From: Greg Kroah-Hartman Date: Fri, 6 Nov 2009 22:21:42 +0000 (-0800) Subject: start 2.6.31.6 review cycle X-Git-Tag: v2.6.31.6~2 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=0550e8b342e25f29e27f3ff45160d6e1d25fae8e;p=thirdparty%2Fkernel%2Fstable-queue.git start 2.6.31.6 review cycle --- diff --git a/queue-2.6.31/8250_pci-add-ibm-saturn-serial-card.patch b/review-2.6.31/8250_pci-add-ibm-saturn-serial-card.patch similarity index 100% rename from queue-2.6.31/8250_pci-add-ibm-saturn-serial-card.patch rename to review-2.6.31/8250_pci-add-ibm-saturn-serial-card.patch diff --git a/queue-2.6.31/acpi-pci-fix-null-pointer-dereference-in-acpi_get_pci_dev-rev.-2.patch b/review-2.6.31/acpi-pci-fix-null-pointer-dereference-in-acpi_get_pci_dev-rev.-2.patch similarity index 100% rename from queue-2.6.31/acpi-pci-fix-null-pointer-dereference-in-acpi_get_pci_dev-rev.-2.patch rename to review-2.6.31/acpi-pci-fix-null-pointer-dereference-in-acpi_get_pci_dev-rev.-2.patch diff --git a/queue-2.6.31/af_unix-fix-deadlock-on-connecting-to-shutdown-socket-cve-2009-3621.patch b/review-2.6.31/af_unix-fix-deadlock-on-connecting-to-shutdown-socket-cve-2009-3621.patch similarity index 100% rename from queue-2.6.31/af_unix-fix-deadlock-on-connecting-to-shutdown-socket-cve-2009-3621.patch rename to review-2.6.31/af_unix-fix-deadlock-on-connecting-to-shutdown-socket-cve-2009-3621.patch diff --git a/queue-2.6.31/agp-intel-add-b43-chipset-support.patch b/review-2.6.31/agp-intel-add-b43-chipset-support.patch similarity index 100% rename from queue-2.6.31/agp-intel-add-b43-chipset-support.patch rename to review-2.6.31/agp-intel-add-b43-chipset-support.patch diff --git a/queue-2.6.31/ahci-revert-restore-sb600-sata-controller-64-bit-dma.patch b/review-2.6.31/ahci-revert-restore-sb600-sata-controller-64-bit-dma.patch similarity index 100% rename from queue-2.6.31/ahci-revert-restore-sb600-sata-controller-64-bit-dma.patch rename to review-2.6.31/ahci-revert-restore-sb600-sata-controller-64-bit-dma.patch diff --git a/queue-2.6.31/alpha-fix-build-after-vmlinux.lds.s-cleanup.patch b/review-2.6.31/alpha-fix-build-after-vmlinux.lds.s-cleanup.patch similarity index 100% rename from queue-2.6.31/alpha-fix-build-after-vmlinux.lds.s-cleanup.patch rename to review-2.6.31/alpha-fix-build-after-vmlinux.lds.s-cleanup.patch diff --git a/queue-2.6.31/alsa-ice1724-make-call-to-set-hw-params-succeed-on-esi-juli.patch b/review-2.6.31/alsa-ice1724-make-call-to-set-hw-params-succeed-on-esi-juli.patch similarity index 100% rename from queue-2.6.31/alsa-ice1724-make-call-to-set-hw-params-succeed-on-esi-juli.patch rename to review-2.6.31/alsa-ice1724-make-call-to-set-hw-params-succeed-on-esi-juli.patch diff --git a/queue-2.6.31/b43-fix-bugzilla-14181-and-the-bug-from-the-previous-fix.patch b/review-2.6.31/b43-fix-bugzilla-14181-and-the-bug-from-the-previous-fix.patch similarity index 100% rename from queue-2.6.31/b43-fix-bugzilla-14181-and-the-bug-from-the-previous-fix.patch rename to review-2.6.31/b43-fix-bugzilla-14181-and-the-bug-from-the-previous-fix.patch diff --git a/queue-2.6.31/bonding-fix-a-race-condition-in-calls-to-slave-mii-ioctls.patch b/review-2.6.31/bonding-fix-a-race-condition-in-calls-to-slave-mii-ioctls.patch similarity index 100% rename from queue-2.6.31/bonding-fix-a-race-condition-in-calls-to-slave-mii-ioctls.patch rename to review-2.6.31/bonding-fix-a-race-condition-in-calls-to-slave-mii-ioctls.patch diff --git a/queue-2.6.31/cifs-fixing-to-avoid-invalid-kfree-in-cifs_get_tcp_session.patch b/review-2.6.31/cifs-fixing-to-avoid-invalid-kfree-in-cifs_get_tcp_session.patch similarity index 100% rename from queue-2.6.31/cifs-fixing-to-avoid-invalid-kfree-in-cifs_get_tcp_session.patch rename to review-2.6.31/cifs-fixing-to-avoid-invalid-kfree-in-cifs_get_tcp_session.patch diff --git a/queue-2.6.31/cpuidle-always-return-with-interrupts-enabled.patch b/review-2.6.31/cpuidle-always-return-with-interrupts-enabled.patch similarity index 100% rename from queue-2.6.31/cpuidle-always-return-with-interrupts-enabled.patch rename to review-2.6.31/cpuidle-always-return-with-interrupts-enabled.patch diff --git a/queue-2.6.31/dm-add-missing-del_gendisk-to-alloc_dev-error-path.patch b/review-2.6.31/dm-add-missing-del_gendisk-to-alloc_dev-error-path.patch similarity index 100% rename from queue-2.6.31/dm-add-missing-del_gendisk-to-alloc_dev-error-path.patch rename to review-2.6.31/dm-add-missing-del_gendisk-to-alloc_dev-error-path.patch diff --git a/queue-2.6.31/dm-dec_pending-needs-locking-to-save-error-value.patch b/review-2.6.31/dm-dec_pending-needs-locking-to-save-error-value.patch similarity index 100% rename from queue-2.6.31/dm-dec_pending-needs-locking-to-save-error-value.patch rename to review-2.6.31/dm-dec_pending-needs-locking-to-save-error-value.patch diff --git a/queue-2.6.31/dm-exception-store-fix-failed-set_chunk_size-error-path.patch b/review-2.6.31/dm-exception-store-fix-failed-set_chunk_size-error-path.patch similarity index 100% rename from queue-2.6.31/dm-exception-store-fix-failed-set_chunk_size-error-path.patch rename to review-2.6.31/dm-exception-store-fix-failed-set_chunk_size-error-path.patch diff --git a/queue-2.6.31/dm-log-userspace-fix-incorrect-luid-cast-in-userspace_ctr.patch b/review-2.6.31/dm-log-userspace-fix-incorrect-luid-cast-in-userspace_ctr.patch similarity index 100% rename from queue-2.6.31/dm-log-userspace-fix-incorrect-luid-cast-in-userspace_ctr.patch rename to review-2.6.31/dm-log-userspace-fix-incorrect-luid-cast-in-userspace_ctr.patch diff --git a/queue-2.6.31/dm-snapshot-free-exception-store-on-init-failure.patch b/review-2.6.31/dm-snapshot-free-exception-store-on-init-failure.patch similarity index 100% rename from queue-2.6.31/dm-snapshot-free-exception-store-on-init-failure.patch rename to review-2.6.31/dm-snapshot-free-exception-store-on-init-failure.patch diff --git a/queue-2.6.31/dm-snapshot-lock-snapshot-while-supplying-status.patch b/review-2.6.31/dm-snapshot-lock-snapshot-while-supplying-status.patch similarity index 100% rename from queue-2.6.31/dm-snapshot-lock-snapshot-while-supplying-status.patch rename to review-2.6.31/dm-snapshot-lock-snapshot-while-supplying-status.patch diff --git a/queue-2.6.31/dm-snapshot-require-non-zero-chunk-size-by-end-of-ctr.patch b/review-2.6.31/dm-snapshot-require-non-zero-chunk-size-by-end-of-ctr.patch similarity index 100% rename from queue-2.6.31/dm-snapshot-require-non-zero-chunk-size-by-end-of-ctr.patch rename to review-2.6.31/dm-snapshot-require-non-zero-chunk-size-by-end-of-ctr.patch diff --git a/queue-2.6.31/dm-snapshot-sort-by-chunk-size-to-fix-race.patch b/review-2.6.31/dm-snapshot-sort-by-chunk-size-to-fix-race.patch similarity index 100% rename from queue-2.6.31/dm-snapshot-sort-by-chunk-size-to-fix-race.patch rename to review-2.6.31/dm-snapshot-sort-by-chunk-size-to-fix-race.patch diff --git a/queue-2.6.31/dm-snapshot-use-unsigned-integer-chunk-size.patch b/review-2.6.31/dm-snapshot-use-unsigned-integer-chunk-size.patch similarity index 100% rename from queue-2.6.31/dm-snapshot-use-unsigned-integer-chunk-size.patch rename to review-2.6.31/dm-snapshot-use-unsigned-integer-chunk-size.patch diff --git a/queue-2.6.31/do_mbind-fix-memory-leak.patch b/review-2.6.31/do_mbind-fix-memory-leak.patch similarity index 100% rename from queue-2.6.31/do_mbind-fix-memory-leak.patch rename to review-2.6.31/do_mbind-fix-memory-leak.patch diff --git a/queue-2.6.31/dpt_i2o-fix-typo-of-einval.patch b/review-2.6.31/dpt_i2o-fix-typo-of-einval.patch similarity index 100% rename from queue-2.6.31/dpt_i2o-fix-typo-of-einval.patch rename to review-2.6.31/dpt_i2o-fix-typo-of-einval.patch diff --git a/queue-2.6.31/dpt_i2o-fix-up-copy-user.patch b/review-2.6.31/dpt_i2o-fix-up-copy-user.patch similarity index 100% rename from queue-2.6.31/dpt_i2o-fix-up-copy-user.patch rename to review-2.6.31/dpt_i2o-fix-up-copy-user.patch diff --git a/queue-2.6.31/driver-core-fix-driver_register-return-value.patch b/review-2.6.31/driver-core-fix-driver_register-return-value.patch similarity index 100% rename from queue-2.6.31/driver-core-fix-driver_register-return-value.patch rename to review-2.6.31/driver-core-fix-driver_register-return-value.patch diff --git a/queue-2.6.31/drm-i915-add-b43-chipset-support.patch b/review-2.6.31/drm-i915-add-b43-chipset-support.patch similarity index 100% rename from queue-2.6.31/drm-i915-add-b43-chipset-support.patch rename to review-2.6.31/drm-i915-add-b43-chipset-support.patch diff --git a/queue-2.6.31/drm-i915-fix-fdi-m-n-setting-according-with-correct-color-depth.patch b/review-2.6.31/drm-i915-fix-fdi-m-n-setting-according-with-correct-color-depth.patch similarity index 100% rename from queue-2.6.31/drm-i915-fix-fdi-m-n-setting-according-with-correct-color-depth.patch rename to review-2.6.31/drm-i915-fix-fdi-m-n-setting-according-with-correct-color-depth.patch diff --git a/queue-2.6.31/drm-i915-fix-panel-fitting-filter-coefficient-select-for-ironlake.patch b/review-2.6.31/drm-i915-fix-panel-fitting-filter-coefficient-select-for-ironlake.patch similarity index 100% rename from queue-2.6.31/drm-i915-fix-panel-fitting-filter-coefficient-select-for-ironlake.patch rename to review-2.6.31/drm-i915-fix-panel-fitting-filter-coefficient-select-for-ironlake.patch diff --git a/queue-2.6.31/drm-i915-fix-to-setup-display-reference-clock-control-on-ironlake.patch b/review-2.6.31/drm-i915-fix-to-setup-display-reference-clock-control-on-ironlake.patch similarity index 100% rename from queue-2.6.31/drm-i915-fix-to-setup-display-reference-clock-control-on-ironlake.patch rename to review-2.6.31/drm-i915-fix-to-setup-display-reference-clock-control-on-ironlake.patch diff --git a/queue-2.6.31/fs-pipe.c-null-pointer-dereference.patch b/review-2.6.31/fs-pipe.c-null-pointer-dereference.patch similarity index 100% rename from queue-2.6.31/fs-pipe.c-null-pointer-dereference.patch rename to review-2.6.31/fs-pipe.c-null-pointer-dereference.patch diff --git a/queue-2.6.31/fsnotify-do-not-set-group-for-a-mark-before-it-is-on-the-i_list.patch b/review-2.6.31/fsnotify-do-not-set-group-for-a-mark-before-it-is-on-the-i_list.patch similarity index 100% rename from queue-2.6.31/fsnotify-do-not-set-group-for-a-mark-before-it-is-on-the-i_list.patch rename to review-2.6.31/fsnotify-do-not-set-group-for-a-mark-before-it-is-on-the-i_list.patch diff --git a/queue-2.6.31/fuse-fix-kunmap-in-fuse_ioctl_copy_user.patch b/review-2.6.31/fuse-fix-kunmap-in-fuse_ioctl_copy_user.patch similarity index 100% rename from queue-2.6.31/fuse-fix-kunmap-in-fuse_ioctl_copy_user.patch rename to review-2.6.31/fuse-fix-kunmap-in-fuse_ioctl_copy_user.patch diff --git a/queue-2.6.31/fuse-prevent-fuse_put_request-on-invalid-pointer.patch b/review-2.6.31/fuse-prevent-fuse_put_request-on-invalid-pointer.patch similarity index 100% rename from queue-2.6.31/fuse-prevent-fuse_put_request-on-invalid-pointer.patch rename to review-2.6.31/fuse-prevent-fuse_put_request-on-invalid-pointer.patch diff --git a/queue-2.6.31/futex-check-for-null-keys-in-match_futex.patch b/review-2.6.31/futex-check-for-null-keys-in-match_futex.patch similarity index 100% rename from queue-2.6.31/futex-check-for-null-keys-in-match_futex.patch rename to review-2.6.31/futex-check-for-null-keys-in-match_futex.patch diff --git a/queue-2.6.31/futex-fix-spurious-wakeup-for-requeue_pi-really.patch b/review-2.6.31/futex-fix-spurious-wakeup-for-requeue_pi-really.patch similarity index 100% rename from queue-2.6.31/futex-fix-spurious-wakeup-for-requeue_pi-really.patch rename to review-2.6.31/futex-fix-spurious-wakeup-for-requeue_pi-really.patch diff --git a/queue-2.6.31/futex-handle-spurious-wake-up.patch b/review-2.6.31/futex-handle-spurious-wake-up.patch similarity index 100% rename from queue-2.6.31/futex-handle-spurious-wake-up.patch rename to review-2.6.31/futex-handle-spurious-wake-up.patch diff --git a/queue-2.6.31/futex-move-drop_futex_key_refs-out-of-spinlock-ed-region.patch b/review-2.6.31/futex-move-drop_futex_key_refs-out-of-spinlock-ed-region.patch similarity index 100% rename from queue-2.6.31/futex-move-drop_futex_key_refs-out-of-spinlock-ed-region.patch rename to review-2.6.31/futex-move-drop_futex_key_refs-out-of-spinlock-ed-region.patch diff --git a/queue-2.6.31/hfsplus-refuse-to-mount-volumes-larger-than-2tb.patch b/review-2.6.31/hfsplus-refuse-to-mount-volumes-larger-than-2tb.patch similarity index 100% rename from queue-2.6.31/hfsplus-refuse-to-mount-volumes-larger-than-2tb.patch rename to review-2.6.31/hfsplus-refuse-to-mount-volumes-larger-than-2tb.patch diff --git a/queue-2.6.31/hwmon-it87-fix-vid-reading-on-it8718f-it8720f.patch b/review-2.6.31/hwmon-it87-fix-vid-reading-on-it8718f-it8720f.patch similarity index 100% rename from queue-2.6.31/hwmon-it87-fix-vid-reading-on-it8718f-it8720f.patch rename to review-2.6.31/hwmon-it87-fix-vid-reading-on-it8718f-it8720f.patch diff --git a/queue-2.6.31/input-synaptics-add-another-protege-m300-to-rate-blacklist.patch b/review-2.6.31/input-synaptics-add-another-protege-m300-to-rate-blacklist.patch similarity index 100% rename from queue-2.6.31/input-synaptics-add-another-protege-m300-to-rate-blacklist.patch rename to review-2.6.31/input-synaptics-add-another-protege-m300-to-rate-blacklist.patch diff --git a/queue-2.6.31/iwlwifi-fix-potential-rx-buffer-loss.patch b/review-2.6.31/iwlwifi-fix-potential-rx-buffer-loss.patch similarity index 100% rename from queue-2.6.31/iwlwifi-fix-potential-rx-buffer-loss.patch rename to review-2.6.31/iwlwifi-fix-potential-rx-buffer-loss.patch diff --git a/queue-2.6.31/iwlwifi-reduce-noise-when-skb-allocation-fails.patch b/review-2.6.31/iwlwifi-reduce-noise-when-skb-allocation-fails.patch similarity index 100% rename from queue-2.6.31/iwlwifi-reduce-noise-when-skb-allocation-fails.patch rename to review-2.6.31/iwlwifi-reduce-noise-when-skb-allocation-fails.patch diff --git a/queue-2.6.31/keys-get_instantiation_keyring-should-inc-the-keyring-refcount-in-all-cases.patch b/review-2.6.31/keys-get_instantiation_keyring-should-inc-the-keyring-refcount-in-all-cases.patch similarity index 100% rename from queue-2.6.31/keys-get_instantiation_keyring-should-inc-the-keyring-refcount-in-all-cases.patch rename to review-2.6.31/keys-get_instantiation_keyring-should-inc-the-keyring-refcount-in-all-cases.patch diff --git a/queue-2.6.31/kvm-get_tss_base_addr-should-return-a-gpa_t.patch b/review-2.6.31/kvm-get_tss_base_addr-should-return-a-gpa_t.patch similarity index 100% rename from queue-2.6.31/kvm-get_tss_base_addr-should-return-a-gpa_t.patch rename to review-2.6.31/kvm-get_tss_base_addr-should-return-a-gpa_t.patch diff --git a/queue-2.6.31/kvm-ignore-reads-from-amds-c1e-enabled-msr.patch b/review-2.6.31/kvm-ignore-reads-from-amds-c1e-enabled-msr.patch similarity index 100% rename from queue-2.6.31/kvm-ignore-reads-from-amds-c1e-enabled-msr.patch rename to review-2.6.31/kvm-ignore-reads-from-amds-c1e-enabled-msr.patch diff --git a/queue-2.6.31/kvm-prevent-kvm_init-from-corrupting-debugfs-structures.patch b/review-2.6.31/kvm-prevent-kvm_init-from-corrupting-debugfs-structures.patch similarity index 100% rename from queue-2.6.31/kvm-prevent-kvm_init-from-corrupting-debugfs-structures.patch rename to review-2.6.31/kvm-prevent-kvm_init-from-corrupting-debugfs-structures.patch diff --git a/queue-2.6.31/kvm-use-proper-hrtimer-function-to-retrieve-expiration-time.patch b/review-2.6.31/kvm-use-proper-hrtimer-function-to-retrieve-expiration-time.patch similarity index 100% rename from queue-2.6.31/kvm-use-proper-hrtimer-function-to-retrieve-expiration-time.patch rename to review-2.6.31/kvm-use-proper-hrtimer-function-to-retrieve-expiration-time.patch diff --git a/queue-2.6.31/libata-fix-internal-command-failure-handling.patch b/review-2.6.31/libata-fix-internal-command-failure-handling.patch similarity index 100% rename from queue-2.6.31/libata-fix-internal-command-failure-handling.patch rename to review-2.6.31/libata-fix-internal-command-failure-handling.patch diff --git a/queue-2.6.31/libata-fix-pmp-initialization.patch b/review-2.6.31/libata-fix-pmp-initialization.patch similarity index 100% rename from queue-2.6.31/libata-fix-pmp-initialization.patch rename to review-2.6.31/libata-fix-pmp-initialization.patch diff --git a/queue-2.6.31/libertas-if_usb-fix-crash-on-64-bit-machines.patch b/review-2.6.31/libertas-if_usb-fix-crash-on-64-bit-machines.patch similarity index 100% rename from queue-2.6.31/libertas-if_usb-fix-crash-on-64-bit-machines.patch rename to review-2.6.31/libertas-if_usb-fix-crash-on-64-bit-machines.patch diff --git a/queue-2.6.31/mac80211-check-interface-is-down-before-type-change.patch b/review-2.6.31/mac80211-check-interface-is-down-before-type-change.patch similarity index 100% rename from queue-2.6.31/mac80211-check-interface-is-down-before-type-change.patch rename to review-2.6.31/mac80211-check-interface-is-down-before-type-change.patch diff --git a/queue-2.6.31/mac80211-fix-for-incorrect-sequence-number-on-hostapd-injected-frames.patch b/review-2.6.31/mac80211-fix-for-incorrect-sequence-number-on-hostapd-injected-frames.patch similarity index 100% rename from queue-2.6.31/mac80211-fix-for-incorrect-sequence-number-on-hostapd-injected-frames.patch rename to review-2.6.31/mac80211-fix-for-incorrect-sequence-number-on-hostapd-injected-frames.patch diff --git a/queue-2.6.31/mbind-fix-leak-of-never-putback-pages.patch b/review-2.6.31/mbind-fix-leak-of-never-putback-pages.patch similarity index 100% rename from queue-2.6.31/mbind-fix-leak-of-never-putback-pages.patch rename to review-2.6.31/mbind-fix-leak-of-never-putback-pages.patch diff --git a/review-2.6.31/mbox b/review-2.6.31/mbox new file mode 100644 index 00000000000..f3d57a06074 --- /dev/null +++ b/review-2.6.31/mbox @@ -0,0 +1,8415 @@ +From gregkh@mini.kroah.org Fri Nov 6 14:15:38 2009 +Message-Id: <20091106221538.846686350@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 06 Nov 2009 14:13:59 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Earl Chew +Subject: [01/99] fs: pipe.c null pointer dereference +References: <20091106221358.309857998@mini.kroah.org> +Content-Disposition: inline; filename=fs-pipe.c-null-pointer-dereference.patch +Content-Length: 3550 +Lines: 131 + + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Earl Chew + +commit ad3960243e55320d74195fb85c975e0a8cc4466c upstream. + +This patch fixes a null pointer exception in pipe_rdwr_open() which +generates the stack trace: + +> Unable to handle kernel NULL pointer dereference at 0000000000000028 RIP: +> [] pipe_rdwr_open+0x35/0x70 +> [] __dentry_open+0x13c/0x230 +> [] do_filp_open+0x2d/0x40 +> [] do_sys_open+0x5a/0x100 +> [] sysenter_do_call+0x1b/0x67 + +The failure mode is triggered by an attempt to open an anonymous +pipe via /proc/pid/fd/* as exemplified by this script: + +============================================================= +while : ; do + { echo y ; sleep 1 ; } | { while read ; do echo z$REPLY; done ; } & + PID=$! + OUT=$(ps -efl | grep 'sleep 1' | grep -v grep | + { read PID REST ; echo $PID; } ) + OUT="${OUT%% *}" + DELAY=$((RANDOM * 1000 / 32768)) + usleep $((DELAY * 1000 + RANDOM % 1000 )) + echo n > /proc/$OUT/fd/1 # Trigger defect +done +============================================================= + +Note that the failure window is quite small and I could only +reliably reproduce the defect by inserting a small delay +in pipe_rdwr_open(). For example: + + static int + pipe_rdwr_open(struct inode *inode, struct file *filp) + { + msleep(100); + mutex_lock(&inode->i_mutex); + +Although the defect was observed in pipe_rdwr_open(), I think it +makes sense to replicate the change through all the pipe_*_open() +functions. + +The core of the change is to verify that inode->i_pipe has not +been released before attempting to manipulate it. If inode->i_pipe +is no longer present, return ENOENT to indicate so. + +The comment about potentially using atomic_t for i_pipe->readers +and i_pipe->writers has also been removed because it is no longer +relevant in this context. The inode->i_mutex lock must be used so +that inode->i_pipe can be dealt with correctly. + +Signed-off-by: Earl Chew +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + fs/pipe.c | 41 ++++++++++++++++++++++++++++++----------- + 1 file changed, 30 insertions(+), 11 deletions(-) + +--- a/fs/pipe.c ++++ b/fs/pipe.c +@@ -777,36 +777,55 @@ pipe_rdwr_release(struct inode *inode, s + static int + pipe_read_open(struct inode *inode, struct file *filp) + { +- /* We could have perhaps used atomic_t, but this and friends +- below are the only places. So it doesn't seem worthwhile. */ ++ int ret = -ENOENT; ++ + mutex_lock(&inode->i_mutex); +- inode->i_pipe->readers++; ++ ++ if (inode->i_pipe) { ++ ret = 0; ++ inode->i_pipe->readers++; ++ } ++ + mutex_unlock(&inode->i_mutex); + +- return 0; ++ return ret; + } + + static int + pipe_write_open(struct inode *inode, struct file *filp) + { ++ int ret = -ENOENT; ++ + mutex_lock(&inode->i_mutex); +- inode->i_pipe->writers++; ++ ++ if (inode->i_pipe) { ++ ret = 0; ++ inode->i_pipe->writers++; ++ } ++ + mutex_unlock(&inode->i_mutex); + +- return 0; ++ return ret; + } + + static int + pipe_rdwr_open(struct inode *inode, struct file *filp) + { ++ int ret = -ENOENT; ++ + mutex_lock(&inode->i_mutex); +- if (filp->f_mode & FMODE_READ) +- inode->i_pipe->readers++; +- if (filp->f_mode & FMODE_WRITE) +- inode->i_pipe->writers++; ++ ++ if (inode->i_pipe) { ++ ret = 0; ++ if (filp->f_mode & FMODE_READ) ++ inode->i_pipe->readers++; ++ if (filp->f_mode & FMODE_WRITE) ++ inode->i_pipe->writers++; ++ } ++ + mutex_unlock(&inode->i_mutex); + +- return 0; ++ return ret; + } + + /* + + +From gregkh@mini.kroah.org Fri Nov 6 14:15:39 2009 +Message-Id: <20091106221538.993410171@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 06 Nov 2009 14:14:00 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Yinghai Lu +Subject: [02/99] pci: increase alignment to make more space for hidden code +References: <20091106221358.309857998@mini.kroah.org> +Content-Disposition: inline; filename=pci-increase-alignment-to-make-more-space-for-hidden-code.patch +Content-Length: 1019 +Lines: 36 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Yinghai Lu + +commit 15b812f1d0a5ca8f5efe7f5882f468af10682ca8 upstream. + +As reported in + + http://bugzilla.kernel.org/show_bug.cgi?id=13940 + +on some system when acpi are enabled, acpi clears some BAR for some +devices without reason, and kernel will need to allocate devices for +them. It then apparently hits some undocumented resource conflict, +resulting in non-working devices. + +Try to increase alignment to get more safe range for unassigned devices. + +Signed-off-by: Yinghai Lu +Signed-off-by: Linus Torvalds + +--- + arch/x86/kernel/e820.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/x86/kernel/e820.c ++++ b/arch/x86/kernel/e820.c +@@ -1378,8 +1378,8 @@ static unsigned long ram_alignment(resou + if (mb < 16) + return 1024*1024; + +- /* To 32MB for anything above that */ +- return 32*1024*1024; ++ /* To 64MB for anything above that */ ++ return 64*1024*1024; + } + + #define MAX_RESOURCE_SIZE ((resource_size_t)-1) + + +From gregkh@mini.kroah.org Fri Nov 6 14:15:39 2009 +Message-Id: <20091106221539.132843823@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 06 Nov 2009 14:14:01 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Tejun Heo , + Jeff Garzik +Subject: [03/99] libata: fix internal command failure handling +References: <20091106221358.309857998@mini.kroah.org> +Content-Disposition: inline; filename=libata-fix-internal-command-failure-handling.patch +Content-Length: 1544 +Lines: 47 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Tejun Heo + +commit f4b31db92d163df8a639f5a8c8633bdeb6e8432d upstream. + +When an internal command fails, it should be failed directly without +invoking EH. In the original implemetation, this was accomplished by +letting internal command bypass failure handling in ata_qc_complete(). +However, later changes added post-successful-completion handling to +that code path and the success path is no longer adequate as internal +command failure path. One of the visible problems is that internal +command failure due to timeout or other freeze conditions would +spuriously trigger WARN_ON_ONCE() in the success path. + +This patch updates failure path such that internal command failure +handling is contained there. + +Signed-off-by: Tejun Heo +Signed-off-by: Jeff Garzik +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ata/libata-core.c | 12 +++++++----- + 1 file changed, 7 insertions(+), 5 deletions(-) + +--- a/drivers/ata/libata-core.c ++++ b/drivers/ata/libata-core.c +@@ -5008,12 +5008,14 @@ void ata_qc_complete(struct ata_queued_c + qc->flags |= ATA_QCFLAG_FAILED; + + if (unlikely(qc->flags & ATA_QCFLAG_FAILED)) { +- if (!ata_tag_internal(qc->tag)) { +- /* always fill result TF for failed qc */ +- fill_result_tf(qc); ++ /* always fill result TF for failed qc */ ++ fill_result_tf(qc); ++ ++ if (!ata_tag_internal(qc->tag)) + ata_qc_schedule_eh(qc); +- return; +- } ++ else ++ __ata_qc_complete(qc); ++ return; + } + + /* read result TF if requested */ + + +From gregkh@mini.kroah.org Fri Nov 6 14:15:39 2009 +Message-Id: <20091106221539.257589628@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 06 Nov 2009 14:14:02 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Tejun Heo , + Jeff Garzik +Subject: [04/99] libata: fix PMP initialization +References: <20091106221358.309857998@mini.kroah.org> +Content-Disposition: inline; filename=libata-fix-pmp-initialization.patch +Content-Length: 1737 +Lines: 49 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Tejun Heo + +commit 4f7c2874995ac48a4622755b8bd159eb2fb6d8f4 upstream. + +Commit 842faa6c1a1d6faddf3377948e5cf214812c6c90 fixed error handling +during attach by not committing detected device class to dev->class +while attaching a new device. However, this change missed the PMP +class check in the configuration loop causing a new PMP device to go +through ata_dev_configure() as if it were an ATA or ATAPI device. + +As PMP device doesn't have a regular IDENTIFY data, this makes +ata_dev_configure() tries to configure a PMP device using an invalid +data. For the most part, it wasn't too harmful and went unnoticed but +this ends up clearing dev->flags which may have ATA_DFLAG_AN set by +sata_pmp_attach(). This means that SATA_PMP_FEAT_NOTIFY ends up being +disabled on PMPs and on PMPs which honor the flag breaks hotplug +support. + +This problem was discovered and reported by Ethan Hsiao. + +Signed-off-by: Tejun Heo +Reported-by: Ethan Hsiao +Signed-off-by: Jeff Garzik +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ata/libata-eh.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/ata/libata-eh.c ++++ b/drivers/ata/libata-eh.c +@@ -2849,12 +2849,14 @@ static int ata_eh_revalidate_and_attach( + * device detection messages backwards. + */ + ata_for_each_dev(dev, link, ALL) { +- if (!(new_mask & (1 << dev->devno)) || +- dev->class == ATA_DEV_PMP) ++ if (!(new_mask & (1 << dev->devno))) + continue; + + dev->class = ehc->classes[dev->devno]; + ++ if (dev->class == ATA_DEV_PMP) ++ continue; ++ + ehc->i.flags |= ATA_EHI_PRINTINFO; + rc = ata_dev_configure(dev); + ehc->i.flags &= ~ATA_EHI_PRINTINFO; + + +From gregkh@mini.kroah.org Fri Nov 6 14:15:39 2009 +Message-Id: <20091106221539.385182515@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 06 Nov 2009 14:14:03 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Tejun Heo , + Jeff Garzik +Subject: [05/99] sata_nv: make sure link is brough up online when skipping hardreset +References: <20091106221358.309857998@mini.kroah.org> +Content-Disposition: inline; filename=sata_nv-make-sure-link-is-brough-up-online-when-skipping-hardreset.patch +Content-Length: 1778 +Lines: 52 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Tejun Heo + +commit 6489e3262e6b188a1a009b65e8a94b7aa17645b7 upstream. + +prereset doesn't bring link online if hardreset is about to happen and +nv_hardreset() may skip if conditions are not right so softreset may +be entered with non-working link status if the system firmware didn't +bring it up before entering OS code which can happen during resume. +This patch makes nv_hardreset() to bring up the link if it's skipping +reset. + +This bug was reported by frodone@gmail.com in the following bug entry. + + http://bugzilla.kernel.org/show_bug.cgi?id=14329 + +Signed-off-by: Tejun Heo +Reported-by: frodone@gmail.com +Signed-off-by: Jeff Garzik +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ata/sata_nv.c | 18 +++++++++++++++--- + 1 file changed, 15 insertions(+), 3 deletions(-) + +--- a/drivers/ata/sata_nv.c ++++ b/drivers/ata/sata_nv.c +@@ -1594,9 +1594,21 @@ static int nv_hardreset(struct ata_link + !ata_dev_enabled(link->device)) + sata_link_hardreset(link, sata_deb_timing_hotplug, deadline, + NULL, NULL); +- else if (!(ehc->i.flags & ATA_EHI_QUIET)) +- ata_link_printk(link, KERN_INFO, +- "nv: skipping hardreset on occupied port\n"); ++ else { ++ const unsigned long *timing = sata_ehc_deb_timing(ehc); ++ int rc; ++ ++ if (!(ehc->i.flags & ATA_EHI_QUIET)) ++ ata_link_printk(link, KERN_INFO, "nv: skipping " ++ "hardreset on occupied port\n"); ++ ++ /* make sure the link is online */ ++ rc = sata_link_resume(link, timing, deadline); ++ /* whine about phy resume failure but proceed */ ++ if (rc && rc != -EOPNOTSUPP) ++ ata_link_printk(link, KERN_WARNING, "failed to resume " ++ "link (errno=%d)\n", rc); ++ } + + /* device signature acquisition is unreliable */ + return -EAGAIN; + + +From gregkh@mini.kroah.org Fri Nov 6 14:15:39 2009 +Message-Id: <20091106221539.517497730@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 06 Nov 2009 14:14:04 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Ingo Molnar , + Trond Myklebust +Subject: [06/99] nfs: Fix nfs_parse_mount_options() kfree() leak +References: <20091106221358.309857998@mini.kroah.org> +Content-Disposition: inline; filename=nfs-fix-nfs_parse_mount_options-kfree-leak.patch +Content-Length: 920 +Lines: 32 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Yinghai Lu + +commit 4223a4a155f245d41c350ed9eba4fc32e965c4da upstream. + +Fix a (small) memory leak in one of the error paths of the NFS mount +options parsing code. + +Regression introduced in 2.6.30 by commit a67d18f (NFS: load the +rpc/rdma transport module automatically). + +Reported-by: Yinghai Lu +Reported-by: Pekka Enberg +Signed-off-by: Ingo Molnar +Signed-off-by: Trond Myklebust +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + fs/nfs/super.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/fs/nfs/super.c ++++ b/fs/nfs/super.c +@@ -1323,6 +1323,7 @@ static int nfs_parse_mount_options(char + default: + dfprintk(MOUNT, "NFS: unrecognized " + "transport protocol\n"); ++ kfree(string); + return 0; + } + break; + + +From gregkh@mini.kroah.org Fri Nov 6 14:15:39 2009 +Message-Id: <20091106221539.652424942@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 06 Nov 2009 14:14:05 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Marcelo Tosatti , + Avi Kivity +Subject: [07/99] KVM: use proper hrtimer function to retrieve expiration time +References: <20091106221358.309857998@mini.kroah.org> +Content-Disposition: inline; filename=kvm-use-proper-hrtimer-function-to-retrieve-expiration-time.patch +Content-Length: 1339 +Lines: 41 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Marcelo Tosatti + +commit ace1546487a0fe4634e3251067f8a32cb2cdc099 upstream. + +hrtimer->base can be temporarily NULL due to racing hrtimer_start. +See switch_hrtimer_base/lock_hrtimer_base. + +Use hrtimer_get_remaining which is robust against it. + +Signed-off-by: Marcelo Tosatti +Signed-off-by: Avi Kivity +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kvm/i8254.c | 2 +- + arch/x86/kvm/lapic.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/x86/kvm/i8254.c ++++ b/arch/x86/kvm/i8254.c +@@ -116,7 +116,7 @@ static s64 __kpit_elapsed(struct kvm *kv + * itself with the initial count and continues counting + * from there. + */ +- remaining = hrtimer_expires_remaining(&ps->pit_timer.timer); ++ remaining = hrtimer_get_remaining(&ps->pit_timer.timer); + elapsed = ps->pit_timer.period - ktime_to_ns(remaining); + elapsed = mod_64(elapsed, ps->pit_timer.period); + +--- a/arch/x86/kvm/lapic.c ++++ b/arch/x86/kvm/lapic.c +@@ -464,7 +464,7 @@ static u32 apic_get_tmcct(struct kvm_lap + if (apic_get_reg(apic, APIC_TMICT) == 0) + return 0; + +- remaining = hrtimer_expires_remaining(&apic->lapic_timer.timer); ++ remaining = hrtimer_get_remaining(&apic->lapic_timer.timer); + if (ktime_to_ns(remaining) < 0) + remaining = ktime_set(0, 0); + + + +From gregkh@mini.kroah.org Fri Nov 6 14:15:39 2009 +Message-Id: <20091106221539.777616263@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 06 Nov 2009 14:14:06 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Andre Przywara , + Avi Kivity +Subject: [08/99] KVM: ignore reads from AMDs C1E enabled MSR +References: <20091106221358.309857998@mini.kroah.org> +Content-Disposition: inline; filename=kvm-ignore-reads-from-amds-c1e-enabled-msr.patch +Content-Length: 845 +Lines: 28 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Andre Przywara + +commit 1fdbd48c242db996107f72ae4140ffe8163e26a8 upstream. + +If the Linux kernel detects an C1E capable AMD processor (K8 RevF and +higher), it will access a certain MSR on every attempt to go to halt. +Explicitly handle this read and return 0 to let KVM run a Linux guest +with the native AMD host CPU propagated to the guest. + +Signed-off-by: Andre Przywara +Signed-off-by: Avi Kivity +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kvm/x86.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/arch/x86/kvm/x86.c ++++ b/arch/x86/kvm/x86.c +@@ -949,6 +949,7 @@ int kvm_get_msr_common(struct kvm_vcpu * + case MSR_P6_EVNTSEL0: + case MSR_P6_EVNTSEL1: + case MSR_K7_EVNTSEL0: ++ case MSR_K8_INT_PENDING_MSG: + data = 0; + break; + case MSR_MTRRcap: + + +From gregkh@mini.kroah.org Fri Nov 6 14:15:40 2009 +Message-Id: <20091106221539.906129663@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 06 Nov 2009 14:14:07 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Thomas Gleixner , + Peter Zijlstra +Subject: [09/99] futex: Handle spurious wake up +References: <20091106221358.309857998@mini.kroah.org> +Content-Disposition: inline; filename=futex-handle-spurious-wake-up.patch +Content-Length: 2703 +Lines: 90 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Thomas Gleixner + +commit d58e6576b0deec6f0b9ff8450fe282da18c50883 upstream. + +The futex code does not handle spurious wake up in futex_wait and +futex_wait_requeue_pi. + +The code assumes that any wake up which was not caused by futex_wake / +requeue or by a timeout was caused by a signal wake up and returns one +of the syscall restart error codes. + +In case of a spurious wake up the signal delivery code which deals +with the restart error codes is not invoked and we return that error +code to user space. That causes applications which actually check the +return codes to fail. Blaise reported that on preempt-rt a python test +program run into a exception trap. -rt exposed that due to a built in +spurious wake up accelerator :) + +Solve this by checking signal_pending(current) in the wake up path and +handle the spurious wake up case w/o returning to user space. + +Reported-by: Blaise Gassend +Debugged-by: Darren Hart +Signed-off-by: Thomas Gleixner +Cc: Peter Zijlstra +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/futex.c | 18 +++++++++++++++--- + 1 file changed, 15 insertions(+), 3 deletions(-) + +--- a/kernel/futex.c ++++ b/kernel/futex.c +@@ -1767,6 +1767,7 @@ static int futex_wait(u32 __user *uaddr, + current->timer_slack_ns); + } + ++retry: + /* Prepare to wait on uaddr. */ + ret = futex_wait_setup(uaddr, val, fshared, &q, &hb); + if (ret) +@@ -1784,9 +1785,14 @@ static int futex_wait(u32 __user *uaddr, + goto out_put_key; + + /* +- * We expect signal_pending(current), but another thread may +- * have handled it for us already. ++ * We expect signal_pending(current), but we might be the ++ * victim of a spurious wakeup as well. + */ ++ if (!signal_pending(current)) { ++ put_futex_key(fshared, &q.key); ++ goto retry; ++ } ++ + ret = -ERESTARTSYS; + if (!abs_time) + goto out_put_key; +@@ -2094,9 +2100,11 @@ int handle_early_requeue_pi_wakeup(struc + */ + plist_del(&q->list, &q->list.plist); + ++ /* Handle spurious wakeups gracefully */ ++ ret = -EAGAIN; + if (timeout && !timeout->task) + ret = -ETIMEDOUT; +- else ++ else if (signal_pending(current)) + ret = -ERESTARTNOINTR; + } + return ret; +@@ -2174,6 +2182,7 @@ static int futex_wait_requeue_pi(u32 __u + debug_rt_mutex_init_waiter(&rt_waiter); + rt_waiter.task = NULL; + ++retry: + key2 = FUTEX_KEY_INIT; + ret = get_futex_key(uaddr2, fshared, &key2, VERIFY_WRITE); + if (unlikely(ret != 0)) +@@ -2271,6 +2280,9 @@ out_put_keys: + out_key2: + put_futex_key(fshared, &key2); + ++ /* Spurious wakeup ? */ ++ if (ret == -EAGAIN) ++ goto retry; + out: + if (to) { + hrtimer_cancel(&to->timer); + + +From gregkh@mini.kroah.org Fri Nov 6 14:15:40 2009 +Message-Id: <20091106221540.027407931@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 06 Nov 2009 14:14:08 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Darren Hart , + Peter Zijlstra , + Ingo Molnar , + Eric Dumazet , + Dinakar Guniguntala , + John Stultz , + Thomas Gleixner +Subject: [10/99] futex: Check for NULL keys in match_futex +References: <20091106221358.309857998@mini.kroah.org> +Content-Disposition: inline; filename=futex-check-for-null-keys-in-match_futex.patch +Content-Length: 1306 +Lines: 39 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Darren Hart + +commit 2bc872036e1c5948b5b02942810bbdd8dbdb9812 upstream. + +If userspace tries to perform a requeue_pi on a non-requeue_pi waiter, +it will find the futex_q->requeue_pi_key to be NULL and OOPS. + +Check for NULL in match_futex() instead of doing explicit NULL pointer +checks on all call sites. While match_futex(NULL, NULL) returning +false is a little odd, it's still correct as we expect valid key +references. + +Signed-off-by: Darren Hart +Cc: Peter Zijlstra +Cc: Ingo Molnar +CC: Eric Dumazet +CC: Dinakar Guniguntala +CC: John Stultz +LKML-Reference: <4AD60687.10306@us.ibm.com> +Signed-off-by: Thomas Gleixner +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/futex.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/kernel/futex.c ++++ b/kernel/futex.c +@@ -150,7 +150,8 @@ static struct futex_hash_bucket *hash_fu + */ + static inline int match_futex(union futex_key *key1, union futex_key *key2) + { +- return (key1->both.word == key2->both.word ++ return (key1 && key2 ++ && key1->both.word == key2->both.word + && key1->both.ptr == key2->both.ptr + && key1->both.offset == key2->both.offset); + } + + +From gregkh@mini.kroah.org Fri Nov 6 14:15:40 2009 +Message-Id: <20091106221540.169575447@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 06 Nov 2009 14:14:09 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Darren Hart , + Peter Zijlstra , + Eric Dumazet , + Dinakar Guniguntala , + John Stultz , + Sven-Thorsten Dietrich , + John Kacur , + Ingo Molnar +Subject: [11/99] futex: Move drop_futex_key_refs out of spinlocked region +References: <20091106221358.309857998@mini.kroah.org> +Content-Disposition: inline; filename=futex-move-drop_futex_key_refs-out-of-spinlock-ed-region.patch +Content-Length: 1752 +Lines: 58 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Darren Hart + +commit 89061d3d58e1f0742139605dc6a7950aa1ecc019 upstream. + +When requeuing tasks from one futex to another, the reference held +by the requeued task to the original futex location needs to be +dropped eventually. + +Dropping the reference may ultimately lead to a call to +"iput_final" and subsequently call into filesystem- specific code - +which may be non-atomic. + +It is therefore safer to defer this drop operation until after the +futex_hash_bucket spinlock has been dropped. + +Originally-From: Helge Bahmann +Signed-off-by: Darren Hart +Cc: Peter Zijlstra +Cc: Eric Dumazet +Cc: Dinakar Guniguntala +Cc: John Stultz +Cc: Sven-Thorsten Dietrich +Cc: John Kacur +LKML-Reference: <4AD7A298.5040802@us.ibm.com> +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/futex.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/kernel/futex.c ++++ b/kernel/futex.c +@@ -1028,7 +1028,6 @@ static inline + void requeue_pi_wake_futex(struct futex_q *q, union futex_key *key, + struct futex_hash_bucket *hb) + { +- drop_futex_key_refs(&q->key); + get_futex_key_refs(key); + q->key = *key; + +@@ -1226,6 +1225,7 @@ retry_private: + */ + if (ret == 1) { + WARN_ON(pi_state); ++ drop_count++; + task_count++; + ret = get_futex_value_locked(&curval2, uaddr2); + if (!ret) +@@ -1304,6 +1304,7 @@ retry_private: + if (ret == 1) { + /* We got the lock. */ + requeue_pi_wake_futex(this, &key2, hb2); ++ drop_count++; + continue; + } else if (ret) { + /* -EDEADLK */ + + +From gregkh@mini.kroah.org Fri Nov 6 14:15:40 2009 +Message-Id: <20091106221540.293515838@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 06 Nov 2009 14:14:10 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Darren Hart , + Peter Zijlstra , + Eric Dumazet , + John Stultz , + Dinakar Guniguntala , + Thomas Gleixner +Subject: [12/99] futex: Fix spurious wakeup for requeue_pi really +References: <20091106221358.309857998@mini.kroah.org> +Content-Disposition: inline; filename=futex-fix-spurious-wakeup-for-requeue_pi-really.patch +Content-Length: 2071 +Lines: 63 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Thomas Gleixner + +commit 11df6dddcbc38affb7473aad3d962baf8414a947 upstream. + +The requeue_pi path doesn't use unqueue_me() (and the racy lock_ptr == +NULL test) nor does it use the wake_list of futex_wake() which where +the reason for commit 41890f2 (futex: Handle spurious wake up) + +See debugging discussing on LKML Message-ID: <4AD4080C.20703@us.ibm.com> + +The changes in this fix to the wait_requeue_pi path were considered to +be a likely unecessary, but harmless safety net. But it turns out that +due to the fact that for unknown $@#!*( reasons EWOULDBLOCK is defined +as EAGAIN we built an endless loop in the code path which returns +correctly EWOULDBLOCK. + +Spurious wakeups in wait_requeue_pi code path are unlikely so we do +the easy solution and return EWOULDBLOCK^WEAGAIN to user space and let +it deal with the spurious wakeup. + +Cc: Darren Hart +Cc: Peter Zijlstra +Cc: Eric Dumazet +Cc: John Stultz +Cc: Dinakar Guniguntala +LKML-Reference: <4AE23C74.1090502@us.ibm.com> +Signed-off-by: Thomas Gleixner +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/futex.c | 6 +----- + 1 file changed, 1 insertion(+), 5 deletions(-) + +--- a/kernel/futex.c ++++ b/kernel/futex.c +@@ -2103,7 +2103,7 @@ int handle_early_requeue_pi_wakeup(struc + plist_del(&q->list, &q->list.plist); + + /* Handle spurious wakeups gracefully */ +- ret = -EAGAIN; ++ ret = -EWOULDBLOCK; + if (timeout && !timeout->task) + ret = -ETIMEDOUT; + else if (signal_pending(current)) +@@ -2184,7 +2184,6 @@ static int futex_wait_requeue_pi(u32 __u + debug_rt_mutex_init_waiter(&rt_waiter); + rt_waiter.task = NULL; + +-retry: + key2 = FUTEX_KEY_INIT; + ret = get_futex_key(uaddr2, fshared, &key2, VERIFY_WRITE); + if (unlikely(ret != 0)) +@@ -2282,9 +2281,6 @@ out_put_keys: + out_key2: + put_futex_key(fshared, &key2); + +- /* Spurious wakeup ? */ +- if (ret == -EAGAIN) +- goto retry; + out: + if (to) { + hrtimer_cancel(&to->timer); + + +From gregkh@mini.kroah.org Fri Nov 6 14:15:40 2009 +Message-Id: <20091106221540.421494604@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 06 Nov 2009 14:14:11 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Tejun Heo , + Chuck Ebbert +Subject: [13/99] ahci: revert "Restore SB600 sata controller 64 bit DMA" +References: <20091106221358.309857998@mini.kroah.org> +Content-Disposition: inline; filename=ahci-revert-restore-sb600-sata-controller-64-bit-dma.patch +Content-Length: 3117 +Lines: 101 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Chuck Ebbert + +revert commit 58a09b38cfcd700b796ea07ae3d2e0efbb28b561 +("[libata] ahci: Restore SB600 SATA controller 64 bit DMA") + +Upstream commit 58a09b38cfcd700b796ea07ae3d2e0efbb28b561 does +nearly the same thing but this patch is simplified for 2.6.31 + +Disables 64-bit DMA for _all_ boards, unlike 2.6.32 which adds a +whitelist. (The whitelist function requires a fairly large patch +that touches unrelated code.) + +Doesn't revert the DMI part as other backported patches might need +the exported symbol. + +Applies to 2.6.31.4 + +Signed-off-by: Chuck Ebbert +Acked-by: Tejun Heo +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ata/ahci.c | 52 ++-------------------------------------------------- + 1 file changed, 2 insertions(+), 50 deletions(-) + +--- a/drivers/ata/ahci.c ++++ b/drivers/ata/ahci.c +@@ -433,7 +433,8 @@ static const struct ata_port_info ahci_p + [board_ahci_sb600] = + { + AHCI_HFLAGS (AHCI_HFLAG_IGN_SERR_INTERNAL | +- AHCI_HFLAG_NO_MSI | AHCI_HFLAG_SECT255), ++ AHCI_HFLAG_32BIT_ONLY | AHCI_HFLAG_NO_MSI | ++ AHCI_HFLAG_SECT255), + .flags = AHCI_FLAG_COMMON, + .pio_mask = ATA_PIO4, + .udma_mask = ATA_UDMA6, +@@ -2602,51 +2603,6 @@ static void ahci_p5wdh_workaround(struct + } + } + +-/* +- * SB600 ahci controller on ASUS M2A-VM can't do 64bit DMA with older +- * BIOS. The oldest version known to be broken is 0901 and working is +- * 1501 which was released on 2007-10-26. Force 32bit DMA on anything +- * older than 1501. Please read bko#9412 for more info. +- */ +-static bool ahci_asus_m2a_vm_32bit_only(struct pci_dev *pdev) +-{ +- static const struct dmi_system_id sysids[] = { +- { +- .ident = "ASUS M2A-VM", +- .matches = { +- DMI_MATCH(DMI_BOARD_VENDOR, +- "ASUSTeK Computer INC."), +- DMI_MATCH(DMI_BOARD_NAME, "M2A-VM"), +- }, +- }, +- { } +- }; +- const char *cutoff_mmdd = "10/26"; +- const char *date; +- int year; +- +- if (pdev->bus->number != 0 || pdev->devfn != PCI_DEVFN(0x12, 0) || +- !dmi_check_system(sysids)) +- return false; +- +- /* +- * Argh.... both version and date are free form strings. +- * Let's hope they're using the same date format across +- * different versions. +- */ +- date = dmi_get_system_info(DMI_BIOS_DATE); +- year = dmi_get_year(DMI_BIOS_DATE); +- if (date && strlen(date) >= 10 && date[2] == '/' && date[5] == '/' && +- (year > 2007 || +- (year == 2007 && strncmp(date, cutoff_mmdd, 5) >= 0))) +- return false; +- +- dev_printk(KERN_WARNING, &pdev->dev, "ASUS M2A-VM: BIOS too old, " +- "forcing 32bit DMA, update BIOS\n"); +- +- return true; +-} +- + static bool ahci_broken_system_poweroff(struct pci_dev *pdev) + { + static const struct dmi_system_id broken_systems[] = { +@@ -2857,10 +2813,6 @@ static int ahci_init_one(struct pci_dev + if (board_id == board_ahci_sb700 && pdev->revision >= 0x40) + hpriv->flags &= ~AHCI_HFLAG_IGN_SERR_INTERNAL; + +- /* apply ASUS M2A_VM quirk */ +- if (ahci_asus_m2a_vm_32bit_only(pdev)) +- hpriv->flags |= AHCI_HFLAG_32BIT_ONLY; +- + if ((hpriv->flags & AHCI_HFLAG_NO_MSI) || pci_enable_msi(pdev)) + pci_intx(pdev, 1); + + + +From gregkh@mini.kroah.org Fri Nov 6 14:15:40 2009 +Message-Id: <20091106221540.545417553@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 06 Nov 2009 14:14:12 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + "David S. Miller" +Subject: [14/99] sparc64: Set IRQF_DISABLED on LDC channel IRQs. +References: <20091106221358.309857998@mini.kroah.org> +Content-Disposition: inline; filename=sparc64-set-irqf_disabled-on-ldc-channel-irqs.patch +Content-Length: 1043 +Lines: 34 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: David S. Miller + +[ Upstream commit c58543c869606532c2382f027d6466f4672ea756 ] + +With lots of virtual devices it's easy to generate a lot of +events and chew up the kernel IRQ stack. + +Reported-by: hyl +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + arch/sparc/kernel/ldc.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/sparc/kernel/ldc.c ++++ b/arch/sparc/kernel/ldc.c +@@ -1242,13 +1242,13 @@ int ldc_bind(struct ldc_channel *lp, con + snprintf(lp->tx_irq_name, LDC_IRQ_NAME_MAX, "%s TX", name); + + err = request_irq(lp->cfg.rx_irq, ldc_rx, +- IRQF_SAMPLE_RANDOM | IRQF_SHARED, ++ IRQF_SAMPLE_RANDOM | IRQF_DISABLED | IRQF_SHARED, + lp->rx_irq_name, lp); + if (err) + return err; + + err = request_irq(lp->cfg.tx_irq, ldc_tx, +- IRQF_SAMPLE_RANDOM | IRQF_SHARED, ++ IRQF_SAMPLE_RANDOM | IRQF_DISABLED | IRQF_SHARED, + lp->tx_irq_name, lp); + if (err) { + free_irq(lp->cfg.rx_irq, lp); + + +From gregkh@mini.kroah.org Fri Nov 6 14:15:40 2009 +Message-Id: <20091106221540.673374392@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 06 Nov 2009 14:14:13 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + "David S. Miller" +Subject: [15/99] sparc: Kill PROM console driver. +References: <20091106221358.309857998@mini.kroah.org> +Content-Disposition: inline; filename=sparc-kill-prom-console-driver.patch +Content-Length: 17191 +Lines: 752 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: David S. Miller + +[ Upstream commit 09d3f3f0e02c8a900d076c302c5c02227f33572d ] + +Many years ago when this driver was written, it had a use, but these +days it's nothing but trouble and distributions should not enable it +in any situation. + +Pretty much every console device a sparc machine could see has a +bonafide real driver, making the PROM console hack unnecessary. + +If any new device shows up, we should write a driver instead of +depending upon this crutch to save us. We've been able to take care +of this even when no chip documentation exists (sunxvr500, sunxvr2500) +so there are no excuses. + +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + Documentation/dontdiff | 1 + arch/sparc/kernel/setup_32.c | 2 + arch/sparc/kernel/setup_64.c | 2 + drivers/char/vt.c | 3 + drivers/video/console/.gitignore | 2 + drivers/video/console/Kconfig | 9 + drivers/video/console/Makefile | 12 + drivers/video/console/prom.uni | 11 + drivers/video/console/promcon.c | 598 --------------------------------------- + scripts/Makefile | 1 + 10 files changed, 1 insertion(+), 640 deletions(-) + +--- a/arch/sparc/kernel/setup_32.c ++++ b/arch/sparc/kernel/setup_32.c +@@ -263,8 +263,6 @@ void __init setup_arch(char **cmdline_p) + + #ifdef CONFIG_DUMMY_CONSOLE + conswitchp = &dummy_con; +-#elif defined(CONFIG_PROM_CONSOLE) +- conswitchp = &prom_con; + #endif + boot_flags_init(*cmdline_p); + +--- a/arch/sparc/kernel/setup_64.c ++++ b/arch/sparc/kernel/setup_64.c +@@ -295,8 +295,6 @@ void __init setup_arch(char **cmdline_p) + + #ifdef CONFIG_DUMMY_CONSOLE + conswitchp = &dummy_con; +-#elif defined(CONFIG_PROM_CONSOLE) +- conswitchp = &prom_con; + #endif + + idprom_init(); +--- a/Documentation/dontdiff ++++ b/Documentation/dontdiff +@@ -152,7 +152,6 @@ piggy.gz + piggyback + pnmtologo + ppc_defs.h* +-promcon_tbl.c + pss_boot.h + qconf + raid6altivec*.c +--- a/drivers/char/vt.c ++++ b/drivers/char/vt.c +@@ -2948,9 +2948,6 @@ int __init vty_init(const struct file_op + panic("Couldn't register console driver\n"); + kbd_init(); + console_map_init(); +-#ifdef CONFIG_PROM_CONSOLE +- prom_con_init(); +-#endif + #ifdef CONFIG_MDA_CONSOLE + mda_console_init(); + #endif +--- a/drivers/video/console/.gitignore ++++ /dev/null +@@ -1,2 +0,0 @@ +-# conmakehash generated file +-promcon_tbl.c +--- a/drivers/video/console/Kconfig ++++ b/drivers/video/console/Kconfig +@@ -67,16 +67,9 @@ config SGI_NEWPORT_CONSOLE + + # bool 'IODC console' CONFIG_IODC_CONSOLE + +-config PROM_CONSOLE +- bool "PROM console" +- depends on SPARC +- help +- Say Y to build a console driver for Sun machines that uses the +- terminal emulation built into their console PROMS. +- + config DUMMY_CONSOLE + bool +- depends on PROM_CONSOLE!=y || VGA_CONSOLE!=y || SGI_NEWPORT_CONSOLE!=y ++ depends on VGA_CONSOLE!=y || SGI_NEWPORT_CONSOLE!=y + default y + + config DUMMY_CONSOLE_COLUMNS +--- a/drivers/video/console/Makefile ++++ b/drivers/video/console/Makefile +@@ -22,7 +22,6 @@ font-objs += $(font-objs-y) + + obj-$(CONFIG_DUMMY_CONSOLE) += dummycon.o + obj-$(CONFIG_SGI_NEWPORT_CONSOLE) += newport_con.o font.o +-obj-$(CONFIG_PROM_CONSOLE) += promcon.o promcon_tbl.o + obj-$(CONFIG_STI_CONSOLE) += sticon.o sticore.o font.o + obj-$(CONFIG_VGA_CONSOLE) += vgacon.o + obj-$(CONFIG_MDA_CONSOLE) += mdacon.o +@@ -40,14 +39,3 @@ obj-$(CONFIG_FB_STI) += sti + ifeq ($(CONFIG_USB_SISUSBVGA_CON),y) + obj-$(CONFIG_USB_SISUSBVGA) += font.o + endif +- +-# Targets that kbuild needs to know about +-targets := promcon_tbl.c +- +-quiet_cmd_conmakehash = CNMKHSH $@ +- cmd_conmakehash = scripts/conmakehash $< | \ +- sed -e '/\#include <[^>]*>/p' -e 's/types/init/' \ +- -e 's/dfont\(_uni.*\]\)/promfont\1 /' > $@ +- +-$(obj)/promcon_tbl.c: $(src)/prom.uni +- $(call cmd,conmakehash) +--- a/drivers/video/console/promcon.c ++++ /dev/null +@@ -1,598 +0,0 @@ +-/* $Id: promcon.c,v 1.17 2000/07/26 23:02:52 davem Exp $ +- * Console driver utilizing PROM sun terminal emulation +- * +- * Copyright (C) 1998 Eddie C. Dost (ecd@skynet.be) +- * Copyright (C) 1998 Jakub Jelinek (jj@ultra.linux.cz) +- */ +- +-#include +-#include +-#include +-#include +-#include +-#include +-#include +-#include +-#include +-#include +-#include +-#include +-#include +- +-#include +-#include +- +-static short pw = 80 - 1, ph = 34 - 1; +-static short px, py; +-static unsigned long promcon_uni_pagedir[2]; +- +-extern u8 promfont_unicount[]; +-extern u16 promfont_unitable[]; +- +-#define PROMCON_COLOR 0 +- +-#if PROMCON_COLOR +-#define inverted(s) ((((s) & 0x7700) == 0x0700) ? 0 : 1) +-#else +-#define inverted(s) (((s) & 0x0800) ? 1 : 0) +-#endif +- +-static __inline__ void +-promcon_puts(char *buf, int cnt) +-{ +- prom_printf("%*.*s", cnt, cnt, buf); +-} +- +-static int +-promcon_start(struct vc_data *conp, char *b) +-{ +- unsigned short *s = (unsigned short *) +- (conp->vc_origin + py * conp->vc_size_row + (px << 1)); +- u16 cs; +- +- cs = scr_readw(s); +- if (px == pw) { +- unsigned short *t = s - 1; +- u16 ct = scr_readw(t); +- +- if (inverted(cs) && inverted(ct)) +- return sprintf(b, "\b\033[7m%c\b\033[@%c\033[m", cs, +- ct); +- else if (inverted(cs)) +- return sprintf(b, "\b\033[7m%c\033[m\b\033[@%c", cs, +- ct); +- else if (inverted(ct)) +- return sprintf(b, "\b%c\b\033[@\033[7m%c\033[m", cs, +- ct); +- else +- return sprintf(b, "\b%c\b\033[@%c", cs, ct); +- } +- +- if (inverted(cs)) +- return sprintf(b, "\033[7m%c\033[m\b", cs); +- else +- return sprintf(b, "%c\b", cs); +-} +- +-static int +-promcon_end(struct vc_data *conp, char *b) +-{ +- unsigned short *s = (unsigned short *) +- (conp->vc_origin + py * conp->vc_size_row + (px << 1)); +- char *p = b; +- u16 cs; +- +- b += sprintf(b, "\033[%d;%dH", py + 1, px + 1); +- +- cs = scr_readw(s); +- if (px == pw) { +- unsigned short *t = s - 1; +- u16 ct = scr_readw(t); +- +- if (inverted(cs) && inverted(ct)) +- b += sprintf(b, "\b%c\b\033[@\033[7m%c\033[m", cs, ct); +- else if (inverted(cs)) +- b += sprintf(b, "\b%c\b\033[@%c", cs, ct); +- else if (inverted(ct)) +- b += sprintf(b, "\b\033[7m%c\b\033[@%c\033[m", cs, ct); +- else +- b += sprintf(b, "\b\033[7m%c\033[m\b\033[@%c", cs, ct); +- return b - p; +- } +- +- if (inverted(cs)) +- b += sprintf(b, "%c\b", cs); +- else +- b += sprintf(b, "\033[7m%c\033[m\b", cs); +- return b - p; +-} +- +-const char *promcon_startup(void) +-{ +- const char *display_desc = "PROM"; +- int node; +- char buf[40]; +- +- node = prom_getchild(prom_root_node); +- node = prom_searchsiblings(node, "options"); +- if (prom_getproperty(node, "screen-#columns", buf, 40) != -1) { +- pw = simple_strtoul(buf, NULL, 0); +- if (pw < 10 || pw > 256) +- pw = 80; +- pw--; +- } +- if (prom_getproperty(node, "screen-#rows", buf, 40) != -1) { +- ph = simple_strtoul(buf, NULL, 0); +- if (ph < 10 || ph > 256) +- ph = 34; +- ph--; +- } +- promcon_puts("\033[H\033[J", 6); +- return display_desc; +-} +- +-static void +-promcon_init_unimap(struct vc_data *conp) +-{ +- mm_segment_t old_fs = get_fs(); +- struct unipair *p, *p1; +- u16 *q; +- int i, j, k; +- +- p = kmalloc(256*sizeof(struct unipair), GFP_KERNEL); +- if (!p) return; +- +- q = promfont_unitable; +- p1 = p; +- k = 0; +- for (i = 0; i < 256; i++) +- for (j = promfont_unicount[i]; j; j--) { +- p1->unicode = *q++; +- p1->fontpos = i; +- p1++; +- k++; +- } +- set_fs(KERNEL_DS); +- con_clear_unimap(conp, NULL); +- con_set_unimap(conp, k, p); +- con_protect_unimap(conp, 1); +- set_fs(old_fs); +- kfree(p); +-} +- +-static void +-promcon_init(struct vc_data *conp, int init) +-{ +- unsigned long p; +- +- conp->vc_can_do_color = PROMCON_COLOR; +- if (init) { +- conp->vc_cols = pw + 1; +- conp->vc_rows = ph + 1; +- } +- p = *conp->vc_uni_pagedir_loc; +- if (conp->vc_uni_pagedir_loc == &conp->vc_uni_pagedir || +- !--conp->vc_uni_pagedir_loc[1]) +- con_free_unimap(conp); +- conp->vc_uni_pagedir_loc = promcon_uni_pagedir; +- promcon_uni_pagedir[1]++; +- if (!promcon_uni_pagedir[0] && p) { +- promcon_init_unimap(conp); +- } +- if (!init) { +- if (conp->vc_cols != pw + 1 || conp->vc_rows != ph + 1) +- vc_resize(conp, pw + 1, ph + 1); +- } +-} +- +-static void +-promcon_deinit(struct vc_data *conp) +-{ +- /* When closing the last console, reset video origin */ +- if (!--promcon_uni_pagedir[1]) +- con_free_unimap(conp); +- conp->vc_uni_pagedir_loc = &conp->vc_uni_pagedir; +- con_set_default_unimap(conp); +-} +- +-static int +-promcon_switch(struct vc_data *conp) +-{ +- return 1; +-} +- +-static unsigned short * +-promcon_repaint_line(unsigned short *s, unsigned char *buf, unsigned char **bp) +-{ +- int cnt = pw + 1; +- int attr = -1; +- unsigned char *b = *bp; +- +- while (cnt--) { +- u16 c = scr_readw(s); +- if (attr != inverted(c)) { +- attr = inverted(c); +- if (attr) { +- strcpy (b, "\033[7m"); +- b += 4; +- } else { +- strcpy (b, "\033[m"); +- b += 3; +- } +- } +- *b++ = c; +- s++; +- if (b - buf >= 224) { +- promcon_puts(buf, b - buf); +- b = buf; +- } +- } +- *bp = b; +- return s; +-} +- +-static void +-promcon_putcs(struct vc_data *conp, const unsigned short *s, +- int count, int y, int x) +-{ +- unsigned char buf[256], *b = buf; +- unsigned short attr = scr_readw(s); +- unsigned char save; +- int i, last = 0; +- +- if (console_blanked) +- return; +- +- if (count <= 0) +- return; +- +- b += promcon_start(conp, b); +- +- if (x + count >= pw + 1) { +- if (count == 1) { +- x -= 1; +- save = scr_readw((unsigned short *)(conp->vc_origin +- + y * conp->vc_size_row +- + (x << 1))); +- +- if (px != x || py != y) { +- b += sprintf(b, "\033[%d;%dH", y + 1, x + 1); +- px = x; +- py = y; +- } +- +- if (inverted(attr)) +- b += sprintf(b, "\033[7m%c\033[m", scr_readw(s++)); +- else +- b += sprintf(b, "%c", scr_readw(s++)); +- +- strcpy(b, "\b\033[@"); +- b += 4; +- +- if (inverted(save)) +- b += sprintf(b, "\033[7m%c\033[m", save); +- else +- b += sprintf(b, "%c", save); +- +- px++; +- +- b += promcon_end(conp, b); +- promcon_puts(buf, b - buf); +- return; +- } else { +- last = 1; +- count = pw - x - 1; +- } +- } +- +- if (inverted(attr)) { +- strcpy(b, "\033[7m"); +- b += 4; +- } +- +- if (px != x || py != y) { +- b += sprintf(b, "\033[%d;%dH", y + 1, x + 1); +- px = x; +- py = y; +- } +- +- for (i = 0; i < count; i++) { +- if (b - buf >= 224) { +- promcon_puts(buf, b - buf); +- b = buf; +- } +- *b++ = scr_readw(s++); +- } +- +- px += count; +- +- if (last) { +- save = scr_readw(s++); +- b += sprintf(b, "%c\b\033[@%c", scr_readw(s++), save); +- px++; +- } +- +- if (inverted(attr)) { +- strcpy(b, "\033[m"); +- b += 3; +- } +- +- b += promcon_end(conp, b); +- promcon_puts(buf, b - buf); +-} +- +-static void +-promcon_putc(struct vc_data *conp, int c, int y, int x) +-{ +- unsigned short s; +- +- if (console_blanked) +- return; +- +- scr_writew(c, &s); +- promcon_putcs(conp, &s, 1, y, x); +-} +- +-static void +-promcon_clear(struct vc_data *conp, int sy, int sx, int height, int width) +-{ +- unsigned char buf[256], *b = buf; +- int i, j; +- +- if (console_blanked) +- return; +- +- b += promcon_start(conp, b); +- +- if (!sx && width == pw + 1) { +- +- if (!sy && height == ph + 1) { +- strcpy(b, "\033[H\033[J"); +- b += 6; +- b += promcon_end(conp, b); +- promcon_puts(buf, b - buf); +- return; +- } else if (sy + height == ph + 1) { +- b += sprintf(b, "\033[%dH\033[J", sy + 1); +- b += promcon_end(conp, b); +- promcon_puts(buf, b - buf); +- return; +- } +- +- b += sprintf(b, "\033[%dH", sy + 1); +- for (i = 1; i < height; i++) { +- strcpy(b, "\033[K\n"); +- b += 4; +- } +- +- strcpy(b, "\033[K"); +- b += 3; +- +- b += promcon_end(conp, b); +- promcon_puts(buf, b - buf); +- return; +- +- } else if (sx + width == pw + 1) { +- +- b += sprintf(b, "\033[%d;%dH", sy + 1, sx + 1); +- for (i = 1; i < height; i++) { +- strcpy(b, "\033[K\n"); +- b += 4; +- } +- +- strcpy(b, "\033[K"); +- b += 3; +- +- b += promcon_end(conp, b); +- promcon_puts(buf, b - buf); +- return; +- } +- +- for (i = sy + 1; i <= sy + height; i++) { +- b += sprintf(b, "\033[%d;%dH", i, sx + 1); +- for (j = 0; j < width; j++) +- *b++ = ' '; +- if (b - buf + width >= 224) { +- promcon_puts(buf, b - buf); +- b = buf; +- } +- } +- +- b += promcon_end(conp, b); +- promcon_puts(buf, b - buf); +-} +- +-static void +-promcon_bmove(struct vc_data *conp, int sy, int sx, int dy, int dx, +- int height, int width) +-{ +- char buf[256], *b = buf; +- +- if (console_blanked) +- return; +- +- b += promcon_start(conp, b); +- if (sy == dy && height == 1) { +- if (dx > sx && dx + width == conp->vc_cols) +- b += sprintf(b, "\033[%d;%dH\033[%d@\033[%d;%dH", +- sy + 1, sx + 1, dx - sx, py + 1, px + 1); +- else if (dx < sx && sx + width == conp->vc_cols) +- b += sprintf(b, "\033[%d;%dH\033[%dP\033[%d;%dH", +- dy + 1, dx + 1, sx - dx, py + 1, px + 1); +- +- b += promcon_end(conp, b); +- promcon_puts(buf, b - buf); +- return; +- } +- +- /* +- * FIXME: What to do here??? +- * Current console.c should not call it like that ever. +- */ +- prom_printf("\033[7mFIXME: bmove not handled\033[m\n"); +-} +- +-static void +-promcon_cursor(struct vc_data *conp, int mode) +-{ +- char buf[32], *b = buf; +- +- switch (mode) { +- case CM_ERASE: +- break; +- +- case CM_MOVE: +- case CM_DRAW: +- b += promcon_start(conp, b); +- if (px != conp->vc_x || py != conp->vc_y) { +- px = conp->vc_x; +- py = conp->vc_y; +- b += sprintf(b, "\033[%d;%dH", py + 1, px + 1); +- } +- promcon_puts(buf, b - buf); +- break; +- } +-} +- +-static int +-promcon_blank(struct vc_data *conp, int blank, int mode_switch) +-{ +- if (blank) { +- promcon_puts("\033[H\033[J\033[7m \033[m\b", 15); +- return 0; +- } else { +- /* Let console.c redraw */ +- return 1; +- } +-} +- +-static int +-promcon_scroll(struct vc_data *conp, int t, int b, int dir, int count) +-{ +- unsigned char buf[256], *p = buf; +- unsigned short *s; +- int i; +- +- if (console_blanked) +- return 0; +- +- p += promcon_start(conp, p); +- +- switch (dir) { +- case SM_UP: +- if (b == ph + 1) { +- p += sprintf(p, "\033[%dH\033[%dM", t + 1, count); +- px = 0; +- py = t; +- p += promcon_end(conp, p); +- promcon_puts(buf, p - buf); +- break; +- } +- +- s = (unsigned short *)(conp->vc_origin +- + (t + count) * conp->vc_size_row); +- +- p += sprintf(p, "\033[%dH", t + 1); +- +- for (i = t; i < b - count; i++) +- s = promcon_repaint_line(s, buf, &p); +- +- for (; i < b - 1; i++) { +- strcpy(p, "\033[K\n"); +- p += 4; +- if (p - buf >= 224) { +- promcon_puts(buf, p - buf); +- p = buf; +- } +- } +- +- strcpy(p, "\033[K"); +- p += 3; +- +- p += promcon_end(conp, p); +- promcon_puts(buf, p - buf); +- break; +- +- case SM_DOWN: +- if (b == ph + 1) { +- p += sprintf(p, "\033[%dH\033[%dL", t + 1, count); +- px = 0; +- py = t; +- p += promcon_end(conp, p); +- promcon_puts(buf, p - buf); +- break; +- } +- +- s = (unsigned short *)(conp->vc_origin + t * conp->vc_size_row); +- +- p += sprintf(p, "\033[%dH", t + 1); +- +- for (i = t; i < t + count; i++) { +- strcpy(p, "\033[K\n"); +- p += 4; +- if (p - buf >= 224) { +- promcon_puts(buf, p - buf); +- p = buf; +- } +- } +- +- for (; i < b; i++) +- s = promcon_repaint_line(s, buf, &p); +- +- p += promcon_end(conp, p); +- promcon_puts(buf, p - buf); +- break; +- } +- +- return 0; +-} +- +-#if !(PROMCON_COLOR) +-static u8 promcon_build_attr(struct vc_data *conp, u8 _color, u8 _intensity, +- u8 _blink, u8 _underline, u8 _reverse, u8 _italic) +-{ +- return (_reverse) ? 0xf : 0x7; +-} +-#endif +- +-/* +- * The console 'switch' structure for the VGA based console +- */ +- +-static int promcon_dummy(void) +-{ +- return 0; +-} +- +-#define DUMMY (void *) promcon_dummy +- +-const struct consw prom_con = { +- .owner = THIS_MODULE, +- .con_startup = promcon_startup, +- .con_init = promcon_init, +- .con_deinit = promcon_deinit, +- .con_clear = promcon_clear, +- .con_putc = promcon_putc, +- .con_putcs = promcon_putcs, +- .con_cursor = promcon_cursor, +- .con_scroll = promcon_scroll, +- .con_bmove = promcon_bmove, +- .con_switch = promcon_switch, +- .con_blank = promcon_blank, +- .con_set_palette = DUMMY, +- .con_scrolldelta = DUMMY, +-#if !(PROMCON_COLOR) +- .con_build_attr = promcon_build_attr, +-#endif +-}; +- +-void __init prom_con_init(void) +-{ +-#ifdef CONFIG_DUMMY_CONSOLE +- if (conswitchp == &dummy_con) +- take_over_console(&prom_con, 0, MAX_NR_CONSOLES-1, 1); +- else +-#endif +- if (conswitchp == &prom_con) +- promcon_init_unimap(vc_cons[fg_console].d); +-} +--- a/drivers/video/console/prom.uni ++++ /dev/null +@@ -1,11 +0,0 @@ +-# +-# Unicode mapping table for font in Sun PROM +-# +-# +-0x20-0x7e idem +-0xa0-0xff idem +-# +-0x7c U+2502 +-0x2d U+2500 +-0x2b U+250c U+2510 U+2514 U+2518 U+251c U+2524 U+252c U+2534 U+253c +-0xa4 U+fffd +--- a/scripts/Makefile ++++ b/scripts/Makefile +@@ -10,7 +10,6 @@ + hostprogs-$(CONFIG_KALLSYMS) += kallsyms + hostprogs-$(CONFIG_LOGO) += pnmtologo + hostprogs-$(CONFIG_VT) += conmakehash +-hostprogs-$(CONFIG_PROM_CONSOLE) += conmakehash + hostprogs-$(CONFIG_IKCONFIG) += bin2c + + always := $(hostprogs-y) $(hostprogs-m) + + +From gregkh@mini.kroah.org Fri Nov 6 14:15:40 2009 +Message-Id: <20091106221540.801628880@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 06 Nov 2009 14:14:14 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Thomas Gleixner , + "David S. Miller" +Subject: [16/99] watchdog: Fix rio watchdog probe function +References: <20091106221358.309857998@mini.kroah.org> +Content-Disposition: inline; filename=watchdog-fix-rio-watchdog-probe-function.patch +Content-Length: 945 +Lines: 32 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Thomas Gleixner + +[ Upstream commit 03717e3d12b625268848414e39beda25e4515692 ] + +After sucessfully registering the misc device the driver iounmaps the +hardware registers and kfree's the device data structure. Ouch ! + +This was introduced with commit e42311d75 (riowatchdog: Convert to +pure OF driver) and went unnoticed for more than a year :) + +Return success instead of dropping into the error cleanup code path. + +Signed-off-by: Thomas Gleixner +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/watchdog/riowd.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/watchdog/riowd.c ++++ b/drivers/watchdog/riowd.c +@@ -206,7 +206,7 @@ static int __devinit riowd_probe(struct + + dev_set_drvdata(&op->dev, p); + riowd_device = p; +- err = 0; ++ return 0; + + out_iounmap: + of_iounmap(&op->resource[0], p->regs, 2); + + +From gregkh@mini.kroah.org Fri Nov 6 14:15:41 2009 +Message-Id: <20091106221540.929583902@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 06 Nov 2009 14:14:15 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Dmitry Torokhov +Subject: [17/99] Input: synaptics - add another Protege M300 to rate blacklist +References: <20091106221358.309857998@mini.kroah.org> +Content-Disposition: inline; filename=input-synaptics-add-another-protege-m300-to-rate-blacklist.patch +Content-Length: 1080 +Lines: 38 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Dmitry Torokhov + +commit 5f5eeff4c93256ee93435a3bf08cf18c45e9a994 upstream. + +Apparently some of Toshiba Protege M300 identify themselves as +"Portable PC" in DMI so we need to add that to the DMI table as +well. We need DMI data so we can automatically lower Synaptics +reporting rate from 80 to 40 pps to avoid over-taxing their +keyboard controllers. + +Tested-by: Rod Davison +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/input/mouse/synaptics.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +--- a/drivers/input/mouse/synaptics.c ++++ b/drivers/input/mouse/synaptics.c +@@ -652,6 +652,16 @@ static const struct dmi_system_id toshib + DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"), + DMI_MATCH(DMI_PRODUCT_NAME, "PORTEGE M300"), + }, ++ ++ }, ++ { ++ .ident = "Toshiba Portege M300", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "Portable PC"), ++ DMI_MATCH(DMI_PRODUCT_VERSION, "Version 1.0"), ++ }, ++ + }, + { } + }; + + +From gregkh@mini.kroah.org Fri Nov 6 14:15:41 2009 +Message-Id: <20091106221541.057271576@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 06 Nov 2009 14:14:16 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jonathan Brassow , + Alasdair G Kergon +Subject: [18/99] dm snapshot: free exception store on init failure +References: <20091106221358.309857998@mini.kroah.org> +Content-Disposition: inline; filename=dm-snapshot-free-exception-store-on-init-failure.patch +Content-Length: 1115 +Lines: 40 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Jonathan Brassow + +commit 034a186d29dbcef099e57ab23ec39440596be911 upstream. + +While initializing the snapshot module, if we fail to register +the snapshot target then we must back-out the exception store +module initialization. + +Signed-off-by: Jonathan Brassow +Reviewed-by: Mikulas Patocka +Reviewed-by: Mike Snitzer +Signed-off-by: Alasdair G Kergon +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/dm-snap.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/drivers/md/dm-snap.c ++++ b/drivers/md/dm-snap.c +@@ -1465,7 +1465,7 @@ static int __init dm_snapshot_init(void) + r = dm_register_target(&snapshot_target); + if (r) { + DMERR("snapshot target register failed %d", r); +- return r; ++ goto bad_register_snapshot_target; + } + + r = dm_register_target(&origin_target); +@@ -1522,6 +1522,9 @@ bad2: + dm_unregister_target(&origin_target); + bad1: + dm_unregister_target(&snapshot_target); ++ ++bad_register_snapshot_target: ++ dm_exception_store_exit(); + return r; + } + + + +From gregkh@mini.kroah.org Fri Nov 6 14:15:41 2009 +Message-Id: <20091106221541.185278978@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 06 Nov 2009 14:14:17 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Mikulas Patocka , + Alasdair G Kergon +Subject: [19/99] dm snapshot: sort by chunk size to fix race +References: <20091106221358.309857998@mini.kroah.org> +Content-Disposition: inline; filename=dm-snapshot-sort-by-chunk-size-to-fix-race.patch +Content-Length: 2518 +Lines: 68 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Mikulas Patocka + +commit 6d45d93ead319423099b82a4efd775bc0f159121 upstream. + +Avoid a race causing corruption when snapshots of the same origin have +different chunk sizes by sorting the internal list of snapshots by chunk +size, largest first. + https://bugzilla.redhat.com/show_bug.cgi?id=182659 + +For example, let's have two snapshots with different chunk sizes. The +first snapshot (1) has small chunk size and the second snapshot (2) has +large chunk size. Let's have chunks A, B, C in these snapshots: +snapshot1: ====A==== ====B==== +snapshot2: ==========C========== + +(Chunk size is a power of 2. Chunks are aligned.) + +A write to the origin at a position within A and C comes along. It +triggers reallocation of A, then reallocation of C and links them +together using A as the 'primary' exception. + +Then another write to the origin comes along at a position within B and +C. It creates pending exception for B. C already has a reallocation in +progress and it already has a primary exception (A), so nothing is done +to it: B and C are not linked. + +If the reallocation of B finishes before the reallocation of C, because +there is no link with the pending exception for C it does not know to +wait for it and, the second write is dispatched to the origin and causes +data corruption in the chunk C in snapshot2. + +To avoid this situation, we maintain snapshots sorted in descending +order of chunk size. This leads to a guaranteed ordering on the links +between the pending exceptions and avoids the problem explained above - +both A and B now get linked to C. + +Signed-off-by: Mikulas Patocka +Signed-off-by: Alasdair G Kergon +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/dm-snap.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/drivers/md/dm-snap.c ++++ b/drivers/md/dm-snap.c +@@ -296,6 +296,7 @@ static void __insert_origin(struct origi + */ + static int register_snapshot(struct dm_snapshot *snap) + { ++ struct dm_snapshot *l; + struct origin *o, *new_o; + struct block_device *bdev = snap->origin->bdev; + +@@ -319,7 +320,11 @@ static int register_snapshot(struct dm_s + __insert_origin(o); + } + +- list_add_tail(&snap->list, &o->snapshots); ++ /* Sort the list according to chunk size, largest-first smallest-last */ ++ list_for_each_entry(l, &o->snapshots, list) ++ if (l->store->chunk_size < snap->store->chunk_size) ++ break; ++ list_add_tail(&snap->list, &l->list); + + up_write(&_origins_lock); + return 0; + + +From gregkh@mini.kroah.org Fri Nov 6 14:15:41 2009 +Message-Id: <20091106221541.312749218@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 06 Nov 2009 14:14:18 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jonathan Brassow , + Alasdair G Kergon +Subject: [20/99] dm log: userspace fix incorrect luid cast in userspace_ctr +References: <20091106221358.309857998@mini.kroah.org> +Content-Disposition: inline; filename=dm-log-userspace-fix-incorrect-luid-cast-in-userspace_ctr.patch +Content-Length: 861 +Lines: 30 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Andrew Morton + +commit bca915aae803cf01fde4461fc9c093cf5a86d7fc upstream. + +mips: + +drivers/md/dm-log-userspace-base.c: In function `userspace_ctr': +drivers/md/dm-log-userspace-base.c:159: warning: cast from pointer to integer of different size + +Cc: Jonathan Brassow +Signed-off-by: Andrew Morton +Signed-off-by: Alasdair G Kergon +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/dm-log-userspace-base.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/md/dm-log-userspace-base.c ++++ b/drivers/md/dm-log-userspace-base.c +@@ -156,7 +156,7 @@ static int userspace_ctr(struct dm_dirty + } + + /* The ptr value is sufficient for local unique id */ +- lc->luid = (uint64_t)lc; ++ lc->luid = (unsigned long)lc; + + lc->ti = ti; + + + +From gregkh@mini.kroah.org Fri Nov 6 14:15:41 2009 +Message-Id: <20091106221541.441256753@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 06 Nov 2009 14:14:19 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Zdenek Kabelac , + Alasdair G Kergon +Subject: [21/99] dm: add missing del_gendisk to alloc_dev error path +References: <20091106221358.309857998@mini.kroah.org> +Content-Disposition: inline; filename=dm-add-missing-del_gendisk-to-alloc_dev-error-path.patch +Content-Length: 894 +Lines: 30 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Zdenek Kabelac + +commit 03022c54b9725026c0370a810168975c387ad04c upstream. + +Add missing del_gendisk() to error path when creation of workqueue fails. +Otherwice there is a resource leak and following warning is shown: + +WARNING: at fs/sysfs/dir.c:487 sysfs_add_one+0xc5/0x160() +sysfs: cannot create duplicate filename '/devices/virtual/block/dm-0' + +Signed-off-by: Zdenek Kabelac +Reviewed-by: Jonathan Brassow +Signed-off-by: Alasdair G Kergon +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/dm.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/md/dm.c ++++ b/drivers/md/dm.c +@@ -1819,6 +1819,7 @@ static struct mapped_device *alloc_dev(i + bad_bdev: + destroy_workqueue(md->wq); + bad_thread: ++ del_gendisk(md->disk); + put_disk(md->disk); + bad_disk: + blk_cleanup_queue(md->queue); + + +From gregkh@mini.kroah.org Fri Nov 6 14:15:41 2009 +Message-Id: <20091106221541.565594071@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 06 Nov 2009 14:14:20 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Kiyoshi Ueda , + Junichi Nomura , + Alasdair G Kergon +Subject: [22/99] dm: dec_pending needs locking to save error value +References: <20091106221358.309857998@mini.kroah.org> +Content-Disposition: inline; filename=dm-dec_pending-needs-locking-to-save-error-value.patch +Content-Length: 1738 +Lines: 57 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Kiyoshi Ueda + +commit f88fb981183e71daf40bbd84bc8251bbf7b59e19 upstream. + +Multiple instances of dec_pending() can run concurrently so a lock is +needed when it saves the first error code. + +I have never experienced actual problem without locking and just found +this during code inspection while implementing the barrier support +patch for request-based dm. + +This patch adds the locking. +I've done compile, boot and basic I/O testings. + +Signed-off-by: Kiyoshi Ueda +Signed-off-by: Jun'ichi Nomura +Signed-off-by: Alasdair G Kergon +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/dm.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +--- a/drivers/md/dm.c ++++ b/drivers/md/dm.c +@@ -47,6 +47,7 @@ struct dm_io { + atomic_t io_count; + struct bio *bio; + unsigned long start_time; ++ spinlock_t endio_lock; + }; + + /* +@@ -576,8 +577,12 @@ static void dec_pending(struct dm_io *io + struct mapped_device *md = io->md; + + /* Push-back supersedes any I/O errors */ +- if (error && !(io->error > 0 && __noflush_suspending(md))) +- io->error = error; ++ if (unlikely(error)) { ++ spin_lock_irqsave(&io->endio_lock, flags); ++ if (!(io->error > 0 && __noflush_suspending(md))) ++ io->error = error; ++ spin_unlock_irqrestore(&io->endio_lock, flags); ++ } + + if (atomic_dec_and_test(&io->io_count)) { + if (io->error == DM_ENDIO_REQUEUE) { +@@ -1224,6 +1229,7 @@ static void __split_and_process_bio(stru + atomic_set(&ci.io->io_count, 1); + ci.io->bio = bio; + ci.io->md = md; ++ spin_lock_init(&ci.io->endio_lock); + ci.sector = bio->bi_sector; + ci.sector_count = bio_sectors(bio); + if (unlikely(bio_empty_barrier(bio))) + + +From gregkh@mini.kroah.org Fri Nov 6 14:15:41 2009 +Message-Id: <20091106221541.685797967@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 06 Nov 2009 14:14:21 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Mikulas Patocka , + Alasdair G Kergon +Subject: [23/99] dm exception store: fix failed set_chunk_size error path +References: <20091106221358.309857998@mini.kroah.org> +Content-Disposition: inline; filename=dm-exception-store-fix-failed-set_chunk_size-error-path.patch +Content-Length: 713 +Lines: 26 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Mikulas Patocka + +commit 0e8c4e4e3ebb15756ddc4170a88149a2cd323cfe upstream. + +Properly close the device if failing because of an invalid chunk size. + +Signed-off-by: Mikulas Patocka +Signed-off-by: Alasdair G Kergon +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/dm-exception-store.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/md/dm-exception-store.c ++++ b/drivers/md/dm-exception-store.c +@@ -251,7 +251,7 @@ int dm_exception_store_create(struct dm_ + + r = set_chunk_size(tmp_store, argv[2], &ti->error); + if (r) +- goto bad_cow; ++ goto bad_ctr; + + r = type->ctr(tmp_store, 0, NULL); + if (r) { + + +From gregkh@mini.kroah.org Fri Nov 6 14:15:41 2009 +Message-Id: <20091106221541.821263847@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 06 Nov 2009 14:14:22 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Mikulas Patocka , + Alasdair G Kergon +Subject: [24/99] dm snapshot: lock snapshot while supplying status +References: <20091106221358.309857998@mini.kroah.org> +Content-Disposition: inline; filename=dm-snapshot-lock-snapshot-while-supplying-status.patch +Content-Length: 896 +Lines: 37 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Mikulas Patocka + +commit 4c6fff445d7aa753957856278d4d93bcad6e2c14 upstream. + +This patch locks the snapshot when returning status. It fixes a race +when it could return an invalid number of free chunks if someone +was simultaneously modifying it. + +Signed-off-by: Mikulas Patocka +Signed-off-by: Alasdair G Kergon +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/dm-snap.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/md/dm-snap.c ++++ b/drivers/md/dm-snap.c +@@ -1147,6 +1147,8 @@ static int snapshot_status(struct dm_tar + unsigned sz = 0; + struct dm_snapshot *snap = ti->private; + ++ down_write(&snap->lock); ++ + switch (type) { + case STATUSTYPE_INFO: + if (!snap->valid) +@@ -1178,6 +1180,8 @@ static int snapshot_status(struct dm_tar + break; + } + ++ up_write(&snap->lock); ++ + return 0; + } + + + +From gregkh@mini.kroah.org Fri Nov 6 14:15:42 2009 +Message-Id: <20091106221541.949266293@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 06 Nov 2009 14:14:23 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Mikulas Patocka , + Alasdair G Kergon +Subject: [25/99] dm snapshot: require non zero chunk size by end of ctr +References: <20091106221358.309857998@mini.kroah.org> +Content-Disposition: inline; filename=dm-snapshot-require-non-zero-chunk-size-by-end-of-ctr.patch +Content-Length: 1096 +Lines: 33 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Mikulas Patocka + +commit 3f2412dc85260e5aae7ebb03bf50d5b1407e3083 upstream. + +If we are creating snapshot with memory-stored exception store, fail if +the user didn't specify chunk size. Zero chunk size would probably crash +a lot of places in the rest of snapshot code. + +Signed-off-by: Mikulas Patocka +Reviewed-by: Jonathan Brassow +Reviewed-by: Mike Snitzer +Signed-off-by: Alasdair G Kergon +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/dm-snap.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/md/dm-snap.c ++++ b/drivers/md/dm-snap.c +@@ -673,6 +673,11 @@ static int snapshot_ctr(struct dm_target + bio_list_init(&s->queued_bios); + INIT_WORK(&s->queued_bios_work, flush_queued_bios); + ++ if (!s->store->chunk_size) { ++ ti->error = "Chunk size not set"; ++ goto bad_load_and_register; ++ } ++ + /* Add snapshot to the list of snapshots for this origin */ + /* Exceptions aren't triggered till snapshot_resume() is called */ + if (register_snapshot(s)) { + + +From gregkh@mini.kroah.org Fri Nov 6 14:15:42 2009 +Message-Id: <20091106221542.080522228@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 06 Nov 2009 14:14:24 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Mikulas Patocka , + Mike Snitzer , + Alasdair G Kergon +Subject: [26/99] dm snapshot: use unsigned integer chunk size +References: <20091106221358.309857998@mini.kroah.org> +Content-Disposition: inline; filename=dm-snapshot-use-unsigned-integer-chunk-size.patch +Content-Length: 5521 +Lines: 167 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Mikulas Patocka + +commit df96eee679ba28c98cf722fa7c9f4286ee1ed0bd upstream. + +Use unsigned integer chunk size. + +Maximum chunk size is 512kB, there won't ever be need to use 4GB chunk size, +so the number can be 32-bit. This fixes compiler failure on 32-bit systems +with large block devices. + +Signed-off-by: Mikulas Patocka +Signed-off-by: Mike Snitzer +Reviewed-by: Jonathan Brassow +Signed-off-by: Alasdair G Kergon +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/dm-exception-store.c | 20 +++++++++++--------- + drivers/md/dm-exception-store.h | 8 ++++---- + drivers/md/dm-snap-persistent.c | 16 ++++++++-------- + drivers/md/dm-snap.c | 4 ++-- + 4 files changed, 25 insertions(+), 23 deletions(-) + +--- a/drivers/md/dm-exception-store.c ++++ b/drivers/md/dm-exception-store.c +@@ -155,7 +155,8 @@ static int set_chunk_size(struct dm_exce + char *value; + + chunk_size_ulong = simple_strtoul(chunk_size_arg, &value, 10); +- if (*chunk_size_arg == '\0' || *value != '\0') { ++ if (*chunk_size_arg == '\0' || *value != '\0' || ++ chunk_size_ulong > UINT_MAX) { + *error = "Invalid chunk size"; + return -EINVAL; + } +@@ -171,34 +172,35 @@ static int set_chunk_size(struct dm_exce + */ + chunk_size_ulong = round_up(chunk_size_ulong, PAGE_SIZE >> 9); + +- return dm_exception_store_set_chunk_size(store, chunk_size_ulong, ++ return dm_exception_store_set_chunk_size(store, ++ (unsigned) chunk_size_ulong, + error); + } + + int dm_exception_store_set_chunk_size(struct dm_exception_store *store, +- unsigned long chunk_size_ulong, ++ unsigned chunk_size, + char **error) + { + /* Check chunk_size is a power of 2 */ +- if (!is_power_of_2(chunk_size_ulong)) { ++ if (!is_power_of_2(chunk_size)) { + *error = "Chunk size is not a power of 2"; + return -EINVAL; + } + + /* Validate the chunk size against the device block size */ +- if (chunk_size_ulong % (bdev_logical_block_size(store->cow->bdev) >> 9)) { ++ if (chunk_size % (bdev_logical_block_size(store->cow->bdev) >> 9)) { + *error = "Chunk size is not a multiple of device blocksize"; + return -EINVAL; + } + +- if (chunk_size_ulong > INT_MAX >> SECTOR_SHIFT) { ++ if (chunk_size > INT_MAX >> SECTOR_SHIFT) { + *error = "Chunk size is too high"; + return -EINVAL; + } + +- store->chunk_size = chunk_size_ulong; +- store->chunk_mask = chunk_size_ulong - 1; +- store->chunk_shift = ffs(chunk_size_ulong) - 1; ++ store->chunk_size = chunk_size; ++ store->chunk_mask = chunk_size - 1; ++ store->chunk_shift = ffs(chunk_size) - 1; + + return 0; + } +--- a/drivers/md/dm-exception-store.h ++++ b/drivers/md/dm-exception-store.h +@@ -101,9 +101,9 @@ struct dm_exception_store { + struct dm_dev *cow; + + /* Size of data blocks saved - must be a power of 2 */ +- chunk_t chunk_size; +- chunk_t chunk_mask; +- chunk_t chunk_shift; ++ unsigned chunk_size; ++ unsigned chunk_mask; ++ unsigned chunk_shift; + + void *context; + }; +@@ -169,7 +169,7 @@ int dm_exception_store_type_register(str + int dm_exception_store_type_unregister(struct dm_exception_store_type *type); + + int dm_exception_store_set_chunk_size(struct dm_exception_store *store, +- unsigned long chunk_size_ulong, ++ unsigned chunk_size, + char **error); + + int dm_exception_store_create(struct dm_target *ti, int argc, char **argv, +--- a/drivers/md/dm-snap.c ++++ b/drivers/md/dm-snap.c +@@ -961,7 +961,7 @@ static void start_copy(struct dm_snap_pe + + src.bdev = bdev; + src.sector = chunk_to_sector(s->store, pe->e.old_chunk); +- src.count = min(s->store->chunk_size, dev_size - src.sector); ++ src.count = min((sector_t)s->store->chunk_size, dev_size - src.sector); + + dest.bdev = s->store->cow->bdev; + dest.sector = chunk_to_sector(s->store, pe->e.new_chunk); +@@ -1402,7 +1402,7 @@ static void origin_resume(struct dm_targ + struct dm_dev *dev = ti->private; + struct dm_snapshot *snap; + struct origin *o; +- chunk_t chunk_size = 0; ++ unsigned chunk_size = 0; + + down_read(&_origins_lock); + o = __lookup_origin(dev->bdev); +--- a/drivers/md/dm-snap-persistent.c ++++ b/drivers/md/dm-snap-persistent.c +@@ -284,12 +284,13 @@ static int read_header(struct pstore *ps + { + int r; + struct disk_header *dh; +- chunk_t chunk_size; ++ unsigned chunk_size; + int chunk_size_supplied = 1; + char *chunk_err; + + /* +- * Use default chunk size (or hardsect_size, if larger) if none supplied ++ * Use default chunk size (or logical_block_size, if larger) ++ * if none supplied + */ + if (!ps->store->chunk_size) { + ps->store->chunk_size = max(DM_CHUNK_SIZE_DEFAULT_SECTORS, +@@ -334,10 +335,9 @@ static int read_header(struct pstore *ps + return 0; + + if (chunk_size_supplied) +- DMWARN("chunk size %llu in device metadata overrides " +- "table chunk size of %llu.", +- (unsigned long long)chunk_size, +- (unsigned long long)ps->store->chunk_size); ++ DMWARN("chunk size %u in device metadata overrides " ++ "table chunk size of %u.", ++ chunk_size, ps->store->chunk_size); + + /* We had a bogus chunk_size. Fix stuff up. */ + free_area(ps); +@@ -345,8 +345,8 @@ static int read_header(struct pstore *ps + r = dm_exception_store_set_chunk_size(ps->store, chunk_size, + &chunk_err); + if (r) { +- DMERR("invalid on-disk chunk size %llu: %s.", +- (unsigned long long)chunk_size, chunk_err); ++ DMERR("invalid on-disk chunk size %u: %s.", ++ chunk_size, chunk_err); + return r; + } + + + +From gregkh@mini.kroah.org Fri Nov 6 14:15:42 2009 +Message-Id: <20091106221542.205393474@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 06 Nov 2009 14:14:25 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Alan Cox +Subject: [27/99] ray_cs: Fix copy_from_user handling +References: <20091106221358.309857998@mini.kroah.org> +Content-Disposition: inline; filename=ray_cs-fix-copy_from_user-handling.patch +Content-Length: 719 +Lines: 26 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Alan Cox + +commit 575c9ed7798218dc923f319c0d78f0c25ca506b9 upstream. + +I've not touched the other stuff here but the word "locking" comes to mind. + +Signed-off-by: Alan Cox +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/ray_cs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/wireless/ray_cs.c ++++ b/drivers/net/wireless/ray_cs.c +@@ -2878,7 +2878,7 @@ static int write_essid(struct file *file + unsigned long count, void *data) + { + static char proc_essid[33]; +- int len = count; ++ unsigned int len = count; + + if (len > 32) + len = 32; + + +From gregkh@mini.kroah.org Fri Nov 6 14:15:42 2009 +Message-Id: <20091106221542.333265650@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 06 Nov 2009 14:14:26 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + KOSAKI Motohiro , + Christoph Lameter +Subject: [28/99] mbind(): fix leak of never putback pages +References: <20091106221358.309857998@mini.kroah.org> +Content-Disposition: inline; filename=mbind-fix-leak-of-never-putback-pages.patch +Content-Length: 2100 +Lines: 101 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: KOSAKI Motohiro + +commit ab8a3e14e6f8e567560f664bbd29aefb306a274e upstream. + +If mbind() receives an invalid address, do_mbind leaks a page. The +following test program detects this leak. + +This patch fixes it. + +migrate_efault.c +======================================= + #include + #include + #include + #include + #include + #include + #include + +static unsigned long pagesize; + +static void* make_hole_mapping(void) +{ + + void* addr; + + addr = mmap(NULL, pagesize*3, PROT_READ|PROT_WRITE, + MAP_ANON|MAP_PRIVATE, 0, 0); + if (addr == MAP_FAILED) + return NULL; + + /* make page populate */ + memset(addr, 0, pagesize*3); + + /* make memory hole */ + munmap(addr+pagesize, pagesize); + + return addr; +} + +int main(int argc, char** argv) +{ + void* addr; + int ch; + int node; + struct bitmask *nmask = numa_allocate_nodemask(); + int err; + int node_set = 0; + + while ((ch = getopt(argc, argv, "n:")) != -1){ + switch (ch){ + case 'n': + node = strtol(optarg, NULL, 0); + numa_bitmask_setbit(nmask, node); + node_set = 1; + break; + default: + ; + } + } + argc -= optind; + argv += optind; + + if (!node_set) + numa_bitmask_setbit(nmask, 0); + + pagesize = getpagesize(); + + addr = make_hole_mapping(); + + err = mbind(addr, pagesize*3, MPOL_BIND, nmask->maskp, nmask->size, MPOL_MF_MOVE_ALL); + if (err) + perror("mbind "); + + return 0; +} +======================================= + +Signed-off-by: KOSAKI Motohiro +Acked-by: Christoph Lameter +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/mempolicy.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/mm/mempolicy.c ++++ b/mm/mempolicy.c +@@ -1058,7 +1058,8 @@ static long do_mbind(unsigned long start + + if (!err && nr_failed && (flags & MPOL_MF_STRICT)) + err = -EIO; +- } ++ } else ++ putback_lru_pages(&pagelist); + + up_write(&mm->mmap_sem); + mpol_put(new); + + +From gregkh@mini.kroah.org Fri Nov 6 14:15:42 2009 +Message-Id: <20091106221542.455186736@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 06 Nov 2009 14:14:27 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + KOSAKI Motohiro , + Christoph Lameter +Subject: [29/99] do_mbind(): fix memory leak +References: <20091106221358.309857998@mini.kroah.org> +Content-Disposition: inline; filename=do_mbind-fix-memory-leak.patch +Content-Length: 1245 +Lines: 50 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: KOSAKI Motohiro + +commit b05ca7385a2848abdc72051f832722641daed8b0 upstream. + +If migrate_prep is failed, new variable is leaked. This patch fixes it. + +Signed-off-by: KOSAKI Motohiro +Acked-by: Christoph Lameter +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/mempolicy.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +--- a/mm/mempolicy.c ++++ b/mm/mempolicy.c +@@ -1024,7 +1024,7 @@ static long do_mbind(unsigned long start + + err = migrate_prep(); + if (err) +- return err; ++ goto mpol_out; + } + { + NODEMASK_SCRATCH(scratch); +@@ -1039,10 +1039,9 @@ static long do_mbind(unsigned long start + err = -ENOMEM; + NODEMASK_SCRATCH_FREE(scratch); + } +- if (err) { +- mpol_put(new); +- return err; +- } ++ if (err) ++ goto mpol_out; ++ + vma = check_range(mm, start, end, nmask, + flags | MPOL_MF_INVERT, &pagelist); + +@@ -1062,6 +1061,7 @@ static long do_mbind(unsigned long start + putback_lru_pages(&pagelist); + + up_write(&mm->mmap_sem); ++ mpol_out: + mpol_put(new); + return err; + } + + +From gregkh@mini.kroah.org Fri Nov 6 14:15:42 2009 +Message-Id: <20091106221542.613588302@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 06 Nov 2009 14:14:28 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Benjamin Herrenschmidt , + Alan Cox , + Michael Reed +Subject: [30/99] 8250_pci: add IBM Saturn serial card +References: <20091106221358.309857998@mini.kroah.org> +Content-Disposition: inline; filename=8250_pci-add-ibm-saturn-serial-card.patch +Content-Length: 2173 +Lines: 69 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Benjamin Herrenschmidt + +commit c68d2b1594548cda7f6dbac6a4d9d30a9b01558c upstream. + +The IBM Saturn serial card has only one port. Without that fixup, +the kernel thinks it has two, which confuses userland setup and +admin tools as well. + +[akpm@linux-foundation.org: fix pci-ids.h layout] +Signed-off-by: Benjamin Herrenschmidt +Acked-by: Alan Cox +Cc: Michael Reed +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Acked-by: Alan Cox +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/serial/8250_pci.c | 11 +++++++++++ + include/linux/pci_ids.h | 3 +++ + 2 files changed, 14 insertions(+) + +--- a/drivers/serial/8250_pci.c ++++ b/drivers/serial/8250_pci.c +@@ -1561,6 +1561,7 @@ enum pci_board_num_t { + pbn_exar_XR17C152, + pbn_exar_XR17C154, + pbn_exar_XR17C158, ++ pbn_exar_ibm_saturn, + pbn_pasemi_1682M, + pbn_ni8430_2, + pbn_ni8430_4, +@@ -2146,6 +2147,13 @@ static struct pciserial_board pci_boards + .base_baud = 921600, + .uart_offset = 0x200, + }, ++ [pbn_exar_ibm_saturn] = { ++ .flags = FL_BASE0, ++ .num_ports = 1, ++ .base_baud = 921600, ++ .uart_offset = 0x200, ++ }, ++ + /* + * PA Semi PWRficient PA6T-1682M on-chip UART + */ +@@ -2649,6 +2657,9 @@ static struct pci_device_id serial_pci_t + PCI_SUBVENDOR_ID_CONNECT_TECH, + PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_8_485, 0, 0, + pbn_b0_8_1843200_200 }, ++ { PCI_VENDOR_ID_EXAR, PCI_DEVICE_ID_EXAR_XR17C152, ++ PCI_VENDOR_ID_IBM, PCI_SUBDEVICE_ID_IBM_SATURN_SERIAL_ONE_PORT, ++ 0, 0, pbn_exar_ibm_saturn }, + + { PCI_VENDOR_ID_SEALEVEL, PCI_DEVICE_ID_SEALEVEL_U530, + PCI_ANY_ID, PCI_ANY_ID, 0, 0, +--- a/include/linux/pci_ids.h ++++ b/include/linux/pci_ids.h +@@ -479,6 +479,9 @@ + #define PCI_DEVICE_ID_IBM_ICOM_V2_ONE_PORT_RVX_ONE_PORT_MDM_PCIE 0x0361 + #define PCI_DEVICE_ID_IBM_ICOM_FOUR_PORT_MODEL 0x252 + ++#define PCI_SUBVENDOR_ID_IBM 0x1014 ++#define PCI_SUBDEVICE_ID_IBM_SATURN_SERIAL_ONE_PORT 0x03d4 ++ + #define PCI_VENDOR_ID_UNISYS 0x1018 + #define PCI_DEVICE_ID_UNISYS_DMA_DIRECTOR 0x001C + + + +From gregkh@mini.kroah.org Fri Nov 6 14:15:42 2009 +Message-Id: <20091106221542.713075246@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 06 Nov 2009 14:14:29 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Alan Cox +Subject: [31/99] dpt_i2o: Fix up copy*user +References: <20091106221358.309857998@mini.kroah.org> +Content-Disposition: inline; filename=dpt_i2o-fix-up-copy-user.patch +Content-Length: 680 +Lines: 26 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Alan Cox + +commit ef7562b7f28319e6dd1f85dc1af87df2a7a84832 upstream. + +Signed-off-by: Alan Cox +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/dpt_i2o.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/scsi/dpt_i2o.c ++++ b/drivers/scsi/dpt_i2o.c +@@ -1918,6 +1918,10 @@ static int adpt_i2o_passthru(adpt_hba* p + } + size = size>>16; + size *= 4; ++ if (size > MAX_MESSAGE_SIZE) { ++ rcode = EINVAL; ++ goto cleanup; ++ } + /* Copy in the user's I2O command */ + if (copy_from_user (msg, user_msg, size)) { + rcode = -EFAULT; + + +From gregkh@mini.kroah.org Fri Nov 6 14:15:42 2009 +Message-Id: <20091106221542.845204599@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 06 Nov 2009 14:14:30 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + OGAWA Hirofumi , + Alan Cox +Subject: [32/99] dpt_i2o: Fix typo of EINVAL +References: <20091106221358.309857998@mini.kroah.org> +Content-Disposition: inline; filename=dpt_i2o-fix-typo-of-einval.patch +Content-Length: 824 +Lines: 28 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: OGAWA Hirofumi + +commit aefba418bfecd1985a08f50a95bd854a119f0153 upstream. + +Commit ef7562b7f28319e6dd1f85dc1af87df2a7a84832 ("dpt_i2o: Fix up +copy*user") had a silly typo: EINVAL should be -EINVAL. + +Signed-off-by: OGAWA Hirofumi +Cc: Alan Cox +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/dpt_i2o.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/scsi/dpt_i2o.c ++++ b/drivers/scsi/dpt_i2o.c +@@ -1919,7 +1919,7 @@ static int adpt_i2o_passthru(adpt_hba* p + size = size>>16; + size *= 4; + if (size > MAX_MESSAGE_SIZE) { +- rcode = EINVAL; ++ rcode = -EINVAL; + goto cleanup; + } + /* Copy in the user's I2O command */ + + +From gregkh@mini.kroah.org Fri Nov 6 14:15:43 2009 +Message-Id: <20091106221542.973446321@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 06 Nov 2009 14:14:31 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Ben Hutchings , + Eric Sesterhenn , + Roman Zippel +Subject: [33/99] hfsplus: refuse to mount volumes larger than 2TB +References: <20091106221358.309857998@mini.kroah.org> +Content-Disposition: inline; filename=hfsplus-refuse-to-mount-volumes-larger-than-2tb.patch +Content-Length: 1480 +Lines: 43 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Ben Hutchings + +commit 5c36fe3d87b3f0c85894a49193c66096a3d6b26f upstream. + +As found in , hfsplus is using type u32 +rather than sector_t for some sector number calculations. + +In particular, hfsplus_get_block() does: + + u32 ablock, dblock, mask; +... + map_bh(bh_result, sb, (dblock << HFSPLUS_SB(sb).fs_shift) + HFSPLUS_SB(sb).blockoffset + (iblock & mask)); + +I am not confident that I can find and fix all cases where a sector number +may be truncated. For now, avoid data loss by refusing to mount HFS+ +volumes with more than 2^32 sectors (2TB). + +[akpm@linux-foundation.org: fix 32 and 64-bit issues] +Signed-off-by: Ben Hutchings +Cc: Eric Sesterhenn +Cc: Roman Zippel +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + fs/hfsplus/wrapper.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/fs/hfsplus/wrapper.c ++++ b/fs/hfsplus/wrapper.c +@@ -99,6 +99,10 @@ int hfsplus_read_wrapper(struct super_bl + + if (hfsplus_get_last_session(sb, &part_start, &part_size)) + return -EINVAL; ++ if ((u64)part_start + part_size > 0x100000000ULL) { ++ pr_err("hfs: volumes larger than 2TB are not supported yet\n"); ++ return -EINVAL; ++ } + while (1) { + bh = sb_bread512(sb, part_start + HFSPLUS_VOLHEAD_SECTOR, vhdr); + if (!bh) + + +From gregkh@mini.kroah.org Fri Nov 6 14:15:43 2009 +Message-Id: <20091106221543.125163308@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 06 Nov 2009 14:14:32 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Stas Sergeev +Subject: [34/99] Driver core: fix driver_register() return value +References: <20091106221358.309857998@mini.kroah.org> +Content-Disposition: inline; filename=driver-core-fix-driver_register-return-value.patch +Content-Length: 1078 +Lines: 31 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Stas Sergeev + +commit 39acbc12affcaa23ef1d887ba3d197baca8e6e47 upstream. + +In this patch: +http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=16dc42e018c2868211b4928f20a957c0c216126c +the check was added for another driver to already claim the same device +on the same bus. But the returned error code was wrong: to modprobe, the +-EEXIST means that _this_ driver is already installed. It therefore +doesn't produce the needed error message when _another_ driver is trying +to register for the same device. Returning -EBUSY fixes the problem. + +Signed-off-by: Stas Sergeev +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/base/driver.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/base/driver.c ++++ b/drivers/base/driver.c +@@ -236,7 +236,7 @@ int driver_register(struct device_driver + put_driver(other); + printk(KERN_ERR "Error: Driver '%s' is already registered, " + "aborting...\n", drv->name); +- return -EEXIST; ++ return -EBUSY; + } + + ret = bus_add_driver(drv); + + +From gregkh@mini.kroah.org Fri Nov 6 14:15:43 2009 +Message-Id: <20091106221543.293510879@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 06 Nov 2009 14:14:33 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Alan Cox +Subject: [35/99] tty: Mark generic_serial users as BROKEN +References: <20091106221358.309857998@mini.kroah.org> +Content-Disposition: inline; filename=tty-mark-generic_serial-users-as-broken.patch +Content-Length: 2451 +Lines: 73 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Alan Cox + +commit 412145947adfca60a4b5b4893fbae82dffa25edd upstream. + +There isn't much else I can do with these. I can find no hardware for any +of them and no users. The code is broken. + +Signed-off-by: Alan Cox +Signed-off-by: Greg Kroah-Hartman + +--- + arch/m68k/Kconfig | 6 +++--- + drivers/char/Kconfig | 6 +++--- + 2 files changed, 6 insertions(+), 6 deletions(-) + +--- a/arch/m68k/Kconfig ++++ b/arch/m68k/Kconfig +@@ -555,7 +555,7 @@ config HPAPCI + + config MVME147_SCC + bool "SCC support for MVME147 serial ports" +- depends on MVME147 ++ depends on MVME147 && BROKEN + help + This is the driver for the serial ports on the Motorola MVME147 + boards. Everyone using one of these boards should say Y here. +@@ -570,14 +570,14 @@ config SERIAL167 + + config MVME162_SCC + bool "SCC support for MVME162 serial ports" +- depends on MVME16x ++ depends on MVME16x && BROKEN + help + This is the driver for the serial ports on the Motorola MVME162 and + 172 boards. Everyone using one of these boards should say Y here. + + config BVME6000_SCC + bool "SCC support for BVME6000 serial ports" +- depends on BVME6000 ++ depends on BVME6000 && BROKEN + help + This is the driver for the serial ports on the BVME4000 and BVME6000 + boards from BVM Ltd. Everyone using one of these boards should say +--- a/drivers/char/Kconfig ++++ b/drivers/char/Kconfig +@@ -323,7 +323,7 @@ config SPECIALIX + + config SX + tristate "Specialix SX (and SI) card support" +- depends on SERIAL_NONSTANDARD && (PCI || EISA || ISA) ++ depends on SERIAL_NONSTANDARD && (PCI || EISA || ISA) && BROKEN + help + This is a driver for the SX and SI multiport serial cards. + Please read the file for details. +@@ -334,7 +334,7 @@ config SX + + config RIO + tristate "Specialix RIO system support" +- depends on SERIAL_NONSTANDARD ++ depends on SERIAL_NONSTANDARD && BROKEN + help + This is a driver for the Specialix RIO, a smart serial card which + drives an outboard box that can support up to 128 ports. Product +@@ -395,7 +395,7 @@ config NOZOMI + + config A2232 + tristate "Commodore A2232 serial support (EXPERIMENTAL)" +- depends on EXPERIMENTAL && ZORRO && BROKEN_ON_SMP ++ depends on EXPERIMENTAL && ZORRO && BROKEN + ---help--- + This option supports the 2232 7-port serial card shipped with the + Amiga 2000 and other Zorro-bus machines, dating from 1989. At + + +From gregkh@mini.kroah.org Fri Nov 6 14:15:43 2009 +Message-Id: <20091106221543.453166367@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 06 Nov 2009 14:14:34 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Sitsofe Wheeler , + Frederic Weisbecker , + Christof Schmitt , + Rusty Russell +Subject: [36/99] param: fix lots of bugs with writing charp params from sysfs, by leaking mem. +References: <20091106221358.309857998@mini.kroah.org> +Content-Disposition: inline; filename=param-fix-lots-of-bugs-with-writing-charp-params-from-sysfs-by-leaking-mem.patch +Content-Length: 2526 +Lines: 73 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Rusty Russell + +commit 65afac7d80ab3bc9f81e75eafb71eeb92a3ebdef upstream. + +e180a6b7759a "param: fix charp parameters set via sysfs" fixed the case +where charp parameters written via sysfs were freed, leaving drivers +accessing random memory. + +Unfortunately, storing a flag in the kparam struct was a bad idea: it's +rodata so setting it causes an oops on some archs. But that's not all: + +1) module_param_array() on charp doesn't work reliably, since we use an + uninitialized temporary struct kernel_param. +2) there's a fundamental race if a module uses this parameter and then + it's changed: they will still access the old, freed, memory. + +The simplest fix (ie. for 2.6.32) is to never free the memory. This +prevents all these problems, at cost of a memory leak. In practice, there +are only 18 places where a charp is writable via sysfs, and all are +root-only writable. + +Reported-by: Takashi Iwai +Cc: Sitsofe Wheeler +Cc: Frederic Weisbecker +Cc: Christof Schmitt +Signed-off-by: Rusty Russell +Signed-off-by: Greg Kroah-Hartman + +--- + include/linux/moduleparam.h | 1 - + kernel/params.c | 10 +--------- + 2 files changed, 1 insertion(+), 10 deletions(-) + +--- a/include/linux/moduleparam.h ++++ b/include/linux/moduleparam.h +@@ -37,7 +37,6 @@ typedef int (*param_set_fn)(const char * + typedef int (*param_get_fn)(char *buffer, struct kernel_param *kp); + + /* Flag bits for kernel_param.flags */ +-#define KPARAM_KMALLOCED 1 + #define KPARAM_ISBOOL 2 + + struct kernel_param { +--- a/kernel/params.c ++++ b/kernel/params.c +@@ -217,13 +217,9 @@ int param_set_charp(const char *val, str + return -ENOSPC; + } + +- if (kp->flags & KPARAM_KMALLOCED) +- kfree(*(char **)kp->arg); +- + /* This is a hack. We can't need to strdup in early boot, and we + * don't need to; this mangled commandline is preserved. */ + if (slab_is_available()) { +- kp->flags |= KPARAM_KMALLOCED; + *(char **)kp->arg = kstrdup(val, GFP_KERNEL); + if (!kp->arg) + return -ENOMEM; +@@ -604,11 +600,7 @@ void module_param_sysfs_remove(struct mo + + void destroy_params(const struct kernel_param *params, unsigned num) + { +- unsigned int i; +- +- for (i = 0; i < num; i++) +- if (params[i].flags & KPARAM_KMALLOCED) +- kfree(*(char **)params[i].arg); ++ /* FIXME: This should free kmalloced charp parameters. It doesn't. */ + } + + static void __init kernel_add_sysfs_param(const char *name, + + +From gregkh@mini.kroah.org Fri Nov 6 14:15:43 2009 +Message-Id: <20091106221543.601055424@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 06 Nov 2009 14:14:35 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Rusty Russell +Subject: [37/99] param: fix NULL comparison on oom +References: <20091106221358.309857998@mini.kroah.org> +Content-Disposition: inline; filename=param-fix-null-comparison-on-oom.patch +Content-Length: 757 +Lines: 26 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Rusty Russell + +commit d553ad864e3b3dde3f1038d491e207021b2d6293 upstream. + +kp->arg is always true: it's the contents of that pointer we care about. + +Reported-by: Takashi Iwai +Signed-off-by: Rusty Russell +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/params.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/kernel/params.c ++++ b/kernel/params.c +@@ -221,7 +221,7 @@ int param_set_charp(const char *val, str + * don't need to; this mangled commandline is preserved. */ + if (slab_is_available()) { + *(char **)kp->arg = kstrdup(val, GFP_KERNEL); +- if (!kp->arg) ++ if (!*(char **)kp->arg) + return -ENOMEM; + } else + *(const char **)kp->arg = val; + + +From gregkh@mini.kroah.org Fri Nov 6 14:15:43 2009 +Message-Id: <20091106221543.777556060@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 06 Nov 2009 14:14:36 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Rusty Russell +Subject: [38/99] param: fix setting arrays of bool +References: <20091106221358.309857998@mini.kroah.org> +Content-Disposition: inline; filename=param-fix-setting-arrays-of-bool.patch +Content-Length: 1439 +Lines: 46 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Rusty Russell + +commit 3c7d76e371ac1a3802ae1673f5c63554af59325c upstream. + +We create a dummy struct kernel_param on the stack for parsing each +array element, but we didn't initialize the flags word. This matters +for arrays of type "bool", where the flag indicates if it really is +an array of bools or unsigned int (old-style). + +Reported-by: Takashi Iwai +Signed-off-by: Rusty Russell +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/params.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/kernel/params.c ++++ b/kernel/params.c +@@ -299,6 +299,7 @@ static int param_array(const char *name, + unsigned int min, unsigned int max, + void *elem, int elemsize, + int (*set)(const char *, struct kernel_param *kp), ++ u16 flags, + unsigned int *num) + { + int ret; +@@ -308,6 +309,7 @@ static int param_array(const char *name, + /* Get the name right for errors. */ + kp.name = name; + kp.arg = elem; ++ kp.flags = flags; + + /* No equals sign? */ + if (!val) { +@@ -353,7 +355,8 @@ int param_array_set(const char *val, str + unsigned int temp_num; + + return param_array(kp->name, val, 1, arr->max, arr->elem, +- arr->elemsize, arr->set, arr->num ?: &temp_num); ++ arr->elemsize, arr->set, kp->flags, ++ arr->num ?: &temp_num); + } + + int param_array_get(char *buffer, struct kernel_param *kp) + + +From gregkh@mini.kroah.org Fri Nov 6 14:15:44 2009 +Message-Id: <20091106221543.922283323@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 06 Nov 2009 14:14:37 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Elina Pasheva +Subject: [39/99] USB: serial: sierra driver send_setup() autopm fix +References: <20091106221358.309857998@mini.kroah.org> +Content-Disposition: inline; filename=usb-serial-sierra-driver-send_setup-autopm-fix.patch +Content-Length: 2001 +Lines: 66 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Elina Pasheva + +commit 3c77d5137d3f4ff41721e9b4f4812db56a6065c0 upstream. + +This patch presents a fix for the autosuspend feature implementation in +sierra usb serial driver for function sierra_send_setup(). Because it +is possible to call sierra_send_setup() before sierra_open() or after +sierra_close() we added a get/put interface activity to assure that the +usb control can happen even when the device is autosuspended. + +Signed-off-by: Elina Pasheva +Tested-by: Matthew Safar +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/sierra.c | 23 ++++++++++++++--------- + 1 file changed, 14 insertions(+), 9 deletions(-) + +--- a/drivers/usb/serial/sierra.c ++++ b/drivers/usb/serial/sierra.c +@@ -287,6 +287,8 @@ static int sierra_send_setup(struct usb_ + struct sierra_port_private *portdata; + __u16 interface = 0; + int val = 0; ++ int do_send = 0; ++ int retval; + + dev_dbg(&port->dev, "%s\n", __func__); + +@@ -305,10 +307,7 @@ static int sierra_send_setup(struct usb_ + */ + if (port->interrupt_in_urb) { + /* send control message */ +- return usb_control_msg(serial->dev, +- usb_rcvctrlpipe(serial->dev, 0), +- 0x22, 0x21, val, interface, +- NULL, 0, USB_CTRL_SET_TIMEOUT); ++ do_send = 1; + } + } + +@@ -320,12 +319,18 @@ static int sierra_send_setup(struct usb_ + interface = 1; + else if (port->bulk_out_endpointAddress == 5) + interface = 2; +- return usb_control_msg(serial->dev, +- usb_rcvctrlpipe(serial->dev, 0), +- 0x22, 0x21, val, interface, +- NULL, 0, USB_CTRL_SET_TIMEOUT); ++ ++ do_send = 1; + } +- return 0; ++ if (!do_send) ++ return 0; ++ ++ usb_autopm_get_interface(serial->interface); ++ retval = usb_control_msg(serial->dev, usb_rcvctrlpipe(serial->dev, 0), ++ 0x22, 0x21, val, interface, NULL, 0, USB_CTRL_SET_TIMEOUT); ++ usb_autopm_put_interface(serial->interface); ++ ++ return retval; + } + + static void sierra_set_termios(struct tty_struct *tty, + + +From gregkh@mini.kroah.org Fri Nov 6 14:15:44 2009 +Message-Id: <20091106221544.085690413@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 06 Nov 2009 14:14:38 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk +Subject: [40/99] USB: option: Patch for Huawei Mobile Broadband E270+ Modem +References: <20091106221358.309857998@mini.kroah.org> +Content-Disposition: inline; filename=usb-option-patch-for-huawei-mobile-broadband-e270-modem.patch +Content-Length: 1262 +Lines: 29 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Ronnie Furuskog + +commit 0ee3a33a0481c8f5c9edb7a5a02f3c76496d9551 upstream. + +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/option.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -166,6 +166,7 @@ static int option_resume(struct usb_ser + #define HUAWEI_PRODUCT_E143D 0x143D + #define HUAWEI_PRODUCT_E143E 0x143E + #define HUAWEI_PRODUCT_E143F 0x143F ++#define HUAWEI_PRODUCT_E14AC 0x14AC + + #define QUANTA_VENDOR_ID 0x0408 + #define QUANTA_PRODUCT_Q101 0xEA02 +@@ -426,6 +427,7 @@ static struct usb_device_id option_ids[] + { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E143D, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E143E, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E143F, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E14AC) }, + { USB_DEVICE(AMOI_VENDOR_ID, AMOI_PRODUCT_9508) }, + { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_V640) }, /* Novatel Merlin V640/XV620 */ + { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_V620) }, /* Novatel Merlin V620/S620 */ + + +From gregkh@mini.kroah.org Fri Nov 6 14:15:44 2009 +Message-Id: <20091106221544.215126415@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 06 Nov 2009 14:14:39 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Huzaifa Sidhpurwala +Subject: [41/99] USB: option: Support for AIRPLUS MCD650 Datacard +References: <20091106221358.309857998@mini.kroah.org> +Content-Disposition: inline; filename=usb-option-support-for-airplus-mcd650-datacard.patch +Content-Length: 1261 +Lines: 37 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Huzaifa Sidhpurwala + +commit 12148da6722be3b44c2220206b6ccb80d2d9d8f8 upstream. + +Here is a patch for Airplus MCD 650 card + +Note: This device is with Victor V Kudlak, and he confirmed that this +device works with the patch. + +Signed-off-by: Huzaifa Sidhpurwala +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/option.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -329,6 +329,9 @@ static int option_resume(struct usb_ser + #define ALCATEL_VENDOR_ID 0x1bbb + #define ALCATEL_PRODUCT_X060S 0x0000 + ++/* Airplus products */ ++#define AIRPLUS_VENDOR_ID 0x1011 ++#define AIRPLUS_PRODUCT_MCD650 0x3198 + + static struct usb_device_id option_ids[] = { + { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_COLT) }, +@@ -590,6 +593,7 @@ static struct usb_device_id option_ids[] + { USB_DEVICE(ALINK_VENDOR_ID, 0x9000) }, + { USB_DEVICE_AND_INTERFACE_INFO(ALINK_VENDOR_ID, ALINK_PRODUCT_3GU, 0xff, 0xff, 0xff) }, + { USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_X060S) }, ++ { USB_DEVICE(AIRPLUS_VENDOR_ID, AIRPLUS_PRODUCT_MCD650) }, + { } /* Terminating entry */ + }; + MODULE_DEVICE_TABLE(usb, option_ids); + + +From gregkh@mini.kroah.org Fri Nov 6 14:15:44 2009 +Message-Id: <20091106221544.356196567@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 06 Nov 2009 14:14:40 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Bryan Wu , + Matthias Urlichs +Subject: [42/99] USB: option: TLAYTECH TUE800 support +References: <20091106221358.309857998@mini.kroah.org> +Content-Disposition: inline; filename=usb-option-tlaytech-tue800-support.patch +Content-Length: 1179 +Lines: 35 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Bryan Wu + +commit fead2ab6cf9ad3a84a06e68ccc20d1e460fad13e upstream. + +Add ID for Tlaytech TUE800 CDMA modem to the option driver. + +Signed-off-by: Bryan Wu +Acked-By: Matthias Urlichs +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/option.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -316,6 +316,9 @@ static int option_resume(struct usb_ser + #define QISDA_PRODUCT_H20_4515 0x4515 + #define QISDA_PRODUCT_H20_4519 0x4519 + ++/* TLAYTECH PRODUCTS */ ++#define TLAYTECH_VENDOR_ID 0x20B9 ++#define TLAYTECH_PRODUCT_TEU800 0x1682 + + /* TOSHIBA PRODUCTS */ + #define TOSHIBA_VENDOR_ID 0x0930 +@@ -594,6 +597,7 @@ static struct usb_device_id option_ids[] + { USB_DEVICE_AND_INTERFACE_INFO(ALINK_VENDOR_ID, ALINK_PRODUCT_3GU, 0xff, 0xff, 0xff) }, + { USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_X060S) }, + { USB_DEVICE(AIRPLUS_VENDOR_ID, AIRPLUS_PRODUCT_MCD650) }, ++ { USB_DEVICE(TLAYTECH_VENDOR_ID, TLAYTECH_PRODUCT_TEU800) }, + { } /* Terminating entry */ + }; + MODULE_DEVICE_TABLE(usb, option_ids); + + +From gregkh@mini.kroah.org Fri Nov 6 14:15:44 2009 +Message-Id: <20091106221544.491007280@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 06 Nov 2009 14:14:41 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + David Woodhouse , + "David S. Miller" , + "John W. Linville" +Subject: [43/99] libertas if_usb: Fix crash on 64-bit machines +References: <20091106221358.309857998@mini.kroah.org> +Content-Disposition: inline; filename=libertas-if_usb-fix-crash-on-64-bit-machines.patch +Content-Length: 1455 +Lines: 37 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: David Woodhouse + +commit e9024a059f2c17fb2bfab212ee9d31511d7b8e57 upstream. + +On a 64-bit kernel, skb->tail is an offset, not a pointer. The libertas +usb driver passes it to usb_fill_bulk_urb() anyway, causing interesting +crashes. Fix that by using skb->data instead. + +This highlights a problem with usb_fill_bulk_urb(). It doesn't notice +when dma_map_single() fails and return the error to its caller as it +should. In fact it _can't_ currently return the error, since it returns +void. + +So this problem was showing up only at unmap time, after we'd already +suffered memory corruption by doing DMA to a bogus address. + +Signed-off-by: David Woodhouse +Acked-by: David S. Miller +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/libertas/if_usb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/wireless/libertas/if_usb.c ++++ b/drivers/net/wireless/libertas/if_usb.c +@@ -507,7 +507,7 @@ static int __if_usb_submit_rx_urb(struct + /* Fill the receive configuration URB and initialise the Rx call back */ + usb_fill_bulk_urb(cardp->rx_urb, cardp->udev, + usb_rcvbulkpipe(cardp->udev, cardp->ep_in), +- (void *) (skb->tail + (size_t) IPFIELD_ALIGN_OFFSET), ++ skb->data + IPFIELD_ALIGN_OFFSET, + MRVDRV_ETH_RX_PACKET_BUFFER_SIZE, callbackfn, + cardp); + + + +From gregkh@mini.kroah.org Fri Nov 6 14:15:44 2009 +Message-Id: <20091106221544.643003214@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 06 Nov 2009 14:14:42 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Kevin Hilman , + Arjan van de Ven , + Len Brown , + Venkatesh Pallipadi , + Ingo Molnar , + "Rafael J. Wysocki" +Subject: [44/99] cpuidle: always return with interrupts enabled +References: <20091106221358.309857998@mini.kroah.org> +Content-Disposition: inline; filename=cpuidle-always-return-with-interrupts-enabled.patch +Content-Length: 1855 +Lines: 52 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Kevin Hilman + +commit 246eb7f0ed1a8aeddec5313137767658f378949b upstream. + +In the case where cpuidle_idle_call() returns before changing state due to +a need_resched(), it was returning with IRQs disabled. + +The idle path assumes that the platform specific idle code returns with +interrupts enabled (although this too is undocumented AFAICT) and on ARM +we have a WARN_ON(!(irqs_disabled()) when returning from the idle loop, so +the user-visible effects were only a warning since interrupts were +eventually re-enabled later. + +On x86, this same problem exists, but there is no WARN_ON() to detect it. +As on ARM, the interrupts are eventually re-enabled, so I'm not sure of +any actual bugs triggered by this. It's primarily a +correctness/consistency fix. + +This patch ensures IRQs are (re)enabled before returning. + +Reported-by: Hemanth V +Signed-off-by: Kevin Hilman +Cc: Arjan van de Ven +Cc: Len Brown +Cc: Venkatesh Pallipadi +Cc: Ingo Molnar +Cc: "Rafael J. Wysocki" +Tested-by: Martin Michlmayr +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/cpuidle/cpuidle.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/drivers/cpuidle/cpuidle.c ++++ b/drivers/cpuidle/cpuidle.c +@@ -75,8 +75,11 @@ static void cpuidle_idle_call(void) + #endif + /* ask the governor for the next state */ + next_state = cpuidle_curr_governor->select(dev); +- if (need_resched()) ++ if (need_resched()) { ++ local_irq_enable(); + return; ++ } ++ + target_state = &dev->states[next_state]; + + /* enter the state and update stats */ + + +From gregkh@mini.kroah.org Fri Nov 6 14:15:44 2009 +Message-Id: <20091106221544.780625234@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 06 Nov 2009 14:14:43 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + "Michael S. Tsirkin" , + Rusty Russell +Subject: [45/99] virtio: order used ring after used index read +References: <20091106221358.309857998@mini.kroah.org> +Content-Disposition: inline; filename=virtio-order-used-ring-after-used-index-read.patch +Content-Length: 919 +Lines: 29 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Michael S. Tsirkin + +commit 2d61ba95034f1abbdec7729d52c740870a5eddb6 upstream. + +On SMP guests, reads from the ring might bypass used index reads. This +causes guest crashes because host writes to used index to signal ring +data readiness. Fix this by inserting rmb before used ring reads. + +Signed-off-by: Michael S. Tsirkin +Signed-off-by: Rusty Russell +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/virtio/virtio_ring.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/virtio/virtio_ring.c ++++ b/drivers/virtio/virtio_ring.c +@@ -281,6 +281,9 @@ static void *vring_get_buf(struct virtqu + return NULL; + } + ++ /* Only get used array entries after they have been exposed by host. */ ++ rmb(); ++ + i = vq->vring.used->ring[vq->last_used_idx%vq->vring.num].id; + *len = vq->vring.used->ring[vq->last_used_idx%vq->vring.num].len; + + + +From gregkh@mini.kroah.org Fri Nov 6 14:15:45 2009 +Message-Id: <20091106221544.917678408@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 06 Nov 2009 14:14:44 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Hitoshi Mitake , + Steve French +Subject: [46/99] CIFS: Fixing to avoid invalid kfree() in cifs_get_tcp_session() +References: <20091106221358.309857998@mini.kroah.org> +Content-Disposition: inline; filename=cifs-fixing-to-avoid-invalid-kfree-in-cifs_get_tcp_session.patch +Content-Length: 4097 +Lines: 102 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Steve French + +commit 8347a5cdd1422eea0470ed586274c7f29e274b47 upstream. + +trivial bug in fs/cifs/connect.c . +The bug is caused by fail of extract_hostname() +when mounting cifs file system. + +This is the situation when I noticed this bug. + +% sudo mount -t cifs //192.168.10.208 mountpoint -o options... + +Then my kernel says, + +[ 1461.807776] ------------[ cut here ]------------ +[ 1461.807781] kernel BUG at mm/slab.c:521! +[ 1461.807784] invalid opcode: 0000 [#2] PREEMPT SMP +[ 1461.807790] last sysfs file: +/sys/devices/pci0000:00/0000:00:1e.0/0000:09:02.0/resource +[ 1461.807793] CPU 0 +[ 1461.807796] Modules linked in: nls_iso8859_1 usbhid sbp2 uhci_hcd +ehci_hcd i2c_i801 ohci1394 ieee1394 psmouse serio_raw pcspkr sky2 usbcore +evdev +[ 1461.807816] Pid: 3446, comm: mount Tainted: G D 2.6.32-rc2-vanilla +[ 1461.807820] RIP: 0010:[] [] +kfree+0x63/0x156 +[ 1461.807829] RSP: 0018:ffff8800b4f7fbb8 EFLAGS: 00010046 +[ 1461.807832] RAX: ffffea00033fff98 RBX: ffff8800afbae7e2 RCX: +0000000000000000 +[ 1461.807836] RDX: ffffea0000000000 RSI: 000000000000005c RDI: +ffffffffffffffea +[ 1461.807839] RBP: ffff8800b4f7fbf8 R08: 0000000000000001 R09: +0000000000000000 +[ 1461.807842] R10: 0000000000000000 R11: ffff8800b4f7fbf8 R12: +00000000ffffffea +[ 1461.807845] R13: ffff8800afb23000 R14: ffff8800b4f87bc0 R15: +ffffffffffffffea +[ 1461.807849] FS: 00007f52b6f187c0(0000) GS:ffff880007600000(0000) +knlGS:0000000000000000 +[ 1461.807852] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b +[ 1461.807855] CR2: 0000000000613000 CR3: 00000000af8f9000 CR4: +00000000000006f0 +[ 1461.807858] DR0: 0000000000000000 DR1: 0000000000000000 DR2: +0000000000000000 +[ 1461.807861] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: +0000000000000400 +[ 1461.807865] Process mount (pid: 3446, threadinfo ffff8800b4f7e000, task +ffff8800950e4380) +[ 1461.807867] Stack: +[ 1461.807869] 0000000000000202 0000000000000282 ffff8800b4f7fbf8 +ffff8800afbae7e2 +[ 1461.807876] <0> 00000000ffffffea ffff8800afb23000 ffff8800b4f87bc0 +ffff8800b4f7fc28 +[ 1461.807884] <0> ffff8800b4f7fcd8 ffffffff81159f6d ffffffff81147bc2 +ffffffff816bfb48 +[ 1461.807892] Call Trace: +[ 1461.807899] [] cifs_get_tcp_session+0x440/0x44b +[ 1461.807904] [] ? find_nls+0x1c/0xe9 +[ 1461.807909] [] cifs_mount+0x16bc/0x2167 +[ 1461.807917] [] ? _spin_unlock+0x30/0x4b +[ 1461.807923] [] cifs_get_sb+0xa5/0x1a8 +[ 1461.807928] [] vfs_kern_mount+0x56/0xc9 +[ 1461.807933] [] do_kern_mount+0x47/0xe7 +[ 1461.807938] [] do_mount+0x712/0x775 +[ 1461.807943] [] ? copy_mount_options+0xcf/0x132 +[ 1461.807948] [] sys_mount+0x7f/0xbf +[ 1461.807953] [] ? lockdep_sys_exit_thunk+0x35/0x67 +[ 1461.807960] [] system_call_fastpath+0x16/0x1b +[ 1461.807963] Code: 00 00 00 00 ea ff ff 48 c1 e8 0c 48 6b c0 68 48 01 d0 +66 83 38 00 79 04 48 8b 40 10 66 83 38 00 79 04 48 8b 40 10 80 38 00 78 04 +<0f> 0b eb fe 4c 8b 70 58 4c 89 ff 41 8b 76 4c e8 b8 49 fb ff e8 +[ 1461.808022] RIP [] kfree+0x63/0x156 +[ 1461.808027] RSP +[ 1461.808031] ---[ end trace ffe26fcdc72c0ce4 ]--- + +The reason of this bug is that the error handling code of +cifs_get_tcp_session() +calls kfree() when corresponding kmalloc() failed. +(The kmalloc() is called by extract_hostname().) + +Signed-off-by: Hitoshi Mitake +Reviewed-by: Jeff Layton +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman + +--- + fs/cifs/connect.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/fs/cifs/connect.c ++++ b/fs/cifs/connect.c +@@ -1556,7 +1556,8 @@ cifs_get_tcp_session(struct smb_vol *vol + + out_err: + if (tcp_ses) { +- kfree(tcp_ses->hostname); ++ if (!IS_ERR(tcp_ses->hostname)) ++ kfree(tcp_ses->hostname); + if (tcp_ses->ssocket) + sock_release(tcp_ses->ssocket); + kfree(tcp_ses); + + +From gregkh@mini.kroah.org Fri Nov 6 14:15:45 2009 +Message-Id: <20091106221545.069595559@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 06 Nov 2009 14:14:45 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + =?ISO-8859-15?q?Bj=C3=B6rn=20Smedman?= , + "John W. Linville" +Subject: [47/99] mac80211: fix for incorrect sequence number on hostapd injected frames +References: <20091106221358.309857998@mini.kroah.org> +Content-Disposition: inline; filename=mac80211-fix-for-incorrect-sequence-number-on-hostapd-injected-frames.patch +Content-Length: 1422 +Lines: 37 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Björn Smedman + +commit 9b1ce526eb917c8b5c8497c327768130ee683392 upstream. + +When hostapd injects a frame, e.g. an authentication or association +response, mac80211 looks for a suitable access point virtual interface +to associate the frame with based on its source address. This makes it +possible e.g. to correctly assign sequence numbers to the frames. + +A small typo in the ethernet address comparison statement caused a +failure to find a suitable ap interface. Sequence numbers on such +frames where therefore left unassigned causing some clients +(especially windows-based 11b/g clients) to reject them and fail to +authenticate or associate with the access point. This patch fixes the +typo in the address comparison statement. + +Signed-off-by: Björn Smedman +Reviewed-by: Johannes Berg +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + net/mac80211/tx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/mac80211/tx.c ++++ b/net/mac80211/tx.c +@@ -1478,7 +1478,7 @@ int ieee80211_master_start_xmit(struct s + if (sdata->vif.type != NL80211_IFTYPE_AP) + continue; + if (compare_ether_addr(sdata->dev->dev_addr, +- hdr->addr2)) { ++ hdr->addr2) == 0) { + dev_hold(sdata->dev); + dev_put(odev); + osdata = sdata; + + +From gregkh@mini.kroah.org Fri Nov 6 14:15:45 2009 +Message-Id: <20091106221545.241612251@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 06 Nov 2009 14:14:46 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Arjan van de Ven , + Johannes Berg , + "John W. Linville" +Subject: [48/99] mac80211: check interface is down before type change +References: <20091106221358.309857998@mini.kroah.org> +Content-Disposition: inline; filename=mac80211-check-interface-is-down-before-type-change.patch +Content-Length: 1753 +Lines: 56 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Johannes Berg + +commit c1f9a764cf47686b1f5a0cf87ada68d90056136a upstream. + +For some strange reason the netif_running() check +ended up after the actual type change instead of +before, potentially causing all kinds of problems +if the interface is up while changing the type; +one of the problems manifests itself as a warning: + +WARNING: at net/mac80211/iface.c:651 ieee80211_teardown_sdata+0xda/0x1a0 [mac80211]() +Hardware name: Aspire one +Pid: 2596, comm: wpa_supplicant Tainted: G W 2.6.31-10-generic #32-Ubuntu +Call Trace: + [] warn_slowpath_common+0x6d/0xa0 + [] warn_slowpath_null+0x15/0x20 + [] ieee80211_teardown_sdata+0xda/0x1a0 [mac80211] + [] ieee80211_if_change_type+0x4a/0xc0 [mac80211] + [] ieee80211_change_iface+0x61/0xa0 [mac80211] + [] cfg80211_wext_siwmode+0xc7/0x120 [cfg80211] + [] ioctl_standard_call+0x58/0xf0 + +(http://www.kerneloops.org/searchweek.php?search=ieee80211_teardown_sdata) + +Cc: Arjan van de Ven +Signed-off-by: Johannes Berg +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + net/mac80211/cfg.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/net/mac80211/cfg.c ++++ b/net/mac80211/cfg.c +@@ -87,6 +87,9 @@ static int ieee80211_change_iface(struct + if (!dev) + return -ENODEV; + ++ if (netif_running(dev)) ++ return -EBUSY; ++ + if (!nl80211_type_check(type)) + return -EINVAL; + +@@ -96,9 +99,6 @@ static int ieee80211_change_iface(struct + if (ret) + return ret; + +- if (netif_running(sdata->dev)) +- return -EBUSY; +- + if (ieee80211_vif_is_mesh(&sdata->vif) && params->mesh_id_len) + ieee80211_sdata_set_mesh_id(sdata, + params->mesh_id_len, + + +From gregkh@mini.kroah.org Fri Nov 6 14:15:45 2009 +Message-Id: <20091106221545.409589249@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 06 Nov 2009 14:14:47 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Robin Holt , + Jack Steiner , + Cliff Whickman , + Ingo Molnar +Subject: [49/99] x86, UV: Fix information in __uv_hub_info structure +References: <20091106221358.309857998@mini.kroah.org> +Content-Disposition: inline; filename=x86-uv-fix-information-in-__uv_hub_info-structure.patch +Content-Length: 2803 +Lines: 78 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Robin Holt + +commit 036ed8ba61b72c19dc5759446d4fe0844aa88255 upstream. + +A few parts of the uv_hub_info structure are initialized +incorrectly. + + - n_val is being loaded with m_val. + - gpa_mask is initialized with a bytes instead of an unsigned long. + - Handle the case where none of the alias registers are used. + +Lastly I converted the bau over to using the uv_hub_info->m_val +which is the correct value. + +Without this patch, booting a large configuration hits a +problem where the upper bits of the gnode affect the pnode +and the bau will not operate. + +Signed-off-by: Robin Holt +Acked-by: Jack Steiner +Cc: Cliff Whickman +LKML-Reference: <20091015224946.396355000@alcatraz.americas.sgi.com> +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/apic/x2apic_uv_x.c | 8 ++++---- + arch/x86/kernel/tlb_uv.c | 4 ++-- + 2 files changed, 6 insertions(+), 6 deletions(-) + +--- a/arch/x86/kernel/apic/x2apic_uv_x.c ++++ b/arch/x86/kernel/apic/x2apic_uv_x.c +@@ -352,14 +352,14 @@ static __init void get_lowmem_redirect(u + + for (i = 0; i < ARRAY_SIZE(redir_addrs); i++) { + alias.v = uv_read_local_mmr(redir_addrs[i].alias); +- if (alias.s.base == 0) { ++ if (alias.s.enable && alias.s.base == 0) { + *size = (1UL << alias.s.m_alias); + redirect.v = uv_read_local_mmr(redir_addrs[i].redirect); + *base = (unsigned long)redirect.s.dest_base << DEST_SHIFT; + return; + } + } +- BUG(); ++ *base = *size = 0; + } + + enum map_type {map_wb, map_uc}; +@@ -609,12 +609,12 @@ void __init uv_system_init(void) + uv_cpu_hub_info(cpu)->lowmem_remap_base = lowmem_redir_base; + uv_cpu_hub_info(cpu)->lowmem_remap_top = lowmem_redir_size; + uv_cpu_hub_info(cpu)->m_val = m_val; +- uv_cpu_hub_info(cpu)->n_val = m_val; ++ uv_cpu_hub_info(cpu)->n_val = n_val; + uv_cpu_hub_info(cpu)->numa_blade_id = blade; + uv_cpu_hub_info(cpu)->blade_processor_id = lcpu; + uv_cpu_hub_info(cpu)->pnode = pnode; + uv_cpu_hub_info(cpu)->pnode_mask = pnode_mask; +- uv_cpu_hub_info(cpu)->gpa_mask = (1 << (m_val + n_val)) - 1; ++ uv_cpu_hub_info(cpu)->gpa_mask = (1UL << (m_val + n_val)) - 1; + uv_cpu_hub_info(cpu)->gnode_upper = gnode_upper; + uv_cpu_hub_info(cpu)->gnode_extra = gnode_extra; + uv_cpu_hub_info(cpu)->global_mmr_base = mmr_base; +--- a/arch/x86/kernel/tlb_uv.c ++++ b/arch/x86/kernel/tlb_uv.c +@@ -843,8 +843,8 @@ static int __init uv_bau_init(void) + GFP_KERNEL, cpu_to_node(cur_cpu)); + + uv_bau_retry_limit = 1; +- uv_nshift = uv_hub_info->n_val; +- uv_mmask = (1UL << uv_hub_info->n_val) - 1; ++ uv_nshift = uv_hub_info->m_val; ++ uv_mmask = (1UL << uv_hub_info->m_val) - 1; + nblades = uv_num_possible_blades(); + + uv_bau_table_bases = (struct bau_control **) + + +From gregkh@mini.kroah.org Fri Nov 6 14:15:45 2009 +Message-Id: <20091106221545.557546609@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 06 Nov 2009 14:14:48 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Robin Holt , + Jack Steiner , + Martin Hicks , + Ingo Molnar +Subject: [50/99] x86, UV: Set DELIVERY_MODE=4 for vector=NMI_VECTOR in uv_hub_send_ipi() +References: <20091106221358.309857998@mini.kroah.org> +Content-Disposition: inline; filename=x86-uv-set-delivery_mode-4-for-vector-nmi_vector-in-uv_hub_send_ipi.patch +Content-Length: 1447 +Lines: 50 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Robin Holt + +commit 02dd0a0613e0d84c7dd8315e3fe6204d005b7c79 upstream. + +When sending a NMI_VECTOR IPI using the UV_HUB_IPI_INT register, +we need to ensure the delivery mode field of that register has +NMI delivery selected. + +This makes those IPIs true NMIs, instead of flat IPIs. It +matters to reboot sequences and KGDB, both of which use NMI +IPIs. + +Signed-off-by: Robin Holt +Acked-by: Jack Steiner +Cc: Martin Hicks +LKML-Reference: <20091020193620.877322000@alcatraz.americas.sgi.com> +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/include/asm/uv/uv_hub.h | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/arch/x86/include/asm/uv/uv_hub.h ++++ b/arch/x86/include/asm/uv/uv_hub.h +@@ -18,6 +18,8 @@ + #include + #include + #include ++#include ++#include + + + /* +@@ -420,9 +422,14 @@ static inline void uv_set_cpu_scir_bits( + static inline void uv_hub_send_ipi(int pnode, int apicid, int vector) + { + unsigned long val; ++ unsigned long dmode = dest_Fixed; ++ ++ if (vector == NMI_VECTOR) ++ dmode = dest_NMI; + + val = (1UL << UVH_IPI_INT_SEND_SHFT) | + ((apicid) << UVH_IPI_INT_APIC_ID_SHFT) | ++ (dmode << UVH_IPI_INT_DELIVERY_MODE_SHFT) | + (vector << UVH_IPI_INT_VECTOR_SHFT); + uv_write_global_mmr64(pnode, UVH_IPI_INT, val); + } + + +From gregkh@mini.kroah.org Fri Nov 6 14:15:45 2009 +Message-Id: <20091106221545.712888699@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 06 Nov 2009 14:14:49 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + David Howells , + Robin Getz +Subject: [51/99] NOMMU: Dont pass NULL pointers to fput() in do_mmap_pgoff() +References: <20091106221358.309857998@mini.kroah.org> +Content-Disposition: inline; filename=nommu-don-t-pass-null-pointers-to-fput-in-do_mmap_pgoff.patch +Content-Length: 1460 +Lines: 44 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: David Howells + +commit 89a8640279f8bb78aaf778d1fc5c4a6778f18064 upstream. + +Don't pass NULL pointers to fput() in the error handling paths of the NOMMU +do_mmap_pgoff() as it can't handle it. + +The following can be used as a test program: + + int main() { static long long a[1024 * 1024 * 20] = { 0 }; return a;} + +Without the patch, the code oopses in atomic_long_dec_and_test() as called by +fput() after the kernel complains that it can't allocate that big a chunk of +memory. With the patch, the kernel just complains about the allocation size +and then the program segfaults during execve() as execve() can't complete the +allocation of all the new ELF program segments. + +Reported-by: Robin Getz +Signed-off-by: David Howells +Acked-by: Robin Getz +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/nommu.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/mm/nommu.c ++++ b/mm/nommu.c +@@ -1384,9 +1384,11 @@ share: + error_just_free: + up_write(&nommu_region_sem); + error: +- fput(region->vm_file); ++ if (region->vm_file) ++ fput(region->vm_file); + kmem_cache_free(vm_region_jar, region); +- fput(vma->vm_file); ++ if (vma->vm_file) ++ fput(vma->vm_file); + if (vma->vm_flags & VM_EXECUTABLE) + removed_exe_file_vma(vma->vm_mm); + kmem_cache_free(vm_area_cachep, vma); + + +From gregkh@mini.kroah.org Fri Nov 6 14:15:45 2009 +Message-Id: <20091106221545.853603990@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 06 Nov 2009 14:14:50 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Bo Liu , + Hugh Dickins +Subject: [52/99] mm: remove incorrect swap_count() from try_to_unuse() +References: <20091106221358.309857998@mini.kroah.org> +Content-Disposition: inline; filename=mm-remove-incorrect-swap_count-from-try_to_unuse.patch +Content-Length: 1458 +Lines: 39 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Bo Liu + +commit 32c5fc10e79a7053ac5728b01a0bff55cbcb9d49 upstream. + +In try_to_unuse(), swcount is a local copy of *swap_map, including the +SWAP_HAS_CACHE bit; but a wrong comparison against swap_count(*swap_map), +which masks off the SWAP_HAS_CACHE bit, succeeded where it should fail. + +That had the effect of resetting the mm from which to start searching +for the next swap page, to an irrelevant mm instead of to an mm in which +this swap page had been found: which may increase search time by ~20%. +But we're used to swapoff being slow, so never noticed the slowdown. + +Remove that one spurious use of swap_count(): Bo Liu thought it merely +redundant, Hugh rewrote the description since it was measurably wrong. + +Signed-off-by: Bo Liu +Signed-off-by: Hugh Dickins +Reviewed-by: KAMEZAWA Hiroyuki +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/swapfile.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/mm/swapfile.c ++++ b/mm/swapfile.c +@@ -1149,8 +1149,7 @@ static int try_to_unuse(unsigned int typ + } else + retval = unuse_mm(mm, entry, page); + +- if (set_start_mm && +- swap_count(*swap_map) < swcount) { ++ if (set_start_mm && *swap_map < swcount) { + mmput(new_start_mm); + atomic_inc(&mm->mm_users); + new_start_mm = mm; + + +From gregkh@mini.kroah.org Fri Nov 6 14:15:46 2009 +Message-Id: <20091106221546.018042424@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 06 Nov 2009 14:14:51 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jan Beulich , + Roland McGrath , + Ingo Molnar +Subject: [53/99] x86-64: Fix register leak in 32-bit syscall audting +References: <20091106221358.309857998@mini.kroah.org> +Content-Disposition: inline; filename=x86-64-fix-register-leak-in-32-bit-syscall-audting.patch +Content-Length: 1651 +Lines: 50 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Jan Beulich + +commit 81766741fe1eee3884219e8daaf03f466f2ed52f upstream. + +Restoring %ebp after the call to audit_syscall_exit() is not +only unnecessary (because the register didn't get clobbered), +but in the sysenter case wasn't even doing the right thing: It +loaded %ebp from a location below the top of stack (RBP < +ARGOFFSET), i.e. arbitrary kernel data got passed back to user +mode in the register. + +Signed-off-by: Jan Beulich +Acked-by: Roland McGrath +LKML-Reference: <4AE5CC4D020000780001BD13@vpn.id2.novell.com> +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/ia32/ia32entry.S | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +--- a/arch/x86/ia32/ia32entry.S ++++ b/arch/x86/ia32/ia32entry.S +@@ -204,7 +204,7 @@ sysexit_from_sys_call: + movl RDI-ARGOFFSET(%rsp),%r8d /* reload 5th syscall arg */ + .endm + +- .macro auditsys_exit exit,ebpsave=RBP ++ .macro auditsys_exit exit + testl $(_TIF_ALLWORK_MASK & ~_TIF_SYSCALL_AUDIT),TI_flags(%r10) + jnz ia32_ret_from_sys_call + TRACE_IRQS_ON +@@ -217,7 +217,6 @@ sysexit_from_sys_call: + call audit_syscall_exit + GET_THREAD_INFO(%r10) + movl RAX-ARGOFFSET(%rsp),%eax /* reload syscall return value */ +- movl \ebpsave-ARGOFFSET(%rsp),%ebp /* reload user register value */ + movl $(_TIF_ALLWORK_MASK & ~_TIF_SYSCALL_AUDIT),%edi + cli + TRACE_IRQS_OFF +@@ -351,7 +350,7 @@ cstar_auditsys: + jmp cstar_dispatch + + sysretl_audit: +- auditsys_exit sysretl_from_sys_call, RCX /* user %ebp in RCX slot */ ++ auditsys_exit sysretl_from_sys_call + #endif + + cstar_tracesys: + + +From gregkh@mini.kroah.org Fri Nov 6 14:15:46 2009 +Message-Id: <20091106221546.158296779@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 06 Nov 2009 14:14:52 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Ryusuke Konishi +Subject: [54/99] nilfs2: fix dirty page accounting leak causing hang at write +References: <20091106221358.309857998@mini.kroah.org> +Content-Disposition: inline; filename=nilfs2-fix-dirty-page-accounting-leak-causing-hang-at-write.patch +Content-Length: 1251 +Lines: 37 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Ryusuke Konishi + +commit b1e19e5601277845b4f17ecd7c9ba04f73ee11aa upstream. + +Bruno Prémont and Dunphy, Bill noticed me that NILFS will certainly +hang on ARM-based targets. + +I found this was caused by an underflow of dirty pages counter. A +b-tree cache routine was marking page dirty without adjusting page +account information. + +This fixes the dirty page accounting leak and resolves the hang on +arm-based targets. + +Reported-by: Bruno Prémont +Reported-by: Dunphy, Bill +Signed-off-by: Ryusuke Konishi +Tested-by: Bruno Prémont +Signed-off-by: Greg Kroah-Hartman + +--- + fs/nilfs2/btnode.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/fs/nilfs2/btnode.c ++++ b/fs/nilfs2/btnode.c +@@ -276,8 +276,7 @@ void nilfs_btnode_commit_change_key(stru + "invalid oldkey %lld (newkey=%lld)", + (unsigned long long)oldkey, + (unsigned long long)newkey); +- if (!test_set_buffer_dirty(obh) && TestSetPageDirty(opage)) +- BUG(); ++ nilfs_btnode_mark_dirty(obh); + + spin_lock_irq(&btnc->tree_lock); + radix_tree_delete(&btnc->page_tree, oldkey); + + +From gregkh@mini.kroah.org Fri Nov 6 14:15:46 2009 +Message-Id: <20091106221546.297423527@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 06 Nov 2009 14:14:53 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Zhenyu Wang , + Eric Anholt +Subject: [55/99] drm/i915: Fix FDI M/N setting according with correct color depth +References: <20091106221358.309857998@mini.kroah.org> +Content-Disposition: inline; filename=drm-i915-fix-fdi-m-n-setting-according-with-correct-color-depth.patch +Content-Length: 2912 +Lines: 97 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Zhenyu Wang + +commit 58a27471d00dc09945cbcfbbc5cbcdcd3c28211d upstream. + +FDI M/N calculation hasn't taken the current pipe color depth into account, +but always set as 24bpp. This one checks current pipe color depth setting, +and change FDI M/N calculation a little to use bits_per_pixel first, then +convert to bytes_per_pixel later. + +This fixes display corrupt issue on Arrandle LVDS with 1600x900 panel +in 18bpp dual-channel mode. + +Signed-off-by: Zhenyu Wang +Signed-off-by: Eric Anholt +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/i915_reg.h | 5 +++++ + drivers/gpu/drm/i915/intel_display.c | 31 +++++++++++++++++++++++++++---- + 2 files changed, 32 insertions(+), 4 deletions(-) + +--- a/drivers/gpu/drm/i915/i915_reg.h ++++ b/drivers/gpu/drm/i915/i915_reg.h +@@ -1616,6 +1616,11 @@ + #define PIPE_START_VBLANK_INTERRUPT_STATUS (1UL<<2) /* 965 or later */ + #define PIPE_VBLANK_INTERRUPT_STATUS (1UL<<1) + #define PIPE_OVERLAY_UPDATED_STATUS (1UL<<0) ++#define PIPE_BPC_MASK (7 << 5) /* Ironlake */ ++#define PIPE_8BPC (0 << 5) ++#define PIPE_10BPC (1 << 5) ++#define PIPE_6BPC (2 << 5) ++#define PIPE_12BPC (3 << 5) + + #define DSPARB 0x70030 + #define DSPARB_CSTART_MASK (0x7f << 7) +--- a/drivers/gpu/drm/i915/intel_display.c ++++ b/drivers/gpu/drm/i915/intel_display.c +@@ -1764,7 +1764,7 @@ fdi_reduce_ratio(u32 *num, u32 *den) + #define LINK_N 0x80000 + + static void +-igdng_compute_m_n(int bytes_per_pixel, int nlanes, ++igdng_compute_m_n(int bits_per_pixel, int nlanes, + int pixel_clock, int link_clock, + struct fdi_m_n *m_n) + { +@@ -1774,7 +1774,8 @@ igdng_compute_m_n(int bytes_per_pixel, i + + temp = (u64) DATA_N * pixel_clock; + temp = div_u64(temp, link_clock); +- m_n->gmch_m = div_u64(temp * bytes_per_pixel, nlanes); ++ m_n->gmch_m = div_u64(temp * bits_per_pixel, nlanes); ++ m_n->gmch_m >>= 3; /* convert to bytes_per_pixel */ + m_n->gmch_n = DATA_N; + fdi_reduce_ratio(&m_n->gmch_m, &m_n->gmch_n); + +@@ -2396,7 +2397,7 @@ static int intel_crtc_mode_set(struct dr + + /* FDI link */ + if (IS_IGDNG(dev)) { +- int lane, link_bw; ++ int lane, link_bw, bpp; + /* eDP doesn't require FDI link, so just set DP M/N + according to current link config */ + if (is_edp) { +@@ -2415,7 +2416,29 @@ static int intel_crtc_mode_set(struct dr + lane = 4; + link_bw = 270000; + } +- igdng_compute_m_n(3, lane, target_clock, ++ ++ /* determine panel color depth */ ++ temp = I915_READ(pipeconf_reg); ++ ++ switch (temp & PIPE_BPC_MASK) { ++ case PIPE_8BPC: ++ bpp = 24; ++ break; ++ case PIPE_10BPC: ++ bpp = 30; ++ break; ++ case PIPE_6BPC: ++ bpp = 18; ++ break; ++ case PIPE_12BPC: ++ bpp = 36; ++ break; ++ default: ++ DRM_ERROR("unknown pipe bpc value\n"); ++ bpp = 24; ++ } ++ ++ igdng_compute_m_n(bpp, lane, target_clock, + link_bw, &m_n); + } + + + +From gregkh@mini.kroah.org Fri Nov 6 14:15:46 2009 +Message-Id: <20091106221546.450155859@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 06 Nov 2009 14:14:54 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Zhenyu Wang , + Eric Anholt +Subject: [56/99] drm/i915: fix to setup display reference clock control on Ironlake +References: <20091106221358.309857998@mini.kroah.org> +Content-Disposition: inline; filename=drm-i915-fix-to-setup-display-reference-clock-control-on-ironlake.patch +Content-Length: 2924 +Lines: 87 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Zhenyu Wang + +commit c038e51e841581cc3fb9a76e5e16331331e9c85c upstream. + +For new stepping of PCH, the display reference clock +is fully under driver's control. This one trys to setup +all needed reference clock for different outputs. Older +stepping of PCH chipset should be ignoring this. + +This fixes output failure issue on newer PCH which requires +driver to take control of reference clock enabling. + +Signed-off-by: Zhenyu Wang +Signed-off-by: Eric Anholt +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/i915_reg.h | 4 +-- + drivers/gpu/drm/i915/intel_display.c | 40 +++++++++++++++++++++++++++++++++++ + 2 files changed, 42 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/i915/i915_reg.h ++++ b/drivers/gpu/drm/i915/i915_reg.h +@@ -1990,11 +1990,11 @@ + #define DREF_CPU_SOURCE_OUTPUT_MASK (3<<13) + #define DREF_SSC_SOURCE_DISABLE (0<<11) + #define DREF_SSC_SOURCE_ENABLE (2<<11) +-#define DREF_SSC_SOURCE_MASK (2<<11) ++#define DREF_SSC_SOURCE_MASK (3<<11) + #define DREF_NONSPREAD_SOURCE_DISABLE (0<<9) + #define DREF_NONSPREAD_CK505_ENABLE (1<<9) + #define DREF_NONSPREAD_SOURCE_ENABLE (2<<9) +-#define DREF_NONSPREAD_SOURCE_MASK (2<<9) ++#define DREF_NONSPREAD_SOURCE_MASK (3<<9) + #define DREF_SUPERSPREAD_SOURCE_DISABLE (0<<7) + #define DREF_SUPERSPREAD_SOURCE_ENABLE (2<<7) + #define DREF_SSC4_DOWNSPREAD (0<<6) +--- a/drivers/gpu/drm/i915/intel_display.c ++++ b/drivers/gpu/drm/i915/intel_display.c +@@ -2442,6 +2442,46 @@ static int intel_crtc_mode_set(struct dr + link_bw, &m_n); + } + ++ /* Ironlake: try to setup display ref clock before DPLL ++ * enabling. This is only under driver's control after ++ * PCH B stepping, previous chipset stepping should be ++ * ignoring this setting. ++ */ ++ if (IS_IGDNG(dev)) { ++ temp = I915_READ(PCH_DREF_CONTROL); ++ /* Always enable nonspread source */ ++ temp &= ~DREF_NONSPREAD_SOURCE_MASK; ++ temp |= DREF_NONSPREAD_SOURCE_ENABLE; ++ I915_WRITE(PCH_DREF_CONTROL, temp); ++ POSTING_READ(PCH_DREF_CONTROL); ++ ++ temp &= ~DREF_SSC_SOURCE_MASK; ++ temp |= DREF_SSC_SOURCE_ENABLE; ++ I915_WRITE(PCH_DREF_CONTROL, temp); ++ POSTING_READ(PCH_DREF_CONTROL); ++ ++ udelay(200); ++ ++ if (is_edp) { ++ if (dev_priv->lvds_use_ssc) { ++ temp |= DREF_SSC1_ENABLE; ++ I915_WRITE(PCH_DREF_CONTROL, temp); ++ POSTING_READ(PCH_DREF_CONTROL); ++ ++ udelay(200); ++ ++ temp &= ~DREF_CPU_SOURCE_OUTPUT_MASK; ++ temp |= DREF_CPU_SOURCE_OUTPUT_DOWNSPREAD; ++ I915_WRITE(PCH_DREF_CONTROL, temp); ++ POSTING_READ(PCH_DREF_CONTROL); ++ } else { ++ temp |= DREF_CPU_SOURCE_OUTPUT_NONSPREAD; ++ I915_WRITE(PCH_DREF_CONTROL, temp); ++ POSTING_READ(PCH_DREF_CONTROL); ++ } ++ } ++ } ++ + if (IS_IGD(dev)) + fp = (1 << clock.n) << 16 | clock.m1 << 8 | clock.m2; + else + + +From gregkh@mini.kroah.org Fri Nov 6 14:15:46 2009 +Message-Id: <20091106221546.595113397@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 06 Nov 2009 14:14:55 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Zhenyu Wang , + Eric Anholt +Subject: [57/99] drm/i915: fix panel fitting filter coefficient select for Ironlake +References: <20091106221358.309857998@mini.kroah.org> +Content-Disposition: inline; filename=drm-i915-fix-panel-fitting-filter-coefficient-select-for-ironlake.patch +Content-Length: 1549 +Lines: 44 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Zhenyu Wang + +commit b1f60b7029989da71fd8ea1b1176480fac9e846c upstream. + +Must set filter selection as hardcoded coefficients for medium 3x3 +filtering, which matches vbios setting for Ironlake. + +This fixes display corrupt issue on HP arrandale with new vbios. + +Signed-off-by: Zhenyu Wang +Signed-off-by: Eric Anholt +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/i915_reg.h | 5 +++++ + drivers/gpu/drm/i915/intel_display.c | 2 +- + 2 files changed, 6 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/i915/i915_reg.h ++++ b/drivers/gpu/drm/i915/i915_reg.h +@@ -1871,6 +1871,11 @@ + #define PFA_CTL_1 0x68080 + #define PFB_CTL_1 0x68880 + #define PF_ENABLE (1<<31) ++#define PF_FILTER_MASK (3<<23) ++#define PF_FILTER_PROGRAMMED (0<<23) ++#define PF_FILTER_MED_3x3 (1<<23) ++#define PF_FILTER_EDGE_ENHANCE (2<<23) ++#define PF_FILTER_EDGE_SOFTEN (3<<23) + #define PFA_WIN_SZ 0x68074 + #define PFB_WIN_SZ 0x68874 + #define PFA_WIN_POS 0x68070 +--- a/drivers/gpu/drm/i915/intel_display.c ++++ b/drivers/gpu/drm/i915/intel_display.c +@@ -1213,7 +1213,7 @@ static void igdng_crtc_dpms(struct drm_c + /* Enable panel fitting for LVDS */ + if (intel_pipe_has_type(crtc, INTEL_OUTPUT_LVDS)) { + temp = I915_READ(pf_ctl_reg); +- I915_WRITE(pf_ctl_reg, temp | PF_ENABLE); ++ I915_WRITE(pf_ctl_reg, temp | PF_ENABLE | PF_FILTER_MED_3x3); + + /* currently full aspect */ + I915_WRITE(pf_win_pos, 0); + + +From gregkh@mini.kroah.org Fri Nov 6 14:15:46 2009 +Message-Id: <20091106221546.733836681@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 06 Nov 2009 14:14:56 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Fabian Henze , + Zhenyu Wang , + Eric Anholt +Subject: [58/99] agp/intel: Add B43 chipset support +References: <20091106221358.309857998@mini.kroah.org> +Content-Disposition: inline; filename=agp-intel-add-b43-chipset-support.patch +Content-Length: 2524 +Lines: 59 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Fabian Henze + +commit 38d8a95621b20ed7868e232a35a26ee61bdcae6f upstream. + +Signed-off-by: Fabian Henze +[Fix reversed HB & IG ids for B43] +Signed-off-by: Zhenyu Wang +Signed-off-by: Eric Anholt +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/char/agp/intel-agp.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/char/agp/intel-agp.c ++++ b/drivers/char/agp/intel-agp.c +@@ -36,6 +36,8 @@ + #define PCI_DEVICE_ID_INTEL_Q35_IG 0x29B2 + #define PCI_DEVICE_ID_INTEL_Q33_HB 0x29D0 + #define PCI_DEVICE_ID_INTEL_Q33_IG 0x29D2 ++#define PCI_DEVICE_ID_INTEL_B43_HB 0x2E40 ++#define PCI_DEVICE_ID_INTEL_B43_IG 0x2E42 + #define PCI_DEVICE_ID_INTEL_GM45_HB 0x2A40 + #define PCI_DEVICE_ID_INTEL_GM45_IG 0x2A42 + #define PCI_DEVICE_ID_INTEL_IGD_E_HB 0x2E00 +@@ -81,6 +83,7 @@ + agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_G45_HB || \ + agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_GM45_HB || \ + agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_G41_HB || \ ++ agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_B43_HB || \ + agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_IGDNG_D_HB || \ + agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_IGDNG_M_HB || \ + agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_IGDNG_MA_HB) +@@ -1232,6 +1235,7 @@ static void intel_i965_get_gtt_range(int + case PCI_DEVICE_ID_INTEL_Q45_HB: + case PCI_DEVICE_ID_INTEL_G45_HB: + case PCI_DEVICE_ID_INTEL_G41_HB: ++ case PCI_DEVICE_ID_INTEL_B43_HB: + case PCI_DEVICE_ID_INTEL_IGDNG_D_HB: + case PCI_DEVICE_ID_INTEL_IGDNG_M_HB: + case PCI_DEVICE_ID_INTEL_IGDNG_MA_HB: +@@ -2208,6 +2212,8 @@ static const struct intel_driver_descrip + "Q45/Q43", NULL, &intel_i965_driver }, + { PCI_DEVICE_ID_INTEL_G45_HB, PCI_DEVICE_ID_INTEL_G45_IG, 0, + "G45/G43", NULL, &intel_i965_driver }, ++ { PCI_DEVICE_ID_INTEL_B43_HB, PCI_DEVICE_ID_INTEL_B43_IG, 0, ++ "B43", NULL, &intel_i965_driver }, + { PCI_DEVICE_ID_INTEL_G41_HB, PCI_DEVICE_ID_INTEL_G41_IG, 0, + "G41", NULL, &intel_i965_driver }, + { PCI_DEVICE_ID_INTEL_IGDNG_D_HB, PCI_DEVICE_ID_INTEL_IGDNG_D_IG, 0, +@@ -2408,6 +2414,7 @@ static struct pci_device_id agp_intel_pc + ID(PCI_DEVICE_ID_INTEL_Q45_HB), + ID(PCI_DEVICE_ID_INTEL_G45_HB), + ID(PCI_DEVICE_ID_INTEL_G41_HB), ++ ID(PCI_DEVICE_ID_INTEL_B43_HB), + ID(PCI_DEVICE_ID_INTEL_IGDNG_D_HB), + ID(PCI_DEVICE_ID_INTEL_IGDNG_M_HB), + ID(PCI_DEVICE_ID_INTEL_IGDNG_MA_HB), + + +From gregkh@mini.kroah.org Fri Nov 6 14:15:47 2009 +Message-Id: <20091106221546.888116969@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 06 Nov 2009 14:14:57 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Fabian Henze , + Zhenyu Wang , + Eric Anholt +Subject: [59/99] drm/i915: add B43 chipset support +References: <20091106221358.309857998@mini.kroah.org> +Content-Disposition: inline; filename=drm-i915-add-b43-chipset-support.patch +Content-Length: 1819 +Lines: 43 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Fabian Henze + +commit 7839c5d5519b6d9e2ccf3cdbf1c39e3817ad0835 upstream. + +Signed-off-by: Fabian Henze +Signed-off-by: Zhenyu Wang +Signed-off-by: Eric Anholt +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/i915_drv.h | 2 ++ + include/drm/drm_pciids.h | 1 + + 2 files changed, 3 insertions(+) + +--- a/drivers/gpu/drm/i915/i915_drv.h ++++ b/drivers/gpu/drm/i915/i915_drv.h +@@ -854,6 +854,7 @@ extern int i915_wait_ring(struct drm_dev + (dev)->pci_device == 0x2E12 || \ + (dev)->pci_device == 0x2E22 || \ + (dev)->pci_device == 0x2E32 || \ ++ (dev)->pci_device == 0x2E42 || \ + (dev)->pci_device == 0x0042 || \ + (dev)->pci_device == 0x0046) + +@@ -866,6 +867,7 @@ extern int i915_wait_ring(struct drm_dev + (dev)->pci_device == 0x2E12 || \ + (dev)->pci_device == 0x2E22 || \ + (dev)->pci_device == 0x2E32 || \ ++ (dev)->pci_device == 0x2E42 || \ + IS_GM45(dev)) + + #define IS_IGDG(dev) ((dev)->pci_device == 0xa001) +--- a/include/drm/drm_pciids.h ++++ b/include/drm/drm_pciids.h +@@ -552,6 +552,7 @@ + {0x8086, 0x2e12, PCI_ANY_ID, PCI_ANY_ID, PCI_CLASS_DISPLAY_VGA << 8, 0xffff00, 0}, \ + {0x8086, 0x2e22, PCI_ANY_ID, PCI_ANY_ID, PCI_CLASS_DISPLAY_VGA << 8, 0xffff00, 0}, \ + {0x8086, 0x2e32, PCI_ANY_ID, PCI_ANY_ID, PCI_CLASS_DISPLAY_VGA << 8, 0xffff00, 0}, \ ++ {0x8086, 0x2e42, PCI_ANY_ID, PCI_ANY_ID, PCI_CLASS_DISPLAY_VGA << 8, 0xffff00, 0}, \ + {0x8086, 0xa001, PCI_ANY_ID, PCI_ANY_ID, PCI_CLASS_DISPLAY_VGA << 8, 0xffff00, 0}, \ + {0x8086, 0xa011, PCI_ANY_ID, PCI_ANY_ID, PCI_CLASS_DISPLAY_VGA << 8, 0xffff00, 0}, \ + {0x8086, 0x35e8, PCI_ANY_ID, PCI_ANY_ID, PCI_CLASS_DISPLAY_VGA << 8, 0xffff00, 0}, \ + + +From gregkh@mini.kroah.org Fri Nov 6 14:15:47 2009 +Message-Id: <20091106221547.023042710@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 06 Nov 2009 14:14:58 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jeremy Fitzhardinge +Subject: [60/99] xen/hvc: make sure console output is always emitted, with explicit polling +References: <20091106221358.309857998@mini.kroah.org> +Content-Disposition: inline; filename=xen-hvc-make-sure-console-output-is-always-emitted-with-explicit-polling.patch +Content-Length: 1696 +Lines: 59 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Jeremy Fitzhardinge + +commit 7825cf10e31c64ece3cac66fb01a742f1094da51 upstream. + +We never want to rely on the hvc workqueue to emit output, because the +most interesting output is when the kernel is broken. This will +improve oops/crash/console message for better debugging. + +Instead, we force-poll until all output is emitted. + +Signed-off-by: Jeremy Fitzhardinge +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/char/hvc_xen.c | 25 ++++++++++++++++++++++++- + 1 file changed, 24 insertions(+), 1 deletion(-) + +--- a/drivers/char/hvc_xen.c ++++ b/drivers/char/hvc_xen.c +@@ -55,7 +55,7 @@ static inline void notify_daemon(void) + notify_remote_via_evtchn(xen_start_info->console.domU.evtchn); + } + +-static int write_console(uint32_t vtermno, const char *data, int len) ++static int __write_console(const char *data, int len) + { + struct xencons_interface *intf = xencons_interface(); + XENCONS_RING_IDX cons, prod; +@@ -76,6 +76,29 @@ static int write_console(uint32_t vtermn + return sent; + } + ++static int write_console(uint32_t vtermno, const char *data, int len) ++{ ++ int ret = len; ++ ++ /* ++ * Make sure the whole buffer is emitted, polling if ++ * necessary. We don't ever want to rely on the hvc daemon ++ * because the most interesting console output is when the ++ * kernel is crippled. ++ */ ++ while (len) { ++ int sent = __write_console(data, len); ++ ++ data += sent; ++ len -= sent; ++ ++ if (unlikely(len)) ++ HYPERVISOR_sched_op(SCHEDOP_yield, NULL); ++ } ++ ++ return ret; ++} ++ + static int read_console(uint32_t vtermno, char *buf, int len) + { + struct xencons_interface *intf = xencons_interface(); + + +From gregkh@mini.kroah.org Fri Nov 6 14:15:47 2009 +Message-Id: <20091106221547.180631669@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 06 Nov 2009 14:14:59 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jeremy Fitzhardinge +Subject: [61/99] xen: mask extended topology info in cpuid +References: <20091106221358.309857998@mini.kroah.org> +Content-Disposition: inline; filename=xen-mask-extended-topology-info-in-cpuid.patch +Content-Length: 1413 +Lines: 53 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Jeremy Fitzhardinge + +commit 82d6469916c6fcfa345636a49004c9d1753905d1 upstream. + +A Xen guest never needs to know about extended topology, and knowing +would just confuse it. + +This patch just zeros ebx in leaf 0xb which indicates no topology info, +preventing a crash under Xen on cpus which support this leaf. + +Signed-off-by: Jeremy Fitzhardinge + +--- + arch/x86/xen/enlighten.c | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +--- a/arch/x86/xen/enlighten.c ++++ b/arch/x86/xen/enlighten.c +@@ -178,6 +178,7 @@ static __read_mostly unsigned int cpuid_ + static void xen_cpuid(unsigned int *ax, unsigned int *bx, + unsigned int *cx, unsigned int *dx) + { ++ unsigned maskebx = ~0; + unsigned maskecx = ~0; + unsigned maskedx = ~0; + +@@ -185,9 +186,16 @@ static void xen_cpuid(unsigned int *ax, + * Mask out inconvenient features, to try and disable as many + * unsupported kernel subsystems as possible. + */ +- if (*ax == 1) { ++ switch (*ax) { ++ case 1: + maskecx = cpuid_leaf1_ecx_mask; + maskedx = cpuid_leaf1_edx_mask; ++ break; ++ ++ case 0xb: ++ /* Suppress extended topology stuff */ ++ maskebx = 0; ++ break; + } + + asm(XEN_EMULATE_PREFIX "cpuid" +@@ -197,6 +205,7 @@ static void xen_cpuid(unsigned int *ax, + "=d" (*dx) + : "0" (*ax), "2" (*cx)); + ++ *bx &= maskebx; + *cx &= maskecx; + *dx &= maskedx; + } + + +From gregkh@mini.kroah.org Fri Nov 6 14:15:47 2009 +Message-Id: <20091106221547.296924651@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 06 Nov 2009 14:15:00 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Michael Buesch , + Jiri Kosina , + Michael Gilbert +Subject: [62/99] sgi-gru: decrapfiy options_write() function +References: <20091106221358.309857998@mini.kroah.org> +Content-Disposition: inline; filename=sgi-gru-decrapfiy-options_write-function.patch +Content-Length: 1519 +Lines: 50 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Linus Torvalds + +commit d39b7dd1dcbf394a1cb897457c862dafe9a20ac5 upstream. + +Not a single line of actual code in the function was really +fundamentally correct. + +Problems ranged from lack of proper range checking, to removing the last +character written (which admittedly is usually '\n'), to not accepting +hex numbers even though the 'show' routine would show the data in that +format. + +This tries to do better. + +Acked-by: Michael Buesch +Tested-and-acked-by: Jack Steiner +Cc: Jiri Kosina +Cc: Michael Gilbert +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/misc/sgi-gru/gruprocfs.c | 13 +++++++------ + 1 file changed, 7 insertions(+), 6 deletions(-) + +--- a/drivers/misc/sgi-gru/gruprocfs.c ++++ b/drivers/misc/sgi-gru/gruprocfs.c +@@ -161,14 +161,15 @@ static int options_show(struct seq_file + static ssize_t options_write(struct file *file, const char __user *userbuf, + size_t count, loff_t *data) + { +- unsigned long val; +- char buf[80]; ++ char buf[20]; + +- if (strncpy_from_user(buf, userbuf, sizeof(buf) - 1) < 0) ++ if (count >= sizeof(buf)) ++ return -EINVAL; ++ if (copy_from_user(buf, userbuf, count)) + return -EFAULT; +- buf[count - 1] = '\0'; +- if (!strict_strtoul(buf, 10, &val)) +- gru_options = val; ++ buf[count] = '\0'; ++ if (strict_strtoul(buf, 0, &gru_options)) ++ return -EINVAL; + + return count; + } + + +From gregkh@mini.kroah.org Fri Nov 6 14:15:47 2009 +Message-Id: <20091106221547.437604054@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 06 Nov 2009 14:15:01 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Gleb Natapov , + Avi Kivity +Subject: [63/99] KVM: get_tss_base_addr() should return a gpa_t +References: <20091106221358.309857998@mini.kroah.org> +Content-Disposition: inline; filename=kvm-get_tss_base_addr-should-return-a-gpa_t.patch +Content-Length: 829 +Lines: 28 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Gleb Natapov + +commit abb3911965c1bd8eea305f64d4840a314259d96d upstream. + +If TSS we are switching to resides in high memory task switch will fail +since address will be truncated. Windows2k3 does this sometimes when +running with more then 4G + +Signed-off-by: Gleb Natapov +Signed-off-by: Avi Kivity +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kvm/x86.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/x86/kvm/x86.c ++++ b/arch/x86/kvm/x86.c +@@ -3762,7 +3762,7 @@ static int save_guest_segment_descriptor + return kvm_write_guest(vcpu->kvm, gpa, seg_desc, 8); + } + +-static u32 get_tss_base_addr(struct kvm_vcpu *vcpu, ++static gpa_t get_tss_base_addr(struct kvm_vcpu *vcpu, + struct desc_struct *seg_desc) + { + u32 base_addr; + + +From gregkh@mini.kroah.org Fri Nov 6 14:15:47 2009 +Message-Id: <20091106221547.581202341@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 06 Nov 2009 14:15:02 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + "Anand V. Avati" , + Miklos Szeredi +Subject: [64/99] fuse: prevent fuse_put_request on invalid pointer +References: <20091106221358.309857998@mini.kroah.org> +Content-Disposition: inline; filename=fuse-prevent-fuse_put_request-on-invalid-pointer.patch +Content-Length: 770 +Lines: 29 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Anand V. Avati + +commit f60311d5f7670d9539b424e4ed8b5c0872fc9e83 upstream. + +fuse_direct_io() has a loop where requests are allocated in each +iteration. if allocation fails, the loop is broken out and follows +into an unconditional fuse_put_request() on that invalid pointer. + +Signed-off-by: Anand V. Avati +Signed-off-by: Miklos Szeredi +Signed-off-by: Greg Kroah-Hartman + +--- + fs/fuse/file.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/fs/fuse/file.c ++++ b/fs/fuse/file.c +@@ -1063,7 +1063,8 @@ ssize_t fuse_direct_io(struct file *file + break; + } + } +- fuse_put_request(fc, req); ++ if (!IS_ERR(req)) ++ fuse_put_request(fc, req); + if (res > 0) + *ppos = pos; + + + +From gregkh@mini.kroah.org Fri Nov 6 14:15:47 2009 +Message-Id: <20091106221547.727479100@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 06 Nov 2009 14:15:03 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jens Axboe , + Miklos Szeredi , + Tejun Heo +Subject: [65/99] fuse: fix kunmap in fuse_ioctl_copy_user +References: <20091106221358.309857998@mini.kroah.org> +Content-Disposition: inline; filename=fuse-fix-kunmap-in-fuse_ioctl_copy_user.patch +Content-Length: 677 +Lines: 29 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Jens Axboe + +commit 0bd87182d3ab18a32a8e9175d3f68754c58e3432 upstream. + +Looks like another victim of the confusing kmap() vs kmap_atomic() API +differences. + +Reported-by: Todor Gyumyushev +Signed-off-by: Jens Axboe +Signed-off-by: Miklos Szeredi +Cc: Tejun Heo +Signed-off-by: Greg Kroah-Hartman + +--- + fs/fuse/file.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/fuse/file.c ++++ b/fs/fuse/file.c +@@ -1600,7 +1600,7 @@ static int fuse_ioctl_copy_user(struct p + kaddr += copy; + } + +- kunmap(map); ++ kunmap(page); + } + + return 0; + + +From gregkh@mini.kroah.org Fri Nov 6 14:15:47 2009 +Message-Id: <20091106221547.857126995@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 06 Nov 2009 14:15:04 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Joerg Roedel +Subject: [66/99] x86/amd-iommu: Workaround for erratum 63 +References: <20091106221358.309857998@mini.kroah.org> +Content-Disposition: inline; filename=x86-amd-iommu-workaround-for-erratum-63.patch +Content-Length: 2527 +Lines: 82 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Joerg Roedel + +commit c5cca146aa03e1f60fb179df65f0dbaf17bc64ed upstream. + +There is an erratum for IOMMU hardware which documents +undefined behavior when forwarding SMI requests from +peripherals and the DTE of that peripheral has a sysmgt +value of 01b. This problem caused weird IO_PAGE_FAULTS in my +case. +This patch implements the suggested workaround for that +erratum into the AMD IOMMU driver. The erratum is +documented with number 63. + +Signed-off-by: Joerg Roedel +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/include/asm/amd_iommu.h | 1 + + arch/x86/kernel/amd_iommu.c | 2 ++ + arch/x86/kernel/amd_iommu_init.c | 22 ++++++++++++++++++++++ + 3 files changed, 25 insertions(+) + +--- a/arch/x86/include/asm/amd_iommu.h ++++ b/arch/x86/include/asm/amd_iommu.h +@@ -30,6 +30,7 @@ extern irqreturn_t amd_iommu_int_handler + extern void amd_iommu_flush_all_domains(void); + extern void amd_iommu_flush_all_devices(void); + extern void amd_iommu_shutdown(void); ++extern void amd_iommu_apply_erratum_63(u16 devid); + #else + static inline int amd_iommu_init(void) { return -ENODEV; } + static inline void amd_iommu_detect(void) { } +--- a/arch/x86/kernel/amd_iommu.c ++++ b/arch/x86/kernel/amd_iommu.c +@@ -1112,6 +1112,8 @@ static void __detach_device(struct prote + amd_iommu_dev_table[devid].data[1] = 0; + amd_iommu_dev_table[devid].data[2] = 0; + ++ amd_iommu_apply_erratum_63(devid); ++ + /* decrease reference counter */ + domain->dev_cnt -= 1; + +--- a/arch/x86/kernel/amd_iommu_init.c ++++ b/arch/x86/kernel/amd_iommu_init.c +@@ -509,6 +509,26 @@ static void set_dev_entry_bit(u16 devid, + amd_iommu_dev_table[devid].data[i] |= (1 << _bit); + } + ++static int get_dev_entry_bit(u16 devid, u8 bit) ++{ ++ int i = (bit >> 5) & 0x07; ++ int _bit = bit & 0x1f; ++ ++ return (amd_iommu_dev_table[devid].data[i] & (1 << _bit)) >> _bit; ++} ++ ++ ++void amd_iommu_apply_erratum_63(u16 devid) ++{ ++ int sysmgt; ++ ++ sysmgt = get_dev_entry_bit(devid, DEV_ENTRY_SYSMGT1) | ++ (get_dev_entry_bit(devid, DEV_ENTRY_SYSMGT2) << 1); ++ ++ if (sysmgt == 0x01) ++ set_dev_entry_bit(devid, DEV_ENTRY_IW); ++} ++ + /* Writes the specific IOMMU for a device into the rlookup table */ + static void __init set_iommu_for_device(struct amd_iommu *iommu, u16 devid) + { +@@ -537,6 +557,8 @@ static void __init set_dev_entry_from_ac + if (flags & ACPI_DEVFLAG_LINT1) + set_dev_entry_bit(devid, DEV_ENTRY_LINT1_PASS); + ++ amd_iommu_apply_erratum_63(devid); ++ + set_iommu_for_device(iommu, devid); + } + + + +From gregkh@mini.kroah.org Fri Nov 6 14:15:48 2009 +Message-Id: <20091106221547.995120375@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 06 Nov 2009 14:15:05 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Eric Paris +Subject: [67/99] fsnotify: do not set group for a mark before it is on the i_list +References: <20091106221358.309857998@mini.kroah.org> +Content-Disposition: inline; filename=fsnotify-do-not-set-group-for-a-mark-before-it-is-on-the-i_list.patch +Content-Length: 2204 +Lines: 66 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Eric Paris + +commit 9f0d793b52eb2266359661369ef6303838904855 upstream. + +fsnotify_add_mark is supposed to add a mark to the g_list and i_list and to +set the group and inode for the mark. fsnotify_destroy_mark_by_entry uses +the fact that ->group != NULL to know if this group should be destroyed or +if it's already been done. + +But fsnotify_add_mark sets the group and inode before it actually adds the +mark to the i_list and g_list. This can result in a race in inotify, it +requires 3 threads. + +sys_inotify_add_watch("file") sys_inotify_add_watch("file") sys_inotify_rm_watch([a]) +inotify_update_watch() +inotify_new_watch() +inotify_add_to_idr() + ^--- returns wd = [a] + inotfiy_update_watch() + inotify_new_watch() + inotify_add_to_idr() + fsnotify_add_mark() + ^--- returns wd = [b] + returns to userspace; + inotify_idr_find([a]) + ^--- gives us the pointer from task 1 +fsnotify_add_mark() + ^--- this is going to set the mark->group and mark->inode fields, but will +return -EEXIST because of the race with [b]. + fsnotify_destroy_mark() + ^--- since ->group != NULL we call back + into inotify_freeing_mark() which calls + inotify_remove_from_idr([a]) + +since fsnotify_add_mark() failed we call: +inotify_remove_from_idr([a]) <------WHOOPS it's not in the idr, this could + have been any entry added later! + +The fix is to make sure we don't set mark->group until we are sure the mark is +on the inode and fsnotify_add_mark will return success. + +Signed-off-by: Eric Paris +Signed-off-by: Greg Kroah-Hartman + +--- + fs/notify/inode_mark.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/fs/notify/inode_mark.c ++++ b/fs/notify/inode_mark.c +@@ -324,11 +324,11 @@ int fsnotify_add_mark(struct fsnotify_ma + spin_lock(&group->mark_lock); + spin_lock(&inode->i_lock); + +- entry->group = group; +- entry->inode = inode; +- + lentry = fsnotify_find_mark_entry(group, inode); + if (!lentry) { ++ entry->group = group; ++ entry->inode = inode; ++ + hlist_add_head(&entry->i_list, &inode->i_fsnotify_mark_entries); + list_add(&entry->g_list, &group->mark_entries); + + + +From gregkh@mini.kroah.org Fri Nov 6 14:15:48 2009 +Message-Id: <20091106221548.134452197@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 06 Nov 2009 14:15:06 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Manuel Lauss , + Sam Ravnborg , + Dmitri Vorobiev +Subject: [68/99] mips: fix build of vmlinux.lds +References: <20091106221358.309857998@mini.kroah.org> +Content-Disposition: inline; filename=mips-fix-build-of-vmlinux.lds.patch +Content-Length: 1546 +Lines: 58 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Manuel Lauss + +commit d71789b6fa37c21ce5eb588d279f57904a62e7e2 upstream. + +Commit 51b563fc93c8cb5bff1d67a0a71c374e4a4ea049 ("arm, cris, mips, +sparc, powerpc, um, xtensa: fix build with bash 4.0") removed a few +CPPFLAGS with vital include paths necessary to build vmlinux.lds +on MIPS, and moved the calculation of the 'jiffies' symbol +directly to vmlinux.lds.S but forgot to change make ifdef/... to +cpp macros. + +Signed-off-by: Manuel Lauss +[sam: moved assignment of CPPFLAGS arch/mips/kernel/Makefile] +Signed-off-by: Sam Ravnborg +Acked-by: Dmitri Vorobiev +Signed-off-by: Greg Kroah-Hartman + +--- + arch/mips/kernel/Makefile | 2 ++ + arch/mips/kernel/vmlinux.lds.S | 12 ++++++------ + 2 files changed, 8 insertions(+), 6 deletions(-) + +--- a/arch/mips/kernel/Makefile ++++ b/arch/mips/kernel/Makefile +@@ -2,6 +2,8 @@ + # Makefile for the Linux/MIPS kernel. + # + ++CPPFLAGS_vmlinux.lds := $(KBUILD_CFLAGS) ++ + extra-y := head.o init_task.o vmlinux.lds + + obj-y += cpu-probe.o branch.o entry.o genex.o irq.o process.o \ +--- a/arch/mips/kernel/vmlinux.lds.S ++++ b/arch/mips/kernel/vmlinux.lds.S +@@ -10,15 +10,15 @@ PHDRS { + note PT_NOTE FLAGS(4); /* R__ */ + } + +-ifdef CONFIG_32BIT +- ifdef CONFIG_CPU_LITTLE_ENDIAN ++#ifdef CONFIG_32BIT ++ #ifdef CONFIG_CPU_LITTLE_ENDIAN + jiffies = jiffies_64; +- else ++ #else + jiffies = jiffies_64 + 4; +- endif +-else ++ #endif ++#else + jiffies = jiffies_64; +-endif ++#endif + + SECTIONS + { + + +From gregkh@mini.kroah.org Fri Nov 6 14:15:48 2009 +Message-Id: <20091106221548.274202771@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 06 Nov 2009 14:15:07 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Sam Ravnborg , + Tim Abbott , + Ivan Kokshaysky , + Richard Henderson +Subject: [69/99] alpha: fix build after vmlinux.lds.S cleanup +References: <20091106221358.309857998@mini.kroah.org> +Content-Disposition: inline; filename=alpha-fix-build-after-vmlinux.lds.s-cleanup.patch +Content-Length: 667 +Lines: 25 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Sam Ravnborg + +commit de078ef55c74d02ee93d44513da5ee88a089d71d upstream. + +Add include to get missing THREAD_SIZE definition + +Signed-off-by: Sam Ravnborg +Cc: Tim Abbott +Cc: Ivan Kokshaysky +Cc: Richard Henderson +Signed-off-by: Greg Kroah-Hartman + +--- + arch/alpha/kernel/vmlinux.lds.S | 1 + + 1 file changed, 1 insertion(+) + +--- a/arch/alpha/kernel/vmlinux.lds.S ++++ b/arch/alpha/kernel/vmlinux.lds.S +@@ -1,4 +1,5 @@ + #include ++#include + #include + + OUTPUT_FORMAT("elf64-alpha") + + +From gregkh@mini.kroah.org Fri Nov 6 14:15:48 2009 +Message-Id: <20091106221548.424594928@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 06 Nov 2009 14:15:08 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + "Rafael J. Wysocki" , + Len Brown , + Chuck Ebbert +Subject: [70/99] ACPI / PCI: Fix NULL pointer dereference in acpi_get_pci_dev() (rev. 2) +References: <20091106221358.309857998@mini.kroah.org> +Content-Disposition: inline; filename=acpi-pci-fix-null-pointer-dereference-in-acpi_get_pci_dev-rev.-2.patch +Content-Length: 1964 +Lines: 55 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Rafael J. Wysocki + +commit 497fb54f578efd2b479727bc88d5ef942c0a1e2d upstream. + +acpi_get_pci_dev() may be called for a non-PCI device, in which case +it should return NULL. However, it assumes that every handle it +finds in the ACPI CA name space, between given device handle and the +PCI root bridge handle, corresponds to a PCI-to-PCI bridge with an +existing secondary bus. For this reason, when it finds a struct +pci_dev object corresponding to one of them, it doesn't check if +its 'subordinate' field is a valid pointer. This obviously leads to +a NULL pointer dereference if acpi_get_pci_dev() is called for a +non-PCI device with a PCI parent which is not a bridge. + +To fix this issue make acpi_get_pci_dev() check if pdev->subordinate +is not NULL for every device it finds on the path between the root +bridge and the device it's supposed to get to and return NULL if the +"target" device cannot be found. + +http://bugzilla.kernel.org/show_bug.cgi?id=14129 +(worked in 2.6.30, regression in 2.6.31) + +Signed-off-by: Rafael J. Wysocki +Reported-by: Danny Feng +Reviewed-by: Alex Chiang +Tested-by: chepioq +Signed-off-by: Len Brown +Cc: Chuck Ebbert +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/acpi/pci_root.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +--- a/drivers/acpi/pci_root.c ++++ b/drivers/acpi/pci_root.c +@@ -400,6 +400,17 @@ struct pci_dev *acpi_get_pci_dev(acpi_ha + + pbus = pdev->subordinate; + pci_dev_put(pdev); ++ ++ /* ++ * This function may be called for a non-PCI device that has a ++ * PCI parent (eg. a disk under a PCI SATA controller). In that ++ * case pdev->subordinate will be NULL for the parent. ++ */ ++ if (!pbus) { ++ dev_dbg(&pdev->dev, "Not a PCI-to-PCI bridge\n"); ++ pdev = NULL; ++ break; ++ } + } + out: + list_for_each_entry_safe(node, tmp, &device_list, node) + + +From gregkh@mini.kroah.org Fri Nov 6 14:15:48 2009 +Message-Id: <20091106221548.548581013@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 06 Nov 2009 14:15:09 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Len Brown , + Chuck Ebbert +Subject: [71/99] Revert "ACPI: Attach the ACPI device to the ACPI handle as early as possible" +References: <20091106221358.309857998@mini.kroah.org> +Content-Disposition: inline; filename=revert-acpi-attach-the-acpi-device-to-the-acpi-handle-as-early-as-possible.patch +Content-Length: 1211 +Lines: 45 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Len Brown + +commit f61f925859c57f6175082aeeee17743c68558a6e upstream. + +This reverts commit eab4b645769fa2f8703f5a3cb0cc4ac090d347af. + +http://bugzilla.kernel.org/show_bug.cgi?id=13002 + +Signed-off-by: Len Brown +Cc: Chuck Ebbert +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/acpi/scan.c | 12 ++---------- + 1 file changed, 2 insertions(+), 10 deletions(-) + +--- a/drivers/acpi/scan.c ++++ b/drivers/acpi/scan.c +@@ -1264,16 +1264,6 @@ acpi_add_single_object(struct acpi_devic + acpi_device_set_id(device, parent, handle, type); + + /* +- * The ACPI device is attached to acpi handle before getting +- * the power/wakeup/peformance flags. Otherwise OS can't get +- * the corresponding ACPI device by the acpi handle in the course +- * of getting the power/wakeup/performance flags. +- */ +- result = acpi_device_set_context(device, type); +- if (result) +- goto end; +- +- /* + * Power Management + * ---------------- + */ +@@ -1303,6 +1293,8 @@ acpi_add_single_object(struct acpi_devic + goto end; + } + ++ if ((result = acpi_device_set_context(device, type))) ++ goto end; + + result = acpi_device_register(device, parent); + + + +From gregkh@mini.kroah.org Fri Nov 6 14:15:48 2009 +Message-Id: <20091106221548.693605803@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 06 Nov 2009 14:15:10 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + David Howells , + Chuck Ebbert +Subject: [72/99] KEYS: get_instantiation_keyring() should inc the keyring refcount in all cases +References: <20091106221358.309857998@mini.kroah.org> +Content-Disposition: inline; filename=keys-get_instantiation_keyring-should-inc-the-keyring-refcount-in-all-cases.patch +Content-Length: 2756 +Lines: 69 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: David Howells + +commit 21279cfa107af07ef985539ac0de2152b9cba5f5 upstream. + +The destination keyring specified to request_key() and co. is made available to +the process that instantiates the key (the slave process started by +/sbin/request-key typically). This is passed in the request_key_auth struct as +the dest_keyring member. + +keyctl_instantiate_key and keyctl_negate_key() call get_instantiation_keyring() +to get the keyring to attach the newly constructed key to at the end of +instantiation. This may be given a specific keyring into which a link will be +made later, or it may be asked to find the keyring passed to request_key(). In +the former case, it returns a keyring with the refcount incremented by +lookup_user_key(); in the latter case, it returns the keyring from the +request_key_auth struct - and does _not_ increment the refcount. + +The latter case will eventually result in an oops when the keyring prematurely +runs out of references and gets destroyed. The effect may take some time to +show up as the key is destroyed lazily. + +To fix this, the keyring returned by get_instantiation_keyring() must always +have its refcount incremented, no matter where it comes from. + +This can be tested by setting /etc/request-key.conf to: + +#OP TYPE DESCRIPTION CALLOUT INFO PROGRAM ARG1 ARG2 ARG3 ... +#====== ======= =============== =============== =============================== +create * test:* * |/bin/false %u %g %d %{user:_display} +negate * * * /bin/keyctl negate %k 10 @u + +and then doing: + + keyctl add user _display aaaaaaaa @u + while keyctl request2 user test:x test:x @u && + keyctl list @u; + do + keyctl request2 user test:x test:x @u; + sleep 31; + keyctl list @u; + done + +which will oops eventually. Changing the negate line to have @u rather than +%S at the end is important as that forces the latter case by passing a special +keyring ID rather than an actual keyring ID. + +Reported-by: Alexander Zangerl +Signed-off-by: David Howells +Tested-by: Alexander Zangerl +Signed-off-by: Linus Torvalds +Cc: Chuck Ebbert +Signed-off-by: Greg Kroah-Hartman + +--- + security/keys/keyctl.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/security/keys/keyctl.c ++++ b/security/keys/keyctl.c +@@ -860,7 +860,7 @@ static long get_instantiation_keyring(ke + /* otherwise specify the destination keyring recorded in the + * authorisation key (any KEY_SPEC_*_KEYRING) */ + if (ringid >= KEY_SPEC_REQUESTOR_KEYRING) { +- *_dest_keyring = rka->dest_keyring; ++ *_dest_keyring = key_get(rka->dest_keyring); + return 0; + } + + + +From gregkh@mini.kroah.org Fri Nov 6 14:15:48 2009 +Message-Id: <20091106221548.863722805@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 06 Nov 2009 14:15:11 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Larry Finger , + "John W. Linville" +Subject: [73/99] b43: Fix Bugzilla #14181 and the bug from the previous fix +References: <20091106221358.309857998@mini.kroah.org> +Content-Disposition: inline; filename=b43-fix-bugzilla-14181-and-the-bug-from-the-previous-fix.patch +Content-Length: 1322 +Lines: 35 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Larry Finger + +commit d50bae33d1358b909ade05ae121d83d3a60ab63f upstream. + +"b43: Fix PPC crash in rfkill polling on unload" fixed the bug reported +in Bugzilla No. 14181; however, it introduced a new bug. Whenever the +radio switch was turned off, it was necessary to unload and reload +the driver for it to recognize the switch again. + +This patch fixes both the original bug in #14181 and the bug introduced by +the previous patch. It must be stated, however, that if there is a BCM4306/3 +with an rfkill switch (not yet proven), then the driver will need an +unload/reload cycle to turn the device back on. + +Signed-off-by: Larry Finger +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/b43/rfkill.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/net/wireless/b43/rfkill.c ++++ b/drivers/net/wireless/b43/rfkill.c +@@ -33,7 +33,8 @@ bool b43_is_hw_radio_enabled(struct b43_ + & B43_MMIO_RADIO_HWENABLED_HI_MASK)) + return 1; + } else { +- if (b43_read16(dev, B43_MMIO_RADIO_HWENABLED_LO) ++ if (b43_status(dev) >= B43_STAT_STARTED && ++ b43_read16(dev, B43_MMIO_RADIO_HWENABLED_LO) + & B43_MMIO_RADIO_HWENABLED_LO_MASK) + return 1; + } + + +From gregkh@mini.kroah.org Fri Nov 6 14:15:49 2009 +Message-Id: <20091106221548.985237484@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 06 Nov 2009 14:15:12 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Alan Cox , + Jeff Garzik +Subject: [74/99] pata_sc1200: Fix crash on boot +References: <20091106221358.309857998@mini.kroah.org> +Content-Disposition: inline; filename=pata_sc1200-fix-crash-on-boot.patch +Content-Length: 915 +Lines: 32 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Alan Cox + +commit 6d4f950e9ea15816c6a4f266ce6b9e438346771e upstream. + +The SC1200 needs a NULL terminator or it may cause a crash on boot. + +Bug #14227 + +Also correct a bogus comment as the driver had serializing added so can run +dual port. + +Signed-off-by: Alan Cox +Signed-off-by: Jeff Garzik +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ata/pata_sc1200.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/drivers/ata/pata_sc1200.c ++++ b/drivers/ata/pata_sc1200.c +@@ -235,8 +235,7 @@ static int sc1200_init_one(struct pci_de + .udma_mask = ATA_UDMA2, + .port_ops = &sc1200_port_ops + }; +- /* Can't enable port 2 yet, see top comments */ +- const struct ata_port_info *ppi[] = { &info, }; ++ const struct ata_port_info *ppi[] = { &info, NULL }; + + return ata_pci_sff_init_one(dev, ppi, &sc1200_sht, NULL); + } + + +From gregkh@mini.kroah.org Fri Nov 6 14:15:49 2009 +Message-Id: <20091106221549.160832156@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 06 Nov 2009 14:15:13 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Tomoki Sekiyama , + Masanori Yoshida , + Chuck Ebbert , + "David S. Miller" +Subject: [75/99] AF_UNIX: Fix deadlock on connecting to shutdown socket (CVE-2009-3621) +References: <20091106221358.309857998@mini.kroah.org> +Content-Disposition: inline; filename=af_unix-fix-deadlock-on-connecting-to-shutdown-socket-cve-2009-3621.patch +Content-Length: 2533 +Lines: 85 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Tomoki Sekiyama + +commit 77238f2b942b38ab4e7f3aced44084493e4a8675 upstream. + +I found a deadlock bug in UNIX domain socket, which makes able to DoS +attack against the local machine by non-root users. + +How to reproduce: +1. Make a listening AF_UNIX/SOCK_STREAM socket with an abstruct + namespace(*), and shutdown(2) it. + 2. Repeat connect(2)ing to the listening socket from the other sockets + until the connection backlog is full-filled. + 3. connect(2) takes the CPU forever. If every core is taken, the + system hangs. + +PoC code: (Run as many times as cores on SMP machines.) + +int main(void) +{ + int ret; + int csd; + int lsd; + struct sockaddr_un sun; + + /* make an abstruct name address (*) */ + memset(&sun, 0, sizeof(sun)); + sun.sun_family = PF_UNIX; + sprintf(&sun.sun_path[1], "%d", getpid()); + + /* create the listening socket and shutdown */ + lsd = socket(AF_UNIX, SOCK_STREAM, 0); + bind(lsd, (struct sockaddr *)&sun, sizeof(sun)); + listen(lsd, 1); + shutdown(lsd, SHUT_RDWR); + + /* connect loop */ + alarm(15); /* forcely exit the loop after 15 sec */ + for (;;) { + csd = socket(AF_UNIX, SOCK_STREAM, 0); + ret = connect(csd, (struct sockaddr *)&sun, sizeof(sun)); + if (-1 == ret) { + perror("connect()"); + break; + } + puts("Connection OK"); + } + return 0; +} + +(*) Make sun_path[0] = 0 to use the abstruct namespace. + If a file-based socket is used, the system doesn't deadlock because + of context switches in the file system layer. + +Why this happens: + Error checks between unix_socket_connect() and unix_wait_for_peer() are + inconsistent. The former calls the latter to wait until the backlog is + processed. Despite the latter returns without doing anything when the + socket is shutdown, the former doesn't check the shutdown state and + just retries calling the latter forever. + +Patch: + The patch below adds shutdown check into unix_socket_connect(), so + connect(2) to the shutdown socket will return -ECONREFUSED. + +Signed-off-by: Tomoki Sekiyama +Signed-off-by: Masanori Yoshida +Cc: Chuck Ebbert +Signed-off-by: David S. Miller + +--- + net/unix/af_unix.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/net/unix/af_unix.c ++++ b/net/unix/af_unix.c +@@ -1074,6 +1074,8 @@ restart: + err = -ECONNREFUSED; + if (other->sk_state != TCP_LISTEN) + goto out_unlock; ++ if (other->sk_shutdown & RCV_SHUTDOWN) ++ goto out_unlock; + + if (unix_recvq_full(other)) { + err = -EAGAIN; + + +From gregkh@mini.kroah.org Fri Nov 6 14:15:49 2009 +Message-Id: <20091106221549.324518938@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 06 Nov 2009 14:15:14 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + David Henningsson , + Takashi Iwai +Subject: [76/99] ALSA: ice1724 - Make call to set hw params succeed on ESI Juli@ +References: <20091106221358.309857998@mini.kroah.org> +Content-Disposition: inline; filename=alsa-ice1724-make-call-to-set-hw-params-succeed-on-esi-juli.patch +Content-Length: 1055 +Lines: 29 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: David Henningsson + +commit bd3c200e6d5495343c91db66d2acf1853b57a141 upstream. + +If two streams are started immediately after one another (such as a +playback and a recording stream), the call to set hw params fails with +EBUSY. This patch makes the call succeed, so playback and recording will +work properly. + +Signed-off-by: David Henningsson +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/ice1712/ice1724.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/pci/ice1712/ice1724.c ++++ b/sound/pci/ice1712/ice1724.c +@@ -643,7 +643,7 @@ static int snd_vt1724_set_pro_rate(struc + (inb(ICEMT1724(ice, DMA_PAUSE)) & DMA_PAUSES)) { + /* running? we cannot change the rate now... */ + spin_unlock_irqrestore(&ice->reg_lock, flags); +- return -EBUSY; ++ return ((rate == ice->cur_rate) && !force) ? 0 : -EBUSY; + } + if (!force && is_pro_rate_locked(ice)) { + spin_unlock_irqrestore(&ice->reg_lock, flags); + + +From gregkh@mini.kroah.org Fri Nov 6 14:15:49 2009 +Message-Id: <20091106221549.488867204@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 06 Nov 2009 14:15:15 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jiri Bohac , + "David S. Miller" +Subject: [77/99] bonding: fix a race condition in calls to slave MII ioctls +References: <20091106221358.309857998@mini.kroah.org> +Content-Disposition: inline; filename=bonding-fix-a-race-condition-in-calls-to-slave-mii-ioctls.patch +Content-Length: 1450 +Lines: 39 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Jiri Bohac + +commit d9d5283228d0c752f199c901fff6e1405dc91bcb upstream. + +In mii monitor mode, bond_check_dev_link() calls the the ioctl +handler of slave devices. It stores the ndo_do_ioctl function +pointer to a static (!) ioctl variable and later uses it to call the +handler with the IOCTL macro. + +If another thread executes bond_check_dev_link() at the same time +(even with a different bond, which none of the locks prevent), a +race condition occurs. If the two racing slaves have different +drivers, this may result in one driver's ioctl handler being +called with a pointer to a net_device controlled with a different +driver, resulting in unpredictable breakage. + +Unless I am overlooking something, the "static" must be a +copy'n'paste error (?). + +Signed-off-by: Jiri Bohac +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/bonding/bond_main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/bonding/bond_main.c ++++ b/drivers/net/bonding/bond_main.c +@@ -691,7 +691,7 @@ static int bond_check_dev_link(struct bo + struct net_device *slave_dev, int reporting) + { + const struct net_device_ops *slave_ops = slave_dev->netdev_ops; +- static int (*ioctl)(struct net_device *, struct ifreq *, int); ++ int (*ioctl)(struct net_device *, struct ifreq *, int); + struct ifreq ifr; + struct mii_ioctl_data *mii; + + + +From gregkh@mini.kroah.org Fri Nov 6 14:15:49 2009 +Message-Id: <20091106221549.637855004@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 06 Nov 2009 14:15:16 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jean Delvare +Subject: [78/99] hwmon: (it87) Fix VID reading on IT8718F/IT8720F +References: <20091106221358.309857998@mini.kroah.org> +Content-Disposition: inline; filename=hwmon-it87-fix-vid-reading-on-it8718f-it8720f.patch +Content-Length: 1115 +Lines: 36 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Jean Delvare + +commit 371dc4a6d8c3c74a9a1c74b87c2affb3fcef6500 upstream. + +Comparing apples to bananas doesn't seem right. Consistently use the +chips enum for chip type comparisons, to avoid such bugs in the +future. + +The bug has been there since support for the IT8718F was added, so +VID never worked for this chip nor for the similar IT8720F. + +Signed-off-by: Jean Delvare +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwmon/it87.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +--- a/drivers/hwmon/it87.c ++++ b/drivers/hwmon/it87.c +@@ -1028,12 +1028,11 @@ static int __init it87_find(unsigned sho + chip_type, *address, sio_data->revision); + + /* Read GPIO config and VID value from LDN 7 (GPIO) */ +- if (chip_type != IT8705F_DEVID) { ++ if (sio_data->type != it87) { + int reg; + + superio_select(GPIO); +- if ((chip_type == it8718) || +- (chip_type == it8720)) ++ if (sio_data->type == it8718 || sio_data->type == it8720) + sio_data->vid_value = superio_inb(IT87_SIO_VID_REG); + + reg = superio_inb(IT87_SIO_PINX2_REG); + + +From gregkh@mini.kroah.org Fri Nov 6 14:15:49 2009 +Message-Id: <20091106221549.793440409@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 06 Nov 2009 14:15:17 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jiri Pirko , + "David S. Miller" , + Chuck Ebbert +Subject: [79/99] netlink: fix typo in initialization (CVE-2009-3612) +References: <20091106221358.309857998@mini.kroah.org> +Content-Disposition: inline; filename=netlink-fix-typo-in-initialization-cve-2009-3612.patch +Content-Length: 902 +Lines: 29 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Jiri Pirko + +commit ad61df918c44316940404891d5082c63e79c256a upstream. + +Commit 9ef1d4c7c7aca1cd436612b6ca785b726ffb8ed8 ("[NETLINK]: Missing +initializations in dumped data") introduced a typo in +initialization. This patch fixes this. + +Signed-off-by: Jiri Pirko +Signed-off-by: David S. Miller +Cc: Chuck Ebbert +Signed-off-by: Greg Kroah-Hartman + +--- + net/sched/cls_api.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/sched/cls_api.c ++++ b/net/sched/cls_api.c +@@ -348,7 +348,7 @@ static int tcf_fill_node(struct sk_buff + tcm = NLMSG_DATA(nlh); + tcm->tcm_family = AF_UNSPEC; + tcm->tcm__pad1 = 0; +- tcm->tcm__pad1 = 0; ++ tcm->tcm__pad2 = 0; + tcm->tcm_ifindex = qdisc_dev(tp->q)->ifindex; + tcm->tcm_parent = tp->classid; + tcm->tcm_info = TC_H_MAKE(tp->prio, tp->protocol); + + +From gregkh@mini.kroah.org Fri Nov 6 14:15:50 2009 +Message-Id: <20091106221549.935130836@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 06 Nov 2009 14:15:18 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Ben Hutchings , + Trond Myklebust +Subject: [80/99] nfs: Avoid overrun when copying client IP address string +References: <20091106221358.309857998@mini.kroah.org> +Content-Disposition: inline; filename=nfs-avoid-overrun-when-copying-client-ip-address-string.patch +Content-Length: 1018 +Lines: 30 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Ben Hutchings + +commit f4373bf9e67e4a653c8854acd7b02dac9714c98a upstream. + +As seen in , nfs4_init_client() can +overrun the source string when copying the client IP address from +nfs_parsed_mount_data::client_address to nfs_client::cl_ipaddr. Since +these are both treated as null-terminated strings elsewhere, the copy +should be done with strlcpy() not memcpy(). + +Signed-off-by: Ben Hutchings +Signed-off-by: Trond Myklebust +Signed-off-by: Greg Kroah-Hartman + +--- + fs/nfs/client.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/nfs/client.c ++++ b/fs/nfs/client.c +@@ -1171,7 +1171,7 @@ static int nfs4_init_client(struct nfs_c + 1, flags & NFS_MOUNT_NORESVPORT); + if (error < 0) + goto error; +- memcpy(clp->cl_ipaddr, ip_addr, sizeof(clp->cl_ipaddr)); ++ strlcpy(clp->cl_ipaddr, ip_addr, sizeof(clp->cl_ipaddr)); + + error = nfs_idmap_new(clp); + if (error < 0) { + + +From gregkh@mini.kroah.org Fri Nov 6 14:15:50 2009 +Message-Id: <20091106221550.079264596@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 06 Nov 2009 14:15:19 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Terry Loftin , + Trond Myklebust +Subject: [81/99] nfs: Panic when commit fails +References: <20091106221358.309857998@mini.kroah.org> +Content-Disposition: inline; filename=nfs-panic-when-commit-fails.patch +Content-Length: 1250 +Lines: 34 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Terry Loftin + +commit a8b40bc7e635831b61c43acc71a86d3a68b2dff0 upstream. + +Actually pass the NFS_FILE_SYNC option to the server to avoid a +Panic in nfs_direct_write_complete() when a commit fails. + +At the end of an nfs write, if the nfs commit fails, all the writes +will be rescheduled. They are supposed to be rescheduled as NFS_FILE_SYNC +writes, but the rpc_task structure is not completely intialized and so +the option is not passed. When the rescheduled writes complete, the +return indicates that they are NFS_UNSTABLE and we try to do another +commit. This leads to a Panic because the commit data structure pointer +was set to null in the initial (failed) commit attempt. + +Signed-off-by: Terry Loftin +Signed-off-by: Trond Myklebust +Signed-off-by: Greg Kroah-Hartman + +--- + fs/nfs/direct.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/fs/nfs/direct.c ++++ b/fs/nfs/direct.c +@@ -457,6 +457,7 @@ static void nfs_direct_write_reschedule( + }; + struct rpc_task_setup task_setup_data = { + .rpc_client = NFS_CLIENT(inode), ++ .rpc_message = &msg, + .callback_ops = &nfs_write_direct_ops, + .workqueue = nfsiod_workqueue, + .flags = RPC_TASK_ASYNC, + + +From gregkh@mini.kroah.org Fri Nov 6 14:15:50 2009 +Message-Id: <20091106221550.218945895@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 06 Nov 2009 14:15:20 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Trond Myklebust +Subject: [82/99] NFSv4: Fix a bug when the server returns NFS4ERR_RESOURCE +References: <20091106221358.309857998@mini.kroah.org> +Content-Disposition: inline; filename=nfsv4-fix-a-bug-when-the-server-returns-nfs4err_resource.patch +Content-Length: 1582 +Lines: 55 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Trond Myklebust + +commit 52567b03ca38b6e556ced450d64dba8d66e23b0e upstream. + +RFC 3530 states that when we recieve the error NFS4ERR_RESOURCE, we are not +supposed to bump the sequence number on OPEN, LOCK, LOCKU, CLOSE, etc +operations. The problem is that we map that error into EREMOTEIO in the XDR +layer, and so the NFSv4 middle-layer routines like seqid_mutating_err(), +and nfs_increment_seqid() don't recognise it. + +The fix is to defer the mapping until after the middle layers have +processed the error. + +Signed-off-by: Trond Myklebust +Signed-off-by: Greg Kroah-Hartman + +--- + fs/nfs/nfs4proc.c | 11 ++++++++--- + fs/nfs/nfs4xdr.c | 1 - + 2 files changed, 8 insertions(+), 4 deletions(-) + +--- a/fs/nfs/nfs4proc.c ++++ b/fs/nfs/nfs4proc.c +@@ -71,12 +71,17 @@ static int _nfs4_proc_getattr(struct nfs + /* Prevent leaks of NFSv4 errors into userland */ + static int nfs4_map_errors(int err) + { +- if (err < -1000) { ++ if (err >= -1000) ++ return err; ++ switch (err) { ++ case -NFS4ERR_RESOURCE: ++ return -EREMOTEIO; ++ default: + dprintk("%s could not handle NFSv4 error %d\n", + __func__, -err); +- return -EIO; ++ break; + } +- return err; ++ return -EIO; + } + + /* +--- a/fs/nfs/nfs4xdr.c ++++ b/fs/nfs/nfs4xdr.c +@@ -5406,7 +5406,6 @@ static struct { + { NFS4ERR_SERVERFAULT, -ESERVERFAULT }, + { NFS4ERR_BADTYPE, -EBADTYPE }, + { NFS4ERR_LOCKED, -EAGAIN }, +- { NFS4ERR_RESOURCE, -EREMOTEIO }, + { NFS4ERR_SYMLINK, -ELOOP }, + { NFS4ERR_OP_ILLEGAL, -EOPNOTSUPP }, + { NFS4ERR_DEADLOCK, -EDEADLK }, + + +From gregkh@mini.kroah.org Fri Nov 6 14:15:50 2009 +Message-Id: <20091106221550.359541615@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 06 Nov 2009 14:15:21 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Trond Myklebust +Subject: [83/99] NFSv4: Fix two unbalanced put_rpccred() issues. +References: <20091106221358.309857998@mini.kroah.org> +Content-Disposition: inline; filename=nfsv4-fix-two-unbalanced-put_rpccred-issues.patch +Content-Length: 1242 +Lines: 38 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Trond Myklebust + +commit 141aeb9f26f9f12f1584c128ce8697cdffb046e7 upstream. + +Commits 29fba38b (nfs41: lease renewal) and fc01cea9 (nfs41: sequence +operation) introduce a couple of put_rpccred() calls on credentials for +which there is no corresponding get_rpccred(). + +See http://bugzilla.kernel.org/show_bug.cgi?id=14249 + +Signed-off-by: Trond Myklebust +Signed-off-by: Greg Kroah-Hartman + +--- + fs/nfs/nfs4proc.c | 4 ---- + 1 file changed, 4 deletions(-) + +--- a/fs/nfs/nfs4proc.c ++++ b/fs/nfs/nfs4proc.c +@@ -3038,9 +3038,6 @@ static void nfs4_renew_done(struct rpc_t + if (time_before(clp->cl_last_renewal,timestamp)) + clp->cl_last_renewal = timestamp; + spin_unlock(&clp->cl_lock); +- dprintk("%s calling put_rpccred on rpc_cred %p\n", __func__, +- task->tk_msg.rpc_cred); +- put_rpccred(task->tk_msg.rpc_cred); + } + + static const struct rpc_call_ops nfs4_renew_ops = { +@@ -4855,7 +4852,6 @@ void nfs41_sequence_call_done(struct rpc + nfs41_sequence_free_slot(clp, task->tk_msg.rpc_resp); + dprintk("%s rpc_cred %p\n", __func__, task->tk_msg.rpc_cred); + +- put_rpccred(task->tk_msg.rpc_cred); + kfree(task->tk_msg.rpc_argp); + kfree(task->tk_msg.rpc_resp); + + + +From gregkh@mini.kroah.org Fri Nov 6 14:15:50 2009 +Message-Id: <20091106221550.501722190@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 06 Nov 2009 14:15:22 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Trond Myklebust +Subject: [84/99] NFSv4: Kill nfs4_renewd_prepare_shutdown() +References: <20091106221358.309857998@mini.kroah.org> +Content-Disposition: inline; filename=nfsv4-kill-nfs4_renewd_prepare_shutdown.patch +Content-Length: 1410 +Lines: 46 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Trond Myklebust + +commit 3050141bae57984dd660e6861632ccf9b8bca77e upstream. + +The NFSv4 renew daemon is shared between all active super blocks that refer +to a particular NFS server, so it is wrong to be shutting it down in +nfs4_kill_super every time a super block is destroyed. + +This patch therefore kills nfs4_renewd_prepare_shutdown altogether, and +leaves it up to nfs4_shutdown_client() to also shut down the renew daemon +by means of the existing call to nfs4_kill_renewd(). + +Signed-off-by: Trond Myklebust +Signed-off-by: Greg Kroah-Hartman + +--- + fs/nfs/nfs4renewd.c | 6 ------ + fs/nfs/super.c | 1 - + 2 files changed, 7 deletions(-) + +--- a/fs/nfs/nfs4renewd.c ++++ b/fs/nfs/nfs4renewd.c +@@ -127,12 +127,6 @@ nfs4_schedule_state_renewal(struct nfs_c + } + + void +-nfs4_renewd_prepare_shutdown(struct nfs_server *server) +-{ +- cancel_delayed_work(&server->nfs_client->cl_renewd); +-} +- +-void + nfs4_kill_renewd(struct nfs_client *clp) + { + cancel_delayed_work_sync(&clp->cl_renewd); +--- a/fs/nfs/super.c ++++ b/fs/nfs/super.c +@@ -2670,7 +2670,6 @@ static void nfs4_kill_super(struct super + dprintk("--> %s\n", __func__); + nfs_super_return_all_delegations(sb); + kill_anon_super(sb); +- nfs4_renewd_prepare_shutdown(server); + nfs_fscache_release_super_cookie(sb); + nfs_free_server(server); + dprintk("<-- %s\n", __func__); + + +From gregkh@mini.kroah.org Fri Nov 6 14:15:50 2009 +Message-Id: <20091106221550.653683831@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 06 Nov 2009 14:15:23 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Trond Myklebust +Subject: [85/99] NFSv4: The link() operation should return any delegation on the file +References: <20091106221358.309857998@mini.kroah.org> +Content-Disposition: inline; filename=nfsv4-the-link-operation-should-return-any-delegation-on-the-file.patch +Content-Length: 704 +Lines: 25 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Trond Myklebust + +commit 9a3936aac133037f65124fcb2d676a6c201a90a4 upstream. + +Otherwise, we have to wait for the server to recall it. + +Signed-off-by: Trond Myklebust +Signed-off-by: Greg Kroah-Hartman + +--- + fs/nfs/dir.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/fs/nfs/dir.c ++++ b/fs/nfs/dir.c +@@ -1536,6 +1536,8 @@ nfs_link(struct dentry *old_dentry, stru + old_dentry->d_parent->d_name.name, old_dentry->d_name.name, + dentry->d_parent->d_name.name, dentry->d_name.name); + ++ nfs_inode_return_delegation(inode); ++ + d_drop(dentry); + error = NFS_PROTO(dir)->link(inode, dir, &dentry->d_name); + if (error == 0) { + + +From gregkh@mini.kroah.org Fri Nov 6 14:15:50 2009 +Message-Id: <20091106221550.789625190@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 06 Nov 2009 14:15:24 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Bastian Blank , + Benjamin Herrenschmidt +Subject: [86/99] powerpc: Remove SMP warning from PowerMac cpufreq +References: <20091106221358.309857998@mini.kroah.org> +Content-Disposition: inline; filename=powerpc-remove-smp-warning-from-powermac-cpufreq.patch +Content-Length: 1506 +Lines: 47 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Bastian Blank + +commit 6fdc31a2b86cf1f98e3eed896578ad9659eeb0f8 upstream. + +On Thu, Aug 13, 2009 at 04:14:58PM +1000, Benjamin Herrenschmidt wrote: +> On Tue, 2009-08-11 at 11:39 +0200, Bastian Blank wrote: +> > This patch just disables this driver on SMP kernels, as it is obviously +> > not supported. +> Why not remove the #error instead ? :-) I don't think it's still +> meaningful, especially since we use the timebase for delays nowadays +> which doesn't depend on the CPU frequency... + +Your call. Take this one: + +The build of a PowerMac 32bit kernel currently fails with + +error: #warning "WARNING, CPUFREQ not recommended on SMP kernels" + +Thie patch removes the not longer applicable SMP warning from the +PowerMac cpufreq code. + +Signed-off-by: Bastian Blank +Signed-off-by: Benjamin Herrenschmidt +Signed-off-by: Greg Kroah-Hartman + +--- + arch/powerpc/platforms/powermac/cpufreq_32.c | 8 -------- + 1 file changed, 8 deletions(-) + +--- a/arch/powerpc/platforms/powermac/cpufreq_32.c ++++ b/arch/powerpc/platforms/powermac/cpufreq_32.c +@@ -44,14 +44,6 @@ + */ + #undef DEBUG_FREQ + +-/* +- * There is a problem with the core cpufreq code on SMP kernels, +- * it won't recalculate the Bogomips properly +- */ +-#ifdef CONFIG_SMP +-#warning "WARNING, CPUFREQ not recommended on SMP kernels" +-#endif +- + extern void low_choose_7447a_dfs(int dfs); + extern void low_choose_750fx_pll(int pll); + extern void low_sleep_handler(void); + + +From gregkh@mini.kroah.org Fri Nov 6 14:15:51 2009 +Message-Id: <20091106221550.930885114@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 06 Nov 2009 14:15:25 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Wu Fengguang , + Hugh Dickins +Subject: [87/99] vmscan: limit VM_EXEC protection to file pages +References: <20091106221358.309857998@mini.kroah.org> +Content-Disposition: inline; filename=vmscan-limit-vm_exec-protection-to-file-pages.patch +Content-Length: 1202 +Lines: 33 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Wu Fengguang + +commit 41e20983fe553b39bc2b00e07c7a379f0c86a4bc upstream. + +It is possible to have !Anon but SwapBacked pages, and some apps could +create huge number of such pages with MAP_SHARED|MAP_ANONYMOUS. These +pages go into the ANON lru list, and hence shall not be protected: we only +care mapped executable files. Failing to do so may trigger OOM. + +Tested-by: Christian Borntraeger +Reviewed-by: Rik van Riel +Signed-off-by: Wu Fengguang +Cc: Hugh Dickins +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/vmscan.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/mm/vmscan.c ++++ b/mm/vmscan.c +@@ -1298,7 +1298,7 @@ static void shrink_active_list(unsigned + * IO, plus JVM can create lots of anon VM_EXEC pages, + * so we ignore them here. + */ +- if ((vm_flags & VM_EXEC) && !PageAnon(page)) { ++ if ((vm_flags & VM_EXEC) && page_is_file_cache(page)) { + list_add(&page->lru, &l_active); + continue; + } + + +From gregkh@mini.kroah.org Fri Nov 6 14:15:51 2009 +Message-Id: <20091106221551.089571423@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 06 Nov 2009 14:15:26 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Hidetoshi Seto , + Huang Ying , + Andi Kleen , + Ingo Molnar +Subject: [88/99] x86: mce: Clean up thermal throttling state tracking code +References: <20091106221358.309857998@mini.kroah.org> +Content-Disposition: inline; filename=x86-mce-clean-up-thermal-throttling-state-tracking-code.patch +Content-Length: 4990 +Lines: 153 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Ingo Molnar + +commit 3967684006f30c253bc6d4a6604d1bad4a7fc672 upstream. + +Instead of a mess of three separate percpu variables, consolidate +the state into a single structure. + +Also clean up therm_throt_process(), use cleaner and more +understandable variable names and a clearer logic. + +This, without changing the logic, makes the code more +streamlined, more readable and smaller as well: + + text data bss dec hex filename + 1487 169 4 1660 67c therm_throt.o.before + 1432 176 4 1612 64c therm_throt.o.after + +Cc: Hidetoshi Seto +Cc: Huang Ying +Cc: Andi Kleen +LKML-Reference: +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/cpu/mcheck/therm_throt.c | 63 +++++++++++++++++++------------ + 1 file changed, 39 insertions(+), 24 deletions(-) + +--- a/arch/x86/kernel/cpu/mcheck/therm_throt.c ++++ b/arch/x86/kernel/cpu/mcheck/therm_throt.c +@@ -34,20 +34,30 @@ + /* How long to wait between reporting thermal events */ + #define CHECK_INTERVAL (300 * HZ) + +-static DEFINE_PER_CPU(__u64, next_check) = INITIAL_JIFFIES; +-static DEFINE_PER_CPU(unsigned long, thermal_throttle_count); +-static DEFINE_PER_CPU(bool, thermal_throttle_active); ++/* ++ * Current thermal throttling state: ++ */ ++struct thermal_state { ++ bool is_throttled; ++ ++ u64 next_check; ++ unsigned long throttle_count; ++}; ++ ++static DEFINE_PER_CPU(struct thermal_state, thermal_state); + +-static atomic_t therm_throt_en = ATOMIC_INIT(0); ++static atomic_t therm_throt_en = ATOMIC_INIT(0); + + #ifdef CONFIG_SYSFS + #define define_therm_throt_sysdev_one_ro(_name) \ + static SYSDEV_ATTR(_name, 0444, therm_throt_sysdev_show_##_name, NULL) + + #define define_therm_throt_sysdev_show_func(name) \ +-static ssize_t therm_throt_sysdev_show_##name(struct sys_device *dev, \ +- struct sysdev_attribute *attr, \ +- char *buf) \ ++ \ ++static ssize_t therm_throt_sysdev_show_##name( \ ++ struct sys_device *dev, \ ++ struct sysdev_attribute *attr, \ ++ char *buf) \ + { \ + unsigned int cpu = dev->id; \ + ssize_t ret; \ +@@ -55,7 +65,7 @@ static ssize_t therm_throt_sysdev_show_# + preempt_disable(); /* CPU hotplug */ \ + if (cpu_online(cpu)) \ + ret = sprintf(buf, "%lu\n", \ +- per_cpu(thermal_throttle_##name, cpu)); \ ++ per_cpu(thermal_state, cpu).name); \ + else \ + ret = 0; \ + preempt_enable(); \ +@@ -63,11 +73,11 @@ static ssize_t therm_throt_sysdev_show_# + return ret; \ + } + +-define_therm_throt_sysdev_show_func(count); +-define_therm_throt_sysdev_one_ro(count); ++define_therm_throt_sysdev_show_func(throttle_count); ++define_therm_throt_sysdev_one_ro(throttle_count); + + static struct attribute *thermal_throttle_attrs[] = { +- &attr_count.attr, ++ &attr_throttle_count.attr, + NULL + }; + +@@ -93,33 +103,38 @@ static struct attribute_group thermal_th + * 1 : Event should be logged further, and a message has been + * printed to the syslog. + */ +-static int therm_throt_process(int curr) ++static int therm_throt_process(bool is_throttled) + { +- unsigned int cpu = smp_processor_id(); +- __u64 tmp_jiffs = get_jiffies_64(); +- bool was_throttled = __get_cpu_var(thermal_throttle_active); +- bool is_throttled = __get_cpu_var(thermal_throttle_active) = curr; ++ struct thermal_state *state; ++ unsigned int this_cpu; ++ bool was_throttled; ++ u64 now; ++ ++ this_cpu = smp_processor_id(); ++ now = get_jiffies_64(); ++ state = &per_cpu(thermal_state, this_cpu); ++ ++ was_throttled = state->is_throttled; ++ state->is_throttled = is_throttled; + + if (is_throttled) +- __get_cpu_var(thermal_throttle_count)++; ++ state->throttle_count++; + + if (!(was_throttled ^ is_throttled) && +- time_before64(tmp_jiffs, __get_cpu_var(next_check))) ++ time_before64(now, state->next_check)) + return 0; + +- __get_cpu_var(next_check) = tmp_jiffs + CHECK_INTERVAL; ++ state->next_check = now + CHECK_INTERVAL; + + /* if we just entered the thermal event */ + if (is_throttled) { +- printk(KERN_CRIT "CPU%d: Temperature above threshold, " +- "cpu clock throttled (total events = %lu)\n", +- cpu, __get_cpu_var(thermal_throttle_count)); ++ printk(KERN_CRIT "CPU%d: Temperature above threshold, cpu clock throttled (total events = %lu)\n", this_cpu, state->throttle_count); + + add_taint(TAINT_MACHINE_CHECK); + return 1; + } + if (was_throttled) { +- printk(KERN_INFO "CPU%d: Temperature/speed normal\n", cpu); ++ printk(KERN_INFO "CPU%d: Temperature/speed normal\n", this_cpu); + return 1; + } + +@@ -213,7 +228,7 @@ static void intel_thermal_interrupt(void + __u64 msr_val; + + rdmsrl(MSR_IA32_THERM_STATUS, msr_val); +- if (therm_throt_process(msr_val & THERM_STATUS_PROCHOT)) ++ if (therm_throt_process((msr_val & THERM_STATUS_PROCHOT) != 0)) + mce_log_therm_throt_event(msr_val); + } + + + +From gregkh@mini.kroah.org Fri Nov 6 14:15:51 2009 +Message-Id: <20091106221551.250413089@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 06 Nov 2009 14:15:27 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Hidetoshi Seto , + Huang Ying , + Andi Kleen , + Ingo Molnar +Subject: [89/99] x86: mce: Fix thermal throttling message storm +References: <20091106221358.309857998@mini.kroah.org> +Content-Disposition: inline; filename=x86-mce-fix-thermal-throttling-message-storm.patch +Content-Length: 2091 +Lines: 61 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Ingo Molnar + +commit b417c9fd8690637f0c91479435ab3e2bf450c038 upstream. + +If a system switches back and forth between hot and cold mode, +the MCE code will print a stream of critical kernel messages. + +Extend the throttling code to properly notice this, by +only printing the first hot + cold transition and omitting +the rest up to CHECK_INTERVAL (5 minutes). + +This way we'll only get a single incident of: + + [ 102.356584] CPU0: Temperature above threshold, cpu clock throttled (total events = 1) + [ 102.357000] Disabling lock debugging due to kernel taint + [ 102.369223] CPU0: Temperature/speed normal + +Every 5 minutes. The 'total events' count tells the number of cold/hot +transitions detected, should overheating occur after 5 minutes again: + +[ 402.357580] CPU0: Temperature above threshold, cpu clock throttled (total events = 24891) +[ 402.358001] CPU0: Temperature/speed normal +[ 450.704142] Machine check events logged + +Cc: Hidetoshi Seto +Cc: Huang Ying +Cc: Andi Kleen +LKML-Reference: +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/cpu/mcheck/therm_throt.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/arch/x86/kernel/cpu/mcheck/therm_throt.c ++++ b/arch/x86/kernel/cpu/mcheck/therm_throt.c +@@ -42,6 +42,7 @@ struct thermal_state { + + u64 next_check; + unsigned long throttle_count; ++ unsigned long last_throttle_count; + }; + + static DEFINE_PER_CPU(struct thermal_state, thermal_state); +@@ -120,11 +121,12 @@ static int therm_throt_process(bool is_t + if (is_throttled) + state->throttle_count++; + +- if (!(was_throttled ^ is_throttled) && +- time_before64(now, state->next_check)) ++ if (time_before64(now, state->next_check) && ++ state->throttle_count != state->last_throttle_count) + return 0; + + state->next_check = now + CHECK_INTERVAL; ++ state->last_throttle_count = state->throttle_count; + + /* if we just entered the thermal event */ + if (is_throttled) { + + +From gregkh@mini.kroah.org Fri Nov 6 14:15:51 2009 +Message-Id: <20091106221551.389639017@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 06 Nov 2009 14:15:28 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Reinette Chatre , + "John W. Linville" +Subject: [90/99] iwlwifi: fix potential rx buffer loss +References: <20091106221358.309857998@mini.kroah.org> +Content-Disposition: inline; filename=iwlwifi-fix-potential-rx-buffer-loss.patch +Content-Length: 4379 +Lines: 130 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Reinette Chatre + +commit de0bd50845eb5935ce3d503c5d2f565d6cb9ece1 upstream. + +RX handling maintains a few lists that keep track of the RX buffers. +Buffers move from one list to the other as they are used, replenished, and +again made available for usage. In one such instance, when a buffer is used +it enters the "rx_used" list. When buffers are replenished an skb is +attached to the buffer and it is moved to the "rx_free" list. The problem +here is that the buffer is first removed from the "rx_used" list _before_ the +skb is allocated. Thus, if the skb allocation fails this buffer remains +removed from the "rx_used" list and is thus lost for future usage. + +Fix this by first allocating the skb before trying to attach it to a list. +We add an additional check to not do this unnecessarily. + +Reported-by: Rick Farrington +Signed-off-by: Reinette Chatre +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/iwlwifi/iwl-rx.c | 24 +++++++++++++++++------- + drivers/net/wireless/iwlwifi/iwl3945-base.c | 24 ++++++++++++++++-------- + 2 files changed, 33 insertions(+), 15 deletions(-) + +--- a/drivers/net/wireless/iwlwifi/iwl3945-base.c ++++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c +@@ -1196,6 +1196,7 @@ static void iwl3945_rx_allocate(struct i + struct iwl_rx_queue *rxq = &priv->rxq; + struct list_head *element; + struct iwl_rx_mem_buffer *rxb; ++ struct sk_buff *skb; + unsigned long flags; + + while (1) { +@@ -1205,17 +1206,11 @@ static void iwl3945_rx_allocate(struct i + spin_unlock_irqrestore(&rxq->lock, flags); + return; + } +- +- element = rxq->rx_used.next; +- rxb = list_entry(element, struct iwl_rx_mem_buffer, list); +- list_del(element); + spin_unlock_irqrestore(&rxq->lock, flags); + + /* Alloc a new receive buffer */ +- rxb->skb = +- alloc_skb(priv->hw_params.rx_buf_size, +- priority); +- if (!rxb->skb) { ++ skb = alloc_skb(priv->hw_params.rx_buf_size, priority); ++ if (!skb) { + if (net_ratelimit()) + IWL_CRIT(priv, ": Can not allocate SKB buffers\n"); + /* We don't reschedule replenish work here -- we will +@@ -1224,6 +1219,19 @@ static void iwl3945_rx_allocate(struct i + break; + } + ++ spin_lock_irqsave(&rxq->lock, flags); ++ if (list_empty(&rxq->rx_used)) { ++ spin_unlock_irqrestore(&rxq->lock, flags); ++ dev_kfree_skb_any(skb); ++ return; ++ } ++ element = rxq->rx_used.next; ++ rxb = list_entry(element, struct iwl_rx_mem_buffer, list); ++ list_del(element); ++ spin_unlock_irqrestore(&rxq->lock, flags); ++ ++ rxb->skb = skb; ++ + /* If radiotap head is required, reserve some headroom here. + * The physical head count is a variable rx_stats->phy_count. + * We reserve 4 bytes here. Plus these extra bytes, the +--- a/drivers/net/wireless/iwlwifi/iwl-rx.c ++++ b/drivers/net/wireless/iwlwifi/iwl-rx.c +@@ -239,26 +239,22 @@ void iwl_rx_allocate(struct iwl_priv *pr + struct iwl_rx_queue *rxq = &priv->rxq; + struct list_head *element; + struct iwl_rx_mem_buffer *rxb; ++ struct sk_buff *skb; + unsigned long flags; + + while (1) { + spin_lock_irqsave(&rxq->lock, flags); +- + if (list_empty(&rxq->rx_used)) { + spin_unlock_irqrestore(&rxq->lock, flags); + return; + } +- element = rxq->rx_used.next; +- rxb = list_entry(element, struct iwl_rx_mem_buffer, list); +- list_del(element); +- + spin_unlock_irqrestore(&rxq->lock, flags); + + /* Alloc a new receive buffer */ +- rxb->skb = alloc_skb(priv->hw_params.rx_buf_size + 256, ++ skb = alloc_skb(priv->hw_params.rx_buf_size + 256, + priority); + +- if (!rxb->skb) { ++ if (!skb) { + IWL_CRIT(priv, "Can not allocate SKB buffers\n"); + /* We don't reschedule replenish work here -- we will + * call the restock method and if it still needs +@@ -266,6 +262,20 @@ void iwl_rx_allocate(struct iwl_priv *pr + break; + } + ++ spin_lock_irqsave(&rxq->lock, flags); ++ ++ if (list_empty(&rxq->rx_used)) { ++ spin_unlock_irqrestore(&rxq->lock, flags); ++ dev_kfree_skb_any(skb); ++ return; ++ } ++ element = rxq->rx_used.next; ++ rxb = list_entry(element, struct iwl_rx_mem_buffer, list); ++ list_del(element); ++ ++ spin_unlock_irqrestore(&rxq->lock, flags); ++ ++ rxb->skb = skb; + /* Get physical address of RB/SKB */ + rxb->real_dma_addr = pci_map_single( + priv->pci_dev, + + +From gregkh@mini.kroah.org Fri Nov 6 14:15:51 2009 +Message-Id: <20091106221551.539852739@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 06 Nov 2009 14:15:29 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Reinette Chatre , + Mel Gorman , + "John W. Linville" +Subject: [91/99] iwlwifi: reduce noise when skb allocation fails +References: <20091106221358.309857998@mini.kroah.org> +Content-Disposition: inline; filename=iwlwifi-reduce-noise-when-skb-allocation-fails.patch +Content-Length: 3315 +Lines: 78 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Reinette Chatre + +commit f82a924cc88a5541df1d4b9d38a0968cd077a051 upstream. + +Replenishment of receive buffers is done in the tasklet handling +received frames as well as in a workqueue. When we are in the tasklet +we cannot sleep and thus attempt atomic skb allocations. It is generally +not a big problem if this fails since iwl_rx_allocate is always followed +by a call to iwl_rx_queue_restock which will queue the work to replenish +the buffers at a time when sleeping is allowed. + +We thus add the __GFP_NOWARN to the skb allocation in iwl_rx_allocate to +reduce the noise if such an allocation fails while we still have enough +buffers. We do maintain the warning and the error message when we are low +on buffers to communicate to the user that there is a potential problem with +memory availability on system + +This addresses issue reported upstream in thread "iwlagn: order 2 page +allocation failures" in +http://thread.gmane.org/gmane.linux.kernel.wireless.general/39187 + +Signed-off-by: Reinette Chatre +Acked-by: Mel Gorman +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/iwlwifi/iwl-rx.c | 10 +++++++++- + drivers/net/wireless/iwlwifi/iwl3945-base.c | 9 ++++++++- + 2 files changed, 17 insertions(+), 2 deletions(-) + +--- a/drivers/net/wireless/iwlwifi/iwl3945-base.c ++++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c +@@ -1208,11 +1208,18 @@ static void iwl3945_rx_allocate(struct i + } + spin_unlock_irqrestore(&rxq->lock, flags); + ++ if (rxq->free_count > RX_LOW_WATERMARK) ++ priority |= __GFP_NOWARN; + /* Alloc a new receive buffer */ + skb = alloc_skb(priv->hw_params.rx_buf_size, priority); + if (!skb) { + if (net_ratelimit()) +- IWL_CRIT(priv, ": Can not allocate SKB buffers\n"); ++ IWL_DEBUG_INFO(priv, "Failed to allocate SKB buffer.\n"); ++ if ((rxq->free_count <= RX_LOW_WATERMARK) && ++ net_ratelimit()) ++ IWL_CRIT(priv, "Failed to allocate SKB buffer with %s. Only %u free buffers remaining.\n", ++ priority == GFP_ATOMIC ? "GFP_ATOMIC" : "GFP_KERNEL", ++ rxq->free_count); + /* We don't reschedule replenish work here -- we will + * call the restock method and if it still needs + * more buffers it will schedule replenish */ +--- a/drivers/net/wireless/iwlwifi/iwl-rx.c ++++ b/drivers/net/wireless/iwlwifi/iwl-rx.c +@@ -250,12 +250,20 @@ void iwl_rx_allocate(struct iwl_priv *pr + } + spin_unlock_irqrestore(&rxq->lock, flags); + ++ if (rxq->free_count > RX_LOW_WATERMARK) ++ priority |= __GFP_NOWARN; + /* Alloc a new receive buffer */ + skb = alloc_skb(priv->hw_params.rx_buf_size + 256, + priority); + + if (!skb) { +- IWL_CRIT(priv, "Can not allocate SKB buffers\n"); ++ if (net_ratelimit()) ++ IWL_DEBUG_INFO(priv, "Failed to allocate SKB buffer.\n"); ++ if ((rxq->free_count <= RX_LOW_WATERMARK) && ++ net_ratelimit()) ++ IWL_CRIT(priv, "Failed to allocate SKB buffer with %s. Only %u free buffers remaining.\n", ++ priority == GFP_ATOMIC ? "GFP_ATOMIC" : "GFP_KERNEL", ++ rxq->free_count); + /* We don't reschedule replenish work here -- we will + * call the restock method and if it still needs + * more buffers it will schedule replenish */ + + +From gregkh@mini.kroah.org Fri Nov 6 14:15:51 2009 +Message-Id: <20091106221551.713475785@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 06 Nov 2009 14:15:30 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Joerg Roedel +Subject: [92/99] x86/amd-iommu: Un__init function required on shutdown +References: <20091106221358.309857998@mini.kroah.org> +Content-Disposition: inline; filename=x86-amd-iommu-un__init-function-required-on-shutdown.patch +Content-Length: 857 +Lines: 28 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Joerg Roedel + +commit ca0207114f1708b563f510b7781a360ec5b98359 upstream. + +The function iommu_feature_disable is required on system +shutdown to disable the IOMMU but it is marked as __init. +This may result in a panic if the memory is reused. This +patch fixes this bug. + +Signed-off-by: Joerg Roedel +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/amd_iommu_init.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/x86/kernel/amd_iommu_init.c ++++ b/arch/x86/kernel/amd_iommu_init.c +@@ -240,7 +240,7 @@ static void iommu_feature_enable(struct + writel(ctrl, iommu->mmio_base + MMIO_CONTROL_OFFSET); + } + +-static void __init iommu_feature_disable(struct amd_iommu *iommu, u8 bit) ++static void iommu_feature_disable(struct amd_iommu *iommu, u8 bit) + { + u32 ctrl; + + + +From gregkh@mini.kroah.org Fri Nov 6 14:15:52 2009 +Message-Id: <20091106221551.845376408@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 06 Nov 2009 14:15:31 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + Greg KH +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + "Darrick J. Wong" , + Marcelo Tosatti +Subject: [93/99] KVM: Prevent kvm_init from corrupting debugfs structures +References: <20091106221358.309857998@mini.kroah.org> +Content-Disposition: inline; filename=kvm-prevent-kvm_init-from-corrupting-debugfs-structures.patch +Content-Length: 2262 +Lines: 85 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Darrick J. Wong + +commit: 0ea4ed8e948c30f88c824c973ee4b9529015fe65 upstream + +I'm seeing an oops condition when kvm-intel and kvm-amd are modprobe'd +during boot (say on an Intel system) and then rmmod'd: + + # modprobe kvm-intel + kvm_init() + kvm_init_debug() + kvm_arch_init() <-- stores debugfs dentries internally + (success, etc) + + # modprobe kvm-amd + kvm_init() + kvm_init_debug() <-- second initialization clobbers kvm's + internal pointers to dentries + kvm_arch_init() + kvm_exit_debug() <-- and frees them + + # rmmod kvm-intel + kvm_exit() + kvm_exit_debug() <-- double free of debugfs files! + + *BOOM* + +If execution gets to the end of kvm_init(), then the calling module has been +established as the kvm provider. Move the debugfs initialization to the end of +the function, and remove the now-unnecessary call to kvm_exit_debug() from the +error path. That way we avoid trampling on the debugfs entries and freeing +them twice. + +Signed-off-by: Darrick J. Wong +Signed-off-by: Marcelo Tosatti +Signed-off-by: Greg Kroah-Hartman + +--- + virt/kvm/kvm_main.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +--- a/virt/kvm/kvm_main.c ++++ b/virt/kvm/kvm_main.c +@@ -2590,8 +2590,6 @@ int kvm_init(void *opaque, unsigned int + int r; + int cpu; + +- kvm_init_debug(); +- + r = kvm_arch_init(opaque); + if (r) + goto out_fail; +@@ -2658,6 +2656,8 @@ int kvm_init(void *opaque, unsigned int + kvm_preempt_ops.sched_in = kvm_sched_in; + kvm_preempt_ops.sched_out = kvm_sched_out; + ++ kvm_init_debug(); ++ + return 0; + + out_free: +@@ -2679,7 +2679,6 @@ out_free_0: + __free_page(bad_page); + out: + kvm_arch_exit(); +- kvm_exit_debug(); + out_fail: + return r; + } +@@ -2688,6 +2687,7 @@ EXPORT_SYMBOL_GPL(kvm_init); + void kvm_exit(void) + { + kvm_trace_cleanup(); ++ kvm_exit_debug(); + misc_deregister(&kvm_dev); + kmem_cache_destroy(kvm_vcpu_cache); + sysdev_unregister(&kvm_sysdev); +@@ -2697,7 +2697,6 @@ void kvm_exit(void) + on_each_cpu(hardware_disable, NULL, 1); + kvm_arch_hardware_unsetup(); + kvm_arch_exit(); +- kvm_exit_debug(); + free_cpumask_var(cpus_hardware_enabled); + __free_page(bad_page); + } + + +From gregkh@mini.kroah.org Fri Nov 6 14:15:52 2009 +Message-Id: <20091106221552.018297553@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 06 Nov 2009 14:15:32 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Benjamin Herrenschmidt +Subject: [94/99] powerpc/pmac: Fix PowerSurge SMP IPI allocation +References: <20091106221358.309857998@mini.kroah.org> +Content-Disposition: inline; filename=powerpc-pmac-fix-powersurge-smp-ipi-allocation.patch +Content-Length: 897 +Lines: 26 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Benjamin Herrenschmidt + +commit 527b3639616b21c257518ee7c26fbf05232db0c0 upstream. + +The code for setting up the IPIs for SMP PowerSurge marchines bitrot, +it needs to properly map the HW interrupt number + +Signed-off-by: Benjamin Herrenschmidt +Signed-off-by: Greg Kroah-Hartman + +--- + arch/powerpc/platforms/powermac/smp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/powerpc/platforms/powermac/smp.c ++++ b/arch/powerpc/platforms/powermac/smp.c +@@ -408,7 +408,7 @@ static void __init smp_psurge_setup_cpu( + /* reset the entry point so if we get another intr we won't + * try to startup again */ + out_be32(psurge_start, 0x100); +- if (setup_irq(30, &psurge_irqaction)) ++ if (setup_irq(irq_create_mapping(NULL, 30), &psurge_irqaction)) + printk(KERN_ERR "Couldn't get primary IPI interrupt"); + } + + + +From gregkh@mini.kroah.org Fri Nov 6 14:15:52 2009 +Message-Id: <20091106221552.169581662@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 06 Nov 2009 14:15:33 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Benjamin Herrenschmidt +Subject: [95/99] powerpc/pmac: Fix issues with sleep on some powerbooks +References: <20091106221358.309857998@mini.kroah.org> +Content-Disposition: inline; filename=powerpc-pmac-fix-issues-with-sleep-on-some-powerbooks.patch +Content-Length: 4839 +Lines: 151 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Benjamin Herrenschmidt + +commit 11a50873ef2b3c1c3fe99a661c22c08f35d93553 upstream. + +Since the change of how interrupts are disabled during suspend, +certain PowerBook models started exhibiting various issues during +suspend or resume from sleep. + +I finally tracked it down to the code that runs various "platform" +functions (kind of little scripts extracted from the device-tree), +which uses our i2c and PMU drivers expecting interrutps to work, +and at a time where with the new scheme, they have been disabled. + +This causes timeouts internally which for some reason results in +the PMU being unable to see the trackpad, among other issues, really +it depends on the machine. Most of the time, we fail to properly adjust +some clocks for suspend/resume so the results are not always +predictable. + +This patch fixes it by using IRQF_TIMER for both the PMU and the I2C +interrupts. I prefer doing it this way than moving the call sites since +I really want those platform functions to still be called after all +drivers (and before sysdevs). + +We also do a slight cleanup to via-pmu.c driver to make sure the +ADB autopoll mask is handled correctly when doing bus resets + +Signed-off-by: Benjamin Herrenschmidt +Signed-off-by: Greg Kroah-Hartman + +--- + arch/powerpc/platforms/powermac/low_i2c.c | 7 +++-- + drivers/macintosh/via-pmu.c | 40 +++++++++++++++++------------- + 2 files changed, 28 insertions(+), 19 deletions(-) + +--- a/arch/powerpc/platforms/powermac/low_i2c.c ++++ b/arch/powerpc/platforms/powermac/low_i2c.c +@@ -540,8 +540,11 @@ static struct pmac_i2c_host_kw *__init k + /* Make sure IRQ is disabled */ + kw_write_reg(reg_ier, 0); + +- /* Request chip interrupt */ +- if (request_irq(host->irq, kw_i2c_irq, 0, "keywest i2c", host)) ++ /* Request chip interrupt. We set IRQF_TIMER because we don't ++ * want that interrupt disabled between the 2 passes of driver ++ * suspend or we'll have issues running the pfuncs ++ */ ++ if (request_irq(host->irq, kw_i2c_irq, IRQF_TIMER, "keywest i2c", host)) + host->irq = NO_IRQ; + + printk(KERN_INFO "KeyWest i2c @0x%08x irq %d %s\n", +--- a/drivers/macintosh/via-pmu.c ++++ b/drivers/macintosh/via-pmu.c +@@ -405,7 +405,11 @@ static int __init via_pmu_start(void) + printk(KERN_ERR "via-pmu: can't map interrupt\n"); + return -ENODEV; + } +- if (request_irq(irq, via_pmu_interrupt, 0, "VIA-PMU", (void *)0)) { ++ /* We set IRQF_TIMER because we don't want the interrupt to be disabled ++ * between the 2 passes of driver suspend, we control our own disabling ++ * for that one ++ */ ++ if (request_irq(irq, via_pmu_interrupt, IRQF_TIMER, "VIA-PMU", (void *)0)) { + printk(KERN_ERR "via-pmu: can't request irq %d\n", irq); + return -ENODEV; + } +@@ -419,7 +423,7 @@ static int __init via_pmu_start(void) + gpio_irq = irq_of_parse_and_map(gpio_node, 0); + + if (gpio_irq != NO_IRQ) { +- if (request_irq(gpio_irq, gpio1_interrupt, 0, ++ if (request_irq(gpio_irq, gpio1_interrupt, IRQF_TIMER, + "GPIO1 ADB", (void *)0)) + printk(KERN_ERR "pmu: can't get irq %d" + " (GPIO1)\n", gpio_irq); +@@ -925,8 +929,7 @@ proc_write_options(struct file *file, co + + #ifdef CONFIG_ADB + /* Send an ADB command */ +-static int +-pmu_send_request(struct adb_request *req, int sync) ++static int pmu_send_request(struct adb_request *req, int sync) + { + int i, ret; + +@@ -1005,16 +1008,11 @@ pmu_send_request(struct adb_request *req + } + + /* Enable/disable autopolling */ +-static int +-pmu_adb_autopoll(int devs) ++static int __pmu_adb_autopoll(int devs) + { + struct adb_request req; + +- if ((vias == NULL) || (!pmu_fully_inited) || !pmu_has_adb) +- return -ENXIO; +- + if (devs) { +- adb_dev_map = devs; + pmu_request(&req, NULL, 5, PMU_ADB_CMD, 0, 0x86, + adb_dev_map >> 8, adb_dev_map); + pmu_adb_flags = 2; +@@ -1027,9 +1025,17 @@ pmu_adb_autopoll(int devs) + return 0; + } + ++static int pmu_adb_autopoll(int devs) ++{ ++ if ((vias == NULL) || (!pmu_fully_inited) || !pmu_has_adb) ++ return -ENXIO; ++ ++ adb_dev_map = devs; ++ return __pmu_adb_autopoll(devs); ++} ++ + /* Reset the ADB bus */ +-static int +-pmu_adb_reset_bus(void) ++static int pmu_adb_reset_bus(void) + { + struct adb_request req; + int save_autopoll = adb_dev_map; +@@ -1038,13 +1044,13 @@ pmu_adb_reset_bus(void) + return -ENXIO; + + /* anyone got a better idea?? */ +- pmu_adb_autopoll(0); ++ __pmu_adb_autopoll(0); + +- req.nbytes = 5; ++ req.nbytes = 4; + req.done = NULL; + req.data[0] = PMU_ADB_CMD; +- req.data[1] = 0; +- req.data[2] = ADB_BUSRESET; ++ req.data[1] = ADB_BUSRESET; ++ req.data[2] = 0; + req.data[3] = 0; + req.data[4] = 0; + req.reply_len = 0; +@@ -1056,7 +1062,7 @@ pmu_adb_reset_bus(void) + pmu_wait_complete(&req); + + if (save_autopoll != 0) +- pmu_adb_autopoll(save_autopoll); ++ __pmu_adb_autopoll(save_autopoll); + + return 0; + } + + +From gregkh@mini.kroah.org Fri Nov 6 14:15:52 2009 +Message-Id: <20091106221552.296543736@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 06 Nov 2009 14:15:34 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Andre Detsch , + Michael Ellerman , + Benjamin Herrenschmidt +Subject: [96/99] powerpc/pci: Fix regression in powerpc MSI-X +References: <20091106221358.309857998@mini.kroah.org> +Content-Disposition: inline; filename=powerpc-pci-fix-regression-in-powerpc-msi-x.patch +Content-Length: 1811 +Lines: 59 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Andre Detsch + +commit 8435b027b87a78145992c37b0b8ed0f1b7761bf0 upstream. + +Patch f598282f5145036312d90875d0ed5c14b49fd8a7 exposed a problem in +powerpc MSI-X functionality, making network interfaces such as ixgbe +and cxgb3 stop to work when MSI-X is enabled. RX interrupts were not +being generated. + +The problem was caused because MSI irq was not being effectively +unmasked after device initialization. + +Signed-off-by: Andre Detsch +Signed-off-by: Michael Ellerman +Signed-off-by: Benjamin Herrenschmidt +Signed-off-by: Greg Kroah-Hartman + +--- + arch/powerpc/platforms/pseries/msi.c | 2 -- + arch/powerpc/platforms/pseries/xics.c | 9 +++++++++ + 2 files changed, 9 insertions(+), 2 deletions(-) + +--- a/arch/powerpc/platforms/pseries/msi.c ++++ b/arch/powerpc/platforms/pseries/msi.c +@@ -432,8 +432,6 @@ static int rtas_setup_msi_irqs(struct pc + /* Read config space back so we can restore after reset */ + read_msi_msg(virq, &msg); + entry->msg = msg; +- +- unmask_msi_irq(virq); + } + + return 0; +--- a/arch/powerpc/platforms/pseries/xics.c ++++ b/arch/powerpc/platforms/pseries/xics.c +@@ -18,6 +18,7 @@ + #include + #include + #include ++#include + #include + + #include +@@ -219,6 +220,14 @@ static void xics_unmask_irq(unsigned int + + static unsigned int xics_startup(unsigned int virq) + { ++ /* ++ * The generic MSI code returns with the interrupt disabled on the ++ * card, using the MSI mask bits. Firmware doesn't appear to unmask ++ * at that level, so we do it here by hand. ++ */ ++ if (irq_to_desc(virq)->msi_desc) ++ unmask_msi_irq(virq); ++ + /* unmask it */ + xics_unmask_irq(virq); + return 0; + + +From gregkh@mini.kroah.org Fri Nov 6 14:15:52 2009 +Message-Id: <20091106221552.428914681@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 06 Nov 2009 14:15:35 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Benjamin Herrenschmidt +Subject: [97/99] powerpc: Fix some late PowerMac G5 with PCIe ATI graphics +References: <20091106221358.309857998@mini.kroah.org> +Content-Disposition: inline; filename=powerpc-fix-some-late-powermac-g5-with-pcie-ati-graphics.patch +Content-Length: 3847 +Lines: 99 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Benjamin Herrenschmidt + +commit cede3930f0ca6fef353fa01306c72a01420bd45e upstream. + +A misconfiguration by the firmware of the U4 PCIe bridge on PowerMac G5 +with the U4 bridge (latest generations, may also affect the iMac G5 +"iSight") is causing us to re-assign the PCI BARs of the video card, +which can get it out of sync with the firmware, thus breaking offb. + +This works around it by fixing up the bridge configuration properly +at boot time. It also fixes a bug where the firmware provides us with +an incorrect set of accessible regions in the device-tree. + +Signed-off-by: Benjamin Herrenschmidt +Signed-off-by: Greg Kroah-Hartman + +--- + arch/powerpc/platforms/powermac/pci.c | 61 ++++++++++++++++++++++++++++++++++ + include/linux/pci_ids.h | 1 + 2 files changed, 62 insertions(+) + +--- a/arch/powerpc/platforms/powermac/pci.c ++++ b/arch/powerpc/platforms/powermac/pci.c +@@ -1286,3 +1286,64 @@ static void fixup_k2_sata(struct pci_dev + } + DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_SERVERWORKS, 0x0240, fixup_k2_sata); + ++/* ++ * On U4 (aka CPC945) the PCIe root complex "P2P" bridge resource ranges aren't ++ * configured by the firmware. The bridge itself seems to ignore them but it ++ * causes problems with Linux which then re-assigns devices below the bridge, ++ * thus changing addresses of those devices from what was in the device-tree, ++ * which sucks when those are video cards using offb ++ * ++ * We could just mark it transparent but I prefer fixing up the resources to ++ * properly show what's going on here, as I have some doubts about having them ++ * badly configured potentially being an issue for DMA. ++ * ++ * We leave PIO alone, it seems to be fine ++ * ++ * Oh and there's another funny bug. The OF properties advertize the region ++ * 0xf1000000..0xf1ffffff as being forwarded as memory space. But that's ++ * actually not true, this region is the memory mapped config space. So we ++ * also need to filter it out or we'll map things in the wrong place. ++ */ ++static void fixup_u4_pcie(struct pci_dev* dev) ++{ ++ struct pci_controller *host = pci_bus_to_host(dev->bus); ++ struct resource *region = NULL; ++ u32 reg; ++ int i; ++ ++ /* Only do that on PowerMac */ ++ if (!machine_is(powermac)) ++ return; ++ ++ /* Find the largest MMIO region */ ++ for (i = 0; i < 3; i++) { ++ struct resource *r = &host->mem_resources[i]; ++ if (!(r->flags & IORESOURCE_MEM)) ++ continue; ++ /* Skip the 0xf0xxxxxx..f2xxxxxx regions, we know they ++ * are reserved by HW for other things ++ */ ++ if (r->start >= 0xf0000000 && r->start < 0xf3000000) ++ continue; ++ if (!region || (r->end - r->start) > ++ (region->end - region->start)) ++ region = r; ++ } ++ /* Nothing found, bail */ ++ if (region == 0) ++ return; ++ ++ /* Print things out */ ++ printk(KERN_INFO "PCI: Fixup U4 PCIe bridge range: %pR\n", region); ++ ++ /* Fixup bridge config space. We know it's a Mac, resource aren't ++ * offset so let's just blast them as-is. We also know that they ++ * fit in 32 bits ++ */ ++ reg = ((region->start >> 16) & 0xfff0) | (region->end & 0xfff00000); ++ pci_write_config_dword(dev, PCI_MEMORY_BASE, reg); ++ pci_write_config_dword(dev, PCI_PREF_BASE_UPPER32, 0); ++ pci_write_config_dword(dev, PCI_PREF_LIMIT_UPPER32, 0); ++ pci_write_config_dword(dev, PCI_PREF_MEMORY_BASE, 0); ++} ++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_APPLE, PCI_DEVICE_ID_APPLE_U4_PCIE, fixup_u4_pcie); +--- a/include/linux/pci_ids.h ++++ b/include/linux/pci_ids.h +@@ -880,6 +880,7 @@ + #define PCI_DEVICE_ID_APPLE_SH_SUNGEM 0x0051 + #define PCI_DEVICE_ID_APPLE_U3L_AGP 0x0058 + #define PCI_DEVICE_ID_APPLE_U3H_AGP 0x0059 ++#define PCI_DEVICE_ID_APPLE_U4_PCIE 0x005b + #define PCI_DEVICE_ID_APPLE_IPID2_AGP 0x0066 + #define PCI_DEVICE_ID_APPLE_IPID2_ATA 0x0069 + #define PCI_DEVICE_ID_APPLE_IPID2_FW 0x006a + + +From gregkh@mini.kroah.org Fri Nov 6 14:15:52 2009 +Message-Id: <20091106221552.566130941@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 06 Nov 2009 14:15:36 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Joseph Chan , + Jeff Garzik +Subject: [98/99] sata_via: Remove redundant device ID for VIA VT8261 +References: <20091106221358.309857998@mini.kroah.org> +Content-Disposition: inline; filename=sata_via-remove-redundant-device-id-for-via-vt8261.patch +Content-Length: 826 +Lines: 27 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: JosephChan@via.com.tw + +commit f38e35b43f2924b3b4e51147b7193f32e9276db4 upstream. + +Just remove redundant device ID for VIA VT8261. +The device ID 0x9000 and 0x9040 are redundant (for VT8261). +The 0x9040 is reserved for other usage. + +Signed-off-by: Joseph Chan +Signed-off-by: Jeff Garzik +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ata/sata_via.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/drivers/ata/sata_via.c ++++ b/drivers/ata/sata_via.c +@@ -93,7 +93,6 @@ static const struct pci_device_id svia_p + { PCI_VDEVICE(VIA, 0x7372), vt6420 }, + { PCI_VDEVICE(VIA, 0x5287), vt8251 }, /* 2 sata chnls (Master/Slave) */ + { PCI_VDEVICE(VIA, 0x9000), vt8251 }, +- { PCI_VDEVICE(VIA, 0x9040), vt8251 }, + + { } /* terminate list */ + }; + + +From gregkh@mini.kroah.org Fri Nov 6 14:15:52 2009 +Message-Id: <20091106221552.709553080@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 06 Nov 2009 14:15:37 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Joseph Chan , + Jeff Garzik +Subject: [99/99] pata_via: extend the rev_max for VT6330 +References: <20091106221358.309857998@mini.kroah.org> +Content-Disposition: inline; filename=pata_via-extend-the-rev_max-for-vt6330.patch +Content-Length: 1324 +Lines: 27 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: JosephChan@via.com.tw + +commit 7d948b1114c7eded14e5a31f440af751d70ecde0 upstream. + +Fix the VT6330 issue, it's because the rev_max of VT6330 exceeds 0x2f. +The VT6415 and VT6330 share the same device ID. + +Signed-off-by: Joseph Chan +Signed-off-by: Jeff Garzik +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ata/pata_via.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/ata/pata_via.c ++++ b/drivers/ata/pata_via.c +@@ -111,7 +111,7 @@ static const struct via_isa_bridge { + { "vt8251", PCI_DEVICE_ID_VIA_8251, 0x00, 0x2f, VIA_UDMA_133 | VIA_BAD_AST }, + { "cx700", PCI_DEVICE_ID_VIA_CX700, 0x00, 0x2f, VIA_UDMA_133 | VIA_BAD_AST | VIA_SATA_PATA }, + { "vt6410", PCI_DEVICE_ID_VIA_6410, 0x00, 0x2f, VIA_UDMA_133 | VIA_BAD_AST | VIA_NO_ENABLES }, +- { "vt6415", PCI_DEVICE_ID_VIA_6415, 0x00, 0x2f, VIA_UDMA_133 | VIA_BAD_AST | VIA_NO_ENABLES }, ++ { "vt6415", PCI_DEVICE_ID_VIA_6415, 0x00, 0xff, VIA_UDMA_133 | VIA_BAD_AST | VIA_NO_ENABLES }, + { "vt8237a", PCI_DEVICE_ID_VIA_8237A, 0x00, 0x2f, VIA_UDMA_133 | VIA_BAD_AST }, + { "vt8237", PCI_DEVICE_ID_VIA_8237, 0x00, 0x2f, VIA_UDMA_133 | VIA_BAD_AST }, + { "vt8235", PCI_DEVICE_ID_VIA_8235, 0x00, 0x2f, VIA_UDMA_133 | VIA_BAD_AST }, + + +From gregkh@mini.kroah.org Fri Nov 6 14:15:38 2009 +Message-Id: <20091106221358.309857998@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 06 Nov 2009 14:13:58 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk +Subject: [00/99] 2.6.31.6 stable review +Content-Length: 6493 +Lines: 124 + +This is the start of the stable review cycle for the 2.6.31.6 release. +There are 99 patches in this series, all will be posted as a response to +this one. If anyone has any issues with these being applied, please let +us know. If anyone is a maintainer of the proper subsystem, and wants +to add a Signed-off-by: line to the patch, please respond with it. + +Responses should be made by November 8, 2009, 20:00:00 UTC. Anything +received after that time might be too late. + +The whole patch series can be found in one patch at: + kernel.org/pub/linux/kernel/v2.6/stable-review/patch-2.6.31.6-rc1.gz +and the diffstat can be found below. + + +thanks, + +greg k-h + +---------------- + + Documentation/dontdiff | 1 - + Makefile | 2 +- + arch/alpha/kernel/vmlinux.lds.S | 1 + + arch/m68k/Kconfig | 6 +- + arch/mips/kernel/Makefile | 2 + + arch/mips/kernel/vmlinux.lds.S | 12 +- + arch/powerpc/platforms/powermac/cpufreq_32.c | 8 - + arch/powerpc/platforms/powermac/low_i2c.c | 7 +- + arch/powerpc/platforms/powermac/pci.c | 61 +++ + arch/powerpc/platforms/powermac/smp.c | 2 +- + arch/powerpc/platforms/pseries/msi.c | 2 - + arch/powerpc/platforms/pseries/xics.c | 9 + + arch/sparc/kernel/ldc.c | 4 +- + arch/sparc/kernel/setup_32.c | 2 - + arch/sparc/kernel/setup_64.c | 2 - + arch/x86/ia32/ia32entry.S | 5 +- + arch/x86/include/asm/amd_iommu.h | 1 + + arch/x86/include/asm/uv/uv_hub.h | 7 + + arch/x86/kernel/amd_iommu.c | 2 + + arch/x86/kernel/amd_iommu_init.c | 24 +- + arch/x86/kernel/apic/x2apic_uv_x.c | 8 +- + arch/x86/kernel/cpu/mcheck/therm_throt.c | 67 ++-- + arch/x86/kernel/e820.c | 4 +- + arch/x86/kernel/tlb_uv.c | 4 +- + arch/x86/kvm/i8254.c | 2 +- + arch/x86/kvm/lapic.c | 2 +- + arch/x86/kvm/x86.c | 3 +- + arch/x86/xen/enlighten.c | 11 +- + drivers/acpi/pci_root.c | 11 + + drivers/acpi/scan.c | 12 +- + drivers/ata/ahci.c | 52 +--- + drivers/ata/libata-core.c | 12 +- + drivers/ata/libata-eh.c | 6 +- + drivers/ata/pata_sc1200.c | 3 +- + drivers/ata/pata_via.c | 2 +- + drivers/ata/sata_nv.c | 18 +- + drivers/ata/sata_via.c | 1 - + drivers/base/driver.c | 2 +- + drivers/char/Kconfig | 6 +- + drivers/char/agp/intel-agp.c | 7 + + drivers/char/hvc_xen.c | 25 +- + drivers/char/vt.c | 3 - + drivers/cpuidle/cpuidle.c | 5 +- + drivers/gpu/drm/i915/i915_drv.h | 2 + + drivers/gpu/drm/i915/i915_reg.h | 14 +- + drivers/gpu/drm/i915/intel_display.c | 73 +++- + drivers/hwmon/it87.c | 5 +- + drivers/input/mouse/synaptics.c | 10 + + drivers/macintosh/via-pmu.c | 40 +- + drivers/md/dm-exception-store.c | 22 +- + drivers/md/dm-exception-store.h | 8 +- + drivers/md/dm-log-userspace-base.c | 2 +- + drivers/md/dm-snap-persistent.c | 16 +- + drivers/md/dm-snap.c | 25 +- + drivers/md/dm.c | 11 +- + drivers/misc/sgi-gru/gruprocfs.c | 13 +- + drivers/net/bonding/bond_main.c | 2 +- + drivers/net/wireless/b43/rfkill.c | 3 +- + drivers/net/wireless/iwlwifi/iwl-rx.c | 34 ++- + drivers/net/wireless/iwlwifi/iwl3945-base.c | 33 +- + drivers/net/wireless/libertas/if_usb.c | 2 +- + drivers/net/wireless/ray_cs.c | 2 +- + drivers/scsi/dpt_i2o.c | 4 + + drivers/serial/8250_pci.c | 11 + + drivers/usb/serial/option.c | 10 + + drivers/usb/serial/sierra.c | 23 +- + drivers/video/console/.gitignore | 2 - + drivers/video/console/Kconfig | 9 +- + drivers/video/console/Makefile | 12 - + drivers/video/console/prom.uni | 11 - + drivers/video/console/promcon.c | 598 -------------------------- + drivers/virtio/virtio_ring.c | 3 + + drivers/watchdog/riowd.c | 2 +- + fs/cifs/connect.c | 3 +- + fs/fuse/file.c | 5 +- + fs/hfsplus/wrapper.c | 4 + + fs/nfs/client.c | 2 +- + fs/nfs/dir.c | 2 + + fs/nfs/direct.c | 1 + + fs/nfs/nfs4proc.c | 15 +- + fs/nfs/nfs4renewd.c | 6 - + fs/nfs/nfs4xdr.c | 1 - + fs/nfs/super.c | 2 +- + fs/nilfs2/btnode.c | 3 +- + fs/notify/inode_mark.c | 6 +- + fs/pipe.c | 41 ++- + include/drm/drm_pciids.h | 1 + + include/linux/moduleparam.h | 1 - + include/linux/pci_ids.h | 4 + + kernel/futex.c | 20 +- + kernel/params.c | 17 +- + mm/mempolicy.c | 13 +- + mm/nommu.c | 6 +- + mm/swapfile.c | 3 +- + mm/vmscan.c | 2 +- + net/mac80211/cfg.c | 6 +- + net/mac80211/tx.c | 2 +- + net/sched/cls_api.c | 2 +- + net/unix/af_unix.c | 2 + + scripts/Makefile | 1 - + security/keys/keyctl.c | 2 +- + sound/pci/ice1712/ice1724.c | 2 +- + virt/kvm/kvm_main.c | 7 +- + 103 files changed, 657 insertions(+), 953 deletions(-) + diff --git a/queue-2.6.31/mips-fix-build-of-vmlinux.lds.patch b/review-2.6.31/mips-fix-build-of-vmlinux.lds.patch similarity index 100% rename from queue-2.6.31/mips-fix-build-of-vmlinux.lds.patch rename to review-2.6.31/mips-fix-build-of-vmlinux.lds.patch diff --git a/queue-2.6.31/mm-remove-incorrect-swap_count-from-try_to_unuse.patch b/review-2.6.31/mm-remove-incorrect-swap_count-from-try_to_unuse.patch similarity index 100% rename from queue-2.6.31/mm-remove-incorrect-swap_count-from-try_to_unuse.patch rename to review-2.6.31/mm-remove-incorrect-swap_count-from-try_to_unuse.patch diff --git a/queue-2.6.31/netlink-fix-typo-in-initialization-cve-2009-3612.patch b/review-2.6.31/netlink-fix-typo-in-initialization-cve-2009-3612.patch similarity index 100% rename from queue-2.6.31/netlink-fix-typo-in-initialization-cve-2009-3612.patch rename to review-2.6.31/netlink-fix-typo-in-initialization-cve-2009-3612.patch diff --git a/queue-2.6.31/nfs-avoid-overrun-when-copying-client-ip-address-string.patch b/review-2.6.31/nfs-avoid-overrun-when-copying-client-ip-address-string.patch similarity index 100% rename from queue-2.6.31/nfs-avoid-overrun-when-copying-client-ip-address-string.patch rename to review-2.6.31/nfs-avoid-overrun-when-copying-client-ip-address-string.patch diff --git a/queue-2.6.31/nfs-fix-nfs_parse_mount_options-kfree-leak.patch b/review-2.6.31/nfs-fix-nfs_parse_mount_options-kfree-leak.patch similarity index 100% rename from queue-2.6.31/nfs-fix-nfs_parse_mount_options-kfree-leak.patch rename to review-2.6.31/nfs-fix-nfs_parse_mount_options-kfree-leak.patch diff --git a/queue-2.6.31/nfs-panic-when-commit-fails.patch b/review-2.6.31/nfs-panic-when-commit-fails.patch similarity index 100% rename from queue-2.6.31/nfs-panic-when-commit-fails.patch rename to review-2.6.31/nfs-panic-when-commit-fails.patch diff --git a/queue-2.6.31/nfsv4-fix-a-bug-when-the-server-returns-nfs4err_resource.patch b/review-2.6.31/nfsv4-fix-a-bug-when-the-server-returns-nfs4err_resource.patch similarity index 100% rename from queue-2.6.31/nfsv4-fix-a-bug-when-the-server-returns-nfs4err_resource.patch rename to review-2.6.31/nfsv4-fix-a-bug-when-the-server-returns-nfs4err_resource.patch diff --git a/queue-2.6.31/nfsv4-fix-two-unbalanced-put_rpccred-issues.patch b/review-2.6.31/nfsv4-fix-two-unbalanced-put_rpccred-issues.patch similarity index 100% rename from queue-2.6.31/nfsv4-fix-two-unbalanced-put_rpccred-issues.patch rename to review-2.6.31/nfsv4-fix-two-unbalanced-put_rpccred-issues.patch diff --git a/queue-2.6.31/nfsv4-kill-nfs4_renewd_prepare_shutdown.patch b/review-2.6.31/nfsv4-kill-nfs4_renewd_prepare_shutdown.patch similarity index 100% rename from queue-2.6.31/nfsv4-kill-nfs4_renewd_prepare_shutdown.patch rename to review-2.6.31/nfsv4-kill-nfs4_renewd_prepare_shutdown.patch diff --git a/queue-2.6.31/nfsv4-the-link-operation-should-return-any-delegation-on-the-file.patch b/review-2.6.31/nfsv4-the-link-operation-should-return-any-delegation-on-the-file.patch similarity index 100% rename from queue-2.6.31/nfsv4-the-link-operation-should-return-any-delegation-on-the-file.patch rename to review-2.6.31/nfsv4-the-link-operation-should-return-any-delegation-on-the-file.patch diff --git a/queue-2.6.31/nilfs2-fix-dirty-page-accounting-leak-causing-hang-at-write.patch b/review-2.6.31/nilfs2-fix-dirty-page-accounting-leak-causing-hang-at-write.patch similarity index 100% rename from queue-2.6.31/nilfs2-fix-dirty-page-accounting-leak-causing-hang-at-write.patch rename to review-2.6.31/nilfs2-fix-dirty-page-accounting-leak-causing-hang-at-write.patch diff --git a/queue-2.6.31/nommu-don-t-pass-null-pointers-to-fput-in-do_mmap_pgoff.patch b/review-2.6.31/nommu-don-t-pass-null-pointers-to-fput-in-do_mmap_pgoff.patch similarity index 100% rename from queue-2.6.31/nommu-don-t-pass-null-pointers-to-fput-in-do_mmap_pgoff.patch rename to review-2.6.31/nommu-don-t-pass-null-pointers-to-fput-in-do_mmap_pgoff.patch diff --git a/queue-2.6.31/param-fix-lots-of-bugs-with-writing-charp-params-from-sysfs-by-leaking-mem.patch b/review-2.6.31/param-fix-lots-of-bugs-with-writing-charp-params-from-sysfs-by-leaking-mem.patch similarity index 100% rename from queue-2.6.31/param-fix-lots-of-bugs-with-writing-charp-params-from-sysfs-by-leaking-mem.patch rename to review-2.6.31/param-fix-lots-of-bugs-with-writing-charp-params-from-sysfs-by-leaking-mem.patch diff --git a/queue-2.6.31/param-fix-null-comparison-on-oom.patch b/review-2.6.31/param-fix-null-comparison-on-oom.patch similarity index 100% rename from queue-2.6.31/param-fix-null-comparison-on-oom.patch rename to review-2.6.31/param-fix-null-comparison-on-oom.patch diff --git a/queue-2.6.31/param-fix-setting-arrays-of-bool.patch b/review-2.6.31/param-fix-setting-arrays-of-bool.patch similarity index 100% rename from queue-2.6.31/param-fix-setting-arrays-of-bool.patch rename to review-2.6.31/param-fix-setting-arrays-of-bool.patch diff --git a/queue-2.6.31/pata_sc1200-fix-crash-on-boot.patch b/review-2.6.31/pata_sc1200-fix-crash-on-boot.patch similarity index 100% rename from queue-2.6.31/pata_sc1200-fix-crash-on-boot.patch rename to review-2.6.31/pata_sc1200-fix-crash-on-boot.patch diff --git a/queue-2.6.31/pata_via-extend-the-rev_max-for-vt6330.patch b/review-2.6.31/pata_via-extend-the-rev_max-for-vt6330.patch similarity index 100% rename from queue-2.6.31/pata_via-extend-the-rev_max-for-vt6330.patch rename to review-2.6.31/pata_via-extend-the-rev_max-for-vt6330.patch diff --git a/queue-2.6.31/pci-increase-alignment-to-make-more-space-for-hidden-code.patch b/review-2.6.31/pci-increase-alignment-to-make-more-space-for-hidden-code.patch similarity index 100% rename from queue-2.6.31/pci-increase-alignment-to-make-more-space-for-hidden-code.patch rename to review-2.6.31/pci-increase-alignment-to-make-more-space-for-hidden-code.patch diff --git a/queue-2.6.31/powerpc-fix-some-late-powermac-g5-with-pcie-ati-graphics.patch b/review-2.6.31/powerpc-fix-some-late-powermac-g5-with-pcie-ati-graphics.patch similarity index 100% rename from queue-2.6.31/powerpc-fix-some-late-powermac-g5-with-pcie-ati-graphics.patch rename to review-2.6.31/powerpc-fix-some-late-powermac-g5-with-pcie-ati-graphics.patch diff --git a/queue-2.6.31/powerpc-pci-fix-regression-in-powerpc-msi-x.patch b/review-2.6.31/powerpc-pci-fix-regression-in-powerpc-msi-x.patch similarity index 100% rename from queue-2.6.31/powerpc-pci-fix-regression-in-powerpc-msi-x.patch rename to review-2.6.31/powerpc-pci-fix-regression-in-powerpc-msi-x.patch diff --git a/queue-2.6.31/powerpc-pmac-fix-issues-with-sleep-on-some-powerbooks.patch b/review-2.6.31/powerpc-pmac-fix-issues-with-sleep-on-some-powerbooks.patch similarity index 100% rename from queue-2.6.31/powerpc-pmac-fix-issues-with-sleep-on-some-powerbooks.patch rename to review-2.6.31/powerpc-pmac-fix-issues-with-sleep-on-some-powerbooks.patch diff --git a/queue-2.6.31/powerpc-pmac-fix-powersurge-smp-ipi-allocation.patch b/review-2.6.31/powerpc-pmac-fix-powersurge-smp-ipi-allocation.patch similarity index 100% rename from queue-2.6.31/powerpc-pmac-fix-powersurge-smp-ipi-allocation.patch rename to review-2.6.31/powerpc-pmac-fix-powersurge-smp-ipi-allocation.patch diff --git a/queue-2.6.31/powerpc-remove-smp-warning-from-powermac-cpufreq.patch b/review-2.6.31/powerpc-remove-smp-warning-from-powermac-cpufreq.patch similarity index 100% rename from queue-2.6.31/powerpc-remove-smp-warning-from-powermac-cpufreq.patch rename to review-2.6.31/powerpc-remove-smp-warning-from-powermac-cpufreq.patch diff --git a/queue-2.6.31/ray_cs-fix-copy_from_user-handling.patch b/review-2.6.31/ray_cs-fix-copy_from_user-handling.patch similarity index 100% rename from queue-2.6.31/ray_cs-fix-copy_from_user-handling.patch rename to review-2.6.31/ray_cs-fix-copy_from_user-handling.patch diff --git a/queue-2.6.31/revert-acpi-attach-the-acpi-device-to-the-acpi-handle-as-early-as-possible.patch b/review-2.6.31/revert-acpi-attach-the-acpi-device-to-the-acpi-handle-as-early-as-possible.patch similarity index 100% rename from queue-2.6.31/revert-acpi-attach-the-acpi-device-to-the-acpi-handle-as-early-as-possible.patch rename to review-2.6.31/revert-acpi-attach-the-acpi-device-to-the-acpi-handle-as-early-as-possible.patch diff --git a/queue-2.6.31/sata_nv-make-sure-link-is-brough-up-online-when-skipping-hardreset.patch b/review-2.6.31/sata_nv-make-sure-link-is-brough-up-online-when-skipping-hardreset.patch similarity index 100% rename from queue-2.6.31/sata_nv-make-sure-link-is-brough-up-online-when-skipping-hardreset.patch rename to review-2.6.31/sata_nv-make-sure-link-is-brough-up-online-when-skipping-hardreset.patch diff --git a/queue-2.6.31/sata_via-remove-redundant-device-id-for-via-vt8261.patch b/review-2.6.31/sata_via-remove-redundant-device-id-for-via-vt8261.patch similarity index 100% rename from queue-2.6.31/sata_via-remove-redundant-device-id-for-via-vt8261.patch rename to review-2.6.31/sata_via-remove-redundant-device-id-for-via-vt8261.patch diff --git a/queue-2.6.31/series b/review-2.6.31/series similarity index 100% rename from queue-2.6.31/series rename to review-2.6.31/series diff --git a/queue-2.6.31/sgi-gru-decrapfiy-options_write-function.patch b/review-2.6.31/sgi-gru-decrapfiy-options_write-function.patch similarity index 100% rename from queue-2.6.31/sgi-gru-decrapfiy-options_write-function.patch rename to review-2.6.31/sgi-gru-decrapfiy-options_write-function.patch diff --git a/queue-2.6.31/sparc-kill-prom-console-driver.patch b/review-2.6.31/sparc-kill-prom-console-driver.patch similarity index 100% rename from queue-2.6.31/sparc-kill-prom-console-driver.patch rename to review-2.6.31/sparc-kill-prom-console-driver.patch diff --git a/queue-2.6.31/sparc64-set-irqf_disabled-on-ldc-channel-irqs.patch b/review-2.6.31/sparc64-set-irqf_disabled-on-ldc-channel-irqs.patch similarity index 100% rename from queue-2.6.31/sparc64-set-irqf_disabled-on-ldc-channel-irqs.patch rename to review-2.6.31/sparc64-set-irqf_disabled-on-ldc-channel-irqs.patch diff --git a/queue-2.6.31/tty-mark-generic_serial-users-as-broken.patch b/review-2.6.31/tty-mark-generic_serial-users-as-broken.patch similarity index 100% rename from queue-2.6.31/tty-mark-generic_serial-users-as-broken.patch rename to review-2.6.31/tty-mark-generic_serial-users-as-broken.patch diff --git a/queue-2.6.31/usb-option-patch-for-huawei-mobile-broadband-e270-modem.patch b/review-2.6.31/usb-option-patch-for-huawei-mobile-broadband-e270-modem.patch similarity index 100% rename from queue-2.6.31/usb-option-patch-for-huawei-mobile-broadband-e270-modem.patch rename to review-2.6.31/usb-option-patch-for-huawei-mobile-broadband-e270-modem.patch diff --git a/queue-2.6.31/usb-option-support-for-airplus-mcd650-datacard.patch b/review-2.6.31/usb-option-support-for-airplus-mcd650-datacard.patch similarity index 100% rename from queue-2.6.31/usb-option-support-for-airplus-mcd650-datacard.patch rename to review-2.6.31/usb-option-support-for-airplus-mcd650-datacard.patch diff --git a/queue-2.6.31/usb-option-tlaytech-tue800-support.patch b/review-2.6.31/usb-option-tlaytech-tue800-support.patch similarity index 100% rename from queue-2.6.31/usb-option-tlaytech-tue800-support.patch rename to review-2.6.31/usb-option-tlaytech-tue800-support.patch diff --git a/queue-2.6.31/usb-serial-sierra-driver-send_setup-autopm-fix.patch b/review-2.6.31/usb-serial-sierra-driver-send_setup-autopm-fix.patch similarity index 100% rename from queue-2.6.31/usb-serial-sierra-driver-send_setup-autopm-fix.patch rename to review-2.6.31/usb-serial-sierra-driver-send_setup-autopm-fix.patch diff --git a/queue-2.6.31/virtio-order-used-ring-after-used-index-read.patch b/review-2.6.31/virtio-order-used-ring-after-used-index-read.patch similarity index 100% rename from queue-2.6.31/virtio-order-used-ring-after-used-index-read.patch rename to review-2.6.31/virtio-order-used-ring-after-used-index-read.patch diff --git a/queue-2.6.31/vmscan-limit-vm_exec-protection-to-file-pages.patch b/review-2.6.31/vmscan-limit-vm_exec-protection-to-file-pages.patch similarity index 100% rename from queue-2.6.31/vmscan-limit-vm_exec-protection-to-file-pages.patch rename to review-2.6.31/vmscan-limit-vm_exec-protection-to-file-pages.patch diff --git a/queue-2.6.31/watchdog-fix-rio-watchdog-probe-function.patch b/review-2.6.31/watchdog-fix-rio-watchdog-probe-function.patch similarity index 100% rename from queue-2.6.31/watchdog-fix-rio-watchdog-probe-function.patch rename to review-2.6.31/watchdog-fix-rio-watchdog-probe-function.patch diff --git a/queue-2.6.31/x86-64-fix-register-leak-in-32-bit-syscall-audting.patch b/review-2.6.31/x86-64-fix-register-leak-in-32-bit-syscall-audting.patch similarity index 100% rename from queue-2.6.31/x86-64-fix-register-leak-in-32-bit-syscall-audting.patch rename to review-2.6.31/x86-64-fix-register-leak-in-32-bit-syscall-audting.patch diff --git a/queue-2.6.31/x86-amd-iommu-un__init-function-required-on-shutdown.patch b/review-2.6.31/x86-amd-iommu-un__init-function-required-on-shutdown.patch similarity index 100% rename from queue-2.6.31/x86-amd-iommu-un__init-function-required-on-shutdown.patch rename to review-2.6.31/x86-amd-iommu-un__init-function-required-on-shutdown.patch diff --git a/queue-2.6.31/x86-amd-iommu-workaround-for-erratum-63.patch b/review-2.6.31/x86-amd-iommu-workaround-for-erratum-63.patch similarity index 100% rename from queue-2.6.31/x86-amd-iommu-workaround-for-erratum-63.patch rename to review-2.6.31/x86-amd-iommu-workaround-for-erratum-63.patch diff --git a/queue-2.6.31/x86-mce-clean-up-thermal-throttling-state-tracking-code.patch b/review-2.6.31/x86-mce-clean-up-thermal-throttling-state-tracking-code.patch similarity index 100% rename from queue-2.6.31/x86-mce-clean-up-thermal-throttling-state-tracking-code.patch rename to review-2.6.31/x86-mce-clean-up-thermal-throttling-state-tracking-code.patch diff --git a/queue-2.6.31/x86-mce-fix-thermal-throttling-message-storm.patch b/review-2.6.31/x86-mce-fix-thermal-throttling-message-storm.patch similarity index 100% rename from queue-2.6.31/x86-mce-fix-thermal-throttling-message-storm.patch rename to review-2.6.31/x86-mce-fix-thermal-throttling-message-storm.patch diff --git a/queue-2.6.31/x86-uv-fix-information-in-__uv_hub_info-structure.patch b/review-2.6.31/x86-uv-fix-information-in-__uv_hub_info-structure.patch similarity index 100% rename from queue-2.6.31/x86-uv-fix-information-in-__uv_hub_info-structure.patch rename to review-2.6.31/x86-uv-fix-information-in-__uv_hub_info-structure.patch diff --git a/queue-2.6.31/x86-uv-set-delivery_mode-4-for-vector-nmi_vector-in-uv_hub_send_ipi.patch b/review-2.6.31/x86-uv-set-delivery_mode-4-for-vector-nmi_vector-in-uv_hub_send_ipi.patch similarity index 100% rename from queue-2.6.31/x86-uv-set-delivery_mode-4-for-vector-nmi_vector-in-uv_hub_send_ipi.patch rename to review-2.6.31/x86-uv-set-delivery_mode-4-for-vector-nmi_vector-in-uv_hub_send_ipi.patch diff --git a/queue-2.6.31/xen-hvc-make-sure-console-output-is-always-emitted-with-explicit-polling.patch b/review-2.6.31/xen-hvc-make-sure-console-output-is-always-emitted-with-explicit-polling.patch similarity index 100% rename from queue-2.6.31/xen-hvc-make-sure-console-output-is-always-emitted-with-explicit-polling.patch rename to review-2.6.31/xen-hvc-make-sure-console-output-is-always-emitted-with-explicit-polling.patch diff --git a/queue-2.6.31/xen-mask-extended-topology-info-in-cpuid.patch b/review-2.6.31/xen-mask-extended-topology-info-in-cpuid.patch similarity index 100% rename from queue-2.6.31/xen-mask-extended-topology-info-in-cpuid.patch rename to review-2.6.31/xen-mask-extended-topology-info-in-cpuid.patch