From: Greg Kroah-Hartman Date: Sat, 14 Mar 2009 01:32:17 +0000 (-0700) Subject: start 2.6.28.8 review cycle X-Git-Tag: v2.6.28.8~2 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=253eea5bf5e06231ecc8f76bf1f72b16b8ddb57a;p=thirdparty%2Fkernel%2Fstable-queue.git start 2.6.28.8 review cycle --- diff --git a/queue-2.6.28/0001-DVB-s5h1409-Perform-s5h1409-soft-reset-after-tunin.patch b/review-2.6.28/0001-DVB-s5h1409-Perform-s5h1409-soft-reset-after-tunin.patch similarity index 100% rename from queue-2.6.28/0001-DVB-s5h1409-Perform-s5h1409-soft-reset-after-tunin.patch rename to review-2.6.28/0001-DVB-s5h1409-Perform-s5h1409-soft-reset-after-tunin.patch diff --git a/queue-2.6.28/0002-V4L-tda8290-fix-TDA8290-TDA18271-initialization.patch b/review-2.6.28/0002-V4L-tda8290-fix-TDA8290-TDA18271-initialization.patch similarity index 100% rename from queue-2.6.28/0002-V4L-tda8290-fix-TDA8290-TDA18271-initialization.patch rename to review-2.6.28/0002-V4L-tda8290-fix-TDA8290-TDA18271-initialization.patch diff --git a/queue-2.6.28/0003-V4L-saa7127-fix-broken-S-Video-with-saa7129.patch b/review-2.6.28/0003-V4L-saa7127-fix-broken-S-Video-with-saa7129.patch similarity index 100% rename from queue-2.6.28/0003-V4L-saa7127-fix-broken-S-Video-with-saa7129.patch rename to review-2.6.28/0003-V4L-saa7127-fix-broken-S-Video-with-saa7129.patch diff --git a/queue-2.6.28/0004-V4L-ivtv-fix-decoder-crash-regression.patch b/review-2.6.28/0004-V4L-ivtv-fix-decoder-crash-regression.patch similarity index 100% rename from queue-2.6.28/0004-V4L-ivtv-fix-decoder-crash-regression.patch rename to review-2.6.28/0004-V4L-ivtv-fix-decoder-crash-regression.patch diff --git a/queue-2.6.28/8250-fix-boot-hang-with-serial-console-when-using-with-serial-over-lan-port.patch b/review-2.6.28/8250-fix-boot-hang-with-serial-console-when-using-with-serial-over-lan-port.patch similarity index 100% rename from queue-2.6.28/8250-fix-boot-hang-with-serial-console-when-using-with-serial-over-lan-port.patch rename to review-2.6.28/8250-fix-boot-hang-with-serial-console-when-using-with-serial-over-lan-port.patch diff --git a/queue-2.6.28/acer-wmi-fix-regression-in-backlight-detection.patch b/review-2.6.28/acer-wmi-fix-regression-in-backlight-detection.patch similarity index 100% rename from queue-2.6.28/acer-wmi-fix-regression-in-backlight-detection.patch rename to review-2.6.28/acer-wmi-fix-regression-in-backlight-detection.patch diff --git a/queue-2.6.28/acpi-fix-broken-usage-of-acpi_ut_get_node_name.patch b/review-2.6.28/acpi-fix-broken-usage-of-acpi_ut_get_node_name.patch similarity index 100% rename from queue-2.6.28/acpi-fix-broken-usage-of-acpi_ut_get_node_name.patch rename to review-2.6.28/acpi-fix-broken-usage-of-acpi_ut_get_node_name.patch diff --git a/queue-2.6.28/acpi-fix-broken-usage-of-name.ascii.patch b/review-2.6.28/acpi-fix-broken-usage-of-name.ascii.patch similarity index 100% rename from queue-2.6.28/acpi-fix-broken-usage-of-name.ascii.patch rename to review-2.6.28/acpi-fix-broken-usage-of-name.ascii.patch diff --git a/queue-2.6.28/alsa-aw2-do-not-grab-every-saa7146-based-device.patch b/review-2.6.28/alsa-aw2-do-not-grab-every-saa7146-based-device.patch similarity index 100% rename from queue-2.6.28/alsa-aw2-do-not-grab-every-saa7146-based-device.patch rename to review-2.6.28/alsa-aw2-do-not-grab-every-saa7146-based-device.patch diff --git a/queue-2.6.28/alsa-fix-excessive-background-noise-introduced-by-oss-emulation-rate-shrink.patch b/review-2.6.28/alsa-fix-excessive-background-noise-introduced-by-oss-emulation-rate-shrink.patch similarity index 100% rename from queue-2.6.28/alsa-fix-excessive-background-noise-introduced-by-oss-emulation-rate-shrink.patch rename to review-2.6.28/alsa-fix-excessive-background-noise-introduced-by-oss-emulation-rate-shrink.patch diff --git a/queue-2.6.28/alsa-hda-add-another-macbook-pro-3-1-ssid.patch b/review-2.6.28/alsa-hda-add-another-macbook-pro-3-1-ssid.patch similarity index 100% rename from queue-2.6.28/alsa-hda-add-another-macbook-pro-3-1-ssid.patch rename to review-2.6.28/alsa-hda-add-another-macbook-pro-3-1-ssid.patch diff --git a/queue-2.6.28/alsa-hda-fix-digital-mic-on-dell-m4-1-and-dell-m4-3.patch b/review-2.6.28/alsa-hda-fix-digital-mic-on-dell-m4-1-and-dell-m4-3.patch similarity index 100% rename from queue-2.6.28/alsa-hda-fix-digital-mic-on-dell-m4-1-and-dell-m4-3.patch rename to review-2.6.28/alsa-hda-fix-digital-mic-on-dell-m4-1-and-dell-m4-3.patch diff --git a/queue-2.6.28/alsa-usb-audio-fix-non-continuous-rate-detection.patch b/review-2.6.28/alsa-usb-audio-fix-non-continuous-rate-detection.patch similarity index 100% rename from queue-2.6.28/alsa-usb-audio-fix-non-continuous-rate-detection.patch rename to review-2.6.28/alsa-usb-audio-fix-non-continuous-rate-detection.patch diff --git a/queue-2.6.28/alsa-usb-audio-workaround-for-misdetected-sample-rate-with-cm6207.patch b/review-2.6.28/alsa-usb-audio-workaround-for-misdetected-sample-rate-with-cm6207.patch similarity index 100% rename from queue-2.6.28/alsa-usb-audio-workaround-for-misdetected-sample-rate-with-cm6207.patch rename to review-2.6.28/alsa-usb-audio-workaround-for-misdetected-sample-rate-with-cm6207.patch diff --git a/queue-2.6.28/aoe-ignore-vendor-extension-aoe-responses.patch b/review-2.6.28/aoe-ignore-vendor-extension-aoe-responses.patch similarity index 100% rename from queue-2.6.28/aoe-ignore-vendor-extension-aoe-responses.patch rename to review-2.6.28/aoe-ignore-vendor-extension-aoe-responses.patch diff --git a/queue-2.6.28/arm-add-i2c_board_info-for-riscpc-pcf8583.patch b/review-2.6.28/arm-add-i2c_board_info-for-riscpc-pcf8583.patch similarity index 100% rename from queue-2.6.28/arm-add-i2c_board_info-for-riscpc-pcf8583.patch rename to review-2.6.28/arm-add-i2c_board_info-for-riscpc-pcf8583.patch diff --git a/queue-2.6.28/asix-new-device-ids.patch b/review-2.6.28/asix-new-device-ids.patch similarity index 100% rename from queue-2.6.28/asix-new-device-ids.patch rename to review-2.6.28/asix-new-device-ids.patch diff --git a/queue-2.6.28/cdc_ether-add-usb-id-for-ericsson-f3507g.patch b/review-2.6.28/cdc_ether-add-usb-id-for-ericsson-f3507g.patch similarity index 100% rename from queue-2.6.28/cdc_ether-add-usb-id-for-ericsson-f3507g.patch rename to review-2.6.28/cdc_ether-add-usb-id-for-ericsson-f3507g.patch diff --git a/queue-2.6.28/copy_process-fix-clone_parent-parent_exec_id-interaction.patch b/review-2.6.28/copy_process-fix-clone_parent-parent_exec_id-interaction.patch similarity index 100% rename from queue-2.6.28/copy_process-fix-clone_parent-parent_exec_id-interaction.patch rename to review-2.6.28/copy_process-fix-clone_parent-parent_exec_id-interaction.patch diff --git a/queue-2.6.28/crypto-api-fix-algorithm-test-race-that-broke-aead-initialisation.patch b/review-2.6.28/crypto-api-fix-algorithm-test-race-that-broke-aead-initialisation.patch similarity index 100% rename from queue-2.6.28/crypto-api-fix-algorithm-test-race-that-broke-aead-initialisation.patch rename to review-2.6.28/crypto-api-fix-algorithm-test-race-that-broke-aead-initialisation.patch diff --git a/queue-2.6.28/drm-i915-add-missing-userland-definitions-for-gem-init-execbuffer.patch b/review-2.6.28/drm-i915-add-missing-userland-definitions-for-gem-init-execbuffer.patch similarity index 100% rename from queue-2.6.28/drm-i915-add-missing-userland-definitions-for-gem-init-execbuffer.patch rename to review-2.6.28/drm-i915-add-missing-userland-definitions-for-gem-init-execbuffer.patch diff --git a/queue-2.6.28/ext4-add-fallback-for-find_group_flex.patch b/review-2.6.28/ext4-add-fallback-for-find_group_flex.patch similarity index 100% rename from queue-2.6.28/ext4-add-fallback-for-find_group_flex.patch rename to review-2.6.28/ext4-add-fallback-for-find_group_flex.patch diff --git a/queue-2.6.28/ext4-fix-deadlock-in-ext4_write_begin-and-ext4_da_write_begin.patch b/review-2.6.28/ext4-fix-deadlock-in-ext4_write_begin-and-ext4_da_write_begin.patch similarity index 100% rename from queue-2.6.28/ext4-fix-deadlock-in-ext4_write_begin-and-ext4_da_write_begin.patch rename to review-2.6.28/ext4-fix-deadlock-in-ext4_write_begin-and-ext4_da_write_begin.patch diff --git a/queue-2.6.28/ext4-fix-lockdep-warning.patch b/review-2.6.28/ext4-fix-lockdep-warning.patch similarity index 100% rename from queue-2.6.28/ext4-fix-lockdep-warning.patch rename to review-2.6.28/ext4-fix-lockdep-warning.patch diff --git a/queue-2.6.28/ext4-fix-null-dereference-in-ext4_ext_migrate-s-error-handling.patch b/review-2.6.28/ext4-fix-null-dereference-in-ext4_ext_migrate-s-error-handling.patch similarity index 100% rename from queue-2.6.28/ext4-fix-null-dereference-in-ext4_ext_migrate-s-error-handling.patch rename to review-2.6.28/ext4-fix-null-dereference-in-ext4_ext_migrate-s-error-handling.patch diff --git a/queue-2.6.28/ext4-fix-to-read-empty-directory-blocks-correctly-in-64k.patch b/review-2.6.28/ext4-fix-to-read-empty-directory-blocks-correctly-in-64k.patch similarity index 100% rename from queue-2.6.28/ext4-fix-to-read-empty-directory-blocks-correctly-in-64k.patch rename to review-2.6.28/ext4-fix-to-read-empty-directory-blocks-correctly-in-64k.patch diff --git a/queue-2.6.28/ext4-implement-range_cyclic-in-ext4_da_writepages-instead-of-write_cache_pages.patch b/review-2.6.28/ext4-implement-range_cyclic-in-ext4_da_writepages-instead-of-write_cache_pages.patch similarity index 100% rename from queue-2.6.28/ext4-implement-range_cyclic-in-ext4_da_writepages-instead-of-write_cache_pages.patch rename to review-2.6.28/ext4-implement-range_cyclic-in-ext4_da_writepages-instead-of-write_cache_pages.patch diff --git a/queue-2.6.28/ext4-initialize-preallocation-list_head-s-properly.patch b/review-2.6.28/ext4-initialize-preallocation-list_head-s-properly.patch similarity index 100% rename from queue-2.6.28/ext4-initialize-preallocation-list_head-s-properly.patch rename to review-2.6.28/ext4-initialize-preallocation-list_head-s-properly.patch diff --git a/queue-2.6.28/fix-fixpoint-divide-exception-in-acct_update_integrals.patch b/review-2.6.28/fix-fixpoint-divide-exception-in-acct_update_integrals.patch similarity index 100% rename from queue-2.6.28/fix-fixpoint-divide-exception-in-acct_update_integrals.patch rename to review-2.6.28/fix-fixpoint-divide-exception-in-acct_update_integrals.patch diff --git a/queue-2.6.28/fix-oops-in-cifs_strfromucs_le-mounting-to-servers-which-do-not-specify-their-os.patch b/review-2.6.28/fix-oops-in-cifs_strfromucs_le-mounting-to-servers-which-do-not-specify-their-os.patch similarity index 100% rename from queue-2.6.28/fix-oops-in-cifs_strfromucs_le-mounting-to-servers-which-do-not-specify-their-os.patch rename to review-2.6.28/fix-oops-in-cifs_strfromucs_le-mounting-to-servers-which-do-not-specify-their-os.patch diff --git a/queue-2.6.28/fore200-fix-oops-on-failed-firmware-load.patch b/review-2.6.28/fore200-fix-oops-on-failed-firmware-load.patch similarity index 100% rename from queue-2.6.28/fore200-fix-oops-on-failed-firmware-load.patch rename to review-2.6.28/fore200-fix-oops-on-failed-firmware-load.patch diff --git a/queue-2.6.28/fs-new-inode-i_state-corruption-fix.patch b/review-2.6.28/fs-new-inode-i_state-corruption-fix.patch similarity index 100% rename from queue-2.6.28/fs-new-inode-i_state-corruption-fix.patch rename to review-2.6.28/fs-new-inode-i_state-corruption-fix.patch diff --git a/queue-2.6.28/hid-fix-bus-endianity-in-file2alias.patch b/review-2.6.28/hid-fix-bus-endianity-in-file2alias.patch similarity index 100% rename from queue-2.6.28/hid-fix-bus-endianity-in-file2alias.patch rename to review-2.6.28/hid-fix-bus-endianity-in-file2alias.patch diff --git a/queue-2.6.28/hid-move-tmff-and-zpff-devices-from-ignore_list-to-blacklist.patch b/review-2.6.28/hid-move-tmff-and-zpff-devices-from-ignore_list-to-blacklist.patch similarity index 100% rename from queue-2.6.28/hid-move-tmff-and-zpff-devices-from-ignore_list-to-blacklist.patch rename to review-2.6.28/hid-move-tmff-and-zpff-devices-from-ignore_list-to-blacklist.patch diff --git a/queue-2.6.28/hpilo-new-pci-device.patch b/review-2.6.28/hpilo-new-pci-device.patch similarity index 100% rename from queue-2.6.28/hpilo-new-pci-device.patch rename to review-2.6.28/hpilo-new-pci-device.patch diff --git a/queue-2.6.28/hwmon-hide-misleading-error-message.patch b/review-2.6.28/hwmon-hide-misleading-error-message.patch similarity index 100% rename from queue-2.6.28/hwmon-hide-misleading-error-message.patch rename to review-2.6.28/hwmon-hide-misleading-error-message.patch diff --git a/queue-2.6.28/hwmon-properly-decode-128-degrees-c-temperature.patch b/review-2.6.28/hwmon-properly-decode-128-degrees-c-temperature.patch similarity index 100% rename from queue-2.6.28/hwmon-properly-decode-128-degrees-c-temperature.patch rename to review-2.6.28/hwmon-properly-decode-128-degrees-c-temperature.patch diff --git a/queue-2.6.28/i2c-fix-misplaced-parentheses.patch b/review-2.6.28/i2c-fix-misplaced-parentheses.patch similarity index 100% rename from queue-2.6.28/i2c-fix-misplaced-parentheses.patch rename to review-2.6.28/i2c-fix-misplaced-parentheses.patch diff --git a/queue-2.6.28/i2c-timeouts-reach-1.patch b/review-2.6.28/i2c-timeouts-reach-1.patch similarity index 100% rename from queue-2.6.28/i2c-timeouts-reach-1.patch rename to review-2.6.28/i2c-timeouts-reach-1.patch diff --git a/queue-2.6.28/ide-iops-fix-odd-length-atapi-pio-transfers.patch b/review-2.6.28/ide-iops-fix-odd-length-atapi-pio-transfers.patch similarity index 100% rename from queue-2.6.28/ide-iops-fix-odd-length-atapi-pio-transfers.patch rename to review-2.6.28/ide-iops-fix-odd-length-atapi-pio-transfers.patch diff --git a/queue-2.6.28/inotify-fix-gfp_kernel-related-deadlock.patch b/review-2.6.28/inotify-fix-gfp_kernel-related-deadlock.patch similarity index 100% rename from queue-2.6.28/inotify-fix-gfp_kernel-related-deadlock.patch rename to review-2.6.28/inotify-fix-gfp_kernel-related-deadlock.patch diff --git a/queue-2.6.28/intel-agp-fix-a-panic-with-1m-of-shared-memory-no-gtt-entries.patch b/review-2.6.28/intel-agp-fix-a-panic-with-1m-of-shared-memory-no-gtt-entries.patch similarity index 100% rename from queue-2.6.28/intel-agp-fix-a-panic-with-1m-of-shared-memory-no-gtt-entries.patch rename to review-2.6.28/intel-agp-fix-a-panic-with-1m-of-shared-memory-no-gtt-entries.patch diff --git a/queue-2.6.28/jbd2-avoid-possible-null-dereference-in-jbd2_journal_begin_ordered_truncate.patch b/review-2.6.28/jbd2-avoid-possible-null-dereference-in-jbd2_journal_begin_ordered_truncate.patch similarity index 100% rename from queue-2.6.28/jbd2-avoid-possible-null-dereference-in-jbd2_journal_begin_ordered_truncate.patch rename to review-2.6.28/jbd2-avoid-possible-null-dereference-in-jbd2_journal_begin_ordered_truncate.patch diff --git a/queue-2.6.28/jbd2-fix-return-value-of-jbd2_journal_start_commit.patch b/review-2.6.28/jbd2-fix-return-value-of-jbd2_journal_start_commit.patch similarity index 100% rename from queue-2.6.28/jbd2-fix-return-value-of-jbd2_journal_start_commit.patch rename to review-2.6.28/jbd2-fix-return-value-of-jbd2_journal_start_commit.patch diff --git a/queue-2.6.28/jffs2-fix-mount-crash-caused-by-removed-nodes.patch b/review-2.6.28/jffs2-fix-mount-crash-caused-by-removed-nodes.patch similarity index 100% rename from queue-2.6.28/jffs2-fix-mount-crash-caused-by-removed-nodes.patch rename to review-2.6.28/jffs2-fix-mount-crash-caused-by-removed-nodes.patch diff --git a/queue-2.6.28/jsm-additional-device-support.patch b/review-2.6.28/jsm-additional-device-support.patch similarity index 100% rename from queue-2.6.28/jsm-additional-device-support.patch rename to review-2.6.28/jsm-additional-device-support.patch diff --git a/queue-2.6.28/libata-don-t-trust-current-capacity-values-in-identify-words-57-58.patch b/review-2.6.28/libata-don-t-trust-current-capacity-values-in-identify-words-57-58.patch similarity index 100% rename from queue-2.6.28/libata-don-t-trust-current-capacity-values-in-identify-words-57-58.patch rename to review-2.6.28/libata-don-t-trust-current-capacity-values-in-identify-words-57-58.patch diff --git a/queue-2.6.28/libata-make-sure-port-is-thawed-when-skipping-resets.patch b/review-2.6.28/libata-make-sure-port-is-thawed-when-skipping-resets.patch similarity index 100% rename from queue-2.6.28/libata-make-sure-port-is-thawed-when-skipping-resets.patch rename to review-2.6.28/libata-make-sure-port-is-thawed-when-skipping-resets.patch diff --git a/review-2.6.28/mbox b/review-2.6.28/mbox new file mode 100644 index 00000000000..25a05a91dbb --- /dev/null +++ b/review-2.6.28/mbox @@ -0,0 +1,11759 @@ +From gregkh@mini.kroah.org Fri Mar 13 18:10:31 2009 +Message-Id: <20090314011031.415433705@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:09:38 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Eugene Teo , + "David S. Miller" +Subject: [patch 001/114] net: amend the fix for SO_BSDCOMPAT gsopt infoleak +References: <20090314010937.416083662@mini.kroah.org> +Content-Disposition: inline; filename=net-amend-the-fix-for-so_bsdcompat-gsopt-infoleak.patch +Content-Length: 931 +Lines: 31 + +2.6.28-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Eugene Teo + +[ Upstream commit 50fee1dec5d71b8a14c1b82f2f42e16adc227f8b ] + +The fix for CVE-2009-0676 (upstream commit df0bca04) is incomplete. Note +that the same problem of leaking kernel memory will reappear if someone +on some architecture uses struct timeval with some internal padding (for +example tv_sec 64-bit and tv_usec 32-bit) --- then, you are going to +leak the padded bytes to userspace. + +Signed-off-by: Eugene Teo +Reported-by: Mikulas Patocka +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + net/core/sock.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/core/sock.c ++++ b/net/core/sock.c +@@ -696,7 +696,7 @@ int sock_getsockopt(struct socket *sock, + if (len < 0) + return -EINVAL; + +- v.val = 0; ++ memset(&v, 0, sizeof(v)); + + switch(optname) { + case SO_DEBUG: + + +From gregkh@mini.kroah.org Fri Mar 13 18:10:31 2009 +Message-Id: <20090314011031.547932190@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:09:39 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + "David S. Miller" +Subject: [patch 002/114] net: Kill skb_truesize_check(), it only catches false-positives. +References: <20090314010937.416083662@mini.kroah.org> +Content-Disposition: inline; filename=net-kill-skb_truesize_check-it-only-catches-false-positives.patch +Content-Length: 2525 +Lines: 80 + +2.6.28-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: David S. Miller + +[ Upstream commit 92a0acce186cde8ead56c6915d9479773673ea1a ] + +A long time ago we had bugs, primarily in TCP, where we would modify +skb->truesize (for TSO queue collapsing) in ways which would corrupt +the socket memory accounting. + +skb_truesize_check() was added in order to try and catch this error +more systematically. + +However this debugging check has morphed into a Frankenstein of sorts +and these days it does nothing other than catch false-positives. + +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + include/linux/skbuff.h | 9 --------- + include/net/sock.h | 1 - + net/core/skbuff.c | 8 -------- + net/core/sock.c | 1 - + 4 files changed, 19 deletions(-) + +--- a/include/linux/skbuff.h ++++ b/include/linux/skbuff.h +@@ -411,15 +411,6 @@ extern void skb_over_panic(struct + void *here); + extern void skb_under_panic(struct sk_buff *skb, int len, + void *here); +-extern void skb_truesize_bug(struct sk_buff *skb); +- +-static inline void skb_truesize_check(struct sk_buff *skb) +-{ +- int len = sizeof(struct sk_buff) + skb->len; +- +- if (unlikely((int)skb->truesize < len)) +- skb_truesize_bug(skb); +-} + + extern int skb_append_datato_frags(struct sock *sk, struct sk_buff *skb, + int getfrag(void *from, char *to, int offset, +--- a/include/net/sock.h ++++ b/include/net/sock.h +@@ -784,7 +784,6 @@ static inline void sk_mem_uncharge(struc + + static inline void sk_wmem_free_skb(struct sock *sk, struct sk_buff *skb) + { +- skb_truesize_check(skb); + sock_set_flag(sk, SOCK_QUEUE_SHRUNK); + sk->sk_wmem_queued -= skb->truesize; + sk_mem_uncharge(sk, skb->truesize); +--- a/net/core/skbuff.c ++++ b/net/core/skbuff.c +@@ -143,14 +143,6 @@ void skb_under_panic(struct sk_buff *skb + BUG(); + } + +-void skb_truesize_bug(struct sk_buff *skb) +-{ +- WARN(net_ratelimit(), KERN_ERR "SKB BUG: Invalid truesize (%u) " +- "len=%u, sizeof(sk_buff)=%Zd\n", +- skb->truesize, skb->len, sizeof(struct sk_buff)); +-} +-EXPORT_SYMBOL(skb_truesize_bug); +- + /* Allocate a new skbuff. We do this ourselves so we can fill in a few + * 'private' fields and also do memory statistics to find all the + * [BEEP] leaks. +--- a/net/core/sock.c ++++ b/net/core/sock.c +@@ -1137,7 +1137,6 @@ void sock_rfree(struct sk_buff *skb) + { + struct sock *sk = skb->sk; + +- skb_truesize_check(skb); + atomic_sub(skb->truesize, &sk->sk_rmem_alloc); + sk_mem_uncharge(skb->sk, skb->truesize); + } + + +From gregkh@mini.kroah.org Fri Mar 13 18:10:31 2009 +Message-Id: <20090314011031.704352984@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:09:40 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + "David S. Miller" +Subject: [patch 003/114] sparc64: Fix crashes in jbusmc_print_dimm() +References: <20090314010937.416083662@mini.kroah.org> +Content-Disposition: inline; filename=sparc64-fix-crashes-in-jbusmc_print_dimm.patch +Content-Length: 594 +Lines: 25 + +2.6.28-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: David S. Miller + +[ Upstream commit 1b0e235cc9bfae4bc0f5cd0cba929206fb0f6a64 ] + +Return was missing for the case where there is no dimm +info match. + +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + arch/sparc64/kernel/chmc.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/arch/sparc64/kernel/chmc.c ++++ b/arch/sparc64/kernel/chmc.c +@@ -306,6 +306,7 @@ static int jbusmc_print_dimm(int syndrom + buf[1] = '?'; + buf[2] = '?'; + buf[3] = '\0'; ++ return 0; + } + p = dp->controller; + prop = &p->layout; + + +From gregkh@mini.kroah.org Fri Mar 13 18:10:31 2009 +Message-Id: <20090314011031.814268622@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:09:41 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + "David S. Miller" +Subject: [patch 004/114] sparc64: Fix DAX handling via userspace access from kernel. +References: <20090314010937.416083662@mini.kroah.org> +Content-Disposition: inline; filename=sparc64-fix-dax-handling-via-userspace-access-from-kernel.patch +Content-Length: 1677 +Lines: 52 + +2.6.28-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: David S. Miller + +[ Upstream commit fcd26f7ae2ea5889134e8b3d60a42ce8b993c95f ] + +If we do a userspace access from kernel mode, and get a +data access exception, we need to check the exception +table just like a normal fault does. + +The spitfire DAX handler was doing this, but such logic +was missing from the sun4v DAX code. + +Reported-by: Dennis Gilmore +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + arch/sparc64/kernel/traps.c | 17 ++++++++++++++++- + 1 file changed, 16 insertions(+), 1 deletion(-) + +--- a/arch/sparc64/kernel/traps.c ++++ b/arch/sparc64/kernel/traps.c +@@ -1,6 +1,6 @@ + /* arch/sparc64/kernel/traps.c + * +- * Copyright (C) 1995,1997,2008 David S. Miller (davem@davemloft.net) ++ * Copyright (C) 1995,1997,2008,2009 David S. Miller (davem@davemloft.net) + * Copyright (C) 1997,1999,2000 Jakub Jelinek (jakub@redhat.com) + */ + +@@ -313,6 +313,21 @@ void sun4v_data_access_exception(struct + return; + + if (regs->tstate & TSTATE_PRIV) { ++ /* Test if this comes from uaccess places. */ ++ const struct exception_table_entry *entry; ++ ++ entry = search_exception_tables(regs->tpc); ++ if (entry) { ++ /* Ouch, somebody is trying VM hole tricks on us... */ ++#ifdef DEBUG_EXCEPTIONS ++ printk("Exception: PC<%016lx> faddr\n", regs->tpc); ++ printk("EX_TABLE: insn<%016lx> fixup<%016lx>\n", ++ regs->tpc, entry->fixup); ++#endif ++ regs->tpc = entry->fixup; ++ regs->tnpc = regs->tpc + 4; ++ return; ++ } + printk("sun4v_data_access_exception: ADDR[%016lx] " + "CTX[%04x] TYPE[%04x], going.\n", + addr, ctx, type); + + +From gregkh@mini.kroah.org Fri Mar 13 18:10:32 2009 +Message-Id: <20090314011031.973681065@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:09:42 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Paul Turner , + Eric Biederman , + Alexey Dobriyan , + Al Viro +Subject: [patch 005/114] vfs: separate FMODE_PREAD/FMODE_PWRITE into separate flags +References: <20090314010937.416083662@mini.kroah.org> +Content-Disposition: inline; filename=vfs-separate-fmode_pread-fmode_pwrite-into-separate-flags.patch +Content-Length: 2480 +Lines: 67 + +2.6.28-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Paul Turner + +commit 55ec82176eca52e4e0530a82a0eb59160a1a95a1 upstream. + +Separate FMODE_PREAD and FMODE_PWRITE into separate flags to reflect the +reality that the read and write paths may have independent restrictions. + +A git grep verifies that these flags are always cleared together so this +new behavior will only apply to interfaces that change to clear flags +individually. + +This is required for "seq_file: properly cope with pread", a post-2.6.25 +regression fix. + +[akpm@linux-foundation.org: add comment] +Signed-off-by: Paul Turner +Cc: Eric Biederman +Cc: Alexey Dobriyan +Cc: Al Viro +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + include/linux/fs.h | 18 ++++++++++++------ + 1 file changed, 12 insertions(+), 6 deletions(-) + +--- a/include/linux/fs.h ++++ b/include/linux/fs.h +@@ -63,24 +63,30 @@ extern int dir_notify_enable; + #define MAY_ACCESS 16 + #define MAY_OPEN 32 + ++/* ++ * flags in file.f_mode. Note that FMODE_READ and FMODE_WRITE must correspond ++ * to O_WRONLY and O_RDWR via the strange trick in __dentry_open() ++ */ ++ + /* file is open for reading */ + #define FMODE_READ ((__force fmode_t)1) + /* file is open for writing */ + #define FMODE_WRITE ((__force fmode_t)2) + /* file is seekable */ + #define FMODE_LSEEK ((__force fmode_t)4) +-/* file can be accessed using pread/pwrite */ ++/* file can be accessed using pread */ + #define FMODE_PREAD ((__force fmode_t)8) +-#define FMODE_PWRITE FMODE_PREAD /* These go hand in hand */ ++/* file can be accessed using pwrite */ ++#define FMODE_PWRITE ((__force fmode_t)16) + /* File is opened for execution with sys_execve / sys_uselib */ +-#define FMODE_EXEC ((__force fmode_t)16) ++#define FMODE_EXEC ((__force fmode_t)32) + /* File is opened with O_NDELAY (only set for block devices) */ +-#define FMODE_NDELAY ((__force fmode_t)32) ++#define FMODE_NDELAY ((__force fmode_t)64) + /* File is opened with O_EXCL (only set for block devices) */ +-#define FMODE_EXCL ((__force fmode_t)64) ++#define FMODE_EXCL ((__force fmode_t)128) + /* File is opened using open(.., 3, ..) and is writeable only for ioctls + (specialy hack for floppy.c) */ +-#define FMODE_WRITE_IOCTL ((__force fmode_t)128) ++#define FMODE_WRITE_IOCTL ((__force fmode_t)256) + + #define RW_MASK 1 + #define RWA_MASK 2 + + +From gregkh@mini.kroah.org Fri Mar 13 18:10:32 2009 +Message-Id: <20090314011032.139859319@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:09:43 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Eric Biederman , + Alexey Dobriyan , + Al Viro , + Paul Turner +Subject: [patch 006/114] seq_file: properly cope with pread +References: <20090314010937.416083662@mini.kroah.org> +Content-Disposition: inline; filename=seq_file-properly-cope-with-pread.patch +Content-Length: 3366 +Lines: 115 + +2.6.28-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Eric Biederman + +commit 8f19d472935c83d823fa4cf02bcc0a7b9952db30 upstream. + +Currently seq_read assumes that the offset passed to it is always the +offset it passed to user space. In the case pread this assumption is +broken and we do the wrong thing when presented with pread. + +To solve this I introduce an offset cache inside of struct seq_file so we +know where our logical file position is. Then in seq_read if we try to +read from another offset we reset our data structures and attempt to go to +the offset user space wanted. + +[akpm@linux-foundation.org: restore FMODE_PWRITE] +[pjt@google.com: seq_open needs its fmode opened up to take advantage of this] +Signed-off-by: Eric Biederman +Cc: Alexey Dobriyan +Cc: Al Viro +Cc: Paul Turner +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + fs/seq_file.c | 36 ++++++++++++++++++++++++++++++++---- + include/linux/seq_file.h | 1 + + 2 files changed, 33 insertions(+), 4 deletions(-) + +--- a/fs/seq_file.c ++++ b/fs/seq_file.c +@@ -48,8 +48,16 @@ int seq_open(struct file *file, const st + */ + file->f_version = 0; + +- /* SEQ files support lseek, but not pread/pwrite */ +- file->f_mode &= ~(FMODE_PREAD | FMODE_PWRITE); ++ /* ++ * seq_files support lseek() and pread(). They do not implement ++ * write() at all, but we clear FMODE_PWRITE here for historical ++ * reasons. ++ * ++ * If a client of seq_files a) implements file.write() and b) wishes to ++ * support pwrite() then that client will need to implement its own ++ * file.open() which calls seq_open() and then sets FMODE_PWRITE. ++ */ ++ file->f_mode &= ~FMODE_PWRITE; + return 0; + } + EXPORT_SYMBOL(seq_open); +@@ -131,6 +139,22 @@ ssize_t seq_read(struct file *file, char + int err = 0; + + mutex_lock(&m->lock); ++ ++ /* Don't assume *ppos is where we left it */ ++ if (unlikely(*ppos != m->read_pos)) { ++ m->read_pos = *ppos; ++ while ((err = traverse(m, *ppos)) == -EAGAIN) ++ ; ++ if (err) { ++ /* With prejudice... */ ++ m->read_pos = 0; ++ m->version = 0; ++ m->index = 0; ++ m->count = 0; ++ goto Done; ++ } ++ } ++ + /* + * seq_file->op->..m_start/m_stop/m_next may do special actions + * or optimisations based on the file->f_version, so we want to +@@ -230,8 +254,10 @@ Fill: + Done: + if (!copied) + copied = err; +- else ++ else { + *ppos += copied; ++ m->read_pos += copied; ++ } + file->f_version = m->version; + mutex_unlock(&m->lock); + return copied; +@@ -266,16 +292,18 @@ loff_t seq_lseek(struct file *file, loff + if (offset < 0) + break; + retval = offset; +- if (offset != file->f_pos) { ++ if (offset != m->read_pos) { + while ((retval=traverse(m, offset)) == -EAGAIN) + ; + if (retval) { + /* with extreme prejudice... */ + file->f_pos = 0; ++ m->read_pos = 0; + m->version = 0; + m->index = 0; + m->count = 0; + } else { ++ m->read_pos = offset; + retval = file->f_pos = offset; + } + } +--- a/include/linux/seq_file.h ++++ b/include/linux/seq_file.h +@@ -19,6 +19,7 @@ struct seq_file { + size_t from; + size_t count; + loff_t index; ++ loff_t read_pos; + u64 version; + struct mutex lock; + const struct seq_operations *op; + + +From gregkh@mini.kroah.org Fri Mar 13 18:10:32 2009 +Message-Id: <20090314011032.290573366@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:09:44 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jiri Kosina +Subject: [patch 007/114] vt: Declare PIO_CMAP/GIO_CMAP as compatbile ioctls. +References: <20090314010937.416083662@mini.kroah.org> +Content-Disposition: inline; filename=vt-declare-pio_cmap-gio_cmap-as-compatbile-ioctls.patch +Content-Length: 812 +Lines: 29 + +2.6.28-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Bill Nottingham + +commit 2db69a9340da12a4db44edb7506dd68799aeff55 upstream. + +Otherwise, these don't work when called from 32-bit userspace on 64-bit +kernels. + +Cc: Jiri Kosina +Cc: Alan Cox +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + fs/compat_ioctl.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/fs/compat_ioctl.c ++++ b/fs/compat_ioctl.c +@@ -1938,6 +1938,8 @@ ULONG_IOCTL(SET_BITMAP_FILE) + /* Big K */ + COMPATIBLE_IOCTL(PIO_FONT) + COMPATIBLE_IOCTL(GIO_FONT) ++COMPATIBLE_IOCTL(PIO_CMAP) ++COMPATIBLE_IOCTL(GIO_CMAP) + ULONG_IOCTL(KDSIGACCEPT) + COMPATIBLE_IOCTL(KDGETKEYCODE) + COMPATIBLE_IOCTL(KDSETKEYCODE) + + +From gregkh@mini.kroah.org Fri Mar 13 18:10:32 2009 +Message-Id: <20090314011032.458313124@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:09:45 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Michael Kerrisk , + Davide Libenzi +Subject: [patch 008/114] timerfd: add flags check +References: <20090314010937.416083662@mini.kroah.org> +Content-Disposition: inline; filename=timerfd-add-flags-check.patch +Content-Length: 2940 +Lines: 90 + +2.6.28-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Davide Libenzi + +commit 610d18f4128ebbd88845d0fc60cce67b49af881e upstream. + +As requested by Michael, add a missing check for valid flags in +timerfd_settime(), and make it return EINVAL in case some extra bits are +set. + +Michael said: +If this is to be any use to userland apps that want to check flag +support (perhaps it is too late already), then the sooner we get it +into the kernel the better: 2.6.29 would be good; earlier stables as +well would be even better. + +[akpm@linux-foundation.org: remove unused TFD_FLAGS_SET] +Acked-by: Michael Kerrisk +Signed-off-by: Davide Libenzi +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + fs/timerfd.c | 12 ++++++------ + include/linux/timerfd.h | 16 ++++++++++++---- + 2 files changed, 18 insertions(+), 10 deletions(-) + +--- a/fs/timerfd.c ++++ b/fs/timerfd.c +@@ -186,10 +186,9 @@ SYSCALL_DEFINE2(timerfd_create, int, clo + BUILD_BUG_ON(TFD_CLOEXEC != O_CLOEXEC); + BUILD_BUG_ON(TFD_NONBLOCK != O_NONBLOCK); + +- if (flags & ~(TFD_CLOEXEC | TFD_NONBLOCK)) +- return -EINVAL; +- if (clockid != CLOCK_MONOTONIC && +- clockid != CLOCK_REALTIME) ++ if ((flags & ~TFD_CREATE_FLAGS) || ++ (clockid != CLOCK_MONOTONIC && ++ clockid != CLOCK_REALTIME)) + return -EINVAL; + + ctx = kzalloc(sizeof(*ctx), GFP_KERNEL); +@@ -201,7 +200,7 @@ SYSCALL_DEFINE2(timerfd_create, int, clo + hrtimer_init(&ctx->tmr, clockid, HRTIMER_MODE_ABS); + + ufd = anon_inode_getfd("[timerfd]", &timerfd_fops, ctx, +- flags & (O_CLOEXEC | O_NONBLOCK)); ++ flags & TFD_SHARED_FCNTL_FLAGS); + if (ufd < 0) + kfree(ctx); + +@@ -219,7 +218,8 @@ SYSCALL_DEFINE4(timerfd_settime, int, uf + if (copy_from_user(&ktmr, utmr, sizeof(ktmr))) + return -EFAULT; + +- if (!timespec_valid(&ktmr.it_value) || ++ if ((flags & ~TFD_SETTIME_FLAGS) || ++ !timespec_valid(&ktmr.it_value) || + !timespec_valid(&ktmr.it_interval)) + return -EINVAL; + +--- a/include/linux/timerfd.h ++++ b/include/linux/timerfd.h +@@ -11,13 +11,21 @@ + /* For O_CLOEXEC and O_NONBLOCK */ + #include + +-/* Flags for timerfd_settime. */ ++/* ++ * CAREFUL: Check include/asm-generic/fcntl.h when defining ++ * new flags, since they might collide with O_* ones. We want ++ * to re-use O_* flags that couldn't possibly have a meaning ++ * from eventfd, in order to leave a free define-space for ++ * shared O_* flags. ++ */ + #define TFD_TIMER_ABSTIME (1 << 0) +- +-/* Flags for timerfd_create. */ + #define TFD_CLOEXEC O_CLOEXEC + #define TFD_NONBLOCK O_NONBLOCK + ++#define TFD_SHARED_FCNTL_FLAGS (TFD_CLOEXEC | TFD_NONBLOCK) ++/* Flags for timerfd_create. */ ++#define TFD_CREATE_FLAGS TFD_SHARED_FCNTL_FLAGS ++/* Flags for timerfd_settime. */ ++#define TFD_SETTIME_FLAGS TFD_TIMER_ABSTIME + + #endif /* _LINUX_TIMERFD_H */ +- + + +From gregkh@mini.kroah.org Fri Mar 13 18:10:32 2009 +Message-Id: <20090314011032.610697374@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:09:46 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Ed Cashin , + Alex Buell +Subject: [patch 009/114] aoe: ignore vendor extension AoE responses +References: <20090314010937.416083662@mini.kroah.org> +Content-Disposition: inline; filename=aoe-ignore-vendor-extension-aoe-responses.patch +Content-Length: 1315 +Lines: 44 + +2.6.28-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Ed Cashin + +commit b6d6c5175809934e04a606d9193ef04924a7a7d9 upstream. + +The Welland ME-747K-SI AoE target generates unsolicited AoE responses that +are marked as vendor extensions. Instead of ignoring these packets, the +aoe driver was generating kernel messages for each unrecognized response +received. This patch corrects the behavior. + +Signed-off-by: Ed Cashin +Reported-by: +Tested-by: +Cc: Alex Buell +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/block/aoe/aoe.h | 1 + + drivers/block/aoe/aoenet.c | 2 ++ + 2 files changed, 3 insertions(+) + +--- a/drivers/block/aoe/aoe.h ++++ b/drivers/block/aoe/aoe.h +@@ -18,6 +18,7 @@ + enum { + AOECMD_ATA, + AOECMD_CFG, ++ AOECMD_VEND_MIN = 0xf0, + + AOEFL_RSP = (1<<3), + AOEFL_ERR = (1<<2), +--- a/drivers/block/aoe/aoenet.c ++++ b/drivers/block/aoe/aoenet.c +@@ -153,6 +153,8 @@ aoenet_rcv(struct sk_buff *skb, struct n + aoecmd_cfg_rsp(skb); + break; + default: ++ if (h->cmd >= AOECMD_VEND_MIN) ++ break; /* don't complain about vendor commands */ + printk(KERN_INFO "aoe: unknown cmd %d\n", h->cmd); + } + exit: + + +From gregkh@mini.kroah.org Fri Mar 13 18:10:32 2009 +Message-Id: <20090314011032.777019901@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:09:47 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + KAMEZAWA Hiroyuki , + Mel Gorman , + Heiko Carstens +Subject: [patch 010/114] mm: clean up for early_pfn_to_nid() +References: <20090314010937.416083662@mini.kroah.org> +Content-Disposition: inline; filename=mm-clean-up-for-early_pfn_to_nid.patch +Content-Length: 6896 +Lines: 197 + +2.6.28-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: KAMEZAWA Hiroyuki + +commit f2dbcfa738368c8a40d4a5f0b65dc9879577cb21 upstream. + +What's happening is that the assertion in mm/page_alloc.c:move_freepages() +is triggering: + + BUG_ON(page_zone(start_page) != page_zone(end_page)); + +Once I knew this is what was happening, I added some annotations: + + if (unlikely(page_zone(start_page) != page_zone(end_page))) { + printk(KERN_ERR "move_freepages: Bogus zones: " + "start_page[%p] end_page[%p] zone[%p]\n", + start_page, end_page, zone); + printk(KERN_ERR "move_freepages: " + "start_zone[%p] end_zone[%p]\n", + page_zone(start_page), page_zone(end_page)); + printk(KERN_ERR "move_freepages: " + "start_pfn[0x%lx] end_pfn[0x%lx]\n", + page_to_pfn(start_page), page_to_pfn(end_page)); + printk(KERN_ERR "move_freepages: " + "start_nid[%d] end_nid[%d]\n", + page_to_nid(start_page), page_to_nid(end_page)); + ... + +And here's what I got: + + move_freepages: Bogus zones: start_page[2207d0000] end_page[2207dffc0] zone[fffff8103effcb00] + move_freepages: start_zone[fffff8103effcb00] end_zone[fffff8003fffeb00] + move_freepages: start_pfn[0x81f600] end_pfn[0x81f7ff] + move_freepages: start_nid[1] end_nid[0] + +My memory layout on this box is: + +[ 0.000000] Zone PFN ranges: +[ 0.000000] Normal 0x00000000 -> 0x0081ff5d +[ 0.000000] Movable zone start PFN for each node +[ 0.000000] early_node_map[8] active PFN ranges +[ 0.000000] 0: 0x00000000 -> 0x00020000 +[ 0.000000] 1: 0x00800000 -> 0x0081f7ff +[ 0.000000] 1: 0x0081f800 -> 0x0081fe50 +[ 0.000000] 1: 0x0081fed1 -> 0x0081fed8 +[ 0.000000] 1: 0x0081feda -> 0x0081fedb +[ 0.000000] 1: 0x0081fedd -> 0x0081fee5 +[ 0.000000] 1: 0x0081fee7 -> 0x0081ff51 +[ 0.000000] 1: 0x0081ff59 -> 0x0081ff5d + +So it's a block move in that 0x81f600-->0x81f7ff region which triggers +the problem. + +This patch: + +Declaration of early_pfn_to_nid() is scattered over per-arch include +files, and it seems it's complicated to know when the declaration is used. + I think it makes fix-for-memmap-init not easy. + +This patch moves all declaration to include/linux/mm.h + +After this, + if !CONFIG_NODES_POPULATES_NODE_MAP && !CONFIG_HAVE_ARCH_EARLY_PFN_TO_NID + -> Use static definition in include/linux/mm.h + else if !CONFIG_HAVE_ARCH_EARLY_PFN_TO_NID + -> Use generic definition in mm/page_alloc.c + else + -> per-arch back end function will be called. + +Signed-off-by: KAMEZAWA Hiroyuki +Tested-by: KOSAKI Motohiro +Reported-by: David Miller +Cc: Mel Gorman +Cc: Heiko Carstens +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + arch/ia64/include/asm/mmzone.h | 4 ---- + arch/ia64/mm/numa.c | 2 +- + arch/x86/include/asm/mmzone_32.h | 2 -- + arch/x86/include/asm/mmzone_64.h | 2 -- + arch/x86/mm/numa_64.c | 2 +- + include/linux/mm.h | 19 ++++++++++++++++--- + mm/page_alloc.c | 8 +++++++- + 7 files changed, 25 insertions(+), 14 deletions(-) + +--- a/arch/ia64/include/asm/mmzone.h ++++ b/arch/ia64/include/asm/mmzone.h +@@ -31,10 +31,6 @@ static inline int pfn_to_nid(unsigned lo + #endif + } + +-#ifdef CONFIG_HAVE_ARCH_EARLY_PFN_TO_NID +-extern int early_pfn_to_nid(unsigned long pfn); +-#endif +- + #ifdef CONFIG_IA64_DIG /* DIG systems are small */ + # define MAX_PHYSNODE_ID 8 + # define NR_NODE_MEMBLKS (MAX_NUMNODES * 8) +--- a/arch/ia64/mm/numa.c ++++ b/arch/ia64/mm/numa.c +@@ -58,7 +58,7 @@ paddr_to_nid(unsigned long paddr) + * SPARSEMEM to allocate the SPARSEMEM sectionmap on the NUMA node where + * the section resides. + */ +-int early_pfn_to_nid(unsigned long pfn) ++int __meminit __early_pfn_to_nid(unsigned long pfn) + { + int i, section = pfn >> PFN_SECTION_SHIFT, ssec, esec; + +--- a/arch/x86/include/asm/mmzone_32.h ++++ b/arch/x86/include/asm/mmzone_32.h +@@ -32,8 +32,6 @@ static inline void get_memcfg_numa(void) + get_memcfg_numa_flat(); + } + +-extern int early_pfn_to_nid(unsigned long pfn); +- + extern void resume_map_numa_kva(pgd_t *pgd); + + #else /* !CONFIG_NUMA */ +--- a/arch/x86/include/asm/mmzone_64.h ++++ b/arch/x86/include/asm/mmzone_64.h +@@ -40,8 +40,6 @@ static inline __attribute__((pure)) int + #define node_end_pfn(nid) (NODE_DATA(nid)->node_start_pfn + \ + NODE_DATA(nid)->node_spanned_pages) + +-extern int early_pfn_to_nid(unsigned long pfn); +- + #ifdef CONFIG_NUMA_EMU + #define FAKE_NODE_MIN_SIZE (64 * 1024 * 1024) + #define FAKE_NODE_MIN_HASH_MASK (~(FAKE_NODE_MIN_SIZE - 1UL)) +--- a/arch/x86/mm/numa_64.c ++++ b/arch/x86/mm/numa_64.c +@@ -145,7 +145,7 @@ int __init compute_hash_shift(struct boo + return shift; + } + +-int early_pfn_to_nid(unsigned long pfn) ++int __meminit __early_pfn_to_nid(unsigned long pfn) + { + return phys_to_nid(pfn << PAGE_SHIFT); + } +--- a/include/linux/mm.h ++++ b/include/linux/mm.h +@@ -1027,10 +1027,23 @@ extern void free_bootmem_with_active_reg + typedef int (*work_fn_t)(unsigned long, unsigned long, void *); + extern void work_with_active_regions(int nid, work_fn_t work_fn, void *data); + extern void sparse_memory_present_with_active_regions(int nid); +-#ifndef CONFIG_HAVE_ARCH_EARLY_PFN_TO_NID +-extern int early_pfn_to_nid(unsigned long pfn); +-#endif /* CONFIG_HAVE_ARCH_EARLY_PFN_TO_NID */ + #endif /* CONFIG_ARCH_POPULATES_NODE_MAP */ ++ ++#if !defined(CONFIG_ARCH_POPULATES_NODE_MAP) && \ ++ !defined(CONFIG_HAVE_ARCH_EARLY_PFN_TO_NID) ++static inline int __early_pfn_to_nid(unsigned long pfn) ++{ ++ return 0; ++} ++#else ++/* please see mm/page_alloc.c */ ++extern int __meminit early_pfn_to_nid(unsigned long pfn); ++#ifdef CONFIG_HAVE_ARCH_EARLY_PFN_TO_NID ++/* there is a per-arch backend function. */ ++extern int __meminit __early_pfn_to_nid(unsigned long pfn); ++#endif /* CONFIG_HAVE_ARCH_EARLY_PFN_TO_NID */ ++#endif ++ + extern void set_dma_reserve(unsigned long new_dma_reserve); + extern void memmap_init_zone(unsigned long, int, unsigned long, + unsigned long, enum memmap_context); +--- a/mm/page_alloc.c ++++ b/mm/page_alloc.c +@@ -2974,7 +2974,7 @@ static int __meminit next_active_region_ + * was used and there are no special requirements, this is a convenient + * alternative + */ +-int __meminit early_pfn_to_nid(unsigned long pfn) ++int __meminit __early_pfn_to_nid(unsigned long pfn) + { + int i; + +@@ -2990,6 +2990,12 @@ int __meminit early_pfn_to_nid(unsigned + } + #endif /* CONFIG_HAVE_ARCH_EARLY_PFN_TO_NID */ + ++int __meminit early_pfn_to_nid(unsigned long pfn) ++{ ++ return __early_pfn_to_nid(pfn); ++} ++ ++ + /* Basic iterator support to walk early_node_map[] */ + #define for_each_active_range_index_in_nid(i, nid) \ + for (i = first_active_region_index_in_nid(nid); i != -1; \ + + +From gregkh@mini.kroah.org Fri Mar 13 18:10:33 2009 +Message-Id: <20090314011032.952425224@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:09:48 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + KAMEZAWA Hiroyuki , + Mel Gorman , + Heiko Carstens +Subject: [patch 011/114] mm: fix memmap init for handling memory hole +References: <20090314010937.416083662@mini.kroah.org> +Content-Disposition: inline; filename=mm-fix-memmap-init-for-handling-memory-hole.patch +Content-Length: 2401 +Lines: 88 + +2.6.28-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: KAMEZAWA Hiroyuki + +commit cc2559bccc72767cb446f79b071d96c30c26439b upstream. + +Now, early_pfn_in_nid(PFN, NID) may returns false if PFN is a hole. +and memmap initialization was not done. This was a trouble for +sparc boot. + +To fix this, the PFN should be initialized and marked as PG_reserved. +This patch changes early_pfn_in_nid() return true if PFN is a hole. + +Signed-off-by: KAMEZAWA Hiroyuki +Reported-by: David Miller +Tested-by: KOSAKI Motohiro +Cc: Mel Gorman +Cc: Heiko Carstens +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + arch/ia64/mm/numa.c | 2 +- + include/linux/mmzone.h | 2 +- + mm/page_alloc.c | 23 ++++++++++++++++++++--- + 3 files changed, 22 insertions(+), 5 deletions(-) + +--- a/arch/ia64/mm/numa.c ++++ b/arch/ia64/mm/numa.c +@@ -70,7 +70,7 @@ int __meminit __early_pfn_to_nid(unsigne + return node_memblk[i].nid; + } + +- return 0; ++ return -1; + } + + #ifdef CONFIG_MEMORY_HOTPLUG +--- a/include/linux/mmzone.h ++++ b/include/linux/mmzone.h +@@ -1067,7 +1067,7 @@ void sparse_init(void); + #endif /* CONFIG_SPARSEMEM */ + + #ifdef CONFIG_NODES_SPAN_OTHER_NODES +-#define early_pfn_in_nid(pfn, nid) (early_pfn_to_nid(pfn) == (nid)) ++bool early_pfn_in_nid(unsigned long pfn, int nid); + #else + #define early_pfn_in_nid(pfn, nid) (1) + #endif +--- a/mm/page_alloc.c ++++ b/mm/page_alloc.c +@@ -2985,16 +2985,33 @@ int __meminit __early_pfn_to_nid(unsigne + if (start_pfn <= pfn && pfn < end_pfn) + return early_node_map[i].nid; + } +- +- return 0; ++ /* This is a memory hole */ ++ return -1; + } + #endif /* CONFIG_HAVE_ARCH_EARLY_PFN_TO_NID */ + + int __meminit early_pfn_to_nid(unsigned long pfn) + { +- return __early_pfn_to_nid(pfn); ++ int nid; ++ ++ nid = __early_pfn_to_nid(pfn); ++ if (nid >= 0) ++ return nid; ++ /* just returns 0 */ ++ return 0; + } + ++#ifdef CONFIG_NODES_SPAN_OTHER_NODES ++bool __meminit early_pfn_in_nid(unsigned long pfn, int node) ++{ ++ int nid; ++ ++ nid = __early_pfn_to_nid(pfn); ++ if (nid >= 0 && nid != node) ++ return false; ++ return true; ++} ++#endif + + /* Basic iterator support to walk early_node_map[] */ + #define for_each_active_range_index_in_nid(i, nid) \ + + +From gregkh@mini.kroah.org Fri Mar 13 18:10:33 2009 +Message-Id: <20090314011033.090722418@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:09:49 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jeff Layton , + Steve French +Subject: [patch 012/114] [CIFS] Fix oops in cifs_strfromUCS_le mounting to servers which do not specify their OS +References: <20090314010937.416083662@mini.kroah.org> +Content-Disposition: inline; filename=fix-oops-in-cifs_strfromucs_le-mounting-to-servers-which-do-not-specify-their-os.patch +Content-Length: 1758 +Lines: 50 + +2.6.28-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Steve French + +commit 69765529d701c838df19ea1f5ad2f33a528261ae upstream. + +Fixes kernel bug #10451 http://bugzilla.kernel.org/show_bug.cgi?id=10451 + +Certain NAS appliances do not set the operating system or network operating system +fields in the session setup response on the wire. cifs was oopsing on the unexpected +zero length response fields (when trying to null terminate a zero length field). + +This fixes the oops. + +Acked-by: Jeff Layton +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman + +--- + fs/cifs/CHANGES | 2 ++ + fs/cifs/sess.c | 4 ++-- + 2 files changed, 4 insertions(+), 2 deletions(-) + +--- a/fs/cifs/CHANGES ++++ b/fs/cifs/CHANGES +@@ -1,3 +1,5 @@ ++Fix oops in cifs_dfs_ref.c when prefixpath is not reachable when using DFS. ++ + Version 1.55 + ------------ + Various fixes to make delete of open files behavior more predictable +--- a/fs/cifs/sess.c ++++ b/fs/cifs/sess.c +@@ -228,7 +228,7 @@ static int decode_unicode_ssetup(char ** + + kfree(ses->serverOS); + /* UTF-8 string will not grow more than four times as big as UCS-16 */ +- ses->serverOS = kzalloc(4 * len, GFP_KERNEL); ++ ses->serverOS = kzalloc((4 * len) + 2 /* trailing null */, GFP_KERNEL); + if (ses->serverOS != NULL) + cifs_strfromUCS_le(ses->serverOS, (__le16 *)data, len, nls_cp); + data += 2 * (len + 1); +@@ -241,7 +241,7 @@ static int decode_unicode_ssetup(char ** + return rc; + + kfree(ses->serverNOS); +- ses->serverNOS = kzalloc(4 * len, GFP_KERNEL); /* BB this is wrong length FIXME BB */ ++ ses->serverNOS = kzalloc((4 * len) + 2 /* trailing null */, GFP_KERNEL); + if (ses->serverNOS != NULL) { + cifs_strfromUCS_le(ses->serverNOS, (__le16 *)data, len, + nls_cp); + + +From gregkh@mini.kroah.org Fri Mar 13 18:10:33 2009 +Message-Id: <20090314011033.285021056@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:09:50 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Nick Piggin , + Vegard Nossum , + Pekka Enberg , + Ingo Molnar , + "Paul E. McKenney" +Subject: [patch 013/114] mm: fix lazy vmap purging (use-after-free error) +References: <20090314010937.416083662@mini.kroah.org> +Content-Disposition: inline; filename=mm-fix-lazy-vmap-purging.patch +Content-Length: 2800 +Lines: 87 + +2.6.28-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Vegard Nossum + +commit cbb766766f3f2f6d9326c561b1020590642c6e39 upstream. + +I just got this new warning from kmemcheck: + + WARNING: kmemcheck: Caught 32-bit read from freed memory (c7806a60) + a06a80c7ecde70c1a04080c700000000a06709c1000000000000000000000000 + f f f f f f f f f f f f f f f f f f f f f f f f f f f f f f f f + ^ + + Pid: 0, comm: swapper Not tainted (2.6.29-rc4 #230) + EIP: 0060:[] EFLAGS: 00000286 CPU: 0 + EIP is at __purge_vmap_area_lazy+0x117/0x140 + EAX: 00070f43 EBX: c7806a40 ECX: c1677080 EDX: 00027b66 + ESI: 00002001 EDI: c170df0c EBP: c170df00 ESP: c178830c + DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068 + CR0: 80050033 CR2: c7806b14 CR3: 01775000 CR4: 00000690 + DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000 + DR6: 00004000 DR7: 00000000 + [] free_unmap_vmap_area_noflush+0x6e/0x70 + [] remove_vm_area+0x2a/0x70 + [] __vunmap+0x45/0xe0 + [] vunmap+0x1e/0x30 + [] text_poke+0x95/0x150 + [] alternatives_smp_unlock+0x49/0x60 + [] alternative_instructions+0x11b/0x124 + [] check_bugs+0xbd/0xdc + [] start_kernel+0x2ed/0x360 + [] __init_begin+0x9e/0xa9 + [] 0xffffffff + +It happened here: + + $ addr2line -e vmlinux -i c1096df7 + mm/vmalloc.c:540 + +Code: + + list_for_each_entry(va, &valist, purge_list) + __free_vmap_area(va); + +It's this instruction: + + mov 0x20(%ebx),%edx + +Which corresponds to a dereference of va->purge_list.next: + + (gdb) p ((struct vmap_area *) 0)->purge_list.next + Cannot access memory at address 0x20 + +It seems that we should use "safe" list traversal here, as the element +is freed inside the loop. Please verify that this is the right fix. + +Acked-by: Nick Piggin +Signed-off-by: Vegard Nossum +Cc: Pekka Enberg +Cc: Ingo Molnar +Cc: "Paul E. McKenney" +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/vmalloc.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/mm/vmalloc.c ++++ b/mm/vmalloc.c +@@ -476,6 +476,7 @@ static void __purge_vmap_area_lazy(unsig + static DEFINE_SPINLOCK(purge_lock); + LIST_HEAD(valist); + struct vmap_area *va; ++ struct vmap_area *n_va; + int nr = 0; + + /* +@@ -515,7 +516,7 @@ static void __purge_vmap_area_lazy(unsig + + if (nr) { + spin_lock(&vmap_area_lock); +- list_for_each_entry(va, &valist, purge_list) ++ list_for_each_entry_safe(va, n_va, &valist, purge_list) + __free_vmap_area(va); + spin_unlock(&vmap_area_lock); + } + + +From gregkh@mini.kroah.org Fri Mar 13 18:10:33 2009 +Message-Id: <20090314011033.444403324@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:09:51 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Nick Piggin +Subject: [patch 014/114] mm: vmap fix overflow +References: <20090314010937.416083662@mini.kroah.org> +Content-Disposition: inline; filename=mm-vmap-fix-overflow.patch +Content-Length: 1491 +Lines: 57 + +2.6.28-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Nick Piggin + +commit 7766970cc13e9071b356b1f2a48a9eb8675bfcce upstream. + +The new vmap allocator can wrap the address and get confused in the case +of large allocations or VMALLOC_END near the end of address space. + +Problem reported by Christoph Hellwig on a 32-bit XFS workload. + +Signed-off-by: Nick Piggin +Reported-by: Christoph Hellwig +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/vmalloc.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/mm/vmalloc.c ++++ b/mm/vmalloc.c +@@ -323,6 +323,7 @@ static struct vmap_area *alloc_vmap_area + unsigned long addr; + int purged = 0; + ++ BUG_ON(!size); + BUG_ON(size & ~PAGE_MASK); + + va = kmalloc_node(sizeof(struct vmap_area), +@@ -334,6 +335,9 @@ retry: + addr = ALIGN(vstart, align); + + spin_lock(&vmap_area_lock); ++ if (addr + size - 1 < addr) ++ goto overflow; ++ + /* XXX: could have a last_hole cache */ + n = vmap_area_root.rb_node; + if (n) { +@@ -365,6 +369,8 @@ retry: + + while (addr + size > first->va_start && addr + size <= vend) { + addr = ALIGN(first->va_end + PAGE_SIZE, align); ++ if (addr + size - 1 < addr) ++ goto overflow; + + n = rb_next(&first->rb_node); + if (n) +@@ -375,6 +381,7 @@ retry: + } + found: + if (addr + size > vend) { ++overflow: + spin_unlock(&vmap_area_lock); + if (!purged) { + purge_vmap_area_lazy(); + + +From gregkh@mini.kroah.org Fri Mar 13 18:10:33 2009 +Message-Id: <20090314011033.590487332@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:09:52 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Yinghai Lu , + Jesse Barnes +Subject: [patch 015/114] PCI quirk: enable MSI on 8132 +References: <20090314010937.416083662@mini.kroah.org> +Content-Disposition: inline; filename=pci-quirk-enable-msi-on-8132.patch +Content-Length: 1375 +Lines: 38 + +2.6.28-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Yinghai Lu + +commit e0ae4f5503235ba4449ffb5bcb4189edcef4d584 upstream. + +David reported that LSI SAS doesn't work with MSI. It turns out that +his BIOS doesn't enable it, but the HT MSI 8132 does support HT MSI. +Add quirk to enable it + +Reported-by: David Lang +Signed-off-by: Yinghai Lu +Signed-off-by: Jesse Barnes +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pci/quirks.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -1778,7 +1778,6 @@ static void __devinit quirk_msi_ht_cap(s + DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_SERVERWORKS, PCI_DEVICE_ID_SERVERWORKS_HT2000_PCIE, + quirk_msi_ht_cap); + +- + /* The nVidia CK804 chipset may have 2 HT MSI mappings. + * MSI are supported if the MSI capability set in any of these mappings. + */ +@@ -1829,6 +1828,9 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_S + PCI_DEVICE_ID_SERVERWORKS_HT1000_PXB, + ht_enable_msi_mapping); + ++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_8132_BRIDGE, ++ ht_enable_msi_mapping); ++ + /* The P5N32-SLI Premium motherboard from Asus has a problem with msi + * for the MCP55 NIC. It is not yet determined whether the msi problem + * also affects other devices. As for now, turn off msi for this device. + + +From gregkh@mini.kroah.org Fri Mar 13 18:10:33 2009 +Message-Id: <20090314011033.739621017@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:09:53 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + HighPoint Linux Team , + James Bottomley +Subject: [patch 016/114] SCSI: hptiop: Add new PCI device ID +References: <20090314010937.416083662@mini.kroah.org> +Content-Disposition: inline; filename=scsi-hptiop-add-new-pci-device-id.patch +Content-Length: 944 +Lines: 23 + +2.6.28-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: HighPoint Linux Team + +commit b73a77494292b930642fbf87de3e3196593f7593 upstream. + +Signed-off-by: HighPoint Linux Team +Signed-off-by: James Bottomley +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/hptiop.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/scsi/hptiop.c ++++ b/drivers/scsi/hptiop.c +@@ -1251,6 +1251,7 @@ static struct pci_device_id hptiop_id_ta + { PCI_VDEVICE(TTI, 0x3530), (kernel_ulong_t)&hptiop_itl_ops }, + { PCI_VDEVICE(TTI, 0x3560), (kernel_ulong_t)&hptiop_itl_ops }, + { PCI_VDEVICE(TTI, 0x4322), (kernel_ulong_t)&hptiop_itl_ops }, ++ { PCI_VDEVICE(TTI, 0x4321), (kernel_ulong_t)&hptiop_itl_ops }, + { PCI_VDEVICE(TTI, 0x4210), (kernel_ulong_t)&hptiop_itl_ops }, + { PCI_VDEVICE(TTI, 0x4211), (kernel_ulong_t)&hptiop_itl_ops }, + { PCI_VDEVICE(TTI, 0x4310), (kernel_ulong_t)&hptiop_itl_ops }, + + +From gregkh@mini.kroah.org Fri Mar 13 18:10:34 2009 +Message-Id: <20090314011033.870367095@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:09:54 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Thomas Gleixner , + David Woodhouse +Subject: [patch 017/114] JFFS2: fix mount crash caused by removed nodes +References: <20090314010937.416083662@mini.kroah.org> +Content-Disposition: inline; filename=jffs2-fix-mount-crash-caused-by-removed-nodes.patch +Content-Length: 3195 +Lines: 109 + +2.6.28-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Thomas Gleixner + +commit 4c41bd0ec953954158f92bed5d3062645062b98e upstream. + +At scan time we observed following scenario: + + node A inserted + node B inserted + node C inserted -> sets overlapped flag on node B + + node A is removed due to CRC failure -> overlapped flag on node B remains + + while (tn->overlapped) + tn = tn_prev(tn); + + ==> crash, when tn_prev(B) is referenced. + +When the ultimate node is removed at scan time and the overlapped flag +is set on the penultimate node, then nothing updates the overlapped +flag of that node. The overlapped iterators blindly expect that the +ultimate node does not have the overlapped flag set, which causes the +scan code to crash. + +It would be a huge overhead to go through the node chain on node +removal and fix up the overlapped flags, so detecting such a case on +the fly in the overlapped iterators is a simpler and reliable +solution. + +Signed-off-by: Thomas Gleixner +Signed-off-by: David Woodhouse +Signed-off-by: Greg Kroah-Hartman + +--- + fs/jffs2/readinode.c | 42 +++++++++++++++++++++++++++++++++--------- + 1 file changed, 33 insertions(+), 9 deletions(-) + +--- a/fs/jffs2/readinode.c ++++ b/fs/jffs2/readinode.c +@@ -220,7 +220,7 @@ static int jffs2_add_tn_to_tree(struct j + struct jffs2_tmp_dnode_info *tn) + { + uint32_t fn_end = tn->fn->ofs + tn->fn->size; +- struct jffs2_tmp_dnode_info *this; ++ struct jffs2_tmp_dnode_info *this, *ptn; + + dbg_readinode("insert fragment %#04x-%#04x, ver %u at %08x\n", tn->fn->ofs, fn_end, tn->version, ref_offset(tn->fn->raw)); + +@@ -251,11 +251,18 @@ static int jffs2_add_tn_to_tree(struct j + if (this) { + /* If the node is coincident with another at a lower address, + back up until the other node is found. It may be relevant */ +- while (this->overlapped) +- this = tn_prev(this); +- +- /* First node should never be marked overlapped */ +- BUG_ON(!this); ++ while (this->overlapped) { ++ ptn = tn_prev(this); ++ if (!ptn) { ++ /* ++ * We killed a node which set the overlapped ++ * flags during the scan. Fix it up. ++ */ ++ this->overlapped = 0; ++ break; ++ } ++ this = ptn; ++ } + dbg_readinode("'this' found %#04x-%#04x (%s)\n", this->fn->ofs, this->fn->ofs + this->fn->size, this->fn ? "data" : "hole"); + } + +@@ -360,7 +367,17 @@ static int jffs2_add_tn_to_tree(struct j + } + if (!this->overlapped) + break; +- this = tn_prev(this); ++ ++ ptn = tn_prev(this); ++ if (!ptn) { ++ /* ++ * We killed a node which set the overlapped ++ * flags during the scan. Fix it up. ++ */ ++ this->overlapped = 0; ++ break; ++ } ++ this = ptn; + } + } + +@@ -456,8 +473,15 @@ static int jffs2_build_inode_fragtree(st + eat_last(&rii->tn_root, &last->rb); + ver_insert(&ver_root, last); + +- if (unlikely(last->overlapped)) +- continue; ++ if (unlikely(last->overlapped)) { ++ if (pen) ++ continue; ++ /* ++ * We killed a node which set the overlapped ++ * flags during the scan. Fix it up. ++ */ ++ last->overlapped = 0; ++ } + + /* Now we have a bunch of nodes in reverse version + order, in the tree at ver_root. Most of the time, + + +From gregkh@mini.kroah.org Fri Mar 13 18:10:34 2009 +Message-Id: <20090314011034.029554443@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:09:55 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Tejun Heo , + James Bottomley +Subject: [patch 018/114] SCSI: sd: revive sd_index_lock +References: <20090314010937.416083662@mini.kroah.org> +Content-Disposition: inline; filename=scsi-sd-revive-sd_index_lock.patch +Content-Length: 1979 +Lines: 62 + +2.6.28-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Tejun Heo + +commit 4034cc68157bfa0b6622efe368488d3d3e20f4e6 upstream. + +Commit f27bac2761cab5a2e212dea602d22457a9aa6943 which converted sd to +use ida instead of idr incorrectly removed sd_index_lock around id +allocation and free. idr/ida do have internal locks but they protect +their free object lists not the allocation itself. The caller is +responsible for that. This missing synchronization led to the same id +being assigned to multiple devices leading to oops. + +Reported and tracked down by Stuart Hayes of Dell. + +Signed-off-by: Tejun Heo +Signed-off-by: James Bottomley +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/sd.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/scsi/sd.c ++++ b/drivers/scsi/sd.c +@@ -106,6 +106,7 @@ static void scsi_disk_release(struct dev + static void sd_print_sense_hdr(struct scsi_disk *, struct scsi_sense_hdr *); + static void sd_print_result(struct scsi_disk *, int); + ++static DEFINE_SPINLOCK(sd_index_lock); + static DEFINE_IDA(sd_index_ida); + + /* This semaphore is used to mediate the 0->1 reference get in the +@@ -1847,7 +1848,9 @@ static int sd_probe(struct device *dev) + if (!ida_pre_get(&sd_index_ida, GFP_KERNEL)) + goto out_put; + ++ spin_lock(&sd_index_lock); + error = ida_get_new(&sd_index_ida, &index); ++ spin_unlock(&sd_index_lock); + } while (error == -EAGAIN); + + if (error) +@@ -1910,7 +1913,9 @@ static int sd_probe(struct device *dev) + return 0; + + out_free_index: ++ spin_lock(&sd_index_lock); + ida_remove(&sd_index_ida, index); ++ spin_unlock(&sd_index_lock); + out_put: + put_disk(gd); + out_free: +@@ -1960,7 +1965,9 @@ static void scsi_disk_release(struct dev + struct scsi_disk *sdkp = to_scsi_disk(dev); + struct gendisk *disk = sdkp->disk; + ++ spin_lock(&sd_index_lock); + ida_remove(&sd_index_ida, sdkp->index); ++ spin_unlock(&sd_index_lock); + + disk->private_data = NULL; + put_disk(disk); + + +From gregkh@mini.kroah.org Fri Mar 13 18:10:34 2009 +Message-Id: <20090314011034.190977129@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:09:56 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Alan Stern +Subject: [patch 019/114] USB: usb_get_string should check the descriptor type +References: <20090314010937.416083662@mini.kroah.org> +Content-Disposition: inline; filename=usb-usb_get_string-should-check-the-descriptor-type.patch +Content-Length: 1702 +Lines: 52 + +2.6.28-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Alan Stern + +commit 67f5a4ba9741fcef3f4db3509ad03565d9e33af2 upstream. + +This patch (as1218) fixes a problem with a radio-control joystick used +in the "walkera 4#3" helicopter. This device responds to the initial +Get-String-Descriptor request for string 0 (which is really the list +of supported languages) by sending its config descriptor! The +usb_get_string() routine needs to check whether it got the right +type of descriptor. + +Oddly enough, this sort of check is already present in +usb_get_descriptor(). The patch changes the error code from -EPROTO +to -ENODATA, because -EPROTO shows up in so many other contexts to +indicate a hardware failure rather than a firmware error. + +Signed-off-by: Alan Stern +Tested-by: Guillermo Jarabo +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/message.c | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +--- a/drivers/usb/core/message.c ++++ b/drivers/usb/core/message.c +@@ -651,7 +651,7 @@ int usb_get_descriptor(struct usb_device + if (result <= 0 && result != -ETIMEDOUT) + continue; + if (result > 1 && ((u8 *)buf)[1] != type) { +- result = -EPROTO; ++ result = -ENODATA; + continue; + } + break; +@@ -694,8 +694,13 @@ static int usb_get_string(struct usb_dev + USB_REQ_GET_DESCRIPTOR, USB_DIR_IN, + (USB_DT_STRING << 8) + index, langid, buf, size, + USB_CTRL_GET_TIMEOUT); +- if (!(result == 0 || result == -EPIPE)) +- break; ++ if (result == 0 || result == -EPIPE) ++ continue; ++ if (result > 1 && ((u8 *) buf)[1] != USB_DT_STRING) { ++ result = -ENODATA; ++ continue; ++ } ++ break; + } + return result; + } + + +From gregkh@mini.kroah.org Fri Mar 13 18:10:34 2009 +Message-Id: <20090314011034.336748926@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:09:57 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Alan Stern +Subject: [patch 020/114] USB: usb-storage: add IGNORE_RESIDUE flag for Genesys Logic adapters +References: <20090314010937.416083662@mini.kroah.org> +Content-Disposition: inline; filename=usb-usb-storage-add-ignore_residue-flag-for-genesys-logic-adapters.patch +Content-Length: 1272 +Lines: 36 + +2.6.28-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Alan Stern + +commit 5126a2674ddac0804450f59da25a058cca629d38 upstream. + +This patch (as1219) adds the IGNORE_RESIDUE flag to the unusual_devs +entries for Genesys Logic's USB-IDE adapter. Although this device +usually gets the residue correct, there is one command crucial to the +operation of CD and DVD drives which it messes up. + +Tested-by: Mike Lampard +Signed-off-by: Alan Stern +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/storage/unusual_devs.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/usb/storage/unusual_devs.h ++++ b/drivers/usb/storage/unusual_devs.h +@@ -876,13 +876,13 @@ UNUSUAL_DEV( 0x05e3, 0x0701, 0x0000, 0x + "Genesys Logic", + "USB to IDE Optical", + US_SC_DEVICE, US_PR_DEVICE, NULL, +- US_FL_GO_SLOW | US_FL_MAX_SECTORS_64 ), ++ US_FL_GO_SLOW | US_FL_MAX_SECTORS_64 | US_FL_IGNORE_RESIDUE ), + + UNUSUAL_DEV( 0x05e3, 0x0702, 0x0000, 0xffff, + "Genesys Logic", + "USB to IDE Disk", + US_SC_DEVICE, US_PR_DEVICE, NULL, +- US_FL_GO_SLOW | US_FL_MAX_SECTORS_64 ), ++ US_FL_GO_SLOW | US_FL_MAX_SECTORS_64 | US_FL_IGNORE_RESIDUE ), + + /* Reported by Hanno Boeck + * Taken from the Lycoris Kernel */ + + +From gregkh@mini.kroah.org Fri Mar 13 18:10:34 2009 +Message-Id: <20090314011034.489449203@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:09:58 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Dmitriy Taychenachev +Subject: [patch 021/114] USB: cdc-acm: add usb id for motomagx phones +References: <20090314010937.416083662@mini.kroah.org> +Content-Disposition: inline; filename=usb-cdc-acm-add-usb-id-for-motomagx-phones.patch +Content-Length: 1054 +Lines: 29 + +2.6.28-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Dmitriy Taychenachev + +commit 155df65ae11dfc322214c6f887185929c809df1b upstream. + +The Motorola MOTOMAGX phones (Z6, E8, Zn5 so far) are providing +combined ACM/BLAN USB configuration. Since it has Vendor Specific +class, the corresponding drivers (cdc-acm, zaurus) can't find it just +by interface info. This patch adds usb id so the cdc-acm driver can +properly handle this combined device. + +Signed-off-by: Dmitriy Taychenachev +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/class/cdc-acm.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/usb/class/cdc-acm.c ++++ b/drivers/usb/class/cdc-acm.c +@@ -1370,6 +1370,8 @@ static struct usb_device_id acm_ids[] = + { USB_DEVICE(0x0572, 0x1321), /* Conexant USB MODEM CX93010 */ + .driver_info = NO_UNION_NORMAL, /* has no union descriptor */ + }, ++ { USB_DEVICE(0x22b8, 0x6425), /* Motorola MOTOMAGX phones */ ++ }, + + /* control interfaces with various AT-command sets */ + { USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_ACM, + + +From gregkh@mini.kroah.org Fri Mar 13 18:10:34 2009 +Message-Id: <20090314011034.642813607@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:09:59 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Larry Finger , + "John W. Linville" +Subject: [patch 022/114] rtl8187: New USB IDs for RTL8187L +References: <20090314010937.416083662@mini.kroah.org> +Content-Disposition: inline; filename=rtl8187-new-usb-id-s-for-rtl8187l.patch +Content-Length: 1961 +Lines: 50 + +2.6.28-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Larry Finger + +commit 046ee5d26ac91316a8ac0a29c0b33139dc9da20d upstream. + +Add new USB ID codes. These come from two postings on forums and +mailing lists, and four are derived from the .inf that accompanies +the latest Realtek Windows driver for the RTL8187L. + +Thanks to Viktor IlijaÅ¡ić and Xose Vazquez +Perez for reporting these new ID's. + +Signed-off-by: Larry Finger +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/rtl8187_dev.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +--- a/drivers/net/wireless/rtl8187_dev.c ++++ b/drivers/net/wireless/rtl8187_dev.c +@@ -40,6 +40,10 @@ static struct usb_device_id rtl8187_tabl + {USB_DEVICE(0x0bda, 0x8189), .driver_info = DEVICE_RTL8187B}, + {USB_DEVICE(0x0bda, 0x8197), .driver_info = DEVICE_RTL8187B}, + {USB_DEVICE(0x0bda, 0x8198), .driver_info = DEVICE_RTL8187B}, ++ /* Surecom */ ++ {USB_DEVICE(0x0769, 0x11F2), .driver_info = DEVICE_RTL8187}, ++ /* Logitech */ ++ {USB_DEVICE(0x0789, 0x010C), .driver_info = DEVICE_RTL8187}, + /* Netgear */ + {USB_DEVICE(0x0846, 0x6100), .driver_info = DEVICE_RTL8187}, + {USB_DEVICE(0x0846, 0x6a00), .driver_info = DEVICE_RTL8187}, +@@ -49,8 +53,16 @@ static struct usb_device_id rtl8187_tabl + /* Sitecom */ + {USB_DEVICE(0x0df6, 0x000d), .driver_info = DEVICE_RTL8187}, + {USB_DEVICE(0x0df6, 0x0028), .driver_info = DEVICE_RTL8187B}, ++ /* Sphairon Access Systems GmbH */ ++ {USB_DEVICE(0x114B, 0x0150), .driver_info = DEVICE_RTL8187}, ++ /* Dick Smith Electronics */ ++ {USB_DEVICE(0x1371, 0x9401), .driver_info = DEVICE_RTL8187}, + /* Abocom */ + {USB_DEVICE(0x13d1, 0xabe6), .driver_info = DEVICE_RTL8187}, ++ /* Qcom */ ++ {USB_DEVICE(0x18E8, 0x6232), .driver_info = DEVICE_RTL8187}, ++ /* AirLive */ ++ {USB_DEVICE(0x1b75, 0x8187), .driver_info = DEVICE_RTL8187}, + {} + }; + + + +From gregkh@mini.kroah.org Fri Mar 13 18:10:34 2009 +Message-Id: <20090314011034.790870402@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:10:00 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Alexey Dobriyan , + Wim Van Sebroeck +Subject: [patch 023/114] WATCHDOG: ks8695_wdt.c: CLOCK_TICK_RATE undeclared +References: <20090314010937.416083662@mini.kroah.org> +Content-Disposition: inline; filename=watchdog-ks8695_wdt.c-clock_tick_rate-undeclared.patch +Content-Length: 725 +Lines: 28 + +2.6.28-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Alexey Dobriyan + +commit b02c387892fc6b3cc59c78ab2f79413d55f50190 upstream. + +On arm-acs5k_tiny: + +drivers/watchdog/ks8695_wdt.c:68: error: 'CLOCK_TICK_RATE' undeclared + (first use in this function) + +Signed-off-by: Alexey Dobriyan +Signed-off-by: Wim Van Sebroeck +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/watchdog/ks8695_wdt.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/watchdog/ks8695_wdt.c ++++ b/drivers/watchdog/ks8695_wdt.c +@@ -21,6 +21,7 @@ + #include + #include + #include ++#include + #include + + #define WDT_DEFAULT_TIME 5 /* seconds */ + + +From gregkh@mini.kroah.org Fri Mar 13 18:10:35 2009 +Message-Id: <20090314011034.945641959@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:10:01 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Phil Sutter , + Wim Van Sebroeck +Subject: [patch 024/114] WATCHDOG: rc32434_wdt: fix watchdog driver +References: <20090314010937.416083662@mini.kroah.org> +Content-Disposition: inline; filename=watchdog-rc32434_wdt-fix-watchdog-driver.patch +Content-Length: 7540 +Lines: 298 + +2.6.28-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Phil Sutter + +commit 0af98d37e85e6958eb84987b1f60da3b54008317 upstream. + +The existing driver code wasn't working. Neither the timeout was set +correctly, nor system reset was being triggered, as the driver seemed +to keep the WDT alive himself. There was also some unnecessary code. + +Signed-off-by: Phil Sutter +Signed-off-by: Wim Van Sebroeck +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/watchdog/rc32434_wdt.c | 158 ++++++++++++++++------------------------- + 1 file changed, 64 insertions(+), 94 deletions(-) + +--- a/drivers/watchdog/rc32434_wdt.c ++++ b/drivers/watchdog/rc32434_wdt.c +@@ -34,104 +34,89 @@ + #include + #include + +-#define MAX_TIMEOUT 20 +-#define RC32434_WDT_INTERVAL (15 * HZ) +- +-#define VERSION "0.2" ++#define VERSION "0.3" + + static struct { +- struct completion stop; +- int running; +- struct timer_list timer; +- int queue; +- int default_ticks; + unsigned long inuse; + } rc32434_wdt_device; + + static struct integ __iomem *wdt_reg; +-static int ticks = 100 * HZ; + + static int expect_close; +-static int timeout; ++ ++/* Board internal clock speed in Hz, ++ * the watchdog timer ticks at. */ ++extern unsigned int idt_cpu_freq; ++ ++/* translate wtcompare value to seconds and vice versa */ ++#define WTCOMP2SEC(x) (x / idt_cpu_freq) ++#define SEC2WTCOMP(x) (x * idt_cpu_freq) ++ ++/* Use a default timeout of 20s. This should be ++ * safe for CPU clock speeds up to 400MHz, as ++ * ((2 ^ 32) - 1) / (400MHz / 2) = 21s. */ ++#define WATCHDOG_TIMEOUT 20 ++ ++static int timeout = WATCHDOG_TIMEOUT; + + static int nowayout = WATCHDOG_NOWAYOUT; + module_param(nowayout, int, 0); + MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default=" + __MODULE_STRING(WATCHDOG_NOWAYOUT) ")"); + ++/* apply or and nand masks to data read from addr and write back */ ++#define SET_BITS(addr, or, nand) \ ++ writel((readl(&addr) | or) & ~nand, &addr) + + static void rc32434_wdt_start(void) + { +- u32 val; ++ u32 or, nand; + +- if (!rc32434_wdt_device.inuse) { +- writel(0, &wdt_reg->wtcount); ++ /* zero the counter before enabling */ ++ writel(0, &wdt_reg->wtcount); + +- val = RC32434_ERR_WRE; +- writel(readl(&wdt_reg->errcs) | val, &wdt_reg->errcs); ++ /* don't generate a non-maskable interrupt, ++ * do a warm reset instead */ ++ nand = 1 << RC32434_ERR_WNE; ++ or = 1 << RC32434_ERR_WRE; + +- val = RC32434_WTC_EN; +- writel(readl(&wdt_reg->wtc) | val, &wdt_reg->wtc); +- } +- rc32434_wdt_device.running++; +-} ++ /* reset the ERRCS timeout bit in case it's set */ ++ nand |= 1 << RC32434_ERR_WTO; + +-static void rc32434_wdt_stop(void) +-{ +- u32 val; +- +- if (rc32434_wdt_device.running) { ++ SET_BITS(wdt_reg->errcs, or, nand); + +- val = ~RC32434_WTC_EN; +- writel(readl(&wdt_reg->wtc) & val, &wdt_reg->wtc); ++ /* reset WTC timeout bit and enable WDT */ ++ nand = 1 << RC32434_WTC_TO; ++ or = 1 << RC32434_WTC_EN; + +- val = ~RC32434_ERR_WRE; +- writel(readl(&wdt_reg->errcs) & val, &wdt_reg->errcs); ++ SET_BITS(wdt_reg->wtc, or, nand); ++} + +- rc32434_wdt_device.running = 0; +- } ++static void rc32434_wdt_stop(void) ++{ ++ /* Disable WDT */ ++ SET_BITS(wdt_reg->wtc, 0, 1 << RC32434_WTC_EN); + } + +-static void rc32434_wdt_set(int new_timeout) ++static int rc32434_wdt_set(int new_timeout) + { +- u32 cmp = new_timeout * HZ; +- u32 state, val; ++ int max_to = WTCOMP2SEC((u32)-1); + ++ if (new_timeout < 0 || new_timeout > max_to) { ++ printk(KERN_ERR KBUILD_MODNAME ++ ": timeout value must be between 0 and %d", ++ max_to); ++ return -EINVAL; ++ } + timeout = new_timeout; +- /* +- * store and disable WTC +- */ +- state = (u32)(readl(&wdt_reg->wtc) & RC32434_WTC_EN); +- val = ~RC32434_WTC_EN; +- writel(readl(&wdt_reg->wtc) & val, &wdt_reg->wtc); +- +- writel(0, &wdt_reg->wtcount); +- writel(cmp, &wdt_reg->wtcompare); +- +- /* +- * restore WTC +- */ ++ writel(SEC2WTCOMP(timeout), &wdt_reg->wtcompare); + +- writel(readl(&wdt_reg->wtc) | state, &wdt_reg); +-} +- +-static void rc32434_wdt_reset(void) +-{ +- ticks = rc32434_wdt_device.default_ticks; ++ return 0; + } + +-static void rc32434_wdt_update(unsigned long unused) ++static void rc32434_wdt_ping(void) + { +- if (rc32434_wdt_device.running) +- ticks--; +- + writel(0, &wdt_reg->wtcount); +- +- if (rc32434_wdt_device.queue && ticks) +- mod_timer(&rc32434_wdt_device.timer, +- jiffies + RC32434_WDT_INTERVAL); +- else +- complete(&rc32434_wdt_device.stop); + } + + static int rc32434_wdt_open(struct inode *inode, struct file *file) +@@ -142,19 +127,23 @@ static int rc32434_wdt_open(struct inode + if (nowayout) + __module_get(THIS_MODULE); + ++ rc32434_wdt_start(); ++ rc32434_wdt_ping(); ++ + return nonseekable_open(inode, file); + } + + static int rc32434_wdt_release(struct inode *inode, struct file *file) + { +- if (expect_close && nowayout == 0) { ++ if (expect_close == 42) { + rc32434_wdt_stop(); + printk(KERN_INFO KBUILD_MODNAME ": disabling watchdog timer\n"); + module_put(THIS_MODULE); +- } else ++ } else { + printk(KERN_CRIT KBUILD_MODNAME + ": device closed unexpectedly. WDT will not stop !\n"); +- ++ rc32434_wdt_ping(); ++ } + clear_bit(0, &rc32434_wdt_device.inuse); + return 0; + } +@@ -174,10 +163,10 @@ static ssize_t rc32434_wdt_write(struct + if (get_user(c, data + i)) + return -EFAULT; + if (c == 'V') +- expect_close = 1; ++ expect_close = 42; + } + } +- rc32434_wdt_update(0); ++ rc32434_wdt_ping(); + return len; + } + return 0; +@@ -197,11 +186,11 @@ static long rc32434_wdt_ioctl(struct fil + }; + switch (cmd) { + case WDIOC_KEEPALIVE: +- rc32434_wdt_reset(); ++ rc32434_wdt_ping(); + break; + case WDIOC_GETSTATUS: + case WDIOC_GETBOOTSTATUS: +- value = readl(&wdt_reg->wtcount); ++ value = 0; + if (copy_to_user(argp, &value, sizeof(int))) + return -EFAULT; + break; +@@ -218,6 +207,7 @@ static long rc32434_wdt_ioctl(struct fil + break; + case WDIOS_DISABLECARD: + rc32434_wdt_stop(); ++ break; + default: + return -EINVAL; + } +@@ -225,11 +215,9 @@ static long rc32434_wdt_ioctl(struct fil + case WDIOC_SETTIMEOUT: + if (copy_from_user(&new_timeout, argp, sizeof(int))) + return -EFAULT; +- if (new_timeout < 1) ++ if (rc32434_wdt_set(new_timeout)) + return -EINVAL; +- if (new_timeout > MAX_TIMEOUT) +- return -EINVAL; +- rc32434_wdt_set(new_timeout); ++ /* Fall through */ + case WDIOC_GETTIMEOUT: + return copy_to_user(argp, &timeout, sizeof(int)); + default: +@@ -262,7 +250,7 @@ static int rc32434_wdt_probe(struct plat + int ret; + struct resource *r; + +- r = platform_get_resource_byname(pdev, IORESOURCE_MEM, "rb500_wdt_res"); ++ r = platform_get_resource_byname(pdev, IORESOURCE_MEM, "rb532_wdt_res"); + if (!r) { + printk(KERN_ERR KBUILD_MODNAME + "failed to retrieve resources\n"); +@@ -277,24 +265,12 @@ static int rc32434_wdt_probe(struct plat + } + + ret = misc_register(&rc32434_wdt_miscdev); +- + if (ret < 0) { + printk(KERN_ERR KBUILD_MODNAME + "failed to register watchdog device\n"); + goto unmap; + } + +- init_completion(&rc32434_wdt_device.stop); +- rc32434_wdt_device.queue = 0; +- +- clear_bit(0, &rc32434_wdt_device.inuse); +- +- setup_timer(&rc32434_wdt_device.timer, rc32434_wdt_update, 0L); +- +- rc32434_wdt_device.default_ticks = ticks; +- +- rc32434_wdt_start(); +- + printk(banner, timeout); + + return 0; +@@ -306,14 +282,8 @@ unmap: + + static int rc32434_wdt_remove(struct platform_device *pdev) + { +- if (rc32434_wdt_device.queue) { +- rc32434_wdt_device.queue = 0; +- wait_for_completion(&rc32434_wdt_device.stop); +- } + misc_deregister(&rc32434_wdt_miscdev); +- + iounmap(wdt_reg); +- + return 0; + } + + + +From gregkh@mini.kroah.org Fri Mar 13 18:10:35 2009 +Message-Id: <20090314011035.083555445@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:10:02 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Phil Sutter , + Wim Van Sebroeck +Subject: [patch 025/114] WATCHDOG: rc32434_wdt: fix sections +References: <20090314010937.416083662@mini.kroah.org> +Content-Disposition: inline; filename=watchdog-rc32434_wdt-fix-sections.patch +Content-Length: 1587 +Lines: 59 + +2.6.28-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Phil Sutter + +commit d9a8798c4bab5ccd40e45e011f668099cfb3eb83 upstream. + +Fix init and exit sections. + +Signed-off-by: Phil Sutter +Signed-off-by: Wim Van Sebroeck +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/watchdog/rc32434_wdt.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +--- a/drivers/watchdog/rc32434_wdt.c ++++ b/drivers/watchdog/rc32434_wdt.c +@@ -34,7 +34,7 @@ + #include + #include + +-#define VERSION "0.3" ++#define VERSION "0.4" + + static struct { + unsigned long inuse; +@@ -242,10 +242,10 @@ static struct miscdevice rc32434_wdt_mis + .fops = &rc32434_wdt_fops, + }; + +-static char banner[] = KERN_INFO KBUILD_MODNAME ++static char banner[] __devinitdata = KERN_INFO KBUILD_MODNAME + ": Watchdog Timer version " VERSION ", timer margin: %d sec\n"; + +-static int rc32434_wdt_probe(struct platform_device *pdev) ++static int __devinit rc32434_wdt_probe(struct platform_device *pdev) + { + int ret; + struct resource *r; +@@ -280,7 +280,7 @@ unmap: + return ret; + } + +-static int rc32434_wdt_remove(struct platform_device *pdev) ++static int __devexit rc32434_wdt_remove(struct platform_device *pdev) + { + misc_deregister(&rc32434_wdt_miscdev); + iounmap(wdt_reg); +@@ -289,8 +289,8 @@ static int rc32434_wdt_remove(struct pla + + static struct platform_driver rc32434_wdt = { + .probe = rc32434_wdt_probe, +- .remove = rc32434_wdt_remove, +- .driver = { ++ .remove = __devexit_p(rc32434_wdt_remove), ++ .driver = { + .name = "rc32434_wdt", + } + }; + + +From gregkh@mini.kroah.org Fri Mar 13 18:10:35 2009 +Message-Id: <20090314011035.242544713@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:10:03 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Faisal Latif , + Roland Dreier +Subject: [patch 026/114] RDMA/nes: Dont allow userspace QPs to use STag zero +References: <20090314010937.416083662@mini.kroah.org> +Content-Disposition: inline; filename=rdma-nes-don-t-allow-userspace-qps-to-use-stag-zero.patch +Content-Length: 5254 +Lines: 136 + +2.6.28-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Faisal Latif + +commit c12e56ef6951f4fce1afe9ef6aab9243ea9a9b04 upstream. + +STag zero is a special STag that allows consumers to access any bus +address without registering memory. The nes driver unfortunately +allows STag zero to be used even with QPs created by unprivileged +userspace consumers, which means that any process with direct verbs +access to the nes device can read and write any memory accessible to +the underlying PCI device (usually any memory in the system). Such +access is usually given for cluster software such as MPI to use, so +this is a local privilege escalation bug on most systems running this +driver. + +The driver was using STag zero to receive the last streaming mode +data; to allow STag zero to be disabled for unprivileged QPs, the +driver now registers a special MR for this data. + +Signed-off-by: Faisal Latif +Signed-off-by: Roland Dreier +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/infiniband/hw/nes/nes_cm.c | 37 +++++++++++++++++++++++++++++----- + drivers/infiniband/hw/nes/nes_verbs.c | 2 + + drivers/infiniband/hw/nes/nes_verbs.h | 1 + 3 files changed, 35 insertions(+), 5 deletions(-) + +--- a/drivers/infiniband/hw/nes/nes_cm.c ++++ b/drivers/infiniband/hw/nes/nes_cm.c +@@ -2495,12 +2495,14 @@ static int nes_disconnect(struct nes_qp + int ret = 0; + struct nes_vnic *nesvnic; + struct nes_device *nesdev; ++ struct nes_ib_device *nesibdev; + + nesvnic = to_nesvnic(nesqp->ibqp.device); + if (!nesvnic) + return -EINVAL; + + nesdev = nesvnic->nesdev; ++ nesibdev = nesvnic->nesibdev; + + nes_debug(NES_DBG_CM, "netdev refcnt = %u.\n", + atomic_read(&nesvnic->netdev->refcnt)); +@@ -2512,6 +2514,8 @@ static int nes_disconnect(struct nes_qp + } else { + /* Need to free the Last Streaming Mode Message */ + if (nesqp->ietf_frame) { ++ if (nesqp->lsmm_mr) ++ nesibdev->ibdev.dereg_mr(nesqp->lsmm_mr); + pci_free_consistent(nesdev->pcidev, + nesqp->private_data_len+sizeof(struct ietf_mpa_frame), + nesqp->ietf_frame, nesqp->ietf_frame_pbase); +@@ -2545,6 +2549,10 @@ int nes_accept(struct iw_cm_id *cm_id, s + struct iw_cm_event cm_event; + struct nes_hw_qp_wqe *wqe; + struct nes_v4_quad nes_quad; ++ struct nes_ib_device *nesibdev; ++ struct ib_mr *ibmr = NULL; ++ struct ib_phys_buf ibphysbuf; ++ struct nes_pd *nespd; + u32 crc_value; + int ret; + +@@ -2605,6 +2613,26 @@ int nes_accept(struct iw_cm_id *cm_id, s + if (cm_id->remote_addr.sin_addr.s_addr != + cm_id->local_addr.sin_addr.s_addr) { + u64temp = (unsigned long)nesqp; ++ nesibdev = nesvnic->nesibdev; ++ nespd = nesqp->nespd; ++ ibphysbuf.addr = nesqp->ietf_frame_pbase; ++ ibphysbuf.size = conn_param->private_data_len + ++ sizeof(struct ietf_mpa_frame); ++ ibmr = nesibdev->ibdev.reg_phys_mr((struct ib_pd *)nespd, ++ &ibphysbuf, 1, ++ IB_ACCESS_LOCAL_WRITE, ++ (u64 *)&nesqp->ietf_frame); ++ if (!ibmr) { ++ nes_debug(NES_DBG_CM, "Unable to register memory region" ++ "for lSMM for cm_node = %p \n", ++ cm_node); ++ return -ENOMEM; ++ } ++ ++ ibmr->pd = &nespd->ibpd; ++ ibmr->device = nespd->ibpd.device; ++ nesqp->lsmm_mr = ibmr; ++ + u64temp |= NES_SW_CONTEXT_ALIGN>>1; + set_wqe_64bit_value(wqe->wqe_words, + NES_IWARP_SQ_WQE_COMP_CTX_LOW_IDX, +@@ -2615,14 +2643,13 @@ int nes_accept(struct iw_cm_id *cm_id, s + wqe->wqe_words[NES_IWARP_SQ_WQE_TOTAL_PAYLOAD_IDX] = + cpu_to_le32(conn_param->private_data_len + + sizeof(struct ietf_mpa_frame)); +- wqe->wqe_words[NES_IWARP_SQ_WQE_FRAG0_LOW_IDX] = +- cpu_to_le32((u32)nesqp->ietf_frame_pbase); +- wqe->wqe_words[NES_IWARP_SQ_WQE_FRAG0_HIGH_IDX] = +- cpu_to_le32((u32)((u64)nesqp->ietf_frame_pbase >> 32)); ++ set_wqe_64bit_value(wqe->wqe_words, ++ NES_IWARP_SQ_WQE_FRAG0_LOW_IDX, ++ (u64)nesqp->ietf_frame); + wqe->wqe_words[NES_IWARP_SQ_WQE_LENGTH0_IDX] = + cpu_to_le32(conn_param->private_data_len + + sizeof(struct ietf_mpa_frame)); +- wqe->wqe_words[NES_IWARP_SQ_WQE_STAG0_IDX] = 0; ++ wqe->wqe_words[NES_IWARP_SQ_WQE_STAG0_IDX] = ibmr->lkey; + + nesqp->nesqp_context->ird_ord_sizes |= + cpu_to_le32(NES_QPCONTEXT_ORDIRD_LSMM_PRESENT | +--- a/drivers/infiniband/hw/nes/nes_verbs.c ++++ b/drivers/infiniband/hw/nes/nes_verbs.c +@@ -1360,8 +1360,10 @@ static struct ib_qp *nes_create_qp(struc + NES_QPCONTEXT_MISC_RQ_SIZE_SHIFT); + nesqp->nesqp_context->misc |= cpu_to_le32((u32)nesqp->hwqp.sq_encoded_size << + NES_QPCONTEXT_MISC_SQ_SIZE_SHIFT); ++ if (!udata) { + nesqp->nesqp_context->misc |= cpu_to_le32(NES_QPCONTEXT_MISC_PRIV_EN); + nesqp->nesqp_context->misc |= cpu_to_le32(NES_QPCONTEXT_MISC_FAST_REGISTER_EN); ++ } + nesqp->nesqp_context->cqs = cpu_to_le32(nesqp->nesscq->hw_cq.cq_number + + ((u32)nesqp->nesrcq->hw_cq.cq_number << 16)); + u64temp = (u64)nesqp->hwqp.sq_pbase; +--- a/drivers/infiniband/hw/nes/nes_verbs.h ++++ b/drivers/infiniband/hw/nes/nes_verbs.h +@@ -134,6 +134,7 @@ struct nes_qp { + struct ietf_mpa_frame *ietf_frame; + dma_addr_t ietf_frame_pbase; + wait_queue_head_t state_waitq; ++ struct ib_mr *lsmm_mr; + unsigned long socket; + struct nes_hw_qp hwqp; + struct work_struct work; + + +From gregkh@mini.kroah.org Fri Mar 13 18:10:35 2009 +Message-Id: <20090314011035.388345080@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:10:04 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk +Subject: [patch 027/114] USB: option: add BenQ 3g modem information +References: <20090314010937.416083662@mini.kroah.org> +Content-Disposition: inline; filename=usb-option-add-benq-3g-modem-information.patch +Content-Length: 1232 +Lines: 37 + +2.6.28-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Jesse Sung + +commit 28fb66821f884870987a0b5ab064ef651d9f7c16 upstream. + +This patch addes the BenQ 3g modem support to the option driver. + + +From: Jesse Sung +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/option.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -289,6 +289,9 @@ static int option_send_setup(struct tty + #define ERICSSON_VENDOR_ID 0x0bdb + #define ERICSSON_PRODUCT_F3507G 0x1900 + ++#define BENQ_VENDOR_ID 0x04a5 ++#define BENQ_PRODUCT_H10 0x4068 ++ + static struct usb_device_id option_ids[] = { + { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_COLT) }, + { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_RICOLA) }, +@@ -498,6 +501,8 @@ static struct usb_device_id option_ids[] + { USB_DEVICE(ZTE_VENDOR_ID, ZTE_PRODUCT_MF628) }, + { USB_DEVICE(ZTE_VENDOR_ID, ZTE_PRODUCT_CDMA_TECH) }, + { USB_DEVICE(ERICSSON_VENDOR_ID, ERICSSON_PRODUCT_F3507G) }, ++ { USB_DEVICE(BENQ_VENDOR_ID, BENQ_PRODUCT_H10) }, ++ { USB_DEVICE(0x1da5, 0x4515) }, /* BenQ H20 */ + { } /* Terminating entry */ + }; + MODULE_DEVICE_TABLE(usb, option_ids); + + +From gregkh@mini.kroah.org Fri Mar 13 18:10:35 2009 +Message-Id: <20090314011035.534090635@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:10:05 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Karsten Wiese , + David Brownell +Subject: [patch 028/114] USB: EHCI: slow down ITD reuse +References: <20090314010937.416083662@mini.kroah.org> +Content-Disposition: inline; filename=usb-ehci-slow-down-itd-reuse.patch +Content-Length: 5704 +Lines: 181 + +2.6.28-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Karsten Wiese + +commit 9aa09d2f8f4bc440d6db1c3414d4009642875240 upstream. + +Currently ITDs are immediately recycled whenever their URB completes. +However, EHCI hardware can sometimes remember some ITD state. This +means that when the ITD is reused before end-of-frame it may sometimes +cause the hardware to reference bogus state. + +This patch defers reusing such ITDs by moving them into a new ehci member +cached_itd_list. ITDs resting in cached_itd_list are moved back into their +stream's free_list once scan_periodic() detects that the active frame has +elapsed. + +This makes the snd_usb_us122l driver (in kernel since .28) work right +when it's hooked up through EHCI. + +[ dbrownell@users.sourceforge.net: comment fixups ] + +Signed-off-by: Karsten Wiese +Tested-by: Philippe Carriere +Tested-by: Federico Briata +Signed-off-by: David Brownell +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/ehci-hcd.c | 2 + + drivers/usb/host/ehci-mem.c | 1 + drivers/usb/host/ehci-sched.c | 56 ++++++++++++++++++++++++++++++++++++------ + drivers/usb/host/ehci.h | 6 ++++ + 4 files changed, 57 insertions(+), 8 deletions(-) + +--- a/drivers/usb/host/ehci.h ++++ b/drivers/usb/host/ehci.h +@@ -87,6 +87,10 @@ struct ehci_hcd { /* one per controlle + int next_uframe; /* scan periodic, start here */ + unsigned periodic_sched; /* periodic activity count */ + ++ /* list of itds completed while clock_frame was still active */ ++ struct list_head cached_itd_list; ++ unsigned clock_frame; ++ + /* per root hub port */ + unsigned long reset_done [EHCI_MAX_ROOT_PORTS]; + +@@ -210,6 +214,8 @@ timer_action (struct ehci_hcd *ehci, enu + } + } + ++static void free_cached_itd_list(struct ehci_hcd *ehci); ++ + /*-------------------------------------------------------------------------*/ + + #include +--- a/drivers/usb/host/ehci-hcd.c ++++ b/drivers/usb/host/ehci-hcd.c +@@ -485,6 +485,7 @@ static int ehci_init(struct usb_hcd *hcd + * periodic_size can shrink by USBCMD update if hcc_params allows. + */ + ehci->periodic_size = DEFAULT_I_TDPS; ++ INIT_LIST_HEAD(&ehci->cached_itd_list); + if ((retval = ehci_mem_init(ehci, GFP_KERNEL)) < 0) + return retval; + +@@ -497,6 +498,7 @@ static int ehci_init(struct usb_hcd *hcd + + ehci->reclaim = NULL; + ehci->next_uframe = -1; ++ ehci->clock_frame = -1; + + /* + * dedicate a qh for the async ring head, since we couldn't unlink +--- a/drivers/usb/host/ehci-mem.c ++++ b/drivers/usb/host/ehci-mem.c +@@ -128,6 +128,7 @@ static inline void qh_put (struct ehci_q + + static void ehci_mem_cleanup (struct ehci_hcd *ehci) + { ++ free_cached_itd_list(ehci); + if (ehci->async) + qh_put (ehci->async); + ehci->async = NULL; +--- a/drivers/usb/host/ehci-sched.c ++++ b/drivers/usb/host/ehci-sched.c +@@ -1004,7 +1004,8 @@ iso_stream_put(struct ehci_hcd *ehci, st + + is_in = (stream->bEndpointAddress & USB_DIR_IN) ? 0x10 : 0; + stream->bEndpointAddress &= 0x0f; +- stream->ep->hcpriv = NULL; ++ if (stream->ep) ++ stream->ep->hcpriv = NULL; + + if (stream->rescheduled) { + ehci_info (ehci, "ep%d%s-iso rescheduled " +@@ -1653,14 +1654,28 @@ itd_complete ( + (stream->bEndpointAddress & USB_DIR_IN) ? "in" : "out"); + } + iso_stream_put (ehci, stream); +- /* OK to recycle this ITD now that its completion callback ran. */ ++ + done: + usb_put_urb(urb); + itd->urb = NULL; +- itd->stream = NULL; +- list_move(&itd->itd_list, &stream->free_list); +- iso_stream_put(ehci, stream); +- ++ if (ehci->clock_frame != itd->frame || itd->index[7] != -1) { ++ /* OK to recycle this ITD now. */ ++ itd->stream = NULL; ++ list_move(&itd->itd_list, &stream->free_list); ++ iso_stream_put(ehci, stream); ++ } else { ++ /* HW might remember this ITD, so we can't recycle it yet. ++ * Move it to a safe place until a new frame starts. ++ */ ++ list_move(&itd->itd_list, &ehci->cached_itd_list); ++ if (stream->refcount == 2) { ++ /* If iso_stream_put() were called here, stream ++ * would be freed. Instead, just prevent reuse. ++ */ ++ stream->ep->hcpriv = NULL; ++ stream->ep = NULL; ++ } ++ } + return retval; + } + +@@ -2101,6 +2116,20 @@ done: + + /*-------------------------------------------------------------------------*/ + ++static void free_cached_itd_list(struct ehci_hcd *ehci) ++{ ++ struct ehci_itd *itd, *n; ++ ++ list_for_each_entry_safe(itd, n, &ehci->cached_itd_list, itd_list) { ++ struct ehci_iso_stream *stream = itd->stream; ++ itd->stream = NULL; ++ list_move(&itd->itd_list, &stream->free_list); ++ iso_stream_put(ehci, stream); ++ } ++} ++ ++/*-------------------------------------------------------------------------*/ ++ + static void + scan_periodic (struct ehci_hcd *ehci) + { +@@ -2115,10 +2144,17 @@ scan_periodic (struct ehci_hcd *ehci) + * Touches as few pages as possible: cache-friendly. + */ + now_uframe = ehci->next_uframe; +- if (HC_IS_RUNNING (ehci_to_hcd(ehci)->state)) ++ if (HC_IS_RUNNING(ehci_to_hcd(ehci)->state)) { + clock = ehci_readl(ehci, &ehci->regs->frame_index); +- else ++ clock_frame = (clock >> 3) % ehci->periodic_size; ++ } else { + clock = now_uframe + mod - 1; ++ clock_frame = -1; ++ } ++ if (ehci->clock_frame != clock_frame) { ++ free_cached_itd_list(ehci); ++ ehci->clock_frame = clock_frame; ++ } + clock %= mod; + clock_frame = clock >> 3; + +@@ -2277,6 +2313,10 @@ restart: + /* rescan the rest of this frame, then ... */ + clock = now; + clock_frame = clock >> 3; ++ if (ehci->clock_frame != clock_frame) { ++ free_cached_itd_list(ehci); ++ ehci->clock_frame = clock_frame; ++ } + } else { + now_uframe++; + now_uframe %= mod; + + +From gregkh@mini.kroah.org Fri Mar 13 18:10:35 2009 +Message-Id: <20090314011035.691806354@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:10:06 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + NeilBrown +Subject: [patch 029/114] md: avoid races when stopping resync. +References: <20090314010937.416083662@mini.kroah.org> +Content-Disposition: inline; filename=md-avoid-races-when-stopping-resync.patch +Content-Length: 2610 +Lines: 83 + +2.6.28-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: NeilBrown + +commit 73d5c38a9536142e062c35997b044e89166e063b upstream. + +There has been a race in raid10 and raid1 for a long time +which has only recently started showing up due to a scheduler changed. + +When a sync_read request finishes, as soon as reschedule_retry +is called, another thread can mark the resync request as having +completed, so md_do_sync can finish, ->stop can be called, and +->conf can be freed. So using conf after reschedule_retry is not +safe. + +Similarly, when finishing a sync_write, calling md_done_sync must be +the last thing we do, as it allows a chain of events which will free +conf and other data structures. + +The first of these requires action in raid10.c +The second requires action in raid1.c and raid10.c + +Signed-off-by: NeilBrown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/raid1.c | 3 ++- + drivers/md/raid10.c | 7 ++++--- + 2 files changed, 6 insertions(+), 4 deletions(-) + +--- a/drivers/md/raid10.c ++++ b/drivers/md/raid10.c +@@ -1236,6 +1236,7 @@ static void end_sync_read(struct bio *bi + /* for reconstruct, we always reschedule after a read. + * for resync, only after all reads + */ ++ rdev_dec_pending(conf->mirrors[d].rdev, conf->mddev); + if (test_bit(R10BIO_IsRecover, &r10_bio->state) || + atomic_dec_and_test(&r10_bio->remaining)) { + /* we have read all the blocks, +@@ -1243,7 +1244,6 @@ static void end_sync_read(struct bio *bi + */ + reschedule_retry(r10_bio); + } +- rdev_dec_pending(conf->mirrors[d].rdev, conf->mddev); + } + + static void end_sync_write(struct bio *bio, int error) +@@ -1264,11 +1264,13 @@ static void end_sync_write(struct bio *b + + update_head_pos(i, r10_bio); + ++ rdev_dec_pending(conf->mirrors[d].rdev, mddev); + while (atomic_dec_and_test(&r10_bio->remaining)) { + if (r10_bio->master_bio == NULL) { + /* the primary of several recovery bios */ +- md_done_sync(mddev, r10_bio->sectors, 1); ++ sector_t s = r10_bio->sectors; + put_buf(r10_bio); ++ md_done_sync(mddev, s, 1); + break; + } else { + r10bio_t *r10_bio2 = (r10bio_t *)r10_bio->master_bio; +@@ -1276,7 +1278,6 @@ static void end_sync_write(struct bio *b + r10_bio = r10_bio2; + } + } +- rdev_dec_pending(conf->mirrors[d].rdev, mddev); + } + + /* +--- a/drivers/md/raid1.c ++++ b/drivers/md/raid1.c +@@ -1233,8 +1233,9 @@ static void end_sync_write(struct bio *b + update_head_pos(mirror, r1_bio); + + if (atomic_dec_and_test(&r1_bio->remaining)) { +- md_done_sync(mddev, r1_bio->sectors, uptodate); ++ sector_t s = r1_bio->sectors; + put_buf(r1_bio); ++ md_done_sync(mddev, s, uptodate); + } + } + + + +From gregkh@mini.kroah.org Fri Mar 13 18:10:35 2009 +Message-Id: <20090314011035.827129687@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:10:07 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + NeilBrown +Subject: [patch 030/114] md/raid10: Dont call bitmap_cond_end_sync when we are doing recovery. +References: <20090314010937.416083662@mini.kroah.org> +Content-Disposition: inline; filename=md-raid10-don-t-call-bitmap_cond_end_sync-when-we-are-doing-recovery.patch +Content-Length: 1922 +Lines: 52 + +2.6.28-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: NeilBrown + +commit 78200d45cde2a79c0d0ae0407883bb264caa3c18 upstream. + +For raid1/4/5/6, resync (fixing inconsistencies between devices) is +very similar to recovery (rebuilding a failed device onto a spare). +The both walk through the device addresses in order. + +For raid10 it can be quite different. resync follows the 'array' +address, and makes sure all copies are the same. Recover walks +through 'device' addresses and recreates each missing block. + +The 'bitmap_cond_end_sync' function allows the write-intent-bitmap +(When present) to be updated to reflect a partially completed resync. +It makes assumptions which mean that it does not work correctly for +raid10 recovery at all. + +In particularly, it can cause bitmap-directed recovery of a raid10 to +not recovery some of the blocks that need to be recovered. + +So move the call to bitmap_cond_end_sync into the resync path, rather +than being in the common "resync or recovery" path. + + +Signed-off-by: NeilBrown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/raid10.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/md/raid10.c ++++ b/drivers/md/raid10.c +@@ -1750,8 +1750,6 @@ static sector_t sync_request(mddev_t *md + if (!go_faster && conf->nr_waiting) + msleep_interruptible(1000); + +- bitmap_cond_end_sync(mddev->bitmap, sector_nr); +- + /* Again, very different code for resync and recovery. + * Both must result in an r10bio with a list of bios that + * have bi_end_io, bi_sector, bi_bdev set, +@@ -1887,6 +1885,8 @@ static sector_t sync_request(mddev_t *md + /* resync. Schedule a read for every block at this virt offset */ + int count = 0; + ++ bitmap_cond_end_sync(mddev->bitmap, sector_nr); ++ + if (!bitmap_start_sync(mddev->bitmap, sector_nr, + &sync_blocks, mddev->degraded) && + !conf->fullsync && !test_bit(MD_RECOVERY_REQUESTED, &mddev->recovery)) { + + +From gregkh@mini.kroah.org Fri Mar 13 18:10:36 2009 +Message-Id: <20090314011035.961760837@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:10:08 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + NeilBrown +Subject: [patch 031/114] md/raid10: Dont skip more than 1 bitmap-chunk at a time during recovery. +References: <20090314010937.416083662@mini.kroah.org> +Content-Disposition: inline; filename=md-raid10-don-t-skip-more-than-1-bitmap-chunk-at-a-time-during-recovery.patch +Content-Length: 1458 +Lines: 51 + +2.6.28-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: NeilBrown + +commit 09b4068a7fe442efc40e9dcbcf5ff37c3338ab15 upstream. + +When doing recovery on a raid10 with a write-intent bitmap, we only +need to recovery chunks that are flagged in the bitmap. + +However if we choose to skip a chunk as it isn't flag, the code +currently skips the whole raid10-chunk, thus it might not recovery +some blocks that need recovering. + +This patch fixes it. + +In case that is confusing, it might help to understand that there +is a 'raid10 chunk size' which guides how data is distributed across +the devices, and a 'bitmap chunk size' which says how much data +corresponds to a single bit in the bitmap. + +This bug only affects cases where the bitmap chunk size is smaller +than the raid10 chunk size. + + + +Signed-off-by: NeilBrown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/raid10.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/md/raid10.c ++++ b/drivers/md/raid10.c +@@ -2011,13 +2011,13 @@ static sector_t sync_request(mddev_t *md + /* There is nowhere to write, so all non-sync + * drives must be failed, so try the next chunk... + */ +- { +- sector_t sec = max_sector - sector_nr; +- sectors_skipped += sec; ++ if (sector_nr + max_sync < max_sector) ++ max_sector = sector_nr + max_sync; ++ ++ sectors_skipped += (max_sector - sector_nr); + chunks_skipped ++; + sector_nr = max_sector; + goto skipped; +- } + } + + static int run(mddev_t *mddev) + + +From gregkh@mini.kroah.org Fri Mar 13 18:10:36 2009 +Message-Id: <20090314011036.119851959@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:10:09 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Clemens Ladisch , + Takashi Iwai +Subject: [patch 032/114] sound: virtuoso: revert "do not overwrite EEPROM on Xonar D2/D2X" +References: <20090314010937.416083662@mini.kroah.org> +Content-Disposition: inline; filename=sound-virtuoso-revert-do-not-overwrite-eeprom-on-xonar-d2-d2x.patch +Content-Length: 3425 +Lines: 89 + +2.6.28-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Clemens Ladisch + +commit 6ce6c473a7fd742fdb0db95841e2c4c6b37337c5 upstream. + +This reverts commit 7e86c0e6850504ec9516b953f316a47277825e33 ("do not +overwrite EEPROM on Xonar D2/D2X") because it did not actually help with +the problem. + +More user reports show that the overwriting of the EEPROM is not +triggered by using this driver but by installing Linux, and that the +installation of any other operating system (even one without any CMI8788 +driver) has the same effect. In other words, the presence of this +driver does not have any effect on the occurrence of the error. (So +far, the available evidence seems to point to a BIOS bug.) + +Furthermore, it turns out that the EEPROM chip is protected against +stray write commands by the command format and by requiring a separate +write-enable command, so the error scenario in the previous commit (that +SPI writes can be misinterpreted as an EEPROM write command) is not even +theoretically possible. + +The mixer control that was removed as a consequence of the previous +commit can only be partially emulated in userspace, which also means it +cannot be seen be the in-kernel OSS API emulation, so it is better to +revert that change. + +Signed-off-by: Clemens Ladisch +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/oxygen/virtuoso.c | 17 ++++------------- + 1 file changed, 4 insertions(+), 13 deletions(-) + +--- a/sound/pci/oxygen/virtuoso.c ++++ b/sound/pci/oxygen/virtuoso.c +@@ -26,7 +26,7 @@ + * SPI 0 -> 1st PCM1796 (front) + * SPI 1 -> 2nd PCM1796 (surround) + * SPI 2 -> 3rd PCM1796 (center/LFE) +- * SPI 4 -> 4th PCM1796 (back) and EEPROM self-destruct (do not use!) ++ * SPI 4 -> 4th PCM1796 (back) + * + * GPIO 2 -> M0 of CS5381 + * GPIO 3 -> M1 of CS5381 +@@ -207,12 +207,6 @@ static void xonar_gpio_changed(struct ox + static inline void pcm1796_write_spi(struct oxygen *chip, unsigned int codec, + u8 reg, u8 value) + { +- /* +- * We don't want to do writes on SPI 4 because the EEPROM, which shares +- * the same pin, might get confused and broken. We'd better take care +- * that the driver works with the default register values ... +- */ +-#if 0 + /* maps ALSA channel pair number to SPI output */ + static const u8 codec_map[4] = { + 0, 1, 2, 4 +@@ -223,7 +217,6 @@ static inline void pcm1796_write_spi(str + (codec_map[codec] << OXYGEN_SPI_CODEC_SHIFT) | + OXYGEN_SPI_CEN_LATCH_CLOCK_HI, + (reg << 8) | value); +-#endif + } + + static inline void pcm1796_write_i2c(struct oxygen *chip, unsigned int codec, +@@ -757,9 +750,6 @@ static const DECLARE_TLV_DB_SCALE(cs4362 + + static int xonar_d2_control_filter(struct snd_kcontrol_new *template) + { +- if (!strncmp(template->name, "Master Playback ", 16)) +- /* disable volume/mute because they would require SPI writes */ +- return 1; + if (!strncmp(template->name, "CD Capture ", 11)) + /* CD in is actually connected to the video in pin */ + template->private_value ^= AC97_CD ^ AC97_VIDEO; +@@ -850,8 +840,9 @@ static const struct oxygen_model model_x + .dac_volume_min = 0x0f, + .dac_volume_max = 0xff, + .misc_flags = OXYGEN_MISC_MIDI, +- .function_flags = OXYGEN_FUNCTION_SPI, +- .dac_i2s_format = OXYGEN_I2S_FORMAT_I2S, ++ .function_flags = OXYGEN_FUNCTION_SPI | ++ OXYGEN_FUNCTION_ENABLE_SPI_4_5, ++ .dac_i2s_format = OXYGEN_I2S_FORMAT_LJUST, + .adc_i2s_format = OXYGEN_I2S_FORMAT_LJUST, + }; + + + +From gregkh@mini.kroah.org Fri Mar 13 18:10:36 2009 +Message-Id: <20090314011036.269661844@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:10:10 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Takashi Iwai +Subject: [patch 033/114] ALSA: usb-audio - Fix non-continuous rate detection +References: <20090314010937.416083662@mini.kroah.org> +Content-Disposition: inline; filename=alsa-usb-audio-fix-non-continuous-rate-detection.patch +Content-Length: 1928 +Lines: 62 + +2.6.28-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Takashi Iwai + +commit 0412558c873f716efe902b397af0653a550f7341 upstream. + +The detection of non-continuous rates (given via rate tables) isn't +processed properly (e.g. for type II). + +This patch fixes and simplifies the detection code. + +Tested-by: Joris van Rantwijk +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/usb/usbaudio.c | 17 +++++++++-------- + 1 file changed, 9 insertions(+), 8 deletions(-) + +--- a/sound/usb/usbaudio.c ++++ b/sound/usb/usbaudio.c +@@ -2524,7 +2524,6 @@ static int parse_audio_format_rates(stru + * build the rate table and bitmap flags + */ + int r, idx; +- unsigned int nonzero_rates = 0; + + fp->rate_table = kmalloc(sizeof(int) * nr_rates, GFP_KERNEL); + if (fp->rate_table == NULL) { +@@ -2532,24 +2531,26 @@ static int parse_audio_format_rates(stru + return -1; + } + +- fp->nr_rates = nr_rates; +- fp->rate_min = fp->rate_max = combine_triple(&fmt[8]); ++ fp->nr_rates = 0; ++ fp->rate_min = fp->rate_max = 0; + for (r = 0, idx = offset + 1; r < nr_rates; r++, idx += 3) { + unsigned int rate = combine_triple(&fmt[idx]); ++ if (!rate) ++ continue; + /* C-Media CM6501 mislabels its 96 kHz altsetting */ + if (rate == 48000 && nr_rates == 1 && + chip->usb_id == USB_ID(0x0d8c, 0x0201) && + fp->altsetting == 5 && fp->maxpacksize == 392) + rate = 96000; +- fp->rate_table[r] = rate; +- nonzero_rates |= rate; +- if (rate < fp->rate_min) ++ fp->rate_table[fp->nr_rates] = rate; ++ if (!fp->rate_min || rate < fp->rate_min) + fp->rate_min = rate; +- else if (rate > fp->rate_max) ++ if (!fp->rate_max || rate > fp->rate_max) + fp->rate_max = rate; + fp->rates |= snd_pcm_rate_to_rate_bit(rate); ++ fp->nr_rates++; + } +- if (!nonzero_rates) { ++ if (!fp->nr_rates) { + hwc_debug("All rates were zero. Skipping format!\n"); + return -1; + } + + +From gregkh@mini.kroah.org Fri Mar 13 18:10:36 2009 +Message-Id: <20090314011036.420604278@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:10:11 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Joris van Rantwijk , + Takashi Iwai +Subject: [patch 034/114] ALSA: usb-audio - Workaround for misdetected sample rate with CM6207 +References: <20090314010937.416083662@mini.kroah.org> +Content-Disposition: inline; filename=alsa-usb-audio-workaround-for-misdetected-sample-rate-with-cm6207.patch +Content-Length: 1084 +Lines: 31 + +2.6.28-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Joris van Rantwijk + +commit 3b03cc5b86e2052295b9b484f37226ee15c87924 upstream. + +The CM6207 incorrectly advertises its 96 kHz playback setting as 48 kHz +in its USB device descriptor. This patch extends an existing workaround +in usbaudio.c to also cover the CM6207. + +This resolves issue 0004249 in the ALSA bug tracker. + +Signed-off-by: Joris van Rantwijk +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/usb/usbaudio.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/sound/usb/usbaudio.c ++++ b/sound/usb/usbaudio.c +@@ -2539,7 +2539,8 @@ static int parse_audio_format_rates(stru + continue; + /* C-Media CM6501 mislabels its 96 kHz altsetting */ + if (rate == 48000 && nr_rates == 1 && +- chip->usb_id == USB_ID(0x0d8c, 0x0201) && ++ (chip->usb_id == USB_ID(0x0d8c, 0x0201) || ++ chip->usb_id == USB_ID(0x0d8c, 0x0102)) && + fp->altsetting == 5 && fp->maxpacksize == 392) + rate = 96000; + fp->rate_table[fp->nr_rates] = rate; + + +From gregkh@mini.kroah.org Fri Mar 13 18:10:36 2009 +Message-Id: <20090314011036.569707036@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:10:12 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Clemens Ladisch , + Takashi Iwai +Subject: [patch 035/114] sound: usb-audio: fix uninitialized variable with M-Audio MIDI interfaces +References: <20090314010937.416083662@mini.kroah.org> +Content-Disposition: inline; filename=sound-usb-audio-fix-uninitialized-variable-with-m-audio-midi-interfaces.patch +Content-Length: 1179 +Lines: 32 + +2.6.28-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Clemens Ladisch + +commit e156ac4c571e3be741bc411e58820b74a9295c72 upstream. + +Fix the snd_usbmidi_create_endpoints_midiman() function, which forgot to +set the out_interval member of the endpoint info structure for Midiman/ +M-Audio devices. Since kernel 2.6.24, any non-zero value makes the +driver use interrupt transfers instead of bulk transfers. With EHCI +controllers, these random interval values result in unbearably large +latencies for output MIDI transfers. + +Signed-off-by: Clemens Ladisch +Reported-by: David +Tested-by: David +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/usb/usbmidi.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/usb/usbmidi.c ++++ b/sound/usb/usbmidi.c +@@ -1628,6 +1628,7 @@ static int snd_usbmidi_create_endpoints_ + } + + ep_info.out_ep = get_endpoint(hostif, 2)->bEndpointAddress & USB_ENDPOINT_NUMBER_MASK; ++ ep_info.out_interval = 0; + ep_info.out_cables = endpoint->out_cables & 0x5555; + err = snd_usbmidi_out_endpoint_create(umidi, &ep_info, &umidi->endpoints[0]); + if (err < 0) + + +From gregkh@mini.kroah.org Fri Mar 13 18:10:36 2009 +Message-Id: <20090314011036.723675766@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:10:13 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Steve Chen , + Takashi Iwai +Subject: [patch 036/114] ALSA: fix excessive background noise introduced by OSS emulation rate shrink +References: <20090314010937.416083662@mini.kroah.org> +Content-Disposition: inline; filename=alsa-fix-excessive-background-noise-introduced-by-oss-emulation-rate-shrink.patch +Content-Length: 732 +Lines: 27 + +2.6.28-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Steve Chen + +commit 5370d96f85962769ea3df3a81cc885f257c51589 upstream. + +Incorrect variable was used to get the next sample which caused S2 +to be stuck with the same value resulting in loud background noise. + +Signed-off-by: Steve Chen +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/core/oss/rate.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/core/oss/rate.c ++++ b/sound/core/oss/rate.c +@@ -157,7 +157,7 @@ static void resample_shrink(struct snd_p + while (dst_frames1 > 0) { + S1 = S2; + if (src_frames1-- > 0) { +- S1 = *src; ++ S2 = *src; + src += src_step; + } + if (pos & ~R_MASK) { + + +From gregkh@mini.kroah.org Fri Mar 13 18:10:36 2009 +Message-Id: <20090314011036.852308445@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:10:14 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Takashi Iwai +Subject: [patch 037/114] ALSA: hda - Fix digital mic on dell-m4-1 and dell-m4-3 +References: <20090314010937.416083662@mini.kroah.org> +Content-Disposition: inline; filename=alsa-hda-fix-digital-mic-on-dell-m4-1-and-dell-m4-3.patch +Content-Length: 699 +Lines: 26 + +2.6.28-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Takashi Iwai + +commit ea18aa464452c3e6550320d247c0306aaa2d156f upstream. + +Fix num_dmuxes initialization for dell-m4-1 and dell-m4-3 models +of IDT 92HD71bxx codec, which was wrongly set to zero. + +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_sigmatel.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/pci/hda/patch_sigmatel.c ++++ b/sound/pci/hda/patch_sigmatel.c +@@ -4668,7 +4668,7 @@ again: + case STAC_DELL_M4_3: + spec->num_dmics = 1; + spec->num_smuxes = 0; +- spec->num_dmuxes = 0; ++ spec->num_dmuxes = 1; + break; + default: + spec->num_dmics = STAC92HD71BXX_NUM_DMICS; + + +From gregkh@mini.kroah.org Fri Mar 13 18:10:37 2009 +Message-Id: <20090314011036.982006986@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:10:15 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Luke Yelavich , + Takashi Iwai +Subject: [patch 038/114] ALSA: hda - add another MacBook Pro 3,1 SSID +References: <20090314010937.416083662@mini.kroah.org> +Content-Disposition: inline; filename=alsa-hda-add-another-macbook-pro-3-1-ssid.patch +Content-Length: 817 +Lines: 26 + +2.6.28-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Luke Yelavich + +commit 2d4663816064fabb68935f920bbd7ccdc7f9392d upstream. + +Reference: Ubuntu bug #33245 + https://bugs.launchpad.net/bugs/332456 + +Signed-off-by: Luke Yelavich +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_realtek.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -6778,6 +6778,7 @@ static int patch_alc882(struct hda_codec + case 0x106b2800: /* AppleTV */ + board_config = ALC885_IMAC24; + break; ++ case 0x106b00a0: /* MacBookPro3,1 - Another revision */ + case 0x106b00a1: /* Macbook (might be wrong - PCI SSID?) */ + case 0x106b00a4: /* MacbookPro4,1 */ + case 0x106b2c00: /* Macbook Pro rev3 */ + + +From gregkh@mini.kroah.org Fri Mar 13 18:10:37 2009 +Message-Id: <20090314011037.141690419@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:10:16 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Anssi Hannula , + Takashi Iwai +Subject: [patch 039/114] ALSA: aw2: do not grab every saa7146 based device +References: <20090314010937.416083662@mini.kroah.org> +Content-Disposition: inline; filename=alsa-aw2-do-not-grab-every-saa7146-based-device.patch +Content-Length: 1088 +Lines: 34 + +2.6.28-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Anssi Hannula + +commit e8bf069c419c1dc0657e02636441fe1179a9db14 upstream. + +Audiowerk2 driver snd-aw2 is bound to any saa7146 device as it does not +check subsystem ids. Many DVB devices are saa7146 based, so aw2 driver +grabs them as well. + +According to http://lkml.org/lkml/2008/10/15/311 aw2 devices have the +subsystem ids set to 0, the saa7146 default. + +Fix conflicts with DVB devices by checking for subsystem ids = 0 +specifically. + +Signed-off-by: Anssi Hannula +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/aw2/aw2-alsa.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/pci/aw2/aw2-alsa.c ++++ b/sound/pci/aw2/aw2-alsa.c +@@ -165,7 +165,7 @@ module_param_array(enable, bool, NULL, 0 + MODULE_PARM_DESC(enable, "Enable Audiowerk2 soundcard."); + + static struct pci_device_id snd_aw2_ids[] = { +- {PCI_VENDOR_ID_SAA7146, PCI_DEVICE_ID_SAA7146, PCI_ANY_ID, PCI_ANY_ID, ++ {PCI_VENDOR_ID_SAA7146, PCI_DEVICE_ID_SAA7146, 0, 0, + 0, 0, 0}, + {0} + }; + + +From gregkh@mini.kroah.org Fri Mar 13 18:10:37 2009 +Message-Id: <20090314011037.297941272@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:10:17 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Michael Spang , + Thomas Renninger , + Zhang Rui , + Andi Kleen , + Carlos Corbacho , + Len Brown , + "Rafael J. Wysocki" +Subject: [patch 040/114] acer-wmi: fix regression in backlight detection +References: <20090314010937.416083662@mini.kroah.org> +Content-Disposition: inline; filename=acer-wmi-fix-regression-in-backlight-detection.patch +Content-Length: 1666 +Lines: 42 + +2.6.28-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Michael Spang + +commit 1ba869ec581fd9078b684c56c399ffe3d2345e27 upstream. + +Currently we disable the Acer WMI backlight device if there is no ACPI +backlight device. As a result, we end up with no backlight device at all. + We should instead disable it if there is an ACPI device, as the other +laptop drivers do. This regression was introduced in febf2d9 ("Acer-WMI: +fingers off backlight if video.ko is serving this functionality"). + +Each laptop driver with backlight support got a similar change around +febf2d9. The changes to the other drivers look correct; see e.g. +a598c82f for a similar but correct change. The regression is also in +2.6.28. + +Signed-off-by: Michael Spang +Acked-by: Thomas Renninger +Cc: Zhang Rui +Cc: Andi Kleen +Cc: Carlos Corbacho +Cc: Len Brown +Cc: "Rafael J. Wysocki" +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/misc/acer-wmi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/misc/acer-wmi.c ++++ b/drivers/misc/acer-wmi.c +@@ -1297,7 +1297,7 @@ static int __init acer_wmi_init(void) + + set_quirks(); + +- if (!acpi_video_backlight_support() && has_cap(ACER_CAP_BRIGHTNESS)) { ++ if (acpi_video_backlight_support() && has_cap(ACER_CAP_BRIGHTNESS)) { + interface->capability &= ~ACER_CAP_BRIGHTNESS; + printk(ACER_INFO "Brightness must be controlled by " + "generic video driver\n"); + + +From gregkh@mini.kroah.org Fri Mar 13 18:10:37 2009 +Message-Id: <20090314011037.453800119@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:10:18 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Tejun Heo , + Nick Piggin , + "David S. Miller" +Subject: [patch 041/114] vmalloc: call flush_cache_vunmap() from unmap_kernel_range() +References: <20090314010937.416083662@mini.kroah.org> +Content-Disposition: inline; filename=vmalloc-call-flush_cache_vunmap-from-unmap_kernel_range.patch +Content-Length: 916 +Lines: 32 + +2.6.28-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Tejun Heo + +commit f6fcba7014f9cc535fa75ef98c008b24e49e2212 upstream. + +Impact: proper vcache flush on unmap_kernel_range() + +flush_cache_vunmap() should be called before pages are unmapped. Add +a call to it in unmap_kernel_range(). + +Signed-off-by: Tejun Heo +Acked-by: Nick Piggin +Acked-by: David S. Miller +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/vmalloc.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/mm/vmalloc.c ++++ b/mm/vmalloc.c +@@ -997,6 +997,8 @@ void __init vmalloc_init(void) + void unmap_kernel_range(unsigned long addr, unsigned long size) + { + unsigned long end = addr + size; ++ ++ flush_cache_vunmap(addr, end); + vunmap_page_range(addr, end); + flush_tlb_kernel_range(addr, end); + } + + +From gregkh@mini.kroah.org Fri Mar 13 18:10:37 2009 +Message-Id: <20090314011037.610595405@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:10:19 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Martin Schwidefsky , + Heiko Carstens +Subject: [patch 042/114] Fix fixpoint divide exception in acct_update_integrals +References: <20090314010937.416083662@mini.kroah.org> +Content-Disposition: inline; filename=fix-fixpoint-divide-exception-in-acct_update_integrals.patch +Content-Length: 3546 +Lines: 96 + +2.6.28-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Heiko Carstens + +commit 6d5b5acca9e566515ef3f1ed617e7295c4f94345 upstream. + +Frans Pop reported the crash below when running an s390 kernel under Hercules: + + Kernel BUG at 000738b4 verbose debug info unavailable! + fixpoint divide exception: 0009 #1! SMP + Modules linked in: nfs lockd nfs_acl sunrpc ctcm fsm tape_34xx + cu3088 tape ccwgroup tape_class ext3 jbd mbcache dm_mirror dm_log dm_snapshot + dm_mod dasd_eckd_mod dasd_mod + CPU: 0 Not tainted 2.6.27.19 #13 + Process awk (pid: 2069, task: 0f9ed9b8, ksp: 0f4f7d18) + Krnl PSW : 070c1000 800738b4 (acct_update_integrals+0x4c/0x118) + R:0 T:1 IO:1 EX:1 Key:0 M:1 W:0 P:0 AS:0 CC:1 PM:0 + Krnl GPRS: 00000000 000007d0 7fffffff fffff830 + 00000000 ffffffff 00000002 0f9ed9b8 + 00000000 00008ca0 00000000 0f9ed9b8 + 0f9edda4 8007386e 0f4f7ec8 0f4f7e98 + Krnl Code: 800738aa: a71807d0 lhi %r1,2000 + 800738ae: 8c200001 srdl %r2,1 + 800738b2: 1d21 dr %r2,%r1 + >800738b4: 5810d10e l %r1,270(%r13) + 800738b8: 1823 lr %r2,%r3 + 800738ba: 4130f060 la %r3,96(%r15) + 800738be: 0de1 basr %r14,%r1 + 800738c0: 5800f060 l %r0,96(%r15) + Call Trace: + ( <000000000004fdea>! blocking_notifier_call_chain+0x1e/0x2c) + <0000000000038502>! do_exit+0x106/0x7c0 + <0000000000038c36>! do_group_exit+0x7a/0xb4 + <0000000000038c8e>! SyS_exit_group+0x1e/0x30 + <0000000000021c28>! sysc_do_restart+0x12/0x16 + <0000000077e7e924>! 0x77e7e924 + +Reason for this is that cpu time accounting usually only happens from +interrupt context, but acct_update_integrals gets also called from +process context with interrupts enabled. + +So in acct_update_integrals we may end up with the following scenario: + +Between reading tsk->stime/tsk->utime and tsk->acct_timexpd an interrupt +happens which updates accouting values. This causes acct_timexpd to be +greater than the former stime + utime. The subsequent calculation of + + dtime = cputime_sub(time, tsk->acct_timexpd); + +will be negative and the division performed by + + cputime_to_jiffies(dtime) + +will generate an exception since the result won't fit into a 32 bit +register. + +In order to fix this just always disable interrupts while accessing any +of the accounting values. + +Reported by: Frans Pop +Tested by: Frans Pop +Cc: Martin Schwidefsky +Signed-off-by: Heiko Carstens +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/tsacct.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/kernel/tsacct.c ++++ b/kernel/tsacct.c +@@ -120,8 +120,10 @@ void acct_update_integrals(struct task_s + if (likely(tsk->mm)) { + cputime_t time, dtime; + struct timeval value; ++ unsigned long flags; + u64 delta; + ++ local_irq_save(flags); + time = tsk->stime + tsk->utime; + dtime = cputime_sub(time, tsk->acct_timexpd); + jiffies_to_timeval(cputime_to_jiffies(dtime), &value); +@@ -129,10 +131,12 @@ void acct_update_integrals(struct task_s + delta = delta * USEC_PER_SEC + value.tv_usec; + + if (delta == 0) +- return; ++ goto out; + tsk->acct_timexpd = time; + tsk->acct_rss_mem1 += delta * get_mm_rss(tsk->mm); + tsk->acct_vm_mem1 += delta * tsk->mm->total_vm; ++ out: ++ local_irq_restore(flags); + } + } + + + +From gregkh@mini.kroah.org Fri Mar 13 18:10:37 2009 +Message-Id: <20090314011037.745513526@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:10:20 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Mauro Carvalho Chehab +Subject: [patch 043/114] 8250: fix boot hang with serial console when using with Serial Over Lan port +References: <20090314010937.416083662@mini.kroah.org> +Content-Disposition: inline; filename=8250-fix-boot-hang-with-serial-console-when-using-with-serial-over-lan-port.patch +Content-Length: 5890 +Lines: 166 + +2.6.28-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Mauro Carvalho Chehab + +commit b6adea334c6c89d5e6c94f9196bbf3a279cb53bd upstream. + +Intel 8257x Ethernet boards have a feature called Serial Over Lan. + +This feature works by emulating a serial port, and it is detected by +kernel as a normal 8250 port. However, this emulation is not perfect, as +also noticed on changeset 7500b1f602aad75901774a67a687ee985d85893f. + +Before this patch, the kernel were trying to check if the serial TX is +capable of work using IRQ's. + +This were done with a code similar this: + + serial_outp(up, UART_IER, UART_IER_THRI); + lsr = serial_in(up, UART_LSR); + iir = serial_in(up, UART_IIR); + serial_outp(up, UART_IER, 0); + + if (lsr & UART_LSR_TEMT && iir & UART_IIR_NO_INT) + up->bugs |= UART_BUG_TXEN; + +This works fine for other 8250 ports, but, on 8250-emulated SoL port, the +chip is a little lazy to down UART_IIR_NO_INT at UART_IIR register. + +Due to that, UART_BUG_TXEN is sometimes enabled. However, as TX IRQ keeps +working, and the TX polling is now enabled, the driver miss-interprets the +IRQ received later, hanging up the machine until a key is pressed at the +serial console. + +This is the 6 version of this patch. Previous versions were trying to +introduce a large enough delay between serial_outp and serial_in(up, +UART_IIR), but not taking forever. However, the needed delay couldn't be +safely determined. + +At the experimental tests, a delay of 1us solves most of the cases, but +still hangs sometimes. Increasing the delay to 5us was better, but still +doesn't solve. A very high delay of 50 ms seemed to work every time. + +However, poking around with delays and pray for it to be enough doesn't +seem to be a good approach, even for a quirk. + +So, instead of playing with random large arbitrary delays, let's just +disable UART_BUG_TXEN for all SoL ports. + +[akpm@linux-foundation.org: fix warnings] +Signed-off-by: Mauro Carvalho Chehab +Cc: Alan Cox +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/serial/8250.c | 15 +++++++++++++++ + drivers/serial/8250_pci.c | 36 ++++++++++++++++++++++++++++++++++++ + include/linux/pci_ids.h | 3 +++ + include/linux/serial_core.h | 1 + + 4 files changed, 55 insertions(+) + +--- a/drivers/serial/8250.c ++++ b/drivers/serial/8250.c +@@ -2014,6 +2014,20 @@ static int serial8250_startup(struct uar + + serial8250_set_mctrl(&up->port, up->port.mctrl); + ++ /* Serial over Lan (SoL) hack: ++ Intel 8257x Gigabit ethernet chips have a ++ 16550 emulation, to be used for Serial Over Lan. ++ Those chips take a longer time than a normal ++ serial device to signalize that a transmission ++ data was queued. Due to that, the above test generally ++ fails. One solution would be to delay the reading of ++ iir. However, this is not reliable, since the timeout ++ is variable. So, let's just don't test if we receive ++ TX irq. This way, we'll never enable UART_BUG_TXEN. ++ */ ++ if (up->port.flags & UPF_NO_TXEN_TEST) ++ goto dont_test_tx_en; ++ + /* + * Do a quick test to see if we receive an + * interrupt when we enable the TX irq. +@@ -2033,6 +2047,7 @@ static int serial8250_startup(struct uar + up->bugs &= ~UART_BUG_TXEN; + } + ++dont_test_tx_en: + spin_unlock_irqrestore(&up->port.lock, flags); + + /* +--- a/drivers/serial/8250_pci.c ++++ b/drivers/serial/8250_pci.c +@@ -758,6 +758,21 @@ pci_default_setup(struct serial_private + return setup_port(priv, port, bar, offset, board->reg_shift); + } + ++static int skip_tx_en_setup(struct serial_private *priv, ++ const struct pciserial_board *board, ++ struct uart_port *port, int idx) ++{ ++ port->flags |= UPF_NO_TXEN_TEST; ++ printk(KERN_DEBUG "serial8250: skipping TxEn test for device " ++ "[%04x:%04x] subsystem [%04x:%04x]\n", ++ priv->dev->vendor, ++ priv->dev->device, ++ priv->dev->subsystem_vendor, ++ priv->dev->subsystem_device); ++ ++ return pci_default_setup(priv, board, port, idx); ++} ++ + /* This should be in linux/pci_ids.h */ + #define PCI_VENDOR_ID_SBSMODULARIO 0x124B + #define PCI_SUBVENDOR_ID_SBSMODULARIO 0x124B +@@ -824,6 +839,27 @@ static struct pci_serial_quirk pci_seria + .init = pci_inteli960ni_init, + .setup = pci_default_setup, + }, ++ { ++ .vendor = PCI_VENDOR_ID_INTEL, ++ .device = PCI_DEVICE_ID_INTEL_8257X_SOL, ++ .subvendor = PCI_ANY_ID, ++ .subdevice = PCI_ANY_ID, ++ .setup = skip_tx_en_setup, ++ }, ++ { ++ .vendor = PCI_VENDOR_ID_INTEL, ++ .device = PCI_DEVICE_ID_INTEL_82573L_SOL, ++ .subvendor = PCI_ANY_ID, ++ .subdevice = PCI_ANY_ID, ++ .setup = skip_tx_en_setup, ++ }, ++ { ++ .vendor = PCI_VENDOR_ID_INTEL, ++ .device = PCI_DEVICE_ID_INTEL_82573E_SOL, ++ .subvendor = PCI_ANY_ID, ++ .subdevice = PCI_ANY_ID, ++ .setup = skip_tx_en_setup, ++ }, + /* + * ITE + */ +--- a/include/linux/pci_ids.h ++++ b/include/linux/pci_ids.h +@@ -2317,6 +2317,9 @@ + #define PCI_DEVICE_ID_INTEL_82378 0x0484 + #define PCI_DEVICE_ID_INTEL_I960 0x0960 + #define PCI_DEVICE_ID_INTEL_I960RM 0x0962 ++#define PCI_DEVICE_ID_INTEL_8257X_SOL 0x1062 ++#define PCI_DEVICE_ID_INTEL_82573E_SOL 0x1085 ++#define PCI_DEVICE_ID_INTEL_82573L_SOL 0x108F + #define PCI_DEVICE_ID_INTEL_82815_MC 0x1130 + #define PCI_DEVICE_ID_INTEL_82815_CGC 0x1132 + #define PCI_DEVICE_ID_INTEL_82092AA_0 0x1221 +--- a/include/linux/serial_core.h ++++ b/include/linux/serial_core.h +@@ -288,6 +288,7 @@ struct uart_port { + #define UPF_HARDPPS_CD ((__force upf_t) (1 << 11)) + #define UPF_LOW_LATENCY ((__force upf_t) (1 << 13)) + #define UPF_BUGGY_UART ((__force upf_t) (1 << 14)) ++#define UPF_NO_TXEN_TEST ((__force upf_t) (1 << 15)) + #define UPF_MAGIC_MULTIPLIER ((__force upf_t) (1 << 16)) + #define UPF_CONS_FLOW ((__force upf_t) (1 << 23)) + #define UPF_SHARE_IRQ ((__force upf_t) (1 << 24)) + + +From gregkh@mini.kroah.org Fri Mar 13 18:10:38 2009 +Message-Id: <20090314011037.899666142@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:10:21 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Alok N Kataria , + Zachary Amsden , + Ingo Molnar +Subject: [patch 044/114] x86, vmi: TSC going backwards check in vmi clocksource +References: <20090314010937.416083662@mini.kroah.org> +Content-Disposition: inline; filename=x86-vmi-tsc-going-backwards-check-in-vmi-clocksource.patch +Content-Length: 1059 +Lines: 36 + +2.6.28-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Alok N Kataria + +commit 48ffc70b675aa7798a52a2e92e20f6cce9140b3d upstream. + +Impact: fix time warps under vmware + +Similar to the check for TSC going backwards in the TSC clocksource, +we also need this check for VMI clocksource. + +Signed-off-by: Alok N Kataria +Cc: Zachary Amsden +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/vmiclock_32.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/arch/x86/kernel/vmiclock_32.c ++++ b/arch/x86/kernel/vmiclock_32.c +@@ -283,10 +283,13 @@ void __devinit vmi_time_ap_init(void) + #endif + + /** vmi clocksource */ ++static struct clocksource clocksource_vmi; + + static cycle_t read_real_cycles(void) + { +- return vmi_timer_ops.get_cycle_counter(VMI_CYCLES_REAL); ++ cycle_t ret = (cycle_t)vmi_timer_ops.get_cycle_counter(VMI_CYCLES_REAL); ++ return ret >= clocksource_vmi.cycle_last ? ++ ret : clocksource_vmi.cycle_last; + } + + static struct clocksource clocksource_vmi = { + + +From gregkh@mini.kroah.org Fri Mar 13 18:10:38 2009 +Message-Id: <20090314011038.052964195@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:10:22 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jiri Slaby , + Jiri Kosina +Subject: [patch 045/114] HID: fix bus endianity in file2alias +References: <20090314010937.416083662@mini.kroah.org> +Content-Disposition: inline; filename=hid-fix-bus-endianity-in-file2alias.patch +Content-Length: 745 +Lines: 26 + +2.6.28-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Jiri Slaby + +commit 2b639386a2a26c84c8d26c649cf657ebd43a7bc8 upstream. + +Fix endianness of bus member of hid_device_id in modpost. + +Signed-off-by: Jiri Slaby +Reported-by: Nye Liu +Signed-off-by: Jiri Kosina +Signed-off-by: Greg Kroah-Hartman + +--- + scripts/mod/file2alias.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/scripts/mod/file2alias.c ++++ b/scripts/mod/file2alias.c +@@ -210,6 +210,7 @@ static void do_usb_table(void *symval, u + static int do_hid_entry(const char *filename, + struct hid_device_id *id, char *alias) + { ++ id->bus = TO_NATIVE(id->bus); + id->vendor = TO_NATIVE(id->vendor); + id->product = TO_NATIVE(id->product); + + + +From gregkh@mini.kroah.org Fri Mar 13 18:10:38 2009 +Message-Id: <20090314011038.205906540@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:10:23 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Ingo Molnar , + Peter Zijlstra , + MinChan Kim , + Nick Piggin +Subject: [patch 046/114] inotify: fix GFP_KERNEL related deadlock +References: <20090314010937.416083662@mini.kroah.org> +Content-Disposition: inline; filename=inotify-fix-gfp_kernel-related-deadlock.patch +Content-Length: 4294 +Lines: 92 + +2.6.28-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Ingo Molnar + +commit f04b30de3c82528f1ab4c58b3dd4c975f5341901 upstream. + +Enhanced lockdep coverage of __GFP_NOFS turned up this new lockdep +assert: + +[ 1093.677775] +[ 1093.677781] ================================= +[ 1093.680031] [ INFO: inconsistent lock state ] +[ 1093.680031] 2.6.29-rc5-tip-01504-gb49eca1-dirty #1 +[ 1093.680031] --------------------------------- +[ 1093.680031] inconsistent {RECLAIM_FS-ON-W} -> {IN-RECLAIM_FS-W} usage. +[ 1093.680031] kswapd0/308 [HC0[0]:SC0[0]:HE1:SE1] takes: +[ 1093.680031] (&inode->inotify_mutex){+.+.?.}, at: [] inotify_inode_is_dead+0x20/0x80 +[ 1093.680031] {RECLAIM_FS-ON-W} state was registered at: +[ 1093.680031] [] mark_held_locks+0x43/0x5b +[ 1093.680031] [] lockdep_trace_alloc+0x6c/0x6e +[ 1093.680031] [] kmem_cache_alloc+0x20/0x150 +[ 1093.680031] [] idr_pre_get+0x27/0x6c +[ 1093.680031] [] inotify_handle_get_wd+0x25/0xad +[ 1093.680031] [] inotify_add_watch+0x7a/0x129 +[ 1093.680031] [] sys_inotify_add_watch+0x20f/0x250 +[ 1093.680031] [] sysenter_do_call+0x12/0x35 +[ 1093.680031] [] 0xffffffff +[ 1093.680031] irq event stamp: 60417 +[ 1093.680031] hardirqs last enabled at (60417): [] call_rcu+0x53/0x59 +[ 1093.680031] hardirqs last disabled at (60416): [] call_rcu+0x17/0x59 +[ 1093.680031] softirqs last enabled at (59656): [] __do_softirq+0x157/0x16b +[ 1093.680031] softirqs last disabled at (59651): [] do_softirq+0x74/0x15d +[ 1093.680031] +[ 1093.680031] other info that might help us debug this: +[ 1093.680031] 2 locks held by kswapd0/308: +[ 1093.680031] #0: (shrinker_rwsem){++++..}, at: [] shrink_slab+0x36/0x189 +[ 1093.680031] #1: (&type->s_umount_key#4){+++++.}, at: [] shrink_dcache_memory+0x110/0x1fb +[ 1093.680031] +[ 1093.680031] stack backtrace: +[ 1093.680031] Pid: 308, comm: kswapd0 Not tainted 2.6.29-rc5-tip-01504-gb49eca1-dirty #1 +[ 1093.680031] Call Trace: +[ 1093.680031] [] valid_state+0x12a/0x13d +[ 1093.680031] [] mark_lock+0xc1/0x1e9 +[ 1093.680031] [] ? check_usage_forwards+0x0/0x3f +[ 1093.680031] [] __lock_acquire+0x2c6/0xac8 +[ 1093.680031] [] ? register_lock_class+0x17/0x228 +[ 1093.680031] [] lock_acquire+0x5d/0x7a +[ 1093.680031] [] ? inotify_inode_is_dead+0x20/0x80 +[ 1093.680031] [] __mutex_lock_common+0x3a/0x4cb +[ 1093.680031] [] ? inotify_inode_is_dead+0x20/0x80 +[ 1093.680031] [] mutex_lock_nested+0x2e/0x36 +[ 1093.680031] [] ? inotify_inode_is_dead+0x20/0x80 +[ 1093.680031] [] inotify_inode_is_dead+0x20/0x80 +[ 1093.680031] [] dentry_iput+0x90/0xc2 +[ 1093.680031] [] d_kill+0x21/0x45 +[ 1093.680031] [] __shrink_dcache_sb+0x27f/0x355 +[ 1093.680031] [] shrink_dcache_memory+0x15e/0x1fb +[ 1093.680031] [] shrink_slab+0x121/0x189 +[ 1093.680031] [] kswapd+0x39f/0x561 +[ 1093.680031] [] ? isolate_pages_global+0x0/0x233 +[ 1093.680031] [] ? autoremove_wake_function+0x0/0x43 +[ 1093.680031] [] ? kswapd+0x0/0x561 +[ 1093.680031] [] kthread+0x41/0x82 +[ 1093.680031] [] ? kthread+0x0/0x82 +[ 1093.680031] [] kernel_thread_helper+0x7/0x10 + +inotify_handle_get_wd() does idr_pre_get() which does a +kmem_cache_alloc() without __GFP_FS - and is hence deadlockable under +extreme MM pressure. + +Signed-off-by: Ingo Molnar +Acked-by: Peter Zijlstra +Cc: MinChan Kim +Cc: Nick Piggin +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + fs/inotify.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/inotify.c ++++ b/fs/inotify.c +@@ -156,7 +156,7 @@ static int inotify_handle_get_wd(struct + int ret; + + do { +- if (unlikely(!idr_pre_get(&ih->idr, GFP_KERNEL))) ++ if (unlikely(!idr_pre_get(&ih->idr, GFP_NOFS))) + return -ENOSPC; + ret = idr_get_new_above(&ih->idr, watch, ih->last_wd+1, &watch->wd); + } while (ret == -EAGAIN); + + +From gregkh@mini.kroah.org Fri Mar 13 18:10:38 2009 +Message-Id: <20090314011038.351676800@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:10:24 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Helmut Schaa , + Pierre Ossman +Subject: [patch 047/114] sdhci: fix led naming +References: <20090314010937.416083662@mini.kroah.org> +Content-Disposition: inline; filename=sdhci-fix-led-naming.patch +Content-Length: 1371 +Lines: 46 + +2.6.28-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Helmut Schaa + +commit 5dbace0c9ba110c1a3810a89fa6bf12b7574b5a3 upstream. + +Fix the led device naming for the sdhci driver. + +The led class documentation defines the led name to have the +form "devicename:colour:function" while not applicable sections +should be left blank. + +To comply with the documentation the led device name is changed +from "mmc*" to "mmc*::". + +Signed-off-by: Helmut Schaa +Signed-off-by: Pierre Ossman +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mmc/host/sdhci.c | 4 +++- + drivers/mmc/host/sdhci.h | 1 + + 2 files changed, 4 insertions(+), 1 deletion(-) + +--- a/drivers/mmc/host/sdhci.c ++++ b/drivers/mmc/host/sdhci.c +@@ -1718,7 +1718,9 @@ int sdhci_add_host(struct sdhci_host *ho + #endif + + #ifdef CONFIG_LEDS_CLASS +- host->led.name = mmc_hostname(mmc); ++ snprintf(host->led_name, sizeof(host->led_name), ++ "%s::", mmc_hostname(mmc)); ++ host->led.name = host->led_name; + host->led.brightness = LED_OFF; + host->led.default_trigger = mmc_hostname(mmc); + host->led.brightness_set = sdhci_led_control; +--- a/drivers/mmc/host/sdhci.h ++++ b/drivers/mmc/host/sdhci.h +@@ -222,6 +222,7 @@ struct sdhci_host { + + #ifdef CONFIG_LEDS_CLASS + struct led_classdev led; /* LED control */ ++ char led_name[32]; + #endif + + spinlock_t lock; /* Mutex */ + + +From gregkh@mini.kroah.org Fri Mar 13 18:10:38 2009 +Message-Id: <20090314011038.503177205@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:10:25 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Tim Blechmann , + Robert Richter , + Ingo Molnar +Subject: [patch 048/114] x86: oprofile: dont set counter width from cpuid on Core2 +References: <20090314010937.416083662@mini.kroah.org> +Content-Disposition: inline; filename=x86-oprofile-don-t-set-counter-width-from-cpuid-on-core2.patch +Content-Length: 1295 +Lines: 43 + +2.6.28-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Tim Blechmann + +commit 780eef9492b16a1543a3b2ae9f9526a735fc9856 upstream. + +Impact: fix stuck NMIs and non-working oprofile on certain CPUs + +Resetting the counter width of the performance counters on Intel's +Core2 CPUs, breaks the delivery of NMIs, when running in x86_64 mode. + +This should fix bug #12395: + + http://bugzilla.kernel.org/show_bug.cgi?id=12395 + +Signed-off-by: Tim Blechmann +Signed-off-by: Robert Richter +LKML-Reference: <20090303100412.GC10085@erda.amd.com> +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- a/arch/x86/oprofile/op_model_ppro.c ++++ b/arch/x86/oprofile/op_model_ppro.c +@@ -78,8 +78,18 @@ static void ppro_setup_ctrs(struct op_msrs const * const msrs) + if (cpu_has_arch_perfmon) { + union cpuid10_eax eax; + eax.full = cpuid_eax(0xa); +- if (counter_width < eax.split.bit_width) +- counter_width = eax.split.bit_width; ++ ++ /* ++ * For Core2 (family 6, model 15), don't reset the ++ * counter width: ++ */ ++ if (!(eax.split.version_id == 0 && ++ current_cpu_data.x86 == 6 && ++ current_cpu_data.x86_model == 15)) { ++ ++ if (counter_width < eax.split.bit_width) ++ counter_width = eax.split.bit_width; ++ } + } + + /* clear all counters */ + + +From gregkh@mini.kroah.org Fri Mar 13 18:10:38 2009 +Message-Id: <20090314011038.646321665@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:10:26 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Leann Ogasawara , + Tim Gardner , + "manoj.iyer" , + Ingo Molnar +Subject: [patch 049/114] x86: add Dell XPS710 reboot quirk +References: <20090314010937.416083662@mini.kroah.org> +Content-Disposition: inline; filename=x86-add-dell-xps710-reboot-quirk.patch +Content-Length: 1018 +Lines: 36 + +2.6.28-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Leann Ogasawara + +commit dd4124a8a06bca89c077a16437edac010f0bb993 upstream. + +Dell XPS710 will hang on reboot. This is resolved by adding a quirk to +set bios reboot. + +Signed-off-by: Leann Ogasawara +Signed-off-by: Tim Gardner +Cc: "manoj.iyer" +LKML-Reference: <1236196380.3231.89.camel@emiko> +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/reboot.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/arch/x86/kernel/reboot.c ++++ b/arch/x86/kernel/reboot.c +@@ -202,6 +202,14 @@ static struct dmi_system_id __initdata r + DMI_MATCH(DMI_PRODUCT_NAME, "HP Compaq"), + }, + }, ++ { /* Handle problems with rebooting on Dell XPS710 */ ++ .callback = set_bios_reboot, ++ .ident = "Dell XPS710", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "Dell XPS710"), ++ }, ++ }, + { } + }; + + + +From gregkh@mini.kroah.org Fri Mar 13 18:10:38 2009 +Message-Id: <20090314011038.802911946@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:10:27 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Lubomir Rintel , + Dave Airlie +Subject: [patch 050/114] intel-agp: fix a panic with 1M of shared memory, no GTT entries +References: <20090314010937.416083662@mini.kroah.org> +Content-Disposition: inline; filename=intel-agp-fix-a-panic-with-1m-of-shared-memory-no-gtt-entries.patch +Content-Length: 1387 +Lines: 46 + +2.6.28-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Lubomir Rintel + +commit 9c1e8a4ebcc04226cb6f3a1bf1d72f4cafd6b089 upstream. + +When GTT size is equal to amount of video memory, the amount of GTT +entries is computed lower than zero, which is invalid and leads to +off-by-one error in intel_i915_configure() + +Originally posted here: +http://bugzilla.kernel.org/show_bug.cgi?id=12539 +http://bugzilla.redhat.com/show_bug.cgi?id=445592 + +Signed-off-by: Lubomir Rintel +Cc: Lubomir Rintel +Cc: Dave Airlie +Reviewed-by: Eric Anholt +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/char/agp/intel-agp.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +--- a/drivers/char/agp/intel-agp.c ++++ b/drivers/char/agp/intel-agp.c +@@ -633,13 +633,15 @@ static void intel_i830_init_gtt_entries( + break; + } + } +- if (gtt_entries > 0) ++ if (gtt_entries > 0) { + dev_info(&agp_bridge->dev->dev, "detected %dK %s memory\n", + gtt_entries / KB(1), local ? "local" : "stolen"); +- else ++ gtt_entries /= KB(4); ++ } else { + dev_info(&agp_bridge->dev->dev, + "no pre-allocated video memory detected\n"); +- gtt_entries /= KB(4); ++ gtt_entries = 0; ++ } + + intel_private.gtt_entries = gtt_entries; + } + + +From gregkh@mini.kroah.org Fri Mar 13 18:10:39 2009 +Message-Id: <20090314011038.947763527@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:10:28 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Will Newton , + David Woodhouse , + David Brownell +Subject: [patch 051/114] mtd_dataflash: fix probing of AT45DB321C chips. +References: <20090314010937.416083662@mini.kroah.org> +Content-Disposition: inline; filename=mtd_dataflash-fix-probing-of-at45db321c-chips.patch +Content-Length: 1087 +Lines: 34 + +2.6.28-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Will Newton + +commit 229cc58ba2b5a83b0b55764c6cb98695c106238a upstream. + +Commit 771999b65f79264acde4b855e5d35696eca5e80c ("[MTD] DataFlash: bugfix, +binary page sizes now handled") broke support for probing AT45DB321C flash +chips. These chips do not support the "page size" status bit, so if we +match the JEDEC id return early. + +[akpm@linux-foundation.org: coding-style fixes] +Signed-off-by: Will Newton +Cc: David Woodhouse +Acked-by: David Brownell +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mtd/devices/mtd_dataflash.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/mtd/devices/mtd_dataflash.c ++++ b/drivers/mtd/devices/mtd_dataflash.c +@@ -815,7 +815,8 @@ static struct flash_info *__devinit jede + if (!(info->flags & IS_POW2PS)) + return info; + } +- } ++ } else ++ return info; + } + } + + + +From gregkh@mini.kroah.org Fri Mar 13 18:10:39 2009 +Message-Id: <20090314011039.092516082@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:10:29 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Wu Fengguang +Subject: [patch 052/114] proc: fix kflags to uflags copying in /proc/kpageflags +References: <20090314010937.416083662@mini.kroah.org> +Content-Disposition: inline; filename=proc-fix-kflags-to-uflags-copying-in-proc-kpageflags.patch +Content-Length: 1116 +Lines: 31 + +2.6.28-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Wu Fengguang + +commit ad3bdefe877afb47480418fdb05ecd42842de65e upstream. + +Fix kpf_copy_bit(src,dst) to be kpf_copy_bit(dst,src) to match the +actual call patterns, e.g. kpf_copy_bit(kflags, KPF_LOCKED, PG_locked). + +This misplacement of src/dst only affected reporting of PG_writeback, +PG_reclaim and PG_buddy. For others kflags==uflags so not affected. + +Signed-off-by: Wu Fengguang +Reviewed-by: KOSAKI Motohiro +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + fs/proc/page.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/proc/page.c ++++ b/fs/proc/page.c +@@ -80,7 +80,7 @@ static const struct file_operations proc + #define KPF_RECLAIM 9 + #define KPF_BUDDY 10 + +-#define kpf_copy_bit(flags, srcpos, dstpos) (((flags >> srcpos) & 1) << dstpos) ++#define kpf_copy_bit(flags, dstpos, srcpos) (((flags >> srcpos) & 1) << dstpos) + + static ssize_t kpageflags_read(struct file *file, char __user *buf, + size_t count, loff_t *ppos) + + +From gregkh@mini.kroah.org Fri Mar 13 18:10:39 2009 +Message-Id: <20090314011039.231422071@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:10:30 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + "Jorge Boncompte [DTI2]" , + Jan Kara , + Nick Piggin +Subject: [patch 053/114] fs: new inode i_state corruption fix +References: <20090314010937.416083662@mini.kroah.org> +Content-Disposition: inline; filename=fs-new-inode-i_state-corruption-fix.patch +Content-Length: 5250 +Lines: 152 + +2.6.28-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Nick Piggin + +commit 7ef0d7377cb287e08f3ae94cebc919448e1f5dff upstream. + +There was a report of a data corruption +http://lkml.org/lkml/2008/11/14/121. There is a script included to +reproduce the problem. + +During testing, I encountered a number of strange things with ext3, so I +tried ext2 to attempt to reduce complexity of the problem. I found that +fsstress would quickly hang in wait_on_inode, waiting for I_LOCK to be +cleared, even though instrumentation showed that unlock_new_inode had +already been called for that inode. This points to memory scribble, or +synchronisation problme. + +i_state of I_NEW inodes is not protected by inode_lock because other +processes are not supposed to touch them until I_LOCK (and I_NEW) is +cleared. Adding WARN_ON(inode->i_state & I_NEW) to sites where we modify +i_state revealed that generic_sync_sb_inodes is picking up new inodes from +the inode lists and passing them to __writeback_single_inode without +waiting for I_NEW. Subsequently modifying i_state causes corruption. In +my case it would look like this: + +CPU0 CPU1 +unlock_new_inode() __sync_single_inode() + reg <- inode->i_state + reg -> reg & ~(I_LOCK|I_NEW) reg <- inode->i_state + reg -> inode->i_state reg -> reg | I_SYNC + reg -> inode->i_state + +Non-atomic RMW on CPU1 overwrites CPU0 store and sets I_LOCK|I_NEW again. + +Fix for this is rather than wait for I_NEW inodes, just skip over them: +inodes concurrently being created are not subject to data integrity +operations, and should not significantly contribute to dirty memory +either. + +After this change, I'm unable to reproduce any of the added warnings or +hangs after ~1hour of running. Previously, the new warnings would start +immediately and hang would happen in under 5 minutes. + +I'm also testing on ext3 now, and so far no problems there either. I +don't know whether this fixes the problem reported above, but it fixes a +real problem for me. + +Cc: "Jorge Boncompte [DTI2]" +Reported-by: Adrian Hunter +Cc: Jan Kara +Signed-off-by: Nick Piggin +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + fs/fs-writeback.c | 9 ++++++++- + fs/inode.c | 7 +++++++ + 2 files changed, 15 insertions(+), 1 deletion(-) + +--- a/fs/fs-writeback.c ++++ b/fs/fs-writeback.c +@@ -274,6 +274,7 @@ __sync_single_inode(struct inode *inode, + int ret; + + BUG_ON(inode->i_state & I_SYNC); ++ WARN_ON(inode->i_state & I_NEW); + + /* Set I_SYNC, reset I_DIRTY */ + dirty = inode->i_state & I_DIRTY; +@@ -298,6 +299,7 @@ __sync_single_inode(struct inode *inode, + } + + spin_lock(&inode_lock); ++ WARN_ON(inode->i_state & I_NEW); + inode->i_state &= ~I_SYNC; + if (!(inode->i_state & I_FREEING)) { + if (!(inode->i_state & I_DIRTY) && +@@ -470,6 +472,11 @@ void generic_sync_sb_inodes(struct super + break; + } + ++ if (inode->i_state & I_NEW) { ++ requeue_io(inode); ++ continue; ++ } ++ + if (wbc->nonblocking && bdi_write_congested(bdi)) { + wbc->encountered_congestion = 1; + if (!sb_is_blkdev_sb(sb)) +@@ -531,7 +538,7 @@ void generic_sync_sb_inodes(struct super + list_for_each_entry(inode, &sb->s_inodes, i_sb_list) { + struct address_space *mapping; + +- if (inode->i_state & (I_FREEING|I_WILL_FREE)) ++ if (inode->i_state & (I_FREEING|I_WILL_FREE|I_NEW)) + continue; + mapping = inode->i_mapping; + if (mapping->nrpages == 0) +--- a/fs/inode.c ++++ b/fs/inode.c +@@ -339,6 +339,7 @@ static int invalidate_list(struct list_h + invalidate_inode_buffers(inode); + if (!atomic_read(&inode->i_count)) { + list_move(&inode->i_list, dispose); ++ WARN_ON(inode->i_state & I_NEW); + inode->i_state |= I_FREEING; + count++; + continue; +@@ -440,6 +441,7 @@ static void prune_icache(int nr_to_scan) + continue; + } + list_move(&inode->i_list, &freeable); ++ WARN_ON(inode->i_state & I_NEW); + inode->i_state |= I_FREEING; + nr_pruned++; + } +@@ -595,6 +597,7 @@ void unlock_new_inode(struct inode *inod + * just created it (so there can be no old holders + * that haven't tested I_LOCK). + */ ++ WARN_ON((inode->i_state & (I_LOCK|I_NEW)) != (I_LOCK|I_NEW)); + inode->i_state &= ~(I_LOCK|I_NEW); + wake_up_inode(inode); + } +@@ -1041,6 +1044,7 @@ void generic_delete_inode(struct inode * + + list_del_init(&inode->i_list); + list_del_init(&inode->i_sb_list); ++ WARN_ON(inode->i_state & I_NEW); + inode->i_state |= I_FREEING; + inodes_stat.nr_inodes--; + spin_unlock(&inode_lock); +@@ -1082,16 +1086,19 @@ static void generic_forget_inode(struct + spin_unlock(&inode_lock); + return; + } ++ WARN_ON(inode->i_state & I_NEW); + inode->i_state |= I_WILL_FREE; + spin_unlock(&inode_lock); + write_inode_now(inode, 1); + spin_lock(&inode_lock); ++ WARN_ON(inode->i_state & I_NEW); + inode->i_state &= ~I_WILL_FREE; + inodes_stat.nr_unused--; + hlist_del_init(&inode->i_hash); + } + list_del_init(&inode->i_list); + list_del_init(&inode->i_sb_list); ++ WARN_ON(inode->i_state & I_NEW); + inode->i_state |= I_FREEING; + inodes_stat.nr_inodes--; + spin_unlock(&inode_lock); + + +From gregkh@mini.kroah.org Fri Mar 13 18:10:39 2009 +Message-Id: <20090314011039.403536326@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:10:31 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Alex Chiang , + Matthew Wilcox +Subject: [patch 054/114] PCIe: portdrv: call pci_disable_device during remove +References: <20090314010937.416083662@mini.kroah.org> +Content-Disposition: inline; filename=pcie-portdrv-call-pci_disable_device-during-remove.patch +Content-Length: 725 +Lines: 26 + +2.6.28-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Alex Chiang + +commit d89987193631bf23d1735c55d13a06d4b8d0e9bd upstream. + +The PCIe port driver calls pci_enable_device() during probe but +never calls pci_disable_device() during remove. + +Signed-off-by: Alex Chiang +Signed-off-by: Matthew Wilcox +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pci/pcie/portdrv_pci.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/pci/pcie/portdrv_pci.c ++++ b/drivers/pci/pcie/portdrv_pci.c +@@ -109,6 +109,7 @@ static int __devinit pcie_portdrv_probe + static void pcie_portdrv_remove (struct pci_dev *dev) + { + pcie_port_device_remove(dev); ++ pci_disable_device(dev); + kfree(pci_get_drvdata(dev)); + } + + + +From gregkh@mini.kroah.org Fri Mar 13 18:10:39 2009 +Message-Id: <20090314011039.556622621@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:10:32 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Andrew Patterson , + Jesse Barnes +Subject: [patch 055/114] PCI: Enable PCIe AER only after checking firmware support +References: <20090314010937.416083662@mini.kroah.org> +Content-Disposition: inline; filename=pci-enable-pcie-aer-only-after-checking-firmware-support.patch +Content-Length: 3503 +Lines: 105 + +2.6.28-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Andrew Patterson + +commit 1f9f13c8d59c1d8da1a602b71d1ab96d1d37d69e upstream. + +The PCIe port driver currently sets the PCIe AER error reporting bits for +any root or switch port without first checking to see if firmware will grant +control. This patch moves setting these bits to the AER service driver +aer_enable_port routine. The bits are then set for the root port and any +downstream switch ports after the check for firmware support (aer_osc_setup) +is made. The patch also unsets the bits in a similar fashion when the AER +service driver is unloaded. + +Reviewed-by: Alex Chiang +Signed-off-by: Andrew Patterson +Signed-off-by: Jesse Barnes +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pci/pcie/aer/aerdrv_core.c | 48 ++++++++++++++++++++++++++++++------- + drivers/pci/pcie/portdrv_pci.c | 2 - + 2 files changed, 39 insertions(+), 11 deletions(-) + +--- a/drivers/pci/pcie/aer/aerdrv_core.c ++++ b/drivers/pci/pcie/aer/aerdrv_core.c +@@ -108,6 +108,34 @@ int pci_cleanup_aer_correct_error_status + } + #endif /* 0 */ + ++ ++static void set_device_error_reporting(struct pci_dev *dev, void *data) ++{ ++ bool enable = *((bool *)data); ++ ++ if (dev->pcie_type != PCIE_RC_PORT && ++ dev->pcie_type != PCIE_SW_UPSTREAM_PORT && ++ dev->pcie_type != PCIE_SW_DOWNSTREAM_PORT) ++ return; ++ ++ if (enable) ++ pci_enable_pcie_error_reporting(dev); ++ else ++ pci_disable_pcie_error_reporting(dev); ++} ++ ++/** ++ * set_downstream_devices_error_reporting - enable/disable the error reporting bits on the root port and its downstream ports. ++ * @dev: pointer to root port's pci_dev data structure ++ * @enable: true = enable error reporting, false = disable error reporting. ++ */ ++static void set_downstream_devices_error_reporting(struct pci_dev *dev, ++ bool enable) ++{ ++ set_device_error_reporting(dev, &enable); ++ pci_walk_bus(dev->subordinate, set_device_error_reporting, &enable); ++} ++ + static int find_device_iter(struct device *device, void *data) + { + struct pci_dev *dev; +@@ -525,15 +553,11 @@ void aer_enable_rootport(struct aer_rpc + pci_read_config_dword(pdev, aer_pos + PCI_ERR_UNCOR_STATUS, ®32); + pci_write_config_dword(pdev, aer_pos + PCI_ERR_UNCOR_STATUS, reg32); + +- /* Enable Root Port device reporting error itself */ +- pci_read_config_word(pdev, pos+PCI_EXP_DEVCTL, ®16); +- reg16 = reg16 | +- PCI_EXP_DEVCTL_CERE | +- PCI_EXP_DEVCTL_NFERE | +- PCI_EXP_DEVCTL_FERE | +- PCI_EXP_DEVCTL_URRE; +- pci_write_config_word(pdev, pos+PCI_EXP_DEVCTL, +- reg16); ++ /* ++ * Enable error reporting for the root port device and downstream port ++ * devices. ++ */ ++ set_downstream_devices_error_reporting(pdev, true); + + /* Enable Root Port's interrupt in response to error messages */ + pci_write_config_dword(pdev, +@@ -553,6 +577,12 @@ static void disable_root_aer(struct aer_ + u32 reg32; + int pos; + ++ /* ++ * Disable error reporting for the root port device and downstream port ++ * devices. ++ */ ++ set_downstream_devices_error_reporting(pdev, false); ++ + pos = pci_find_ext_capability(pdev, PCI_EXT_CAP_ID_ERR); + /* Disable Root's interrupt in response to error messages */ + pci_write_config_dword(pdev, pos + PCI_ERR_ROOT_COMMAND, 0); +--- a/drivers/pci/pcie/portdrv_pci.c ++++ b/drivers/pci/pcie/portdrv_pci.c +@@ -101,8 +101,6 @@ static int __devinit pcie_portdrv_probe + + pcie_portdrv_save_config(dev); + +- pci_enable_pcie_error_reporting(dev); +- + return 0; + } + + + +From gregkh@mini.kroah.org Fri Mar 13 18:10:39 2009 +Message-Id: <20090314011039.709998889@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:10:33 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Adam Lackorzynski , + Scott H Kilau , + Wendy Xiong +Subject: [patch 056/114] jsm: additional device support +References: <20090314010937.416083662@mini.kroah.org> +Content-Disposition: inline; filename=jsm-additional-device-support.patch +Content-Length: 1897 +Lines: 52 + +2.6.28-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Adam Lackorzynski + +commit ffa7525c13eb3db0fd19a3e1cffe2ce6f561f5f3 upstream. + +I have a Digi Neo 8 PCI card (114f:00b1) Serial controller: Digi +International Digi Neo 8 (rev 05) + +that works with the jsm driver after using the following patch. + +Signed-off-by: Adam Lackorzynski +Cc: Scott H Kilau +Cc: Wendy Xiong +Acked-by: Alan Cox +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/serial/jsm/jsm_driver.c | 3 +++ + include/linux/pci_ids.h | 1 + + 2 files changed, 4 insertions(+) + +--- a/drivers/serial/jsm/jsm_driver.c ++++ b/drivers/serial/jsm/jsm_driver.c +@@ -84,6 +84,8 @@ static int jsm_probe_one(struct pci_dev + brd->pci_dev = pdev; + if (pdev->device == PCIE_DEVICE_ID_NEO_4_IBM) + brd->maxports = 4; ++ else if (pdev->device == PCI_DEVICE_ID_DIGI_NEO_8) ++ brd->maxports = 8; + else + brd->maxports = 2; + +@@ -212,6 +214,7 @@ static struct pci_device_id jsm_pci_tbl[ + { PCI_DEVICE(PCI_VENDOR_ID_DIGI, PCI_DEVICE_ID_NEO_2RJ45), 0, 0, 2 }, + { PCI_DEVICE(PCI_VENDOR_ID_DIGI, PCI_DEVICE_ID_NEO_2RJ45PRI), 0, 0, 3 }, + { PCI_DEVICE(PCI_VENDOR_ID_DIGI, PCIE_DEVICE_ID_NEO_4_IBM), 0, 0, 4 }, ++ { PCI_DEVICE(PCI_VENDOR_ID_DIGI, PCI_DEVICE_ID_DIGI_NEO_8), 0, 0, 5 }, + { 0, } + }; + MODULE_DEVICE_TABLE(pci, jsm_pci_tbl); +--- a/include/linux/pci_ids.h ++++ b/include/linux/pci_ids.h +@@ -1445,6 +1445,7 @@ + #define PCI_DEVICE_ID_DIGI_DF_M_E 0x0071 + #define PCI_DEVICE_ID_DIGI_DF_M_IOM2_A 0x0072 + #define PCI_DEVICE_ID_DIGI_DF_M_A 0x0073 ++#define PCI_DEVICE_ID_DIGI_NEO_8 0x00B1 + #define PCI_DEVICE_ID_NEO_2DB9 0x00C8 + #define PCI_DEVICE_ID_NEO_2DB9PRI 0x00C9 + #define PCI_DEVICE_ID_NEO_2RJ45 0x00CA + + +From gregkh@mini.kroah.org Fri Mar 13 18:10:39 2009 +Message-Id: <20090314011039.859419404@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:10:34 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Robert Hancock , + Jeff Garzik +Subject: [patch 057/114] libata: Dont trust current capacity values in identify words 57-58 +References: <20090314010937.416083662@mini.kroah.org> +Content-Disposition: inline; filename=libata-don-t-trust-current-capacity-values-in-identify-words-57-58.patch +Content-Length: 1776 +Lines: 52 + +2.6.28-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Robert Hancock + +commit 968e594afdbc40b4270f9d4032ae8350475749d6 upstream. + +Hanno Böck reported a problem where an old Conner CP30254 240MB hard drive +was reported as 1.1TB in capacity by libata: + +http://lkml.org/lkml/2009/2/13/134 + +This was caused by libata trusting the drive's reported current capacity in +sectors in identify words 57 and 58 if the drive does not support LBA and the +current CHS translation values appear valid. Unfortunately it seems older +ATA specs were vague about what this field should contain and a number of drives +used values with wrong byte order or that were totally bogus. There's no +unique information that it conveys and so we can just calculate the number +of sectors from the reported current CHS values. + +While we're at it, clean up this function to use named constants for the +identify word values. + +Signed-off-by: Robert Hancock +Signed-off-by: Jeff Garzik +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ata/libata-core.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +--- a/drivers/ata/libata-core.c ++++ b/drivers/ata/libata-core.c +@@ -1251,14 +1251,16 @@ static u64 ata_id_n_sectors(const u16 *i + { + if (ata_id_has_lba(id)) { + if (ata_id_has_lba48(id)) +- return ata_id_u64(id, 100); ++ return ata_id_u64(id, ATA_ID_LBA_CAPACITY_2); + else +- return ata_id_u32(id, 60); ++ return ata_id_u32(id, ATA_ID_LBA_CAPACITY); + } else { + if (ata_id_current_chs_valid(id)) +- return ata_id_u32(id, 57); ++ return id[ATA_ID_CUR_CYLS] * id[ATA_ID_CUR_HEADS] * ++ id[ATA_ID_CUR_SECTORS]; + else +- return id[1] * id[3] * id[6]; ++ return id[ATA_ID_CYLS] * id[ATA_ID_HEADS] * ++ id[ATA_ID_SECTORS]; + } + } + + + +From gregkh@mini.kroah.org Fri Mar 13 18:10:40 2009 +Message-Id: <20090314011040.009715188@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:10:35 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Tejun Heo , + Robert Hancock , + Jeff Garzik +Subject: [patch 058/114] libata: make sure port is thawed when skipping resets +References: <20090314010937.416083662@mini.kroah.org> +Content-Disposition: inline; filename=libata-make-sure-port-is-thawed-when-skipping-resets.patch +Content-Length: 2320 +Lines: 60 + +2.6.28-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Tejun Heo + +commit d6515e6ff4ad3db4bd5ef2dd4e1026a7aca2482e upstream. + +When SCR access is available and the link is offline, softreset is +skipped as it only wastes time and some controllers don't respond very +well. However, the skip path forgot to thaw the port, which not only +blocks further event notification from the port but also causes +repeated EH invocations on the same event on drivers which rely on +->thaw() to clear events if the IRQ is shared with another device or +port. + +This problem has always been there but is uncovered by recent sata_nv +nf2/3 change which dropped hardreset support while maintaining SCR +access. nf2/3 doesn't clear hotplug event mask from the interrupt +handler but relies on ->thaw() to clear them. When the hardreset was +there, the reset action was never skipped and the port was always +thawed but, with the hardreset gone, ->prereset() determines that +there's no need for softreset and both ->softreset() and ->thaw() are +skipped. This leads to stuck hotplug event in the IRQ status register +triggering hotplug event whenever IRQ is delieverd on the same IRQ. +As the controller shares the same IRQ for both ports, this happens on +every IO if one port is occpupied and the other isn't. + +This patch fixes the problem by making sure that the port is thawed on +reset-skip path. + +bko#11615 reports this problem. + +Signed-off-by: Tejun Heo +Cc: Robert Hancock +Reported-by: Dan Andresan +Reported-by: Arne Woerner +Reported-by: Stefan Lippers-Hollmann +Signed-off-by: Jeff Garzik +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ata/libata-eh.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/drivers/ata/libata-eh.c ++++ b/drivers/ata/libata-eh.c +@@ -2366,11 +2366,14 @@ int ata_eh_reset(struct ata_link *link, + } + + /* prereset() might have cleared ATA_EH_RESET. If so, +- * bang classes and return. ++ * bang classes, thaw and return. + */ + if (reset && !(ehc->i.action & ATA_EH_RESET)) { + ata_link_for_each_dev(dev, link) + classes[dev->devno] = ATA_DEV_NONE; ++ if ((ap->pflags & ATA_PFLAG_FROZEN) && ++ ata_is_host_link(link)) ++ ata_eh_thaw_port(ap); + rc = 0; + goto out; + } + + +From gregkh@mini.kroah.org Fri Mar 13 18:10:40 2009 +Message-Id: <20090314011040.152887304@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:10:36 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Adrian Hunter , + Pierre Ossman +Subject: [patch 059/114] mmc: fix data timeout for SEND_EXT_CSD +References: <20090314010937.416083662@mini.kroah.org> +Content-Disposition: inline; filename=mmc-fix-data-timeout-for-send_ext_csd.patch +Content-Length: 1253 +Lines: 46 + +2.6.28-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Adrian Hunter + +commit cda56ac29f2d8288d62978272856884d26e0b47b upstream. + +Commit 0d3e0460f307e84904968aad6cff97bd688583d8 +"MMC: CSD and CID timeout values" inadvertently broke +the timeout for the MMC command SEND_EXT_CSD. + +This patch puts it back again. + +Depending on the characteristics of the controller, +this bug may prevent the use of MMC cards. + +Signed-off-by: Adrian Hunter +Signed-off-by: Pierre Ossman +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mmc/core/mmc_ops.c | 15 +++++++++------ + 1 file changed, 9 insertions(+), 6 deletions(-) + +--- a/drivers/mmc/core/mmc_ops.c ++++ b/drivers/mmc/core/mmc_ops.c +@@ -248,12 +248,15 @@ mmc_send_cxd_data(struct mmc_card *card, + + sg_init_one(&sg, data_buf, len); + +- /* +- * The spec states that CSR and CID accesses have a timeout +- * of 64 clock cycles. +- */ +- data.timeout_ns = 0; +- data.timeout_clks = 64; ++ if (opcode == MMC_SEND_CSD || opcode == MMC_SEND_CID) { ++ /* ++ * The spec states that CSR and CID accesses have a timeout ++ * of 64 clock cycles. ++ */ ++ data.timeout_ns = 0; ++ data.timeout_clks = 64; ++ } else ++ mmc_set_data_timeout(&data, card); + + mmc_wait_for_req(host, &mrq); + + + +From gregkh@mini.kroah.org Fri Mar 13 18:10:40 2009 +Message-Id: <20090314011040.309454816@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:10:37 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Yauhen Kharuzhy , + Pierre Ossman +Subject: [patch 060/114] s3cmci: Fix hangup in do_pio_write() +References: <20090314010937.416083662@mini.kroah.org> +Content-Disposition: inline; filename=s3cmci-fix-hangup-in-do_pio_write.patch +Content-Length: 1206 +Lines: 35 + +2.6.28-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Yauhen Kharuzhy + +commit 994244883739e4044bef76d4e5d7a9b66dc6c7b6 upstream. + +This commit fixes the regression what was added by commit +088a78af978d0c8e339071a9b2bca1f4cb368f30 "s3cmci: Support transfers +which are not multiple of 32 bits." + +fifo_free() now returns amount of available space in FIFO buffer in +bytes. But do_pio_write() writes to FIFO 32-bit words. Condition for +return from cycle is (fifo_free() == 0), but when fifo has 1..3 bytes +of free space then this condition will never be true and system hangs. + +This patch changes condition in the while() to (fifo_free() > 3). + +Signed-off-by: Yauhen Kharuzhy +Signed-off-by: Andrew Morton +Signed-off-by: Pierre Ossman + +--- + drivers/mmc/host/s3cmci.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/mmc/host/s3cmci.c ++++ b/drivers/mmc/host/s3cmci.c +@@ -329,7 +329,7 @@ static void do_pio_write(struct s3cmci_h + + to_ptr = host->base + host->sdidata; + +- while ((fifo = fifo_free(host))) { ++ while ((fifo = fifo_free(host)) > 3) { + if (!host->pio_bytes) { + res = get_data_buffer(host, &host->pio_bytes, + &host->pio_ptr); + + +From gregkh@mini.kroah.org Fri Mar 13 18:10:40 2009 +Message-Id: <20090314011040.466541543@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:10:38 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Ben Dooks , + Pierre Ossman +Subject: [patch 061/114] mmc: s3cmci: fix s3c2410_dma_config() arguments. +References: <20090314010937.416083662@mini.kroah.org> +Content-Disposition: inline; filename=mmc-s3cmci-fix-s3c2410_dma_config-arguments.patch +Content-Length: 1089 +Lines: 28 + +2.6.28-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Ben Dooks + +commit 7c48ed3383bfb2106694807361ec187fe8a4333d upstream. + +The s3cmci driver is calling s3c2410_dma_config with incorrect data for +the DCON register. The S3C2410_DCON_HWTRIG is implicit in the channel +configuration and the device selection of S3C2410_DCON_CH0_SDI is +incorrect as the DMA system may not select channel 0. + +Signed-off-by: Ben Dooks +Acked-by: Pierre Ossman +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- a/drivers/mmc/host/s3cmci.c ++++ b/drivers/mmc/host/s3cmci.c +@@ -793,8 +793,7 @@ static void s3cmci_dma_setup(struct s3cmci_host *host, + host->mem->start + host->sdidata); + + if (!setup_ok) { +- s3c2410_dma_config(host->dma, 4, +- (S3C2410_DCON_HWTRIG | S3C2410_DCON_CH0_SDI)); ++ s3c2410_dma_config(host->dma, 4, 0); + s3c2410_dma_set_buffdone_fn(host->dma, + s3cmci_dma_done_callback); + s3c2410_dma_setflags(host->dma, S3C2410_DMAF_AUTOSTART); + + +From gregkh@mini.kroah.org Fri Mar 13 18:10:40 2009 +Message-Id: <20090314011040.596765924@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:10:39 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Yi Li , + Bryan Wu , + Pierre Ossman +Subject: [patch 062/114] MMC: fix bug - SDHC card capacity not correct +References: <20090314010937.416083662@mini.kroah.org> +Content-Disposition: inline; filename=mmc-fix-bug-sdhc-card-capacity-not-correct.patch +Content-Length: 781 +Lines: 25 + +2.6.28-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Yi Li + +commit 444122fd58fdc83c96877a92b3f6288cafddb08d upstream. + +Signed-off-by: Yi Li +Signed-off-by: Bryan Wu +Signed-off-by: Pierre Ossman +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mmc/card/block.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/mmc/card/block.c ++++ b/drivers/mmc/card/block.c +@@ -514,7 +514,7 @@ static int mmc_blk_probe(struct mmc_card + if (err) + goto out; + +- string_get_size(get_capacity(md->disk) << 9, STRING_UNITS_2, ++ string_get_size((u64)get_capacity(md->disk) << 9, STRING_UNITS_2, + cap_str, sizeof(cap_str)); + printk(KERN_INFO "%s: %s %s %s %s\n", + md->disk->disk_name, mmc_card_id(card), mmc_card_name(card), + + +From gregkh@mini.kroah.org Fri Mar 13 18:10:40 2009 +Message-Id: <20090314011040.746463995@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:10:40 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Rabin Vincent , + Pierre Ossman +Subject: [patch 063/114] mmc_test: fix basic read test +References: <20090314010937.416083662@mini.kroah.org> +Content-Disposition: inline; filename=mmc_test-fix-basic-read-test.patch +Content-Length: 755 +Lines: 27 + +2.6.28-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Rabin Vincent + +commit 58a5dd3e0e77029d3db1f8fa75d0b54b38169d5d upstream. + +Due to a typo in the Basic Read test, it's currently identical to the +Basic Write test. Fix this. + +Signed-off-by: Rabin Vincent +Signed-off-by: Pierre Ossman +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mmc/card/mmc_test.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/mmc/card/mmc_test.c ++++ b/drivers/mmc/card/mmc_test.c +@@ -494,7 +494,7 @@ static int mmc_test_basic_read(struct mm + + sg_init_one(&sg, test->buffer, 512); + +- ret = mmc_test_simple_transfer(test, &sg, 1, 0, 1, 512, 1); ++ ret = mmc_test_simple_transfer(test, &sg, 1, 0, 1, 512, 0); + if (ret) + return ret; + + + +From gregkh@mini.kroah.org Fri Mar 13 18:10:41 2009 +Message-Id: <20090314011040.889516597@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:10:41 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Ingo Molnar +Subject: [patch 064/114] x86: tone down mtrr_trim_uncached_memory() warning +References: <20090314010937.416083662@mini.kroah.org> +Content-Disposition: inline; filename=x86-tone-down-mtrr_trim_uncached_memory-warning.patch +Content-Length: 1291 +Lines: 41 + +2.6.28-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Ingo Molnar + +commit bf3647c44bc76c43c4b2ebb4c37a559e899ac70e upstream. + +kerneloops.org is reporting a lot of these warnings that come due to +vmware not setting up any MTRRs for emulated CPUs: + +| Reported 709 times (14696 total reports) +| BIOS bug (often in VMWare) where the MTRR's are set up incorrectly +| or not at all +| +| This warning was last seen in version 2.6.29-rc2-git1, and first +| seen in 2.6.24. +| +| More info: +| http://www.kerneloops.org/searchweek.php?search=mtrr_trim_uncached_memory + +Keep a one-liner KERN_INFO about it - so that we have so notice if empty +MTRRs are caused by native hardware/BIOS weirdness. + +Signed-off-by: Ingo Molnar +Cc: Chuck Ebbert +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/cpu/mtrr/main.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/arch/x86/kernel/cpu/mtrr/main.c ++++ b/arch/x86/kernel/cpu/mtrr/main.c +@@ -1600,8 +1600,7 @@ int __init mtrr_trim_uncached_memory(uns + + /* kvm/qemu doesn't have mtrr set right, don't trim them all */ + if (!highest_pfn) { +- WARN(!kvm_para_available(), KERN_WARNING +- "WARNING: strange, CPU MTRRs all blank?\n"); ++ printk(KERN_INFO "CPU MTRRs all blank - virtualized system.\n"); + return 0; + } + + + +From gregkh@mini.kroah.org Fri Mar 13 18:10:41 2009 +Message-Id: <20090314011041.046871380@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:10:42 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Roland McGrath +Subject: [patch 065/114] x86-64: fix int $0x80 -ENOSYS return +References: <20090314010937.416083662@mini.kroah.org> +Content-Disposition: inline; filename=x86-64-fix-int-0x80-enosys-return.patch +Content-Length: 1905 +Lines: 63 + +2.6.28-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Roland McGrath + +commit c09249f8d1b84344eca882547afdbffee8c09d14 upstream. + +One of my past fixes to this code introduced a different new bug. +When using 32-bit "int $0x80" entry for a bogus syscall number, +the return value is not correctly set to -ENOSYS. This only happens +when neither syscall-audit nor syscall tracing is enabled (i.e., never +seen if auditd ever started). Test program: + + /* gcc -o int80-badsys -m32 -g int80-badsys.c + Run on x86-64 kernel. + Note to reproduce the bug you need auditd never to have started. */ + + #include + #include + + int + main (void) + { + long res; + asm ("int $0x80" : "=a" (res) : "0" (99999)); + printf ("bad syscall returns %ld\n", res); + return res != -ENOSYS; + } + +The fix makes the int $0x80 path match the sysenter and syscall paths. + +Reported-by: Dmitry V. Levin +Signed-off-by: Roland McGrath +Cc: Chuck Ebbert +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/ia32/ia32entry.S | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +--- a/arch/x86/ia32/ia32entry.S ++++ b/arch/x86/ia32/ia32entry.S +@@ -418,9 +418,9 @@ ENTRY(ia32_syscall) + orl $TS_COMPAT,TI_status(%r10) + testl $_TIF_WORK_SYSCALL_ENTRY,TI_flags(%r10) + jnz ia32_tracesys +-ia32_do_syscall: + cmpl $(IA32_NR_syscalls-1),%eax +- ja int_ret_from_sys_call /* ia32_tracesys has set RAX(%rsp) */ ++ ja ia32_badsys ++ia32_do_call: + IA32_ARG_FIXUP + call *ia32_sys_call_table(,%rax,8) # xxx: rip relative + ia32_sysret: +@@ -435,7 +435,9 @@ ia32_tracesys: + call syscall_trace_enter + LOAD_ARGS32 ARGOFFSET /* reload args from stack in case ptrace changed it */ + RESTORE_REST +- jmp ia32_do_syscall ++ cmpl $(IA32_NR_syscalls-1),%eax ++ ja int_ret_from_sys_call /* ia32_tracesys has set RAX(%rsp) */ ++ jmp ia32_do_call + END(ia32_syscall) + + ia32_badsys: + + +From gregkh@mini.kroah.org Fri Mar 13 18:10:41 2009 +Message-Id: <20090314011041.178682760@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:10:43 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Paul Moore , + James Morris +Subject: [patch 066/114] selinux: Fix a panic in selinux_netlbl_inode_permission() +References: <20090314010937.416083662@mini.kroah.org> +Content-Disposition: inline; filename=selinux-fix-a-panic-in-selinux_netlbl_inode_permission.patch +Content-Length: 1186 +Lines: 37 + +2.6.28-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Paul Moore + +commit d7f59dc4642ce2fc7b79fcd4ec02ffce7f21eb02 upstream. + +Rick McNeal from LSI identified a panic in selinux_netlbl_inode_permission() +caused by a certain sequence of SUNRPC operations. The problem appears to be +due to the lack of NULL pointer checking in the function; this patch adds the +pointer checks so the function will exit safely in the cases where the socket +is not completely initialized. + +Signed-off-by: Paul Moore +Signed-off-by: James Morris +Cc: Chuck Ebbert +Signed-off-by: Greg Kroah-Hartman + +--- + security/selinux/netlabel.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/security/selinux/netlabel.c ++++ b/security/selinux/netlabel.c +@@ -386,11 +386,12 @@ int selinux_netlbl_inode_permission(stru + if (!S_ISSOCK(inode->i_mode) || + ((mask & (MAY_WRITE | MAY_APPEND)) == 0)) + return 0; +- + sock = SOCKET_I(inode); + sk = sock->sk; ++ if (sk == NULL) ++ return 0; + sksec = sk->sk_security; +- if (sksec->nlbl_state != NLBL_REQUIRE) ++ if (sksec == NULL || sksec->nlbl_state != NLBL_REQUIRE) + return 0; + + local_bh_disable(); + + +From gregkh@mini.kroah.org Fri Mar 13 18:10:41 2009 +Message-Id: <20090314011041.327731579@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:10:44 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Paul Moore , + James Morris +Subject: [patch 067/114] selinux: Fix the NetLabel glue code for setsockopt() +References: <20090314010937.416083662@mini.kroah.org> +Content-Disposition: inline; filename=selinux-fix-the-netlabel-glue-code-for-setsockopt.patch +Content-Length: 1402 +Lines: 41 + +2.6.28-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Paul Moore + +commit 09c50b4a52c01a1f450b8eec819089e228655bfb upstream. + +At some point we (okay, I) managed to break the ability for users to use the +setsockopt() syscall to set IPv4 options when NetLabel was not active on the +socket in question. The problem was noticed by someone trying to use the +"-R" (record route) option of ping: + + # ping -R 10.0.0.1 + ping: record route: No message of desired type + +The solution is relatively simple, we catch the unlabeled socket case and +clear the error code, allowing the operation to succeed. Please note that we +still deny users the ability to override IPv4 options on socket's which have +NetLabel labeling active; this is done to ensure the labeling remains intact. + +Signed-off-by: Paul Moore +Signed-off-by: James Morris +Cc: Chuck Ebbert +Signed-off-by: Greg Kroah-Hartman + +--- + security/selinux/netlabel.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/security/selinux/netlabel.c ++++ b/security/selinux/netlabel.c +@@ -491,8 +491,10 @@ int selinux_netlbl_socket_setsockopt(str + lock_sock(sk); + rc = netlbl_sock_getattr(sk, &secattr); + release_sock(sk); +- if (rc == 0 && secattr.flags != NETLBL_SECATTR_NONE) ++ if (rc == 0) + rc = -EACCES; ++ else if (rc == -ENOMSG) ++ rc = 0; + netlbl_secattr_destroy(&secattr); + } + + + +From gregkh@mini.kroah.org Fri Mar 13 18:10:41 2009 +Message-Id: <20090314011041.472610401@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:10:45 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + David Altobelli +Subject: [patch 068/114] hpilo: new pci device +References: <20090314010937.416083662@mini.kroah.org> +Content-Disposition: inline; filename=hpilo-new-pci-device.patch +Content-Length: 720 +Lines: 26 + +2.6.28-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: David Altobelli + +commit 31d8b5631f095cb7100cfccc95c801a2547ffe2b upstream. + +Future iLO devices will have an HP vendor id. + +Signed-off-by: David Altobelli +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/misc/hpilo.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/misc/hpilo.c ++++ b/drivers/misc/hpilo.c +@@ -710,6 +710,7 @@ out: + + static struct pci_device_id ilo_devices[] = { + { PCI_DEVICE(PCI_VENDOR_ID_COMPAQ, 0xB204) }, ++ { PCI_DEVICE(PCI_VENDOR_ID_HP, 0x3307) }, + { } + }; + MODULE_DEVICE_TABLE(pci, ilo_devices); + + +From gregkh@mini.kroah.org Fri Mar 13 18:10:41 2009 +Message-Id: <20090314011041.598193480@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:10:46 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Yinghai Lu , + Jesse Barnes +Subject: [patch 069/114] PCI: dont enable too many HT MSI mappings +References: <20090314010937.416083662@mini.kroah.org> +Content-Disposition: inline; filename=pci-don-t-enable-too-many-ht-msi-mappings.patch +Content-Length: 4258 +Lines: 160 + +2.6.28-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Yinghai Lu + +commit 1dec6b054dd1fc780e18b815068bf5677409eb2d upstream. + +Prakash reported that his c51-mcp51 ondie sound card doesn't work with +MSI. But if he hacks out the HT-MSI quirk, MSI works fine. + +So this patch reworks the nv_msi_ht_cap_quirk(). It will now only +enable ht_msi on own its root device, avoiding enabling it on devices +following that root dev. + +Reported-by: Prakash Punnoor +Tested-by: Prakash Punnoor +Signed-off-by: Yinghai Lu +Signed-off-by: Jesse Barnes +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pci/quirks.c | 115 ++++++++++++++++++++++++++++++++++++++++++++------- + 1 file changed, 100 insertions(+), 15 deletions(-) + +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -1847,10 +1847,100 @@ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_NV + PCI_DEVICE_ID_NVIDIA_NVENET_15, + nvenet_msi_disable); + +-static void __devinit nv_msi_ht_cap_quirk(struct pci_dev *dev) ++static void __devinit nv_ht_enable_msi_mapping(struct pci_dev *dev) + { + struct pci_dev *host_bridge; ++ int pos; ++ int i, dev_no; ++ int found = 0; ++ ++ dev_no = dev->devfn >> 3; ++ for (i = dev_no; i >= 0; i--) { ++ host_bridge = pci_get_slot(dev->bus, PCI_DEVFN(i, 0)); ++ if (!host_bridge) ++ continue; ++ ++ pos = pci_find_ht_capability(host_bridge, HT_CAPTYPE_SLAVE); ++ if (pos != 0) { ++ found = 1; ++ break; ++ } ++ pci_dev_put(host_bridge); ++ } ++ ++ if (!found) ++ return; ++ ++ /* root did that ! */ ++ if (msi_ht_cap_enabled(host_bridge)) ++ goto out; ++ ++ ht_enable_msi_mapping(dev); ++ ++out: ++ pci_dev_put(host_bridge); ++} ++ ++static void __devinit ht_disable_msi_mapping(struct pci_dev *dev) ++{ ++ int pos, ttl = 48; ++ ++ pos = pci_find_ht_capability(dev, HT_CAPTYPE_MSI_MAPPING); ++ while (pos && ttl--) { ++ u8 flags; ++ ++ if (pci_read_config_byte(dev, pos + HT_MSI_FLAGS, ++ &flags) == 0) { ++ dev_info(&dev->dev, "Enabling HT MSI Mapping\n"); ++ ++ pci_write_config_byte(dev, pos + HT_MSI_FLAGS, ++ flags & ~HT_MSI_FLAGS_ENABLE); ++ } ++ pos = pci_find_next_ht_capability(dev, pos, ++ HT_CAPTYPE_MSI_MAPPING); ++ } ++} ++ ++static int __devinit ht_check_msi_mapping(struct pci_dev *dev) ++{ + int pos, ttl = 48; ++ int found = 0; ++ ++ /* check if there is HT MSI cap or enabled on this device */ ++ pos = pci_find_ht_capability(dev, HT_CAPTYPE_MSI_MAPPING); ++ while (pos && ttl--) { ++ u8 flags; ++ ++ if (found < 1) ++ found = 1; ++ if (pci_read_config_byte(dev, pos + HT_MSI_FLAGS, ++ &flags) == 0) { ++ if (flags & HT_MSI_FLAGS_ENABLE) { ++ if (found < 2) { ++ found = 2; ++ break; ++ } ++ } ++ } ++ pos = pci_find_next_ht_capability(dev, pos, ++ HT_CAPTYPE_MSI_MAPPING); ++ } ++ ++ return found; ++} ++ ++static void __devinit nv_msi_ht_cap_quirk(struct pci_dev *dev) ++{ ++ struct pci_dev *host_bridge; ++ int pos; ++ int found; ++ ++ /* check if there is HT MSI cap or enabled on this device */ ++ found = ht_check_msi_mapping(dev); ++ ++ /* no HT MSI CAP */ ++ if (found == 0) ++ return; + + /* + * HT MSI mapping should be disabled on devices that are below +@@ -1866,24 +1956,19 @@ static void __devinit nv_msi_ht_cap_quir + pos = pci_find_ht_capability(host_bridge, HT_CAPTYPE_SLAVE); + if (pos != 0) { + /* Host bridge is to HT */ +- ht_enable_msi_mapping(dev); ++ if (found == 1) { ++ /* it is not enabled, try to enable it */ ++ nv_ht_enable_msi_mapping(dev); ++ } + return; + } + +- /* Host bridge is not to HT, disable HT MSI mapping on this device */ +- pos = pci_find_ht_capability(dev, HT_CAPTYPE_MSI_MAPPING); +- while (pos && ttl--) { +- u8 flags; ++ /* HT MSI is not enabled */ ++ if (found == 1) ++ return; + +- if (pci_read_config_byte(dev, pos + HT_MSI_FLAGS, +- &flags) == 0) { +- dev_info(&dev->dev, "Disabling HT MSI mapping"); +- pci_write_config_byte(dev, pos + HT_MSI_FLAGS, +- flags & ~HT_MSI_FLAGS_ENABLE); +- } +- pos = pci_find_next_ht_capability(dev, pos, +- HT_CAPTYPE_MSI_MAPPING); +- } ++ /* Host bridge is not to HT, disable HT MSI mapping on this device */ ++ ht_disable_msi_mapping(dev); + } + DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_NVIDIA, PCI_ANY_ID, nv_msi_ht_cap_quirk); + DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AL, PCI_ANY_ID, nv_msi_ht_cap_quirk); + + +From gregkh@mini.kroah.org Fri Mar 13 18:10:41 2009 +Message-Id: <20090314011041.753930516@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:10:47 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Roland McGrath +Subject: [patch 070/114] x86-64: seccomp: fix 32/64 syscall hole +References: <20090314010937.416083662@mini.kroah.org> +Content-Disposition: inline; filename=x86-64-seccomp-fix-32-64-syscall-hole.patch +Content-Length: 5827 +Lines: 217 + +2.6.28-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Roland McGrath + +commit 5b1017404aea6d2e552e991b3fd814d839e9cd67 upstream. + +On x86-64, a 32-bit process (TIF_IA32) can switch to 64-bit mode with +ljmp, and then use the "syscall" instruction to make a 64-bit system +call. A 64-bit process make a 32-bit system call with int $0x80. + +In both these cases under CONFIG_SECCOMP=y, secure_computing() will use +the wrong system call number table. The fix is simple: test TS_COMPAT +instead of TIF_IA32. Here is an example exploit: + + /* test case for seccomp circumvention on x86-64 + + There are two failure modes: compile with -m64 or compile with -m32. + + The -m64 case is the worst one, because it does "chmod 777 ." (could + be any chmod call). The -m32 case demonstrates it was able to do + stat(), which can glean information but not harm anything directly. + + A buggy kernel will let the test do something, print, and exit 1; a + fixed kernel will make it exit with SIGKILL before it does anything. + */ + + #define _GNU_SOURCE + #include + #include + #include + #include + #include + #include + #include + + int + main (int argc, char **argv) + { + char buf[100]; + static const char dot[] = "."; + long ret; + unsigned st[24]; + + if (prctl (PR_SET_SECCOMP, 1, 0, 0, 0) != 0) + perror ("prctl(PR_SET_SECCOMP) -- not compiled into kernel?"); + + #ifdef __x86_64__ + assert ((uintptr_t) dot < (1UL << 32)); + asm ("int $0x80 # %0 <- %1(%2 %3)" + : "=a" (ret) : "0" (15), "b" (dot), "c" (0777)); + ret = snprintf (buf, sizeof buf, + "result %ld (check mode on .!)\n", ret); + #elif defined __i386__ + asm (".code32\n" + "pushl %%cs\n" + "pushl $2f\n" + "ljmpl $0x33, $1f\n" + ".code64\n" + "1: syscall # %0 <- %1(%2 %3)\n" + "lretl\n" + ".code32\n" + "2:" + : "=a" (ret) : "0" (4), "D" (dot), "S" (&st)); + if (ret == 0) + ret = snprintf (buf, sizeof buf, + "stat . -> st_uid=%u\n", st[7]); + else + ret = snprintf (buf, sizeof buf, "result %ld\n", ret); + #else + # error "not this one" + #endif + + write (1, buf, ret); + + syscall (__NR_exit, 1); + return 2; + } + +Signed-off-by: Roland McGrath +[ I don't know if anybody actually uses seccomp, but it's enabled in + at least both Fedora and SuSE kernels, so maybe somebody is. - Linus ] +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + arch/mips/include/asm/seccomp.h | 1 - + arch/powerpc/include/asm/compat.h | 5 +++++ + arch/powerpc/include/asm/seccomp.h | 4 ---- + arch/sparc/include/asm/compat.h | 5 +++++ + arch/sparc/include/asm/seccomp.h | 6 ------ + arch/x86/include/asm/seccomp_32.h | 6 ------ + arch/x86/include/asm/seccomp_64.h | 8 -------- + kernel/seccomp.c | 7 ++++--- + 8 files changed, 14 insertions(+), 28 deletions(-) + +--- a/arch/mips/include/asm/seccomp.h ++++ b/arch/mips/include/asm/seccomp.h +@@ -1,6 +1,5 @@ + #ifndef __ASM_SECCOMP_H + +-#include + #include + + #define __NR_seccomp_read __NR_read +--- a/arch/powerpc/include/asm/compat.h ++++ b/arch/powerpc/include/asm/compat.h +@@ -210,5 +210,10 @@ struct compat_shmid64_ds { + compat_ulong_t __unused6; + }; + ++static inline int is_compat_task(void) ++{ ++ return test_thread_flag(TIF_32BIT); ++} ++ + #endif /* __KERNEL__ */ + #endif /* _ASM_POWERPC_COMPAT_H */ +--- a/arch/powerpc/include/asm/seccomp.h ++++ b/arch/powerpc/include/asm/seccomp.h +@@ -1,10 +1,6 @@ + #ifndef _ASM_POWERPC_SECCOMP_H + #define _ASM_POWERPC_SECCOMP_H + +-#ifdef __KERNEL__ +-#include +-#endif +- + #include + + #define __NR_seccomp_read __NR_read +--- a/arch/sparc/include/asm/compat.h ++++ b/arch/sparc/include/asm/compat.h +@@ -240,4 +240,9 @@ struct compat_shmid64_ds { + unsigned int __unused2; + }; + ++static inline int is_compat_task(void) ++{ ++ return test_thread_flag(TIF_32BIT); ++} ++ + #endif /* _ASM_SPARC64_COMPAT_H */ +--- a/arch/sparc/include/asm/seccomp.h ++++ b/arch/sparc/include/asm/seccomp.h +@@ -1,11 +1,5 @@ + #ifndef _ASM_SECCOMP_H + +-#include /* already defines TIF_32BIT */ +- +-#ifndef TIF_32BIT +-#error "unexpected TIF_32BIT on sparc64" +-#endif +- + #include + + #define __NR_seccomp_read __NR_read +--- a/arch/x86/include/asm/seccomp_32.h ++++ b/arch/x86/include/asm/seccomp_32.h +@@ -1,12 +1,6 @@ + #ifndef _ASM_X86_SECCOMP_32_H + #define _ASM_X86_SECCOMP_32_H + +-#include +- +-#ifdef TIF_32BIT +-#error "unexpected TIF_32BIT on i386" +-#endif +- + #include + + #define __NR_seccomp_read __NR_read +--- a/arch/x86/include/asm/seccomp_64.h ++++ b/arch/x86/include/asm/seccomp_64.h +@@ -1,14 +1,6 @@ + #ifndef _ASM_X86_SECCOMP_64_H + #define _ASM_X86_SECCOMP_64_H + +-#include +- +-#ifdef TIF_32BIT +-#error "unexpected TIF_32BIT on x86_64" +-#else +-#define TIF_32BIT TIF_IA32 +-#endif +- + #include + #include + +--- a/kernel/seccomp.c ++++ b/kernel/seccomp.c +@@ -8,6 +8,7 @@ + + #include + #include ++#include + + /* #define SECCOMP_DEBUG 1 */ + #define NR_SECCOMP_MODES 1 +@@ -22,7 +23,7 @@ static int mode1_syscalls[] = { + 0, /* null terminated */ + }; + +-#ifdef TIF_32BIT ++#ifdef CONFIG_COMPAT + static int mode1_syscalls_32[] = { + __NR_seccomp_read_32, __NR_seccomp_write_32, __NR_seccomp_exit_32, __NR_seccomp_sigreturn_32, + 0, /* null terminated */ +@@ -37,8 +38,8 @@ void __secure_computing(int this_syscall + switch (mode) { + case 1: + syscall = mode1_syscalls; +-#ifdef TIF_32BIT +- if (test_thread_flag(TIF_32BIT)) ++#ifdef CONFIG_COMPAT ++ if (is_compat_task()) + syscall = mode1_syscalls_32; + #endif + do { + + +From gregkh@mini.kroah.org Fri Mar 13 18:10:42 2009 +Message-Id: <20090314011041.891793353@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:10:48 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Roland McGrath +Subject: [patch 071/114] x86-64: syscall-audit: fix 32/64 syscall hole +References: <20090314010937.416083662@mini.kroah.org> +Content-Disposition: inline; filename=x86-64-syscall-audit-fix-32-64-syscall-hole.patch +Content-Length: 1140 +Lines: 33 + +2.6.28-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Roland McGrath + +commit ccbe495caa5e604b04d5a31d7459a6f6a76a756c upstream. + +On x86-64, a 32-bit process (TIF_IA32) can switch to 64-bit mode with +ljmp, and then use the "syscall" instruction to make a 64-bit system +call. A 64-bit process make a 32-bit system call with int $0x80. + +In both these cases, audit_syscall_entry() will use the wrong system +call number table and the wrong system call argument registers. This +could be used to circumvent a syscall audit configuration that filters +based on the syscall numbers or argument details. + +Signed-off-by: Roland McGrath +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/ptrace.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/x86/kernel/ptrace.c ++++ b/arch/x86/kernel/ptrace.c +@@ -1512,7 +1512,7 @@ void send_sigtrap(struct task_struct *ts + #ifdef CONFIG_X86_32 + # define IS_IA32 1 + #elif defined CONFIG_IA32_EMULATION +-# define IS_IA32 test_thread_flag(TIF_IA32) ++# define IS_IA32 is_compat_task() + #else + # define IS_IA32 0 + #endif + + +From gregkh@mini.kroah.org Fri Mar 13 18:10:42 2009 +Message-Id: <20090314011042.028728011@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:10:49 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jeremy Fitzhardinge , + Mark McLoughlin , + Xen-devel , + Ingo Molnar +Subject: [patch 072/114] xen: disable interrupts early, as start_kernel expects +References: <20090314010937.416083662@mini.kroah.org> +Content-Disposition: inline; filename=xen-disable-interrupts-early-as-start_kernel-expects.patch +Content-Length: 995 +Lines: 32 + +2.6.28-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Jeremy Fitzhardinge + +commit 55d8085671863fe4ee6a17b7814bd38180a44e1d upstream. + +This avoids a lockdep warning from: + if (DEBUG_LOCKS_WARN_ON(unlikely(!early_boot_irqs_enabled))) + return; +in trace_hardirqs_on_caller(); + +Signed-off-by: Jeremy Fitzhardinge +Cc: Mark McLoughlin +Cc: Xen-devel +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/xen/enlighten.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/arch/x86/xen/enlighten.c ++++ b/arch/x86/xen/enlighten.c +@@ -1669,6 +1669,9 @@ asmlinkage void __init xen_start_kernel( + possible map and a non-dummy shared_info. */ + per_cpu(xen_vcpu, 0) = &HYPERVISOR_shared_info->vcpu_info[0]; + ++ local_irq_disable(); ++ early_boot_irqs_off(); ++ + xen_raw_console_write("mapping kernel into physical memory\n"); + pgd = xen_setup_kernel_pagetable(pgd, xen_start_info->nr_pages); + + + +From gregkh@mini.kroah.org Fri Mar 13 18:10:42 2009 +Message-Id: <20090314011042.166416397@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:10:50 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jens Axboe , + Jeremy Fitzhardinge , + =?ISO-8859-15?q?Sven=20K=C3=B6hler?= +Subject: [patch 073/114] xen/blkfront: use blk_rq_map_sg to generate ring entries +References: <20090314010937.416083662@mini.kroah.org> +Content-Disposition: inline; filename=xen-blkfront-use-blk_rq_map_sg-to-generate-ring-entries.patch +Content-Length: 4124 +Lines: 117 + +2.6.28-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Jens Axboe + +commit 9e973e64ac6dc504e6447d52193d4fff1a670156 upstream. + +On occasion, the request will apparently have more segments than we +fit into the ring. Jens says: + +> The second problem is that the block layer then appears to create one +> too many segments, but from the dump it has rq->nr_phys_segments == +> BLKIF_MAX_SEGMENTS_PER_REQUEST. I suspect the latter is due to +> xen-blkfront not handling the merging on its own. It should check that +> the new page doesn't form part of the previous page. The +> rq_for_each_segment() iterates all single bits in the request, not dma +> segments. The "easiest" way to do this is to call blk_rq_map_sg() and +> then iterate the mapped sg list. That will give you what you are +> looking for. + +> Here's a test patch, compiles but otherwise untested. I spent more +> time figuring out how to enable XEN than to code it up, so YMMV! +> Probably the sg list wants to be put inside the ring and only +> initialized on allocation, then you can get rid of the sg on stack and +> sg_init_table() loop call in the function. I'll leave that, and the +> testing, to you. + +[Moved sg array into info structure, and initialize once. -J] + +Signed-off-by: Jens Axboe +Signed-off-by: Jeremy Fitzhardinge +Cc: Sven Köhler +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/block/xen-blkfront.c | 30 +++++++++++++++--------------- + 1 file changed, 15 insertions(+), 15 deletions(-) + +--- a/drivers/block/xen-blkfront.c ++++ b/drivers/block/xen-blkfront.c +@@ -40,6 +40,7 @@ + #include + #include + #include ++#include + + #include + #include +@@ -82,6 +83,7 @@ struct blkfront_info + enum blkif_state connected; + int ring_ref; + struct blkif_front_ring ring; ++ struct scatterlist sg[BLKIF_MAX_SEGMENTS_PER_REQUEST]; + unsigned int evtchn, irq; + struct request_queue *rq; + struct work_struct work; +@@ -204,12 +206,11 @@ static int blkif_queue_request(struct re + struct blkfront_info *info = req->rq_disk->private_data; + unsigned long buffer_mfn; + struct blkif_request *ring_req; +- struct req_iterator iter; +- struct bio_vec *bvec; + unsigned long id; + unsigned int fsect, lsect; +- int ref; ++ int i, ref; + grant_ref_t gref_head; ++ struct scatterlist *sg; + + if (unlikely(info->connected != BLKIF_STATE_CONNECTED)) + return 1; +@@ -238,12 +239,13 @@ static int blkif_queue_request(struct re + if (blk_barrier_rq(req)) + ring_req->operation = BLKIF_OP_WRITE_BARRIER; + +- ring_req->nr_segments = 0; +- rq_for_each_segment(bvec, req, iter) { +- BUG_ON(ring_req->nr_segments == BLKIF_MAX_SEGMENTS_PER_REQUEST); +- buffer_mfn = pfn_to_mfn(page_to_pfn(bvec->bv_page)); +- fsect = bvec->bv_offset >> 9; +- lsect = fsect + (bvec->bv_len >> 9) - 1; ++ ring_req->nr_segments = blk_rq_map_sg(req->q, req, info->sg); ++ BUG_ON(ring_req->nr_segments > BLKIF_MAX_SEGMENTS_PER_REQUEST); ++ ++ for_each_sg(info->sg, sg, ring_req->nr_segments, i) { ++ buffer_mfn = pfn_to_mfn(page_to_pfn(sg_page(sg))); ++ fsect = sg->offset >> 9; ++ lsect = fsect + (sg->length >> 9) - 1; + /* install a grant reference. */ + ref = gnttab_claim_grant_reference(&gref_head); + BUG_ON(ref == -ENOSPC); +@@ -254,16 +256,12 @@ static int blkif_queue_request(struct re + buffer_mfn, + rq_data_dir(req) ); + +- info->shadow[id].frame[ring_req->nr_segments] = +- mfn_to_pfn(buffer_mfn); +- +- ring_req->seg[ring_req->nr_segments] = ++ info->shadow[id].frame[i] = mfn_to_pfn(buffer_mfn); ++ ring_req->seg[i] = + (struct blkif_request_segment) { + .gref = ref, + .first_sect = fsect, + .last_sect = lsect }; +- +- ring_req->nr_segments++; + } + + info->ring.req_prod_pvt++; +@@ -628,6 +626,8 @@ static int setup_blkring(struct xenbus_d + SHARED_RING_INIT(sring); + FRONT_RING_INIT(&info->ring, sring, PAGE_SIZE); + ++ sg_init_table(info->sg, BLKIF_MAX_SEGMENTS_PER_REQUEST); ++ + err = xenbus_grant_ring(dev, virt_to_mfn(info->ring.sring)); + if (err < 0) { + free_page((unsigned long)sring); + + +From gregkh@mini.kroah.org Fri Mar 13 18:10:42 2009 +Message-Id: <20090314011042.322664316@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:10:51 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + "David S. Miller" +Subject: [patch 074/114] asix: new device ids +References: <20090314010937.416083662@mini.kroah.org> +Content-Disposition: inline; filename=asix-new-device-ids.patch +Content-Length: 1021 +Lines: 36 + +2.6.28-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Greg Kroah-Hartman + +commit fef7cc0893146550b286b13c0e6e914556142730 upstream. + +This patch adds two new device ids to the asix driver. + +One comes directly from the asix driver on their web site, the other was +reported by Armani Liao as needed for the MSI X320 to get the driver to +work properly for it. + +Reported-by: Armani Liao +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: David S. Miller + +--- + drivers/net/usb/asix.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/drivers/net/usb/asix.c ++++ b/drivers/net/usb/asix.c +@@ -1450,6 +1450,14 @@ static const struct usb_device_id produc + // Cables-to-Go USB Ethernet Adapter + USB_DEVICE(0x0b95, 0x772a), + .driver_info = (unsigned long) &ax88772_info, ++}, { ++ // ABOCOM for pci ++ USB_DEVICE(0x14ea, 0xab11), ++ .driver_info = (unsigned long) &ax88178_info, ++}, { ++ // ASIX 88772a ++ USB_DEVICE(0x0db0, 0xa877), ++ .driver_info = (unsigned long) &ax88772_info, + }, + { }, // END + }; + + +From gregkh@mini.kroah.org Fri Mar 13 18:10:42 2009 +Message-Id: <20090314011042.474559392@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:10:52 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + =?ISO-8859-15?q?Bj=C3=B8rn=20Mork?= , + "David S. Miller" +Subject: [patch 075/114] cdc_ether: add usb id for Ericsson F3507g +References: <20090314010937.416083662@mini.kroah.org> +Content-Disposition: inline; filename=cdc_ether-add-usb-id-for-ericsson-f3507g.patch +Content-Length: 1372 +Lines: 38 + +2.6.28-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Bjørn Mork + +commit cac477e8f1038c41b6f29d3161ce351462ef3df7 upstream. + +The Ericsson F3507g wireless broadband module provides a CDC Ethernet +compliant interface, but identifies it as a "Mobile Direct Line" CDC +subclass, thereby preventing the CDC Ethernet class driver from picking +it up. This patch adds the device id to cdc_ether.c as a workaround. + +Ericsson has provided a "class" driver for this device: +http://kerneltrap.org/mailarchive/linux-net/2008/10/28/3832094 +But closer inspection of that driver reveals that it adds little more +than duplication of code from cdc_ether.c. See also +http://marc.info/?l=linux-usb&m=123334979706403&w=2 + +Signed-off-by: Bjørn Mork +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/usb/cdc_ether.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/net/usb/cdc_ether.c ++++ b/drivers/net/usb/cdc_ether.c +@@ -559,6 +559,11 @@ static const struct usb_device_id produc + USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_ETHERNET, + USB_CDC_PROTO_NONE), + .driver_info = (unsigned long) &cdc_info, ++}, { ++ /* Ericsson F3507g */ ++ USB_DEVICE_AND_INTERFACE_INFO(0x0bdb, 0x1900, USB_CLASS_COMM, ++ USB_CDC_SUBCLASS_MDLM, USB_CDC_PROTO_NONE), ++ .driver_info = (unsigned long) &cdc_info, + }, + { }, // END + }; + + +From gregkh@mini.kroah.org Fri Mar 13 18:10:42 2009 +Message-Id: <20090314011042.626092557@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:10:53 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Dmitriy Taychenachev , + "David S. Miller" +Subject: [patch 076/114] zaurus: add usb id for motomagx phones +References: <20090314010937.416083662@mini.kroah.org> +Content-Disposition: inline; filename=zaurus-add-usb-id-for-motomagx-phones.patch +Content-Length: 1183 +Lines: 33 + +2.6.28-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Dmitriy Taychenachev + +commit 52c0326beaa3cb0049d0f1c51c6ad5d4a04e4430 upstream. + +The Motorola MOTOMAGX phones (Z6, E8, Zn5 so far) are providing +combined ACM/BLAN USB configuration. Since it has Vendor Specific +class, the corresponding drivers (cdc-acm, zaurus) can't find it just +by interface info. This patch adds usb id so the zaurus driver can +properly handle this combined device. + +Signed-off-by: Dmitriy Taychenachev +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/usb/zaurus.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/net/usb/zaurus.c ++++ b/drivers/net/usb/zaurus.c +@@ -341,6 +341,11 @@ static const struct usb_device_id produc + USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_MDLM, + USB_CDC_PROTO_NONE), + .driver_info = (unsigned long) &bogus_mdlm_info, ++}, { ++ /* Motorola MOTOMAGX phones */ ++ USB_DEVICE_AND_INTERFACE_INFO(0x22b8, 0x6425, USB_CLASS_COMM, ++ USB_CDC_SUBCLASS_MDLM, USB_CDC_PROTO_NONE), ++ .driver_info = (unsigned long) &bogus_mdlm_info, + }, + + /* Olympus has some models with a Zaurus-compatible option. + + +From gregkh@mini.kroah.org Fri Mar 13 18:10:42 2009 +Message-Id: <20090314011042.780575799@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:10:54 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Meelis Roos , + "David S. Miller" +Subject: [patch 077/114] fore200: fix oops on failed firmware load +References: <20090314010937.416083662@mini.kroah.org> +Content-Disposition: inline; filename=fore200-fix-oops-on-failed-firmware-load.patch +Content-Length: 1033 +Lines: 30 + +2.6.28-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Meelis Roos + +commit fcffd0d8bbddac757cd856e635ac75e8eb4518bc upstream. + +Fore 200 ATM driver fails to handle request_firmware failures and oopses +when no firmware file was found. Fix it by checking for the right return +values and propaganting the return value up. + +Signed-off-by: Meelis Roos +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/atm/fore200e.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/atm/fore200e.c ++++ b/drivers/atm/fore200e.c +@@ -2519,8 +2519,8 @@ fore200e_load_and_start_fw(struct fore20 + return err; + + sprintf(buf, "%s%s", fore200e->bus->proc_name, FW_EXT); +- if (request_firmware(&firmware, buf, device) == 1) { +- printk(FORE200E "missing %s firmware image\n", fore200e->bus->model_name); ++ if ((err = request_firmware(&firmware, buf, device)) < 0) { ++ printk(FORE200E "problem loading firmware image %s\n", fore200e->bus->model_name); + return err; + } + + + +From gregkh@mini.kroah.org Fri Mar 13 18:10:43 2009 +Message-Id: <20090314011042.933206789@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:10:55 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Alexander Duyck , + Jeff Kirsher , + Jesse Barnes , + Matthew Wilcox +Subject: [patch 078/114] PCI: Add PCI quirk to disable L0s ASPM state for 82575 and 82598 +References: <20090314010937.416083662@mini.kroah.org> +Content-Disposition: inline; filename=pci-add-pci-quirk-to-disable-l0s-aspm-state-for-82575-and-82598.patch +Content-Length: 3109 +Lines: 68 + +2.6.28-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Alexander Duyck + +commit 649426efcfbc67a8b033497151816cbac9fd0cfa upstream. + +This patch is intended to disable L0s ASPM link state for 82598 (ixgbe) +parts due to the fact that it is possible to corrupt TX data when coming +back out of L0s on some systems. The workaround had been added for 82575 +(igb) previously, but did not use the ASPM api. This quirk uses the ASPM +api to prevent the ASPM subsystem from re-enabling the L0s state. + +Instead of adding the fix in igb to the ixgbe driver as well it was +decided to move it into a pci quirk. It is necessary to move the fix out +of the driver and into a pci quirk in order to prevent the issue from +occuring prior to driver load to handle the possibility of the device being +passed to a VM via direct assignment. + +Signed-off-by: Alexander Duyck +Signed-off-by: Jeff Kirsher +CC: Jesse Barnes +Signed-off-by: Matthew Wilcox +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pci/quirks.c | 25 +++++++++++++++++++++++++ + 1 file changed, 25 insertions(+) + +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -23,6 +23,7 @@ + #include + #include + #include ++#include + #include "pci.h" + + int isa_dma_bridge_buggy; +@@ -1543,6 +1544,30 @@ static void __devinit quirk_e100_interru + } + DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, PCI_ANY_ID, quirk_e100_interrupt); + ++/* ++ * The 82575 and 82598 may experience data corruption issues when transitioning ++ * out of L0S. To prevent this we need to disable L0S on the pci-e link ++ */ ++static void __devinit quirk_disable_aspm_l0s(struct pci_dev *dev) ++{ ++ dev_info(&dev->dev, "Disabling L0s\n"); ++ pci_disable_link_state(dev, PCIE_LINK_STATE_L0S); ++} ++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x10a7, quirk_disable_aspm_l0s); ++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x10a9, quirk_disable_aspm_l0s); ++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x10b6, quirk_disable_aspm_l0s); ++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x10c6, quirk_disable_aspm_l0s); ++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x10c7, quirk_disable_aspm_l0s); ++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x10c8, quirk_disable_aspm_l0s); ++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x10d6, quirk_disable_aspm_l0s); ++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x10db, quirk_disable_aspm_l0s); ++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x10dd, quirk_disable_aspm_l0s); ++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x10e1, quirk_disable_aspm_l0s); ++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x10ec, quirk_disable_aspm_l0s); ++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x10f1, quirk_disable_aspm_l0s); ++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x10f4, quirk_disable_aspm_l0s); ++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x1508, quirk_disable_aspm_l0s); ++ + static void __devinit fixup_rev1_53c810(struct pci_dev* dev) + { + /* rev 1 ncr53c810 chips don't set the class at all which means + + +From gregkh@mini.kroah.org Fri Mar 13 18:10:43 2009 +Message-Id: <20090314011043.083385451@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:10:56 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Oleg Nesterov , + Roland McGrath , + David Howells , + "Serge E. Hallyn" +Subject: [patch 079/114] copy_process: fix CLONE_PARENT && parent_exec_id interaction +References: <20090314010937.416083662@mini.kroah.org> +Content-Disposition: inline; filename=copy_process-fix-clone_parent-parent_exec_id-interaction.patch +Content-Length: 1766 +Lines: 54 + +2.6.28-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Oleg Nesterov + +commit 2d5516cbb9daf7d0e342a2e3b0fc6f8c39a81205 upstream. + +CLONE_PARENT can fool the ->self_exec_id/parent_exec_id logic. If we +re-use the old parent, we must also re-use ->parent_exec_id to make +sure exit_notify() sees the right ->xxx_exec_id's when the CLONE_PARENT'ed +task exits. + +Also, move down the "p->parent_exec_id = p->self_exec_id" thing, to place +two different cases together. + +Signed-off-by: Oleg Nesterov +Cc: Roland McGrath +Cc: Andrew Morton +Cc: David Howells +Cc: Serge E. Hallyn +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/fork.c | 11 +++++------ + 1 file changed, 5 insertions(+), 6 deletions(-) + +--- a/kernel/fork.c ++++ b/kernel/fork.c +@@ -1176,10 +1176,6 @@ static struct task_struct *copy_process( + #endif + clear_all_latency_tracing(p); + +- /* Our parent execution domain becomes current domain +- These must match for thread signalling to apply */ +- p->parent_exec_id = p->self_exec_id; +- + /* ok, now we should be set up.. */ + p->exit_signal = (clone_flags & CLONE_THREAD) ? -1 : (clone_flags & CSIGNAL); + p->pdeath_signal = 0; +@@ -1217,10 +1213,13 @@ static struct task_struct *copy_process( + set_task_cpu(p, smp_processor_id()); + + /* CLONE_PARENT re-uses the old parent */ +- if (clone_flags & (CLONE_PARENT|CLONE_THREAD)) ++ if (clone_flags & (CLONE_PARENT|CLONE_THREAD)) { + p->real_parent = current->real_parent; +- else ++ p->parent_exec_id = current->parent_exec_id; ++ } else { + p->real_parent = current; ++ p->parent_exec_id = current->self_exec_id; ++ } + + spin_lock(¤t->sighand->siglock); + + + +From gregkh@mini.kroah.org Fri Mar 13 18:10:43 2009 +Message-Id: <20090314011043.229448008@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:10:57 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Matt Mackall , + Alexey Dobriyan +Subject: [patch 080/114] proc: fix PG_locked reporting in /proc/kpageflags +References: <20090314010937.416083662@mini.kroah.org> +Content-Disposition: inline; filename=proc-fix-pg_locked-reporting-in-proc-kpageflags.patch +Content-Length: 832 +Lines: 27 + +2.6.28-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Helge Bahmann + +commit e07a4b9217d1e97d2f3a62b6b070efdc61212110 upstream. + +Expr always evaluates to zero. + +Cc: Matt Mackall +Signed-off-by: Andrew Morton +Signed-off-by: Alexey Dobriyan +Signed-off-by: Greg Kroah-Hartman + +--- + fs/proc/page.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/proc/page.c ++++ b/fs/proc/page.c +@@ -107,7 +107,7 @@ static ssize_t kpageflags_read(struct fi + else + kflags = ppage->flags; + +- uflags = kpf_copy_bit(KPF_LOCKED, PG_locked, kflags) | ++ uflags = kpf_copy_bit(kflags, KPF_LOCKED, PG_locked) | + kpf_copy_bit(kflags, KPF_ERROR, PG_error) | + kpf_copy_bit(kflags, KPF_REFERENCED, PG_referenced) | + kpf_copy_bit(kflags, KPF_UPTODATE, PG_uptodate) | + + +From gregkh@mini.kroah.org Fri Mar 13 18:10:43 2009 +Message-Id: <20090314011043.372383693@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:10:58 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Michael Neuling , + Benjamin Herrenschmidt +Subject: [patch 081/114] powerpc: Fix load/store float double alignment handler +References: <20090314010937.416083662@mini.kroah.org> +Content-Disposition: inline; filename=powerpc-fix-load-store-float-double-alignment-handler.patch +Content-Length: 1907 +Lines: 63 + +2.6.28-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Michael Neuling + +commit 49f297f8df9adb797334155470ea9ca68bdb041e upstream. + +When we introduced VSX, we changed the way FPRs are stored in the +thread_struct. Unfortunately we missed the load/store float double +alignment handler code when updating how we access FPRs in the +thread_struct. + +Below fixes this and merges the little/big endian case. + +Signed-off-by: Michael Neuling +Signed-off-by: Benjamin Herrenschmidt +Signed-off-by: Greg Kroah-Hartman + +--- + arch/powerpc/kernel/align.c | 29 +++++++++++++---------------- + 1 file changed, 13 insertions(+), 16 deletions(-) + +--- a/arch/powerpc/kernel/align.c ++++ b/arch/powerpc/kernel/align.c +@@ -367,27 +367,24 @@ static int emulate_multiple(struct pt_re + static int emulate_fp_pair(unsigned char __user *addr, unsigned int reg, + unsigned int flags) + { +- char *ptr = (char *) ¤t->thread.TS_FPR(reg); +- int i, ret; ++ char *ptr0 = (char *) ¤t->thread.TS_FPR(reg); ++ char *ptr1 = (char *) ¤t->thread.TS_FPR(reg+1); ++ int i, ret, sw = 0; + + if (!(flags & F)) + return 0; + if (reg & 1) + return 0; /* invalid form: FRS/FRT must be even */ +- if (!(flags & SW)) { +- /* not byte-swapped - easy */ +- if (!(flags & ST)) +- ret = __copy_from_user(ptr, addr, 16); +- else +- ret = __copy_to_user(addr, ptr, 16); +- } else { +- /* each FPR value is byte-swapped separately */ +- ret = 0; +- for (i = 0; i < 16; ++i) { +- if (!(flags & ST)) +- ret |= __get_user(ptr[i^7], addr + i); +- else +- ret |= __put_user(ptr[i^7], addr + i); ++ if (flags & SW) ++ sw = 7; ++ ret = 0; ++ for (i = 0; i < 8; ++i) { ++ if (!(flags & ST)) { ++ ret |= __get_user(ptr0[i^sw], addr + i); ++ ret |= __get_user(ptr1[i^sw], addr + i + 8); ++ } else { ++ ret |= __put_user(ptr0[i^sw], addr + i); ++ ret |= __put_user(ptr1[i^sw], addr + i + 8); + } + } + if (ret) + + +From gregkh@mini.kroah.org Fri Mar 13 18:10:43 2009 +Message-Id: <20090314011043.500507452@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:10:59 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Ben Dooks , + Anton Vorontsov , + Pierre Ossman +Subject: [patch 082/114] sdhci: Add quirk for controllers with no end-of-busy IRQ +References: <20090314010937.416083662@mini.kroah.org> +Content-Disposition: inline; filename=sdhci-add-quirk-for-controllers-with-no-end-of-busy-irq.patch +Content-Length: 1645 +Lines: 48 + +2.6.28-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Ben Dooks + +commit f945405cdecd9e0ae3e58ff84cabd19b4522965e upstream. + +The Samsung SDHCI (and FSL eSDHC) controller block seems to fail +to generate an INT_DATA_END after the transfer has completed and +the bus busy state finished. + +Changes in e809517f6fa5803a5a1cd56026f0e2190fc13d5c to use the +new busy method are the cause of the behaviour change. + +Signed-off-by: Ben Dooks +Signed-off-by: Anton Vorontsov +Signed-off-by: Pierre Ossman +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mmc/host/sdhci.c | 5 ++++- + drivers/mmc/host/sdhci.h | 2 ++ + 2 files changed, 6 insertions(+), 1 deletion(-) + +--- a/drivers/mmc/host/sdhci.c ++++ b/drivers/mmc/host/sdhci.c +@@ -1286,8 +1286,11 @@ static void sdhci_cmd_irq(struct sdhci_h + if (host->cmd->data) + DBG("Cannot wait for busy signal when also " + "doing a data transfer"); +- else ++ else if (!(host->quirks & SDHCI_QUIRK_NO_BUSY_IRQ)) + return; ++ ++ /* The controller does not support the end-of-busy IRQ, ++ * fall through and take the SDHCI_INT_RESPONSE */ + } + + if (intmask & SDHCI_INT_RESPONSE) +--- a/drivers/mmc/host/sdhci.h ++++ b/drivers/mmc/host/sdhci.h +@@ -210,6 +210,8 @@ struct sdhci_host { + #define SDHCI_QUIRK_BROKEN_SMALL_PIO (1<<13) + /* Controller supports high speed but doesn't have the caps bit set */ + #define SDHCI_QUIRK_FORCE_HIGHSPEED (1<<14) ++/* Controller does not provide transfer-complete interrupt when not busy */ ++#define SDHCI_QUIRK_NO_BUSY_IRQ (1<<15) + + int irq; /* Device IRQ */ + void __iomem * ioaddr; /* Mapped address */ + + +From gregkh@mini.kroah.org Fri Mar 13 18:10:43 2009 +Message-Id: <20090314011043.647123722@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:11:00 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Andres Salomon , + Pierre Ossman +Subject: [patch 083/114] sdhci: Add NO_BUSY_IRQ quirk for Marvell CAFE host chip +References: <20090314010937.416083662@mini.kroah.org> +Content-Disposition: inline; filename=sdhci-add-no_busy_irq-quirk-for-marvell-cafe-host-chip.patch +Content-Length: 884 +Lines: 29 + +2.6.28-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Andres Salomon + +commit a0874897b1ba106298e4303a25456a473fc40f3d upstream. + +As described here: http://lkml.org/lkml/2009/2/20/265 + +The CAFE chip is broken due to commit e809517f6fa5803a5a1cd5602. +Anton added a quirk here: http://lkml.org/lkml/2009/2/20/279 that fixes +CAFE's problem. This adds the quirk for CAFE. + +Signed-off-by: Andres Salomon +Signed-off-by: Pierre Ossman +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mmc/host/sdhci-pci.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/mmc/host/sdhci-pci.c ++++ b/drivers/mmc/host/sdhci-pci.c +@@ -107,6 +107,7 @@ static const struct sdhci_pci_fixes sdhc + + static const struct sdhci_pci_fixes sdhci_cafe = { + .quirks = SDHCI_QUIRK_NO_SIMULT_VDD_AND_POWER | ++ SDHCI_QUIRK_NO_BUSY_IRQ | + SDHCI_QUIRK_BROKEN_TIMEOUT_VAL, + }; + + + +From gregkh@mini.kroah.org Fri Mar 13 18:10:43 2009 +Message-Id: <20090314011043.790685951@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:11:01 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Oleg Nesterov , + Al Viro , + Andi Kleen , + Jonathan Corbet +Subject: [patch 084/114] pipe_rdwr_fasync: fix the error handling to prevent the leak/crash +References: <20090314010937.416083662@mini.kroah.org> +Content-Disposition: inline; filename=pipe_rdwr_fasync-fix-the-error-handling-to-prevent-the-leak-crash.patch +Content-Length: 1405 +Lines: 45 + +2.6.28-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Oleg Nesterov + +commit e5bc49ba7439b9726006d031d440cba96819f0f8 upstream. + +If the second fasync_helper() fails, pipe_rdwr_fasync() returns the error +but leaves the file on ->fasync_readers. + +This was always wrong, but since 233e70f4228e78eb2f80dc6650f65d3ae3dbf17c +"saner FASYNC handling on file close" we have the new problem. Because in +this case setfl() doesn't set FASYNC bit, __fput() will not do +->fasync(0), and we leak fasync_struct with ->fa_file pointing to the +freed file. + +Signed-off-by: Oleg Nesterov +Cc: Al Viro +Cc: Andi Kleen +Cc: Jonathan Corbet +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + fs/pipe.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/fs/pipe.c ++++ b/fs/pipe.c +@@ -699,12 +699,12 @@ pipe_rdwr_fasync(int fd, struct file *fi + int retval; + + mutex_lock(&inode->i_mutex); +- + retval = fasync_helper(fd, filp, on, &pipe->fasync_readers); +- +- if (retval >= 0) ++ if (retval >= 0) { + retval = fasync_helper(fd, filp, on, &pipe->fasync_writers); +- ++ if (retval < 0) /* this can happen only if on == T */ ++ fasync_helper(-1, filp, 0, &pipe->fasync_readers); ++ } + mutex_unlock(&inode->i_mutex); + + if (retval < 0) + + +From gregkh@mini.kroah.org Fri Mar 13 18:10:44 2009 +Message-Id: <20090314011043.959273650@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:11:02 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Devin Heitmueller , + Mauro Carvalho Chehab +Subject: [patch 085/114] DVB: s5h1409: Perform s5h1409 soft reset after tuning +References: <20090314010937.416083662@mini.kroah.org> +Content-Disposition: inline; filename=0001-DVB-s5h1409-Perform-s5h1409-soft-reset-after-tunin.patch +Content-Length: 1637 +Lines: 50 + +2.6.28-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Devin Heitmueller + +(cherry picked from commit 67e70baf043cfdcdaf5972bc94be82632071536b) + +Just like with the s5h1411, the s5h1409 needs a soft-reset in order for it +to know that the tuner has been told to change frequencies. This change +changes the behavior from "random tuning times between 500ms to complete +tuning lock failures" to "tuning lock consistently within 700ms". + +Thanks to Robert Krakora for doing +initial testing of the patch on the KWorld 330U. + +Thanks to Andy Walls for doing testing of the patch on +the HVR-1600. + +Thanks to Michael Krufky for doing additional testing. + +Signed-off-by: Devin Heitmueller +Signed-off-by: Michael Krufky +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/dvb/frontends/s5h1409.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +--- a/drivers/media/dvb/frontends/s5h1409.c ++++ b/drivers/media/dvb/frontends/s5h1409.c +@@ -545,9 +545,6 @@ static int s5h1409_set_frontend(struct d + + s5h1409_enable_modulation(fe, p->u.vsb.modulation); + +- /* Allow the demod to settle */ +- msleep(100); +- + if (fe->ops.tuner_ops.set_params) { + if (fe->ops.i2c_gate_ctrl) + fe->ops.i2c_gate_ctrl(fe, 1); +@@ -562,6 +559,10 @@ static int s5h1409_set_frontend(struct d + s5h1409_set_qam_interleave_mode(fe); + } + ++ /* Issue a reset to the demod so it knows to resync against the ++ newly tuned frequency */ ++ s5h1409_softreset(fe); ++ + return 0; + } + + + +From gregkh@mini.kroah.org Fri Mar 13 18:10:44 2009 +Message-Id: <20090314011044.109722459@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:11:03 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Mauro Carvalho Chehab +Subject: [patch 086/114] V4L: tda8290: fix TDA8290 + TDA18271 initialization +References: <20090314010937.416083662@mini.kroah.org> +Content-Disposition: inline; filename=0002-V4L-tda8290-fix-TDA8290-TDA18271-initialization.patch +Content-Length: 957 +Lines: 29 + +2.6.28-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Michael Krufky + +(cherry picked from commit 439b72b69e4992e9ec34b74304f0fa95623934eb) + +Don't call tda8290_init_tuner unless we have either a TDA8275 or TDA8275A +present. Calling this function will cause a TDA18271 to get sick, so we +should only call it when needed. + +Signed-off-by: Michael Krufky +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/common/tuners/tda8290.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/media/common/tuners/tda8290.c ++++ b/drivers/media/common/tuners/tda8290.c +@@ -724,7 +724,8 @@ struct dvb_frontend *tda829x_attach(stru + fe->ops.analog_ops.info.name = name; + + if (priv->ver & TDA8290) { +- tda8290_init_tuner(fe); ++ if (priv->ver & (TDA8275 | TDA8275A)) ++ tda8290_init_tuner(fe); + tda8290_init_if(fe); + } else if (priv->ver & TDA8295) + tda8295_init_if(fe); + + +From gregkh@mini.kroah.org Fri Mar 13 18:10:44 2009 +Message-Id: <20090314011044.265489107@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:11:04 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Martin Dauskardt , + Hans Verkuil , + Mauro Carvalho Chehab +Subject: [patch 087/114] V4L: saa7127: fix broken S-Video with saa7129 +References: <20090314010937.416083662@mini.kroah.org> +Content-Disposition: inline; filename=0003-V4L-saa7127-fix-broken-S-Video-with-saa7129.patch +Content-Length: 4233 +Lines: 114 + +2.6.28-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Martin Dauskardt + +(backported from commit 0f3559ef17362a7dd5017521a4dd4cad31263395) + +Register 0x2d has to be set differently in the saa7129 compared to the +saa7127. This was not done correctly, so S-Video was broken in certain +circumstances. + +This fixes a regression introduced in 2.6.28. + +Signed-off-by: Martin Dauskardt +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Michael Krufky +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/video/saa7127.c | 52 ++++++++++++++++++++++++------------------ + 1 file changed, 30 insertions(+), 22 deletions(-) + +--- a/drivers/media/video/saa7127.c ++++ b/drivers/media/video/saa7127.c +@@ -149,7 +149,7 @@ static const struct i2c_reg_value saa712 + { SAA7127_REG_COPYGEN_0, 0x77 }, + { SAA7127_REG_COPYGEN_1, 0x41 }, + { SAA7127_REG_COPYGEN_2, 0x00 }, /* Macrovision enable/disable */ +- { SAA7127_REG_OUTPUT_PORT_CONTROL, 0x9e }, ++ { SAA7127_REG_OUTPUT_PORT_CONTROL, 0xbf }, + { SAA7127_REG_GAIN_LUMINANCE_RGB, 0x00 }, + { SAA7127_REG_GAIN_COLORDIFF_RGB, 0x00 }, + { SAA7127_REG_INPUT_PORT_CONTROL_1, 0x80 }, /* for color bars */ +@@ -479,12 +479,18 @@ static int saa7127_set_output_type(struc + break; + + case SAA7127_OUTPUT_TYPE_COMPOSITE: +- state->reg_2d = 0x08; /* 00001000 CVBS only, RGB DAC's off (high impedance mode) */ ++ if (state->ident == V4L2_IDENT_SAA7129) ++ state->reg_2d = 0x20; /* CVBS only */ ++ else ++ state->reg_2d = 0x08; /* 00001000 CVBS only, RGB DAC's off (high impedance mode) */ + state->reg_3a = 0x13; /* by default switch YUV to RGB-matrix on */ + break; + + case SAA7127_OUTPUT_TYPE_SVIDEO: +- state->reg_2d = 0xff; /* 11111111 croma -> R, luma -> CVBS + G + B */ ++ if (state->ident == V4L2_IDENT_SAA7129) ++ state->reg_2d = 0x18; /* Y + C */ ++ else ++ state->reg_2d = 0xff; /*11111111 croma -> R, luma -> CVBS + G + B */ + state->reg_3a = 0x13; /* by default switch YUV to RGB-matrix on */ + break; + +@@ -499,7 +505,10 @@ static int saa7127_set_output_type(struc + break; + + case SAA7127_OUTPUT_TYPE_BOTH: +- state->reg_2d = 0xbf; ++ if (state->ident == V4L2_IDENT_SAA7129) ++ state->reg_2d = 0x38; ++ else ++ state->reg_2d = 0xbf; + state->reg_3a = 0x13; /* by default switch YUV to RGB-matrix on */ + break; + +@@ -691,24 +700,6 @@ static int saa7127_probe(struct i2c_clie + + i2c_set_clientdata(client, state); + +- /* Configure Encoder */ +- +- v4l_dbg(1, debug, client, "Configuring encoder\n"); +- saa7127_write_inittab(client, saa7127_init_config_common); +- saa7127_set_std(client, V4L2_STD_NTSC); +- saa7127_set_output_type(client, SAA7127_OUTPUT_TYPE_BOTH); +- saa7127_set_vps(client, &vbi); +- saa7127_set_wss(client, &vbi); +- saa7127_set_cc(client, &vbi); +- saa7127_set_xds(client, &vbi); +- if (test_image == 1) +- /* The Encoder has an internal Colorbar generator */ +- /* This can be used for debugging */ +- saa7127_set_input_type(client, SAA7127_INPUT_TYPE_TEST_IMAGE); +- else +- saa7127_set_input_type(client, SAA7127_INPUT_TYPE_NORMAL); +- saa7127_set_video_enable(client, 1); +- + if (id->driver_data) { /* Chip type is already known */ + state->ident = id->driver_data; + } else { /* Needs detection */ +@@ -730,6 +721,23 @@ static int saa7127_probe(struct i2c_clie + + v4l_info(client, "%s found @ 0x%x (%s)\n", client->name, + client->addr << 1, client->adapter->name); ++ ++ v4l_dbg(1, debug, client, "Configuring encoder\n"); ++ saa7127_write_inittab(client, saa7127_init_config_common); ++ saa7127_set_std(client, V4L2_STD_NTSC); ++ saa7127_set_output_type(client, SAA7127_OUTPUT_TYPE_BOTH); ++ saa7127_set_vps(client, &vbi); ++ saa7127_set_wss(client, &vbi); ++ saa7127_set_cc(client, &vbi); ++ saa7127_set_xds(client, &vbi); ++ if (test_image == 1) ++ /* The Encoder has an internal Colorbar generator */ ++ /* This can be used for debugging */ ++ saa7127_set_input_type(client, SAA7127_INPUT_TYPE_TEST_IMAGE); ++ else ++ saa7127_set_input_type(client, SAA7127_INPUT_TYPE_NORMAL); ++ saa7127_set_video_enable(client, 1); ++ + if (state->ident == V4L2_IDENT_SAA7129) + saa7127_write_inittab(client, saa7129_init_config_extra); + return 0; + + +From gregkh@mini.kroah.org Fri Mar 13 18:10:44 2009 +Message-Id: <20090314011044.402723723@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:11:05 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Hans Verkuil , + Mauro Carvalho Chehab +Subject: [patch 088/114] V4L: ivtv: fix decoder crash regression +References: <20090314010937.416083662@mini.kroah.org> +Content-Disposition: inline; filename=0004-V4L-ivtv-fix-decoder-crash-regression.patch +Content-Length: 1863 +Lines: 63 + +2.6.28-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Hans Verkuil + +(cherry picked from commit ac9575f75c52bcb455120f8c43376b556acba048) + +The video_ioctl2 conversion of ivtv in kernel 2.6.27 introduced a bug +causing decoder commands to crash. The decoder commands should have been +handled from the video_ioctl2 default handler, ensuring correct mapping +of the argument between user and kernel space. Unfortunately they ended +up before the video_ioctl2 call, causing random crashes. + +Thanks to hannes@linus.priv.at for testing and helping me track down the +cause! + +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Michael Krufky +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/video/ivtv/ivtv-ioctl.c | 24 ++++++++++++------------ + 1 file changed, 12 insertions(+), 12 deletions(-) + +--- a/drivers/media/video/ivtv/ivtv-ioctl.c ++++ b/drivers/media/video/ivtv/ivtv-ioctl.c +@@ -1750,6 +1750,18 @@ static int ivtv_default(struct file *fil + break; + } + ++ case IVTV_IOC_DMA_FRAME: ++ case VIDEO_GET_PTS: ++ case VIDEO_GET_FRAME_COUNT: ++ case VIDEO_GET_EVENT: ++ case VIDEO_PLAY: ++ case VIDEO_STOP: ++ case VIDEO_FREEZE: ++ case VIDEO_CONTINUE: ++ case VIDEO_COMMAND: ++ case VIDEO_TRY_COMMAND: ++ return ivtv_decoder_ioctls(file, cmd, (void *)arg); ++ + default: + return -EINVAL; + } +@@ -1792,18 +1804,6 @@ static long ivtv_serialized_ioctl(struct + ivtv_vapi(itv, CX2341X_DEC_SET_AUDIO_MODE, 2, itv->audio_bilingual_mode, itv->audio_stereo_mode); + return 0; + +- case IVTV_IOC_DMA_FRAME: +- case VIDEO_GET_PTS: +- case VIDEO_GET_FRAME_COUNT: +- case VIDEO_GET_EVENT: +- case VIDEO_PLAY: +- case VIDEO_STOP: +- case VIDEO_FREEZE: +- case VIDEO_CONTINUE: +- case VIDEO_COMMAND: +- case VIDEO_TRY_COMMAND: +- return ivtv_decoder_ioctls(filp, cmd, (void *)arg); +- + default: + break; + } + + +From gregkh@mini.kroah.org Fri Mar 13 18:10:44 2009 +Message-Id: <20090314011044.553768976@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:11:06 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + linux-ext4@vger.kernel.org, + Jan Kara , + Eric Sandeen +Subject: [patch 089/114] jbd2: Fix return value of jbd2_journal_start_commit() +References: <20090314010937.416083662@mini.kroah.org> +Content-Disposition: inline; filename=jbd2-fix-return-value-of-jbd2_journal_start_commit.patch +Content-Length: 3545 +Lines: 96 + + +2.6.28-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Jan Kara + +(cherry picked from commit c88ccea3143975294f5a52097546bcbb75975f52) + +The function jbd2_journal_start_commit() returns 1 if either a +transaction is committing or the function has queued a transaction +commit. But it returns 0 if we raced with somebody queueing the +transaction commit as well. This resulted in ext4_sync_fs() not +functioning correctly (description from Arthur Jones): + + In the case of a data=ordered umount with pending long symlinks + which are delayed due to a long list of other I/O on the backing + block device, this causes the buffer associated with the long + symlinks to not be moved to the inode dirty list in the second + phase of fsync_super. Then, before they can be dirtied again, + kjournald exits, seeing the UMOUNT flag and the dirty pages are + never written to the backing block device, causing long symlink + corruption and exposing new or previously freed block data to + userspace. + +This can be reproduced with a script created by Eric Sandeen +: + + #!/bin/bash + + umount /mnt/test2 + mount /dev/sdb4 /mnt/test2 + rm -f /mnt/test2/* + dd if=/dev/zero of=/mnt/test2/bigfile bs=1M count=512 + touch /mnt/test2/thisisveryveryveryveryveryveryveryveryveryveryveryveryveryveryveryverylongfilename + ln -s /mnt/test2/thisisveryveryveryveryveryveryveryveryveryveryveryveryveryveryveryverylongfilename + /mnt/test2/link + umount /mnt/test2 + mount /dev/sdb4 /mnt/test2 + ls /mnt/test2/ + +This patch fixes jbd2_journal_start_commit() to always return 1 when +there's a transaction committing or queued for commit. + +Signed-off-by: Jan Kara +Signed-off-by: "Theodore Ts'o" +CC: Eric Sandeen +CC: linux-ext4@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman + +--- + fs/jbd2/journal.c | 17 +++++++++++------ + 1 file changed, 11 insertions(+), 6 deletions(-) + +--- a/fs/jbd2/journal.c ++++ b/fs/jbd2/journal.c +@@ -430,7 +430,7 @@ int __jbd2_log_space_left(journal_t *jou + } + + /* +- * Called under j_state_lock. Returns true if a transaction was started. ++ * Called under j_state_lock. Returns true if a transaction commit was started. + */ + int __jbd2_log_start_commit(journal_t *journal, tid_t target) + { +@@ -498,7 +498,8 @@ int jbd2_journal_force_commit_nested(jou + + /* + * Start a commit of the current running transaction (if any). Returns true +- * if a transaction was started, and fills its tid in at *ptid ++ * if a transaction is going to be committed (or is currently already ++ * committing), and fills its tid in at *ptid + */ + int jbd2_journal_start_commit(journal_t *journal, tid_t *ptid) + { +@@ -508,15 +509,19 @@ int jbd2_journal_start_commit(journal_t + if (journal->j_running_transaction) { + tid_t tid = journal->j_running_transaction->t_tid; + +- ret = __jbd2_log_start_commit(journal, tid); +- if (ret && ptid) ++ __jbd2_log_start_commit(journal, tid); ++ /* There's a running transaction and we've just made sure ++ * it's commit has been scheduled. */ ++ if (ptid) + *ptid = tid; +- } else if (journal->j_committing_transaction && ptid) { ++ ret = 1; ++ } else if (journal->j_committing_transaction) { + /* + * If ext3_write_super() recently started a commit, then we + * have to wait for completion of that transaction + */ +- *ptid = journal->j_committing_transaction->t_tid; ++ if (ptid) ++ *ptid = journal->j_committing_transaction->t_tid; + ret = 1; + } + spin_unlock(&journal->j_state_lock); + + +From gregkh@mini.kroah.org Fri Mar 13 18:10:44 2009 +Message-Id: <20090314011044.703024399@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:11:07 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + linux-ext4@vger.kernel.org, + Jan Kara , + Eric Sandeen +Subject: [patch 090/114] Revert "ext4: wait on all pending commits in ext4_sync_fs()" +References: <20090314010937.416083662@mini.kroah.org> +Content-Disposition: inline; filename=revert-ext4-wait-on-all-pending-commits-in-ext4_sync_fs.patch +Content-Length: 1479 +Lines: 51 + + +2.6.28-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Jan Kara + +(cherry picked from commit 9eddacf9e9c03578ef2c07c9534423e823d677f8) + +This undoes commit 14ce0cb411c88681ab8f3a4c9caa7f42e97a3184. + +Since jbd2_journal_start_commit() is now fixed to return 1 when we +started a transaction commit, there's some transaction waiting to be +committed or there's a transaction already committing, we don't +need to call ext4_force_commit() in ext4_sync_fs(). Furthermore +ext4_force_commit() can unnecessarily create sync transaction which is +expensive so it's worthwhile to remove it when we can. + +http://bugzilla.kernel.org/show_bug.cgi?id=12224 + +Signed-off-by: Jan Kara +Signed-off-by: "Theodore Ts'o" +Cc: Eric Sandeen +Cc: linux-ext4@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman + +--- + fs/ext4/super.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +--- a/fs/ext4/super.c ++++ b/fs/ext4/super.c +@@ -2914,15 +2914,15 @@ static void ext4_write_super(struct supe + + static int ext4_sync_fs(struct super_block *sb, int wait) + { +- int ret = 0; ++ tid_t target; + + trace_mark(ext4_sync_fs, "dev %s wait %d", sb->s_id, wait); + sb->s_dirt = 0; +- if (wait) +- ret = ext4_force_commit(sb); +- else +- jbd2_journal_start_commit(EXT4_SB(sb)->s_journal, NULL); +- return ret; ++ if (jbd2_journal_start_commit(EXT4_SB(sb)->s_journal, &target)) { ++ if (wait) ++ jbd2_log_wait_commit(EXT4_SB(sb)->s_journal, target); ++ } ++ return 0; + } + + /* + + +From gregkh@mini.kroah.org Fri Mar 13 18:10:44 2009 +Message-Id: <20090314011044.850951987@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:11:08 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Dan Carpenter , + mfasheh@suse.de, + Jan Kara , + linux-ext4@vger.kernel.org, + ocfs2-devel@oss.oracle.com, + Joel Becker +Subject: [patch 091/114] jbd2: Avoid possible NULL dereference in jbd2_journal_begin_ordered_truncate() +References: <20090314010937.416083662@mini.kroah.org> +Content-Disposition: inline; filename=jbd2-avoid-possible-null-dereference-in-jbd2_journal_begin_ordered_truncate.patch +Content-Length: 5572 +Lines: 135 + + +2.6.28-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Jan Kara + +(cherry picked from commit 7f5aa215088b817add9c71914b83650bdd49f8a9) + +If we race with commit code setting i_transaction to NULL, we could +possibly dereference it. Proper locking requires the journal pointer +(to access journal->j_list_lock), which we don't have. So we have to +change the prototype of the function so that filesystem passes us the +journal pointer. Also add a more detailed comment about why the +function jbd2_journal_begin_ordered_truncate() does what it does and +how it should be used. + +Thanks to Dan Carpenter for pointing to the +suspitious code. + +Signed-off-by: Jan Kara +Signed-off-by: "Theodore Ts'o" +Acked-by: Joel Becker +CC: linux-ext4@vger.kernel.org +CC: ocfs2-devel@oss.oracle.com +CC: mfasheh@suse.de +CC: Dan Carpenter +Signed-off-by: Greg Kroah-Hartman + +--- + fs/ext4/inode.c | 6 ++++-- + fs/jbd2/transaction.c | 42 +++++++++++++++++++++++++++++++----------- + fs/ocfs2/journal.h | 6 ++++-- + include/linux/jbd2.h | 3 ++- + 4 files changed, 41 insertions(+), 16 deletions(-) + +--- a/fs/ext4/inode.c ++++ b/fs/ext4/inode.c +@@ -46,8 +46,10 @@ + static inline int ext4_begin_ordered_truncate(struct inode *inode, + loff_t new_size) + { +- return jbd2_journal_begin_ordered_truncate(&EXT4_I(inode)->jinode, +- new_size); ++ return jbd2_journal_begin_ordered_truncate( ++ EXT4_SB(inode->i_sb)->s_journal, ++ &EXT4_I(inode)->jinode, ++ new_size); + } + + static void ext4_invalidatepage(struct page *page, unsigned long offset); +--- a/fs/jbd2/transaction.c ++++ b/fs/jbd2/transaction.c +@@ -2050,26 +2050,46 @@ done: + } + + /* +- * This function must be called when inode is journaled in ordered mode +- * before truncation happens. It starts writeout of truncated part in +- * case it is in the committing transaction so that we stand to ordered +- * mode consistency guarantees. ++ * File truncate and transaction commit interact with each other in a ++ * non-trivial way. If a transaction writing data block A is ++ * committing, we cannot discard the data by truncate until we have ++ * written them. Otherwise if we crashed after the transaction with ++ * write has committed but before the transaction with truncate has ++ * committed, we could see stale data in block A. This function is a ++ * helper to solve this problem. It starts writeout of the truncated ++ * part in case it is in the committing transaction. ++ * ++ * Filesystem code must call this function when inode is journaled in ++ * ordered mode before truncation happens and after the inode has been ++ * placed on orphan list with the new inode size. The second condition ++ * avoids the race that someone writes new data and we start ++ * committing the transaction after this function has been called but ++ * before a transaction for truncate is started (and furthermore it ++ * allows us to optimize the case where the addition to orphan list ++ * happens in the same transaction as write --- we don't have to write ++ * any data in such case). + */ +-int jbd2_journal_begin_ordered_truncate(struct jbd2_inode *inode, ++int jbd2_journal_begin_ordered_truncate(journal_t *journal, ++ struct jbd2_inode *jinode, + loff_t new_size) + { +- journal_t *journal; +- transaction_t *commit_trans; ++ transaction_t *inode_trans, *commit_trans; + int ret = 0; + +- if (!inode->i_transaction && !inode->i_next_transaction) ++ /* This is a quick check to avoid locking if not necessary */ ++ if (!jinode->i_transaction) + goto out; +- journal = inode->i_transaction->t_journal; ++ /* Locks are here just to force reading of recent values, it is ++ * enough that the transaction was not committing before we started ++ * a transaction adding the inode to orphan list */ + spin_lock(&journal->j_state_lock); + commit_trans = journal->j_committing_transaction; + spin_unlock(&journal->j_state_lock); +- if (inode->i_transaction == commit_trans) { +- ret = filemap_fdatawrite_range(inode->i_vfs_inode->i_mapping, ++ spin_lock(&journal->j_list_lock); ++ inode_trans = jinode->i_transaction; ++ spin_unlock(&journal->j_list_lock); ++ if (inode_trans == commit_trans) { ++ ret = filemap_fdatawrite_range(jinode->i_vfs_inode->i_mapping, + new_size, LLONG_MAX); + if (ret) + jbd2_journal_abort(journal, ret); +--- a/fs/ocfs2/journal.h ++++ b/fs/ocfs2/journal.h +@@ -445,8 +445,10 @@ static inline int ocfs2_jbd2_file_inode( + static inline int ocfs2_begin_ordered_truncate(struct inode *inode, + loff_t new_size) + { +- return jbd2_journal_begin_ordered_truncate(&OCFS2_I(inode)->ip_jinode, +- new_size); ++ return jbd2_journal_begin_ordered_truncate( ++ OCFS2_SB(inode->i_sb)->journal->j_journal, ++ &OCFS2_I(inode)->ip_jinode, ++ new_size); + } + + #endif /* OCFS2_JOURNAL_H */ +--- a/include/linux/jbd2.h ++++ b/include/linux/jbd2.h +@@ -1087,7 +1087,8 @@ extern int jbd2_journal_clear_err (j + extern int jbd2_journal_bmap(journal_t *, unsigned long, unsigned long long *); + extern int jbd2_journal_force_commit(journal_t *); + extern int jbd2_journal_file_inode(handle_t *handle, struct jbd2_inode *inode); +-extern int jbd2_journal_begin_ordered_truncate(struct jbd2_inode *inode, loff_t new_size); ++extern int jbd2_journal_begin_ordered_truncate(journal_t *journal, ++ struct jbd2_inode *inode, loff_t new_size); + extern void jbd2_journal_init_jbd_inode(struct jbd2_inode *jinode, struct inode *inode); + extern void jbd2_journal_release_jbd_inode(journal_t *journal, struct jbd2_inode *jinode); + + + +From gregkh@mini.kroah.org Fri Mar 13 18:10:45 2009 +Message-Id: <20090314011045.002488989@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:11:09 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Wei Yongjun +Subject: [patch 092/114] ext4: Fix to read empty directory blocks correctly in 64k +References: <20090314010937.416083662@mini.kroah.org> +Content-Disposition: inline; filename=ext4-fix-to-read-empty-directory-blocks-correctly-in-64k.patch +Content-Length: 1413 +Lines: 40 + + +2.6.28-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Wei Yongjun + +(cherry picked from commit 7be2baaa0322c59ba888aa5260a8c130666acd41) + +The rec_len field in the directory entry is 16 bits, so there was a +problem representing rec_len for filesystems with a 64k block size in +the case where the directory entry takes the entire 64k block. +Unfortunately, there were two schemes that were proposed; one where +all zeros meant 65536 and one where all ones (65535) meant 65536. +E2fsprogs used 0, whereas the kernel used 65535. Oops. Fortunately +this case happens extremely rarely, with the most common case being +the lost+found directory, created by mke2fs. + +So we will be liberal in what we accept, and accept both encodings, +but we will continue to encode 65536 as 65535. This will require a +change in e2fsprogs, but with fortunately ext4 filesystems normally +have the dir_index feature enabled, which precludes having a +completely empty directory block. + +Signed-off-by: Wei Yongjun +Signed-off-by: "Theodore Ts'o" +Signed-off-by: Greg Kroah-Hartman + +--- + fs/ext4/ext4.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/ext4/ext4.h ++++ b/fs/ext4/ext4.h +@@ -862,7 +862,7 @@ static inline unsigned ext4_rec_len_from + { + unsigned len = le16_to_cpu(dlen); + +- if (len == EXT4_MAX_REC_LEN) ++ if (len == EXT4_MAX_REC_LEN || len == 0) + return 1 << 16; + return len; + } + + +From gregkh@mini.kroah.org Fri Mar 13 18:10:45 2009 +Message-Id: <20090314011045.159567971@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:11:10 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + "Aneesh Kumar K.V" +Subject: [patch 093/114] ext4: Fix lockdep warning +References: <20090314010937.416083662@mini.kroah.org> +Content-Disposition: inline; filename=ext4-fix-lockdep-warning.patch +Content-Length: 2258 +Lines: 72 + + +2.6.28-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Aneesh Kumar K.V + +(cherry picked from commit ba4439165f0f0d25b2fe065cf0c1ff8130b802eb) + +We should not call ext4_mb_add_n_trim while holding alloc_semp. + + ============================================= + [ INFO: possible recursive locking detected ] + 2.6.29-rc4-git1-dirty #124 + --------------------------------------------- + ffsb/3116 is trying to acquire lock: + (&meta_group_info[i]->alloc_sem){----}, at: [] + ext4_mb_load_buddy+0xd2/0x343 + + but task is already holding lock: + (&meta_group_info[i]->alloc_sem){----}, at: [] + ext4_mb_load_buddy+0xd2/0x343 + +http://bugzilla.kernel.org/show_bug.cgi?id=12672 + +Signed-off-by: Aneesh Kumar K.V +Signed-off-by: "Theodore Ts'o" +Signed-off-by: Greg Kroah-Hartman + +--- + fs/ext4/mballoc.c | 29 ++++++++++++++++------------- + 1 file changed, 16 insertions(+), 13 deletions(-) + +--- a/fs/ext4/mballoc.c ++++ b/fs/ext4/mballoc.c +@@ -4456,23 +4456,26 @@ static int ext4_mb_release_context(struc + pa->pa_free -= ac->ac_b_ex.fe_len; + pa->pa_len -= ac->ac_b_ex.fe_len; + spin_unlock(&pa->pa_lock); +- /* +- * We want to add the pa to the right bucket. +- * Remove it from the list and while adding +- * make sure the list to which we are adding +- * doesn't grow big. +- */ +- if (likely(pa->pa_free)) { +- spin_lock(pa->pa_obj_lock); +- list_del_rcu(&pa->pa_inode_list); +- spin_unlock(pa->pa_obj_lock); +- ext4_mb_add_n_trim(ac); +- } + } +- ext4_mb_put_pa(ac, ac->ac_sb, pa); + } + if (ac->alloc_semp) + up_read(ac->alloc_semp); ++ if (pa) { ++ /* ++ * We want to add the pa to the right bucket. ++ * Remove it from the list and while adding ++ * make sure the list to which we are adding ++ * doesn't grow big. We need to release ++ * alloc_semp before calling ext4_mb_add_n_trim() ++ */ ++ if (pa->pa_linear && likely(pa->pa_free)) { ++ spin_lock(pa->pa_obj_lock); ++ list_del_rcu(&pa->pa_inode_list); ++ spin_unlock(pa->pa_obj_lock); ++ ext4_mb_add_n_trim(ac); ++ } ++ ext4_mb_put_pa(ac, ac->ac_sb, pa); ++ } + if (ac->ac_bitmap_page) + page_cache_release(ac->ac_bitmap_page); + if (ac->ac_buddy_page) + + +From gregkh@mini.kroah.org Fri Mar 13 18:10:45 2009 +Message-Id: <20090314011045.310960315@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:11:11 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + "Aneesh Kumar K.V" +Subject: [patch 094/114] ext4: Initialize preallocation list_heads properly +References: <20090314010937.416083662@mini.kroah.org> +Content-Disposition: inline; filename=ext4-initialize-preallocation-list_head-s-properly.patch +Content-Length: 1149 +Lines: 38 + + +2.6.28-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Aneesh Kumar K.V + +(cherry picked from commit d794bf8e0936dce45104565cd48c571061f4c1e3) + +When creating a new ext4_prealloc_space structure, we have to +initialize its list_head pointers before we add them to any prealloc +lists. Otherwise, with list debug enabled, we will get list +corruption warnings. + +Signed-off-by: Aneesh Kumar K.V +Signed-off-by: "Theodore Ts'o" +Signed-off-by: Greg Kroah-Hartman + +--- + fs/ext4/mballoc.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/fs/ext4/mballoc.c ++++ b/fs/ext4/mballoc.c +@@ -3690,6 +3690,8 @@ ext4_mb_new_inode_pa(struct ext4_allocat + pa->pa_free = pa->pa_len; + atomic_set(&pa->pa_count, 1); + spin_lock_init(&pa->pa_lock); ++ INIT_LIST_HEAD(&pa->pa_inode_list); ++ INIT_LIST_HEAD(&pa->pa_group_list); + pa->pa_deleted = 0; + pa->pa_linear = 0; + +@@ -3748,6 +3750,7 @@ ext4_mb_new_group_pa(struct ext4_allocat + atomic_set(&pa->pa_count, 1); + spin_lock_init(&pa->pa_lock); + INIT_LIST_HEAD(&pa->pa_inode_list); ++ INIT_LIST_HEAD(&pa->pa_group_list); + pa->pa_deleted = 0; + pa->pa_linear = 1; + + + +From gregkh@mini.kroah.org Fri Mar 13 18:10:45 2009 +Message-Id: <20090314011045.451648868@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:11:12 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + "Aneesh Kumar K.V" +Subject: [patch 095/114] ext4: Implement range_cyclic in ext4_da_writepages instead of write_cache_pages +References: <20090314010937.416083662@mini.kroah.org> +Content-Disposition: inline; filename=ext4-implement-range_cyclic-in-ext4_da_writepages-instead-of-write_cache_pages.patch +Content-Length: 3066 +Lines: 94 + + +2.6.28-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Aneesh Kumar K.V + +(cherry picked from commit 2acf2c261b823d9d9ed954f348b97620297a36b5) + +With delayed allocation we lock the page in write_cache_pages() and +try to build an in memory extent of contiguous blocks. This is needed +so that we can get large contiguous blocks request. If range_cyclic +mode is enabled, write_cache_pages() will loop back to the 0 index if +no I/O has been done yet, and try to start writing from the beginning +of the range. That causes an attempt to take the page lock of lower +index page while holding the page lock of higher index page, which can +cause a dead lock with another writeback thread. + +The solution is to implement the range_cyclic behavior in +ext4_da_writepages() instead. + +http://bugzilla.kernel.org/show_bug.cgi?id=12579 + +Signed-off-by: Aneesh Kumar K.V +Signed-off-by: "Theodore Ts'o" +Signed-off-by: Greg Kroah-Hartman + +--- + fs/ext4/inode.c | 21 +++++++++++++++++++-- + 1 file changed, 19 insertions(+), 2 deletions(-) + +--- a/fs/ext4/inode.c ++++ b/fs/ext4/inode.c +@@ -2402,6 +2402,7 @@ static int ext4_da_writepages(struct add + struct inode *inode = mapping->host; + int no_nrwrite_index_update; + long pages_written = 0, pages_skipped; ++ int range_cyclic, cycled = 1, io_done = 0; + int needed_blocks, ret = 0, nr_to_writebump = 0; + struct ext4_sb_info *sbi = EXT4_SB(mapping->host->i_sb); + +@@ -2439,9 +2440,15 @@ static int ext4_da_writepages(struct add + if (wbc->range_start == 0 && wbc->range_end == LLONG_MAX) + range_whole = 1; + +- if (wbc->range_cyclic) ++ range_cyclic = wbc->range_cyclic; ++ if (wbc->range_cyclic) { + index = mapping->writeback_index; +- else ++ if (index) ++ cycled = 0; ++ wbc->range_start = index << PAGE_CACHE_SHIFT; ++ wbc->range_end = LLONG_MAX; ++ wbc->range_cyclic = 0; ++ } else + index = wbc->range_start >> PAGE_CACHE_SHIFT; + + mpd.wbc = wbc; +@@ -2455,6 +2462,7 @@ static int ext4_da_writepages(struct add + wbc->no_nrwrite_index_update = 1; + pages_skipped = wbc->pages_skipped; + ++retry: + while (!ret && wbc->nr_to_write > 0) { + + /* +@@ -2497,6 +2505,7 @@ static int ext4_da_writepages(struct add + pages_written += mpd.pages_written; + wbc->pages_skipped = pages_skipped; + ret = 0; ++ io_done = 1; + } else if (wbc->nr_to_write) + /* + * There is no more writeout needed +@@ -2505,6 +2514,13 @@ static int ext4_da_writepages(struct add + */ + break; + } ++ if (!io_done && !cycled) { ++ cycled = 1; ++ index = 0; ++ wbc->range_start = index << PAGE_CACHE_SHIFT; ++ wbc->range_end = mapping->writeback_index - 1; ++ goto retry; ++ } + if (pages_skipped != wbc->pages_skipped) + printk(KERN_EMERG "This should not happen leaving %s " + "with nr_to_write = %ld ret = %d\n", +@@ -2512,6 +2528,7 @@ static int ext4_da_writepages(struct add + + /* Update index */ + index += pages_written; ++ wbc->range_cyclic = range_cyclic; + if (wbc->range_cyclic || (range_whole && wbc->nr_to_write > 0)) + /* + * set the writeback_index so that range_cyclic + + +From gregkh@mini.kroah.org Fri Mar 13 18:10:45 2009 +Message-Id: <20090314011045.608542421@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:11:13 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Dan Carpenter +Subject: [patch 096/114] ext4: Fix NULL dereference in ext4_ext_migrate()s error handling +References: <20090314010937.416083662@mini.kroah.org> +Content-Disposition: inline; filename=ext4-fix-null-dereference-in-ext4_ext_migrate-s-error-handling.patch +Content-Length: 1198 +Lines: 49 + + +2.6.28-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Dan Carpenter + +(cherry picked from commit 090542641de833c6f756895fc2f139f046e298f9) + +This was found through a code checker (http://repo.or.cz/w/smatch.git/). +It looks like you might be able to trigger the error by trying to migrate +a readonly file system. + +Signed-off-by: Dan Carpenter +Signed-off-by: "Theodore Ts'o" +Signed-off-by: Greg Kroah-Hartman + +--- + fs/ext4/migrate.c | 8 +++----- + 1 file changed, 3 insertions(+), 5 deletions(-) + +--- a/fs/ext4/migrate.c ++++ b/fs/ext4/migrate.c +@@ -480,7 +480,7 @@ int ext4_ext_migrate(struct inode *inode + + 1); + if (IS_ERR(handle)) { + retval = PTR_ERR(handle); +- goto err_out; ++ return retval; + } + tmp_inode = ext4_new_inode(handle, + inode->i_sb->s_root->d_inode, +@@ -488,8 +488,7 @@ int ext4_ext_migrate(struct inode *inode + if (IS_ERR(tmp_inode)) { + retval = -ENOMEM; + ext4_journal_stop(handle); +- tmp_inode = NULL; +- goto err_out; ++ return retval; + } + i_size_write(tmp_inode, i_size_read(inode)); + /* +@@ -617,8 +616,7 @@ err_out: + + ext4_journal_stop(handle); + +- if (tmp_inode) +- iput(tmp_inode); ++ iput(tmp_inode); + + return retval; + } + + +From gregkh@mini.kroah.org Fri Mar 13 18:10:45 2009 +Message-Id: <20090314011045.758367881@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:11:14 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Ext4 Developers List +Subject: [patch 097/114] ext4: Add fallback for find_group_flex +References: <20090314010937.416083662@mini.kroah.org> +Content-Disposition: inline; filename=ext4-add-fallback-for-find_group_flex.patch +Content-Length: 1358 +Lines: 42 + +2.6.28-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: "Theodore Ts'o" + +(cherry picked from commit 05bf9e839d9de4e8a094274a0a2fd07beb47eaf1) + +This is a workaround for find_group_flex() which badly needs to be +replaced. One of its problems (besides ignoring the Orlov algorithm) +is that it is a bit hyperactive about returning failure under +suspicious circumstances. This can lead to spurious ENOSPC failures +even when there are inodes still available. + +Work around this for now by retrying the search using +find_group_other() if find_group_flex() returns -1. If +find_group_other() succeeds when find_group_flex() has failed, log a +warning message. + +A better block/inode allocator that will fix this problem for real has +been queued up for the next merge window. + +Signed-off-by: "Theodore Ts'o" +Signed-off-by: Greg Kroah-Hartman + +--- + fs/ext4/ialloc.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/fs/ext4/ialloc.c ++++ b/fs/ext4/ialloc.c +@@ -703,6 +703,13 @@ struct inode *ext4_new_inode(handle_t *h + + if (sbi->s_log_groups_per_flex) { + ret2 = find_group_flex(sb, dir, &group); ++ if (ret2 == -1) { ++ ret2 = find_group_other(sb, dir, &group); ++ if (ret2 == 0 && printk_ratelimit()) ++ printk(KERN_NOTICE "ext4: find_group_flex " ++ "failed, fallback succeeded dir %lu\n", ++ dir->i_ino); ++ } + goto got_group; + } + + + +From gregkh@mini.kroah.org Fri Mar 13 18:10:46 2009 +Message-Id: <20090314011045.914471586@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:11:15 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Ext4 Developers List , + Jan Kara +Subject: [patch 098/114] ext4: Fix deadlock in ext4_write_begin() and ext4_da_write_begin() +References: <20090314010937.416083662@mini.kroah.org> +Content-Disposition: inline; filename=ext4-fix-deadlock-in-ext4_write_begin-and-ext4_da_write_begin.patch +Content-Length: 1596 +Lines: 55 + + +2.6.28-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Jan Kara + +(cherry picked from commit ebd3610b110bbb18ea6f9f2aeed1e1068c537227) + +Functions ext4_write_begin() and ext4_da_write_begin() call +grab_cache_page_write_begin() without AOP_FLAG_NOFS. Thus it +can happen that page reclaim is triggered in that function +and it recurses back into the filesystem (or some other filesystem). +But this can lead to various problems as a transaction is already +started at that point. Add the necessary flag. + +http://bugzilla.kernel.org/show_bug.cgi?id=11688 + +Signed-off-by: Jan Kara +Signed-off-by: "Theodore Ts'o" +Signed-off-by: Greg Kroah-Hartman + +--- + fs/ext4/inode.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +--- a/fs/ext4/inode.c ++++ b/fs/ext4/inode.c +@@ -1347,6 +1347,10 @@ retry: + goto out; + } + ++ /* We cannot recurse into the filesystem as the transaction is already ++ * started */ ++ flags |= AOP_FLAG_NOFS; ++ + page = grab_cache_page_write_begin(mapping, index, flags); + if (!page) { + ext4_journal_stop(handle); +@@ -1356,7 +1360,7 @@ retry: + *pagep = page; + + ret = block_write_begin(file, mapping, pos, len, flags, pagep, fsdata, +- ext4_get_block); ++ ext4_get_block); + + if (!ret && ext4_should_journal_data(inode)) { + ret = walk_page_buffers(handle, page_buffers(page), +@@ -2603,6 +2607,9 @@ retry: + ret = PTR_ERR(handle); + goto out; + } ++ /* We cannot recurse into the filesystem as the transaction is already ++ * started */ ++ flags |= AOP_FLAG_NOFS; + + page = grab_cache_page_write_begin(mapping, index, flags); + if (!page) { + + +From gregkh@mini.kroah.org Fri Mar 13 18:10:46 2009 +Message-Id: <20090314011046.066141918@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:11:16 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jeremy Fitzhardinge , + Thomas Gleixner +Subject: [patch 099/114] x86/paravirt: make arch_flush_lazy_mmu/cpu disable preemption +References: <20090314010937.416083662@mini.kroah.org> +Content-Disposition: inline; filename=x86-paravirt-make-arch_flush_lazy_mmu-cpu-disable-preemption.patch +Content-Length: 2671 +Lines: 93 + +2.6.28-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Jeremy Fitzhardinge + +commit d85cf93da66977dbc645352be1b2084a659d8a0b upstream. + +Impact: avoid access to percpu vars in preempible context + +They are intended to be used whenever there's the possibility +that there's some stale state which is going to be overwritten +with a queued update, or to force a state change when we may be +in lazy mode. Either way, we could end up calling it with +preemption enabled, so wrap the functions in their own little +preempt-disable section so they can be safely called in any +context (though preemption should never be enabled if we're actually +in a lazy state). + +(Move out of line to avoid #include dependencies.) + +Signed-off-by: Jeremy Fitzhardinge +Signed-off-by: Thomas Gleixner +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/include/asm/paravirt.h | 17 ++--------------- + arch/x86/kernel/paravirt.c | 24 ++++++++++++++++++++++++ + 2 files changed, 26 insertions(+), 15 deletions(-) + +--- a/arch/x86/include/asm/paravirt.h ++++ b/arch/x86/include/asm/paravirt.h +@@ -1352,14 +1352,7 @@ static inline void arch_leave_lazy_cpu_m + PVOP_VCALL0(pv_cpu_ops.lazy_mode.leave); + } + +-static inline void arch_flush_lazy_cpu_mode(void) +-{ +- if (unlikely(paravirt_get_lazy_mode() == PARAVIRT_LAZY_CPU)) { +- arch_leave_lazy_cpu_mode(); +- arch_enter_lazy_cpu_mode(); +- } +-} +- ++void arch_flush_lazy_cpu_mode(void); + + #define __HAVE_ARCH_ENTER_LAZY_MMU_MODE + static inline void arch_enter_lazy_mmu_mode(void) +@@ -1372,13 +1365,7 @@ static inline void arch_leave_lazy_mmu_m + PVOP_VCALL0(pv_mmu_ops.lazy_mode.leave); + } + +-static inline void arch_flush_lazy_mmu_mode(void) +-{ +- if (unlikely(paravirt_get_lazy_mode() == PARAVIRT_LAZY_MMU)) { +- arch_leave_lazy_mmu_mode(); +- arch_enter_lazy_mmu_mode(); +- } +-} ++void arch_flush_lazy_mmu_mode(void); + + static inline void __set_fixmap(unsigned /* enum fixed_addresses */ idx, + unsigned long phys, pgprot_t flags) +--- a/arch/x86/kernel/paravirt.c ++++ b/arch/x86/kernel/paravirt.c +@@ -268,6 +268,30 @@ enum paravirt_lazy_mode paravirt_get_laz + return __get_cpu_var(paravirt_lazy_mode); + } + ++void arch_flush_lazy_mmu_mode(void) ++{ ++ preempt_disable(); ++ ++ if (paravirt_get_lazy_mode() == PARAVIRT_LAZY_MMU) { ++ arch_leave_lazy_mmu_mode(); ++ arch_enter_lazy_mmu_mode(); ++ } ++ ++ preempt_enable(); ++} ++ ++void arch_flush_lazy_cpu_mode(void) ++{ ++ preempt_disable(); ++ ++ if (paravirt_get_lazy_mode() == PARAVIRT_LAZY_CPU) { ++ arch_leave_lazy_cpu_mode(); ++ arch_enter_lazy_cpu_mode(); ++ } ++ ++ preempt_enable(); ++} ++ + struct pv_info pv_info = { + .name = "bare hardware", + .paravirt_enabled = 0, + + +From gregkh@mini.kroah.org Fri Mar 13 18:10:46 2009 +Message-Id: <20090314011046.207940178@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:11:17 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + John Stultz , + Ingo Molnar +Subject: [patch 100/114] x86, hpet: fix for LS21 + HPET = boot hang +References: <20090314010937.416083662@mini.kroah.org> +Content-Disposition: inline; filename=x86-hpet-fix-for-ls21-hpet-boot-hang.patch +Content-Length: 1788 +Lines: 51 + +2.6.28-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: john stultz + +commit b13e24644c138d0ddbc451403c30a96b09bfd556 upstream. + +Between 2.6.23 and 2.6.24-rc1 a change was made that broke IBM LS21 +systems that had the HPET enabled in the BIOS, resulting in boot hangs +for x86_64. + +Specifically commit b8ce33590687888ebb900d09557b8807c4539022, which +merges the i386 and x86_64 HPET code. + +Prior to this commit, when we setup the HPET timers in x86_64, we did +the following: + + hpet_writel(HPET_TN_ENABLE | HPET_TN_PERIODIC | HPET_TN_SETVAL | + HPET_TN_32BIT, HPET_T0_CFG); + +However after the i386/x86_64 HPET merge, we do the following: + + cfg = hpet_readl(HPET_Tn_CFG(timer)); + cfg |= HPET_TN_ENABLE | HPET_TN_PERIODIC | + HPET_TN_SETVAL | HPET_TN_32BIT; + hpet_writel(cfg, HPET_Tn_CFG(timer)); + +However on LS21s with HPET enabled in the BIOS, the HPET_T0_CFG register +boots with Level triggered interrupts (HPET_TN_LEVEL) enabled. This +causes the periodic interrupt to be not so periodic, and that results in +the boot time hang I reported earlier in the delay calibration. + +My fix: Always disable HPET_TN_LEVEL when setting up periodic mode. + +Signed-off-by: John Stultz +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/hpet.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/arch/x86/kernel/hpet.c ++++ b/arch/x86/kernel/hpet.c +@@ -267,6 +267,8 @@ static void hpet_set_mode(enum clock_eve + now = hpet_readl(HPET_COUNTER); + cmp = now + (unsigned long) delta; + cfg = hpet_readl(HPET_Tn_CFG(timer)); ++ /* Make sure we use edge triggered interrupts */ ++ cfg &= ~HPET_TN_LEVEL; + cfg |= HPET_TN_ENABLE | HPET_TN_PERIODIC | + HPET_TN_SETVAL | HPET_TN_32BIT; + hpet_writel(cfg, HPET_Tn_CFG(timer)); + + +From gregkh@mini.kroah.org Fri Mar 13 18:10:46 2009 +Message-Id: <20090314011046.351163467@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:11:18 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Tejun Heo , + Ingo Molnar +Subject: [patch 101/114] x86: math_emu info cleanup +References: <20090314010937.416083662@mini.kroah.org> +Content-Disposition: inline; filename=x86-math_emu-info-cleanup.patch +Content-Length: 7426 +Lines: 240 + +2.6.28-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Tejun Heo + +commit ae6af41f5a4841f06eb92bc86ad020ad44ae2a30 upstream. + +Impact: cleanup + +* Come on, struct info? s/struct info/struct math_emu_info/ + +* Use struct pt_regs and kernel_vm86_regs instead of defining its own + register frame structure. + +Signed-off-by: Tejun Heo +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/include/asm/math_emu.h | 29 ++++------------- + arch/x86/include/asm/processor.h | 2 - + arch/x86/math-emu/fpu_entry.c | 2 - + arch/x86/math-emu/fpu_proto.h | 2 - + arch/x86/math-emu/fpu_system.h | 14 ++++---- + arch/x86/math-emu/get_address.c | 63 ++++++++++++++++++--------------------- + 6 files changed, 48 insertions(+), 64 deletions(-) + +--- a/arch/x86/include/asm/math_emu.h ++++ b/arch/x86/include/asm/math_emu.h +@@ -1,31 +1,18 @@ + #ifndef _ASM_X86_MATH_EMU_H + #define _ASM_X86_MATH_EMU_H + ++#include ++#include ++ + /* This structure matches the layout of the data saved to the stack + following a device-not-present interrupt, part of it saved + automatically by the 80386/80486. + */ +-struct info { ++struct math_emu_info { + long ___orig_eip; +- long ___ebx; +- long ___ecx; +- long ___edx; +- long ___esi; +- long ___edi; +- long ___ebp; +- long ___eax; +- long ___ds; +- long ___es; +- long ___fs; +- long ___orig_eax; +- long ___eip; +- long ___cs; +- long ___eflags; +- long ___esp; +- long ___ss; +- long ___vm86_es; /* This and the following only in vm86 mode */ +- long ___vm86_ds; +- long ___vm86_fs; +- long ___vm86_gs; ++ union { ++ struct pt_regs regs; ++ struct kernel_vm86_regs vm86; ++ }; + }; + #endif /* _ASM_X86_MATH_EMU_H */ +--- a/arch/x86/include/asm/processor.h ++++ b/arch/x86/include/asm/processor.h +@@ -349,7 +349,7 @@ struct i387_soft_struct { + u8 no_update; + u8 rm; + u8 alimit; +- struct info *info; ++ struct math_emu_info *info; + u32 entry_eip; + }; + +--- a/arch/x86/math-emu/fpu_entry.c ++++ b/arch/x86/math-emu/fpu_entry.c +@@ -659,7 +659,7 @@ static int valid_prefix(u_char *Byte, u_ + } + } + +-void math_abort(struct info *info, unsigned int signal) ++void math_abort(struct math_emu_info *info, unsigned int signal) + { + FPU_EIP = FPU_ORIG_EIP; + current->thread.trap_no = 16; +--- a/arch/x86/math-emu/fpu_proto.h ++++ b/arch/x86/math-emu/fpu_proto.h +@@ -52,7 +52,7 @@ extern void fst_i_(void); + extern void fstp_i(void); + /* fpu_entry.c */ + asmlinkage extern void math_emulate(long arg); +-extern void math_abort(struct info *info, unsigned int signal); ++extern void math_abort(struct math_emu_info *info, unsigned int signal); + /* fpu_etc.c */ + extern void FPU_etc(void); + /* fpu_tags.c */ +--- a/arch/x86/math-emu/fpu_system.h ++++ b/arch/x86/math-emu/fpu_system.h +@@ -18,7 +18,7 @@ + + /* This sets the pointer FPU_info to point to the argument part + of the stack frame of math_emulate() */ +-#define SETUP_DATA_AREA(arg) FPU_info = (struct info *) &arg ++#define SETUP_DATA_AREA(arg) FPU_info = (struct math_emu_info *) &arg + + /* s is always from a cpu register, and the cpu does bounds checking + * during register load --> no further bounds checks needed */ +@@ -38,12 +38,12 @@ + #define I387 (current->thread.xstate) + #define FPU_info (I387->soft.info) + +-#define FPU_CS (*(unsigned short *) &(FPU_info->___cs)) +-#define FPU_SS (*(unsigned short *) &(FPU_info->___ss)) +-#define FPU_DS (*(unsigned short *) &(FPU_info->___ds)) +-#define FPU_EAX (FPU_info->___eax) +-#define FPU_EFLAGS (FPU_info->___eflags) +-#define FPU_EIP (FPU_info->___eip) ++#define FPU_CS (*(unsigned short *) &(FPU_info->regs.cs)) ++#define FPU_SS (*(unsigned short *) &(FPU_info->regs.ss)) ++#define FPU_DS (*(unsigned short *) &(FPU_info->regs.ds)) ++#define FPU_EAX (FPU_info->regs.ax) ++#define FPU_EFLAGS (FPU_info->regs.flags) ++#define FPU_EIP (FPU_info->regs.ip) + #define FPU_ORIG_EIP (FPU_info->___orig_eip) + + #define FPU_lookahead (I387->soft.lookahead) +--- a/arch/x86/math-emu/get_address.c ++++ b/arch/x86/math-emu/get_address.c +@@ -29,42 +29,39 @@ + #define FPU_WRITE_BIT 0x10 + + static int reg_offset[] = { +- offsetof(struct info, ___eax), +- offsetof(struct info, ___ecx), +- offsetof(struct info, ___edx), +- offsetof(struct info, ___ebx), +- offsetof(struct info, ___esp), +- offsetof(struct info, ___ebp), +- offsetof(struct info, ___esi), +- offsetof(struct info, ___edi) ++ offsetof(struct math_emu_info, regs.ax), ++ offsetof(struct math_emu_info, regs.cx), ++ offsetof(struct math_emu_info, regs.dx), ++ offsetof(struct math_emu_info, regs.bx), ++ offsetof(struct math_emu_info, regs.sp), ++ offsetof(struct math_emu_info, regs.bp), ++ offsetof(struct math_emu_info, regs.si), ++ offsetof(struct math_emu_info, regs.di) + }; + + #define REG_(x) (*(long *)(reg_offset[(x)]+(u_char *) FPU_info)) + + static int reg_offset_vm86[] = { +- offsetof(struct info, ___cs), +- offsetof(struct info, ___vm86_ds), +- offsetof(struct info, ___vm86_es), +- offsetof(struct info, ___vm86_fs), +- offsetof(struct info, ___vm86_gs), +- offsetof(struct info, ___ss), +- offsetof(struct info, ___vm86_ds) ++ offsetof(struct math_emu_info, regs.cs), ++ offsetof(struct math_emu_info, vm86.ds), ++ offsetof(struct math_emu_info, vm86.es), ++ offsetof(struct math_emu_info, vm86.fs), ++ offsetof(struct math_emu_info, vm86.gs), ++ offsetof(struct math_emu_info, regs.ss), ++ offsetof(struct math_emu_info, vm86.ds) + }; + + #define VM86_REG_(x) (*(unsigned short *) \ + (reg_offset_vm86[((unsigned)x)]+(u_char *) FPU_info)) + +-/* This dummy, gs is not saved on the stack. */ +-#define ___GS ___ds +- + static int reg_offset_pm[] = { +- offsetof(struct info, ___cs), +- offsetof(struct info, ___ds), +- offsetof(struct info, ___es), +- offsetof(struct info, ___fs), +- offsetof(struct info, ___GS), +- offsetof(struct info, ___ss), +- offsetof(struct info, ___ds) ++ offsetof(struct math_emu_info, regs.cs), ++ offsetof(struct math_emu_info, regs.ds), ++ offsetof(struct math_emu_info, regs.es), ++ offsetof(struct math_emu_info, regs.fs), ++ offsetof(struct math_emu_info, regs.ds), /* dummy, not saved on stack */ ++ offsetof(struct math_emu_info, regs.ss), ++ offsetof(struct math_emu_info, regs.ds) + }; + + #define PM_REG_(x) (*(unsigned short *) \ +@@ -349,34 +346,34 @@ void __user *FPU_get_address_16(u_char F + } + switch (rm) { + case 0: +- address += FPU_info->___ebx + FPU_info->___esi; ++ address += FPU_info->regs.bx + FPU_info->regs.si; + break; + case 1: +- address += FPU_info->___ebx + FPU_info->___edi; ++ address += FPU_info->regs.bx + FPU_info->regs.di; + break; + case 2: +- address += FPU_info->___ebp + FPU_info->___esi; ++ address += FPU_info->regs.bp + FPU_info->regs.si; + if (addr_modes.override.segment == PREFIX_DEFAULT) + addr_modes.override.segment = PREFIX_SS_; + break; + case 3: +- address += FPU_info->___ebp + FPU_info->___edi; ++ address += FPU_info->regs.bp + FPU_info->regs.di; + if (addr_modes.override.segment == PREFIX_DEFAULT) + addr_modes.override.segment = PREFIX_SS_; + break; + case 4: +- address += FPU_info->___esi; ++ address += FPU_info->regs.si; + break; + case 5: +- address += FPU_info->___edi; ++ address += FPU_info->regs.di; + break; + case 6: +- address += FPU_info->___ebp; ++ address += FPU_info->regs.bp; + if (addr_modes.override.segment == PREFIX_DEFAULT) + addr_modes.override.segment = PREFIX_SS_; + break; + case 7: +- address += FPU_info->___ebx; ++ address += FPU_info->regs.bx; + break; + } + + + +From gregkh@mini.kroah.org Fri Mar 13 18:10:46 2009 +Message-Id: <20090314011046.519991983@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:11:19 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Tejun Heo , + Ingo Molnar +Subject: [patch 102/114] x86: fix math_emu register frame access +References: <20090314010937.416083662@mini.kroah.org> +Content-Disposition: inline; filename=x86-fix-math_emu-register-frame-access.patch +Content-Length: 9835 +Lines: 283 + +2.6.28-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Tejun Heo + +commit d315760ffa261c15ff92699ac6f514112543d7ca upstream. + +do_device_not_available() is the handler for #NM and it declares that +it takes a unsigned long and calls math_emu(), which takes a long +argument and surprisingly expects the stack frame starting at the zero +argument would match struct math_emu_info, which isn't true regardless +of configuration in the current code. + +This patch makes do_device_not_available() take struct pt_regs like +other exception handlers and initialize struct math_emu_info with +pointer to it and pass pointer to the math_emu_info to math_emulate() +like normal C functions do. This way, unless gcc makes a copy of +struct pt_regs in do_device_not_available(), the register frame is +correctly accessed regardless of kernel configuration or compiler +used. + +This doesn't fix all math_emu problems but it at least gets it +somewhat working. + +Signed-off-by: Tejun Heo +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/include/asm/math_emu.h | 4 +- + arch/x86/include/asm/traps.h | 4 +- + arch/x86/kernel/traps.c | 15 +++++---- + arch/x86/math-emu/fpu_entry.c | 4 +- + arch/x86/math-emu/fpu_proto.h | 2 - + arch/x86/math-emu/fpu_system.h | 16 +++------ + arch/x86/math-emu/get_address.c | 66 ++++++++++++++++++++-------------------- + 7 files changed, 55 insertions(+), 56 deletions(-) + +--- a/arch/x86/include/asm/math_emu.h ++++ b/arch/x86/include/asm/math_emu.h +@@ -11,8 +11,8 @@ + struct math_emu_info { + long ___orig_eip; + union { +- struct pt_regs regs; +- struct kernel_vm86_regs vm86; ++ struct pt_regs *regs; ++ struct kernel_vm86_regs *vm86; + }; + }; + #endif /* _ASM_X86_MATH_EMU_H */ +--- a/arch/x86/include/asm/traps.h ++++ b/arch/x86/include/asm/traps.h +@@ -41,7 +41,7 @@ dotraplinkage void do_int3(struct pt_reg + dotraplinkage void do_overflow(struct pt_regs *, long); + dotraplinkage void do_bounds(struct pt_regs *, long); + dotraplinkage void do_invalid_op(struct pt_regs *, long); +-dotraplinkage void do_device_not_available(struct pt_regs *, long); ++dotraplinkage void do_device_not_available(struct pt_regs); + dotraplinkage void do_coprocessor_segment_overrun(struct pt_regs *, long); + dotraplinkage void do_invalid_TSS(struct pt_regs *, long); + dotraplinkage void do_segment_not_present(struct pt_regs *, long); +@@ -74,8 +74,8 @@ extern int kstack_depth_to_print; + + #ifdef CONFIG_X86_32 + void math_error(void __user *); ++void math_emulate(struct math_emu_info *); + unsigned long patch_espfix_desc(unsigned long, unsigned long); +-asmlinkage void math_emulate(long); + #endif + + #endif /* _ASM_X86_TRAPS_H */ +--- a/arch/x86/kernel/traps.c ++++ b/arch/x86/kernel/traps.c +@@ -912,7 +912,7 @@ asmlinkage void math_state_restore(void) + EXPORT_SYMBOL_GPL(math_state_restore); + + #ifndef CONFIG_MATH_EMULATION +-asmlinkage void math_emulate(long arg) ++void math_emulate(struct math_emu_info *info) + { + printk(KERN_EMERG + "math-emulation not enabled and no coprocessor found.\n"); +@@ -922,16 +922,19 @@ asmlinkage void math_emulate(long arg) + } + #endif /* CONFIG_MATH_EMULATION */ + +-dotraplinkage void __kprobes +-do_device_not_available(struct pt_regs *regs, long error) ++dotraplinkage void __kprobes do_device_not_available(struct pt_regs regs) + { + #ifdef CONFIG_X86_32 + if (read_cr0() & X86_CR0_EM) { +- conditional_sti(regs); +- math_emulate(0); ++ struct math_emu_info info = { }; ++ ++ conditional_sti(®s); ++ ++ info.regs = ®s; ++ math_emulate(&info); + } else { + math_state_restore(); /* interrupts still off */ +- conditional_sti(regs); ++ conditional_sti(®s); + } + #else + math_state_restore(); +--- a/arch/x86/math-emu/fpu_entry.c ++++ b/arch/x86/math-emu/fpu_entry.c +@@ -131,7 +131,7 @@ u_char emulating = 0; + static int valid_prefix(u_char *Byte, u_char __user ** fpu_eip, + overrides * override); + +-asmlinkage void math_emulate(long arg) ++void math_emulate(struct math_emu_info *info) + { + u_char FPU_modrm, byte1; + unsigned short code; +@@ -161,7 +161,7 @@ asmlinkage void math_emulate(long arg) + RE_ENTRANT_CHECK_ON; + #endif /* RE_ENTRANT_CHECKING */ + +- SETUP_DATA_AREA(arg); ++ FPU_info = info; + + FPU_ORIG_EIP = FPU_EIP; + +--- a/arch/x86/math-emu/fpu_proto.h ++++ b/arch/x86/math-emu/fpu_proto.h +@@ -51,7 +51,7 @@ extern void ffreep(void); + extern void fst_i_(void); + extern void fstp_i(void); + /* fpu_entry.c */ +-asmlinkage extern void math_emulate(long arg); ++extern void math_emulate(struct math_emu_info *info); + extern void math_abort(struct math_emu_info *info, unsigned int signal); + /* fpu_etc.c */ + extern void FPU_etc(void); +--- a/arch/x86/math-emu/fpu_system.h ++++ b/arch/x86/math-emu/fpu_system.h +@@ -16,10 +16,6 @@ + #include + #include + +-/* This sets the pointer FPU_info to point to the argument part +- of the stack frame of math_emulate() */ +-#define SETUP_DATA_AREA(arg) FPU_info = (struct math_emu_info *) &arg +- + /* s is always from a cpu register, and the cpu does bounds checking + * during register load --> no further bounds checks needed */ + #define LDT_DESCRIPTOR(s) (((struct desc_struct *)current->mm->context.ldt)[(s) >> 3]) +@@ -38,12 +34,12 @@ + #define I387 (current->thread.xstate) + #define FPU_info (I387->soft.info) + +-#define FPU_CS (*(unsigned short *) &(FPU_info->regs.cs)) +-#define FPU_SS (*(unsigned short *) &(FPU_info->regs.ss)) +-#define FPU_DS (*(unsigned short *) &(FPU_info->regs.ds)) +-#define FPU_EAX (FPU_info->regs.ax) +-#define FPU_EFLAGS (FPU_info->regs.flags) +-#define FPU_EIP (FPU_info->regs.ip) ++#define FPU_CS (*(unsigned short *) &(FPU_info->regs->cs)) ++#define FPU_SS (*(unsigned short *) &(FPU_info->regs->ss)) ++#define FPU_DS (*(unsigned short *) &(FPU_info->regs->ds)) ++#define FPU_EAX (FPU_info->regs->ax) ++#define FPU_EFLAGS (FPU_info->regs->flags) ++#define FPU_EIP (FPU_info->regs->ip) + #define FPU_ORIG_EIP (FPU_info->___orig_eip) + + #define FPU_lookahead (I387->soft.lookahead) +--- a/arch/x86/math-emu/get_address.c ++++ b/arch/x86/math-emu/get_address.c +@@ -29,43 +29,43 @@ + #define FPU_WRITE_BIT 0x10 + + static int reg_offset[] = { +- offsetof(struct math_emu_info, regs.ax), +- offsetof(struct math_emu_info, regs.cx), +- offsetof(struct math_emu_info, regs.dx), +- offsetof(struct math_emu_info, regs.bx), +- offsetof(struct math_emu_info, regs.sp), +- offsetof(struct math_emu_info, regs.bp), +- offsetof(struct math_emu_info, regs.si), +- offsetof(struct math_emu_info, regs.di) ++ offsetof(struct pt_regs, ax), ++ offsetof(struct pt_regs, cx), ++ offsetof(struct pt_regs, dx), ++ offsetof(struct pt_regs, bx), ++ offsetof(struct pt_regs, sp), ++ offsetof(struct pt_regs, bp), ++ offsetof(struct pt_regs, si), ++ offsetof(struct pt_regs, di) + }; + +-#define REG_(x) (*(long *)(reg_offset[(x)]+(u_char *) FPU_info)) ++#define REG_(x) (*(long *)(reg_offset[(x)] + (u_char *)FPU_info->regs)) + + static int reg_offset_vm86[] = { +- offsetof(struct math_emu_info, regs.cs), +- offsetof(struct math_emu_info, vm86.ds), +- offsetof(struct math_emu_info, vm86.es), +- offsetof(struct math_emu_info, vm86.fs), +- offsetof(struct math_emu_info, vm86.gs), +- offsetof(struct math_emu_info, regs.ss), +- offsetof(struct math_emu_info, vm86.ds) ++ offsetof(struct pt_regs, cs), ++ offsetof(struct kernel_vm86_regs, ds), ++ offsetof(struct kernel_vm86_regs, es), ++ offsetof(struct kernel_vm86_regs, fs), ++ offsetof(struct kernel_vm86_regs, gs), ++ offsetof(struct pt_regs, ss), ++ offsetof(struct kernel_vm86_regs, ds) + }; + + #define VM86_REG_(x) (*(unsigned short *) \ +- (reg_offset_vm86[((unsigned)x)]+(u_char *) FPU_info)) ++ (reg_offset_vm86[((unsigned)x)] + (u_char *)FPU_info->regs)) + + static int reg_offset_pm[] = { +- offsetof(struct math_emu_info, regs.cs), +- offsetof(struct math_emu_info, regs.ds), +- offsetof(struct math_emu_info, regs.es), +- offsetof(struct math_emu_info, regs.fs), +- offsetof(struct math_emu_info, regs.ds), /* dummy, not saved on stack */ +- offsetof(struct math_emu_info, regs.ss), +- offsetof(struct math_emu_info, regs.ds) ++ offsetof(struct pt_regs, cs), ++ offsetof(struct pt_regs, ds), ++ offsetof(struct pt_regs, es), ++ offsetof(struct pt_regs, fs), ++ offsetof(struct pt_regs, ds), /* dummy, not saved on stack */ ++ offsetof(struct pt_regs, ss), ++ offsetof(struct pt_regs, ds) + }; + + #define PM_REG_(x) (*(unsigned short *) \ +- (reg_offset_pm[((unsigned)x)]+(u_char *) FPU_info)) ++ (reg_offset_pm[((unsigned)x)] + (u_char *)FPU_info->regs)) + + /* Decode the SIB byte. This function assumes mod != 0 */ + static int sib(int mod, unsigned long *fpu_eip) +@@ -346,34 +346,34 @@ void __user *FPU_get_address_16(u_char F + } + switch (rm) { + case 0: +- address += FPU_info->regs.bx + FPU_info->regs.si; ++ address += FPU_info->regs->bx + FPU_info->regs->si; + break; + case 1: +- address += FPU_info->regs.bx + FPU_info->regs.di; ++ address += FPU_info->regs->bx + FPU_info->regs->di; + break; + case 2: +- address += FPU_info->regs.bp + FPU_info->regs.si; ++ address += FPU_info->regs->bp + FPU_info->regs->si; + if (addr_modes.override.segment == PREFIX_DEFAULT) + addr_modes.override.segment = PREFIX_SS_; + break; + case 3: +- address += FPU_info->regs.bp + FPU_info->regs.di; ++ address += FPU_info->regs->bp + FPU_info->regs->di; + if (addr_modes.override.segment == PREFIX_DEFAULT) + addr_modes.override.segment = PREFIX_SS_; + break; + case 4: +- address += FPU_info->regs.si; ++ address += FPU_info->regs->si; + break; + case 5: +- address += FPU_info->regs.di; ++ address += FPU_info->regs->di; + break; + case 6: +- address += FPU_info->regs.bp; ++ address += FPU_info->regs->bp; + if (addr_modes.override.segment == PREFIX_DEFAULT) + addr_modes.override.segment = PREFIX_SS_; + break; + case 7: +- address += FPU_info->regs.bx; ++ address += FPU_info->regs->bx; + break; + } + + + +From gregkh@mini.kroah.org Fri Mar 13 18:10:46 2009 +Message-Id: <20090314011046.651474624@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:11:20 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Sergei Shtylyov , + Bartlomiej Zolnierkiewicz +Subject: [patch 103/114] ide-iops: fix odd-length ATAPI PIO transfers +References: <20090314010937.416083662@mini.kroah.org> +Content-Disposition: inline; filename=ide-iops-fix-odd-length-atapi-pio-transfers.patch +Content-Length: 875 +Lines: 28 + +2.6.28-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Sergei Shtylyov + +commit a509538d4fb4f99cdf0a095213d57cc3b2347615 upstream. + +Commit 9567b349f7e7dd7e2483db99ee8e4a6fe0caca38 (ide: merge ->atapi_*put_bytes +and ->ata_*put_data methods) introduced a regression WRT the odd-length ATAPI +PIO transfers -- the final word didn't get written (causing command timeouts). + +Signed-off-by: Sergei Shtylyov +Signed-off-by: Bartlomiej Zolnierkiewicz +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ide/ide-iops.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/ide/ide-iops.c ++++ b/drivers/ide/ide-iops.c +@@ -324,6 +324,8 @@ void ide_output_data(ide_drive_t *drive, + u8 io_32bit = drive->io_32bit; + u8 mmio = (hwif->host_flags & IDE_HFLAG_MMIO) ? 1 : 0; + ++ len++; ++ + if (io_32bit) { + unsigned long uninitialized_var(flags); + + + +From gregkh@mini.kroah.org Fri Mar 13 18:10:46 2009 +Message-Id: <20090314011046.806586365@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:11:21 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Anssi Hannula , + Jiri Kosina +Subject: [patch 104/114] HID: move tmff and zpff devices from ignore_list to blacklist +References: <20090314010937.416083662@mini.kroah.org> +Content-Disposition: inline; filename=hid-move-tmff-and-zpff-devices-from-ignore_list-to-blacklist.patch +Content-Length: 2827 +Lines: 61 + + +2.6.28-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Anssi Hannula + +[ upstream commit daedb3d6a91f9626ab4c921378ac52e44de833d5 ] + +Subject: [patch 104/114] HID: move tmff and zpff devices from ignore_list to blacklist + +The devices handled by hid-tmff and hid-zpff were added in the +hid_ignore_list[] instead of hid_blacklist[] in hid-core.c, thus +disabling them completely. + +hid_ignore_list[] causes hid layer to skip the device, while +hid_blacklist[] indicates there is a specific driver in hid bus. + +Re-enable the devices by moving them to the correct list. + +Signed-off-by: Anssi Hannula +Signed-off-by: Jiri Kosina +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hid/hid-core.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +--- a/drivers/hid/hid-core.c ++++ b/drivers/hid/hid-core.c +@@ -1302,6 +1302,12 @@ static const struct hid_device_id hid_bl + { HID_USB_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_PS3_CONTROLLER) }, + { HID_USB_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_VAIO_VGX_MOUSE) }, + { HID_USB_DEVICE(USB_VENDOR_ID_SUNPLUS, USB_DEVICE_ID_SUNPLUS_WDESKTOP) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_THRUSTMASTER, 0xb300) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_THRUSTMASTER, 0xb304) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_THRUSTMASTER, 0xb651) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_THRUSTMASTER, 0xb654) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_ZEROPLUS, 0x0005) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_ZEROPLUS, 0x0030) }, + + { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, 0x030c) }, + { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_PRESENTER_8K_BT) }, +@@ -1529,10 +1535,6 @@ static const struct hid_device_id hid_ig + { HID_USB_DEVICE(USB_VENDOR_ID_SOUNDGRAPH, USB_DEVICE_ID_SOUNDGRAPH_IMON_LCD3) }, + { HID_USB_DEVICE(USB_VENDOR_ID_TENX, USB_DEVICE_ID_TENX_IBUDDY1) }, + { HID_USB_DEVICE(USB_VENDOR_ID_TENX, USB_DEVICE_ID_TENX_IBUDDY2) }, +- { HID_USB_DEVICE(USB_VENDOR_ID_THRUSTMASTER, 0xb300) }, +- { HID_USB_DEVICE(USB_VENDOR_ID_THRUSTMASTER, 0xb304) }, +- { HID_USB_DEVICE(USB_VENDOR_ID_THRUSTMASTER, 0xb651) }, +- { HID_USB_DEVICE(USB_VENDOR_ID_THRUSTMASTER, 0xb654) }, + { HID_USB_DEVICE(USB_VENDOR_ID_VERNIER, USB_DEVICE_ID_VERNIER_LABPRO) }, + { HID_USB_DEVICE(USB_VENDOR_ID_VERNIER, USB_DEVICE_ID_VERNIER_GOTEMP) }, + { HID_USB_DEVICE(USB_VENDOR_ID_VERNIER, USB_DEVICE_ID_VERNIER_SKIP) }, +@@ -1543,8 +1545,6 @@ static const struct hid_device_id hid_ig + { HID_USB_DEVICE(USB_VENDOR_ID_WISEGROUP, USB_DEVICE_ID_1_PHIDGETSERVO_20) }, + { HID_USB_DEVICE(USB_VENDOR_ID_WISEGROUP, USB_DEVICE_ID_8_8_4_IF_KIT) }, + { HID_USB_DEVICE(USB_VENDOR_ID_YEALINK, USB_DEVICE_ID_YEALINK_P1K_P4K_B2K) }, +- { HID_USB_DEVICE(USB_VENDOR_ID_ZEROPLUS, 0x0005) }, +- { HID_USB_DEVICE(USB_VENDOR_ID_ZEROPLUS, 0x0030) }, + { } + }; + + + +From gregkh@mini.kroah.org Fri Mar 13 18:10:47 2009 +Message-Id: <20090314011046.947001838@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:11:22 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Russell King , + Jean Delvare , + Alessandro Zummo +Subject: [patch 105/114] ARM: Add i2c_board_info for RiscPC PCF8583 +References: <20090314010937.416083662@mini.kroah.org> +Content-Disposition: inline; filename=arm-add-i2c_board_info-for-riscpc-pcf8583.patch +Content-Length: 1554 +Lines: 62 + + +2.6.28-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Russell King + +commit 531660ef5604c75de6fdead9da1304051af17c09 upstream + +Add the necessary i2c_board_info structure to fix the lack of PCF8583 +RTC on RiscPC. + +Signed-off-by: Russell King +Signed-off-by: Jean Delvare +Cc: Alessandro Zummo +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/mach-rpc/riscpc.c | 6 ++++++ + drivers/i2c/busses/i2c-acorn.c | 3 ++- + 2 files changed, 8 insertions(+), 1 deletion(-) + +--- a/arch/arm/mach-rpc/riscpc.c ++++ b/arch/arm/mach-rpc/riscpc.c +@@ -19,6 +19,7 @@ + #include + #include + #include ++#include + + #include + #include +@@ -201,8 +202,13 @@ static struct platform_device *devs[] __ + &pata_device, + }; + ++static struct i2c_board_info i2c_rtc = { ++ I2C_BOARD_INFO("pcf8583", 0x50) ++}; ++ + static int __init rpc_init(void) + { ++ i2c_register_board_info(0, &i2c_rtc, 1); + return platform_add_devices(devs, ARRAY_SIZE(devs)); + } + +--- a/drivers/i2c/busses/i2c-acorn.c ++++ b/drivers/i2c/busses/i2c-acorn.c +@@ -84,6 +84,7 @@ static struct i2c_algo_bit_data ioc_data + + static struct i2c_adapter ioc_ops = { + .id = I2C_HW_B_IOC, ++ .nr = 0, + .algo_data = &ioc_data, + }; + +@@ -91,7 +92,7 @@ static int __init i2c_ioc_init(void) + { + force_ones = FORCE_ONES | SCL | SDA; + +- return i2c_bit_add_bus(&ioc_ops); ++ return i2c_bit_add_numbered_bus(&ioc_ops); + } + + module_init(i2c_ioc_init); + + +From gregkh@mini.kroah.org Fri Mar 13 18:10:47 2009 +Message-Id: <20090314011047.118328511@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:11:23 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Roel Kluin , + Jean Delvare +Subject: [patch 106/114] i2c: Timeouts reach -1 +References: <20090314010937.416083662@mini.kroah.org> +Content-Disposition: inline; filename=i2c-timeouts-reach-1.patch +Content-Length: 1616 +Lines: 54 + + +2.6.28-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Roel Kluin + +commit a746b578d8406b2db0e9f0d040061bc1f78433cf upstream + +With a postfix decrement these timeouts reach -1 rather than 0, but +after the loop it is tested whether they have become 0. + +As pointed out by Jean Delvare, the condition we are waiting for should +also be tested before the timeout. With the current order, you could +exit with a timeout error while the job is actually done. + +Signed-off-by: Roel Kluin +Signed-off-by: Jean Delvare +Signed-off-by: Greg Kroah-Hartman + + +--- + drivers/i2c/busses/i2c-amd8111.c | 4 ++-- + drivers/i2c/busses/i2c-pxa.c | 2 +- + 2 files changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/i2c/busses/i2c-amd8111.c ++++ b/drivers/i2c/busses/i2c-amd8111.c +@@ -72,7 +72,7 @@ static unsigned int amd_ec_wait_write(st + { + int timeout = 500; + +- while (timeout-- && (inb(smbus->base + AMD_EC_SC) & AMD_EC_SC_IBF)) ++ while ((inb(smbus->base + AMD_EC_SC) & AMD_EC_SC_IBF) && --timeout) + udelay(1); + + if (!timeout) { +@@ -88,7 +88,7 @@ static unsigned int amd_ec_wait_read(str + { + int timeout = 500; + +- while (timeout-- && (~inb(smbus->base + AMD_EC_SC) & AMD_EC_SC_OBF)) ++ while ((~inb(smbus->base + AMD_EC_SC) & AMD_EC_SC_OBF) && --timeout) + udelay(1); + + if (!timeout) { +--- a/drivers/i2c/busses/i2c-pxa.c ++++ b/drivers/i2c/busses/i2c-pxa.c +@@ -644,7 +644,7 @@ static int i2c_pxa_do_pio_xfer(struct px + + i2c_pxa_start_message(i2c); + +- while (timeout-- && i2c->msg_num > 0) { ++ while (i2c->msg_num > 0 && --timeout) { + i2c_pxa_handler(0, i2c); + udelay(10); + } + + +From gregkh@mini.kroah.org Fri Mar 13 18:10:47 2009 +Message-Id: <20090314011047.272638967@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:11:24 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Roel Kluin , + Jean Delvare +Subject: [patch 107/114] i2c: Fix misplaced parentheses +References: <20090314010937.416083662@mini.kroah.org> +Content-Disposition: inline; filename=i2c-fix-misplaced-parentheses.patch +Content-Length: 783 +Lines: 29 + + +2.6.28-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Roel Kluin + +commit f29d2e0275a4f03ef2fd158e484508dcb0c64efb upstream + +Fix misplaced parentheses. + +Signed-off-by: Roel Kluin +Signed-off-by: Jean Delvare +Signed-off-by: Greg Kroah-Hartman + + +--- + drivers/i2c/i2c-core.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/i2c/i2c-core.c ++++ b/drivers/i2c/i2c-core.c +@@ -1831,7 +1831,8 @@ static s32 i2c_smbus_xfer_emulated(struc + case I2C_SMBUS_QUICK: + msg[0].len = 0; + /* Special case: The read/write field is used as data */ +- msg[0].flags = flags | (read_write==I2C_SMBUS_READ)?I2C_M_RD:0; ++ msg[0].flags = flags | (read_write == I2C_SMBUS_READ ? ++ I2C_M_RD : 0); + num = 1; + break; + case I2C_SMBUS_BYTE: + + +From gregkh@mini.kroah.org Fri Mar 13 18:10:47 2009 +Message-Id: <20090314011047.425424026@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:11:25 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + Len Brown +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + linux-acpi@vger.kernel.org, + Lin Ming , + Henrique de Moraes Holschuh +Subject: [patch 108/114] ACPI: fix broken usage of name.ascii +References: <20090314010937.416083662@mini.kroah.org> +Content-Disposition: inline; filename=acpi-fix-broken-usage-of-name.ascii.patch +Content-Length: 1045 +Lines: 36 + +2.6.28-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Henrique de Moraes Holschuh + +This issue was fixed indirectly in mainline by commit +0175d562a29ad052c510782c7e76bc63d5155b9b. + +acpi_namespace_node's name.ascii field is four chars, and not NULL- +terminated except by pure luck. So, it cannot be used by sscanf() without +a length restriction. + +This is the minimal fix for both stable 2.6.27 and 2.6.28. + +Signed-off-by: Henrique de Moraes Holschuh +Cc: Lin Ming +Cc: Len Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/acpi/ec.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/drivers/acpi/ec.c ++++ b/drivers/acpi/ec.c +@@ -759,9 +759,10 @@ acpi_ec_register_query_methods(acpi_hand + struct acpi_namespace_node *node = handle; + struct acpi_ec *ec = context; + int value = 0; +- if (sscanf(node->name.ascii, "_Q%x", &value) == 1) { ++ ++ if (sscanf(node->name.ascii, "_Q%2x", &value) == 1) + acpi_ec_add_query_handler(ec, value, handle, NULL, NULL); +- } ++ + return AE_OK; + } + + + +From gregkh@mini.kroah.org Fri Mar 13 18:10:47 2009 +Message-Id: <20090314011047.577830206@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:11:26 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + Len Brown +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + linux-acpi@vger.kernel.org, + Lin Ming , + Henrique de Moraes Holschuh +Subject: [patch 109/114] ACPI: fix broken usage of acpi_ut_get_node_name() +References: <20090314010937.416083662@mini.kroah.org> +Content-Disposition: inline; filename=acpi-fix-broken-usage-of-acpi_ut_get_node_name.patch +Content-Length: 978 +Lines: 32 + +2.6.28-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Henrique de Moraes Holschuh + +This issue was fixed indirectly in mainline by commit +60a4ce7f4148155d3f28eea4a213f7ee47cd57b7. + +acpi_ut_get_node_name() returns a four char fixed-size array, not +NULL-terminated. + +This is the minimal fix for stable 2.6.28. + +Signed-off-by: Henrique de Moraes Holschuh +Cc: stable@kernel.org +Acked-by: Lin Ming +Acked-by: Len Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/acpi/power.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/acpi/power.c ++++ b/drivers/acpi/power.c +@@ -151,7 +151,7 @@ static int acpi_power_get_state(acpi_han + *state = (sta & 0x01)?ACPI_POWER_RESOURCE_STATE_ON: + ACPI_POWER_RESOURCE_STATE_OFF; + +- ACPI_DEBUG_PRINT((ACPI_DB_INFO, "Resource [%s] is %s\n", ++ ACPI_DEBUG_PRINT((ACPI_DB_INFO, "Resource [%4.4s] is %s\n", + acpi_ut_get_node_name(handle), + *state ? "on" : "off")); + + + +From gregkh@mini.kroah.org Fri Mar 13 18:10:47 2009 +Message-Id: <20090314011047.734304002@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:11:27 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Herbert Xu , + Kerin Millar +Subject: [patch 110/114] crypto: api - Fix algorithm test race that broke aead initialisation +References: <20090314010937.416083662@mini.kroah.org> +Content-Disposition: inline; filename=crypto-api-fix-algorithm-test-race-that-broke-aead-initialisation.patch +Content-Length: 1841 +Lines: 58 + +2.6.28-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Herbert Xu + +commit b8e15992b420d09dae831125a623c474c8637cee upstream. + +When we complete a test we'll notify everyone waiting on it, drop +the mutex, and then remove the test larval (after reacquiring the +mutex). If one of the notified parties tries to register another +algorithm with the same driver name prior to the removal of the +test larval, they will fail with EEXIST as only one algorithm of +a given name can be tested at any time. + +This broke the initialisation of aead and givcipher algorithms as +they will register two algorithms with the same driver name, in +sequence. + +This patch fixes the problem by marking the larval as dead before +we drop the mutex, and also ignoring all dead or dying algorithms +on the registration path. + +Tested-by: Andreas Steffen +Signed-off-by: Herbert Xu +Cc: Kerin Millar +Signed-off-by: Greg Kroah-Hartman + +--- + crypto/algapi.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/crypto/algapi.c ++++ b/crypto/algapi.c +@@ -149,6 +149,9 @@ static struct crypto_larval *__crypto_re + if (q == alg) + goto err; + ++ if (crypto_is_moribund(q)) ++ continue; ++ + if (crypto_is_larval(q)) { + if (!strcmp(alg->cra_driver_name, q->cra_driver_name)) + goto err; +@@ -197,7 +200,7 @@ void crypto_alg_tested(const char *name, + + down_write(&crypto_alg_sem); + list_for_each_entry(q, &crypto_alg_list, cra_list) { +- if (!crypto_is_larval(q)) ++ if (crypto_is_moribund(q) || !crypto_is_larval(q)) + continue; + + test = (struct crypto_larval *)q; +@@ -210,6 +213,7 @@ void crypto_alg_tested(const char *name, + goto unlock; + + found: ++ q->cra_flags |= CRYPTO_ALG_DEAD; + alg = test->adult; + if (err || list_empty(&alg->cra_list)) + goto complete; + + +From gregkh@mini.kroah.org Fri Mar 13 18:10:48 2009 +Message-Id: <20090314011047.891588229@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:11:28 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jean Delvare , + Hans de Goede +Subject: [patch 111/114] hwmon: (f71882fg) Hide misleading error message +References: <20090314010937.416083662@mini.kroah.org> +Content-Disposition: inline; filename=hwmon-hide-misleading-error-message.patch +Content-Length: 898 +Lines: 32 + +2.6.28-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Jean Delvare + +commit 603eaa1bdd3e0402085e815cc531bb0a32827a9e upstream + +If the F71882FG chip is at address 0x4e, then the probe at 0x2e will +fail with the following message in the logs: +f71882fg: Not a Fintek device + +This is misleading because there is a Fintek device, just at a +different address. So I propose to degrade this message to a debug +message. + +Signed-off-by: Jean Delvare +Acked-by: Hans de Goede + + +--- + drivers/hwmon/f71882fg.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/hwmon/f71882fg.c ++++ b/drivers/hwmon/f71882fg.c +@@ -837,7 +837,7 @@ static int __init f71882fg_find(int sioa + + devid = superio_inw(sioaddr, SIO_REG_MANID); + if (devid != SIO_FINTEK_ID) { +- printk(KERN_INFO DRVNAME ": Not a Fintek device\n"); ++ pr_debug(DRVNAME ": Not a Fintek device\n"); + goto exit; + } + + + +From gregkh@mini.kroah.org Fri Mar 13 18:10:48 2009 +Message-Id: <20090314011048.025626220@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:11:29 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Eric Anholt , + Dave Airlie +Subject: [patch 112/114] drm/i915: Add missing userland definitions for gem init/execbuffer. +References: <20090314010937.416083662@mini.kroah.org> +Content-Disposition: inline; filename=drm-i915-add-missing-userland-definitions-for-gem-init-execbuffer.patch +Content-Length: 1436 +Lines: 26 + +2.6.28-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Eric Anholt + +commit 8d391aa410ecb230fc4c3147b94eec25b9f3c20f upstream. + +fdo bug #19132. + +Signed-off-by: Eric Anholt +Signed-off-by: Dave Airlie +Signed-off-by: Greg Kroah-Hartman + +--- + include/drm/i915_drm.h | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/include/drm/i915_drm.h ++++ b/include/drm/i915_drm.h +@@ -177,6 +177,8 @@ typedef struct _drm_i915_sarea { + #define DRM_IOCTL_I915_SET_VBLANK_PIPE DRM_IOW( DRM_COMMAND_BASE + DRM_I915_SET_VBLANK_PIPE, drm_i915_vblank_pipe_t) + #define DRM_IOCTL_I915_GET_VBLANK_PIPE DRM_IOR( DRM_COMMAND_BASE + DRM_I915_GET_VBLANK_PIPE, drm_i915_vblank_pipe_t) + #define DRM_IOCTL_I915_VBLANK_SWAP DRM_IOWR(DRM_COMMAND_BASE + DRM_I915_VBLANK_SWAP, drm_i915_vblank_swap_t) ++#define DRM_IOCTL_I915_GEM_INIT DRM_IOW(DRM_COMMAND_BASE + DRM_I915_GEM_INIT, struct drm_i915_gem_init) ++#define DRM_IOCTL_I915_GEM_EXECBUFFER DRM_IOW(DRM_COMMAND_BASE + DRM_I915_GEM_EXECBUFFER, struct drm_i915_gem_execbuffer) + #define DRM_IOCTL_I915_GEM_PIN DRM_IOWR(DRM_COMMAND_BASE + DRM_I915_GEM_PIN, struct drm_i915_gem_pin) + #define DRM_IOCTL_I915_GEM_UNPIN DRM_IOW(DRM_COMMAND_BASE + DRM_I915_GEM_UNPIN, struct drm_i915_gem_unpin) + #define DRM_IOCTL_I915_GEM_BUSY DRM_IOWR(DRM_COMMAND_BASE + DRM_I915_GEM_BUSY, struct drm_i915_gem_busy) + + +From gregkh@mini.kroah.org Fri Mar 13 18:10:48 2009 +Message-Id: <20090314011048.190348139@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:11:30 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Ralf Baechle +Subject: [patch 113/114] MIPS: compat: Implement is_compat_task. +References: <20090314010937.416083662@mini.kroah.org> +Content-Disposition: inline; filename=mips-compat-implement-is_compat_task.patch +Content-Length: 1278 +Lines: 42 + +2.6.28-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Ralf Baechle + +commit 4302e5d53b9166d45317e3ddf0a7a9dab3efd43b upstream. + +This is a build fix required after "x86-64: seccomp: fix 32/64 syscall +hole" (commit 5b1017404aea6d2e552e991b3fd814d839e9cd67). MIPS doesn't +have the issue that was fixed for x86-64 by that patch. + +This also doesn't solve the N32 issue which is that N32 seccomp processes +will be treated as non-compat processes thus only have access to N64 +syscalls. + +Signed-off-by: Ralf Baechle +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + arch/mips/include/asm/compat.h | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/arch/mips/include/asm/compat.h ++++ b/arch/mips/include/asm/compat.h +@@ -3,6 +3,8 @@ + /* + * Architecture specific compatibility types + */ ++#include ++#include + #include + #include + #include +@@ -218,4 +220,9 @@ struct compat_shmid64_ds { + compat_ulong_t __unused2; + }; + ++static inline int is_compat_task(void) ++{ ++ return test_thread_flag(TIF_32BIT); ++} ++ + #endif /* _ASM_COMPAT_H */ + + +From gregkh@mini.kroah.org Fri Mar 13 18:10:48 2009 +Message-Id: <20090314011048.328045517@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:11:31 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jean Delvare +Subject: [patch 114/114] hwmon: (it87) Properly decode -128 degrees C temperature +References: <20090314010937.416083662@mini.kroah.org> +Content-Disposition: inline; filename=hwmon-properly-decode-128-degrees-c-temperature.patch +Content-Length: 1565 +Lines: 39 + +2.6.28-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Jean Delvare + +commit e267d25005c861fe6afda343f044536342c9f8b4 upstream + +The it87 driver is reporting -128 degrees C as +128 degrees C. +That's not a terribly likely temperature value but let's still +get it right, especially when it simplifies the code. + +Signed-off-by: Jean Delvare +Signed-off-by: Greg Kroah-Hartman + + +--- + drivers/hwmon/it87.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/hwmon/it87.c ++++ b/drivers/hwmon/it87.c +@@ -207,7 +207,7 @@ static inline u16 FAN16_TO_REG(long rpm) + + #define TEMP_TO_REG(val) (SENSORS_LIMIT(((val)<0?(((val)-500)/1000):\ + ((val)+500)/1000),-128,127)) +-#define TEMP_FROM_REG(val) (((val)>0x80?(val)-0x100:(val))*1000) ++#define TEMP_FROM_REG(val) ((val) * 1000) + + #define PWM_TO_REG(val) ((val) >> 1) + #define PWM_FROM_REG(val) (((val)&0x7f) << 1) +@@ -261,9 +261,9 @@ struct it87_data { + u8 has_fan; /* Bitfield, fans enabled */ + u16 fan[5]; /* Register values, possibly combined */ + u16 fan_min[5]; /* Register values, possibly combined */ +- u8 temp[3]; /* Register value */ +- u8 temp_high[3]; /* Register value */ +- u8 temp_low[3]; /* Register value */ ++ s8 temp[3]; /* Register value */ ++ s8 temp_high[3]; /* Register value */ ++ s8 temp_low[3]; /* Register value */ + u8 sensor; /* Register value */ + u8 fan_div[3]; /* Register encoding, shifted right */ + u8 vid; /* Register encoding, combined */ + + +From gregkh@mini.kroah.org Fri Mar 13 18:10:31 2009 +Message-Id: <20090314010937.416083662@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Fri, 13 Mar 2009 18:09:37 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk +Subject: [patch 000/114] 2.6.28.8-stable review +Content-Length: 8041 +Lines: 166 + +This is the start of the stable review cycle for the 2.6.28.8 release. +There are 114 patches in this series, all will be posted as a response +to this one. If anyone has any issues with these being applied, please +let us know. If anyone is a maintainer of the proper subsystem, and +wants to add a Signed-off-by: line to the patch, please respond with it. + +These patches are sent out with a number of different people on the Cc: +line. If you wish to be a reviewer, please email stable@kernel.org to +add your name to the list. If you want to be off the reviewer list, +also email us. + +Responses should be made by Tuesday, March 17, 00:00:00 UTC. Anything +received after that time might be too late. + +The whole patch series can be found in one patch at: + kernel.org/pub/linux/kernel/v2.6/stable-review/patch-2.6.28.8-rc1.gz +and the diffstat can be found below. + + +thanks, + +greg k-h + + Makefile | 2 +- + arch/arm/mach-rpc/riscpc.c | 6 + + arch/ia64/include/asm/mmzone.h | 4 - + arch/ia64/mm/numa.c | 4 +- + arch/mips/include/asm/compat.h | 7 ++ + arch/mips/include/asm/seccomp.h | 1 - + arch/powerpc/include/asm/compat.h | 5 + + arch/powerpc/include/asm/seccomp.h | 4 - + arch/powerpc/kernel/align.c | 29 +++--- + arch/sparc/include/asm/compat.h | 5 + + arch/sparc/include/asm/seccomp.h | 6 - + arch/sparc64/kernel/chmc.c | 1 + + arch/sparc64/kernel/traps.c | 17 +++- + arch/x86/ia32/ia32entry.S | 8 +- + arch/x86/include/asm/math_emu.h | 29 ++---- + arch/x86/include/asm/mmzone_32.h | 2 - + arch/x86/include/asm/mmzone_64.h | 2 - + arch/x86/include/asm/paravirt.h | 17 +--- + arch/x86/include/asm/processor.h | 2 +- + arch/x86/include/asm/seccomp_32.h | 6 - + arch/x86/include/asm/seccomp_64.h | 8 -- + arch/x86/include/asm/traps.h | 4 +- + arch/x86/kernel/cpu/mtrr/main.c | 3 +- + arch/x86/kernel/hpet.c | 2 + + arch/x86/kernel/paravirt.c | 24 +++++ + arch/x86/kernel/ptrace.c | 2 +- + arch/x86/kernel/reboot.c | 8 ++ + arch/x86/kernel/traps.c | 15 ++- + arch/x86/kernel/vmiclock_32.c | 5 +- + arch/x86/math-emu/fpu_entry.c | 6 +- + arch/x86/math-emu/fpu_proto.h | 4 +- + arch/x86/math-emu/fpu_system.h | 16 +-- + arch/x86/math-emu/get_address.c | 69 +++++++------- + arch/x86/mm/numa_64.c | 2 +- + arch/x86/oprofile/op_model_ppro.c | 14 +++- + arch/x86/xen/enlighten.c | 3 + + crypto/algapi.c | 6 +- + drivers/acpi/ec.c | 5 +- + drivers/acpi/power.c | 2 +- + drivers/ata/libata-core.c | 10 +- + drivers/ata/libata-eh.c | 5 +- + drivers/atm/fore200e.c | 4 +- + drivers/block/aoe/aoe.h | 1 + + drivers/block/aoe/aoenet.c | 2 + + drivers/block/xen-blkfront.c | 30 +++--- + drivers/char/agp/intel-agp.c | 8 +- + drivers/hid/hid-core.c | 12 +- + drivers/hwmon/f71882fg.c | 2 +- + drivers/hwmon/it87.c | 8 +- + drivers/i2c/busses/i2c-acorn.c | 3 +- + drivers/i2c/busses/i2c-amd8111.c | 4 +- + drivers/i2c/busses/i2c-pxa.c | 2 +- + drivers/i2c/i2c-core.c | 3 +- + drivers/ide/ide-iops.c | 2 + + drivers/infiniband/hw/nes/nes_cm.c | 37 ++++++- + drivers/infiniband/hw/nes/nes_verbs.c | 2 + + drivers/infiniband/hw/nes/nes_verbs.h | 1 + + drivers/md/raid1.c | 3 +- + drivers/md/raid10.c | 19 ++-- + drivers/media/common/tuners/tda8290.c | 3 +- + drivers/media/dvb/frontends/s5h1409.c | 7 +- + drivers/media/video/ivtv/ivtv-ioctl.c | 24 +++--- + drivers/media/video/saa7127.c | 52 ++++++----- + drivers/misc/acer-wmi.c | 2 +- + drivers/misc/hpilo.c | 1 + + drivers/mmc/card/block.c | 2 +- + drivers/mmc/card/mmc_test.c | 2 +- + drivers/mmc/core/mmc_ops.c | 15 ++- + drivers/mmc/host/s3cmci.c | 5 +- + drivers/mmc/host/sdhci-pci.c | 1 + + drivers/mmc/host/sdhci.c | 9 ++- + drivers/mmc/host/sdhci.h | 3 + + drivers/mtd/devices/mtd_dataflash.c | 3 +- + drivers/net/usb/asix.c | 8 ++ + drivers/net/usb/cdc_ether.c | 5 + + drivers/net/usb/zaurus.c | 5 + + drivers/net/wireless/rtl8187_dev.c | 12 +++ + drivers/pci/pcie/aer/aerdrv_core.c | 48 ++++++++-- + drivers/pci/pcie/portdrv_pci.c | 3 +- + drivers/pci/quirks.c | 144 +++++++++++++++++++++++++--- + drivers/scsi/hptiop.c | 1 + + drivers/scsi/sd.c | 7 ++ + drivers/serial/8250.c | 15 +++ + drivers/serial/8250_pci.c | 36 +++++++ + drivers/serial/jsm/jsm_driver.c | 3 + + drivers/usb/class/cdc-acm.c | 2 + + drivers/usb/core/message.c | 11 ++- + drivers/usb/host/ehci-hcd.c | 2 + + drivers/usb/host/ehci-mem.c | 1 + + drivers/usb/host/ehci-sched.c | 56 ++++++++++-- + drivers/usb/host/ehci.h | 6 + + drivers/usb/serial/option.c | 5 + + drivers/usb/storage/unusual_devs.h | 4 +- + drivers/watchdog/ks8695_wdt.c | 1 + + drivers/watchdog/rc32434_wdt.c | 168 ++++++++++++++------------------- + fs/cifs/CHANGES | 2 + + fs/cifs/sess.c | 4 +- + fs/compat_ioctl.c | 2 + + fs/ext4/ext4.h | 2 +- + fs/ext4/ialloc.c | 7 ++ + fs/ext4/inode.c | 36 ++++++- + fs/ext4/mballoc.c | 32 ++++--- + fs/ext4/migrate.c | 8 +- + fs/ext4/super.c | 12 +- + fs/fs-writeback.c | 9 ++- + fs/inode.c | 7 ++ + fs/inotify.c | 2 +- + fs/jbd2/journal.c | 17 ++- + fs/jbd2/transaction.c | 42 ++++++-- + fs/jffs2/readinode.c | 42 +++++++-- + fs/ocfs2/journal.h | 6 +- + fs/pipe.c | 8 +- + fs/proc/page.c | 4 +- + fs/seq_file.c | 36 ++++++- + fs/timerfd.c | 12 +- + include/drm/i915_drm.h | 2 + + include/linux/fs.h | 18 +++- + include/linux/jbd2.h | 3 +- + include/linux/mm.h | 19 +++- + include/linux/mmzone.h | 2 +- + include/linux/pci_ids.h | 4 + + include/linux/seq_file.h | 1 + + include/linux/serial_core.h | 1 + + include/linux/skbuff.h | 9 -- + include/linux/timerfd.h | 16 +++- + include/net/sock.h | 1 - + kernel/fork.c | 11 +- + kernel/seccomp.c | 7 +- + kernel/tsacct.c | 6 +- + mm/page_alloc.c | 27 +++++- + mm/vmalloc.c | 12 ++- + net/core/skbuff.c | 8 -- + net/core/sock.c | 3 +- + scripts/mod/file2alias.c | 1 + + security/selinux/netlabel.c | 9 +- + sound/core/oss/rate.c | 2 +- + sound/pci/aw2/aw2-alsa.c | 2 +- + sound/pci/hda/patch_realtek.c | 1 + + sound/pci/hda/patch_sigmatel.c | 2 +- + sound/pci/oxygen/virtuoso.c | 17 +--- + sound/usb/usbaudio.c | 20 ++-- + sound/usb/usbmidi.c | 1 + + 142 files changed, 1115 insertions(+), 565 deletions(-) + diff --git a/queue-2.6.28/md-avoid-races-when-stopping-resync.patch b/review-2.6.28/md-avoid-races-when-stopping-resync.patch similarity index 100% rename from queue-2.6.28/md-avoid-races-when-stopping-resync.patch rename to review-2.6.28/md-avoid-races-when-stopping-resync.patch diff --git a/queue-2.6.28/md-raid10-don-t-call-bitmap_cond_end_sync-when-we-are-doing-recovery.patch b/review-2.6.28/md-raid10-don-t-call-bitmap_cond_end_sync-when-we-are-doing-recovery.patch similarity index 100% rename from queue-2.6.28/md-raid10-don-t-call-bitmap_cond_end_sync-when-we-are-doing-recovery.patch rename to review-2.6.28/md-raid10-don-t-call-bitmap_cond_end_sync-when-we-are-doing-recovery.patch diff --git a/queue-2.6.28/md-raid10-don-t-skip-more-than-1-bitmap-chunk-at-a-time-during-recovery.patch b/review-2.6.28/md-raid10-don-t-skip-more-than-1-bitmap-chunk-at-a-time-during-recovery.patch similarity index 100% rename from queue-2.6.28/md-raid10-don-t-skip-more-than-1-bitmap-chunk-at-a-time-during-recovery.patch rename to review-2.6.28/md-raid10-don-t-skip-more-than-1-bitmap-chunk-at-a-time-during-recovery.patch diff --git a/queue-2.6.28/mips-compat-implement-is_compat_task.patch b/review-2.6.28/mips-compat-implement-is_compat_task.patch similarity index 100% rename from queue-2.6.28/mips-compat-implement-is_compat_task.patch rename to review-2.6.28/mips-compat-implement-is_compat_task.patch diff --git a/queue-2.6.28/mm-clean-up-for-early_pfn_to_nid.patch b/review-2.6.28/mm-clean-up-for-early_pfn_to_nid.patch similarity index 100% rename from queue-2.6.28/mm-clean-up-for-early_pfn_to_nid.patch rename to review-2.6.28/mm-clean-up-for-early_pfn_to_nid.patch diff --git a/queue-2.6.28/mm-fix-lazy-vmap-purging.patch b/review-2.6.28/mm-fix-lazy-vmap-purging.patch similarity index 100% rename from queue-2.6.28/mm-fix-lazy-vmap-purging.patch rename to review-2.6.28/mm-fix-lazy-vmap-purging.patch diff --git a/queue-2.6.28/mm-fix-memmap-init-for-handling-memory-hole.patch b/review-2.6.28/mm-fix-memmap-init-for-handling-memory-hole.patch similarity index 100% rename from queue-2.6.28/mm-fix-memmap-init-for-handling-memory-hole.patch rename to review-2.6.28/mm-fix-memmap-init-for-handling-memory-hole.patch diff --git a/queue-2.6.28/mm-vmap-fix-overflow.patch b/review-2.6.28/mm-vmap-fix-overflow.patch similarity index 100% rename from queue-2.6.28/mm-vmap-fix-overflow.patch rename to review-2.6.28/mm-vmap-fix-overflow.patch diff --git a/queue-2.6.28/mmc-fix-bug-sdhc-card-capacity-not-correct.patch b/review-2.6.28/mmc-fix-bug-sdhc-card-capacity-not-correct.patch similarity index 100% rename from queue-2.6.28/mmc-fix-bug-sdhc-card-capacity-not-correct.patch rename to review-2.6.28/mmc-fix-bug-sdhc-card-capacity-not-correct.patch diff --git a/queue-2.6.28/mmc-fix-data-timeout-for-send_ext_csd.patch b/review-2.6.28/mmc-fix-data-timeout-for-send_ext_csd.patch similarity index 100% rename from queue-2.6.28/mmc-fix-data-timeout-for-send_ext_csd.patch rename to review-2.6.28/mmc-fix-data-timeout-for-send_ext_csd.patch diff --git a/queue-2.6.28/mmc-s3cmci-fix-s3c2410_dma_config-arguments.patch b/review-2.6.28/mmc-s3cmci-fix-s3c2410_dma_config-arguments.patch similarity index 100% rename from queue-2.6.28/mmc-s3cmci-fix-s3c2410_dma_config-arguments.patch rename to review-2.6.28/mmc-s3cmci-fix-s3c2410_dma_config-arguments.patch diff --git a/queue-2.6.28/mmc_test-fix-basic-read-test.patch b/review-2.6.28/mmc_test-fix-basic-read-test.patch similarity index 100% rename from queue-2.6.28/mmc_test-fix-basic-read-test.patch rename to review-2.6.28/mmc_test-fix-basic-read-test.patch diff --git a/queue-2.6.28/mtd_dataflash-fix-probing-of-at45db321c-chips.patch b/review-2.6.28/mtd_dataflash-fix-probing-of-at45db321c-chips.patch similarity index 100% rename from queue-2.6.28/mtd_dataflash-fix-probing-of-at45db321c-chips.patch rename to review-2.6.28/mtd_dataflash-fix-probing-of-at45db321c-chips.patch diff --git a/queue-2.6.28/net-amend-the-fix-for-so_bsdcompat-gsopt-infoleak.patch b/review-2.6.28/net-amend-the-fix-for-so_bsdcompat-gsopt-infoleak.patch similarity index 100% rename from queue-2.6.28/net-amend-the-fix-for-so_bsdcompat-gsopt-infoleak.patch rename to review-2.6.28/net-amend-the-fix-for-so_bsdcompat-gsopt-infoleak.patch diff --git a/queue-2.6.28/net-kill-skb_truesize_check-it-only-catches-false-positives.patch b/review-2.6.28/net-kill-skb_truesize_check-it-only-catches-false-positives.patch similarity index 100% rename from queue-2.6.28/net-kill-skb_truesize_check-it-only-catches-false-positives.patch rename to review-2.6.28/net-kill-skb_truesize_check-it-only-catches-false-positives.patch diff --git a/queue-2.6.28/pci-add-pci-quirk-to-disable-l0s-aspm-state-for-82575-and-82598.patch b/review-2.6.28/pci-add-pci-quirk-to-disable-l0s-aspm-state-for-82575-and-82598.patch similarity index 100% rename from queue-2.6.28/pci-add-pci-quirk-to-disable-l0s-aspm-state-for-82575-and-82598.patch rename to review-2.6.28/pci-add-pci-quirk-to-disable-l0s-aspm-state-for-82575-and-82598.patch diff --git a/queue-2.6.28/pci-don-t-enable-too-many-ht-msi-mappings.patch b/review-2.6.28/pci-don-t-enable-too-many-ht-msi-mappings.patch similarity index 100% rename from queue-2.6.28/pci-don-t-enable-too-many-ht-msi-mappings.patch rename to review-2.6.28/pci-don-t-enable-too-many-ht-msi-mappings.patch diff --git a/queue-2.6.28/pci-enable-pcie-aer-only-after-checking-firmware-support.patch b/review-2.6.28/pci-enable-pcie-aer-only-after-checking-firmware-support.patch similarity index 100% rename from queue-2.6.28/pci-enable-pcie-aer-only-after-checking-firmware-support.patch rename to review-2.6.28/pci-enable-pcie-aer-only-after-checking-firmware-support.patch diff --git a/queue-2.6.28/pci-quirk-enable-msi-on-8132.patch b/review-2.6.28/pci-quirk-enable-msi-on-8132.patch similarity index 100% rename from queue-2.6.28/pci-quirk-enable-msi-on-8132.patch rename to review-2.6.28/pci-quirk-enable-msi-on-8132.patch diff --git a/queue-2.6.28/pcie-portdrv-call-pci_disable_device-during-remove.patch b/review-2.6.28/pcie-portdrv-call-pci_disable_device-during-remove.patch similarity index 100% rename from queue-2.6.28/pcie-portdrv-call-pci_disable_device-during-remove.patch rename to review-2.6.28/pcie-portdrv-call-pci_disable_device-during-remove.patch diff --git a/queue-2.6.28/pipe_rdwr_fasync-fix-the-error-handling-to-prevent-the-leak-crash.patch b/review-2.6.28/pipe_rdwr_fasync-fix-the-error-handling-to-prevent-the-leak-crash.patch similarity index 100% rename from queue-2.6.28/pipe_rdwr_fasync-fix-the-error-handling-to-prevent-the-leak-crash.patch rename to review-2.6.28/pipe_rdwr_fasync-fix-the-error-handling-to-prevent-the-leak-crash.patch diff --git a/queue-2.6.28/powerpc-fix-load-store-float-double-alignment-handler.patch b/review-2.6.28/powerpc-fix-load-store-float-double-alignment-handler.patch similarity index 100% rename from queue-2.6.28/powerpc-fix-load-store-float-double-alignment-handler.patch rename to review-2.6.28/powerpc-fix-load-store-float-double-alignment-handler.patch diff --git a/queue-2.6.28/proc-fix-kflags-to-uflags-copying-in-proc-kpageflags.patch b/review-2.6.28/proc-fix-kflags-to-uflags-copying-in-proc-kpageflags.patch similarity index 100% rename from queue-2.6.28/proc-fix-kflags-to-uflags-copying-in-proc-kpageflags.patch rename to review-2.6.28/proc-fix-kflags-to-uflags-copying-in-proc-kpageflags.patch diff --git a/queue-2.6.28/proc-fix-pg_locked-reporting-in-proc-kpageflags.patch b/review-2.6.28/proc-fix-pg_locked-reporting-in-proc-kpageflags.patch similarity index 100% rename from queue-2.6.28/proc-fix-pg_locked-reporting-in-proc-kpageflags.patch rename to review-2.6.28/proc-fix-pg_locked-reporting-in-proc-kpageflags.patch diff --git a/queue-2.6.28/rdma-nes-don-t-allow-userspace-qps-to-use-stag-zero.patch b/review-2.6.28/rdma-nes-don-t-allow-userspace-qps-to-use-stag-zero.patch similarity index 100% rename from queue-2.6.28/rdma-nes-don-t-allow-userspace-qps-to-use-stag-zero.patch rename to review-2.6.28/rdma-nes-don-t-allow-userspace-qps-to-use-stag-zero.patch diff --git a/queue-2.6.28/revert-ext4-wait-on-all-pending-commits-in-ext4_sync_fs.patch b/review-2.6.28/revert-ext4-wait-on-all-pending-commits-in-ext4_sync_fs.patch similarity index 100% rename from queue-2.6.28/revert-ext4-wait-on-all-pending-commits-in-ext4_sync_fs.patch rename to review-2.6.28/revert-ext4-wait-on-all-pending-commits-in-ext4_sync_fs.patch diff --git a/queue-2.6.28/rtl8187-new-usb-id-s-for-rtl8187l.patch b/review-2.6.28/rtl8187-new-usb-id-s-for-rtl8187l.patch similarity index 100% rename from queue-2.6.28/rtl8187-new-usb-id-s-for-rtl8187l.patch rename to review-2.6.28/rtl8187-new-usb-id-s-for-rtl8187l.patch diff --git a/queue-2.6.28/s3cmci-fix-hangup-in-do_pio_write.patch b/review-2.6.28/s3cmci-fix-hangup-in-do_pio_write.patch similarity index 100% rename from queue-2.6.28/s3cmci-fix-hangup-in-do_pio_write.patch rename to review-2.6.28/s3cmci-fix-hangup-in-do_pio_write.patch diff --git a/queue-2.6.28/scsi-hptiop-add-new-pci-device-id.patch b/review-2.6.28/scsi-hptiop-add-new-pci-device-id.patch similarity index 100% rename from queue-2.6.28/scsi-hptiop-add-new-pci-device-id.patch rename to review-2.6.28/scsi-hptiop-add-new-pci-device-id.patch diff --git a/queue-2.6.28/scsi-sd-revive-sd_index_lock.patch b/review-2.6.28/scsi-sd-revive-sd_index_lock.patch similarity index 100% rename from queue-2.6.28/scsi-sd-revive-sd_index_lock.patch rename to review-2.6.28/scsi-sd-revive-sd_index_lock.patch diff --git a/queue-2.6.28/sdhci-add-no_busy_irq-quirk-for-marvell-cafe-host-chip.patch b/review-2.6.28/sdhci-add-no_busy_irq-quirk-for-marvell-cafe-host-chip.patch similarity index 100% rename from queue-2.6.28/sdhci-add-no_busy_irq-quirk-for-marvell-cafe-host-chip.patch rename to review-2.6.28/sdhci-add-no_busy_irq-quirk-for-marvell-cafe-host-chip.patch diff --git a/queue-2.6.28/sdhci-add-quirk-for-controllers-with-no-end-of-busy-irq.patch b/review-2.6.28/sdhci-add-quirk-for-controllers-with-no-end-of-busy-irq.patch similarity index 100% rename from queue-2.6.28/sdhci-add-quirk-for-controllers-with-no-end-of-busy-irq.patch rename to review-2.6.28/sdhci-add-quirk-for-controllers-with-no-end-of-busy-irq.patch diff --git a/queue-2.6.28/sdhci-fix-led-naming.patch b/review-2.6.28/sdhci-fix-led-naming.patch similarity index 100% rename from queue-2.6.28/sdhci-fix-led-naming.patch rename to review-2.6.28/sdhci-fix-led-naming.patch diff --git a/queue-2.6.28/selinux-fix-a-panic-in-selinux_netlbl_inode_permission.patch b/review-2.6.28/selinux-fix-a-panic-in-selinux_netlbl_inode_permission.patch similarity index 100% rename from queue-2.6.28/selinux-fix-a-panic-in-selinux_netlbl_inode_permission.patch rename to review-2.6.28/selinux-fix-a-panic-in-selinux_netlbl_inode_permission.patch diff --git a/queue-2.6.28/selinux-fix-the-netlabel-glue-code-for-setsockopt.patch b/review-2.6.28/selinux-fix-the-netlabel-glue-code-for-setsockopt.patch similarity index 100% rename from queue-2.6.28/selinux-fix-the-netlabel-glue-code-for-setsockopt.patch rename to review-2.6.28/selinux-fix-the-netlabel-glue-code-for-setsockopt.patch diff --git a/queue-2.6.28/seq_file-properly-cope-with-pread.patch b/review-2.6.28/seq_file-properly-cope-with-pread.patch similarity index 100% rename from queue-2.6.28/seq_file-properly-cope-with-pread.patch rename to review-2.6.28/seq_file-properly-cope-with-pread.patch diff --git a/queue-2.6.28/series b/review-2.6.28/series similarity index 100% rename from queue-2.6.28/series rename to review-2.6.28/series diff --git a/queue-2.6.28/sound-usb-audio-fix-uninitialized-variable-with-m-audio-midi-interfaces.patch b/review-2.6.28/sound-usb-audio-fix-uninitialized-variable-with-m-audio-midi-interfaces.patch similarity index 100% rename from queue-2.6.28/sound-usb-audio-fix-uninitialized-variable-with-m-audio-midi-interfaces.patch rename to review-2.6.28/sound-usb-audio-fix-uninitialized-variable-with-m-audio-midi-interfaces.patch diff --git a/queue-2.6.28/sound-virtuoso-revert-do-not-overwrite-eeprom-on-xonar-d2-d2x.patch b/review-2.6.28/sound-virtuoso-revert-do-not-overwrite-eeprom-on-xonar-d2-d2x.patch similarity index 100% rename from queue-2.6.28/sound-virtuoso-revert-do-not-overwrite-eeprom-on-xonar-d2-d2x.patch rename to review-2.6.28/sound-virtuoso-revert-do-not-overwrite-eeprom-on-xonar-d2-d2x.patch diff --git a/queue-2.6.28/sparc64-fix-crashes-in-jbusmc_print_dimm.patch b/review-2.6.28/sparc64-fix-crashes-in-jbusmc_print_dimm.patch similarity index 100% rename from queue-2.6.28/sparc64-fix-crashes-in-jbusmc_print_dimm.patch rename to review-2.6.28/sparc64-fix-crashes-in-jbusmc_print_dimm.patch diff --git a/queue-2.6.28/sparc64-fix-dax-handling-via-userspace-access-from-kernel.patch b/review-2.6.28/sparc64-fix-dax-handling-via-userspace-access-from-kernel.patch similarity index 100% rename from queue-2.6.28/sparc64-fix-dax-handling-via-userspace-access-from-kernel.patch rename to review-2.6.28/sparc64-fix-dax-handling-via-userspace-access-from-kernel.patch diff --git a/queue-2.6.28/timerfd-add-flags-check.patch b/review-2.6.28/timerfd-add-flags-check.patch similarity index 100% rename from queue-2.6.28/timerfd-add-flags-check.patch rename to review-2.6.28/timerfd-add-flags-check.patch diff --git a/queue-2.6.28/usb-cdc-acm-add-usb-id-for-motomagx-phones.patch b/review-2.6.28/usb-cdc-acm-add-usb-id-for-motomagx-phones.patch similarity index 100% rename from queue-2.6.28/usb-cdc-acm-add-usb-id-for-motomagx-phones.patch rename to review-2.6.28/usb-cdc-acm-add-usb-id-for-motomagx-phones.patch diff --git a/queue-2.6.28/usb-ehci-slow-down-itd-reuse.patch b/review-2.6.28/usb-ehci-slow-down-itd-reuse.patch similarity index 100% rename from queue-2.6.28/usb-ehci-slow-down-itd-reuse.patch rename to review-2.6.28/usb-ehci-slow-down-itd-reuse.patch diff --git a/queue-2.6.28/usb-option-add-benq-3g-modem-information.patch b/review-2.6.28/usb-option-add-benq-3g-modem-information.patch similarity index 100% rename from queue-2.6.28/usb-option-add-benq-3g-modem-information.patch rename to review-2.6.28/usb-option-add-benq-3g-modem-information.patch diff --git a/queue-2.6.28/usb-usb-storage-add-ignore_residue-flag-for-genesys-logic-adapters.patch b/review-2.6.28/usb-usb-storage-add-ignore_residue-flag-for-genesys-logic-adapters.patch similarity index 100% rename from queue-2.6.28/usb-usb-storage-add-ignore_residue-flag-for-genesys-logic-adapters.patch rename to review-2.6.28/usb-usb-storage-add-ignore_residue-flag-for-genesys-logic-adapters.patch diff --git a/queue-2.6.28/usb-usb_get_string-should-check-the-descriptor-type.patch b/review-2.6.28/usb-usb_get_string-should-check-the-descriptor-type.patch similarity index 100% rename from queue-2.6.28/usb-usb_get_string-should-check-the-descriptor-type.patch rename to review-2.6.28/usb-usb_get_string-should-check-the-descriptor-type.patch diff --git a/queue-2.6.28/vfs-separate-fmode_pread-fmode_pwrite-into-separate-flags.patch b/review-2.6.28/vfs-separate-fmode_pread-fmode_pwrite-into-separate-flags.patch similarity index 100% rename from queue-2.6.28/vfs-separate-fmode_pread-fmode_pwrite-into-separate-flags.patch rename to review-2.6.28/vfs-separate-fmode_pread-fmode_pwrite-into-separate-flags.patch diff --git a/queue-2.6.28/vmalloc-call-flush_cache_vunmap-from-unmap_kernel_range.patch b/review-2.6.28/vmalloc-call-flush_cache_vunmap-from-unmap_kernel_range.patch similarity index 100% rename from queue-2.6.28/vmalloc-call-flush_cache_vunmap-from-unmap_kernel_range.patch rename to review-2.6.28/vmalloc-call-flush_cache_vunmap-from-unmap_kernel_range.patch diff --git a/queue-2.6.28/vt-declare-pio_cmap-gio_cmap-as-compatbile-ioctls.patch b/review-2.6.28/vt-declare-pio_cmap-gio_cmap-as-compatbile-ioctls.patch similarity index 100% rename from queue-2.6.28/vt-declare-pio_cmap-gio_cmap-as-compatbile-ioctls.patch rename to review-2.6.28/vt-declare-pio_cmap-gio_cmap-as-compatbile-ioctls.patch diff --git a/queue-2.6.28/watchdog-ks8695_wdt.c-clock_tick_rate-undeclared.patch b/review-2.6.28/watchdog-ks8695_wdt.c-clock_tick_rate-undeclared.patch similarity index 100% rename from queue-2.6.28/watchdog-ks8695_wdt.c-clock_tick_rate-undeclared.patch rename to review-2.6.28/watchdog-ks8695_wdt.c-clock_tick_rate-undeclared.patch diff --git a/queue-2.6.28/watchdog-rc32434_wdt-fix-sections.patch b/review-2.6.28/watchdog-rc32434_wdt-fix-sections.patch similarity index 100% rename from queue-2.6.28/watchdog-rc32434_wdt-fix-sections.patch rename to review-2.6.28/watchdog-rc32434_wdt-fix-sections.patch diff --git a/queue-2.6.28/watchdog-rc32434_wdt-fix-watchdog-driver.patch b/review-2.6.28/watchdog-rc32434_wdt-fix-watchdog-driver.patch similarity index 100% rename from queue-2.6.28/watchdog-rc32434_wdt-fix-watchdog-driver.patch rename to review-2.6.28/watchdog-rc32434_wdt-fix-watchdog-driver.patch diff --git a/queue-2.6.28/x86-64-fix-int-0x80-enosys-return.patch b/review-2.6.28/x86-64-fix-int-0x80-enosys-return.patch similarity index 100% rename from queue-2.6.28/x86-64-fix-int-0x80-enosys-return.patch rename to review-2.6.28/x86-64-fix-int-0x80-enosys-return.patch diff --git a/queue-2.6.28/x86-64-seccomp-fix-32-64-syscall-hole.patch b/review-2.6.28/x86-64-seccomp-fix-32-64-syscall-hole.patch similarity index 100% rename from queue-2.6.28/x86-64-seccomp-fix-32-64-syscall-hole.patch rename to review-2.6.28/x86-64-seccomp-fix-32-64-syscall-hole.patch diff --git a/queue-2.6.28/x86-64-syscall-audit-fix-32-64-syscall-hole.patch b/review-2.6.28/x86-64-syscall-audit-fix-32-64-syscall-hole.patch similarity index 100% rename from queue-2.6.28/x86-64-syscall-audit-fix-32-64-syscall-hole.patch rename to review-2.6.28/x86-64-syscall-audit-fix-32-64-syscall-hole.patch diff --git a/queue-2.6.28/x86-add-dell-xps710-reboot-quirk.patch b/review-2.6.28/x86-add-dell-xps710-reboot-quirk.patch similarity index 100% rename from queue-2.6.28/x86-add-dell-xps710-reboot-quirk.patch rename to review-2.6.28/x86-add-dell-xps710-reboot-quirk.patch diff --git a/queue-2.6.28/x86-fix-math_emu-register-frame-access.patch b/review-2.6.28/x86-fix-math_emu-register-frame-access.patch similarity index 100% rename from queue-2.6.28/x86-fix-math_emu-register-frame-access.patch rename to review-2.6.28/x86-fix-math_emu-register-frame-access.patch diff --git a/queue-2.6.28/x86-hpet-fix-for-ls21-hpet-boot-hang.patch b/review-2.6.28/x86-hpet-fix-for-ls21-hpet-boot-hang.patch similarity index 100% rename from queue-2.6.28/x86-hpet-fix-for-ls21-hpet-boot-hang.patch rename to review-2.6.28/x86-hpet-fix-for-ls21-hpet-boot-hang.patch diff --git a/queue-2.6.28/x86-math_emu-info-cleanup.patch b/review-2.6.28/x86-math_emu-info-cleanup.patch similarity index 100% rename from queue-2.6.28/x86-math_emu-info-cleanup.patch rename to review-2.6.28/x86-math_emu-info-cleanup.patch diff --git a/queue-2.6.28/x86-oprofile-don-t-set-counter-width-from-cpuid-on-core2.patch b/review-2.6.28/x86-oprofile-don-t-set-counter-width-from-cpuid-on-core2.patch similarity index 100% rename from queue-2.6.28/x86-oprofile-don-t-set-counter-width-from-cpuid-on-core2.patch rename to review-2.6.28/x86-oprofile-don-t-set-counter-width-from-cpuid-on-core2.patch diff --git a/queue-2.6.28/x86-paravirt-make-arch_flush_lazy_mmu-cpu-disable-preemption.patch b/review-2.6.28/x86-paravirt-make-arch_flush_lazy_mmu-cpu-disable-preemption.patch similarity index 100% rename from queue-2.6.28/x86-paravirt-make-arch_flush_lazy_mmu-cpu-disable-preemption.patch rename to review-2.6.28/x86-paravirt-make-arch_flush_lazy_mmu-cpu-disable-preemption.patch diff --git a/queue-2.6.28/x86-tone-down-mtrr_trim_uncached_memory-warning.patch b/review-2.6.28/x86-tone-down-mtrr_trim_uncached_memory-warning.patch similarity index 100% rename from queue-2.6.28/x86-tone-down-mtrr_trim_uncached_memory-warning.patch rename to review-2.6.28/x86-tone-down-mtrr_trim_uncached_memory-warning.patch diff --git a/queue-2.6.28/x86-vmi-tsc-going-backwards-check-in-vmi-clocksource.patch b/review-2.6.28/x86-vmi-tsc-going-backwards-check-in-vmi-clocksource.patch similarity index 100% rename from queue-2.6.28/x86-vmi-tsc-going-backwards-check-in-vmi-clocksource.patch rename to review-2.6.28/x86-vmi-tsc-going-backwards-check-in-vmi-clocksource.patch diff --git a/queue-2.6.28/xen-blkfront-use-blk_rq_map_sg-to-generate-ring-entries.patch b/review-2.6.28/xen-blkfront-use-blk_rq_map_sg-to-generate-ring-entries.patch similarity index 100% rename from queue-2.6.28/xen-blkfront-use-blk_rq_map_sg-to-generate-ring-entries.patch rename to review-2.6.28/xen-blkfront-use-blk_rq_map_sg-to-generate-ring-entries.patch diff --git a/queue-2.6.28/xen-disable-interrupts-early-as-start_kernel-expects.patch b/review-2.6.28/xen-disable-interrupts-early-as-start_kernel-expects.patch similarity index 100% rename from queue-2.6.28/xen-disable-interrupts-early-as-start_kernel-expects.patch rename to review-2.6.28/xen-disable-interrupts-early-as-start_kernel-expects.patch diff --git a/queue-2.6.28/zaurus-add-usb-id-for-motomagx-phones.patch b/review-2.6.28/zaurus-add-usb-id-for-motomagx-phones.patch similarity index 100% rename from queue-2.6.28/zaurus-add-usb-id-for-motomagx-phones.patch rename to review-2.6.28/zaurus-add-usb-id-for-motomagx-phones.patch