From: Greg Kroah-Hartman Date: Fri, 28 Apr 2006 00:25:17 +0000 (-0700) Subject: start of 2.6.16.12 review cycle X-Git-Tag: v2.6.16.12~1 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=2421bceffecd0a93bce8ab9f18ca4436a69f82ab;p=thirdparty%2Fkernel%2Fstable-queue.git start of 2.6.16.12 review cycle --- diff --git a/queue-2.6.16/MIPS-0001.patch b/review-2.6.16/MIPS-0001.patch similarity index 100% rename from queue-2.6.16/MIPS-0001.patch rename to review-2.6.16/MIPS-0001.patch diff --git a/queue-2.6.16/MIPS-0002.patch b/review-2.6.16/MIPS-0002.patch similarity index 100% rename from queue-2.6.16/MIPS-0002.patch rename to review-2.6.16/MIPS-0002.patch diff --git a/queue-2.6.16/MIPS-0003.patch b/review-2.6.16/MIPS-0003.patch similarity index 100% rename from queue-2.6.16/MIPS-0003.patch rename to review-2.6.16/MIPS-0003.patch diff --git a/queue-2.6.16/MIPS-0004.patch b/review-2.6.16/MIPS-0004.patch similarity index 100% rename from queue-2.6.16/MIPS-0004.patch rename to review-2.6.16/MIPS-0004.patch diff --git a/queue-2.6.16/alpha-strncpy-fix.patch b/review-2.6.16/alpha-strncpy-fix.patch similarity index 100% rename from queue-2.6.16/alpha-strncpy-fix.patch rename to review-2.6.16/alpha-strncpy-fix.patch diff --git a/queue-2.6.16/altix-snsc-duplicate-kobject-fix.patch b/review-2.6.16/altix-snsc-duplicate-kobject-fix.patch similarity index 100% rename from queue-2.6.16/altix-snsc-duplicate-kobject-fix.patch rename to review-2.6.16/altix-snsc-duplicate-kobject-fix.patch diff --git a/queue-2.6.16/cs5535_gpio.c-call-cdev_del-during-module_exit-to-unmap-kobject-references-and-other-cleanups.patch b/review-2.6.16/cs5535_gpio.c-call-cdev_del-during-module_exit-to-unmap-kobject-references-and-other-cleanups.patch similarity index 100% rename from queue-2.6.16/cs5535_gpio.c-call-cdev_del-during-module_exit-to-unmap-kobject-references-and-other-cleanups.patch rename to review-2.6.16/cs5535_gpio.c-call-cdev_del-during-module_exit-to-unmap-kobject-references-and-other-cleanups.patch diff --git a/queue-2.6.16/cxusb-bluebird-bug-fix-power-down-corrupts-frontend.patch b/review-2.6.16/cxusb-bluebird-bug-fix-power-down-corrupts-frontend.patch similarity index 100% rename from queue-2.6.16/cxusb-bluebird-bug-fix-power-down-corrupts-frontend.patch rename to review-2.6.16/cxusb-bluebird-bug-fix-power-down-corrupts-frontend.patch diff --git a/queue-2.6.16/dm-flush-queue-EINTR.patch b/review-2.6.16/dm-flush-queue-EINTR.patch similarity index 100% rename from queue-2.6.16/dm-flush-queue-EINTR.patch rename to review-2.6.16/dm-flush-queue-EINTR.patch diff --git a/queue-2.6.16/dm-snapshot-fix-kcopyd-destructor.patch b/review-2.6.16/dm-snapshot-fix-kcopyd-destructor.patch similarity index 100% rename from queue-2.6.16/dm-snapshot-fix-kcopyd-destructor.patch rename to review-2.6.16/dm-snapshot-fix-kcopyd-destructor.patch diff --git a/queue-2.6.16/fix-reiserfs-deadlock.patch b/review-2.6.16/fix-reiserfs-deadlock.patch similarity index 100% rename from queue-2.6.16/fix-reiserfs-deadlock.patch rename to review-2.6.16/fix-reiserfs-deadlock.patch diff --git a/queue-2.6.16/fix-saa7129-support-in-saa7127-module-for-pvr350-tv-out.patch b/review-2.6.16/fix-saa7129-support-in-saa7127-module-for-pvr350-tv-out.patch similarity index 100% rename from queue-2.6.16/fix-saa7129-support-in-saa7127-module-for-pvr350-tv-out.patch rename to review-2.6.16/fix-saa7129-support-in-saa7127-module-for-pvr350-tv-out.patch diff --git a/queue-2.6.16/for_each_possible_cpu.patch b/review-2.6.16/for_each_possible_cpu.patch similarity index 100% rename from queue-2.6.16/for_each_possible_cpu.patch rename to review-2.6.16/for_each_possible_cpu.patch diff --git a/queue-2.6.16/get_dvb_firmware-download-nxt2002-firmware-from-new-driver-location.patch b/review-2.6.16/get_dvb_firmware-download-nxt2002-firmware-from-new-driver-location.patch similarity index 100% rename from queue-2.6.16/get_dvb_firmware-download-nxt2002-firmware-from-new-driver-location.patch rename to review-2.6.16/get_dvb_firmware-download-nxt2002-firmware-from-new-driver-location.patch diff --git a/queue-2.6.16/lsm-add-missing-hook-to-do_compat_readv_writev.patch b/review-2.6.16/lsm-add-missing-hook-to-do_compat_readv_writev.patch similarity index 100% rename from queue-2.6.16/lsm-add-missing-hook-to-do_compat_readv_writev.patch rename to review-2.6.16/lsm-add-missing-hook-to-do_compat_readv_writev.patch diff --git a/queue-2.6.16/make-vm86-call-audit_syscall_exit.patch b/review-2.6.16/make-vm86-call-audit_syscall_exit.patch similarity index 100% rename from queue-2.6.16/make-vm86-call-audit_syscall_exit.patch rename to review-2.6.16/make-vm86-call-audit_syscall_exit.patch diff --git a/queue-2.6.16/net-e1000-update-truesize-with-the-length-of-the-packet-for-packet-split.patch b/review-2.6.16/net-e1000-update-truesize-with-the-length-of-the-packet-for-packet-split.patch similarity index 100% rename from queue-2.6.16/net-e1000-update-truesize-with-the-length-of-the-packet-for-packet-split.patch rename to review-2.6.16/net-e1000-update-truesize-with-the-length-of-the-packet-for-packet-split.patch diff --git a/review-2.6.16/send.mbox b/review-2.6.16/send.mbox new file mode 100644 index 00000000000..1353c25bf35 --- /dev/null +++ b/review-2.6.16/send.mbox @@ -0,0 +1,2389 @@ +From greg@quad.kroah.org Thu Apr 27 17:13:22 2006 +Message-Id: <20060428001226.204293000@quad.kroah.org> +User-Agent: quilt/0.44-1 +Date: Thu, 27 Apr 2006 17:12:26 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + torvalds@osdl.org, + akpm@osdl.org, + alan@lxorguk.ukuu.org.uk +Subject: [patch 00/24] -stable review +Content-Length: 734 +Lines: 17 + +This is the start of the stable review cycle for the 2.6.16.12 release. +There are 24 patches in this series, all will be posted as a response to +this one. If anyone has any issues with these being applied, please let +us know. If anyone is a maintainer of the proper subsystem, and wants +to add a signed-off-by: line to the patch, please respond with it. + +These patches are sent out with a number of different people on the Cc: +line. If you wish to be a reviewer, please email stable@kernel.org to +add your name to the list. If you want to be off the reviewer list, +also email us. + +Responses should be made by Sunday, April 30 00:00:00 UTC. Anything +received after that time, might be too late. + +thanks, + +the -stable release team + +From greg@quad.kroah.org Thu Apr 27 17:13:22 2006 +Message-Id: <20060428001322.190063000@quad.kroah.org> +References: <20060428001226.204293000@quad.kroah.org> +User-Agent: quilt/0.44-1 +Date: Thu, 27 Apr 2006 17:12:27 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + git-commits-head@vger.kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + torvalds@osdl.org, + akpm@osdl.org, + alan@lxorguk.ukuu.org.uk, + Arnaud MAZIN , + Stelian Pop , + Greg Kroah-Hartman +Subject: [patch 01/24] sonypi: correct detection of new ICH7-based laptops +Content-Disposition: inline; filename=sonypi-correct-detection-of-new-ich7-based-laptops.patch +Content-Length: 1132 +Lines: 34 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Arnaud MAZIN + +[PATCH] sonypi: correct detection of new ICH7-based laptops + +Add a test to detect the ICH7 based Core Duo SONY laptops (such as the SZ1) +as type3 models. + +Signed-off-by: Arnaud MAZIN +Acked-by: Stelian Pop +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/char/sonypi.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- linux-2.6.16.11.orig/drivers/char/sonypi.c ++++ linux-2.6.16.11/drivers/char/sonypi.c +@@ -1341,6 +1341,9 @@ static int __devinit sonypi_probe(struct + else if ((pcidev = pci_get_device(PCI_VENDOR_ID_INTEL, + PCI_DEVICE_ID_INTEL_ICH6_1, NULL))) + sonypi_device.model = SONYPI_DEVICE_MODEL_TYPE3; ++ else if ((pcidev = pci_get_device(PCI_VENDOR_ID_INTEL, ++ PCI_DEVICE_ID_INTEL_ICH7_1, NULL))) ++ sonypi_device.model = SONYPI_DEVICE_MODEL_TYPE3; + else + sonypi_device.model = SONYPI_DEVICE_MODEL_TYPE2; + + +-- + +From greg@quad.kroah.org Thu Apr 27 17:13:22 2006 +Message-Id: <20060428001322.331437000@quad.kroah.org> +References: <20060428001226.204293000@quad.kroah.org> +User-Agent: quilt/0.44-1 +Date: Thu, 27 Apr 2006 17:12:28 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + git-commits-head@vger.kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + torvalds@osdl.org, + akpm@osdl.org, + alan@lxorguk.ukuu.org.uk, + Thayumanavar Sachithanantham , + Greg Kroah-Hartman +Subject: [patch 02/24] cs5535_gpio.c: call cdev_del() during module_exit to unmap kobject references and other cleanups +Content-Disposition: inline; filename=cs5535_gpio.c-call-cdev_del-during-module_exit-to-unmap-kobject-references-and-other-cleanups.patch +Content-Length: 1422 +Lines: 41 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Thayumanavar Sachithanantham + +[PATCH] cs5535_gpio.c: call cdev_del() during module_exit to unmap kobject references and other cleanups + +During module unloading, cdev_del() must be called to unmap cdev related +kobject references and other cleanups(such as inode->i_cdev being set to +NULL) which prevents the OOPS upon subsequent loading, usage and unloading +of modules(as seen in the mail thread +http://marc.theaimsgroup.com/?l=linux-kernel&m=114533640609018&w=2). + +Also, remove unneeded test of gpio_base. + +Signed-off-by: Thayumanavar Sachithanantham +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/char/cs5535_gpio.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- linux-2.6.16.11.orig/drivers/char/cs5535_gpio.c ++++ linux-2.6.16.11/drivers/char/cs5535_gpio.c +@@ -241,9 +241,10 @@ static int __init cs5535_gpio_init(void) + static void __exit cs5535_gpio_cleanup(void) + { + dev_t dev_id = MKDEV(major, 0); ++ ++ cdev_del(&cs5535_gpio_cdev); + unregister_chrdev_region(dev_id, CS5535_GPIO_COUNT); +- if (gpio_base != 0) +- release_region(gpio_base, CS5535_GPIO_SIZE); ++ release_region(gpio_base, CS5535_GPIO_SIZE); + } + + module_init(cs5535_gpio_init); + +-- + +From greg@quad.kroah.org Thu Apr 27 17:13:22 2006 +Message-Id: <20060428001322.474436000@quad.kroah.org> +References: <20060428001226.204293000@quad.kroah.org> +User-Agent: quilt/0.44-1 +Date: Thu, 27 Apr 2006 17:12:29 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + torvalds@osdl.org, + akpm@osdl.org, + alan@lxorguk.ukuu.org.uk, + Jason Baron , + Al Viro , + Greg Kroah-Hartman +Subject: [patch 03/24] make vm86 call audit_syscall_exit +Content-Disposition: inline; filename=make-vm86-call-audit_syscall_exit.patch +Content-Length: 3573 +Lines: 106 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +hi, + +The motivation behind the patch below was to address messages in +/var/log/messages such as: + +Jan 31 10:54:15 mets kernel: audit(:0): major=252 name_count=0: freeing +multiple contexts (1) +Jan 31 10:54:15 mets kernel: audit(:0): major=113 name_count=0: freeing +multiple contexts (2) + +I can reproduce by running 'get-edid' from: +http://john.fremlin.de/programs/linux/read-edid/. + +These messages come about in the log b/c the vm86 calls do not exit via +the normal system call exit paths and thus do not call +'audit_syscall_exit'. The next system call will then free the context for +itself and for the vm86 context, thus generating the above messages. This +patch addresses the issue by simply adding a call to 'audit_syscall_exit' +from the vm86 code. + +Besides fixing the above error messages the patch also now allows vm86 +system calls to become auditable. This is useful since strace does not +appear to properly record the return values from sys_vm86. + +I think this patch is also a step in the right direction in terms of +cleaning up some core auditing code. If we can correct any other paths +that do not properly call the audit exit and entries points, then we can +also eliminate the notion of context chaining. + +I've tested this patch by verifying that the log messages no longer +appear, and that the audit records for sys_vm86 appear to be correct. +Also, 'read_edid' produces itentical output. + +thanks, + +-Jason + +Signed-off-by: Jason Baron +Signed-off-by: Al Viro +Signed-off-by: Greg Kroah-Hartman + +--- +--- + arch/i386/kernel/vm86.c | 12 ++++++++++-- + kernel/auditsc.c | 5 ----- + 2 files changed, 10 insertions(+), 7 deletions(-) + +--- linux-2.6.16.11.orig/arch/i386/kernel/vm86.c ++++ linux-2.6.16.11/arch/i386/kernel/vm86.c +@@ -43,6 +43,7 @@ + #include + #include + #include ++#include + + #include + #include +@@ -252,6 +253,7 @@ out: + static void do_sys_vm86(struct kernel_vm86_struct *info, struct task_struct *tsk) + { + struct tss_struct *tss; ++ long eax; + /* + * make sure the vm86() system call doesn't try to do anything silly + */ +@@ -305,13 +307,19 @@ static void do_sys_vm86(struct kernel_vm + tsk->thread.screen_bitmap = info->screen_bitmap; + if (info->flags & VM86_SCREEN_BITMAP) + mark_screen_rdonly(tsk->mm); ++ __asm__ __volatile__("xorl %eax,%eax; movl %eax,%fs; movl %eax,%gs\n\t"); ++ __asm__ __volatile__("movl %%eax, %0\n" :"=r"(eax)); ++ ++ /*call audit_syscall_exit since we do not exit via the normal paths */ ++ if (unlikely(current->audit_context)) ++ audit_syscall_exit(current, AUDITSC_RESULT(eax), eax); ++ + __asm__ __volatile__( +- "xorl %%eax,%%eax; movl %%eax,%%fs; movl %%eax,%%gs\n\t" + "movl %0,%%esp\n\t" + "movl %1,%%ebp\n\t" + "jmp resume_userspace" + : /* no outputs */ +- :"r" (&info->regs), "r" (task_thread_info(tsk)) : "ax"); ++ :"r" (&info->regs), "r" (task_thread_info(tsk))); + /* we never return here */ + } + +--- linux-2.6.16.11.orig/kernel/auditsc.c ++++ linux-2.6.16.11/kernel/auditsc.c +@@ -966,11 +966,6 @@ void audit_syscall_entry(struct task_str + if (context->in_syscall) { + struct audit_context *newctx; + +-#if defined(__NR_vm86) && defined(__NR_vm86old) +- /* vm86 mode should only be entered once */ +- if (major == __NR_vm86 || major == __NR_vm86old) +- return; +-#endif + #if AUDIT_DEBUG + printk(KERN_ERR + "audit(:%d) pid=%d in syscall=%d;" + +-- + +From greg@quad.kroah.org Thu Apr 27 17:13:22 2006 +Message-Id: <20060428001322.615019000@quad.kroah.org> +References: <20060428001226.204293000@quad.kroah.org> +User-Agent: quilt/0.44-1 +Date: Thu, 27 Apr 2006 17:12:30 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + torvalds@osdl.org, + akpm@osdl.org, + alan@lxorguk.ukuu.org.uk, + brian.b@hp.com, + Andi Kleen , + Greg Kroah-Hartman +Subject: [patch 04/24] x86_64: Pass -32 to the assembler when compiling the 32bit vsyscall pages +Content-Disposition: inline; filename=x86_64-pass-32-to-the-assembler-when-compiling-the-32bit-vsyscall-pages.patch +Content-Length: 1070 +Lines: 35 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ + +This quietens warnings and actually fixes a bug. The unwind tables would +come out wrong without -32, causing pthread cancellation during them +to crash in the gcc runtime. + +The problem seems to only happen with newer binutils +(it doesn't happen with 2.16.91.0.2 but happens wit 2.16.91.0.5) + +Thanks to Brian Baker @ HP for test case and initial analysis. + +Cc: brian.b@hp.com + +Signed-off-by: Andi Kleen +Signed-off-by: Greg Kroah-Hartman + + +--- + arch/x86_64/ia32/Makefile | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- linux-2.6.16.11.orig/arch/x86_64/ia32/Makefile ++++ linux-2.6.16.11/arch/x86_64/ia32/Makefile +@@ -27,5 +27,5 @@ $(obj)/vsyscall-sysenter.so $(obj)/vsysc + $(obj)/vsyscall-%.so: $(src)/vsyscall.lds $(obj)/vsyscall-%.o FORCE + $(call if_changed,syscall) + +-AFLAGS_vsyscall-sysenter.o = -m32 +-AFLAGS_vsyscall-syscall.o = -m32 ++AFLAGS_vsyscall-sysenter.o = -m32 -Wa,-32 ++AFLAGS_vsyscall-syscall.o = -m32 -Wa,-32 + +-- + +From greg@quad.kroah.org Thu Apr 27 17:13:22 2006 +Message-Id: <20060428001322.752580000@quad.kroah.org> +References: <20060428001226.204293000@quad.kroah.org> +User-Agent: quilt/0.44-1 +Date: Thu, 27 Apr 2006 17:12:31 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + torvalds@osdl.org, + akpm@osdl.org, + alan@lxorguk.ukuu.org.uk, + mikew@google.com, + Andi Kleen , + Greg Kroah-Hartman +Subject: [patch 05/24] x86_64: Fix a race in the free_iommu path. +Content-Disposition: inline; filename=x86_64-fix-a-race-in-the-free_iommu-path.patch +Content-Length: 1308 +Lines: 40 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Mike Waychison + +We do this by removing a micro-optimization that tries to avoid grabbing +the iommu_bitmap_lock spinlock and using a bus-locked operation. + +This still races with other simultaneous alloc_iommu or free_iommu(size +> 1) which both use bus-unlocked operations. + +The end result of this race is eventually ending +up with an iommu_gart_bitmap that has bits errornously set all over, +making large contiguous iommu space allocations fail with 'PCI-DMA: +Out of IOMMU space'. + +Signed-off-by: Mike Waychison +Signed-off-by: Andi Kleen +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86_64/kernel/pci-gart.c | 4 ---- + 1 file changed, 4 deletions(-) + +--- linux-2.6.16.11.orig/arch/x86_64/kernel/pci-gart.c ++++ linux-2.6.16.11/arch/x86_64/kernel/pci-gart.c +@@ -114,10 +114,6 @@ static unsigned long alloc_iommu(int siz + static void free_iommu(unsigned long offset, int size) + { + unsigned long flags; +- if (size == 1) { +- clear_bit(offset, iommu_gart_bitmap); +- return; +- } + spin_lock_irqsave(&iommu_bitmap_lock, flags); + __clear_bit_string(iommu_gart_bitmap, offset, size); + spin_unlock_irqrestore(&iommu_bitmap_lock, flags); + +-- + +From greg@quad.kroah.org Thu Apr 27 17:13:23 2006 +Message-Id: <20060428001322.901074000@quad.kroah.org> +References: <20060428001226.204293000@quad.kroah.org> +User-Agent: quilt/0.44-1 +Date: Thu, 27 Apr 2006 17:12:32 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + torvalds@osdl.org, + akpm@osdl.org, + alan@lxorguk.ukuu.org.uk, + Eric Sesterhenn , + smurf@smurf.noris.de, + Adrian Bunk , + Greg Kroah-Hartman +Subject: [patch 06/24] USB: fix array overrun in drivers/usb/serial/option.c +Content-Disposition: inline; filename=usb-fix-array-overrun-in-drivers-usb-serial-option.c.patch +Content-Length: 1404 +Lines: 40 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Eric Sesterhenn + +since the arrays are declared as in_urbs[N_IN_URB] +and out_urbs[N_OUT_URB] both for loops, go one +over the end of the array. This fixes coverity id #555 + +This patch was already included in Linus' tree. + +Signed-off-by: Eric Sesterhenn +Signed-off-by: Adrian Bunk +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/option.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- linux-2.6.16.11.orig/drivers/usb/serial/option.c ++++ linux-2.6.16.11/drivers/usb/serial/option.c +@@ -582,14 +582,14 @@ static void option_setup_urbs(struct usb + portdata = usb_get_serial_port_data(port); + + /* Do indat endpoints first */ +- for (j = 0; j <= N_IN_URB; ++j) { ++ for (j = 0; j < N_IN_URB; ++j) { + portdata->in_urbs[j] = option_setup_urb (serial, + port->bulk_in_endpointAddress, USB_DIR_IN, port, + portdata->in_buffer[j], IN_BUFLEN, option_indat_callback); + } + + /* outdat endpoints */ +- for (j = 0; j <= N_OUT_URB; ++j) { ++ for (j = 0; j < N_OUT_URB; ++j) { + portdata->out_urbs[j] = option_setup_urb (serial, + port->bulk_out_endpointAddress, USB_DIR_OUT, port, + portdata->out_buffer[j], OUT_BUFLEN, option_outdat_callback); + +-- + +From greg@quad.kroah.org Thu Apr 27 17:13:23 2006 +Message-Id: <20060428001323.038996000@quad.kroah.org> +References: <20060428001226.204293000@quad.kroah.org> +User-Agent: quilt/0.44-1 +Date: Thu, 27 Apr 2006 17:12:33 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + dsd@gentoo.org, + mm-commits@vger.kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + torvalds@osdl.org, + akpm@osdl.org, + alan@lxorguk.ukuu.org.uk, + Greg Kroah-Hartman +Subject: [patch 07/24] tipar oops fix +Content-Disposition: inline; filename=tipar-oops-fix.patch +Content-Length: 1036 +Lines: 33 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Daniel Drake + +If compiled into the kernel, parport_register_driver() is called before the +parport driver has been initalised. + +This means that it is expected that tp_count is 0 after the +parport_register_driver() call() - tipar's attach function will not be +called until later during bootup. + +Signed-off-by: Daniel Drake +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/char/tipar.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- linux-2.6.16.11.orig/drivers/char/tipar.c ++++ linux-2.6.16.11/drivers/char/tipar.c +@@ -515,7 +515,7 @@ tipar_init_module(void) + err = PTR_ERR(tipar_class); + goto out_chrdev; + } +- if (parport_register_driver(&tipar_driver) || tp_count == 0) { ++ if (parport_register_driver(&tipar_driver)) { + printk(KERN_ERR "tipar: unable to register with parport\n"); + err = -EIO; + goto out_class; + +-- + +From greg@quad.kroah.org Thu Apr 27 17:13:23 2006 +Message-Id: <20060428001323.183224000@quad.kroah.org> +References: <20060428001226.204293000@quad.kroah.org> +User-Agent: quilt/0.44-1 +Date: Thu, 27 Apr 2006 17:12:34 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + torvalds@osdl.org, + akpm@osdl.org, + alan@lxorguk.ukuu.org.uk, + Michael Krufky , + Greg Kroah-Hartman +Subject: [patch 08/24] get_dvb_firmware: download nxt2002 firmware from new driver location +Content-Disposition: inline; filename=get_dvb_firmware-download-nxt2002-firmware-from-new-driver-location.patch +Content-Length: 1403 +Lines: 44 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Michael Krufky + +BBTI has updated their driver, and removed the old one from their website. +This patch updates the get_dvb_firmware script to download the firmware +from the new driver location. + +Signed-off-by: Michael Krufky +Signed-off-by: Greg Kroah-Hartman + + +--- + Documentation/dvb/get_dvb_firmware | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- linux-2.6.16.11.orig/Documentation/dvb/get_dvb_firmware ++++ linux-2.6.16.11/Documentation/dvb/get_dvb_firmware +@@ -240,9 +240,9 @@ sub dibusb { + } + + sub nxt2002 { +- my $sourcefile = "Broadband4PC_4_2_11.zip"; ++ my $sourcefile = "Technisat_DVB-PC_4_4_COMPACT.zip"; + my $url = "http://www.bbti.us/download/windows/$sourcefile"; +- my $hash = "c6d2ea47a8f456d887ada0cfb718ff2a"; ++ my $hash = "476befae8c7c1bb9648954060b1eec1f"; + my $outfile = "dvb-fe-nxt2002.fw"; + my $tmpdir = tempdir(DIR => "/tmp", CLEANUP => 1); + +@@ -250,8 +250,8 @@ sub nxt2002 { + + wgetfile($sourcefile, $url); + unzip($sourcefile, $tmpdir); +- verify("$tmpdir/SkyNETU.sys", $hash); +- extract("$tmpdir/SkyNETU.sys", 375832, 5908, $outfile); ++ verify("$tmpdir/SkyNET.sys", $hash); ++ extract("$tmpdir/SkyNET.sys", 331624, 5908, $outfile); + + $outfile; + } + +-- + +From greg@quad.kroah.org Thu Apr 27 17:13:23 2006 +Message-Id: <20060428001323.317460000@quad.kroah.org> +References: <20060428001226.204293000@quad.kroah.org> +User-Agent: quilt/0.44-1 +Date: Thu, 27 Apr 2006 17:12:35 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + torvalds@osdl.org, + akpm@osdl.org, + alan@lxorguk.ukuu.org.uk, + norbert@tretkowski.de, + Greg Kroah-Hartman +Subject: [patch 09/24] for_each_possible_cpu +Content-Disposition: inline; filename=for_each_possible_cpu.patch +Content-Length: 863 +Lines: 29 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Andrew Morton + +Backport for_each_possible_cpu() into 2.6.16. Fixes the alpha build, and any +future occurrences. + + +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman + +--- + include/linux/cpumask.h | 1 + + 1 file changed, 1 insertion(+) + +--- linux-2.6.16.11.orig/include/linux/cpumask.h ++++ linux-2.6.16.11/include/linux/cpumask.h +@@ -408,6 +408,7 @@ extern cpumask_t cpu_present_map; + }) + + #define for_each_cpu(cpu) for_each_cpu_mask((cpu), cpu_possible_map) ++#define for_each_possible_cpu(cpu) for_each_cpu_mask((cpu), cpu_possible_map) + #define for_each_online_cpu(cpu) for_each_cpu_mask((cpu), cpu_online_map) + #define for_each_present_cpu(cpu) for_each_cpu_mask((cpu), cpu_present_map) + + +-- + +From greg@quad.kroah.org Thu Apr 27 17:13:23 2006 +Message-Id: <20060428001323.459743000@quad.kroah.org> +References: <20060428001226.204293000@quad.kroah.org> +User-Agent: quilt/0.44-1 +Date: Thu, 27 Apr 2006 17:12:36 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + torvalds@osdl.org, + akpm@osdl.org, + alan@lxorguk.ukuu.org.uk, + Jose Alberto Reguero , + Mauro Carvalho Chehab , + Hans Verkuil , + Michael Krufky , + Greg Kroah-Hartman +Subject: [patch 10/24] fix saa7129 support in saa7127 module for pvr350 tv out +Content-Disposition: inline; filename=fix-saa7129-support-in-saa7127-module-for-pvr350-tv-out.patch +Content-Length: 1013 +Lines: 32 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Jose Alberto Reguero + +This patch fixes tv-out support for the newer model of +the pvr350, which has a saa7129 instead of a saa7127 +video encoder. + +Signed-off-by: Jose Alberto Reguero +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Hans Verkuil +Signed-off-by: Michael Krufky +Signed-off-by: Greg Kroah-Hartman + + +--- + drivers/media/video/saa7127.c | 1 + + 1 file changed, 1 insertion(+) + +--- linux-2.6.16.11.orig/drivers/media/video/saa7127.c ++++ linux-2.6.16.11/drivers/media/video/saa7127.c +@@ -141,6 +141,7 @@ struct i2c_reg_value { + static const struct i2c_reg_value saa7129_init_config_extra[] = { + { SAA7127_REG_OUTPUT_PORT_CONTROL, 0x38 }, + { SAA7127_REG_VTRIG, 0xfa }, ++ { 0, 0 } + }; + + static const struct i2c_reg_value saa7127_init_config_common[] = { + +-- + +From greg@quad.kroah.org Thu Apr 27 17:13:23 2006 +Message-Id: <20060428001323.610742000@quad.kroah.org> +References: <20060428001226.204293000@quad.kroah.org> +User-Agent: quilt/0.44-1 +Date: Thu, 27 Apr 2006 17:12:37 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + torvalds@osdl.org, + akpm@osdl.org, + alan@lxorguk.ukuu.org.uk, + Michael Krufky , + Greg Kroah-Hartman +Subject: [patch 11/24] cxusb-bluebird: bug-fix: power down corrupts frontend +Content-Disposition: inline; filename=cxusb-bluebird-bug-fix-power-down-corrupts-frontend.patch +Content-Length: 2736 +Lines: 77 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Michael Krufky + +This patch prevents a bug where the frontend is unable to tune after waking +from powered down state. Now, the device remains powered on until it is +disconnected, just like the windows driver. It seems that the bluebird +firmware is unable to successfully handle tuning after a powered down state. + +This patch fixes all of the FusionHDTV Bluebird USB2 devices. The Medion +MD95700 will still behave as before, since it was unaffected by this bug. + +Signed-off-by: Michael Krufky +Signed-off-by: Greg Kroah-Hartman + + +--- + drivers/media/dvb/dvb-usb/cxusb.c | 17 +++++++++++++---- + 1 file changed, 13 insertions(+), 4 deletions(-) + +--- linux-2.6.16.11.orig/drivers/media/dvb/dvb-usb/cxusb.c ++++ linux-2.6.16.11/drivers/media/dvb/dvb-usb/cxusb.c +@@ -149,6 +149,15 @@ static int cxusb_power_ctrl(struct dvb_u + return cxusb_ctrl_msg(d, CMD_POWER_OFF, &b, 1, NULL, 0); + } + ++static int cxusb_bluebird_power_ctrl(struct dvb_usb_device *d, int onoff) ++{ ++ u8 b = 0; ++ if (onoff) ++ return cxusb_ctrl_msg(d, CMD_POWER_ON, &b, 1, NULL, 0); ++ else ++ return 0; ++} ++ + static int cxusb_streaming_ctrl(struct dvb_usb_device *d, int onoff) + { + u8 buf[2] = { 0x03, 0x00 }; +@@ -505,7 +514,7 @@ static struct dvb_usb_properties cxusb_b + .size_of_priv = sizeof(struct cxusb_state), + + .streaming_ctrl = cxusb_streaming_ctrl, +- .power_ctrl = cxusb_power_ctrl, ++ .power_ctrl = cxusb_bluebird_power_ctrl, + .frontend_attach = cxusb_lgdt3303_frontend_attach, + .tuner_attach = cxusb_lgh064f_tuner_attach, + +@@ -545,7 +554,7 @@ static struct dvb_usb_properties cxusb_b + .size_of_priv = sizeof(struct cxusb_state), + + .streaming_ctrl = cxusb_streaming_ctrl, +- .power_ctrl = cxusb_power_ctrl, ++ .power_ctrl = cxusb_bluebird_power_ctrl, + .frontend_attach = cxusb_dee1601_frontend_attach, + .tuner_attach = cxusb_dee1601_tuner_attach, + +@@ -594,7 +603,7 @@ static struct dvb_usb_properties cxusb_b + .size_of_priv = sizeof(struct cxusb_state), + + .streaming_ctrl = cxusb_streaming_ctrl, +- .power_ctrl = cxusb_power_ctrl, ++ .power_ctrl = cxusb_bluebird_power_ctrl, + .frontend_attach = cxusb_mt352_frontend_attach, + .tuner_attach = cxusb_lgz201_tuner_attach, + +@@ -634,7 +643,7 @@ static struct dvb_usb_properties cxusb_b + .size_of_priv = sizeof(struct cxusb_state), + + .streaming_ctrl = cxusb_streaming_ctrl, +- .power_ctrl = cxusb_power_ctrl, ++ .power_ctrl = cxusb_bluebird_power_ctrl, + .frontend_attach = cxusb_mt352_frontend_attach, + .tuner_attach = cxusb_dtt7579_tuner_attach, + + +-- + +From greg@quad.kroah.org Thu Apr 27 17:13:23 2006 +Message-Id: <20060428001323.749218000@quad.kroah.org> +References: <20060428001226.204293000@quad.kroah.org> +User-Agent: quilt/0.44-1 +Date: Thu, 27 Apr 2006 17:12:38 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + torvalds@osdl.org, + akpm@osdl.org, + alan@lxorguk.ukuu.org.uk, + Alasdair G Kergon , + Greg Kroah-Hartman +Subject: [patch 12/24] dm snapshot: fix kcopyd destructor +Content-Disposition: inline; filename=dm-snapshot-fix-kcopyd-destructor.patch +Content-Length: 3140 +Lines: 111 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Alasdair G Kergon + +Before removing a snapshot, wait for the completion of any kcopyd jobs using +it. + +Do this by maintaining a count (nr_jobs) of how many outstanding jobs each +kcopyd_client has. + +The snapshot destructor first unregisters the snapshot so that no new kcopyd +jobs (created by writes to the origin) will reference that particular +snapshot. kcopyd_client_destroy() is now run next to wait for the completion +of any outstanding jobs before the snapshot exception structures (that those +jobs reference) are freed. + +Signed-off-by: Alasdair G Kergon +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/dm-snap.c | 6 +++++- + drivers/md/kcopyd.c | 17 ++++++++++++++++- + 2 files changed, 21 insertions(+), 2 deletions(-) + +--- linux-2.6.16.11.orig/drivers/md/dm-snap.c ++++ linux-2.6.16.11/drivers/md/dm-snap.c +@@ -542,8 +542,12 @@ static void snapshot_dtr(struct dm_targe + { + struct dm_snapshot *s = (struct dm_snapshot *) ti->private; + ++ /* Prevent further origin writes from using this snapshot. */ ++ /* After this returns there can be no new kcopyd jobs. */ + unregister_snapshot(s); + ++ kcopyd_client_destroy(s->kcopyd_client); ++ + exit_exception_table(&s->pending, pending_cache); + exit_exception_table(&s->complete, exception_cache); + +@@ -552,7 +556,7 @@ static void snapshot_dtr(struct dm_targe + + dm_put_device(ti, s->origin); + dm_put_device(ti, s->cow); +- kcopyd_client_destroy(s->kcopyd_client); ++ + kfree(s); + } + +--- linux-2.6.16.11.orig/drivers/md/kcopyd.c ++++ linux-2.6.16.11/drivers/md/kcopyd.c +@@ -44,6 +44,9 @@ struct kcopyd_client { + struct page_list *pages; + unsigned int nr_pages; + unsigned int nr_free_pages; ++ ++ wait_queue_head_t destroyq; ++ atomic_t nr_jobs; + }; + + static struct page_list *alloc_pl(void) +@@ -293,10 +296,15 @@ static int run_complete_job(struct kcopy + int read_err = job->read_err; + unsigned int write_err = job->write_err; + kcopyd_notify_fn fn = job->fn; ++ struct kcopyd_client *kc = job->kc; + +- kcopyd_put_pages(job->kc, job->pages); ++ kcopyd_put_pages(kc, job->pages); + mempool_free(job, _job_pool); + fn(read_err, write_err, context); ++ ++ if (atomic_dec_and_test(&kc->nr_jobs)) ++ wake_up(&kc->destroyq); ++ + return 0; + } + +@@ -431,6 +439,7 @@ static void do_work(void *ignored) + */ + static void dispatch_job(struct kcopyd_job *job) + { ++ atomic_inc(&job->kc->nr_jobs); + push(&_pages_jobs, job); + wake(); + } +@@ -670,6 +679,9 @@ int kcopyd_client_create(unsigned int nr + return r; + } + ++ init_waitqueue_head(&kc->destroyq); ++ atomic_set(&kc->nr_jobs, 0); ++ + client_add(kc); + *result = kc; + return 0; +@@ -677,6 +689,9 @@ int kcopyd_client_create(unsigned int nr + + void kcopyd_client_destroy(struct kcopyd_client *kc) + { ++ /* Wait for completion of all jobs submitted by this client. */ ++ wait_event(kc->destroyq, !atomic_read(&kc->nr_jobs)); ++ + dm_io_put(kc->nr_pages); + client_free_pages(kc); + client_del(kc); + +-- + +From greg@quad.kroah.org Thu Apr 27 17:13:24 2006 +Message-Id: <20060428001323.890281000@quad.kroah.org> +References: <20060428001226.204293000@quad.kroah.org> +User-Agent: quilt/0.44-1 +Date: Thu, 27 Apr 2006 17:12:39 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + torvalds@osdl.org, + akpm@osdl.org, + alan@lxorguk.ukuu.org.uk, + Junichi Nomura , + Alasdair G Kergon , + Greg Kroah-Hartman +Subject: [patch 13/24] dm flush queue EINTR +Content-Disposition: inline; filename=dm-flush-queue-EINTR.patch +Content-Length: 1248 +Lines: 41 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +If dm_suspend() is cancelled, bios already added to the deferred list need to +be submitted. Otherwise they remain 'in limbo' until there's a dm_resume(). + +Signed-off-by: Jun'ichi Nomura +Signed-off-by: Alasdair G Kergon +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/dm.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- linux-2.6.16.11.orig/drivers/md/dm.c ++++ linux-2.6.16.11/drivers/md/dm.c +@@ -1098,6 +1098,7 @@ int dm_suspend(struct mapped_device *md, + { + struct dm_table *map = NULL; + DECLARE_WAITQUEUE(wait, current); ++ struct bio *def; + int r = -EINVAL; + + down(&md->suspend_lock); +@@ -1157,9 +1158,11 @@ int dm_suspend(struct mapped_device *md, + /* were we interrupted ? */ + r = -EINTR; + if (atomic_read(&md->pending)) { ++ clear_bit(DMF_BLOCK_IO, &md->flags); ++ def = bio_list_get(&md->deferred); ++ __flush_deferred_io(md, def); + up_write(&md->io_lock); + unlock_fs(md); +- clear_bit(DMF_BLOCK_IO, &md->flags); + goto out; + } + up_write(&md->io_lock); + +-- + +From greg@quad.kroah.org Thu Apr 27 17:13:24 2006 +Message-Id: <20060428001324.028668000@quad.kroah.org> +References: <20060428001226.204293000@quad.kroah.org> +User-Agent: quilt/0.44-1 +Date: Thu, 27 Apr 2006 17:12:40 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + torvalds@osdl.org, + akpm@osdl.org, + alan@lxorguk.ukuu.org.uk, + Joe Korty , + Greg Kroah-Hartman +Subject: [patch 14/24] Simplify proc/devices and fix early termination regression +Content-Disposition: inline; filename=simplify-proc-devices-and-fix-early-termination-regression.patch +Content-Length: 13788 +Lines: 537 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ + +Repair /proc/devices early-termination regression. + +2.6.16 broke /proc/devices. An application often gets an +EOF before the end of data is reached, if that application +uses a series of short read(2)s to access the data. I have +used read buffers of varying sizes with varying degrees +of unsuccess (larger sizes get further into the data than +smaller sizes, following a simple pattern). It appears +that the only safe way to get the data is to use a single +read buffer larger than all the data in /proc/devices. + +The following example demonstates the problem: + + # dd if=/proc/devices bs=1 + Character devices: + 1 mem + 27+0 records in + 27+0 records out + +This patch is a backport of the fix recently accepted to +Linus's tree: + + commit 68eef3b4791572ecb70249c7fb145bb3742dd899 + [PATCH] Simplify proc/devices and fix early termination regression + +It replaces the complex, state-machine algorithm introduced +in 2.6.16 with a simple algorithm, modeled on the implementation +of /proc/interrupts. + +[akpm@osdl.org: cleanups, simplifications] + +Signed-off-by: Joe Korty +Signed-off-by: Greg Kroah-Hartman + + +--- + block/genhd.c | 103 +++------------------------------ + fs/char_dev.c | 87 +++------------------------- + fs/proc/proc_misc.c | 161 +++++++++++----------------------------------------- + include/linux/fs.h | 15 +--- + 4 files changed, 61 insertions(+), 305 deletions(-) + +--- linux-2.6.16.11.orig/block/genhd.c ++++ linux-2.6.16.11/block/genhd.c +@@ -16,8 +16,6 @@ + #include + #include + +-#define MAX_PROBE_HASH 255 /* random */ +- + static struct subsystem block_subsys; + + static DECLARE_MUTEX(block_subsys_sem); +@@ -30,108 +28,29 @@ static struct blk_major_name { + struct blk_major_name *next; + int major; + char name[16]; +-} *major_names[MAX_PROBE_HASH]; ++} *major_names[BLKDEV_MAJOR_HASH_SIZE]; + + /* index in the above - for now: assume no multimajor ranges */ + static inline int major_to_index(int major) + { +- return major % MAX_PROBE_HASH; +-} +- +-struct blkdev_info { +- int index; +- struct blk_major_name *bd; +-}; +- +-/* +- * iterate over a list of blkdev_info structures. allows +- * the major_names array to be iterated over from outside this file +- * must be called with the block_subsys_sem held +- */ +-void *get_next_blkdev(void *dev) +-{ +- struct blkdev_info *info; +- +- if (dev == NULL) { +- info = kmalloc(sizeof(*info), GFP_KERNEL); +- if (!info) +- goto out; +- info->index=0; +- info->bd = major_names[info->index]; +- if (info->bd) +- goto out; +- } else { +- info = dev; +- } +- +- while (info->index < ARRAY_SIZE(major_names)) { +- if (info->bd) +- info->bd = info->bd->next; +- if (info->bd) +- goto out; +- /* +- * No devices on this chain, move to the next +- */ +- info->index++; +- info->bd = (info->index < ARRAY_SIZE(major_names)) ? +- major_names[info->index] : NULL; +- if (info->bd) +- goto out; +- } +- +-out: +- return info; +-} +- +-void *acquire_blkdev_list(void) +-{ +- down(&block_subsys_sem); +- return get_next_blkdev(NULL); +-} +- +-void release_blkdev_list(void *dev) +-{ +- up(&block_subsys_sem); +- kfree(dev); ++ return major % BLKDEV_MAJOR_HASH_SIZE; + } + ++#ifdef CONFIG_PROC_FS + +-/* +- * Count the number of records in the blkdev_list. +- * must be called with the block_subsys_sem held +- */ +-int count_blkdev_list(void) ++void blkdev_show(struct seq_file *f, off_t offset) + { +- struct blk_major_name *n; +- int i, count; +- +- count = 0; ++ struct blk_major_name *dp; + +- for (i = 0; i < ARRAY_SIZE(major_names); i++) { +- for (n = major_names[i]; n; n = n->next) +- count++; ++ if (offset < BLKDEV_MAJOR_HASH_SIZE) { ++ down(&block_subsys_sem); ++ for (dp = major_names[offset]; dp; dp = dp->next) ++ seq_printf(f, "%3d %s\n", dp->major, dp->name); ++ up(&block_subsys_sem); + } +- +- return count; +-} +- +-/* +- * extract the major and name values from a blkdev_info struct +- * passed in as a void to *dev. Must be called with +- * block_subsys_sem held +- */ +-int get_blkdev_info(void *dev, int *major, char **name) +-{ +- struct blkdev_info *info = dev; +- +- if (info->bd == NULL) +- return 1; +- +- *major = info->bd->major; +- *name = info->bd->name; +- return 0; + } + ++#endif /* CONFIG_PROC_FS */ + + int register_blkdev(unsigned int major, const char *name) + { +--- linux-2.6.16.11.orig/fs/char_dev.c ++++ linux-2.6.16.11/fs/char_dev.c +@@ -15,6 +15,7 @@ + #include + #include + #include ++#include + + #include + #include +@@ -26,8 +27,6 @@ + + static struct kobj_map *cdev_map; + +-#define MAX_PROBE_HASH 255 /* random */ +- + static DECLARE_MUTEX(chrdevs_lock); + + static struct char_device_struct { +@@ -38,93 +37,29 @@ static struct char_device_struct { + char name[64]; + struct file_operations *fops; + struct cdev *cdev; /* will die */ +-} *chrdevs[MAX_PROBE_HASH]; ++} *chrdevs[CHRDEV_MAJOR_HASH_SIZE]; + + /* index in the above */ + static inline int major_to_index(int major) + { +- return major % MAX_PROBE_HASH; +-} +- +-struct chrdev_info { +- int index; +- struct char_device_struct *cd; +-}; +- +-void *get_next_chrdev(void *dev) +-{ +- struct chrdev_info *info; +- +- if (dev == NULL) { +- info = kmalloc(sizeof(*info), GFP_KERNEL); +- if (!info) +- goto out; +- info->index=0; +- info->cd = chrdevs[info->index]; +- if (info->cd) +- goto out; +- } else { +- info = dev; +- } +- +- while (info->index < ARRAY_SIZE(chrdevs)) { +- if (info->cd) +- info->cd = info->cd->next; +- if (info->cd) +- goto out; +- /* +- * No devices on this chain, move to the next +- */ +- info->index++; +- info->cd = (info->index < ARRAY_SIZE(chrdevs)) ? +- chrdevs[info->index] : NULL; +- if (info->cd) +- goto out; +- } +- +-out: +- return info; +-} +- +-void *acquire_chrdev_list(void) +-{ +- down(&chrdevs_lock); +- return get_next_chrdev(NULL); +-} +- +-void release_chrdev_list(void *dev) +-{ +- up(&chrdevs_lock); +- kfree(dev); ++ return major % CHRDEV_MAJOR_HASH_SIZE; + } + ++#ifdef CONFIG_PROC_FS + +-int count_chrdev_list(void) ++void chrdev_show(struct seq_file *f, off_t offset) + { + struct char_device_struct *cd; +- int i, count; +- +- count = 0; + +- for (i = 0; i < ARRAY_SIZE(chrdevs) ; i++) { +- for (cd = chrdevs[i]; cd; cd = cd->next) +- count++; ++ if (offset < CHRDEV_MAJOR_HASH_SIZE) { ++ down(&chrdevs_lock); ++ for (cd = chrdevs[offset]; cd; cd = cd->next) ++ seq_printf(f, "%3d %s\n", cd->major, cd->name); ++ up(&chrdevs_lock); + } +- +- return count; + } + +-int get_chrdev_info(void *dev, int *major, char **name) +-{ +- struct chrdev_info *info = dev; +- +- if (info->cd == NULL) +- return 1; +- +- *major = info->cd->major; +- *name = info->cd->name; +- return 0; +-} ++#endif /* CONFIG_PROC_FS */ + + /* + * Register a single major with a specified minor range. +--- linux-2.6.16.11.orig/fs/proc/proc_misc.c ++++ linux-2.6.16.11/fs/proc/proc_misc.c +@@ -249,144 +249,60 @@ static int cpuinfo_open(struct inode *in + return seq_open(file, &cpuinfo_op); + } + +-enum devinfo_states { +- CHR_HDR, +- CHR_LIST, +- BLK_HDR, +- BLK_LIST, +- DEVINFO_DONE +-}; +- +-struct devinfo_state { +- void *chrdev; +- void *blkdev; +- unsigned int num_records; +- unsigned int cur_record; +- enum devinfo_states state; ++static struct file_operations proc_cpuinfo_operations = { ++ .open = cpuinfo_open, ++ .read = seq_read, ++ .llseek = seq_lseek, ++ .release = seq_release, + }; + +-static void *devinfo_start(struct seq_file *f, loff_t *pos) ++static int devinfo_show(struct seq_file *f, void *v) + { +- struct devinfo_state *info = f->private; ++ int i = *(loff_t *) v; + +- if (*pos) { +- if ((info) && (*pos <= info->num_records)) +- return info; +- return NULL; ++ if (i < CHRDEV_MAJOR_HASH_SIZE) { ++ if (i == 0) ++ seq_printf(f, "Character devices:\n"); ++ chrdev_show(f, i); ++ } else { ++ i -= CHRDEV_MAJOR_HASH_SIZE; ++ if (i == 0) ++ seq_printf(f, "\nBlock devices:\n"); ++ blkdev_show(f, i); + } +- info = kmalloc(sizeof(*info), GFP_KERNEL); +- f->private = info; +- info->chrdev = acquire_chrdev_list(); +- info->blkdev = acquire_blkdev_list(); +- info->state = CHR_HDR; +- info->num_records = count_chrdev_list(); +- info->num_records += count_blkdev_list(); +- info->num_records += 2; /* Character and Block headers */ +- *pos = 1; +- info->cur_record = *pos; +- return info; ++ return 0; + } + +-static void *devinfo_next(struct seq_file *f, void *v, loff_t *pos) ++static void *devinfo_start(struct seq_file *f, loff_t *pos) + { +- int idummy; +- char *ndummy; +- struct devinfo_state *info = f->private; +- +- switch (info->state) { +- case CHR_HDR: +- info->state = CHR_LIST; +- (*pos)++; +- /*fallthrough*/ +- case CHR_LIST: +- if (get_chrdev_info(info->chrdev,&idummy,&ndummy)) { +- /* +- * The character dev list is complete +- */ +- info->state = BLK_HDR; +- } else { +- info->chrdev = get_next_chrdev(info->chrdev); +- } +- (*pos)++; +- break; +- case BLK_HDR: +- info->state = BLK_LIST; +- (*pos)++; +- /*fallthrough*/ +- case BLK_LIST: +- if (get_blkdev_info(info->blkdev,&idummy,&ndummy)) { +- /* +- * The block dev list is complete +- */ +- info->state = DEVINFO_DONE; +- } else { +- info->blkdev = get_next_blkdev(info->blkdev); +- } +- (*pos)++; +- break; +- case DEVINFO_DONE: +- (*pos)++; +- info->cur_record = *pos; +- info = NULL; +- break; +- default: +- break; +- } +- if (info) +- info->cur_record = *pos; +- return info; ++ if (*pos < (BLKDEV_MAJOR_HASH_SIZE + CHRDEV_MAJOR_HASH_SIZE)) ++ return pos; ++ return NULL; + } + +-static void devinfo_stop(struct seq_file *f, void *v) ++static void *devinfo_next(struct seq_file *f, void *v, loff_t *pos) + { +- struct devinfo_state *info = f->private; +- +- if (info) { +- release_chrdev_list(info->chrdev); +- release_blkdev_list(info->blkdev); +- f->private = NULL; +- kfree(info); +- } ++ (*pos)++; ++ if (*pos >= (BLKDEV_MAJOR_HASH_SIZE + CHRDEV_MAJOR_HASH_SIZE)) ++ return NULL; ++ return pos; + } + +-static int devinfo_show(struct seq_file *f, void *arg) ++static void devinfo_stop(struct seq_file *f, void *v) + { +- int major; +- char *name; +- struct devinfo_state *info = f->private; +- +- switch(info->state) { +- case CHR_HDR: +- seq_printf(f,"Character devices:\n"); +- /* fallthrough */ +- case CHR_LIST: +- if (!get_chrdev_info(info->chrdev,&major,&name)) +- seq_printf(f,"%3d %s\n",major,name); +- break; +- case BLK_HDR: +- seq_printf(f,"\nBlock devices:\n"); +- /* fallthrough */ +- case BLK_LIST: +- if (!get_blkdev_info(info->blkdev,&major,&name)) +- seq_printf(f,"%3d %s\n",major,name); +- break; +- default: +- break; +- } +- +- return 0; ++ /* Nothing to do */ + } + +-static struct seq_operations devinfo_op = { +- .start = devinfo_start, +- .next = devinfo_next, +- .stop = devinfo_stop, +- .show = devinfo_show, ++static struct seq_operations devinfo_ops = { ++ .start = devinfo_start, ++ .next = devinfo_next, ++ .stop = devinfo_stop, ++ .show = devinfo_show + }; + +-static int devinfo_open(struct inode *inode, struct file *file) ++static int devinfo_open(struct inode *inode, struct file *filp) + { +- return seq_open(file, &devinfo_op); ++ return seq_open(filp, &devinfo_ops); + } + + static struct file_operations proc_devinfo_operations = { +@@ -396,13 +312,6 @@ static struct file_operations proc_devin + .release = seq_release, + }; + +-static struct file_operations proc_cpuinfo_operations = { +- .open = cpuinfo_open, +- .read = seq_read, +- .llseek = seq_lseek, +- .release = seq_release, +-}; +- + extern struct seq_operations vmstat_op; + static int vmstat_open(struct inode *inode, struct file *file) + { +--- linux-2.6.16.11.orig/include/linux/fs.h ++++ linux-2.6.16.11/include/linux/fs.h +@@ -1383,6 +1383,7 @@ extern int bd_claim(struct block_device + extern void bd_release(struct block_device *); + + /* fs/char_dev.c */ ++#define CHRDEV_MAJOR_HASH_SIZE 255 + extern int alloc_chrdev_region(dev_t *, unsigned, unsigned, const char *); + extern int register_chrdev_region(dev_t, unsigned, const char *); + extern int register_chrdev(unsigned int, const char *, +@@ -1390,25 +1391,17 @@ extern int register_chrdev(unsigned int, + extern int unregister_chrdev(unsigned int, const char *); + extern void unregister_chrdev_region(dev_t, unsigned); + extern int chrdev_open(struct inode *, struct file *); +-extern int get_chrdev_list(char *); +-extern void *acquire_chrdev_list(void); +-extern int count_chrdev_list(void); +-extern void *get_next_chrdev(void *); +-extern int get_chrdev_info(void *, int *, char **); +-extern void release_chrdev_list(void *); ++extern void chrdev_show(struct seq_file *,off_t); + + /* fs/block_dev.c */ ++#define BLKDEV_MAJOR_HASH_SIZE 255 + #define BDEVNAME_SIZE 32 /* Largest string for a blockdev identifier */ + extern const char *__bdevname(dev_t, char *buffer); + extern const char *bdevname(struct block_device *bdev, char *buffer); + extern struct block_device *lookup_bdev(const char *); + extern struct block_device *open_bdev_excl(const char *, int, void *); + extern void close_bdev_excl(struct block_device *); +-extern void *acquire_blkdev_list(void); +-extern int count_blkdev_list(void); +-extern void *get_next_blkdev(void *); +-extern int get_blkdev_info(void *, int *, char **); +-extern void release_blkdev_list(void *); ++extern void blkdev_show(struct seq_file *,off_t); + + extern void init_special_inode(struct inode *, umode_t, dev_t); + + +-- + +From greg@quad.kroah.org Thu Apr 27 17:13:24 2006 +Message-Id: <20060428001324.174508000@quad.kroah.org> +References: <20060428001226.204293000@quad.kroah.org> +User-Agent: quilt/0.44-1 +Date: Thu, 27 Apr 2006 17:12:41 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + git-commits-head@vger.kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + torvalds@osdl.org, + akpm@osdl.org, + alan@lxorguk.ukuu.org.uk, + Jan Kara , + , + Greg Kroah-Hartman +Subject: [patch 15/24] Fix reiserfs deadlock +Content-Disposition: inline; filename=fix-reiserfs-deadlock.patch +Content-Length: 1315 +Lines: 40 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Jan Kara + +[PATCH] Fix reiserfs deadlock + +reiserfs_cache_default_acl() should return whether we successfully found +the acl or not. We have to return correct value even if reiserfs_get_acl() +returns error code and not just 0. Otherwise callers such as +reiserfs_mkdir() can unnecessarily lock the xattrs and later functions such +as reiserfs_new_inode() fail to notice that we have already taken the lock +and try to take it again with obvious consequences. + +Signed-off-by: Jan Kara +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + fs/reiserfs/xattr_acl.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- linux-2.6.16.11.orig/fs/reiserfs/xattr_acl.c ++++ linux-2.6.16.11/fs/reiserfs/xattr_acl.c +@@ -408,8 +408,9 @@ int reiserfs_cache_default_acl(struct in + acl = reiserfs_get_acl(inode, ACL_TYPE_DEFAULT); + reiserfs_read_unlock_xattrs(inode->i_sb); + reiserfs_read_unlock_xattr_i(inode); +- ret = acl ? 1 : 0; +- posix_acl_release(acl); ++ ret = (acl && !IS_ERR(acl)); ++ if (ret) ++ posix_acl_release(acl); + } + + return ret; + +-- + +From greg@quad.kroah.org Thu Apr 27 17:13:24 2006 +Message-Id: <20060428001324.314150000@quad.kroah.org> +References: <20060428001226.204293000@quad.kroah.org> +User-Agent: quilt/0.44-1 +Date: Thu, 27 Apr 2006 17:12:42 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + git-commits-head@vger.kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + torvalds@osdl.org, + akpm@osdl.org, + alan@lxorguk.ukuu.org.uk, + Greg Howard , + Greg Kroah-Hartman +Subject: [patch 16/24] Altix snsc: duplicate kobject fix +Content-Disposition: inline; filename=altix-snsc-duplicate-kobject-fix.patch +Content-Length: 1196 +Lines: 35 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Greg Howard + +Fix Altix system controller (snsc) device names to include the slot number +of the blade whose associated system controller is the target of the device +interface. Including the slot number avoids a problem we're currently +having where slots within the same enclosure are attempting to create +multiple kobjects with identical names. + +Signed-off-by: Greg Howard +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/char/snsc.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- linux-2.6.16.11.orig/drivers/char/snsc.c ++++ linux-2.6.16.11/drivers/char/snsc.c +@@ -391,7 +391,8 @@ scdrv_init(void) + format_module_id(devnamep, geo_module(geoid), + MODULE_FORMAT_BRIEF); + devnamep = devname + strlen(devname); +- sprintf(devnamep, "#%d", geo_slab(geoid)); ++ sprintf(devnamep, "^%d#%d", geo_slot(geoid), ++ geo_slab(geoid)); + + /* allocate sysctl device data */ + scd = kmalloc(sizeof (struct sysctl_data_s), + +-- + +From greg@quad.kroah.org Thu Apr 27 17:13:24 2006 +Message-Id: <20060428001324.452969000@quad.kroah.org> +References: <20060428001226.204293000@quad.kroah.org> +User-Agent: quilt/0.44-1 +Date: Thu, 27 Apr 2006 17:12:43 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + git-commits-head@vger.kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + torvalds@osdl.org, + akpm@osdl.org, + alan@lxorguk.ukuu.org.uk, + Ivan Kokshaysky , + Greg Kroah-Hartman +Subject: [patch 17/24] Alpha: strncpy() fix +Content-Disposition: inline; filename=alpha-strncpy-fix.patch +Content-Length: 1236 +Lines: 47 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Ivan Kokshaysky + +[PATCH] Alpha: strncpy() fix + +As it turned out after recent SCSI changes, strncpy() was broken - +it mixed up the return values from __stxncpy() in registers $24 and $27. + +Thanks to Mathieu Chouquet-Stringer for tracking down the problem +and providing an excellent test case. + +Signed-off-by: Ivan Kokshaysky +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + arch/alpha/lib/strncpy.S | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- linux-2.6.16.11.orig/arch/alpha/lib/strncpy.S ++++ linux-2.6.16.11/arch/alpha/lib/strncpy.S +@@ -43,8 +43,8 @@ strncpy: + + .align 4 + $multiword: +- subq $24, 1, $2 # clear the final bits in the prev word +- or $2, $24, $2 ++ subq $27, 1, $2 # clear the final bits in the prev word ++ or $2, $27, $2 + zapnot $1, $2, $1 + subq $18, 1, $18 + +@@ -70,8 +70,8 @@ $multiword: + bne $18, 0b + + 1: ldq_u $1, 0($16) # clear the leading bits in the final word +- subq $27, 1, $2 +- or $2, $27, $2 ++ subq $24, 1, $2 ++ or $2, $24, $2 + + zap $1, $2, $1 + stq_u $1, 0($16) + +-- + +From greg@quad.kroah.org Thu Apr 27 17:13:24 2006 +Message-Id: <20060428001324.594722000@quad.kroah.org> +References: <20060428001226.204293000@quad.kroah.org> +User-Agent: quilt/0.44-1 +Date: Thu, 27 Apr 2006 17:12:44 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + git-commits-head@vger.kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + torvalds@osdl.org, + akpm@osdl.org, + alan@lxorguk.ukuu.org.uk, + James Morris , + Al Viro , + Greg Kroah-Hartman , + Chris Wright +Subject: [patch 18/24] LSM: add missing hook to do_compat_readv_writev() +Content-Disposition: inline; filename=lsm-add-missing-hook-to-do_compat_readv_writev.patch +Content-Length: 1113 +Lines: 39 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: James Morris + +This patch addresses a flaw in LSM, where there is no mediation of readv() +and writev() in for 32-bit compatible apps using a 64-bit kernel. + +This bug was discovered and fixed initially in the native readv/writev +code [1], but was not fixed in the compat code. Thanks to Al for spotting +this one. + + [1] http://lwn.net/Articles/154282/ + +Signed-off-by: James Morris +Signed-off-by: Al Viro +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Chris Wright + +--- + fs/compat.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- linux-2.6.16.11.orig/fs/compat.c ++++ linux-2.6.16.11/fs/compat.c +@@ -1215,6 +1215,10 @@ static ssize_t compat_do_readv_writev(in + if (ret < 0) + goto out; + ++ ret = security_file_permission(file, type == READ ? MAY_READ:MAY_WRITE); ++ if (ret) ++ goto out; ++ + fnv = NULL; + if (type == READ) { + fn = file->f_op->read; + +-- + +From greg@quad.kroah.org Thu Apr 27 17:13:24 2006 +Message-Id: <20060428001324.738152000@quad.kroah.org> +References: <20060428001226.204293000@quad.kroah.org> +User-Agent: quilt/0.44-1 +Date: Thu, 27 Apr 2006 17:12:45 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + git-commits-head@vger.kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + torvalds@osdl.org, + akpm@osdl.org, + alan@lxorguk.ukuu.org.uk, + Zachary Amsden , + Greg Kroah-Hartman +Subject: [patch 19/24] x86/PAE: Fix pte_clear for the >4GB RAM case +Content-Disposition: inline; filename=x86-pae-fix-pte_clear-for-the-4gb-ram-case.patch +Content-Length: 5572 +Lines: 130 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Zachary Amsden + +[PATCH] x86/PAE: Fix pte_clear for the >4GB RAM case + +Proposed fix for ptep_get_and_clear_full PAE bug. Pte_clear had the same bug, +so use the same fix for both. Turns out pmd_clear had it as well, but pgds +are not affected. + +The problem is rather intricate. Page table entries in PAE mode are 64-bits +wide, but the only atomic 8-byte write operation available in 32-bit mode is +cmpxchg8b, which is expensive (at least on P4), and thus avoided. But it can +happen that the processor may prefetch entries into the TLB in the middle of an +operation which clears a page table entry. So one must always clear the P-bit +in the low word of the page table entry first when clearing it. + +Since the sequence *ptep = __pte(0) leaves the order of the write dependent on +the compiler, it must be coded explicitly as a clear of the low word followed +by a clear of the high word. Further, there must be a write memory barrier +here to enforce proper ordering by the compiler (and, in the future, by the +processor as well). + +On > 4GB memory machines, the implementation of pte_clear for PAE was clearly +deficient, as it could leave virtual mappings of physical memory above 4GB +aliased to memory below 4GB in the TLB. The implementation of +ptep_get_and_clear_full has a similar bug, although not nearly as likely to +occur, since the mappings being cleared are in the process of being destroyed, +and should never be dereferenced again. + +But, as luck would have it, it is possible to trigger bugs even without ever +dereferencing these bogus TLB mappings, even if the clear is followed fairly +soon after with a TLB flush or invalidation. The problem is that memory above +4GB may now be aliased into the first 4GB of memory, and in fact, may hit a +region of memory with non-memory semantics. These regions include AGP and PCI +space. As such, these memory regions are not cached by the processor. This +introduces the bug. + +The processor can speculate memory operations, including memory writes, as long +as they are committed with the proper ordering. Speculating a memory write to +a linear address that has a bogus TLB mapping is possible. Normally, the +speculation is harmless. But for cached memory, it does leave the falsely +speculated cacheline unmodified, but in a dirty state. This cache line will be +eventually written back. If this cacheline happens to intersect a region of +memory that is not protected by the cache coherency protocol, it can corrupt +data in I/O memory, which is generally a very bad thing to do, and can cause +total system failure or just plain undefined behavior. + +These bugs are extremely unlikely, but the severity is of such magnitude, and +the fix so simple that I think fixing them immediately is justified. Also, +they are nearly impossible to debug. + +Signed-off-by: Zachary Amsden +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + include/asm-i386/pgtable-2level.h | 3 +++ + include/asm-i386/pgtable-3level.h | 20 ++++++++++++++++++++ + include/asm-i386/pgtable.h | 4 +--- + 3 files changed, 24 insertions(+), 3 deletions(-) + +--- linux-2.6.16.11.orig/include/asm-i386/pgtable-2level.h ++++ linux-2.6.16.11/include/asm-i386/pgtable-2level.h +@@ -18,6 +18,9 @@ + #define set_pte_atomic(pteptr, pteval) set_pte(pteptr,pteval) + #define set_pmd(pmdptr, pmdval) (*(pmdptr) = (pmdval)) + ++#define pte_clear(mm,addr,xp) do { set_pte_at(mm, addr, xp, __pte(0)); } while (0) ++#define pmd_clear(xp) do { set_pmd(xp, __pmd(0)); } while (0) ++ + #define ptep_get_and_clear(mm,addr,xp) __pte(xchg(&(xp)->pte_low, 0)) + #define pte_same(a, b) ((a).pte_low == (b).pte_low) + #define pte_page(x) pfn_to_page(pte_pfn(x)) +--- linux-2.6.16.11.orig/include/asm-i386/pgtable-3level.h ++++ linux-2.6.16.11/include/asm-i386/pgtable-3level.h +@@ -85,6 +85,26 @@ static inline void pud_clear (pud_t * pu + #define pmd_offset(pud, address) ((pmd_t *) pud_page(*(pud)) + \ + pmd_index(address)) + ++/* ++ * For PTEs and PDEs, we must clear the P-bit first when clearing a page table ++ * entry, so clear the bottom half first and enforce ordering with a compiler ++ * barrier. ++ */ ++static inline void pte_clear(struct mm_struct *mm, unsigned long addr, pte_t *ptep) ++{ ++ ptep->pte_low = 0; ++ smp_wmb(); ++ ptep->pte_high = 0; ++} ++ ++static inline void pmd_clear(pmd_t *pmd) ++{ ++ u32 *tmp = (u32 *)pmd; ++ *tmp = 0; ++ smp_wmb(); ++ *(tmp + 1) = 0; ++} ++ + static inline pte_t ptep_get_and_clear(struct mm_struct *mm, unsigned long addr, pte_t *ptep) + { + pte_t res; +--- linux-2.6.16.11.orig/include/asm-i386/pgtable.h ++++ linux-2.6.16.11/include/asm-i386/pgtable.h +@@ -204,12 +204,10 @@ extern unsigned long long __PAGE_KERNEL, + extern unsigned long pg0[]; + + #define pte_present(x) ((x).pte_low & (_PAGE_PRESENT | _PAGE_PROTNONE)) +-#define pte_clear(mm,addr,xp) do { set_pte_at(mm, addr, xp, __pte(0)); } while (0) + + /* To avoid harmful races, pmd_none(x) should check only the lower when PAE */ + #define pmd_none(x) (!(unsigned long)pmd_val(x)) + #define pmd_present(x) (pmd_val(x) & _PAGE_PRESENT) +-#define pmd_clear(xp) do { set_pmd(xp, __pmd(0)); } while (0) + #define pmd_bad(x) ((pmd_val(x) & (~PAGE_MASK & ~_PAGE_USER)) != _KERNPG_TABLE) + + +@@ -269,7 +267,7 @@ static inline pte_t ptep_get_and_clear_f + pte_t pte; + if (full) { + pte = *ptep; +- *ptep = __pte(0); ++ pte_clear(mm, addr, ptep); + } else { + pte = ptep_get_and_clear(mm, addr, ptep); + } + +-- + +From greg@quad.kroah.org Thu Apr 27 17:13:25 2006 +Message-Id: <20060428001324.879818000@quad.kroah.org> +References: <20060428001226.204293000@quad.kroah.org> +User-Agent: quilt/0.44-1 +Date: Thu, 27 Apr 2006 17:12:46 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + torvalds@osdl.org, + akpm@osdl.org, + alan@lxorguk.ukuu.org.uk, + netdev@vger.kernel.org, + , + , + , + , + , + Auke Kok , + Greg Kroah-Hartman +Subject: [patch 20/24] NET: e1000: Update truesize with the length of the packet for packet split +Content-Disposition: inline; filename=net-e1000-update-truesize-with-the-length-of-the-packet-for-packet-split.patch +Content-Length: 764 +Lines: 28 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ + +Update skb with the real packet size. + + +Signed-off-by: Jesse Brandeburg +Signed-off-by: Auke Kok +Signed-off-by: John Ronciak +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/e1000/e1000_main.c | 1 + + 1 file changed, 1 insertion(+) + +--- linux-2.6.16.11.orig/drivers/net/e1000/e1000_main.c ++++ linux-2.6.16.11/drivers/net/e1000/e1000_main.c +@@ -3851,6 +3851,7 @@ e1000_clean_rx_irq_ps(struct e1000_adapt + skb_shinfo(skb)->nr_frags++; + skb->len += length; + skb->data_len += length; ++ skb->truesize += length; + } + + e1000_rx_checksum(adapter, staterr, + +-- + +From greg@quad.kroah.org Thu Apr 27 17:13:25 2006 +Message-Id: <20060428001325.019060000@quad.kroah.org> +References: <20060428001226.204293000@quad.kroah.org> +User-Agent: quilt/0.44-1 +Date: Thu, 27 Apr 2006 17:12:47 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + torvalds@osdl.org, + akpm@osdl.org, + alan@lxorguk.ukuu.org.uk, + Ralf Baechle , + Greg Kroah-Hartman +Subject: [patch 21/24] MIPS: Use "R" constraint for cache_op. +Content-Disposition: inline; filename=MIPS-0001.patch +Content-Length: 743 +Lines: 26 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +Gcc might emit an absolute address for the the "m" constraint which +gas unfortunately does not permit. + +Signed-off-by: Ralf Baechle +Signed-off-by: Greg Kroah-Hartman + +--- + include/asm-mips/r4kcache.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- linux-2.6.16.11.orig/include/asm-mips/r4kcache.h ++++ linux-2.6.16.11/include/asm-mips/r4kcache.h +@@ -37,7 +37,7 @@ + " cache %0, %1 \n" \ + " .set pop \n" \ + : \ +- : "i" (op), "m" (*(unsigned char *)(addr))) ++ : "i" (op), "R" (*(unsigned char *)(addr))) + + static inline void flush_icache_line_indexed(unsigned long addr) + { + +-- + +From greg@quad.kroah.org Thu Apr 27 17:13:25 2006 +Message-Id: <20060428001325.159252000@quad.kroah.org> +References: <20060428001226.204293000@quad.kroah.org> +User-Agent: quilt/0.44-1 +Date: Thu, 27 Apr 2006 17:12:48 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + torvalds@osdl.org, + akpm@osdl.org, + alan@lxorguk.ukuu.org.uk, + Ralf Baechle , + Greg Kroah-Hartman +Subject: [patch 22/24] MIPS: R2 build fixes for gcc < 3.4. +Content-Disposition: inline; filename=MIPS-0002.patch +Content-Length: 2821 +Lines: 113 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ + +Signed-off-by: Ralf Baechle +Signed-off-by: Greg Kroah-Hartman + +--- + include/asm-mips/bitops.h | 14 ++++++++++++-- + include/asm-mips/byteorder.h | 4 ++++ + include/asm-mips/interrupt.h | 8 ++++++++ + 3 files changed, 24 insertions(+), 2 deletions(-) + +--- linux-2.6.16.11.orig/include/asm-mips/bitops.h ++++ linux-2.6.16.11/include/asm-mips/bitops.h +@@ -654,7 +654,12 @@ static inline unsigned long fls(unsigned + { + #ifdef CONFIG_32BIT + #ifdef CONFIG_CPU_MIPS32 +- __asm__ ("clz %0, %1" : "=r" (word) : "r" (word)); ++ __asm__ ( ++ " .set mips32 \n" ++ " clz %0, %1 \n" ++ " .set mips0 \n" ++ : "=r" (word) ++ : "r" (word)); + + return 32 - word; + #else +@@ -678,7 +683,12 @@ static inline unsigned long fls(unsigned + #ifdef CONFIG_64BIT + #ifdef CONFIG_CPU_MIPS64 + +- __asm__ ("dclz %0, %1" : "=r" (word) : "r" (word)); ++ __asm__ ( ++ " .set mips64 \n" ++ " dclz %0, %1 \n" ++ " .set mips0 \n" ++ : "=r" (word) ++ : "r" (word)); + + return 64 - word; + #else +--- linux-2.6.16.11.orig/include/asm-mips/byteorder.h ++++ linux-2.6.16.11/include/asm-mips/byteorder.h +@@ -19,7 +19,9 @@ + static __inline__ __attribute_const__ __u16 ___arch__swab16(__u16 x) + { + __asm__( ++ " .set mips32r2 \n" + " wsbh %0, %1 \n" ++ " .set mips0 \n" + : "=r" (x) + : "r" (x)); + +@@ -30,8 +32,10 @@ static __inline__ __attribute_const__ __ + static __inline__ __attribute_const__ __u32 ___arch__swab32(__u32 x) + { + __asm__( ++ " .set mips32r2 \n" + " wsbh %0, %1 \n" + " rotr %0, %0, 16 \n" ++ " .set mips0 \n" + : "=r" (x) + : "r" (x)); + +--- linux-2.6.16.11.orig/include/asm-mips/interrupt.h ++++ linux-2.6.16.11/include/asm-mips/interrupt.h +@@ -20,7 +20,9 @@ __asm__ ( + " .set reorder \n" + " .set noat \n" + #ifdef CONFIG_CPU_MIPSR2 ++ " .set mips32r2 \n" + " ei \n" ++ " .set mips0 \n" + #else + " mfc0 $1,$12 \n" + " ori $1,0x1f \n" +@@ -63,7 +65,9 @@ __asm__ ( + " .set push \n" + " .set noat \n" + #ifdef CONFIG_CPU_MIPSR2 ++ " .set mips32r2 \n" + " di \n" ++ " .set mips0 \n" + #else + " mfc0 $1,$12 \n" + " ori $1,0x1f \n" +@@ -103,8 +107,10 @@ __asm__ ( + " .set reorder \n" + " .set noat \n" + #ifdef CONFIG_CPU_MIPSR2 ++ " .set mips32r2 \n" + " di \\result \n" + " andi \\result, 1 \n" ++ " .set mips0 \n" + #else + " mfc0 \\result, $12 \n" + " ori $1, \\result, 0x1f \n" +@@ -133,9 +139,11 @@ __asm__ ( + * Slow, but doesn't suffer from a relativly unlikely race + * condition we're having since days 1. + */ ++ " .set mips32r2 \n" + " beqz \\flags, 1f \n" + " di \n" + " ei \n" ++ " .set mips0 \n" + "1: \n" + #elif defined(CONFIG_CPU_MIPSR2) + /* + +-- + +From greg@quad.kroah.org Thu Apr 27 17:13:25 2006 +Message-Id: <20060428001325.298860000@quad.kroah.org> +References: <20060428001226.204293000@quad.kroah.org> +User-Agent: quilt/0.44-1 +Date: Thu, 27 Apr 2006 17:12:49 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + torvalds@osdl.org, + akpm@osdl.org, + alan@lxorguk.ukuu.org.uk, + Atsushi Nemoto , + Ralf Baechle , + Greg Kroah-Hartman +Subject: [patch 23/24] MIPS: Fix tx49_blast_icache32_page_indexed. +Content-Disposition: inline; filename=MIPS-0003.patch +Content-Length: 1058 +Lines: 30 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Atsushi Nemoto + +Fix the cache index value in tx49_blast_icache32_page_indexed(). +This is damage by de62893bc0725f8b5f0445250577cd7a10b2d8f8 commit. + +Signed-off-by: Atsushi Nemoto +Signed-off-by: Ralf Baechle +Signed-off-by: Greg Kroah-Hartman + +--- + arch/mips/mm/c-r4k.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- linux-2.6.16.11.orig/arch/mips/mm/c-r4k.c ++++ linux-2.6.16.11/arch/mips/mm/c-r4k.c +@@ -154,7 +154,8 @@ static inline void blast_icache32_r4600_ + + static inline void tx49_blast_icache32_page_indexed(unsigned long page) + { +- unsigned long start = page; ++ unsigned long indexmask = current_cpu_data.icache.waysize - 1; ++ unsigned long start = INDEX_BASE + (page & indexmask); + unsigned long end = start + PAGE_SIZE; + unsigned long ws_inc = 1UL << current_cpu_data.icache.waybit; + unsigned long ws_end = current_cpu_data.icache.ways << + +-- + +From greg@quad.kroah.org Thu Apr 27 17:13:25 2006 +Message-Id: <20060428001325.444493000@quad.kroah.org> +References: <20060428001226.204293000@quad.kroah.org> +User-Agent: quilt/0.44-1 +Date: Thu, 27 Apr 2006 17:12:50 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + torvalds@osdl.org, + akpm@osdl.org, + alan@lxorguk.ukuu.org.uk, + Win Treese , + Ralf Baechle , + Greg Kroah-Hartman +Subject: [patch 24/24] MIPS: Fix branch emulation for floating-point exceptions. +Content-Disposition: inline; filename=MIPS-0004.patch +Content-Length: 1095 +Lines: 33 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Win Treese + +In the branch emulation for floating-point exceptions, __compute_return_epc +must determine for bc1f et al which condition code bit to test. This is +based on bits <4:2> of the rt field. The switch statement to distinguish +bc1f et al needs to use only the two low bits of rt, but the old code tests +on the whole rt field. This patch masks off the proper bits. + +Signed-off-by: Win Treese +Signed-off-by: Ralf Baechle +Signed-off-by: Greg Kroah-Hartman + +--- + arch/mips/kernel/branch.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- linux-2.6.16.11.orig/arch/mips/kernel/branch.c ++++ linux-2.6.16.11/arch/mips/kernel/branch.c +@@ -184,7 +184,7 @@ int __compute_return_epc(struct pt_regs + bit = (insn.i_format.rt >> 2); + bit += (bit != 0); + bit += 23; +- switch (insn.i_format.rt) { ++ switch (insn.i_format.rt & 3) { + case 0: /* bc1f */ + case 2: /* bc1fl */ + if (~fcr31 & (1 << bit)) + +-- + diff --git a/queue-2.6.16/series b/review-2.6.16/series similarity index 100% rename from queue-2.6.16/series rename to review-2.6.16/series diff --git a/queue-2.6.16/simplify-proc-devices-and-fix-early-termination-regression.patch b/review-2.6.16/simplify-proc-devices-and-fix-early-termination-regression.patch similarity index 100% rename from queue-2.6.16/simplify-proc-devices-and-fix-early-termination-regression.patch rename to review-2.6.16/simplify-proc-devices-and-fix-early-termination-regression.patch diff --git a/queue-2.6.16/sonypi-correct-detection-of-new-ich7-based-laptops.patch b/review-2.6.16/sonypi-correct-detection-of-new-ich7-based-laptops.patch similarity index 100% rename from queue-2.6.16/sonypi-correct-detection-of-new-ich7-based-laptops.patch rename to review-2.6.16/sonypi-correct-detection-of-new-ich7-based-laptops.patch diff --git a/queue-2.6.16/tipar-oops-fix.patch b/review-2.6.16/tipar-oops-fix.patch similarity index 100% rename from queue-2.6.16/tipar-oops-fix.patch rename to review-2.6.16/tipar-oops-fix.patch diff --git a/queue-2.6.16/usb-fix-array-overrun-in-drivers-usb-serial-option.c.patch b/review-2.6.16/usb-fix-array-overrun-in-drivers-usb-serial-option.c.patch similarity index 100% rename from queue-2.6.16/usb-fix-array-overrun-in-drivers-usb-serial-option.c.patch rename to review-2.6.16/usb-fix-array-overrun-in-drivers-usb-serial-option.c.patch diff --git a/queue-2.6.16/x86-pae-fix-pte_clear-for-the-4gb-ram-case.patch b/review-2.6.16/x86-pae-fix-pte_clear-for-the-4gb-ram-case.patch similarity index 100% rename from queue-2.6.16/x86-pae-fix-pte_clear-for-the-4gb-ram-case.patch rename to review-2.6.16/x86-pae-fix-pte_clear-for-the-4gb-ram-case.patch diff --git a/queue-2.6.16/x86_64-fix-a-race-in-the-free_iommu-path.patch b/review-2.6.16/x86_64-fix-a-race-in-the-free_iommu-path.patch similarity index 100% rename from queue-2.6.16/x86_64-fix-a-race-in-the-free_iommu-path.patch rename to review-2.6.16/x86_64-fix-a-race-in-the-free_iommu-path.patch diff --git a/queue-2.6.16/x86_64-pass-32-to-the-assembler-when-compiling-the-32bit-vsyscall-pages.patch b/review-2.6.16/x86_64-pass-32-to-the-assembler-when-compiling-the-32bit-vsyscall-pages.patch similarity index 100% rename from queue-2.6.16/x86_64-pass-32-to-the-assembler-when-compiling-the-32bit-vsyscall-pages.patch rename to review-2.6.16/x86_64-pass-32-to-the-assembler-when-compiling-the-32bit-vsyscall-pages.patch