--- /dev/null
+From b8e7e40abeac49644fec4a4f52ffe74c7b05eca0 Mon Sep 17 00:00:00 2001
+From: Alan Cox <alan@linux.intel.com>
+Date: Thu, 28 May 2009 14:01:35 +0100
+Subject: 8250: Fix oops from setserial
+
+From: Alan Cox <alan@linux.intel.com>
+
+commit b8e7e40abeac49644fec4a4f52ffe74c7b05eca0 upstream.
+
+If you setserial a port which has never been initialised we change the type
+but don't update the I/O method pointers. The same problem is true if you
+change the io type of a port - but nobody ever does that so nobody noticed!
+
+Remember the old type and when attaching if the type has changed reload the
+port accessor pointers. We can't do it blindly as some 8250 drivers load custom
+accessors and we must not stomp those.
+
+Tested-by: Victor Seryodkin <vvscore@gmail.com>
+Closes-bug: #13367
+Signed-off-by: Alan Cox <alan@linux.intel.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Kirill Smelkov <kirr@mns.spb.ru>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/serial/8250.c | 15 +++++++++++++++
+ 1 file changed, 15 insertions(+)
+
+--- a/drivers/serial/8250.c
++++ b/drivers/serial/8250.c
+@@ -137,6 +137,7 @@ struct uart_8250_port {
+ unsigned char mcr;
+ unsigned char mcr_mask; /* mask of user bits */
+ unsigned char mcr_force; /* mask of forced bits */
++ unsigned char cur_iotype; /* Running I/O type */
+
+ /*
+ * Some bits in registers are cleared on a read, so they must
+@@ -471,6 +472,7 @@ static void io_serial_out(struct uart_po
+
+ static void set_io_from_upio(struct uart_port *p)
+ {
++ struct uart_8250_port *up = (struct uart_8250_port *)p;
+ switch (p->iotype) {
+ case UPIO_HUB6:
+ p->serial_in = hub6_serial_in;
+@@ -509,6 +511,8 @@ static void set_io_from_upio(struct uart
+ p->serial_out = io_serial_out;
+ break;
+ }
++ /* Remember loaded iotype */
++ up->cur_iotype = p->iotype;
+ }
+
+ static void
+@@ -1937,6 +1941,9 @@ static int serial8250_startup(struct uar
+ up->capabilities = uart_config[up->port.type].flags;
+ up->mcr = 0;
+
++ if (up->port.iotype != up->cur_iotype)
++ set_io_from_upio(port);
++
+ if (up->port.type == PORT_16C950) {
+ /* Wake up and initialize UART */
+ up->acr = 0;
+@@ -2563,6 +2570,9 @@ static void serial8250_config_port(struc
+ if (ret < 0)
+ probeflags &= ~PROBE_RSA;
+
++ if (up->port.iotype != up->cur_iotype)
++ set_io_from_upio(port);
++
+ if (flags & UART_CONFIG_TYPE)
+ autoconfig(up, probeflags);
+ if (up->port.type != PORT_UNKNOWN && flags & UART_CONFIG_IRQ)
+@@ -2671,6 +2681,11 @@ serial8250_register_ports(struct uart_dr
+ {
+ int i;
+
++ for (i = 0; i < nr_uarts; i++) {
++ struct uart_8250_port *up = &serial8250_ports[i];
++ up->cur_iotype = 0xFF;
++ }
++
+ serial8250_isa_init_ports();
+
+ for (i = 0; i < nr_uarts; i++) {
--- /dev/null
+From cebbert@redhat.com Mon Jun 29 10:44:17 2009
+From: Chuck Ebbert <cebbert@redhat.com>
+Date: Wed, 10 Jun 2009 17:56:46 -0400
+Subject: atkbd: add forced release quirks for four more keyboard models
+To: stable@kernel.org
+Cc: Dmitry Torokhov <dtor@mail.ru>
+Message-ID: <20090610175646.29a028b9@dhcp-100-2-144.bos.redhat.com>
+
+From: Chuck Ebbert <cebbert@redhat.com>
+
+Add atkbd forced key release quirks for four more notebook models.
+
+Rollup of:
+linux-2.6.git-391916985b009b8934d00f772a3bde0d8a495ebd.patch
+linux-2.6.git-adcb523eb39e0dd2f712d8dbd8e18b5d36a97825.patch
+linux-2.6.git-157f3a3e17cd498571db2a472dc3a15a7679ee3f.patch
+linux-2.6.git-e04126c79242d2740b469292d42c239bad7807cc.patch
+linux-2.6.git-9166d0f620d5dd4a128711bdeedb3e0f534d9d49.patch
+
+Cc: Dmitry Torokhov <dtor@mail.ru>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/input/keyboard/atkbd.c | 169 +++++++++++++++++++++++------------------
+ 1 file changed, 96 insertions(+), 73 deletions(-)
+
+--- a/drivers/input/keyboard/atkbd.c
++++ b/drivers/input/keyboard/atkbd.c
+@@ -229,7 +229,8 @@ struct atkbd {
+ /*
+ * System-specific ketymap fixup routine
+ */
+-static void (*atkbd_platform_fixup)(struct atkbd *);
++static void (*atkbd_platform_fixup)(struct atkbd *, const void *data);
++static void *atkbd_platform_fixup_data;
+
+ static ssize_t atkbd_attr_show_helper(struct device *dev, char *buf,
+ ssize_t (*handler)(struct atkbd *, char *));
+@@ -834,87 +835,71 @@ static void atkbd_disconnect(struct seri
+ }
+
+ /*
+- * Most special keys (Fn+F?) on Dell laptops do not generate release
+- * events so we have to do it ourselves.
++ * generate release events for the keycodes given in data
+ */
+-static void atkbd_dell_laptop_keymap_fixup(struct atkbd *atkbd)
++static void atkbd_apply_forced_release_keylist(struct atkbd* atkbd,
++ const void *data)
+ {
+- static const unsigned int forced_release_keys[] = {
+- 0x85, 0x86, 0x87, 0x88, 0x89, 0x8a, 0x8b, 0x8f, 0x93,
+- };
+- int i;
++ const unsigned int *keys = data;
++ unsigned int i;
+
+ if (atkbd->set == 2)
+- for (i = 0; i < ARRAY_SIZE(forced_release_keys); i++)
+- __set_bit(forced_release_keys[i],
+- atkbd->force_release_mask);
++ for (i = 0; keys[i] != -1U; i++)
++ __set_bit(keys[i], atkbd->force_release_mask);
+ }
+
+ /*
++ * Most special keys (Fn+F?) on Dell laptops do not generate release
++ * events so we have to do it ourselves.
++ */
++static unsigned int atkbd_dell_laptop_forced_release_keys[] = {
++ 0x85, 0x86, 0x87, 0x88, 0x89, 0x8a, 0x8b, 0x8f, 0x93, -1U
++};
++
++/*
+ * Perform fixup for HP system that doesn't generate release
+ * for its video switch
+ */
+-static void atkbd_hp_keymap_fixup(struct atkbd *atkbd)
+-{
+- static const unsigned int forced_release_keys[] = {
+- 0x94,
+- };
+- int i;
+-
+- if (atkbd->set == 2)
+- for (i = 0; i < ARRAY_SIZE(forced_release_keys); i++)
+- __set_bit(forced_release_keys[i],
+- atkbd->force_release_mask);
+-}
++static unsigned int atkbd_hp_forced_release_keys[] = {
++ 0x94, -1U
++};
+
+ /*
+ * Inventec system with broken key release on volume keys
+ */
+-static void atkbd_inventec_keymap_fixup(struct atkbd *atkbd)
+-{
+- const unsigned int forced_release_keys[] = {
+- 0xae, 0xb0,
+- };
+- int i;
+-
+- if (atkbd->set == 2)
+- for (i = 0; i < ARRAY_SIZE(forced_release_keys); i++)
+- __set_bit(forced_release_keys[i],
+- atkbd->force_release_mask);
+-}
++static unsigned int atkbd_inventec_forced_release_keys[] = {
++ 0xae, 0xb0, -1U
++};
+
+ /*
+ * Perform fixup for HP Pavilion ZV6100 laptop that doesn't generate release
+ * for its volume buttons
+ */
+-static void atkbd_hp_zv6100_keymap_fixup(struct atkbd *atkbd)
+-{
+- const unsigned int forced_release_keys[] = {
+- 0xae, 0xb0,
+- };
+- int i;
++static unsigned int atkbd_hp_zv6100_forced_release_keys[] = {
++ 0xae, 0xb0, -1U
++};
+
+- if (atkbd->set == 2)
+- for (i = 0; i < ARRAY_SIZE(forced_release_keys); i++)
+- __set_bit(forced_release_keys[i],
+- atkbd->force_release_mask);
+-}
++/*
++ * Samsung NC10,NC20 with Fn+F? key release not working
++ */
++static unsigned int atkbd_samsung_forced_release_keys[] = {
++ 0x82, 0x83, 0x84, 0x86, 0x88, 0x89, 0xb3, 0xf7, 0xf9, -1U
++};
+
+ /*
+- * Samsung NC10 with Fn+F? key release not working
++ * The volume up and volume down special keys on a Fujitsu Amilo PA 1510 laptop
++ * do not generate release events so we have to do it ourselves.
+ */
+-static void atkbd_samsung_keymap_fixup(struct atkbd *atkbd)
+-{
+- const unsigned int forced_release_keys[] = {
+- 0x82, 0x83, 0x84, 0x86, 0x88, 0x89, 0xb3, 0xf7, 0xf9,
+- };
+- int i;
++static unsigned int atkbd_amilo_pa1510_forced_release_keys[] = {
++ 0xb0, 0xae, -1U
++};
+
+- if (atkbd->set == 2)
+- for (i = 0; i < ARRAY_SIZE(forced_release_keys); i++)
+- __set_bit(forced_release_keys[i],
+- atkbd->force_release_mask);
+-}
++/*
++ * Amilo Xi 3650 key release for light touch bar not working
++ */
++static unsigned int atkbd_amilo_xi3650_forced_release_keys[] = {
++ 0x67, 0xed, 0x90, 0xa2, 0x99, 0xa4, 0xae, 0xb0, -1U
++};
+
+ /*
+ * atkbd_set_keycode_table() initializes keyboard's keycode table
+@@ -967,7 +952,7 @@ static void atkbd_set_keycode_table(stru
+ * Perform additional fixups
+ */
+ if (atkbd_platform_fixup)
+- atkbd_platform_fixup(atkbd);
++ atkbd_platform_fixup(atkbd, atkbd_platform_fixup_data);
+ }
+
+ /*
+@@ -1492,9 +1477,11 @@ static ssize_t atkbd_show_err_count(stru
+ return sprintf(buf, "%lu\n", atkbd->err_count);
+ }
+
+-static int __init atkbd_setup_fixup(const struct dmi_system_id *id)
++static int __init atkbd_setup_forced_release(const struct dmi_system_id *id)
+ {
+- atkbd_platform_fixup = id->driver_data;
++ atkbd_platform_fixup = atkbd_apply_forced_release_keylist;
++ atkbd_platform_fixup_data = id->driver_data;
++
+ return 0;
+ }
+
+@@ -1505,8 +1492,8 @@ static struct dmi_system_id atkbd_dmi_qu
+ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+ DMI_MATCH(DMI_CHASSIS_TYPE, "8"), /* Portable */
+ },
+- .callback = atkbd_setup_fixup,
+- .driver_data = atkbd_dell_laptop_keymap_fixup,
++ .callback = atkbd_setup_forced_release,
++ .driver_data = atkbd_dell_laptop_forced_release_keys,
+ },
+ {
+ .ident = "Dell Laptop",
+@@ -1514,8 +1501,8 @@ static struct dmi_system_id atkbd_dmi_qu
+ DMI_MATCH(DMI_SYS_VENDOR, "Dell Computer Corporation"),
+ DMI_MATCH(DMI_CHASSIS_TYPE, "8"), /* Portable */
+ },
+- .callback = atkbd_setup_fixup,
+- .driver_data = atkbd_dell_laptop_keymap_fixup,
++ .callback = atkbd_setup_forced_release,
++ .driver_data = atkbd_dell_laptop_forced_release_keys,
+ },
+ {
+ .ident = "HP 2133",
+@@ -1523,8 +1510,8 @@ static struct dmi_system_id atkbd_dmi_qu
+ DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "HP 2133"),
+ },
+- .callback = atkbd_setup_fixup,
+- .driver_data = atkbd_hp_keymap_fixup,
++ .callback = atkbd_setup_forced_release,
++ .driver_data = atkbd_hp_forced_release_keys,
+ },
+ {
+ .ident = "HP Pavilion ZV6100",
+@@ -1532,8 +1519,8 @@ static struct dmi_system_id atkbd_dmi_qu
+ DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "Pavilion ZV6100"),
+ },
+- .callback = atkbd_setup_fixup,
+- .driver_data = atkbd_hp_zv6100_keymap_fixup,
++ .callback = atkbd_setup_forced_release,
++ .driver_data = atkbd_hp_zv6100_forced_release_keys,
+ },
+ {
+ .ident = "Inventec Symphony",
+@@ -1541,8 +1528,8 @@ static struct dmi_system_id atkbd_dmi_qu
+ DMI_MATCH(DMI_SYS_VENDOR, "INVENTEC"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "SYMPHONY 6.0/7.0"),
+ },
+- .callback = atkbd_setup_fixup,
+- .driver_data = atkbd_inventec_keymap_fixup,
++ .callback = atkbd_setup_forced_release,
++ .driver_data = atkbd_inventec_forced_release_keys,
+ },
+ {
+ .ident = "Samsung NC10",
+@@ -1550,8 +1537,44 @@ static struct dmi_system_id atkbd_dmi_qu
+ DMI_MATCH(DMI_SYS_VENDOR, "SAMSUNG ELECTRONICS CO., LTD."),
+ DMI_MATCH(DMI_PRODUCT_NAME, "NC10"),
+ },
+- .callback = atkbd_setup_fixup,
+- .driver_data = atkbd_samsung_keymap_fixup,
++ .callback = atkbd_setup_forced_release,
++ .driver_data = atkbd_samsung_forced_release_keys,
++ },
++ {
++ .ident = "Samsung NC20",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "SAMSUNG ELECTRONICS CO., LTD."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "NC20"),
++ },
++ .callback = atkbd_setup_forced_release,
++ .driver_data = atkbd_samsung_forced_release_keys,
++ },
++ {
++ .ident = "Samsung SQ45S70S",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "SAMSUNG ELECTRONICS CO., LTD."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "SQ45S70S"),
++ },
++ .callback = atkbd_setup_forced_release,
++ .driver_data = atkbd_samsung_forced_release_keys,
++ },
++ {
++ .ident = "Fujitsu Amilo PA 1510",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU SIEMENS"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "AMILO Pa 1510"),
++ },
++ .callback = atkbd_setup_forced_release,
++ .driver_data = atkbd_amilo_pa1510_forced_release_keys,
++ },
++ {
++ .ident = "Fujitsu Amilo Xi 3650",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU SIEMENS"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "AMILO Xi 3650"),
++ },
++ .callback = atkbd_setup_forced_release,
++ .driver_data = atkbd_amilo_xi3650_forced_release_keys,
+ },
+ { }
+ };
--- /dev/null
+From 96050dfb25966612008dcea7d342e91fa01e993c Mon Sep 17 00:00:00 2001
+From: Peter Botha <peterb@goldcircle.co.za>
+Date: Tue, 9 Jun 2009 17:16:32 -0700
+Subject: char: mxser, fix ISA board lookup
+
+From: Peter Botha <peterb@goldcircle.co.za>
+
+commit 96050dfb25966612008dcea7d342e91fa01e993c upstream.
+
+There's a bug in the mxser kernel module that still appears in the
+2.6.29.4 kernel.
+
+mxser_get_ISA_conf takes a ioaddress as its first argument, by passing the
+not of the ioaddr, you're effectively passing 0 which means it won't be
+able to talk to an ISA card. I have tested this, and removing the !
+fixes the problem.
+
+Cc: "Peter Botha" <peterb@goldcircle.co.za>
+Signed-off-by: Jiri Slaby <jirislaby@gmail.com>
+Acked-by: Alan Cox <alan@lxorguk.ukuu.org.uk>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/char/mxser.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/char/mxser.c
++++ b/drivers/char/mxser.c
+@@ -2712,7 +2712,7 @@ static int __init mxser_module_init(void
+ continue;
+
+ brd = &mxser_boards[m];
+- retval = mxser_get_ISA_conf(!ioaddr[b], brd);
++ retval = mxser_get_ISA_conf(ioaddr[b], brd);
+ if (retval <= 0) {
+ brd->info = NULL;
+ continue;
--- /dev/null
+From 3b0fde0fac19c180317eb0601b3504083f4b9bf5 Mon Sep 17 00:00:00 2001
+From: Yinghai Lu <yinghai@kernel.org>
+Date: Tue, 16 Jun 2009 15:31:16 -0700
+Subject: firmware_map: fix hang with x86/32bit
+
+From: Yinghai Lu <yinghai@kernel.org>
+
+commit 3b0fde0fac19c180317eb0601b3504083f4b9bf5 upstream.
+
+Addresses http://bugzilla.kernel.org/show_bug.cgi?id=13484
+
+Peer reported:
+| The bug is introduced from kernel 2.6.27, if E820 table reserve the memory
+| above 4G in 32bit OS(BIOS-e820: 00000000fff80000 - 0000000120000000
+| (reserved)), system will report Int 6 error and hang up. The bug is caused by
+| the following code in drivers/firmware/memmap.c, the resource_size_t is 32bit
+| variable in 32bit OS, the BUG_ON() will be invoked to result in the Int 6
+| error. I try the latest 32bit Ubuntu and Fedora distributions, all hit this
+| bug.
+|======
+|static int firmware_map_add_entry(resource_size_t start, resource_size_t end,
+| const char *type,
+| struct firmware_map_entry *entry)
+
+and it only happen with CONFIG_PHYS_ADDR_T_64BIT is not set.
+
+it turns out we need to pass u64 instead of resource_size_t for that.
+
+[akpm@linux-foundation.org: add comment]
+Reported-and-tested-by: Peer Chen <pchen@nvidia.com>
+Signed-off-by: Yinghai Lu <yinghai@kernel.org>
+Cc: Ingo Molnar <mingo@elte.hu>
+Acked-by: H. Peter Anvin <hpa@zytor.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/firmware/memmap.c | 16 +++++++++-------
+ include/linux/firmware-map.h | 12 ++++--------
+ 2 files changed, 13 insertions(+), 15 deletions(-)
+
+--- a/drivers/firmware/memmap.c
++++ b/drivers/firmware/memmap.c
+@@ -31,8 +31,12 @@
+ * information is necessary as for the resource tree.
+ */
+ struct firmware_map_entry {
+- resource_size_t start; /* start of the memory range */
+- resource_size_t end; /* end of the memory range (incl.) */
++ /*
++ * start and end must be u64 rather than resource_size_t, because e820
++ * resources can lie at addresses above 4G.
++ */
++ u64 start; /* start of the memory range */
++ u64 end; /* end of the memory range (incl.) */
+ const char *type; /* type of the memory range */
+ struct list_head list; /* entry for the linked list */
+ struct kobject kobj; /* kobject for each entry */
+@@ -101,7 +105,7 @@ static LIST_HEAD(map_entries);
+ * Common implementation of firmware_map_add() and firmware_map_add_early()
+ * which expects a pre-allocated struct firmware_map_entry.
+ **/
+-static int firmware_map_add_entry(resource_size_t start, resource_size_t end,
++static int firmware_map_add_entry(u64 start, u64 end,
+ const char *type,
+ struct firmware_map_entry *entry)
+ {
+@@ -132,8 +136,7 @@ static int firmware_map_add_entry(resour
+ *
+ * Returns 0 on success, or -ENOMEM if no memory could be allocated.
+ **/
+-int firmware_map_add(resource_size_t start, resource_size_t end,
+- const char *type)
++int firmware_map_add(u64 start, u64 end, const char *type)
+ {
+ struct firmware_map_entry *entry;
+
+@@ -157,8 +160,7 @@ int firmware_map_add(resource_size_t sta
+ *
+ * Returns 0 on success, or -ENOMEM if no memory could be allocated.
+ **/
+-int __init firmware_map_add_early(resource_size_t start, resource_size_t end,
+- const char *type)
++int __init firmware_map_add_early(u64 start, u64 end, const char *type)
+ {
+ struct firmware_map_entry *entry;
+
+--- a/include/linux/firmware-map.h
++++ b/include/linux/firmware-map.h
+@@ -24,21 +24,17 @@
+ */
+ #ifdef CONFIG_FIRMWARE_MEMMAP
+
+-int firmware_map_add(resource_size_t start, resource_size_t end,
+- const char *type);
+-int firmware_map_add_early(resource_size_t start, resource_size_t end,
+- const char *type);
++int firmware_map_add(u64 start, u64 end, const char *type);
++int firmware_map_add_early(u64 start, u64 end, const char *type);
+
+ #else /* CONFIG_FIRMWARE_MEMMAP */
+
+-static inline int firmware_map_add(resource_size_t start, resource_size_t end,
+- const char *type)
++static inline int firmware_map_add(u64 start, u64 end, const char *type)
+ {
+ return 0;
+ }
+
+-static inline int firmware_map_add_early(resource_size_t start,
+- resource_size_t end, const char *type)
++static inline int firmware_map_add_early(u64 start, u64 end, const char *type)
+ {
+ return 0;
+ }
--- /dev/null
+From 545b9fd3d737afc0bb5203b1e79194a471605acd Mon Sep 17 00:00:00 2001
+From: Nick Piggin <npiggin@suse.de>
+Date: Tue, 2 Jun 2009 12:07:47 +0200
+Subject: fs: remove incorrect I_NEW warnings
+
+From: Nick Piggin <npiggin@suse.de>
+
+commit 545b9fd3d737afc0bb5203b1e79194a471605acd upstream.
+
+Some filesystems can call in to sync an inode that is still in the
+I_NEW state (eg. ext family, when mounted with -osync). This is OK
+because the filesystem has sole access to the new inode, so it can
+modify i_state without races (because no other thread should be
+modifying it, by definition of I_NEW). Ie. a false positive, so
+remove the warnings.
+
+The races are described here 7ef0d7377cb287e08f3ae94cebc919448e1f5dff,
+which is also where the warnings were introduced.
+
+Reported-by: Stephen Hemminger <shemminger@vyatta.com>
+Signed-off-by: Nick Piggin <npiggin@suse.de>
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/fs-writeback.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/fs/fs-writeback.c
++++ b/fs/fs-writeback.c
+@@ -274,7 +274,6 @@ __sync_single_inode(struct inode *inode,
+ int ret;
+
+ BUG_ON(inode->i_state & I_SYNC);
+- WARN_ON(inode->i_state & I_NEW);
+
+ /* Set I_SYNC, reset I_DIRTY */
+ dirty = inode->i_state & I_DIRTY;
+@@ -299,7 +298,6 @@ __sync_single_inode(struct inode *inode,
+ }
+
+ spin_lock(&inode_lock);
+- WARN_ON(inode->i_state & I_NEW);
+ inode->i_state &= ~I_SYNC;
+ if (!(inode->i_state & I_FREEING)) {
+ if (!(inode->i_state & I_DIRTY) &&
--- /dev/null
+From a61d90d75d0f9e86432c45b496b4b0fbf0fd03dc Mon Sep 17 00:00:00 2001
+From: Jan Kara <jack@suse.cz>
+Date: Tue, 9 Jun 2009 16:26:26 -0700
+Subject: jbd: fix race in buffer processing in commit code
+
+From: Jan Kara <jack@suse.cz>
+
+commit a61d90d75d0f9e86432c45b496b4b0fbf0fd03dc upstream.
+
+In commit code, we scan buffers attached to a transaction. During this
+scan, we sometimes have to drop j_list_lock and then we recheck whether
+the journal buffer head didn't get freed by journal_try_to_free_buffers().
+ But checking for buffer_jbd(bh) isn't enough because a new journal head
+could get attached to our buffer head. So add a check whether the journal
+head remained the same and whether it's still at the same transaction and
+list.
+
+This is a nasty bug and can cause problems like memory corruption (use after
+free) or trigger various assertions in JBD code (observed).
+
+Signed-off-by: Jan Kara <jack@suse.cz>
+Cc: <linux-ext4@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/jbd/commit.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/fs/jbd/commit.c
++++ b/fs/jbd/commit.c
+@@ -238,7 +238,7 @@ write_out_data:
+ spin_lock(&journal->j_list_lock);
+ }
+ /* Someone already cleaned up the buffer? */
+- if (!buffer_jbd(bh)
++ if (!buffer_jbd(bh) || bh2jh(bh) != jh
+ || jh->b_transaction != commit_transaction
+ || jh->b_jlist != BJ_SyncData) {
+ jbd_unlock_bh_state(bh);
+@@ -466,7 +466,9 @@ void journal_commit_transaction(journal_
+ spin_lock(&journal->j_list_lock);
+ continue;
+ }
+- if (buffer_jbd(bh) && jh->b_jlist == BJ_Locked) {
++ if (buffer_jbd(bh) && bh2jh(bh) == jh &&
++ jh->b_transaction == commit_transaction &&
++ jh->b_jlist == BJ_Locked) {
+ __journal_unfile_buffer(jh);
+ jbd_unlock_bh_state(bh);
+ journal_remove_journal_head(bh);
--- /dev/null
+From 8e822df700694ca6850d1e0c122fd7004b2778d8 Mon Sep 17 00:00:00 2001
+From: Shaohua Li <shaohua.li@intel.com>
+Date: Mon, 8 Jun 2009 09:27:25 +0800
+Subject: PCI: disable ASPM on VIA root-port-under-bridge configurations
+
+From: Shaohua Li <shaohua.li@intel.com>
+
+commit 8e822df700694ca6850d1e0c122fd7004b2778d8 upstream.
+
+VIA has a strange chipset, it has root port under a bridge. Disable ASPM
+for such strange chipset.
+
+Tested-by: Wolfgang Denk <wd@denx.de>
+Signed-off-by: Shaohua Li <shaohua.li@intel.com>
+Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+--- a/drivers/pci/pcie/aspm.c
++++ b/drivers/pci/pcie/aspm.c
+@@ -638,6 +638,10 @@ void pcie_aspm_init_link_state(struct pci_dev *pdev)
+ if (pdev->pcie_type != PCI_EXP_TYPE_ROOT_PORT &&
+ pdev->pcie_type != PCI_EXP_TYPE_DOWNSTREAM)
+ return;
++ /* VIA has a strange chipset, root port is under a bridge */
++ if (pdev->pcie_type == PCI_EXP_TYPE_ROOT_PORT &&
++ pdev->bus->self)
++ return;
+ down_read(&pci_bus_sem);
+ if (list_empty(&pdev->subordinate->devices))
+ goto out;
--- /dev/null
+From fdd7b4c3302c93f6833e338903ea77245eb510b4 Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <eric.dumazet@gmail.com>
+Date: Tue, 9 Jun 2009 04:01:02 -0700
+Subject: r8169: fix crash when large packets are received
+
+From: Eric Dumazet <eric.dumazet@gmail.com>
+
+commit fdd7b4c3302c93f6833e338903ea77245eb510b4 upstream.
+
+Michael Tokarev reported receiving a large packet could crash
+a machine with RTL8169 NIC.
+( original thread at http://lkml.org/lkml/2009/6/8/192 )
+
+Problem is this driver tells that NIC frames up to 16383 bytes
+can be received but provides skb to rx ring allocated with
+smaller sizes (1536 bytes in case standard 1500 bytes MTU is used)
+
+When a frame larger than what was allocated by driver is received,
+dma transfert can occurs past the end of buffer and corrupt
+kernel memory.
+
+Fix is to tell to NIC what is the maximum size a frame can be.
+
+This bug is very old, (before git introduction, linux-2.6.10), and
+should be backported to stable versions.
+
+Reported-by: Michael Tokarev <mjt@tls.msk.ru>
+Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
+Tested-by: Michael Tokarev <mjt@tls.msk.ru>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/r8169.c | 11 +++++------
+ 1 file changed, 5 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/r8169.c
++++ b/drivers/net/r8169.c
+@@ -66,7 +66,6 @@ static const int multicast_filter_limit
+ #define RX_DMA_BURST 6 /* Maximum PCI burst, '6' is 1024 */
+ #define TX_DMA_BURST 6 /* Maximum PCI burst, '6' is 1024 */
+ #define EarlyTxThld 0x3F /* 0x3F means NO early transmit */
+-#define RxPacketMaxSize 0x3FE8 /* 16K - 1 - ETH_HLEN - VLAN - CRC... */
+ #define SafeMtu 0x1c20 /* ... actually life sucks beyond ~7k */
+ #define InterFrameGap 0x03 /* 3 means InterFrameGap = the shortest one */
+
+@@ -2357,10 +2356,10 @@ static u16 rtl_rw_cpluscmd(void __iomem
+ return cmd;
+ }
+
+-static void rtl_set_rx_max_size(void __iomem *ioaddr)
++static void rtl_set_rx_max_size(void __iomem *ioaddr, unsigned int rx_buf_sz)
+ {
+ /* Low hurts. Let's disable the filtering. */
+- RTL_W16(RxMaxSize, 16383);
++ RTL_W16(RxMaxSize, rx_buf_sz);
+ }
+
+ static void rtl8169_set_magic_reg(void __iomem *ioaddr, unsigned mac_version)
+@@ -2407,7 +2406,7 @@ static void rtl_hw_start_8169(struct net
+
+ RTL_W8(EarlyTxThres, EarlyTxThld);
+
+- rtl_set_rx_max_size(ioaddr);
++ rtl_set_rx_max_size(ioaddr, tp->rx_buf_sz);
+
+ if ((tp->mac_version == RTL_GIGA_MAC_VER_01) ||
+ (tp->mac_version == RTL_GIGA_MAC_VER_02) ||
+@@ -2668,7 +2667,7 @@ static void rtl_hw_start_8168(struct net
+
+ RTL_W8(EarlyTxThres, EarlyTxThld);
+
+- rtl_set_rx_max_size(ioaddr);
++ rtl_set_rx_max_size(ioaddr, tp->rx_buf_sz);
+
+ tp->cp_cmd |= RTL_R16(CPlusCmd) | PktCntrDisable | INTT_1;
+
+@@ -2846,7 +2845,7 @@ static void rtl_hw_start_8101(struct net
+
+ RTL_W8(EarlyTxThres, EarlyTxThld);
+
+- rtl_set_rx_max_size(ioaddr);
++ rtl_set_rx_max_size(ioaddr, tp->rx_buf_sz);
+
+ tp->cp_cmd |= rtl_rw_cpluscmd(ioaddr) | PCIMulRW;
+
parport-netmos-9845-9855-1p4s-fixes.patch
+8250-fix-oops-from-setserial.patch
+char-mxser-fix-isa-board-lookup.patch
+jbd-fix-race-in-buffer-processing-in-commit-code.patch
+r8169-fix-crash-when-large-packets-are-received.patch
+fs-remove-incorrect-i_new-warnings.patch
+firmware_map-fix-hang-with-x86-32bit.patch
+pci-disable-aspm-on-via-root-port-under-bridge-configurations.patch
+atkbd-add-forced-release-quirks-for-four-more-keyboard-models.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
