From: Greg Kroah-Hartman Date: Wed, 1 Jul 2009 00:17:51 +0000 (-0700) Subject: remove 2 .29 patches and add the mbox for review X-Git-Tag: v2.6.27.26~5 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=11a58438e1673cd14763c7f5dc76a5b290579e64;p=thirdparty%2Fkernel%2Fstable-queue.git remove 2 .29 patches and add the mbox for review --- diff --git a/queue-2.6.29/mbox b/queue-2.6.29/mbox new file mode 100644 index 00000000000..fbbc6a359ef --- /dev/null +++ b/queue-2.6.29/mbox @@ -0,0 +1,3000 @@ +From gregkh@mini.kroah.org Tue Jun 30 17:15:48 2009 +Message-Id: <20090701001548.065942448@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:13:57 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Philippe De Muyter +Subject: [patch 01/35] parport: netmos 9845 & 9855 1P4S fixes +References: <20090701001356.007288418@mini.kroah.org> +Content-Disposition: inline; filename=parport-netmos-9845-9855-1p4s-fixes.patch +Content-Length: 5045 +Lines: 121 + +2.6.29-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Philippe De Muyter + +commit 50db9d8e4ca17974595e3848cb65f9371a304de4 upstream. + +netmos serial/parallel adapters come in different flavour differing only +by the number of parallel and serial ports, which are encoded in the +subdevice ID. + +Last fix of Christian Pellegrin for 9855 2P2S broke support for 9855 1P4S, +and works only by side-effect for the first parallel port of a 2P2S, as +this first parallel port is found by reading the second addr entry of +(struct parport_pc_pci) cards[netmos_9855], which is not initialized, and +hence has value 0, which happens to be the BAR of the first parallel port. + +netmos_9xx5_combo entry in (struct parport_pc_pci) cards[], which is used +for a 9845 1P4S must also be fixed for the parallel port support when +there are 4 serial ports because this entry currently gives 2 as BAR index +for the parallel port. Actually, in this case, BAR 2 is the 3rd serial +port while the parallel port is at BAR 4. + +I fixed 9845 1P4S and 9855 1P4S support, while preserving 9855 2P2S support, + +- by creating a netmos_9855_2p entry and using it for 9855 boards with 2 + parallel ports : 9855 2P2S and 9855 2P0S boards, + +- and by allowing netmos_parallel_init to change not only the number of + parallel ports (0 or 1), but making it also change the BAR index of the + parallel port when the serial ports are before the parallel port. + +PS: the netmos_9855_2p entry in (struct pciserial_board) +pci_parport_serial_boards[] is needed because netmos_parallel_init has no +clean way to replace FL_BASE2 by FL_BASE4 in the description of the serial +ports in function of the number of parallel ports on the card. + +Tested with 9845 1P4S, 9855 1P4S and 9855 2P2S boards. + +Signed-off-by: Philippe De Muyter +Tested-by: Christian Pellegrin +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/parport/parport_serial.c | 30 +++++++++++++++++++++++++----- + 1 file changed, 25 insertions(+), 5 deletions(-) + +--- a/drivers/parport/parport_serial.c ++++ b/drivers/parport/parport_serial.c +@@ -30,6 +30,7 @@ enum parport_pc_pci_cards { + titan_210l, + netmos_9xx5_combo, + netmos_9855, ++ netmos_9855_2p, + avlab_1s1p, + avlab_1s2p, + avlab_2s1p, +@@ -62,7 +63,7 @@ struct parport_pc_pci { + struct parport_pc_pci *card, int failed); + }; + +-static int __devinit netmos_parallel_init(struct pci_dev *dev, struct parport_pc_pci *card, int autoirq, int autodma) ++static int __devinit netmos_parallel_init(struct pci_dev *dev, struct parport_pc_pci *par, int autoirq, int autodma) + { + /* the rule described below doesn't hold for this device */ + if (dev->device == PCI_DEVICE_ID_NETMOS_9835 && +@@ -74,9 +75,17 @@ static int __devinit netmos_parallel_ini + * and serial ports. The form is 0x00PS, where

is the number of + * parallel ports and is the number of serial ports. + */ +- card->numports = (dev->subsystem_device & 0xf0) >> 4; +- if (card->numports > ARRAY_SIZE(card->addr)) +- card->numports = ARRAY_SIZE(card->addr); ++ par->numports = (dev->subsystem_device & 0xf0) >> 4; ++ if (par->numports > ARRAY_SIZE(par->addr)) ++ par->numports = ARRAY_SIZE(par->addr); ++ /* ++ * This function is currently only called for cards with up to ++ * one parallel port. ++ * Parallel port BAR is either before or after serial ports BARS; ++ * hence, lo should be either 0 or equal to the number of serial ports. ++ */ ++ if (par->addr[0].lo != 0) ++ par->addr[0].lo = dev->subsystem_device & 0xf; + return 0; + } + +@@ -84,7 +93,8 @@ static struct parport_pc_pci cards[] __d + /* titan_110l */ { 1, { { 3, -1 }, } }, + /* titan_210l */ { 1, { { 3, -1 }, } }, + /* netmos_9xx5_combo */ { 1, { { 2, -1 }, }, netmos_parallel_init }, +- /* netmos_9855 */ { 1, { { 2, -1 }, }, netmos_parallel_init }, ++ /* netmos_9855 */ { 1, { { 0, -1 }, }, netmos_parallel_init }, ++ /* netmos_9855_2p */ { 2, { { 0, -1 }, { 2, -1 }, } }, + /* avlab_1s1p */ { 1, { { 1, 2}, } }, + /* avlab_1s2p */ { 2, { { 1, 2}, { 3, 4 },} }, + /* avlab_2s1p */ { 1, { { 2, 3}, } }, +@@ -110,6 +120,10 @@ static struct pci_device_id parport_seri + { PCI_VENDOR_ID_NETMOS, PCI_DEVICE_ID_NETMOS_9845, + PCI_ANY_ID, PCI_ANY_ID, 0, 0, netmos_9xx5_combo }, + { PCI_VENDOR_ID_NETMOS, PCI_DEVICE_ID_NETMOS_9855, ++ 0x1000, 0x0020, 0, 0, netmos_9855_2p }, ++ { PCI_VENDOR_ID_NETMOS, PCI_DEVICE_ID_NETMOS_9855, ++ 0x1000, 0x0022, 0, 0, netmos_9855_2p }, ++ { PCI_VENDOR_ID_NETMOS, PCI_DEVICE_ID_NETMOS_9855, + PCI_ANY_ID, PCI_ANY_ID, 0, 0, netmos_9855 }, + /* PCI_VENDOR_ID_AVLAB/Intek21 has another bunch of cards ...*/ + { PCI_VENDOR_ID_AFAVLAB, 0x2110, +@@ -192,6 +206,12 @@ static struct pciserial_board pci_parpor + .uart_offset = 8, + }, + [netmos_9855] = { ++ .flags = FL_BASE2 | FL_BASE_BARS, ++ .num_ports = 1, ++ .base_baud = 115200, ++ .uart_offset = 8, ++ }, ++ [netmos_9855_2p] = { + .flags = FL_BASE4 | FL_BASE_BARS, + .num_ports = 1, + .base_baud = 115200, + + +From gregkh@mini.kroah.org Tue Jun 30 17:15:48 2009 +Message-Id: <20090701001548.246214392@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:13:58 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Alan Cox , + Kirill Smelkov +Subject: [patch 02/35] 8250: Fix oops from setserial +References: <20090701001356.007288418@mini.kroah.org> +Content-Disposition: inline; filename=8250-fix-oops-from-setserial.patch +Content-Length: 2528 +Lines: 83 + +2.6.29-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Alan Cox + +commit b8e7e40abeac49644fec4a4f52ffe74c7b05eca0 upstream. + +If you setserial a port which has never been initialised we change the type +but don't update the I/O method pointers. The same problem is true if you +change the io type of a port - but nobody ever does that so nobody noticed! + +Remember the old type and when attaching if the type has changed reload the +port accessor pointers. We can't do it blindly as some 8250 drivers load custom +accessors and we must not stomp those. + +Tested-by: Victor Seryodkin +Closes-bug: #13367 +Signed-off-by: Alan Cox +Signed-off-by: Linus Torvalds +Cc: Kirill Smelkov +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/serial/8250.c | 15 +++++++++++++++ + 1 file changed, 15 insertions(+) + +--- a/drivers/serial/8250.c ++++ b/drivers/serial/8250.c +@@ -137,6 +137,7 @@ struct uart_8250_port { + unsigned char mcr; + unsigned char mcr_mask; /* mask of user bits */ + unsigned char mcr_force; /* mask of forced bits */ ++ unsigned char cur_iotype; /* Running I/O type */ + + /* + * Some bits in registers are cleared on a read, so they must +@@ -471,6 +472,7 @@ static void io_serial_out(struct uart_po + + static void set_io_from_upio(struct uart_port *p) + { ++ struct uart_8250_port *up = (struct uart_8250_port *)p; + switch (p->iotype) { + case UPIO_HUB6: + p->serial_in = hub6_serial_in; +@@ -509,6 +511,8 @@ static void set_io_from_upio(struct uart + p->serial_out = io_serial_out; + break; + } ++ /* Remember loaded iotype */ ++ up->cur_iotype = p->iotype; + } + + static void +@@ -1937,6 +1941,9 @@ static int serial8250_startup(struct uar + up->capabilities = uart_config[up->port.type].flags; + up->mcr = 0; + ++ if (up->port.iotype != up->cur_iotype) ++ set_io_from_upio(port); ++ + if (up->port.type == PORT_16C950) { + /* Wake up and initialize UART */ + up->acr = 0; +@@ -2563,6 +2570,9 @@ static void serial8250_config_port(struc + if (ret < 0) + probeflags &= ~PROBE_RSA; + ++ if (up->port.iotype != up->cur_iotype) ++ set_io_from_upio(port); ++ + if (flags & UART_CONFIG_TYPE) + autoconfig(up, probeflags); + if (up->port.type != PORT_UNKNOWN && flags & UART_CONFIG_IRQ) +@@ -2671,6 +2681,11 @@ serial8250_register_ports(struct uart_dr + { + int i; + ++ for (i = 0; i < nr_uarts; i++) { ++ struct uart_8250_port *up = &serial8250_ports[i]; ++ up->cur_iotype = 0xFF; ++ } ++ + serial8250_isa_init_ports(); + + for (i = 0; i < nr_uarts; i++) { + + +From gregkh@mini.kroah.org Tue Jun 30 17:15:48 2009 +Message-Id: <20090701001548.420416552@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:13:59 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + "Peter Botha" , + Jiri Slaby +Subject: [patch 03/35] char: mxser, fix ISA board lookup +References: <20090701001356.007288418@mini.kroah.org> +Content-Disposition: inline; filename=char-mxser-fix-isa-board-lookup.patch +Content-Length: 1134 +Lines: 35 + +2.6.29-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Peter Botha + +commit 96050dfb25966612008dcea7d342e91fa01e993c upstream. + +There's a bug in the mxser kernel module that still appears in the +2.6.29.4 kernel. + +mxser_get_ISA_conf takes a ioaddress as its first argument, by passing the +not of the ioaddr, you're effectively passing 0 which means it won't be +able to talk to an ISA card. I have tested this, and removing the ! +fixes the problem. + +Cc: "Peter Botha" +Signed-off-by: Jiri Slaby +Acked-by: Alan Cox +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/char/mxser.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/char/mxser.c ++++ b/drivers/char/mxser.c +@@ -2712,7 +2712,7 @@ static int __init mxser_module_init(void + continue; + + brd = &mxser_boards[m]; +- retval = mxser_get_ISA_conf(!ioaddr[b], brd); ++ retval = mxser_get_ISA_conf(ioaddr[b], brd); + if (retval <= 0) { + brd->info = NULL; + continue; + + +From gregkh@mini.kroah.org Tue Jun 30 17:15:48 2009 +Message-Id: <20090701001548.636200762@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:14:00 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jan Kara , + +Subject: [patch 04/35] jbd: fix race in buffer processing in commit code +References: <20090701001356.007288418@mini.kroah.org> +Content-Disposition: inline; filename=jbd-fix-race-in-buffer-processing-in-commit-code.patch +Content-Length: 1753 +Lines: 48 + +2.6.29-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Jan Kara + +commit a61d90d75d0f9e86432c45b496b4b0fbf0fd03dc upstream. + +In commit code, we scan buffers attached to a transaction. During this +scan, we sometimes have to drop j_list_lock and then we recheck whether +the journal buffer head didn't get freed by journal_try_to_free_buffers(). + But checking for buffer_jbd(bh) isn't enough because a new journal head +could get attached to our buffer head. So add a check whether the journal +head remained the same and whether it's still at the same transaction and +list. + +This is a nasty bug and can cause problems like memory corruption (use after +free) or trigger various assertions in JBD code (observed). + +Signed-off-by: Jan Kara +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + fs/jbd/commit.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/fs/jbd/commit.c ++++ b/fs/jbd/commit.c +@@ -238,7 +238,7 @@ write_out_data: + spin_lock(&journal->j_list_lock); + } + /* Someone already cleaned up the buffer? */ +- if (!buffer_jbd(bh) ++ if (!buffer_jbd(bh) || bh2jh(bh) != jh + || jh->b_transaction != commit_transaction + || jh->b_jlist != BJ_SyncData) { + jbd_unlock_bh_state(bh); +@@ -466,7 +466,9 @@ void journal_commit_transaction(journal_ + spin_lock(&journal->j_list_lock); + continue; + } +- if (buffer_jbd(bh) && jh->b_jlist == BJ_Locked) { ++ if (buffer_jbd(bh) && bh2jh(bh) == jh && ++ jh->b_transaction == commit_transaction && ++ jh->b_jlist == BJ_Locked) { + __journal_unfile_buffer(jh); + jbd_unlock_bh_state(bh); + journal_remove_journal_head(bh); + + +From gregkh@mini.kroah.org Tue Jun 30 17:15:49 2009 +Message-Id: <20090701001548.822249123@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:14:01 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Eric Dumazet , + "David S. Miller" +Subject: [patch 05/35] r8169: fix crash when large packets are received +References: <20090701001356.007288418@mini.kroah.org> +Content-Disposition: inline; filename=r8169-fix-crash-when-large-packets-are-received.patch +Content-Length: 2792 +Lines: 82 + +2.6.29-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Eric Dumazet + +commit fdd7b4c3302c93f6833e338903ea77245eb510b4 upstream. + +Michael Tokarev reported receiving a large packet could crash +a machine with RTL8169 NIC. +( original thread at http://lkml.org/lkml/2009/6/8/192 ) + +Problem is this driver tells that NIC frames up to 16383 bytes +can be received but provides skb to rx ring allocated with +smaller sizes (1536 bytes in case standard 1500 bytes MTU is used) + +When a frame larger than what was allocated by driver is received, +dma transfert can occurs past the end of buffer and corrupt +kernel memory. + +Fix is to tell to NIC what is the maximum size a frame can be. + +This bug is very old, (before git introduction, linux-2.6.10), and +should be backported to stable versions. + +Reported-by: Michael Tokarev +Signed-off-by: Eric Dumazet +Tested-by: Michael Tokarev +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/r8169.c | 11 +++++------ + 1 file changed, 5 insertions(+), 6 deletions(-) + +--- a/drivers/net/r8169.c ++++ b/drivers/net/r8169.c +@@ -66,7 +66,6 @@ static const int multicast_filter_limit + #define RX_DMA_BURST 6 /* Maximum PCI burst, '6' is 1024 */ + #define TX_DMA_BURST 6 /* Maximum PCI burst, '6' is 1024 */ + #define EarlyTxThld 0x3F /* 0x3F means NO early transmit */ +-#define RxPacketMaxSize 0x3FE8 /* 16K - 1 - ETH_HLEN - VLAN - CRC... */ + #define SafeMtu 0x1c20 /* ... actually life sucks beyond ~7k */ + #define InterFrameGap 0x03 /* 3 means InterFrameGap = the shortest one */ + +@@ -2357,10 +2356,10 @@ static u16 rtl_rw_cpluscmd(void __iomem + return cmd; + } + +-static void rtl_set_rx_max_size(void __iomem *ioaddr) ++static void rtl_set_rx_max_size(void __iomem *ioaddr, unsigned int rx_buf_sz) + { + /* Low hurts. Let's disable the filtering. */ +- RTL_W16(RxMaxSize, 16383); ++ RTL_W16(RxMaxSize, rx_buf_sz); + } + + static void rtl8169_set_magic_reg(void __iomem *ioaddr, unsigned mac_version) +@@ -2407,7 +2406,7 @@ static void rtl_hw_start_8169(struct net + + RTL_W8(EarlyTxThres, EarlyTxThld); + +- rtl_set_rx_max_size(ioaddr); ++ rtl_set_rx_max_size(ioaddr, tp->rx_buf_sz); + + if ((tp->mac_version == RTL_GIGA_MAC_VER_01) || + (tp->mac_version == RTL_GIGA_MAC_VER_02) || +@@ -2668,7 +2667,7 @@ static void rtl_hw_start_8168(struct net + + RTL_W8(EarlyTxThres, EarlyTxThld); + +- rtl_set_rx_max_size(ioaddr); ++ rtl_set_rx_max_size(ioaddr, tp->rx_buf_sz); + + tp->cp_cmd |= RTL_R16(CPlusCmd) | PktCntrDisable | INTT_1; + +@@ -2846,7 +2845,7 @@ static void rtl_hw_start_8101(struct net + + RTL_W8(EarlyTxThres, EarlyTxThld); + +- rtl_set_rx_max_size(ioaddr); ++ rtl_set_rx_max_size(ioaddr, tp->rx_buf_sz); + + tp->cp_cmd |= rtl_rw_cpluscmd(ioaddr) | PCIMulRW; + + + +From gregkh@mini.kroah.org Tue Jun 30 17:15:49 2009 +Message-Id: <20090701001549.014483188@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:14:02 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Nick Piggin , + Al Viro +Subject: [patch 06/35] fs: remove incorrect I_NEW warnings +References: <20090701001356.007288418@mini.kroah.org> +Content-Disposition: inline; filename=fs-remove-incorrect-i_new-warnings.patch +Content-Length: 1335 +Lines: 42 + +2.6.29-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Nick Piggin + +commit 545b9fd3d737afc0bb5203b1e79194a471605acd upstream. + +Some filesystems can call in to sync an inode that is still in the +I_NEW state (eg. ext family, when mounted with -osync). This is OK +because the filesystem has sole access to the new inode, so it can +modify i_state without races (because no other thread should be +modifying it, by definition of I_NEW). Ie. a false positive, so +remove the warnings. + +The races are described here 7ef0d7377cb287e08f3ae94cebc919448e1f5dff, +which is also where the warnings were introduced. + +Reported-by: Stephen Hemminger +Signed-off-by: Nick Piggin +Signed-off-by: Al Viro +Signed-off-by: Greg Kroah-Hartman + +--- + fs/fs-writeback.c | 2 -- + 1 file changed, 2 deletions(-) + +--- a/fs/fs-writeback.c ++++ b/fs/fs-writeback.c +@@ -274,7 +274,6 @@ __sync_single_inode(struct inode *inode, + int ret; + + BUG_ON(inode->i_state & I_SYNC); +- WARN_ON(inode->i_state & I_NEW); + + /* Set I_SYNC, reset I_DIRTY */ + dirty = inode->i_state & I_DIRTY; +@@ -299,7 +298,6 @@ __sync_single_inode(struct inode *inode, + } + + spin_lock(&inode_lock); +- WARN_ON(inode->i_state & I_NEW); + inode->i_state &= ~I_SYNC; + if (!(inode->i_state & I_FREEING)) { + if (!(inode->i_state & I_DIRTY) && + + +From gregkh@mini.kroah.org Tue Jun 30 17:15:49 2009 +Message-Id: <20090701001549.207107959@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:14:03 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Yinghai Lu , + Ingo Molnar , + "H. Peter Anvin" , + Thomas Gleixner +Subject: [patch 07/35] firmware_map: fix hang with x86/32bit +References: <20090701001356.007288418@mini.kroah.org> +Content-Disposition: inline; filename=firmware_map-fix-hang-with-x86-32bit.patch +Content-Length: 4211 +Lines: 113 + +2.6.29-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Yinghai Lu + +commit 3b0fde0fac19c180317eb0601b3504083f4b9bf5 upstream. + +Addresses http://bugzilla.kernel.org/show_bug.cgi?id=13484 + +Peer reported: +| The bug is introduced from kernel 2.6.27, if E820 table reserve the memory +| above 4G in 32bit OS(BIOS-e820: 00000000fff80000 - 0000000120000000 +| (reserved)), system will report Int 6 error and hang up. The bug is caused by +| the following code in drivers/firmware/memmap.c, the resource_size_t is 32bit +| variable in 32bit OS, the BUG_ON() will be invoked to result in the Int 6 +| error. I try the latest 32bit Ubuntu and Fedora distributions, all hit this +| bug. +|====== +|static int firmware_map_add_entry(resource_size_t start, resource_size_t end, +| const char *type, +| struct firmware_map_entry *entry) + +and it only happen with CONFIG_PHYS_ADDR_T_64BIT is not set. + +it turns out we need to pass u64 instead of resource_size_t for that. + +[akpm@linux-foundation.org: add comment] +Reported-and-tested-by: Peer Chen +Signed-off-by: Yinghai Lu +Cc: Ingo Molnar +Acked-by: H. Peter Anvin +Cc: Thomas Gleixner +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/firmware/memmap.c | 16 +++++++++------- + include/linux/firmware-map.h | 12 ++++-------- + 2 files changed, 13 insertions(+), 15 deletions(-) + +--- a/drivers/firmware/memmap.c ++++ b/drivers/firmware/memmap.c +@@ -31,8 +31,12 @@ + * information is necessary as for the resource tree. + */ + struct firmware_map_entry { +- resource_size_t start; /* start of the memory range */ +- resource_size_t end; /* end of the memory range (incl.) */ ++ /* ++ * start and end must be u64 rather than resource_size_t, because e820 ++ * resources can lie at addresses above 4G. ++ */ ++ u64 start; /* start of the memory range */ ++ u64 end; /* end of the memory range (incl.) */ + const char *type; /* type of the memory range */ + struct list_head list; /* entry for the linked list */ + struct kobject kobj; /* kobject for each entry */ +@@ -101,7 +105,7 @@ static LIST_HEAD(map_entries); + * Common implementation of firmware_map_add() and firmware_map_add_early() + * which expects a pre-allocated struct firmware_map_entry. + **/ +-static int firmware_map_add_entry(resource_size_t start, resource_size_t end, ++static int firmware_map_add_entry(u64 start, u64 end, + const char *type, + struct firmware_map_entry *entry) + { +@@ -132,8 +136,7 @@ static int firmware_map_add_entry(resour + * + * Returns 0 on success, or -ENOMEM if no memory could be allocated. + **/ +-int firmware_map_add(resource_size_t start, resource_size_t end, +- const char *type) ++int firmware_map_add(u64 start, u64 end, const char *type) + { + struct firmware_map_entry *entry; + +@@ -157,8 +160,7 @@ int firmware_map_add(resource_size_t sta + * + * Returns 0 on success, or -ENOMEM if no memory could be allocated. + **/ +-int __init firmware_map_add_early(resource_size_t start, resource_size_t end, +- const char *type) ++int __init firmware_map_add_early(u64 start, u64 end, const char *type) + { + struct firmware_map_entry *entry; + +--- a/include/linux/firmware-map.h ++++ b/include/linux/firmware-map.h +@@ -24,21 +24,17 @@ + */ + #ifdef CONFIG_FIRMWARE_MEMMAP + +-int firmware_map_add(resource_size_t start, resource_size_t end, +- const char *type); +-int firmware_map_add_early(resource_size_t start, resource_size_t end, +- const char *type); ++int firmware_map_add(u64 start, u64 end, const char *type); ++int firmware_map_add_early(u64 start, u64 end, const char *type); + + #else /* CONFIG_FIRMWARE_MEMMAP */ + +-static inline int firmware_map_add(resource_size_t start, resource_size_t end, +- const char *type) ++static inline int firmware_map_add(u64 start, u64 end, const char *type) + { + return 0; + } + +-static inline int firmware_map_add_early(resource_size_t start, +- resource_size_t end, const char *type) ++static inline int firmware_map_add_early(u64 start, u64 end, const char *type) + { + return 0; + } + + +From gregkh@mini.kroah.org Tue Jun 30 17:15:49 2009 +Message-Id: <20090701001549.472261271@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:14:04 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Shaohua Li , + Jesse Barnes +Subject: [patch 08/35] PCI: disable ASPM on VIA root-port-under-bridge configurations +References: <20090701001356.007288418@mini.kroah.org> +Content-Disposition: inline; filename=pci-disable-aspm-on-via-root-port-under-bridge-configurations.patch +Content-Length: 870 +Lines: 26 + +2.6.29-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Shaohua Li + +commit 8e822df700694ca6850d1e0c122fd7004b2778d8 upstream. + +VIA has a strange chipset, it has root port under a bridge. Disable ASPM +for such strange chipset. + +Tested-by: Wolfgang Denk +Signed-off-by: Shaohua Li +Signed-off-by: Jesse Barnes +Signed-off-by: Greg Kroah-Hartman + +--- a/drivers/pci/pcie/aspm.c ++++ b/drivers/pci/pcie/aspm.c +@@ -638,6 +638,10 @@ void pcie_aspm_init_link_state(struct pci_dev *pdev) + if (pdev->pcie_type != PCI_EXP_TYPE_ROOT_PORT && + pdev->pcie_type != PCI_EXP_TYPE_DOWNSTREAM) + return; ++ /* VIA has a strange chipset, root port is under a bridge */ ++ if (pdev->pcie_type == PCI_EXP_TYPE_ROOT_PORT && ++ pdev->bus->self) ++ return; + down_read(&pci_bus_sem); + if (list_empty(&pdev->subordinate->devices)) + goto out; + + +From gregkh@mini.kroah.org Tue Jun 30 17:15:49 2009 +Message-Id: <20090701001549.565804796@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:14:05 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Dmitry Torokhov +Subject: [patch 09/35] atkbd: add forced release quirks for four more keyboard models +References: <20090701001356.007288418@mini.kroah.org> +Content-Disposition: inline; filename=atkbd-add-forced-release-quirks-for-four-more-keyboard-models.patch +Content-Length: 8721 +Lines: 285 + +2.6.29-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Chuck Ebbert + +Add atkbd forced key release quirks for four more notebook models. + +Rollup of: +linux-2.6.git-391916985b009b8934d00f772a3bde0d8a495ebd.patch +linux-2.6.git-adcb523eb39e0dd2f712d8dbd8e18b5d36a97825.patch +linux-2.6.git-157f3a3e17cd498571db2a472dc3a15a7679ee3f.patch +linux-2.6.git-e04126c79242d2740b469292d42c239bad7807cc.patch +linux-2.6.git-9166d0f620d5dd4a128711bdeedb3e0f534d9d49.patch + +Cc: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/input/keyboard/atkbd.c | 169 +++++++++++++++++++++++------------------ + 1 file changed, 96 insertions(+), 73 deletions(-) + +--- a/drivers/input/keyboard/atkbd.c ++++ b/drivers/input/keyboard/atkbd.c +@@ -229,7 +229,8 @@ struct atkbd { + /* + * System-specific ketymap fixup routine + */ +-static void (*atkbd_platform_fixup)(struct atkbd *); ++static void (*atkbd_platform_fixup)(struct atkbd *, const void *data); ++static void *atkbd_platform_fixup_data; + + static ssize_t atkbd_attr_show_helper(struct device *dev, char *buf, + ssize_t (*handler)(struct atkbd *, char *)); +@@ -834,87 +835,71 @@ static void atkbd_disconnect(struct seri + } + + /* +- * Most special keys (Fn+F?) on Dell laptops do not generate release +- * events so we have to do it ourselves. ++ * generate release events for the keycodes given in data + */ +-static void atkbd_dell_laptop_keymap_fixup(struct atkbd *atkbd) ++static void atkbd_apply_forced_release_keylist(struct atkbd* atkbd, ++ const void *data) + { +- static const unsigned int forced_release_keys[] = { +- 0x85, 0x86, 0x87, 0x88, 0x89, 0x8a, 0x8b, 0x8f, 0x93, +- }; +- int i; ++ const unsigned int *keys = data; ++ unsigned int i; + + if (atkbd->set == 2) +- for (i = 0; i < ARRAY_SIZE(forced_release_keys); i++) +- __set_bit(forced_release_keys[i], +- atkbd->force_release_mask); ++ for (i = 0; keys[i] != -1U; i++) ++ __set_bit(keys[i], atkbd->force_release_mask); + } + + /* ++ * Most special keys (Fn+F?) on Dell laptops do not generate release ++ * events so we have to do it ourselves. ++ */ ++static unsigned int atkbd_dell_laptop_forced_release_keys[] = { ++ 0x85, 0x86, 0x87, 0x88, 0x89, 0x8a, 0x8b, 0x8f, 0x93, -1U ++}; ++ ++/* + * Perform fixup for HP system that doesn't generate release + * for its video switch + */ +-static void atkbd_hp_keymap_fixup(struct atkbd *atkbd) +-{ +- static const unsigned int forced_release_keys[] = { +- 0x94, +- }; +- int i; +- +- if (atkbd->set == 2) +- for (i = 0; i < ARRAY_SIZE(forced_release_keys); i++) +- __set_bit(forced_release_keys[i], +- atkbd->force_release_mask); +-} ++static unsigned int atkbd_hp_forced_release_keys[] = { ++ 0x94, -1U ++}; + + /* + * Inventec system with broken key release on volume keys + */ +-static void atkbd_inventec_keymap_fixup(struct atkbd *atkbd) +-{ +- const unsigned int forced_release_keys[] = { +- 0xae, 0xb0, +- }; +- int i; +- +- if (atkbd->set == 2) +- for (i = 0; i < ARRAY_SIZE(forced_release_keys); i++) +- __set_bit(forced_release_keys[i], +- atkbd->force_release_mask); +-} ++static unsigned int atkbd_inventec_forced_release_keys[] = { ++ 0xae, 0xb0, -1U ++}; + + /* + * Perform fixup for HP Pavilion ZV6100 laptop that doesn't generate release + * for its volume buttons + */ +-static void atkbd_hp_zv6100_keymap_fixup(struct atkbd *atkbd) +-{ +- const unsigned int forced_release_keys[] = { +- 0xae, 0xb0, +- }; +- int i; ++static unsigned int atkbd_hp_zv6100_forced_release_keys[] = { ++ 0xae, 0xb0, -1U ++}; + +- if (atkbd->set == 2) +- for (i = 0; i < ARRAY_SIZE(forced_release_keys); i++) +- __set_bit(forced_release_keys[i], +- atkbd->force_release_mask); +-} ++/* ++ * Samsung NC10,NC20 with Fn+F? key release not working ++ */ ++static unsigned int atkbd_samsung_forced_release_keys[] = { ++ 0x82, 0x83, 0x84, 0x86, 0x88, 0x89, 0xb3, 0xf7, 0xf9, -1U ++}; + + /* +- * Samsung NC10 with Fn+F? key release not working ++ * The volume up and volume down special keys on a Fujitsu Amilo PA 1510 laptop ++ * do not generate release events so we have to do it ourselves. + */ +-static void atkbd_samsung_keymap_fixup(struct atkbd *atkbd) +-{ +- const unsigned int forced_release_keys[] = { +- 0x82, 0x83, 0x84, 0x86, 0x88, 0x89, 0xb3, 0xf7, 0xf9, +- }; +- int i; ++static unsigned int atkbd_amilo_pa1510_forced_release_keys[] = { ++ 0xb0, 0xae, -1U ++}; + +- if (atkbd->set == 2) +- for (i = 0; i < ARRAY_SIZE(forced_release_keys); i++) +- __set_bit(forced_release_keys[i], +- atkbd->force_release_mask); +-} ++/* ++ * Amilo Xi 3650 key release for light touch bar not working ++ */ ++static unsigned int atkbd_amilo_xi3650_forced_release_keys[] = { ++ 0x67, 0xed, 0x90, 0xa2, 0x99, 0xa4, 0xae, 0xb0, -1U ++}; + + /* + * atkbd_set_keycode_table() initializes keyboard's keycode table +@@ -967,7 +952,7 @@ static void atkbd_set_keycode_table(stru + * Perform additional fixups + */ + if (atkbd_platform_fixup) +- atkbd_platform_fixup(atkbd); ++ atkbd_platform_fixup(atkbd, atkbd_platform_fixup_data); + } + + /* +@@ -1492,9 +1477,11 @@ static ssize_t atkbd_show_err_count(stru + return sprintf(buf, "%lu\n", atkbd->err_count); + } + +-static int __init atkbd_setup_fixup(const struct dmi_system_id *id) ++static int __init atkbd_setup_forced_release(const struct dmi_system_id *id) + { +- atkbd_platform_fixup = id->driver_data; ++ atkbd_platform_fixup = atkbd_apply_forced_release_keylist; ++ atkbd_platform_fixup_data = id->driver_data; ++ + return 0; + } + +@@ -1505,8 +1492,8 @@ static struct dmi_system_id atkbd_dmi_qu + DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), + DMI_MATCH(DMI_CHASSIS_TYPE, "8"), /* Portable */ + }, +- .callback = atkbd_setup_fixup, +- .driver_data = atkbd_dell_laptop_keymap_fixup, ++ .callback = atkbd_setup_forced_release, ++ .driver_data = atkbd_dell_laptop_forced_release_keys, + }, + { + .ident = "Dell Laptop", +@@ -1514,8 +1501,8 @@ static struct dmi_system_id atkbd_dmi_qu + DMI_MATCH(DMI_SYS_VENDOR, "Dell Computer Corporation"), + DMI_MATCH(DMI_CHASSIS_TYPE, "8"), /* Portable */ + }, +- .callback = atkbd_setup_fixup, +- .driver_data = atkbd_dell_laptop_keymap_fixup, ++ .callback = atkbd_setup_forced_release, ++ .driver_data = atkbd_dell_laptop_forced_release_keys, + }, + { + .ident = "HP 2133", +@@ -1523,8 +1510,8 @@ static struct dmi_system_id atkbd_dmi_qu + DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"), + DMI_MATCH(DMI_PRODUCT_NAME, "HP 2133"), + }, +- .callback = atkbd_setup_fixup, +- .driver_data = atkbd_hp_keymap_fixup, ++ .callback = atkbd_setup_forced_release, ++ .driver_data = atkbd_hp_forced_release_keys, + }, + { + .ident = "HP Pavilion ZV6100", +@@ -1532,8 +1519,8 @@ static struct dmi_system_id atkbd_dmi_qu + DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"), + DMI_MATCH(DMI_PRODUCT_NAME, "Pavilion ZV6100"), + }, +- .callback = atkbd_setup_fixup, +- .driver_data = atkbd_hp_zv6100_keymap_fixup, ++ .callback = atkbd_setup_forced_release, ++ .driver_data = atkbd_hp_zv6100_forced_release_keys, + }, + { + .ident = "Inventec Symphony", +@@ -1541,8 +1528,8 @@ static struct dmi_system_id atkbd_dmi_qu + DMI_MATCH(DMI_SYS_VENDOR, "INVENTEC"), + DMI_MATCH(DMI_PRODUCT_NAME, "SYMPHONY 6.0/7.0"), + }, +- .callback = atkbd_setup_fixup, +- .driver_data = atkbd_inventec_keymap_fixup, ++ .callback = atkbd_setup_forced_release, ++ .driver_data = atkbd_inventec_forced_release_keys, + }, + { + .ident = "Samsung NC10", +@@ -1550,8 +1537,44 @@ static struct dmi_system_id atkbd_dmi_qu + DMI_MATCH(DMI_SYS_VENDOR, "SAMSUNG ELECTRONICS CO., LTD."), + DMI_MATCH(DMI_PRODUCT_NAME, "NC10"), + }, +- .callback = atkbd_setup_fixup, +- .driver_data = atkbd_samsung_keymap_fixup, ++ .callback = atkbd_setup_forced_release, ++ .driver_data = atkbd_samsung_forced_release_keys, ++ }, ++ { ++ .ident = "Samsung NC20", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "SAMSUNG ELECTRONICS CO., LTD."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "NC20"), ++ }, ++ .callback = atkbd_setup_forced_release, ++ .driver_data = atkbd_samsung_forced_release_keys, ++ }, ++ { ++ .ident = "Samsung SQ45S70S", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "SAMSUNG ELECTRONICS CO., LTD."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "SQ45S70S"), ++ }, ++ .callback = atkbd_setup_forced_release, ++ .driver_data = atkbd_samsung_forced_release_keys, ++ }, ++ { ++ .ident = "Fujitsu Amilo PA 1510", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU SIEMENS"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "AMILO Pa 1510"), ++ }, ++ .callback = atkbd_setup_forced_release, ++ .driver_data = atkbd_amilo_pa1510_forced_release_keys, ++ }, ++ { ++ .ident = "Fujitsu Amilo Xi 3650", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU SIEMENS"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "AMILO Xi 3650"), ++ }, ++ .callback = atkbd_setup_forced_release, ++ .driver_data = atkbd_amilo_xi3650_forced_release_keys, + }, + { } + }; + + +From gregkh@mini.kroah.org Tue Jun 30 17:15:49 2009 +Message-Id: <20090701001549.750098757@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:14:06 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Nicolas Ferre , + Andrew Victor , + Haavard Skinnemoen +Subject: [patch 10/35] atmel_lcdfb: correct fifo size for some products +References: <20090701001356.007288418@mini.kroah.org> +Content-Disposition: inline; filename=atmel_lcdfb-correct-fifo-size-for-some-products.patch +Content-Length: 1354 +Lines: 41 + +2.6.29-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Nicolas Ferre + +commit 53b7479bbdaedcc7846c66fd608fe66f1b5aa35b upstream. + +Remove wrong fifo size definition for some AT91 products. + +Due to a misunderstanding of some AT91 datasheets, a fifo size of 2048 +(words) has been introduced by mistake. In fact, all products (AT91/AT32) +are sharing the same fifo size of 512 words. + +Signed-off-by: Nicolas Ferre +Cc: Andrew Victor +Acked-by: Haavard Skinnemoen +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/video/atmel_lcdfb.c | 10 ++-------- + 1 file changed, 2 insertions(+), 8 deletions(-) + +--- a/drivers/video/atmel_lcdfb.c ++++ b/drivers/video/atmel_lcdfb.c +@@ -29,14 +29,8 @@ + + /* configurable parameters */ + #define ATMEL_LCDC_CVAL_DEFAULT 0xc8 +-#define ATMEL_LCDC_DMA_BURST_LEN 8 +- +-#if defined(CONFIG_ARCH_AT91SAM9263) || defined(CONFIG_ARCH_AT91CAP9) || \ +- defined(CONFIG_ARCH_AT91SAM9RL) +-#define ATMEL_LCDC_FIFO_SIZE 2048 +-#else +-#define ATMEL_LCDC_FIFO_SIZE 512 +-#endif ++#define ATMEL_LCDC_DMA_BURST_LEN 8 /* words */ ++#define ATMEL_LCDC_FIFO_SIZE 512 /* words */ + + #if defined(CONFIG_ARCH_AT91) + #define ATMEL_LCDFB_FBINFO_DEFAULT (FBINFO_DEFAULT \ + + +From gregkh@mini.kroah.org Tue Jun 30 17:15:50 2009 +Message-Id: <20090701001549.948288390@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:14:07 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Stephen Hemminger , + Jay Vosburgh , + "David S. Miller" +Subject: [patch 11/35] bonding: fix multiple module load problem +References: <20090701001356.007288418@mini.kroah.org> +Content-Disposition: inline; filename=bonding-fix-multiple-module-load-problem.patch +Content-Length: 1185 +Lines: 37 + +2.6.29-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Stephen Hemminger + +[ Upstream commit 130aa61a77b8518f1ea618e1b7d214d60b405f10 ] + +Some users still load bond module multiple times to create bonding +devices. This accidentally was broken by a later patch about +the time sysfs was fixed. According to Jay, it was broken +by: + commit b8a9787eddb0e4665f31dd1d64584732b2b5d051 + Author: Jay Vosburgh + Date: Fri Jun 13 18:12:04 2008 -0700 + + bonding: Allow setting max_bonds to zero + +Note: sysfs and procfs still produce WARN() messages when this is done +so the sysfs method is the recommended API. + +Signed-off-by: Stephen Hemminger +Signed-off-by: Jay Vosburgh +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/bonding/bond_sysfs.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/bonding/bond_sysfs.c ++++ b/drivers/net/bonding/bond_sysfs.c +@@ -1538,6 +1538,7 @@ int bond_create_sysfs(void) + printk(KERN_ERR + "network device named %s already exists in sysfs", + class_attr_bonding_masters.attr.name); ++ ret = 0; + } + + return ret; + + +From gregkh@mini.kroah.org Tue Jun 30 17:15:50 2009 +Message-Id: <20090701001550.157928733@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:14:08 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Dirk Eibach , + Jiri Slaby +Subject: [patch 12/35] char: moxa, prevent opening unavailable ports +References: <20090701001356.007288418@mini.kroah.org> +Content-Disposition: inline; filename=char-moxa-prevent-opening-unavailable-ports.patch +Content-Length: 1431 +Lines: 47 + +2.6.29-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Dirk Eibach + +commit a90b037583d5f1ae3e54e9c687c79df82d1d34a4 upstream. + +In moxa.c there are 32 minor numbers reserved for each device. The number +of ports actually available per device is stored in +moxa_board_conf->numPorts. This number is not considered in moxa_open(). +Opening a port that is not available results in a kernel oops. This patch +adds a test to moxa_open() that prevents opening unavailable ports. + +[akpm@linux-foundation.org: avoid multiple returns] +Signed-off-by: Dirk Eibach +Signed-off-by: Jiri Slaby +Cc: Alan Cox +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/char/moxa.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/drivers/char/moxa.c ++++ b/drivers/char/moxa.c +@@ -1184,6 +1184,11 @@ static int moxa_open(struct tty_struct * + return -ENODEV; + } + ++ if (port % MAX_PORTS_PER_BOARD >= brd->numPorts) { ++ retval = -ENODEV; ++ goto out_unlock; ++ } ++ + ch = &brd->ports[port % MAX_PORTS_PER_BOARD]; + ch->port.count++; + tty->driver_data = ch; +@@ -1208,8 +1213,8 @@ static int moxa_open(struct tty_struct * + moxa_close_port(tty); + } else + ch->port.flags |= ASYNC_NORMAL_ACTIVE; ++out_unlock: + mutex_unlock(&moxa_openlock); +- + return retval; + } + + + +From gregkh@mini.kroah.org Tue Jun 30 17:15:50 2009 +Message-Id: <20090701001550.312076882@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:14:09 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Karsten Keil +Subject: [patch 13/35] ISDN: Fix DMA alloc for hfcpci +References: <20090701001356.007288418@mini.kroah.org> +Content-Disposition: inline; filename=isdn-fix-dma-alloc-for-hfcpci.patch +Content-Length: 3794 +Lines: 99 + +2.6.29-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Karsten Keil + +commit 8a745b9d91962991ce87a649a4dc3af3206c2c8b upstream. + +Replace wrong code with correct DMA API functions. + +Signed-off-by: Karsten Keil +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/isdn/hisax/hfc_pci.c | 41 ++++++++++++++++++++++++++++++----------- + drivers/isdn/hisax/hisax.h | 2 +- + 2 files changed, 31 insertions(+), 12 deletions(-) + +--- a/drivers/isdn/hisax/hfc_pci.c ++++ b/drivers/isdn/hisax/hfc_pci.c +@@ -82,8 +82,9 @@ release_io_hfcpci(struct IsdnCardState * + Write_hfc(cs, HFCPCI_INT_M2, cs->hw.hfcpci.int_m2); + pci_write_config_word(cs->hw.hfcpci.dev, PCI_COMMAND, 0); /* disable memory mapped ports + busmaster */ + del_timer(&cs->hw.hfcpci.timer); +- kfree(cs->hw.hfcpci.share_start); +- cs->hw.hfcpci.share_start = NULL; ++ pci_free_consistent(cs->hw.hfcpci.dev, 0x8000, ++ cs->hw.hfcpci.fifos, cs->hw.hfcpci.dma); ++ cs->hw.hfcpci.fifos = NULL; + iounmap((void *)cs->hw.hfcpci.pci_io); + } + +@@ -1663,8 +1664,19 @@ setup_hfcpci(struct IsdnCard *card) + dev_hfcpci); + i++; + if (tmp_hfcpci) { ++ dma_addr_t dma_mask = DMA_BIT_MASK(32) & ~0x7fffUL; + if (pci_enable_device(tmp_hfcpci)) + continue; ++ if (pci_set_dma_mask(tmp_hfcpci, dma_mask)) { ++ printk(KERN_WARNING ++ "HiSax hfc_pci: No suitable DMA available.\n"); ++ continue; ++ } ++ if (pci_set_consistent_dma_mask(tmp_hfcpci, dma_mask)) { ++ printk(KERN_WARNING ++ "HiSax hfc_pci: No suitable consistent DMA available.\n"); ++ continue; ++ } + pci_set_master(tmp_hfcpci); + if ((card->para[0]) && (card->para[0] != (tmp_hfcpci->resource[ 0].start & PCI_BASE_ADDRESS_IO_MASK))) + continue; +@@ -1693,22 +1705,29 @@ setup_hfcpci(struct IsdnCard *card) + printk(KERN_WARNING "HFC-PCI: No IO-Mem for PCI card found\n"); + return (0); + } ++ + /* Allocate memory for FIFOS */ +- /* Because the HFC-PCI needs a 32K physical alignment, we */ +- /* need to allocate the double mem and align the address */ +- if (!(cs->hw.hfcpci.share_start = kmalloc(65536, GFP_KERNEL))) { +- printk(KERN_WARNING "HFC-PCI: Error allocating memory for FIFO!\n"); ++ cs->hw.hfcpci.fifos = pci_alloc_consistent(cs->hw.hfcpci.dev, ++ 0x8000, &cs->hw.hfcpci.dma); ++ if (!cs->hw.hfcpci.fifos) { ++ printk(KERN_WARNING "HFC-PCI: Error allocating FIFO memory!\n"); ++ return 0; ++ } ++ if (cs->hw.hfcpci.dma & 0x7fff) { ++ printk(KERN_WARNING ++ "HFC-PCI: Error DMA memory not on 32K boundary (%lx)\n", ++ (u_long)cs->hw.hfcpci.dma); ++ pci_free_consistent(cs->hw.hfcpci.dev, 0x8000, ++ cs->hw.hfcpci.fifos, cs->hw.hfcpci.dma); + return 0; + } +- cs->hw.hfcpci.fifos = (void *) +- (((ulong) cs->hw.hfcpci.share_start) & ~0x7FFF) + 0x8000; +- pci_write_config_dword(cs->hw.hfcpci.dev, 0x80, (u_int) virt_to_bus(cs->hw.hfcpci.fifos)); ++ pci_write_config_dword(cs->hw.hfcpci.dev, 0x80, (u32)cs->hw.hfcpci.dma); + cs->hw.hfcpci.pci_io = ioremap((ulong) cs->hw.hfcpci.pci_io, 256); + printk(KERN_INFO +- "HFC-PCI: defined at mem %p fifo %p(%#x) IRQ %d HZ %d\n", ++ "HFC-PCI: defined at mem %p fifo %p(%lx) IRQ %d HZ %d\n", + cs->hw.hfcpci.pci_io, + cs->hw.hfcpci.fifos, +- (u_int) virt_to_bus(cs->hw.hfcpci.fifos), ++ (u_long)cs->hw.hfcpci.dma, + cs->irq, HZ); + + spin_lock_irqsave(&cs->lock, flags); +--- a/drivers/isdn/hisax/hisax.h ++++ b/drivers/isdn/hisax/hisax.h +@@ -694,7 +694,7 @@ struct hfcPCI_hw { + int nt_timer; + struct pci_dev *dev; + unsigned char *pci_io; /* start of PCI IO memory */ +- void *share_start; /* shared memory for Fifos start */ ++ dma_addr_t dma; /* dma handle for Fifos */ + void *fifos; /* FIFO memory */ + int last_bfifo_cnt[2]; /* marker saving last b-fifo frame count */ + struct timer_list timer; + + +From gregkh@mini.kroah.org Tue Jun 30 17:15:50 2009 +Message-Id: <20090701001550.521446575@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:14:10 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk +Subject: [patch 14/35] USB: usbtmc: fix switch statment +References: <20090701001356.007288418@mini.kroah.org> +Content-Disposition: inline; filename=usb-usbtmc-fix-switch-statment.patch +Content-Length: 1244 +Lines: 49 + +2.6.29-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Greg Kroah-Hartman + +commit a92b63e7e4c185b4dd9e87762e2cb716e54482d0 upstream. + +Steve Holland pointed out that we forgot to call break; in the switch +statment. This probably resolves a lot of the bug reports I've gotten +for the driver lately. + +Stupid me... + +Reported-by: Steve Holland +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/class/usbtmc.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/usb/class/usbtmc.c ++++ b/drivers/usb/class/usbtmc.c +@@ -927,21 +927,27 @@ static long usbtmc_ioctl(struct file *fi + switch (cmd) { + case USBTMC_IOCTL_CLEAR_OUT_HALT: + retval = usbtmc_ioctl_clear_out_halt(data); ++ break; + + case USBTMC_IOCTL_CLEAR_IN_HALT: + retval = usbtmc_ioctl_clear_in_halt(data); ++ break; + + case USBTMC_IOCTL_INDICATOR_PULSE: + retval = usbtmc_ioctl_indicator_pulse(data); ++ break; + + case USBTMC_IOCTL_CLEAR: + retval = usbtmc_ioctl_clear(data); ++ break; + + case USBTMC_IOCTL_ABORT_BULK_OUT: + retval = usbtmc_ioctl_abort_bulk_out(data); ++ break; + + case USBTMC_IOCTL_ABORT_BULK_IN: + retval = usbtmc_ioctl_abort_bulk_in(data); ++ break; + } + + mutex_unlock(&data->io_mutex); + + +From gregkh@mini.kroah.org Tue Jun 30 17:15:50 2009 +Message-Id: <20090701001550.709903218@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:14:11 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jean Delvare , + Steve Conklin , + Leann Ogasawara , + Ingo Molnar +Subject: [patch 15/35] x86: Add quirk for reboot stalls on a Dell Optiplex 360 +References: <20090701001356.007288418@mini.kroah.org> +Content-Disposition: inline; filename=x86-add-quirk-for-reboot-stalls-on-a-dell-optiplex-360.patch +Content-Length: 1174 +Lines: 37 + +2.6.29-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Jean Delvare + +commit 4a4aca641bc4598e77b866804f47c651ec4a764d upstream. + +The Dell Optiplex 360 hangs on reboot, just like the Optiplex 330, so +the same quirk is needed. + +Signed-off-by: Jean Delvare +Cc: Steve Conklin +Cc: Leann Ogasawara +LKML-Reference: <200906051202.38311.jdelvare@suse.de> +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/reboot.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +--- a/arch/x86/kernel/reboot.c ++++ b/arch/x86/kernel/reboot.c +@@ -193,6 +193,15 @@ static struct dmi_system_id __initdata r + DMI_MATCH(DMI_BOARD_NAME, "0KP561"), + }, + }, ++ { /* Handle problems with rebooting on Dell Optiplex 360 with 0T656F */ ++ .callback = set_bios_reboot, ++ .ident = "Dell OptiPlex 360", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "OptiPlex 360"), ++ DMI_MATCH(DMI_BOARD_NAME, "0T656F"), ++ }, ++ }, + { /* Handle problems with rebooting on Dell 2400's */ + .callback = set_bios_reboot, + .ident = "Dell PowerEdge 2400", + + +From gregkh@mini.kroah.org Tue Jun 30 17:15:51 2009 +Message-Id: <20090701001550.955339915@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:14:12 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Takashi Iwai +Subject: [patch 16/35] ALSA: ca0106 - Add missing registrations of vmaster controls +References: <20090701001356.007288418@mini.kroah.org> +Content-Disposition: inline; filename=alsa-ca0106-add-missing-registrations-of-vmaster-controls.patch +Content-Length: 1035 +Lines: 38 + +2.6.29-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Takashi Iwai + +commit 601e1cc5df940b59e71c947726640811897d30df upstream. + +Although the vmaster controls are created, they aren't registered thus +they don't appear in the real world. Added the missing snd_ctl_add() +calls. + +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/ca0106/ca0106_mixer.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/sound/pci/ca0106/ca0106_mixer.c ++++ b/sound/pci/ca0106/ca0106_mixer.c +@@ -841,6 +841,9 @@ int __devinit snd_ca0106_mixer(struct sn + snd_ca0106_master_db_scale); + if (!vmaster) + return -ENOMEM; ++ err = snd_ctl_add(card, vmaster); ++ if (err < 0) ++ return err; + add_slaves(card, vmaster, slave_vols); + + if (emu->details->spi_dac == 1) { +@@ -848,6 +851,9 @@ int __devinit snd_ca0106_mixer(struct sn + NULL); + if (!vmaster) + return -ENOMEM; ++ err = snd_ctl_add(card, vmaster); ++ if (err < 0) ++ return err; + add_slaves(card, vmaster, slave_sws); + } + return 0; + + +From gregkh@mini.kroah.org Tue Jun 30 17:15:51 2009 +Message-Id: <20090701001551.101806792@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:14:13 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Scott James Remnant , + Tim Gardner , + Bjorn Helgaas , + Philippe De Muyter , + Kay Sievers +Subject: [patch 17/35] floppy: provide a PNP device table in the module. +References: <20090701001356.007288418@mini.kroah.org> +Content-Disposition: inline; filename=floppy-provide-a-pnp-device-table-in-the-module.patch +Content-Length: 1587 +Lines: 49 + +2.6.29-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Scott James Remnant + +commit 83f9ef463bcb4ba7b4fee1d6212fac7d277010d3 upstream. + +The missing device table means that the floppy module is not auto-loaded, +even when the appropriate PNP device (0700) is found. + +We don't actually use the table in the module, since the device doesn't +have a struct pnp_driver, but it's sufficient to cause an alias in the +module that udev/modprobe will use. + +Signed-off-by: Scott James Remnant +Signed-off-by: Tim Gardner +Cc: Bjorn Helgaas +Cc: Philippe De Muyter +Acked-by: Kay Sievers +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/block/floppy.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/drivers/block/floppy.c ++++ b/drivers/block/floppy.c +@@ -177,6 +177,7 @@ static int print_unex = 1; + #include + #include + #include ++#include + #include /* for invalidate_buffers() */ + #include + +@@ -4598,6 +4599,13 @@ MODULE_AUTHOR("Alain L. Knaff"); + MODULE_SUPPORTED_DEVICE("fd"); + MODULE_LICENSE("GPL"); + ++/* This doesn't actually get used other than for module information */ ++static const struct pnp_device_id floppy_pnpids[] = { ++ { "PNP0700", 0 }, ++ { } ++}; ++MODULE_DEVICE_TABLE(pnp, floppy_pnpids); ++ + #else + + __setup("floppy=", floppy_setup); + + +From gregkh@mini.kroah.org Tue Jun 30 17:15:51 2009 +Message-Id: <20090701001551.313300221@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:14:14 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jack Morgenstein , + Roland Dreier +Subject: [patch 18/35] IB/mlx4: Add strong ordering to local inval and fast reg work requests +References: <20090701001356.007288418@mini.kroah.org> +Content-Disposition: inline; filename=ib-mlx4-add-strong-ordering-to-local-inval-and-fast-reg-work-requests.patch +Content-Length: 1887 +Lines: 54 + +2.6.29-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Jack Morgenstein + +commit 2ac6bf4ddc87c3b6b609f8fa82f6ebbffeac12f4 upstream. + +The ConnectX Programmer's Reference Manual states that the "SO" bit +must be set when posting Fast Register and Local Invalidate send work +requests. When this bit is set, the work request will be executed +only after all previous work requests on the send queue have been +executed. (If the bit is not set, Fast Register and Local Invalidate +WQEs may begin execution too early, which violates the defined +semantics for these operations) + +This fixes the issue with NFS/RDMA reported in + + +Signed-off-by: Jack Morgenstein +Signed-off-by: Roland Dreier +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/infiniband/hw/mlx4/qp.c | 4 ++++ + include/linux/mlx4/qp.h | 1 + + 2 files changed, 5 insertions(+) + +--- a/drivers/infiniband/hw/mlx4/qp.c ++++ b/drivers/infiniband/hw/mlx4/qp.c +@@ -1585,12 +1585,16 @@ int mlx4_ib_post_send(struct ib_qp *ibqp + break; + + case IB_WR_LOCAL_INV: ++ ctrl->srcrb_flags |= ++ cpu_to_be32(MLX4_WQE_CTRL_STRONG_ORDER); + set_local_inv_seg(wqe, wr->ex.invalidate_rkey); + wqe += sizeof (struct mlx4_wqe_local_inval_seg); + size += sizeof (struct mlx4_wqe_local_inval_seg) / 16; + break; + + case IB_WR_FAST_REG_MR: ++ ctrl->srcrb_flags |= ++ cpu_to_be32(MLX4_WQE_CTRL_STRONG_ORDER); + set_fmr_seg(wqe, wr); + wqe += sizeof (struct mlx4_wqe_fmr_seg); + size += sizeof (struct mlx4_wqe_fmr_seg) / 16; +--- a/include/linux/mlx4/qp.h ++++ b/include/linux/mlx4/qp.h +@@ -165,6 +165,7 @@ enum { + MLX4_WQE_CTRL_IP_CSUM = 1 << 4, + MLX4_WQE_CTRL_TCP_UDP_CSUM = 1 << 5, + MLX4_WQE_CTRL_INS_VLAN = 1 << 6, ++ MLX4_WQE_CTRL_STRONG_ORDER = 1 << 7, + }; + + struct mlx4_wqe_ctrl_seg { + + +From gregkh@mini.kroah.org Tue Jun 30 17:15:51 2009 +Message-Id: <20090701001551.517170262@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:14:15 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Yinghai Lu , + "H. Peter Anvin" +Subject: [patch 19/35] x86: handle initrd that extends into unusable memory +References: <20090701001356.007288418@mini.kroah.org> +Content-Disposition: inline; filename=x86-handle-initrd-that-extends-into-unusable-memory.patch +Content-Length: 2135 +Lines: 72 + +2.6.29-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Yinghai Lu + +commit 8c5dd8f43367f4f266dd616f11658005bc2d20ef upstream. + +On a system where system memory (according e820) is not covered by +mtrr, mtrr_trim_memory converts a portion of memory to reserved, but +bootloader has already put the initrd in that range. + +Thus, we need to have 64bit to use relocate_initrd too. + +[ Impact: fix using initrd when mtrr_trim_memory happen ] + +Signed-off-by: Yinghai Lu +Signed-off-by: H. Peter Anvin +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/setup.c | 15 +++------------ + 1 file changed, 3 insertions(+), 12 deletions(-) + +--- a/arch/x86/kernel/setup.c ++++ b/arch/x86/kernel/setup.c +@@ -255,15 +255,13 @@ static inline void copy_edd(void) + + #ifdef CONFIG_BLK_DEV_INITRD + +-#ifdef CONFIG_X86_32 +- + #define MAX_MAP_CHUNK (NR_FIX_BTMAPS << PAGE_SHIFT) + static void __init relocate_initrd(void) + { + + u64 ramdisk_image = boot_params.hdr.ramdisk_image; + u64 ramdisk_size = boot_params.hdr.ramdisk_size; +- u64 end_of_lowmem = max_low_pfn << PAGE_SHIFT; ++ u64 end_of_lowmem = max_low_pfn_mapped << PAGE_SHIFT; + u64 ramdisk_here; + unsigned long slop, clen, mapaddr; + char *p, *q; +@@ -319,14 +317,13 @@ static void __init relocate_initrd(void) + ramdisk_image, ramdisk_image + ramdisk_size - 1, + ramdisk_here, ramdisk_here + ramdisk_size - 1); + } +-#endif + + static void __init reserve_initrd(void) + { + u64 ramdisk_image = boot_params.hdr.ramdisk_image; + u64 ramdisk_size = boot_params.hdr.ramdisk_size; + u64 ramdisk_end = ramdisk_image + ramdisk_size; +- u64 end_of_lowmem = max_low_pfn << PAGE_SHIFT; ++ u64 end_of_lowmem = max_low_pfn_mapped << PAGE_SHIFT; + + if (!boot_params.hdr.type_of_loader || + !ramdisk_image || !ramdisk_size) +@@ -356,14 +353,8 @@ static void __init reserve_initrd(void) + return; + } + +-#ifdef CONFIG_X86_32 + relocate_initrd(); +-#else +- printk(KERN_ERR "initrd extends beyond end of memory " +- "(0x%08llx > 0x%08llx)\ndisabling initrd\n", +- ramdisk_end, end_of_lowmem); +- initrd_start = 0; +-#endif ++ + free_early(ramdisk_image, ramdisk_end); + } + #else + + +From gregkh@mini.kroah.org Tue Jun 30 17:15:51 2009 +Message-Id: <20090701001551.690481544@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:14:16 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Peter Zijlstra , + Ingo Molnar +Subject: [patch 20/35] lockdep: Select frame pointers on x86 +References: <20090701001356.007288418@mini.kroah.org> +Content-Disposition: inline; filename=lockdep-select-frame-pointers-on-x86.patch +Content-Length: 925 +Lines: 30 + +2.6.29-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Peter Zijlstra + +commit 00540e5d54be972a94a3b2ce6da8621bebe731a2 upstream. + +x86 stack traces are a piece of crap without frame pointers, and its not +like the 'performance gain' of not having stack pointers matters when you +selected lockdep. + +Reported-by: Andrew Morton +LKML-Reference: +Signed-off-by: Peter Zijlstra +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + lib/Kconfig.debug | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/lib/Kconfig.debug ++++ b/lib/Kconfig.debug +@@ -402,7 +402,7 @@ config LOCKDEP + bool + depends on DEBUG_KERNEL && TRACE_IRQFLAGS_SUPPORT && STACKTRACE_SUPPORT && LOCKDEP_SUPPORT + select STACKTRACE +- select FRAME_POINTER if !X86 && !MIPS && !PPC ++ select FRAME_POINTER if !MIPS && !PPC + select KALLSYMS + select KALLSYMS_ALL + + + +From gregkh@mini.kroah.org Tue Jun 30 17:15:52 2009 +Message-Id: <20090701001551.874389473@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:14:17 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Bob Copeland , + "John W. Linville" +Subject: [patch 21/35] mac80211: fix minstrel single-rate memory corruption +References: <20090701001356.007288418@mini.kroah.org> +Content-Disposition: inline; filename=mac80211-fix-minstrel-single-rate-memory-corruption.patch +Content-Length: 1975 +Lines: 49 + +2.6.29-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Bob Copeland + +commit 5ee58d7e6ad019675b4090582aec4fa1180d8703 upstream. + +The minstrel rate controller periodically looks up rate indexes in +a sampling table. When accessing a specific row and column, minstrel +correctly does a bounds check which, on the surface, appears to handle +the case where mi->n_rates < 2. However, mi->sample_idx is actually +defined as an unsigned, so the right hand side is taken to be a huge +positive number when negative, and the check will always fail. + +Consequently, the RC will overrun the array and cause random memory +corruption when communicating with a peer that has only a single rate. +The max value of mi->sample_idx is around 25 so casting to int should +have no ill effects. + +Without the change, uptime is a few minutes under load with an AP +that has a single hard-coded rate, and both the AP and STA could +potentially crash. With the change, both lasted 12 hours with a +steady load. + +Thanks to Ognjen Maric for providing the single-rate clue so I could +reproduce this. + +This fixes http://bugzilla.kernel.org/show_bug.cgi?id=12490 on the +regression list (also http://bugzilla.kernel.org/show_bug.cgi?id=13000). + +Reported-by: Sergey S. Kostyliov +Reported-by: Ognjen Maric +Signed-off-by: Bob Copeland +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + net/mac80211/rc80211_minstrel.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/mac80211/rc80211_minstrel.c ++++ b/net/mac80211/rc80211_minstrel.c +@@ -216,7 +216,7 @@ minstrel_get_next_sample(struct minstrel + unsigned int sample_ndx; + sample_ndx = SAMPLE_TBL(mi, mi->sample_idx, mi->sample_column); + mi->sample_idx++; +- if (mi->sample_idx > (mi->n_rates - 2)) { ++ if ((int) mi->sample_idx > (mi->n_rates - 2)) { + mi->sample_idx = 0; + mi->sample_column++; + if (mi->sample_column >= SAMPLE_COLUMNS) + + +From gregkh@mini.kroah.org Tue Jun 30 17:15:52 2009 +Message-Id: <20090701001552.051321322@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:14:18 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Dan Williams , + NeilBrown +Subject: [patch 22/35] md/raid5: add missing call to schedule() after prepare_to_wait() +References: <20090701001356.007288418@mini.kroah.org> +Content-Disposition: inline; filename=md-raid5-add-missing-call-to-schedule-after-prepare_to_wait.patch +Content-Length: 911 +Lines: 31 + +2.6.29-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Dan Williams + +commit 7a3ab908948b6296ee7e81d42f7c176361c51975 upstream. + +In the unlikely event that reshape progresses past the current request +while it is waiting for a stripe we need to schedule() before retrying +for 2 reasons: +1/ Prevent list corruption from duplicated list_add() calls without + intervening list_del(). +2/ Give the reshape code a chance to make some progress to resolve the + conflict. + +Signed-off-by: Dan Williams +Signed-off-by: NeilBrown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/raid5.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/md/raid5.c ++++ b/drivers/md/raid5.c +@@ -3465,6 +3465,7 @@ static int make_request(struct request_q + spin_unlock_irq(&conf->device_lock); + if (must_retry) { + release_stripe(sh); ++ schedule(); + goto retry; + } + } + + +From gregkh@mini.kroah.org Tue Jun 30 17:15:52 2009 +Message-Id: <20090701001552.244954110@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:14:19 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jiri Slaby , + Alan Cox +Subject: [patch 23/35] vt_ioctl: fix lock imbalance +References: <20090701001356.007288418@mini.kroah.org> +Content-Disposition: inline; filename=vt_ioctl-fix-lock-imbalance.patch +Content-Length: 804 +Lines: 29 + +2.6.29-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Jiri Slaby + +commit a115902f67ef51fbbe83e214fb761aaa9734c1ce upstream. + +Don't return from switch/case directly in vt_ioctl. Set ret and break +instead so that we unlock BKL. + +Signed-off-by: Jiri Slaby +Signed-off-by: Alan Cox +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/char/vt_ioctl.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/char/vt_ioctl.c ++++ b/drivers/char/vt_ioctl.c +@@ -396,7 +396,8 @@ int vt_ioctl(struct tty_struct *tty, str + kbd = kbd_table + console; + switch (cmd) { + case TIOCLINUX: +- return tioclinux(tty, arg); ++ ret = tioclinux(tty, arg); ++ break; + case KIOCSOUND: + if (!perm) + goto eperm; + + +From gregkh@mini.kroah.org Tue Jun 30 17:15:52 2009 +Message-Id: <20090701001552.431397625@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:14:20 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Andreas Herrmann , + Ingo Molnar +Subject: [patch 24/35] x86: Set cpu_llc_id on AMD CPUs +References: <20090701001356.007288418@mini.kroah.org> +Content-Disposition: inline; filename=x86-set-cpu_llc_id-on-amd-cpus.patch +Content-Length: 1958 +Lines: 72 + +2.6.29-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Andreas Herrmann + +commit 99bd0c0fc4b04da54cb311953ef9489931c19c63 upstream. + +This counts when building sched domains in case NUMA information +is not available. + +( See cpu_coregroup_mask() which uses llc_shared_map which in turn is + created based on cpu_llc_id. ) + +Currently Linux builds domains as follows: +(example from a dual socket quad-core system) + + CPU0 attaching sched-domain: + domain 0: span 0-7 level CPU + groups: 0 1 2 3 4 5 6 7 + + ... + + CPU7 attaching sched-domain: + domain 0: span 0-7 level CPU + groups: 7 0 1 2 3 4 5 6 + +Ever since that is borked for multi-core AMD CPU systems. +This patch fixes that and now we get a proper: + + CPU0 attaching sched-domain: + domain 0: span 0-3 level MC + groups: 0 1 2 3 + domain 1: span 0-7 level CPU + groups: 0-3 4-7 + + ... + + CPU7 attaching sched-domain: + domain 0: span 4-7 level MC + groups: 7 4 5 6 + domain 1: span 0-7 level CPU + groups: 4-7 0-3 + +This allows scheduler to assign tasks to cores on different sockets +(i.e. that don't share last level cache) for performance reasons. + +Signed-off-by: Andreas Herrmann +LKML-Reference: <20090619085909.GJ5218@alberich.amd.com> +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/cpu/amd.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/arch/x86/kernel/cpu/amd.c ++++ b/arch/x86/kernel/cpu/amd.c +@@ -207,13 +207,15 @@ static void __cpuinit amd_detect_cmp(str + { + #ifdef CONFIG_X86_HT + unsigned bits; ++ int cpu = smp_processor_id(); + + bits = c->x86_coreid_bits; +- + /* Low order bits define the core id (index of core in socket) */ + c->cpu_core_id = c->initial_apicid & ((1 << bits)-1); + /* Convert the initial APIC ID into the socket ID */ + c->phys_proc_id = c->initial_apicid >> bits; ++ /* use socket ID also for last level cache */ ++ per_cpu(cpu_llc_id, cpu) = c->phys_proc_id; + #endif + } + + + +From gregkh@mini.kroah.org Tue Jun 30 17:15:52 2009 +Message-Id: <20090701001552.616407113@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:14:21 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jens Rottmann , + Alan Cox , + Jeff Garzik +Subject: [patch 25/35] parport_pc: after superio probing restore original register values +References: <20090701001356.007288418@mini.kroah.org> +Content-Disposition: inline; filename=parport_pc-after-superio-probing-restore-original-register-values.patch +Content-Length: 4217 +Lines: 130 + +2.6.29-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Jens Rottmann + +commit e2434dc1c19412639dd047a4d4eff8ed0e5d0d50 upstream. + +CONFIG_PARPORT_PC_SUPERIO probes for various superio chips by writing +byte sequences to a set of different potential I/O ranges. But the +probed ranges are not exclusive to parallel ports. Some of our boards +just happen to have a watchdog in one of them. Took us almost a week +to figure out why some distros reboot without warning after running +flawlessly for 3 hours. For exactly 170 = 0xAA minutes, that is ... + +Fixed by restoring original values after probing. Also fixed too small +request_region() in detect_and_report_it87(). + +Signed-off-by: Jens Rottmann +Signed-off-by: Alan Cox +Acked-by: Jeff Garzik +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/parport/parport_pc.c | 31 +++++++++++++++++++++++++------ + 1 file changed, 25 insertions(+), 6 deletions(-) + +--- a/drivers/parport/parport_pc.c ++++ b/drivers/parport/parport_pc.c +@@ -1413,11 +1413,13 @@ static void __devinit decode_smsc(int ef + + static void __devinit winbond_check(int io, int key) + { +- int devid,devrev,oldid,x_devid,x_devrev,x_oldid; ++ int origval, devid, devrev, oldid, x_devid, x_devrev, x_oldid; + + if (!request_region(io, 3, __func__)) + return; + ++ origval = inb(io); /* Save original value */ ++ + /* First probe without key */ + outb(0x20,io); + x_devid=inb(io+1); +@@ -1437,6 +1439,8 @@ static void __devinit winbond_check(int + oldid=inb(io+1); + outb(0xaa,io); /* Magic Seal */ + ++ outb(origval, io); /* in case we poked some entirely different hardware */ ++ + if ((x_devid == devid) && (x_devrev == devrev) && (x_oldid == oldid)) + goto out; /* protection against false positives */ + +@@ -1447,11 +1451,15 @@ out: + + static void __devinit winbond_check2(int io,int key) + { +- int devid,devrev,oldid,x_devid,x_devrev,x_oldid; ++ int origval[3], devid, devrev, oldid, x_devid, x_devrev, x_oldid; + + if (!request_region(io, 3, __func__)) + return; + ++ origval[0] = inb(io); /* Save original values */ ++ origval[1] = inb(io + 1); ++ origval[2] = inb(io + 2); ++ + /* First probe without the key */ + outb(0x20,io+2); + x_devid=inb(io+2); +@@ -1470,6 +1478,10 @@ static void __devinit winbond_check2(int + oldid=inb(io+2); + outb(0xaa,io); /* Magic Seal */ + ++ outb(origval[0], io); /* in case we poked some entirely different hardware */ ++ outb(origval[1], io + 1); ++ outb(origval[2], io + 2); ++ + if ((x_devid == devid) && (x_devrev == devrev) && (x_oldid == oldid)) + goto out; /* protection against false positives */ + +@@ -1480,11 +1492,13 @@ out: + + static void __devinit smsc_check(int io, int key) + { +- int id,rev,oldid,oldrev,x_id,x_rev,x_oldid,x_oldrev; ++ int origval, id, rev, oldid, oldrev, x_id, x_rev, x_oldid, x_oldrev; + + if (!request_region(io, 3, __func__)) + return; + ++ origval = inb(io); /* Save original value */ ++ + /* First probe without the key */ + outb(0x0d,io); + x_oldid=inb(io+1); +@@ -1508,6 +1522,8 @@ static void __devinit smsc_check(int io, + rev=inb(io+1); + outb(0xaa,io); /* Magic Seal */ + ++ outb(origval, io); /* in case we poked some entirely different hardware */ ++ + if ((x_id == id) && (x_oldrev == oldrev) && + (x_oldid == oldid) && (x_rev == rev)) + goto out; /* protection against false positives */ +@@ -1544,11 +1560,12 @@ static void __devinit detect_and_report_ + static void __devinit detect_and_report_it87(void) + { + u16 dev; +- u8 r; ++ u8 origval, r; + if (verbose_probing) + printk(KERN_DEBUG "IT8705 Super-IO detection, now testing port 2E ...\n"); +- if (!request_region(0x2e, 1, __func__)) ++ if (!request_region(0x2e, 2, __func__)) + return; ++ origval = inb(0x2e); /* Save original value */ + outb(0x87, 0x2e); + outb(0x01, 0x2e); + outb(0x55, 0x2e); +@@ -1568,8 +1585,10 @@ static void __devinit detect_and_report_ + outb(r | 8, 0x2F); + outb(0x02, 0x2E); /* Lock */ + outb(0x02, 0x2F); ++ } else { ++ outb(origval, 0x2e); /* Oops, sorry to disturb */ + } +- release_region(0x2e, 1); ++ release_region(0x2e, 2); + } + #endif /* CONFIG_PARPORT_PC_SUPERIO */ + + + +From gregkh@mini.kroah.org Tue Jun 30 17:15:52 2009 +Message-Id: <20090701001552.820343714@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:14:22 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + FUJITA Tomonori , + Alan Cox , + Jeff Garzik +Subject: [patch 26/35] parport_pc: set properly the dma_mask for parport_pc device +References: <20090701001356.007288418@mini.kroah.org> +Content-Disposition: inline; filename=parport_pc-set-properly-the-dma_mask-for-parport_pc-device.patch +Content-Length: 1667 +Lines: 44 + +2.6.29-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: FUJITA Tomonori + +commit dfa7c4d869b7d3d37b70f1de856f2901b6ebfcf0 upstream. + +parport_pc_probe_port() creates the own 'parport_pc' device if the +device argument is NULL. Then parport_pc_probe_port() doesn't +initialize the dma_mask and coherent_dma_mask of the device and calls +dma_alloc_coherent with it. dma_alloc_coherent fails because +dma_alloc_coherent() doesn't accept the uninitialized dma_mask: + +http://lkml.org/lkml/2009/6/16/150 + +Long ago, X86_32 and X86_64 had the own dma_alloc_coherent +implementations; X86_32 accepted a device having dma_mask that is not +initialized however X86_64 didn't. When we merged them, we chose to +prohibit a device having dma_mask that is not initialized. I think +that it's good to require drivers to set up dma_mask (and +coherent_dma_mask) properly if the drivers want DMA. + +Signed-off-by: FUJITA Tomonori +Reported-by: Malcom Blaney +Tested-by: Malcom Blaney +Signed-off-by: Alan Cox +Acked-by: Jeff Garzik +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/parport/parport_pc.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/parport/parport_pc.c ++++ b/drivers/parport/parport_pc.c +@@ -2211,6 +2211,9 @@ struct parport *parport_pc_probe_port (u + if (IS_ERR(pdev)) + return NULL; + dev = &pdev->dev; ++ ++ dev->coherent_dma_mask = DMA_BIT_MASK(24); ++ dev->dma_mask = &dev->coherent_dma_mask; + } + + ops = kmalloc(sizeof (struct parport_operations), GFP_KERNEL); + + +From gregkh@mini.kroah.org Tue Jun 30 17:15:53 2009 +Message-Id: <20090701001553.003289449@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:14:23 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + "Rafael J. Wysocki" , + Jesse Barnes +Subject: [patch 27/35] PCI PM: Fix handling of devices without PM support by pci_target_state() +References: <20090701001356.007288418@mini.kroah.org> +Content-Disposition: inline; filename=pci-pm-fix-handling-of-devices-without-pm-support-by-pci_target_state.patch +Content-Length: 1472 +Lines: 44 + +2.6.29-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Rafael J. Wysocki + +commit d2abdf62882d982c58e7a6b09ecdcfcc28075e2e upstream. + +If a PCI device is not power-manageable either by the platform, or +with the help of the native PCI PM interface, pci_target_state() will +return either PCI_D3hot, or PCI_POWER_ERROR for it, depending on +whether or not the device is configured to wake up the system. Alas, +none of these return values is correct, because each of them causes +pci_prepare_to_sleep() to return error code, although it should +complete successfully in such a case. + +Fix this problem by making pci_target_state() always return PCI_D0 +for devices that cannot be power managed. + +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Jesse Barnes +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pci/pci.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +--- a/drivers/pci/pci.c ++++ b/drivers/pci/pci.c +@@ -1196,15 +1196,14 @@ pci_power_t pci_target_state(struct pci_ + default: + target_state = state; + } ++ } else if (!dev->pm_cap) { ++ target_state = PCI_D0; + } else if (device_may_wakeup(&dev->dev)) { + /* + * Find the deepest state from which the device can generate + * wake-up events, make it the target state and enable device + * to generate PME#. + */ +- if (!dev->pm_cap) +- return PCI_POWER_ERROR; +- + if (dev->pme_support) { + while (target_state + && !(dev->pme_support & (1 << target_state))) + + +From gregkh@mini.kroah.org Tue Jun 30 17:15:53 2009 +Message-Id: <20090701001553.278599027@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:14:24 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + "Rafael J. Wysocki" , + Jesse Barnes +Subject: [patch 28/35] PCI PM: Follow PCI_PM_CTRL_NO_SOFT_RESET during transitions from D3 +References: <20090701001356.007288418@mini.kroah.org> +Content-Disposition: inline; filename=pci-pm-follow-pci_pm_ctrl_no_soft_reset-during-transitions-from-d3.patch +Content-Length: 1444 +Lines: 38 + +2.6.29-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Rafael J. Wysocki + +commit f62795f1e892ca9269849fa83de97621da7e02c0 upstream. + +According to the PCI PM specification (PCI Bus Power Management +Interface Specification, Rev. 1.2, Section 5.4.1) we are supposed to +reinitialize devices that have PCI_PM_CTRL_NO_SOFT_RESET clear during +all transitions from PCI_D3hot to PCI_D0, but we only do it if the +device's current_state field is equal to PCI_UNKNOWN. + +This may lead to problems if a device with PCI_PM_CTRL_NO_SOFT_RESET +unset is put into PCI_D3hot at run time by its driver and +pci_set_power_state() is used to put it back into PCI_D0, because in +that case the device will remain uninitialized after +pci_set_power_state() has returned. Prevent that from happening by +modifying pci_raw_set_power_state() to reinitialize devices with +PCI_PM_CTRL_NO_SOFT_RESET unset during all transitions from D3 to D0. + +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Jesse Barnes +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pci/pci.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/pci/pci.c ++++ b/drivers/pci/pci.c +@@ -479,6 +479,8 @@ pci_raw_set_power_state(struct pci_dev * + pmcsr &= ~PCI_PM_CTRL_STATE_MASK; + pmcsr |= state; + break; ++ case PCI_D3hot: ++ case PCI_D3cold: + case PCI_UNKNOWN: /* Boot-up */ + if ((pmcsr & PCI_PM_CTRL_STATE_MASK) == PCI_D3hot + && !(pmcsr & PCI_PM_CTRL_NO_SOFT_RESET)) { + + +From gregkh@mini.kroah.org Tue Jun 30 17:15:53 2009 +Message-Id: <20090701001553.429647333@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:14:25 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jiri Slaby , + Alan Cox +Subject: [patch 29/35] pcmcia/cm4000: fix lock imbalance +References: <20090701001356.007288418@mini.kroah.org> +Content-Disposition: inline; filename=pcmcia-cm4000-fix-lock-imbalance.patch +Content-Length: 777 +Lines: 28 + +2.6.29-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Jiri Slaby + +commit 69ae59d7d8df14413cf0a97b3e372d7dc8352563 upstream. + +Don't return from switch/case, break instead, so that we unlock BKL. + +Signed-off-by: Jiri Slaby +Signed-off-by: Alan Cox +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/char/pcmcia/cm4000_cs.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/char/pcmcia/cm4000_cs.c ++++ b/drivers/char/pcmcia/cm4000_cs.c +@@ -1575,7 +1575,8 @@ static long cmm_ioctl(struct file *filp, + clear_bit(LOCK_IO, &dev->flags); + wake_up_interruptible(&dev->ioq); + +- return 0; ++ rc = 0; ++ break; + case CM_IOCSPTS: + { + struct ptsreq krnptsreq; + + +From gregkh@mini.kroah.org Tue Jun 30 17:15:53 2009 +Message-Id: <20090701001553.621173501@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:14:26 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Andrew Vasquez , + James Bottomley +Subject: [patch 30/35] qla2xxx: Correct (again) overflow during dump-processing on large-memory ISP23xx parts. +References: <20090701001356.007288418@mini.kroah.org> +Content-Disposition: inline; filename=qla2xxx-correct-overflow-during-dump-processing-on-large-memory-isp23xx-parts.patch +Content-Length: 986 +Lines: 29 + +2.6.29-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Andrew Vasquez + +commit e18e963b7e533149676b5d387d0a56160df9f111 upstream. + +Commit 7b867cf76fbcc8d77867cbec6f509f71dce8a98f ([SCSI] qla2xxx: +Refactor qla data structures) inadvertently reverted +e792121ec85672c1fa48f79d13986a3f4f56c590 ([SCSI] qla2xxx: Correct +overflow during dump-processing on large-memory ISP23xx parts.). + +Signed-off-by: Andrew Vasquez +Signed-off-by: James Bottomley +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/qla2xxx/qla_dbg.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/scsi/qla2xxx/qla_dbg.c ++++ b/drivers/scsi/qla2xxx/qla_dbg.c +@@ -218,7 +218,7 @@ qla24xx_soft_reset(struct qla_hw_data *h + + static int + qla2xxx_dump_ram(struct qla_hw_data *ha, uint32_t addr, uint16_t *ram, +- uint16_t ram_words, void **nxt) ++ uint32_t ram_words, void **nxt) + { + int rval; + uint32_t cnt, stat, timer, words, idx; + + +From gregkh@mini.kroah.org Tue Jun 30 17:15:53 2009 +Message-Id: <20090701001553.803002126@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:14:27 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Clemens Ladisch , + Takashi Iwai +Subject: [patch 31/35] sound: seq_midi_event: fix decoding of (N)RPN events +References: <20090701001356.007288418@mini.kroah.org> +Content-Disposition: inline; filename=sound-seq_midi_event-fix-decoding-of-rpn-events.patch +Content-Length: 1289 +Lines: 34 + +2.6.29-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Clemens Ladisch + +commit 6423f9ea8035138d70bae1a278d3b57b743f8b3e upstream. + +When decoding (N)RPN sequencer events into raw MIDI commands, the +extra_decode_xrpn() function had accidentally swapped the MSB and LSB +controller values of both the parameter number and the data value. + +Signed-off-by: Clemens Ladisch +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/core/seq/seq_midi_event.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/sound/core/seq/seq_midi_event.c ++++ b/sound/core/seq/seq_midi_event.c +@@ -504,10 +504,10 @@ static int extra_decode_xrpn(struct snd_ + if (dev->nostat && count < 12) + return -ENOMEM; + cmd = MIDI_CMD_CONTROL|(ev->data.control.channel & 0x0f); +- bytes[0] = ev->data.control.param & 0x007f; +- bytes[1] = (ev->data.control.param & 0x3f80) >> 7; +- bytes[2] = ev->data.control.value & 0x007f; +- bytes[3] = (ev->data.control.value & 0x3f80) >> 7; ++ bytes[0] = (ev->data.control.param & 0x3f80) >> 7; ++ bytes[1] = ev->data.control.param & 0x007f; ++ bytes[2] = (ev->data.control.value & 0x3f80) >> 7; ++ bytes[3] = ev->data.control.value & 0x007f; + if (cmd != dev->lastcmd && !dev->nostat) { + if (count < 9) + return -ENOMEM; + + +From gregkh@mini.kroah.org Tue Jun 30 17:15:54 2009 +Message-Id: <20090701001553.976012658@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:14:28 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Dimitri Sivanich , + Christoph Lameter , + Nick Piggin , + Mel Gorman +Subject: [patch 32/35] mm: fix handling of pagesets for downed cpus +References: <20090701001356.007288418@mini.kroah.org> +Content-Disposition: inline; filename=mm-fix-handling-of-pagesets-for-downed-cpus.patch +Content-Length: 1836 +Lines: 58 + +2.6.29-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Dimitri Sivanich + +commit 364df0ebfbbb1330bfc6ca159f4d6020efc15a12 upstream. + +After downing/upping a cpu, an attempt to set +/proc/sys/vm/percpu_pagelist_fraction results in an oops in +percpu_pagelist_fraction_sysctl_handler(). + +If a processor is downed then we need to set the pageset pointer back to +the boot pageset. + +Updates of the high water marks should not access pagesets of unpopulated +zones (those pointer go to the boot pagesets which would be no longer +functional if their size would be increased beyond zero). + +Signed-off-by: Dimitri Sivanich +Signed-off-by: Christoph Lameter +Reviewed-by: KOSAKI Motohiro +Cc: Nick Piggin +Cc: Mel Gorman +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/page_alloc.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/mm/page_alloc.c ++++ b/mm/page_alloc.c +@@ -2804,7 +2804,7 @@ bad: + if (dzone == zone) + break; + kfree(zone_pcp(dzone, cpu)); +- zone_pcp(dzone, cpu) = NULL; ++ zone_pcp(dzone, cpu) = &boot_pageset[cpu]; + } + return -ENOMEM; + } +@@ -2819,7 +2819,7 @@ static inline void free_zone_pagesets(in + /* Free per_cpu_pageset if it is slab allocated */ + if (pset != &boot_pageset[cpu]) + kfree(pset); +- zone_pcp(zone, cpu) = NULL; ++ zone_pcp(zone, cpu) = &boot_pageset[cpu]; + } + } + +@@ -4494,6 +4494,8 @@ int percpu_pagelist_fraction_sysctl_hand + if (!write || (ret == -EINVAL)) + return ret; + for_each_zone(zone) { ++ if (!populated_zone(zone)) ++ continue; + for_each_online_cpu(cpu) { + unsigned long high; + high = zone->present_pages / percpu_pagelist_fraction; + + +From gregkh@mini.kroah.org Tue Jun 30 17:15:54 2009 +Message-Id: <20090701001554.157008086@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:14:29 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Mikulas Patocka , + Alasdair G Kergon +Subject: [patch 33/35] dm mpath: validate table argument count +References: <20090701001356.007288418@mini.kroah.org> +Content-Disposition: inline; filename=dm-mpath-validate-table-argument-count.patch +Content-Length: 1060 +Lines: 36 + +2.6.29-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Mikulas Patocka + +commit 0e0497c0c017664994819f4602dc07fd95896c52 upstream. + +The parser reads the argument count as a number but doesn't check that +sufficient arguments are supplied. This command triggers the bug: + +dmsetup create mpath --table "0 `blockdev --getsize /dev/mapper/cr0` + multipath 0 0 2 1 round-robin 1000 0 1 1 /dev/mapper/cr0 + round-robin 0 1 1 /dev/mapper/cr1 1000" +kernel BUG at drivers/md/dm-mpath.c:530! + +Signed-off-by: Mikulas Patocka +Signed-off-by: Alasdair G Kergon +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/dm-mpath.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/md/dm-mpath.c ++++ b/drivers/md/dm-mpath.c +@@ -554,6 +554,12 @@ static int parse_path_selector(struct ar + return -EINVAL; + } + ++ if (ps_argc > as->argc) { ++ dm_put_path_selector(pst); ++ ti->error = "not enough arguments for path selector"; ++ return -EINVAL; ++ } ++ + r = pst->create(&pg->ps, ps_argc, as->argv); + if (r) { + dm_put_path_selector(pst); + + +From gregkh@mini.kroah.org Tue Jun 30 17:15:54 2009 +Message-Id: <20090701001554.377000070@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:14:30 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Mikulas Patocka , + Alasdair G Kergon +Subject: [patch 34/35] dm mpath: validate hw_handler argument count +References: <20090701001356.007288418@mini.kroah.org> +Content-Disposition: inline; filename=dm-mpath-validate-hw_handler-argument-count.patch +Content-Length: 804 +Lines: 29 + +2.6.29-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Mikulas Patocka + +commit e094f4f15f5169526c7200b9bde44b900548a81e upstream. + +Fix arg count parsing error in hw handlers. + +Signed-off-by: Mikulas Patocka +Signed-off-by: Alasdair G Kergon +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/dm-mpath.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/md/dm-mpath.c ++++ b/drivers/md/dm-mpath.c +@@ -706,6 +706,11 @@ static int parse_hw_handler(struct arg_s + if (!hw_argc) + return 0; + ++ if (hw_argc > as->argc) { ++ ti->error = "not enough arguments for hardware handler"; ++ return -EINVAL; ++ } ++ + m->hw_handler_name = kstrdup(shift(as), GFP_KERNEL); + request_module("scsi_dh_%s", m->hw_handler_name); + if (scsi_dh_handler_exist(m->hw_handler_name) == 0) { + + +From gregkh@mini.kroah.org Tue Jun 30 17:15:54 2009 +Message-Id: <20090701001554.551074711@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:14:31 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Milan Broz , + Alasdair G Kergon +Subject: [patch 35/35] dm: sysfs skip output when device is being destroyed +References: <20090701001356.007288418@mini.kroah.org> +Content-Disposition: inline; filename=dm-sysfs-skip-output-when-device-is-being-destroyed.patch +Content-Length: 749 +Lines: 32 + +2.6.29-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Milan Broz + +commit 4d89b7b4e4726893453d0fb4ddbb5b3e16353994 upstream. + +Do not process sysfs attributes when device is being destroyed. + +Otherwise code can cause + BUG_ON(test_bit(DMF_FREEING, &md->flags)); +in dm_put() call. + +Signed-off-by: Milan Broz +Signed-off-by: Alasdair G Kergon +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/dm.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/md/dm.c ++++ b/drivers/md/dm.c +@@ -1728,6 +1728,10 @@ struct mapped_device *dm_get_from_kobjec + if (&md->kobj != kobj) + return NULL; + ++ if (test_bit(DMF_FREEING, &md->flags) || ++ test_bit(DMF_DELETING, &md->flags)) ++ return NULL; ++ + dm_get(md); + return md; + } + + +From gregkh@mini.kroah.org Tue Jun 30 17:15:48 2009 +Message-Id: <20090701001356.007288418@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:13:56 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk +Subject: [patch 00/35] 2.6.29-stable review +Content-Length: 2680 +Lines: 66 + + +This is the start of the stable review cycle for the 2.6.29.6 release. + +This is going to be the last of the .29 kernel series releases, barring +anything major happening. + +There are 35 patches in this series, all will be posted as a response to +this one. If anyone has any issues with these being applied, please let +us know. If anyone is a maintainer of the proper subsystem, and wants +to add a Signed-off-by: line to the patch, please respond with it. + +These patches are sent out with a number of different people on the Cc: +line. If you wish to be a reviewer, please email stable@kernel.org to +add your name to the list. If you want to be off the reviewer list, +also email us. + +Responses should be made by Friday, Jul 3, 00:00:00 2009 UTC. +Anything received after that time might be too late. + +The whole patch series can be found in one patch at: + kernel.org/pub/linux/kernel/v2.6/stable-review/patch-2.6.29.6-rc1.gz +and the diffstat can be found below. + + +thanks, + +greg k-h + + + Makefile | 2 +- + arch/x86/kernel/cpu/amd.c | 4 +- + arch/x86/kernel/reboot.c | 9 ++ + arch/x86/kernel/setup.c | 15 +--- + drivers/block/floppy.c | 8 ++ + drivers/char/moxa.c | 7 ++- + drivers/char/mxser.c | 2 +- + drivers/char/pcmcia/cm4000_cs.c | 3 +- + drivers/char/vt_ioctl.c | 3 +- + drivers/firmware/memmap.c | 16 ++-- + drivers/infiniband/hw/mlx4/qp.c | 4 + + drivers/input/keyboard/atkbd.c | 169 +++++++++++++++++++++---------------- + drivers/isdn/hisax/hfc_pci.c | 41 +++++++--- + drivers/isdn/hisax/hisax.h | 2 +- + drivers/md/dm-mpath.c | 11 +++ + drivers/md/dm.c | 4 + + drivers/md/raid5.c | 1 + + drivers/net/bonding/bond_sysfs.c | 1 + + drivers/net/r8169.c | 11 +-- + drivers/parport/parport_pc.c | 34 ++++++-- + drivers/parport/parport_serial.c | 30 ++++++- + drivers/pci/pci.c | 7 +- + drivers/pci/pcie/aspm.c | 4 + + drivers/scsi/qla2xxx/qla_dbg.c | 2 +- + drivers/serial/8250.c | 15 ++++ + drivers/usb/class/usbtmc.c | 6 ++ + drivers/video/atmel_lcdfb.c | 10 +-- + fs/fs-writeback.c | 2 - + fs/jbd/commit.c | 6 +- + include/linux/firmware-map.h | 12 +-- + include/linux/mlx4/qp.h | 1 + + lib/Kconfig.debug | 2 +- + mm/page_alloc.c | 6 +- + net/mac80211/rc80211_minstrel.c | 2 +- + sound/core/seq/seq_midi_event.c | 8 +- + sound/pci/ca0106/ca0106_mixer.c | 6 ++ + 36 files changed, 307 insertions(+), 159 deletions(-) + diff --git a/queue-2.6.29/send_sigio_to_task-sanitize-the-usage-of-fown-signum.patch b/queue-2.6.29/send_sigio_to_task-sanitize-the-usage-of-fown-signum.patch deleted file mode 100644 index 08caee16a0c..00000000000 --- a/queue-2.6.29/send_sigio_to_task-sanitize-the-usage-of-fown-signum.patch +++ /dev/null @@ -1,68 +0,0 @@ -From 8eeee4e2f04fc551f50c9d9847da2d73d7d33728 Mon Sep 17 00:00:00 2001 -From: Oleg Nesterov -Date: Wed, 17 Jun 2009 00:27:10 +0200 -Subject: send_sigio_to_task: sanitize the usage of fown->signum - -From: Oleg Nesterov - -commit 8eeee4e2f04fc551f50c9d9847da2d73d7d33728 upstream. - -send_sigio_to_task() reads fown->signum several times, we can race with -F_SETSIG which changes ->signum lockless. In theory, this can fool -security checks or we can call group_send_sig_info() with the wrong -->si_signo which does not match "int sig". - -Change the code to cache ->signum. - -Signed-off-by: Oleg Nesterov -Signed-off-by: Linus Torvalds -Signed-off-by: Greg Kroah-Hartman - ---- - fs/fcntl.c | 16 +++++++++++----- - 1 file changed, 11 insertions(+), 5 deletions(-) - ---- a/fs/fcntl.c -+++ b/fs/fcntl.c -@@ -428,14 +428,20 @@ static inline int sigio_perm(struct task - } - - static void send_sigio_to_task(struct task_struct *p, -- struct fown_struct *fown, -+ struct fown_struct *fown, - int fd, - int reason) - { -- if (!sigio_perm(p, fown, fown->signum)) -+ /* -+ * F_SETSIG can change ->signum lockless in parallel, make -+ * sure we read it once and use the same value throughout. -+ */ -+ int signum = ACCESS_ONCE(fown->signum); -+ -+ if (!sigio_perm(p, fown, signum)) - return; - -- switch (fown->signum) { -+ switch (signum) { - siginfo_t si; - default: - /* Queue a rt signal with the appropriate fd as its -@@ -444,7 +450,7 @@ static void send_sigio_to_task(struct ta - delivered even if we can't queue. Failure to - queue in this case _should_ be reported; we fall - back to SIGIO in that case. --sct */ -- si.si_signo = fown->signum; -+ si.si_signo = signum; - si.si_errno = 0; - si.si_code = reason; - /* Make sure we are called with one of the POLL_* -@@ -456,7 +462,7 @@ static void send_sigio_to_task(struct ta - else - si.si_band = band_table[reason - POLL_IN]; - si.si_fd = fd; -- if (!group_send_sig_info(fown->signum, &si, p)) -+ if (!group_send_sig_info(signum, &si, p)) - break; - /* fall-through: fall back on the old plain SIGIO signal */ - case 0: diff --git a/queue-2.6.29/series b/queue-2.6.29/series index 4eeabe66b75..311c011ca9d 100644 --- a/queue-2.6.29/series +++ b/queue-2.6.29/series @@ -19,8 +19,6 @@ ib-mlx4-add-strong-ordering-to-local-inval-and-fast-reg-work-requests.patch x86-handle-initrd-that-extends-into-unusable-memory.patch lockdep-select-frame-pointers-on-x86.patch mac80211-fix-minstrel-single-rate-memory-corruption.patch -shift-current_cred-from-__f_setown-to-f_modown.patch -send_sigio_to_task-sanitize-the-usage-of-fown-signum.patch md-raid5-add-missing-call-to-schedule-after-prepare_to_wait.patch vt_ioctl-fix-lock-imbalance.patch x86-set-cpu_llc_id-on-amd-cpus.patch diff --git a/queue-2.6.29/shift-current_cred-from-__f_setown-to-f_modown.patch b/queue-2.6.29/shift-current_cred-from-__f_setown-to-f_modown.patch deleted file mode 100644 index a86ba87fe7d..00000000000 --- a/queue-2.6.29/shift-current_cred-from-__f_setown-to-f_modown.patch +++ /dev/null @@ -1,76 +0,0 @@ -From 2f38d70fb4e97e7d00e12eaac45790cf6ebd7b22 Mon Sep 17 00:00:00 2001 -From: Oleg Nesterov -Date: Tue, 16 Jun 2009 22:07:46 +0200 -Subject: shift current_cred() from __f_setown() to f_modown() - -From: Oleg Nesterov - -commit 2f38d70fb4e97e7d00e12eaac45790cf6ebd7b22 upstream. - -Shift current_cred() from __f_setown() to f_modown(). This reduces -the number of arguments and saves 48 bytes from fs/fcntl.o. - -[ Note: this doesn't clear euid/uid when pid is set to NULL. But if - f_owner.pid == NULL we never use f_owner.uid/euid. Otherwise we'd - have a bug anyway: we must not send signals if pid was reset to NULL. ] - -Signed-off-by: Oleg Nesterov -Acked-by: David Howells -Signed-off-by: Linus Torvalds -Signed-off-by: Greg Kroah-Hartman - ---- - fs/fcntl.c | 17 ++++++++++------- - 1 file changed, 10 insertions(+), 7 deletions(-) - ---- a/fs/fcntl.c -+++ b/fs/fcntl.c -@@ -198,15 +198,19 @@ static int setfl(int fd, struct file * f - } - - static void f_modown(struct file *filp, struct pid *pid, enum pid_type type, -- uid_t uid, uid_t euid, int force) -+ int force) - { - write_lock_irq(&filp->f_owner.lock); - if (force || !filp->f_owner.pid) { - put_pid(filp->f_owner.pid); - filp->f_owner.pid = get_pid(pid); - filp->f_owner.pid_type = type; -- filp->f_owner.uid = uid; -- filp->f_owner.euid = euid; -+ -+ if (pid) { -+ const struct cred *cred = current_cred(); -+ filp->f_owner.uid = cred->uid; -+ filp->f_owner.euid = cred->euid; -+ } - } - write_unlock_irq(&filp->f_owner.lock); - } -@@ -214,14 +218,13 @@ static void f_modown(struct file *filp, - int __f_setown(struct file *filp, struct pid *pid, enum pid_type type, - int force) - { -- const struct cred *cred = current_cred(); - int err; -- -+ - err = security_file_set_fowner(filp); - if (err) - return err; - -- f_modown(filp, pid, type, cred->uid, cred->euid, force); -+ f_modown(filp, pid, type, force); - return 0; - } - EXPORT_SYMBOL(__f_setown); -@@ -247,7 +250,7 @@ EXPORT_SYMBOL(f_setown); - - void f_delown(struct file *filp) - { -- f_modown(filp, NULL, PIDTYPE_PID, 0, 0, 1); -+ f_modown(filp, NULL, PIDTYPE_PID, 1); - } - - pid_t f_getown(struct file *filp)