From: Greg Kroah-Hartman Date: Thu, 13 Aug 2009 20:01:01 +0000 (-0700) Subject: start 2.6.30.5 review cycle X-Git-Tag: v2.6.30.5~3 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=3253cc7a46a35459ec2b0dc05645b73ed51be276;p=thirdparty%2Fkernel%2Fstable-queue.git start 2.6.30.5 review cycle --- diff --git a/queue-2.6.30/0001-drm-i915-add-ignore-lvds-quirk-info-for-AOpen-Mini-P.patch b/review-2.6.30/0001-drm-i915-add-ignore-lvds-quirk-info-for-AOpen-Mini-P.patch similarity index 100% rename from queue-2.6.30/0001-drm-i915-add-ignore-lvds-quirk-info-for-AOpen-Mini-P.patch rename to review-2.6.30/0001-drm-i915-add-ignore-lvds-quirk-info-for-AOpen-Mini-P.patch diff --git a/queue-2.6.30/0002-drm-i915-apply-G45-vblank-count-code-to-all-G4x-chip.patch b/review-2.6.30/0002-drm-i915-apply-G45-vblank-count-code-to-all-G4x-chip.patch similarity index 100% rename from queue-2.6.30/0002-drm-i915-apply-G45-vblank-count-code-to-all-G4x-chip.patch rename to review-2.6.30/0002-drm-i915-apply-G45-vblank-count-code-to-all-G4x-chip.patch diff --git a/queue-2.6.30/0003-drm-i915-avoid-non-atomic-sysrq-execution.patch b/review-2.6.30/0003-drm-i915-avoid-non-atomic-sysrq-execution.patch similarity index 100% rename from queue-2.6.30/0003-drm-i915-avoid-non-atomic-sysrq-execution.patch rename to review-2.6.30/0003-drm-i915-avoid-non-atomic-sysrq-execution.patch diff --git a/queue-2.6.30/0004-drm-i915-Skip-lvds-with-Aopen-i945GTt-VFA.patch b/review-2.6.30/0004-drm-i915-Skip-lvds-with-Aopen-i945GTt-VFA.patch similarity index 100% rename from queue-2.6.30/0004-drm-i915-Skip-lvds-with-Aopen-i945GTt-VFA.patch rename to review-2.6.30/0004-drm-i915-Skip-lvds-with-Aopen-i945GTt-VFA.patch diff --git a/queue-2.6.30/0005-drm-i915-Hook-connector-to-encoder-during-load-detec.patch b/review-2.6.30/0005-drm-i915-Hook-connector-to-encoder-during-load-detec.patch similarity index 100% rename from queue-2.6.30/0005-drm-i915-Hook-connector-to-encoder-during-load-detec.patch rename to review-2.6.30/0005-drm-i915-Hook-connector-to-encoder-during-load-detec.patch diff --git a/queue-2.6.30/0006-drm-i915-initialize-fence-registers-to-zero-when-loa.patch b/review-2.6.30/0006-drm-i915-initialize-fence-registers-to-zero-when-loa.patch similarity index 100% rename from queue-2.6.30/0006-drm-i915-initialize-fence-registers-to-zero-when-loa.patch rename to review-2.6.30/0006-drm-i915-initialize-fence-registers-to-zero-when-loa.patch diff --git a/queue-2.6.30/0007-drm-i915-Set-SSC-frequency-for-8xx-chips-correctly.patch b/review-2.6.30/0007-drm-i915-Set-SSC-frequency-for-8xx-chips-correctly.patch similarity index 100% rename from queue-2.6.30/0007-drm-i915-Set-SSC-frequency-for-8xx-chips-correctly.patch rename to review-2.6.30/0007-drm-i915-Set-SSC-frequency-for-8xx-chips-correctly.patch diff --git a/queue-2.6.30/alsa-hda-add-missing-vmaster-initialization-for-alc269.patch b/review-2.6.30/alsa-hda-add-missing-vmaster-initialization-for-alc269.patch similarity index 100% rename from queue-2.6.30/alsa-hda-add-missing-vmaster-initialization-for-alc269.patch rename to review-2.6.30/alsa-hda-add-missing-vmaster-initialization-for-alc269.patch diff --git a/queue-2.6.30/atl1c-add-missing-parentheses.patch b/review-2.6.30/atl1c-add-missing-parentheses.patch similarity index 100% rename from queue-2.6.30/atl1c-add-missing-parentheses.patch rename to review-2.6.30/atl1c-add-missing-parentheses.patch diff --git a/queue-2.6.30/atl1c-misplaced-parenthesis.patch b/review-2.6.30/atl1c-misplaced-parenthesis.patch similarity index 100% rename from queue-2.6.30/atl1c-misplaced-parenthesis.patch rename to review-2.6.30/atl1c-misplaced-parenthesis.patch diff --git a/queue-2.6.30/atl1c-wake_mcast-tested-twice-not-wake_ucast.patch b/review-2.6.30/atl1c-wake_mcast-tested-twice-not-wake_ucast.patch similarity index 100% rename from queue-2.6.30/atl1c-wake_mcast-tested-twice-not-wake_ucast.patch rename to review-2.6.30/atl1c-wake_mcast-tested-twice-not-wake_ucast.patch diff --git a/queue-2.6.30/be2net-fix-to-avoid-a-crash-seen-on-ppc-with-lro-and-jumbo-frames.patch b/review-2.6.30/be2net-fix-to-avoid-a-crash-seen-on-ppc-with-lro-and-jumbo-frames.patch similarity index 100% rename from queue-2.6.30/be2net-fix-to-avoid-a-crash-seen-on-ppc-with-lro-and-jumbo-frames.patch rename to review-2.6.30/be2net-fix-to-avoid-a-crash-seen-on-ppc-with-lro-and-jumbo-frames.patch diff --git a/queue-2.6.30/cfg80211-add-two-missing-null-pointer-checks.patch b/review-2.6.30/cfg80211-add-two-missing-null-pointer-checks.patch similarity index 100% rename from queue-2.6.30/cfg80211-add-two-missing-null-pointer-checks.patch rename to review-2.6.30/cfg80211-add-two-missing-null-pointer-checks.patch diff --git a/queue-2.6.30/cifs-fix-error-handling-in-mount-time-dfs-referral-chasing-code.patch b/review-2.6.30/cifs-fix-error-handling-in-mount-time-dfs-referral-chasing-code.patch similarity index 100% rename from queue-2.6.30/cifs-fix-error-handling-in-mount-time-dfs-referral-chasing-code.patch rename to review-2.6.30/cifs-fix-error-handling-in-mount-time-dfs-referral-chasing-code.patch diff --git a/queue-2.6.30/compat_ioctl-hook-up-compat-handler-for-fiemap-ioctl.patch b/review-2.6.30/compat_ioctl-hook-up-compat-handler-for-fiemap-ioctl.patch similarity index 100% rename from queue-2.6.30/compat_ioctl-hook-up-compat-handler-for-fiemap-ioctl.patch rename to review-2.6.30/compat_ioctl-hook-up-compat-handler-for-fiemap-ioctl.patch diff --git a/queue-2.6.30/drm-i915-save-restore-cursor-state-on-suspend-resume.patch b/review-2.6.30/drm-i915-save-restore-cursor-state-on-suspend-resume.patch similarity index 100% rename from queue-2.6.30/drm-i915-save-restore-cursor-state-on-suspend-resume.patch rename to review-2.6.30/drm-i915-save-restore-cursor-state-on-suspend-resume.patch diff --git a/queue-2.6.30/e100-work-around-the-driver-using-streaming-dma-mapping-for-rx-descriptors.patch b/review-2.6.30/e100-work-around-the-driver-using-streaming-dma-mapping-for-rx-descriptors.patch similarity index 100% rename from queue-2.6.30/e100-work-around-the-driver-using-streaming-dma-mapping-for-rx-descriptors.patch rename to review-2.6.30/e100-work-around-the-driver-using-streaming-dma-mapping-for-rx-descriptors.patch diff --git a/queue-2.6.30/edac-x38-fix-mchbar-high-register-addr.patch b/review-2.6.30/edac-x38-fix-mchbar-high-register-addr.patch similarity index 100% rename from queue-2.6.30/edac-x38-fix-mchbar-high-register-addr.patch rename to review-2.6.30/edac-x38-fix-mchbar-high-register-addr.patch diff --git a/queue-2.6.30/execve-must-clear-current-clear_child_tid.patch b/review-2.6.30/execve-must-clear-current-clear_child_tid.patch similarity index 100% rename from queue-2.6.30/execve-must-clear-current-clear_child_tid.patch rename to review-2.6.30/execve-must-clear-current-clear_child_tid.patch diff --git a/queue-2.6.30/firewire-sbp2-add-support-for-disks-2-tb.patch b/review-2.6.30/firewire-sbp2-add-support-for-disks-2-tb.patch similarity index 100% rename from queue-2.6.30/firewire-sbp2-add-support-for-disks-2-tb.patch rename to review-2.6.30/firewire-sbp2-add-support-for-disks-2-tb.patch diff --git a/queue-2.6.30/flat-fix-uninitialized-ptr-with-shared-libs.patch b/review-2.6.30/flat-fix-uninitialized-ptr-with-shared-libs.patch similarity index 100% rename from queue-2.6.30/flat-fix-uninitialized-ptr-with-shared-libs.patch rename to review-2.6.30/flat-fix-uninitialized-ptr-with-shared-libs.patch diff --git a/queue-2.6.30/generic-ipi-fix-hotplug_cfd.patch b/review-2.6.30/generic-ipi-fix-hotplug_cfd.patch similarity index 100% rename from queue-2.6.30/generic-ipi-fix-hotplug_cfd.patch rename to review-2.6.30/generic-ipi-fix-hotplug_cfd.patch diff --git a/queue-2.6.30/gro-flush-gro-packets-in-napi_disable_pending-path.patch b/review-2.6.30/gro-flush-gro-packets-in-napi_disable_pending-path.patch similarity index 100% rename from queue-2.6.30/gro-flush-gro-packets-in-napi_disable_pending-path.patch rename to review-2.6.30/gro-flush-gro-packets-in-napi_disable_pending-path.patch diff --git a/queue-2.6.30/gso-stop-fraglists-from-escaping.patch b/review-2.6.30/gso-stop-fraglists-from-escaping.patch similarity index 100% rename from queue-2.6.30/gso-stop-fraglists-from-escaping.patch rename to review-2.6.30/gso-stop-fraglists-from-escaping.patch diff --git a/queue-2.6.30/hugetlbfs-fix-i_blocks-accounting.patch b/review-2.6.30/hugetlbfs-fix-i_blocks-accounting.patch similarity index 100% rename from queue-2.6.30/hugetlbfs-fix-i_blocks-accounting.patch rename to review-2.6.30/hugetlbfs-fix-i_blocks-accounting.patch diff --git a/queue-2.6.30/hwmon-differentiate-between-lpc47m233-and-lpc47m292.patch b/review-2.6.30/hwmon-differentiate-between-lpc47m233-and-lpc47m292.patch similarity index 100% rename from queue-2.6.30/hwmon-differentiate-between-lpc47m233-and-lpc47m292.patch rename to review-2.6.30/hwmon-differentiate-between-lpc47m233-and-lpc47m292.patch diff --git a/queue-2.6.30/hwmon-fix-upper-limit-readings.patch b/review-2.6.30/hwmon-fix-upper-limit-readings.patch similarity index 100% rename from queue-2.6.30/hwmon-fix-upper-limit-readings.patch rename to review-2.6.30/hwmon-fix-upper-limit-readings.patch diff --git a/queue-2.6.30/i2c-tsl2550-fix-lux-value-in-dark-environment.patch b/review-2.6.30/i2c-tsl2550-fix-lux-value-in-dark-environment.patch similarity index 100% rename from queue-2.6.30/i2c-tsl2550-fix-lux-value-in-dark-environment.patch rename to review-2.6.30/i2c-tsl2550-fix-lux-value-in-dark-environment.patch diff --git a/queue-2.6.30/ide-fix-handling-of-unexpected-irqs-vs-request_irq.patch b/review-2.6.30/ide-fix-handling-of-unexpected-irqs-vs-request_irq.patch similarity index 100% rename from queue-2.6.30/ide-fix-handling-of-unexpected-irqs-vs-request_irq.patch rename to review-2.6.30/ide-fix-handling-of-unexpected-irqs-vs-request_irq.patch diff --git a/queue-2.6.30/ide-fix-memory-leak-when-flush-command-is-issued.patch b/review-2.6.30/ide-fix-memory-leak-when-flush-command-is-issued.patch similarity index 100% rename from queue-2.6.30/ide-fix-memory-leak-when-flush-command-is-issued.patch rename to review-2.6.30/ide-fix-memory-leak-when-flush-command-is-issued.patch diff --git a/queue-2.6.30/ide-relax-dma-info-validity-checking.patch b/review-2.6.30/ide-relax-dma-info-validity-checking.patch similarity index 100% rename from queue-2.6.30/ide-relax-dma-info-validity-checking.patch rename to review-2.6.30/ide-relax-dma-info-validity-checking.patch diff --git a/queue-2.6.30/ieee1394-sbp2-add-support-for-disks-2-tb.patch b/review-2.6.30/ieee1394-sbp2-add-support-for-disks-2-tb.patch similarity index 100% rename from queue-2.6.30/ieee1394-sbp2-add-support-for-disks-2-tb.patch rename to review-2.6.30/ieee1394-sbp2-add-support-for-disks-2-tb.patch diff --git a/queue-2.6.30/inet-call-skb_orphan-before-tproxy-activates.patch b/review-2.6.30/inet-call-skb_orphan-before-tproxy-activates.patch similarity index 100% rename from queue-2.6.30/inet-call-skb_orphan-before-tproxy-activates.patch rename to review-2.6.30/inet-call-skb_orphan-before-tproxy-activates.patch diff --git a/queue-2.6.30/ipsec-fix-name-of-cast-algorithm.patch b/review-2.6.30/ipsec-fix-name-of-cast-algorithm.patch similarity index 100% rename from queue-2.6.30/ipsec-fix-name-of-cast-algorithm.patch rename to review-2.6.30/ipsec-fix-name-of-cast-algorithm.patch diff --git a/queue-2.6.30/iwlwifi-only-show-active-power-level-via-sysfs.patch b/review-2.6.30/iwlwifi-only-show-active-power-level-via-sysfs.patch similarity index 100% rename from queue-2.6.30/iwlwifi-only-show-active-power-level-via-sysfs.patch rename to review-2.6.30/iwlwifi-only-show-active-power-level-via-sysfs.patch diff --git a/queue-2.6.30/libsas-reuse-the-original-port-when-hotplugging-phys-in-wide-ports.patch b/review-2.6.30/libsas-reuse-the-original-port-when-hotplugging-phys-in-wide-ports.patch similarity index 100% rename from queue-2.6.30/libsas-reuse-the-original-port-when-hotplugging-phys-in-wide-ports.patch rename to review-2.6.30/libsas-reuse-the-original-port-when-hotplugging-phys-in-wide-ports.patch diff --git a/queue-2.6.30/make-scsi-sg-v4-driver-enabled-by-default-and-remove-experimental-dependency-since-udev-depends-on-bsg.patch b/review-2.6.30/make-scsi-sg-v4-driver-enabled-by-default-and-remove-experimental-dependency-since-udev-depends-on-bsg.patch similarity index 100% rename from queue-2.6.30/make-scsi-sg-v4-driver-enabled-by-default-and-remove-experimental-dependency-since-udev-depends-on-bsg.patch rename to review-2.6.30/make-scsi-sg-v4-driver-enabled-by-default-and-remove-experimental-dependency-since-udev-depends-on-bsg.patch diff --git a/queue-2.6.30/make-sock_sendpage-use-kernel_sendpage.patch b/review-2.6.30/make-sock_sendpage-use-kernel_sendpage.patch similarity index 100% rename from queue-2.6.30/make-sock_sendpage-use-kernel_sendpage.patch rename to review-2.6.30/make-sock_sendpage-use-kernel_sendpage.patch diff --git a/review-2.6.30/mbox b/review-2.6.30/mbox new file mode 100644 index 00000000000..03acddaa6bc --- /dev/null +++ b/review-2.6.30/mbox @@ -0,0 +1,6421 @@ +From gregkh@mini.kroah.org Thu Aug 13 12:51:24 2009 +Message-Id: <20090813195124.804107734@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Thu, 13 Aug 2009 12:49:36 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + Greg KH +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + "John W. Linville" , + Reinette Chatre +Subject: [patch 01/74] iwlwifi: only show active power level via sysfs +References: <20090813194935.985368088@mini.kroah.org> +Content-Disposition: inline; filename=iwlwifi-only-show-active-power-level-via-sysfs.patch +Content-Length: 2616 +Lines: 84 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Reinette Chatre + +commit 872ed1902f511a8947021c562f5728a5bf0640b5 upstream. + +This changes the power_level file to adhere to the "one value +per file" sysfs rule. The user will know which power level was +requested as it will be the number just written to this file. It +is thus not necessary to create a new sysfs file for this value. + +In addition it fixes a problem where powertop's parsing expects +this value to be the first value in this file without any descriptions. + +Signed-off-by: Reinette Chatre +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/iwlwifi/iwl-agn.c | 19 +------------------ + drivers/net/wireless/iwlwifi/iwl3945-base.c | 19 +------------------ + 2 files changed, 2 insertions(+), 36 deletions(-) + +--- a/drivers/net/wireless/iwlwifi/iwl3945-base.c ++++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c +@@ -4623,27 +4623,10 @@ static ssize_t show_power_level(struct d + struct device_attribute *attr, char *buf) + { + struct iwl_priv *priv = dev_get_drvdata(d); +- int mode = priv->power_data.user_power_setting; +- int system = priv->power_data.system_power_setting; + int level = priv->power_data.power_mode; + char *p = buf; + +- switch (system) { +- case IWL_POWER_SYS_AUTO: +- p += sprintf(p, "SYSTEM:auto"); +- break; +- case IWL_POWER_SYS_AC: +- p += sprintf(p, "SYSTEM:ac"); +- break; +- case IWL_POWER_SYS_BATTERY: +- p += sprintf(p, "SYSTEM:battery"); +- break; +- } +- +- p += sprintf(p, "\tMODE:%s", (mode < IWL_POWER_AUTO) ? +- "fixed" : "auto"); +- p += sprintf(p, "\tINDEX:%d", level); +- p += sprintf(p, "\n"); ++ p += sprintf(p, "%d\n", level); + return p - buf + 1; + } + +--- a/drivers/net/wireless/iwlwifi/iwl-agn.c ++++ b/drivers/net/wireless/iwlwifi/iwl-agn.c +@@ -3101,27 +3101,10 @@ static ssize_t show_power_level(struct d + struct device_attribute *attr, char *buf) + { + struct iwl_priv *priv = dev_get_drvdata(d); +- int mode = priv->power_data.user_power_setting; +- int system = priv->power_data.system_power_setting; + int level = priv->power_data.power_mode; + char *p = buf; + +- switch (system) { +- case IWL_POWER_SYS_AUTO: +- p += sprintf(p, "SYSTEM:auto"); +- break; +- case IWL_POWER_SYS_AC: +- p += sprintf(p, "SYSTEM:ac"); +- break; +- case IWL_POWER_SYS_BATTERY: +- p += sprintf(p, "SYSTEM:battery"); +- break; +- } +- +- p += sprintf(p, "\tMODE:%s", (mode < IWL_POWER_AUTO) ? +- "fixed" : "auto"); +- p += sprintf(p, "\tINDEX:%d", level); +- p += sprintf(p, "\n"); ++ p += sprintf(p, "%d\n", level); + return p - buf + 1; + } + + + +From gregkh@mini.kroah.org Thu Aug 13 12:51:25 2009 +Message-Id: <20090813195124.932621003@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Thu, 13 Aug 2009 12:49:37 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Ajit Khaparde , + "David S. Miller" +Subject: [patch 02/74] be2net: Fix to avoid a crash seen on PPC with LRO and Jumbo frames. +References: <20090813194935.985368088@mini.kroah.org> +Content-Disposition: inline; filename=be2net-fix-to-avoid-a-crash-seen-on-ppc-with-lro-and-jumbo-frames.patch +Content-Length: 4914 +Lines: 141 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Ajit Khaparde + +[ Upstream commit bd46cb6cf11867130a41ea9546dd65688b71f3c2 ] + +While testing the driver on PPC, we ran into a crash with LRO, Jumbo frames. +With CONFIG_PPC_64K_PAGES configured (a default in PPC), MAX_SKB_FRAGS drops to 3 and we were crossing the array limits on skb_shinfo(skb)->frags[]. +Now we coalesce the frags from the same physical page into one slot in +skb_shinfo(skb)->frags[] and go to the next index when the frag is from + +different physical page. + +This patch is against the net-2.6 tree. + +Signed-off-by: Ajit Khaparde +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/benet/be.h | 2 - + drivers/net/benet/be_ethtool.c | 4 +-- + drivers/net/benet/be_main.c | 45 +++++++++++++++++++++++++++++------------ + 3 files changed, 35 insertions(+), 16 deletions(-) + +--- a/drivers/net/benet/be_ethtool.c ++++ b/drivers/net/benet/be_ethtool.c +@@ -162,8 +162,8 @@ be_set_coalesce(struct net_device *netde + return -EINVAL; + + adapter->max_rx_coal = coalesce->rx_max_coalesced_frames; +- if (adapter->max_rx_coal > MAX_SKB_FRAGS) +- adapter->max_rx_coal = MAX_SKB_FRAGS - 1; ++ if (adapter->max_rx_coal > BE_MAX_FRAGS_PER_FRAME) ++ adapter->max_rx_coal = BE_MAX_FRAGS_PER_FRAME; + + /* if AIC is being turned on now, start with an EQD of 0 */ + if (rx_eq->enable_aic == 0 && +--- a/drivers/net/benet/be.h ++++ b/drivers/net/benet/be.h +@@ -73,7 +73,7 @@ static inline char *nic_name(struct pci_ + #define RX_FRAGS_REFILL_WM (RX_Q_LEN - MAX_RX_POST) + + #define BE_MAX_LRO_DESCRIPTORS 16 +-#define BE_MAX_FRAGS_PER_FRAME 16 ++#define BE_MAX_FRAGS_PER_FRAME (min((u32) 16, (u32) MAX_SKB_FRAGS)) + + struct be_dma_mem { + void *va; +--- a/drivers/net/benet/be_main.c ++++ b/drivers/net/benet/be_main.c +@@ -682,7 +682,7 @@ static void skb_fill_rx_data(struct be_a + { + struct be_queue_info *rxq = &adapter->rx_obj.q; + struct be_rx_page_info *page_info; +- u16 rxq_idx, i, num_rcvd; ++ u16 rxq_idx, i, num_rcvd, j; + u32 pktsize, hdr_len, curr_frag_len; + u8 *start; + +@@ -725,22 +725,33 @@ static void skb_fill_rx_data(struct be_a + + /* More frags present for this completion */ + pktsize -= curr_frag_len; /* account for above copied frag */ +- for (i = 1; i < num_rcvd; i++) { ++ for (i = 1, j = 0; i < num_rcvd; i++) { + index_inc(&rxq_idx, rxq->len); + page_info = get_rx_page_info(adapter, rxq_idx); + + curr_frag_len = min(pktsize, rx_frag_size); + +- skb_shinfo(skb)->frags[i].page = page_info->page; +- skb_shinfo(skb)->frags[i].page_offset = page_info->page_offset; +- skb_shinfo(skb)->frags[i].size = curr_frag_len; ++ /* Coalesce all frags from the same physical page in one slot */ ++ if (page_info->page_offset == 0) { ++ /* Fresh page */ ++ j++; ++ skb_shinfo(skb)->frags[j].page = page_info->page; ++ skb_shinfo(skb)->frags[j].page_offset = ++ page_info->page_offset; ++ skb_shinfo(skb)->frags[j].size = 0; ++ skb_shinfo(skb)->nr_frags++; ++ } else { ++ put_page(page_info->page); ++ } ++ ++ skb_shinfo(skb)->frags[j].size += curr_frag_len; + skb->len += curr_frag_len; + skb->data_len += curr_frag_len; +- skb_shinfo(skb)->nr_frags++; + pktsize -= curr_frag_len; + + memset(page_info, 0, sizeof(*page_info)); + } ++ BUG_ON(j > MAX_SKB_FRAGS); + + be_rx_stats_update(adapter, pktsize, num_rcvd); + return; +@@ -803,7 +814,7 @@ static void be_rx_compl_process_lro(stru + struct skb_frag_struct rx_frags[BE_MAX_FRAGS_PER_FRAME]; + struct be_queue_info *rxq = &adapter->rx_obj.q; + u32 num_rcvd, pkt_size, remaining, vlanf, curr_frag_len; +- u16 i, rxq_idx = 0, vid; ++ u16 i, rxq_idx = 0, vid, j; + + num_rcvd = AMAP_GET_BITS(struct amap_eth_rx_compl, numfrags, rxcp); + pkt_size = AMAP_GET_BITS(struct amap_eth_rx_compl, pktsize, rxcp); +@@ -811,20 +822,28 @@ static void be_rx_compl_process_lro(stru + rxq_idx = AMAP_GET_BITS(struct amap_eth_rx_compl, fragndx, rxcp); + + remaining = pkt_size; +- for (i = 0; i < num_rcvd; i++) { ++ for (i = 0, j = -1; i < num_rcvd; i++) { + page_info = get_rx_page_info(adapter, rxq_idx); + + curr_frag_len = min(remaining, rx_frag_size); + +- rx_frags[i].page = page_info->page; +- rx_frags[i].page_offset = page_info->page_offset; +- rx_frags[i].size = curr_frag_len; +- remaining -= curr_frag_len; ++ /* Coalesce all frags from the same physical page in one slot */ ++ if (i == 0 || page_info->page_offset == 0) { ++ /* First frag or Fresh page */ ++ j++; ++ rx_frags[j].page = page_info->page; ++ rx_frags[j].page_offset = page_info->page_offset; ++ rx_frags[j].size = 0; ++ } else { ++ put_page(page_info->page); ++ } ++ rx_frags[j].size += curr_frag_len; + ++ remaining -= curr_frag_len; + index_inc(&rxq_idx, rxq->len); +- + memset(page_info, 0, sizeof(*page_info)); + } ++ BUG_ON(j > MAX_SKB_FRAGS); + + if (likely(!vlanf)) { + lro_receive_frags(&adapter->rx_obj.lro_mgr, rx_frags, pkt_size, + + +From gregkh@mini.kroah.org Thu Aug 13 12:51:25 2009 +Message-Id: <20090813195125.088225988@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Thu, 13 Aug 2009 12:49:38 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Krzysztof Halasa , + Jeff Kirsher , + "David S. Miller" +Subject: [patch 03/74] E100: work around the driver using streaming DMA mapping for RX descriptors. +References: <20090813194935.985368088@mini.kroah.org> +Content-Disposition: inline; filename=e100-work-around-the-driver-using-streaming-dma-mapping-for-rx-descriptors.patch +Content-Length: 1078 +Lines: 32 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Krzysztof Halasa + +[ Upstream commit 303d67c288319768b19ed8dbed429fef7eb7c275 ] + +E100 places it's RX packet descriptors inside skb->data and uses them +with bidirectional streaming DMA mapping. Unfortunately it fails to +transfer skb->data ownership to the device after it reads the +descriptor's status, breaking on non-coherent (e.g., ARM) platforms. + +This have to be converted to use coherent memory for the descriptors. + +Signed-off-by: Krzysztof Halasa +Acked-by: Jeff Kirsher +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/e100.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/net/e100.c ++++ b/drivers/net/e100.c +@@ -1762,6 +1762,9 @@ static int e100_rx_indicate(struct nic * + + if (ioread8(&nic->csr->scb.status) & rus_no_res) + nic->ru_running = RU_SUSPENDED; ++ pci_dma_sync_single_for_device(nic->pdev, rx->dma_addr, ++ sizeof(struct rfd), ++ PCI_DMA_BIDIRECTIONAL); + return -ENODATA; + } + + + +From gregkh@mini.kroah.org Thu Aug 13 12:51:25 2009 +Message-Id: <20090813195125.214786279@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Thu, 13 Aug 2009 12:49:39 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Herbert Xu , + "David S. Miller" +Subject: [patch 04/74] ipsec: Fix name of CAST algorithm +References: <20090813194935.985368088@mini.kroah.org> +Content-Disposition: inline; filename=ipsec-fix-name-of-cast-algorithm.patch +Content-Length: 693 +Lines: 28 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Herbert Xu + +[ Upstream commit 245acb87729bc76ba65c7476665c01837e0cdccb ] + +Our CAST algorithm is called cast5, not cast128. Clearly nobody +has ever used it :) + +Signed-off-by: Herbert Xu +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/xfrm/xfrm_algo.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/net/xfrm/xfrm_algo.c ++++ b/net/xfrm/xfrm_algo.c +@@ -292,8 +292,8 @@ static struct xfrm_algo_desc ealg_list[] + } + }, + { +- .name = "cbc(cast128)", +- .compat = "cast128", ++ .name = "cbc(cast5)", ++ .compat = "cast5", + + .uinfo = { + .encr = { + + +From gregkh@mini.kroah.org Thu Aug 13 12:51:25 2009 +Message-Id: <20090813195125.351956918@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Thu, 13 Aug 2009 12:49:40 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Anton Vorontsov , + "David S. Miller" +Subject: [patch 05/74] sky2: Fix checksum endianness +References: <20090813194935.985368088@mini.kroah.org> +Content-Disposition: inline; filename=sky2-fix-checksum-endianness.patch +Content-Length: 1546 +Lines: 42 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Anton Vorontsov + +[ Upstream commit b9389796fa4c87fbdff33816e317cdae5f36dd0b ] + +sky2 driver on PowerPC targets floods kernel log with following errors: + + eth1: hw csum failure. + Call Trace: + [ef84b8a0] [c00075e4] show_stack+0x50/0x160 (unreliable) + [ef84b8d0] [c02fa178] netdev_rx_csum_fault+0x3c/0x5c + [ef84b8f0] [c02f6920] __skb_checksum_complete_head+0x7c/0x84 + [ef84b900] [c02f693c] __skb_checksum_complete+0x14/0x24 + [ef84b910] [c0337e08] tcp_v4_rcv+0x4c8/0x6f8 + [ef84b940] [c031a9c8] ip_local_deliver+0x98/0x210 + [ef84b960] [c031a788] ip_rcv+0x38c/0x534 + [ef84b990] [c0300338] netif_receive_skb+0x260/0x36c + [ef84b9c0] [c025de00] sky2_poll+0x5dc/0xcf8 + [ef84ba20] [c02fb7fc] net_rx_action+0xc0/0x144 + +The NIC is Yukon-2 EC chip revision 1. + +Converting checksum field from le16 to CPU byte order fixes the issue. + +Signed-off-by: Anton Vorontsov +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/sky2.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/sky2.c ++++ b/drivers/net/sky2.c +@@ -2441,7 +2441,7 @@ static int sky2_status_intr(struct sky2_ + if (likely(status >> 16 == (status & 0xffff))) { + skb = sky2->rx_ring[sky2->rx_next].skb; + skb->ip_summed = CHECKSUM_COMPLETE; +- skb->csum = status & 0xffff; ++ skb->csum = le16_to_cpu(status); + } else { + printk(KERN_NOTICE PFX "%s: hardware receive " + "checksum problem (status = %#x)\n", + + +From gregkh@mini.kroah.org Thu Aug 13 12:51:25 2009 +Message-Id: <20090813195125.508950830@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Thu, 13 Aug 2009 12:49:41 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + David Brownell , + "David S. Miller" +Subject: [patch 06/74] usbnet cdc_subset: fix issues talking to PXA gadgets +References: <20090813194935.985368088@mini.kroah.org> +Content-Disposition: inline; filename=usbnet-cdc_subset-fix-issues-talking-to-pxa-gadgets.patch +Content-Length: 1378 +Lines: 36 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: David Brownell + +[ Upstream commit 6be832529a8129c9d90a1d3a78c5d503a710b6fc ] + +The host-side CDC subset driver is binding more specifically +than it should ... only to PXA 210/25x/26x Linux-USB gadgets. + +Loosen that restriction to match the gadget driver driver. +This will various PXA 27x and PXA 3xx devices happier when +talking to Linux hosts, potentially others. + +Signed-off-by: David Brownell +Tested-by: Aric D. Blumer +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/usb/cdc_subset.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +--- a/drivers/net/usb/cdc_subset.c ++++ b/drivers/net/usb/cdc_subset.c +@@ -307,9 +307,10 @@ static const struct usb_device_id produc + USB_DEVICE (0x1286, 0x8001), // "blob" bootloader + .driver_info = (unsigned long) &blob_info, + }, { +- // Linux Ethernet/RNDIS gadget on pxa210/25x/26x, second config +- // e.g. Gumstix, current OpenZaurus, ... +- USB_DEVICE_VER (0x0525, 0xa4a2, 0x0203, 0x0203), ++ // Linux Ethernet/RNDIS gadget, mostly on PXA, second config ++ // e.g. Gumstix, current OpenZaurus, ... or anything else ++ // that just enables this gadget option. ++ USB_DEVICE (0x0525, 0xa4a2), + .driver_info = (unsigned long) &linuxdev_info, + }, + #endif + + +From gregkh@mini.kroah.org Thu Aug 13 12:51:25 2009 +Message-Id: <20090813195125.668127635@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Thu, 13 Aug 2009 12:49:42 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Eric Dumazet , + "David S. Miller" +Subject: [patch 07/74] net: sk_prot_alloc() should not blindly overwrite memory +References: <20090813194935.985368088@mini.kroah.org> +Content-Disposition: inline; filename=net-sk_prot_alloc-should-not-blindly-overwrite-memory.patch +Content-Length: 1509 +Lines: 48 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Eric Dumazet + +[ Upstream commit e912b1142be8f1e2c71c71001dc992c6e5eb2ec1 ] + +Some sockets use SLAB_DESTROY_BY_RCU, and our RCU code correctness +depends on sk->sk_nulls_node.next being always valid. A NULL +value is not allowed as it might fault a lockless reader. + +Current sk_prot_alloc() implementation doesnt respect this hypothesis, +calling kmem_cache_alloc() with __GFP_ZERO. Just call memset() around +the forbidden field. + +Signed-off-by: Eric Dumazet +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/core/sock.c | 19 +++++++++++++++++-- + 1 file changed, 17 insertions(+), 2 deletions(-) + +--- a/net/core/sock.c ++++ b/net/core/sock.c +@@ -935,8 +935,23 @@ static struct sock *sk_prot_alloc(struct + struct kmem_cache *slab; + + slab = prot->slab; +- if (slab != NULL) +- sk = kmem_cache_alloc(slab, priority); ++ if (slab != NULL) { ++ sk = kmem_cache_alloc(slab, priority & ~__GFP_ZERO); ++ if (!sk) ++ return sk; ++ if (priority & __GFP_ZERO) { ++ /* ++ * caches using SLAB_DESTROY_BY_RCU should let ++ * sk_node.next un-modified. Special care is taken ++ * when initializing object to zero. ++ */ ++ if (offsetof(struct sock, sk_node.next) != 0) ++ memset(sk, 0, offsetof(struct sock, sk_node.next)); ++ memset(&sk->sk_node.pprev, 0, ++ prot->obj_size - offsetof(struct sock, ++ sk_node.pprev)); ++ } ++ } + else + sk = kmalloc(prot->obj_size, priority); + + + +From gregkh@mini.kroah.org Thu Aug 13 12:51:25 2009 +Message-Id: <20090813195125.796359983@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Thu, 13 Aug 2009 12:49:43 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Eric Dumazet , + "David S. Miller" +Subject: [patch 08/74] net: sock_copy() fixes +References: <20090813194935.985368088@mini.kroah.org> +Content-Disposition: inline; filename=net-sock_copy-fixes.patch +Content-Length: 5170 +Lines: 149 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Eric Dumazet + +[ Upstream commit 4dc6dc7162c08b9965163c9ab3f9375d4adff2c7 ] + +Commit e912b1142be8f1e2c71c71001dc992c6e5eb2ec1 +(net: sk_prot_alloc() should not blindly overwrite memory) +took care of not zeroing whole new socket at allocation time. + +sock_copy() is another spot where we should be very careful. +We should not set refcnt to a non null value, until +we are sure other fields are correctly setup, or +a lockless reader could catch this socket by mistake, +while not fully (re)initialized. + +This patch puts sk_node & sk_refcnt to the very beginning +of struct sock to ease sock_copy() & sk_prot_alloc() job. + +We add appropriate smp_wmb() before sk_refcnt initializations +to match our RCU requirements (changes to sock keys should +be committed to memory before sk_refcnt setting) + +Signed-off-by: Eric Dumazet +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + include/net/sock.h | 32 +++++++++++++++++++------------- + net/core/sock.c | 20 ++++++++++++++++++-- + 2 files changed, 37 insertions(+), 15 deletions(-) + +--- a/include/net/sock.h ++++ b/include/net/sock.h +@@ -103,15 +103,15 @@ struct net; + + /** + * struct sock_common - minimal network layer representation of sockets ++ * @skc_node: main hash linkage for various protocol lookup tables ++ * @skc_nulls_node: main hash linkage for UDP/UDP-Lite protocol ++ * @skc_refcnt: reference count ++ * @skc_hash: hash value used with various protocol lookup tables + * @skc_family: network address family + * @skc_state: Connection state + * @skc_reuse: %SO_REUSEADDR setting + * @skc_bound_dev_if: bound device index if != 0 +- * @skc_node: main hash linkage for various protocol lookup tables +- * @skc_nulls_node: main hash linkage for UDP/UDP-Lite protocol + * @skc_bind_node: bind hash linkage for various protocol lookup tables +- * @skc_refcnt: reference count +- * @skc_hash: hash value used with various protocol lookup tables + * @skc_prot: protocol handlers inside a network family + * @skc_net: reference to the network namespace of this socket + * +@@ -119,17 +119,21 @@ struct net; + * for struct sock and struct inet_timewait_sock. + */ + struct sock_common { +- unsigned short skc_family; +- volatile unsigned char skc_state; +- unsigned char skc_reuse; +- int skc_bound_dev_if; ++ /* ++ * first fields are not copied in sock_copy() ++ */ + union { + struct hlist_node skc_node; + struct hlist_nulls_node skc_nulls_node; + }; +- struct hlist_node skc_bind_node; + atomic_t skc_refcnt; ++ + unsigned int skc_hash; ++ unsigned short skc_family; ++ volatile unsigned char skc_state; ++ unsigned char skc_reuse; ++ int skc_bound_dev_if; ++ struct hlist_node skc_bind_node; + struct proto *skc_prot; + #ifdef CONFIG_NET_NS + struct net *skc_net; +@@ -207,15 +211,17 @@ struct sock { + * don't add nothing before this first member (__sk_common) --acme + */ + struct sock_common __sk_common; ++#define sk_node __sk_common.skc_node ++#define sk_nulls_node __sk_common.skc_nulls_node ++#define sk_refcnt __sk_common.skc_refcnt ++ ++#define sk_copy_start __sk_common.skc_hash ++#define sk_hash __sk_common.skc_hash + #define sk_family __sk_common.skc_family + #define sk_state __sk_common.skc_state + #define sk_reuse __sk_common.skc_reuse + #define sk_bound_dev_if __sk_common.skc_bound_dev_if +-#define sk_node __sk_common.skc_node +-#define sk_nulls_node __sk_common.skc_nulls_node + #define sk_bind_node __sk_common.skc_bind_node +-#define sk_refcnt __sk_common.skc_refcnt +-#define sk_hash __sk_common.skc_hash + #define sk_prot __sk_common.skc_prot + #define sk_net __sk_common.skc_net + unsigned char sk_shutdown : 2, +--- a/net/core/sock.c ++++ b/net/core/sock.c +@@ -915,13 +915,19 @@ static inline void sock_lock_init(struct + af_family_keys + sk->sk_family); + } + ++/* ++ * Copy all fields from osk to nsk but nsk->sk_refcnt must not change yet, ++ * even temporarly, because of RCU lookups. sk_node should also be left as is. ++ */ + static void sock_copy(struct sock *nsk, const struct sock *osk) + { + #ifdef CONFIG_SECURITY_NETWORK + void *sptr = nsk->sk_security; + #endif +- +- memcpy(nsk, osk, osk->sk_prot->obj_size); ++ BUILD_BUG_ON(offsetof(struct sock, sk_copy_start) != ++ sizeof(osk->sk_node) + sizeof(osk->sk_refcnt)); ++ memcpy(&nsk->sk_copy_start, &osk->sk_copy_start, ++ osk->sk_prot->obj_size - offsetof(struct sock, sk_copy_start)); + #ifdef CONFIG_SECURITY_NETWORK + nsk->sk_security = sptr; + security_sk_clone(osk, nsk); +@@ -1118,6 +1124,11 @@ struct sock *sk_clone(const struct sock + + newsk->sk_err = 0; + newsk->sk_priority = 0; ++ /* ++ * Before updating sk_refcnt, we must commit prior changes to memory ++ * (Documentation/RCU/rculist_nulls.txt for details) ++ */ ++ smp_wmb(); + atomic_set(&newsk->sk_refcnt, 2); + + /* +@@ -1809,6 +1820,11 @@ void sock_init_data(struct socket *sock, + + sk->sk_stamp = ktime_set(-1L, 0); + ++ /* ++ * Before updating sk_refcnt, we must commit prior changes to memory ++ * (Documentation/RCU/rculist_nulls.txt for details) ++ */ ++ smp_wmb(); + atomic_set(&sk->sk_refcnt, 1); + atomic_set(&sk->sk_drops, 0); + } + + +From gregkh@mini.kroah.org Thu Aug 13 12:51:26 2009 +Message-Id: <20090813195125.923244268@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Thu, 13 Aug 2009 12:49:44 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Herbert Xu , + "David S. Miller" +Subject: [patch 09/74] gro: Flush GRO packets in napi_disable_pending path +References: <20090813194935.985368088@mini.kroah.org> +Content-Disposition: inline; filename=gro-flush-gro-packets-in-napi_disable_pending-path.patch +Content-Length: 1253 +Lines: 39 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Herbert Xu + +[ Upstream commit ff780cd8f2fa928b193554f593b36d1243554212 ] + +When NAPI is disabled while we're in net_rx_action, we end up +calling __napi_complete without flushing GRO packets. This is +a bug as it would cause the GRO packets to linger, of course it +also literally BUGs to catch error like this :) + +This patch changes it to napi_complete, with the obligatory IRQ +reenabling. This should be safe because we've only just disabled +IRQs and it does not materially affect the test conditions in +between. + +Signed-off-by: Herbert Xu +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/core/dev.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +--- a/net/core/dev.c ++++ b/net/core/dev.c +@@ -2788,9 +2788,11 @@ static void net_rx_action(struct softirq + * move the instance around on the list at-will. + */ + if (unlikely(work == weight)) { +- if (unlikely(napi_disable_pending(n))) +- __napi_complete(n); +- else ++ if (unlikely(napi_disable_pending(n))) { ++ local_irq_enable(); ++ napi_complete(n); ++ local_irq_disable(); ++ } else + list_move_tail(&n->poll_list, list); + } + + + +From gregkh@mini.kroah.org Thu Aug 13 12:51:26 2009 +Message-Id: <20090813195126.055293320@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Thu, 13 Aug 2009 12:49:45 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Herbert Xu , + "David S. Miller" +Subject: [patch 10/74] gso: Stop fraglists from escaping +References: <20090813194935.985368088@mini.kroah.org> +Content-Disposition: inline; filename=gso-stop-fraglists-from-escaping.patch +Content-Length: 1614 +Lines: 47 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Herbert Xu + +[ Upstream commit 278b2513f76161a9cf1ebddd620dc9d1714fe573 ] + +As it stands skb fraglists can get past the check in dev_queue_xmit +if the skb is marked as GSO. In particular, if the packet doesn't +have the proper checksums for GSO, but can otherwise be handled by +the underlying device, we will not perform the fraglist check on it +at all. + +If the underlying device cannot handle fraglists, then this will +break. + +The fix is as simple as moving the fraglist check from the device +check into skb_gso_ok. + +This has caused crashes with Xen when used together with GRO which +can generate GSO packets with fraglists. + +Signed-off-by: Herbert Xu +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + include/linux/netdevice.h | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +--- a/include/linux/netdevice.h ++++ b/include/linux/netdevice.h +@@ -1856,15 +1856,14 @@ static inline int net_gso_ok(int feature + + static inline int skb_gso_ok(struct sk_buff *skb, int features) + { +- return net_gso_ok(features, skb_shinfo(skb)->gso_type); ++ return net_gso_ok(features, skb_shinfo(skb)->gso_type) && ++ (!skb_shinfo(skb)->frag_list || (features & NETIF_F_FRAGLIST)); + } + + static inline int netif_needs_gso(struct net_device *dev, struct sk_buff *skb) + { + return skb_is_gso(skb) && + (!skb_gso_ok(skb, dev->features) || +- (skb_shinfo(skb)->frag_list && +- !(dev->features & NETIF_F_FRAGLIST)) || + unlikely(skb->ip_summed != CHECKSUM_PARTIAL)); + } + + + +From gregkh@mini.kroah.org Thu Aug 13 12:51:26 2009 +Message-Id: <20090813195126.188943619@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Thu, 13 Aug 2009 12:49:46 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Herbert Xu , + "David S. Miller" +Subject: [patch 11/74] net: Move rx skb_orphan call to where needed +References: <20090813194935.985368088@mini.kroah.org> +Content-Disposition: inline; filename=net-move-rx-skb_orphan-call-to-where-needed.patch +Content-Length: 3381 +Lines: 102 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Herbert Xu + +[ Upstream commit 329c44e3948473916bccd253a37ac2a66dad9862 ] + +In order to get the tun driver to account packets, we need to be +able to receive packets with destructors set. To be on the safe +side, I added an skb_orphan call for all protocols by default since +some of them (IP in particular) cannot handle receiving packets +destructors properly. + +Now it seems that at least one protocol (CAN) expects to be able +to pass skb->sk through the rx path without getting clobbered. + +So this patch attempts to fix this properly by moving the skb_orphan +call to where it's actually needed. In particular, I've added it +to skb_set_owner_[rw] which is what most users of skb->destructor +call. + +This is actually an improvement for tun too since it means that +we only give back the amount charged to the socket when the skb +is passed to another socket that will also be charged accordingly. + +Signed-off-by: Herbert Xu +Tested-by: Oliver Hartkopp +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + include/net/sctp/sctp.h | 1 + + include/net/sock.h | 2 ++ + net/ax25/ax25_in.c | 3 +-- + net/core/dev.c | 2 -- + net/irda/af_irda.c | 3 --- + net/irda/ircomm/ircomm_lmp.c | 1 + + 6 files changed, 5 insertions(+), 7 deletions(-) + +--- a/include/net/sctp/sctp.h ++++ b/include/net/sctp/sctp.h +@@ -448,6 +448,7 @@ static inline void sctp_skb_set_owner_r( + { + struct sctp_ulpevent *event = sctp_skb2event(skb); + ++ skb_orphan(skb); + skb->sk = sk; + skb->destructor = sctp_sock_rfree; + atomic_add(event->rmem_len, &sk->sk_rmem_alloc); +--- a/include/net/sock.h ++++ b/include/net/sock.h +@@ -1231,6 +1231,8 @@ static inline void skb_set_owner_w(struc + + static inline void skb_set_owner_r(struct sk_buff *skb, struct sock *sk) + { ++ skb_orphan(skb); ++ skb_orphan(skb); + skb->sk = sk; + skb->destructor = sock_rfree; + atomic_add(skb->truesize, &sk->sk_rmem_alloc); +--- a/net/ax25/ax25_in.c ++++ b/net/ax25/ax25_in.c +@@ -437,8 +437,7 @@ free: + int ax25_kiss_rcv(struct sk_buff *skb, struct net_device *dev, + struct packet_type *ptype, struct net_device *orig_dev) + { +- skb->sk = NULL; /* Initially we don't know who it's for */ +- skb->destructor = NULL; /* Who initializes this, dammit?! */ ++ skb_orphan(skb); + + if (!net_eq(dev_net(dev), &init_net)) { + kfree_skb(skb); +--- a/net/core/dev.c ++++ b/net/core/dev.c +@@ -2284,8 +2284,6 @@ ncls: + if (!skb) + goto out; + +- skb_orphan(skb); +- + type = skb->protocol; + list_for_each_entry_rcu(ptype, + &ptype_base[ntohs(type) & PTYPE_HASH_MASK], list) { +--- a/net/irda/af_irda.c ++++ b/net/irda/af_irda.c +@@ -913,9 +913,6 @@ static int irda_accept(struct socket *so + /* Clean up the original one to keep it in listen state */ + irttp_listen(self->tsap); + +- /* Wow ! What is that ? Jean II */ +- skb->sk = NULL; +- skb->destructor = NULL; + kfree_skb(skb); + sk->sk_ack_backlog--; + +--- a/net/irda/ircomm/ircomm_lmp.c ++++ b/net/irda/ircomm/ircomm_lmp.c +@@ -196,6 +196,7 @@ static int ircomm_lmp_data_request(struc + /* Don't forget to refcount it - see ircomm_tty_do_softint() */ + skb_get(skb); + ++ skb_orphan(skb); + skb->destructor = ircomm_lmp_flow_control; + + if ((self->pkt_count++ > 7) && (self->flow_status == FLOW_START)) { + + +From gregkh@mini.kroah.org Thu Aug 13 12:51:26 2009 +Message-Id: <20090813195126.321194634@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Thu, 13 Aug 2009 12:49:47 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Herbert Xu , + "David S. Miller" +Subject: [patch 12/74] inet: Call skb_orphan before tproxy activates +References: <20090813194935.985368088@mini.kroah.org> +Content-Disposition: inline; filename=inet-call-skb_orphan-before-tproxy-activates.patch +Content-Length: 1306 +Lines: 42 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Herbert Xu + +[ Upstream commit 71f9dacd2e4d233029e9e956ca3f79531f411827 ] + +As transparent proxying looks up the socket early and assigns +it to the skb for later processing, we must drop any existing +socket ownership prior to that in order to distinguish between +the case where tproxy is active and where it is not. + +Signed-off-by: Herbert Xu +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv4/ip_input.c | 3 +++ + net/ipv6/ip6_input.c | 3 +++ + 2 files changed, 6 insertions(+) + +--- a/net/ipv4/ip_input.c ++++ b/net/ipv4/ip_input.c +@@ -437,6 +437,9 @@ int ip_rcv(struct sk_buff *skb, struct n + /* Remove any debris in the socket control block */ + memset(IPCB(skb), 0, sizeof(struct inet_skb_parm)); + ++ /* Must drop socket now because of tproxy. */ ++ skb_orphan(skb); ++ + return NF_HOOK(PF_INET, NF_INET_PRE_ROUTING, skb, dev, NULL, + ip_rcv_finish); + +--- a/net/ipv6/ip6_input.c ++++ b/net/ipv6/ip6_input.c +@@ -139,6 +139,9 @@ int ipv6_rcv(struct sk_buff *skb, struct + + rcu_read_unlock(); + ++ /* Must drop socket now because of tproxy. */ ++ skb_orphan(skb); ++ + return NF_HOOK(PF_INET6, NF_INET_PRE_ROUTING, skb, dev, NULL, + ip6_rcv_finish); + err: + + +From gregkh@mini.kroah.org Thu Aug 13 12:51:26 2009 +Message-Id: <20090813195126.482792691@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Thu, 13 Aug 2009 12:49:48 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Eric Anholt +Subject: [patch 13/74] drm/i915: Save/restore cursor state on suspend/resume. +References: <20090813194935.985368088@mini.kroah.org> +Content-Disposition: inline; filename=drm-i915-save-restore-cursor-state-on-suspend-resume.patch +Content-Length: 2614 +Lines: 79 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Eric Anholt + +(cherry picked from commit 1fd1c624362819ecc36db2458c6a972c48ae92d6) + +This may fix cursor corruption in X on resume, which would persist until +the cursor was hidden and then shown again. + +V2: Also include the cursor control regs. + +Signed-off-by: Eric Anholt +Reviewed-by: Jesse Barnes +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/i915_drv.h | 8 ++++++++ + drivers/gpu/drm/i915/i915_suspend.c | 20 ++++++++++++++++++++ + 2 files changed, 28 insertions(+) + +--- a/drivers/gpu/drm/i915/i915_drv.h ++++ b/drivers/gpu/drm/i915/i915_drv.h +@@ -285,6 +285,13 @@ typedef struct drm_i915_private { + u8 saveDACMASK; + u8 saveCR[37]; + uint64_t saveFENCE[16]; ++ u32 saveCURACNTR; ++ u32 saveCURAPOS; ++ u32 saveCURABASE; ++ u32 saveCURBCNTR; ++ u32 saveCURBPOS; ++ u32 saveCURBBASE; ++ u32 saveCURSIZE; + + struct { + struct drm_mm gtt_space; +@@ -642,6 +649,7 @@ void i915_gem_detach_phys_object(struct + void i915_gem_free_all_phys_object(struct drm_device *dev); + int i915_gem_object_get_pages(struct drm_gem_object *obj); + void i915_gem_object_put_pages(struct drm_gem_object *obj); ++void i915_gem_release(struct drm_device * dev, struct drm_file *file_priv); + + /* i915_gem_tiling.c */ + void i915_gem_detect_bit_6_swizzle(struct drm_device *dev); +--- a/drivers/gpu/drm/i915/i915_suspend.c ++++ b/drivers/gpu/drm/i915/i915_suspend.c +@@ -295,6 +295,16 @@ int i915_save_state(struct drm_device *d + i915_save_palette(dev, PIPE_B); + dev_priv->savePIPEBSTAT = I915_READ(PIPEBSTAT); + ++ /* Cursor state */ ++ dev_priv->saveCURACNTR = I915_READ(CURACNTR); ++ dev_priv->saveCURAPOS = I915_READ(CURAPOS); ++ dev_priv->saveCURABASE = I915_READ(CURABASE); ++ dev_priv->saveCURBCNTR = I915_READ(CURBCNTR); ++ dev_priv->saveCURBPOS = I915_READ(CURBPOS); ++ dev_priv->saveCURBBASE = I915_READ(CURBBASE); ++ if (!IS_I9XX(dev)) ++ dev_priv->saveCURSIZE = I915_READ(CURSIZE); ++ + /* CRT state */ + dev_priv->saveADPA = I915_READ(ADPA); + +@@ -480,6 +490,16 @@ int i915_restore_state(struct drm_device + I915_WRITE(DSPBCNTR, dev_priv->saveDSPBCNTR); + I915_WRITE(DSPBADDR, I915_READ(DSPBADDR)); + ++ /* Cursor state */ ++ I915_WRITE(CURAPOS, dev_priv->saveCURAPOS); ++ I915_WRITE(CURACNTR, dev_priv->saveCURACNTR); ++ I915_WRITE(CURABASE, dev_priv->saveCURABASE); ++ I915_WRITE(CURBPOS, dev_priv->saveCURBPOS); ++ I915_WRITE(CURBCNTR, dev_priv->saveCURBCNTR); ++ I915_WRITE(CURBBASE, dev_priv->saveCURBBASE); ++ if (!IS_I9XX(dev)) ++ I915_WRITE(CURSIZE, dev_priv->saveCURSIZE); ++ + /* CRT state */ + I915_WRITE(ADPA, dev_priv->saveADPA); + + + +From gregkh@mini.kroah.org Thu Aug 13 12:51:26 2009 +Message-Id: <20090813195126.652068054@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Thu, 13 Aug 2009 12:49:49 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jarod Wilson , + Florian Demmer , + Eric Anholt +Subject: [patch 14/74] drm/i915: add ignore lvds quirk info for AOpen Mini PC +References: <20090813194935.985368088@mini.kroah.org> +Content-Disposition: inline; filename=0001-drm-i915-add-ignore-lvds-quirk-info-for-AOpen-Mini-P.patch +Content-Length: 1043 +Lines: 36 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Jarod Wilson + +(cherry picked from commit 70aa96ca2d8d938fc036ef8fd189b0151f4fc3ba) + +Fix a FIXME in the intel LVDS bring-up code, adding the appropriate +blacklist entry for the AOpen Mini PC, courtesy of a dmidecode +dump from Florian Demmer. + +Signed-off-by: Jarod Wilson +CC: Florian Demmer +Signed-off-by: Eric Anholt +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/i915/intel_lvds.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/i915/intel_lvds.c ++++ b/drivers/gpu/drm/i915/intel_lvds.c +@@ -420,8 +420,14 @@ static const struct dmi_system_id intel_ + DMI_MATCH(DMI_PRODUCT_NAME, "Studio Hybrid 140g"), + }, + }, +- +- /* FIXME: add a check for the Aopen Mini PC */ ++ { ++ .callback = intel_no_lvds_dmi_callback, ++ .ident = "AOpen Mini PC", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "AOpen"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "i965GMx-IF"), ++ }, ++ }, + + { } /* terminating entry */ + }; + + +From gregkh@mini.kroah.org Thu Aug 13 12:51:26 2009 +Message-Id: <20090813195126.779209273@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Thu, 13 Aug 2009 12:49:50 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jesse Barnes , + Eric Anholt +Subject: [patch 15/74] drm/i915: apply G45 vblank count code to all G4x chips and fix max_frame_count +References: <20090813194935.985368088@mini.kroah.org> +Content-Disposition: inline; filename=0002-drm-i915-apply-G45-vblank-count-code-to-all-G4x-chip.patch +Content-Length: 1422 +Lines: 42 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Jesse Barnes + +(cherry picked from commit 42c2798b35b95c471877133e19ccc3cab00e9b65) + +All G4x and newer chips use the new style frame count register, with a +full 32 bit frame count. Update the code to reflect this. + +Signed-off-by: Jesse Barnes +Signed-off-by: Eric Anholt +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/i915/i915_dma.c | 5 ++++- + drivers/gpu/drm/i915/i915_irq.c | 2 -- + 2 files changed, 4 insertions(+), 3 deletions(-) + +--- a/drivers/gpu/drm/i915/i915_dma.c ++++ b/drivers/gpu/drm/i915/i915_dma.c +@@ -1153,8 +1153,11 @@ int i915_driver_load(struct drm_device * + #endif + + dev->driver->get_vblank_counter = i915_get_vblank_counter; +- if (IS_GM45(dev)) ++ dev->max_vblank_count = 0xffffff; /* only 24 bits of frame count */ ++ if (IS_G4X(dev)) { ++ dev->max_vblank_count = 0xffffffff; /* full 32 bit counter */ + dev->driver->get_vblank_counter = gm45_get_vblank_counter; ++ } + + i915_gem_load(dev); + +--- a/drivers/gpu/drm/i915/i915_irq.c ++++ b/drivers/gpu/drm/i915/i915_irq.c +@@ -572,8 +572,6 @@ int i915_driver_irq_postinstall(struct d + + dev_priv->vblank_pipe = DRM_I915_VBLANK_PIPE_A | DRM_I915_VBLANK_PIPE_B; + +- dev->max_vblank_count = 0xffffff; /* only 24 bits of frame count */ +- + /* Unmask the interrupts that we always want on. */ + dev_priv->irq_mask_reg = ~I915_INTERRUPT_ENABLE_FIX; + + + +From gregkh@mini.kroah.org Thu Aug 13 12:51:27 2009 +Message-Id: <20090813195126.920965349@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Thu, 13 Aug 2009 12:49:51 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jesse Barnes , + Eric Anholt +Subject: [patch 16/74] drm/i915: avoid non-atomic sysrq execution +References: <20090813194935.985368088@mini.kroah.org> +Content-Disposition: inline; filename=0003-drm-i915-avoid-non-atomic-sysrq-execution.patch +Content-Length: 1113 +Lines: 37 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Jesse Barnes + +(cherry picked from commit b66d18ddb16603d1e1ec39cb2ff3abf3fd212180) + +The sysrq functions are executed in hardirq context, so we shouldn't be +calling sleeping functions from them, like mutex_locks or memory +allocations. + +Fix up the i915 sysrq handler to avoid this. + +Signed-off-by: Jesse Barnes +Signed-off-by: Eric Anholt +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/i915/intel_fb.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/i915/intel_fb.c ++++ b/drivers/gpu/drm/i915/intel_fb.c +@@ -857,9 +857,15 @@ void intelfb_restore(void) + drm_crtc_helper_set_config(&kernelfb_mode); + } + ++static void intelfb_restore_work_fn(struct work_struct *ignored) ++{ ++ intelfb_restore(); ++} ++static DECLARE_WORK(intelfb_restore_work, intelfb_restore_work_fn); ++ + static void intelfb_sysrq(int dummy1, struct tty_struct *dummy3) + { +- intelfb_restore(); ++ schedule_work(&intelfb_restore_work); + } + + static struct sysrq_key_op sysrq_intelfb_restore_op = { + + +From gregkh@mini.kroah.org Thu Aug 13 12:51:27 2009 +Message-Id: <20090813195127.056965881@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Thu, 13 Aug 2009 12:49:52 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Michael Cousin , + Eric Anholt +Subject: [patch 17/74] drm/i915: Skip lvds with Aopen i945GTt-VFA +References: <20090813194935.985368088@mini.kroah.org> +Content-Disposition: inline; filename=0004-drm-i915-Skip-lvds-with-Aopen-i945GTt-VFA.patch +Content-Length: 746 +Lines: 28 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Michael Cousin +Signed-off-by: Eric Anholt +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/i915/intel_lvds.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/gpu/drm/i915/intel_lvds.c ++++ b/drivers/gpu/drm/i915/intel_lvds.c +@@ -428,6 +428,13 @@ static const struct dmi_system_id intel_ + DMI_MATCH(DMI_PRODUCT_NAME, "i965GMx-IF"), + }, + }, ++ { ++ .callback = intel_no_lvds_dmi_callback, ++ .ident = "Aopen i945GTt-VFA", ++ .matches = { ++ DMI_MATCH(DMI_PRODUCT_VERSION, "AO00001JW"), ++ }, ++ }, + + { } /* terminating entry */ + }; + + +From gregkh@mini.kroah.org Thu Aug 13 12:51:27 2009 +Message-Id: <20090813195127.189458281@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Thu, 13 Aug 2009 12:49:53 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Keith Packard , + Eric Anholt +Subject: [patch 18/74] drm/i915: Hook connector to encoder during load detection (fixes tv/vga detect) +References: <20090813194935.985368088@mini.kroah.org> +Content-Disposition: inline; filename=0005-drm-i915-Hook-connector-to-encoder-during-load-detec.patch +Content-Length: 1140 +Lines: 34 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Keith Packard + +(cherry picked from commit 03d6069912babc07a3da20e715dd6a5dc8f0f867) + +With the DRM-driven DPMS code, encoders are considered idle unless a +connector is hooked to them, so mode setting is skipped. This makes load +detection fail as none of the hardware is enabled. + +Signed-off-by: Keith Packard +Signed-off-by: Eric Anholt +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/i915/intel_display.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/gpu/drm/i915/intel_display.c ++++ b/drivers/gpu/drm/i915/intel_display.c +@@ -1590,6 +1590,7 @@ struct drm_crtc *intel_get_load_detect_p + } + + encoder->crtc = crtc; ++ intel_output->base.encoder = encoder; + intel_output->load_detect_temp = true; + + intel_crtc = to_intel_crtc(crtc); +@@ -1625,6 +1626,7 @@ void intel_release_load_detect_pipe(stru + + if (intel_output->load_detect_temp) { + encoder->crtc = NULL; ++ intel_output->base.encoder = NULL; + intel_output->load_detect_temp = false; + crtc->enabled = drm_helper_crtc_in_use(crtc); + drm_helper_disable_unused_functions(dev); + + +From gregkh@mini.kroah.org Thu Aug 13 12:51:27 2009 +Message-Id: <20090813195127.336139759@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Thu, 13 Aug 2009 12:49:54 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + =?ISO-8859-15?q?Gr=C3=A9goire=20Henry?= , + Eric Anholt +Subject: [patch 19/74] drm/i915: initialize fence registers to zero when loading GEM +References: <20090813194935.985368088@mini.kroah.org> +Content-Disposition: inline; filename=0006-drm-i915-initialize-fence-registers-to-zero-when-loa.patch +Content-Length: 1366 +Lines: 47 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Grégoire Henry + +(cherry picked from commit b5aa8a0fc132dd512c33e7c2621d075e3b77a65e) + +Unitialized fence register could leads to corrupted display. Problem +encountered on MacBooks (revision 1 and 2), directly booting from EFI +or through BIOS emulation. + +(bug #21710 at freedestop.org) + +Signed-off-by: Grégoire Henry +Signed-off-by: Eric Anholt +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/i915/i915_gem.c | 13 +++++++++++++ + 1 file changed, 13 insertions(+) + +--- a/drivers/gpu/drm/i915/i915_gem.c ++++ b/drivers/gpu/drm/i915/i915_gem.c +@@ -4154,6 +4154,7 @@ i915_gem_lastclose(struct drm_device *de + void + i915_gem_load(struct drm_device *dev) + { ++ int i; + drm_i915_private_t *dev_priv = dev->dev_private; + + spin_lock_init(&dev_priv->mm.active_list_lock); +@@ -4173,6 +4174,18 @@ i915_gem_load(struct drm_device *dev) + else + dev_priv->num_fence_regs = 8; + ++ /* Initialize fence registers to zero */ ++ if (IS_I965G(dev)) { ++ for (i = 0; i < 16; i++) ++ I915_WRITE64(FENCE_REG_965_0 + (i * 8), 0); ++ } else { ++ for (i = 0; i < 8; i++) ++ I915_WRITE(FENCE_REG_830_0 + (i * 4), 0); ++ if (IS_I945G(dev) || IS_I945GM(dev) || IS_G33(dev)) ++ for (i = 0; i < 8; i++) ++ I915_WRITE(FENCE_REG_945_8 + (i * 4), 0); ++ } ++ + i915_gem_detect_bit_6_swizzle(dev); + } + + + +From gregkh@mini.kroah.org Thu Aug 13 12:51:27 2009 +Message-Id: <20090813195127.465882440@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Thu, 13 Aug 2009 12:49:55 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Ma Ling , + Eric Anholt +Subject: [patch 20/74] drm/i915: Set SSC frequency for 8xx chips correctly +References: <20090813194935.985368088@mini.kroah.org> +Content-Disposition: inline; filename=0007-drm-i915-Set-SSC-frequency-for-8xx-chips-correctly.patch +Content-Length: 1043 +Lines: 34 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Ma Ling + +(cherry picked from commit 6ff4fd05676bc5b5c930bef25901e489f7843660) + +All 8xx class chips have the 66/48 split, not just 855. + +Signed-off-by: Ma Ling +Reviewed-by: Jesse Barnes +Signed-off-by: Eric Anholt +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/i915/intel_bios.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +--- a/drivers/gpu/drm/i915/intel_bios.c ++++ b/drivers/gpu/drm/i915/intel_bios.c +@@ -185,10 +185,12 @@ parse_general_features(struct drm_i915_p + dev_priv->lvds_use_ssc = general->enable_ssc; + + if (dev_priv->lvds_use_ssc) { +- if (IS_I855(dev_priv->dev)) +- dev_priv->lvds_ssc_freq = general->ssc_freq ? 66 : 48; +- else +- dev_priv->lvds_ssc_freq = general->ssc_freq ? 100 : 96; ++ if (IS_I85X(dev_priv->dev)) ++ dev_priv->lvds_ssc_freq = ++ general->ssc_freq ? 66 : 48; ++ else ++ dev_priv->lvds_ssc_freq = ++ general->ssc_freq ? 100 : 96; + } + } + } + + +From gregkh@mini.kroah.org Thu Aug 13 12:51:27 2009 +Message-Id: <20090813195127.628539086@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Thu, 13 Aug 2009 12:49:56 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Peter Oberparleiter +Subject: [patch 21/74] sysfs: fix hardlink count on device_move +References: <20090813194935.985368088@mini.kroah.org> +Content-Disposition: inline; filename=sysfs-fix-hardlink-count-on-device_move.patch +Content-Length: 1143 +Lines: 36 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Peter Oberparleiter + +commit 0f58b44582001c8bcdb75f36cf85ebbe5170e959 upstream. + +Update directory hardlink count when moving kobjects to a new parent. +Fixes the following problem which occurs when several devices are +moved to the same parent and then unregistered: + +> ls -laF /sys/devices/css0/defunct/ +> total 0 +> drwxr-xr-x 4294967295 root root 0 2009-07-14 17:02 ./ +> drwxr-xr-x 114 root root 0 2009-07-14 17:02 ../ +> drwxr-xr-x 2 root root 0 2009-07-14 17:01 power/ +> -rw-r--r-- 1 root root 4096 2009-07-14 17:01 uevent + +Signed-off-by: Peter Oberparleiter +Signed-off-by: Greg Kroah-Hartman + +--- + fs/sysfs/dir.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/fs/sysfs/dir.c ++++ b/fs/sysfs/dir.c +@@ -939,8 +939,10 @@ again: + /* Remove from old parent's list and insert into new parent's list. */ + sysfs_unlink_sibling(sd); + sysfs_get(new_parent_sd); ++ drop_nlink(old_parent->d_inode); + sysfs_put(sd->s_parent); + sd->s_parent = new_parent_sd; ++ inc_nlink(new_parent->d_inode); + sysfs_link_sibling(sd); + + out_unlock: + + +From gregkh@mini.kroah.org Thu Aug 13 12:51:27 2009 +Message-Id: <20090813195127.776055031@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Thu, 13 Aug 2009 12:49:57 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Giacomo Lozito , + Alan Stern +Subject: [patch 22/74] USB: storage: raise timeout in usb_stor_Bulk_max_lun +References: <20090813194935.985368088@mini.kroah.org> +Content-Disposition: inline; filename=usb-storage-raise-timeout-in-usb_stor_bulk_max_lun.patch +Content-Length: 1155 +Lines: 33 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Giacomo Lozito + +commit 7a777919bbeec3eac1d7904a728a60e9c2bb9c67 upstream. + +Requests to get max LUN, for certain USB storage devices, require a +longer timeout before a correct reply is returned. This happens for a +Realtek USB Card Reader (0bda:0152), which has a max LUN of 3 but is set +to 0, thus losing functionality, because of the timeout occurring too +quickly. + +Raising the timeout value fixes the issue and might help other devices +to return a correct max LUN value as well. + +Signed-off-by: Giacomo Lozito +Acked-by: Alan Stern +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/storage/transport.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/storage/transport.c ++++ b/drivers/usb/storage/transport.c +@@ -961,7 +961,7 @@ int usb_stor_Bulk_max_lun(struct us_data + US_BULK_GET_MAX_LUN, + USB_DIR_IN | USB_TYPE_CLASS | + USB_RECIP_INTERFACE, +- 0, us->ifnum, us->iobuf, 1, HZ); ++ 0, us->ifnum, us->iobuf, 1, 10*HZ); + + US_DEBUGP("GetMaxLUN command result is %d, data is %d\n", + result, us->iobuf[0]); + + +From gregkh@mini.kroah.org Thu Aug 13 12:51:28 2009 +Message-Id: <20090813195127.947446438@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Thu, 13 Aug 2009 12:49:58 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Lu Zhihe , + Doug Thompson +Subject: [patch 23/74] edac: x38 fix mchbar high register addr +References: <20090813194935.985368088@mini.kroah.org> +Content-Disposition: inline; filename=edac-x38-fix-mchbar-high-register-addr.patch +Content-Length: 919 +Lines: 29 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Lu Zhihe + +commit 3d768213a6c34a27fac1804143da8cf18b8b175f upstream. + +Intel X38 MCHBAR is a 64bits register, base from 0x48, so its higher base +is 0x4C. + +Signed-off-by: Lu Zhihe +Signed-off-by: Doug Thompson +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/edac/x38_edac.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/edac/x38_edac.c ++++ b/drivers/edac/x38_edac.c +@@ -30,7 +30,7 @@ + /* Intel X38 register addresses - device 0 function 0 - DRAM Controller */ + + #define X38_MCHBAR_LOW 0x48 /* MCH Memory Mapped Register BAR */ +-#define X38_MCHBAR_HIGH 0x4b ++#define X38_MCHBAR_HIGH 0x4c + #define X38_MCHBAR_MASK 0xfffffc000ULL /* bits 35:14 */ + #define X38_MMR_WINDOW_SIZE 16384 + + + +From gregkh@mini.kroah.org Thu Aug 13 12:51:28 2009 +Message-Id: <20090813195128.100947730@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Thu, 13 Aug 2009 12:49:59 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + John Stoffel , + Jens Axboe +Subject: [patch 24/74] Make SCSI SG v4 driver enabled by default and remove EXPERIMENTAL dependency, since udev depends on BSG +References: <20090813194935.985368088@mini.kroah.org> +Content-Disposition: inline; filename=make-scsi-sg-v4-driver-enabled-by-default-and-remove-experimental-dependency-since-udev-depends-on-bsg.patch +Content-Length: 1286 +Lines: 46 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: John Stoffel + +commit 14d9fa352592582e457cf75022202766baac1348 upstream. + +Make Block Layer SG support v4 the default, since recent udev versions +depend on this to access serial numbers and other low level info properly. + +This should be backported to older kernels as well, since most distros have +enabled this for a long time. + +Signed-off-by: John Stoffel +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman + +--- + block/Kconfig | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +--- a/block/Kconfig ++++ b/block/Kconfig +@@ -45,9 +45,9 @@ config LBD + If unsure, say N. + + config BLK_DEV_BSG +- bool "Block layer SG support v4 (EXPERIMENTAL)" +- depends on EXPERIMENTAL +- ---help--- ++ bool "Block layer SG support v4" ++ default y ++ help + Saying Y here will enable generic SG (SCSI generic) v4 support + for any block device. + +@@ -57,7 +57,10 @@ config BLK_DEV_BSG + protocols (e.g. Task Management Functions and SMP in Serial + Attached SCSI). + +- If unsure, say N. ++ This option is required by recent UDEV versions to properly ++ access device serial numbers, etc. ++ ++ If unsure, say Y. + + config BLK_DEV_INTEGRITY + bool "Block layer data integrity support" + + +From gregkh@mini.kroah.org Thu Aug 13 12:51:28 2009 +Message-Id: <20090813195128.242130683@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Thu, 13 Aug 2009 12:50:00 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Tom Peng , + Jack Wang , + Lindar Liu , + James Bottomley +Subject: [patch 25/74] SCSI: libsas: reuse the original port when hotplugging phys in wide ports +References: <20090813194935.985368088@mini.kroah.org> +Content-Disposition: inline; filename=libsas-reuse-the-original-port-when-hotplugging-phys-in-wide-ports.patch +Content-Length: 2234 +Lines: 62 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Tom Peng + +commit 5381837f125cc62ad703fbcdfcd7566fc81fd404 upstream. + +There's a hotplug problem in the way libsas allocates ports: it loops over the +available ports first trying to add to an existing for a wide port and +otherwise allocating the next free port. This scheme only works if the port +array is packed from zero, which fails if a port gets hot unplugged and the +array becomes sparse. In that case, a new port is formed even if there's a +wide port it should be part of. Fix this by creating two loops over all the +ports: the first to see if the phy should be part of a wide port and the +second to form a new port in an empty port slot. + +Signed-off-by: Tom Peng +Signed-off-by: Jack Wang +Signed-off-by: Lindar Liu +Signed-off-by: James Bottomley +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/libsas/sas_port.c | 19 +++++++++++++++---- + 1 file changed, 15 insertions(+), 4 deletions(-) + +--- a/drivers/scsi/libsas/sas_port.c ++++ b/drivers/scsi/libsas/sas_port.c +@@ -56,7 +56,7 @@ static void sas_form_port(struct asd_sas + } + } + +- /* find a port */ ++ /* see if the phy should be part of a wide port */ + spin_lock_irqsave(&sas_ha->phy_port_lock, flags); + for (i = 0; i < sas_ha->num_phys; i++) { + port = sas_ha->sas_port[i]; +@@ -69,12 +69,23 @@ static void sas_form_port(struct asd_sas + SAS_DPRINTK("phy%d matched wide port%d\n", phy->id, + port->id); + break; +- } else if (*(u64 *) port->sas_addr == 0 && port->num_phys==0) { +- memcpy(port->sas_addr, phy->sas_addr, SAS_ADDR_SIZE); +- break; + } + spin_unlock(&port->phy_list_lock); + } ++ /* The phy does not match any existing port, create a new one */ ++ if (i == sas_ha->num_phys) { ++ for (i = 0; i < sas_ha->num_phys; i++) { ++ port = sas_ha->sas_port[i]; ++ spin_lock(&port->phy_list_lock); ++ if (*(u64 *)port->sas_addr == 0 ++ && port->num_phys == 0) { ++ memcpy(port->sas_addr, phy->sas_addr, ++ SAS_ADDR_SIZE); ++ break; ++ } ++ spin_unlock(&port->phy_list_lock); ++ } ++ } + + if (i >= sas_ha->num_phys) { + printk(KERN_NOTICE "%s: couldn't find a free port, bug?\n", + + +From gregkh@mini.kroah.org Thu Aug 13 12:51:28 2009 +Message-Id: <20090813195128.394569326@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Thu, 13 Aug 2009 12:50:01 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Igor Mammedov , + Jeff Layton , + Steve French +Subject: [patch 26/74] cifs: fix error handling in mount-time DFS referral chasing code +References: <20090813194935.985368088@mini.kroah.org> +Content-Disposition: inline; filename=cifs-fix-error-handling-in-mount-time-dfs-referral-chasing-code.patch +Content-Length: 2841 +Lines: 95 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Jeff Layton + +commit 7b91e2661addd8e2419cb45f6a322aa5dab9bcee upstream. + +If the referral is malformed or the hostname can't be resolved, then +the current code generates an oops. Fix it to handle these errors +gracefully. + +Reported-by: Sandro Mathys +Acked-by: Igor Mammedov +Signed-off-by: Jeff Layton +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman + +--- + fs/cifs/cifs_dfs_ref.c | 12 +++++++++--- + fs/cifs/connect.c | 13 ++++++++++--- + 2 files changed, 19 insertions(+), 6 deletions(-) + +--- a/fs/cifs/cifs_dfs_ref.c ++++ b/fs/cifs/cifs_dfs_ref.c +@@ -55,7 +55,7 @@ void cifs_dfs_release_automount_timer(vo + * i.e. strips from UNC trailing path that is not part of share + * name and fixup missing '\' in the begining of DFS node refferal + * if neccessary. +- * Returns pointer to share name on success or NULL on error. ++ * Returns pointer to share name on success or ERR_PTR on error. + * Caller is responsible for freeing returned string. + */ + static char *cifs_get_share_name(const char *node_name) +@@ -68,7 +68,7 @@ static char *cifs_get_share_name(const c + UNC = kmalloc(len+2 /*for term null and additional \ if it's missed */, + GFP_KERNEL); + if (!UNC) +- return NULL; ++ return ERR_PTR(-ENOMEM); + + /* get share name and server name */ + if (node_name[1] != '\\') { +@@ -87,7 +87,7 @@ static char *cifs_get_share_name(const c + cERROR(1, ("%s: no server name end in node name: %s", + __func__, node_name)); + kfree(UNC); +- return NULL; ++ return ERR_PTR(-EINVAL); + } + + /* find sharename end */ +@@ -133,6 +133,12 @@ char *cifs_compose_mount_options(const c + return ERR_PTR(-EINVAL); + + *devname = cifs_get_share_name(ref->node_name); ++ if (IS_ERR(*devname)) { ++ rc = PTR_ERR(*devname); ++ *devname = NULL; ++ goto compose_mount_options_err; ++ } ++ + rc = dns_resolve_server_name_to_ip(*devname, &srvIP); + if (rc != 0) { + cERROR(1, ("%s: Failed to resolve server part of %s to IP: %d", +--- a/fs/cifs/connect.c ++++ b/fs/cifs/connect.c +@@ -2563,11 +2563,20 @@ remote_path_check: + + if (mount_data != mount_data_global) + kfree(mount_data); ++ + mount_data = cifs_compose_mount_options( + cifs_sb->mountdata, full_path + 1, + referrals, &fake_devname); +- kfree(fake_devname); ++ + free_dfs_info_array(referrals, num_referrals); ++ kfree(fake_devname); ++ kfree(full_path); ++ ++ if (IS_ERR(mount_data)) { ++ rc = PTR_ERR(mount_data); ++ mount_data = NULL; ++ goto mount_fail_check; ++ } + + if (tcon) + cifs_put_tcon(tcon); +@@ -2575,8 +2584,6 @@ remote_path_check: + cifs_put_smb_ses(pSesInfo); + + cleanup_volume_info(&volume_info); +- FreeXid(xid); +- kfree(full_path); + referral_walks_count++; + goto try_mount_again; + } + + +From gregkh@mini.kroah.org Thu Aug 13 12:51:28 2009 +Message-Id: <20090813195128.556439418@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Thu, 13 Aug 2009 12:50:02 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Henrique de Moraes Holschuh , + Len Brown +Subject: [patch 27/74] thinkpad-acpi: disable broken bay and dock subdrivers +References: <20090813194935.985368088@mini.kroah.org> +Content-Disposition: inline; filename=thinkpad-acpi-disable-broken-bay-and-dock-subdrivers.patch +Content-Length: 1927 +Lines: 53 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Henrique de Moraes Holschuh + +commit 550e7fd8afb7664ae7cedb398c407694e2bf7d3c upstream. + +Currently, the ThinkPad-ACPI bay and dock drivers are completely +broken, and cause a NULL pointer derreference in kernel mode (and, +therefore, an OOPS) when they try to issue events (i.e. on dock, +undock, bay ejection, etc). + +OTOH, the standard ACPI dock driver can handle the hotplug bays and +docks of the ThinkPads just fine (including batteries) as of 2.6.27. +In fact, it does a much better job of it than thinkpad-acpi ever did. + +It is just not worth the hassle to find a way to fix this crap without +breaking the (deprecated) thinkpad-acpi dock/bay ABI. This is old, +deprecated code that sees little testing or use. + +As a quick fix suitable for -stable backports, mark the thinkpad-acpi +bay and dock subdrivers as BROKEN in Kconfig. The dead code will be +removed by a later patch. + +This fixes bugzilla #13669, and should be applied to 2.6.27 and later. + +Signed-off-by: Henrique de Moraes Holschuh +Reported-by: Joerg Platte +Signed-off-by: Len Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/platform/x86/Kconfig | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/platform/x86/Kconfig ++++ b/drivers/platform/x86/Kconfig +@@ -265,6 +265,7 @@ config THINKPAD_ACPI_DOCK + bool "Legacy Docking Station Support" + depends on THINKPAD_ACPI + depends on ACPI_DOCK=n ++ depends on BROKEN + default n + ---help--- + Allows the thinkpad_acpi driver to handle docking station events. +@@ -278,7 +279,8 @@ config THINKPAD_ACPI_DOCK + config THINKPAD_ACPI_BAY + bool "Legacy Removable Bay Support" + depends on THINKPAD_ACPI +- default y ++ depends on BROKEN ++ default n + ---help--- + Allows the thinkpad_acpi driver to handle removable bays. It will + electrically disable the device in the bay, and also generate + + +From gregkh@mini.kroah.org Thu Aug 13 12:51:28 2009 +Message-Id: <20090813195128.703325684@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Thu, 13 Aug 2009 12:50:03 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Henrique de Moraes Holschuh , + Len Brown +Subject: [patch 28/74] thinkpad-acpi: fix incorrect use of TPACPI_BRGHT_MODE_ECNVRAM +References: <20090813194935.985368088@mini.kroah.org> +Content-Disposition: inline; filename=thinkpad-acpi-fix-incorrect-use-of-tpacpi_brght_mode_ecnvram.patch +Content-Length: 4687 +Lines: 126 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Henrique de Moraes Holschuh + +commit 59fe4fe34d7afdf63208124f313be9056feaa2f4 upstream. + +HBRV-based default selection of backlight control strategy didn't work +well, at least the X41 defines it but doesn't use it and I don't think +it will stop there. + +Switch to a white/blacklist. All models that have HBRV defined have +been included in the list, and initially all ATI GPUs will get +ECNVRAM, and the Intel GPUs will get UCMS_STEP. + +Symptoms of incorrect backlight mode selection are: + +1. Non-working backlight control through sysfs; + +2. Backlight gets reset to the lowest level at every shutdown, reboot + and when thinkpad-acpi gets unloaded; + +This fixes a regression in 2.6.30, bugzilla #13826 + +Signed-off-by: Henrique de Moraes Holschuh +Reported-by: Tobias Diedrich +Signed-off-by: Len Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/platform/x86/thinkpad_acpi.c | 61 ++++++++++++++++++++++++++--------- + 1 file changed, 47 insertions(+), 14 deletions(-) + +--- a/drivers/platform/x86/thinkpad_acpi.c ++++ b/drivers/platform/x86/thinkpad_acpi.c +@@ -5757,14 +5757,48 @@ static struct backlight_ops ibm_backligh + + /* --------------------------------------------------------------------- */ + ++/* ++ * These are only useful for models that have only one possibility ++ * of GPU. If the BIOS model handles both ATI and Intel, don't use ++ * these quirks. ++ */ ++#define TPACPI_BRGHT_Q_NOEC 0x0001 /* Must NOT use EC HBRV */ ++#define TPACPI_BRGHT_Q_EC 0x0002 /* Should or must use EC HBRV */ ++#define TPACPI_BRGHT_Q_ASK 0x8000 /* Ask for user report */ ++ ++static const struct tpacpi_quirk brightness_quirk_table[] __initconst = { ++ /* Models with ATI GPUs known to require ECNVRAM mode */ ++ TPACPI_Q_IBM('1', 'Y', TPACPI_BRGHT_Q_EC), /* T43/p ATI */ ++ ++ /* Models with ATI GPUs (waiting confirmation) */ ++ TPACPI_Q_IBM('1', 'R', TPACPI_BRGHT_Q_ASK|TPACPI_BRGHT_Q_EC), ++ TPACPI_Q_IBM('1', 'Q', TPACPI_BRGHT_Q_ASK|TPACPI_BRGHT_Q_EC), ++ TPACPI_Q_IBM('7', '6', TPACPI_BRGHT_Q_ASK|TPACPI_BRGHT_Q_EC), ++ TPACPI_Q_IBM('7', '8', TPACPI_BRGHT_Q_ASK|TPACPI_BRGHT_Q_EC), ++ ++ /* Models with Intel Extreme Graphics 2 (waiting confirmation) */ ++ TPACPI_Q_IBM('1', 'V', TPACPI_BRGHT_Q_ASK|TPACPI_BRGHT_Q_NOEC), ++ TPACPI_Q_IBM('1', 'W', TPACPI_BRGHT_Q_ASK|TPACPI_BRGHT_Q_NOEC), ++ TPACPI_Q_IBM('1', 'U', TPACPI_BRGHT_Q_ASK|TPACPI_BRGHT_Q_NOEC), ++ ++ /* Models with Intel GMA900 */ ++ TPACPI_Q_IBM('7', '0', TPACPI_BRGHT_Q_NOEC), /* T43, R52 */ ++ TPACPI_Q_IBM('7', '4', TPACPI_BRGHT_Q_NOEC), /* X41 */ ++ TPACPI_Q_IBM('7', '5', TPACPI_BRGHT_Q_NOEC), /* X41 Tablet */ ++}; ++ + static int __init brightness_init(struct ibm_init_struct *iibm) + { + int b; ++ unsigned long quirks; + + vdbg_printk(TPACPI_DBG_INIT, "initializing brightness subdriver\n"); + + mutex_init(&brightness_mutex); + ++ quirks = tpacpi_check_quirks(brightness_quirk_table, ++ ARRAY_SIZE(brightness_quirk_table)); ++ + /* + * We always attempt to detect acpi support, so as to switch + * Lenovo Vista BIOS to ACPI brightness mode even if we are not +@@ -5821,23 +5855,13 @@ static int __init brightness_init(struct + /* TPACPI_BRGHT_MODE_AUTO not implemented yet, just use default */ + if (brightness_mode == TPACPI_BRGHT_MODE_AUTO || + brightness_mode == TPACPI_BRGHT_MODE_MAX) { +- if (thinkpad_id.vendor == PCI_VENDOR_ID_IBM) { +- /* +- * IBM models that define HBRV probably have +- * EC-based backlight level control +- */ +- if (acpi_evalf(ec_handle, NULL, "HBRV", "qd")) +- /* T40-T43, R50-R52, R50e, R51e, X31-X41 */ +- brightness_mode = TPACPI_BRGHT_MODE_ECNVRAM; +- else +- /* all other IBM ThinkPads */ +- brightness_mode = TPACPI_BRGHT_MODE_UCMS_STEP; +- } else +- /* All Lenovo ThinkPads */ ++ if (quirks & TPACPI_BRGHT_Q_EC) ++ brightness_mode = TPACPI_BRGHT_MODE_ECNVRAM; ++ else + brightness_mode = TPACPI_BRGHT_MODE_UCMS_STEP; + + dbg_printk(TPACPI_DBG_BRGHT, +- "selected brightness_mode=%d\n", ++ "driver auto-selected brightness_mode=%d\n", + brightness_mode); + } + +@@ -5858,6 +5882,15 @@ static int __init brightness_init(struct + vdbg_printk(TPACPI_DBG_INIT | TPACPI_DBG_BRGHT, + "brightness is supported\n"); + ++ if (quirks & TPACPI_BRGHT_Q_ASK) { ++ printk(TPACPI_NOTICE ++ "brightness: will use unverified default: " ++ "brightness_mode=%d\n", brightness_mode); ++ printk(TPACPI_NOTICE ++ "brightness: please report to %s whether it works well " ++ "or not on your ThinkPad\n", TPACPI_MAIL); ++ } ++ + ibm_backlight_device->props.max_brightness = + (tp_features.bright_16levels)? 15 : 7; + ibm_backlight_device->props.brightness = b & TP_EC_BACKLIGHT_LVLMSK; + + +From gregkh@mini.kroah.org Thu Aug 13 12:51:29 2009 +Message-Id: <20090813195128.860303934@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Thu, 13 Aug 2009 12:50:04 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Ryusuke Konishi +Subject: [patch 29/74] nilfs2: fix oops due to inconsistent state in page with discrete b-tree nodes +References: <20090813194935.985368088@mini.kroah.org> +Content-Disposition: inline; filename=nilfs2-fix-oops-due-to-inconsistent-state-in-page-with-discrete-b-tree-nodes.patch +Content-Length: 1873 +Lines: 57 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Ryusuke Konishi + +commit a97778457f22181e8c38c4cd7d7e528378738a98 upstream. + +Andrea Gelmini gave me a report that a kernel oops hit on a nilfs +filesystem with a 1KB block size when doing rsync. + +This turned out to be caused by an inconsistency of dirty state +between a page and its buffers storing b-tree node blocks. + +If the page had multiple buffers split over multiple logs, and if the +logs were written at a time, a dirty flag remained in the page even +every dirty flag in the buffers was cleared. + +This will fix the failure by dropping the dirty flag properly for +pages with the discrete multiple b-tree nodes. + +Reported-by: Andrea Gelmini +Signed-off-by: Ryusuke Konishi +Tested-by: Andrea Gelmini +Signed-off-by: Greg Kroah-Hartman + +--- + fs/nilfs2/segment.c | 16 +++++++++++++++- + 1 file changed, 15 insertions(+), 1 deletion(-) + +--- a/fs/nilfs2/segment.c ++++ b/fs/nilfs2/segment.c +@@ -1876,12 +1876,26 @@ static void nilfs_end_page_io(struct pag + if (!page) + return; + +- if (buffer_nilfs_node(page_buffers(page)) && !PageWriteback(page)) ++ if (buffer_nilfs_node(page_buffers(page)) && !PageWriteback(page)) { + /* + * For b-tree node pages, this function may be called twice + * or more because they might be split in a segment. + */ ++ if (PageDirty(page)) { ++ /* ++ * For pages holding split b-tree node buffers, dirty ++ * flag on the buffers may be cleared discretely. ++ * In that case, the page is once redirtied for ++ * remaining buffers, and it must be cancelled if ++ * all the buffers get cleaned later. ++ */ ++ lock_page(page); ++ if (nilfs_page_buffers_clean(page)) ++ __nilfs_clear_page_dirty(page); ++ unlock_page(page); ++ } + return; ++ } + + __nilfs_end_page_io(page, err); + } + + +From gregkh@mini.kroah.org Thu Aug 13 12:51:29 2009 +Message-Id: <20090813195129.013296149@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Thu, 13 Aug 2009 12:50:05 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Lai Jiangshan , + Steven Rostedt , + Frederic Weisbecker +Subject: [patch 30/74] tracing: Fix invalid function_graph entry +References: <20090813194935.985368088@mini.kroah.org> +Content-Disposition: inline; filename=tracing-fix-invalid-function_graph-entry.patch +Content-Length: 1807 +Lines: 51 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Lai Jiangshan + +commit 38ceb592fcac9110c6b3c87ea0a27bff68c43486 upstream. + +When print_graph_entry() computes a function call entry event, it needs +to also check the next entry to guess if it matches the return event of +the current function entry. +In order to look at this next event, it needs to consume the current +entry before going ahead in the ring buffer. + +However, if the current event that gets consumed is the last one in the +ring buffer head page, the ring_buffer may reuse the page for writers. +The consumed entry will then become invalid because of possible +racy overwriting. + +Me must then handle this entry by making a copy of it. + +The fix also applies on 2.6.30 + +Signed-off-by: Lai Jiangshan +Cc: Steven Rostedt +LKML-Reference: <4A6EEAEC.3050508@cn.fujitsu.com> +Signed-off-by: Frederic Weisbecker +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/trace/trace_functions_graph.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +--- a/kernel/trace/trace_functions_graph.c ++++ b/kernel/trace/trace_functions_graph.c +@@ -798,9 +798,16 @@ print_graph_function(struct trace_iterat + + switch (entry->type) { + case TRACE_GRAPH_ENT: { +- struct ftrace_graph_ent_entry *field; ++ /* ++ * print_graph_entry() may consume the current event, ++ * thus @field may become invalid, so we need to save it. ++ * sizeof(struct ftrace_graph_ent_entry) is very small, ++ * it can be safely saved at the stack. ++ */ ++ struct ftrace_graph_ent_entry *field, saved; + trace_assign_type(field, entry); +- return print_graph_entry(field, s, iter); ++ saved = *field; ++ return print_graph_entry(&saved, s, iter); + } + case TRACE_GRAPH_RET: { + struct ftrace_graph_ret_entry *field; + + +From gregkh@mini.kroah.org Thu Aug 13 12:51:29 2009 +Message-Id: <20090813195129.165986932@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Thu, 13 Aug 2009 12:50:06 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Lai Jiangshan , + Steven Rostedt , + Frederic Weisbecker +Subject: [patch 31/74] tracing: Fix missing function_graph events when we splice_read from trace_pipe +References: <20090813194935.985368088@mini.kroah.org> +Content-Disposition: inline; filename=tracing-fix-missing-function_graph-events-when-we-splice_read-from-trace_pipe.patch +Content-Length: 1799 +Lines: 66 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Lai Jiangshan + +commit 74e7ff8c50b6b022e6ffaa736b16a4dc161d3eaf upstream. + +About a half events are missing when we splice_read +from trace_pipe. They are unexpectedly consumed because we ignore +the TRACE_TYPE_NO_CONSUME return value used by the function graph +tracer when it needs to consume the events by itself to walk on +the ring buffer. + +The same problem appears with ftrace_dump() + +Example of an output before this patch: + +1) | ktime_get_real() { +1) 2.846 us | read_hpet(); +1) 4.558 us | } +1) 6.195 us | } + +After this patch: + +0) | ktime_get_real() { +0) | getnstimeofday() { +0) 1.960 us | read_hpet(); +0) 3.597 us | } +0) 5.196 us | } + +The fix also applies on 2.6.30 + +Signed-off-by: Lai Jiangshan +Cc: Steven Rostedt +LKML-Reference: <4A6EEC52.90704@cn.fujitsu.com> +Signed-off-by: Frederic Weisbecker +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/trace/trace.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +--- a/kernel/trace/trace.c ++++ b/kernel/trace/trace.c +@@ -2993,7 +2993,8 @@ tracing_fill_pipe_page(size_t rem, struc + break; + } + +- trace_consume(iter); ++ if (ret != TRACE_TYPE_NO_CONSUME) ++ trace_consume(iter); + rem -= count; + if (!find_next_entry_inc(iter)) { + rem = 0; +@@ -4122,8 +4123,11 @@ static void __ftrace_dump(bool disable_t + iter.pos = -1; + + if (find_next_entry_inc(&iter) != NULL) { +- print_trace_line(&iter); +- trace_consume(&iter); ++ int ret; ++ ++ ret = print_trace_line(&iter); ++ if (ret != TRACE_TYPE_NO_CONSUME) ++ trace_consume(&iter); + } + + trace_printk_seq(&iter.seq); + + +From gregkh@mini.kroah.org Thu Aug 13 12:51:29 2009 +Message-Id: <20090813195129.309168736@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Thu, 13 Aug 2009 12:50:07 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Michael Buesch , + Helge Deller +Subject: [patch 32/74] parisc: isa-eeprom - Fix loff_t usage +References: <20090813194935.985368088@mini.kroah.org> +Content-Disposition: inline; filename=parisc-isa-eeprom-fix-loff_t-usage.patch +Content-Length: 905 +Lines: 29 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Michael Buesch + +commit 6b4dbcd86a9d464057fcc7abe4d0574093071fcc upstream. + +loff_t is a signed type. If userspace passes a negative ppos, the "count" +range check is weakened. "count"s bigger than HPEE_MAX_LENGTH will pass the check. +Also, if ppos is negative, the readb(eisa_eeprom_addr + *ppos) will poke in random +memory. + +Signed-off-by: Michael Buesch +Signed-off-by: Helge Deller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/parisc/eisa_eeprom.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/parisc/eisa_eeprom.c ++++ b/drivers/parisc/eisa_eeprom.c +@@ -55,7 +55,7 @@ static ssize_t eisa_eeprom_read(struct f + ssize_t ret; + int i; + +- if (*ppos >= HPEE_MAX_LENGTH) ++ if (*ppos < 0 || *ppos >= HPEE_MAX_LENGTH) + return 0; + + count = *ppos + count < HPEE_MAX_LENGTH ? count : HPEE_MAX_LENGTH - *ppos; + + +From gregkh@mini.kroah.org Thu Aug 13 12:51:29 2009 +Message-Id: <20090813195129.458122866@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Thu, 13 Aug 2009 12:50:08 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Johannes Berg , + "John W. Linville" +Subject: [patch 33/74] cfg80211: add two missing NULL pointer checks +References: <20090813194935.985368088@mini.kroah.org> +Content-Disposition: inline; filename=cfg80211-add-two-missing-null-pointer-checks.patch +Content-Length: 1005 +Lines: 37 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Johannes Berg + +commit cd3468bad96c00b5a512f551674f36776129520e upstream. + +These pointers can be NULL, the is_mesh() case isn't +ever hit in the current kernel, but cmp_ies() can be +hit under certain conditions. + +Signed-off-by: Johannes Berg +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + net/wireless/scan.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/net/wireless/scan.c ++++ b/net/wireless/scan.c +@@ -118,7 +118,7 @@ static int cmp_ies(u8 num, u8 *ies1, siz + + if (!ie1 && !ie2) + return 0; +- if (!ie1) ++ if (!ie1 || !ie2) + return -1; + + r = memcmp(ie1 + 2, ie2 + 2, min(ie1[1], ie2[1])); +@@ -171,6 +171,8 @@ static bool is_mesh(struct cfg80211_bss + ie = find_ie(WLAN_EID_MESH_CONFIG, + a->information_elements, + a->len_information_elements); ++ if (!ie) ++ return false; + if (ie[1] != IEEE80211_MESH_CONFIG_LEN) + return false; + + + +From gregkh@mini.kroah.org Thu Aug 13 12:51:29 2009 +Message-Id: <20090813195129.603296702@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Thu, 13 Aug 2009 12:50:09 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Hiroshi Shimamoto , + Thomas Gleixner , + John Stultz , + Ingo Molnar +Subject: [patch 34/74] posix-timers: Fix oops in clock_nanosleep() with CLOCK_MONOTONIC_RAW +References: <20090813194935.985368088@mini.kroah.org> +Content-Disposition: inline; filename=posix-timers-fix-oops-in-clock_nanosleep-with-clock_monotonic_raw.patch +Content-Length: 1282 +Lines: 44 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Hiroshi Shimamoto + +commit 70d715fd0597f18528f389b5ac59102263067744 upstream. + +Prevent calling do_nanosleep() with clockid +CLOCK_MONOTONIC_RAW, it may cause oops, such as NULL pointer +dereference. + +Signed-off-by: Hiroshi Shimamoto +Cc: Andrew Morton +Cc: Thomas Gleixner +Cc: John Stultz +LKML-Reference: <4A764FF3.50607@ct.jp.nec.com> +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/posix-timers.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/kernel/posix-timers.c ++++ b/kernel/posix-timers.c +@@ -202,6 +202,12 @@ static int no_timer_create(struct k_itim + return -EOPNOTSUPP; + } + ++static int no_nsleep(const clockid_t which_clock, int flags, ++ struct timespec *tsave, struct timespec __user *rmtp) ++{ ++ return -EOPNOTSUPP; ++} ++ + /* + * Return nonzero if we know a priori this clockid_t value is bogus. + */ +@@ -254,6 +260,7 @@ static __init int init_posix_timers(void + .clock_get = posix_get_monotonic_raw, + .clock_set = do_posix_clock_nosettime, + .timer_create = no_timer_create, ++ .nsleep = no_nsleep, + }; + + register_posix_clock(CLOCK_REALTIME, &clock_realtime); + + +From gregkh@mini.kroah.org Thu Aug 13 12:51:29 2009 +Message-Id: <20090813195129.754915826@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Thu, 13 Aug 2009 12:50:10 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Bartlomiej Zolnierkiewicz , + Len Brown , + "Rafael J. Wysocki" +Subject: [patch 35/74] PM / ACPI: HP G7000 Notebook needs a SCI_EN resume quirk +References: <20090813194935.985368088@mini.kroah.org> +Content-Disposition: inline; filename=pm-acpi-hp-g7000-notebook-needs-a-sci_en-resume-quirk.patch +Content-Length: 1187 +Lines: 39 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Bartlomiej Zolnierkiewicz + +commit ec79be26875f6c1468784876cb99192b7f41c7a5 upstream. + +This fixes regression (battery "vanishing" on resume) introduced by +commit d0c71fe7ebc180f1b7bc7da1d39a07fc19eec768 ("ACPI Suspend: Enable +ACPI during resume if SCI_EN is not set") and also the issue with +the "screaming" IRQ 9. + +Fixes http://bugzilla.kernel.org/show_bug.cgi?id=13745 + +Reported-and-tested-by: Alan Jenkins +Signed-off-by: Bartlomiej Zolnierkiewicz +Acked-by: Len Brown +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/acpi/sleep.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/drivers/acpi/sleep.c ++++ b/drivers/acpi/sleep.c +@@ -397,6 +397,14 @@ static struct dmi_system_id __initdata a + }, + }, + { ++ .callback = init_set_sci_en_on_resume, ++ .ident = "Hewlett-Packard HP G7000 Notebook PC", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "HP G7000 Notebook PC"), ++ }, ++ }, ++ { + .callback = init_old_suspend_ordering, + .ident = "Panasonic CF51-2L", + .matches = { + + +From gregkh@mini.kroah.org Thu Aug 13 12:51:30 2009 +Message-Id: <20090813195129.901571614@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Thu, 13 Aug 2009 12:50:11 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Peter Korsgaard , + Kumar Gala +Subject: [patch 36/74] powerpc/mpc83xx: Fix usb mux setup for mpc834x +References: <20090813194935.985368088@mini.kroah.org> +Content-Disposition: inline; filename=powerpc-mpc83xx-fix-usb-mux-setup-for-mpc834x.patch +Content-Length: 4194 +Lines: 125 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Peter Korsgaard + +commit b7d66c88c968379ebe683a28c4005895497ebbad upstream. + +usb0 and usb1 mux settings in the sicrl register were swapped (twice!) +in mpc834x_usb_cfg(), leading to various strange issues with fsl-ehci +and full speed devices. + +The USB port config on mpc834x is done using 2 muxes: Port 0 is always +used for MPH port 0, and port 1 can either be used for MPH port 1 or DR +(unless DR uses UTMI phy or OTG, then it uses both ports) - See 8349 RM +figure 1-4.. + +mpc8349_usb_cfg() had this inverted for the DR, and it also had the bit +positions of the usb0 / usb1 mux settings swapped. It would basically +work if you specified port1 instead of port0 for the MPH controller (and +happened to use ULPI phys), which is what all the 834x dts have done, +even though that configuration is physically invalid. + +Instead fix mpc8349_usb_cfg() and adjust the dts files to match reality. + +Signed-off-by: Peter Korsgaard +Signed-off-by: Kumar Gala +Signed-off-by: Greg Kroah-Hartman + +--- + arch/powerpc/boot/dts/asp834x-redboot.dts | 2 +- + arch/powerpc/boot/dts/mpc8349emitx.dts | 2 +- + arch/powerpc/boot/dts/mpc834x_mds.dts | 2 +- + arch/powerpc/boot/dts/sbc8349.dts | 2 +- + arch/powerpc/platforms/83xx/mpc83xx.h | 4 ++-- + arch/powerpc/platforms/83xx/usb.c | 10 +++++----- + 6 files changed, 11 insertions(+), 11 deletions(-) + +--- a/arch/powerpc/boot/dts/asp834x-redboot.dts ++++ b/arch/powerpc/boot/dts/asp834x-redboot.dts +@@ -167,7 +167,7 @@ + interrupt-parent = <&ipic>; + interrupts = <39 0x8>; + phy_type = "ulpi"; +- port1; ++ port0; + }; + /* phy type (ULPI, UTMI, UTMI_WIDE, SERIAL) */ + usb@23000 { +--- a/arch/powerpc/boot/dts/mpc8349emitx.dts ++++ b/arch/powerpc/boot/dts/mpc8349emitx.dts +@@ -156,7 +156,7 @@ + interrupt-parent = <&ipic>; + interrupts = <39 0x8>; + phy_type = "ulpi"; +- port1; ++ port0; + }; + + usb@23000 { +--- a/arch/powerpc/boot/dts/mpc834x_mds.dts ++++ b/arch/powerpc/boot/dts/mpc834x_mds.dts +@@ -153,7 +153,7 @@ + interrupt-parent = <&ipic>; + interrupts = <39 0x8>; + phy_type = "ulpi"; +- port1; ++ port0; + }; + /* phy type (ULPI, UTMI, UTMI_WIDE, SERIAL) */ + usb@23000 { +--- a/arch/powerpc/boot/dts/sbc8349.dts ++++ b/arch/powerpc/boot/dts/sbc8349.dts +@@ -144,7 +144,7 @@ + interrupt-parent = <&ipic>; + interrupts = <39 0x8>; + phy_type = "ulpi"; +- port1; ++ port0; + }; + /* phy type (ULPI, UTMI, UTMI_WIDE, SERIAL) */ + usb@23000 { +--- a/arch/powerpc/platforms/83xx/mpc83xx.h ++++ b/arch/powerpc/platforms/83xx/mpc83xx.h +@@ -22,8 +22,8 @@ + /* system i/o configuration register low */ + #define MPC83XX_SICRL_OFFS 0x114 + #define MPC834X_SICRL_USB_MASK 0x60000000 +-#define MPC834X_SICRL_USB0 0x40000000 +-#define MPC834X_SICRL_USB1 0x20000000 ++#define MPC834X_SICRL_USB0 0x20000000 ++#define MPC834X_SICRL_USB1 0x40000000 + #define MPC831X_SICRL_USB_MASK 0x00000c00 + #define MPC831X_SICRL_USB_ULPI 0x00000800 + #define MPC8315_SICRL_USB_MASK 0x000000fc +--- a/arch/powerpc/platforms/83xx/usb.c ++++ b/arch/powerpc/platforms/83xx/usb.c +@@ -47,25 +47,25 @@ int mpc834x_usb_cfg(void) + sccr |= MPC83XX_SCCR_USB_DRCM_11; /* 1:3 */ + + prop = of_get_property(np, "phy_type", NULL); ++ port1_is_dr = 1; + if (prop && (!strcmp(prop, "utmi") || + !strcmp(prop, "utmi_wide"))) { + sicrl |= MPC834X_SICRL_USB0 | MPC834X_SICRL_USB1; + sicrh |= MPC834X_SICRH_USB_UTMI; +- port1_is_dr = 1; ++ port0_is_dr = 1; + } else if (prop && !strcmp(prop, "serial")) { + dr_mode = of_get_property(np, "dr_mode", NULL); + if (dr_mode && !strcmp(dr_mode, "otg")) { + sicrl |= MPC834X_SICRL_USB0 | MPC834X_SICRL_USB1; +- port1_is_dr = 1; ++ port0_is_dr = 1; + } else { +- sicrl |= MPC834X_SICRL_USB0; ++ sicrl |= MPC834X_SICRL_USB1; + } + } else if (prop && !strcmp(prop, "ulpi")) { +- sicrl |= MPC834X_SICRL_USB0; ++ sicrl |= MPC834X_SICRL_USB1; + } else { + printk(KERN_WARNING "834x USB PHY type not supported\n"); + } +- port0_is_dr = 1; + of_node_put(np); + } + np = of_find_compatible_node(NULL, NULL, "fsl-usb2-mph"); + + +From gregkh@mini.kroah.org Thu Aug 13 12:51:30 2009 +Message-Id: <20090813195130.073928863@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Thu, 13 Aug 2009 12:50:12 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Eric Sandeen , + Andi Kleen , + William Lee Irwin III +Subject: [patch 37/74] hugetlbfs: fix i_blocks accounting +References: <20090813194935.985368088@mini.kroah.org> +Content-Disposition: inline; filename=hugetlbfs-fix-i_blocks-accounting.patch +Content-Length: 1694 +Lines: 52 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Eric Sandeen + +commit e4c6f8bed01f9f9a5c607bd689bf67e7b8a36bd8 upstream. + +As reported in Red Hat bz #509671, i_blocks for files on hugetlbfs get +accounting wrong when doing something like: + + $ > foo + $ date > foo + date: write error: Invalid argument + $ /usr/bin/stat foo + File: `foo' + Size: 0 Blocks: 18446744073709547520 IO Block: 2097152 regular +... + +This is because hugetlb_unreserve_pages() is unconditionally removing +blocks_per_huge_page(h) on each call rather than using the freed amount. +If there were 0 blocks, it goes negative, resulting in the above. + +This is a regression from commit a5516438959d90b071ff0a484ce4f3f523dc3152 +("hugetlb: modular state for hugetlb page size") + +which did: + +- inode->i_blocks -= BLOCKS_PER_HUGEPAGE * freed; ++ inode->i_blocks -= blocks_per_huge_page(h); + +so just put back the freed multiplier, and it's all happy again. + +Signed-off-by: Eric Sandeen +Acked-by: Andi Kleen +Cc: William Lee Irwin III +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/hugetlb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/mm/hugetlb.c ++++ b/mm/hugetlb.c +@@ -2341,7 +2341,7 @@ void hugetlb_unreserve_pages(struct inod + long chg = region_truncate(&inode->i_mapping->private_list, offset); + + spin_lock(&inode->i_lock); +- inode->i_blocks -= blocks_per_huge_page(h); ++ inode->i_blocks -= (blocks_per_huge_page(h) * freed); + spin_unlock(&inode->i_lock); + + hugetlb_put_quota(inode->i_mapping, (chg - freed)); + + +From gregkh@mini.kroah.org Thu Aug 13 12:51:30 2009 +Message-Id: <20090813195130.226828111@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Thu, 13 Aug 2009 12:50:13 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Mel Gorman , + KAMEZAWA Hiroyuki +Subject: [patch 38/74] page-allocator: preserve PFN ordering when __GFP_COLD is set +References: <20090813194935.985368088@mini.kroah.org> +Content-Disposition: inline; filename=page-allocator-preserve-pfn-ordering-when-__gfp_cold-is-set.patch +Content-Length: 2727 +Lines: 79 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Mel Gorman + +commit e084b2d95e48b31aa45f9c49ffc6cdae8bdb21d4 upstream. + +Fix a post-2.6.24 performace regression caused by +3dfa5721f12c3d5a441448086bee156887daa961 ("page-allocator: preserve PFN +ordering when __GFP_COLD is set"). + +Narayanan reports "The regression is around 15%. There is no disk controller +as our setup is based on Samsung OneNAND used as a memory mapped device on a +OMAP2430 based board." + +The page allocator tries to preserve contiguous PFN ordering when returning +pages such that repeated callers to the allocator have a strong chance of +getting physically contiguous pages, particularly when external fragmentation +is low. However, of the bulk of the allocations have __GFP_COLD set as they +are due to aio_read() for example, then the PFNs are in reverse PFN order. +This can cause performance degration when used with IO controllers that could +have merged the requests. + +This patch attempts to preserve the contiguous ordering of PFNs for users of +__GFP_COLD. + +Signed-off-by: Mel Gorman +Reported-by: Narayananu Gopalakrishnan +Tested-by: Narayanan Gopalakrishnan +Cc: KAMEZAWA Hiroyuki +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/page_alloc.c | 13 +++++++++---- + 1 file changed, 9 insertions(+), 4 deletions(-) + +--- a/mm/page_alloc.c ++++ b/mm/page_alloc.c +@@ -858,7 +858,7 @@ static struct page *__rmqueue(struct zon + */ + static int rmqueue_bulk(struct zone *zone, unsigned int order, + unsigned long count, struct list_head *list, +- int migratetype) ++ int migratetype, int cold) + { + int i; + +@@ -877,7 +877,10 @@ static int rmqueue_bulk(struct zone *zon + * merge IO requests if the physical pages are ordered + * properly. + */ +- list_add(&page->lru, list); ++ if (likely(cold == 0)) ++ list_add(&page->lru, list); ++ else ++ list_add_tail(&page->lru, list); + set_page_private(page, migratetype); + list = &page->lru; + } +@@ -1077,7 +1080,8 @@ again: + local_irq_save(flags); + if (!pcp->count) { + pcp->count = rmqueue_bulk(zone, 0, +- pcp->batch, &pcp->list, migratetype); ++ pcp->batch, &pcp->list, ++ migratetype, cold); + if (unlikely(!pcp->count)) + goto failed; + } +@@ -1096,7 +1100,8 @@ again: + /* Allocate more to the pcp list if necessary */ + if (unlikely(&page->lru == &pcp->list)) { + pcp->count += rmqueue_bulk(zone, 0, +- pcp->batch, &pcp->list, migratetype); ++ pcp->batch, &pcp->list, ++ migratetype, cold); + page = list_entry(pcp->list.next, struct page, lru); + } + + + +From gregkh@mini.kroah.org Thu Aug 13 12:51:30 2009 +Message-Id: <20090813195130.384492696@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Thu, 13 Aug 2009 12:50:14 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Thomas Hellstrom , + Suresh Siddha , + dri-devel@lists.sourceforge.net, + venkatesh.pallipadi@intel.com, + Ingo Molnar +Subject: [patch 39/74] x86: Fix CPA memtype reserving in the set_pages_array*() cases +References: <20090813194935.985368088@mini.kroah.org> +Content-Disposition: inline; filename=x86-fix-cpa-memtype-reserving-in-the-set_pages_array-cases.patch +Content-Length: 3166 +Lines: 94 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Thomas Hellstrom + +commit 8523acfe40efc1a8d3da8f473ca67cb195b06f0c upstream. + +The code was incorrectly reserving memtypes using the page +virtual address instead of the physical address. Furthermore, +the code was not ignoring highmem pages as it ought to. + +( upstream does not pass in highmem pages yet - but upcoming + graphics code will do it and there's no reason to not handle + this properly in the CPA APIs.) + +Fixes: http://bugzilla.kernel.org/show_bug.cgi?id=13884 + +Signed-off-by: Thomas Hellstrom +Acked-by: Suresh Siddha +Cc: dri-devel@lists.sourceforge.net +Cc: venkatesh.pallipadi@intel.com +LKML-Reference: <1249284345-7654-1-git-send-email-thellstrom@vmware.com> +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/mm/pageattr.c | 30 +++++++++++++++++++++--------- + 1 file changed, 21 insertions(+), 9 deletions(-) + +--- a/arch/x86/mm/pageattr.c ++++ b/arch/x86/mm/pageattr.c +@@ -590,9 +590,12 @@ static int __change_page_attr(struct cpa + unsigned int level; + pte_t *kpte, old_pte; + +- if (cpa->flags & CPA_PAGES_ARRAY) +- address = (unsigned long)page_address(cpa->pages[cpa->curpage]); +- else if (cpa->flags & CPA_ARRAY) ++ if (cpa->flags & CPA_PAGES_ARRAY) { ++ struct page *page = cpa->pages[cpa->curpage]; ++ if (unlikely(PageHighMem(page))) ++ return 0; ++ address = (unsigned long)page_address(page); ++ } else if (cpa->flags & CPA_ARRAY) + address = cpa->vaddr[cpa->curpage]; + else + address = *cpa->vaddr; +@@ -695,9 +698,12 @@ static int cpa_process_alias(struct cpa_ + * No need to redo, when the primary call touched the direct + * mapping already: + */ +- if (cpa->flags & CPA_PAGES_ARRAY) +- vaddr = (unsigned long)page_address(cpa->pages[cpa->curpage]); +- else if (cpa->flags & CPA_ARRAY) ++ if (cpa->flags & CPA_PAGES_ARRAY) { ++ struct page *page = cpa->pages[cpa->curpage]; ++ if (unlikely(PageHighMem(page))) ++ return 0; ++ vaddr = (unsigned long)page_address(page); ++ } else if (cpa->flags & CPA_ARRAY) + vaddr = cpa->vaddr[cpa->curpage]; + else + vaddr = *cpa->vaddr; +@@ -1118,7 +1124,9 @@ int set_pages_array_uc(struct page **pag + int free_idx; + + for (i = 0; i < addrinarray; i++) { +- start = (unsigned long)page_address(pages[i]); ++ if (PageHighMem(pages[i])) ++ continue; ++ start = page_to_pfn(pages[i]) << PAGE_SHIFT; + end = start + PAGE_SIZE; + if (reserve_memtype(start, end, _PAGE_CACHE_UC_MINUS, NULL)) + goto err_out; +@@ -1131,7 +1139,9 @@ int set_pages_array_uc(struct page **pag + err_out: + free_idx = i; + for (i = 0; i < free_idx; i++) { +- start = (unsigned long)page_address(pages[i]); ++ if (PageHighMem(pages[i])) ++ continue; ++ start = page_to_pfn(pages[i]) << PAGE_SHIFT; + end = start + PAGE_SIZE; + free_memtype(start, end); + } +@@ -1160,7 +1170,9 @@ int set_pages_array_wb(struct page **pag + return retval; + + for (i = 0; i < addrinarray; i++) { +- start = (unsigned long)page_address(pages[i]); ++ if (PageHighMem(pages[i])) ++ continue; ++ start = page_to_pfn(pages[i]) << PAGE_SHIFT; + end = start + PAGE_SIZE; + free_memtype(start, end); + } + + +From gregkh@mini.kroah.org Thu Aug 13 12:51:30 2009 +Message-Id: <20090813195130.514363745@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Thu, 13 Aug 2009 12:50:15 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + "H. Peter Anvin" +Subject: [patch 40/74] x86: fix assembly constraints in native_save_fl() +References: <20090813194935.985368088@mini.kroah.org> +Content-Disposition: inline; filename=x86-fix-assembly-constraints-in-native_save_fl.patch +Content-Length: 1966 +Lines: 60 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: H. Peter Anvin + +commit f1f029c7bfbf4ee1918b90a431ab823bed812504 upstream. + +>From Gabe Black in bugzilla 13888: + +native_save_fl is implemented as follows: + + 11static inline unsigned long native_save_fl(void) + 12{ + 13 unsigned long flags; + 14 + 15 asm volatile("# __raw_save_flags\n\t" + 16 "pushf ; pop %0" + 17 : "=g" (flags) + 18 : /* no input */ + 19 : "memory"); + 20 + 21 return flags; + 22} + +If gcc chooses to put flags on the stack, for instance because this is +inlined into a larger function with more register pressure, the offset +of the flags variable from the stack pointer will change when the +pushf is performed. gcc doesn't attempt to understand that fact, and +address used for pop will still be the same. It will write to +somewhere near flags on the stack but not actually into it and +overwrite some other value. + +I saw this happen in the ide_device_add_all function when running in a +simulator I work on. I'm assuming that some quirk of how the simulated +hardware is set up caused the code path this is on to be executed when +it normally wouldn't. + +A simple fix might be to change "=g" to "=r". + +Reported-by: Gabe Black +Signed-off-by: H. Peter Anvin +Signed-off-by: Greg Kroah-Hartman + +--- a/arch/x86/include/asm/irqflags.h ++++ b/arch/x86/include/asm/irqflags.h +@@ -12,9 +12,15 @@ static inline unsigned long native_save_fl(void) + { + unsigned long flags; + ++ /* ++ * Note: this needs to be "=r" not "=rm", because we have the ++ * stack offset from what gcc expects at the time the "pop" is ++ * executed, and so a memory reference with respect to the stack ++ * would end up using the wrong address. ++ */ + asm volatile("# __raw_save_flags\n\t" + "pushf ; pop %0" +- : "=g" (flags) ++ : "=r" (flags) + : /* no input */ + : "memory"); + + + +From gregkh@mini.kroah.org Thu Aug 13 12:51:30 2009 +Message-Id: <20090813195130.664882602@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Thu, 13 Aug 2009 12:50:16 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Venkatesh Pallipadi , + Suresh Siddha , + Dave Airlie , + "H. Peter Anvin" +Subject: [patch 41/74] x86, pat: Fix set_memory_wc related corruption +References: <20090813194935.985368088@mini.kroah.org> +Content-Disposition: inline; filename=x86-pat-fix-set_memory_wc-related-corruption.patch +Content-Length: 2501 +Lines: 63 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Pallipadi, Venkatesh + +commit bdc6340f4eb68295b1e7c0ade2356b56dca93d93 upstream. + +Changeset 3869c4aa18835c8c61b44bd0f3ace36e9d3b5bd0 +that went in after 2.6.30-rc1 was a seemingly small change to _set_memory_wc() +to make it complaint with SDM requirements. But, introduced a nasty bug, which +can result in crash and/or strange corruptions when set_memory_wc is used. +One such crash reported here +http://lkml.org/lkml/2009/7/30/94 + +Actually, that changeset introduced two bugs. +* change_page_attr_set() takes &addr as first argument and can the addr value + might have changed on return, even for single page change_page_attr_set() + call. That will make the second change_page_attr_set() in this routine + operate on unrelated addr, that can eventually cause strange corruptions + and bad page state crash. +* The second change_page_attr_set() call, before setting _PAGE_CACHE_WC, should + clear the earlier _PAGE_CACHE_UC_MINUS, as otherwise cache attribute will not + be WC (will be UC instead). + +The patch below fixes both these problems. Sending a single patch to fix both +the problems, as the change is to the same line of code. The change to have a +addr_copy is not very clean. But, it is simpler than making more changes +through various routines in pageattr.c. + +A huge thanks to Jerome for reporting this problem and providing a simple test +case that helped us root cause the problem. + +Reported-by: Jerome Glisse +Signed-off-by: Venkatesh Pallipadi +Signed-off-by: Suresh Siddha +LKML-Reference: <20090730214319.GA1889@linux-os.sc.intel.com> +Acked-by: Dave Airlie +Signed-off-by: H. Peter Anvin +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/mm/pageattr.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +--- a/arch/x86/mm/pageattr.c ++++ b/arch/x86/mm/pageattr.c +@@ -1002,12 +1002,15 @@ EXPORT_SYMBOL(set_memory_array_uc); + int _set_memory_wc(unsigned long addr, int numpages) + { + int ret; ++ unsigned long addr_copy = addr; ++ + ret = change_page_attr_set(&addr, numpages, + __pgprot(_PAGE_CACHE_UC_MINUS), 0); +- + if (!ret) { +- ret = change_page_attr_set(&addr, numpages, +- __pgprot(_PAGE_CACHE_WC), 0); ++ ret = change_page_attr_set_clr(&addr_copy, numpages, ++ __pgprot(_PAGE_CACHE_WC), ++ __pgprot(_PAGE_CACHE_MASK), ++ 0, 0, NULL); + } + return ret; + } + + +From gregkh@mini.kroah.org Thu Aug 13 12:51:30 2009 +Message-Id: <20090813195130.818923467@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Thu, 13 Aug 2009 12:50:17 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Dan Williams , + NeilBrown +Subject: [patch 42/74] md/raid6: release spare page at ->stop() +References: <20090813194935.985368088@mini.kroah.org> +Content-Disposition: inline; filename=md-raid6-release-spare-page-at-stop.patch +Content-Length: 2049 +Lines: 76 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Dan Williams + +commit 95fc17aac45300f45968aacd97a536ddd8db8101 upstream. + +Add missing call to safe_put_page from stop() by unifying open coded +raid5_conf_t de-allocation under free_conf(). + +Signed-off-by: Dan Williams +Signed-off-by: NeilBrown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/raid5.c | 26 ++++++++++++-------------- + 1 file changed, 12 insertions(+), 14 deletions(-) + +--- a/drivers/md/raid5.c ++++ b/drivers/md/raid5.c +@@ -4310,6 +4310,15 @@ raid5_size(mddev_t *mddev, sector_t sect + return sectors * (raid_disks - conf->max_degraded); + } + ++static void free_conf(raid5_conf_t *conf) ++{ ++ shrink_stripes(conf); ++ safe_put_page(conf->spare_page); ++ kfree(conf->disks); ++ kfree(conf->stripe_hashtbl); ++ kfree(conf); ++} ++ + static raid5_conf_t *setup_conf(mddev_t *mddev) + { + raid5_conf_t *conf; +@@ -4439,11 +4448,7 @@ static raid5_conf_t *setup_conf(mddev_t + + abort: + if (conf) { +- shrink_stripes(conf); +- safe_put_page(conf->spare_page); +- kfree(conf->disks); +- kfree(conf->stripe_hashtbl); +- kfree(conf); ++ free_conf(conf); + return ERR_PTR(-EIO); + } else + return ERR_PTR(-ENOMEM); +@@ -4609,12 +4614,8 @@ abort: + md_unregister_thread(mddev->thread); + mddev->thread = NULL; + if (conf) { +- shrink_stripes(conf); + print_raid5_conf(conf); +- safe_put_page(conf->spare_page); +- kfree(conf->disks); +- kfree(conf->stripe_hashtbl); +- kfree(conf); ++ free_conf(conf); + } + mddev->private = NULL; + printk(KERN_ALERT "raid5: failed to run raid set %s\n", mdname(mddev)); +@@ -4629,13 +4630,10 @@ static int stop(mddev_t *mddev) + + md_unregister_thread(mddev->thread); + mddev->thread = NULL; +- shrink_stripes(conf); +- kfree(conf->stripe_hashtbl); + mddev->queue->backing_dev_info.congested_fn = NULL; + blk_sync_queue(mddev->queue); /* the unplug fn references 'conf'*/ + sysfs_remove_group(&mddev->kobj, &raid5_attrs_group); +- kfree(conf->disks); +- kfree(conf); ++ free_conf(conf); + mddev->private = NULL; + return 0; + } + + +From gregkh@mini.kroah.org Thu Aug 13 12:51:31 2009 +Message-Id: <20090813195130.963233083@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Thu, 13 Aug 2009 12:50:18 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + NeilBrown +Subject: [patch 43/74] md: when a level change reduces the number of devices, remove the excess. +References: <20090813194935.985368088@mini.kroah.org> +Content-Disposition: inline; filename=md-when-a-level-change-reduces-the-number-of-devices-remove-the-excess.patch +Content-Length: 1229 +Lines: 41 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: NeilBrown + +commit 3a981b03f38dc3b8a69b77cbc679e66c1318a44a upstream. + +When an array is changed from RAID6 to RAID5, fewer drives are +needed. So any device that is made superfluous by the level +conversion must be marked as not-active. +For the RAID6->RAID5 conversion, this will be a drive which only +has 'Q' blocks on it. + +Signed-off-by: NeilBrown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/md.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/md/md.c ++++ b/drivers/md/md.c +@@ -2680,6 +2680,7 @@ level_store(mddev_t *mddev, const char * + ssize_t rv = len; + struct mdk_personality *pers; + void *priv; ++ mdk_rdev_t *rdev; + + if (mddev->pers == NULL) { + if (len == 0) +@@ -2759,6 +2760,12 @@ level_store(mddev_t *mddev, const char * + mddev_suspend(mddev); + mddev->pers->stop(mddev); + module_put(mddev->pers->owner); ++ /* Invalidate devices that are now superfluous */ ++ list_for_each_entry(rdev, &mddev->disks, same_set) ++ if (rdev->raid_disk >= mddev->raid_disks) { ++ rdev->raid_disk = -1; ++ clear_bit(In_sync, &rdev->flags); ++ } + mddev->pers = pers; + mddev->private = priv; + strlcpy(mddev->clevel, pers->name, sizeof(mddev->clevel)); + + +From gregkh@mini.kroah.org Thu Aug 13 12:51:31 2009 +Message-Id: <20090813195131.095567787@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Thu, 13 Aug 2009 12:50:19 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Bartlomiej Zolnierkiewicz , + "David S. Miller" +Subject: [patch 44/74] ide: fix handling of unexpected IRQs vs request_irq() +References: <20090813194935.985368088@mini.kroah.org> +Content-Disposition: inline; filename=ide-fix-handling-of-unexpected-irqs-vs-request_irq.patch +Content-Length: 1917 +Lines: 70 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Bartlomiej Zolnierkiewicz + +commit ffc36c7610731115c77700dcc53901920361c235 upstream. + +Add ide_host_enable_irqs() helper and use it in ide_host_register() +before registering ports. Then remove no longer needed IRQ unmasking +from in init_irq(). + +This should fix the problem with "screaming" shared IRQ on the first +port (after request_irq() call while we have the unexpected IRQ pending +on the second port) which was uncovered by my rework of the serialized +interfaces support. + +Reported-by: Frans Pop +Tested-by: Frans Pop +Signed-off-by: Bartlomiej Zolnierkiewicz +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ide/ide-probe.c | 23 ++++++++++++++++++++--- + 1 file changed, 20 insertions(+), 3 deletions(-) + +--- a/drivers/ide/ide-probe.c ++++ b/drivers/ide/ide-probe.c +@@ -830,6 +830,24 @@ static int ide_port_setup_devices(ide_hw + return j; + } + ++static void ide_host_enable_irqs(struct ide_host *host) ++{ ++ ide_hwif_t *hwif; ++ int i; ++ ++ ide_host_for_each_port(i, hwif, host) { ++ if (hwif == NULL) ++ continue; ++ ++ /* clear any pending IRQs */ ++ hwif->tp_ops->read_status(hwif); ++ ++ /* unmask IRQs */ ++ if (hwif->io_ports.ctl_addr) ++ hwif->tp_ops->write_devctl(hwif, ATA_DEVCTL_OBS); ++ } ++} ++ + /* + * This routine sets up the IRQ for an IDE interface. + */ +@@ -843,9 +861,6 @@ static int init_irq (ide_hwif_t *hwif) + if (irq_handler == NULL) + irq_handler = ide_intr; + +- if (io_ports->ctl_addr) +- hwif->tp_ops->write_devctl(hwif, ATA_DEVCTL_OBS); +- + if (request_irq(hwif->irq, irq_handler, sa, hwif->name, hwif)) + goto out_up; + +@@ -1389,6 +1404,8 @@ int ide_host_register(struct ide_host *h + ide_port_tune_devices(hwif); + } + ++ ide_host_enable_irqs(host); ++ + ide_host_for_each_port(i, hwif, host) { + if (hwif == NULL) + continue; + + +From gregkh@mini.kroah.org Thu Aug 13 12:51:31 2009 +Message-Id: <20090813195131.225373807@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Thu, 13 Aug 2009 12:50:20 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Bartlomiej Zolnierkiewicz , + "David S. Miller" +Subject: [patch 45/74] ide: relax DMA info validity checking +References: <20090813194935.985368088@mini.kroah.org> +Content-Disposition: inline; filename=ide-relax-dma-info-validity-checking.patch +Content-Length: 3027 +Lines: 96 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Bartlomiej Zolnierkiewicz + +commit 346c17a6cf60375323adfaa4b8a9d841049f890e upstream. + +There are some broken devices that report multiple DMA xfer modes +enabled at once (ATA spec doesn't allow it) but otherwise work fine +with DMA so just delete ide_id_dma_bug(). + +[ As discovered by detective work by Frans and Bart, due to how + handling of the ID block was handled before commit c419993 + ("ide-iops: only clear DMA words on setting DMA mode") this + check was always seeing zeros in the fields or other similar + garbage. Therefore this check wasn't actually checking anything. + Now that the tests actually check the real bits, all we see are + devices that trigger the check yet work perfectly fine, therefore + killing this useless check is the best thing to do. -DaveM ] + +Reported-by: Frans Pop +Signed-off-by: Bartlomiej Zolnierkiewicz +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ide/ide-dma.c | 21 --------------------- + drivers/ide/ide-iops.c | 3 --- + include/linux/ide.h | 2 -- + 3 files changed, 26 deletions(-) + +--- a/drivers/ide/ide-dma.c ++++ b/drivers/ide/ide-dma.c +@@ -362,9 +362,6 @@ static int ide_tune_dma(ide_drive_t *dri + if (__ide_dma_bad_drive(drive)) + return 0; + +- if (ide_id_dma_bug(drive)) +- return 0; +- + if (hwif->host_flags & IDE_HFLAG_TRUST_BIOS_FOR_DMA) + return config_drive_for_dma(drive); + +@@ -395,24 +392,6 @@ static int ide_dma_check(ide_drive_t *dr + return -1; + } + +-int ide_id_dma_bug(ide_drive_t *drive) +-{ +- u16 *id = drive->id; +- +- if (id[ATA_ID_FIELD_VALID] & 4) { +- if ((id[ATA_ID_UDMA_MODES] >> 8) && +- (id[ATA_ID_MWDMA_MODES] >> 8)) +- goto err_out; +- } else if ((id[ATA_ID_MWDMA_MODES] >> 8) && +- (id[ATA_ID_SWDMA_MODES] >> 8)) +- goto err_out; +- +- return 0; +-err_out: +- printk(KERN_ERR "%s: bad DMA info in identify block\n", drive->name); +- return 1; +-} +- + int ide_set_dma(ide_drive_t *drive) + { + int rc; +--- a/drivers/ide/ide-iops.c ++++ b/drivers/ide/ide-iops.c +@@ -306,9 +306,6 @@ int ide_driveid_update(ide_drive_t *driv + + kfree(id); + +- if ((drive->dev_flags & IDE_DFLAG_USING_DMA) && ide_id_dma_bug(drive)) +- ide_dma_off(drive); +- + return 1; + out_err: + SELECT_MASK(drive, 0); +--- a/include/linux/ide.h ++++ b/include/linux/ide.h +@@ -1384,7 +1384,6 @@ int ide_in_drive_list(u16 *, const struc + #ifdef CONFIG_BLK_DEV_IDEDMA + int ide_dma_good_drive(ide_drive_t *); + int __ide_dma_bad_drive(ide_drive_t *); +-int ide_id_dma_bug(ide_drive_t *); + + u8 ide_find_dma_mode(ide_drive_t *, u8); + +@@ -1425,7 +1424,6 @@ void ide_dma_lost_irq(ide_drive_t *); + ide_startstop_t ide_dma_timeout_retry(ide_drive_t *, int); + + #else +-static inline int ide_id_dma_bug(ide_drive_t *drive) { return 0; } + static inline u8 ide_find_dma_mode(ide_drive_t *drive, u8 speed) { return 0; } + static inline u8 ide_max_dma_mode(ide_drive_t *drive) { return 0; } + static inline void ide_dma_off_quietly(ide_drive_t *drive) { ; } + + +From gregkh@mini.kroah.org Thu Aug 13 12:51:31 2009 +Message-Id: <20090813195131.386899357@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Thu, 13 Aug 2009 12:50:21 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Luca Tettamanti , + Jean Delvare +Subject: [patch 46/74] hwmon: (asus_atk0110) Fix upper limit readings +References: <20090813194935.985368088@mini.kroah.org> +Content-Disposition: inline; filename=hwmon-fix-upper-limit-readings.patch +Content-Length: 1133 +Lines: 33 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Luca Tettamanti + +commit 8d282497cbf8124d6814d51a74fb13d69531c669 upstream. + +On newer Asus boards the "upper" limit of a sensor is encoded as +delta from the "lower" limit. Fix the driver to correctly handle +this case. + +Signed-off-by: Luca Tettamanti +Tested-by: Alex Macfarlane Smith +Signed-off-by: Jean Delvare +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwmon/asus_atk0110.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/drivers/hwmon/asus_atk0110.c ++++ b/drivers/hwmon/asus_atk0110.c +@@ -593,7 +593,11 @@ static int atk_add_sensor(struct atk_dat + sensor->data = data; + sensor->id = flags->integer.value; + sensor->limit1 = limit1->integer.value; +- sensor->limit2 = limit2->integer.value; ++ if (data->old_interface) ++ sensor->limit2 = limit2->integer.value; ++ else ++ /* The upper limit is expressed as delta from lower limit */ ++ sensor->limit2 = sensor->limit1 + limit2->integer.value; + + snprintf(sensor->input_attr_name, ATTR_NAME_SIZE, + "%s%d_input", base_name, start + *num); + + +From gregkh@mini.kroah.org Thu Aug 13 12:51:31 2009 +Message-Id: <20090813195131.532954238@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Thu, 13 Aug 2009 12:50:22 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jean Delvare , + Juerg Haefliger , + Hans de Goede +Subject: [patch 47/74] hwmon: (smsc47m1) Differentiate between LPC47M233 and LPC47M292 +References: <20090813194935.985368088@mini.kroah.org> +Content-Disposition: inline; filename=hwmon-differentiate-between-lpc47m233-and-lpc47m292.patch +Content-Length: 1510 +Lines: 51 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Jean Delvare + +commit 1b54ab450b180eaeeb0eee6f0f64349246a22c14 upstream. + +The SMSC LPC47M233 and LPC47M292 chips have the same device ID but +are not compatible. + +Signed-off-by: Jean Delvare +Cc: Juerg Haefliger +Acked-by: Hans de Goede +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwmon/smsc47m1.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +--- a/drivers/hwmon/smsc47m1.c ++++ b/drivers/hwmon/smsc47m1.c +@@ -86,6 +86,7 @@ superio_exit(void) + #define SUPERIO_REG_ACT 0x30 + #define SUPERIO_REG_BASE 0x60 + #define SUPERIO_REG_DEVID 0x20 ++#define SUPERIO_REG_DEVREV 0x21 + + /* Logical device registers */ + +@@ -429,6 +430,9 @@ static int __init smsc47m1_find(unsigned + * The LPC47M292 (device id 0x6B) is somewhat compatible, but it + * supports a 3rd fan, and the pin configuration registers are + * unfortunately different. ++ * The LPC47M233 has the same device id (0x6B) but is not compatible. ++ * We check the high bit of the device revision register to ++ * differentiate them. + */ + switch (val) { + case 0x51: +@@ -448,6 +452,13 @@ static int __init smsc47m1_find(unsigned + sio_data->type = smsc47m1; + break; + case 0x6B: ++ if (superio_inb(SUPERIO_REG_DEVREV) & 0x80) { ++ pr_debug(DRVNAME ": " ++ "Found SMSC LPC47M233, unsupported\n"); ++ superio_exit(); ++ return -ENODEV; ++ } ++ + pr_info(DRVNAME ": Found SMSC LPC47M292\n"); + sio_data->type = smsc47m2; + break; + + +From gregkh@mini.kroah.org Thu Aug 13 12:51:31 2009 +Message-Id: <20090813195131.678614026@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Thu, 13 Aug 2009 12:50:23 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Michele Jr De Candia , + Rodolfo Giometti , + Jean Delvare +Subject: [patch 48/74] i2c/tsl2550: Fix lux value in dark environment +References: <20090813194935.985368088@mini.kroah.org> +Content-Disposition: inline; filename=i2c-tsl2550-fix-lux-value-in-dark-environment.patch +Content-Length: 1399 +Lines: 51 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Michele Jr De Candia + +commit 96f699ad09c8b3c55cd229506a9add0047838e3e upstream. + +I've tested TSL2550 driver and I've found a bug: when light is off, +returned value from tsl2550_calculate_lux function is -1 when it should +be 0 (sensor correctly read that light was off). + +I think the bug is that a zero c0 value (approximated value of ch0) is +misinterpreted as an error. + +Signed-off-by: Michele Jr De Candia +Acked-by: Rodolfo Giometti +Signed-off-by: Jean Delvare +Signed-off-by: Greg Kroah-Hartman + +--- a/drivers/i2c/chips/tsl2550.c ++++ b/drivers/i2c/chips/tsl2550.c +@@ -27,7 +27,7 @@ + #include + + #define TSL2550_DRV_NAME "tsl2550" +-#define DRIVER_VERSION "1.1.1" ++#define DRIVER_VERSION "1.1.2" + + /* + * Defines +@@ -189,13 +189,16 @@ static int tsl2550_calculate_lux(u8 ch0, u8 ch1) + u8 r = 128; + + /* Avoid division by 0 and count 1 cannot be greater than count 0 */ +- if (c0 && (c1 <= c0)) +- r = c1 * 128 / c0; ++ if (c1 <= c0) ++ if (c0) { ++ r = c1 * 128 / c0; ++ ++ /* Calculate LUX */ ++ lux = ((c0 - c1) * ratio_lut[r]) / 256; ++ } else ++ lux = 0; + else +- return -1; +- +- /* Calculate LUX */ +- lux = ((c0 - c1) * ratio_lut[r]) / 256; ++ return -EAGAIN; + + /* LUX range check */ + return lux > TSL2550_MAX_LUX ? TSL2550_MAX_LUX : lux; + + +From gregkh@mini.kroah.org Thu Aug 13 12:51:31 2009 +Message-Id: <20090813195131.830210237@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Thu, 13 Aug 2009 12:50:24 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Stefan Richter +Subject: [patch 49/74] firewire: sbp2: add support for disks >2 TB (and 16 bytes long CDBs) +References: <20090813194935.985368088@mini.kroah.org> +Content-Disposition: inline; filename=firewire-sbp2-add-support-for-disks-2-tb.patch +Content-Length: 1634 +Lines: 50 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Stefan Richter + +Commit af2719415a5ceae06f2a6d33e78b555e64697fc8 upstream. + +Increase the command ORB data structure to transport up to 16 bytes long +CDBs (instead of 12 bytes), and tell the SCSI mid layer about it. This +is notably necessary for READ CAPACITY(16) and friends, i.e. support of +large disks. + +Signed-off-by: Stefan Richter +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/firewire/fw-sbp2.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +--- a/drivers/firewire/fw-sbp2.c ++++ b/drivers/firewire/fw-sbp2.c +@@ -190,6 +190,12 @@ struct sbp2_target { + #define SBP2_CYCLE_LIMIT (0xc8 << 12) /* 200 125us cycles */ + + /* ++ * There is no transport protocol limit to the CDB length, but we implement ++ * a fixed length only. 16 bytes is enough for disks larger than 2 TB. ++ */ ++#define SBP2_MAX_CDB_SIZE 16 ++ ++/* + * The default maximum s/g segment size of a FireWire controller is + * usually 0x10000, but SBP-2 only allows 0xffff. Since buffers have to + * be quadlet-aligned, we set the length limit to 0xffff & ~3. +@@ -301,7 +307,7 @@ struct sbp2_command_orb { + struct sbp2_pointer next; + struct sbp2_pointer data_descriptor; + __be32 misc; +- u8 command_block[12]; ++ u8 command_block[SBP2_MAX_CDB_SIZE]; + } request; + struct scsi_cmnd *cmd; + scsi_done_fn_t done; +@@ -1135,6 +1141,8 @@ static int sbp2_probe(struct device *dev + if (fw_device_enable_phys_dma(device) < 0) + goto fail_shost_put; + ++ shost->max_cmd_len = SBP2_MAX_CDB_SIZE; ++ + if (scsi_add_host(shost, &unit->device) < 0) + goto fail_shost_put; + + + +From gregkh@mini.kroah.org Thu Aug 13 12:51:32 2009 +Message-Id: <20090813195131.992427366@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Thu, 13 Aug 2009 12:50:25 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Stefan Richter +Subject: [patch 50/74] ieee1394: sbp2: add support for disks >2 TB (and 16 bytes long CDBs) +References: <20090813194935.985368088@mini.kroah.org> +Content-Disposition: inline; filename=ieee1394-sbp2-add-support-for-disks-2-tb.patch +Content-Length: 1422 +Lines: 51 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Stefan Richter + +Commit ebbb16bffa646f853899ef3fdc0ac7abab888703 upstream. + +Increase the command ORB data structure to transport up to 16 bytes long +CDBs (instead of 12 bytes), and tell the SCSI mid layer about it. This +is notably necessary for READ CAPACITY(16) and friends, i.e. support of +large disks. + +Signed-off-by: Stefan Richter +Signed-off-by: Greg Kroah-Hartman +--- + drivers/ieee1394/sbp2.c | 1 + + drivers/ieee1394/sbp2.h | 8 +++++++- + 2 files changed, 8 insertions(+), 1 deletion(-) + +--- a/drivers/ieee1394/sbp2.c ++++ b/drivers/ieee1394/sbp2.c +@@ -880,6 +880,7 @@ static struct sbp2_lu *sbp2_alloc_device + } + + shost->hostdata[0] = (unsigned long)lu; ++ shost->max_cmd_len = SBP2_MAX_CDB_SIZE; + + if (!scsi_add_host(shost, &ud->device)) { + lu->shost = shost; +--- a/drivers/ieee1394/sbp2.h ++++ b/drivers/ieee1394/sbp2.h +@@ -25,6 +25,12 @@ + #define SBP2_DEVICE_NAME "sbp2" + + /* ++ * There is no transport protocol limit to the CDB length, but we implement ++ * a fixed length only. 16 bytes is enough for disks larger than 2 TB. ++ */ ++#define SBP2_MAX_CDB_SIZE 16 ++ ++/* + * SBP-2 specific definitions + */ + +@@ -51,7 +57,7 @@ struct sbp2_command_orb { + u32 data_descriptor_hi; + u32 data_descriptor_lo; + u32 misc; +- u8 cdb[12]; ++ u8 cdb[SBP2_MAX_CDB_SIZE]; + } __attribute__((packed)); + + #define SBP2_LOGIN_REQUEST 0x0 + + +From gregkh@mini.kroah.org Thu Aug 13 12:51:32 2009 +Message-Id: <20090813195132.153955097@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Thu, 13 Aug 2009 12:50:26 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Roel Kluin , + Jie Yang , + Jay Cliburn , + Chris Snook , + "David S. Miller" +Subject: [patch 51/74] atl1c: WAKE_MCAST tested twice, not WAKE_UCAST +References: <20090813194935.985368088@mini.kroah.org> +Content-Disposition: inline; filename=atl1c-wake_mcast-tested-twice-not-wake_ucast.patch +Content-Length: 1041 +Lines: 30 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Roel Kluin + +commit 0ed586d075ef65c0268982e5b7f36d0ffaa95547 upstream. + +The WAKE_MCAST bit is tested twice, the first should be WAKE_UCAST. + +Signed-off-by: Roel Kluin +Cc: Jie Yang +Cc: Jay Cliburn +Cc: Chris Snook +Signed-off-by: Andrew Morton +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/atl1c/atl1c_ethtool.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/atl1c/atl1c_ethtool.c ++++ b/drivers/net/atl1c/atl1c_ethtool.c +@@ -271,7 +271,7 @@ static int atl1c_set_wol(struct net_devi + struct atl1c_adapter *adapter = netdev_priv(netdev); + + if (wol->wolopts & (WAKE_ARP | WAKE_MAGICSECURE | +- WAKE_MCAST | WAKE_BCAST | WAKE_MCAST)) ++ WAKE_UCAST | WAKE_BCAST | WAKE_MCAST)) + return -EOPNOTSUPP; + /* these settings will always override what we currently have */ + adapter->wol = 0; + + +From gregkh@mini.kroah.org Thu Aug 13 12:51:32 2009 +Message-Id: <20090813195132.283752239@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Thu, 13 Aug 2009 12:50:27 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Roel Kluin , + "David S. Miller" +Subject: [patch 52/74] atl1c: add missing parentheses +References: <20090813194935.985368088@mini.kroah.org> +Content-Disposition: inline; filename=atl1c-add-missing-parentheses.patch +Content-Length: 1530 +Lines: 44 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: roel kluin + +commit c5ad4f592e27d782faea0a787d9181f192a69ef0 upstream. + +Parentheses are required or the comparison occurs before the bitand. + +Signed-off-by: Roel Kluin +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/atl1c/atl1c.h | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/net/atl1c/atl1c.h ++++ b/drivers/net/atl1c/atl1c.h +@@ -188,14 +188,14 @@ struct atl1c_tpd_ext_desc { + #define RRS_HDS_TYPE_DATA 2 + + #define RRS_IS_NO_HDS_TYPE(flag) \ +- (((flag) >> (RRS_HDS_TYPE_SHIFT)) & RRS_HDS_TYPE_MASK == 0) ++ ((((flag) >> (RRS_HDS_TYPE_SHIFT)) & RRS_HDS_TYPE_MASK) == 0) + + #define RRS_IS_HDS_HEAD(flag) \ +- (((flag) >> (RRS_HDS_TYPE_SHIFT)) & RRS_HDS_TYPE_MASK == \ ++ ((((flag) >> (RRS_HDS_TYPE_SHIFT)) & RRS_HDS_TYPE_MASK) == \ + RRS_HDS_TYPE_HEAD) + + #define RRS_IS_HDS_DATA(flag) \ +- (((flag) >> (RRS_HDS_TYPE_SHIFT)) & RRS_HDS_TYPE_MASK == \ ++ ((((flag) >> (RRS_HDS_TYPE_SHIFT)) & RRS_HDS_TYPE_MASK) == \ + RRS_HDS_TYPE_DATA) + + /* rrs word 3 bit 0:31 */ +@@ -245,7 +245,7 @@ struct atl1c_tpd_ext_desc { + #define RRS_PACKET_TYPE_802_3 1 + #define RRS_PACKET_TYPE_ETH 0 + #define RRS_PACKET_IS_ETH(word) \ +- (((word) >> RRS_PACKET_TYPE_SHIFT) & RRS_PACKET_TYPE_MASK == \ ++ ((((word) >> RRS_PACKET_TYPE_SHIFT) & RRS_PACKET_TYPE_MASK) == \ + RRS_PACKET_TYPE_ETH) + #define RRS_RXD_IS_VALID(word) \ + ((((word) >> RRS_RXD_UPDATED_SHIFT) & RRS_RXD_UPDATED_MASK) == 1) + + +From gregkh@mini.kroah.org Thu Aug 13 12:51:32 2009 +Message-Id: <20090813195132.410969736@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Thu, 13 Aug 2009 12:50:28 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Roel Kluin , + "David S. Miller" +Subject: [patch 53/74] atl1c: misplaced parenthesis +References: <20090813194935.985368088@mini.kroah.org> +Content-Disposition: inline; filename=atl1c-misplaced-parenthesis.patch +Content-Length: 797 +Lines: 26 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: roel kluin + +commit 37b76c697f4ac082e9923dfa8e8aecc8bc54a8e1 upstream. + +Fix misplaced parenthesis + +Signed-off-by: Roel Kluin +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/atl1c/atl1c_main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/atl1c/atl1c_main.c ++++ b/drivers/net/atl1c/atl1c_main.c +@@ -1701,7 +1701,7 @@ static void atl1c_clean_rx_irq(struct at + if (likely(RRS_RXD_IS_VALID(rrs->word3))) { + rfd_num = (rrs->word0 >> RRS_RX_RFD_CNT_SHIFT) & + RRS_RX_RFD_CNT_MASK; +- if (unlikely(rfd_num) != 1) ++ if (unlikely(rfd_num != 1)) + /* TODO support mul rfd*/ + if (netif_msg_rx_err(adapter)) + dev_warn(&pdev->dev, + + +From gregkh@mini.kroah.org Thu Aug 13 12:51:32 2009 +Message-Id: <20090813195132.580843987@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Thu, 13 Aug 2009 12:50:29 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + Greg KH +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + NeilBrown +Subject: [patch 54/74] md: Handle growth of v1.x metadata correctly. +References: <20090813194935.985368088@mini.kroah.org> +Content-Disposition: inline; filename=md-handle-growth-of-v1.x-metadata-correctly.patch +Content-Length: 1168 +Lines: 40 + + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Neil Brown + +commit 70471dafe3390243c598a3165dfb86b8b8b3f4fe upstream. + +The v1.x metadata does not have a fixed size and can grow +when devices are added. +If it grows enough to require an extra sector of storage, +we need to update the 'sb_size' to match. + +Without this, md can write out an incomplete superblock with a +bad checksum, which will be rejected when trying to re-assemble +the array. + +Signed-off-by: NeilBrown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/md.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +--- a/drivers/md/md.c ++++ b/drivers/md/md.c +@@ -1410,8 +1410,14 @@ static void super_1_sync(mddev_t *mddev, + if (rdev2->desc_nr+1 > max_dev) + max_dev = rdev2->desc_nr+1; + +- if (max_dev > le32_to_cpu(sb->max_dev)) ++ if (max_dev > le32_to_cpu(sb->max_dev)) { ++ int bmask; + sb->max_dev = cpu_to_le32(max_dev); ++ rdev->sb_size = max_dev * 2 + 256; ++ bmask = queue_hardsect_size(rdev->bdev->bd_disk->queue)-1; ++ if (rdev->sb_size & bmask) ++ rdev->sb_size = (rdev->sb_size | bmask) + 1; ++ } + for (i=0; idev_roles[i] = cpu_to_le16(0xfffe); + + + +From gregkh@mini.kroah.org Thu Aug 13 12:51:32 2009 +Message-Id: <20090813195132.711720396@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Thu, 13 Aug 2009 12:50:30 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Eric Dumazet , + Oleg Nesterov , + Peter Zijlstra , + Sonny Rao , + Ingo Molnar , + Thomas Gleixner , + Ulrich Drepper +Subject: [patch 55/74] execve: must clear current->clear_child_tid +References: <20090813194935.985368088@mini.kroah.org> +Content-Disposition: inline; filename=execve-must-clear-current-clear_child_tid.patch +Content-Length: 4327 +Lines: 122 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Eric Dumazet + +commit 9c8a8228d0827e0d91d28527209988f672f97d28 upstream. + +While looking at Jens Rosenboom bug report +(http://lkml.org/lkml/2009/7/27/35) about strange sys_futex call done from +a dying "ps" program, we found following problem. + +clone() syscall has special support for TID of created threads. This +support includes two features. + +One (CLONE_CHILD_SETTID) is to set an integer into user memory with the +TID value. + +One (CLONE_CHILD_CLEARTID) is to clear this same integer once the created +thread dies. + +The integer location is a user provided pointer, provided at clone() +time. + +kernel keeps this pointer value into current->clear_child_tid. + +At execve() time, we should make sure kernel doesnt keep this user +provided pointer, as full user memory is replaced by a new one. + +As glibc fork() actually uses clone() syscall with CLONE_CHILD_SETTID and +CLONE_CHILD_CLEARTID set, chances are high that we might corrupt user +memory in forked processes. + +Following sequence could happen: + +1) bash (or any program) starts a new process, by a fork() call that + glibc maps to a clone( ... CLONE_CHILD_SETTID | CLONE_CHILD_CLEARTID + ...) syscall + +2) When new process starts, its current->clear_child_tid is set to a + location that has a meaning only in bash (or initial program) context + (&THREAD_SELF->tid) + +3) This new process does the execve() syscall to start a new program. + current->clear_child_tid is left unchanged (a non NULL value) + +4) If this new program creates some threads, and initial thread exits, + kernel will attempt to clear the integer pointed by + current->clear_child_tid from mm_release() : + + if (tsk->clear_child_tid + && !(tsk->flags & PF_SIGNALED) + && atomic_read(&mm->mm_users) > 1) { + u32 __user * tidptr = tsk->clear_child_tid; + tsk->clear_child_tid = NULL; + + /* + * We don't check the error code - if userspace has + * not set up a proper pointer then tough luck. + */ +<< here >> put_user(0, tidptr); + sys_futex(tidptr, FUTEX_WAKE, 1, NULL, NULL, 0); + } + +5) OR : if new program is not multi-threaded, but spied by /proc/pid + users (ps command for example), mm_users > 1, and the exiting program + could corrupt 4 bytes in a persistent memory area (shm or memory mapped + file) + +If current->clear_child_tid points to a writeable portion of memory of the +new program, kernel happily and silently corrupts 4 bytes of memory, with +unexpected effects. + +Fix is straightforward and should not break any sane program. + +Reported-by: Jens Rosenboom +Acked-by: Linus Torvalds +Signed-off-by: Eric Dumazet +Signed-off-by: Oleg Nesterov +Cc: Peter Zijlstra +Cc: Sonny Rao +Cc: Ingo Molnar +Cc: Thomas Gleixner +Cc: Ulrich Drepper +Cc: Oleg Nesterov +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/fork.c | 22 +++++++++++----------- + 1 file changed, 11 insertions(+), 11 deletions(-) + +--- a/kernel/fork.c ++++ b/kernel/fork.c +@@ -568,18 +568,18 @@ void mm_release(struct task_struct *tsk, + * the value intact in a core dump, and to save the unnecessary + * trouble otherwise. Userland only wants this done for a sys_exit. + */ +- if (tsk->clear_child_tid +- && !(tsk->flags & PF_SIGNALED) +- && atomic_read(&mm->mm_users) > 1) { +- u32 __user * tidptr = tsk->clear_child_tid; ++ if (tsk->clear_child_tid) { ++ if (!(tsk->flags & PF_SIGNALED) && ++ atomic_read(&mm->mm_users) > 1) { ++ /* ++ * We don't check the error code - if userspace has ++ * not set up a proper pointer then tough luck. ++ */ ++ put_user(0, tsk->clear_child_tid); ++ sys_futex(tsk->clear_child_tid, FUTEX_WAKE, ++ 1, NULL, NULL, 0); ++ } + tsk->clear_child_tid = NULL; +- +- /* +- * We don't check the error code - if userspace has +- * not set up a proper pointer then tough luck. +- */ +- put_user(0, tidptr); +- sys_futex(tidptr, FUTEX_WAKE, 1, NULL, NULL, 0); + } + } + + + +From gregkh@mini.kroah.org Thu Aug 13 12:51:33 2009 +Message-Id: <20090813195132.877694343@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Thu, 13 Aug 2009 12:50:31 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Mike Frysinger , + David Howells +Subject: [patch 56/74] flat: fix uninitialized ptr with shared libs +References: <20090813194935.985368088@mini.kroah.org> +Content-Disposition: inline; filename=flat-fix-uninitialized-ptr-with-shared-libs.patch +Content-Length: 1230 +Lines: 50 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Linus Torvalds + +commit 3440625d78711bee41a84cf29c3d8c579b522666 upstream. + +The new credentials code broke load_flat_shared_library() as it now uses +an uninitialized cred pointer. + +Reported-by: Bernd Schmidt +Tested-by: Bernd Schmidt +Cc: Mike Frysinger +Cc: David Howells +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + fs/binfmt_flat.c | 17 ++++++++++++----- + 1 file changed, 12 insertions(+), 5 deletions(-) + +--- a/fs/binfmt_flat.c ++++ b/fs/binfmt_flat.c +@@ -828,15 +828,22 @@ static int load_flat_shared_library(int + if (IS_ERR(bprm.file)) + return res; + ++ bprm.cred = prepare_exec_creds(); ++ res = -ENOMEM; ++ if (!bprm.cred) ++ goto out; ++ + res = prepare_binprm(&bprm); + + if (res <= (unsigned long)-4096) + res = load_flat_file(&bprm, libs, id, NULL); +- if (bprm.file) { +- allow_write_access(bprm.file); +- fput(bprm.file); +- bprm.file = NULL; +- } ++ ++ abort_creds(bprm.cred); ++ ++out: ++ allow_write_access(bprm.file); ++ fput(bprm.file); ++ + return(res); + } + + + +From gregkh@mini.kroah.org Thu Aug 13 12:51:33 2009 +Message-Id: <20090813195133.025035073@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Thu, 13 Aug 2009 12:50:32 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Eric Sandeen , + , + Mark Lord , + Arnd Bergmann , + Josef Bacik , + Jan Kara +Subject: [patch 57/74] compat_ioctl: hook up compat handler for FIEMAP ioctl +References: <20090813194935.985368088@mini.kroah.org> +Content-Disposition: inline; filename=compat_ioctl-hook-up-compat-handler-for-fiemap-ioctl.patch +Content-Length: 1160 +Lines: 38 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Eric Sandeen + +commit 69130c7cf96ea853dc5be599dd6a4b98907d39cc upstream. + +The FIEMAP_IOC_FIEMAP mapping ioctl was missing a 32-bit compat handler, +which means that 32-bit suerspace on 64-bit kernels cannot use this ioctl +command. + +The structure is nicely aligned, padded, and sized, so it is just this +simple. + +Tested w/ 32-bit ioctl tester (from Josef) on a 64-bit kernel on ext4. + +Signed-off-by: Eric Sandeen +Cc: +Cc: Mark Lord +Cc: Arnd Bergmann +Cc: Josef Bacik +Cc: Jan Kara +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + fs/compat_ioctl.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/fs/compat_ioctl.c ++++ b/fs/compat_ioctl.c +@@ -1915,6 +1915,7 @@ COMPATIBLE_IOCTL(FIONCLEX) + COMPATIBLE_IOCTL(FIOASYNC) + COMPATIBLE_IOCTL(FIONBIO) + COMPATIBLE_IOCTL(FIONREAD) /* This is also TIOCINQ */ ++COMPATIBLE_IOCTL(FS_IOC_FIEMAP) + /* 0x00 */ + COMPATIBLE_IOCTL(FIBMAP) + COMPATIBLE_IOCTL(FIGETBSZ) + + +From gregkh@mini.kroah.org Thu Aug 13 12:51:33 2009 +Message-Id: <20090813195133.179908882@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Thu, 13 Aug 2009 12:50:33 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Xiao Guangrong , + Ingo Molnar , + Jens Axboe , + Nick Piggin , + Peter Zijlstra , + Rusty Russell +Subject: [patch 58/74] generic-ipi: fix hotplug_cfd() +References: <20090813194935.985368088@mini.kroah.org> +Content-Disposition: inline; filename=generic-ipi-fix-hotplug_cfd.patch +Content-Length: 1140 +Lines: 38 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Xiao Guangrong + +commit 69dd647f969c28d18de77e2153f30d05a1874571 upstream. + +Use CONFIG_HOTPLUG_CPU, not CONFIG_CPU_HOTPLUG + +When hot-unpluging a cpu, it will leak memory allocated at cpu hotplug, +but only if CPUMASK_OFFSTACK=y, which is default to n. + +The bug was introduced by 8969a5ede0f9e17da4b943712429aef2c9bcd82b +("generic-ipi: remove kmalloc()"). + +Signed-off-by: Xiao Guangrong +Cc: Ingo Molnar +Cc: Jens Axboe +Cc: Nick Piggin +Cc: Peter Zijlstra +Cc: Rusty Russell +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/smp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/kernel/smp.c ++++ b/kernel/smp.c +@@ -57,7 +57,7 @@ hotplug_cfd(struct notifier_block *nfb, + return NOTIFY_BAD; + break; + +-#ifdef CONFIG_CPU_HOTPLUG ++#ifdef CONFIG_HOTPLUG_CPU + case CPU_UP_CANCELED: + case CPU_UP_CANCELED_FROZEN: + + + +From gregkh@mini.kroah.org Thu Aug 13 12:51:33 2009 +Message-Id: <20090813195133.309452779@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Thu, 13 Aug 2009 12:50:34 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Mike Galbraith , + Peter Teoh +Subject: [patch 59/74] Staging: rt2870: Revert d44ca7 Removal of kernel_thread() API +References: <20090813194935.985368088@mini.kroah.org> +Content-Disposition: inline; filename=staging-rt2870-revert-d44ca7-removal-of-kernel_thread-api.patch +Content-Length: 10222 +Lines: 325 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Greg Kroah-Hartman + +commit 2c63abf9e8a51dec886da482dfd8ae752581a61c upstream. + +[Mike Galbraith did the upstream revert, which was more complex] + +Staging: rt2870: Revert d44ca7 Removal of kernel_thread() API + +The sanity check this patch introduced triggers on shutdown, apparently due to +threads having already exited by the time BUG_ON() is reached. + +Cc: Mike Galbraith +Cc: Peter Teoh +Signed-off-by: Greg Kroah-Hartman + + +--- + drivers/staging/rt2870/2870_main_dev.c | 67 ++++++++++++++++--------- + drivers/staging/rt2870/common/2870_rtmp_init.c | 35 +++++-------- + drivers/staging/rt2870/common/cmm_data.c | 3 + + drivers/staging/rt2870/common/rtmp_init.c | 2 + drivers/staging/rt2870/common/rtusb_io.c | 3 - + drivers/staging/rt2870/rt2870.h | 6 -- + drivers/staging/rt2870/rt_linux.h | 11 ++-- + 7 files changed, 74 insertions(+), 53 deletions(-) + +--- a/drivers/staging/rt2870/2870_main_dev.c ++++ b/drivers/staging/rt2870/2870_main_dev.c +@@ -265,7 +265,7 @@ INT MlmeThread( + */ + DBGPRINT(RT_DEBUG_TRACE,( "<---%s\n",__func__)); + +- pObj->MLMEThr_task = NULL; ++ pObj->MLMEThr_pid = THREAD_PID_INIT_VALUE; + + complete_and_exit (&pAd->mlmeComplete, 0); + return 0; +@@ -373,7 +373,7 @@ INT RTUSBCmdThread( + */ + DBGPRINT(RT_DEBUG_TRACE,( "<---RTUSBCmdThread\n")); + +- pObj->RTUSBCmdThr_task = NULL; ++ pObj->RTUSBCmdThr_pid = THREAD_PID_INIT_VALUE; + + complete_and_exit (&pAd->CmdQComplete, 0); + return 0; +@@ -467,7 +467,7 @@ INT TimerQThread( + */ + DBGPRINT(RT_DEBUG_TRACE,( "<---%s\n",__func__)); + +- pObj->TimerQThr_task = NULL; ++ pObj->TimerQThr_pid = THREAD_PID_INIT_VALUE; + + complete_and_exit(&pAd->TimerQComplete, 0); + return 0; +@@ -944,46 +944,69 @@ VOID RT28xxThreadTerminate( + RTUSBCancelPendingIRPs(pAd); + + // Terminate Threads +- BUG_ON(pObj->TimerQThr_task == NULL); +- CHECK_PID_LEGALITY(task_pid(pObj->TimerQThr_task)) ++ CHECK_PID_LEGALITY(pObj->TimerQThr_pid) + { + POS_COOKIE pObj = (POS_COOKIE)pAd->OS_Cookie; + +- printk(KERN_DEBUG "Terminate the TimerQThr pid=%d!\n", +- pid_nr(task_pid(pObj->TimerQThr_task))); ++ printk("Terminate the TimerQThr_pid=%d!\n", GET_PID_NUMBER(pObj->TimerQThr_pid)); + mb(); + pAd->TimerFunc_kill = 1; + mb(); +- kthread_stop(pObj->TimerQThr_task); +- pObj->TimerQThr_task = NULL; ++ ret = KILL_THREAD_PID(pObj->TimerQThr_pid, SIGTERM, 1); ++ if (ret) ++ { ++ printk(KERN_WARNING "%s: unable to stop TimerQThread, pid=%d, ret=%d!\n", ++ pAd->net_dev->name, GET_PID_NUMBER(pObj->TimerQThr_pid), ret); ++ } ++ else ++ { ++ wait_for_completion(&pAd->TimerQComplete); ++ pObj->TimerQThr_pid = THREAD_PID_INIT_VALUE; ++ } + } + +- BUG_ON(pObj->MLMEThr_task == NULL); +- CHECK_PID_LEGALITY(task_pid(pObj->MLMEThr_task)) ++ CHECK_PID_LEGALITY(pObj->MLMEThr_pid) + { +- printk(KERN_DEBUG "Terminate the MLMEThr pid=%d!\n", +- pid_nr(task_pid(pObj->MLMEThr_task))); ++ printk("Terminate the MLMEThr_pid=%d!\n", GET_PID_NUMBER(pObj->MLMEThr_pid)); + mb(); + pAd->mlme_kill = 1; + //RT28XX_MLME_HANDLER(pAd); + mb(); +- kthread_stop(pObj->MLMEThr_task); +- pObj->MLMEThr_task = NULL; ++ ret = KILL_THREAD_PID(pObj->MLMEThr_pid, SIGTERM, 1); ++ if (ret) ++ { ++ printk (KERN_WARNING "%s: unable to Mlme thread, pid=%d, ret=%d!\n", ++ pAd->net_dev->name, GET_PID_NUMBER(pObj->MLMEThr_pid), ret); ++ } ++ else ++ { ++ //wait_for_completion (&pAd->notify); ++ wait_for_completion (&pAd->mlmeComplete); ++ pObj->MLMEThr_pid = THREAD_PID_INIT_VALUE; ++ } + } + +- BUG_ON(pObj->RTUSBCmdThr_task == NULL); +- CHECK_PID_LEGALITY(task_pid(pObj->RTUSBCmdThr_task)) ++ CHECK_PID_LEGALITY(pObj->RTUSBCmdThr_pid) + { +- printk(KERN_DEBUG "Terminate the RTUSBCmdThr pid=%d!\n", +- pid_nr(task_pid(pObj->RTUSBCmdThr_task))); ++ printk("Terminate the RTUSBCmdThr_pid=%d!\n", GET_PID_NUMBER(pObj->RTUSBCmdThr_pid)); + mb(); + NdisAcquireSpinLock(&pAd->CmdQLock); + pAd->CmdQ.CmdQState = RT2870_THREAD_STOPED; + NdisReleaseSpinLock(&pAd->CmdQLock); + mb(); + //RTUSBCMDUp(pAd); +- kthread_stop(pObj->RTUSBCmdThr_task); +- pObj->RTUSBCmdThr_task = NULL; ++ ret = KILL_THREAD_PID(pObj->RTUSBCmdThr_pid, SIGTERM, 1); ++ if (ret) ++ { ++ printk(KERN_WARNING "%s: unable to RTUSBCmd thread, pid=%d, ret=%d!\n", ++ pAd->net_dev->name, GET_PID_NUMBER(pObj->RTUSBCmdThr_pid), ret); ++ } ++ else ++ { ++ //wait_for_completion (&pAd->notify); ++ wait_for_completion (&pAd->CmdQComplete); ++ pObj->RTUSBCmdThr_pid = THREAD_PID_INIT_VALUE; ++ } + } + + +@@ -1044,7 +1067,7 @@ BOOLEAN RT28XXChipsetCheck( + if (dev_p->descriptor.idVendor == rtusb_usb_id[i].idVendor && + dev_p->descriptor.idProduct == rtusb_usb_id[i].idProduct) + { +- printk(KERN_DEBUG "rt2870: idVendor = 0x%x, idProduct = 0x%x\n", ++ printk("rt2870: idVendor = 0x%x, idProduct = 0x%x\n", + dev_p->descriptor.idVendor, dev_p->descriptor.idProduct); + break; + } +--- a/drivers/staging/rt2870/common/2870_rtmp_init.c ++++ b/drivers/staging/rt2870/common/2870_rtmp_init.c +@@ -727,8 +727,8 @@ NDIS_STATUS AdapterBlockAllocateMemory( + + usb_dev = pObj->pUsb_Dev; + +- pObj->MLMEThr_task = NULL; +- pObj->RTUSBCmdThr_task = NULL; ++ pObj->MLMEThr_pid = THREAD_PID_INIT_VALUE; ++ pObj->RTUSBCmdThr_pid = THREAD_PID_INIT_VALUE; + + *ppAd = (PVOID)vmalloc(sizeof(RTMP_ADAPTER)); + +@@ -765,7 +765,7 @@ NDIS_STATUS CreateThreads( + { + PRTMP_ADAPTER pAd = net_dev->ml_priv; + POS_COOKIE pObj = (POS_COOKIE) pAd->OS_Cookie; +- struct task_struct *tsk; ++ pid_t pid_number = -1; + + //init_MUTEX(&(pAd->usbdev_semaphore)); + +@@ -779,39 +779,36 @@ NDIS_STATUS CreateThreads( + init_completion (&pAd->TimerQComplete); + + // Creat MLME Thread +- pObj->MLMEThr_task = NULL; +- tsk = kthread_run(MlmeThread, pAd, pAd->net_dev->name); +- +- if (IS_ERR(tsk)) { ++ pObj->MLMEThr_pid= THREAD_PID_INIT_VALUE; ++ pid_number = kernel_thread(MlmeThread, pAd, CLONE_VM); ++ if (pid_number < 0) ++ { + printk (KERN_WARNING "%s: unable to start Mlme thread\n",pAd->net_dev->name); + return NDIS_STATUS_FAILURE; + } +- +- pObj->MLMEThr_task = tsk; ++ pObj->MLMEThr_pid = GET_PID(pid_number); + // Wait for the thread to start + wait_for_completion(&(pAd->mlmeComplete)); + + // Creat Command Thread +- pObj->RTUSBCmdThr_task = NULL; +- tsk = kthread_run(RTUSBCmdThread, pAd, pAd->net_dev->name); +- +- if (IS_ERR(tsk) < 0) ++ pObj->RTUSBCmdThr_pid= THREAD_PID_INIT_VALUE; ++ pid_number = kernel_thread(RTUSBCmdThread, pAd, CLONE_VM); ++ if (pid_number < 0) + { + printk (KERN_WARNING "%s: unable to start RTUSBCmd thread\n",pAd->net_dev->name); + return NDIS_STATUS_FAILURE; + } +- +- pObj->RTUSBCmdThr_task = tsk; ++ pObj->RTUSBCmdThr_pid = GET_PID(pid_number); + wait_for_completion(&(pAd->CmdQComplete)); + +- pObj->TimerQThr_task = NULL; +- tsk = kthread_run(TimerQThread, pAd, pAd->net_dev->name); +- if (IS_ERR(tsk) < 0) ++ pObj->TimerQThr_pid= THREAD_PID_INIT_VALUE; ++ pid_number = kernel_thread(TimerQThread, pAd, CLONE_VM); ++ if (pid_number < 0) + { + printk (KERN_WARNING "%s: unable to start TimerQThread\n",pAd->net_dev->name); + return NDIS_STATUS_FAILURE; + } +- pObj->TimerQThr_task = tsk; ++ pObj->TimerQThr_pid = GET_PID(pid_number); + // Wait for the thread to start + wait_for_completion(&(pAd->TimerQComplete)); + +--- a/drivers/staging/rt2870/common/cmm_data.c ++++ b/drivers/staging/rt2870/common/cmm_data.c +@@ -709,6 +709,9 @@ BOOLEAN RTMP_FillTxBlkInfo( + } + + return TRUE; ++ ++FillTxBlkErr: ++ return FALSE; + } + + +--- a/drivers/staging/rt2870/common/rtmp_init.c ++++ b/drivers/staging/rt2870/common/rtmp_init.c +@@ -3655,7 +3655,7 @@ VOID UserCfgInit( + #ifdef RALINK_28xx_QA + //pAd->ate.Repeat = 0; + pAd->ate.TxStatus = 0; +- pAd->ate.AtePid = NULL; ++ pAd->ate.AtePid = THREAD_PID_INIT_VALUE; + #endif // RALINK_28xx_QA // + #endif // RALINK_ATE // + +--- a/drivers/staging/rt2870/common/rtusb_io.c ++++ b/drivers/staging/rt2870/common/rtusb_io.c +@@ -958,8 +958,7 @@ NDIS_STATUS RTUSBEnqueueCmdFromNdis( + POS_COOKIE pObj = (POS_COOKIE) pAd->OS_Cookie; + + +- BUG_ON(pObj->RTUSBCmdThr_task == NULL); +- CHECK_PID_LEGALITY(task_pid(pObj->RTUSBCmdThr_task)) ++ CHECK_PID_LEGALITY(pObj->RTUSBCmdThr_pid) + return (NDIS_STATUS_RESOURCES); + + status = RTMPAllocateMemory((PVOID *)&cmdqelmt, sizeof(CmdQElmt)); +--- a/drivers/staging/rt2870/rt2870.h ++++ b/drivers/staging/rt2870/rt2870.h +@@ -580,16 +580,14 @@ VOID RTUSBBulkRxComplete(purbb_t pUrb, s + #define RTUSBMlmeUp(pAd) \ + { \ + POS_COOKIE pObj = (POS_COOKIE) pAd->OS_Cookie; \ +- BUG_ON(pObj->MLMEThr_task == NULL); \ +- CHECK_PID_LEGALITY(task_pid(pObj->MLMEThr_task)) \ ++ CHECK_PID_LEGALITY(pObj->MLMEThr_pid) \ + up(&(pAd->mlme_semaphore)); \ + } + + #define RTUSBCMDUp(pAd) \ + { \ + POS_COOKIE pObj = (POS_COOKIE) pAd->OS_Cookie; \ +- BUG_ON(pObj->RTUSBCmdThr_task == NULL); \ +- CHECK_PID_LEGALITY(task_pid(pObj->RTUSBCmdThr_task)) \ ++ CHECK_PID_LEGALITY(pObj->RTUSBCmdThr_pid) \ + up(&(pAd->RTUSBCmd_semaphore)); \ + } + +--- a/drivers/staging/rt2870/rt_linux.h ++++ b/drivers/staging/rt2870/rt_linux.h +@@ -44,7 +44,6 @@ + #include + #include + #include +-#include + + #include + #include +@@ -166,12 +165,14 @@ typedef int (*HARD_START_XMIT_FUNC)(stru + + #if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,27) + typedef struct pid * THREAD_PID; ++#define THREAD_PID_INIT_VALUE NULL + #define GET_PID(_v) find_get_pid(_v) + #define GET_PID_NUMBER(_v) pid_nr(_v) + #define CHECK_PID_LEGALITY(_pid) if (pid_nr(_pid) >= 0) + #define KILL_THREAD_PID(_A, _B, _C) kill_pid(_A, _B, _C) + #else + typedef pid_t THREAD_PID; ++#define THREAD_PID_INIT_VALUE -1 + #define GET_PID(_v) _v + #define GET_PID_NUMBER(_v) _v + #define CHECK_PID_LEGALITY(_pid) if (_pid >= 0) +@@ -187,11 +188,11 @@ struct os_lock { + struct os_cookie { + + #ifdef RT2870 +- struct usb_device *pUsb_Dev; ++ struct usb_device *pUsb_Dev; + +- struct task_struct *MLMEThr_task; +- struct task_struct *RTUSBCmdThr_task; +- struct task_struct *TimerQThr_task; ++ THREAD_PID MLMEThr_pid; ++ THREAD_PID RTUSBCmdThr_pid; ++ THREAD_PID TimerQThr_pid; + #endif // RT2870 // + + struct tasklet_struct rx_done_task; + + +From gregkh@mini.kroah.org Thu Aug 13 12:51:33 2009 +Message-Id: <20090813195133.435305300@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Thu, 13 Aug 2009 12:50:35 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + =?ISO-8859-15?q?Marko=20H=C3=A4nninen?= +Subject: [patch 60/74] USB: ftdi_sio: add vendor and product id for Bayer glucose meter serial converter cable +References: <20090813194935.985368088@mini.kroah.org> +Content-Disposition: inline; filename=usb-ftdi_sio-add-vendor-and-product-id-for-bayer-glucose-meter-serial-converter-cable.patch +Content-Length: 1473 +Lines: 45 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Marko Hänninen + +commit c47aacc67a3d26dfab9c9b8965975ed2b2010b30 upstream. + +Attached patch adds USB vendor and product IDs for Bayer's USB to serial +converter cable used by Bayer blood glucose meters. It seems to be a +FT232RL based device and works without any problem with ftdi_sio driver +when this patch is applied. See: http://winglucofacts.com/cables/ + + +Signed-off-by: Marko Hänninen +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/ftdi_sio.c | 1 + + drivers/usb/serial/ftdi_sio.h | 7 +++++++ + 2 files changed, 8 insertions(+) + +--- a/drivers/usb/serial/ftdi_sio.c ++++ b/drivers/usb/serial/ftdi_sio.c +@@ -672,6 +672,7 @@ static struct usb_device_id id_table_com + { USB_DEVICE(JETI_VID, JETI_SPC1201_PID) }, + { USB_DEVICE(MARVELL_VID, MARVELL_SHEEVAPLUG_PID), + .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, ++ { USB_DEVICE(BAYER_VID, BAYER_CONTOUR_CABLE_PID) }, + { }, /* Optional parameter entry */ + { } /* Terminating entry */ + }; +--- a/drivers/usb/serial/ftdi_sio.h ++++ b/drivers/usb/serial/ftdi_sio.h +@@ -926,6 +926,13 @@ + #define MARVELL_SHEEVAPLUG_PID 0x9e8f + + /* ++ * Bayer Ascensia Contour blood glucose meter USB-converter cable. ++ * http://winglucofacts.com/cables/ ++ */ ++#define BAYER_VID 0x1A79 ++#define BAYER_CONTOUR_CABLE_PID 0x6001 ++ ++/* + * BmRequestType: 1100 0000b + * bRequest: FTDI_E2_READ + * wValue: 0 + + +From gregkh@mini.kroah.org Thu Aug 13 12:51:33 2009 +Message-Id: <20090813195133.580120781@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Thu, 13 Aug 2009 12:50:36 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Dhaval Vasa +Subject: [patch 61/74] USB: ftdi_sio: add product_id for Marvell OpenRD Base, Client +References: <20090813194935.985368088@mini.kroah.org> +Content-Disposition: inline; filename=usb-ftdi_sio-add-product_id-for-marvell-openrd-base-client.patch +Content-Length: 1233 +Lines: 43 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Dhaval Vasa + +commit 50d0678e2026c18e4147f0b16b5853113659b82d upstream. + +reference: +http://www.open-rd.org + +Signed-off-by: Dhaval Vasa +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/ftdi_sio.c | 2 ++ + drivers/usb/serial/ftdi_sio.h | 7 +++++++ + 2 files changed, 9 insertions(+) + +--- a/drivers/usb/serial/ftdi_sio.c ++++ b/drivers/usb/serial/ftdi_sio.c +@@ -673,6 +673,8 @@ static struct usb_device_id id_table_com + { USB_DEVICE(MARVELL_VID, MARVELL_SHEEVAPLUG_PID), + .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, + { USB_DEVICE(BAYER_VID, BAYER_CONTOUR_CABLE_PID) }, ++ { USB_DEVICE(FTDI_VID, MARVELL_OPENRD_PID), ++ .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, + { }, /* Optional parameter entry */ + { } /* Terminating entry */ + }; +--- a/drivers/usb/serial/ftdi_sio.h ++++ b/drivers/usb/serial/ftdi_sio.h +@@ -933,6 +933,13 @@ + #define BAYER_CONTOUR_CABLE_PID 0x6001 + + /* ++ * Marvell OpenRD Base, Client ++ * http://www.open-rd.org ++ * OpenRD Base, Client use VID 0x0403 ++ */ ++#define MARVELL_OPENRD_PID 0x9e90 ++ ++/* + * BmRequestType: 1100 0000b + * bRequest: FTDI_E2_READ + * wValue: 0 + + +From gregkh@mini.kroah.org Thu Aug 13 12:51:33 2009 +Message-Id: <20090813195133.720254371@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Thu, 13 Aug 2009 12:50:37 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Rogerio Brito , + Phil Dibowitz , + Alan Stern , + Robert Hancock +Subject: [patch 62/74] USB: storage: include Prolific Technology USB drive in unusual_devs list +References: <20090813194935.985368088@mini.kroah.org> +Content-Disposition: inline; filename=usb-storage-include-prolific-technology-usb-drive-in-unusual_devs-list.patch +Content-Length: 1291 +Lines: 39 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Rogerio Brito + +commit c15e3ca1d822abba78c00b1ffc3e7b382a50396e upstream. + +Add a quirk entry for the Leading Driver UD-11 usb flash drive. + +As Alan Stern told me, the device doesn't deal correctly with the +locking media feature of the device, and this patch incorporates it. + +Compiled, tested, working. + +Signed-off-by: Rogerio Brito +Cc: Phil Dibowitz +Cc: Alan Stern +Cc: Robert Hancock +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/storage/unusual_devs.h | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/usb/storage/unusual_devs.h ++++ b/drivers/usb/storage/unusual_devs.h +@@ -838,6 +838,13 @@ UNUSUAL_DEV( 0x066f, 0x8000, 0x0001, 0x0 + US_SC_DEVICE, US_PR_DEVICE, NULL, + US_FL_FIX_CAPACITY ), + ++/* Reported by Rogerio Brito */ ++UNUSUAL_DEV( 0x067b, 0x2317, 0x0001, 0x001, ++ "Prolific Technology, Inc.", ++ "Mass Storage Device", ++ US_SC_DEVICE, US_PR_DEVICE, NULL, ++ US_FL_NOT_LOCKABLE ), ++ + /* Reported by Richard -=[]=- */ + /* Change to bcdDeviceMin (0x0100 to 0x0001) reported by + * Thomas Bartosik */ + + +From gregkh@mini.kroah.org Thu Aug 13 12:51:34 2009 +Message-Id: <20090813195133.863693403@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Thu, 13 Aug 2009 12:50:38 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Alan Stern , + Kay Sievers +Subject: [patch 63/74] USB: usbfs: fix -ENOENT error code to be -ENODEV +References: <20090813194935.985368088@mini.kroah.org> +Content-Disposition: inline; filename=usb-usbfs-fix-enoent-error-code-to-be-enodev.patch +Content-Length: 780 +Lines: 28 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Alan Stern + +commit 01105a246345f011fde64d24a601090b646e9e4c upstream. + +This patch (as1272) changes the error code returned when an open call +for a USB device node fails to locate the corresponding device. The +appropriate error code is -ENODEV, not -ENOENT. + +Signed-off-by: Alan Stern +CC: Kay Sievers +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/devio.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/core/devio.c ++++ b/drivers/usb/core/devio.c +@@ -582,7 +582,7 @@ static int usbdev_open(struct inode *ino + if (!ps) + goto out; + +- ret = -ENOENT; ++ ret = -ENODEV; + + /* usbdev device-node */ + if (imajor(inode) == USB_DEVICE_MAJOR) + + +From gregkh@mini.kroah.org Thu Aug 13 12:51:34 2009 +Message-Id: <20090813195134.019510489@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Thu, 13 Aug 2009 12:50:39 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Michael Buesch , + Pete Zaitcev +Subject: [patch 64/74] USB: devio: Properly do access_ok() checks +References: <20090813194935.985368088@mini.kroah.org> +Content-Disposition: inline; filename=usb-devio-properly-do-access_ok-checks.patch +Content-Length: 1616 +Lines: 45 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Michael Buesch + +commit 18753ebc8a98efe0e8ff6167afb31cef220c8e50 upstream. + +access_ok() checks must be done on every part of the userspace structure +that is accessed. If access_ok() on one part of the struct succeeded, it +does not imply it will succeed on other parts of the struct. (Does +depend on the architecture implementation of access_ok()). + +This changes the __get_user() users to first check access_ok() on the +data structure. + +Signed-off-by: Michael Buesch +Cc: Pete Zaitcev +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/devio.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +--- a/drivers/usb/core/devio.c ++++ b/drivers/usb/core/devio.c +@@ -1308,7 +1308,8 @@ static int get_urb32(struct usbdevfs_urb + struct usbdevfs_urb32 __user *uurb) + { + __u32 uptr; +- if (get_user(kurb->type, &uurb->type) || ++ if (!access_ok(VERIFY_READ, uurb, sizeof(*uurb)) || ++ __get_user(kurb->type, &uurb->type) || + __get_user(kurb->endpoint, &uurb->endpoint) || + __get_user(kurb->status, &uurb->status) || + __get_user(kurb->flags, &uurb->flags) || +@@ -1523,8 +1524,9 @@ static int proc_ioctl_compat(struct dev_ + u32 udata; + + uioc = compat_ptr((long)arg); +- if (get_user(ctrl.ifno, &uioc->ifno) || +- get_user(ctrl.ioctl_code, &uioc->ioctl_code) || ++ if (!access_ok(VERIFY_READ, uioc, sizeof(*uioc)) || ++ __get_user(ctrl.ifno, &uioc->ifno) || ++ __get_user(ctrl.ioctl_code, &uioc->ioctl_code) || + __get_user(udata, &uioc->data)) + return -EFAULT; + ctrl.data = compat_ptr(udata); + + +From gregkh@mini.kroah.org Thu Aug 13 12:51:34 2009 +Message-Id: <20090813195134.194857291@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Thu, 13 Aug 2009 12:50:40 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Eric Dumazet , + Steven Rostedt +Subject: [patch 65/74] ring-buffer: Fix memleak in ring_buffer_free() +References: <20090813194935.985368088@mini.kroah.org> +Content-Disposition: inline; filename=ring-buffer-fix-memleak-in-ring_buffer_free.patch +Content-Length: 707 +Lines: 27 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Eric Dumazet + +commit bd3f02212d6a457267e0c9c02c426151c436d9d4 upstream. + +I noticed oprofile memleaked in linux-2.6 current tree, +and tracked this ring-buffer leak. + +Signed-off-by: Eric Dumazet +LKML-Reference: <4A7C06B9.2090302@gmail.com> +Signed-off-by: Steven Rostedt +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/trace/ring_buffer.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/kernel/trace/ring_buffer.c ++++ b/kernel/trace/ring_buffer.c +@@ -695,6 +695,7 @@ ring_buffer_free(struct ring_buffer *buf + + put_online_cpus(); + ++ kfree(buffer->buffers); + free_cpumask_var(buffer->cpumask); + + kfree(buffer); + + +From gregkh@mini.kroah.org Thu Aug 13 12:51:34 2009 +Message-Id: <20090813195134.338486356@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Thu, 13 Aug 2009 12:50:41 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Alok N Kataria , + Ingo Molnar +Subject: [patch 66/74] x86: Fix VMI && stack protector +References: <20090813194935.985368088@mini.kroah.org> +Content-Disposition: inline; filename=x86-fix-vmi-stack-protector.patch +Content-Length: 1027 +Lines: 34 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Alok Kataria + +commit 7d5b005652bc5ae3e1e0efc53fd0e25a643ec506 upstream. + +With CONFIG_STACK_PROTECTOR turned on, VMI doesn't boot with +more than one processor. The problem is with the gs value not +being initialized correctly when registering the secondary +processor for VMI's case. + +The patch below initializes the gs value for the AP to +__KERNEL_STACK_CANARY. Without this the secondary processor +keeps on taking a GP on every gs access. + +Signed-off-by: Alok N Kataria +LKML-Reference: <1249425262.18955.40.camel@ank32.eng.vmware.com> +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/vmi_32.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/x86/kernel/vmi_32.c ++++ b/arch/x86/kernel/vmi_32.c +@@ -441,7 +441,7 @@ vmi_startup_ipi_hook(int phys_apicid, un + ap.ds = __USER_DS; + ap.es = __USER_DS; + ap.fs = __KERNEL_PERCPU; +- ap.gs = 0; ++ ap.gs = __KERNEL_STACK_CANARY; + + ap.eflags = 0; + + + +From gregkh@mini.kroah.org Thu Aug 13 12:51:34 2009 +Message-Id: <20090813195134.500277035@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Thu, 13 Aug 2009 12:50:42 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Oleg Nesterov , + James Morris +Subject: [patch 67/74] mm_for_maps: simplify, use ptrace_may_access() +References: <20090813194935.985368088@mini.kroah.org> +Content-Disposition: inline; filename=mm_for_maps-simplify-use-ptrace_may_access.patch +Content-Length: 1722 +Lines: 61 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Oleg Nesterov + +commit 13f0feafa6b8aead57a2a328e2fca6a5828bf286 upstream. + +It would be nice to kill __ptrace_may_access(). It requires task_lock(), +but this lock is only needed to read mm->flags in the middle. + +Convert mm_for_maps() to use ptrace_may_access(), this also simplifies +the code a little bit. + +Also, we do not need to take ->mmap_sem in advance. In fact I think +mm_for_maps() should not play with ->mmap_sem at all, the caller should +take this lock. + +With or without this patch, without ->cred_guard_mutex held we can race +with exec() and get the new ->mm but check old creds. + +Signed-off-by: Oleg Nesterov +Reviewed-by: Serge Hallyn +Signed-off-by: James Morris +Signed-off-by: Greg Kroah-Hartman + +--- + fs/proc/base.c | 23 +++++++++++------------ + 1 file changed, 11 insertions(+), 12 deletions(-) + +--- a/fs/proc/base.c ++++ b/fs/proc/base.c +@@ -237,20 +237,19 @@ struct mm_struct *mm_for_maps(struct tas + struct mm_struct *mm = get_task_mm(task); + if (!mm) + return NULL; ++ if (mm != current->mm) { ++ /* ++ * task->mm can be changed before security check, ++ * in that case we must notice the change after. ++ */ ++ if (!ptrace_may_access(task, PTRACE_MODE_READ) || ++ mm != task->mm) { ++ mmput(mm); ++ return NULL; ++ } ++ } + down_read(&mm->mmap_sem); +- task_lock(task); +- if (task->mm != mm) +- goto out; +- if (task->mm != current->mm && +- __ptrace_may_access(task, PTRACE_MODE_READ) < 0) +- goto out; +- task_unlock(task); + return mm; +-out: +- task_unlock(task); +- up_read(&mm->mmap_sem); +- mmput(mm); +- return NULL; + } + + static int proc_pid_cmdline(struct task_struct *task, char * buffer) + + +From gregkh@mini.kroah.org Thu Aug 13 12:51:34 2009 +Message-Id: <20090813195134.630212134@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Thu, 13 Aug 2009 12:50:43 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Oleg Nesterov , + Serge Hallyn , + James Morris +Subject: [patch 68/74] mm_for_maps: shift down_read(mmap_sem) to the caller +References: <20090813194935.985368088@mini.kroah.org> +Content-Disposition: inline; filename=mm_for_maps-shift-down_read-to-the-caller.patch +Content-Length: 1786 +Lines: 66 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Oleg Nesterov + +commit 00f89d218523b9bf6b522349c039d5ac80aa536d upstream. + +mm_for_maps() takes ->mmap_sem after security checks, this looks +strange and obfuscates the locking rules. Move this lock to its +single caller, m_start(). + +Signed-off-by: Oleg Nesterov +Acked-by: Serge Hallyn +Signed-off-by: James Morris +Signed-off-by: Greg Kroah-Hartman + +--- + fs/proc/base.c | 8 +++----- + fs/proc/task_mmu.c | 1 + + fs/proc/task_nommu.c | 1 + + 3 files changed, 5 insertions(+), 5 deletions(-) + +--- a/fs/proc/base.c ++++ b/fs/proc/base.c +@@ -235,9 +235,8 @@ static int check_mem_permission(struct t + struct mm_struct *mm_for_maps(struct task_struct *task) + { + struct mm_struct *mm = get_task_mm(task); +- if (!mm) +- return NULL; +- if (mm != current->mm) { ++ ++ if (mm && mm != current->mm) { + /* + * task->mm can be changed before security check, + * in that case we must notice the change after. +@@ -245,10 +244,9 @@ struct mm_struct *mm_for_maps(struct tas + if (!ptrace_may_access(task, PTRACE_MODE_READ) || + mm != task->mm) { + mmput(mm); +- return NULL; ++ mm = NULL; + } + } +- down_read(&mm->mmap_sem); + return mm; + } + +--- a/fs/proc/task_mmu.c ++++ b/fs/proc/task_mmu.c +@@ -119,6 +119,7 @@ static void *m_start(struct seq_file *m, + mm = mm_for_maps(priv->task); + if (!mm) + return NULL; ++ down_read(&mm->mmap_sem); + + tail_vma = get_gate_vma(priv->task); + priv->tail_vma = tail_vma; +--- a/fs/proc/task_nommu.c ++++ b/fs/proc/task_nommu.c +@@ -189,6 +189,7 @@ static void *m_start(struct seq_file *m, + priv->task = NULL; + return NULL; + } ++ down_read(&mm->mmap_sem); + + /* start from the Nth VMA */ + for (p = rb_first(&mm->mm_rb); p; p = rb_next(p)) + + +From gregkh@mini.kroah.org Thu Aug 13 12:51:34 2009 +Message-Id: <20090813195134.782760213@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Thu, 13 Aug 2009 12:50:44 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Oleg Nesterov , + Serge Hallyn , + James Morris +Subject: [patch 69/74] mm_for_maps: take ->cred_guard_mutex to fix the race with exec +References: <20090813194935.985368088@mini.kroah.org> +Content-Disposition: inline; filename=mm_for_maps-take-cred_guard_mutex-to-fix-the-race-with-exec.patch +Content-Length: 1594 +Lines: 57 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Oleg Nesterov + +commit 704b836cbf19e885f8366bccb2e4b0474346c02d upstream. + +The problem is minor, but without ->cred_guard_mutex held we can race +with exec() and get the new ->mm but check old creds. + +Now we do not need to re-check task->mm after ptrace_may_access(), it +can't be changed to the new mm under us. + +Strictly speaking, this also fixes another very minor problem. Unless +security check fails or the task exits mm_for_maps() should never +return NULL, the caller should get either old or new ->mm. + +Signed-off-by: Oleg Nesterov +Acked-by: Serge Hallyn +Signed-off-by: James Morris +Signed-off-by: Greg Kroah-Hartman + +--- + fs/proc/base.c | 22 +++++++++++----------- + 1 file changed, 11 insertions(+), 11 deletions(-) + +--- a/fs/proc/base.c ++++ b/fs/proc/base.c +@@ -234,19 +234,19 @@ static int check_mem_permission(struct t + + struct mm_struct *mm_for_maps(struct task_struct *task) + { +- struct mm_struct *mm = get_task_mm(task); ++ struct mm_struct *mm; + +- if (mm && mm != current->mm) { +- /* +- * task->mm can be changed before security check, +- * in that case we must notice the change after. +- */ +- if (!ptrace_may_access(task, PTRACE_MODE_READ) || +- mm != task->mm) { +- mmput(mm); +- mm = NULL; +- } ++ if (mutex_lock_killable(&task->cred_exec_mutex)) ++ return NULL; ++ ++ mm = get_task_mm(task); ++ if (mm && mm != current->mm && ++ !ptrace_may_access(task, PTRACE_MODE_READ)) { ++ mmput(mm); ++ mm = NULL; + } ++ mutex_unlock(&task->cred_exec_mutex); ++ + return mm; + } + + + +From gregkh@mini.kroah.org Thu Aug 13 12:51:35 2009 +Message-Id: <20090813195134.928242950@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Thu, 13 Aug 2009 12:50:45 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + "David S. Miller" , + Julien TINNES , + Tavis Ormandy +Subject: [patch 70/74] Make sock_sendpage() use kernel_sendpage() +References: <20090813194935.985368088@mini.kroah.org> +Content-Disposition: inline; filename=make-sock_sendpage-use-kernel_sendpage.patch +Content-Length: 1180 +Lines: 35 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Linus Torvalds + +commit e694958388c50148389b0e9b9e9e8945cf0f1b98 upstream. + +kernel_sendpage() does the proper default case handling for when the +socket doesn't have a native sendpage implementation. + +Now, arguably this might be something that we could instead solve by +just specifying that all protocols should do it themselves at the +protocol level, but we really only care about the common protocols. +Does anybody really care about sendpage on something like Appletalk? Not +likely. + +Acked-by: David S. Miller +Acked-by: Julien TINNES +Acked-by: Tavis Ormandy +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + net/socket.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/socket.c ++++ b/net/socket.c +@@ -736,7 +736,7 @@ static ssize_t sock_sendpage(struct file + if (more) + flags |= MSG_MORE; + +- return sock->ops->sendpage(sock, page, offset, size, flags); ++ return kernel_sendpage(sock, page, offset, size, flags); + } + + static ssize_t sock_splice_read(struct file *file, loff_t *ppos, + + +From gregkh@mini.kroah.org Thu Aug 13 12:51:35 2009 +Message-Id: <20090813195135.112037059@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Thu, 13 Aug 2009 12:50:46 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + Greg KH +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Robert Richter , + Ingo Molnar , + Steven Rostedt +Subject: [patch 71/74] ring-buffer: Fix advance of reader in rb_buffer_peek() +References: <20090813194935.985368088@mini.kroah.org> +Content-Disposition: inline; filename=ring-buffer-fix-advance-of-reader-in-rb_buffer_peek.patch +Content-Length: 3069 +Lines: 85 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Robert Richter + +Backport for 2.6.30-stable of: + + 469535a ring-buffer: Fix advance of reader in rb_buffer_peek() + +When calling rb_buffer_peek() from ring_buffer_consume() and a +padding event is returned, the function rb_advance_reader() is +called twice. This may lead to missing samples or under high +workloads to the warning below. This patch fixes this. If a padding +event is returned by rb_buffer_peek() it will be consumed by the +calling function now. + +Also, I simplified some code in ring_buffer_consume(). + +------------[ cut here ]------------ +WARNING: at /dev/shm/.source/linux/kernel/trace/ring_buffer.c:2289 rb_advance_reader+0x2e/0xc5() +Hardware name: Anaheim +Modules linked in: +Pid: 29, comm: events/2 Tainted: G W 2.6.31-rc3-oprofile-x86_64-standard-00059-g5050dc2 #1 +Call Trace: +[] ? rb_advance_reader+0x2e/0xc5 +[] warn_slowpath_common+0x77/0x8f +[] warn_slowpath_null+0xf/0x11 +[] rb_advance_reader+0x2e/0xc5 +[] ring_buffer_consume+0xa0/0xd2 +[] op_cpu_buffer_read_entry+0x21/0x9e +[] ? __find_get_block+0x4b/0x165 +[] sync_buffer+0xa5/0x401 +[] ? __find_get_block+0x4b/0x165 +[] ? wq_sync_buffer+0x0/0x78 +[] wq_sync_buffer+0x5b/0x78 +[] worker_thread+0x113/0x1ac +[] ? autoremove_wake_function+0x0/0x38 +[] ? worker_thread+0x0/0x1ac +[] kthread+0x88/0x92 +[] child_rip+0xa/0x20 +[] ? kthread+0x0/0x92 +[] ? child_rip+0x0/0x20 +---[ end trace f561c0a58fcc89bd ]--- + +Cc: Steven Rostedt +Signed-off-by: Robert Richter +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/trace/ring_buffer.c | 10 ++++------ + 1 file changed, 4 insertions(+), 6 deletions(-) + +--- a/kernel/trace/ring_buffer.c ++++ b/kernel/trace/ring_buffer.c +@@ -2102,7 +2102,6 @@ rb_buffer_peek(struct ring_buffer *buffe + * the box. Return the padding, and we will release + * the current locks, and try again. + */ +- rb_advance_reader(cpu_buffer); + return event; + + case RINGBUF_TYPE_TIME_EXTEND: +@@ -2219,6 +2218,8 @@ ring_buffer_peek(struct ring_buffer *buf + again: + spin_lock_irqsave(&cpu_buffer->reader_lock, flags); + event = rb_buffer_peek(buffer, cpu, ts); ++ if (event && event->type == RINGBUF_TYPE_PADDING) ++ rb_advance_reader(cpu_buffer); + spin_unlock_irqrestore(&cpu_buffer->reader_lock, flags); + + if (event && event->type == RINGBUF_TYPE_PADDING) { +@@ -2283,12 +2284,9 @@ ring_buffer_consume(struct ring_buffer * + spin_lock_irqsave(&cpu_buffer->reader_lock, flags); + + event = rb_buffer_peek(buffer, cpu, ts); +- if (!event) +- goto out_unlock; +- +- rb_advance_reader(cpu_buffer); ++ if (event) ++ rb_advance_reader(cpu_buffer); + +- out_unlock: + spin_unlock_irqrestore(&cpu_buffer->reader_lock, flags); + + out: + + +From gregkh@mini.kroah.org Thu Aug 13 12:51:35 2009 +Message-Id: <20090813195135.282259870@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Thu, 13 Aug 2009 12:50:47 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Trond Myklebust +Subject: [patch 72/74] NFS: Fix an O_DIRECT Oops... +References: <20090813194935.985368088@mini.kroah.org> +Content-Disposition: inline; filename=nfs-fix-an-o_direct-oops.patch +Content-Length: 7035 +Lines: 208 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Trond Myklebust + +commit 1ae88b2e446261c038f2c0c3150ffae142b227a2 upstream. + +We can't call nfs_readdata_release()/nfs_writedata_release() without +first initialising and referencing args.context. Doing so inside +nfs_direct_read_schedule_segment()/nfs_direct_write_schedule_segment() +causes an Oops. + +We should rather be calling nfs_readdata_free()/nfs_writedata_free() in +those cases. + +Looking at the O_DIRECT code, the "struct nfs_direct_req" is already +referencing the nfs_open_context for us. Since the readdata and writedata +structures carry a reference to that, we can simplify things by getting rid +of the extra nfs_open_context references, so that we can replace all +instances of nfs_readdata_release()/nfs_writedata_release(). + +Reported-by: Catalin Marinas +Signed-off-by: Trond Myklebust +Tested-by: Catalin Marinas +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + fs/nfs/direct.c | 20 ++++++++++---------- + fs/nfs/read.c | 6 ++---- + fs/nfs/write.c | 6 ++---- + include/linux/nfs_fs.h | 5 ++--- + 4 files changed, 16 insertions(+), 21 deletions(-) + +--- a/fs/nfs/direct.c ++++ b/fs/nfs/direct.c +@@ -255,7 +255,7 @@ static void nfs_direct_read_release(void + + if (put_dreq(dreq)) + nfs_direct_complete(dreq); +- nfs_readdata_release(calldata); ++ nfs_readdata_free(data); + } + + static const struct rpc_call_ops nfs_read_direct_ops = { +@@ -311,14 +311,14 @@ static ssize_t nfs_direct_read_schedule_ + data->npages, 1, 0, data->pagevec, NULL); + up_read(¤t->mm->mmap_sem); + if (result < 0) { +- nfs_readdata_release(data); ++ nfs_readdata_free(data); + break; + } + if ((unsigned)result < data->npages) { + bytes = result * PAGE_SIZE; + if (bytes <= pgbase) { + nfs_direct_release_pages(data->pagevec, result); +- nfs_readdata_release(data); ++ nfs_readdata_free(data); + break; + } + bytes -= pgbase; +@@ -331,7 +331,7 @@ static ssize_t nfs_direct_read_schedule_ + data->inode = inode; + data->cred = msg.rpc_cred; + data->args.fh = NFS_FH(inode); +- data->args.context = get_nfs_open_context(ctx); ++ data->args.context = ctx; + data->args.offset = pos; + data->args.pgbase = pgbase; + data->args.pages = data->pagevec; +@@ -438,7 +438,7 @@ static void nfs_direct_free_writedata(st + struct nfs_write_data *data = list_entry(dreq->rewrite_list.next, struct nfs_write_data, pages); + list_del(&data->pages); + nfs_direct_release_pages(data->pagevec, data->npages); +- nfs_writedata_release(data); ++ nfs_writedata_free(data); + } + } + +@@ -531,7 +531,7 @@ static void nfs_direct_commit_release(vo + + dprintk("NFS: %5u commit returned %d\n", data->task.tk_pid, status); + nfs_direct_write_complete(dreq, data->inode); +- nfs_commitdata_release(calldata); ++ nfs_commit_free(data); + } + + static const struct rpc_call_ops nfs_commit_direct_ops = { +@@ -564,7 +564,7 @@ static void nfs_direct_commit_schedule(s + data->args.fh = NFS_FH(data->inode); + data->args.offset = 0; + data->args.count = 0; +- data->args.context = get_nfs_open_context(dreq->ctx); ++ data->args.context = dreq->ctx; + data->res.count = 0; + data->res.fattr = &data->fattr; + data->res.verf = &data->verf; +@@ -725,14 +725,14 @@ static ssize_t nfs_direct_write_schedule + data->npages, 0, 0, data->pagevec, NULL); + up_read(¤t->mm->mmap_sem); + if (result < 0) { +- nfs_writedata_release(data); ++ nfs_writedata_free(data); + break; + } + if ((unsigned)result < data->npages) { + bytes = result * PAGE_SIZE; + if (bytes <= pgbase) { + nfs_direct_release_pages(data->pagevec, result); +- nfs_writedata_release(data); ++ nfs_writedata_free(data); + break; + } + bytes -= pgbase; +@@ -747,7 +747,7 @@ static ssize_t nfs_direct_write_schedule + data->inode = inode; + data->cred = msg.rpc_cred; + data->args.fh = NFS_FH(inode); +- data->args.context = get_nfs_open_context(ctx); ++ data->args.context = ctx; + data->args.offset = pos; + data->args.pgbase = pgbase; + data->args.pages = data->pagevec; +--- a/fs/nfs/read.c ++++ b/fs/nfs/read.c +@@ -59,17 +59,15 @@ struct nfs_read_data *nfs_readdata_alloc + return p; + } + +-static void nfs_readdata_free(struct nfs_read_data *p) ++void nfs_readdata_free(struct nfs_read_data *p) + { + if (p && (p->pagevec != &p->page_array[0])) + kfree(p->pagevec); + mempool_free(p, nfs_rdata_mempool); + } + +-void nfs_readdata_release(void *data) ++static void nfs_readdata_release(struct nfs_read_data *rdata) + { +- struct nfs_read_data *rdata = data; +- + put_nfs_open_context(rdata->args.context); + nfs_readdata_free(rdata); + } +--- a/fs/nfs/write.c ++++ b/fs/nfs/write.c +@@ -84,17 +84,15 @@ struct nfs_write_data *nfs_writedata_all + return p; + } + +-static void nfs_writedata_free(struct nfs_write_data *p) ++void nfs_writedata_free(struct nfs_write_data *p) + { + if (p && (p->pagevec != &p->page_array[0])) + kfree(p->pagevec); + mempool_free(p, nfs_wdata_mempool); + } + +-void nfs_writedata_release(void *data) ++static void nfs_writedata_release(struct nfs_write_data *wdata) + { +- struct nfs_write_data *wdata = data; +- + put_nfs_open_context(wdata->args.context); + nfs_writedata_free(wdata); + } +--- a/include/linux/nfs_fs.h ++++ b/include/linux/nfs_fs.h +@@ -473,7 +473,6 @@ extern int nfs_writepages(struct addres + extern int nfs_flush_incompatible(struct file *file, struct page *page); + extern int nfs_updatepage(struct file *, struct page *, unsigned int, unsigned int); + extern int nfs_writeback_done(struct rpc_task *, struct nfs_write_data *); +-extern void nfs_writedata_release(void *); + + /* + * Try to write back everything synchronously (but check the +@@ -488,7 +487,6 @@ extern int nfs_wb_page_cancel(struct ino + extern int nfs_commit_inode(struct inode *, int); + extern struct nfs_write_data *nfs_commitdata_alloc(void); + extern void nfs_commit_free(struct nfs_write_data *wdata); +-extern void nfs_commitdata_release(void *wdata); + #else + static inline int + nfs_commit_inode(struct inode *inode, int how) +@@ -507,6 +505,7 @@ nfs_have_writebacks(struct inode *inode) + * Allocate nfs_write_data structures + */ + extern struct nfs_write_data *nfs_writedata_alloc(unsigned int npages); ++extern void nfs_writedata_free(struct nfs_write_data *); + + /* + * linux/fs/nfs/read.c +@@ -515,7 +514,6 @@ extern int nfs_readpage(struct file *, + extern int nfs_readpages(struct file *, struct address_space *, + struct list_head *, unsigned); + extern int nfs_readpage_result(struct rpc_task *, struct nfs_read_data *); +-extern void nfs_readdata_release(void *data); + extern int nfs_readpage_async(struct nfs_open_context *, struct inode *, + struct page *); + +@@ -523,6 +521,7 @@ extern int nfs_readpage_async(struct nf + * Allocate nfs_read_data structures + */ + extern struct nfs_read_data *nfs_readdata_alloc(unsigned int npages); ++extern void nfs_readdata_free(struct nfs_read_data *); + + /* + * linux/fs/nfs3proc.c + + +From gregkh@mini.kroah.org Thu Aug 13 12:51:35 2009 +Message-Id: <20090813195135.441844749@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Thu, 13 Aug 2009 12:50:48 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Takashi Iwai +Subject: [patch 73/74] ALSA: hda - Add missing vmaster initialization for ALC269 +References: <20090813194935.985368088@mini.kroah.org> +Content-Disposition: inline; filename=alsa-hda-add-missing-vmaster-initialization-for-alc269.patch +Content-Length: 799 +Lines: 29 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Takashi Iwai + +commit 100d5eb36ba20dc0b99a17ea2b9800c567bfc3d1 upstream. + +Without the initialization of vmaster NID, the dB information got +confused for ALC269 codec. + +Reference: Novell bnc#527361 + https://bugzilla.novell.com/show_bug.cgi?id=527361 + +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_realtek.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -13150,6 +13150,8 @@ static int patch_alc269(struct hda_codec + set_capture_mixer(spec); + set_beep_amp(spec, 0x0b, 0x04, HDA_INPUT); + ++ spec->vmaster_nid = 0x02; ++ + codec->patch_ops = alc_patch_ops; + if (board_config == ALC269_AUTO) + spec->init_hook = alc269_auto_init; + + +From gregkh@mini.kroah.org Thu Aug 13 12:51:35 2009 +Message-Id: <20090813195135.602994150@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Thu, 13 Aug 2009 12:50:49 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Maxime Bizon , + Bartlomiej Zolnierkiewicz , + "David S. Miller" , + Simon Kirby +Subject: [patch 74/74] ide: fix memory leak when flush command is issued +References: <20090813194935.985368088@mini.kroah.org> +Content-Disposition: inline; filename=ide-fix-memory-leak-when-flush-command-is-issued.patch +Content-Length: 1228 +Lines: 36 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Maxime Bizon + +commit bc146d23d1358af43f03793c3ad8c9f16bbcffcb upstream. + +I'm using ide on 2.6.30.1 with xfs filesystem. I noticed a kernel memory +leak after writing lots of data, the kmalloc-96 slab cache keeps +growing. It seems the struct ide_cmd kmalloced by idedisk_prepare_flush +is never kfreed. + +Commit a09485df9cda49fbde2766c86eb18a9cae585162 ("ide: move request +type specific code from ide_end_drive_cmd() to callers (v3)") and +f505d49ffd25ed062e76ffd17568d3937fcd338c ("ide: fix barriers support") +cause this regression, cmd->rq must now be set for ide_complete_cmd to +honor the IDE_TFLAG_DYN flag. + +Signed-off-by: Maxime Bizon +Acked-by: Bartlomiej Zolnierkiewicz +Signed-off-by: David S. Miller +Cc: Simon Kirby +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ide/ide-disk.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/ide/ide-disk.c ++++ b/drivers/ide/ide-disk.c +@@ -413,6 +413,7 @@ static void idedisk_prepare_flush(struct + rq->cmd_type = REQ_TYPE_ATA_TASKFILE; + rq->cmd_flags |= REQ_SOFTBARRIER; + rq->special = cmd; ++ cmd->rq = rq; + } + + ide_devset_get(multcount, mult_count); + + +From gregkh@mini.kroah.org Thu Aug 13 12:51:24 2009 +Message-Id: <20090813194935.985368088@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Thu, 13 Aug 2009 12:49:35 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk +Subject: [patch 00/74] 2.6.30.5-stable review +Content-Length: 6801 +Lines: 123 + +This is the start of the stable review cycle for the 2.6.30.5 release. +There are 74 patches in this series, all will be posted as a response to +this one. If anyone has any issues with these being applied, please let +us know. If anyone is a maintainer of the proper subsystem, and wants +to add a Signed-off-by: line to the patch, please respond with it. + +These patches are sent out with a number of different people on the Cc: +line. If you wish to be a reviewer, please email stable@kernel.org to +add your name to the list. If you want to be off the reviewer list, +also email us. + +Responses should be made by Saturday, August 15, 2009 19:00:00 UTC. +Anything received after that time might be too late. + +The whole patch series can be found in one patch at: + kernel.org/pub/linux/kernel/v2.6/stable-review/patch-2.6.30.5-rc1.gz +and the diffstat can be found below. + + +thanks, + +greg k-h + +---------------- + + Makefile | 2 +- + arch/powerpc/boot/dts/asp834x-redboot.dts | 2 +- + arch/powerpc/boot/dts/mpc8349emitx.dts | 2 +- + arch/powerpc/boot/dts/mpc834x_mds.dts | 2 +- + arch/powerpc/boot/dts/sbc8349.dts | 2 +- + arch/powerpc/platforms/83xx/mpc83xx.h | 4 +- + arch/powerpc/platforms/83xx/usb.c | 10 ++-- + arch/x86/include/asm/irqflags.h | 8 +++- + arch/x86/kernel/vmi_32.c | 2 +- + arch/x86/mm/pageattr.c | 39 ++++++++++---- + block/Kconfig | 11 +++-- + drivers/acpi/sleep.c | 8 +++ + drivers/edac/x38_edac.c | 2 +- + drivers/firewire/fw-sbp2.c | 10 +++- + drivers/gpu/drm/i915/i915_dma.c | 5 ++- + drivers/gpu/drm/i915/i915_drv.h | 8 +++ + drivers/gpu/drm/i915/i915_gem.c | 13 +++++ + drivers/gpu/drm/i915/i915_irq.c | 2 - + drivers/gpu/drm/i915/i915_suspend.c | 20 +++++++ + drivers/gpu/drm/i915/intel_bios.c | 10 ++-- + drivers/gpu/drm/i915/intel_display.c | 2 + + drivers/gpu/drm/i915/intel_fb.c | 8 +++- + drivers/gpu/drm/i915/intel_lvds.c | 17 +++++- + drivers/hwmon/asus_atk0110.c | 6 ++- + drivers/hwmon/smsc47m1.c | 11 ++++ + drivers/i2c/chips/tsl2550.c | 17 ++++--- + drivers/ide/ide-disk.c | 1 + + drivers/ide/ide-dma.c | 21 ------- + drivers/ide/ide-iops.c | 3 - + drivers/ide/ide-probe.c | 23 +++++++- + drivers/ieee1394/sbp2.c | 1 + + drivers/ieee1394/sbp2.h | 8 +++- + drivers/md/md.c | 15 +++++- + drivers/md/raid5.c | 26 ++++----- + drivers/net/atl1c/atl1c.h | 8 ++-- + drivers/net/atl1c/atl1c_ethtool.c | 2 +- + drivers/net/atl1c/atl1c_main.c | 2 +- + drivers/net/benet/be.h | 2 +- + drivers/net/benet/be_ethtool.c | 4 +- + drivers/net/benet/be_main.c | 45 +++++++++++----- + drivers/net/e100.c | 3 + + drivers/net/sky2.c | 2 +- + drivers/net/usb/cdc_subset.c | 7 ++- + drivers/net/wireless/iwlwifi/iwl-agn.c | 19 +------ + drivers/net/wireless/iwlwifi/iwl3945-base.c | 19 +------ + drivers/parisc/eisa_eeprom.c | 2 +- + drivers/platform/x86/Kconfig | 4 +- + drivers/platform/x86/thinkpad_acpi.c | 61 +++++++++++++++++----- + drivers/scsi/libsas/sas_port.c | 19 +++++-- + drivers/staging/rt2870/2870_main_dev.c | 67 ++++++++++++++++-------- + drivers/staging/rt2870/common/2870_rtmp_init.c | 35 ++++++------- + drivers/staging/rt2870/common/cmm_data.c | 3 + + drivers/staging/rt2870/common/rtmp_init.c | 2 +- + drivers/staging/rt2870/common/rtusb_io.c | 3 +- + drivers/staging/rt2870/rt2870.h | 6 +-- + drivers/staging/rt2870/rt_linux.h | 11 ++-- + drivers/usb/core/devio.c | 10 ++-- + drivers/usb/serial/ftdi_sio.c | 3 + + drivers/usb/serial/ftdi_sio.h | 14 +++++ + drivers/usb/storage/transport.c | 2 +- + drivers/usb/storage/unusual_devs.h | 7 +++ + fs/binfmt_flat.c | 17 ++++-- + fs/cifs/cifs_dfs_ref.c | 12 +++- + fs/cifs/connect.c | 13 ++++- + fs/compat_ioctl.c | 1 + + fs/nfs/direct.c | 20 ++++---- + fs/nfs/read.c | 6 +-- + fs/nfs/write.c | 6 +-- + fs/nilfs2/segment.c | 16 +++++- + fs/proc/base.c | 27 ++++----- + fs/proc/task_mmu.c | 1 + + fs/proc/task_nommu.c | 1 + + fs/sysfs/dir.c | 2 + + include/linux/ide.h | 2 - + include/linux/netdevice.h | 5 +- + include/linux/nfs_fs.h | 5 +- + include/net/sctp/sctp.h | 1 + + include/net/sock.h | 34 +++++++----- + kernel/fork.c | 22 ++++---- + kernel/posix-timers.c | 7 +++ + kernel/smp.c | 2 +- + kernel/trace/ring_buffer.c | 11 ++-- + kernel/trace/trace.c | 10 +++- + kernel/trace/trace_functions_graph.c | 11 +++- + mm/hugetlb.c | 2 +- + mm/page_alloc.c | 13 +++-- + net/ax25/ax25_in.c | 3 +- + net/core/dev.c | 10 ++-- + net/core/sock.c | 39 ++++++++++++-- + net/ipv4/ip_input.c | 3 + + net/ipv6/ip6_input.c | 3 + + net/irda/af_irda.c | 3 - + net/irda/ircomm/ircomm_lmp.c | 1 + + net/socket.c | 2 +- + net/wireless/scan.c | 4 +- + net/xfrm/xfrm_algo.c | 4 +- + sound/pci/hda/patch_realtek.c | 2 + + 97 files changed, 659 insertions(+), 345 deletions(-) + diff --git a/queue-2.6.30/md-handle-growth-of-v1.x-metadata-correctly.patch b/review-2.6.30/md-handle-growth-of-v1.x-metadata-correctly.patch similarity index 100% rename from queue-2.6.30/md-handle-growth-of-v1.x-metadata-correctly.patch rename to review-2.6.30/md-handle-growth-of-v1.x-metadata-correctly.patch diff --git a/queue-2.6.30/md-raid6-release-spare-page-at-stop.patch b/review-2.6.30/md-raid6-release-spare-page-at-stop.patch similarity index 100% rename from queue-2.6.30/md-raid6-release-spare-page-at-stop.patch rename to review-2.6.30/md-raid6-release-spare-page-at-stop.patch diff --git a/queue-2.6.30/md-when-a-level-change-reduces-the-number-of-devices-remove-the-excess.patch b/review-2.6.30/md-when-a-level-change-reduces-the-number-of-devices-remove-the-excess.patch similarity index 100% rename from queue-2.6.30/md-when-a-level-change-reduces-the-number-of-devices-remove-the-excess.patch rename to review-2.6.30/md-when-a-level-change-reduces-the-number-of-devices-remove-the-excess.patch diff --git a/queue-2.6.30/mm_for_maps-shift-down_read-to-the-caller.patch b/review-2.6.30/mm_for_maps-shift-down_read-to-the-caller.patch similarity index 100% rename from queue-2.6.30/mm_for_maps-shift-down_read-to-the-caller.patch rename to review-2.6.30/mm_for_maps-shift-down_read-to-the-caller.patch diff --git a/queue-2.6.30/mm_for_maps-simplify-use-ptrace_may_access.patch b/review-2.6.30/mm_for_maps-simplify-use-ptrace_may_access.patch similarity index 100% rename from queue-2.6.30/mm_for_maps-simplify-use-ptrace_may_access.patch rename to review-2.6.30/mm_for_maps-simplify-use-ptrace_may_access.patch diff --git a/queue-2.6.30/mm_for_maps-take-cred_guard_mutex-to-fix-the-race-with-exec.patch b/review-2.6.30/mm_for_maps-take-cred_guard_mutex-to-fix-the-race-with-exec.patch similarity index 100% rename from queue-2.6.30/mm_for_maps-take-cred_guard_mutex-to-fix-the-race-with-exec.patch rename to review-2.6.30/mm_for_maps-take-cred_guard_mutex-to-fix-the-race-with-exec.patch diff --git a/queue-2.6.30/net-move-rx-skb_orphan-call-to-where-needed.patch b/review-2.6.30/net-move-rx-skb_orphan-call-to-where-needed.patch similarity index 100% rename from queue-2.6.30/net-move-rx-skb_orphan-call-to-where-needed.patch rename to review-2.6.30/net-move-rx-skb_orphan-call-to-where-needed.patch diff --git a/queue-2.6.30/net-sk_prot_alloc-should-not-blindly-overwrite-memory.patch b/review-2.6.30/net-sk_prot_alloc-should-not-blindly-overwrite-memory.patch similarity index 100% rename from queue-2.6.30/net-sk_prot_alloc-should-not-blindly-overwrite-memory.patch rename to review-2.6.30/net-sk_prot_alloc-should-not-blindly-overwrite-memory.patch diff --git a/queue-2.6.30/net-sock_copy-fixes.patch b/review-2.6.30/net-sock_copy-fixes.patch similarity index 100% rename from queue-2.6.30/net-sock_copy-fixes.patch rename to review-2.6.30/net-sock_copy-fixes.patch diff --git a/queue-2.6.30/nfs-fix-an-o_direct-oops.patch b/review-2.6.30/nfs-fix-an-o_direct-oops.patch similarity index 100% rename from queue-2.6.30/nfs-fix-an-o_direct-oops.patch rename to review-2.6.30/nfs-fix-an-o_direct-oops.patch diff --git a/queue-2.6.30/nilfs2-fix-oops-due-to-inconsistent-state-in-page-with-discrete-b-tree-nodes.patch b/review-2.6.30/nilfs2-fix-oops-due-to-inconsistent-state-in-page-with-discrete-b-tree-nodes.patch similarity index 100% rename from queue-2.6.30/nilfs2-fix-oops-due-to-inconsistent-state-in-page-with-discrete-b-tree-nodes.patch rename to review-2.6.30/nilfs2-fix-oops-due-to-inconsistent-state-in-page-with-discrete-b-tree-nodes.patch diff --git a/queue-2.6.30/page-allocator-preserve-pfn-ordering-when-__gfp_cold-is-set.patch b/review-2.6.30/page-allocator-preserve-pfn-ordering-when-__gfp_cold-is-set.patch similarity index 100% rename from queue-2.6.30/page-allocator-preserve-pfn-ordering-when-__gfp_cold-is-set.patch rename to review-2.6.30/page-allocator-preserve-pfn-ordering-when-__gfp_cold-is-set.patch diff --git a/queue-2.6.30/parisc-isa-eeprom-fix-loff_t-usage.patch b/review-2.6.30/parisc-isa-eeprom-fix-loff_t-usage.patch similarity index 100% rename from queue-2.6.30/parisc-isa-eeprom-fix-loff_t-usage.patch rename to review-2.6.30/parisc-isa-eeprom-fix-loff_t-usage.patch diff --git a/queue-2.6.30/pm-acpi-hp-g7000-notebook-needs-a-sci_en-resume-quirk.patch b/review-2.6.30/pm-acpi-hp-g7000-notebook-needs-a-sci_en-resume-quirk.patch similarity index 100% rename from queue-2.6.30/pm-acpi-hp-g7000-notebook-needs-a-sci_en-resume-quirk.patch rename to review-2.6.30/pm-acpi-hp-g7000-notebook-needs-a-sci_en-resume-quirk.patch diff --git a/queue-2.6.30/posix-timers-fix-oops-in-clock_nanosleep-with-clock_monotonic_raw.patch b/review-2.6.30/posix-timers-fix-oops-in-clock_nanosleep-with-clock_monotonic_raw.patch similarity index 100% rename from queue-2.6.30/posix-timers-fix-oops-in-clock_nanosleep-with-clock_monotonic_raw.patch rename to review-2.6.30/posix-timers-fix-oops-in-clock_nanosleep-with-clock_monotonic_raw.patch diff --git a/queue-2.6.30/powerpc-mpc83xx-fix-usb-mux-setup-for-mpc834x.patch b/review-2.6.30/powerpc-mpc83xx-fix-usb-mux-setup-for-mpc834x.patch similarity index 100% rename from queue-2.6.30/powerpc-mpc83xx-fix-usb-mux-setup-for-mpc834x.patch rename to review-2.6.30/powerpc-mpc83xx-fix-usb-mux-setup-for-mpc834x.patch diff --git a/queue-2.6.30/ring-buffer-fix-advance-of-reader-in-rb_buffer_peek.patch b/review-2.6.30/ring-buffer-fix-advance-of-reader-in-rb_buffer_peek.patch similarity index 100% rename from queue-2.6.30/ring-buffer-fix-advance-of-reader-in-rb_buffer_peek.patch rename to review-2.6.30/ring-buffer-fix-advance-of-reader-in-rb_buffer_peek.patch diff --git a/queue-2.6.30/ring-buffer-fix-memleak-in-ring_buffer_free.patch b/review-2.6.30/ring-buffer-fix-memleak-in-ring_buffer_free.patch similarity index 100% rename from queue-2.6.30/ring-buffer-fix-memleak-in-ring_buffer_free.patch rename to review-2.6.30/ring-buffer-fix-memleak-in-ring_buffer_free.patch diff --git a/queue-2.6.30/series b/review-2.6.30/series similarity index 100% rename from queue-2.6.30/series rename to review-2.6.30/series diff --git a/queue-2.6.30/sky2-fix-checksum-endianness.patch b/review-2.6.30/sky2-fix-checksum-endianness.patch similarity index 100% rename from queue-2.6.30/sky2-fix-checksum-endianness.patch rename to review-2.6.30/sky2-fix-checksum-endianness.patch diff --git a/queue-2.6.30/staging-rt2870-revert-d44ca7-removal-of-kernel_thread-api.patch b/review-2.6.30/staging-rt2870-revert-d44ca7-removal-of-kernel_thread-api.patch similarity index 100% rename from queue-2.6.30/staging-rt2870-revert-d44ca7-removal-of-kernel_thread-api.patch rename to review-2.6.30/staging-rt2870-revert-d44ca7-removal-of-kernel_thread-api.patch diff --git a/queue-2.6.30/sysfs-fix-hardlink-count-on-device_move.patch b/review-2.6.30/sysfs-fix-hardlink-count-on-device_move.patch similarity index 100% rename from queue-2.6.30/sysfs-fix-hardlink-count-on-device_move.patch rename to review-2.6.30/sysfs-fix-hardlink-count-on-device_move.patch diff --git a/queue-2.6.30/thinkpad-acpi-disable-broken-bay-and-dock-subdrivers.patch b/review-2.6.30/thinkpad-acpi-disable-broken-bay-and-dock-subdrivers.patch similarity index 100% rename from queue-2.6.30/thinkpad-acpi-disable-broken-bay-and-dock-subdrivers.patch rename to review-2.6.30/thinkpad-acpi-disable-broken-bay-and-dock-subdrivers.patch diff --git a/queue-2.6.30/thinkpad-acpi-fix-incorrect-use-of-tpacpi_brght_mode_ecnvram.patch b/review-2.6.30/thinkpad-acpi-fix-incorrect-use-of-tpacpi_brght_mode_ecnvram.patch similarity index 100% rename from queue-2.6.30/thinkpad-acpi-fix-incorrect-use-of-tpacpi_brght_mode_ecnvram.patch rename to review-2.6.30/thinkpad-acpi-fix-incorrect-use-of-tpacpi_brght_mode_ecnvram.patch diff --git a/queue-2.6.30/tracing-fix-invalid-function_graph-entry.patch b/review-2.6.30/tracing-fix-invalid-function_graph-entry.patch similarity index 100% rename from queue-2.6.30/tracing-fix-invalid-function_graph-entry.patch rename to review-2.6.30/tracing-fix-invalid-function_graph-entry.patch diff --git a/queue-2.6.30/tracing-fix-missing-function_graph-events-when-we-splice_read-from-trace_pipe.patch b/review-2.6.30/tracing-fix-missing-function_graph-events-when-we-splice_read-from-trace_pipe.patch similarity index 100% rename from queue-2.6.30/tracing-fix-missing-function_graph-events-when-we-splice_read-from-trace_pipe.patch rename to review-2.6.30/tracing-fix-missing-function_graph-events-when-we-splice_read-from-trace_pipe.patch diff --git a/queue-2.6.30/usb-devio-properly-do-access_ok-checks.patch b/review-2.6.30/usb-devio-properly-do-access_ok-checks.patch similarity index 100% rename from queue-2.6.30/usb-devio-properly-do-access_ok-checks.patch rename to review-2.6.30/usb-devio-properly-do-access_ok-checks.patch diff --git a/queue-2.6.30/usb-ftdi_sio-add-product_id-for-marvell-openrd-base-client.patch b/review-2.6.30/usb-ftdi_sio-add-product_id-for-marvell-openrd-base-client.patch similarity index 100% rename from queue-2.6.30/usb-ftdi_sio-add-product_id-for-marvell-openrd-base-client.patch rename to review-2.6.30/usb-ftdi_sio-add-product_id-for-marvell-openrd-base-client.patch diff --git a/queue-2.6.30/usb-ftdi_sio-add-vendor-and-product-id-for-bayer-glucose-meter-serial-converter-cable.patch b/review-2.6.30/usb-ftdi_sio-add-vendor-and-product-id-for-bayer-glucose-meter-serial-converter-cable.patch similarity index 100% rename from queue-2.6.30/usb-ftdi_sio-add-vendor-and-product-id-for-bayer-glucose-meter-serial-converter-cable.patch rename to review-2.6.30/usb-ftdi_sio-add-vendor-and-product-id-for-bayer-glucose-meter-serial-converter-cable.patch diff --git a/queue-2.6.30/usb-storage-include-prolific-technology-usb-drive-in-unusual_devs-list.patch b/review-2.6.30/usb-storage-include-prolific-technology-usb-drive-in-unusual_devs-list.patch similarity index 100% rename from queue-2.6.30/usb-storage-include-prolific-technology-usb-drive-in-unusual_devs-list.patch rename to review-2.6.30/usb-storage-include-prolific-technology-usb-drive-in-unusual_devs-list.patch diff --git a/queue-2.6.30/usb-storage-raise-timeout-in-usb_stor_bulk_max_lun.patch b/review-2.6.30/usb-storage-raise-timeout-in-usb_stor_bulk_max_lun.patch similarity index 100% rename from queue-2.6.30/usb-storage-raise-timeout-in-usb_stor_bulk_max_lun.patch rename to review-2.6.30/usb-storage-raise-timeout-in-usb_stor_bulk_max_lun.patch diff --git a/queue-2.6.30/usb-usbfs-fix-enoent-error-code-to-be-enodev.patch b/review-2.6.30/usb-usbfs-fix-enoent-error-code-to-be-enodev.patch similarity index 100% rename from queue-2.6.30/usb-usbfs-fix-enoent-error-code-to-be-enodev.patch rename to review-2.6.30/usb-usbfs-fix-enoent-error-code-to-be-enodev.patch diff --git a/queue-2.6.30/usbnet-cdc_subset-fix-issues-talking-to-pxa-gadgets.patch b/review-2.6.30/usbnet-cdc_subset-fix-issues-talking-to-pxa-gadgets.patch similarity index 100% rename from queue-2.6.30/usbnet-cdc_subset-fix-issues-talking-to-pxa-gadgets.patch rename to review-2.6.30/usbnet-cdc_subset-fix-issues-talking-to-pxa-gadgets.patch diff --git a/queue-2.6.30/x86-fix-assembly-constraints-in-native_save_fl.patch b/review-2.6.30/x86-fix-assembly-constraints-in-native_save_fl.patch similarity index 100% rename from queue-2.6.30/x86-fix-assembly-constraints-in-native_save_fl.patch rename to review-2.6.30/x86-fix-assembly-constraints-in-native_save_fl.patch diff --git a/queue-2.6.30/x86-fix-cpa-memtype-reserving-in-the-set_pages_array-cases.patch b/review-2.6.30/x86-fix-cpa-memtype-reserving-in-the-set_pages_array-cases.patch similarity index 100% rename from queue-2.6.30/x86-fix-cpa-memtype-reserving-in-the-set_pages_array-cases.patch rename to review-2.6.30/x86-fix-cpa-memtype-reserving-in-the-set_pages_array-cases.patch diff --git a/queue-2.6.30/x86-fix-vmi-stack-protector.patch b/review-2.6.30/x86-fix-vmi-stack-protector.patch similarity index 100% rename from queue-2.6.30/x86-fix-vmi-stack-protector.patch rename to review-2.6.30/x86-fix-vmi-stack-protector.patch diff --git a/queue-2.6.30/x86-pat-fix-set_memory_wc-related-corruption.patch b/review-2.6.30/x86-pat-fix-set_memory_wc-related-corruption.patch similarity index 100% rename from queue-2.6.30/x86-pat-fix-set_memory_wc-related-corruption.patch rename to review-2.6.30/x86-pat-fix-set_memory_wc-related-corruption.patch