.cz>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/hda/hda_intel.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -2392,6 +2392,11 @@ static int __devinit azx_create(struct s
+ }
+ }
+
++ /* disable 64bit DMA address for Teradici */
++ /* it does not work with device 6549:1200 subsys e4a2:040b */
++ if (chip->driver_type == AZX_DRIVER_TERA)
++ gcap &= ~ICH6_GCAP_64OK;
++
+ /* allow 64bit DMA address if supported by H/W */
+ if ((gcap & ICH6_GCAP_64OK) && !pci_set_dma_mask(pci, DMA_BIT_MASK(64)))
+ pci_set_consistent_dma_mask(pci, DMA_BIT_MASK(64));
+
+
+From gregkh@mini.kroah.org Wed Dec 16 17:15:58 2009
+Message-Id: <20091217011558.481887504@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 17:14:16 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Takashi Iwai <tiwai@suse.de>
+Subject: [05/90] ALSA: hrtimer - Fix lock-up
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit fcfdebe70759c74e2e701f69aaa7f0e5e32cf5a6 upstream.
+
+The timer stop callback can be called from snd_timer_interrupt(), which
+is called from the hrtimer callback. Since hrtimer_cancel() waits for
+the callback completion, this eventually results in a lock-up.
+
+This patch fixes the problem by just toggling a flag at stop callback
+and call hrtimer_cancel() later.
+
+Reported-and-tested-by: Wojtek Zabolotny <W.Zabolotny@elka.pw.edu.pl>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/core/hrtimer.c | 15 +++++++++++++--
+ 1 file changed, 13 insertions(+), 2 deletions(-)
+
+--- a/sound/core/hrtimer.c
++++ b/sound/core/hrtimer.c
+@@ -37,14 +37,22 @@ static unsigned int resolution;
+ struct snd_hrtimer {
+ struct snd_timer *timer;
+ struct hrtimer hrt;
++ atomic_t running;
+ };
+
+ static enum hrtimer_restart snd_hrtimer_callback(struct hrtimer *hrt)
+ {
+ struct snd_hrtimer *stime = container_of(hrt, struct snd_hrtimer, hrt);
+ struct snd_timer *t = stime->timer;
++
++ if (!atomic_read(&stime->running))
++ return HRTIMER_NORESTART;
++
+ hrtimer_forward_now(hrt, ns_to_ktime(t->sticks * resolution));
+ snd_timer_interrupt(stime->timer, t->sticks);
++
++ if (!atomic_read(&stime->running))
++ return HRTIMER_NORESTART;
+ return HRTIMER_RESTART;
+ }
+
+@@ -58,6 +66,7 @@ static int snd_hrtimer_open(struct snd_t
+ hrtimer_init(&stime->hrt, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
+ stime->timer = t;
+ stime->hrt.function = snd_hrtimer_callback;
++ atomic_set(&stime->running, 0);
+ t->private_data = stime;
+ return 0;
+ }
+@@ -78,16 +87,18 @@ static int snd_hrtimer_start(struct snd_
+ {
+ struct snd_hrtimer *stime = t->private_data;
+
++ atomic_set(&stime->running, 0);
++ hrtimer_cancel(&stime->hrt);
+ hrtimer_start(&stime->hrt, ns_to_ktime(t->sticks * resolution),
+ HRTIMER_MODE_REL);
++ atomic_set(&stime->running, 1);
+ return 0;
+ }
+
+ static int snd_hrtimer_stop(struct snd_timer *t)
+ {
+ struct snd_hrtimer *stime = t->private_data;
+-
+- hrtimer_cancel(&stime->hrt);
++ atomic_set(&stime->running, 0);
+ return 0;
+ }
+
+
+
+From gregkh@mini.kroah.org Wed Dec 16 17:15:58 2009
+Message-Id: <20091217011558.635603496@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 17:14:17 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Bob Copeland <me@bobcopeland.com>,
+ "John W. Linville" <linville@tuxdriver.com>
+Subject: [06/90] ath5k: allow setting txpower to 0
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Bob Copeland <me@bobcopeland.com>
+
+commit 2eb2fa67e5462a36e98172fb92c78bc405b3035f upstream.
+
+As a holdover from earlier code when we used to set
+the power limit to '0' after a reset to configure the
+default transmit power, ath5k interprets txpower=0 as
+12.5 dBm. Fix that by just passing 0 through.
+
+This fixes http://bugzilla.kernel.org/show_bug.cgi?id=14567
+
+Reported-by: Daniel Folkers <daniel.folkers@task24.nl>
+Tested-by: Daniel Folkers <daniel.folkers@task24.nl>
+Signed-off-by: Bob Copeland <me@bobcopeland.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/ath/ath5k/phy.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath5k/phy.c
++++ b/drivers/net/wireless/ath/ath5k/phy.c
+@@ -2931,8 +2931,6 @@ ath5k_hw_txpower(struct ath5k_hw *ah, st
+ ATH5K_ERR(ah->ah_sc, "invalid tx power: %u\n", txpower);
+ return -EINVAL;
+ }
+- if (txpower == 0)
+- txpower = AR5K_TUNE_DEFAULT_TXPOWER;
+
+ /* Reset TX power values */
+ memset(&ah->ah_txpower, 0, sizeof(ah->ah_txpower));
+
+
+From gregkh@mini.kroah.org Wed Dec 16 17:15:58 2009
+Message-Id: <20091217011558.748938366@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 17:14:18 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ jirislaby@gmail.com,
+ rjw@sisk.pl,
+ me@bobcopeland.com,
+ david.quan@atheros.com,
+ "Luis R. Rodriguez" <lrodriguez@atheros.com>,
+ "John W. Linville" <linville@tuxdriver.com>
+Subject: [07/90] ath5k: enable EEPROM checksum check
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Luis R. Rodriguez <lrodriguez@atheros.com>
+
+commit 512414b0bed0d376ac4d5ec1dd6f0b1a3551febc upstream.
+
+Without this we have no gaurantee of the integrity of the
+EEPROM and are likely to encounter a lot of bogus bug reports
+due to actual issues on the EEPROM. With the EEPROM checksum
+check in place we can easily rule those issues out.
+
+If you run patch during a revert *you* have a card with a busted
+EEPROM and only older kernel will support that concoction. This
+patch is a trade off between not accepitng bogus EEPROMs and
+avoiding bogus bug reports allowing developers to focus instead
+on real concrete issues.
+
+If stable keeps bogus bug reports because of a possibly busted EEPROM
+feel free to apply this there too.
+
+Tested on an AR5414
+
+Cc: jirislaby@gmail.com
+Cc: akpm@linux-foundation.org
+Cc: rjw@sisk.pl
+Cc: me@bobcopeland.com
+Cc: david.quan@atheros.com
+Signed-off-by: Luis R. Rodriguez <lrodriguez@atheros.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/ath/ath5k/eeprom.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath5k/eeprom.c
++++ b/drivers/net/wireless/ath/ath5k/eeprom.c
+@@ -97,6 +97,7 @@ ath5k_eeprom_init_header(struct ath5k_hw
+ struct ath5k_eeprom_info *ee = &ah->ah_capabilities.cap_eeprom;
+ int ret;
+ u16 val;
++ u32 cksum, offset;
+
+ /*
+ * Read values from EEPROM and store them in the capability structure
+@@ -111,7 +112,6 @@ ath5k_eeprom_init_header(struct ath5k_hw
+ if (ah->ah_ee_version < AR5K_EEPROM_VERSION_3_0)
+ return 0;
+
+-#ifdef notyet
+ /*
+ * Validate the checksum of the EEPROM date. There are some
+ * devices with invalid EEPROMs.
+@@ -124,7 +124,6 @@ ath5k_eeprom_init_header(struct ath5k_hw
+ ATH5K_ERR(ah->ah_sc, "Invalid EEPROM checksum 0x%04x\n", cksum);
+ return -EIO;
+ }
+-#endif
+
+ AR5K_EEPROM_READ_HDR(AR5K_EEPROM_ANT_GAIN(ah->ah_ee_version),
+ ee_ant_gain);
+
+
+From gregkh@mini.kroah.org Wed Dec 16 17:15:58 2009
+Message-Id: <20091217011558.884142808@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 17:14:19 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Alexey Dobriyan <adobriyan@gmail.com>,
+ Serge Hallyn <serue@us.ibm.com>,
+ David Howells <dhowells@redhat.com>,
+ James Morris <jmorris@namei.org>
+Subject: [08/90] bsdacct: fix uid/gid misreporting
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Alexey Dobriyan <adobriyan@gmail.com>
+
+commit 4b731d50ff3df6b9141a6c12b088e8eb0109e83c upstream.
+
+commit d8e180dcd5bbbab9cd3ff2e779efcf70692ef541 "bsdacct: switch
+credentials for writing to the accounting file" introduced credential
+switching during final acct data collecting. However, uid/gid pair
+continued to be collected from current which became credentials of who
+created acct file, not who exits.
+
+Addresses http://bugzilla.kernel.org/show_bug.cgi?id=14676
+
+Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
+Reported-by: Juho K. Juopperi <jkj@kapsi.fi>
+Acked-by: Serge Hallyn <serue@us.ibm.com>
+Acked-by: David Howells <dhowells@redhat.com>
+Reviewed-by: Michal Schmidt <mschmidt@redhat.com>
+Cc: James Morris <jmorris@namei.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/acct.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/kernel/acct.c
++++ b/kernel/acct.c
+@@ -536,7 +536,8 @@ static void do_acct_process(struct bsd_a
+ do_div(elapsed, AHZ);
+ ac.ac_btime = get_seconds() - elapsed;
+ /* we really need to bite the bullet and change layout */
+- current_uid_gid(&ac.ac_uid, &ac.ac_gid);
++ ac.ac_uid = orig_cred->uid;
++ ac.ac_gid = orig_cred->gid;
+ #if ACCT_VERSION==2
+ ac.ac_ahz = AHZ;
+ #endif
+
+
+From gregkh@mini.kroah.org Wed Dec 16 17:15:59 2009
+Message-Id: <20091217011559.013115552@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 17:14:20 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Mathieu Desnoyers <mathieu.desnoyers@polymtl.ca>
+Subject: [09/90] debugfs: fix create mutex racy fops and private data
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Mathieu Desnoyers <mathieu.desnoyers@polymtl.ca>
+
+commit d3a3b0adad0865c12e39b712ca89efbd0a3a0dbc upstream.
+
+Setting fops and private data outside of the mutex at debugfs file
+creation introduces a race where the files can be opened with the wrong
+file operations and private data. It is easy to trigger with a process
+waiting on file creation notification.
+
+Signed-off-by: Mathieu Desnoyers <mathieu.desnoyers@polymtl.ca>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/debugfs/inode.c | 55 ++++++++++++++++++++++++++++++-----------------------
+ 1 file changed, 32 insertions(+), 23 deletions(-)
+
+--- a/fs/debugfs/inode.c
++++ b/fs/debugfs/inode.c
+@@ -32,7 +32,9 @@ static struct vfsmount *debugfs_mount;
+ static int debugfs_mount_count;
+ static bool debugfs_registered;
+
+-static struct inode *debugfs_get_inode(struct super_block *sb, int mode, dev_t dev)
++static struct inode *debugfs_get_inode(struct super_block *sb, int mode, dev_t dev,
++ void *data, const struct file_operations *fops)
++
+ {
+ struct inode *inode = new_inode(sb);
+
+@@ -44,14 +46,18 @@ static struct inode *debugfs_get_inode(s
+ init_special_inode(inode, mode, dev);
+ break;
+ case S_IFREG:
+- inode->i_fop = &debugfs_file_operations;
++ inode->i_fop = fops ? fops : &debugfs_file_operations;
++ inode->i_private = data;
+ break;
+ case S_IFLNK:
+ inode->i_op = &debugfs_link_operations;
++ inode->i_fop = fops;
++ inode->i_private = data;
+ break;
+ case S_IFDIR:
+ inode->i_op = &simple_dir_inode_operations;
+- inode->i_fop = &simple_dir_operations;
++ inode->i_fop = fops ? fops : &simple_dir_operations;
++ inode->i_private = data;
+
+ /* directory inodes start off with i_nlink == 2
+ * (for "." entry) */
+@@ -64,7 +70,8 @@ static struct inode *debugfs_get_inode(s
+
+ /* SMP-safe */
+ static int debugfs_mknod(struct inode *dir, struct dentry *dentry,
+- int mode, dev_t dev)
++ int mode, dev_t dev, void *data,
++ const struct file_operations *fops)
+ {
+ struct inode *inode;
+ int error = -EPERM;
+@@ -72,7 +79,7 @@ static int debugfs_mknod(struct inode *d
+ if (dentry->d_inode)
+ return -EEXIST;
+
+- inode = debugfs_get_inode(dir->i_sb, mode, dev);
++ inode = debugfs_get_inode(dir->i_sb, mode, dev, data, fops);
+ if (inode) {
+ d_instantiate(dentry, inode);
+ dget(dentry);
+@@ -81,12 +88,13 @@ static int debugfs_mknod(struct inode *d
+ return error;
+ }
+
+-static int debugfs_mkdir(struct inode *dir, struct dentry *dentry, int mode)
++static int debugfs_mkdir(struct inode *dir, struct dentry *dentry, int mode,
++ void *data, const struct file_operations *fops)
+ {
+ int res;
+
+ mode = (mode & (S_IRWXUGO | S_ISVTX)) | S_IFDIR;
+- res = debugfs_mknod(dir, dentry, mode, 0);
++ res = debugfs_mknod(dir, dentry, mode, 0, data, fops);
+ if (!res) {
+ inc_nlink(dir);
+ fsnotify_mkdir(dir, dentry);
+@@ -94,18 +102,20 @@ static int debugfs_mkdir(struct inode *d
+ return res;
+ }
+
+-static int debugfs_link(struct inode *dir, struct dentry *dentry, int mode)
++static int debugfs_link(struct inode *dir, struct dentry *dentry, int mode,
++ void *data, const struct file_operations *fops)
+ {
+ mode = (mode & S_IALLUGO) | S_IFLNK;
+- return debugfs_mknod(dir, dentry, mode, 0);
++ return debugfs_mknod(dir, dentry, mode, 0, data, fops);
+ }
+
+-static int debugfs_create(struct inode *dir, struct dentry *dentry, int mode)
++static int debugfs_create(struct inode *dir, struct dentry *dentry, int mode,
++ void *data, const struct file_operations *fops)
+ {
+ int res;
+
+ mode = (mode & S_IALLUGO) | S_IFREG;
+- res = debugfs_mknod(dir, dentry, mode, 0);
++ res = debugfs_mknod(dir, dentry, mode, 0, data, fops);
+ if (!res)
+ fsnotify_create(dir, dentry);
+ return res;
+@@ -139,7 +149,9 @@ static struct file_system_type debug_fs_
+
+ static int debugfs_create_by_name(const char *name, mode_t mode,
+ struct dentry *parent,
+- struct dentry **dentry)
++ struct dentry **dentry,
++ void *data,
++ const struct file_operations *fops)
+ {
+ int error = 0;
+
+@@ -164,13 +176,16 @@ static int debugfs_create_by_name(const
+ if (!IS_ERR(*dentry)) {
+ switch (mode & S_IFMT) {
+ case S_IFDIR:
+- error = debugfs_mkdir(parent->d_inode, *dentry, mode);
++ error = debugfs_mkdir(parent->d_inode, *dentry, mode,
++ data, fops);
+ break;
+ case S_IFLNK:
+- error = debugfs_link(parent->d_inode, *dentry, mode);
++ error = debugfs_link(parent->d_inode, *dentry, mode,
++ data, fops);
+ break;
+ default:
+- error = debugfs_create(parent->d_inode, *dentry, mode);
++ error = debugfs_create(parent->d_inode, *dentry, mode,
++ data, fops);
+ break;
+ }
+ dput(*dentry);
+@@ -221,19 +236,13 @@ struct dentry *debugfs_create_file(const
+ if (error)
+ goto exit;
+
+- error = debugfs_create_by_name(name, mode, parent, &dentry);
++ error = debugfs_create_by_name(name, mode, parent, &dentry,
++ data, fops);
+ if (error) {
+ dentry = NULL;
+ simple_release_fs(&debugfs_mount, &debugfs_mount_count);
+ goto exit;
+ }
+-
+- if (dentry->d_inode) {
+- if (data)
+- dentry->d_inode->i_private = data;
+- if (fops)
+- dentry->d_inode->i_fop = fops;
+- }
+ exit:
+ return dentry;
+ }
+
+
+From gregkh@mini.kroah.org Wed Dec 16 17:15:59 2009
+Message-Id: <20091217011559.147532119@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 17:14:21 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Sukadev Bhattiprolu <sukadev@linux.vnet.ibm.com>
+Subject: [10/90] devpts_get_tty() should validate inode
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Sukadev Bhattiprolu <sukadev@linux.vnet.ibm.com>
+
+commit edfacdd6f81119b9005615593f2cbd94b8c7e2d8 upstream.
+
+devpts_get_tty() assumes that the inode passed in is associated with a valid
+pty. But if the only reference to the pty is via a bind-mount, the inode
+passed to devpts_get_tty() while valid, would refer to a pty that no longer
+exists.
+
+With a lot of debug effort, Grzegorz Nosek developed a small program (see
+below) to reproduce a crash on recent kernels. This crash is a regression
+introduced by the commit:
+
+ commit 527b3e4773628b30d03323a2cb5fb0d84441990f
+ Author: Sukadev Bhattiprolu <sukadev@us.ibm.com>
+ Date: Mon Oct 13 10:43:08 2008 +0100
+
+To fix, ensure that the dentry associated with the inode has not yet been
+deleted/unhashed by devpts_pty_kill().
+
+See also:
+https://lists.linux-foundation.org/pipermail/containers/2009-July/019273.html
+
+tty-bug.c:
+
+#define _GNU_SOURCE
+#include <fcntl.h>
+#include <sched.h>
+#include <stdlib.h>
+#include <sys/mount.h>
+#include <sys/signal.h>
+#include <unistd.h>
+#include <stdio.h>
+
+#include <linux/fs.h>
+
+void dummy(int sig)
+{
+}
+
+static int child(void *unused)
+{
+ int fd;
+
+ signal(SIGINT, dummy); signal(SIGHUP, dummy);
+ pause(); /* cheesy synchronisation to wait for /dev/pts/0 to appear */
+
+ mount("/dev/pts/0", "/dev/console", NULL, MS_BIND, NULL);
+ sleep(2);
+
+ fd = open("/dev/console", O_RDWR);
+ dup(0); dup(0);
+ write(1, "Hello world!\n", sizeof("Hello world!\n")-1);
+ return 0;
+}
+
+int main(void)
+{
+ pid_t pid;
+ char *stack;
+
+ stack = malloc(16384);
+ pid = clone(child, stack+16384, CLONE_NEWNS|SIGCHLD, NULL);
+
+ open("/dev/ptmx", O_RDWR|O_NOCTTY|O_NONBLOCK);
+
+ unlockpt(fd); grantpt(fd);
+
+ sleep(2);
+ kill(pid, SIGHUP);
+ sleep(1);
+ return 0; /* exit before child opens /dev/console */
+}
+
+Reported-by: Grzegorz Nosek <root@localdomain.pl>
+Signed-off-by: Sukadev Bhattiprolu <sukadev@linux.vnet.ibm.com>
+Tested-by: Serge Hallyn <serue@us.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/devpts/inode.c | 16 ++++++++++++++--
+ 1 file changed, 14 insertions(+), 2 deletions(-)
+
+--- a/fs/devpts/inode.c
++++ b/fs/devpts/inode.c
+@@ -518,11 +518,23 @@ int devpts_pty_new(struct inode *ptmx_in
+
+ struct tty_struct *devpts_get_tty(struct inode *pts_inode, int number)
+ {
++ struct dentry *dentry;
++ struct tty_struct *tty;
++
+ BUG_ON(pts_inode->i_rdev == MKDEV(TTYAUX_MAJOR, PTMX_MINOR));
+
++ /* Ensure dentry has not been deleted by devpts_pty_kill() */
++ dentry = d_find_alias(pts_inode);
++ if (!dentry)
++ return NULL;
++
++ tty = NULL;
+ if (pts_inode->i_sb->s_magic == DEVPTS_SUPER_MAGIC)
+- return (struct tty_struct *)pts_inode->i_private;
+- return NULL;
++ tty = (struct tty_struct *)pts_inode->i_private;
++
++ dput(dentry);
++
++ return tty;
+ }
+
+ void devpts_pty_kill(struct tty_struct *tty)
+
+
+From gregkh@mini.kroah.org Wed Dec 16 17:15:59 2009
+Message-Id: <20091217011559.279090025@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 17:14:22 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Andi Kleen <ak@linux.intel.com>,
+ Andrew Morton <akpm@linuxfoundation.org>,
+ Nick Piggin <npiggin@suse.de>,
+ Darren Hart <dvhltc@us.ibm.com>,
+ Peter Zijlstra <peterz@infradead.org>,
+ Thomas Gleixner <tglx@linutronix.de>
+Subject: [11/90] futex: Take mmap_sem for get_user_pages in fault_in_user_writeable
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Andi Kleen <andi@firstfloor.org>
+
+commit 722d0172377a5697919b9f7e5beb95165b1dec4e upstream.
+
+get_user_pages() must be called with mmap_sem held.
+
+Signed-off-by: Andi Kleen <ak@linux.intel.com>
+Cc: Andrew Morton <akpm@linuxfoundation.org>
+Cc: Nick Piggin <npiggin@suse.de>
+Cc: Darren Hart <dvhltc@us.ibm.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+LKML-Reference: <20091208121942.GA21298@basil.fritz.box>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/futex.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+--- a/kernel/futex.c
++++ b/kernel/futex.c
+@@ -303,8 +303,14 @@ void put_futex_key(int fshared, union fu
+ */
+ static int fault_in_user_writeable(u32 __user *uaddr)
+ {
+- int ret = get_user_pages(current, current->mm, (unsigned long)uaddr,
+- 1, 1, 0, NULL, NULL);
++ struct mm_struct *mm = current->mm;
++ int ret;
++
++ down_read(&mm->mmap_sem);
++ ret = get_user_pages(current, mm, (unsigned long)uaddr,
++ 1, 1, 0, NULL, NULL);
++ up_read(&mm->mmap_sem);
++
+ return ret < 0 ? ret : 0;
+ }
+
+
+
+From gregkh@mini.kroah.org Wed Dec 16 17:15:59 2009
+Message-Id: <20091217011559.424543346@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 17:14:23 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ WANG Cong <amwang@redhat.com>,
+ Eugene Teo <eteo@redhat.com>,
+ Roman Zippel <zippel@linux-m68k.org>,
+ Al Viro <viro@zeniv.linux.org.uk>,
+ Christoph Hellwig <hch@lst.de>,
+ Alexey Dobriyan <adobriyan@gmail.com>,
+ Dave Anderson <anderson@redhat.com>
+Subject: [12/90] hfs: fix a potential buffer overflow
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Amerigo Wang <amwang@redhat.com>
+
+commit ec81aecb29668ad71f699f4e7b96ec46691895b6 upstream.
+
+A specially-crafted Hierarchical File System (HFS) filesystem could cause
+a buffer overflow to occur in a process's kernel stack during a memcpy()
+call within the hfs_bnode_read() function (at fs/hfs/bnode.c:24). The
+attacker can provide the source buffer and length, and the destination
+buffer is a local variable of a fixed length. This local variable (passed
+as "&entry" from fs/hfs/dir.c:112 and allocated on line 60) is stored in
+the stack frame of hfs_bnode_read()'s caller, which is hfs_readdir().
+Because the hfs_readdir() function executes upon any attempt to read a
+directory on the filesystem, it gets called whenever a user attempts to
+inspect any filesystem contents.
+
+[amwang@redhat.com: modify this patch and fix coding style problems]
+Signed-off-by: WANG Cong <amwang@redhat.com>
+Cc: Eugene Teo <eteo@redhat.com>
+Cc: Roman Zippel <zippel@linux-m68k.org>
+Cc: Al Viro <viro@zeniv.linux.org.uk>
+Cc: Christoph Hellwig <hch@lst.de>
+Cc: Alexey Dobriyan <adobriyan@gmail.com>
+Cc: Dave Anderson <anderson@redhat.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/hfs/catalog.c | 4 ++++
+ fs/hfs/dir.c | 11 +++++++++++
+ fs/hfs/super.c | 7 ++++++-
+ 3 files changed, 21 insertions(+), 1 deletion(-)
+
+--- a/fs/hfs/catalog.c
++++ b/fs/hfs/catalog.c
+@@ -289,6 +289,10 @@ int hfs_cat_move(u32 cnid, struct inode
+ err = hfs_brec_find(&src_fd);
+ if (err)
+ goto out;
++ if (src_fd.entrylength > sizeof(entry) || src_fd.entrylength < 0) {
++ err = -EIO;
++ goto out;
++ }
+
+ hfs_bnode_read(src_fd.bnode, &entry, src_fd.entryoffset,
+ src_fd.entrylength);
+--- a/fs/hfs/dir.c
++++ b/fs/hfs/dir.c
+@@ -79,6 +79,11 @@ static int hfs_readdir(struct file *filp
+ filp->f_pos++;
+ /* fall through */
+ case 1:
++ if (fd.entrylength > sizeof(entry) || fd.entrylength < 0) {
++ err = -EIO;
++ goto out;
++ }
++
+ hfs_bnode_read(fd.bnode, &entry, fd.entryoffset, fd.entrylength);
+ if (entry.type != HFS_CDR_THD) {
+ printk(KERN_ERR "hfs: bad catalog folder thread\n");
+@@ -109,6 +114,12 @@ static int hfs_readdir(struct file *filp
+ err = -EIO;
+ goto out;
+ }
++
++ if (fd.entrylength > sizeof(entry) || fd.entrylength < 0) {
++ err = -EIO;
++ goto out;
++ }
++
+ hfs_bnode_read(fd.bnode, &entry, fd.entryoffset, fd.entrylength);
+ type = entry.type;
+ len = hfs_mac2asc(sb, strbuf, &fd.key->cat.CName);
+--- a/fs/hfs/super.c
++++ b/fs/hfs/super.c
+@@ -409,8 +409,13 @@ static int hfs_fill_super(struct super_b
+ /* try to get the root inode */
+ hfs_find_init(HFS_SB(sb)->cat_tree, &fd);
+ res = hfs_cat_find_brec(sb, HFS_ROOT_CNID, &fd);
+- if (!res)
++ if (!res) {
++ if (fd.entrylength > sizeof(rec) || fd.entrylength < 0) {
++ res = -EIO;
++ goto bail;
++ }
+ hfs_bnode_read(fd.bnode, &rec, fd.entryoffset, fd.entrylength);
++ }
+ if (res) {
+ hfs_find_exit(&fd);
+ goto bail_no_root;
+
+
+From gregkh@mini.kroah.org Wed Dec 16 17:15:59 2009
+Message-Id: <20091217011559.541241545@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 17:14:24 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Feng Tang <feng.tang@intel.com>,
+ Heiko Carstens <heiko.carstens@de.ibm.com>,
+ Thomas Gleixner <tglx@linutronix.de>
+Subject: [13/90] hrtimer: Fix /proc/timer_list regression
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Feng Tang <feng.tang@intel.com>
+
+commit 8629ea2eaba8ca0de2e38ce1b4a825e16255976e upstream.
+
+commit 507e1231 (timer stats: Optimize by adding quick check to avoid
+function calls) introduced a regression in /proc/timer_list.
+
+/proc/timer_list shows now
+ #0: <c27d46b0>, tick_sched_timer, S:01, <(null)>, /-1
+instead of
+ #0: <c27d46b0>, tick_sched_timer, S:01, hrtimer_start, swapper/0
+
+Revert the hrtimer quick check for now. The optimization needs more
+thought, but this is neither 2.6.32-rc7 nor stable material.
+
+[ tglx: - Removed unrelated changes from the original patch
+ - Prevent unneccesary call to timer_stats_update_stats
+ - massaged the changelog ]
+
+Signed-off-by: Feng Tang <feng.tang@intel.com>
+LKML-Reference: <alpine.LFD.2.00.0911181933540.24119@localhost.localdomain>
+Cc: Heiko Carstens <heiko.carstens@de.ibm.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ include/linux/hrtimer.h | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+--- a/include/linux/hrtimer.h
++++ b/include/linux/hrtimer.h
+@@ -448,7 +448,7 @@ extern void timer_stats_update_stats(voi
+
+ static inline void timer_stats_account_hrtimer(struct hrtimer *timer)
+ {
+- if (likely(!timer->start_site))
++ if (likely(!timer_stats_active))
+ return;
+ timer_stats_update_stats(timer, timer->start_pid, timer->start_site,
+ timer->function, timer->start_comm, 0);
+@@ -459,8 +459,6 @@ extern void __timer_stats_hrtimer_set_st
+
+ static inline void timer_stats_hrtimer_set_start_info(struct hrtimer *timer)
+ {
+- if (likely(!timer_stats_active))
+- return;
+ __timer_stats_hrtimer_set_start_info(timer, __builtin_return_address(0));
+ }
+
+
+
+From gregkh@mini.kroah.org Wed Dec 16 17:15:59 2009
+Message-Id: <20091217011559.676670596@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 17:14:25 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ "Theodore Tso" <tytso@mit.edu>
+Subject: [14/90] jbd2: dont wipe the journal on a failed journal checksum
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Theodore Ts'o <tytso@mit.edu>
+
+commit e6a47428de84e19fda52f21ab73fde2906c40d09 upstream.
+
+If there is a failed journal checksum, don't reset the journal. This
+allows for userspace programs to decide how to recover from this
+situation. It may be that ignoring the journal checksum failure might
+be a better way of recovering the file system. Once we add per-block
+checksums, we can definitely do better. Until then, a system
+administrator can try backing up the file system image (or taking a
+snapshot) and and trying to determine experimentally whether ignoring
+the checksum failure or aborting the journal replay results in less
+data loss.
+
+Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/jbd2/journal.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/fs/jbd2/journal.c
++++ b/fs/jbd2/journal.c
+@@ -1421,6 +1421,13 @@ int jbd2_journal_load(journal_t *journal
+ if (jbd2_journal_recover(journal))
+ goto recovery_error;
+
++ if (journal->j_failed_commit) {
++ printk(KERN_ERR "JBD2: journal transaction %u on %s "
++ "is corrupt.\n", journal->j_failed_commit,
++ journal->j_devname);
++ return -EIO;
++ }
++
+ /* OK, we've finished with the dynamic journal bits:
+ * reinitialise the dynamic contents of the superblock in memory
+ * and reset them on disk. */
+
+
+From gregkh@mini.kroah.org Wed Dec 16 17:15:59 2009
+Message-Id: <20091217011559.807451173@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 17:14:26 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Carsten Otte <cotte@de.ibm.com>,
+ Avi Kivity <avi@redhat.com>
+Subject: [15/90] KVM: s390: Make psw available on all exits, not just a subset
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Carsten Otte <carsteno@de.ibm.com>
+
+commit d7b0b5eb3000c6fb902f08c619fcd673a23d8fab upstream.
+
+This patch moves s390 processor status word into the base kvm_run
+struct and keeps it up-to date on all userspace exits.
+
+The userspace ABI is broken by this, however there are no applications
+in the wild using this. A capability check is provided so users can
+verify the updated API exists.
+
+Signed-off-by: Carsten Otte <cotte@de.ibm.com>
+Signed-off-by: Avi Kivity <avi@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/s390/include/asm/kvm.h | 3 ++-
+ arch/s390/kvm/kvm-s390.c | 25 +++++++++++++++++--------
+ include/linux/kvm.h | 8 ++++++--
+ 3 files changed, 25 insertions(+), 11 deletions(-)
+
+--- a/arch/s390/include/asm/kvm.h
++++ b/arch/s390/include/asm/kvm.h
+@@ -1,6 +1,5 @@
+ #ifndef __LINUX_KVM_S390_H
+ #define __LINUX_KVM_S390_H
+-
+ /*
+ * asm-s390/kvm.h - KVM s390 specific structures and definitions
+ *
+@@ -24,6 +23,8 @@ struct kvm_ioapic_state {
+ /* no IOAPIC for s390 */
+ };
+
++#define __KVM_S390
++
+ /* for KVM_GET_REGS and KVM_SET_REGS */
+ struct kvm_regs {
+ /* general purpose regs for s390 */
+--- a/arch/s390/kvm/kvm-s390.c
++++ b/arch/s390/kvm/kvm-s390.c
+@@ -115,10 +115,16 @@ long kvm_arch_dev_ioctl(struct file *fil
+
+ int kvm_dev_ioctl_check_extension(long ext)
+ {
++ int r;
++
+ switch (ext) {
++ case KVM_CAP_S390_PSW:
++ r = 1;
++ break;
+ default:
+- return 0;
++ r = 0;
+ }
++ return r;
+ }
+
+ /* Section: vm related */
+@@ -422,8 +428,10 @@ static int kvm_arch_vcpu_ioctl_set_initi
+ vcpu_load(vcpu);
+ if (atomic_read(&vcpu->arch.sie_block->cpuflags) & CPUSTAT_RUNNING)
+ rc = -EBUSY;
+- else
+- vcpu->arch.sie_block->gpsw = psw;
++ else {
++ vcpu->run->psw_mask = psw.mask;
++ vcpu->run->psw_addr = psw.addr;
++ }
+ vcpu_put(vcpu);
+ return rc;
+ }
+@@ -505,9 +513,6 @@ int kvm_arch_vcpu_ioctl_run(struct kvm_v
+
+ switch (kvm_run->exit_reason) {
+ case KVM_EXIT_S390_SIEIC:
+- vcpu->arch.sie_block->gpsw.mask = kvm_run->s390_sieic.mask;
+- vcpu->arch.sie_block->gpsw.addr = kvm_run->s390_sieic.addr;
+- break;
+ case KVM_EXIT_UNKNOWN:
+ case KVM_EXIT_S390_RESET:
+ break;
+@@ -515,6 +520,9 @@ int kvm_arch_vcpu_ioctl_run(struct kvm_v
+ BUG();
+ }
+
++ vcpu->arch.sie_block->gpsw.mask = kvm_run->psw_mask;
++ vcpu->arch.sie_block->gpsw.addr = kvm_run->psw_addr;
++
+ might_fault();
+
+ do {
+@@ -529,8 +537,6 @@ int kvm_arch_vcpu_ioctl_run(struct kvm_v
+ /* intercept cannot be handled in-kernel, prepare kvm-run */
+ kvm_run->exit_reason = KVM_EXIT_S390_SIEIC;
+ kvm_run->s390_sieic.icptcode = vcpu->arch.sie_block->icptcode;
+- kvm_run->s390_sieic.mask = vcpu->arch.sie_block->gpsw.mask;
+- kvm_run->s390_sieic.addr = vcpu->arch.sie_block->gpsw.addr;
+ kvm_run->s390_sieic.ipa = vcpu->arch.sie_block->ipa;
+ kvm_run->s390_sieic.ipb = vcpu->arch.sie_block->ipb;
+ rc = 0;
+@@ -542,6 +548,9 @@ int kvm_arch_vcpu_ioctl_run(struct kvm_v
+ rc = 0;
+ }
+
++ kvm_run->psw_mask = vcpu->arch.sie_block->gpsw.mask;
++ kvm_run->psw_addr = vcpu->arch.sie_block->gpsw.addr;
++
+ if (vcpu->sigset_active)
+ sigprocmask(SIG_SETMASK, &sigsaved, NULL);
+
+--- a/include/linux/kvm.h
++++ b/include/linux/kvm.h
+@@ -104,6 +104,11 @@ struct kvm_run {
+ __u64 cr8;
+ __u64 apic_base;
+
++#ifdef __KVM_S390
++ /* the processor status word for s390 */
++ __u64 psw_mask; /* psw upper half */
++ __u64 psw_addr; /* psw lower half */
++#endif
+ union {
+ /* KVM_EXIT_UNKNOWN */
+ struct {
+@@ -155,8 +160,6 @@ struct kvm_run {
+ /* KVM_EXIT_S390_SIEIC */
+ struct {
+ __u8 icptcode;
+- __u64 mask; /* psw upper half */
+- __u64 addr; /* psw lower half */
+ __u16 ipa;
+ __u32 ipb;
+ } s390_sieic;
+@@ -453,6 +456,7 @@ struct kvm_irq_routing {
+ };
+
+ #endif
++#define KVM_CAP_S390_PSW 42
+
+ /*
+ * ioctls for VM fds
+
+
+From gregkh@mini.kroah.org Wed Dec 16 17:16:00 2009
+Message-Id: <20091217011559.935025982@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 17:14:27 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ NeilBrown <neilb@suse.de>
+Subject: [16/90] md/bitmap: protect against bitmap removal while being updated.
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: NeilBrown <neilb@suse.de>
+
+commit aa5cbd103887011b4830355f88fb055f9ad2d556 upstream.
+
+A write intent bitmap can be removed from an array while the
+array is active.
+When this happens, all IO is suspended and flushed before the
+bitmap is removed.
+However it is possible that bitmap_daemon_work is still running to
+clear old bits from the bitmap. If it is, it can dereference the
+bitmap after it has been freed.
+
+So introduce a new mutex to protect bitmap_daemon_work and get it
+before destroying a bitmap.
+
+This is suitable for any current -stable kernel.
+
+Signed-off-by: NeilBrown <neilb@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/bitmap.c | 24 ++++++++++++++++++------
+ drivers/md/bitmap.h | 2 +-
+ drivers/md/md.c | 3 ++-
+ drivers/md/md.h | 1 +
+ 4 files changed, 22 insertions(+), 8 deletions(-)
+
+--- a/drivers/md/bitmap.c
++++ b/drivers/md/bitmap.c
+@@ -1077,23 +1077,31 @@ static bitmap_counter_t *bitmap_get_coun
+ * out to disk
+ */
+
+-void bitmap_daemon_work(struct bitmap *bitmap)
++void bitmap_daemon_work(mddev_t *mddev)
+ {
++ struct bitmap *bitmap;
+ unsigned long j;
+ unsigned long flags;
+ struct page *page = NULL, *lastpage = NULL;
+ int blocks;
+ void *paddr;
+
+- if (bitmap == NULL)
++ /* Use a mutex to guard daemon_work against
++ * bitmap_destroy.
++ */
++ mutex_lock(&mddev->bitmap_mutex);
++ bitmap = mddev->bitmap;
++ if (bitmap == NULL) {
++ mutex_unlock(&mddev->bitmap_mutex);
+ return;
++ }
+ if (time_before(jiffies, bitmap->daemon_lastrun + bitmap->daemon_sleep*HZ))
+ goto done;
+
+ bitmap->daemon_lastrun = jiffies;
+ if (bitmap->allclean) {
+ bitmap->mddev->thread->timeout = MAX_SCHEDULE_TIMEOUT;
+- return;
++ goto done;
+ }
+ bitmap->allclean = 1;
+
+@@ -1202,6 +1210,7 @@ void bitmap_daemon_work(struct bitmap *b
+ done:
+ if (bitmap->allclean == 0)
+ bitmap->mddev->thread->timeout = bitmap->daemon_sleep * HZ;
++ mutex_unlock(&mddev->bitmap_mutex);
+ }
+
+ static bitmap_counter_t *bitmap_get_counter(struct bitmap *bitmap,
+@@ -1538,9 +1547,9 @@ void bitmap_flush(mddev_t *mddev)
+ */
+ sleep = bitmap->daemon_sleep;
+ bitmap->daemon_sleep = 0;
+- bitmap_daemon_work(bitmap);
+- bitmap_daemon_work(bitmap);
+- bitmap_daemon_work(bitmap);
++ bitmap_daemon_work(mddev);
++ bitmap_daemon_work(mddev);
++ bitmap_daemon_work(mddev);
+ bitmap->daemon_sleep = sleep;
+ bitmap_update_sb(bitmap);
+ }
+@@ -1571,6 +1580,7 @@ static void bitmap_free(struct bitmap *b
+ kfree(bp);
+ kfree(bitmap);
+ }
++
+ void bitmap_destroy(mddev_t *mddev)
+ {
+ struct bitmap *bitmap = mddev->bitmap;
+@@ -1578,7 +1588,9 @@ void bitmap_destroy(mddev_t *mddev)
+ if (!bitmap) /* there was no bitmap */
+ return;
+
++ mutex_lock(&mddev->bitmap_mutex);
+ mddev->bitmap = NULL; /* disconnect from the md device */
++ mutex_unlock(&mddev->bitmap_mutex);
+ if (mddev->thread)
+ mddev->thread->timeout = MAX_SCHEDULE_TIMEOUT;
+
+--- a/drivers/md/bitmap.h
++++ b/drivers/md/bitmap.h
+@@ -282,7 +282,7 @@ void bitmap_close_sync(struct bitmap *bi
+ void bitmap_cond_end_sync(struct bitmap *bitmap, sector_t sector);
+
+ void bitmap_unplug(struct bitmap *bitmap);
+-void bitmap_daemon_work(struct bitmap *bitmap);
++void bitmap_daemon_work(mddev_t *mddev);
+ #endif
+
+ #endif
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -361,6 +361,7 @@ static mddev_t * mddev_find(dev_t unit)
+
+ mutex_init(&new->open_mutex);
+ mutex_init(&new->reconfig_mutex);
++ mutex_init(&new->bitmap_mutex);
+ INIT_LIST_HEAD(&new->disks);
+ INIT_LIST_HEAD(&new->all_mddevs);
+ init_timer(&new->safemode_timer);
+@@ -6595,7 +6596,7 @@ void md_check_recovery(mddev_t *mddev)
+
+
+ if (mddev->bitmap)
+- bitmap_daemon_work(mddev->bitmap);
++ bitmap_daemon_work(mddev);
+
+ if (mddev->ro)
+ return;
+--- a/drivers/md/md.h
++++ b/drivers/md/md.h
+@@ -289,6 +289,7 @@ struct mddev_s
+ * hot-adding a bitmap. It should
+ * eventually be settable by sysfs.
+ */
++ struct mutex bitmap_mutex;
+
+ struct list_head all_mddevs;
+ };
+
+
+From gregkh@mini.kroah.org Wed Dec 16 17:16:00 2009
+Message-Id: <20091217011600.063985666@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 17:14:28 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Sergei Shtylyov <sshtylyov@ru.mvista.com>,
+ Jeff Garzik <jgarzik@redhat.com>
+Subject: [17/90] pata_hpt{37x|3x2n}: fix timing register masks (take 2)
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Sergei Shtylyov <sshtylyov@ru.mvista.com>
+
+commit 5600c70e576199a7552e1c0fff43f3fe16f5566e upstream.
+
+These drivers inherited from the older 'hpt366' IDE driver the buggy timing
+register masks in their set_piomode() metods. As a result, too low command
+cycle active time is programmed for slow PIO modes. Quite fortunately, it's
+later "fixed up" by the set_dmamode() methods which also "helpfully" reprogram
+the command timings, usually to PIO mode 4; unfortunately, setting an UltraDMA
+mode #N also reprograms already set PIO data timings, usually to MWDMA mode #
+max(N, 2) timings...
+
+However, the drivers added some breakage of their own too: the bit that they
+set/clear to control the FIFO is sometimes wrong -- it's actually the MSB of
+the command cycle setup time; also, setting it in DMA mode is wrong as this
+bit is only for PIO actually and clearing it for PIO modes is not needed as
+no mode in any timing table has it set...
+
+Fix all this, inverting the masks while at it, like in the 'hpt366' and
+'pata_hpt366' drivers; bump the drivers' versions, accounting for recent
+patches that forgot to do it...
+
+Signed-off-by: Sergei Shtylyov <sshtylyov@ru.mvista.com>
+Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/ata/pata_hpt37x.c | 32 +++++++++++++++-----------------
+ drivers/ata/pata_hpt3x2n.c | 17 ++++++++---------
+ 2 files changed, 23 insertions(+), 26 deletions(-)
+
+--- a/drivers/ata/pata_hpt37x.c
++++ b/drivers/ata/pata_hpt37x.c
+@@ -24,7 +24,7 @@
+ #include <linux/libata.h>
+
+ #define DRV_NAME "pata_hpt37x"
+-#define DRV_VERSION "0.6.12"
++#define DRV_VERSION "0.6.14"
+
+ struct hpt_clock {
+ u8 xfer_speed;
+@@ -404,9 +404,8 @@ static void hpt370_set_piomode(struct at
+
+ pci_read_config_dword(pdev, addr1, ®);
+ mode = hpt37x_find_mode(ap, adev->pio_mode);
+- mode &= ~0x8000000; /* No FIFO in PIO */
+- mode &= ~0x30070000; /* Leave config bits alone */
+- reg &= 0x30070000; /* Strip timing bits */
++ mode &= 0xCFC3FFFF; /* Leave DMA bits alone */
++ reg &= ~0xCFC3FFFF; /* Strip timing bits */
+ pci_write_config_dword(pdev, addr1, reg | mode);
+ }
+
+@@ -423,8 +422,7 @@ static void hpt370_set_dmamode(struct at
+ {
+ struct pci_dev *pdev = to_pci_dev(ap->host->dev);
+ u32 addr1, addr2;
+- u32 reg;
+- u32 mode;
++ u32 reg, mode, mask;
+ u8 fast;
+
+ addr1 = 0x40 + 4 * (adev->devno + 2 * ap->port_no);
+@@ -436,11 +434,12 @@ static void hpt370_set_dmamode(struct at
+ fast |= 0x01;
+ pci_write_config_byte(pdev, addr2, fast);
+
++ mask = adev->dma_mode < XFER_UDMA_0 ? 0x31C001FF : 0x303C0000;
++
+ pci_read_config_dword(pdev, addr1, ®);
+ mode = hpt37x_find_mode(ap, adev->dma_mode);
+- mode |= 0x8000000; /* FIFO in MWDMA or UDMA */
+- mode &= ~0xC0000000; /* Leave config bits alone */
+- reg &= 0xC0000000; /* Strip timing bits */
++ mode &= mask;
++ reg &= ~mask;
+ pci_write_config_dword(pdev, addr1, reg | mode);
+ }
+
+@@ -508,9 +507,8 @@ static void hpt372_set_piomode(struct at
+ mode = hpt37x_find_mode(ap, adev->pio_mode);
+
+ printk("Find mode for %d reports %X\n", adev->pio_mode, mode);
+- mode &= ~0x80000000; /* No FIFO in PIO */
+- mode &= ~0x30070000; /* Leave config bits alone */
+- reg &= 0x30070000; /* Strip timing bits */
++ mode &= 0xCFC3FFFF; /* Leave DMA bits alone */
++ reg &= ~0xCFC3FFFF; /* Strip timing bits */
+ pci_write_config_dword(pdev, addr1, reg | mode);
+ }
+
+@@ -527,8 +525,7 @@ static void hpt372_set_dmamode(struct at
+ {
+ struct pci_dev *pdev = to_pci_dev(ap->host->dev);
+ u32 addr1, addr2;
+- u32 reg;
+- u32 mode;
++ u32 reg, mode, mask;
+ u8 fast;
+
+ addr1 = 0x40 + 4 * (adev->devno + 2 * ap->port_no);
+@@ -539,12 +536,13 @@ static void hpt372_set_dmamode(struct at
+ fast &= ~0x07;
+ pci_write_config_byte(pdev, addr2, fast);
+
++ mask = adev->dma_mode < XFER_UDMA_0 ? 0x31C001FF : 0x303C0000;
++
+ pci_read_config_dword(pdev, addr1, ®);
+ mode = hpt37x_find_mode(ap, adev->dma_mode);
+ printk("Find mode for DMA %d reports %X\n", adev->dma_mode, mode);
+- mode &= ~0xC0000000; /* Leave config bits alone */
+- mode |= 0x80000000; /* FIFO in MWDMA or UDMA */
+- reg &= 0xC0000000; /* Strip timing bits */
++ mode &= mask;
++ reg &= ~mask;
+ pci_write_config_dword(pdev, addr1, reg | mode);
+ }
+
+--- a/drivers/ata/pata_hpt3x2n.c
++++ b/drivers/ata/pata_hpt3x2n.c
+@@ -25,7 +25,7 @@
+ #include <linux/libata.h>
+
+ #define DRV_NAME "pata_hpt3x2n"
+-#define DRV_VERSION "0.3.4"
++#define DRV_VERSION "0.3.7"
+
+ enum {
+ HPT_PCI_FAST = (1 << 31),
+@@ -185,9 +185,8 @@ static void hpt3x2n_set_piomode(struct a
+
+ pci_read_config_dword(pdev, addr1, ®);
+ mode = hpt3x2n_find_mode(ap, adev->pio_mode);
+- mode &= ~0x8000000; /* No FIFO in PIO */
+- mode &= ~0x30070000; /* Leave config bits alone */
+- reg &= 0x30070000; /* Strip timing bits */
++ mode &= 0xCFC3FFFF; /* Leave DMA bits alone */
++ reg &= ~0xCFC3FFFF; /* Strip timing bits */
+ pci_write_config_dword(pdev, addr1, reg | mode);
+ }
+
+@@ -204,8 +203,7 @@ static void hpt3x2n_set_dmamode(struct a
+ {
+ struct pci_dev *pdev = to_pci_dev(ap->host->dev);
+ u32 addr1, addr2;
+- u32 reg;
+- u32 mode;
++ u32 reg, mode, mask;
+ u8 fast;
+
+ addr1 = 0x40 + 4 * (adev->devno + 2 * ap->port_no);
+@@ -216,11 +214,12 @@ static void hpt3x2n_set_dmamode(struct a
+ fast &= ~0x07;
+ pci_write_config_byte(pdev, addr2, fast);
+
++ mask = adev->dma_mode < XFER_UDMA_0 ? 0x31C001FF : 0x303C0000;
++
+ pci_read_config_dword(pdev, addr1, ®);
+ mode = hpt3x2n_find_mode(ap, adev->dma_mode);
+- mode |= 0x8000000; /* FIFO in MWDMA or UDMA */
+- mode &= ~0xC0000000; /* Leave config bits alone */
+- reg &= 0xC0000000; /* Strip timing bits */
++ mode &= mask;
++ reg &= ~mask;
+ pci_write_config_dword(pdev, addr1, reg | mode);
+ }
+
+
+
+From gregkh@mini.kroah.org Wed Dec 16 17:16:00 2009
+Message-Id: <20091217011600.203236971@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 17:14:29 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Igor Grinberg <grinberg@compulab.co.il>,
+ Mike Rapoport <mike@compulab.co.il>,
+ Eric Miao <eric.y.miao@gmail.com>
+Subject: [18/90] [ARM] pxa/em-x270: fix usb hub power up/reset sequence
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Igor Grinberg <grinberg@compulab.co.il>
+
+commit 1b82e4c32fba96d8805b1e2126ba5382e56fac32 upstream.
+
+Signed-off-by: Igor Grinberg <grinberg@compulab.co.il>
+Signed-off-by: Mike Rapoport <mike@compulab.co.il>
+Signed-off-by: Eric Miao <eric.y.miao@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/arm/mach-pxa/em-x270.c | 11 +++++------
+ 1 file changed, 5 insertions(+), 6 deletions(-)
+
+--- a/arch/arm/mach-pxa/em-x270.c
++++ b/arch/arm/mach-pxa/em-x270.c
+@@ -497,16 +497,15 @@ static int em_x270_usb_hub_init(void)
+ goto err_free_vbus_gpio;
+
+ /* USB Hub power-on and reset */
+- gpio_direction_output(usb_hub_reset, 0);
++ gpio_direction_output(usb_hub_reset, 1);
++ gpio_direction_output(GPIO9_USB_VBUS_EN, 0);
+ regulator_enable(em_x270_usb_ldo);
+- gpio_set_value(usb_hub_reset, 1);
+ gpio_set_value(usb_hub_reset, 0);
++ gpio_set_value(usb_hub_reset, 1);
+ regulator_disable(em_x270_usb_ldo);
+ regulator_enable(em_x270_usb_ldo);
+- gpio_set_value(usb_hub_reset, 1);
+-
+- /* enable VBUS */
+- gpio_direction_output(GPIO9_USB_VBUS_EN, 1);
++ gpio_set_value(usb_hub_reset, 0);
++ gpio_set_value(GPIO9_USB_VBUS_EN, 1);
+
+ return 0;
+
+
+
+From gregkh@mini.kroah.org Wed Dec 16 17:16:00 2009
+Message-Id: <20091217011600.331719222@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 17:14:30 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Michael Buesch <mb@bu3sch.de>,
+ "John W. Linville" <linville@tuxdriver.com>
+Subject: [19/90] ssb: Fix range check in sprom write
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Michael Buesch <mb@bu3sch.de>
+
+commit e33761e6f23881de9f3ee77cc2204ab2e26f3d9a upstream.
+
+The range check in the sprom image parser hex2sprom() is broken.
+One sprom word is 4 hex characters.
+This fixes the check and also adds much better sanity checks to the code.
+We better make sure the image is OK by doing some sanity checks to avoid
+bricking the device by accident.
+
+Signed-off-by: Michael Buesch <mb@bu3sch.de>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/ssb/sprom.c | 20 ++++++++++++++++----
+ 1 file changed, 16 insertions(+), 4 deletions(-)
+
+--- a/drivers/ssb/sprom.c
++++ b/drivers/ssb/sprom.c
+@@ -13,6 +13,8 @@
+
+ #include "ssb_private.h"
+
++#include <linux/ctype.h>
++
+
+ static const struct ssb_sprom *fallback_sprom;
+
+@@ -33,17 +35,27 @@ static int sprom2hex(const u16 *sprom, c
+ static int hex2sprom(u16 *sprom, const char *dump, size_t len,
+ size_t sprom_size_words)
+ {
+- char tmp[5] = { 0 };
+- int cnt = 0;
++ char c, tmp[5] = { 0 };
++ int err, cnt = 0;
+ unsigned long parsed;
+
+- if (len < sprom_size_words * 2)
++ /* Strip whitespace at the end. */
++ while (len) {
++ c = dump[len - 1];
++ if (!isspace(c) && c != '\0')
++ break;
++ len--;
++ }
++ /* Length must match exactly. */
++ if (len != sprom_size_words * 4)
+ return -EINVAL;
+
+ while (cnt < sprom_size_words) {
+ memcpy(tmp, dump, 4);
+ dump += 4;
+- parsed = simple_strtoul(tmp, NULL, 16);
++ err = strict_strtoul(tmp, 16, &parsed);
++ if (err)
++ return err;
+ sprom[cnt++] = swab16((u16)parsed);
+ }
+
+
+
+From gregkh@mini.kroah.org Wed Dec 16 17:16:00 2009
+Message-Id: <20091217011600.472766906@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 17:14:31 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Roel Kluin <roel.kluin@gmail.com>,
+ Trond Myklebust <Trond.Myklebust@netapp.com>
+Subject: [20/90] SUNRPC: IS_ERR/PTR_ERR confusion
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Roel Kluin <roel.kluin@gmail.com>
+
+commit 480e3243df156e39eea6c91057e2ae612a6bbe19 upstream.
+
+IS_ERR returns 1 or 0, PTR_ERR returns the error value.
+
+Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
+Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/sunrpc/auth_gss/auth_gss.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/sunrpc/auth_gss/auth_gss.c
++++ b/net/sunrpc/auth_gss/auth_gss.c
+@@ -485,7 +485,7 @@ gss_refresh_upcall(struct rpc_task *task
+ dprintk("RPC: %5u gss_refresh_upcall for uid %u\n", task->tk_pid,
+ cred->cr_uid);
+ gss_msg = gss_setup_upcall(task->tk_client, gss_auth, cred);
+- if (IS_ERR(gss_msg) == -EAGAIN) {
++ if (PTR_ERR(gss_msg) == -EAGAIN) {
+ /* XXX: warning on the first, under the assumption we
+ * shouldn't normally hit this case on a refresh. */
+ warn_gssd();
+
+
+From gregkh@mini.kroah.org Wed Dec 16 17:16:00 2009
+Message-Id: <20091217011600.604399403@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 17:14:32 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Russ Dill <Russ.Dill@gmail.com>
+Subject: [21/90] USB: Close usb_find_interface race v3
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Russ Dill <Russ.Dill@gmail.com>
+
+commit c2d284ee04ab6f6718de2ddcf1b43160e046c41d upstream.
+
+USB drivers that create character devices call usb_register_dev in their
+probe function. This associates the usb_interface device with that minor
+number and creates the character device and announces it to the world.
+However, the driver's probe function is called before the new
+usb_interface is added to the driver's klist_devices.
+
+This is a problem because userspace will respond to the character device
+creation announcement by opening the character device. The driver's open
+function will the call usb_find_interface to find the usb_interface
+associated with that minor number. usb_find_interface will walk the
+driver's list of devices and find the usb_interface with the matching
+minor number.
+
+Because the announcement happens before the usb_interface is added to the
+driver's klist_devices, a race condition exists. A straightforward fix
+is to walk the list of devices on usb_bus_type instead since the device
+is added to that list before the announcement occurs.
+
+bus_find_device calls get_device to bump the reference count on the found
+device. It is arguable that the reference count should be dropped by the
+caller of usb_find_interface instead of usb_find_interface, however,
+the current users of usb_find_interface do not expect this.
+
+The original version of this patch only matched against minor number
+instead of driver and minor number. This version matches against both.
+
+Signed-off-by: Russ Dill <Russ.Dill@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/core/usb.c | 31 ++++++++++++++++---------------
+ 1 file changed, 16 insertions(+), 15 deletions(-)
+
+--- a/drivers/usb/core/usb.c
++++ b/drivers/usb/core/usb.c
+@@ -132,7 +132,7 @@ EXPORT_SYMBOL_GPL(usb_altnum_to_altsetti
+
+ struct find_interface_arg {
+ int minor;
+- struct usb_interface *interface;
++ struct device_driver *drv;
+ };
+
+ static int __find_interface(struct device *dev, void *data)
+@@ -143,12 +143,10 @@ static int __find_interface(struct devic
+ if (!is_usb_interface(dev))
+ return 0;
+
++ if (dev->driver != arg->drv)
++ return 0;
+ intf = to_usb_interface(dev);
+- if (intf->minor != -1 && intf->minor == arg->minor) {
+- arg->interface = intf;
+- return 1;
+- }
+- return 0;
++ return intf->minor == arg->minor;
+ }
+
+ /**
+@@ -156,21 +154,24 @@ static int __find_interface(struct devic
+ * @drv: the driver whose current configuration is considered
+ * @minor: the minor number of the desired device
+ *
+- * This walks the driver device list and returns a pointer to the interface
+- * with the matching minor. Note, this only works for devices that share the
+- * USB major number.
++ * This walks the bus device list and returns a pointer to the interface
++ * with the matching minor and driver. Note, this only works for devices
++ * that share the USB major number.
+ */
+ struct usb_interface *usb_find_interface(struct usb_driver *drv, int minor)
+ {
+ struct find_interface_arg argb;
+- int retval;
++ struct device *dev;
+
+ argb.minor = minor;
+- argb.interface = NULL;
+- /* eat the error, it will be in argb.interface */
+- retval = driver_for_each_device(&drv->drvwrap.driver, NULL, &argb,
+- __find_interface);
+- return argb.interface;
++ argb.drv = &drv->drvwrap.driver;
++
++ dev = bus_find_device(&usb_bus_type, NULL, &argb, __find_interface);
++
++ /* Drop reference count from bus_find_device */
++ put_device(dev);
++
++ return dev ? to_usb_interface(dev) : NULL;
+ }
+ EXPORT_SYMBOL_GPL(usb_find_interface);
+
+
+
+From gregkh@mini.kroah.org Wed Dec 16 17:16:00 2009
+Message-Id: <20091217011600.734038780@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 17:14:33 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Sergei Shtylyov <sshtylyov@ru.mvista.com>,
+ Anand Gadiyar <gadiyar@ti.com>
+Subject: [22/90] USB: musb_gadget_ep0: fix unhandled endpoint 0 IRQs, again
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Sergei Shtylyov <sshtylyov@ru.mvista.com>
+
+commit 196f1b7a387546f425df2f1fad26772e3d513aea upstream.
+
+Commit a5073b52833e4df8e16c93dc4cbb7e0c558c74a2 (musb_gadget: fix
+unhandled endpoint 0 IRQs) somehow missed its key change:
+
+"The gadget EP0 code routinely ignores an interrupt at end of
+the data phase because of musb_g_ep0_giveback() resetting the
+state machine to "idle, waiting for SETUP" phase prematurely."
+
+So, the majority of the cases of unhandled IRQs is still unfixed...
+
+Signed-off-by: Sergei Shtylyov <sshtylyov@ru.mvista.com>
+Signed-off-by: Anand Gadiyar <gadiyar@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/musb/musb_gadget_ep0.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/drivers/usb/musb/musb_gadget_ep0.c
++++ b/drivers/usb/musb/musb_gadget_ep0.c
+@@ -199,7 +199,6 @@ service_in_request(struct musb *musb, co
+ static void musb_g_ep0_giveback(struct musb *musb, struct usb_request *req)
+ {
+ musb_g_giveback(&musb->endpoints[0].ep_in, req, 0);
+- musb->ep0_state = MUSB_EP0_STAGE_SETUP;
+ }
+
+ /*
+
+
+From gregkh@mini.kroah.org Wed Dec 16 17:16:00 2009
+Message-Id: <20091217011600.862764776@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 17:14:34 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Zhang Le <r0bertz@gentoo.org>
+Subject: [23/90] USB: option.c: add support for D-Link DWM-162-U5
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Zhang Le <r0bertz@gentoo.org>
+
+commit 54a8e144acad6506920f385f4ef2779664f05b21 upstream.
+
+Add D-Link DWM-162-U5 device id 1e0e:ce16 into option driver. The device
+has 4 interfaces, of which 1 is handled by storage and the other 3 by
+option driver.
+
+The device appears first as CD-only 05c6:2100 device and must be switched
+to 1e0e:ce16 mode either by using "eject CD" or usb_modeswitch.
+
+The MessageContent for usb_modeswitch.conf is:
+"55534243e0c26a85000000000000061b000000020000000000000000000000"
+
+Signed-off-by: Zhang Le <r0bertz@gentoo.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/serial/option.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -632,6 +632,7 @@ static struct usb_device_id option_ids[]
+ { USB_DEVICE(TOSHIBA_VENDOR_ID, TOSHIBA_PRODUCT_G450) },
+ { USB_DEVICE(TOSHIBA_VENDOR_ID, TOSHIBA_PRODUCT_HSDPA_MINICARD ) }, /* Toshiba 3G HSDPA == Novatel Expedite EU870D MiniCard */
+ { USB_DEVICE(ALINK_VENDOR_ID, 0x9000) },
++ { USB_DEVICE(ALINK_VENDOR_ID, 0xce16) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ALINK_VENDOR_ID, ALINK_PRODUCT_3GU, 0xff, 0xff, 0xff) },
+ { USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_X060S) },
+ { USB_DEVICE(AIRPLUS_VENDOR_ID, AIRPLUS_PRODUCT_MCD650) },
+
+
+From gregkh@mini.kroah.org Wed Dec 16 17:16:01 2009
+Message-Id: <20091217011600.998528574@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 17:14:35 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Alan Stern <stern@rowland.harvard.edu>
+Subject: [24/90] USB: usb-storage: add BAD_SENSE flag
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit a0bb108112a872c0b0c4b3ef4974f95fb75b155d upstream.
+
+This patch (as1311) fixes a problem in usb-storage: Some devices are
+pretty broken when it comes to reporting sense data. The information
+they send back indicates that they have more than 18 bytes of sense
+data available, but when the system asks for more than 18 they fail or
+hang. The symptom is that probing fails with multiple resets.
+
+The patch adds a new BAD_SENSE flag to indicate that usb-storage
+should never ask for more than 18 bytes of sense data. The flag can
+be set in an unusual_devs entry or via the "quirks=" module parameter,
+and it is set automatically whenever a REQUEST SENSE command for more
+than 18 bytes fails or times out.
+
+An unusual_devs entry is added for the Agfa photo frame, which uses a
+Prolific chip having this bug.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Tested-by: Daniel Kukula <daniel.kuku@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ Documentation/kernel-parameters.txt | 2 ++
+ drivers/usb/storage/transport.c | 17 +++++++++++++----
+ drivers/usb/storage/unusual_devs.h | 7 +++++++
+ drivers/usb/storage/usb.c | 3 +++
+ include/linux/usb_usual.h | 4 +++-
+ 5 files changed, 28 insertions(+), 5 deletions(-)
+
+--- a/Documentation/kernel-parameters.txt
++++ b/Documentation/kernel-parameters.txt
+@@ -2561,6 +2561,8 @@ and is between 256 and 4096 characters.
+ to a common usb-storage quirk flag as follows:
+ a = SANE_SENSE (collect more than 18 bytes
+ of sense data);
++ b = BAD_SENSE (don't collect more than 18
++ bytes of sense data);
+ c = FIX_CAPACITY (decrease the reported
+ device capacity by one sector);
+ h = CAPACITY_HEURISTICS (decrease the
+--- a/drivers/usb/storage/transport.c
++++ b/drivers/usb/storage/transport.c
+@@ -666,10 +666,11 @@ void usb_stor_invoke_transport(struct sc
+ * to wait for at least one CHECK_CONDITION to determine
+ * SANE_SENSE support
+ */
+- if ((srb->cmnd[0] == ATA_16 || srb->cmnd[0] == ATA_12) &&
++ if (unlikely((srb->cmnd[0] == ATA_16 || srb->cmnd[0] == ATA_12) &&
+ result == USB_STOR_TRANSPORT_GOOD &&
+ !(us->fflags & US_FL_SANE_SENSE) &&
+- !(srb->cmnd[2] & 0x20)) {
++ !(us->fflags & US_FL_BAD_SENSE) &&
++ !(srb->cmnd[2] & 0x20))) {
+ US_DEBUGP("-- SAT supported, increasing auto-sense\n");
+ us->fflags |= US_FL_SANE_SENSE;
+ }
+@@ -718,6 +719,12 @@ Retry_Sense:
+ if (test_bit(US_FLIDX_TIMED_OUT, &us->dflags)) {
+ US_DEBUGP("-- auto-sense aborted\n");
+ srb->result = DID_ABORT << 16;
++
++ /* If SANE_SENSE caused this problem, disable it */
++ if (sense_size != US_SENSE_SIZE) {
++ us->fflags &= ~US_FL_SANE_SENSE;
++ us->fflags |= US_FL_BAD_SENSE;
++ }
+ goto Handle_Errors;
+ }
+
+@@ -727,10 +734,11 @@ Retry_Sense:
+ * (small) sense request. This fixes some USB GSM modems
+ */
+ if (temp_result == USB_STOR_TRANSPORT_FAILED &&
+- (us->fflags & US_FL_SANE_SENSE) &&
+- sense_size != US_SENSE_SIZE) {
++ sense_size != US_SENSE_SIZE) {
+ US_DEBUGP("-- auto-sense failure, retry small sense\n");
+ sense_size = US_SENSE_SIZE;
++ us->fflags &= ~US_FL_SANE_SENSE;
++ us->fflags |= US_FL_BAD_SENSE;
+ goto Retry_Sense;
+ }
+
+@@ -754,6 +762,7 @@ Retry_Sense:
+ */
+ if (srb->sense_buffer[7] > (US_SENSE_SIZE - 8) &&
+ !(us->fflags & US_FL_SANE_SENSE) &&
++ !(us->fflags & US_FL_BAD_SENSE) &&
+ (srb->sense_buffer[0] & 0x7C) == 0x70) {
+ US_DEBUGP("-- SANE_SENSE support enabled\n");
+ us->fflags |= US_FL_SANE_SENSE;
+--- a/drivers/usb/storage/unusual_devs.h
++++ b/drivers/usb/storage/unusual_devs.h
+@@ -838,6 +838,13 @@ UNUSUAL_DEV( 0x066f, 0x8000, 0x0001, 0x0
+ US_SC_DEVICE, US_PR_DEVICE, NULL,
+ US_FL_FIX_CAPACITY ),
+
++/* Reported by Daniel Kukula <daniel.kuku@gmail.com> */
++UNUSUAL_DEV( 0x067b, 0x1063, 0x0100, 0x0100,
++ "Prolific Technology, Inc.",
++ "Prolific Storage Gadget",
++ US_SC_DEVICE, US_PR_DEVICE, NULL,
++ US_FL_BAD_SENSE ),
++
+ /* Reported by Rogerio Brito <rbrito@ime.usp.br> */
+ UNUSUAL_DEV( 0x067b, 0x2317, 0x0001, 0x001,
+ "Prolific Technology, Inc.",
+--- a/drivers/usb/storage/usb.c
++++ b/drivers/usb/storage/usb.c
+@@ -460,6 +460,9 @@ static void adjust_quirks(struct us_data
+ case 'a':
+ f |= US_FL_SANE_SENSE;
+ break;
++ case 'b':
++ f |= US_FL_BAD_SENSE;
++ break;
+ case 'c':
+ f |= US_FL_FIX_CAPACITY;
+ break;
+--- a/include/linux/usb_usual.h
++++ b/include/linux/usb_usual.h
+@@ -56,7 +56,9 @@
+ US_FLAG(SANE_SENSE, 0x00008000) \
+ /* Sane Sense (> 18 bytes) */ \
+ US_FLAG(CAPACITY_OK, 0x00010000) \
+- /* READ CAPACITY response is correct */
++ /* READ CAPACITY response is correct */ \
++ US_FLAG(BAD_SENSE, 0x00020000) \
++ /* Bad Sense (never more than 18 bytes) */
+
+ #define US_FLAG(name, value) US_FL_##name = value ,
+ enum { US_DO_ALL_FLAGS };
+
+
+From gregkh@mini.kroah.org Wed Dec 16 17:16:01 2009
+Message-Id: <20091217011601.125726102@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 17:14:36 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Andre Herms <andre.herms@tec-venture.de>
+Subject: [25/90] USB: usbtmc: repeat usb_bulk_msg until whole message is transfered
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Andre Herms <andre.herms@tec-venture.de>
+
+commit ec412b92dbe3ea839716853eea058d1bcc5e6ca4 upstream.
+
+usb_bulk_msg() transfers only bytes up to the maximum packet size.
+It must be repeated by the usbtmc driver until all bytes of a TMC message
+are transfered.
+
+Without this patch, ETIMEDOUT is reported when writing TMC messages
+larger than the maximum USB bulk size and the transfer remains incomplete.
+The user will notice that the device hangs and must be reset by either closing
+the application or pulling the plug.
+
+Signed-off-by: Andre Herms <andre.herms@tec-venture.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/class/usbtmc.c | 14 ++++++++++----
+ 1 file changed, 10 insertions(+), 4 deletions(-)
+
+--- a/drivers/usb/class/usbtmc.c
++++ b/drivers/usb/class/usbtmc.c
+@@ -545,10 +545,16 @@ static ssize_t usbtmc_write(struct file
+ n_bytes = roundup(12 + this_part, 4);
+ memset(buffer + 12 + this_part, 0, n_bytes - (12 + this_part));
+
+- retval = usb_bulk_msg(data->usb_dev,
+- usb_sndbulkpipe(data->usb_dev,
+- data->bulk_out),
+- buffer, n_bytes, &actual, USBTMC_TIMEOUT);
++ do {
++ retval = usb_bulk_msg(data->usb_dev,
++ usb_sndbulkpipe(data->usb_dev,
++ data->bulk_out),
++ buffer, n_bytes,
++ &actual, USBTMC_TIMEOUT);
++ if (retval != 0)
++ break;
++ n_bytes -= actual;
++ } while (n_bytes);
+
+ data->bTag_last_write = data->bTag;
+ data->bTag++;
+
+
+From gregkh@mini.kroah.org Wed Dec 16 17:16:01 2009
+Message-Id: <20091217011601.254418435@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 17:14:37 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Roel Kluin <roel.kluin@gmail.com>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Mauro Carvalho Chehab <mchehab@redhat.com>
+Subject: [26/90] V4L/DVB: Fix test in copy_reg_bits()
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Roel Kluin <roel.kluin@gmail.com>
+
+commit c95a419a5604ec8a23cd73f61e9bb151e8cbe89b upstream.
+
+The reg_pair2[j].reg was tested twice.
+
+Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
+Acked-by: Michael Krufky <mkrufky@linuxtv.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/media/common/tuners/mxl5007t.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/media/common/tuners/mxl5007t.c
++++ b/drivers/media/common/tuners/mxl5007t.c
+@@ -196,7 +196,7 @@ static void copy_reg_bits(struct reg_pai
+ i = j = 0;
+
+ while (reg_pair1[i].reg || reg_pair1[i].val) {
+- while (reg_pair2[j].reg || reg_pair2[j].reg) {
++ while (reg_pair2[j].reg || reg_pair2[j].val) {
+ if (reg_pair1[i].reg != reg_pair2[j].reg) {
+ j++;
+ continue;
+
+
+From gregkh@mini.kroah.org Wed Dec 16 17:16:01 2009
+Message-Id: <20091217011601.389918723@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 17:14:38 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Dave Jones <davej@redhat.com>,
+ Ingo Molnar <mingo@elte.hu>
+Subject: [27/90] x86: Add new Intel CPU cache size descriptors
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Dave Jones <davej@redhat.com>
+
+commit 85160b92fbd35321104819283c91bfed2b553e3c upstream.
+
+The latest rev of Intel doc AP-485 details new cache descriptors
+that we don't yet support. 12MB, 18MB and 24MB 24-way assoc L3
+caches.
+
+Signed-off-by: Dave Jones <davej@redhat.com>
+LKML-Reference: <20091110184924.GA20337@redhat.com>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/cpu/intel_cacheinfo.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/arch/x86/kernel/cpu/intel_cacheinfo.c
++++ b/arch/x86/kernel/cpu/intel_cacheinfo.c
+@@ -101,6 +101,9 @@ static const struct _cache_table __cpuin
+ { 0xe2, LVL_3, 2048 }, /* 16-way set assoc, 64 byte line size */
+ { 0xe3, LVL_3, 4096 }, /* 16-way set assoc, 64 byte line size */
+ { 0xe4, LVL_3, 8192 }, /* 16-way set assoc, 64 byte line size */
++ { 0xea, LVL_3, 12288 }, /* 24-way set assoc, 64 byte line size */
++ { 0xeb, LVL_3, 18432 }, /* 24-way set assoc, 64 byte line size */
++ { 0xec, LVL_3, 24576 }, /* 24-way set assoc, 64 byte line size */
+ { 0x00, 0, 0}
+ };
+
+
+
+From gregkh@mini.kroah.org Wed Dec 16 17:16:01 2009
+Message-Id: <20091217011601.522223439@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 17:14:39 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Joerg Roedel <joerg.roedel@amd.com>
+Subject: [28/90] x86/amd-iommu: attach devices to pre-allocated domains early
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Joerg Roedel <joerg.roedel@amd.com>
+
+commit be831297716036de5b24308447ecb69f1706a846 upstream.
+
+For some devices the ACPI table may define unity map
+requirements which must me met when the IOMMU is enabled. So
+we need to attach devices to their domains as early as
+possible so that these mappings are in place when needed.
+This patch assigns the domains right after they are
+allocated. Otherwise this can result in I/O page faults
+before a driver binds to a device and BIOS is still using
+it.
+
+Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/amd_iommu.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/arch/x86/kernel/amd_iommu.c
++++ b/arch/x86/kernel/amd_iommu.c
+@@ -1873,10 +1873,10 @@ static void prealloc_protection_domains(
+ struct pci_dev *dev = NULL;
+ struct dma_ops_domain *dma_dom;
+ struct amd_iommu *iommu;
+- u16 devid;
++ u16 devid, __devid;
+
+ while ((dev = pci_get_device(PCI_ANY_ID, PCI_ANY_ID, dev)) != NULL) {
+- devid = calc_devid(dev->bus->number, dev->devfn);
++ __devid = devid = calc_devid(dev->bus->number, dev->devfn);
+ if (devid > amd_iommu_last_bdf)
+ continue;
+ devid = amd_iommu_alias_table[devid];
+@@ -1891,6 +1891,10 @@ static void prealloc_protection_domains(
+ init_unity_mappings_for_device(dma_dom, devid);
+ dma_dom->target_dev = devid;
+
++ attach_device(iommu, &dma_dom->domain, devid);
++ if (__devid != devid)
++ attach_device(iommu, &dma_dom->domain, __devid);
++
+ list_add_tail(&dma_dom->list, &iommu_pd_list);
+ }
+ }
+
+
+From gregkh@mini.kroah.org Wed Dec 16 17:16:01 2009
+Message-Id: <20091217011601.657714019@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 17:14:40 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Joerg Roedel <joerg.roedel@amd.com>
+Subject: [29/90] x86/amd-iommu: un__init iommu_setup_msi
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Joerg Roedel <joerg.roedel@amd.com>
+
+commit 9f800de38b05d84809e89f16671d636a140eede7 upstream.
+
+This function may be called on the resume path and can not
+be dropped after booting.
+
+Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/amd_iommu_init.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/x86/kernel/amd_iommu_init.c
++++ b/arch/x86/kernel/amd_iommu_init.c
+@@ -915,7 +915,7 @@ static int __init init_iommu_all(struct
+ *
+ ****************************************************************************/
+
+-static int __init iommu_setup_msi(struct amd_iommu *iommu)
++static int iommu_setup_msi(struct amd_iommu *iommu)
+ {
+ int r;
+
+
+
+From gregkh@mini.kroah.org Wed Dec 16 17:16:01 2009
+Message-Id: <20091217011601.788409461@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 17:14:41 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Mikael Pettersson <mikpe@it.uu.se>,
+ Andreas Herrmann <andreas.herrmann3@amd.com>,
+ Joerg Roedel <joerg.roedel@amd.com>,
+ Ingo Molnar <mingo@elte.hu>
+Subject: [30/90] x86, apic: Enable lapic nmi watchdog on AMD Family 11h
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Mikael Pettersson <mikpe@it.uu.se>
+
+commit 7d1849aff6687a135a8da3a75e32a00e3137a5e2 upstream.
+
+The x86 lapic nmi watchdog does not recognize AMD Family 11h,
+resulting in:
+
+ NMI watchdog: CPU not supported
+
+As far as I can see from available documentation (the BKDM),
+family 11h looks identical to family 10h as far as the PMU
+is concerned.
+
+Extending the check to accept family 11h results in:
+
+ Testing NMI watchdog ... OK.
+
+I've been running with this change on a Turion X2 Ultra ZM-82
+laptop for a couple of weeks now without problems.
+
+Signed-off-by: Mikael Pettersson <mikpe@it.uu.se>
+Cc: Andreas Herrmann <andreas.herrmann3@amd.com>
+Cc: Joerg Roedel <joerg.roedel@amd.com>
+LKML-Reference: <19223.53436.931768.278021@pilspetsen.it.uu.se>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/cpu/perfctr-watchdog.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/x86/kernel/cpu/perfctr-watchdog.c
++++ b/arch/x86/kernel/cpu/perfctr-watchdog.c
+@@ -711,7 +711,7 @@ static void probe_nmi_watchdog(void)
+ switch (boot_cpu_data.x86_vendor) {
+ case X86_VENDOR_AMD:
+ if (boot_cpu_data.x86 != 6 && boot_cpu_data.x86 != 15 &&
+- boot_cpu_data.x86 != 16)
++ boot_cpu_data.x86 != 16 && boot_cpu_data.x86 != 17)
+ return;
+ wd_ops = &k7_wd_ops;
+ break;
+
+
+From gregkh@mini.kroah.org Wed Dec 16 17:16:02 2009
+Message-Id: <20091217011601.921010092@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 17:14:42 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Leann Ogasawara <leann.ogasawara@canonical.com>,
+ "H. Peter Anvin" <hpa@zytor.com>
+Subject: [31/90] x86: ASUS P4S800 reboot=bios quirk
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Leann Ogasawara <leann.ogasawara@canonical.com>
+
+commit 4832ddda2ec4df96ea1eed334ae2dbd65fc1f541 upstream.
+
+Bug reporter noted their system with an ASUS P4S800 motherboard would
+hang when rebooting unless reboot=b was specified. Their dmidecode
+didn't contain descriptive System Information for Manufacturer or
+Product Name, so I used their Base Board Information to create a
+reboot quirk patch. The bug reporter confirmed this patch resolves
+the reboot hang.
+
+Handle 0x0001, DMI type 1, 25 bytes
+System Information
+ Manufacturer: System Manufacturer
+ Product Name: System Name
+ Version: System Version
+ Serial Number: SYS-1234567890
+ UUID: E0BFCD8B-7948-D911-A953-E486B4EEB67F
+ Wake-up Type: Power Switch
+
+Handle 0x0002, DMI type 2, 8 bytes
+Base Board Information
+ Manufacturer: ASUSTeK Computer INC.
+ Product Name: P4S800
+ Version: REV 1.xx
+ Serial Number: xxxxxxxxxxx
+
+BugLink: http://bugs.launchpad.net/bugs/366682
+
+ASUS P4S800 will hang when rebooting unless reboot=b is specified.
+Add a quirk to reboot through the bios.
+
+Signed-off-by: Leann Ogasawara <leann.ogasawara@canonical.com>
+LKML-Reference: <1259972107.4629.275.camel@emiko>
+Signed-off-by: H. Peter Anvin <hpa@zytor.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/reboot.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/arch/x86/kernel/reboot.c
++++ b/arch/x86/kernel/reboot.c
+@@ -257,6 +257,14 @@ static struct dmi_system_id __initdata r
+ DMI_MATCH(DMI_PRODUCT_NAME, "SBC-FITPC2"),
+ },
+ },
++ { /* Handle problems with rebooting on ASUS P4S800 */
++ .callback = set_bios_reboot,
++ .ident = "ASUS P4S800",
++ .matches = {
++ DMI_MATCH(DMI_BOARD_VENDOR, "ASUSTeK Computer INC."),
++ DMI_MATCH(DMI_BOARD_NAME, "P4S800"),
++ },
++ },
+ { }
+ };
+
+
+
+From gregkh@mini.kroah.org Wed Dec 16 17:16:02 2009
+Message-Id: <20091217011602.051155536@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 17:14:43 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ "Darrick J. Wong" <djwong@us.ibm.com>,
+ Muli Ben-Yehuda <muli@il.ibm.com>,
+ FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>,
+ Joerg Roedel <joerg.roedel@amd.com>,
+ Yinghai Lu <yhlu.kernel@gmail.com>,
+ "Jon D. Mason" <jdmason@kudzu.us>,
+ Corinna Schultz <coschult@us.ibm.com>,
+ Ingo Molnar <mingo@elte.hu>
+Subject: [32/90] x86, Calgary IOMMU quirk: Find nearest matching Calgary while walking up the PCI tree
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Darrick J. Wong <djwong@us.ibm.com>
+
+commit 4528752f49c1f4025473d12bc5fa9181085c3f22 upstream.
+
+On a multi-node x3950M2 system, there's a slight oddity in the
+PCI device tree for all secondary nodes:
+
+ 30:1e.0 PCI bridge: Intel Corporation 82801 PCI Bridge (rev e1)
+ \-33:00.0 PCI bridge: IBM CalIOC2 PCI-E Root Port (rev 01)
+ \-34:00.0 RAID bus controller: LSI Logic / Symbios Logic MegaRAID SAS 1078 (rev 04)
+
+...as compared to the primary node:
+
+ 00:1e.0 PCI bridge: Intel Corporation 82801 PCI Bridge (rev e1)
+ \-01:00.0 VGA compatible controller: ATI Technologies Inc ES1000 (rev 02)
+ 03:00.0 PCI bridge: IBM CalIOC2 PCI-E Root Port (rev 01)
+ \-04:00.0 RAID bus controller: LSI Logic / Symbios Logic MegaRAID SAS 1078 (rev 04)
+
+In both nodes, the LSI RAID controller hangs off a CalIOC2
+device, but on the secondary nodes, the BIOS hides the VGA
+device and substitutes the device tree ending with the disk
+controller.
+
+It would seem that Calgary devices don't necessarily appear at
+the top of the PCI tree, which means that the current code to
+find the Calgary IOMMU that goes with a particular device is
+buggy.
+
+Rather than walk all the way to the top of the PCI
+device tree and try to match bus number with Calgary descriptor,
+the code needs to examine each parent of the particular device;
+if it encounters a Calgary with a matching bus number, simply
+use that.
+
+Otherwise, we BUG() when the bus number of the Calgary doesn't
+match the bus number of whatever's at the top of the device tree.
+
+Extra note: This patch appears to work correctly for the x3950
+that came before the x3950 M2.
+
+Signed-off-by: Darrick J. Wong <djwong@us.ibm.com>
+Acked-by: Muli Ben-Yehuda <muli@il.ibm.com>
+Cc: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
+Cc: Joerg Roedel <joerg.roedel@amd.com>
+Cc: Yinghai Lu <yhlu.kernel@gmail.com>
+Cc: Jon D. Mason <jdmason@kudzu.us>
+Cc: Corinna Schultz <coschult@us.ibm.com>
+LKML-Reference: <20091202230556.GG10295@tux1.beaverton.ibm.com>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/pci-calgary_64.c | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+--- a/arch/x86/kernel/pci-calgary_64.c
++++ b/arch/x86/kernel/pci-calgary_64.c
+@@ -318,13 +318,15 @@ static inline struct iommu_table *find_i
+
+ pdev = to_pci_dev(dev);
+
++ /* search up the device tree for an iommu */
+ pbus = pdev->bus;
+-
+- /* is the device behind a bridge? Look for the root bus */
+- while (pbus->parent)
++ do {
++ tbl = pci_iommu(pbus);
++ if (tbl && tbl->it_busno == pbus->number)
++ break;
++ tbl = NULL;
+ pbus = pbus->parent;
+-
+- tbl = pci_iommu(pbus);
++ } while (pbus);
+
+ BUG_ON(tbl && (tbl->it_busno != pbus->number));
+
+
+
+From gregkh@mini.kroah.org Wed Dec 16 17:16:02 2009
+Message-Id: <20091217011602.184023170@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 17:14:44 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Tejun Heo <tj@kernel.org>,
+ FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>,
+ Matteo Frigo <athena@fftw.org>,
+ Ingo Molnar <mingo@elte.hu>
+Subject: [33/90] x86: Fix iommu=nodac parameter handling
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Tejun Heo <tj@kernel.org>
+
+commit 2ae8bb75db1f3de422eb5898f2a063c46c36dba8 upstream.
+
+iommu=nodac should forbid dac instead of enabling it. Fix it.
+
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Acked-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
+Cc: Matteo Frigo <athena@fftw.org>
+LKML-Reference: <4AE5B52A.4050408@kernel.org>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/pci-dma.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/x86/kernel/pci-dma.c
++++ b/arch/x86/kernel/pci-dma.c
+@@ -203,7 +203,7 @@ static __init int iommu_setup(char *p)
+ if (!strncmp(p, "allowdac", 8))
+ forbid_dac = 0;
+ if (!strncmp(p, "nodac", 5))
+- forbid_dac = -1;
++ forbid_dac = 1;
+ if (!strncmp(p, "usedac", 6)) {
+ forbid_dac = -1;
+ return 1;
+
+
+From gregkh@mini.kroah.org Wed Dec 16 17:16:02 2009
+Message-Id: <20091217011602.311747508@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 17:14:45 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Dave Jones <davej@redhat.com>,
+ Ingo Molnar <mingo@elte.hu>
+Subject: [34/90] x86: Fix typo in Intel CPU cache size descriptor
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Dave Jones <davej@redhat.com>
+
+commit e02e0e1a130b9ca37c5186d38ad4b3aaf58bb149 upstream.
+
+I double-checked the datasheet. One of the existing
+descriptors has a typo: it should be 2MB not 2038 KB.
+
+Signed-off-by: Dave Jones <davej@redhat.com>
+LKML-Reference: <20091110200120.GA27090@redhat.com>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/cpu/intel_cacheinfo.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/x86/kernel/cpu/intel_cacheinfo.c
++++ b/arch/x86/kernel/cpu/intel_cacheinfo.c
+@@ -93,7 +93,7 @@ static const struct _cache_table __cpuin
+ { 0xd1, LVL_3, 1024 }, /* 4-way set assoc, 64 byte line size */
+ { 0xd2, LVL_3, 2048 }, /* 4-way set assoc, 64 byte line size */
+ { 0xd6, LVL_3, 1024 }, /* 8-way set assoc, 64 byte line size */
+- { 0xd7, LVL_3, 2038 }, /* 8-way set assoc, 64 byte line size */
++ { 0xd7, LVL_3, 2048 }, /* 8-way set assoc, 64 byte line size */
+ { 0xd8, LVL_3, 4096 }, /* 12-way set assoc, 64 byte line size */
+ { 0xdc, LVL_3, 2048 }, /* 12-way set assoc, 64 byte line size */
+ { 0xdd, LVL_3, 4096 }, /* 12-way set assoc, 64 byte line size */
+
+
+From gregkh@mini.kroah.org Wed Dec 16 17:16:02 2009
+Message-Id: <20091217011602.441871371@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 17:14:46 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Joe Perches <joe@perches.com>,
+ Ingo Molnar <mingo@elte.hu>
+Subject: [35/90] x86: GART: pci-gart_64.c: Use correct length in strncmp
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Joe Perches <joe@perches.com>
+
+commit 41855b77547fa18d90ed6a5d322983d3fdab1959 upstream.
+
+Signed-off-by: Joe Perches <joe@perches.com>
+LKML-Reference: <1257818330.12852.72.camel@Joe-Laptop.home>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/pci-gart_64.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/x86/kernel/pci-gart_64.c
++++ b/arch/x86/kernel/pci-gart_64.c
+@@ -856,7 +856,7 @@ void __init gart_parse_options(char *p)
+ #endif
+ if (isdigit(*p) && get_option(&p, &arg))
+ iommu_size = arg;
+- if (!strncmp(p, "fullflush", 8))
++ if (!strncmp(p, "fullflush", 9))
+ iommu_fullflush = 1;
+ if (!strncmp(p, "nofullflush", 11))
+ iommu_fullflush = 0;
+
+
+From gregkh@mini.kroah.org Wed Dec 16 17:16:02 2009
+Message-Id: <20091217011602.574123357@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 17:14:47 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Alex Deucher <alexdeucher@gmail.com>,
+ Dave Airlie <airlied@redhat.com>
+Subject: [36/90] drm/radeon/kms: Add quirk for HIS X1300 board
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Alex Deucher <alexdeucher@gmail.com>
+
+commit 4e3f9b78ff917cc5c833858fdb5d96bc262e0bf3 upstream.
+
+Board is DVI+VGA, not DVI+DVI
+
+Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/radeon/radeon_atombios.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/drivers/gpu/drm/radeon/radeon_atombios.c
++++ b/drivers/gpu/drm/radeon/radeon_atombios.c
+@@ -134,6 +134,14 @@ static bool radeon_atom_apply_quirks(str
+ }
+ }
+
++ /* HIS X1300 is DVI+VGA, not DVI+DVI */
++ if ((dev->pdev->device == 0x7146) &&
++ (dev->pdev->subsystem_vendor == 0x17af) &&
++ (dev->pdev->subsystem_device == 0x2058)) {
++ if (supported_device == ATOM_DEVICE_DFP1_SUPPORT)
++ return false;
++ }
++
+ /* Funky macbooks */
+ if ((dev->pdev->device == 0x71C5) &&
+ (dev->pdev->subsystem_vendor == 0x106b) &&
+
+
+From gregkh@mini.kroah.org Wed Dec 16 17:16:02 2009
+Message-Id: <20091217011602.713264453@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 17:14:48 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Alex Deucher <alexdeucher@gmail.com>,
+ Dave Airlie <airlied@redhat.com>
+Subject: [37/90] drm/radeon/kms: fix legacy crtc2 dpms
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Alex Deucher <alexdeucher@gmail.com>
+
+commit 8de21525439e6b5bb8d8c81e49094d867bf82f6d upstream.
+
+noticed by Matthijs Kooijman on fdo bug 22140
+
+Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/radeon/radeon_legacy_crtc.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+--- a/drivers/gpu/drm/radeon/radeon_legacy_crtc.c
++++ b/drivers/gpu/drm/radeon/radeon_legacy_crtc.c
+@@ -291,8 +291,7 @@ void radeon_crtc_dpms(struct drm_crtc *c
+ uint32_t mask;
+
+ if (radeon_crtc->crtc_id)
+- mask = (RADEON_CRTC2_EN |
+- RADEON_CRTC2_DISP_DIS |
++ mask = (RADEON_CRTC2_DISP_DIS |
+ RADEON_CRTC2_VSYNC_DIS |
+ RADEON_CRTC2_HSYNC_DIS |
+ RADEON_CRTC2_DISP_REQ_EN_B);
+@@ -304,7 +303,7 @@ void radeon_crtc_dpms(struct drm_crtc *c
+ switch (mode) {
+ case DRM_MODE_DPMS_ON:
+ if (radeon_crtc->crtc_id)
+- WREG32_P(RADEON_CRTC2_GEN_CNTL, RADEON_CRTC2_EN, ~mask);
++ WREG32_P(RADEON_CRTC2_GEN_CNTL, RADEON_CRTC2_EN, ~(RADEON_CRTC2_EN | mask));
+ else {
+ WREG32_P(RADEON_CRTC_GEN_CNTL, RADEON_CRTC_EN, ~(RADEON_CRTC_EN |
+ RADEON_CRTC_DISP_REQ_EN_B));
+@@ -318,7 +317,7 @@ void radeon_crtc_dpms(struct drm_crtc *c
+ case DRM_MODE_DPMS_OFF:
+ drm_vblank_pre_modeset(dev, radeon_crtc->crtc_id);
+ if (radeon_crtc->crtc_id)
+- WREG32_P(RADEON_CRTC2_GEN_CNTL, mask, ~mask);
++ WREG32_P(RADEON_CRTC2_GEN_CNTL, mask, ~(RADEON_CRTC2_EN | mask));
+ else {
+ WREG32_P(RADEON_CRTC_GEN_CNTL, RADEON_CRTC_DISP_REQ_EN_B, ~(RADEON_CRTC_EN |
+ RADEON_CRTC_DISP_REQ_EN_B));
+
+
+From gregkh@mini.kroah.org Wed Dec 16 17:16:02 2009
+Message-Id: <20091217011602.837916977@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 17:14:49 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Vasanthakumar Thiagarajan <vasanth@atheros.com>,
+ "John W. Linville" <linville@tuxdriver.com>
+Subject: [38/90] mac80211: Fix bug in computing crc over dynamic IEs in beacon
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Vasanthakumar Thiagarajan <vasanth@atheros.com>
+
+commit 1814077fd12a9cdf478c10076e9c42094e9d9250 upstream.
+
+On a 32-bit machine, BIT() macro does not give the required
+bit value if the bit is mroe than 31. In ieee802_11_parse_elems_crc(),
+BIT() is suppossed to get the bit value more than 31 (42 (id of ERP_INFO_IE),
+37 (CHANNEL_SWITCH_IE), (42), 32 (POWER_CONSTRAINT_IE), 45 (HT_CAP_IE),
+61 (HT_INFO_IE)). As we do not get the required bit value for the above
+IEs, crc over these IEs are never calculated, so any dynamic change in these
+IEs after the association is not really handled on 32-bit platforms.
+This patch fixes this issue.
+
+Signed-off-by: Vasanthakumar Thiagarajan <vasanth@atheros.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/mac80211/util.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/mac80211/util.c
++++ b/net/mac80211/util.c
+@@ -537,7 +537,7 @@ u32 ieee802_11_parse_elems_crc(u8 *start
+ if (elen > left)
+ break;
+
+- if (calc_crc && id < 64 && (filter & BIT(id)))
++ if (calc_crc && id < 64 && (filter & (1ULL << id)))
+ crc = crc32_be(crc, pos - 2, elen + 2);
+
+ switch (id) {
+
+
+From gregkh@mini.kroah.org Wed Dec 16 17:16:03 2009
+Message-Id: <20091217011602.968830252@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 17:14:50 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>,
+ Andi Kleen <ak@linux.intel.com>,
+ Wu Fengguang <fengguang.wu@intel.com>,
+ Hugh Dickins <hugh.dickins@tiscali.co.uk>,
+ Mel Gorman <mel@csn.ul.ie>,
+ Lee Schermerhorn <lee.schermerhorn@hp.com>,
+ Andy Whitcroft <apw@canonical.com>,
+ David Rientjes <rientjes@google.com>
+Subject: [39/90] mm: hugetlb: fix hugepage memory leak in mincore()
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
+
+commit 4f16fc107d9c9b8a72aa19b189a9216e90a7aaef upstream.
+
+Most callers of pmd_none_or_clear_bad() check whether the target page is
+in a hugepage or not, but mincore() and walk_page_range() do not check it.
+ So if we use mincore() on a hugepage on x86 machine, the hugepage memory
+is leaked as shown below. This patch fixes it by extending mincore()
+system call to support hugepages.
+
+Details
+=======
+My test program (leak_mincore) works as follows:
+ - creat() and mmap() a file on hugetlbfs (file size is 200MB == 100 hugepages,)
+ - read()/write() something on it,
+ - call mincore() for first ten pages and printf() the values of *vec
+ - munmap() and unlink() the file on hugetlbfs
+
+Without my patch
+----------------
+$ cat /proc/meminfo| grep "HugePage"
+HugePages_Total: 1000
+HugePages_Free: 1000
+HugePages_Rsvd: 0
+HugePages_Surp: 0
+$ ./leak_mincore
+vec[0] 0
+vec[1] 0
+vec[2] 0
+vec[3] 0
+vec[4] 0
+vec[5] 0
+vec[6] 0
+vec[7] 0
+vec[8] 0
+vec[9] 0
+$ cat /proc/meminfo |grep "HugePage"
+HugePages_Total: 1000
+HugePages_Free: 999
+HugePages_Rsvd: 0
+HugePages_Surp: 0
+$ ls /hugetlbfs/
+$
+
+Return values in *vec from mincore() are set to 0, while the hugepage
+should be in memory, and 1 hugepage is still accounted as used while
+there is no file on hugetlbfs.
+
+With my patch
+-------------
+$ cat /proc/meminfo| grep "HugePage"
+HugePages_Total: 1000
+HugePages_Free: 1000
+HugePages_Rsvd: 0
+HugePages_Surp: 0
+$ ./leak_mincore
+vec[0] 1
+vec[1] 1
+vec[2] 1
+vec[3] 1
+vec[4] 1
+vec[5] 1
+vec[6] 1
+vec[7] 1
+vec[8] 1
+vec[9] 1
+$ cat /proc/meminfo |grep "HugePage"
+HugePages_Total: 1000
+HugePages_Free: 1000
+HugePages_Rsvd: 0
+HugePages_Surp: 0
+$ ls /hugetlbfs/
+$
+
+Return value in *vec set to 1 and no memory leaks.
+
+[akpm@linux-foundation.org: cleanup]
+[akpm@linux-foundation.org: build fix]
+Signed-off-by: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
+Cc: Andi Kleen <ak@linux.intel.com>
+Cc: Wu Fengguang <fengguang.wu@intel.com>
+Cc: Hugh Dickins <hugh.dickins@tiscali.co.uk>
+Cc: Mel Gorman <mel@csn.ul.ie>
+Cc: Lee Schermerhorn <lee.schermerhorn@hp.com>
+Cc: Andy Whitcroft <apw@canonical.com>
+Cc: David Rientjes <rientjes@google.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ mm/mincore.c | 37 +++++++++++++++++++++++++++++++++++++
+ 1 file changed, 37 insertions(+)
+
+--- a/mm/mincore.c
++++ b/mm/mincore.c
+@@ -14,6 +14,7 @@
+ #include <linux/syscalls.h>
+ #include <linux/swap.h>
+ #include <linux/swapops.h>
++#include <linux/hugetlb.h>
+
+ #include <asm/uaccess.h>
+ #include <asm/pgtable.h>
+@@ -72,6 +73,42 @@ static long do_mincore(unsigned long add
+ if (!vma || addr < vma->vm_start)
+ return -ENOMEM;
+
++#ifdef CONFIG_HUGETLB_PAGE
++ if (is_vm_hugetlb_page(vma)) {
++ struct hstate *h;
++ unsigned long nr_huge;
++ unsigned char present;
++
++ i = 0;
++ nr = min(pages, (vma->vm_end - addr) >> PAGE_SHIFT);
++ h = hstate_vma(vma);
++ nr_huge = ((addr + pages * PAGE_SIZE - 1) >> huge_page_shift(h))
++ - (addr >> huge_page_shift(h)) + 1;
++ nr_huge = min(nr_huge,
++ (vma->vm_end - addr) >> huge_page_shift(h));
++ while (1) {
++ /* hugepage always in RAM for now,
++ * but generally it needs to be check */
++ ptep = huge_pte_offset(current->mm,
++ addr & huge_page_mask(h));
++ present = !!(ptep &&
++ !huge_pte_none(huge_ptep_get(ptep)));
++ while (1) {
++ vec[i++] = present;
++ addr += PAGE_SIZE;
++ /* reach buffer limit */
++ if (i == nr)
++ return nr;
++ /* check hugepage border */
++ if (!((addr & ~huge_page_mask(h))
++ >> PAGE_SHIFT))
++ break;
++ }
++ }
++ return nr;
++ }
++#endif
++
+ /*
+ * Calculate how many pages there are left in the last level of the
+ * PTE array for our address.
+
+
+From gregkh@mini.kroah.org Wed Dec 16 17:16:03 2009
+Message-Id: <20091217011603.095665584@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 17:14:51 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>,
+ Andi Kleen <ak@linux.intel.com>,
+ Wu Fengguang <fengguang.wu@intel.com>,
+ Hugh Dickins <hugh.dickins@tiscali.co.uk>,
+ Mel Gorman <mel@csn.ul.ie>,
+ Lee Schermerhorn <lee.schermerhorn@hp.com>,
+ Andy Whitcroft <apw@canonical.com>,
+ David Rientjes <rientjes@google.com>
+Subject: [40/90] mm: hugetlb: fix hugepage memory leak in walk_page_range()
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
+
+commit d33b9f45bd24a6391bc05e2b5a13c1b5787ca9c2 upstream.
+
+Most callers of pmd_none_or_clear_bad() check whether the target page is
+in a hugepage or not, but walk_page_range() do not check it. So if we
+read /proc/pid/pagemap for the hugepage on x86 machine, the hugepage
+memory is leaked as shown below. This patch fixes it.
+
+Details
+=======
+My test program (leak_pagemap) works as follows:
+ - creat() and mmap() a file on hugetlbfs (file size is 200MB == 100 hugepages,)
+ - read()/write() something on it,
+ - call page-types with option -p (walk around the page tables),
+ - munmap() and unlink() the file on hugetlbfs
+
+Without my patches
+------------------
+$ cat /proc/meminfo |grep "HugePage"
+HugePages_Total: 1000
+HugePages_Free: 1000
+HugePages_Rsvd: 0
+HugePages_Surp: 0
+$ ./leak_pagemap
+[snip output]
+$ cat /proc/meminfo |grep "HugePage"
+HugePages_Total: 1000
+HugePages_Free: 900
+HugePages_Rsvd: 0
+HugePages_Surp: 0
+$ ls /hugetlbfs/
+$
+
+100 hugepages are accounted as used while there is no file on hugetlbfs.
+
+With my patches
+---------------
+$ cat /proc/meminfo |grep "HugePage"
+HugePages_Total: 1000
+HugePages_Free: 1000
+HugePages_Rsvd: 0
+HugePages_Surp: 0
+$ ./leak_pagemap
+[snip output]
+$ cat /proc/meminfo |grep "HugePage"
+HugePages_Total: 1000
+HugePages_Free: 1000
+HugePages_Rsvd: 0
+HugePages_Surp: 0
+$ ls /hugetlbfs
+$
+
+No memory leaks.
+
+Signed-off-by: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
+Cc: Andi Kleen <ak@linux.intel.com>
+Cc: Wu Fengguang <fengguang.wu@intel.com>
+Cc: Hugh Dickins <hugh.dickins@tiscali.co.uk>
+Cc: Mel Gorman <mel@csn.ul.ie>
+Cc: Lee Schermerhorn <lee.schermerhorn@hp.com>
+Cc: Andy Whitcroft <apw@canonical.com>
+Cc: David Rientjes <rientjes@google.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ mm/pagewalk.c | 16 +++++++++++++++-
+ 1 file changed, 15 insertions(+), 1 deletion(-)
+
+--- a/mm/pagewalk.c
++++ b/mm/pagewalk.c
+@@ -1,6 +1,7 @@
+ #include <linux/mm.h>
+ #include <linux/highmem.h>
+ #include <linux/sched.h>
++#include <linux/hugetlb.h>
+
+ static int walk_pte_range(pmd_t *pmd, unsigned long addr, unsigned long end,
+ struct mm_walk *walk)
+@@ -107,6 +108,7 @@ int walk_page_range(unsigned long addr,
+ pgd_t *pgd;
+ unsigned long next;
+ int err = 0;
++ struct vm_area_struct *vma;
+
+ if (addr >= end)
+ return err;
+@@ -117,11 +119,22 @@ int walk_page_range(unsigned long addr,
+ pgd = pgd_offset(walk->mm, addr);
+ do {
+ next = pgd_addr_end(addr, end);
++
++ /* skip hugetlb vma to avoid hugepage PMD being cleared
++ * in pmd_none_or_clear_bad(). */
++ vma = find_vma(walk->mm, addr);
++ if (vma && is_vm_hugetlb_page(vma)) {
++ if (vma->vm_end < next)
++ next = vma->vm_end;
++ continue;
++ }
++
+ if (pgd_none_or_clear_bad(pgd)) {
+ if (walk->pte_hole)
+ err = walk->pte_hole(addr, next, walk);
+ if (err)
+ break;
++ pgd++;
+ continue;
+ }
+ if (walk->pgd_entry)
+@@ -131,7 +144,8 @@ int walk_page_range(unsigned long addr,
+ err = walk_pud_range(pgd, addr, next, walk);
+ if (err)
+ break;
+- } while (pgd++, addr = next, addr != end);
++ pgd++;
++ } while (addr = next, addr != end);
+
+ return err;
+ }
+
+
+From gregkh@mini.kroah.org Wed Dec 16 17:16:03 2009
+Message-Id: <20091217011603.224089240@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 17:14:52 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Subject: [41/90] powerpc: Fix usage of 64-bit instruction in 32-bit altivec code
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+
+commit e090aa80321b64c3b793f3b047e31ecf1af9538d upstream.
+
+e821ea70f3b4873b50056a1e0f74befed1014c09 introduced a bug by copying
+some 64-bit originated code as-is to be used by both 32 and 64-bit
+but this code contains a 64-bit ony "cmpdi" instruction.
+
+This changes it to cmpwi, which is fine since VRSAVE can only contains
+a 32-bit value anyway.
+
+Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/powerpc/kernel/vector.S | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/powerpc/kernel/vector.S
++++ b/arch/powerpc/kernel/vector.S
+@@ -58,7 +58,7 @@ _GLOBAL(load_up_altivec)
+ * all 1's
+ */
+ mfspr r4,SPRN_VRSAVE
+- cmpdi 0,r4,0
++ cmpwi 0,r4,0
+ bne+ 1f
+ li r4,-1
+ mtspr SPRN_VRSAVE,r4
+
+
+From gregkh@mini.kroah.org Wed Dec 16 17:16:03 2009
+Message-Id: <20091217011603.362701500@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 17:14:53 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Ian Jackson <ian.jackson@eu.citrix.com>,
+ Alan Cox <alan@linux.intel.com>
+Subject: [42/90] Serial: Do not read IIR in serial8250_start_tx when UART_BUG_TXEN
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Ian Jackson <ian.jackson@eu.citrix.com>
+
+commit 68cb4f8e246bbbc649980be0628cae9265870a91 upstream.
+
+Do not read IIR in serial8250_start_tx when UART_BUG_TXEN
+
+Reading the IIR clears some oustanding interrupts so it is not safe.
+Instead, simply transmit immediately if the buffer is empty without
+regard to IIR.
+
+Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com>
+Reviewed-by: Markus Armbruster <armbru@redhat.com>
+Reviewed-by: Jiri Kosina <jkosina@suse.cz>
+Cc: Alan Cox <alan@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/serial/8250.c | 8 +++-----
+ 1 file changed, 3 insertions(+), 5 deletions(-)
+
+--- a/drivers/serial/8250.c
++++ b/drivers/serial/8250.c
+@@ -1337,14 +1337,12 @@ static void serial8250_start_tx(struct u
+ serial_out(up, UART_IER, up->ier);
+
+ if (up->bugs & UART_BUG_TXEN) {
+- unsigned char lsr, iir;
++ unsigned char lsr;
+ lsr = serial_in(up, UART_LSR);
+ up->lsr_saved_flags |= lsr & LSR_SAVE_FLAGS;
+- iir = serial_in(up, UART_IIR) & 0x0f;
+ if ((up->port.type == PORT_RM9000) ?
+- (lsr & UART_LSR_THRE &&
+- (iir == UART_IIR_NO_INT || iir == UART_IIR_THRI)) :
+- (lsr & UART_LSR_TEMT && iir & UART_IIR_NO_INT))
++ (lsr & UART_LSR_THRE) :
++ (lsr & UART_LSR_TEMT))
+ transmit_chars(up);
+ }
+ }
+
+
+From gregkh@mini.kroah.org Wed Dec 16 17:16:03 2009
+Message-Id: <20091217011603.486845303@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 17:14:54 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Mikulas Patocka <mpatocka@redhat.com>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [43/90] ide: Serialize CMD643 and CMD646 to fix a hardware bug with SSD
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+[ Upstream commit 9bd7496f5dd488e109e91d9d5743915fb4dfbfde ]
+
+CMD646 corrupts data on concurrent transfers on both channels when IDE SSD is
+connected to one of the channels.
+
+Setup that demonstrates this hardware bug: Ultra 5, onboard CMD646, rev 3.
+/dev/hda is 8GB Seagate ST38410A in MWDMA2
+/dev/hdd is 32GB SSD SiliconHardDisk in MWDMA2
+
+- When reading /dev/hdd (for example with dd or fsck), reads from /dev/hda
+ are corrupted, there are twiddled single bits 1->0 and some full 32-bit
+ words corrupted, sometimes commands fail (which switches /dev/hda to
+ PIO mode but the corruptions happen even in PIO).
+- Reads from /dev/hdd don't seem to be corrupted (i.e. fsck passes fine).
+- When I connected normal rotating harddisk to /dev/hdd, there was no
+ corruption, so the corruption is something specific to SSD.
+- I tried the same setup on a PCI card with CMD649 and saw no corruption.
+
+This patch serializes the operation for CMD646 and 643 (I didn't test
+CMD643 but it may have the same hw bug too because it's earlier design).
+CMD649 is good. I don't know anything about CMD 648.
+
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Tested-by: Frans Pop <elendil@planet.nl>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/ide/cmd64x.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/ide/cmd64x.c
++++ b/drivers/ide/cmd64x.c
+@@ -379,7 +379,8 @@ static const struct ide_port_info cmd64x
+ .enablebits = {{0x00,0x00,0x00}, {0x51,0x08,0x08}},
+ .port_ops = &cmd64x_port_ops,
+ .host_flags = IDE_HFLAG_CLEAR_SIMPLEX |
+- IDE_HFLAG_ABUSE_PREFETCH,
++ IDE_HFLAG_ABUSE_PREFETCH |
++ IDE_HFLAG_SERIALIZE,
+ .pio_mask = ATA_PIO5,
+ .mwdma_mask = ATA_MWDMA2,
+ .udma_mask = 0x00, /* no udma */
+@@ -389,7 +390,8 @@ static const struct ide_port_info cmd64x
+ .init_chipset = init_chipset_cmd64x,
+ .enablebits = {{0x51,0x04,0x04}, {0x51,0x08,0x08}},
+ .port_ops = &cmd648_port_ops,
+- .host_flags = IDE_HFLAG_ABUSE_PREFETCH,
++ .host_flags = IDE_HFLAG_ABUSE_PREFETCH |
++ IDE_HFLAG_SERIALIZE,
+ .pio_mask = ATA_PIO5,
+ .mwdma_mask = ATA_MWDMA2,
+ .udma_mask = ATA_UDMA2,
+
+
+From gregkh@mini.kroah.org Wed Dec 16 17:16:03 2009
+Message-Id: <20091217011603.624534895@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 17:14:55 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Hemant Pedanekar <hemantp@ti.com>,
+ Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>,
+ Sergei Shtylyov <sshtylyov@ru.mvista.com>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [44/90] ide: fix ioctl to pass requested transfer mode to ide_find_dma_mode instead of UDMA6
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Hemant Pedanekar <hemantp@ti.com>
+
+[ Upstream commit 28c1969ff887bc2a7df39272850dece01de03285 ]
+
+Currently, ide_cmd_ioctl when invoked for setting DMA transfer mode calls
+ide_find_dma_mode with requested mode as XFER_UDMA_6. This prevents setting DMA
+mode to any other value than the default (maximum) supported by the device (or
+UDMA6, if supported) irrespective of the actual requested transfer mode and
+returns error.
+
+For example, setting mode to UDMA2 using hdparm, where UDMA4 is the default
+transfer mode gives following error:
+ # ./hdparm -d1 -Xudma2 /dev/hda
+ /dev/hda:hda: UDMA/66 mode selected
+ setting using_dma to 1 (on)
+ hda: UDMA/66 mode selected
+ setting xfermode to 66 (UltraDMA mode2)
+ HDIO_DRIVE_CMD(setxfermode) failed: Invalid argument
+ using_dma = 1 (on)
+
+This patch fixes the issue.
+
+Signed-off-by: Hemant Pedanekar <hemantp@ti.com>
+Acked-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
+Acked-by: Sergei Shtylyov <sshtylyov@ru.mvista.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/ide/ide-ioctls.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/ide/ide-ioctls.c
++++ b/drivers/ide/ide-ioctls.c
+@@ -162,7 +162,7 @@ static int ide_cmd_ioctl(ide_drive_t *dr
+ if (tf->command == ATA_CMD_SET_FEATURES &&
+ tf->feature == SETFEATURES_XFER &&
+ tf->nsect >= XFER_SW_DMA_0) {
+- xfer_rate = ide_find_dma_mode(drive, XFER_UDMA_6);
++ xfer_rate = ide_find_dma_mode(drive, tf->nsect);
+ if (xfer_rate != tf->nsect) {
+ err = -EINVAL;
+ goto abort;
+
+
+From gregkh@mini.kroah.org Wed Dec 16 17:16:03 2009
+Message-Id: <20091217011603.801085521@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 17:14:56 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [45/90] Revert "ide: try to use PIO Mode 0 during probe if possible"
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: David S. Miller <davem@davemloft.net>
+
+[ Upstream commit 0fb18c4777ff424c1db694af98443a201fa4fc30 ]
+
+This reverts commit 6029336426a2b43e4bc6f4a84be8789a047d139e.
+
+Ok, we really do need to revert this, even with Bart's sis5513.c
+fix in there.
+
+The problem is that several driver's ->set_pio_mode() method
+depends upon the drive->media type being set properly. Most
+of them use this to enable prefetching, which can only be done
+for disk media.
+
+But the commit being reverted here calls ->set_pio_mode() before
+it's setup. Actually it considers everything disk because that
+is the default media type set by ide_port_init_devices_data().
+
+The set of drivers that depend upon the media type in their
+->set_pio_method() are:
+
+drivers/ide/alim15x3.c
+drivers/ide/it8172.c
+drivers/ide/it8213.c
+drivers/ide/pdc202xx_old.c
+drivers/ide/piix.c
+drivers/ide/qd65xx.c
+drivers/ide/sis5513.c
+drivers/ide/slc90e66.c
+
+And it is possible that we could fix this by guarding the prefetching
+and other media dependent setting changes with a test on
+IDE_PFLAG_PROBING in hwif->port_flags, that's simply too risky for
+2.6.32-rcX and -stable.
+
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/ide/ide-probe.c | 9 ---------
+ 1 file changed, 9 deletions(-)
+
+--- a/drivers/ide/ide-probe.c
++++ b/drivers/ide/ide-probe.c
+@@ -1035,15 +1035,6 @@ static void ide_port_init_devices(ide_hw
+ if (port_ops && port_ops->init_dev)
+ port_ops->init_dev(drive);
+ }
+-
+- ide_port_for_each_dev(i, drive, hwif) {
+- /*
+- * default to PIO Mode 0 before we figure out
+- * the most suited mode for the attached device
+- */
+- if (port_ops && port_ops->set_pio_mode)
+- port_ops->set_pio_mode(drive, 0);
+- }
+ }
+
+ static void ide_init_port(ide_hwif_t *hwif, unsigned int port,
+
+
+From gregkh@mini.kroah.org Wed Dec 16 17:16:04 2009
+Message-Id: <20091217011603.954645418@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 17:14:57 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>,
+ Sergei Shtylyov <sshtylyov@ru.mvista.com>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [46/90] slc90e66: fix UDMA handling
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
+
+[ Upstream commit ee31527a02b0a8e1aa4a5e4084d2db5fa34737ed ]
+
+Fix checking of the currently programmed UDMA mode.
+
+Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
+Acked-by: Sergei Shtylyov <sshtylyov@ru.mvista.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/ide/slc90e66.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/ide/slc90e66.c
++++ b/drivers/ide/slc90e66.c
+@@ -91,8 +91,7 @@ static void slc90e66_set_dma_mode(ide_dr
+
+ if (!(reg48 & u_flag))
+ pci_write_config_word(dev, 0x48, reg48|u_flag);
+- /* FIXME: (reg4a & a_speed) ? */
+- if ((reg4a & u_speed) != u_speed) {
++ if ((reg4a & a_speed) != u_speed) {
+ pci_write_config_word(dev, 0x4a, reg4a & ~a_speed);
+ pci_read_config_word(dev, 0x4a, ®4a);
+ pci_write_config_word(dev, 0x4a, reg4a|u_speed);
+
+
+From gregkh@mini.kroah.org Wed Dec 16 17:16:04 2009
+Message-Id: <20091217011604.090632427@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 17:14:58 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Alexander Beregalov <a.beregalov@gmail.com>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [47/90] Au1x00: fix crash when trying register_netdev()
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Alexander Beregalov <a.beregalov@gmail.com>
+
+[ Upstream commit 63edaf647607795a065e6956a79c47f500dc8447 ]
+
+Andreas Lohre reported that the driver crashes when trying
+to register_netdev(), he sugessted to move dev->netdev_ops initialization
+before calling register_netdev(), it worked for him.
+
+Reported-by: Andreas Lohre <alohre@gmail.com>
+Signed-off-by: Alexander Beregalov <a.beregalov@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/au1000_eth.c | 15 ++++++++-------
+ 1 file changed, 8 insertions(+), 7 deletions(-)
+
+--- a/drivers/net/au1000_eth.c
++++ b/drivers/net/au1000_eth.c
+@@ -1089,7 +1089,14 @@ static struct net_device * au1000_probe(
+ return NULL;
+ }
+
+- if ((err = register_netdev(dev)) != 0) {
++ dev->base_addr = base;
++ dev->irq = irq;
++ dev->netdev_ops = &au1000_netdev_ops;
++ SET_ETHTOOL_OPS(dev, &au1000_ethtool_ops);
++ dev->watchdog_timeo = ETH_TX_TIMEOUT;
++
++ err = register_netdev(dev);
++ if (err != 0) {
+ printk(KERN_ERR "%s: Cannot register net device, error %d\n",
+ DRV_NAME, err);
+ free_netdev(dev);
+@@ -1207,12 +1214,6 @@ static struct net_device * au1000_probe(
+ aup->tx_db_inuse[i] = pDB;
+ }
+
+- dev->base_addr = base;
+- dev->irq = irq;
+- dev->netdev_ops = &au1000_netdev_ops;
+- SET_ETHTOOL_OPS(dev, &au1000_ethtool_ops);
+- dev->watchdog_timeo = ETH_TX_TIMEOUT;
+-
+ /*
+ * The boot code uses the ethernet controller, so reset it to start
+ * fresh. au1000_init() expects that the device is in reset state.
+
+
+From gregkh@mini.kroah.org Wed Dec 16 17:16:04 2009
+Message-Id: <20091217011604.223046724@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 17:14:59 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Stanislav Brabec <sbrabec@suse.cz>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [48/90] b44 WOL setup: one-bit-off stack corruption kernel panic fix
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+
+From: Stanislav Brabec <sbrabec@suse.cz>
+
+[ Upstream commit: e0188829cb724e7d12a2d4e343b368ff1d6e1471 ]
+
+About 50% of shutdowns of b44 Ethernet adapter ends by kernel panic
+with kernels compiled with stack-protector.
+
+Checking b44_magic_pattern() return values, one call of
+b44_magic_pattern() returns 127. It means, that set_bit(128, pmask)
+was called on line 1509. It means that bit 0 of 17th byte of pmask was
+overwritten. But pmask has only 16 bytes. Stack corruption happens.
+
+It seems that set_bit() on line 1509 always writes one bit off.
+
+The fix does not only solve the stack corruption, but also makes Wake
+On LAN working on my onboard B44 on Asus A7V-333X mainboard.
+
+It seems that this problem affects all kernel versions since commit
+725ad800 ([PATCH] b44: add wol for old nic) on 2006-06-20.
+
+Signed-off-by: Stanislav Brabec <sbrabec@suse.cz>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/net/b44.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/net/b44.c
++++ b/drivers/net/b44.c
+@@ -1505,8 +1505,7 @@ static int b44_magic_pattern(u8 *macaddr
+ for (k = 0; k< ethaddr_bytes; k++) {
+ ppattern[offset + magicsync +
+ (j * ETH_ALEN) + k] = macaddr[k];
+- len++;
+- set_bit(len, (unsigned long *) pmask);
++ set_bit(len++, (unsigned long *) pmask);
+ }
+ }
+ return len - 1;
+
+
+From gregkh@mini.kroah.org Wed Dec 16 17:16:04 2009
+Message-Id: <20091217011604.354502244@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 17:15:00 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [49/90] b44: Fix wedge when using netconsole.
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+
+From: David S. Miller <davem@davemloft.net>
+
+[ Upstream commit 0cae200eec6330cd2c20b24279597be1da50dc93 ]
+
+Fixes kernel bugzilla #14691
+
+Due to the way netpoll works, it is perfectly legal to see
+NAPI already scheduled when new device events are pending
+in b44_interrupt().
+
+So logging a message about it is wrong and in fact harmful.
+
+Based upon a patch by Andreas Mohr.
+
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/net/b44.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+--- a/drivers/net/b44.c
++++ b/drivers/net/b44.c
+@@ -913,9 +913,6 @@ static irqreturn_t b44_interrupt(int irq
+ bp->istat = istat;
+ __b44_disable_ints(bp);
+ __napi_schedule(&bp->napi);
+- } else {
+- printk(KERN_ERR PFX "%s: Error, poll already scheduled\n",
+- dev->name);
+ }
+
+ irq_ack:
+
+
+From gregkh@mini.kroah.org Wed Dec 16 17:16:04 2009
+Message-Id: <20091217011604.483828174@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 17:15:01 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Roger Oksanen <roger.oksanen@cs.helsinki.fi>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [50/90] e100: Use pci pool to work around GFP_ATOMIC order 5 memory allocation failure
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+
+From: Roger Oksanen <roger.oksanen@cs.helsinki.fi>
+
+[ Upstream commit 98468efddb101f8a29af974101c17ba513b07be1 ]
+
+pci_alloc_consistent uses GFP_ATOMIC allocation that may fail on some systems
+with limited memory (Bug #14265). pci_pool_alloc allows waiting with
+GFP_KERNEL.
+
+Tested-by: Karol Lewandowski <karol.k.lewandowski@gmail.com>
+Signed-off-by: Roger Oksanen <roger.oksanen@cs.helsinki.fi>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/net/e100.c | 17 +++++++++++------
+ 1 file changed, 11 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/e100.c
++++ b/drivers/net/e100.c
+@@ -156,6 +156,7 @@
+ #include <linux/init.h>
+ #include <linux/pci.h>
+ #include <linux/dma-mapping.h>
++#include <linux/dmapool.h>
+ #include <linux/netdevice.h>
+ #include <linux/etherdevice.h>
+ #include <linux/mii.h>
+@@ -601,6 +602,7 @@ struct nic {
+ struct mem *mem;
+ dma_addr_t dma_addr;
+
++ struct pci_pool *cbs_pool;
+ dma_addr_t cbs_dma_addr;
+ u8 adaptive_ifs;
+ u8 tx_threshold;
+@@ -1779,9 +1781,7 @@ static void e100_clean_cbs(struct nic *n
+ nic->cb_to_clean = nic->cb_to_clean->next;
+ nic->cbs_avail++;
+ }
+- pci_free_consistent(nic->pdev,
+- sizeof(struct cb) * nic->params.cbs.count,
+- nic->cbs, nic->cbs_dma_addr);
++ pci_pool_free(nic->cbs_pool, nic->cbs, nic->cbs_dma_addr);
+ nic->cbs = NULL;
+ nic->cbs_avail = 0;
+ }
+@@ -1799,8 +1799,8 @@ static int e100_alloc_cbs(struct nic *ni
+ nic->cb_to_use = nic->cb_to_send = nic->cb_to_clean = NULL;
+ nic->cbs_avail = 0;
+
+- nic->cbs = pci_alloc_consistent(nic->pdev,
+- sizeof(struct cb) * count, &nic->cbs_dma_addr);
++ nic->cbs = pci_pool_alloc(nic->cbs_pool, GFP_KERNEL,
++ &nic->cbs_dma_addr);
+ if (!nic->cbs)
+ return -ENOMEM;
+
+@@ -2827,7 +2827,11 @@ static int __devinit e100_probe(struct p
+ DPRINTK(PROBE, ERR, "Cannot register net device, aborting.\n");
+ goto err_out_free;
+ }
+-
++ nic->cbs_pool = pci_pool_create(netdev->name,
++ nic->pdev,
++ nic->params.cbs.count * sizeof(struct cb),
++ sizeof(u32),
++ 0);
+ DPRINTK(PROBE, INFO, "addr 0x%llx, irq %d, MAC addr %pM\n",
+ (unsigned long long)pci_resource_start(pdev, use_io ? 1 : 0),
+ pdev->irq, netdev->dev_addr);
+@@ -2857,6 +2861,7 @@ static void __devexit e100_remove(struct
+ unregister_netdev(netdev);
+ e100_free(nic);
+ pci_iounmap(pdev, nic->csr);
++ pci_pool_destroy(nic->cbs_pool);
+ free_netdev(netdev);
+ pci_release_regions(pdev);
+ pci_disable_device(pdev);
+
+
+From gregkh@mini.kroah.org Wed Dec 16 17:16:04 2009
+Message-Id: <20091217011604.615316659@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 17:15:02 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Herbert Xu <herbert@gondor.apana.org.au>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [51/90] gro: Fix illegal merging of trailer trash
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+
+From: Herbert Xu <herbert@gondor.apana.org.au>
+
+[ Upstream commit 69c0cab120a85471054614418b447349caba22d7 ]
+
+When we've merged skb's with page frags, and subsequently receive
+a trailer skb (< MSS) that is not completely non-linear (this can
+occur on Intel NICs if the packet size falls below the threshold),
+GRO ends up producing an illegal GSO skb with a frag_list.
+
+This is harmless unless the skb is then forwarded through an
+interface that requires software GSO, whereupon the GSO code
+will BUG.
+
+This patch detects this case in GRO and avoids merging the
+trailer skb.
+
+Reported-by: Mark Wagner <mwagner@redhat.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/core/skbuff.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/net/core/skbuff.c
++++ b/net/core/skbuff.c
+@@ -2704,7 +2704,8 @@ int skb_gro_receive(struct sk_buff **hea
+
+ NAPI_GRO_CB(skb)->free = 1;
+ goto done;
+- }
++ } else if (skb_gro_len(p) != pinfo->gso_size)
++ return -E2BIG;
+
+ headroom = skb_headroom(p);
+ nskb = netdev_alloc_skb(p->dev, headroom + skb_gro_offset(p));
+
+
+From gregkh@mini.kroah.org Wed Dec 16 17:16:04 2009
+Message-Id: <20091217011604.755061670@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 17:15:03 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Patrick McHardy <kaber@trash.net>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [52/90] ip_fragment: also adjust skb->truesize for packets not owned by a socket
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+
+From: Patrick McHardy <kaber@trash.net>
+
+[ Upstream commit b2722b1c3a893ec6021508da15b32282ec79f4da ]
+
+When a large packet gets reassembled by ip_defrag(), the head skb
+accounts for all the fragments in skb->truesize. If this packet is
+refragmented again, skb->truesize is not re-adjusted to reflect only
+the head size since its not owned by a socket. If the head fragment
+then gets recycled and reused for another received fragment, it might
+exceed the defragmentation limits due to its large truesize value.
+
+skb_recycle_check() explicitly checks for linear skbs, so any recycled
+skb should reflect its true size in skb->truesize. Change ip_fragment()
+to also adjust the truesize value of skbs not owned by a socket.
+
+Reported-and-tested-by: Ben Menchaca <ben@bigfootnetworks.com>
+Signed-off-by: Patrick McHardy <kaber@trash.net>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/ipv4/ip_output.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/ipv4/ip_output.c
++++ b/net/ipv4/ip_output.c
+@@ -500,8 +500,8 @@ int ip_fragment(struct sk_buff *skb, int
+ if (skb->sk) {
+ frag->sk = skb->sk;
+ frag->destructor = sock_wfree;
+- truesizes += frag->truesize;
+ }
++ truesizes += frag->truesize;
+ }
+
+ /* Everything is OK. Generate! */
+
+
+From gregkh@mini.kroah.org Wed Dec 16 17:16:05 2009
+Message-Id: <20091217011604.896113614@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 17:15:04 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [53/90] Revert "isdn: isdn_ppp: Use SKB list facilities instead of home-grown implementation."
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+
+From: David S. Miller <davem@davemloft.net>
+
+[ Upstream commit e29d4363174949a7a4e46f670993d7ff43342c1c ]
+
+This reverts commit 38783e671399b5405f1fd177d602c400a9577ae6.
+
+It causes kernel bugzilla #14594
+
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/isdn/i4l/isdn_ppp.c | 348 ++++++++++++++++++++------------------------
+ include/linux/isdn_ppp.h | 2
+ 2 files changed, 162 insertions(+), 188 deletions(-)
+
+--- a/drivers/isdn/i4l/isdn_ppp.c
++++ b/drivers/isdn/i4l/isdn_ppp.c
+@@ -1535,10 +1535,8 @@ static int isdn_ppp_mp_bundle_array_init
+ int sz = ISDN_MAX_CHANNELS*sizeof(ippp_bundle);
+ if( (isdn_ppp_bundle_arr = kzalloc(sz, GFP_KERNEL)) == NULL )
+ return -ENOMEM;
+- for (i = 0; i < ISDN_MAX_CHANNELS; i++) {
++ for( i = 0; i < ISDN_MAX_CHANNELS; i++ )
+ spin_lock_init(&isdn_ppp_bundle_arr[i].lock);
+- skb_queue_head_init(&isdn_ppp_bundle_arr[i].frags);
+- }
+ return 0;
+ }
+
+@@ -1571,7 +1569,7 @@ static int isdn_ppp_mp_init( isdn_net_lo
+ if ((lp->netdev->pb = isdn_ppp_mp_bundle_alloc()) == NULL)
+ return -ENOMEM;
+ lp->next = lp->last = lp; /* nobody else in a queue */
+- skb_queue_head_init(&lp->netdev->pb->frags);
++ lp->netdev->pb->frags = NULL;
+ lp->netdev->pb->frames = 0;
+ lp->netdev->pb->seq = UINT_MAX;
+ }
+@@ -1583,29 +1581,28 @@ static int isdn_ppp_mp_init( isdn_net_lo
+
+ static u32 isdn_ppp_mp_get_seq( int short_seq,
+ struct sk_buff * skb, u32 last_seq );
+-static void isdn_ppp_mp_discard(ippp_bundle *mp, struct sk_buff *from,
+- struct sk_buff *to);
+-static void isdn_ppp_mp_reassembly(isdn_net_dev *net_dev, isdn_net_local *lp,
+- struct sk_buff *from, struct sk_buff *to,
+- u32 lastseq);
+-static void isdn_ppp_mp_free_skb(ippp_bundle *mp, struct sk_buff *skb);
++static struct sk_buff * isdn_ppp_mp_discard( ippp_bundle * mp,
++ struct sk_buff * from, struct sk_buff * to );
++static void isdn_ppp_mp_reassembly( isdn_net_dev * net_dev, isdn_net_local * lp,
++ struct sk_buff * from, struct sk_buff * to );
++static void isdn_ppp_mp_free_skb( ippp_bundle * mp, struct sk_buff * skb );
+ static void isdn_ppp_mp_print_recv_pkt( int slot, struct sk_buff * skb );
+
+ static void isdn_ppp_mp_receive(isdn_net_dev * net_dev, isdn_net_local * lp,
+- struct sk_buff *skb)
++ struct sk_buff *skb)
+ {
+- struct sk_buff *newfrag, *frag, *start, *nextf;
+- u32 newseq, minseq, thisseq;
+- isdn_mppp_stats *stats;
+ struct ippp_struct *is;
++ isdn_net_local * lpq;
++ ippp_bundle * mp;
++ isdn_mppp_stats * stats;
++ struct sk_buff * newfrag, * frag, * start, *nextf;
++ u32 newseq, minseq, thisseq;
+ unsigned long flags;
+- isdn_net_local *lpq;
+- ippp_bundle *mp;
+ int slot;
+
+ spin_lock_irqsave(&net_dev->pb->lock, flags);
+- mp = net_dev->pb;
+- stats = &mp->stats;
++ mp = net_dev->pb;
++ stats = &mp->stats;
+ slot = lp->ppp_slot;
+ if (slot < 0 || slot >= ISDN_MAX_CHANNELS) {
+ printk(KERN_ERR "%s: lp->ppp_slot(%d)\n",
+@@ -1616,19 +1613,20 @@ static void isdn_ppp_mp_receive(isdn_net
+ return;
+ }
+ is = ippp_table[slot];
+- if (++mp->frames > stats->max_queue_len)
++ if( ++mp->frames > stats->max_queue_len )
+ stats->max_queue_len = mp->frames;
+-
++
+ if (is->debug & 0x8)
+ isdn_ppp_mp_print_recv_pkt(lp->ppp_slot, skb);
+
+- newseq = isdn_ppp_mp_get_seq(is->mpppcfg & SC_IN_SHORT_SEQ,
+- skb, is->last_link_seqno);
++ newseq = isdn_ppp_mp_get_seq(is->mpppcfg & SC_IN_SHORT_SEQ,
++ skb, is->last_link_seqno);
++
+
+ /* if this packet seq # is less than last already processed one,
+ * toss it right away, but check for sequence start case first
+ */
+- if (mp->seq > MP_LONGSEQ_MAX && (newseq & MP_LONGSEQ_MAXBIT)) {
++ if( mp->seq > MP_LONGSEQ_MAX && (newseq & MP_LONGSEQ_MAXBIT) ) {
+ mp->seq = newseq; /* the first packet: required for
+ * rfc1990 non-compliant clients --
+ * prevents constant packet toss */
+@@ -1638,7 +1636,7 @@ static void isdn_ppp_mp_receive(isdn_net
+ spin_unlock_irqrestore(&mp->lock, flags);
+ return;
+ }
+-
++
+ /* find the minimum received sequence number over all links */
+ is->last_link_seqno = minseq = newseq;
+ for (lpq = net_dev->queue;;) {
+@@ -1659,31 +1657,22 @@ static void isdn_ppp_mp_receive(isdn_net
+ * packets */
+ newfrag = skb;
+
+- /* Insert new fragment into the proper sequence slot. */
+- skb_queue_walk(&mp->frags, frag) {
+- if (MP_SEQ(frag) == newseq) {
+- isdn_ppp_mp_free_skb(mp, newfrag);
+- newfrag = NULL;
+- break;
+- }
+- if (MP_LT(newseq, MP_SEQ(frag))) {
+- __skb_queue_before(&mp->frags, frag, newfrag);
+- newfrag = NULL;
+- break;
+- }
+- }
+- if (newfrag)
+- __skb_queue_tail(&mp->frags, newfrag);
++ /* if this new fragment is before the first one, then enqueue it now. */
++ if ((frag = mp->frags) == NULL || MP_LT(newseq, MP_SEQ(frag))) {
++ newfrag->next = frag;
++ mp->frags = frag = newfrag;
++ newfrag = NULL;
++ }
+
+- frag = skb_peek(&mp->frags);
+- start = ((MP_FLAGS(frag) & MP_BEGIN_FRAG) &&
+- (MP_SEQ(frag) == mp->seq)) ? frag : NULL;
+- if (!start)
+- goto check_overflow;
++ start = MP_FLAGS(frag) & MP_BEGIN_FRAG &&
++ MP_SEQ(frag) == mp->seq ? frag : NULL;
+
+- /* main fragment traversing loop
++ /*
++ * main fragment traversing loop
+ *
+ * try to accomplish several tasks:
++ * - insert new fragment into the proper sequence slot (once that's done
++ * newfrag will be set to NULL)
+ * - reassemble any complete fragment sequence (non-null 'start'
+ * indicates there is a continguous sequence present)
+ * - discard any incomplete sequences that are below minseq -- due
+@@ -1692,46 +1681,71 @@ static void isdn_ppp_mp_receive(isdn_net
+ * come to complete such sequence and it should be discarded
+ *
+ * loop completes when we accomplished the following tasks:
++ * - new fragment is inserted in the proper sequence ('newfrag' is
++ * set to NULL)
+ * - we hit a gap in the sequence, so no reassembly/processing is
+ * possible ('start' would be set to NULL)
+ *
+ * algorithm for this code is derived from code in the book
+ * 'PPP Design And Debugging' by James Carlson (Addison-Wesley)
+ */
+- skb_queue_walk_safe(&mp->frags, frag, nextf) {
+- thisseq = MP_SEQ(frag);
++ while (start != NULL || newfrag != NULL) {
+
+- /* check for misplaced start */
+- if (start != frag && (MP_FLAGS(frag) & MP_BEGIN_FRAG)) {
+- printk(KERN_WARNING"isdn_mppp(seq %d): new "
+- "BEGIN flag with no prior END", thisseq);
+- stats->seqerrs++;
+- stats->frame_drops++;
+- isdn_ppp_mp_discard(mp, start, frag);
+- start = frag;
+- } else if (MP_LE(thisseq, minseq)) {
+- if (MP_FLAGS(frag) & MP_BEGIN_FRAG)
++ thisseq = MP_SEQ(frag);
++ nextf = frag->next;
++
++ /* drop any duplicate fragments */
++ if (newfrag != NULL && thisseq == newseq) {
++ isdn_ppp_mp_free_skb(mp, newfrag);
++ newfrag = NULL;
++ }
++
++ /* insert new fragment before next element if possible. */
++ if (newfrag != NULL && (nextf == NULL ||
++ MP_LT(newseq, MP_SEQ(nextf)))) {
++ newfrag->next = nextf;
++ frag->next = nextf = newfrag;
++ newfrag = NULL;
++ }
++
++ if (start != NULL) {
++ /* check for misplaced start */
++ if (start != frag && (MP_FLAGS(frag) & MP_BEGIN_FRAG)) {
++ printk(KERN_WARNING"isdn_mppp(seq %d): new "
++ "BEGIN flag with no prior END", thisseq);
++ stats->seqerrs++;
++ stats->frame_drops++;
++ start = isdn_ppp_mp_discard(mp, start,frag);
++ nextf = frag->next;
++ }
++ } else if (MP_LE(thisseq, minseq)) {
++ if (MP_FLAGS(frag) & MP_BEGIN_FRAG)
+ start = frag;
+- else {
++ else {
+ if (MP_FLAGS(frag) & MP_END_FRAG)
+- stats->frame_drops++;
+- __skb_unlink(skb, &mp->frags);
++ stats->frame_drops++;
++ if( mp->frags == frag )
++ mp->frags = nextf;
+ isdn_ppp_mp_free_skb(mp, frag);
++ frag = nextf;
+ continue;
+- }
++ }
+ }
+-
+- /* if we have end fragment, then we have full reassembly
+- * sequence -- reassemble and process packet now
++
++ /* if start is non-null and we have end fragment, then
++ * we have full reassembly sequence -- reassemble
++ * and process packet now
+ */
+- if (MP_FLAGS(frag) & MP_END_FRAG) {
+- minseq = mp->seq = (thisseq+1) & MP_LONGSEQ_MASK;
+- /* Reassemble the packet then dispatch it */
+- isdn_ppp_mp_reassembly(net_dev, lp, start, frag, thisseq);
++ if (start != NULL && (MP_FLAGS(frag) & MP_END_FRAG)) {
++ minseq = mp->seq = (thisseq+1) & MP_LONGSEQ_MASK;
++ /* Reassemble the packet then dispatch it */
++ isdn_ppp_mp_reassembly(net_dev, lp, start, nextf);
++
++ start = NULL;
++ frag = NULL;
+
+- start = NULL;
+- frag = NULL;
+- }
++ mp->frags = nextf;
++ }
+
+ /* check if need to update start pointer: if we just
+ * reassembled the packet and sequence is contiguous
+@@ -1742,25 +1756,26 @@ static void isdn_ppp_mp_receive(isdn_net
+ * below low watermark and set start to the next frag or
+ * clear start ptr.
+ */
+- if (nextf != (struct sk_buff *)&mp->frags &&
++ if (nextf != NULL &&
+ ((thisseq+1) & MP_LONGSEQ_MASK) == MP_SEQ(nextf)) {
+- /* if we just reassembled and the next one is here,
+- * then start another reassembly.
+- */
+- if (frag == NULL) {
++ /* if we just reassembled and the next one is here,
++ * then start another reassembly. */
++
++ if (frag == NULL) {
+ if (MP_FLAGS(nextf) & MP_BEGIN_FRAG)
+- start = nextf;
+- else {
+- printk(KERN_WARNING"isdn_mppp(seq %d):"
+- " END flag with no following "
+- "BEGIN", thisseq);
++ start = nextf;
++ else
++ {
++ printk(KERN_WARNING"isdn_mppp(seq %d):"
++ " END flag with no following "
++ "BEGIN", thisseq);
+ stats->seqerrs++;
+ }
+ }
+- } else {
+- if (nextf != (struct sk_buff *)&mp->frags &&
+- frag != NULL &&
+- MP_LT(thisseq, minseq)) {
++
++ } else {
++ if ( nextf != NULL && frag != NULL &&
++ MP_LT(thisseq, minseq)) {
+ /* we've got a break in the sequence
+ * and we not at the end yet
+ * and we did not just reassembled
+@@ -1769,39 +1784,41 @@ static void isdn_ppp_mp_receive(isdn_net
+ * discard all the frames below low watermark
+ * and start over */
+ stats->frame_drops++;
+- isdn_ppp_mp_discard(mp, start, nextf);
++ mp->frags = isdn_ppp_mp_discard(mp,start,nextf);
+ }
+ /* break in the sequence, no reassembly */
+- start = NULL;
+- }
+- if (!start)
+- break;
+- }
+-
+-check_overflow:
++ start = NULL;
++ }
++
++ frag = nextf;
++ } /* while -- main loop */
++
++ if (mp->frags == NULL)
++ mp->frags = frag;
++
+ /* rather straighforward way to deal with (not very) possible
+- * queue overflow
+- */
++ * queue overflow */
+ if (mp->frames > MP_MAX_QUEUE_LEN) {
+ stats->overflows++;
+- skb_queue_walk_safe(&mp->frags, frag, nextf) {
+- if (mp->frames <= MP_MAX_QUEUE_LEN)
+- break;
+- __skb_unlink(frag, &mp->frags);
+- isdn_ppp_mp_free_skb(mp, frag);
++ while (mp->frames > MP_MAX_QUEUE_LEN) {
++ frag = mp->frags->next;
++ isdn_ppp_mp_free_skb(mp, mp->frags);
++ mp->frags = frag;
+ }
+ }
+ spin_unlock_irqrestore(&mp->lock, flags);
+ }
+
+-static void isdn_ppp_mp_cleanup(isdn_net_local *lp)
++static void isdn_ppp_mp_cleanup( isdn_net_local * lp )
+ {
+- struct sk_buff *skb, *tmp;
+-
+- skb_queue_walk_safe(&lp->netdev->pb->frags, skb, tmp) {
+- __skb_unlink(skb, &lp->netdev->pb->frags);
+- isdn_ppp_mp_free_skb(lp->netdev->pb, skb);
++ struct sk_buff * frag = lp->netdev->pb->frags;
++ struct sk_buff * nextfrag;
++ while( frag ) {
++ nextfrag = frag->next;
++ isdn_ppp_mp_free_skb(lp->netdev->pb, frag);
++ frag = nextfrag;
+ }
++ lp->netdev->pb->frags = NULL;
+ }
+
+ static u32 isdn_ppp_mp_get_seq( int short_seq,
+@@ -1838,115 +1855,72 @@ static u32 isdn_ppp_mp_get_seq( int shor
+ return seq;
+ }
+
+-static void isdn_ppp_mp_discard(ippp_bundle *mp, struct sk_buff *from,
+- struct sk_buff *to)
++struct sk_buff * isdn_ppp_mp_discard( ippp_bundle * mp,
++ struct sk_buff * from, struct sk_buff * to )
+ {
+- if (from) {
+- struct sk_buff *skb, *tmp;
+- int freeing = 0;
+-
+- skb_queue_walk_safe(&mp->frags, skb, tmp) {
+- if (skb == to)
+- break;
+- if (skb == from)
+- freeing = 1;
+- if (!freeing)
+- continue;
+- __skb_unlink(skb, &mp->frags);
+- isdn_ppp_mp_free_skb(mp, skb);
++ if( from )
++ while (from != to) {
++ struct sk_buff * next = from->next;
++ isdn_ppp_mp_free_skb(mp, from);
++ from = next;
+ }
+- }
++ return from;
+ }
+
+-static unsigned int calc_tot_len(struct sk_buff_head *queue,
+- struct sk_buff *from, struct sk_buff *to)
+-{
+- unsigned int tot_len = 0;
+- struct sk_buff *skb;
+- int found_start = 0;
+-
+- skb_queue_walk(queue, skb) {
+- if (skb == from)
+- found_start = 1;
+- if (!found_start)
+- continue;
+- tot_len += skb->len - MP_HEADER_LEN;
+- if (skb == to)
+- break;
+- }
+- return tot_len;
+-}
+-
+-/* Reassemble packet using fragments in the reassembly queue from
+- * 'from' until 'to', inclusive.
+- */
+-static void isdn_ppp_mp_reassembly(isdn_net_dev *net_dev, isdn_net_local *lp,
+- struct sk_buff *from, struct sk_buff *to,
+- u32 lastseq)
++void isdn_ppp_mp_reassembly( isdn_net_dev * net_dev, isdn_net_local * lp,
++ struct sk_buff * from, struct sk_buff * to )
+ {
+- ippp_bundle *mp = net_dev->pb;
+- unsigned int tot_len;
+- struct sk_buff *skb;
++ ippp_bundle * mp = net_dev->pb;
+ int proto;
++ struct sk_buff * skb;
++ unsigned int tot_len;
+
+ if (lp->ppp_slot < 0 || lp->ppp_slot >= ISDN_MAX_CHANNELS) {
+ printk(KERN_ERR "%s: lp->ppp_slot(%d) out of range\n",
+ __func__, lp->ppp_slot);
+ return;
+ }
+-
+- tot_len = calc_tot_len(&mp->frags, from, to);
+-
+- if (MP_FLAGS(from) == (MP_BEGIN_FRAG | MP_END_FRAG)) {
+- if (ippp_table[lp->ppp_slot]->debug & 0x40)
++ if( MP_FLAGS(from) == (MP_BEGIN_FRAG | MP_END_FRAG) ) {
++ if( ippp_table[lp->ppp_slot]->debug & 0x40 )
+ printk(KERN_DEBUG "isdn_mppp: reassembly: frame %d, "
+- "len %d\n", MP_SEQ(from), from->len);
++ "len %d\n", MP_SEQ(from), from->len );
+ skb = from;
+ skb_pull(skb, MP_HEADER_LEN);
+- __skb_unlink(skb, &mp->frags);
+ mp->frames--;
+ } else {
+- struct sk_buff *walk, *tmp;
+- int found_start = 0;
++ struct sk_buff * frag;
++ int n;
+
+- if (ippp_table[lp->ppp_slot]->debug & 0x40)
+- printk(KERN_DEBUG"isdn_mppp: reassembling frames %d "
+- "to %d, len %d\n", MP_SEQ(from), lastseq,
+- tot_len);
++ for(tot_len=n=0, frag=from; frag != to; frag=frag->next, n++)
++ tot_len += frag->len - MP_HEADER_LEN;
+
+- skb = dev_alloc_skb(tot_len);
+- if (!skb)
++ if( ippp_table[lp->ppp_slot]->debug & 0x40 )
++ printk(KERN_DEBUG"isdn_mppp: reassembling frames %d "
++ "to %d, len %d\n", MP_SEQ(from),
++ (MP_SEQ(from)+n-1) & MP_LONGSEQ_MASK, tot_len );
++ if( (skb = dev_alloc_skb(tot_len)) == NULL ) {
+ printk(KERN_ERR "isdn_mppp: cannot allocate sk buff "
+- "of size %d\n", tot_len);
+-
+- found_start = 0;
+- skb_queue_walk_safe(&mp->frags, walk, tmp) {
+- if (walk == from)
+- found_start = 1;
+- if (!found_start)
+- continue;
++ "of size %d\n", tot_len);
++ isdn_ppp_mp_discard(mp, from, to);
++ return;
++ }
+
+- if (skb) {
+- unsigned int len = walk->len - MP_HEADER_LEN;
+- skb_copy_from_linear_data_offset(walk, MP_HEADER_LEN,
+- skb_put(skb, len),
+- len);
+- }
+- __skb_unlink(walk, &mp->frags);
+- isdn_ppp_mp_free_skb(mp, walk);
++ while( from != to ) {
++ unsigned int len = from->len - MP_HEADER_LEN;
+
+- if (walk == to)
+- break;
++ skb_copy_from_linear_data_offset(from, MP_HEADER_LEN,
++ skb_put(skb,len),
++ len);
++ frag = from->next;
++ isdn_ppp_mp_free_skb(mp, from);
++ from = frag;
+ }
+ }
+- if (!skb)
+- return;
+-
+ proto = isdn_ppp_strip_proto(skb);
+ isdn_ppp_push_higher(net_dev, lp, skb, proto);
+ }
+
+-static void isdn_ppp_mp_free_skb(ippp_bundle *mp, struct sk_buff *skb)
++static void isdn_ppp_mp_free_skb(ippp_bundle * mp, struct sk_buff * skb)
+ {
+ dev_kfree_skb(skb);
+ mp->frames--;
+--- a/include/linux/isdn_ppp.h
++++ b/include/linux/isdn_ppp.h
+@@ -157,7 +157,7 @@ typedef struct {
+
+ typedef struct {
+ int mp_mrru; /* unused */
+- struct sk_buff_head frags; /* fragments sl list */
++ struct sk_buff * frags; /* fragments sl list -- use skb->next */
+ long frames; /* number of frames in the frame list */
+ unsigned int seq; /* last processed packet seq #: any packets
+ * with smaller seq # will be dropped
+
+
+From gregkh@mini.kroah.org Wed Dec 16 17:16:05 2009
+Message-Id: <20091217011605.019497617@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 17:15:05 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jarek Poplawski <jarkao2@gmail.com>,
+ Eric Dumazet <eric.dumazet@gmail.com>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [54/90] net: Fix the rollback test in dev_change_name()
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+
+From: Eric Dumazet <eric.dumazet@gmail.com>
+
+[ Upstream commit 91e9c07bd635353d1a278bdb38dbb56ac371bcb8 ]
+
+net: Fix the rollback test in dev_change_name()
+
+In dev_change_name() an err variable is used for storing the original
+call_netdevice_notifiers() errno (negative) and testing for a rollback
+error later, but the test for non-zero is wrong, because the err might
+have positive value as well - from dev_alloc_name(). It means the
+rollback for a netdevice with a number > 0 will never happen. (The err
+test is reordered btw. to make it more readable.)
+
+Signed-off-by: Jarek Poplawski <jarkao2@gmail.com>
+Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/core/dev.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -933,14 +933,15 @@ rollback:
+ ret = notifier_to_errno(ret);
+
+ if (ret) {
+- if (err) {
+- printk(KERN_ERR
+- "%s: name change rollback failed: %d.\n",
+- dev->name, ret);
+- } else {
++ /* err >= 0 after dev_alloc_name() or stores the first errno */
++ if (err >= 0) {
+ err = ret;
+ memcpy(dev->name, oldname, IFNAMSIZ);
+ goto rollback;
++ } else {
++ printk(KERN_ERR
++ "%s: name change rollback failed: %d.\n",
++ dev->name, ret);
+ }
+ }
+
+
+
+From gregkh@mini.kroah.org Wed Dec 16 17:16:05 2009
+Message-Id: <20091217011605.149734203@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 17:15:06 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Russell King <rmk+kernel@arm.linux.org.uk>,
+ Eric Miao <eric.y.miao@gmail.com>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [55/90] NET: smc91x: Fix irq flags
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+
+From: Russell King - ARM Linux <linux@arm.linux.org.uk>
+
+[ Upstream commit d5ccd67bb77ced5249067d05171992a7d5020393 ]
+
+smc91x.h defines SMC_IRQ_FLAGS to be -1 when it wants the interrupt
+flags to be taken from the resource structure. However, d280ead
+changed this to checking for non-zero resource flags.
+
+Unfortunately, this means that on some platforms, we end up passing
+'-1' to request_irq rather than the desired result. Combine the two
+conditions into one so that the IRQ flags are taken from the resource
+if either SMC_IRQ_FLAGS is -1 or the resource flags specify an
+interrupt trigger.
+
+This restores network on at least the Versatile platform.
+
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Acked-by: Eric Miao <eric.y.miao@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/net/smc91x.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/smc91x.c
++++ b/drivers/net/smc91x.c
+@@ -2283,7 +2283,7 @@ static int __devinit smc_drv_probe(struc
+
+ ndev->irq = ires->start;
+
+- if (ires->flags & IRQF_TRIGGER_MASK)
++ if (irq_flags == -1 || ires->flags & IRQF_TRIGGER_MASK)
+ irq_flags = ires->flags & IRQF_TRIGGER_MASK;
+
+ ret = smc_request_attrib(pdev, ndev);
+
+
+From gregkh@mini.kroah.org Wed Dec 16 17:16:05 2009
+Message-Id: <20091217011605.286045484@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 17:15:07 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Steve Glendinning <steve.glendinning@smsc.com>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [56/90] smsc9420: prevent BUG() if ethtool is called with interface down
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+
+From: Steve Glendinning <steve.glendinning@smsc.com>
+
+[ Upstream commit 6c53b1b15e222244358d3cbbefd2a13920faa352 ]
+
+This patch fixes a null pointer dereference BUG() if ethtool is used on
+an smsc9420 interface while it is down, because the phy_dev is only
+allocated while the interface is up.
+
+Signed-off-by: Steve Glendinning <steve.glendinning@smsc.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/net/smsc9420.c | 14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+
+--- a/drivers/net/smsc9420.c
++++ b/drivers/net/smsc9420.c
+@@ -252,6 +252,9 @@ static int smsc9420_ethtool_get_settings
+ {
+ struct smsc9420_pdata *pd = netdev_priv(dev);
+
++ if (!pd->phy_dev)
++ return -ENODEV;
++
+ cmd->maxtxpkt = 1;
+ cmd->maxrxpkt = 1;
+ return phy_ethtool_gset(pd->phy_dev, cmd);
+@@ -262,6 +265,9 @@ static int smsc9420_ethtool_set_settings
+ {
+ struct smsc9420_pdata *pd = netdev_priv(dev);
+
++ if (!pd->phy_dev)
++ return -ENODEV;
++
+ return phy_ethtool_sset(pd->phy_dev, cmd);
+ }
+
+@@ -290,6 +296,10 @@ static void smsc9420_ethtool_set_msgleve
+ static int smsc9420_ethtool_nway_reset(struct net_device *netdev)
+ {
+ struct smsc9420_pdata *pd = netdev_priv(netdev);
++
++ if (!pd->phy_dev)
++ return -ENODEV;
++
+ return phy_start_aneg(pd->phy_dev);
+ }
+
+@@ -312,6 +322,10 @@ smsc9420_ethtool_getregs(struct net_devi
+ for (i = 0; i < 0x100; i += (sizeof(u32)))
+ data[j++] = smsc9420_reg_read(pd, i);
+
++ // cannot read phy registers if the net device is down
++ if (!phy_dev)
++ return;
++
+ for (i = 0; i <= 31; i++)
+ data[j++] = smsc9420_mii_read(phy_dev->bus, phy_dev->addr, i);
+ }
+
+
+From gregkh@mini.kroah.org Wed Dec 16 17:16:05 2009
+Message-Id: <20091217011605.421274510@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 17:15:08 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Eric Dumazet <eric.dumazet@gmail.com>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [57/90] vlan: Fix register_vlan_dev() error path
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+
+From: Eric Dumazet <eric.dumazet@gmail.com>
+
+[ Upstream commit 6b863d1d3239eff0f45c2e6e672f5b56db828db0 ]
+
+In case register_netdevice() returns an error, and a new vlan_group
+was allocated and inserted in vlan_group_hash[] we call
+vlan_group_free() without deleting group from hash table. Future
+lookups can give infinite loops or crashes.
+
+We must delete the vlan_group using RCU safe procedure.
+
+Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/8021q/vlan.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/net/8021q/vlan.c
++++ b/net/8021q/vlan.c
+@@ -287,8 +287,11 @@ out_uninit_applicant:
+ if (ngrp)
+ vlan_gvrp_uninit_applicant(real_dev);
+ out_free_group:
+- if (ngrp)
+- vlan_group_free(ngrp);
++ if (ngrp) {
++ hlist_del_rcu(&ngrp->hlist);
++ /* Free the group, after all cpu's are done. */
++ call_rcu(&ngrp->rcu, vlan_rcu_free);
++ }
+ return err;
+ }
+
+
+
+From gregkh@mini.kroah.org Wed Dec 16 17:16:05 2009
+Message-Id: <20091217011605.553623715@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 17:15:09 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [58/90] sparc64: Fix definition of VMEMMAP_SIZE.
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+
+From: David S. Miller <davem@davemloft.net>
+
+[ Upstream commit bffbc94a4d2c1769c3826fceddd2dbb75e72c80b ]
+
+This was the cause of various boot failures on V480, V880, etc.
+systems.
+
+Kernel image memory was being overwritten because the vmemmap[]
+array was being sized to small. So if you had physical memory
+addresses past a certain point, the early bootup would spam
+all over variables in the kernel data section.
+
+The vmemmap mappings map page structs, not page struct pointers.
+And that was the key thinko in the macro definition.
+
+This was fixable thanks to the help, reports, and tireless patience
+of Hermann Lauer.
+
+Reported-by: Hermann Lauer <Hermann.Lauer@iwr.uni-heidelberg.de>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ arch/sparc/mm/init_64.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/sparc/mm/init_64.h
++++ b/arch/sparc/mm/init_64.h
+@@ -45,7 +45,7 @@ extern void free_initmem(void);
+ #define VMEMMAP_ALIGN(x) (((x)+VMEMMAP_CHUNK-1UL)&VMEMMAP_CHUNK_MASK)
+
+ #define VMEMMAP_SIZE ((((1UL << MAX_PHYSADDR_BITS) >> PAGE_SHIFT) * \
+- sizeof(struct page *)) >> VMEMMAP_CHUNK_SHIFT)
++ sizeof(struct page)) >> VMEMMAP_CHUNK_SHIFT)
+ extern unsigned long vmemmap_table[VMEMMAP_SIZE];
+ #endif
+
+
+
+From gregkh@mini.kroah.org Wed Dec 16 17:16:05 2009
+Message-Id: <20091217011605.681672604@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 17:15:10 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [59/90] sunsab: Do not set sunsab_reg.cons right before registering minors.
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+
+From: David S. Miller <davem@davemloft.net>
+
+[ Upstream commit 4e68e188411ea98e40309700cf0c89ad4469ac1d ]
+
+Other Sun serial drivers do not do this, and if we keep it this way
+it ends up registering all serial devices as consoles rather than
+just the one which we explicitly register via sunserial_console_match()
+which uses add_preferred_console().
+
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/serial/sunsab.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/drivers/serial/sunsab.c
++++ b/drivers/serial/sunsab.c
+@@ -1116,7 +1116,6 @@ static int __init sunsab_init(void)
+ if (!sunsab_ports)
+ return -ENOMEM;
+
+- sunsab_reg.cons = SUNSAB_CONSOLE();
+ err = sunserial_register_minors(&sunsab_reg, num_channels);
+ if (err) {
+ kfree(sunsab_ports);
+
+
+From gregkh@mini.kroah.org Wed Dec 16 17:16:05 2009
+Message-Id: <20091217011605.824429156@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 17:15:11 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [60/90] sunsu: Fix detection of SU ports which are RSC console or control.
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+
+From: David S. Miller <davem@davemloft.net>
+
+[ Upstream commit 8301d386afc55c877bafe2c6c7dc75a96ddd2838 ]
+
+These device nodes are named "rsc-console" and "rsc-control" rather
+than 'serial', but the device_type property is 'serial' so we'll
+tip off of that for detection.
+
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/serial/sunsu.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/drivers/serial/sunsu.c
++++ b/drivers/serial/sunsu.c
+@@ -1517,6 +1517,10 @@ static const struct of_device_id su_matc
+ .name = "serial",
+ .compatible = "su",
+ },
++ {
++ .type = "serial",
++ .compatible = "su",
++ },
+ {},
+ };
+ MODULE_DEVICE_TABLE(of, su_match);
+@@ -1548,6 +1552,12 @@ static int __init sunsu_init(void)
+ num_uart++;
+ }
+ }
++ for_each_node_by_type(dp, "serial") {
++ if (of_device_is_compatible(dp, "su")) {
++ if (su_get_type(dp) == SU_PORT_PORT)
++ num_uart++;
++ }
++ }
+
+ if (num_uart) {
+ err = sunserial_register_minors(&sunsu_reg, num_uart);
+
+
+From gregkh@mini.kroah.org Wed Dec 16 17:16:06 2009
+Message-Id: <20091217011605.938263178@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 17:15:12 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [61/90] serial: suncore: Add ignore_line argument to sunserial_console_match().
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+
+From: David S. Miller <davem@davemloft.net>
+
+[ Upstream commit 4e3533d05b6e5e66d1cda27f6671251c99c62894 ]
+
+This tells the logic to ignore the line match when deciding whether the
+device is the OpenFirmware specified console device or not.
+
+This is going to be used in the SU driver for rsc-console detection.
+
+There is probably a better way to handle this, but this is the least
+intrusive solution for now which we can validate won't break any other
+cases.
+
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/serial/suncore.c | 19 ++++++++++---------
+ drivers/serial/suncore.h | 2 +-
+ drivers/serial/sunsab.c | 6 ++++--
+ drivers/serial/sunsu.c | 3 ++-
+ drivers/serial/sunzilog.c | 6 ++++--
+ 5 files changed, 21 insertions(+), 15 deletions(-)
+
+--- a/drivers/serial/suncore.c
++++ b/drivers/serial/suncore.c
+@@ -53,20 +53,21 @@ void sunserial_unregister_minors(struct
+ EXPORT_SYMBOL(sunserial_unregister_minors);
+
+ int sunserial_console_match(struct console *con, struct device_node *dp,
+- struct uart_driver *drv, int line)
++ struct uart_driver *drv, int line, bool ignore_line)
+ {
+- int off;
+-
+ if (!con || of_console_device != dp)
+ return 0;
+
+- off = 0;
+- if (of_console_options &&
+- *of_console_options == 'b')
+- off = 1;
++ if (!ignore_line) {
++ int off = 0;
+
+- if ((line & 1) != off)
+- return 0;
++ if (of_console_options &&
++ *of_console_options == 'b')
++ off = 1;
++
++ if ((line & 1) != off)
++ return 0;
++ }
+
+ con->index = line;
+ drv->cons = con;
+--- a/drivers/serial/suncore.h
++++ b/drivers/serial/suncore.h
+@@ -26,7 +26,7 @@ extern int sunserial_register_minors(str
+ extern void sunserial_unregister_minors(struct uart_driver *, int);
+
+ extern int sunserial_console_match(struct console *, struct device_node *,
+- struct uart_driver *, int);
++ struct uart_driver *, int, bool);
+ extern void sunserial_console_termios(struct console *);
+
+ #endif /* !(_SERIAL_SUN_H) */
+--- a/drivers/serial/sunsab.c
++++ b/drivers/serial/sunsab.c
+@@ -1027,10 +1027,12 @@ static int __devinit sab_probe(struct of
+ goto out1;
+
+ sunserial_console_match(SUNSAB_CONSOLE(), op->node,
+- &sunsab_reg, up[0].port.line);
++ &sunsab_reg, up[0].port.line,
++ false);
+
+ sunserial_console_match(SUNSAB_CONSOLE(), op->node,
+- &sunsab_reg, up[1].port.line);
++ &sunsab_reg, up[1].port.line,
++ false);
+
+ err = uart_add_one_port(&sunsab_reg, &up[0].port);
+ if (err)
+--- a/drivers/serial/sunsu.c
++++ b/drivers/serial/sunsu.c
+@@ -1468,7 +1468,8 @@ static int __devinit su_probe(struct of_
+ up->port.ops = &sunsu_pops;
+
+ sunserial_console_match(SUNSU_CONSOLE(), dp,
+- &sunsu_reg, up->port.line);
++ &sunsu_reg, up->port.line,
++ false);
+ err = uart_add_one_port(&sunsu_reg, &up->port);
+ if (err)
+ goto out_unmap;
+--- a/drivers/serial/sunzilog.c
++++ b/drivers/serial/sunzilog.c
+@@ -1416,7 +1416,8 @@ static int __devinit zs_probe(struct of_
+
+ if (!keyboard_mouse) {
+ if (sunserial_console_match(SUNZILOG_CONSOLE(), op->node,
+- &sunzilog_reg, up[0].port.line))
++ &sunzilog_reg, up[0].port.line,
++ false))
+ up->flags |= SUNZILOG_FLAG_IS_CONS;
+ err = uart_add_one_port(&sunzilog_reg, &up[0].port);
+ if (err) {
+@@ -1425,7 +1426,8 @@ static int __devinit zs_probe(struct of_
+ return err;
+ }
+ if (sunserial_console_match(SUNZILOG_CONSOLE(), op->node,
+- &sunzilog_reg, up[1].port.line))
++ &sunzilog_reg, up[1].port.line,
++ false))
+ up->flags |= SUNZILOG_FLAG_IS_CONS;
+ err = uart_add_one_port(&sunzilog_reg, &up[1].port);
+ if (err) {
+
+
+From gregkh@mini.kroah.org Wed Dec 16 17:16:06 2009
+Message-Id: <20091217011606.083503274@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 17:15:13 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [62/90] serial: suncore: Fix RSC/LOM handling in sunserial_console_termios().
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+
+From: David S. Miller <davem@davemloft.net>
+
+[ Upstream commit 457931de3b0925dc2eb941bc7d611a509be36dff ]
+
+RSC and LOM devices have fixed speed settings.
+
+We already had some code to match and handle "rsc" named devices on
+E250 systems, but we also have to handle 'rsc-console', 'rsc-control',
+and 'lom-console'.
+
+Also, in order to get this right regardless of what 'output-device'
+happens to be, explicitly pass the UART device node pointer to this
+routine.
+
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/serial/suncore.c | 18 ++++++++++--------
+ drivers/serial/suncore.h | 3 ++-
+ drivers/serial/sunhv.c | 2 +-
+ drivers/serial/sunsab.c | 2 +-
+ drivers/serial/sunzilog.c | 2 +-
+ 5 files changed, 15 insertions(+), 12 deletions(-)
+
+--- a/drivers/serial/suncore.c
++++ b/drivers/serial/suncore.c
+@@ -77,23 +77,24 @@ int sunserial_console_match(struct conso
+ }
+ EXPORT_SYMBOL(sunserial_console_match);
+
+-void
+-sunserial_console_termios(struct console *con)
++void sunserial_console_termios(struct console *con, struct device_node *uart_dp)
+ {
+- struct device_node *dp;
+- const char *od, *mode, *s;
++ const char *mode, *s;
+ char mode_prop[] = "ttyX-mode";
+ int baud, bits, stop, cflag;
+ char parity;
+
+- dp = of_find_node_by_path("/options");
+- od = of_get_property(dp, "output-device", NULL);
+- if (!strcmp(od, "rsc")) {
+- mode = of_get_property(of_console_device,
++ if (!strcmp(uart_dp->name, "rsc") ||
++ !strcmp(uart_dp->name, "rsc-console") ||
++ !strcmp(uart_dp->name, "rsc-control")) {
++ mode = of_get_property(uart_dp,
+ "ssp-console-modes", NULL);
+ if (!mode)
+ mode = "115200,8,n,1,-";
++ } else if (!strcmp(uart_dp->name, "lom-console")) {
++ mode = "9600,8,n,1,-";
+ } else {
++ struct device_node *dp;
+ char c;
+
+ c = 'a';
+@@ -102,6 +103,7 @@ sunserial_console_termios(struct console
+
+ mode_prop[3] = c;
+
++ dp = of_find_node_by_path("/options");
+ mode = of_get_property(dp, mode_prop, NULL);
+ if (!mode)
+ mode = "9600,8,n,1,-";
+--- a/drivers/serial/suncore.h
++++ b/drivers/serial/suncore.h
+@@ -27,6 +27,7 @@ extern void sunserial_unregister_minors(
+
+ extern int sunserial_console_match(struct console *, struct device_node *,
+ struct uart_driver *, int, bool);
+-extern void sunserial_console_termios(struct console *);
++extern void sunserial_console_termios(struct console *,
++ struct device_node *);
+
+ #endif /* !(_SERIAL_SUN_H) */
+--- a/drivers/serial/sunhv.c
++++ b/drivers/serial/sunhv.c
+@@ -566,7 +566,7 @@ static int __devinit hv_probe(struct of_
+ goto out_free_con_read_page;
+
+ sunserial_console_match(&sunhv_console, op->node,
+- &sunhv_reg, port->line);
++ &sunhv_reg, port->line, false);
+
+ err = uart_add_one_port(&sunhv_reg, port);
+ if (err)
+--- a/drivers/serial/sunsab.c
++++ b/drivers/serial/sunsab.c
+@@ -883,7 +883,7 @@ static int sunsab_console_setup(struct c
+ printk("Console: ttyS%d (SAB82532)\n",
+ (sunsab_reg.minor - 64) + con->index);
+
+- sunserial_console_termios(con);
++ sunserial_console_termios(con, to_of_device(up->port.dev)->node);
+
+ switch (con->cflag & CBAUD) {
+ case B150: baud = 150; break;
+--- a/drivers/serial/sunzilog.c
++++ b/drivers/serial/sunzilog.c
+@@ -1180,7 +1180,7 @@ static int __init sunzilog_console_setup
+ (sunzilog_reg.minor - 64) + con->index, con->index);
+
+ /* Get firmware console settings. */
+- sunserial_console_termios(con);
++ sunserial_console_termios(con, to_of_device(up->port.dev)->node);
+
+ /* Firmware console speed is limited to 150-->38400 baud so
+ * this hackish cflag thing is OK.
+
+
+From gregkh@mini.kroah.org Wed Dec 16 17:16:06 2009
+Message-Id: <20091217011606.209811936@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 17:15:14 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [63/90] sunsu: Pass true ignore_line to console match when RSC or LOM console.
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+
+From: David S. Miller <davem@davemloft.net>
+
+[ Upstream commit 1917d17b903955b8b2903626a2e01d071a5d0ec9 ]
+
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/serial/sunsu.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+--- a/drivers/serial/sunsu.c
++++ b/drivers/serial/sunsu.c
+@@ -1409,6 +1409,7 @@ static int __devinit su_probe(struct of_
+ struct uart_sunsu_port *up;
+ struct resource *rp;
+ enum su_type type;
++ bool ignore_line;
+ int err;
+
+ type = su_get_type(dp);
+@@ -1467,9 +1468,14 @@ static int __devinit su_probe(struct of_
+
+ up->port.ops = &sunsu_pops;
+
++ ignore_line = false;
++ if (!strcmp(dp->name, "rsc-console") ||
++ !strcmp(dp->name, "lom-console"))
++ ignore_line = true;
++
+ sunserial_console_match(SUNSU_CONSOLE(), dp,
+ &sunsu_reg, up->port.line,
+- false);
++ ignore_line);
+ err = uart_add_one_port(&sunsu_reg, &up->port);
+ if (err)
+ goto out_unmap;
+
+
+From gregkh@mini.kroah.org Wed Dec 16 17:16:06 2009
+Message-Id: <20091217011606.338794179@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 17:15:15 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [64/90] sunsu: Use sunserial_console_termios() in sunsu_console_setup().
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+
+From: David S. Miller <davem@davemloft.net>
+
+[ Upstream commit be24656a5e2d68bfd0744f0742c4aceef2cf44b5 ]
+
+Be like the other Sun serial drivers otherwise the special handling of
+OpenFirmware options and hard-coded overrides for LOM/RSC consoles
+will not be handled.
+
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/serial/sunsu.c | 17 ++++++++++-------
+ 1 file changed, 10 insertions(+), 7 deletions(-)
+
+--- a/drivers/serial/sunsu.c
++++ b/drivers/serial/sunsu.c
+@@ -1329,11 +1329,9 @@ static void sunsu_console_write(struct c
+ */
+ static int __init sunsu_console_setup(struct console *co, char *options)
+ {
++ static struct ktermios dummy;
++ struct ktermios termios;
+ struct uart_port *port;
+- int baud = 9600;
+- int bits = 8;
+- int parity = 'n';
+- int flow = 'n';
+
+ printk("Console: ttyS%d (SU)\n",
+ (sunsu_reg.minor - 64) + co->index);
+@@ -1352,10 +1350,15 @@ static int __init sunsu_console_setup(st
+ */
+ spin_lock_init(&port->lock);
+
+- if (options)
+- uart_parse_options(options, &baud, &parity, &bits, &flow);
++ /* Get firmware console settings. */
++ sunserial_console_termios(co, to_of_device(port->dev)->node);
+
+- return uart_set_options(port, co, baud, parity, bits, flow);
++ memset(&termios, 0, sizeof(struct ktermios));
++ termios.c_cflag = co->cflag;
++ port->mctrl |= TIOCM_DTR;
++ port->ops->set_termios(port, &termios, &dummy);
++
++ return 0;
+ }
+
+ static struct console sunsu_console = {
+
+
+From gregkh@mini.kroah.org Wed Dec 16 17:16:06 2009
+Message-Id: <20091217011606.474016081@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 17:15:16 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [65/90] sparc64: Dont specify IRQF_SHARED for LDC interrupts.
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+
+From: David S. Miller <davem@davemloft.net>
+
+[ Upstream commit 08a036d583409e3517e3d15b7478d029b25f2cf2 ]
+
+IRQF_SHARED and IRQF_DISABLED don't mix.
+
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ arch/sparc/kernel/ldc.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/sparc/kernel/ldc.c
++++ b/arch/sparc/kernel/ldc.c
+@@ -1242,13 +1242,13 @@ int ldc_bind(struct ldc_channel *lp, con
+ snprintf(lp->tx_irq_name, LDC_IRQ_NAME_MAX, "%s TX", name);
+
+ err = request_irq(lp->cfg.rx_irq, ldc_rx,
+- IRQF_SAMPLE_RANDOM | IRQF_DISABLED | IRQF_SHARED,
++ IRQF_SAMPLE_RANDOM | IRQF_DISABLED,
+ lp->rx_irq_name, lp);
+ if (err)
+ return err;
+
+ err = request_irq(lp->cfg.tx_irq, ldc_tx,
+- IRQF_SAMPLE_RANDOM | IRQF_DISABLED | IRQF_SHARED,
++ IRQF_SAMPLE_RANDOM | IRQF_DISABLED,
+ lp->tx_irq_name, lp);
+ if (err) {
+ free_irq(lp->cfg.rx_irq, lp);
+
+
+From gregkh@mini.kroah.org Wed Dec 16 17:16:06 2009
+Message-Id: <20091217011606.605472719@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 17:15:17 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [66/90] sparc64: Fix overly strict range type matching for PCI devices.
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+
+From: David S. Miller <davem@davemloft.net>
+
+[ Upstream commit 4230fa3b89ea1c413766bd411a8315a3d05aa6c7 ]
+
+When we are trying to see if a range property entry applies
+to a given address, we are overly strict about the type.
+
+We should only allow I/O ranges for I/O addresses, and only allow
+CONFIG space ranges for CONFIG space address.
+
+However for MEM ranges, they come in 32-bit and 64-bit flavors.
+And a lack of an exact match is OK if the range is 32-bit and
+the address is 64-bit. We can assign a 64-bit address properly
+into a 32-bit parent range just fine.
+
+So allow it.
+
+Reported-by: Patrick Finnegan <pat@computer-refuge.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ arch/sparc/kernel/of_device_64.c | 14 ++++++++++++--
+ 1 file changed, 12 insertions(+), 2 deletions(-)
+
+--- a/arch/sparc/kernel/of_device_64.c
++++ b/arch/sparc/kernel/of_device_64.c
+@@ -104,9 +104,19 @@ static int of_bus_pci_map(u32 *addr, con
+ int i;
+
+ /* Check address type match */
+- if ((addr[0] ^ range[0]) & 0x03000000)
+- return -EINVAL;
++ if (!((addr[0] ^ range[0]) & 0x03000000))
++ goto type_match;
++
++ /* Special exception, we can map a 64-bit address into
++ * a 32-bit range.
++ */
++ if ((addr[0] & 0x03000000) == 0x03000000 &&
++ (range[0] & 0x03000000) == 0x02000000)
++ goto type_match;
++
++ return -EINVAL;
+
++type_match:
+ if (of_out_of_range(addr + 1, range + 1, range + na + pna,
+ na - 1, ns))
+ return -EINVAL;
+
+
+From gregkh@mini.kroah.org Wed Dec 16 17:16:06 2009
+Message-Id: <20091217011606.755651686@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 17:15:18 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [67/90] sparc64: Fix stack debugging IRQ stack regression.
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+
+From: David S. Miller <davem@davemloft.net>
+
+[ Upstream commit 166e553a575f09485f6d0df8a1ef3c5991f7d953 ]
+
+Commit 4f70f7a91bffdcc39f088748dc678953eb9a3fbd
+(sparc64: Implement IRQ stacks.) has two bugs.
+
+First, the softirq range check forgets to subtract STACK_BIAS
+before comparing with %sp. Next, on failure the wrong label
+is jumped to, resulting in a bogus stack being loaded.
+
+Reported-by: Igor Kovalenko <igor.v.kovalenko@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ arch/sparc/lib/mcount.S | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/arch/sparc/lib/mcount.S
++++ b/arch/sparc/lib/mcount.S
+@@ -64,8 +64,9 @@ mcount:
+ 2: sethi %hi(softirq_stack), %g3
+ or %g3, %lo(softirq_stack), %g3
+ ldx [%g3 + %g1], %g7
++ sub %g7, STACK_BIAS, %g7
+ cmp %sp, %g7
+- bleu,pt %xcc, 2f
++ bleu,pt %xcc, 3f
+ sethi %hi(THREAD_SIZE), %g3
+ add %g7, %g3, %g7
+ cmp %sp, %g7
+@@ -75,7 +76,7 @@ mcount:
+ * again, we are already trying to output the stack overflow
+ * message.
+ */
+- sethi %hi(ovstack), %g7 ! cant move to panic stack fast enough
++3: sethi %hi(ovstack), %g7 ! cant move to panic stack fast enough
+ or %g7, %lo(ovstack), %g7
+ add %g7, OVSTACKSIZE, %g3
+ sub %g3, STACK_BIAS + 192, %g3
+
+
+From gregkh@mini.kroah.org Wed Dec 16 17:16:06 2009
+Message-Id: <20091217011606.867357237@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 17:15:19 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [68/90] sparc: Set UTS_MACHINE correctly.
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+
+From: David S. Miller <davem@davemloft.net>
+
+[ Upstream commit 7f5620a5fcd658f219e85831d3691908f1eccbde ]
+
+"ARCH" can be just about anything, so we shouldn't end up
+with UTS_MACHINE of "sparc" in a 64-bit kernel build just
+because someone set the personality using 'sparc32' or
+similar. CONFIG_SPARC64 drives the compilation and
+therefore provides the definitive value, not "ARCH".
+
+This mirrors commit 8c6531f7a99f29ba8817ffb12cc9ecf190049bd6
+(x86: correctly set UTS_MACHINE for "make ARCH=x86")
+
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ arch/sparc/Makefile | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/arch/sparc/Makefile
++++ b/arch/sparc/Makefile
+@@ -27,6 +27,7 @@ AS := $(AS) -32
+ LDFLAGS := -m elf32_sparc
+ CHECKFLAGS += -D__sparc__
+ export BITS := 32
++UTS_MACHINE := sparc
+
+ #KBUILD_CFLAGS += -g -pipe -fcall-used-g5 -fcall-used-g7
+ KBUILD_CFLAGS += -m32 -pipe -mno-fpu -fcall-used-g5 -fcall-used-g7
+@@ -50,6 +51,7 @@ CHECKFLAGS += -D__sparc__ -D__sparc
+
+ LDFLAGS := -m elf64_sparc
+ export BITS := 64
++UTS_MACHINE := sparc64
+
+ KBUILD_CFLAGS += -m64 -pipe -mno-fpu -mcpu=ultrasparc -mcmodel=medlow \
+ -ffixed-g4 -ffixed-g5 -fcall-used-g7 -Wno-sign-compare \
+
+
+From gregkh@mini.kroah.org Wed Dec 16 17:16:07 2009
+Message-Id: <20091217011607.003608176@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 17:15:20 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jan Beulich <jbeulich@novell.com>,
+ Hidetoshi Seto <seto.hidetoshi@jp.fujitsu.com>,
+ Ingo Molnar <mingo@elte.hu>
+Subject: [69/90] x86/mce: Set up timer unconditionally
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Jan Beulich <jbeulich@novell.com>
+
+commit bc09effabf0c5c6c7021e5ef9af15a23579b32a8 upstream.
+
+mce_timer must be passed to setup_timer() in all cases, no
+matter whether it is going to be actually used. Otherwise, when
+the CPU gets brought down, its call to del_timer_sync() will
+never return, as the timer won't have a base associated, and
+hence lock_timer_base() will loop infinitely.
+
+Signed-off-by: Jan Beulich <jbeulich@novell.com>
+Signed-off-by: Hidetoshi Seto <seto.hidetoshi@jp.fujitsu.com>
+LKML-Reference: <4B1DB831.2030801@jp.fujitsu.com>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/cpu/mcheck/mce.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/arch/x86/kernel/cpu/mcheck/mce.c
++++ b/arch/x86/kernel/cpu/mcheck/mce.c
+@@ -1327,13 +1327,14 @@ static void mce_init_timer(void)
+ struct timer_list *t = &__get_cpu_var(mce_timer);
+ int *n = &__get_cpu_var(next_interval);
+
++ setup_timer(t, mcheck_timer, smp_processor_id());
++
+ if (mce_ignore_ce)
+ return;
+
+ *n = check_interval * HZ;
+ if (!*n)
+ return;
+- setup_timer(t, mcheck_timer, smp_processor_id());
+ t->expires = round_jiffies(jiffies + *n);
+ add_timer_on(t, smp_processor_id());
+ }
+
+
+From gregkh@mini.kroah.org Wed Dec 16 17:16:07 2009
+Message-Id: <20091217011607.132146579@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 17:15:21 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Larry Finger <Larry.Finger@lwfinger.net>,
+ "John W. Linville" <linville@tuxdriver.com>
+Subject: [70/90] b43legacy: avoid PPC fault during resume
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Larry Finger <Larry.Finger@lwfinger.net>
+
+commit 316a4d966cae3c2dec83ebb1ee1a3515f97b30ff upstream.
+
+For PPC architecture with PHY Revision < 3, a read of the register
+B43_MMIO_HWENABLED_LO will cause a CPU fault unless b43legacy_status()
+returns a value of 2 (B43legacy_STAT_STARTED); however, one finds that
+the driver is unable to associate after resuming from hibernation unless
+this routine returns 1. To satisfy both conditions, the routine is rewritten
+to return TRUE whenever b43legacy_status() returns a value < 2.
+
+This patch fixes the second problem listed in the postings for Red Hat
+Bugzilla #538523.
+
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/b43legacy/rfkill.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/net/wireless/b43legacy/rfkill.c
++++ b/drivers/net/wireless/b43legacy/rfkill.c
+@@ -34,6 +34,13 @@ bool b43legacy_is_hw_radio_enabled(struc
+ & B43legacy_MMIO_RADIO_HWENABLED_HI_MASK))
+ return 1;
+ } else {
++ /* To prevent CPU fault on PPC, do not read a register
++ * unless the interface is started; however, on resume
++ * for hibernation, this routine is entered early. When
++ * that happens, unconditionally return TRUE.
++ */
++ if (b43legacy_status(dev) < B43legacy_STAT_STARTED)
++ return 1;
+ if (b43legacy_read16(dev, B43legacy_MMIO_RADIO_HWENABLED_LO)
+ & B43legacy_MMIO_RADIO_HWENABLED_LO_MASK)
+ return 1;
+
+
+From gregkh@mini.kroah.org Wed Dec 16 17:16:07 2009
+Message-Id: <20091217011607.262223579@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 17:15:22 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Larry Finger <Larry.Finger@lwfinger.net>,
+ "John W. Linville" <linville@tuxdriver.com>
+Subject: [71/90] p54usb: Remove DMA buffer from stack
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Larry Finger <Larry.Finger@lwfinger.net>
+
+commit 21d6c270f11c7d0ab5aafa48a6e79ba514f4e5e7 upstream.
+
+On 2.6.32-rc6 from wireless-testing, the following warning is emitted:
+
+------------[ cut here ]------------
+WARNING: at lib/dma-debug.c:860 check_for_stack+0xaa/0xe0()
+Hardware name: HP Pavilion dv2700 Notebook PC
+ehci_hcd 0000:00:02.1: DMA-API: device driver maps memory fromstack
+ [addr=ffff8800b6e2bca8]
+Modules linked in: <Removed>
+Pid: 16378, comm: modprobe Not tainted 2.6.32-rc6-wl #244
+Call Trace:
+ [<ffffffff81049698>] warn_slowpath_common+0x78/0xb0
+ [<ffffffff8104972c>] warn_slowpath_fmt+0x3c/0x40
+ [<ffffffff811ae52a>] check_for_stack+0xaa/0xe0
+ [<ffffffff811afc8d>] debug_dma_map_page+0xfd/0x170
+ [<ffffffffa006297a>] usb_hcd_submit_urb+0x3da/0x9c0 [usbcore]
+ [<ffffffff81076e6f>] ? lockdep_init_map+0x5f/0x5d0
+ [<ffffffffa0063365>] usb_submit_urb+0xe5/0x260 [usbcore]
+ [<ffffffffa0064b7e>] usb_start_wait_urb+0x5e/0xf0 [usbcore]
+ [<ffffffffa0063943>] ? usb_init_urb+0x23/0x40 [usbcore]
+ [<ffffffffa0064cd4>] usb_bulk_msg+0xc4/0x150 [usbcore]
+ [<ffffffffa0441a91>] T.719+0x31/0x40 [p54usb]
+ [<ffffffffa0441acf>] p54u_upload_firmware_3887+0x2f/0x490 [p54usb]
+ [<ffffffffa049c667>] ? p54_parse_firmware+0x427/0x450 [p54common]
+ <Rest of traceback removed>
+---[ end trace f77df0316ddad3de ]---
+
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/p54/p54usb.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/wireless/p54/p54usb.c
++++ b/drivers/net/wireless/p54/p54usb.c
+@@ -427,12 +427,16 @@ static const char p54u_romboot_3887[] =
+ static int p54u_firmware_reset_3887(struct ieee80211_hw *dev)
+ {
+ struct p54u_priv *priv = dev->priv;
+- u8 buf[4];
++ u8 *buf;
+ int ret;
+
+- memcpy(&buf, p54u_romboot_3887, sizeof(buf));
++ buf = kmalloc(4, GFP_KERNEL);
++ if (!buf)
++ return -ENOMEM;
++ memcpy(buf, p54u_romboot_3887, 4);
+ ret = p54u_bulk_msg(priv, P54U_PIPE_DATA,
+- buf, sizeof(buf));
++ buf, 4);
++ kfree(buf);
+ if (ret)
+ dev_err(&priv->udev->dev, "(p54usb) unable to jump to "
+ "boot ROM (%d)!\n", ret);
+
+
+From gregkh@mini.kroah.org Wed Dec 16 17:16:07 2009
+Message-Id: <20091217011607.388210554@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 17:15:23 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ Greg KH <greg@kroah.com>
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Yong Wang <yong.y.wang@intel.com>,
+ Borislav Petkov <borislav.petkov@amd.com>,
+ Arjan van de Ven <arjan@infradead.org>,
+ Ingo Molnar <mingo@elte.hu>
+Subject: [72/90] [PATCH .31-stable] x86: Under BIOS control, restore APs APIC_LVTTHMR to the BSP value
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Yong Wang <yong.y.wang@linux.intel.com>
+
+Upstream commit a2202aa29289db64ca7988b12343158b67b27f10.
+
+On platforms where bios handles the thermal monitor interrupt,
+APIC_LVTTHMR on each logical CPU is programmed to generate a SMI and OS
+can't touch it.
+
+Unfortunately AP bringup sequence using INIT-SIPI-SIPI clear all
+the LVT entries except the mask bit. Essentially this results in
+all LVT entries including the thermal monitoring interrupt set to masked
+(clearing the bios programmed value for APIC_LVTTHMR).
+
+And this leads to kernel take over the thermal monitoring interrupt
+on AP's but not on BSP (leaving the bios programmed value only on BSP).
+
+As a result of this, we have seen system hangs when the thermal
+monitoring interrupt is generated.
+
+Fix this by reading the initial value of thermal LVT entry on BSP
+and if bios has taken over the control, then program the same value
+on all AP's and leave the thermal monitoring interrupt control
+on all the logical cpu's to the bios.
+
+Signed-off-by: Yong Wang <yong.y.wang@intel.com>
+Reviewed-by: Suresh Siddha <suresh.b.siddha@intel.com>
+Cc: Borislav Petkov <borislav.petkov@amd.com>
+Cc: Arjan van de Ven <arjan@infradead.org>
+LKML-Reference: <20091110013824.GA24940@ywang-moblin2.bj.intel.com>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/include/asm/mce.h | 6 ++++++
+ arch/x86/kernel/cpu/mcheck/therm_throt.c | 29 ++++++++++++++++++++++++++++-
+ arch/x86/kernel/setup.c | 3 +++
+ 3 files changed, 37 insertions(+), 1 deletion(-)
+
+--- a/arch/x86/include/asm/mce.h
++++ b/arch/x86/include/asm/mce.h
+@@ -214,5 +214,11 @@ void mce_log_therm_throt_event(__u64 sta
+ static inline void mce_log_therm_throt_event(__u64 status) {}
+ #endif
+
++#ifdef CONFIG_X86_THERMAL_VECTOR
++extern void mcheck_intel_therm_init(void);
++#else
++static inline void mcheck_intel_therm_init(void) { }
++#endif
++
+ #endif /* __KERNEL__ */
+ #endif /* _ASM_X86_MCE_H */
+--- a/arch/x86/kernel/cpu/mcheck/therm_throt.c
++++ b/arch/x86/kernel/cpu/mcheck/therm_throt.c
+@@ -49,6 +49,8 @@ static DEFINE_PER_CPU(struct thermal_sta
+
+ static atomic_t therm_throt_en = ATOMIC_INIT(0);
+
++static u32 lvtthmr_init __read_mostly;
++
+ #ifdef CONFIG_SYSFS
+ #define define_therm_throt_sysdev_one_ro(_name) \
+ static SYSDEV_ATTR(_name, 0444, therm_throt_sysdev_show_##_name, NULL)
+@@ -254,6 +256,18 @@ asmlinkage void smp_thermal_interrupt(st
+ ack_APIC_irq();
+ }
+
++void __init mcheck_intel_therm_init(void)
++{
++ /*
++ * This function is only called on boot CPU. Save the init thermal
++ * LVT value on BSP and use that value to restore APs' thermal LVT
++ * entry BIOS programmed later
++ */
++ if (cpu_has(&boot_cpu_data, X86_FEATURE_ACPI) &&
++ cpu_has(&boot_cpu_data, X86_FEATURE_ACC))
++ lvtthmr_init = apic_read(APIC_LVTTHMR);
++}
++
+ void intel_init_thermal(struct cpuinfo_x86 *c)
+ {
+ unsigned int cpu = smp_processor_id();
+@@ -270,7 +284,20 @@ void intel_init_thermal(struct cpuinfo_x
+ * since it might be delivered via SMI already:
+ */
+ rdmsr(MSR_IA32_MISC_ENABLE, l, h);
+- h = apic_read(APIC_LVTTHMR);
++
++ /*
++ * The initial value of thermal LVT entries on all APs always reads
++ * 0x10000 because APs are woken up by BSP issuing INIT-SIPI-SIPI
++ * sequence to them and LVT registers are reset to 0s except for
++ * the mask bits which are set to 1s when APs receive INIT IPI.
++ * Always restore the value that BIOS has programmed on AP based on
++ * BSP's info we saved since BIOS is always setting the same value
++ * for all threads/cores
++ */
++ apic_write(APIC_LVTTHMR, lvtthmr_init);
++
++ h = lvtthmr_init;
++
+ if ((l & MSR_IA32_MISC_ENABLE_TM1) && (h & APIC_DM_SMI)) {
+ printk(KERN_DEBUG
+ "CPU%d: Thermal monitoring handled by SMI\n", cpu);
+--- a/arch/x86/kernel/setup.c
++++ b/arch/x86/kernel/setup.c
+@@ -107,6 +107,7 @@
+ #ifdef CONFIG_X86_64
+ #include <asm/numa_64.h>
+ #endif
++#include <asm/mce.h>
+
+ #ifndef ARCH_SETUP
+ #define ARCH_SETUP
+@@ -1030,6 +1031,8 @@ void __init setup_arch(char **cmdline_p)
+ conswitchp = &dummy_con;
+ #endif
+ #endif
++
++ mcheck_intel_therm_init();
+ }
+
+ #ifdef CONFIG_X86_32
+
+
+From gregkh@mini.kroah.org Wed Dec 16 17:16:07 2009
+Message-Id: <20091217011607.520619682@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 17:15:24 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Zhao Yakui <yakui.zhao@intel.com>,
+ Venkatesh Pallipadi <venkatesh.pallipadi@intel.com>,
+ Len Brown <len.brown@intel.com>
+Subject: [73/90] ACPI: Use the ARB_DISABLE for the CPU which model id is less than 0x0f.
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Zhao Yakui <yakui.zhao@intel.com>
+
+commit 03a05ed1152944000151d57b71000de287a1eb02 upstream.
+
+Currently, ARB_DISABLE is a NOP on all of the recent Intel platforms.
+For such platforms, reduce contention on c3_lock by skipping the fake
+ARB_DISABLE.
+
+The cpu model id on one laptop is 14. If we disable ARB_DISABLE on this box,
+the box can't be booted correctly. But if we still enable ARB_DISABLE on this
+box, the box can be booted correctly.
+
+So we still use the ARB_DISABLE for the cpu which mode id is less than 0x0f.
+
+http://bugzilla.kernel.org/show_bug.cgi?id=14700
+
+Signed-off-by: Zhao Yakui <yakui.zhao@intel.com>
+Acked-by: Venkatesh Pallipadi <venkatesh.pallipadi@intel.com>
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/acpi/cstate.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/x86/kernel/acpi/cstate.c
++++ b/arch/x86/kernel/acpi/cstate.c
+@@ -48,7 +48,7 @@ void acpi_processor_power_init_bm_check(
+ * P4, Core and beyond CPUs
+ */
+ if (c->x86_vendor == X86_VENDOR_INTEL &&
+- (c->x86 > 0xf || (c->x86 == 6 && c->x86_model >= 14)))
++ (c->x86 > 0xf || (c->x86 == 6 && c->x86_model >= 0x0f)))
+ flags->bm_control = 0;
+ }
+ EXPORT_SYMBOL(acpi_processor_power_init_bm_check);
+
+
+From gregkh@mini.kroah.org Wed Dec 16 17:16:07 2009
+Message-Id: <20091217011607.648675624@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 17:15:25 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Thomas Renninger <trenn@suse.de>,
+ =?ISO-8859-15?q?Peter=20K=C3=BCppers?= <peter-mailbox@web.de>,
+ Michael Franzl <michaelfranzl@gmx.at>,
+ Ian Turner <vectro@vectro.org>,
+ Corentin Chary <corentincj@iksaif.net>,
+ Len Brown <len.brown@intel.com>
+Subject: [74/90] asus-laptop: change light sens default values.
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Corentin Chary <corentincj@iksaif.net>
+
+commit d951d4cc84e8b5ddb8e0ab81cf6a72cc73fdd668 upstream.
+
+The light sensor disable brightness key and
+/sys/class/backlight/ control. There was a lot of report
+from users who didn't understand why they couldn't change their
+brightness, including:
+
+https://bugs.launchpad.net/bugs/222171
+https://bugzilla.novell.com/show_bug.cgi?id=514747
+http://bugzilla.kernel.org/show_bug.cgi?id=13671
+http://bugzilla.kernel.org/show_bug.cgi?id=14432
+
+Now the light sensor is disabled, and if the user want to enable
+it, the level should be ok.
+
+The funny thing is that comments where ok, not code.
+
+Cc: stable@kernel.org
+Cc: Thomas Renninger <trenn@suse.de>
+Cc: Peter Küppers <peter-mailbox@web.de>
+Cc: Michael Franzl <michaelfranzl@gmx.at>
+Cc: Ian Turner <vectro@vectro.org>
+Signed-off-by: Corentin Chary <corentincj@iksaif.net>
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/platform/x86/asus-laptop.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/platform/x86/asus-laptop.c
++++ b/drivers/platform/x86/asus-laptop.c
+@@ -1172,8 +1172,8 @@ static int asus_hotk_add(struct acpi_dev
+ hotk->ledd_status = 0xFFF;
+
+ /* Set initial values of light sensor and level */
+- hotk->light_switch = 1; /* Default to light sensor disabled */
+- hotk->light_level = 0; /* level 5 for sensor sensitivity */
++ hotk->light_switch = 0; /* Default to light sensor disabled */
++ hotk->light_level = 5; /* level 5 for sensor sensitivity */
+
+ if (ls_switch_handle)
+ set_light_sens_switch(hotk->light_switch);
+
+
+From gregkh@mini.kroah.org Wed Dec 16 17:16:07 2009
+Message-Id: <20091217011607.777680705@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 17:15:26 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jean Delvare <khali@linux-fr.org>,
+ Richard Purdie <rpurdie@linux.intel.com>
+Subject: [75/90] backlight: lcd - Fix wrong sizeof
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Jean Delvare <khali@linux-fr.org>
+
+commit 1e0fa6bd8c7468067f2e988c7a416dafd0651c34 upstream.
+
+Which is why I have always preferred sizeof(struct foo) over
+sizeof(var).
+
+Signed-off-by: Jean Delvare <khali@linux-fr.org>
+Signed-off-by: Richard Purdie <rpurdie@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/video/backlight/lcd.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/video/backlight/lcd.c
++++ b/drivers/video/backlight/lcd.c
+@@ -56,7 +56,7 @@ static int fb_notifier_callback(struct n
+
+ static int lcd_register_fb(struct lcd_device *ld)
+ {
+- memset(&ld->fb_notif, 0, sizeof(&ld->fb_notif));
++ memset(&ld->fb_notif, 0, sizeof(ld->fb_notif));
+ ld->fb_notif.notifier_call = fb_notifier_callback;
+ return fb_register_client(&ld->fb_notif);
+ }
+
+
+From gregkh@mini.kroah.org Wed Dec 16 17:16:08 2009
+Message-Id: <20091217011607.913966145@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 17:15:27 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Chris Wilson <chris@chris-wilson.co.uk>,
+ David Woodhouse <dwmw2@infradead.org>,
+ Zhenyu Wang <zhenyu.z.wang@intel.com>,
+ Zhenyu Wang <zhenyuw@linux.intel.com>,
+ Eric Anholt <eric@anholt.net>
+Subject: [76/90] drm/i915: Avoid NULL dereference with component_only tv_modes
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Chris Wilson <chris@chris-wilson.co.uk>
+
+commit d271817baecbccb47da0d9f28c285a0dae8a06b7 upstream.
+
+In commit d2d9f2324, the guard for a valid video mode was removed. This
+caused the regression:
+
+ kernel crash during kms graphic boot on Intel GM4500 platform
+ https://bugzilla.redhat.com/show_bug.cgi?id=540218
+
+This patches changes the logic slightly not to rely on a coupled
+variable, but to just check whether the video_modes is valid before
+dereferencing.
+
+Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
+Cc: David Woodhouse <dwmw2@infradead.org>
+Cc: Zhenyu Wang <zhenyu.z.wang@intel.com>
+[ickle: Actually reference the correct bug report]
+Acked-by: Zhenyu Wang <zhenyuw@linux.intel.com>
+Signed-off-by: Eric Anholt <eric@anholt.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/i915/intel_tv.c | 11 ++++-------
+ 1 file changed, 4 insertions(+), 7 deletions(-)
+
+--- a/drivers/gpu/drm/i915/intel_tv.c
++++ b/drivers/gpu/drm/i915/intel_tv.c
+@@ -1212,20 +1212,17 @@ intel_tv_mode_set(struct drm_encoder *en
+ tv_ctl |= TV_TRILEVEL_SYNC;
+ if (tv_mode->pal_burst)
+ tv_ctl |= TV_PAL_BURST;
++
+ scctl1 = 0;
+- /* dda1 implies valid video levels */
+- if (tv_mode->dda1_inc) {
++ if (tv_mode->dda1_inc)
+ scctl1 |= TV_SC_DDA1_EN;
+- }
+-
+ if (tv_mode->dda2_inc)
+ scctl1 |= TV_SC_DDA2_EN;
+-
+ if (tv_mode->dda3_inc)
+ scctl1 |= TV_SC_DDA3_EN;
+-
+ scctl1 |= tv_mode->sc_reset;
+- scctl1 |= video_levels->burst << TV_BURST_LEVEL_SHIFT;
++ if (video_levels)
++ scctl1 |= video_levels->burst << TV_BURST_LEVEL_SHIFT;
+ scctl1 |= tv_mode->dda1_inc << TV_SCDDA1_INC_SHIFT;
+
+ scctl2 = tv_mode->dda2_size << TV_SCDDA2_SIZE_SHIFT |
+
+
+From gregkh@mini.kroah.org Wed Dec 16 17:16:08 2009
+Message-Id: <20091217011608.038270093@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 17:15:28 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Zhenyu Wang <zhenyuw@linux.intel.com>,
+ Eric Anholt <eric@anholt.net>
+Subject: [77/90] drm/i915: Fix CRT hotplug detect by checking really no channels attached
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Zhenyu Wang <zhenyuw@linux.intel.com>
+
+commit 8e9e0eea9955bffbe5e5cd6355157cabddc31f17 upstream.
+
+For CRT hotplug detect status, we have four test results as blue
+channel only, green channel only, both blue and green channel, and
+no channel attached. Origin code only marks both blue and green channel
+case as connected, but ignore other possible connected states. This one
+trys to detect CRT by checking no channel attached case instead.
+
+Signed-off-by: Zhenyu Wang <zhenyuw@linux.intel.com>
+Signed-off-by: Eric Anholt <eric@anholt.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/i915/intel_crt.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/i915/intel_crt.c
++++ b/drivers/gpu/drm/i915/intel_crt.c
+@@ -234,8 +234,8 @@ static bool intel_crt_detect_hotplug(str
+ } while (time_after(timeout, jiffies));
+ }
+
+- if ((I915_READ(PORT_HOTPLUG_STAT) & CRT_HOTPLUG_MONITOR_MASK) ==
+- CRT_HOTPLUG_MONITOR_COLOR)
++ if ((I915_READ(PORT_HOTPLUG_STAT) & CRT_HOTPLUG_MONITOR_MASK) !=
++ CRT_HOTPLUG_MONITOR_NONE)
+ return true;
+
+ return false;
+
+
+From gregkh@mini.kroah.org Wed Dec 16 17:16:08 2009
+Message-Id: <20091217011608.173172682@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 17:15:29 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Zhenyu Wang <zhenyuw@linux.intel.com>,
+ Eric Anholt <eric@anholt.net>
+Subject: [78/90] drm/i915: Fix LVDS stability issue on Ironlake
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Zhenyu Wang <zhenyuw@linux.intel.com>
+
+commit 1b3c7a47f993bf9ab6c4c7cc3bbf5588052b58f4 upstream.
+
+In disable sequence, all output ports on PCH have to be disabled
+before PCH transcoder, but LVDS port was left always enabled. This
+one fixes that by disable LVDS port properly during pipe disable
+process, and resolved stability issue seen on Ironlake. Also move
+panel fitting disable time just after pipe disable to align with
+the spec.
+
+Signed-off-by: Zhenyu Wang <zhenyuw@linux.intel.com>
+Signed-off-by: Eric Anholt <eric@anholt.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/i915/intel_display.c | 60 +++++++++++++++++++++++------------
+ 1 file changed, 41 insertions(+), 19 deletions(-)
+
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -1182,6 +1182,15 @@ static void igdng_crtc_dpms(struct drm_c
+ case DRM_MODE_DPMS_STANDBY:
+ case DRM_MODE_DPMS_SUSPEND:
+ DRM_DEBUG("crtc %d dpms on\n", pipe);
++
++ if (intel_pipe_has_type(crtc, INTEL_OUTPUT_LVDS)) {
++ temp = I915_READ(PCH_LVDS);
++ if ((temp & LVDS_PORT_EN) == 0) {
++ I915_WRITE(PCH_LVDS, temp | LVDS_PORT_EN);
++ POSTING_READ(PCH_LVDS);
++ }
++ }
++
+ if (HAS_eDP) {
+ /* enable eDP PLL */
+ igdng_enable_pll_edp(crtc);
+@@ -1366,8 +1375,6 @@ static void igdng_crtc_dpms(struct drm_c
+ case DRM_MODE_DPMS_OFF:
+ DRM_DEBUG("crtc %d dpms off\n", pipe);
+
+- i915_disable_vga(dev);
+-
+ /* Disable display plane */
+ temp = I915_READ(dspcntr_reg);
+ if ((temp & DISPLAY_PLANE_ENABLE) != 0) {
+@@ -1377,6 +1384,8 @@ static void igdng_crtc_dpms(struct drm_c
+ I915_READ(dspbase_reg);
+ }
+
++ i915_disable_vga(dev);
++
+ /* disable cpu pipe, disable after all planes disabled */
+ temp = I915_READ(pipeconf_reg);
+ if ((temp & PIPEACONF_ENABLE) != 0) {
+@@ -1397,9 +1406,15 @@ static void igdng_crtc_dpms(struct drm_c
+ } else
+ DRM_DEBUG("crtc %d is disabled\n", pipe);
+
+- if (HAS_eDP) {
+- igdng_disable_pll_edp(crtc);
++ udelay(100);
++
++ /* Disable PF */
++ temp = I915_READ(pf_ctl_reg);
++ if ((temp & PF_ENABLE) != 0) {
++ I915_WRITE(pf_ctl_reg, temp & ~PF_ENABLE);
++ I915_READ(pf_ctl_reg);
+ }
++ I915_WRITE(pf_win_size, 0);
+
+ /* disable CPU FDI tx and PCH FDI rx */
+ temp = I915_READ(fdi_tx_reg);
+@@ -1425,6 +1440,13 @@ static void igdng_crtc_dpms(struct drm_c
+
+ udelay(100);
+
++ if (intel_pipe_has_type(crtc, INTEL_OUTPUT_LVDS)) {
++ temp = I915_READ(PCH_LVDS);
++ I915_WRITE(PCH_LVDS, temp & ~LVDS_PORT_EN);
++ I915_READ(PCH_LVDS);
++ udelay(100);
++ }
++
+ /* disable PCH transcoder */
+ temp = I915_READ(transconf_reg);
+ if ((temp & TRANS_ENABLE) != 0) {
+@@ -1444,6 +1466,8 @@ static void igdng_crtc_dpms(struct drm_c
+ }
+ }
+
++ udelay(100);
++
+ /* disable PCH DPLL */
+ temp = I915_READ(pch_dpll_reg);
+ if ((temp & DPLL_VCO_ENABLE) != 0) {
+@@ -1451,14 +1475,20 @@ static void igdng_crtc_dpms(struct drm_c
+ I915_READ(pch_dpll_reg);
+ }
+
+- temp = I915_READ(fdi_rx_reg);
+- if ((temp & FDI_RX_PLL_ENABLE) != 0) {
+- temp &= ~FDI_SEL_PCDCLK;
+- temp &= ~FDI_RX_PLL_ENABLE;
+- I915_WRITE(fdi_rx_reg, temp);
+- I915_READ(fdi_rx_reg);
++ if (HAS_eDP) {
++ igdng_disable_pll_edp(crtc);
+ }
+
++ temp = I915_READ(fdi_rx_reg);
++ temp &= ~FDI_SEL_PCDCLK;
++ I915_WRITE(fdi_rx_reg, temp);
++ I915_READ(fdi_rx_reg);
++
++ temp = I915_READ(fdi_rx_reg);
++ temp &= ~FDI_RX_PLL_ENABLE;
++ I915_WRITE(fdi_rx_reg, temp);
++ I915_READ(fdi_rx_reg);
++
+ /* Disable CPU FDI TX PLL */
+ temp = I915_READ(fdi_tx_reg);
+ if ((temp & FDI_TX_PLL_ENABLE) != 0) {
+@@ -1467,16 +1497,8 @@ static void igdng_crtc_dpms(struct drm_c
+ udelay(100);
+ }
+
+- /* Disable PF */
+- temp = I915_READ(pf_ctl_reg);
+- if ((temp & PF_ENABLE) != 0) {
+- I915_WRITE(pf_ctl_reg, temp & ~PF_ENABLE);
+- I915_READ(pf_ctl_reg);
+- }
+- I915_WRITE(pf_win_size, 0);
+-
+ /* Wait for the clocks to turn off. */
+- udelay(150);
++ udelay(100);
+ break;
+ }
+ }
+
+
+From gregkh@mini.kroah.org Wed Dec 16 17:16:08 2009
+Message-Id: <20091217011608.305374103@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 17:15:30 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jesse Barnes <jbarnes@virtuousgeek.org>,
+ Eric Anholt <eric@anholt.net>,
+ Stefan Bader <stefan.bader@canonical.com>
+Subject: [79/90] drm/i915: save/restore BLC histogram control reg across suspend/resume
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Jesse Barnes <jbarnes@virtuousgeek.org>
+
+commit 0eb96d6ed38430b72897adde58f5477a6b71757a upstream.
+
+Turns out some machines, like the ThinkPad X40 don't come back if you
+don't save/restore this register.
+
+Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
+Signed-off-by: Eric Anholt <eric@anholt.net>
+Cc: Stefan Bader <stefan.bader@canonical.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/i915/i915_drv.h | 1 +
+ drivers/gpu/drm/i915/i915_reg.h | 2 ++
+ drivers/gpu/drm/i915/i915_suspend.c | 2 ++
+ 3 files changed, 5 insertions(+)
+
+--- a/drivers/gpu/drm/i915/i915_drv.h
++++ b/drivers/gpu/drm/i915/i915_drv.h
+@@ -264,6 +264,7 @@ typedef struct drm_i915_private {
+ u32 saveDSPASURF;
+ u32 saveDSPATILEOFF;
+ u32 savePFIT_PGM_RATIOS;
++ u32 saveBLC_HIST_CTL;
+ u32 saveBLC_PWM_CTL;
+ u32 saveBLC_PWM_CTL2;
+ u32 saveFPB0;
+--- a/drivers/gpu/drm/i915/i915_reg.h
++++ b/drivers/gpu/drm/i915/i915_reg.h
+@@ -915,6 +915,8 @@
+ #define BACKLIGHT_DUTY_CYCLE_SHIFT (0)
+ #define BACKLIGHT_DUTY_CYCLE_MASK (0xffff)
+
++#define BLC_HIST_CTL 0x61260
++
+ /* TV port control */
+ #define TV_CTL 0x68000
+ /** Enables the TV encoder */
+--- a/drivers/gpu/drm/i915/i915_suspend.c
++++ b/drivers/gpu/drm/i915/i915_suspend.c
+@@ -416,6 +416,7 @@ int i915_save_state(struct drm_device *d
+ dev_priv->savePP_CONTROL = I915_READ(PP_CONTROL);
+ dev_priv->savePFIT_PGM_RATIOS = I915_READ(PFIT_PGM_RATIOS);
+ dev_priv->saveBLC_PWM_CTL = I915_READ(BLC_PWM_CTL);
++ dev_priv->saveBLC_HIST_CTL = I915_READ(BLC_HIST_CTL);
+ if (IS_I965G(dev))
+ dev_priv->saveBLC_PWM_CTL2 = I915_READ(BLC_PWM_CTL2);
+ if (IS_MOBILE(dev) && !IS_I830(dev))
+@@ -560,6 +561,7 @@ int i915_restore_state(struct drm_device
+
+ I915_WRITE(PFIT_PGM_RATIOS, dev_priv->savePFIT_PGM_RATIOS);
+ I915_WRITE(BLC_PWM_CTL, dev_priv->saveBLC_PWM_CTL);
++ I915_WRITE(BLC_HIST_CTL, dev_priv->saveBLC_HIST_CTL);
+ I915_WRITE(PP_ON_DELAYS, dev_priv->savePP_ON_DELAYS);
+ I915_WRITE(PP_OFF_DELAYS, dev_priv->savePP_OFF_DELAYS);
+ I915_WRITE(PP_DIVISOR, dev_priv->savePP_DIVISOR);
+
+
+From gregkh@mini.kroah.org Wed Dec 16 17:16:08 2009
+Message-Id: <20091217011608.432875928@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 17:15:31 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Shaohua Li <shaohua.li@intel.com>,
+ Zhenyu Wang <zhenyuw@linux.intel.com>,
+ Eric Anholt <eric@anholt.net>
+Subject: [80/90] drm/i915: PineView only has LVDS and CRT ports
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Zhenyu Wang <zhenyuw@linux.intel.com>
+
+commit 103a196f4224dc6872081305cf7f82ebf67aa7bd upstream.
+
+PineView only has 2 ports for LVDS and CRT. Don't enable other
+ports for it.
+
+Cc: Shaohua Li <shaohua.li@intel.com>
+Signed-off-by: Zhenyu Wang <zhenyuw@linux.intel.com>
+Signed-off-by: Eric Anholt <eric@anholt.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/i915/i915_drv.h | 4 ++++
+ drivers/gpu/drm/i915/intel_display.c | 6 +++---
+ 2 files changed, 7 insertions(+), 3 deletions(-)
+
+--- a/drivers/gpu/drm/i915/i915_drv.h
++++ b/drivers/gpu/drm/i915/i915_drv.h
+@@ -838,6 +838,7 @@ extern int i915_wait_ring(struct drm_dev
+ #define IS_I85X(dev) ((dev)->pci_device == 0x3582)
+ #define IS_I855(dev) ((dev)->pci_device == 0x3582)
+ #define IS_I865G(dev) ((dev)->pci_device == 0x2572)
++#define IS_I8XX(dev) (IS_I830(dev) || IS_845G(dev) || IS_I85X(dev) || IS_I865G(dev))
+
+ #define IS_I915G(dev) ((dev)->pci_device == 0x2582 || (dev)->pci_device == 0x258a)
+ #define IS_I915GM(dev) ((dev)->pci_device == 0x2592)
+@@ -899,9 +900,12 @@ extern int i915_wait_ring(struct drm_dev
+ */
+ #define HAS_128_BYTE_Y_TILING(dev) (IS_I9XX(dev) && !(IS_I915G(dev) || \
+ IS_I915GM(dev)))
++#define SUPPORTS_DIGITAL_OUTPUTS(dev) (IS_I9XX(dev) && !IS_IGD(dev))
+ #define SUPPORTS_INTEGRATED_HDMI(dev) (IS_G4X(dev) || IS_IGDNG(dev))
+ #define SUPPORTS_INTEGRATED_DP(dev) (IS_G4X(dev) || IS_IGDNG(dev))
+ #define SUPPORTS_EDP(dev) (IS_IGDNG_M(dev))
++#define SUPPORTS_TV(dev) (IS_I9XX(dev) && IS_MOBILE(dev) && \
++ !IS_IGDNG(dev) && !IS_IGD(dev))
+ #define I915_HAS_HOTPLUG(dev) (IS_I945G(dev) || IS_I945GM(dev) || IS_I965G(dev))
+ /* dsparb controlled by hw only */
+ #define DSPARB_HWCONTROL(dev) (IS_G4X(dev) || IS_IGDNG(dev))
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -3347,7 +3347,7 @@ static void intel_setup_outputs(struct d
+ if (I915_READ(PCH_DP_D) & DP_DETECTED)
+ intel_dp_init(dev, PCH_DP_D);
+
+- } else if (IS_I9XX(dev)) {
++ } else if (SUPPORTS_DIGITAL_OUTPUTS(dev)) {
+ bool found = false;
+
+ if (I915_READ(SDVOB) & SDVO_DETECTED) {
+@@ -3374,10 +3374,10 @@ static void intel_setup_outputs(struct d
+
+ if (SUPPORTS_INTEGRATED_DP(dev) && (I915_READ(DP_D) & DP_DETECTED))
+ intel_dp_init(dev, DP_D);
+- } else
++ } else if (IS_I8XX(dev))
+ intel_dvo_init(dev);
+
+- if (IS_I9XX(dev) && IS_MOBILE(dev) && !IS_IGDNG(dev))
++ if (SUPPORTS_TV(dev))
+ intel_tv_init(dev);
+
+ list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
+
+
+From gregkh@mini.kroah.org Wed Dec 16 17:16:08 2009
+Message-Id: <20091217011608.568487962@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 17:15:32 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jan Kara <jack@suse.cz>
+Subject: [81/90] ext3: Fix data / filesystem corruption when write fails to copy data
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Jan Kara <jack@suse.cz>
+
+commit 68eb3db08344286733adac48304d9fb7a0e53b27 upstream.
+
+When ext3_write_begin fails after allocating some blocks or
+generic_perform_write fails to copy data to write, we truncate blocks already
+instantiated beyond i_size. Although these blocks were never inside i_size, we
+have to truncate pagecache of these blocks so that corresponding buffers get
+unmapped. Otherwise subsequent __block_prepare_write (called because we are
+retrying the write) will find the buffers mapped, not call ->get_block, and
+thus the page will be backed by already freed blocks leading to filesystem and
+data corruption.
+
+Reported-by: James Y Knight <foom@fuhm.net>
+Signed-off-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/ext3/inode.c | 18 ++++++++++++++----
+ 1 file changed, 14 insertions(+), 4 deletions(-)
+
+--- a/fs/ext3/inode.c
++++ b/fs/ext3/inode.c
+@@ -1137,6 +1137,16 @@ static int do_journal_get_write_access(h
+ return ext3_journal_get_write_access(handle, bh);
+ }
+
++/*
++ * Truncate blocks that were not used by write. We have to truncate the
++ * pagecache as well so that corresponding buffers get properly unmapped.
++ */
++static void ext3_truncate_failed_write(struct inode *inode)
++{
++ truncate_inode_pages(inode->i_mapping, inode->i_size);
++ ext3_truncate(inode);
++}
++
+ static int ext3_write_begin(struct file *file, struct address_space *mapping,
+ loff_t pos, unsigned len, unsigned flags,
+ struct page **pagep, void **fsdata)
+@@ -1195,7 +1205,7 @@ write_begin_failed:
+ unlock_page(page);
+ page_cache_release(page);
+ if (pos + len > inode->i_size)
+- ext3_truncate(inode);
++ ext3_truncate_failed_write(inode);
+ }
+ if (ret == -ENOSPC && ext3_should_retry_alloc(inode->i_sb, &retries))
+ goto retry;
+@@ -1290,7 +1300,7 @@ static int ext3_ordered_write_end(struct
+ page_cache_release(page);
+
+ if (pos + len > inode->i_size)
+- ext3_truncate(inode);
++ ext3_truncate_failed_write(inode);
+ return ret ? ret : copied;
+ }
+
+@@ -1316,7 +1326,7 @@ static int ext3_writeback_write_end(stru
+ page_cache_release(page);
+
+ if (pos + len > inode->i_size)
+- ext3_truncate(inode);
++ ext3_truncate_failed_write(inode);
+ return ret ? ret : copied;
+ }
+
+@@ -1369,7 +1379,7 @@ static int ext3_journalled_write_end(str
+ page_cache_release(page);
+
+ if (pos + len > inode->i_size)
+- ext3_truncate(inode);
++ ext3_truncate_failed_write(inode);
+ return ret ? ret : copied;
+ }
+
+
+
+From gregkh@mini.kroah.org Wed Dec 16 17:16:08 2009
+Message-Id: <20091217011608.696291429@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 17:15:33 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Deon van der Merwe <dvdm@truteq.co.za>,
+ Julian Anastasov <ja@ssi.bg>,
+ Simon Horman <horms@verge.net.au>,
+ Patrick McHardy <kaber@trash.net>
+Subject: [82/90] ipvs: zero usvc and udest
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Simon Horman <horms@verge.net.au>
+
+commit 258c889362aa95d0ab534b38ce8c15d3009705b1 upstream.
+
+Make sure that any otherwise uninitialised fields of usvc are zero.
+
+This has been obvserved to cause a problem whereby the port of
+fwmark services may end up as a non-zero value which causes
+scheduling of a destination server to fail for persisitent services.
+
+As observed by Deon van der Merwe <dvdm@truteq.co.za>.
+This fix suggested by Julian Anastasov <ja@ssi.bg>.
+
+For good measure also zero udest.
+
+Cc: Deon van der Merwe <dvdm@truteq.co.za>
+Acked-by: Julian Anastasov <ja@ssi.bg>
+Signed-off-by: Simon Horman <horms@verge.net.au>
+Signed-off-by: Patrick McHardy <kaber@trash.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/netfilter/ipvs/ip_vs_ctl.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/net/netfilter/ipvs/ip_vs_ctl.c
++++ b/net/netfilter/ipvs/ip_vs_ctl.c
+@@ -2713,6 +2713,8 @@ static int ip_vs_genl_parse_service(stru
+ if (!(nla_af && (nla_fwmark || (nla_port && nla_protocol && nla_addr))))
+ return -EINVAL;
+
++ memset(usvc, 0, sizeof(*usvc));
++
+ usvc->af = nla_get_u16(nla_af);
+ #ifdef CONFIG_IP_VS_IPV6
+ if (usvc->af != AF_INET && usvc->af != AF_INET6)
+@@ -2900,6 +2902,8 @@ static int ip_vs_genl_parse_dest(struct
+ if (!(nla_addr && nla_port))
+ return -EINVAL;
+
++ memset(udest, 0, sizeof(*udest));
++
+ nla_memcpy(&udest->addr, nla_addr, sizeof(udest->addr));
+ udest->port = nla_get_u16(nla_port);
+
+
+
+From gregkh@mini.kroah.org Wed Dec 16 17:16:08 2009
+Message-Id: <20091217011608.830966337@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 17:15:34 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Zhu Yi <yi.zhu@intel.com>,
+ "John W. Linville" <linville@tuxdriver.com>
+Subject: [83/90] ipw2100: fix rebooting hang with driver loaded
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Zhu Yi <yi.zhu@intel.com>
+
+commit 52ce3e9a7db754b78cf2cbabc87013f921b25b28 upstream.
+
+Add PCI .shutdown method so that we can disable the device during
+shutdown or reboot. Without this, the reboot doesn't work well on
+some platforms.
+
+This fixes http://bugzilla.intellinuxwireless.org/show_bug.cgi?id=2124
+
+Tested-by: pablo <pablolm2005@gmail.com>
+Signed-off-by: Zhu Yi <yi.zhu@intel.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/ipw2x00/ipw2100.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+--- a/drivers/net/wireless/ipw2x00/ipw2100.c
++++ b/drivers/net/wireless/ipw2x00/ipw2100.c
+@@ -6487,6 +6487,16 @@ static int ipw2100_resume(struct pci_dev
+ }
+ #endif
+
++static void ipw2100_shutdown(struct pci_dev *pci_dev)
++{
++ struct ipw2100_priv *priv = pci_get_drvdata(pci_dev);
++
++ /* Take down the device; powers it off, etc. */
++ ipw2100_down(priv);
++
++ pci_disable_device(pci_dev);
++}
++
+ #define IPW2100_DEV_ID(x) { PCI_VENDOR_ID_INTEL, 0x1043, 0x8086, x }
+
+ static struct pci_device_id ipw2100_pci_id_table[] __devinitdata = {
+@@ -6550,6 +6560,7 @@ static struct pci_driver ipw2100_pci_dri
+ .suspend = ipw2100_suspend,
+ .resume = ipw2100_resume,
+ #endif
++ .shutdown = ipw2100_shutdown,
+ };
+
+ /**
+
+
+From gregkh@mini.kroah.org Wed Dec 16 17:16:09 2009
+Message-Id: <20091217011608.959719502@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 17:15:35 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ David Woodhouse <David.Woodhouse@intel.com>
+Subject: [84/90] jffs2: Fix long-standing bug with symlink garbage collection.
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: David Woodhouse <David.Woodhouse@intel.com>
+
+commit 2e16cfca6e17ae37ae21feca080a6f2eca9087dc upstream.
+
+Ever since jffs2_garbage_collect_metadata() was first half-written in
+February 2001, it's been broken on architectures where 'char' is signed.
+When garbage collecting a symlink with target length above 127, the payload
+length would end up negative, causing interesting and bad things to happen.
+
+Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/jffs2/gc.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/fs/jffs2/gc.c
++++ b/fs/jffs2/gc.c
+@@ -700,7 +700,8 @@ static int jffs2_garbage_collect_metadat
+ struct jffs2_raw_inode ri;
+ struct jffs2_node_frag *last_frag;
+ union jffs2_device_node dev;
+- char *mdata = NULL, mdatalen = 0;
++ char *mdata = NULL;
++ int mdatalen = 0;
+ uint32_t alloclen, ilen;
+ int ret;
+
+
+
+From gregkh@mini.kroah.org Wed Dec 16 17:16:09 2009
+Message-Id: <20091217011609.093584674@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 17:15:36 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Alan Cox <alan@linux.intel.com>,
+ Petr Vandrovec <VANDROVE@vc.cvut.cz>,
+ Pekka Enberg <penberg@cs.helsinki.fi>,
+ "Paul A. Clarke" <pc@us.ibm.com>
+Subject: [85/90] matroxfb: fix problems with display stability
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Alan Cox <alan@linux.intel.com>
+
+commit 8c651311a3a08c1e4815de6933e00a760e498dae upstream.
+
+Regression caused in 2.6.23 and then despite repeated requests never fixed
+or dealt with (Petr promised to sort it in 2008 but seems to have
+forgotten).
+
+Enough is enough - remove the problem line that was added. If it upsets
+someone they've had two years to deal with it and at the very least it'll
+rattle their cage and wake them up.
+
+Addresses http://bugzilla.kernel.org/show_bug.cgi?id=9709
+
+Signed-off-by: Alan Cox <alan@linux.intel.com>
+Reported-by: Damon <account@bugzilla.kernel.org.juxtaposition.net>
+Tested-by: Ruud van Melick <rvm1974@raketnet.nl>
+Cc: Petr Vandrovec <VANDROVE@vc.cvut.cz>
+Cc: Pekka Enberg <penberg@cs.helsinki.fi>
+Cc: Paul A. Clarke <pc@us.ibm.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/video/matrox/g450_pll.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/video/matrox/g450_pll.c
++++ b/drivers/video/matrox/g450_pll.c
+@@ -341,7 +341,8 @@ static int __g450_setclk(WPMINFO unsigne
+ M1064_XDVICLKCTRL_C1DVICLKEN |
+ M1064_XDVICLKCTRL_DVILOOPCTL |
+ M1064_XDVICLKCTRL_P1LOOPBWDTCTL;
+- matroxfb_DAC_out(PMINFO M1064_XDVICLKCTRL,tmp);
++ /* Setting this breaks PC systems so don't do it */
++ /* matroxfb_DAC_out(PMINFO M1064_XDVICLKCTRL,tmp); */
+ matroxfb_DAC_out(PMINFO M1064_XPWRCTRL,
+ xpwrctrl);
+
+
+
+From gregkh@mini.kroah.org Wed Dec 16 17:16:09 2009
+Message-Id: <20091217011609.228623383@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 17:15:37 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ David Miller <davem@davemloft.net>
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ netdev@vger.kernel.org,
+ marcel@holtmann.org,
+ "Eric W. Biederman" <ebiederm@aristanetworks.com>
+Subject: [86/90] net: Fix userspace RTM_NEWLINK notifications.
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+commit d90a909e1f3e006a1d57fe11fd417173b6494701 upstream.
+
+I received some bug reports about userspace programs having problems
+because after RTM_NEWLINK was received they could not immeidate
+access files under /proc/sys/net/ because they had not been
+registered yet.
+
+The problem was trivailly fixed by moving the userspace
+notification from rtnetlink_event to the end of register_netdevice.
+
+Signed-off-by: Eric W. Biederman <ebiederm@aristanetworks.com>
+Cc: David Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/core/dev.c | 11 +++++++++++
+ net/core/rtnetlink.c | 4 +---
+ 2 files changed, 12 insertions(+), 3 deletions(-)
+
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -4808,6 +4808,11 @@ int register_netdevice(struct net_device
+ rollback_registered(dev);
+ dev->reg_state = NETREG_UNREGISTERED;
+ }
++ /*
++ * Prevent userspace races by waiting until the network
++ * device is fully setup before sending notifications.
++ */
++ rtmsg_ifinfo(RTM_NEWLINK, dev, ~0U);
+
+ out:
+ return ret;
+@@ -5343,6 +5348,12 @@ int dev_change_net_namespace(struct net_
+ /* Notify protocols, that a new device appeared. */
+ call_netdevice_notifiers(NETDEV_REGISTER, dev);
+
++ /*
++ * Prevent userspace races by waiting until the network
++ * device is fully setup before sending notifications.
++ */
++ rtmsg_ifinfo(RTM_NEWLINK, dev, ~0U);
++
+ synchronize_net();
+ err = 0;
+ out:
+--- a/net/core/rtnetlink.c
++++ b/net/core/rtnetlink.c
+@@ -1347,13 +1347,11 @@ static int rtnetlink_event(struct notifi
+ case NETDEV_UNREGISTER:
+ rtmsg_ifinfo(RTM_DELLINK, dev, ~0U);
+ break;
+- case NETDEV_REGISTER:
+- rtmsg_ifinfo(RTM_NEWLINK, dev, ~0U);
+- break;
+ case NETDEV_UP:
+ case NETDEV_DOWN:
+ rtmsg_ifinfo(RTM_NEWLINK, dev, IFF_UP|IFF_RUNNING);
+ break;
++ case NETDEV_REGISTER:
+ case NETDEV_CHANGE:
+ case NETDEV_GOING_DOWN:
+ break;
+
+
+From gregkh@mini.kroah.org Wed Dec 16 17:16:09 2009
+Message-Id: <20091217011609.364392349@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 17:15:38 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ WANG Cong <amwang@redhat.com>,
+ Ingo Molnar <mingo@elte.hu>,
+ Peter Zijlstra <a.p.zijlstra@chello.nl>,
+ James Morris <jmorris@namei.org>,
+ Alexey Dobriyan <adobriyan@gmail.com>
+Subject: [87/90] sysctl_max_map_count should be non-negative
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Amerigo Wang <amwang@redhat.com>
+
+commit 70da2340fbc68e91e701762f785479ab495a0869 upstream.
+
+Jan Engelhardt reported we have this problem:
+
+setting max_map_count to a value large enough results in programs dying at
+first try. This is on 2.6.31.6:
+
+15:59 borg:/proc/sys/vm # echo $[1<<31-1] >max_map_count
+15:59 borg:/proc/sys/vm # cat max_map_count
+1073741824
+15:59 borg:/proc/sys/vm # echo $[1<<31] >max_map_count
+15:59 borg:/proc/sys/vm # cat max_map_count
+Killed
+
+This is because we have a chance to make 'max_map_count' negative. but
+it's meaningless. Make it only accept non-negative values.
+
+Reported-by: Jan Engelhardt <jengelh@medozas.de>
+Signed-off-by: WANG Cong <amwang@redhat.com>
+Cc: Ingo Molnar <mingo@elte.hu>
+Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
+Cc: James Morris <jmorris@namei.org>
+Cc: Alexey Dobriyan <adobriyan@gmail.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/sysctl.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/kernel/sysctl.c
++++ b/kernel/sysctl.c
+@@ -1539,7 +1539,8 @@ static struct ctl_table debug_table[] =
+ .data = &show_unhandled_signals,
+ .maxlen = sizeof(int),
+ .mode = 0644,
+- .proc_handler = proc_dointvec
++ .proc_handler = proc_dointvec,
++ .extra1 = &zero,
+ },
+ #endif
+ { .ctl_name = 0 }
+
+
+From gregkh@mini.kroah.org Wed Dec 16 17:16:09 2009
+Message-Id: <20091217011609.499502645@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 17:15:39 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Henrique de Moraes Holschuh <hmh@hmh.eng.br>,
+ Len Brown <len.brown@intel.com>
+Subject: [88/90] thinkpad-acpi: fix default brightness_mode for R50e/R51
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Henrique de Moraes Holschuh <hmh@hmh.eng.br>
+
+commit a9f8eacca4e9e8693de9b896c1fa7aadaa9402e8 upstream.
+
+According to a report, the R50e wants EC-based brightness control,
+even if it uses an Intel GPU. The current driver default was reported
+to not work at all.
+
+This bug can be worked around by the "brightness_mode=3" module
+parameter.
+
+Change the default of the R50e and R51 2xxx models (which use the same
+EC firmware, 1V) to TPACPI_BRGHT_Q_EC, but keep TPACPI_BRGHT_Q_ASK set
+for now, as I'd like to get more reports.
+
+This fixes a regression caused by commit
+59fe4fe34d7afdf63208124f313be9056feaa2f4,
+"thinkpad-acpi: fix incorrect use of TPACPI_BRGHT_MODE_ECNVRAM"
+
+Kernel 2.6.31 also needs this fix.
+
+Reported-by: Ferenc Wagner <wferi@niif.hu>
+Tested-by: Ferenc Wagner <wferi@niif.hu>
+Signed-off-by: Henrique de Moraes Holschuh <hmh@hmh.eng.br>
+Cc: stable@kernel.org
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/platform/x86/thinkpad_acpi.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/platform/x86/thinkpad_acpi.c
++++ b/drivers/platform/x86/thinkpad_acpi.c
+@@ -5663,8 +5663,8 @@ static const struct tpacpi_quirk brightn
+
+ /* Models with Intel Extreme Graphics 2 */
+ TPACPI_Q_IBM('1', 'U', TPACPI_BRGHT_Q_NOEC),
+- TPACPI_Q_IBM('1', 'V', TPACPI_BRGHT_Q_ASK|TPACPI_BRGHT_Q_NOEC),
+- TPACPI_Q_IBM('1', 'W', TPACPI_BRGHT_Q_ASK|TPACPI_BRGHT_Q_NOEC),
++ TPACPI_Q_IBM('1', 'V', TPACPI_BRGHT_Q_ASK|TPACPI_BRGHT_Q_EC),
++ TPACPI_Q_IBM('1', 'W', TPACPI_BRGHT_Q_ASK|TPACPI_BRGHT_Q_EC),
+
+ /* Models with Intel GMA900 */
+ TPACPI_Q_IBM('7', '0', TPACPI_BRGHT_Q_NOEC), /* T43, R52 */
+
+
+From gregkh@mini.kroah.org Wed Dec 16 17:16:09 2009
+Message-Id: <20091217011609.621838406@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 17:15:40 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Henrique de Moraes Holschuh <hmh@hmh.eng.br>,
+ Len Brown <len.brown@intel.com>
+Subject: [89/90] thinkpad-acpi: preserve rfkill state across suspend/resume
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Henrique de Moraes Holschuh <hmh@hmh.eng.br>
+
+commit 208b996b6c460285650d39b2330f8ef82c007d10 upstream.
+
+Since the rfkill rework in 2.6.31, the driver is always resuming with
+the radios disabled.
+
+Change thinkpad-acpi to ask the firmware to resume with the radios in
+the last state. This fixes the Bluetooth and WWAN rfkill switches.
+
+Note that it means we respect the firmware's oddities. Should the
+user toggle the hardware rfkill switch on and off, it might cause the
+radios to resume enabled.
+
+UWB is an unknown quantity since it has nowhere the same level of
+firmware support (no control over state storage in NVRAM, for
+example), and might need further fixing. Testers welcome.
+
+This change fixes a regression from 2.6.30.
+
+Reported-by: Jerone Young <jerone.young@canonical.com>
+Reported-by: Ian Molton <ian.molton@collabora.co.uk>
+Signed-off-by: Henrique de Moraes Holschuh <hmh@hmh.eng.br>
+Tested-by: Ian Molton <ian.molton@collabora.co.uk>
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/platform/x86/thinkpad_acpi.c | 32 +++++---------------------------
+ 1 file changed, 5 insertions(+), 27 deletions(-)
+
+--- a/drivers/platform/x86/thinkpad_acpi.c
++++ b/drivers/platform/x86/thinkpad_acpi.c
+@@ -3406,15 +3406,6 @@ enum {
+
+ #define TPACPI_RFK_BLUETOOTH_SW_NAME "tpacpi_bluetooth_sw"
+
+-static void bluetooth_suspend(pm_message_t state)
+-{
+- /* Try to make sure radio will resume powered off */
+- if (!acpi_evalf(NULL, NULL, "\\BLTH", "vd",
+- TP_ACPI_BLTH_PWR_OFF_ON_RESUME))
+- vdbg_printk(TPACPI_DBG_RFKILL,
+- "bluetooth power down on resume request failed\n");
+-}
+-
+ static int bluetooth_get_status(void)
+ {
+ int status;
+@@ -3448,10 +3439,9 @@ static int bluetooth_set_status(enum tpa
+ #endif
+
+ /* We make sure to keep TP_ACPI_BLUETOOTH_RESUMECTRL off */
++ status = TP_ACPI_BLUETOOTH_RESUMECTRL;
+ if (state == TPACPI_RFK_RADIO_ON)
+- status = TP_ACPI_BLUETOOTH_RADIOSSW;
+- else
+- status = 0;
++ status |= TP_ACPI_BLUETOOTH_RADIOSSW;
+
+ if (!acpi_evalf(hkey_handle, NULL, "SBDC", "vd", status))
+ return -EIO;
+@@ -3590,7 +3580,6 @@ static struct ibm_struct bluetooth_drive
+ .read = bluetooth_read,
+ .write = bluetooth_write,
+ .exit = bluetooth_exit,
+- .suspend = bluetooth_suspend,
+ .shutdown = bluetooth_shutdown,
+ };
+
+@@ -3608,15 +3597,6 @@ enum {
+
+ #define TPACPI_RFK_WWAN_SW_NAME "tpacpi_wwan_sw"
+
+-static void wan_suspend(pm_message_t state)
+-{
+- /* Try to make sure radio will resume powered off */
+- if (!acpi_evalf(NULL, NULL, "\\WGSV", "qvd",
+- TP_ACPI_WGSV_PWR_OFF_ON_RESUME))
+- vdbg_printk(TPACPI_DBG_RFKILL,
+- "WWAN power down on resume request failed\n");
+-}
+-
+ static int wan_get_status(void)
+ {
+ int status;
+@@ -3649,11 +3629,10 @@ static int wan_set_status(enum tpacpi_rf
+ }
+ #endif
+
+- /* We make sure to keep TP_ACPI_WANCARD_RESUMECTRL off */
++ /* We make sure to set TP_ACPI_WANCARD_RESUMECTRL */
++ status = TP_ACPI_WANCARD_RESUMECTRL;
+ if (state == TPACPI_RFK_RADIO_ON)
+- status = TP_ACPI_WANCARD_RADIOSSW;
+- else
+- status = 0;
++ status |= TP_ACPI_WANCARD_RADIOSSW;
+
+ if (!acpi_evalf(hkey_handle, NULL, "SWAN", "vd", status))
+ return -EIO;
+@@ -3791,7 +3770,6 @@ static struct ibm_struct wan_driver_data
+ .read = wan_read,
+ .write = wan_write,
+ .exit = wan_exit,
+- .suspend = wan_suspend,
+ .shutdown = wan_shutdown,
+ };
+
+
+
+From gregkh@mini.kroah.org Wed Dec 16 17:16:09 2009
+Message-Id: <20091217011609.752672621@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 17:15:41 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Rafal Milecki <zajec5@gmail.com>,
+ Jean-Francois Moine <moinejf@free.fr>,
+ Mauro Carvalho Chehab <mchehab@redhat.com>,
+ Surbhi Palande <surbhi.palande@canonical.com>
+Subject: [90/90] V4L/DVB (13116): gspca - ov519: Webcam 041e:4067 added.
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Rafal Milecki <zajec5@gmail.com>
+
+commit 518c8df77c21b7d1690dd8b96eb0e54c4ec1c9c1 upstream.
+
+Signed-off-by: Rafal Milecki <zajec5@gmail.com>
+Signed-off-by: Jean-Francois Moine <moinejf@free.fr>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Cc: Surbhi Palande <surbhi.palande@canonical.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ Documentation/video4linux/gspca.txt | 1 +
+ drivers/media/video/gspca/ov519.c | 1 +
+ 2 files changed, 2 insertions(+)
+
+--- a/Documentation/video4linux/gspca.txt
++++ b/Documentation/video4linux/gspca.txt
+@@ -37,6 +37,7 @@ ov519 041e:405f Creative Live! VISTA VF
+ ov519 041e:4060 Creative Live! VISTA VF0350
+ ov519 041e:4061 Creative Live! VISTA VF0400
+ ov519 041e:4064 Creative Live! VISTA VF0420
++ov519 041e:4067 Creative Live! Cam Video IM (VF0350)
+ ov519 041e:4068 Creative Live! VISTA VF0470
+ spca561 0458:7004 Genius VideoCAM Express V2
+ sunplus 0458:7006 Genius Dsc 1.3 Smart
+--- a/drivers/media/video/gspca/ov519.c
++++ b/drivers/media/video/gspca/ov519.c
+@@ -3364,6 +3364,7 @@ static const __devinitdata struct usb_de
+ {USB_DEVICE(0x041e, 0x4061), .driver_info = BRIDGE_OV519 },
+ {USB_DEVICE(0x041e, 0x4064),
+ .driver_info = BRIDGE_OV519 | BRIDGE_INVERT_LED },
++ {USB_DEVICE(0x041e, 0x4067), .driver_info = BRIDGE_OV519 },
+ {USB_DEVICE(0x041e, 0x4068),
+ .driver_info = BRIDGE_OV519 | BRIDGE_INVERT_LED },
+ {USB_DEVICE(0x045e, 0x028c), .driver_info = BRIDGE_OV519 },
+
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
